Function cbm_cmd_update

src/cli/cli.c:11503–11707

#endif /* CBM_CLI_ENABLE_TEST_API */

int cbm_cmd_update(int argc, char **argv) {
    parse_auto_answer(argc, argv);

    bool dry_run = false;
    bool force = false;
    int variant_flag = 0; /* 0 = ask, 1 = standard, 2 = ui */
    for (int i = 0; i < argc; i++) {
        if (strcmp(argv[i], "--dry-run") == 0) {
            dry_run = true;
        } else if (strcmp(argv[i], "--standard") == 0) {
            variant_flag = VARIANT_A;
        } else if (strcmp(argv[i], "--ui") == 0) {
            variant_flag = VARIANT_B;
        } else if (strcmp(argv[i], "--force") == 0) {
            force = true;
        } else if (strcmp(argv[i], "-y") != 0 && strcmp(argv[i], "--yes") != 0 &&
                   strcmp(argv[i], "-n") != 0 && strcmp(argv[i], "--no") != 0) {
            (void)fprintf(stderr, "error: unknown update option: %s\n", argv[i]);
            return CLI_TRUE;
        }
    }

    /* Updates run from the install script, not from this process — on every
     * platform.
     *
     * Windows forced the split first: a running .exe cannot replace itself, so
     * an in-process updater needed a second resident binary to swap the first
     * one out, and that launcher stub was exactly the shape Defender's ML
     * scores as a dropper.
     *
     * The rest followed for the same reason rather than a different one. An
     * in-process updater is, structurally, a downloader: it fetches a remote
     * archive, extracts it, marks the result executable and runs it. That is
     * the behaviour Microsoft's Wacatac family describes almost verbatim, and
     * carrying it in the product binary put download/extract/chmod/exec in
     * every shipped artifact for a command most users run a handful of times.
     *
     * The install script already does all of it, is idempotent -- so re-running
     * it IS the update -- and runs while cbm is NOT running. Print the exact
     * command instead of feigning self-update. */
#ifndef CBM_CLI_ENABLE_TEST_API
    /* A release build has nothing to do but hand off. The flags are still
     * parsed and validated above, so `update --dry-run` and friends keep
     * rejecting typos instead of silently accepting them. */
    (void)dry_run;
    (void)force;
    (void)variant_flag;
#endif
#ifdef CBM_CLI_ENABLE_TEST_API
    if (g_cli_activation_test_ops_set) {
        (void)fprintf(stderr, "*** cbm test seam: portable update flow engaged; the "
                              "script-update handoff is bypassed (test builds only) ***\n");
    } else
#endif
    {
        char self_dir[CLI_BUF_1K] = {0};
        bool have_dir = false;
        /* cbm_detect_self_path resolves wide on Windows (non-ASCII install