Feat/serve auto freshen

.github/workflows/release.yml

@@ -1,8 +1,9 @@
 name: release
 
 # Build prebuilt `synaptic` binaries for Linux/macOS/Windows and attach them to
-# the GitHub Release when a `v*` tag is pushed. Run manually via workflow_dispatch
-# to smoke-test the build matrix without cutting a release.
+# the GitHub Release when a `v*` tag is pushed, and sync the `wiki/` directory to
+# the GitHub wiki. Run manually via workflow_dispatch to smoke-test the build
+# matrix (and re-sync the wiki) without cutting a release.
 on:
   push:
     tags: ["v*"]
@@ -47,15 +48,19 @@ jobs:
           cp README.md LICENSE CHANGELOG.md "$dist/"
           if [ "${{ runner.os }}" = "Windows" ]; then
             7z a "${dist}.zip" "$dist"
+            certutil -hashfile "${dist}.zip" SHA256 | sed -n '2p' | tr -d ' \r' > "${dist}.zip.sha256"
           else
             tar czf "${dist}.tar.gz" "$dist"
+            shasum -a 256 "${dist}.tar.gz" | awk '{print $1}' > "${dist}.tar.gz.sha256"
           fi
       - uses: actions/upload-artifact@v7
         with:
           name: synaptic-${{ matrix.target }}
           path: |
             synaptic-${{ matrix.target }}.tar.gz
+            synaptic-${{ matrix.target }}.tar.gz.sha256
             synaptic-${{ matrix.target }}.zip
+            synaptic-${{ matrix.target }}.zip.sha256
           if-no-files-found: ignore
 
   release:
@@ -71,3 +76,42 @@ jobs:
         with:
           files: dist/*
           generate_release_notes: true
+
+  publish-wiki:
+    # Sync wiki/ (as committed on the released ref) to the GitHub wiki repo, but
+    # only commit when it actually differs from what is already published.
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
+    steps:
+      - uses: actions/checkout@v7
+      - name: Sync wiki/ to the GitHub wiki
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          if [ ! -d wiki ]; then
+            echo "no wiki/ directory; nothing to publish"
+            exit 0
+          fi
+          tmp="$(mktemp -d)"
+          # Build the authenticated clone URL without a literal user@host token.
+          auth="https://x-access-token:${GH_TOKEN}"
+          repo="${auth}@github.com/${GITHUB_REPOSITORY}.wiki.git"
+          if ! git clone --depth 1 "$repo" "$tmp"; then
+            echo "::error::wiki repo not found. Create the first page in the GitHub UI once, then re-run."
+            exit 1
+          fi
+          # Mirror wiki/ into the wiki repo: delete pages removed from source,
+          # but never touch the wiki repo's own .git.
+          rsync -a --delete --exclude '.git' wiki/ "$tmp/"
+          cd "$tmp"
+          bot="github-actions[bot]"
+          git config user.name "$bot"
+          git config user.email "41898282+${bot}@users.noreply.github.com"
+          git add -A
+          if git diff --cached --quiet; then
+            echo "Wiki already up to date; nothing to publish."
+          else
+            git commit -m "docs(wiki): sync from ${GITHUB_REF_NAME} (${GITHUB_SHA})"
+            git push origin HEAD
+          fi

CHANGELOG.md

@@ -10,6 +10,15 @@ All notable changes to Synaptic are documented here. The format is based on
 
 ## [Unreleased]
 
+### Added
+- `self-update` command: opt-in self-replacement from the latest GitHub release,
+  with SHA-256 checksum verification and a confirmation prompt before the binary
+  is swapped (`--yes` to skip, `--check` to report availability only). An opt-in
+  background check (`self-update --enable`) prints a one-line "update available"
+  notice at most once per day; it is off by default, writes to
+  `~/.synaptic/update.toml`, and can be force-disabled with
+  `SYNAPTIC_UPDATE_CHECK=0`. Release archives now publish a `.sha256` sidecar.
+
 ## [0.3.0] - 2026-06-21
 
 ### Changed

Cargo.toml

@@ -42,6 +42,7 @@ synaptic-predict = { path = "crates/synaptic-predict" }
 synaptic-sandbox = { path = "crates/synaptic-sandbox" }
 synaptic-eval = { path = "crates/synaptic-eval" }
 synaptic-sqlaudit = { path = "crates/synaptic-sqlaudit" }
+synaptic-upgrade = { path = "crates/synaptic-upgrade" }
 clap = { version = "4", features = ["derive"] }
 anyhow = "1"
 rayon = "1"
@@ -103,6 +104,11 @@ strsim = "0.11"
 tiktoken-rs = "0.12"
 sha2 = "0.11"
 hmac = "0.13"
+semver = "1"
+self-replace = "1"
+zip = { version = "2", default-features = false, features = ["deflate"] }
+flate2 = "1"
+tar = "0.4"
 tempfile = "3"
 criterion = "0.8"
 proptest = "1"

README.md

@@ -249,6 +249,13 @@ Neo4j/FalkorDB export), and `office` / `gws` / `media` (spreadsheet / Google-Wor
 audio-video ingest), e.g. `cargo install --path bin/synaptic --features pg,push`. See
 [Installation](https://github.com/ColinVaughn/Synaptic/wiki/Installation) and [Configuration](https://github.com/ColinVaughn/Synaptic/wiki/Configuration).
 
+Once installed, update in place with `synaptic self-update` (verifies a SHA-256
+checksum and prompts before replacing the binary). Opt in to a background
+"update available" notice with `synaptic self-update --enable` — off by default,
+runs at most once a day, and never blocks normal commands. `cargo install` /
+source builds can self-update too, but the swap installs the default-feature
+prebuilt binary.
+
 ## Quickstart
 
 ```sh
@@ -311,6 +318,7 @@ A code-only corpus runs fully offline; the optional LLM semantic pass over docs
 | `hook <action>` | Manage git hooks + the `graph.json` merge driver |
 | `install` / `uninstall [platform]` | Install the Synaptic skill for a host assistant |
 | `cache <action>` | Maintain the on-disk extraction cache |
+| `self-update` | Update the binary from the latest GitHub release (opt-in). Flags: `--enable`/`--disable` (background notice), `--check`, `--yes` |
 
 The full reference with every flag is in [Commands](https://github.com/ColinVaughn/Synaptic/wiki/Commands). Run
 `synaptic <command> --help` for the flag list at the terminal.

bin/synaptic/Cargo.toml

@@ -59,6 +59,7 @@ synaptic-predict = { workspace = true }
 synaptic-sandbox = { workspace = true }
 synaptic-eval = { workspace = true }
 synaptic-sqlaudit = { workspace = true }
+synaptic-upgrade = { workspace = true }
 clap = { workspace = true }
 anyhow = { workspace = true }
 rayon = { workspace = true }

bin/synaptic/src/cli.rs

@@ -475,6 +475,25 @@ pub(crate) enum Cmd {
         #[command(subcommand)]
         action: SqlAction,
     },
+    /// Update the Synaptic binary to the latest GitHub release (opt-in).
+    /// Bare: check and, if newer, prompt to download + replace. `--enable` /
+    /// `--disable` toggle the background "update available" notice (off by
+    /// default; persisted to ~/.synaptic/update.toml). `--check` reports
+    /// availability without downloading.
+    SelfUpdate {
+        /// Enable the background update-available notice and exit.
+        #[arg(long, conflicts_with_all = ["disable", "check", "yes"])]
+        enable: bool,
+        /// Disable the background update-available notice and exit.
+        #[arg(long, conflicts_with_all = ["enable", "check", "yes"])]
+        disable: bool,
+        /// Report whether an update is available, then exit (no download).
+        #[arg(long)]
+        check: bool,
+        /// Skip the confirmation prompt before downloading and replacing.
+        #[arg(long, short = 'y')]
+        yes: bool,
+    },
 }
 
 #[derive(Subcommand)]

bin/synaptic/src/commands/mod.rs

@@ -16,6 +16,7 @@ pub(crate) mod prs;
 pub(crate) mod query;
 pub(crate) mod refactor;
 pub(crate) mod search;
+pub(crate) mod self_update;
 pub(crate) mod serve;
 pub(crate) mod skill;
 pub(crate) mod speculate;