Bump version to 0.1.6

Cargo.lock

@@ -436,7 +436,7 @@ dependencies = [
 
 [[package]]
 name = "dosh"
-version = "0.1.5"
+version = "0.1.6"
 dependencies = [
  "anyhow",
  "base64",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "dosh"
-version = "0.1.5"
+version = "0.1.6"
 edition = "2024"
 license = "MIT"
 

Makefile

@@ -1,4 +1,4 @@
-.PHONY: build test fmt install package-release package-release-linux package-release-windows publish-release bench-report bench-local bench-local-json bench-docker-ssh bench-docker-mosh fuzz-smoke fuzz-deep soak-local tui-harness
+.PHONY: build test fmt clippy release-check install package-release package-release-linux package-release-windows publish-release bench-report bench-local bench-local-json bench-docker-ssh bench-docker-mosh fuzz-smoke fuzz-deep soak-local tui-harness
 
 build:
 	cargo build --release
@@ -9,6 +9,16 @@ test:
 fmt:
 	cargo fmt
 
+clippy:
+	cargo clippy --all-targets -- -D warnings
+
+release-check:
+	cargo fmt --check
+	sh -n install.sh scripts/*.sh
+	cargo clippy --all-targets -- -D warnings
+	cargo test
+	$(MAKE) tui-harness
+
 install:
 	sh install.sh --from-current
 

README.md

@@ -54,11 +54,11 @@ dosh recover HOST        # clear cached attach state and re-check
 Examples:
 
 ```sh
-dosh palav
-dosh palav tm
-dosh forward palav -L 8080:127.0.0.1:80
-dosh forward palav -D 1080
-dosh forward palav -R 2222:127.0.0.1:22
+dosh server
+dosh server tm
+dosh forward server -L 8080:127.0.0.1:80
+dosh forward server -D 1080
+dosh forward server -R 2222:127.0.0.1:22
 ```
 
 Agent forwarding is opt-in with `-A` and must be enabled on the server.

install.sh

@@ -410,7 +410,7 @@ write_systemd_service() {
   else
     cat >"$systemd_user_dir/dosh-server.service" <<EOF
 [Unit]
-Description=Dosh server
+Description=dosh dormant shell server
 After=network-online.target
 Wants=network-online.target
 
@@ -420,6 +420,15 @@ ExecStart=$bindir/dosh-server serve
 Restart=on-failure
 RestartSec=1
 KillMode=process
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=read-only
+ReadWritePaths=$config_dir $data_dir
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictRealtime=true
+LockPersonality=true
+MemoryDenyWriteExecute=true
 
 [Install]
 WantedBy=default.target
@@ -479,7 +488,8 @@ EOF
     mkdir -p "$systemd_user_dir"
     write_systemd_service
     if [ "$start_server" -eq 1 ] && systemctl --user daemon-reload >/dev/null 2>&1; then
-      systemctl --user enable --now dosh-server.service
+      systemctl --user enable dosh-server.service
+      systemctl --user restart dosh-server.service
     fi
   elif [ "$start_server" -eq 1 ]; then
     nohup "$bindir/dosh-server" serve >"$data_dir/dosh-server.log" 2>&1 &
@@ -547,8 +557,8 @@ EOF
     fi
     cat >"$hosts_config" <<EOF
 # Example:
-# [homelab]
-# ssh = "homelab"
+# [server]
+# ssh = "server"
 # dosh_host = "server.example.com"
 # port = 50000
 # default_command = "tm"

src/bin/dosh-client.rs

@@ -1503,7 +1503,54 @@ fn latest_release_download_url(repo: &str, artifact: &str) -> Option<String> {
     Some(format!("{web}/releases/latest/download/{artifact}"))
 }
 
-fn latest_release_tag_download_url(repo: &str, artifact: &str) -> Result<Option<String>> {
+fn release_tag_from_effective_url(web: &str, effective: &str) -> Option<String> {
+    let prefix = format!("{web}/releases/tag/");
+    let tag = effective.strip_prefix(&prefix)?;
+    if tag.is_empty() {
+        None
+    } else {
+        Some(tag.to_string())
+    }
+}
+
+fn release_version_from_tag(tag: &str) -> &str {
+    tag.strip_prefix('v').unwrap_or(tag)
+}
+
+fn update_version_status(local: &str, latest: &str) -> &'static str {
+    match compare_dotted_versions(latest, local) {
+        std::cmp::Ordering::Equal => "current",
+        std::cmp::Ordering::Greater => "update available",
+        std::cmp::Ordering::Less => "different",
+    }
+}
+
+fn compare_dotted_versions(left: &str, right: &str) -> std::cmp::Ordering {
+    let left = parse_dotted_version(left);
+    let right = parse_dotted_version(right);
+    let width = left.len().max(right.len());
+    for index in 0..width {
+        let ordering = left
+            .get(index)
+            .copied()
+            .unwrap_or(0)
+            .cmp(&right.get(index).copied().unwrap_or(0));
+        if ordering != std::cmp::Ordering::Equal {
+            return ordering;
+        }
+    }
+    std::cmp::Ordering::Equal
+}
+
+fn parse_dotted_version(version: &str) -> Vec<u64> {
+    version
+        .split(|byte: char| !byte.is_ascii_digit())
+        .filter(|part| !part.is_empty())
+        .map(|part| part.parse::<u64>().unwrap_or(0))
+        .collect()
+}
+
+fn latest_release_tag(repo: &str) -> Result<Option<String>> {
     let web = repo
         .strip_suffix(".git")
         .unwrap_or(repo)
@@ -1525,14 +1572,18 @@ fn latest_release_tag_download_url(repo: &str, artifact: &str) -> Result<Option<
         return Ok(None);
     }
     let effective = String::from_utf8_lossy(&output.stdout);
-    let prefix = format!("{web}/releases/tag/");
-    let Some(tag) = effective.strip_prefix(&prefix) else {
-        return Ok(None);
-    };
-    if tag.is_empty() {
-        return Ok(None);
+    Ok(release_tag_from_effective_url(web, &effective))
+}
+
+fn release_tag_download_url(repo: &str, tag: &str, artifact: &str) -> Option<String> {
+    let web = repo
+        .strip_suffix(".git")
+        .unwrap_or(repo)
+        .trim_end_matches('/');
+    if !web.starts_with("http://") && !web.starts_with("https://") {
+        return None;
     }
-    Ok(Some(format!("{web}/releases/download/{tag}/{artifact}")))
+    Some(format!("{web}/releases/download/{tag}/{artifact}"))
 }
 
 fn url_reachable(url: &str) -> Result<bool> {
@@ -1556,13 +1607,27 @@ fn run_update(config: &dosh::config::ClientConfig, check_only: bool) -> Result<(
     let installer = format!("{raw_base}/raw/branch/main/install.sh");
     let artifact = release_artifact_name();
     if check_only {
-        println!("dosh {}", env!("CARGO_PKG_VERSION"));
+        let local_version = env!("CARGO_PKG_VERSION");
+        let latest_tag = latest_release_tag(&repo)?;
+        println!("dosh {local_version}");
         println!("repo: {repo}");
         println!("installer: {installer}");
+        match latest_tag.as_deref() {
+            Some(tag) => {
+                let latest_version = release_version_from_tag(tag);
+                println!(
+                    "latest: {latest_version} ({})",
+                    update_version_status(local_version, latest_version)
+                );
+            }
+            None => println!("latest: unknown"),
+        }
         if let Some(latest_url) = latest_release_download_url(&repo, artifact) {
             let mut status = "missing";
             let mut display_url = latest_url.clone();
-            if let Some(tag_url) = latest_release_tag_download_url(&repo, artifact)?
+            if let Some(tag_url) = latest_tag
+                .as_deref()
+                .and_then(|tag| release_tag_download_url(&repo, tag, artifact))
                 && url_reachable(&tag_url)?
             {
                 status = "available";
@@ -5557,12 +5622,13 @@ mod tests {
         load_first_native_identity_with_prompt, parse_dynamic_forward, parse_escape_key,
         parse_local_forward, parse_remote_forward, parse_ssh_config, post_submit_hold_duration,
         queue_pending_user_input, raw_contains_host_table, recv_response_until, refresh_live_addr,
+        release_tag_download_url, release_tag_from_effective_url, release_version_from_tag,
         render_status_clear, render_status_overlay, requested_env, resolved_startup_command,
         retransmit_stream_opens, rewrite_forward_command, selected_predict_mode, selected_udp_host,
         server_version_mismatch, should_hold_during_startup_gate, should_hold_post_submit_input,
         split_after_command_submit, ssh_destination_host, ssh_username, ssh_with_user,
         startup_command, status_ssh_target, strip_stale_mouse_reports, toml_bare_key_or_quoted,
-        update_check_requested, valid_forward_host,
+        update_check_requested, update_version_status, valid_forward_host,
     };
     use dosh::config::{ClientConfig, CommandExtension, HostConfig};
     use dosh::native::EnvVar;
@@ -6435,6 +6501,39 @@ mod tests {
         );
     }
 
+    #[test]
+    fn release_tag_parses_effective_latest_url() {
+        assert_eq!(
+            release_tag_from_effective_url(
+                "https://example.com/owner/dosh",
+                "https://example.com/owner/dosh/releases/tag/v1.0.0"
+            )
+            .as_deref(),
+            Some("v1.0.0")
+        );
+        assert_eq!(release_version_from_tag("v1.0.0"), "1.0.0");
+        assert_eq!(release_version_from_tag("2026.06.28"), "2026.06.28");
+        assert_eq!(
+            release_tag_download_url(
+                "https://example.com/owner/dosh.git",
+                "v1.0.0",
+                "dosh-linux-x86_64.tar.gz"
+            )
+            .as_deref(),
+            Some(
+                "https://example.com/owner/dosh/releases/download/v1.0.0/dosh-linux-x86_64.tar.gz"
+            )
+        );
+        assert!(release_tag_from_effective_url("https://example.com/owner/dosh", "").is_none());
+    }
+
+    #[test]
+    fn update_version_status_compares_numeric_parts() {
+        assert_eq!(update_version_status("0.1.5", "0.1.5"), "current");
+        assert_eq!(update_version_status("0.1.9", "0.1.10"), "update available");
+        assert_eq!(update_version_status("1.0.0", "0.9.9"), "different");
+    }
+
     #[test]
     fn resolved_startup_command_expands_global_extension() {
         let mut config = ClientConfig::default();