Release 0.0.7: user-local installer + self-update apply

- install.sh: no-root user-local install (private venv + ~/.local/bin launchers
  + desktop entry); --ref <tag> to install a specific release, --uninstall to
  remove; auto-installs the python3-venv prerequisite with consent
- packaging/make-run.sh: build a self-extracting .run installer (makeself)
  bundling the wheel + install.sh; release workflow builds and attaches it
- M13 self-update apply: `rigdoctor update` runs an authenticated pip upgrade
  (rigdoctor[gui] @ git+https://oauth2:<token>@...@<tag>), token scrubbed; GUI
  sidebar "Update to v…" button applies it and prompts to restart
- version 0.0.7, CHANGELOG, docs (M9/M13, ROADMAP, README install section)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -27,6 +27,11 @@ jobs:
           python -m pip install --upgrade build
           python -m build
 
+      - name: Build self-extracting installer (.run)
+        run: |
+          (apt-get update && apt-get install -y makeself && sh packaging/make-run.sh) \
+            || echo "makeself unavailable — skipping .run"
+
       - name: Read version
         id: ver
         run: |

CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to RigDoctor are recorded here. Format follows
 (`MAJOR.MINOR.PATCH`, pre-1.0). `__version__` and `pyproject.toml` must match the git
 release tag (so the auto-updater, D18, can compare versions).
 
+## [0.0.7] - 2026-05-21
+### Added
+- **User-local installer** `install.sh` (no root): creates a private venv, links
+  `rigdoctor`/`rigdoctor-gui` into `~/.local/bin`, and adds a desktop entry. Re-run to
+  upgrade; `--uninstall` to remove.
+- **Self-extracting `.run` installer** via `packaging/make-run.sh` (makeself) — one
+  download-and-run executable bundling the wheel + `install.sh`; built and attached to each
+  release by CI.
+- **Self-update apply (M13)**: `rigdoctor update` now installs the newer version via
+  authenticated pip (`rigdoctor[gui] @ git+https://oauth2:<token>@…@<tag>`); the GUI sidebar
+  "Update to v…" button applies it and prompts to restart. Token is scrubbed from output.
+
 ## [0.0.6] - 2026-05-21
 ### Added
 - **Token-gated updates (M13)**: store a Gitea Personal Access Token, **encrypted in the OS

README.md

@@ -63,6 +63,21 @@ Full rationale and the still-open questions are in `docs/DECISIONS.md`.
 | `installer/` | Installer / `.deb` packaging (empty until Phase 4) |
 | `tests/` | Tests (stdlib `unittest`) |
 
+## Install (user-local, no root)
+
+RigDoctor installs into a private venv under `~/.local` — no root, self-updating:
+
+```bash
+./install.sh                 # from a source checkout or the self-extracting .run
+./install.sh --ref v0.0.6    # install a specific released tag (needs a token)
+./install.sh --uninstall     # remove it
+```
+
+This adds `rigdoctor` / `rigdoctor-gui` to `~/.local/bin` and a desktop entry. Each release
+also ships a one-file **`.run`** installer (download, `chmod +x`, run). Updates are gated to
+accounts on the Git server (a Personal Access Token); save one via the GUI **Setup → Update
+access** panel or `rigdoctor login`, then `rigdoctor update` (or the sidebar button).
+
 ## Run it (dev)
 
 Stdlib-only, no install needed (target is Python ≥ 3.11; tested on 3.14):

docs/MODULES.md

@@ -57,7 +57,10 @@ Status: ⬜ not started · 🟦 designing · 🟨 in progress · ✅ done
   resolution; enables the logger service and trigger mode. *Implemented (first cut):* distro/
   package-manager/GPU detection (`core/sysenv`), an optional-component catalog (`core/catalog`),
   and dependency install via pkexec/sudo — `rigdoctor install [--check] [-y]` + GUI Setup tab.
-  *Pending:* writing config/module selection and enabling the `systemd --user` service.
+  The **user-local app install** is `install.sh` (private venv + `~/.local/bin` launchers +
+  desktop entry, no root; handles the `python3-venv` prerequisite) plus a self-extracting
+  **`.run`** (makeself, built by CI). *Pending:* config/module selection + `systemd --user`
+  service enable.
 - **M12 Session sharing / remote assist** (D16) — let a helper inspect a user's machine, in
   an escalating ladder: (1) **diagnostic bundle export** (inventory + recent log + report,
   one-way), (2) **live read-only view** over a user-chosen tunnel (Tailscale/cloudflared/SSH,
@@ -68,8 +71,11 @@ Status: ⬜ not started · 🟦 designing · 🟨 in progress · ✅ done
   holders** via a Personal Access Token, stored **encrypted in the OS keyring** (`secret-tool`)
   with a 0600-file fallback (`config.load_token`/`save_token`/`token_backend`). `core/updates`
   queries the releases API with the token; CLI `login`/`logout`/`update`; GUI Setup "Update
-  access" panel + sidebar states. The no-root **self-update apply** (download → verify → swap →
+  access" panel + sidebar states. The no-root **self-update apply** is implemented:
-  restart) and the user-local install script are still pending.
+  `rigdoctor update` runs an authenticated `pip install --upgrade "rigdoctor[gui] @
+  git+https://oauth2:<token>@…@<tag>"` into the user-local venv (GUI "Update to v…" button +
+  restart prompt; token scrubbed). Installed via the user-local **`install.sh`** /
+  self-extracting **`.run`** (M9).
   *Original plan:* On launch, check the public Gitea releases API and
   **self-update a user-local install with no root** (download → verify checksum/signature →
   atomic symlink swap → restart, incl. the daemon). HTTPS-only, version-check-only (no

docs/ROADMAP.md

@@ -40,16 +40,17 @@ Ubuntu + NVIDIA first; `.deb` distribution (see `DECISIONS.md`).
       `rigdoctor wrap %command%` + global Steam compat-tool; zero-config watcher
       (Steam RunningAppID + /proc) and GameMode hook follow)
 - [~] M9 interactive installer — *done:* distro/GPU detection + optional-dependency install
-      (`rigdoctor install`, GUI Setup tab). *Pending:* module-selection config + `systemd --user`
+      (`rigdoctor install`, GUI Setup tab); **user-local `install.sh` + self-extracting `.run`**
-      service enable + trigger-mode pick.
+      (no-root venv install, handles python3-venv prereq, CI-built). *Pending:* module-selection
+      config + `systemd --user` service enable + trigger-mode pick.
 - [ ] `.deb` packaging (D8) declaring per-bundle deps incl. python3-pyside6 for Desktop UI
 
 ## Phase 5 — Breadth (later)
 - [ ] AMD GPU support in M1 (Steam Deck / Radeon)
 - [ ] Intel GPU best-effort
-- [~] M13 auto-update (D18) — *done:* launch-time version check shown in the GUI sidebar
+- [x] M13 auto-update (D18) — launch-time version check (GUI sidebar) + no-root self-update
-      (up-to-date / "Update to v…" / unavailable). *Pending:* no-root self-update of the
+      apply (`rigdoctor update` / sidebar button → authenticated pip upgrade), token-gated.
-      user-local install from the public Gitea releases; `rigdoctor update`.
+      Restart-after-update is manual for now.
 - [ ] (Later, separate milestone) Optional auto-apply of suggested fixes behind explicit
       consent — currently out of scope (D9)
 

install.sh

@@ -0,0 +1,103 @@
+#!/usr/bin/env sh
+# RigDoctor user-local installer (no root). Creates a private venv, links the
+# `rigdoctor` / `rigdoctor-gui` commands into ~/.local/bin, and adds a desktop
+# entry. Installs from a bundled wheel (the .run installer) or from a source
+# checkout. Re-run to upgrade; `./install.sh --uninstall` to remove.
+set -eu
+
+APP_NAME=rigdoctor
+DATA_HOME="${XDG_DATA_HOME:-$HOME/.local/share}"
+VENV="$DATA_HOME/$APP_NAME/venv"
+BIN_DIR="$HOME/.local/bin"
+DESKTOP_DIR="$DATA_HOME/applications"
+DESKTOP_FILE="$DESKTOP_DIR/rigdoctor.desktop"
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+
+uninstall() {
+    echo "Removing RigDoctor user-local install…"
+    rm -rf "$VENV"
+    rm -f "$BIN_DIR/rigdoctor" "$BIN_DIR/rigdoctor-gui" "$DESKTOP_FILE"
+    echo "Done. (Config and logs under ~/.config/rigdoctor and ~/.local/share/rigdoctor were kept.)"
+}
+
+REF=""
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --uninstall) uninstall; exit 0 ;;
+        --ref) REF="${2:-}"; [ -n "$REF" ] || { echo "--ref needs a tag"; exit 1; }; shift 2 ;;
+        -h|--help) echo "Usage: install.sh [--ref <tag>] [--uninstall]"; exit 0 ;;
+        *) echo "Unknown option: $1"; exit 1 ;;
+    esac
+done
+
+PY=python3
+command -v "$PY" >/dev/null 2>&1 || { echo "python3 not found — install Python 3.11+."; exit 1; }
+"$PY" - <<'EOF' || { echo "Python 3.11+ is required."; exit 1; }
+import sys
+sys.exit(0 if sys.version_info >= (3, 11) else 1)
+EOF
+
+# venv support (ensurepip) is required; install python3-venv if it's missing.
+if ! "$PY" -c "import ensurepip" >/dev/null 2>&1; then
+    PYVER=$("$PY" -c "import sys; print(f'{sys.version_info.major}.{sys.version_info.minor}')")
+    PKGS="python3-venv python${PYVER}-venv"
+    echo "Python venv support is missing — needs: $PKGS"
+    if command -v pkexec >/dev/null 2>&1; then ESC=pkexec
+    elif command -v sudo >/dev/null 2>&1; then ESC=sudo
+    else ESC=""; fi
+    if [ -n "$ESC" ] && command -v apt-get >/dev/null 2>&1; then
+        echo "Installing $PKGS (you may be prompted for your password)…"
+        "$ESC" sh -c "apt-get update && apt-get install -y $PKGS" \
+            || { echo "Failed. Install manually: sudo apt install $PKGS"; exit 1; }
+    else
+        echo "Install it manually, then re-run: sudo apt install $PKGS"
+        exit 1
+    fi
+fi
+
+# Where to install from: a specific released tag (--ref), a bundled wheel, or source.
+WHEEL=$(ls "$SCRIPT_DIR"/rigdoctor-*.whl 2>/dev/null | head -n1 || true)
+if [ -n "$REF" ]; then
+    CONF="${XDG_CONFIG_HOME:-$HOME/.config}/rigdoctor/token"
+    TOKEN="${RIGDOCTOR_TOKEN:-$(cat "$CONF" 2>/dev/null || true)}"
+    [ -n "$TOKEN" ] || { echo "--ref needs a token (run 'rigdoctor login' or set RIGDOCTOR_TOKEN)."; exit 1; }
+    SRC="rigdoctor[gui] @ git+https://oauth2:$TOKEN@git.jesseyvanofferen.com/jessey/rigdoctor.git@$REF"
+elif [ -n "$WHEEL" ]; then
+    SRC="$WHEEL[gui]"
+elif [ -f "$SCRIPT_DIR/pyproject.toml" ]; then
+    SRC="$SCRIPT_DIR[gui]"
+else
+    echo "No bundled wheel or source found next to the installer."
+    exit 1
+fi
+
+echo "Creating venv at $VENV…"
+"$PY" -m venv "$VENV"
+"$VENV/bin/pip" install --upgrade pip >/dev/null
+echo "Installing RigDoctor (pulls in PySide6 — this can take a minute)…"
+"$VENV/bin/pip" install "$SRC"
+
+mkdir -p "$BIN_DIR"
+ln -sf "$VENV/bin/rigdoctor" "$BIN_DIR/rigdoctor"
+ln -sf "$VENV/bin/rigdoctor-gui" "$BIN_DIR/rigdoctor-gui"
+
+mkdir -p "$DESKTOP_DIR"
+cat > "$DESKTOP_FILE" <<EOF
+[Desktop Entry]
+Type=Application
+Name=RigDoctor
+Comment=Hardware monitoring & crash diagnostics for Linux gamers
+Exec=$VENV/bin/rigdoctor-gui
+Icon=utilities-system-monitor
+Terminal=false
+Categories=System;Monitor;Utility;
+EOF
+
+echo
+echo "RigDoctor $("$VENV/bin/rigdoctor" --version 2>/dev/null | awk '{print $2}') installed."
+echo "  GUI:  rigdoctor-gui   (or find 'RigDoctor' in your app menu)"
+echo "  CLI:  rigdoctor --help"
+case ":$PATH:" in
+    *":$BIN_DIR:"*) ;;
+    *) echo "  Note: add $BIN_DIR to your PATH (a fresh login usually does this).";;
+esac

packaging/make-run.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env sh
+# Build a self-extracting .run installer: bundles the wheel + install.sh so a user
+# can download one file, run it, and get a no-root user-local install.
+#
+# Requires `makeself` (apt install makeself). Run from the repo root.
+set -eu
+
+ROOT=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+cd "$ROOT"
+
+command -v makeself >/dev/null 2>&1 || {
+    echo "makeself not found. Install it: sudo apt install makeself"
+    exit 1
+}
+
+VERSION=$(python3 -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
+mkdir -p dist
+
+# Build the wheel if it isn't already in dist/.
+if ! ls dist/rigdoctor-"$VERSION"-py3-none-any.whl >/dev/null 2>&1; then
+    python3 -m build --wheel
+fi
+
+STAGE=$(mktemp -d)
+cp dist/rigdoctor-"$VERSION"-py3-none-any.whl "$STAGE"/
+cp install.sh "$STAGE"/install.sh
+chmod +x "$STAGE/install.sh"
+
+OUT="dist/rigdoctor-$VERSION-installer.run"
+makeself --notemp-suffix "$STAGE" "$OUT" "RigDoctor $VERSION installer" ./install.sh
+rm -rf "$STAGE"
+echo "Built $OUT"
+echo "Run it with:  chmod +x $OUT && ./$OUT"

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "rigdoctor"
-version = "0.0.6"
+version = "0.0.7"
 description = "Modular hardware monitoring & crash diagnostics for Linux gamers."
 readme = "README.md"
 requires-python = ">=3.11"

src/rigdoctor/__init__.py

@@ -1,3 +1,3 @@
 """RigDoctor — modular hardware monitoring & crash diagnostics for Linux gamers."""
 
-__version__ = "0.0.6"
+__version__ = "0.0.7"

src/rigdoctor/cli.py

@@ -266,8 +266,14 @@ def cmd_update(args) -> int:
     print(f"Update available: {tag}  (current v{__version__}).")
     if args.check:
         return 0
-    print("Self-update (apply) isn't wired yet — coming with the install script.")
+    print(f"Installing {tag}…")
+    rc, out = updates.apply_update(tag)
+    print(out[-2000:])
+    if rc == 0:
+        print(f"\nUpdated to {tag}. Restart RigDoctor to use the new version.")
         return 0
+    print(f"\nUpdate failed (exit {rc}).")
+    return rc
 
 
 def cmd_report(args) -> int:

src/rigdoctor/core/updates.py

@@ -9,6 +9,8 @@ handles detection and exposes a clear state for the UI.
 from __future__ import annotations
 
 import json
+import subprocess
+import sys
 import urllib.error
 import urllib.request
 
@@ -73,3 +75,23 @@ def update_state(timeout: float = 5.0) -> tuple[str, str | None]:
     if tag and is_newer(tag):
         return (AVAILABLE, tag)
     return (UP_TO_DATE, tag)
+
+
+def apply_update(tag: str) -> tuple[int, str]:
+    """Self-update the current (user-local) install to `tag` via authenticated pip.
+
+    Installs `rigdoctor[gui] @ git+https://oauth2:<token>@…/rigdoctor.git@<tag>` into
+    the running environment. Returns (exit_code, output) with the token scrubbed.
+    """
+    token = load_token()
+    if not token:
+        return (1, "No update token configured. Run `rigdoctor login`.")
+    host = GITEA_BASE.split("://", 1)[1]
+    ref = f"rigdoctor[gui] @ git+https://oauth2:{token}@{host}/{REPO}.git@{tag}"
+    cmd = [sys.executable, "-m", "pip", "install", "--upgrade", ref]
+    try:
+        proc = subprocess.run(cmd, capture_output=True, text=True, timeout=1800)
+        out = (proc.stdout + proc.stderr).replace(token, "***")
+        return (proc.returncode, out)
+    except (subprocess.SubprocessError, OSError) as exc:
+        return (1, str(exc).replace(token, "***"))

src/rigdoctor/gui/main_window.py

@@ -4,8 +4,7 @@ from __future__ import annotations
 
 import threading
 
-from PySide6.QtCore import Qt, QUrl, Signal
+from PySide6.QtCore import Qt, Signal
-from PySide6.QtGui import QDesktopServices
 from PySide6.QtWidgets import (
     QButtonGroup,
     QFrame,
@@ -34,7 +33,8 @@ _PLACEHOLDERS = {
 
 
 class MainWindow(QMainWindow):
-    _update_checked = Signal(object)  # latest tag (str) or None
+    _update_checked = Signal(object)  # (state, tag)
+    _update_applied = Signal(int)     # pip exit code
 
     def __init__(self, interval: float = 1.0) -> None:
         super().__init__()
@@ -72,7 +72,9 @@ class MainWindow(QMainWindow):
         self._worker.start()
 
         # Background update check (M13); result lands in the sidebar.
+        self._latest_tag = None
         self._update_checked.connect(self._show_update_state)
+        self._update_applied.connect(self._on_update_applied)
         threading.Thread(target=self._check_updates, daemon=True).start()
 
     def _build_sidebar(self) -> QFrame:
@@ -117,16 +119,33 @@ class MainWindow(QMainWindow):
         self._update_btn = QPushButton()
         self._update_btn.setObjectName("PrimaryButton")
         self._update_btn.setCursor(Qt.CursorShape.PointingHandCursor)
-        self._update_btn.clicked.connect(lambda: QDesktopServices.openUrl(QUrl(updates.RELEASES_PAGE)))
+        self._update_btn.clicked.connect(self._apply_update)
         self._update_btn.setVisible(False)
         v.addWidget(self._update_btn)
         return bar
 
+    def _apply_update(self) -> None:
+        if not self._latest_tag:
+            return
+        self._update_btn.setEnabled(False)
+        self._update_label.setText("updating…")
+        tag = self._latest_tag
+        threading.Thread(target=lambda: self._update_applied.emit(updates.apply_update(tag)[0]), daemon=True).start()
+
+    def _on_update_applied(self, rc: int) -> None:
+        if rc == 0:
+            self._update_label.setText("updated — restart RigDoctor")
+            self._update_btn.setVisible(False)
+        else:
+            self._update_label.setText("update failed")
+            self._update_btn.setEnabled(True)
+
     def _check_updates(self) -> None:
         self._update_checked.emit(updates.update_state())
 
     def _show_update_state(self, result) -> None:
         state, tag = result
+        self._latest_tag = tag
         self._update_btn.setVisible(False)
         if state == updates.NO_TOKEN:
             self._update_label.setText("connect to update server")