[Nawid3333]

Third part of making issue #10 closable. GitHub can't update your PC, so update-local.cmd, a double-click in the repository's root, does. It runs tools/update-local.ps1, which brings your PC to what CI uses. It follows CI's rule: a release counts once it is 5 days old.

What	How
Node.js	The newest release of the major .nvmrc names, from nodejs.org's installer, checked against its SHASUMS256.txt. Windows asks for admin rights. A newer major you already have is kept
npm	Its newest release, installed globally in %APPDATA%\npm
pnpm	At least the version package.json pins. Inside the repository, pnpm switches to that version by itself
The repository	Only on main with nothing uncommitted: git pull --ff-only, then pnpm install --frozen-lockfile into the store node_modules already uses (V:\.pnpm-store), and fsaunpack's npm ci with scripts off
The mpv helper	native-host/install.ps1 again when the repository's host file differs from the installed one, keeping your mpv and Node paths

It never touches:

• Firefox: it updates itself, and FastStream comes from the releases.
• mpv: C:\Program Files\mpv is your own repository, Nawid3333/mpv, with its own updater. It's already on the build CI pins.
• WSL: pnpm run verify:linux updates its distros.

Options and failures:

• -DryRun only says what it would do.
• -Repo <path> points it at another checkout.
• A failed step is reported and the rest still run.

Tested on this PC for real, against the main checkout:

• it pulled to 6018d621 (release 1.3.82.51);
• installed into V:\.pnpm-store, and ran fsaunpack's npm ci;
• reinstalled the mpv helper, whose host file types: background.mjs and the mpv host are type-checked, with a ratchet (T5) #109 had changed. The installed helper then answered a ping through its .bat: {"ok":true,"mpv":true,"path":"C:\\Program Files\\mpv\\mpv.exe"}.

Node, npm and pnpm were already current, so no admin prompt came up. After #119 merges, .nvmrc says 26 and the script would install 26.10.0 once it's 5 days old.

Tests: tests/unit/updateLocal.test.mjs covers the version picks (age rule, fallback to the previous major, prereleases and deprecated releases skipped). It also checks that the script is ASCII, which Windows PowerShell 5.1 needs for a file without a BOM, and that it parses in Windows PowerShell. .gitattributes gives .cmd files CRLF line endings. Lint, typecheck and the unit tests (942) pass.

Docs: a "Your PC" section in docs/maintenance.md, and CLAUDE.md's Commands section.

Ships nothing.

🤖 Generated with Claude Code

[Nawid3333]

Both threads addressed in 82266ef:

• MSI staging (%TEMP% race): the installer now stages in a per-run %ProgramData%\FastStream\node-<guid> directory whose ACL is rebuilt (inheritance off, everyone else removed) to this user + Administrators + SYSTEM only. Download, hash, signature check and the elevated msiexec all run inside it.
• newest-release.mjs string escaping: already fixed on this PR by 793210e (replaceAll); the code-scanning instance for 324d2d6 reports state "fixed" and the repo list shows 0 open alerts.

Behavior change worth noting: the default (double-click) run is now check-and-report only — it names what is out of date and the exact commands, and changes nothing. -Apply is what installs/pulls/reinstalls; -DryRun is kept as an old name for the check.