fix(cli): run update installer silently

cli/cmd/geniex/BUILD.bazel

@@ -45,7 +45,6 @@ go_cgo_test(
     srcs = [
         "infer_test.go",
         "model_test.go",
-        "update_test.go",
     ],
     embed = [":geniex_lib"],
     gotags = [

cli/cmd/geniex/update.go

@@ -48,18 +48,21 @@
 )
 
 func update() *cobra.Command {
-	return &cobra.Command{
+	cmd := &cobra.Command{
 		GroupID: "management",
 		Use:     "update",
 		Short:   "update geniex",
 		Long:    "Update geniex to the latest version",
 		RunE: func(cmd *cobra.Command, args []string) error {
-			return runUpdate(cmd, args)
+			silent, _ := cmd.Flags().GetBool("silent")
+			return runUpdate(silent)
 		},
 	}
+	cmd.Flags().Bool("silent", false, "run the installer silently (no prompts or progress UI)")
+	return cmd
 }
 
-func runUpdate(_ *cobra.Command, _ []string) error {
+func runUpdate(silent bool) error {
 	latest, err := getLatestVersion()
 	if err != nil {
 		return err
@@ -138,7 +141,14 @@
 		return err
 	}
 
-	if err := exec.Command(dst).Start(); err != nil {
+	var installArgs []string
+	if silent {
+		installArgs = []string{"/VERYSILENT", "/SUPPRESSMSGBOXES", "/NORESTART"}
+	}
+	// dst is a local file downloaded from the official release S3 bucket and
+	// verified against its published SHA256 above, so executing it is safe.
+	// nosemgrep: go.lang.security.audit.dangerous-exec-command.dangerous-exec-command
+	if err := exec.Command(dst, installArgs...).Start(); err != nil {
 		return err
 	}
 	fmt.Println("update package is ready to install")

cli/release/windows/geniex-cli-setup.iss

@@ -68,19 +68,23 @@ begin
   if not RegQueryStringValue(HKCU, UninstallKey, 'UninstallString', UninstallString) then
     Exit;
 
-  if MsgBox('Existing version detected.'#13#10 +
+  { Bare MsgBox still renders (hidden) under /VERYSILENT and deadlocks setup;
+    SuppressibleMsgBox returns Default in silent mode. }
+  if SuppressibleMsgBox('Existing version detected.'#13#10 +
             'Please uninstall the existing version first.'#13#10#13#10 +
-            'Uninstall now?', mbConfirmation, MB_YESNO) <> IDYES then
+            'Uninstall now?', mbConfirmation, MB_YESNO, IDYES) <> IDYES then
   begin
-    MsgBox('Installation aborted.', mbInformation, MB_OK);
+    SuppressibleMsgBox('Installation aborted.', mbInformation, MB_OK, IDOK);
     Result := False;
     Exit;
   end;
 
-  if (not Exec(RemoveQuotes(UninstallString), '/SILENT', '', SW_SHOW, ewWaitUntilTerminated, ResultCode))
+  { /SUPPRESSMSGBOXES is required — /VERYSILENT alone does not silence the
+    old uninstaller's own MsgBox calls. }
+  if (not Exec(RemoveQuotes(UninstallString), '/VERYSILENT /NORESTART /SUPPRESSMSGBOXES', '', SW_HIDE, ewWaitUntilTerminated, ResultCode))
      or (ResultCode <> 0) then
   begin
-    MsgBox(Format('Uninstall failed (ErrCode: %d).', [ResultCode]), mbError, MB_OK);
+    SuppressibleMsgBox(Format('Uninstall failed (ErrCode: %d).', [ResultCode]), mbError, MB_OK, IDOK);
     Result := False;
     Exit;
   end;
@@ -90,7 +94,7 @@ begin
   begin
     if Waited >= 30000 then
     begin
-      MsgBox('Timed out waiting for the previous version to finish uninstalling.', mbError, MB_OK);
+      SuppressibleMsgBox('Timed out waiting for the previous version to finish uninstalling.', mbError, MB_OK, IDOK);
       Result := False;
       Exit;
     end;