@aragon-agent/cli 0.5.9 → 0.5.11

package/dist/commands/perf.js

@@ -30,10 +30,51 @@ let resetGovernor = null;
 export function setPerfResetHook(fn) {
     resetGovernor = fn;
 }
+/**
+ * Frame-writer counters (tui-input-flicker-fix §5.4).
+ *
+ * A SECOND MODULE-LEVEL SLOT rather than a prop on `App`, and that is this
+ * file's own documented convention rather than a shortcut: the writer is built
+ * in `runInteractive`, lives entirely outside React, and its counters never
+ * render — so routing them through a 1900-line component's props would buy
+ * nothing and cost `App.tsx` plus `app.test.tsx` churn (P1-2).
+ *
+ * `null` means the writer was never built — `--no-diff-render`, inline mode, or
+ * a non-interactive path. `/perf` says so in words, so "the flag is off" and
+ * "the writer crashed" never look alike.
+ */
+let frameStats = null;
+/** Called by `cli.tsx` after building the writer. Passing `null` detaches. */
+export function setFrameStatsProvider(fn) {
+    frameStats = fn;
+}
+export function readFrameStats() {
+    return frameStats ? frameStats() : null;
+}
 function mb(bytes) {
     return `${(bytes / (1024 * 1024)).toFixed(1)}MB`;
 }
-/** Format a snapshot as the five-line block documented in §5.4. */
+function ratio(total, frames) {
+    return frames > 0 ? (total / frames).toFixed(1) : '0.0';
+}
+/**
+ * The writer line (§5.4), in this function's existing ASCII separator shape.
+ *
+ * `fallbacks > 0` on a healthy session is the single most useful diagnostic this
+ * feature can emit: it means something wrote to stdout behind Ink's back and
+ * absolute addressing lost its origin.
+ */
+function formatWriterLine() {
+    const stats = readFrameStats();
+    if (!stats)
+        return 'writer     full  -  diff render off';
+    const bytesPerFrame = stats.framesTotal > 0 ? Math.round(stats.bytesWritten / stats.framesTotal) : 0;
+    return (`writer     diff  -  frames ${stats.framesTotal} ` +
+        `(diffed ${stats.framesDiffed}, full ${stats.framesFull})  -  ` +
+        `lines/frame ${ratio(stats.linesWritten, stats.framesTotal)}  -  ` +
+        `bytes/frame ${bytesPerFrame}  -  fallbacks ${stats.fallbacks}`);
+}
+/** Format a snapshot as the six-line block documented in §5.4. */
 export function formatPerfReport(snap) {
     const caches = renderCacheStats();
     const eco = snap.rung > 0 ? '  -  eco' : '';
@@ -49,6 +90,7 @@ export function formatPerfReport(snap) {
             `hl ${caches.highlightEntries} (${mb(caches.highlightBytes)})  -  ` +
             `lines ${caches.lineEntries}`,
         `mode       ${snap.mode}  -  viewport ${snap.viewportRows} rows  -  offset ${snap.offset}`,
+        formatWriterLine(),
     ].join('\n');
 }
 export const perfCommand = {

package/dist/commands/registry.d.ts

@@ -7,6 +7,7 @@ import type { AgentMode } from '../agent/agent-mode.js';
 import type { NoticeLevel, Overlay, ToastLevel, ViewAction, ViewState } from '../agent/reducer.js';
 import type { PersistedConfig } from '../config/schema.js';
 import type { FollowThroughBudget } from '../todo/follow-through.js';
+import type { UpdateCommandPort } from '../update/types.js';
 export interface CommandContext {
     /** Raw argument string after the command word (may be empty). */
     args: string;
@@ -52,6 +53,22 @@ export interface CommandContext {
      * change; absent means the clause degrades to naming the ceiling alone.
      */
     followBudget?: FollowThroughBudget;
+    /**
+     * The updater, when this session has one (cli-auto-update §4.4 / C-14 / P0-2).
+     *
+     * `/fast`, `/team` and `/todo` reach their subsystems through `controller`,
+     * because those subsystems live on `AgentController`. This one does not, and
+     * by §3.1 it MUST NOT — `update/` may not import `agent/` — so it needs its
+     * own field, and this is the only seam a slash command has.
+     *
+     * OPTIONAL, for two independent reasons. The service is legitimately absent
+     * under `update.mode: 'off'`, on a non-TTY and in CI (§3.8), so `/update` has
+     * to have something honest to say when it is missing; and a REQUIRED field
+     * would break every existing `CommandContext` fixture in this package at
+     * compile time, for a feature none of them are about. `followBudget` above is
+     * the precedent for an optional, read-at-command-time member.
+     */
+    update?: UpdateCommandPort;
     /** Rebuild the system prompt and the dynamic command list after a skill change. */
     refreshSkills: () => void;
     /**

package/dist/config/app-paths.d.ts

@@ -14,6 +14,9 @@
  *   ├── config.json.bak        `aragon config edit` pre-edit backup
  *   ├── prompt-history.jsonl   submitted prompts, append-only (0600 on POSIX)
  *   ├── state.json             UI bookkeeping scalars (0600 on POSIX)
+ *   ├── update-state.json      auto-update coordination (0600 on POSIX)
+ *   ├── update-install.lock    held by the running `npm i -g` child
+ *   ├── update-install.log     that child's stdout+stderr; unlinked on exit
  *   ├── logs/                  JSONL logs (0700 on POSIX)
  *   ├── sessions/              /save · /resume
  *   ├── skills/                `aragon skills install` target
@@ -79,6 +82,34 @@ export declare function getConfigBackupPath(): string;
 export declare function getPromptHistoryPath(): string;
 /** `<home>/state.json` — UI bookkeeping scalars only; see `ui-state.ts`. */
 export declare function getUiStatePath(): string;
+/**
+ * `<home>/update-state.json` — cross-process auto-update coordination
+ * (cli-auto-update §5.2).
+ *
+ * Deliberately NOT inside `state.json`: that file is documented as UI
+ * bookkeeping scalars only (C-6), and this is coordination state that a SECOND
+ * aragon process reads to decide whether anyone has already asked the registry.
+ * Different lifetime, different failure policy, different reader.
+ */
+export declare function getUpdateStatePath(): string;
+/**
+ * `<home>/update-install.lock` — the `wx` lock the running installer child holds
+ * (cli-auto-update §3.7).
+ *
+ * A FILE, and a direct child of the root, for the reason the two files above
+ * are: `logs/`, `sessions/` and `skills/` are all scan roots, and every extra
+ * file inside one is another thing each walk has to recognise and skip.
+ */
+export declare function getUpdateLockPath(): string;
+/**
+ * `<home>/update-install.log` — the installer child's stdout+stderr
+ * (cli-auto-update §3.5 / U-5).
+ *
+ * A REAL FILE and not a pipe: the child is detached and outlives the parent
+ * (D-10), and a pipe whose parent has exited takes EPIPE on the next write. The
+ * parent tails it on the child's exit, redacts, logs, and unlinks.
+ */
+export declare function getUpdateInstallLogPath(): string;
 export declare function getLogsDir(): string;
 export declare function getSessionsDir(): string;
 /** `<home>` — parent of `skills/`, and where sidecar state such as usage lives. */

package/dist/config/app-paths.js

@@ -14,6 +14,9 @@
  *   ├── config.json.bak        `aragon config edit` pre-edit backup
  *   ├── prompt-history.jsonl   submitted prompts, append-only (0600 on POSIX)
  *   ├── state.json             UI bookkeeping scalars (0600 on POSIX)
+ *   ├── update-state.json      auto-update coordination (0600 on POSIX)
+ *   ├── update-install.lock    held by the running `npm i -g` child
+ *   ├── update-install.log     that child's stdout+stderr; unlinked on exit
  *   ├── logs/                  JSONL logs (0700 on POSIX)
  *   ├── sessions/              /save · /resume
  *   ├── skills/                `aragon skills install` target
@@ -140,6 +143,40 @@ export function getPromptHistoryPath() {
 export function getUiStatePath() {
     return join(resolution.root, 'state.json');
 }
+/**
+ * `<home>/update-state.json` — cross-process auto-update coordination
+ * (cli-auto-update §5.2).
+ *
+ * Deliberately NOT inside `state.json`: that file is documented as UI
+ * bookkeeping scalars only (C-6), and this is coordination state that a SECOND
+ * aragon process reads to decide whether anyone has already asked the registry.
+ * Different lifetime, different failure policy, different reader.
+ */
+export function getUpdateStatePath() {
+    return join(resolution.root, 'update-state.json');
+}
+/**
+ * `<home>/update-install.lock` — the `wx` lock the running installer child holds
+ * (cli-auto-update §3.7).
+ *
+ * A FILE, and a direct child of the root, for the reason the two files above
+ * are: `logs/`, `sessions/` and `skills/` are all scan roots, and every extra
+ * file inside one is another thing each walk has to recognise and skip.
+ */
+export function getUpdateLockPath() {
+    return join(resolution.root, 'update-install.lock');
+}
+/**
+ * `<home>/update-install.log` — the installer child's stdout+stderr
+ * (cli-auto-update §3.5 / U-5).
+ *
+ * A REAL FILE and not a pipe: the child is detached and outlives the parent
+ * (D-10), and a pipe whose parent has exited takes EPIPE on the next write. The
+ * parent tails it on the child's exit, redacts, logs, and unlinks.
+ */
+export function getUpdateInstallLogPath() {
+    return join(resolution.root, 'update-install.log');
+}
 export function getLogsDir() {
     return join(resolution.root, 'logs');
 }

package/dist/config/cli-commands.d.ts

@@ -1,6 +1,6 @@
 /**
  * `aragon config get | list | edit | home`, plus the `log.*`, `team.*`,
- * `retry.*` and `fast.*` branches of `config set`.
+ * `retry.*`, `fast.*` and `update.*` branches of `config set`.
  *
  * These live here rather than in `cli.tsx` because `runConfigSet` is already a
  * 21-case switch — well past the complexity ceiling this package writes down —
@@ -43,6 +43,17 @@ export declare const RETRY_CONFIG_SET_KEYS: readonly ["retry.enabled", "retry.ma
  * `Set fast.model = haiku`.
  */
 export declare const FAST_CONFIG_SET_KEYS: readonly ["fast.enabled", "fast.provider", "fast.model", "fast.baseUrl", "fast.thinkingLevel", "fast.delegate", "fast.review", "fast.reviewEveryTurns", "fast.reviewContextTurns", "fast.reviewMaxChars", "fast.reviewMaxPerSession"];
+/**
+ * Config keys under `update.` that `aragon config set` accepts (cli-auto-update
+ * §4.1).
+ *
+ * A DEDICATED SETTER RATHER THAN A GENERIC DOTTED WRITER, for the reason the
+ * four sets above each record: a generic setter would write `update` as a FLAT
+ * string key (`"update.mode": "notify"` at the top level of the file), the
+ * section would silently never take effect, and `config set` would still print
+ * `Set update.mode = notify`.
+ */
+export declare const UPDATE_CONFIG_SET_KEYS: readonly ["update.mode", "update.checkIntervalMs", "update.registry", "update.distTag"];
 /**
  * Translate a `log.*` dotted key into a patch, or `null` for anything else.
  *
@@ -94,6 +105,21 @@ export declare function applyRetryConfigSet(key: string, value: string): Partial
  * the clamped 50 while the caller echoes the STORED value (AC-13).
  */
 export declare function applyFastConfigSet(key: string, value: string): Partial<PersistedConfig> | null;
+/**
+ * Translate an `update.*` dotted key into a patch, or `null` for anything else.
+ *
+ * The patch is a PARTIAL `update` section, safe only because
+ * `updatePersistedConfig` deep-merges that section — with a shallow merge,
+ * setting the mode would silently reset the interval, the registry mirror and
+ * the dist-tag (C-4 / R-10).
+ *
+ * EVERY KEY ROUTES THROUGH `clampUpdateConfig`, not through a local parse, for
+ * the reason `applyRetryConfigSet` and `applyFastConfigSet` both record: one
+ * gate for both directions means no key here can pick up a different coercion
+ * later, and `config set update.checkIntervalMs 5` writes the clamped 900000
+ * while the caller echoes the STORED value (AC-20).
+ */
+export declare function applyUpdateConfigSet(key: string, value: string): Partial<PersistedConfig> | null;
 /**
  * `log.redactSecrets false` is the one setting that lets credentials reach the
  * disk. It is command-line-only (there is no settings-screen entry) and it says

package/dist/config/cli-commands.js

@@ -1,6 +1,6 @@
 /**
  * `aragon config get | list | edit | home`, plus the `log.*`, `team.*`,
- * `retry.*` and `fast.*` branches of `config set`.
+ * `retry.*`, `fast.*` and `update.*` branches of `config set`.
  *
  * These live here rather than in `cli.tsx` because `runConfigSet` is already a
  * 21-case switch — well past the complexity ceiling this package writes down —
@@ -13,7 +13,7 @@ import process from 'node:process';
 import { getConfigBackupPath, getConfigPath, getHomeRoot, getLogsDir, getPromptHistoryPath, getUiStatePath, isHomeOverridden, } from './app-paths.js';
 import { getHomeMigrationBreadcrumbPath } from './migrate-home.js';
 import { loadPersistedConfig, updatePersistedConfig } from './store.js';
-import { clampFastConfig, clampRetryConfig, coercePositiveInt, maskSecret, DEFAULT_FAST_CONFIG, DEFAULT_RETRY_CONFIG, DEFAULT_TEAM_CONFIG, } from './schema.js';
+import { clampFastConfig, clampRetryConfig, clampUpdateConfig, coercePositiveInt, maskSecret, DEFAULT_FAST_CONFIG, DEFAULT_RETRY_CONFIG, DEFAULT_TEAM_CONFIG, DEFAULT_UPDATE_CONFIG, } from './schema.js';
 import { clampLogLevel } from '../logging/levels.js';
 /** Config keys under `log.` that `aragon config set` accepts. */
 export const LOG_CONFIG_SET_KEYS = [
@@ -87,6 +87,22 @@ export const FAST_CONFIG_SET_KEYS = [
     'fast.reviewMaxChars',
     'fast.reviewMaxPerSession',
 ];
+/**
+ * Config keys under `update.` that `aragon config set` accepts (cli-auto-update
+ * §4.1).
+ *
+ * A DEDICATED SETTER RATHER THAN A GENERIC DOTTED WRITER, for the reason the
+ * four sets above each record: a generic setter would write `update` as a FLAT
+ * string key (`"update.mode": "notify"` at the top level of the file), the
+ * section would silently never take effect, and `config set` would still print
+ * `Set update.mode = notify`.
+ */
+export const UPDATE_CONFIG_SET_KEYS = [
+    'update.mode',
+    'update.checkIntervalMs',
+    'update.registry',
+    'update.distTag',
+];
 function isTrue(value) {
     return value === 'true' || value === '1';
 }
@@ -245,6 +261,39 @@ export function applyFastConfigSet(key, value) {
             return null;
     }
 }
+/**
+ * Translate an `update.*` dotted key into a patch, or `null` for anything else.
+ *
+ * The patch is a PARTIAL `update` section, safe only because
+ * `updatePersistedConfig` deep-merges that section — with a shallow merge,
+ * setting the mode would silently reset the interval, the registry mirror and
+ * the dist-tag (C-4 / R-10).
+ *
+ * EVERY KEY ROUTES THROUGH `clampUpdateConfig`, not through a local parse, for
+ * the reason `applyRetryConfigSet` and `applyFastConfigSet` both record: one
+ * gate for both directions means no key here can pick up a different coercion
+ * later, and `config set update.checkIntervalMs 5` writes the clamped 900000
+ * while the caller echoes the STORED value (AC-20).
+ */
+export function applyUpdateConfigSet(key, value) {
+    const patch = (update) => ({ update });
+    const clampOne = (field) => {
+        const merged = clampUpdateConfig({ ...DEFAULT_UPDATE_CONFIG, [field]: value });
+        return { [field]: merged[field] };
+    };
+    switch (key) {
+        case 'update.mode':
+            return patch(clampOne('mode'));
+        case 'update.checkIntervalMs':
+            return patch(clampOne('checkIntervalMs'));
+        case 'update.registry':
+            return patch(clampOne('registry'));
+        case 'update.distTag':
+            return patch(clampOne('distTag'));
+        default:
+            return null;
+    }
+}
 /**
  * `log.redactSecrets false` is the one setting that lets credentials reach the
  * disk. It is command-line-only (there is no settings-screen entry) and it says

package/dist/config/env.d.ts

@@ -12,7 +12,17 @@
  *     ARAGON_FAST_PROVIDER, ARAGON_FAST_MODEL, ARAGON_FAST_BASE_URL,
  *     ARAGON_LOG_LEVEL,
  *     ARAGON_LOG_FILE, ARAGON_LOG_DIR, ARAGON_TRANSCRIPT_RETAIN,
- *     ARAGON_RENDER_GOVERNOR, ARAGON_MAX_RENDER_INTERVAL_MS.
+ *     ARAGON_RENDER_GOVERNOR, ARAGON_MAX_RENDER_INTERVAL_MS,
+ *     ARAGON_DIFF_RENDER, ARAGON_SYNC_OUTPUT,
+ *     ARAGON_UPDATE.
+ *
+ * READ ELSEWHERE, ON PURPOSE: `ARAGON_UPDATE_REGISTRY` and `npm_config_registry`
+ * are resolved by `update/registry.ts::resolveRegistryUrl`, NOT here, because
+ * §3.3 puts them BELOW `config.update.registry` in precedence — the opposite of
+ * the env-beats-file rule this file implements. Writing them into `partial`
+ * would silently invert that order and make a config-file mirror unreachable on
+ * any machine where npm exports its own registry (which is every machine npm
+ * runs a script on).
  *
  * NOT here: `ARAGON_HOME`. It is read when `config/app-paths.ts` is first
  * evaluated, which is long before `loadDotenv()` runs, so a `.env` can never

package/dist/config/env.js

@@ -12,7 +12,17 @@
  *     ARAGON_FAST_PROVIDER, ARAGON_FAST_MODEL, ARAGON_FAST_BASE_URL,
  *     ARAGON_LOG_LEVEL,
  *     ARAGON_LOG_FILE, ARAGON_LOG_DIR, ARAGON_TRANSCRIPT_RETAIN,
- *     ARAGON_RENDER_GOVERNOR, ARAGON_MAX_RENDER_INTERVAL_MS.
+ *     ARAGON_RENDER_GOVERNOR, ARAGON_MAX_RENDER_INTERVAL_MS,
+ *     ARAGON_DIFF_RENDER, ARAGON_SYNC_OUTPUT,
+ *     ARAGON_UPDATE.
+ *
+ * READ ELSEWHERE, ON PURPOSE: `ARAGON_UPDATE_REGISTRY` and `npm_config_registry`
+ * are resolved by `update/registry.ts::resolveRegistryUrl`, NOT here, because
+ * §3.3 puts them BELOW `config.update.registry` in precedence — the opposite of
+ * the env-beats-file rule this file implements. Writing them into `partial`
+ * would silently invert that order and make a config-file mirror unreachable on
+ * any machine where npm exports its own registry (which is every machine npm
+ * runs a script on).
  *
  * NOT here: `ARAGON_HOME`. It is read when `config/app-paths.ts` is first
  * evaluated, which is long before `loadDotenv()` runs, so a `.env` can never
@@ -279,6 +289,37 @@ export function readEnvConfig() {
         if (Object.keys(section).length > 0)
             partial.fast = section;
     }
+    // ARAGON_UPDATE=0|off|false turns auto-update off; `notify` reports without
+    // installing; 1|on|true|yes turns it on (cli-auto-update §4.2).
+    //
+    // A TRI-STATE, so it is parsed by an EXPLICIT POSITIVE LIST PER OUTCOME rather
+    // than by the boolean positive list its neighbours use — and emphatically not
+    // by `envBool` below, whose NEGATIVE list would resolve `ARAGON_UPDATE=disable`
+    // to `true`.
+    //
+    // ANYTHING UNRECOGNISED IS LEFT ABSENT, which is the invariant this file
+    // states three times over (`ARAGON_TEAM_MAX`, `ARAGON_RETRY_MAX`,
+    // `ARAGON_MAX_TOKENS`): a value that resolves to a default looks PERMANENTLY
+    // SUPPLIED, and the config file underneath can then never win again. For a
+    // kill switch that is the worst possible failure — `ARAGON_UPDATE=disabled`
+    // would read as "on" while the user believes they turned it off.
+    //
+    // `ARAGON_TODO_FOLLOW` is the tri-state precedent: the recognised string is
+    // written through and `clampUpdateConfig` stays the single gate, so there is
+    // never a second validator that can disagree with the first.
+    const update = process.env.ARAGON_UPDATE?.trim().toLowerCase();
+    if (update !== undefined && update.length > 0) {
+        const mode = update === '0' || update === 'false' || update === 'off' || update === 'no'
+            ? 'off'
+            : update === 'notify'
+                ? 'notify'
+                : update === '1' || update === 'true' || update === 'on' || update === 'yes'
+                    ? 'auto'
+                    : undefined;
+        if (mode !== undefined) {
+            partial.update = { mode };
+        }
+    }
     // Render bounds (tui-render-performance §5.3). Same channel story as
     // ARAGON_FULLSCREEN: a container or a wrapper that owns argv can reach neither
     // a flag nor a config file, and a session that freezes is exactly the case
@@ -307,6 +348,22 @@ export function readEnvConfig() {
         if (Number.isFinite(parsed) && parsed > 0)
             partial.maxRenderIntervalMs = parsed;
     }
+    // ARAGON_DIFF_RENDER=0 restores the pre-fix full-frame repaint;
+    // ARAGON_SYNC_OUTPUT=0 drops the DEC 2026 envelope (tui-input-flicker-fix
+    // §5.3). Parsed by the POSITIVE list, exactly as ARAGON_FULLSCREEN /
+    // ARAGON_MOUSE / ARAGON_PLAN / ARAGON_TEAM / ARAGON_TODO / ARAGON_RENDER_GOVERNOR
+    // are — NOT by `envBool` below, whose NEGATIVE list disagrees with it on values
+    // like `ARAGON_DIFF_RENDER=disable`.
+    const diffRender = process.env.ARAGON_DIFF_RENDER?.trim().toLowerCase();
+    if (diffRender !== undefined && diffRender.length > 0) {
+        partial.diffRender =
+            diffRender === '1' || diffRender === 'true' || diffRender === 'on' || diffRender === 'yes';
+    }
+    const syncOutput = process.env.ARAGON_SYNC_OUTPUT?.trim().toLowerCase();
+    if (syncOutput !== undefined && syncOutput.length > 0) {
+        partial.syncOutput =
+            syncOutput === '1' || syncOutput === 'true' || syncOutput === 'on' || syncOutput === 'yes';
+    }
     const log = readEnvLogConfig();
     if (log)
         partial.log = log;

package/dist/config/load.d.ts

@@ -106,6 +106,19 @@ export interface CliFlags {
     renderGovernor?: boolean;
     /** `--max-render-interval <ms>` — the governor ceiling for this run (L4). */
     maxRenderInterval?: string | number;
+    /**
+     * `--diff-render` ⇒ true, `--no-diff-render` ⇒ false, absent ⇒ undefined
+     * (tui-input-flicker-fix §5.2).
+     *
+     * DECLARED AS A PAIR for the reason `--render-governor` records one field up:
+     * `diffRender` is PERSISTED and defaults to `true`, so a lone
+     * `--no-diff-render` would make commander default `opts.diffRender` to `true`
+     * and silently overwrite a stored `false` on every run that passed no flag at
+     * all — i.e. the documented escape hatch would quietly un-set itself.
+     */
+    diffRender?: boolean;
+    /** `--sync-output` ⇒ true, `--no-sync-output` ⇒ false, absent ⇒ undefined (§5.2). */
+    syncOutput?: boolean;
     /**
      * `--retry` ⇒ true, `--no-retry` ⇒ false, absent ⇒ undefined
      * (llm-api-retry-backoff §6.2).
@@ -148,6 +161,23 @@ export interface CliFlags {
      * to keep in step with `toFlags`.
      */
     fastReview?: string;
+    /**
+     * `--update` ⇒ true, `--no-update` ⇒ false, absent ⇒ undefined
+     * (cli-auto-update §4.2).
+     *
+     * DECLARED AS A PAIR — MANDATORY (C-11), for the reason `--team`,
+     * `--todo-panel`, `--render-governor`, `--retry` and `--fast` each record in
+     * turn. `update.mode` is PERSISTED and defaults to `'auto'`, so a lone
+     * `--no-update` would make commander default `opts.update` to `true` and
+     * silently overwrite a stored `off` on every run that passed no flag at all —
+     * i.e. the kill switch would un-set itself.
+     *
+     * A BOOLEAN FOR A TRI-STATE KEY, deliberately: the flag is a SESSION override
+     * and `notify` is a preference, not something a user reaches for once. `true`
+     * maps to `'auto'`, `false` to `'off'`; `notify` is reachable through the
+     * config file and `ARAGON_UPDATE=notify`.
+     */
+    update?: boolean;
 }
 /**
  * Resolve the effective config by merging all layers, then derive the runtime

package/dist/config/load.js

@@ -6,7 +6,7 @@
  * legitimately long single tool run can never be watchdog-killed.
  */
 import process from 'node:process';
-import { DEFAULT_CONFIG, IDLE_TIMEOUT_MARGIN_MS, clampAskRounds, clampDensity, clampHumanTimeout, clampLogConfig, clampFastConfig, clampRetryConfig, clampSkillsConfig, clampTeamConfig, clampTodoConfig, clampTheme, clampThinkingLevel, clampMaxTokens, clampMaxRenderInterval, clampTranscriptRetain, clampTranscriptWindow, coercePositiveInt, isAutoToken, isSkillsToolPolicyMode, } from './schema.js';
+import { DEFAULT_CONFIG, IDLE_TIMEOUT_MARGIN_MS, clampAskRounds, clampDensity, clampHumanTimeout, clampLogConfig, clampFastConfig, clampRetryConfig, clampSkillsConfig, clampTeamConfig, clampTodoConfig, clampUpdateConfig, clampTheme, clampThinkingLevel, clampMaxTokens, clampMaxRenderInterval, clampTranscriptRetain, clampTranscriptWindow, coercePositiveInt, isAutoToken, isSkillsToolPolicyMode, } from './schema.js';
 import { loadDotenv, readEnvConfig, readEnvDisabledSkills } from './env.js';
 import { readConfigFile } from './store.js';
 import { getConfigPath } from './app-paths.js';
@@ -185,6 +185,29 @@ function resolveFastConfig(flags, env, file) {
         ...reviewPatch,
     });
 }
+/**
+ * Merge the `update` section across all four layers (defaults › file › env ›
+ * flags), cli-auto-update §4.2.
+ *
+ * `!== undefined` ON `flags.update`, which is the rule `resolveTeamConfig`,
+ * `resolveTodoConfig`, `resolveRetryConfig` and `resolveFastConfig` each state
+ * once (C-11): commander materialises a lone `--no-update` as
+ * `opts.update = true` when the flag is absent, so a truthiness check cannot
+ * tell `--no-update` from "not passed" — and here that would silently re-enable
+ * a subsystem the user turned off, which is the one direction this feature must
+ * never fail in.
+ *
+ * The flag maps onto `mode` rather than carrying its own key, so there is
+ * exactly one place that says whether the updater runs.
+ */
+function resolveUpdateConfig(flags, env, file) {
+    return clampUpdateConfig({
+        ...DEFAULT_CONFIG.update,
+        ...(file.update ?? {}),
+        ...(env.update ?? {}),
+        ...(flags.update !== undefined ? { mode: flags.update ? 'auto' : 'off' } : {}),
+    });
+}
 /**
  * Resolve the adaptive render governor: flag › env › file › default `true`
  * (tui-render-performance L4).
@@ -204,6 +227,35 @@ function resolveRenderGovernor(flags, env, file) {
         return file.renderGovernor;
     return DEFAULT_CONFIG.renderGovernor;
 }
+/**
+ * Resolve per-line frame diffing: flag › env › file › default `true`
+ * (tui-input-flicker-fix §5.1).
+ *
+ * Shaped exactly like `resolveRenderGovernor` above, and for the same reason:
+ * there are no heuristics for an explicit `true` to override, so a persisted
+ * `true` is a value rather than an opinion that has to be told apart from
+ * silence. `!== undefined` on the flag is what makes `--no-diff-render` beat a
+ * config file that left the key at its default.
+ */
+function resolveDiffRender(flags, env, file) {
+    if (flags.diffRender !== undefined)
+        return flags.diffRender;
+    if (env.diffRender !== undefined)
+        return env.diffRender;
+    if (file.diffRender !== undefined)
+        return file.diffRender;
+    return DEFAULT_CONFIG.diffRender;
+}
+/** Same ladder for the DEC 2026 envelope (§5.1). */
+function resolveSyncOutput(flags, env, file) {
+    if (flags.syncOutput !== undefined)
+        return flags.syncOutput;
+    if (env.syncOutput !== undefined)
+        return env.syncOutput;
+    if (file.syncOutput !== undefined)
+        return file.syncOutput;
+    return DEFAULT_CONFIG.syncOutput;
+}
 /** Merge the `log` section across all four layers (defaults › file › env › flags). */
 function resolveLogConfig(flags, env, file) {
     const merged = clampLogConfig({
@@ -398,6 +450,8 @@ export function loadConfig(flags = {}) {
         ...(requestedRetain < transcriptRetain ? { transcriptRetainRequested: requestedRetain } : {}),
         renderGovernor: resolveRenderGovernor(flags, env.partial, file),
         maxRenderIntervalMs: clampMaxRenderInterval(pick(flags.maxRenderInterval, env.partial.maxRenderIntervalMs, file.maxRenderIntervalMs), DEFAULT_CONFIG.maxRenderIntervalMs),
+        diffRender: resolveDiffRender(flags, env.partial, file),
+        syncOutput: resolveSyncOutput(flags, env.partial, file),
         confirmTools,
         toolTimeoutMs,
         idleTimeoutMs,
@@ -428,6 +482,7 @@ export function loadConfig(flags = {}) {
         todo: resolveTodoConfig(flags, env.partial, file),
         retry: resolveRetryConfig(flags, env.partial, file),
         fast: resolveFastConfig(flags, env.partial, file),
+        update: resolveUpdateConfig(flags, env.partial, file),
         cwd,
         color,
         colorLevel,