@event4u/agent-config 16.5.0 → 17.0.0

package/dist/cli-delegate/check_update_banner.js

@@ -2,58 +2,33 @@
 import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
 
 // src/scripts/check_update_banner.ts
-import * as fs6 from "node:fs";
-import * as path6 from "node:path";
+import * as fs9 from "node:fs";
+import * as tty from "node:tty";
+import * as path9 from "node:path";
 import { fileURLToPath as fileURLToPath2, pathToFileURL } from "node:url";
 
-// src/scripts/_lib/agent_settings.ts
-import { createRequire } from "node:module";
+// src/scripts/_cli/doctor_install_mode.ts
 import * as fs3 from "node:fs";
 import * as path3 from "node:path";
 
-// src/scripts/_lib/package_root.ts
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { fileURLToPath } from "node:url";
-var PACKAGE_NAME = "@event4u/agent-config";
-var MAX_ASCENT = 16;
-function resolvePackageRoot(fromUrlOrPath, legacyHops = 3) {
-  const start = fromUrlOrPath.startsWith("file:") ? fileURLToPath(fromUrlOrPath) : fromUrlOrPath;
-  const startDir = path.dirname(start);
-  let dir = startDir;
-  for (let i = 0; i < MAX_ASCENT; i++) {
-    const manifest = path.join(dir, "package.json");
-    if (fs.existsSync(manifest)) {
-      try {
-        const parsed = JSON.parse(fs.readFileSync(manifest, "utf8"));
-        if (parsed.name === PACKAGE_NAME) {
-          return dir;
-        }
-      } catch {
-      }
-    }
-    const parent = path.dirname(dir);
-    if (parent === dir) {
-      break;
-    }
-    dir = parent;
-  }
-  return path.resolve(startDir, ...Array.from({ length: legacyHops }, () => ".."));
-}
+// src/scripts/_lib/update_check.ts
+import { randomBytes } from "node:crypto";
+import * as fs2 from "node:fs";
+import * as path2 from "node:path";
 
 // src/scripts/_lib/user_global_paths.ts
-import * as fs2 from "node:fs";
+import * as fs from "node:fs";
 import * as os from "node:os";
-import * as path2 from "node:path";
+import * as path from "node:path";
 var EVENT4U_HOME_ENV = "EVENT4U_CONFIG_HOME";
-var DEFAULT_EVENT4U_ROOT_RELATIVE = path2.join(".event4u", "agent-config");
-var LEGACY_XDG_ROOT_RELATIVE = path2.join(".config", "agent-config");
+var DEFAULT_EVENT4U_ROOT_RELATIVE = path.join(".event4u", "agent-config");
+var LEGACY_XDG_ROOT_RELATIVE = path.join(".config", "agent-config");
 function expanduser(p) {
   if (p === "~") {
     return os.homedir();
   }
   if (p.startsWith("~/") || process.platform === "win32" && p.startsWith("~\\")) {
-    return path2.join(os.homedir(), p.slice(2));
+    return path.join(os.homedir(), p.slice(2));
   }
   return p;
 }
@@ -69,10 +44,10 @@ function event4u_root(env) {
   if (override) {
     return expanduser(override);
   }
-  return path2.join(os.homedir(), DEFAULT_EVENT4U_ROOT_RELATIVE);
+  return path.join(os.homedir(), DEFAULT_EVENT4U_ROOT_RELATIVE);
 }
 function legacy_xdg_root() {
-  return path2.join(os.homedir(), LEGACY_XDG_ROOT_RELATIVE);
+  return path.join(os.homedir(), LEGACY_XDG_ROOT_RELATIVE);
 }
 function resolve_with_fallback(relative_name, options = {}) {
   if (is_absolute_like_python(relative_name)) {
@@ -80,12 +55,12 @@ function resolve_with_fallback(relative_name, options = {}) {
       `resolve_with_fallback expects a relative path, got '${relative_name}'`
     );
   }
-  const new_path = path2.join(event4u_root(options.env ?? null), relative_name);
-  if (fs2.existsSync(new_path)) {
+  const new_path = path.join(event4u_root(options.env ?? null), relative_name);
+  if (fs.existsSync(new_path)) {
     return new_path;
   }
-  const legacy_path = path2.join(legacy_xdg_root(), relative_name);
-  if (fs2.existsSync(legacy_path)) {
+  const legacy_path = path.join(legacy_xdg_root(), relative_name);
+  if (fs.existsSync(legacy_path)) {
     return legacy_path;
   }
   return null;
@@ -94,7 +69,295 @@ function write_target(relative_name, options = {}) {
   if (is_absolute_like_python(relative_name)) {
     throw new Error(`write_target expects a relative path, got '${relative_name}'`);
   }
-  return path2.join(event4u_root(options.env ?? null), relative_name);
+  return path.join(event4u_root(options.env ?? null), relative_name);
+}
+
+// src/scripts/_lib/version_order.ts
+var NUM = "(0|[1-9]\\d*)";
+var IDENT = "[0-9A-Za-z-]+";
+var VERSION_RE = new RegExp(
+  `^v*${NUM}\\.${NUM}\\.${NUM}(?:-(${IDENT}(?:\\.${IDENT})*))?(?:\\+${IDENT}(?:\\.${IDENT})*)?$`
+);
+
+// src/scripts/_lib/update_check.ts
+var PACKAGE_NAME = "@event4u/agent-config";
+var NPM_REGISTRY_URL = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`;
+var FETCH_TIMEOUT_S = 1;
+var CHECK_WINDOW_MS = 24 * 60 * 60 * 1e3;
+var STATE_FILENAME = "update-check.json";
+var DEFAULT_STATE_PATH = write_target(STATE_FILENAME);
+function _resolve_state_path() {
+  const found = resolve_with_fallback(STATE_FILENAME);
+  if (found !== null) {
+    return found;
+  }
+  return DEFAULT_STATE_PATH;
+}
+async function fetch_latest_document(options = {}) {
+  const timeout = options.timeout ?? FETCH_TIMEOUT_S;
+  const url = options.url ?? NPM_REGISTRY_URL;
+  const fetch_impl = options.fetch_impl ?? fetch;
+  try {
+    const resp = await fetch_impl(url, {
+      headers: {
+        Accept: "application/json",
+        "User-Agent": "agent-config-update-check"
+      },
+      signal: AbortSignal.timeout(timeout * 1e3)
+    });
+    const payload = await resp.json();
+    if (payload !== null && typeof payload === "object" && !Array.isArray(payload)) {
+      const doc = payload;
+      const version = doc["version"];
+      if (typeof version === "string" && version.trim()) {
+        const cfg = doc["agentConfig"];
+        const impact = cfg !== null && typeof cfg === "object" && !Array.isArray(cfg) ? cfg["impact"] : null;
+        return { version: version.trim(), impact: impact ?? null };
+      }
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
+function _cacheable_impact(impact) {
+  if (impact === null || typeof impact !== "object" || Array.isArray(impact)) return null;
+  const out = {};
+  for (const [version, entry] of Object.entries(impact)) {
+    if (!/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(version)) continue;
+    if (entry === null || typeof entry !== "object" || Array.isArray(entry)) continue;
+    const value = entry["impact"];
+    if (!["none", "automatic", "notice", "action"].includes(String(value))) continue;
+    out[version] = { impact: String(value), security: entry["security"] === true };
+  }
+  return Object.keys(out).length > 0 ? out : null;
+}
+function _read_state(state_path) {
+  try {
+    const raw = fs2.readFileSync(state_path, "utf-8");
+    const data = JSON.parse(raw);
+    if (data !== null && typeof data === "object" && !Array.isArray(data)) {
+      return data;
+    }
+  } catch {
+  }
+  return {};
+}
+function _write_state(state_path, payload) {
+  const parent = path2.dirname(state_path);
+  fs2.mkdirSync(parent, { recursive: true });
+  const tmp = path2.join(parent, `.update-check-${randomBytes(8).toString("hex")}`);
+  try {
+    const sorted = {};
+    for (const key of Object.keys(payload).sort()) {
+      sorted[key] = payload[key];
+    }
+    fs2.writeFileSync(tmp, JSON.stringify(sorted, null, 2), { encoding: "utf-8", mode: 384 });
+    fs2.chmodSync(tmp, 384);
+    fs2.renameSync(tmp, state_path);
+  } catch (err) {
+    try {
+      fs2.unlinkSync(tmp);
+    } catch {
+    }
+    throw err;
+  }
+}
+function _should_check(state, now) {
+  const last = state.last_check_utc;
+  if (typeof last !== "string") {
+    return true;
+  }
+  let normalized = last.replace(/Z/g, "+00:00");
+  if (!/[+-]\d{2}:?\d{2}$/.test(normalized)) {
+    normalized = `${normalized}+00:00`;
+  }
+  const last_ms = Date.parse(normalized);
+  if (Number.isNaN(last_ms)) {
+    return true;
+  }
+  return now.getTime() - last_ms >= CHECK_WINDOW_MS;
+}
+var GLOBAL_TREE = /[\\/](?:lib|npm)[\\/]node_modules[\\/]@event4u[\\/]agent-config[\\/]?$/;
+function classify_install_origin(signals) {
+  const pin = signals.project_pin?.trim() ?? "";
+  if (pin !== "") {
+    return signals.latest && _is_newer(signals.latest, pin) ? "project-pin" : "unknown";
+  }
+  if (signals.package_root.split(/[\\/]+/).includes("_npx")) {
+    return "ephemeral";
+  }
+  if (signals.is_global_consumer || GLOBAL_TREE.test(signals.package_root)) {
+    return "global";
+  }
+  return "unknown";
+}
+function _format_banner(latest, installed, origin = "unknown") {
+  const head = `\u2139\uFE0F  agent-config ${latest} available (you have ${installed}).`;
+  if (origin === "global") {
+    return `${head}
+    Update: agent-config upgrade`;
+  }
+  if (origin === "project-pin") {
+    return `${head}
+    Update: agent-config update`;
+  }
+  return head;
+}
+function _int_or_zero(part) {
+  const trimmed = part.trim();
+  if (/^[+-]?\d+$/.test(trimmed)) {
+    return parseInt(trimmed, 10);
+  }
+  return 0;
+}
+function _is_newer(latest, installed) {
+  const parse = (v) => {
+    const core = v.replace(/^v+/, "").split("-")[0] ?? "";
+    const parts = core.split(".");
+    const out = [];
+    for (const p of parts.slice(0, 3)) {
+      out.push(_int_or_zero(p));
+    }
+    while (out.length < 3) {
+      out.push(0);
+    }
+    return [out[0], out[1], out[2]];
+  };
+  const a = parse(latest);
+  const b = parse(installed);
+  for (let i = 0; i < 3; i += 1) {
+    if (a[i] > b[i]) {
+      return true;
+    }
+    if (a[i] < b[i]) {
+      return false;
+    }
+  }
+  return false;
+}
+function _resolve_origin(origin, latest) {
+  return typeof origin === "function" ? origin(latest) : origin;
+}
+function _format_utc(d) {
+  return d.toISOString().replace(/\.\d{3}Z$/, "Z");
+}
+async function check_for_update(installed_version, options = {}) {
+  const env = options.env ?? process.env;
+  if (env.AGENT_CONFIG_NO_UPDATE_CHECK === "1") {
+    return null;
+  }
+  if (env.CI === "1" || env.CI === "true" || env.GITHUB_ACTIONS === "true") {
+    return null;
+  }
+  const settings_enabled = options.settings_enabled ?? true;
+  if (!settings_enabled) {
+    return null;
+  }
+  let is_tty = options.is_tty ?? null;
+  if (is_tty === null) {
+    is_tty = Boolean(process.stdout.isTTY);
+  }
+  if (!is_tty) {
+    return null;
+  }
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const read_path = options.state_path ?? _resolve_state_path();
+  const write_path = options.state_path ?? DEFAULT_STATE_PATH;
+  const state = _read_state(read_path);
+  if (!_should_check(state, now)) {
+    const latest2 = state.last_seen_version;
+    if (typeof latest2 === "string" && _is_newer(latest2, installed_version)) {
+      return _format_banner(latest2, installed_version, _resolve_origin(options.origin, latest2));
+    }
+    return null;
+  }
+  let impact = null;
+  let latest;
+  if (options.fetcher === void 0) {
+    const doc = await fetch_latest_document();
+    latest = doc?.version ?? null;
+    impact = doc?.impact ?? null;
+  } else {
+    latest = await options.fetcher();
+  }
+  const fallback_seen = Object.prototype.hasOwnProperty.call(state, "last_seen_version") ? state.last_seen_version : "";
+  const payload = {
+    last_check_utc: _format_utc(now),
+    // Python: `latest or state.get("last_seen_version", "")`.
+    last_seen_version: latest ? latest : fallback_seen,
+    installed_version
+  };
+  const cacheable = _cacheable_impact(impact);
+  if (cacheable !== null) payload["last_seen_impact"] = cacheable;
+  else if (state["last_seen_impact"] !== void 0 && !latest) payload["last_seen_impact"] = state["last_seen_impact"];
+  try {
+    _write_state(write_path, payload);
+  } catch (err) {
+    const code = err.code;
+    if (typeof code !== "string") {
+      throw err;
+    }
+  }
+  if (!latest || !_is_newer(latest, installed_version)) {
+    return null;
+  }
+  return _format_banner(latest, installed_version, _resolve_origin(options.origin, latest));
+}
+
+// src/scripts/_cli/doctor_install_mode.ts
+function isFile(p) {
+  try {
+    return fs3.statSync(p).isFile();
+  } catch {
+    return false;
+  }
+}
+function isDir(p) {
+  try {
+    return fs3.statSync(p).isDirectory();
+  } catch {
+    return false;
+  }
+}
+var INSTALL_MODE_MARKER_RELATIVE = "agents/.agent-state/install-mode.txt";
+function _is_global_only_consumer(project_root) {
+  return isFile(path3.join(project_root, INSTALL_MODE_MARKER_RELATIVE)) || isDir(path3.join(project_root, "agents", "overrides"));
+}
+
+// src/scripts/_lib/agent_settings.ts
+import { createRequire } from "node:module";
+import * as fs5 from "node:fs";
+import * as path5 from "node:path";
+
+// src/scripts/_lib/package_root.ts
+import * as fs4 from "node:fs";
+import * as path4 from "node:path";
+import { fileURLToPath } from "node:url";
+var PACKAGE_NAME2 = "@event4u/agent-config";
+var MAX_ASCENT = 16;
+function resolvePackageRoot(fromUrlOrPath, legacyHops = 3) {
+  const start = fromUrlOrPath.startsWith("file:") ? fileURLToPath(fromUrlOrPath) : fromUrlOrPath;
+  const startDir = path4.dirname(start);
+  let dir = startDir;
+  for (let i = 0; i < MAX_ASCENT; i++) {
+    const manifest = path4.join(dir, "package.json");
+    if (fs4.existsSync(manifest)) {
+      try {
+        const parsed = JSON.parse(fs4.readFileSync(manifest, "utf8"));
+        if (parsed.name === PACKAGE_NAME2) {
+          return dir;
+        }
+      } catch {
+      }
+    }
+    const parent = path4.dirname(dir);
+    if (parent === dir) {
+      break;
+    }
+    dir = parent;
+  }
+  return path4.resolve(startDir, ...Array.from({ length: legacyHops }, () => ".."));
 }
 
 // src/shared/settingsCarveOut.ts
@@ -105,12 +368,6 @@ var SETTINGS_CARVE_OUT = [
     absentResolvesTo: "legacy-all",
     reason: "The template fallback applies only when NO global settings file exists. Once a file exists, an absent key means legacy-all by documented contract, so an existing install is never silently narrowed on upgrade."
   },
-  {
-    key: "projection.rule_workspaces",
-    reader: "src/install/rule_scope.ts:96 ruleScopeFromSettings",
-    absentResolvesTo: "null \u2014 LEGACY_ALL, i.e. every rule ships including maintainer-only ones",
-    reason: "Same upgrade contract as projection.mode, and the failure is louder: an absent list widens the projection instead of narrowing it."
-  },
   {
     key: "discipline_profile",
     reader: "work_engine/_lib/agent_settings.ts:1263",
@@ -153,6 +410,7 @@ function carveOutKeys() {
 }
 
 // src/scripts/_lib/settings_renamed_keys.ts
+var SETTINGS_REMOVAL_RULE = "A settings key may be removed or renamed in a minor release only when no consumer project can rely on it \u2014 default-neutral and derivable, proven by a named test; any other removal or rename ships only in a major, and a renamed key's alias is dropped only in a major.";
 var RENAMED_KEYS = /* @__PURE__ */ new Map([
   ["planning.challenge_on_create", "planning.closure_pass"]
 ]);
@@ -183,7 +441,7 @@ function applyRenamedKeys(layer) {
     if (_warned.has(oldKey)) continue;
     _warned.add(oldKey);
     process.stderr.write(
-      `\u26A0\uFE0F  settings: \`${oldKey}\` was renamed to \`${newKey}\`. The old key still works for one minor; rename it in your .agent-settings.yml.
+      `\u26A0\uFE0F  settings: \`${oldKey}\` was renamed to \`${newKey}\`; the old key still works. ${SETTINGS_REMOVAL_RULE} Rename it in your .agent-settings.yml.
 `
     );
   }
@@ -259,7 +517,11 @@ var REMOVED_KEYS = /* @__PURE__ */ new Map([
   ["pipelines.skill_improvement", "the skill-improvement-trigger rule; the capture is a proposal the user confirms"],
   ["consistency.cross_source", "the cross-source-consistency rule, always on; batching and the no-cheap-questions floor bound the noise"],
   ["subagents.downshift", "the model_tier each sub-task declares; downshift is always on"],
-  ["ai_team.suppress_setup_hint", "nothing: the one-line team-mode setup hint is always shown"]
+  ["ai_team.suppress_setup_hint", "nothing: the one-line team-mode setup hint is always shown"],
+  // 2026-10-20 — the projection keys (ADR-293, road-to-a-setup-that-decides-itself Phase 4)
+  ["lean_projection.mode", "the computed layer-form decision (_lib/layer_form_decision.ts), plus `install --full` and src/config/layer-form-brakes.json as the two brakes. For one release window an installer converts a leftover `eager-all` into the install receipt pin and drops any other value, saying which (_lib/projection_key_migration.ts); the project tree reads the package-owned src/config/project-tree-form.json, never this key"],
+  ["lean_projection.hosts", "THINNABLE_HOSTS in _lib/lean_projection_mode.ts and the per-host row in src/config/host-injection-effect.json; no reader of this key remains"],
+  ["projection.rule_workspaces", "consumerRuleWorkspaces() in _lib/scoped_projection.ts, which derives the consumer workspace set from src/config/discovery/packs.yml \u2014 every id minus `agent-config-maintainer` \u2014 so a new pack reaches consumers without a settings edit"]
 ]);
 var _warnedRemovedKeys = /* @__PURE__ */ new Set();
 function _readDotted(root, dotted) {
@@ -326,10 +588,10 @@ var DEFAULT_PROJECT_FILE = ".agent-settings.yml";
 var LOCAL_PROJECT_FILE = ".agent-settings.local.yml";
 var LOCAL_PROJECT_SUBDIR = ["agents", "settings"];
 function _local_settings_path(project_root) {
-  return path3.join(project_root, ...LOCAL_PROJECT_SUBDIR, LOCAL_PROJECT_FILE);
+  return path5.join(project_root, ...LOCAL_PROJECT_SUBDIR, LOCAL_PROJECT_FILE);
 }
 function _canonical_settings_path(project_root) {
-  return path3.join(project_root, ...LOCAL_PROJECT_SUBDIR, DEFAULT_PROJECT_FILE);
+  return path5.join(project_root, ...LOCAL_PROJECT_SUBDIR, DEFAULT_PROJECT_FILE);
 }
 var USER_GLOBAL_FILENAME = "agent-settings.yml";
 function DEFAULT_USER_GLOBAL_FILE() {
@@ -385,22 +647,17 @@ var MERGEABLE_KEYS = [
   // GUI; whitelisting decides only whether the value SURVIVES the merge
   // (ADR-271, road-to-design-intent-conformance 2.3).
   "design.fidelity_mode",
-  // `lean_projection.*` is a per-MACHINE setting and the install it governs is
-  // a user-scope one: the layer being thinned is `~/.claude/rules`, which
-  // belongs to the machine and not to any checkout. Without these two rows a
-  // consumer who wrote the opt-in into the user-global file got no error, no
-  // warning and no effect — the same silent-filter defect the two entries
-  // above repair, reaching a third key, and unsatisfiable-by-construction on
-  // an ADR-020 global-only install, where no project layer exists to carry it.
-  // Whitelisting decides only whether a value SURVIVES the merge: it sets
-  // nothing, and `installerThinsHost` still refuses a template-only value.
-  "lean_projection.mode",
-  "lean_projection.hosts"
+  // `retro.enabled` is the one switch over the automatic retro (ADR-292). It
+  // ships `true`, so the only value worth writing is `false`, and a user who
+  // writes it once in the user-global file expects every checkout without its
+  // own value to honour it — without this row the off switch would be
+  // discarded silently. A project value still wins.
+  "retro.enabled"
 ];
-var TEMPLATE_RELATIVE = path3.join("src", "config", "agent-settings.template.yml");
+var TEMPLATE_RELATIVE = path5.join("src", "config", "agent-settings.template.yml");
 var _PACKAGE_ROOT = resolvePackageRoot(import.meta.url);
 function default_template_path() {
-  return path3.join(_PACKAGE_ROOT, TEMPLATE_RELATIVE);
+  return path5.join(_PACKAGE_ROOT, TEMPLATE_RELATIVE);
 }
 function _is_placeholder(value) {
   return typeof value === "string" && /^__[A-Z0-9_]+__$/.test(value);
@@ -451,8 +708,8 @@ var _AGENTS_DIR_MARKERS = [
 var _LEGACY_ANCHOR_ENV = "AGENT_CONFIG_LEGACY_ANCHOR";
 function _exists(p) {
   try {
-    fs3.lstatSync(p);
-    fs3.statSync(p);
+    fs5.lstatSync(p);
+    fs5.statSync(p);
     return true;
   } catch {
     return false;
@@ -460,22 +717,22 @@ function _exists(p) {
 }
 function _is_dir(p) {
   try {
-    return fs3.statSync(p).isDirectory();
+    return fs5.statSync(p).isDirectory();
   } catch {
     return false;
   }
 }
 function _is_file(p) {
   try {
-    return fs3.statSync(p).isFile();
+    return fs5.statSync(p).isFile();
   } catch {
     return false;
   }
 }
 function _resolve(p) {
-  const absolute = path3.resolve(p);
+  const absolute = path5.resolve(p);
   try {
-    return fs3.realpathSync(absolute);
+    return fs5.realpathSync(absolute);
   } catch {
     return absolute;
   }
@@ -485,7 +742,7 @@ function _ancestor_chain(start) {
   let cursor = start;
   for (; ; ) {
     chain.push(cursor);
-    const parent = path3.dirname(cursor);
+    const parent = path5.dirname(cursor);
     if (parent === cursor) {
       break;
     }
@@ -494,15 +751,15 @@ function _ancestor_chain(start) {
   return chain;
 }
 function _boundary_anchor_at(dir) {
-  const agents_dir = path3.join(dir, "agents");
+  const agents_dir = path5.join(dir, "agents");
   if (_is_dir(agents_dir)) {
     for (const marker of _AGENTS_DIR_MARKERS) {
-      if (_exists(path3.join(agents_dir, marker))) {
+      if (_exists(path5.join(agents_dir, marker))) {
         return ANCHOR_AGENTS_DIR;
       }
     }
   }
-  if (_exists(path3.join(dir, ".git"))) {
+  if (_exists(path5.join(dir, ".git"))) {
     return ANCHOR_GIT;
   }
   return null;
@@ -513,7 +770,7 @@ function find_project_root_with_anchor(start) {
   const chain = _ancestor_chain(current);
   if (legacy) {
     for (const candidate of chain) {
-      if (_exists(path3.join(candidate, ".git"))) {
+      if (_exists(path5.join(candidate, ".git"))) {
         return [candidate, ANCHOR_GIT];
       }
     }
@@ -527,7 +784,7 @@ function find_project_root_with_anchor(start) {
   }
   let outermost = null;
   for (const candidate of chain) {
-    if (_exists(path3.join(candidate, DEFAULT_PROJECT_FILE))) {
+    if (_exists(path5.join(candidate, DEFAULT_PROJECT_FILE))) {
       outermost = candidate;
     }
   }
@@ -543,13 +800,13 @@ function find_project_root(start) {
 function _resolve_cascade_paths(cwd, project_path) {
   if (cwd === null) {
     const legacy = project_path ? project_path : DEFAULT_PROJECT_FILE;
-    const parent = path3.dirname(legacy);
+    const parent = path5.dirname(legacy);
     return [legacy, _canonical_settings_path(parent), _local_settings_path(parent)];
   }
   const root = find_project_root(cwd);
   if (root === null) {
     const legacy = project_path ? project_path : DEFAULT_PROJECT_FILE;
-    const parent = path3.dirname(legacy);
+    const parent = path5.dirname(legacy);
     return [legacy, _canonical_settings_path(parent), _local_settings_path(parent)];
   }
   const cwd_resolved = _resolve(cwd);
@@ -560,7 +817,7 @@ function _resolve_cascade_paths(cwd, project_path) {
     if (cursor === root) {
       break;
     }
-    const parent = path3.dirname(cursor);
+    const parent = path5.dirname(cursor);
     if (parent === cursor) {
       break;
     }
@@ -568,11 +825,37 @@ function _resolve_cascade_paths(cwd, project_path) {
   }
   chain.reverse();
   return [
-    ...chain.map((d) => path3.join(d, DEFAULT_PROJECT_FILE)),
+    ...chain.map((d) => path5.join(d, DEFAULT_PROJECT_FILE)),
     _canonical_settings_path(root),
     _local_settings_path(root)
   ];
 }
+function _probe_yaml(p) {
+  if (!_is_file(p)) return "absent";
+  let YAML;
+  try {
+    YAML = _require("yaml");
+  } catch {
+    return "malformed";
+  }
+  try {
+    YAML.parse(fs5.readFileSync(p, "utf-8"), { version: "1.1" });
+    return "valid";
+  } catch (err) {
+    if (_is_yaml_error(err) || _is_os_error(err)) return "malformed";
+    throw err;
+  }
+}
+function settings_layer_states(options = {}) {
+  const project_path = options.project_path ?? null;
+  const cwd = options.cwd ?? null;
+  const user_global = options.user_global_path ? [options.user_global_path] : user_global_settings_paths();
+  const out = [];
+  for (const p of [...user_global, ..._resolve_cascade_paths(cwd, project_path)]) {
+    out.push({ path: p, state: _probe_yaml(p) });
+  }
+  return out;
+}
 function load_agent_settings(options = {}) {
   const project_path = options.project_path ?? null;
   const user_global_path = options.user_global_path ?? null;
@@ -614,7 +897,7 @@ function _read_yaml(p) {
   }
   let data;
   try {
-    const text = fs3.readFileSync(p, "utf-8");
+    const text = fs5.readFileSync(p, "utf-8");
     data = YAML.parse(text, { version: "1.1" });
     if (data === null || data === void 0) {
       data = {};
@@ -713,216 +996,269 @@ function _is_plain_dict(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
-// src/scripts/_lib/scan_scope.ts
-import * as fs4 from "node:fs";
-import * as path4 from "node:path";
-var DeadScopeError = class extends Error {
-  gate;
-  constructor(gate, message) {
-    super(message);
-    this.name = "DeadScopeError";
-    this.gate = gate;
-  }
-};
-function assertWatchlistResolves(opts) {
-  const resolved = opts.candidates.filter((rel) => {
-    try {
-      return fs4.statSync(path4.join(opts.repoRoot, rel)).isFile();
-    } catch {
-      return false;
-    }
-  });
-  if (resolved.length === 0) {
-    throw new DeadScopeError(
-      opts.gate,
-      `${opts.gate}: none of its ${opts.candidates.length} guarded path(s) exist under ${opts.repoRoot} \u2014 the guard is watching phantoms and can never fire. Checked: ${opts.candidates.join(", ")}`
-    );
-  }
-  return resolved;
-}
+// src/scripts/_lib/advisory_notice.ts
+import { createHash } from "node:crypto";
+import * as fs7 from "node:fs";
+import * as path7 from "node:path";
 
-// src/scripts/_lib/update_check.ts
-import { randomBytes } from "node:crypto";
-import * as fs5 from "node:fs";
-import * as path5 from "node:path";
-var PACKAGE_NAME2 = "@event4u/agent-config";
-var NPM_REGISTRY_URL = `https://registry.npmjs.org/${PACKAGE_NAME2}/latest`;
-var FETCH_TIMEOUT_S = 1;
-var CHECK_WINDOW_MS = 24 * 60 * 60 * 1e3;
-var STATE_FILENAME = "update-check.json";
-var DEFAULT_STATE_PATH = write_target(STATE_FILENAME);
-function _resolve_state_path() {
-  const found = resolve_with_fallback(STATE_FILENAME);
-  if (found !== null) {
-    return found;
+// src/scripts/_lib/git_common_dir.ts
+import fs6 from "node:fs";
+import path6 from "node:path";
+function realpath_or_self(p) {
+  try {
+    return fs6.realpathSync(p);
+  } catch {
+    return p;
   }
-  return DEFAULT_STATE_PATH;
 }
-async function fetch_latest_from_npm(options = {}) {
-  const timeout = options.timeout ?? FETCH_TIMEOUT_S;
-  const url = options.url ?? NPM_REGISTRY_URL;
-  const fetch_impl = options.fetch_impl ?? fetch;
+function git_common_dir(project_root) {
+  const dot_git = path6.join(project_root, ".git");
   try {
-    const resp = await fetch_impl(url, {
-      headers: {
-        Accept: "application/json",
-        "User-Agent": "agent-config-update-check"
-      },
-      signal: AbortSignal.timeout(timeout * 1e3)
-    });
-    const payload = await resp.json();
-    if (payload !== null && typeof payload === "object" && !Array.isArray(payload)) {
-      const version = payload.version;
-      if (typeof version === "string" && version.trim()) {
-        return version.trim();
-      }
+    const st = fs6.statSync(dot_git);
+    if (st.isDirectory()) {
+      return realpath_or_self(dot_git);
+    }
+    const m = fs6.readFileSync(dot_git, "utf-8").match(/^gitdir:\s*(.+)\s*$/m);
+    if (m === null) {
+      return null;
+    }
+    const gitdir = path6.resolve(project_root, m[1].trim());
+    const commondir_file = path6.join(gitdir, "commondir");
+    if (fs6.existsSync(commondir_file)) {
+      const common = path6.resolve(gitdir, fs6.readFileSync(commondir_file, "utf-8").trim());
+      return realpath_or_self(common);
     }
+    return realpath_or_self(gitdir);
   } catch {
     return null;
   }
-  return null;
 }
-function _read_state(state_path) {
+
+// src/scripts/_lib/undeployed_fixes.ts
+var UNDEPLOYED_AFTER_HOURS = 24;
+function mergedNotDeployed(all, findings, now = /* @__PURE__ */ new Date()) {
+  const byKey = new Map(findings.map((f) => [f.key, f]));
+  const rows = [];
+  for (const r of Object.values(all)) {
+    if (r.state !== "fixed-in-trunk" && r.state !== "fixed-released") continue;
+    const since = r.stamps["fixed-in-trunk"];
+    if (since === void 0) continue;
+    const hours = (now.getTime() - Date.parse(since)) / 36e5;
+    if (!Number.isFinite(hours) || hours < UNDEPLOYED_AFTER_HOURS) continue;
+    const f = byKey.get(r.key);
+    if (f !== void 0 && f.tier !== "T0" && f.tier !== "T1") continue;
+    rows.push({ id: r.key.split("|")[0] ?? r.key, mergeSha: r.merge_sha, hours: Math.floor(hours) });
+  }
+  return rows;
+}
+
+// src/scripts/_lib/advisory_notice.ts
+var STALE_AFTER_HOURS = 24;
+var SILENCE_NOTICE_DAYS = 3;
+function readAdvisorySettings(root) {
   try {
-    const raw = fs5.readFileSync(state_path, "utf-8");
-    const data = JSON.parse(raw);
-    if (data !== null && typeof data === "object" && !Array.isArray(data)) {
-      return data;
-    }
+    if (settings_layer_states({ cwd: root }).some((l) => l.state === "malformed")) return { mode: "off", egress: "none", kev: "off" };
+    const section = load_agent_settings({ cwd: root })["advisories"];
+    const s = section !== null && typeof section === "object" && !Array.isArray(section) ? section : {};
+    return {
+      // An unquoted `off` is YAML's boolean false: both mean off.
+      mode: s["mode"] === "off" || s["mode"] === false ? "off" : "notify",
+      egress: s["egress"] === "none" ? "none" : "query",
+      kev: s["kev"] === "off" || s["kev"] === false ? "off" : "on"
+    };
   } catch {
+    return { mode: "off", egress: "none", kev: "off" };
   }
-  return {};
 }
-function _write_state(state_path, payload) {
-  const parent = path5.dirname(state_path);
-  fs5.mkdirSync(parent, { recursive: true });
-  const tmp = path5.join(parent, `.update-check-${randomBytes(8).toString("hex")}`);
+function statePath(root) {
+  const common = git_common_dir(root);
+  if (common === null) return null;
+  let real = path7.resolve(root);
   try {
-    const sorted = {};
-    for (const key of Object.keys(payload).sort()) {
-      sorted[key] = payload[key];
-    }
-    fs5.writeFileSync(tmp, JSON.stringify(sorted, null, 2), { encoding: "utf-8", mode: 384 });
-    fs5.chmodSync(tmp, 384);
-    fs5.renameSync(tmp, state_path);
-  } catch (err) {
+    real = fs7.realpathSync(root);
+  } catch {
+  }
+  const key = createHash("sha256").update(real).digest("hex").slice(0, 16);
+  return path7.join(common, "agent-config", "advisories", `${key}.json`);
+}
+function remediationsPath(root) {
+  const common = git_common_dir(root);
+  return common === null ? null : path7.join(common, "agent-config", "advisories", "remediations.json");
+}
+function readRemediations(root) {
+  const p = remediationsPath(root);
+  if (p !== null) {
     try {
-      fs5.unlinkSync(tmp);
+      const doc = JSON.parse(fs7.readFileSync(p, "utf-8"));
+      if (isObject(doc)) return doc;
     } catch {
     }
-    throw err;
   }
+  return readState(root)?.remediations ?? {};
 }
-function _should_check(state, now) {
-  const last = state.last_check_utc;
-  if (typeof last !== "string") {
-    return true;
-  }
-  let normalized = last.replace(/Z/g, "+00:00");
-  if (!/[+-]\d{2}:?\d{2}$/.test(normalized)) {
-    normalized = `${normalized}+00:00`;
-  }
-  const last_ms = Date.parse(normalized);
-  if (Number.isNaN(last_ms)) {
-    return true;
+function readState(root) {
+  const p = statePath(root);
+  if (p === null) return null;
+  try {
+    const doc = JSON.parse(fs7.readFileSync(p, "utf-8"));
+    return isState(doc) ? doc : null;
+  } catch {
+    return null;
   }
-  return now.getTime() - last_ms >= CHECK_WINDOW_MS;
 }
-function _format_banner(latest, installed) {
-  return `\u2139\uFE0F  agent-config ${latest} available (you have ${installed}).
-    Update: npx ${PACKAGE_NAME2} update`;
+var isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+function isState(doc) {
+  if (!isObject(doc) || doc["schema"] !== 1 || typeof doc["at"] !== "string") return false;
+  if (!Array.isArray(doc["findings"]) || !doc["findings"].every((f) => isObject(f) && typeof f["key"] === "string")) return false;
+  const n = doc["notice"];
+  if (n !== null && n !== void 0 && !(isObject(n) && Array.isArray(n["interrupt"]) && typeof n["digest"] === "number")) return false;
+  if (doc["silent_since"] !== void 0 && !isObject(doc["silent_since"])) return false;
+  if (doc["remediations"] !== void 0 && !isObject(doc["remediations"])) return false;
+  return true;
 }
-function _int_or_zero(part) {
-  const trimmed = part.trim();
-  if (/^[+-]?\d+$/.test(trimmed)) {
-    return parseInt(trimmed, 10);
-  }
-  return 0;
+var MAX_NOTICE_LINES = 8;
+var FIELD = /^[A-Za-z0-9@._:/+~^<>=*-]{1,200}$/;
+function safeField(v, max = 80) {
+  if (typeof v === "number" && Number.isInteger(v) && v >= 0 && v < 1e7) return String(v);
+  if (typeof v !== "string" || v.length > max || !FIELD.test(v)) return "?";
+  return v;
 }
-function _is_newer(latest, installed) {
-  const parse = (v) => {
-    const core = v.replace(/^v+/, "").split("-")[0] ?? "";
-    const parts = core.split(".");
-    const out = [];
-    for (const p of parts.slice(0, 3)) {
-      out.push(_int_or_zero(p));
-    }
-    while (out.length < 3) {
-      out.push(0);
-    }
-    return [out[0], out[1], out[2]];
-  };
-  const a = parse(latest);
-  const b = parse(installed);
-  for (let i = 0; i < 3; i += 1) {
-    if (a[i] > b[i]) {
-      return true;
-    }
-    if (a[i] < b[i]) {
-      return false;
-    }
-  }
-  return false;
+var TIERS = /* @__PURE__ */ new Set(["T0", "T1", "T2", "T3"]);
+var VERDICTS = /* @__PURE__ */ new Set([
+  "affected",
+  "fix-available",
+  "fix-fresh",
+  "no-fix",
+  "malware",
+  "eol",
+  "eol-soon",
+  "pre-announced",
+  "unknown",
+  "accepted"
+]);
+function enumField(v, allowed) {
+  return typeof v === "string" && allowed.has(v) ? v : "?";
 }
-function _format_utc(d) {
-  return d.toISOString().replace(/\.\d{3}Z$/, "Z");
+function where(f) {
+  return f.file === "" ? "" : ` (${safeField(f.file, 200)}:${safeField(f.line)})`;
 }
-async function check_for_update(installed_version, options = {}) {
-  const env = options.env ?? process.env;
-  if (env.AGENT_CONFIG_NO_UPDATE_CHECK === "1") {
-    return null;
+function describe(f) {
+  const tier = enumField(f.tier, TIERS);
+  const verdict = enumField(f.verdict, VERDICTS);
+  const pkg = safeField(f.package);
+  const ver = f.version === null ? "" : ` ${safeField(f.version)}`;
+  const fix = f.fixed === null ? "" : ` \u2192 ${safeField(f.fixed)}`;
+  const date = safeField(f.date);
+  const ids = [f.id, ...Array.isArray(f.aliases) ? f.aliases : []].slice(0, 3).map((i) => safeField(i)).join(", ");
+  const kev = f.kev === true ? " \u2014 known exploited (KEV)" : "";
+  switch (verdict) {
+    case "pre-announced":
+      return `${tier} ${pkg}: a security release is pre-announced (${date}); fixed versions not yet named${where(f)}`;
+    case "eol":
+      return `${tier} ${pkg}${ver}: security support ended ${date}${where(f)}`;
+    case "eol-soon":
+      return `${tier} ${pkg}${ver}: security support ends ${date}${where(f)}`;
+    case "unknown":
+      if (typeof f.note === "string" && f.note.includes("egress-none")) return `${tier} ${pkg}: not checked \u2014 advisories.egress is none`;
+      if (typeof f.note === "string" && f.note.includes("lockfile-unsupported")) return `${tier} ${pkg}: not checked \u2014 a lockfile format this audit cannot read (yarn, pnpm, bun or npm v1)`;
+      if (typeof f.note === "string" && f.note.startsWith("vendor-patched")) return `${tier} ${pkg}${ver}: distro-patched \u2014 judge it by the distro's own advisory${where(f)}`;
+      return `${tier} ${pkg}: unknown \u2014 the source did not answer`;
+    default:
+      return `${tier} ${pkg}${ver}${fix} [${verdict}] ${ids}${kev}${where(f)}`;
   }
-  if (env.CI === "1" || env.CI === "true" || env.GITHUB_ACTIONS === "true") {
-    return null;
+}
+function noticeLines(state, now = /* @__PURE__ */ new Date(), remediations = null) {
+  if (state === null) return [];
+  const lines = [];
+  const atMs = Date.parse(state.at);
+  const ageH = Number.isFinite(atMs) && atMs <= now.getTime() ? (now.getTime() - atMs) / 36e5 : Number.POSITIVE_INFINITY;
+  const byKey = new Map(state.findings.map((f) => [f.key, f]));
+  const pending = state.notice?.interrupt.map((k) => byKey.get(k)).filter((f) => f !== void 0) ?? [];
+  for (const f of pending) {
+    lines.push(`advisory ${describe(f)} \u2014 fix now: /audit deps fix ${safeField(f.id)} (here or in its own worktree), or later`);
+  }
+  if ((state.notice?.digest ?? 0) > 0) lines.push(`advisories: ${safeField(state.notice.digest)} more in the digest \u2014 /audit deps`);
+  for (const [source, since] of Object.entries(state.silent_since ?? {}).slice(0, 4)) {
+    const sinceMs = Date.parse(String(since));
+    if (!Number.isFinite(sinceMs) || sinceMs > now.getTime()) {
+      lines.push(`advisories: ${safeField(source)} silent since an unreadable date \u2014 findings from it are unknown, not clear`);
+      continue;
+    }
+    const days = (now.getTime() - sinceMs) / 864e5;
+    if (days >= SILENCE_NOTICE_DAYS) lines.push(`advisories: ${safeField(source)} has not answered for ${Math.floor(days)} days \u2014 findings from it are unknown, not clear`);
   }
-  const settings_enabled = options.settings_enabled ?? true;
-  if (!settings_enabled) {
-    return null;
+  for (const u of mergedNotDeployed(remediations ?? state.remediations ?? {}, state.findings, now)) {
+    const sha = u.mergeSha === null ? "" : ` (${safeField(u.mergeSha.slice(0, 12))})`;
+    lines.push(`advisory ${safeField(u.id)}: merged${sha} but not deployed for ${safeField(u.hours)} h \u2014 deploy it the way this project deploys`);
   }
-  let is_tty = options.is_tty ?? null;
-  if (is_tty === null) {
-    is_tty = Boolean(process.stdout.isTTY);
+  if (ageH === Number.POSITIVE_INFINITY) {
+    lines.push("advisories: data age unreadable \u2014 run `agent-config audit:deps refresh`");
+  } else if (ageH >= STALE_AFTER_HOURS) {
+    lines.push(`advisories: data is ${Math.floor(ageH / 24) || 1} day(s) old \u2014 run \`agent-config audit:deps refresh\``);
   }
-  if (!is_tty) {
-    return null;
+  return lines.length > MAX_NOTICE_LINES ? [...lines.slice(0, MAX_NOTICE_LINES - 1), `advisories: ${lines.length - MAX_NOTICE_LINES + 1} more \u2014 /audit deps`] : lines;
+}
+function sessionNotice(root, now = /* @__PURE__ */ new Date(), deliver) {
+  if (readAdvisorySettings(root).mode === "off") return null;
+  const state = readState(root);
+  if (state === null) return null;
+  const stamp = statePath(root) + ".shown";
+  let prev = {};
+  try {
+    prev = JSON.parse(fs7.readFileSync(stamp, "utf-8"));
+  } catch {
+    prev = {};
+  }
+  const day = now.toISOString().slice(0, 10);
+  const lines = noticeLines(state, now, readRemediations(root));
+  const keyOf = (l) => createHash("sha256").update(l.replace(/\b\d+ (?:h|days?|day\(s\))\b/g, "#")).digest("hex").slice(0, 16);
+  const isReminder = (l) => /^advisories: (?:data|\S+ (?:has not answered|silent since))|: merged/.test(l);
+  const once = new Set(Array.isArray(prev.once) ? prev.once : []);
+  const today = new Set(prev.day === day && Array.isArray(prev.today) ? prev.today : []);
+  const out = lines.filter((l) => isReminder(l) ? !today.has(keyOf(l)) : !once.has(keyOf(l)));
+  if (out.length === 0) return null;
+  const text = out.join("\n");
+  if (deliver !== void 0 && !deliver(text)) return null;
+  for (const l of out) (isReminder(l) ? today : once).add(keyOf(l));
+  try {
+    fs7.writeFileSync(stamp, `${JSON.stringify({ day, once: [...once].slice(-200), today: [...today] })}
+`);
+  } catch {
   }
-  const now = options.now ?? /* @__PURE__ */ new Date();
-  const read_path = options.state_path ?? _resolve_state_path();
-  const write_path = options.state_path ?? DEFAULT_STATE_PATH;
-  const state = _read_state(read_path);
-  if (!_should_check(state, now)) {
-    const latest2 = state.last_seen_version;
-    if (typeof latest2 === "string" && _is_newer(latest2, installed_version)) {
-      return _format_banner(latest2, installed_version);
-    }
-    return null;
+  return text;
+}
+
+// src/scripts/_lib/scan_scope.ts
+import * as fs8 from "node:fs";
+import * as path8 from "node:path";
+var DeadScopeError = class extends Error {
+  gate;
+  constructor(gate, message) {
+    super(message);
+    this.name = "DeadScopeError";
+    this.gate = gate;
   }
-  const fetcher = options.fetcher ?? (() => fetch_latest_from_npm());
-  const latest = await fetcher();
-  const fallback_seen = Object.prototype.hasOwnProperty.call(state, "last_seen_version") ? state.last_seen_version : "";
-  const payload = {
-    last_check_utc: _format_utc(now),
-    // Python: `latest or state.get("last_seen_version", "")`.
-    last_seen_version: latest ? latest : fallback_seen,
-    installed_version
-  };
-  try {
-    _write_state(write_path, payload);
-  } catch (err) {
-    const code = err.code;
-    if (typeof code !== "string") {
-      throw err;
+};
+function assertWatchlistResolves(opts) {
+  const resolved = opts.candidates.filter((rel) => {
+    try {
+      return fs8.statSync(path8.join(opts.repoRoot, rel)).isFile();
+    } catch {
+      return false;
     }
+  });
+  if (resolved.length === 0) {
+    throw new DeadScopeError(
+      opts.gate,
+      `${opts.gate}: none of its ${opts.candidates.length} guarded path(s) exist under ${opts.repoRoot} \u2014 the guard is watching phantoms and can never fire. Checked: ${opts.candidates.join(", ")}`
+    );
   }
-  if (!latest || !_is_newer(latest, installed_version)) {
-    return null;
-  }
-  return _format_banner(latest, installed_version);
+  return resolved;
 }
 
 // src/scripts/check_update_banner.ts
 var _HERE = fileURLToPath2(import.meta.url);
-var ROOT = path6.resolve(path6.dirname(_HERE), "..", "..");
+var ROOT = path9.resolve(path9.dirname(_HERE), "..", "..");
 var DOC = `Thin CLI wrapper: emit the daily update-check banner to stderr.
 
 Invoked by the \`scripts/agent-config\` dispatcher **after** a
@@ -936,9 +1272,9 @@ Usage:
 When \`--installed-version\` is omitted, reads \`package.json\` next to
 the package root (\`$PACKAGE_ROOT/package.json\`).`;
 function _read_installed_version(package_root) {
-  const candidate = path6.join(package_root, "package.json");
+  const candidate = path9.join(package_root, "package.json");
   try {
-    const data = JSON.parse(fs6.readFileSync(candidate, "utf-8"));
+    const data = JSON.parse(fs9.readFileSync(candidate, "utf-8"));
     const version = data["version"];
     if (typeof version === "string" && version.trim()) {
       return version.trim();
@@ -962,6 +1298,22 @@ function _read_settings_flag(cwd) {
   }
   return true;
 }
+function _read_project_pin(cwd) {
+  try {
+    const pin = load_agent_settings({ cwd })["agent_config_version"];
+    return typeof pin === "string" && pin.trim() !== "" ? pin.trim() : null;
+  } catch {
+    return null;
+  }
+}
+function _detect_origin(package_root, cwd, latest) {
+  return classify_install_origin({
+    package_root,
+    project_pin: _read_project_pin(cwd),
+    latest,
+    is_global_consumer: _is_global_only_consumer(cwd)
+  });
+}
 function parse_args(argv) {
   let installed_version = "";
   let cwd = process.cwd();
@@ -988,6 +1340,19 @@ async function main(argv = process.argv.slice(2)) {
     process.stdout.write(DOC + "\n");
     return 0;
   }
+  try {
+    sessionNotice(path9.resolve(args.cwd), void 0, (text) => {
+      if (!tty.isatty(3)) return false;
+      try {
+        fs9.writeSync(3, `${text}
+`);
+        return true;
+      } catch {
+        return false;
+      }
+    });
+  } catch {
+  }
   if (!args.installed_version) {
     try {
       assertWatchlistResolves({
@@ -1010,14 +1375,17 @@ async function main(argv = process.argv.slice(2)) {
   }
   let cwd;
   try {
-    cwd = path6.resolve(args.cwd);
+    cwd = path9.resolve(args.cwd);
   } catch {
     cwd = ROOT;
   }
   const enabled = _read_settings_flag(cwd);
   let banner;
   try {
-    banner = await check_for_update(installed, { settings_enabled: enabled });
+    banner = await check_for_update(installed, {
+      settings_enabled: enabled,
+      origin: (latest) => _detect_origin(ROOT, cwd, latest)
+    });
   } catch {
     return 0;
   }
@@ -1031,17 +1399,17 @@ function _isCliEntry() {
     return false;
   }
   if (true) {
-    if (path6.basename(process.argv[1], ".js") === "check_update_banner") {
+    if (path9.basename(process.argv[1], ".js") === "check_update_banner") {
       return true;
     }
   }
-  const argvUrl = pathToFileURL(path6.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL(path9.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs6.realpathSync(fileURLToPath2(import.meta.url));
-    const argv = fs6.realpathSync(path6.resolve(process.argv[1]));
+    const here = fs9.realpathSync(fileURLToPath2(import.meta.url));
+    const argv = fs9.realpathSync(path9.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
@@ -1052,6 +1420,7 @@ if (_isCliEntry() || process.argv[1] === _HERE) {
 }
 export {
   ROOT,
+  _detect_origin,
   _read_installed_version,
   _read_settings_flag,
   main,