@event4u/agent-config 6.1.0 → 7.0.1

package/src/scripts/_lib/script_output.py

@@ -1,144 +0,0 @@
-"""Verbosity-aware print router for scripts/*.py.
-
-Phase 10 of road-to-token-frugality. Single source of truth for how
-maintenance scripts emit progress, success, warnings, and errors.
-
-Resolution order (first wins):
-  1. AGENT_SCRIPT_VERBOSITY env var      (silent | minimal | verbose)
-  2. SCRIPT_OUTPUT_VERBOSE=1 alias       (== verbose)
-  3. .agent-settings.yml verbosity.script_output
-  4. Default: minimal
-
-Once resolved, the level is exported back into AGENT_SCRIPT_VERBOSITY
-so child processes inherit the same level (Phase 10.1c). Explicit
---quiet flags on the child still win at the call site.
-
-Levels:
-  silent   = stderr only; success() drops; info() drops; warn() drops
-  minimal  = success() collapsed to one end-of-run summary; info() drops
-  verbose  = pre-Phase-10 behaviour, every call prints
-
-error() always writes to stderr regardless of level. Iron-Law surfaces
-(release confirms, install secrets prompts) bypass this module and use
-plain print() so they cannot be silenced.
-"""
-from __future__ import annotations
-
-import os
-import sys
-from pathlib import Path
-from typing import Final
-
-VALID_LEVELS: Final[tuple[str, ...]] = ("silent", "minimal", "verbose")
-DEFAULT_LEVEL: Final[str] = "minimal"
-ENV_VAR: Final[str] = "AGENT_SCRIPT_VERBOSITY"
-ENV_ALIAS: Final[str] = "SCRIPT_OUTPUT_VERBOSE"
-SETTINGS_FILE: Final[str] = ".agent-settings.yml"
-
-_resolved_level: str | None = None
-_pending_summary: list[str] = []
-
-
-def _read_settings_level(settings_path: Path) -> str | None:
-    """Read verbosity.script_output from .agent-settings.yml.
-
-    Returns None when the file is missing, PyYAML is unavailable, or
-    the key is absent. Errors fall through to the default level. Goes
-    through the centralized loader (road-to-portable-dev-preferences P3)
-    so the tolerance contract — missing file, malformed YAML, no PyYAML
-    — degrades uniformly across scripts. ``verbosity.script_output`` is
-    not on the user-global whitelist, so a value there is silently
-    ignored; the project file is the only source for this knob.
-    """
-    # Lazy import — supports both `python3 scripts/foo.py` (sys.path
-    # contains scripts/) and `pytest` (scripts._lib is a proper package).
-    try:
-        from _lib.agent_settings import load_agent_settings  # type: ignore[import-not-found]  # noqa: PLC0415
-    except ImportError:
-        from scripts._lib.agent_settings import (  # noqa: PLC0415
-            load_agent_settings,
-        )
-
-    data = load_agent_settings(project_path=settings_path)
-    section = data.get("verbosity")
-    if not isinstance(section, dict):
-        return None
-    value = section.get("script_output")
-    if isinstance(value, str) and value in VALID_LEVELS:
-        return value
-    return None
-
-
-def resolve_level(settings_path: Path | None = None) -> str:
-    """Resolve and cache the active verbosity level.
-
-    First call wins; subsequent calls return the cached value so the
-    process is internally consistent. Tests reset via reset_level().
-    """
-    global _resolved_level
-    if _resolved_level is not None:
-        return _resolved_level
-
-    env_value = os.environ.get(ENV_VAR, "").strip().lower()
-    if env_value in VALID_LEVELS:
-        _resolved_level = env_value
-    elif os.environ.get(ENV_ALIAS, "").strip() == "1":
-        _resolved_level = "verbose"
-    else:
-        path = settings_path or Path(SETTINGS_FILE)
-        _resolved_level = _read_settings_level(path) or DEFAULT_LEVEL
-
-    # Inheritance: export resolved level so child processes see it.
-    os.environ[ENV_VAR] = _resolved_level
-    return _resolved_level
-
-
-def reset_level() -> None:
-    """Clear the cached level. Test helper."""
-    global _resolved_level
-    _resolved_level = None
-    _pending_summary.clear()
-
-
-def info(message: str) -> None:
-    """Per-step progress note. Drops at silent + minimal."""
-    if resolve_level() == "verbose":
-        print(message)
-
-
-def success(message: str) -> None:
-    """Per-step success. At minimal collected for end-of-run summary;
-    at verbose printed immediately; at silent dropped."""
-    level = resolve_level()
-    if level == "verbose":
-        print(message)
-    elif level == "minimal":
-        _pending_summary.append(message)
-
-
-def warn(message: str) -> None:
-    """Warning. Stderr at all levels except silent."""
-    if resolve_level() != "silent":
-        print(message, file=sys.stderr)
-
-
-def error(message: str) -> None:
-    """Error. Always stderr regardless of level."""
-    print(message, file=sys.stderr)
-
-
-def flush_summary(headline: str | None = None) -> None:
-    """Emit the pending success() summary at end-of-run.
-
-    No-op at verbose (already printed) and silent (suppressed).
-    Use the explicit `headline` arg to override the auto-pick.
-    """
-    level = resolve_level()
-    if level != "minimal" or not _pending_summary:
-        return
-    if headline:
-        print(headline)
-    else:
-        # Default: print the last collected line as the headline.
-        print(_pending_summary[-1])
-    _pending_summary.clear()

package/src/scripts/_lib/security_lint.py

@@ -1,228 +0,0 @@
-#!/usr/bin/env python3
-"""Shared helpers for the agent-security corpus linters (road-to-security-pillar.md P1).
-
-Implements the **false-positive containment convention** (P1.5) so the
-self-audit linters can scan a corpus that legitimately *contains* attack
-strings as teaching material, without the allowlist-growth death-spiral:
-
-1. **Fenced-block exemption** — content inside a ```` ```security-example ````
-   fence is skipped by every check. Grep-auditable, scoped to the block.
-2. **Confidence weighting** — a match in a doc / example / template / evals
-   file scores at 0.25x; below the FAIL threshold it is a WARN, not an error.
-3. **Per-file pragma** — ``<!-- security-lint: allow <check> "<reason>" -->``
-   anywhere in the file suppresses one check for that file. Reasons are
-   mandatory and counted; crossing PRAGMA_CAP entries repo-wide means the
-   linter is wrong (escalate per autonomous-execution), not "add another".
-
-There is **no global allowlist** — that is the rejected pattern.
-
-The module is import-only (no side effects). Each linter builds its findings
-with :func:`scan` + the predicates here, then calls :func:`report`.
-"""
-from __future__ import annotations
-
-import re
-from dataclasses import dataclass
-from pathlib import Path
-
-# repo root, resolved from src/scripts/_lib/security_lint.py
-ROOT = Path(__file__).resolve().parents[3]
-
-PRAGMA_CAP = 20
-EXAMPLE_FENCE_LANG = "security-example"
-
-# Shown in every linter's --help (P1.5 reference obligation).
-GUIDELINE = "docs/guidelines/agent-infra/security-lint-containment.md"
-GUIDELINE_EPILOG = (
-    "False-positive containment (fenced security-example block, confidence "
-    "weighting, per-file `security-lint: allow` pragma — no global allowlist): "
-    f"see {GUIDELINE}."
-)
-
-# Source-of-truth roots scanned by the self-audit linters.
-DEFAULT_SCAN_ROOTS = ("src/skills", "src/rules", "src/agent-src", "src/domains")
-
-# A path is "example/teaching" (0.25x weight) when it lives under docs/ or
-# evals/, or its name marks it as an example/template/fixture.
-_EXAMPLE_PATH = re.compile(
-    r"(^|/)(docs|evals|tests?|fixtures?)(/|$)|example|template|sample|/_template",
-    re.IGNORECASE,
-)
-
-_PRAGMA = re.compile(
-    r"<!--\s*security-lint:\s*allow\s+(?P<check>[\w-]+)\s+"
-    r"\"(?P<reason>[^\"]+)\"\s*-->"
-)
-
-_FENCE = re.compile(r"^(\s*)(`{3,}|~{3,})\s*([\w-]*)\s*$")
-
-SEVERITY_RANK = {"LOW": 1, "MED": 2, "HIGH": 3}
-
-
-@dataclass(frozen=True)
-class Finding:
-    """One linter hit. ``weight`` is the confidence multiplier (1.0 or 0.25)."""
-
-    path: str          # repo-relative
-    line: int          # 1-based; 0 = file-level
-    check: str         # stable check id, also the pragma key
-    severity: str      # HIGH | MED | LOW
-    message: str
-    weight: float = 1.0
-
-    @property
-    def is_fail(self) -> bool:
-        """A HIGH-severity, full-weight finding fails the build."""
-        return self.severity == "HIGH" and self.weight >= 1.0
-
-
-def is_example_path(rel_path: str) -> bool:
-    return bool(_EXAMPLE_PATH.search(rel_path))
-
-
-def path_weight(rel_path: str) -> float:
-    return 0.25 if is_example_path(rel_path) else 1.0
-
-
-@dataclass
-class ScannedFile:
-    """A file pre-split into lines with a fence/pragma mask the linters reuse."""
-
-    path: Path
-    rel: str
-    lines: list[str]
-    # per-line flags (1-based index → flag); index 0 unused
-    in_example_fence: list[bool]
-    in_any_fence: list[bool]
-    pragmas: dict[str, str]          # check id → reason (first 15 lines)
-    weight: float
-
-    def pragma_allows(self, check: str) -> bool:
-        return check in self.pragmas
-
-    def iter_lines(self, *, skip_example_fence: bool = True,
-                   skip_any_fence: bool = False):
-        """Yield (lineno, text) honouring the fence masks."""
-        for i, text in enumerate(self.lines, start=1):
-            if skip_example_fence and self.in_example_fence[i]:
-                continue
-            if skip_any_fence and self.in_any_fence[i]:
-                continue
-            yield i, text
-
-
-def scan_file(path: Path) -> ScannedFile:
-    if path.is_absolute():
-        try:
-            rel = path.relative_to(ROOT).as_posix()
-        except ValueError:
-            rel = path.name  # outside the package root (e.g. a consumer-config audit)
-    else:
-        rel = path.as_posix()
-    raw = path.read_text(encoding="utf-8", errors="surrogatepass")
-    lines = raw.splitlines()
-    n = len(lines)
-    in_example = [False] * (n + 1)
-    in_any = [False] * (n + 1)
-
-    fence_open = False
-    fence_marker = ""
-    fence_is_example = False
-    for i, text in enumerate(lines, start=1):
-        m = _FENCE.match(text)
-        if m and not fence_open:
-            fence_open = True
-            fence_marker = m.group(2)[0]
-            fence_is_example = m.group(3) == EXAMPLE_FENCE_LANG
-            in_any[i] = True
-            in_example[i] = fence_is_example
-            continue
-        if fence_open:
-            in_any[i] = True
-            in_example[i] = fence_is_example
-            # closing fence: same marker char, 3+ long, no info string
-            cm = _FENCE.match(text)
-            if cm and cm.group(2)[0] == fence_marker and cm.group(3) == "":
-                fence_open = False
-                fence_is_example = False
-
-    # Pragmas are explicit, grep-auditable opt-out markers — honour them
-    # anywhere in the file (a long frontmatter can push the body past line 15).
-    pragmas: dict[str, str] = {}
-    for text in lines:
-        for m in _PRAGMA.finditer(text):
-            pragmas[m.group("check")] = m.group("reason")
-
-    return ScannedFile(
-        path=path,
-        rel=rel,
-        lines=lines,
-        in_example_fence=in_example,
-        in_any_fence=in_any,
-        pragmas=pragmas,
-        weight=path_weight(rel),
-    )
-
-
-def scan_path(path: Path, base: Path) -> ScannedFile:
-    """scan_file, but compute ``rel`` relative to an arbitrary ``base`` root.
-
-    Used by the consumer-facing audit (P3.1) to scan a target repo's config
-    instead of this package's ``src/``.
-    """
-    sf = scan_file(path)
-    try:
-        rel = path.resolve().relative_to(base.resolve()).as_posix()
-    except ValueError:
-        rel = path.name
-    return ScannedFile(
-        path=sf.path, rel=rel, lines=sf.lines,
-        in_example_fence=sf.in_example_fence, in_any_fence=sf.in_any_fence,
-        pragmas=sf.pragmas, weight=path_weight(rel),
-    )
-
-
-def iter_corpus(roots=DEFAULT_SCAN_ROOTS, exts=(".md",)):
-    """Yield ScannedFile for every matching file under the given roots."""
-    for root in roots:
-        base = ROOT / root
-        if not base.exists():
-            continue
-        for path in sorted(base.rglob("*")):
-            if path.is_file() and path.suffix in exts:
-                yield scan_file(path)
-
-
-def report(findings: list[Finding], *, check_label: str) -> int:
-    """Print findings grouped by severity; return an exit code.
-
-    Exit 1 iff at least one finding ``is_fail`` (HIGH + full weight). WARN-level
-    (weighted-down or < HIGH) findings print but never fail the build.
-    """
-    if not findings:
-        print(f"✅  {check_label}: clean ({_corpus_note()}).")
-        return 0
-
-    fails = [f for f in findings if f.is_fail]
-    warns = [f for f in findings if not f.is_fail]
-
-    for f in sorted(findings, key=lambda x: (-SEVERITY_RANK.get(x.severity, 0), x.path, x.line)):
-        glyph = "\U0001f534" if f.is_fail else "⚠️"
-        loc = f"{f.path}:{f.line}" if f.line else f.path
-        wnote = "" if f.weight >= 1.0 else f" (weight {f.weight:g})"
-        print(f"  {glyph} [{f.severity}] {f.check} — {loc}{wnote}: {f.message}")
-
-    print()
-    if fails:
-        print(
-            f"❌  {check_label}: {len(fails)} blocking finding(s), "
-            f"{len(warns)} warning(s). Fix, or mark a true teaching example with a "
-            f"```{EXAMPLE_FENCE_LANG} fence or a `security-lint: allow` pragma."
-        )
-        return 1
-    print(f"⚠️  {check_label}: {len(warns)} warning(s), 0 blocking.")
-    return 0
-
-
-def _corpus_note() -> str:
-    return "scanned " + ", ".join(DEFAULT_SCAN_ROOTS)

package/src/scripts/_lib/token_count.py

@@ -1,95 +0,0 @@
-#!/usr/bin/env python3
-"""Real-tokenizer counting for the budget tooling (roadmap 0B.1).
-
-`char != token`. Every budget in this suite is historically in characters;
-the lean-initial-context goal is tokens. This helper adds a token count
-*alongside* chars so chars stay the cheap, stdlib-only proxy and tokens
-become the truth where a real tokenizer is available.
-
-Design — no silent installs, no mandatory network (per `missing-tool-handling`):
-
-- **GPT** — exact via `tiktoken` (`o200k_base`, the GPT-4o/4.1 encoding) when
-  the optional dependency is installed; otherwise a documented `chars / 4`
-  proxy flagged `exact=False`. Install `tiktoken` to activate exact counts.
-- **Claude** — no offline tokenizer ships in `anthropic` 0.98 (the SDK exposes
-  only the live `messages.count_tokens` endpoint, which needs an API call).
-  Offline we use a documented `chars / 3.6` proxy flagged `exact=False`; the
-  exact API count is reserved for the live-bench boundaries to avoid spend on
-  the cheap path.
-
-Both proxies are intentionally conservative ratios drawn from English-prose +
-markdown samples; they are estimates, never gates. The char budgets remain the
-enforced floor (`measure_rule_budget --kernel-budget-check`).
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-
-# Proxy ratios (chars per token) for the no-tokenizer fallback. Tuned for
-# English markdown rule/skill prose; deliberately conservative.
-_GPT_CHARS_PER_TOKEN = 4.0
-_CLAUDE_CHARS_PER_TOKEN = 3.6
-
-_TIKTOKEN_ENCODING = "o200k_base"  # GPT-4o / GPT-4.1 family.
-
-# Resolve the optional tiktoken encoder once at import.
-try:  # pragma: no cover - exercised by env presence, not unit tests
-    import tiktoken  # type: ignore
-
-    _ENC = tiktoken.get_encoding(_TIKTOKEN_ENCODING)
-except Exception:  # ImportError, or model-data fetch failure offline
-    _ENC = None
-
-TIKTOKEN_AVAILABLE = _ENC is not None
-
-
-@dataclass(frozen=True)
-class TokenCount:
-    """A single token measurement and whether it is exact or a proxy."""
-
-    tokens: int
-    exact: bool
-
-
-def gpt_tokens(text: str) -> TokenCount:
-    """GPT token count — exact via tiktoken when present, else a char proxy."""
-    if _ENC is not None:
-        return TokenCount(len(_ENC.encode(text)), True)
-    return TokenCount(round(len(text) / _GPT_CHARS_PER_TOKEN), False)
-
-
-def claude_tokens(text: str) -> TokenCount:
-    """Claude token count — documented offline proxy (no local tokenizer)."""
-    return TokenCount(round(len(text) / _CLAUDE_CHARS_PER_TOKEN), False)
-
-
-def measure(text: str) -> dict[str, object]:
-    """Return chars + per-model token counts for one text blob.
-
-    Keys: chars, tokens_gpt, tokens_gpt_exact, tokens_claude,
-    tokens_claude_exact. The `*_exact` booleans tell a report consumer
-    whether the number is a real tokenizer count or a proxy estimate.
-    """
-    g = gpt_tokens(text)
-    c = claude_tokens(text)
-    return {
-        "chars": len(text),
-        "tokens_gpt": g.tokens,
-        "tokens_gpt_exact": g.exact,
-        "tokens_claude": c.tokens,
-        "tokens_claude_exact": c.exact,
-    }
-
-
-def method_note() -> str:
-    """One-line provenance of how token counts were produced (for reports)."""
-    if TIKTOKEN_AVAILABLE:
-        return (
-            f"tokens_gpt: exact (tiktoken {_TIKTOKEN_ENCODING}); "
-            f"tokens_claude: proxy (chars/{_CLAUDE_CHARS_PER_TOKEN})"
-        )
-    return (
-        f"tokens_gpt: proxy (chars/{_GPT_CHARS_PER_TOKEN}, tiktoken not installed); "
-        f"tokens_claude: proxy (chars/{_CLAUDE_CHARS_PER_TOKEN})"
-    )

package/src/scripts/_lib/update_check.py

@@ -1,207 +0,0 @@
-"""Daily update-check banner for the ``agent-config`` dispatcher.
-
-Phase 2 of road-to-portable-runtime-and-update-check. Pure functions:
-``check_for_update()`` decides whether a banner should be emitted and
-returns the banner string (or ``None``). The dispatcher prints the
-returned string to ``stderr`` after the subcommand finishes — never
-delaying the work, never prompting.
-
-Design constraints (see roadmap P2):
-
-- Stdlib only (no new deps); the package's Python floor is stdlib-only.
-- 1 s hard timeout on the registry call; network failure is silent.
-- 24 h cadence gated by ``~/.event4u/agent-config/update-check.json``
-  (legacy ``~/.config/agent-config/update-check.json`` is read once as
-  a fallback so the cadence is not reset on the first run after the
-  Phase-1 namespace migration).
-- Suppress in CI, on non-TTY stdout, when ``AGENT_CONFIG_NO_UPDATE_CHECK=1``,
-  or when ``update_check.enabled: false`` in settings.
-- State file mode is ``0600``.
-
-The dispatcher is the only call site. Tests mock ``now``, the state
-path, and ``fetch_latest_from_npm`` to cover every branch.
-"""
-from __future__ import annotations
-
-import json
-import os
-import sys
-import tempfile
-import urllib.error
-import urllib.request
-from datetime import datetime, timedelta, timezone
-from pathlib import Path
-from typing import Optional
-
-from scripts._lib import user_global_paths
-
-PACKAGE_NAME = "@event4u/agent-config"
-NPM_REGISTRY_URL = f"https://registry.npmjs.org/{PACKAGE_NAME}/latest"
-FETCH_TIMEOUT_S = 1.0
-CHECK_WINDOW = timedelta(hours=24)
-
-STATE_FILENAME = "update-check.json"
-
-#: Canonical write target. Reads are routed via
-#: :func:`_resolve_state_path` with a read-fallback to the legacy
-#: ``~/.config/agent-config/update-check.json`` so a fresh install
-#: under the new namespace does not lose the 24 h cadence window
-#: established by a pre-2.4 install.
-DEFAULT_STATE_PATH = user_global_paths.write_target(STATE_FILENAME)
-
-
-def _resolve_state_path() -> Path:
-    """Return the active state path, preferring the new namespace."""
-    found = user_global_paths.resolve_with_fallback(STATE_FILENAME)
-    if found is not None:
-        return found
-    return DEFAULT_STATE_PATH
-
-
-def _now_utc() -> datetime:
-    return datetime.now(timezone.utc)
-
-
-def fetch_latest_from_npm(
-    *,
-    timeout: float = FETCH_TIMEOUT_S,
-    url: str = NPM_REGISTRY_URL,
-) -> Optional[str]:
-    """Return the ``latest`` dist-tag version, or ``None`` on any failure.
-
-    Hard 1 s timeout. Any exception (network, JSON, missing key) yields
-    ``None`` — the update check is best-effort.
-    """
-    try:
-        req = urllib.request.Request(
-            url,
-            headers={"Accept": "application/json", "User-Agent": "agent-config-update-check"},
-        )
-        with urllib.request.urlopen(req, timeout=timeout) as resp:  # noqa: S310 — fixed URL
-            payload = json.load(resp)
-        version = payload.get("version")
-        if isinstance(version, str) and version.strip():
-            return version.strip()
-    except (urllib.error.URLError, TimeoutError, ValueError, OSError, json.JSONDecodeError):
-        return None
-    return None
-
-
-def _read_state(path: Path) -> dict:
-    try:
-        with path.open("r", encoding="utf-8") as fh:
-            data = json.load(fh)
-        if isinstance(data, dict):
-            return data
-    except (OSError, ValueError, json.JSONDecodeError):
-        pass
-    return {}
-
-
-def _write_state(path: Path, payload: dict) -> None:
-    path.parent.mkdir(parents=True, exist_ok=True)
-    fd, tmp = tempfile.mkstemp(prefix=".update-check-", dir=str(path.parent))
-    try:
-        with os.fdopen(fd, "w", encoding="utf-8") as fh:
-            json.dump(payload, fh, indent=2, sort_keys=True)
-        os.chmod(tmp, 0o600)
-        os.replace(tmp, path)
-    except Exception:
-        try:
-            os.unlink(tmp)
-        except OSError:
-            pass
-        raise
-
-
-def _should_check(state: dict, now: datetime) -> bool:
-    last = state.get("last_check_utc")
-    if not isinstance(last, str):
-        return True
-    try:
-        last_dt = datetime.fromisoformat(last.replace("Z", "+00:00"))
-    except ValueError:
-        return True
-    if last_dt.tzinfo is None:
-        last_dt = last_dt.replace(tzinfo=timezone.utc)
-    return (now - last_dt) >= CHECK_WINDOW
-
-
-def _format_banner(latest: str, installed: str) -> str:
-    return (
-        f"ℹ️  agent-config {latest} available (you have {installed}).\n"
-        f"    Update: npx {PACKAGE_NAME} update"
-    )
-
-
-def _is_newer(latest: str, installed: str) -> bool:
-    def _parse(v: str) -> tuple:
-        parts = v.lstrip("v").split("-", 1)[0].split(".")
-        out = []
-        for p in parts[:3]:
-            try:
-                out.append(int(p))
-            except ValueError:
-                out.append(0)
-        while len(out) < 3:
-            out.append(0)
-        return tuple(out)
-
-    return _parse(latest) > _parse(installed)
-
-
-def check_for_update(
-    installed_version: str,
-    *,
-    now: Optional[datetime] = None,
-    state_path: Optional[Path] = None,
-    env: Optional[dict] = None,
-    is_tty: Optional[bool] = None,
-    settings_enabled: bool = True,
-    fetcher=fetch_latest_from_npm,
-) -> Optional[str]:
-    """Decide whether to show an update banner. Pure (modulo state file).
-
-    Returns the banner string or ``None``. ``None`` covers every
-    suppression branch (CI, non-TTY, opt-out, within 24 h, network
-    failure, no update available).
-    """
-    env = env if env is not None else os.environ
-    if env.get("AGENT_CONFIG_NO_UPDATE_CHECK") == "1":
-        return None
-    if env.get("CI") in {"1", "true"} or env.get("GITHUB_ACTIONS") == "true":
-        return None
-    if not settings_enabled:
-        return None
-    if is_tty is None:
-        is_tty = sys.stdout.isatty()
-    if not is_tty:
-        return None
-
-    now = now or _now_utc()
-    # When the caller does not pin a state path, route through the
-    # fallback resolver so a pre-2.4 install's cadence file is still
-    # consulted before we decide to re-check npm.
-    read_path = state_path or _resolve_state_path()
-    write_path = state_path or DEFAULT_STATE_PATH
-    state = _read_state(read_path)
-    if not _should_check(state, now):
-        latest = state.get("last_seen_version")
-        if isinstance(latest, str) and _is_newer(latest, installed_version):
-            return _format_banner(latest, installed_version)
-        return None
-
-    latest = fetcher()
-    payload = {
-        "last_check_utc": now.strftime("%Y-%m-%dT%H:%M:%SZ"),
-        "last_seen_version": latest or state.get("last_seen_version", ""),
-        "installed_version": installed_version,
-    }
-    try:
-        _write_state(write_path, payload)
-    except OSError:
-        pass
-
-    if not latest or not _is_newer(latest, installed_version):
-        return None
-    return _format_banner(latest, installed_version)