@inbrace-tech/tokenline 1.2.4 → 1.3.0

package/README.md

@@ -30,6 +30,24 @@ npx @inbrace-tech/tokenline init --antigravity
 
 Simply restart Claude Code or Antigravity, and your new statusline will be live.
 
+### Updating
+
+The installed `tokenline.sh` is a copy, so it stays on the version you installed until you update it. Use the same scope flag you installed with:
+
+```bash
+npx @inbrace-tech/tokenline@latest update --global   # or: update (project), update --antigravity
+```
+
+`update` finds the script your `statusLine` points at and replaces it. It never edits `settings.json`, and there's nothing to restart.
+
+You don't have to remember to check. About once a day, an installed copy looks up the latest published version in the background. When a newer one exists, it adds one gray line to the statusline:
+
+```
+↑ tokenline 1.3.0 available · npx @inbrace-tech/tokenline@latest update --global
+```
+
+The check is a single `GET` to `registry.npmjs.org` for the version number, made only if `curl` is installed. It runs detached, so rendering never waits on the network. Nothing about your session is sent, and nothing downloaded is executed: only a plain `x.y.z` version is accepted and shown. To turn it off, set `TOKENLINE_NO_UPDATE_CHECK=1` (`DO_NOT_TRACK=1` works too).
+
 ---
 
 ## Preview
@@ -97,9 +115,19 @@ On macOS: `brew install bash jq`. BSD `date`/`stat` work as-is; no `coreutils` n
 
 ## Advanced Installation
 
+### Without Node (curl)
+
+No Node? Download the latest release's `tokenline.sh` to `~/.claude/` in one line:
+
+```bash
+curl -fsSL https://github.com/inbrace-tech/tokenline/releases/latest/download/install.sh | bash
+```
+
+It checks the dependencies and prints the `statusLine` block to paste into `settings.json` (see below). Run the same command again to update; once the block is in place, there's nothing else to do. Set `TOKENLINE_DIR` to install somewhere else, e.g. `TOKENLINE_DIR=~/.gemini/antigravity-cli` for the Antigravity CLI.
+
 ### Without Node (clone + install.sh)
 
-No Node? Clone the repo and run the dependency checker, which prints a ready-to-paste snippet:
+Prefer a clone? Run the dependency checker, which prints a ready-to-paste snippet:
 
 ```bash
 git clone https://github.com/inbrace-tech/tokenline.git
@@ -128,8 +156,9 @@ Then restart Claude Code.
 - **Backs up** `settings.json` to `settings.json.bak` before writing.
 - **Never clobbers** invalid JSON: if it can't parse your `settings.json`, it stops and prints the block to paste manually.
 - Is **idempotent**, and won't replace a different existing `statusLine` unless you pass `--force`.
+- **Stamps** the copy with the installed version and the command that updates it (two lines near the top of the script). The repo's own `tokenline.sh` stays unstamped.
 
-Other commands: `doctor` (check dependencies and config, change nothing) and `uninstall` (remove the block; `--purge` also deletes the script).
+Other commands: `update` (replace the installed script, see [Updating](#updating)), `doctor` (check dependencies and config, change nothing) and `uninstall` (remove the block; `--purge` also deletes the script).
 
 ### Antigravity CLI
 

package/dist/cli.js

@@ -1,35 +1,44 @@
 #!/usr/bin/env node
-"use strict";var F=require("fs"),E=require("path");var L=require("os"),l=require("path"),I=(0,l.join)(__dirname,"..","tokenline.sh"),J=t=>t.targetCli==="antigravity"?(0,l.join)((0,L.homedir)(),".gemini","antigravity-cli"):t.global?(0,l.join)((0,L.homedir)(),".claude"):(0,l.resolve)(".claude");var $=t=>t.dir?(0,l.resolve)(t.dir,"tokenline.sh"):(0,l.join)(J(t),"tokenline.sh"),g=t=>(0,l.join)(J(t),"settings.json"),_=t=>t.targetCli==="antigravity"?"antigravity (global)":t.global?"claude (global)":"claude (project)",q=t=>t.includes(" ")?`bash "${t}"`:`bash ${t}`;var p=require("fs");function f(t){if(!(0,p.existsSync)(t))return{exists:!1,data:{}};let e=(0,p.readFileSync)(t,"utf8");if(e.trim()==="")return{exists:!0,data:{},raw:e};try{return{exists:!0,data:JSON.parse(e),raw:e}}catch{return{exists:!0,data:null,raw:e}}}function x(t){let e=`${t}.bak`;return(0,p.copyFileSync)(t,e),e}var v=t=>typeof t=="string"&&/tokenline\.sh/.test(t);var O=require("child_process"),P=require("os");var G=!!process.stdout.isTTY&&!process.env.NO_COLOR,k=(t,e)=>G?`\x1B[${t}m${e}\x1B[0m`:e,i=t=>k("1",t),K=t=>k("2",t),b=t=>k("32",t),Y=t=>k("31",t),z=t=>k("33",t),m=t=>console.log(`${b("\u2713")} ${t}`),a=t=>console.log(`${z("!")} ${t}`),d=t=>console.error(`${Y("\u2717")} ${t}`),s=t=>console.log(`${K("\u2192")} ${t}`);function S(){let t=(0,P.platform)();return t==="linux"||t==="darwin"?(m(`platform: ${t} (supported)`),!0):(a(`platform: ${t} \u2014 supported on Linux/WSL2 and macOS; the bash statusline likely won't render yet (see roadmap). Use --force to install anyway.`),!1)}function w(){let t=(0,O.spawnSync)("jq",["--version"],{encoding:"utf8"});return t.status===0?(m(String(t.stdout).trim()),!0):(a("jq not found \u2014 required at runtime. Install it (apt install jq / brew install jq)."),!1)}function C(){let t=(0,O.spawnSync)("bash",["--version"],{encoding:"utf8"});if(t.status===0){let e=String(t.stdout).match(/version (\d+)\.(\d+)/);return e&&Number(e[1])>=4?(m(`bash ${e[1]}.${e[2]}`),!0):(a(`bash ${e?`${e[1]}.${e[2]}`:"?"} found \u2014 the script needs bash 4+.`),!1)}return a("bash not found \u2014 the statusline runs as a bash script."),!1}function U(){console.log(i(`
+"use strict";var Q=require("fs"),X=require("path");var _=require("os"),u=require("path"),D=(0,u.join)(__dirname,"..","tokenline.sh"),J=t=>t.targetCli==="antigravity"?(0,u.join)((0,_.homedir)(),".gemini","antigravity-cli"):t.global?(0,u.join)((0,_.homedir)(),".claude"):(0,u.resolve)(".claude");var w=t=>t.dir?(0,u.resolve)(t.dir,"tokenline.sh"):(0,u.join)(J(t),"tokenline.sh"),p=t=>(0,u.join)(J(t),"settings.json"),q=t=>t.targetCli==="antigravity"?"antigravity (global)":t.global?"claude (global)":"claude (project)",A=t=>t.includes(" ")?`bash "${t}"`:`bash ${t}`;var b=require("fs");function m(t){if(!(0,b.existsSync)(t))return{exists:!1,data:{}};let e=(0,b.readFileSync)(t,"utf8");if(e.trim()==="")return{exists:!0,data:{},raw:e};try{return{exists:!0,data:JSON.parse(e),raw:e}}catch{return{exists:!0,data:null,raw:e}}}function C(t){let e=`${t}.bak`;return(0,b.copyFileSync)(t,e),e}var L=t=>typeof t=="string"&&/tokenline\.sh/.test(t);var j=require("child_process"),F=require("os");var tt=!!process.stdout.isTTY&&!process.env.NO_COLOR,x=(t,e)=>tt?`\x1B[${t}m${e}\x1B[0m`:e,a=t=>x("1",t),et=t=>x("2",t),h=t=>x("32",t),nt=t=>x("31",t),rt=t=>x("33",t),k=t=>console.log(`${h("\u2713")} ${t}`),l=t=>console.log(`${rt("!")} ${t}`),g=t=>console.error(`${nt("\u2717")} ${t}`),i=t=>console.log(`${et("\u2192")} ${t}`);function T(){let t=(0,F.platform)();return t==="linux"||t==="darwin"?(k(`platform: ${t} (supported)`),!0):(l(`platform: ${t} \u2014 supported on Linux/WSL2 and macOS; the bash statusline likely won't render yet (see roadmap). Use --force to install anyway.`),!1)}function O(){let t=(0,j.spawnSync)("jq",["--version"],{encoding:"utf8"});return t.status===0?(k(String(t.stdout).trim()),!0):(l("jq not found \u2014 required at runtime. Install it (apt install jq / brew install jq)."),!1)}function N(){let t=(0,j.spawnSync)("bash",["--version"],{encoding:"utf8"});if(t.status===0){let e=String(t.stdout).match(/version (\d+)\.(\d+)/);return e&&Number(e[1])>=4?(k(`bash ${e[1]}.${e[2]}`),!0):(l(`bash ${e?`${e[1]}.${e[2]}`:"?"} found \u2014 the script needs bash 4+.`),!1)}return l("bash not found \u2014 the statusline runs as a bash script."),!1}function B(){console.log(a(`
 tokenline \u2014 environment check
-`)),S(),C(),w();let t=[{global:!1,dir:null,targetCli:"claude"},{global:!0,dir:null,targetCli:"claude"},{global:!0,dir:null,targetCli:"antigravity"}];for(let e of t){let r=_(e),n=g(e),o=f(n);o.exists&&o.data&&v(o.data.statusLine?.command)?m(`${r} settings: tokenline configured (${n})`):o.exists&&o.data===null?a(`${r} settings: invalid JSON (${n})`):s(`${r} settings: not configured (${n})`)}console.log()}var c=require("fs"),T=require("path");function A(t){if(console.log(i(`
+`)),T(),N(),O();let t=[{global:!1,dir:null,targetCli:"claude"},{global:!0,dir:null,targetCli:"claude"},{global:!0,dir:null,targetCli:"antigravity"}];for(let e of t){let n=q(e),o=p(e),r=m(o);r.exists&&r.data&&L(r.data.statusLine?.command)?k(`${n} settings: tokenline configured (${o})`):r.exists&&r.data===null?l(`${n} settings: invalid JSON (${o})`):i(`${n} settings: not configured (${o})`)}console.log()}var I=require("fs"),V=require("path");var ot='TOKENLINE_VERSION=""',it='TOKENLINE_UPDATE_CMD=""',st=/^\d+\.\d+\.\d+$/,E=t=>{let e="npx @inbrace-tech/tokenline@latest update";return t.targetCli==="antigravity"?`${e} --antigravity`:t.global?`${e} --global`:e};function K(t,e,n){if(!st.test(e))throw new Error(`Invalid version: ${e}`);if(n.includes("'"))throw new Error("Update command must not contain a single quote");let o=t.split(`
+`),r=(d,c)=>{let f=o.flatMap((v,S)=>v===d?[S]:[]);if(f.length!==1)throw new Error(`Expected exactly one "${d}" line in tokenline.sh`);o[f[0]]=c};return r(ot,`TOKENLINE_VERSION="${e}"`),r(it,`TOKENLINE_UPDATE_CMD='${n}'`),o.join(`
+`)}function M(t){if(typeof t!="string")return null;let e=/^bash (?:"([^"$`\\]+)"|([^\s"'$`\\]+))$/.exec(t),n=e?e[1]??e[2]:void 0;return n!==void 0&&n.endsWith("/tokenline.sh")?n:null}var s=require("fs"),y=require("path");function R(t,e,n){let o=K((0,s.readFileSync)(D,"utf8"),e,n);at(t,o)}function at(t,e){let n=(0,s.existsSync)(t)?(0,s.realpathSync)(t):t;(0,s.mkdirSync)((0,y.dirname)(n),{recursive:!0});let o=(0,y.join)((0,y.dirname)(n),`.${(0,y.basename)(n)}.${process.pid}.tmp`);(0,s.writeFileSync)(o,e,{flag:"wx",mode:493});try{(0,s.chmodSync)(o,493),(0,s.renameSync)(o,n)}catch(r){throw(0,s.rmSync)(o,{force:!0}),r}}function W(t,e){if(console.log(a(`
 tokenline \u2014 installing the statusline
-`)),!S()&&!t.force){d("Unsupported platform. Re-run with --force to install anyway."),process.exitCode=1;return}C(),w();let r=$(t),n=g(t),o={type:"command",command:q(r),refreshInterval:1},u=f(n);if(u.exists&&u.data===null){d(`Could not parse ${n} (invalid JSON). Leaving it untouched.`),console.log(`
+`)),!T()&&!t.force){g("Unsupported platform. Re-run with --force to install anyway."),process.exitCode=1;return}N(),O();let o=w(t),r=p(t),d={type:"command",command:A(o),refreshInterval:1},c=m(r);if(c.exists&&c.data===null){g(`Could not parse ${r} (invalid JSON). Leaving it untouched.`),console.log(`
 Add this block manually, inside the top-level object:
-`),console.log(JSON.stringify({statusLine:o},null,2)+`
-`),process.exitCode=1;return}let y=u.data?u.data.statusLine:void 0,R=y!==void 0&&y.command===o.command,N=y!==void 0&&!R;if(N&&!t.force){d(`A different statusLine is already configured in ${n}:`),console.log(`    ${JSON.stringify(y)}`),a("Re-run with --force to replace it."),process.exitCode=1;return}if(t.dryRun){console.log(i(`
-[dry-run] would:`)),s(`write script  \u2192 ${r}`),s(`${u.exists?"patch":"create"} settings \u2192 ${n}`),u.exists&&s(`backup       \u2192 ${n}.bak`),console.log(`
+`),console.log(JSON.stringify({statusLine:d},null,2)+`
+`),process.exitCode=1;return}let f=c.data?c.data.statusLine:void 0,v=f!==void 0&&f.command===d.command,S=f!==void 0&&!v;if(S&&!t.force){g(`A different statusLine is already configured in ${r}:`),console.log(`    ${JSON.stringify(f)}`),l("Re-run with --force to replace it."),process.exitCode=1;return}if(t.dryRun){console.log(a(`
+[dry-run] would:`)),i(`write script  \u2192 ${o}`),i(`${c.exists?"patch":"create"} settings \u2192 ${r}`),c.exists&&i(`backup       \u2192 ${r}.bak`),console.log(`
 statusLine block:
-${JSON.stringify(o,null,2)}
-`);return}(0,c.mkdirSync)((0,T.dirname)(r),{recursive:!0}),(0,c.copyFileSync)(I,r),(0,c.chmodSync)(r,493),s(`wrote ${r}`);let j=u.data??{};u.exists?(x(n),s(`backed up ${n} \u2192 settings.json.bak`)):(0,c.mkdirSync)((0,T.dirname)(n),{recursive:!0}),j.statusLine=o,(0,c.writeFileSync)(n,JSON.stringify(j,null,2)+`
-`),s(`${R?"confirmed":N?"replaced":"added"} statusLine in ${n}`);let W=t.targetCli==="antigravity"?"Antigravity CLI":"Claude Code";console.log(`
-${b("Done.")} Restart ${W} to see the statusline.
-`)}var h=require("fs");function B(t){console.log(i(`
+${JSON.stringify(d,null,2)}
+`);return}R(o,e,E(t)),i(`wrote ${o} (v${e})`);let U=c.data??{};c.exists?(C(r),i(`backed up ${r} \u2192 settings.json.bak`)):(0,I.mkdirSync)((0,V.dirname)(r),{recursive:!0}),U.statusLine=d,(0,I.writeFileSync)(r,JSON.stringify(U,null,2)+`
+`),i(`${v?"confirmed":S?"replaced":"added"} statusLine in ${r}`);let Z=t.targetCli==="antigravity"?"Antigravity CLI":"Claude Code";console.log(`
+${h("Done.")} Restart ${Z} to see the statusline.
+`)}var $=require("fs");function G(t){console.log(a(`
 tokenline \u2014 uninstall
-`));let e=g(t),r=f(e);if(!r.exists||r.data===null?a(`No usable settings at ${e} \u2014 nothing to remove.`):v(r.data.statusLine?.command)?t.dryRun?s(`[dry-run] would remove statusLine from ${e}`):(x(e),delete r.data.statusLine,(0,h.writeFileSync)(e,JSON.stringify(r.data,null,2)+`
-`),s(`removed statusLine from ${e} (backup: settings.json.bak)`)):s(`No tokenline statusLine in ${e} \u2014 left untouched.`),t.purge){let o=$(t);(0,h.existsSync)(o)&&(t.dryRun?s(`[dry-run] would delete ${o}`):((0,h.unlinkSync)(o),s(`deleted ${o}`)))}let n=t.targetCli==="antigravity"?"Antigravity CLI":"Claude Code";console.log(`
-${b("Done.")} Restart ${n}.
-`)}var H=JSON.parse((0,F.readFileSync)((0,E.join)(__dirname,"..","package.json"),"utf8"));function M(t){let e={_:[],targetCli:"claude",dir:null,global:!1,dryRun:!1,force:!1,purge:!1,help:!1,version:!1,unknown:[]};for(let r=0;r<t.length;r++){let n=t[r];switch(n){case"--dir":e.dir=t[++r]??null;break;case"--antigravity":e.targetCli="antigravity",e.global=!0;break;case"--global":e.global=!0;break;case"--dry-run":e.dryRun=!0;break;case"--force":e.force=!0;break;case"--purge":e.purge=!0;break;case"-h":case"--help":e.help=!0;break;case"-v":case"--version":e.version=!0;break;default:n!==void 0&&n.startsWith("-")?e.unknown.push(n):n!==void 0&&e._.push(n)}}return e}function D(){console.log(`
-${i("tokenline")} \u2014 a cache-aware statusline for AI coding CLIs
+`));let e=p(t),n=m(e);if(!n.exists||n.data===null?l(`No usable settings at ${e} \u2014 nothing to remove.`):L(n.data.statusLine?.command)?t.dryRun?i(`[dry-run] would remove statusLine from ${e}`):(C(e),delete n.data.statusLine,(0,$.writeFileSync)(e,JSON.stringify(n.data,null,2)+`
+`),i(`removed statusLine from ${e} (backup: settings.json.bak)`)):i(`No tokenline statusLine in ${e} \u2014 left untouched.`),t.purge){let r=w(t);(0,$.existsSync)(r)&&(t.dryRun?i(`[dry-run] would delete ${r}`):((0,$.unlinkSync)(r),i(`deleted ${r}`)))}let o=t.targetCli==="antigravity"?"Antigravity CLI":"Claude Code";console.log(`
+${h("Done.")} Restart ${o}.
+`)}var Y=require("fs");function z(t,e){console.log(a(`
+tokenline \u2014 updating the statusline
+`));let n=p(t),o=m(n),r=M(o.data?.statusLine?.command);if(r===null||!(0,Y.existsSync)(r)){g(`No installed tokenline.sh found through ${n}.`);let d=t.targetCli==="antigravity"||t.global?"":" (or --global)";console.log(`
+Install it first: npx @inbrace-tech/tokenline init${d}
+`),process.exitCode=1;return}if(t.dryRun){i(`[dry-run] would overwrite ${r} with v${e}`);return}R(r,e,E(t)),i(`updated ${r} \u2192 v${e}`),console.log(`
+${h("Done.")} The statusline picks up the new version on its next refresh.
+`)}var P=JSON.parse((0,Q.readFileSync)((0,X.join)(__dirname,"..","package.json"),"utf8"));function lt(t){let e={_:[],targetCli:"claude",dir:null,global:!1,dryRun:!1,force:!1,purge:!1,help:!1,version:!1,unknown:[]};for(let n=0;n<t.length;n++){let o=t[n];switch(o){case"--dir":e.dir=t[++n]??null;break;case"--antigravity":e.targetCli="antigravity",e.global=!0;break;case"--global":e.global=!0;break;case"--dry-run":e.dryRun=!0;break;case"--force":e.force=!0;break;case"--purge":e.purge=!0;break;case"-h":case"--help":e.help=!0;break;case"-v":case"--version":e.version=!0;break;default:o!==void 0&&o.startsWith("-")?e.unknown.push(o):o!==void 0&&e._.push(o)}}return e}function H(){console.log(`
+${a("tokenline")} \u2014 a cache-aware statusline for AI coding CLIs
 
-${i("Usage")}
+${a("Usage")}
   npx @inbrace-tech/tokenline <command> [options]
 
-${i("Commands")}
+${a("Commands")}
   init          Install tokenline.sh and wire it into settings
+  update        Replace the installed tokenline.sh with this version (run it as @latest)
   doctor        Check dependencies and current config \u2014 changes nothing
   uninstall     Remove the tokenline statusLine block from settings
 
-${i("Options")}
+${a("Options")}
   --antigravity Target Antigravity CLI (~/.gemini/antigravity-cli)
   --global      Target ~/.claude (global) instead of ./.claude (project)
   --dir <path>  Write tokenline.sh to a custom directory
@@ -39,7 +48,7 @@ ${i("Options")}
   -h, --help    Show this help
   -v, --version Show version
 
-${i("Notes")}
+${a("Notes")}
   The statusline runs as 'bash tokenline.sh' \u2014 no Node in the per-second hot path.
   jq is required at runtime; this installer checks for it but cannot install it.
-`)}function Q(){let t=M(process.argv.slice(2));if(t.unknown.length>0&&t.unknown.forEach(e=>a(`ignoring unknown option: ${e}`)),t.version){console.log(H.version);return}if(t.help||t._.length===0){D();return}try{switch(t._[0]){case"init":A(t);break;case"doctor":U();break;case"uninstall":case"remove":B(t);break;default:d(`Unknown command: ${t._[0]}`),D(),process.exitCode=1}}catch(e){d(e instanceof Error?e.message:String(e)),process.exitCode=1}}Q();
+`)}function ct(){let t=lt(process.argv.slice(2));if(t.unknown.length>0&&t.unknown.forEach(e=>l(`ignoring unknown option: ${e}`)),t.version){console.log(P.version);return}if(t.help||t._.length===0){H();return}try{switch(t._[0]){case"init":W(t,P.version);break;case"update":z(t,P.version);break;case"doctor":B();break;case"uninstall":case"remove":G(t);break;default:g(`Unknown command: ${t._[0]}`),H(),process.exitCode=1}}catch(e){g(e instanceof Error?e.message:String(e)),process.exitCode=1}}ct();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inbrace-tech/tokenline",
-  "version": "1.2.4",
+  "version": "1.3.0",
   "description": "A cache-aware statusline for AI coding CLIs — installs tokenline.sh and wires it into your Claude Code settings.",
   "bin": {
     "tokenline": "dist/cli.js"
@@ -40,7 +40,7 @@
     "@changesets/changelog-github": "1.0.1",
     "@changesets/cli": "^3.0.2",
     "@eslint/js": "10.0.1",
-    "@types/node": "24.13.4",
+    "@types/node": "24.13.5",
     "@vitest/eslint-plugin": "1.6.27",
     "eslint": "10.10.0",
     "eslint-config-prettier": "10.1.8",
@@ -48,7 +48,7 @@
     "eslint-plugin-prettier": "5.5.6",
     "eslint-plugin-simple-import-sort": "13.0.0",
     "globals": "17.12.0",
-    "prettier": "3.9.6",
+    "prettier": "3.9.8",
     "tsup": "^8.5.1",
     "typescript": "5.9.3",
     "typescript-eslint": "8.70.0",

package/tokenline.sh

@@ -17,6 +17,13 @@
 # stay deterministic even when the user exports LC_ALL. Output is ASCII/bytes.
 export LC_ALL=C
 
+# --- Install stamp ---
+# The installer (npm `init`/`update`, or the release asset) rewrites these two
+# lines in the copy it installs: the version it shipped and the exact command
+# that updates this copy. Left empty here, so the repo copy never checks.
+TOKENLINE_VERSION=""
+TOKENLINE_UPDATE_CMD=""
+
 # --- Colors & Formatting Constants ---
 COLOR_GRAY=$'\033[38;5;244m'
 COLOR_DARK_GRAY=$'\033[38;5;240m'
@@ -468,7 +475,60 @@ compute_turn_breakdown() {
   fi
 }
 
-# --- 7. Compose and Render Output ---
+# --- 7. Update Notice ---
+version_gt() {
+  # 0 when x.y.z $1 is newer than x.y.z $2 (both pre-validated). 10# keeps a
+  # leading zero from being read as octal.
+  local -a a b
+  IFS=. read -ra a <<< "$1"
+  IFS=. read -ra b <<< "$2"
+  local i
+  for i in 0 1 2; do
+    (( 10#${a[i]} > 10#${b[i]} )) && return 0
+    (( 10#${a[i]} < 10#${b[i]} )) && return 1
+  done
+  return 1
+}
+
+compute_update_notice() {
+  # Installed (stamped) copies only; the repo copy has no version and never checks.
+  # At most once per 24h a detached curl stores the latest published version in
+  # the private runtime dir, and the render path only reads that file. Nothing
+  # from the session is sent, and nothing downloaded is ever executed.
+  # Opt out with TOKENLINE_NO_UPDATE_CHECK=1 (DO_NOT_TRACK=1 is honored too).
+  update_info=""
+  local semver='^[0-9]+\.[0-9]+\.[0-9]+$'
+  [[ "$TOKENLINE_VERSION" =~ $semver ]] || return 0
+  [ "${TOKENLINE_NO_UPDATE_CHECK:-}" = "1" ] && return 0
+  [ "${DO_NOT_TRACK:-}" = "1" ] && return 0
+  # Only a private dir we own: never create or follow files in shared /tmp.
+  [ "$_runtime_dir" != "/tmp" ] && [ -O "$_runtime_dir" ] || return 0
+
+  local latest_file="$_runtime_dir/latest-version"
+  local checked_at
+  checked_at=$(file_mtime "$latest_file")
+  if { [ -z "$checked_at" ] || [ $((now - checked_at)) -ge 86400 ]; } \
+    && command -v curl >/dev/null 2>&1; then
+    # Mark the check first, so the refreshes during the fetch don't start another.
+    touch "$latest_file" 2>/dev/null
+    (
+      v=$(curl -fsS --max-time 5 https://registry.npmjs.org/@inbrace-tech/tokenline/latest \
+        | jq -r '.version // empty')
+      [[ "$v" =~ $semver ]] && printf '%s\n' "$v" > "$latest_file.tmp" \
+        && mv -f "$latest_file.tmp" "$latest_file"
+    ) < /dev/null > /dev/null 2>&1 &
+    disown 2>/dev/null
+  fi
+
+  local latest=""
+  read -r latest 2>/dev/null < "$latest_file"
+  [[ "$latest" =~ $semver ]] || return 0
+  version_gt "$latest" "$TOKENLINE_VERSION" || return 0
+  update_info=$(printf '%s↑ tokenline %s available · %s%s' \
+    "$COLOR_DARK_GRAY" "$latest" "$TOKENLINE_UPDATE_CMD" "$COLOR_RESET")
+}
+
+# --- 8. Compose and Render Output ---
 render_statusline() {
   # Line 1: client/model | ctx | cache TTL
   local display_header=""
@@ -497,6 +557,11 @@ render_statusline() {
     [ -n "$rl_7d_info" ] && line_rl="${line_rl:+$line_rl  }$rl_7d_info"
     printf "%s\n" "$line_rl"
   fi
+
+  # Last line: update notice (stamped installs with a newer version published)
+  if [ -n "$update_info" ]; then
+    printf "%s\n" "$update_info"
+  fi
 }
 
 # --- Orchestrated Execution Flow ---
@@ -505,4 +570,5 @@ compute_cache_timer
 compute_context_info
 compute_rate_limits
 compute_turn_breakdown
+compute_update_notice
 render_statusline