@xbghc/warden 0.11.1 → 0.12.0

package/README.md

@@ -43,13 +43,20 @@ or install globally:
 
 ```sh
 npm i -g @xbghc/warden
-warden [repoPath] [--port <n>] [--no-open]
+warden [repoPath] [--port <n>] [--no-open] [--no-update-check]
 ```
 
 The server picks the first free port from 4100 (or `--port`), prints the URL and tries to open a
 browser via `wslview`, `explorer.exe`, then `xdg-open`. If none of those exist it only prints the URL.
 Several instances on the same repository can run at the same time.
 
+On start warden asks the npm registry whether a newer release exists, at most once a day (the answer
+is cached in `~/.local/share/warden/update-check.json`). When there is one, a line in the terminal
+and a chip beside the wordmark say so; clicking the chip copies the command — `npx @xbghc/warden@latest`
+for an npx run, whose cache otherwise keeps serving the old copy, `npm i -g @xbghc/warden@latest`
+for a global install. The check never delays startup and fails silently. `--no-update-check`,
+`WARDEN_NO_UPDATE_CHECK=1`, `NO_UPDATE_NOTIFIER=1` or `CI` turn it off.
+
 ## Targets (what is being reviewed)
 
 | Target | Key | Git equivalent |
@@ -362,6 +369,11 @@ the repository. A mutating request the
 browser labels as coming from another site (`Sec-Fetch-Site: cross-site`) is refused with 403, so a
 page from elsewhere cannot drive the server through the browser it is open in.
 
+The only request warden makes off the machine is the update check: a `GET` of
+`https://registry.npmjs.org/@xbghc%2fwarden/latest`, no more than once a day, carrying nothing about
+the repository or the review. `--no-update-check` (or the environment switches under *Install / run*)
+removes it.
+
 ## Development
 
 ```sh

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // bin/cli.ts
-import path9 from "path";
+import path10 from "path";
 import { spawn } from "child_process";
 import { existsSync as existsSync2 } from "fs";
 import { fileURLToPath } from "url";
@@ -812,26 +812,26 @@ var throwNestingLimitExceeded = () => {
 };
 
 // node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/utils/url.js
-var splitPath = (path10) => {
-  const paths = path10.split("/");
+var splitPath = (path11) => {
+  const paths = path11.split("/");
   if (paths[0] === "") {
     paths.shift();
   }
   return paths;
 };
 var splitRoutingPath = (routePath) => {
-  const { groups, path: path10 } = extractGroupsFromPath(routePath);
-  const paths = splitPath(path10);
+  const { groups, path: path11 } = extractGroupsFromPath(routePath);
+  const paths = splitPath(path11);
   return replaceGroupMarks(paths, groups);
 };
-var extractGroupsFromPath = (path10) => {
+var extractGroupsFromPath = (path11) => {
   const groups = [];
-  path10 = path10.replace(/\{[^}]+\}/g, (match2, index) => {
+  path11 = path11.replace(/\{[^}]+\}/g, (match2, index) => {
     const mark = `@${index}`;
     groups.push([mark, match2]);
     return mark;
   });
-  return { groups, path: path10 };
+  return { groups, path: path11 };
 };
 var replaceGroupMarks = (paths, groups) => {
   for (let i = groups.length - 1; i >= 0; i--) {
@@ -888,8 +888,8 @@ var getPath = (request) => {
       const queryIndex = url.indexOf("?", i);
       const hashIndex = url.indexOf("#", i);
       const end = queryIndex === -1 ? hashIndex === -1 ? void 0 : hashIndex : hashIndex === -1 ? queryIndex : Math.min(queryIndex, hashIndex);
-      const path10 = url.slice(start, end);
-      return tryDecodeURI(path10.includes("%25") ? path10.replace(/%25/g, "%2525") : path10);
+      const path11 = url.slice(start, end);
+      return tryDecodeURI(path11.includes("%25") ? path11.replace(/%25/g, "%2525") : path11);
     } else if (charCode === 63 || charCode === 35) {
       break;
     }
@@ -906,11 +906,11 @@ var mergePath = (base, sub, ...rest) => {
   }
   return `${base?.[0] === "/" ? "" : "/"}${base}${sub === "/" ? "" : `${base?.at(-1) === "/" ? "" : "/"}${sub?.[0] === "/" ? sub.slice(1) : sub}`}`;
 };
-var checkOptionalParameter = (path10) => {
-  if (path10.charCodeAt(path10.length - 1) !== 63 || !path10.includes(":")) {
+var checkOptionalParameter = (path11) => {
+  if (path11.charCodeAt(path11.length - 1) !== 63 || !path11.includes(":")) {
     return null;
   }
-  const segments = path10.split("/");
+  const segments = path11.split("/");
   const results = [];
   let basePath = "";
   segments.forEach((segment) => {
@@ -1052,9 +1052,9 @@ var HonoRequest = class {
    */
   path;
   bodyCache = {};
-  constructor(request, path10 = "/", matchResult = [[]]) {
+  constructor(request, path11 = "/", matchResult = [[]]) {
     this.raw = request;
-    this.path = path10;
+    this.path = path11;
     this.#matchResult = matchResult;
   }
   param(key) {
@@ -1826,8 +1826,8 @@ var Hono = class _Hono {
         return this;
       };
     });
-    this.on = (method, path10, ...handlers) => {
-      for (const p of [path10].flat()) {
+    this.on = (method, path11, ...handlers) => {
+      for (const p of [path11].flat()) {
         this.#path = p;
         for (const m of [method].flat()) {
           const methodName = m.toUpperCase();
@@ -1885,8 +1885,8 @@ var Hono = class _Hono {
    * app.route("/api", app2) // GET /api/user
    * ```
    */
-  route(path10, app) {
-    const subApp = this.basePath(path10);
+  route(path11, app) {
+    const subApp = this.basePath(path11);
     app.routes.map((r) => {
       let handler;
       if (app.errorHandler === errorHandler) {
@@ -1912,9 +1912,9 @@ var Hono = class _Hono {
    * const api = new Hono().basePath('/api')
    * ```
    */
-  basePath(path10) {
+  basePath(path11) {
     const subApp = this.#clone();
-    subApp._basePath = mergePath(this._basePath, path10);
+    subApp._basePath = mergePath(this._basePath, path11);
     return subApp;
   }
   /**
@@ -1988,7 +1988,7 @@ var Hono = class _Hono {
    * })
    * ```
    */
-  mount(path10, applicationHandler, options) {
+  mount(path11, applicationHandler, options) {
     let replaceRequest;
     let optionHandler;
     if (options) {
@@ -2015,7 +2015,7 @@ var Hono = class _Hono {
       return [c.env, executionContext];
     };
     replaceRequest ||= (() => {
-      const mergedPath = mergePath(this._basePath, path10);
+      const mergedPath = mergePath(this._basePath, path11);
       const pathPrefixLength = mergedPath === "/" ? 0 : mergedPath.length;
       return (request) => {
         const url = new URL(request.url);
@@ -2030,18 +2030,18 @@ var Hono = class _Hono {
       }
       await next();
     };
-    this.#addRoute(METHOD_NAME_ALL, mergePath(path10, "*"), handler);
+    this.#addRoute(METHOD_NAME_ALL, mergePath(path11, "*"), handler);
     return this;
   }
-  #addRoute(method, path10, handler, baseRoutePath) {
-    path10 = mergePath(this._basePath, path10);
+  #addRoute(method, path11, handler, baseRoutePath) {
+    path11 = mergePath(this._basePath, path11);
     const r = {
       basePath: baseRoutePath !== void 0 ? mergePath(this._basePath, baseRoutePath) : this._basePath,
-      path: path10,
+      path: path11,
       method,
       handler
     };
-    this.router.add(method, path10, [handler, r]);
+    this.router.add(method, path11, [handler, r]);
     this.routes.push(r);
   }
   #handleError(err, c) {
@@ -2054,10 +2054,10 @@ var Hono = class _Hono {
     if (method === "HEAD") {
       return (async () => new Response(null, await this.#dispatch(request, executionCtx, env, "GET")))();
     }
-    const path10 = this.getPath(request, { env });
-    const matchResult = this.router.match(method, path10);
+    const path11 = this.getPath(request, { env });
+    const matchResult = this.router.match(method, path11);
     const c = new Context(request, {
-      path: path10,
+      path: path11,
       matchResult,
       env,
       executionCtx,
@@ -2160,7 +2160,7 @@ var createNullObject = () => /* @__PURE__ */ Object.create(null);
 
 // node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/router/reg-exp-router/matcher.js
 var emptyParam = [];
-function match(method, path10) {
+function match(method, path11) {
   const matchers = this.buildAllMatchers();
   const match2 = ((method2, path22) => {
     const matcher = matchers[method2] || matchers[METHOD_NAME_ALL];
@@ -2176,7 +2176,7 @@ function match(method, path10) {
     return [matcher[1][index], match3];
   });
   this.match = match2;
-  return match2(method, path10);
+  return match2(method, path11);
 }
 
 // node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/router/reg-exp-router/node.js
@@ -2293,14 +2293,14 @@ var Trie = class {
   #index = 0;
   // dynamic path -> [handler index, param assoc]; static paths are not registered
   paths = createNullObject();
-  insert(path10, isStatic) {
+  insert(path11, isStatic) {
     if (isStatic) {
-      this.#root.insert(path10.split(""), 0, [], this.#context, true);
+      this.#root.insert(path11.split(""), 0, [], this.#context, true);
       return;
     }
     const paramAssoc = [];
     const groups = [];
-    let markedPath = path10;
+    let markedPath = path11;
     for (let i = 0; ; ) {
       let replaced = false;
       markedPath = markedPath.replace(/\{[^}]+\}/g, (m) => {
@@ -2325,7 +2325,7 @@ var Trie = class {
       }
     }
     this.#root.insert(tokens, this.#index, paramAssoc, this.#context, false);
-    this.paths[path10] = [this.#index++, paramAssoc];
+    this.paths[path11] = [this.#index++, paramAssoc];
   }
   buildRegExp() {
     let regexp = this.#root.buildRegExpStr();
@@ -2352,17 +2352,17 @@ var Trie = class {
 
 // node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/router/reg-exp-router/router.js
 var wildcardRegExpCache = createNullObject();
-function buildWildcardRegExp(path10) {
-  return wildcardRegExpCache[path10] ??= new RegExp(
-    `^${path10.replace(
+function buildWildcardRegExp(path11) {
+  return wildcardRegExpCache[path11] ??= new RegExp(
+    `^${path11.replace(
       /\/:[^/{}]+(?:\{\[\^\/]\+})?(?=[/{]|$)|\/?\*$|([.\\+*[^\]$()?{}|])/g,
       (match2, metaChar) => metaChar ? `\\${metaChar}` : match2 === "/*" ? TAIL_WILDCARD_REG_EXP_STR : match2 === "*" ? ONLY_WILDCARD_REG_EXP_STR : `/:${LABEL_REG_EXP_STR}`
     )}$`
   );
 }
-function findMiddleware(middleware, path10) {
+function findMiddleware(middleware, path11) {
   for (const k of Object.keys(middleware).sort((a, b) => b.length - a.length)) {
-    if (buildWildcardRegExp(k).test(path10)) {
+    if (buildWildcardRegExp(k).test(path11)) {
       return [...middleware[k]];
     }
   }
@@ -2378,14 +2378,14 @@ var RegExpRouter = class {
     this.#routes = { [METHOD_NAME_ALL]: createNullObject() };
     this.#tries = { [METHOD_NAME_ALL]: new Trie() };
   }
-  #insertPath(method, path10) {
+  #insertPath(method, path11) {
     try {
-      this.#tries[method].insert(path10, !/\*|\/:/.test(path10));
+      this.#tries[method].insert(path11, !/\*|\/:/.test(path11));
     } catch (e) {
-      throw e === PATH_ERROR ? new UnsupportedPathError(path10) : e;
+      throw e === PATH_ERROR ? new UnsupportedPathError(path11) : e;
     }
   }
-  add(method, path10, handler) {
+  add(method, path11, handler) {
     const middleware = this.#middleware;
     const routes = this.#routes;
     if (!middleware) {
@@ -2401,28 +2401,28 @@ var RegExpRouter = class {
         }
       }
     }
-    if (path10 === "/*") {
-      path10 = "*";
+    if (path11 === "/*") {
+      path11 = "*";
     }
     const methods = method === METHOD_NAME_ALL ? Object.keys(middleware) : [method];
-    if (/\*$/.test(path10)) {
-      const re = buildWildcardRegExp(path10);
+    if (/\*$/.test(path11)) {
+      const re = buildWildcardRegExp(path11);
       for (const m of methods) {
-        if (!middleware[m][path10]) {
-          this.#insertPath(m, path10);
-          middleware[m][path10] = findMiddleware(middleware[m], path10) || findMiddleware(middleware[METHOD_NAME_ALL], path10) || [];
+        if (!middleware[m][path11]) {
+          this.#insertPath(m, path11);
+          middleware[m][path11] = findMiddleware(middleware[m], path11) || findMiddleware(middleware[METHOD_NAME_ALL], path11) || [];
         }
       }
       for (const handlerMap of [middleware, routes]) {
         for (const m of methods) {
           for (const p in handlerMap[m]) {
-            re.test(p) && handlerMap[m][p].push([handler, path10]);
+            re.test(p) && handlerMap[m][p].push([handler, path11]);
           }
         }
       }
       return;
     }
-    const paths = checkOptionalParameter(path10) || [path10];
+    const paths = checkOptionalParameter(path11) || [path11];
     for (const path22 of paths) {
       for (const m of methods) {
         if (!routes[m][path22]) {
@@ -2451,11 +2451,11 @@ var RegExpRouter = class {
     const handlerData = [];
     const [regexp, indexReplacementMap, paramReplacementMap] = trie.buildRegExp();
     for (const r of [middleware, routes]) {
-      for (const path10 in r) {
-        const handlers = r[path10];
-        const pathData = trie.paths[path10];
+      for (const path11 in r) {
+        const handlers = r[path11];
+        const pathData = trie.paths[path11];
         if (!pathData) {
-          staticMap[path10] = [handlers.map(([h]) => [h, createNullObject()]), emptyParam];
+          staticMap[path11] = [handlers.map(([h]) => [h, createNullObject()]), emptyParam];
           continue;
         }
         handlerData[pathData[0]] = handlers.map(([h, handlerPath]) => [
@@ -2479,13 +2479,13 @@ var SmartRouter = class {
   constructor(init) {
     this.#routers = init.routers;
   }
-  add(method, path10, handler) {
+  add(method, path11, handler) {
     if (!this.#routes) {
       throw new Error(MESSAGE_MATCHER_IS_ALREADY_BUILT);
     }
-    this.#routes.push([method, path10, handler]);
+    this.#routes.push([method, path11, handler]);
   }
-  match(method, path10) {
+  match(method, path11) {
     if (!this.#routes) {
       throw new Error("Fatal error");
     }
@@ -2500,7 +2500,7 @@ var SmartRouter = class {
         for (let i2 = 0, len2 = routes.length; i2 < len2; i2++) {
           router.add(...routes[i2]);
         }
-        res = router.match(method, path10);
+        res = router.match(method, path11);
       } catch (e) {
         if (e instanceof UnsupportedPathError) {
           continue;
@@ -2535,9 +2535,9 @@ var Node2 = class _Node2 {
   #patterns = [];
   #pattern;
   #params = emptyParams;
-  insert(method, path10, handler) {
+  insert(method, path11, handler) {
     let curNode = this;
-    const parts = splitRoutingPath(path10);
+    const parts = splitRoutingPath(path11);
     const possibleKeys = /* @__PURE__ */ new Set();
     let i = 0;
     for (const p of parts) {
@@ -2577,12 +2577,12 @@ var Node2 = class _Node2 {
       }
     }
   }
-  search(method, path10) {
+  search(method, path11) {
     const handlerSets = [];
     this.#params = emptyParams;
     const curNode = this;
     let curNodes = [curNode];
-    const parts = splitPath(path10);
+    const parts = splitPath(path11);
     const curNodesQueue = [];
     const len = parts.length;
     let partOffsets = null;
@@ -2624,13 +2624,13 @@ var Node2 = class _Node2 {
           if (matcher !== true) {
             if (!partOffsets) {
               partOffsets = [];
-              let offset = path10[0] === "/" ? 1 : 0;
+              let offset = path11[0] === "/" ? 1 : 0;
               for (let p = 0; p < len; p++) {
                 partOffsets[p] = offset;
                 offset += parts[p].length + 1;
               }
             }
-            const restPathString = path10.slice(partOffsets[i]);
+            const restPathString = path11.slice(partOffsets[i]);
             const m = matcher.exec(restPathString);
             if (m) {
               params[name] = m[0];
@@ -2690,13 +2690,13 @@ var Node2 = class _Node2 {
 var TrieRouter = class {
   name = "TrieRouter";
   #node = new Node2();
-  add(method, path10, handler) {
-    for (const result of checkOptionalParameter(path10) || [path10]) {
+  add(method, path11, handler) {
+    for (const result of checkOptionalParameter(path11) || [path11]) {
       this.#node.insert(method, result, handler);
     }
   }
-  match(method, path10) {
-    return this.#node.search(method, path10);
+  match(method, path11) {
+    return this.#node.search(method, path11);
   }
 };
 
@@ -4594,9 +4594,9 @@ var TmuxService = class {
     const sessions = [];
     for (const line of output.trimEnd().split("\n")) {
       const [id, name, ...parts] = line.split("	");
-      const path10 = parts.join("	");
-      if (!id || !/^\$\d+$/.test(id) || !name || !path10) continue;
-      if (await realpath3(path10).catch(() => null) === root) sessions.push({ id, name, path: path10 });
+      const path11 = parts.join("	");
+      if (!id || !/^\$\d+$/.test(id) || !name || !path11) continue;
+      if (await realpath3(path11).catch(() => null) === root) sessions.push({ id, name, path: path11 });
     }
     return sessions;
   }
@@ -4852,6 +4852,7 @@ function createApp(opts) {
     return c.json(info);
   });
   api.get("/state", async (c) => c.json(await store.load()));
+  api.get("/update", async (c) => c.json(await opts.update ?? null));
   api.patch("/prefs", async (c) => {
     const body = await c.req.json();
     const prefs = await store.update((s) => {
@@ -5530,6 +5531,70 @@ function reachableFromWindows(port, token, timeoutMs = PROBE_TIMEOUT_MS) {
   });
 }
 
+// packages/server/src/update.ts
+import path9 from "path";
+import { mkdir as mkdir2, readFile as readFile5, writeFile as writeFile2 } from "fs/promises";
+var PACKAGE = "@xbghc/warden";
+var LATEST_URL = "https://registry.npmjs.org/@xbghc%2fwarden/latest";
+var FETCH_TIMEOUT_MS = 3e3;
+var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+function updateCacheFile(baseDir = dataDir()) {
+  return path9.join(baseDir, "update-check.json");
+}
+function updateCheckEnabled(env = process.env) {
+  return !env.WARDEN_NO_UPDATE_CHECK && !env.NO_UPDATE_NOTIFIER && !env.CI;
+}
+function isNewer(latest, current) {
+  const parse = (v) => /^(\d+)\.(\d+)\.(\d+)$/.exec(v)?.slice(1).map(Number);
+  const a = parse(latest);
+  const b = parse(current);
+  if (!a || !b) return false;
+  for (let i = 0; i < 3; i++) {
+    if (a[i] !== b[i]) return a[i] > b[i];
+  }
+  return false;
+}
+async function fetchLatestFromRegistry() {
+  const res = await fetch(LATEST_URL, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS), headers: { accept: "application/json" } });
+  if (!res.ok) throw new Error(`registry answered ${res.status}`);
+  const body = await res.json();
+  if (typeof body.version !== "string") throw new Error("registry answer carries no version");
+  return body.version;
+}
+async function readCache(file, now) {
+  try {
+    const cache = JSON.parse(await readFile5(file, "utf8"));
+    if (typeof cache.latest !== "string" || typeof cache.checkedAt !== "number") return void 0;
+    const age = now - cache.checkedAt;
+    return age >= 0 && age < CHECK_INTERVAL_MS ? cache.latest : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function writeCache(file, cache) {
+  try {
+    await mkdir2(path9.dirname(file), { recursive: true });
+    await writeFile2(file, JSON.stringify(cache));
+  } catch {
+  }
+}
+async function checkForUpdate(opts) {
+  try {
+    const cacheFile = opts.cacheFile ?? updateCacheFile();
+    const now = (opts.now ?? Date.now)();
+    let latest = await readCache(cacheFile, now);
+    if (latest === void 0) {
+      latest = await (opts.fetchLatest ?? fetchLatestFromRegistry)();
+      await writeCache(cacheFile, { checkedAt: now, latest });
+    }
+    if (!isNewer(latest, opts.current)) return null;
+    const command = opts.npx ? `npx ${PACKAGE}@latest` : `npm i -g ${PACKAGE}@latest`;
+    return { current: opts.current, latest, command };
+  } catch {
+    return null;
+  }
+}
+
 // packages/server/src/index.ts
 var HOST = "127.0.0.1";
 var DEFAULT_PORT_START = 4100;
@@ -5554,7 +5619,7 @@ async function startServer(opts) {
   const stateFile = opts.stateFile ?? stateFilePath(repo.commonRoot);
   const store = new StateStore(stateFile, repo.commonRoot);
   const instanceToken = randomUUID2();
-  const app = createApp({ repo, store, nvim: new NvimService(), webDir: opts.webDir, instanceToken });
+  const app = createApp({ repo, store, nvim: new NvimService(), webDir: opts.webDir, instanceToken, update: opts.update });
   const listen = (p) => new Promise((resolve, reject) => {
     const s = serve({ fetch: app.fetch, hostname: HOST, port: p }, () => resolve(s));
     s.once("error", reject);
@@ -5597,13 +5662,14 @@ async function startServer(opts) {
 }
 
 // bin/cli.ts
-var VERSION = true ? "0.11.1" : "dev";
+var VERSION = true ? "0.12.0" : "dev";
 function parseArgs(argv) {
-  const args = { repoPath: process.cwd(), open: true, help: false, version: false };
+  const args = { repoPath: process.cwd(), open: true, updateCheck: true, help: false, version: false };
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
     if (a === "--no-open") args.open = false;
     else if (a === "--open") args.open = true;
+    else if (a === "--no-update-check") args.updateCheck = false;
     else if (a === "--port" || a === "-p") {
       const v = argv[++i];
       if (!v || !/^\d+$/.test(v)) throw new Error("--port requires a number");
@@ -5615,7 +5681,7 @@ function parseArgs(argv) {
     } else if (a === "--help" || a === "-h") args.help = true;
     else if (a === "--version" || a === "-v") args.version = true;
     else if (a.startsWith("-")) throw new Error(`unknown option: ${a}`);
-    else args.repoPath = path9.resolve(a);
+    else args.repoPath = path10.resolve(a);
   }
   return args;
 }
@@ -5628,6 +5694,8 @@ Options:
   --port <n>, -p <n>   Listen on a fixed port (default: first free port from 4100, and under WSL
                        the first one the Windows side can reach)
   --no-open            Do not try to open the browser
+  --no-update-check    Do not ask the npm registry whether a newer warden exists
+                       (also: WARDEN_NO_UPDATE_CHECK=1, NO_UPDATE_NOTIFIER=1, CI)
   -h, --help           Show this help
   -v, --version        Print version
 `;
@@ -5658,16 +5726,16 @@ async function openBrowser(url) {
   return false;
 }
 function resolveWebDir() {
-  const here = path9.dirname(fileURLToPath(import.meta.url));
+  const here = path10.dirname(fileURLToPath(import.meta.url));
   const candidates = [
     process.env.WARDEN_WEB_DIR,
-    path9.join(here, "web"),
+    path10.join(here, "web"),
     // dist/cli.js -> dist/web
-    path9.join(here, "..", "dist", "web")
+    path10.join(here, "..", "dist", "web")
     // bin/cli.ts (tsx dev) -> dist/web
   ].filter((p) => !!p);
   for (const dir of candidates) {
-    if (existsSync2(path9.join(dir, "index.html"))) return dir;
+    if (existsSync2(path10.join(dir, "index.html"))) return dir;
   }
   return void 0;
 }
@@ -5692,9 +5760,12 @@ async function main() {
   if (!webDir) {
     console.error("warning: built web assets not found (dist/web). Only the /api endpoints will be served.");
   }
+  const viaNpx = fileURLToPath(import.meta.url).includes(`${path10.sep}_npx${path10.sep}`);
+  const checking = args.updateCheck && VERSION !== "dev" && updateCheckEnabled();
+  const update = checking ? checkForUpdate({ current: VERSION, npx: viaNpx }) : Promise.resolve(null);
   let server;
   try {
-    server = await startServer({ repoPath: args.repoPath, port: args.port, webDir });
+    server = await startServer({ repoPath: args.repoPath, port: args.port, webDir, update });
   } catch (e) {
     console.error(`warden: ${e.message}`);
     process.exit(1);
@@ -5715,6 +5786,9 @@ async function main() {
     const opened = await openBrowser(server.url);
     if (!opened) console.log("  (could not open a browser automatically; open the URL manually)");
   }
+  void update.then((u) => {
+    if (u) console.log(`  update: ${u.latest} is available (running ${u.current}) \u2014 ${u.command}`);
+  });
   const shutdown = () => {
     server.close().finally(() => process.exit(0));
   };