@xingjisoft/neutrino 0.5.0 → 0.5.2

package/dist/pro/config.js

@@ -170,16 +170,20 @@ export function loadProModels() {
         throw new Error(`Pro model.json is missing; it is downloaded from ${PRO_MODELS_URL} on first use`);
     }
     const { tier } = readProModels(PRO_MODEL_FILE, "model.json");
-    // Presets the user keeps in model-custom.json are merged in: a same-named entry
-    // replaces the one from model.json in place, new ones are appended.
+    // Presets the user keeps in model-custom.json are merged in. Their place in the
+    // list is read as strength (the slider runs from weak to strong), so entries that
+    // are not official rungs lead it: a preset named after an official one edits that
+    // rung in place, every other one sits left of the graded presets.
     if (fs.existsSync(PRO_CUSTOM_MODEL_FILE)) {
+        const own = [];
         for (const preset of readProModels(PRO_CUSTOM_MODEL_FILE, "model-custom.json").tier) {
             const index = tier.findIndex((entry) => entry.name === preset.name);
             if (index === -1)
-                tier.push(preset);
+                own.push(preset);
             else
                 tier[index] = preset;
         }
+        tier.unshift(...own);
     }
     if (tier.length === 0)
         throw new Error("Pro model.json must contain a nonempty tier array");

package/dist/update.js

@@ -29,9 +29,15 @@ export function updateStatus() {
  * announce", which is what the next start is for. Concurrent callers share the
  * one lookup, and a successful answer is kept for the rest of the process so
  * the terminal and the Web console cannot disagree.
+ *
+ * Start-up asks once and is served from that answer from then on. A caller that
+ * passes `refresh` — the settings button, the background timer — queries the
+ * registry again, so an answer from an hour ago cannot make a check look idle.
+ * A failed refresh changes nothing: the last good answer stays, and the caller
+ * learns what went wrong from `error`.
  */
-export function checkForUpdate() {
-    if (published)
+export function checkForUpdate(options = {}) {
+    if (published && options.refresh !== true)
         return Promise.resolve(updateStatus());
     pending ??= lookupLatestVersion()
         .then((version) => {

package/dist/updateWatch.js

@@ -0,0 +1,76 @@
+/**
+ * The periodic update check.
+ *
+ * A Web console can stay open for days, so the start-up lookup alone would
+ * never tell its windows about a release published afterwards. This module asks
+ * the registry again on a timer, in the process that serves those windows, and
+ * hands a release it has not seen before to whoever is listening: the console
+ * forwards it to every open browser (GET /api/update/events) and the first-open
+ * dialog reads the same answer.
+ */
+import { checkForUpdate, updateStatus } from "./update.js";
+/** How often the background service asks the registry again. */
+export const UPDATE_CHECK_INTERVAL_MS = 30 * 60 * 1000;
+const listeners = new Set();
+let running = null;
+/**
+ * Listen for a release the periodic check finds. Returns the unsubscribe
+ * function.
+ *
+ * Only news is announced: a version this process already knows — from the
+ * start-up lookup, the settings button or an earlier tick — is not sent again,
+ * so the dialogs cannot reopen every half hour for a release the user has
+ * already declined.
+ */
+export function subscribeUpdateAnnouncements(listener) {
+    listeners.add(listener);
+    return () => {
+        listeners.delete(listener);
+    };
+}
+/**
+ * Start asking the registry every `intervalMs` (30 minutes by default).
+ *
+ * Idempotent, and the returned function stops the timer and leaves the module
+ * ready to start again. Checks run off the timer rather than at start-up: both
+ * the console and the terminal UI already look once when they start, and a
+ * second immediate lookup would only spend npm calls on the same answer.
+ */
+export function startUpdateWatch(options = {}) {
+    if (running)
+        return running;
+    const timer = setInterval(() => {
+        // The remembered answer is read before the lookup, because the lookup itself
+        // updates it: what matters is whether this check is what discovered the
+        // release.
+        const known = updateStatus().latestVersion;
+        // `refresh` is what makes a timer useful: without it checkForUpdate keeps
+        // returning the answer this process already has and would never see a new
+        // release.
+        void checkForUpdate({ refresh: true }).then((check) => {
+            try {
+                options.onCheck?.(check);
+            }
+            catch {
+                // A failing log must not stop the check that follows it.
+            }
+            if (!check.hasUpdate || check.latestVersion === known)
+                return;
+            for (const listener of [...listeners]) {
+                try {
+                    listener(check);
+                }
+                catch {
+                    // One broken window must not starve the others.
+                }
+            }
+        });
+    }, options.intervalMs ?? UPDATE_CHECK_INTERVAL_MS);
+    // A check in flight must never keep a shutting-down process alive.
+    timer.unref?.();
+    running = () => {
+        clearInterval(timer);
+        running = null;
+    };
+    return running;
+}

package/dist/web/server.js

@@ -29,7 +29,8 @@ import { defaultProPreset, ensureProModels, requireProPreset } from "../pro/conf
 import { listAgentSessions, loadAgentMessages, loadAgentSession, safeAgentSessionId } from "../agents.js";
 import { migrateAgentSession, SessionMigrationError } from "../migration.js";
 import { runningBackground } from "../background.js";
-import { MANUAL_UPDATE_COMMAND, installUpdate, updateStatus } from "../update.js";
+import { MANUAL_UPDATE_COMMAND, checkForUpdate, installUpdate, updateStatus } from "../update.js";
+import { subscribeUpdateAnnouncements } from "../updateWatch.js";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 // dist/web -> package root (mirrors the same trick used in config.ts).
 const PKG_ROOT = path.resolve(__dirname, "..", "..");
@@ -604,7 +605,88 @@ function streamLive(key, req, res) {
     // Without this, a client reset during a write is an uncaught 'error' event.
     res.on("error", cleanup);
 }
-async function handleApi(req, res, url, auth, mode, pathname, binding) {
+/**
+ * The windows watching for update announcements. The console owns one of these
+ * so closing it can end those streams: a browser reconnects an EventSource by
+ * itself, so an open tab would otherwise keep `close` waiting for a socket that
+ * will never go quiet on its own.
+ */
+function createUpdateStreams() {
+    const open = new Set();
+    return {
+        add(res) {
+            open.add(res);
+        },
+        remove(res) {
+            open.delete(res);
+        },
+        closeAll() {
+            for (const res of [...open]) {
+                open.delete(res);
+                try {
+                    res.end();
+                }
+                catch { /* the window is already gone */ }
+            }
+        },
+    };
+}
+/**
+ * The periodic check's findings, as an event stream. A window that opens after
+ * a release was already found still has to learn about it, so the answer this
+ * process holds goes out first: the same status /api/settings hands the
+ * first-open dialog, with the same fields the manual check returns.
+ *
+ * Both workspaces read it. An update belongs to the process, not to a
+ * conversation, so a Pro tab and a standard tab are told about the same release.
+ */
+function streamUpdateEvents(req, res, streams) {
+    res.writeHead(200, {
+        "Content-Type": "text/event-stream; charset=utf-8",
+        "Cache-Control": "no-cache, no-transform",
+        Connection: "keep-alive",
+        "X-Accel-Buffering": "no",
+    });
+    // Same guard as streamLive: a browser that closed or reloaded the tab leaves
+    // a socket writes fail on, and an unhandled 'error' event would stop the process.
+    const write = (chunk) => {
+        if (res.destroyed || res.writableEnded)
+            return false;
+        try {
+            res.write(chunk);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    };
+    const send = (status, error = "") => {
+        write(`event: update\ndata: ${JSON.stringify({
+            has_update: status.hasUpdate,
+            current_version: status.currentVersion,
+            latest_version: status.latestVersion,
+            error,
+        })}\n\n`);
+    };
+    write("retry: 2000\n\n");
+    send(updateStatus());
+    streams.add(res);
+    const unsubscribe = subscribeUpdateAnnouncements((check) => send(check, check.error ?? ""));
+    const keepAlive = setInterval(() => {
+        if (!write(": ping\n\n"))
+            cleanup();
+    }, 25_000);
+    keepAlive.unref?.();
+    function cleanup() {
+        clearInterval(keepAlive);
+        unsubscribe();
+        streams.remove(res);
+    }
+    req.on("close", cleanup);
+    req.on("error", cleanup);
+    res.on("error", cleanup);
+}
+async function handleApi(req, res, url, auth, mode, pathname, binding, updates) {
     if (!pathname.startsWith("/api/"))
         return false;
     // The Pro presets are not bundled either: the first Pro request makes sure they
@@ -748,6 +830,39 @@ async function handleApi(req, res, url, auth, mode, pathname, binding) {
         }
         return true;
     }
+    // The 30-minute background check announces a release here, so a window that
+    // stays open learns about it without reloading. Both workspaces open it.
+    if (req.method === "GET" && pathname === "/api/update/events") {
+        streamUpdateEvents(req, res, updates);
+        return true;
+    }
+    // The settings page's "Check for updates" button. Start-up reads the registry
+    // once and the Web console is served from that answer, so a manual check has
+    // to ask again; otherwise the button would keep showing whatever was true
+    // when the process started. Like the install below it runs npm on this
+    // machine, so it sits behind the login cookie and the same-origin check.
+    //
+    // The answer is a status, not an HTTP failure: an unreachable registry leaves
+    // `error` set on a 200 response, which is what the browser shows next to the
+    // button. A failure also changes nothing — the last good answer stays.
+    if (pathname === "/api/update/check") {
+        if (req.method !== "POST") {
+            sendJson(res, 405, { error: "method not allowed" });
+            return true;
+        }
+        if (!isSameOrigin(req)) {
+            sendJson(res, 403, { error: "cross-origin request rejected" });
+            return true;
+        }
+        const check = await checkForUpdate({ refresh: true });
+        sendJson(res, 200, {
+            has_update: check.hasUpdate,
+            current_version: check.currentVersion,
+            latest_version: check.latestVersion,
+            error: check.error ?? "",
+        });
+        return true;
+    }
     // The update prompt's confirm button: npm runs on this machine, so the route
     // sits behind the login cookie and the same-origin check like every other
     // mutation, and only a release the registry announced can be installed.
@@ -1308,7 +1423,7 @@ async function handleApi(req, res, url, auth, mode, pathname, binding) {
     sendJson(res, 404, { error: "not found" });
     return true;
 }
-async function handleRequest(req, res, auth, binding) {
+async function handleRequest(req, res, auth, binding, updates) {
     let url;
     try {
         url = new URL(req.url ?? "/", "http://localhost");
@@ -1341,7 +1456,7 @@ async function handleRequest(req, res, auth, binding) {
         mode = "pro";
         apiPathname = pathname.slice("/pro".length);
     }
-    if (await handleApi(req, res, url, auth, mode, apiPathname, binding))
+    if (await handleApi(req, res, url, auth, mode, apiPathname, binding, updates))
         return;
     if (mode === "pro") {
         // Nothing else lives under /pro but the page and its API.
@@ -1371,8 +1486,11 @@ export async function startWebServer(options) {
         service: options.backgroundService,
         updateSettings: (body, mode) => updateSettings(body, mode),
     };
+    // Every window watching for an update belongs to this console, not the module,
+    // so a second embedded server (a test, an embedding) keeps its own set.
+    const updates = createUpdateStreams();
     const server = http.createServer((req, res) => {
-        handleRequest(req, res, auth, binding).catch((err) => {
+        handleRequest(req, res, auth, binding, updates).catch((err) => {
             if (!res.headersSent) {
                 sendJson(res, 500, { error: err instanceof Error ? err.message : "internal error" });
             }
@@ -1513,6 +1631,9 @@ export async function startWebServer(options) {
         setHost: (next) => rebind(next),
         close: () => new Promise((resolve) => {
             closed = true;
+            // These streams never end on their own, so they are closed explicitly;
+            // otherwise server.close() would wait for a window that stays open.
+            updates.closeAll();
             for (const key of [...webSessions.keys()])
                 closeWebSession(key);
             if (!server.listening) {

package/dist/web/service.js

@@ -5,6 +5,7 @@ import { loadConfig, saveConfig } from "../config.js";
 import { startBackgroundTray } from "../tray.js";
 import { PRO_MODELS_URL, syncProModels } from "../pro/config.js";
 import { checkForUpdate, UPDATE_PACKAGE } from "../update.js";
+import { startUpdateWatch } from "../updateWatch.js";
 import { hub } from "./hub.js";
 import { startWebServer } from "./server.js";
 import { TerminalBridges } from "./terminalBridge.js";
@@ -18,6 +19,7 @@ export async function runWebService(options) {
     let handle = null;
     let tray = null;
     let monitor = null;
+    let stopUpdateWatch = null;
     let stopping = false;
     const bridges = new TerminalBridges();
     const status = () => {
@@ -44,6 +46,8 @@ export async function runWebService(options) {
         stopping = true;
         if (monitor)
             clearInterval(monitor);
+        stopUpdateWatch?.();
+        stopUpdateWatch = null;
         tray?.close();
         bridges.close();
         backgroundLog(`stopping pid=${process.pid}`);
@@ -131,6 +135,24 @@ export async function runWebService(options) {
     }
     backgroundLog(`started pid=${process.pid} on ${handle.url} (residency ${resident ? "on" : "off"})`);
     syncTray();
+    // The start-up lookup above is one answer; a console that stays open needs
+    // more than that. Every 30 minutes the registry is asked again and a release
+    // it has not seen before is announced to every open window
+    // (GET /api/update/events), which is the same status the first-open dialog
+    // reads, so both ways of telling the user come from one source.
+    let loggedUpdate = "";
+    stopUpdateWatch = startUpdateWatch({
+        onCheck: (result) => {
+            // Log a change, not the same answer every half hour.
+            const line = result.hasUpdate
+                ? `${UPDATE_PACKAGE} ${result.latestVersion} is available (running ${result.currentVersion})`
+                : result.error ? `update check: ${result.error}` : "";
+            if (!line || line === loggedUpdate)
+                return;
+            loggedUpdate = line;
+            backgroundLog(line);
+        },
+    });
     // No helper processes: polling pids must remain invisible on Windows. An
     // orphaned, non-resident console lets an in-flight browser turn finish before
     // exiting, so disabling residency also cannot throw away running work.

package/package.json

@@ -1,37 +1,37 @@
-{
-  "name": "@xingjisoft/neutrino",
-  "version": "0.5.0",
-  "description": "XINGJI Neutrino - a CLI coding agent in the terminal.",
-  "type": "module",
-  "license": "Apache-2.0",
-  "bin": {
-    "neutrino": "dist/bin.js"
-  },
-  "main": "dist/app.js",
-  "files": [
-    "dist",
-    "assets",
-    "web"
-  ],
-  "engines": {
-    "node": ">=18.0.0"
-  },
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "test": "npm run build && node scripts/test-paste.mjs && node scripts/test-mouse.mjs && node scripts/test-cursor.mjs && node scripts/test-selection.mjs && node scripts/test-drag-scroll.mjs && node scripts/test-selection-performance.mjs && node scripts/test-copy.mjs && node scripts/test-scrollbar.mjs && node scripts/test-render.mjs && node scripts/test-drift.mjs && node scripts/test-sanitize.mjs && node scripts/test-markdown.mjs && node scripts/test-wrap.mjs && node scripts/test-fetch.mjs && node scripts/test-compact.mjs && node scripts/test-history-fold.mjs && node scripts/test-web-history.mjs && node scripts/test-web-mobile-history.mjs && node scripts/test-session-migration.mjs && node scripts/test-web-session-migration.mjs && node scripts/test-web-default.mjs && node scripts/test-turn-fold.mjs && node scripts/test-long-turn.mjs && node scripts/test-plan.mjs && node scripts/test-subagent.mjs && node scripts/test-web-settings.mjs && node scripts/test-update.mjs && node scripts/test-update-ui.mjs && node scripts/test-update-web.mjs && node scripts/test-model-intensity.mjs && node scripts/test-background.mjs && node scripts/test-background-lifetime.mjs && node scripts/test-web-markdown.mjs && node scripts/test-web-i18n.mjs && node scripts/test-web-workspaces.mjs && node scripts/test-tools.mjs && node scripts/test-approval.mjs && node scripts/test-approval-review.mjs && node scripts/test-approval-ui.mjs && node scripts/test-web-approval-details.mjs && node scripts/test-web-sidebar-status.mjs && node scripts/test-web-seen.mjs && node scripts/test-approval-mode.mjs && node scripts/test-approval-context.mjs && node scripts/test-settings-render.mjs && node scripts/test-approval-flow.mjs && node scripts/test-web.mjs && node scripts/test-web-settings-http.mjs && node scripts/test-web-lan.mjs && node scripts/test-web-auth.mjs && node scripts/test-web-auth-ui.mjs && node scripts/test-web-pro.mjs && node scripts/test-pro-preflight.mjs && node scripts/test-pro-runtime.mjs && node scripts/test-pro-team.mjs && node scripts/test-pro-ui.mjs && node scripts/test-interrupt.mjs && node scripts/test-terminal-lifecycle.mjs && node scripts/test-persistence.mjs && node scripts/test-resilience.mjs && node scripts/test-approval-timeout.mjs && node scripts/test-approval-hardening.mjs && node scripts/test-approval-extreme.mjs && node scripts/test-approval-reason.mjs",
-    "prepare": "npm run build",
-    "web": "node dist/bin.js web"
-  },
-  "keywords": [
-    "cli",
-    "agent",
-    "ai",
-    "terminal",
-    "llm",
-    "coding"
-  ],
-  "devDependencies": {
-    "@types/node": "^22.0.0",
-    "typescript": "^5.5.0"
-  }
-}
+{
+  "name": "@xingjisoft/neutrino",
+  "version": "0.5.2",
+  "description": "XINGJI Neutrino - a CLI coding agent in the terminal.",
+  "type": "module",
+  "license": "Apache-2.0",
+  "bin": {
+    "neutrino": "dist/bin.js"
+  },
+  "main": "dist/app.js",
+  "files": [
+    "dist",
+    "assets",
+    "web"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "npm run build && node scripts/test-paste.mjs && node scripts/test-mouse.mjs && node scripts/test-cursor.mjs && node scripts/test-selection.mjs && node scripts/test-drag-scroll.mjs && node scripts/test-selection-performance.mjs && node scripts/test-copy.mjs && node scripts/test-scrollbar.mjs && node scripts/test-render.mjs && node scripts/test-drift.mjs && node scripts/test-sanitize.mjs && node scripts/test-markdown.mjs && node scripts/test-wrap.mjs && node scripts/test-fetch.mjs && node scripts/test-compact.mjs && node scripts/test-history-fold.mjs && node scripts/test-web-history.mjs && node scripts/test-web-mobile-history.mjs && node scripts/test-session-migration.mjs && node scripts/test-web-session-migration.mjs && node scripts/test-web-default.mjs && node scripts/test-turn-fold.mjs && node scripts/test-long-turn.mjs && node scripts/test-plan.mjs && node scripts/test-subagent.mjs && node scripts/test-web-settings.mjs && node scripts/test-update.mjs && node scripts/test-update-ui.mjs && node scripts/test-update-web.mjs && node scripts/test-settings-update.mjs && node scripts/test-update-check.mjs && node scripts/test-update-watch.mjs && node scripts/test-model-intensity.mjs && node scripts/test-background.mjs && node scripts/test-background-lifetime.mjs && node scripts/test-web-markdown.mjs && node scripts/test-web-i18n.mjs && node scripts/test-web-workspaces.mjs && node scripts/test-tools.mjs && node scripts/test-approval.mjs && node scripts/test-approval-review.mjs && node scripts/test-approval-ui.mjs && node scripts/test-web-approval-details.mjs && node scripts/test-web-sidebar-status.mjs && node scripts/test-web-seen.mjs && node scripts/test-approval-mode.mjs && node scripts/test-approval-context.mjs && node scripts/test-settings-render.mjs && node scripts/test-approval-flow.mjs && node scripts/test-web.mjs && node scripts/test-web-settings-http.mjs && node scripts/test-web-lan.mjs && node scripts/test-web-auth.mjs && node scripts/test-web-auth-ui.mjs && node scripts/test-web-pro.mjs && node scripts/test-pro-preflight.mjs && node scripts/test-pro-runtime.mjs && node scripts/test-pro-team.mjs && node scripts/test-pro-ui.mjs && node scripts/test-interrupt.mjs && node scripts/test-terminal-lifecycle.mjs && node scripts/test-persistence.mjs && node scripts/test-resilience.mjs && node scripts/test-approval-timeout.mjs && node scripts/test-approval-hardening.mjs && node scripts/test-approval-extreme.mjs && node scripts/test-approval-reason.mjs",
+    "prepare": "npm run build",
+    "web": "node dist/bin.js web"
+  },
+  "keywords": [
+    "cli",
+    "agent",
+    "ai",
+    "terminal",
+    "llm",
+    "coding"
+  ],
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.5.0"
+  }
+}

package/web/app.js

@@ -145,6 +145,7 @@ function showGate(message = "") {
   if (gateShown) return;
   gateShown = true;
   closeStream();
+  closeUpdateEvents();
   setStatus("locked", "offline");
   document.getElementById("settings-dialog").close();
   document.getElementById("background-dialog")?.close?.();
@@ -259,20 +260,57 @@ async function answerBackgroundPrompt(enable) {
 
 // ------------------------------------------------------------- update notice
 //
-// The server compares the version it runs with the one npm publishes, and both
-// workspaces read that from the settings payload: a Pro tab announces a new
-// release exactly like the regular console. Confirming installs it on this
-// machine; the running process keeps the old code either way, so a successful
-// update ends by telling the user to restart.
+// The server compares the version it runs with the one npm publishes — at
+// start-up, every 30 minutes and on demand from Settings — and every answer
+// reaches the page through one announcement stream, so the notice shown when
+// the console opens and the corner badge cannot disagree about the release. A
+// Pro tab listens to the same stream under its own API prefix. Confirming
+// installs it on this machine; the running process keeps the old code either
+// way, so a successful update ends by telling the user to restart.
 //
-// Two dialogs never open at once: when an update is offered, the background
-// invitation waits for the next page load (it is not consumed by being skipped).
+// Two dialogs never open at once: the background invitation is modal too, so a
+// release announced while it is up is offered once it is out of the way.
 
 let updatePrompted = false;
 
-function maybePromptUpdate(config) {
-  const update = config?.update;
-  if (updatePrompted || !update?.has_update) return false;
+// The release the page currently knows about. The notice and the corner badge
+// read this one value, so the reminder can never name a different version.
+let updateOffer = null;
+
+// The console's own announcement stream, and the release that arrived while the
+// background invitation was holding the screen.
+let updateSource = null;
+let pendingUpdate = null;
+
+/**
+ * Remember a release and light the corner badge. The announcement stream and a
+ * check started in Settings both report here.
+ */
+function noteUpdateAvailable(update) {
+  if (!update?.has_update) return false;
+  updateOffer = update;
+  if (el.updateBadge) {
+    const label = tr("A new version is available");
+    el.updateBadge.title = label;
+    el.updateBadge.setAttribute("aria-label", label);
+    el.updateBadge.classList.remove("hidden");
+  }
+  return true;
+}
+
+/** The release is installed or was never on offer: drop the reminder. */
+function clearUpdateBadge() {
+  updateOffer = null;
+  pendingUpdate = null;
+  el.updateBadge?.classList.add("hidden");
+}
+
+/**
+ * Offer a known release. The notice shown on load and a check started from
+ * Settings both end up here, so an update is announced with the same words and
+ * the same buttons however the user found out about it.
+ */
+function openUpdateDialog(update) {
   if (!el.updateDialog || typeof el.updateDialog.showModal !== "function") return false;
   updatePrompted = true;
   if (el.updateVersions) {
@@ -299,6 +337,56 @@ function maybePromptUpdate(config) {
   return true;
 }
 
+/**
+ * Announce a release. The console pushes what it knows when a tab connects and
+ * again whenever the 30-minute background check finds a new one, so a window
+ * that stays open is told in the same words as one that has just loaded.
+ */
+function applyUpdateStatus(update) {
+  // The badge is lit even when the notice was already shown, so a dismissed
+  // offer can still be picked up again from the corner.
+  if (!noteUpdateAvailable(update)) {
+    // The console reports no release any more, so the reminder has nothing
+    // left to stand for.
+    clearUpdateBadge();
+    return false;
+  }
+  if (updatePrompted) return false;
+  // The background invitation is a modal dialog too, and two of them must never
+  // stack: this release is offered once that one is out of the way.
+  if (el.backgroundDialog?.open) {
+    pendingUpdate = update;
+    return false;
+  }
+  return openUpdateDialog(update);
+}
+
+/**
+ * Listen for the console's announcements. EventSource reconnects by itself, so
+ * a dropped connection only leaves the page with the release it already knows.
+ */
+function openUpdateEvents() {
+  if (updateSource) return;
+  const source = new EventSource(apiPath("/api/update/events"));
+  updateSource = source;
+  source.addEventListener("update", (event) => {
+    let update;
+    try {
+      update = JSON.parse(event.data);
+    } catch {
+      return;
+    }
+    applyUpdateStatus(update);
+  });
+}
+
+/** The console is locked behind the login gate: its announcements are moot. */
+function closeUpdateEvents() {
+  if (!updateSource) return;
+  updateSource.close();
+  updateSource = null;
+}
+
 /** Run npm through the console's own server and report what happened. */
 async function runUpdate() {
   if (!el.updateNow || el.updateNow.disabled) return;
@@ -322,6 +410,7 @@ async function runUpdate() {
     // The install is done: the only thing left is to close the notice.
     el.updateLater?.classList.add("hidden");
     el.updateNow?.classList.add("hidden");
+    clearUpdateBadge();
   } catch (error) {
     if (feedback) {
       feedback.textContent = tr("Update failed: {error}", { error: error.message });
@@ -422,6 +511,7 @@ const el = {
   updateClose: document.getElementById("update-close"),
   updateLater: document.getElementById("update-later"),
   updateNow: document.getElementById("update-now"),
+  updateBadge: document.getElementById("update-badge"),
 };
 
 if (el.backgroundCancel) {
@@ -435,6 +525,14 @@ if (el.backgroundDialog) {
     event.preventDefault();
     void answerBackgroundPrompt(false);
   });
+  // A release announced while the invitation was up is offered right after it.
+  el.backgroundDialog.addEventListener("close", () => {
+    const waiting = pendingUpdate;
+    pendingUpdate = null;
+    // The login gate closes this dialog on its way in, and nothing may sit on
+    // top of it.
+    if (waiting && !gateShown) openUpdateDialog(waiting);
+  });
 }
 
 if (el.updateNow) el.updateNow.addEventListener("click", () => { void runUpdate(); });
@@ -447,6 +545,12 @@ if (el.updateDialog) {
     el.updateDialog.close();
   });
 }
+// The corner disc reopens the same notice, so a dismissal is never final.
+if (el.updateBadge) {
+  el.updateBadge.addEventListener("click", () => {
+    if (updateOffer) openUpdateDialog(updateOffer);
+  });
+}
 
 const state = {
   overview: null,
@@ -495,6 +599,12 @@ const preferences = createSettingsUI({
   proMode: PRO_MODE,
   onCatalogChange: (catalog) => proUI?.load(catalog),
   onLanguageChange: (language) => changeInterfaceLanguage(language),
+  // A check started from Settings offers its result through the same dialog as
+  // the notice shown on load, and lights the corner badge with it.
+  onUpdateFound: (update) => {
+    noteUpdateAvailable(update);
+    return openUpdateDialog(update);
+  },
   async applyModel(selection) {
     const current = state.selection;
     if (!current) throw new Error("Select a conversation first.");
@@ -3146,9 +3256,12 @@ preferences.load()
     if (language && language !== uiLanguage()) {
       await changeInterfaceLanguage(language, { persist: false });
     }
-    // Offer the update first, and only then the background invitation: two
-    // modal dialogs must never stack on top of each other.
-    if (!maybePromptUpdate(config)) maybePromptBackground(config);
+    // The announcement stream needs the login cookie, so it opens once the
+    // settings payload has loaded. A release it reports right away opens the
+    // notice; one that lands while the background invitation is up waits for it
+    // to close, because two modal dialogs must never stack on top of each other.
+    openUpdateEvents();
+    maybePromptBackground(config);
   })
   .catch(error => console.error(error));
 loadSeen().then(() => loadOverview()).then(() => {

package/web/i18n.js

@@ -115,6 +115,13 @@ const ZH = {
   "Updated to {version}. Restart Neutrino to use it.": "已更新到 {version}，请重新启动 Neutrino 以使用新版本。",
   "Update failed: {error}": "更新失败：{error}",
   "Update by hand with:": "也可以手动更新：",
+  "Updates": "更新",
+  "Check for updates": "检查更新",
+  "Checking for updates…": "正在检查更新…",
+  "Version {latest} is available. This install runs {current}.": "发现新版本 {latest}，当前安装为 {current}。",
+  "Neutrino {version} is up to date.": "Neutrino {version} 已是最新版本。",
+  "Update check failed: {error}": "检查更新失败：{error}",
+  "Neutrino checks npm for new releases every 30 minutes. Both workspaces share that check.": "Neutrino 每 30 分钟通过 npm 检查一次新版本，普通模式与 Pro 模式共用该检查。",
   // -- chrome -------------------------------------------------------------
   "Neutrino": "Neutrino",
   "Switch to Pro mode": "切换至Pro模式",