update: a released codeaf installs the newest stable and restarts before the chat opens

[ZeroPoint95]

A released codeaf now updates itself and restarts before the chat opens. Every other build is only told.

What changed

• A stable build installed as codeaf, with automatic updates on, now updates before the chat opens:
  • looks for a newer stable release
  • installs it with a progress line
  • restarts into it with the same arguments
• Among the chat's first lines it then says codeaf updated from <old> to <new> as it opened · automatic updates in /settings turns this off.
• Startup never hangs:
  • The check is cached for a day; otherwise it waits at most 1.5s.
  • A check that failed or got no answer is not retried for an hour.
  • The install waits at most 20s. A release that runs out of time is left to the chat's background install for a day.
  • Slow, failed or ctrl+c opens the build already on disk.
• Other launches print one terminal line before the chat, plus the existing chat line:
  • automatic updates off
  • dev, staging and rc builds, devaf, stageaf, any other file name
  • a pinned file
• A release you skipped, or one backing off after a failure, prints nothing in the terminal (same as the chat).
• The "named codeaf" rule reads the file that would be overwritten, with symlinks resolved, so it answers the same on macOS and Linux.
• Some launches don't check at all:
  • source builds (make build, go run) make no request
  • no terminal, CI set, or --once: nothing runs
• New: codeaf update --version <tag> and /update <tag> pin the file. A plain update unpins.
• The chat's 10s countdown stays, but only as the fallback when the launch couldn't finish.
• A finished background install now says just codeaf <tag> installed · restart to use the new version.
• On Windows, the parent waiting on the restarted build ignores console ctrl+c.
• Linuxbrew (/home/linuxbrew/.linuxbrew/) is treated as a package manager and is never replaced in place.
• The manual, the settings hint and --help are updated.
• keys.md: one heading reworded. The new update sections shifted search ranking, so "how do I make this one chat think harder" no longer reached that heading.

How it was checked

• go test -race ./internal/update/ ./internal/config/ ./cmd/codeaf/:
  • ok internal/update 15.6s
  • ok internal/config 34.3s
  • cmd/codeaf (238.8s): one failure, TestAShellRunWaitsForItsLastCallsPriceAndKeepsItsClock (carried_money_test.go:64: stderr = "", want the wait said). It fails the same way under -race on origin/dev 1acf751, so it's pre-existing. No other failure and no data race reported.
• go test -run 'Update|Offer|Skip|Pinned|Launch|Install|Grace|Countdown|Refus|FinishedInstall|Automatic|Deferred' ./internal/tui3/: ok … 15.0s
• go run ./cmd/codeaf-changes check: docs/changes/unreleased: 2 entries, all well formed.
• make test-laws: laws: 139 files in 30 packages, all 30 ok
• make test-packed-manual: ok internal/manual
• GOOS=windows and GOOS=linux builds of ./cmd/codeaf: compile
• make test-touched at f53fa93 (the previous head): every touched package passed on its first run: cmd/codeaf, internal/config, internal/manual, internal/update, and all 8 shards of internal/tui3. Not re-run for this round.
• By hand against the real GitHub stable, from a checkout of this branch.
  1. Build, copy and restore in one line, so bin/codeaf is never left stamped as a release:
     make build BUILD_REV=v0.0.1 && mkdir -p /tmp/au && rm -f /tmp/au/codeaf /tmp/au/devaf && cp bin/codeaf /tmp/au/codeaf && cp bin/codeaf /tmp/au/devaf && make build
  2. From cd $(mktemp -d), CODEAF_HOME=/tmp/au/home /tmp/au/codeaf:
     • Printed updating codeaf v0.0.1 to v0.8.0, then codeaf v0.8.0 installed · opening it.
     • Restarted on v0.8.0 in 3.3s, including the 66 MB download.
     • v0.8.0 predates this PR, so its chat has no "updated from" line.
  3. CODEAF_HOME=/tmp/au/home /tmp/au/devaf:
     • Nothing installed.
     • Chat: codeaf v0.8.0 is out · you have v0.0.1 · /update installs it for the next launch.
     • Terminal: … · devaf update installs it.
  4. Separately, against a local release host serving a v0.0.2 built from this branch, in a real terminal: restart with the "updated from" line; auto-update off; source build making zero requests; pin and unpin; silent network (1.8s, then 0.14s); slow download into the chat's countdown; ctrl+c.

Checklist

• A change entry: docs/changes/unreleased/1826-auto-update-on-launch.md
• The manual knows about it: running-from-the-terminal.md and commands.md, with new probes in internal/manual/chat_test.go
• No new line in .github/known-red.txt
• Only my own paths are staged — no git add -A

🤖 Generated with Claude Code