[tfcace]

Summary

The model list went stale for four months without anyone noticing: hash shows whatever claude-agent-acp reports, and that list is baked into the Claude Code binary bundled in the npm package. Nothing updates a global npm install -g.

This PR makes hash notice and offer the fix, Ghostty-style (check, never a silent install):

• Daily check. After the first prompt is drawn, a goroutine resolves the configured agent command, reads the installed version from the package's package.json, and asks the npm registry for latest at most once per 24h across all sessions (state in <data dir>/agent-update.json). Offline or unknown layout: silent.
• Banner + ghost text. When a newer version exists, the next prompt shows a banner in the did-you-mean shape, with model update pre-filled as ghost text. At most once a day per version. A pending learned fix outranks it. A notice the adapter has already caught up with is dropped unseen.
• model update. Prints the exact npm install -g … command, streams npm's output dim and indented, reports OSC 9;4 progress and OSC 7501 status, restarts the agent (the pinned model survives), and shows the fresh model list with new tags. Every failure (no npm, EACCES, prefix mismatch, restart failure) names the manual command or the next step. Ctrl-C cancels npm, not hash.
• status shows the adapter version and X available · model update when behind.
• Config: [agent] auto_update = "check" | "off" (default check). Only the npm-installed @agentclientprotocol/claude-agent-acp is handled; other agents are untouched.

New leaf package internal/agentupdate (standard library only) owns detection, registry, state, throttle rules, and the installer, all with injected clock, PATH lookup, and process runner. No new dependencies.

Not in scope

• Background installs (auto_update = "install"): left as a documented future value.
• Other agents or package managers.

Test plan

• go vet ./... && go test ./... green; golangci-lint 0 issues.
• Unit tests: version compare, symlinked npm trees, httptest registry, atomic state file, throttle windows with a fake clock, installer with a fake runner (EACCES, no npm), banner and ghost priority, background-check guards, model update success/failure paths with a fake installer and transport, OSC 7501 pairing, status rendering, stale-notice drop.
• Smoke test on macOS against the real adapter and registry with an isolated data dir: banner at the prompt after ls, model update ghost text, status lines, no banner and no registry call on a second launch the same day.
• Real model update run on a 0.42.0 install: npm output, agent restart, fresh model card (Opus 5.5, Fable 5.1, Sonnet 5.5, Haiku 5.5).
• Reviewer: open hash with an outdated adapter installed, confirm the banner, accept it, confirm the card.

Known, pre-existing, unrelated: the whole internal/shell package fails under -race on a data race inside github.com/chzyer/readline; the new tests pass under -race when run on their own.

Docs: README and docs/config-reference.md here; the website docs guide gets a one-line auto_update note in the hash-website repo (separate commit, not yet pushed).