Skip to content

fix(update): show update notices to the person only - #56

Merged
0xpolarzero merged 1 commit into
mainfrom
fix/update-notice-user-only
Oct 23, 2026
Merged

0xpolarzero merged 1 commit into
mainfrom
fix/update-notice-user-only

Conversation

@0xpolarzero

@0xpolarzero 0xpolarzero commented Oct 23, 2026 •

Copy link
Copy Markdown
Member

Refs #44. Thanks @Suzukaa-a for flagging that the update notice read as prompt injection.

The update notice no longer enters the model's context in any adapter:

  • Notice text (lcu/update.mjs): plain information for the person ("LCU X is available (installed: Y). Run lcu update, then restart the agents that use LCU."), no instructions to an agent.
  • Codex hooks: lcu update --notice --hook prints a top-level systemMessage (a warning shown to the user) instead of hookSpecificOutput.additionalContext. The hook definitions are unchanged, so their trust hash is too.
  • Claude Code mod (lcu-approve 0.6.0): toast only; the hook result is returned unchanged.
  • Pi / Oh My Pi: new session_start handler calls ctx.ui.notify in interactive sessions (3 s cap, errors ignored).
  • Docs: INSTALLATION.md and ADAPTERS.md update-notice sections. Hermes and DeepSeek Harness keep lcu status / doctor / update --check.

The once-a-day account-wide cooldown and LCU_NO_UPDATE_CHECK=1 are unchanged.

Tests

  • node --test tests/node/*.test.mjs: 446 pass, 0 fail
  • adapters npm test: 212 pass, 8 skipped, 0 fail (includes new Pi notice test)
  • claude plugin test on the mod: 49/49
  • Python unit tests: 43 OK
  • Not run: tests/run.sh, e2e

Not verified live

The Codex systemMessage warning and the Pi/OMP notification have not been observed in a live session. Headless claude -p runs still consume the daily announcement without anyone seeing it.

RetriggerView in GreptileConfidence Score: 5/5

The PR appears safe to merge; no actionable defects were found.

Summary

Moves update notices out of model context and onto user-facing surfaces.

  • Update notices tell people about releases without instructing the model.
  • Claude Code shows update notices as toasts, not hook context.
  • Pi and Oh My Pi show update notices when an interactive session starts.

Known limitation acknowledged by 0xpolarzero: headless claude -p runs still consume the daily announcement without showing it. The PR also states that Codex warnings and Pi/Oh My Pi notifications have not been observed live.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Cache[Cached update notice] --> Cooldown[Shared announcement cooldown]
  Cooldown --> Codex[Codex systemMessage]
  Cooldown --> Claude[Claude toast]
  Cooldown --> Pi[Pi or Oh My Pi notification]
  Codex --> Person[Person using LCU]
  Claude --> Person
  Pi --> Person
Loading

Reviews (1) · Last reviewed commit: "fix(update): show update notices to the ..." · Reviewed by Greptile

The update notice no longer enters the model's context. Codex hooks print
systemMessage instead of additionalContext, the Claude Code mod shows only
its toast, and Pi / Oh My Pi show a UI notification at session start. The
notice text is now plain information for the person.

Refs #44
@vercel

vercel Bot commented Oct 23, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
lcu Ready Ready Preview Oct 23, 2026 8:45am UTC

@Suzukaa-a

Copy link
Copy Markdown

Thanks for the quick fix, and for taking the report seriously.

I also owe you an apology for #44. I'd seen an agent update LCU on its own in a Claude Code context that had never used LCU, and for a moment I took it as something LCU's components were deliberately doing. I filed the issue in the heat of that moment. After I calmed down and looked into it, that wasn't what was happening, and I should have checked before opening the issue. Sorry for the noise and for the wrong framing.

@0xpolarzero

Copy link
Copy Markdown
Member Author

Thanks for the quick fix, and for taking the report seriously.

I also owe you an apology for #44. I'd seen an agent update LCU on its own in a Claude Code context that had never used LCU, and for a moment I took it as something LCU's components were deliberately doing. I filed the issue in the heat of that moment. After I calmed down and looked into it, that wasn't what was happening, and I should have checked before opening the issue. Sorry for the noise and for the wrong framing.

It was definitely a wrong choice to get it into the context of an agent that didn't use lcu in the first place, and the fact that your agent updated it without notice is as issue as well, and makes sense considering that bad pattern. So it's normal that it was confusing to you.

So, still, thanks for reporting it, that's definitely useful, better file it in the heat of that moment than never! You don't owe me an apology and I don't think that's noise. Really appreciate you taking the time to explain, thanks!

@0xpolarzero
0xpolarzero merged commit bd26df4 into main Oct 23, 2026
19 checks passed
@0xpolarzero
0xpolarzero deleted the fix/update-notice-user-only branch October 23, 2026 09:09

This branch was successfully deployed

1 active deployment
Preview — 4d3be2aa Deployed Oct 23, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants