Add TCAPSULE_NO_VERSION_CHECK to skip the remote version check

[jackson-asmith]

What

Adds a single opt-out env var, TCAPSULE_NO_VERSION_CHECK=1, that skips the remote version check so a run makes no outbound request.

Why

Per your feedback: the existing strong update-enforcement behavior is kept exactly as-is (it's good for pressuring users off vulnerable Samba builds), and it already fails open when the endpoint is unreachable. This just gives users who want a fully offline run an explicit switch instead of having to physically pull the network.

Changes

• version_check_disabled(env) + an env param on check_client_version; when the var is set, it returns a non-blocking result with source="disabled" and makes no network call or cache write.
• No change to the block-on-outdated behavior, the URL, or anything else.
• Test + one DETAIL.md line.

I dropped the advisory/local-floor rework and the redirect changes from the original PR as you requested.

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request updates the client version check logic to be advisory. Instead of blocking execution based on the remote minimum supported version, the client now only blocks if the local build version falls below a locally bundled floor (LOCAL_MIN_SUPPORTED_VERSION). A newer remote version will instead print a one-line advisory message. Additionally, the environment variable TCAPSULE_NO_VERSION_CHECK can now be used to skip the remote fetch entirely, and the fetch mechanism has been enhanced to reject cross-host or insecure redirects. Unit tests have been updated and added to verify these behaviors. There are no review comments, so I have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[jamesyc]

The local check is rather pointless- that only gets updated on update, so it's sort of tautological

Also, this check is already advisory. It fails-open, aka you can literally just unplug the internet access (the modem ethernet cable, etc) and it will just work anyways. There's no way for an external attacker to really disable executing it locally. For security reasons, strongly enforcing updates unless the user intentionally disables access to the version.json url (which is very clearly printed, precisely for that reason) is good security behavior- see how the WannaCry worm ravaged Samba v1; it would be good to be able to strongly pressure users to a certain newer version.

I do think just adding TCAPSULE_NO_VERSION_CHECK may be a good idea, but the rest of it is not needed.

[jackson-asmith]

Slimmed this down to just the TCAPSULE_NO_VERSION_CHECK opt-out as you suggested (ad0c555, force-pushed). Dropped the advisory/local-floor rework and the redirect pinning entirely — the strong enforcement and fail-open-on-unreachable behavior are unchanged. Diff is now ~12 lines in version_check.py plus a test.