feat(update): update_check config block + dismissible Web UI update banner (Spec 079 US1) (#805)

* feat(update): update_check config block with hot-reload + env precedence (Spec 079 US1)

Add the update_check.{enabled,channel} config group (FR-012/FR-013):

- enabled (default true) gates BOTH the background poll and the manual
  CheckNow (/api/v1/info?refresh=true) path; when disabled no network
  check runs and GetVersionInfo returns nil so /api/v1/info omits the
  update object entirely — every surface (banner, badge, status/doctor
  annotation) goes quiet (FR-015).
- channel: "stable" (default; prereleases never offered) or "rc"
  (prereleases included), validated; the config-file equivalent of
  MCPPROXY_ALLOW_PRERELEASE_UPDATES.
- Precedence (FR-014): the existing env switches WIN over config —
  MCPPROXY_DISABLE_AUTO_UPDATE=true force-disables and
  MCPPROXY_ALLOW_PRERELEASE_UPDATES=true force-includes prereleases.
  The spec leaves precedence open; env-wins is the operator-override
  reading, documented in code and docs.
- Hot-reload: DetectConfigChanges reports "update_check"; ApplyConfig
  (API path) and ReloadConfiguration (disk path) both re-gate the
  running checker. The background loop now stays alive while
  config-disabled, and a re-enable/channel switch triggers a prompt
  re-check instead of waiting up to the 4h interval.
- make swagger: config.UpdateCheckConfig surfaced on config.Config.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(web): dismissible per-version update banner on the dashboard (Spec 079 US1)

FR-005: non-modal alert banner on the dashboard when the checker reports
an update — "Update available: vX — you are running vY" with a
release-notes link and a dismiss (X) button. Dismissal persists the
dismissed latest_version in localStorage, so the same version never
re-nags across reloads while a newer release shows the banner again.
The existing sidebar badge + manual-check toast are unchanged.

When update_check.enabled=false the daemon omits the update object from
/api/v1/info, so the banner (and badge) are naturally absent; the manual
"check for updates" action now says checks are disabled instead of the
misleading "You are running the latest version".

Tests: 6 vitest cases (render, no-update, absent update object,
dismiss persists, stays dismissed on remount, newer version reappears).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs(update): document update_check config block, env-var precedence, and the Web UI banner (Spec 079 US1)

- features/version-updates.md: update_check.{enabled,channel} reference,
  hot-reload behavior, explicit env-vs-config precedence (env wins, one
  direction only), config-based examples, dismissible per-version banner.
- configuration.md + configuration/config-file.md (served reference):
  new Update Check sections + complete-reference key.
- configuration/environment-variables.md: auto-update table is core+tray
  (not tray-only) and points at the config-file equivalent.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(update): review fixes — tray honors update_check.enabled, no stale nudge/cache

Address Codex review findings on the Spec 079 US1 branch:

- Go tray self-update (major): the tray's independent daily release check
  (checkForUpdates) now reads update_check.enabled from the shared config
  file and skips the network check when disabled (FR-015: no check on any
  surface). Fails open on missing/unreadable config, matching the pre-079
  default; MCPPROXY_DISABLE_AUTO_UPDATE still wins (FR-014). Full FR-001a
  convergence (tray consuming the shared checker, incl. channel) remains a
  separate 079 work item — docs updated to say exactly that.
- Tray stale nudge (minor): checkUpdateFromAPI treats an absent update
  object in /api/v1/info (checker disabled via hot-reload) as "no update",
  clearing state and hiding the menu item instead of returning early and
  leaving a stale "New version available" entry until restart.
- Checker races (minor): SetConfig now bumps a config generation and drops
  the cached VersionInfo on any effective change; check() captures the
  generation and updateVersionInfo discards results from a stale generation
  or while disabled. An in-flight check can no longer publish/announce after
  disable, and a channel switch or re-enable never briefly serves
  wrong-channel cached info (FR-013/FR-015).
- UpdateBanner (minor): localStorage reads/writes wrapped in try/catch,
  degrading to session-only dismissal when storage is blocked (precedent:
  stores/system.ts), so blocked storage cannot break Dashboard setup.

Tests: new unit tests for the tray config gate, the stale-nudge clear
(httptest core stub), the checker generation/disable races, and a
blocked-localStorage banner spec. go test -race, vitest (253 pass),
golangci-lint v2, and make build all green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs(update): sync REST/CLI/prerelease docs with update_check gating

- rest-api.md: /api/v1/info omits the update object when checking is
  disabled (update_check.enabled=false or MCPPROXY_DISABLE_AUTO_UPDATE);
  note refresh=true no-ops while disabled and point at the update_check
  config block.
- cli/status-command.md: document the disabled case (no update object,
  version shown without annotation).
- prerelease-builds.md: RC opt-in now also possible via
  update_check.channel=rc for the core checker (Go tray self-update check
  stays env-only until FR-001a).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(update): tray gate honors --config override; check() re-reads enabled

Codex final-review findings on PR #805 (Spec 079 US1):

- Major: ServerAdapter.GetConfigPath() hardcoded ~/.mcpproxy/mcp_config.json,
  ignoring MCPPROXY_TRAY_CONFIG_PATH — the very path the tray launches core
  with as --config (buildCoreArgs). So the update_check gate read the wrong
  file under a custom config path and failed open, letting the tray-owned
  daily GitHub check run despite update_check.enabled=false. Resolve the env
  override first, matching what core actually uses.

- Minor: check() captured cfgGen but not the enabled flag, so a disable racing
  after the caller's outer Enabled() gate (loop tick / re-enable goroutine)
  still issued a GitHub request. The generation guard dropped the result, but
  the request fired — violating FR-015 "no network check on any surface".
  Re-read enabled under the same lock as gen and bail before checkFunc.

Both covered by new tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(update): tray gates self-update via core API, not config file

The tray must interact with the core only over the socket/REST API and
hold no state (CLAUDE.md). The previous update-check gate violated this by
calling config.LoadFromFile on the core's mcp_config.json.

Replace updateCheckEnabledByConfig with fetchCoreUpdateInfo, which asks the
core via GET /api/v1/info (the same endpoint checkUpdateFromAPI uses). The
core omits the update object when update_check.enabled=false, making its
config the single source of truth:

- core reports an update object -> run the legacy GitHub self-update flow
- core omits the update object   -> skip (checking disabled / no update)
- core unreachable               -> skip this tick (do not fall open to a
  network check the operator may have disabled); the 24h ticker retries

checkUpdateFromAPI now shares fetchCoreUpdateInfo. File-based gate tests are
replaced with API-based ones asserting the network path (injected
selfUpdateFunc) runs only when the core reports an update.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: Dumbris

cmd/mcpproxy-tray/internal/api/adapter.go

@@ -6,6 +6,7 @@ import (
 	"os"
 	"path/filepath"
 	"runtime"
+	"strings"
 
 	internalRuntime "github.com/smart-mcp-proxy/mcpproxy-go/internal/runtime"
 	"github.com/smart-mcp-proxy/mcpproxy-go/internal/tray"
@@ -307,8 +308,15 @@ func (a *ServerAdapter) ReloadConfiguration() error {
 	return fmt.Errorf("ReloadConfiguration not yet supported via API")
 }
 
-// GetConfigPath returns the configuration file path
+// GetConfigPath returns the configuration file path core is running with.
+// The tray passes MCPPROXY_TRAY_CONFIG_PATH to core as --config (see
+// buildCoreArgs in main.go), so tray-side config consumers — e.g. the Spec 079
+// update_check gate — must resolve to that same override, not a hardcoded
+// default. Falls back to the default ~/.mcpproxy path when unset.
 func (a *ServerAdapter) GetConfigPath() string {
+	if cfg := strings.TrimSpace(os.Getenv("MCPPROXY_TRAY_CONFIG_PATH")); cfg != "" {
+		return cfg
+	}
 	homeDir, err := os.UserHomeDir()
 	if err != nil {
 		return "~/.mcpproxy/mcp_config.json" // fallback

cmd/mcpproxy-tray/internal/api/adapter_test.go

@@ -645,3 +645,30 @@ func TestHealthDataFlow_EndToEnd(t *testing.T) {
 	status := adapter.GetStatus().(map[string]interface{})
 	assert.Equal(t, 1, status["connected_servers"], "Status should use health.level for connected count")
 }
+
+// =============================================================================
+// ServerAdapter.GetConfigPath Tests
+// =============================================================================
+
+// The tray launches core with --config <MCPPROXY_TRAY_CONFIG_PATH> (see
+// buildCoreArgs in main.go). GetConfigPath must resolve to that SAME path so
+// tray-side config consumers (e.g. the Spec 079 update_check gate) read the
+// config core is actually using — not a hardcoded default.
+func TestServerAdapter_GetConfigPath_HonorsTrayConfigPathEnv(t *testing.T) {
+	const custom = "/tmp/custom-tray-config/mcp_config.json"
+	t.Setenv("MCPPROXY_TRAY_CONFIG_PATH", custom)
+
+	adapter := NewServerAdapter(NewMockClient())
+
+	assert.Equal(t, custom, adapter.GetConfigPath())
+}
+
+func TestServerAdapter_GetConfigPath_DefaultWhenEnvUnset(t *testing.T) {
+	t.Setenv("MCPPROXY_TRAY_CONFIG_PATH", "")
+
+	adapter := NewServerAdapter(NewMockClient())
+
+	got := adapter.GetConfigPath()
+	assert.Contains(t, got, "mcp_config.json")
+	assert.NotEqual(t, "", got)
+}

docs/api/rest-api.md

@@ -793,7 +793,7 @@ Get application info, version, and update availability.
 | `listen_addr` | string | Server listen address |
 | `endpoints.http` | string | HTTP API endpoint address |
 | `endpoints.socket` | string | Unix socket path (empty if disabled) |
-| `update` | object | Update information (may be null if not checked yet) |
+| `update` | object | Update information (may be null if not checked yet; omitted entirely when update checking is disabled via `update_check.enabled: false` or `MCPPROXY_DISABLE_AUTO_UPDATE=true`) |
 | `update.available` | boolean | Whether a newer version is available |
 | `update.latest_version` | string | Latest version available on GitHub |
 | `update.release_url` | string | URL to the GitHub release page |
@@ -802,7 +802,7 @@ Get application info, version, and update availability.
 | `update.check_error` | string | Error message if update check failed |
 
 :::tip Update Checking
-MCPProxy automatically checks for updates every 4 hours. The update information is exposed via this endpoint and used by the tray application and web UI to show update notifications.
+MCPProxy automatically checks for updates every 4 hours. The update information is exposed via this endpoint and used by the tray application and web UI to show update notifications. Use `?refresh=true` to force an immediate re-check. Checking is controlled by the `update_check` config block (`enabled`, `channel`) — see [Version Updates](/features/version-updates); when disabled, `?refresh=true` performs no check and the `update` object is omitted.
 :::
 
 ### Docker

docs/cli/status-command.md

@@ -151,6 +151,7 @@ When the daemon is running, `status` surfaces the result of the background updat
 - **Update available**: `Version: v1.2.0 (update available: v1.3.0 — <release URL>)`
 - **Up to date**: `Version: v1.3.0 (latest)`
 - **Check failed or not yet completed** (offline, rate-limited): the version is shown without any annotation. In JSON output the `update.check_error` field retains the failure reason for diagnostics.
+- **Update checking disabled** (`update_check.enabled: false` in the config, or `MCPPROXY_DISABLE_AUTO_UPDATE=true`): the daemon performs no check and omits the `update` object entirely, so the version is shown without any annotation.
 
 In machine-readable output (`-o json`/`-o yaml`) the `update` object also carries `checked_at` (when the last successful check ran, so consumers can judge staleness) and `is_prerelease` (whether the offered version is a prerelease), matching the `/api/v1/info` contract.
 

docs/configuration.md

@@ -17,7 +17,8 @@ Complete reference for MCPProxy configuration file (`mcp_config.json`). This doc
 11. [Code Execution](#code-execution)
 12. [Feature Flags](#feature-flags)
 13. [Registries](#registries)
-14. [Complete Example](#complete-example)
+14. [Update Check](#update-check)
+15. [Complete Example](#complete-example)
 
 ---
 
@@ -1033,6 +1034,49 @@ and are hot-reloadable. Non-positive values fall back to the defaults.
 
 ---
 
+## Update Check
+
+Controls the background upgrade-awareness checker (Spec 079). MCPProxy
+periodically queries GitHub Releases and surfaces "update available" on
+`mcpproxy status` / `doctor`, a startup log line, the Web UI (sidebar badge +
+dismissible banner), and the trays. Checks never block and fail silently when
+offline.
+
+```json
+{
+  "update_check": {
+    "enabled": true,
+    "channel": "stable"
+  }
+}
+```
+
+| Field | Type | Default | Description |
+|-------|------|---------|-------------|
+| `enabled` | boolean | `true` | Master switch for update checking. When `false`, no network check is performed (background poll *and* the manual `/api/v1/info?refresh=true` re-check) and no upgrade nudge appears on any surface — the `update` object is omitted from `/api/v1/info`. |
+| `channel` | string | `"stable"` | Release channel: `"stable"` (GitHub `releases/latest`; prereleases never offered) or `"rc"` (prerelease tags such as `v0.47.0-rc.1` included). |
+
+Both keys are optional and hot-reloadable: editing them (config file or
+`POST /api/v1/config/apply`) takes effect without a restart, and re-enabling
+triggers a prompt re-check.
+
+**Environment-variable precedence** — the existing switches keep working and
+**win over** the config keys (operator override):
+
+| Variable | Effect |
+|----------|--------|
+| `MCPPROXY_DISABLE_AUTO_UPDATE=true` | Force-disables update checking even when `update_check.enabled` is `true`. |
+| `MCPPROXY_ALLOW_PRERELEASE_UPDATES=true` | Force-selects the prerelease (`rc`) channel even when `update_check.channel` is `stable`. |
+
+The env vars only widen in one direction (disable checks / enable
+prereleases); they cannot force-enable checking that config disabled — with
+`update_check.enabled: false`, checks stay off regardless of environment.
+
+See [Version Updates](features/version-updates.md) for where updates are
+surfaced.
+
+---
+
 ## Complete Example
 
 Here's a complete configuration example with all major sections:

docs/configuration/config-file.md

@@ -38,6 +38,10 @@ MCPProxy uses a JSON configuration file located at `~/.mcpproxy/mcp_config.json`
   "features": {
     "enable_web_ui": true
   },
+  "update_check": {
+    "enabled": true,
+    "channel": "stable"
+  },
   "mcpServers": []
 }
 ```
@@ -112,6 +116,23 @@ Both cadences are configurable globally, and can be overridden per server (see [
 | `code_execution_max_tool_calls` | integer | `0` | Maximum tool calls (0 = unlimited) |
 | `code_execution_pool_size` | integer | `10` | VM pool size for code execution |
 
+### Update Check Settings
+
+Controls the background upgrade-awareness checker. Both keys are optional and
+hot-reloadable (no restart needed).
+
+| Option | Type | Default | Description |
+|--------|------|---------|-------------|
+| `update_check.enabled` | boolean | `true` | Master switch. When `false`, no network check runs (background poll and manual re-check) and no upgrade nudge appears on any surface — the `update` object is omitted from `/api/v1/info`. |
+| `update_check.channel` | string | `"stable"` | Release channel: `"stable"` (prereleases never offered) or `"rc"` (prerelease tags like `v0.47.0-rc.1` included). |
+
+The existing environment switches keep working and **win over** these keys:
+`MCPPROXY_DISABLE_AUTO_UPDATE=true` force-disables checking, and
+`MCPPROXY_ALLOW_PRERELEASE_UPDATES=true` force-selects the prerelease channel.
+They only widen in one direction — they cannot re-enable checking that the
+config disabled. See [Version Updates](/features/version-updates) for where
+updates are surfaced.
+
 ### MCP Servers
 
 See [Upstream Servers](/configuration/upstream-servers) for detailed server configuration.

docs/configuration/environment-variables.md

@@ -111,14 +111,19 @@ The tray application doesn't read the config file directly. It launches the core
 | `MCPPROXY_TRAY_ENDPOINT` | Override tray-core communication endpoint (unix:///path/socket.sock or npipe:////./pipe/name) | Auto-detect |
 | `MCPPROXY_TRAY_INSPECT_ADDR` | Address for tray instrumentation/debug server | - |
 
-### Auto-Update Settings (Tray)
+### Auto-Update Settings
 
 | Variable | Description | Default |
 |----------|-------------|---------|
-| `MCPPROXY_DISABLE_AUTO_UPDATE` | Disable automatic update checks | `false` |
-| `MCPPROXY_UPDATE_NOTIFY_ONLY` | Only notify about updates, don't auto-install | `false` |
-| `MCPPROXY_ALLOW_PRERELEASE_UPDATES` | Allow prerelease/beta version updates | `false` |
-| `MCPPROXY_UPDATE_APP_BUNDLE` | Enable app bundle updates (macOS) | `false` |
+| `MCPPROXY_DISABLE_AUTO_UPDATE` | Disable automatic update checks (core + tray) | `false` |
+| `MCPPROXY_UPDATE_NOTIFY_ONLY` | Only notify about updates, don't auto-install (tray) | `false` |
+| `MCPPROXY_ALLOW_PRERELEASE_UPDATES` | Allow prerelease/beta version updates (core + tray) | `false` |
+| `MCPPROXY_UPDATE_APP_BUNDLE` | Enable app bundle updates (macOS tray) | `false` |
+
+Update checking can also be controlled from the config file via the
+`update_check` block (`enabled`, `channel`) — see
+[Version Updates](/features/version-updates). When both are set, the
+environment variables **win** over the config keys.
 
 ### Setting Tray Variables on macOS
 

docs/features/version-updates.md

@@ -37,6 +37,12 @@ The sidebar displays the current version at the bottom. When an update is availa
 - A small "update available" badge appears next to the version
 - Click to view the release notes
 
+The dashboard additionally shows a **dismissible update banner** ("Update
+available: vX — you are running vY") with a release-notes link. Dismissal is
+**per version**: dismissing the banner for v1.3.0 keeps it hidden for v1.3.0
+(persisted in the browser), but the banner reappears when a newer release
+becomes available. The banner is non-modal and never blocks the UI.
+
 ### CLI Doctor Command
 
 The `mcpproxy doctor` command shows version information:
@@ -55,20 +61,75 @@ Download: https://github.com/smart-mcp-proxy/mcpproxy-go/releases/tag/v1.3.0
 
 ## Configuration
 
+### Config File (`update_check`)
+
+Update checking is controlled from `mcp_config.json` via the `update_check`
+block:
+
+```json
+{
+  "update_check": {
+    "enabled": true,
+    "channel": "stable"
+  }
+}
+```
+
+| Option | Type | Default | Description |
+|--------|------|---------|-------------|
+| `enabled` | boolean | `true` | Master switch. When `false`, no network check is performed (background poll and the manual re-check) and no upgrade nudge appears on any surface — the `update` object is omitted from `/api/v1/info`. |
+| `channel` | string | `"stable"` | Release channel: `"stable"` (GitHub `releases/latest`; prereleases never offered) or `"rc"` (prerelease tags such as `v0.47.0-rc.1` included). |
+
+Both keys are **hot-reloadable**: editing the config file or applying it via
+`POST /api/v1/config/apply` takes effect without a restart. Re-enabling (or
+switching channels) triggers a prompt re-check instead of waiting for the next
+4-hour tick.
+
+`enabled: false` also gates the Go tray's built-in daily self-update check, so
+no surface performs a network check while disabled. The tray does **not** read
+`mcp_config.json` itself (it holds no state); instead it asks the core via
+`GET /api/v1/info` before checking — the core omits the `update` object when
+update checking is disabled, and the tray then skips its own network check. If
+the core is unreachable the tray skips that tick and retries, rather than
+falling open to a check the operator may have disabled. The tray's own check
+still selects prereleases via `MCPPROXY_ALLOW_PRERELEASE_UPDATES` only —
+converging it fully onto the shared checker (including `channel`) is a separate
+Spec 079 work item (FR-001a).
+
 ### Environment Variables
 
 | Variable | Description | Default |
 |----------|-------------|---------|
 | `MCPPROXY_DISABLE_AUTO_UPDATE` | Disable background update checks entirely | `false` |
 | `MCPPROXY_ALLOW_PRERELEASE_UPDATES` | Include prerelease/beta versions in update checks | `false` |
 
+### Precedence (env vs config)
+
+The environment switches **win over** the `update_check` config keys — they
+are the operator override:
+
+- `MCPPROXY_DISABLE_AUTO_UPDATE=true` disables checking even when
+  `update_check.enabled` is `true`.
+- `MCPPROXY_ALLOW_PRERELEASE_UPDATES=true` selects the prerelease channel even
+  when `update_check.channel` is `"stable"`.
+
+The env vars only widen in one direction (disable checks / include
+prereleases). They cannot re-enable checking that the config disabled: with
+`update_check.enabled: false`, no check runs regardless of environment.
+
 ### Examples
 
 ```bash
-# Disable update checking
+# Disable update checking (config file — persistent, hot-reloads)
+#   "update_check": { "enabled": false }
+
+# Disable update checking (environment — wins over config)
 MCPPROXY_DISABLE_AUTO_UPDATE=true mcpproxy serve
 
-# Enable prerelease updates (for beta testers)
+# Opt in to prerelease (RC) updates via config
+#   "update_check": { "channel": "rc" }
+
+# Enable prerelease updates via environment (for beta testers)
 MCPPROXY_ALLOW_PRERELEASE_UPDATES=true mcpproxy serve
 ```
 
@@ -127,7 +188,7 @@ When running a development build (version shows as "development"), update checki
 ### Update check not working
 
 1. Ensure you have internet connectivity
-2. Check if `MCPPROXY_DISABLE_AUTO_UPDATE` is set
+2. Check if `MCPPROXY_DISABLE_AUTO_UPDATE` is set, or `update_check.enabled` is `false` in `mcp_config.json`
 3. Run `mcpproxy doctor` to see current version status
 4. Check logs for any GitHub API errors:
    ```bash
@@ -136,7 +197,8 @@ When running a development build (version shows as "development"), update checki
 
 ### Prerelease not showing
 
-By default, prerelease versions are excluded. To enable:
+By default, prerelease versions are excluded. To enable, set
+`"update_check": { "channel": "rc" }` in `mcp_config.json`, or:
 
 ```bash
 export MCPPROXY_ALLOW_PRERELEASE_UPDATES=true

docs/prerelease-builds.md

@@ -69,7 +69,7 @@ The GitHub release is created with `prerelease: true`, so it does **not** become
 - Does not deploy docs or trigger marketing automation (`deploy-docs`, `trigger-marketing-update` guarded).
 - Not offered as an update on **stable channels**:
   - The macOS tray uses GitHub `releases/latest`, which excludes prereleases (`native/macos/MCPProxy/MCPProxy/Services/UpdateService.swift`), plus a semver downgrade guard so an `-rc` is never treated as "newer" than the matching stable.
-  - The backend/tray update check is stable-only by default (`internal/tray/tray.go` → `releases/latest`). Set `MCPPROXY_ALLOW_PRERELEASE_UPDATES=true` to opt in to RC update offers.
+  - The backend/tray update check is stable-only by default (`internal/tray/tray.go` → `releases/latest`). Set `MCPPROXY_ALLOW_PRERELEASE_UPDATES=true` to opt in to RC update offers; the core checker can also opt in via `"update_check": { "channel": "rc" }` in `mcp_config.json` (Spec 079 — the Go tray's own self-update check gates on the core's decision by querying `GET /api/v1/info` rather than reading the config file, and selects prereleases via `MCPPROXY_ALLOW_PRERELEASE_UPDATES`; converging it fully onto the shared checker is FR-001a).
 
 ### Installing an RC