feat: notify when a newer version is available (#333)

**Summary**  
This change introduces a new startup check that notifies users if a
newer `@openai/codex` version is available. To avoid spamming, it writes
a small state file recording the last check time and will only re‑check
once every 24 hours.

**What’s Changed**  
- **New file** `src/utils/check-updates.ts`  
  - Runs `npm outdated --global @openai/codex`  
  - Reads/writes `codex-state.json` under `CONFIG_DIR`  
  - Limits checks to once per day (`UPDATE_CHECK_FREQUENCY = 24h`)  
- Uses `boxen` for a styled alert and `which` to locate the npm binary
- **Hooked into** `src/cli.tsx` entrypoint:
  ```ts
  import { checkForUpdates } from "./utils/check-updates";
  // …
  // after loading config
  await checkForUpdates().catch();
  ```
- **Dependencies**  
  - Added `boxen@^8.0.1`, `which@^5.0.0`, `@types/which@^3.0.4`  
- **Tests**  
  - Vitest suite under `tests/check-updates.test.ts`  
  - Snapshot in `__snapshots__/check-updates.test.ts.snap`  

**Motivation**  
Addresses issue #244. Users running a stale global install will now see
a friendly reminder—at most once per day—to upgrade and enjoy the latest
features.

**Test Plan**  
- `getNPMCommandPath()` resolves npm correctly  
- `checkOutdated()` parses `npm outdated` JSON  
- State file prevents repeat alerts within 24h  
- Boxen snapshot matches expected output  
- No console output when state indicates a recent check  

**Related Issue**  
try resolves #244


**Preview**
Prompt a pnpm‑style alert when outdated  

![outdated‑alert](https://github.com/user-attachments/assets/294dad45-d858-45d1-bf34-55e672ab883a)

Let me know if you’d tweak any of the messaging, throttle frequency,
placement in the startup flow, or anything else.

---------

Co-authored-by: Thibault Sottiaux <tibo@openai.com>

codex-cli/src/utils/check-updates.ts

@@ -0,0 +1,143 @@
+import { CONFIG_DIR } from "./config";
+import boxen from "boxen";
+import chalk from "chalk";
+import * as cp from "node:child_process";
+import { readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import which from "which";
+
+interface UpdateCheckState {
+  lastUpdateCheck?: string;
+}
+
+interface PackageInfo {
+  current: string;
+  wanted: string;
+  latest: string;
+  dependent: string;
+  location: string;
+}
+
+interface UpdateCheckInfo {
+  currentVersion: string;
+  latestVersion: string;
+}
+
+const UPDATE_CHECK_FREQUENCY = 1000 * 60 * 60 * 24; // 1 day
+
+export async function getNPMCommandPath(): Promise<string | undefined> {
+  try {
+    return await which(process.platform === "win32" ? "npm.cmd" : "npm");
+  } catch {
+    return undefined;
+  }
+}
+
+export async function checkOutdated(
+  npmCommandPath: string,
+): Promise<UpdateCheckInfo | undefined> {
+  return new Promise((resolve, _reject) => {
+    // TODO: support local installation
+    // Right now we're using "--global", which only checks global packages.
+    // But codex might be installed locally — we should check the local version first,
+    // and only fall back to the global one if needed.
+    const args = ["outdated", "--global", "--json", "--", "@openai/codex"];
+    // corepack npm wrapper would automatically update package.json. disable that behavior.
+    // COREPACK_ENABLE_AUTO_PIN disables the package.json overwrite, and
+    // COREPACK_ENABLE_PROJECT_SPEC makes the npm view command succeed
+    //   even if packageManager specified a package manager other than npm.
+    const env = {
+      ...process.env,
+      COREPACK_ENABLE_AUTO_PIN: "0",
+      COREPACK_ENABLE_PROJECT_SPEC: "0",
+    };
+    let options: cp.ExecFileOptions = { env };
+    let commandPath = npmCommandPath;
+    if (process.platform === "win32") {
+      options = { ...options, shell: true };
+      commandPath = `"${npmCommandPath}"`;
+    }
+    cp.execFile(commandPath, args, options, async (_error, stdout) => {
+      try {
+        const { name: packageName } = await import("../../package.json");
+        const content: Record<string, PackageInfo> = JSON.parse(stdout);
+        if (!content[packageName]) {
+          // package not installed or not outdated
+          resolve(undefined);
+          return;
+        }
+
+        const currentVersion = content[packageName].current;
+        const latestVersion = content[packageName].latest;
+
+        resolve({ currentVersion, latestVersion });
+        return;
+      } catch {
+        // ignore
+      }
+      resolve(undefined);
+    });
+  });
+}
+
+export async function checkForUpdates(): Promise<void> {
+  const stateFile = join(CONFIG_DIR, "update-check.json");
+  let state: UpdateCheckState | undefined;
+  try {
+    state = JSON.parse(await readFile(stateFile, "utf8"));
+  } catch {
+    // ignore
+  }
+
+  if (
+    state?.lastUpdateCheck &&
+    Date.now() - new Date(state.lastUpdateCheck).valueOf() <
+      UPDATE_CHECK_FREQUENCY
+  ) {
+    return;
+  }
+
+  const npmCommandPath = await getNPMCommandPath();
+  if (!npmCommandPath) {
+    return;
+  }
+
+  const packageInfo = await checkOutdated(npmCommandPath);
+
+  await writeState(stateFile, {
+    ...state,
+    lastUpdateCheck: new Date().toUTCString(),
+  });
+
+  if (!packageInfo) {
+    return;
+  }
+
+  const updateMessage = `To update, run: ${chalk.cyan(
+    "npm install -g @openai/codex",
+  )} to update.`;
+
+  const box = boxen(
+    `\
+Update available! ${chalk.red(packageInfo.currentVersion)} → ${chalk.green(
+      packageInfo.latestVersion,
+    )}.
+${updateMessage}`,
+    {
+      padding: 1,
+      margin: 1,
+      align: "center",
+      borderColor: "yellow",
+      borderStyle: "round",
+    },
+  );
+
+  // eslint-disable-next-line no-console
+  console.log(box);
+}
+
+async function writeState(stateFilePath: string, state: UpdateCheckState) {
+  await writeFile(stateFilePath, JSON.stringify(state, null, 2), {
+    encoding: "utf8",
+  });
+}