feat: add config opt-out, TTY check, and config-first update flow

- Add auto_update_check config field (defaults to true)
- Load config before update check, skip if auto_update_check is false
- Add TTY check before interactive prompt (skip in non-TTY environments)
- Update config.example.yaml with new option documentation

cmd/kctl-tui/main.go

@@ -83,9 +83,19 @@ func main() {
 		}
 	}
 
+	// Load config early to check auto_update_update and validate.
+	cfgPath, err := config.DefaultPath()
+	if err == nil {
+		cfg, cfgErr := config.Load(cfgPath)
+		if cfgErr != nil {
+			fmt.Fprintf(os.Stderr, "WARNING: failed to load config: %v\n", cfgErr)
+		}
+		if cfgErr == nil && cfg.IsAutoUpdateCheckEnabled() {
 			if checkForUpdateInteractive(verbose) {
 				os.Exit(0)
 			}
+		}
+	}
 
 	m := newFullModel()
 	p := tea.NewProgram(m, tea.WithAltScreen())

cmd/kctl-tui/update.go

@@ -13,6 +13,7 @@ import (
 
 	"github.com/Masterminds/semver/v3"
 	"github.com/creativeprojects/go-selfupdate"
+	"golang.org/x/term"
 )
 
 const (
@@ -88,6 +89,10 @@ func checkForUpdateInteractive(verbose bool) bool {
 		return false
 	}
 
+	if !term.IsTerminal(int(os.Stdin.Fd())) {
+		return false
+	}
+
 	updater, err := initUpdater(verbose)
 	if err != nil {
 		if verbose {

config.example.yaml

@@ -60,3 +60,7 @@ team_label_key: "example.org/team"
 # wraps SSO login in a custom script or needs a specific --profile, e.g.:
 #   aws_sso_login_command: "aws sso login --profile my-profile"
 aws_sso_login_command: "aws sso login"
+
+# Check for updates on startup and prompt to update if a newer version is
+# available. Set to false to disable. Defaults to true if omitted.
+# auto_update_check: true

go.mod

@@ -7,6 +7,7 @@ require (
 	github.com/charmbracelet/bubbles v0.21.1
 	github.com/charmbracelet/bubbletea v1.3.10
 	github.com/creativeprojects/go-selfupdate v1.6.0
+	golang.org/x/term v0.44.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 

internal/config/config.go

@@ -62,6 +62,19 @@ type Config struct {
 	// AWSSSOLoginCommand is run interactively if an AWS auth check fails
 	// before the secrets workflow (e.g. an expired SSO session).
 	AWSSSOLoginCommand string `yaml:"aws_sso_login_command"`
+
+	// AutoUpdateCheck controls whether kctl-tui checks for updates on
+	// startup. Defaults to true when omitted.
+	AutoUpdateCheck *bool `yaml:"auto_update_check"`
+}
+
+// IsAutoUpdateCheckEnabled returns true unless the user has explicitly set
+// auto_update_check to false in their config.
+func (c Config) IsAutoUpdateCheckEnabled() bool {
+	if c.AutoUpdateCheck == nil {
+		return true
+	}
+	return *c.AutoUpdateCheck
 }
 
 // LoginCommand returns the configured AWS SSO login command, falling back