fix(desktop): replace a stale staged update with the newest release

Author: waleedlatif1

apps/desktop/README.md

@@ -172,7 +172,7 @@ Raw local file bytes are never exposed through the preload bridge and cannot be
 
 ## Auto-update, channels, rollout, rollback
 
-- `electron-updater` reads the deployment's `/api/desktop/update` feed; production resolves stable releases from `simstudioai/sim`, while dev/staging resolve prereleases from `simstudioai/sim-desktop-releases`. Artifact downloads go directly to GitHub and deltas use `.zip.blockmap`. Sim validates every candidate before starting its download. Developer ID builds installed under `/Applications` use a prompt (Restart and update / Later; Later installs on quit); other packaged builds offer a validated installer download — never forced mid-session.
+- `electron-updater` reads the deployment's `/api/desktop/update` feed; production resolves stable releases from `simstudioai/sim`, while dev/staging resolve prereleases from `simstudioai/sim-desktop-releases`. Artifact downloads go directly to GitHub and deltas use `.zip.blockmap`. Sim validates every candidate before starting its download. Developer ID builds installed under `/Applications` use a prompt (Restart and update / Later; Later installs on quit); other packaged builds offer a validated installer download — never forced mid-session. A staged or offered update keeps being re-checked on the normal cadence, and a newer release replaces it, so a shell left running across several releases installs the latest build in one restart instead of the stale one followed by another prompt.
 - Streams: production follows stable `X.Y.Z` releases, dev follows `-dev.N`, and staging follows `-staging.N`. The feed still recognizes legacy `-alpha.N`/`-beta.N` releases during migration.
 - Staged rollout: after publishing, edit `stagingPercentage: 10` into the release's `latest-mac.yml`, then raise as crash metrics stay clean.
 - Rollback: a pulled release must be superseded by a **higher** version — users on the broken build will not reinstall an equal one. (A blocked-versions kill-switch was removed as unwired dead code; reintroduce it in `updater.ts` if a remote config source ever exists to feed it.)

apps/desktop/src/main/updater.test.ts

@@ -445,6 +445,118 @@ describe('initUpdater state machine', () => {
     })
   })
 
+  it('replaces a staged update with a newer release instead of installing the stale build', async () => {
+    const { handle, states } = await createUpdater()
+    handle.check()
+    await vi.advanceTimersByTimeAsync(0)
+    emit('update-available', { version: '2.0.0' })
+    emit('update-downloaded', { version: '2.0.0' })
+    expect(handle.getState()).toEqual({ status: 'ready', version: '2.0.0' })
+    states.length = 0
+
+    await vi.advanceTimersByTimeAsync(10_000)
+    expect(autoUpdaterMock.checkForUpdates).toHaveBeenCalledTimes(2)
+    emit('checking-for-update')
+    emit('update-available', { version: '2.1.0' })
+    emit('download-progress', { percent: 50 })
+    expect(autoUpdaterMock.downloadUpdate).toHaveBeenCalledTimes(2)
+    expect(handle.getState()).toEqual({ status: 'ready', version: '2.0.0' })
+
+    await vi.advanceTimersByTimeAsync(30 * 60 * 1000)
+    expect(autoUpdaterMock.checkForUpdates).toHaveBeenCalledTimes(2)
+
+    emit('update-downloaded', { version: '2.1.0' })
+    expect(states).toEqual([{ status: 'ready', version: '2.1.0' }])
+    expect(autoUpdaterMock.autoInstallOnAppQuit).toBe(true)
+    expect(events.record).toHaveBeenCalledWith('update_downloaded', { version: '2.1.0' })
+  })
+
+  it('keeps a staged update when a background re-check finds nothing newer or fails', async () => {
+    const { handle, states } = await createUpdater()
+    handle.check()
+    await vi.advanceTimersByTimeAsync(0)
+    emit('update-available', { version: '2.0.0' })
+    emit('update-downloaded', { version: '2.0.0' })
+    states.length = 0
+
+    await vi.advanceTimersByTimeAsync(10_000)
+    emit('update-available', { version: '2.0.0' })
+    await vi.advanceTimersByTimeAsync(30 * 60 * 1000 - 10_000)
+    emit('update-not-available')
+    await vi.advanceTimersByTimeAsync(30 * 60 * 1000)
+    emit('error', new Error('net::ERR_NETWORK_CHANGED'))
+    await vi.advanceTimersByTimeAsync(30 * 60 * 1000)
+    emit('update-available', { version: '2.1.0' })
+    emit('error', new Error('download interrupted'))
+    await vi.advanceTimersByTimeAsync(0)
+
+    expect(autoUpdaterMock.checkForUpdates).toHaveBeenCalledTimes(5)
+    expect(autoUpdaterMock.downloadUpdate).toHaveBeenCalledTimes(2)
+    expect(states).toEqual([])
+    expect(handle.getState()).toEqual({ status: 'ready', version: '2.0.0' })
+    expect(autoUpdaterMock.autoInstallOnAppQuit).toBe(true)
+  })
+
+  it('does not replace a staged update when background downloads are disabled', async () => {
+    const { handle } = await createUpdater()
+    handle.check()
+    await vi.advanceTimersByTimeAsync(0)
+    emit('update-available', { version: '2.0.0' })
+    emit('update-downloaded', { version: '2.0.0' })
+    handle.setAutoDownload(false)
+
+    await vi.advanceTimersByTimeAsync(10_000)
+    emit('update-available', { version: '2.1.0' })
+
+    expect(autoUpdaterMock.downloadUpdate).toHaveBeenCalledTimes(1)
+    expect(handle.getState()).toEqual({ status: 'ready', version: '2.0.0' })
+  })
+
+  it('installs a replacement that finished staging while the restart prompt was open', async () => {
+    let resolveConfirmation: (result: { response: number; checkboxChecked: boolean }) => void =
+      () => {
+        throw new Error('Restart confirmation did not initialize')
+      }
+    const { handle } = await createUpdater()
+    handle.check()
+    await vi.advanceTimersByTimeAsync(0)
+    emit('update-available', { version: '2.0.0' })
+    emit('update-downloaded', { version: '2.0.0' })
+    await vi.advanceTimersByTimeAsync(10_000)
+    emit('update-available', { version: '2.1.0' })
+
+    vi.mocked(dialog.showMessageBox).mockImplementationOnce(
+      () =>
+        new Promise((resolve) => {
+          resolveConfirmation = resolve
+        })
+    )
+    handle.install()
+    emit('update-downloaded', { version: '2.1.0' })
+    resolveConfirmation({ response: 1, checkboxChecked: false })
+    await vi.advanceTimersByTimeAsync(0)
+
+    expect(autoUpdaterMock.quitAndInstall).toHaveBeenCalledTimes(1)
+  })
+
+  it('refreshes an offered update to a newer release before it is downloaded', async () => {
+    const { handle } = await createUpdater({ autoDownload: false })
+    handle.check()
+    await vi.advanceTimersByTimeAsync(0)
+    emit('update-available', { version: '2.0.0' })
+    expect(handle.getState()).toEqual({ status: 'available', version: '2.0.0' })
+
+    await vi.advanceTimersByTimeAsync(10_000)
+    emit('checking-for-update')
+    emit('error', new Error('net::ERR_INTERNET_DISCONNECTED'))
+    expect(handle.getState()).toEqual({ status: 'available', version: '2.0.0' })
+
+    await vi.advanceTimersByTimeAsync(30 * 60 * 1000 - 10_000)
+    emit('update-available', { version: '2.1.0' })
+    expect(handle.getState()).toEqual({ status: 'available', version: '2.1.0' })
+    expect(autoUpdaterMock.downloadUpdate).not.toHaveBeenCalled()
+  })
+
   it('checks from idle and ignores re-entrant checks while busy', async () => {
     const { handle } = await createUpdater()
     handle.check()
@@ -1035,6 +1147,31 @@ describe('initUpdater manual mode (no Developer ID signature)', () => {
     expect(handle.getState()).toEqual({ status: 'error', manual: true })
   })
 
+  it('replaces an offered manual download with a newer release', async () => {
+    let feedVersion: string | null = '2.0.0'
+    const fetchManifest = vi.fn(async () => {
+      if (feedVersion === null) throw new Error('network down')
+      return manifest(feedVersion)
+    })
+    const { handle } = await createManualUpdater(fetchManifest)
+    handle.check()
+    await vi.advanceTimersByTimeAsync(0)
+    expect(handle.getState()).toEqual({ status: 'available', version: '2.0.0', manual: true })
+
+    feedVersion = null
+    await vi.advanceTimersByTimeAsync(10_000)
+    expect(handle.getState()).toEqual({ status: 'available', version: '2.0.0', manual: true })
+
+    feedVersion = '2.1.0'
+    await vi.advanceTimersByTimeAsync(30 * 60 * 1000)
+    expect(handle.getState()).toEqual({ status: 'available', version: '2.1.0', manual: true })
+
+    handle.install()
+    expect(shell.openExternal).toHaveBeenCalledWith(
+      'https://github.com/simstudioai/sim/releases/download/v2.1.0/Sim-2.1.0-universal.dmg'
+    )
+  })
+
   it('checks on the scheduled interval', async () => {
     const fetchManifest = vi.fn(async () => manifest('9.9.9'))
     await createManualUpdater(fetchManifest)

apps/desktop/src/main/updater.ts

@@ -395,13 +395,17 @@ export function initUpdater(deps: UpdaterDeps): UpdaterHandle {
     let installInFlight = false
     let installConfirmationInFlight = false
 
-    const quitAndInstall = (version: string | undefined) => {
+    /**
+     * Squirrel installs whatever it has staged when the process exits, so a
+     * newer build that replaced the staged one mid-confirmation still installs.
+     */
+    const quitAndInstall = () => {
       if (installInFlight) return
       installInFlight = true
       void Promise.resolve()
         .then(() => deps.beforeInstall?.())
         .then(() => {
-          if (state.status !== 'ready' || state.version !== version) {
+          if (state.status !== 'ready') {
             autoUpdater.autoInstallOnAppQuit = false
             installInFlight = false
             return
@@ -438,8 +442,8 @@ export function initUpdater(deps: UpdaterDeps): UpdaterHandle {
       const confirmation = win ? showShellDialog(win, options) : showShellDialog(options)
       void confirmation
         .then(({ response }) => {
-          if (response === 1 && state.status === 'ready' && state.version === version) {
-            quitAndInstall(version)
+          if (response === 1 && state.status === 'ready') {
+            quitAndInstall()
           }
         })
         .catch((error) => {
@@ -459,8 +463,20 @@ export function initUpdater(deps: UpdaterDeps): UpdaterHandle {
     let nextUpdaterCheckId = 0
     let updaterCheckTimeout: ReturnType<typeof setTimeout> | null = null
     let updaterRequestId: number | null = null
+    /**
+     * The validated version whose download is in flight. While `ready`, a
+     * non-null value means a newer build is replacing the staged one.
+     */
     let acceptedUpdateVersion: string | null = null
 
+    /**
+     * A staged (`ready`) or offered (`available`) update keeps being re-checked
+     * in the background so a newer release replaces it. Without this, a shell
+     * left running across several releases installs the stale build on
+     * restart and immediately offers the next one.
+     */
+    const isRefreshingOffer = () => state.status === 'ready' || state.status === 'available'
+
     const finishProbe = (probeId: number) => {
       if (activeProbeId !== probeId) return
       activeProbeId = null
@@ -479,7 +495,7 @@ export function initUpdater(deps: UpdaterDeps): UpdaterHandle {
     }
 
     autoUpdater.on('checking-for-update', () => {
-      if (activeUpdaterCheckId === null) return
+      if (activeUpdaterCheckId === null || isRefreshingOffer()) return
       setState({ status: 'checking' })
     })
 
@@ -488,6 +504,8 @@ export function initUpdater(deps: UpdaterDeps): UpdaterHandle {
       if (checkId === null) return
       finishUpdaterCheck(checkId)
       if (updaterRequestId === checkId) updaterRequestId = null
+      // A staged bundle is already armed in Squirrel and cannot be withdrawn.
+      if (state.status === 'ready') return
       setState({ status: 'idle' })
     })
 
@@ -501,6 +519,28 @@ export function initUpdater(deps: UpdaterDeps): UpdaterHandle {
         !originFeedConfigured ||
         (info.files.length > 0 &&
           info.files.every((file) => isReleaseAssetUrl(file.url, info.version, channel)))
+      if (state.status === 'ready' || state.status === 'available') {
+        const offeredVersion = state.version ?? currentVersion
+        if (
+          !validOriginAssets ||
+          !isValidUpdateCandidate(info.version, currentVersion) ||
+          !isNewerVersion(info.version, offeredVersion)
+        ) {
+          return
+        }
+        if (state.status === 'ready') {
+          if (!autoDownloadEnabled) return
+          acceptedUpdateVersion = info.version
+          deps.events.record('update_check', { available: info.version, replacing: offeredVersion })
+          void autoUpdater.downloadUpdate().catch((error) => {
+            if (acceptedUpdateVersion === info.version) acceptedUpdateVersion = null
+            logger.warn('Replacement update download failed; keeping the staged update', {
+              message: getErrorMessage(error, 'unknown'),
+            })
+          })
+          return
+        }
+      }
       if (!isValidUpdateCandidate(info.version, currentVersion) || !validOriginAssets) {
         acceptedUpdateVersion = null
         autoUpdater.autoInstallOnAppQuit = false
@@ -536,7 +576,11 @@ export function initUpdater(deps: UpdaterDeps): UpdaterHandle {
     })
 
     autoUpdater.on('update-downloaded', (info) => {
-      if (state.status !== 'downloading') return
+      if (state.status === 'ready') {
+        if (acceptedUpdateVersion !== info.version) return
+      } else if (state.status !== 'downloading') {
+        return
+      }
       if (
         acceptedUpdateVersion !== info.version ||
         !isValidUpdateCandidate(info.version, currentVersion)
@@ -558,6 +602,16 @@ export function initUpdater(deps: UpdaterDeps): UpdaterHandle {
       if (checkId !== null) {
         finishUpdaterCheck(checkId)
         if (updaterRequestId === checkId) updaterRequestId = null
+        if (isRefreshingOffer() && !installInFlight) {
+          logger.warn('Background update re-check failed; keeping the current update', {
+            message: getErrorMessage(error, 'unknown'),
+          })
+          return
+        }
+      } else if (state.status === 'ready' && acceptedUpdateVersion !== null && !installInFlight) {
+        acceptedUpdateVersion = null
+        deps.events.record('update_error', { message: getErrorMessage(error, 'unknown') })
+        return
       } else if (state.status !== 'downloading' && state.status !== 'ready' && !installInFlight) {
         return
       }
@@ -660,12 +714,21 @@ export function initUpdater(deps: UpdaterDeps): UpdaterHandle {
         if (
           activeProbeId !== null ||
           activeUpdaterCheckId !== null ||
-          state.status === 'available' ||
-          state.status === 'downloading' ||
-          state.status === 'ready'
+          state.status === 'downloading'
         ) {
           return
         }
+        if (isRefreshingOffer()) {
+          const replacementInFlight = state.status === 'ready' && acceptedUpdateVersion !== null
+          if (
+            interactive ||
+            installInFlight ||
+            installConfirmationInFlight ||
+            replacementInFlight
+          ) {
+            return
+          }
+        }
         if (interactive) {
           setState({ status: 'checking' })
         }
@@ -726,28 +789,38 @@ export function initUpdater(deps: UpdaterDeps): UpdaterHandle {
     let nextCheckId = 0
     let checkTimeout: ReturnType<typeof setTimeout> | null = null
 
+    /**
+     * An offered download keeps being re-checked in the background, and only a
+     * strictly newer release with a usable asset replaces it; failures and
+     * equal versions leave the current offer untouched.
+     */
     const doCheck = async () => {
-      if (activeCheckId !== null || state.status === 'available') return
+      if (activeCheckId !== null) return
+      const offeredVersion = state.status === 'available' ? state.version : undefined
+      const refreshing = offeredVersion !== undefined
       const checkId = ++nextCheckId
       activeCheckId = checkId
-      downloadUrl = null
-      setState({ status: 'checking', manual: true })
+      if (!refreshing) {
+        downloadUrl = null
+        setState({ status: 'checking', manual: true })
+      }
       checkTimeout = setTimeout(() => {
         if (activeCheckId !== checkId) return
         activeCheckId = null
         checkTimeout = null
         deps.events.record('update_error', { message: 'Manual update check timed out' })
-        setState({ status: 'error', manual: true })
+        if (!refreshing) setState({ status: 'error', manual: true })
       }, UPDATE_CHECK_TIMEOUT_MS)
       try {
         const feedUrl = feedUrlForOrigin(deps.appOrigin())
         const manifest = feedUrl ? await fetchManifest(`${feedUrl}/latest-mac.yml`) : null
         if (activeCheckId !== checkId) return
         const version = manifest ? (/^version:\s*(\S+)\s*$/m.exec(manifest)?.[1] ?? null) : null
         if (!manifest || !version || !isValidUpdateCandidate(version, currentVersion)) {
-          setState({ status: 'idle', manual: true })
+          if (!refreshing) setState({ status: 'idle', manual: true })
           return
         }
+        if (refreshing && !isNewerVersion(version, offeredVersion)) return
         // The feed rewrites manifest urls to absolute GitHub asset URLs;
         // prefer the dmg for a human download.
         //
@@ -759,12 +832,12 @@ export function initUpdater(deps: UpdaterDeps): UpdaterHandle {
           manifest.matchAll(/^\s*(?:-\s*)?url:\s*(\S+)\s*$/gm),
           (m) => m[1]
         ).filter((url) => isReleaseAssetUrl(url, version, resolveUpdateChannel(currentVersion)))
-        downloadUrl =
+        const nextDownloadUrl =
           urls.find((url) => url.endsWith('.dmg')) ??
           urls.find((url) => url.endsWith('.zip')) ??
           urls[0] ??
           null
-        if (!downloadUrl) {
+        if (!nextDownloadUrl) {
           // 'error', not 'idle': a newer version demonstrably exists and cannot
           // be offered, so "Sim is up to date" would strand a user whose shell
           // the server's minimum-version gate is already blocking.
@@ -773,15 +846,16 @@ export function initUpdater(deps: UpdaterDeps): UpdaterHandle {
             candidates: urls.length,
           })
           deps.events.record('update_blocked_version', { version, reason: 'unusable-url' })
-          setState({ status: 'error', version: state.version, manual: true })
+          if (!refreshing) setState({ status: 'error', version: state.version, manual: true })
           return
         }
+        downloadUrl = nextDownloadUrl
         deps.events.record('update_check', { available: version, manual: true })
         setState({ status: 'available', version, manual: true })
       } catch (error) {
         if (activeCheckId !== checkId) return
         logger.warn('Manual update check failed', { message: getErrorMessage(error, 'unknown') })
-        setState({ status: 'error', version: state.version, manual: true })
+        if (!refreshing) setState({ status: 'error', version: state.version, manual: true })
       } finally {
         if (activeCheckId === checkId) {
           activeCheckId = null