Desktop: download updates in the background and install on quit (parked for upstream #17588) - #40

Why this is a separate, parked PR

This is the desktop half of #5, moved out so #5 is only the server updater. It is parked, not for merge yet. Upstream pingdotgg#17588 ("download updates in the background and install them on quit") does the same thing. When it lands, the fork gets it from the nightly follow and this PR is closed. Keeping it here, not deleted, keeps the reviewed work in case pingdotgg#17588 stalls or is rejected.

Rejected alternatives:

• Keep it in Auto-update: server updates itself when quiet #5. The server and desktop halves share no code. Every Auto-update: server updates itself when quiet #5 rebase and review carried both, and feat(desktop): download updates in the background and install them on quit pingdotgg/t3code#17588 will replace this half anyway.
• Delete it. That would lose three review rounds of work if feat(desktop): download updates in the background and install them on quit pingdotgg/t3code#17588 never merges.

Differences from pingdotgg#17588 (read only, as of 11-06): pingdotgg#17588 has no setting. It is always on, but only Windows and AppImage install at quit; macOS and .deb still need Install. This PR is opt-in ("autoUpdate": true in desktop-settings.json, off by default) and arms install-on-quit on every platform electron-updater supports.

What

• Setting on, update available: after the startup check and each poll check, the update is downloaded. When the download is complete and still offerable, it calls setAutoInstallOnAppQuit(true).
• At quit: a finalizer on the updater's scope runs as the app shuts down, before electron-updater's own quit handler installs.
  • It reads the setting again. If it is now off, or the download is gone, install-on-quit is switched off and nothing installs.
  • Otherwise it writes the same install record the Update button writes. A crash or power cut before a real quit leaves no record, so it is not reported as an install that did not apply.
• An install at quit that did not apply: the app restarts on the old version, and the existing "last update did not apply" check reports it. That version is then not armed again automatically, which prevents a silent loop. The Update button still offers it.
• Turning it off: if the setting is off at a poll, or the update track changes, install-on-quit is switched off.

Failure cases

Hand breaks from the #5 rounds, each turning the tests red: no quit step (2), record written at arm time (5), setting not re-read at quit (1).

Tests

Rebased on fork main with one conflict in DesktopUpdates.ts (the channel change now restores the release floor on error; the disarm stays before it). Desktop typecheck is clean. src/updates + src/app: 235/235 pass, with GH_TOKEN/GITHUB_TOKEN unset and an empty GH_CONFIG_DIR.

Not proven: no real electron-updater download and install-on-quit (that needs a published fork release). A reboot that kills the app during the quit step, after the record but before the install, would still report "did not apply".

General vs project

All general: one desktop setting in the public fork, nothing project-specific.

🤖 Generated with Claude Code