desktop: in-app updates, two channels, signed, fed by fixed-tag releases

There was no in-place update anywhere. The app never checked, downloaded or
applied anything, and the only published release predates the whole sync arc —
so `install.sh` would hand out a build with no sync in it. Installing from
per-run CI artifacts, which is what's been happening, is not something an
updater can point at: ephemeral, auth-gated, no stable URL.

Two channels, switchable in the app: `stable` follows tagged releases, `dev`
follows every green push.

The feed is a Fabled-Git release asset, not a ThoughtSync server route. This
reverses the lean recorded in task 1998, and the reason matters — a
server-hosted feed can only reach a desktop that has linked a server, and
local-first-with-no-server is the whole premise. An unlinked install has to be
able to update itself.

Each channel reads a `latest.json` on a release whose TAG NEVER MOVES.
That's forced, not stylistic: Forgejo has no /releases/latest/download/<asset>
route (verified — it 404s with no redirect), so "newest" cannot be named in a
URL. `dev` carries the rolling bundles; `stable` is a pointer release holding
only the manifest, whose URLs aim at the versioned release's assets, so nothing
is duplicated.

The manifest is written by a third job that runs after both bundle jobs. They
build in separate workspaces and neither can see the other's output, but one
manifest has to describe both platforms — generating it inside either job would
silently omit the other, and a missing platform reads to a user as "no update
available" rather than as a broken feed. It reads what actually landed on the
release, so it can never advertise a bundle that failed to upload.

Signing is gated on the secret existing, in the script rather than an `if:`
(the secrets context isn't reliably available to step conditions). No key means
no updater artifacts and no publish: a feed the app would refuse to verify is
worse than no feed, because it looks like it works. CI stays green until the
key lands.

On Linux the updater can only replace an AppImage — a deb or pacman install is
owned by its package manager and must never be overwritten underneath it. The
app detects that case up front and says so, instead of failing halfway through
with a permissions error nobody can read.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SreJkbxB4gx8pPsu8QbLPi

desktop/src-tauri/src/update.rs

@@ -0,0 +1,274 @@
+//! In-app updates (M10.9).
+//!
+//! Two channels, because two audiences: `stable` follows tagged `v*` releases,
+//! `dev` follows every green push. Each reads a `latest.json` published as an asset
+//! on a release whose TAG NEVER CHANGES — verified necessary, because Forgejo has no
+//! `/releases/latest/download/<asset>` route (it 404s), so "newest" cannot be named
+//! in a URL. A fixed tag can.
+//!
+//! The feed lives on Fabled-Git rather than on a ThoughtSync server, deliberately:
+//! this app is usable having never linked a server, and an install that can't reach
+//! its own updates because it isn't paired with anything would contradict the whole
+//! local-first premise.
+//!
+//! Updates are signed. The public half is baked into `tauri.conf.json`; the private
+//! half exists only as a CI secret, and is generated by the operator — a release
+//! signing key that has passed through anyone else's hands is not a signing key.
+
+use serde::{Deserialize, Serialize};
+use tauri::State;
+use tauri_plugin_updater::UpdaterExt;
+
+use crate::local::{store, Db};
+
+/// Where the manifests live. Fixed tags, so these URLs are permanent.
+const FEED_BASE: &str = "https://git.fabledsword.com/bvandeusen/thoughtsync/releases/download";
+
+const CHANNEL_PREF: &str = "update_channel";
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum Channel {
+    Stable,
+    Dev,
+}
+
+impl Channel {
+    fn as_str(self) -> &'static str {
+        match self {
+            Channel::Stable => "stable",
+            Channel::Dev => "dev",
+        }
+    }
+
+    /// Anything unrecognized reads as `stable`. A corrupted or hand-edited value
+    /// must not silently opt someone into pre-release builds.
+    fn parse(raw: &str) -> Self {
+        match raw.trim() {
+            "dev" => Channel::Dev,
+            _ => Channel::Stable,
+        }
+    }
+
+    fn feed_url(self) -> String {
+        format!("{FEED_BASE}/{}/latest.json", self.as_str())
+    }
+}
+
+/// What the UI needs to describe the update situation without a second call.
+#[derive(Debug, Serialize)]
+pub struct UpdateStatus {
+    pub channel: Channel,
+    pub current_version: String,
+    /// The newer version on offer, or `None` when already up to date.
+    pub available: Option<String>,
+    pub notes: Option<String>,
+    /// False when this install can't apply an update to itself (see
+    /// `self_update_blocker`). The UI must not offer a button that cannot work.
+    pub can_install: bool,
+    /// Why not, in words meant for the person reading them.
+    pub blocked_reason: Option<String>,
+}
+
+/// Whether this install can replace itself, and if not, why.
+///
+/// The updater rewrites the running bundle in place, which only works for formats
+/// that ARE a single self-contained file. On Linux that means the AppImage and
+/// nothing else: a `.deb` or pacman install is owned by the package manager, and
+/// silently overwriting files it tracks would corrupt its database. Tauri detects
+/// the AppImage case by the `APPIMAGE` env var the runtime sets.
+fn self_update_blocker() -> Option<String> {
+    if cfg!(target_os = "linux") && std::env::var_os("APPIMAGE").is_none() {
+        return Some(
+            "This copy was installed by your package manager, so it updates the same \
+             way — `apt upgrade`, `pacman -Syu`, or re-running the install script. \
+             In-app updates work on the AppImage build."
+                .to_string(),
+        );
+    }
+    None
+}
+
+fn read_channel(db: &State<'_, Db>) -> Result<Channel, String> {
+    let conn = db.0.lock().map_err(|e| e.to_string())?;
+    let raw = store::pref(&conn, CHANNEL_PREF).map_err(|e| e.to_string())?;
+    Ok(raw.as_deref().map(Channel::parse).unwrap_or(Channel::Stable))
+}
+
+#[tauri::command]
+pub fn update_channel_get(db: State<'_, Db>) -> Result<Channel, String> {
+    read_channel(&db)
+}
+
+#[tauri::command]
+pub fn update_channel_set(channel: Channel, db: State<'_, Db>) -> Result<Channel, String> {
+    let conn = db.0.lock().map_err(|e| e.to_string())?;
+    store::set_pref(&conn, CHANNEL_PREF, channel.as_str()).map_err(|e| e.to_string())?;
+    log::info!("update channel set to {}", channel.as_str());
+    Ok(channel)
+}
+
+/// Ask the feed whether there's something newer. Never installs anything.
+#[tauri::command]
+pub async fn update_check(
+    app: tauri::AppHandle,
+    db: State<'_, Db>,
+) -> Result<UpdateStatus, String> {
+    let channel = read_channel(&db)?;
+    let current_version = app.package_info().version.to_string();
+    let blocked_reason = self_update_blocker();
+
+    let url = channel
+        .feed_url()
+        .parse()
+        .map_err(|e| format!("the update feed address is malformed: {e}"))?;
+    let updater = app
+        .updater_builder()
+        .endpoints(vec![url])
+        .map_err(|e| e.to_string())?
+        .build()
+        .map_err(|e| format!("updates aren't configured for this build: {e}"))?;
+
+    // A missing manifest is the ordinary state of a channel nobody has published to
+    // yet — report it as "nothing available" rather than as a failure to act on.
+    // Matched on the message rather than an error variant so this doesn't break on a
+    // plugin minor that renames one.
+    let found = match updater.check().await {
+        Ok(found) => found,
+        Err(e) => {
+            let detail = e.to_string();
+            if is_missing_manifest(&detail) {
+                None
+            } else {
+                return Err(describe_check_error(&detail));
+            }
+        }
+    };
+
+    Ok(UpdateStatus {
+        channel,
+        current_version,
+        available: found.as_ref().map(|u| u.version.clone()),
+        notes: found.as_ref().and_then(|u| u.body.clone()),
+        can_install: found.is_some() && blocked_reason.is_none(),
+        blocked_reason,
+    })
+}
+
+/// Download, verify and apply the update, then relaunch.
+///
+/// Refuses up front on an install that can't replace itself, rather than failing
+/// halfway through with a permissions error nobody can interpret.
+#[tauri::command]
+pub async fn update_install(app: tauri::AppHandle, db: State<'_, Db>) -> Result<(), String> {
+    if let Some(reason) = self_update_blocker() {
+        return Err(reason);
+    }
+    let channel = read_channel(&db)?;
+    let url = channel
+        .feed_url()
+        .parse()
+        .map_err(|e| format!("the update feed address is malformed: {e}"))?;
+    let updater = app
+        .updater_builder()
+        .endpoints(vec![url])
+        .map_err(|e| e.to_string())?
+        .build()
+        .map_err(|e| format!("updates aren't configured for this build: {e}"))?;
+
+    let found = updater
+        .check()
+        .await
+        .map_err(|e| describe_check_error(&e.to_string()))?;
+    let Some(update) = found else {
+        return Err("There's no update to install — this is already the newest build.".to_string());
+    };
+
+    log::info!(
+        "installing update {} over {} ({} channel)",
+        update.version,
+        app.package_info().version,
+        channel.as_str()
+    );
+    update
+        .download_and_install(|_chunk, _total| {}, || {})
+        .await
+        .map_err(|e| format!("the update couldn't be installed: {e}"))?;
+
+    // Only reached if the install succeeded. `restart` diverges, so it's the tail.
+    log::info!("update installed; restarting");
+    app.restart()
+}
+
+/// Whether a check failure just means "this channel has nothing published yet".
+fn is_missing_manifest(detail: &str) -> bool {
+    let lower = detail.to_lowercase();
+    lower.contains("404") || lower.contains("not found")
+}
+
+/// Turn a check failure into something worth reading. The default rendering of a
+/// transport error names the URL and nothing else, which tells a user nothing about
+/// what they could do next.
+fn describe_check_error(detail: &str) -> String {
+    let lower = detail.to_lowercase();
+    if lower.contains("error sending request") || lower.contains("dns") || lower.contains("connect")
+    {
+        return "Couldn't reach the update server — check your connection.".to_string();
+    }
+    format!("Couldn't check for updates: {detail}")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn each_channel_has_its_own_fixed_feed() {
+        assert!(Channel::Stable.feed_url().ends_with("/stable/latest.json"));
+        assert!(Channel::Dev.feed_url().ends_with("/dev/latest.json"));
+        assert_ne!(Channel::Stable.feed_url(), Channel::Dev.feed_url());
+    }
+
+    #[test]
+    fn the_feed_is_https() {
+        // The manifest names the URL and signature of a binary that is about to
+        // replace this one. The signature is what actually protects it, but there's
+        // no reason to hand an attacker the manifest to tamper with in the first place.
+        assert!(Channel::Stable.feed_url().starts_with("https://"));
+        assert!(Channel::Dev.feed_url().starts_with("https://"));
+    }
+
+    #[test]
+    fn an_unknown_channel_falls_back_to_stable() {
+        // A corrupted or hand-edited pref must never silently opt someone into
+        // pre-release builds — the safe default is the conservative one.
+        assert_eq!(Channel::parse("dev"), Channel::Dev);
+        assert_eq!(Channel::parse("stable"), Channel::Stable);
+        assert_eq!(Channel::parse("nightly"), Channel::Stable);
+        assert_eq!(Channel::parse(""), Channel::Stable);
+    }
+
+    #[test]
+    fn an_unpublished_channel_is_not_reported_as_a_failure() {
+        // Before the first publish, or on a channel nobody uses, the feed simply
+        // isn't there. That's "you're up to date", not something to alarm anyone with.
+        assert!(is_missing_manifest("http status: 404 Not Found"));
+        assert!(is_missing_manifest("Release Not Found"));
+        assert!(!is_missing_manifest("invalid signature"));
+    }
+
+    #[test]
+    fn an_unreachable_server_reads_as_a_connection_problem() {
+        let msg = describe_check_error("error sending request for url (https://…)");
+        assert!(msg.contains("connection"), "got {msg}");
+        // Anything unrecognized still surfaces its detail rather than being swallowed.
+        assert!(describe_check_error("invalid signature").contains("invalid signature"));
+    }
+
+    #[test]
+    fn the_channel_name_round_trips() {
+        for channel in [Channel::Stable, Channel::Dev] {
+            assert_eq!(Channel::parse(channel.as_str()), channel);
+        }
+    }
+}