Always install the newest eligible desktop update (#2149)

* Reapply "Always revalidate desktop updates before install"

This reverts commit 623c05aa4d.

* fix(desktop): make update revalidation safe on quit

Updater-triggered quits now bypass normal quit handling, and manifest revalidation gives up after five seconds without allowing a late install.

* fix(desktop): preserve fail-closed update installs

Keep cached updates deferred when quit-time validation is offline, and report validation timeouts separately from superseded releases.

* fix(desktop): preserve updater quit behavior

Automatic installs remain silent without relaunching, updater handoff is bounded, and background preparation failures remain visible without pinning manifest checks.

* fix(desktop): keep AppImage updates manual

Preserve the AppImage safety exemption by skipping ordinary quit-time installation while retaining the explicit Update now path.

* fix(desktop): serialize update preparation

* fix(desktop): recognize macOS updater quit handoff

packages/desktop/src/daemon/quit-lifecycle.ts

@@ -14,6 +14,16 @@ interface BeforeQuitApp {
   exit(code: number): void;
 }
 
+interface QuitLifecycle {
+  handleBeforeQuit(event: BeforeQuitEvent): void;
+  handleBeforeQuitForUpdate(): void;
+}
+
+interface DeferredUpdateQuit {
+  promise: Promise<boolean>;
+  resolve(): void;
+}
+
 export interface StopOnQuitDeps {
   settingsStore: Pick<DesktopSettingsStore, "get">;
   isDesktopManagedDaemonRunning: () => boolean;
@@ -42,36 +52,95 @@ export async function stopDesktopManagedDaemonOnQuitIfNeeded(
   return true;
 }
 
-export function createBeforeQuitHandler({
+function waitForUpdateDeadline(signal: AbortSignal): Promise<boolean> {
+  if (signal.aborted) {
+    return Promise.resolve(false);
+  }
+
+  return new Promise((resolve) => {
+    signal.addEventListener("abort", () => resolve(false), { once: true });
+  });
+}
+
+function createDeferredUpdateQuit(): DeferredUpdateQuit {
+  let resolvePromise!: (started: boolean) => void;
+  const promise = new Promise<boolean>((resolve) => {
+    resolvePromise = resolve;
+  });
+  return { promise, resolve: () => resolvePromise(true) };
+}
+
+export function createQuitLifecycle({
   app,
   closeTransportSessions,
   stopDesktopManagedDaemonIfNeeded,
+  installAppUpdateOnQuit,
+  createUpdateDeadlineSignal,
   onStopError,
+  onUpdateError,
 }: {
   app: BeforeQuitApp;
   closeTransportSessions: () => void;
   stopDesktopManagedDaemonIfNeeded: () => Promise<boolean>;
+  installAppUpdateOnQuit: (signal: AbortSignal) => Promise<boolean>;
+  createUpdateDeadlineSignal: () => AbortSignal;
   onStopError: (error: unknown) => void;
-}): (event: BeforeQuitEvent) => void {
-  // We always preventDefault on first quit so we can run the async stop
-  // decision, then call app.exit(0) — which bypasses Electron's
-  // close → window-all-closed → will-quit chain. The window-all-closed
-  // listener is a darwin no-op (macOS convention) and would otherwise
-  // veto a re-fired app.quit().
+  onUpdateError: (error: unknown) => void;
+}): QuitLifecycle {
+  // The first quit waits for daemon shutdown and update revalidation. A validated
+  // update re-fires app.quit(); otherwise app.exit(0) bypasses Electron's macOS
+  // window-all-closed handler, which would veto that second quit.
   let quitting = false;
+  let quittingForUpdate = false;
+  const updateQuit = createDeferredUpdateQuit();
 
-  return (event) => {
+  function handleBeforeQuit(event: BeforeQuitEvent): void {
     closeTransportSessions();
-    if (quitting) return;
+    if (quittingForUpdate) return;
+    if (quitting) {
+      // MacUpdater's no-relaunch path calls app.quit() without emitting
+      // before-quit-for-update. A second quit is equivalent handoff evidence.
+      updateQuit.resolve();
+      return;
+    }
     quitting = true;
     event.preventDefault();
 
-    void stopDesktopManagedDaemonIfNeeded()
-      .catch((error) => {
+    void (async () => {
+      try {
+        await stopDesktopManagedDaemonIfNeeded();
+      } catch (error) {
         onStopError(error);
-      })
-      .finally(() => {
-        app.exit(0);
+      }
+
+      const signal = createUpdateDeadlineSignal();
+      const updateInstallation = installAppUpdateOnQuit(signal).catch((error) => {
+        onUpdateError(error);
+        return false;
       });
+      const installingUpdate = await Promise.race([
+        updateInstallation,
+        waitForUpdateDeadline(signal),
+      ]);
+      if (installingUpdate) {
+        const handoffStarted = await Promise.race([
+          updateQuit.promise,
+          waitForUpdateDeadline(createUpdateDeadlineSignal()),
+        ]);
+        if (handoffStarted) {
+          return;
+        }
+      }
+
+      app.exit(0);
+    })();
+  }
+
+  return {
+    handleBeforeQuit,
+    handleBeforeQuitForUpdate() {
+      quittingForUpdate = true;
+      updateQuit.resolve();
+    },
   };
 }