ruby_everywhere 0.1.7 → 0.1.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e49675a00a9bbeda3f2e8e9df0dd625535de48ed2cf1dbe2efd6ce2bd6c6975d
-  data.tar.gz: 6ee2c5cf2063f6099473e51b8bd1b60a93c738c80136b605807dfd6d89095e2e
+  metadata.gz: b3a05ca6c42372f257d9fdcbd1ff0e7b2becbceb64e533e671ab5b9b222f7fff
+  data.tar.gz: 6905e9cc0e07e0cf221d0a9219b9ddcdbe43ddfee67d844d5d7d2824f92291c6
 SHA512:
-  metadata.gz: 24efd93b6713e1d50497367a1c532e784284ff18003b5204adc5f99bf2ad9cc0d34c8ef1815539957a1b06e24ff7d64880966a83a43ea7cf40aa357d526456ca
-  data.tar.gz: e9820167a09013b4721c584738b2b480f6054dfcbb9fb2417d83ec07158e6359c05ba364a8d8e905b5e5b1a044f97e938917852ac5c4e68f368eda84198fa421
+  metadata.gz: 755a57a26107f6f6f95d0ef30b14b9f83d67d172ac4aba0fbff629326e4db013b6aa094d16b558b9e84b147d8faff6e93a524df53b0976e5282e156026a87cd1
+  data.tar.gz: 1ab5013257d9d4716c8ea27a23ada758474be29dae9cb34d204925dde1cd82fe3046faf10e92cd18242507c6cb7c911bdc3bea9d2dd358507389a4d3584dcf18

data/lib/everywhere/blake2b.rb

@@ -0,0 +1,116 @@
+# frozen_string_literal: true
+
+module Everywhere
+  # Pure-Ruby BLAKE2b (RFC 7693), unkeyed, variable digest length.
+  #
+  # OpenSSL only exposes the fixed BLAKE2b512 digest, but minisign's secret-key
+  # checksum is BLAKE2b-256 — and a 2b-256 digest is NOT a truncation of 2b-512
+  # (the output length is part of the parameter block). This implementation
+  # covers any length; hot paths (hashing a whole artifact) should still prefer
+  # `Blake2b.digest64`, which uses OpenSSL when available and only falls back
+  # here.
+  module Blake2b
+    MASK = 0xFFFFFFFFFFFFFFFF
+
+    IV = [
+      0x6a09e667f3bcc908, 0xbb67ae8584caa73b, 0x3c6ef372fe94f82b, 0xa54ff53a5f1d36f1,
+      0x510e527fade682d1, 0x9b05688c2b3e6c1f, 0x1f83d9abfb41bd6b, 0x5be0cd19137e2179
+    ].freeze
+
+    SIGMA = [
+      [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15],
+      [14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3],
+      [11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4],
+      [7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8],
+      [9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13],
+      [2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9],
+      [12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11],
+      [13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10],
+      [6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5],
+      [10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0]
+    ].freeze
+
+    module_function
+
+    def digest(data, outlen)
+      raise ArgumentError, "digest length must be 1..64" unless (1..64).cover?(outlen)
+
+      data = data.to_s.b
+      h = IV.dup
+      h[0] ^= 0x01010000 ^ outlen # param block word 0: digest_length, fanout=1, depth=1
+
+      if data.empty?
+        compress(h, ("\0" * 128).b, 0, true)
+      else
+        blocks = (data.bytesize + 127) / 128
+        blocks.times do |i|
+          block = data.byteslice(i * 128, 128)
+          if i == blocks - 1
+            compress(h, block.ljust(128, "\0"), data.bytesize, true)
+          else
+            compress(h, block, (i + 1) * 128, false)
+          end
+        end
+      end
+
+      h.pack("Q<8").byteslice(0, outlen)
+    end
+
+    def hexdigest(data, outlen) = digest(data, outlen).unpack1("H*")
+
+    # 64-byte BLAKE2b of a file — minisign's prehash. Streams through OpenSSL's
+    # BLAKE2b512 when the linked OpenSSL provides it (it matches RFC 7693 with
+    # outlen 64), else falls back to the pure-Ruby path.
+    def digest64_file(path)
+      require "openssl"
+      md = begin
+        OpenSSL::Digest.new("BLAKE2b512")
+      rescue StandardError
+        nil
+      end
+      return digest(File.binread(path), 64) unless md
+
+      File.open(path, "rb") do |io|
+        while (chunk = io.read(1 << 20))
+          md << chunk
+        end
+      end
+      md.digest
+    end
+
+    def compress(h, block, t, last)
+      m = block.unpack("Q<16")
+      v = h + IV
+      v[12] ^= t & MASK
+      v[13] ^= (t >> 64) & MASK
+      v[14] ^= MASK if last
+
+      12.times do |round|
+        s = SIGMA[round % 10]
+        mix(v, 0, 4, 8, 12, m[s[0]], m[s[1]])
+        mix(v, 1, 5, 9, 13, m[s[2]], m[s[3]])
+        mix(v, 2, 6, 10, 14, m[s[4]], m[s[5]])
+        mix(v, 3, 7, 11, 15, m[s[6]], m[s[7]])
+        mix(v, 0, 5, 10, 15, m[s[8]], m[s[9]])
+        mix(v, 1, 6, 11, 12, m[s[10]], m[s[11]])
+        mix(v, 2, 7, 8, 13, m[s[12]], m[s[13]])
+        mix(v, 3, 4, 9, 14, m[s[14]], m[s[15]])
+      end
+
+      8.times { |i| h[i] ^= v[i] ^ v[i + 8] }
+    end
+
+    def mix(v, a, b, c, d, x, y)
+      v[a] = (v[a] + v[b] + x) & MASK
+      v[d] = rotr(v[d] ^ v[a], 32)
+      v[c] = (v[c] + v[d]) & MASK
+      v[b] = rotr(v[b] ^ v[c], 24)
+      v[a] = (v[a] + v[b] + y) & MASK
+      v[d] = rotr(v[d] ^ v[a], 16)
+      v[c] = (v[c] + v[d]) & MASK
+      v[b] = rotr(v[b] ^ v[c], 63)
+    end
+
+    def rotr(x, n) = ((x >> n) | ((x << (64 - n)) & MASK)) & MASK
+  end
+end

data/lib/everywhere/cli.rb

@@ -10,6 +10,8 @@ require_relative "commands/icon"
 require_relative "commands/doctor"
 require_relative "commands/install"
 require_relative "commands/release"
+require_relative "commands/publish"
+require_relative "commands/updates_keygen"
 require_relative "commands/shell_dir"
 require_relative "commands/platform/login"
 require_relative "commands/platform/logout"
@@ -39,6 +41,8 @@ module Everywhere
     register "clean",   Commands::Clean
     register "icon",    Commands::Icon
     register "release", Commands::Release
+    register "publish", Commands::Publish
+    register "updates keygen", Commands::UpdatesKeygen
     register "shell-dir", Commands::ShellDir
 
     register "platform login",       Commands::PlatformLogin

data/lib/everywhere/commands/publish.rb

@@ -0,0 +1,267 @@
+# frozen_string_literal: true
+
+require "dry/cli"
+require "json"
+require "digest"
+require_relative "../minisign"
+require_relative "../s3"
+require_relative "../update_manifest"
+require_relative "../paths"
+require_relative "../ui"
+
+module Everywhere
+  module Commands
+    # Publish a released build to the app's update bucket — the free,
+    # self-hosted half of auto-updates. Reads the receipt `every release`
+    # wrote, signs the artifact, uploads it plus the manifests to any
+    # S3-compatible bucket, and cuts latest.json over LAST so shipped apps
+    # only ever see a complete release.
+    #
+    # Bucket creds come from the standard AWS env vars; endpoint/bucket/etc.
+    # from everywhere.yml's updates.s3 section. See UpdateManifest for the
+    # layout/JSON contract.
+    class Publish < Dry::CLI::Command
+      desc "Publish a released build to your update bucket (self-hosted auto-updates)"
+
+      option :root,        default: ".",  desc: "App root directory"
+      option :receipt,     default: nil,  desc: "Build receipt (default: dist/release.json)"
+      option :channel,     default: nil,  desc: "Release channel (default: updates.channel, then stable)"
+      option :notes,       default: nil,  desc: "Release notes shown to users"
+      option :notes_file,  default: nil,  desc: "Read release notes from a file"
+      option :key,         default: nil,  desc: "Minisign secret key path (default: ~/.rubyeverywhere/keys/<bundle_id>.key)"
+      option :rollback_to, default: nil,  desc: "Re-point latest.json at an already-published version"
+      option :latest_alias, type: :boolean, default: true, desc: "Maintain the App-latest.zip download alias"
+      option :force,       type: :boolean, default: false, desc: "Overwrite a differing already-published version"
+
+      def call(root: ".", receipt: nil, channel: nil, notes: nil, notes_file: nil, key: nil,
+               rollback_to: nil, latest_alias: true, force: false, **)
+        @root = File.expand_path(root)
+        @config = Everywhere::Config.load(@root)
+        @channel = channel || @config.updates_channel
+        preflight!
+
+        if rollback_to
+          rollback!(rollback_to, latest_alias: latest_alias)
+        else
+          publish!(receipt_path(receipt), notes: read_notes(notes, notes_file),
+                   key: key, latest_alias: latest_alias, force: force)
+        end
+      end
+
+      private
+
+      # ---- publish -------------------------------------------------------------
+
+      def publish!(receipt_path, notes:, key:, latest_alias:, force:)
+        receipt = load_receipt(receipt_path)
+        artifact_path = verify_artifact!(receipt, receipt_path)
+        os, arch = receipt.dig("target", "os"), receipt.dig("target", "arch")
+        version = receipt.dig("app", "version")
+        filename = versioned_filename(receipt)
+        loc = { channel: @channel, os: os, arch: arch, prefix: prefix }
+
+        UI.phase("Signing #{filename}")
+        signature = sign!(artifact_path, key)
+        UI.ok("signed and self-verified against updates.public_key")
+
+        entry = UpdateManifest.entry(
+          receipt: receipt, channel: @channel, notes: notes, signature: signature,
+          url: "#{@config.updates_url}/#{@channel}/#{os}/#{arch}/#{filename}"
+        )
+
+        UI.phase("Publishing #{version} to #{@channel}/#{os}/#{arch}")
+        upload_artifact!(artifact_path, filename, signature, loc, force: force)
+        maintain_alias!(filename, version, loc) if latest_alias
+        index = update_index!(entry, loc)
+
+        # The cutover: everything the manifest points at is durable before
+        # latest.json flips. A check mid-publish sees old-complete or
+        # new-complete, never a torn release.
+        s3.put_object(UpdateManifest.latest_key(**loc), UpdateManifest.to_json(entry),
+                      content_type: "application/json", cache_control: UpdateManifest::MUTABLE_CACHE)
+        UI.ok("latest.json → #{version}")
+
+        summarize(entry, index, loc)
+      end
+
+      def upload_artifact!(path, filename, signature, loc, force:)
+        key = UpdateManifest.artifact_key(filename, **loc)
+        size = File.size(path)
+
+        if (head = s3.head_object(key))
+          if head[:size] == size && !force
+            UI.step("#{filename} already published (same size) — skipping upload")
+            s3.put_object("#{key}.minisig", signature, content_type: "text/plain",
+                          cache_control: UpdateManifest::IMMUTABLE_CACHE)
+            return
+          elsif !force
+            UI.die!("#{key} already exists with different content (#{head[:size]} vs #{size} bytes) — " \
+                    "bump app.version, or pass --force if you really mean to replace a published artifact")
+          end
+        end
+
+        UI.step("uploading #{filename} #{UI.dim("(#{(size / 1024.0 / 1024.0).round(1)}MB)")}")
+        File.open(path, "rb") do |io|
+          s3.put_object(key, io, size: size, content_type: content_type(filename),
+                        cache_control: UpdateManifest::IMMUTABLE_CACHE)
+        end
+        s3.put_object("#{key}.minisig", signature, content_type: "text/plain",
+                      cache_control: UpdateManifest::IMMUTABLE_CACHE)
+      end
+
+      def maintain_alias!(filename, version, loc)
+        aliased = UpdateManifest.latest_alias(filename, version)
+        return unless aliased
+
+        s3.copy_object(UpdateManifest.artifact_key(filename, **loc),
+                       UpdateManifest.artifact_key(aliased, **loc),
+                       content_type: content_type(filename), cache_control: UpdateManifest::MUTABLE_CACHE)
+        UI.substep("#{aliased} alias refreshed")
+      end
+
+      def update_index!(entry, loc)
+        index = UpdateManifest.index_append(s3.get_object(UpdateManifest.index_key(**loc)), entry)
+        s3.put_object(UpdateManifest.index_key(**loc), index,
+                      content_type: "application/json", cache_control: UpdateManifest::MUTABLE_CACHE)
+        index
+      end
+
+      # ---- rollback ------------------------------------------------------------
+
+      def rollback!(version, latest_alias:)
+        # os/arch come from the receipt on publish; on rollback there may be no
+        # dist/, so take the target from build.targets (or the default).
+        target = Array(@config.targets).first || "macos-arm64"
+        os, arch = target.split("-", 2)
+        loc = { channel: @channel, os: os, arch: arch, prefix: prefix }
+
+        UI.phase("Rolling back #{@channel}/#{os}/#{arch} to #{version}")
+        entry = UpdateManifest.index_find(s3.get_object(UpdateManifest.index_key(**loc)), version)
+        UI.die!("version #{version} was never published to #{@channel}/#{os}/#{arch} (not in index.json)") unless entry
+
+        filename = File.basename(entry.fetch("url"))
+        key = UpdateManifest.artifact_key(filename, **loc)
+        UI.die!("#{key} is gone from the bucket — can't roll back to it") unless s3.head_object(key)
+
+        s3.put_object(UpdateManifest.latest_key(**loc), UpdateManifest.to_json(entry),
+                      content_type: "application/json", cache_control: UpdateManifest::MUTABLE_CACHE)
+        maintain_alias!(filename, version, loc) if latest_alias
+
+        UI.ok("latest.json → #{version}")
+        UI.warn("apps still on newer #{entry["app"] ? entry.dig("app", "name") : "builds"} won't downgrade — " \
+                "ship a higher-versioned release to move everyone off the bad build")
+      end
+
+      # ---- pieces --------------------------------------------------------------
+
+      def preflight!
+        UI.die!("no updates.url in everywhere.yml — add an updates: section (see `every updates keygen`)") unless @config.updates_url
+        UI.die!("no updates.public_key in everywhere.yml — run `every updates keygen`") unless @config.updates_public_key
+        UI.die!("no updates.s3.bucket in everywhere.yml") if s3_config["bucket"].to_s.empty?
+        UI.die!("missing bucket credentials — set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY") if
+          ENV["AWS_ACCESS_KEY_ID"].to_s.empty? || ENV["AWS_SECRET_ACCESS_KEY"].to_s.empty?
+      end
+
+      def receipt_path(given)
+        path = given ? File.expand_path(given, @root) : File.join(@root, "dist", "release.json")
+        UI.die!("no receipt at #{UI.short_path(path)} — run `every release` first") unless File.exist?(path)
+        path
+      end
+
+      def load_receipt(path)
+        JSON.parse(File.read(path))
+      rescue JSON::ParserError => e
+        UI.die!("#{UI.short_path(path)} isn't valid JSON (#{e.message})")
+      end
+
+      def verify_artifact!(receipt, receipt_path)
+        filename = receipt.dig("artifact", "filename") or UI.die!("receipt has no artifact record — re-run `every release`")
+        path = File.join(File.dirname(receipt_path), filename)
+        UI.die!("artifact #{UI.short_path(path)} not found next to the receipt") unless File.exist?(path)
+
+        expected = receipt.dig("artifact", "checksum").to_s.delete_prefix("sha256:")
+        actual = Digest::SHA256.file(path).hexdigest
+        UI.die!("#{filename} doesn't match its receipt (stale dist/? re-run `every release`)") unless actual == expected
+        path
+      end
+
+      # "My-App.zip" + version -> "My-App-1.2.0.zip": the immutable bucket name.
+      def versioned_filename(receipt)
+        filename = receipt.dig("artifact", "filename")
+        version = receipt.dig("app", "version")
+        base = File.basename(filename, ".*")
+        ext = File.extname(filename)
+        base.end_with?("-#{version}") ? filename : "#{base}-#{version}#{ext}"
+      end
+
+      def sign!(path, key_option)
+        secret_key = signing_key(key_option)
+        signature = Minisign.sign_file(path, secret_key: secret_key, passphrase: passphrase)
+        begin
+          File.write("#{path}.minisig", signature)
+          Minisign.verify_file(path, signature: signature, public_key: @config.updates_public_key)
+        rescue Minisign::Error
+          UI.die!("signature doesn't verify against updates.public_key in everywhere.yml — " \
+                  "the key you're signing with isn't the one shipped apps trust")
+        end
+        signature
+      rescue Minisign::PassphraseError
+        UI.die!("wrong or missing key passphrase — set EVERYWHERE_SIGNING_KEY_PASSPHRASE")
+      end
+
+      def signing_key(key_option)
+        if key_option
+          UI.die!("no key file at #{key_option}") unless File.exist?(key_option)
+          return File.read(key_option)
+        end
+        if (path = ENV["EVERYWHERE_SIGNING_KEY_FILE"])
+          UI.die!("EVERYWHERE_SIGNING_KEY_FILE points at #{path}, which doesn't exist") unless File.exist?(path)
+          return File.read(path)
+        end
+        return ENV["EVERYWHERE_SIGNING_KEY"] if ENV["EVERYWHERE_SIGNING_KEY"]
+
+        default = File.join(Paths.cache_dir, "keys", "#{@config.bundle_id}.key")
+        UI.die!("no signing key found — run `every updates keygen` (looked for #{UI.short_path(default)})") unless File.exist?(default)
+        File.read(default)
+      end
+
+      def passphrase = ENV["EVERYWHERE_SIGNING_KEY_PASSPHRASE"] || ""
+
+      def s3_config = @config.updates_s3
+
+      def prefix = s3_config["prefix"]
+
+      def s3
+        @s3 ||= Everywhere::S3.new(
+          bucket: s3_config["bucket"],
+          region: s3_config["region"] || "auto",
+          endpoint: s3_config["endpoint"],
+          force_path_style: s3_config["force_path_style"],
+          access_key_id: ENV.fetch("AWS_ACCESS_KEY_ID"),
+          secret_access_key: ENV.fetch("AWS_SECRET_ACCESS_KEY"),
+          session_token: ENV["AWS_SESSION_TOKEN"]
+        )
+      end
+
+      def content_type(filename)
+        filename.end_with?(".zip") ? "application/zip" : "application/octet-stream"
+      end
+
+      def read_notes(notes, notes_file)
+        return notes if notes
+        return File.read(File.expand_path(notes_file, @root)).strip if notes_file
+
+        nil
+      end
+
+      def summarize(entry, index, loc)
+        entries = JSON.parse(index)["entries"].length
+        UI.phase("Published 🎉")
+        UI.success("#{entry["app"]["name"]} #{entry["version"]} is live on the #{UI.bold(@channel)} channel")
+        UI.substep("feed #{UI.dim("#{@config.updates_url}/#{UpdateManifest.latest_key(**loc.merge(prefix: nil))}")}")
+        UI.substep("#{entries} version#{"s" if entries != 1} in the index · shipped apps pick this up within " \
+                   "#{@config.updates_interval / 60} minutes")
+      end
+    end
+  end
+end

data/lib/everywhere/commands/updates_keygen.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+require "dry/cli"
+require_relative "../minisign"
+require_relative "../paths"
+require_relative "../ui"
+
+module Everywhere
+  module Commands
+    # Mint the minisign-compatible keypair that signs this app's updates.
+    # Secret key lands in ~/.rubyeverywhere/keys/<bundle_id>.key (never in the
+    # app repo); the public key goes into everywhere.yml's updates.public_key,
+    # where the build bakes it into the shell for verification.
+    class UpdatesKeygen < Dry::CLI::Command
+      desc "Generate an update-signing keypair (minisign-compatible)"
+
+      option :root,       default: ".",   desc: "App root directory"
+      option :force,      type: :boolean, default: false, desc: "Overwrite an existing keypair"
+      option :passphrase, type: :boolean, default: false, desc: "Encrypt the secret key with a passphrase (prompted)"
+
+      def call(root: ".", force: false, passphrase: false, **)
+        config = Everywhere::Config.load(File.expand_path(root))
+        bundle_id = config.bundle_id
+        keys_dir = File.join(Paths.cache_dir, "keys")
+        sk_path = File.join(keys_dir, "#{bundle_id}.key")
+        pub_path = File.join(keys_dir, "#{bundle_id}.pub")
+
+        if File.exist?(sk_path) && !force
+          UI.die!("a signing key for #{bundle_id} already exists at #{UI.short_path(sk_path)} — " \
+                  "pass --force to overwrite it (shipped apps signed with the old key will REFUSE updates signed with a new one)")
+        end
+
+        UI.phase("Generating update signing key for #{bundle_id}")
+        pair = Minisign.keygen(passphrase: passphrase ? prompt_passphrase : "")
+
+        require "fileutils"
+        FileUtils.mkdir_p(keys_dir, mode: 0o700)
+        File.write(sk_path, pair.secret_key, perm: 0o600)
+        File.write(pub_path, pair.public_key, perm: 0o644)
+
+        UI.ok("secret key #{UI.short_path(sk_path)} #{UI.dim("(key id #{pair.key_id_hex})")}")
+        UI.ok("public key #{UI.short_path(pub_path)}")
+
+        UI.phase("Add the public key to config/everywhere.yml")
+        puts <<~YAML
+
+          updates:
+            url: https://your-bucket-or-cdn.example.com/#{config.name.downcase.gsub(/[^a-z0-9]+/, "-")}
+            public_key: "#{Minisign.public_key_base64(pair.public_key)}"
+
+        YAML
+        UI.substep("back up the secret key somewhere safe — losing it strands every shipped app on its current version")
+      end
+
+      private
+
+      def prompt_passphrase
+        require "io/console"
+        UI.die!("--passphrase needs an interactive terminal") unless $stdin.tty?
+
+        pass = $stdin.getpass("Passphrase: ")
+        confirm = $stdin.getpass("Passphrase (again): ")
+        UI.die!("passphrases didn't match") unless pass == confirm
+        UI.die!("empty passphrase — rerun without --passphrase for an unencrypted key") if pass.empty?
+        pass
+      end
+    end
+  end
+end

data/lib/everywhere/config.rb

@@ -109,6 +109,42 @@ module Everywhere
       @data.dig("remote", "url")&.chomp("/")
     end
 
+    # The `updates:` section — self-hosted auto-updates. Two halves:
+    # a client half (url/channel/public_key/auto/interval) that ships to the
+    # shell, and a publish-side `s3:` half that NEVER leaves the dev machine.
+    # `channel` here is a *release channel* (stable/beta) — not the receipt's
+    # `distribution_channel` (direct vs app stores).
+    def updates = @data.fetch("updates", nil) || {}
+
+    def updates_s3 = updates.fetch("s3", nil) || {}
+
+    def updates_channel = updates["channel"] || "stable"
+
+    def updates_url = updates["url"]&.chomp("/")
+
+    def updates_public_key = updates["public_key"]
+
+    # off — never check; check — check + notify (default); download — also
+    # fetch/verify in the background; install — silent auto-update.
+    def updates_auto = updates["auto"] || "check"
+
+    def updates_interval = [(updates["interval"] || 21_600).to_i, 300].max
+
+    # The client subset for the shell; nil (and thus absent from
+    # everywhere.json) until both url and public_key are configured — an
+    # unsigned update feed is not a thing.
+    def updates_shell_hash
+      return nil unless updates_url && updates_public_key
+
+      {
+        "url" => updates_url,
+        "channel" => updates_channel,
+        "public_key" => updates_public_key,
+        "auto" => updates_auto,
+        "interval" => updates_interval
+      }
+    end
+
     def tint_color
       normalize_color(appearance["tint_color"])
     end
@@ -172,7 +208,8 @@ module Everywhere
         "tint_color" => tint_color,
         "background_color" => background_color,
         "menu" => (menu unless menu.empty?),
-        "tray" => (tray unless tray.empty?)
+        "tray" => (tray unless tray.empty?),
+        "updates" => updates_shell_hash
       }.compact
     end
 

data/lib/everywhere/javascript/bridge.js

@@ -10,10 +10,20 @@
 //   Everywhere.platform                  // "desktop" | "mobile" | "browser"
 //   Everywhere.os                        // "macos" | "windows" | "linux" | "ios" | "android" | "chromeos" | "unknown"
 //   Everywhere.native                    // true inside a RubyEverywhere app
+//   Everywhere.version                   // app version (everywhere.yml app.version); null in a plain browser tab
 //   Everywhere.notify({ title, body })   // native / web Notification / console
 //   Everywhere.confirm("Sure?")          // Promise<boolean>, native dialog when possible
 //   Everywhere.on("menu", handler)       // shell events; returns unsubscribe fn
 //   Everywhere.visit("/settings")        // Turbo.visit with location fallback
+//
+//   Everywhere.updates.supported         // true when the shell has an update feed
+//   Everywhere.updates.check()           // Promise<{available, version?, notes?, notesHtml?}>
+//   Everywhere.updates.install()         // download/verify/swap/relaunch
+//   Everywhere.updates.on("available" | "none" | "progress" | "ready" | "error", handler)
+//
+//   notes is the markdown source; notesHtml is the same notes pre-rendered to
+//   HTML (from the signed update feed — your own content), ready for a
+//   changelog modal: el.innerHTML = notesHtml.
 
 const config =
   (typeof window !== "undefined" && window.__EVERYWHERE_CONFIG__) || {}
@@ -74,6 +84,32 @@ const desktop = {
 
   clipboardRead() {
     return window.__TAURI__.clipboardManager.readText()
+  },
+
+  // Ask the shell to check its update feed; resolve off whichever update
+  // event answers first. The shell always replies to an explicit check
+  // (available / none / error), the timeout is just a safety net.
+  updatesCheck() {
+    return new Promise((resolve, reject) => {
+      const offs = []
+      let timer = null
+      const settle = (fn) => (payload) => {
+        offs.forEach((off) => off())
+        clearTimeout(timer)
+        fn(payload)
+      }
+      offs.push(this.on("update-available", settle((p) =>
+        resolve({ available: true, version: p.version,
+                  notes: p.notes ?? null, notesHtml: p.notes_html ?? null }))))
+      offs.push(this.on("update-none", settle(() => resolve({ available: false }))))
+      offs.push(this.on("update-error", settle((p) => reject(new Error(p.message)))))
+      timer = setTimeout(settle(() => resolve({ available: false, timedOut: true })), 30000)
+      window.__TAURI__.event.emit("everywhere:update-check", {})
+    })
+  },
+
+  updatesInstall() {
+    return window.__TAURI__.event.emit("everywhere:update-install", {})
   }
 }
 
@@ -114,6 +150,16 @@ const browser = {
       try { return await navigator.clipboard.readText() } catch (_) { return null }
     }
     return null
+  },
+
+  // Auto-updates only exist inside the shell; the browser tab is always "current".
+  updatesCheck() {
+    return Promise.resolve({ available: false, unsupported: true })
+  },
+
+  updatesInstall() {
+    console.log("[everywhere] updates unavailable in the browser")
+    return Promise.resolve()
   }
 }
 
@@ -140,6 +186,11 @@ export const Everywhere = {
   platform,
   os,
 
+  // The running app's version (everywhere.yml app.version, injected by the
+  // shell) — e.g. an About page or footer badge. null in a plain browser tab,
+  // where the page came from a server, not a versioned bundle.
+  version: config.version || null,
+
   get native() {
     return platform !== "browser"
   },
@@ -168,6 +219,30 @@ export const Everywhere = {
     read() {
       return adapter.clipboardRead()
     }
+  },
+
+  updates: {
+    // True only when the shell actually has a feed to check (everywhere.yml
+    // updates: url + public_key made it into the shipped config).
+    get supported() {
+      return platform === "desktop" && !!config.updates
+    },
+    version: config.version || null,
+    channel: (config.updates && config.updates.channel) || null,
+
+    check() {
+      return adapter.updatesCheck()
+    },
+
+    // Fire-and-forget: progress arrives via on("progress"), completion as
+    // "ready", failures as "error"; on success the shell restarts the app.
+    install() {
+      return adapter.updatesInstall()
+    },
+
+    on(event, handler) {
+      return adapter.on(`update-${event}`, handler)
+    }
   }
 }