@remit/web-client 0.0.209 → 0.0.210

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/web-client",
-  "version": "0.0.209",
+  "version": "0.0.210",
   "type": "module",
   "description": "Remit web client, published as composable primitives — the app shell, auth shells, and runtime config. A distributor imports what it composes and bundles it.",
   "exports": {

package/src/hooks/use-system-update.test.ts

@@ -16,13 +16,20 @@ import { act, createElement, type ReactNode } from "react";
 import { SelfUpdateOverlay } from "../components/self-update/SelfUpdateOverlay";
 import { AdvancedNavIcon } from "../components/settings/AdvancedNavIcon";
 import { SelfUpdatePanel } from "../components/settings/SelfUpdatePanel";
+import { __resetFatalError, getCurrentFatalError } from "../lib/fatal-error";
 import {
 	APPLY_BUDGET_SECONDS,
 	NEVER_CAME_BACK_MARGIN_SECONDS,
 } from "../lib/self-update-state";
 import { createDomHarness, type DomHarness } from "../test-support/dom";
-import { type HttpMock, httpError, mockFetch } from "../test-support/http";
 import {
+	type HttpCall,
+	type HttpMock,
+	httpError,
+	mockFetch,
+} from "../test-support/http";
+import {
+	CHECK_ANSWER_BUDGET_MS,
 	type SelfUpdateApi,
 	SelfUpdateProvider,
 	useSelfUpdate,
@@ -36,9 +43,11 @@ let http: HttpMock | undefined;
 beforeEach(() => {
 	globalThis.localStorage = globalThis.window.localStorage;
 	localStorage.clear();
+	__resetFatalError();
 });
 
 afterEach(() => {
+	__resetFatalError();
 	http?.restore();
 	http = undefined;
 	harness?.close();
@@ -105,12 +114,12 @@ async function settle(dom: DomHarness): Promise<void> {
  * what the real seam returns the moment it accepts the request.
  */
 function mountApi(
-	getResponse: () => unknown,
+	getResponse: (call: HttpCall) => unknown,
 	children: ReactNode = null,
 ): { dom: DomHarness; api: () => SelfUpdateApi } {
 	http = mockFetch((call) => {
 		if (call.path.endsWith("/system/update") && call.method === "GET") {
-			return getResponse();
+			return getResponse(call);
 		}
 		return {
 			currentVersion: "0.9.3",
@@ -148,6 +157,15 @@ async function startUpdate(
 	});
 }
 
+async function press(dom: DomHarness, api: () => SelfUpdateApi): Promise<void> {
+	await act(async () => {
+		api().onCheck();
+		await dom.flush();
+		await dom.wait(1);
+		await dom.flush();
+	});
+}
+
 async function renderSurface(
 	getResponse: () => unknown,
 	children: ReactNode,
@@ -428,7 +446,23 @@ describe("useSystemUpdate — actions", () => {
 		assert.equal(after.status === "ready" && after.section.status, "upToDate");
 	});
 
-	test("checking and retrying re-poll the surface", async () => {
+	test("the press asks the updater for a check, not another read of the same file (#599)", async () => {
+		// The whole of #599: a plain re-read answers with the verdict it already
+		// had. Only refresh=true records a request the updater will act on.
+		const { dom, api } = mountApi(() => available);
+		await settle(dom);
+		const before = http?.calls.length ?? 0;
+
+		await press(dom, api);
+
+		const refreshes = (http?.calls ?? [])
+			.slice(before)
+			.filter((call) => call.url.includes("refresh=true"));
+		assert.equal(refreshes.length, 1);
+		assert.equal(refreshes[0].method, "GET");
+	});
+
+	test("retrying the connection re-polls the surface", async () => {
 		let calls = 0;
 		const { dom, api } = mountApi(() => {
 			calls += 1;
@@ -437,10 +471,6 @@ describe("useSystemUpdate — actions", () => {
 		await settle(dom);
 		const afterMount = calls;
 
-		await act(async () => {
-			api().onCheck();
-			await dom.flush();
-		});
 		await act(async () => {
 			api().onRetryConnection();
 			await dom.flush();
@@ -448,4 +478,57 @@ describe("useSystemUpdate — actions", () => {
 
 		assert.equal(calls > afterMount, true);
 	});
+
+	test("a press the updater never answers ends loudly, not in a spinner (#599)", async () => {
+		// The poll keeps answering with the same bytes, so nothing the hook reads
+		// changes and no render would notice the wait running out on its own.
+		const { dom, api } = mountApi(
+			() => available,
+			createElement(SelfUpdatePanel),
+		);
+		await settle(dom);
+
+		const realNow = Date.now;
+		try {
+			await act(async () => {
+				api().onCheck();
+				// The press is stamped off the real clock; the wait it then arms is
+				// measured against one already past the budget, so the deadline the
+				// hook sets for itself lands on the next tick, not in half a minute.
+				Date.now = () => realNow() + CHECK_ANSWER_BUDGET_MS + 1_000;
+				await dom.flush();
+			});
+			// The effects have run and the deadline is armed — let it fire.
+			await dom.wait(5);
+			await dom.flush();
+
+			assert.match(dom.html(), /The updater did not answer/);
+			assert.match(dom.html(), /remit logs updater/);
+			assert.doesNotMatch(dom.html(), /Looking for a newer version/);
+		} finally {
+			Date.now = realNow;
+		}
+	});
+
+	test("a refused refresh is shown, never swallowed back into the old verdict (#599)", async () => {
+		let refused = false;
+		const { dom, api } = mountApi(
+			(call) =>
+				refused && call.url.includes("refresh=true")
+					? httpError(500)
+					: available,
+			createElement(SelfUpdatePanel),
+		);
+		await settle(dom);
+
+		refused = true;
+		await press(dom, api);
+
+		assert.match(dom.html(), /could not be requested/);
+		assert.match(dom.html(), /answered 500/);
+		assert.doesNotMatch(dom.html(), /Install 0\.9\.4/);
+		// The press is a raw SDK call, outside the cache the global sink watches:
+		// a 5xx escalates from here or from nowhere at all.
+		assert.equal(getCurrentFatalError()?.error !== undefined, true);
+	});
 });

package/src/hooks/use-system-update.ts

@@ -12,13 +12,15 @@
  * nothing and takes the server's answer as it finds it.
  *
  * Polling follows the run: every 30 seconds while idle, every 5 seconds while a
- * run is in flight or this page is waiting on one it started.
+ * run is in flight, this page is waiting on one it started, or it is waiting on
+ * a check it pressed for.
  */
 import {
 	systemOperationsApplySystemUpdateMutation,
 	systemOperationsGetSystemUpdateOptions,
 	systemOperationsGetSystemUpdateQueryKey,
 } from "@remit/api-http-client/@tanstack/react-query.gen.ts";
+import { systemOperationsGetSystemUpdate } from "@remit/api-http-client/sdk.gen.ts";
 import type {
 	RemitImapSystemUpdateResponse,
 	RemitImapSystemUpdateRun,
@@ -35,8 +37,13 @@ import {
 	useRef,
 	useState,
 } from "react";
+import { shouldEscalate, softErrorMeta } from "@/lib/error-classifier";
+import { reportFatalError } from "@/lib/fatal-error";
 import {
 	appliesSchemaMigration,
+	type CheckPress,
+	checkAnswered,
+	checkRequestFailureReason,
 	deriveUpdateSurface,
 	type HeldRun,
 	isSurfaceAbsent,
@@ -48,6 +55,19 @@ import {
 const IDLE_POLL_MS = 30_000;
 const RUN_POLL_MS = 5_000;
 
+/**
+ * How long a pressed check waits for the updater before the pane calls it a
+ * failure. The backend only records the request; the updater picks it up on a
+ * five-second watch tick, so half a minute is several ticks — patient enough for
+ * a busy box, short enough that a press against a dead updater is answered
+ * rather than left spinning for good.
+ */
+export const CHECK_ANSWER_BUDGET_MS = 30_000;
+
+/** The press was recorded and nothing came back. Names the process and the log. */
+export const UPDATER_SILENT_REASON =
+	"The updater did not answer. Run `remit logs updater` to see why.";
+
 export interface SelfUpdateApi {
 	surface: UpdateSurface;
 	/** Whether the pending release runs a schema migration during the window. */
@@ -55,7 +75,7 @@ export interface SelfUpdateApi {
 	currentVersion: string | undefined;
 	/** The available release, for the consent dialog. */
 	release: ReleaseInfo | undefined;
-	/** Refetch the surface, showing a `checking` pane until it settles. */
+	/** Ask the updater for a fresh check, showing a `checking` pane until it answers. */
 	onCheck: () => void;
 	/** Request a specific release — consent has been given. */
 	install: (targetVersion: string) => void;
@@ -69,10 +89,13 @@ function pollInterval(
 	error: unknown,
 	run: RemitImapSystemUpdateRun | null,
 	hasHeldRun: boolean,
+	hasPress: boolean,
 ): number | false {
 	if (isSurfaceAbsent(error) && !hasHeldRun) return false;
 	const inFlight = run !== null && run.outcome === null;
-	if (hasHeldRun || inFlight) return RUN_POLL_MS;
+	// A press is waiting on the updater's next watch tick (#599), so it polls at
+	// the run cadence — and only until the wait ends, which drops the press.
+	if (hasHeldRun || inFlight || hasPress) return RUN_POLL_MS;
 	return IDLE_POLL_MS;
 }
 
@@ -80,10 +103,13 @@ export function useSystemUpdate(): SelfUpdateApi {
 	const queryClient = useQueryClient();
 	const [held, setHeld] = useState<HeldRun | null>(null);
 	const [dismissedRunId, setDismissedRunId] = useState<string | null>(null);
-	const [checkRequested, setCheckRequested] = useState(false);
+	const [checkPress, setCheckPress] = useState<CheckPress | null>(null);
+	const [checkFailure, setCheckFailure] = useState<string | null>(null);
 
 	const heldRef = useRef(held);
 	heldRef.current = held;
+	const pressRef = useRef(checkPress);
+	pressRef.current = checkPress;
 
 	const query = useQuery({
 		...systemOperationsGetSystemUpdateOptions(),
@@ -94,17 +120,21 @@ export function useSystemUpdate(): SelfUpdateApi {
 				query.state.error,
 				query.state.data?.run ?? null,
 				heldRef.current !== null,
+				pressRef.current !== null,
 			),
 	});
 
+	const dataRef = useRef(query.data);
+	dataRef.current = query.data;
+
 	const derived = deriveUpdateSurface({
 		data: query.data,
 		isError: query.isError,
 		error: query.error,
-		isFetching: query.isFetching,
 		held,
 		dismissedRunId,
-		checkRequested,
+		checkPress,
+		checkFailure,
 		now: Date.now(),
 	});
 
@@ -120,15 +150,62 @@ export function useSystemUpdate(): SelfUpdateApi {
 		if (releaseHeld) setHeld((current) => (current === null ? current : null));
 	}, [releaseHeld]);
 
+	// The updater answered the press: let go of it, so the next poll renders the
+	// verdict rather than the spinner.
 	useEffect(() => {
-		if (checkRequested && !query.isFetching) setCheckRequested(false);
-	}, [checkRequested, query.isFetching]);
+		if (checkPress !== null && checkAnswered(checkPress, query.data))
+			setCheckPress(null);
+	}, [checkPress, query.data]);
+
+	// The wait has to end itself. A poll that answers with the same bytes changes
+	// nothing this hook reads, so nothing would re-render to notice the budget had
+	// run out, and the spinner would sit there for good (#599).
+	useEffect(() => {
+		if (checkPress === null) return;
+		const remaining =
+			checkPress.pressedAt + CHECK_ANSWER_BUDGET_MS - Date.now();
+		const timer = setTimeout(
+			() => {
+				setCheckPress(null);
+				setCheckFailure(UPDATER_SILENT_REASON);
+			},
+			Math.max(0, remaining),
+		);
+		return () => clearTimeout(timer);
+	}, [checkPress]);
 
 	const { refetch } = query;
 
 	const onCheck = useCallback(() => {
-		setCheckRequested(true);
-		void refetch();
+		// A plain refetch only re-reads state.json, so the answer would be exactly
+		// as old as it was before the press. refresh=true has the backend record a
+		// check request for the updater; the wait is this page's to keep, against
+		// the `lastCheckedAt` the server had when the control was pressed (#599).
+		setCheckFailure(null);
+		setCheckPress({
+			pressedAt: Date.now(),
+			since: dataRef.current?.check.lastCheckedAt,
+		});
+
+		void systemOperationsGetSystemUpdate({
+			query: { refresh: true },
+			throwOnError: true,
+		})
+			.then(() => {
+				void refetch();
+			})
+			.catch((error: unknown) => {
+				// The request never reached the seam, so nothing is coming. Say so
+				// where the press was made instead of reverting to the old verdict.
+				// This is a raw SDK call, outside the query cache that feeds the
+				// global sink, so the 5xx the seam answers when the control volume
+				// is unwritable escalates from here or from nowhere.
+				if (shouldEscalate(error, softErrorMeta, "user")) {
+					reportFatalError(error);
+				}
+				setCheckPress(null);
+				setCheckFailure(checkRequestFailureReason(error));
+			});
 	}, [refetch]);
 
 	const onRetryConnection = useCallback(() => {

package/src/lib/self-update-state.test.ts

@@ -8,6 +8,7 @@ import { ApiError } from "./api";
 import {
 	APPLY_BUDGET_SECONDS,
 	appliesSchemaMigration,
+	checkRequestFailureReason,
 	type DeriveInput,
 	deriveUpdateSurface,
 	type HeldRun,
@@ -67,10 +68,10 @@ function input(overrides: Partial<DeriveInput> = {}): DeriveInput {
 		data: undefined,
 		isError: false,
 		error: undefined,
-		isFetching: false,
 		held: null,
 		dismissedRunId: null,
-		checkRequested: false,
+		checkPress: null,
+		checkFailure: null,
 		now: NOW,
 		...overrides,
 	};
@@ -229,12 +230,16 @@ describe("deriveUpdateSurface — the surface without a run", () => {
 		);
 	});
 
-	test("a pressed check shows checking while the refetch is in flight", () => {
+	test("a press keeps checking while the server still reports the answer it had (#599)", () => {
+		const stale = {
+			status: "ok" as const,
+			updateAvailable: false,
+			lastCheckedAt: "2026-07-20T11:00:00.000Z",
+		};
 		const result = deriveUpdateSurface(
 			input({
-				data: response(),
-				checkRequested: true,
-				isFetching: true,
+				data: response({ check: stale }),
+				checkPress: { pressedAt: NOW - 5_000, since: stale.lastCheckedAt },
 			}),
 		);
 		assert.equal(
@@ -242,6 +247,52 @@ describe("deriveUpdateSurface — the surface without a run", () => {
 			"checking",
 		);
 	});
+
+	test("a press settles the moment the server reports a newer lastCheckedAt (#599)", () => {
+		const result = deriveUpdateSurface(
+			input({
+				data: response({
+					check: {
+						status: "ok",
+						updateAvailable: false,
+						lastCheckedAt: "2026-07-20T11:59:50.000Z",
+					},
+				}),
+				checkPress: {
+					pressedAt: NOW - 5_000,
+					since: "2026-07-20T11:00:00.000Z",
+				},
+			}),
+		);
+		assert.equal(
+			result.surface.status === "ready" && result.surface.section.status,
+			"upToDate",
+		);
+	});
+
+	test("a failed press is reported verbatim, never swallowed into the old verdict (#599)", () => {
+		const result = deriveUpdateSurface(
+			input({
+				data: response({
+					check: {
+						status: "ok",
+						updateAvailable: true,
+						latestVersion: "0.9.4",
+						lastCheckedAt: "2026-07-20T11:00:00.000Z",
+					},
+				}),
+				checkFailure: checkRequestFailureReason(new ApiError("boom", 500)),
+			}),
+		);
+		assert.equal(result.surface.status, "ready");
+		if (result.surface.status !== "ready") return;
+		const section = result.surface.section;
+		assert.equal(section.status, "checkFailed");
+		if (section.status !== "checkFailed") return;
+		assert.match(section.reason, /answered 500/);
+		// The age of the answer it is still showing survives the failure.
+		assert.equal(section.lastCheckedAt, Date.parse("2026-07-20T11:00:00.000Z"));
+	});
 });
 
 describe("deriveUpdateSurface — check and run stay independent", () => {

package/src/lib/self-update-state.ts

@@ -57,6 +57,44 @@ export interface HeldRun {
 	startedAt: number;
 }
 
+/**
+ * The check this page asked for, held for as long as the page that asked lives.
+ * The server records the request and answers with the state it already had, so
+ * the wait is the client's to keep: `since` is `check.lastCheckedAt` as the
+ * server reported it at the moment of the press, and the answer has landed once
+ * the server reports a different one. Comparing against that stored value rather
+ * than against the press's own clock keeps the rule honest on a box whose clock
+ * differs from the browser's.
+ */
+export interface CheckPress {
+	/** Epoch millis when the control was pressed, for the bounded wait. */
+	pressedAt: number;
+	since: string | undefined;
+}
+
+export function checkAnswered(
+	press: CheckPress,
+	data: RemitImapSystemUpdateResponse | undefined,
+): boolean {
+	const lastCheckedAt = data?.check.lastCheckedAt;
+	return lastCheckedAt !== undefined && lastCheckedAt !== press.since;
+}
+
+/**
+ * Why the request the press fired never reached the seam. The status is named
+ * because a 500 here is a real fault on the box — the control volume unwritable
+ * is the one seen in the wild — and a press that quietly re-served the old
+ * verdict is exactly how #599 stayed invisible for an hour.
+ */
+export function checkRequestFailureReason(error: unknown): string {
+	const status = getErrorStatus(error);
+	const cause =
+		status === undefined
+			? "the server did not answer"
+			: `the server answered ${status}`;
+	return `The check could not be requested — ${cause}. Run \`remit logs backend\` to see why.`;
+}
+
 export type UpdateOverlay =
 	| { kind: "none" }
 	| {
@@ -82,10 +120,12 @@ export interface DeriveInput {
 	data: RemitImapSystemUpdateResponse | undefined;
 	isError: boolean;
 	error: unknown;
-	isFetching: boolean;
 	held: HeldRun | null;
 	dismissedRunId: string | null;
-	checkRequested: boolean;
+	/** The check this page pressed for, or null when it is not waiting on one. */
+	checkPress: CheckPress | null;
+	/** Why the request that press fired failed, or null when it did not. */
+	checkFailure: string | null;
 	now: number;
 }
 
@@ -238,27 +278,49 @@ function terminalSection(
 
 function checkSection(
 	data: RemitImapSystemUpdateResponse,
-	isChecking: boolean,
+	press: CheckPress | null,
+	failure: string | null,
 	now: number,
 ): SelfUpdateState {
 	const check = data.check;
-	if (isChecking) return { status: "checking", version: data.currentVersion };
+	const lastCheckedAt = parseIso(check.lastCheckedAt);
+
+	if (failure !== null) {
+		return {
+			status: "checkFailed",
+			version: data.currentVersion,
+			reason: failure,
+			lastCheckedAt,
+		};
+	}
+
+	// The press is recorded and the updater has not answered it: the pane waits on
+	// a genuinely newer `lastCheckedAt` rather than re-serving the verdict it
+	// already had (#599). The caller drops the press when the wait runs out, which
+	// arrives here as a failure.
+	if (press !== null && !checkAnswered(press, data)) {
+		return { status: "checking", version: data.currentVersion };
+	}
 
 	if (check.status === "failed") {
 		return {
 			status: "checkFailed",
 			version: data.currentVersion,
 			reason: check.error ?? "Remit could not reach the update service.",
-			lastCheckedAt: parseIso(check.lastCheckedAt),
+			lastCheckedAt,
 		};
 	}
 
 	// A configured surface that has not run its first check yet is never-checked,
 	// not checking: the updater runs the check on a cadence and has not written a
 	// result. A spinner here would run forever, since nothing on this poll is in
-	// flight. Only a genuine refetch (handled above) shows the spinner.
+	// flight. Only a press this page is still waiting on shows the spinner.
 	if (check.status === "disabled") {
-		return { status: "neverChecked", version: data.currentVersion };
+		return {
+			status: "neverChecked",
+			version: data.currentVersion,
+			lastCheckedAt,
+		};
 	}
 
 	const release = releaseFromCheck(data, now);
@@ -412,7 +474,7 @@ function deriveHeld(
 }
 
 function displayFromData(input: DeriveInput): UpdateSurface {
-	const { data, isError, isFetching, dismissedRunId, checkRequested, now } =
+	const { data, isError, dismissedRunId, checkPress, checkFailure, now } =
 		input;
 
 	if (isError) {
@@ -464,7 +526,7 @@ function displayFromData(input: DeriveInput): UpdateSurface {
 
 	return {
 		status: "ready",
-		section: checkSection(data, checkRequested && isFetching, now),
+		section: checkSection(data, checkPress, checkFailure, now),
 		overlay: { kind: "none" },
 	};
 }