claude-code-session-manager 0.104.2 → 0.105.0

package/src/main/lib/openExternalApp.cjs

@@ -49,11 +49,11 @@ function findCommand(name) {
  *
  * @returns {Promise<{ ok: true, opener: string } | { ok: false, error: string }>}
  */
-function spawnDetached(cmd, args, opener = cmd) {
+function spawnDetached(cmd, args, opener = cmd, spawnFn = spawn, extraOpts = {}) {
   return new Promise((resolve) => {
     let child;
     try {
-      child = spawn(cmd, args, { detached: true, stdio: 'ignore', env: cleanChildEnv() });
+      child = spawnFn(cmd, args, { detached: true, stdio: 'ignore', env: cleanChildEnv(), ...extraOpts });
     } catch (e) {
       resolve({ ok: false, error: `failed to launch ${opener}: ${e?.message ?? e}` });
       return;
@@ -116,12 +116,16 @@ async function openFileInEditor({ path: abs, line, col, editor }) {
 }
 
 /**
- * Open a directory in the OS file manager (Finder on macOS, Nautilus etc on Linux).
+ * Open a directory in the OS file manager (Finder on macOS, Nautilus etc on Linux,
+ * explorer.exe on Windows).
  *
  * @param {{ cwd: string }} opts
+ * @param {{ platform?: string, spawn?: Function }} [deps]
  * @returns {Promise<{ ok: true, opener: string } | { ok: false, error: string }>}
  */
-async function openInFinder({ cwd }) {
+async function openInFinder({ cwd }, deps = {}) {
+  const { platform = process.platform, spawn: spawnFn = spawn } = deps;
+  if (platform === 'win32') return spawnDetached('explorer.exe', [cwd], 'explorer', spawnFn);
   const errStr = await shell.openPath(cwd);
   if (errStr) return { ok: false, error: errStr };
   return { ok: true, opener: 'shell' };
@@ -132,28 +136,75 @@ async function openInFinder({ cwd }) {
  *
  * Linux: tries gnome-terminal → konsole → xfce4-terminal → xterm.
  * macOS: delegates to Terminal.app via `open -a`.
+ * Windows: `wt.exe -d <cwd>` when on PATH, else powershell.exe -NoExit in a new
+ * console via `cmd.exe /d /c start`.
  *
  * Arg shapes per terminal are preserved verbatim from index.cjs (AC impl note):
  *   gnome-terminal  → ['--working-directory=<cwd>']
  *   others          → ['-e', "bash -c \"cd '<cwd>' && exec bash\""]
  *
  * @param {{ cwd: string }} opts
+ * @param {{ platform?: string, spawn?: Function, findCommand?: (n: string) => string | null }} [deps]
  * @returns {Promise<{ ok: true, opener: string } | { ok: false, error: string }>}
  */
-async function openInTerminal({ cwd }) {
-  if (process.platform === 'linux') {
+async function openInTerminal({ cwd }, deps = {}) {
+  const { platform = process.platform, spawn: spawnFn = spawn, findCommand: find = findCommand } = deps;
+  if (platform === 'linux') {
     const terms = ['gnome-terminal', 'konsole', 'xfce4-terminal', 'xterm'];
     for (const t of terms) {
-      if (!findCommand(t)) continue;
+      if (!find(t)) continue;
       const args = t === 'gnome-terminal'
         ? ['--working-directory=' + cwd]
         : ['-e', `bash -c "cd '${cwd.replace(/'/g, "'\\''")}' && exec bash"`];
-      return spawnDetached(t, args);
+      return spawnDetached(t, args, t, spawnFn);
     }
-  } else if (process.platform === 'darwin') {
-    return spawnDetached('open', ['-a', 'Terminal', cwd], 'Terminal.app');
+  } else if (platform === 'darwin') {
+    return spawnDetached('open', ['-a', 'Terminal', cwd], 'Terminal.app', spawnFn);
+  } else if (platform === 'win32') {
+    if (find('wt.exe')) return spawnDetached('wt.exe', ['-d', cwd], 'wt', spawnFn);
+    const setLoc = `Set-Location -LiteralPath '${cwd.replace(/'/g, "''")}'`;
+    return spawnDetached('cmd.exe',
+      ['/d', '/c', 'start', '', 'powershell.exe', '-NoExit', '-Command', setLoc],
+      'powershell', spawnFn, { windowsHide: true });
   }
   return { ok: false, error: 'no terminal found' };
 }
 
-module.exports = { spawnDetached, findCommand, openInEditor, openFileInEditor, openInFinder, openInTerminal };
+/** Escape a string for use inside an AppleScript double-quoted literal. */
+const appleScriptQuote = (s) => `"${String(s).replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+
+/**
+ * Run a command in a visible OS terminal so the user sees and controls it
+ * (password prompts, installer dialogs). `command` MUST come from main-side
+ * code, never from the renderer. argv arrays only — never shell:true.
+ *
+ * @param {{ command: string, shell?: 'sh' | 'powershell' }} opts
+ * @param {{ platform?: string, spawn?: Function, find?: (n: string) => string | null }} [deps]
+ * @returns {Promise<{ ok: true, opener: string } | { ok: false, error: string }>}
+ */
+async function runInTerminal({ command, shell: shellKind }, deps = {}) {
+  const { platform = process.platform, spawn: spawnFn = spawn, find = findCommand } = deps;
+  if (typeof command !== 'string' || !command.trim()) return { ok: false, error: 'empty command' };
+  if (platform === 'darwin') {
+    const script = `tell application "Terminal"\nactivate\ndo script ${appleScriptQuote(command)}\nend tell`;
+    return spawnDetached('osascript', ['-e', script], 'Terminal.app', spawnFn);
+  }
+  if (platform === 'win32') {
+    return spawnDetached('cmd.exe',
+      ['/d', '/c', 'start', '', 'powershell.exe', '-NoExit', '-Command', command],
+      'powershell', spawnFn);
+  }
+  if (platform === 'linux') {
+    const inner = `${command}; exec bash`;
+    for (const t of ['gnome-terminal', 'konsole', 'xfce4-terminal', 'xterm']) {
+      if (!find(t)) continue;
+      const args = t === 'gnome-terminal'
+        ? ['--', 'bash', '-lc', inner]
+        : ['-e', 'bash', '-lc', inner];
+      return spawnDetached(t, args, t, spawnFn);
+    }
+  }
+  return { ok: false, error: 'no terminal found' };
+}
+
+module.exports = { spawnDetached, findCommand, openInEditor, openFileInEditor, openInFinder, openInTerminal, runInTerminal };

package/src/main/lib/otlpTraceExporter.cjs

@@ -0,0 +1,147 @@
+/**
+ * otlpTraceExporter — zero-dependency batching exporter that POSTs 0-duration
+ * spans to an OTLP/HTTP endpoint as JSON (ExportTraceServiceRequest).
+ *
+ * Replaces the @opentelemetry/* SDK for the one thing otel.cjs does: emit
+ * "event" spans. recordSpan() only queues (no I/O, never throws); a timer
+ * unref()'d so it can't hold the process open drains the queue in batches.
+ * A failed POST drops that batch and is surfaced via stats() — the app must
+ * keep working without telemetry. Field names mirror otlp-transformer's JSON.
+ */
+
+const crypto = require('node:crypto');
+
+function toAnyValue(v) {
+  switch (typeof v) {
+    case 'string': return { stringValue: v };
+    case 'boolean': return { boolValue: v };
+    case 'bigint': return { intValue: v.toString() };
+    case 'number':
+      if (!Number.isFinite(v)) return { stringValue: String(v) };
+      return Number.isInteger(v) ? { intValue: String(v) } : { doubleValue: v };
+    default:
+      try { return { stringValue: JSON.stringify(v) ?? String(v) }; } catch { return { stringValue: String(v) }; }
+  }
+}
+
+function toAttributes(obj) {
+  const out = [];
+  if (!obj || typeof obj !== 'object') return out;
+  for (const [key, v] of Object.entries(obj)) {
+    if (v === undefined || v === null) continue;
+    out.push({ key, value: toAnyValue(v) });
+  }
+  return out;
+}
+
+function createOtlpTraceExporter({
+  url,
+  headers,
+  serviceName,
+  scopeName,
+  maxQueue = 2048,
+  maxBatch = 512,
+  flushIntervalMs = 5000,
+  timeoutMs = 10000,
+} = {}) {
+  let queue = [];
+  let timer = null;
+  let closed = false;
+  let inFlight = Promise.resolve();
+  const counts = { exported: 0, dropped: 0, failed: 0, lastError: null };
+
+  function ensureTimer() {
+    if (timer || closed) return;
+    timer = setInterval(() => { flush(); }, flushIntervalMs);
+    if (typeof timer.unref === 'function') timer.unref();
+  }
+
+  function recordSpan({ name, timeMs, attributes } = {}) {
+    try {
+      if (closed) return;
+      const ms = typeof timeMs === 'number' && Number.isFinite(timeMs) ? timeMs : Date.now();
+      const nanos = (BigInt(Math.round(ms)) * 1000000n).toString();
+      queue.push({
+        traceId: crypto.randomBytes(16).toString('hex'),
+        spanId: crypto.randomBytes(8).toString('hex'),
+        name: String(name),
+        kind: 1,
+        startTimeUnixNano: nanos,
+        endTimeUnixNano: nanos,
+        attributes: toAttributes(attributes),
+      });
+      if (queue.length > maxQueue) {
+        const over = queue.length - maxQueue;
+        queue.splice(0, over);
+        counts.dropped += over;
+      }
+      ensureTimer();
+    } catch (err) {
+      counts.lastError = err?.message || String(err);
+    }
+  }
+
+  async function post(spans) {
+    const body = JSON.stringify({
+      resourceSpans: [{
+        resource: { attributes: [{ key: 'service.name', value: { stringValue: String(serviceName) } }] },
+        scopeSpans: [{ scope: { name: String(scopeName) }, spans }],
+      }],
+    });
+    const res = await fetch(url, {
+      method: 'POST',
+      headers: { ...(headers || {}), 'content-type': 'application/json' },
+      body,
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    try { await res.arrayBuffer(); } catch { /* body drain is best-effort */ }
+    if (!res.ok) throw new Error(`OTLP endpoint responded ${res.status}`);
+  }
+
+  async function drain() {
+    while (queue.length > 0) {
+      const batch = queue.splice(0, maxBatch);
+      try {
+        await post(batch);
+        counts.exported += batch.length;
+        counts.lastError = null;
+      } catch (err) {
+        counts.failed += 1;
+        counts.lastError = err?.message || String(err);
+        return; // drop this batch; the next tick retries whatever is left
+      }
+    }
+  }
+
+  function flush() {
+    const next = inFlight.then(drain, drain);
+    inFlight = next.catch(() => {});
+    return next.catch(() => {});
+  }
+
+  async function shutdown() {
+    closed = true;
+    if (timer) { clearInterval(timer); timer = null; }
+    let guard;
+    await Promise.race([
+      flush(),
+      new Promise((resolve) => { guard = setTimeout(resolve, timeoutMs); }),
+    ]);
+    clearTimeout(guard);
+    queue = [];
+  }
+
+  function stats() {
+    return {
+      queued: queue.length,
+      exported: counts.exported,
+      dropped: counts.dropped,
+      failed: counts.failed,
+      lastError: counts.lastError,
+    };
+  }
+
+  return { recordSpan, flush, shutdown, stats };
+}
+
+module.exports = { createOtlpTraceExporter };

package/src/main/lib/prereqs.cjs

@@ -0,0 +1,145 @@
+/**
+ * prereqs.cjs — first-run prerequisite checklist (git, Claude Code CLI,
+ * Claude sign-in, and Git Bash on Windows). Each missing item carries the
+ * OFFICIAL one-line install command so a UI can offer one-click installs.
+ * Detection only — never runs an installer. Probes are injectable
+ * (opts.execFile / hasCredentials / exists) so tests spawn nothing.
+ */
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { promisify } = require('node:util');
+const childProcess = require('node:child_process');
+const { pathWithUserBins } = require('./cleanEnv.cjs');
+const { resolveClaudeBin } = require('./claudeBin.cjs');
+const { readCredentials } = require('./credentials.cjs');
+
+const PROBE_TIMEOUT_MS = 5000;
+const GIT_URL = 'https://git-scm.com/downloads';
+const CLAUDE_SETUP_URL = 'https://docs.claude.com/en/docs/claude-code/setup';
+const WINGET_GIT = 'winget install --id Git.Git -e --source winget';
+
+const execFileP = promisify(childProcess.execFile);
+
+/** Default probe: no shell, 5 s timeout, PATH widened with the user bin dirs. */
+function defaultExecFile(cmd, args) {
+  return execFileP(cmd, args, {
+    env: { ...process.env, PATH: pathWithUserBins() },
+    timeout: PROBE_TIMEOUT_MS,
+    windowsHide: true,
+  });
+}
+
+async function defaultHasCredentials() {
+  const r = await readCredentials();
+  return r.kind === 'ok';
+}
+
+function errText(e) {
+  const msg = (e && (e.message || e.code)) || String(e);
+  return String(msg).split('\n')[0].slice(0, 200);
+}
+
+/** Run a probe; resolves {ok, out} and never rejects (timeout/ENOENT → ok:false). */
+async function probe(execFile, cmd, args) {
+  try {
+    const r = await execFile(cmd, args);
+    const out = typeof r === 'string' ? r : (r && r.stdout) || '';
+    return { ok: true, out: String(out).trim(), error: null };
+  } catch (e) {
+    return { ok: false, out: '', error: errText(e) };
+  }
+}
+
+function item(id, label, ok, version, detail, fix) {
+  return { id, label, ok, version: ok ? version : null, detail: ok ? null : detail, fix: ok ? null : fix };
+}
+
+function gitFix(platform) {
+  if (platform === 'darwin') return { command: 'xcode-select --install', shell: 'sh', url: GIT_URL };
+  if (platform === 'win32') return { command: WINGET_GIT, shell: 'powershell', url: GIT_URL };
+  // linux: distro-specific — point at the package-manager docs instead of a command.
+  return { command: '', shell: 'sh', url: GIT_URL };
+}
+
+async function checkGit(platform, execFile) {
+  const ver = await probe(execFile, 'git', ['--version']);
+  let ok = ver.ok;
+  let detail = ver.error;
+  if (ok && platform === 'darwin') {
+    // /usr/bin/git on macOS is a stub that prompts for the Command Line Tools.
+    const xc = await probe(execFile, 'xcode-select', ['-p']);
+    if (!xc.ok) {
+      const which = await probe(execFile, 'which', ['git']);
+      if (!which.ok || which.out === '/usr/bin/git' || !which.out) {
+        ok = false;
+        detail = 'Xcode Command Line Tools are not installed';
+      }
+    }
+  }
+  const version = ver.out.replace(/^git version\s+/, '').split(/\s/)[0] || null;
+  const fix = gitFix(platform);
+  const missing = platform === 'linux'
+    ? `${detail || 'git not found'} — install it with your distro's package manager`
+    : (detail || 'git not found');
+  return item('git', 'Git', ok, version, missing, fix);
+}
+
+async function checkClaudeCli(platform, execFile, claudeBin) {
+  const bin = claudeBin || resolveClaudeBin();
+  const r = await probe(execFile, bin, ['--version']);
+  const win = platform === 'win32';
+  return item('claude-cli', 'Claude Code CLI', r.ok, r.out.split('\n')[0] || null,
+    r.error || 'claude not found', {
+      command: win ? 'irm https://claude.ai/install.ps1 | iex' : 'curl -fsSL https://claude.ai/install.sh | bash',
+      shell: win ? 'powershell' : 'sh',
+      url: CLAUDE_SETUP_URL,
+    });
+}
+
+async function checkClaudeAuth(platform, hasCredentials) {
+  let ok = false;
+  try { ok = !!(await hasCredentials()); } catch { ok = false; }
+  return item('claude-auth', 'Claude account', ok, null,
+    'Not signed in — run `claude` and sign in to your Claude account', {
+      command: 'claude',
+      shell: platform === 'win32' ? 'powershell' : 'sh',
+      url: CLAUDE_SETUP_URL,
+    });
+}
+
+function checkGitBash(exists) {
+  const candidates = [];
+  if (process.env.CLAUDE_CODE_GIT_BASH_PATH) candidates.push(process.env.CLAUDE_CODE_GIT_BASH_PATH);
+  candidates.push(path.win32.join(process.env.ProgramFiles || 'C:\\Program Files', 'Git', 'bin', 'bash.exe'));
+  let found = null;
+  for (const c of candidates) {
+    try { if (exists(c)) { found = c; break; } } catch { /* treat as absent */ }
+  }
+  return item('git-bash', 'Git Bash', !!found, found,
+    'Claude Code on Windows needs Git for Windows (bash.exe)',
+    { command: WINGET_GIT, shell: 'powershell', url: GIT_URL });
+}
+
+/**
+ * @param {{platform?: string, execFile?: Function, hasCredentials?: Function,
+ *          claudeBin?: string, exists?: (p: string) => boolean}} [opts]
+ * @returns {Promise<Array<{id:string,label:string,ok:boolean,version:string|null,detail:string|null,
+ *          fix:{command:string,shell:'sh'|'powershell',url?:string}|null}>>}
+ */
+async function checkPrereqs(opts = {}) {
+  const {
+    platform = process.platform,
+    execFile = defaultExecFile,
+    hasCredentials = defaultHasCredentials,
+    claudeBin,
+    exists = fs.existsSync,
+  } = opts;
+  const jobs = [checkGit(platform, execFile)];
+  if (platform === 'win32') jobs.push(Promise.resolve(checkGitBash(exists)));
+  jobs.push(checkClaudeCli(platform, execFile, claudeBin), checkClaudeAuth(platform, hasCredentials));
+  return Promise.all(jobs);
+}
+
+module.exports = { checkPrereqs };

package/src/main/lib/procIdentity.cjs

@@ -97,12 +97,47 @@ function identityFromPs(pid) {
   return { pid, startTicks, cmdline, complete: startTicks !== null && cmdline !== null };
 }
 
-/** identity(pid) → {pid, startTicks, cmdline, complete}. Never throws. */
-function identity(pid) {
+/** PowerShell serialises DateTime as "\/Date(ms)\/" (5.1) or ISO-8601 (7+). */
+function parseWinStartTime(v) {
+  if (typeof v === 'string') {
+    const m = /^\/Date\((-?\d+)\)\/$/.exec(v.trim());
+    if (m) return Number(m[1]);
+    const ms = Date.parse(v);
+    return Number.isFinite(ms) ? ms : null;
+  }
+  if (v && typeof v === 'object' && typeof v.value === 'string') return parseWinStartTime(v.value);
+  return null;
+}
+
+function identityFromPowerShell(pid, execFile) {
+  const unknown = { pid, startTicks: null, cmdline: null, complete: false };
+  let out;
+  try {
+    out = execFile(
+      'powershell.exe',
+      ['-NoProfile', '-Command', `Get-Process -Id ${pid} | Select-Object StartTime,ProcessName | ConvertTo-Json`],
+      { encoding: 'utf8', windowsHide: true, timeout: 5000 },
+    );
+    const parsed = JSON.parse(String(out));
+    const startTicks = parseWinStartTime(parsed && parsed.StartTime);
+    const name = parsed && typeof parsed.ProcessName === 'string' ? parsed.ProcessName.trim() : '';
+    const cmdline = name || null;
+    return { pid, startTicks, cmdline, complete: startTicks !== null && cmdline !== null };
+  } catch {
+    return unknown; // missing process, timeout, or unparseable output
+  }
+}
+
+/**
+ * identity(pid, opts?) → {pid, startTicks, cmdline, complete}. Never throws.
+ * opts.platform / opts.execFile (sync, execFileSync-shaped) are injectable for tests.
+ */
+function identity(pid, { platform = process.platform, execFile = execFileSync } = {}) {
   if (!Number.isInteger(pid) || pid <= 0) {
     return { pid, startTicks: null, cmdline: null, complete: false };
   }
   try {
+    if (platform === 'win32') return identityFromPowerShell(pid, execFile);
     return hasProc() ? identityFromProc(pid) : identityFromPs(pid);
   } catch {
     return { pid, startTicks: null, cmdline: null, complete: false };

package/src/main/lib/rcaReport.cjs

@@ -50,6 +50,7 @@ const VERDICT_LABELS = {
   no_verdict_sentinel: 'no commit or verdict sentinel',
   abandoned_background_task: 'abandoned auto-backgrounded task',
   pass_no_commit: 'PASS sentinel but no commit landed',
+  sentinel_fail: 'executor reported SCHEDULER_VERDICT: FAIL',
   pass_no_commit_already_shipped: 'PASS with no commit — deliverables already shipped',
   pass_no_commit_prior_run_verified: 'PASS with no commit — prior run of this slug already landed the work',
   silent_no_op: 'no commit, clean tree — no evidence of work',

package/src/main/lib/reaperHelpers.cjs

@@ -30,9 +30,11 @@ const { pidAlive } = require('./pidAlive.cjs');
  * Conservative by design: a false negative (live process treated as dead) is
  * far worse than a late reap.
  */
-function claudePidAlive(pid) {
+function claudePidAlive(pid, { platform = process.platform } = {}) {
   if (!pid || typeof pid !== 'number' || pid <= 1) return false;
   if (!pidAlive(pid)) return false;
+  // Windows has no /proc — cannot verify identity, so never call it dead.
+  if (platform === 'win32') return true;
   try {
     const cmd = fs.readFileSync(`/proc/${pid}/cmdline`, 'utf8').replace(/\0/g, ' ');
     return /\bclaude\b/.test(cmd);
@@ -73,7 +75,8 @@ function claudePidAlive(pid) {
  * — i.e. exactly today's behaviour (fail toward terminalizing), never a hang
  * or a thrown error propagating to the caller.
  */
-function findLiveProcessForJob(job, { worktreeDir, runCwd } = {}) {
+function findLiveProcessForJob(job, { worktreeDir, runCwd, platform = process.platform } = {}) {
+  if (platform === 'win32') return null; // no /proc — skip every read
   const slug = job?.slug;
   let entries;
   try {

package/src/main/lib/shippedPersonaSeeds.cjs

@@ -207,6 +207,16 @@ const SHIPPED_PERSONA_SEEDS = deepFreeze({
         tools: "Read, Grep, Glob, Bash",
       },
     },
+    {
+      commit: "<fill in>",
+      bodySha256: "ca159cd47ac4b618af842c6ccd59107fac4a34b0efcfa5dfe7d06875736156ed",
+      fm: {
+        description: "Validates a finished PLAN (the PRDs its validate PRD lists) once, after its last PRD lands — re-runs each PRD's gate, checks every acceptance criterion against the real tree, reviews the plan's combined diff, and reports one VERIFIED/REFUTED verdict per PRD via sentinel lines. Runs headless as a scheduled PRD (agentType: validator); never edits product code and never queues work.",
+        model: "sonnet",
+        title: "Engineering — Plan Validator",
+        tools: "Read, Grep, Glob, Bash",
+      },
+    },
   ],
   "demo-video-builder": [
     {

package/src/main/lib/timeoutShimScript.cjs

@@ -222,16 +222,28 @@ function main() {
   // spawned, without detaching further, dies too); fall back to the direct
   // pid only when the group signal itself fails (e.g. --foreground, where
   // the child shares OUR group rather than leading its own).
+  // Inlined (not require('./killTree.cjs')): this script is copied to ~ and
+  // runs standalone, so it cannot resolve app-relative modules. win32 has no
+  // process groups, so taskkill /T /F stands in for the group signal.
   function killGroup(sig) {
+    if (process.platform === 'win32') {
+      try {
+        require('node:child_process').spawn('taskkill', ['/PID', String(child.pid), '/T', '/F'], { stdio: 'ignore', windowsHide: true });
+      } catch {
+        try { process.kill(child.pid, sig); } catch { /* already gone */ }
+      }
+      return;
+    }
     try {
-      process.kill(-child.pid, sig);
+      const groupPid = -child.pid; // negative pid = whole POSIX process group
+      process.kill(groupPid, sig);
     } catch {
       try { process.kill(child.pid, sig); } catch { /* already gone */ }
     }
   }
 
   try {
-    child = spawn(command, commandArgs, { stdio: 'inherit', detached: !opts.foreground });
+    child = spawn(command, commandArgs, { stdio: 'inherit', detached: !opts.foreground, windowsHide: true });
   } catch (err) {
     finish(err && err.code === 'EACCES' ? 126 : 127);
     return;

package/src/main/lib/updateCheck.cjs

@@ -3,9 +3,10 @@
 /**
  * updateCheck.cjs — bounded, offline-safe, opt-out "is a newer build published?" probe.
  *
- * getUpdateStatus() → { current, latest, behind }. Never throws/rejects; any failure
- * (offline, DNS, non-200, bad JSON, timeout) → { current, latest: null, behind: false }.
- * The request is a bare GET (no headers/cookies/query/body) so it carries nothing that
+ * getUpdateStatus() → { current, latest, behind, channel, downloadUrl? } (installer builds compare
+ * against the latest GitHub Release; npx/dev builds against the npm registry). Never throws/rejects; any failure
+ * (offline, DNS, non-200, bad JSON, timeout) → { current, latest: null, behind: false, channel }.
+ * The request is a bare GET (only a static User-Agent; no cookies/query/body) so it carries nothing that
  * identifies the user or machine. Disabled by SM_UPDATE_CHECK=0 or E2E mode (SM_E2E=1).
  */
 
@@ -16,11 +17,14 @@ const path = require('node:path');
 const CACHE_TTL_MS = 6 * 60 * 60 * 1000;
 const REQUEST_TIMEOUT_MS = 3000;
 const CACHE_FILE = 'update-check.json';
+const GITHUB_CACHE_FILE = 'update-check-github.json';
+const GITHUB_RELEASE_URL = 'https://api.github.com/repos/StanislavBG/claude-code-session-manager/releases/latest';
 
 /** Plain GET → parsed JSON. Rejects on non-200, bad JSON, or timeout. */
 function httpGetJson(url, timeoutMs) {
   return new Promise((resolve, reject) => {
-    const req = https.get(url, { timeout: timeoutMs }, (res) => {
+    // GitHub's API rejects requests without a User-Agent; it names the app only, not the user.
+    const req = https.get(url, { timeout: timeoutMs, headers: { 'User-Agent': 'claude-code-session-manager' } }, (res) => {
       if (res.statusCode !== 200) {
         res.resume();
         reject(new Error(`HTTP ${res.statusCode}`));
@@ -58,15 +62,20 @@ function isBehind(current, latest) {
   return false;
 }
 
-function readCache(file, now) {
+function readCacheEntry(file, now) {
   try {
     const c = JSON.parse(fs.readFileSync(file, 'utf8'));
     if (c && typeof c.latest === 'string' && typeof c.checkedAt === 'number'
-      && now - c.checkedAt >= 0 && now - c.checkedAt < CACHE_TTL_MS) return c.latest;
+      && now - c.checkedAt >= 0 && now - c.checkedAt < CACHE_TTL_MS) return c;
   } catch { /* missing/corrupt cache = miss */ }
   return null;
 }
 
+function readCache(file, now) {
+  const c = readCacheEntry(file, now);
+  return c ? c.latest : null;
+}
+
 function defaultPackageName() {
   return require(path.join(__dirname, '..', '..', '..', 'package.json')).name;
 }
@@ -74,13 +83,34 @@ function defaultPackageName() {
 async function getUpdateStatus({ deps } = {}) {
   const d = deps || {};
   let current = '';
+  let channel = 'npm';
   try {
     const app = d.app || require('electron').app;
     current = app.getVersion();
+    const packaged = (d.isPackaged || require('./appRuntime.cjs').isPackagedApp)();
+    channel = packaged ? 'installer' : 'npm';
     const env = d.env || process.env;
-    if (env.SM_UPDATE_CHECK === '0' || env.SM_E2E === '1') return { current, latest: null, behind: false };
+    if (env.SM_UPDATE_CHECK === '0' || env.SM_E2E === '1') return { current, latest: null, behind: false, channel };
 
     const now = (d.now || Date.now)();
+    const write = d.writeJson || require('../config.cjs').writeJson;
+    if (packaged) {
+      const file = path.join(app.getPath('userData'), GITHUB_CACHE_FILE);
+      let entry = readCacheEntry(file, now);
+      if (entry == null) {
+        const rel = await (d.fetchJson || httpGetJson)(GITHUB_RELEASE_URL, REQUEST_TIMEOUT_MS);
+        const tag = rel && typeof rel.tag_name === 'string' ? rel.tag_name.replace(/^v/, '') : '';
+        if (!tag) return { current, latest: null, behind: false, channel };
+        const downloadUrl = typeof rel.html_url === 'string' ? rel.html_url : null;
+        entry = { checkedAt: now, latest: tag, downloadUrl };
+        try { await write(file, entry); } catch { /* cache is best-effort */ }
+      }
+      return {
+        current, latest: entry.latest, behind: isBehind(current, entry.latest), channel,
+        downloadUrl: typeof entry.downloadUrl === 'string' ? entry.downloadUrl : null,
+      };
+    }
+
     const file = path.join(app.getPath('userData'), CACHE_FILE);
     let latest = readCache(file, now);
     if (latest == null) {
@@ -88,14 +118,14 @@ async function getUpdateStatus({ deps } = {}) {
       const url = `https://registry.npmjs.org/-/package/${name}/dist-tags`;
       const tags = await (d.fetchJson || httpGetJson)(url, REQUEST_TIMEOUT_MS);
       latest = tags && typeof tags.latest === 'string' ? tags.latest : null;
-      if (latest == null) return { current, latest: null, behind: false };
+      if (latest == null) return { current, latest: null, behind: false, channel };
       try {
-        await (d.writeJson || require('../config.cjs').writeJson)(file, { checkedAt: now, latest });
+        await write(file, { checkedAt: now, latest });
       } catch { /* cache is best-effort */ }
     }
-    return { current, latest, behind: isBehind(current, latest) };
+    return { current, latest, behind: isBehind(current, latest), channel };
   } catch {
-    return { current, latest: null, behind: false };
+    return { current, latest: null, behind: false, channel };
   }
 }