claude-code-session-manager 0.109.0 → 0.111.0

package/src/main/lib/relayClientAuth.cjs

@@ -0,0 +1,133 @@
+'use strict';
+
+// Desktop credential for acting as a 'browser'-role relay client against
+// bilko.run's sm-relay client endpoints. Pairs with a one-time client code,
+// stores the long-lived client token at 0600, and exchanges it for one-time WS
+// tickets and the owner's device list. No Electron imports.
+
+const fs = require('node:fs');
+const https = require('node:https');
+const path = require('node:path');
+const { claudeHome } = require('./schedulerPaths.cjs');
+const { writeJsonAtomicSync, readJsonOrSync } = require('./atomicFs.cjs');
+
+const RELAY_CLIENT_API_BASE = 'https://bilko.run/api/sm-relay';
+const REQUEST_TIMEOUT_MS = 15_000;
+const CLIENT_NAME_MAX = 64;
+
+/** Default transport: resolves { status, json }; never includes headers in errors. */
+function defaultRequest({ method, url, headers = {}, body }) {
+  return new Promise((resolve, reject) => {
+    let parsed;
+    try { parsed = new URL(url); } catch { reject(new Error('invalid_url')); return; }
+    if (parsed.protocol !== 'https:') {
+      reject(new Error('Only https:// allowed for relay API calls'));
+      return;
+    }
+    const outHeaders = { ...headers };
+    if (body != null) outHeaders['Content-Length'] = Buffer.byteLength(body);
+    const req = https.request({
+      hostname: parsed.hostname,
+      port: parsed.port || 443,
+      path: parsed.pathname + (parsed.search || ''),
+      method,
+      headers: outHeaders,
+      rejectUnauthorized: true,
+    }, (res) => {
+      let data = '';
+      res.on('data', (c) => { data += c; });
+      res.on('end', () => {
+        let json = null;
+        try { json = JSON.parse(data); } catch { /* non-JSON body */ }
+        resolve({ status: res.statusCode, json });
+      });
+    });
+    req.on('error', (err) => reject(new Error(err.message)));
+    req.setTimeout(REQUEST_TIMEOUT_MS, () => { req.destroy(new Error('timeout')); });
+    if (body != null) req.write(body);
+    req.end();
+  });
+}
+
+function defaultTokenPath() {
+  return path.join(claudeHome(), 'session-manager', 'relay-client.json');
+}
+
+function createRelayClientAuth({ tokenPath, request = defaultRequest } = {}) {
+  const file = tokenPath || defaultTokenPath();
+
+  function readStored() {
+    const data = readJsonOrSync(file, null);
+    return data && typeof data.clientToken === 'string' && data.clientToken ? data : null;
+  }
+  function clearToken() {
+    fs.rmSync(file, { force: true });
+  }
+  function isPaired() { return readStored() !== null; }
+  function getClientId() { return readStored()?.clientId ?? null; }
+
+  async function pair(code, clientName) {
+    const body = { code: String(code ?? '').trim().toUpperCase() };
+    const name = typeof clientName === 'string' ? clientName.slice(0, CLIENT_NAME_MAX) : '';
+    if (name) body.clientName = name;
+    const res = await request({
+      method: 'POST',
+      url: `${RELAY_CLIENT_API_BASE}/client-pair`,
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(body),
+    });
+    const json = res.json || {};
+    if (res.status === 404) return { ok: false, error: 'relay_client_auth_unavailable' };
+    if (res.status !== 200) return { ok: false, error: json.error || `HTTP ${res.status}` };
+    if (!json.clientToken) return { ok: false, error: 'relay_auth_failed' };
+    writeJsonAtomicSync(file, {
+      clientToken: json.clientToken,
+      clientId: json.clientId,
+      pairedAt: new Date().toISOString(),
+    }, { mode: 0o600 });
+    return { ok: true, clientId: json.clientId };
+  }
+
+  /** Authenticated call; maps status codes to the module's error vocabulary. */
+  async function authed(method, route, body) {
+    const stored = readStored();
+    if (!stored) throw new Error('relay_client_unpaired');
+    const headers = { Authorization: `Bearer ${stored.clientToken}` };
+    if (body != null) headers['Content-Type'] = 'application/json';
+    const res = await request({ method, url: `${RELAY_CLIENT_API_BASE}${route}`, headers, body });
+    if (res.status === 401) {
+      clearToken();
+      throw new Error('relay_client_unpaired');
+    }
+    if (res.status === 404) throw new Error('relay_client_auth_unavailable');
+    if (res.status < 200 || res.status >= 300) {
+      throw new Error((res.json && res.json.error) || `HTTP ${res.status}`);
+    }
+    return res.json || {};
+  }
+
+  // Optional peer argument is accepted and ignored (remoteClient passes it).
+  async function getBrowserTicket(_peer) {
+    const json = await authed('POST', '/client-ticket', '{}');
+    if (!json.ticket) throw new Error('relay_auth_failed');
+    return json.ticket;
+  }
+
+  async function listDevices() {
+    const json = await authed('GET', '/client/devices');
+    return Array.isArray(json.devices) ? json.devices : [];
+  }
+
+  async function getDevicePubKey(deviceId) {
+    const devices = await listDevices();
+    const hit = devices.find((d) => d && d.deviceId === deviceId);
+    if (!hit) throw new Error('device_not_found');
+    return hit.devicePubKey;
+  }
+
+  return { pair, getBrowserTicket, getDevicePubKey, listDevices, isPaired, getClientId, clearToken };
+}
+
+const relayClientAuth = createRelayClientAuth();
+
+module.exports = { createRelayClientAuth, relayClientAuth, RELAY_CLIENT_API_BASE };

package/src/main/lib/remoteClientSessions.cjs

@@ -0,0 +1,84 @@
+'use strict'
+
+/**
+ * Per-client E2E session registry for the web-remote agent.
+ * Pure — no Electron, no I/O — importable in unit tests.
+ *
+ * One record per connected client, keyed by the relay's `fromConn`. Envelopes
+ * without a usable `fromConn` (relay not yet stamping) key to LEGACY_CLIENT_KEY,
+ * which preserves single-client behaviour.
+ */
+
+const { makeState } = require('./e2eStateMachine.cjs')
+
+const LEGACY_CLIENT_KEY = 'legacy'
+const MAX_KEY_LEN = 64
+
+/**
+ * @param {{ fromConn?: unknown } | null | undefined} envelope
+ * @returns {string}
+ */
+function clientKeyOf(envelope) {
+  const k = envelope && envelope.fromConn
+  if (typeof k === 'string' && k.length > 0 && k.length <= MAX_KEY_LEN) return k
+  return LEGACY_CLIENT_KEY
+}
+
+function makeRecord(key, clientId) {
+  return {
+    key,
+    clientId: typeof clientId === 'string' ? clientId : null,
+    e2e: makeState(),
+    peerPubKey: null,
+    deviceId: null,
+    ptyStreams: new Map(),
+    subscriptions: new Set(),
+    lastSessionListJson: null,
+  }
+}
+
+function createClientSessions() {
+  const records = new Map()
+
+  function teardown(key) {
+    const rec = records.get(key)
+    if (!rec) return null
+    for (const unsub of rec.ptyStreams.values()) {
+      try { if (typeof unsub === 'function') unsub() } catch { /* swallow */ }
+    }
+    rec.ptyStreams.clear()
+    rec.subscriptions.clear()
+    records.delete(key)
+    return rec
+  }
+
+  return {
+    clientKeyOf,
+    get: (key) => records.get(key) || null,
+    getOrCreate(key, { clientId = null } = {}) {
+      let rec = records.get(key)
+      if (!rec) {
+        rec = makeRecord(key, clientId)
+        records.set(key, rec)
+      } else if (rec.clientId === null && typeof clientId === 'string') {
+        rec.clientId = clientId
+      }
+      return rec
+    },
+    delete: (key) => records.delete(key),
+    keys: () => [...records.keys()],
+    values: () => [...records.values()],
+    authenticated: () => [...records.values()].filter((r) => r.e2e.state === 'authenticated'),
+    teardown,
+    teardownAll() {
+      let n = 0
+      for (const key of [...records.keys()]) {
+        if (teardown(key)) n++
+      }
+      return n
+    },
+    size: () => records.size,
+  }
+}
+
+module.exports = { createClientSessions, clientKeyOf, LEGACY_CLIENT_KEY }

package/src/main/lib/shippedPersonaSeeds.cjs

@@ -285,6 +285,17 @@ const SHIPPED_PERSONA_SEEDS = deepFreeze({
         effort: "medium",
       },
     },
+    {
+      commit: "seed-v4",
+      bodySha256: "247f5244d376e9842f368955bdb9b6c7c4bfc45821ba44aa6ebf44aa30b5afb1",
+      fm: {
+        description: "30-second self-contained HTML/JS demo video for Project Home, saved via project_demo_video_write.",
+        tools: "Read, Grep, Glob, Bash, Write, Edit",
+        title: "Project Home — Demo Video",
+        model: "opus",
+        effort: "max",
+      },
+    },
   ],
 });
 

package/src/main/lib/updaterSettings.cjs

@@ -0,0 +1,64 @@
+/**
+ * updaterSettings — persists the in-app auto-update toggle.
+ *
+ * Storage: ~/.claude/session-manager/updater.json
+ * Shape: { enabled: boolean (ON by default), schemaVersion: 1 }
+ *
+ * Mirrors telemetrySettings.cjs: atomic write via config.cjs, frozen DEFAULTS,
+ * isValid() rejecting unknown keys. Pure data plumbing — no IPC, no UI.
+ */
+'use strict';
+
+const fsp = require('node:fs/promises');
+const path = require('node:path');
+const os = require('node:os');
+const config = require('../config.cjs');
+
+const SCHEMA_VERSION = 1;
+const DEFAULTS = Object.freeze({ enabled: true, schemaVersion: SCHEMA_VERSION });
+const KNOWN_KEYS = new Set(Object.keys(DEFAULTS));
+
+function storePath() {
+  return path.join(os.homedir(), '.claude', 'session-manager', 'updater.json');
+}
+
+function isValid(cfg) {
+  if (!cfg || typeof cfg !== 'object' || Array.isArray(cfg)) return false;
+  for (const k of Object.keys(cfg)) {
+    if (!KNOWN_KEYS.has(k)) return false;
+  }
+  return typeof cfg.enabled === 'boolean' && cfg.schemaVersion === SCHEMA_VERSION;
+}
+
+/** Never throws: missing, unparseable, or invalid files all yield the defaults. */
+async function load() {
+  try {
+    const data = JSON.parse(await fsp.readFile(storePath(), 'utf8'));
+    const merged = { ...DEFAULTS, ...data };
+    if (isValid(data && typeof data === 'object' && !Array.isArray(data) ? merged : data)) {
+      return { enabled: merged.enabled, schemaVersion: SCHEMA_VERSION };
+    }
+  } catch (e) {
+    if (e.code !== 'ENOENT') console.warn('[updaterSettings] load failed:', e.message);
+  }
+  return { ...DEFAULTS };
+}
+
+let writeQueue = Promise.resolve();
+async function save(patch) {
+  if (!patch || typeof patch !== 'object' || Array.isArray(patch)) throw new Error('Invalid updater config');
+  for (const k of Object.keys(patch)) {
+    if (k !== 'enabled') throw new Error('Invalid updater config');
+  }
+  if (typeof patch.enabled !== 'boolean') throw new Error('Invalid updater config');
+  const next = { enabled: patch.enabled, schemaVersion: SCHEMA_VERSION };
+  const run = async () => {
+    await config.writeJson(storePath(), next, { mode: 0o600 });
+    return next;
+  };
+  const tail = writeQueue.then(run, run);
+  writeQueue = tail.catch(() => {});
+  return tail;
+}
+
+module.exports = { storePath, load, save, isValid, DEFAULTS, SCHEMA_VERSION };

package/src/main/remoteClient.cjs

@@ -11,17 +11,17 @@ const { claudeHome } = require('./lib/schedulerPaths.cjs');
 const { writeJsonAtomicSync, readJsonOrSync } = require('./lib/atomicFs.cjs');
 const { generateE2EKeyPair, deriveSessionKey, deriveSas, encryptBox, decryptBox } = require('./lib/remoteE2eCrypto.cjs');
 const { ALLOWED_COMMANDS } = require('./ipcSchemas.cjs');
+const { relayClientAuth } = require('./lib/relayClientAuth.cjs');
 
 // Hard-coded wss:// — same relay URL as webRemote.cjs, no plaintext downgrade.
 const RELAY_WSS_URL = 'wss://bilko.run/projects/session-manager/relay';
 const SEND_TIMEOUT_MS = 15_000;
 const WS_OPEN = 1;
 
-/** Default relay auth: the bilko.run relay has no desktop-client auth yet. */
-const defaultRelayAuth = {
-  async getBrowserTicket() { throw new Error('relay_client_auth_unavailable'); },
-  async getDevicePubKey() { throw new Error('relay_client_auth_unavailable'); },
-};
+// The relay closes a revoked desktop client's socket with this code.
+const CLOSE_TOKEN_REVOKED = 4001;
+// Relay errors that end the handshake with a reason the UI can explain.
+const FATAL_RELAY_ERRORS = new Set(['device_offline', 'not_your_device']);
 
 function defaultWsFactory(url) {
   const WebSocket = require('ws');
@@ -32,7 +32,7 @@ function defaultConfigPath() {
   return path.join(claudeHome(), 'session-manager', 'remote-peers.json');
 }
 
-function createRemoteClient({ relayAuth = defaultRelayAuth, wsFactory = defaultWsFactory, configPath } = {}) {
+function createRemoteClient({ relayAuth = relayClientAuth, wsFactory = defaultWsFactory, configPath } = {}) {
   const file = configPath || defaultConfigPath();
   /** @type {Map<string, any>} peerId -> runtime state */
   const runtime = new Map();
@@ -62,7 +62,7 @@ function createRemoteClient({ relayAuth = defaultRelayAuth, wsFactory = defaultW
     if (!s) {
       s = {
         status: 'idle', reason: null, sas: null, ws: null, sessionKey: null,
-        devicePubKey: null, pending: new Map(), attempt: 0,
+        devicePubKey: null, pending: new Map(), attempt: 0, osRequested: false,
       };
       runtime.set(peerId, s);
     }
@@ -100,6 +100,7 @@ function createRemoteClient({ relayAuth = defaultRelayAuth, wsFactory = defaultW
       clientPrivateKey: kp.e2ePrivateKey,
       clientPublicKey: kp.e2ePublicKey,
       verifiedDevicePubKey: null,
+      os: null,
     };
     peers.push(peer);
     savePeers(peers);
@@ -116,6 +117,21 @@ function createRemoteClient({ relayAuth = defaultRelayAuth, wsFactory = defaultW
     return { status: s.status, reason: s.reason, sas: s.sas };
   }
 
+  // Fire-and-forget, once per connection: remember the remote's platform so the
+  // Remote view can show it offline. Any failure leaves `os` untouched.
+  function learnOs(peerId, s) {
+    if (s.osRequested) return;
+    s.osRequested = true;
+    send(peerId, 'cmd:app:info').then((res) => {
+      if (typeof res?.platform === 'string' && res.platform) updatePeer(peerId, { os: res.platform });
+    }).catch(() => { /* older remote or timeout: never fails the connection */ });
+  }
+
+  function markAuthenticated(peerId, s) {
+    s.status = 'authenticated';
+    learnOs(peerId, s);
+  }
+
   function rawSend(ws, msg) {
     ws.send(JSON.stringify(msg));
   }
@@ -148,7 +164,12 @@ function createRemoteClient({ relayAuth = defaultRelayAuth, wsFactory = defaultW
     }
     if (msg.type === 'error') {
       const code = msg.code || msg.payload?.code;
-      if (code === 'token_revoked') fail(peerId, 'token_revoked');
+      if (code === 'token_revoked') {
+        try { relayAuth.clearToken?.(); } catch { /* best effort */ }
+        fail(peerId, 'token_revoked');
+      } else if (FATAL_RELAY_ERRORS.has(code)) {
+        fail(peerId, code);
+      }
       return;
     }
     if (msg.type === 'auth:ok') {
@@ -171,9 +192,11 @@ function createRemoteClient({ relayAuth = defaultRelayAuth, wsFactory = defaultW
         fail(peerId, 'e2e_derivation_failed');
         return;
       }
-      s.status = peer.verifiedDevicePubKey && peer.verifiedDevicePubKey === s.devicePubKey
-        ? 'authenticated'
-        : 'pending_sas';
+      if (peer.verifiedDevicePubKey && peer.verifiedDevicePubKey === s.devicePubKey) {
+        markAuthenticated(peerId, s);
+      } else {
+        s.status = 'pending_sas';
+      }
       return;
     }
     if (msg.type === 'e2e:box') {
@@ -198,6 +221,7 @@ function createRemoteClient({ relayAuth = defaultRelayAuth, wsFactory = defaultW
     s.sessionKey = null;
     s.sas = null;
     s.reason = null;
+    s.osRequested = false;
     s.status = 'connecting';
 
     let ticket;
@@ -230,8 +254,13 @@ function createRemoteClient({ relayAuth = defaultRelayAuth, wsFactory = defaultW
     }
     s.ws = ws;
     ws.on('message', (data) => { if (s.ws === ws) handleMessage(peerId, s, peer, data); });
-    ws.on('close', () => {
+    ws.on('close', (code) => {
       if (s.ws !== ws) return;
+      if (code === CLOSE_TOKEN_REVOKED) {
+        try { relayAuth.clearToken?.(); } catch { /* best effort */ }
+        fail(peerId, 'token_revoked');
+        return;
+      }
       s.ws = null;
       s.sessionKey = null;
       failPending(s, new Error('connection_closed'));
@@ -245,7 +274,7 @@ function createRemoteClient({ relayAuth = defaultRelayAuth, wsFactory = defaultW
     const s = rt(peerId);
     if (s.status !== 'pending_sas' || !s.devicePubKey) return { ok: false, reason: 'not_pending_sas' };
     updatePeer(peerId, { verifiedDevicePubKey: s.devicePubKey });
-    s.status = 'authenticated';
+    markAuthenticated(peerId, s);
     return { ok: true };
   }
 

package/src/main/remoteClientIpc.cjs

@@ -7,16 +7,23 @@
  * and `remoteClient:event`.
  */
 
+const os = require('node:os');
 const { ipcMain } = require('electron');
 const { z } = require('zod');
 const { remoteClient } = require('./remoteClient.cjs');
+const { relayClientAuth } = require('./lib/relayClientAuth.cjs');
 const { ALLOWED_COMMANDS } = require('./ipcSchemas.cjs');
 const { sendIfAlive } = require('./lib/sendToRenderer.cjs');
 
 const STATUS_POLL_MS = 1000;
 
 const peerId = z.string().min(1).max(128);
+const pairCode = z.string().trim()
+  .transform((c) => c.replace(/[-\s]/g, '').toUpperCase())
+  .refine((c) => /^[A-Za-z0-9]{8}$/.test(c), { message: 'invalid_code' });
 const schemas = {
+  pair: z.object({ code: pairCode, clientName: z.string().max(64).optional() }),
+  add: z.object({ deviceId: z.string().min(1).max(128), machineName: z.string().min(1).max(64) }),
   peer: z.object({ peerId }),
   send: z.object({
     peerId,
@@ -29,7 +36,7 @@ function validated(schema, handler) {
   return (_event, payload) => handler(schema.parse(payload));
 }
 
-function registerRemoteClientHandlers(getWindow, client = remoteClient) {
+function registerRemoteClientHandlers(getWindow, client = remoteClient, auth = relayClientAuth) {
   const unsubs = new Map(); // peerId -> unsubscribe for event forwarding
   const lastStatus = new Map(); // peerId -> serialized status
 
@@ -91,6 +98,31 @@ function registerRemoteClientHandlers(getWindow, client = remoteClient) {
   ipcMain.handle('remoteClient:send', validated(schemas.send, ({ peerId: id, type, payload }) =>
     client.send(id, type, payload)));
 
+  ipcMain.handle('remoteClient:auth-status', () => ({ paired: auth.isPaired(), clientId: auth.getClientId() }));
+
+  ipcMain.handle('remoteClient:pair', validated(schemas.pair, ({ code, clientName }) =>
+    auth.pair(code, clientName ?? os.hostname())));
+
+  ipcMain.handle('remoteClient:unpair', () => {
+    auth.clearToken();
+    return { ok: true };
+  });
+
+  ipcMain.handle('remoteClient:devices', async () => {
+    try {
+      return { ok: true, devices: await auth.listDevices() };
+    } catch (e) {
+      return { ok: false, error: e.message };
+    }
+  });
+
+  ipcMain.handle('remoteClient:add', validated(schemas.add, ({ deviceId, machineName }) => {
+    const { clientPrivateKey: _omit, ...peer } = client.addPeer({ peerId: deviceId, deviceId, machineName });
+    ensureForwarding(deviceId);
+    publishStatus(deviceId);
+    return peer;
+  }));
+
   return () => {
     clearInterval(timer);
     for (const off of unsubs.values()) off();

package/src/main/scheduler.cjs

@@ -9856,6 +9856,18 @@ async function superviseAdoptedRunsPass(jobs) {
   }
 }
 
+// A dead-pid row whose spawnJob() is still in flight (slug in runningSet) is
+// mid-finalize: integrating its sm-job branch, then writing the terminal row.
+// Reaping it races that merge (family-frame 137, 2026-10-10). The bound keeps
+// a wedged spawnJob from shielding its row forever — past it, reap as before.
+const FINALIZE_OWNERSHIP_MAX_MS = 30 * 60_000;
+const finalizeOwnedSince = new Map();
+function spawnJobStillFinalizing(slug, now) {
+  if (!runningSet.has(slug)) return false;
+  if (!finalizeOwnedSince.has(slug)) finalizeOwnedSince.set(slug, now);
+  return now - finalizeOwnedSince.get(slug) < FINALIZE_OWNERSHIP_MAX_MS;
+}
+
 async function reapDeadRunningJobs() {
   try {
     // Do NOT gate on runningSet: spawnJob()'s finally block unconditionally
@@ -9881,7 +9893,11 @@ async function reapDeadRunningJobs() {
       getLogPid: (j) => readSpawnedPidFromLog(logPathForJob(j)),
       getLogMtimeMs: (j) => readLogMtimeMs(logPathForJob(j)),
       logFreshWindowMs: IDLE_OUTPUT_KILL_MS,
+      finalizeOwned: (j) => spawnJobStillFinalizing(j.slug, Date.now()),
     });
+    for (const slug of finalizeOwnedSince.keys()) {
+      if (!runningSet.has(slug)) finalizeOwnedSince.delete(slug);
+    }
     for (const w of warnings) {
       console.warn(`[scheduler] reapDeadRunningJobs: ${w.reason} slug=${w.slug} — leaving row alone`);
     }

package/src/main/updaterIpc.cjs

@@ -0,0 +1,110 @@
+'use strict';
+
+/**
+ * updaterIpc.cjs — wires the autoUpdater.cjs state machine to the real electron-updater instance, the
+ * persisted toggle (updaterSettings) and a busy signal (sessionSlots + live PTYs), and registers the
+ * `updater:*` IPC handlers. Local renderer only: no remote/relay command (ipcSchemas ALLOWED_COMMANDS)
+ * reaches the updater, and no handler accepts a URL, feed or provider — the feed is the app-update.yml
+ * electron-builder bakes in.
+ */
+
+const { z } = require('zod');
+const { isAutoUpdateSupported, createAutoUpdater } = require('./lib/autoUpdater.cjs');
+const { sendIfAlive } = require('./lib/sendToRenderer.cjs');
+
+const schemas = {
+  install: z.object({ force: z.boolean() }).strict(),
+  setEnabled: z.object({ enabled: z.boolean() }).strict(),
+};
+
+function validated(schema, handler) {
+  return (_event, payload) => handler(schema.parse(payload));
+}
+
+function defaultDeps() {
+  return {
+    loadUpdater: () => require('electron-updater').autoUpdater,
+    isPackaged: () => require('./lib/appRuntime.cjs').isPackagedApp(),
+    platform: process.platform,
+    env: process.env,
+    settings: require('./lib/updaterSettings.cjs'),
+    sessionSlots: require('./lib/sessionSlots.cjs'),
+    currentVersion: () => require('electron').app.getVersion(),
+    log: (message, meta) => {
+      try {
+        require('./logs.cjs').writeLine({ scope: 'updater', level: 'info', message, meta });
+      } catch { /* logging must never break the updater */ }
+    },
+  };
+}
+
+/**
+ * @param {{ ipcMain: any, getWindow: () => any, ptyManager: any, deps?: object }} opts
+ * @returns {{ updater: object, ready: Promise<void> }}
+ */
+function registerUpdaterIpc({ ipcMain, getWindow, ptyManager, deps = {} }) {
+  const d = { ...defaultDeps(), ...deps };
+  const supported = isAutoUpdateSupported({ packaged: d.isPackaged() === true, platform: d.platform, env: d.env });
+
+  // electron-updater is only ever loaded for a supported build — an unpackaged/npx run never touches it.
+  let realUpdater = null;
+  if (supported) {
+    realUpdater = d.loadUpdater();
+    if (realUpdater) realUpdater.logger = null;
+  }
+
+  let enabled = true;
+  const isBusy = () => {
+    const jobs = d.sessionSlots.inUse();
+    const terminals = ptyManager && ptyManager.sessions ? ptyManager.sessions.size : 0;
+    return { busy: jobs > 0 || terminals > 0, reason: `${jobs} job(s), ${terminals} terminal(s) running` };
+  };
+  const currentVersion = typeof d.currentVersion === 'function' ? d.currentVersion() : d.currentVersion;
+
+  const updater = createAutoUpdater({
+    updater: realUpdater,
+    supported,
+    currentVersion,
+    isBusy,
+    getEnabled: () => enabled,
+    log: d.log,
+  });
+
+  const snapshot = () => ({ ...updater.status(), enabled });
+  updater.subscribe(() => sendIfAlive(getWindow(), 'updater:status', snapshot()));
+
+  ipcMain.handle('updater:status', () => snapshot());
+  ipcMain.handle('updater:check', async () => {
+    await updater.checkNow();
+    return snapshot();
+  });
+  ipcMain.handle('updater:install', validated(schemas.install, ({ force }) => {
+    updater.requestInstall({ force });
+    return snapshot();
+  }));
+  ipcMain.handle('updater:cancel-deferred', () => {
+    updater.cancelDeferred();
+    return snapshot();
+  });
+  ipcMain.handle('updater:set-enabled', validated(schemas.setEnabled, async ({ enabled: next }) => {
+    await d.settings.save({ enabled: next });
+    enabled = next;
+    updater.setEnabled(next);
+    sendIfAlive(getWindow(), 'updater:status', snapshot());
+    return snapshot();
+  }));
+
+  const ready = (async () => {
+    try {
+      const cfg = await d.settings.load();
+      enabled = cfg.enabled !== false;
+      if (enabled) updater.start();
+    } catch (e) {
+      d.log('updater start failed', { error: e && e.message });
+    }
+  })();
+
+  return { updater, ready };
+}
+
+module.exports = { registerUpdaterIpc };