gloomberb 0.18.1 → 0.18.3

package/src/renderers/dom/styles.css

@@ -70,6 +70,10 @@ button, [data-gloom-interactive="true"] { cursor: pointer; }
 [data-gloom-role="desktop-button"]:is([data-gloom-variant="plain"], [data-gloom-variant="ghost"], [data-gloom-variant="secondary"]):not(:disabled):not([aria-pressed="true"]):hover {
   background-color: var(--gloom-hover-fill);
 }
+/* Quiet quick actions take the same wash, over a chosen one's fill too. */
+[data-gloom-role="desktop-button"][data-gloom-variant="quiet"]:not(:disabled):hover {
+  background-color: var(--gloom-hover-fill) !important;
+}
 [data-gloom-hover-bg="true"]:hover {
   background-color: var(--gloom-box-hover-bg) !important;
 }
@@ -503,6 +507,45 @@ button, [data-gloom-interactive="true"] { cursor: pointer; }
 [data-gloom-role="tab-button"][data-active="true"]::after { opacity: 1; }
 [data-gloom-role="tab-button"]:disabled { color: var(--gloom-text-muted); cursor: default; }
 [data-gloom-role="tab-button"]:focus-visible { outline: none; }
+/* Title-bar tabs: the same text, sizes and colours, drawn as raised boxes
+   instead of underlines. The active tab is a box with rounded top corners,
+   open at the bottom: its top and sides in the header rule's colour (the
+   accent while the pane is focused), its fill the surface under it, laid over
+   the rule so it opens into the pane. An inactive tab takes the hover fill in
+   the same shape. The pane header sets the colours (pane/header.tsx). */
+[data-gloom-role="tab-list"][data-gloom-variant="header"] {
+  /* Header colour left above a box, and the box's line: the header rule's width. */
+  --pane-tab-top-gap: 2px;
+  --pane-tab-rule: 1px;
+}
+[data-gloom-role="tab-list"][data-gloom-variant="header"] > [data-gloom-role="tab-button"] {
+  height: calc(100% - var(--pane-tab-top-gap));
+  /* The sides take their line from the padding, so a label sits where it
+     would without the box. The gap and the top line push the label down; the
+     bottom padding lifts it back onto the header's centre line, halfway
+     between its top rule (a divider or a floating border, when there is one)
+     and its bottom rule, where the title sits. */
+  padding: 0 calc(var(--gloom-space-sm) - var(--pane-tab-rule)) calc(var(--pane-tab-top-gap) + 2 * var(--pane-tab-rule) - var(--pane-tab-top-inset, 0px));
+  border: var(--pane-tab-rule) solid transparent;
+  border-bottom: 0;
+  border-radius: var(--gloom-radius-md) var(--gloom-radius-md) 0 0;
+  /* The line lies on the bar, as the rule does, so a translucent hairline is
+     the same colour on both. */
+  background-clip: padding-box;
+}
+[data-gloom-role="tab-list"][data-gloom-variant="header"] > [data-gloom-role="tab-button"]::after { content: none; }
+[data-gloom-role="tab-list"][data-gloom-variant="header"] > [data-gloom-role="tab-button"][data-active="true"] {
+  background-color: var(--pane-tab-active-bg, var(--gloom-bg));
+  border-color: var(--pane-tab-border, var(--gloom-hairline));
+}
+[data-gloom-role="tab-list"][data-gloom-variant="header"] > [data-gloom-role="tab-button"]:not([data-active="true"]):not(:disabled):is(:hover, :focus-visible, [data-drag-target="true"]) {
+  background-color: var(--gloom-hover-fill);
+}
+/* A tab's close mark stays inside the box: in a 20px title bar the box is
+   shorter than the icon button, whose fill would cover the box's top line. */
+[data-gloom-role="tab-list"][data-gloom-variant="header"] [data-gloom-role="tab-close"] {
+  max-height: 100%;
+}
 /* A tab's close mark and a strip's plus are the icon button: 20 by 18, the control radius, the hover fill. */
 [data-gloom-role="tab-add"] {
   border: 0;
@@ -941,12 +984,14 @@ html[data-gloom-screenshot="true"] [data-gloom-role="chart-watermark"] {
 }
 .gloom-qb-inline .gloom-qb-view { margin-left: 0; box-shadow: none; align-self: stretch; }
 /* A long inline choice (an expiry strip) scrolls by itself, as the terminal's
-   does, so its label and the controls beside it stay in view. */
+   does, so its label and the controls beside it stay in view. It narrows with
+   its group and has no floor of its own: a floor wider than the room the bar
+   gives it drew its next choice under the control beside it. */
 .gloom-qb-filters[data-strip="true"],
 .gloom-qb-inline[data-strip="true"] { flex: 0 1 auto; min-width: 0; }
 .gloom-qb-inline[data-strip="true"] .gloom-qb-segments {
   flex: 0 1 auto;
-  min-width: 12ch;
+  min-width: 0;
   overflow-x: auto;
   scrollbar-width: none;
 }
@@ -1354,8 +1399,9 @@ html[data-gloom-screenshot="true"] [data-gloom-role="chart-watermark"] {
   white-space: nowrap;
 }
 
-/* Icon-only button: pane header, footer, dialog close, window controls. */
-.gloom-icon-button {
+/* Icon-only button: pane header, footer, dialog close, window controls. A
+   footer status icon (a delayed source's clock) takes the same box. */
+.gloom-icon-button, [data-gloom-role="pane-footer-icon"] {
   flex: none;
   display: inline-flex;
   align-items: center;
@@ -1372,7 +1418,7 @@ html[data-gloom-screenshot="true"] [data-gloom-role="chart-watermark"] {
   cursor: pointer;
   transition: background-color 120ms ease, color 120ms ease;
 }
-.gloom-icon-button:disabled { cursor: default; }
+.gloom-icon-button:disabled, [data-gloom-role="pane-footer-icon"] { cursor: default; }
 .gloom-icon-button:not(:disabled):hover { background: var(--gloom-hover-fill); color: var(--gloom-text-bright); }
 .gloom-icon-button[aria-pressed="true"] { color: var(--gloom-warning); }
 .gloom-qb-view button:disabled { color: var(--gloom-text-muted); opacity: 0.55; cursor: default; }

package/src/renderers/electrobun/bun/core-capabilities.ts

@@ -8,6 +8,7 @@ import type { AppServices } from "../../../core/app-services";
 import { diskNotesFilesIO, isNotesFile } from "../../../plugins/builtin/notes/files";
 import type { BrokerAdapter } from "../../../types/broker";
 import type { AppConfig, BrokerInstanceConfig } from "../../../types/config";
+import { errorMessage } from "../../../utils/errors";
 
 const DESKTOP_CORE_PLUGIN_ID = "desktop-core";
 
@@ -30,6 +31,7 @@ const BROKER_INVOKE_OPERATIONS = new Set([
   "getChartResolutionCapabilities",
   "getOptionsChain",
   "listOpenOrders",
+  "getOrderStatus",
   "listExecutions",
   "previewOrder",
   "placeOrder",
@@ -116,6 +118,8 @@ function invokeBrokerOperation(
     case "previewOrder":
     case "placeOrder":
       return (broker[operation] as any)?.call(broker, instance, args[0]);
+    case "getOrderStatus":
+      return broker.getOrderStatus?.(instance, args[0] as number);
     case "modifyOrder":
       return broker.modifyOrder?.(instance, args[0] as number, args[1] as never);
     case "cancelOrder":
@@ -167,6 +171,15 @@ function createBrokerCapability(options: CoreCapabilityOptions): PluginCapabilit
           },
         );
       }),
+      orders: stream((input: any, emit) => {
+        const instanceId = requireString(input.instanceId, "Broker instance");
+        const { instance, broker } = resolveBrokerInstance(options, instanceId);
+        if (!broker.subscribeOrders) throw new Error(`Broker "${broker.name}" does not stream orders.`);
+        return broker.subscribeOrders(instance, {
+          order: (order) => emit({ kind: "order", order }),
+          live: (live) => emit({ kind: "orders-live", live }),
+        });
+      }),
       removeInstance: op(async (input: any) => {
         const { instance, broker } = resolveBrokerInstance(options, input.instanceId);
         await broker.disconnect?.(instance);
@@ -209,7 +222,14 @@ function createNotesFilesCapability(): PluginCapability {
         await io(input).delete(file(input));
         return null;
       }, "action"),
-      listKeys: op((input: any) => io(input).listKeys({ strict: input.strict === true })),
+      listKeys: op(async (input: any) => {
+        const skipped: Array<{ key: string; reason: string }> = [];
+        const keys = await io(input).listKeys({
+          strict: input.strict === true,
+          ...(input.reportSkipped === true ? { skipped: (key: string, error: unknown) => skipped.push({ key, reason: errorMessage(error) }) } : {}),
+        });
+        return input.reportSkipped === true ? { keys, skipped } : keys;
+      }),
     },
   };
 }

package/src/renderers/electrobun/bun/desktop/backend.ts

@@ -15,6 +15,8 @@ import { startRemoteControlServer, type RemoteControlServer } from "../../../../
 import type { RemoteControlRequest, RemoteControlResponse } from "../../../../remote/types";
 import { installCrashReporter } from "../../../../telemetry/crash-reports";
 import { createNodeCrashReporterHost } from "../../../../telemetry/crash-reports-node";
+import { installUpdateFailureReporter, reviewLastUpdateAttempt } from "../../../../telemetry/update-failures";
+import { createNodeUpdateFailureHost } from "../../../../telemetry/update-failures-node";
 import type { AppConfig } from "../../../../types/config";
 import type { DesktopSharedStateSnapshot } from "../../../../types/desktop-window";
 import type {
@@ -37,6 +39,7 @@ import {
 } from "../external-plugins";
 import { MAIN_WINDOW_RPC_KEY } from "../window/focus";
 import { handleDesktopBackendRequest } from "./backend-requests";
+import { detectDesktopInstallKind, removeUpdateAsides } from "./update";
 import { DesktopCapabilityBridge } from "./capability-bridge";
 import { DesktopDetachedWindowManager } from "./detached-windows";
 import { handleDesktopHostRequest } from "./host-requests";
@@ -138,6 +141,13 @@ export class DesktopBackend {
     if (!this.crashReporterInstalled) {
       this.crashReporterInstalled = true;
       installCrashReporter(createNodeCrashReporterHost({ surface: "desktop", getConfig: () => this.config }));
+      // This process runs the desktop update, so it reports how the last one ended and any that fail.
+      installUpdateFailureReporter(createNodeUpdateFailureHost({
+        installKind: detectDesktopInstallKind(),
+        getDataDir: () => this.config?.dataDir ?? null,
+      }));
+      reviewLastUpdateAttempt();
+      void removeUpdateAsides();
     }
     // The native menu shows the same accelerators the keys use, so a rebind
     // rebuilds it.

package/src/renderers/electrobun/bun/desktop/update.ts

@@ -1,3 +1,5 @@
+import { readdir, rm } from "fs/promises";
+import { basename, dirname, join } from "path";
 import type Electrobun from "electrobun/bun";
 import type { UpdateStatusEntry } from "electrobun/bun";
 import type { UpdateChannel } from "../../../../types/config";
@@ -15,6 +17,20 @@ import {
   type GitHubReleaseListing,
 } from "../../../../updater/github-releases";
 import { stagedUpdateFitsChannel } from "../../../../updater/channel";
+import {
+  classifyUpdateError,
+  httpStatusFailureCode,
+  type UpdateFailure,
+  type UpdateFailureCode,
+} from "../../../../updater/failure";
+import {
+  forgetStagedUpdate,
+  noteUpdateApplying,
+  noteUpdateStaged,
+  reportUpdateFailure,
+  type UpdateInstallKind,
+} from "../../../../telemetry/update-failures";
+import { logFailure } from "../../../../utils/log-failure";
 import { compareSemver, isPrereleaseVersion } from "../../../../utils/semver";
 import { VERSION } from "../../../../version";
 
@@ -27,7 +43,14 @@ type ElectrobunUpdater = typeof Electrobun.Updater;
  */
 export type ElectrobunUpdaterApi = Pick<
   ElectrobunUpdater,
-  "checkForUpdate" | "downloadUpdate" | "applyUpdate" | "updateInfo" | "clearStatusHistory" | "onStatusChange" | "setUpdateSource"
+  | "checkForUpdate"
+  | "downloadUpdate"
+  | "applyUpdate"
+  | "updateInfo"
+  | "clearStatusHistory"
+  | "getStatusHistory"
+  | "onStatusChange"
+  | "setUpdateSource"
 > & {
   localInfo: Pick<ElectrobunUpdater["localInfo"], "channel" | "baseUrl">;
 };
@@ -37,12 +60,111 @@ type ListReleases = () => Promise<GitHubReleaseListing[]>;
 
 const NIGHTLY_RELEASE_WINDOW = 30;
 
+/** A step that failed for a reason known where it was thrown. */
+class DesktopUpdateError extends Error {
+  constructor(message: string, readonly code: UpdateFailureCode) {
+    super(message);
+    this.name = "DesktopUpdateError";
+  }
+}
+
+/** `<app>.previous` and `<app>.previous-<suffix>`: what an install moves the old app to. */
+function isUpdateAside(entry: string, appName: string): boolean {
+  if (!entry.startsWith(`${appName}.previous`)) return false;
+  const rest = entry.slice(appName.length + ".previous".length);
+  return rest === "" || /^-[0-9a-z]+(?:-\d+)?$/.test(rest);
+}
+
+/**
+ * Removes the copies of the app an install moved aside and could not remove
+ * then (the Electrobun patch's `replaceAppBundle`), from beside the app this
+ * process runs from: starting from it means the install that left them worked.
+ * macOS keeps the app in its bundle, Linux in `<app data>/app` (`bin/bun`
+ * inside it); Windows installs through its own script and leaves none.
+ * Resolves to the paths it removed.
+ */
+export async function removeUpdateAsides(
+  execPath: string = process.execPath,
+  platform: string = process.platform,
+): Promise<string[]> {
+  const app = platform === "darwin"
+    ? /^(.*?\.app)\/Contents\/MacOS\/[^/]+$/.exec(execPath)?.[1]
+    : platform === "linux" && basename(dirname(execPath)) === "bin" ? dirname(dirname(execPath)) : undefined;
+  if (!app) return [];
+  const folder = dirname(app);
+  const removed: string[] = [];
+  for (const entry of await readdir(folder).catch(() => [] as string[])) {
+    if (!isUpdateAside(entry, basename(app))) continue;
+    const path = join(folder, entry);
+    // One that still cannot be removed (another user's) is tried again at the next start.
+    const done = await rm(path, { recursive: true, force: true }).then(() => true, logFailure("desktop-update", "Could not remove an old copy of the app", false));
+    if (done) removed.push(path);
+  }
+  return removed;
+}
+
+/**
+ * Where the running app sits, for update failure reports and for what an
+ * install that cannot replace it means. Electrobun replaces the macOS bundle
+ * the app runs from; on Windows and Linux it always installs into its own
+ * folder under the user's app data.
+ */
+export function detectDesktopInstallKind(
+  execPath: string = process.execPath,
+  platform: string = process.platform,
+  homeDir: string = process.env.HOME ?? "",
+): UpdateInstallKind {
+  if (platform !== "darwin") return platform === "win32" || platform === "linux" ? "desktop-app-data" : "unknown";
+  const bundle = /^(.*?\.app)\/Contents\//.exec(execPath)?.[1];
+  if (!bundle) return "unknown";
+  if (bundle.includes("/AppTranslocation/")) return "desktop-translocated";
+  if (bundle.startsWith("/Volumes/")) return "desktop-volume";
+  if (bundle.startsWith("/Applications/") || (homeDir && bundle.startsWith(`${homeDir}/Applications/`))) return "desktop-applications";
+  return "desktop-elsewhere";
+}
+
+/**
+ * On macOS a bundle that cannot be replaced where it runs (a disk image, the
+ * read-only copy App Translocation runs, another volume) is fixed by moving
+ * the app to Applications, which is what the header then says. Anywhere else
+ * a move across disks keeps its own reason: from Applications, moving the app
+ * again would not help.
+ */
+function installFailureCode(code: UpdateFailureCode, installKind: UpdateInstallKind): UpdateFailureCode {
+  const movable = installKind === "desktop-translocated" || installKind === "desktop-volume";
+  if (movable && (code === "permission_denied" || code === "read_only" || code === "wrong_location" || code === "cross_device")) return "wrong_location";
+  return code;
+}
+
+/**
+ * Why Electrobun's check failed. It returns one message for every failure, so
+ * the status it emitted just before says whether the server answered (with
+ * which status) or could not be reached.
+ */
+function checkFailureCode(error: string, history: UpdateStatusEntry[]): UpdateFailureCode {
+  const last = history.at(-1);
+  const status = last?.status === "error" ? /HTTP (\d{3})/.exec(last.message)?.[1] : undefined;
+  if (status) return httpStatusFailureCode(Number(status));
+  if (/Invalid update\.json/i.test(error)) return "bad_response";
+  const code = classifyUpdateError(error);
+  // "Failed to fetch update info" with no status before it: the request itself threw.
+  return code === "unknown" ? "offline" : code;
+}
+
+/** Why a download that Electrobun returned from did not leave an update ready. */
+function downloadFailureCode(error: string, lastErrorStatus: UpdateStatusEntry | null): UpdateFailure {
+  if (/zstd/i.test(error)) return { phase: "verify", code: "corrupt" };
+  if (lastErrorStatus?.message.startsWith("Failed to download:")) return { phase: "download", code: "http_error" };
+  const code = classifyUpdateError(error);
+  return { phase: "download", code: code === "unknown" ? "interrupted" : code };
+}
+
 async function listGitHubReleases(): Promise<GitHubReleaseListing[]> {
   const response = await fetch(`${GITHUB_RELEASES_API_URL}?per_page=${NIGHTLY_RELEASE_WINDOW}`, {
     headers: { Accept: "application/vnd.github+json" },
     signal: AbortSignal.timeout(10_000),
   });
-  if (!response.ok) throw new Error(`GitHub returned ${response.status}`);
+  if (!response.ok) throw new DesktopUpdateError(`GitHub returned ${response.status}`, httpStatusFailureCode(response.status));
   const data: unknown = await response.json();
   if (!Array.isArray(data)) throw new Error("GitHub returned an unexpected releases payload");
   return data as GitHubReleaseListing[];
@@ -88,6 +210,12 @@ function hasDesktopManifest(release: GitHubReleaseListing): boolean {
   return release.assets?.some((asset) => asset.name === manifest) === true;
 }
 
+/**
+ * The progress an Electrobun status means. An `error` status is left to the
+ * caller: during a download Electrobun emits some it recovers from (a patch
+ * that does not apply falls back to the full download), so only the outcome
+ * says whether the download failed.
+ */
 function mapDesktopUpdateStatus(entry: UpdateStatusEntry): UpdateProgress | null {
   const progress = entry.details?.progress;
   switch (entry.status) {
@@ -120,11 +248,6 @@ function mapDesktopUpdateStatus(entry: UpdateStatusEntry): UpdateProgress | null
     // once `updateInfo().updateReady` confirms it.
     case "complete":
       return { phase: "done", message: "Update installed, restarting..." };
-    case "error":
-      return {
-        phase: "error",
-        error: entry.details?.errorMessage || entry.message,
-      };
     default:
       return null;
   }
@@ -133,9 +256,12 @@ function mapDesktopUpdateStatus(entry: UpdateStatusEntry): UpdateProgress | null
 export function createElectrobunDesktopUpdater(
   updater: ElectrobunUpdaterApi,
   {
+    installKind = detectDesktopInstallKind(),
     listReleases = listGitHubReleases,
     runningVersion = VERSION,
   }: {
+    /** Where the app runs from, which an install that cannot replace it is blamed on. */
+    installKind?: UpdateInstallKind;
     listReleases?: ListReleases;
     /** The version of the installed app, which a download checks as. */
     runningVersion?: string;
@@ -152,6 +278,15 @@ export function createElectrobunDesktopUpdater(
   /** An apply is under way, or finished and the app is quitting. */
   let applyInProgress = false;
 
+  /** The error progress for a failed step, reported to error tracking on the way. */
+  function failed(failure: UpdateFailure, error: string, release?: { version?: string; channel?: UpdateChannel } | null): UpdateProgress {
+    reportUpdateFailure(failure, {
+      targetVersion: release?.version,
+      channel: release?.channel === "nightly" ? "nightly" : "stable",
+    });
+    return { phase: "error", error, failure };
+  }
+
   /**
    * Forgets a downloaded update `updateChannel` does not allow: a nightly
    * build staged before the switch back to stable. Electrobun's own ready
@@ -159,7 +294,10 @@ export function createElectrobunDesktopUpdater(
    * a restart cannot install it, and its files go with the next download.
    */
   function dropStagedMisfit(updateChannel: UpdateChannel): void {
-    if (readyRelease && !applyInProgress && !stagedUpdateFitsChannel(readyRelease, updateChannel)) readyRelease = null;
+    if (readyRelease && !applyInProgress && !stagedUpdateFitsChannel(readyRelease, updateChannel)) {
+      readyRelease = null;
+      forgetStagedUpdate();
+    }
   }
 
   async function releaseInfo(updateInfo: { version?: string; hash?: string }, currentVersion: string): Promise<ReleaseInfo> {
@@ -177,6 +315,13 @@ export function createElectrobunDesktopUpdater(
     };
   }
 
+  /** Electrobun's check, with the failure it ended in named. */
+  async function checkElectrobun(): Promise<Awaited<ReturnType<ElectrobunUpdaterApi["checkForUpdate"]>> | { error: string; code: UpdateFailureCode }> {
+    const info = await updater.checkForUpdate();
+    if (!info.error) return info;
+    return { error: info.error, code: checkFailureCode(info.error, updater.getStatusHistory()) };
+  }
+
   /**
    * Nightly: the highest version among the newest releases that has this
    * platform's desktop manifest, nightly or stable, fetched from that release's
@@ -192,8 +337,8 @@ export function createElectrobunDesktopUpdater(
     const baseUrl = githubReleaseDownloadBaseUrl(target.tag_name);
     updater.setUpdateSource({ channel: filesChannel, baseUrl });
 
-    const info = await updater.checkForUpdate();
-    if (info.error) return { kind: "error", error: info.error };
+    const info = await checkElectrobun();
+    if ("code" in info) throw new DesktopUpdateError(info.error, info.code);
     // The same build as the one installed.
     if (!info.updateAvailable) return { kind: "current" };
 
@@ -210,7 +355,11 @@ export function createElectrobunDesktopUpdater(
     };
   }
 
-  async function check(currentVersion: string, updateChannel: UpdateChannel = "stable"): Promise<UpdateCheckResult> {
+  /**
+   * The check, without reporting: a download runs it first and reports what
+   * went wrong itself.
+   */
+  async function checkQuietly(currentVersion: string, updateChannel: UpdateChannel): Promise<UpdateCheckResult> {
     dropStagedMisfit(updateChannel);
     // A downloaded update the channel still allows stays the answer until the
     // user restarts into it, and asking Electrobun again would discard its
@@ -229,9 +378,9 @@ export function createElectrobunDesktopUpdater(
 
       // Stable is the release version.json names, as it always was.
       updater.setUpdateSource(null);
-      const info = await updater.checkForUpdate();
-      if (info.error) {
-        return { kind: "error", error: info.error };
+      const info = await checkElectrobun();
+      if ("code" in info) {
+        return { kind: "error", error: info.error, failure: { phase: "check", code: info.code } };
       }
       if (!info.updateAvailable) {
         return { kind: "current" };
@@ -247,13 +396,21 @@ export function createElectrobunDesktopUpdater(
         release: await releaseInfo(info, currentVersion),
       };
     } catch (error) {
+      const code = error instanceof DesktopUpdateError ? error.code : classifyUpdateError(error);
       return {
         kind: "error",
         error: error instanceof Error ? error.message : "Desktop update check failed",
+        failure: { phase: "check", code },
       };
     }
   }
 
+  async function check(currentVersion: string, updateChannel: UpdateChannel = "stable"): Promise<UpdateCheckResult> {
+    const result = await checkQuietly(currentVersion, updateChannel);
+    if (result.kind === "error" && result.failure) reportUpdateFailure(result.failure, { channel: updateChannel });
+    return result;
+  }
+
   async function download(
     release: Pick<ReleaseInfo, "channel">,
     onProgress: (progress: UpdateProgress) => void,
@@ -277,17 +434,25 @@ export function createElectrobunDesktopUpdater(
     }
 
     downloadInProgress = true;
+    /** The last error Electrobun emitted on the way, which may or may not have ended the download. */
+    let lastErrorStatus: UpdateStatusEntry | null = null;
+    /** The release the download is for, once the check has found it. */
+    let target: ReleaseInfo | null = null;
     updater.clearStatusHistory();
     updater.onStatusChange((entry) => {
+      if (entry.status === "error") {
+        lastErrorStatus = entry;
+        return;
+      }
       const progress = mapDesktopUpdateStatus(entry);
       if (progress) onProgress(progress);
     });
 
     try {
       onProgress({ phase: "downloading", percent: 0 });
-      const result = await check(runningVersion, updateChannel);
+      const result = await checkQuietly(runningVersion, updateChannel);
       if (result.kind === "error") {
-        onProgress({ phase: "error", error: result.error });
+        onProgress(failed(result.failure ?? { phase: "check", code: "unknown" }, result.error, { channel: updateChannel }));
         return;
       }
       if (result.kind !== "available") {
@@ -297,27 +462,31 @@ export function createElectrobunDesktopUpdater(
         });
         return;
       }
+      target = result.release;
 
       await updater.downloadUpdate();
       const updateInfo = updater.updateInfo();
       if (updateInfo?.error) {
-        onProgress({ phase: "error", error: updateInfo.error });
+        onProgress(failed(downloadFailureCode(updateInfo.error, lastErrorStatus), updateInfo.error, result.release));
         return;
       }
       if (!updateInfo?.updateReady) {
-        onProgress({ phase: "error", error: "Desktop update did not finish downloading." });
+        onProgress(failed({ phase: "download", code: "interrupted" }, "Desktop update did not finish downloading.", result.release));
         return;
       }
 
       // Downloaded, not installed: applying relaunches the app, and that waits
       // for the user's explicit request (`apply`).
       readyRelease = result.release;
+      noteUpdateStaged(result.release.version, updateChannel);
       onProgress({ phase: "ready", canRestart: true });
     } catch (error) {
-      onProgress({
-        phase: "error",
-        error: error instanceof Error ? error.message : "Desktop update failed",
-      });
+      const code = classifyUpdateError(error);
+      onProgress(failed(
+        { phase: "download", code: code === "unknown" ? "interrupted" : code },
+        error instanceof Error ? error.message : "Desktop update failed",
+        { version: target?.version, channel: updateChannel },
+      ));
     } finally {
       downloadInProgress = false;
       updater.onStatusChange(null);
@@ -327,11 +496,13 @@ export function createElectrobunDesktopUpdater(
   async function apply(onProgress: (progress: UpdateProgress) => void): Promise<void> {
     if (applyInProgress || downloadInProgress) return;
     if (!readyRelease || !updater.updateInfo()?.updateReady) {
+      const missing = readyRelease;
       readyRelease = null;
-      onProgress({ phase: "error", error: "The downloaded update is no longer available." });
+      onProgress(failed({ phase: "apply", code: "staged_missing" }, "The downloaded update is no longer available.", missing));
       return;
     }
 
+    const target = readyRelease;
     applyInProgress = true;
     let relaunching = false;
     let reportedError = false;
@@ -339,7 +510,19 @@ export function createElectrobunDesktopUpdater(
       if (progress.phase === "error") reportedError = true;
       onProgress(progress);
     };
+    const installFailed = (error: unknown, message: string) => {
+      // Electrobun names the system error in its message ("Failed to replace app: EACCES: ...").
+      const code = installFailureCode(classifyUpdateError(error), installKind);
+      report(failed({ phase: relaunching ? "relaunch" : "apply", code }, message, target));
+    };
+    // Kept before Electrobun quits the app, so the next launch can tell whether it took.
+    noteUpdateApplying(target.version, target.channel === "nightly" ? "nightly" : "stable");
     updater.onStatusChange((entry) => {
+      if (entry.status === "error") {
+        const message = entry.details?.errorMessage || entry.message;
+        installFailed(message, message);
+        return;
+      }
       if (entry.status === "launching-new-version" || entry.status === "complete") relaunching = true;
       const progress = mapDesktopUpdateStatus(entry);
       if (progress) report(progress);
@@ -348,16 +531,13 @@ export function createElectrobunDesktopUpdater(
     try {
       report({ phase: "replacing" });
       await updater.applyUpdate();
-      // Electrobun returns without a status when it cannot install, for example
-      // when a newer release replaced the one that was downloaded.
+      // Electrobun returns without a status when it finds nothing to install:
+      // the downloaded files are gone, or hold no app.
       if (!relaunching && !reportedError) {
-        report({ phase: "error", error: "Desktop update could not be installed." });
+        report(failed({ phase: "apply", code: "staged_missing" }, "Desktop update could not be installed.", target));
       }
     } catch (error) {
-      report({
-        phase: "error",
-        error: error instanceof Error ? error.message : "Desktop update failed",
-      });
+      installFailed(error, error instanceof Error ? error.message : "Desktop update failed");
     } finally {
       updater.onStatusChange(null);
     }

package/src/renderers/electrobun/bun/external-plugins.ts

@@ -14,6 +14,7 @@ import {
   loadExternalPlugin,
 } from "../../../plugins/loader";
 import { createNodePluginManager } from "../../../plugins/manager-node";
+import { readPluginIcon } from "../../../plugins/plugin-icon";
 import type { PluginRegistry } from "../../../plugins/registry";
 import { desktopRendererCapabilityManifests } from "./desktop/initialization";
 import { reportCrash } from "../../../telemetry/crash-reports";
@@ -70,6 +71,7 @@ async function bundlePluginDirectory(
 
   const { plugin } = loaded;
   const directory = basename(pluginDir);
+  const icon = readPluginIcon(pluginDir);
   const base = {
     id: plugin.id,
     name: plugin.name,
@@ -80,6 +82,7 @@ async function bundlePluginDirectory(
     ...(loaded.commit ? { commit: loaded.commit } : {}),
     ...(loaded.repo ? { repo: loaded.repo } : {}),
     ...(loaded.linked ? { linked: true } : {}),
+    ...(icon ? { icon } : {}),
     ...(plugin.targets ? { targets: plugin.targets } : {}),
   };
 

package/src/renderers/electrobun/shared/protocol.ts

@@ -130,6 +130,8 @@ export interface DesktopExternalPluginBundle {
   /** `owner/repo` of the checkout's GitHub origin. */
   repo?: string;
   linked?: boolean;
+  /** The plugin's logo as a `data:` URL, read from the checkout by the Bun process. */
+  icon?: string;
   /** ES module source, absent when `error` or `unsupportedTarget` is set. */
   code?: string;
   targets?: readonly ("cli" | "tui" | "desktop" | "web")[];

package/src/renderers/electrobun/view/broker-remote-client.ts

@@ -125,6 +125,22 @@ const client: BrokerRemoteClient = {
     });
   },
 
+  subscribeOrders(instanceId, listener) {
+    return subscribeBackendCapability({
+      subscriptionId: `broker-orders:${instanceId}:${nextSubscriptionId++}`,
+      capabilityId: BROKER_CAPABILITY_ID,
+      operationId: "orders",
+      payload: { instanceId },
+      onEvent: (message) => {
+        const event = message as BrokerRemoteEvent;
+        if (event.kind === "order") listener.order(event.order);
+        else if (event.kind === "orders-live") listener.live?.(event.live);
+      },
+      // A stream that cannot open leaves the host polling open orders.
+      onError: (error) => { listener.live?.(false); console.error("Failed to subscribe to broker orders", error); },
+    });
+  },
+
   async removeInstance(instanceId) {
     await invokeBrokerCapability("removeInstance", { instanceId });
     statuses.delete(instanceId);

package/src/renderers/electrobun/view/external-plugins.ts

@@ -28,6 +28,7 @@ export async function loadDesktopExternalPlugin(bundle: DesktopExternalPluginBun
     ...(bundle.commit ? { commit: bundle.commit } : {}),
     ...(bundle.repo ? { repo: bundle.repo } : {}),
     ...(bundle.linked ? { linked: true } : {}),
+    ...(bundle.icon ? { icon: bundle.icon } : {}),
   };
   const fallback = {
     ...base,