ima2-gen 3.26.0 → 3.26.1

package/CHANGELOG.md

@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [3.26.1] - 2026-10-02
+
+### Fixed
+
+- **Desktop update checks find their manifests** — installed apps ask the release GitHub marks Latest, which is the npm release `vX.Y.Z`, for `latest-mac.yml`, but the manifests lived only in `desktop-vX.Y.Z`, so every check ended in a 404 ("Unable to check for updates"). The desktop workflow now copies `latest*.yml` into `vX.Y.Z` with file paths that point at the desktop release assets (`scripts/mirror-desktop-update-manifests.mjs`), which also lets apps from 3.23–3.26 update without a new build.
+- **Start hidden applies only at login** — the desktop app used to hide its window on every launch when Start hidden was on. Now only a login launch stays in the menu bar or tray; opening ima2 yourself always shows the window, and a login relaunch of a running app no longer raises it. (#365)
+- **Closing the window keeps the server and frees the renderer** — with Keep running on close, closing the window now destroys it instead of hiding it; the server keeps running in the tray and *Open ima2* recreates a window on the live server. *Open ima2* stays available when the server is stopped or failed, because the window offers Start, Restart and the server log. A crashed or killed window reloads itself up to three times a minute. (#365)
+- **A failed update install no longer leaves ima2 without a server** — if the installer does not start (an error from the updater, a thrown install call, or, on Windows and Linux, no exit within 15 seconds), the app restarts the server it stopped and shows a retryable error. A quit that was cancelled during update preparation no longer disables the updater. (#365)
+- **Stopping the server on Windows** — the desktop app ends the whole server process tree (`taskkill /T /F`) and a stop that cannot end the server reports an error after a bounded wait instead of hanging quit or an update. `ima2 stop` and the desktop app now run the server's own shutdown on Windows too (OAuth helper, MCP connections, database), which a self-sent SIGTERM skipped. (#365)
+
 ## [3.26.0] - 2026-09-30
 
 ### Added

package/bin/lib/platform.js

@@ -89,27 +89,48 @@ export function openUrl(url) {
  * before forceful exit, giving file handles and sockets time to close cleanly.
  */
 const SHUTDOWN_GRACE_MS = 3_000;
-let shutdownStarted = false;
+export function createShutdownCoordinator({ exit = (code) => process.exit(code), graceMs = SHUTDOWN_GRACE_MS, } = {}) {
+    let handler = null;
+    let run = null;
+    return {
+        setHandler(next) { handler = next; },
+        request(reason) {
+            if (run)
+                return run;
+            let exited = false;
+            let force;
+            const finish = () => {
+                if (exited)
+                    return;
+                exited = true;
+                clearTimeout(force);
+                exit(0);
+            };
+            force = setTimeout(finish, graceMs);
+            force.unref?.();
+            run = (async () => {
+                try {
+                    await handler?.(reason);
+                }
+                catch (err) {
+                    logWarn("shutdown", "handler_failed", { signal: reason, error: err });
+                }
+                finish();
+            })();
+            return run;
+        },
+    };
+}
+const shutdown = createShutdownCoordinator();
+export const requestShutdown = (reason) => shutdown.request(reason);
 export function onShutdown(handler) {
+    shutdown.setHandler(handler);
     const signals = isWin
         ? ["SIGINT", "SIGTERM", "SIGBREAK"]
         : ["SIGINT", "SIGTERM", "SIGHUP"];
     for (const sig of signals) {
         try {
-            process.on(sig, async () => {
-                if (shutdownStarted)
-                    return;
-                shutdownStarted = true;
-                const forceExit = setTimeout(() => process.exit(0), SHUTDOWN_GRACE_MS);
-                forceExit.unref?.();
-                try {
-                    await handler(sig);
-                }
-                catch (err) {
-                    logWarn("shutdown", "handler_failed", { signal: sig, error: err });
-                }
-                process.exit(0);
-            });
+            process.on(sig, () => { void requestShutdown(sig); });
         }
         catch {
             // Some signals aren't installable on certain platforms; ignore.

package/docs/API.md

@@ -149,7 +149,7 @@ inventing a runtime `lanes` availability result.
 | Method | Path | Notes |
 |---|---|---|
 | `GET` | `/api/health` | Server health, version, paths, provider policy; includes `grok: { auth: "oauth" \| "none" }` and the runtime identity `bootId`, `launcher` (`foreground` \| `background` \| `service` \| `desktop`) and `root`, mirrored in `~/.ima2/server.json` |
-| `POST` | `/api/admin/stop` | Clean shutdown (local admin only): requires the boot-generated `X-Ima2-Admin-Nonce` from `~/.ima2/server.json`; any request with an `Origin` header is refused (browser drive-by protection). Responds `202`, prints `IMA2_STOP_INTENT <bootId>` on the server's stdout (the desktop app reads it to tell a requested stop from a crash), then self-signals SIGTERM |
+| `POST` | `/api/admin/stop` | Clean shutdown (local admin only): requires the boot-generated `X-Ima2-Admin-Nonce` from `~/.ima2/server.json`; any request with an `Origin` header is refused (browser drive-by protection). Responds `202`, prints `IMA2_STOP_INTENT <bootId>` on the server's stdout (the desktop app reads it to tell a requested stop from a crash), then runs the server's shutdown routine directly (a self-SIGTERM would skip it on Windows) |
 | `GET` | `/api/providers` | Provider availability and runtime ports |
 | `GET` | `/api/oauth/status` | GPT OAuth status and visible models, plus `auth` / `grokAuth` login verdicts: `{ provider, loggedIn, health: healthy\|warning\|reauth_required\|not_logged_in, reason?, source?, email?, plan?, accountId (masked), expiresAt?, refreshable, action?, note? }`. A proxy that exited because no session file exists reports `auth_required`. |
 | `GET` | `/api/grok/status` | xAI OAuth session state and visible xAI image models: `ready`, `no_image_model`, `error`, or `offline` with `reason: "login_required"` when no session is stored |

package/docs/migration/runtime-test-inventory.md

@@ -4,7 +4,7 @@ Generated by `npm run test:inventory` (script: `scripts/classify-tests.mjs`).
 
 _Tests considered "runtime-importing" if they import from `../lib/`, `../routes/`, `../bin/`, `../server`, or `../config`._
 
-Total: 541 (runtime: 246, contract: 295)
+Total: 545 (runtime: 247, contract: 298)
 
 ## Runtime-importing tests
 - `tests/advertise-payload-contract.test.ts`
@@ -169,6 +169,7 @@ Total: 541 (runtime: 246, contract: 295)
 - `tests/open-directory.test.ts`
 - `tests/openai-execution-parity.test.ts`
 - `tests/openai-transport-parity.test.ts`
+- `tests/platform-shutdown.test.ts`
 - `tests/preset-compiler.test.ts`
 - `tests/preset-restore-contract.test.ts`
 - `tests/preset-xmp-roundtrip.test.ts`
@@ -358,6 +359,7 @@ Total: 541 (runtime: 246, contract: 295)
 - `tests/desktop-context-menu.test.ts`
 - `tests/desktop-edit-menu.test.ts`
 - `tests/desktop-mac-verification.test.ts`
+- `tests/desktop-quit-cleanup.test.ts`
 - `tests/desktop-release-assets.test.ts`
 - `tests/desktop-release-contract.test.ts`
 - `tests/desktop-release-workflow-shell.test.ts`
@@ -369,8 +371,10 @@ Total: 541 (runtime: 246, contract: 295)
 - `tests/desktop-takeover.test.ts`
 - `tests/desktop-titlebar-contract.test.ts`
 - `tests/desktop-tray.test.ts`
+- `tests/desktop-update-manifest-mirror.test.ts`
 - `tests/desktop-update-state.test.ts`
 - `tests/desktop-updater.test.ts`
+- `tests/desktop-window-lifecycle.test.ts`
 - `tests/desktop-window-open.test.ts`
 - `tests/direct-mode-visual-contract.test.ts`
 - `tests/dropped-media-sorting-contract.test.ts`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ima2-gen",
-  "version": "3.26.0",
+  "version": "3.26.1",
   "packageManager": "npm@11.18.0",
   "description": "Local-first visual generation runtime and studio for people and coding agents, with reproducible image and video workflows across multiple providers.",
   "type": "module",
@@ -131,5 +131,5 @@
     "typescript-eslint": "8.70.0",
     "yaml": "2.9.1"
   },
-  "gitHead": "f7857a52d057ce628f04d3402ac460fd029f92f9"
+  "gitHead": "8c27479c140b1a8db59b866cf41df099e287dd9e"
 }

package/routes/admin.js

@@ -2,6 +2,7 @@ import { timingSafeEqual } from "node:crypto";
 import { requireRuntimeContext } from "../lib/runtimeContext.js";
 import { logEvent } from "../lib/logger.js";
 import { stopIntentLine } from "../lib/runtimeIdentity.js";
+import { requestShutdown } from "../bin/lib/platform.js";
 /**
  * Local admin surface. POST /api/admin/stop shuts the server down cleanly.
  *
@@ -17,18 +18,17 @@ import { stopIntentLine } from "../lib/runtimeIdentity.js";
  * 2. Any request carrying an Origin header is refused outright. Browser-issued
  *    cross-origin fetches always carry Origin; the ima2 CLI never does.
  *
- * Shutdown itself is a self-signal: the SIGTERM handler installed by
- * onShutdown() owns the ONLY complete teardown (unadvertise, proxy children,
- * agent queue, timers, DB close, exit) and its shutdownStarted latch makes the
- * signal idempotent. Calling shutdownServerAndMcp() directly here would strand
- * proxy children and leave a stale advertise file (audit blocker 2).
+ * Shutdown goes through the coordinator installed by onShutdown(), which owns
+ * the complete teardown (unadvertise, proxy children, agent queue, timers, DB
+ * close, exit). A Windows self-SIGTERM terminates the process without running
+ * that handler, so the route requests shutdown directly instead.
  *
- * Before the self-signal the route prints the stop-intent line on stdout and
- * signals only once that write has flushed. A supervisor that owns this
+ * Before requesting shutdown the route prints the stop-intent line on stdout
+ * and proceeds only once that write has flushed. A supervisor that owns this
  * process's pipe (the desktop shell) reads it to tell a requested stop from a
  * crash, so it does not restart a server the user just stopped.
  */
-export function registerAdminRoutes(app, ctxRaw) {
+export function registerAdminRoutes(app, ctxRaw, { shutdown = requestShutdown } = {}) {
     const ctx = requireRuntimeContext(ctxRaw);
     app.post("/api/admin/stop", (req, res) => {
         if (typeof req.headers.origin === "string" && req.headers.origin.length > 0) {
@@ -45,16 +45,8 @@ export function registerAdminRoutes(app, ctxRaw) {
         }
         logEvent("admin", "stop_requested", { pid: process.pid });
         res.status(202).json({ ok: true, pid: process.pid, stopping: true });
-        const selfSignal = () => {
-            try {
-                process.kill(process.pid, "SIGTERM");
-            }
-            catch {
-                process.exit(0);
-            }
-        };
         setImmediate(() => {
-            process.stdout.write(stopIntentLine(ctx.bootId), () => selfSignal());
+            process.stdout.write(stopIntentLine(ctx.bootId), () => { void shutdown("admin"); });
         });
     });
 }