local-operator-ui 0.21.3 → 0.22.0

package/out/main/index.js

@@ -184,6 +184,27 @@ const desktopRequestSchema = zod.z.discriminatedUnion("op", [
     beforeId: id$1.optional(),
     limit: zod.z.number().int().min(1).max(500).optional()
   }).strict(),
+  /*
+   * One child's durable transcript, for the run panel's reader
+   * (`docs/run-sidebar.md` § 10.1, § 10.3).
+   *
+   * Both ids are the same `^[a-f0-9]{12}$` the whole desktop surface already
+   * validates on, and NEITHER is a path: the child directory is resolved by the
+   * route from the id and from the parent's own roster, so the renderer cannot
+   * name a directory at all. That containment is the route's, not the caller's —
+   * a schema that accepted a path here would be the whole boundary.
+   *
+   * `beforeId` is an entry id (max 128 chars, the `id` shape) rather than an
+   * offset, matching `sessions.history`: file compaction replaces the JSONL
+   * atomically, so offsets become lies while ids stay meaningful.
+   */
+  zod.z.object({
+    op: zod.z.literal("subagents.transcript"),
+    sessionId,
+    childId: sessionId,
+    beforeId: id$1.optional(),
+    limit: zod.z.number().int().min(1).max(500).optional()
+  }).strict(),
   zod.z.object({
     op: zod.z.literal("sessions.message"),
     sessionId,
@@ -670,6 +691,16 @@ function desktopEndpoint(request) {
         method: "GET"
       };
     }
+    case "subagents.transcript": {
+      const query = new URLSearchParams({
+        limit: String(request.limit ?? 100)
+      });
+      if (request.beforeId) query.set("before_id", request.beforeId);
+      return {
+        path: `/v1/desktop/sessions/${request.sessionId}/children/${request.childId}/transcript?${query}`,
+        method: "GET"
+      };
+    }
     case "sessions.message":
       return {
         path: `/v1/desktop/sessions/${request.sessionId}/messages`,
@@ -1098,6 +1129,19 @@ const mediaRequestSchema = zod.z.discriminatedUnion("op", [
     op: zod.z.literal("sessions.attachment"),
     sessionId: zod.z.string().regex(/^[a-f0-9]{12}$/),
     digest: zod.z.string().regex(/^[a-f0-9]{32}$/)
+  }).strict(),
+  // The child-scoped twin of the op above, for the run panel's reader: a
+  // child's durable rows reference attachments in the same content-addressed
+  // store, and the parent's route takes the session whose transcript holds the
+  // reference — which a child session is not, so it refuses. `childId` is
+  // shape-constrained here for the same reason `sessionId` is: the path is
+  // built in main, and an unvalidated id would be renderer-controlled path
+  // text.
+  zod.z.object({
+    op: zod.z.literal("subagents.attachment"),
+    sessionId: zod.z.string().regex(/^[a-f0-9]{12}$/),
+    childId: zod.z.string().regex(/^[a-f0-9]{12}$/),
+    digest: zod.z.string().regex(/^[a-f0-9]{32}$/)
   }).strict()
 ]);
 function endpoint(request) {
@@ -1117,6 +1161,11 @@ function endpoint(request) {
         path: `/v1/desktop/sessions/${request.sessionId}/attachments/${request.digest}`,
         method: "GET"
       };
+    case "subagents.attachment":
+      return {
+        path: `/v1/desktop/sessions/${request.sessionId}/children/${request.childId}/attachments/${request.digest}`,
+        method: "GET"
+      };
   }
 }
 async function requestDesktopMedia(input, bytes, backendUrl, token) {
@@ -1138,7 +1187,7 @@ async function requestDesktopMedia(input, bytes, backendUrl, token) {
   const target2 = endpoint(request);
   let body;
   let contentType;
-  if (request.op === "agent.export" || request.op === "sessions.attachment") {
+  if (request.op === "agent.export" || request.op === "sessions.attachment" || request.op === "subagents.attachment") {
     body = void 0;
   } else if (request.op === "speech.create" || request.op === "speech.agent") {
     body = JSON.stringify(request.request);
@@ -4427,6 +4476,9 @@ const PENDING_INSTALL_MARKER_FILE = "pending-update-install.json";
 const INSTALL_DISK_SLACK_BYTES = 256 * 1024 * 1024;
 const DOWNLOAD_PAGE_URL = "https://local-operator.com/download";
 const WATCHDOG_TIMEOUT_SECONDS = 600;
+const WATCHDOG_HARD_TIMEOUT_SECONDS = 1800;
+const PENDING_INSTALL_RECENCY_MARGIN_SECONDS = 300;
+const PENDING_INSTALL_RECENCY_SECONDS = WATCHDOG_HARD_TIMEOUT_SECONDS + PENDING_INSTALL_RECENCY_MARGIN_SECONDS;
 const PLIST_READ_TIMEOUT_SECONDS = 5;
 const WATCHDOG_TOKEN = "local-operator-update-watchdog";
 const BAD_BUNDLE_MARKERS = [
@@ -4783,7 +4835,7 @@ function recordInstallFailure(dir, input) {
   const previous = readLastInstallAttempt(dir);
   const record = {
     targetVersion: input.payload.targetVersion,
-    runningVersion: previous?.runningVersion ?? "unknown",
+    runningVersion: input.runningVersion || previous?.runningVersion || "unknown",
     startedAt: input.startedAt,
     detectedAt: input.detectedAt,
     detail: input.payload.detail,
@@ -4821,12 +4873,45 @@ function evaluatePendingInstall(input) {
   }
   const order = compareVersions(marker.targetVersion, input.runningVersion);
   if (order !== null && order < 0) return { kind: "stale", marker };
+  if (input.installInFlight === true) return { kind: "in-flight", marker };
   return { kind: "failed", marker };
 }
-function installFailurePayload(marker, runningVersion, options = {}) {
+function pendingInstallAgeSeconds(marker, now = Date.now()) {
+  if (!marker.startedAt) return null;
+  const started = Date.parse(marker.startedAt);
+  if (Number.isNaN(started)) return null;
+  return (now - started) / 1e3;
+}
+function isInstallInFlight(input) {
+  if (!input.marker || !input.jobLoaded) return false;
+  const age = pendingInstallAgeSeconds(input.marker, input.now);
+  if (age === null) return false;
+  return age >= 0 && age <= PENDING_INSTALL_RECENCY_SECONDS;
+}
+function launchdJobLoaded(jobLabel, probe) {
+  if (!jobLabel) return false;
+  return probe(jobLabel) === 0;
+}
+function installStartedText(marker) {
   const started = marker.startedAt ? new Date(marker.startedAt) : null;
-  const startedText = started && !Number.isNaN(started.getTime()) ? started.toLocaleString() : "at an unknown time";
+  return started && !Number.isNaN(started.getTime()) ? started.toLocaleString() : "at an unknown time";
+}
+function installFailurePayload(marker, runningVersion, options = {}) {
+  const startedText = installStartedText(marker);
   const logText = options.shipItLogPath ? ` Squirrel's own log is at ${options.shipItLogPath}.` : "";
+  if (options.cancelledByRelaunch === true) {
+    return {
+      message: `The update to version ${marker.targetVersion} was cancelled because Local Operator was opened while the update was installing. Version ${runningVersion} is still running.`,
+      remedy: {
+        text: "Quit Local Operator and replace it in Applications with a fresh copy, or update again from the app — and leave it closed until the update finishes.",
+        url: DOWNLOAD_PAGE_URL
+      },
+      detail: `Install started ${startedText} from ${marker.artifactPath || "an unknown artifact"}. Squirrel cancels an install when an instance of the app is running.${logText}`,
+      targetVersion: marker.targetVersion,
+      attempts: options.attempts ?? 1,
+      cancelledByRelaunch: true
+    };
+  }
   return {
     message: `The update to version ${marker.targetVersion} didn't finish, so version ${runningVersion} is still running.`,
     remedy: {
@@ -4838,6 +4923,13 @@ function installFailurePayload(marker, runningVersion, options = {}) {
     attempts: options.attempts ?? 1
   };
 }
+function installInFlightPayload(marker, runningVersion) {
+  return {
+    targetVersion: marker.targetVersion,
+    message: `Version ${marker.targetVersion} can't finish installing while Local Operator is open — keeping it open cancels the install. Quit and leave it closed until the app opens again by itself.`,
+    detail: `Install started ${installStartedText(marker)} from ${marker.artifactPath || "an unknown artifact"}, while version ${runningVersion} was running.`
+  };
+}
 function shipItJobLabel(bundleId) {
   return `${bundleId}.ShipIt`;
 }
@@ -4853,14 +4945,17 @@ function watchdogSwapTarget(input) {
   return input.target;
 }
 function watchdogSignals(platform) {
+  if (platform !== "darwin") return { jobProbe: null, plistReader: null };
   return { jobProbe: "launchctl", plistReader: "/usr/bin/plutil" };
 }
 function buildWatchdogPlan(input) {
-  const signals = input.signals ?? watchdogSignals();
+  const signals = input.signals ?? watchdogSignals(input.platform);
   const timeoutSeconds = input.timeoutSeconds ?? WATCHDOG_TIMEOUT_SECONDS;
+  const hardTimeoutSeconds = input.hardTimeoutSeconds ?? WATCHDOG_HARD_TIMEOUT_SECONDS;
   const intervalSeconds = input.intervalSeconds ?? 3;
   const settleSeconds = input.settleSeconds ?? 5;
   const appearSeconds = input.appearSeconds ?? 30;
+  const announceSeconds = input.announceSeconds ?? 5;
   const plistTimeoutSeconds = input.plistReadTimeoutSeconds ?? PLIST_READ_TIMEOUT_SECONDS;
   const script = `#!/bin/sh
 # ${WATCHDOG_TOKEN}
@@ -4891,12 +4986,30 @@ function buildWatchdogPlan(input) {
 #       one beyond it: the new app is in place and ShipIt has nothing left to do.
 #       This is what makes an early exit safe rather than a guess, and it is the
 #       path a failed-but-swapped install takes.
-#   (c) the bound arrived with no decision. Trying is still better than leaving
-#       the user with nothing, and the bound is what makes the previous
-#       version's silent exit 0 impossible. It is ~2.4x the slowest ShipIt
-#       attempt measured on this machine (255s from request to verdict for a
-#       1 GiB app), and it is the ONE path that can start the app while a swap
-#       is still in flight - an accepted risk, not an oversight.
+#   (c) a bound arrived with no decision. Trying is still better than leaving the
+#       user with nothing, and the bound is what makes the previous version's
+#       silent exit 0 impossible.
+#
+# (c) has a HOLD in front of it whenever the job is known and still loaded, and
+# that hold is the 2026-09-13 incident written into the script. At the soft bound
+# the install can be perfectly alive - that day it was, and it needed another
+# four minutes to move and code-verify a 1 GiB bundle on a host at load ~95 - and
+# Squirrel asks "is any instance of the target app running?" one last time before
+# it swaps. A launch there is not a rescue, it is the kill: the install aborts
+# (App Still Running, SQRLInstallerErrorDomain -9) and this script's own relaunch
+# is the whole cause of the failure the user is then told about. So while the job
+# is still loaded the script holds, says the update is still installing, and
+# starts the app only at the hard bound - where a job that old is better assumed
+# hung than live. (c) is therefore the ONE path that can start the app while a
+# swap is still in flight - an accepted risk, now taken at the hard bound rather
+# than at the soft one.
+#
+# It also says what is happening while it waits, because the silence is what cost
+# the operator the install: the window vanishes, nothing says the install takes
+# minutes, and reopening the app is the natural thing to do - which is exactly
+# what aborts it. Notifying is best-effort in every sense (notifications muted,
+# osascript blocked, no notifier at all), so no notification failure may change
+# what this script decides or what it exits with.
 #
 # With no job label to ask about, the job cannot be consulted at all, so the swap
 # state is the whole signal: the script waits for (b) rather than spending an
@@ -4919,10 +5032,35 @@ if [ -z "$APP_PID" ] || [ -z "$BUNDLE" ]; then
 fi
 now() { date +%s; }
 app_running() { kill -0 "$APP_PID" 2>/dev/null; }
-# launchctl list <label> exits 113 when the job is not loaded, 0 when it is.
-# With no probe there is no launchd to ask, and this answers "cannot ask" rather
-# than "not loaded": job_known below requires the probe for the same reason.
-shipit_loaded() { [ -n "$SHIPIT_PROBE" ] && [ -n "$SHIPIT_JOB" ] && "$SHIPIT_PROBE" list "$SHIPIT_JOB" >/dev/null 2>&1; }
+# Tell the user what is going on, in the only way available: the app is dead
+# while this runs, so this is osascript and nothing else - no app process, no
+# updater. Backgrounded and status-dropped, because a notification is best-effort
+# in every sense: muted Notification Center, osascript blocked by policy, or no
+# notifier at all must never change what this script decides, when it retries, or
+# what it exits with. The text travels as its own argument rather than inside the
+# AppleScript, so no word of it needs escaping.
+notify() {
+	[ -n "$1" ] || return 0
+	osascript -e 'on run argv' -e 'display notification (item 1 of argv) with title (item 2 of argv)' -e 'end run' "$1" "Local Operator" >/dev/null 2>&1 &
+}
+# launchctl list <label> exits 0 when the job is loaded and 113 when launchd has
+# no such job; every other status is not an answer at all. An unanswerable probe
+# is read as "still loaded" - the safe direction - because the one decision this
+# feeds here is whether to start the app into a live install, and a launchctl
+# that failed for some other reason (not on PATH, a transient launchd error) must
+# not be what starts it. The other direction is not licensed by it: the hard
+# bound still ends the wait, so an unanswered probe costs time rather than the
+# install. A definite 113 still means the install declared itself over, which is
+# the one answer that ends the wait early. With no probe at all there is no
+# launchd to ask, and this answers "cannot ask" rather than "not loaded":
+# job_known below requires the probe for the same reason.
+shipit_loaded() {
+	[ -n "$SHIPIT_PROBE" ] && [ -n "$SHIPIT_JOB" ] || return 1
+	"$SHIPIT_PROBE" list "$SHIPIT_JOB" >/dev/null 2>&1
+	job_status=$?
+	[ "$job_status" -eq 113 ] && return 1
+	return 0
+}
 # (b), the swap's own state: is the app at the target path AT OR BEYOND the
 # version this update was for? plutil rather than \`defaults read\`, which reads
 # through a preference domain and can answer from a stale cache; a half-written
@@ -5048,11 +5186,22 @@ decided() {
 	return 1
 }
 deadline=$(( $(now) + ${timeoutSeconds} ))
+hard_deadline=$(( $(now) + ${hardTimeoutSeconds} ))
 # 1. The install only starts once the old app has exited.
 while app_running; do
 	if [ "$(now)" -ge "$deadline" ]; then break; fi
 	sleep ${intervalSeconds}
 done
+# 1b. The app is gone, so an install is at work: say so a few seconds in, so the
+#     window that just vanished comes with an explanation. This is the moment the
+#     operator of 2026-09-13 was left guessing, and reopening the app four
+#     minutes later is what aborted their install. Skipped when the app is still
+#     running - a quit the user cancelled, where nothing is being installed and
+#     nothing should be claimed.
+if ! app_running; then
+	sleep ${announceSeconds}
+	notify "Installing the update. Keep Local Operator closed until it opens again by itself — this can take a few minutes."
+fi
 # 2. ShipIt's job is submitted as part of the quit, so it may not be loaded the
 #    instant the app is gone: give it a bounded window to appear before treating
 #    "no job" as "the install is over". Skipped when there is no label to ask
@@ -5066,12 +5215,48 @@ if [ "$job_known" -eq 1 ]; then
 	done
 fi
 # 3. Wait for the install to be decided - by the job going, or by the swap
-#    landing - and never past the bound.
+#    landing. The soft bound ends this wait only when there is no loaded job
+#    answering for the install: see the hold below.
+holding=0
 while :; do
 	if decided; then break; fi
-	if [ "$(now)" -ge "$deadline" ]; then break; fi
+	if [ "$(now)" -ge "$deadline" ]; then
+		if [ "$job_known" -eq 1 ] && shipit_loaded; then
+			holding=1
+			notify "The update is still installing. Keep Local Operator closed; it will open again when the install finishes."
+		fi
+		break
+	fi
 	sleep ${intervalSeconds}
 done
+# 3b. The hold. The soft bound arrived with the install's job still loaded, so
+#     the install is alive and a launch here is what aborts it: Squirrel's last
+#     question before it swaps is whether any instance of the app is running,
+#     and on 2026-09-13 our own relaunch was the instance that answered yes. The
+#     job going or the swap landing still ends this at once - both are decisions
+#     the install made - and otherwise the hard bound does, which is where
+#     "better a live swap than no app at all" takes over.
+#
+#     The hard bound's notice names the action the panel will ask for instead of
+#     a different one. What the user sees next is the app coming back with the
+#     in-flight panel, whose copy is "quit and leave it closed until the app
+#     opens again by itself" - so a notice that ended "check for updates when it
+#     is back" told them the install was over at the exact moment the app was
+#     about to say it was still running, and two authorities seconds apart with
+#     opposite instructions is worse than either alone (UX U10). The notice now
+#     states what is happening and hands over to that panel rather than
+#     pre-empting it: the instruction the user acts on is the panel's, and it is
+#     the correct one - quitting again is what lets the swap finish.
+if [ "$holding" -eq 1 ]; then
+	while :; do
+		if decided; then break; fi
+		if [ "$(now)" -ge "$hard_deadline" ]; then
+			notify "The update is taking longer than expected. Local Operator is opening again so you are not left without it — if it says the update is still installing, quit it and leave it closed until the install finishes."
+			break
+		fi
+		sleep ${intervalSeconds}
+	done
+fi
 # Let Squirrel's own relaunch (which happens as the job finishes) land first.
 sleep ${settleSeconds}
 # 4. Nothing to do if Squirrel relaunched the app or the user started it. This is
@@ -5096,9 +5281,46 @@ exit 0
       LO_UPDATE_WATCHDOG_SHIPIT_PROBE: signals.jobProbe ?? "",
       LO_UPDATE_WATCHDOG_PLIST_READER: signals.plistReader ?? ""
     },
-    timeoutSeconds
+    timeoutSeconds,
+    hardTimeoutSeconds
   };
 }
+function removeStagedTree(input) {
+  const attempts = input.attempts ?? 3;
+  const delayMs = input.delayMs ?? 250;
+  const sleep = input.sleep ?? defaultSleep;
+  let error = null;
+  for (let attempt = 1; attempt <= attempts; attempt++) {
+    try {
+      input.remove(input.path);
+    } catch (thrown) {
+      error = String(thrown);
+    }
+    if (!input.exists(input.path)) {
+      return { removed: true, attempts: attempt, error: null };
+    }
+    if (attempt < attempts) sleep(delayMs);
+  }
+  return {
+    removed: false,
+    attempts,
+    error: error ?? `the staged tree at ${input.path} is still there`
+  };
+}
+function defaultSleep(ms) {
+  if (ms <= 0) return;
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function reapStagedTree(path2) {
+  const removal = removeStagedTree({
+    path: path2,
+    remove: (target2) => fs.rmSync(target2, { recursive: true, force: true }),
+    exists: (target2) => fs.existsSync(target2)
+  });
+  if (!removal.removed) {
+    throw new Error(removal.error ?? `could not remove ${path2}`);
+  }
+}
 function reapFailedInstall(input) {
   const result = {
     jobLabel: null,
@@ -5414,6 +5636,7 @@ const VERSION_LINE_REGEX = /Version:\s*([^\n]+)/;
 const VERSION_CLEAN_REGEX = /^v/i;
 const BETA_VERSION_REGEX = /v\d+\.\d+\.\d+\.beta\.\d+/;
 const BUNDLE_ID_REGEX = /^[\w.-]+$/;
+const INSTALL_IN_FLIGHT_RECHECK_MS = 1e4;
 const LAUNCHCTL_NOT_LOADED_REGEX = /could not find|no such process/i;
 const SEAL_PROBE_TIMEOUT_MS = 45e3;
 function versionSuffix(version) {
@@ -5498,6 +5721,38 @@ class UpdateService {
   /** A failed install detected from the marker on this start, if any. */
   pendingInstallFailure = null;
   installFailureDelivered = false;
+  /**
+   * An install this process found still running, if any.
+   *
+   * The opposite fact to `pendingInstallFailure`, and kept apart from it: this
+   * one means the update is still in progress and the user has to leave the app
+   * closed for it to finish. Nothing may be cleared, reaped or reported while
+   * it is up.
+   */
+  pendingInstallInFlight = null;
+  installInFlightDelivered = false;
+  /**
+   * True once this process has seen its own install run.
+   *
+   * It is what lets a later failure name the real cause: an install this app
+   * watched start and then not finish, on a machine where the app was open for
+   * part of it, was cancelled by that relaunch (Squirrel asks whether any
+   * instance is running before it swaps), and saying "the update didn't finish"
+   * there sends the user back to retry the one thing that cannot work.
+   */
+  installWasInFlight = false;
+  /** The pending re-check of a live install, while the app is open. */
+  installInFlightTimer = null;
+  /**
+   * True once a quit following an in-flight install has made sure the app will
+   * come back.
+   *
+   * The two callers are the same quit seen twice - `window-all-closed` decides
+   * and `before-quit` runs as it goes through - so without this the launchd
+   * probe, the `ps` read and the "no watchdog is running" log all happen twice
+   * for one quit.
+   */
+  inFlightQuitWatchdogEnsured = false;
   /**
    * True while `quit-and-install` is running its pre-flight.
    *
@@ -5615,12 +5870,27 @@ class UpdateService {
    * update did not happen. Everything the user learns afterwards starts here:
    * the notice, the durable record it can be found in later, and the cleanup of
    * what Squirrel left running.
+   *
+   * The one case that must NOT be read as a failure is the install that is still
+   * running, and it is the 2026-09-13 incident: the app comes back mid-install
+   * on the old version, because the swap has not happened yet. That used to
+   * clear the marker, remove the very job doing the installing, and tell the
+   * user the update had failed - two seconds before ShipIt aborted the install
+   * on its own final check. So the job is probed first, a live install is left
+   * alone entirely, and the re-check below reports what really happens to it.
    */
   recoverPendingInstall() {
     const marker = readPendingInstallMarker(this.markerDir());
     const outcome = evaluatePendingInstall({
       marker,
-      runningVersion: electron.app.getVersion()
+      runningVersion: electron.app.getVersion(),
+      // Probed once per evaluation, and only on macOS: a loaded job plus a
+      // current marker is what makes "still on the old version" an install in
+      // progress rather than an install that failed.
+      installInFlight: isInstallInFlight({
+        marker,
+        jobLoaded: this.shipItInstallJobLoaded()
+      })
     });
     switch (outcome.kind) {
       case "none":
@@ -5641,27 +5911,53 @@ class UpdateService {
         this.reapWatchdog(outcome.marker, true);
         clearPendingInstallMarker(this.markerDir());
         return;
+      case "in-flight": {
+        this.installWasInFlight = true;
+        logger.info(
+          `Update marker: the install of version ${outcome.marker.targetVersion} is still running (its install job is loaded). Leaving the marker, the install job and the relaunch watchdog in place.`,
+          LogFileType.UPDATE_SERVICE
+        );
+        this.pendingInstallInFlight = installInFlightPayload(
+          outcome.marker,
+          electron.app.getVersion()
+        );
+        this.scheduleInstallInFlightDelivery();
+        this.scheduleInstallInFlightRecheck();
+        return;
+      }
       case "failed": {
         const shipItLogPath = this.shipItLog();
         const record = recordInstallFailure(this.markerDir(), {
           payload: installFailurePayload(outcome.marker, electron.app.getVersion(), {
-            shipItLogPath
+            shipItLogPath,
+            cancelledByRelaunch: this.installWasInFlight
           }),
+          // The record names the version that is running now, which is the same
+          // answer the payload above was built from: Settings renders it as
+          // "Version X is running", and it used to carry the previous failure's
+          // version forward instead (QA Q1).
+          runningVersion: electron.app.getVersion(),
           startedAt: outcome.marker.startedAt || null,
           detectedAt: (/* @__PURE__ */ new Date()).toISOString()
         });
         const payload = installFailurePayload(
           outcome.marker,
           electron.app.getVersion(),
-          { attempts: record.attempts, shipItLogPath }
+          {
+            attempts: record.attempts,
+            shipItLogPath,
+            // An install this process watched run and then not finish, with the
+            // app open for part of it, was cancelled by that relaunch.
+            cancelledByRelaunch: this.installWasInFlight
+          }
         );
         logger.error(
           `Update marker: install of version ${outcome.marker.targetVersion} did not complete (attempt ${record.attempts}). ${payload.detail}`,
           LogFileType.UPDATE_SERVICE
         );
         this.pendingInstallFailure = payload;
+        this.stopInstallInFlightRecheck();
         this.reapWatchdog(outcome.marker, false);
-        clearPendingInstallMarker(this.markerDir());
         this.reapFailedInstallLeftovers();
         this.schedulePendingInstallFailureDelivery();
       }
@@ -5742,7 +6038,13 @@ class UpdateService {
         },
         exists: (path2) => fs.existsSync(path2),
         listDir: (dir) => fs.readdirSync(dir),
-        removeDir: (dir) => fs.rmSync(dir, { recursive: true, force: true }),
+        // Retried, because the draw this cleans up is a race: on 2026-09-13
+        // ShipIt was moving this very tree into place while the reap walked
+        // it, and the rmdir it lost surfaced as ENOTDIR - which `rmSync`
+        // does not retry (see `removeStagedTree`). A tree that cannot be
+        // removed after that is still reported, because it is ~1 GiB the
+        // user's disk is paying for.
+        removeDir: (dir) => reapStagedTree(dir),
         log
       });
       if (result.errors.length > 0) {
@@ -5761,9 +6063,12 @@ class UpdateService {
   /**
    * Deliver the failed-install notice once the renderer can hear it.
    *
-   * The marker is read while the window is still loading, so the push happens
-   * on `did-finish-load` with a delayed fallback: the component subscribes from
-   * a React effect, which may run after the load event.
+   * The single delivery path for every install failure, read at start-up or
+   * found on a re-check: the marker is read while the window is still loading
+   * (and, on a re-check, the window is up but the React effect that subscribes
+   * is not provably past), so the push happens on `did-finish-load` with a
+   * delayed fallback. One path rather than two is what keeps "delivered"
+   * meaning the same thing in both cases (review R2).
    */
   schedulePendingInstallFailureDelivery() {
     if (!this.pendingInstallFailure) return;
@@ -5780,11 +6085,190 @@ class UpdateService {
       return;
     }
     this.installFailureDelivered = true;
+    this.pendingInstallInFlight = null;
+    clearPendingInstallMarker(this.markerDir());
     logger.info(
       "Reported a failed update install to the renderer",
       LogFileType.UPDATE_SERVICE
     );
   }
+  /**
+   * A substituted answer to "is this app's install job loaded", or null.
+   *
+   * The production answer is the launchd probe in `shipItInstallJobLoaded`, and
+   * it asks about a label read from the RUNNING BUNDLE (`shipItJob`). A test or a
+   * harness process that is not that bundle has no label to ask about, so the
+   * whole in-flight path - recovery's reading, the re-check, and the quit below -
+   * is otherwise unreachable from a suite. This is the same shape as the
+   * watchdog's own probe, which is invoked by name precisely so a harness can
+   * substitute it: one seam for the whole answer, so what a test drives is the
+   * rule production uses rather than a second copy of it. Production never sets
+   * it.
+   */
+  installJobLoadedProbe = null;
+  /**
+   * Whether this app's ShipIt install job is loaded, right now.
+   *
+   * This is the machine's own answer to "is an install in flight", and the only
+   * answer that can tell a live install apart from the job a failed one left
+   * behind. It is asked of launchd by label rather than inferred from a process
+   * name, so nothing else on the machine can be mistaken for it. Off macOS there
+   * is no launchd to ask, so the answer is a plain no and recovery stays
+   * version-only there, exactly as it is today.
+   */
+  shipItInstallJobLoaded() {
+    if (this.installJobLoadedProbe) return this.installJobLoadedProbe();
+    const jobProbe = watchdogSignals(process.platform).jobProbe;
+    if (!jobProbe) return false;
+    return launchdJobLoaded(this.shipItJob(), (label) => {
+      const result = node_child_process.spawnSync(jobProbe, ["list", label], {
+        encoding: "utf8",
+        timeout: 5e3
+      });
+      return result.error || result.status == null ? null : result.status;
+    });
+  }
+  /**
+   * Deliver the still-installing notice once the renderer can hear it.
+   *
+   * Same shape and the same reason as the failure's delivery: the marker is read
+   * while the window is still loading, and the component subscribes from a React
+   * effect that can run after `did-finish-load`.
+   */
+  scheduleInstallInFlightDelivery() {
+    if (!this.pendingInstallInFlight || this.installInFlightDelivered) return;
+    const deliver = () => this.deliverPendingInstallInFlight();
+    const webContents = this.mainWindow?.webContents;
+    if (webContents && !webContents.isDestroyed()) {
+      webContents.once("did-finish-load", deliver);
+    }
+    setTimeout(deliver, 5e3);
+  }
+  deliverPendingInstallInFlight() {
+    if (!this.pendingInstallInFlight || this.installInFlightDelivered) return;
+    if (!this.sendToRenderer(
+      "update-install-in-flight",
+      this.pendingInstallInFlight
+    )) {
+      return;
+    }
+    this.installInFlightDelivered = true;
+    logger.info(
+      "Reported an install still in flight to the renderer",
+      LogFileType.UPDATE_SERVICE
+    );
+  }
+  /**
+   * Re-check a live install while the app stays open, until it settles.
+   *
+   * The panel that says "the update is still installing" cannot be the end of
+   * the story: ShipIt decides within a couple of minutes of the app coming back
+   * (it asks whether any instance is running as its final validation), and the
+   * user has to hear what that decision was. Re-evaluating is what produces it -
+   * the job no longer loaded means the install is over, and the marker plus the
+   * old running version then say truthfully that it was cancelled. The loop ends
+   * by itself: once the marker is older than
+   * `PENDING_INSTALL_RECENCY_SECONDS` nothing calls it current, the next
+   * evaluation is a failure, and that branch stops the timer.
+   */
+  scheduleInstallInFlightRecheck() {
+    if (this.installInFlightTimer) return;
+    this.installInFlightTimer = setTimeout(() => {
+      this.installInFlightTimer = null;
+      this.recoverPendingInstall();
+    }, INSTALL_IN_FLIGHT_RECHECK_MS);
+    this.installInFlightTimer.unref();
+  }
+  stopInstallInFlightRecheck() {
+    if (!this.installInFlightTimer) return;
+    clearTimeout(this.installInFlightTimer);
+    this.installInFlightTimer = null;
+  }
+  /**
+   * Make sure something will start the app again after a quit that is only
+   * getting out of an install's way.
+   *
+   * The watchdog from the original install is usually still there - it holds
+   * while the job is loaded now, rather than starting the app into the swap -
+   * but it may have run out its own bounds, and the user may be quitting hours
+   * later. Quitting without one would leave them with no app at all, which is
+   * the outcome this whole change exists to remove. Nothing is started when ours
+   * is alive, because two watchdogs relaunching at the same moment is a race
+   * with nothing to gain. The marker is left exactly as it is: its start time is
+   * what tells recovery this is still the same install.
+   */
+  ensureWatchdogAfterInFlightQuit(marker) {
+    const pid = marker.watchdogPid;
+    const commandLine = pid == null ? null : readCommandOutput("/bin/ps", ["-o", "command=", "-p", String(pid)]);
+    if (watchdogIsOurs({
+      alive: commandLine != null,
+      commandLine,
+      installSucceeded: true
+    })) {
+      logger.info(
+        `Relaunch watchdog ${pid} is still running; it will start the app when the install settles.`,
+        LogFileType.UPDATE_SERVICE
+      );
+      return;
+    }
+    const launched = this.launchWatchdog(marker.targetVersion);
+    logger.info(
+      launched ? `Started relaunch watchdog ${launched} for the install already in flight; it will start the app when the install's job goes.` : "No relaunch watchdog is running for the install in flight and none could be started; the app will need starting by hand after it quits.",
+      LogFileType.UPDATE_SERVICE
+    );
+  }
+  /**
+   * The pending-install marker, if the machine says an install is live now.
+   *
+   * The marker is read first, because the ordinary answer to "is an update
+   * installing" is no and a file read answers it; the launchd probe behind it is
+   * a process spawn and is only worth paying for when there is a marker to ask
+   * about.
+   */
+  livePendingInstallMarker() {
+    const marker = readPendingInstallMarker(this.markerDir());
+    if (!marker) return null;
+    return isInstallInFlight({
+      marker,
+      jobLoaded: this.shipItInstallJobLoaded()
+    }) ? marker : null;
+  }
+  /**
+   * Treat a quit as a quit for an install that is in flight, and make sure
+   * something will start the app again.
+   *
+   * Two gestures reach this, and a user believes both are harmless: the macOS
+   * close-the-last-window close, and any ordinary quit (Cmd+Q, the dock, the
+   * menu). `window-all-closed` on macOS deliberately leaves the app running with
+   * no window, which is right for every ordinary close - but a running instance
+   * of this app is exactly what Squirrel's final validation aborts an install on,
+   * so a user who closes the window during an install has cancelled their update
+   * without being told, and reached the incident this whole change exists to
+   * remove by the platform's most familiar gesture (UX U1). The relaunch promise
+   * was also button-shaped: a plain quit while an install was in flight left it
+   * resting on whatever watchdog the install happened to still have (UX U2).
+   *
+   * The probe is the machine's answer rather than the renderer's, so this holds
+   * even when the panel was never drawn - the app can come back mid-install and
+   * have its last window closed before the renderer has heard anything.
+   *
+   * Returns true when an install was in flight, so a caller that is deciding
+   * whether to quit knows the close was taken over. Nothing here touches the
+   * marker, the install's job or the failure record: this only gets the app out
+   * of Squirrel's way and makes sure it comes back.
+   */
+  quitForInFlightInstall(context) {
+    const marker = this.livePendingInstallMarker();
+    if (!marker) return false;
+    if (this.inFlightQuitWatchdogEnsured) return true;
+    this.inFlightQuitWatchdogEnsured = true;
+    logger.info(
+      `Quitting so the in-flight update install can finish (${context}).`,
+      LogFileType.UPDATE_SERVICE
+    );
+    this.ensureWatchdogAfterInFlightQuit(marker);
+    return true;
+  }
   /**
    * Kill a watchdog still running from the recorded install attempt.
    *
@@ -6092,7 +6576,13 @@ ${heal.removed.join("\n")}`,
       targetVersion: watchdogSwapTarget({
         target: targetVersion,
         running: electron.app.getVersion()
-      })
+      }),
+      // Stated rather than read off `process.platform` at the plan: this
+      // watchdog exists for Squirrel.Mac's ShipIt, the guard above already
+      // refuses it anywhere else, and the script's two probes (launchd's job
+      // lookup, `plutil`) are generated for the platform the script runs on
+      // rather than for whichever host planned it (see `watchdogSignals`).
+      platform: "darwin"
     });
     try {
       const child = node_child_process.spawn("sh", ["-c", plan.script], {
@@ -6102,7 +6592,7 @@ ${heal.removed.join("\n")}`,
       });
       child.unref();
       logger.info(
-        `Started the update relaunch watchdog (pid ${child.pid ?? "unknown"}): it starts the app again as soon as the install's job goes or version ${plan.env.LO_UPDATE_WATCHDOG_TARGET_VERSION || "unknown"} is in place, and at the ${plan.timeoutSeconds}s bound if neither happens.`,
+        `Started the update relaunch watchdog (pid ${child.pid ?? "unknown"}): it starts the app again as soon as the install's job goes or version ${plan.env.LO_UPDATE_WATCHDOG_TARGET_VERSION || "unknown"} is in place, and at the ${plan.timeoutSeconds}s bound if neither happens - or at the ${plan.hardTimeoutSeconds}s hard bound when the install's job is still loaded at the first, which is the case where starting the app would cancel the install.`,
         LogFileType.UPDATE_SERVICE
       );
       return child.pid ?? null;
@@ -6125,6 +6615,7 @@ ${heal.removed.join("\n")}`,
       clearInterval(this.updateCheckInterval);
       this.updateCheckInterval = null;
     }
+    this.stopInstallInFlightRecheck();
     electronUpdater.autoUpdater.removeAllListeners();
     electron.ipcMain.removeHandler("check-for-updates");
     electron.ipcMain.removeHandler("check-for-backend-updates");
@@ -6133,6 +6624,7 @@ ${heal.removed.join("\n")}`,
     electron.ipcMain.removeHandler("update-backend");
     electron.ipcMain.removeHandler("download-update");
     electron.ipcMain.removeHandler("quit-and-install");
+    electron.ipcMain.removeHandler("quit-for-update-install");
     this.mainWindow = null;
   }
   /**
@@ -6497,6 +6989,19 @@ ${heal.removed.join("\n")}`,
       electronUpdater.autoUpdater.quitAndInstall(false, true);
       return true;
     });
+    electron.ipcMain.handle("quit-for-update-install", () => {
+      const marker = readPendingInstallMarker(this.markerDir());
+      logger.info(
+        "Quitting so the in-flight update install can finish.",
+        LogFileType.UPDATE_SERVICE
+      );
+      if (marker && !this.inFlightQuitWatchdogEnsured) {
+        this.inFlightQuitWatchdogEnsured = true;
+        this.ensureWatchdogAfterInFlightQuit(marker);
+      }
+      setImmediate(() => electron.app.quit());
+      return true;
+    });
   }
   /**
    * Check for updates
@@ -7658,6 +8163,19 @@ function createApplicationMenu() {
         ...process.platform === "darwin" ? [
           { type: "separator" },
           { role: "front" },
+          /*
+           * `close` is what gives the window the standard Cmd+W, and on macOS
+           * it is not implied by anything else here: the Window menu carried
+           * `minimize`/`zoom`/`front` and no close item, so the gesture the
+           * in-flight update panel invites ("quit and leave it closed until
+           * the app opens again by itself") resolved to nothing at all - the
+           * red button worked and the keyboard did not (UX U9). It belongs
+           * here rather than in File because the app's own File menu holds a
+           * lone `quit`, and this gesture has to reach the same
+           * `window-all-closed` path the red button takes, which is the one
+           * this change made safe for an install in flight.
+           */
+          { role: "close" },
           { type: "separator" },
           { role: "window" }
         ] : [{ role: "close" }]
@@ -7851,6 +8369,7 @@ if (windowLaunch.mode !== "normal") {
   console.log(`[window-mode] ${describeWindowLaunch(windowLaunch)}`);
 }
 let mainWindow = null;
+let activeUpdateService = null;
 const zoomInFromEvent = () => {
   if (mainWindow) {
     const webContents = mainWindow.webContents;
@@ -8251,6 +8770,7 @@ electron.app.whenReady().then(async () => {
       updateService = null;
     }
     updateService = new UpdateService(mainWindow, backendService);
+    activeUpdateService = updateService;
     mainWindow.on("closed", () => {
       if (updateService) {
         updateService.dispose();
@@ -8291,6 +8811,10 @@ electron.app.whenReady().then(async () => {
 });
 electron.app.on("window-all-closed", () => {
   if (process.platform === "darwin") {
+    if (activeUpdateService?.quitForInFlightInstall("last window closed")) {
+      electron.app.quit();
+      return;
+    }
     logger.info(
       "All windows closed, but keeping app active (macOS platform)",
       LogFileType.BACKEND
@@ -8469,6 +8993,7 @@ electron.app.on("will-quit", async (event) => {
 electron.app.on("before-quit", () => {
   logger.info("App is about to quit", LogFileType.BACKEND);
   electron.globalShortcut.unregisterAll();
+  activeUpdateService?.quitForInFlightInstall("app quit");
 });
 process.on("exit", () => {
   logger.info(