local-operator-ui 0.34.11 → 0.34.13

package/out/main/index.js

@@ -2088,6 +2088,26 @@ const desktopRequestUnion = zod.z.discriminatedUnion("op", [
      */
     keys: zod.z.array(zod.z.string().min(1).max(512)).max(256).optional(),
     force: zod.z.boolean().optional()
+  }).strict(),
+  /*
+   * THE PREVIEWS' SIGNED STATIC URLS (file-serving RFC § 4, Phase A adoption).
+   * The renderer cannot read the core's serve record (no filesystem, no record
+   * store), so the previews ask MAIN - which already holds the desktop bearer -
+   * to mint a short-lived signed URL for one static route + path. The route is
+   * public in Phase A; this op is what lets the previews keep working when a
+   * later core phase gates it, and a core that predates the route answers 404,
+   * which the previews read as their fallback signal, not an error.
+   *
+   * `route` is the backend's own signed-string vocabulary (the four static
+   * family ids), held here so a route the signature cannot cover fails at this
+   * boundary. `ttlS` stays within the backend's documented cap (600 default,
+   * 3600 max) - a bound, not a preference.
+   */
+  zod.z.object({
+    op: zod.z.literal("static.sign"),
+    route: zod.z.enum(["images", "videos", "audio", "html"]),
+    path: zod.z.string().min(1),
+    ttlS: zod.z.number().int().min(1).max(3600).optional()
   }).strict()
 ]);
 const desktopRequestSchema = desktopRequestUnion.superRefine(
@@ -3648,6 +3668,23 @@ function desktopEndpoint(request) {
           ...request.force !== void 0 ? { force: request.force } : {}
         }
       };
+    /*
+     * The previews' signed static URLs: NOT under `/v1/desktop/` - the core's
+     * sign route accepts the desktop bearer OR its local access token - so an
+     * answer here never counts as pairing evidence (`desktopAnswerProvesPairing`
+     * reads the prefix, deliberately). `ttl_s` is omitted unless asked for, so
+     * the core's own default (600 s) is the one number for "unspecified".
+     */
+    case "static.sign":
+      return {
+        path: "/v1/static/sign",
+        method: "POST",
+        body: {
+          route: request.route,
+          path: request.path,
+          ttl_s: request.ttlS
+        }
+      };
   }
 }
 const MAX_PROBE_PATHS = 64;
@@ -4484,6 +4521,9 @@ const SHIPIT_RELATIVE_PATH = path$1.join(
 const INSTALLER_TOKEN = "local-operator-update-installer";
 const UPDATE_STAGING_DIR = "update-staging";
 const INSTALLER_POLL_SECONDS = "0.2";
+const INSTALLER_FIRST_GRACE_SECONDS = 60;
+const INSTALLER_SECOND_GRACE_SECONDS = 20;
+const INSTALLER_KILL_SETTLE_SECONDS = "0.5";
 const EXTRACTION_TIMEOUT_MS = 10 * 6e4;
 function shipItPathInBundle(bundlePath) {
   if (!bundlePath) return null;
@@ -4563,6 +4603,8 @@ function shipItStatePlist(input) {
   };
 }
 function buildInstallerSpawn(input) {
+  const firstGrace = input.graceSeconds?.first ?? INSTALLER_FIRST_GRACE_SECONDS;
+  const secondGrace = input.graceSeconds?.second ?? INSTALLER_SECOND_GRACE_SECONDS;
   const script = `#!/bin/sh
 # ${INSTALLER_TOKEN}
 #
@@ -4573,10 +4615,74 @@ function buildInstallerSpawn(input) {
 # (SQRLInstallerErrorDomain Code=-9, the 2026-09-18 09:37 install). So this waits
 # for the app's pid to go, and then replaces itself with the installer: one
 # process, one pid for the app to record, and no shell left in the way.
-while kill -0 "$1" 2>/dev/null; do
+#
+# THE WAIT IS BOUNDED AND LOGGED (2026-10-11): the unbounded shape waited 26 m
+# 49 s while the app sat alive with no window, and logged nothing anywhere. Each
+# stage below is bounded and writes one timestamped line to the installer's log;
+# the last stage starts the installer regardless, because a pid that survives
+# SIGKILL is a zombie and nothing more exists to wait for.
+app_pid=$1
+started=$(date +%s)
+log_stage() {
+	printf '%s ${INSTALLER_TOKEN}: %s\\n' "$(date '+%Y-%m-%dT%H:%M:%S')" "$1" >>"$LO_UPDATE_INSTALLER_LOG"
+}
+elapsed() {
+	printf '%d' "$(( $(date +%s) - started ))"
+}
+# A recycled pid is never signalled: before any kill, the target's command line
+# must still name the app's own executable ($LO_UPDATE_INSTALLER_APP_EXEC,
+# environment only - see the args comment at the callers).
+target_is_app() {
+	[ -n "$LO_UPDATE_INSTALLER_APP_EXEC" ] || return 1
+	_line=$(ps -o command= -p "$app_pid" 2>/dev/null) || return 1
+	case "$_line" in
+		*"$LO_UPDATE_INSTALLER_APP_EXEC"*) return 0 ;;
+	esac
+	return 1
+}
+start_installer() {
+	log_stage "starting the installer ($(elapsed)s in)"
+	exec "$LO_UPDATE_INSTALLER_SHIPIT" "$LO_UPDATE_INSTALLER_LABEL" "$LO_UPDATE_INSTALLER_STATE" >>"$LO_UPDATE_INSTALLER_LOG" 2>&1
+}
+log_stage "waiting up to ${firstGrace}s for the app to exit on its own"
+_end=$((started + ${firstGrace}))
+while kill -0 "$app_pid" 2>/dev/null; do
+	if [ "$(date +%s)" -ge "$_end" ]; then break; fi
 	sleep ${INSTALLER_POLL_SECONDS}
 done
-exec "$LO_UPDATE_INSTALLER_SHIPIT" "$LO_UPDATE_INSTALLER_LABEL" "$LO_UPDATE_INSTALLER_STATE" >>"$LO_UPDATE_INSTALLER_LOG" 2>&1
+if ! kill -0 "$app_pid" 2>/dev/null; then
+	log_stage "the app exited on its own ($(elapsed)s in)"
+	start_installer
+fi
+log_stage "the first grace expired with the app still there"
+if target_is_app; then
+	log_stage "asking the app to stop (SIGTERM)"
+	kill -TERM "$app_pid" 2>/dev/null
+	_end=$(( $(date +%s) + ${secondGrace} ))
+	while kill -0 "$app_pid" 2>/dev/null; do
+		if [ "$(date +%s)" -ge "$_end" ]; then break; fi
+		sleep ${INSTALLER_POLL_SECONDS}
+	done
+	if ! kill -0 "$app_pid" 2>/dev/null; then
+		log_stage "the app exited after SIGTERM ($(elapsed)s in)"
+		start_installer
+	fi
+	if target_is_app; then
+		log_stage "the second grace expired; forcing the pid gone (SIGKILL)"
+		kill -KILL "$app_pid" 2>/dev/null
+		sleep ${INSTALLER_KILL_SETTLE_SECONDS}
+		if kill -0 "$app_pid" 2>/dev/null; then
+			log_stage "the pid survived SIGKILL (a zombie or unkillable); nothing left to wait for"
+		else
+			log_stage "the app is gone after SIGKILL ($(elapsed)s in)"
+		fi
+	else
+		log_stage "target is not the app after SIGTERM; starting the installer"
+	fi
+	start_installer
+fi
+log_stage "target is not the app; starting the installer without signalling"
+start_installer
 `;
   return {
     script,
@@ -4584,7 +4690,8 @@ exec "$LO_UPDATE_INSTALLER_SHIPIT" "$LO_UPDATE_INSTALLER_LABEL" "$LO_UPDATE_INST
       LO_UPDATE_INSTALLER_SHIPIT: input.shipItPath,
       LO_UPDATE_INSTALLER_LABEL: input.label,
       LO_UPDATE_INSTALLER_STATE: input.statePath,
-      LO_UPDATE_INSTALLER_LOG: input.logPath
+      LO_UPDATE_INSTALLER_LOG: input.logPath,
+      LO_UPDATE_INSTALLER_APP_EXEC: input.appExecPath
     },
     // `sh -c <script> <name> <pid>`: the name is $0 and the pid is $1, so the
     // script text carries no path and no number that a process listing of it
@@ -4611,6 +4718,8 @@ const INSTALL_DISK_SLACK_BYTES = 256 * 1024 * 1024;
 const DOWNLOAD_PAGE_URL = "https://local-operator.com/download";
 const WATCHDOG_TIMEOUT_SECONDS = 600;
 const WATCHDOG_HARD_TIMEOUT_SECONDS = 1800;
+const WATCHDOG_APP_WAIT_NOTICE_SECONDS = 15;
+const WATCHDOG_APP_WAIT_FALLBACK_SECONDS = 2 * (INSTALLER_FIRST_GRACE_SECONDS + INSTALLER_SECOND_GRACE_SECONDS);
 const PENDING_INSTALL_RECENCY_MARGIN_SECONDS = 300;
 const PENDING_INSTALL_RECENCY_SECONDS = WATCHDOG_HARD_TIMEOUT_SECONDS + PENDING_INSTALL_RECENCY_MARGIN_SECONDS;
 const LAUNCH_HOLD_END_MARGIN_SECONDS = 60;
@@ -5346,13 +5455,15 @@ function watchdogSignals(platform) {
   return { jobProbe: "launchctl", plistReader: "/usr/bin/plutil" };
 }
 function buildWatchdogPlan(input) {
-  const signals = input.signals ?? watchdogSignals(input.platform);
+  const signals = input.signals ?? watchdogSignals(input.platform ?? "darwin");
   const timeoutSeconds = input.timeoutSeconds ?? WATCHDOG_TIMEOUT_SECONDS;
   const hardTimeoutSeconds = input.hardTimeoutSeconds ?? WATCHDOG_HARD_TIMEOUT_SECONDS;
   const intervalSeconds = input.intervalSeconds ?? 3;
   const settleSeconds = input.settleSeconds ?? 5;
   const appearSeconds = input.appearSeconds ?? 30;
   const announceSeconds = input.announceSeconds ?? 5;
+  const appWaitNoticeSeconds = input.appWaitNoticeSeconds ?? WATCHDOG_APP_WAIT_NOTICE_SECONDS;
+  const appWaitFallbackSeconds = input.appWaitFallbackSeconds ?? WATCHDOG_APP_WAIT_FALLBACK_SECONDS;
   const plistTimeoutSeconds = input.plistReadTimeoutSeconds ?? PLIST_READ_TIMEOUT_SECONDS;
   const script = `#!/bin/sh
 # ${WATCHDOG_TOKEN}
@@ -5450,6 +5561,27 @@ if [ -z "$APP_PID" ] || [ -z "$BUNDLE" ]; then
 fi
 now() { date +%s; }
 app_running() { kill -0 "$APP_PID" 2>/dev/null; }
+# THE WAIT'S OWN CLOCK (2026-10-11). The script is spawned as the quit begins, so
+# its own start IS the wait's start - elapsed is measured from here rather than
+# from the marker's startedAt, which is written before the quit and would need a
+# new seam through two collaborators for a difference of seconds.
+started=$(now)
+# "waiting 15 s" / "waiting 2 min 30 s": elapsed in the units a person reads,
+# with the seconds term dropped at an exact minute ("waiting 30 min") - "30 min
+# 0 s" reads like a clock fault rather than a wait (round-1 D2).
+elapsed_text() {
+	_seconds=$(( $(now) - started ))
+	if [ "$_seconds" -lt 0 ]; then _seconds=0; fi
+	if [ "$_seconds" -ge 60 ]; then
+		if [ $((_seconds % 60)) -eq 0 ]; then
+			printf '%d min' "$((_seconds / 60))"
+		else
+			printf '%d min %d s' "$((_seconds / 60))" "$((_seconds % 60))"
+		fi
+	else
+		printf '%d s' "$_seconds"
+	fi
+}
 # Whether ANY process is this install's ShipIt, for the pid that stopped being it.
 #
 # The same two facts installerElsewhere requires of a line in its listing: this
@@ -5676,8 +5808,31 @@ decided() {
 deadline=$(( $(now) + ${timeoutSeconds} ))
 hard_deadline=$(( $(now) + ${hardTimeoutSeconds} ))
 # 1. The install only starts once the old app has exited.
+#
+#    AND THE WAIT SPEAKS, INSTEAD OF LEAVING THE PERSON IN SILENCE (2026-10-11).
+#    The incident's app sat alive with no window for 26 m 49 s; this script was
+#    the only process left that could say anything, and its first step was
+#    silent until the soft bound - the person watched nothing happen and
+#    resolved it by hand ('kill -TERM', which is what let ShipIt exec). So the
+#    wait now says what it is waiting for and for how long, well before the
+#    installer's own escalation signals the app
+#    (WATCHDOG_APP_WAIT_NOTICE_SECONDS), and after the escalation has
+#    provably failed it hands over the action that works
+#    (WATCHDOG_APP_WAIT_FALLBACK_SECONDS). Each fires at most once; the
+#    kill switch silences both like every other notice (notify's own guard).
+app_wait_notice=0
+app_wait_fallback=0
 while app_running; do
 	if [ "$(now)" -ge "$deadline" ]; then break; fi
+	_waited=$(( $(now) - started ))
+	if [ "$app_wait_notice" -eq 0 ] && [ "$_waited" -ge ${appWaitNoticeSeconds} ]; then
+		app_wait_notice=1
+		notify "Waiting for Local Operator to close so the update can install (waiting $(elapsed_text)). No action is needed yet."
+	fi
+	if [ "$app_wait_fallback" -eq 0 ] && [ "$_waited" -ge ${appWaitFallbackSeconds} ]; then
+		app_wait_fallback=1
+		notify "The update is still waiting for Local Operator to close (waiting $(elapsed_text)). If nothing happens, quit Local Operator (Force Quit if it does not respond) and leave it closed until it opens again by itself."
+	fi
 	sleep ${intervalSeconds}
 done
 # 1b. The app is gone and an install is at work, so the window that just
@@ -5752,7 +5907,16 @@ while :; do
 	if [ "$(now)" -ge "$deadline" ]; then
 		if [ "$signal_known" -eq 1 ] && install_live; then
 			holding=1
-			notify "The update is still installing. Keep Local Operator closed; it will open again when the install finishes."
+			# THE SOFT BOUND BRANCHES TOO (round-1 UX U4): it fires while the app
+			# may still be RUNNING, where "keep it closed" describes a state the
+			# person is not in. App running -> the wait/fallback copy with a fresh
+			# elapsed reading; app gone -> the stay-closed copy, which is true there
+			# (an install this app spawned is live and the swap still needs quiet).
+			if app_running; then
+				notify "The update is still waiting for Local Operator to close (waiting $(elapsed_text)). If nothing happens, quit Local Operator (Force Quit if it does not respond) and leave it closed until it opens again by itself."
+			else
+				notify "The update is still installing. Keep Local Operator closed; it will open again when the install finishes."
+			fi
 		fi
 		break
 	fi
@@ -5780,7 +5944,20 @@ if [ "$holding" -eq 1 ]; then
 	while :; do
 		if decided; then break; fi
 		if [ "$(now)" -ge "$hard_deadline" ]; then
-			notify "The update is taking longer than expected. Local Operator is opening again so you are not left without it — if it says the update is still installing, quit it and leave it closed until the install finishes."
+			# TRUTHFUL ON BOTH ARMS (2026-10-11). The notice that used to stand
+			# here promised "Local Operator is opening again" unconditionally, and
+			# the path below with the app STILL RUNNING ('if app_running; then
+			# exit 0') is exactly where that promise is false - the watchdog
+			# exits without launching, because launching into a running app is
+			# what aborts a swap. So the app-still-running arm now says the true
+			# thing and hands over the action that resolves it, the same fallback
+			# the wait's own notices use; the app-gone arm keeps the notice the
+			# panel's copy expects (UX U10).
+			if app_running; then
+				notify "The update is still waiting for Local Operator to close (waiting $(elapsed_text)). If nothing happens, quit Local Operator (Force Quit if it does not respond) and leave it closed until it opens again by itself."
+			else
+				notify "The update is taking longer than expected. Local Operator is opening again so you are not left without it — if it says the update is still installing, quit it and leave it closed until the install finishes."
+			fi
 			break
 		fi
 		sleep ${intervalSeconds}
@@ -35442,6 +35619,32 @@ function rememberPickedDirectory(kind, filePaths, directoryPicked = false) {
   if (!first) return;
   lastPickedDirectory.set(kind, directoryPicked ? first : path$1.dirname(first));
 }
+const QUIT_EXIT_DEADLINE_MARGIN_MS = 5e3;
+function quitExitDeadlineMs(input) {
+  return SESSION_COOKIE_QUIT_BUDGET_MS + input.quitCleanupFailsafeMs + QUIT_EXIT_DEADLINE_MARGIN_MS;
+}
+function createQuitExitDeadline(input) {
+  let timer = null;
+  let stage = "";
+  return {
+    arm(next) {
+      if (timer) return;
+      stage = next;
+      timer = setTimeout(() => {
+        timer = null;
+        input.onFire(stage);
+      }, input.timeoutMs);
+      timer.unref();
+    },
+    phase(next) {
+      stage = next;
+    },
+    release() {
+      if (timer) clearTimeout(timer);
+      timer = null;
+    }
+  };
+}
 function createQuitState() {
   let quitting = false;
   return {
@@ -36440,6 +36643,9 @@ const GLOBAL_UPDATE_TIMEOUT_MS = 15 * 60 * 1e3;
 const SOURCE_REBUILD_TIMEOUT_MS = 30 * 60 * 1e3;
 const UPDATE_RESTART_STOP_GRACE_MS = 5e3;
 const BUNDLE_ID_REGEX = /^[\w.-]+$/;
+const APP_UPDATE_CACHE_DIR_NAME_REGEX = /^updaterCacheDirName:[ \t]*(\S+)[ \t]*$/m;
+const CACHE_DIR_NAME_OK_REGEX = /^[A-Za-z0-9._-]+$/;
+const UPDATER_CACHE_PENDING_FILE_REGEX = /\.zip$/i;
 const INSTALL_IN_FLIGHT_RECHECK_MS = 1e4;
 const LAUNCHCTL_NOT_LOADED_REGEX = /could not find|no such process/i;
 const APP_OWNED_PUBLISH_HEADROOM_BYTES = 450 * 1024 * 1024;
@@ -37446,6 +37652,7 @@ class UpdateService {
         );
         this.reapWatchdog(outcome.marker, true);
         this.reapStagedUpdateTrees();
+        this.reapUpdaterCache();
         clearPendingInstallMarker(this.markerDir());
         this.retireSupersededInstallRecord();
         this.pendingInstallSucceeded = {
@@ -37460,6 +37667,7 @@ class UpdateService {
         );
         this.reapWatchdog(outcome.marker, true);
         this.reapStagedUpdateTrees();
+        this.reapUpdaterCache();
         clearPendingInstallMarker(this.markerDir());
         this.retireSupersededInstallRecord();
         return;
@@ -37512,6 +37720,7 @@ class UpdateService {
         this.reapWatchdog(outcome.marker, false);
         this.reapFailedInstallLeftovers();
         this.reapStagedUpdateTrees();
+        this.reapUpdaterCache();
         this.schedulePendingInstallFailureDelivery();
       }
     }
@@ -38643,6 +38852,16 @@ ${heal.removed.join("\n")}`,
   startInstaller(handoff) {
     const plan = buildInstallerSpawn({
       appPid: process.pid,
+      /*
+       * The path the spawner's identity check matches before it signals
+       * anything: this process's own executable. `process.execPath` is
+       * `/Applications/Local Operator.app/Contents/MacOS/Local Operator`
+       * in the packaged app, and the running main process's command line
+       * starts with exactly that path - which is the question
+       * `ps -o command= -p <pid>` answers. It travels in the environment,
+       * never in the script text (see the callee's own note).
+       */
+      appExecPath: process.execPath,
       shipItPath: handoff.shipItPath,
       label: handoff.label,
       statePath: handoff.statePath,
@@ -38728,6 +38947,146 @@ ${heal.removed.join("\n")}`,
       }
     }
   }
+  /**
+   * The updater's own cache directory for this app, or null when it cannot be
+   * resolved.
+   *
+   * WHY THE APP NEEDS THIS PATH AT ALL (2026-10-11 cache hygiene): nothing ever
+   * clears `~/Library/Caches/<updater cache dir>/` - measured residue after one
+   * successful install: `update.zip` (~180 MB), `pending/<artifact>.zip` (~180
+   * MB, the SAME bytes) and `pending/update-info.json`, all three left behind by
+   * a download that has already been used or replaced. electron-updater clears
+   * `pending/` on a failed DOWNLOAD and never clears `update.zip` - by design,
+   * because `update.zip` is the differential base its next download patches
+   * against (`MacUpdater`'s `canDifferentialDownload`), so deleting it buys disk
+   * at the cost of a full ~180 MB re-download. `reapUpdaterCache` below is the
+   * bounded-retention answer; this resolver is how it finds the directory.
+   *
+   * TWO SOURCES, in order. The download helper is authoritative for a download
+   * THIS run performed (the same private surface `ensureStagedArtifactVerified`
+   * already reads). It does not survive a restart, and the reap runs at
+   * start-up, so the fallback reads the name electron-updater itself would
+   * read: `updaterCacheDirName` from `app-update.yml` beside the packaged app,
+   * under the base cache path its own adapter computes (`~/Library/Caches` on
+   * macOS). ONE key on ONE line is parsed rather than adding a YAML dependency
+   * on a package that is a transitive dependency of the updater rather than
+   * ours.
+   *
+   * A DELETION ROOT IS NEVER TAKEN FROM THE MARKER or any other mutable record:
+   * a corrupted record would then choose what gets deleted. Null means
+   * "declined to reap", never a guess.
+   */
+  updaterCacheRoot() {
+    const helper = this.downloadHelper();
+    if (helper?.cacheDirForPendingUpdate) {
+      return path$1.dirname(helper.cacheDirForPendingUpdate);
+    }
+    try {
+      const config = fs.readFileSync(
+        path$1.join(process.resourcesPath, "app-update.yml"),
+        "utf8"
+      );
+      const name = config.match(APP_UPDATE_CACHE_DIR_NAME_REGEX)?.[1];
+      if (!name || !CACHE_DIR_NAME_OK_REGEX.test(name)) return null;
+      return path$1.join(electron.app.getPath("home"), "Library", "Caches", name);
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Reduce the updater's cache to at most ONE artifact's worth, once an install
+   * is settled (2026-10-11).
+   *
+   * THE RETENTION RULE, and its reasoning. After every settled verdict the cache
+   * is DEDUPED, not emptied: `update.zip` and `pending/<artifact>.zip` are the
+   * same bytes, and only one of them has future value - `update.zip`, the
+   * differential base the next download patches against (`MacUpdater` copies
+   * every download to it, and falls back to a FULL download without it). So:
+   * when `update.zip` exists, the pending artifact and the `update-info.json`
+   * that describes it go (the bytes survive in the base), and when it does not,
+   * nothing is deleted - there is nothing to dedupe, and the pending artifact is
+   * the only copy. The retention window is bounded by the next download, which
+   * overwrites the base in place; there is deliberately NO day-count constant,
+   * because a clock cannot tell a live delta base from a dead one and would
+   * either delete the base the next update needs or count forever on an idle
+   * machine. ROLLBACK STORY: nothing here is a rollback artifact - `update.zip`
+   * cannot be installed by itself, and the app's reinstall and recovery paths
+   * re-fetch from the feed; the retained copy exists for the next update's
+   * DELTA (worth ~180 MB of transfer), not for restoring anything older.
+   *
+   * SAFETY RAILS, re-asked at the point of deletion rather than trusted from the
+   * caller: the three branches that call this have already decided the install
+   * is not in flight, but the machine is asked ONCE more - a live marker, a
+   * running installer, or a relaunch watchdog that is still OURS all mean
+   * something else may still be reading this cache, and the reap stands down
+   * with a log line. A registered-but-idle ShipIt job is NOT one of those
+   * signals (the 0.17.0 lessons: the job outlives finished installs by design),
+   * and the in-flight branch above NEVER calls here.
+   */
+  reapUpdaterCache() {
+    const note = (message) => logger.info(message, LogFileType.UPDATE_SERVICE);
+    const marker = readPendingInstallMarker(this.markerDir());
+    const liveness = this.installLiveness(marker);
+    if (liveness.installerRunning || marker !== null && isInstallInFlight({
+      marker,
+      jobState: liveness.jobState,
+      installerRunning: liveness.installerRunning
+    })) {
+      note(
+        "Not reaping the updater cache: the machine still reports an install in flight."
+      );
+      return;
+    }
+    const watchdogPid = marker?.watchdogPid ?? null;
+    if (watchdogPid != null) {
+      const commandLine = readCommandOutput("/bin/ps", [
+        "-o",
+        "command=",
+        "-p",
+        String(watchdogPid)
+      ]);
+      if (watchdogIsOurs({
+        alive: commandLine != null,
+        commandLine,
+        installSucceeded: true
+      })) {
+        note(
+          `Not reaping the updater cache while relaunch watchdog ${watchdogPid} is still running.`
+        );
+        return;
+      }
+    }
+    const root = this.updaterCacheRoot();
+    if (!root) {
+      note("Updater cache not reaped: its directory could not be resolved.");
+      return;
+    }
+    const base = path$1.join(root, "update.zip");
+    if (!fs.existsSync(base)) {
+      note(
+        "Updater cache left alone: no differential base to dedupe the pending artifact against."
+      );
+      return;
+    }
+    const pendingDir = path$1.join(root, "pending");
+    if (!fs.existsSync(pendingDir)) return;
+    for (const entry of fs.readdirSync(pendingDir)) {
+      if (!UPDATER_CACHE_PENDING_FILE_REGEX.test(entry) && entry !== "update-info.json")
+        continue;
+      const target2 = path$1.join(pendingDir, entry);
+      try {
+        fs.rmSync(target2, { force: true });
+        note(
+          `Reaped the updater cache's duplicate of the differential base: ${target2}.`
+        );
+      } catch (error) {
+        logger.warn(
+          `Could not reap ${target2}: ${String(error)}`,
+          LogFileType.UPDATE_SERVICE
+        );
+      }
+    }
+  }
   /**
    * Both of the machine's liveness answers for this marker.
    *
@@ -43859,6 +44218,7 @@ const backendInstaller = new BackendInstaller({
   // (`./relaunch-pending` owns why scheduling happens only at the terminal).
   onQuitCancelled: () => {
     quitState.cancel();
+    quitExitDeadline.release();
     relaunchPending.clear();
   }
 });
@@ -44178,6 +44538,22 @@ electron.app.whenReady().then(async () => {
       process.on(signal, () => endHeadlessRun(`received ${signal}`));
     }
   }
+  if (windowLaunch.mode !== "headless") {
+    const onSigtermDuringQuit = () => {
+      if (!quitState.isQuitting()) {
+        process.removeListener("SIGTERM", onSigtermDuringQuit);
+        process.kill(process.pid, "SIGTERM");
+        return;
+      }
+      logger.info(
+        "Received SIGTERM during a quit; exiting so the quit reaches its terminal (an update installer may be waiting on this pid).",
+        LogFileType.BACKEND
+      );
+      scheduleReopenAtQuitTerminal();
+      electron.app.exit(0);
+    };
+    process.on("SIGTERM", onSigtermDuringQuit);
+  }
   electron.app.on("browser-window-created", (_, window) => {
     utils.optimizer.watchWindowShortcuts(window);
   });
@@ -45184,7 +45560,22 @@ const scheduleReopenAtQuitTerminal = () => {
     }
   });
 };
+const QUIT_EXIT_DEADLINE_MS = quitExitDeadlineMs({
+  quitCleanupFailsafeMs: QUIT_CLEANUP_FAILSAFE_MS
+});
+const quitExitDeadline = createQuitExitDeadline({
+  timeoutMs: QUIT_EXIT_DEADLINE_MS,
+  onFire: (firedInStage) => {
+    logger.error(
+      `The quit did not finish within ${QUIT_EXIT_DEADLINE_MS} ms (stalled ${firedInStage}); exiting with failure so the process cannot sit alive with no window`,
+      LogFileType.BACKEND
+    );
+    scheduleReopenAtQuitTerminal();
+    electron.app.exit(1);
+  }
+});
 electron.app.on("will-quit", (event) => {
+  quitExitDeadline.phase("will-quit");
   viewerEndpoint?.close();
   viewerRecord?.stop();
   scheduleReopenAtQuitTerminal();
@@ -45224,6 +45615,7 @@ const holdQuitForSessionCookieSnapshot = createSessionCookieQuitHold({
 });
 electron.app.on("before-quit", async (event) => {
   quitState.begin();
+  quitExitDeadline.arm("before the session-cookie hold");
   electron.globalShortcut.unregisterAll();
   miniViewRegistrar?.dispose();
   quickSendWatcher?.stop();
@@ -45233,6 +45625,7 @@ electron.app.on("before-quit", async (event) => {
     armHeadlessExitDeadline("the app is quitting");
   }
   if (await holdQuitForSessionCookieSnapshot(event)) return;
+  quitExitDeadline.phase("after the session-cookie hold");
   logger.info("App is about to quit", LogFileType.BACKEND);
   if (!backendService.isOwnedCleanupComplete()) {
     try {
@@ -45253,6 +45646,7 @@ electron.app.on("before-quit", async (event) => {
   }
   activeUpdateService?.quitForInFlightInstall("app quit");
   void stopBrowserHost();
+  quitExitDeadline.phase("awaiting the window close");
 });
 process.on("exit", () => {
   try {

package/out/preload/index.js

@@ -2113,6 +2113,26 @@ const desktopRequestUnion = zod.z.discriminatedUnion("op", [
      */
     keys: zod.z.array(zod.z.string().min(1).max(512)).max(256).optional(),
     force: zod.z.boolean().optional()
+  }).strict(),
+  /*
+   * THE PREVIEWS' SIGNED STATIC URLS (file-serving RFC § 4, Phase A adoption).
+   * The renderer cannot read the core's serve record (no filesystem, no record
+   * store), so the previews ask MAIN - which already holds the desktop bearer -
+   * to mint a short-lived signed URL for one static route + path. The route is
+   * public in Phase A; this op is what lets the previews keep working when a
+   * later core phase gates it, and a core that predates the route answers 404,
+   * which the previews read as their fallback signal, not an error.
+   *
+   * `route` is the backend's own signed-string vocabulary (the four static
+   * family ids), held here so a route the signature cannot cover fails at this
+   * boundary. `ttlS` stays within the backend's documented cap (600 default,
+   * 3600 max) - a bound, not a preference.
+   */
+  zod.z.object({
+    op: zod.z.literal("static.sign"),
+    route: zod.z.enum(["images", "videos", "audio", "html"]),
+    path: zod.z.string().min(1),
+    ttlS: zod.z.number().int().min(1).max(3600).optional()
   }).strict()
 ]);
 desktopRequestUnion.superRefine(

package/out/renderer/assets/{_basePickBy-0FuZakDO.js → _basePickBy-CuMaQXnE.js}

@@ -1 +1 @@
-import{e as o,c as b,g as v,k as O,h as P,j as p,l as w,m as A,n as x,t as c,o as N}from"./_baseUniq-DF-R-zk_.js";import{as as g,aa as y,at as E,au as F,av as M,aw as I,ax as _,ay as $,az as B,aA as T}from"./mermaid.core-DUwwjyuA.js";var S=/\s/;function z(n){for(var r=n.length;r--&&S.test(n.charAt(r)););return r}var G=/^\s+/;function H(n){return n&&n.slice(0,z(n)+1).replace(G,"")}var m=NaN,L=/^[-+]0x[0-9a-f]+$/i,R=/^0b[01]+$/i,q=/^0o[0-7]+$/i,C=parseInt;function K(n){if(typeof n=="number")return n;if(o(n))return m;if(g(n)){var r=typeof n.valueOf=="function"?n.valueOf():n;n=g(r)?r+"":r}if(typeof n!="string")return n===0?n:+n;n=H(n);var t=R.test(n);return t||q.test(n)?C(n.slice(2),t?2:8):L.test(n)?m:+n}var W=1/0,X=17976931348623157e292;function Y(n){if(!n)return n===0?n:0;if(n=K(n),n===W||n===-1/0){var r=n<0?-1:1;return r*X}return n===n?n:0}function D(n){var r=Y(n),t=r%1;return r===r?t?r-t:r:0}function fn(n){var r=n==null?0:n.length;return r?b(n):[]}var l=Object.prototype,J=l.hasOwnProperty,dn=y(function(n,r){n=Object(n);var t=-1,e=r.length,a=e>2?r[2]:void 0;for(a&&E(r[0],r[1],a)&&(e=1);++t<e;)for(var f=r[t],i=F(f),s=-1,d=i.length;++s<d;){var u=i[s],h=n[u];(h===void 0||M(h,l[u])&&!J.call(n,u))&&(n[u]=f[u])}return n});function un(n){var r=n==null?0:n.length;return r?n[r-1]:void 0}function Q(n){return function(r,t,e){var a=Object(r);if(!I(r)){var f=v(t);r=O(r),t=function(s){return f(a[s],s,a)}}var i=n(r,t,e);return i>-1?a[f?r[i]:i]:void 0}}var U=Math.max;function Z(n,r,t){var e=n==null?0:n.length;if(!e)return-1;var a=t==null?0:D(t);return a<0&&(a=U(e+a,0)),P(n,v(r),a)}var hn=Q(Z);function V(n,r){var t=-1,e=I(n)?Array(n.length):[];return p(n,function(a,f,i){e[++t]=r(a,f,i)}),e}function gn(n,r){var t=_(n)?w:V;return t(n,v(r))}var j=Object.prototype,k=j.hasOwnProperty;function nn(n,r){return n!=null&&k.call(n,r)}function vn(n,r){return n!=null&&A(n,r,nn)}function rn(n,r){return n<r}function tn(n,r,t){for(var e=-1,a=n.length;++e<a;){var f=n[e],i=r(f);if(i!=null&&(s===void 0?i===i&&!o(i):t(i,s)))var s=i,d=f}return d}function mn(n){return n&&n.length?tn(n,$,rn):void 0}function an(n,r,t,e){if(!g(n))return n;r=x(r,n);for(var a=-1,f=r.length,i=f-1,s=n;s!=null&&++a<f;){var d=c(r[a]),u=t;if(d==="__proto__"||d==="constructor"||d==="prototype")return n;if(a!=i){var h=s[d];u=void 0,u===void 0&&(u=g(h)?h:B(r[a+1])?[]:{})}T(s,d,u),s=s[d]}return n}function on(n,r,t){for(var e=-1,a=r.length,f={};++e<a;){var i=r[e],s=N(n,i);t(s,i)&&an(f,x(i,n),s)}return f}export{rn as a,tn as b,V as c,on as d,mn as e,fn as f,hn as g,vn as h,dn as i,D as j,un as l,gn as m,Y as t};
+import{e as o,c as b,g as v,k as O,h as P,j as p,l as w,m as A,n as x,t as c,o as N}from"./_baseUniq-DKeCGkCd.js";import{as as g,aa as y,at as E,au as F,av as M,aw as I,ax as _,ay as $,az as B,aA as T}from"./mermaid.core-DNS50-NS.js";var S=/\s/;function z(n){for(var r=n.length;r--&&S.test(n.charAt(r)););return r}var G=/^\s+/;function H(n){return n&&n.slice(0,z(n)+1).replace(G,"")}var m=NaN,L=/^[-+]0x[0-9a-f]+$/i,R=/^0b[01]+$/i,q=/^0o[0-7]+$/i,C=parseInt;function K(n){if(typeof n=="number")return n;if(o(n))return m;if(g(n)){var r=typeof n.valueOf=="function"?n.valueOf():n;n=g(r)?r+"":r}if(typeof n!="string")return n===0?n:+n;n=H(n);var t=R.test(n);return t||q.test(n)?C(n.slice(2),t?2:8):L.test(n)?m:+n}var W=1/0,X=17976931348623157e292;function Y(n){if(!n)return n===0?n:0;if(n=K(n),n===W||n===-1/0){var r=n<0?-1:1;return r*X}return n===n?n:0}function D(n){var r=Y(n),t=r%1;return r===r?t?r-t:r:0}function fn(n){var r=n==null?0:n.length;return r?b(n):[]}var l=Object.prototype,J=l.hasOwnProperty,dn=y(function(n,r){n=Object(n);var t=-1,e=r.length,a=e>2?r[2]:void 0;for(a&&E(r[0],r[1],a)&&(e=1);++t<e;)for(var f=r[t],i=F(f),s=-1,d=i.length;++s<d;){var u=i[s],h=n[u];(h===void 0||M(h,l[u])&&!J.call(n,u))&&(n[u]=f[u])}return n});function un(n){var r=n==null?0:n.length;return r?n[r-1]:void 0}function Q(n){return function(r,t,e){var a=Object(r);if(!I(r)){var f=v(t);r=O(r),t=function(s){return f(a[s],s,a)}}var i=n(r,t,e);return i>-1?a[f?r[i]:i]:void 0}}var U=Math.max;function Z(n,r,t){var e=n==null?0:n.length;if(!e)return-1;var a=t==null?0:D(t);return a<0&&(a=U(e+a,0)),P(n,v(r),a)}var hn=Q(Z);function V(n,r){var t=-1,e=I(n)?Array(n.length):[];return p(n,function(a,f,i){e[++t]=r(a,f,i)}),e}function gn(n,r){var t=_(n)?w:V;return t(n,v(r))}var j=Object.prototype,k=j.hasOwnProperty;function nn(n,r){return n!=null&&k.call(n,r)}function vn(n,r){return n!=null&&A(n,r,nn)}function rn(n,r){return n<r}function tn(n,r,t){for(var e=-1,a=n.length;++e<a;){var f=n[e],i=r(f);if(i!=null&&(s===void 0?i===i&&!o(i):t(i,s)))var s=i,d=f}return d}function mn(n){return n&&n.length?tn(n,$,rn):void 0}function an(n,r,t,e){if(!g(n))return n;r=x(r,n);for(var a=-1,f=r.length,i=f-1,s=n;s!=null&&++a<f;){var d=c(r[a]),u=t;if(d==="__proto__"||d==="constructor"||d==="prototype")return n;if(a!=i){var h=s[d];u=void 0,u===void 0&&(u=g(h)?h:B(r[a+1])?[]:{})}T(s,d,u),s=s[d]}return n}function on(n,r,t){for(var e=-1,a=r.length,f={};++e<a;){var i=r[e],s=N(n,i);t(s,i)&&an(f,x(i,n),s)}return f}export{rn as a,tn as b,V as c,on as d,mn as e,fn as f,hn as g,vn as h,dn as i,D as j,un as l,gn as m,Y as t};