fix(desktop): classify invalid release feeds

Author: waleedlatif1

apps/sim/app/api/desktop/update/download/route.test.ts

@@ -137,6 +137,17 @@ describe('desktop update download route', () => {
     expect(await response.json()).toMatchObject({ error: 'Release installer unavailable' })
   })
 
+  it('reports an invalid feed when the release has no updater manifest', async () => {
+    const incomplete = release('v1.4.0', DESKTOP_STABLE_RELEASE_REPOSITORY)
+    incomplete.assets = incomplete.assets.filter((asset) => asset.name !== MANIFEST_ASSET_NAME)
+    mockReleases([incomplete])
+
+    const response = await getDownload()
+
+    expect(response.status).toBe(502)
+    expect(await response.json()).toMatchObject({ error: 'Release installer unavailable' })
+  })
+
   it('surfaces an unreadable release list instead of redirecting', async () => {
     fetchMock.mockResolvedValueOnce(new Response(null, { status: 500 }))
 

apps/sim/app/api/desktop/update/latest-mac.yml/route.test.ts

@@ -167,6 +167,17 @@ describe('desktop update manifest route', () => {
     expect(fetchMock).toHaveBeenCalledTimes(1)
   })
 
+  it('reports an invalid feed when the release has no updater manifest', async () => {
+    const incomplete = release('v1.1.0')
+    incomplete.assets = incomplete.assets.filter((asset) => asset.name !== MANIFEST_ASSET_NAME)
+    fetchMock.mockResolvedValueOnce(Response.json([incomplete]))
+
+    const response = await getFeed('www.sim.ai')
+
+    expect(response.status).toBe(502)
+    expect(await response.json()).toMatchObject({ error: 'Release manifest unavailable' })
+  })
+
   it('walks past a page of unrelated releases to reach the newest desktop build', async () => {
     const filler = Array.from({ length: DESKTOP_RELEASES_PAGE_SIZE }, (_, index) => ({
       tag_name: `python-sdk-v0.${index}.0`,

apps/sim/lib/desktop/update-feed.test.ts

@@ -111,19 +111,17 @@ describe('selectReleaseForChannel', () => {
     expect(selectReleaseForChannel(flagged, 'latest')?.tag_name).toBe('v0.5.24')
   })
 
-  it('skips releases missing the updater manifest asset', () => {
-    // A release whose build failed (or is mid-upload) must not take the
-    // channel down; the previous good release keeps serving.
+  it('keeps releases missing the updater manifest eligible for candidate validation', () => {
     const withBrokenNewest = [
       release('v0.5.25-dev.413', { assets: [{ name: 'Sim-0.5.25-dev.413-universal.dmg' }] }),
       release('v0.5.25-dev.412'),
     ]
-    expect(selectReleaseForChannel(withBrokenNewest, 'dev')?.tag_name).toBe('v0.5.25-dev.412')
+    expect(selectReleaseForChannel(withBrokenNewest, 'dev')?.tag_name).toBe('v0.5.25-dev.413')
   })
 
-  it('skips release listings without asset data', () => {
+  it('keeps release listings without asset data eligible for candidate validation', () => {
     const bare = { tag_name: 'v0.5.25', draft: false, prerelease: false }
-    expect(selectReleaseForChannel([bare, release('v0.5.24')], 'latest')?.tag_name).toBe('v0.5.24')
+    expect(selectReleaseForChannel([bare, release('v0.5.24')], 'latest')?.tag_name).toBe('v0.5.25')
   })
 
   it('skips drafts and unparseable tags', () => {

apps/sim/lib/desktop/update-feed.ts

@@ -80,9 +80,9 @@ export interface DesktopReleaseCandidate {
 
 /**
  * Lists releases of the channel's own kind, newest first. Channels never see
- * another channel's artifacts (see module docs). Releases without their
- * updater manifest asset are skipped — a release created before its build
- * finished (or whose build failed) must not take the channel down.
+ * another channel's artifacts (see module docs). Artifact validation happens
+ * in the candidate resolver so invalid releases remain distinguishable from
+ * a channel with no releases.
  */
 function releasesForChannel(
   releases: DesktopReleaseCandidate[],
@@ -96,17 +96,14 @@ function releasesForChannel(
     // Defense in depth: a bare vX.Y.Z tag manually marked "pre-release" on
     // GitHub must not reach stable clients.
     if (channel === 'latest' && release.prerelease) continue
-    if (!release.assets?.some((asset) => asset.name === MANIFEST_ASSET_NAME)) {
-      continue
-    }
     if (compareVersions(version, '0.0.0') === null) continue
     candidates.push({ release, version })
   }
   candidates.sort((left, right) => compareVersions(right.version, left.version) ?? 0)
   return candidates.map(({ release }) => release)
 }
 
-/** Picks the newest release that passes the channel and manifest-presence checks. */
+/** Picks the newest release that passes the channel and version checks. */
 export function selectReleaseForChannel(
   releases: DesktopReleaseCandidate[],
   channel: DesktopUpdateChannel