fix(desktop): harden update and quit flows

[waleedlatif1]

Summary

• require signed, notarized desktop releases and verify bundled native binaries before publication
• validate update manifests and installer URLs before download, with fallback to the next valid release
• confirm restart only after a downloaded update is ready and preserve normal quit safeguards
• harden desktop permissions, child-window unload handling, and off-screen window restoration
• share one race-safe update-state hook across the desktop gate, settings, and sidebar

Type of Change

• Bug fix

Testing

• 1,455 desktop tests
• 51 focused update feed, route, hook, and sidebar tests
• monorepo type-check, lint, 45 audits, desktop bridge/IPC checks, workflow YAML validation, and native-binary checksum verification

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 2, 2026 8:43am UTC

[greptile-apps]

Greptile Summary

This PR hardens desktop release publication, update selection, restart and quit behavior, native permissions, window restoration, and shared renderer update state.

• Requires signed and notarized published builds and validates packaged artifacts and identities.
• Validates each update candidate’s manifest and installer together, falling back to the next valid same-channel release.
• Coordinates update readiness across desktop UI surfaces and preserves normal quit safeguards.
• Tightens child-window lifecycle, permission, and restored-window bounds handling.

Confidence Score: 5/5

The PR appears safe to merge.

The previously reported release-fallback failure is fixed: invalid same-channel candidates are rejected individually, manifest and installer validation remains release-scoped, and selection continues to an older valid candidate; no blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/lib/desktop/update-feed.ts	Iterates same-channel releases in version order and accepts only candidates whose manifest and installer pass shared validation.
apps/sim/app/api/desktop/update/latest-mac.yml/route.ts	Uses candidate-level validation so an invalid newest release no longer prevents fallback to an older valid update.
apps/sim/app/api/desktop/update/download/route.ts	Uses the same validated release selection as the updater feed before redirecting to an installer.
.github/workflows/desktop-release.yml	Enforces signing before publication and validates artifact integrity, bundle identity, hardened runtime, and notarization.
apps/desktop/src/main/updater.ts	Hardens update readiness, installer URL validation, and restart behavior.
apps/sim/hooks/use-desktop-update-state.ts	Centralizes race-safe desktop update state for the gate, settings, and sidebar consumers.

_{Reviews (4): Last reviewed commit: "fix(desktop): classify invalid release f..." | Re-trigger Greptile}

[cubic-dev-ai]

All reported issues were addressed across 27 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 27 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 27 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 27 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}