Promote macOS in-app updates to main

[pavelhov]

Summary

Promote the reviewed macOS updater from development to main. Source PR: #39; promotion head: 0e9a408ceaf243db8cab044b23e2eda4eb910fec.

CodexCommander can check for stable updates and install them from the menu app while preserving the user’s proxy, routing, and service choices. Installation pauses the bundled proxy before download and restores the appropriate state after relaunch.

This implements U1–U6 of the updater plan. Existing v0.1.6 installations need one manual bootstrap to the first updater-enabled release; release publication is handled separately from this promotion.

Behavior and recovery

• Automatic checks run quietly. An available release changes the menu action to Update Available…; manual checks remain available. Installation shows the pause/interruption disclosure with Update Anyway or Later, with no drain countdown or automatic replay.
• A durable transaction excludes bundle-dependent starts through installation. An uncertain installer remains guarded with Finish Update; dismissal and process exit do not imply disarm.
• Recovery preserves stopped, running/native, running/proxied, and supervised states. Newer Stop/native choices take precedence, and independent runtimes remain under their existing ownership.

Security and distribution

Security review covers the pinned Sparkle dependency, helper/admission boundaries, signing-key custody, and release artifacts. Sparkle 2.9.6 is pinned with artifact/tool checksums; both feed and archive signatures are required, with strict feed verification and verification before extraction. Private signing keys remain outside release asset directories. Bundle components are signed inside-out and the universal archive is checked again after extraction.

Apple Developer ID signing and notarization remain deferred. Qualification uses disposable update-signing keys and ad-hoc app signatures; it does not establish notarized distribution readiness. Publishing must assemble and verify a complete draft release before advertising it as latest.

Validation

Windows qualification identified macOS-only fixtures using POSIX directory fsync and bundle path syntax. PR #42 scopes those fixtures to Linux/macOS while preserving platform-independent service-command tests on Windows; production durability and recovery guards are unchanged. The corrected tree passed the full 623-file local suite and PR CI. macOS and Windows cross-platform requalification passed on identical tree 858219b4765267157e23f658208958bf48c0f59f.

• bun run typecheck, bun run test:parallel (623 files), bun run prepush (623 shards and privacy scan), and bun run lint:gui passed; lint retains one existing warning.
• bun run test:macos: 156 core and 79 UI tests passed. The final intent-preservation fixes passed 30 focused Bun tests and independent review.
• Real signed updates passed on Apple Silicon and Intel/Rosetta, including stopped/native/proxied states, launchd recovery, active-request choices, failed download, invalid feed signature, cancellation and crash recovery.
• Final installed fixtures preserved the exact independent-runtime PID and enforced bundled CLI/service exclusion during a canceled update. All qualification fixtures had no remaining processes or services after cleanup.
• The clean universal release archive passed nested signature and extraction checks. Docs built 44 pages; both changed docs routes passed browser checks with no console errors.

Installed qualification used source revision 4d23fac1d; subsequent intent-preservation and discovery-UI changes were verified with focused regressions, independent review, and the full suite. The full state/fault/CPU cross-product was not run. Both validated review findings are fixed; none remain unapplied.

Session-settled decisions carried from planning: early pause before download (user-approved), Update Anyway/Later interruption consent (user-directed), quiet automatic discovery with on-demand disclosure (user-directed revision after the menu screenshot), and Apple signing later (user-directed).

Demo

Actual AppKit menu and installation confirmation captured in an isolated UI fixture. The menu states are supplied by the fixture; native tests separately verify real Sparkle background discovery and focus behavior.

---