[Init] Initial commit - NetMesh terminal manager

electron/bridges/autoUpdateBridge.cjs

@@ -0,0 +1,651 @@
+/**
+ * Auto-Update Bridge
+ *
+ * Wraps electron-updater to provide IPC-driven update checks, downloads, and
+ * install-on-quit. Designed around a "prompt" model: the renderer asks to
+ * check, then explicitly triggers download and install.
+ *
+ * Linux packages use electron-updater's package-manager path when the
+ * electron-builder package-type marker is present. Unmarked Linux builds
+ * (including snap and development runs) get a graceful fallback so the
+ * renderer can offer a manual "open GitHub releases" link.
+ */
+
+let _deps = null;
+
+/**
+ * Read the persisted auto-update preference from a JSON file in userData.
+ * Returns true (default) if the file doesn't exist or is unreadable.
+ */
+function readAutoUpdatePreference() {
+  try {
+    const { app } = _deps?.electronModule || {};
+    if (!app) return true;
+    const path = require('path');
+    const fs = require('fs');
+    const prefPath = path.join(app.getPath('userData'), 'auto-update-pref.json');
+    const data = JSON.parse(fs.readFileSync(prefPath, 'utf8'));
+    return data.enabled !== false;
+  } catch {
+    return true; // default to enabled
+  }
+}
+
+/**
+ * Persist the auto-update preference to a JSON file in userData.
+ */
+function writeAutoUpdatePreference(enabled) {
+  try {
+    const { app } = _deps?.electronModule || {};
+    if (!app) return;
+    const path = require('path');
+    const fs = require('fs');
+    const prefPath = path.join(app.getPath('userData'), 'auto-update-pref.json');
+    fs.writeFileSync(prefPath, JSON.stringify({ enabled }), 'utf8');
+  } catch (err) {
+    console.warn('[AutoUpdate] Failed to write preference:', err?.message || err);
+  }
+}
+
+const SUPPORTED_LINUX_PACKAGE_TYPES = new Set(["deb", "rpm", "pacman"]);
+
+/**
+ * Identify the Linux package format written by electron-builder into the
+ * packaged resources directory. AppImage does not have this marker; its
+ * runtime exposes the APPIMAGE environment variable instead.
+ */
+function getLinuxPackageType() {
+  if (process.env.APPIMAGE) return "AppImage";
+  if (typeof process.resourcesPath !== "string") return null;
+
+  try {
+    const fs = require("fs");
+    const path = require("path");
+    const packageType = fs.readFileSync(path.join(process.resourcesPath, "package-type"), "utf8").trim();
+    return SUPPORTED_LINUX_PACKAGE_TYPES.has(packageType) ? packageType : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Returns true when the current packaging format supports electron-updater
+ * (macOS zip/dmg, Windows NSIS, Linux AppImage/deb/rpm/pacman).
+ */
+function isAutoUpdateSupported() {
+  if (process.platform === "darwin" || process.platform === "win32") {
+    return true;
+  }
+  return process.platform === "linux" && getLinuxPackageType() !== null;
+}
+
+/** Lazily resolved autoUpdater — avoids importing electron-updater in
+ *  contexts where native modules might not be available. */
+let _autoUpdater = null;
+
+/** Guard against duplicate listener registration */
+let _listenersRegistered = false;
+
+/** Track whether a download is in progress to distinguish download errors from check errors */
+let _isDownloading = false;
+
+/** Track whether quitAndInstall has entered the package installation phase */
+let _isInstalling = false;
+
+/** Track whether a checkForUpdates call is in flight (set before call, cleared on result event) */
+let _isChecking = false;
+
+/**
+ * Snapshot of the last known update status so newly opened windows can hydrate
+ * without waiting for the next IPC event.
+ * @type {{ status: 'idle' | 'downloading' | 'ready' | 'error', percent: number, error: string | null, version: string | null, isChecking: boolean }}
+ */
+let _lastStatus = { status: 'idle', percent: 0, error: null, version: null, isChecking: false };
+function getAutoUpdater() {
+  if (_autoUpdater) return _autoUpdater;
+  try {
+    const { autoUpdater } = require("electron-updater");
+    autoUpdater.autoDownload = readAutoUpdatePreference();
+    autoUpdater.autoInstallOnAppQuit = false;
+    // Silence the default electron-log transport (we log ourselves).
+    autoUpdater.logger = null;
+    _autoUpdater = autoUpdater;
+    return autoUpdater;
+  } catch (err) {
+    console.error("[AutoUpdate] Failed to load electron-updater:", err?.message || err);
+    return null;
+  }
+}
+
+/**
+ * Register persistent global IPC event listeners for auto-download flow.
+ * Called once in init(). Forwards electron-updater events to the renderer
+ * even when no manual download was initiated.
+ */
+function setupGlobalListeners() {
+  if (_listenersRegistered) return;
+  const updater = getAutoUpdater();
+  if (!updater) return;
+  _listenersRegistered = true;
+
+  updater.on("update-not-available", () => {
+    _isChecking = false;
+    // Reset stale status so late-opening windows don't hydrate from a
+    // previous 'error' or 'ready' snapshot after a "no update" check.
+    _lastStatus = { status: 'idle', percent: 0, error: null, version: null, isChecking: false };
+    broadcastToAllWindows("netcatty:update:update-not-available", {});
+  });
+
+  updater.on("update-available", (info) => {
+    _isChecking = false;
+    // Only track as downloading when autoDownload is enabled — otherwise no
+    // download will actually start and the status would be stuck at 0%.
+    // Use 'available' so late-opening windows can still hydrate the version.
+    const willDownload = updater.autoDownload !== false;
+    _isDownloading = willDownload;
+    _lastStatus = { status: willDownload ? 'downloading' : 'available', percent: 0, error: null, version: info.version || null, isChecking: false };
+    broadcastToAllWindows("netcatty:update:update-available", {
+      version: info.version || "",
+      releaseNotes: typeof info.releaseNotes === "string" ? info.releaseNotes : "",
+      releaseDate: info.releaseDate || null,
+    });
+  });
+
+  updater.on("download-progress", (info) => {
+    _lastStatus.percent = Math.round(info.percent ?? 0);
+    broadcastToAllWindows("netcatty:update:download-progress", {
+      percent: info.percent ?? 0,
+      bytesPerSecond: info.bytesPerSecond ?? 0,
+      transferred: info.transferred ?? 0,
+      total: info.total ?? 0,
+    });
+  });
+
+  updater.on("update-downloaded", () => {
+    _isDownloading = false;
+    _lastStatus = { ..._lastStatus, status: 'ready', percent: 100 };
+    broadcastToAllWindows("netcatty:update:downloaded");
+  });
+
+  updater.on("error", (err) => {
+    _isChecking = false;
+    // Only broadcast download-phase errors; check-phase errors (e.g. network failures
+    // during checkForUpdates) are not download failures and must not set autoDownloadStatus.
+    // Install errors are also broadcast: Linux package managers report a cancelled
+    // elevation prompt or a failed command after update-downloaded has already
+    // cleared _isDownloading.
+    if (!_isDownloading && !_isInstalling) {
+      _lastStatus = { ..._lastStatus, isChecking: false };
+      console.warn("[AutoUpdate] Check-phase error (not broadcast to renderer):", err?.message || err);
+      return;
+    }
+    _isDownloading = false;
+    const errorMsg = err?.message || "Unknown update error";
+    if (_isInstalling) {
+      _isInstalling = false;
+      cancelQuittingForUpdateWatchdog();
+      setQuittingForUpdate(false);
+    }
+    _lastStatus = { ..._lastStatus, status: 'error', error: errorMsg };
+    broadcastToAllWindows("netcatty:update:error", {
+      error: errorMsg,
+    });
+  });
+
+  console.log("[AutoUpdate] Global listeners registered");
+}
+
+/**
+ * Trigger an automatic update check after a delay.
+ * No-op on platforms that don't support auto-update (for example Linux snap
+ * or an unmarked development build).
+ * Called from main process after the main window is created.
+ *
+ * @param {number} delayMs - Milliseconds to wait before checking (default: 5000)
+ */
+let _autoCheckTimer = null;
+
+function startAutoCheck(delayMs = 5000) {
+  if (!isAutoUpdateSupported()) {
+    console.log("[AutoUpdate] Platform does not support auto-update, skipping auto-check");
+    return;
+  }
+  // Cancel any existing timer to avoid duplicate concurrent checks
+  // (e.g. from multiple windows initializing or re-enable toggle).
+  cancelAutoCheck();
+  _autoCheckTimer = setTimeout(async () => {
+    _autoCheckTimer = null;
+    const updater = getAutoUpdater();
+    if (!updater) {
+      console.warn("[AutoUpdate] Auto-check skipped — updater not available");
+      return;
+    }
+    // Respect autoDownload flag — the renderer may have disabled it via IPC
+    // before this timer fires.
+    if (updater.autoDownload === false) {
+      console.log("[AutoUpdate] Auto-check skipped — autoDownload is disabled");
+      return;
+    }
+    _isChecking = true;
+    _lastStatus = { ..._lastStatus, isChecking: true };
+    try {
+      console.log("[AutoUpdate] Starting automatic update check...");
+      await updater.checkForUpdates();
+    } catch (err) {
+      _isChecking = false;
+      _lastStatus = { ..._lastStatus, isChecking: false };
+      console.warn("[AutoUpdate] Auto-check failed:", err?.message || err);
+    }
+  }, delayMs);
+}
+
+/**
+ * Cancel a pending startAutoCheck timer.  Called when the renderer triggers
+ * a manual check to avoid racing with the queued auto-check.
+ */
+function cancelAutoCheck() {
+  if (_autoCheckTimer) {
+    clearTimeout(_autoCheckTimer);
+    _autoCheckTimer = null;
+  }
+}
+
+/**
+ * Flip the windowManager "quitting for update" flag, swallowing the case where
+ * the window manager module isn't available. Used by the install handler to
+ * commit the app to a clean quit before quitAndInstall, and to roll back if the
+ * install never actually quits (#1215).
+ */
+function setQuittingForUpdate(enabled) {
+  try {
+    const windowManager = require("./windowManager.cjs");
+    windowManager.setQuittingForUpdate(!!enabled);
+  } catch {
+    // ignore — window manager may not be available
+  }
+}
+
+/**
+ * The webContents for usable dirty-editor windows. Used by the install handler
+ * to ask every renderer that can own editor tabs about unsaved work before
+ * committing to a quit. Targets registered editor owners specifically (not
+ * getAllWindows()[0]) so we never query tray/settings windows, whose renderers
+ * don't participate in the dirty-editor protocol.
+ */
+function getDirtyEditorWebContentsList() {
+  try {
+    const windowManager = require("./windowManager.cjs");
+    const windows = typeof windowManager.getDirtyEditorWindows === "function"
+      ? windowManager.getDirtyEditorWindows()
+      : typeof windowManager.getMainWindows === "function"
+        ? windowManager.getMainWindows()
+        : [windowManager.getMainWindow?.()].filter(Boolean);
+    return windows
+      .filter((win) => win && !win.isDestroyed?.())
+      .map((win) => win.webContents)
+      .filter((wc) => wc && !wc.isDestroyed?.() && !wc.isCrashed?.());
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Tell the renderer that the update can't install yet because there are unsaved
+ * editors. The renderer surfaces a toast asking the user to save, then click
+ * "Restart Now" again.
+ *
+ * Broadcast to ALL windows, not just the main one: the install can be triggered
+ * from the Settings window's "Restart to Update" button, and that's the focused
+ * window the user is looking at. Sending only to the (possibly hidden/behind)
+ * main window would make the click appear to do nothing (#1215 review). The
+ * unsaved editors live in the main window, but every window surfaces the same
+ * "save first" notice so it lands wherever the user is.
+ */
+function notifyNeedsSave() {
+  broadcastToAllWindows("netcatty:update:needs-save");
+}
+
+/** Max time to wait for the renderer's unsaved-editors reply before the install
+ *  fails open and proceeds (matches the before-quit guard timeout). */
+const INSTALL_DIRTY_CHECK_TIMEOUT_MS = 5000;
+
+/**
+ * Ask the main-window renderer whether it has unsaved editor changes, reusing
+ * the shared dirty-editor round-trip. Resolves false (fail open) if the helper
+ * is unavailable, so a missing module can never block an install. `ipcMain` is
+ * the instance passed to registerHandlers; the helper needs it to listen for
+ * the reply.
+ */
+function queryDirtyEditorsSafe(webContents, ipcMain) {
+  try {
+    const { queryDirtyEditors } = require("./dirtyEditorGuard.cjs");
+    return queryDirtyEditors(webContents, INSTALL_DIRTY_CHECK_TIMEOUT_MS, { ipcMain });
+  } catch (err) {
+    console.warn("[AutoUpdate] dirty-editor guard unavailable:", err?.message || err);
+    return Promise.resolve(false);
+  }
+}
+
+/**
+ * If quitAndInstall doesn't lead to the app actually quitting (it returns
+ * without app.quit(), e.g. on a Squirrel.Mac follow-up error or a stale
+ * downloaded file), the quitting-for-update flags would stay set and
+ * permanently bypass close-to-tray + the dirty-editor quit guard. This
+ * watchdog clears them if we're still running after a grace period.
+ *
+ * The grace period is deliberately long. On macOS quitAndInstall() can return
+ * while Squirrel.Mac is still pulling the already-downloaded ZIP from the local
+ * update server before it actually closes the windows; for a large/slow update
+ * that second stage can take well over 10s. If the watchdog cleared isQuitting
+ * during that window, the eventual native quit would hit a *non*-quitting
+ * close-to-tray handler and get stranded again — the exact #1215 failure. So we
+ * only roll back after a window long enough that the app is realistically stuck,
+ * not merely slow. The cost of waiting longer is just that close-to-tray stays
+ * bypassed a bit longer in the rare genuine-failure case (#1215 review).
+ */
+let _quittingForUpdateWatchdog = null;
+const QUITTING_FOR_UPDATE_WATCHDOG_MS = 60000;
+
+function cancelQuittingForUpdateWatchdog() {
+  if (_quittingForUpdateWatchdog) {
+    clearTimeout(_quittingForUpdateWatchdog);
+    _quittingForUpdateWatchdog = null;
+  }
+}
+
+function scheduleQuittingForUpdateWatchdog() {
+  if (_quittingForUpdateWatchdog) {
+    clearTimeout(_quittingForUpdateWatchdog);
+  }
+  _quittingForUpdateWatchdog = setTimeout(() => {
+    _quittingForUpdateWatchdog = null;
+    _isInstalling = false;
+    // Still alive after the grace period — the install did not quit the app.
+    console.warn("[AutoUpdate] App still running after quitAndInstall; clearing quitting-for-update state");
+    setQuittingForUpdate(false);
+  }, QUITTING_FOR_UPDATE_WATCHDOG_MS);
+  // Don't let the watchdog keep the event loop (and thus the process) alive —
+  // if the app is otherwise ready to quit, the timer must not block it.
+  if (typeof _quittingForUpdateWatchdog.unref === "function") {
+    _quittingForUpdateWatchdog.unref();
+  }
+}
+
+/**
+ * Cancel an install after the main quit guard finds unsaved editor changes.
+ * The main process owns the dirty-editor decision, but the install lifecycle
+ * state lives here and must be released together with the window-manager flag.
+ */
+function cancelPendingInstall() {
+  if (!_isInstalling) return;
+  _isInstalling = false;
+  cancelQuittingForUpdateWatchdog();
+  setQuittingForUpdate(false);
+}
+
+function init(deps) {
+  _deps = deps;
+  setupGlobalListeners();
+}
+
+/**
+ * Broadcast an IPC event to all non-destroyed BrowserWindows.
+ * Ensures both the main window and settings window always receive
+ * auto-update events.
+ * @param {string} channel
+ * @param {unknown} [payload]
+ */
+function broadcastToAllWindows(channel, payload) {
+  try {
+    const { BrowserWindow } = _deps?.electronModule || {};
+    if (!BrowserWindow) return;
+    const windows = BrowserWindow.getAllWindows();
+    for (const win of windows) {
+      if (!win.isDestroyed()) {
+        if (payload !== undefined) {
+          win.webContents.send(channel, payload);
+        } else {
+          win.webContents.send(channel);
+        }
+      }
+    }
+  } catch (err) {
+    console.warn("[AutoUpdate] broadcastToAllWindows failed:", err?.message || err);
+  }
+}
+
+function registerHandlers(ipcMain) {
+  // ---- Check for updates ------------------------------------------------
+  ipcMain.handle("netcatty:update:check", async () => {
+    // Cancel any pending auto-check to prevent concurrent checkForUpdates()
+    // calls — electron-updater rejects them and surfaces false errors.
+    cancelAutoCheck();
+
+    if (!isAutoUpdateSupported()) {
+      return {
+        available: false,
+        supported: false,
+        error: "Auto-update is not supported on this platform/package format.",
+      };
+    }
+
+    const updater = getAutoUpdater();
+    if (!updater) {
+      return {
+        available: false,
+        supported: false,
+        error: "Update module failed to load.",
+      };
+    }
+
+    // If a check is already in flight (e.g. from startAutoCheck), don't
+    // start a concurrent one — electron-updater rejects it and surfaces a
+    // confusing error.  Return a sentinel so the renderer knows to wait.
+    if (_isChecking) {
+      return { available: false, supported: true, checking: true };
+    }
+
+    // If a download is already in progress or the update is ready to install,
+    // skip the check entirely — calling checkForUpdates() while downloading
+    // can cause electron-updater to error, which corrupts the download state
+    // and forces the user to download manually (GitHub issue #522).
+    if (_isDownloading) {
+      return { available: true, supported: true, downloading: true, version: _lastStatus.version };
+    }
+    if (_lastStatus.status === 'ready') {
+      return { available: true, supported: true, ready: true, version: _lastStatus.version };
+    }
+
+    try {
+      _isChecking = true;
+      _lastStatus = { ..._lastStatus, isChecking: true };
+      const result = await updater.checkForUpdates();
+      if (!result || !result.updateInfo) {
+        return { available: false, supported: true };
+      }
+
+      const { version, releaseNotes, releaseDate } = result.updateInfo;
+
+      // Compare with current version using semver ordering.
+      // Only report an update when the feed version is strictly newer,
+      // avoiding false positives for pre-release or nightly builds.
+      const { app } = _deps?.electronModule || {};
+      const currentVersion = app?.getVersion?.() || "0.0.0";
+      const isNewer = currentVersion.localeCompare(version, undefined, { numeric: true, sensitivity: 'base' }) < 0;
+      if (!isNewer) {
+        return { available: false, supported: true };
+      }
+
+      return {
+        available: true,
+        supported: true,
+        version,
+        releaseNotes: typeof releaseNotes === "string" ? releaseNotes : "",
+        releaseDate: releaseDate || null,
+      };
+    } catch (err) {
+      _isChecking = false;
+      _lastStatus = { ..._lastStatus, isChecking: false };
+      console.warn("[AutoUpdate] Check failed:", err?.message || err);
+      return {
+        available: false,
+        supported: true,
+        error: err?.message || "Unknown update check error",
+      };
+    }
+  });
+
+  // ---- Download update ---------------------------------------------------
+  ipcMain.handle("netcatty:update:download", async () => {
+    if (_isDownloading) {
+      return { success: true };
+    }
+    const updater = getAutoUpdater();
+    if (!updater) {
+      return { success: false, error: "Update module not available." };
+    }
+    try {
+      _isDownloading = true;
+      _lastStatus = { ..._lastStatus, status: 'downloading', percent: 0, error: null };
+      await updater.downloadUpdate();
+      return { success: true };
+    } catch (err) {
+      _isDownloading = false;
+      _lastStatus = { ..._lastStatus, status: 'error', error: err?.message || "Download failed", percent: 0 };
+      // Don't broadcast here — the global updater "error" listener already handles it
+      console.error("[AutoUpdate] Download failed:", err?.message || err);
+      return { success: false, error: err?.message || "Download failed" };
+    }
+  });
+
+  // ---- Get current update status (for late-opening windows) ---------------
+  ipcMain.handle("netcatty:update:getStatus", () => {
+    return { ..._lastStatus };
+  });
+
+  // ---- Install (quit & install) ------------------------------------------
+  ipcMain.handle("netcatty:update:install", async () => {
+    const updater = getAutoUpdater();
+    if (!updater) return;
+    if (_isInstalling) return;
+
+    // Check for unsaved editors BEFORE committing to a quit (#1215 review).
+    //
+    // On macOS quitAndInstall() closes windows first and only then fires
+    // before-quit. Once setQuittingForUpdate(true) lets the main window
+    // actually close (instead of hiding to tray), the before-quit dirty-editor
+    // guard can run after the window is already gone — isReachableByUser is
+    // false, so it commits the quit and silently drops unsaved SFTP edits.
+    //
+    // So we ask the renderer here, while the window and renderer are still
+    // alive. If there's unsaved work in any main window, abort the install
+    // (don't touch the quitting flags, don't quitAndInstall) and tell the
+    // renderer to prompt the user to save; they can click "Restart Now" again
+    // afterwards. If no main window is reachable (no window / crashed
+    // renderer) there's no user to ask, so we install directly — matching the
+    // before-quit fail-open path.
+    const editorWebContents = getDirtyEditorWebContentsList();
+    if (editorWebContents.length > 0) {
+      const dirtyResults = await Promise.all(
+        editorWebContents.map((webContents) => queryDirtyEditorsSafe(webContents, ipcMain)),
+      );
+      if (dirtyResults.some(Boolean)) {
+        // Broadcast so the notice reaches whichever window the user clicked
+        // from (main or Settings), not just the main window we queried.
+        notifyNeedsSave();
+        return;
+      }
+    }
+
+    // Another request may have completed its dirty-editor check while this
+    // request was waiting. Only one request may commit the app to a quit.
+    if (_isInstalling) return;
+
+    // Commit the app to a real quit BEFORE quitAndInstall fires app.quit().
+    // Without this the in-place install silently fails (#1215): the main-window
+    // close handler hides to tray when close-to-tray is on, so the process
+    // stays alive and Squirrel.Mac's ShipIt helper — which waits on the parent
+    // PID to die before swapping the bundle — ends up in launchd "pending
+    // spawn" limbo and never installs. setQuittingForUpdate(true) sets
+    // isQuitting so close-to-tray is bypassed and the window actually closes.
+    _isInstalling = true;
+    setQuittingForUpdate(true);
+
+    // On macOS, the system tray keeps the app process alive even after all
+    // windows are closed, which prevents quitAndInstall from completing.
+    // Destroy the tray (and its panel window) before quitting so the app
+    // can exit cleanly and the installer can proceed.
+    if (process.platform === "darwin") {
+      try {
+        const globalShortcutBridge = require("./globalShortcutBridge.cjs");
+        globalShortcutBridge.cleanup();
+      } catch {
+        // ignore — bridge may not be available
+      }
+    }
+
+    try {
+      updater.quitAndInstall(false, true);
+    } catch (err) {
+      // quitAndInstall threw synchronously — the app will NOT quit. Roll back
+      // the quitting-for-update flags so later closes/quits behave normally
+      // instead of permanently bypassing close-to-tray + the dirty-editor
+      // guard (#1215 review).
+      console.error("[AutoUpdate] quitAndInstall failed:", err?.message || err);
+      _isInstalling = false;
+      cancelQuittingForUpdateWatchdog();
+      setQuittingForUpdate(false);
+      return;
+    }
+
+    // Linux package-manager failures emit the updater error synchronously from
+    // quitAndInstall(). The error listener clears _isInstalling in that case,
+    // so do not install a watchdog after the failure has already been handled.
+    if (!_isInstalling) return;
+
+    // quitAndInstall can also fail to quit asynchronously (e.g. Squirrel.Mac's
+    // follow-up check errors, or a stale/missing downloaded file) — it returns
+    // without app.quit() ever firing. A watchdog clears the flags if we're
+    // still alive shortly after, so the app doesn't get stuck in a state where
+    // every window close bypasses close-to-tray and the dirty-editor guard.
+    scheduleQuittingForUpdateWatchdog();
+  });
+
+  // ---- Get auto-update preference -----------------------------------------
+  ipcMain.handle("netcatty:update:getAutoUpdate", () => {
+    return { enabled: readAutoUpdatePreference() };
+  });
+
+  // ---- Enable/disable auto-update ----------------------------------------
+  let _prevAutoDownloadEnabled = readAutoUpdatePreference();
+  ipcMain.handle("netcatty:update:setAutoUpdate", (_event, { enabled }) => {
+    const wasEnabled = _prevAutoDownloadEnabled;
+    _prevAutoDownloadEnabled = !!enabled;
+    const updater = getAutoUpdater();
+    if (updater) {
+      updater.autoDownload = !!enabled;
+      console.log("[AutoUpdate] autoDownload set to:", !!enabled);
+    }
+    // Persist so the preference survives app restarts
+    writeAutoUpdatePreference(!!enabled);
+    if (!enabled) {
+      cancelAutoCheck();
+    } else if (!wasEnabled && !_isChecking) {
+      // Only re-schedule when actually re-enabling (not on every mount sync),
+      // to avoid duplicate checks from multiple windows initializing.
+      // Skip if a check is already in flight to prevent concurrent calls.
+      startAutoCheck(2000);
+    }
+    return { success: true };
+  });
+
+  console.log("[AutoUpdate] Handlers registered");
+}
+
+module.exports = {
+  init,
+  registerHandlers,
+  isAutoUpdateSupported,
+  startAutoCheck,
+  cancelPendingInstall,
+};