feat(updater): in-app update on desktop, releases link on Android

Anyone who installed an AppImage or ran the Windows installer was frozen
on that version forever. Nothing in the app ever mentioned a new release
existed, and the release notes were the only announcement.

Desktop now checks a signed manifest, shows the version and its notes in
Settings, and installs and relaunches on request. The signature check is
the whole point: it is what stops a substituted download from being
installed by the app itself. Windows binaries stay unsigned for
SmartScreen purposes -- that is a code-signing certificate, a separate
problem -- but the update payload is verified against our own key.

Android is deliberately not wired to the updater. An app may not replace
its own APK; that is the package installer's job, and the plugin has no
Android implementation. It gets a link to the releases page instead of a
button that would throw.

The plugins are gated with a target-triple cfg rather than
cfg(desktop). Cargo only evaluates target cfgs in a [target.'cfg(..)']
table, so cfg(desktop) matches nothing, silently drops the dependency,
and fails much later with "Permission updater:default not found" -- which
is exactly what the first attempt here did.

Where the manifest lives took some finding. This Gitea serves
/releases/download/<tag>/<asset> but 404s on
/releases/latest/download/<asset> (verified against a real asset), so
there is no stable latest-release URL. The gitea-pages branch is
force-pushed wholesale by publish-docs.yml, so it cannot host the file
either. latest.json therefore gets its own orphan branch, read over the
raw-file URL, and is published from a scratch repo in RUNNER_TEMP rather
than by switching branches in the checkout -- doing that would have left
the following steps standing on a one-commit history, and the next step
but one runs release:notes against the real commit range.

Also fixed, all of it release-integrity:

  - "appimage" is in bundle.targets. The release notes have advertised an
    AppImage for months; tauri.conf.json never built one, the artifact
    step globbed for *.AppImage, found nothing, and said nothing. The
    step now fails instead.
  - The .AppImage.tar.gz/.sig pair and the NSIS .sig are collected. A
    manifest referencing a signature that was never uploaded fails only
    on the user's machine, so the manifest step also refuses to write an
    entry with an empty signature.
  - Release notes are generated by release:notes from the traceability
    graph, which is what CLAUDE.md has asked for all along, instead of a
    fixed heredoc that said "see CHANGELOG.md for detailed changes" and
    linked "GitHub Issues" on a Gitea-hosted project.
  - The notes tell users how to verify a download with SHA256SUMS.

Requirements UR-077 / DR-217, tests UT-208 (12 cases over the version
comparison and the platform decision, including that a pre-release does
not offer itself as an upgrade to the matching release).

Verified: 1070 frontend tests, cargo check for both the host and
aarch64-linux-android (confirming the plugins are absent there), clippy
-D warnings, svelte-check 0 errors.

src/lib/utils/updateCheck.test.ts

@@ -0,0 +1,97 @@
+/**
+ * Tests for the update decision logic.
+ *
+ * TRACES: | DR-217 | UT-208
+ *
+ * The pure half is tested here; `checkForUpdate`/`installUpdate` talk to the
+ * plugin and are exercised by actually cutting a release (see the Phase 3
+ * verification steps in docs/build/ci-operations.md).
+ */
+
+import { describe, it, expect } from "vitest";
+import { decideUpdateAction, isNewerVersion, updateCapability, RELEASES_URL } from "./updateCheck";
+
+describe("isNewerVersion", () => {
+  it("compares each numeric field in order", () => {
+    expect(isNewerVersion("0.9.2", "0.9.1")).toBe(true);
+    expect(isNewerVersion("0.10.0", "0.9.9")).toBe(true);
+    expect(isNewerVersion("1.0.0", "0.99.99")).toBe(true);
+    expect(isNewerVersion("0.9.1", "0.9.2")).toBe(false);
+  });
+
+  it("does not offer the version already installed", () => {
+    expect(isNewerVersion("0.9.1", "0.9.1")).toBe(false);
+  });
+
+  it("tolerates a leading v, which is how the tags are written", () => {
+    // build-release.yml derives VERSION from refs/tags/v0.9.1.
+    expect(isNewerVersion("v0.9.2", "0.9.1")).toBe(true);
+    expect(isNewerVersion("0.9.2", "v0.9.1")).toBe(true);
+  });
+
+  it("sorts a pre-release below the release of the same number", () => {
+    // Otherwise everyone on 0.9.2 gets offered 0.9.2-rc1 as an "upgrade" —
+    // build-release.yml marks exactly these suffixes as prereleases.
+    expect(isNewerVersion("0.9.2-rc1", "0.9.2")).toBe(false);
+    expect(isNewerVersion("0.9.2", "0.9.2-rc1")).toBe(true);
+    expect(isNewerVersion("0.9.2-rc1", "0.9.1")).toBe(true);
+  });
+
+  it("treats a missing patch field as zero rather than NaN", () => {
+    expect(isNewerVersion("1.0", "0.9.9")).toBe(true);
+    expect(isNewerVersion("0.9", "0.9.1")).toBe(false);
+  });
+});
+
+describe("updateCapability", () => {
+  it("reports install for the desktop platforms", () => {
+    expect(updateCapability("linux")).toBe("install");
+    expect(updateCapability("windows")).toBe("install");
+    expect(updateCapability("macos")).toBe("install");
+  });
+
+  it("reports link-only for mobile", () => {
+    // tauri-plugin-updater is not compiled for Android at all: an app cannot
+    // overwrite its own APK. Calling it there would throw, not degrade.
+    expect(updateCapability("android")).toBe("link-only");
+    expect(updateCapability("ios")).toBe("link-only");
+  });
+});
+
+describe("decideUpdateAction", () => {
+  it("offers nothing when the endpoint reported nothing", () => {
+    expect(decideUpdateAction("linux", null)).toEqual({ kind: "none" });
+    expect(decideUpdateAction("android", null)).toEqual({ kind: "none" });
+  });
+
+  it("offers a real install on desktop", () => {
+    expect(decideUpdateAction("linux", { version: "0.9.2", notes: "fixes" })).toEqual({
+      kind: "install",
+      version: "0.9.2",
+      notes: "fixes",
+    });
+  });
+
+  it("normalises absent notes to null rather than undefined", () => {
+    // The Svelte side renders `{#if notes}`; undefined vs null is the kind of
+    // difference that only shows up as a blank panel in front of a user.
+    expect(decideUpdateAction("windows", { version: "0.9.2" })).toEqual({
+      kind: "install",
+      version: "0.9.2",
+      notes: null,
+    });
+  });
+
+  it("offers the releases page on Android instead of an install", () => {
+    expect(decideUpdateAction("android", { version: "0.9.2" })).toEqual({
+      kind: "open-releases",
+      version: "0.9.2",
+      url: RELEASES_URL,
+    });
+  });
+
+  it("points at Gitea, not GitHub", () => {
+    // The release body used to link "GitHub Issues" on a Gitea-hosted project.
+    expect(RELEASES_URL).toContain("gitea.tourolle.paris");
+  });
+});

src/lib/utils/updateCheck.ts

@@ -0,0 +1,179 @@
+/**
+ * In-app update: decide what to offer, and on which platform.
+ *
+ * TRACES: UR-077 | DR-217
+ *
+ * Until this existed there was no upgrade path at all. Somebody who installed a
+ * `.AppImage` or ran the NSIS installer stayed on that version permanently and
+ * had no way to learn a newer one existed — the release notes were the only
+ * announcement, and nothing in the app ever read them.
+ *
+ * ## Two platforms, two answers
+ *
+ * `tauri-plugin-updater` replaces the running application's own files. That is
+ * possible on Linux and Windows and impossible on Android, where installing an
+ * APK is the package installer's job and an app may not overwrite itself. So
+ * the plugin is compiled only for desktop (see `Cargo.toml`'s
+ * `cfg(not(any(target_os = "android", target_os = "ios")))` table) and Android
+ * gets the honest alternative: a link to the releases page.
+ *
+ * That asymmetry is the whole reason this module is a pure decision function
+ * plus a thin caller. `decideUpdateAction` takes the platform and what the
+ * endpoint said and returns *what to offer*; the Svelte side does the offering.
+ * The alternative — `if (platform() === "android")` sprinkled through a
+ * component — is exactly the shape that has bitten this codebase before.
+ *
+ * ## Versions
+ *
+ * Comparison is left to the updater plugin on desktop, which compares against
+ * the version baked into the bundle. `isNewerVersion` exists for the Android
+ * path, where nothing native is available to do it, and for tests.
+ */
+
+import { createLogger } from "$lib/utils/logger";
+
+const log = createLogger("UpdateCheck");
+
+/** Where a user goes to fetch a build by hand. */
+export const RELEASES_URL = "https://gitea.tourolle.paris/dtourolle/jellytau/releases";
+
+/** What the UI should offer the user. */
+export type UpdateAction =
+  /** Nothing to do — already current, or the check failed and we stay quiet. */
+  | { kind: "none" }
+  /** Desktop: the plugin can download, verify and install this itself. */
+  | { kind: "install"; version: string; notes: string | null }
+  /** Android: we can only point at the download. */
+  | { kind: "open-releases"; version: string; url: string };
+
+/**
+ * Compare two semver-ish version strings.
+ *
+ * Deliberately small: JellyTau's versions are `MAJOR.MINOR.PATCH` with an
+ * optional `-rc1`/`-beta` suffix (build-release.yml keys prerelease off exactly
+ * those). A pre-release sorts *below* the same numeric version, so 0.9.2-rc1
+ * does not offer itself as an upgrade to somebody on 0.9.2.
+ *
+ * Returns true when `candidate` is strictly newer than `current`.
+ */
+export function isNewerVersion(candidate: string, current: string): boolean {
+  const parse = (raw: string) => {
+    const cleaned = raw.trim().replace(/^v/, "");
+    const [core, ...rest] = cleaned.split("-");
+    const parts = core.split(".").map((n) => Number.parseInt(n, 10));
+    return {
+      nums: [parts[0] || 0, parts[1] || 0, parts[2] || 0],
+      // Any suffix at all makes it a pre-release.
+      pre: rest.length > 0,
+    };
+  };
+
+  const a = parse(candidate);
+  const b = parse(current);
+
+  for (let i = 0; i < 3; i++) {
+    if (a.nums[i] !== b.nums[i]) return a.nums[i] > b.nums[i];
+  }
+  // Same numbers: a release beats a pre-release, nothing beats a release.
+  return b.pre && !a.pre;
+}
+
+/** What a platform can do about an available update. */
+export type UpdateCapability = "install" | "link-only";
+
+/**
+ * Map a platform string (from `@tauri-apps/plugin-os`) to what it can do.
+ *
+ * Android is link-only because the updater plugin is not compiled there at all;
+ * calling it would throw rather than degrade.
+ */
+export function updateCapability(platform: string): UpdateCapability {
+  return platform === "android" || platform === "ios" ? "link-only" : "install";
+}
+
+/**
+ * Decide what to offer.
+ *
+ * `available` is null when the endpoint reported no newer version, or when the
+ * check failed — the caller collapses both, because the UI treatment is the
+ * same and a failed update check must never interrupt somebody watching
+ * something.
+ */
+export function decideUpdateAction(
+  platform: string,
+  available: { version: string; notes?: string | null } | null,
+): UpdateAction {
+  if (!available) return { kind: "none" };
+
+  if (updateCapability(platform) === "link-only") {
+    return { kind: "open-releases", version: available.version, url: RELEASES_URL };
+  }
+
+  return { kind: "install", version: available.version, notes: available.notes ?? null };
+}
+
+/**
+ * Check for an update and return what to offer.
+ *
+ * Everything here is best-effort: a server that is down, an endpoint that
+ * 404s, or a machine with no network must produce a quiet "none", never an
+ * error the user sees. An update check is not something the user asked for.
+ */
+export async function checkForUpdate(): Promise<UpdateAction> {
+  try {
+    const { platform } = await import("@tauri-apps/plugin-os");
+    const current = platform();
+
+    if (updateCapability(current) === "link-only") {
+      // Nothing native to ask on Android. Offering the releases page
+      // unconditionally would nag on every launch, so the mobile path is
+      // surfaced from Settings on demand rather than checked automatically.
+      return { kind: "none" };
+    }
+
+    const { check } = await import("@tauri-apps/plugin-updater");
+    const update = await check();
+    if (!update) return { kind: "none" };
+
+    log.info("update available", update.version);
+    return decideUpdateAction(current, { version: update.version, notes: update.body ?? null });
+  } catch (error) {
+    log.warn("update check failed; staying quiet", error);
+    return { kind: "none" };
+  }
+}
+
+/**
+ * Download, verify and install a desktop update, then relaunch.
+ *
+ * The signature check happens inside the plugin against the public key in
+ * `tauri.conf.json` — an artifact that does not verify is refused there, which
+ * is the entire security value of the updater. `onProgress` is fed the fraction
+ * downloaded so the UI can show something during what may be a 100 MB fetch.
+ */
+export async function installUpdate(onProgress?: (fraction: number) => void): Promise<void> {
+  const { check } = await import("@tauri-apps/plugin-updater");
+  const update = await check();
+  if (!update) return;
+
+  let downloaded = 0;
+  let contentLength = 0;
+
+  await update.downloadAndInstall((event) => {
+    switch (event.event) {
+      case "Started":
+        contentLength = event.data.contentLength ?? 0;
+        break;
+      case "Progress":
+        downloaded += event.data.chunkLength;
+        if (contentLength > 0) onProgress?.(downloaded / contentLength);
+        break;
+      case "Finished":
+        onProgress?.(1);
+        break;
+    }
+  });
+
+  const { relaunch } = await import("@tauri-apps/plugin-process");
+  await relaunch();
+}