Logo to 15rem, sandbox-aware desktop launcher, and update-on-start

**Logo** is 15rem (240px) wide, 80px tall at its 3:1 ratio. Measured in a
browser: exact at 1440, and at 390 it shrinks to 232px rather than overflowing,
with the download button still beside it.

**Sandbox.** Reported from a real machine: the AppImage aborts with

  FATAL:setuid_sandbox_host.cc(163) The SUID sandbox helper binary was found,
  but is not configured correctly.

Chromium wants one of two sandboxes. The namespace sandbox needs unprivileged
user namespaces, which recent kernels restrict; the fallback SUID helper needs
chrome-sandbox owned by root with mode 4755, which an install without root
cannot set. The .deb was already covered by its postinst — but so was nothing
else, and the installer's no-root path had exactly the same hole.

The installer now writes a launcher that decides at run time instead of the
installer guessing: SUID helper if configured, else the namespace sandbox if
the kernel allows it, else --no-sandbox with a message saying why and pointing
at the .deb. The sandbox is only dropped where neither option actually exists.

**Update on start**, for both surfaces, shelling out to the same installer
rather than embedding electron-updater — the installer already understands
every layout DiskPush can be installed in, and electron-updater only handles
AppImage on Linux.

The CLI checks before running the command and re-execs afterwards, so the
command runs on the version just installed rather than the one already loaded
into memory. It is rate-limited to once every six hours, because a CLI that
makes a network request per invocation hangs whenever GitHub is slow, and it
is skipped entirely for --json output, for the self-management commands, and
under DISKPUSH_NO_AUTO_UPDATE.

The desktop applies the update on launch but defers the restart while a
transfer is running. Restarting a file-transfer app mid-transfer to pick up a
version bump would abandon the transfer.

Version comparison is numeric, with a test: as strings, "0.10.0" < "0.9.0".

209 tests pass.

Author: ralyodio

apps/cli/src/bin.ts

@@ -12,6 +12,7 @@ import { EXIT } from './exit-codes.js'
 import { HELP, VERSION } from './help.js'
 import { Output } from './output.js'
 import { ArgvError, hasFlag, looksLikeEndpoint, parseArgv } from './parse-argv.js'
+import { autoUpdate, reexec } from './self-update.js'
 import { existsSync } from 'node:fs'
 
 async function main(argv: readonly string[]): Promise<number> {
@@ -58,6 +59,12 @@ async function main(argv: readonly string[]): Promise<number> {
     return EXIT.ok
   }
 
+  // Check for a newer release before running the command, so it runs on the
+  // version just installed. Rate-limited, silent when offline, and skipped
+  // entirely for --json, for the self-management commands, and when
+  // DISKPUSH_NO_AUTO_UPDATE is set.
+  if (await autoUpdate(command, output) === 'updated') reexec()
+
   const store = await DiskPushStore.open()
   try {
     if (command in TRANSFER_ALIASES) return await runTransfer(command, parsed, store, output)

apps/cli/src/self-update.test.ts

@@ -0,0 +1,23 @@
+import { describe, expect, it } from 'vitest'
+import { isNewer } from './self-update.js'
+
+describe('isNewer', () => {
+  it('compares numerically, not lexically', () => {
+    // The bug this exists to prevent: "0.10.0" < "0.9.0" as strings.
+    expect(isNewer('0.10.0', '0.9.0')).toBe(true)
+    expect(isNewer('0.9.0', '0.10.0')).toBe(false)
+  })
+
+  it('is false for the same version', () => {
+    expect(isNewer('1.2.3', '1.2.3')).toBe(false)
+  })
+
+  it('handles a shorter version string', () => {
+    expect(isNewer('1.3', '1.2.9')).toBe(true)
+    expect(isNewer('1.2', '1.2.1')).toBe(false)
+  })
+
+  it('does not treat an older release as newer', () => {
+    expect(isNewer('0.1.0', '0.2.0')).toBe(false)
+  })
+})

apps/cli/src/self-update.ts

@@ -0,0 +1,138 @@
+import { spawnSync } from 'node:child_process'
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { VERSION } from './help.js'
+import type { Output } from './output.js'
+import { readManifest, stateDirectory } from './commands/self.js'
+
+/**
+ * Startup update check.
+ *
+ * Rate-limited rather than run on every invocation: a CLI that makes a network
+ * request before each command is a CLI that hangs whenever GitHub is slow, and
+ * `diskpush` is the kind of thing people put in a loop.
+ */
+const CHECK_INTERVAL_MS = 6 * 60 * 60 * 1000
+const RELEASES_API = 'https://api.github.com/repos/profullstack/diskpush/releases/latest'
+
+function stampPath(): string {
+  return join(stateDirectory(), 'last-update-check')
+}
+
+function readStamp(): number {
+  try {
+    return Number(readFileSync(stampPath(), 'utf8').trim()) || 0
+  } catch {
+    return 0
+  }
+}
+
+function writeStamp(): void {
+  try {
+    mkdirSync(dirname(stampPath()), { recursive: true })
+    writeFileSync(stampPath(), String(Date.now()))
+  } catch {
+    // A cache we cannot write is a check that runs more often, not an error.
+  }
+}
+
+/** Compares dotted versions numerically, so 0.10.0 is newer than 0.9.0. */
+export function isNewer(candidate: string, current: string): boolean {
+  const a = candidate.split('.').map(Number)
+  const b = current.split('.').map(Number)
+  for (let i = 0; i < Math.max(a.length, b.length); i += 1) {
+    const left = a[i] ?? 0
+    const right = b[i] ?? 0
+    if (left !== right) return left > right
+  }
+  return false
+}
+
+async function latestVersion(timeoutMs = 4000): Promise<string | null> {
+  try {
+    const response = await fetch(RELEASES_API, {
+      headers: { accept: 'application/vnd.github+json', 'user-agent': `diskpush/${VERSION}` },
+      signal: AbortSignal.timeout(timeoutMs),
+    })
+    if (!response.ok) return null
+    const release = (await response.json()) as { tag_name?: string; draft?: boolean }
+    if (!release.tag_name || release.draft) return null
+    return release.tag_name.replace(/^v/, '')
+  } catch {
+    // Offline, rate-limited, slow: none of these should stop the command the
+    // user actually typed.
+    return null
+  }
+}
+
+export type AutoUpdateOutcome = 'skipped' | 'current' | 'updated' | 'failed'
+
+/**
+ * Checks for a newer release and installs it before the requested command
+ * runs, so the command executes on the version it just installed.
+ *
+ * Deliberately does nothing when: the copy was not installed by the installer,
+ * output is machine-readable, the command is one where a surprise upgrade
+ * would be wrong, or DISKPUSH_NO_AUTO_UPDATE is set.
+ */
+export async function autoUpdate(command: string | null, output: Output, force = false): Promise<AutoUpdateOutcome> {
+  if (process.env.DISKPUSH_NO_AUTO_UPDATE) return 'skipped'
+  // --json output is parsed by scripts; a progress line in it is a bug.
+  if (output.isJson) return 'skipped'
+  // Updating inside these would be circular, surprising, or both.
+  if (command && ['update', 'upgrade', 'uninstall', 'remove', 'version', 'help', 'doctor'].includes(command)) {
+    return 'skipped'
+  }
+
+  const manifest = readManifest()
+  if (!manifest || manifest.method === 'source') return 'skipped'
+
+  if (!force && Date.now() - readStamp() < CHECK_INTERVAL_MS) return 'skipped'
+  writeStamp()
+
+  const latest = await latestVersion()
+  if (!latest) return 'skipped'
+  if (!isNewer(latest, VERSION)) return 'current'
+
+  output.warn(`DiskPush ${latest} is available (you have ${VERSION}). Updating...`)
+
+  const script = spawnSync('sh', ['-c', `curl -fsSL ${manifest.installer} || wget -qO- ${manifest.installer}`], {
+    encoding: 'utf8',
+    maxBuffer: 16 * 1024 * 1024,
+  })
+  if (script.status !== 0 || !script.stdout) {
+    output.warn('Update check failed to download the installer; continuing on the current version.')
+    return 'failed'
+  }
+
+  const run = spawnSync('sh', ['-s', '--', ...(manifest.desktop ? [] : ['--cli-only'])], {
+    input: script.stdout,
+    stdio: ['pipe', 'ignore', 'inherit'],
+  })
+  if (run.status !== 0) {
+    output.warn('Update failed; continuing on the current version.')
+    return 'failed'
+  }
+
+  output.warn(`Updated to ${latest}.`)
+  return 'updated'
+}
+
+/**
+ * Re-runs the original command on the freshly installed version.
+ *
+ * Without this the process would carry on executing the code it loaded at
+ * startup, which is the old version — so the update would appear to have had
+ * no effect until the next invocation.
+ */
+export function reexec(): never {
+  const manifest = readManifest()
+  const binary = manifest ? join(dirname(stateDirectory()), '..', 'bin', 'diskpush') : null
+  const target = binary && existsSync(binary) ? binary : process.argv[1]
+
+  const result = spawnSync(target!, process.argv.slice(2), {
+    stdio: 'inherit',
+    env: { ...process.env, DISKPUSH_NO_AUTO_UPDATE: '1' },
+  })
+  process.exit(result.status ?? 0)
+}

apps/desktop/electron/main/index.ts

@@ -1,8 +1,9 @@
 import { join } from 'node:path'
 import { app, BrowserWindow, shell } from 'electron'
 import { registerIpc } from './ipc'
+import { checkForUpdates } from './services/updater'
 import { closeAllSessions } from './services/sessions'
-import { cancelAll } from './services/transfers'
+import { cancelAll, hasActiveTransfer } from './services/transfers'
 
 const isDev = !app.isPackaged && process.env.DISKPUSH_DEV === '1'
 const DEV_URL = 'http://localhost:3210'
@@ -75,6 +76,9 @@ app.whenReady().then(() => {
   registerIpc()
   createWindow()
 
+  // Not awaited: a slow or unreachable GitHub must not delay the window.
+  void checkForUpdates(hasActiveTransfer)
+
   app.on('activate', () => {
     if (BrowserWindow.getAllWindows().length === 0) createWindow()
   })

apps/desktop/electron/main/services/transfers.ts

@@ -237,6 +237,11 @@ export function cancelTransfer(jobId: string): boolean {
   return true
 }
 
+/** True while any transfer is in flight; the updater defers a restart on it. */
+export function hasActiveTransfer(): boolean {
+  return running.size > 0
+}
+
 export function cancelAll(): void {
   for (const job of running.values()) job.cancel()
 }

apps/desktop/electron/main/services/updater.ts

@@ -0,0 +1,109 @@
+import { spawn } from 'node:child_process'
+import { existsSync, readFileSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+import { app, BrowserWindow, dialog } from 'electron'
+
+/**
+ * Startup update check.
+ *
+ * It shells out to the same installer the CLI uses rather than embedding
+ * electron-updater: the installer already knows every way DiskPush can be
+ * installed, and electron-updater only handles AppImage on Linux, which is not
+ * the layout the installer produces.
+ */
+
+const RELEASES_API = 'https://api.github.com/repos/profullstack/diskpush/releases/latest'
+
+type Manifest = { version: string; method: string; installer: string; desktop: boolean }
+
+function manifestPath(): string {
+  const dataHome = process.env.XDG_DATA_HOME ?? join(homedir(), '.local', 'share')
+  return join(process.env.DISKPUSH_HOME ? join(process.env.DISKPUSH_HOME, 'install') : join(dataHome, 'diskpush'), 'manifest.json')
+}
+
+function readManifest(): Manifest | null {
+  const path = manifestPath()
+  if (!existsSync(path)) return null
+  try {
+    return JSON.parse(readFileSync(path, 'utf8')) as Manifest
+  } catch {
+    return null
+  }
+}
+
+/** Numeric comparison, so 0.10.0 is newer than 0.9.0. */
+export function isNewer(candidate: string, current: string): boolean {
+  const a = candidate.split('.').map(Number)
+  const b = current.split('.').map(Number)
+  for (let i = 0; i < Math.max(a.length, b.length); i += 1) {
+    const left = a[i] ?? 0
+    const right = b[i] ?? 0
+    if (left !== right) return left > right
+  }
+  return false
+}
+
+async function latestVersion(): Promise<string | null> {
+  try {
+    const response = await fetch(RELEASES_API, {
+      headers: { accept: 'application/vnd.github+json', 'user-agent': `diskpush/${app.getVersion()}` },
+      signal: AbortSignal.timeout(6000),
+    })
+    if (!response.ok) return null
+    const release = (await response.json()) as { tag_name?: string; draft?: boolean }
+    if (!release.tag_name || release.draft) return null
+    return release.tag_name.replace(/^v/, '')
+  } catch {
+    return null
+  }
+}
+
+function runInstaller(installer: string): Promise<boolean> {
+  return new Promise((resolve) => {
+    const child = spawn('sh', ['-c', `curl -fsSL ${installer} | sh`], { stdio: 'ignore', detached: false })
+    child.on('error', () => resolve(false))
+    child.on('close', (code) => resolve(code === 0))
+  })
+}
+
+/**
+ * @param hasActiveTransfer tells the updater whether restarting right now
+ *   would interrupt work. It applies the update either way, but a file
+ *   transfer is exactly the thing not to kill for a version bump.
+ */
+export async function checkForUpdates(hasActiveTransfer: () => boolean): Promise<void> {
+  if (process.env.DISKPUSH_NO_AUTO_UPDATE) return
+
+  const manifest = readManifest()
+  // Installed some other way (a .deb, a distro package, a source checkout):
+  // whatever installed it is what should update it.
+  if (!manifest || manifest.method === 'source') return
+
+  const latest = await latestVersion()
+  if (!latest || !isNewer(latest, app.getVersion())) return
+
+  const installed = await runInstaller(manifest.installer)
+  if (!installed) return
+
+  // The new version is on disk; only the running process is stale. Restarting
+  // mid-transfer would abandon it, so that waits.
+  if (hasActiveTransfer()) return
+
+  const window = BrowserWindow.getFocusedWindow() ?? BrowserWindow.getAllWindows()[0]
+  const options = {
+    type: 'info' as const,
+    buttons: ['Later', 'Restart now'],
+    defaultId: 1,
+    cancelId: 0,
+    title: 'Update installed',
+    message: `DiskPush ${latest} has been installed.`,
+    detail: 'Restart to use it. Your connections, profiles and queued jobs are unaffected.',
+  }
+
+  const result = window ? await dialog.showMessageBox(window, options) : await dialog.showMessageBox(options)
+  if (result.response === 1) {
+    app.relaunch()
+    app.exit(0)
+  }
+}

scripts/install.sh

@@ -116,6 +116,41 @@ if [ "$WANT_DESKTOP" = yes ]; then
     tar -xzf "$WORK/app.tar.gz" -C "$SHARE/app" --strip-components=1
     METHOD=linux-app
 
+    # Chromium wants one of two sandboxes. The namespace sandbox needs
+    # unprivileged user namespaces; the fallback SUID helper needs
+    # chrome-sandbox owned by root with mode 4755, which an install without
+    # root cannot set. Where a kernel denies the first and we cannot provide
+    # the second, Electron aborts on launch:
+    #
+    #   FATAL:setuid_sandbox_host.cc(163) The SUID sandbox helper binary was
+    #   found, but is not configured correctly.
+    #
+    # So the launcher decides at run time rather than the installer guessing,
+    # and only drops the sandbox when neither option is actually available.
+    cat > "$SHARE/app/launch.sh" <<'LAUNCH'
+#!/bin/sh
+set -eu
+here="$(cd "$(dirname "$0")" && pwd)"
+app="$here/diskpush-desktop"
+
+# Is the SUID helper correctly configured? (A .deb install sets this up.)
+if [ -u "$here/chrome-sandbox" ]; then
+  exec "$app" "$@"
+fi
+
+# Can Chromium use the namespace sandbox instead?
+if unshare --user true >/dev/null 2>&1; then
+  exec "$app" "$@"
+fi
+
+echo "diskpush: this kernel denies unprivileged user namespaces, and the SUID" >&2
+echo "          sandbox helper needs root to configure, which this install does" >&2
+echo "          not have. Starting without Chromium's sandbox." >&2
+echo "          For a sandboxed install, use the .deb: https://diskpush.com/download" >&2
+exec "$app" --no-sandbox "$@"
+LAUNCH
+    chmod 0755 "$SHARE/app/launch.sh"
+
     # A launcher, an icon, and a menu entry. This is what a .deb would give
     # you; done by hand because doing it by hand needs no root.
     mkdir -p "$PREFIX/share/applications" "$PREFIX/share/icons/hicolor/512x512/apps"
@@ -128,7 +163,7 @@ Type=Application
 Name=DiskPush
 GenericName=File Transfer
 Comment=Push files fast. Sync only what changed.
-Exec=$SHARE/app/diskpush-desktop %U
+Exec=$SHARE/app/launch.sh %U
 Icon=diskpush
 Terminal=false
 Categories=Utility;FileTransfer;Network;