Harden update download lifecycle: cleanup and shutdown cancellation - #51
Merged
Conversation
Move the update orchestration out of MainWindow into a new UpdateController: startup/manual update checks, the automatic-notice policy, download, installer handoff, and the graceful shutdown from #48. MainWindow keeps only the WPF concerns (update-notice controls, status text, download-progress text) behind a new IUpdateNoticeView seam, and ISettingsHost/SettingsWindow are unchanged apart from delegating to the controller. UpdateService (SHA-256 fail-closed download) and UpdateLauncher (/IMIRROR_LAUNCH=1 silent handoff) are reused as-is; no behavior change. The controller takes injected delegates so it is unit-testable without WPF; adds 18 UpdateController tests. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Two fixes to the update workflow, built on the UpdateController extraction (#49): 1. Downloaded installers were never deleted, so %LOCALAPPDATA%\iMirror\Updates grew by one setup.exe per update forever. UpdateService.TryCleanUpDownloadedInstallers now removes leftover .exe/.download files at startup (best-effort; files locked by a still-running installer are skipped until the next start). 2. Update checks and installer downloads used CancellationToken.None, so an in-flight download raced process teardown when the user closed the app. UpdateController now owns a shutdown CancellationTokenSource that MainWindow cancels at the start of ShutdownApplicationAsync; a canceled install returns quietly without flashing the retry UI. The SHA-256 fail-closed verification and the #48 installer handoff (launch installer, then graceful shutdown, relaunch via /IMIRROR_LAUNCH=1) are unchanged. Adds 7 tests. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this fixes
1. Downloaded installer accumulation. Nothing ever deleted downloaded setup files, so
%LOCALAPPDATA%\iMirror\Updatesgrew by onesetup.exeper update forever. NewUpdateService.TryCleanUpDownloadedInstallers()removes leftover.exe/ partial.downloadfiles, called off the UI thread during the startup update check. Best-effort: a file locked by a still-running installer (the fresh post-update relaunch) is skipped and removed on the next start; unrelated files are untouched.2. No cancellation path for update work. Checks and downloads used
CancellationToken.None, so an in-flight download raced process teardown when the user closed the app mid-download.UpdateControllernow owns a shutdownCancellationTokenSource;MainWindow.ShutdownApplicationAsynccancels it first thing. The startup delay, update check, and download all observe the token. A canceled install logs and returnsfalsequietly instead of flashing the "Retry" UI on a closing window (UpdateService.DownloadSetupAsyncalready deletes the partial file on any failure, including cancellation).Unchanged
DownloadSetupAsync— untouched./SILENT ... /IMIRROR_LAUNCH=1) → graceful shutdown — same order; cancellation firing during that shutdown is a no-op since nothing is in flight.Testing
7 new tests:
UpdateServicecleanup (removes installer/partial files only, skips locked files without throwing, tolerates a missing directory) andUpdateControllercancellation (startup check stops quietly, canceled install returns false without retry UI or shutdown, manual check propagates cancellation to the settings caller). Existing tests updated for the new controller seams.Validation
dotnet build iMirror.sln -c Release— passed, 0 warnings, 0 errors.dotnet test MacMirrorReceiver.Tests\MacMirrorReceiver.Tests.csproj -c Release— passed: 90 tests, 0 failed.🤖 Generated with Claude Code