Repository navigation
feat(updater): cancel downloads with authoritative thaw acknowledgement - #813
Conversation
Test-First: src-tauri/src/update_cancel.rs::cancel_during_download_aborts_and_thaws_before_ack Test-First: src-tauri/src/update_cancel.rs::cancel_after_installer_started_is_too_late_and_keeps_freeze Test-First: src-tauri/src/update_cancel.rs::cancel_without_running_install_reports_not_running Test-First: src-tauri/src/update_cancel.rs::second_install_is_refused_until_thaw_completed Test-First: src/lib/ipc.test.ts::cancels update download through the typed command
Test-First: src-tauri/src/update_cancel.rs::cancel_during_download_aborts_and_thaws_before_ack Test-First: src-tauri/src/update_cancel.rs::cancel_after_installer_started_is_too_late_and_keeps_freeze Test-First: src-tauri/src/update_cancel.rs::cancel_without_running_install_reports_not_running Test-First: src-tauri/src/update_cancel.rs::second_install_is_refused_until_thaw_completed Test-First: src/lib/ipc.test.ts::cancels update download through the typed command
Merge Protections🟢 All 2 merge protections satisfied — ready to merge. Show 2 satisfied protections🟢 Paket-PR bringt seinen Bericht mitPackage branches (w<N>-, df<N>, ki-<N>, hq2-, dr-, z<N>-) must carry their report in the PR body, in a section that starts with "## Report".
🟢 🚦 Auto-queueWhen all merge protections are satisfied and these conditions match, this pull request will be queued automatically.
|
Cuarroc
added
the
review-ok
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 600850392d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| let _ = install | ||
| .finish(std::future::ready(Err( | ||
| "installer may have started; restart before retrying".into(), | ||
| ))) |
There was a problem hiding this comment.
After the app has completed any earlier update, its writable Installed/Promoted journal remains on disk; produce_journal normally replaces it only after the next download completes (delivery_recovery/install.rs:79-87). If that next download is cancelled, journal production is skipped, lines 1236-1239 mistake the old journal for evidence that the current installer started, and this branch reports an error without thawing. Consequently cancel_update_download rejects, maintenance remains active, and another attempt is refused until restart instead of returning the promised authoritative cancelled acknowledgement. Track whether this flight created/crossed its own journal boundary, or discard a replaceable completed journal before beginning the cancellable download.
Useful? React with 👍 / 👎.
Merge Queue Status
This pull request spent 19 minutes 1 second in the queue, including 18 minutes 46 seconds running CI. Required conditions to merge
|
Dieser Entwurf ergänzt den Abbruch eines Update-Downloads im Backend und in der IPC-Schnittstelle.
Ein erfolgreicher Abbruch wird erst bestätigt, wenn der Wartungsmodus beendet ist und ein neuer Versuch starten kann.
Die Oberfläche folgt im Paket -b; dieser PR bleibt bis zu den zwei unabhängigen Reviews ein Entwurf.
Report
Scope and candidate
15305c2e1eb503df4834f5cdce1a372f3c39964c.600850392d9310ea8b98c3d4bb176b7ca50c7817.Behavior and wire contract
cancel_update_download/cancelUpdateDownload(): Promise<CancelUpdateResult>resolves to a JSON string, using Serde camelCase:"cancelled"Update download cancelled."tooLate""notRunning"Failed thaw or interrupted execution rejects the cancellation call rather than acknowledging success, and retains the occupied slot to refuse retries. A second install returns
refused: update install already running. Successful thaw clears the slot before notifying cancellation waiters. The existing ten-minute download timeout and journal recovery rules remain in force. No dependencies were added.Evidence (2026-10-09)
Semantic RED was recorded on BASE plus a compiling stub/test scaffold, committed as
ba13ad8536ece9c6da02833aff1f89455622a8cf, before implementation:cargo test --manifest-path src-tauri/Cargo.toml update_cancelnpm run test:unit -- src/lib/ipc.test.tsGreen implementation evidence:
cargo test --manifest-path src-tauri/Cargo.toml update_cancelcargo test --manifest-path src-tauri/Cargo.toml every_command_state_type_is_managedcargo test --manifest-path src-tauri/Cargo.toml update_cancel -- --listnpm run test:unit -- src/libbash scripts/ci/red-first.sh --planbash scripts/ci/red-first.shCARGO_BUILD_JOBS=2 bash scripts/ci/gates.sh lane prepushbash scripts/ci/secret-scan.shgit push -u origin codex/w5-v16-upd-cancel-agit ls-remote origin codex/w5-v16-upd-cancel-aThe full red-first run reused existing node_modules through a temporary-base symlink after byte-comparing package-lock.json, and reused this worker's build slot for HEAD. Dependency installation was explicitly disabled in that invocation. Tests, filters and gate code were unchanged. An intermediate normal-build failure exposed that Tokio macros were test-only; the final implementation uses std::future::poll_fn and passes normal cargo-check and clippy.
Architecture drift: no new occurrences; no allowlist changes.
NICHT ABGEDECKT
#[cfg(windows)]tests or check Windows clippy branches; the Windows lane runs in the merge queue.Review and handover
Review: ausstehend (Stufe A). Two non-OpenAI vendor reviews are required at the candidate SHA; Root dispatches them (requested route: Anthropic + GLM 5.2). No worker review, labels, ready transition or merge performed.
Delivery stage: implemented, locally tested and pushed; draft handover. Review, acceptance, merge and usable UI remain separate. Native goal was created and checked through the harness goal tools; this worker's bounded goal ends at verified draft handover, while parent Z3 stays open.
Model evidence: system identity is Codex / GPT-6 family (OpenAI); an exact served runtime model ID and remaining provider quota were not exposed. The project-memory mirror was unavailable; live GitHub and Git evidence supplied the starting state.
Root-Abnahme (2026-10-09, head 6008503)
review-pr813-anthropic-r1-600850392d93.md.as_ref().unwrap()on the cancel path (unreachable today)Installhas noDrop: a panic or dropped command future betweenbegin()andfinish()keeps the single-flight slot occupied until restart (fail-closed)done)Installingis set beforeproduce_journal;TooLateis conservativefrozencell never written, so the "keeps_freeze" assertion is vacuousbeginguard,finish_unstarted, thaw before ack) has no integration testfinish_unstartedreportsNotRunningto a pending cancel; success path writes a synthetic error intodoneVerdicts: Anthropic approve; GLM approve with conditions (conditions G1/G2 → follow-up). No high finding in round 1, so no round 2 (AGENTS.md); all conditions go into UPD-CANCEL-a2 (main.rs seam, serial, directly after this merge, before UPD-CANCEL-b). Two families outside the author family (OpenAI), bound to head 6008503. Seam main.rs was assigned exclusively to this package.
NICHT ABGEDECKT (Root): Windows lane only in the merge queue; no end-to-end updater run (no real installer download); the glue path is covered by reading only until UPD-CANCEL-a2.