From 4345b4fb7e7cfc79d3feda19a91b0ca30667aa76 Mon Sep 17 00:00:00 2001
From: Julius Olsson <julius.olsson05@gmail.com>
Date: Sun, 27 Sep 2026 08:20:34 -0700
Subject: [PATCH 1/5] docs(cli-updates): plan an update that cannot start
 saying so (#1425)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../2026-09-27-cli-update-could-not-start.md  | 81 +++++++++++++++++++
 1 file changed, 81 insertions(+)
 create mode 100644 docs/plans/2026-09-27-cli-update-could-not-start.md

diff --git a/docs/plans/2026-09-27-cli-update-could-not-start.md b/docs/plans/2026-09-27-cli-update-could-not-start.md
new file mode 100644
index 000000000..69bb4a547
--- /dev/null
+++ b/docs/plans/2026-09-27-cli-update-could-not-start.md
@@ -0,0 +1,81 @@
+# An update that cannot start says so and stays dismissable (#1425)
+
+Size: short plan. The root cause is known and the change is bounded
+(found by #1423's review b).
+
+## Outcome
+
+When **Update Now** or an automatic update cannot start, the CLI update
+banner stops showing an undismissable "Updating…" row forever. It shows a
+dismissable failure in fixed words, with **Update now** to retry. A click
+whose IPC call rejects is also said instead of dropped.
+
+## Evidence (verified 2026-09-27, do not re-derive)
+
+- `CliUpdateOrchestrator.runUpdate` publishes `updating`, then awaits
+  `openLog(cli)`, which `mkdir`s `CLI_UPDATE_LOG_DIR` outside any catch.
+  An EACCES or ENOSPC there rejects, and the snapshot stays `updating`.
+  `describeState` marks `updating` as `undismissable`.
+- Every later await in `runUpdate` already swallows or returns a result:
+  - `appendLog` and `appendDiagnostics` catch;
+  - `readInstalledVersion` returns `{ ok }`;
+  - the command runs inside a try.
+
+  So `openLog` is the one throw that strands the state.
+- `CliUpdateBanner` fires `cliUpdatesUpdateNow` with `void` in both the
+  `notify` and the user-`deferred` rows. The IPC handler's rejection
+  (`updateOnce` throwing) is dropped, and nothing is said.
+- #1423 already gave banner actions a result contract: `onClick` may
+  resolve `false`, and the row then shows `failureText`, keyed by
+  `resultKey`.
+- `failed.logPath` is read only by the `cli-updates:open-log` handler and
+  the banner's `resultKey`.
+
+## Change
+
+- `@shared/types/cliUpdate`:
+  - `failed.logPath: string | null` (null = there is no log, because the
+    update never started);
+  - `CliUpdateFailureReason` adds `'could-not-start'`.
+- `runUpdate`: `openLog` runs in a try. On rejection it warns the cause
+  in main's log (never the renderer; q22) and publishes
+  `failed { reason: 'could-not-start', logPath: null }`, then returns
+  without running the command.
+  - Ruling: do not run the update without a log. A state dir we cannot
+    write to (ENOSPC, EACCES) makes a package install likely to fail too,
+    and a failure with no log would leave the user nothing to look at.
+    Cost if wrong: one retry after the user fixes the disk.
+- `cli-updates:open-log`: a `failed` state with `logPath === null` opens
+  nothing and answers `false`. The banner shows no View Log for it anyway.
+- Banner:
+  - `could-not-start` reads: "Couldn't start the <label> update: Agent
+    Code couldn't create its update log." The hint names disk space or
+    permissions on the Agent Code data folder. The action is **Update
+    now**, as a retry. Fixed words only.
+  - Every Update now action awaits `cliUpdatesUpdateNow`, resolves
+    `false` on rejection, and has `failureText` "Couldn't start the
+    update. Try again."
+
+## Tests (fail-first)
+
+- Orchestrator test: `mkdir` of the log dir rejects (EACCES). The snapshot
+  goes `updating` → `failed { reason: 'could-not-start', logPath: null }`,
+  the update command is never run, and nothing stays `updating`. Before
+  the fix: `updateOnce` rejects and the state stays `updating`.
+- Banner renderer test:
+  - a rejecting `cliUpdatesUpdateNow` shows the failure alert;
+  - `describeState` for `could-not-start` is dismissable, shows the fixed
+    sentence and offers Update now.
+  - Before the fix: no alert, and there is no such state.
+- `cli-updates:open-log` with a null `logPath` answers `false` without
+  calling `shell.openPath`.
+
+## Verification
+
+`npx tsc -b` and the scoped vitest runs. Boundary: the app is never
+launched, and a read-only state dir is simulated at the `fs` boundary.
+
+## Out of scope
+
+- Pruning `cli-update-logs` (nothing prunes it; unchanged).
+- The phone has no CLI update surface.

From 3c465d38ef51fe4ca243b1a6d8f4cf9b062c434c Mon Sep 17 00:00:00 2001
From: Julius Olsson <julius.olsson05@gmail.com>
Date: Sun, 27 Sep 2026 08:22:08 -0700
Subject: [PATCH 2/5] fix(cli-updates): an update that cannot start fails as
 could-not-start, and Update now says a rejected request (#1425)

runUpdate caught nothing after publishing the undismissable 'updating':
openLog's mkdir (EACCES/ENOSPC) stranded it forever. It now publishes
failed { reason: 'could-not-start', logPath: null } without running the
command. The banner says so in fixed words with Update now as the retry
(keyed per attempt), open-log opens nothing for it, and every Update now
action awaits its IPC and shows 'Couldn't start the update. Try again.'
on rejection instead of dropping it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/main/ipc/cliUpdates.test.ts               | 12 ++++
 src/main/ipc/cliUpdates.ts                    |  4 +-
 ...liUpdateOrchestrator.couldNotStart.test.ts | 63 +++++++++++++++++++
 src/main/setup/cliUpdateOrchestrator.ts       | 27 +++++++-
 .../CliUpdateBanner.renderer.test.tsx         | 38 +++++++++++
 .../features/cli-updates/CliUpdateBanner.tsx  | 48 +++++++++-----
 .../src/features/cli-updates/store.ts         |  9 ++-
 src/shared/types/cliUpdate.ts                 | 10 ++-
 8 files changed, 191 insertions(+), 20 deletions(-)
 create mode 100644 src/main/setup/cliUpdateOrchestrator.couldNotStart.test.ts

diff --git a/src/main/ipc/cliUpdates.test.ts b/src/main/ipc/cliUpdates.test.ts
index 25e0986ee..067a14c30 100644
--- a/src/main/ipc/cliUpdates.test.ts
+++ b/src/main/ipc/cliUpdates.test.ts
@@ -59,3 +59,15 @@ it('opens nothing for a path, an unknown CLI, or a CLI whose state is not failed
   expect(await openLog('codex')).toBe(false)
   expect(shell.openPath).not.toHaveBeenCalled()
 })
+
+// #1425: an update that could not start has no log; there is nothing to open.
+it('opens nothing for a could-not-start failure, which has no log', async () => {
+  shell.openPath.mockResolvedValue('')
+  snapshot.claude = { ...failed, reason: 'could-not-start', logPath: null }
+  try {
+    expect(await openLog('claude')).toBe(false)
+    expect(shell.openPath).not.toHaveBeenCalled()
+  } finally {
+    snapshot.claude = failed
+  }
+})
diff --git a/src/main/ipc/cliUpdates.ts b/src/main/ipc/cliUpdates.ts
index ffdc508ce..4ad52751b 100644
--- a/src/main/ipc/cliUpdates.ts
+++ b/src/main/ipc/cliUpdates.ts
@@ -73,7 +73,9 @@ export function registerCliUpdatesIpc(orchestrator: CliUpdateOrchestrator): void
     // the one path it wrote: the current failed state's log. Anything else
     // (an unknown CLI, a state that is not `failed`) opens nothing.
     const state = cli === 'claude' || cli === 'codex' ? orchestrator.getSnapshot()[cli] : undefined
-    if (state?.kind !== 'failed') return false
+    // #1425: a `could-not-start` failure has no log (the attempt stopped
+    // before creating one); there is nothing to open.
+    if (state?.kind !== 'failed' || state.logPath === null) return false
     // shell.openPath RESOLVES with '' on success and an error string on
     // failure. WHY the answer is returned (#1250 row 10): this used to discard
     // the string on the belief that "the OS shell surfaces its own error
diff --git a/src/main/setup/cliUpdateOrchestrator.couldNotStart.test.ts b/src/main/setup/cliUpdateOrchestrator.couldNotStart.test.ts
new file mode 100644
index 000000000..d2d512348
--- /dev/null
+++ b/src/main/setup/cliUpdateOrchestrator.couldNotStart.test.ts
@@ -0,0 +1,63 @@
+import { describe, expect, it, vi } from 'vitest'
+
+// #1425 (found by #1423's review b): runUpdate published `updating`, then
+// awaited openLog's mkdir outside any catch. A read-only or full state dir
+// rejected there and the snapshot stayed `updating` — an undismissable
+// "Updating…" row forever, and a dropped IPC rejection for Update Now.
+//
+// The fs boundary is where the failure really happens, so that is the one
+// thing replaced: mkdir of the log folder rejects the way macOS does for a
+// folder the user cannot write (EACCES). The update command runner is a spy
+// that must never be reached — an update without a log is not attempted.
+const fsState = vi.hoisted(() => ({ mkdirError: null as NodeJS.ErrnoException | null }))
+vi.mock('fs/promises', async importOriginal => {
+  const actual = await importOriginal<typeof import('fs/promises')>()
+  return {
+    ...actual,
+    mkdir: async (...args: Parameters<typeof actual.mkdir>) => {
+      if (fsState.mkdirError) throw fsState.mkdirError
+      return actual.mkdir(...args)
+    },
+  }
+})
+const runShellCommand = vi.hoisted(() => vi.fn(async () => ({ stdout: '', stderr: '' })))
+vi.mock('@main/setup/shell.js', () => ({ runShellCommand }))
+vi.mock('@main/setup/toolchain.js', () => ({ getToolPath: (cli: string) => `/usr/local/bin/${cli}` }))
+vi.mock('@main/setup/cliVersion.js', async importOriginal => ({
+  ...(await importOriginal<typeof import('@main/setup/cliVersion.js')>()),
+  readInstalledVersion: async () => ({ ok: true, version: '2.1.281' }),
+}))
+vi.mock('@main/setup/setupState.js', () => ({
+  loadSetupState: async () => ({ cliUpdateCache: { claude: { latestVersion: '2.1.282' }, codex: { latestVersion: '2.1.282' } } }),
+  updateCliUpdateCache: async () => undefined,
+}))
+vi.mock('@main/setup/cliInstallMethod.js', () => ({ detectCliInstallMethod: async () => 'npm' }))
+
+import { CliUpdateOrchestrator } from './cliUpdateOrchestrator.js'
+
+describe('an update that cannot start (#1425)', () => {
+  it('fails as could-not-start with no log, instead of staying Updating', async () => {
+    fsState.mkdirError = Object.assign(new Error("EACCES: permission denied, mkdir '/state/cli-update-logs'"), { code: 'EACCES' })
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    try {
+      const orchestrator = new CliUpdateOrchestrator({ list: () => [], getSessionKind: () => 'claude' } as never, { acquireUpdateLease: () => () => undefined })
+      const kinds: string[] = []
+      orchestrator.on('state', snapshot => { kinds.push(snapshot.claude.kind) })
+
+      const snapshot = await orchestrator.updateOnce('claude')
+
+      expect(snapshot.claude).toMatchObject({
+        kind: 'failed', reason: 'could-not-start', logPath: null, from: '2.1.281', wantedLatest: '2.1.282', installMethod: 'npm',
+      })
+      // It did announce the attempt, and it did not stop there.
+      expect(kinds).toEqual(['updating', 'failed'])
+      expect(runShellCommand).not.toHaveBeenCalled()
+      // The OS text stays in main's log (q22), never in the state.
+      expect(JSON.stringify(snapshot.claude)).not.toContain('EACCES')
+      expect(warn).toHaveBeenCalled()
+    } finally {
+      fsState.mkdirError = null
+      warn.mockRestore()
+    }
+  })
+})
diff --git a/src/main/setup/cliUpdateOrchestrator.ts b/src/main/setup/cliUpdateOrchestrator.ts
index 09c161fca..05255e163 100644
--- a/src/main/setup/cliUpdateOrchestrator.ts
+++ b/src/main/setup/cliUpdateOrchestrator.ts
@@ -432,7 +432,32 @@ export class CliUpdateOrchestrator extends EventEmitter {
       startedAt: Date.now(),
     })
 
-    const logPath = await this.openLog(cli)
+    // #1425: `updating` is already published, and it is undismissable in the
+    // banner — so a failure here must END in another state, never leave this
+    // one standing. openLog's mkdir is the one await in this method that can
+    // throw (every later step catches or returns a result; see appendLog,
+    // appendDiagnostics, readInstalledVersion). A folder we cannot create
+    // (EACCES on the data folder, ENOSPC) means we do not run the update at
+    // all: a package install into a full or unwritable disk is likely to
+    // fail too, and a failure with no log would leave the user nothing to
+    // look at. The OS text stays here; the state carries a fixed reason.
+    let logPath: string
+    try {
+      logPath = await this.openLog(cli)
+    } catch (err) {
+      console.warn('[cli-update] could not create the update log; the update was not started:', err)
+      this.updateSnapshot(cli, {
+        kind: 'failed',
+        cli,
+        from: ctx.from,
+        wantedLatest: ctx.to,
+        installMethod: ctx.installMethod,
+        reason: 'could-not-start',
+        logPath: null,
+        finishedAt: Date.now(),
+      })
+      return
+    }
     const command = updateCommandFor(cli, ctx.installMethod)
     let commandFailed = false
     let timedOut = false
diff --git a/src/renderer/src/features/cli-updates/CliUpdateBanner.renderer.test.tsx b/src/renderer/src/features/cli-updates/CliUpdateBanner.renderer.test.tsx
index 731099353..e319d3658 100644
--- a/src/renderer/src/features/cli-updates/CliUpdateBanner.renderer.test.tsx
+++ b/src/renderer/src/features/cli-updates/CliUpdateBanner.renderer.test.tsx
@@ -104,3 +104,41 @@ describe('CliUpdateBanner View Log', () => {
     expect(screen.queryByRole('alert')).toBeNull()
   })
 })
+
+// #1425: an update that could not start used to leave an undismissable
+// "Updating…" row forever (main), and a rejected Update now request was dropped
+// by `void` (renderer). The first is now its own failed state; the second is
+// said on the row that was clicked.
+describe('CliUpdateBanner: an update that could not start', () => {
+  const couldNotStart = { kind: 'failed' as const, cli: 'claude' as const, from: '2.1.281', wantedLatest: '2.1.282', installMethod: 'npm' as const, reason: 'could-not-start' as const, logPath: null, finishedAt: 5 }
+
+  it('says so in fixed words, offers a retry instead of a log, and can be dismissed', async () => {
+    const updateNow = vi.fn(async () => DEFAULT_CLI_UPDATE_SNAPSHOT)
+    Object.defineProperty(window, 'api', { configurable: true, value: { ...(window as { api?: object }).api, cliUpdatesUpdateNow: updateNow } })
+    useCliUpdateStore.setState({ snapshot: { ...DEFAULT_CLI_UPDATE_SNAPSHOT, claude: couldNotStart }, dismissed: new Set() })
+    render(<CliUpdateBanner />)
+    expect(screen.getByText("Couldn't start the Claude Code update: Agent Code couldn't create its update log. Still at 2.1.281.")).toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'View Log' })).toBeNull()
+    await act(async () => { fireEvent.click(screen.getByRole('button', { name: 'Update now' })) })
+    expect(updateNow).toHaveBeenCalledWith('claude')
+    expect(describeState('claude', couldNotStart)?.undismissable).not.toBe(true)
+  })
+
+  it('keys each attempt separately, so a dismissed failure does not hide the next click\'s', () => {
+    expect(dismissKey('claude', couldNotStart)).not.toBe(dismissKey('claude', { ...couldNotStart, finishedAt: 6 }))
+  })
+
+  it.each([
+    ['the offer', { kind: 'notify' as const, cli: 'claude' as const, installed: '2.1.281', latest: '2.1.282', severity: 'patch' as const, installMethod: 'npm' as const, checkedAt: 1 }, 'Update Now'],
+    ['a deferral of the user\'s click', { ...deferred('claude'), requestedByUser: true as const }, 'Update now'],
+  ] as const)('says a rejected Update now request on %s instead of dropping it', async (_name, state, label) => {
+    const updateNow = vi.fn(async () => { throw new Error('Error invoking remote method \'cli-updates:update-now\': EACCES /state') })
+    Object.defineProperty(window, 'api', { configurable: true, value: { ...(window as { api?: object }).api, cliUpdatesUpdateNow: updateNow } })
+    useCliUpdateStore.setState({ snapshot: { ...DEFAULT_CLI_UPDATE_SNAPSHOT, claude: state }, dismissed: new Set() })
+    render(<CliUpdateBanner />)
+    await act(async () => { fireEvent.click(screen.getByRole('button', { name: label })) })
+    // Fixed words; the IPC/OS text never reaches the screen (q22).
+    expect(screen.getByRole('alert')).toHaveTextContent("Couldn't start the update. Try again.")
+    expect(screen.getByRole('alert').textContent).not.toContain('EACCES')
+  })
+})
diff --git a/src/renderer/src/features/cli-updates/CliUpdateBanner.tsx b/src/renderer/src/features/cli-updates/CliUpdateBanner.tsx
index 1bfd37cec..f4d877a34 100644
--- a/src/renderer/src/features/cli-updates/CliUpdateBanner.tsx
+++ b/src/renderer/src/features/cli-updates/CliUpdateBanner.tsx
@@ -48,6 +48,24 @@ type BannerEntry = {
 
 // Fixed words (q22): the OS failure text stays in main's diagnostic log.
 export const CLI_UPDATE_LOG_NOT_OPENED = "Couldn't open the update log. It may have been cleaned up; the next failed update writes a new one."
+// #1425: an Update now click whose request itself failed (main rejected
+// before any state could say so) used to be dropped by `void`.
+export const CLI_UPDATE_NOT_STARTED = "Couldn't start the update. Try again."
+
+/** Every Update now action (#1425). Awaited so a rejected request is said
+ *  (resolves false → the row's failureText) instead of dropped. The snapshot
+ *  main answers with arrives over the state event as well, so success needs
+ *  nothing more here. */
+function updateNowAction(cli: CliUpdateKind, resultKey: string): NonNullable<BannerEntry['action']> {
+  return {
+    label: 'Update now',
+    // One-shot update: bypasses the automatic/notify/off preference for this
+    // click only, leaving the persisted behavior untouched.
+    onClick: () => window.api.cliUpdatesUpdateNow(cli).then(() => true, () => false),
+    failureText: CLI_UPDATE_NOT_STARTED,
+    resultKey,
+  }
+}
 
 export function describeState(cli: CliUpdateKind, state: CliUpdateState): BannerEntry | null {
   const label = cli === 'claude' ? 'Claude Code' : 'Codex'
@@ -72,6 +90,17 @@ export function describeState(cli: CliUpdateKind, state: CliUpdateState): Banner
         text: `${label} updated to ${state.to}.`,
       }
     case 'failed': {
+      if (state.reason === 'could-not-start') {
+        // #1425: the attempt stopped before running anything, so there is no
+        // log to view; the row offers the retry instead. Dismissable, unlike
+        // the `updating` row this used to leave standing forever.
+        return {
+          tone: 'warning',
+          text: `Couldn't start the ${label} update: Agent Code couldn't create its update log. Still at ${state.from}.`,
+          hint: 'Check that the disk has free space and that the Agent Code data folder is writable, then choose Update now.',
+          action: updateNowAction(cli, `could-not-start:${state.finishedAt}`),
+        }
+      }
       const reasonHint =
         state.reason === 'timeout'
           ? 'timed out'
@@ -110,7 +139,7 @@ export function describeState(cli: CliUpdateKind, state: CliUpdateState): Banner
           failureText: CLI_UPDATE_LOG_NOT_OPENED,
           // A new failed run writes a new log: an earlier "couldn't open"
           // says nothing about it (#1423 review a).
-          resultKey: state.logPath,
+          resultKey: state.logPath ?? undefined,
         },
         hint,
       }
@@ -119,15 +148,7 @@ export function describeState(cli: CliUpdateKind, state: CliUpdateState): Banner
       return {
         tone: 'info',
         text: `${label} ${state.installed} → ${state.latest} available.`,
-        action: {
-          label: 'Update Now',
-          onClick: () => {
-            // One-shot update: bypasses the automatic/notify/off
-            // preference for this click only, leaving the persisted
-            // behavior untouched.
-            void window.api.cliUpdatesUpdateNow(cli)
-          },
-        },
+        action: { ...updateNowAction(cli, `notify:${state.latest}`), label: 'Update Now' },
       }
     case 'deferred':
       // Automatic deferrals stay silent ("we'll do it later" needs no
@@ -141,12 +162,7 @@ export function describeState(cli: CliUpdateKind, state: CliUpdateState): Banner
       return {
         tone: 'info',
         text: `${label} ${state.wantedLatest} is ready, but ${label} agents are running. Close them, then choose Update now (now ${state.from}).`,
-        action: {
-          label: 'Update now',
-          onClick: () => {
-            void window.api.cliUpdatesUpdateNow(cli)
-          },
-        },
+        action: updateNowAction(cli, `deferred:${state.checkedAt}`),
       }
     case 'idle':
     case 'up-to-date':
diff --git a/src/renderer/src/features/cli-updates/store.ts b/src/renderer/src/features/cli-updates/store.ts
index a871e8074..509713212 100644
--- a/src/renderer/src/features/cli-updates/store.ts
+++ b/src/renderer/src/features/cli-updates/store.ts
@@ -77,7 +77,14 @@ export function dismissKey(cli: CliUpdateKind, state: CliUpdateState): string {
     case 'updated':
       return `${cli}:updated:${state.to}`
     case 'failed':
-      return `${cli}:failed:${state.wantedLatest}`
+      // A could-not-start row offers Update now as its retry (#1425), so it
+      // is keyed per ATTEMPT, like a user deferral: a dismissed failure must
+      // not swallow the answer to the next click. Other failures stay per
+      // version — their retry is the next launch, and re-showing the same
+      // failure every launch after a dismissal would nag.
+      return state.reason === 'could-not-start'
+        ? `${cli}:failed:${state.wantedLatest}:${state.finishedAt}`
+        : `${cli}:failed:${state.wantedLatest}`
     case 'deferred':
       // A user-requested deferral is keyed per CLICK (#1265 review A): the
       // row's Update now retries, and a dismissed explanation must not
diff --git a/src/shared/types/cliUpdate.ts b/src/shared/types/cliUpdate.ts
index 83740b4e3..6b9b60345 100644
--- a/src/shared/types/cliUpdate.ts
+++ b/src/shared/types/cliUpdate.ts
@@ -98,7 +98,10 @@ export type CliUpdateState =
       wantedLatest: string
       installMethod: CliInstallMethod
       reason: CliUpdateFailureReason
-      logPath: string
+      /** The attempt's log. Null only for `could-not-start` (#1425): the
+       *  attempt stopped before it could create one, so there is nothing to
+       *  open and the banner offers a retry instead of View Log. */
+      logPath: string | null
       finishedAt: number
     }
   /** Update was skipped because a session of this kind is currently spawned
@@ -153,6 +156,11 @@ export type CliUpdateFailureReason =
    *  the CLI is not installed or the PATH entry points at something
    *  unexpected. */
   | 'unparseable-version'
+  /** The update never ran: Agent Code could not create its log for the
+   *  attempt (a full disk, or an Agent Code data folder it cannot write).
+   *  #1425: this used to leave the state `updating` forever. No log exists;
+   *  the cause is in main's diagnostic output only (q22). */
+  | 'could-not-start'
 
 /** User preference for how aggressive the auto-updater should be. Persisted
  *  in setup.json (not the renderer's settings.json) because setup.json is

From d9b18e92b3d7bfa132dc6d72f50ef606c2d8d5f1 Mon Sep 17 00:00:00 2001
From: Julius Olsson <julius.olsson05@gmail.com>
Date: Sun, 27 Sep 2026 10:54:45 -0700
Subject: [PATCH 3/5] fix(cli-updates): create the log before running, and
 never let publication strand updating (#1447 review a)

openLog now creates the attempt's log file (flag wx): a folder that exists
but will not take a file (EACCES, ENOSPC) used to let the update run with no
log and a View Log pointing nowhere; it is could-not-start now. updateSnapshot
contains a throwing publication (a window torn down mid-send), which used to
abort runUpdate right after 'updating' and strand it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 ...liUpdateOrchestrator.couldNotStart.test.ts | 48 ++++++++++++++++++-
 src/main/setup/cliUpdateOrchestrator.ts       | 25 +++++++++-
 2 files changed, 70 insertions(+), 3 deletions(-)

diff --git a/src/main/setup/cliUpdateOrchestrator.couldNotStart.test.ts b/src/main/setup/cliUpdateOrchestrator.couldNotStart.test.ts
index d2d512348..18fe5d47c 100644
--- a/src/main/setup/cliUpdateOrchestrator.couldNotStart.test.ts
+++ b/src/main/setup/cliUpdateOrchestrator.couldNotStart.test.ts
@@ -9,7 +9,7 @@ import { describe, expect, it, vi } from 'vitest'
 // thing replaced: mkdir of the log folder rejects the way macOS does for a
 // folder the user cannot write (EACCES). The update command runner is a spy
 // that must never be reached — an update without a log is not attempted.
-const fsState = vi.hoisted(() => ({ mkdirError: null as NodeJS.ErrnoException | null }))
+const fsState = vi.hoisted(() => ({ mkdirError: null as NodeJS.ErrnoException | null, writeError: null as NodeJS.ErrnoException | null }))
 vi.mock('fs/promises', async importOriginal => {
   const actual = await importOriginal<typeof import('fs/promises')>()
   return {
@@ -18,6 +18,10 @@ vi.mock('fs/promises', async importOriginal => {
       if (fsState.mkdirError) throw fsState.mkdirError
       return actual.mkdir(...args)
     },
+    writeFile: async (...args: Parameters<typeof actual.writeFile>) => {
+      if (fsState.writeError) throw fsState.writeError
+      return actual.writeFile(...args)
+    },
   }
 })
 const runShellCommand = vi.hoisted(() => vi.fn(async () => ({ stdout: '', stderr: '' })))
@@ -61,3 +65,45 @@ describe('an update that cannot start (#1425)', () => {
     }
   })
 })
+
+// #1447 review a: the folder was the only thing checked. A folder that already
+// exists but will not take a new file (EACCES on the folder, ENOSPC) let the
+// update run with no log, and View Log then pointed at a file that never was.
+describe('an update whose log file cannot be created (#1447 review a)', () => {
+  it('fails as could-not-start and never runs the command', async () => {
+    fsState.writeError = Object.assign(new Error("ENOSPC: no space left on device, open '/state/cli-update-logs/claude-x.log'"), { code: 'ENOSPC' })
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    runShellCommand.mockClear()
+    try {
+      const orchestrator = new CliUpdateOrchestrator({ list: () => [], getSessionKind: () => 'claude' } as never, { acquireUpdateLease: () => () => undefined })
+      const snapshot = await orchestrator.updateOnce('claude')
+      expect(snapshot.claude).toMatchObject({ kind: 'failed', reason: 'could-not-start', logPath: null })
+      expect(runShellCommand).not.toHaveBeenCalled()
+    } finally {
+      fsState.writeError = null
+      warn.mockRestore()
+    }
+  })
+})
+
+// #1447 review a: publishing a state is synchronous (emit -> the IPC broadcast
+// -> webContents.send). A listener that throws on `updating` (a window torn
+// down mid-send) aborted runUpdate before any later state, leaving the
+// snapshot `updating` for good. Publication failures must not steer the
+// update's own state machine.
+describe('a state listener that throws (#1447 review a)', () => {
+  it('does not strand updating', async () => {
+    fsState.mkdirError = Object.assign(new Error('EACCES'), { code: 'EACCES' })
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    try {
+      const orchestrator = new CliUpdateOrchestrator({ list: () => [], getSessionKind: () => 'claude' } as never, { acquireUpdateLease: () => () => undefined })
+      orchestrator.on('state', snapshot => { if (snapshot.claude.kind === 'updating') throw new Error('Object has been destroyed') })
+      const snapshot = await orchestrator.updateOnce('claude')
+      expect(snapshot.claude.kind).toBe('failed')
+      expect(orchestrator.getSnapshot().claude.kind).not.toBe('updating')
+    } finally {
+      fsState.mkdirError = null
+      warn.mockRestore()
+    }
+  })
+})
diff --git a/src/main/setup/cliUpdateOrchestrator.ts b/src/main/setup/cliUpdateOrchestrator.ts
index 05255e163..988cabea9 100644
--- a/src/main/setup/cliUpdateOrchestrator.ts
+++ b/src/main/setup/cliUpdateOrchestrator.ts
@@ -581,7 +581,19 @@ export class CliUpdateOrchestrator extends EventEmitter {
 
   private updateSnapshot(cli: CliUpdateKind, state: CliUpdateState): void {
     this.snapshot = { ...this.snapshot, [cli]: state }
-    this.emit('state', this.snapshot)
+    // WHY publication is contained (#1447 review a): emit is synchronous and
+    // its listener broadcasts to every window through webContents.send, which
+    // throws for a window torn down mid-send. That exception used to escape
+    // into runUpdate right after `updating` was published and abort it before
+    // any later state — leaving the snapshot (the source of truth, already
+    // committed above) and the other windows on an undismissable "Updating…".
+    // The state machine decides the state; a failed publication is logged and
+    // the next publication (or the renderer's snapshot fetch) catches up.
+    try {
+      this.emit('state', this.snapshot)
+    } catch (error) {
+      console.warn('[cli-update] publishing the update state failed:', error)
+    }
   }
 
   private async openLog(cli: CliUpdateKind): Promise<string> {
@@ -590,7 +602,16 @@ export class CliUpdateOrchestrator extends EventEmitter {
     // file per attempt so a re-run doesn't overwrite the last failure's
     // log while a user is trying to inspect it.
     const stamp = new Date().toISOString().replace(/[:.]/g, '-')
-    return join(CLI_UPDATE_LOG_DIR, `${cli}-${stamp}.log`)
+    const logPath = join(CLI_UPDATE_LOG_DIR, `${cli}-${stamp}.log`)
+    // WHY the file is CREATED here, not just named (#1447 review a): a folder
+    // that already exists but will not take a new file (EACCES on it, ENOSPC)
+    // passed mkdir, the update ran, every appendLog was swallowed, and View
+    // Log pointed at a file that was never written. Creating it up front is
+    // the real "can we keep a log" check; it throws into runUpdate's
+    // could-not-start path before the command runs. `wx` never truncates an
+    // earlier attempt's log that happens to share the name.
+    await writeFile(logPath, `[Agent Code] ${cli} update log, ${new Date().toISOString()}\n`, { flag: 'wx' })
+    return logPath
   }
 }
 

From 0e324332c829de266cee6055aaaebd8d3d542b58 Mon Sep 17 00:00:00 2001
From: Julius Olsson <julius.olsson05@gmail.com>
Date: Sun, 27 Sep 2026 10:57:41 -0700
Subject: [PATCH 4/5] test(cli-updates): the could-not-start retry says a
 rejected request too (#1447 review b)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../src/features/cli-updates/CliUpdateBanner.renderer.test.tsx  | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/renderer/src/features/cli-updates/CliUpdateBanner.renderer.test.tsx b/src/renderer/src/features/cli-updates/CliUpdateBanner.renderer.test.tsx
index e319d3658..79c59de0f 100644
--- a/src/renderer/src/features/cli-updates/CliUpdateBanner.renderer.test.tsx
+++ b/src/renderer/src/features/cli-updates/CliUpdateBanner.renderer.test.tsx
@@ -131,6 +131,8 @@ describe('CliUpdateBanner: an update that could not start', () => {
   it.each([
     ['the offer', { kind: 'notify' as const, cli: 'claude' as const, installed: '2.1.281', latest: '2.1.282', severity: 'patch' as const, installMethod: 'npm' as const, checkedAt: 1 }, 'Update Now'],
     ['a deferral of the user\'s click', { ...deferred('claude'), requestedByUser: true as const }, 'Update now'],
+    // #1447 review b: the could-not-start row's own retry must say a rejection too.
+    ['the could-not-start retry', { kind: 'failed' as const, cli: 'claude' as const, from: '2.1.281', wantedLatest: '2.1.282', installMethod: 'npm' as const, reason: 'could-not-start' as const, logPath: null, finishedAt: 5 }, 'Update now'],
   ] as const)('says a rejected Update now request on %s instead of dropping it', async (_name, state, label) => {
     const updateNow = vi.fn(async () => { throw new Error('Error invoking remote method \'cli-updates:update-now\': EACCES /state') })
     Object.defineProperty(window, 'api', { configurable: true, value: { ...(window as { api?: object }).api, cliUpdatesUpdateNow: updateNow } })

From 50761ac62def4ed4499498a38e3847c1c3c32d85 Mon Sep 17 00:00:00 2001
From: Julius Olsson <julius.olsson05@gmail.com>
Date: Sun, 27 Sep 2026 11:15:51 -0700
Subject: [PATCH 5/5] test(cli-updates): pin Update now's success half and the
 could-not-start hint copy (#1447 review c)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../features/cli-updates/CliUpdateBanner.renderer.test.tsx   | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/renderer/src/features/cli-updates/CliUpdateBanner.renderer.test.tsx b/src/renderer/src/features/cli-updates/CliUpdateBanner.renderer.test.tsx
index 79c59de0f..9c0c0ff63 100644
--- a/src/renderer/src/features/cli-updates/CliUpdateBanner.renderer.test.tsx
+++ b/src/renderer/src/features/cli-updates/CliUpdateBanner.renderer.test.tsx
@@ -121,7 +121,12 @@ describe('CliUpdateBanner: an update that could not start', () => {
     expect(screen.queryByRole('button', { name: 'View Log' })).toBeNull()
     await act(async () => { fireEvent.click(screen.getByRole('button', { name: 'Update now' })) })
     expect(updateNow).toHaveBeenCalledWith('claude')
+    // A request that resolves says nothing (#1447 review c: the success half
+    // of the action was unpinned).
+    expect(screen.queryByRole('alert')).toBeNull()
     expect(describeState('claude', couldNotStart)?.undismissable).not.toBe(true)
+    // The hint is user-visible copy too: fixed words, no OS text (q22).
+    expect(describeState('claude', couldNotStart)?.hint).toBe('Check that the disk has free space and that the Agent Code data folder is writable, then choose Update now.')
   })
 
   it('keys each attempt separately, so a dismissed failure does not hide the next click\'s', () => {