fix(updater): self-replace bat retries move; hard-exit to release lock

Dennis's "Update app from tray" produced no UAC prompt and no
visible change — the old exe stayed in place silently. Cause: the
.bat did a single `move /y` after a 2-second wait. Windows held the
file lock on the just-exited PyInstaller exe (bootloader teardown
+ AV scanning the new file) for longer than 2 s. The single move
silently failed; the relaunch then started the still-old exe.

Two fixes baked in:

1) `_write_self_replace_bat` now retries `move /y` up to 30 times
   with 1 s between attempts after a 3 s initial wait. As soon as
   the move succeeds we relaunch; if all 30 retries fail we leave
   the new exe in place so the user can swap it manually.

2) `install_and_restart` now calls `os._exit(0)` instead of
   `sys.exit(0)`. SystemExit only unwinds the calling thread —
   daemon threads + pystray's Windows message loop kept the
   process alive (and the file lock with it) long enough that the
   bat's retry loop sometimes still timed out. The tray icon,
   bridge HTTP server, and presence loop are also stopped cleanly
   before the hard exit so resources have a chance to release.

Bumps presence to 0.3.17. Firmware unchanged from 0.3.16.

Author: Dennis Sepede

CHANGELOG.md

@@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.17] - 2026-05-25
+
+### Fixed
+- **Auto-update appeared to succeed but the old exe stayed in place**: the `.bat` did a single `move /y` after a 2 s wait. That wasn't enough — Windows can hold the file lock on the just-exited PyInstaller exe for several seconds (bootloader teardown, AV scanning the new file). The single `move` silently failed and the user was left on the previous version with no error. The relaunch then started the still-old exe.
+  - The self-replace `.bat` now waits 3 s, then retries `move /y` up to 30 times with 1 s spacing. As soon as the move succeeds it relaunches the new exe; if all 30 retries fail it leaves the new exe in place so the user can swap manually.
+  - The Python side now calls `os._exit(0)` instead of `sys.exit(0)`, so daemon threads + pystray's Windows message loop don't keep the file lock alive after the "exit".
+  - The tray icon, bridge HTTP server, and presence loop are stopped cleanly before the hard exit.
+
 ## [0.3.16] - 2026-05-25
 
 ### Fixed

presence_helper/src/busylight_presence/__init__.py

@@ -6,4 +6,4 @@
 previous manual state when the call ends.
 """
 
-__version__ = "0.3.16"
+__version__ = "0.3.17"

presence_helper/src/busylight_presence/tray.py

@@ -441,15 +441,28 @@ def cb(written: int, total: int) -> None:
             progress.set_progress(1.0)
             progress.set_message(
                 "Download complete. Restarting BusyLight…\n"
-                "Approve the Windows UAC prompt when it appears."
+                "If Windows asks for permission, click Yes."
             )
             import time
             time.sleep(1.5)
             progress.close()
-            self._stop_event.set()  # let worker threads wind down
-            install_and_restart(new_exe)
+            # Tell every cooperating thread we're going away so they
+            # release their handles + ports. Then stop the tray icon
+            # cleanly. The .bat already retries the move for 30 s in
+            # case Windows holds the exe lock longer than expected.
+            self._stop_event.set()
+            try:
+                self._bridge.stop()
+            except Exception:  # noqa: BLE001
+                pass
+            try:
+                if self._icon is not None:
+                    self._icon.stop()
+            except Exception:  # noqa: BLE001
+                pass
+            install_and_restart(new_exe)  # never returns
         except SystemExit:
-            raise  # install_and_restart exits the process by design
+            raise
         except Exception as e:  # noqa: BLE001
             log.exception("update install failed: %s", e)
             self._notify("Update failed", str(e))

presence_helper/src/busylight_presence/updater.py

@@ -201,8 +201,11 @@ def install_and_restart(new_exe: Path) -> None:
     """Replace the currently-running exe with `new_exe` and relaunch.
 
     Windows only. Spawns a detached `cmd /c <bat>` and exits the current
-    process — the .bat then waits, moves the file, restarts, and deletes
-    itself.
+    process — the .bat then waits, moves the file (with retries),
+    restarts, and deletes itself. We use `os._exit` rather than
+    `sys.exit` because the latter only raises `SystemExit` on the
+    calling thread; daemon threads + pystray's Windows message loop
+    would keep the exe alive and the file lock with it.
     """
     if sys.platform != "win32":
         raise RuntimeError("auto-install is Windows-only")
@@ -214,21 +217,17 @@ def install_and_restart(new_exe: Path) -> None:
 
     bat = _write_self_replace_bat(new_exe=new_exe, target=current)
     log.info("spawning installer %s -> %s", new_exe, current)
-    # DETACHED_PROCESS + CREATE_NEW_PROCESS_GROUP so the .bat survives
-    # our own exit. /c keeps cmd alive only until the bat finishes,
-    # which is what we want.
     DETACHED_PROCESS = 0x00000008
     CREATE_NEW_PROCESS_GROUP = 0x00000200
     subprocess.Popen(
         ["cmd.exe", "/c", str(bat)],
         creationflags=DETACHED_PROCESS | CREATE_NEW_PROCESS_GROUP,
         close_fds=True,
     )
-    # Give the launcher a beat to start, then bow out so the move can
-    # actually proceed (Windows holds an exclusive lock on the running
-    # exe).
-    log.info("exiting current process so updater can take over")
-    sys.exit(0)
+    # Hard exit so all threads die and Windows releases the exe lock.
+    log.info("hard-exiting current process so updater can take over")
+    import os
+    os._exit(0)
 
 
 # ---------------------------------------------------------------------------
@@ -250,21 +249,44 @@ def _self_version() -> str:
 
 
 def _write_self_replace_bat(*, new_exe: Path, target: Path) -> Path:
-    """Emit a one-shot .bat that does: wait, move, relaunch, self-delete."""
+    """Emit a one-shot .bat that does: wait, retry-move, relaunch,
+    self-delete.
+
+    The "retry-move" loop is important: Windows can hold the file
+    lock on the old exe for several seconds after the process
+    nominally exits (PyInstaller bootloader, antivirus scanning of
+    the new file, etc). A single `move` 2 seconds later often used
+    to fail silently, leaving the user with the old version and no
+    error message.
+    """
     bat = Path(tempfile.gettempdir()) / "busylight-update.bat"
-    # Use 8.3-safe absolute paths in quotes so spaces don't break the
-    # move. `move /y` overwrites; `start ""` keeps the relaunched exe
-    # decoupled from the bat's cmd window.
+    # `setlocal` + numeric tries; on each attempt sleep 1s and try to
+    # `move /y`. If it succeeds, jump out and relaunch. After 30
+    # attempts (≈30 s) give up — better than spinning forever.
     bat.write_text(
         "@echo off\r\n"
         "rem BusyLight Presence self-updater (auto-generated)\r\n"
-        # Wait ~2s for the original process to exit so Windows releases
-        # the file lock on the .exe.
-        "timeout /t 2 /nobreak >nul\r\n"
-        f'move /y "{new_exe}" "{target}" >nul\r\n'
+        "setlocal enabledelayedexpansion\r\n"
+        # Initial pause so the original process has a moment to start
+        # tearing down (icon stop, thread joins, sys.exit).
+        "timeout /t 3 /nobreak >nul\r\n"
+        "set /a attempts=0\r\n"
+        ":retry\r\n"
+        "set /a attempts=!attempts!+1\r\n"
+        f'move /y "{new_exe}" "{target}" >nul 2>&1\r\n'
+        "if exist " + f'"{new_exe}"' + " (\r\n"
+        "  if !attempts! geq 30 (\r\n"
+        "    rem Out of retries — the old exe is still locked. Leave\r\n"
+        "    rem the new exe in place so the user can move it manually.\r\n"
+        "    goto :done\r\n"
+        "  )\r\n"
+        "  timeout /t 1 /nobreak >nul\r\n"
+        "  goto :retry\r\n"
+        ")\r\n"
         f'start "" "{target}"\r\n'
+        ":done\r\n"
         # Delete the bat itself last so its own handle is gone.
-        f'del "%~f0"\r\n',
+        f'(goto) 2>nul & del "%~f0"\r\n',
         encoding="ascii",
     )
     return bat