fix(desktop): guard installUpdate against repeat clicks

MacUpdater.quitAndInstall() registers a fresh native-updater
`update-downloaded` listener each call when Squirrel.Mac hasn't finished
staging. Repeat clicks on the update button stacked listeners, then fanned
out into parallel nativeUpdater.quitAndInstall() calls once Squirrel
fired — racing to swap the binary and leaving the app on the old version.
Matches the reporter's symptom (app quits, reopens on same version).

Add an `isInstalling` guard + `status === READY` precondition so repeat
clicks collapse to a single quitAndInstall, and clear the flag in the
error handler so the user can retry if Squirrel surfaces an error instead
of actually quitting.

Closes #3507

Author: Kitenite

apps/desktop/src/main/lib/auto-updater.test.ts

@@ -0,0 +1,86 @@
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+import { EventEmitter } from "node:events";
+
+class FakeAutoUpdater extends EventEmitter {
+	autoDownload = false;
+	autoInstallOnAppQuit = false;
+	disableDifferentialDownload = false;
+	allowDowngrade = false;
+	setFeedURL = mock(() => {});
+	checkForUpdates = mock(() => Promise.resolve(null));
+	quitAndInstall = mock(() => {});
+}
+
+const fakeAutoUpdater = new FakeAutoUpdater();
+
+mock.module("electron-updater", () => ({
+	autoUpdater: fakeAutoUpdater,
+}));
+
+mock.module("electron", () => ({
+	app: {
+		getPath: mock(() => ""),
+		getName: mock(() => "test-app"),
+		getVersion: mock(() => "1.0.0"),
+		getAppPath: mock(() => ""),
+		isPackaged: false,
+		isReady: mock(() => true),
+		whenReady: mock(() => Promise.resolve()),
+	},
+	dialog: {
+		showMessageBox: mock(() => Promise.resolve({ response: 0 })),
+	},
+}));
+
+mock.module("main/index", () => ({
+	setSkipQuitConfirmation: mock(() => {}),
+}));
+
+const autoUpdater = await import("./auto-updater");
+const { AUTO_UPDATE_STATUS } = await import("shared/auto-update");
+
+describe("installUpdate", () => {
+	beforeEach(() => {
+		fakeAutoUpdater.removeAllListeners();
+		fakeAutoUpdater.quitAndInstall.mockClear();
+		fakeAutoUpdater.checkForUpdates.mockClear();
+		fakeAutoUpdater.setFeedURL.mockClear();
+		autoUpdater.setupAutoUpdater();
+		// Error handler resets the module-level isInstalling guard so each
+		// test starts from the same state even though the module is a singleton.
+		fakeAutoUpdater.emit("error", new Error("reset"));
+	});
+
+	test("ignores install requests when no update is ready", () => {
+		expect(autoUpdater.getUpdateStatus().status).not.toBe(
+			AUTO_UPDATE_STATUS.READY,
+		);
+
+		autoUpdater.installUpdate();
+
+		expect(fakeAutoUpdater.quitAndInstall).not.toHaveBeenCalled();
+	});
+
+	test("collapses repeat install clicks into a single quitAndInstall call", () => {
+		fakeAutoUpdater.emit("update-downloaded", { version: "9.9.9" });
+		expect(autoUpdater.getUpdateStatus().status).toBe(AUTO_UPDATE_STATUS.READY);
+
+		autoUpdater.installUpdate();
+		autoUpdater.installUpdate();
+		autoUpdater.installUpdate();
+
+		expect(fakeAutoUpdater.quitAndInstall).toHaveBeenCalledTimes(1);
+	});
+
+	test("clears the in-flight guard when Squirrel surfaces an error", () => {
+		fakeAutoUpdater.emit("update-downloaded", { version: "9.9.9" });
+		autoUpdater.installUpdate();
+		expect(fakeAutoUpdater.quitAndInstall).toHaveBeenCalledTimes(1);
+
+		fakeAutoUpdater.emit("error", new Error("squirrel failed"));
+		fakeAutoUpdater.emit("update-downloaded", { version: "9.9.9" });
+		autoUpdater.installUpdate();
+
+		expect(fakeAutoUpdater.quitAndInstall).toHaveBeenCalledTimes(2);
+	});
+});

apps/desktop/src/main/lib/auto-updater.ts

@@ -82,6 +82,7 @@ function isNetworkError(error: Error | string): boolean {
 let currentStatus: AutoUpdateStatus = AUTO_UPDATE_STATUS.IDLE;
 let currentVersion: string | undefined;
 let isDismissed = false;
+let isInstalling = false;
 
 function emitStatus(
 	status: AutoUpdateStatus,
@@ -111,6 +112,25 @@ export function installUpdate(): void {
 		emitStatus(AUTO_UPDATE_STATUS.IDLE);
 		return;
 	}
+	// MacUpdater.quitAndInstall() registers a fresh native-updater
+	// `update-downloaded` listener each time it runs before Squirrel.Mac has
+	// finished staging. Repeat clicks therefore fan out into multiple parallel
+	// quitAndInstall calls once Squirrel fires, racing each other and leaving
+	// the binary un-swapped. Gate on status + an in-flight flag to collapse
+	// duplicates.
+	if (isInstalling) {
+		console.info(
+			"[auto-updater] Install already in progress, ignoring duplicate request",
+		);
+		return;
+	}
+	if (currentStatus !== AUTO_UPDATE_STATUS.READY) {
+		console.warn(
+			`[auto-updater] Install ignored: update not ready (status=${currentStatus})`,
+		);
+		return;
+	}
+	isInstalling = true;
 	setSkipQuitConfirmation();
 	autoUpdater.quitAndInstall(false, true);
 }
@@ -242,6 +262,8 @@ export function setupAutoUpdater(): void {
 	);
 
 	autoUpdater.on("error", (error) => {
+		// Allow retry if Squirrel surfaces an error instead of actually quitting.
+		isInstalling = false;
 		if (isNetworkError(error)) {
 			console.info("[auto-updater] Network unavailable, will retry later");
 			emitStatus(AUTO_UPDATE_STATUS.IDLE);