[infra] No auto-update mechanism — no electron-updater, no update manifests

[rahulkatiyar19955]

Severity

High

Summary

There is no auto-update mechanism: no electron-updater dependency, no publish provider block, and packaging runs with --publish never, so no latest-*.yml update manifests are produced. Shipped apps cannot self-update, despite AGENT.md requiring versioned update manifests.

Location

• electron-builder.yml (no publish provider block)
• package.json:20-23 (package* scripts; no electron-updater dep in dependencies)
• .github/workflows/electron-build.yml:51,86 (--publish never)
• .github/workflows/release-pipeline.yml:81-108 (drafts a GitHub release with raw artifacts only)

Details

electron-builder only emits update manifests (latest-mac.yml, latest-linux.yml, etc.) when a publish provider is configured and publishing is enabled. Here packaging explicitly passes --publish never, there is no publish block in electron-builder.yml, and electron-updater is not a dependency. The release pipeline simply attaches the .dmg/.AppImage to a draft GitHub release. As a result there is no wiring for autoUpdater in the main process and no manifest for clients to check, so installed apps can never update themselves.

AGENT.md ## Security & Privacy Guardrails (line 313) states: "Auto-update: design update manifests to be versioned; stage canary rollouts." No update manifests are generated at all.

Suggested fix

Add electron-updater, configure a publish block (GitHub provider) in electron-builder.yml so update manifests are emitted at package time, and wire autoUpdater in src/main. If auto-update is intentionally deferred for now, record the deviation explicitly in AGENT.md so the requirement and the gap are reconciled.

Project-rule reference

AGENT.md ## Security & Privacy Guardrails line 313 — "Auto-update: design update manifests to be versioned; stage canary rollouts."