Description
Dots Desktop includes an automatic update lifecycle that selects the correct release feed for the installed distribution, checks for a newer version, downloads it, and coordinates installation through desktop state and tray controls. Internal and buyer channels share one application codebase but resolve different release sources, preventing a buyer installation from drifting onto an internal feed.
Private release access uses an app-scoped credential sealed with Electron safe storage. The updater reads that credential only in the main process; it never borrows ambient GitHub environment tokens and never returns the raw value to the renderer. When no credential is available, updates are honestly disabled and the tray reports that state instead of pretending the product is current.
Selling Points
- Keeps installed desktops on a supported release without requiring users to repeat installer steps.
- Separates internal and buyer release channels, preserving each audience’s version line and access policy.
- Stores the private-feed token in OS-backed encrypted storage rather than shell environment or plaintext settings.
- Surfaces update availability and disabled states through native desktop controls, so background behavior remains visible.
- Avoids credential leakage by keeping feed authentication entirely in the main process.
User Story
A buyer launches Dots Desktop after a new version has been published. The shell uses their previously stored release credential to check the buyer feed, reports the available version in the tray, downloads it, and offers the supported install action. They update without finding a release page or exposing a repository token to the web renderer.
Extension Surface
This feature is configurable. apps/desktop/src/main/update-feed-credentials.ts provides the set/clear/status credential contract, and apps/desktop/src/main/updater.ts resolves behavior from the installed distribution and stored credential. Users can configure access and choose when to install, but external code cannot register another updater provider or arbitrary feed protocol.
Capabilities & Limits
- Resolves separate internal and buyer feeds from the desktop distribution.
- Checks, downloads, and stages updates while publishing honest state to desktop chrome.
- Runs with auto-update off when the required private-feed credential is absent.
- Limit: the updater can see published releases only; draft releases are intentionally invisible.
- Limit: platform signing and notarization depend on release infrastructure and are not supplied by the runtime updater itself.
Implementation Map
apps/desktop/src/main/updater.tsapps/desktop/src/main/update-state.tsapps/desktop/src/main/update-feed-credentials.tsapps/desktop/src/main/tray-template.ts