Skip to content

fix(dev): stop the in-app updater from hijacking the real install during local dev - #1141

Open
3laa-NA wants to merge 1 commit into
harborstremio:beta-branchfrom
3laa-NA:fix/dev-build-updater-safety
Open

fix(dev): stop the in-app updater from hijacking the real install during local dev#1141
3laa-NA wants to merge 1 commit into
harborstremio:beta-branchfrom
3laa-NA:fix/dev-build-updater-safety

Conversation

@3laa-NA

@3laa-NA 3laa-NA commented Aug 2, 2026

Copy link
Copy Markdown

Summary

Prevents the in-app updater from ever running inside a pnpm tauri dev build, since it can only ever end up silently updating and relaunching a separately installed release build instead of the dev build itself.

Why

Dev builds share the same Tauri app identifier as the production release build by default. The updater has no awareness of which build triggered it — "Update now" always downloads and runs the real production installer, which always targets the actual Harbor install location on disk. There's no way for that installer to meaningfully "update" a dev build living at target/debug/harbor.exe; running the updater there just silently updates the user's separate real install and relaunches that instead, which looks like the dev build vanished.

Verification

  • Ran pnpm tauri dev, confirmed the updater no longer checks or shows the update prompt.
  • Confirmed import.meta.env.DEV is false in production builds, so this has zero effect there.
  • tsc -b --pretty false — clean.

Platform Impact

Verified on Windows. The fix is gated purely on import.meta.env.DEV, so behavior should be identical on macOS/Linux.

UI Changes

None — dev-only behavior change.

Checklist

  • This pull request is focused and contains no unrelated refactors.
  • I ran vp check for the changed files. — Not available on beta-branch (no vite-plus dependency here yet; filed as a separate issue for visibility). Ran tsc -b --pretty false instead.
  • I ran typecheck after TypeScript changes (via tsc -b --pretty false, see note above).
  • No Rust changes in this PR.
  • Tested on the affected platform (Windows); fix is platform-agnostic.
  • No playback, navigation, or hotkey behavior touched.
  • No new tests added — no existing test harness covers updater/dev-mode branching in this repo.
  • No secrets, tokens, or personal data included.

Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com

…ing local dev

Dev builds (`pnpm tauri dev`) share the same Tauri app identifier
(`app.harbor`) as the production release build by default. The in-app
updater doesn't know or care which build triggered it: when "Update now"
runs, it downloads and executes the actual production installer, which
always targets the real Harbor install location on disk, regardless of
whether a dev or release build kicked off the check.

Result: running the dev build and clicking "Update now" silently updates
and relaunches the user's separately installed real Harbor app instead of
the dev build, which just looks like the dev build vanished. There is no
way for the release installer to meaningfully "update" a dev build living
at target/debug/harbor.exe in the first place, so the updater should never
have run there at all.

Fix: checkForUpdate() now returns immediately when import.meta.env.DEV is
true, so the updater never checks or fires inside `pnpm tauri dev`. Zero
effect on production builds, where import.meta.env.DEV is false.

Also ignore src-tauri/tauri.dev.local.json: a new, personal, local-only
Tauri config override (never committed) that gives a local dev build its
own app identifier and deep-link scheme, so its app-data directory
(settings, library, watch history) doesn't collide with a real installed
app's data either. Usage: pnpm tauri dev --config src-tauri/tauri.dev.local.json

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant