feat(updater): macOS 原地升级 —— 去掉 Finder 替换确认弹窗

[Gyanano]

背景

V1.4.1 实测反馈：应用内更新在 macOS 上最后一步是打开 dmg 让用户手动拖拽，Finder 会弹「保留两者 / 停止 / 替换」确认框。 Finder 不认版本号，任何拖拽覆盖都会问——正版升级的「无弹窗」体验来自原地替换机制。

方案

下载完成后不再 open dmg，而是：

1. 只读挂载 dmg（hdiutil attach -nobrowse -readonly），解析挂载点，定位其中的 .app
2. 生成 trampoline shell 脚本并 spawn，然后主进程退出
3. 脚本等旧进程退出（上限 30s）→ ditto 暂存新包到目标同级目录（同卷）→ mv 旧包到旁边 → mv 新包到位（同卷原子替换，第二步失败会回滚）→ 卸载 dmg、删除临时文件 → 重新打开应用

任意环节失败都回退到旧行为（打开 dmg 走手动流程）：开发态裸二进制（不在 .app 里）、挂载失败、目录不可写等。

实现说明

• 纯函数（bundle 路径识别、hdiutil 输出解析、shell 引号转义、脚本渲染）跨平台可测，6 个新单测；hdiutil/ditto 执行路径用 cfg(macos) 门控，不影响 Linux CI。
• 不生成长驻进程：脚本在下载完成后、应用退出前一刻才 spawn。

验证

• 沙盒演练：真实 V1.4.1 dmg + trampoline 脚本 + 假目标目录，验证替换后目标变为 Developer ID 签名（TeamIdentifier JL7HMQG9WG）、挂载卸载、dmg 清理、脚本自删除 ✅
• 端到端 GUI 实测：本地打包 ad-hoc 签名 .app（伪装 1.4.0）放入 ~/Applications，走完整 检查更新 → 下载 → 安装 → 自动重启 流程，全程零弹窗，替换后包变为官方 1.4.1 ✅（用户确认 + 签名复核）
• 全套 49 个 Rust 测试绿

---

Note

Medium Risk
Changes how macOS replaces the installed .app (filesystem moves, generated shell, hdiutil/ditto); rollback and DMG fallback limit breakage but a failed swap could still disrupt the install location until the user intervenes.

Overview
macOS in-app updates no longer end by opening the DMG for manual drag-and-drop. When the app runs from a real .app bundle, launch_installer_and_exit mounts the downloaded DMG read-only, writes a short-lived trampoline shell script, spawns it detached, and exits. The script waits for the updater process (up to ~30s), stages the new bundle with ditto, performs an atomic same-volume swap (mv old aside → mv new in, with rollback on failure), detaches the volume, deletes the DMG, and relaunches the updated app.

Linux/Windows behavior is unchanged via a non-macOS launch_inner (still xdg-open / direct spawn). Failure paths (dev binary outside a bundle, mount/parse errors, spawn failure) log a warning and fall back to open on the DMG.

The swap logic is split into testable pure helpers (bundle_path_from_exe, hdiutil mount parsing, POSIX shell_quote, render_trampoline_script) plus six new unit tests; hdiutil/ditto integration stays behind #[cfg(target_os = "macos")].

^{Reviewed by Cursor Bugbot for commit 966ca48. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_82e7e030-a8ae-4480-87b4-036e33892115)