Sync latest TrueGrowth updates

openspec/changes/add-desktop-auto-updates/design.md

@@ -0,0 +1,15 @@
+## Context
+The desktop app is packaged with Electron and electron-builder. Updates will be served from a static 1Panel/Nginx site instead of a business backend.
+
+## Decisions
+- Use `electron-updater` with electron-builder `generic` publishing.
+- Reserve `https://truegrowth.benchu.cloud/desktop/stable/` as the stable update channel root.
+- Keep mac `dmg` for first install and mac `zip` for auto updates.
+- Keep Windows `nsis` as the installed auto-update target and `portable` as a manual-download artifact only.
+- Do not automatically restart the app after download; users confirm restart from the renderer UI.
+- Desktop update UI supersedes the existing web Service Worker update prompt inside Electron so customers do not see two update concepts at once.
+
+## Release Notes
+- macOS customer auto updates require Developer ID signing and notarization before production distribution.
+- Windows production releases should be Authenticode signed to reduce SmartScreen and security-product friction.
+- Unsigned builds may be used for local or internal update-flow tests only.

openspec/changes/add-desktop-auto-updates/proposal.md

@@ -0,0 +1,15 @@
+# Change: Add desktop auto updates
+
+## Why
+TrueGrowth desktop customers need a reliable way to receive macOS and Windows client updates after installation without a custom backend.
+
+## What Changes
+- Add Electron auto update support backed by the 1Panel static origin at `https://truegrowth.benchu.cloud/desktop/stable/`.
+- Expose update status and commands to the renderer through the desktop preload bridge.
+- Add a branded lower-left update entry and dialog for checking, downloading, progress, retry, and restart-to-install.
+- Add release manifest tooling for `latest.yml`, `latest-mac.yml`, and `releases.json`.
+- Treat production signing as a release gate for customer auto-update packages.
+
+## Impact
+- Affected specs: desktop-auto-updates
+- Affected code: Electron main/preload, electron-builder config, Workbench shell UI, release scripts

openspec/changes/add-desktop-auto-updates/specs/desktop-auto-updates/spec.md

@@ -0,0 +1,34 @@
+## ADDED Requirements
+
+### Requirement: Desktop Auto Update Channel
+The desktop application SHALL use `https://truegrowth.benchu.cloud/desktop/stable/` as the default stable auto-update channel.
+
+#### Scenario: Packaged client checks for updates
+- **GIVEN** a packaged installed desktop client
+- **WHEN** the scheduled or manual update check runs
+- **THEN** the client SHALL query the generic update metadata from the stable channel.
+
+### Requirement: Desktop Update UI
+The desktop application SHALL expose update status in the lower-left navigation utility area and provide a branded dialog for update actions.
+
+#### Scenario: Update is available
+- **WHEN** the updater reports a new version
+- **THEN** the UI SHALL show the version, release notes when available, and a download action.
+
+#### Scenario: Update is downloaded
+- **WHEN** the updater finishes downloading an update
+- **THEN** the UI SHALL offer restart-to-install without forcing restart automatically.
+
+### Requirement: Release Artifact Manifest
+The release tooling SHALL produce a `releases.json` manifest alongside electron-builder update metadata for the 1Panel static directory.
+
+#### Scenario: Release artifacts are prepared
+- **WHEN** desktop release artifacts exist in the release output directory
+- **THEN** the tooling SHALL record version, channel URL, files, sizes, sha256 hashes, and upload guidance.
+
+### Requirement: Production Signing Gate
+Production auto-update releases SHALL require platform signing before customer distribution.
+
+#### Scenario: Unsigned production package
+- **WHEN** a production customer release is prepared without required platform signing
+- **THEN** the release SHALL be treated as not ready for customer auto-update distribution.

openspec/changes/add-desktop-auto-updates/tasks.md

@@ -0,0 +1,13 @@
+## 1. Implementation
+- [x] 1.1 Add `electron-updater` dependency.
+- [x] 1.2 Configure electron-builder generic publishing at the TrueGrowth stable update URL.
+- [x] 1.3 Implement Electron update state, events, manual checks, download, and restart-install commands.
+- [x] 1.4 Expose a safe preload update bridge to the renderer.
+- [x] 1.5 Add Workbench update entry and dialog with light/dark styling.
+- [x] 1.6 Add release manifest generation/verification tooling for 1Panel upload.
+
+## 2. Validation
+- [x] 2.1 Run Electron main/preload syntax checks.
+- [x] 2.2 Run web typecheck for the Workbench UI.
+- [x] 2.3 Run the release manifest script with a fixture release directory.
+- [ ] 2.4 Validate OpenSpec change if the `openspec` CLI is available. (`openspec` was not found in PATH.)