fix: require explicit update downloads

Keep automatic update checks and the persistent update banner, but disable background update downloads so releases do not create uncontrolled traffic spikes. Remove the onboarding and settings auto-download controls because downloads are now always user-initiated.

Tests: bun run typecheck; bun run build; git diff --check
Codex: removed the auto-download preference and forced electron-updater downloads behind the explicit Update action.

Author: beautyfree

src/main/app-updater.ts

@@ -3,7 +3,7 @@
  *
  * Event translation table (electron-updater → AppUpdateStatusJson.state):
  *   checking-for-update  → "checking"
- *   update-available     → "available"     (manual) or "downloading" (auto)
+ *   update-available     → "available"     (user chooses when to download)
  *   update-not-available → "up-to-date"
  *   download-progress    → "downloading"   (with 0–100 progress)
  *   update-downloaded    → "ready"         (updateReady → user can restart)
@@ -16,7 +16,6 @@
 import { app } from "electron";
 import pkg from "electron-updater";
 import type { AppUpdateStatusJson } from "../shared/rpc-schema";
-import { readSettings } from "./settings";
 
 const { autoUpdater } = pkg;
 
@@ -31,12 +30,6 @@ let lastError: string | null = null;
 let state: AppUpdateStatusJson["state"] = "idle";
 let updateDownloaded = false;
 let downloadPromise: Promise<string[]> | null = null;
-let autoDownloadUpdates = true;
-
-function refreshAutoDownloadPreference(): void {
-	autoDownloadUpdates = readSettings().auto_download_updates !== false;
-	autoUpdater.autoDownload = autoDownloadUpdates;
-}
 
 function snapshot(): AppUpdateStatusJson {
 	return {
@@ -67,7 +60,7 @@ function setState(next: AppUpdateStatusJson["state"]): void {
 }
 
 function wireAutoUpdaterEvents(): void {
-	refreshAutoDownloadPreference();
+	autoUpdater.autoDownload = false;
 	autoUpdater.autoInstallOnAppQuit = true;
 
 	autoUpdater.on("checking-for-update", () => {
@@ -80,7 +73,7 @@ function wireAutoUpdaterEvents(): void {
 		remoteVersion = info?.version ?? null;
 		downloadProgress = null;
 		updateDownloaded = false;
-		setState(autoDownloadUpdates ? "downloading" : "available");
+		setState("available");
 	});
 
 	autoUpdater.on("update-not-available", () => {
@@ -122,16 +115,15 @@ export function initAppUpdater(
 
 	wireAutoUpdaterEvents();
 
-	// Fire-and-forget initial check, then poll every 6h.
-	refreshAutoDownloadPreference();
+	// Fire-and-forget initial check, then poll every 6h. Downloads are always
+	// user-initiated to avoid uncontrolled release traffic spikes.
 	void autoUpdater.checkForUpdates().catch((err) => {
 		lastError = err?.message ?? String(err);
 		setState("error");
 	});
 
 	recheckTimer = setInterval(
 		() => {
-			refreshAutoDownloadPreference();
 			void autoUpdater.checkForUpdates().catch((err) => {
 				lastError = err?.message ?? String(err);
 				setState("error");
@@ -160,7 +152,6 @@ export function getAppUpdateStatus(): AppUpdateStatusJson {
 export async function checkForUpdate(): Promise<AppUpdateStatusJson> {
 	if (!app.isPackaged) return snapshot();
 	try {
-		refreshAutoDownloadPreference();
 		await autoUpdater.checkForUpdates();
 	} catch (err) {
 		lastError = (err as Error)?.message ?? String(err);

src/mainview/components/OnboardingWizard.tsx

@@ -42,7 +42,6 @@ export default function OnboardingWizard({
 	);
 
 	const [step, setStep] = useState<Step>("welcome");
-	const [autoDownloadUpdates, setAutoDownloadUpdates] = useState(true);
 	const [popular, setPopular] = useState<MarketplaceSkillJson[] | null>(null);
 	const [loadingPopular, setLoadingPopular] = useState(false);
 	const [loadError, setLoadError] = useState<string | null>(null);
@@ -101,16 +100,6 @@ export default function OnboardingWizard({
 		} catch {
 			/* ignore */
 		}
-		void invoke("read_settings")
-			.then((settings) =>
-				invoke("write_settings", {
-					settings: {
-						...settings,
-						auto_download_updates: autoDownloadUpdates,
-					},
-				}),
-			)
-			.catch(() => {});
 		onClose();
 	}
 
@@ -411,23 +400,6 @@ export default function OnboardingWizard({
 							</button>
 						</div>
 
-						<label className="mx-auto flex max-w-md cursor-pointer select-none items-start gap-2.5 rounded-lg border border-border/40 bg-muted/5 px-3 py-2.5 transition hover:bg-black/[0.03] dark:hover:bg-white/[0.04]">
-							<input
-								type="checkbox"
-								checked={autoDownloadUpdates}
-								onChange={(e) => setAutoDownloadUpdates(e.target.checked)}
-								className="mt-0.5 size-3.5 rounded accent-primary"
-							/>
-							<span className="min-w-0">
-								<span className="block text-xs font-medium text-foreground">
-									{t("onboarding.autoDownloadUpdatesTitle")}
-								</span>
-								<span className="mt-0.5 block text-[11px] leading-relaxed text-muted-foreground">
-									{t("onboarding.autoDownloadUpdatesBody")}
-								</span>
-							</span>
-						</label>
-
 						<div className="flex justify-end">
 							<Button variant="outline" size="sm" onClick={markDoneAndClose}>
 								{t("onboarding.finish")}

src/mainview/i18n/en.ts

@@ -329,9 +329,6 @@ const en = {
     updateBannerAction: "Update",
     updateBannerUpdating: "Updating",
     updateBannerDismiss: "Dismiss update notification",
-    updateAutoDownload: "Download app updates automatically",
-    updateAutoDownloadDescription:
-      "Skiller downloads new versions in the background and asks before restarting.",
     // Marketplace Cache
     onboardingTitle: "Onboarding",
     onboardingDescription:
@@ -481,9 +478,6 @@ const en = {
     noDescription: "No description available — check the repo before installing.",
     doneTitle: "You're ready",
     doneBody: "Jump straight into the app — here's where to go first:",
-    autoDownloadUpdatesTitle: "Download app updates automatically",
-    autoDownloadUpdatesBody:
-      "Skiller will fetch new versions in the background, then ask before restarting.",
     ctaSkillsTitle: "Manage skills",
     ctaSkillsBody: "See what's installed, copy a skill to another agent, or clean house.",
     ctaMarketplaceTitle: "Open Marketplace",

src/mainview/pages/Settings.tsx

@@ -29,7 +29,6 @@ interface AppSettings {
   path_overrides: Record<string, string[]> | null
   close_action: string | null
   analytics_enabled?: boolean | null
-  auto_download_updates?: boolean | null
   macos_window_blur?: boolean | null
   assumed_listing_char_budget?: number | null
   assumed_context_window_chars?: number | null
@@ -41,7 +40,6 @@ const DEFAULT_SETTINGS: AppSettings = {
   path_overrides: null,
   close_action: null,
   analytics_enabled: null,
-  auto_download_updates: null,
   macos_window_blur: null,
 }
 
@@ -602,32 +600,6 @@ export default function SettingsPage() {
             </div>
           </div>
 
-          <label className="flex cursor-pointer select-none items-start gap-3 rounded-lg border border-border/40 bg-muted/5 px-3 py-2.5 transition hover:bg-black/[0.03] dark:hover:bg-white/[0.04]">
-            <input
-              type="checkbox"
-              checked={settings?.auto_download_updates !== false}
-              onChange={(e) => {
-                const enabled = e.target.checked
-                saveMutation.mutate({
-                  ...(settings ?? DEFAULT_SETTINGS),
-                  auto_download_updates: enabled,
-                })
-                if (enabled && updateStatus?.state === 'available') {
-                  void handleUpdateDownload()
-                }
-              }}
-              className="mt-0.5 size-3.5 rounded accent-primary"
-            />
-            <span className="min-w-0">
-              <span className="block text-xs font-medium text-foreground">
-                {t('settings.updateAutoDownload')}
-              </span>
-              <span className="mt-0.5 block text-xs leading-relaxed text-muted-foreground">
-                {t('settings.updateAutoDownloadDescription')}
-              </span>
-            </span>
-          </label>
-
           {/* Download progress bar — the percentage is already in the
            *  subtitle, but a visual bar gives actual feedback on long
            *  downloads (200+ MB DMG can take minutes on slow networks).

src/shared/rpc-schema.ts

@@ -97,8 +97,6 @@ export type AppSettingsJson = {
   assumed_context_window_chars?: number | null;
   /** Product telemetry and analytics (PostHog). Default true when omitted. */
   analytics_enabled?: boolean | null;
-  /** Download app updates automatically after they are found. Default true when omitted. */
-  auto_download_updates?: boolean | null;
   /** One-time GitHub star prompt cadence metadata. */
   github_star_prompt?: {
     first_seen_at?: string | null;