Warn before Sparkle update relaunch kills terminal sessions

Resources/Localizable.xcstrings

@@ -77797,6 +77797,40 @@
           }
         }
       }
+    },
+    "update.relaunchWarning.message": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "This update will relaunch cmux and terminate in-app terminal sessions.\n\nWorkspaces affected: %1$lld\nTerminal sessions affected: %2$lld\nRunning commands detected: %3$lld\nRemote / SSH terminal sessions: %4$lld\n\nShells, SSH connections, and agents attached to these PTYs will be terminated."
+          }
+        },
+        "ja": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "このアップデートを適用すると cmux が再起動し、アプリ内のターミナルセッションが終了します。\n\n影響を受けるワークスペース: %1$lld\n影響を受けるターミナルセッション: %2$lld\n実行中コマンドの検出数: %3$lld\nリモート / SSH ターミナルセッション: %4$lld\n\nこれらの PTY に接続されたシェル、SSH 接続、エージェントは終了します。"
+          }
+        }
+      }
+    },
+    "update.relaunchWarning.title": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Update Will Close Terminal Sessions"
+          }
+        },
+        "ja": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "アップデートでターミナルセッションが終了します"
+          }
+        }
+      }
     }
   }
 }

Sources/AppDelegate.swift

@@ -1994,6 +1994,13 @@ final class AppDelegate: NSObject, NSApplicationDelegate, UNUserNotificationCent
         let display: SessionDisplaySnapshot?
     }
 
+    private struct UpdateRelaunchTerminalSummary {
+        let workspaceCount: Int
+        let terminalSessionCount: Int
+        let runningCommandCount: Int
+        let remoteTerminalSessionCount: Int
+    }
+
     private static let persistedWindowGeometryDefaultsKey = "cmux.session.lastWindowGeometry.v1"
 
     weak var tabManager: TabManager?
@@ -5889,6 +5896,59 @@ final class AppDelegate: NSObject, NSApplicationDelegate, UNUserNotificationCent
         updateController.attemptUpdate()
     }
 
+    func confirmUpdateRelaunchIfNeeded() -> Bool {
+        guard let summary = updateRelaunchTerminalSummary() else {
+            UpdateLogStore.shared.append("update relaunch warning skipped (no active terminal sessions)")
+            return true
+        }
+
+        UpdateLogStore.shared.append(
+            "update relaunch warning shown " +
+            "(workspaces=\(summary.workspaceCount), sessions=\(summary.terminalSessionCount), " +
+            "running=\(summary.runningCommandCount), remote=\(summary.remoteTerminalSessionCount))"
+        )
+
+        let alert = NSAlert()
+        alert.alertStyle = .warning
+        alert.messageText = String(
+            localized: "update.relaunchWarning.title",
+            defaultValue: "Update Will Close Terminal Sessions"
+        )
+        alert.informativeText = String(
+            localized: "update.relaunchWarning.message",
+            defaultValue: """
+            This update will relaunch cmux and terminate in-app terminal sessions.
+
+            Workspaces affected: \(summary.workspaceCount)
+            Terminal sessions affected: \(summary.terminalSessionCount)
+            Running commands detected: \(summary.runningCommandCount)
+            Remote / SSH terminal sessions: \(summary.remoteTerminalSessionCount)
+
+            Shells, SSH connections, and agents attached to these PTYs will be terminated.
+            """
+        )
+        alert.addButton(withTitle: String(localized: "common.restartNow", defaultValue: "Restart Now"))
+        alert.addButton(withTitle: String(localized: "common.later", defaultValue: "Later"))
+
+        if let updateNowButton = alert.buttons.first {
+            updateNowButton.keyEquivalent = "\r"
+            updateNowButton.keyEquivalentModifierMask = []
+            alert.window.defaultButtonCell = updateNowButton.cell as? NSButtonCell
+            alert.window.initialFirstResponder = updateNowButton
+        }
+        if let deferButton = alert.buttons.dropFirst().first {
+            deferButton.keyEquivalent = "\u{1b}"
+        }
+
+        if NSApp.activationPolicy() == .regular {
+            NSApp.activate(ignoringOtherApps: true)
+        }
+
+        let confirmed = alert.runModal() == .alertFirstButtonReturn
+        UpdateLogStore.shared.append("update relaunch warning result=\(confirmed ? "confirm" : "defer")")
+        return confirmed
+    }
+
     func isCmuxCLIInstalledInPATH() -> Bool {
         CmuxCLIPathInstaller().isInstalled()
     }
@@ -5958,6 +6018,61 @@ final class AppDelegate: NSObject, NSApplicationDelegate, UNUserNotificationCent
         }
     }
 
+    private func updateRelaunchTerminalSummary() -> UpdateRelaunchTerminalSummary? {
+        var seenManagers = Set<ObjectIdentifier>()
+        var managers: [TabManager] = []
+
+        for context in mainWindowContexts.values {
+            let managerId = ObjectIdentifier(context.tabManager)
+            guard seenManagers.insert(managerId).inserted else { continue }
+            managers.append(context.tabManager)
+        }
+
+        if managers.isEmpty, let tabManager {
+            managers.append(tabManager)
+        }
+
+        var workspaceCount = 0
+        var terminalSessionCount = 0
+        var runningCommandCount = 0
+        var remoteTerminalSessionCount = 0
+
+        for manager in managers {
+            for workspace in manager.tabs {
+                var workspaceHasTerminalSession = false
+
+                for (panelId, panel) in workspace.panels {
+                    guard let terminalPanel = panel as? TerminalPanel else { continue }
+                    workspaceHasTerminalSession = true
+                    terminalSessionCount += 1
+
+                    if workspace.panelNeedsConfirmClose(
+                        panelId: panelId,
+                        fallbackNeedsConfirmClose: terminalPanel.needsConfirmClose()
+                    ) {
+                        runningCommandCount += 1
+                    }
+
+                    if workspace.isRemoteTerminalSurface(panelId) {
+                        remoteTerminalSessionCount += 1
+                    }
+                }
+
+                if workspaceHasTerminalSession {
+                    workspaceCount += 1
+                }
+            }
+        }
+
+        guard terminalSessionCount > 0 else { return nil }
+        return UpdateRelaunchTerminalSummary(
+            workspaceCount: workspaceCount,
+            terminalSessionCount: terminalSessionCount,
+            runningCommandCount: runningCommandCount,
+            remoteTerminalSessionCount: remoteTerminalSessionCount
+        )
+    }
+
     @objc func restartSocketListener(_ sender: Any?) {
         guard tabManager != nil else {
             NSSound.beep()

Sources/Update/UpdateDelegate.swift

@@ -47,11 +47,15 @@ extension UpdateDriver: SPUUpdaterDelegate {
     /// Called when an update is scheduled to install silently,
     /// which occurs when automatic download is enabled.
     func updater(_ updater: SPUUpdater, willInstallUpdateOnQuit item: SUAppcastItem, immediateInstallationBlock immediateInstallHandler: @escaping () -> Void) -> Bool {
+        let guardedImmediateInstallHandler = makeGuardedUpdateRelaunchAction(
+            applicationTerminated: false,
+            action: immediateInstallHandler
+        )
         DispatchQueue.main.async { [weak viewModel] in
             viewModel?.clearDetectedUpdate()
             viewModel?.state = .installing(.init(
                 isAutoUpdate: true,
-                retryTerminatingApplication: immediateInstallHandler,
+                retryTerminatingApplication: guardedImmediateInstallHandler,
                 dismiss: { [weak viewModel] in
                     viewModel?.state = .idle
                 }

Sources/Update/UpdateDriver.swift

@@ -17,6 +17,7 @@ class UpdateDriver: NSObject, SPUUserDriver {
     private var lastFeedURLString: String?
     private var pendingUserInitiatedCheckPresentation: UpdateUserInitiatedCheckPresentation?
     private var activeUserInitiatedCheckPresentation: UpdateUserInitiatedCheckPresentation?
+    var confirmUpdateRelaunchIfNeededHandler: (() -> Bool)?
 
     init(viewModel: UpdateViewModel, hostBundle: Bundle) {
         self.viewModel = viewModel
@@ -71,17 +72,21 @@ class UpdateDriver: NSObject, SPUUserDriver {
                          state: SPUUserUpdateState,
                          reply: @escaping @Sendable (SPUUserUpdateChoice) -> Void) {
         UpdateLogStore.shared.append("show update found: \(appcastItem.displayVersionString)")
+        let forwardedReply: @Sendable (SPUUserUpdateChoice) -> Void = { [weak self] choice in
+            if choice != .install {
+                self?.finishUserInitiatedCheckPresentation()
+            }
+            reply(choice)
+        }
+        let guardedReply = shouldGuardInstallChoice(for: state)
+            ? makeGuardedUpdateInstallChoiceReply(forwardedReply)
+            : forwardedReply
         if usesStandardPresentation {
             clearCustomStateForStandardPresentation()
-            standard.showUpdateFound(with: appcastItem, state: state) { [weak self] choice in
-                if choice != .install {
-                    self?.finishUserInitiatedCheckPresentation()
-                }
-                reply(choice)
-            }
+            standard.showUpdateFound(with: appcastItem, state: state, reply: guardedReply)
             return
         }
-        setStateAfterMinimumCheckDelay(.updateAvailable(.init(appcastItem: appcastItem, reply: reply)))
+        setStateAfterMinimumCheckDelay(.updateAvailable(.init(appcastItem: appcastItem, reply: guardedReply)))
     }
 
     func showUpdateReleaseNotes(with downloadData: SPUDownloadData) {
@@ -208,21 +213,35 @@ class UpdateDriver: NSObject, SPUUserDriver {
 
     func showReady(toInstallAndRelaunch reply: @escaping @Sendable (SPUUserUpdateChoice) -> Void) {
         UpdateLogStore.shared.append("show ready to install")
+        let forwardedReply: @Sendable (SPUUserUpdateChoice) -> Void = { [weak self] choice in
+            if choice != .install {
+                self?.finishUserInitiatedCheckPresentation()
+            }
+            reply(choice)
+        }
+        let guardedReply = makeGuardedUpdateInstallChoiceReply(forwardedReply)
         if usesStandardPresentation {
-            standard.showReady(toInstallAndRelaunch: reply)
+            standard.showReady(toInstallAndRelaunch: guardedReply)
             return
         }
-        reply(.install)
+        guardedReply(.install)
     }
 
     func showInstallingUpdate(withApplicationTerminated applicationTerminated: Bool, retryTerminatingApplication: @escaping () -> Void) {
         UpdateLogStore.shared.append("show installing update")
+        let guardedRetryTerminatingApplication = makeGuardedUpdateRelaunchAction(
+            applicationTerminated: applicationTerminated,
+            action: retryTerminatingApplication
+        )
         if usesStandardPresentation {
-            standard.showInstallingUpdate(withApplicationTerminated: applicationTerminated, retryTerminatingApplication: retryTerminatingApplication)
+            standard.showInstallingUpdate(
+                withApplicationTerminated: applicationTerminated,
+                retryTerminatingApplication: guardedRetryTerminatingApplication
+            )
             return
         }
         setState(.installing(.init(
-            retryTerminatingApplication: retryTerminatingApplication,
+            retryTerminatingApplication: guardedRetryTerminatingApplication,
             dismiss: { [weak viewModel] in
                 viewModel?.state = .idle
             }
@@ -457,6 +476,63 @@ class UpdateDriver: NSObject, SPUUserDriver {
         }
     }
 
+    private func shouldGuardInstallChoice(for state: SPUUserUpdateState) -> Bool {
+        state.stage != .notDownloaded
+    }
+
+    @MainActor
+    private func confirmUpdateRelaunchIfNeeded() -> Bool {
+        confirmUpdateRelaunchIfNeededHandler?() ?? AppDelegate.shared?.confirmUpdateRelaunchIfNeeded() ?? true
+    }
+
+    func makeGuardedUpdateInstallChoiceReply(
+        _ reply: @escaping @Sendable (SPUUserUpdateChoice) -> Void
+    ) -> @Sendable (SPUUserUpdateChoice) -> Void {
+        { [weak self] choice in
+            guard choice == .install else {
+                reply(choice)
+                return
+            }
+
+            Task { @MainActor [weak self] in
+                let confirmed = self?.confirmUpdateRelaunchIfNeeded() ?? true
+                guard confirmed else {
+                    self?.recordDeferredUpdateRelaunch()
+                    reply(.dismiss)
+                    return
+                }
+
+                reply(.install)
+            }
+        }
+    }
+
+    func makeGuardedUpdateRelaunchAction(
+        applicationTerminated: Bool,
+        action: @escaping () -> Void
+    ) -> () -> Void {
+        { [weak self] in
+            Task { @MainActor [weak self] in
+                if applicationTerminated {
+                    action()
+                    return
+                }
+
+                let confirmed = self?.confirmUpdateRelaunchIfNeeded() ?? true
+                guard confirmed else {
+                    self?.recordDeferredUpdateRelaunch()
+                    return
+                }
+
+                action()
+            }
+        }
+    }
+
+    private func recordDeferredUpdateRelaunch() {
+        UpdateLogStore.shared.append("update relaunch deferred due to active terminal sessions")
+    }
+
     private func runOnMain(_ action: @escaping () -> Void) {
         if Thread.isMainThread {
             action()