Sg312 · Aug 12, 2026 · Aug 11, 2026 · Aug 11, 2026 · Aug 12, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -72,7 +72,7 @@ jobs:
   # Detect shell-code changes on dev/staging pushes. Web-only changes never
   # need a desktop build (installed shells load the web app live); changes to
   # the Electron app or the bridge packages trigger a per-env prerelease build
-  # (dev → alpha channel, staging → beta) that the env's update feed
+  # (dev → dev stream, staging → staging) that the env's update feed
   # (/api/desktop/update) starts offering automatically.
   detect-desktop-changes:
     name: Detect Desktop Changes
@@ -707,10 +707,10 @@ jobs:
     secrets: inherit
 
   # Per-env desktop prereleases: a dev/staging push that touches shell code
-  # publishes a channel-tagged GitHub prerelease (vX.Y.Z-alpha.N from dev,
-  # vX.Y.Z-beta.N from staging). Each environment's /api/desktop/update feed
-  # offers only its channel, so dev-pointed shells pick up alpha builds,
-  # staging-pointed shells beta builds, and prod-pointed shells stable
+  # publishes an environment-tagged GitHub prerelease (vX.Y.Z-dev.N from dev,
+  # vX.Y.Z-staging.N from staging). Each environment's /api/desktop/update feed
+  # offers only its stream, so dev-pointed shells pick up dev builds,
+  # staging-pointed shells staging builds, and prod-pointed shells stable
   # releases — independently. Unlike stable releases, prereleases build even
   # before the Apple signing secrets exist — unsigned, so the update pipeline
   # is testable end to end; installed shells detect the missing Developer ID
@@ -738,7 +738,7 @@ jobs:
           GH_REPO: ${{ github.repository }}
           SIGNED: ${{ needs.check-desktop-signing.outputs.configured }}
         run: |
-          if [ "$GITHUB_REF" = "refs/heads/dev" ]; then CHANNEL=alpha; APP_NAME="Sim Dev"; else CHANNEL=beta; APP_NAME="Sim Staging"; fi
+          if [ "$GITHUB_REF" = "refs/heads/dev" ]; then CHANNEL=dev; APP_NAME="Sim Dev"; else CHANNEL=staging; APP_NAME="Sim Staging"; fi
           # Prerelease core = next patch after the latest stable release, so
           # channel builds always outrank the stable they are built on top of
           # and are always superseded by the next stable. The run-attempt
@@ -825,9 +825,9 @@ jobs:
     steps:
       - name: Delete stale prereleases
         run: |
-          if [ "$GITHUB_REF" = "refs/heads/dev" ]; then CHANNEL=alpha; else CHANNEL=beta; fi
+          if [ "$GITHUB_REF" = "refs/heads/dev" ]; then CHANNELS='(dev|alpha)'; else CHANNELS='(staging|beta)'; fi
           gh release list --limit 100 --json tagName,isPrerelease,isDraft,createdAt \
-            --jq "[.[] | select(.isPrerelease and (.isDraft | not) and (.tagName | test(\"-${CHANNEL}\\\\.\")))] | sort_by(.createdAt) | reverse | .[5:] | .[].tagName" |
+            --jq "[.[] | select(.isPrerelease and (.isDraft | not) and (.tagName | test(\"-${CHANNELS}\\\\.\")))] | sort_by(.createdAt) | reverse | .[5:] | .[].tagName" |
           while read -r TAG; do
             [ -n "$TAG" ] || continue
             echo "Deleting stale prerelease $TAG"
@@ -836,11 +836,11 @@ jobs:
 
       - name: Delete leftover draft prereleases
         run: |
-          if [ "$GITHUB_REF" = "refs/heads/dev" ]; then CHANNEL=alpha; else CHANNEL=beta; fi
+          if [ "$GITHUB_REF" = "refs/heads/dev" ]; then CHANNELS='(dev|alpha)'; else CHANNELS='(staging|beta)'; fi
           # Drafts have no tag ref, so delete by release id via the API
           # (gh release delete resolves by tag, which is ambiguous for drafts).
           gh api "repos/${GH_REPO}/releases?per_page=100" \
-            --jq ".[] | select(.draft and (.tag_name | test(\"-${CHANNEL}\\\\.\"))) | .id" |
+            --jq ".[] | select(.draft and (.tag_name | test(\"-${CHANNELS}\\\\.\"))) | .id" |
           while read -r ID; do
             [ -n "$ID" ] || continue
             echo "Deleting leftover draft release $ID"

diff --git a/.github/workflows/desktop-release.yml b/.github/workflows/desktop-release.yml
@@ -91,8 +91,9 @@ jobs:
             exit 1
           fi
 
-      # Prerelease versions carry their environment in the tag: -alpha.N is a
-      # dev build, -beta.N a staging build. The channel decides the app's
+      # Prerelease versions carry their environment in the tag: -dev.N is a
+      # dev build, -staging.N a staging build. Legacy -alpha/-beta tags remain
+      # accepted while already-published builds age out. The channel decides the app's
       # identity (name/bundle id — a separate app per environment, installable
       # side by side) and the default origin baked into the bundle, which in
       # turn selects the update feed the installed app polls.
@@ -102,9 +103,9 @@ jobs:
           VERSION: ${{ inputs.version }}
         run: |
           case "$VERSION" in
-            *-alpha.*)
+            *-dev.*|*-alpha.*)
               NAME='Sim Dev'; APP_ID=ai.sim.desktop.dev; ORIGIN=https://www.dev.sim.ai ;;
-            *-beta.*)
+            *-staging.*|*-beta.*)
               NAME='Sim Staging'; APP_ID=ai.sim.desktop.staging; ORIGIN=https://www.staging.sim.ai ;;
             *)
               NAME='Sim'; APP_ID=ai.sim.desktop; ORIGIN='' ;;

diff --git a/apps/desktop/README.md b/apps/desktop/README.md
@@ -168,7 +168,7 @@ Raw local file bytes are never exposed through the preload bridge and cannot be
 ## Auto-update, channels, rollout, rollback
 
 - `electron-updater` reads the GitHub Releases feed (`publish` is pinned to `simstudioai/sim`); deltas via `.zip.blockmap`. Install is prompt-based (Restart Now / Later; Later installs on quit) — never forced mid-session.
-- Channels: stable builds (`X.Y.Z`) follow `latest`; `-beta.N` builds follow `beta` (never attach a beta `latest-mac.yml` to a stable tag).
+- Streams: production follows stable `X.Y.Z` releases, dev follows `-dev.N`, and staging follows `-staging.N`. The feed still recognizes legacy `-alpha.N`/`-beta.N` releases during migration.
 - Staged rollout: after publishing, edit `stagingPercentage: 10` into the release's `latest-mac.yml`, then raise as crash metrics stay clean.
 - Rollback: a pulled release must be superseded by a **higher** version — users on the broken build will not reinstall an equal one. (A blocked-versions kill-switch was removed as unwired dead code; reintroduce it in `updater.ts` if a remote config source ever exists to feed it.)
 - Ship the DMG and tell users to install to `/Applications` — App Translocation breaks Squirrel.Mac updates from quarantined paths.

diff --git a/apps/desktop/src/main/updater.test.ts b/apps/desktop/src/main/updater.test.ts
@@ -8,6 +8,7 @@ const autoUpdaterMock = {
   allowDowngrade: false,
   autoDownload: true,
   autoInstallOnAppQuit: false,
+  autoRunAppAfterInstall: true,
   logger: null as unknown,
   on: vi.fn(),
   setFeedURL: vi.fn(),
@@ -25,6 +26,7 @@ import {
   isNewerVersion,
   parseSemver,
   resolveUpdateChannel,
+  type UpdaterHandle,
   updateCheckIntervalMs,
 } from '@/main/updater'
 
@@ -35,15 +37,20 @@ describe('resolveUpdateChannel', () => {
   })
 
   it('maps prerelease versions to their channel', () => {
-    expect(resolveUpdateChannel('1.2.3-beta.1')).toBe('beta')
-    expect(resolveUpdateChannel('1.2.3-alpha.2')).toBe('alpha')
+    expect(resolveUpdateChannel('1.2.3-dev.2')).toBe('dev')
+    expect(resolveUpdateChannel('1.2.3-staging.1')).toBe('staging')
+  })
+
+  it('keeps legacy alpha and beta builds on their environment streams', () => {
+    expect(resolveUpdateChannel('1.2.3-alpha.2')).toBe('dev')
+    expect(resolveUpdateChannel('1.2.3-beta.1')).toBe('staging')
   })
 })
 
 describe('updateCheckIntervalMs', () => {
   it('checks dev and staging builds every five minutes', () => {
-    expect(updateCheckIntervalMs('1.2.3-alpha.2')).toBe(5 * 60 * 1000)
-    expect(updateCheckIntervalMs('1.2.3-beta.1')).toBe(5 * 60 * 1000)
+    expect(updateCheckIntervalMs('1.2.3-dev.2')).toBe(5 * 60 * 1000)
+    expect(updateCheckIntervalMs('1.2.3-staging.1')).toBe(5 * 60 * 1000)
   })
 
   it('checks production builds every thirty minutes', () => {
@@ -61,6 +68,7 @@ describe('parseSemver', () => {
   it('returns null for garbage', () => {
     expect(parseSemver('latest')).toBeNull()
     expect(parseSemver('1.2')).toBeNull()
+    expect(parseSemver('1.2.3garbage')).toBeNull()
     expect(parseSemver('')).toBeNull()
   })
 })
@@ -137,7 +145,11 @@ describe('initUpdater state machine', () => {
     }
   }
 
-  async function createUpdater(options?: { autoDownload?: boolean; feedAvailable?: boolean }) {
+  async function createUpdater(options?: {
+    autoDownload?: boolean
+    feedAvailable?: boolean | 'no-release'
+    probeOriginFeed?: (feedUrl: string) => Promise<boolean | 'no-release'>
+  }) {
     const states: DesktopUpdateState[] = []
     const handle = initUpdater({
       getWindow: () => null,
@@ -147,7 +159,7 @@ describe('initUpdater state machine', () => {
       onStateChange: (state) => states.push(state),
       loadAutoUpdater: () =>
         autoUpdaterMock as unknown as typeof import('electron-updater')['autoUpdater'],
-      probeOriginFeed: async () => options?.feedAvailable ?? false,
+      probeOriginFeed: options?.probeOriginFeed ?? (async () => options?.feedAvailable ?? false),
       canSelfUpdate: async () => true,
     })
     // Engine selection (signature detection) resolves asynchronously.
@@ -162,7 +174,7 @@ describe('initUpdater state machine', () => {
     autoUpdaterMock.checkForUpdates.mockClear()
     autoUpdaterMock.downloadUpdate.mockClear()
     autoUpdaterMock.quitAndInstall.mockClear()
-    // Keep the update-downloaded dialog from resolving into quitAndInstall.
+    autoUpdaterMock.autoRunAppAfterInstall = false
     vi.mocked(dialog.showMessageBox).mockResolvedValue({ response: 1, checkboxChecked: false })
   })
 
@@ -188,12 +200,14 @@ describe('initUpdater state machine', () => {
       { status: 'downloading', version: '2.0.0', percent: 42 },
       { status: 'ready', version: '2.0.0' },
     ])
+    expect(dialog.showMessageBox).not.toHaveBeenCalled()
+    expect(autoUpdaterMock.quitAndInstall).not.toHaveBeenCalled()
 
     handle.install()
     expect(autoUpdaterMock.quitAndInstall).toHaveBeenCalledTimes(1)
   })
 
-  it('stops at available and downloads on demand when auto-download is off', async () => {
+  it('downloads, installs, and relaunches from one Update action', async () => {
     autoUpdaterMock.autoDownload = false
     const { handle } = await createUpdater({ autoDownload: false })
 
@@ -203,6 +217,11 @@ describe('initUpdater state machine', () => {
     handle.check()
     expect(autoUpdaterMock.downloadUpdate).toHaveBeenCalledTimes(1)
     expect(autoUpdaterMock.checkForUpdates).not.toHaveBeenCalled()
+
+    emit('update-downloaded', { version: '2.0.0' })
+    expect(dialog.showMessageBox).not.toHaveBeenCalled()
+    expect(autoUpdaterMock.autoRunAppAfterInstall).toBe(true)
+    expect(autoUpdaterMock.quitAndInstall).toHaveBeenCalledTimes(1)
   })
 
   it('checks from idle and ignores re-entrant checks while busy', async () => {
@@ -216,6 +235,31 @@ describe('initUpdater state machine', () => {
     expect(autoUpdaterMock.checkForUpdates).toHaveBeenCalledTimes(1)
   })
 
+  it('does not lose an interactive check while updater capability is initializing', async () => {
+    let resolveCapability: ((capable: boolean) => void) | undefined
+    const capability = new Promise<boolean>((resolve) => {
+      resolveCapability = resolve
+    })
+    const states: DesktopUpdateState[] = []
+    const handle = initUpdater({
+      getWindow: () => null,
+      events,
+      appOrigin: () => 'https://www.dev.sim.ai',
+      onStateChange: (state) => states.push(state),
+      loadAutoUpdater: () =>
+        autoUpdaterMock as unknown as typeof import('electron-updater')['autoUpdater'],
+      probeOriginFeed: async () => true,
+      canSelfUpdate: () => capability,
+    })
+
+    handle.check()
+    expect(states).toEqual([{ status: 'checking' }])
+
+    resolveCapability?.(true)
+    await vi.advanceTimersByTimeAsync(0)
+    expect(autoUpdaterMock.checkForUpdates).toHaveBeenCalledTimes(1)
+  })
+
   it('resets to idle when a downloaded update is a blocked downgrade', async () => {
     const { handle } = await createUpdater()
     emit('update-downloaded', { version: '0.0.1' })
@@ -224,6 +268,17 @@ describe('initUpdater state machine', () => {
     expect(autoUpdaterMock.quitAndInstall).not.toHaveBeenCalled()
   })
 
+  it('never exposes an equal, older, malformed, or cross-stream candidate as an update', async () => {
+    const { handle } = await createUpdater()
+
+    for (const version of ['1.0.0', '0.9.9', 'nightly', '2.0.0-dev.1']) {
+      emit('update-available', { version })
+      expect(handle.getState()).toEqual({ status: 'idle' })
+    }
+
+    expect(autoUpdaterMock.downloadUpdate).not.toHaveBeenCalled()
+  })
+
   it('surfaces updater errors and recovers via update-not-available', async () => {
     const { handle } = await createUpdater()
     emit('error', new Error('feed unreachable'))
@@ -233,7 +288,8 @@ describe('initUpdater state machine', () => {
   })
 
   it('switches to the per-env origin feed when the origin serves one', async () => {
-    await createUpdater({ feedAvailable: true })
+    const { handle } = await createUpdater({ feedAvailable: true })
+    handle.check()
     await vi.advanceTimersByTimeAsync(0)
     expect(autoUpdaterMock.setFeedURL).toHaveBeenCalledWith({
       provider: 'generic',
@@ -244,27 +300,70 @@ describe('initUpdater state machine', () => {
   })
 
   it('keeps the packaged GitHub feed when the origin has no feed', async () => {
-    await createUpdater({ feedAvailable: false })
+    const { handle } = await createUpdater({ feedAvailable: false })
+    handle.check()
     await vi.advanceTimersByTimeAsync(0)
     expect(autoUpdaterMock.setFeedURL).not.toHaveBeenCalled()
   })
 
-  it('skips checks on prerelease builds when the origin feed is down', async () => {
+  it('completes an interactive check immediately when the environment has no release', async () => {
+    const { handle, states } = await createUpdater({ feedAvailable: 'no-release' })
+
+    handle.check()
+    await vi.advanceTimersByTimeAsync(0)
+
+    expect(states).toEqual([{ status: 'checking' }, { status: 'idle' }])
+    expect(autoUpdaterMock.checkForUpdates).not.toHaveBeenCalled()
+  })
+
+  it('re-probes a no-release environment so a newly published update appears without restart', async () => {
+    const probeOriginFeed = vi
+      .fn<(feedUrl: string) => Promise<boolean | 'no-release'>>()
+      .mockResolvedValueOnce('no-release')
+      .mockResolvedValueOnce(true)
+    const { handle } = await createUpdater({ probeOriginFeed })
+
+    handle.check()
+    await vi.advanceTimersByTimeAsync(0)
+    expect(handle.getState()).toEqual({ status: 'idle' })
+    expect(autoUpdaterMock.checkForUpdates).not.toHaveBeenCalled()
+
+    handle.check()
+    await vi.advanceTimersByTimeAsync(0)
+    expect(probeOriginFeed).toHaveBeenCalledTimes(2)
+    expect(autoUpdaterMock.setFeedURL).toHaveBeenCalledTimes(1)
+    expect(autoUpdaterMock.checkForUpdates).toHaveBeenCalledTimes(1)
+  })
+
+  it('recovers an interactive check when the feed probe times out', async () => {
+    const probeOriginFeed = vi.fn(() => new Promise<boolean>(() => {}))
+    const { handle } = await createUpdater({ probeOriginFeed })
+
+    handle.check()
+    expect(handle.getState()).toEqual({ status: 'checking' })
+    await vi.advanceTimersByTimeAsync(10_000)
+
+    expect(handle.getState()).toEqual({ status: 'error' })
+    expect(autoUpdaterMock.checkForUpdates).not.toHaveBeenCalled()
+  })
+
+  it('fails interactive checks promptly on prerelease builds when the origin feed is down', async () => {
     // The GitHub fallback is stable-only: a Sim Dev shell can never apply a
     // prod-identity artifact, so it must not check against it.
-    vi.mocked(app.getVersion).mockReturnValue('1.0.1-alpha.7')
+    vi.mocked(app.getVersion).mockReturnValue('1.0.1-dev.7')
     try {
       const { handle } = await createUpdater({ feedAvailable: false })
       handle.check()
       await vi.advanceTimersByTimeAsync(0)
       expect(autoUpdaterMock.checkForUpdates).not.toHaveBeenCalled()
+      expect(handle.getState()).toEqual({ status: 'error' })
     } finally {
       vi.mocked(app.getVersion).mockReturnValue('1.0.0')
     }
   })
 
   it('checks prerelease builds normally through the origin feed', async () => {
-    vi.mocked(app.getVersion).mockReturnValue('1.0.1-alpha.7')
+    vi.mocked(app.getVersion).mockReturnValue('1.0.1-dev.7')
     try {
       const { handle } = await createUpdater({ feedAvailable: true })
       handle.check()
@@ -276,8 +375,8 @@ describe('initUpdater state machine', () => {
   })
 
   it.each([
-    ['1.0.1-alpha.7', 5 * 60 * 1000],
-    ['1.0.1-beta.7', 5 * 60 * 1000],
+    ['1.0.1-dev.7', 5 * 60 * 1000],
+    ['1.0.1-staging.7', 5 * 60 * 1000],
     ['1.0.1', 30 * 60 * 1000],
   ])('schedules %s update polling every %i milliseconds', async (version, interval) => {
     vi.mocked(app.getVersion).mockReturnValue(version)
@@ -505,11 +604,34 @@ describe('checkForUpdatesInteractive', () => {
     await vi.advanceTimersByTimeAsync(0)
 
     expect(dialog.showMessageBox).toHaveBeenCalledWith(
-      expect.objectContaining({ message: 'Sim is up to date' })
+      expect.objectContaining({
+        type: 'info',
+        buttons: ['OK'],
+        defaultId: 0,
+        message: 'You’re up to date!',
+        detail: `Sim ${app.getVersion()} is currently the newest version available.`,
+      })
     )
     expect(shell.openExternal).not.toHaveBeenCalled()
   })
 
+  it('fails a hung interactive check after twelve seconds instead of waiting thirty', async () => {
+    const handle: UpdaterHandle = {
+      setAutoDownload: () => {},
+      getState: () => ({ status: 'checking' }),
+      check: vi.fn(),
+      install: vi.fn(),
+      onState: () => () => {},
+    }
+
+    checkForUpdatesInteractive({ getWindow: () => null, events, handle })
+    await vi.advanceTimersByTimeAsync(12_000)
+
+    expect(dialog.showMessageBox).toHaveBeenCalledWith(
+      expect.objectContaining({ message: 'Could not check for updates' })
+    )
+  })
+
   it('only explains packaged-build updates when unpackaged', async () => {
     ;(app as unknown as { isPackaged: boolean }).isPackaged = false
     checkForUpdatesInteractive({ getWindow: () => null, events, handle: null })