[cookingwithsimon]

Requested by Simon · project thread

What changes for the user

Before: to get a new version you had to visit the Releases page, download the exe and replace your copy by hand.

After:

• A few seconds after start, a release build quietly checks GitHub's latest release. If there's a newer one, a green banner offers Install and restart, What's new, Not now and Skip this version.
• Install and restart downloads the new exe, checks it against the .sha256 published with the release, swaps it in place of the running exe (the old one becomes ProDHCPServer.exe.old, deleted on the next start) and starts the new version. The new version inherits admin rights, so there's no UAC prompt.
• Installing needs the server stopped, so the adapter is always restored first.
• Settings > Updates: a tick box for the start-up check (on by default), Check now, and the status.
• Offline or on an isolated AV network, the check fails quietly. It only writes a log line, never a banner or popup.
• If Windows refuses to start the new exe (Defender ASR on managed work laptops), the old exe is put back and the banner explains what to do.
• CI test builds (0.1.N) don't check on start, so smoke-test screenshots stay clean. Check now still works on them.

This runs inside the app. There's no separate Windows service.

How

• Core/Updates/Updater.cs: UpdateChecker (GitHub API, release JSON parsing, SHA-256-checked streaming download, size cap, GitHub-only HTTPS URLs, plain-English failures) and ExeSwap (rename-aside install, rollback, clean-up). No Windows APIs.
• App/ViewModels/UpdateViewModel.cs: start-up check, commands, and process restart with --updated.
• App.xaml.cs: the outgoing version releases the single-instance mutex just before starting the new exe, and a version started with --updated waits up to 30 s for the mutex. That covers both new and older builds.
• AppSettings: CheckForUpdates, SkippedUpdate.
• README section on updates, plus docs/hardware-test-updates.md.

Integrity note: the SHA-256 comes from the same GitHub release, so it catches a corrupted or truncated download. It doesn't protect against a compromised GitHub account. Code signing would be the next step for that.

Testing

• Core tests pass (new UpdaterTests: version parsing, release JSON, drafts and pre-releases ignored, non-GitHub URLs refused, offline and rate-limited checks, checksum match and mismatch, swap, rollback and clean-up)
• Windows CI run is green (integration tests, publish, smoke-test screenshots)
• Hardware checklist added: docs/hardware-test-updates.md (updates a test build from this PR to the published v1.1.0)

---

Generated by Claude Code