@@ -1363,8 +1381,52 @@ export function AboutPanel() {
? i18nT('pages.settings.aboutPanel.automatic_updates_unavailable_channel')
: i18nT('pages.settings.aboutPanel.automatic_updates_unavailable_platform')}
+ ) : isGatewayPolicyManaged ? (
+ // The gateway's security policy provider owns updates on this
+ // bundled install. The intro line and the Check button are hidden:
+ // clicking Check would return "not-available" from the feed lane
+ // that stands down, which is false when the provider has an update
+ // ready.
+ <>
+
+ {i18nT('pages.settings.aboutPanel.updates_managed_by_policy_desktop')}
+
+ {/* When the provider has a pending update, render the gateway's
+ check/apply controls so the user can act on it. Shown ONLY
+ when showUpdate is true to avoid displaying a "Check for
+ updates" button that contradicts the policy notice above. */}
+ {showUpdate && (
+
+ )}
+
) : (
+ {/* When a gateway updates section is also shown in this window,
+ label the app's section so "Check for updates" is unambiguously
+ about this app, not the gateway. */}
+ {updateSwitches.gateway && (
+
+ {i18nT('pages.settings.aboutPanel.app_updates_heading')}
+
+ )}
{/* Managed lane: the marker names an external owner even though
the updater is armed; show the managed-by notice and the
copyable command above the regular update controls. */}
@@ -1458,8 +1520,20 @@ export function AboutPanel() {
)}
{/* Outside the app updater's branches on purpose: a gateway the app
does not own (a reused cli.sh service, an SSH-forwarded one)
- installs on its own switch whatever this build's updater says. */}
- {updateSwitches.gateway &&
}
+ installs on its own switch whatever this build's updater says.
+ On a policy-governed install the switch still controls whether
+ the provider's apply command runs unattended, as the existing
+ WhatsNewAutoUpdateToggle comment documents. */}
+ {updateSwitches.gateway && (
+
+ )}
) : (
About.
useUpdateSubscription()
+ // Notify the main process whenever the gateway status reports a security
+ // policy provider governs this install's updates, so the feed lane stands down.
+ usePolicyGovernedNotification()
const { branding, botName, avatar } = useShellBranding({ colorTheme, brandName, brandLogo, brandFavicon })
useRumPageView()
useNotificationSound()
diff --git a/website/src/store/dashboardSlice.ts b/website/src/store/dashboardSlice.ts
index c55439c9342..3e2a1a562d7 100644
--- a/website/src/store/dashboardSlice.ts
+++ b/website/src/store/dashboardSlice.ts
@@ -1991,3 +1991,10 @@ export const selectSlotListPending = (state: { dashboard: DashboardState }): boo
}
export default dashboardSlice.reducer
+
+/** True when the local bundled gateway's policy provider governs this install.
+ * Shared by `usePolicyGovernedNotification`, `UpdateFoundModal`, `AboutPanel`. */
+export function selectPolicyGoverned(s: { dashboard: DashboardState }): boolean {
+ const st = s.dashboard.status
+ return st?.update_bundled_by_app === true && st?.update_managed_by === 'command' && st?.update_can_apply === true
+}
diff --git a/website/src/test/AboutPanel.policyManaged.test.tsx b/website/src/test/AboutPanel.policyManaged.test.tsx
new file mode 100644
index 00000000000..47969e334c3
--- /dev/null
+++ b/website/src/test/AboutPanel.policyManaged.test.tsx
@@ -0,0 +1,96 @@
+// When the gateway's security policy provider governs updates on a bundled
+// install AND can actually apply on this platform, the desktop update section
+// shows a "managed by policy" notice instead of the regular update card and
+// auto-download switch.
+//
+// Three conditions must all be true:
+// update_bundled_by_app: true (gateway is the one the app bundles)
+// update_managed_by: 'command' (a policy provider owns updates)
+// update_can_apply: true (the provider shell exists — not Windows)
+//
+// On Windows the policy shell is absent (can_apply: false), so the Electron
+// updater remains the working update path and the notice does not appear.
+import { describe, it, expect, vi, afterEach } from 'vitest'
+import { render, screen, waitFor, cleanup } from '@testing-library/react'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { Provider } from 'react-redux'
+import { store } from '../store'
+import { sseStatus } from '../store/dashboardSlice'
+import { MemoryRouter } from 'react-router-dom'
+import { AboutPanel } from '../pages/settings/AboutPanel'
+import { i18nT } from '../i18n/t'
+import type { StatusData } from '../types'
+
+afterEach(cleanup)
+
+const BASE_INFO = {
+ version: '0.1.0',
+ channel: 'stable',
+ stampedChannel: 'stable',
+ channelSwitchable: true,
+ channelPreference: '',
+ platform: 'darwin-arm64',
+ packaged: true,
+}
+
+function mountWithStatus(status: Partial) {
+ ;(window as unknown as { updateAPI?: unknown }).updateAPI = {
+ onState: () => () => {},
+ check: vi.fn().mockResolvedValue({ ok: true }),
+ download: vi.fn().mockResolvedValue({ ok: true }),
+ install: vi.fn().mockResolvedValue({ ok: true }),
+ getInfo: vi.fn().mockResolvedValue(BASE_INFO),
+ }
+ store.dispatch(sseStatus(status as StatusData))
+ const qc = new QueryClient({ defaultOptions: { queries: { retry: false } } })
+ return render(
+
+
+
+
+
+
+ ,
+ )
+}
+
+describe('policy-governed bundled install', () => {
+ it('shows the "managed by policy" notice when provider can apply on this platform', async () => {
+ mountWithStatus({ update_bundled_by_app: true, update_managed_by: 'command', update_can_apply: true } as Partial)
+ const note = await screen.findByTestId('gateway-policy-managed-note')
+ expect(note).toBeInTheDocument()
+ expect(note.textContent).toContain(i18nT('pages.settings.aboutPanel.updates_managed_by_policy_desktop'))
+ })
+
+ it('hides the auto-download switch when policy governs and provider can apply', async () => {
+ mountWithStatus({ update_bundled_by_app: true, update_managed_by: 'command', update_can_apply: true } as Partial)
+ // Wait for the panel to render the version chip so the assertion is against
+ // a fully settled tree, not the initial loading state.
+ await screen.findByTestId('gateway-policy-managed-note')
+ const switches = screen.queryAllByRole('switch', { name: /install app updates automatically/i })
+ expect(switches).toHaveLength(0)
+ })
+
+ it('does not show the notice when the provider cannot apply on this platform (Windows)', async () => {
+ // On Windows the policy shell is absent: update_can_apply is false.
+ // The Electron updater remains the working update path.
+ mountWithStatus({ update_bundled_by_app: true, update_managed_by: 'command', update_can_apply: false } as Partial)
+ await waitFor(() => {
+ expect(screen.queryByTestId('gateway-policy-managed-note')).not.toBeInTheDocument()
+ })
+ })
+
+ it('does not show the notice when bundled but no policy provider', async () => {
+ mountWithStatus({ update_bundled_by_app: true, update_managed_by: 'electron', update_can_apply: false } as Partial)
+ await waitFor(() => {
+ expect(screen.queryByTestId('gateway-policy-managed-note')).not.toBeInTheDocument()
+ })
+ })
+
+ it('does not show the notice when policy provider but not bundled', async () => {
+ mountWithStatus({ update_bundled_by_app: false, update_managed_by: 'command', update_can_apply: true } as Partial)
+ await waitFor(() => {
+ expect(screen.queryByTestId('gateway-policy-managed-note')).not.toBeInTheDocument()
+ })
+ })
+})
diff --git a/website/src/test/AppSdkChatPanel.unlistedSlot.test.tsx b/website/src/test/AppSdkChatPanel.unlistedSlot.test.tsx
index 0e0e935b26f..0e81c386d71 100644
--- a/website/src/test/AppSdkChatPanel.unlistedSlot.test.tsx
+++ b/website/src/test/AppSdkChatPanel.unlistedSlot.test.tsx
@@ -33,7 +33,7 @@ vi.mock('../components/SegmentedControl', () => ({ default: () => null }))
vi.mock('../pages/chat/CollapsibleToolGroup', () => ({ default: () => null }))
vi.mock('../pages/chat/ActivityViewer', () => ({ default: () => null }))
vi.mock('../pages/chat/SessionColorPicker', () => ({ default: () => null }))
-vi.mock('../pages/chat', () => ({ ChatFooter: () => null, AssistantMessage: () => null, McpInfoButton: () => null }))
+vi.mock('../pages/chat', () => ({ ChatFooter: () => null, AssistantMessage: () => null, McpInfoButton: () => null, PinnedPrompt: () => null }))
vi.mock('../pages/ChatSidebar', () => ({ default: () => null, SIDEBAR_MIN: 200, SIDEBAR_MAX: 500 }))
vi.mock('../pages/chat/ChatSettings', () => ({ loadChatConfig: () => ({ contentWidth: 'compact' }), CONTENT_WIDTH: { compact: { messages: '900px', input: '916px' }, comfortable: { messages: '84%', input: '85%' }, full: { messages: '92%', input: '93%' } } }))
diff --git a/website/src/types/electron-bridge.d.ts b/website/src/types/electron-bridge.d.ts
index cc1a3d0c51b..2dc8aee4b44 100644
--- a/website/src/types/electron-bridge.d.ts
+++ b/website/src/types/electron-bridge.d.ts
@@ -235,6 +235,10 @@ declare global {
laneVersion?: string
runningAheadOfLane?: boolean | null
replayed?: boolean
+ /** The main process's confirmed governance verdict — true only when the
+ * local bundled gateway's policy provider was accepted via the three-gate
+ * assertLocalDashboard check. False for remote (SSH-tunneled) gateways. */
+ policyGoverned?: boolean
}
interface UpdateInfo {
@@ -252,6 +256,10 @@ declare global {
updateCommand?: string
laneVersion?: string
runningAheadOfLane?: boolean | null
+ /** The main process's confirmed policy governance verdict — true only when
+ * the local bundled gateway's policy provider was accepted via the
+ * three-gate assertLocalDashboard check. */
+ policyGoverned?: boolean
}
interface UpdateResult {
@@ -268,6 +276,10 @@ declare global {
getInfo?: () => Promise<(UpdateInfo & { lastState?: UpdateState | null }) | undefined>
setChannel?: (channel: string) => Promise
setAutoDownload?: (enabled: boolean) => Promise
+ /** Notify the main process that a security policy provider now governs (or
+ * no longer governs) this install's updates. Fire-and-forget; no return.
+ * Absent on shells that predate the feature. */
+ notifyPolicyGoverned?: (governed: boolean) => void
}
interface Window {
diff --git a/website/src/utils/updateSwitches.test.ts b/website/src/utils/updateSwitches.test.ts
index d8956a83b87..81374e3f9e2 100644
--- a/website/src/utils/updateSwitches.test.ts
+++ b/website/src/utils/updateSwitches.test.ts
@@ -37,6 +37,33 @@ describe('updateSwitchesShown', () => {
expect(gateway('unknown')).toBe(false)
})
+ it('draws the gateway row in a desktop window for a reused (non-bundled) gateway', () => {
+ // Topology 2 of GH #15797: a gateway the app reuses (CLI service, SSH tunnel)
+ // manages its own bytes; its switch is shown even when the effect is not yet
+ // a definite install, because the app's updater does not cover it.
+ for (const effect of ['notify', 'unknown'] as const) {
+ expect(
+ updateSwitchesShown({ bridge: shell(), info: {}, effect, bundledByApp: false }).gateway,
+ ).toBe(true)
+ }
+ })
+
+ it('still hides the gateway row in a desktop window for the bundled gateway', () => {
+ // bundledByApp: true => the app's own gateway, which ignores the switch.
+ for (const effect of ['notify', 'unknown'] as const) {
+ expect(
+ updateSwitchesShown({ bridge: shell(), info: {}, effect, bundledByApp: true }).gateway,
+ ).toBe(false)
+ }
+ })
+
+ it('treats an unresolved bundled status conservatively (same as before)', () => {
+ // bundledByApp: undefined => status not yet loaded, keep the old rule.
+ expect(
+ updateSwitchesShown({ bridge: shell(), info: {}, effect: 'notify', bundledByApp: undefined }).gateway,
+ ).toBe(false)
+ })
+
it('offers the app switch on a shell that can read and write it, unless the updater is disabled', () => {
const app = (bridge: UpdateAPI | undefined, info: { disabled?: string } | null | undefined) =>
updateSwitchesShown({ bridge, info, effect: 'notify' }).app
@@ -47,6 +74,18 @@ describe('updateSwitchesShown', () => {
expect(app(shell({ getInfo: undefined }), {})).toBe(false)
})
+ it('hides the app switch when policy governs so settings search and About agree', () => {
+ // A policy provider owns updates: the app's auto-download switch is not actionable
+ // and must not appear in settings search (leading to an absent target on About).
+ expect(
+ updateSwitchesShown({ bridge: shell(), info: {}, effect: 'install', policyGoverned: true }).app,
+ ).toBe(false)
+ // Without governance the switch still shows normally.
+ expect(
+ updateSwitchesShown({ bridge: shell(), info: {}, effect: 'install', policyGoverned: false }).app,
+ ).toBe(true)
+ })
+
it.each(['dev', 'translocated', 'externally-managed'])(
'keeps a disabled (%s) updater out of the gateway switch’s rule',
disabled => {
diff --git a/website/src/utils/updateSwitches.ts b/website/src/utils/updateSwitches.ts
index 065ed66cfce..821858d7bf0 100644
--- a/website/src/utils/updateSwitches.ts
+++ b/website/src/utils/updateSwitches.ts
@@ -10,12 +10,13 @@
* `update_auto_effect` and nothing about the desktop updater. In a browser
* window the gateway card IS the update UI, so the row is always drawn and
* says when the switch cannot install or when the gateway has not said yet.
- * In a desktop window it is drawn only on a definite install or mandatory:
- * the app's own gateway ignores the switch, and an unknown effect cannot
- * tell that gateway from one the app merely attaches to.
+ * In a desktop window it is drawn when the effect is a definite install or
+ * mandatory, or when the status frame reports the connected gateway is not the
+ * bundled one (the app reuses an external gateway that manages its own bytes).
*/
import { useQuery } from '@tanstack/react-query'
import { useAppSelector } from '../store'
+import { selectPolicyGoverned } from '../store/dashboardSlice'
import { hasAutoDownload, updateInfoQuery } from '../api/updateInfoQuery'
import { i18nT } from '../i18n/t'
import type { StatusData } from '../types'
@@ -35,18 +36,62 @@ export function useGatewayAutoUpdateEffect(): Effect {
return gatewayAutoUpdateEffect(useAppSelector(s => s.dashboard.status?.update_auto_effect))
}
+/**
+ * Whether this app's Electron updater is governed by a policy provider.
+ * Combines the status-based check (fast) with the main-process-confirmed value
+ * from the `update-state` broadcast cache, which is authoritative: the main-
+ * process gate rejects notifications from SSH-tunnelled remote gateways, so a
+ * remote bundled gateway's stamp cannot suppress the local app's update surfaces.
+ * The update-state broadcast always wins over the older getInfo() snapshot.
+ * When no broadcast has arrived yet (new window), info.policyGoverned from
+ * getInfo() is honoured in either direction as the next-best source.
+ */
+export function useIsPolicyGoverned(info?: { policyGoverned?: boolean } | null): boolean {
+ const statusGoverned = useAppSelector(selectPolicyGoverned)
+ const { data: updateState } = useQuery({ queryKey: ['update-state'], enabled: false })
+ // The update-state broadcast carries the most recent main-process verdict.
+ // If it explicitly confirms governance is active, trust it over any older snapshot.
+ if (updateState?.policyGoverned === true) return true
+ // If the main process confirmed governance is NOT active, trust it.
+ if (updateState?.policyGoverned === false) return false
+ // No broadcast verdict yet (new window): honour getInfo's policyGoverned in
+ // either direction as the next-best authoritative source.
+ if (info !== undefined && info !== null) {
+ if (info.policyGoverned === true) return true
+ if (info.policyGoverned === false) return false
+ }
+ // Fallback: use status-based predicate.
+ return statusGoverned
+}
+
/**
* Which update switches a window draws (see the module rule). `info` is the
* updater's `getInfo()` answer, `undefined` while it has not answered.
+ * `bundledByApp` is `update_bundled_by_app` from the status frame: `true` when
+ * this gateway is the one the desktop app bundled and launched, `false` when the
+ * app reuses an external gateway (a CLI service, an SSH-forwarded one), and
+ * `undefined` while the status has not arrived. A reused gateway in a desktop
+ * window has its own update surface, so its switch is always drawn even when the
+ * effect is not yet a definite install.
*/
-export function updateSwitchesShown({ bridge, info, effect }: {
+export function updateSwitchesShown({ bridge, info, effect, bundledByApp, policyGoverned }: {
bridge: UpdateAPI | undefined
info: { disabled?: string } | null | undefined
effect: Effect
+ bundledByApp?: boolean
+ /** When the gateway reports a security policy provider governs this install's
+ * updates, the app's own auto-download switch must not be shown: the feed lane
+ * stands down and the preference is not actionable. Settings search and the
+ * What's-new modal read this too, so they agree with About on switch visibility. */
+ policyGoverned?: boolean
}): { app: boolean; gateway: boolean } {
return {
- app: hasAutoDownload(bridge) && !info?.disabled,
- gateway: !bridge || effect === 'install' || effect === 'mandatory',
+ app: hasAutoDownload(bridge) && !info?.disabled && !policyGoverned,
+ // In a desktop window, show the gateway switch when the effect is a definite
+ // install or mandatory (the existing rule), OR when the gateway is known to be
+ // a reused one (not the bundled gateway): a reused gateway manages its own
+ // updates and the app's updater does not cover it.
+ gateway: !bridge || bundledByApp === false || effect === 'install' || effect === 'mandatory',
}
}
@@ -60,7 +105,9 @@ export function updateSwitchesShown({ bridge, info, effect }: {
export function useUpdateSwitchesShown({ fetch = true }: { fetch?: boolean } = {}): { app: boolean; gateway: boolean } {
const bridge = window.updateAPI
const { data: info } = useQuery({ ...updateInfoQuery, enabled: fetch && !!bridge })
- return updateSwitchesShown({ bridge, info, effect: useGatewayAutoUpdateEffect() })
+ const bundledByApp = useAppSelector(s => s.dashboard.status?.update_bundled_by_app)
+ const policyGoverned = useIsPolicyGoverned(info)
+ return updateSwitchesShown({ bridge, info, effect: useGatewayAutoUpdateEffect(), bundledByApp, policyGoverned })
}
/**