fix(updater): harden DMG downloads

[ryan-mt]

Summary

• download upstream DMGs into a unique same-directory temporary file and atomically replace the cache only after flush and sync
• preserve an existing valid DMG when HTTP status, streaming, or filesystem operations fail
• bound upstream connect and stalled-read operations without imposing a total large-download deadline
• hash cached DMGs incrementally instead of loading the full image into memory

Root cause

The updater created Codex.dmg before the GET request succeeded. That truncated a valid cache and allowed failed transfers to leave partial data at the recorded path. The wrapper-update path also read the entire DMG into memory to derive its package version.

Validation

• cargo fmt --check
• cargo check -p codex-update-manager
• cargo test -p codex-update-manager upstream — 7 passed
• cargo test -p codex-update-manager wrapper_apply::tests::derives_package_version_with_streamed_dmg_hash — 1 passed
• updater suite excluding three independently reproduced upstream/main feature-picker race failures — 217 passed
• clean upstream/main baseline reproduced the same three feature-picker failures (214 passed, 3 failed)
• git diff --check

[Copilot]

Pull request overview

This pull request hardens the updater’s upstream DMG download and wrapper-update flows to avoid corrupting an existing cached Codex.dmg on failed transfers, while also reducing memory usage when hashing DMGs to derive candidate package versions.

Changes:

• Switches DMG downloading to write into a unique temporary file in the destination directory and atomically rename into place only after flush + sync_all, preserving any existing cache on failures.
• Centralizes reqwest client construction in upstream::http_client() and applies connect/stalled-read timeouts consistently across upstream requests.
• Streams DMG hashing for wrapper package version derivation (instead of reading the full DMG into memory) and adds test coverage for the streamed hashing behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
updater/src/wrapper_apply.rs	Uses streamed hashing to derive wrapper package versions from DMGs and adds a unit test for the new hashing approach.
updater/src/upstream.rs	Implements temp-file + atomic replace DMG downloads, adds shared HTTP client factory with timeouts, and expands download failure-mode tests.
updater/src/app.rs	Switches upstream-check cycle to use the shared upstream HTTP client configuration.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Yo-DDV]

Thanks for hardening the updater path. I checked current head c1af3bf7.

I ran:

• cargo fmt --check
• cargo check -p codex-update-manager
• cargo test -p codex-update-manager upstream
• cargo test -p codex-update-manager wrapper_apply::tests::derives_package_version_with_streamed_dmg_hash
• git diff --check origin/main...HEAD

CI is green. The atomic download/cache behavior and streamed hash path look aligned from my side. Final review and merge stay with @ilysenko.

[Leay15]

@ryan-mt Thank you for these hardening changes!
I reviewed the runtime behavior, and everything looks good.
Could you please bump the codex-update-manager crate to the next patch version, 0.9.1?

[ilysenko]

Thanks for the update. I found two additional blockers:

• download_dmg() publishes every download to the shared downloads/Codex.dmg, but the wrapper-apply path does not use the daemon check lock. Concurrent downloads can overwrite each other and leave a caller using SHA/version metadata that no longer matches the file at the returned path. Please serialize publication/use across both paths or publish immutable content-addressed files.
• The temporary file is synced before rename, but the parent directory is not synced afterward. Please make the completed publication crash-durable before reporting success and persisting updater state.

[avifenesh]

(withdrawn — duplicate of feedback already given by other reviewers)

Withdrawing — duplicates the owner's existing review.

[ilysenko]

Thank you for identifying and implementing the updater download-hardening direction. We incorporated that work into #834 with the outstanding review concerns addressed: downloads are published to immutable SHA-256-addressed paths so daemon and wrapper flows cannot replace each other's input, the completed file and parent directory are synced, and hashing is streamed in both the updater and acceptance engine. I am closing this PR as superseded by #834.