fix(one): stop orphaned server, double menu dialogs, and update crash-loop

Four user-reported issues with the desktop shell:

1. Orphaned server on quit/restart. `node one.mjs` is only a launcher — it
   spawns `objectstack serve` as a grandchild. kill_current() used
   Child::kill() (SIGKILL), which the launcher can't forward, so the real
   server was orphaned and kept holding the port + SQLite DB. Now the launcher
   runs as a process-group leader and shutdown sends SIGTERM to the whole group
   (graceful, forwarded to the server) with a SIGKILL fallback; taskkill /T on
   Windows. Validated: port listeners drop to 0 after shutdown.

2. "Repeated refresh" on second launch was a consequence of #1 — the orphan
   held standalone.db, so the new server hit a lock conflict, crashed, and the
   supervisor restarted it in a loop, re-navigating the window each time. Fixed
   by #1 (no orphan -> no conflict).

3. Two windows per menu click. A single click is delivered to both the tray's
   on_menu_event and the global app handler, running every action twice (two
   update dialogs, two Finder windows for Open Data/Reveal Logs). Added a short
   dedup window in handle_menu_id.

4. "Check for updates" gave no feedback and could be clicked repeatedly. Added
   CHECKING/INSTALLING atomic guards (concurrent clicks are no-ops), an
   update-checking event ("Checking for updates…"), and real download progress
   via update-progress; splash + injected banner render both.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: os-zhuang

apps/objectos-one/src-tauri/Cargo.lock

@@ -27,6 +27,12 @@ dirs = "5"
 tokio = { version = "1", features = ["time"] }
 url = "2"
 
+[target.'cfg(unix)'.dependencies]
+# Used to signal the whole sidecar process group (launcher + grandchild
+# `objectstack serve`) so a graceful SIGTERM reaches the real server instead
+# of only SIGKILLing the launcher and orphaning the server.
+libc = "0.2"
+
 [profile.release]
 panic = "abort"
 codegen-units = 1

apps/objectos-one/src-tauri/Cargo.toml

@@ -1,5 +1,5 @@
 // Injected into every page of the main webview. Lets the user see update
-// prompts even after navigating away from the splash page.
+// status, progress and prompts even after navigating away from the splash page.
 (function () {
   if (window.__objectosUpdateBanner) return;
   window.__objectosUpdateBanner = true;
@@ -23,9 +23,7 @@
     return root;
   }
 
-  function render(info) {
-    const root = ensureRoot();
-    root.innerHTML = '';
+  function cardShell() {
     const card = document.createElement('div');
     Object.assign(card.style, {
       background: '#141826',
@@ -35,14 +33,55 @@
       padding: '14px 16px',
       boxShadow: '0 10px 30px rgba(0,0,0,0.35)',
     });
+    return card;
+  }
+
+  function currentKind() {
+    const root = document.getElementById('__objectos_update_root');
+    const el = root && root.firstElementChild;
+    return el ? el.getAttribute('data-kind') : null;
+  }
+
+  function setStatusText(text) {
+    const root = document.getElementById('__objectos_update_root');
+    if (!root) return;
+    const status = root.querySelector('[data-status]');
+    if (status) status.textContent = text;
+  }
+
+  // Lightweight, non-actionable status toast (e.g. "Checking for updates…").
+  // Never overrides the real, actionable update card.
+  function showStatus(text) {
+    if (currentKind() === 'card') return;
+    const root = ensureRoot();
+    root.innerHTML = '';
+    const card = cardShell();
+    card.setAttribute('data-kind', 'status');
+    card.innerHTML = `<div data-status style="color:#8b93a7">${text}</div>`;
+    root.appendChild(card);
+  }
+
+  function clearStatus() {
+    if (currentKind() === 'status') {
+      const root = document.getElementById('__objectos_update_root');
+      if (root) root.remove();
+    }
+  }
+
+  // The actionable "update available · restart to install" card.
+  function render(info) {
+    const root = ensureRoot();
+    root.innerHTML = '';
+    const card = cardShell();
+    card.setAttribute('data-kind', 'card');
     card.innerHTML = `
-      <div style="font-weight:600;margin-bottom:4px">Update available · v${info.version}</div>
+      <div style="font-weight:600;margin-bottom:4px">Update available · v${info.version || '?'}</div>
       <div style="color:#8b93a7;font-size:12px;margin-bottom:10px">
-        You're on v${info.current}. Restart to install.
+        You're on v${info.current || '?'}. Restart to install.
       </div>
       <div style="display:flex;gap:8px;justify-content:flex-end">
         <button data-act="later" style="background:transparent;color:#8b93a7;border:1px solid #2c3247;border-radius:6px;padding:5px 10px;cursor:pointer">Later</button>
-        <button data-act="install" style="background:#6ea8ff;color:#0b0d12;border:0;border-radius:6px;padding:5px 12px;cursor:pointer;font-weight:600">Install & Restart</button>
+        <button data-act="install" style="background:#6ea8ff;color:#0b0d12;border:0;border-radius:6px;padding:5px 12px;cursor:pointer;font-weight:600">Install &amp; Restart</button>
       </div>
       <div data-status style="color:#8b93a7;font-size:12px;margin-top:8px"></div>
     `;
@@ -63,11 +102,15 @@
     };
   }
 
+  // "Checking for updates…" feedback for the user-initiated menu check.
+  event.listen('objectos://update-checking', (e) => {
+    if (e.payload) showStatus('Checking for updates…');
+    else clearStatus();
+  });
   event.listen('objectos://update-available', (e) => render(e.payload || {}));
-  event.listen('objectos://update-installing', (e) => {
-    const root = document.getElementById('__objectos_update_root');
-    if (!root) return;
-    const status = root.querySelector('[data-status]');
-    if (status) status.textContent = 'Downloading v' + e.payload + '…';
+  event.listen('objectos://update-installing', () => setStatusText('Starting update…'));
+  event.listen('objectos://update-progress', (e) => {
+    const p = e.payload || {};
+    setStatusText(p.pct != null ? `Downloading ${p.pct}%…` : 'Downloading…');
   });
 })();

apps/objectos-one/src-tauri/assets/update-banner.js

@@ -4,6 +4,11 @@
 //! reads the first submenu as the "application menu", so that's where the
 //! standard About / Settings / Quit items live.
 
+use std::{
+    sync::Mutex,
+    time::{Duration, Instant},
+};
+
 use tauri::{
     menu::{AboutMetadataBuilder, Menu, MenuItem, PredefinedMenuItem, Submenu},
     tray::{MouseButton, MouseButtonState, TrayIconBuilder, TrayIconEvent},
@@ -13,8 +18,30 @@ use tauri_plugin_opener::OpenerExt;
 
 use crate::{logger, paths, sidecar, updater, windows};
 
+/// A single menu click is delivered to BOTH the tray's own `on_menu_event` and
+/// the global app `on_menu_event`, so every action would otherwise run twice —
+/// popping two dialogs, opening two Finder windows, etc. Track the last event
+/// and drop a repeat of the same id within a short window.
+static LAST_MENU_EVENT: Mutex<Option<(String, Instant)>> = Mutex::new(None);
+const MENU_DEDUP_WINDOW: Duration = Duration::from_millis(400);
+
+fn is_duplicate_event(id: &str) -> bool {
+    let now = Instant::now();
+    let mut guard = LAST_MENU_EVENT.lock().unwrap();
+    if let Some((last_id, last_at)) = guard.as_ref() {
+        if last_id == id && now.duration_since(*last_at) < MENU_DEDUP_WINDOW {
+            return true;
+        }
+    }
+    *guard = Some((id.to_string(), now));
+    false
+}
+
 /// Central dispatch for both menus.
 pub fn handle_menu_id(app: &AppHandle, id: &str) {
+    if is_duplicate_event(id) {
+        return;
+    }
     match id {
         "open" => windows::focus_main(app),
         "reload" => windows::reload_main(app),

apps/objectos-one/src-tauri/src/menu.rs

@@ -54,11 +54,54 @@ const STABLE_AFTER: Duration = Duration::from_secs(60);
 /// pick-a-port / bind-a-port race the Node launcher used to have.
 const DEFAULT_PORT: u16 = 8787;
 
+/// Max time we wait for a graceful shutdown before force-killing.
+const SHUTDOWN_GRACE: Duration = Duration::from_millis(3000);
+
 pub fn kill_current(app: &AppHandle) {
     let state: tauri::State<Sidecar> = app.state();
     let taken = state.0.lock().unwrap().take();
     if let Some(mut child) = taken {
-        let _ = child.kill();
+        let pid = child.id();
+        terminate_tree(pid, &mut child);
+    }
+}
+
+/// Terminate the sidecar *process tree*.
+///
+/// The thing we spawn (`node one.mjs`) is only a launcher — it spawns the real
+/// `objectstack serve` as a grandchild. A plain `Child::kill()` sends SIGKILL,
+/// which the launcher can't catch or forward, so the server is orphaned and
+/// keeps holding the port and the SQLite DB. Instead we signal the whole
+/// process group (we spawn the launcher as a group leader, so pgid == pid):
+/// SIGTERM first so the launcher forwards a clean shutdown to the server and
+/// it releases its resources, then SIGKILL as a fallback if it doesn't exit.
+fn terminate_tree(pid: u32, child: &mut Child) {
+    #[cfg(unix)]
+    {
+        // Negative pid targets the entire process group.
+        unsafe { libc::kill(-(pid as i32), libc::SIGTERM) };
+        let deadline = Instant::now() + SHUTDOWN_GRACE;
+        loop {
+            match child.try_wait() {
+                Ok(Some(_)) => return, // exited cleanly
+                Ok(None) if Instant::now() < deadline => {
+                    thread::sleep(Duration::from_millis(100));
+                }
+                _ => break,
+            }
+        }
+        // Didn't exit in time — force-kill the whole group, then reap.
+        unsafe { libc::kill(-(pid as i32), libc::SIGKILL) };
+        let _ = child.wait();
+    }
+    #[cfg(windows)]
+    {
+        // No process groups here; taskkill /T terminates the whole tree.
+        let _ = Command::new("taskkill")
+            .args(["/PID", &pid.to_string(), "/T", "/F"])
+            .stdout(Stdio::null())
+            .stderr(Stdio::null())
+            .status();
         let _ = child.wait();
     }
 }
@@ -180,6 +223,15 @@ fn spawn_sidecar(app: &AppHandle) -> Result<Child, String> {
         // full deadline on a dead port and the UI would hang on the splash.
         .env("OBJECTOS_MANAGED", "1");
 
+    // Run the launcher in its own process group (pgid == its pid) so shutdown
+    // can signal the whole tree — launcher + the `objectstack serve`
+    // grandchild — at once instead of orphaning the server. See terminate_tree.
+    #[cfg(unix)]
+    {
+        use std::os::unix::process::CommandExt;
+        cmd.process_group(0);
+    }
+
     let mut child = cmd.spawn().map_err(|e| format!("spawn node: {e}"))?;
 
     if let Some(stdout) = child.stdout.take() {

apps/objectos-one/src-tauri/src/sidecar.rs

@@ -13,7 +13,10 @@
 //!     which WebView is currently loaded in the main window.
 
 use std::{
-    sync::atomic::{AtomicBool, Ordering},
+    sync::{
+        atomic::{AtomicBool, AtomicU64, Ordering},
+        Arc,
+    },
     time::Duration,
 };
 
@@ -27,6 +30,36 @@ use crate::{logger::log_line, sidecar};
 
 pub static UPDATE_PENDING: AtomicBool = AtomicBool::new(false);
 
+/// True while an update check is running. Guards against a second click (or a
+/// background check) starting an overlapping check — which is what let the
+/// "Check for updates…" item fire repeatedly with no feedback.
+static CHECKING: AtomicBool = AtomicBool::new(false);
+
+/// True while a download+install is running. This is the guard that makes it
+/// impossible to launch two installs at once (the cause of multiple installer
+/// windows on a slow network).
+static INSTALLING: AtomicBool = AtomicBool::new(false);
+
+/// RAII guard over an atomic flag: acquires it via compare-exchange and clears
+/// it on drop, so any early return / error path releases it for a later retry.
+struct FlagGuard(&'static AtomicBool);
+
+impl FlagGuard {
+    /// `Some(guard)` only if we flipped the flag false→true; `None` if it was
+    /// already held (i.e. an operation is already in flight).
+    fn acquire(flag: &'static AtomicBool) -> Option<FlagGuard> {
+        flag.compare_exchange(false, true, Ordering::SeqCst, Ordering::SeqCst)
+            .ok()
+            .map(|_| FlagGuard(flag))
+    }
+}
+
+impl Drop for FlagGuard {
+    fn drop(&mut self) {
+        self.0.store(false, Ordering::SeqCst);
+    }
+}
+
 #[derive(Serialize, Clone)]
 pub struct UpdateInfo {
     pub version: String,
@@ -48,17 +81,34 @@ pub fn schedule_update_check(app: AppHandle) {
 /// so we always show a native dialog with the outcome. The background check
 /// (verbose=false) stays silent on the no-news path.
 pub async fn check_for_update(app: &AppHandle, verbose: bool) {
+    // Only one check at a time. A second click (or a background check racing a
+    // manual one) is ignored rather than stacking another network call + dialog.
+    let Some(_check_guard) = FlagGuard::acquire(&CHECKING) else {
+        log_line("INFO", "update check already running; ignoring duplicate request");
+        return;
+    };
+    // Give the user immediate feedback that the click registered.
+    if verbose {
+        let _ = app.emit("objectos://update-checking", true);
+    }
+
     let updater = match app.updater() {
         Ok(u) => u,
         Err(e) => {
             log_line("WARN", &format!("updater unavailable: {e}"));
             if verbose {
+                let _ = app.emit("objectos://update-checking", false);
                 show_error(app, &e.to_string());
             }
             return;
         }
     };
-    match updater.check().await {
+    let outcome = updater.check().await;
+    // Clear the "checking" indicator before surfacing the result.
+    if verbose {
+        let _ = app.emit("objectos://update-checking", false);
+    }
+    match outcome {
         Ok(Some(update)) => {
             UPDATE_PENDING.store(true, Ordering::SeqCst);
             let info = UpdateInfo {
@@ -192,15 +242,39 @@ pub async fn install_update(app: AppHandle) -> Result<(), String> {
 /// Shared install path used by both the IPC command (called from the
 /// splash UI) and the verbose-check confirm dialog.
 async fn run_install(app: &AppHandle) -> Result<(), String> {
+    // Single install ever. A second invocation (double-click, or both the
+    // splash card and the injected banner firing) is a no-op while one runs —
+    // this is what prevents two downloads / two installer windows.
+    let Some(_install_guard) = FlagGuard::acquire(&INSTALLING) else {
+        log_line("INFO", "install already in progress; ignoring duplicate request");
+        return Ok(());
+    };
+
     let updater = app.updater().map_err(|e| e.to_string())?;
     let update = updater
         .check()
         .await
         .map_err(|e| e.to_string())?
         .ok_or_else(|| "no update available".to_string())?;
     let _ = app.emit("objectos://update-installing", &update.version);
+
+    // Stream download progress to the UI so the user can see it's working and
+    // doesn't click again.
+    let app_progress = app.clone();
+    let downloaded = Arc::new(AtomicU64::new(0));
+    let counter = downloaded.clone();
     update
-        .download_and_install(|_, _| {}, || {})
+        .download_and_install(
+            move |chunk, total| {
+                let so_far = counter.fetch_add(chunk as u64, Ordering::SeqCst) + chunk as u64;
+                let pct = total.map(|t| if t > 0 { ((so_far * 100) / t).min(100) } else { 0 });
+                let _ = app_progress.emit(
+                    "objectos://update-progress",
+                    serde_json::json!({ "downloaded": so_far, "total": total, "pct": pct }),
+                );
+            },
+            || {},
+        )
         .await
         .map_err(|e| e.to_string())?;
     // Make sure the sidecar is gone before the relaunch swaps the binary.

apps/objectos-one/src-tauri/src/updater.rs

@@ -129,6 +129,11 @@
           updInstall.disabled = true;
           updLater.disabled = true;
         });
+        event.listen('objectos://update-progress', (e) => {
+          const p = e.payload || {};
+          updStatus.textContent =
+            p.pct != null ? 'Downloading ' + p.pct + '%…' : 'Downloading…';
+        });
         updInstall.addEventListener('click', async () => {
           updStatus.textContent = 'Starting update…';
           updInstall.disabled = true;