fix(updatecheck): verify rpm ownership and detect tray-staged DMG core (Spec 079 US2)

Cross-model review round 1 fixes:

- rpm channel: the RPM database existing only proves the host is
  RPM-based; a manual tarball copy to /usr/bin/mcpproxy on Fedora was
  misclassified as rpm and shown a wrong 'sudo dnf upgrade' command.
  Ownership is now confirmed with a one-shot 'rpm -qf /usr/bin/mcpproxy'
  probe (3s timeout, fails closed to unknown per FR-009).

- dmg channel: DMG installs run the core from the tray-staged
  ~/Library/Application Support/mcpproxy/bin/mcpproxy (and the bundled
  source lives under Contents/Resources/bin), so the .app/Contents/MacOS
  check never matched the process serving /api/v1/info and DMG installs
  reported unknown. Both paths now classify as dmg; that staged directory
  is written only by the tray's bundle-staging, so it uniquely implies a
  DMG install.

Author: Dumbris

docs/features/version-updates.md

@@ -181,12 +181,17 @@ in decreasing confidence order:
    `/home/linuxbrew/.linuxbrew`).
 2. **Docker**: `/.dockerenv` exists.
 3. **deb / rpm**: on Linux, the executable is exactly `/usr/bin/mcpproxy`
-   **and** the owning package manager's database confirms it
-   (`/var/lib/dpkg/info/mcpproxy.list` for deb; an rpm database for rpm).
-   Both signals are required — a binary merely copied to `/usr/bin` (e.g. an
-   AUR or manual install) stays `unknown`.
-4. **DMG**: on macOS, the executable runs from an `.app/Contents/MacOS`
-   bundle.
+   **and** the owning package manager confirms it owns the file
+   (`/var/lib/dpkg/info/mcpproxy.list` for deb; for rpm, an rpm database
+   exists **and** a one-shot `rpm -qf /usr/bin/mcpproxy` query names the
+   `mcpproxy` package). Both signals are required — a binary merely copied to
+   `/usr/bin` (e.g. an AUR or manual install), even on an RPM-based distro,
+   stays `unknown`.
+4. **DMG**: on macOS, the executable runs from an `.app/Contents/MacOS` or
+   `.app/Contents/Resources/bin` bundle path, or is the tray-staged core at
+   `~/Library/Application Support/mcpproxy/bin/mcpproxy` (the process that
+   actually serves the API for DMG installs; only the tray's bundle-staging
+   writes that directory).
 5. **go install**: the Go toolchain stamped a real module version into the
    binary's build info while no release version was stamped via ldflags.
 6. Otherwise the channel is **`unknown`**.

internal/updatecheck/channel.go

@@ -1,11 +1,14 @@
 package updatecheck
 
 import (
+	"context"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"runtime"
 	"runtime/debug"
 	"strings"
+	"time"
 
 	"golang.org/x/mod/semver"
 )
@@ -70,6 +73,10 @@ type channelDetector struct {
 	evalSymlinks  func(string) (string, error)
 	statFile      func(string) error // nil error ⇒ the path exists
 	readBuildInfo func() (*debug.BuildInfo, bool)
+	// rpmOwnsBinary reports whether the mcpproxy RPM package owns
+	// /usr/bin/mcpproxy (see rpmOwnsUsrBinMcpproxy). Only consulted on Linux
+	// when the binary runs from /usr/bin/mcpproxy and an RPM database exists.
+	rpmOwnsBinary func() bool
 }
 
 func newChannelDetector(ldflagsVersion string) *channelDetector {
@@ -84,9 +91,31 @@ func newChannelDetector(ldflagsVersion string) *channelDetector {
 			return err
 		},
 		readBuildInfo: debug.ReadBuildInfo,
+		rpmOwnsBinary: rpmOwnsUsrBinMcpproxy,
 	}
 }
 
+// rpmProbeTimeout bounds the one-shot `rpm -qf` ownership query run at
+// startup on RPM-based hosts. rpm answers from a local database, so 3s is
+// generous; on expiry the probe fails closed to ChannelUnknown.
+const rpmProbeTimeout = 3 * time.Second
+
+// rpmOwnsUsrBinMcpproxy reports whether the mcpproxy RPM package owns
+// /usr/bin/mcpproxy. The RPM database existing (checked by the caller) only
+// proves the host is RPM-based — a manual tarball copy to /usr/bin/mcpproxy on
+// Fedora would otherwise be misclassified as an rpm install and shown a wrong
+// `dnf upgrade` command (FR-009: never guess). Any failure — rpm binary
+// missing, file unowned, timeout — degrades to false, i.e. ChannelUnknown.
+func rpmOwnsUsrBinMcpproxy() bool {
+	ctx, cancel := context.WithTimeout(context.Background(), rpmProbeTimeout)
+	defer cancel()
+	out, err := exec.CommandContext(ctx, "rpm", "-qf", "--qf", "%{NAME}", "/usr/bin/mcpproxy").Output()
+	if err != nil {
+		return false
+	}
+	return strings.TrimSpace(string(out)) == "mcpproxy"
+}
+
 // DetectChannel identifies the install channel of the running binary.
 // ldflagsVersion is the build version handed to the checker (see
 // channelDetector.ldflagsVersion). The build-time marker wins; heuristics
@@ -124,14 +153,19 @@ func (d *channelDetector) detect() string {
 	}
 
 	// (3) deb/rpm: require BOTH the package-manager-owned install path AND
-	// that package manager's database evidence. AUR/manual installs share
-	// /usr/bin/mcpproxy but have neither DB entry and must fall to unknown;
-	// both DBs matching is ambiguous and also falls to unknown. This branch
-	// is terminal for the /usr/bin/mcpproxy path: never guess (FR-009).
+	// package-specific ownership evidence. dpkg keeps a per-package file list
+	// (mcpproxy.list); rpm has no per-package file to stat, so the database
+	// presence (host is RPM-based) is confirmed with an `rpm -qf` ownership
+	// query — the DB alone would misclassify a manual tarball copy to
+	// /usr/bin/mcpproxy on any RPM distro. AUR/manual installs have neither
+	// and must fall to unknown; both matching is ambiguous and also falls to
+	// unknown. This branch is terminal for the /usr/bin/mcpproxy path: never
+	// guess (FR-009).
 	if d.goos == "linux" && path == "/usr/bin/mcpproxy" {
 		hasDeb := d.statFile("/var/lib/dpkg/info/mcpproxy.list") == nil
-		hasRPM := d.statFile("/var/lib/rpm/rpmdb.sqlite") == nil ||
+		rpmDBPresent := d.statFile("/var/lib/rpm/rpmdb.sqlite") == nil ||
 			d.statFile("/var/lib/rpm/Packages") == nil
+		hasRPM := rpmDBPresent && d.rpmOwnsBinary()
 		switch {
 		case hasDeb && !hasRPM:
 			return ChannelDeb
@@ -142,8 +176,19 @@ func (d *channelDetector) detect() string {
 		}
 	}
 
-	// (4) macOS app bundle ⇒ DMG install.
-	if d.goos == "darwin" && strings.Contains(path, ".app/Contents/MacOS") {
+	// (4) macOS DMG install. Three shapes, because the tray stages the
+	// bundled core out of the app bundle before running it
+	// (cmd/mcpproxy-tray stageBundledCore):
+	//   - .app/Contents/MacOS       — the tray itself / direct bundle exec
+	//   - .app/Contents/Resources/bin — the bundled core run in place
+	//   - ~/Library/Application Support/mcpproxy/bin/mcpproxy — the staged
+	//     core, which is the process that actually serves /api/v1/info for
+	//     DMG installs; that directory is written only by the tray's
+	//     bundle-staging path, so it uniquely implies a DMG install.
+	if d.goos == "darwin" &&
+		(strings.Contains(path, ".app/Contents/MacOS") ||
+			strings.Contains(path, ".app/Contents/Resources/bin") ||
+			strings.HasSuffix(path, "/Library/Application Support/mcpproxy/bin/mcpproxy")) {
 		return ChannelDMG
 	}
 

internal/updatecheck/channel_test.go

@@ -18,6 +18,7 @@ func testDetector() *channelDetector {
 		evalSymlinks:   func(p string) (string, error) { return p, nil },
 		statFile:       func(string) error { return os.ErrNotExist },
 		readBuildInfo:  func() (*debug.BuildInfo, bool) { return nil, false },
+		rpmOwnsBinary:  func() bool { return false },
 	}
 }
 
@@ -134,7 +135,7 @@ func TestDetectChannel_DebRequiresBothSignals(t *testing.T) {
 }
 
 func TestDetectChannel_RPMRequiresBothSignals(t *testing.T) {
-	t.Run("path + rpmdb.sqlite -> rpm", func(t *testing.T) {
+	t.Run("path + rpmdb.sqlite + rpm ownership -> rpm", func(t *testing.T) {
 		d := testDetector()
 		d.execPath = func() (string, error) { return "/usr/bin/mcpproxy", nil }
 		d.statFile = func(p string) error {
@@ -143,12 +144,13 @@ func TestDetectChannel_RPMRequiresBothSignals(t *testing.T) {
 			}
 			return os.ErrNotExist
 		}
+		d.rpmOwnsBinary = func() bool { return true }
 		if got := d.detect(); got != ChannelRPM {
 			t.Errorf("detect() = %q, want %q", got, ChannelRPM)
 		}
 	})
 
-	t.Run("path + legacy Packages db -> rpm", func(t *testing.T) {
+	t.Run("path + legacy Packages db + rpm ownership -> rpm", func(t *testing.T) {
 		d := testDetector()
 		d.execPath = func() (string, error) { return "/usr/bin/mcpproxy", nil }
 		d.statFile = func(p string) error {
@@ -157,11 +159,30 @@ func TestDetectChannel_RPMRequiresBothSignals(t *testing.T) {
 			}
 			return os.ErrNotExist
 		}
+		d.rpmOwnsBinary = func() bool { return true }
 		if got := d.detect(); got != ChannelRPM {
 			t.Errorf("detect() = %q, want %q", got, ChannelRPM)
 		}
 	})
 
+	t.Run("rpm db present but package does not own the binary -> unknown", func(t *testing.T) {
+		// Manual tarball copy to /usr/bin/mcpproxy on Fedora: the host RPM
+		// database exists, but `rpm -qf` disowns the file. Suggesting
+		// `dnf upgrade mcpproxy` here would be wrong (FR-009).
+		d := testDetector()
+		d.execPath = func() (string, error) { return "/usr/bin/mcpproxy", nil }
+		d.statFile = func(p string) error {
+			if p == "/var/lib/rpm/rpmdb.sqlite" {
+				return nil
+			}
+			return os.ErrNotExist
+		}
+		d.rpmOwnsBinary = func() bool { return false }
+		if got := d.detect(); got != ChannelUnknown {
+			t.Errorf("detect() = %q, want %q", got, ChannelUnknown)
+		}
+	})
+
 	t.Run("both dpkg and rpm evidence is ambiguous -> unknown", func(t *testing.T) {
 		d := testDetector()
 		d.execPath = func() (string, error) { return "/usr/bin/mcpproxy", nil }
@@ -174,6 +195,7 @@ func TestDetectChannel_RPMRequiresBothSignals(t *testing.T) {
 			}
 			return nil
 		}
+		d.rpmOwnsBinary = func() bool { return true }
 		if got := d.detect(); got != ChannelUnknown {
 			t.Errorf("detect() = %q, want %q", got, ChannelUnknown)
 		}
@@ -190,6 +212,42 @@ func TestDetectChannel_DMG(t *testing.T) {
 		t.Errorf("detect() = %q, want %q", got, ChannelDMG)
 	}
 
+	t.Run("tray-staged core path -> dmg", func(t *testing.T) {
+		// DMG reality: the tray stages the bundled core into Application
+		// Support and runs it from there — that process is the one serving
+		// /api/v1/info, so it must still classify as dmg.
+		d := testDetector()
+		d.goos = "darwin"
+		d.execPath = func() (string, error) {
+			return "/Users/dev/Library/Application Support/mcpproxy/bin/mcpproxy", nil
+		}
+		if got := d.detect(); got != ChannelDMG {
+			t.Errorf("detect() = %q, want %q", got, ChannelDMG)
+		}
+	})
+
+	t.Run("bundled core under Resources/bin -> dmg", func(t *testing.T) {
+		d := testDetector()
+		d.goos = "darwin"
+		d.execPath = func() (string, error) {
+			return "/Applications/MCPProxy.app/Contents/Resources/bin/mcpproxy", nil
+		}
+		if got := d.detect(); got != ChannelDMG {
+			t.Errorf("detect() = %q, want %q", got, ChannelDMG)
+		}
+	})
+
+	t.Run("staged-core path on linux is not dmg", func(t *testing.T) {
+		d := testDetector()
+		d.goos = "linux"
+		d.execPath = func() (string, error) {
+			return "/home/dev/Library/Application Support/mcpproxy/bin/mcpproxy", nil
+		}
+		if got := d.detect(); got != ChannelUnknown {
+			t.Errorf("detect() = %q, want %q", got, ChannelUnknown)
+		}
+	})
+
 	t.Run("app bundle path on linux is not dmg", func(t *testing.T) {
 		d := testDetector()
 		d.goos = "linux"