[Bug][desktop] macOS nightly update feed is missing on the test deployment — dsh-desk/feeds/mac-arm64/nightly-mac.yml returns COS NoSuchKey

[overFloweee]

Summary

An installed macOS Desktop nightly (0.1.6-alpha.1.20260916.2, bundle id com.deepseek.dsh) is packaged with the internal-test dotenv
(DSH_DESKTOP_AUTO_UPDATE_ENV=test, DOWNLOAD_TEST_ORIGIN=https://download-test.deepseek.com), so Check for Updates requests

https://download-test.deepseek.com/dsh-desk/feeds/mac-arm64/nightly-mac.yml

That object does not exist on either deployment origin, so every update check fails with
Could not check for updates. Please try again later. / technical detail Cannot find channel "nightly-mac.yml" + HttpError: 404.

The client side is correct and matches the repository's own contract; the publication for this target is missing.

Environment

Item	Value
OS	macOS 26.5.2 (25F84), Mac17,2 (Apple M5)
App bundle	/Applications/DeepSeek Harness.app
CFBundleShortVersionString / CFBundleVersion	0.1.6-alpha.1.20260916.2
CFBundleIdentifier	com.deepseek.dsh
Signature	Developer ID Application: Hangzhou DeepSeek Artificial Intelligence Co., Ltd (NAN929V4UM), timestamped 2026-09-16 17:34:30
Updater	electron-updater 6.8.9 (bundled in app.asar; matches apps/desktop/package.json ^6.8.9), generic provider, channel nightly
Contents/Resources/app-update.yml	provider: generic / url: https://download-test.deepseek.com/dsh-desk/feeds/mac-arm64/ / channel: nightly / updaterCacheDirName: '@deepseek-aidsh-desktop-updater'

lib/main.js in the packaged app.asar hard-codes the channel as well (this.updater.channel = "nightly", allowPrerelease = true), so the requested metadata filename is nightly-mac.yml by design — the same value desktopUpdateMetadataFilename() produces.

The updater cache directory ~/Library/Caches/@deepseek-aidsh-desktop-updater does not exist on this machine. electron-updater creates it when it downloads an update, so its absence means no update was ever downloaded here — consistent with the feed never having been reachable.

Reproduction

# 1. Exactly the URL the packaged client requests (noCache is electron-updater's cache buster)
curl -sS -D - -o /dev/null \
  "https://download-test.deepseek.com/dsh-desk/feeds/mac-arm64/nightly-mac.yml?noCache=1k30rgi3g"

# 2. In the app: update indicator → "Check for Updates"

Current behavior

HTTP/2 404
content-type: text/html
x-cos-error-code: NoSuchKey
x-cos-error-detail-key: dsh-desk/feeds/mac-arm64/nightly-mac.yml
x-cos-error-message: The specified key does not exist.
x-cos-request-id: NmFiMDk1OWFfNTVhOTY0MDlfMTFiM2NfMWJhOWQzNWY=

The same NoSuchKey is returned by the production origin. Full probe matrix (anonymous curl, HTTP status):

Object	download-test.deepseek.com	download.deepseek.com
dsh-desk/feeds/mac-arm64/nightly-mac.yml	404	404
dsh-desk/feeds/mac-arm64/latest-mac.yml	404	404
dsh-desk/feeds/mac-x64/nightly-mac.yml	404	404
dsh-desk/feeds/win-x64/nightly.yml	404	404
dsh-desk/feeds/win-x64/latest.yml	404	404
dsh-desk/bin/mac-arm64/deepseek-harness-0.1.6-alpha.1.20260916.1-mac-arm64.{dmg,zip,zip.blockmap}	404	404
dsh-desk/bin/mac-arm64/deepseek-harness-0.1.6-alpha.1.20260916.2-mac-arm64.{dmg,zip,zip.blockmap}	404	404
dsh-desk/bin/win-x64/deepseek-harness-0.1.6-alpha.1.20260916.2-win-x64.exe	404	404

Bucket identity checks (to rule out "wrong region / wrong bucket"):

# ap-beijing is the bucket's region: anonymous direct access is denied at bucket level…
curl -s https://bj-toc-download-test-1320056602.cos.ap-beijing.myqcloud.com/dsh-desk/feeds/mac-arm64/nightly-mac.yml   # 403 AccessDenied
# …and the other regions do not host it
curl -s https://bj-toc-download-test-1320056602.cos.ap-shanghai.myqcloud.com/dsh-desk/feeds/mac-arm64/nightly-mac.yml  # 404 NoSuchBucket
curl -s https://bj-toc-download-test-1320056602.cos.ap-guangzhou.myqcloud.com/dsh-desk/feeds/mac-arm64/nightly-mac.yml # 404 NoSuchBucket

desktop-cos.ts pins DESKTOP_COS_REGION = 'ap-beijing', and installed-update-cos.ts fixes the pair ORIGIN = 'https://download-test.deepseek.com' / BUCKET = 'bj-toc-download-test-1320056602', which matches the README deployment table. The CDN error is authoritative for absence — the repo says so itself:

/** COS reports a missing key through this error code; no other status means absence. */
function isMissingObject(error: unknown): boolean {
  return typeof error === 'object' && error !== null && 'code' in error && error.code === 'NoSuchKey'
}

So this is not an authentication, proxy, DLP or token problem: the origin answered NoSuchKey, not AccessDenied.

Expected behavior

Per apps/desktop/README.md:

Feed directories are dsh-desk/feeds/<target>/; versioned packages and blockmaps live in dsh-desk/bin/<target>/. Targets are mac-arm64, mac-x64, and win-x64.
Every release publishes nightly.yml or nightly-mac.yml; stable releases also publish latest.yml or latest-mac.yml pointing at the same artifacts.

An installed test-deployment client must therefore be able to fetch dsh-desk/feeds/mac-arm64/nightly-mac.yml from https://download-test.deepseek.com. Nothing in the client needs to change.

Root-cause analysis

1. Packaging and upload are separate, operator-driven steps. package:desktop:mac:arm64 writes app-update.yml with the selected origin but uploads nothing; upload:mac:arm64 is a second command that requires COS credentials. No workflow performs either: grep -il desktop .github/workflows/*.yml matches none of the 20 workflows in this repository. So a nightly build can be produced and distributed to users while its feed is never published.
2. A successful upload and public availability are not the same check. The uploader records its own result but explicitly does not read the feed back through the public origin: "Public CDN readback remains separate release qualification, explicitly marked not-performed in the upload result." Combined with (1), a skipped or failed upload:* leaves packaged clients pointing at a feed that does not exist, and nothing fails loudly.
3. The release-version rule requires published objects to be checked, and they are not there. README.md → Release versions: "For each base and date, start the index at 1 and increment after checking retained release records and published objects; never reuse a published version." The installed build carries index .2 (0.1.6-alpha.1.20260916.2), yet neither .20260916.1 nor .20260916.2 payloads, nor any channel metadata, are publicly retrievable for mac-arm64. Either the publication step never ran for this target, or it wrote to a location the public origin does not serve.
4. The only end-to-end installed-update lane cannot catch this. installed-update-qualification.ts allocates its own private namespace and pins it to Windows: feedKey: dsh-desk/feeds/qualification/<id>/win-x64/nightly.yml, binPrefix: dsh-desk/bin/qualification/<id>/win-x64, with keyAllowed() rejecting every other key. macOS has no equivalent lane, and test:updates:local runs against a loopback server, so a missing mac feed is invisible to the current qualification suite.

Open questions for the release owner

1. Was upload:mac:arm64 ever executed for the test deployment for the 0.1.6-alpha.1.20260916.{1,2} nightlies? The retained .desktop-build/upload-records/test-mac-arm64-* record should settle this (result.json present = completion).
2. Does EdgeOne host download-test.deepseek.com actually map to bucket bj-toc-download-test-1320056602 (ap-beijing)? Observed side fact: https://download-test.deepseek.com/ and https://download.deepseek.com/ return byte-identical content (sha256 prefix 11882015de84285f…); if both origins resolve to the same bucket, the test/production feed separation assumed by DSH_DESKTOP_AUTO_UPDATE_ENV does not hold and test uploads could clobber production metadata.
3. Is the desktop nightly produced by a pipeline outside this repository (no in-repo workflow packages or uploads Desktop), and does that pipeline call upload:* at all?

Suggested fix and acceptance criteria

• Unblock the affected installs: run pnpm run upload:mac:arm64 for the test deployment with the 0.1.6-alpha.1.20260916.x artifacts (re-run pnpm run package:desktop:mac:arm64 first only if the build output and completion record are gone).
• Close the detection gap: after upload, read the channel file back anonymously through the configured origin and fail the release when it is not 200 — the uploader already has an explicit place for that result (not-performed), so this is turning a documented manual step into an enforced one.
• Consider extending the installed-update qualification lane to mac-arm64 (currently Windows-only), since that is the only lane that exercises the real deployment origin.
• Acceptance: curl -sI https://download-test.deepseek.com/dsh-desk/feeds/mac-arm64/nightly-mac.yml returns 200; on the installed 0.1.6-alpha.1.20260916.2 build, Check for Updates reports an available version (or "up to date") instead of Could not check for updates.

Additional observation (local, unrelated to the feed)

The affected installation has a broken code seal, so it should be reinstalled cleanly before verifying any fix:

$ codesign --verify --verbose=4 "/Applications/DeepSeek Harness.app"
a sealed resource is missing or invalid
file added:    Contents/Resources/runtime/bin/node.orig-20260919
file modified: Contents/Resources/runtime/bin/node

Someone replaced the bundled runtime/bin/node on 2026-09-19 and left a backup beside it, which invalidates the signature. This does not cause the 404 above, but a modified bundle must not be used as evidence when testing an update flow.

Evidence collected

• Contents/Resources/app-update.yml of the installed nightly (quoted above).
• Raw response headers for the exact failing request (quoted above) and for the production origin.
• The probe matrix above (10 representative objects) plus roughly 40 further dsh-desk/* paths — all three targets, both dated index builds, and both origins, including dsh-desk/feeds/<target>/ directory requests — every one returned 404 with x-cos-error-code: NoSuchKey.
• Direct COS probes at ap-beijing / ap-shanghai / ap-guangzhou to confirm the bucket and its region.
• codesign --verify output for the local bundle.

[overFloweee]

补充一条证据链（2026-09-22 实测）：这条 feed 缺失不是孤例——公开渠道目前没有任何桌面产物：

• GitHub Releases 全部 15 个版本的 assets=0，从未挂过 dmg/zip/exe
• 没有 desktop-v* tag；20 个 workflow 里没有一个打包/上传桌面
• 官方落地页（中/英）与文档 quickstart 都没有桌面下载入口

另外路径口径已经变了：0.1.7 起 test 发布放在 dsh-desk/<release-id>/feeds/<target>/（DOWNLOAD_TEST_RELEASE_ID，32 位 hex），而 0.1.6 客户端里写死的是旧路径 dsh-desk/feeds/mac-arm64/ —— 即使官方重新发布测试版桌面包，已安装的老客户端也不会自动看到，需要手动重装。

已把"桌面包整体缺失 + 希望公开下载入口"整理成需求帖：#7446。