feat(desktop): move NSIS installs to Velopack on the next update

[h4yfans]

Summary

A Windows user on an NSIS install currently stays on the update path that fails on roughly 8.5% of installs per 60 days. This moves them to the Velopack install automatically, on the next update they take, with no prompt and no manual reinstall.

An NSIS install keeps electron-updater for checking and downloading. The install step is what changes. Once electron-updater has the NSIS setup.exe on disk, installer-handoff.ts looks for MemryNote-win-Setup.exe on the same release tag, streams it into userData/installer-handoff/, and verifies it before anything is executed. onDownloaded is deferred until that settles, so "Restart to install" never appears before everything the hand-off needs exists.

Verification rule. Get-AuthenticodeSignature -LiteralPath <file> | ConvertTo-Json -Compress, parsed by judgeAuthenticode. Status must be Valid (serialized as 0 or the enum name) and SignerCertificate.Subject must contain CN=Open Source Developer Kaan Karaca. Anything else deletes the file and declines. An unverified binary is never spawned, on either the updater path or the CLI path.

The hand-off script. Pinned by installer-handoff-script.test.ts, rendered with CRLF, spawned detached through cmd.exe /c:

@echo off
setlocal
rem MemryNote installer hand-off: wait for the app to exit, remove the NSIS install, install the Velopack build.
set "APP_PID=1234"
set "APP_EXE=Memrynote.exe"
set "INSTALL_DIR=C:\Users\kaan\AppData\Local\Programs\MemryNote"
set "UNINSTALLER=C:\Users\kaan\AppData\Local\Programs\MemryNote\Uninstall MemryNote.exe"
set "WORK_DIR=C:\Users\kaan\AppData\Local\Temp\memry-installer-handoff-1234"
set "SETUP=C:\Users\kaan\AppData\Roaming\memrynote\installer-handoff\MemryNote-win-Setup.exe"
set "SETUP_LOG=C:\Users\kaan\AppData\Roaming\memrynote\logs\velopack-setup.log"
set "NSIS_INSTALLER=C:\Users\kaan\AppData\Local\memrynote-updater\pending\MemryNote-2026.911.1-setup.exe"
set "VELOPACK_EXE=%LocalAppData%\MemryNote\current\Memrynote.exe"

:wait_for_exit
tasklist /FI "PID eq %APP_PID%" /FI "IMAGENAME eq %APP_EXE%" /NH 2>nul | find /I "%APP_EXE%" >nul
if not errorlevel 1 (
  ping -n 2 127.0.0.1 >nul
  goto wait_for_exit
)

if not exist "%WORK_DIR%" mkdir "%WORK_DIR%"
copy /y "%UNINSTALLER%" "%WORK_DIR%\Uninstall MemryNote.exe" >nul
start "" /wait "%WORK_DIR%\Uninstall MemryNote.exe" /S _?=%INSTALL_DIR%

start "" /wait "%SETUP%" --silent --verbose --log "%SETUP_LOG%"

if not exist "%VELOPACK_EXE%" (
  if exist "%NSIS_INSTALLER%" start "" /wait "%NSIS_INSTALLER%" /S --force-run
)

del /q "%SETUP%" >nul 2>&1
rmdir /s /q "%WORK_DIR%" >nul 2>&1
(goto) 2>nul & del "%~f0"

Order matters in four places. It waits for our own PID and image name, so a recycled PID cannot match. ping is the sleep because timeout /t aborts with "Input redirection is not supported" under stdio: 'ignore'. The uninstaller runs from a copy with _?= last and unquoted, so it blocks and RMDir /r $INSTDIR can remove the original, and without --updated, so the tolerant full-removal path runs and the Start-menu shortcut at the path Velopack is about to reuse is gone first. Setup.exe runs only after that, and launches the app itself.

Fallbacks. Every refusal lands on the plain NSIS install, which is exactly today's behavior.

What fails	What the user sees
The release carries no MemryNote-win-Setup.exe (HEAD 404)	Nothing. Info log only, no error event. The NSIS update installs as usual.
HEAD or the download fails	Nothing new. INSTALLER_HANDOFF_DOWNLOAD_FAILED through the existing updater error path, then the NSIS update installs as usual.
The signature does not verify	Same. INSTALLER_HANDOFF_UNVERIFIED, the downloaded file is deleted, the NSIS update installs as usual.
The script cannot be spawned	launch() returns false, so autoInstallOnAppQuit is left on and electron-updater installs the NSIS update from its own quit hook.
Setup.exe runs but leaves no app	The script reinstalls from the NSIS installer electron-updater already downloaded. The user is never left without an app.
Windows itself is shutting down	No install at all, hand-off included, which is the existing session-end guard. It applies on the next user-initiated quit.

Next launch. The marker now carries installer (electron-updater, velopack, velopack-handoff; older markers lack the field). resolveUpdateInstallOutcome reads it against the running version and the install layout. Same version is the existing UPDATE_INSTALL_DID_NOT_APPLY, now with source: velopack-handoff. A new version from the Velopack layout is app_update_installed with action: migrated. A new version still on the NSIS layout is INSTALLER_HANDOFF_DID_NOT_APPLY, meaning the update arrived but the migration did not. The silent install-on-quit path writes the marker too, which it never did before, so a Windows update that applies on a normal quit is no longer invisible.

Memrynote.exe --cli migrate-installer <path-to-MemryNote-win-Setup.exe> drives the same verify-then-hand-off path against a local file. Windows only, exit 0 only once the script is spawned.

Stacked on #2164.

Release note

none

Test plan

Run from the worktree on Node 24 (.nvmrc), unless noted.

• pnpm --filter @memry/desktop typecheck:node — pass.
• pnpm --filter @memry/desktop typecheck:test — pass. No test file was added to the tsconfig.test.*.json exclude backlog.
• pnpm --filter @memry/desktop exec vitest run --config config/vitest.config.ts --project main src/main/installer-handoff.test.ts src/main/installer-handoff-script.test.ts src/main/updater-nsis-handoff.test.ts src/main/cli/migrate-installer.test.ts src/main/telemetry/update-install-marker.test.ts src/main/cli/headless.test.ts src/main/updater.test.ts src/main/updater-velopack.test.ts — 134 pass.
• pnpm --filter @memry/desktop test:main — 8263 pass, 3 fail. The three are apps/desktop/scripts/check-cert-hashes-config.test.ts, which passes on Node 24 and only fails when the suite runs on the Node 26 the native modules happen to be built for here. Unrelated to this diff.
• pnpm lint — 0 errors. The one warning is pre-existing in vault-switcher.tsx.
• pnpm check:architecture, pnpm check:contracts — pass.
• pnpm ipc:check — pass on Node 24. No contract changed. On Node 26 it dies on --experimental-transform-types, which that version removed.
• pnpm docs:impact --base origin/feat/velopack-windows-updater --strict — pass, docs changed on this branch.
• pnpm docs:build, git diff --check — pass.

What none of that covers: the batch script, the _?= uninstaller behavior and the Get-AuthenticodeSignature | ConvertTo-Json shape only ever run on Windows, so every test here asserts the rendered text and the parse rules rather than the effect. The migrate job in .github/workflows/velopack-smoke.yml is what proves them, and it needs a published release carrying MemryNote-win-Setup.exe before it can run. It installs the published NSIS build, hands off, then asserts the NSIS directory, its uninstall key and its shortcut are gone, the Velopack install is signed and present, the Start menu entry is back and Memrynote.exe is running from the new install. Its run_cli_migration input stays off until a published NSIS build contains migrate-installer. The hand-off is also unverified end to end against a real update until that release exists.

[github-actions]

React Doctor found no new issues. 🎉

_{Reviewed by React Doctor for commit 11e48fc.}

[codecov]

Codecov Report

❌ Patch coverage is 95.60000% with 11 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
apps/desktop/src/main/installer-handoff.ts	95.00%	6 Missing ⚠️
apps/desktop/src/main/cli/migrate-installer.ts	93.75%	2 Missing ⚠️
apps/desktop/src/main/cli/headless.ts	85.71%	1 Missing ⚠️
apps/desktop/src/main/installer-handoff-script.ts	96.87%	1 Missing ⚠️
...esktop/src/main/telemetry/update-install-marker.ts	96.42%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!