[Gabriel Dufresne (GabrielDuf)]

A downloaded UniGetUI update always waits for the user: the Update now banner, the toast button, or quitting the app. A machine left running in the tray therefore never installs its own update.

This adds an opt-in setting, Install UniGetUI updates automatically while it is idle in the background (General → UniGetUI updater, Windows only, off by default).

When it installs

While an update waits for consent, the updater samples every 5 seconds. It installs only after two consecutive samples where:

• the setting is on and "Update UniGetUI automatically" is on,
• the window is hidden in the tray or minimized,
• nothing is running: active or queued operations, maintenance tasks, a backup, or other updater work (the same busy check as Quit after automatic updates),
• there is no unsaved work and the app is not quitting.

Safeguards

• No work is cut off. The idle decision and a new AbstractOperation.HoldNewOperations switch are set in the same UI-thread step, so no operation can start between the decision and the installer closing UniGetUI. The hold is released if the installer comes back without replacing the app. A held operation can still be canceled.
• No retry loop. Each running UniGetUI tries a background install of a given version once; after that the update waits for the user again.
• No unattended UAC prompt. On an all-users install that is not running as administrator, the setting is disabled with an explanation, and the update log says why.
• The app stays in the background after updating. The updater passes a new /LaunchInBackground switch, and the installer then relaunches UniGetUI with --daemon instead of opening the window. Every other update path is unchanged.

Testing

• Unit tests for the idle gate, the installer arguments, and the operation hold (queued, non-queued, cancel). Disabling the hold makes the new hold tests fail.
• An Inno probe built from the new [Run] entries, run silently: no switch → relaunch with no arguments; /LaunchInBackground → relaunch with --daemon only; /NoAutoStart → no relaunch.
• An end-to-end run of a 2026.3.3-versioned Debug build against a local update feed and a probe installer that logs its command line. With the setting off it never installed (30 min). Hidden and idle, it installed after two samples. With the window open it waited, then installed once the window was closed to the tray. With operations running it waited until they ended. This run was on the first commit; the hardening commit is covered by unit tests only.
• Full UniGetUI.PackageEngine.Tests suite, both dotnet format gates.

Not covered: a real installer replacing a real installation.

---

Closes #5636

[Copilot]

🟡 Changes recommended

Critical admission races allow scheduled backups and retried package operations to start after the updater’s idle check and be terminated by the installer’s forced shutdown.

4 open issues

• Gate maintenance and backup admission during installer handoff · New
• Synchronize retry admission with updater hold acquisition · New
• Track attempted versions across channel changes · New
• Keep sampling idle state while background installation is enabled · New

What changed in this PR

Adds opt-in, Windows-only installation of UniGetUI updates while the app is idle in the background, addressing #5636 without requiring user interaction.

Changes:

• Adds a searchable setting in desktop and terminal settings.
• Introduces a two-sample idle gate, operation hold, and elevation and retry safeguards.
• Adds background installer relaunch support and tests for idle checks, arguments, and held operations.

File	Description
UniGetUI.iss	Supports relaunching with --daemon.
src/​UniGetUI.Tui/​Views/​Pages/​SettingsPage.cs	Exposes the Windows-only setting.
src/​UniGetUI.Tests/​IdleSelfUpdateGateTests.cs	Tests consecutive idle samples and blocking conditions.
src/​UniGetUI.Tests/​AutoUpdaterTests.cs	Tests background relaunch arguments.
src/​UniGetUI.PackageEngine.Tests/​PackageOperationsTests.cs	Tests held operations and cancellation.
src/​UniGetUI.PackageEngine.Operations/​AbstractOperation.cs	Adds a switch to hold new operations.
src/​UniGetUI.Core.Settings/​SettingsEngine_Names.cs	Registers the new setting key.
src/​UniGetUI.Avalonia/​Views/​Pages/​SettingsPages/​General.axaml.cs	Controls setting availability and elevation warnings.
src/​UniGetUI.Avalonia/​Views/​Pages/​SettingsPages/​General.axaml	Adds the updater setting card.
src/​UniGetUI.Avalonia/​Infrastructure/​SettingsSearchIndex.cs	Makes the setting searchable.
src/​UniGetUI.Avalonia/​Infrastructure/​QuitAfterAutomaticUpdates.cs	Exposes the existing busy check for reuse.
src/​UniGetUI.Avalonia/​Infrastructure/​IdleSelfUpdateGate.cs	Implements the two-sample idle decision.
src/​UniGetUI.Avalonia/​Infrastructure/​AvaloniaAutoUpdater.cs	Coordinates idle sampling and background installation.
src/​Shared/​AutoUpdater.InstallerArguments.cs	Adds the optional background relaunch switch.
src/​Languages/​lang_en.json	Adds English setting and warning strings.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Unattended updates can terminate active TUI package operations or unexpectedly request elevation, while failed installer attempts leave the prepared update without a working consent-based retry.

2 open issues

• Coordinate installer handoff across desktop and TUI instances · New
• Defer unattended updates when installation scope is unknown · New

1 previously missed issue

In code that hasn't changed since last review

Restore consent waiting when unattended installation fails

src/​UniGetUI.Avalonia/​Infrastructure/​AvaloniaAutoUpdater.cs:880

If the unattended installer fails to launch or exits with an error while UniGetUI survives, LaunchInstallerAsync returns normally and this ends the pending-consent attempt. The toast's Update now action and the quit path only set release flags, so neither can retry the prepared update until another check creates a new attempt. On failure, release the hold and restore consent waiting with background installation disabled for the already-tried version.

4 resolved since last review

• Synchronize retry admission with updater hold acquisition
• Gate maintenance and backup admission during installer handoff
• Keep sampling idle state while background installation is enabled
• Track attempted versions across channel changes

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The elevated updater ignores other users’ active sessions, allowing the installer’s unrestricted taskkill to terminate their package operations or backups without consent.

No open issues 🎉

1 previously missed issue

In code that hasn't changed since last review

Elevated installs can terminate package operations in other sessions

src/​UniGetUI.Avalonia/​Infrastructure/​AvaloniaAutoUpdater.cs:934

When UniGetUI runs elevated, this session filter ignores other users' active instances even though background installation is allowed. The installer's KillRunningApps uses elevated taskkill /f /im without a session filter, so it can terminate another session's package operations or backups without consent. Check all sessions when running elevated, retaining the current-session restriction for non-elevated installs.

2 resolved since last review

• Defer unattended updates when installation scope is unknown
• Coordinate installer handoff across desktop and TUI instances

_{Review effort: Balanced}

[randy-but-a-ro]

🤖 Pull request was approved automatically: the AI review is complete and all its review threads are resolved. 🎉

Integration Details

{
	"deliveryId": "796e0350-d493-11f1-940a-174e6f408b9c",
	"headSha": "9782a1f8e2cad97b907bf8fe72e1590430573474",
	"reviewer": "copilot-pull-request-reviewer[bot]"
}