[Juliusolsson05]

Refs #1250 (row 10). #1250 is a batch issue, so the other rows stay open.

Problem

A failed CLI auto-update shows View Log. cli-updates:open-log discarded shell.openPath's answer, which RESOLVES with an error string when it cannot open the file (for example, a log removed by hand; nothing prunes this directory automatically). Its comment said the OS would show its own dialog. It does not, so the click did nothing visible.

Change

• cli-updates:open-log returns boolean: true only for ''. An error string, or a throw, is false and is warned to the console (diagnostic only).
• It takes the CLI kind, not a path (review a): main opens only that CLI's current failed state's log, which it wrote itself. A renderer-supplied path used to reach shell.openPath, which opens applications too.
• Preload: cliUpdatesOpenLog(cli): Promise<boolean>.
• Banner: an action may answer whether it worked. On false, BannerRow shows the action's failureText in a role="alert" line on that row: "Couldn't open the update log. It may have been cleaned up; the next failed update writes a new one." Fixed words (q22). A later click clears it, only the latest click sets it, and a new failure's log clears it.

Plan: docs/plans/2026-09-27-cli-update-log-open-failure.md.

Tests (red on main)

• New src/main/ipc/cliUpdates.test.ts (the real handler; ipcMain captured, shell.openPath stubbed): '' answers true and opens main's own log path; an error string or a throw answers false; a path, an unknown CLI, or a non-failed state opens nothing.
• CliUpdateBanner.renderer.test.tsx: View Log answered false shows the sentence; answered true shows none; a later click clears it; a stale answer loses to the latest; a rejected request is said the same way; a new log clears the alert. The main test also asserts the diagnostic warn.

Verification

• rm -rf .tsc-out; npx tsc -b: clean.
• NODE_ENV=test npx vitest run src/main/ipc/cliUpdates.test.ts src/renderer/src/features/cli-updates src/main/setup: 18/18 at round 0; the cli-updates suites are 13/13 after review.
• Follow-up split from review: bug(cli-updates): Update Now that cannot start leaves an undismissable 'Updating' row #1425 (Update Now that cannot start leaves an undismissable row).
• Review round 1: the disposition is in the PR comments.
• The app was not launched.

🤖 Generated with Claude Code

[Juliusolsson05]

Review disposition, reviewer a (head 9dc492d0)

Verdict: a FIX-BEFORE-MERGE. Reviewers b and c are starting on this head.

Finding	Disposition
a1 (Major): the renderer could make main open ANY path (shell.openPath also opens applications); pre-existing, but in the touched handler	Fixed. cli-updates:open-log takes the CLI kind, and main opens only that CLI's current failed state's log, which it wrote itself. Test: a path, an unknown CLI, or a non-failed state opens nothing, and openPath is never called. It fails on the previous head.
a2: an older, slower answer could re-show the alert after a newer successful click	Fixed: only the latest click sets the result. The test fails on the previous head.
a3: the alert survived a new failed run with a new log	Fixed: the result is keyed to the log path. The test fails on the previous head.
a4: "the debug-retention prune removes these logs" was false	Fixed in the plan and the comment: nothing prunes this directory automatically.

Verification:

• npx tsc -b: clean.
• src/main/ipc/cliUpdates.test.ts and features/cli-updates: 12/12.

🤖 Generated with Claude Code

[Juliusolsson05]

Review disposition: verification a, round 1 b and c (head c8722f08)

Verdicts: verify a FIX-BEFORE-MERGE (a minor comment), b FIX-BEFORE-MERGE, c MERGE-READY with minors.

Finding	Disposition
a, c1: the new test comments repeated the false retention claim	Fixed: both test comments now say nothing prunes this directory automatically.
c2, c5: "a later click clears it" was untested, and the stale-answer test was vacuous on main	Fixed: one test shows the alert first, then a later click clears it at once, then a stale false loses to the newer true. The "no clear" mutation now fails.
c3: no test for a rejected request	Fixed: a rejecting IPC shows the fixed sentence and no raw text. The "no catch" mutation now fails.
c4: the diagnostic warn was untested	Fixed: asserted for both the error-string and the throw paths.
b1: Update Now that cannot start leaves an undismissable "Updating" row (pre-existing)	Split into #1425. It needs a failed shape without a log, which touches @shared/types/cliUpdate, the orchestrator and the banner, beyond View Log.
b2: the behaviour setting ignored a write failure	Already fixed by #1403 (rows 6 and 13: setCliUpdateBehavior returns its promise, and the row catches and alerts).

Verification: src/main/ipc/cliUpdates.test.ts and features/cli-updates: 13/13. tsc is unchanged: this commit touches only tests and the plan.

Round count: round 1 and verification are done, so the review is capped. The PR waits for CI and the manager.

🤖 Generated with Claude Code