Add safe source control tool updates

[badcuban]

Summary

• add compact Git and GitHub CLI version advisories in Source Control settings
• add explicit one-click Windows updates through allowlisted WinGet package IDs, with hidden console execution and post-update verification
• make Windows CLI discovery handle common Git locations and App Execution Aliases
• refresh source-control discovery after desktop backend reconnects so stale ?missing? states cannot persist
• suppress gh telemetry/update-notifier only for Threadlines-owned subprocesses

Why

Older GitHub CLI releases can briefly flash terminal windows on Windows, and the dev desktop could intermittently show Git as unavailable because of GUI PATH/alias handling and stale renderer discovery state.

Safety

• updates run only after an explicit click
• client sends a typed target, never a shell command
• server maps targets to fixed WinGet IDs (GitHub.cli, Git.Git)
• Git and gh updates share one in-process WinGet lock
• installed versions are rediscovered after WinGet exits
• manual commands and official release links remain available
• no updater was executed while developing or testing this change

Validation

• vp fmt
• vp lint
• vp run typecheck
• vp run '@threadlines/web#test:browser' SettingsPanels.browser (40 passed)
• focused source-control, shell, desktop environment, RPC, and client-state tests

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
threadlines	Skipped		Aug 14, 2026 7:30am