#205 Prevent built-in updater from shadowing package-managed Linux installs

[Anonymous]

Originally created by: kristofferR

Problem

A package-managed Carrier installation can end up shadowed by an AppImage installed at ~/.local/bin/carrier, likely through the in-app updater. The shadowing AppImage then wins PATH resolution over /usr/bin/carrier.

Observed on Arch Linux with Carrier 1.7.1:

• pacman owned /usr/bin/carrier (about 9.5 MB)
• ~/.local/bin/carrier was an AppImage (about 92.7 MB)
• launching carrier ran the AppImage via /tmp/.mount_* and its bundled WebKit
• that build opened the native window but left Messenger stuck on its skeleton UI
• launching /usr/bin/carrier directly used system WebKit and rendered Messenger immediately

The current guard, pacman_owns_current_executable(), only asks whether pacman owns current_exe(). Once the AppImage shadows the package binary, current_exe() points inside the AppImage mount, so the guard cannot detect that a package-managed Carrier is installed at /usr/bin/carrier.

Expected behavior

A package-manager installation must never be replaced or shadowed by an AppImage from the built-in updater. Update discovery can remain enabled, but installation should route to package-manager instructions.

Linux built-in installation should fail closed: require positive evidence that Carrier is a standalone supported installation (for example, a genuine AppImage runtime) instead of treating “the current executable is not pacman-owned” as sufficient evidence. Detection should also account for a package-owned canonical binary that is currently shadowed on PATH.

Acceptance criteria

• A pacman/AUR installation cannot create or update ~/.local/bin/carrier through Carrier.
• A shadowing AppImage does not hide the presence of a package-owned /usr/bin/carrier.
• Package-managed installs show manual package-manager update instructions and never call install_update.
• Standalone AppImage updates continue to work when positively identified.
• Add focused coverage for the package-owned binary plus shadowing AppImage case.

[Anonymous]

Ticket changed by: kristofferR

• status: open --> closed

[Anonymous]

Originally posted by: kristofferR

Fixed in 11523f2.

Linux built-in update installation now requires a positively identified AppImage runtime. A package-managed or canonical /usr/bin/carrier installation takes precedence over a shadowing AppImage, routes to manual package-manager instructions, and cannot reach install_update.

Focused coverage was added for the shadowing package-install case, standalone AppImage updates, and fail-closed ambiguous Linux installs. The full Rust and TypeScript validation gates pass.