Bugfix: Session 179: Why would the Tauri auto-updater silently fail ...

Documentation for Sessions

🐛 Bugfix: Session 179: Why would the Tauri auto-updater silently fail ...

Date: 2026-03-06
Time: 15:58:02 UTC
Session: gspace1-179.6
Agent: angular
Confidence: 97%
Status: ✅ Documented

📋 Decision Context

Question:

Session 179: Why would the Tauri auto-updater silently fail to download updates from a private GitHub repo?

Task: Fix auto-updater for private GitHub repo

🎯 Decision Made

Chosen:

Cloudflare Worker now parses latest.json, recursively rewrites all GitHub download URLs to route through its own /download/:filename proxy endpoint, and returns the rewritten JSON. Added proxyLatestJson() function separate from the generic proxyGitHubAsset().

Options Considered:

  1. Make the GitHub repo public (security risk)
  2. Embed GitHub PAT in the Tauri binary (leaks secret)
  3. Rewrite URLs in Cloudflare Worker (chosen)
  4. Use a different update hosting service

💭 Reasoning

Root cause: tauri-action's includeUpdaterJson generates latest.json with direct GitHub release asset URLs (https://github.com/GoGrabSpace/editor/releases/download/...). The GoGrabSpace/editor repo is PRIVATE. Tauri's built-in updater makes unauthenticated GET requests to these URLs → GitHub returns 404. The Cloudflare Worker was already proxying /latest.json and /download/:filename with server-side GitHub PAT auth, but it was serving latest.json AS-IS without rewriting the internal URLs. The fix: parse the JSON, walk all 'url' fields recursively (Tauri's latest.json has nested platform objects), and rewrite github.com URLs to vitto-updater.gograb.space/download/filename. The rewriteUrls() function handles nested objects and arrays. Early warning: if Tauri changes its latest.json schema or adds new URL fields, the rewriter needs updating. The X-Urls-Rewritten response header makes this debuggable.

📁 Files Involved

🔗 Related

Auto-generated by MCP Smart Consolidation