fix(desktop): serve the update feed from GitHub Pages so shared IPs stop hitting GitHub's 429

[devin-ai-integration]

Primary change type

• Bug fix
• Documentation
• Feature
• Tests
• Dependency update
• Maintenance or refactor

Problem and motivation

Studio users behind one office/VPN NAT see Couldn't check: GitHub is rate-limiting this network and cannot update. electron-updater's github provider makes ~3 unauthenticated requests to github.com's web frontend per check (releases.atom, /releases/latest, then latest*.yml), and GitHub throttles non-browser clients per IP. Several Studios each checking 30s after launch (+ every 4h, + manual clicks) is enough to trip it for everyone on that IP. The existing client-side coalescing (checkInFlight, 60s replay) only bounds one machine; nothing in the app can fix a shared-IP limit.

Summary and scope

Move the update feed off github.com; keep the installers on GitHub Releases.

• electron-builder.yml: publish → provider: generic, url: https://sapiom.github.io/sapiom-js/desktop/, useMultipleRangeRequest: false (release assets are S3-backed and reject multi-range requests — same reason the github provider hardcodes it). One request per check, to a host with no per-IP throttle.
• desktop-release.yml: new step after "Publish GitHub Release" that clones (or creates) the gh-pages branch, copies every latest*.yml/beta*.yml into desktop/ with url:/path: rewritten from bare filenames to absolute https://github.com/sapiom/sapiom-js/releases/download/<tag>/<file>, asserts every url was rewritten, commits and pushes. Incremental by design: a beta release publishes only beta*.yml and leaves latest*.yml untouched (a whole-site Pages deploy would wipe the other channel). Runs with the release job's existing contents: write.
• smoke.ts update-config check: expects generic + an https://…/ feed url instead of github + owner/repo.
• update-policy.ts: classifyUpdateError also maps the generic provider's 404 (Cannot find channel "beta-mac.yml" update info) to no-release; allowPrerelease comment updated (inert under generic, kept for anyone pointing back at GitHub).
• Comments/docs in pack.mjs and CLAUDE.md.

Out of scope: hosting the installers elsewhere (downloads still go through one github.com redirect, but only when an update actually exists), and any change to the channel/mirror logic.

Related work

Related issue or discussion: Slack #studio-syndicate thread (Tidjane's report, 2026-09-04).

Validation

pnpm --filter @sapiom/harness-desktop typecheck — clean
pnpm --filter @sapiom/harness-desktop test — 20 files, 172 tests passed (incl. new classifyUpdateError case)
sed rewrite exercised locally against a sample latest-mac.yml — files[].url and path both become absolute release links; leak check passes

Not run: a packaged build (--smoke) — CI's per-OS smoke jobs cover checkUpdateConfig against the real app-update.yml.

Tests and documentation

• Test: update-policy.test.ts — generic 404 → no-release.
• Docs: CLAUDE.md auto-update section explains the provider choice and the Pages prerequisite.

Compatibility and release impact

• Breaking or externally visible changes: One-time repo setting required before the next tag: Settings → Pages → Source "Deploy from a branch" → gh-pages / / (root) (the branch is created by the first release that runs this step; the setting can be flipped before or after, but until it is on the feed URL 404s and new installs report "no release has been published on this channel yet"). Installs built before this change still read GitHub directly (their baked app-update.yml says github) until they update once — so the rate-limit toast can still appear on those until they land on this release.
• Changeset: Added (@sapiom/harness-desktop patch).

Security

• I have not included secrets, credentials, private data, or unsanitized logs.
• This pull request does not publicly disclose a suspected vulnerability. I
  will follow the
  Security Policy for
  private reporting.

AI assistance

• I did not use AI assistance for this change.
• I used AI assistance and have described it below.

Written by Devin; verified via typecheck, unit tests and a local run of the manifest rewrite.

Checklist

• I read CONTRIBUTING.md, and this contribution follows the direct-PR or issue-first policy.
• This pull request addresses one focused problem and contains no unrelated cleanup.
• I added or updated tests, or explained above why tests are not applicable.
• I ran the relevant build, typecheck, lint, and test commands, or explained
  any N/A checks above.
• I updated documentation for user-facing changes, or marked it N/A above.
• I added a Changeset for a published-package change, or explained why it is not applicable.
• I can explain and maintain every submitted change, including any AI-assisted work.

Link to Devin session: https://app.devin.ai/sessions/2ce6535038e047a183e470b59d094b57
Open in Devin Desktop: https://app.devin.ai/desktop/session/2ce6535038e047a183e470b59d094b57?variant=devin
Requested by: @gwitwer

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring