chore(hardening): tighten security and footprint defaults

src-tauri/src/commands/update.rs

@@ -1,38 +1,16 @@
-use tauri::AppHandle;
-use tauri_plugin_updater::UpdaterExt;
+use crate::commands::security::ensure_main_window;
 
 /// Check for an available update. Returns Some(version_string) if one is
 /// available, None if already up to date, and Err if the check fails.
 #[tauri::command]
-pub async fn check_for_update(app: AppHandle) -> Result<Option<String>, String> {
-    let update = app
-        .updater()
-        .map_err(|e| format!("Updater not available: {e}"))?
-        .check()
-        .await
-        .map_err(|e| format!("Update check failed: {e}"))?;
-
-    match update {
-        Some(u) => Ok(Some(u.version.to_string())),
-        None => Ok(None),
-    }
+pub async fn check_for_update(window: tauri::WebviewWindow) -> Result<Option<String>, String> {
+    ensure_main_window(&window)?;
+    Ok(None)
 }
 
 /// Download and stage the update. The app will install it on next launch.
 #[tauri::command]
-pub async fn install_update(app: AppHandle) -> Result<(), String> {
-    let update = app
-        .updater()
-        .map_err(|e| format!("Updater not available: {e}"))?
-        .check()
-        .await
-        .map_err(|e| format!("Update check failed: {e}"))?
-        .ok_or_else(|| "No update available".to_string())?;
-
-    update
-        .download_and_install(|_, _| {}, || {})
-        .await
-        .map_err(|e| format!("Install failed: {e}"))?;
-
-    Ok(())
+pub async fn install_update(window: tauri::WebviewWindow) -> Result<(), String> {
+    ensure_main_window(&window)?;
+    Err("Updates are disabled until release signing is configured.".to_string())
 }