feat(launcher): refresh the Plugin before launch with installed-version fallback

[ZhangchengCharles]

Parent

#34

What to build

On every explicit desktop launch, make a bounded best-effort attempt to refresh the configured marketplace and install the current cut-as-code Editor Plugin before launching. A successful update starts the newly installed release through the existing Editor Hub compatibility and safe-handoff contract; a timeout or update failure falls back to the newest valid already-installed release without blocking the editor.

Acceptance criteria

• Desktop launch attempts marketplace refresh and Plugin update through supported Codex Plugin commands before resolving the final launch candidate.
• The update attempt has a bounded timeout and does not create a background updater, scheduled task, tray process, or Plugin cache mutation path.
• A successful update selects and launches the newly installed valid Plugin release.
• Network, authentication, unavailable marketplace, timeout, and update-command failures are reported as recoverable warnings when a valid installed release exists.
• After a recoverable update failure, the newest valid already-installed release still opens the localhost project picker.
• An invalid or incomplete newly cached release is ignored in favor of a valid installed release.
• A newer compatible runtime reuses the active Hub, while an incompatible runtime delegates immediate or deferred replacement to the existing Hub handoff and update-pending behavior.
• The launcher does not terminate an active Hub, reproduce handoff logic, discard drafts, or replace a running MCP process in place.
• The update result and final launch result are reported independently and do not expose credentials, launch tokens, environment dumps, project contents, or unnecessary local paths.
• The launcher-level behavioral contract covers successful update, each recoverable failure class, installed-version fallback, active compatible Hub reuse, deferred incompatible handoff, and the normal old-MCP/new-Hub lifecycle.
• Existing packaged Hub handoff and cross-platform workflow checks remain green.

Blocked by

• feat(launcher): open the installed Editor Plugin from the desktop #35 — feat(launcher): open the installed Editor Plugin from the desktop
• feat(plugin): hand off Editor Hub updates safely #31 — feat(plugin): hand off Editor Hub updates safely