fix: stop desktop startup update loop — manifest version matches bundles

Do not inflate latest.json from dmg filenames; use build version only.
Add client loop guard when the same update retries without version bump.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/generate-desktop-latest-json.mjs

@@ -60,17 +60,19 @@ function addPlatform(platformKey, bundleName) {
     return;
   }
   const bundleVersion = versionFromName(bundleName);
+  const effectiveVersion = bundleVersion === '0.0.0' ? version : bundleVersion;
   const existing = platforms[platformKey];
-  if (existing && cmpSemver(bundleVersion, existing.bundleVersion) <= 0) return;
+  if (existing && cmpSemver(effectiveVersion, existing.bundleVersion) <= 0) return;
   platforms[platformKey] = {
     url: `${baseUrl}/${encodeURIComponent(bundleName)}`,
     signature,
-    bundleVersion,
+    bundleVersion: effectiveVersion,
   };
 }
 
 for (const f of files) {
   if (f.endsWith('.sig')) continue;
+  if (f.endsWith('.dmg')) continue; // 설치용 dmg — updater manifest 대상 아님
   const lower = f.toLowerCase();
   if (lower.includes('aarch64') && (lower.endsWith('.tar.gz') || lower.endsWith('.app.tar.gz'))) {
     addPlatform('darwin-aarch64', f);
@@ -91,7 +93,12 @@ const bundleMaxVersion = Object.values(platforms).reduce(
   (max, p) => (cmpSemver(p.bundleVersion, max) > 0 ? p.bundleVersion : max),
   '0.0.0',
 );
-const manifestVersion = cmpSemver(bundleMaxVersion, version) > 0 ? bundleMaxVersion : version;
+// manifest 버전 = 빌드 버전(--version). 번들 파일명에 버전 없으면 CLI 버전 사용.
+// dmg 파일명으로 올리지 않음 — tar.gz 내용과 불일치하면 업데이트 무한 루프.
+let manifestVersion = version;
+if (bundleMaxVersion !== '0.0.0' && cmpSemver(bundleMaxVersion, version) < 0) {
+  console.warn(`[warn] bundle version ${bundleMaxVersion} < build ${version} — using build version`);
+}
 
 const manifest = {
   version: manifestVersion,