feat: Add automatic update system with hash verification

Implement comprehensive automatic update checking and installation system
for installed Meteor addons. The system verifies updates using SHA-256
hashes from GitHub releases to ensure integrity.

Features:
- Background update checker that runs on startup after addon metadata loads
- SHA-256 hash verification for all downloads via GitHub API
- Progress tracking with visual progress bar widget
- Batch update installation with backup/rollback capability
- Manual update check from addon detail screen
- Changelog viewer for release notes
- Update notification screen showing all available updates

New Systems:
- UpdateChecker: Scans installed addons against GitHub releases
- UpdateDownloadManager: Handles async downloads with progress callbacks
- UpdateInstaller: Manages safe installation with backup recovery

Architecture:
- Callback-based flow: AddonManager → UpdateChecker → UpdatesAvailableScreen
- Background thread downloads with render thread GUI updates
- Hash verification before and after download
- Graceful fallback if GitHub API unavailable or hash missing

Technical Details:
- Uses GitHub Release API to fetch latest versions and assets
- Computes local JAR hashes and compares with remote checksums
- Downloads only if hashes differ (version-agnostic detection)
- Atomic file operations with .bak backup before replacement
- Progress tracking via byte stream monitoring

Author: GhostTypes

.claude/settings.local.json

@@ -9,7 +9,8 @@
       "mcp__gradle-mcp-server__gradle_build",
       "WebFetch(domain:maven.fabricmc.net)",
       "mcp__code-search-mcp__search_text",
-      "Bash(grep:*)"
+      "Bash(grep:*)",
+      "WebFetch(domain:github.blog)"
     ],
     "deny": [],
     "ask": []

src/main/java/com/cope/meteoraddons/MeteorAddonsAddon.java

@@ -1,15 +1,20 @@
 package com.cope.meteoraddons;
 
+import com.cope.meteoraddons.gui.screens.UpdatesAvailableScreen;
 import com.cope.meteoraddons.gui.tabs.AddonsTab;
 import com.cope.meteoraddons.systems.AddonManager;
 import com.cope.meteoraddons.systems.IconPreloadSystem;
+import com.cope.meteoraddons.systems.UpdateChecker;
 import meteordevelopment.meteorclient.addons.GithubRepo;
 import meteordevelopment.meteorclient.addons.MeteorAddon;
+import meteordevelopment.meteorclient.gui.GuiThemes;
 import meteordevelopment.meteorclient.gui.tabs.Tabs;
 import meteordevelopment.meteorclient.systems.Systems;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import static meteordevelopment.meteorclient.MeteorClient.mc;
+
 /**
  * Entry point for Meteor Addons addon.
  * Enables browsing, installing, and updating Meteor Client addons from within the client.
@@ -25,14 +30,33 @@ public void onInitialize() {
         Systems.add(iconPreloadSystem);
         LOG.info("IconPreloadSystem registered");
 
-        Systems.add(new AddonManager());
+        // Initialize UpdateChecker
+        UpdateChecker updateChecker = new UpdateChecker();
+        Systems.add(updateChecker);
+        LOG.info("UpdateChecker system registered");
+
+        // Set up update notification callback
+        updateChecker.setOnUpdatesFound(updates -> {
+            LOG.info("Found {} addon updates available", updates.size());
+            // Show the updates screen on the next tick (ensures we're on render thread)
+            mc.execute(() -> {
+                mc.setScreen(new UpdatesAvailableScreen(GuiThemes.get(), updates));
+            });
+        });
+
+        // Set up AddonManager with callback to trigger update check
+        AddonManager addonManager = new AddonManager();
+        addonManager.setOnLoadComplete(() -> {
+            LOG.info("Addon metadata loaded, starting update check...");
+            updateChecker.checkForUpdates();
+        });
+
+        Systems.add(addonManager);
         LOG.info("AddonManager system initialized");
 
         Tabs.add(new AddonsTab());
         LOG.info("Addons tab registered");
 
-
-
         LOG.info("Meteor Addons Addon initialized successfully");
     }
 

src/main/java/com/cope/meteoraddons/gui/screens/AddonDetailScreen.java

@@ -1,12 +1,18 @@
 package com.cope.meteoraddons.gui.screens;
 
+import com.cope.meteoraddons.MeteorAddonsAddon;
 import com.cope.meteoraddons.addons.Addon;
+import com.cope.meteoraddons.addons.InstalledAddon;
 import com.cope.meteoraddons.addons.OnlineAddon;
 import com.cope.meteoraddons.config.IconSizeConfig;
 import com.cope.meteoraddons.models.AddonMetadata;
+import com.cope.meteoraddons.models.UpdateInfo;
 import com.cope.meteoraddons.systems.AddonManager;
+import com.cope.meteoraddons.util.GitHubReleaseAPI;
+import com.cope.meteoraddons.util.HashUtil;
 import com.cope.meteoraddons.util.IconCache;
 import meteordevelopment.meteorclient.gui.GuiTheme;
+import meteordevelopment.meteorclient.gui.GuiThemes;
 import meteordevelopment.meteorclient.gui.WindowScreen;
 import meteordevelopment.meteorclient.gui.widgets.containers.WHorizontalList;
 import meteordevelopment.meteorclient.gui.widgets.containers.WSection;
@@ -19,7 +25,10 @@
 
 import com.cope.meteoraddons.util.TimeUtil;
 
+import java.nio.file.Path;
+import java.util.Collections;
 import java.util.List;
+import java.util.Optional;
 
 import static meteordevelopment.meteorclient.MeteorClient.mc;
 import static meteordevelopment.meteorclient.utils.Utils.getWindowWidth;
@@ -115,7 +124,7 @@ public void initWidgets() {
         // Actions (Buttons)
         WHorizontalList actions = add(theme.horizontalList()).right().widget();
 
-        // Download/Install Button
+        // Download/Install Button (for non-installed addons)
         if (!addon.isInstalled() && addon instanceof OnlineAddon) {
             WButton downloadButton = actions.add(theme.button("Download")).widget();
             downloadButton.action = () -> {
@@ -133,6 +142,26 @@ public void initWidgets() {
             };
         }
 
+        // Check for Updates Button (for installed addons)
+        if (addon.isInstalled() && addon instanceof InstalledAddon installedAddon) {
+            WButton checkUpdateBtn = actions.add(theme.button("Check for Updates")).widget();
+            checkUpdateBtn.action = () -> {
+                checkUpdateBtn.set("Checking...");
+                MeteorExecutor.execute(() -> {
+                    Optional<UpdateInfo> update = checkForUpdate(installedAddon);
+                    mc.execute(() -> {
+                        if (update.isPresent()) {
+                            checkUpdateBtn.set("Update Found!");
+                            // Show updates screen with this single update
+                            mc.setScreen(new UpdatesAvailableScreen(GuiThemes.get(), Collections.singletonList(update.get())));
+                        } else {
+                            checkUpdateBtn.set("Up to date");
+                        }
+                    });
+                });
+            };
+        }
+
         // Link Buttons
         if (addon.getGithubUrl().isPresent()) {
              WButton btn = actions.add(theme.button("GitHub")).widget();
@@ -189,4 +218,123 @@ private boolean addFeatureList(WSection section, String label, List<String> item
 
         return true;
     }
+
+    /**
+     * Check for updates for a specific installed addon.
+     */
+    private Optional<UpdateInfo> checkForUpdate(InstalledAddon installed) {
+        MeteorAddonsAddon.LOG.info("Checking for updates for: {}", installed.getName());
+
+        // Get GitHub URL from the installed addon
+        Optional<String> githubUrlOpt = installed.getGithubUrl();
+        if (githubUrlOpt.isEmpty()) {
+            MeteorAddonsAddon.LOG.warn("No GitHub URL for {}", installed.getName());
+            return Optional.empty();
+        }
+
+        String githubUrl = githubUrlOpt.get();
+        MeteorAddonsAddon.LOG.info("GitHub URL: {}", githubUrl);
+
+        // Parse owner/repo
+        Optional<String[]> parsed = GitHubReleaseAPI.parseGitHubUrl(githubUrl);
+        if (parsed.isEmpty()) {
+            MeteorAddonsAddon.LOG.warn("Failed to parse GitHub URL: {}", githubUrl);
+            return Optional.empty();
+        }
+
+        String[] ownerRepo = parsed.get();
+        MeteorAddonsAddon.LOG.info("Parsed: owner={}, repo={}", ownerRepo[0], ownerRepo[1]);
+
+        // Get local JAR path
+        Path localJarPath = getJarPath(installed);
+        if (localJarPath == null) {
+            MeteorAddonsAddon.LOG.warn("Could not determine JAR path for {}", installed.getName());
+            return Optional.empty();
+        }
+        MeteorAddonsAddon.LOG.info("Local JAR path: {}", localJarPath);
+
+        // Compute local hash
+        String localHash = HashUtil.computeSha256(localJarPath);
+        if (localHash == null) {
+            MeteorAddonsAddon.LOG.warn("Failed to compute local hash for {}", installed.getName());
+            return Optional.empty();
+        }
+        MeteorAddonsAddon.LOG.info("Local SHA256: {}", localHash);
+
+        // Fetch release info from GitHub
+        Optional<GitHubReleaseAPI.ReleaseInfo> releaseOpt = GitHubReleaseAPI.getLatestRelease(ownerRepo[0], ownerRepo[1]);
+        if (releaseOpt.isEmpty()) {
+            MeteorAddonsAddon.LOG.warn("No release found for {}/{}", ownerRepo[0], ownerRepo[1]);
+            return Optional.empty();
+        }
+
+        GitHubReleaseAPI.ReleaseInfo release = releaseOpt.get();
+        MeteorAddonsAddon.LOG.info("Latest release: {} ({})", release.getName(), release.getTagName());
+
+        // Find JAR asset
+        Optional<GitHubReleaseAPI.AssetInfo> assetOpt = GitHubReleaseAPI.findJarAsset(release);
+        if (assetOpt.isEmpty()) {
+            MeteorAddonsAddon.LOG.warn("No JAR asset found in release for {}", installed.getName());
+            return Optional.empty();
+        }
+
+        GitHubReleaseAPI.AssetInfo asset = assetOpt.get();
+        String remoteHash = asset.getSha256();
+        MeteorAddonsAddon.LOG.info("Remote JAR: {}", asset.getFileName());
+        MeteorAddonsAddon.LOG.info("Remote SHA256: {}", remoteHash);
+
+        if (remoteHash == null || remoteHash.isEmpty()) {
+            MeteorAddonsAddon.LOG.warn("No SHA256 digest available for {} (GitHub may not have computed it yet)", installed.getName());
+            return Optional.empty();
+        }
+
+        // Compare hashes
+        if (!HashUtil.hashesMatch(localHash, remoteHash)) {
+            MeteorAddonsAddon.LOG.info("UPDATE AVAILABLE for {}: hashes differ", installed.getName());
+
+            return Optional.of(new UpdateInfo(
+                installed,
+                installed.getName(),
+                installed.getVersion(),
+                release.getVersion(),
+                release.getChangelog(),
+                asset.getDownloadUrl(),
+                remoteHash,
+                localHash,
+                localJarPath
+            ));
+        } else {
+            MeteorAddonsAddon.LOG.info("{} is up to date (hashes match)", installed.getName());
+            return Optional.empty();
+        }
+    }
+
+    /**
+     * Get the JAR file path for an installed addon.
+     */
+    private Path getJarPath(InstalledAddon addon) {
+        try {
+            List<Path> rootPaths = addon.getModContainer().getRootPaths();
+            if (!rootPaths.isEmpty()) {
+                Path rootPath = rootPaths.get(0);
+                String pathStr = rootPath.toUri().toString();
+                MeteorAddonsAddon.LOG.debug("Root path URI: {}", pathStr);
+
+                if (pathStr.startsWith("jar:file:")) {
+                    // Extract JAR path from jar:file:/path/to/mod.jar!/
+                    int exclamation = pathStr.indexOf('!');
+                    if (exclamation > 0) {
+                        String jarUriStr = pathStr.substring(4, exclamation); // Get "file:/path/to/mod.jar"
+                        java.net.URI jarUri = new java.net.URI(jarUriStr);
+                        return Path.of(jarUri);
+                    }
+                } else if (pathStr.endsWith(".jar")) {
+                    return rootPath;
+                }
+            }
+        } catch (Exception e) {
+            MeteorAddonsAddon.LOG.warn("Failed to get JAR path for {}: {}", addon.getName(), e.getMessage());
+        }
+        return null;
+    }
 }