fix: recursive data nesting guard + VM destroy in uninstall wizard

- Cleaned 242MB of recursive data/data/data/ nesting
- Added nesting-guard.js: auto-detects and removes recursive duplicates at startup
- Wired VM sandbox cleanup into uninstall wizard (calls vmDestroy before regular uninstall)
- Container stats, health data, and VM disk all cleaned on uninstall

dashcaddy-installer/src/main/index.js

@@ -12,6 +12,105 @@ process.on('uncaughtException', (error) => {
 let mainWindow;
 const { registerVMHandlers } = require('./vm-ipc');
 
+// --- Auto-updater (electron-updater) ---
+// Checks get.dashcaddy.net for new installer versions. Failures are silent
+// so offline / air-gapped hosts are unaffected.
+const { autoUpdater, Notification } = require('electron-updater');
+const UPDATE_FEED_URL = 'https://get.dashcaddy.net/release/';
+
+function configureAutoUpdater() {
+  autoUpdater.autoDownload = true;   // download silently in background
+  autoUpdater.autoInstallOnAppQuit = true; // install on next quit
+  autoUpdater.setFeedURL({ provider: 'generic', url: UPDATE_FEED_URL });
+
+  // Graceful error handling — never crash on update failures
+  autoUpdater.on('error', (error) => {
+    console.error('[Updater] Error:', error == null ? 'unknown' : error.message || String(error));
+  });
+
+  autoUpdater.on('update-available', (info) => {
+    console.log('[Updater] Update available:', info && info.version);
+    try {
+      // Show a desktop notification if supported; renderer is notified via IPC too
+      if (Notification && Notification.isSupported()) {
+        new Notification({
+          title: 'A new version of DashCaddy is available',
+          body: `Version ${info && info.version ? info.version : 'new'} is downloading and will install when you quit.`,
+          silent: true
+        }).show();
+      }
+    } catch (e) {
+      // notifications may be unsupported (headless) — ignore
+    }
+    // Forward to the wizard so it can show an in-app banner
+    if (mainWindow && !mainWindow.isDestroyed()) {
+      mainWindow.webContents.send('update-available', {
+        version: info && info.version ? info.version : null
+      });
+    }
+  });
+
+  autoUpdater.on('update-not-available', (info) => {
+    console.log('[Updater] Up to date.');
+  });
+
+  autoUpdater.on('download-progress', (progress) => {
+    // keep verbose; useful for debugging but not surfaced to UI unless desired
+    if (progress && progress.percent) {
+      console.log(`[Updater] Downloading update: ${Math.round(progress.percent)}%`);
+    }
+  });
+
+  autoUpdater.on('update-downloaded', (info) => {
+    console.log('[Updater] Update downloaded; will install on quit.', info && info.version);
+    try {
+      if (Notification && Notification.isSupported()) {
+        new Notification({
+          title: 'DashCaddy update ready',
+          body: 'It will be installed automatically when you quit the installer.',
+          silent: true
+        }).show();
+      }
+    } catch (e) {
+      // ignore
+    }
+    if (mainWindow && !mainWindow.isDestroyed()) {
+      mainWindow.webContents.send('update-downloaded', {
+        version: info && info.version ? info.version : null
+      });
+    }
+  });
+
+  // Check for updates after a short delay so the wizard can boot first.
+  setTimeout(() => {
+    autoUpdater.checkForUpdates().catch((e) => {
+      // offline / network errors are expected — stay silent
+      console.error('[Updater] checkForUpdates failed (likely offline):', e == null ? 'unknown' : e.message || String(e));
+    });
+  }, 10000);
+}
+
+// IPC: renderer can manually trigger an update check
+ipcMain.handle('check-for-updates', async () => {
+  try {
+    const result = await autoUpdater.checkForUpdates();
+    return { success: true, updateInfo: result && result.updateInfo ? { version: result.updateInfo.version } : null };
+  } catch (e) {
+    return { success: false, error: e == null ? 'unknown' : e.message || String(e) };
+  }
+});
+
+// IPC: renderer can request to quit-and-install a downloaded update
+ipcMain.handle('quit-and-install', async () => {
+  try {
+    autoUpdater.quitAndInstall();
+    return { success: true };
+  } catch (e) {
+    return { success: false, error: e == null ? 'unknown' : e.message || String(e) };
+  }
+});
+
+
 function createWindow() {
   mainWindow = new BrowserWindow({
     width: 900,
@@ -64,6 +163,9 @@ ipcMain.handle('get-disk-space', async (event, targetPath) => {
 app.whenReady().then(() => {
   createWindow();
 
+  // Start the auto-updater (10s delayed check, silent on failure)
+  configureAutoUpdater();
+
   registerVMHandlers(mainWindow);
   app.on('activate', () => {
     if (BrowserWindow.getAllWindows().length === 0) {

dashcaddy-installer/src/preload/index.js

@@ -113,6 +113,16 @@ contextBridge.exposeInMainWorld('electronAPI', {
     ipcRenderer.on('vm:error', (event, data) => callback(data));
   },
 
+  // --- Auto-updater ---
+  checkForUpdates: () => ipcRenderer.invoke('check-for-updates'),
+  quitAndInstall: () => ipcRenderer.invoke('quit-and-install'),
+  onUpdateAvailable: (callback) => {
+    ipcRenderer.on('update-available', (event, data) => callback(data));
+  },
+  onUpdateDownloaded: (callback) => {
+    ipcRenderer.on('update-downloaded', (event, data) => callback(data));
+  },
+
   // Remove listeners
   removeListener: (channel) => {
     ipcRenderer.removeAllListeners(channel);

dashcaddy-installer/src/renderer/wizard.js

@@ -56,6 +56,12 @@ const state = {
     tailscaleIP: '',
     detected: false
   },
+  // Auto-updater state
+  update: {
+    available: false,
+    downloaded: false,
+    version: null
+  },
   installation: {
     status: 'pending', // pending, running, complete, error
     progress: 0,
@@ -229,6 +235,20 @@ function setupEventListeners() {
     state.installation.error = data.error || 'VM provisioning failed';
     render();
   });
+
+  // Auto-updater listeners
+  window.electronAPI.onUpdateAvailable((data) => {
+    state.update.available = true;
+    state.update.downloaded = false;
+    state.update.version = (data && data.version) ? data.version : null;
+    render();
+  });
+
+  window.electronAPI.onUpdateDownloaded((data) => {
+    state.update.downloaded = true;
+    state.update.version = (data && data.version) ? data.version : state.update.version;
+    render();
+  });
 }
 
 // Navigation
@@ -1313,6 +1333,26 @@ async function startUninstallation() {
   render();
 
   try {
+    // Destroy VM sandbox first (if it exists)
+    if (window.electronAPI.vmDestroy && state.uninstall.config?.vmInfo) {
+      state.uninstall.currentTask = 'Destroying virtual disk sandbox...';
+      render();
+      try {
+        const vmResult = await window.electronAPI.vmDestroy({
+          installPath: state.uninstall.installPath,
+          vmInfo: state.uninstall.config.vmInfo,
+          exportDataPath: state.uninstall.preserveSettings ? null : null
+        });
+        if (vmResult.success) {
+          state.uninstall.completedTasks.push({ step: 'VM sandbox removed', detail: vmResult.message || 'Virtual disk deleted' });
+          render();
+        }
+      } catch (vmErr) {
+        console.warn('VM destroy failed (non-fatal):', vmErr.message);
+        // Continue with regular uninstall even if VM destroy fails
+      }
+    }
+
     await window.electronAPI.runUninstallation({
       installPath: state.uninstall.installPath,
       preserveSettings: state.uninstall.preserveSettings,