Fix ObtainInstaller offline regression, add missing test includes

- Move readyToInstall and upToDate state checks before the GitHub API
  call so already-downloaded installers can proceed when GitHub is
  unreachable
- Add missing <algorithm>, <iterator>, <vector> includes in
  UpdatingTests.cpp to avoid transitive-include breakage

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

PowerToys.slnx

@@ -57,6 +57,7 @@
     <Project Path="src/common/UnitTests-CommonLib/UnitTests-CommonLib.vcxproj" Id="1a066c63-64b3-45f8-92fe-664e1cce8077" />
     <Project Path="src/common/UnitTests-CommonUtils/UnitTests-CommonUtils.vcxproj" Id="8b5cfb38-ccba-40a8-ad7a-89c57b070884" />
     <Project Path="src/common/updating/updating.vcxproj" Id="17da04df-e393-4397-9cf0-84dabe11032e" />
+    <Project Path="src/common/updating/UnitTests/UpdatingUnitTests.vcxproj" Id="a1b2c3d4-e5f6-7890-abcd-ef1234567890" />
     <Project Path="src/common/version/version.vcxproj" Id="cc6e41ac-8174-4e8a-8d22-85dd7f4851df" />
   </Folder>
   <Folder Name="/common/interop/">

src/Update/PowerToys.Update.cpp

@@ -14,6 +14,8 @@
 #include <common/updating/updating.h>
 #include <common/updating/updateState.h>
 #include <common/updating/installer.h>
+#include <common/updating/configBackup.h>
+#include <common/updating/updateLifecycle.h>
 
 #include <common/utils/elevation.h>
 #include <common/utils/HttpClient.h>
@@ -21,6 +23,8 @@
 #include <common/utils/resources.h>
 #include <common/utils/timeutil.h>
 
+#include <wil/resource.h>
+
 #include <common/SettingsAPI/settings_helpers.h>
 
 #include <common/logger/logger.h>
@@ -38,15 +42,16 @@ namespace fs = std::filesystem;
 
 std::optional<fs::path> CopySelfToTempDir()
 {
+    // D5 fix: Use unique temp path with PID to avoid collision on concurrent updates
     std::error_code error;
-    auto dst_path = fs::temp_directory_path() / "PowerToys.Update.exe";
+    auto dst_path = fs::temp_directory_path() / (L"PowerToys.Update." + std::to_wstring(GetCurrentProcessId()) + L".exe");
     fs::copy_file(get_module_filename(), dst_path, fs::copy_options::overwrite_existing, error);
     if (error)
     {
         return std::nullopt;
     }
 
-    return std::move(dst_path);
+    return dst_path;
 }
 
 std::optional<fs::path> ObtainInstaller(bool& isUpToDate)
@@ -57,34 +62,9 @@ std::optional<fs::path> ObtainInstaller(bool& isUpToDate)
 
     auto state = UpdateState::read();
 
-    const auto new_version_info = std::move(get_github_version_info_async()).get();
-    if (std::holds_alternative<version_up_to_date>(*new_version_info))
-    {
-        isUpToDate = true;
-        Logger::error("Invoked with -update_now argument, but no update was available");
-        return std::nullopt;
-    }
-
-    if (state.state == UpdateState::readyToDownload || state.state == UpdateState::errorDownloading)
-    {
-        if (!new_version_info)
-        {
-            Logger::error(L"Couldn't obtain github version info: {}", new_version_info.error());
-            return std::nullopt;
-        }
-
-        // Cleanup old updates before downloading the latest
-        updating::cleanup_updates();
-
-        auto downloaded_installer = std::move(download_new_version_async(std::get<new_version_download_info>(*new_version_info))).get();
-        if (!downloaded_installer)
-        {
-            Logger::error("Couldn't download new installer");
-        }
-
-        return downloaded_installer;
-    }
-    else if (state.state == UpdateState::readyToInstall)
+    // Handle readyToInstall first — the installer is already on disk,
+    // so we don't need a GitHub API call (which may fail if offline).
+    if (state.state == UpdateState::readyToInstall)
     {
         fs::path installer{ get_pending_updates_path() / state.downloadedInstallerFilename };
         if (fs::is_regular_file(installer))
@@ -97,12 +77,44 @@ std::optional<fs::path> ObtainInstaller(bool& isUpToDate)
             return std::nullopt;
         }
     }
-    else if (state.state == UpdateState::upToDate)
+
+    if (state.state == UpdateState::upToDate)
     {
         isUpToDate = true;
         return std::nullopt;
     }
 
+    const auto new_version_info = std::move(get_github_version_info_async()).get();
+
+    // Check for error BEFORE dereferencing — the old code crashed here
+    // when GitHub API was unreachable (new_version_info held an error string).
+    if (!new_version_info)
+    {
+        Logger::error(L"Couldn't obtain github version info: {}", new_version_info.error());
+        return std::nullopt;
+    }
+
+    if (std::holds_alternative<version_up_to_date>(*new_version_info))
+    {
+        isUpToDate = true;
+        Logger::error("Invoked with -update_now argument, but no update was available");
+        return std::nullopt;
+    }
+
+    if (state.state == UpdateState::readyToDownload || state.state == UpdateState::errorDownloading)
+    {
+        // Cleanup old updates before downloading the latest
+        updating::cleanup_updates();
+
+        auto downloaded_installer = std::move(download_new_version_async(std::get<new_version_download_info>(*new_version_info))).get();
+        if (!downloaded_installer)
+        {
+            Logger::error("Couldn't download new installer");
+        }
+
+        return downloaded_installer;
+    }
+
     Logger::error("Invoked with -update_now argument, but update state was invalid");
     return std::nullopt;
 }
@@ -116,13 +128,29 @@ bool InstallNewVersionStage1(fs::path installer)
 
         if (pt_main_window != nullptr)
         {
+            // Get the process that owns the tray window so we can wait for it to exit
+            DWORD ptProcessId = 0;
+            GetWindowThreadProcessId(pt_main_window, &ptProcessId);
+
             SendMessageW(pt_main_window, WM_CLOSE, 0, 0);
+
+            // D4 fix: Wait for PT to actually exit before launching installer.
+            // Without this, the installer may find PT files locked.
+            if (ptProcessId != 0)
+            {
+                wil::unique_handle ptProcess{ OpenProcess(SYNCHRONIZE, FALSE, ptProcessId) };
+                if (ptProcess)
+                {
+                    WaitForSingleObject(ptProcess.get(), 10000); // 10 second timeout
+                }
+            }
         }
 
-        std::wstring arguments{ UPDATE_NOW_LAUNCH_STAGE2 };
-        arguments += L" \"";
-        arguments += installer.c_str();
-        arguments += L"\"";
+        // Pass the install directory so Stage 2 can relaunch PowerToys after install
+        const std::wstring installDir = get_module_folderpath();
+
+        std::wstring arguments = updating::BuildStage2Arguments(
+            UPDATE_NOW_LAUNCH_STAGE2, installer, fs::path(installDir));
         SHELLEXECUTEINFOW sei{ sizeof(sei) };
         sei.fMask = { SEE_MASK_FLAG_NO_UI | SEE_MASK_NOASYNC };
         sei.lpFile = copy_in_temp->c_str();
@@ -190,9 +218,16 @@ int WINAPI WinMain(HINSTANCE, HINSTANCE, LPSTR, int)
     LPWSTR* args = CommandLineToArgvW(GetCommandLineW(), &nArgs);
     if (!args || nArgs < 2)
     {
+        if (args)
+        {
+            LocalFree(args);
+        }
         return 1;
     }
 
+    // D3 fix: ensure args is freed on all exit paths
+    auto freeArgs = wil::scope_exit([&] { LocalFree(args); });
+
     std::wstring_view action{ args[1] };
 
     std::filesystem::path logFilePath(PTSettingsHelper::get_root_save_folder_location());
@@ -201,6 +236,10 @@ int WINAPI WinMain(HINSTANCE, HINSTANCE, LPSTR, int)
 
     if (action == UPDATE_NOW_LAUNCH_STAGE1)
     {
+        // Backup config files before the update to protect against corruption
+        Logger::info("Backing up config files before update");
+        updating::BackupConfigFiles(fs::path(PTSettingsHelper::get_root_save_folder_location()));
+
         bool isUpToDate = false;
         auto installerPath = ObtainInstaller(isUpToDate);
         bool failed = !installerPath.has_value();
@@ -217,6 +256,12 @@ int WINAPI WinMain(HINSTANCE, HINSTANCE, LPSTR, int)
     }
     else if (action == UPDATE_NOW_LAUNCH_STAGE2)
     {
+        if (nArgs < 3)
+        {
+            Logger::error("Stage 2 invoked without installer path argument");
+            return 1;
+        }
+
         using namespace std::string_view_literals;
         const bool failed = !InstallNewVersionStage2(args[2]);
         if (failed)
@@ -227,6 +272,37 @@ int WINAPI WinMain(HINSTANCE, HINSTANCE, LPSTR, int)
                 state.state = UpdateState::errorDownloading;
             });
         }
+
+        // D7 fix: Always check for corrupted configs after Stage 2, regardless
+        // of install success/failure. A failed install may still corrupt configs.
+        Logger::info("Checking for corrupted config files after update");
+        updating::RestoreCorruptedConfigs(fs::path(PTSettingsHelper::get_root_save_folder_location()));
+
+        if (!failed)
+        {
+            // Relaunch PowerToys from the install directory
+            if (updating::CanRelaunchAfterUpdate(nArgs))
+            {
+                std::wstring ptExePath = updating::BuildPowerToysExePath(args[3]);
+
+                Logger::info(L"Relaunching PowerToys after update: {}", ptExePath);
+
+                SHELLEXECUTEINFOW sei{ sizeof(sei) };
+                sei.fMask = { SEE_MASK_FLAG_NO_UI | SEE_MASK_NOASYNC };
+                sei.lpFile = ptExePath.c_str();
+                sei.nShow = SW_SHOWNORMAL;
+                sei.lpParameters = UPDATE_REPORT_SUCCESS;
+
+                if (!ShellExecuteExW(&sei))
+                {
+                    Logger::error(L"Failed to relaunch PowerToys after update");
+                }
+            }
+            else
+            {
+                Logger::warn("Install directory not provided to Stage 2 - cannot relaunch PowerToys");
+            }
+        }
         return failed;
     }
 

src/common/updating/UnitTests/UpdatingTests.cpp

@@ -0,0 +1,679 @@
+// Copyright (c) Microsoft Corporation
+// The Microsoft Corporation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+#include "pch.h"
+
+#include <algorithm>
+#include <filesystem>
+#include <fstream>
+#include <iterator>
+#include <string>
+#include <vector>
+
+#include <common/updating/configBackup.h>
+#include <common/updating/updateLifecycle.h>
+
+using namespace Microsoft::VisualStudio::CppUnitTestFramework;
+
+namespace fs = std::filesystem;
+
+namespace UpdatingUnitTests
+{
+    // Helper to create a temp directory for test isolation.
+    // Each instance gets a unique subdirectory to prevent test interference.
+    class TempDir
+    {
+    public:
+        TempDir()
+        {
+            wchar_t tempPath[MAX_PATH + 1];
+            GetTempPathW(MAX_PATH, tempPath);
+            static std::atomic<int> counter{0};
+            m_path = fs::path(tempPath) / (L"PowerToysUpdateTests_" + std::to_wstring(counter++));
+
+            // Ensure clean state
+            std::error_code ec;
+            fs::remove_all(m_path, ec);
+            fs::create_directories(m_path, ec);
+        }
+
+        ~TempDir()
+        {
+            std::error_code ec;
+            fs::remove_all(m_path, ec);
+        }
+
+        const fs::path& path() const { return m_path; }
+
+        // Write a file with the given content
+        void WriteFile(const fs::path& relativePath, const std::string& content)
+        {
+            auto fullPath = m_path / relativePath;
+            fs::create_directories(fullPath.parent_path());
+            std::ofstream file(fullPath, std::ios::binary);
+            file.write(content.data(), content.size());
+        }
+
+        // Write a file with raw bytes (including null bytes for corruption testing)
+        void WriteFileBytes(const fs::path& relativePath, const std::vector<char>& bytes)
+        {
+            auto fullPath = m_path / relativePath;
+            fs::create_directories(fullPath.parent_path());
+            std::ofstream file(fullPath, std::ios::binary);
+            file.write(bytes.data(), bytes.size());
+        }
+
+        // Read file content as string
+        std::string ReadFile(const fs::path& relativePath)
+        {
+            auto fullPath = m_path / relativePath;
+            std::ifstream file(fullPath, std::ios::binary);
+            return std::string(std::istreambuf_iterator<char>(file), std::istreambuf_iterator<char>());
+        }
+
+        bool FileExists(const fs::path& relativePath)
+        {
+            return fs::exists(m_path / relativePath);
+        }
+
+    private:
+        fs::path m_path;
+    };
+
+    TEST_CLASS(IsJsonFileCorruptedTests)
+    {
+    public:
+        // Tests IsJsonFileCorrupted: valid JSON with no null bytes returns false.
+        // Covers: configBackup.h IsJsonFileCorrupted — happy path, full file scan.
+        TEST_METHOD(CleanJsonFileIsNotCorrupted)
+        {
+            TempDir dir;
+            dir.WriteFile(L"settings.json", R"({"theme":"dark","startup":true})");
+
+            Assert::IsFalse(updating::IsJsonFileCorrupted(dir.path() / L"settings.json"));
+        }
+
+        // Tests IsJsonFileCorrupted: zero-length file returns false (empty is not corrupted).
+        // Covers: configBackup.h IsJsonFileCorrupted — file.read returns 0 bytes immediately.
+        TEST_METHOD(EmptyFileIsNotCorrupted)
+        {
+            TempDir dir;
+            dir.WriteFile(L"empty.json", "");
+
+            Assert::IsFalse(updating::IsJsonFileCorrupted(dir.path() / L"empty.json"));
+        }
+
+        // Tests IsJsonFileCorrupted: file containing embedded null bytes returns true.
+        // Covers: configBackup.h IsJsonFileCorrupted — null byte detection within buffer.
+        TEST_METHOD(FileWithNullBytesIsCorrupted)
+        {
+            TempDir dir;
+            std::vector<char> corrupted = { '{', '"', 'a', '"', ':', '\0', '\0', '\0', '}' };
+            dir.WriteFileBytes(L"corrupted.json", corrupted);
+
+            Assert::IsTrue(updating::IsJsonFileCorrupted(dir.path() / L"corrupted.json"));
+        }
+
+        // Tests IsJsonFileCorrupted: file entirely filled with 0x00 bytes returns true.
+        // Reproduces the exact bug from #46179 where installer zeroed out JSON files.
+        // Covers: configBackup.h IsJsonFileCorrupted — first byte is null.
+        TEST_METHOD(FileFilledWithNullBytesIsCorrupted)
+        {
+            TempDir dir;
+            std::vector<char> allNulls(1024, '\0');
+            dir.WriteFileBytes(L"workspaces.json", allNulls);
+
+            Assert::IsTrue(updating::IsJsonFileCorrupted(dir.path() / L"workspaces.json"));
+        }
+
+        // Tests IsJsonFileCorrupted: path that does not exist returns false.
+        // Covers: configBackup.h IsJsonFileCorrupted — file.is_open() check.
+        TEST_METHOD(NonExistentFileIsNotCorrupted)
+        {
+            TempDir dir;
+
+            Assert::IsFalse(updating::IsJsonFileCorrupted(dir.path() / L"missing.json"));
+        }
+
+        // Tests IsJsonFileCorrupted: file larger than the 4096-byte read chunk
+        // with no null bytes returns false.
+        // Covers: configBackup.h IsJsonFileCorrupted — multi-chunk while loop.
+        TEST_METHOD(LargeCleanFileIsNotCorrupted)
+        {
+            TempDir dir;
+            std::string largeContent(8192, 'x');
+            dir.WriteFile(L"large.json", largeContent);
+
+            Assert::IsFalse(updating::IsJsonFileCorrupted(dir.path() / L"large.json"));
+        }
+
+        // Tests IsJsonFileCorrupted: null byte placed after the first 4096-byte
+        // chunk boundary is still detected.
+        // Covers: configBackup.h IsJsonFileCorrupted — second chunk scan.
+        TEST_METHOD(NullByteAtEndOfLargeFileIsDetected)
+        {
+            TempDir dir;
+            std::string content(5000, 'x');
+            content[4999] = '\0';
+            std::vector<char> bytes(content.begin(), content.end());
+            dir.WriteFileBytes(L"sneaky.json", bytes);
+
+            Assert::IsTrue(updating::IsJsonFileCorrupted(dir.path() / L"sneaky.json"));
+        }
+    };
+
+    TEST_CLASS(BackupConfigFilesTests)
+    {
+    public:
+        // Tests BackupConfigFiles: root-level .json files are copied to ConfigBackup.
+        // Covers: configBackup.h BackupConfigFiles — root directory_iterator,
+        //         is_regular_file && extension == ".json" branch.
+        // Setup: Two root-level JSON files.
+        TEST_METHOD(BackupCopiesRootJsonFiles)
+        {
+            TempDir dir;
+            dir.WriteFile(L"settings.json", R"({"theme":"dark"})");
+            dir.WriteFile(L"UpdateState.json", R"({"state":0})");
+
+            updating::BackupConfigFiles(dir.path());
+
+            Assert::IsTrue(dir.FileExists(L"ConfigBackup\\settings.json"));
+            Assert::IsTrue(dir.FileExists(L"ConfigBackup\\UpdateState.json"));
+            Assert::AreEqual(std::string(R"({"theme":"dark"})"), dir.ReadFile(L"ConfigBackup\\settings.json"));
+        }
+
+        // Tests BackupConfigFiles: .json files inside module subdirectories are
+        // copied to ConfigBackup/<module>/.
+        // Covers: configBackup.h BackupConfigFiles — is_directory branch,
+        //         module directory_iterator with extension filter.
+        // Setup: Root JSON + two module directories with JSON files.
+        TEST_METHOD(BackupCopiesModuleJsonFiles)
+        {
+            TempDir dir;
+            dir.WriteFile(L"settings.json", R"({"theme":"dark"})");
+            dir.WriteFile(L"FancyZones\\settings.json", R"({"zones":[]})");
+            dir.WriteFile(L"Workspaces\\workspaces.json", R"({"workspaces":[]})");
+
+            updating::BackupConfigFiles(dir.path());
+
+            Assert::IsTrue(dir.FileExists(L"ConfigBackup\\FancyZones\\settings.json"));
+            Assert::IsTrue(dir.FileExists(L"ConfigBackup\\Workspaces\\workspaces.json"));
+            Assert::AreEqual(std::string(R"({"zones":[]})"),
+                dir.ReadFile(L"ConfigBackup\\FancyZones\\settings.json"));
+        }
+
+        // Tests BackupConfigFiles: non-.json files at root level are not copied.
+        // Covers: configBackup.h BackupConfigFiles — extension filter excludes .log.
+        // Setup: One JSON file + one .log file at root.
+        TEST_METHOD(BackupSkipsNonJsonFiles)
+        {
+            TempDir dir;
+            dir.WriteFile(L"settings.json", R"({"theme":"dark"})");
+            dir.WriteFile(L"debug.log", "log data");
+
+            updating::BackupConfigFiles(dir.path());
+
+            Assert::IsTrue(dir.FileExists(L"ConfigBackup\\settings.json"));
+            Assert::IsFalse(dir.FileExists(L"ConfigBackup\\debug.log"));
+        }
+
+        // Tests BackupConfigFiles: the "Updates" directory is explicitly skipped.
+        // Covers: configBackup.h BackupConfigFiles — dirName == L"Updates" continue.
+        // Setup: Root JSON + Updates directory containing a file.
+        TEST_METHOD(BackupSkipsUpdatesDirectory)
+        {
+            TempDir dir;
+            dir.WriteFile(L"settings.json", R"({"theme":"dark"})");
+            dir.WriteFile(L"Updates\\installer.exe", "fake exe");
+
+            updating::BackupConfigFiles(dir.path());
+
+            Assert::IsFalse(dir.FileExists(L"ConfigBackup\\Updates"));
+        }
+
+        // Tests BackupConfigFiles: running backup twice overwrites the previous
+        // backup with current file content.
+        // Covers: configBackup.h BackupConfigFiles — fs::remove_all(backupDir) +
+        //         copy_options::overwrite_existing.
+        // Setup: Backup, modify original, backup again.
+        TEST_METHOD(BackupOverwritesPreviousBackup)
+        {
+            TempDir dir;
+            dir.WriteFile(L"settings.json", R"({"version":1})");
+            updating::BackupConfigFiles(dir.path());
+
+            // Update the original
+            dir.WriteFile(L"settings.json", R"({"version":2})");
+            updating::BackupConfigFiles(dir.path());
+
+            Assert::AreEqual(std::string(R"({"version":2})"), dir.ReadFile(L"ConfigBackup\\settings.json"));
+        }
+
+        // Tests BackupConfigFiles: non-.json files inside module subdirectories
+        // (e.g., FancyZones/zones.dat) should NOT be backed up.
+        // Covers: configBackup.h BackupConfigFiles — extension filter in module loop.
+        TEST_METHOD(BackupSkipsNonJsonFilesInModuleDirs)
+        {
+            TempDir dir;
+            dir.WriteFile(L"settings.json", R"({})");
+            dir.WriteFile(L"FancyZones\\settings.json", R"({"zones":[]})");
+            dir.WriteFile(L"FancyZones\\zones.dat", "binary data");
+
+            updating::BackupConfigFiles(dir.path());
+
+            Assert::IsTrue(dir.FileExists(L"ConfigBackup\\FancyZones\\settings.json"));
+            Assert::IsFalse(dir.FileExists(L"ConfigBackup\\FancyZones\\zones.dat"));
+        }
+
+        // Tests BackupConfigFiles: empty root directory with no files produces
+        // an empty ConfigBackup dir without errors.
+        // Covers: configBackup.h BackupConfigFiles — empty directory_iterator.
+        TEST_METHOD(BackupEmptyRootDirSucceeds)
+        {
+            TempDir dir;
+            // Root dir exists but has no files
+
+            updating::BackupConfigFiles(dir.path());
+
+            Assert::IsTrue(dir.FileExists(L"ConfigBackup"));
+        }
+    };
+
+    TEST_CLASS(RestoreCorruptedConfigsTests)
+    {
+    public:
+        // Tests RestoreCorruptedConfigs: corrupted root-level JSON file is restored
+        // from the good backup copy.
+        // Covers: configBackup.h RestoreCorruptedConfigs — root file restore branch,
+        //         fs::exists + IsJsonFileCorrupted + backup integrity check.
+        // Setup: Good file -> backup -> corrupt original -> restore.
+        TEST_METHOD(RestoreFixesCorruptedRootFile)
+        {
+            TempDir dir;
+            const std::string goodContent = R"({"theme":"dark"})";
+            dir.WriteFile(L"settings.json", goodContent);
+
+            // Backup
+            updating::BackupConfigFiles(dir.path());
+
+            // Corrupt the original
+            std::vector<char> corrupted(goodContent.size(), '\0');
+            dir.WriteFileBytes(L"settings.json", corrupted);
+            Assert::IsTrue(updating::IsJsonFileCorrupted(dir.path() / L"settings.json"));
+
+            // Restore
+            updating::RestoreCorruptedConfigs(dir.path());
+
+            Assert::IsFalse(updating::IsJsonFileCorrupted(dir.path() / L"settings.json"));
+            Assert::AreEqual(goodContent, dir.ReadFile(L"settings.json"));
+        }
+
+        // Tests RestoreCorruptedConfigs: corrupted module-level JSON file is restored
+        // from the good backup copy.
+        // Covers: configBackup.h RestoreCorruptedConfigs — module directory branch,
+        //         moduleBackupEntry restore with integrity check.
+        // Setup: Module file + root file -> backup -> corrupt module file -> restore.
+        TEST_METHOD(RestoreFixesCorruptedModuleFile)
+        {
+            TempDir dir;
+            const std::string goodContent = R"({"workspaces":[]})";
+            dir.WriteFile(L"Workspaces\\workspaces.json", goodContent);
+            dir.WriteFile(L"settings.json", R"({})");
+
+            updating::BackupConfigFiles(dir.path());
+
+            // Corrupt the module file
+            std::vector<char> corrupted(goodContent.size(), '\0');
+            dir.WriteFileBytes(L"Workspaces\\workspaces.json", corrupted);
+
+            updating::RestoreCorruptedConfigs(dir.path());
+
+            Assert::AreEqual(goodContent, dir.ReadFile(L"Workspaces\\workspaces.json"));
+        }
+
+        // Tests RestoreCorruptedConfigs: clean (non-corrupted) files are NOT
+        // overwritten by backup — preserves user changes made after backup.
+        // Covers: configBackup.h RestoreCorruptedConfigs — IsJsonFileCorrupted
+        //         returns false, copy_file is skipped.
+        // Setup: File -> backup -> modify (but keep valid) -> restore.
+        TEST_METHOD(RestoreLeavesCleanFilesUntouched)
+        {
+            TempDir dir;
+            dir.WriteFile(L"settings.json", R"({"version":1})");
+
+            updating::BackupConfigFiles(dir.path());
+
+            // Modify original (but keep it clean JSON)
+            dir.WriteFile(L"settings.json", R"({"version":2})");
+
+            updating::RestoreCorruptedConfigs(dir.path());
+
+            // Should NOT have been restored since it's not corrupted
+            Assert::AreEqual(std::string(R"({"version":2})"), dir.ReadFile(L"settings.json"));
+        }
+
+        // Tests RestoreCorruptedConfigs: when no ConfigBackup directory exists,
+        // restore silently does nothing (no crash, no data loss).
+        // Covers: configBackup.h RestoreCorruptedConfigs — !fs::exists(backupDir)
+        //         early return.
+        // Setup: File with no prior backup.
+        TEST_METHOD(RestoreHandlesMissingBackupDirectory)
+        {
+            TempDir dir;
+            dir.WriteFile(L"settings.json", R"({"theme":"dark"})");
+
+            // No backup was created - restore should silently do nothing
+            updating::RestoreCorruptedConfigs(dir.path());
+
+            Assert::AreEqual(std::string(R"({"theme":"dark"})"), dir.ReadFile(L"settings.json"));
+        }
+
+        // Tests RestoreCorruptedConfigs: end-to-end scenario with multiple modules,
+        // some corrupted and some clean, verifying selective restore.
+        // Covers: configBackup.h RestoreCorruptedConfigs — both root and module
+        //         branches, selective restore based on corruption status.
+        // Setup: 4 modules -> backup -> corrupt 2 -> restore -> verify all 4.
+        TEST_METHOD(FullBackupAndRestoreRoundTrip)
+        {
+            TempDir dir;
+
+            // Set up a realistic config structure
+            dir.WriteFile(L"settings.json", R"({"startup":true,"theme":"dark"})");
+            dir.WriteFile(L"FancyZones\\settings.json", R"({"zones":[{"id":1}]})");
+            dir.WriteFile(L"Workspaces\\workspaces.json", R"({"workspaces":[{"name":"dev"}]})");
+            dir.WriteFile(L"KeyboardManager\\default.json", R"({"remaps":[]})");
+
+            // Backup
+            updating::BackupConfigFiles(dir.path());
+
+            // Corrupt some files (simulating #46179 scenario)
+            dir.WriteFileBytes(L"Workspaces\\workspaces.json", std::vector<char>(100, '\0'));
+            dir.WriteFileBytes(L"settings.json", std::vector<char>(50, '\0'));
+            // Leave FancyZones and KBM clean
+
+            // Restore
+            updating::RestoreCorruptedConfigs(dir.path());
+
+            // Corrupted files should be restored
+            Assert::AreEqual(std::string(R"({"startup":true,"theme":"dark"})"), dir.ReadFile(L"settings.json"));
+            Assert::AreEqual(std::string(R"({"workspaces":[{"name":"dev"}]})"), dir.ReadFile(L"Workspaces\\workspaces.json"));
+
+            // Clean files should be unchanged
+            Assert::AreEqual(std::string(R"({"zones":[{"id":1}]})"), dir.ReadFile(L"FancyZones\\settings.json"));
+            Assert::AreEqual(std::string(R"({"remaps":[]})"), dir.ReadFile(L"KeyboardManager\\default.json"));
+        }
+
+        // Tests RestoreCorruptedConfigs: when the original file has been deleted
+        // (not corrupted), restore should NOT recreate it from backup. The installer
+        // may have intentionally removed obsolete config files.
+        // Covers: configBackup.h RestoreCorruptedConfigs — fs::exists guard.
+        TEST_METHOD(RestoreSkipsDeletedOriginals)
+        {
+            TempDir dir;
+            dir.WriteFile(L"obsolete.json", R"({"old":true})");
+            updating::BackupConfigFiles(dir.path());
+
+            // Installer deletes the file
+            std::error_code ec;
+            fs::remove(dir.path() / L"obsolete.json", ec);
+
+            updating::RestoreCorruptedConfigs(dir.path());
+
+            // Should NOT be recreated
+            Assert::IsFalse(dir.FileExists(L"obsolete.json"));
+        }
+
+        // Tests RestoreCorruptedConfigs: when the backup file itself is corrupted
+        // (e.g., disk error during backup), restore should NOT copy corrupted
+        // backup over the original — that would make things worse.
+        // Covers: configBackup.h RestoreCorruptedConfigs — backup integrity check (B2 fix).
+        TEST_METHOD(RestoreSkipsCorruptedBackup)
+        {
+            TempDir dir;
+            dir.WriteFile(L"settings.json", R"({"theme":"dark"})");
+            updating::BackupConfigFiles(dir.path());
+
+            // Corrupt BOTH the original AND the backup
+            std::vector<char> nulls(50, '\0');
+            dir.WriteFileBytes(L"settings.json", nulls);
+            dir.WriteFileBytes(L"ConfigBackup\\settings.json", nulls);
+
+            updating::RestoreCorruptedConfigs(dir.path());
+
+            // Original should still be corrupted — we don't restore from bad backup
+            Assert::IsTrue(updating::IsJsonFileCorrupted(dir.path() / L"settings.json"));
+        }
+    };
+
+    // Simulates what actually happens during a PowerToys upgrade:
+    // 1. User has settings from normal use
+    // 2. Updater backs up before install (Stage 1)
+    // 3. Installer runs and corrupts some files (simulated)
+    // 4. Updater restores corrupted files (Stage 2)
+    // 5. PT relaunches and finds working configs
+    TEST_CLASS(UpgradeSimulationTests)
+    {
+    public:
+        // Tests full upgrade simulation: backup -> installer corrupts files -> restore.
+        // Verifies that corrupted files are restored and clean files are untouched.
+        // Covers: configBackup.h BackupConfigFiles + RestoreCorruptedConfigs —
+        //         end-to-end with 5 modules, 2 corrupted, 3 clean.
+        // Setup: Realistic config structure with multiple modules.
+        TEST_METHOD(SimulateUpgradeWithCorruption)
+        {
+            TempDir dir;
+
+            // === User's real config state before upgrade ===
+            dir.WriteFile(L"settings.json",
+                R"({"startup":true,"theme":"dark","run_elevated":false,"download_updates_automatically":true})");
+            dir.WriteFile(L"FancyZones\\settings.json",
+                R"({"zones":[{"id":1,"rect":{"x":0,"y":0,"w":960,"h":1080}}]})");
+            dir.WriteFile(L"Workspaces\\workspaces.json",
+                R"({"workspaces":[{"name":"dev","apps":["code","terminal"]}]})");
+            dir.WriteFile(L"KeyboardManager\\default.json",
+                R"({"remapKeys":{"inProcess":[{"original":"0x41","new":"0x42"}]}})");
+            dir.WriteFile(L"MouseWithoutBorders\\settings.json",
+                R"({"machineKey":"abc123","connectToAll":true})");
+
+            // Non-JSON files that should be left alone
+            dir.WriteFile(L"update.log", "2026-04-11 update started");
+
+            // === Stage 1: Backup before killing PT ===
+            updating::BackupConfigFiles(dir.path());
+
+            // Verify backup was created correctly
+            Assert::IsTrue(dir.FileExists(L"ConfigBackup\\settings.json"));
+            Assert::IsTrue(dir.FileExists(L"ConfigBackup\\FancyZones\\settings.json"));
+            Assert::IsTrue(dir.FileExists(L"ConfigBackup\\Workspaces\\workspaces.json"));
+            Assert::IsTrue(dir.FileExists(L"ConfigBackup\\KeyboardManager\\default.json"));
+            Assert::IsTrue(dir.FileExists(L"ConfigBackup\\MouseWithoutBorders\\settings.json"));
+            Assert::IsFalse(dir.FileExists(L"ConfigBackup\\update.log"));
+
+            // === Installer runs: some files get corrupted (the #46179 scenario) ===
+            // Workspaces JSON filled with null bytes
+            dir.WriteFileBytes(L"Workspaces\\workspaces.json", std::vector<char>(512, '\0'));
+            // Main settings partially corrupted (null bytes injected)
+            std::vector<char> partialCorrupt = { '{', '"', 's', '\0', '\0', '\0', '\0', '}' };
+            dir.WriteFileBytes(L"settings.json", partialCorrupt);
+
+            // FancyZones, KBM, and MWB survive the install fine
+            // (this is realistic - not all files get corrupted)
+
+            // === Stage 2: Restore after install completes ===
+            updating::RestoreCorruptedConfigs(dir.path());
+
+            // === Verify: PT relaunches and finds working configs ===
+
+            // Corrupted files should be restored from backup
+            Assert::IsFalse(updating::IsJsonFileCorrupted(dir.path() / L"settings.json"));
+            Assert::IsFalse(updating::IsJsonFileCorrupted(dir.path() / L"Workspaces\\workspaces.json"));
+            Assert::AreEqual(
+                std::string(R"({"startup":true,"theme":"dark","run_elevated":false,"download_updates_automatically":true})"),
+                dir.ReadFile(L"settings.json"));
+            Assert::AreEqual(
+                std::string(R"({"workspaces":[{"name":"dev","apps":["code","terminal"]}]})"),
+                dir.ReadFile(L"Workspaces\\workspaces.json"));
+
+            // Clean files should be untouched (not overwritten with backup)
+            Assert::AreEqual(
+                std::string(R"({"zones":[{"id":1,"rect":{"x":0,"y":0,"w":960,"h":1080}}]})"),
+                dir.ReadFile(L"FancyZones\\settings.json"));
+            Assert::AreEqual(
+                std::string(R"({"remapKeys":{"inProcess":[{"original":"0x41","new":"0x42"}]}})"),
+                dir.ReadFile(L"KeyboardManager\\default.json"));
+            Assert::AreEqual(
+                std::string(R"({"machineKey":"abc123","connectToAll":true})"),
+                dir.ReadFile(L"MouseWithoutBorders\\settings.json"));
+        }
+
+        // Tests upgrade from an old version that has fewer modules than the new version.
+        // Verifies that new module configs (created by the installer) are not touched
+        // by restore, while corrupted old configs are restored.
+        // Covers: configBackup.h RestoreCorruptedConfigs — module dir in root that
+        //         has no corresponding backup entry.
+        // Setup: Old version with 1 module -> backup -> new installer adds module -> corrupt old -> restore.
+        TEST_METHOD(SimulateUpgradeFromVeryOldVersion)
+        {
+            TempDir dir;
+
+            // Old version had fewer modules - only settings.json
+            dir.WriteFile(L"settings.json", R"({"theme":"dark","powertoys_version":"v0.60.0"})");
+
+            // Backup
+            updating::BackupConfigFiles(dir.path());
+
+            // New installer creates new module dirs that didn't exist before
+            dir.WriteFile(L"NewModule\\settings.json", R"({"enabled":true})");
+
+            // Old settings get corrupted during upgrade
+            dir.WriteFileBytes(L"settings.json", std::vector<char>(100, '\0'));
+
+            // Restore
+            updating::RestoreCorruptedConfigs(dir.path());
+
+            // Old settings restored
+            Assert::AreEqual(
+                std::string(R"({"theme":"dark","powertoys_version":"v0.60.0"})"),
+                dir.ReadFile(L"settings.json"));
+
+            // New module settings untouched (no backup existed for them)
+            Assert::AreEqual(
+                std::string(R"({"enabled":true})"),
+                dir.ReadFile(L"NewModule\\settings.json"));
+        }
+    };
+
+    // Tests for the update lifecycle: argument passing between Stage 1 and Stage 2,
+    // relaunch path construction, and the handoff that was broken in #42004/#43011/#44071.
+    TEST_CLASS(UpdateLifecycleTests)
+    {
+    public:
+        // Tests BuildStage2Arguments: output contains the stage 2 flag, installer path,
+        // and install directory — all three components needed for Stage 2.
+        // Covers: updateLifecycle.h BuildStage2Arguments — concatenation logic.
+        // Setup: Typical paths with spaces (Program Files).
+        TEST_METHOD(BuildStage2ArgumentsContainsInstallerAndInstallDir)
+        {
+            const auto args = updating::BuildStage2Arguments(
+                L"-update_now_stage_2",
+                L"C:\\Users\\test\\AppData\\Local\\PowerToys\\Updates\\powertoyssetup-x64.exe",
+                L"C:\\Program Files\\PowerToys");
+
+            // Must contain the stage 2 flag
+            Assert::IsTrue(args.find(L"-update_now_stage_2") != std::wstring::npos);
+            // Must contain the installer path (quoted)
+            Assert::IsTrue(args.find(L"powertoyssetup-x64.exe") != std::wstring::npos);
+            // Must contain the install directory (quoted) — this was MISSING before our fix
+            Assert::IsTrue(args.find(L"C:\\Program Files\\PowerToys") != std::wstring::npos);
+        }
+
+        // Tests BuildStage2Arguments: both paths are wrapped in double quotes to
+        // survive CommandLineToArgvW parsing when paths contain spaces.
+        // Covers: updateLifecycle.h BuildStage2Arguments — quote wrapping.
+        // Setup: Installer path with spaces.
+        TEST_METHOD(BuildStage2ArgumentsQuotesBothPaths)
+        {
+            const auto args = updating::BuildStage2Arguments(
+                L"-update_now_stage_2",
+                L"C:\\path with spaces\\installer.exe",
+                L"C:\\Program Files\\PowerToys");
+
+            // Count quotes — should have 4 (open/close for each path)
+            size_t quoteCount = std::count(args.begin(), args.end(), L'"');
+            Assert::AreEqual(size_t{ 4 }, quoteCount);
+        }
+
+        // Tests BuildPowerToysExePath: appends "PowerToys.exe" to the install dir.
+        // Covers: updateLifecycle.h BuildPowerToysExePath — fs::path / operator.
+        // Setup: Standard install path without trailing backslash.
+        TEST_METHOD(BuildPowerToysExePathAppendsExeName)
+        {
+            const auto path = updating::BuildPowerToysExePath(L"C:\\Program Files\\PowerToys");
+            Assert::AreEqual(std::wstring(L"C:\\Program Files\\PowerToys\\PowerToys.exe"), path);
+        }
+
+        // Tests BuildPowerToysExePath: trailing backslash does not produce double
+        // backslash (e.g., "...PowerToys\\PowerToys.exe").
+        // Covers: updateLifecycle.h BuildPowerToysExePath — fs::path normalizes separators.
+        // Setup: Install path with trailing backslash.
+        TEST_METHOD(BuildPowerToysExePathHandlesTrailingBackslash)
+        {
+            const auto path = updating::BuildPowerToysExePath(L"C:\\Program Files\\PowerToys\\");
+            Assert::AreEqual(std::wstring(L"C:\\Program Files\\PowerToys\\PowerToys.exe"), path);
+        }
+
+        // Tests BuildPowerToysExePath: empty string produces just "PowerToys.exe".
+        // Covers: updateLifecycle.h BuildPowerToysExePath — fs::path with empty input.
+        // Setup: Empty install directory string.
+        TEST_METHOD(BuildPowerToysExePathHandlesEmptyString)
+        {
+            const auto path = updating::BuildPowerToysExePath(L"");
+            Assert::AreEqual(std::wstring(L"PowerToys.exe"), path);
+        }
+
+        // Tests CanRelaunchAfterUpdate: returns true when Stage 2 receives
+        // the install directory (argCount >= 4), false otherwise.
+        // This is the gate that prevents relaunch when using an old Stage 1
+        // that didn't pass the install dir (#42004/#43011/#44071).
+        // Covers: updateLifecycle.h CanRelaunchAfterUpdate.
+        TEST_METHOD(CanRelaunchReflectsArgCount)
+        {
+            // Old Stage 1 (pre-fix): only passed action + installer = 3 args
+            Assert::IsFalse(updating::CanRelaunchAfterUpdate(0));
+            Assert::IsFalse(updating::CanRelaunchAfterUpdate(1));
+            Assert::IsFalse(updating::CanRelaunchAfterUpdate(2));
+            Assert::IsFalse(updating::CanRelaunchAfterUpdate(3));
+
+            // New Stage 1 (post-fix): passes action + installer + installDir = 4 args
+            Assert::IsTrue(updating::CanRelaunchAfterUpdate(4));
+            Assert::IsTrue(updating::CanRelaunchAfterUpdate(5));
+        }
+
+        // Tests BuildStage2Arguments + CommandLineToArgvW round-trip: the exact
+        // scenario where Stage 1 builds args and Windows parses them in Stage 2.
+        // Verifies quoting is correct so paths with spaces survive the round trip.
+        // Covers: updateLifecycle.h BuildStage2Arguments — quote correctness.
+        // Setup: Realistic paths with spaces and version numbers.
+        TEST_METHOD(Stage2ArgumentsCanBeRoundTrippedThroughCommandLineToArgvW)
+        {
+            const std::wstring installerPath = L"C:\\Users\\test user\\AppData\\Local\\PowerToys\\Updates\\powertoyssetup-0.86.0-x64.exe";
+            const std::wstring installDir = L"C:\\Program Files\\PowerToys";
+
+            const auto args = updating::BuildStage2Arguments(L"-update_now_stage_2", installerPath, installDir);
+
+            // Simulate what Windows does: prepend a fake exe name and parse
+            std::wstring commandLine = L"PowerToys.Update.exe " + args;
+
+            int argc = 0;
+            LPWSTR* argv = CommandLineToArgvW(commandLine.c_str(), &argc);
+            Assert::IsNotNull(argv);
+            Assert::AreEqual(4, argc);
+            Assert::AreEqual(std::wstring(L"-update_now_stage_2"), std::wstring(argv[1]));
+            Assert::AreEqual(installerPath, std::wstring(argv[2]));
+            Assert::AreEqual(installDir, std::wstring(argv[3]));
+
+            LocalFree(argv);
+        }
+    };
+}

src/common/updating/UnitTests/UpdatingUnitTests.vcxproj

@@ -0,0 +1,45 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Label="Globals">
+    <VCProjectVersion>16.0</VCProjectVersion>
+    <ProjectGuid>{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}</ProjectGuid>
+    <Keyword>Win32Proj</Keyword>
+    <RootNamespace>UpdatingUnitTests</RootNamespace>
+    <ProjectSubType>NativeUnitTestProject</ProjectSubType>
+    <ProjectName>Updating.UnitTests</ProjectName>
+  </PropertyGroup>
+  <PropertyGroup Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseOfMfc>false</UseOfMfc>
+
+    <OutDir>$(SolutionDir)$(Platform)\$(Configuration)\tests\UpdatingUnitTests\</OutDir>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="Shared">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <ItemDefinitionGroup>
+    <ClCompile>
+      <AdditionalIncludeDirectories>..\;..\..\;..\..\..\;$(VCInstallDir)UnitTest\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+    </ClCompile>
+    <Link>
+      <AdditionalLibraryDirectories>$(VCInstallDir)UnitTest\lib;%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClCompile Include="UpdatingTests.cpp" />
+    <ClCompile Include="pch.cpp">
+      <PrecompiledHeader Condition="'$(UsePrecompiledHeaders)' != 'false'">Create</PrecompiledHeader>
+    </ClCompile>
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="pch.h" />
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+</Project>

src/common/updating/UnitTests/pch.cpp

@@ -0,0 +1,5 @@
+// Copyright (c) Microsoft Corporation
+// The Microsoft Corporation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+#include "pch.h"

src/common/updating/UnitTests/pch.h

@@ -0,0 +1,17 @@
+// Copyright (c) Microsoft Corporation
+// The Microsoft Corporation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+#ifndef PCH_H
+#define PCH_H
+
+#include <atomic>
+#include <Windows.h>
+
+// Suppressing 26466 - Don't use static_cast downcasts - in CppUnitTest.h
+#pragma warning(push)
+#pragma warning(disable : 26466)
+#include "CppUnitTest.h"
+#pragma warning(pop)
+
+#endif //PCH_H

src/common/updating/configBackup.h

@@ -0,0 +1,170 @@
+// Copyright (c) Microsoft Corporation
+// The Microsoft Corporation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+#pragma once
+
+#include <filesystem>
+#include <fstream>
+#include <string>
+
+namespace updating
+{
+    namespace fs = std::filesystem;
+
+    // Check if a JSON file is corrupted (contains null bytes, as seen in #46179)
+    inline bool IsJsonFileCorrupted(const fs::path& filePath)
+    {
+        try
+        {
+            std::ifstream file(filePath, std::ios::binary);
+            if (!file.is_open())
+            {
+                return false;
+            }
+
+            constexpr size_t c_readChunkSize{ 4096 };
+            char buffer[c_readChunkSize];
+            while (file.read(buffer, c_readChunkSize) || file.gcount() > 0)
+            {
+                const auto bytesRead = file.gcount();
+                for (std::streamsize i = 0; i < bytesRead; ++i)
+                {
+                    if (buffer[i] == '\0')
+                    {
+                        return true;
+                    }
+                }
+            }
+
+            return false;
+        }
+        catch (...)
+        {
+            return true;
+        }
+    }
+
+    // Backup all JSON config files before update to protect against corruption (#46179)
+    inline void BackupConfigFiles(const fs::path& rootPath)
+    {
+        try
+        {
+            const fs::path backupDir = rootPath / L"ConfigBackup";
+
+            std::error_code ec;
+            fs::remove_all(backupDir, ec);
+            // Note: remove_all failure means stale backup may persist; continue anyway
+            // since create_directories will overlay
+            fs::create_directories(backupDir, ec);
+            if (ec)
+            {
+                return;
+            }
+
+            for (const auto& entry : fs::directory_iterator(rootPath, ec))
+            {
+                if (ec)
+                {
+                    break;
+                }
+
+                if (entry.is_regular_file() && entry.path().extension() == L".json")
+                {
+                    fs::copy_file(entry.path(), backupDir / entry.path().filename(), fs::copy_options::overwrite_existing, ec);
+                }
+                else if (entry.is_directory())
+                {
+                    const auto dirName = entry.path().filename().wstring();
+                    if (dirName == L"ConfigBackup" || dirName == L"Updates")
+                    {
+                        continue;
+                    }
+
+                    const auto moduleBackup = backupDir / entry.path().filename();
+                    fs::create_directories(moduleBackup, ec);
+
+                    std::error_code moduleEc;
+                    for (const auto& moduleEntry : fs::directory_iterator(entry.path(), moduleEc))
+                    {
+                        if (moduleEc)
+                        {
+                            break;
+                        }
+
+                        if (moduleEntry.is_regular_file() && moduleEntry.path().extension() == L".json")
+                        {
+                            fs::copy_file(moduleEntry.path(), moduleBackup / moduleEntry.path().filename(), fs::copy_options::overwrite_existing, moduleEc);
+                        }
+                    }
+                }
+            }
+        }
+        catch (...)
+        {
+            // Intentionally swallowed — update must not fail due to backup errors.
+            // Logging would require spdlog dependency which is unavailable in test context.
+        }
+    }
+
+    // Restore JSON configs from backup if corruption is detected after update
+    inline void RestoreCorruptedConfigs(const fs::path& rootPath)
+    {
+        try
+        {
+            const fs::path backupDir = rootPath / L"ConfigBackup";
+
+            if (!fs::exists(backupDir))
+            {
+                return;
+            }
+
+            std::error_code ec;
+            for (const auto& backupEntry : fs::directory_iterator(backupDir, ec))
+            {
+                if (ec)
+                {
+                    break;
+                }
+
+                if (backupEntry.is_regular_file() && backupEntry.path().extension() == L".json")
+                {
+                    const auto originalPath = rootPath / backupEntry.path().filename();
+                    // Only restore if the backup itself is valid
+                    if (fs::exists(originalPath) && IsJsonFileCorrupted(originalPath) && !IsJsonFileCorrupted(backupEntry.path()))
+                    {
+                        fs::copy_file(backupEntry.path(), originalPath, fs::copy_options::overwrite_existing, ec);
+                    }
+                }
+                else if (backupEntry.is_directory())
+                {
+                    const auto moduleDir = rootPath / backupEntry.path().filename();
+
+                    std::error_code moduleEc;
+                    for (const auto& moduleBackupEntry : fs::directory_iterator(backupEntry.path(), moduleEc))
+                    {
+                        if (moduleEc)
+                        {
+                            break;
+                        }
+
+                        if (moduleBackupEntry.is_regular_file() && moduleBackupEntry.path().extension() == L".json")
+                        {
+                            const auto originalModulePath = moduleDir / moduleBackupEntry.path().filename();
+                            // Only restore if the backup itself is valid
+                            if (fs::exists(originalModulePath) && IsJsonFileCorrupted(originalModulePath) && !IsJsonFileCorrupted(moduleBackupEntry.path()))
+                            {
+                                fs::copy_file(moduleBackupEntry.path(), originalModulePath, fs::copy_options::overwrite_existing, moduleEc);
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        catch (...)
+        {
+            // Intentionally swallowed — update must not fail due to backup errors.
+            // Logging would require spdlog dependency which is unavailable in test context.
+        }
+    }
+}

src/common/updating/updateLifecycle.h

@@ -0,0 +1,47 @@
+// Copyright (c) Microsoft Corporation
+// The Microsoft Corporation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+#pragma once
+
+#include <filesystem>
+#include <string>
+
+namespace updating
+{
+    namespace fs = std::filesystem;
+
+    // Build the command-line arguments for Stage 2.
+    // Stage 1 passes the installer path and the PT install directory
+    // so Stage 2 can run the installer and relaunch PowerToys afterward.
+    // Note: paths containing embedded double-quote characters are not supported.
+    // This is safe because install paths come from get_module_folderpath().
+    inline std::wstring BuildStage2Arguments(
+        const std::wstring& stage2Flag,
+        const fs::path& installerPath,
+        const fs::path& installDir)
+    {
+        std::wstring arguments{ stage2Flag };
+        arguments += L" \"";
+        arguments += installerPath.c_str();
+        arguments += L"\" \"";
+        arguments += installDir.c_str();
+        arguments += L"\"";
+        return arguments;
+    }
+
+    // Build the full path to PowerToys.exe from the install directory.
+    // Used by Stage 2 to relaunch PT after a successful update.
+    inline std::wstring BuildPowerToysExePath(const std::wstring& installDir)
+    {
+        return (std::filesystem::path(installDir) / L"PowerToys.exe").wstring();
+    }
+
+    // Determine whether Stage 2 has enough information to relaunch PT.
+    // Returns true if the install directory argument was provided.
+    inline bool CanRelaunchAfterUpdate(int argCount)
+    {
+        // args[0]=exe, args[1]=action, args[2]=installer, args[3]=installDir
+        return argCount >= 4;
+    }
+}

src/runner/UpdateUtils.h

@@ -11,10 +11,7 @@ namespace cmdArg
     // restarting it from there, so it doesn't interfere with the installation process.
     const inline wchar_t* UPDATE_NOW_LAUNCH_STAGE1 = L"-update_now";
     // Stage 2 consists of starting the installer and optionally launching newly installed PowerToys binary.
-    // That's indicated by the following 2 flags.
     const inline wchar_t* UPDATE_NOW_LAUNCH_STAGE2 = L"-update_now_stage_2";
-    const inline wchar_t* UPDATE_STAGE2_RESTART_PT = L"restart";
-    const inline wchar_t* UPDATE_STAGE2_DONT_START_PT = L"dont_start";
 
     const inline wchar_t* UPDATE_REPORT_SUCCESS = L"-report_update_success";
 }

src/settings-ui/Settings.UI.Library/GeneralSettings.cs

@@ -111,7 +111,7 @@ namespace Microsoft.PowerToys.Settings.UI.Library
             QuickAccessShortcut = new HotkeySettings();
             IsElevated = false;
             ShowNewUpdatesToastNotification = true;
-            AutoDownloadUpdates = false;
+            AutoDownloadUpdates = true;
             EnableExperimentation = true;
             DashboardSortOrder = DashboardSortOrder.Alphabetical;
             Theme = "system";

src/settings-ui/Settings.UI.UnitTests/Cmd/SetSettingCommandTests.cs

@@ -56,7 +56,7 @@ public class SetSettingCommandTests
     }
 
     [DataRow(typeof(GeneralSettings), "Enabled.MouseWithoutBorders", "true")]
-    [DataRow(typeof(GeneralSettings), nameof(GeneralSettings.AutoDownloadUpdates), "true")]
+    [DataRow(typeof(GeneralSettings), nameof(GeneralSettings.AutoDownloadUpdates), "false")]
     [TestMethod]
     public void SetGeneralSetting(Type moduleSettingsType, string settingName, string newValueStr)
     {