[Bug]: Provider auto-update (npm install @latest) blocks backend cold start for ~47s

[bernardopg]

Area

apps/desktop (provider maintenance / backend startup)

Steps to reproduce

1. Have a CLI-backed provider enabled that is slightly out of date (in my case OpenCode / Codex).
2. Launch the desktop app (cold start).
3. Inspect the backend traces under ~/.t3/userdata/logs/server.trace.ndjson and desktop.trace.ndjson.

Expected behavior

Provider auto-update / maintenance should not block or significantly delay the backend becoming ready. The window/backend readiness should not wait on a network npm install, and any provider update should be deferred, backgrounded, and cancellable.

Actual behavior

On startup the backend runs a provider update that executes npm install <package>@latest and dominates the cold start. Slowest startup-phase spans from a single launch:

+3.75s   47729ms  ProviderMaintenanceRunner.updateProvider
+3.75s   47727ms  ProviderMaintenanceRunner.runProviderUpdate
+3.75s   47727ms  ProviderMaintenanceRunner.runCommandAndVerify
+3.75s   47727ms  ProviderMaintenanceRunner.runCommand
+3.75s   47061ms  ProviderMaintenanceRunner.collectCommandResult
+0.36s    3705ms  checkOpenCodeProviderStatus
+1.87s    1190ms  opencode.provider.list

desktop.backendManager.waitForHttpReady was ~12s; the provider update (npm install @latest) ran ~47s on top of that. The update command (${definition.npmPackageName}@latest) appears to run automatically as part of maintenance rather than only when the user accepts an update notification.

Impact

Major degradation or frequent failure (very slow / heavy cold start, especially on slow networks).

Version or commit

0.0.27 (Linux AppImage, packaged as the t3code-bin AUR package)

Environment

Arch Linux, Hyprland (Wayland), zsh. Providers enabled: Claude Agent, Codex. OpenCode present.

Logs or stack traces

updateProvider span attributes are empty, so the exact provider isn't recorded in the span; the surrounding activity (checkOpenCodeProviderStatus, opencode.provider.list) points to the OpenCode/Codex CLI being updated via npm.

Workaround

None found that is clean. There is a T3CODE_DISABLE_AUTO_UPDATE env var, but it appears to gate the Electron app updater, not provider maintenance. A documented way to disable provider auto-update at startup (or to make it strictly opt-in / background) would help.