fix(config): use app.isPackaged instead of resourcesPath to detect packaged build

process.resourcesPath is truthy in Electron dev mode too, making the dev
fallback in getTfStatePath() unreachable. Switch to app.isPackaged (via a
new readIsPackaged() helper, following the same lazy-require pattern as
readUserDataPath()) so the packaged-path branch only fires in a real
packaged build.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: CoderCoco

app/packages/desktop-main/src/services/ConfigService.test.ts

@@ -254,15 +254,17 @@ describe('ConfigService', () => {
       delete process.env['SERVER_CONFIG_PATH'];
     });
 
-    it('should return packaged tfstate path when readResourcesPath returns a value', () => {
-      vi.spyOn(service as unknown as { readResourcesPath: () => string | undefined }, 'readResourcesPath').mockReturnValue('/fake/resources');
+    it('should return packaged tfstate path when readIsPackaged returns true', () => {
+      type Internals = { readIsPackaged: () => boolean; readResourcesPath: () => string | undefined };
+      vi.spyOn(service as unknown as Internals, 'readIsPackaged').mockReturnValue(true);
+      vi.spyOn(service as unknown as Internals, 'readResourcesPath').mockReturnValue('/fake/resources');
       expect(service.getTfStatePath()).toBe(
         path.join('/fake/resources', 'terraform', 'aws', 'terraform.tfstate'),
       );
     });
 
-    it('should return the repo-relative fallback when readResourcesPath returns undefined', () => {
-      vi.spyOn(service as unknown as { readResourcesPath: () => string | undefined }, 'readResourcesPath').mockReturnValue(undefined);
+    it('should return the repo-relative fallback when readIsPackaged returns false', () => {
+      vi.spyOn(service as unknown as { readIsPackaged: () => boolean }, 'readIsPackaged').mockReturnValue(false);
       const result = service.getTfStatePath();
       expect(result).toMatch(/terraform[/\\]terraform\.tfstate$/);
       expect(path.isAbsolute(result)).toBe(true);

app/packages/desktop-main/src/services/ConfigService.ts

@@ -174,6 +174,24 @@ export class ConfigService {
     return (process as NodeJS.Process & { resourcesPath?: string }).resourcesPath;
   }
 
+  /**
+   * Return whether the app is running as a packaged Electron build
+   * (`electron.app.isPackaged`). `process.resourcesPath` is set in both dev
+   * and packaged Electron processes, so it cannot be used as a packaged-build
+   * guard — this method is the reliable alternative. Extracted as a protected
+   * method so tests can stub it via `vi.spyOn`.
+   */
+  protected readIsPackaged(): boolean {
+    if (!process.versions['electron']) return false;
+    try {
+      const _require = createRequire(import.meta.url);
+      const electron = _require('electron') as { app: { isPackaged: boolean } };
+      return electron.app.isPackaged;
+    } catch {
+      return false;
+    }
+  }
+
   /**
    * Return the Electron `userData` directory when running inside an Electron
    * process, or `null` otherwise. The `electron` module is required lazily at
@@ -198,16 +216,16 @@ export class ConfigService {
    *
    * Resolution order:
    *  1. `TF_STATE_PATH` env var — wins when set.
-   *  2. Electron packaged app — `<resourcesPath>/terraform/aws/terraform.tfstate`.
+   *  2. Electron packaged app (`app.isPackaged`) — `<resourcesPath>/terraform/aws/terraform.tfstate`.
    *  3. Dev/test fallback — repo root `terraform/terraform.tfstate`.
    */
   getTfStatePath(): string {
     const envOverride = process.env['TF_STATE_PATH'];
     if (envOverride) return envOverride;
 
-    const resourcesPath = this.readResourcesPath();
-    if (resourcesPath) {
-      return join(resourcesPath, 'terraform', 'aws', 'terraform.tfstate');
+    if (this.readIsPackaged()) {
+      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+      return join(this.readResourcesPath()!, 'terraform', 'aws', 'terraform.tfstate');
     }
 
     // Dev fallback: repo root is one level above _APP_ROOT (app/)