fix(restore): close cross-host gatekeeper races

Recover stale cross-host ownership deterministically when Electron and Tauri start together, and fence Tauri renderer mutations against authority rotation through the final atomic replacement.

Preserve restored tabs and unsent drafts after non-authoritative workspace stops, reject stale HTTP message hydration after newer SSE updates, and serialize Electron CLI lifecycle operations so restart cannot race shutdown or spawn an untracked server.

Flush Tauri client state before stopping the CLI, align shared window geometry on outer position plus content size, and discard incompatible legacy native bounds during migration.

Validated with 92 Electron native tests, 71 focused UI tests, 38 Tauri client-state tests, 7 Tauri shutdown tests, all affected typechecks, cargo check, focused rustfmt, and the Electron production build.

Author: pascalandr

packages/electron-app/electron/main/client-state-cross-host.test.ts

@@ -122,6 +122,25 @@ test("stale recovery is identity guarded and blocked by live or uncertain partic
   assert.equal(blocked.isPrimary, false)
 })
 
+test("simultaneous claimants deterministically recover a stale owner", (t) => {
+  const directory = temp(t), staleDirectory = join(directory, CROSS_HOST_OWNER_DIRECTORY)
+  const stale = owner(601, "stale"), first = owner(602, "a"), second = owner(603, "b")
+  mkdirSync(staleDirectory)
+  const observed = JSON.stringify(stale)
+  writeFileSync(join(staleDirectory, "owner.json"), observed)
+  writeFileSync(join(directory, "participant.603.b.json"), JSON.stringify(second))
+  writeFileSync(join(directory, "recovery.603.b.claim"), observed)
+  const identities = new Map([[602, first.processStartIdentity], [603, second.processStartIdentity]])
+  const deps = {
+    pidAlive: (pid: number) => pid !== stale.pid,
+    processStartIdentity: (pid: number) => identities.get(pid),
+  }
+  const winner = CrossHostRegistration.register(directory, first, true, deps)!
+  const loser = CrossHostRegistration.register(directory, second, true, deps)!
+  assert.equal(winner.isPrimary, true)
+  assert.equal(loser.isPrimary, false)
+})
+
 test("ordinary release removes only its participant", (t) => {
   const directory = temp(t)
   const registration = CrossHostRegistration.register(directory, owner(401, "primary"), true, dependencies(true, "primary-start"))!

packages/electron-app/electron/main/client-state-cross-host.ts

@@ -9,6 +9,8 @@ export const CROSS_HOST_OWNER_DIRECTORY = "primary.owner.json"
 const OWNER_FILENAME = "owner.json"
 const PARTICIPANT_PREFIX = "participant."
 const PARTICIPANT_SUFFIX = ".json"
+const RECOVERY_PREFIX = "recovery."
+const RECOVERY_SUFFIX = ".claim"
 const RETIRED_PREFIX = "retired."
 const ACQUIRE_ATTEMPTS = 10
 
@@ -130,6 +132,10 @@ function participantPath(directory: string, owner: ProcessOwner): string {
   return join(directory, `${PARTICIPANT_PREFIX}${owner.pid}.${owner.runToken}${PARTICIPANT_SUFFIX}`)
 }
 
+function recoveryPath(directory: string, owner: ProcessOwner): string {
+  return join(directory, `${RECOVERY_PREFIX}${owner.pid}.${owner.runToken}${RECOVERY_SUFFIX}`)
+}
+
 function publishParticipant(path: string, owner: ProcessOwner): void {
   const value = serializeOwner(owner)
   try { publishFile(path, value) } catch (error) {
@@ -156,22 +162,37 @@ function removeParticipantIfOwned(path: string, owner: ProcessOwner): void {
   }
 }
 
-function hasLiveParticipants(directory: string, current: ProcessOwner, dependencies: CrossHostLeaseDependencies): boolean {
+function recoveryClaimants(
+  directory: string,
+  current: ProcessOwner,
+  observedOwner: string,
+  dependencies: CrossHostLeaseDependencies,
+): ProcessOwner[] | undefined {
+  const claimants = [current]
   for (const name of readdirSync(directory)) {
     if (!name.startsWith(PARTICIPANT_PREFIX) || !name.endsWith(PARTICIPANT_SUFFIX)) continue
     const path = join(directory, name)
     const participant = parseOwner(readIfExists(path) ?? "")
-    if (!participant) return true
+    if (!participant) return undefined
     if (sameOwner(participant, current)) continue
     const stale = ownerIsStale(participant, dependencies)
-    if (stale !== true) return true
-    removeParticipantIfOwned(path, participant)
+    if (stale === true) {
+      removeParticipantIfOwned(path, participant)
+      try { unlinkSync(recoveryPath(directory, participant)) } catch {}
+      continue
+    }
+    if (readIfExists(recoveryPath(directory, participant)) !== observedOwner) return undefined
+    claimants.push(participant)
   }
-  return false
+  return claimants
 }
 
 function retireOwner(directory: string, observed: string, owner: ProcessOwner, claimant: ProcessOwner, dependencies: CrossHostLeaseDependencies): boolean {
-  if (ownerIsStale(owner, dependencies) !== true || hasLiveParticipants(directory, claimant, dependencies)) return false
+  if (ownerIsStale(owner, dependencies) !== true) return false
+  const claimants = recoveryClaimants(directory, claimant, observed, dependencies)
+  if (!claimants) return false
+  claimants.sort((left, right) => serializeOwner(left) < serializeOwner(right) ? -1 : 1)
+  if (!sameOwner(claimants[0]!, claimant)) return false
   if (readIfExists(ownerPath(directory)) !== observed) return false
   const retired = join(directory, `${RETIRED_PREFIX}${owner.pid}.${owner.runToken}`)
   try {
@@ -220,6 +241,7 @@ export class CrossHostRegistration {
     private readonly directory: string,
     readonly owner: ProcessOwner,
     private readonly participant: string,
+    private readonly recoveryClaim: string | undefined,
     private primary: boolean,
   ) {}
 
@@ -237,6 +259,7 @@ export class CrossHostRegistration {
     publishParticipant(participant, owner)
     dependencies.onParticipantPublished?.()
     let primary = false
+    let recoveryClaim: string | undefined
     try {
       if (typeof primaryCandidate === "function" ? primaryCandidate() : primaryCandidate) {
         for (let attempt = 0; attempt < ACQUIRE_ATTEMPTS; attempt += 1) {
@@ -246,12 +269,19 @@ export class CrossHostRegistration {
           const existing = parseOwner(observed)
           if (!existing) break
           if (sameOwner(existing, owner)) { primary = true; break }
+          if (ownerIsStale(existing, dependencies) === true) {
+            recoveryClaim ??= recoveryPath(directory, owner)
+            try { publishFile(recoveryClaim, observed) } catch (error) {
+              if (!hasErrorCode(error, "EEXIST") || readIfExists(recoveryClaim) !== observed) throw error
+            }
+          }
           if (!retireOwner(directory, observed, existing, owner, dependencies)) break
         }
       }
-      return new CrossHostRegistration(directory, owner, participant, primary)
+      return new CrossHostRegistration(directory, owner, participant, recoveryClaim, primary)
     } catch (error) {
       removeParticipantIfOwned(participant, owner)
+      if (recoveryClaim) try { unlinkSync(recoveryClaim) } catch {}
       throw error
     }
   }
@@ -265,6 +295,7 @@ export class CrossHostRegistration {
   release(): boolean {
     if (this.released) return false
     removeParticipantIfOwned(this.participant, this.owner)
+    if (this.recoveryClaim) try { unlinkSync(this.recoveryClaim) } catch {}
     this.primary = false
     this.released = true
     return true

packages/electron-app/electron/main/client-state-lifecycle.test.ts

@@ -27,7 +27,7 @@ function harness(options: {
   const other = { isDestroyed: () => false, hide: () => { calls.push("hide-other") } } as unknown as BrowserWindow
   const app = { on: (name: string, handler: never) => appEvents.set(name, handler), quit: () => calls.push("quit"), exit: () => { exits++ } } as unknown as App
   const manager = { isPrimary: true, flush: async () => {}, drainAndReleasePrimary: async () => { calls.push("release") } } as ClientStateManager
-  const cli = { stop: async () => { calls.push("stop"); await options.stop?.() } } as unknown as CliProcessManager
+  const cli = { shutdown: async () => { calls.push("stop"); await options.stop?.() } } as unknown as CliProcessManager
   const lifecycle = new ClientStateLifecycle({ app, clientStateManager: manager, cliManager: cli, getMainWindow: () => window, getAllWindows: () => options.otherWindow ? [window, other] : [window], getAllowedRendererOrigins: () => ["http://127.0.0.1:43123"], isTrustedRendererOrigin: () => true, isWindows: true })
   lifecycle.attachMainWindow(window, { flush: async () => { calls.push("native"); await options.nativeFlush?.() } } as unknown as WindowStateTracker)
   lifecycle.registerAppEvents()

packages/electron-app/electron/main/client-state-lifecycle.ts

@@ -94,7 +94,7 @@ export class ClientStateLifecycle {
     if (this.shutdown) return this.shutdown
     const stages = (async () => {
       const rendererFlush = this.runStage("renderer shutdown flush", () => this.flushRenderer(window))
-      const cliStop = this.dependencies.cliManager.stop().then(() => null, (error: unknown) => error)
+      const cliStop = this.dependencies.cliManager.shutdown().then(() => null, (error: unknown) => error)
       await rendererFlush
       await this.runStage("native shutdown flush", () => this.flushNative())
       const cliError = await cliStop

packages/electron-app/electron/main/client-state.test.ts

@@ -85,9 +85,15 @@ test("first shared primary deterministically migrates legacy host envelopes", as
   mkdirSync(electron, { recursive: true }); mkdirSync(tauri, { recursive: true })
   t.after(() => rmSync(root, { recursive: true, force: true }))
   writeFileSync(join(electron, "client-state.json"), JSON.stringify({ version: 1, restoreEnabled: true, snapshot: { revision: 999, savedAt: 10, host: "electron" } }))
-  writeFileSync(join(tauri, "client-state.json"), JSON.stringify({ version: 1, restoreEnabled: true, snapshot: { savedAt: 20, host: "tauri" } }))
+  writeFileSync(join(tauri, "client-state.json"), JSON.stringify({
+    version: 1,
+    restoreEnabled: true,
+    snapshot: { savedAt: 20, host: "tauri" },
+    window: { bounds: { x: 10, y: 10, width: 1000, height: 700 }, maximized: false, fullscreen: false, zoomFactor: 1 },
+  }))
   const manager = new ClientStateManager(electron, undefined, { crossHostElectionDirectory: election, legacyTauriDataPath: tauri })
   assert.deepEqual(manager.loadClientState().snapshot, { savedAt: 20, host: "tauri" })
+  assert.equal(manager.getWindowState(), undefined)
   assert.equal(existsSync(join(electron, "client-state.json")), true)
   assert.equal(existsSync(join(tauri, "client-state.json")), true)
   await manager.drainAndReleasePrimary()

packages/electron-app/electron/main/client-state.ts

@@ -118,6 +118,7 @@ function legacyCandidate(path: string, host: "electron" | "tauri"): { host: stri
     const candidate = JSON.parse(readFileSync(path, "utf8")) as Record<string, unknown>
     if (!candidate || candidate.version !== CLIENT_STATE_VERSION) return undefined
     const parsed = parseClientState(JSON.stringify(candidate)).state
+    delete parsed.window
     const snapshot = candidate.snapshot as Record<string, unknown> | undefined
     const savedAt = typeof snapshot?.savedAt === "number" && Number.isFinite(snapshot.savedAt) ? snapshot.savedAt : -1
     return { host, state: parsed, savedAt, hasSnapshot: snapshot !== undefined }

packages/electron-app/electron/main/ipc.ts

@@ -41,8 +41,7 @@ export function setupCliIPC(mainWindow: BrowserWindow, cliManager: CliProcessMan
 
   ipcMain.handle("cli:restart", async () => {
     const devMode = process.env.NODE_ENV === "development"
-    await cliManager.stop()
-    return cliManager.start({ dev: devMode })
+    return cliManager.restart({ dev: devMode })
   })
 
   ipcMain.handle("dialog:open", async (_, request: DialogOpenRequest): Promise<DialogOpenResult> => {

packages/electron-app/electron/main/main.ts

@@ -384,6 +384,7 @@ function createWindow() {
   mainWindow = new BrowserWindow({
     width: restoredBounds?.width ?? DEFAULT_WINDOW_WIDTH,
     height: restoredBounds?.height ?? DEFAULT_WINDOW_HEIGHT,
+    useContentSize: true,
     ...(restoredBounds ? { x: restoredBounds.x, y: restoredBounds.y } : {}),
     minWidth: 800,
     minHeight: 600,

packages/electron-app/electron/main/process-manager.ts

@@ -14,6 +14,7 @@ import {
   forceCapturedProcessTree,
   stopManagedChild,
 } from "./process-stop"
+import { SerializedLifecycle } from "./serialized-lifecycle"
 import { buildUserShellCommand, getUserShellEnv, supportsUserShell } from "./user-shell"
 
 const nodeRequire = createRequire(import.meta.url)
@@ -139,10 +140,32 @@ export class CliProcessManager extends EventEmitter {
   private authCookieName = `${SESSION_COOKIE_NAME_PREFIX}_${process.pid}_${Date.now()}`
   private requestedStop = false
   private shutdownStatus: "complete" | "incomplete" | null = null
+  private lifecycle = new SerializedLifecycle()
 
-  async start(options: StartOptions): Promise<CliStatus> {
+  start(options: StartOptions): Promise<CliStatus> {
+    return this.lifecycle.enqueue(() => this.startNow(options))
+  }
+
+  restart(options: StartOptions): Promise<CliStatus> {
+    return this.lifecycle.enqueue(async () => {
+      await this.stopNow()
+      if (this.lifecycle.stopped) throw new Error("CLI process manager is shutting down")
+      return this.startNow(options)
+    })
+  }
+
+  stop(): Promise<void> {
+    return this.lifecycle.enqueue(() => this.stopNow())
+  }
+
+  shutdown(): Promise<void> {
+    return this.lifecycle.stop(() => this.stopNow())
+  }
+
+  private async startNow(options: StartOptions): Promise<CliStatus> {
+    if (this.lifecycle.stopped) throw new Error("CLI process manager is shutting down")
     if (this.child) {
-      await this.stop()
+      await this.stopNow()
       if (this.child) throw new Error("CLI process did not exit before restart")
     }
 
@@ -234,7 +257,7 @@ export class CliProcessManager extends EventEmitter {
     })
   }
 
-  async stop(): Promise<void> {
+  private async stopNow(): Promise<void> {
     const child = this.child
     if (!child) {
       this.updateStatus({ state: "stopped" })

packages/electron-app/electron/main/serialized-lifecycle.test.ts

@@ -0,0 +1,25 @@
+import assert from "node:assert/strict"
+import test from "node:test"
+import { SerializedLifecycle } from "./serialized-lifecycle"
+
+test("serializes operations and exposes shutdown before queued work resumes", async () => {
+  const lifecycle = new SerializedLifecycle()
+  let release!: () => void
+  const gate = new Promise<void>((resolve) => { release = resolve })
+  let active = 0, maximum = 0
+  const first = lifecycle.enqueue(async () => {
+    active += 1; maximum = Math.max(maximum, active)
+    await gate
+    active -= 1
+    if (lifecycle.stopped) throw new Error("stopped")
+  })
+  const second = lifecycle.enqueue(async () => {
+    active += 1; maximum = Math.max(maximum, active); active -= 1
+  })
+  const shutdown = lifecycle.stop(async () => {})
+  release()
+  await assert.rejects(first, /stopped/)
+  await second
+  await shutdown
+  assert.equal(maximum, 1)
+})