fix(restore): simplify persistence and harden cleanup

Consolidate the desktop restore lifecycle and its regression coverage while preserving primary-process ownership, renderer authorization, active drafts, attachments, session tombstones, and cancellation semantics.

Bound workspace launches end to end, retain cleanup ownership after unexpected exits, and use identity- and token-guarded portable POSIX process-group cleanup. This avoids the macOS all-process ps timeout without introducing an unverified PID fallback, with real Darwin integration tests for CI.

Harden packaged Electron origins, transactional Tauri navigation authority, and bounded Windows session-end shutdown. Validation covers Electron, Tauri, UI, and server focused suites plus all TypeScript typechecks.

Author: pascalandr

packages/electron-app/electron/main/client-state-election-child.ts

@@ -54,9 +54,9 @@ const election = electClientStateProcess(
   },
 )
 
-process.stdout.write(`${JSON.stringify({ isPrimary: election.isPrimary, owner, warnings })}\n`)
+process.stdout.write(`${JSON.stringify({ isPrimary: election, owner, warnings })}\n`)
 process.stdin.resume()
 process.stdin.once("end", () => {
-  removeRunningMarkerIfOwned(election.runningMarkerPath, owner)
+  removeRunningMarkerIfOwned(join(directory, `client-state.running.${owner.pid}.${owner.runToken}.json`), owner)
   removeProcessOwnerLockIfOwned(primaryLockPath, owner)
 })

packages/electron-app/electron/main/client-state-ipc-handlers.test.ts

@@ -0,0 +1,64 @@
+import assert from "node:assert/strict"
+import test from "node:test"
+import type { IpcMainInvokeEvent } from "electron"
+import { setupClientStateIPC } from "./client-state-ipc"
+
+function harness() {
+  const handlers = new Map<string, (event: IpcMainInvokeEvent, ...args: unknown[]) => unknown>()
+  const listeners = new Map<string, (...args: unknown[]) => void>()
+  const frame = { url: "http://127.0.0.1:3000/app" }
+  const webContents = {
+    mainFrame: frame,
+    getURL: () => "http://127.0.0.1:3000/app",
+    on: (event: string, listener: (...args: unknown[]) => void) => listeners.set(event, listener),
+  }
+  const window = { isDestroyed: () => false, webContents }
+  let current: typeof window | null = window
+  const calls: string[] = []
+  const state = {
+    claimClientStateAccess: (token: unknown) => { calls.push(`claim:${token}`); return true },
+    assertRendererAccessToken: (token: unknown) => calls.push(`assert:${token}`),
+    loadClientState: () => ({ isPrimary: true }),
+    saveClientState: () => true,
+    setRestoreEnabled: () => true,
+    clearClientState: () => true,
+    resetRendererAccessToken: () => calls.push("reset"),
+  }
+  const bind = setupClientStateIPC(
+    { handle: (channel, listener) => handlers.set(channel, listener) },
+    state as never,
+    () => current as never,
+    () => ["http://127.0.0.1:3000"],
+  )
+  bind(window as never)
+  return { calls, frame, handlers, listeners, setCurrent: (value: typeof window | null) => { current = value }, webContents, window }
+}
+
+test("IPC channels enforce the current main sender, frame, origin, and token", async () => {
+  const h = harness()
+  assert.deepEqual([...h.handlers.keys()], [
+    "client-state:claimAccess", "client-state:load", "client-state:save",
+    "client-state:setRestoreEnabled", "client-state:clear",
+  ])
+  const event = { sender: h.webContents, senderFrame: h.frame }
+  await h.handlers.get("client-state:claimAccess")!(event as never, "token")
+  await h.handlers.get("client-state:load")!(event as never, "token")
+  assert.deepEqual(h.calls, ["claim:token", "assert:token"])
+
+  for (const invalid of [
+    { sender: {}, senderFrame: h.frame },
+    { sender: h.webContents, senderFrame: { url: h.frame.url } },
+    { sender: h.webContents, senderFrame: { ...h.frame, url: "https://example.com" } },
+  ]) await assert.rejects(h.handlers.get("client-state:load")!(invalid as never, "token") as Promise<unknown>)
+})
+
+test("only the registered current window can reset renderer authority", () => {
+  const h = harness()
+  h.listeners.get("did-navigate")!({}, "http://127.0.0.1:3000/next")
+  h.listeners.get("render-process-gone")!()
+  assert.deepEqual(h.calls, ["reset", "reset"])
+  h.setCurrent(null)
+  h.listeners.get("did-navigate")!({}, "http://127.0.0.1:3000/late")
+  h.listeners.get("destroyed")!()
+  assert.deepEqual(h.calls, ["reset", "reset"])
+})

packages/electron-app/electron/main/client-state-ipc-handlers.ts

@@ -1,21 +1,22 @@
-import { ipcMain, type BrowserWindow, type IpcMainInvokeEvent } from "electron"
+import type { BrowserWindow, IpcMainInvokeEvent } from "electron"
 import type { ClientStateManager } from "./client-state"
-import {
-  createClientStateIPCHandlers,
-  createRendererAccessNavigationCommitHandler,
-} from "./client-state-ipc-handlers"
-import { isAllowedRendererOrigin } from "./permissions"
+import { shouldResetRendererAccessTokenForNavigation } from "./client-state-navigation"
+import { isAllowedRendererOrigin } from "./renderer-origin"
 
-function validateSender(event: IpcMainInvokeEvent, mainWindow: BrowserWindow, getAllowedOrigins: () => string[]) {
+interface IPCRegistrar {
+  handle(channel: string, listener: (event: IpcMainInvokeEvent, ...args: unknown[]) => unknown): void
+}
+
+function validateSender(event: IpcMainInvokeEvent, mainWindow: BrowserWindow | null, allowedOrigins: string[]) {
   if (
+    !mainWindow ||
     mainWindow.isDestroyed() ||
     event.sender !== mainWindow.webContents ||
     event.senderFrame !== mainWindow.webContents.mainFrame
   ) {
     throw new Error("Client state IPC is only available to the local main window")
   }
 
-  const allowedOrigins = getAllowedOrigins()
   const currentUrl = mainWindow.webContents.getURL()
   if (
     !isAllowedRendererOrigin(currentUrl, allowedOrigins) ||
@@ -27,42 +28,51 @@ function validateSender(event: IpcMainInvokeEvent, mainWindow: BrowserWindow, ge
 }
 
 export function setupClientStateIPC(
-  mainWindow: BrowserWindow,
+  ipcMain: IPCRegistrar,
   clientState: ClientStateManager,
-  getAllowedOrigins: () => string[],
+  getMainWindow: () => BrowserWindow | null,
+  getAllowedOrigins: (window: BrowserWindow | null) => string[],
 ) {
-  const handlers = createClientStateIPCHandlers(clientState)
-  const handleNavigationCommit = createRendererAccessNavigationCommitHandler(
-    clientState,
-    (url) => isAllowedRendererOrigin(url, getAllowedOrigins()),
-  )
-
-  ipcMain.handle("client-state:claimAccess", async (event, token: unknown) => {
-    validateSender(event, mainWindow, getAllowedOrigins)
-    return handlers.claimAccess(token)
-  })
-
-  ipcMain.handle("client-state:load", async (event, token: unknown) => {
-    validateSender(event, mainWindow, getAllowedOrigins)
-    return handlers.load(token)
-  })
-
-  ipcMain.handle("client-state:save", async (event, token: unknown, snapshot: unknown) => {
-    validateSender(event, mainWindow, getAllowedOrigins)
-    return handlers.save(token, snapshot)
+  const validate = (event: IpcMainInvokeEvent) => {
+    const window = getMainWindow()
+    validateSender(event, window, getAllowedOrigins(window))
+  }
+  const handle = (
+    channel: string,
+    operation: (argument: unknown) => unknown,
+  ) => ipcMain.handle(channel, async (event, token: unknown, argument: unknown) => {
+    validate(event)
+    clientState.assertRendererAccessToken(token)
+    return operation(argument)
   })
 
-  ipcMain.handle("client-state:setRestoreEnabled", async (event, token: unknown, enabled: unknown) => {
-    validateSender(event, mainWindow, getAllowedOrigins)
-    return handlers.setRestoreEnabled(token, enabled)
+  ipcMain.handle("client-state:claimAccess", async (event, token: unknown) => {
+    validate(event)
+    return clientState.claimClientStateAccess(token)
   })
-
-  ipcMain.handle("client-state:clear", async (event, token: unknown) => {
-    validateSender(event, mainWindow, getAllowedOrigins)
-    return handlers.clear(token)
+  handle("client-state:load", () => clientState.loadClientState())
+  handle("client-state:save", (snapshot) => clientState.saveClientState(snapshot))
+  handle("client-state:setRestoreEnabled", (enabled) => {
+    if (typeof enabled !== "boolean") throw new Error("Restore enabled must be a boolean")
+    return clientState.setRestoreEnabled(enabled)
   })
+  handle("client-state:clear", () => clientState.clearClientState())
 
-  mainWindow.webContents.on("did-navigate", (_event, url) => {
-    handleNavigationCommit(url, false, true)
-  })
+  return (window: BrowserWindow): void => {
+    window.webContents.on("did-navigate", (_event, url) => {
+      if (getMainWindow() === window && shouldResetRendererAccessTokenForNavigation(
+        url,
+        false,
+        true,
+        (target) => isAllowedRendererOrigin(target, getAllowedOrigins(window)),
+      )) {
+        clientState.resetRendererAccessToken()
+      }
+    })
+    const resetDestroyedRenderer = () => {
+      if (getMainWindow() === window) clientState.resetRendererAccessToken()
+    }
+    window.webContents.on("render-process-gone", resetDestroyedRenderer)
+    window.webContents.on("destroyed", resetDestroyedRenderer)
+  }
 }