fix(restore): harden Electron state recovery

Restore workspace tabs without treating transient startup stops as user removals, hydrate saved session ancestry and metadata across worktree workspaces, and preserve scroll snapshots through cache eviction and late native seeding.

Keep Electron zoom consistent for native menu, keyboard, and wheel input across navigation and restart. Bound desktop shutdown, start CLI termination alongside state flushing, and use verified Windows process-tree escalation to avoid minute-long exits.

Treat Electron as a secondary client when a live Tauri marker already owns restoration, while retaining an independent CLI and manual workspace creation. Cancellation ownership is request-scoped so reused workspace launches cannot remove or retain the wrong instance.

Validated with UI and Electron typechecks, server typecheck, 67 Electron native tests, 54 focused restore tests, independent targeted reviews, and successful server/UI/Electron builds.

Author: pascalandr

packages/electron-app/electron/main/client-state-lifecycle.test.ts

@@ -7,7 +7,14 @@ import type { CliProcessManager } from "./process-manager"
 import type { WindowStateTracker } from "./window-state"
 
 const tick = () => new Promise((resolve) => setImmediate(resolve))
-function harness(options: { flush?: () => Promise<unknown>; timeout?: number; otherWindow?: boolean } = {}) {
+function harness(options: {
+  flush?: () => Promise<unknown>
+  stop?: () => Promise<void>
+  nativeFlush?: () => Promise<void>
+  timeout?: number
+  shutdownTimeout?: number
+  otherWindow?: boolean
+} = {}) {
   const windows = new Map<string, (event?: { preventDefault(): void }) => void>()
   const appEvents = new Map<string, (event?: { preventDefault(): void }) => void>()
   const calls: string[] = []
@@ -21,9 +28,9 @@ function harness(options: { flush?: () => Promise<unknown>; timeout?: number; ot
   const other = { isDestroyed: () => false } as BrowserWindow
   const app = { on: (name: string, handler: never) => appEvents.set(name, handler), quit: () => calls.push("quit"), exit: () => { exits++ } } as unknown as App
   const manager = { isPrimary: true, flush: async () => {}, drainAndReleasePrimary: async () => { calls.push("release") } } as ClientStateManager
-  const cli = { stop: async () => { calls.push("stop") } } as unknown as CliProcessManager
-  const lifecycle = new ClientStateLifecycle({ app, clientStateManager: manager, cliManager: cli, getMainWindow: () => window, getAllWindows: () => options.otherWindow ? [window, other] : [window], getAllowedRendererOrigins: () => ["http://127.0.0.1:43123"], isTrustedRendererOrigin: () => true, windowsSessionEndFlushTimeoutMs: options.timeout, rendererFlushTimeoutMs: options.timeout && options.timeout * 2, isWindows: true })
-  lifecycle.attachMainWindow(window, { flush: async () => { calls.push("native") } } as unknown as WindowStateTracker)
+  const cli = { stop: async () => { calls.push("stop"); await options.stop?.() } } as unknown as CliProcessManager
+  const lifecycle = new ClientStateLifecycle({ app, clientStateManager: manager, cliManager: cli, getMainWindow: () => window, getAllWindows: () => options.otherWindow ? [window, other] : [window], getAllowedRendererOrigins: () => ["http://127.0.0.1:43123"], isTrustedRendererOrigin: () => true, windowsSessionEndFlushTimeoutMs: options.timeout, rendererFlushTimeoutMs: options.timeout && options.timeout * 2, shutdownTimeoutMs: options.shutdownTimeout, isWindows: true })
+  lifecycle.attachMainWindow(window, { flush: async () => { calls.push("native"); await options.nativeFlush?.() } } as unknown as WindowStateTracker)
   lifecycle.registerAppEvents()
   const close = () => { let prevented = false; windows.get("close")?.({ preventDefault: () => { prevented = true } }); return prevented }
   return { appEvents, calls, close, exits: () => exits, lifecycle, window, windows }
@@ -58,7 +65,7 @@ test("late old-window detach preserves replacement tracker during shutdown", asy
   h.lifecycle.detachMainWindow(h.window)
   h.appEvents.get("before-quit")?.({ preventDefault: () => {} })
   await (h.lifecycle as any).shutdown
-  assert.deepEqual(h.calls, ["renderer", "replacement-native", "release", "stop"])
+  assert.deepEqual(h.calls, ["renderer", "stop", "replacement-native", "release"])
 })
 
 test("Windows session end flushes once and exits", async () => {
@@ -68,7 +75,7 @@ test("Windows session end flushes once and exits", async () => {
   h.windows.get("session-end")?.()
   await (h.lifecycle as any).sessionEnd; await tick()
   assert.equal(prevented, true)
-  assert.deepEqual(h.calls, ["renderer", "native", "release", "stop"])
+  assert.deepEqual(h.calls, ["renderer", "stop", "native", "release"])
   assert.equal(h.exits(), 1)
 })
 
@@ -79,6 +86,24 @@ test("session end promotes and bounds an already-hung ordinary shutdown", async
   h.windows.get("query-session-end")?.({ preventDefault: () => {} })
   await (h.lifecycle as any).sessionEnd; await tick()
   assert.ok(Date.now() - started < 500)
-  assert.deepEqual(h.calls, ["renderer"])
+  assert.deepEqual(h.calls, ["renderer", "stop"])
+  assert.equal(h.exits(), 1)
+})
+
+test("ordinary quit has an absolute deadline when CLI stop never settles", async () => {
+  const h = harness({ stop: () => new Promise(() => {}), shutdownTimeout: 20 })
+  h.appEvents.get("before-quit")?.({ preventDefault: () => {} })
+  await (h.lifecycle as any).shutdown
+  await tick()
+  assert.deepEqual(h.calls, ["renderer", "stop", "native", "release"])
+  assert.equal(h.exits(), 1)
+})
+
+test("CLI termination starts before a hung native flush reaches the absolute deadline", async () => {
+  const h = harness({ nativeFlush: () => new Promise(() => {}), shutdownTimeout: 20 })
+  h.appEvents.get("before-quit")?.({ preventDefault: () => {} })
+  await (h.lifecycle as any).shutdown
+  await tick()
+  assert.deepEqual(h.calls, ["renderer", "stop", "native"])
   assert.equal(h.exits(), 1)
 })

packages/electron-app/electron/main/client-state-lifecycle.ts

@@ -5,6 +5,7 @@ import { flushRendererClientStateBeforeShutdown } from "./renderer-client-state-
 import type { WindowStateTracker } from "./window-state"
 
 const WINDOWS_SESSION_END_FLUSH_TIMEOUT_MS = 1_500
+const SHUTDOWN_TIMEOUT_MS = 10_000
 
 interface ClientStateLifecycleDependencies {
   app: App
@@ -16,6 +17,7 @@ interface ClientStateLifecycleDependencies {
   isTrustedRendererOrigin(url: string, allowedOrigins: string[]): boolean
   windowsSessionEndFlushTimeoutMs?: number
   rendererFlushTimeoutMs?: number
+  shutdownTimeoutMs?: number
   isWindows?: boolean
 }
 
@@ -92,12 +94,25 @@ export class ClientStateLifecycle {
 
   private startShutdown(window: BrowserWindow | null): Promise<void> {
     if (this.shutdown) return this.shutdown
-    this.shutdown = (async () => {
-      await this.runStage("renderer shutdown flush", () => this.flushRenderer(window))
+    const stages = (async () => {
+      const rendererFlush = this.runStage("renderer shutdown flush", () => this.flushRenderer(window))
+      const cliStop = this.runStage("CLI stop", () => this.dependencies.cliManager.stop())
+      await rendererFlush
       await this.runStage("native shutdown flush", () => this.flushNative())
       await this.runStage("primary release", () => this.dependencies.clientStateManager.drainAndReleasePrimary())
-      await this.runStage("CLI stop", () => this.dependencies.cliManager.stop())
+      await cliStop
     })()
+    const timeoutMs = this.dependencies.shutdownTimeoutMs ?? SHUTDOWN_TIMEOUT_MS
+    let timeout: ReturnType<typeof setTimeout> | undefined
+    this.shutdown = Promise.race([
+      stages,
+      new Promise<void>((resolve) => { timeout = setTimeout(() => {
+        console.warn(`[client-state] desktop shutdown timed out after ${timeoutMs}ms; forcing exit`)
+        resolve()
+      }, timeoutMs) }),
+    ]).finally(() => {
+      if (timeout) clearTimeout(timeout)
+    })
     return this.shutdown
   }
 

packages/electron-app/electron/main/client-state-process.test.ts

@@ -8,11 +8,21 @@ import { tmpdir } from "node:os"
 import { join } from "node:path"
 import { fileURLToPath } from "node:url"
 import test from "node:test"
-import { cleanStaleRunningMarkers, createRunningMarker, electClientStateProcess, getRunningMarkerPath, REGISTRATION_LOCK_WAIT_MS, removeProcessOwnerLockIfOwned, removeRunningMarkerIfOwned, type ProcessOwner } from "./client-state-process"
+import { cleanStaleRunningMarkers, createRunningMarker, electClientStateProcess, getRunningMarkerPath, hasLiveTauriClient, REGISTRATION_LOCK_WAIT_MS, removeProcessOwnerLockIfOwned, removeRunningMarkerIfOwned, type ProcessOwner } from "./client-state-process"
 import { getProcessStartIdentity } from "./client-state-process-identity"
 
 function temp(t: test.TestContext) { const directory = mkdtempSync(join(tmpdir(), "codenomad-election-")); t.after(() => rmSync(directory, { recursive: true, force: true })); return directory }
 
+test("detects only live Tauri client-state markers", (t) => {
+  const directory = temp(t)
+  writeFileSync(join(directory, "client-state.running.123.1.lock"), "")
+  writeFileSync(join(directory, "client-state.running.456.2.lock"), "")
+  writeFileSync(join(directory, "unrelated.lock"), "")
+  assert.equal(hasLiveTauriClient(directory, (pid) => pid === 456), true)
+  assert.equal(hasLiveTauriClient(directory, () => false), false)
+  assert.equal(hasLiveTauriClient(join(directory, "missing"), () => true), false)
+})
+
 interface Child { process: ChildProcessWithoutNullStreams; result: Promise<{ isPrimary: boolean }> }
 function child(directory: string, start: string, wait = "", paused = "", release = ""): Child {
   const process = spawn(globalThis.process.execPath, ["--import", "tsx", fileURLToPath(new URL("./client-state-election-child.ts", import.meta.url)), directory, randomUUID(), start, wait, paused, release])

packages/electron-app/electron/main/client-state-process.ts

@@ -91,6 +91,25 @@ export function isPidAlive(pid: number): boolean {
   }
 }
 
+export function hasLiveTauriClient(
+  tauriDataPath: string,
+  pidAlive: (pid: number) => boolean = isPidAlive,
+): boolean {
+  let entries: string[]
+  try {
+    entries = readdirSync(tauriDataPath)
+  } catch (error) {
+    if (hasErrorCode(error, "ENOENT")) return false
+    throw error
+  }
+  return entries.some((name) => {
+    const match = /^client-state\.running\.(\d+)\..+\.lock$/.exec(name)
+    if (!match) return false
+    const pid = Number(match[1])
+    return Number.isInteger(pid) && pid > 0 && pid !== process.pid && pidAlive(pid)
+  })
+}
+
 export function classifyRunningMarker(
   markerOwner: ProcessOwner,
   currentOwner: ProcessOwner,

packages/electron-app/electron/main/client-state.test.ts

@@ -43,6 +43,23 @@ test("renderer access is exclusive per document and resettable", async (t) => {
   assert.equal(manager.claimClientStateAccess("document-2"), true)
 })
 
+test("a live Tauri owner blocks Electron snapshot restoration", async (t) => {
+  const directory = mkdtempSync(join(tmpdir(), "codenomad-cross-host-state-"))
+  t.after(() => rmSync(directory, { recursive: true, force: true }))
+  writeFileSync(join(directory, "client-state.json"), JSON.stringify({
+    version: 1,
+    restoreEnabled: true,
+    snapshot: { tabs: ["must-not-restore"] },
+  }))
+  const secondary = new ClientStateManager(directory, undefined, { primaryBlocked: true })
+  assert.deepEqual(secondary.loadClientState(), { isPrimary: false, restoreEnabled: true, snapshot: null })
+  await secondary.drainAndReleasePrimary()
+
+  const successor = new ClientStateManager(directory)
+  assert.equal(successor.isPrimary, true)
+  await successor.drainAndReleasePrimary()
+})
+
 test("failed preference and clear writes roll memory and suppression back", async (t) => {
   const h = harness(t)
   const manager = h.create()

packages/electron-app/electron/main/client-state.ts

@@ -109,7 +109,11 @@ export class ClientStateManager {
   private frozen = false
   private rendererAccessToken: string | undefined
 
-  constructor(userDataPath: string, private readonly writeState: ClientStateWriter = writeClientStateTemporary) {
+  constructor(
+    userDataPath: string,
+    private readonly writeState: ClientStateWriter = writeClientStateTemporary,
+    options?: { primaryBlocked?: boolean },
+  ) {
     mkdirSync(userDataPath, { recursive: true })
     this.userDataPath = userDataPath
     this.statePath = join(userDataPath, CLIENT_STATE_FILENAME)
@@ -123,6 +127,10 @@ export class ClientStateManager {
       (message, error) => console.warn(`[client-state] ${message}`, error),
     )
     this.primary = election
+    if (this.primary && options?.primaryBlocked) {
+      removeProcessOwnerLockIfOwned(this.lockPath, this.owner)
+      this.primary = false
+    }
     if (this.primary) {
       const persisted = this.readState()
       this.state = persisted.state

packages/electron-app/electron/main/main.ts

@@ -2,7 +2,7 @@ import { app, BrowserView, BrowserWindow, ipcMain, nativeImage, screen, session,
 import http from "node:http"
 import https from "node:https"
 import { existsSync, mkdirSync, rmSync } from "fs"
-import { dirname, join } from "path"
+import { dirname, isAbsolute, join } from "path"
 import { fileURLToPath } from "url"
 import { createApplicationMenu } from "./menu"
 import { ClientStateManager } from "./client-state"
@@ -13,10 +13,12 @@ import { setupCliIPC } from "./ipc"
 import { configureMediaPermissionHandlers, isAllowedRendererOrigin } from "./permissions"
 import { resolveConfiguredRendererOrigins } from "./renderer-origin"
 import { CliProcessManager } from "./process-manager"
+import { hasLiveTauriClient } from "./client-state-process"
 import {
   clampWindowBounds,
   DEFAULT_WINDOW_HEIGHT,
   DEFAULT_WINDOW_WIDTH,
+  installWindowZoomInput,
   restoreWindowState,
   WindowStateTracker,
 } from "./window-state"
@@ -94,7 +96,22 @@ function cleanupPackagedChromiumStorage() {
 
 cleanupPackagedChromiumStorage()
 
-const clientStateManager = new ClientStateManager(app.getPath("userData"))
+const linuxDataHome = process.env.XDG_DATA_HOME && isAbsolute(process.env.XDG_DATA_HOME)
+  ? process.env.XDG_DATA_HOME
+  : join(app.getPath("home"), ".local", "share")
+const tauriClientStatePath = process.platform === "linux"
+  ? join(linuxDataHome, "ai.neuralnomads.codenomad.client")
+  : join(app.getPath("appData"), "ai.neuralnomads.codenomad.client")
+let tauriClientIsRunning = false
+try {
+  tauriClientIsRunning = hasLiveTauriClient(tauriClientStatePath)
+} catch (error) {
+  console.warn("[client-state] failed to inspect Tauri process markers; continuing conservatively as secondary", error)
+  tauriClientIsRunning = true
+}
+const clientStateManager = new ClientStateManager(app.getPath("userData"), undefined, {
+  primaryBlocked: tauriClientIsRunning,
+})
 const cliManager = new CliProcessManager()
 let mainWindow: BrowserWindow | null = null
 let currentCliUrl: string | null = null
@@ -392,6 +409,7 @@ function createWindow() {
       preload: getPreloadPath(),
       contextIsolation: true,
       nodeIntegration: false,
+      ...(savedWindowState ? { zoomFactor: savedWindowState.zoomFactor } : {}),
       spellcheck: !isMac,
       additionalArguments: ["--codenomad-window-context=local"],
     },
@@ -415,6 +433,10 @@ function createWindow() {
     restoreWindowState(window, savedWindowState, restoredBounds)
     windowStateTracker = new WindowStateTracker(window, clientStateManager, savedWindowState)
   }
+  installWindowZoomInput(window, (level) => {
+    if (windowStateTracker) windowStateTracker.setZoomLevel(level)
+    else window.webContents.setZoomLevel(level)
+  })
 
   setupNavigationGuards(window, navigationController)