fix(restore): share desktop state across hosts

Persist Electron and Tauri restore data in one cross-host envelope, migrate legacy host files deterministically, and prevent cleared state from being resurrected. Keep atomic replacements on the destination filesystem and normalize Tauri window bounds for HiDPI handoffs.

Delay capture until native flush listeners are ready, preserve the saved active tab and session IDs during startup, accept legacy unversioned snapshots, and hydrate incomplete session metadata without overwriting newer updates.

Validated with 89 Electron native tests, 69 focused UI tests, 36 Tauri client-state tests, UI/Electron typechecks, cargo check, rustfmt, and the Electron production build.

Author: pascalandr

packages/electron-app/electron/main/client-state-cross-host-child.ts

@@ -4,7 +4,7 @@ import { getProcessStartIdentity } from "./client-state-process-identity"
 import { isPidAlive } from "./client-state-process"
 import { ClientStateManager } from "./client-state"
 
-const [directory, startPath, readyPath, mode, userDataPath, participantReadyPath, participantContinuePath, legacyTauriDataPath] = process.argv.slice(2)
+const [directory, startPath, readyPath, mode, userDataPath, participantReadyPath, participantContinuePath, legacyTauriDataPath, operation, payload] = process.argv.slice(2)
 if (!directory || !startPath) throw new Error("Expected election directory and start path")
 if (readyPath) writeFileSync(readyPath, "")
 while (!existsSync(startPath)) Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 5)
@@ -32,7 +32,11 @@ const registration = owner && CrossHostRegistration.register(directory, owner, t
   onOwnerPrepared: mode === "owner-crash" ? () => process.exit(91) : undefined,
   onOwnerRetired: mode === "retire-crash" ? () => process.exit(91) : undefined,
 })
-process.stdout.write(`${JSON.stringify({ acquired: manager?.isPrimary ?? Boolean(registration?.isPrimary) })}\n`)
+if (manager?.isPrimary && operation === "save") await manager.saveClientState(JSON.parse(payload))
+process.stdout.write(`${JSON.stringify({
+  acquired: manager?.isPrimary ?? Boolean(registration?.isPrimary),
+  state: operation === "load" ? manager?.loadClientState() : undefined,
+})}\n`)
 process.stdin.resume()
 process.stdin.once("end", () => {
   if (manager) void manager.drainAndReleasePrimary().finally(() => process.exit())

packages/electron-app/electron/main/client-state-cross-host.test.ts

@@ -10,6 +10,7 @@ import {
   CrossHostRegistration,
   CROSS_HOST_OWNER_DIRECTORY,
   resolveCrossHostElectionDirectory,
+  resolveCrossHostStatePath,
   type CrossHostLeaseDependencies,
 } from "./client-state-cross-host"
 import type { ProcessOwner } from "./client-state-process"
@@ -150,4 +151,7 @@ test("platform paths match the Rust contract", () => {
   assert.equal(resolveCrossHostElectionDirectory({ HOME: "/Users/dev" }, "darwin", "/fallback"), posix.join("/Users/dev", ".codenomad", "client-state", "election"))
   assert.equal(resolveCrossHostElectionDirectory({ HOME: "/home/dev" }, "linux", "/fallback"), posix.join("/home/dev", ".codenomad", "client-state", "election"))
   assert.equal(resolveCrossHostElectionDirectory({ USERPROFILE: "", HOME: "D:\\Home" }, "win32", "C:\\Fallback"), win32.join("D:\\Home", ".codenomad", "client-state", "election"))
+  assert.equal(resolveCrossHostStatePath({ HOME: "/Users/dev" }, "darwin", "/fallback"), posix.join("/Users/dev", ".codenomad", "client-state", "client-state.json"))
+  assert.equal(resolveCrossHostStatePath({ HOME: "/home/dev" }, "linux", "/fallback"), posix.join("/home/dev", ".codenomad", "client-state", "client-state.json"))
+  assert.equal(resolveCrossHostStatePath({ USERPROFILE: "", HOME: "D:\\Home" }, "win32", "C:\\Fallback"), win32.join("D:\\Home", ".codenomad", "client-state", "client-state.json"))
 })

packages/electron-app/electron/main/client-state-cross-host.ts

@@ -43,6 +43,18 @@ export function resolveCrossHostElectionDirectory(
   return pathApi.join(configured ?? fallbackHome, ".codenomad", "client-state", "election")
 }
 
+export function resolveCrossHostStatePath(
+  environment: NodeJS.ProcessEnv = process.env,
+  platform: NodeJS.Platform = process.platform,
+  fallbackHome = homedir(),
+): string {
+  const pathApi = platform === "win32" ? win32 : posix
+  const configured = platform === "win32"
+    ? validHome(environment.USERPROFILE, platform) ?? validHome(environment.HOME, platform)
+    : validHome(environment.HOME, platform)
+  return pathApi.join(configured ?? fallbackHome, ".codenomad", "client-state", "client-state.json")
+}
+
 export function resolveLegacyTauriDataDirectory(
   environment: NodeJS.ProcessEnv = process.env,
   platform: NodeJS.Platform = process.platform,

packages/electron-app/electron/main/client-state.test.ts

@@ -1,5 +1,5 @@
 import assert from "node:assert/strict"
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs"
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs"
 import { writeFile } from "node:fs/promises"
 import { tmpdir } from "node:os"
 import { join } from "node:path"
@@ -79,6 +79,45 @@ test("cross-host ownership is required in addition to each host-local election",
   await successor.drainAndReleasePrimary()
 })
 
+test("first shared primary deterministically migrates legacy host envelopes", async (t) => {
+  const root = mkdtempSync(join(tmpdir(), "codenomad-migration-"))
+  const electron = join(root, "electron"), tauri = join(root, "tauri"), election = join(root, "shared", "election")
+  mkdirSync(electron, { recursive: true }); mkdirSync(tauri, { recursive: true })
+  t.after(() => rmSync(root, { recursive: true, force: true }))
+  writeFileSync(join(electron, "client-state.json"), JSON.stringify({ version: 1, restoreEnabled: true, snapshot: { revision: 999, savedAt: 10, host: "electron" } }))
+  writeFileSync(join(tauri, "client-state.json"), JSON.stringify({ version: 1, restoreEnabled: true, snapshot: { savedAt: 20, host: "tauri" } }))
+  const manager = new ClientStateManager(electron, undefined, { crossHostElectionDirectory: election, legacyTauriDataPath: tauri })
+  assert.deepEqual(manager.loadClientState().snapshot, { savedAt: 20, host: "tauri" })
+  assert.equal(existsSync(join(electron, "client-state.json")), true)
+  assert.equal(existsSync(join(tauri, "client-state.json")), true)
+  await manager.drainAndReleasePrimary()
+})
+
+test("legacy migration prefers disabled and ignores malformed candidates", async (t) => {
+  const root = mkdtempSync(join(tmpdir(), "codenomad-migration-"))
+  const electron = join(root, "electron"), tauri = join(root, "tauri"), election = join(root, "shared", "election")
+  mkdirSync(electron, { recursive: true }); mkdirSync(tauri, { recursive: true })
+  t.after(() => rmSync(root, { recursive: true, force: true }))
+  writeFileSync(join(electron, "client-state.json"), "malformed")
+  writeFileSync(join(tauri, "client-state.json"), JSON.stringify({ version: 1, restoreEnabled: false, snapshot: { savedAt: 1 } }))
+  const manager = new ClientStateManager(electron, undefined, { crossHostElectionDirectory: election, legacyTauriDataPath: tauri })
+  assert.deepEqual(manager.loadClientState(), { isPrimary: true, restoreEnabled: false, snapshot: null })
+  assert.equal(JSON.parse(readFileSync(join(root, "shared", "client-state.json"), "utf8")).restoreEnabled, false)
+  await manager.drainAndReleasePrimary()
+})
+
+test("legacy migration does not resurrect a snapshot after clear", async (t) => {
+  const root = mkdtempSync(join(tmpdir(), "codenomad-migration-"))
+  const electron = join(root, "electron"), tauri = join(root, "tauri"), election = join(root, "shared", "election")
+  mkdirSync(electron, { recursive: true }); mkdirSync(tauri, { recursive: true })
+  t.after(() => rmSync(root, { recursive: true, force: true }))
+  writeFileSync(join(electron, "client-state.json"), JSON.stringify({ version: 1, restoreEnabled: true }))
+  writeFileSync(join(tauri, "client-state.json"), JSON.stringify({ version: 1, restoreEnabled: true, snapshot: { savedAt: 20 } }))
+  const manager = new ClientStateManager(electron, undefined, { crossHostElectionDirectory: election, legacyTauriDataPath: tauri })
+  assert.equal(manager.loadClientState().snapshot, null)
+  await manager.drainAndReleasePrimary()
+})
+
 test("ownership loss immediately disables restore reads and mutations", async (t) => {
   const h = harness(t, {
     version: 1,

packages/electron-app/electron/main/client-state.ts

@@ -1,7 +1,7 @@
 import { randomUUID } from "node:crypto"
-import { mkdirSync, readFileSync } from "node:fs"
-import { rename, rm, writeFile } from "node:fs/promises"
-import { join } from "node:path"
+import { closeSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, writeFileSync } from "node:fs"
+import { open, rename, rm } from "node:fs/promises"
+import { dirname, join } from "node:path"
 import {
   electClientStateProcess,
   getRunningMarkerPath,
@@ -17,6 +17,7 @@ import {
   CrossHostRegistration,
   crossHostParticipants,
   resolveCrossHostElectionDirectory,
+  resolveCrossHostStatePath,
   resolveLegacyTauriDataDirectory,
   type CrossHostLeaseDependencies,
 } from "./client-state-cross-host"
@@ -69,7 +70,13 @@ interface ClientStateManagerOptions {
 }
 
 async function writeClientStateTemporary(temporaryPath: string, serializedState: string): Promise<void> {
-  await writeFile(temporaryPath, serializedState, { encoding: "utf8", mode: 0o600 })
+  const file = await open(temporaryPath, "w", 0o600)
+  try {
+    await file.writeFile(serializedState, "utf8")
+    await file.sync()
+  } finally {
+    await file.close()
+  }
 }
 
 interface ParsedClientState {
@@ -106,6 +113,19 @@ function parseClientState(value: string): ParsedClientState {
   }
 }
 
+function legacyCandidate(path: string, host: "electron" | "tauri"): { host: string; state: PersistedClientState; savedAt: number; hasSnapshot: boolean } | undefined {
+  try {
+    const candidate = JSON.parse(readFileSync(path, "utf8")) as Record<string, unknown>
+    if (!candidate || candidate.version !== CLIENT_STATE_VERSION) return undefined
+    const parsed = parseClientState(JSON.stringify(candidate)).state
+    const snapshot = candidate.snapshot as Record<string, unknown> | undefined
+    const savedAt = typeof snapshot?.savedAt === "number" && Number.isFinite(snapshot.savedAt) ? snapshot.savedAt : -1
+    return { host, state: parsed, savedAt, hasSnapshot: snapshot !== undefined }
+  } catch {
+    return undefined
+  }
+}
+
 export class ClientStateManager {
   private readonly userDataPath: string
   private readonly statePath: string
@@ -134,7 +154,11 @@ export class ClientStateManager {
     }
     mkdirSync(userDataPath, { recursive: true })
     this.userDataPath = userDataPath
-    this.statePath = join(userDataPath, CLIENT_STATE_FILENAME)
+    const crossHostElectionDirectory = options?.crossHostElectionDirectory ?? resolveCrossHostElectionDirectory()
+    this.statePath = options?.crossHostElectionDirectory
+      ? join(dirname(crossHostElectionDirectory), CLIENT_STATE_FILENAME)
+      : resolveCrossHostStatePath()
+    mkdirSync(dirname(this.statePath), { recursive: true })
     this.lockPath = join(userDataPath, PRIMARY_LOCK_FILENAME)
     const registrationLockPath = join(userDataPath, REGISTRATION_LOCK_FILENAME)
 
@@ -144,7 +168,6 @@ export class ClientStateManager {
       { primaryLockPath: this.lockPath, registrationLockPath },
       (message, error) => console.warn(`[client-state] ${message}`, error),
     )
-    const crossHostElectionDirectory = options?.crossHostElectionDirectory ?? resolveCrossHostElectionDirectory()
     const legacyTauriDataPath = options?.legacyTauriDataPath === undefined
       ? (options?.crossHostElectionDirectory ? null : resolveLegacyTauriDataDirectory())
       : options.legacyTauriDataPath
@@ -179,6 +202,10 @@ export class ClientStateManager {
       this.primary = false
     }
     if (this.isPrimary) {
+      this.migrateLegacyStateIfNeeded([
+        ["electron", join(userDataPath, CLIENT_STATE_FILENAME)],
+        ...(legacyTauriDataPath ? [["tauri", join(legacyTauriDataPath, CLIENT_STATE_FILENAME)] as const] : []),
+      ])
       const persisted = this.readState()
       this.state = persisted.state
       this.persistenceSuppressed = !this.state.restoreEnabled
@@ -335,6 +362,40 @@ export class ClientStateManager {
     }
   }
 
+  private migrateLegacyStateIfNeeded(paths: ReadonlyArray<readonly ["electron" | "tauri", string]>): void {
+    try {
+      readFileSync(this.statePath)
+      return
+    } catch (error) {
+      if (!hasErrorCode(error, "ENOENT")) return
+    }
+    const winner = paths
+      .map(([host, path]) => legacyCandidate(path, host))
+      .filter((candidate): candidate is NonNullable<typeof candidate> => Boolean(candidate))
+      .sort((left, right) =>
+        Number(left.state.restoreEnabled) - Number(right.state.restoreEnabled) ||
+        Number(left.hasSnapshot) - Number(right.hasSnapshot) ||
+        right.savedAt - left.savedAt ||
+        right.host.localeCompare(left.host),
+      )[0]
+    if (!winner) return
+
+    const temporaryPath = join(dirname(this.statePath), `.${CLIENT_STATE_FILENAME}.${this.owner.pid}.${this.owner.runToken}.migration.tmp`)
+    let descriptor: number | undefined
+    try {
+      descriptor = openSync(temporaryPath, "wx", 0o600)
+      writeFileSync(descriptor, JSON.stringify(winner.state), "utf8")
+      fsyncSync(descriptor)
+      closeSync(descriptor)
+      descriptor = undefined
+      this.assertReplacementAllowed()
+      renameSync(temporaryPath, this.statePath)
+    } finally {
+      if (descriptor !== undefined) closeSync(descriptor)
+      rm(temporaryPath, { force: true }).catch(() => {})
+    }
+  }
+
   private getMutationDisposition(futureEnvelopeResult = true): Promise<boolean> | undefined {
     if (!this.isPrimary) {
       return Promise.resolve(false)
@@ -376,7 +437,7 @@ export class ClientStateManager {
 
   private async writeAtomically(serializedState: string): Promise<void> {
     const temporaryPath = join(
-      this.userDataPath,
+      dirname(this.statePath),
       `.${CLIENT_STATE_FILENAME}.${this.owner.pid}.${this.owner.runToken}.tmp`,
     )
     try {