fix(restore): disable startup restore by default

New Electron, Tauri, and UI client state now starts with restoration disabled while preserving an explicitly persisted enabled preference. Parsing malformed or incomplete envelopes follows the same safe default across desktop hosts.

Tests that exercise persistence explicitly enable restoration, and the rebased interruption registry uses its public session-id view instead of stale internal maps.

Validation: UI and Electron typecheck passed; focused Rust tests reached 36/38 before the final fixture-only correction.

Author: pascalandr

packages/electron-app/electron/main/client-state-cross-host-child.ts

@@ -32,7 +32,10 @@ const registration = owner && CrossHostRegistration.register(directory, owner, t
   onOwnerPrepared: mode === "owner-crash" ? () => process.exit(91) : undefined,
   onOwnerRetired: mode === "retire-crash" ? () => process.exit(91) : undefined,
 })
-if (manager?.isPrimary && operation === "save") await manager.saveClientState(JSON.parse(payload))
+if (manager?.isPrimary && operation === "save") {
+  await manager.setRestoreEnabled(true)
+  await manager.saveClientState(JSON.parse(payload))
+}
 process.stdout.write(`${JSON.stringify({
   acquired: manager?.isPrimary ?? Boolean(registration?.isPrimary),
   state: operation === "load" ? manager?.loadClientState() : undefined,

packages/electron-app/electron/main/client-state-navigation.test.ts

@@ -32,6 +32,7 @@ test("renderer access resets only for trusted full main-frame navigation", () =>
 
 test("immediate reload flushes latest state before rotating document access", async (t) => {
   const manager = managerHarness(t)
+  await manager.setRestoreEnabled(true)
   manager.claimClientStateAccess("outgoing")
   const load = (token: string) => { manager.assertRendererAccessToken(token); return manager.loadClientState() }
   const save = (token: string, state: unknown) => { manager.assertRendererAccessToken(token); return manager.saveClientState(state) }

packages/electron-app/electron/main/client-state.test.ts

@@ -30,7 +30,7 @@ function harness(t: test.TestContext, initial?: object) {
 }
 
 test("renderer access is exclusive per document and resettable", async (t) => {
-  const manager = harness(t).create()
+  const manager = harness(t, { version: 1, restoreEnabled: true }).create()
   assert.throws(() => manager.claimClientStateAccess(""), /nonempty string/)
   assert.throws(() => manager.assertRendererAccessToken("unclaimed"), /has not been claimed/)
   assert.equal(manager.claimClientStateAccess("document-1"), true)
@@ -65,7 +65,7 @@ test("cross-host ownership is required in addition to each host-local election",
     crossHostDependencies,
     processOwner: { pid: 8102, runToken: "electron", processStartIdentity: "electron-start" },
   })
-  assert.deepEqual(secondary.loadClientState(), { isPrimary: false, restoreEnabled: true, snapshot: null })
+  assert.deepEqual(secondary.loadClientState(), { isPrimary: false, restoreEnabled: false, snapshot: null })
   await secondary.drainAndReleasePrimary()
 
   await primary.drainAndReleasePrimary()
@@ -134,13 +134,13 @@ test("ownership loss immediately disables restore reads and mutations", async (t
   const manager = h.create()
   writeFileSync(join(h.directory, "election", "primary.owner.json", "owner.json"), "malformed")
   assert.equal(manager.isPrimary, false)
-  assert.deepEqual(manager.loadClientState(), { isPrimary: false, restoreEnabled: true, snapshot: null })
+  assert.deepEqual(manager.loadClientState(), { isPrimary: false, restoreEnabled: false, snapshot: null })
   assert.equal(manager.getWindowState(), undefined)
   assert.equal(await manager.saveClientState({ ignored: true }), false)
 })
 
 test("failed preference and clear writes roll memory and suppression back", async (t) => {
-  const h = harness(t)
+  const h = harness(t, { version: 1, restoreEnabled: true })
   const manager = h.create()
   await manager.saveClientState({ kept: true })
   h.fail(true)
@@ -157,7 +157,7 @@ test("failed preference and clear writes roll memory and suppression back", asyn
 })
 
 test("successful clear suppresses saves, including after failed re-enable", async (t) => {
-  const h = harness(t)
+  const h = harness(t, { version: 1, restoreEnabled: true })
   const manager = h.create()
   await manager.saveClientState({ kept: true })
   await manager.clearClientState()
@@ -170,7 +170,7 @@ test("successful clear suppresses saves, including after failed re-enable", asyn
 })
 
 test("disabling restore atomically removes snapshot/window and survives restart", async (t) => {
-  const h = harness(t)
+  const h = harness(t, { version: 1, restoreEnabled: true })
   const manager = h.create(undefined, { pid: process.pid, runToken: "before-restart", processStartIdentity: "old-start" })
   await manager.saveClientState({ kept: true })
   await manager.saveWindowState({ bounds: { x: 10, y: 20, width: 1200, height: 800 }, maximized: true, fullscreen: false, zoomFactor: 1.25 })
@@ -188,7 +188,7 @@ test("disabling restore atomically removes snapshot/window and survives restart"
 })
 
 test("drain freezes mutations and waits for admitted writes", async (t) => {
-  const h = harness(t)
+  const h = harness(t, { version: 1, restoreEnabled: true })
   let started!: () => void
   let release!: () => void
   const began = new Promise<void>((resolve) => { started = resolve })
@@ -209,7 +209,7 @@ test("drain freezes mutations and waits for admitted writes", async (t) => {
 })
 
 test("an old writer cannot replace a successor after PID reuse", async (t) => {
-  const h = harness(t)
+  const h = harness(t, { version: 1, restoreEnabled: true })
   let started!: () => void
   let release!: () => void
   const began = new Promise<void>((resolve) => { started = resolve })
@@ -234,15 +234,15 @@ test("future envelopes are preserved until a successful explicit clear", async (
   const future = { version: 7, restoreEnabled: false, snapshot: { future: true }, futurePreference: "keep" }
   const h = harness(t, future)
   const manager = h.create(undefined, { pid: process.pid, runToken: "future-before-restart", processStartIdentity: "old-start" })
-  assert.deepEqual(manager.loadClientState(), { isPrimary: true, restoreEnabled: true, snapshot: null })
+  assert.deepEqual(manager.loadClientState(), { isPrimary: true, restoreEnabled: false, snapshot: null })
   assert.equal(await manager.saveClientState({ ignored: true }), true)
   assert.equal(await manager.setRestoreEnabled(false), false)
   assert.deepEqual(JSON.parse(readFileSync(h.statePath, "utf8")), future)
   await manager.drainAndReleasePrimary()
   const restarted = h.create()
   assert.deepEqual(JSON.parse(readFileSync(h.statePath, "utf8")), future)
   assert.equal(await restarted.clearClientState(), true)
-  assert.deepEqual(JSON.parse(readFileSync(h.statePath, "utf8")), { version: 1, restoreEnabled: true })
+  assert.deepEqual(JSON.parse(readFileSync(h.statePath, "utf8")), { version: 1, restoreEnabled: false })
   assert.equal(await restarted.saveClientState({ supported: true }), true)
   assert.deepEqual(JSON.parse(readFileSync(h.statePath, "utf8")).snapshot, { supported: true })
 })

packages/electron-app/electron/main/client-state.ts

@@ -85,7 +85,7 @@ interface ParsedClientState {
 }
 
 function parseClientState(value: string): ParsedClientState {
-  const defaults: PersistedClientState = { version: CLIENT_STATE_VERSION, restoreEnabled: true }
+  const defaults: PersistedClientState = { version: CLIENT_STATE_VERSION, restoreEnabled: false }
   try {
     const candidate = JSON.parse(value) as Record<string, unknown>
     if (candidate && typeof candidate.version === "number" && candidate.version > CLIENT_STATE_VERSION) {
@@ -97,7 +97,7 @@ function parseClientState(value: string): ParsedClientState {
 
     const state: PersistedClientState = {
       version: CLIENT_STATE_VERSION,
-      restoreEnabled: typeof candidate.restoreEnabled === "boolean" ? candidate.restoreEnabled : true,
+      restoreEnabled: typeof candidate.restoreEnabled === "boolean" ? candidate.restoreEnabled : false,
     }
     if (Object.prototype.hasOwnProperty.call(candidate, "snapshot")) {
       state.snapshot = candidate.snapshot
@@ -142,7 +142,7 @@ export class ClientStateManager {
   private readonly lockPath: string
   private readonly legacyTauriDataPath: string | null
   private readonly owner: ProcessOwner
-  private state: PersistedClientState = { version: CLIENT_STATE_VERSION, restoreEnabled: true }
+  private state: PersistedClientState = { version: CLIENT_STATE_VERSION, restoreEnabled: false }
   private writeQueue: Promise<void> = Promise.resolve()
   private drainAndReleasePromise: Promise<void> | undefined
   private crossHostRegistration: CrossHostRegistration | undefined
@@ -238,7 +238,7 @@ export class ClientStateManager {
 
   loadClientState(): ClientStateLoadResult {
     if (!this.isPrimary) {
-      return { isPrimary: false, restoreEnabled: true, snapshot: null }
+      return { isPrimary: false, restoreEnabled: false, snapshot: null }
     }
     return {
       isPrimary: true,
@@ -368,7 +368,7 @@ export class ClientStateManager {
         console.warn("[client-state] failed to read state", error)
       }
       return {
-        state: { version: CLIENT_STATE_VERSION, restoreEnabled: true },
+        state: { version: CLIENT_STATE_VERSION, restoreEnabled: false },
         unsupportedFutureEnvelope: false,
       }
     }

packages/tauri-app/src-tauri/src/client_state.rs

@@ -71,11 +71,11 @@ impl Default for PersistedClientState {
     fn default() -> Self {
         Self {
             version: CLIENT_STATE_VERSION,
-            restore_enabled: true,
+            restore_enabled: false,
             snapshot: None,
             window: None,
             unsupported_future_envelope: false,
-            writes_enabled: true,
+            writes_enabled: false,
         }
     }
 }
@@ -531,14 +531,14 @@ fn parse_client_state(bytes: &[u8]) -> PersistedClientState {
         restore_enabled: value
             .get("restoreEnabled")
             .and_then(Value::as_bool)
-            .unwrap_or(true),
+            .unwrap_or(false),
         snapshot,
         window: value.get("window").and_then(window::normalize_window_state),
         unsupported_future_envelope: false,
         writes_enabled: value
             .get("restoreEnabled")
             .and_then(Value::as_bool)
-            .unwrap_or(true),
+            .unwrap_or(false),
     }
 }
 

packages/tauri-app/src-tauri/src/client_state/tests.rs

@@ -42,6 +42,16 @@ fn assert_receive_timeout<T>(result: Result<T, mpsc::RecvTimeoutError>) {
     assert!(matches!(result, Err(mpsc::RecvTimeoutError::Timeout)));
 }
 
+fn enable_restore(state: &ClientState) {
+    assert!(state.set_restore_enabled(true).unwrap());
+}
+
+fn enable_restore_in_memory(state: &ClientState) {
+    let mut persisted = state.state.lock().unwrap();
+    persisted.restore_enabled = true;
+    persisted.writes_enabled = true;
+}
+
 fn failing_state(initially_failing: bool) -> (TempDir, ClientState, Arc<AtomicBool>) {
     let directory = tempfile::tempdir().unwrap();
     let fail = Arc::new(AtomicBool::new(initially_failing));
@@ -162,7 +172,7 @@ fn parses_envelopes_and_normalizes_zoom() {
         br#"{"version":1,"restoreEnabled":"no"}"#.as_slice(),
     ] {
         let state = parse_client_state(bytes);
-        assert!(state.restore_enabled);
+        assert!(!state.restore_enabled);
         assert_eq!(state.snapshot, None);
         assert!(!state.unsupported_future_envelope);
     }
@@ -370,6 +380,7 @@ fn election_preserves_cohorts_until_every_participant_exits() {
 fn secondary_and_failed_initialization_are_isolated() {
     let directory = tempfile::tempdir().unwrap();
     let primary = ClientState::initialize_at(directory.path()).unwrap();
+    enable_restore(&primary);
     assert!(primary.save_snapshot(json!({ "kept": true })).unwrap());
     let state_path = directory.path().join(CLIENT_STATE_FILENAME);
     let original = fs::read(&state_path).unwrap();
@@ -390,6 +401,7 @@ fn disable_and_clear_suppress_later_writes() {
     for clear in [false, true] {
         let directory = tempfile::tempdir().unwrap();
         let state = ClientState::initialize_at(directory.path()).unwrap();
+        enable_restore(&state);
         assert!(state.save_snapshot(json!({ "removed": true })).unwrap());
         state.state.lock().unwrap().window = Some(window());
         if clear {
@@ -413,6 +425,7 @@ fn disable_and_clear_suppress_later_writes() {
 fn failed_writes_restore_memory_and_suppression_state() {
     for operation in ["snapshot", "clear", "disable"] {
         let (_directory, state, fail) = failing_state(false);
+        enable_restore(&state);
         assert!(state.save_snapshot(json!({ "kept": true })).unwrap());
         state.state.lock().unwrap().window = Some(window());
         fail.store(true, Ordering::SeqCst);
@@ -463,7 +476,7 @@ fn future_envelope_is_preserved_until_successful_clear() {
         }),
     )
     .unwrap();
-    assert_eq!(state.load().unwrap(), load(true, true, Value::Null));
+    assert_eq!(state.load().unwrap(), load(true, false, Value::Null));
     assert!(!state.set_restore_enabled(false).unwrap());
     assert!(state.save_snapshot(json!({ "ignored": true })).unwrap());
     state.flush().unwrap();
@@ -474,6 +487,7 @@ fn future_envelope_is_preserved_until_successful_clear() {
     fail.store(false, Ordering::SeqCst);
     assert!(state.clear().unwrap());
     assert!(!state.state.lock().unwrap().unsupported_future_envelope);
+    enable_restore(&state);
     assert!(state.save_snapshot(json!({ "accepted": true })).unwrap());
     assert_eq!(state.load().unwrap().snapshot, json!({ "accepted": true }));
 }
@@ -613,6 +627,7 @@ fn ownership_release_drains_active_write_and_blocks_later_writes() {
         )
         .unwrap(),
     );
+    enable_restore_in_memory(&state);
     let writing = Arc::clone(&state);
     let writer = thread::spawn(move || writing.save_snapshot(json!({ "first": true })));
     started_rx.recv().unwrap();
@@ -647,6 +662,7 @@ fn ownership_loss_blocks_the_final_atomic_replacement() {
         }),
     )
     .unwrap();
+    enable_restore_in_memory(&state);
     assert_eq!(
         state.save_snapshot(json!({ "blocked": true })).unwrap_err(),
         "Client state ownership changed before atomic replacement"
@@ -673,6 +689,7 @@ fn renderer_rotation_blocks_an_in_flight_old_renderer_replacement() {
         )
         .unwrap(),
     );
+    enable_restore_in_memory(&state);
     let outgoing = Url::parse("http://127.0.0.1:43123/workspace").unwrap();
     let incoming = Url::parse("http://127.0.0.1:43124/workspace").unwrap();
     state.renderer_access.claim("old", &outgoing).unwrap();
@@ -699,6 +716,7 @@ fn renderer_rotation_blocks_an_in_flight_old_renderer_replacement() {
 fn oversized_snapshot_does_not_replace_state() {
     let directory = tempfile::tempdir().unwrap();
     let state = ClientState::initialize_at(directory.path()).unwrap();
+    enable_restore(&state);
     state.save_snapshot(json!({ "small": true })).unwrap();
     assert!(state
         .save_snapshot(Value::String("x".repeat(MAX_CLIENT_SNAPSHOT_BYTES)))

packages/ui/src/lib/native/client-state.ts

@@ -6,7 +6,7 @@ export type NativeClientStateLoadResult = {
   restoreEnabled: boolean
   snapshot: unknown | null
 }
-const SECONDARY_CLIENT_STATE: NativeClientStateLoadResult = { isPrimary: false, restoreEnabled: true, snapshot: null }
+const SECONDARY_CLIENT_STATE: NativeClientStateLoadResult = { isPrimary: false, restoreEnabled: false, snapshot: null }
 const accessToken = (() => {
   const bytes = new Uint8Array(32)
   globalThis.crypto.getRandomValues(bytes)

packages/ui/src/stores/client-state.ts

@@ -11,7 +11,7 @@ const MAX_LAYOUT_VALUE_LENGTH = 4096
 const LEGACY_LAYOUT_KEY_PREFIX = "opencode-session-"
 const UNSAFE_LAYOUT_KEYS = new Set(["__proto__", "constructor", "prototype"])
 const [clientStateIsPrimary, setClientStateIsPrimary] = createSignal(true)
-const [restorePreviousStateEnabled, setRestorePreviousStateEnabledSignal] = createSignal(true)
+const [restorePreviousStateEnabled, setRestorePreviousStateEnabledSignal] = createSignal(false)
 const [loadedClientSnapshotExists, setLoadedClientSnapshotExists] = createSignal(false)
 const [loadedRestorableSession, setLoadedRestorableSession] = createSignal<RestorableSessionState | null>(null)
 let initialized = false

packages/ui/src/stores/instances.ts

@@ -168,6 +168,10 @@ class InterruptionRegistry<T extends { id: string }, S extends string> {
     return next
   }
 
+  sessionIds(instanceId: string): IterableIterator<string> {
+    return this.sessionCounts.get(instanceId)?.keys() ?? new Map<string, number>().keys()
+  }
+
   clear(instanceId: string, requests: readonly T[], clearPending: (sessionId: string) => void): void {
     requests.forEach(({ id }) => this.enqueuedAt.delete(id))
     this.sources.delete(instanceId)
@@ -291,8 +295,8 @@ function settleInstanceReadyWaiters(instanceId: string, error?: Error): void {
 function reconcilePendingSessionIndicators(instanceId: string): void {
   reconcileSessionPendingState(
     instanceId,
-    new Set(permissionSessionCounts.get(instanceId)?.keys() ?? []),
-    new Set(questionSessionCounts.get(instanceId)?.keys() ?? []),
+    new Set(permissionRegistry.sessionIds(instanceId)),
+    new Set(questionRegistry.sessionIds(instanceId)),
   )
 }