feat(close): add Cancel option to running-sessions close dialog

The close-confirmation dialog only offered Kill & Quit / Keep in
Background; every dismissal (Escape, window-X) hid the window. Add a
third Cancel button that aborts the close and keeps the app open.

Also fix a pre-existing race: the backend force-destroyed the window
5s after a close request regardless of an open dialog. The renderer
now acks WindowCloseHandling when it takes over the close
interactively, clearing the fallback timer; a crashed renderer still
hits the 5s fallback.

Add preload-allowlist.test.ts asserting every IPC channel is in
preload.cjs ALLOWED_CHANNELS — the new channels were initially missing
there (same bug class as 08969d3), which silently broke the dialog.

Author: johannesjo

electron/ipc/channels.ts

@@ -58,6 +58,7 @@ export enum IPC {
   WindowToggleMaximize = '__window_toggle_maximize',
   WindowClose = '__window_close',
   WindowForceClose = '__window_force_close',
+  WindowCloseHandling = '__window_close_handling',
   WindowHide = '__window_hide',
   WindowMaximize = '__window_maximize',
   WindowUnmaximize = '__window_unmaximize',
@@ -73,6 +74,7 @@ export enum IPC {
 
   // Dialog
   DialogConfirm = '__dialog_confirm',
+  DialogChoice = '__dialog_choice',
   DialogOpen = '__dialog_open',
 
   // Shell

electron/ipc/register.ts

@@ -856,6 +856,18 @@ export function registerAllHandlers(win: BrowserWindow): void {
     return result.response === 0;
   });
 
+  ipcMain.handle(IPC.DialogChoice, async (_e, args) => {
+    const result = await dialog.showMessageBox(win, {
+      type: args.kind === 'warning' ? 'warning' : 'question',
+      title: args.title || 'Confirm',
+      message: args.message,
+      buttons: args.buttons,
+      defaultId: args.defaultId ?? 0,
+      cancelId: args.cancelId ?? args.buttons.length - 1,
+    });
+    return result.response;
+  });
+
   ipcMain.handle(IPC.DialogOpen, async (_e, args) => {
     const properties: Array<'openDirectory' | 'openFile' | 'multiSelections'> = [];
     if (args?.directory) properties.push('openDirectory');
@@ -973,16 +985,33 @@ export function registerAllHandlers(win: BrowserWindow): void {
   });
   win.on('resize', createThrottledForwarder(win, IPC.WindowResized, 100));
   win.on('move', createThrottledForwarder(win, IPC.WindowMoved, 100));
+  // Fallback timer that force-destroys the window if the renderer never
+  // responds to a close request (e.g. it crashed). Cleared once the renderer
+  // acks that it is handling the close interactively (showing a dialog), so a
+  // user deliberating over that dialog isn't force-quit out from under it.
+  let forceCloseTimer: ReturnType<typeof setTimeout> | undefined;
+  const clearForceCloseTimer = (): void => {
+    if (forceCloseTimer) {
+      clearTimeout(forceCloseTimer);
+      forceCloseTimer = undefined;
+    }
+  };
+  ipcMain.handle(IPC.WindowCloseHandling, clearForceCloseTimer);
+
   win.on('close', (e) => {
     e.preventDefault();
     if (!win.isDestroyed()) {
       win.webContents.send(IPC.WindowCloseRequested);
       // Fallback: force-close if renderer doesn't respond within 5 seconds.
-      // If the renderer calls WindowForceClose first, win.isDestroyed()
-      // will be true and this is a no-op.
-      setTimeout(() => {
+      // Cleared by WindowCloseHandling if the renderer takes over the close
+      // interactively. If the renderer calls WindowForceClose first,
+      // win.isDestroyed() will be true and this is a no-op.
+      clearForceCloseTimer();
+      forceCloseTimer = setTimeout(() => {
         if (!win.isDestroyed()) win.destroy();
       }, 5_000);
     }
   });
+
+  win.on('closed', clearForceCloseTimer);
 }

electron/preload-allowlist.test.ts

@@ -0,0 +1,22 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+import { describe, expect, it } from 'vitest';
+
+import { IPC } from './ipc/channels.js';
+
+// Regression guard: every IPC channel the renderer can invoke must be in
+// preload.cjs ALLOWED_CHANNELS, or `invoke` throws "Blocked IPC channel" at
+// runtime. main.ts only console.warns about drift in dev, so without this
+// test the mismatch ships silently (see commit 08969d3, same bug class).
+describe('preload ALLOWED_CHANNELS', () => {
+  const preloadSrc = readFileSync(join(__dirname, 'preload.cjs'), 'utf8');
+  const hasChannel = (channel: string) =>
+    preloadSrc.includes(`'${channel}'`) || preloadSrc.includes(`"${channel}"`);
+
+  it('lists every channel in the IPC enum', () => {
+    const channels: string[] = Object.values(IPC);
+    const missing = channels.filter((channel) => !hasChannel(channel));
+    expect(missing).toEqual([]);
+  });
+});

electron/preload.cjs

@@ -70,8 +70,10 @@ const ALLOWED_CHANNELS = new Set([
   '__window_resized',
   '__window_moved',
   '__window_close_requested',
+  '__window_close_handling',
   // Dialog
   '__dialog_confirm',
+  '__dialog_choice',
   '__dialog_open',
   // Shell
   '__shell_reveal',

src/App.tsx

@@ -4,7 +4,8 @@ import { onMount, onCleanup, createEffect, Show, ErrorBoundary, createSignal } f
 import { invoke } from './lib/ipc';
 import { IPC } from '../electron/ipc/channels';
 import { appWindow } from './lib/window';
-import { confirm } from './lib/dialog';
+import { choice } from './lib/dialog';
+import { CLOSE_DIALOG_BUTTONS, resolveCloseChoice } from './lib/close-decision';
 import { Sidebar } from './components/Sidebar';
 import { TilingLayout } from './components/TilingLayout';
 import { NewTaskDialog } from './components/NewTaskDialog';
@@ -434,24 +435,28 @@ function App() {
           runningCount === 1
             ? '1 running terminal session'
             : `${runningCount} running terminal sessions`;
-        const shouldKill = await confirm(
-          `You have ${countLabel}. They can be restored on app restart. Kill them and quit, or keep them alive in the background?`,
+        const selected = await choice(
+          `You have ${countLabel}. They can be restored on app restart. Kill them and quit, keep them alive in the background, or cancel?`,
           {
             title: 'Running Terminals',
             kind: 'warning',
-            okLabel: 'Kill & Quit',
-            cancelLabel: 'Keep in Background',
+            buttons: [...CLOSE_DIALOG_BUTTONS],
+            defaultId: 2,
+            cancelId: 2,
           },
-        ).catch(() => false);
+        ).catch(() => 2);
 
-        if (shouldKill) {
+        const action = resolveCloseChoice(selected);
+        if (action === 'kill') {
           await invoke(IPC.KillAllAgents).catch(console.error);
           allowClose = true;
           await appWindow.close().catch(console.error);
           return;
         }
-
-        await appWindow.hide().catch(console.error);
+        if (action === 'background') {
+          await appWindow.hide().catch(console.error);
+        }
+        // 'abort': close already prevented above — leave the window open.
       } finally {
         handlingClose = false;
       }

src/lib/close-decision.test.ts

@@ -0,0 +1,26 @@
+import { describe, expect, it } from 'vitest';
+
+import { CLOSE_DIALOG_BUTTONS, resolveCloseChoice } from './close-decision';
+
+describe('resolveCloseChoice', () => {
+  it('maps button 0 (Kill & Quit) to kill', () => {
+    expect(resolveCloseChoice(0)).toBe('kill');
+  });
+
+  it('maps button 1 (Keep in Background) to background', () => {
+    expect(resolveCloseChoice(1)).toBe('background');
+  });
+
+  it('maps button 2 (Cancel) to abort', () => {
+    expect(resolveCloseChoice(2)).toBe('abort');
+  });
+
+  it('falls back to abort for an out-of-range index', () => {
+    expect(resolveCloseChoice(-1)).toBe('abort');
+    expect(resolveCloseChoice(99)).toBe('abort');
+  });
+
+  it('exposes button labels with Cancel last', () => {
+    expect(CLOSE_DIALOG_BUTTONS).toEqual(['Kill & Quit', 'Keep in Background', 'Cancel']);
+  });
+});

src/lib/close-decision.ts

@@ -0,0 +1,20 @@
+// Maps the close-confirmation dialog's button index to a close action.
+//
+// The dialog (shown when the window is closed with live PTY sessions) offers
+// three choices. Cancel is last and is also the safe fallback for any
+// out-of-range index (e.g. Escape / window-X mapped to cancelId).
+
+export type CloseAction = 'kill' | 'background' | 'abort';
+
+export const CLOSE_DIALOG_BUTTONS = ['Kill & Quit', 'Keep in Background', 'Cancel'] as const;
+
+export function resolveCloseChoice(index: number): CloseAction {
+  switch (index) {
+    case 0:
+      return 'kill';
+    case 1:
+      return 'background';
+    default:
+      return 'abort';
+  }
+}

src/lib/dialog.test.ts

@@ -0,0 +1,43 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+import { IPC } from '../../electron/ipc/channels';
+import { choice } from './dialog';
+
+const invoke = vi.fn();
+
+(globalThis as unknown as { window: unknown }).window = {
+  electron: { ipcRenderer: { invoke } },
+};
+
+afterEach(() => {
+  invoke.mockReset();
+});
+
+describe('choice', () => {
+  it('invokes the DialogChoice channel with message and options', async () => {
+    invoke.mockResolvedValue(2);
+
+    const result = await choice('Pick one', {
+      title: 'Closing',
+      kind: 'warning',
+      buttons: ['Kill & Quit', 'Keep in Background', 'Cancel'],
+      defaultId: 2,
+      cancelId: 2,
+    });
+
+    expect(invoke).toHaveBeenCalledWith(IPC.DialogChoice, {
+      message: 'Pick one',
+      title: 'Closing',
+      kind: 'warning',
+      buttons: ['Kill & Quit', 'Keep in Background', 'Cancel'],
+      defaultId: 2,
+      cancelId: 2,
+    });
+    expect(result).toBe(2);
+  });
+
+  it('returns the selected button index from the main process', async () => {
+    invoke.mockResolvedValue(0);
+    expect(await choice('msg', { buttons: ['A', 'B'] })).toBe(0);
+  });
+});

src/lib/dialog.ts

@@ -16,6 +16,24 @@ export async function confirm(message: string, options?: ConfirmOptions): Promis
   }) as Promise<boolean>;
 }
 
+interface ChoiceOptions {
+  title?: string;
+  kind?: string;
+  buttons: string[];
+  /** Button index selected by Enter. */
+  defaultId?: number;
+  /** Button index returned for Escape / window-close. */
+  cancelId?: number;
+}
+
+/** Multi-button dialog. Resolves to the index of the chosen button. */
+export async function choice(message: string, options: ChoiceOptions): Promise<number> {
+  return window.electron.ipcRenderer.invoke(IPC.DialogChoice, {
+    message,
+    ...options,
+  }) as Promise<number>;
+}
+
 interface OpenDialogOptions {
   directory?: boolean;
   multiple?: boolean;

src/lib/window.ts

@@ -99,6 +99,16 @@ class AppWindow {
     handler: (event: { preventDefault: () => void }) => Promise<void> | void,
   ): Promise<UnlistenFn> {
     return window.electron.ipcRenderer.on(IPC.WindowCloseRequested, () => {
+      // Tell the backend we're handling this close interactively so it cancels
+      // its 5s force-destroy fallback. From here the renderer owns the
+      // outcome: WindowForceClose to quit, hide to background, or nothing to
+      // abort. (Crash before this point still hits the backend fallback.)
+      // Best-effort: a failed ack must never abort the close handler below.
+      try {
+        void window.electron.ipcRenderer.invoke(IPC.WindowCloseHandling).catch(() => {});
+      } catch {
+        /* ack is best-effort; the backend fallback still protects us */
+      }
       let prevented = false;
       const result = handler({
         preventDefault: () => {