fix(root): add always-present drag region so window is movable on chrome-less routes (#2316) (#2317)

* fix(root): add always-present drag region so window is movable on chrome-less routes (#2316)

* fix(security): override hono >=4.12.25, dompurify, @opentelemetry/core

Bump hono override to >=4.12.25 and add dompurify >=3.4.7 and
@opentelemetry/core >=2.8.0 overrides to clear pnpm audit findings
(GHSA-88fw-hqm2-52qc and others). Resolves 14 transitive vulns to 1 low.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(security): dedupe overrides after merging main

The PR-merge ref combined this branch's dompurify/@opentelemetry/core
overrides with main's, producing duplicate YAML keys that pnpm rejected
during setup. Drop the duplicates (keep main's higher dompurify >=3.4.9),
retaining only the unique hono >=4.12.25 bump from this branch.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(security): cap @babel/core override below 8.0 to fix build

The unbounded '@babel/core': '>=7.29.6' override (merged from main)
resolved to the just-published Babel 8.0.0, whose breaking removal of
Scope#references crashes the Vite/Babel transform during electron-forge
make on all platforms. Bound the range to '>=7.29.6 <8.0.0' so it still
patches GHSA-4x5r-pxfx-6jf8 while staying on the 7.x line.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Reynier Ortiz Vega <reynier@stacklok.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: 4 people

pnpm-lock.yaml

@@ -39,11 +39,11 @@ overrides:
   fast-uri: '>=3.1.2'
   fast-xml-builder: '>=1.2.0'
   fast-xml-parser: 5.8.0
-  hono: '>=4.12.23'
+  hono: '>=4.12.25'
   ip-address: '>=10.2.0'
   lodash-es: '>=4.18.0'
   mermaid: '>=11.15.0'
-  '@babel/core': '>=7.29.6'
+  '@babel/core': '>=7.29.6 <8.0.0'
   dompurify: '>=3.4.9'
   js-yaml: '>=4.2.0'
   '@opentelemetry/core': '>=2.8.0'

pnpm-workspace.yaml

@@ -46,6 +46,10 @@ function RootComponent() {
 
   return (
     <NewsletterModalProvider>
+      <div
+        className="app-region-drag pointer-events-none fixed top-0 right-0
+          left-0 z-50 h-9"
+      />
       {!hideNav && <TopNav />}
       {!hideNav && import.meta.env.DEV && <CustomSocketBanner />}
       <Main>

renderer/src/routes/__root.tsx

@@ -0,0 +1,108 @@
+import { render, waitFor } from '@testing-library/react'
+import { describe, it, expect, vi } from 'vitest'
+import {
+  createMemoryHistory,
+  createRootRoute,
+  createRoute,
+  RouterProvider,
+  Router,
+} from '@tanstack/react-router'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+
+vi.mock('@/common/hooks/use-restart-shutdown-servers', () => ({
+  useRestartShutdownServers: () => undefined,
+}))
+
+vi.mock('@/common/hooks/use-mcp-optimizer-startup-cleanup', () => ({
+  useMcpOptimizerStartupCleanup: () => undefined,
+}))
+
+vi.mock('../root/hooks/use-registry-error-toast', () => ({
+  useRegistryErrorToast: () => undefined,
+}))
+
+vi.mock('@/common/components/expert-consultation-banner', () => ({
+  ExpertConsultationBanner: () => null,
+}))
+
+vi.mock('@/common/components/newsletter-modal', () => ({
+  NewsletterModal: () => null,
+}))
+
+vi.mock('@/common/components/custom-socket-banner', () => ({
+  CustomSocketBanner: () => null,
+}))
+
+vi.mock('@/common/components/layout/top-nav/window-controls', () => ({
+  WindowControls: () => null,
+}))
+
+vi.mock('@/common/lib/os-design', () => ({
+  getOsDesignVariant: () => 'mac',
+}))
+
+import { Route as RootRoute } from '../__root'
+
+function renderRouterAt(path: string) {
+  const rootRoute = createRootRoute({
+    component: RootRoute.options.component,
+  })
+
+  const shutdownRoute = createRoute({
+    getParentRoute: () => rootRoute,
+    path: '/shutdown',
+    component: () => <div data-testid="shutdown-content">Shutting down</div>,
+  })
+
+  const cliIssueRoute = createRoute({
+    getParentRoute: () => rootRoute,
+    path: '/cli-issue',
+    component: () => <div data-testid="cli-issue-content">CLI issue</div>,
+  })
+
+  const indexRoute = createRoute({
+    getParentRoute: () => rootRoute,
+    path: '/',
+    component: () => <div data-testid="index-content">Home</div>,
+  })
+
+  const router = new Router({
+    routeTree: rootRoute.addChildren([
+      shutdownRoute,
+      cliIssueRoute,
+      indexRoute,
+    ]),
+    history: createMemoryHistory({ initialEntries: [path] }),
+    defaultNotFoundComponent: () => null,
+  })
+
+  const queryClient = new QueryClient({
+    defaultOptions: { queries: { retry: false } },
+  })
+
+  return render(
+    <QueryClientProvider client={queryClient}>
+      <RouterProvider router={router} />
+    </QueryClientProvider>
+  )
+}
+
+describe('Bug: window cannot be moved on chrome-less routes (macOS)', () => {
+  it('renders a draggable region (app-region-drag) on /shutdown so the window can be moved', async () => {
+    const { container } = renderRouterAt('/shutdown')
+
+    await waitFor(() => {
+      const dragElements = container.querySelectorAll('.app-region-drag')
+      expect(dragElements.length).toBeGreaterThan(0)
+    })
+  })
+
+  it('renders a draggable region (app-region-drag) on /cli-issue so the window can be moved', async () => {
+    const { container } = renderRouterAt('/cli-issue')
+
+    await waitFor(() => {
+      const dragElements = container.querySelectorAll('.app-region-drag')
+      expect(dragElements.length).toBeGreaterThan(0)
+    })
+  })
+})