@gloom-sh/terminal 0.18.5 → 0.19.1

package/src/renderers/electrobun/bun/desktop/relaunch.ts

@@ -1,4 +1,7 @@
-import { dirname } from "path";
+import { rm } from "fs/promises";
+import { tmpdir } from "os";
+import { dirname, win32 } from "path";
+import { psString, runScriptAfterExit, writePowerShellScript } from "./windows-script";
 
 /**
  * The folders the relaunch script finds `sleep` in, after whatever PATH the
@@ -29,6 +32,8 @@ export interface RelaunchContext {
   cwd: string;
   /** PATH as the app sees it. */
   pathEnv: string;
+  /** Where the app keeps its data when GLOOMBERB_HOME moves it. */
+  home?: string;
 }
 
 interface RelaunchCommand {
@@ -47,15 +52,16 @@ function currentProcess(): RelaunchContext {
     args: process.argv.slice(1),
     cwd: process.cwd(),
     pathEnv: process.env.PATH ?? "",
+    home: process.env.GLOOMBERB_HOME || undefined,
   };
 }
 
 /**
- * What opens the app again once `context.pid` has exited. The script runs in
- * `/` with the shell and `open` named by their full paths: the launcher starts
- * the app inside its bundle's `Contents/MacOS`, which a rename to the app's
- * new name takes away, and a spawn into a folder that is gone fails as if the
- * shell were missing (`ENOENT, posix_spawn 'sh'`).
+ * What opens the app again once `context.pid` has exited, on a Mac or Linux.
+ * The script runs in `/` with the shell and `open` named by their full paths:
+ * the launcher starts the app inside its bundle's `Contents/MacOS`, which a
+ * rename to the app's new name takes away, and a spawn into a folder that is
+ * gone fails as if the shell were missing (`ENOENT, posix_spawn 'sh'`).
  */
 export function desktopRelaunchCommand(context: RelaunchContext, bundle?: string): RelaunchCommand {
   const pathEnv = context.pathEnv ? `${context.pathEnv}:${SYSTEM_PATH}` : SYSTEM_PATH;
@@ -70,8 +76,6 @@ export function desktopRelaunchCommand(context: RelaunchContext, bundle?: string
     };
   }
 
-  if (context.platform === "win32") return { cmd: [context.execPath, ...context.args] };
-
   const args = context.args.map(shellQuote).join(" ");
   return {
     cmd: ["/bin/sh", "-c", `${waitForExit}; cd ${shellQuote(context.cwd)} 2>/dev/null; ${shellQuote(context.execPath)}${args ? ` ${args}` : ""}`],
@@ -80,12 +84,100 @@ export function desktopRelaunchCommand(context: RelaunchContext, bundle?: string
   };
 }
 
+export interface WindowsRelaunch {
+  /** The app's process, which the script waits out. */
+  pid: number;
+  /** `bin\launcher.exe` beside the runtime: what the Start menu opens. */
+  launcher: string;
+  log: string;
+  cancel: string;
+  taskName: string;
+  /** GLOOMBERB_HOME for the app it opens; a task has the user's environment, not the app's. */
+  home?: string;
+}
+
+/**
+ * The PowerShell 5.1 script that opens the Windows app again. It answers
+ * `started` in its log, waits for the app's process to be gone (Chromium's
+ * profile stays held until then, and an app opened before hands itself to the
+ * closing one and crashes), then opens the launcher. An app that stopped
+ * waiting for it writes `cancel` and stays open, so the script opens nothing.
+ */
+export function windowsRelaunchScript({ pid, launcher, log, cancel, taskName, home }: WindowsRelaunch): string {
+  return [
+    "$ErrorActionPreference = 'Stop'",
+    `$OldPid = ${pid}`,
+    `$Launcher = ${psString(launcher)}`,
+    `$Log = ${psString(log)}`,
+    `$Cancel = ${psString(cancel)}`,
+    `$TaskName = ${psString(taskName)}`,
+    `$DataHome = ${psString(home ?? "")}`,
+    String.raw`
+$LogEncoding = New-Object System.Text.UTF8Encoding $false
+function Write-Log([string]$Message) {
+  for ($Attempt = 0; $Attempt -lt 10; $Attempt += 1) {
+    try { [IO.File]::AppendAllText($Log, (Get-Date).ToString('o') + ' ' + $Message + [Environment]::NewLine, $LogEncoding); return } catch { Start-Sleep -Milliseconds 100 }
+  }
+}
+
+try {
+  if (-not (Test-Path -LiteralPath $Launcher)) { Write-Log ('declined: no ' + $Launcher); return }
+  Write-Log ('started ' + $PID)
+  $Deadline = (Get-Date).AddMinutes(5)
+  while ((Get-Process -Id $OldPid -ErrorAction SilentlyContinue) -and -not (Test-Path -LiteralPath $Cancel) -and (Get-Date) -lt $Deadline) {
+    Start-Sleep -Milliseconds 250
+  }
+  if (Test-Path -LiteralPath $Cancel) { Write-Log 'the app stopped waiting; it stays open'; return }
+  if (Get-Process -Id $OldPid -ErrorAction SilentlyContinue) { Write-Log 'the app did not quit'; return }
+  Start-Sleep -Milliseconds 500
+  if ($DataHome) { $env:GLOOMBERB_HOME = $DataHome }
+  Start-Process -FilePath $Launcher -WorkingDirectory (Split-Path -Parent $Launcher)
+  Write-Log ('opened ' + $Launcher)
+} catch {
+  Write-Log ('could not open the app: ' + $_.Exception.Message)
+} finally {
+  $ErrorActionPreference = 'Continue'
+  schtasks.exe /delete /tn $TaskName /f | Out-Null
+  Remove-Item -LiteralPath $PSCommandPath -Force -ErrorAction SilentlyContinue
+}
+`,
+  ].join("\n");
+}
+
+/**
+ * Electrobun puts the Windows app in a job that ends every process it starts
+ * when it exits, so the script runs from a scheduled task, which outlives it.
+ * Resolves once the script has started: the app may quit then.
+ */
+async function scheduleWindowsRelaunch(context: RelaunchContext): Promise<void> {
+  const name = `gloom-restart-${context.pid}`;
+  const script = win32.join(tmpdir(), `${name}.ps1`);
+  const log = win32.join(tmpdir(), `${name}.log`);
+  const cancel = win32.join(tmpdir(), `${name}.cancel`);
+  await rm(log, { force: true });
+  await rm(cancel, { force: true });
+  await writePowerShellScript(script, windowsRelaunchScript({
+    pid: context.pid,
+    launcher: win32.join(win32.dirname(context.execPath), "launcher.exe"),
+    log,
+    cancel,
+    taskName: `GloomRestart-${context.pid}`,
+    home: context.home,
+  }));
+  const answer = await runScriptAfterExit(script, log, cancel, `GloomRestart-${context.pid}`);
+  if (answer.kind !== "started") throw new Error(`the restart script did not start: ${answer.reason}`);
+}
+
 /**
  * Opens the app again once this process has exited. On a Mac, `bundle` opens
  * that bundle instead of the one this process runs from: the app's own, under
- * the name it was just given.
+ * the name it was just given. Resolves once this process may exit.
  */
-export function scheduleDesktopRelaunch(bundle?: string, context: RelaunchContext = currentProcess()): void {
+export async function scheduleDesktopRelaunch(bundle?: string, context: RelaunchContext = currentProcess()): Promise<void> {
+  if (context.platform === "win32") {
+    await scheduleWindowsRelaunch(context);
+    return;
+  }
   const { cmd, cwd, pathEnv } = desktopRelaunchCommand(context, bundle);
   const child = Bun.spawn(cmd, {
     ...(cwd ? { cwd } : {}),

package/src/renderers/electrobun/bun/desktop/update.ts

@@ -1,4 +1,4 @@
-import { readdir, rm } from "fs/promises";
+import { open, readdir, rm } from "fs/promises";
 import { basename, dirname, join } from "path";
 import type Electrobun from "electrobun/bun";
 import type { UpdateStatusEntry } from "electrobun/bun";
@@ -145,24 +145,101 @@ export function firstTarPath(bytes: Uint8Array): string | null {
   return null;
 }
 
+/**
+ * An octal number field of a tar header, read as tar readers do: the digits
+ * after any leading spaces, up to the first other character. The checksum is
+ * what tells a header from noise.
+ */
+function tarOctal(header: Uint8Array, start: number, length: number): number {
+  const digits = /^[\0 ]*([0-7]*)/.exec(new TextDecoder().decode(header.subarray(start, start + length)))?.[1];
+  return digits ? Number.parseInt(digits, 8) : 0;
+}
+
+/** Whether a header's checksum matches it: its bytes summed with the checksum field as spaces. */
+function tarHeaderChecksumMatches(header: Uint8Array): boolean {
+  const stored = tarOctal(header, 148, 8);
+  let unsigned = 0;
+  let signed = 0;
+  for (let index = 0; index < TAR_BLOCK; index += 1) {
+    const byte = index >= 148 && index < 156 ? 0x20 : header[index]!;
+    unsigned += byte;
+    signed += byte > 127 ? byte - 256 : byte;
+  }
+  return stored === unsigned || stored === signed;
+}
+
+/**
+ * Whether the file at `path` is a whole tar: every header from the first
+ * matches its checksum, and the entries reach the end-of-archive block before
+ * the file ends. A tar cut off partway (a decompress that failed, an app that
+ * quit while writing it) or no tar at all is not. It reads the headers only,
+ * so it says nothing about the files' contents.
+ */
+export async function isWholeTar(path: string): Promise<boolean> {
+  const file = await open(path, "r").catch(() => null);
+  if (!file) return false;
+  try {
+    const { size } = await file.stat();
+    const header = new Uint8Array(TAR_BLOCK);
+    for (let offset = 0; offset + TAR_BLOCK <= size;) {
+      const { bytesRead } = await file.read(header, 0, TAR_BLOCK, offset);
+      if (bytesRead < TAR_BLOCK) return false;
+      if (header.every((byte) => byte === 0)) return offset > 0;
+      if (!tarHeaderChecksumMatches(header)) return false;
+      // Octal: the base-256 sizes past 8 GB are not in an app's archive.
+      const entrySize = tarOctal(header, 124, 12);
+      offset += TAR_BLOCK + Math.ceil(entrySize / TAR_BLOCK) * TAR_BLOCK;
+    }
+    return false;
+  } catch {
+    return false;
+  } finally {
+    await file.close().catch(() => {});
+  }
+}
+
+/** Whether `path` holds a file that is not a whole tar. A missing one is not damaged. */
+async function isDamagedTar(path: string): Promise<boolean> {
+  return await Bun.file(path).exists() && !(await isWholeTar(path));
+}
+
+/** Where Electrobun keeps the update with build hash `hash` once it is downloaded. */
+function stagedArchivePath(extractionFolder: string, hash: string | undefined): string | null {
+  return hash ? join(extractionFolder, `${hash}.tar`) : null;
+}
+
+async function removeStagedArchive(path: string): Promise<void> {
+  await rm(path, { force: true }).catch(logFailure("desktop-update", "Could not remove a damaged update archive"));
+}
+
 /**
  * Removes the unpacked update archives in Electrobun's `self-extraction`
- * folder whose app carries its name from before the rename. The one that
- * matters is the Windows archive an install from then updated from: it is
- * packed again with the folder renamed (scripts/write-legacy-desktop-files.ts),
- * so its bytes are not those of the archive the next release's patch is made
- * from, and bspatch would turn it into a broken build. Without it the updater
+ * folder it must not build on. Electrobun takes `<hash>.tar` there as the
+ * update already downloaded without reading it, and a damaged one (part of a
+ * tar, from a decompress that failed) then failed to unpack at every install:
+ * without it, the download fetches a fresh copy. Also removed are the ones
+ * whose app carries its name from before the rename. The one that matters is
+ * the Windows archive an install from then updated from: it is packed again
+ * with the folder renamed (scripts/write-legacy-desktop-files.ts), so its
+ * bytes are not those of the archive the next release's patch is made from,
+ * and bspatch would turn it into a broken build. Without it the updater
  * downloads the full archive instead. Resolves to the paths it removed.
  */
-async function removeLegacyUpdateArchives(folder: string): Promise<string[]> {
+async function removeUnusableUpdateArchives(folder: string): Promise<string[]> {
   const removed: string[] = [];
   for (const entry of await readdir(folder).catch(() => [] as string[])) {
     if (!entry.endsWith(".tar")) continue;
     const path = join(folder, entry);
-    const head = await Bun.file(path).slice(0, 64 * 1024).bytes().catch(() => null);
-    const top = head ? firstTarPath(head)?.replace(/^\.\//, "").split("/")[0] : undefined;
-    if (top !== LEGACY_DESKTOP_APP_NAME && top !== `${LEGACY_DESKTOP_APP_NAME}.app`) continue;
-    const done = await rm(path, { force: true }).then(() => true, logFailure("desktop-update", "Could not remove an update archive from before the rename", false));
+    let reason: string;
+    if (!(await isWholeTar(path))) {
+      reason = "Could not remove a damaged update archive";
+    } else {
+      const head = await Bun.file(path).slice(0, 64 * 1024).bytes().catch(() => null);
+      const top = head ? firstTarPath(head)?.replace(/^\.\//, "").split("/")[0] : undefined;
+      if (top !== LEGACY_DESKTOP_APP_NAME && top !== `${LEGACY_DESKTOP_APP_NAME}.app`) continue;
+      reason = "Could not remove an update archive from before the rename";
+    }
+    const done = await rm(path, { force: true }).then(() => true, logFailure("desktop-update", reason, false));
     if (done) removed.push(path);
   }
   return removed;
@@ -343,6 +420,12 @@ export function createElectrobunDesktopUpdater(
   /** An apply is under way, or finished and the app is quitting. */
   let applyInProgress = false;
 
+  /** Electrobun's `self-extraction` folder, where the download leaves the update as `<hash>.tar`. */
+  async function extractionFolder(): Promise<string | null> {
+    const appData = await updater.appDataFolder?.().catch(() => null);
+    return appData ? join(appData, "self-extraction") : null;
+  }
+
   /** The error progress for a failed step, reported to error tracking on the way. */
   function failed(failure: UpdateFailure, error: string, release?: { version?: string; channel?: UpdateChannel } | null): UpdateProgress {
     reportUpdateFailure(failure, {
@@ -529,8 +612,8 @@ export function createElectrobunDesktopUpdater(
       }
       target = result.release;
 
-      const appData = await updater.appDataFolder?.().catch(() => null);
-      if (appData) await removeLegacyUpdateArchives(join(appData, "self-extraction"));
+      const extraction = await extractionFolder();
+      if (extraction) await removeUnusableUpdateArchives(extraction);
       await updater.downloadUpdate();
       const updateInfo = updater.updateInfo();
       if (updateInfo?.error) {
@@ -541,6 +624,15 @@ export function createElectrobunDesktopUpdater(
         onProgress(failed({ phase: "download", code: "interrupted" }, "Desktop update did not finish downloading.", result.release));
         return;
       }
+      // However Electrobun came by it (a patch, the full download), an archive
+      // that is not whole is never offered for a restart. It goes, so the retry
+      // downloads it again.
+      const staged = extraction ? stagedArchivePath(extraction, updateInfo.hash) : null;
+      if (staged && await isDamagedTar(staged)) {
+        await removeStagedArchive(staged);
+        onProgress(failed({ phase: "verify", code: "corrupt" }, "The downloaded update is damaged.", result.release));
+        return;
+      }
 
       // Downloaded, not installed: applying relaunches the app, and that waits
       // for the user's explicit request (`apply`).
@@ -570,9 +662,12 @@ export function createElectrobunDesktopUpdater(
     }
 
     const target = readyRelease;
+    const stagedHash = updater.updateInfo()?.hash;
     applyInProgress = true;
     let relaunching = false;
     let reportedError = false;
+    /** The install failed on the archive itself: it does not unpack. */
+    let damaged = false;
     const report = (progress: UpdateProgress) => {
       if (progress.phase === "error") reportedError = true;
       onProgress(progress);
@@ -580,6 +675,7 @@ export function createElectrobunDesktopUpdater(
     const installFailed = (error: unknown, message: string) => {
       // Electrobun names the system error in its message ("Failed to replace app: EACCES: ...").
       const code = installFailureCode(classifyUpdateError(error), installKind);
+      if (code === "corrupt") damaged = true;
       report(failed({ phase: relaunching ? "relaunch" : "apply", code }, message, target));
     };
     // Kept before Electrobun quits the app, so the next launch can tell whether it took.
@@ -610,9 +706,14 @@ export function createElectrobunDesktopUpdater(
     }
 
     // Past this point the app is quitting, so the guard stays up. A failed apply
-    // drops the staged release: the retry starts from the download again.
+    // drops the staged release: the retry starts from the download again. An
+    // archive that does not unpack goes too, or that download would take it as
+    // done once more and the install would fail on it again.
     if (!relaunching) {
       readyRelease = null;
+      const extraction = damaged ? await extractionFolder() : null;
+      const staged = extraction ? stagedArchivePath(extraction, stagedHash) : null;
+      if (staged) await removeStagedArchive(staged);
       applyInProgress = false;
     }
   }

package/src/renderers/electrobun/bun/desktop/view-ids.ts

@@ -0,0 +1,52 @@
+import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "fs";
+import { join } from "path";
+import type { DesktopViewIds } from "../../shared/protocol";
+
+/**
+ * The copy on disk of the ids the desktop view keeps in its WebView storage
+ * (view/view-ids.ts), in the data folder beside the install id. That storage
+ * belongs to the app's bundle identifier, and this copy is what a build under
+ * another identifier starts from.
+ */
+const FILE_NAME = "desktop-view-ids.json";
+const KEY = /^gloomberb\.[a-z0-9.-]{1,64}$/i;
+const MAX_IDS = 16;
+const MAX_VALUE_LENGTH = 4096;
+
+function viewIdsPath(dataDir: string): string {
+  return join(dataDir, FILE_NAME);
+}
+
+/** The entries of `raw` shaped like view ids: a storage key of this app's and a short string. */
+function parseViewIds(raw: unknown): DesktopViewIds {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return {};
+  const ids: DesktopViewIds = {};
+  for (const [key, value] of Object.entries(raw).slice(0, MAX_IDS)) {
+    if (KEY.test(key) && typeof value === "string" && value.length > 0 && value.length <= MAX_VALUE_LENGTH) ids[key] = value;
+  }
+  return ids;
+}
+
+/** What the data folder keeps; nothing when the file is missing or unreadable. */
+export function readDesktopViewIds(dataDir: string): DesktopViewIds {
+  try {
+    return parseViewIds(JSON.parse(readFileSync(viewIdsPath(dataDir), "utf8")));
+  } catch {
+    // Intentional ignore: no copy yet (a first launch, or a build from before it was kept), so the view keeps what it has.
+    return {};
+  }
+}
+
+/** Replaces the copy with what the view sent, written whole or not at all. Throws when it cannot, so the view tries again. */
+export function saveDesktopViewIds(dataDir: string, ids: unknown): void {
+  const path = viewIdsPath(dataDir);
+  const temporary = `${path}.${process.pid}.tmp`;
+  try {
+    mkdirSync(dataDir, { recursive: true });
+    writeFileSync(temporary, JSON.stringify(parseViewIds(ids)));
+    renameSync(temporary, path);
+  } catch (error) {
+    rmSync(temporary, { force: true });
+    throw error;
+  }
+}

package/src/renderers/electrobun/bun/desktop/windows-script.ts

@@ -0,0 +1,92 @@
+import { readFile, writeFile } from "fs/promises";
+
+/**
+ * PowerShell scripts the Windows app leaves to finish what it cannot do while
+ * it runs: its own files are locked until it quits.
+ */
+
+/** How long a script has to answer before the app stops waiting and keeps running. */
+const SCRIPT_START_TIMEOUT_MS = 20_000;
+
+/**
+ * `value` as a single-quoted PowerShell string. PowerShell also takes the
+ * curly single quotes U+2018 to U+201B for quotes; doubling escapes each.
+ */
+export function psString(value: string): string {
+  return `'${value.replace(/['\u2018-\u201B]/g, "$&$&")}'`;
+}
+
+/** PowerShell 5.1, which every supported Windows has, running `script` hidden and without the user's profile. */
+function powershellCommand(script: string): string[] {
+  return ["powershell.exe", "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-WindowStyle", "Hidden", "-File", script];
+}
+
+/**
+ * Writes `text` as a script for PowerShell 5.1: with Windows line ends, and
+ * with a byte order mark, without which it reads the file in the system code
+ * page and garbles a path with an accent in it.
+ */
+export async function writePowerShellScript(path: string, text: string): Promise<void> {
+  await writeFile(path, `\uFEFF${text.replaceAll(/\r?\n/g, "\r\n")}`, "utf8");
+}
+
+/** What a script that runs after the app quits answered before the app quit for it. */
+export type ScriptAnswer =
+  /** It waits for the app to quit. */
+  | { kind: "started" }
+  /** It cannot run now, for a while: something it needs is in use. */
+  | { kind: "busy"; reason: string }
+  /** It cannot run. */
+  | { kind: "declined"; reason: string };
+
+/**
+ * The script's answer in its log, a line `<time> started …`,
+ * `<time> busy: …` or `<time> declined: …`; null before it wrote one.
+ */
+export function scriptAnswer(log: string): ScriptAnswer | null {
+  for (const line of log.replace(/^\uFEFF/, "").split(/\r?\n/)) {
+    const match = /^\S+ (started|busy|declined)\b:? ?(.*)$/.exec(line);
+    if (!match) continue;
+    if (match[1] === "started") return { kind: "started" };
+    return { kind: match[1] === "busy" ? "busy" : "declined", reason: match[2]?.trim() ?? "" };
+  }
+  return null;
+}
+
+function schtasks(...args: string[]): void {
+  const result = Bun.spawnSync(["schtasks.exe", ...args], { stdio: ["ignore", "ignore", "pipe"], windowsHide: true });
+  if (!result.success) throw new Error(`schtasks ${args[0]}: ${result.stderr.toString().trim()}`);
+}
+
+/**
+ * Runs `script` from the scheduled task `taskName`, which outlives the app (a
+ * child of its process dies with it), and resolves to the answer it writes to
+ * `log`: only on `started` may the app quit for it. The script removes the
+ * task. When it does not answer in time, the app writes `cancel`, which keeps
+ * a script that starts late from doing anything, and this throws with the
+ * task gone, as it does when the task could not be made.
+ */
+export async function runScriptAfterExit(script: string, log: string, cancel: string, taskName: string): Promise<ScriptAnswer> {
+  const command = powershellCommand(script).map((part) => (part === script ? `"${part}"` : part)).join(" ");
+  try {
+    schtasks("/create", "/tn", taskName, "/tr", command, "/sc", "once", "/st", "00:00", "/f");
+    schtasks("/run", "/tn", taskName);
+    const deadline = Date.now() + SCRIPT_START_TIMEOUT_MS;
+    while (Date.now() < deadline) {
+      const answer = scriptAnswer(await readFile(log, "utf8").catch(() => ""));
+      if (answer) return answer;
+      await Bun.sleep(250);
+    }
+    await writeFile(cancel, "").catch(() => {});
+    throw new Error("the script did not start");
+  } catch (error) {
+    try { schtasks("/delete", "/tn", taskName, "/f"); } catch { /* Intentional ignore: never made, or the script removed it. */ }
+    throw error;
+  }
+}
+
+/** Runs `script` in the background, as a child of the app; resolves to its exit code. */
+export async function runScriptInBackground(script: string): Promise<number> {
+  const child = Bun.spawn(powershellCommand(script), { stdio: ["ignore", "ignore", "ignore"], windowsHide: true });
+  return await child.exited;
+}

package/src/renderers/electrobun/bun/index.ts

@@ -25,9 +25,11 @@ import {
   type RememberedDesktopWindow,
 } from "./window/remembered-frame";
 import { reapStaleTerminalMedia } from "../../opentui/terminal-media";
+import { quitWindowsEventLoopOnItsThread } from "./window/windows-quit";
 import { installProcessCrashListeners } from "../../../telemetry/crash-reports-node";
 import { renameLegacyMacApp } from "./desktop/app-name";
 import { scheduleDesktopRelaunch } from "./desktop/relaunch";
+import { settleInstallerFolder } from "./desktop/installer-folder";
 
 console.log = (...args) => console.error(...args);
 console.info = (...args) => console.error(...args);
@@ -45,6 +47,25 @@ setConfigStoreHost(nodeConfigStoreHost);
 // before the config, and its off switch, has been read.
 installProcessCrashListeners();
 
+// An install the Windows installer made lives in the installer's folder,
+// where its shortcuts, the gloom command and its uninstall entry lead.
+// Electrobun's updater installs an update into a folder of its own and opens
+// it from there: this build moves into the installer's folder and opens again
+// from it before any window shows.
+const installerFolderMove = await settleInstallerFolder({
+  platform: process.platform,
+  execPath: process.execPath,
+  homeDir: homedir(),
+  localAppData: process.env.LOCALAPPDATA,
+}).catch((error: unknown) => {
+  console.error("[desktop] could not move the app into the installer's folder", error instanceof Error ? error.message : String(error));
+  return null;
+});
+if (installerFolderMove?.kind === "relaunching") {
+  Utils.quit();
+  await new Promise<never>(() => {});
+}
+
 // An install from before the rename runs from Gloomberb.app, where its updater
 // put this build. It takes the new name and opens again from there before any
 // window shows. Anywhere else this returns without touching the disk.
@@ -58,7 +79,7 @@ const appRename = await renameLegacyMacApp({
   return null;
 });
 if (appRename?.kind === "renamed") {
-  scheduleDesktopRelaunch(appRename.bundle);
+  await scheduleDesktopRelaunch(appRename.bundle);
   Utils.quit();
   // The process is exiting; nothing below may open a window meanwhile.
   await new Promise<never>(() => {});
@@ -171,12 +192,15 @@ const mainWindow = createAppWindow({
   preload: desktopBootFramePreload(readDesktopBootFrame(desktopBootFramePath())),
 });
 backend.mainWindow = mainWindow;
+quitWindowsEventLoopOnItsThread(mainWindow);
 // The window is loading its view; the services it will ask for start now
 // rather than when it asks. Its `init` reports a failure, and retries.
 startDesktopBackend(backend).catch((error) => {
   console.error("[desktop] startup failed", error instanceof Error ? error.stack ?? error.message : String(error));
 });
-if (rememberedWindow?.fullscreen) {
+// Windows has no way into fullscreen here, and builds whose frameless window
+// Windows took for fullscreen saved every window as fullscreen.
+if (rememberedWindow?.fullscreen && process.platform !== "win32") {
   try { mainWindow.setFullScreen(true); } catch { /* the framed window is still the one they sized */ }
 } else if (rememberedWindow?.maximized) {
   try { mainWindow.maximize(); } catch { /* the framed window is still the one they sized */ }

package/src/renderers/electrobun/bun/window/create.ts

@@ -1,5 +1,6 @@
 import { BrowserWindow } from "electrobun/bun";
 import {
+  applyNativeWindowFrame,
   applyWindowMoveEvent,
   applyWindowResizeEvent,
   updateWindowFrameCache,
@@ -9,6 +10,7 @@ import {
 import type { WindowFrame, WindowMinimumSize } from "./frame";
 import { applyWindowsCustomChrome } from "./windows-custom-chrome";
 import { applyWindowsWindowIcon } from "./windows-icons";
+import { fitPageToClientArea } from "./windows-native";
 
 type DesktopTitleBarStyle = "default" | "hidden" | "hiddenInset";
 type DesktopWindowRenderer = "native" | "cef";
@@ -20,8 +22,13 @@ type DesktopWindowStyleMask = {
   FullSizeContentView?: boolean;
 };
 
+/**
+ * No native title bar: the header is the title bar. On Windows "hidden" is a
+ * bare popup with no frame to resize by, which Windows also takes for
+ * fullscreen; "hiddenInset" keeps the sizing frame and cuts out the caption.
+ */
 function desktopTitleBarStyle(): DesktopTitleBarStyle {
-  return process.platform === "darwin" ? "hiddenInset" : "hidden";
+  return process.platform === "linux" ? "hidden" : "hiddenInset";
 }
 
 function desktopWindowRenderer(): DesktopWindowRenderer {
@@ -43,6 +50,22 @@ function desktopWindowStyleMask(): DesktopWindowStyleMask {
   };
 }
 
+const APP_VIEW_URL = "views://mainview/index.html";
+
+/**
+ * Electrobun's Windows webview takes a page load that starts while Ctrl is
+ * down for a Ctrl+click on a link: it cancels the load and asks for a new
+ * window instead. A window opened from a Ctrl chord, as Ctrl+Shift+O pops a
+ * pane out, stayed blank. Its page is loaded again, which Electrobun lets
+ * through within half a second of the one it cancelled.
+ */
+function loadAgainWhenTakenForCtrlClick(window: BrowserWindow): void {
+  (window.webview as { on: (name: string, handler: (event: unknown) => void) => void }).on("new-window-open", (event) => {
+    const detail = (event as { data?: { detail?: { url?: unknown } } }).data?.detail;
+    if (detail?.url === APP_VIEW_URL) window.webview.loadURL(APP_VIEW_URL);
+  });
+}
+
 interface AppWindowOptions {
   title: string;
   /** Already normalized to at least `minSize`. */
@@ -63,7 +86,7 @@ export function createAppWindow({ title, frame, rpc, minSize, onFrameChange, pre
   const window = new BrowserWindow({
     title,
     frame,
-    url: "views://mainview/index.html",
+    url: APP_VIEW_URL,
     ...(preload ? { preload } : {}),
     renderer: desktopWindowRenderer(),
     rpc,
@@ -74,13 +97,29 @@ export function createAppWindow({ title, frame, rpc, minSize, onFrameChange, pre
   });
   applyWindowsWindowIcon(title);
   applyWindowsCustomChrome(title);
+  if (process.platform === "win32") {
+    loadAgainWhenTakenForCtrlClick(window);
+    // The page exists once it has loaded; until then there is nothing to fit.
+    window.webview.on("dom-ready", () => {
+      fitPageToClientArea(window.ptr);
+    });
+  }
   updateWindowFrameCache(window, frame, minSize);
+  const readsNativeFrame = process.platform === "win32";
   (window as any).on?.("move", (event: WindowMoveEvent) => {
-    applyWindowMoveEvent(window, event);
+    if (readsNativeFrame) {
+      if (!applyNativeWindowFrame(window, minSize)) return;
+    } else {
+      applyWindowMoveEvent(window, event);
+    }
     onFrameChange?.();
   });
   (window as any).on?.("resize", (event: WindowResizeEvent) => {
-    applyWindowResizeEvent(window, event, minSize);
+    if (readsNativeFrame) {
+      if (!applyNativeWindowFrame(window, minSize)) return;
+    } else {
+      applyWindowResizeEvent(window, event, minSize);
+    }
     onFrameChange?.();
   });
   return window;

package/src/renderers/electrobun/bun/window/events.ts

@@ -47,3 +47,23 @@ export function applyWindowResizeEvent(
   }
   return nextFrame;
 }
+
+type FramedWindow = Pick<BrowserWindow, "frame" | "getFrame" | "isMinimized" | "setFrame">;
+
+/**
+ * Electrobun's Windows events do not carry the window's frame: a resize
+ * reports the client area's size at 0,0, a move the client area's corner as
+ * unsigned 16-bit values, and both come while the window is minimized. There
+ * the frame is read from the window itself, and a minimized window keeps the
+ * frame it had.
+ */
+export function applyNativeWindowFrame(window: FramedWindow, minimumSize?: WindowMinimumSize): WindowFrame | null {
+  if (window.isMinimized()) return null;
+  const read = window.getFrame();
+  if (!(read.width > 0 && read.height > 0)) return null;
+  const nextFrame = updateWindowFrameCache(window as BrowserWindow, read, minimumSize);
+  if (nextFrame && (nextFrame.width !== read.width || nextFrame.height !== read.height)) {
+    window.setFrame(nextFrame.x, nextFrame.y, nextFrame.width, nextFrame.height);
+  }
+  return nextFrame;
+}