@pmate/cli 0.35.1 → 0.35.3

package/dist/templates/electron/call-preload.cjs

@@ -0,0 +1,15 @@
+const { contextBridge, ipcRenderer } = require('electron')
+contextBridge.exposeInMainWorld('pmateIncomingCall', Object.freeze({
+  getSession: () => ipcRenderer.invoke('pmate:call:session'),
+  updateState: state => ipcRenderer.invoke('pmate:call:state', state),
+  onCloseRequested: handler => {
+    const listener = () => handler()
+    ipcRenderer.on('pmate:call:closeRequested', listener)
+    return () => ipcRenderer.removeListener('pmate:call:closeRequested', listener)
+  },
+  onCaller: handler => {
+    const listener = (_event, caller) => handler(caller)
+    ipcRenderer.on('pmate:call:caller', listener)
+    return () => ipcRenderer.removeListener('pmate:call:caller', listener)
+  },
+}))

package/dist/templates/electron/calls.cjs

@@ -0,0 +1,100 @@
+const path = require('node:path')
+function createDesktopCalls({ appId, instanceId, origin, BrowserWindow, ipcMain, dialog, createClient = async options => {
+  const { CallClient } = await import('@pmate/chat-sdk/runtime')
+  return new CallClient(options)
+}, onError = () => {} }) {
+  let client, identity, generation = 0, current, unsubscribe
+  const people = new Map()
+  const trusted = event => {
+    try { return current && event.sender === current.window.webContents && event.senderFrame === event.sender.mainFrame
+      && new URL(event.senderFrame.url).origin === origin && new URL(event.senderFrame.url).pathname === '/_desktop/call' } catch { return false }
+  }
+  function destroy() {
+    const previous = current
+    current = undefined
+    if (previous) { clearTimeout(previous.timer); previous.resolve('suppressed'); previous.window.destroy() }
+  }
+  function present(callId) {
+    if (!client || !identity || client.snapshot().callId !== callId || client.snapshot().phase !== 'incoming') return Promise.resolve('suppressed')
+    if (current?.callId === callId) return current.ready
+    destroy()
+    const window = new BrowserWindow({ width: 420, height: 680, minWidth: 380, minHeight: 540, title: '来电', show: false,
+      backgroundColor: '#ffffff', webPreferences: { preload: path.join(__dirname, 'call-preload.cjs'), partition: 'persist:desktop',
+        nodeIntegration: false, contextIsolation: true, sandbox: true, webSecurity: true, autoplayPolicy: 'no-user-gesture-required' } })
+    let resolve, reject
+    const ready = new Promise((yes, no) => { resolve = yes; reject = no })
+    const entry = current = { callId, window, ready, resolve, reject, phase: 'incoming', confirming: false }
+    entry.timer = setTimeout(() => { if (current === entry) { reject(new Error('Incoming call window timeout')); destroy() } }, 1500)
+    window.webContents.setWindowOpenHandler(() => ({ action: 'deny' }))
+    for (const event of ['will-navigate', 'will-redirect', 'will-attach-webview']) window.webContents.on(event, e => e.preventDefault())
+    window.webContents.on('did-fail-load', (_event, code) => { if (code !== -3 && current === entry) { reject(new Error('Incoming call window failed')); destroy() } })
+    window.on('close', event => {
+      if (current !== entry) return
+      event.preventDefault()
+      if (entry.phase === 'incoming' || entry.phase === 'ended' || entry.phase === 'idle') {
+        if (entry.phase === 'incoming') client?.hangup()
+        destroy(); return
+      }
+      if (entry.confirming) return
+      entry.confirming = true
+      void dialog.showMessageBox(window, { type: 'question', message: '结束通话并关闭窗口？', buttons: ['继续通话', '结束通话'], defaultId: 0, cancelId: 0 })
+        .then(result => { if (current === entry && result.response === 1) { window.webContents.send('pmate:call:closeRequested'); setTimeout(() => { if (current === entry) destroy() }, 2000) } })
+        .catch(onError).finally(() => { entry.confirming = false })
+    })
+    void window.loadURL(`${origin}/_desktop/call`).catch(error => { if (current === entry) { reject(error); destroy() } })
+    return ready
+  }
+  ipcMain.handle('pmate:call:session', event => {
+    if (!trusted(event) || !identity || !client) throw new Error('Untrusted call session request')
+    const callerId = client.snapshot().peerId, caller = people.get(callerId) ?? { id: callerId, name: '联系人' }
+    return { callId: current.callId, profileId: identity.profileId, token: identity.token, clientInstanceId: instanceId, caller, url: 'wss://calls.pmate.chat/call' }
+  })
+  ipcMain.handle('pmate:call:state', (event, state) => {
+    if (!trusted(event) || !state || state.callId !== current.callId || !['idle', 'requesting', 'ringing', 'incoming', 'connecting', 'connected', 'ended'].includes(state.phase)) throw new Error('Invalid call window state')
+    const entry = current
+    entry.phase = state.phase
+    if (['incoming', 'connecting', 'connected'].includes(state.phase)) {
+      clearTimeout(entry.timer); entry.window.show(); entry.window.focus(); entry.resolve('handled')
+    } else if (state.phase === 'ended') destroy()
+  })
+  return {
+    getWindow: () => current?.window,
+    setPeople(values) {
+      if (!Array.isArray(values) || values.length > 2000 || values.some(value => !value || typeof value.id !== 'string' || value.id.length > 128
+        || typeof value.name !== 'string' || value.name.length > 256 || (value.avatar !== undefined && (typeof value.avatar !== 'string' || value.avatar.length > 2048)))) throw new Error('Invalid call directory')
+      people.clear(); for (const value of values) people.set(value.id, { id: value.id, name: value.name, avatar: value.avatar })
+      if (current && client) { const caller = people.get(client.snapshot().peerId); if (caller) current.window.webContents.send('pmate:call:caller', caller) }
+    },
+    async configure(value) {
+      if (identity?.profileId === value.profileId && identity?.token === value.token && client) return
+      generation++; const ownGeneration = generation
+      unsubscribe?.(); client?.close(); client = undefined; identity = undefined; destroy(); people.clear()
+      const next = await createClient({ profileId: value.profileId, token: value.token, clientInstanceId: instanceId })
+      if (generation !== ownGeneration) { next.close(); return }
+      identity = { profileId: value.profileId, token: value.token }; client = next
+      unsubscribe = next.subscribe(state => {
+        if (generation !== ownGeneration) return
+        if (state.phase === 'incoming') void present(state.callId).catch(onError)
+        else if (state.phase === 'ended' && state.reason !== 'answered_elsewhere' && current?.callId === state.callId) destroy()
+      })
+      next.connect()
+    },
+    async handleReach(event) {
+      if (event.appId !== appId || !client) throw new Error('Call handler unavailable')
+      const ownGeneration = generation, result = await client.handleReach(event)
+      if (generation !== ownGeneration) throw new Error('Call identity changed')
+      if (event.eventType === 'call.incoming' && result === 'handled') return present(event.payload.callId)
+      if (event.eventType === 'call.ended' && result === 'handled' && current?.callId === event.payload.callId) destroy()
+      return result
+    },
+    async incoming(callId) {
+      if (!client || typeof callId !== 'string' || !callId || callId.length > 128) throw new Error('Invalid incoming call')
+      if (current?.callId === callId && ['incoming', 'connecting', 'connected'].includes(current.phase)) { current.window.show(); current.window.focus(); return current.ready }
+      const ownGeneration = generation, result = await client.attachAndWait(callId)
+      if (generation !== ownGeneration) throw new Error('Call identity changed')
+      return result === 'handled' ? present(callId) : result
+    },
+    stop() { generation++; unsubscribe?.(); unsubscribe = undefined; client?.close(); client = undefined; identity = undefined; destroy(); people.clear() },
+  }
+}
+module.exports = { createDesktopCalls }

package/dist/templates/electron/main.cjs

@@ -1,7 +1,11 @@
-const { app, BrowserWindow, session, shell, Menu, desktopCapturer, ipcMain } = require('electron')
+const { app, BrowserWindow, session, shell, Menu, desktopCapturer, ipcMain, Notification, dialog } = require('electron')
 const path = require('node:path')
 const { createResourceHandler } = require('./resources.cjs')
 const { installMediaPermissions } = require('./media.cjs')
+const { createDesktopNotifications } = require('./notifications.cjs')
+const { desktopInstanceId, createDesktopReach } = require('./reach.cjs')
+const { createRendererReach } = require('./reach-renderer.cjs')
+const { createDesktopCalls } = require('./calls.cjs')
 const config = require('./desktop-config.json')
 const manifest = require('./resource-manifest.json')
 app.setName(config.productName)
@@ -9,6 +13,7 @@ app.setName(config.productName)
 app.setPath('userData', path.join(app.getPath('appData'), config.bundleId))
 const allowedNavigation = new Set([config.origin, ...config.authOrigins])
 let mainWindow
+let desktopNotifications, desktopReach, desktopCalls
 function isAllowed(raw) { try { return allowedNavigation.has(new URL(raw).origin) } catch { return false } }
 function external(raw) {
   try { if (['https:', 'http:', 'mailto:'].includes(new URL(raw).protocol)) void shell.openExternal(raw) } catch { /* Invalid links are not executable targets. */ }
@@ -26,6 +31,7 @@ function restrict(window) {
 function createWindow() {
   mainWindow = new BrowserWindow({ width: 1180, height: 820, minWidth: 380, minHeight: 540, title: config.productName, backgroundColor: '#f6f8fb', webPreferences: { preload: path.join(__dirname, 'preload.cjs'), partition: 'persist:desktop', nodeIntegration: false, contextIsolation: true, sandbox: true, webSecurity: true } })
   restrict(mainWindow)
+  mainWindow.webContents.on('did-start-navigation', (_event, _url, _inPlace, mainFrame) => { if (mainFrame) desktopNotifications?.clearContext() })
   mainWindow.webContents.on('did-fail-load', (_event, code, _description, url, mainFrame) => {
     if (mainFrame && code !== -3 && url !== `${config.origin}/_desktop/offline`) void mainWindow.loadURL(`${config.origin}/_desktop/offline`)
   })
@@ -45,7 +51,7 @@ else {
       }
       return resources(request) ?? desktopSession.fetch(request, { bypassCustomProtocolHandlers: true })
     })
-    installMediaPermissions(desktopSession, { origin: config.origin, getWindow: () => mainWindow, desktopCapturer, BrowserWindow, ipcMain })
+    installMediaPermissions(desktopSession, { origin: config.origin, getWindow: () => mainWindow, getWindows: () => [mainWindow, desktopCalls?.getWindow()], desktopCapturer, BrowserWindow, ipcMain })
     ipcMain.handle('pmate:screen-settings', event => {
       if (!mainWindow || event.sender !== mainWindow.webContents || event.senderFrame !== mainWindow.webContents.mainFrame || new URL(mainWindow.webContents.getURL()).origin !== config.origin) return false
       if (process.platform === 'darwin') { void shell.openExternal('x-apple.systempreferences:com.apple.preference.security?Privacy_ScreenCapture'); return true }
@@ -55,6 +61,42 @@ else {
       { role: 'appMenu' }, { role: 'editMenu' }, { role: 'viewMenu' }, { role: 'windowMenu' },
       { label: config.productName, submenu: [{ label: 'Back to app', click: () => { if (!mainWindow) createWindow(); else void mainWindow.loadURL(config.origin) } }] },
     ]))
+    desktopNotifications = createDesktopNotifications({ ipcMain, Notification, origin: config.origin, appId: config.app, getWindow: () => mainWindow, showWindow: () => {
+      if (!mainWindow) createWindow()
+      if (mainWindow.isMinimized()) mainWindow.restore()
+      mainWindow.show(); mainWindow.focus()
+      return mainWindow
+    } })
+    const instanceId = desktopInstanceId(app.getPath('userData'))
+    const rendererReach = createRendererReach({ ipcMain, getWindow: () => mainWindow, trusted: event => desktopNotifications.trusted(event) })
+    if (config.app === 'pmate:hello') desktopCalls = createDesktopCalls({ appId: config.app, instanceId, origin: config.origin, BrowserWindow, ipcMain, dialog })
+    desktopReach = createDesktopReach({ appId: config.app, instanceId, present: input => desktopNotifications.display(input),
+      configureCalls: identity => { rendererReach.reset(); return desktopCalls?.configure(identity) }, stopCalls: () => { rendererReach.reset(); desktopCalls?.stop() },
+      incomingCall: callId => { if (!desktopCalls) throw new Error('Call handler unavailable'); return desktopCalls.incoming(callId) },
+      isViewingThread: threadId => desktopNotifications.isViewingThread(threadId),
+      onReach: event => ['call.incoming', 'call.ended'].includes(event.eventType) && desktopCalls ? desktopCalls.handleReach(event) : rendererReach.deliver(event),
+    })
+    ipcMain.handle('pmate:call:incoming', (event, callId) => {
+      if (!desktopNotifications.trusted(event) || !desktopCalls) throw new Error('Untrusted call sender')
+      return desktopCalls.incoming(callId)
+    })
+    ipcMain.handle('pmate:call:reach', (event, value) => {
+      if (!desktopNotifications.trusted(event) || !desktopCalls) throw new Error('Untrusted call sender')
+      return desktopCalls.handleReach(value)
+    })
+    ipcMain.handle('pmate:call:people', (event, people) => {
+      if (!desktopNotifications.trusted(event) || !desktopCalls) throw new Error('Untrusted call sender')
+      desktopCalls.setPeople(people)
+    })
+    ipcMain.handle('pmate:reach:configure', (event, identity) => {
+      if (!desktopNotifications.trusted(event)) throw new Error('Untrusted reach sender')
+      return desktopReach.configure(identity)
+    })
+    ipcMain.handle('pmate:reach:stop', event => {
+      if (!desktopNotifications.trusted(event)) throw new Error('Untrusted reach sender')
+      desktopReach.stop(); desktopNotifications.reset()
+    })
+    app.on('before-quit', () => { desktopReach.stop(); desktopNotifications.reset() })
     createWindow()
     app.on('activate', () => { if (!mainWindow) createWindow() })
   }).catch(error => { console.error('Desktop startup failed:', error.message); app.exit(1) })

package/dist/templates/electron/media.cjs

@@ -1,9 +1,8 @@
 const { chooseScreen } = require('./share-picker.cjs')
-function installMediaPermissions(desktopSession, { origin, getWindow, desktopCapturer, BrowserWindow, ipcMain }) {
+function installMediaPermissions(desktopSession, { origin, getWindow, getWindows = () => [getWindow()], desktopCapturer, BrowserWindow, ipcMain }) {
   const sameOrigin = raw => { try { return new URL(raw).origin === origin } catch { return false } }
   const trusted = contents => {
-    const window = getWindow()
-    return !!window && !window.isDestroyed() && contents === window.webContents && sameOrigin(contents.getURL())
+    return getWindows().some(window => !!window && !window.isDestroyed() && contents === window.webContents && sameOrigin(contents.getURL()))
   }
   desktopSession.setPermissionRequestHandler((contents, permission, callback, details) => {
     const allowed = trusted(contents) && details.isMainFrame === true && sameOrigin(details.requestingUrl)
@@ -13,7 +12,7 @@ function installMediaPermissions(desktopSession, { origin, getWindow, desktopCap
     return Boolean(trusted(contents) && sameOrigin(requestingOrigin) && details.isMainFrame === true && (permission === 'display-capture' || (permission === 'media' && details.mediaType === 'audio')))
   })
   desktopSession.setDisplayMediaRequestHandler(async (request, callback) => {
-    const window = getWindow()
+    const window = getWindows().find(window => window && !window.isDestroyed() && request.frame === window.webContents.mainFrame)
     const valid = () => window && !window.isDestroyed() && trusted(window.webContents) && request.frame && request.frame === window.webContents.mainFrame && sameOrigin(request.securityOrigin)
     if (!valid() || !request.userGesture || !request.videoRequested || request.audioRequested) return callback(null)
     let completed = false

package/dist/templates/electron/notifications.cjs

@@ -0,0 +1,71 @@
+// Main-process presentation boundary. Only the configured app's top frame may invoke it.
+function createDesktopNotifications({ ipcMain, Notification, origin, appId, getWindow, showWindow, now = Date.now }) {
+  let activeThreadId, pendingOpen, epoch = 0
+  const shown = new Map()
+  const pending = new Map()
+  const trusted = event => {
+    try { return event.sender === getWindow()?.webContents && event.senderFrame === event.sender.mainFrame && new URL(event.senderFrame.url).origin === origin } catch { return false }
+  }
+  const context = (event, value) => {
+    if (!trusted(event)) throw new Error('Untrusted notification context')
+    if (value !== null && (typeof value !== 'string' || value.length > 512)) throw new Error('Invalid thread context')
+    activeThreadId = value ?? undefined
+  }
+  const present = async (event, input) => {
+    if (!trusted(event)) throw new Error('Untrusted notification sender')
+    return display(input)
+  }
+  const display = input => {
+    if (!input || input.appId !== appId || typeof input.notificationId !== 'string' || !input.notificationId || input.notificationId.length > 512
+      || typeof input.title !== 'string' || input.title.length > 256 || typeof input.body !== 'string' || input.body.length > 4096
+      || ['threadId', 'callId', 'meetingId'].some(key => input[key] !== undefined && (typeof input[key] !== 'string' || input[key].length > 512))) throw new Error('Invalid notification')
+    for (const [id, item] of shown) if (item.until <= now()) { item.notification.close(); shown.delete(id) }
+    if (input.expiresAtMs !== undefined && (!Number.isFinite(input.expiresAtMs) || input.expiresAtMs <= now())) return 'suppressed'
+    if (shown.has(input.notificationId)) return 'suppressed'
+    if (pending.has(input.notificationId)) return pending.get(input.notificationId)
+    const window = getWindow()
+    if (input.digestThreads !== undefined) {
+      if (!Array.isArray(input.digestThreads) || !input.digestThreads.length || input.digestThreads.length > 1000 || input.digestThreads.some(item => !item || typeof item.threadId !== 'string' || !item.threadId || item.threadId.length > 512 || typeof item.title !== 'string' || item.title.length > 512 || !Number.isSafeInteger(item.count) || item.count < 1)) throw new Error('Invalid notification digest')
+      const visible = input.digestThreads.filter(item => !(item.threadId === activeThreadId && window && window.isVisible() && window.isFocused() && !window.isMinimized()))
+      if (!visible.length) return 'suppressed'
+      input = { ...input, threadId: visible.length === 1 ? visible[0].threadId : undefined,
+        body: visible.length === input.digestThreads.length ? input.body : `${visible.length} 个会话中有 ${visible.reduce((sum, item) => sum + item.count, 0)} 条新消息` }
+    }
+    if (input.threadId && input.threadId === activeThreadId && window && window.isVisible() && window.isFocused() && !window.isMinimized()) return 'suppressed'
+    if (!Notification.isSupported()) throw new Error('Desktop notifications unavailable')
+    const notification = new Notification({ title: input.title, body: input.body, silent: false })
+    const until = Math.min(input.expiresAtMs ?? now() + 86400000, now() + 86400000)
+    const presentationEpoch = epoch
+    const operation = new Promise((resolve, reject) => {
+      let settled = false
+      const timeout = setTimeout(() => { if (!settled) { settled = true; notification.close(); reject(new Error('Notification display timeout')) } }, 1500)
+      notification.once('show', () => {
+        if (settled) return
+        settled = true; clearTimeout(timeout)
+        if (presentationEpoch !== epoch) { notification.close(); reject(new Error('Notification identity changed')); return }
+        if (shown.size >= 10000) { const first = shown.keys().next().value; shown.get(first).notification.close(); shown.delete(first) }
+        shown.set(input.notificationId, { notification, until }); resolve('displayed')
+      })
+      notification.once('failed', () => { if (!settled) { settled = true; clearTimeout(timeout); reject(new Error('Notification display failed')) } })
+      notification.on('click', () => {
+        const main = showWindow()
+        pendingOpen = { notificationId: input.notificationId, threadId: input.threadId, callId: input.callId, meetingId: input.meetingId }
+        main.webContents.send('pmate:notification:open', pendingOpen)
+        notification.close()
+      })
+      notification.show()
+    })
+    pending.set(input.notificationId, operation)
+    const cleanup = () => { if (pending.get(input.notificationId) === operation) pending.delete(input.notificationId) }
+    void operation.then(cleanup, cleanup)
+    return operation
+  }
+  ipcMain.handle('pmate:notification:consumeOpen', event => {
+    if (!trusted(event)) throw new Error('Untrusted notification click consumer')
+    const intent = pendingOpen; pendingOpen = undefined; return intent
+  })
+  ipcMain.handle('pmate:notification:context', context)
+  ipcMain.handle('pmate:notification:present', present)
+  return { display, trusted, isViewingThread(threadId) { const window = getWindow(); return !!threadId && threadId === activeThreadId && !!window && window.isVisible() && window.isFocused() && !window.isMinimized() }, clearContext() { activeThreadId = undefined }, reset() { epoch++; pendingOpen = undefined; activeThreadId = undefined; for (const item of shown.values()) item.notification.close(); shown.clear() } }
+}
+module.exports = { createDesktopNotifications }

package/dist/templates/electron/preload.cjs

@@ -1,2 +1,35 @@
 const { contextBridge, ipcRenderer } = require('electron')
-contextBridge.exposeInMainWorld('pmateDesktop', { openScreenSettings: () => ipcRenderer.invoke('pmate:screen-settings') })
+contextBridge.exposeInMainWorld('pmateDesktop', Object.freeze({
+  openScreenSettings: () => ipcRenderer.invoke('pmate:screen-settings'),
+  reach: Object.freeze({
+    onEvent: handler => {
+      const listener = (_event, value) => {
+        Promise.resolve().then(() => handler(value.event)).then(status =>
+          ipcRenderer.invoke('pmate:reach:ack', { requestId: value.requestId, status }), () =>
+          ipcRenderer.invoke('pmate:reach:ack', { requestId: value.requestId, status: 'failed' })).catch(() => {})
+      }
+      ipcRenderer.on('pmate:reach:event', listener)
+      return () => ipcRenderer.removeListener('pmate:reach:event', listener)
+    },
+    configure: identity => ipcRenderer.invoke('pmate:reach:configure', identity),
+    stop: () => ipcRenderer.invoke('pmate:reach:stop'),
+  }),
+  calls: Object.freeze({
+    incoming: callId => ipcRenderer.invoke('pmate:call:incoming', callId),
+    handleReach: event => ipcRenderer.invoke('pmate:call:reach', event),
+    setPeople: people => ipcRenderer.invoke('pmate:call:people', people),
+  }),
+  notifications: Object.freeze({
+    present: input => ipcRenderer.invoke('pmate:notification:present', input),
+    setActiveThread: threadId => ipcRenderer.invoke('pmate:notification:context', threadId),
+    onOpen: handler => {
+      let active = true
+      const seen = new Set()
+      const deliver = value => { if (active && value && !seen.has(value.notificationId)) { seen.add(value.notificationId); handler(value) } }
+      const listener = () => { void ipcRenderer.invoke('pmate:notification:consumeOpen').then(deliver).catch(() => {}) }
+      ipcRenderer.on('pmate:notification:open', listener)
+      listener()
+      return () => { active = false; ipcRenderer.removeListener('pmate:notification:open', listener) }
+    },
+  }),
+}))

package/dist/templates/electron/reach-renderer.cjs

@@ -0,0 +1,39 @@
+const { randomUUID } = require('node:crypto')
+/** A socket receipt is not a renderer business acknowledgement. */
+function createRendererReach({ ipcMain, getWindow, trusted, timeoutMs = 1800 }) {
+  const pending = new Map()
+  ipcMain.handle('pmate:reach:ack', (event, reply) => {
+    if (!trusted(event)) throw new Error('Untrusted reach acknowledgement')
+    const item = pending.get(reply?.requestId)
+    if (!item || item.sender !== event.sender) throw new Error('Unknown reach request')
+    if (!['handled', 'suppressed', 'failed'].includes(reply.status)) throw new Error('Invalid reach acknowledgement')
+    item.finish(reply.status)
+  })
+  return {
+    deliver(event) {
+      const window = getWindow()
+      if (!window || window.isDestroyed() || window.webContents.isDestroyed()) return Promise.reject(new Error('Reach renderer unavailable'))
+      const sender = window.webContents, requestId = randomUUID()
+      return new Promise((resolve, reject) => {
+        let timer
+        const finish = status => {
+          if (!pending.delete(requestId)) return
+          clearTimeout(timer)
+          sender.removeListener('destroyed', destroyed)
+          sender.removeListener('did-start-navigation', navigated)
+          if (status === 'handled' || status === 'suppressed') resolve(status)
+          else reject(new Error('Reach renderer did not handle event'))
+        }
+        const destroyed = () => finish('failed')
+        const navigated = (_event, _url, inPlace, mainFrame) => { if (mainFrame && !inPlace) finish('failed') }
+        pending.set(requestId, { sender, finish })
+        sender.once('destroyed', destroyed)
+        sender.on('did-start-navigation', navigated)
+        timer = setTimeout(() => finish('failed'), timeoutMs)
+        try { sender.send('pmate:reach:event', { requestId, event }) } catch { finish('failed') }
+      })
+    },
+    reset() { for (const item of [...pending.values()]) item.finish('failed') },
+  }
+}
+module.exports = { createRendererReach }

package/dist/templates/electron/reach.cjs

@@ -0,0 +1,62 @@
+const { randomUUID } = require('node:crypto')
+const { readFileSync, writeFileSync, mkdirSync } = require('node:fs')
+const path = require('node:path')
+
+function desktopInstanceId(userData) {
+  const file = path.join(userData, 'reach-device.json')
+  try { const value = JSON.parse(readFileSync(file, 'utf8')); if (typeof value.id === 'string' && /^desktop-[a-f0-9-]{36}$/.test(value.id)) return value.id } catch {}
+  mkdirSync(userData, { recursive: true })
+  const id = `desktop-${randomUUID()}`
+  writeFileSync(file, JSON.stringify({ id }), { mode: 0o600 })
+  return id
+}
+/** Credentials remain in memory. This connection survives renderer reload/closure. */
+function createDesktopReach({ appId, instanceId, hubUrl = 'wss://hub.pmate.chat', present, onReach, configureCalls, stopCalls, incomingCall, isViewingThread, createClient = async options => {
+  const { ChatClient } = await import('@pmate/chat-sdk/runtime')
+  return new ChatClient(options)
+} }) {
+  let client, identity, generation = 0
+  return {
+    async configure(value) {
+      if (!value || value.appId !== appId || ['accountId', 'profileId', 'token'].some(key => typeof value[key] !== 'string' || !value[key] || value[key].length > 16384)) throw new Error('Invalid reach identity')
+      if (client && identity && identity.accountId === value.accountId && identity.profileId === value.profileId && identity.token === value.token) return { instanceId }
+      const ownGeneration = ++generation
+      client?.close(); client = undefined; identity = { accountId: value.accountId, profileId: value.profileId, token: value.token }
+      await configureCalls?.(value)
+      if (generation !== ownGeneration) return { instanceId }
+      const next = await createClient({ appId, profileId: value.profileId, clientInstanceId: instanceId, hubUrl,
+        session: { token: value.token, session: { identity: { accountId: value.accountId, app: appId, profileId: value.profileId, kind: 'user' } } },
+        onNotification: async notification => {
+          if (generation !== ownGeneration) throw new Error('Reach account changed')
+          const data = notification.data
+          let threadId = data.threadId
+          if (data.type === 'call.incoming') {
+            if (!incomingCall || typeof data.callId !== 'string' || typeof data.callerId !== 'string') throw new Error('Call handler unavailable')
+            const { dmThreadId } = await import('@pmate/chat-sdk/runtime')
+            threadId = dmThreadId(appId, value.profileId, data.callerId)
+            const viewed = isViewingThread?.(threadId)
+            const result = await incomingCall(data.callId)
+            if (generation !== ownGeneration) throw new Error('Reach account changed')
+            if (result === 'suppressed' || viewed) return 'suppressed'
+          }
+          const digestThreads = data.type === 'social.messageDigest' ? JSON.parse(data.threads) : undefined
+          return present({ appId, notificationId: notification.notificationId, title: notification.title ?? '', body: notification.body ?? '', digestThreads,
+            threadId, callId: data.callId, meetingId: data.meetingId, expiresAtMs: notification.expiresAtMs })
+        },
+        onReach: async event => {
+          if (generation !== ownGeneration || !onReach) throw new Error('Reach handler unavailable')
+          const result = await onReach(event)
+          if (generation !== ownGeneration) throw new Error('Reach account changed')
+          return result
+        },
+      })
+      if (generation !== ownGeneration) { next.close(); return { instanceId } }
+      client = next
+      // Authentication and reconnect belong to the host; IPC does not wait for a network roundtrip.
+      void next.connect().catch(() => {})
+      return { instanceId }
+    },
+    stop() { generation++; client?.close(); client = undefined; identity = undefined; stopCalls?.() },
+  }
+}
+module.exports = { desktopInstanceId, createDesktopReach }

package/dist/templates/electron/resources.cjs

@@ -17,7 +17,7 @@ function createResourceHandler(root, origin, manifest) {
     if (name.includes('\\') || name.includes('\0') || name.split('/').some(p => p === '..' || p === '.')) return new Response('Invalid path', { status: 400 })
     // Exact files come from the build manifest. Only extensionless document routes get the SPA shell.
     if (!Object.hasOwn(manifest, name)) {
-      if (!path.extname(name) && request.headers.get('sec-fetch-dest') === 'document') name = 'index.html'
+      if (name === '_desktop/call' || (!path.extname(name) && request.headers.get('sec-fetch-dest') === 'document')) name = 'index.html'
       else if (!name) name = 'index.html'
       else return new Response('Resource not found', { status: 404 })
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pmate/cli",
-  "version": "0.35.1",
+  "version": "0.35.3",
   "description": "CLI utilities for the pMate project",
   "license": "MIT",
   "bin": {