@wrongstack/desktop 0.292.1 → 0.295.0

package/dist/main/main.js

@@ -1,16 +1,13 @@
 // src/main/main.ts
 import * as path4 from "node:path";
-import * as fs3 from "node:fs/promises";
-import { wstackGlobalRoot as wstackGlobalRoot3 } from "@wrongstack/core/utils";
+import { resolveWstackPaths as resolveWstackPaths2 } from "@wrongstack/core/utils";
 import {
   app as app2,
   BaseWindow,
   dialog,
-  ipcMain as ipcMain2,
-  nativeImage,
   screen,
-  shell,
-  WebContentsView
+  shell as shell2,
+  WebContentsView as WebContentsView2
 } from "electron";
 
 // src/main/macos-platform.ts
@@ -62,6 +59,17 @@ function firstOpenFileArg(argv) {
 // src/main/agent-bridge.ts
 import { randomUUID } from "node:crypto";
 import { EventEmitter } from "node:events";
+import {
+  createSurfaceConnectionState,
+  DEFAULT_SURFACE_CONNECTION_CONFIG,
+  decodeProtocolFrame,
+  markConnectionActivity,
+  markConnectionConnecting,
+  markConnectionOpen,
+  planConnectionReconnect,
+  resetConnection,
+  stopConnection
+} from "@wrongstack/webui-server/protocol";
 import WebSocket from "ws";
 var MAX_MESSAGES = 300;
 var RECONNECT_CONFIG = {
@@ -76,6 +84,14 @@ var RECONNECT_CONFIG = {
   /** Jitter factor (0-1) to add randomness to delays */
   jitterFactor: 0.1
 };
+var DESKTOP_CONNECTION_CONFIG = {
+  ...DEFAULT_SURFACE_CONNECTION_CONFIG,
+  maxReconnectAttempts: RECONNECT_CONFIG.maxAttempts,
+  initialBackoffMs: RECONNECT_CONFIG.initialDelayMs,
+  maxBackoffMs: RECONNECT_CONFIG.maxDelayMs,
+  backoffMultiplier: RECONNECT_CONFIG.backoffMultiplier,
+  jitterRatio: RECONNECT_CONFIG.jitterFactor
+};
 var DesktopAgentBridge = class extends EventEmitter {
   conversations = /* @__PURE__ */ new Map();
   snapshot(runtimeId) {
@@ -99,6 +115,7 @@ var DesktopAgentBridge = class extends EventEmitter {
     const conversation = this.getOrCreate(runtimeId);
     this.cancelReconnect(conversation);
     conversation.reconnectAttempt = 0;
+    conversation.connectionState = resetConnection(conversation.connectionState);
     void this.ensureConnected(runtimeId, wsUrl);
   }
   async ensureConnected(runtimeId, wsUrl) {
@@ -113,6 +130,7 @@ var DesktopAgentBridge = class extends EventEmitter {
     }
     conversation.reconnectUrl = wsUrl;
     conversation.reconnectAttempt = 0;
+    conversation.connectionState = resetConnection(conversation.connectionState);
     await this.connect(runtimeId, wsUrl);
     return publicConversation(conversation);
   }
@@ -123,6 +141,7 @@ var DesktopAgentBridge = class extends EventEmitter {
     const conversation = this.getOrCreate(runtimeId);
     this.cancelReconnect(conversation);
     conversation.status = "connecting";
+    conversation.connectionState = markConnectionConnecting(conversation.connectionState);
     conversation.error = void 0;
     this.emitChanged(conversation);
     this.emitReconnectEvent(conversation, "connecting");
@@ -141,7 +160,7 @@ var DesktopAgentBridge = class extends EventEmitter {
         conversation.error = void 0;
         conversation.connectPromise = null;
         conversation.reconnectAttempt = 0;
-        conversation.reconnectUrl = null;
+        conversation.connectionState = markConnectionOpen(conversation.connectionState);
         this.emitChanged(conversation);
         this.emitReconnectEvent(conversation, "connected");
         resolve2();
@@ -181,26 +200,27 @@ var DesktopAgentBridge = class extends EventEmitter {
    * Schedule a reconnection attempt with exponential backoff.
    */
   scheduleReconnect(conversation) {
-    if (RECONNECT_CONFIG.maxAttempts === 0) return;
-    if (conversation.reconnectAttempt >= RECONNECT_CONFIG.maxAttempts) {
+    const reconnect = planConnectionReconnect(
+      conversation.connectionState,
+      DESKTOP_CONNECTION_CONFIG
+    );
+    conversation.connectionState = reconnect.state;
+    conversation.reconnectAttempt = reconnect.state.reconnectAttempt;
+    if (!reconnect.plan) {
       this.emitReconnectEvent(conversation, "exhausted");
       return;
     }
-    const baseDelay = Math.min(
-      RECONNECT_CONFIG.initialDelayMs * RECONNECT_CONFIG.backoffMultiplier ** conversation.reconnectAttempt,
-      RECONNECT_CONFIG.maxDelayMs
-    );
-    const jitter = baseDelay * RECONNECT_CONFIG.jitterFactor * Math.random();
-    const delay = Math.floor(baseDelay + jitter);
-    conversation.reconnectAttempt++;
-    this.emitReconnectEvent(conversation, "scheduled", { delay, attempt: conversation.reconnectAttempt });
+    this.emitReconnectEvent(conversation, "scheduled", {
+      delay: reconnect.plan.delayMs,
+      attempt: reconnect.plan.attempt
+    });
     conversation.reconnectTimer = setTimeout(() => {
       conversation.reconnectTimer = null;
       if (!conversation.reconnectUrl) return;
       if (conversation.ws?.readyState !== WebSocket.OPEN) {
         void this.connect(conversation.runtimeId, conversation.reconnectUrl);
       }
-    }, delay);
+    }, reconnect.plan.delayMs);
   }
   /**
    * Cancel pending reconnection.
@@ -228,6 +248,7 @@ var DesktopAgentBridge = class extends EventEmitter {
     if (!trimmed) return this.snapshot(runtimeId);
     const conversation = this.getOrCreate(runtimeId);
     conversation.reconnectAttempt = 0;
+    conversation.connectionState = resetConnection(conversation.connectionState);
     await this.ensureConnected(runtimeId, wsUrl);
     const conv = this.getOrCreate(runtimeId);
     this.appendMessage(conv, {
@@ -252,6 +273,7 @@ var DesktopAgentBridge = class extends EventEmitter {
   async abort(runtimeId, wsUrl) {
     const conversation = this.getOrCreate(runtimeId);
     conversation.reconnectAttempt = 0;
+    conversation.connectionState = resetConnection(conversation.connectionState);
     await this.ensureConnected(runtimeId, wsUrl);
     const conv = this.getOrCreate(runtimeId);
     this.send(conv, {
@@ -268,6 +290,7 @@ var DesktopAgentBridge = class extends EventEmitter {
     this.cancelReconnect(conversation);
     conversation.reconnectAttempt = 0;
     conversation.reconnectUrl = null;
+    conversation.connectionState = stopConnection(conversation.connectionState);
     conversation.ws?.close();
     conversation.ws = null;
     conversation.connectPromise = null;
@@ -281,12 +304,10 @@ var DesktopAgentBridge = class extends EventEmitter {
     }
   }
   handleServerMessage(conversation, raw) {
-    let message;
-    try {
-      message = JSON.parse(raw);
-    } catch {
-      return;
-    }
+    const decoded = decodeProtocolFrame(raw, "server");
+    if (!decoded.ok) return;
+    conversation.connectionState = markConnectionActivity(conversation.connectionState);
+    const message = decoded.message;
     const payload = message.payload ?? {};
     switch (message.type) {
       case "session.start": {
@@ -390,7 +411,8 @@ var DesktopAgentBridge = class extends EventEmitter {
       activeAssistantMessageId: null,
       reconnectAttempt: 0,
       reconnectTimer: null,
-      reconnectUrl: null
+      reconnectUrl: null,
+      connectionState: createSurfaceConnectionState()
     };
     this.conversations.set(runtimeId, conversation);
     return conversation;
@@ -412,6 +434,73 @@ function stringValue(value) {
   return typeof value === "string" ? value : void 0;
 }
 
+// src/main/desktop-privileged-actions.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import {
+  createCompatibilityTrustBoundary,
+  isTrustDecisionAllowed
+} from "@wrongstack/core/security";
+var desktopCompatibilityTrustBoundary = createCompatibilityTrustBoundary({
+  policyId: "desktop-trusted-host-compat-v1"
+});
+async function authorizeDesktopAction(boundary, action, logger) {
+  const request = {
+    version: 1,
+    requestId: randomUUID2(),
+    actor: { kind: "user", id: "desktop-user" },
+    surface: "desktop",
+    capability: action.capability,
+    subject: action.subject,
+    risk: action.risk,
+    scope: action.cwd ? { cwd: action.cwd } : {},
+    authContext: { method: "local-process", principalId: "desktop-user" },
+    ...action.metadata ? { metadata: action.metadata } : {}
+  };
+  const decision = await boundary.evaluate(request);
+  const auditEntry = {
+    event: "desktop.trust_boundary.decision",
+    requestId: request.requestId,
+    capability: request.capability,
+    decision: decision.kind,
+    policyId: decision.policyId
+  };
+  if (logger) {
+    logger.info("Trust boundary decision", auditEntry);
+  } else {
+    console.warn(JSON.stringify({ level: "info", ...auditEntry, timestamp: (/* @__PURE__ */ new Date()).toISOString() }));
+  }
+  return { allowed: isTrustDecisionAllowed(decision), reason: decision.reason };
+}
+function authorizeDesktopRuntimeStart(boundary, cwd, runtimeKind) {
+  return authorizeDesktopAction(boundary, {
+    capability: "process.spawn",
+    subject: {
+      kind: "command",
+      id: "wrongstack-webui-runtime",
+      attributes: { runtimeKind }
+    },
+    risk: "high",
+    cwd,
+    metadata: { operation: "open-project" }
+  });
+}
+function authorizeDesktopRuntimeStop(boundary, runtime) {
+  return authorizeDesktopAction(boundary, {
+    capability: "process.terminate",
+    subject: {
+      kind: "process",
+      id: runtime.id,
+      attributes: {
+        ...runtime.pid !== void 0 ? { pid: runtime.pid } : {},
+        runtimeId: runtime.id
+      }
+    },
+    risk: "high",
+    cwd: runtime.root,
+    metadata: { operation: "close-runtime" }
+  });
+}
+
 // src/main/ipc.ts
 var IPC = {
   getState: "desktop:get-state",
@@ -754,36 +843,53 @@ function tMain(key) {
 // src/main/desktop-config-io.ts
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
-import { DefaultSecretVault } from "@wrongstack/core";
-import { decryptConfigSecrets, encryptConfigSecrets } from "@wrongstack/core/security";
+import { decryptConfigSecrets, DefaultSecretVault, encryptConfigSecrets } from "@wrongstack/core/security";
 import { atomicWrite, wstackGlobalRoot } from "@wrongstack/core/utils";
-var globalConfigPath = path.join(wstackGlobalRoot(), "config.json");
+var globalRoot = wstackGlobalRoot();
+var bootstrapConfigPath = path.join(globalRoot, "config.json");
+var defaultProfileConfigPath = path.join(globalRoot, "profiles", "default", "config.json");
 var vault = new DefaultSecretVault({
-  keyFile: path.join(wstackGlobalRoot(), ".key")
+  keyFile: path.join(globalRoot, ".key")
 });
+function safeProfileName(value) {
+  if (typeof value !== "string" || !value.trim()) return "default";
+  return value.replace(/[/\\:]/g, "_").replace(/\.\./g, "_") || "default";
+}
+async function resolveActiveProfileConfigPath() {
+  try {
+    const raw = await fs.readFile(bootstrapConfigPath, "utf8");
+    const parsed = JSON.parse(raw);
+    return path.join(globalRoot, "profiles", safeProfileName(parsed.activeProfile), "config.json");
+  } catch {
+    return defaultProfileConfigPath;
+  }
+}
 async function readUiLocale() {
+  const profileConfigPath = await resolveActiveProfileConfigPath();
   let raw;
   try {
-    raw = await fs.readFile(globalConfigPath, "utf8");
+    raw = await fs.readFile(profileConfigPath, "utf8");
   } catch {
     return void 0;
   }
   try {
-    const decrypted = decryptConfigSecrets(
-      JSON.parse(raw),
-      vault
-    );
+    const decrypted = decryptConfigSecrets(JSON.parse(raw), vault);
     const value = decrypted.uiLocale;
     return typeof value === "string" && value ? value : void 0;
   } catch {
     return void 0;
   }
 }
-var desktopConfigPaths = { globalConfigPath, vault };
+var desktopConfigPaths = {
+  bootstrapConfigPath,
+  profileConfigPath: defaultProfileConfigPath,
+  vault
+};
 async function writeUiLocale(code) {
+  const profileConfigPath = await resolveActiveProfileConfigPath();
   let raw;
   try {
-    raw = await fs.readFile(globalConfigPath, "utf8");
+    raw = await fs.readFile(profileConfigPath, "utf8");
   } catch {
     raw = "{}";
   }
@@ -796,7 +902,8 @@ async function writeUiLocale(code) {
   const decrypted = decryptConfigSecrets(parsed, vault);
   decrypted.uiLocale = code;
   const encrypted = encryptConfigSecrets(decrypted, vault);
-  await atomicWrite(globalConfigPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
+  await fs.mkdir(path.dirname(profileConfigPath), { recursive: true });
+  await atomicWrite(profileConfigPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
 }
 
 // src/main/runtime-manager.ts
@@ -811,15 +918,30 @@ import * as net from "node:net";
 import * as os from "node:os";
 import * as path2 from "node:path";
 import { fileURLToPath } from "node:url";
-import { atomicWrite as atomicWrite2, projectSlug, toErrorMessage, wstackGlobalRoot as wstackGlobalRoot2 } from "@wrongstack/core/utils";
+import {
+  atomicWrite as atomicWrite2,
+  buildChildEnv,
+  projectSlug,
+  resolveWstackPaths,
+  toErrorMessage,
+  wstackGlobalRoot as wstackGlobalRoot2
+} from "@wrongstack/core/utils";
 var HTTP_PORT_START = 34560;
 var WS_PORT_START = 34660;
 var START_TIMEOUT_MS = 3e4;
 var MIN_WINDOW_WIDTH = 760;
 var MIN_WINDOW_HEIGHT = 520;
 var DesktopRuntimeManager = class extends EventEmitter2 {
+  constructor(trustBoundary = desktopCompatibilityTrustBoundary) {
+    super();
+    this.trustBoundary = trustBoundary;
+  }
+  trustBoundary;
   runtimes = /* @__PURE__ */ new Map();
-  stateFile = path2.join(wstackGlobalRoot2(), "desktop.json");
+  stateFile = path2.join(
+    resolveWstackPaths({ projectRoot: process.cwd() }).configDir,
+    "desktop.json"
+  );
   recentProjects = [];
   registeredProjects = [];
   restoreProjectSessions = [];
@@ -930,6 +1052,10 @@ var DesktopRuntimeManager = class extends EventEmitter2 {
     const kind = options.kind ?? "project";
     const touchRecent = options.touchRecent ?? kind === "project";
     const forceNew = options.forceNew === true;
+    const authorization = await authorizeDesktopRuntimeStart(this.trustBoundary, resolved, kind);
+    if (!authorization.allowed) {
+      throw new Error(`Desktop runtime start denied: ${authorization.reason}`);
+    }
     if (!forceNew) {
       const existing = Array.from(this.runtimes.values()).find(
         (runtime2) => samePath(runtime2.root, resolved) && runtime2.kind === kind && (runtime2.status === "starting" || runtime2.status === "running")
@@ -1009,7 +1135,7 @@ var DesktopRuntimeManager = class extends EventEmitter2 {
         {
           cwd: resolved,
           env: {
-            ...process.env,
+            ...buildChildEnv(),
             ELECTRON_RUN_AS_NODE: "1",
             WEBUI_STRICT_PORT: "1",
             WRONGSTACK_DESKTOP: "1"
@@ -1088,6 +1214,13 @@ var DesktopRuntimeManager = class extends EventEmitter2 {
     this.emitChanged();
   }
   async closeRuntime(id) {
+    const runtime = this.runtimes.get(id);
+    if (runtime) {
+      const authorization = await authorizeDesktopRuntimeStop(this.trustBoundary, runtime);
+      if (!authorization.allowed) {
+        throw new Error(`Desktop runtime stop denied: ${authorization.reason}`);
+      }
+    }
     await this.closeRuntimeInternal(id, { persistWorkspace: true });
   }
   async closeAll(options = {}) {
@@ -1589,12 +1722,28 @@ function webuiPreloadPath() {
   return fileURLToPath(new URL("../preload/webui-preload.cjs", import.meta.url));
 }
 function desktopSettingsWorkspaceRoot() {
-  return path2.join(wstackGlobalRoot2(), "settings");
+  return path2.join(resolveWstackPaths({ projectRoot: process.cwd() }).configDir, "settings");
 }
 
 // src/main/main.ts
 import { watchProviderConfig } from "@wrongstack/core/storage";
 
+// src/main/webui/controller.ts
+import { shell, WebContentsView } from "electron";
+
+// src/main/state/constants.ts
+var OPEN_EXTERNAL_ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:", "mailto:"]);
+var SIDEBAR_WIDTH_WIDE = 292;
+var SIDEBAR_WIDTH_MEDIUM = 276;
+var SIDEBAR_WIDTH_NARROW = 252;
+var SIDEBAR_WIDTH_COLLAPSED = 56;
+var MIN_WINDOW_WIDTH2 = 760;
+var MIN_WINDOW_HEIGHT2 = 520;
+var MAX_PENDING_WEBUI_COMMANDS = 50;
+var MAX_PENDING_FLUSH_ATTEMPTS = 80;
+var WEBUI_COMMAND_FALLBACK_MS = 350;
+var WEBUI_COMMAND_ACK_TIMEOUT_MS = 2e3;
+
 // src/main/webui-command-bridge.ts
 var DESKTOP_WEBUI_ACTIONS = /* @__PURE__ */ new Set([
   "new-session",
@@ -1746,18 +1895,430 @@ function isRecord(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 
-// src/main/state/constants.ts
-var OPEN_EXTERNAL_ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:", "mailto:"]);
-var SIDEBAR_WIDTH_WIDE = 292;
-var SIDEBAR_WIDTH_MEDIUM = 276;
-var SIDEBAR_WIDTH_NARROW = 252;
-var SIDEBAR_WIDTH_COLLAPSED = 56;
-var MIN_WINDOW_WIDTH2 = 760;
-var MIN_WINDOW_HEIGHT2 = 520;
-var MAX_PENDING_WEBUI_COMMANDS = 50;
-var MAX_PENDING_FLUSH_ATTEMPTS = 80;
-var WEBUI_COMMAND_FALLBACK_MS = 350;
-var WEBUI_COMMAND_ACK_TIMEOUT_MS = 2e3;
+// src/main/webui/navigation.ts
+function allowedExternalProtocol(target) {
+  try {
+    const protocol = new URL(target).protocol;
+    return OPEN_EXTERNAL_ALLOWED_PROTOCOLS.has(protocol) ? protocol : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function sameOrigin(candidate, base) {
+  if (!base) return false;
+  try {
+    return new URL(candidate).origin === new URL(base).origin;
+  } catch {
+    return false;
+  }
+}
+
+// src/main/webui/controller.ts
+var DesktopWebuiController = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  ctx;
+  views = /* @__PURE__ */ new Map();
+  pendingAcks = /* @__PURE__ */ new Map();
+  activeRuntimeId = null;
+  status = { runtimeId: null, status: "idle" };
+  commandSequence = 0;
+  openExternal(target) {
+    const protocol = allowedExternalProtocol(target);
+    if (!protocol) return;
+    void authorizeDesktopAction(this.ctx.trustBoundary, {
+      capability: "url.open-external",
+      subject: { kind: "url", id: target, attributes: { protocol } },
+      risk: "elevated",
+      metadata: { operation: "webui-navigation" }
+    }).then(
+      (decision) => decision.allowed ? void shell.openExternal(target) : void 0
+    ).catch(() => void 0);
+  }
+  publishStatus(next) {
+    this.status = next;
+    const shellView2 = this.ctx.getShellView();
+    if (!shellView2 || shellView2.webContents.isDestroyed()) return;
+    shellView2.webContents.send(IPC.webuiStatusChanged, next);
+  }
+  setEntryStatus(entry, next) {
+    const previousPrefs = entry.status.prefs;
+    entry.status = {
+      ...next,
+      ...next.prefs === void 0 && previousPrefs !== void 0 ? { prefs: previousPrefs } : {},
+      // `pendingCommands` is always derived from the entry's own array (source of truth).
+      // Any `next.pendingCommands` value is intentionally overwritten.
+      pendingCommands: entry.pendingCommands.length
+    };
+    if (this.activeRuntimeId === entry.runtimeId) {
+      this.publishStatus(entry.status);
+      this.ctx.onPrefsChanged?.(previousPrefs, entry.status.prefs);
+    }
+  }
+  ensure(runtimeId) {
+    const mainWindow2 = this.ctx.getMainWindow();
+    if (!mainWindow2) return null;
+    const existing = this.views.get(runtimeId);
+    if (existing) return existing;
+    const view = new WebContentsView({
+      webPreferences: {
+        preload: webuiPreloadPath(),
+        contextIsolation: true,
+        nodeIntegration: false,
+        sandbox: false
+      }
+    });
+    const entry = {
+      runtimeId,
+      view,
+      url: null,
+      status: { runtimeId, status: "idle" },
+      bridgeReady: false,
+      attached: false,
+      pendingCommands: [],
+      pendingFlushTimer: null,
+      pendingFlushAttempts: 0
+    };
+    view.webContents.setWindowOpenHandler(({ url }) => {
+      this.openExternal(url);
+      return { action: "deny" };
+    });
+    view.webContents.on("will-navigate", (event, url) => {
+      if (sameOrigin(url, entry.url)) return;
+      event.preventDefault();
+      this.openExternal(url);
+    });
+    view.webContents.on("did-start-loading", () => {
+      if (this.views.get(runtimeId) !== entry) return;
+      entry.bridgeReady = false;
+      this.setEntryStatus(entry, { runtimeId, status: "loading" });
+    });
+    view.webContents.on("did-finish-load", () => {
+      if (this.views.get(runtimeId) !== entry) return;
+      this.scheduleFlush(entry);
+      try {
+        entry.view.webContents.send(IPC.webuiLocaleChanged, this.ctx.getLocale());
+      } catch {
+      }
+    });
+    view.webContents.on("did-fail-load", (_event, errorCode, errorDescription) => {
+      if (this.views.get(runtimeId) !== entry || errorCode === -3) return;
+      this.setEntryStatus(entry, { runtimeId, status: "error", error: errorDescription });
+    });
+    view.webContents.on("render-process-gone", (_event, details) => {
+      if (this.views.get(runtimeId) !== entry) return;
+      this.setEntryStatus(entry, {
+        runtimeId,
+        status: "error",
+        error: `WebUI renderer exited: ${details.reason}`
+      });
+    });
+    this.views.set(runtimeId, entry);
+    return entry;
+  }
+  attach(entry) {
+    const mainWindow2 = this.ctx.getMainWindow();
+    if (!mainWindow2 || entry.attached) return;
+    mainWindow2.contentView.addChildView(entry.view);
+    entry.attached = true;
+  }
+  dispose(entry) {
+    this.views.delete(entry.runtimeId);
+    entry.pendingCommands.length = 0;
+    this.settleRuntimeAcks(entry.runtimeId, false);
+    if (entry.pendingFlushTimer) clearTimeout(entry.pendingFlushTimer);
+    entry.pendingFlushTimer = null;
+    const mainWindow2 = this.ctx.getMainWindow();
+    if (mainWindow2 && entry.attached) mainWindow2.contentView.removeChildView(entry.view);
+    entry.attached = false;
+    if (!entry.view.webContents.isDestroyed()) entry.view.webContents.close();
+    if (this.activeRuntimeId === entry.runtimeId) this.activeRuntimeId = null;
+  }
+  disposeAll() {
+    for (const entry of [...this.views.values()]) this.dispose(entry);
+  }
+  findBySenderId(senderId) {
+    return [...this.views.values()].find((entry) => entry.view.webContents.id === senderId);
+  }
+  syncActive() {
+    if (!this.ctx.getMainWindow()) return;
+    const snapshot = this.ctx.manager.snapshot();
+    const live = new Set(snapshot.runtimes.filter((r) => r.status === "running").map((r) => r.id));
+    for (const [id, entry2] of this.views) if (!live.has(id)) this.dispose(entry2);
+    const active = snapshot.runtimes.find((runtime) => runtime.id === snapshot.activeRuntimeId);
+    if (active?.status !== "running") {
+      this.activeRuntimeId = active?.id ?? null;
+      this.publishStatus({ runtimeId: active?.id ?? null, status: "idle" });
+      this.ctx.layoutViews();
+      return;
+    }
+    const url = this.ctx.manager.getRuntimeUrlWithToken(active.id);
+    if (!url) {
+      this.activeRuntimeId = active.id;
+      this.publishStatus({ runtimeId: active.id, status: "idle" });
+      this.ctx.layoutViews();
+      return;
+    }
+    const entry = this.ensure(active.id);
+    if (!entry) return;
+    this.activeRuntimeId = active.id;
+    this.attach(entry);
+    this.ctx.layoutViews();
+    this.publishStatus(entry.status);
+    if (entry.url === url) return;
+    entry.url = url;
+    entry.bridgeReady = false;
+    this.setEntryStatus(entry, { runtimeId: active.id, status: "loading" });
+    void entry.view.webContents.loadURL(url).catch((error) => {
+      this.setEntryStatus(entry, {
+        runtimeId: active.id,
+        status: "error",
+        error: error instanceof Error ? error.message : String(error)
+      });
+    });
+  }
+  broadcastLocale(locale) {
+    for (const entry of this.views.values()) {
+      if (!entry.view.webContents.isDestroyed())
+        entry.view.webContents.send(IPC.webuiLocaleChanged, locale);
+    }
+  }
+  activeEntry() {
+    const id = this.ctx.manager.snapshot().activeRuntimeId;
+    return id ? this.views.get(id) : void 0;
+  }
+  async dispatch(commandInput) {
+    const command = normalizeDesktopWebuiCommand(commandInput);
+    if (!command) return false;
+    const entry = this.activeEntry();
+    if (!entry?.url) return false;
+    if (entry.status.status !== "ready" || !entry.bridgeReady) {
+      if (!entry.view.webContents.isLoading() && entry.status.status !== "error")
+        return this.dispatchNow(entry, command);
+      this.queue(entry, command);
+      this.scheduleFlush(entry);
+      return true;
+    }
+    return this.dispatchNow(entry, command);
+  }
+  async reload() {
+    const entry = this.activeEntry();
+    if (!entry?.url) return false;
+    entry.bridgeReady = false;
+    this.setEntryStatus(entry, { runtimeId: entry.runtimeId, status: "loading" });
+    return entry.view.webContents.loadURL(entry.url).then(() => true).catch((error) => {
+      this.setEntryStatus(entry, {
+        runtimeId: entry.runtimeId,
+        status: "error",
+        error: error instanceof Error ? error.message : String(error)
+      });
+      return false;
+    });
+  }
+  queue(entry, command) {
+    entry.pendingCommands.push(command);
+    if (entry.pendingCommands.length > MAX_PENDING_WEBUI_COMMANDS)
+      entry.pendingCommands.splice(0, entry.pendingCommands.length - MAX_PENDING_WEBUI_COMMANDS);
+    entry.pendingFlushAttempts = 0;
+    this.setEntryStatus(entry, entry.status);
+  }
+  dispatchNow(entry, command) {
+    if (this.views.get(entry.runtimeId) !== entry || !entry.url) return Promise.resolve(false);
+    const requestId = `${entry.runtimeId}:${Date.now()}:${++this.commandSequence}`;
+    const outbound = { ...command, requestId };
+    return new Promise((resolve2) => {
+      const fallbackTimer = setTimeout(() => {
+        if (!this.pendingAcks.has(requestId)) return;
+        if (this.views.get(entry.runtimeId) !== entry || entry.view.webContents.isDestroyed()) return;
+        void entry.view.webContents.executeJavaScript(buildWebuiCommandFallbackScript(outbound), true).catch(() => void 0);
+      }, WEBUI_COMMAND_FALLBACK_MS);
+      const timer = setTimeout(() => this.settleAck(requestId, false), WEBUI_COMMAND_ACK_TIMEOUT_MS);
+      this.pendingAcks.set(requestId, { runtimeId: entry.runtimeId, timer, fallbackTimer, resolve: resolve2 });
+      try {
+        entry.view.webContents.send(IPC.webuiCommand, outbound);
+        if (this.activeRuntimeId === entry.runtimeId) entry.view.webContents.focus();
+      } catch {
+        this.settleAck(requestId, false);
+      }
+    });
+  }
+  settleAck(requestId, handled) {
+    const pending = this.pendingAcks.get(requestId);
+    if (!pending) return;
+    this.pendingAcks.delete(requestId);
+    clearTimeout(pending.timer);
+    if (pending.fallbackTimer) clearTimeout(pending.fallbackTimer);
+    if (handled) {
+      const entry = this.views.get(pending.runtimeId);
+      if (entry) {
+        entry.bridgeReady = true;
+        this.setEntryStatus(entry, { ...entry.status, status: "ready" });
+      }
+    }
+    pending.resolve(handled);
+  }
+  settleRuntimeAcks(runtimeId, handled) {
+    for (const [id, pending] of [...this.pendingAcks])
+      if (pending.runtimeId === runtimeId) this.settleAck(id, handled);
+  }
+  scheduleFlush(entry) {
+    if (entry.pendingFlushTimer) return;
+    entry.pendingFlushTimer = setTimeout(() => {
+      entry.pendingFlushTimer = null;
+      void this.flush(entry);
+    }, 250);
+  }
+  async flush(entry) {
+    if (this.views.get(entry.runtimeId) !== entry || entry.pendingCommands.length === 0) return;
+    if (!entry.bridgeReady) {
+      entry.pendingFlushAttempts += 1;
+      const shouldExecuteFallback = !entry.view.webContents.isLoading() && entry.pendingFlushAttempts >= 4;
+      if (!shouldExecuteFallback && entry.pendingFlushAttempts <= MAX_PENDING_FLUSH_ATTEMPTS) {
+        this.scheduleFlush(entry);
+        this.setEntryStatus(entry, entry.status);
+        return;
+      }
+      if (!shouldExecuteFallback) {
+        entry.pendingCommands.length = 0;
+        this.setEntryStatus(entry, { runtimeId: entry.runtimeId, status: "error", error: "WebUI command bridge did not become ready." });
+        return;
+      }
+    }
+    entry.pendingFlushAttempts = 0;
+    const commands = entry.pendingCommands.splice(0);
+    this.setEntryStatus(entry, entry.status);
+    for (const command of commands) await this.dispatchNow(entry, command).catch(() => void 0);
+  }
+};
+
+// src/main/app-icon.ts
+import * as fs3 from "node:fs/promises";
+import { nativeImage } from "electron";
+async function readIcon(relativePath) {
+  try {
+    const iconPath = new URL(relativePath, import.meta.url).pathname;
+    await fs3.stat(iconPath);
+    const icon = nativeImage.createFromPath(iconPath);
+    return icon.isEmpty() ? void 0 : icon;
+  } catch {
+    return void 0;
+  }
+}
+async function loadDesktopAppIcon() {
+  if (process.platform !== "darwin") return readIcon("../../assets/icon.svg");
+  return await readIcon("../../assets/icon.png") ?? readIcon("../../assets/icon.icns");
+}
+
+// src/main/window-state-controller.ts
+var DesktopWindowStateController = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  ctx;
+  saveTimer = null;
+  scheduleSave() {
+    if (this.saveTimer) clearTimeout(this.saveTimer);
+    this.saveTimer = setTimeout(() => {
+      this.saveTimer = null;
+      void this.save();
+    }, 350);
+  }
+  async save() {
+    const window = this.ctx.getWindow();
+    if (!window || window.isDestroyed?.()) return;
+    const bounds = window.getNormalBounds();
+    await this.ctx.save({ ...bounds, maximized: window.isMaximized() });
+  }
+  validated(state) {
+    if (!state || !Number.isFinite(state.width) || !Number.isFinite(state.height) || state.width < MIN_WINDOW_WIDTH2 || state.height < MIN_WINDOW_HEIGHT2)
+      return null;
+    if (state.x === void 0 || state.y === void 0) {
+      return { width: state.width, height: state.height, maximized: state.maximized };
+    }
+    const candidate = { x: state.x, y: state.y, width: state.width, height: state.height };
+    return this.ctx.getDisplays().some(({ workArea }) => intersects(candidate, workArea)) ? { x: state.x, y: state.y, width: state.width, height: state.height, maximized: state.maximized } : null;
+  }
+};
+function intersects(left, right) {
+  return left.x < right.x + right.width && left.x + left.width > right.x && left.y < right.y + right.height && left.y + left.height > right.y;
+}
+
+// src/main/runtime/operations.ts
+import * as fs4 from "node:fs/promises";
+async function openProject(ctx, requestedRoot) {
+  let projectRoot = requestedRoot;
+  if (!projectRoot) {
+    projectRoot = await ctx.chooseProjectRoot("open");
+  }
+  if (!projectRoot) return ctx.getRuntimeManager().snapshot();
+  await ctx.getRuntimeManager().openProject(projectRoot);
+  ctx.syncActiveWebuiView();
+  ctx.broadcastState();
+  return ctx.getRuntimeManager().snapshot();
+}
+async function registerProject(ctx, requestedRoot) {
+  let projectRoot = requestedRoot;
+  if (!projectRoot) {
+    projectRoot = await ctx.chooseProjectRoot("register");
+  }
+  if (!projectRoot) return ctx.getRuntimeManager().snapshot();
+  await ctx.getRuntimeManager().registerProject(projectRoot);
+  ctx.broadcastState();
+  return ctx.getRuntimeManager().snapshot();
+}
+async function unregisterProject(ctx, root) {
+  if (!root || typeof root !== "string") return ctx.getRuntimeManager().snapshot();
+  await ctx.getRuntimeManager().unregisterProject(root);
+  ctx.broadcastState();
+  return ctx.getRuntimeManager().snapshot();
+}
+async function openProjectSession(ctx, runtimeId) {
+  const snapshot = ctx.getRuntimeManager().snapshot();
+  const runtime = (runtimeId ? snapshot.runtimes.find((candidate) => candidate.id === runtimeId) : void 0) ?? snapshot.runtimes.find((candidate) => candidate.id === snapshot.activeRuntimeId);
+  if (runtime?.kind !== "project") {
+    return openProject(ctx);
+  }
+  await ctx.getRuntimeManager().openProject(runtime.root, { forceNew: true });
+  ctx.syncActiveWebuiView();
+  ctx.broadcastState();
+  return ctx.getRuntimeManager().snapshot();
+}
+async function openSettings(ctx) {
+  const snapshot = ctx.getRuntimeManager().snapshot();
+  const active = snapshot.runtimes.find((runtime) => runtime.id === snapshot.activeRuntimeId);
+  if (!active || active.kind === "global-settings" || active.status !== "running") {
+    const root = desktopSettingsWorkspaceRoot();
+    await fs4.mkdir(root, { recursive: true });
+    await ctx.getRuntimeManager().openProject(root, {
+      name: "Global Settings",
+      kind: "global-settings",
+      touchRecent: false
+    });
+    ctx.syncActiveWebuiView();
+    ctx.broadcastState();
+  }
+  await ctx.dispatchWebuiCommand({ view: "settings" });
+  return ctx.getRuntimeManager().snapshot();
+}
+async function activateRuntime(ctx, id) {
+  await ctx.getRuntimeManager().activateRuntime(id);
+  ctx.syncActiveWebuiView();
+  ctx.broadcastState();
+  return ctx.getRuntimeManager().snapshot();
+}
+async function closeRuntime(ctx, id) {
+  ctx.getAgentBridge().close(id);
+  await ctx.getRuntimeManager().closeRuntime(id);
+  ctx.syncActiveWebuiView();
+  ctx.broadcastState();
+  return ctx.getRuntimeManager().snapshot();
+}
+async function restoreLastWorkspace(ctx) {
+  await ctx.getRuntimeManager().restoreLastWorkspace();
+  ctx.syncActiveWebuiView();
+  ctx.broadcastState();
+}
 
 // src/main/layout/sidebar.ts
 function getSidebarWidth(windowWidth, collapsed) {
@@ -2394,52 +2955,74 @@ initMacOS();
 if (process.platform === "win32") {
   app2.setAppUserModelId("com.wrongstack.desktop");
 }
-app2.setPath("userData", path4.join(wstackGlobalRoot3(), "desktop", "electron-profile"));
-var manager = new DesktopRuntimeManager();
+app2.setPath(
+  "userData",
+  path4.join(
+    resolveWstackPaths2({ projectRoot: process.cwd() }).configDir,
+    "desktop",
+    "electron-profile"
+  )
+);
+var desktopTrustBoundary = desktopCompatibilityTrustBoundary;
+var manager = new DesktopRuntimeManager(desktopTrustBoundary);
 var bridge = new DesktopAgentBridge();
 var mainWindow = null;
 var shellView = null;
-var webuiViews = /* @__PURE__ */ new Map();
-var activeWebuiRuntimeId = null;
-var webuiStatus = { runtimeId: null, status: "idle" };
-var webuiCommandSequence = 0;
 var shellSidebarCollapsed = false;
-var pendingWebuiCommandAcks = /* @__PURE__ */ new Map();
-var saveWindowStateTimer = null;
 var quittingAfterCleanup = false;
-function safeOpenExternal(target) {
-  let protocol;
-  try {
-    protocol = new URL(target).protocol;
-  } catch {
-    return;
+var webuiController = new DesktopWebuiController({
+  manager,
+  trustBoundary: desktopTrustBoundary,
+  getMainWindow: () => mainWindow,
+  getShellView: () => shellView,
+  getLocale: getMainLocale,
+  layoutViews: () => layoutWebuiViews(),
+  onPrefsChanged: (previous, next) => {
+    if (menuRelevantPrefsChanged(previous, next)) configureApplicationMenu2();
   }
-  if (OPEN_EXTERNAL_ALLOWED_PROTOCOLS.has(protocol)) {
-    void shell.openExternal(target);
-  }
-}
-function sameOrigin(candidate, base) {
-  if (!base) return false;
-  try {
-    return new URL(candidate).origin === new URL(base).origin;
-  } catch {
-    return false;
+});
+var windowStateController = new DesktopWindowStateController({
+  getWindow: () => mainWindow,
+  getDisplays: () => screen.getAllDisplays(),
+  save: (state) => manager.saveWindowState(state)
+});
+function safeOpenExternal(target) {
+  const protocol = allowedExternalProtocol(target);
+  if (protocol) {
+    void authorizeDesktopAction(desktopTrustBoundary, {
+      capability: "url.open-external",
+      subject: { kind: "url", id: target, attributes: { protocol } },
+      risk: "elevated",
+      metadata: { operation: "open-external" }
+    }).then((authorization) => {
+      if (authorization.allowed) return shell2.openExternal(target);
+      return void 0;
+    });
   }
 }
 function revealInExplorer(root) {
-  shell.openPath(root).catch((err) => {
-    if (process.platform === "darwin") {
-      void shell.openPath(path4.dirname(root)).catch(() => void 0);
-    }
-    console.error(
-      JSON.stringify({
-        level: "warn",
-        event: "desktop.reveal_in_explorer_failed",
-        root,
-        message: err instanceof Error ? err.message : String(err),
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      })
-    );
+  void authorizeDesktopAction(desktopTrustBoundary, {
+    capability: "filesystem.open-native",
+    subject: { kind: "path", id: root, attributes: { target: "file-manager" } },
+    risk: "elevated",
+    cwd: root,
+    metadata: { operation: "reveal-in-explorer" }
+  }).then((authorization) => {
+    if (!authorization.allowed) return;
+    return shell2.openPath(root).catch((err) => {
+      if (process.platform === "darwin") {
+        void shell2.openPath(path4.dirname(root)).catch(() => void 0);
+      }
+      console.error(
+        JSON.stringify({
+          level: "warn",
+          event: "desktop.reveal_in_explorer_failed",
+          root,
+          message: err instanceof Error ? err.message : String(err),
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        })
+      );
+    });
   });
 }
 function setShellSidebarCollapsed(collapsed) {
@@ -2452,57 +3035,6 @@ function setShellSidebarCollapsed(collapsed) {
 function menuRelevantPrefsChanged(previous, next) {
   return previous?.yolo !== next?.yolo || previous?.nextPrediction !== next?.nextPrediction || previous?.contextAutoCompact !== next?.contextAutoCompact;
 }
-function setEntryWebuiStatus(entry, next) {
-  const previousPrefs = entry.status.prefs;
-  entry.status = {
-    ...next,
-    prefs: next.prefs ?? entry.status.prefs,
-    pendingCommands: entry.pendingCommands.length || void 0
-  };
-  if (activeWebuiRuntimeId === entry.runtimeId) {
-    publishWebuiStatus(entry.status);
-    if (menuRelevantPrefsChanged(previousPrefs, entry.status.prefs)) {
-      configureApplicationMenu2();
-    }
-  }
-}
-function scheduleWindowStateSave() {
-  if (saveWindowStateTimer) clearTimeout(saveWindowStateTimer);
-  saveWindowStateTimer = setTimeout(() => {
-    saveWindowStateTimer = null;
-    void saveWindowState();
-  }, 350);
-}
-async function saveWindowState() {
-  if (!mainWindow) return;
-  const bounds = mainWindow.getNormalBounds();
-  await manager.saveWindowState({
-    x: bounds.x,
-    y: bounds.y,
-    width: bounds.width,
-    height: bounds.height,
-    maximized: mainWindow.isMaximized()
-  });
-}
-function validatedWindowState(state) {
-  if (!state) return null;
-  if (state.width < MIN_WINDOW_WIDTH2 || state.height < MIN_WINDOW_HEIGHT2) return null;
-  if (state.x === void 0 || state.y === void 0) return state;
-  const candidate = {
-    x: state.x,
-    y: state.y,
-    width: state.width,
-    height: state.height
-  };
-  const visibleOnSomeDisplay = screen.getAllDisplays().some((display) => {
-    const area = display.workArea;
-    return rectanglesIntersect(candidate, area);
-  });
-  return visibleOnSomeDisplay ? state : null;
-}
-function rectanglesIntersect(left, right) {
-  return left.x < right.x + right.width && left.x + left.width > right.x && left.y < right.y + right.height && left.y + left.height > right.y;
-}
 function layoutViews() {
   if (!mainWindow || !shellView) return;
   const size = mainWindow.getContentSize();
@@ -2520,7 +3052,7 @@ function layoutWebuiViews() {
   const active = snapshot.runtimes.find((runtime) => runtime.id === snapshot.activeRuntimeId);
   const sidebarWidth = getSidebarWidth(width, shellSidebarCollapsed);
   const contentWidth = Math.max(0, width - sidebarWidth);
-  for (const entry of webuiViews.values()) {
+  for (const entry of webuiController.views.values()) {
     const runtime = snapshot.runtimes.find((r) => r.id === entry.runtimeId);
     if (active?.id === entry.runtimeId && runtime?.status === "running") {
       entry.view.setBounds({ x: sidebarWidth, y: 0, width: contentWidth, height });
@@ -2529,413 +3061,32 @@ function layoutWebuiViews() {
     }
   }
 }
-function ensureWebuiEntry(runtimeId) {
-  if (!mainWindow) return null;
-  const existing = webuiViews.get(runtimeId);
-  if (existing) return existing;
-  const view = new WebContentsView({
-    webPreferences: {
-      preload: webuiPreloadPath(),
-      contextIsolation: true,
-      nodeIntegration: false,
-      sandbox: false
-    }
-  });
-  const entry = {
-    runtimeId,
-    view,
-    url: null,
-    status: { runtimeId, status: "idle" },
-    bridgeReady: false,
-    attached: false,
-    pendingCommands: [],
-    pendingFlushTimer: null,
-    pendingFlushAttempts: 0
-  };
-  view.webContents.setWindowOpenHandler(({ url }) => {
-    safeOpenExternal(url);
-    return { action: "deny" };
-  });
-  view.webContents.on("will-navigate", (event, url) => {
-    if (sameOrigin(url, entry.url)) return;
-    event.preventDefault();
-    safeOpenExternal(url);
-  });
-  view.webContents.on("did-start-loading", () => {
-    if (webuiViews.get(runtimeId) !== entry) return;
-    entry.bridgeReady = false;
-    setEntryWebuiStatus(entry, { runtimeId, status: "loading" });
-  });
-  view.webContents.on("did-finish-load", () => {
-    if (webuiViews.get(runtimeId) !== entry) return;
-    schedulePendingWebuiFlush(entry);
-    try {
-      entry.view.webContents.send(IPC.webuiLocaleChanged, getMainLocale());
-    } catch {
-    }
-  });
-  view.webContents.on("did-fail-load", (_event, errorCode, errorDescription) => {
-    if (webuiViews.get(runtimeId) !== entry || errorCode === -3) return;
-    setEntryWebuiStatus(entry, { runtimeId, status: "error", error: errorDescription });
-  });
-  view.webContents.on("render-process-gone", (_event, details) => {
-    if (webuiViews.get(runtimeId) !== entry) return;
-    setEntryWebuiStatus(entry, {
-      runtimeId,
-      status: "error",
-      error: `WebUI renderer exited: ${details.reason}`
-    });
-  });
-  webuiViews.set(runtimeId, entry);
-  return entry;
-}
-function attachWebuiEntry(entry) {
-  if (!mainWindow) return;
-  if (entry.attached) return;
-  mainWindow.contentView.addChildView(entry.view);
-  entry.attached = true;
-}
-function disposeWebuiEntry(entry) {
-  webuiViews.delete(entry.runtimeId);
-  entry.pendingCommands.length = 0;
-  settlePendingWebuiCommandAcksForRuntime(entry.runtimeId, false);
-  if (entry.pendingFlushTimer) {
-    clearTimeout(entry.pendingFlushTimer);
-    entry.pendingFlushTimer = null;
-  }
-  if (mainWindow && entry.attached) {
-    mainWindow.contentView.removeChildView(entry.view);
-  }
-  entry.attached = false;
-  if (!entry.view.webContents.isDestroyed()) {
-    entry.view.webContents.close();
-  }
-  if (activeWebuiRuntimeId === entry.runtimeId) activeWebuiRuntimeId = null;
-}
-function disposeAllWebuiEntries() {
-  for (const entry of Array.from(webuiViews.values())) {
-    disposeWebuiEntry(entry);
-  }
-  webuiViews.clear();
-}
-function pruneWebuiEntries(runtimeIds) {
-  const live = new Set(runtimeIds);
-  for (const [id, entry] of webuiViews) {
-    if (!live.has(id)) {
-      disposeWebuiEntry(entry);
-    }
-  }
-}
-function findWebuiEntryBySenderId(senderId) {
-  return Array.from(webuiViews.values()).find(
-    (candidate) => candidate.view.webContents.id === senderId
-  );
-}
-function syncActiveWebuiView() {
-  if (!mainWindow) return;
-  const snapshot = manager.snapshot();
-  pruneWebuiEntries(
-    snapshot.runtimes.filter((runtime) => runtime.status === "running").map((runtime) => runtime.id)
-  );
-  const active = snapshot.runtimes.find((runtime) => runtime.id === snapshot.activeRuntimeId);
-  if (active?.status !== "running") {
-    activeWebuiRuntimeId = active?.id ?? null;
-    publishWebuiStatus({ runtimeId: active?.id ?? null, status: "idle" });
-    layoutWebuiViews();
-    return;
-  }
-  const url = manager.getRuntimeUrlWithToken(active.id);
-  if (!url) {
-    activeWebuiRuntimeId = active.id;
-    publishWebuiStatus({ runtimeId: active.id, status: "idle" });
-    layoutWebuiViews();
-    return;
-  }
-  const entry = ensureWebuiEntry(active.id);
-  if (!entry) return;
-  activeWebuiRuntimeId = active.id;
-  attachWebuiEntry(entry);
-  layoutWebuiViews();
-  publishWebuiStatus(entry.status);
-  if (entry.url !== url) {
-    entry.url = url;
-    entry.bridgeReady = false;
-    setEntryWebuiStatus(entry, { runtimeId: active.id, status: "loading" });
-    void entry.view.webContents.loadURL(url).catch((err) => {
-      setEntryWebuiStatus(entry, {
-        runtimeId: active.id,
-        status: "error",
-        error: err instanceof Error ? err.message : String(err)
-      });
-      console.error(
-        JSON.stringify({
-          level: "error",
-          event: "desktop.webui_view_load_failed",
-          runtimeId: active.id,
-          message: err instanceof Error ? err.message : String(err),
-          timestamp: (/* @__PURE__ */ new Date()).toISOString()
-        })
-      );
-    });
-  }
-}
 function broadcastState() {
   if (!shellView || shellView.webContents.isDestroyed()) return;
   shellView.webContents.send(IPC.stateChanged, manager.snapshot());
 }
-function publishWebuiStatus(next) {
-  webuiStatus = next;
-  if (!shellView || shellView.webContents.isDestroyed()) return;
-  shellView.webContents.send(IPC.webuiStatusChanged, webuiStatus);
-}
-function broadcastLocaleToEmbeddedWebuis(locale) {
-  for (const entry of webuiViews.values()) {
-    if (entry.view.webContents.isDestroyed()) continue;
-    try {
-      entry.view.webContents.send(IPC.webuiLocaleChanged, locale);
-    } catch {
-    }
-  }
-}
-function getActiveWebuiEntry() {
-  const activeId = manager.snapshot().activeRuntimeId;
-  return activeId ? webuiViews.get(activeId) : void 0;
-}
-async function isWebuiCommandBridgeReady(entry) {
-  if (webuiViews.get(entry.runtimeId) !== entry || !entry.url) return false;
-  return entry.bridgeReady;
-}
-function queueWebuiCommand(entry, command) {
-  entry.pendingCommands.push(command);
-  if (entry.pendingCommands.length > MAX_PENDING_WEBUI_COMMANDS) {
-    entry.pendingCommands.splice(0, entry.pendingCommands.length - MAX_PENDING_WEBUI_COMMANDS);
-  }
-  entry.pendingFlushAttempts = 0;
-  setEntryWebuiStatus(entry, entry.status);
-}
-function nextWebuiCommandRequestId(runtimeId) {
-  webuiCommandSequence += 1;
-  return `${runtimeId}:${Date.now()}:${webuiCommandSequence}`;
-}
-async function dispatchWebuiCommand(commandInput) {
-  const command = normalizeDesktopWebuiCommand(commandInput);
-  if (!command) return false;
-  const entry = getActiveWebuiEntry();
-  if (!entry?.url) return false;
-  if (entry.status.status !== "ready") {
-    if (!entry.view.webContents.isLoading() && entry.status.status !== "error") {
-      return dispatchWebuiCommandNow(entry, command);
-    }
-    queueWebuiCommand(entry, command);
-    schedulePendingWebuiFlush(entry);
-    return true;
-  }
-  if (!await isWebuiCommandBridgeReady(entry)) {
-    if (!entry.view.webContents.isLoading()) {
-      return dispatchWebuiCommandNow(entry, command);
-    }
-    queueWebuiCommand(entry, command);
-    schedulePendingWebuiFlush(entry);
-    return true;
-  }
-  return dispatchWebuiCommandNow(entry, command);
-}
-async function reloadActiveWebuiView() {
-  const entry = getActiveWebuiEntry();
-  if (!entry?.url) return false;
-  entry.bridgeReady = false;
-  setEntryWebuiStatus(entry, { runtimeId: entry.runtimeId, status: "loading" });
-  return entry.view.webContents.loadURL(entry.url).then(() => true).catch((err) => {
-    setEntryWebuiStatus(entry, {
-      runtimeId: entry.runtimeId,
-      status: "error",
-      error: err instanceof Error ? err.message : String(err)
-    });
-    console.error(
-      JSON.stringify({
-        level: "error",
-        event: "desktop.webui_view_reload_failed",
-        runtimeId: entry.runtimeId,
-        message: err instanceof Error ? err.message : String(err),
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      })
-    );
-    return false;
-  });
-}
-async function dispatchWebuiCommandNow(entry, command) {
-  if (webuiViews.get(entry.runtimeId) !== entry || !entry.url) return false;
-  const requestId = nextWebuiCommandRequestId(entry.runtimeId);
-  const commandWithRequestId = { ...command, requestId };
-  return new Promise((resolve2) => {
-    const fallbackTimer = setTimeout(() => {
-      const pending = pendingWebuiCommandAcks.get(requestId);
-      if (!pending) return;
-      sendWebuiCommandDomFallback(entry, commandWithRequestId);
-    }, WEBUI_COMMAND_FALLBACK_MS);
-    const timer = setTimeout(() => {
-      settlePendingWebuiCommandAck(requestId, false);
-    }, WEBUI_COMMAND_ACK_TIMEOUT_MS);
-    pendingWebuiCommandAcks.set(requestId, {
-      runtimeId: entry.runtimeId,
-      timer,
-      fallbackTimer,
-      resolve: resolve2
-    });
-    try {
-      entry.view.webContents.send(IPC.webuiCommand, commandWithRequestId);
-      if (activeWebuiRuntimeId === entry.runtimeId) {
-        entry.view.webContents.focus();
-      }
-    } catch {
-      settlePendingWebuiCommandAck(requestId, false);
-    }
-  });
-}
-function sendWebuiCommandDomFallback(entry, command) {
-  if (webuiViews.get(entry.runtimeId) !== entry || entry.view.webContents.isDestroyed()) return;
-  void entry.view.webContents.executeJavaScript(buildWebuiCommandFallbackScript(command), true).catch(() => void 0);
-}
-function settlePendingWebuiCommandAck(requestId, handled) {
-  const pending = pendingWebuiCommandAcks.get(requestId);
-  if (!pending) return;
-  pendingWebuiCommandAcks.delete(requestId);
-  clearTimeout(pending.timer);
-  if (pending.fallbackTimer) clearTimeout(pending.fallbackTimer);
-  if (handled) {
-    const entry = webuiViews.get(pending.runtimeId);
-    if (entry) {
-      entry.bridgeReady = true;
-      setEntryWebuiStatus(entry, { ...entry.status, status: "ready" });
-    }
-  }
-  pending.resolve(handled);
-}
-function settlePendingWebuiCommandAcksForRuntime(runtimeId, handled) {
-  for (const [requestId, pending] of [...pendingWebuiCommandAcks]) {
-    if (pending.runtimeId === runtimeId) {
-      settlePendingWebuiCommandAck(requestId, handled);
-    }
-  }
-}
-async function flushPendingWebuiCommands(entry) {
-  if (webuiViews.get(entry.runtimeId) !== entry) return;
-  if (entry.pendingCommands.length === 0) return;
-  if (!await isWebuiCommandBridgeReady(entry)) {
-    entry.pendingFlushAttempts += 1;
-    const canFallback = !entry.view.webContents.isLoading() && entry.pendingFlushAttempts >= 4;
-    if (!canFallback && entry.pendingFlushAttempts <= MAX_PENDING_FLUSH_ATTEMPTS) {
-      schedulePendingWebuiFlush(entry);
-      setEntryWebuiStatus(entry, entry.status);
-      return;
-    }
-    if (!canFallback) {
-      entry.pendingCommands.length = 0;
-      setEntryWebuiStatus(entry, {
-        runtimeId: entry.runtimeId,
-        status: "error",
-        error: "WebUI command bridge did not become ready."
-      });
-      return;
-    }
-  }
-  entry.pendingFlushAttempts = 0;
-  const commands = entry.pendingCommands.splice(0, entry.pendingCommands.length);
-  setEntryWebuiStatus(entry, entry.status);
-  for (const command of commands) {
-    await dispatchWebuiCommandNow(entry, command).catch(() => void 0);
-  }
-}
-function schedulePendingWebuiFlush(entry) {
-  if (entry.pendingFlushTimer) return;
-  entry.pendingFlushTimer = setTimeout(() => {
-    entry.pendingFlushTimer = null;
-    void flushPendingWebuiCommands(entry);
-  }, 250);
-}
-async function openProject(requestedRoot) {
-  let projectRoot = requestedRoot;
-  if (!projectRoot) {
+var runtimeOperationsContext = {
+  getRuntimeManager: () => manager,
+  getAgentBridge: () => bridge,
+  broadcastState,
+  syncActiveWebuiView: () => webuiController.syncActive(),
+  dispatchWebuiCommand: (command) => webuiController.dispatch(command),
+  chooseProjectRoot: async (kind) => {
     const result = await dialog.showOpenDialog({
-      title: tMain("openProject"),
+      title: tMain(kind === "open" ? "openProject" : "registerProject"),
       properties: ["openDirectory"]
     });
-    projectRoot = result.filePaths[0];
+    return result.filePaths[0];
   }
-  if (!projectRoot) return manager.snapshot();
-  await manager.openProject(projectRoot);
-  syncActiveWebuiView();
-  broadcastState();
-  return manager.snapshot();
-}
-async function registerProject(requestedRoot) {
-  let projectRoot = requestedRoot;
-  if (!projectRoot) {
-    const result = await dialog.showOpenDialog({
-      title: tMain("registerProject"),
-      properties: ["openDirectory"]
-    });
-    projectRoot = result.filePaths[0];
-  }
-  if (!projectRoot) return manager.snapshot();
-  await manager.registerProject(projectRoot);
-  broadcastState();
-  return manager.snapshot();
-}
-async function unregisterProject(root) {
-  if (!root || typeof root !== "string") return manager.snapshot();
-  await manager.unregisterProject(root);
-  broadcastState();
-  return manager.snapshot();
-}
-async function openProjectSession(runtimeId) {
-  const snapshot = manager.snapshot();
-  const runtime = (runtimeId ? snapshot.runtimes.find((candidate) => candidate.id === runtimeId) : void 0) ?? snapshot.runtimes.find((candidate) => candidate.id === snapshot.activeRuntimeId);
-  if (runtime?.kind !== "project") {
-    return openProject();
-  }
-  await manager.openProject(runtime.root, { forceNew: true });
-  syncActiveWebuiView();
-  broadcastState();
-  return manager.snapshot();
-}
-async function openSettings() {
-  const snapshot = manager.snapshot();
-  const active = snapshot.runtimes.find((runtime) => runtime.id === snapshot.activeRuntimeId);
-  if (!active || active.kind === "global-settings" || active.status !== "running") {
-    const root = desktopSettingsWorkspaceRoot();
-    await fs3.mkdir(root, { recursive: true });
-    await manager.openProject(root, {
-      name: "Global Settings",
-      kind: "global-settings",
-      touchRecent: false
-    });
-    syncActiveWebuiView();
-    broadcastState();
-  }
-  await dispatchWebuiCommand({ view: "settings" });
-  return manager.snapshot();
-}
-async function activateRuntime(id) {
-  await manager.activateRuntime(id);
-  syncActiveWebuiView();
-  broadcastState();
-  return manager.snapshot();
-}
-async function closeRuntime(id) {
-  bridge.close(id);
-  await manager.closeRuntime(id);
-  const entry = webuiViews.get(id);
-  if (entry) disposeWebuiEntry(entry);
-  syncActiveWebuiView();
-  broadcastState();
-  return manager.snapshot();
-}
-async function restoreLastWorkspace() {
-  await manager.restoreLastWorkspace();
-  syncActiveWebuiView();
-  broadcastState();
-}
+};
+var openProject2 = (root) => openProject(runtimeOperationsContext, root);
+var registerProject2 = (root) => registerProject(runtimeOperationsContext, root);
+var unregisterProject2 = (root) => unregisterProject(runtimeOperationsContext, root);
+var openProjectSession2 = (id) => openProjectSession(runtimeOperationsContext, id);
+var openSettings2 = () => openSettings(runtimeOperationsContext);
+var activateRuntime2 = (id) => activateRuntime(runtimeOperationsContext, id);
+var closeRuntime2 = (id) => closeRuntime(runtimeOperationsContext, id);
+var restoreLastWorkspace2 = () => restoreLastWorkspace(runtimeOperationsContext);
 function createMenuContext() {
   return {
     getSnapshot: () => manager.snapshot(),
@@ -2946,44 +3097,44 @@ function createMenuContext() {
     getActiveWebuiPrefs: () => {
       const snapshot = manager.snapshot();
       if (!snapshot.activeRuntimeId) return void 0;
-      return webuiViews.get(snapshot.activeRuntimeId)?.status.prefs;
+      return webuiController.views.get(snapshot.activeRuntimeId)?.status.prefs;
     },
     getShellSidebarCollapsed: () => shellSidebarCollapsed,
     t: tMain,
     getRuntimeManager: () => manager,
-    getWebuiViews: () => webuiViews,
-    dispatchWebuiCommand,
-    reloadActiveWebuiView,
+    getWebuiViews: () => webuiController.views,
+    dispatchWebuiCommand: (command) => webuiController.dispatch(command),
+    reloadActiveWebuiView: () => webuiController.reload(),
     activateRuntime: async (id) => {
-      await activateRuntime(id);
+      await activateRuntime2(id);
     },
     openProject: async () => {
-      await openProject();
+      await openProject2();
     },
     registerProject: async () => {
-      await registerProject();
+      await registerProject2();
     },
     openSettings: async () => {
-      await openSettings();
+      await openSettings2();
     },
     openProjectSession: async (id) => {
-      await openProjectSession(id);
+      await openProjectSession2(id);
     },
     closeRuntime: async (id) => {
-      await closeRuntime(id);
+      await closeRuntime2(id);
     },
     unregisterProject: async (root) => {
-      await unregisterProject(root);
+      await unregisterProject2(root);
     },
-    getActiveRuntimeId: () => activeWebuiRuntimeId,
+    getActiveRuntimeId: () => webuiController.activeRuntimeId,
     setShellSidebarCollapsed: (collapsed) => {
       setShellSidebarCollapsed(collapsed);
     },
     restoreLastWorkspace: async () => {
-      await restoreLastWorkspace();
+      await restoreLastWorkspace2();
     },
     openExternal: (url) => {
-      shell.openExternal(url);
+      safeOpenExternal(url);
     },
     revealInExplorer: (root) => {
       revealInExplorer(root);
@@ -2997,8 +3148,8 @@ function buildIpcHandlerContext() {
   return {
     getMainWindow: () => mainWindow,
     getShellView: () => shellView,
-    getWebuiViews: () => webuiViews,
-    getWebuiStatus: () => webuiStatus,
+    getWebuiViews: () => webuiController.views,
+    getWebuiStatus: () => webuiController.status,
     getRuntimeManager: () => manager,
     getAgentBridge: () => bridge,
     getI18n: () => ({ getMainLocale, setMainLocale, tMain }),
@@ -3006,37 +3157,40 @@ function buildIpcHandlerContext() {
     getShellSidebarCollapsed: () => shellSidebarCollapsed,
     setShellSidebarCollapsed: (collapsed) => setShellSidebarCollapsed(collapsed),
     broadcastState: () => broadcastState(),
-    publishWebuiStatus: (next) => publishWebuiStatus(next),
-    syncActiveWebuiView: () => syncActiveWebuiView(),
+    publishWebuiStatus: (next) => {
+      const entry = next.runtimeId ? webuiController.views.get(next.runtimeId) : void 0;
+      if (entry) webuiController.setEntryStatus(entry, next);
+    },
+    syncActiveWebuiView: () => webuiController.syncActive(),
     configureApplicationMenu: () => configureApplicationMenu2(),
-    broadcastLocaleToEmbeddedWebuis: (locale) => broadcastLocaleToEmbeddedWebuis(locale),
-    dispatchWebuiCommand: (command) => dispatchWebuiCommand(command),
-    reloadActiveWebuiView: () => reloadActiveWebuiView(),
-    openProject: (root) => openProject(root),
-    registerProject: (root) => registerProject(root),
-    unregisterProject: (root) => unregisterProject(root),
-    openProjectSession: (id) => openProjectSession(id),
-    activateRuntime: (id) => activateRuntime(id),
-    closeRuntime: (id) => closeRuntime(id),
-    openSettings: () => openSettings(),
+    broadcastLocaleToEmbeddedWebuis: (locale) => webuiController.broadcastLocale(locale),
+    dispatchWebuiCommand: (command) => webuiController.dispatch(command),
+    reloadActiveWebuiView: () => webuiController.reload(),
+    openProject: (root) => openProject2(root),
+    registerProject: (root) => registerProject2(root),
+    unregisterProject: (root) => unregisterProject2(root),
+    openProjectSession: (id) => openProjectSession2(id),
+    activateRuntime: (id) => activateRuntime2(id),
+    closeRuntime: (id) => closeRuntime2(id),
+    openSettings: () => openSettings2(),
     sendMessage: (id, wsUrl, content) => bridge.sendMessage(id, wsUrl, content),
     abortRuntime: (id, wsUrl) => bridge.abort(id, wsUrl),
     openExternal: (url) => safeOpenExternal(url),
     revealInExplorer: (root) => {
       revealInExplorer(root);
     },
-    findWebuiEntryBySenderId: (senderId) => findWebuiEntryBySenderId(senderId),
-    getPendingWebuiCommandAcks: () => pendingWebuiCommandAcks,
-    settlePendingWebuiCommandAck: (requestId, handled) => settlePendingWebuiCommandAck(requestId, handled),
-    setEntryWebuiStatus: (entry, next) => setEntryWebuiStatus(entry, next),
-    schedulePendingWebuiFlush: (entry) => schedulePendingWebuiFlush(entry)
+    findWebuiEntryBySenderId: (senderId) => webuiController.findBySenderId(senderId),
+    getPendingWebuiCommandAcks: () => webuiController.pendingAcks,
+    settlePendingWebuiCommandAck: (requestId, handled) => webuiController.settleAck(requestId, handled),
+    setEntryWebuiStatus: (entry, next) => webuiController.setEntryStatus(entry, next),
+    schedulePendingWebuiFlush: (entry) => webuiController.scheduleFlush(entry)
   };
 }
 async function boot() {
   const locale = await readUiLocale();
   if (locale) setMainLocale(locale);
   const shellUrl = rendererIndexPath();
-  shellView = new WebContentsView({
+  shellView = new WebContentsView2({
     webPreferences: {
       preload: preloadPath(),
       contextIsolation: true,
@@ -3050,34 +3204,10 @@ async function boot() {
   });
   registerIpcHandlers(buildIpcHandlerContext());
   await shellView.webContents.loadURL(shellUrl);
-  const prevState = validatedWindowState(manager.getWindowState());
+  const prevState = windowStateController.validated(manager.getWindowState());
   const defaultWidth = 1180;
   const defaultHeight = 720;
-  let appIcon;
-  if (process.platform !== "darwin") {
-    try {
-      const iconPath = new URL("../../assets/icon.svg", import.meta.url).pathname;
-      await fs3.stat(iconPath);
-      appIcon = nativeImage.createFromPath(iconPath);
-      if (appIcon.isEmpty()) appIcon = void 0;
-    } catch {
-    }
-  } else {
-    try {
-      const pngPath = new URL("../../assets/icon.png", import.meta.url).pathname;
-      await fs3.stat(pngPath);
-      appIcon = nativeImage.createFromPath(pngPath);
-      if (appIcon.isEmpty()) appIcon = void 0;
-    } catch {
-      try {
-        const icnsPath = new URL("../../assets/icon.icns", import.meta.url).pathname;
-        await fs3.stat(icnsPath);
-        appIcon = nativeImage.createFromPath(icnsPath);
-        if (appIcon.isEmpty()) appIcon = void 0;
-      } catch {
-      }
-    }
-  }
+  const appIcon = await loadDesktopAppIcon();
   const winOptions = {
     width: prevState?.width ?? defaultWidth,
     height: prevState?.height ?? defaultHeight,
@@ -3092,10 +3222,10 @@ async function boot() {
     if (prevState.y !== void 0) winOptions.y = prevState.y;
   }
   mainWindow = new BaseWindow(winOptions);
-  mainWindow.on("resized", scheduleWindowStateSave);
-  mainWindow.on("moved", scheduleWindowStateSave);
-  mainWindow.on("maximize", scheduleWindowStateSave);
-  mainWindow.on("unmaximize", scheduleWindowStateSave);
+  mainWindow.on("resized", () => windowStateController.scheduleSave());
+  mainWindow.on("moved", () => windowStateController.scheduleSave());
+  mainWindow.on("maximize", () => windowStateController.scheduleSave());
+  mainWindow.on("unmaximize", () => windowStateController.scheduleSave());
   if (prevState?.maximized) {
     mainWindow.maximize();
   }
@@ -3108,7 +3238,7 @@ async function boot() {
     shellView.webContents.send(IPC.conversationChanged, conversation);
   });
   manager.on("changed", () => {
-    syncActiveWebuiView();
+    webuiController.syncActive();
     configureApplicationMenu2();
     broadcastState();
   });
@@ -3118,8 +3248,9 @@ async function boot() {
     }
   });
   let lastWatchedLocale;
+  const activeProfileConfigPath = await resolveActiveProfileConfigPath();
   watchProviderConfig(
-    desktopConfigPaths.globalConfigPath,
+    activeProfileConfigPath,
     desktopConfigPaths.vault,
     (snapshot) => {
       const updated = snapshot.uiLocale;
@@ -3127,7 +3258,7 @@ async function boot() {
       lastWatchedLocale = updated;
       setMainLocale(updated);
       configureApplicationMenu2();
-      broadcastLocaleToEmbeddedWebuis(updated);
+      webuiController.broadcastLocale(updated);
       if (shellView && !shellView.webContents.isDestroyed()) {
         shellView.webContents.send(IPC.localeChanged, updated);
       }
@@ -3137,12 +3268,12 @@ async function boot() {
     if (quittingAfterCleanup) return;
     event.preventDefault();
     bridge.closeAll();
-    disposeAllWebuiEntries();
-    void saveWindowState();
+    webuiController.disposeAll();
+    void windowStateController.save();
     quittingAfterCleanup = true;
     app2.exit(0);
   });
-  await restoreLastWorkspace();
+  await restoreLastWorkspace2();
   const argvOpenPath = firstOpenFileArg(process.argv);
   const queuedOpenPath = drainPendingOpenFilePath();
   const openPath = argvOpenPath ?? queuedOpenPath;
@@ -3161,10 +3292,10 @@ app2.on("window-all-closed", () => {
 app2.on("before-quit", () => {
   if (mainWindow) {
     mainWindow.removeAllListeners("close");
-    void saveWindowState();
+    void windowStateController.save();
   }
   bridge.closeAll();
-  disposeAllWebuiEntries();
+  webuiController.disposeAll();
 });
 app2.on("activate", () => {
   if (!mainWindow) return;