@wtfalch/desktop 0.0.0-stage → 0.1.1

package/src/shell.mjs

@@ -0,0 +1,471 @@
+import { mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+// Main process only; loaded by startShell() so that importing the package
+// outside Electron (tests, check scripts) never imports 'electron'.
+import {
+  BrowserWindow,
+  Menu,
+  WebContentsView,
+  app,
+  dialog,
+  ipcMain,
+  safeStorage,
+  screen,
+  session,
+  shell,
+} from 'electron';
+import updaterPkg from 'electron-updater';
+import { accessNavigation, partitionFetcher, probeAccess, waitForAccess } from './access.mjs';
+import {
+  forgetCompany,
+  loadCompany,
+  loadPendingClear,
+  markPendingClear,
+  saveCompany,
+} from './company.mjs';
+import { validateConfig } from './config.mjs';
+import { findDeepLinkArg, initialDeepLink, resolveDeepLink } from './deep-link.mjs';
+import { wireCloseBehavior } from './lifecycle.mjs';
+import { menuTemplate } from './menu.mjs';
+import { discover, originForAddress, originForEmail } from './resolve.mjs';
+import {
+  allowedNavigation,
+  permissionCheckHandler,
+  permissionRequestHandler,
+  secureContents,
+  trustedSender,
+  trustedWelcomeSender,
+} from './security.mjs';
+import { configureUpdater, installUpdaterRecovery } from './updater.mjs';
+import { welcomeDir } from './welcome-dir.mjs';
+import { clampBounds, readWindowState, writeWindowState } from './window-state.mjs';
+
+const { autoUpdater } = updaterPkg;
+
+export function run(config) {
+  validateConfig(config);
+  const { appName, signIn } = config;
+  const fixed = config.origin.kind === 'fixed';
+  const welcomeFile = join(welcomeDir, 'welcome.html');
+  const welcomeUrl = pathToFileURL(welcomeFile).href;
+  app.setName(appName);
+  // A packaged build gets its scheme from Info.plist; registering an unpackaged
+  // Electron binary would hand <scheme>:// links to a dev checkout.
+  if (app.isPackaged) app.setAsDefaultProtocolClient(signIn.scheme);
+  const profile = join(app.getPath('appData'), config.dataDirName);
+  mkdirSync(profile, { recursive: true, mode: 0o700 });
+  app.setPath('userData', profile);
+
+  // Plain-http localhost origins and the dev environment overrides exist for
+  // development and tests; a packaged app has none of them.
+  const local = { allowLocal: !app.isPackaged };
+  const devEnv = (name) => (app.isPackaged ? undefined : process.env[name] || undefined);
+  const fixedOrigin = fixed
+    ? devEnv(config.devOriginEnv)
+      ? originForAddress(devEnv(config.devOriginEnv), local)
+      : config.origin.origin
+    : undefined;
+  const navOptions = config.navigationLinks && {
+    scheme: signIn.scheme,
+    pathPrefix: config.navigationLinks.pathPrefix,
+  };
+
+  let login;
+  let showWindow = () => {};
+  let routeLink;
+  // macOS can hand us a link before the app is ready. A sign-in link finds
+  // nothing waiting and is ignored; a page link is queued for the window.
+  const queuedLinks = [];
+  app.on('open-url', (event, url) => {
+    event.preventDefault();
+    if (login?.handleDeepLink(url)) showWindow();
+    else if (navOptions) {
+      if (routeLink) routeLink(url);
+      else queuedLinks.push(url);
+    }
+  });
+
+  const locked = new WeakSet();
+  const lockSession = (partition, origin) => {
+    if (locked.has(partition)) return partition;
+    locked.add(partition);
+    if (origin) {
+      partition.setPermissionRequestHandler(permissionRequestHandler(origin, config.permissions));
+      partition.setPermissionCheckHandler(permissionCheckHandler(origin, config.permissions));
+    } else {
+      partition.setPermissionRequestHandler((_contents, _permission, callback) => callback(false));
+      partition.setPermissionCheckHandler(() => false);
+    }
+    partition.on('will-download', (_event, item) => item.cancel());
+    return partition;
+  };
+  const companyPartition = (origin) =>
+    lockSession(
+      session.fromPartition(`${config.partitionPrefix}${Buffer.from(origin).toString('hex')}`),
+      origin,
+    );
+  async function clearPartition(partition) {
+    await partition.clearStorageData();
+    await partition.clearCache();
+    await partition.cookies.flushStore();
+  }
+  const context = (origin) => {
+    const partition = companyPartition(origin);
+    // Every request to the company origin goes through its partition's session.
+    return {
+      origin,
+      partition,
+      fetcher: partitionFetcher(partition),
+      userDataDir: profile,
+      safeStorage,
+      openBrowser: (url) => shell.openExternal(url),
+    };
+  };
+
+  if (!app.requestSingleInstanceLock()) app.quit();
+  else
+    void app
+      .whenReady()
+      .then(async () => {
+        const companyFile = join(profile, 'company.json');
+        const stateFile = join(profile, 'window-state.json');
+        // A session left behind by a crash during sign-in or sign-out is cleared first.
+        const leftover = loadPendingClear(companyFile, local);
+        if (leftover) {
+          await clearPartition(companyPartition(leftover)).catch(() => {});
+          forgetCompany(companyFile);
+        }
+        let company = loadCompany(companyFile, local);
+        const savedState = readWindowState(stateFile);
+        const window = new BrowserWindow({
+          ...clampBounds(savedState?.bounds, screen.getAllDisplays()),
+          show: false,
+        });
+        if (savedState?.maximized) window.maximize();
+        showWindow = () => {
+          window.show();
+          window.focus();
+        };
+
+        // The window holds one view at a time: the welcome screen, in its own
+        // in-memory session, the Access login, or the company's page, in the
+        // company's partition.
+        let view;
+        const fit = () => {
+          const [width, height] = window.getContentSize();
+          view?.setBounds({ x: 0, y: 0, width, height });
+        };
+        const setView = (next) => {
+          if (view) {
+            window.contentView.removeChildView(view);
+            view.webContents.close();
+          }
+          view = next;
+          window.contentView.addChildView(view);
+          fit();
+        };
+        window.on('resize', fit);
+        const preferences = {
+          nodeIntegration: false,
+          contextIsolation: true,
+          sandbox: true,
+          webSecurity: true,
+          devTools: !app.isPackaged,
+        };
+
+        let userCancelled = false;
+        let gate; // the Access login in progress: { cancelled }
+        const cancelSignIn = () => {
+          userCancelled = true;
+          if (gate) gate.cancelled = true;
+          login?.cancel();
+        };
+        const welcomeConfig = JSON.stringify({
+          appName,
+          fixed,
+          host: fixed ? new URL(fixedOrigin).host : undefined,
+          hostPrefix: config.origin.hostPrefix,
+        });
+        // notice: 'failed', 'ended', 'offline:<name>' or 'waiting:<code>', shown by the page from its fragment.
+        const showWelcome = async (notice) => {
+          const next = new WebContentsView({
+            webPreferences: {
+              ...preferences,
+              session: lockSession(session.fromPartition('shell-welcome')),
+              preload: join(welcomeDir, 'welcome-preload.cjs'),
+              additionalArguments: [`--shell-welcome=${encodeURIComponent(welcomeConfig)}`],
+            },
+          });
+          secureContents(next.webContents, (url) => url.split('#')[0] === welcomeUrl);
+          // The page's buttons change the fragment; that is its whole API.
+          next.webContents.on('did-navigate-in-page', (_event, url, isMainFrame) => {
+            if (!isMainFrame) return;
+            const hash = new URL(url).hash;
+            if (hash.startsWith('#cancel')) cancelSignIn();
+            else if (hash.startsWith('#retry') && company) void showCompany(company);
+            else if (hash.startsWith('#retry') && fixed) void signInFixed().catch(() => {});
+            else if (hash.startsWith('#signin') && fixed) void signInFixed().catch(() => {});
+          });
+          setView(next);
+          await next.webContents.loadFile(welcomeFile, notice ? { hash: notice } : undefined);
+        };
+        // The server sent the company window to its own sign-in page: the session is gone.
+        let ending = false;
+        const endSession = () => {
+          if (ending) return;
+          ending = true;
+          void signOut('ended')
+            .catch(() => {})
+            .finally(() => {
+              ending = false;
+            });
+        };
+
+        // Behind Cloudflare Access. Resolves 'passed', 'offline' (the origin could
+        // not be reached), 'cancelled' or 'failed'. When Access wants a login, the
+        // window shows the origin so the person passes it there, and the shell
+        // polls through the partition until the origin answers for itself.
+        const passAccess = async (found) => {
+          if (config.accessProbePath === null) return 'passed';
+          const { partition, fetcher } = context(found.origin);
+          const probe = () => probeAccess(fetcher, found.origin, config.accessProbePath);
+          // Set before the first await so a second request cannot open a second gate.
+          const mine = { cancelled: false };
+          gate = mine;
+          try {
+            const first = await probe();
+            if (first !== 'access') return first;
+            const next = new WebContentsView({
+              webPreferences: { ...preferences, session: partition },
+            });
+            secureContents(next.webContents, (url) => accessNavigation(url, found.origin));
+            setView(next);
+            next.webContents.loadURL(found.origin).catch(() => {});
+            try {
+              await waitForAccess({ probe, isCancelled: () => mine.cancelled });
+              return 'passed';
+            } catch {
+              // Pages visited while gating must leave nothing behind.
+              if (mine.cancelled) await clearPartition(partition).catch(() => {});
+              return mine.cancelled ? 'cancelled' : 'failed';
+            }
+          } finally {
+            if (gate === mine) gate = undefined;
+          }
+        };
+        // What to show when Access was not passed.
+        const showGateFailure = async (found, result) => {
+          if (result === 'offline') await showWelcome(`offline:${encodeURIComponent(found.name)}`);
+          else await showWelcome(result === 'cancelled' ? undefined : 'failed');
+        };
+
+        const showCompany = async (found) => {
+          const access = await passAccess(found);
+          if (access !== 'passed') {
+            await showGateFailure(found, access);
+            return;
+          }
+          const next = new WebContentsView({
+            webPreferences: {
+              ...preferences,
+              session: companyPartition(found.origin),
+              ...(signIn.preload ? { preload: signIn.preload } : {}),
+            },
+          });
+          secureContents(
+            next.webContents,
+            (url) => allowedNavigation(url, found.origin),
+            (url) => {
+              if (view === next && new URL(url).origin === found.origin) endSession();
+            },
+          );
+          setView(next);
+          try {
+            await next.webContents.loadURL(`${found.origin}${config.landingPath}`);
+          } catch (error) {
+            // A blocked redirect is the session ending, handled above. Anything else is
+            // the network: keep the company and the session, and offer to try again.
+            if (view === next && !ending && !/ERR_ABORTED/.test(error.message))
+              await showWelcome(`offline:${encodeURIComponent(found.name)}`);
+          }
+        };
+
+        let signedOut = false; // the next sign-in shows the issuer's account chooser
+        const startSignIn = (found, email) => {
+          const ctx = context(found.origin);
+          const mine = signIn.createLogin(ctx);
+          login = mine;
+          const selectAccount = signedOut;
+          userCancelled = false;
+          signedOut = false;
+          // Cookies may land in the partition before the company is saved.
+          markPendingClear(companyFile, found.origin);
+          mine
+            .start({ email, selectAccount })
+            .then(async () => {
+              company = found;
+              saveCompany(companyFile, company, local);
+              await showCompany(found);
+            })
+            .catch(async () => {
+              // A cancelled sign-in may have been replaced by a newer one; leave that alone.
+              if (login !== mine) return;
+              await clearPartition(ctx.partition).catch(() => {});
+              forgetCompany(companyFile);
+              await showWelcome(userCancelled ? undefined : 'failed');
+            })
+            .catch(() => {});
+        };
+        // Fixed origin: no email screen. Pass Access if needed, open the browser,
+        // and show the pairing code.
+        const signInFixed = async () => {
+          if (login?.active || gate) return;
+          userCancelled = false;
+          const found = { origin: fixedOrigin, name: appName };
+          const access = await passAccess(found);
+          if (access !== 'passed') {
+            await showGateFailure(found, access);
+            return;
+          }
+          if (login?.active) return;
+          startSignIn(found, undefined);
+          await showWelcome(login.code ? `waiting:${login.code}` : undefined);
+        };
+        // Without `start` it only checks that the app is there.
+        const resolveAndSignIn = async (origin, email, start = true) => {
+          if (login?.active) throw new Error('Sign-in already active');
+          let found;
+          const { wellKnownPath, validate } = config.origin;
+          try {
+            found = await discover(origin, fetch, { wellKnownPath, validate, ...local });
+          } catch {
+            return { notFound: true };
+          }
+          const host = new URL(found.origin).host;
+          if (!start) return { name: found.name, host };
+          if (login?.active) throw new Error('Sign-in already active');
+          startSignIn(found, email);
+          return { name: found.name, host, code: login.code };
+        };
+        if (!fixed) {
+          const welcomeCall = (channel, runCall) =>
+            ipcMain.handle(channel, (event, input, start) => {
+              if (!view || !trustedWelcomeSender(event, view.webContents, welcomeUrl))
+                throw new Error('Untrusted request');
+              if (typeof input !== 'string' || input.length > 320) throw new Error('Invalid input');
+              if (typeof start !== 'boolean') throw new Error('Invalid input');
+              return runCall(input.trim(), start);
+            });
+          welcomeCall('shell:resolve-email', (email, start) =>
+            resolveAndSignIn(originForEmail(email, config.origin), email.toLowerCase(), start),
+          );
+          welcomeCall('shell:resolve-address', (address, start) =>
+            resolveAndSignIn(originForAddress(address, local), undefined, start),
+          );
+        }
+        // A strategy's own page bridge: `signIn.handlers` maps a channel to
+        // (context, ...args). Each is reachable only from the company page's top frame.
+        for (const [channel, handler] of Object.entries(signIn.handlers ?? {}))
+          ipcMain.handle(channel, (event, ...args) => {
+            const origin = company?.origin ?? fixedOrigin;
+            if (!view || !origin || !trustedSender(event, view.webContents, origin))
+              throw new Error('Untrusted request');
+            return handler(context(origin), ...args);
+          });
+
+        const signOut = async (notice) => {
+          cancelSignIn();
+          const leaving = company;
+          company = undefined;
+          signedOut = true;
+          if (leaving) {
+            const ctx = context(leaving.origin);
+            // Best effort (skipped when the server already ended the session), whatever the answer.
+            if (notice !== 'ended') await signIn.logout(ctx).catch(() => {});
+            // If we die before the partition is clear, the next start finishes the job.
+            markPendingClear(companyFile, leaving.origin);
+            // Destroy the document before clearing its storage; an old document cannot write it back.
+            await showWelcome(notice);
+            await clearPartition(ctx.partition);
+          } else await showWelcome(notice);
+          forgetCompany(companyFile);
+        };
+        Menu.setApplicationMenu(
+          Menu.buildFromTemplate(
+            menuTemplate({
+              appName,
+              packaged: app.isPackaged,
+              onCancel: cancelSignIn,
+              onSignOut: () => {
+                void signOut().catch(() =>
+                  dialog.showErrorBox(
+                    'Sign-out',
+                    'Sign-out could not be completed. Quit the app and try again.',
+                  ),
+                );
+              },
+            }),
+          ),
+        );
+        app.on('second-instance', (_event, argv) => {
+          showWindow();
+          for (const arg of argv) login?.handleDeepLink(arg);
+          const target = navOptions && company && findDeepLinkArg(argv, company.origin, navOptions);
+          if (target) void view?.webContents.loadURL(target).catch(() => {});
+        });
+        app.on('before-quit', () => login?.cancel());
+        wireCloseBehavior(app, window);
+        window.on('close', () =>
+          writeWindowState(stateFile, {
+            bounds: window.isMaximized() ? window.getNormalBounds() : window.getBounds(),
+            maximized: window.isMaximized(),
+          }),
+        );
+
+        if (navOptions)
+          routeLink = (url) => {
+            const target = company && resolveDeepLink(url, company.origin, navOptions);
+            if (!target) return;
+            showWindow();
+            void view?.webContents.loadURL(target).catch(() => {});
+          };
+        if (company) {
+          await showCompany(company);
+          // A page link that arrived before the window existed or as a launch argument.
+          const link =
+            navOptions && initialDeepLink(queuedLinks, process.argv, company.origin, navOptions);
+          queuedLinks.length = 0;
+          if (link) void view?.webContents.loadURL(link).catch(() => {});
+        } else if (fixed) await signInFixed().catch(() => showWelcome('failed'));
+        else {
+          await showWelcome();
+          // Development only: go straight to one origin instead of asking for an email.
+          const dev = devEnv(config.devOriginEnv);
+          if (dev) await resolveAndSignIn(originForAddress(dev, local)).catch(() => {});
+        }
+        window.show();
+        // A failed or skipped check must never block startup or show a dialog.
+        // Unpackaged, the dev feed variable points the updater at a local static
+        // server. Packaged, the feed is config.feedUrl, or the app-update.yml
+        // electron-builder baked in when that is null; nothing in the environment
+        // can change it (Agora's packaged env override is not carried over).
+        installUpdaterRecovery(autoUpdater, {
+          onError: (error) =>
+            console.error(`${appName} update check failed:`, error?.message ?? error),
+        });
+        const devFeed = devEnv(config.devFeedEnv);
+        const feedUrl = devFeed ?? config.feedUrl ?? undefined;
+        const channel = config.updateChannel ?? undefined;
+        if (feedUrl)
+          configureUpdater(autoUpdater, feedUrl, {
+            forceDevUpdateConfig: !app.isPackaged,
+            channel,
+          });
+        if (app.isPackaged || devFeed) void autoUpdater.checkForUpdates().catch(() => {});
+      })
+      .catch(() => {
+        dialog.showErrorBox(`${appName} could not start`, 'Check your connection, then try again.');
+        app.quit();
+      });
+}

package/src/strategies/cookie-handoff.mjs

@@ -0,0 +1,79 @@
+// The sign-in strategy for apps whose server speaks the cookie handoff
+// (README.md, "The handoff contract"): Boule and Archon. Agora's bearer-token
+// strategy lives in Agora and has the same shape.
+import { createHash, randomBytes } from 'node:crypto';
+import { DesktopLogin } from '../login.mjs';
+
+// Preflight for one deployed origin. Walks the start of the handoff, as far as
+// the issuer's account chooser, and names the one piece of deployment
+// configuration that is wrong. It signs nobody in and needs no credential.
+// A sign-in it starts is never redeemed and expires on the server in minutes.
+async function check(origin, { fetcher = fetch } = {}) {
+  const problems = [];
+  const fail = (what, fix) => {
+    problems.push({ what, fix });
+    throw new Error(what);
+  };
+  const get = (url, init) =>
+    fetcher(url, { redirect: 'manual', signal: AbortSignal.timeout(15000), ...init });
+  try {
+    const challenge = createHash('sha256').update(randomBytes(32)).digest('base64url');
+    const started = await get(`${origin}/auth/desktop/start?challenge=${challenge}`);
+    const authorize = started.headers.get('location');
+    if (![302, 303].includes(started.status) || !authorize)
+      fail(
+        `${origin}/auth/desktop/start answered ${started.status}`,
+        'Deploy a release with the desktop sign-in routes and read its logs.',
+      );
+    // The issuer refuses an unregistered redirect_uri with 400 rather than a
+    // login page, so this is the only check that catches a missing registration.
+    const callback = new URL(authorize).searchParams.get('redirect_uri');
+    if (callback !== `${origin}/auth/desktop/callback`)
+      fail(
+        `The issuer request asks to return to ${callback}`,
+        `Expected ${origin}/auth/desktop/callback.`,
+      );
+    const chooser = await get(authorize);
+    if (chooser.status !== 302)
+      fail(
+        `The issuer answered ${chooser.status} for ${callback}`,
+        `Register ${callback} as a redirect URI on issuer application ${new URL(authorize).searchParams.get('client_id')}.`,
+      );
+  } catch (error) {
+    if (!problems.length) problems.push({ what: error.message, fix: 'Unexpected failure.' });
+  }
+  return problems;
+}
+
+export function cookieHandoff({ scheme }) {
+  if (typeof scheme !== 'string' || !/^[a-z][a-z0-9+.-]*$/.test(scheme))
+    throw new Error('cookieHandoff needs a url scheme');
+  return {
+    scheme,
+    createLogin: ({ origin, partition, fetcher, openBrowser }) => {
+      const login = new DesktopLogin({ scheme, origin, partition, fetcher, openBrowser });
+      // DesktopLogin takes (email, selectAccount); the strategy interface takes an object.
+      return {
+        start: ({ email, selectAccount }) => login.start(email, selectAccount),
+        cancel: () => login.cancel(),
+        handleDeepLink: (value) => login.handleDeepLink(value),
+        get active() {
+          return login.active;
+        },
+        get code() {
+          return login.code;
+        },
+      };
+    },
+    // Best effort: the server answers 303 to the issuer, which is never followed.
+    logout: async ({ origin, fetcher }) => {
+      await fetcher(`${origin}/auth/logout`, {
+        method: 'POST',
+        redirect: 'manual',
+        headers: { origin },
+        signal: AbortSignal.timeout(10000),
+      }).catch(() => {});
+    },
+    check,
+  };
+}

package/src/updater.mjs

@@ -0,0 +1,60 @@
+// Main process only. Wraps electron-updater's generic-provider feed so the
+// app can update itself from a static file host: a public Cloudflare R2
+// bucket in production, a local static server in tests. A no-op when no
+// feed URL is configured, since the dev feed variable stays unset until the
+// user's R2 bucket exists (see README.md).
+//
+// `channel` is electron-updater's own channel mechanism (`autoUpdater.channel`),
+// not a second feed URL: on macOS it picks `<channel>-mac.yml` instead of
+// `latest-mac.yml` off the same bucket, so a beta build never touches the
+// file stable installs already read. Unset, the channel is never assigned
+// and the provider falls back to its own default ("latest"). electron-updater
+// refuses to reset `channel` back to a falsy value once a build has set it
+// to a real one (`ERR_UPDATER_INVALID_CHANNEL`), so this never assigns a
+// falsy channel -- a caller that wants the default channel just omits the
+// option, on every call, for the lifetime of the process.
+//
+// electron-updater's own `channel` setter also flips `allowDowngrade` to
+// `true` unconditionally (AppUpdater.js), so a channel build could install
+// a release with a *lower* version number than the one already running.
+// No channel this app ships today should do that silently, so
+// `allowDowngrade` is always assigned here too, after `channel`, from this
+// function's own option -- overriding electron-updater's automatic flip
+// rather than inheriting it. See README.md, "Channel separation".
+export function configureUpdater(
+  autoUpdater,
+  feedUrl,
+  { forceDevUpdateConfig = false, channel, allowDowngrade = false } = {},
+) {
+  if (!feedUrl) return false;
+  autoUpdater.forceDevUpdateConfig = forceDevUpdateConfig;
+  if (channel) autoUpdater.channel = channel;
+  autoUpdater.allowDowngrade = allowDowngrade;
+  autoUpdater.setFeedURL({ provider: 'generic', url: feedUrl });
+  return true;
+}
+
+// Main process only. Gives a failed check or download somewhere to go other
+// than silently vanishing. electron-updater's AppUpdater is an EventEmitter
+// and reports every check/download failure on 'error' in addition to
+// rejecting the promise the caller already awaits -- main.mjs's startup
+// check already discards that rejection (`.catch(() => {})`, so a failed or
+// skipped check never blocks startup or shows a dialog), which left 'error'
+// as the only place left to observe why a check failed. electron-updater
+// itself resets its own in-flight-check/download state on failure
+// (AppUpdater.js nulls both `checkForUpdatesPromise` and `downloadPromise`
+// once their promise settles), so recovery -- a later check or download
+// succeeding right after an earlier one failed -- is already a property of
+// the library; this only adds a place to see that a failure happened.
+// Idempotent per autoUpdater instance, so calling it again (a re-check, a
+// dev reload) never attaches a second listener and never double-reports
+// the same failure.
+const recoveryInstalled = new WeakSet();
+export function installUpdaterRecovery(autoUpdater, { onError } = {}) {
+  if (recoveryInstalled.has(autoUpdater)) return false;
+  recoveryInstalled.add(autoUpdater);
+  autoUpdater.on('error', (error, message) => {
+    onError?.(error, message);
+  });
+  return true;
+}

package/src/welcome-dir.mjs

@@ -0,0 +1,5 @@
+import { fileURLToPath } from 'node:url';
+
+// The welcome page, its preload, styles, sticker and fonts. electron-builder
+// packs it with the package; this is where the shell loads it from.
+export const welcomeDir = fileURLToPath(new URL('../welcome/', import.meta.url)).replace(/\/$/, '');

package/src/window-state.mjs

@@ -0,0 +1,39 @@
+// Main process only. Persists window bounds and maximized state as small
+// JSON in userData, and clamps stored bounds to whatever displays are
+// currently connected so a disconnected monitor never strands the window.
+import { readFileSync, writeFileSync } from 'node:fs';
+
+export const DEFAULT_BOUNDS = { width: 1200, height: 800 };
+// A stored position only counts as visible when a meaningful slice of it
+// (not just a stray pixel) still lands on a connected display.
+const MIN_VISIBLE_WIDTH = 100;
+const MIN_VISIBLE_HEIGHT = 50;
+
+export function clampBounds(bounds, displays, fallback = DEFAULT_BOUNDS) {
+  if (!bounds || typeof bounds !== 'object') return fallback;
+  const { x, y, width, height } = bounds;
+  if (![x, y, width, height].every(Number.isFinite) || width < 200 || height < 200) return fallback;
+  const visible = (displays ?? []).some(({ bounds: d }) => {
+    const overlapX = Math.min(x + width, d.x + d.width) - Math.max(x, d.x);
+    const overlapY = Math.min(y + height, d.y + d.height) - Math.max(y, d.y);
+    return overlapX >= MIN_VISIBLE_WIDTH && overlapY >= MIN_VISIBLE_HEIGHT;
+  });
+  return visible ? { x, y, width, height } : fallback;
+}
+
+export function readWindowState(path) {
+  try {
+    const state = JSON.parse(readFileSync(path, 'utf8'));
+    return state && typeof state === 'object' ? state : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+export function writeWindowState(path, state) {
+  try {
+    writeFileSync(path, JSON.stringify(state));
+  } catch {
+    /* Best-effort; a stale window position is not worth crashing over. */
+  }
+}