@zerwiz/ymir 0.1.33 → 0.1.35

package/apps/sessrumnir/src/main/index.ts

@@ -0,0 +1,619 @@
+import { app, BrowserWindow, dialog, ipcMain, Menu, nativeImage, screen, session, shell } from 'electron'
+import { existsSync, mkdirSync } from 'fs'
+import { basename, join, resolve as resolvePath } from 'path'
+import { isTrustedRendererUrl, RENDERER_INDEX_PATH } from './renderer-origin'
+import { workspaceTrustStore } from './workspace-trust'
+import { WorkspaceManager } from './workspace-manager'
+import { registerIpcHandlers, loadAppSettings, saveAppSettings } from './ipc-handlers'
+import { setPiExecutableOverride, cleanupPiChildTempDir } from './pi-rpc-manager'
+import { applyLanguageSetting } from './i18n'
+import { i18n, t } from '../shared/i18n'
+import { fetchAllCatalogPackages } from './package-catalog'
+import { activityStatsStore } from './activity-stats'
+import { configureGuiDataDir, getCanonicalUserDataDir, getExternalGuiDataDir, migrateLegacyGuiData } from './app-data-paths'
+import { setupTray, setTrayEnabled, isTrayEnabled, isTrayAvailable, destroyTray, notifyFirstHide } from './tray-manager'
+import { shouldHideToTray } from './tray-decision'
+import { createEditorGuard } from './editor-guard'
+import { appLog } from './app-log'
+import { IPC_CHANNELS } from '../shared/ipc-contracts'
+
+// Env var honored on startup: if set, the named directory becomes the active
+// workspace (created on first run, switched to on subsequent runs). The CLI
+// launcher in bin/sessrumnir.js sets this from `sessrumnir <path>`.
+const WORKSPACE_ENV_VAR = 'PI_DESKTOP_WORKSPACE'
+
+// Electron's development executable otherwise registers as Electron on Windows,
+// which makes the taskbar and notification identity use Electron branding.
+app.setName('Sessrúmnir')
+if (process.platform === 'win32') app.setAppUserModelId('org.ymir.sessrumnir')
+if (process.platform === 'linux') {
+  app.setDesktopName('ymir-sessrumnir.desktop');
+  app.commandLine.appendSwitch('class', 'sessrumnir');
+}
+
+// Suppress EPIPE errors from closed subprocess pipes
+process.on('uncaughtException', (err) => {
+  if (err.message?.includes('EPIPE') || (err as NodeJS.ErrnoException).code === 'EPIPE') {
+    // Ignore EPIPE - happens when Pi process exits
+    return
+  }
+  console.error('Uncaught exception:', err)
+  appLog.error('app', 'Uncaught exception', err)
+})
+
+// ─── Constants ───────────────────────────────────────────────────────────────
+
+const WINDOW_WIDTH = 1400
+const WINDOW_HEIGHT = 900
+// Minimums must stay well below the compositor's tile size on a scaled screen.
+// On a 1920x1200 panel at 1.5 scale the logical work area is 1280x800, and a
+// half-width tile is ~414 DIP. A min width of 800 made the app fight the
+// compositor: the surface stayed at the tile size while the renderer viewport
+// clamped to 800 DIP, so the right half of the UI rendered outside the window.
+const MIN_WINDOW_WIDTH = 400
+const MIN_WINDOW_HEIGHT = 360
+
+// Fit the seat to the screen it lands on. A fixed 1400x900 is larger than a
+// 1280x800 logical work area (e.g. a 1920x1200 panel at 1.5 scale), which
+// pushes the window past the glass and clips the right side of the UI. Clamp
+// to the work area; never below the minimums (an even smaller work area wins).
+function fitWindowSize(): { width: number; height: number } {
+  const { width, height } = screen.getPrimaryDisplay().workAreaSize
+  const fit = (desired: number, min: number, avail: number): number =>
+    Math.max(Math.min(desired, avail), Math.min(min, avail))
+  return {
+    width: fit(WINDOW_WIDTH, MIN_WINDOW_WIDTH, width),
+    height: fit(WINDOW_HEIGHT, MIN_WINDOW_HEIGHT, height),
+  }
+}
+const DEV_SERVER_URL = process.env.ELECTRON_RENDERER_URL
+const PRELOAD_PATH = join(__dirname, '../preload/index.js')
+// <webview> partitions used by the file preview (see file-tree.tsx). The HTML
+// preview renders untrusted workspace files with scripts and network disabled;
+// the PDF preview needs pdfium (plugins) and is confined to file:// only.
+const HTML_PREVIEW_PARTITION = 'preview'
+const PDF_PREVIEW_PARTITION = 'persist:pdf-preview'
+
+// In dev: resources/ sits at the project root (app.getAppPath()).
+// In packaged: extraResources config copies resources/ into process.resourcesPath/resources/.
+// Computed lazily: `app` is undefined at module-eval time under electron-vite preview,
+// so reading `app.isPackaged` at top level crashes before whenReady().
+let cachedAppIconPath: string | null = null
+function getAppIconPath(): string {
+  if (cachedAppIconPath !== null) return cachedAppIconPath
+  const base = app.isPackaged
+    ? join(process.resourcesPath, 'resources')
+    : join(app.getAppPath(), 'resources')
+  cachedAppIconPath = join(base, 'icons', 'icon.png')
+  return cachedAppIconPath
+}
+
+// ─── Workspace Manager (singleton) ───────────────────────────────────────────
+
+let workspaceManager: WorkspaceManager | null = null
+
+// The single main window, tracked so the tray, single-instance relaunch, and
+// macOS dock-activate can all bring it back. `isQuitting` distinguishes a real
+// quit (menu/tray Quit, Cmd-Ctrl+Q) from a window close that should hide to tray.
+let mainWindow: BrowserWindow | null = null
+let isQuitting = false
+
+// Guards the renderer's unsaved editor buffer against teardown. The renderer
+// mirrors its dirty flag here (ui:editor-dirty-set); quit, non-tray window
+// close, and the reload menu items all pause on the same discard dialog.
+const editorGuard = createEditorGuard()
+
+/** Native confirm matching the in-app discard dialog's wording. */
+async function confirmEditorDiscard(window: BrowserWindow | null): Promise<boolean> {
+  // Tray Quit can arrive while the window is hidden; surface it so the
+  // dialog (and the edits it is asking about) are actually visible.
+  if (window && !window.isDestroyed() && !window.isVisible()) window.show()
+  const options = {
+    type: 'warning' as const,
+    title: t('editorGuard.title'),
+    message: editorGuard.promptMessage(),
+    buttons: [t('editorGuard.discardButton'), t('editorGuard.keepEditing')],
+    defaultId: 1,
+    cancelId: 1,
+  }
+  const { response } = window
+    ? await dialog.showMessageBox(window, options)
+    : await dialog.showMessageBox(options)
+  return response === 0
+}
+
+/** Menu Reload / Force Reload: ask a dirty editor first, then reload. */
+async function reloadMainWindowWithGuard(ignoreCache: boolean): Promise<void> {
+  const window = mainWindow
+  if (!window) return
+  if (editorGuard.needsPrompt() && !(await confirmEditorDiscard(window))) return
+  // did-start-loading resets the guard once the reload actually begins.
+  if (ignoreCache) window.webContents.reloadIgnoringCache()
+  else window.webContents.reload()
+}
+
+// Single-instance lock: with "minimize to tray" the window can be hidden while
+// the app keeps running, so a relaunch (taskbar, launcher, `pi-desktop <path>`)
+// must focus the existing instance instead of spawning a second one. The second
+// process exits immediately; the first receives 'second-instance'.
+if (!app.requestSingleInstanceLock()) {
+  app.quit()
+} else {
+  app.on('second-instance', () => {
+    showMainWindow()
+  })
+}
+
+// PI_DESKTOP_USER_DATA_DIR set by the launching process overrides the
+// canonical appData-derived directory: that exact directory holds all GUI
+// data and legacy migration is skipped, keeping it fully isolated.
+const externalUserDataDir = getExternalGuiDataDir()
+const userDataDir = externalUserDataDir ?? getCanonicalUserDataDir(app.getPath('appData'))
+mkdirSync(userDataDir, { recursive: true })
+app.setPath('userData', userDataDir)
+configureGuiDataDir(userDataDir)
+
+// ─── Window Creation ─────────────────────────────────────────────────────────
+
+/**
+ * The main window must never navigate to arbitrary content: its privileged
+ * preload (terminal + full IPC) attaches to whatever loads. In production only
+ * the exact packaged renderer file is allowed; in development only the dev
+ * server's own origin (parsed, not a fragile string prefix).
+ */
+function isAllowedMainWindowNavigation(targetUrl: string): boolean {
+  return isTrustedRendererUrl(targetUrl, {
+    devServerUrl: DEV_SERVER_URL,
+    rendererIndexPath: RENDERER_INDEX_PATH,
+  })
+}
+
+/** Whether the active workspace has been trusted by the user (see workspace-trust.ts). */
+function isActiveWorkspaceTrusted(): boolean {
+  const path = workspaceManager?.getActiveWorkspace()?.path
+  return path ? workspaceTrustStore.isTrusted(path) : false
+}
+
+/**
+ * For an untrusted workspace, confine the HTML file-preview guest to local files:
+ * block every non-file request on its partition so malicious workspace HTML
+ * cannot beacon out or pull remote resources. Combined with scripts-disabled for
+ * untrusted previews (see will-attach-webview), this closes the exfiltration path.
+ * A trusted workspace's own pages may load resources normally (interactive preview).
+ */
+function hardenPreviewSession(): void {
+  session
+    .fromPartition(HTML_PREVIEW_PARTITION)
+    .webRequest.onBeforeRequest((details, callback) => {
+      const blocked = !details.url.startsWith('file://') && !isActiveWorkspaceTrusted()
+      callback({ cancel: blocked })
+    })
+}
+
+function createMainWindow(): BrowserWindow {
+  const appIcon = nativeImage.createFromPath(getAppIconPath())
+  const { width, height } = fitWindowSize()
+  const window = new BrowserWindow({
+    width,
+    height,
+    minWidth: MIN_WINDOW_WIDTH,
+    minHeight: MIN_WINDOW_HEIGHT,
+    title: 'Sessrúmnir',
+    backgroundColor: '#0a1020',
+    icon: appIcon,
+    show: false,
+    webPreferences: {
+      preload: PRELOAD_PATH,
+      contextIsolation: true,
+      nodeIntegration: false,
+      sandbox: true,
+      webSecurity: true,
+      allowRunningInsecureContent: false,
+      experimentalFeatures: false,
+      // Enables the <webview> tag used by the HTML file preview to run its own
+      // JavaScript in an isolated guest process (no Node, separate origin),
+      // without loosening the app's own CSP.
+      webviewTag: true,
+    },
+  })
+
+  // Hide the top menu bar (File/Edit/View/Window). The application menu stays
+  // set so its accelerators (Ctrl+N, Ctrl+O, copy/paste, etc.) keep working;
+  // only the visible bar is hidden. autoHideMenuBar is left off so Alt won't
+  // reveal it.
+  window.setMenuBarVisibility(false)
+
+  // Graceful show (avoid white flash)
+  window.once('ready-to-show', () => {
+    window.show()
+    window.focus()
+  })
+
+  // Minimize-to-tray: when enabled (Windows/Linux), a window close hides the
+  // window and keeps the app running instead of quitting. A real quit sets
+  // `isQuitting` first (see before-quit), so this only intercepts user closes.
+  window.on('close', (event) => {
+    if (shouldHideToTray({ isQuitting, enabled: isTrayEnabled(), platform: process.platform, trayAvailable: isTrayAvailable() })) {
+      event.preventDefault()
+      window.hide()
+      notifyFirstHide()
+      return
+    }
+    // A real close destroys the renderer and its unsaved editor buffer;
+    // pause for the same discard decision every in-app path gets. (Hiding to
+    // tray above loses nothing, so it never asks.)
+    if (editorGuard.needsPrompt()) {
+      event.preventDefault()
+      void confirmEditorDiscard(window).then((discard) => {
+        if (discard) {
+          editorGuard.confirmDiscard()
+          window.close()
+        }
+      })
+    }
+  })
+
+  // A reloaded (or crashed-and-recovered) renderer starts with a clean
+  // editor; a stale dirty flag here would make quit nag forever.
+  window.webContents.on('did-start-loading', () => editorGuard.reset())
+  window.webContents.on('render-process-gone', () => editorGuard.reset())
+
+  window.on('closed', () => {
+    if (mainWindow === window) mainWindow = null
+  })
+
+  // Open external links in default browser
+  window.webContents.setWindowOpenHandler(({ url }) => {
+    if (url.startsWith('https://') || url.startsWith('http://')) {
+      shell.openExternal(url)
+    }
+    return { action: 'deny' }
+  })
+
+  // Block navigation to anything but the pinned renderer (see helper).
+  window.webContents.on('will-navigate', (event, url) => {
+    if (isAllowedMainWindowNavigation(url)) return
+    event.preventDefault()
+  })
+
+  // Harden the HTML file-preview <webview> guest before Electron attaches it:
+  // strip any preload/Node access it might request and reject anything that
+  // isn't the local `file://` preview it's meant for. Defense-in-depth against
+  // a renderer XSS trying to attach a guest with elevated webPreferences.
+  window.webContents.on('will-attach-webview', (event, webPreferences, params) => {
+    delete webPreferences.preload
+    webPreferences.nodeIntegration = false
+    webPreferences.nodeIntegrationInSubFrames = false
+    webPreferences.contextIsolation = true
+    webPreferences.sandbox = true
+    webPreferences.webSecurity = true
+    webPreferences.allowRunningInsecureContent = false
+
+    // Only the PDF preview needs pdfium (plugins). For the HTML preview, scripts
+    // run only when the workspace is trusted (interactive preview of your own
+    // project); for an untrusted workspace scripts are disabled so — with sandbox
+    // + webSecurity above and the partition's network block — malicious preview
+    // HTML cannot read other local files or exfiltrate data.
+    const isPdfPreview =
+      params.partition === PDF_PREVIEW_PARTITION || /\.pdf(?:[?#]|$)/i.test(params.src)
+    webPreferences.plugins = isPdfPreview
+    if (!isPdfPreview && !isActiveWorkspaceTrusted()) {
+      webPreferences.javascript = false
+    }
+
+    if (!params.src.startsWith('file://')) {
+      event.preventDefault()
+    }
+  })
+
+  // Load renderer
+  if (DEV_SERVER_URL) {
+    window.loadURL(DEV_SERVER_URL)
+  } else {
+    window.loadFile(RENDERER_INDEX_PATH)
+  }
+
+  // Dev tools in development
+  if (process.env.NODE_ENV === 'development') {
+    window.webContents.openDevTools({ mode: 'detach' })
+  }
+
+  mainWindow = window
+  return window
+}
+
+// Bring the main window to the foreground, re-creating it if it was fully
+// closed. Used by the tray, single-instance relaunch, and macOS dock activate.
+function showMainWindow(): void {
+  if (mainWindow) {
+    if (mainWindow.isMinimized()) mainWindow.restore()
+    mainWindow.show()
+    mainWindow.focus()
+  } else {
+    createMainWindow()
+  }
+}
+
+// ─── Application Menu ────────────────────────────────────────────────────────
+
+// One identity covers every Ymir surface: the shared session lives at the gate,
+// so signing out here clears it for Hlidskjalf, Smiðja, and Sessrúmnir alike.
+const YMIR_GATE = process.env.YMIR_GATE_URL ?? 'http://127.0.0.1:3889'
+
+async function signOutOfYmir(): Promise<void> {
+  try {
+    await fetch(`${YMIR_GATE}/api/logout`, { method: 'POST' })
+  } catch {
+    // gate down — nothing to clear server-side
+  }
+  BrowserWindow.getAllWindows().forEach((w) => w.reload())
+}
+
+// Move to another hall through the gate's one launcher, as the Omarchy key
+// bindings and Hlidskjalf's switcher do.
+async function raiseHall(view: 'hlidskjalf' | 'smidja' | 'sessrumnir'): Promise<void> {
+  try {
+    await fetch(`${YMIR_GATE}/api/desktop`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ view }),
+    })
+  } catch {
+    // launcher unreachable — stay where we are
+  }
+}
+
+function createApplicationMenu(): void {
+  const template: Electron.MenuItemConstructorOptions[] = [
+    {
+      label: t('menu.file'),
+      submenu: [
+        {
+          label: t('common.newSession'),
+          accelerator: 'CmdOrCtrl+N',
+          click: () => {
+            const focusedWindow = BrowserWindow.getFocusedWindow()
+            focusedWindow?.webContents.send('menu:new-session')
+          },
+        },
+        {
+          label: t('menu.newWorkspace'),
+          accelerator: 'CmdOrCtrl+Shift+N',
+          click: () => {
+            const focusedWindow = BrowserWindow.getFocusedWindow()
+            focusedWindow?.webContents.send('menu:new-workspace')
+          },
+        },
+        {
+          label: t('menu.openProject'),
+          accelerator: 'CmdOrCtrl+O',
+          click: () => {
+            const focusedWindow = BrowserWindow.getFocusedWindow()
+            focusedWindow?.webContents.send('menu:open-project')
+          },
+        },
+        { type: 'separator' },
+{ label: 'Go to Hlidskjalf', click: () => { void raiseHall('hlidskjalf') } },
+        { label: 'Go to Smiðja', click: () => { void raiseHall('smidja') } },
+        { type: 'separator' },
+        // The gate holds the one session; Sessrúmnir has no gate cookie, so it
+        // signs in through the gate rather than claiming a session it lacks.
+        { label: 'Sign in to Ymir…', click: () => { void shell.openExternal(`${YMIR_GATE.replace(/:3889$/, ':3888')}/`) } },
+        { label: 'Sign out of Ymir', click: () => { void signOutOfYmir() } },
+        { type: 'separator' },
+        // Role items get explicit labels: Electron's own role labels are English.
+        { role: 'quit', label: t('app.quit') },
+      ],
+    },
+    {
+      label: t('menu.edit'),
+      submenu: [
+        { role: 'undo', label: t('menu.undo') },
+        { role: 'redo', label: t('menu.redo') },
+        { type: 'separator' },
+        { role: 'cut', label: t('common.cut') },
+        { role: 'copy', label: t('common.copy') },
+        { role: 'paste', label: t('common.paste') },
+        { role: 'selectAll', label: t('common.selectAll') },
+      ],
+    },
+    {
+      label: t('menu.view'),
+      submenu: [
+        // Not the bare roles: a reload destroys the renderer and its unsaved
+        // editor buffer, so both run through the same discard guard as
+        // close/quit before touching webContents.
+        {
+          label: t('menu.reload'),
+          accelerator: 'CmdOrCtrl+R',
+          click: () => void reloadMainWindowWithGuard(false),
+        },
+        {
+          label: t('menu.forceReload'),
+          accelerator: 'Shift+CmdOrCtrl+R',
+          click: () => void reloadMainWindowWithGuard(true),
+        },
+        { role: 'toggleDevTools', label: t('menu.toggleDevTools') },
+        { type: 'separator' },
+        { role: 'resetZoom', label: t('menu.actualSize') },
+        { role: 'zoomIn', label: t('menu.zoomIn') },
+        { role: 'zoomOut', label: t('menu.zoomOut') },
+        { type: 'separator' },
+        { role: 'togglefullscreen', label: t('menu.toggleFullScreen') },
+      ],
+    },
+    {
+      label: t('menu.window'),
+      submenu: [
+        { role: 'minimize', label: t('menu.minimize') },
+        { role: 'zoom', label: t('menu.zoom') },
+        { role: 'close', label: t('menu.close') },
+      ],
+    },
+  ]
+
+  Menu.setApplicationMenu(Menu.buildFromTemplate(template))
+}
+
+// ─── App Lifecycle ───────────────────────────────────────────────────────────
+
+app.whenReady().then(async () => {
+  if (!externalUserDataDir) {
+    await migrateLegacyGuiData({
+      appDataDir: app.getPath('appData'),
+      userDataDir: app.getPath('userData'),
+    })
+  }
+
+  // Set the macOS dock icon in development only. A packaged app already gets its
+  // dock icon from the bundled .icns (correct macOS geometry with padding). The
+  // raw icon.png is full-bleed, so calling setIcon in a packaged build overrode
+  // the .icns with a wrongly sized icon once the app started (issue #66).
+  if (process.platform === 'darwin' && app.dock && !app.isPackaged) {
+    app.dock.setIcon(nativeImage.createFromPath(getAppIconPath()))
+  }
+
+  // Initialize workspace manager
+  workspaceManager = new WorkspaceManager()
+  await workspaceManager.initialize()
+
+  // Honor PI_DESKTOP_WORKSPACE if set: switch to (or create) the named workspace.
+  await applyWorkspaceFromEnv(workspaceManager)
+
+  // Lock the HTML preview partition to local files before any preview can load.
+  hardenPreviewSession()
+
+  // Resolve the configured engine before exposing IPC or creating the renderer;
+  // otherwise the renderer can win the startup race and launch the default Pi
+  // binary before this setting is applied.
+  const settings = await loadAppSettings(workspaceManager)
+  setPiExecutableOverride(settings.piExecutablePath, settings.piEngine)
+
+  // Before the menu, window, and tray exist, so they are built in the saved language.
+  applyLanguageSetting(settings.language)
+
+  // Register IPC handlers before creating windows. The window getter is a
+  // lazy closure — mainWindow is created later and the notification wiring
+  // only dereferences it at event time. showMainWindow recreates the window
+  // when a notification is clicked after a full close (macOS).
+  registerIpcHandlers(workspaceManager, {
+    getWindow: () => mainWindow,
+    showWindow: showMainWindow,
+  }, getAppIconPath())
+
+  // The renderer mirrors its editor-dirty flag on every transition; the
+  // quit/close/reload guards below read the cached value.
+  ipcMain.on(IPC_CHANNELS.UI_EDITOR_DIRTY_SET, (_event, dirty: unknown, fileName: unknown) => {
+    editorGuard.setDirty(dirty === true, typeof fileName === 'string' ? fileName : null)
+  })
+
+  // Create the application menu, and build it again in the new language
+  // whenever the language setting changes.
+  createApplicationMenu()
+  i18n.on('languageChanged', () => createApplicationMenu())
+
+  // Create main window
+  createMainWindow()
+
+  // System tray: inject deps once, then enable it if the setting is on. The
+  // one-time "still running" hint reads/persists via app settings.
+  setupTray({
+    getWindow: () => mainWindow,
+    quit: () => app.quit(),
+    iconPath: getAppIconPath(),
+    hasSeenHint: settings.hasSeenTrayHint,
+    onHintShown: () => {
+      void saveAppSettings({ hasSeenTrayHint: true })
+    },
+  })
+  setTrayEnabled(settings.minimizeToTrayOnClose)
+
+  // Warm the package catalog cache in the background so the Catalog tab is
+  // instant when first opened. Non-blocking; failures are ignored (offline etc).
+  void fetchAllCatalogPackages().catch(() => {})
+
+  // Baseline scan of the persisted activity stats, so the store reflects reality
+  // even if the home screen is never opened this run. Non-blocking.
+  void activityStatsStore.refresh()
+
+  // macOS: re-show (or re-create) the window when the dock icon is clicked.
+  // showMainWindow handles both a hidden window and a fully-closed one.
+  app.on('activate', () => {
+    showMainWindow()
+  })
+})
+
+// Quit when all windows closed (except macOS)
+app.on('window-all-closed', () => {
+  if (process.platform !== 'darwin') {
+    app.quit()
+  }
+})
+
+// Cleanup on quit
+app.on('before-quit', (event) => {
+  // Gate BEFORE isQuitting is set: quitting destroys the renderer and its
+  // unsaved editor buffer, and a cancelled dialog must leave the tray-hide
+  // behavior (which reads isQuitting) exactly as it was.
+  if (editorGuard.needsPrompt()) {
+    event.preventDefault()
+    void confirmEditorDiscard(mainWindow).then((discard) => {
+      if (discard) {
+        editorGuard.confirmDiscard()
+        app.quit()
+      }
+    })
+    return
+  }
+  // Mark a real quit so the window `close` handler stops hiding to tray and lets
+  // the window actually close. This is the single choke point every quit path
+  // flows through (menu/tray Quit, Cmd-Ctrl+Q).
+  isQuitting = true
+  // Release the tray icon so it doesn't linger in the notification area.
+  destroyTray()
+  // Synchronous incremental scan + write: captures every session touched this
+  // run before we exit (async I/O isn't guaranteed to finish during shutdown).
+  activityStatsStore.flushSync()
+  appLog.flushSync()
+  workspaceManager?.stopAll()
+  // Windows: GUI-owned Pi TEMP does not get OS cleanup — wipe on quit.
+  cleanupPiChildTempDir()
+})
+
+// Security: prevent new window creation, and stop preview <webview> guests from
+// navigating away from their local file (e.g. a malicious HTML file redirecting
+// itself to a remote URL to phone home).
+app.on('web-contents-created', (_event, contents) => {
+  contents.setWindowOpenHandler(() => {
+    return { action: 'deny' }
+  })
+  if (contents.getType() === 'webview') {
+    contents.on('will-navigate', (event, url) => {
+      // An untrusted preview may not navigate away from its local file (e.g. a
+      // malicious page redirecting itself to a remote URL). Trusted previews of
+      // your own project may navigate freely.
+      if (!url.startsWith('file://') && !isActiveWorkspaceTrusted()) event.preventDefault()
+    })
+  }
+})
+
+async function applyWorkspaceFromEnv(manager: WorkspaceManager): Promise<void> {
+  const raw = process.env[WORKSPACE_ENV_VAR]
+  if (!raw) return
+
+  const path = resolvePath(raw)
+  if (!existsSync(path)) {
+    console.warn(`[Sessrúmnir] ${WORKSPACE_ENV_VAR}=${raw} does not exist; ignoring`)
+    return
+  }
+
+  const existing = manager.getWorkspaces().find((w) => w.path === path)
+  if (existing) {
+    await manager.setActiveWorkspace(existing.id)
+    return
+  }
+
+  const name = basename(path) || path
+  const created = await manager.createWorkspace(name, path)
+  await manager.setActiveWorkspace(created.id)
+}

package/apps/sessrumnir/src/main/ipc/active-engine.ts

@@ -0,0 +1,15 @@
+import type { AgentEngineKind } from '../../shared/ipc-contracts'
+import { getConfiguredEngineKind } from '../pi-rpc-manager'
+import type { WorkspaceManager } from '../workspace-manager'
+
+/**
+ * Engine the user is looking at right now: the active session's runtime
+ * engine when one is live (a Pi-store session resumes under Pi and an OMP
+ * session under OMP regardless of the configured default), else the
+ * configured default. Every per-engine IPC decision (models file, skill
+ * roots, plugin CLI) reads this one rule so the UI and the file it touches
+ * never disagree.
+ */
+export function activeEngineKind(workspaceManager: WorkspaceManager): AgentEngineKind {
+  return workspaceManager.getActivePiManager()?.getEngineKind() ?? getConfiguredEngineKind()
+}

package/apps/sessrumnir/src/main/ipc/context.ts

@@ -0,0 +1,58 @@
+import { BrowserWindow } from 'electron'
+import { PiRpcManager } from '../pi-rpc-manager'
+import { WorkspaceManager } from '../workspace-manager'
+import { SessionTagManager } from '../session-tags'
+import { ArchivedSessionsManager } from '../archived-sessions'
+import { TerminalService } from '../terminal-service'
+import { NotesManager } from '../notes-manager'
+
+export interface IpcContext {
+  workspaceManager: WorkspaceManager
+  broadcast(channel: string, data: unknown): void
+  getActivePi(): PiRpcManager
+  approvedAttachmentPaths: Set<string>
+  tagManager: SessionTagManager
+  archivedSessions: ArchivedSessionsManager
+  notesManager: NotesManager
+  terminalService: TerminalService
+}
+
+export function createIpcContext(workspaceManager: WorkspaceManager): IpcContext {
+  const tagManager = new SessionTagManager()
+  const archivedSessions = new ArchivedSessionsManager()
+  const terminalService = new TerminalService()
+  const notesManager = new NotesManager()
+
+  // Absolute paths the user explicitly picked via the native open dialog. The
+  // attachment reader will only read these (or files inside the workspace), so a
+  // renderer cannot ask it to read arbitrary files by path.
+  const approvedAttachmentPaths = new Set<string>()
+
+  // Helper: get Pi manager for active workspace
+  function getActivePi(): PiRpcManager {
+    const pi = workspaceManager.getActivePiManager()
+    if (!pi) throw new Error('No active workspace or Pi not running')
+    return pi
+  }
+
+  // Helper: broadcast to all renderer windows
+  function broadcast(channel: string, data: unknown): void {
+    const windows = BrowserWindow.getAllWindows()
+    for (const win of windows) {
+      if (!win.isDestroyed()) {
+        win.webContents.send(channel, data)
+      }
+    }
+  }
+
+  return {
+    workspaceManager,
+    broadcast,
+    getActivePi,
+    approvedAttachmentPaths,
+    tagManager,
+    archivedSessions,
+    notesManager,
+    terminalService,
+  }
+}