@zogien/native-sdk 0.11.0-fork.3 → 0.11.0-fork.5

package/src/platform/macos/appkit_host.m

@@ -817,6 +817,26 @@ static int NativeSdkCredentialStatus(OSStatus status, int missingCode) {
 @property(nonatomic, strong) NSString *openCommand;
 @end
 
+/* One asynchronous dialog (native_sdk_appkit_request_dialog): what is
+ * showing, where, and once it finishes, the result poll hands back. */
+@interface NativeSdkDialog : NSObject
+@property(nonatomic, assign) uint64_t dialogId;
+@property(nonatomic, assign) uint64_t parentWindowId;
+@property(nonatomic, strong) NSSavePanel *panel;
+@property(nonatomic, strong) NSAlert *alert;
+/* The sheet's window, when the dialog is attached to one. */
+@property(nonatomic, weak) NSWindow *sheetParent;
+/* A parentless alert runs modally from the next loop turn. */
+@property(nonatomic, assign) BOOL modalRunning;
+@property(nonatomic, assign) BOOL cancelRequested;
+@property(nonatomic, assign) int outcome;
+@property(nonatomic, assign) int button;
+@property(nonatomic, strong) NSArray<NSString *> *paths;
+@end
+
+@implementation NativeSdkDialog
+@end
+
 @interface NativeSdkAppKitHost : NSObject <WKNavigationDelegate, NSMenuDelegate, NSUserNotificationCenterDelegate>
 @property(nonatomic, strong) NSWindow *window;
 @property(nonatomic, strong) WKWebView *webView;
@@ -881,6 +901,10 @@ static int NativeSdkCredentialStatus(OSStatus status, int missingCode) {
  * block starts still gets its own turn. */
 @property(atomic, assign) BOOL crossThreadFramePending;
 @property(nonatomic, strong) NSMutableDictionary<NSNumber *, NSTimer *> *appTimers;
+/* Asynchronous dialogs by id while presented, and finished ones in the
+ * order they finished, awaiting poll. */
+@property(nonatomic, strong) NSMutableDictionary<NSNumber *, NativeSdkDialog *> *dialogs;
+@property(nonatomic, strong) NSMutableArray<NativeSdkDialog *> *finishedDialogs;
 /* Notification userInfo persists with the delivered notification, so it
  * carries only a per-process token. Commands remain in this live host;
  * stale notifications from an earlier execution cannot dispatch into a
@@ -1242,6 +1266,25 @@ static int NativeSdkCredentialStatus(OSStatus status, int missingCode) {
 - (void)emitShortcutWithId:(NSString *)identifier key:(NSString *)key modifiers:(uint32_t)modifiers event:(NSEvent *)event;
 @end
 
+static void NativeSdkCancelDialogsForWindow(NativeSdkAppKitHost *host, uint64_t windowId);
+static void NativeSdkCancelAllDialogs(NativeSdkAppKitHost *host);
+
+/* [NSApp stop:] and stopModal take effect only after the loop handles its
+ * next event; post an empty one so a stop requested from a timer or block
+ * ends the loop now. */
+static void NativeSdkPostEmptyEvent(void) {
+    NSEvent *event = [NSEvent otherEventWithType:NSEventTypeApplicationDefined
+                                        location:NSZeroPoint
+                                   modifierFlags:0
+                                       timestamp:0
+                                    windowNumber:0
+                                         context:nil
+                                         subtype:0
+                                           data1:0
+                                           data2:0];
+    [NSApp postEvent:event atStart:NO];
+}
+
 // Recursively re-emit the gpu-surface resize event for every metal
 // surface under `view` (the tall-titlebar chrome re-query path).
 static void NativeSdkEmitGpuSurfaceResizes(NSView *view) {
@@ -1423,6 +1466,9 @@ static NSPoint NativeSdkViewLocalYDownPoint(NSView *view, NSPoint point) {
 
 - (void)windowWillClose:(NSNotification *)notification {
     (void)notification;
+    // End this window's sheets while it can still take them down; a
+    // sheet on a closed window never calls its completion handler.
+    NativeSdkCancelDialogsForWindow(self.host, self.windowId);
     if (self.observesContentLayout) {
         NSWindow *window = self.host.windows[@(self.windowId)];
         [window removeObserver:self forKeyPath:@"contentLayoutRect"];
@@ -8182,6 +8228,8 @@ static float NativeSdkCaptureReadRemixedSample(const AudioBufferList *buffers, c
     self.nativeViewExplicitTextKeys = [[NSMutableSet alloc] init];
     self.bridgeEnabledChildWebViewKeys = [[NSMutableSet alloc] init];
     self.appTimers = [[NSMutableDictionary alloc] init];
+    self.dialogs = [[NSMutableDictionary alloc] init];
+    self.finishedDialogs = [[NSMutableArray alloc] init];
     self.notificationActionCommands = [[NSMutableDictionary alloc] init];
     self.notificationActionTokensByIdentifier = [[NSMutableDictionary alloc] init];
     self.statusItems = [[NSMutableDictionary alloc] init];
@@ -8497,6 +8545,9 @@ static float NativeSdkCaptureReadRemixedSample(const AudioBufferList *buffers, c
 - (void)closeWindowWithId:(uint64_t)windowId {
     NSWindow *window = self.windows[@(windowId)];
     if (!window) return;
+    // performClose: refuses a window with a sheet attached, so end this
+    // window's dialogs first (Electron's NativeWindowMac::Close does too).
+    NativeSdkCancelDialogsForWindow(self, windowId);
     // A runtime-initiated close is the app DECIDING to close: it must
     // not bounce off the window's own .hide close policy, so it skips
     // performClose: (which runs windowShouldClose:) and closes
@@ -10766,17 +10817,9 @@ static NSString *NativeSdkSigningTeamIdentifier(NSString *bundlePath) {
     }
     [self stopAppearanceObservers];
     [self stopApplicationActivationObservers];
+    NativeSdkCancelAllDialogs(self);
     [NSApp stop:nil];
-    NSEvent *event = [NSEvent otherEventWithType:NSEventTypeApplicationDefined
-                                        location:NSZeroPoint
-                                   modifierFlags:0
-                                       timestamp:0
-                                    windowNumber:0
-                                         context:nil
-                                         subtype:0
-                                           data1:0
-                                           data2:0];
-    [NSApp postEvent:event atStart:NO];
+    NativeSdkPostEmptyEvent();
 }
 
 /* Drain the quit verb a pre-run dispatch parked (see
@@ -13271,6 +13314,372 @@ int native_sdk_appkit_check_for_updates(native_sdk_appkit_host_t *host, int user
     return 1;
 }
 
+// ---------------------------------------------------------------------------
+// App-driven updates (`updates.mode = "app"`): the platform half of
+// src/updater/engine.zig, reached through src/updater/macos.zig. Unlike the
+// host flow above, nothing here shows UI; the engine calls these from its
+// worker threads and from the app loop. The release stages beside the app,
+// `<parent>/.<App.app>.native-update/`, so installing it is a rename on the
+// same volume, and a helper installs it once this process exits.
+
+enum {
+    NativeSdkUpdateOk = 0,
+    NativeSdkUpdateNetwork = 1,
+    NativeSdkUpdateHttpStatus = 2,
+    NativeSdkUpdateTooLarge = 3,
+    NativeSdkUpdateCancelled = 4,
+    NativeSdkUpdateDisk = 5,
+};
+
+static NSString *NativeSdkUpdateString(const char *bytes, size_t length) {
+    if (!bytes || length == 0) return @"";
+    return [[NSString alloc] initWithBytes:bytes length:length encoding:NSUTF8StringEncoding] ?: @"";
+}
+
+static size_t NativeSdkUpdateCopy(NSString *value, char *output, size_t capacity) {
+    const char *bytes = value.UTF8String;
+    const size_t length = bytes ? strlen(bytes) : 0;
+    if (length == 0 || length > capacity) return 0;
+    memcpy(output, bytes, length);
+    return length;
+}
+
+static NSString *NativeSdkUpdateBundlePath(void) {
+    return NSBundle.mainBundle.bundlePath.stringByStandardizingPath;
+}
+
+static NSString *NativeSdkUpdateSiblingPath(NSString *suffix) {
+    NSString *bundlePath = NativeSdkUpdateBundlePath();
+    return [bundlePath.stringByDeletingLastPathComponent stringByAppendingPathComponent:[NSString stringWithFormat:@".%@.%@", bundlePath.lastPathComponent, suffix]];
+}
+
+static NSString *NativeSdkUpdateResultPath(NSString *bundleIdentifier) {
+    NSURL *support = [[NSFileManager defaultManager] URLsForDirectory:NSApplicationSupportDirectory inDomains:NSUserDomainMask].firstObject;
+    if (!support || bundleIdentifier.length == 0) return nil;
+    return [[support.path stringByAppendingPathComponent:bundleIdentifier] stringByAppendingPathComponent:@".native-update-result"];
+}
+
+static BOOL NativeSdkUpdateURLAllowed(NSURL *url, BOOL allowLoopbackHttp) {
+    NSString *scheme = url.scheme.lowercaseString;
+    if ([scheme isEqualToString:@"https"]) return url.host.length > 0;
+    if (!allowLoopbackHttp || ![scheme isEqualToString:@"http"]) return NO;
+    NSString *host = url.host.lowercaseString;
+    return [host isEqualToString:@"127.0.0.1"] || [host isEqualToString:@"::1"] || [host isEqualToString:@"localhost"];
+}
+
+/// The one app bundle a staged release unpacked to, when it is this app at
+/// `version`; Info.plist is read directly because NSBundle caches bundles
+/// by path and the staging path is reused.
+static NSString *NativeSdkUpdateStagedBundle(NSString *stagePath, NSString *bundleIdentifier, NSString *version) {
+    NSFileManager *manager = [NSFileManager defaultManager];
+    NSArray<NSString *> *entries = [manager contentsOfDirectoryAtPath:stagePath error:nil];
+    NSString *bundleName = nil;
+    for (NSString *entry in entries ?: @[]) {
+        if ([entry isEqualToString:@".native-staged"]) continue;
+        if (bundleName || ![[entry pathExtension].lowercaseString isEqualToString:@"app"]) return nil;
+        bundleName = entry;
+    }
+    if (!bundleName) return nil;
+    NSString *candidate = [stagePath stringByAppendingPathComponent:bundleName];
+    NSNumber *isDirectory = nil;
+    NSNumber *isSymlink = nil;
+    [[NSURL fileURLWithPath:candidate] getResourceValue:&isDirectory forKey:NSURLIsDirectoryKey error:nil];
+    [[NSURL fileURLWithPath:candidate] getResourceValue:&isSymlink forKey:NSURLIsSymbolicLinkKey error:nil];
+    if (!isDirectory.boolValue || isSymlink.boolValue) return nil;
+    NSDictionary *info = [NSDictionary dictionaryWithContentsOfFile:[candidate stringByAppendingPathComponent:@"Contents/Info.plist"]];
+    id identifier = info[@"CFBundleIdentifier"];
+    id bundleVersion = info[@"CFBundleVersion"];
+    if (![identifier isKindOfClass:[NSString class]] || ![identifier isEqualToString:bundleIdentifier]) return nil;
+    if (![bundleVersion isKindOfClass:[NSString class]] || ![bundleVersion isEqualToString:version]) return nil;
+    return candidate;
+}
+
+/// A Developer ID app accepts only a release signed by the same team, as
+/// the host flow does; unsigned and ad-hoc installs rely on the feed's
+/// Ed25519 signature alone.
+static BOOL NativeSdkUpdateSignatureMatches(NSString *candidate, NSString *bundleIdentifier) {
+    NSString *teamIdentifier = NativeSdkSigningTeamIdentifier(NativeSdkUpdateBundlePath());
+    if (teamIdentifier.length == 0) return YES;
+    if ([teamIdentifier rangeOfCharacterFromSet:[[NSCharacterSet alphanumericCharacterSet] invertedSet]].location != NSNotFound ||
+        [bundleIdentifier rangeOfCharacterFromSet:[NSCharacterSet characterSetWithCharactersInString:@"\\\""]].location != NSNotFound) return NO;
+    NSString *requirement = [NSString stringWithFormat:@"anchor apple generic and certificate leaf[subject.OU] = \"%@\" and identifier \"%@\"", teamIdentifier, bundleIdentifier];
+    return NativeSdkRunTask(@"/usr/bin/codesign", @[ @"--verify", @"--deep", @"--strict", [@"-R=" stringByAppendingString:requirement], candidate ], NULL);
+}
+
+typedef void (*NativeSdkUpdateProgressFn)(void *context, uint64_t received);
+typedef int (*NativeSdkUpdateCancelledFn)(void *context);
+
+@interface NativeSdkUpdateTransfer : NSObject <NSURLSessionDataDelegate>
+@property(nonatomic) BOOL allowLoopbackHttp;
+@property(nonatomic) uint64_t limit;
+@property(nonatomic) uint64_t received;
+@property(atomic) int result;
+@property(nonatomic, strong) NSMutableData *data;
+@property(nonatomic, strong) NSFileHandle *file;
+@property(nonatomic) void *context;
+@property(nonatomic) NativeSdkUpdateProgressFn progress;
+@property(nonatomic, strong) dispatch_semaphore_t done;
+@end
+
+@implementation NativeSdkUpdateTransfer
+
+- (void)URLSession:(NSURLSession *)session task:(NSURLSessionTask *)task willPerformHTTPRedirection:(NSHTTPURLResponse *)response newRequest:(NSURLRequest *)request completionHandler:(void (^)(NSURLRequest *))completionHandler {
+    (void)session;
+    (void)response;
+    if (NativeSdkUpdateURLAllowed(request.URL, self.allowLoopbackHttp)) {
+        completionHandler(request);
+        return;
+    }
+    self.result = NativeSdkUpdateNetwork;
+    completionHandler(nil);
+    [task cancel];
+}
+
+- (void)URLSession:(NSURLSession *)session dataTask:(NSURLSessionDataTask *)dataTask didReceiveResponse:(NSURLResponse *)response completionHandler:(void (^)(NSURLSessionResponseDisposition))completionHandler {
+    (void)session;
+    (void)dataTask;
+    NSHTTPURLResponse *http = [response isKindOfClass:[NSHTTPURLResponse class]] ? (NSHTTPURLResponse *)response : nil;
+    if (!http || !NativeSdkUpdateURLAllowed(response.URL, self.allowLoopbackHttp)) {
+        self.result = NativeSdkUpdateNetwork;
+    } else if (http.statusCode < 200 || http.statusCode >= 300) {
+        self.result = NativeSdkUpdateHttpStatus;
+    } else if (response.expectedContentLength > 0 && (uint64_t)response.expectedContentLength > self.limit) {
+        self.result = NativeSdkUpdateTooLarge;
+    }
+    completionHandler(self.result == NativeSdkUpdateOk ? NSURLSessionResponseAllow : NSURLSessionResponseCancel);
+}
+
+- (void)URLSession:(NSURLSession *)session dataTask:(NSURLSessionDataTask *)dataTask didReceiveData:(NSData *)data {
+    (void)session;
+    if (self.result != NativeSdkUpdateOk) return;
+    if (data.length > self.limit - self.received) {
+        self.result = NativeSdkUpdateTooLarge;
+        [dataTask cancel];
+        return;
+    }
+    if (self.file) {
+        NSError *error = nil;
+        if (![self.file writeData:data error:&error]) {
+            self.result = NativeSdkUpdateDisk;
+            [dataTask cancel];
+            return;
+        }
+    } else {
+        [self.data appendData:data];
+    }
+    self.received += data.length;
+    if (self.progress) self.progress(self.context, self.received);
+}
+
+- (void)URLSession:(NSURLSession *)session task:(NSURLSessionTask *)task didCompleteWithError:(NSError *)error {
+    (void)session;
+    (void)task;
+    if (error && self.result == NativeSdkUpdateOk) self.result = NativeSdkUpdateNetwork;
+    dispatch_semaphore_signal(self.done);
+}
+
+@end
+
+/// GETs `url` through the user's network settings, waiting on the calling
+/// (worker) thread and honoring `cancelled` while the transfer stalls.
+static int NativeSdkUpdateTransferRun(NSURL *url, NativeSdkUpdateTransfer *transfer, void *context, NativeSdkUpdateCancelledFn cancelled) {
+    NSURLSessionConfiguration *configuration = NSURLSessionConfiguration.ephemeralSessionConfiguration;
+    configuration.timeoutIntervalForRequest = 30;
+    configuration.timeoutIntervalForResource = 60 * 60;
+    configuration.requestCachePolicy = NSURLRequestReloadIgnoringLocalCacheData;
+    NSOperationQueue *queue = [[NSOperationQueue alloc] init];
+    queue.maxConcurrentOperationCount = 1;
+    NSURLSession *session = [NSURLSession sessionWithConfiguration:configuration delegate:transfer delegateQueue:queue];
+    transfer.done = dispatch_semaphore_create(0);
+    NSURLSessionDataTask *task = [session dataTaskWithURL:url];
+    [task resume];
+    while (dispatch_semaphore_wait(transfer.done, dispatch_time(DISPATCH_TIME_NOW, 200 * NSEC_PER_MSEC)) != 0) {
+        if (cancelled && cancelled(context) && transfer.result == NativeSdkUpdateOk) {
+            transfer.result = NativeSdkUpdateCancelled;
+            [task cancel];
+        }
+    }
+    [session finishTasksAndInvalidate];
+    return transfer.result;
+}
+
+int native_sdk_macos_updates_eligibility(void) {
+    @autoreleasepool {
+        NSString *bundlePath = NativeSdkUpdateBundlePath();
+        if (![bundlePath.pathExtension.lowercaseString isEqualToString:@"app"]) return 1;
+        // A quarantined app Gatekeeper runs from a randomized read-only
+        // mount cannot replace itself until the user moves it.
+        if ([bundlePath rangeOfString:@"/AppTranslocation/"].location != NSNotFound) return 2;
+        if (![[NSFileManager defaultManager] isWritableFileAtPath:bundlePath.stringByDeletingLastPathComponent]) return 2;
+        return 0;
+    }
+}
+
+size_t native_sdk_macos_updates_staged_version(const char *bundle_id, size_t bundle_id_len, char *output, size_t capacity) {
+    @autoreleasepool {
+        NSString *stagePath = NativeSdkUpdateSiblingPath(@"native-update");
+        NSString *version = [NSString stringWithContentsOfFile:[stagePath stringByAppendingPathComponent:@".native-staged"] encoding:NSUTF8StringEncoding error:nil];
+        if (version.length == 0 || !NativeSdkUpdateStagedBundle(stagePath, NativeSdkUpdateString(bundle_id, bundle_id_len), version)) return 0;
+        return NativeSdkUpdateCopy(version, output, capacity);
+    }
+}
+
+size_t native_sdk_macos_updates_take_last(const char *bundle_id, size_t bundle_id_len, char *output, size_t capacity) {
+    @autoreleasepool {
+        NSString *resultPath = NativeSdkUpdateResultPath(NativeSdkUpdateString(bundle_id, bundle_id_len));
+        if (!resultPath) return 0;
+        NSString *record = [NSString stringWithContentsOfFile:resultPath encoding:NSUTF8StringEncoding error:nil];
+        if (!record) return 0;
+        [[NSFileManager defaultManager] removeItemAtPath:resultPath error:nil];
+        NSString *line = [record stringByTrimmingCharactersInSet:NSCharacterSet.whitespaceAndNewlineCharacterSet];
+        if (![line hasPrefix:@"updated "]) return 0;
+        return NativeSdkUpdateCopy([line substringFromIndex:8], output, capacity);
+    }
+}
+
+int native_sdk_macos_updates_fetch(const char *url, size_t url_len, int allow_loopback_http, uint8_t *output, size_t capacity, size_t *output_len) {
+    @autoreleasepool {
+        NSURL *target = [NSURL URLWithString:NativeSdkUpdateString(url, url_len)];
+        if (!target || !NativeSdkUpdateURLAllowed(target, allow_loopback_http != 0)) return NativeSdkUpdateNetwork;
+        NativeSdkUpdateTransfer *transfer = [[NativeSdkUpdateTransfer alloc] init];
+        transfer.allowLoopbackHttp = allow_loopback_http != 0;
+        transfer.limit = capacity;
+        transfer.data = [NSMutableData data];
+        const int result = NativeSdkUpdateTransferRun(target, transfer, NULL, NULL);
+        if (result != NativeSdkUpdateOk) return result;
+        memcpy(output, transfer.data.bytes, transfer.data.length);
+        *output_len = transfer.data.length;
+        return NativeSdkUpdateOk;
+    }
+}
+
+int native_sdk_macos_updates_download(const char *url, size_t url_len, int allow_loopback_http, uint64_t limit, char *path_output, size_t path_capacity, size_t *path_len, void *context, NativeSdkUpdateProgressFn progress, NativeSdkUpdateCancelledFn cancelled) {
+    @autoreleasepool {
+        NSURL *target = [NSURL URLWithString:NativeSdkUpdateString(url, url_len)];
+        if (!target || !NativeSdkUpdateURLAllowed(target, allow_loopback_http != 0)) return NativeSdkUpdateNetwork;
+        NSString *path = [NSTemporaryDirectory() stringByAppendingPathComponent:[NSString stringWithFormat:@"native-update-%@.zip", NSUUID.UUID.UUIDString]];
+        NSFileManager *manager = [NSFileManager defaultManager];
+        if (![manager createFileAtPath:path contents:nil attributes:@{ NSFilePosixPermissions: @0600 }]) return NativeSdkUpdateDisk;
+        NSFileHandle *file = [NSFileHandle fileHandleForWritingAtPath:path];
+        if (!file) {
+            [manager removeItemAtPath:path error:nil];
+            return NativeSdkUpdateDisk;
+        }
+        NativeSdkUpdateTransfer *transfer = [[NativeSdkUpdateTransfer alloc] init];
+        transfer.allowLoopbackHttp = allow_loopback_http != 0;
+        transfer.limit = limit;
+        transfer.file = file;
+        transfer.context = context;
+        transfer.progress = progress;
+        int result = NativeSdkUpdateTransferRun(target, transfer, context, cancelled);
+        if (![file closeAndReturnError:nil] && result == NativeSdkUpdateOk) result = NativeSdkUpdateDisk;
+        const size_t length = NativeSdkUpdateCopy(path, path_output, path_capacity);
+        if (result == NativeSdkUpdateOk && length == 0) result = NativeSdkUpdateDisk;
+        if (result != NativeSdkUpdateOk) {
+            [manager removeItemAtPath:path error:nil];
+            return result;
+        }
+        *path_len = length;
+        return NativeSdkUpdateOk;
+    }
+}
+
+int native_sdk_macos_updates_stage(const char *archive_path, size_t archive_path_len, const char *bundle_id, size_t bundle_id_len, const char *version, size_t version_len) {
+    @autoreleasepool {
+        NSFileManager *manager = [NSFileManager defaultManager];
+        NSString *bundleIdentifier = NativeSdkUpdateString(bundle_id, bundle_id_len);
+        NSString *expectedVersion = NativeSdkUpdateString(version, version_len);
+        NSString *stagePath = NativeSdkUpdateSiblingPath(@"native-update");
+        [manager removeItemAtPath:stagePath error:nil];
+        if (![manager createDirectoryAtPath:stagePath withIntermediateDirectories:NO attributes:nil error:nil]) return 2;
+        NSString *candidate = nil;
+        if (NativeSdkRunTask(@"/usr/bin/ditto", @[ @"-x", @"-k", NativeSdkUpdateString(archive_path, archive_path_len), stagePath ], NULL)) {
+            candidate = NativeSdkUpdateStagedBundle(stagePath, bundleIdentifier, expectedVersion);
+        }
+        if (!candidate || !NativeSdkUpdateSignatureMatches(candidate, bundleIdentifier)) {
+            [manager removeItemAtPath:stagePath error:nil];
+            return 1;
+        }
+        if (![expectedVersion writeToFile:[stagePath stringByAppendingPathComponent:@".native-staged"] atomically:YES encoding:NSUTF8StringEncoding error:nil]) {
+            [manager removeItemAtPath:stagePath error:nil];
+            return 2;
+        }
+        return 0;
+    }
+}
+
+void native_sdk_macos_updates_discard(void) {
+    @autoreleasepool {
+        [[NSFileManager defaultManager] removeItemAtPath:NativeSdkUpdateSiblingPath(@"native-update") error:nil];
+    }
+}
+
+/// Starts the helper that waits for this process to exit, replaces the app
+/// with the staged release (the old one returns if that fails), records
+/// the switch for the new version to report, and with `relaunch` opens it.
+int native_sdk_macos_updates_install(const char *bundle_id, size_t bundle_id_len, const char *from_version, size_t from_version_len, int relaunch) {
+    @autoreleasepool {
+        NSFileManager *manager = [NSFileManager defaultManager];
+        NSString *bundleIdentifier = NativeSdkUpdateString(bundle_id, bundle_id_len);
+        NSString *stagePath = NativeSdkUpdateSiblingPath(@"native-update");
+        NSString *version = [NSString stringWithContentsOfFile:[stagePath stringByAppendingPathComponent:@".native-staged"] encoding:NSUTF8StringEncoding error:nil];
+        NSString *candidate = version.length > 0 ? NativeSdkUpdateStagedBundle(stagePath, bundleIdentifier, version) : nil;
+        if (!candidate) return 0;
+        NSString *scriptPath = [NSTemporaryDirectory() stringByAppendingPathComponent:[NSString stringWithFormat:@"native-update-install-%@.sh", NSUUID.UUID.UUIDString]];
+        NSString *script = @"#!/bin/sh\n"
+            "set -u\n"
+            "pid=\"$1\"; current=\"$2\"; candidate=\"$3\"; backup=\"$4\"; stage=\"$5\"; relaunch=\"$6\"; result=\"$7\"; from=\"$8\"; to=\"$9\"\n"
+            "count=0\n"
+            "while /bin/kill -0 \"$pid\" 2>/dev/null; do\n"
+            "  count=$((count + 1))\n"
+            "  if [ \"$count\" -ge 600 ]; then /bin/rm -f \"$0\"; exit 1; fi\n"
+            "  /bin/sleep 0.1\n"
+            "done\n"
+            "/bin/rm -rf \"$backup\"\n"
+            "if /bin/mv \"$current\" \"$backup\"; then\n"
+            "  if /bin/mv \"$candidate\" \"$current\"; then\n"
+            "    if [ -n \"$result\" ]; then /bin/mkdir -p \"${result%/*}\" && /usr/bin/printf 'updated %s %s\\n' \"$from\" \"$to\" > \"$result\"; fi\n"
+            "    if [ \"$relaunch\" != 1 ] || /usr/bin/open \"$current\"; then\n"
+            "      /bin/rm -rf \"$backup\" \"$stage\"\n"
+            "      /bin/rm -f \"$0\"\n"
+            "      exit 0\n"
+            "    fi\n"
+            "    if [ -n \"$result\" ]; then /bin/rm -f \"$result\"; fi\n"
+            "    /bin/rm -rf \"$current\"\n"
+            "  fi\n"
+            "  /bin/mv \"$backup\" \"$current\"\n"
+            "fi\n"
+            "/bin/rm -rf \"$stage\"\n"
+            "if [ \"$relaunch\" = 1 ]; then /usr/bin/open \"$current\" >/dev/null 2>&1 || true; fi\n"
+            "/bin/rm -f \"$0\"\n"
+            "exit 1\n";
+        if (![script writeToFile:scriptPath atomically:YES encoding:NSUTF8StringEncoding error:nil] ||
+            ![manager setAttributes:@{ NSFilePosixPermissions: @0700 } ofItemAtPath:scriptPath error:nil]) {
+            [manager removeItemAtPath:scriptPath error:nil];
+            return 0;
+        }
+        NSTask *installer = [[NSTask alloc] init];
+        installer.executableURL = [NSURL fileURLWithPath:@"/bin/sh"];
+        installer.arguments = @[
+            scriptPath,
+            [NSString stringWithFormat:@"%d", getpid()],
+            NativeSdkUpdateBundlePath(),
+            candidate,
+            NativeSdkUpdateSiblingPath(@"native-update-backup"),
+            stagePath,
+            relaunch ? @"1" : @"0",
+            NativeSdkUpdateResultPath(bundleIdentifier) ?: @"",
+            NativeSdkUpdateString(from_version, from_version_len),
+            version,
+        ];
+        if (![installer launchAndReturnError:nil]) {
+            [manager removeItemAtPath:scriptPath error:nil];
+            return 0;
+        }
+        return 1;
+    }
+}
+
 void native_sdk_appkit_run(native_sdk_appkit_host_t *host, native_sdk_appkit_event_callback_t callback, void *context) {
     NativeSdkAppKitHost *object = (__bridge NativeSdkAppKitHost *)host;
     [object runWithCallback:callback context:context];
@@ -13992,23 +14401,71 @@ static void NativeSdkConfigurePanelExtensions(NSSavePanel *panel, NSArray<NSStri
     }
 }
 
+static NSString *NativeSdkDialogString(const char *bytes, size_t len) {
+    if (!bytes || len == 0) return nil;
+    return [[NSString alloc] initWithBytes:bytes length:len encoding:NSUTF8StringEncoding];
+}
+
+static NSOpenPanel *NativeSdkMakeOpenPanel(const native_sdk_appkit_open_dialog_opts_t *opts) {
+    NSOpenPanel *panel = [NSOpenPanel openPanel];
+    NSString *title = NativeSdkDialogString(opts->title, opts->title_len);
+    if (title) panel.title = title;
+    NSString *path = NativeSdkDialogString(opts->default_path, opts->default_path_len);
+    if (path) panel.directoryURL = [NSURL fileURLWithPath:path];
+    panel.canChooseFiles = opts->allow_directories == 0;
+    panel.canChooseDirectories = opts->allow_directories != 0;
+    panel.allowsMultipleSelection = opts->allow_multiple != 0;
+    NativeSdkConfigurePanelExtensions(panel, NativeSdkParseExtensions(opts->extensions, opts->extensions_len));
+    return panel;
+}
+
+static NSSavePanel *NativeSdkMakeSavePanel(const native_sdk_appkit_save_dialog_opts_t *opts) {
+    NSSavePanel *panel = [NSSavePanel savePanel];
+    NSString *title = NativeSdkDialogString(opts->title, opts->title_len);
+    if (title) panel.title = title;
+    NSString *path = NativeSdkDialogString(opts->default_path, opts->default_path_len);
+    if (path) panel.directoryURL = [NSURL fileURLWithPath:path];
+    NSString *name = NativeSdkDialogString(opts->default_name, opts->default_name_len);
+    if (name) panel.nameFieldStringValue = name;
+    NativeSdkConfigurePanelExtensions(panel, NativeSdkParseExtensions(opts->extensions, opts->extensions_len));
+    return panel;
+}
+
+static NSAlert *NativeSdkMakeAlert(const native_sdk_appkit_message_dialog_opts_t *opts) {
+    NSAlert *alert = [[NSAlert alloc] init];
+    switch (opts->style) {
+        case 1: alert.alertStyle = NSAlertStyleWarning; break;
+        case 2: alert.alertStyle = NSAlertStyleCritical; break;
+        default: alert.alertStyle = NSAlertStyleInformational; break;
+    }
+    NSString *title = NativeSdkDialogString(opts->title, opts->title_len);
+    NSString *message = NativeSdkDialogString(opts->message, opts->message_len);
+    NSString *informative = NativeSdkDialogString(opts->informative_text, opts->informative_text_len);
+    if (message.length > 0) {
+        alert.messageText = message;
+    } else if (title.length > 0) {
+        alert.messageText = title;
+    }
+    if (informative.length > 0) {
+        alert.informativeText = informative;
+    }
+    if (opts->message && opts->message_len > 0) {
+        alert.window.title = title.length > 0 ? title : @"";
+    }
+    NSString *primary = NativeSdkDialogString(opts->primary_button, opts->primary_button_len);
+    [alert addButtonWithTitle:primary ?: @"OK"];
+    NSString *secondary = NativeSdkDialogString(opts->secondary_button, opts->secondary_button_len);
+    if (secondary) [alert addButtonWithTitle:secondary];
+    NSString *tertiary = NativeSdkDialogString(opts->tertiary_button, opts->tertiary_button_len);
+    if (tertiary) [alert addButtonWithTitle:tertiary];
+    return alert;
+}
+
 native_sdk_appkit_open_dialog_result_t native_sdk_appkit_show_open_dialog(native_sdk_appkit_host_t *host, const native_sdk_appkit_open_dialog_opts_t *opts, char *buffer, size_t buffer_len) {
     (void)host;
     native_sdk_appkit_open_dialog_result_t result = { .count = 0, .bytes_written = 0 };
     @autoreleasepool {
-        NSOpenPanel *panel = [NSOpenPanel openPanel];
-        if (opts->title && opts->title_len > 0) {
-            panel.title = [[NSString alloc] initWithBytes:opts->title length:opts->title_len encoding:NSUTF8StringEncoding];
-        }
-        if (opts->default_path && opts->default_path_len > 0) {
-            NSString *path = [[NSString alloc] initWithBytes:opts->default_path length:opts->default_path_len encoding:NSUTF8StringEncoding];
-            panel.directoryURL = [NSURL fileURLWithPath:path];
-        }
-        panel.canChooseFiles = opts->allow_directories == 0;
-        panel.canChooseDirectories = opts->allow_directories != 0;
-        panel.allowsMultipleSelection = opts->allow_multiple != 0;
-        NativeSdkConfigurePanelExtensions(panel, NativeSdkParseExtensions(opts->extensions, opts->extensions_len));
-
+        NSOpenPanel *panel = NativeSdkMakeOpenPanel(opts);
         if ([panel runModal] != NSModalResponseOK) return result;
 
         size_t offset = 0;
@@ -14035,19 +14492,7 @@ native_sdk_appkit_open_dialog_result_t native_sdk_appkit_show_open_dialog(native
 size_t native_sdk_appkit_show_save_dialog(native_sdk_appkit_host_t *host, const native_sdk_appkit_save_dialog_opts_t *opts, char *buffer, size_t buffer_len) {
     (void)host;
     @autoreleasepool {
-        NSSavePanel *panel = [NSSavePanel savePanel];
-        if (opts->title && opts->title_len > 0) {
-            panel.title = [[NSString alloc] initWithBytes:opts->title length:opts->title_len encoding:NSUTF8StringEncoding];
-        }
-        if (opts->default_path && opts->default_path_len > 0) {
-            NSString *path = [[NSString alloc] initWithBytes:opts->default_path length:opts->default_path_len encoding:NSUTF8StringEncoding];
-            panel.directoryURL = [NSURL fileURLWithPath:path];
-        }
-        if (opts->default_name && opts->default_name_len > 0) {
-            panel.nameFieldStringValue = [[NSString alloc] initWithBytes:opts->default_name length:opts->default_name_len encoding:NSUTF8StringEncoding];
-        }
-        NativeSdkConfigurePanelExtensions(panel, NativeSdkParseExtensions(opts->extensions, opts->extensions_len));
-
+        NSSavePanel *panel = NativeSdkMakeSavePanel(opts);
         if ([panel runModal] != NSModalResponseOK) return 0;
 
         NSString *path = panel.URL.path;
@@ -14063,45 +14508,200 @@ size_t native_sdk_appkit_show_save_dialog(native_sdk_appkit_host_t *host, const
 int native_sdk_appkit_show_message_dialog(native_sdk_appkit_host_t *host, const native_sdk_appkit_message_dialog_opts_t *opts) {
     (void)host;
     @autoreleasepool {
-        NSAlert *alert = [[NSAlert alloc] init];
-        switch (opts->style) {
-            case 1: alert.alertStyle = NSAlertStyleWarning; break;
-            case 2: alert.alertStyle = NSAlertStyleCritical; break;
-            default: alert.alertStyle = NSAlertStyleInformational; break;
-        }
-        NSString *title = opts->title && opts->title_len > 0 ? [[NSString alloc] initWithBytes:opts->title length:opts->title_len encoding:NSUTF8StringEncoding] : nil;
-        NSString *message = opts->message && opts->message_len > 0 ? [[NSString alloc] initWithBytes:opts->message length:opts->message_len encoding:NSUTF8StringEncoding] : nil;
-        NSString *informative = opts->informative_text && opts->informative_text_len > 0 ? [[NSString alloc] initWithBytes:opts->informative_text length:opts->informative_text_len encoding:NSUTF8StringEncoding] : nil;
-        if (message.length > 0) {
-            alert.messageText = message;
-        } else if (title.length > 0) {
-            alert.messageText = title;
-        }
-        if (informative.length > 0) {
-            alert.informativeText = informative;
-        }
-        if (opts->message && opts->message_len > 0) {
-            alert.window.title = title.length > 0 ? title : @"";
-        }
-        if (opts->primary_button && opts->primary_button_len > 0) {
-            [alert addButtonWithTitle:[[NSString alloc] initWithBytes:opts->primary_button length:opts->primary_button_len encoding:NSUTF8StringEncoding]];
+        NSAlert *alert = NativeSdkMakeAlert(opts);
+        NSModalResponse response = [alert runModal];
+        if (response == NSAlertFirstButtonReturn) return 0;
+        if (response == NSAlertSecondButtonReturn) return 1;
+        return 2;
+    }
+}
+
+/* Record a dialog's result and wake the loop; the runtime collects it with
+ * poll. Never runs app code: AppKit calls completion handlers inside its
+ * own transaction (electron#26884), so the result waits for the wake. */
+static void NativeSdkFinishDialog(NativeSdkAppKitHost *host, NativeSdkDialog *dialog, NSModalResponse response) {
+    if (!host) return;
+    NSNumber *key = @(dialog.dialogId);
+    if (host.dialogs[key] != dialog) return;
+    [host.dialogs removeObjectForKey:key];
+    dialog.outcome = NATIVE_SDK_APPKIT_DIALOG_CANCELLED;
+    if (dialog.alert) {
+        if (response >= NSAlertFirstButtonReturn && response <= NSAlertThirdButtonReturn) {
+            dialog.outcome = NATIVE_SDK_APPKIT_DIALOG_SELECTED;
+            dialog.button = (int)(response - NSAlertFirstButtonReturn);
+        }
+    } else if (response == NSModalResponseOK) {
+        NSMutableArray<NSString *> *paths = [NSMutableArray array];
+        if ([dialog.panel isKindOfClass:[NSOpenPanel class]]) {
+            for (NSURL *url in ((NSOpenPanel *)dialog.panel).URLs) {
+                if (url.path) [paths addObject:url.path];
+            }
+        } else if (dialog.panel.URL.path) {
+            [paths addObject:dialog.panel.URL.path];
+        }
+        dialog.paths = paths;
+        if (paths.count > 0) dialog.outcome = NATIVE_SDK_APPKIT_DIALOG_SELECTED;
+    }
+    dialog.panel = nil;
+    dialog.alert = nil;
+    if (host.didShutdown) return;
+    [host.finishedDialogs addObject:dialog];
+    [host wakeFromAnyThread];
+}
+
+static void NativeSdkPresentDialog(NativeSdkAppKitHost *host, NativeSdkDialog *dialog, NSWindow *parent) {
+    __weak NativeSdkAppKitHost *weakHost = host;
+    if (dialog.panel) {
+        void (^done)(NSModalResponse) = ^(NSModalResponse response) {
+            NativeSdkFinishDialog(weakHost, dialog, response);
+        };
+        if (parent) {
+            dialog.sheetParent = parent;
+            [dialog.panel beginSheetModalForWindow:parent completionHandler:done];
         } else {
-            [alert addButtonWithTitle:@"OK"];
+            [dialog.panel beginWithCompletionHandler:done];
         }
-        if (opts->secondary_button && opts->secondary_button_len > 0) {
-            [alert addButtonWithTitle:[[NSString alloc] initWithBytes:opts->secondary_button length:opts->secondary_button_len encoding:NSUTF8StringEncoding]];
+        return;
+    }
+    if (parent) {
+        dialog.sheetParent = parent;
+        [dialog.alert beginSheetModalForWindow:parent completionHandler:^(NSModalResponse response) {
+            NativeSdkFinishDialog(weakHost, dialog, response);
+        }];
+        return;
+    }
+    // NSAlert has no modeless form. With no window to attach a sheet to,
+    // run it modally from a fresh loop turn, outside any runtime
+    // dispatch, so events keep reaching the app meanwhile (Electron runs
+    // a parentless message box modally too). A run loop block, not
+    // dispatch_async: a modal loop inside a main-queue block keeps the
+    // serial main queue from draining, and wakes and quits ride it.
+    CFRunLoopRef mainLoop = CFRunLoopGetMain();
+    CFRunLoopPerformBlock(mainLoop, kCFRunLoopCommonModes, ^{
+        NativeSdkAppKitHost *strongHost = weakHost;
+        if (!strongHost || dialog.cancelRequested || strongHost.dialogs[@(dialog.dialogId)] != dialog) {
+            NativeSdkFinishDialog(strongHost, dialog, NSModalResponseCancel);
+            return;
         }
-        if (opts->tertiary_button && opts->tertiary_button_len > 0) {
-            [alert addButtonWithTitle:[[NSString alloc] initWithBytes:opts->tertiary_button length:opts->tertiary_button_len encoding:NSUTF8StringEncoding]];
+        dialog.modalRunning = YES;
+        const NSModalResponse response = [dialog.alert runModal];
+        dialog.modalRunning = NO;
+        NativeSdkFinishDialog(strongHost, dialog, response);
+        // A stop during the alert ended only the modal loop; [NSApp stop:]
+        // inside a modal session never reaches the main one.
+        if (strongHost.didShutdown) {
+            [NSApp stop:nil];
+            NativeSdkPostEmptyEvent();
         }
+    });
+    CFRunLoopWakeUp(mainLoop);
+}
 
-        NSModalResponse response = [alert runModal];
-        if (response == NSAlertFirstButtonReturn) return 0;
-        if (response == NSAlertSecondButtonReturn) return 1;
-        return 2;
+static void NativeSdkCancelDialog(NativeSdkDialog *dialog) {
+    NSWindow *sheet = dialog.panel ?: dialog.alert.window;
+    if (dialog.sheetParent && sheet) {
+        // Ending the sheet on its window detaches it at once, so a close
+        // right after is not refused for a sheet still attached.
+        [dialog.sheetParent endSheet:sheet returnCode:NSModalResponseCancel];
+        return;
+    }
+    if (dialog.panel) {
+        [dialog.panel cancel:nil];
+        return;
+    }
+    if (!dialog.alert) return;
+    if (dialog.modalRunning) {
+        [NSApp stopModalWithCode:NSModalResponseCancel];
+        NativeSdkPostEmptyEvent();
+    } else {
+        // Not started yet: the deferred presentation finishes it instead.
+        dialog.cancelRequested = YES;
+    }
+}
+
+static void NativeSdkCancelDialogsForWindow(NativeSdkAppKitHost *host, uint64_t windowId) {
+    for (NativeSdkDialog *dialog in [host.dialogs.allValues copy]) {
+        if (dialog.parentWindowId == windowId) NativeSdkCancelDialog(dialog);
     }
 }
 
+static void NativeSdkCancelAllDialogs(NativeSdkAppKitHost *host) {
+    for (NativeSdkDialog *dialog in [host.dialogs.allValues copy]) NativeSdkCancelDialog(dialog);
+    [host.finishedDialogs removeAllObjects];
+}
+
+int native_sdk_appkit_request_dialog(native_sdk_appkit_host_t *host, const native_sdk_appkit_dialog_request_t *request) {
+    NativeSdkAppKitHost *object = (__bridge NativeSdkAppKitHost *)host;
+    if (!object || !request || object.didShutdown || request->id == 0) return 0;
+    @autoreleasepool {
+        NativeSdkDialog *dialog = [[NativeSdkDialog alloc] init];
+        dialog.dialogId = request->id;
+        dialog.parentWindowId = request->parent_window_id;
+        switch (request->kind) {
+            case NATIVE_SDK_APPKIT_DIALOG_OPEN:
+                if (!request->open_opts) return 0;
+                dialog.panel = NativeSdkMakeOpenPanel(request->open_opts);
+                break;
+            case NATIVE_SDK_APPKIT_DIALOG_SAVE:
+                if (!request->save_opts) return 0;
+                dialog.panel = NativeSdkMakeSavePanel(request->save_opts);
+                break;
+            case NATIVE_SDK_APPKIT_DIALOG_MESSAGE:
+                if (!request->message_opts) return 0;
+                dialog.alert = NativeSdkMakeAlert(request->message_opts);
+                break;
+            default:
+                return 0;
+        }
+        // A parent that cannot host a sheet right now (hidden, minimized,
+        // already showing one) gets a modeless panel instead, as Electron
+        // does for invisible parents (electron#22671).
+        NSWindow *parent = request->parent_window_id != 0 ? object.windows[@(request->parent_window_id)] : nil;
+        if (parent && (!parent.isVisible || parent.isMiniaturized || parent.attachedSheet)) parent = nil;
+        if (!parent) dialog.parentWindowId = 0;
+        object.dialogs[@(dialog.dialogId)] = dialog;
+        NativeSdkPresentDialog(object, dialog, parent);
+        return 1;
+    }
+}
+
+void native_sdk_appkit_cancel_dialog(native_sdk_appkit_host_t *host, uint64_t id) {
+    NativeSdkAppKitHost *object = (__bridge NativeSdkAppKitHost *)host;
+    if (!object) return;
+    NativeSdkDialog *dialog = object.dialogs[@(id)];
+    if (dialog) NativeSdkCancelDialog(dialog);
+}
+
+int native_sdk_appkit_poll_dialog_result(native_sdk_appkit_host_t *host, char *buffer, size_t buffer_len, native_sdk_appkit_dialog_result_t *result) {
+    NativeSdkAppKitHost *object = (__bridge NativeSdkAppKitHost *)host;
+    if (!object || !result || object.finishedDialogs.count == 0) return 0;
+    NativeSdkDialog *dialog = object.finishedDialogs.firstObject;
+    [object.finishedDialogs removeObjectAtIndex:0];
+    *result = (native_sdk_appkit_dialog_result_t){ .id = dialog.dialogId, .outcome = dialog.outcome, .button = dialog.button };
+    size_t offset = 0;
+    size_t count = 0;
+    for (NSString *path in dialog.paths) {
+        NSData *data = [path dataUsingEncoding:NSUTF8StringEncoding];
+        if (!data) continue;
+        const size_t needed = data.length + (count > 0 ? 1 : 0);
+        if (!buffer || needed > buffer_len - offset) {
+            // More paths than the runtime can hold: report failure rather
+            // than a silently shortened selection.
+            result->outcome = NATIVE_SDK_APPKIT_DIALOG_FAILED;
+            offset = 0;
+            count = 0;
+            break;
+        }
+        if (count > 0) buffer[offset++] = '\n';
+        memcpy(buffer + offset, data.bytes, data.length);
+        offset += data.length;
+        count++;
+    }
+    result->count = count;
+    result->bytes_written = offset;
+    return 1;
+}
+
 static NSImage *NativeSdkTrayImageWithOpacity(NSImage *source, double opacity) {
     if (!source) return nil;
     const CGFloat fraction = MAX(0.0, MIN(1.0, opacity));