@zogien/native-sdk 0.11.0-fork.4 → 0.11.0-fork.5

package/src/platform/windows/root.zig

@@ -143,8 +143,8 @@ extern fn native_sdk_windows_create(app_name: [*]const u8, app_name_len: usize,
 extern fn native_sdk_windows_destroy(host: *WindowsHost) void;
 extern fn native_sdk_windows_run(host: *WindowsHost, callback: WindowsCallback, context: ?*anyopaque) void;
 extern fn native_sdk_windows_stop(host: *WindowsHost) void;
-extern fn native_sdk_windows_wake(host: *WindowsHost) void;
-extern fn native_sdk_windows_request_frame(host: *WindowsHost) void;
+extern fn native_sdk_windows_wake(host: *WindowsHost) c_int;
+extern fn native_sdk_windows_request_frame(host: *WindowsHost) c_int;
 extern fn native_sdk_windows_decode_image(bytes: [*]const u8, bytes_len: usize, pixels: [*]u8, pixels_len: usize, max_pixels: usize, out_width: *usize, out_height: *usize) c_int;
 extern fn native_sdk_windows_load_webview(host: *WindowsHost, source: [*]const u8, source_len: usize, source_kind: c_int, asset_root: [*]const u8, asset_root_len: usize, asset_entry: [*]const u8, asset_entry_len: usize, asset_origin: [*]const u8, asset_origin_len: usize, spa_fallback: c_int) void;
 extern fn native_sdk_windows_load_window_webview(host: *WindowsHost, window_id: u64, source: [*]const u8, source_len: usize, source_kind: c_int, asset_root: [*]const u8, asset_root_len: usize, asset_entry: [*]const u8, asset_entry_len: usize, asset_origin: [*]const u8, asset_origin_len: usize, spa_fallback: c_int) c_int;
@@ -197,6 +197,9 @@ extern fn native_sdk_windows_reveal_path(host: *WindowsHost, path: [*]const u8,
 extern fn native_sdk_windows_show_open_dialog(host: *WindowsHost, opts: *const WindowsOpenDialogOpts, buffer: [*]u8, buffer_len: usize) WindowsOpenDialogResult;
 extern fn native_sdk_windows_show_save_dialog(host: *WindowsHost, opts: *const WindowsSaveDialogOpts, buffer: [*]u8, buffer_len: usize) usize;
 extern fn native_sdk_windows_show_message_dialog(host: *WindowsHost, opts: *const WindowsMessageDialogOpts) c_int;
+extern fn native_sdk_windows_request_dialog(host: *WindowsHost, request: *const WindowsDialogRequest) c_int;
+extern fn native_sdk_windows_cancel_dialog(host: *WindowsHost, id: u64) void;
+extern fn native_sdk_windows_poll_dialog_result(host: *WindowsHost, buffer: [*]u8, buffer_len: usize, result: *WindowsDialogResult) c_int;
 extern fn native_sdk_windows_show_notification(host: *WindowsHost, title: [*]const u8, title_len: usize, subtitle: [*]const u8, subtitle_len: usize, body: [*]const u8, body_len: usize, notification_id: [*]const u8, notification_id_len: usize, action_label: [*]const u8, action_label_len: usize, action_command: [*]const u8, action_command_len: usize) c_int;
 extern fn native_sdk_windows_create_tray(host: *WindowsHost, icon_path: [*]const u8, icon_path_len: usize, tooltip: [*]const u8, tooltip_len: usize, activation_command: [*]const u8, activation_command_len: usize, alternate_activation_command: [*]const u8, alternate_activation_command_len: usize, open_command: [*]const u8, open_command_len: usize) c_int;
 extern fn native_sdk_windows_update_tray_menu(host: *WindowsHost, item_ids: [*]const u32, labels: [*]const [*]const u8, label_lens: [*]const usize, separators: [*]const c_int, enabled_flags: [*]const c_int, details: [*]const [*]const u8, detail_lens: [*]const usize, roles: [*]const c_int, keys: [*]const [*]const u8, key_lens: [*]const usize, modifiers: [*]const u32, count: usize) c_int;
@@ -277,6 +280,23 @@ const WindowsMessageDialogOpts = extern struct {
     tertiary_button_len: usize,
 };
 
+const WindowsDialogRequest = extern struct {
+    id: u64,
+    parent_window_id: u64,
+    kind: c_int,
+    open_opts: ?*const WindowsOpenDialogOpts,
+    save_opts: ?*const WindowsSaveDialogOpts,
+    message_opts: ?*const WindowsMessageDialogOpts,
+};
+
+const WindowsDialogResult = extern struct {
+    id: u64,
+    outcome: c_int,
+    button: c_int,
+    count: usize,
+    bytes_written: usize,
+};
+
 /// The startup-window twin of the runtime's create-time `.hide` gate:
 /// on windows, hide-on-close is honest only when the app declares a
 /// tray (status item) — SW_HIDE removes the taskbar entry and windows
@@ -477,6 +497,9 @@ pub const WindowsPlatform = struct {
                 .show_open_dialog_fn = showOpenDialog,
                 .show_save_dialog_fn = showSaveDialog,
                 .show_message_dialog_fn = showMessageDialog,
+                .request_dialog_fn = if (self.web_engine == .system) requestDialog else null,
+                .cancel_dialog_fn = if (self.web_engine == .system) cancelDialog else null,
+                .poll_dialog_result_fn = if (self.web_engine == .system) pollDialogResult else null,
                 .show_notification_fn = showNotification,
                 .create_tray_fn = createTray,
                 .update_tray_menu_fn = updateTrayMenu,
@@ -901,13 +924,14 @@ fn emitWindowEvent(context: ?*anyopaque, window_id: platform_mod.WindowId, name:
     native_sdk_windows_emit_window_event(self.host, window_id, name.ptr, name.len, detail_json.ptr, detail_json.len);
 }
 
-/// Thread-safe: `PostMessageW` into the existing message loop (the
-/// enqueue-only shape the wake contract requires — never the
+/// Thread-safe: `PostMessageW` to the host's loop window (the
+/// enqueue-only shape the wake contract requires — no lock, never the
 /// synchronous `SendMessage`), whose window procedure emits `.wake` on
-/// the loop thread.
+/// the loop thread. A wake that could not be posted is an error, so the
+/// caller re-arms instead of assuming the nudge happened.
 fn wake(context: ?*anyopaque) anyerror!void {
     const self: *WindowsPlatform = @ptrCast(@alignCast(context.?));
-    native_sdk_windows_wake(self.host);
+    if (native_sdk_windows_wake(self.host) == 0) return error.WakeNotPosted;
 }
 
 /// Teardown abandoned an in-flight channel wake call: latch the flag
@@ -918,13 +942,14 @@ fn noteChannelWakeAbandoned(context: ?*anyopaque) void {
     self.channel_wake_abandoned.store(true, .seq_cst);
 }
 
-/// Thread-safe like `wake`: `PostMessage` into the message loop, whose
-/// window procedure emits one `.frame` event on the loop thread. The
-/// automation arrival watcher calls this when a command lands so
-/// consumption never depends on the host's own frame pump.
+/// Thread-safe like `wake`: `PostMessage` to the loop window, whose
+/// window procedure emits one `.frame` event on the loop thread;
+/// requests coalesce while one is queued. The automation arrival
+/// watcher calls this when a command lands so consumption never depends
+/// on the host's own frame pump.
 fn requestFrame(context: ?*anyopaque) anyerror!void {
     const self: *WindowsPlatform = @ptrCast(@alignCast(context.?));
-    native_sdk_windows_request_frame(self.host);
+    if (native_sdk_windows_request_frame(self.host) == 0) return error.FrameRequestNotPosted;
 }
 
 /// Headless image codec for session replay: the SAME WIC decode a live
@@ -1481,12 +1506,9 @@ fn closeWebView(context: ?*anyopaque, window_id: platform_mod.WindowId, label: [
     if (native_sdk_windows_close_webview(self.host, window_id, label.ptr, label.len) == 0) return error.WebViewNotFound;
 }
 
-fn showOpenDialog(context: ?*anyopaque, options: platform_mod.OpenDialogOptions, buffer: []u8) anyerror!platform_mod.OpenDialogResult {
-    const self: *WindowsPlatform = @ptrCast(@alignCast(context.?));
-    if (self.web_engine != .system) return error.UnsupportedService;
-    var ext_buf: [1024]u8 = undefined;
-    const ext_str = flattenFilters(options.filters, &ext_buf);
-    const opts = WindowsOpenDialogOpts{
+fn windowsOpenDialogOpts(options: platform_mod.OpenDialogOptions, ext_buf: []u8) WindowsOpenDialogOpts {
+    const ext_str = flattenFilters(options.filters, ext_buf);
+    return .{
         .title = options.title.ptr,
         .title_len = options.title.len,
         .default_path = options.default_path.ptr,
@@ -1496,17 +1518,11 @@ fn showOpenDialog(context: ?*anyopaque, options: platform_mod.OpenDialogOptions,
         .allow_directories = if (options.allow_directories) 1 else 0,
         .allow_multiple = if (options.allow_multiple) 1 else 0,
     };
-    const result = native_sdk_windows_show_open_dialog(self.host, &opts, buffer.ptr, buffer.len);
-    if (result.bytes_written > buffer.len) return error.NoSpaceLeft;
-    return .{ .count = result.count, .paths = buffer[0..result.bytes_written] };
 }
 
-fn showSaveDialog(context: ?*anyopaque, options: platform_mod.SaveDialogOptions, buffer: []u8) anyerror!?[]const u8 {
-    const self: *WindowsPlatform = @ptrCast(@alignCast(context.?));
-    if (self.web_engine != .system) return error.UnsupportedService;
-    var ext_buf: [1024]u8 = undefined;
-    const ext_str = flattenFilters(options.filters, &ext_buf);
-    const opts = WindowsSaveDialogOpts{
+fn windowsSaveDialogOpts(options: platform_mod.SaveDialogOptions, ext_buf: []u8) WindowsSaveDialogOpts {
+    const ext_str = flattenFilters(options.filters, ext_buf);
+    return .{
         .title = options.title.ptr,
         .title_len = options.title.len,
         .default_path = options.default_path.ptr,
@@ -1516,16 +1532,10 @@ fn showSaveDialog(context: ?*anyopaque, options: platform_mod.SaveDialogOptions,
         .extensions = ext_str.ptr,
         .extensions_len = ext_str.len,
     };
-    const written = native_sdk_windows_show_save_dialog(self.host, &opts, buffer.ptr, buffer.len);
-    if (written > buffer.len) return error.NoSpaceLeft;
-    if (written == 0) return null;
-    return buffer[0..written];
 }
 
-fn showMessageDialog(context: ?*anyopaque, options: platform_mod.MessageDialogOptions) anyerror!platform_mod.MessageDialogResult {
-    const self: *WindowsPlatform = @ptrCast(@alignCast(context.?));
-    if (self.web_engine != .system) return error.UnsupportedService;
-    const opts = WindowsMessageDialogOpts{
+fn windowsMessageDialogOpts(options: platform_mod.MessageDialogOptions) WindowsMessageDialogOpts {
+    return .{
         .style = @intFromEnum(options.style),
         .title = options.title.ptr,
         .title_len = options.title.len,
@@ -1540,7 +1550,97 @@ fn showMessageDialog(context: ?*anyopaque, options: platform_mod.MessageDialogOp
         .tertiary_button = options.tertiary_button.ptr,
         .tertiary_button_len = options.tertiary_button.len,
     };
-    return @enumFromInt(native_sdk_windows_show_message_dialog(self.host, &opts));
+}
+
+fn showOpenDialog(context: ?*anyopaque, options: platform_mod.OpenDialogOptions, buffer: []u8) anyerror!platform_mod.OpenDialogResult {
+    const self: *WindowsPlatform = @ptrCast(@alignCast(context.?));
+    if (self.web_engine != .system) return error.UnsupportedService;
+    var ext_buf: [1024]u8 = undefined;
+    const opts = windowsOpenDialogOpts(options, &ext_buf);
+    const result = native_sdk_windows_show_open_dialog(self.host, &opts, buffer.ptr, buffer.len);
+    if (result.bytes_written > buffer.len) return error.NoSpaceLeft;
+    return .{ .count = result.count, .paths = buffer[0..result.bytes_written] };
+}
+
+fn showSaveDialog(context: ?*anyopaque, options: platform_mod.SaveDialogOptions, buffer: []u8) anyerror!?[]const u8 {
+    const self: *WindowsPlatform = @ptrCast(@alignCast(context.?));
+    if (self.web_engine != .system) return error.UnsupportedService;
+    var ext_buf: [1024]u8 = undefined;
+    const opts = windowsSaveDialogOpts(options, &ext_buf);
+    const written = native_sdk_windows_show_save_dialog(self.host, &opts, buffer.ptr, buffer.len);
+    if (written > buffer.len) return error.NoSpaceLeft;
+    if (written == 0) return null;
+    return buffer[0..written];
+}
+
+fn showMessageDialog(context: ?*anyopaque, options: platform_mod.MessageDialogOptions) anyerror!platform_mod.MessageDialogResult {
+    const self: *WindowsPlatform = @ptrCast(@alignCast(context.?));
+    if (self.web_engine != .system) return error.UnsupportedService;
+    const opts = windowsMessageDialogOpts(options);
+    // Negative: a session end left the dialog unanswered (the host
+    // cancelled it to unwind this dispatch); no button stands in for it.
+    const pressed = native_sdk_windows_show_message_dialog(self.host, &opts);
+    if (pressed < 0) return error.SessionEnding;
+    return @enumFromInt(pressed);
+}
+
+// The host copies every option before returning, so they may live on this
+// stack; the result comes back through pollDialogResult on a later wake.
+fn requestDialog(context: ?*anyopaque, request: platform_mod.DialogRequest) anyerror!void {
+    const self: *WindowsPlatform = @ptrCast(@alignCast(context.?));
+    var ext_buf: [1024]u8 = undefined;
+    var open_opts: WindowsOpenDialogOpts = undefined;
+    var save_opts: WindowsSaveDialogOpts = undefined;
+    var message_opts: WindowsMessageDialogOpts = undefined;
+    var native_request = WindowsDialogRequest{
+        .id = request.id,
+        .parent_window_id = request.parent_window_id orelse 0,
+        .kind = @intFromEnum(std.meta.activeTag(request.options)),
+        .open_opts = null,
+        .save_opts = null,
+        .message_opts = null,
+    };
+    switch (request.options) {
+        .open => |options| {
+            open_opts = windowsOpenDialogOpts(options, &ext_buf);
+            native_request.open_opts = &open_opts;
+        },
+        .save => |options| {
+            save_opts = windowsSaveDialogOpts(options, &ext_buf);
+            native_request.save_opts = &save_opts;
+        },
+        .message => |options| {
+            message_opts = windowsMessageDialogOpts(options);
+            native_request.message_opts = &message_opts;
+        },
+    }
+    if (native_sdk_windows_request_dialog(self.host, &native_request) == 0) return error.DialogUnavailable;
+}
+
+fn cancelDialog(context: ?*anyopaque, id: platform_mod.DialogRequestId) void {
+    const self: *WindowsPlatform = @ptrCast(@alignCast(context.?));
+    native_sdk_windows_cancel_dialog(self.host, id);
+}
+
+fn pollDialogResult(context: ?*anyopaque, buffer: []u8) ?platform_mod.DialogResult {
+    const self: *WindowsPlatform = @ptrCast(@alignCast(context.?));
+    var result: WindowsDialogResult = undefined;
+    if (native_sdk_windows_poll_dialog_result(self.host, buffer.ptr, buffer.len, &result) == 0) return null;
+    return .{
+        .id = result.id,
+        .outcome = switch (result.outcome) {
+            0 => .selected,
+            1 => .cancelled,
+            else => .failed,
+        },
+        .paths = buffer[0..@min(result.bytes_written, buffer.len)],
+        .count = result.count,
+        .button = switch (result.button) {
+            1 => .secondary,
+            2 => .tertiary,
+            else => .primary,
+        },
+    };
 }
 
 fn showNotification(context: ?*anyopaque, options: platform_mod.NotificationOptions) anyerror!void {
@@ -2274,7 +2374,9 @@ test "windows tray carries lifecycle commands rich rows and key equivalents into
     try std.testing.expect(std.mem.indexOf(u8, host_source, "display_label += shortcutSuffix(item.key, item.modifiers);") != null);
     try std.testing.expect(std.mem.indexOf(u8, host_source, "const std::vector<TrayItem> displayed_items = host->tray_items;") != null);
     try std.testing.expect(std.mem.indexOf(u8, host_source, "emitTrayActionForCommandId(host, displayed_items, command_id);") != null);
-    try std.testing.expect(std.mem.indexOf(u8, host_source, "return emitTrayActionForCommandId(host, host->tray_items, item.command_id);") != null);
+    try std.testing.expect(std.mem.indexOf(u8, host_source, "out->kind = kTrayAction;") != null);
+    try std.testing.expect(std.mem.indexOf(u8, host_source, "out->tray_item_id = item.id;") != null);
+    try std.testing.expect(std.mem.indexOf(u8, host_source, "event.tray_item_id = match.tray_item_id;") != null);
     try std.testing.expect(std.mem.indexOf(u8, host_source, "tray_event == NIN_SELECT || tray_event == NIN_KEYSELECT || tray_event == WM_LBUTTONUP") != null);
 }
 
@@ -2336,6 +2438,87 @@ test "windows WM_CLOSE hide consults the live tray state and downgrades to a rea
     try std.testing.expect(std.mem.indexOf(u8, close_hook, "downgraded to a real close") != null);
 }
 
+test "windows session end runs the stop hook once and bypasses the close policy" {
+    // C++ this suite cannot execute, pinned textually like the WM_CLOSE
+    // hook above. A confirmed WM_ENDSESSION (logoff, system shutdown, a
+    // Restart Manager close) never goes through the close-policy hide;
+    // the query only says yes; the run loop's exit and the session end
+    // share one exactly-once delivery.
+    const host_source = @embedFile("webview2_host.cpp");
+    const query_at = std.mem.indexOf(u8, host_source, "case WM_QUERYENDSESSION:") orelse return error.TestExpectedEqual;
+    const end_at = std.mem.indexOfPos(u8, host_source, query_at, "case WM_ENDSESSION:") orelse return error.TestExpectedEqual;
+    const close_at = std.mem.indexOfPos(u8, host_source, end_at, "case WM_CLOSE:") orelse return error.TestExpectedEqual;
+    try std.testing.expect(std.mem.indexOf(u8, host_source[query_at..end_at], "return TRUE;") != null);
+    try std.testing.expect(std.mem.indexOf(u8, host_source[end_at..close_at], "if (host && wparam) endSession(host);") != null);
+    // While a session end unwinds a dispatch, closes are ignored before
+    // the close policy is consulted.
+    const ending_close_at = std.mem.indexOfPos(u8, host_source, close_at, "if (host && host->session_ending) return 0;") orelse return error.TestExpectedEqual;
+    const hide_at = std.mem.indexOfPos(u8, host_source, close_at, "ShowWindow(hwnd, SW_HIDE);") orelse return error.TestExpectedEqual;
+    try std.testing.expect(ending_close_at < hide_at);
+
+    // Outside a runtime dispatch the shutdown runs synchronously, then
+    // the tray icon goes and the process ends. Inside one, the runtime
+    // queues the shutdown behind it, so the host marks the session
+    // ending, hands the shutdown over, stops the loop, and cancels the
+    // dialogs holding the dispatch, without ending the process.
+    const session_at = std.mem.indexOf(u8, host_source, "static void endSession(Host *host) {") orelse return error.TestExpectedEqual;
+    const session_end = std.mem.indexOfPos(u8, host_source, session_at, "\n}\n") orelse return error.TestExpectedEqual;
+    const session_fn = host_source[session_at..session_end];
+    const order = [_][]const u8{
+        "if (host->shutdown_delivered) return;",
+        "if (host->runtime_dispatch_depth == 0) {",
+        "deliverShutdown(host);",
+        "removeNotificationIcon(host);",
+        "TerminateProcess(GetCurrentProcess(), 0);",
+        "host->session_ending = true;",
+        "deliverShutdown(host);",
+        "host->running = false;",
+        "EnumThreadWindows(GetCurrentThreadId(), closeOwnedDialog,",
+    };
+    var cursor: usize = 0;
+    for (order) |needle| cursor = (std.mem.indexOfPos(u8, session_fn, cursor, needle) orelse return error.TestExpectedEqual) + needle.len;
+    try std.testing.expectEqual(@as(usize, 1), std.mem.count(u8, session_fn, "TerminateProcess("));
+
+    const deliver_fn_at = std.mem.indexOf(u8, host_source, "static void deliverShutdown(Host *host) {") orelse return error.TestExpectedEqual;
+    const flag_at = std.mem.indexOfPos(u8, host_source, deliver_fn_at, "host->shutdown_delivered = true;") orelse return error.TestExpectedEqual;
+    const callback_at = std.mem.indexOfPos(u8, host_source, deliver_fn_at, "host->callback(host->callback_context, &shutdown);") orelse return error.TestExpectedEqual;
+    // The flag latches before the callback: a session end arriving while
+    // the stop hook runs (a modal loop inside it) must not deliver again.
+    try std.testing.expect(flag_at < callback_at);
+    try std.testing.expectEqual(@as(usize, 1), std.mem.count(u8, host_source, "kind = kShutdown;"));
+
+    // The dispatch depth sees every call into the runtime: events through
+    // the counting trampoline the run loop installs, Bridge messages
+    // through their one delivery site.
+    const run_at = std.mem.indexOf(u8, host_source, "void native_sdk_windows_run(") orelse return error.TestExpectedEqual;
+    const run_end = std.mem.indexOfPos(u8, host_source, run_at, "\n}\n") orelse return error.TestExpectedEqual;
+    const run_fn = host_source[run_at..run_end];
+    try std.testing.expect(std.mem.indexOf(u8, run_fn, "host->callback = dispatchEventToRuntime;") != null);
+    try std.testing.expect(std.mem.indexOf(u8, run_fn, "deliverShutdown(host);") != null);
+    const trampoline_at = std.mem.indexOf(u8, host_source, "static void dispatchEventToRuntime(") orelse return error.TestExpectedEqual;
+    const scope_at = std.mem.indexOfPos(u8, host_source, trampoline_at, "RuntimeDispatchScope scope(host);") orelse return error.TestExpectedEqual;
+    const forward_at = std.mem.indexOfPos(u8, host_source, trampoline_at, "host->runtime_callback(host->runtime_context, event);") orelse return error.TestExpectedEqual;
+    try std.testing.expect(scope_at < forward_at);
+    // Nothing enters the runtime after the shutdown was handed over, on
+    // every path: the stop hook's own events and a closing dialog's.
+    const gate_at = std.mem.indexOfPos(u8, host_source, trampoline_at, "if (host->shutdown_delivered && event->kind != kShutdown) return;") orelse return error.TestExpectedEqual;
+    try std.testing.expect(gate_at < forward_at);
+    try std.testing.expect(std.mem.indexOf(u8, host_source, "if (!host->bridge_callback || host->shutdown_delivered) return;") != null);
+    try std.testing.expectEqual(@as(usize, 1), std.mem.count(u8, host_source, "host->bridge_callback("));
+    const bridge_at = std.mem.indexOf(u8, host_source, "host->bridge_callback(") orelse return error.TestExpectedEqual;
+    const bridge_scope_at = std.mem.lastIndexOf(u8, host_source[0..bridge_at], "RuntimeDispatchScope scope(host);") orelse return error.TestExpectedEqual;
+    try std.testing.expect(bridge_at - bridge_scope_at < 128);
+
+    // Dialogs the unwinding cancels, through any chain of owners, report
+    // no answer rather than a button, and new ones are not shown;
+    // session_end_test.cpp drives this on a Windows host.
+    try std.testing.expect(std.mem.indexOf(u8, host_source, "for (HWND owner = GetWindow(hwnd, GW_OWNER); owner; owner = GetWindow(owner, GW_OWNER)) {") != null);
+    const message_at = std.mem.indexOf(u8, host_source, "int native_sdk_windows_show_message_dialog(Host *host, const WindowsMessageDialogOpts *opts) {") orelse return error.TestExpectedEqual;
+    const message_end = std.mem.indexOfPos(u8, host_source, message_at, "\n}\n") orelse return error.TestExpectedEqual;
+    try std.testing.expectEqual(@as(usize, 3), std.mem.count(u8, host_source[message_at..message_end], "if (host->session_ending) return -1;"));
+    try std.testing.expectEqual(@as(usize, 2), std.mem.count(u8, host_source, "|| buffer_len == 0 || host->session_ending) return"));
+}
+
 test "windows passive show never foregrounds or focuses the window" {
     const host_source = @embedFile("webview2_host.cpp");
     const show_at = std.mem.indexOf(u8, host_source, "int native_sdk_windows_show_window(") orelse return error.TestExpectedEqual;
@@ -2720,11 +2903,14 @@ test "windows window focus includes focused native child views" {
 test "windows webview focus reports the focused child label" {
     // WebView2 owns the page HWND and its input; GotFocus is the
     // controller-level edge that mirrors keyboard ownership back into
-    // the runtime's per-view register.
+    // the runtime's per-view register. The callback queues the focused
+    // view, and the loop window reports it once the callback returns.
     const host_source = @embedFile("webview2_host.cpp");
     try std.testing.expect(std.mem.indexOf(u8, host_source, "add_GotFocus(Callback<ICoreWebView2FocusChangedEventHandler>") != null);
-    try std.testing.expect(std.mem.indexOf(u8, host_source, "event.kind = kViewFocused;") != null);
-    try std.testing.expect(std.mem.indexOf(u8, host_source, "event.view_label = focused->second.label.c_str();") != null);
+    try std.testing.expect(std.mem.indexOf(u8, host_source, "event.kind = DeferredWebViewEvent::Kind::Focus;") != null);
+    try std.testing.expect(std.mem.indexOf(u8, host_source, "event.label = focused->second.label;") != null);
+    try std.testing.expect(std.mem.indexOf(u8, host_source, "focused.kind = kViewFocused;") != null);
+    try std.testing.expect(std.mem.indexOf(u8, host_source, "focused.view_label = event.label.c_str();") != null);
 }
 
 test "windows webview2 keeps its user data with the app's per-user data" {

package/src/platform/windows/session_end_test.cpp

@@ -0,0 +1,303 @@
+/* Session end against the production Windows host, across processes:
+ * the test runs itself again as the app (--child <scenario>) and plays
+ * the sender, the way logoff and Restart Manager reach a GUI process:
+ * WM_QUERYENDSESSION, then WM_ENDSESSION, sent to its top-level window.
+ * The app's only window is hidden, like one behind a tray icon.
+ *
+ *  flat    No app dispatch is running. A cancelled end (wParam FALSE)
+ *          changes nothing; a confirmed one delivers one shutdown and
+ *          ends the process inside the message.
+ *  nested  The app is inside a dispatch, in a modal dialog. The dialog
+ *          is cancelled and reports no answer instead of a button,
+ *          later dialogs are refused, no event follows the shutdown, a
+ *          follow-up WM_CLOSE (Restart Manager sends one) is ignored,
+ *          and the loop returns into the regular teardown.
+ *  quit    No session end: the app quits on its own, through the loop's
+ *          exit, which shares the exactly-once shutdown.
+ *
+ * In every scenario the stop hook raises an event of its own while it
+ * runs, and no event may reach the app after its shutdown. The app
+ * prints one line per observation and the sender checks them. A
+ * watchdog bounds every wait. */
+#include "webview2_host.cpp"
+
+#include <cstdarg>
+#include <cstring>
+
+namespace {
+
+void say(const char *format, ...) {
+    va_list args;
+    va_start(args, format);
+    vprintf(format, args);
+    va_end(args);
+    putchar('\n');
+    fflush(stdout);
+}
+
+/* ------------------------------------------------------------ the app */
+
+Host *app = nullptr;
+bool nested = false;
+bool quitting = false;
+bool shut_down = false;
+
+void appEvent(void *, const WindowsEvent *incoming) {
+    if (shut_down) {
+        say("FAIL event %d reached the app after its shutdown", static_cast<int>(incoming->kind));
+        return;
+    }
+    switch (incoming->kind) {
+        case kStart: {
+            auto window = app->windows.find(1);
+            say("ready %llu", static_cast<unsigned long long>(reinterpret_cast<uintptr_t>(window->second.hwnd)));
+            if (quitting) native_sdk_windows_stop(app);
+            if (!nested) break;
+            /* A confirmation whose primary button is the destructive
+             * one: cancelling it must not read as that button. */
+            WindowsMessageDialogOpts confirm = {};
+            confirm.title = "Session End Test";
+            confirm.title_len = strlen(confirm.title);
+            confirm.message = "Delete everything?";
+            confirm.message_len = strlen(confirm.message);
+            confirm.primary_button = "Delete";
+            confirm.primary_button_len = strlen(confirm.primary_button);
+            confirm.secondary_button = "Keep";
+            confirm.secondary_button_len = strlen(confirm.secondary_button);
+            say("dialog %d", native_sdk_windows_show_message_dialog(app, &confirm));
+            say("second dialog %d", native_sdk_windows_show_message_dialog(app, &confirm));
+            char path[MAX_PATH] = {};
+            WindowsOpenDialogOpts open = {};
+            say("open dialog %zu", native_sdk_windows_show_open_dialog(app, &open, path, sizeof(path)).count);
+            break;
+        }
+        case kShutdown:
+            shut_down = true;
+            say("shutdown");
+            /* Work in the stop hook can raise an event (here a wake the
+             * loop window takes synchronously); it must not reach the
+             * app, whose shutdown already ran. */
+            SendMessageW(app->loop_window.load(), kWakeMessage, 0, 0);
+            break;
+        default:
+            break;
+    }
+}
+
+int runApp(const char *scenario) {
+    nested = strcmp(scenario, "nested") == 0;
+    quitting = strcmp(scenario, "quit") == 0;
+    app = native_sdk_windows_create(
+        "session-end-test", 16, "Session End Test", 16,
+        "dev.native-sdk.session-end-test", sizeof("dev.native-sdk.session-end-test") - 1,
+        nullptr, 0, "main", 4, 0, 0, 320, 240,
+        0, 0, 0, 1, 0, 0, 0, 2, 0);
+    if (!app) {
+        say("FAIL create host");
+        return 1;
+    }
+    native_sdk_windows_run(app, appEvent, nullptr);
+    say("run returned");
+    native_sdk_windows_destroy(app);
+    return 0;
+}
+
+/* --------------------------------------------------------- the sender */
+
+const char *stage = "starting";
+HANDLE child_process = nullptr;
+
+void require(bool condition, const char *message) {
+    if (condition) return;
+    fprintf(stderr, "FAIL (%s): %s\n", stage, message);
+    if (child_process) TerminateProcess(child_process, 1);
+    ExitProcess(1);
+}
+
+struct Child {
+    PROCESS_INFORMATION process = {};
+    HANDLE output = nullptr;
+    std::string lines;
+};
+
+Child spawn(const char *scenario) {
+    SECURITY_ATTRIBUTES inherit = { sizeof(inherit), nullptr, TRUE };
+    HANDLE read_end = nullptr;
+    HANDLE write_end = nullptr;
+    require(CreatePipe(&read_end, &write_end, &inherit, 0) != 0, "output pipe");
+    SetHandleInformation(read_end, HANDLE_FLAG_INHERIT, 0);
+    wchar_t exe[MAX_PATH] = {};
+    GetModuleFileNameW(nullptr, exe, MAX_PATH);
+    std::wstring command = L"\"" + std::wstring(exe) + L"\" --child " + widen(scenario);
+    STARTUPINFOW startup = {};
+    startup.cb = sizeof(startup);
+    startup.dwFlags = STARTF_USESTDHANDLES;
+    startup.hStdOutput = write_end;
+    startup.hStdError = write_end;
+    Child child;
+    require(CreateProcessW(exe, command.data(), nullptr, nullptr, TRUE, CREATE_NO_WINDOW, nullptr, nullptr, &startup, &child.process) != 0, "start the app");
+    CloseHandle(write_end);
+    child.output = read_end;
+    child_process = child.process.hProcess;
+    return child;
+}
+
+/* The app's stdout is in text mode, so lines arrive ending in CRLF. */
+void appendOutput(Child &child, const char *bytes, DWORD count) {
+    for (DWORD index = 0; index < count; ++index) {
+        if (bytes[index] != '\r') child.lines.push_back(bytes[index]);
+    }
+}
+
+/* Reads until a line starting with `prefix` arrives; returns its rest. */
+std::string waitForLine(Child &child, const char *prefix) {
+    const std::string wanted = std::string("\n") + prefix;
+    for (;;) {
+        const std::string text = "\n" + child.lines;
+        const size_t at = text.find(wanted);
+        if (at != std::string::npos) {
+            const size_t end = text.find('\n', at + 1);
+            if (end != std::string::npos) return text.substr(at + wanted.size(), end - at - wanted.size());
+        }
+        char buffer[512];
+        DWORD read = 0;
+        require(ReadFile(child.output, buffer, sizeof(buffer), &read, nullptr) && read > 0, "the app's output ended early");
+        appendOutput(child, buffer, read);
+    }
+}
+
+/* Waits for the app to exit and collects the rest of its output. */
+DWORD finish(Child &child, DWORD timeout_ms) {
+    require(WaitForSingleObject(child.process.hProcess, timeout_ms) == WAIT_OBJECT_0, "the app exited");
+    char buffer[512];
+    DWORD read = 0;
+    while (ReadFile(child.output, buffer, sizeof(buffer), &read, nullptr) && read > 0) appendOutput(child, buffer, read);
+    DWORD code = 1;
+    GetExitCodeProcess(child.process.hProcess, &code);
+    CloseHandle(child.output);
+    CloseHandle(child.process.hThread);
+    CloseHandle(child.process.hProcess);
+    child_process = nullptr;
+    return code;
+}
+
+size_t countLines(const Child &child, const char *line) {
+    const std::string text = "\n" + child.lines;
+    const std::string wanted = std::string("\n") + line + "\n";
+    size_t count = 0;
+    for (size_t at = text.find(wanted); at != std::string::npos; at = text.find(wanted, at + 1)) count += 1;
+    return count;
+}
+
+void requireLine(const Child &child, const char *line) {
+    if (countLines(child, line) == 1) return;
+    fprintf(stderr, "app output:\n%s\n", child.lines.c_str());
+    require(false, line);
+}
+
+void requireClean(const Child &child) {
+    if (child.lines.find("FAIL") == std::string::npos) return;
+    fprintf(stderr, "app output:\n%s\n", child.lines.c_str());
+    require(false, "the app reported a failure");
+}
+
+LRESULT sendToApp(HWND hwnd, UINT message, WPARAM wparam, LPARAM lparam) {
+    DWORD_PTR answer = 0;
+    SendMessageTimeoutW(hwnd, message, wparam, lparam, SMTO_ABORTIFHUNG, 10000, &answer);
+    return static_cast<LRESULT>(answer);
+}
+
+HWND appWindow(Child &child) {
+    const std::string handle = waitForLine(child, "ready ");
+    HWND hwnd = reinterpret_cast<HWND>(static_cast<uintptr_t>(std::stoull(handle)));
+    require(IsWindow(hwnd) && !IsWindowVisible(hwnd), "the app's window exists, hidden");
+    return hwnd;
+}
+
+void runFlat() {
+    stage = "flat";
+    Child child = spawn("flat");
+    HWND hwnd = appWindow(child);
+    require(sendToApp(hwnd, WM_QUERYENDSESSION, 0, ENDSESSION_LOGOFF) == TRUE, "the query is answered yes");
+    sendToApp(hwnd, WM_ENDSESSION, FALSE, ENDSESSION_LOGOFF);
+    require(WaitForSingleObject(child.process.hProcess, 300) == WAIT_TIMEOUT, "a cancelled session end leaves the app running");
+    require(sendToApp(hwnd, WM_QUERYENDSESSION, 0, ENDSESSION_LOGOFF) == TRUE, "the query is answered yes");
+    sendToApp(hwnd, WM_ENDSESSION, TRUE, ENDSESSION_LOGOFF);
+    require(finish(child, 2000) == 0, "the app ended with exit code 0");
+    requireClean(child);
+    requireLine(child, "shutdown");
+    require(countLines(child, "run returned") == 0, "the process ended inside WM_ENDSESSION, not through the loop");
+}
+
+struct DialogSearch {
+    DWORD process_id;
+    HWND found;
+};
+
+BOOL CALLBACK findDialog(HWND hwnd, LPARAM lparam) {
+    auto *search = reinterpret_cast<DialogSearch *>(lparam);
+    DWORD process_id = 0;
+    GetWindowThreadProcessId(hwnd, &process_id);
+    wchar_t class_name[16] = {};
+    GetClassNameW(hwnd, class_name, 16);
+    if (process_id != search->process_id || !IsWindowVisible(hwnd) || wcscmp(class_name, L"#32770") != 0) return TRUE;
+    search->found = hwnd;
+    return FALSE;
+}
+
+void runNested() {
+    stage = "nested";
+    Child child = spawn("nested");
+    HWND hwnd = appWindow(child);
+    DialogSearch search = { child.process.dwProcessId, nullptr };
+    for (int attempt = 0; attempt < 200 && !search.found; ++attempt) {
+        Sleep(50);
+        EnumWindows(findDialog, reinterpret_cast<LPARAM>(&search));
+    }
+    require(search.found != nullptr, "the app's dialog is open");
+    require(sendToApp(hwnd, WM_QUERYENDSESSION, 0, ENDSESSION_CLOSEAPP) == TRUE, "the query is answered yes");
+    sendToApp(hwnd, WM_ENDSESSION, TRUE, ENDSESSION_CLOSEAPP);
+    sendToApp(hwnd, WM_CLOSE, 0, 0);
+    require(finish(child, 10000) == 0, "the app exited with exit code 0");
+    requireClean(child);
+    requireLine(child, "shutdown");
+    requireLine(child, "dialog -1");
+    requireLine(child, "second dialog -1");
+    requireLine(child, "open dialog 0");
+    requireLine(child, "run returned");
+}
+
+void runQuit() {
+    stage = "quit";
+    Child child = spawn("quit");
+    appWindow(child);
+    require(finish(child, 10000) == 0, "the app exited with exit code 0");
+    requireClean(child);
+    requireLine(child, "shutdown");
+    requireLine(child, "run returned");
+}
+
+} // namespace
+
+int main(int argc, char **argv) {
+    if (argc == 3 && strcmp(argv[1], "--child") == 0) {
+        setvbuf(stdout, nullptr, _IONBF, 0);
+        return runApp(argv[2]);
+    }
+    HANDLE finished = CreateEventW(nullptr, TRUE, FALSE, nullptr);
+    require(finished != nullptr, "watchdog event");
+    std::thread watchdog([finished] {
+        if (WaitForSingleObject(finished, 60000) == WAIT_OBJECT_0) return;
+        fprintf(stderr, "FAIL: stalled in %s\n", stage);
+        if (child_process) TerminateProcess(child_process, 1);
+        TerminateProcess(GetCurrentProcess(), 1);
+    });
+    runFlat();
+    runNested();
+    runQuit();
+    SetEvent(finished);
+    watchdog.join();
+    CloseHandle(finished);
+    puts("PASS: Windows session end");
+    return 0;
+}