agentbox-app 0.1.12 → 0.1.16

package/main/terminal-host.mjs

@@ -0,0 +1,143 @@
+// TASK TERMINALS OUTLIVE THE APP. This process holds the shells. It is started
+// detached, so quitting or restarting the app leaves them running; restarting
+// the computer ends them like everything else. The app reconnects when it starts.
+//
+// Lines of JSON over a socket only this user can reach: `{id, op, args}` in,
+// `{id, value}` or `{id, error}` back. The ops are TaskTerminals' own.
+// With no terminal and no app connected for a minute it ends itself.
+//
+//   ELECTRON_RUN_AS_NODE=1 <electron> main/terminal-host.mjs <socket>
+import fs from 'node:fs';
+import os from 'node:os';
+import net from 'node:net';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { nameSlug } from '../shared/product-name.mjs';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+// The app talks to any host speaking this, whichever version started it, so
+// the terminals an older app left are still reachable after an update. Change
+// it only with a client that still speaks the old one.
+export const PROTOCOL = 1;
+// A host started by older code keeps the terminals it has; new terminals open
+// in a host made of the code the app is running now.
+const MADE_OF = ['terminal-host.mjs', 'task-terminals.mjs', '../shared/terminal-state.mjs'];
+export const HOST_ALREADY_THERE = 3;
+const OPS = new Set(['open', 'read', 'write', 'resize', 'close', 'end', 'list']);
+
+export function terminalHostStamp() {
+  const h = crypto.createHash('sha1');
+  for (const f of MADE_OF) { try { h.update(fs.readFileSync(path.join(HERE, f))); } catch { h.update(f); } }
+  return h.digest('hex').slice(0, 12);
+}
+
+const prefix = (uid) => `${nameSlug}-terminals-${uid}-`;
+
+// Short enough for a socket's path (104 bytes on macOS), and this user's own.
+export function terminalHostSocket({ stamp = terminalHostStamp(), dir = os.tmpdir(), uid = process.getuid?.() ?? 0 } = {}) {
+  return path.join(dir, `${prefix(uid)}${stamp}.sock`);
+}
+
+/** Every host socket of this user's, newest code or not. */
+export function terminalHostSockets({ dir = os.tmpdir(), uid = process.getuid?.() ?? 0 } = {}) {
+  try {
+    return fs.readdirSync(dir).filter((f) => f.startsWith(prefix(uid)) && f.endsWith('.sock')).map((f) => path.join(dir, f));
+  } catch { return []; }
+}
+
+export function serveTerminals({ sockPath, terminals, stamp = terminalHostStamp(), idleMs = 60_000, onIdle = () => {}, log = () => {} }) {
+  let clients = 0;
+  let idleTimer = null;
+  const idle = () => {
+    clearTimeout(idleTimer);
+    if (clients || terminals.sessions.size) return;
+    idleTimer = setTimeout(() => { if (!clients && !terminals.sessions.size) onIdle(); }, idleMs);
+    idleTimer.unref?.();
+  };
+  const watch = setInterval(idle, idleMs);
+  watch.unref?.();
+  const answer = async ({ op, args = [] }) => {
+    if (op === 'hello') return { protocol: PROTOCOL, stamp, pid: process.pid };
+    if (!OPS.has(op)) throw new Error(`Unknown terminal action: ${op}`);
+    // The host cannot read the store, so it never works out a folder itself:
+    // a terminal it no longer has is one the app opens afresh.
+    if (op === 'open' && !args[1] && !terminals.sessions.has(args[0])) throw new Error('Terminal session ended. Open a new terminal to continue.');
+    return terminals[op](...args);
+  };
+  const server = net.createServer((sock) => {
+    clients += 1;
+    clearTimeout(idleTimer);
+    let buf = '';
+    const send = (msg) => { if (!sock.destroyed) sock.write(`${JSON.stringify(msg)}\n`); };
+    sock.setEncoding('utf8');
+    sock.on('data', (d) => {
+      buf += d;
+      let n;
+      while ((n = buf.indexOf('\n')) >= 0) {
+        const line = buf.slice(0, n);
+        buf = buf.slice(n + 1);
+        let msg;
+        try { msg = JSON.parse(line); } catch { continue; }
+        Promise.resolve().then(() => answer(msg))
+          .then((value) => send({ id: msg.id, value: value ?? null }), (err) => send({ id: msg.id, error: String(err?.message ?? err) }));
+      }
+    });
+    sock.on('close', () => { clients -= 1; idle(); });
+    sock.on('error', () => {});
+  });
+  server.on('error', (err) => log(`terminal host: ${err.message}`));
+  // Node deletes the path a server listened on as it closes, so it listens on
+  // a name of its own and moves it into place, and on the way out takes away
+  // only a socket that is still its own.
+  let mine = null;
+  const own = `${sockPath}.${process.pid}`;
+  const ours = () => { try { return mine !== null && fs.statSync(sockPath).ino === mine; } catch { return false; } };
+  const started = new Promise((resolve) => {
+    const probe = net.connect(sockPath);
+    const timer = setTimeout(() => { probe.destroy(); resolve('taken'); }, 2_000);
+    probe.once('connect', () => { clearTimeout(timer); probe.destroy(); resolve('taken'); });
+    probe.once('error', () => {
+      clearTimeout(timer);
+      try { fs.unlinkSync(own); } catch { /* not there */ }
+      server.listen(own, () => {
+        try { fs.chmodSync(own, 0o600); fs.renameSync(own, sockPath); mine = fs.statSync(sockPath).ino; } catch (err) { log(`terminal host: ${err.message}`); }
+        idle();
+        resolve('serving');
+      });
+    });
+  });
+  return {
+    server,
+    started,
+    close: () => started.then(() => new Promise((resolve) => {
+      clearTimeout(idleTimer);
+      clearInterval(watch);
+      if (ours()) { try { fs.unlinkSync(sockPath); } catch { /* gone */ } }
+      if (server.listening) server.close(() => resolve()); else resolve();
+    })),
+  };
+}
+
+// Started as a program by the app (main/terminal-hosts.mjs).
+if (path.basename(process.argv[1] || '') === 'terminal-host.mjs') {
+  const sockPath = process.argv[2];
+  // Loaded before the socket opens, so a host that cannot make a shell never
+  // answers and the app keeps its terminals itself.
+  (await import('node:module')).createRequire(import.meta.url)('node-pty');
+  const { TaskTerminals } = await import('./task-terminals.mjs');
+  const { readMacPressureWord } = await import('./leftovers.mjs');
+  const terminals = new TaskTerminals({ readPressure: process.platform === 'darwin' ? readMacPressureWord : null });
+  const host = serveTerminals({
+    sockPath,
+    terminals,
+    onIdle: () => host.close().then(() => process.exit(0)),
+    log: (m) => process.stderr.write(`${m}\n`),
+  });
+  if (await host.started === 'taken') process.exit(HOST_ALREADY_THERE);
+  // One shell's stray error is that shell's, not every terminal's.
+  process.on('uncaughtException', (err) => process.stderr.write(`terminal host: ${err?.stack || err}\n`));
+  process.on('unhandledRejection', (err) => process.stderr.write(`terminal host: ${err?.stack || err}\n`));
+  // The app going is not a reason to end, and nor is the terminal it ran from.
+  process.on('SIGHUP', () => {});
+}

package/main/terminal-hosts.mjs

@@ -0,0 +1,261 @@
+// THE APP'S SIDE OF ./terminal-host.mjs: the same calls as TaskTerminals, each
+// sent to whichever host holds that terminal. A new terminal opens in the host
+// made of this app's code, started when there is none; one an older app left
+// stays in the older host until it ends. If no host will start, terminals run
+// inside the app as they used to, and the terminal's first line says so.
+import fs from 'node:fs';
+import os from 'node:os';
+import net from 'node:net';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { PROTOCOL, HOST_ALREADY_THERE, terminalHostStamp, terminalHostSocket, terminalHostSockets } from './terminal-host.mjs';
+import { ENDED } from './task-terminals.mjs';
+import { SETTINGS_TERMINAL } from '../shared/settings-terminal.mjs';
+import { NAME } from '../shared/product-name.mjs';
+
+const ENDED_SESSION = 'Terminal session ended. Open a new terminal to continue.';
+// Closing a task ends its terminal this long after, so a Z that reopens it
+// keeps the terminal.
+export const CLOSE_GRACE_MS = 2 * 60_000;
+// A host that would not start is not tried again for this long.
+const RETRY_MS = 5 * 60_000;
+
+export function launchTerminalHost(sockPath, { logFile = null } = {}) {
+  const out = logFile ? fs.openSync(logFile, 'a') : 'ignore';
+  try {
+    const proc = spawn(process.execPath, [fileURLToPath(new URL('./terminal-host.mjs', import.meta.url)), sockPath], {
+      env: { ...process.env, ELECTRON_RUN_AS_NODE: '1' },
+      detached: true,
+      stdio: ['ignore', out, out],
+    });
+    proc.on('error', () => {});
+    proc.unref();
+    return proc;
+  } finally {
+    if (typeof out === 'number') fs.closeSync(out);
+  }
+}
+
+/** One socket to one host, every call with a deadline that ends it. */
+export function connectTerminalHost(sockPath, { connectMs = 2_000, callMs = 5_000 } = {}) {
+  return new Promise((resolve, reject) => {
+    const sock = net.connect(sockPath);
+    const pending = new Map();
+    let next = 1;
+    let buf = '';
+    const conn = {
+      sockPath,
+      closed: false,
+      call(op, ...args) {
+        if (conn.closed) return Promise.reject(new Error(ENDED_SESSION));
+        const id = next++;
+        return new Promise((res, rej) => {
+          const timer = setTimeout(() => { pending.delete(id); rej(new Error('The terminal did not answer.')); }, callMs);
+          pending.set(id, { res, rej, timer });
+          sock.write(`${JSON.stringify({ id, op, args })}\n`);
+        });
+      },
+      close() { sock.destroy(); },
+    };
+    const timer = setTimeout(() => { sock.destroy(); reject(new Error('The terminal host did not answer.')); }, connectMs);
+    sock.setEncoding('utf8');
+    sock.once('connect', () => { clearTimeout(timer); resolve(conn); });
+    sock.on('data', (d) => {
+      buf += d;
+      let n;
+      while ((n = buf.indexOf('\n')) >= 0) {
+        let msg = null;
+        try { msg = JSON.parse(buf.slice(0, n)); } catch { /* not ours */ }
+        buf = buf.slice(n + 1);
+        const p = msg && pending.get(msg.id);
+        if (!p) continue;
+        pending.delete(msg.id);
+        clearTimeout(p.timer);
+        if (msg.error !== undefined) p.rej(new Error(msg.error)); else p.res(msg.value);
+      }
+    });
+    sock.on('error', (err) => { clearTimeout(timer); reject(err); });
+    sock.on('close', () => {
+      conn.closed = true;
+      for (const p of pending.values()) { clearTimeout(p.timer); p.rej(new Error(ENDED_SESSION)); }
+      pending.clear();
+    });
+  });
+}
+
+/**
+ * Whether a terminal's task is closed. Only a task the store says is done: one
+ * it cannot find may be another store's, and the sign-in terminal and an
+ * outside agent's belong to no task.
+ */
+export const taskClosed = (store) => (key) => {
+  const { product, id } = JSON.parse(key);
+  if (product === SETTINGS_TERMINAL.product || String(id).startsWith('agent:')) return false;
+  return store.readItem?.(product, id)?.status === 'done';
+};
+
+/**
+ * Terminals whose task has been closed for `graceMs` on every look since. `seen`
+ * carries when each was first seen closed from one look to the next.
+ */
+export function closedTerminals(list, isClosed, seen, now, graceMs = CLOSE_GRACE_MS) {
+  const keys = new Set(list.map((s) => s.key));
+  for (const key of [...seen.keys()]) if (!keys.has(key)) seen.delete(key);
+  const due = [];
+  for (const { key } of list) {
+    let closed = false;
+    try { closed = !!isClosed(key); } catch { closed = false; }
+    if (!closed) { seen.delete(key); continue; }
+    if (!seen.has(key)) seen.set(key, now);
+    if (now - seen.get(key) >= graceMs) due.push(key);
+  }
+  return due;
+}
+
+export class TerminalHosts {
+  /**
+   * `local` is the app's own TaskTerminals, for when no host will start.
+   */
+  constructor({
+    local,
+    stamp = terminalHostStamp(),
+    dir = os.tmpdir(),
+    uid = process.getuid?.() ?? 0,
+    launch = launchTerminalHost,
+    connect = connectTerminalHost,
+    logFile = null,
+    startMs = 8_000,
+    now = () => Date.now(),
+    log = () => {},
+  }) {
+    Object.assign(this, { local, stamp, dir, uid, launch, connect, logFile, startMs, now, log });
+    this.ownPath = terminalHostSocket({ stamp, dir, uid });
+    this.conns = new Map();
+    this.where = new Map();
+    this.closedSeen = new Map();
+    this.failedAt = null;
+    this.failure = null;
+    const t = local;
+    this.inApp = { local: true, call: async (op, ...args) => t[op](...args) };
+  }
+
+  async _hello(sockPath) {
+    const had = this.conns.get(sockPath);
+    if (had && !had.closed) return had;
+    // Every open hands over this user's environment, so never to a socket
+    // somebody else put at the name.
+    try { if (process.getuid && fs.statSync(sockPath).uid !== process.getuid()) return null; } catch { return null; }
+    let conn;
+    try { conn = await this.connect(sockPath); } catch { return null; }
+    try {
+      const hi = await conn.call('hello');
+      if (hi?.protocol !== PROTOCOL) { conn.close(); return null; }
+    } catch { conn.close(); return null; }
+    this.conns.set(sockPath, conn);
+    return conn;
+  }
+
+  /** The hosts an earlier run of the app left, found once. */
+  ready() { return (this.discovered ??= this.discover().catch(() => {})); }
+
+  /** Every host this user has, and which terminal is in which. */
+  async discover() {
+    for (const sockPath of terminalHostSockets({ dir: this.dir, uid: this.uid })) await this._hello(sockPath);
+    await this.list();
+  }
+
+  /** The host made of this app's code, started if there is none. */
+  async _mine() {
+    const there = await this._hello(this.ownPath);
+    if (there) return there;
+    if (this.failedAt !== null && this.now() - this.failedAt < RETRY_MS) throw new Error(this.failure);
+    let proc;
+    try { proc = this.launch(this.ownPath, { logFile: this.logFile }); } catch (err) { return this._failed(err.message); }
+    const end = Date.now() + this.startMs;
+    while (Date.now() < end) {
+      await new Promise((r) => setTimeout(r, 100));
+      const conn = await this._hello(this.ownPath);
+      if (conn) { this.failedAt = null; this.failure = null; return conn; }
+      if (Number.isInteger(proc?.exitCode) && proc.exitCode !== HOST_ALREADY_THERE) return this._failed(`it exited with code ${proc.exitCode}`);
+    }
+    return this._failed(`no answer in ${Math.round(this.startMs / 1000)} seconds`);
+  }
+
+  _failed(why) {
+    this.failedAt = this.now();
+    this.failure = why;
+    this.log(`terminal host: ${why}`);
+    throw new Error(why);
+  }
+
+  _at(key) {
+    const at = this.where.get(key);
+    if (!at || at.closed) throw new Error(ENDED_SESSION);
+    return at;
+  }
+
+  async open(key, place) {
+    await this.ready();
+    const at = this.where.get(key);
+    if (at && !at.closed && (!at.local || this.local.sessions.has(key))) {
+      try { return await at.call('open', key); } catch { /* ended there: a new one below */ }
+    }
+    this.where.delete(key);
+    let host;
+    try { host = await this._mine(); } catch (err) {
+      const notice = `This terminal ends when ${NAME} quits, because the process that keeps terminals running through a restart would not start (${err.message}).`;
+      const state = this.local.open(key, { ...place, notice: [place?.notice, notice].filter(Boolean).join(' ') });
+      this.where.set(key, this.inApp);
+      return state;
+    }
+    const state = await host.call('open', key, place);
+    this.where.set(key, host);
+    return state;
+  }
+
+  read(key, offset, wait) { return this._at(key).call('read', key, offset, wait); }
+  write(key, data) { return this._at(key).call('write', key, data); }
+  resize(key, cols, rows) { return this._at(key).call('resize', key, cols, rows); }
+  async close(key) {
+    const at = this.where.get(key);
+    this.where.delete(key);
+    if (at && !at.closed) await at.call('close', key);
+  }
+  async end(key, why) {
+    const at = this.where.get(key);
+    if (at && !at.closed) await at.call('end', key, why);
+  }
+
+  /** Every terminal, in every host and in the app, freshly asked. */
+  async list() {
+    const out = [];
+    const answered = new Set();
+    for (const [sockPath, conn] of this.conns) {
+      if (conn.closed) { this.conns.delete(sockPath); continue; }
+      let got = [];
+      try { got = await conn.call('list'); } catch { continue; }
+      answered.add(conn);
+      // An older host with nothing left ends itself once nobody is connected.
+      if (!got.length && sockPath !== this.ownPath) { conn.close(); this.conns.delete(sockPath); continue; }
+      for (const s of got) { this.where.set(s.key, conn); out.push(s); }
+    }
+    const listed = new Set(out.map((s) => s.key));
+    for (const [key, at] of this.where) {
+      if (at.closed || (answered.has(at) && !listed.has(key)) || (at.local && !this.local.sessions.has(key))) this.where.delete(key);
+    }
+    for (const s of this.local.list()) if (this.where.get(s.key) === this.inApp) out.push(s);
+    return out;
+  }
+
+  /** Whether this task has a terminal, as far as the app last knew. */
+  hasTerminal(id) {
+    for (const key of this.where.keys()) { try { if (JSON.parse(key).id === id) return true; } catch { /* not a task's */ } }
+    return false;
+  }
+
+  async endClosed(isClosed) {
+    const due = closedTerminals(await this.list(), isClosed, this.closedSeen, this.now());
+    for (const key of due) { try { await this.end(key, ENDED.closed); } catch { /* gone already */ } }
+    return due;
+  }
+}

package/main/transcript-search.mjs

@@ -0,0 +1,80 @@
+// FINDING A CLAUDE CODE TRANSCRIPT WITHOUT HOLDING THE APP MORE THAN ONCE.
+//
+// Claude Code keeps a session at `<projects>/<slug of its folder>/<id>.jsonl`.
+// When it is not there the only way to find it is to look in every folder:
+// ten thousand on a busy Mac, 1.4 s on the window's thread. So a session found
+// nowhere is not looked for again for ten minutes, and a caller picks how to look:
+//   'now'    in this call, for an answer that decides a resume (an imported
+//            thread is filed under the folder it first ran in)
+//   'later'  in the background; this call answers null, a later one finds it
+//   'never'  only at the slug path: a cloud run's transcript comes home there
+//            and nowhere else (main/cloud/run.mjs transcriptFolderName)
+import fs from 'node:fs';
+import path from 'node:path';
+
+export const MISS_KEPT_MS = 10 * 60_000;
+
+const found = new Map();  // `${projects}\0${id}` -> transcript path
+const missed = new Map(); // `${projects}\0${id}` -> when it was last looked for and not found
+const wanted = new Map(); // projects folder -> session ids to look for
+let search = null;
+
+export const slugFor = (cwd) => String(cwd || '').replace(/[^a-zA-Z0-9]/g, '-');
+const keyOf = (projects, id) => `${projects}\0${id}`;
+
+function remember(projects, id, file) {
+  if (file) { found.set(keyOf(projects, id), file); missed.delete(keyOf(projects, id)); return; }
+  missed.set(keyOf(projects, id), Date.now());
+  while (missed.size > 1000) missed.delete(missed.keys().next().value);
+}
+
+/** The transcript's path, or null. `look` says where else to look when it is not at the slug path. */
+export function findTranscript(projects, sessionId, cwd, { look = 'later' } = {}) {
+  if (!projects || !sessionId) return null;
+  const key = keyOf(projects, sessionId);
+  const known = found.get(key);
+  if (known && fs.existsSync(known)) return known;
+  // Claude Code names the folder from the resolved path: /tmp is /private/tmp on a Mac.
+  let real = cwd;
+  try { real = cwd ? fs.realpathSync(cwd) : cwd; } catch { /* the folder is gone */ }
+  for (const at of new Set([cwd, real])) {
+    const direct = path.join(projects, slugFor(at), `${sessionId}.jsonl`);
+    if (fs.existsSync(direct)) { found.set(key, direct); return direct; }
+  }
+  if (look === 'never' || Date.now() - (missed.get(key) ?? -Infinity) < MISS_KEPT_MS) return null;
+  if (look === 'later') { lookEverywhere(projects, sessionId); return null; }
+  let file = null;
+  try {
+    for (const dir of fs.readdirSync(projects)) {
+      const p = path.join(projects, dir, `${sessionId}.jsonl`);
+      if (fs.existsSync(p)) { file = p; break; }
+    }
+  } catch { /* no projects folder */ }
+  remember(projects, sessionId, file);
+  return file;
+}
+
+function lookEverywhere(projects, sessionId) {
+  if (!wanted.has(projects)) wanted.set(projects, new Set());
+  wanted.get(projects).add(sessionId);
+  search ??= (async () => {
+    while (wanted.size) {
+      const [root, ids] = wanted.entries().next().value;
+      wanted.delete(root);
+      const left = new Set(ids);
+      let dirs = [];
+      try { dirs = await fs.promises.readdir(root); } catch { /* no projects folder */ }
+      for (const dir of dirs) {
+        if (!left.size) break;
+        for (const id of [...left]) {
+          const p = path.join(root, dir, `${id}.jsonl`);
+          try { await fs.promises.access(p); remember(root, id, p); left.delete(id); } catch { /* not here */ }
+        }
+      }
+      for (const id of left) remember(root, id, null);
+    }
+  })().finally(() => { search = null; });
+}
+
+/** The background look, when one is running; settled otherwise. */
+export const transcriptSearch = () => search ?? Promise.resolve();

package/main/updater.mjs

@@ -48,6 +48,7 @@
 
 import { createRequire } from 'node:module';
 import { Name } from '../shared/product-name.mjs';
+import { MOVE_SAY } from '../shared/where-it-runs-from.mjs';
 
 const require = createRequire(import.meta.url);
 
@@ -68,6 +69,14 @@ export function describe(state) {
   const { phase, currentVersion, newVersion, percent, error, checkedAt, readyAt, source, changes, behind } = state;
   const installing = phase === 'installing';
   return {
+    // WHETHER THIS COPY CAN UPDATE ITSELF FROM WHERE IT IS, and the one press
+    // that fixes it when it cannot (main/where-it-runs-from.mjs). It rides the
+    // updater's own state because the three surfaces that would have to ask
+    // separately — the Settings row, the sidebar card and ⌘K — all already
+    // read this one object, and a second channel for it is a second answer.
+    canMove: !!state.canMove,
+    place: state.canMove ? (state.place ?? null) : null,
+    moveError: state.moveError ?? null,
     phase,
     currentVersion,
     newVersion: newVersion ?? null,
@@ -96,7 +105,17 @@ export function describe(state) {
   };
 }
 
-export function createUpdater({ app, log = console, onChanged = () => {} }) {
+/**
+ * `autoUpdater` is a SEAM FOR THE TESTS and nothing else. The real one is
+ * required below; passing one in is how the failure paths get tested without a
+ * packaged build, a signed release and a network, which is the only reason the
+ * download bug (see the swallow in `check`) went seven reports unnoticed.
+ */
+export function createUpdater({ app, log = console, onChanged = () => {}, autoUpdater: given = null, place = null }) {
+  // READ ONCE, at construction (main/where-it-runs-from.mjs says why the
+  // bundle cannot move under a running process). A build with no place passed
+  // in — the tests, and `main/serve.mjs` — simply never offers the move.
+  const where = place?.state?.() ?? { place: null, canUpdate: true, offerMove: false };
   let state = {
     phase: 'idle',
     currentVersion: app.getVersion(),
@@ -105,6 +124,9 @@ export function createUpdater({ app, log = console, onChanged = () => {} }) {
     error: null,
     checkedAt: null,
     readyAt: null,
+    canMove: !!where.offerMove,
+    place: where.place ?? null,
+    moveError: null,
   };
   let timer = null;
   let stopped = false;
@@ -117,12 +139,14 @@ export function createUpdater({ app, log = console, onChanged = () => {} }) {
   // Loaded lazily and inside a try, so a build that somehow shipped without the
   // dependency degrades to "no updates" instead of failing to boot at all. The
   // app not starting is a strictly worse outcome than the app not updating.
-  let autoUpdater = null;
-  try {
-    ({ autoUpdater } = require('electron-updater'));
-  } catch (e) {
-    set({ phase: 'unsupported', error: 'This build has no updater in it.' });
-    log.warn?.('[updater] electron-updater is not available:', e?.message ?? e);
+  let autoUpdater = given;
+  if (!autoUpdater) {
+    try {
+      ({ autoUpdater } = require('electron-updater'));
+    } catch (e) {
+      set({ phase: 'unsupported', error: 'This build has no updater in it.' });
+      log.warn?.('[updater] electron-updater is not available:', e?.message ?? e);
+    }
   }
 
   if (autoUpdater) {
@@ -184,7 +208,23 @@ export function createUpdater({ app, log = console, onChanged = () => {} }) {
     if (state.phase === 'ready') return describe(state);
     if (state.phase === 'checking' || (state.phase === 'downloading' && !manual)) return describe(state);
     try {
-      await autoUpdater.checkForUpdates();
+      const found = await autoUpdater.checkForUpdates();
+      // THE DOWNLOAD IS A SECOND PROMISE AND NOBODY WAS HOLDING IT. With
+      // `autoDownload` on, electron-updater starts the download inside the
+      // check and hands it back here as `downloadPromise`; its own
+      // `downloadUpdate` dispatches the `error` event and then RE-THROWS. The
+      // await above resolves on the RESULT, not on the download, so a failed
+      // download had nowhere to land but `unhandledRejection` — and
+      // `main/crash-report.mjs` files one of those as a crash.
+      //
+      // That is 7 of the 14 crash reports of launch week (PostHog, 2026-10-08)
+      // and not one of them was a crash: five are Squirrel's read-only volume
+      // error from an app run out of the disk image, two are a dropped
+      // connection, and in every one of them the app carried on running. The
+      // failure is ALREADY on screen by the time we get here, because the
+      // `error` handler above set it, so there is nothing left to do with this
+      // rejection but stop it being mistaken for a crash.
+      found?.downloadPromise?.catch?.(() => {});
     } catch (e) {
       set({ phase: 'error', error: shortError(e), checkedAt: Date.now() });
     }
@@ -201,6 +241,18 @@ export function createUpdater({ app, log = console, onChanged = () => {} }) {
     return true;
   }
 
+  // THE OTHER BUTTON, for a copy that cannot update itself from where it is.
+  // Electron moves the bundle and relaunches, so a `true` here is the last
+  // thing this process does. A failure goes into the state like every other
+  // failure, so the row and the sidebar card both say it and both offer
+  // another press.
+  function move() {
+    if (!state.canMove) return { moved: false, error: null };
+    const got = place?.move?.() ?? { moved: false, error: null };
+    if (!got.moved) set({ moveError: got.error ?? null });
+    return got;
+  }
+
   function start() {
     if (stopped || timer) return;
     const tick = () => { void check(); };
@@ -215,7 +267,7 @@ export function createUpdater({ app, log = console, onChanged = () => {} }) {
     timer = null;
   }
 
-  return { start, stop, check, install, state: () => describe(state) };
+  return { start, stop, check, install, move, state: () => describe(state) };
 }
 
 // electron-updater's errors arrive as Error objects whose `message` is
@@ -234,6 +286,16 @@ export function shortError(e) {
   // releases/download/v0.1.0/latest-mac.yml): HttpErr…" to her. The sentence
   // for exactly that failure was already on the line below it.
   const named = `${e?.code ?? ''} ${raw}`;
+  // SQUIRREL'S OWN PARAGRAPH, WHICH IS 240 CHARACTERS AND HAS A URL IN IT.
+  // "Cannot update while running on a read-only volume. The application is on
+  // a read-only volume. Please move the application and try again. If you'll
+  // need to move the application out of the Downloads directory. See
+  // https://github.com/Squirrel/Squirrel.Mac …" — the whole of what 23 of the
+  // 26 main-rejection reports carried (PostHog, 2026-10-12), and the Settings
+  // row showed the first 160 characters of it. The app knows where it is
+  // running from (shared/where-it-runs-from.mjs), so this is one sentence and
+  // the row beside it is the press that fixes it.
+  if (/read-only volume/i.test(raw)) return MOVE_SAY.cannotUpdateHere;
   if (/ERR_UPDATER_ZIP_FILE_NOT_FOUND/.test(named)) return 'That release has no app in it to install.';
   if (/ERR_UPDATER_CHANNEL_FILE_NOT_FOUND/.test(named)) return 'That release is missing its update file.';
   if (/ERR_UPDATER_NO_PUBLISHED_VERSIONS|LATEST_VERSION_NOT_FOUND/.test(named)) return 'No published version to update to yet.';

package/main/webview-guard.mjs

@@ -0,0 +1,45 @@
+// What an embedded page may do, decided here rather than on the tag that
+// asked for it. The preload is the one that matters: `preload.cjs` is the
+// bridge the app's own page talks to the store through, so a page off the web
+// holding it holds everything the person holds.
+//
+// The partition is deliberately left alone. It says WHERE a page's sign-ins
+// go rather than what the page may reach, and flattening it would merge the
+// website pane's store into the default one (shared/websites.mjs).
+//
+// Pinned by tests/a-website-in-the-pane-cannot-reach-the-app.test.mjs.
+
+/**
+ * Pin one attaching webview to the floor. `webPreferences` and `params` are
+ * Electron's own objects from `will-attach-webview`, mutated in place, which
+ * is how that event is answered.
+ */
+export function hardenAttachedWebview(webPreferences, params) {
+  if (webPreferences) {
+    // Nothing of ours reaches the page.
+    delete webPreferences.preload;
+    delete webPreferences.preloadURL;
+    webPreferences.nodeIntegration = false;
+    webPreferences.nodeIntegrationInSubFrames = false;
+    webPreferences.nodeIntegrationInWorker = false;
+    webPreferences.contextIsolation = true;
+    webPreferences.sandbox = true;
+    webPreferences.webSecurity = true;
+    webPreferences.allowRunningInsecureContent = false;
+    webPreferences.experimentalFeatures = false;
+    webPreferences.enableBlinkFeatures = '';
+
+    // No embedded page starts sound before a click in it. Electron's default
+    // lets any page start media the moment it loads.
+    webPreferences.autoplayPolicy = 'document-user-activation-required';
+  }
+  if (params) {
+    // A window the guest opens for itself would be a window with none of the
+    // above. Links that want one go out to the real browser instead
+    // (setWindowOpenHandler in main/main.mjs).
+    params.allowpopups = false;
+    params.nodeintegration = false;
+    params.nodeintegrationinsubframes = false;
+  }
+  return webPreferences;
+}