dsh-builtin-browser 0.4.1 → 0.4.5

package/src/browser-electron/ephemeral-profile.ts

@@ -0,0 +1,152 @@
+/**
+ * The ephemeral browser profile: a throwaway directory under the DSH home, used when the
+ * user has turned profile persistence off, and deleted when the browser is released.
+ *
+ * Deleting on release is not enough by itself. A process killed outright — a DSH restart
+ * that ends in SIGKILL, "End task" in a task manager, a crashed host — never runs its
+ * cleanup, so the profile it was using survives on disk: the user asked for no profile to
+ * be kept and the machine keeps one anyway, holding cookies and history. Nothing can run
+ * at SIGKILL time, so the cleanup has to happen on the NEXT run instead, which is what
+ * this module provides.
+ *
+ * Ownership is a marker file inside the directory naming the process that claimed it. A
+ * directory whose owner is gone AND which has not been written to for a while is
+ * abandoned. The age check is what keeps the sweep away from a profile an orphaned
+ * browser (a child that outlived the parent which was killed) may still be using: a live
+ * Chromium writes to its profile continuously, so a directory that has not changed in an
+ * hour is not in use.
+ */
+import { mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+/** The marker file, named once because both the claim and the sweep read it. */
+const OWNER_FILE = '.dsh-ephemeral-owner'
+
+/**
+ * How long a profile is left alone regardless of ownership. An orphaned browser keeps
+ * writing to its profile, so this is what distinguishes "abandoned" from "in use by a
+ * process this one did not start".
+ */
+const ABANDONED_AFTER_MS = 60 * 60 * 1000
+
+/** Test seams; production passes neither. */
+export interface SweepOptions {
+  /** The clock, for the age check. */
+  readonly now?: number
+  /** Liveness test for an owner pid. */
+  readonly alive?: (pid: number) => boolean
+}
+
+/**
+ * Whether a process with this pid exists.
+ *
+ * A signal of 0 performs the permission and existence checks without delivering anything.
+ * EPERM is a live process owned by someone else — alive, not gone.
+ * @param pid - the pid to test.
+ * @returns true when the process exists.
+ */
+function processAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0)
+    return true
+  } catch (error) {
+    return (error as NodeJS.ErrnoException).code === 'EPERM'
+  }
+}
+
+/**
+ * The directory name an ephemeral profile for `kind` gets, before it is claimed.
+ *
+ * The sweep matches on the same shape, so the two must agree: a name built anywhere else
+ * is a directory the sweep will never find.
+ * @param kind - the detected browser product (`chrome`, `edge`, ...).
+ * @param id - a per-run unique suffix.
+ * @returns the directory NAME, not a path.
+ */
+export function ephemeralProfileName(kind: string, id: string): string {
+  return `${kind}-profile-ephemeral-${id}`
+}
+
+/**
+ * Mark an ephemeral profile directory as this process's, so a later run can tell whether
+ * the process that created it is still there.
+ * @param dir - the profile directory (created if it does not exist yet).
+ * @param pid - the claiming process, defaulting to this one.
+ * @param now - the claim time, defaulting to the current clock.
+ * @returns true when the marker was written.
+ */
+export function claimEphemeralProfile(dir: string, pid: number = process.pid, now: number = Date.now()): boolean {
+  try {
+    mkdirSync(dir, { recursive: true })
+    writeFileSync(join(dir, OWNER_FILE), JSON.stringify({ pid, at: now }))
+    return true
+  } catch {
+    // The browser creates the directory itself when this fails, and cleanup is best
+    // effort throughout: a marker that could not be written must not stop the launch.
+    return false
+  }
+}
+
+/**
+ * The claimed owner of an ephemeral profile, when it has one.
+ * @param dir - the profile directory.
+ * @returns the owner pid, or undefined when there is no readable marker.
+ */
+function readOwner(dir: string): number | undefined {
+  try {
+    const parsed = JSON.parse(readFileSync(join(dir, OWNER_FILE), 'utf8')) as { pid?: unknown }
+    return typeof parsed.pid === 'number' ? parsed.pid : undefined
+  } catch {
+    // No marker: a run from before this existed, or one killed before it wrote one. The
+    // age check has already applied, and a directory with no claimant that old is
+    // abandoned by any reading.
+    return undefined
+  }
+}
+
+/**
+ * Delete the ephemeral profiles under `root` that belong to processes which are gone.
+ *
+ * Called before a new one is claimed, because that is the only moment that can still act
+ * on a profile whose owner was killed: nothing runs when the signal lands.
+ * @param root - the plugin's profile root (`<DSH_HOME>/dsh-builtin-browser-host`).
+ * @param kind - the browser product, which selects the directory-name prefix.
+ * @param options - test seams for the clock and the liveness test.
+ * @returns the names of the directories that were removed.
+ */
+export function sweepAbandonedEphemeralProfiles(root: string, kind: string, options: SweepOptions = {}): string[] {
+  const now = options.now ?? Date.now()
+  const alive = options.alive ?? processAlive
+  const prefix = `${kind}-profile-ephemeral-`
+  const removed: string[] = []
+  let names: string[]
+  try {
+    names = readdirSync(root)
+  } catch {
+    // No profile root yet: nothing has ever been written here, so nothing to sweep.
+    return removed
+  }
+  for (const name of names) {
+    if (!name.startsWith(prefix)) continue
+    const dir = join(root, name)
+    let ageMs: number
+    try {
+      ageMs = now - statSync(dir).mtimeMs
+    } catch {
+      continue
+    }
+    // Recent writes mean a browser is still working in there. A killed DSH can leave its
+    // Chromium child running, and that child's profile is not garbage.
+    if (ageMs < ABANDONED_AFTER_MS) continue
+    const owner = readOwner(dir)
+    if (owner !== undefined && alive(owner)) continue
+    try {
+      rmSync(dir, { recursive: true, force: true })
+      removed.push(name)
+    } catch {
+      // In use, or not ours to remove. Leaving it is the safe outcome and the next run
+      // tries again — the alternative is deleting a profile out from under a live browser.
+    }
+  }
+  return removed
+}

package/src/browser-electron/history-store.ts

@@ -13,10 +13,11 @@
  * @module dsh-browser/browser-electron/history-store
  */
 
-import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { dirname, join } from 'node:path'
 import type { VisitedPage } from '../browser/types.js'
+import { writeFileAtomic } from './settings-store.js'
 
 export type { VisitedPage }
 
@@ -51,8 +52,24 @@ export function visitedHistoryPath(): string {
  * a corrupted line must never hide the rest of the history.
  */
 export class HistoryStore {
-  private readonly maxEntries: number
-  private readonly maxAgeMs: number
+  /**
+   * File size at which the next rewrite happens.
+   *
+   * Advanced after each rewrite so the cost is paid once per PRUNE_SLACK appends
+   * rather than on every append: asking "is it over the cap?" was true from the first
+   * over-cap write onwards, which is what made every later navigation rewrite the file.
+   */
+  private pruneThreshold: number
+  /**
+   * Appends since the last rewrite.
+   *
+   * prune() runs after every navigation, and the answer is almost always "nothing to
+   * do" — but working that out from the file costs a full parse. Counting instead makes
+   * the common case a comparison.
+   */
+  private appendedSincePrune = 0
+  private maxEntries: number
+  private maxAgeMs: number
 
   /**
    * @param file - absolute path of the JSONL history file.
@@ -64,6 +81,23 @@ export class HistoryStore {
   ) {
     this.maxEntries = limits.maxEntries ?? DEFAULT_MAX_ENTRIES
     this.maxAgeMs = (limits.maxAgeDays ?? DEFAULT_MAX_AGE_DAYS) * 24 * 60 * 60 * 1000
+    // The first rewrite is due once the file has grown the slack past the cap.
+    this.pruneThreshold = this.maxEntries + this.slack()
+  }
+
+  /**
+   * Re-read the retention limits.
+   *
+   * They are settings, and settings change while the plugin runs — a panel that let the
+   * operator edit them while nothing read the new values made the control a lie. Entry count
+   * and age are the pair the interface presents, so they are updated together.
+   * @param limits - the current retention overrides.
+   */
+  updateLimits(limits: HistoryLimits): void {
+    this.maxEntries = limits.maxEntries ?? DEFAULT_MAX_ENTRIES
+    this.maxAgeMs = (limits.maxAgeDays ?? DEFAULT_MAX_AGE_DAYS) * 24 * 60 * 60 * 1000
+    // Recomputed rather than left alone: a smaller cap means the next rewrite is sooner.
+    this.pruneThreshold = Math.max(this.pruneThreshold, this.maxEntries + this.slack())
   }
 
   /** Whether the history file exists yet (diagnostics and tests). */
@@ -84,6 +118,7 @@ export class HistoryStore {
     } catch {
       // Best-effort: history is not worth failing a navigation over.
     }
+    this.appendedSincePrune++
   }
 
   /**
@@ -123,20 +158,57 @@ export class HistoryStore {
    * the count cap. Cheap no-op until the file grows past the cap, so callers can
    * run it after every append.
    */
+  /**
+   * How far past the cap the file may grow before it is rewritten.
+   *
+   * Scaled to the cap rather than fixed: a fixed 500 was meaningless when the cap is
+   * small (a caller asking for three entries would never reach 503), and the slack is
+   * there to batch rewrites, not to overrule the caller's bound.
+   * @returns the number of extra entries tolerated before a rewrite.
+   */
+  private slack(): number {
+    return Math.min(PRUNE_SLACK, Math.max(1, Math.floor(this.maxEntries / 2)))
+  }
+
   prune(): void {
+    // Cheap first: past the cap but without enough new entries to justify a rewrite.
+    // Reading the file to reach this conclusion was the remaining per-navigation cost.
+    if (this.appendedSincePrune === 0) return
     const all = this.readAll()
     const cutoff = Date.now() - this.maxAgeMs
     const fresh = all.filter(page => page.at >= cutoff)
     const kept = fresh.length > this.maxEntries ? fresh.slice(fresh.length - this.maxEntries) : fresh
-    // Only rewrite when something actually fell off, and only once the excess
-    // is worth a full rewrite.
-    if (kept.length === all.length) return
-    if (all.length - kept.length < PRUNE_SLACK && fresh.length <= this.maxEntries) return
+    // Every early exit has to retire the count it just spent, or the gate above stops gating.
+    // It counted appends so that the common "nothing to do" case is a comparison; leaving the
+    // counter set on the two paths that DO read the file meant it was never zero again, so
+    // every navigation paid the full parse this was written to avoid.
+    if (kept.length === all.length) {
+      this.appendedSincePrune = 0
+      return
+    }
+    // Only rewrite once the file has grown PRUNE_SLACK past what we last wrote. Asking
+    // "is the file over the cap?" instead was true from the first over-cap append
+    // onwards, so every single navigation after that rewrote the whole file.
+    if (all.length < this.pruneThreshold) {
+      // Deliberately NOT reset here: the count is what tracks progress toward the threshold,
+      // so clearing it would postpone the rewrite indefinitely. The read is the price of
+      // staying under the threshold, and the threshold is what bounds how often that happens.
+      return
+    }
     try {
       const body = kept.map(page => `${JSON.stringify(page)}\n`).join('')
-      writeFileSync(this.file, body)
+      // Atomic, like the settings document. A plain writeFileSync truncates first, and this is
+      // the whole history in one call: a TerminateProcess mid-write — the browser host is
+      // killed exactly that way on Windows — left a partial file, and the reader drops a
+      // half-written TAIL rather than the middle, so everything after the tear was lost.
+      writeFileAtomic(this.file, body)
+      // The file now holds only what was kept, so the next rewrite is due once
+      // PRUNE_SLACK more entries have been appended.
+      this.pruneThreshold = kept.length + this.slack()
+      this.appendedSincePrune = 0
     } catch {
-      // Best-effort: an unpruned file still reads correctly.
+      // Best-effort: an unpruned file still reads correctly, and the atomic write leaves the
+      // previous one in place when it fails.
     }
   }
 

package/src/browser-electron/host-main.ts

@@ -50,26 +50,40 @@ try {
 }
 
 /**
- * Read the spawn token. The parent sends it two ways and the child prefers
- * the first that yields a value:
+ * Read the spawn token. The parent sends it two ways:
  *   1. stdin (first line) — the secure channel on Unix/macOS;
  *   2. DSH_BROWSER_RPC_TOKEN env — the fallback on Windows, where Electron is
  *      a GUI-subsystem process and never receives piped stdin (the parent
  *      sets it in the spawn env for exactly this reason).
- * stdin wins over env so the parent's token never has to touch argv.
+ *
+ * stdin WINS over env, which is what the ordering here has to express. It used to read env
+ * first and only consult stdin when that came up empty, so the stdin branch never ran while
+ * env was set — every spawn was told both ways, so the documented preference was silently
+ * the other way round. The env value is kept as the default for the common case where stdin
+ * delivers nothing; the interface below overwrites it when a line arrives.
  */
 let RPC_TOKEN = process.env.DSH_BROWSER_RPC_TOKEN ?? ''
-const stdinDelivered = RPC_TOKEN !== ''
-if (process.stdin !== null && process.stdin.readable) {
-  const stdinLines = createInterface({ input: process.stdin, terminal: false })
+/** True once a line actually arrived on stdin (as opposed to env being present). */
+let tokenFromStdin = false
+/**
+ * The one and only stdin reader.
+ *
+ * It is created here and reused by the hello path inside `whenReady` below: two
+ * `createInterface` calls on the same stream both consume its lines, so the second one saw
+ * nothing at all. A single reader means whoever needs the token from stdin waits on it.
+ */
+const stdinLines = process.stdin !== null && process.stdin.readable
+  ? createInterface({ input: process.stdin, terminal: false })
+  : undefined
+if (stdinLines !== undefined) {
   stdinLines.on('line', (line) => {
-    if (RPC_TOKEN === '') {
-      RPC_TOKEN = line.trim()
-      stdinLines.close()
-    }
+    if (tokenFromStdin) return
+    tokenFromStdin = true
+    const token = line.trim()
+    if (token !== '') RPC_TOKEN = token
   })
   stdinLines.on('close', () => {
-    if (RPC_TOKEN === '' && !stdinDelivered) {
+    if (RPC_TOKEN === '') {
       process.stderr.write('[dsh-browser host] warning: no token received on stdin or env\n')
     }
   })
@@ -794,14 +808,23 @@ async function handle(op: string, msg: { id: number; viewId?: string; windowId?:
         try { win.window.restore() } catch { /* not minimized */ }
         win.window.focus()
         let base64 = ''
+        let renderedSize: { width: number; height: number } | undefined
         try {
           let image
           try {
-            image = await entry.webContentsView.webContents.capturePage()
+            image = await withTimeout(
+              entry.webContentsView.webContents.capturePage(),
+              COMMAND_TIMEOUT_MS,
+              'capturePage',
+            )
           } catch (error) {
             process.stderr.write(`[dsh-browser host] capturePage failed: ${String(error)}\n`)
             await new Promise(resolve => setTimeout(resolve, 400))
-            image = await entry.webContentsView.webContents.capturePage()
+            image = await withTimeout(
+              entry.webContentsView.webContents.capturePage(),
+              COMMAND_TIMEOUT_MS,
+              'capturePage',
+            )
           }
           // Downscale to fit the requested box, preserving aspect ratio.
           const size = image.getSize()
@@ -810,6 +833,9 @@ async function handle(op: string, msg: { id: number; viewId?: string; windowId?:
           if (maxW > 0 && w > maxW) { h = Math.round(h * maxW / w); w = maxW }
           if (maxH > 0 && h > maxH) { w = Math.round(w * maxH / h); h = maxH }
           if (w > 0 && h > 0 && (w !== size.width || h !== size.height)) image = image.resize({ width: w, height: h })
+          // What the caller actually receives: after the downscale, not the captured size.
+          // Recorded here because this is the last point that knows both.
+          if (w > 0 && h > 0) renderedSize = { width: w, height: h }
           const buf = wantFormat === 'jpeg' ? image.toJPEG(wantQuality) : image.toPNG()
           if (wantFormat === 'jpeg') mime = 'image/jpeg'
           if (buf.length > 0) base64 = buf.toString('base64')
@@ -831,7 +857,11 @@ async function handle(op: string, msg: { id: number; viewId?: string; windowId?:
             try { win.window.contentView.removeChildView(toolbar) } catch { /* already gone */ }
           }
           try {
-            const shot = await entry.webContentsView.webContents.debugger.sendCommand('Page.captureScreenshot', {})
+            const shot = await withTimeout(
+              entry.webContentsView.webContents.debugger.sendCommand('Page.captureScreenshot', {}),
+              COMMAND_TIMEOUT_MS,
+              'Page.captureScreenshot',
+            )
             const data = (shot as { data?: unknown }).data
             if (typeof data === 'string' && data.length > 0) base64 = data
           } finally {
@@ -850,7 +880,12 @@ async function handle(op: string, msg: { id: number; viewId?: string; windowId?:
         if (base64 === '') {
           throw new Error('capture produced no image (view not painted)')
         }
-        reply(msg.id, { ok: true, result: { base64, mime } })
+        // The measured size travels with the image. Without it the native path — which is the
+        // default self-hosted one — could never answer `browser_screenshot`'s width/height,
+        // because the seam's only channel was {base64, mime} and the provider had nothing to
+        // forward. The caller's `maxWidth`/`maxHeight` are applied here, so this is the only
+        // place that knows what came back.
+        reply(msg.id, { ok: true, result: { base64, mime, width: renderedSize?.width, height: renderedSize?.height } })
         return
       }
       case 'download': {
@@ -869,7 +904,12 @@ async function handle(op: string, msg: { id: number; viewId?: string; windowId?:
         // the parent's memory or hit the single-line cap. This also avoids
         // Electron's download pipeline entirely (CDP debugger attach can
         // interfere with will-download).
-        const result = await entry.webContentsView.webContents.debugger.sendCommand('Runtime.evaluate', {
+        // Bounded like every other op. The evaluate awaits a page-side fetch, so a slow or
+        // unresponsive server held the serial queue open forever: handle() never settled,
+        // every later op queued behind it, and the parent's plain timeout does not restart
+        // the host.
+        const result = await withTimeout(
+          entry.webContentsView.webContents.debugger.sendCommand('Runtime.evaluate', {
           // Stream the body through a reader so the size cap is enforced as
           // bytes arrive — never buffer an unbounded download into memory
           // before checking the limit (a huge URL would otherwise OOM the
@@ -910,7 +950,10 @@ async function handle(op: string, msg: { id: number; viewId?: string; windowId?:
           })()`,
           awaitPromise: true,
           returnByValue: true,
-        })
+          }) as Promise<{ result?: { value?: unknown }; exceptionDetails?: { exception?: { description?: string } } }>,
+          COMMAND_TIMEOUT_MS,
+          'download evaluate',
+        )
         const value = (result as { result?: { value?: unknown } }).result?.value
         if (typeof value !== 'string') {
           const detail = (result as { exceptionDetails?: { exception?: { description?: string } } }).exceptionDetails
@@ -939,7 +982,25 @@ async function handle(op: string, msg: { id: number; viewId?: string; windowId?:
         if (win === undefined || entry === undefined) throw new Error(`flushAuth: unknown view ${viewId}`)
         // Export the session's cookies so login state can be saved/restored
         // across browser hosts (or shared with another machine).
-        const cookies = await entry.webContentsView.webContents.session.cookies.get({})
+        //
+        // Scoped to this view's own page. The jar is SHARED on purpose: views here are built
+        // without a partition and every window drives the same browser, so signing in once
+        // works everywhere. What must not be shared is the HANDING OVER — an unfiltered read
+        // would put every domain every task has visited, plus whatever the human is signed
+        // into, in front of one task's caller. Least exposure, not isolation. An unknown page
+        // refuses rather than widening.
+        //
+        // Bounded like every other op: a renderer that stops answering here would hold the
+        // serial queue forever, and the parent's plain timeout does not restart the host.
+        const pageUrl = entry.webContentsView.webContents.getURL()
+        if (pageUrl === '' || pageUrl === 'about:blank') {
+          throw new Error('flushAuth: this view has no page loaded, so the cookie scope is unknown — reading everything would expose other sessions')
+        }
+        const cookies = await withTimeout(
+          entry.webContentsView.webContents.session.cookies.get({ url: pageUrl }),
+          COMMAND_TIMEOUT_MS,
+          'cookies.get',
+        )
         const exported = cookies.map(c => {
           // Electron types the cookie domain as optional; a missing domain
           // cannot be exported meaningfully, so default to '' (matches the
@@ -973,16 +1034,22 @@ async function handle(op: string, msg: { id: number; viewId?: string; windowId?:
         let restored = 0
         for (const c of cookies as Array<{ url?: string; name?: string; value?: string; domain?: string; path?: string; secure?: boolean; httpOnly?: boolean; expirationDate?: number }>) {
           if (typeof c.url !== 'string' || typeof c.name !== 'string' || typeof c.value !== 'string') continue
-          await entry.webContentsView.webContents.session.cookies.set({
-            url: c.url,
-            name: c.name,
-            value: c.value,
-            ...typeof c.domain === 'string' ? { domain: c.domain } : {},
-            ...typeof c.path === 'string' ? { path: c.path } : {},
-            ...typeof c.secure === 'boolean' ? { secure: c.secure } : {},
-            ...typeof c.httpOnly === 'boolean' ? { httpOnly: c.httpOnly } : {},
-            ...typeof c.expirationDate === 'number' ? { expirationDate: c.expirationDate } : {},
-          })
+          // Bounded per cookie: this runs once for every cookie, so a single hang held the
+          // serial queue open forever with no path to recovery.
+          await withTimeout(
+            entry.webContentsView.webContents.session.cookies.set({
+              url: c.url,
+              name: c.name,
+              value: c.value,
+              ...typeof c.domain === 'string' ? { domain: c.domain } : {},
+              ...typeof c.path === 'string' ? { path: c.path } : {},
+              ...typeof c.secure === 'boolean' ? { secure: c.secure } : {},
+              ...typeof c.httpOnly === 'boolean' ? { httpOnly: c.httpOnly } : {},
+              ...typeof c.expirationDate === 'number' ? { expirationDate: c.expirationDate } : {},
+            }),
+            COMMAND_TIMEOUT_MS,
+            'cookies.set',
+          )
           restored++
         }
         reply(msg.id, { ok: true, result: { restored } })
@@ -1050,16 +1117,18 @@ void app.whenReady().then(() => {
     socket.write(JSON.stringify({ id: 0, op: 'hello', token: RPC_TOKEN }) + '\n')
   }
   if (RPC_TOKEN !== '') {
+    // Either stdin already delivered a line (it wins) or env supplied the fallback.
     writeHello()
   } else {
-    // No token yet (env absent and stdin still pending): wait for stdin's
-    // first line with a bounded fallback, then send whatever we have — an
-    // empty hello is refused by the parent, which then fails cleanly.
+    // Neither yet: wait for stdin's first line with a bounded fallback, then send whatever
+    // we have — an empty hello is refused by the parent, which then fails cleanly. The
+    // reader is the module-level one, NOT a second createInterface on the same stream: two
+    // readers of one stdin both consume its lines, so the second one never saw the token.
     const fallback = setTimeout(() => writeHello(), 2_000)
-    if (process.stdin !== null && process.stdin.readable) {
-      const stdinLines = createInterface({ input: process.stdin, terminal: false })
-      stdinLines.once('line', () => { clearTimeout(fallback); writeHello() })
-      stdinLines.once('close', () => { clearTimeout(fallback); writeHello() })
+    if (stdinLines !== undefined) {
+      const send = (): void => { clearTimeout(fallback); writeHello() }
+      stdinLines.once('line', send)
+      stdinLines.once('close', send)
     }
   }
   const rl = createInterface({ input: socket })
@@ -1092,7 +1161,17 @@ void app.whenReady().then(() => {
   // without cleanup, exit so no zombie Electron window is left behind.
   socket.on('close', () => {
     process.stderr.write('[dsh-browser host] parent connection closed, exiting\n')
-    app.exit(0)
+    // A normal quit, not `app.exit(0)`. exit() skips before-quit/will-quit and does not wait
+    // for Chromium to finish writing the profile — the leveldb files holding cookies and site
+    // data. This path runs on every dispose, and a session that has just logged in is exactly
+    // when the profile holds unwritten state, so a hard exit could leave a half-written leveldb
+    // behind, which is what makes a browser profile fail to open on the next launch.
+    app.quit()
+    // Belt and braces: the parent is already gone, so there is nothing left to serve. If a
+    // listener or a window blocks the quit, forcing the exit after a grace period is still
+    // strictly better than an orphaned Electron window the user has to close by hand.
+    const force = setTimeout(() => app.exit(0), 5000)
+    force.unref()
   })
   // Keep the process alive until the parent closes the socket or kills us.
 })