gloomberb 0.19.2 → 0.19.3

package/src/remote/endpoint.ts

@@ -1,5 +1,6 @@
-import { readFile, rm, writeFile, mkdir } from "fs/promises";
+import { readFile, rename, rm } from "fs/promises";
 import { dirname, join } from "path";
+import { makePrivateDir, writePrivateFile } from "../utils/private-files";
 import type { RemoteAppKind, RemoteEndpoint } from "./types";
 
 const DEFAULT_ENDPOINT_FILE = "remote-control.json";
@@ -25,9 +26,21 @@ export async function removeRemoteEndpointFiles(dataDir: string, endpoint: Remot
   ]);
 }
 
+/**
+ * Readable by the user alone, an older copy replaced: it holds the token that
+ * controls the app. Written beside it and moved into place, so a client that
+ * finds the file never reads it half written.
+ */
 async function writeRemoteEndpoint(filePath: string, endpoint: RemoteEndpoint): Promise<void> {
-  await mkdir(dirname(filePath), { recursive: true });
-  await writeFile(filePath, JSON.stringify(endpoint, null, 2), { encoding: "utf-8", mode: 0o600 });
+  await makePrivateDir(dirname(filePath));
+  const temporary = `${filePath}.${process.pid}.tmp`;
+  try {
+    await writePrivateFile(temporary, JSON.stringify(endpoint, null, 2));
+    await rename(temporary, filePath);
+  } catch (error) {
+    await rm(temporary, { force: true });
+    throw error;
+  }
 }
 
 async function removeRemoteEndpointIfOwned(filePath: string, endpoint: RemoteEndpoint): Promise<void> {

package/src/renderers/browser/main.tsx

@@ -31,7 +31,7 @@ import {
   readOrCreateBrowserInstallId,
 } from "../../telemetry/crash-reports-dom";
 import { currentTelemetryConfig } from "../../telemetry/live-config";
-import { attentionCountsEnabled, installAttentionCounter } from "../../telemetry/attention-counts";
+import { installAttentionCounter } from "../../telemetry/attention-counts";
 import { installUsageCounter, recordRestoredFunctions, usageCountsEnabled } from "../../telemetry/usage-counts";
 import { installWindowUsageFlush } from "../../telemetry/usage-counts-dom";
 import type { AppConfig } from "../../types/config";
@@ -71,7 +71,7 @@ async function boot(): Promise<void> {
     getInstallId: () => readOrCreateBrowserInstallId(),
     officialPluginIds: loadOfficialPluginIds,
   });
-  installAttentionCounter(() => !browserDoNotTrack() && attentionCountsEnabled(currentTelemetryConfig(loadedConfig)));
+  installAttentionCounter({ allowed: () => !browserDoNotTrack(), launchConfig: () => loadedConfig });
   // A document reload does not unmount React. Flush both config and session
   // timers while localStorage is still available, including background tabs.
   window.addEventListener("pagehide", () => { void flushPendingPersistence(); });
@@ -114,6 +114,7 @@ async function boot(): Promise<void> {
           plugins={getBrowserPlugins(externalPlugins)}
           desktopDeepLinkBridge={deepLinkBridge}
           updatesEnabled={false}
+          setupEnabled={false}
         />
       </DomHostProviders>
     </DomErrorBoundary>,

package/src/renderers/cloudflare/http-proxy.ts

@@ -19,30 +19,12 @@ import {
   readRequestInit,
   toResponseHead,
   type HttpProxyResponseEnvelope,
-  type ProxiedRequestInit,
 } from "../../utils/http-proxy-response";
 import { isProxiedHost, PROXY_ALLOWED_HOSTS } from "../../utils/plugin-proxy-hosts";
+import { fetchCheckingRedirects, readBytesWithin, type ProxyUpstreamResult } from "../../utils/http-proxy-upstream";
 import type { ProxySessionGate } from "./proxy-session";
 
 const PROXY_METHODS = new Set(["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE"]);
-/** Set by the caller's browser or meaningful only to the hop it came from. */
-const STRIPPED_REQUEST_HEADERS = new Set([
-  "connection",
-  "content-length",
-  "host",
-  "keep-alive",
-  "proxy-authorization",
-  "te",
-  "trailer",
-  "transfer-encoding",
-  "upgrade",
-]);
-/** Dropped when a redirect leaves the origin the plugin set them for. */
-const CROSS_ORIGIN_STRIPPED_HEADERS = ["authorization", "cookie", "proxy-authorization"];
-/** Dropped when a redirect turns the request into a bodiless GET. */
-const REQUEST_BODY_HEADERS = ["content-encoding", "content-language", "content-location", "content-type"];
-const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
-const MAX_REDIRECTS = 5;
 const MAX_BODY_BYTES = 5 * 1024 * 1024;
 /** Plugin request bodies are small JSON; anything near this is not one. */
 const MAX_REQUEST_BYTES = 1024 * 1024;
@@ -88,112 +70,10 @@ export function validateProxyTarget(
   return { url };
 }
 
-function upstreamHeaders(raw: Record<string, string>): Headers {
-  const headers = new Headers();
-  for (const [name, value] of Object.entries(raw)) {
-    if (STRIPPED_REQUEST_HEADERS.has(name.toLowerCase())) continue;
-    try {
-      headers.set(name, value);
-    } catch {
-      // A header name the runtime refuses is dropped rather than failing the
-      // whole request, matching how a browser treats an unsettable header.
-    }
-  }
-  return headers;
-}
-
 function proxyError(message: string, status: number, headers: Record<string, string> = {}): Response {
   return Response.json({ error: message }, { status, headers: { "cache-control": "no-store", ...headers } });
 }
 
-/**
- * Reads a body, giving up once it passes `maxBytes`. Returns null when it was
- * too large, after cancelling the stream so the rest is never pulled.
- */
-async function readBytesWithin(body: ReadableStream<Uint8Array> | null, maxBytes: number): Promise<Uint8Array | null> {
-  if (!body) return new Uint8Array(0);
-  const reader = body.getReader();
-  const chunks: Uint8Array[] = [];
-  let size = 0;
-  for (;;) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    size += value.byteLength;
-    if (size > maxBytes) {
-      await reader.cancel().catch(() => {});
-      return null;
-    }
-    chunks.push(value);
-  }
-  const bytes = new Uint8Array(size);
-  let offset = 0;
-  for (const chunk of chunks) {
-    bytes.set(chunk, offset);
-    offset += chunk.byteLength;
-  }
-  return bytes;
-}
-
-type UpstreamResult = { response: Response } | { error: string; status: number };
-
-/**
- * Follows redirects one hop at a time instead of letting `fetch` do it, so
- * every `Location` passes the same allowlist check as the first URL. An
- * allowlisted host that redirects elsewhere (an open redirect, a moved API)
- * would otherwise carry the request to any host on the internet.
- *
- * Method and header handling mirror the Fetch spec: 303, and 301/302 after a
- * POST, become a bodiless GET; credentials the plugin set are dropped when the
- * redirect leaves the origin they were meant for.
- */
-async function fetchWithinAllowlist(
-  first: URL,
-  init: ProxiedRequestInit,
-  fetchUpstream: typeof fetch,
-  hosts: readonly string[],
-  signal: AbortSignal,
-): Promise<UpstreamResult> {
-  const headers = upstreamHeaders(init.headers);
-  const mode = init.redirect ?? "follow";
-  let url = first;
-  let method = init.method;
-  let body = init.body;
-
-  for (let followed = 0; ; followed += 1) {
-    const response = await fetchUpstream(url, { method, headers, body, redirect: "manual", signal });
-    const location = REDIRECT_STATUSES.has(response.status) ? response.headers.get("location") : null;
-    // "manual" hands the redirect back to the plugin. If it follows it, that
-    // comes back through here as a new request and is checked like one.
-    if (location === null || mode === "manual") return { response };
-
-    await response.body?.cancel().catch(() => {});
-    if (mode === "error") return { error: "The upstream response was a redirect.", status: 502 };
-    if (followed >= MAX_REDIRECTS) return { error: "The upstream redirected too many times.", status: 502 };
-
-    let next: string;
-    try {
-      next = new URL(location, url).href;
-    } catch {
-      return { error: "The upstream sent an invalid redirect.", status: 502 };
-    }
-    const target = validateProxyTarget(next, hosts);
-    if ("error" in target) return { error: `The upstream redirect was refused. ${target.error}`, status: 502 };
-
-    if (target.url.origin !== url.origin) {
-      for (const name of CROSS_ORIGIN_STRIPPED_HEADERS) headers.delete(name);
-    }
-    if (
-      (response.status === 303 && method !== "GET" && method !== "HEAD")
-      || ((response.status === 301 || response.status === 302) && method === "POST")
-    ) {
-      method = "GET";
-      body = undefined;
-      for (const name of REQUEST_BODY_HEADERS) headers.delete(name);
-    }
-    url = target.url;
-  }
-}
-
 function upstreamFailure(error: unknown): Response {
   const timedOut = error instanceof Error && error.name === "TimeoutError";
   return proxyError(timedOut ? "The upstream request timed out." : "The upstream request failed.", 504);
@@ -256,9 +136,13 @@ export async function handleHttpProxy(request: Request, options: HttpProxyOption
   }
 
   const signal = AbortSignal.timeout(Math.min(init.timeoutMs ?? DEFAULT_TIMEOUT_MS, MAX_TIMEOUT_MS));
-  let result: UpstreamResult;
+  let result: ProxyUpstreamResult;
   try {
-    result = await fetchWithinAllowlist(target.url, init, fetchUpstream, hosts, signal);
+    result = await fetchCheckingRedirects(target.url, init, {
+      fetch: fetchUpstream,
+      check: (url) => validateProxyTarget(url, hosts),
+      signal,
+    });
   } catch (error) {
     return upstreamFailure(error);
   }

package/src/renderers/dom/desktop/icons.tsx

@@ -225,6 +225,7 @@ export function WebIconButton({
   disabled = false,
   size = 12,
   stopPropagation = true,
+  text,
 }: IconButtonProps) {
   return (
     <button
@@ -261,6 +262,7 @@ export function WebIconButton({
       }}
     >
       <WebIcon name={icon} size={size} />
+      {text ? <span className="gloom-icon-button-text">{text}</span> : null}
     </button>
   );
 }

package/src/renderers/dom/host/image-surface.tsx

@@ -1,48 +1,73 @@
 /** @jsxImportSource react */
-import { useEffect, useState, type CSSProperties, type ReactNode } from "react";
+import { useState, type CSSProperties, type ReactNode } from "react";
 import type { ImageSurfaceProps } from "../../../ui/host";
 import { cleanDomProps, commonStyle } from "./style";
 
+type ImageStatus = "loading" | "loaded" | "failed";
+
 /**
  * Images that failed to load this session, such as a company with no logo:
  * a row scrolled back into view draws its fallback at once rather than an
  * empty box while it asks again.
  */
 const failedImages = new Set<string>();
-const FAILED_IMAGES_KEPT = 2_000;
+/** Images that loaded this session: a row scrolled back into view draws its picture on its first frame, not its stand-in. */
+const loadedImages = new Set<string>();
+const IMAGES_KEPT = 2_000;
+
+function remember(images: Set<string>, src: string): void {
+  if (images.size >= IMAGES_KEPT) images.delete(images.values().next().value!);
+  images.add(src);
+}
 
-function rememberFailedImage(src: string): void {
-  if (failedImages.size >= FAILED_IMAGES_KEPT) failedImages.delete(failedImages.values().next().value!);
-  failedImages.add(src);
+function initialStatus(src: string): ImageStatus {
+  if (failedImages.has(src)) return "failed";
+  return loadedImages.has(src) ? "loaded" : "loading";
 }
 
-/** An image filling its box; `children` stand in without a `src`, or once it fails to load. */
-export function WebImageSurface({ children, src, alt = "", objectFit = "contain", ...props }: ImageSurfaceProps) {
+/**
+ * An image still being fetched, kept out of the layout and the paint so the
+ * box shows its `children` until the picture can replace them whole.
+ */
+const PENDING_IMAGE_STYLE: CSSProperties = { position: "absolute", width: 0, height: 0, opacity: 0, pointerEvents: "none" };
+
+/** An image filling its box; `children` stand in without a `src`, or once it fails to load (and while it loads with `fallbackWhileLoading`). */
+export function WebImageSurface({ children, src, alt = "", objectFit = "contain", fallbackWhileLoading = false, imageBackground, ...props }: ImageSurfaceProps) {
   const imageSrc = typeof src === "string" ? src.trim() : "";
-  const [failed, setFailed] = useState(() => failedImages.has(imageSrc));
-  useEffect(() => setFailed(failedImages.has(imageSrc)), [imageSrc]);
+  // Keyed by the address it describes, so a row that takes another logo starts that one's own load.
+  const [known, setKnown] = useState<{ src: string; status: ImageStatus }>(() => ({ src: imageSrc, status: initialStatus(imageSrc) }));
+  const status = known.src === imageSrc ? known.status : initialStatus(imageSrc);
   const baseStyle = commonStyle(props);
+  const waiting = fallbackWhileLoading && status === "loading";
   return (
     <div
       {...cleanDomProps(props)}
       style={{
         ...baseStyle,
         overflow: baseStyle.overflow ?? "hidden",
+        ...(imageBackground && status === "loaded" ? { background: imageBackground } : {}),
         ...(props.style as CSSProperties | undefined),
       }}
     >
-      {imageSrc && !failed ? (
-        <img
-          key={imageSrc}
-          src={imageSrc}
-          alt={alt}
-          draggable={false}
-          onError={() => {
-            rememberFailedImage(imageSrc);
-            setFailed(true);
-          }}
-          style={{ width: "100%", height: "100%", display: "block", objectFit }}
-        />
+      {imageSrc && status !== "failed" ? (
+        <>
+          <img
+            key={imageSrc}
+            src={imageSrc}
+            alt={alt}
+            draggable={false}
+            onLoad={() => {
+              remember(loadedImages, imageSrc);
+              setKnown({ src: imageSrc, status: "loaded" });
+            }}
+            onError={() => {
+              remember(failedImages, imageSrc);
+              setKnown({ src: imageSrc, status: "failed" });
+            }}
+            style={waiting ? PENDING_IMAGE_STYLE : { width: "100%", height: "100%", display: "block", objectFit }}
+          />
+          {waiting ? children as ReactNode : null}
+        </>
       ) : children as ReactNode}
     </div>
   );

package/src/renderers/dom/styles.css

@@ -1441,6 +1441,10 @@ html[data-gloom-screenshot="true"] [data-gloom-role="chart-watermark"] {
   box-shadow: inset -1px 0 0 var(--sg-hairline);
 }
 [data-gloom-role="stat-grid-cell"][data-wide="true"] { grid-column: 1 / -1; box-shadow: none; }
+/* A whole-row cell too narrow for its value and detail on one line: the label
+   stays on the first line, the value and the detail run down beside it. */
+[data-gloom-role="stat-grid-cell"][data-wrapped="true"] { align-items: flex-start; }
+[data-gloom-role="stat-grid-cell"][data-wrapped="true"] [data-gloom-role="stat-grid-detail"] { flex: none; }
 /* Column grid text whose track can be narrower than it, and the grid itself: clipped
    without a scroll container where the engine has `overflow: clip`. A text box sets its
    own overflow inline, hence !important. The margin keeps the antialiased edge of a glyph
@@ -1497,6 +1501,9 @@ html[data-gloom-screenshot="true"] [data-gloom-role="chart-watermark"] {
 .gloom-icon-button:disabled, [data-gloom-role="pane-footer-icon"] { cursor: default; }
 .gloom-icon-button:not(:disabled):hover { background: var(--gloom-hover-fill); color: var(--gloom-text-bright); }
 .gloom-icon-button[aria-pressed="true"] { color: var(--gloom-warning); }
+/* A status's few characters after its icon (a delay's 15m): read without hovering, in the muted tone of the meta text around it. */
+.gloom-icon-button-text, [data-gloom-role="pane-footer-icon-text"] { margin-left: var(--gloom-space-xs); color: var(--gloom-text-muted); }
+.gloom-icon-button:not(:disabled):hover .gloom-icon-button-text { color: inherit; }
 .gloom-qb-view button:disabled { color: var(--gloom-text-muted); opacity: 0.55; cursor: default; }
 [data-gloom-role="field-grid-value"] button,
 [data-gloom-role="field-grid-value"] button > span { justify-content: flex-end !important; text-align: right; padding-inline: 0 !important; }

package/src/renderers/dom/toast-host.tsx

@@ -6,12 +6,14 @@ import {
   ToastHostProvider,
   type ToastHost,
   type ToastStore,
+  useToastsShown,
 } from "../../ui/toast";
 import { WebButton } from "./desktop/controls";
 import { WebIconButton } from "./desktop/icons";
 
 function ToastViewport({ store }: { store: ToastStore }) {
   const toasts = useSyncExternalStore(store.subscribe, store.getSnapshot, store.getSnapshot);
+  useToastsShown(toasts);
   const { dismiss } = store;
   const actionShortcut = useActionShortcut("notification-action");
   const dismissShortcut = useActionShortcut("notification-dismiss");

package/src/renderers/electrobun/bun/desktop/backend.ts

@@ -16,6 +16,7 @@ import { startRemoteControlServer, type RemoteControlServer } from "../../../../
 import type { RemoteControlRequest, RemoteControlResponse } from "../../../../remote/types";
 import { installCrashReporter } from "../../../../telemetry/crash-reports";
 import { createNodeCrashReporterHost } from "../../../../telemetry/crash-reports-node";
+import { createStallClocks } from "../../../../telemetry/stall-clocks";
 import { installStallReporter, parseStallEvent, recordStall } from "../../../../telemetry/stall-reports";
 import { createNodeStallReporterHost } from "../../../../telemetry/stall-reports-node";
 import { installUpdateFailureReporter, reviewLastUpdateAttempt } from "../../../../telemetry/update-failures";
@@ -23,7 +24,7 @@ import { createNodeUpdateFailureHost } from "../../../../telemetry/update-failur
 import type { AppConfig } from "../../../../types/config";
 import { linkDesktopCommands } from "../../../../updater/command-names";
 import { debugLog } from "../../../../utils/debug-log";
-import { setStallSink, startMainThreadStallMonitor } from "../../../../utils/main-thread-stall";
+import { setStallClocks, setStallSink, startMainThreadStallMonitor } from "../../../../utils/main-thread-stall";
 import type { DesktopSharedStateSnapshot } from "../../../../types/desktop-window";
 import type {
   ContextMenuSelectMessage,
@@ -45,6 +46,7 @@ import {
   takeExternalPluginBundles,
 } from "../external-plugins";
 import { MAIN_WINDOW_RPC_KEY } from "../window/focus";
+import { measureNativeWindowCalls } from "../window/native-timing";
 import { handleDesktopBackendRequest } from "./backend-requests";
 import { detectDesktopInstallKind, removeUpdateAsides } from "./update";
 import { removeLegacyMacApp } from "./app-name";
@@ -58,6 +60,7 @@ import { applyMacosDockIcon } from "./macos-dock-icon";
 import { handleDesktopPluginStateRequest } from "./plugin-state";
 import { scheduleDesktopRelaunch } from "./relaunch";
 import { createDesktopRpcRegistry } from "./rpc-registry";
+import { measureRpcTraffic } from "./rpc-timing";
 import { DesktopStateBroadcaster } from "./state-broadcaster";
 import { createDesktopWorkspace, type DesktopWorkspace } from "./workspace";
 import { handleDesktopWorkspaceRequest } from "./workspace/requests";
@@ -162,6 +165,8 @@ export class DesktopBackend {
       // Desktop has no Debug Log: freezes of this process and of its windows go to the stall log in the data folder.
       installStallReporter(createNodeStallReporterHost({ getDataDir: () => this.config?.dataDir ?? null }));
       setStallSink((event) => recordStall("app", event));
+      setStallClocks(createStallClocks());
+      measureNativeWindowCalls();
       startMainThreadStallMonitor();
     }
     // The native menu shows the same accelerators the keys use, so a rebind
@@ -273,6 +278,7 @@ export class DesktopBackend {
         },
       },
     });
+    measureRpcTraffic(rpc);
     this.rpcs.registerWindowRpc(key, rpc);
     return rpc;
   }

package/src/renderers/electrobun/bun/desktop/initialization.ts

@@ -1,4 +1,5 @@
-import { existsSync, mkdirSync } from "fs";
+import { existsSync } from "fs";
+import { makePrivateDirSync } from "../../../../utils/private-files";
 import { homedir, hostname } from "os";
 import { getGloomberbDirs } from "../../../../data/config/home";
 import type { AppServices } from "../../../../core/app-services";
@@ -103,7 +104,7 @@ function buildInitializationPayload(
 async function resolveDesktopDataDir(): Promise<string> {
   const dataDir = await getDataDir() ?? getGloomberbDirs().data;
   if (!existsSync(dataDir)) {
-    mkdirSync(dataDir, { recursive: true });
+    makePrivateDirSync(dataDir);
   }
   return dataDir;
 }

package/src/renderers/electrobun/bun/desktop/rpc-timing.ts

@@ -0,0 +1,88 @@
+import { measurePerf } from "../../../../utils/perf-marks";
+
+interface RpcPacket {
+  type?: unknown;
+  id?: unknown;
+  method?: unknown;
+  params?: unknown;
+}
+
+interface RpcTransport {
+  send?(packet: RpcPacket): void;
+  registerHandler?(handler: (packet: RpcPacket) => unknown): void;
+  unregisterHandler?(): void;
+}
+
+/** Answers waiting for their request's name; past this the oldest is forgotten. */
+const MAX_OPEN_REQUESTS = 500;
+
+/** A request or message name as a stall report keeps it: lower-case words, dotted. */
+function sectionPart(name: unknown): string {
+  if (typeof name !== "string") return "unknown";
+  const part = name
+    .replace(/([a-z0-9])([A-Z])/g, "$1-$2")
+    .toLowerCase()
+    .replace(/[^a-z0-9.]+/g, "-")
+    .replace(/^[-.]+|[-.]+$/g, "");
+  return part || "unknown";
+}
+
+/** What a window asked for: the backend's own method inside the one Electrobun request. */
+function requestName(packet: RpcPacket): string {
+  const params = packet.params as { method?: unknown } | null | undefined;
+  return sectionPart(packet.method === "backend.request" ? params?.method : packet.method);
+}
+
+/**
+ * Names every turn a window's channel takes on this process: the part of a
+ * request answered before its first wait (`rpc.request.<method>`), a message
+ * from the window (`rpc.message.<name>`), and the encoding, encryption and
+ * sending of an answer (`rpc.respond.<method>`) or a message to the window
+ * (`rpc.send.<name>`). A stall that follows one then says which, where the
+ * report would otherwise name whatever was last measured minutes before.
+ * Call before the channel's window is created: Electrobun hands it the
+ * transport then.
+ */
+export function measureRpcTraffic(rpc: { setTransport(transport: RpcTransport): void }): void {
+  const setTransport = rpc.setTransport;
+  const openRequests = new Map<unknown, string>();
+
+  const incoming = (packet: RpcPacket): string => {
+    if (!packet || typeof packet !== "object") return "rpc.unknown";
+    if (packet.type === "request") {
+      const name = requestName(packet);
+      openRequests.set(packet.id, name);
+      if (openRequests.size > MAX_OPEN_REQUESTS) openRequests.delete(openRequests.keys().next().value);
+      return `rpc.request.${name}`;
+    }
+    if (packet.type === "message") return `rpc.message.${sectionPart(packet.id)}`;
+    return "rpc.response";
+  };
+
+  const outgoing = (packet: RpcPacket): string => {
+    if (!packet || typeof packet !== "object") return "rpc.unknown";
+    if (packet.type === "response") {
+      const name = openRequests.get(packet.id) ?? "unknown";
+      openRequests.delete(packet.id);
+      return `rpc.respond.${name}`;
+    }
+    if (packet.type === "message") return `rpc.send.${sectionPart(packet.id)}`;
+    return `rpc.ask.${sectionPart(packet.method)}`;
+  };
+
+  rpc.setTransport = (transport) => {
+    const { send, registerHandler } = transport;
+    setTransport.call(rpc, {
+      ...transport,
+      ...(send ? { send: (packet: RpcPacket) => measurePerf(outgoing(packet), () => send.call(transport, packet)) } : {}),
+      ...(registerHandler
+        ? {
+          registerHandler: (handler: (packet: RpcPacket) => unknown) => registerHandler.call(
+            transport,
+            (packet: RpcPacket) => measurePerf(incoming(packet), () => handler(packet)),
+          ),
+        }
+        : {}),
+    });
+  };
+}

package/src/renderers/electrobun/bun/desktop/update.ts

@@ -111,10 +111,20 @@ export async function removeUpdateAsides(
 
 const TAR_BLOCK = 512;
 
+/**
+ * A macOS extended-attributes sidecar (`._name`), which an archive lists just
+ * before the file it describes.
+ */
+function isAppleDoublePath(name: string): boolean {
+  return name.split("/").some((segment) => segment.startsWith("._"));
+}
+
 /**
  * The first path in a tar, read from its leading headers: a ustar name and
- * prefix, or the long name a pax (`x`) or GNU (`L`) header gives it. Null when
- * `bytes` ends before one.
+ * prefix, or the long name a pax (`x`) or GNU (`L`) header gives it. A macOS
+ * extended-attributes sidecar (`._Gloomberb`) is skipped, so the path is the
+ * entry the archive carries, not the metadata beside it. Null when `bytes`
+ * ends before one.
  */
 export function firstTarPath(bytes: Uint8Array): string | null {
   const decoder = new TextDecoder();
@@ -136,8 +146,14 @@ export function firstTarPath(bytes: Uint8Array): string | null {
       header = data + Math.ceil(size / TAR_BLOCK) * TAR_BLOCK;
       continue;
     }
-    if (longName) return longName;
-    const name = field(header, 100);
+    const fromHeader = longName == null;
+    const name = longName ?? field(header, 100);
+    longName = null;
+    if (isAppleDoublePath(name)) {
+      header = data + Math.ceil(size / TAR_BLOCK) * TAR_BLOCK;
+      continue;
+    }
+    if (!fromHeader) return name;
     // POSIX ustar ("ustar\0") only: GNU tar keeps other fields where the prefix would be.
     const prefix = field(header + 257, 6) === "ustar" ? field(header + 345, 155) : "";
     return prefix ? `${prefix}/${name}` : name;

package/src/renderers/electrobun/bun/desktop/view-ids.ts

@@ -1,5 +1,6 @@
-import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "fs";
+import { readFileSync, renameSync, rmSync } from "fs";
 import { join } from "path";
+import { makePrivateDirSync, writePrivateFileSync } from "../../../../utils/private-files";
 import type { DesktopViewIds } from "../../shared/protocol";
 
 /**
@@ -37,13 +38,16 @@ export function readDesktopViewIds(dataDir: string): DesktopViewIds {
   }
 }
 
-/** Replaces the copy with what the view sent, written whole or not at all. Throws when it cannot, so the view tries again. */
+/**
+ * Replaces the copy with what the view sent, written whole or not at all and
+ * readable by the user alone. Throws when it cannot, so the view tries again.
+ */
 export function saveDesktopViewIds(dataDir: string, ids: unknown): void {
   const path = viewIdsPath(dataDir);
   const temporary = `${path}.${process.pid}.tmp`;
   try {
-    mkdirSync(dataDir, { recursive: true });
-    writeFileSync(temporary, JSON.stringify(parseViewIds(ids)));
+    makePrivateDirSync(dataDir);
+    writePrivateFileSync(temporary, JSON.stringify(parseViewIds(ids)));
     renameSync(temporary, path);
   } catch (error) {
     rmSync(temporary, { force: true });

package/src/renderers/electrobun/bun/external-plugins.ts

@@ -110,9 +110,13 @@ async function bundlePluginDirectory(
     // production JSX runtime. A bundle built from a process without
     // NODE_ENV set targets jsx-dev-runtime instead and fails on first
     // render with "jsxDEV is not a function".
+    //
+    // The view has no `process`, so the bundler also gives a plugin that reads
+    // one a stand-in (see plugins/plugin-process.ts), named after the plugin.
     const outDir = pluginBundleCacheDir(getPluginCacheDir());
     const result = await bundleExternalPlugin(pluginDir, join(outDir, directory), {
       define: { "process.env.NODE_ENV": "\"production\"" },
+      pluginName: plugin.name || directory,
     });
     const code = await Bun.file(result.outputPath).text();
     bundleCache.set(pluginDir, { mtimeMs, code });

package/src/renderers/electrobun/bun/window/create.ts

@@ -1,4 +1,5 @@
 import { BrowserWindow } from "electrobun/bun";
+import { measurePerf } from "../../../../utils/perf-marks";
 import { trackWindowAttention } from "./attention";
 import {
   applyNativeWindowFrame,
@@ -84,7 +85,8 @@ interface AppWindowOptions {
  * its cached frame current as it moves, and holds it to `minSize` on resize.
  */
 export function createAppWindow({ title, frame, rpc, minSize, onFrameChange, preload }: AppWindowOptions): BrowserWindow {
-  const window = new BrowserWindow({
+  // Opening a window waits on the native layer, the webview's creation included.
+  const window = measurePerf("native.window.create", () => new BrowserWindow({
     title,
     frame,
     url: APP_VIEW_URL,
@@ -95,7 +97,7 @@ export function createAppWindow({ title, frame, rpc, minSize, onFrameChange, pre
     titleBarStyle: desktopTitleBarStyle(),
     navigationRules: JSON.stringify(["views://*"]),
     sandbox: false,
-  });
+  }));
   applyWindowsWindowIcon(title);
   applyWindowsCustomChrome(title);
   if (process.platform === "win32") {