livedesk 0.1.607 → 0.1.608

package/electron/installer-quit-gate.mjs

@@ -0,0 +1,183 @@
+export const DEFAULT_INSTALLER_QUIT_CONFIRMATION_MS = 1_000;
+
+export const InstallerQuitDecision = Object.freeze({
+  NORMAL: 'normal-quit',
+  HOLD: 'hold-update-quit',
+  BLOCK: 'block-stale-update-quit',
+  ALLOW: 'allow-update-quit'
+});
+
+function normalizeDelay(value) {
+  const milliseconds = Number(value);
+  return Number.isFinite(milliseconds) && milliseconds >= 0
+    ? Math.round(milliseconds)
+    : DEFAULT_INSTALLER_QUIT_CONFIRMATION_MS;
+}
+
+/**
+ * electron-updater reports that it intends to quit before the Windows NSIS
+ * spawn promise has necessarily rejected. This gate holds the first quit for
+ * a short error window without importing Electron, so its race is executable
+ * in a plain Node regression test.
+ */
+export function createInstallerQuitGate({
+  requestQuit,
+  confirmationDelayMs = DEFAULT_INSTALLER_QUIT_CONFIRMATION_MS,
+  setTimer = setTimeout,
+  clearTimer = clearTimeout
+} = {}) {
+  if (typeof requestQuit !== 'function') {
+    throw new TypeError('installer-quit-gate-request-quit-required');
+  }
+
+  const confirmationDelay = normalizeDelay(confirmationDelayMs);
+  let generation = 0;
+  let attempt = null;
+
+  const clearConfirmationTimer = ownedAttempt => {
+    if (!ownedAttempt || ownedAttempt.confirmationTimer === null) return;
+    clearTimer(ownedAttempt.confirmationTimer);
+    ownedAttempt.confirmationTimer = null;
+  };
+
+  const snapshot = () => {
+    if (!attempt) {
+      return {
+        generation,
+        state: 'idle',
+        intentObserved: false,
+        failed: false,
+        firstQuitHeld: false,
+        quitReissueRequested: false,
+        staleQuitBlocked: false,
+        error: ''
+      };
+    }
+    return {
+      generation: attempt.generation,
+      state: attempt.state,
+      intentObserved: attempt.intentObserved,
+      failed: attempt.failed,
+      firstQuitHeld: attempt.firstQuitHeld,
+      quitReissueRequested: attempt.quitReissueRequested,
+      staleQuitBlocked: attempt.staleQuitBlocked,
+      error: attempt.error
+    };
+  };
+
+  const beginInstall = () => {
+    clearConfirmationTimer(attempt);
+    attempt = {
+      generation: ++generation,
+      state: 'preparing',
+      intentObserved: false,
+      failed: false,
+      firstQuitHeld: false,
+      quitReissueRequested: false,
+      staleQuitBlocked: false,
+      error: '',
+      confirmationTimer: null
+    };
+    return attempt.generation;
+  };
+
+  const noteBeforeQuitForUpdate = () => {
+    if (!attempt) return false;
+    attempt.intentObserved = true;
+    if (attempt.failed) {
+      attempt.state = 'failed-update-quit-intent';
+    } else if (!attempt.firstQuitHeld) {
+      attempt.state = 'update-quit-intent';
+    }
+    return true;
+  };
+
+  const failInstall = error => {
+    if (!attempt) return false;
+    attempt.failed = true;
+    attempt.error = String(error?.message || error || 'desktop-update-installer-launch-failed');
+    clearConfirmationTimer(attempt);
+
+    if (attempt.firstQuitHeld && !attempt.quitReissueRequested) {
+      // The updater-owned quit was already intercepted. There is no later quit
+      // to consume, so a user's subsequent normal quit must remain available.
+      attempt.intentObserved = false;
+      attempt.state = 'failed-after-held-quit';
+    } else if (attempt.intentObserved) {
+      // The updater has announced a quit, or our delayed reissue is in flight.
+      // Consume that one stale quit before returning to normal quit handling.
+      attempt.state = 'failed-update-quit-pending';
+    } else {
+      // electron-updater can dispatch its spawn error before its queued
+      // before-quit-for-update event. Retain the failed attempt for that event.
+      attempt.state = 'failed-awaiting-update-quit-intent';
+    }
+    return true;
+  };
+
+  const scheduleConfirmedQuit = ownedAttempt => {
+    if (ownedAttempt.confirmationTimer !== null) return;
+    const fire = () => {
+      ownedAttempt.confirmationTimer = null;
+      if (
+        attempt !== ownedAttempt
+        || ownedAttempt.failed
+        || !ownedAttempt.intentObserved
+        || ownedAttempt.quitReissueRequested
+      ) {
+        return;
+      }
+      ownedAttempt.quitReissueRequested = true;
+      ownedAttempt.state = 'reissuing-update-quit';
+      try {
+        requestQuit();
+      } catch (error) {
+        ownedAttempt.failed = true;
+        ownedAttempt.intentObserved = false;
+        ownedAttempt.error = String(error?.message || error);
+        ownedAttempt.state = 'quit-reissue-failed';
+      }
+    };
+    ownedAttempt.confirmationTimer = setTimer(fire, confirmationDelay);
+    ownedAttempt.confirmationTimer?.unref?.();
+  };
+
+  const handleBeforeQuit = () => {
+    const ownedAttempt = attempt;
+    if (!ownedAttempt?.intentObserved) return InstallerQuitDecision.NORMAL;
+
+    if (ownedAttempt.failed) {
+      ownedAttempt.intentObserved = false;
+      ownedAttempt.staleQuitBlocked = true;
+      ownedAttempt.state = 'failed-update-quit-blocked';
+      return InstallerQuitDecision.BLOCK;
+    }
+
+    if (ownedAttempt.quitReissueRequested) {
+      ownedAttempt.intentObserved = false;
+      ownedAttempt.state = 'update-quit-allowed';
+      return InstallerQuitDecision.ALLOW;
+    }
+
+    if (!ownedAttempt.firstQuitHeld) {
+      ownedAttempt.firstQuitHeld = true;
+      ownedAttempt.state = 'holding-update-quit';
+      scheduleConfirmedQuit(ownedAttempt);
+    }
+    return InstallerQuitDecision.HOLD;
+  };
+
+  const dispose = () => {
+    clearConfirmationTimer(attempt);
+    attempt = null;
+  };
+
+  return {
+    beginInstall,
+    noteBeforeQuitForUpdate,
+    failInstall,
+    handleBeforeQuit,
+    getState: snapshot,
+    dispose
+  };
+}

package/electron/main.mjs

@@ -1,11 +1,12 @@
-import { app, BrowserWindow, clipboard, dialog, ipcMain, Menu, nativeImage, powerMonitor, safeStorage, shell, Tray } from 'electron';
+import { app, autoUpdater as electronAutoUpdater, BrowserWindow, clipboard, dialog, ipcMain, Menu, nativeImage, powerMonitor, safeStorage, shell, Tray } from 'electron';
 import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { spawn } from 'node:child_process';
 import { createRequire } from 'node:module';
-import { createProductUpdateManager } from './update-manager.mjs';
-import { createRecurringProductUpdateOwner } from './recurring-update-owner.mjs';
+import { createProductUpdateManager } from './update-manager.mjs';
+import { createRecurringProductUpdateOwner } from './recurring-update-owner.mjs';
+import { createInstallerQuitGate, InstallerQuitDecision } from './installer-quit-gate.mjs';
 import { AUTH_REQUEST_TIMEOUT_MS, createPkceAuthorizationUrl, exchangePkceCode, fetchSupabaseUser, parsePkceCallbackUrl, refreshSupabaseSession } from './oauth-pkce.mjs';
 import { getRuntimeAuthEnvironment, resolveDesktopAuthConfig, resolveDesktopBuildFlavor } from './auth-config.mjs';
 import { createBoundedDesktopLogger } from './bounded-desktop-log.mjs';
@@ -155,10 +156,10 @@ let runtimeRestartWindowStartedAt = 0;
 let runtimeRestartTimer = null;
 let runtimeRestartPromise = null;
 let runtimeLaunchStartedAt = 0;
-let runtimeRoleTakeoverPending = process.env.LIVEDESK_ROLE_TAKEOVER === '1';
-let quitSequenceStarted = false;
-let updateInstallSequenceStarted = false;
-let productUpdates = null;
+let runtimeRoleTakeoverPending = process.env.LIVEDESK_ROLE_TAKEOVER === '1';
+let quitSequenceStarted = false;
+let updateInstallSequenceStarted = false;
+let productUpdates = null;
 let recurringProductUpdates = null;
 let pendingOAuth = null;
 let pendingProtocolUrl = '';
@@ -169,7 +170,10 @@ let lastDesktopResumeRecoveryAt = 0;
 let desktopSessionEpoch = 0;
 let lastKnownDesktopSession = null;
 let desktopClipboardOwner = null;
-const desktopAuthInvalidationGuard = createDesktopAuthInvalidationGuard();
+const desktopAuthInvalidationGuard = createDesktopAuthInvalidationGuard();
+const installerQuitGate = createInstallerQuitGate({
+  requestQuit: () => app.quit()
+});
 const FALLBACK_ICON_DATA_URL = `data:image/svg+xml;charset=utf-8,${encodeURIComponent('<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32" fill="none"><rect x="1" y="1" width="30" height="30" rx="7" fill="#111827"/><g transform="translate(5 5) scale(.785714)"><rect x="2.5" y="4" width="14" height="9" rx="1.5" stroke="#F8FAFC" stroke-width="1.7" opacity=".42"/><path d="M7 16v1.5h5" stroke="#F8FAFC" stroke-width="1.7" stroke-linecap="round" opacity=".42"/><rect x="10.5" y="2.5" width="14" height="9" rx="1.5" stroke="#F8FAFC" stroke-width="1.7" opacity=".62"/><path d="M15 14.5V16h5" stroke="#F8FAFC" stroke-width="1.7" stroke-linecap="round" opacity=".62"/><rect x="6.5" y="8.5" width="15" height="10" rx="1.7" fill="#F8FAFC" fill-opacity=".12" stroke="#F8FAFC" stroke-width="1.9"/><path d="M12 21v1.5H9.5M16 21v1.5h2.5M9.5 22.5h9" stroke="#F8FAFC" stroke-width="1.9" stroke-linecap="round"/></g></svg>')}`;
 const desktopLogger = createBoundedDesktopLogger({ logPath });
 
@@ -615,12 +619,18 @@ async function stopRuntime() {
   child.livedeskRuntimeStopDeadline = deadline;
   const operation = (async () => {
     await requestRuntimeShutdown(deadline);
-    const gracefulDeadline = Math.max(
-      Date.now(),
-      deadline - DEFAULT_RUNTIME_FORCED_CLEANUP_RESERVE_MS
-    );
-    await waitForOwnedRuntimeTreeExit(child, { deadline: gracefulDeadline });
-    await drainRuntimeTreeUntilStopped(child, deadline);
+    const gracefulDeadline = Math.max(
+      Date.now(),
+      deadline - DEFAULT_RUNTIME_FORCED_CLEANUP_RESERVE_MS
+    );
+    try {
+      await waitForOwnedRuntimeTreeExit(child, { deadline: gracefulDeadline });
+    } catch (error) {
+      // Preserve the forced-cleanup reserve. A stale ChildProcess terminal
+      // notification must not prevent the exact registered tree drain below.
+      log(`runtime graceful exit wait expired; forcing exact drain: ${error?.message || error}`);
+    }
+    await drainRuntimeTreeUntilStopped(child, deadline);
     if (runtimeChild === child) runtimeChild = null;
     return true;
   })();
@@ -669,32 +679,56 @@ function requestRuntimeRestart(source = 'manual') {
 async function prepareRuntimeForUpdateInstall() {
   if (updateInstallSequenceStarted) {
     throw new Error('desktop-update-install-already-started');
-  }
-  updateInstallSequenceStarted = true;
+  }
+  updateInstallSequenceStarted = true;
+  installerQuitGate.beginInstall();
   isQuitting = true;
   recurringProductUpdates?.stop();
   try {
     await quiesceDesktopAuthOwner('desktop-update-install');
     await stopRuntime();
   } catch (error) {
+    installerQuitGate.failInstall(error);
     updateInstallSequenceStarted = false;
     isQuitting = false;
     scheduleDesktopAuthRefresh(readEncryptedSession());
+    let recoveryError = null;
+    try {
+      const ready = await restartRuntimeProcess();
+      if (!ready) throw new Error('desktop-update-runtime-recovery-not-ready');
+    } catch (cause) {
+      recoveryError = cause;
+      log(`desktop update preparation recovery failed: ${cause?.message || cause}`);
+    }
+    if (!recoveryError) {
+      recurringProductUpdates?.start();
+    }
+    if (recoveryError) {
+      throw new Error(
+        `desktop-update-preinstall-recovery-failed:${recoveryError?.message || recoveryError}`,
+        { cause: error }
+      );
+    }
     throw error;
   }
-}
-
-async function recoverRuntimeAfterUpdateInstallError(error) {
-  log(`desktop update install launch failed after runtime drain: ${error?.message || error}`);
+}
+
+async function recoverRuntimeAfterUpdateInstallError(error) {
+  // electron-updater can report a Windows installer spawn failure just before
+  // its queued app.quit(). Seal that exact update quit before restarting.
+  installerQuitGate.failInstall(error);
+  log(`desktop update install launch failed after runtime drain: ${error?.message || error}`);
   updateInstallSequenceStarted = false;
   isQuitting = false;
   scheduleDesktopAuthRefresh(readEncryptedSession());
-  if (!runtimeChild) {
-    startRuntime();
-    const ready = await waitForRuntime();
-    if (ready) mainWindow?.loadURL(LOCAL_RUNTIME_URL);
-  }
-}
+  if (!runtimeChild) startRuntime();
+  const ready = await waitForRuntime();
+  if (!ready) {
+    throw new Error('desktop-update-runtime-recovery-not-ready', { cause: error });
+  }
+  mainWindow?.loadURL(LOCAL_RUNTIME_URL);
+  recurringProductUpdates?.start();
+}
 
 async function syncSessionToRuntime(session) {
   const normalized = normalizeSession(session);
@@ -1221,12 +1255,18 @@ function createTray() {
   updateTray('Starting');
 }
 
-app.on('open-url', (event, url) => {
+app.on('open-url', (event, url) => {
   event.preventDefault();
   if (!isLiveDeskAuthCallbackUrl(url)) return;
   if (app.isReady()) void handleProtocolUrl(url);
   else pendingProtocolUrl = url;
-});
+});
+
+electronAutoUpdater.on('before-quit-for-update', () => {
+  // On Windows this is updater intent, not proof that the asynchronous NSIS
+  // spawn succeeded. The first updater-owned quit is confirmed below.
+  installerQuitGate.noteBeforeQuitForUpdate();
+});
 
 if (!app.requestSingleInstanceLock()) {
   app.quit();
@@ -1237,19 +1277,43 @@ if (!app.requestSingleInstanceLock()) {
     showWindow();
   });
   app.whenReady().then(async () => {
-    app.setAsDefaultProtocolClient('livedesk');
-    removeLegacyStartupEntries();
-    migrateLegacyPlaintextSession();
-    productUpdates = createProductUpdateManager({
-      app,
-      onStatus: status => {
+    app.setAsDefaultProtocolClient('livedesk');
+    removeLegacyStartupEntries();
+    migrateLegacyPlaintextSession();
+    let lastProductUpdateLogSignature = '';
+    productUpdates = createProductUpdateManager({
+      app,
+      onStatus: status => {
         if (mainWindow && !mainWindow.isDestroyed() && !mainWindow.webContents.isDestroyed()) {
           mainWindow.webContents.send('updates:status', status);
         }
-        if (status.state === 'available') updateTray(`Update ${status.availableVersion} available`);
-        else if (status.state === 'downloading') updateTray(`Downloading update ${Math.round(status.progress || 0)}%`);
-        else if (status.state === 'downloaded') updateTray(`Update ${status.availableVersion} ready`);
-      },
+        if (status.state === 'available') updateTray(`Update ${status.availableVersion} available`);
+        else if (status.state === 'downloading') updateTray(`Downloading update ${Math.round(status.progress || 0)}%`);
+        else if (status.state === 'downloaded') updateTray(`Update ${status.availableVersion} ready`);
+        const progressBucket = Math.floor(Math.max(0, Number(status.progress || 0)) / 10) * 10;
+        const signature = [
+          status.state,
+          status.channel,
+          status.currentVersion,
+          status.availableVersion,
+          status.downloadedVersion,
+          progressBucket,
+          status.cleanupPending,
+          status.reopenRequired,
+          status.errorCode,
+          status.error,
+          status.lastCheckStartedAt,
+          status.lastCheckCompletedAt,
+          status.startupCheck
+        ].join('|');
+        if (signature !== lastProductUpdateLogSignature) {
+          lastProductUpdateLogSignature = signature;
+          log(
+            `desktop update state=${status.state || 'unknown'} channel=${status.channel || 'unknown'} current=${status.currentVersion || 'unknown'} available=${status.availableVersion || 'none'} downloaded=${status.downloadedVersion || 'none'} progress=${progressBucket} cleanupPending=${Boolean(status.cleanupPending)} reopenRequired=${Boolean(status.reopenRequired)} feed=${status.feedUrl || 'none'} checkStarted=${status.lastCheckStartedAt || 'none'} checkCompleted=${status.lastCheckCompletedAt || 'none'} errorCode=${status.errorCode || 'none'} error=${status.error || 'none'}`,
+            { priority: status.state === 'error' || status.state === 'installing' ? 'normal' : 'low' }
+          );
+        }
+      },
       beforeInstall: prepareRuntimeForUpdateInstall,
       onInstallError: recoverRuntimeAfterUpdateInstallError
     });
@@ -1298,10 +1362,17 @@ if (!app.requestSingleInstanceLock()) {
     pendingProtocolUrl = '';
     if (initialProtocolUrl) void handleProtocolUrl(initialProtocolUrl);
   });
-  app.on('window-all-closed', () => { /* tray-owned desktop stays alive */ });
-  app.on('before-quit', event => {
-    if (quitSequenceStarted) return;
-    event.preventDefault();
+  app.on('window-all-closed', () => { /* tray-owned desktop stays alive */ });
+  app.on('before-quit', event => {
+    if (quitSequenceStarted) return;
+    const installerQuitDecision = installerQuitGate.handleBeforeQuit();
+    if (installerQuitDecision === InstallerQuitDecision.HOLD
+      || installerQuitDecision === InstallerQuitDecision.BLOCK) {
+      event.preventDefault();
+      return;
+    }
+    if (installerQuitDecision === InstallerQuitDecision.ALLOW) return;
+    event.preventDefault();
     recurringProductUpdates?.stop();
     quitSequenceStarted = true;
     isQuitting = true;
@@ -1317,7 +1388,9 @@ if (!app.requestSingleInstanceLock()) {
       isQuitting = false;
       quitSequenceStarted = false;
       updateInstallSequenceStarted = false;
+      installerQuitGate.failInstall(error);
       scheduleDesktopAuthRefresh(readEncryptedSession());
+      recurringProductUpdates?.start();
       updateTray('Runtime cleanup blocked');
       log(`runtime cleanup blocked application quit: ${error?.message || error}`);
     });