fix(desktop): close review edge cases

Author: waleedlatif1

apps/desktop/src/main/browser-agent/panel.test.ts

@@ -126,6 +126,22 @@ describe('panel chat scope', () => {
     expect(view.setBounds).not.toHaveBeenCalled()
   })
 
+  it('recovers when capturePage throws before returning a promise', async () => {
+    const { win, view } = showPanel(panel)
+    const scopeId = panel.getActivePanelScopeId()
+    const image = await view.webContents.capturePage()
+    vi.mocked(view.webContents.capturePage).mockImplementationOnce(() => {
+      throw new Error('WebContents was destroyed')
+    })
+
+    await expect(panel.capturePanelSnapshot(win, scopeId)).resolves.toBeNull()
+
+    vi.mocked(view.webContents.capturePage).mockResolvedValue(image)
+    await expect(panel.capturePanelSnapshot(win, scopeId)).resolves.toMatchObject({
+      dataUrl: 'data:image/png;base64,c2lt',
+    })
+  })
+
   it('shares one native capture across concurrent requests for the same frame', async () => {
     const { win, view } = showPanel(panel)
     const scopeId = panel.getActivePanelScopeId()

apps/desktop/src/main/browser-agent/panel.ts

@@ -627,8 +627,16 @@ export async function capturePanelSnapshot(
 
   occludableFrame = null
   const generation = ++panelCaptureGeneration
-  const promise = contents
-    .capturePage(undefined, { stayHidden: false })
+  let capture: ReturnType<typeof contents.capturePage>
+  try {
+    capture = contents.capturePage(undefined, { stayHidden: false })
+  } catch (error) {
+    logger.warn('Could not capture browser panel for a toolbar menu', {
+      error: getErrorMessage(error, 'unknown'),
+    })
+    return null
+  }
+  const promise = capture
     .then((image): BrowserPanelSnapshot | null => {
       const imageSize = image.getSize()
       if (

apps/desktop/src/main/browser-agent/session.test.ts

@@ -2171,6 +2171,18 @@ describe('browser-agent session', () => {
       })
     ).toBe(false)
 
+    const staleGestureCallback = vi.fn()
+    requestHandler(contents, 'media', staleGestureCallback, {
+      isMainFrame: true,
+      mediaTypes: ['audio'],
+      requestingUrl: 'https://example.com/',
+      securityOrigin: 'https://example.com',
+    })
+    expect(staleGestureCallback).toHaveBeenCalledWith(false)
+    expect(
+      session.mediaPermissionRequestForContents(contents as unknown as WebContents)
+    ).toBeUndefined()
+
     // Chromium routes navigator.clipboard.writeText through this one; denying
     // it silently broke every copy button that does not use execCommand.
     const writeCallback = vi.fn()

apps/desktop/src/main/browser-agent/session.ts

@@ -943,6 +943,7 @@ function settleMediaPermission(tab: AgentTab, allowed: boolean): boolean {
 function revokeTabMediaPermissions(tab: AgentTab, publish = true): void {
   const hadPrompt = settleMediaPermission(tab, false)
   tab.mediaPermissionGrant = undefined
+  tab.lastRealUserGestureAt = undefined
   if (hadPrompt && publish) publishPageIssue(tab)
 }
 

apps/desktop/src/main/browser-agent/url-guard.test.ts

@@ -248,6 +248,22 @@ describe('isBlockedSubresourceUrl', () => {
     expect(mockLookup).toHaveBeenCalledTimes(24)
   })
 
+  it('bounds queued requests by the original DNS deadline', async () => {
+    vi.useFakeTimers()
+    try {
+      mockLookup.mockReturnValue(new Promise(() => {}))
+      const verdicts = Array.from({ length: 16 }, (_, index) =>
+        isBlockedSubresourceUrl(`https://slow-${index}.example/app.js`)
+      )
+      await vi.advanceTimersByTimeAsync(5_000)
+
+      await expect(Promise.all(verdicts)).resolves.toEqual(Array(16).fill(true))
+      expect(mockLookup).toHaveBeenCalledTimes(8)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
   it('treats a trailing-dot host as the same host', async () => {
     await isBlockedSubresourceUrl('https://example.com/a.js')
     await isBlockedSubresourceUrl('https://example.com./b.js')

apps/desktop/src/main/browser-agent/url-guard.ts

@@ -1,5 +1,5 @@
 import { createLogger } from '@sim/logger'
-import { resolveHostAddresses } from '@sim/security/dns'
+import { DEFAULT_DNS_TIMEOUT_MS, DnsTimeoutError, resolveHostAddresses } from '@sim/security/dns'
 import {
   isIpLiteral,
   isLoopbackIp,
@@ -157,15 +157,29 @@ const MAX_QUEUED_DNS_LOOKUPS = 64
 let activeDnsLookups = 0
 const dnsLookupWaiters: Array<() => void> = []
 
-async function acquireDnsLookupSlot(): Promise<void> {
+async function acquireDnsLookupSlot(host: string, deadline: number): Promise<void> {
   if (activeDnsLookups < MAX_CONCURRENT_DNS_LOOKUPS) {
     activeDnsLookups++
     return
   }
   if (dnsLookupWaiters.length >= MAX_QUEUED_DNS_LOOKUPS) {
     throw new Error('DNS lookup queue is full')
   }
-  await new Promise<void>((resolve) => dnsLookupWaiters.push(resolve))
+  const remainingMs = deadline - Date.now()
+  if (remainingMs <= 0) throw new DnsTimeoutError(host)
+
+  await new Promise<void>((resolve, reject) => {
+    const grant = () => {
+      clearTimeout(timer)
+      resolve()
+    }
+    const timer = setTimeout(() => {
+      const index = dnsLookupWaiters.indexOf(grant)
+      if (index >= 0) dnsLookupWaiters.splice(index, 1)
+      reject(new DnsTimeoutError(host))
+    }, remainingMs)
+    dnsLookupWaiters.push(grant)
+  })
 }
 
 function releaseDnsLookupSlot(): void {
@@ -178,9 +192,12 @@ function releaseDnsLookupSlot(): void {
 }
 
 async function resolveHostAddressesBounded(host: string) {
-  await acquireDnsLookupSlot()
+  const deadline = Date.now() + DEFAULT_DNS_TIMEOUT_MS
+  await acquireDnsLookupSlot(host, deadline)
   try {
-    return await resolveHostAddresses(host)
+    const remainingMs = deadline - Date.now()
+    if (remainingMs <= 0) throw new DnsTimeoutError(host)
+    return await resolveHostAddresses(host, { timeoutMs: remainingMs })
   } finally {
     releaseDnsLookupSlot()
   }

apps/desktop/src/main/browser-sites/directory.test.ts

@@ -304,7 +304,7 @@ describe('SiteDirectory', () => {
     expect(await store.list()).toEqual([{ hostname: 'github.com', name: 'GitHub' }])
   })
 
-  it('blocks stored site records with fields outside the persistence contract', async () => {
+  it('blocks stored site records with invalid field values', async () => {
     const payload = [{ hostname: 'github.com', visits: -1 }]
     const original = JSON.stringify({
       version: 2,

apps/desktop/src/main/desktop-chat-session-store.test.ts

@@ -121,6 +121,23 @@ describe('DesktopChatSessionStore', () => {
     expect(statSync(filePath).mode & 0o077).toBe(0)
   })
 
+  it('does not replace the durable store with an oversized encrypted envelope', () => {
+    const provider = encryption()
+    const store = open(provider)
+    store.setTerminal(ORIGIN, 'chat-existing', TERMINAL)
+    expect(store.flush()).toBe(true)
+    const existing = readFileSync(filePath, 'utf8')
+
+    vi.mocked(provider.encryptString).mockReturnValueOnce(Buffer.alloc(8 * 1024 * 1024))
+    store.setTerminal(ORIGIN, 'chat-new', TERMINAL)
+
+    expect(store.flush()).toBe(false)
+    expect(readFileSync(filePath, 'utf8')).toBe(existing)
+
+    expect(store.flush()).toBe(true)
+    expect(readFileSync(filePath, 'utf8')).not.toBe(existing)
+  })
+
   it('keeps a pending chat in memory until migration promotes it to a durable chat id', () => {
     const provider = encryption()
     const pending = open(provider)

apps/desktop/src/main/desktop-chat-session-store.ts

@@ -541,6 +541,7 @@ export class DesktopChatSessionStore {
         v: STORE_VERSION,
         ciphertext: this.encryption.encryptString(JSON.stringify(payload)).toString('base64'),
       }
+      if (Buffer.byteLength(JSON.stringify(envelope), 'utf8') > MAX_STORE_BYTES) return false
       writeJsonFileAtomicallySync(this.filePath, envelope)
       this.dirty = false
       return true

apps/desktop/src/main/index.ts

@@ -151,6 +151,7 @@ function main(): void {
   let resumingQuitAfterTeardown = false
   let tray: TrayHandle | null = null
   let updater: UpdaterHandle | null = null
+  let startupReady: Promise<void> | null = null
   const configuredPartitions = new Set<string>()
 
   const allowHttpLocalhost = () => !app.isPackaged || appOrigin().startsWith('http://')
@@ -540,6 +541,7 @@ function main(): void {
         return [stores[index].label]
       })
     },
+    canCompleteDeploymentScopedStateChange: () => getAccountDataTeardownKind() === 'deployment',
     completeDeploymentScopedStateChange: completeDeploymentScopedTeardown,
     relaunch: relaunchApp,
   })
@@ -557,7 +559,7 @@ function main(): void {
   }
 
   app.on('second-instance', () => {
-    void app.whenReady().then(() => createAndLoadAppWindow())
+    void (startupReady ?? app.whenReady()).then(() => createAndLoadAppWindow())
   })
 
   app.on('window-all-closed', () => {
@@ -606,12 +608,13 @@ function main(): void {
   })
 
   app.on('activate', () => {
-    if (app.isReady() && !getMainWindow()) {
-      void ensureMainWindow()
-    }
+    if (!app.isReady()) return
+    void (startupReady ?? app.whenReady()).then(() => {
+      if (!getMainWindow()) return ensureMainWindow()
+    })
   })
 
-  void app.whenReady().then(async () => {
+  startupReady = app.whenReady().then(async () => {
     // Packaged apps keep their native bundle icon so the Dock appearance does
     // not change when the process starts. Unpackaged runs have no branded
     // bundle, so they still need the channel-specific development icon.