lib.rs

use base64::{engine::general_purpose::STANDARD as BASE64, Engine as _};
use serde::{Deserialize, Serialize};
use serde_json::{Map as JsonMap, Value as JsonValue};
use std::{
    collections::HashMap,
    env,
    fs::{create_dir_all, File, OpenOptions},
    io::{BufRead, BufReader, Write},
    path::{Path, PathBuf},
    process::Stdio,
    sync::atomic::{AtomicBool, AtomicU64, Ordering},
    sync::mpsc,
    sync::{Arc, Mutex, OnceLock},
    time::{Duration, SystemTime, UNIX_EPOCH},
};
use tauri::{
    menu::{Menu, PredefinedMenuItem, Submenu},
    AppHandle, DragDropEvent, Emitter, Manager, RunEvent, WindowEvent,
};
#[cfg(target_os = "macos")]
use tauri::menu::AboutMetadata;
use process_wrap::std::{ChildWrapper, CommandWrap};
#[cfg(windows)]
use process_wrap::std::{CreationFlags, JobObject};
#[cfg(unix)]
use process_wrap::std::ProcessGroup;
#[cfg(windows)]
use windows::Win32::System::Threading::CREATE_NO_WINDOW;

// Native Win32 clipboard reads, so a paste never spawns a console-window-popping
// PowerShell child. macOS/Linux keep the sidecar path (no console flicker there).
#[cfg(windows)]
mod clipboard_win;

// Shared with build.rs (via `#[path]`); the PE subsystem offsets live in one place.
#[cfg(windows)]
mod pe_subsystem;

type SidecarSender = mpsc::Sender<String>;
type PendingRequests = Arc<Mutex<HashMap<String, mpsc::Sender<JsonValue>>>>;
type SharedChild = Arc<Mutex<Box<dyn ChildWrapper + Send + Sync>>>;

struct SidecarState {
    tx: SidecarSender,
    pending_requests: PendingRequests,
    next_request_id: AtomicU64,
    child: SharedChild,
}

// ── Quit interception ─────────────────────────────────────────────────────────
//
// Every quit trigger funnels through `request_quit`, which asks the webview's
// orchestrator (standalone/src/quit.ts) to tear down and call back
// `quit_proceed`. Protocol + watchdog phases: docs/specs/standalone.md §Quit flow.
#[derive(Default)]
struct QuitState {
    // The webview acknowledged quit-requested — its listener is alive.
    acked: AtomicBool,
    // Teardown has actually begun (user confirmed, or there was nothing to
    // confirm). Until this is set the webview may be parked on the confirmation
    // dialog waiting for a human, so the teardown deadline below must stay
    // suspended — a slow user must not be force-quit out from under the dialog.
    tearing_down: AtomicBool,
    // Bumped by `quit_progress` at each teardown phase boundary (teardown start,
    // install start). The phase-3 watchdog treats a bump as "still making
    // progress" and refreshes its deadline, so a long-but-live install isn't cut
    // off by a long teardown — each phase gets its own budget rather than sharing
    // one total.
    progress: AtomicU64,
    // Teardown finished (or a watchdog gave up): cleared to exit. Gates the
    // CloseRequested/ExitRequested arms so the final app.exit(0) isn't re-caught.
    approved: AtomicBool,
    // Bumped on every request_quit and on quit_cancel. A watchdog captures the
    // seq it was spawned for; if it no longer matches, a repeated trigger or a
    // cancel has superseded it and the watchdog exits without acting.
    seq: AtomicU64,
}

// Phase 1: no ack within this window ⇒ webview listener is dead — exit.
const QUIT_ACK_TIMEOUT_MS: u64 = 2_000;
// Phase 3: per-phase budget once teardown is running. Each reported phase
// (teardown, install) refreshes it, so it bounds a single stalled phase, not the
// sum of all teardown work. Comfortably exceeds the webview's own 8 s teardown
// ceiling (docs/specs/standalone.md §Quit flow).
const QUIT_PHASE_TIMEOUT_MS: u64 = 12_000;
const QUIT_POLL_STEP_MS: u64 = 500;

fn quit_approved(app: &AppHandle) -> bool {
    app.try_state::<QuitState>()
        .is_some_and(|q| q.approved.load(Ordering::SeqCst))
}

fn request_quit(app: &AppHandle) {
    let Some(quit) = app.try_state::<QuitState>() else {
        return;
    };
    quit.acked.store(false, Ordering::SeqCst);
    // Deliberately do NOT reset `tearing_down` here. A cancel happens before
    // teardown, so it's already false for a genuinely fresh quit; and once
    // teardown begins it only ever ends in `quit_proceed` (app exit), so a repeat
    // trigger fired mid-teardown must keep the flag set — otherwise the fresh
    // watchdog would drop into the unbounded phase-2 wait and stop bounding the
    // in-flight teardown.
    // fetch_add returns the prior value; our watchdog's seq is that + 1.
    let my_seq = quit.seq.fetch_add(1, Ordering::SeqCst) + 1;
    let _ = app.emit("dormouse://quit-requested", ());

    // Watchdog: a cloned handle polls QuitState so a dead or wedged webview can't
    // make quit hang. A repeated trigger bumps seq, so this (now-stale) watchdog
    // returns and the fresh request_quit spawns a replacement.
    let app = app.clone();
    std::thread::spawn(move || {
        std::thread::sleep(Duration::from_millis(QUIT_ACK_TIMEOUT_MS));
        let Some(quit) = app.try_state::<QuitState>() else {
            return;
        };
        // Superseded (seq bumped by a repeated trigger or a cancel) or already
        // exiting (approved) ⇒ this watchdog has nothing to do.
        let stale = |quit: &QuitState| {
            quit.seq.load(Ordering::SeqCst) != my_seq || quit.approved.load(Ordering::SeqCst)
        };
        if stale(&quit) {
            return;
        }
        if !quit.acked.load(Ordering::SeqCst) {
            append_log("[quit] no ack from webview; exiting");
            quit.approved.store(true, Ordering::SeqCst);
            app.exit(0);
            return;
        }
        // Phase 2: acked but teardown hasn't begun. The webview may be parked on
        // the confirmation dialog waiting for a human, so hold with no deadline —
        // only proceed (approved) or cancel (seq bump) ends the wait.
        while !quit.tearing_down.load(Ordering::SeqCst) {
            std::thread::sleep(Duration::from_millis(QUIT_POLL_STEP_MS));
            if stale(&quit) {
                return;
            }
        }
        // Phase 3: teardown running. Bound it, but a `quit_progress` bump (a phase
        // boundary: teardown start, install start) refreshes the deadline so one
        // long phase can't starve the next — each phase gets its own budget.
        let mut last_progress = quit.progress.load(Ordering::SeqCst);
        let mut elapsed = 0u64;
        loop {
            std::thread::sleep(Duration::from_millis(QUIT_POLL_STEP_MS));
            if stale(&quit) {
                return;
            }
            let progress = quit.progress.load(Ordering::SeqCst);
            if progress != last_progress {
                last_progress = progress;
                elapsed = 0;
                continue;
            }
            elapsed += QUIT_POLL_STEP_MS;
            if elapsed >= QUIT_PHASE_TIMEOUT_MS {
                append_log("[quit] teardown phase stalled; exiting");
                quit.approved.store(true, Ordering::SeqCst);
                app.exit(0);
                return;
            }
        }
    });
}

const LOG_FILE_ENV: &str = "DORMOUSE_LOG_FILE";

fn log_timestamp() -> u64 {
    SystemTime::now()
        .duration_since(UNIX_EPOCH)
        .map(|duration| duration.as_secs())
        .unwrap_or_default()
}

fn default_log_path() -> PathBuf {
    if let Some(path) = env::var_os(LOG_FILE_ENV) {
        return PathBuf::from(path);
    }

    #[cfg(target_os = "windows")]
    if let Some(local_app_data) = env::var_os("LOCALAPPDATA") {
        return PathBuf::from(local_app_data)
            .join("Dormouse Terminal")
            .join("dormouse.log");
    }

    env::temp_dir().join("dormouse.log")
}

fn log_path() -> &'static Path {
    static PATH: OnceLock<PathBuf> = OnceLock::new();
    PATH.get_or_init(default_log_path)
}

// `append_log` runs per stdout/stderr line from the sidecar; reopening
// the file each call costs a syscall + dir-walk per chatty subprocess
// log line. Cache an append handle for the life of the process.
fn log_file() -> Option<&'static Mutex<File>> {
    static FILE: OnceLock<Option<Mutex<File>>> = OnceLock::new();
    FILE.get_or_init(|| {
        let path = log_path();
        if let Some(parent) = path.parent() {
            let _ = create_dir_all(parent);
        }
        OpenOptions::new()
            .create(true)
            .append(true)
            .open(path)
            .ok()
            .map(Mutex::new)
    })
    .as_ref()
}

fn init_log() {
    let path = log_path();
    if let Some(parent) = path.parent() {
        let _ = create_dir_all(parent);
    }

    if let Ok(mut file) = OpenOptions::new()
        .create(true)
        .write(true)
        .truncate(true)
        .open(path)
    {
        let _ = writeln!(
            file,
            "[{}] Dormouse log started at {}",
            log_timestamp(),
            path.display()
        );
    }
}

fn append_log(message: impl AsRef<str>) {
    let Some(file) = log_file() else { return };
    if let Ok(mut file) = file.lock() {
        let _ = writeln!(file, "[{}] {}", log_timestamp(), message.as_ref());
    }
}

#[cfg(target_os = "macos")]
fn set_macos_dock_icon() {
    use objc2::{AllocAnyThread, MainThreadMarker};
    use objc2_app_kit::{NSApplication, NSImage};
    use objc2_foundation::NSData;

    let mtm = unsafe { MainThreadMarker::new_unchecked() };
    let app = NSApplication::sharedApplication(mtm);
    // The largest size exploded from icon.icns (1024×1024) — it carries the
    // built-in transparent padding the bundle's edge-to-edge 128x128@2x.png lacks.
    let data = NSData::with_bytes(include_bytes!("../icons/dock-icon.png"));
    let Some(app_icon) = NSImage::initWithData(NSImage::alloc(), &data) else {
        append_log("[app] failed to create macOS dock icon image");
        return;
    };

    unsafe {
        app.setApplicationIconImage(Some(&app_icon));
    }
}

fn read_log_tail(max_bytes: usize) -> Result<String, String> {
    let path = log_path();
    let contents = std::fs::read_to_string(path)
        .map_err(|e| format!("read {}: {e}", path.display()))?;
    if contents.len() <= max_bytes {
        return Ok(contents);
    }
    // Slice on a char boundary so we never split a multi-byte sequence.
    let start = contents.len() - max_bytes;
    let start = (start..contents.len())
        .find(|&i| contents.is_char_boundary(i))
        .unwrap_or(contents.len());
    Ok(contents[start..].to_string())
}

#[derive(Serialize, Deserialize, Clone)]
struct PtySpawnOptions {
    cols: Option<u16>,
    rows: Option<u16>,
    cwd: Option<String>,
    shell: Option<String>,
    args: Option<Vec<String>>,
}

#[derive(Serialize, Deserialize, Clone)]
#[serde(rename_all = "camelCase")]
struct DorControlResponse {
    request_id: String,
    ok: bool,
    #[serde(skip_serializing_if = "Option::is_none")]
    result: Option<JsonValue>,
    #[serde(skip_serializing_if = "Option::is_none")]
    error: Option<String>,
}

#[derive(Clone, Debug, PartialEq, Eq)]
struct DorCliPaths {
    bin_dir: PathBuf,
    entrypoint: PathBuf,
}

fn send_to_sidecar(state: &SidecarState, line: String) {
    let _ = state.tx.send(line);
}

fn request_from_sidecar(
    state: &SidecarState,
    event: &str,
    data: JsonValue,
) -> Result<JsonValue, String> {
    request_from_sidecar_timeout(state, event, data, Duration::from_secs(1))
}

/// INVARIANT: every `#[tauri::command]` that reaches these two blocking helpers
/// must be declared `#[tauri::command(async)]` (or be an `async fn`). Tauri runs
/// a plain sync command on the **main thread**, where the `recv_timeout` below
/// stops the webview from painting for the whole round trip — up to
/// `AGENT_BROWSER_TIMEOUT` (30s) for a hung agent-browser, and a visible ~3s
/// freeze on a cold `agent-browser open`, which is long enough to look like a
/// pane that never appeared. `(async)` moves the same blocking body onto a
/// runtime worker, so the UI keeps rendering while the sidecar works.

fn request_from_sidecar_timeout(
    state: &SidecarState,
    event: &str,
    data: JsonValue,
    timeout: Duration,
) -> Result<JsonValue, String> {
    let request_id = format!(
        "req-{}",
        state.next_request_id.fetch_add(1, Ordering::Relaxed)
    );
    let (tx, rx) = mpsc::channel();
    state
        .pending_requests
        .lock()
        .map_err(|_| "failed to lock pending request map".to_string())?
        .insert(request_id.clone(), tx);

    let mut payload = match data {
        JsonValue::Object(map) => map,
        _ => JsonMap::new(),
    };
    payload.insert("requestId".into(), JsonValue::String(request_id.clone()));

    let msg = serde_json::json!({
        "event": event,
        "data": JsonValue::Object(payload)
    });
    send_to_sidecar(state, msg.to_string());

    match rx.recv_timeout(timeout) {
        Ok(response) => Ok(response),
        Err(err) => {
            if let Ok(mut pending) = state.pending_requests.lock() {
                pending.remove(&request_id);
            }
            // Disconnected means the reaper cleared pending_requests because
            // the sidecar exited — surface that distinctly from a real timeout.
            match err {
                mpsc::RecvTimeoutError::Timeout => {
                    Err(format!("timed out waiting for {event}"))
                }
                mpsc::RecvTimeoutError::Disconnected => {
                    Err(format!("sidecar exited before responding to {event}"))
                }
            }
        }
    }
}

// ── Tauri commands ──────────────────────────────────────────────────────────

#[tauri::command]
fn pty_spawn(state: tauri::State<'_, SidecarState>, id: String, options: Option<PtySpawnOptions>) {
    let msg = serde_json::json!({
        "event": "pty:spawn",
        "data": { "id": id, "options": options }
    });
    send_to_sidecar(&state, msg.to_string());
}

#[tauri::command]
fn pty_write(state: tauri::State<'_, SidecarState>, id: String, data: String) {
    let msg = serde_json::json!({
        "event": "pty:input",
        "data": { "id": id, "data": data }
    });
    send_to_sidecar(&state, msg.to_string());
}

#[tauri::command]
fn pty_resize(state: tauri::State<'_, SidecarState>, id: String, cols: u16, rows: u16) {
    let msg = serde_json::json!({
        "event": "pty:resize",
        "data": { "id": id, "cols": cols, "rows": rows }
    });
    send_to_sidecar(&state, msg.to_string());
}

#[tauri::command]
fn pty_kill(state: tauri::State<'_, SidecarState>, id: String) {
    let msg = serde_json::json!({
        "event": "pty:kill",
        "data": { "id": id }
    });
    send_to_sidecar(&state, msg.to_string());
}

#[tauri::command]
fn pty_request_init(state: tauri::State<'_, SidecarState>) {
    let msg = serde_json::json!({ "event": "pty:requestInit" });
    send_to_sidecar(&state, msg.to_string());
}

#[tauri::command]
fn dor_control_response(state: tauri::State<'_, SidecarState>, response: DorControlResponse) {
    let msg = serde_json::json!({
        "event": "dor:controlResponse",
        "data": response,
    });
    send_to_sidecar(&state, msg.to_string());
}

#[tauri::command(async)]
fn pty_get_cwd(
    state: tauri::State<'_, SidecarState>,
    id: String,
) -> Result<Option<String>, String> {
    let response = request_from_sidecar(&state, "pty:getCwd", serde_json::json!({ "id": id }))?;
    Ok(response
        .get("cwd")
        .and_then(|cwd| cwd.as_str().map(String::from)))
}

// Mirrors `OPEN_PORT_TIMEOUT_MS` in `lib/src/lib/platform/types.ts` — keep in sync.
const OPEN_PORT_TIMEOUT_MS: u64 = 3000;

#[tauri::command(async)]
fn pty_get_open_ports(
    state: tauri::State<'_, SidecarState>,
    id: String,
) -> Result<JsonValue, String> {
    let response = request_from_sidecar_timeout(
        &state,
        "pty:getOpenPorts",
        serde_json::json!({ "id": id }),
        Duration::from_millis(OPEN_PORT_TIMEOUT_MS),
    )?;
    Ok(response
        .get("ports")
        .cloned()
        .unwrap_or_else(|| JsonValue::Array(Vec::new())))
}

#[tauri::command(async)]
fn pty_get_scrollback(
    state: tauri::State<'_, SidecarState>,
    id: String,
) -> Result<Option<String>, String> {
    let response =
        request_from_sidecar(&state, "pty:getScrollback", serde_json::json!({ "id": id }))?;
    Ok(response
        .get("data")
        .and_then(|data| data.as_str().map(String::from)))
}

// Unlike pty_kill / kill_sidecar_now this preserves scrollback so the caller can
// capture final output afterward. Async: waits up to `timeout + 1500ms` (margin
// for the round trip beyond the sidecar's own kill timer) and must not block the
// main thread for that long.
#[tauri::command]
async fn pty_graceful_kill_all(
    state: tauri::State<'_, SidecarState>,
    timeout: u64,
) -> Result<(), String> {
    request_from_sidecar_timeout(
        &state,
        "pty:gracefulKillAll",
        serde_json::json!({ "timeout": timeout }),
        Duration::from_millis(timeout + 1500),
    )?;
    Ok(())
}

// Stands up the loopback iframe proxy in the sidecar and returns the
// IframeProxyResult JSON the webview's IframePanel expects. The proxy server is
// the shared lib/src/host/iframe-proxy.ts; this only bridges the request.
#[tauri::command(async)]
fn iframe_create_proxy_url(
    state: tauri::State<'_, SidecarState>,
    target: String,
) -> Result<JsonValue, String> {
    let response = request_from_sidecar_timeout(
        &state,
        "iframe:createProxyUrl",
        serde_json::json!({ "target": target }),
        Duration::from_secs(5),
    )?;
    Ok(response.get("result").cloned().unwrap_or(JsonValue::Null))
}

// ── agent-browser host (docs/specs/dor-browser.md → "Agent-Browser Host Capabilities").
// Thin forwarders to the Node sidecar, which runs the shared
// lib/src/host/agent-browser-host.ts — the very same module the VS Code
// extension host runs. Mirrors iframe_create_proxy_url; the logic lives in lib,
// not here, so the two hosts can't drift. ──────────────────────────────────────

// agent-browser launches Chrome (slow on first run), and pop-out is a
// close + relaunch, so allow a generous window before a forward times out.
const AGENT_BROWSER_TIMEOUT: Duration = Duration::from_secs(30);

fn agent_browser_forward(
    state: &SidecarState,
    event: &str,
    data: JsonValue,
) -> Result<JsonValue, String> {
    let response = request_from_sidecar_timeout(state, event, data, AGENT_BROWSER_TIMEOUT)?;
    Ok(response.get("result").cloned().unwrap_or(JsonValue::Null))
}

#[tauri::command(async)]
fn agent_browser_command(
    state: tauri::State<'_, SidecarState>,
    session: String,
    args: Vec<String>,
    binary_path: Option<String>,
) -> Result<JsonValue, String> {
    agent_browser_forward(
        &state,
        "agentBrowser:command",
        serde_json::json!({ "session": session, "args": args, "binaryPath": binary_path }),
    )
}

#[tauri::command(async)]
fn agent_browser_edit(
    state: tauri::State<'_, SidecarState>,
    session: String,
    op: String,
    binary_path: Option<String>,
) -> Result<JsonValue, String> {
    agent_browser_forward(
        &state,
        "agentBrowser:edit",
        serde_json::json!({ "session": session, "op": op, "binaryPath": binary_path }),
    )
}

#[tauri::command(async)]
fn agent_browser_stream_status(
    state: tauri::State<'_, SidecarState>,
    session: String,
    binary_path: Option<String>,
) -> Result<JsonValue, String> {
    agent_browser_forward(
        &state,
        "agentBrowser:streamStatus",
        serde_json::json!({ "session": session, "binaryPath": binary_path }),
    )
}

#[tauri::command(async)]
fn agent_browser_open(
    state: tauri::State<'_, SidecarState>,
    url: String,
    headed: Option<bool>,
    binary_path: Option<String>,
) -> Result<JsonValue, String> {
    agent_browser_forward(
        &state,
        "agentBrowser:open",
        serde_json::json!({ "url": url, "headed": headed, "binaryPath": binary_path }),
    )
}

// `rect` is accepted by the adapter but unused — no window positioning today.
#[tauri::command(async)]
fn agent_browser_pop_out(
    state: tauri::State<'_, SidecarState>,
    session: String,
    url: Option<String>,
    binary_path: Option<String>,
) -> Result<JsonValue, String> {
    agent_browser_forward(
        &state,
        "agentBrowser:popOut",
        serde_json::json!({ "session": session, "url": url, "binaryPath": binary_path }),
    )
}

#[tauri::command(async)]
fn agent_browser_pop_in(
    state: tauri::State<'_, SidecarState>,
    session: String,
    url: Option<String>,
    binary_path: Option<String>,
) -> Result<JsonValue, String> {
    agent_browser_forward(
        &state,
        "agentBrowser:popIn",
        serde_json::json!({ "session": session, "url": url, "binaryPath": binary_path }),
    )
}

// The sidecar hands back the screenshot's temp-file PATH (bytes no longer ride
// the JSON-lines stdio shared with PTY traffic). Read the file here and return a
// raw tauri::ipc::Response so the webview gets an ArrayBuffer (the path the panel
// decodes with createImageBitmap). A base64 `bytesBase64` field is kept as a
// fallback for a stale sidecar bundle (dev-time version skew), but the path
// branch is preferred.
#[tauri::command(async)]
fn agent_browser_screenshot(
    state: tauri::State<'_, SidecarState>,
    session: String,
    format: Option<String>,
    quality: Option<u32>,
    binary_path: Option<String>,
) -> Result<tauri::ipc::Response, String> {
    let result = agent_browser_forward(
        &state,
        "agentBrowser:screenshot",
        serde_json::json!({ "session": session, "format": format, "quality": quality, "binaryPath": binary_path }),
    )?;
    if result.get("ok").and_then(JsonValue::as_bool) != Some(true) {
        return Err(result
            .get("error")
            .and_then(JsonValue::as_str)
            .unwrap_or("screenshot failed")
            .to_string());
    }
    if let Some(path) = result.get("path").and_then(JsonValue::as_str) {
        let bytes = std::fs::read(path)
            .map_err(|err| format!("could not read screenshot file '{path}': {err}"))?;
        return Ok(tauri::ipc::Response::new(bytes));
    }
    // Fallback: an older sidecar bundle still base64s the bytes over stdio.
    let b64 = result
        .get("bytesBase64")
        .and_then(JsonValue::as_str)
        .ok_or("screenshot returned no path or bytes")?;
    let bytes = BASE64
        .decode(b64)
        .map_err(|err| format!("bad screenshot base64: {err}"))?;
    Ok(tauri::ipc::Response::new(bytes))
}

// Clipboard reads run natively on Windows (see clipboard_win) to avoid the
// console-window flicker of shelling out to PowerShell; other platforms keep the
// sidecar path (pbpaste/xclip never pop a console window).
#[tauri::command(async)]
fn read_clipboard_file_paths(
    state: tauri::State<'_, SidecarState>,
) -> Result<Vec<String>, String> {
    #[cfg(windows)]
    {
        let _ = &state;
        return Ok(clipboard_win::read_file_paths());
    }
    #[cfg(not(windows))]
    {
        let response =
            request_from_sidecar_timeout(&state, "clipboard:readFiles", serde_json::json!({}), Duration::from_secs(5))?;
        Ok(response
            .get("paths")
            .and_then(|v| serde_json::from_value(v.clone()).ok())
            .unwrap_or_default())
    }
}

#[tauri::command(async)]
fn read_clipboard_image_as_file_path(
    state: tauri::State<'_, SidecarState>,
) -> Result<Option<String>, String> {
    #[cfg(windows)]
    {
        let _ = &state;
        return Ok(clipboard_win::read_image_as_file_path());
    }
    #[cfg(not(windows))]
    {
        let response =
            request_from_sidecar_timeout(&state, "clipboard:readImage", serde_json::json!({}), Duration::from_secs(10))?;
        Ok(response
            .get("path")
            .and_then(|path| path.as_str().map(String::from)))
    }
}

#[tauri::command(async)]
fn read_clipboard_text(
    state: tauri::State<'_, SidecarState>,
) -> Result<String, String> {
    #[cfg(windows)]
    {
        let _ = &state;
        return Ok(clipboard_win::read_text().unwrap_or_default());
    }
    #[cfg(not(windows))]
    {
        let response =
            request_from_sidecar_timeout(&state, "clipboard:readText", serde_json::json!({}), Duration::from_secs(5))?;
        Ok(response
            .get("text")
            .and_then(|v| v.as_str().map(String::from))
            .unwrap_or_default())
    }
}

#[tauri::command]
fn read_update_log() -> Result<String, String> {
    read_log_tail(10_000)
}

// --- Per-window session persistence (docs/specs/standalone.md §Persistence) ---
//
// The webview's persisted-session blob (a `PersistedWindow`) is stored as one
// atomic file per Tauri window, keyed by the window label. This replaces webview
// `localStorage`, whose WKWebView SQLite WAL grew unbounded because WebKit pins
// its own WAL with a long-lived reader and never truncates during a days-long
// session. A plain file we overwrite atomically has no WAL and cannot grow.
//
// Window identity is implicit: each command keys by the invoking window's label,
// so the frontend stays window-agnostic and a second window (`win-2`, …) persists
// to its own file without ever rewriting the first window's blob.

fn sessions_dir(app: &AppHandle) -> Result<PathBuf, String> {
    Ok(app
        .path()
        .app_data_dir()
        .map_err(|e| format!("app_data_dir unavailable: {e}"))?
        .join("sessions"))
}

// Window labels are app-controlled (e.g. "main"), but sanitize defensively so a
// label can never escape the sessions directory or embed a path separator.
fn session_file_name(label: &str) -> String {
    let safe: String = label
        .chars()
        .map(|c| {
            if c.is_ascii_alphanumeric() || c == '-' || c == '_' {
                c
            } else {
                '_'
            }
        })
        .collect();
    format!("{safe}.json")
}

fn read_session_from(dir: &Path, label: &str) -> Result<Option<String>, String> {
    let path = dir.join(session_file_name(label));
    match std::fs::read_to_string(&path) {
        Ok(contents) => Ok(Some(contents)),
        Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(None),
        Err(e) => Err(format!("read session {label}: {e}")),
    }
}

fn write_session_to(dir: &Path, label: &str, state: &str) -> Result<(), String> {
    create_dir_all(dir).map_err(|e| format!("create sessions dir: {e}"))?;
    let file_name = session_file_name(label);
    let path = dir.join(&file_name);
    let tmp = dir.join(format!("{file_name}.tmp"));
    // Atomic replace: write a sibling temp file, fsync it, then rename over the
    // target so a crash mid-write can never truncate the previous good snapshot.
    {
        let mut f = File::create(&tmp).map_err(|e| format!("open temp: {e}"))?;
        f.write_all(state.as_bytes())
            .map_err(|e| format!("write temp: {e}"))?;
        f.sync_all().map_err(|e| format!("fsync temp: {e}"))?;
    }
    std::fs::rename(&tmp, &path).map_err(|e| format!("rename session {label}: {e}"))?;
    // The temp file's own fsync doesn't make the rename durable — on unix the
    // directory entry that now points at the new inode must be fsynced too, or a
    // crash right after quit could leave the rename unrecorded. Best-effort: a
    // failure here doesn't invalidate the (already-written) data. Windows has no
    // equivalent dir-fsync concept, so this is unix-only.
    #[cfg(unix)]
    {
        if let Ok(d) = std::fs::File::open(dir) {
            let _ = d.sync_all();
        }
    }
    Ok(())
}

// Async so the file IO (and save's two fsyncs — temp file + dir, both
// F_FULLFSYNC on macOS) runs off the main/event-loop thread. Ordering is safe:
// the webview store issues at most one save_session at a time (its coalescer).
#[tauri::command]
async fn load_session(window: tauri::Window) -> Result<Option<String>, String> {
    read_session_from(&sessions_dir(window.app_handle())?, window.label())
}

#[tauri::command]
async fn save_session(window: tauri::Window, state: String) -> Result<(), String> {
    write_session_to(&sessions_dir(window.app_handle())?, window.label(), &state)
}

#[tauri::command]
fn kill_sidecar_now(state: tauri::State<'_, SidecarState>) {
    kill_sidecar_and_wait(&state.child);
}

// ── Quit protocol commands (docs/specs/standalone.md §Quit flow) ─────────────

// The webview's quit orchestrator received quit-requested and its listener is
// alive; stand the phase-1 ack watchdog down.
#[tauri::command]
fn quit_ack(state: tauri::State<'_, QuitState>) {
    state.acked.store(true, Ordering::SeqCst);
}

// The orchestrator has started (or advanced) teardown: the confirmation wait is
// over, and this phase boundary refreshes the watchdog's per-phase deadline. The
// webview calls this at teardown start and again before installing an update, so
// a long install gets its own budget instead of sharing the teardown clock.
#[tauri::command]
fn quit_progress(state: tauri::State<'_, QuitState>) {
    state.tearing_down.store(true, Ordering::SeqCst);
    state.progress.fetch_add(1, Ordering::SeqCst);
}

// The user declined the quit (confirmation cancel). Bumping seq invalidates any
// live watchdog for this quit so nothing exits; the next request_quit starts
// fresh (it re-clears `acked` itself).
#[tauri::command]
fn quit_cancel(state: tauri::State<'_, QuitState>) {
    state.seq.fetch_add(1, Ordering::SeqCst);
}

// Teardown is done (or the orchestrator bailed under its own timeout); approve so
// the app.exit(0) below re-enters ExitRequested with approved=true and proceeds.
#[tauri::command]
fn quit_proceed(app: AppHandle, state: tauri::State<'_, QuitState>) {
    state.approved.store(true, Ordering::SeqCst);
    app.exit(0);
}

// Normal app quit should let the Node sidecar run its shutdown handler first:
// that handler closes headed agent-browser pop-out windows before killing PTYs.
// If the sidecar is wedged, fall back to the same hard kill path so quit remains
// bounded.
fn shutdown_sidecar_and_wait(state: &SidecarState) {
    const POLL_INTERVAL: Duration = Duration::from_millis(20);
    const MAX_POLLS: u32 = 125;

    append_log("[sidecar] requesting graceful shutdown");
    send_to_sidecar(
        state,
        serde_json::json!({ "event": "sidecar:shutdown", "data": {} }).to_string(),
    );

    let Ok(mut guard) = state.child.lock() else {
        return;
    };
    for _ in 0..MAX_POLLS {
        match guard.try_wait() {
            Ok(Some(status)) => {
                append_log(format!(
                    "[sidecar] confirmed graceful exit (status: {status})"
                ));
                return;
            }
            Ok(None) => std::thread::sleep(POLL_INTERVAL),
            Err(err) => {
                append_log(format!(
                    "[sidecar] wait error during graceful shutdown: {err}"
                ));
                return;
            }
        }
    }

    append_log("[sidecar] graceful shutdown timed out (~2.5s); killing");
    let _ = guard.start_kill();
}

// Job Object on Windows / process group on Unix — kill propagates to the
// sidecar's grandchildren (the spawned shells). On Unix this is SIGKILL to
// the whole process group, which is more thorough than the previous
// SIGTERM-to-just-node path that left node-pty grandchildren orphaned.
//
// The updater calls this before launching the Windows NSIS installer: NSIS
// overwrites files inside the bundled sidecar (e.g. node-pty's `conpty.node`),
// and Windows refuses to overwrite a native module the live sidecar still has
// loaded — surfacing as "Error opening file for writing". Releasing those
// handles first requires the node process to be gone, not merely signalled.
//
// We poll `try_wait` rather than block on `wait()`: `try_wait` is idempotent
// and can't hang, whereas the job-object `wait()` consumes a completion-port
// message the reaper thread may already have drained (e.g. if the sidecar had
// crashed earlier), which would block forever. The ~5s cap means a wedged
// sidecar can't stall quit indefinitely.
fn kill_sidecar_and_wait(child: &SharedChild) {
    // Poll for exit at this cadence, up to ~5s total (MAX_POLLS × POLL_INTERVAL).
    const POLL_INTERVAL: Duration = Duration::from_millis(20);
    const MAX_POLLS: u32 = 250;

    let Ok(mut guard) = child.lock() else { return };
    append_log(format!(
        "[sidecar] killing and waiting for exit (pid={})",
        guard.id()
    ));
    let _ = guard.start_kill();
    for _ in 0..MAX_POLLS {
        match guard.try_wait() {
            Ok(Some(status)) => {
                append_log(format!("[sidecar] confirmed exit during kill (status: {status})"));
                return;
            }
            Ok(None) => std::thread::sleep(POLL_INTERVAL),
            Err(err) => {
                append_log(format!("[sidecar] wait error during kill: {err}"));
                return;
            }
        }
    }
    append_log("[sidecar] kill wait timed out (~5s); proceeding anyway");
}

#[derive(Serialize, Deserialize, Clone)]
struct ShellInfo {
    name: String,
    path: String,
    #[serde(default)]
    args: Vec<String>,
}

#[tauri::command(async)]
fn get_available_shells(state: tauri::State<'_, SidecarState>) -> Result<Vec<ShellInfo>, String> {
    let response = request_from_sidecar_timeout(&state, "pty:getShells", serde_json::json!({}), Duration::from_secs(10))?;
    let shells: Vec<ShellInfo> = response
        .get("shells")
        .and_then(|v| serde_json::from_value(v.clone()).ok())
        .unwrap_or_default();
    Ok(shells)
}

fn resolve_sidecar_path(resource_dir: Option<PathBuf>, manifest_dir: &Path) -> PathBuf {
    if let Some(ref dir) = resource_dir {
        // Tauri maps `../sidecar` to `_up_/sidecar` when bundling resources
        for prefix in &["sidecar", "_up_/sidecar"] {
            let path = dir.join(prefix).join("main.js");
            if path.is_file() {
                // resource_dir() hands back a `\\?\` verbatim path in the
                // bundled/dev layout. Normalize once here, at the boundary, so
                // every consumer (the node script arg, the dor-cli paths derived
                // from this path's parent) gets a plain path. cmd.exe can't
                // execute a batch file via a verbatim path; Rust's APIs accept
                // both, so stripping is always safe.
                return strip_windows_verbatim_prefix(&path.to_string_lossy()).unwrap_or(path);
            }
        }
    }

    manifest_dir.join("..").join("sidecar").join("main.js")
}

fn strip_windows_verbatim_prefix(path_string: &str) -> Option<PathBuf> {
    if let Some(stripped) = path_string.strip_prefix(r"\\?\UNC\") {
        return Some(PathBuf::from(format!(r"\\{stripped}")));
    }
    if let Some(stripped) = path_string.strip_prefix(r"\\?\") {
        return Some(PathBuf::from(stripped));
    }

    None
}

fn resolve_node_binary_path() -> Result<PathBuf, String> {
    let exe = env::current_exe().map_err(|e| format!("current_exe: {e}"))?;
    let dir = exe
        .parent()
        .ok_or_else(|| "current_exe has no parent".to_string())?;
    find_node_binary(dir, env!("TAURI_ENV_TARGET_TRIPLE"))
        .ok_or_else(|| format!("node sidecar not found in {}", dir.display()))
}

// tauri-bundler sometimes strips the target-triple suffix (e.g. install dir
// has `node.exe`, dev/bundle has `node-x86_64-pc-windows-msvc.exe`).
fn find_node_binary(dir: &Path, target_triple: &str) -> Option<PathBuf> {
    let suffix = if cfg!(windows) { ".exe" } else { "" };
    let candidates = [
        dir.join(format!("node-{target_triple}{suffix}")),
        dir.join(format!("node{suffix}")),
    ];
    candidates.into_iter().find(|p| p.is_file())
}

// The node the `dor` CLI runs under. On Windows the bundled node.exe is patched
// to the GUI subsystem at build time (build.rs `force_windows_gui_subsystem`) so
// spawning the sidecar from our GUI process doesn't trigger Win11's DefTerm
// handoff and flash a stray terminal window. A GUI-subsystem node, however, does
// not attach to an *inherited* console: when `dor` runs inside a shell's ConPTY
// its stdout/stderr are console handles (not STARTUPINFO pipes), so every byte it
// prints is silently dropped and commands appear to produce no output. `dor`
// already runs inside a pseudo-console and can never cause a stray window, so it
// needs a console-subsystem node. Derive one by copying the bundled node and
// flipping the PE subsystem byte back to console; cache it in app data. The
// sidecar itself keeps running under the GUI node.
#[cfg(windows)]
fn resolve_dor_node_path(gui_node: &Path, app: &AppHandle) -> PathBuf {
    match ensure_console_subsystem_node(gui_node, app) {
        Ok(path) => path,
        Err(err) => {
            append_log(format!(
                "[dor] console-subsystem node derivation failed ({err}); dor output may be lost"
            ));
            gui_node.to_path_buf()
        }
    }
}

#[cfg(not(windows))]
fn resolve_dor_node_path(gui_node: &Path, _app: &AppHandle) -> PathBuf {
    gui_node.to_path_buf()
}

#[cfg(windows)]
fn ensure_console_subsystem_node(gui_node: &Path, app: &AppHandle) -> Result<PathBuf, String> {
    let dir = app
        .path()
        .app_local_data_dir()
        .map_err(|e| format!("app_local_data_dir: {e}"))?;
    create_dir_all(&dir).map_err(|e| format!("create cache dir: {e}"))?;
    let dest = dir.join("dor-node.exe");
    let src_len = std::fs::metadata(gui_node)
        .map_err(|e| format!("stat bundled node: {e}"))?
        .len();
    // Reuse the cached copy only when it matches the current bundled node's size
    // and is already console-subsystem; re-derive when missing or stale (e.g. an
    // app update swapped the bundled node). read_subsystem seeks to the field
    // rather than reading the whole ~80MB binary on every launch.
    if let Ok(meta) = std::fs::metadata(&dest) {
        if meta.len() == src_len
            && pe_subsystem::read_subsystem(&dest).ok() == Some(pe_subsystem::CONSOLE)
        {
            return Ok(dest);
        }
    }
    // Copy the bundled node with its subsystem flipped back to console. Writing a
    // fresh file (rather than fs::copy + re-patch) reads the source only once and
    // sidesteps fs::copy propagating the source's read-only attribute.
    let mut bytes = std::fs::read(gui_node).map_err(|e| format!("read bundled node: {e}"))?;
    pe_subsystem::set_subsystem(&mut bytes, pe_subsystem::CONSOLE)?;
    std::fs::write(&dest, &bytes).map_err(|e| format!("write dor node: {e}"))?;
    Ok(dest)
}

fn dor_control_socket_path() -> String {
    let pid = std::process::id();
    #[cfg(windows)]
    {
        format!(r"\\.\pipe\dormouse-{pid}-dor")
    }
    #[cfg(not(windows))]
    {
        env::temp_dir()
            .join(format!("dormouse-{pid}-dor.sock"))
            .to_string_lossy()
            .into_owned()
    }
}

fn dor_control_token() -> String {
    // Must be unguessable: it is the sole authenticator for the private `dor`
    // control socket. A PID+timestamp value is locally discoverable (`ps`) and
    // bounded by the app's launch window, so draw 24 bytes from the OS CSPRNG and
    // hex-encode them — matching the VS Code host's randomBytes(24).toString('hex')
    // in pty-manager.ts. Aborting on CSPRNG failure is deliberate: never fall back
    // to a weak token.
    let mut bytes = [0u8; 24];
    getrandom::fill(&mut bytes).expect("OS CSPRNG unavailable for dor control token");
    bytes.iter().map(|b| format!("{b:02x}")).collect()
}

fn dor_cli_paths_from_root(root: PathBuf) -> DorCliPaths {
    DorCliPaths {
        bin_dir: root.join("bin"),
        entrypoint: root.join("dist").join("dor.js"),
    }
}

fn resolve_dor_cli_paths(sidecar_path: &Path, manifest_dir: &Path) -> DorCliPaths {
    if let Some(sidecar_dir) = sidecar_path.parent() {
        let bundled = dor_cli_paths_from_root(sidecar_dir.join("dor-cli"));
        if bundled.entrypoint.is_file() {
            return bundled;
        }
    }

    let staged = dor_cli_paths_from_root(manifest_dir.join("..").join("sidecar").join("dor-cli"));
    if staged.entrypoint.is_file() {
        return staged;
    }

    dor_cli_paths_from_root(manifest_dir.join("..").join("..").join("dor"))
}

fn start_sidecar(app: &AppHandle) -> Result<SidecarState, String> {
    let manifest_dir = Path::new(env!("CARGO_MANIFEST_DIR"));
    let sidecar_path = resolve_sidecar_path(app.path().resource_dir().ok(), manifest_dir);
    let node_path = resolve_node_binary_path()?;
    let dor_cli_paths = resolve_dor_cli_paths(&sidecar_path, manifest_dir);
    let dor_node_path = resolve_dor_node_path(&node_path, app);
    let dor_control_socket = dor_control_socket_path();
    let dor_control_token = dor_control_token();
    append_log(format!(
        "[sidecar] resolved script: {}",
        sidecar_path.display()
    ));
    append_log(format!("[sidecar] node binary: {}", node_path.display()));
    append_log(format!("[dor] node binary: {}", dor_node_path.display()));
    append_log(format!(
        "[dor] CLI bin dir: {}",
        dor_cli_paths.bin_dir.display()
    ));
    append_log(format!(
        "[dor] CLI entrypoint: {}",
        dor_cli_paths.entrypoint.display()
    ));
    append_log(format!("[dor] control socket: {dor_control_socket}"));

    let mut wrap = CommandWrap::with_new(&node_path, |c| {
        c.arg(&sidecar_path)
            .env("DORMOUSE_HOST", "standalone")
            .env("DORMOUSE_NODE", &dor_node_path)
            .env("DORMOUSE_CLI_BIN", &dor_cli_paths.bin_dir)
            .env("DORMOUSE_CLI_JS", &dor_cli_paths.entrypoint)
            .env("DORMOUSE_CONTROL_SOCKET", &dor_control_socket)
            .env("DORMOUSE_CONTROL_TOKEN", &dor_control_token)
            .stdin(Stdio::piped())
            .stdout(Stdio::piped())
            .stderr(Stdio::piped());
    });
    #[cfg(windows)]
    {
        wrap.wrap(CreationFlags(CREATE_NO_WINDOW));
        wrap.wrap(JobObject);
    }
    #[cfg(unix)]
    {
        wrap.wrap(ProcessGroup::leader());
    }

    let mut child = wrap
        .spawn()
        .map_err(|err| format!("failed to start Node.js sidecar: {err}"))?;
    let child_pid = child.id();
    append_log(format!("[sidecar] spawned Node.js runtime (pid={child_pid})"));

    // We piped all three streams ourselves, so `take` should always succeed —
    // but if it doesn't, the child is already running and would otherwise
    // outlive this function. Reap it before bailing.
    let stdin = child.stdin().take();
    let stdout = child.stdout().take();
    let stderr = child.stderr().take();
    let (mut stdin, stdout, stderr) = match (stdin, stdout, stderr) {
        (Some(i), Some(o), Some(e)) => (i, o, e),
        _ => {
            let _ = child.start_kill();
            return Err("sidecar pipes missing after spawn".to_string());
        }
    };

    let handle = app.clone();
    let pending_requests: PendingRequests = Arc::new(Mutex::new(HashMap::new()));
    let pending_requests_for_task = Arc::clone(&pending_requests);

    std::thread::spawn(move || {
        let reader = BufReader::new(stdout);
        for line_result in reader.lines() {
            let Ok(line) = line_result else {
                break;
            };
            let Ok(mut msg) = serde_json::from_str::<JsonValue>(&line) else {
                append_log(format!("[sidecar stdout] {}", line.trim_end()));
                continue;
            };
            let Some(event) = msg.get("event").and_then(|e| e.as_str()).map(String::from)
            else {
                append_log("[sidecar stdout] JSON line missing event");
                continue;
            };
            let data = msg
                .as_object_mut()
                .and_then(|m| m.remove("data"))
                .unwrap_or(JsonValue::Null);

            if let Some(request_id) = data
                .get("requestId")
                .and_then(|request_id| request_id.as_str())
            {
                if let Ok(mut pending) = pending_requests_for_task.lock() {
                    if let Some(response_tx) = pending.remove(request_id) {
                        let _ = response_tx.send(data.clone());
                        continue;
                    }
                }
            }

            let _ = handle.emit(&event, data);
        }
    });

    std::thread::spawn(move || {
        let reader = BufReader::new(stderr);
        for line_result in reader.lines() {
            let Ok(line) = line_result else {
                break;
            };
            let message = format!("[sidecar] {}", line.trim_end());
            eprintln!("{message}");
            append_log(message);
        }
    });

    let (tx, writer_rx) = mpsc::channel::<String>();

    std::thread::spawn(move || {
        while let Ok(line) = writer_rx.recv() {
            let payload = format!("{}\n", line);
            if stdin.write_all(payload.as_bytes()).is_err() {
                append_log("[sidecar] stdin write failed");
                break;
            }
        }
    });

    let child: SharedChild = Arc::new(Mutex::new(child));

    // Reaper: poll for exit so we log a real exit status and unblock any
    // pending `request_from_sidecar_timeout` callers immediately instead of
    // making them wait the full timeout when the sidecar has already died.
    let child_for_reaper = Arc::clone(&child);
    let pending_for_reaper = Arc::clone(&pending_requests);
    std::thread::spawn(move || {
        loop {
            let status = match child_for_reaper.lock() {
                Ok(mut guard) => guard.try_wait(),
                Err(_) => return,
            };
            match status {
                Ok(Some(status)) => {
                    append_log(format!("[sidecar] exited (status: {status})"));
                    if let Ok(mut pending) = pending_for_reaper.lock() {
                        pending.clear();
                    }
                    return;
                }
                Ok(None) => std::thread::sleep(Duration::from_millis(250)),
                Err(err) => {
                    append_log(format!("[sidecar] wait error: {err}"));
                    return;
                }
            }
        }
    });

    Ok(SidecarState {
        tx,
        pending_requests,
        next_request_id: AtomicU64::new(0),
        child,
    })
}

// ── App entry point ─────────────────────────────────────────────────────────

#[cfg_attr(mobile, tauri::mobile_entry_point)]
pub fn run() {
    tauri::Builder::default()
        .plugin(tauri_plugin_shell::init())
        .plugin(tauri_plugin_updater::Builder::new().build())
        // Replace Tauri's default menu, which binds Cmd+V to a native Paste
        // action that fights with the webview's DOM keydown handler. The
        // terminal owns Cmd+C / Cmd+V / Cmd+X in JS (see `Wall.tsx`).
        .menu(|handle| {
            #[cfg(target_os = "macos")]
            let pkg = handle.package_info();
            #[cfg(target_os = "macos")]
            let about = AboutMetadata {
                name: Some(pkg.name.clone()),
                version: Some(pkg.version.to_string()),
                ..Default::default()
            };
            let mut items: Vec<Box<dyn tauri::menu::IsMenuItem<_>>> = Vec::new();
            #[cfg(target_os = "macos")]
            items.push(Box::new(Submenu::with_items(
                handle,
                pkg.name.clone(),
                true,
                &[
                    &PredefinedMenuItem::about(handle, None, Some(about))?,
                    &PredefinedMenuItem::separator(handle)?,
                    &PredefinedMenuItem::services(handle, None)?,
                    &PredefinedMenuItem::separator(handle)?,
                    &PredefinedMenuItem::hide(handle, None)?,
                    &PredefinedMenuItem::hide_others(handle, None)?,
                    &PredefinedMenuItem::separator(handle)?,
                    &PredefinedMenuItem::quit(handle, None)?,
                ],
            )?));
            items.push(Box::new(Submenu::with_items(
                handle,
                "Window",
                true,
                &[
                    &PredefinedMenuItem::minimize(handle, None)?,
                    &PredefinedMenuItem::maximize(handle, None)?,
                    #[cfg(target_os = "macos")]
                    &PredefinedMenuItem::separator(handle)?,
                    &PredefinedMenuItem::close_window(handle, None)?,
                ],
            )?));
            let refs: Vec<&dyn tauri::menu::IsMenuItem<_>> = items.iter().map(|b| b.as_ref()).collect();
            Menu::with_items(handle, &refs)
        })
        // Inert while tauri.conf.json sets dragDropEnabled=false (needed for HTML5 pane drag). See diffplug/dormouse#38 and tauri-apps/tauri#14373.
        .on_window_event(|window, event| {
            if let WindowEvent::DragDrop(DragDropEvent::Drop { paths, .. }) = event {
                let payload: Vec<String> = paths
                    .iter()
                    .map(|p| p.to_string_lossy().into_owned())
                    .collect();
                let _ = window.emit("dormouse://files-dropped", serde_json::json!({ "paths": payload }));
            }
            // Window close funnels into the app-wide quit flow (§Quit flow).
            // Multi-window seam: one window ships today, so a per-window close is
            // the whole-app quit; a multi-window build would give each close a
            // per-window teardown and only quit on the last one.
            if let WindowEvent::CloseRequested { api, .. } = event {
                let app = window.app_handle();
                if !quit_approved(app) {
                    api.prevent_close();
                    request_quit(app);
                }
            }
        })
        .setup(|app| {
            init_log();
            append_log("[app] setup started");

            let sidecar_state = start_sidecar(app.handle()).map_err(|err| {
                append_log(format!("[sidecar] {err}"));
                std::io::Error::new(std::io::ErrorKind::Other, err)
            })?;
            app.manage(sidecar_state);
            append_log("[app] sidecar state registered");

            // Quit-interception state (docs/specs/standalone.md §Quit flow).
            app.manage(QuitState::default());

            // On non-macOS, remove native decorations for a fully custom title bar.
            // macOS uses titleBarStyle "Overlay" from config instead, which preserves
            // rounded corners and native traffic-light buttons.
            #[cfg(not(target_os = "macos"))]
            {
                if let Some(window) = app.get_webview_window("main") {
                    let _ = window.set_decorations(false);
                }
            }

            Ok(())
        })
        .invoke_handler(tauri::generate_handler![
            pty_spawn,
            pty_write,
            pty_resize,
            pty_kill,
            pty_get_cwd,
            pty_get_open_ports,
            pty_get_scrollback,
            pty_graceful_kill_all,
            iframe_create_proxy_url,
            pty_request_init,
            dor_control_response,
            kill_sidecar_now,
            quit_ack,
            quit_progress,
            quit_cancel,
            quit_proceed,
            get_available_shells,
            read_clipboard_file_paths,
            read_clipboard_image_as_file_path,
            read_clipboard_text,
            read_update_log,
            load_session,
            save_session,
            agent_browser_command,
            agent_browser_edit,
            agent_browser_screenshot,
            agent_browser_stream_status,
            agent_browser_open,
            agent_browser_pop_out,
            agent_browser_pop_in,
        ])
        .build(tauri::generate_context!())
        .expect("error while building Dormouse")
        .run(|app, event| match event {
            #[cfg(target_os = "macos")]
            RunEvent::Ready => set_macos_dock_icon(),
            // Cmd+Q / app-menu / dock quit / interceptable OS logout (§Quit flow).
            // The flow's own app.exit(0) re-enters here with approved=true and
            // passes; `code` (None = user-initiated) is deliberately ignored.
            RunEvent::ExitRequested { api, .. } => {
                if !quit_approved(app) {
                    api.prevent_exit();
                    request_quit(app);
                }
            }
            // Harmless after teardown: the PTY map is already empty, so the
            // sidecar killAll no-ops. Still the backstop for any unclean exit.
            RunEvent::Exit => {
                if let Some(state) = app.try_state::<SidecarState>() {
                    append_log("[app] exit — shutting down sidecar");
                    shutdown_sidecar_and_wait(&state);
                }
            }
            _ => {}
        });
}

#[cfg(test)]
mod tests {
    use super::{
        find_node_binary, read_session_from, resolve_dor_cli_paths, resolve_sidecar_path,
        session_file_name, strip_windows_verbatim_prefix, write_session_to,
    };
    use std::fs;
    use std::path::{Path, PathBuf};
    use std::time::{SystemTime, UNIX_EPOCH};

    // RAII guard so a failing assert doesn't leak the temp dir.
    struct TempDir(PathBuf);
    impl TempDir {
        fn new(name: &str) -> Self {
            let suffix = SystemTime::now()
                .duration_since(UNIX_EPOCH)
                .expect("system time before unix epoch")
                .as_nanos();
            let path = std::env::temp_dir().join(format!("dormouse-{name}-{suffix}"));
            fs::create_dir_all(&path).expect("failed to create temp dir");
            TempDir(path)
        }
        fn path(&self) -> &Path {
            &self.0
        }
    }
    impl Drop for TempDir {
        fn drop(&mut self) {
            let _ = fs::remove_dir_all(&self.0);
        }
    }

    #[test]
    #[cfg(windows)]
    fn pe_subsystem_round_trips() {
        use super::pe_subsystem::{read_subsystem, set_subsystem, CONSOLE, GUI};
        let dir = TempDir::new("pe-subsystem");
        let path = dir.path().join("fake.exe");
        // Minimal PE: MZ magic, e_lfanew -> 0x80, "PE\0\0" signature, and a
        // Subsystem field 0x5C past the PE signature starting as console.
        let mut bytes = vec![0u8; 256];
        bytes[0] = b'M';
        bytes[1] = b'Z';
        let pe_offset: u32 = 0x80;
        bytes[0x3C..0x40].copy_from_slice(&pe_offset.to_le_bytes());
        let po = pe_offset as usize;
        bytes[po..po + 4].copy_from_slice(b"PE\0\0");
        bytes[po + 0x5C..po + 0x5C + 2].copy_from_slice(&CONSOLE.to_le_bytes());
        fs::write(&path, &bytes).expect("write fake pe");

        // read_subsystem seeks in the file; set_subsystem patches the image.
        assert_eq!(read_subsystem(&path).unwrap(), CONSOLE);
        set_subsystem(&mut bytes, GUI).unwrap(); // build.rs flips console -> GUI
        fs::write(&path, &bytes).unwrap();
        assert_eq!(read_subsystem(&path).unwrap(), GUI);
        set_subsystem(&mut bytes, CONSOLE).unwrap(); // dor derive flips it back
        fs::write(&path, &bytes).unwrap();
        assert_eq!(read_subsystem(&path).unwrap(), CONSOLE);
    }

    #[test]
    fn prefers_packaged_sidecar_when_resource_exists() {
        let resource_dir = TempDir::new("resource");
        let sidecar_dir = resource_dir.path().join("sidecar");
        let sidecar_path = sidecar_dir.join("main.js");

        fs::create_dir_all(&sidecar_dir).expect("failed to create sidecar dir");
        fs::write(&sidecar_path, "console.log('packaged');").expect("failed to create sidecar");

        let resolved = resolve_sidecar_path(
            Some(resource_dir.path().to_path_buf()),
            Path::new("/repo/standalone/src-tauri"),
        );

        assert_eq!(resolved, sidecar_path);
    }

    #[test]
    fn finds_sidecar_under_up_prefix() {
        let resource_dir = TempDir::new("resource-up");
        let sidecar_dir = resource_dir.path().join("_up_").join("sidecar");
        let sidecar_path = sidecar_dir.join("main.js");

        fs::create_dir_all(&sidecar_dir).expect("failed to create sidecar dir");
        fs::write(&sidecar_path, "console.log('packaged');").expect("failed to create sidecar");

        let resolved = resolve_sidecar_path(
            Some(resource_dir.path().to_path_buf()),
            Path::new("/repo/standalone/src-tauri"),
        );

        assert_eq!(resolved, sidecar_path);
    }

    #[test]
    fn falls_back_to_repo_sidecar_when_resource_is_missing() {
        let manifest_dir = Path::new("/repo/standalone/src-tauri");

        let resolved = resolve_sidecar_path(None, manifest_dir);

        assert_eq!(
            resolved,
            manifest_dir.join("..").join("sidecar").join("main.js")
        );
    }

    #[test]
    fn strips_windows_verbatim_prefix_for_node_main_script() {
        let path = strip_windows_verbatim_prefix(
            r"\\?\C:\Users\EdgarTwigg\AppData\Local\Dormouse\_up_\sidecar\main.js",
        )
        .expect("expected verbatim path to be stripped");

        assert_eq!(
            path,
            PathBuf::from(r"C:\Users\EdgarTwigg\AppData\Local\Dormouse\_up_\sidecar\main.js")
        );
    }

    #[test]
    fn strips_windows_verbatim_unc_prefix_for_node_main_script() {
        let path = strip_windows_verbatim_prefix(r"\\?\UNC\server\share\Dormouse\sidecar\main.js")
            .expect("expected verbatim UNC path to be stripped");

        assert_eq!(
            path,
            PathBuf::from(r"\\server\share\Dormouse\sidecar\main.js")
        );
    }

    #[test]
    fn finds_node_binary_with_triple_suffix() {
        let dir = TempDir::new("node-triple");
        let suffix = if cfg!(windows) { ".exe" } else { "" };
        let triple = "x86_64-pc-windows-msvc";
        let expected = dir.path().join(format!("node-{triple}{suffix}"));
        fs::write(&expected, b"fake").expect("failed to write fake binary");

        let resolved = find_node_binary(dir.path(), triple).expect("should resolve");
        assert_eq!(resolved, expected);
    }

    #[test]
    fn finds_node_binary_falls_back_to_stripped_name() {
        let dir = TempDir::new("node-stripped");
        let suffix = if cfg!(windows) { ".exe" } else { "" };
        let expected = dir.path().join(format!("node{suffix}"));
        fs::write(&expected, b"fake").expect("failed to write fake binary");

        let resolved =
            find_node_binary(dir.path(), "x86_64-pc-windows-msvc").expect("should resolve");
        assert_eq!(resolved, expected);
    }

    #[test]
    fn returns_none_when_no_node_binary_present() {
        let dir = TempDir::new("node-missing");

        assert!(find_node_binary(dir.path(), "x86_64-pc-windows-msvc").is_none());
    }

    #[test]
    fn resolves_staged_dor_cli_next_to_sidecar() {
        let resource_dir = TempDir::new("dor-cli-resource");
        let sidecar_dir = resource_dir.path().join("sidecar");
        let sidecar_path = sidecar_dir.join("main.js");
        let dor_root = sidecar_dir.join("dor-cli");
        let dor_entrypoint = dor_root.join("dist").join("dor.js");

        fs::create_dir_all(dor_entrypoint.parent().unwrap()).expect("failed to create dor dist");
        fs::create_dir_all(dor_root.join("bin")).expect("failed to create dor bin");
        fs::write(&sidecar_path, "console.log('sidecar');").expect("failed to create sidecar");
        fs::write(&dor_entrypoint, "console.log('dor');").expect("failed to create dor entrypoint");

        let resolved =
            resolve_dor_cli_paths(&sidecar_path, Path::new("/repo/standalone/src-tauri"));

        assert_eq!(resolved.bin_dir, dor_root.join("bin"));
        assert_eq!(resolved.entrypoint, dor_entrypoint);
    }

    #[test]
    fn resolves_repo_dor_cli_when_staged_copy_is_missing() {
        let sidecar_dir = TempDir::new("dor-cli-missing");
        let sidecar_path = sidecar_dir.path().join("main.js");
        let manifest_dir = Path::new("/repo/standalone/src-tauri");

        fs::write(&sidecar_path, "console.log('sidecar');").expect("failed to create sidecar");

        let resolved = resolve_dor_cli_paths(&sidecar_path, manifest_dir);

        let dor_root = manifest_dir.join("..").join("..").join("dor");
        assert_eq!(resolved.bin_dir, dor_root.join("bin"));
        assert_eq!(resolved.entrypoint, dor_root.join("dist").join("dor.js"));
    }

    // resource_dir() hands us a `\\?\` verbatim path on Windows. resolve_sidecar_path
    // is the single normalization boundary: it must strip the prefix so every
    // downstream consumer (the node script arg, and the dor-cli paths derived from
    // this path's parent) gets a plain path — otherwise cmd.exe can't launch
    // `dor.cmd` reached through DORMOUSE_CLI_BIN on PATH.
    #[test]
    #[cfg(windows)]
    fn resolve_sidecar_path_strips_verbatim_prefix() {
        let resource_dir = TempDir::new("sidecar-verbatim");
        let sidecar_path = resource_dir.path().join("sidecar").join("main.js");
        fs::create_dir_all(sidecar_path.parent().unwrap()).expect("failed to create sidecar dir");
        fs::write(&sidecar_path, "console.log('sidecar');").expect("failed to create sidecar");

        // A verbatim resource dir to the same real tree; is_file() still resolves it.
        let verbatim_resource = PathBuf::from(format!(r"\\?\{}", resource_dir.path().display()));
        let resolved =
            resolve_sidecar_path(Some(verbatim_resource), Path::new("/repo/standalone/src-tauri"));

        assert_eq!(resolved, sidecar_path);
        assert!(!resolved.to_string_lossy().contains(r"\\?\"));
    }

    #[test]
    fn session_missing_reads_none() {
        let dir = TempDir::new("sessions-missing");
        // No file yet — a fresh install / new window reads as None, not an error.
        assert_eq!(read_session_from(dir.path(), "main").unwrap(), None);
    }

    #[test]
    fn session_round_trips_and_isolates_windows() {
        let dir = TempDir::new("sessions-roundtrip");
        write_session_to(dir.path(), "main", r#"{"v":1,"who":"main"}"#).unwrap();
        assert_eq!(
            read_session_from(dir.path(), "main").unwrap().as_deref(),
            Some(r#"{"v":1,"who":"main"}"#),
        );

        // A second window persists to its own file and never touches the first's.
        write_session_to(dir.path(), "win-2", r#"{"v":1,"who":"win-2"}"#).unwrap();
        assert_eq!(
            read_session_from(dir.path(), "main").unwrap().as_deref(),
            Some(r#"{"v":1,"who":"main"}"#),
        );
        assert_eq!(
            read_session_from(dir.path(), "win-2").unwrap().as_deref(),
            Some(r#"{"v":1,"who":"win-2"}"#),
        );

        // Overwrite is atomic-replace, not append: the latest blob fully wins.
        write_session_to(dir.path(), "main", r#"{"v":2}"#).unwrap();
        assert_eq!(
            read_session_from(dir.path(), "main").unwrap().as_deref(),
            Some(r#"{"v":2}"#),
        );
    }

    #[test]
    fn session_label_cannot_escape_directory() {
        // A hostile label is flattened to a plain filename inside the dir.
        assert_eq!(session_file_name("../../evil"), "______evil.json");
        assert_eq!(session_file_name("main"), "main.json");
        assert_eq!(session_file_name("a/b"), "a_b.json");
    }

    // Enforces the INVARIANT documented above `request_from_sidecar_timeout`:
    // every `#[tauri::command]` whose body reaches the blocking sidecar helpers
    // must be `#[tauri::command(async)]` (or an `async fn`). A plain-sync command
    // runs on the main thread, where `recv_timeout` freezes the webview for the
    // whole round trip — up to 10s on a clipboard image paste. Three clipboard
    // commands once slipped through the async port; this scans the source so the
    // omission can't silently recur.
    #[test]
    fn sidecar_commands_are_async() {
        let src = include_str!("lib.rs");
        let lines: Vec<&str> = src.lines().collect();
        let mut offenders: Vec<String> = Vec::new();

        for (i, line) in lines.iter().enumerate() {
            let trimmed = line.trim_start();
            if !trimmed.starts_with("#[tauri::command") {
                continue;
            }
            let is_async_attr = trimmed.contains("(async)");

            // Skip any further attribute lines / blanks down to the fn signature.
            let mut j = i + 1;
            while j < lines.len() {
                let t = lines[j].trim_start();
                if t.starts_with("#[") || t.is_empty() {
                    j += 1;
                } else {
                    break;
                }
            }
            if j >= lines.len() {
                continue;
            }
            let sig = lines[j].trim_start();
            let is_async_fn = sig.starts_with("async fn") || sig.starts_with("pub async fn");
            let name = sig
                .trim_start_matches("pub ")
                .trim_start_matches("async ")
                .trim_start_matches("fn ")
                .split('(')
                .next()
                .unwrap_or("<unknown>")
                .trim();

            // Extract the fn body by brace-counting from the signature onward.
            // This is a naive char count, not a lexer: a lone `{`/`}` inside a
            // string or char literal (e.g. `'{'`, or `"missing }"`) would throw
            // off the depth. It holds across the command bodies scanned here
            // because none of them contain such a literal; a future command that
            // did would need a real tokenizer. Good enough to enforce the
            // async-attribute invariant, not a general Rust brace matcher.
            let mut depth = 0i32;
            let mut started = false;
            let mut body = String::new();
            for l in &lines[j..] {
                for ch in l.chars() {
                    if ch == '{' {
                        depth += 1;
                        started = true;
                    } else if ch == '}' {
                        depth -= 1;
                    }
                }
                body.push_str(l);
                if started && depth == 0 {
                    break;
                }
            }

            // Match direct callers of the blocking helper *and* the
            // agent-browser commands, which reach it transitively through the
            // `agent_browser_forward` wrapper (their bodies never name
            // `request_from_sidecar` directly). That family carries the longest
            // timeout (AGENT_BROWSER_TIMEOUT = 30s), so it's the worst case to
            // let slip plain-sync.
            let reaches_sidecar =
                body.contains("request_from_sidecar") || body.contains("agent_browser_forward");
            if reaches_sidecar && !(is_async_attr || is_async_fn) {
                offenders.push(name.to_string());
            }
        }

        assert!(
            offenders.is_empty(),
            "these #[tauri::command] fns reach the blocking sidecar helpers but are \
             not declared #[tauri::command(async)] (see the INVARIANT above \
             request_from_sidecar_timeout): {offenders:?}",
        );
    }
}