[Request]: Multi client

[Mat4m0]

Able to run multiple instances of the game..

Difficulty: Keychain integration, Template saving,..

[Mat4m0]

Spec idea

Product definition

Guild Wars Reforged lets a player save multiple local account profiles and open two or more independently controlled Guild Wars sessions at once.

It remains:

• One signed macOS application.
• One verified ArenaNet client installation.
• One shared game-data download.
• One application updater.
• One isolated window, filesystem, login, and network session per profile.

It does not clone the application, duplicate the game download, broadcast input, automate gameplay, or provide generic launcher/plugin machinery.

Product promise

Pick an account, press Open, and play. Every account remembers its own login and local game files, while downloads, updates, and host-authored builds are safely shared.

This requires changing the current “no multiboxing support” product non-goal in PRODUCT.md to:

Multiple independently controlled sessions are supported. Input broadcasting, coordinated control, macros, bots, and unattended gameplay are not.

---

Experience principles

1. Existing players notice no migration
   Updating the app opens their existing game exactly as before. Templates, settings, screenshots, chat logs, downloads, and saved login remain available.

2. One account means one local profile
   A profile owns a game window, saved login, Steam session, preferences, templates, screenshots, and chat logs.

3. Shared things stay shared
   ArenaNet client files, downloaded chunks, application updates, certifications, and the GWonMac Build/Team library are downloaded or stored once.

4. Credentials are entered only into Guild Wars
   The account manager never adds a second email/password form. The official login and Remember Password behavior remain authoritative.

5. Opening is idempotent
   Opening a profile that is already running focuses it. It never creates a duplicate.

6. Sessions cannot interfere
   A failed, closed, reloaded, or crashed window cannot affect another window’s storage, sockets, input, or login.

7. Focus is sacred
   Only the focused window receives input. Losing focus releases every held key, mouse button, virtual cursor, and pointer lock.

8. Updates remain global and calm
   An update is downloaded once and never silently disconnects active sessions.

---

Primary experience

Account Hub

When the player has multiple profiles, opening Guild Wars Reforged presents a compact account list:

Guild Wars Reforged

Accounts

Main                              Playing       Focus
Storage                           Ready         Open
Pre-Searing                       Ready         Open
Testing                           Needs sign-in Open

+ Add Account

The list uses the existing Guild Wars/Obsidian component system. It is a dense native product surface, not a decorative dashboard of cards.

Entry points

• Launching the application with one profile opens it directly.
• Launching with multiple profiles opens Account Hub.
• ⌘N opens Account Hub.
• File → Open Account… opens Account Hub.
• The Dock menu lists profiles.
• Launching the .app while it is already running opens or focuses Account Hub.
• The macOS Window menu lists all active account windows.

Profile row behavior

• Open: start a new game window.

• Focus: bring the existing window forward.

• Starting…: disable repeated launch attempts.

• Needs attention: show a brief error and Retry.

• Context menu:

  • Rename
  • Copy templates from…
  • Forget saved login
  • Archive
  • Profile settings…

Window titles use the local label:

Guild Wars Reforged — Main

Labels are local and need not match an email address or character name.

---

Add Account

1. The player selects Add Account.
2. Account Hub adds an inline name field.
3. The player enters a local label such as “Storage.”
4. Optional checkbox: Copy Guild Wars templates from Main.
5. The app creates an isolated profile and opens its game window.
6. Guild Wars presents its normal login screen.
7. If the player enables Remember Password, credentials are stored in that profile’s Keychain item.

The account manager never sees or requests the password itself.

If creation fails before the window opens, no half-created visible profile remains.

---

Switching accounts

• Click another Guild Wars window.
• Select it from the Window menu.
• Select Focus in Account Hub.
• Select it from the Dock menu.
• Use normal macOS ⌘Tab and Mission Control behavior.

There is no application-specific input switching mode or global account hotkey.

---

Closing sessions

• Closing a game window closes only that session.
• Its filesystem is synced before destruction.
• Its sockets are closed.
• Other sessions continue uninterrupted.
• Closing the final game window quits the app unless Account Hub is open.
• Quit closes and syncs all sessions through one bounded cleanup operation.

A stuck session cannot indefinitely prevent the others from closing. If its filesystem cannot sync, the player gets a clear warning before a user-requested update or quit.

---

Storage model

One source of truth per concept

Concept	Owner
Profile identity and local label	profiles.json
Running/not-running status	In-memory window registry
ArenaNet credentials	Profile-scoped Keychain item
Steam token	Profile-scoped Keychain item
Game preferences and raw templates	Profile’s isolated IDBFS
App settings and update track	Existing global settings.json
Verified ArenaNet client	Shared ClientRuntime
Downloaded game chunks	Existing shared chunk store
Build and Team library	Existing global build-library.json
Per-window placement	Profile-scoped window state

No username, password, Steam token, character name, running state, or duplicated game-data location is stored in profiles.json.

Minimal profile registry

{
  "formatVersion": 1,
  "profiles": [
    {
      "id": "default",
      "label": "Main",
      "archived": false
    },
    {
      "id": "019f…",
      "label": "Storage",
      "archived": false
    }
  ]
}

Array order is display order. No additional ordering table or database is needed.

The technical term is profile; the player-facing term is account.

---

Filesystem isolation

Every profile receives a separate persistent Electron session and therefore a separate IndexedDB/IDBFS store.

This isolates:

• Guild Wars preferences
• Skill and equipment templates
• Screenshots
• Chat logs
• Other files written by the official client

The existing profile remains in the current default Electron session under gw://app. New profiles use derived persistent partitions.

Two active renderers must never mount the same IDBFS store.

Template behavior

There are two related but distinct concepts:

• GWonMac Builds and Teams remain globally shared.
• Raw Guild Wars template files belong to a profile.

Players can explicitly copy templates between profiles. Copying is:

• One-time, not live synchronization.
• Previewed before writing.
• Conflict-safe.
• Never destructive.
• Recorded only as the resulting files—there is no synchronization database.

When names conflict:

• Identical template: skip.
• Different template with same name: import under a unique name.
• Never overwrite silently.

---

Keychain specification

Each profile has two independent Data Protection Keychain items:

service = io.github.mat4m0.gwonmac
account = arena-net:<profile-id>

service = io.github.mat4m0.gwonmac
account = steam:<profile-id>

Requirements:

• kSecUseDataProtectionKeychain
• kSecAttrAccessibleWhenUnlockedThisDeviceOnly
• No iCloud synchronization
• No credentials in profile files
• No safeStorage or encrypted-file fallback
• No password or token in diagnostics
• No profile label used as a Keychain identifier
• Rename does not affect Keychain access
• Keychain read failure never deletes the item
• Preview, Release, and Development identities remain isolated

Each profile’s secret operations are serialized independently. A slow Keychain request for one account cannot block another account’s game traffic.

Forget saved login

Forget saved login:

• Clears the selected profile’s ArenaNet item.
• Clears its Steam item after explicit confirmation.
• Does not delete templates, preferences, screenshots, or the profile.
• Does not unlink an ArenaNet or Steam account.

---

Seamless migration

Existing player upgrade

On the first launch of the multi-account release:

1. Detect that profiles.json does not exist.

2. Atomically create the reserved default profile.

3. Keep the existing Electron default session and gw://app origin.

4. Do not move or rewrite existing IndexedDB.

5. Do not move:

   • settings.json
   • build-library.json
   • window-state.json
   • client generations
   • chunk storage
   • diagnostics

6. Migrate the existing Keychain items to default profile items.

7. Open the game exactly as before.

No migration screen is shown unless something needs player attention.

Keychain migration protocol

Migration is data-driven and restart-safe:

1. Read the legacy item.
2. If no legacy item exists, finish.
3. Write the new profile-scoped item.
4. Read the new item back.
5. Compare exact bytes.
6. Delete the legacy item only after successful verification.

Outcomes:

• Legacy only: copy and verify.
• New only: migration already completed.
• Both equal: remove legacy.
• Both different: preserve both and ask which saved login to keep.
• Keychain unavailable: preserve everything and continue to the login screen.

Application updates must never delete browser storage or Keychain entries as general recovery.

---

Multi-window runtime

Replace the global mainWindow assumption with a WindowRegistry.

The registry maps:

profile ID ↔ BrowserWindow ↔ webContents ID

It owns:

• Which profiles are running
• Focusing an existing profile
• IPC sender authorization
• Per-window cleanup
• Window title and menu targeting
• Socket ownership
• Diagnostics attribution
• Per-window crash recovery

A profile can have at most one game window.

Application menu actions always target the focused game window. They must not capture whichever window happened to be created last.

Shared runtime

There remains exactly one:

• ClientRuntime
• App updater
• Chunk store
• Active verified client generation
• Socket manager
• Diagnostics recorder
• App settings owner

The active client generation is immutable while any game window is using it.

---

Input and focus requirements

These are release-blocking requirements.

• Only the focused window receives keyboard and mouse input.
• Blur releases all held buttons and keys.
• Blur exits pointer lock.
• Opening Account Hub, Settings, a sheet, or a native menu resets game input.
• A background renderer cannot request focus.
• A background renderer cannot capture pointer lock.
• Reloading one renderer cannot affect another renderer’s input state.
• A renderer crash releases its complete input state.
• Overlapping windows work.
• Multiple windows on one display work.
• Multiple fullscreen windows work.
• Mission Control and ⌘Tab work.
• Moving a window between Retina and non-Retina displays works.
• No API exists for broadcasting or duplicating input.

---

Update experience

Application update

Application updates remain global.

When an update becomes ready:

Guild Wars Reforged 2026.9 is ready.

2 Guild Wars sessions are currently connected.

Restart and Update    Later

Restart and Update:

1. Resets input in every game window.
2. Requests an IDBFS sync from every renderer.
3. Reports any session that failed to save.
4. Closes all sockets.
5. Flushes profile window state and diagnostics.
6. Installs the update.
7. Reopens Account Hub.

If any filesystem sync fails, offer:

• Retry Save
• Cancel Update
• Update Anyway…

The risky action is never the default.

Automatic update checks remain disabled while any game socket is active, matching current behavior.

ArenaNet client update

• Checked and prepared once.
• Shared by every account.
• Never downloaded separately for each profile.
• One verified generation serves all active renderers.
• A candidate is not swapped underneath running sessions.
• Candidate health can be confirmed by the first successful renderer.
• Candidate failure cannot erase the previous verified generation.

---

Diagnostics and privacy

A problem report can be created for a specific game window.

It may include:

• Random diagnostic session ID
• Random profile ID
• Number of active game windows
• Which renderer failed
• Input/focus transitions
• Socket counts and closed outcomes
• Filesystem sync outcome
• Update and client-generation state

It must exclude:

• Profile label
• ArenaNet email
• Password
• Steam token
• Character names
• Chat
• Game packets
• Raw command-line or request bodies

Exports run the existing secret/path redactor automatically. Players should never need to manually remove an email or password before sharing a diagnostic archive.

---

Resource behavior

The release guarantee is:

Two simultaneous sessions are supported on the minimum supported Mac.

Additional sessions may be opened when resources permit, but no arbitrary maximum is promised until measured.

Requirements:

• Account Hub shows current active-session count.
• Before opening another session under significant memory pressure, warn rather than crashing silently.
• A warning never claims an exact safe count without measured evidence.
• Extended 4 GB mode explains that every active client receives a larger potential address space.
• Occluded and minimized windows rely on normal Chromium visibility throttling.
• Background sessions must not be programmatically kept rendering.
• One renderer reaching memory pressure does not automatically reload another.

---

Profile lifecycle

Rename

• Changes only the local label.
• Does not modify Keychain identifiers, filesystem partitions, or diagnostics IDs.
• Takes effect immediately in titles, Account Hub, Dock menu, and Window menu.

Archive

The normal removal action is reversible:

• Closes the profile if running.
• Hides it from the main account list.
• Preserves credentials and files.
• Can be restored from Settings → Accounts → Archived.

Delete local profile permanently

An advanced, confirmed action:

1. Profile must not be running.
2. Show what will be removed.
3. Offer template export.
4. Require an explicit destructive confirmation.
5. Clear profile Keychain items.
6. Remove only that profile’s browser partition and window state.
7. Preserve global downloads, builds, settings, and other profiles.

It never claims to delete the online ArenaNet account.

The reserved default profile can be renamed and archived but not permanently deleted while it remains the continuity owner of legacy browser storage.

---

User stories

US-01 — Existing player updates safely

As an existing player, I want to update to the multi-account release without a migration task so that I can continue playing immediately.

Acceptance:

• Existing templates remain.
• Existing saved login works.
• Existing settings and Build/Team library remain.
• No game data is downloaded again.
• The first launch looks unchanged.

US-02 — Add another account

As a player with a second account, I want to create a locally named profile and sign in through Guild Wars so that I do not give my password to another launcher interface.

Acceptance:

• Only a local label is requested.
• The official login opens.
• Remember Password stores credentials for this profile only.
• Cancelling leaves no corrupt profile.

US-03 — Open two accounts

As a player, I want to open two saved profiles from one account list so that both accounts can be online simultaneously.

Acceptance:

• Both windows render and connect independently.
• No second client download occurs.
• Each window has its profile label in the title.
• Each row accurately shows Open, Starting, or Focus.

US-04 — Avoid duplicate launches

As a player, I want repeated Open actions to focus an existing session so that accidental clicks do not create duplicates.

Acceptance:

• One profile has at most one game window.
• Double-clicking cannot race into two windows.
• A repeated app launch opens Account Hub.

US-05 — Switch windows reliably

As a player, I want to switch between overlapping clients without stuck movement, mouse capture, or surprise focus changes.

Acceptance:

• Focus never jumps between game windows.
• Blurred windows release input.
• Pointer lock belongs only to the focused window.
• Three overlapping-window stress tests pass.

US-06 — Keep local files separate

As a player, I want each account to keep its own preferences and saved files so that simultaneous sessions cannot overwrite one another.

Acceptance:

• A template created in one profile does not appear in another unless explicitly copied.
• Screenshots and chat logs remain isolated.
• Concurrent quit preserves both filesystems.

US-07 — Reuse templates

As a player, I want to copy templates from an existing profile when adding an account so that I do not rebuild my library manually.

Acceptance:

• Copy is previewed.
• Existing destination files are not overwritten.
• Conflicts receive deterministic unique names.
• Profiles do not become continuously synchronized.

US-08 — Share GWonMac Builds and Teams

As a player, I want my host-authored library available in every game window so that I can use the same builds across accounts.

Acceptance:

• One global library remains canonical.
• Concurrent stale writes are rejected or merged through domain operations.
• One window cannot silently erase another’s changes.
• Account-specific unlock problems are reported at Apply time.

US-09 — Save multiple logins securely

As a player, I want each profile to remember its own ArenaNet or Steam login so that choosing an account is enough to start.

Acceptance:

• Each profile has separate Keychain items.
• Renaming does not lose credentials.
• A locked Keychain returns to login without deleting anything.
• Credentials never appear in profile files or diagnostics.

US-10 — Close one account safely

As a player, I want to close one game window without disconnecting my other accounts.

Acceptance:

• Only that renderer’s filesystem and sockets are closed.
• Other sessions continue rendering and playing.
• Closing a crashed session remains possible.

US-11 — Update without data loss

As a player with multiple sessions open, I want updates to wait for me and save every profile before restarting.

Acceptance:

• Update status persists in the app.
• The confirmation states how many sessions will close.
• Every profile is synced.
• Failed sync is visible and Update Anyway is not the default.
• Profiles and Keychain items survive the signed replacement.

US-12 — Recover one failed session

As a player, I want a failed account launch or renderer crash to affect only that profile.

Acceptance:

• The row becomes Needs attention with Retry.
• Existing sessions stay connected.
• A failed renderer cannot close another renderer’s sockets.
• Crash recovery is tracked per window.

US-13 — Report a multi-window problem

As a player, I want one-click diagnostics for the affected account window so that I can report focus or launch failures without exposing credentials.

Acceptance:

• The export identifies the failing renderer anonymously.
• Account labels and credentials are excluded.
• Redaction is automatic.
• The report includes focus and filesystem-sync outcomes.

US-14 — Remove a profile without mistakes

As a player, I want to distinguish forgetting a password, hiding a profile, and deleting local files so that a simple cleanup action cannot erase templates.

Acceptance:

• These are three separate actions.
• Archive is reversible.
• Permanent deletion offers template export and explicit confirmation.
• Shared game downloads are never deleted by profile removal.

---

Non-goals

• Input broadcasting
• Synchronized window control
• Macros or automation
• Unattended gameplay
• Automatic character selection
• Generic custom launch arguments
• DLL/plugin/mod injection
• Wine prefixes or cloned installations
• Cloud account synchronization
• Sharing credentials between profiles
• Live synchronization of raw Guild Wars template directories
• Automatically reopening every previously active account
• Claiming support for an unmeasured number of sessions

---

Release gates

The feature is ready only when all of these pass:

1. Legacy continuity
   Signed old → new update preserves login, templates, settings, builds, and chunks.

2. Two-account live canary
   Two different accounts remain connected and playable simultaneously.

3. Storage isolation
   Concurrent template writes and relaunch preserve both profiles.

4. Input torture test
   Overlap, pointer lock, fullscreen, Mission Control, monitor changes, and rapid focus switching.

5. Lifecycle isolation
   Close, reload, crash, and retry one session while another remains connected.

6. Update continuity
   A ready application update syncs all sessions and preserves every profile after replacement.

7. Keychain continuity
   Multiple ArenaNet and Steam items survive move, relaunch, update, and Stable/Beta transitions.

8. Concurrent library integrity
   Two windows cannot lose Build/Team edits through stale whole-file writes.

9. Privacy
   Diagnostics contain no labels, usernames, passwords, tokens, chat, or packets.

10. Performance
    Two sessions pass the supported Mac’s memory, GPU, audio, and thermal qualification.

Recommended first shipping cut

The simplest production-worthy first release includes:

• Reserved Default migration
• Account Hub
• Add and rename profile
• Two simultaneous windows
• Separate IDBFS partitions
• Profile-scoped Keychain items
• Window registry and focused-menu routing
• Per-window close/crash/reload
• Multi-renderer quit/update synchronization
• Focus and pointer-lock certification
• Safe diagnostics

Template copying, Dock shortcuts, archive management, and more-than-two qualification can follow without changing the underlying storage model.

[Mat4m0]

#136