Persist profile state in SQLite with a durable background writer

config/build-plugins/plain-node-entry-guard.ts

@@ -16,15 +16,33 @@ type OutputChunk = Rollup.OutputChunk
 // electron, and smoke-loads daemon-entry under plain Node to prove its module
 // graph still resolves.
 
-// Entries executed as plain Node (ELECTRON_RUN_AS_NODE / no electron runtime):
-// forked daemon, parcel-watcher, WSL filesystem and computer sidecars, and the CLI-run
-// agent-hooks entry. require("electron") throws MODULE_NOT_FOUND in all of them.
+// The CLI loads these paths after electron-vite replaces out/main.
+export const CLI_MAIN_ENTRY_NAMES = [
+  'agent-hooks/managed-agent-hook-controls',
+  'codex/managed-home-shell-preflight',
+  'claude-accounts/keychain',
+  ...[
+    'access',
+    'active-location',
+    'storage-classification',
+    'offline-settings',
+    'export-path',
+    'backup-path',
+    'database-recovery',
+    'domain-reader',
+    'recovery',
+    'recovery-command'
+  ].map((module) => `persistence/profile-state/profile-state-${module}`),
+  'startup/http1-compatibility-marker'
+] as const
+
+// Plain-Node processes and CLI modules cannot load Electron's API.
 const PLAIN_NODE_ENTRY_NAMES = [
   'daemon-entry',
   'parcel-watcher-process-entry',
   'computer-sidecar',
   'wsl-transcript-fs-process-entry',
-  'agent-hooks/managed-agent-hook-controls'
+  ...CLI_MAIN_ENTRY_NAMES
 ] as const
 
 // Entries executed as worker threads of the main process. Electron's module is
@@ -41,7 +59,9 @@ const WORKER_THREAD_ENTRY_NAMES = [
   'session-scanner-worker-entry',
   'main-thread-hang-watchdog-entry',
   'port-scan-command-worker-entry',
-  'usage-scan-worker-entry'
+  'usage-scan-worker-entry',
+  'profile-state-backup-worker-entry',
+  'profile-state-writer-worker-entry'
 ] as const
 
 export const GUARDED_ENTRY_NAMES = [

config/electron-builder.config.cjs

@@ -281,6 +281,8 @@ module.exports = {
     'out/main/gemini/**',
     'out/main/grok/**',
     'out/main/hermes/**',
+    'out/main/persistence/profile-state/**',
+    'out/main/startup/http1-compatibility-marker.js',
     'out/main/daemon-entry.js',
     'out/main/session-scanner-service-entry.js',
     'out/main/wsl-transcript-fs-process-entry.js',

config/scripts/build-orcad.mjs

@@ -21,6 +21,7 @@ import {
 import { arch, platform, tmpdir } from 'node:os'
 import { join } from 'node:path'
 import process from 'node:process'
+import { smokeProfileStateWorkers } from './profile-state-worker-smoke.mjs'
 import {
   ORCAD_VERSION_FILENAME,
   ORCAD_RIPGREP_ARTIFACTS
@@ -99,10 +100,8 @@ cpSync(join(ROOT, 'resources', 'licenses', 'ripgrep'), join(OUT_DIR, 'ripgrep',
   recursive: true
 })
 
-/** Why one call per child and not one `outdir` build: esbuild mirrors each entry's source
- *  directory under `outdir`, and both children must land flat beside orcad.js — that is where
- *  their runtime resolvers look for them. */
-function buildForkedChild(entryPoint, outfile) {
+// Child and worker resolvers require flat entries beside orcad.js.
+function buildIsolatedEntry(entryPoint, outfile) {
   return build({
     entryPoints: [entryPoint],
     bundle: true,
@@ -120,9 +119,15 @@ function buildForkedChild(entryPoint, outfile) {
   })
 }
 
-const childResults = await Promise.all([
-  buildForkedChild(WATCHER_ENTRY, WATCHER_OUT_FILE),
-  buildForkedChild(DAEMON_ENTRY, DAEMON_OUT_FILE)
+const isolatedResults = await Promise.all([
+  buildIsolatedEntry(WATCHER_ENTRY, WATCHER_OUT_FILE),
+  buildIsolatedEntry(DAEMON_ENTRY, DAEMON_OUT_FILE),
+  ...['writer', 'backup'].map((role) =>
+    buildIsolatedEntry(
+      join(ROOT, `src/main/persistence/profile-state/profile-state-${role}-worker-entry.ts`),
+      join(OUT_DIR, `profile-state-${role}-worker-entry.js`)
+    )
+  )
 ])
 
 const result = await build({
@@ -147,9 +152,7 @@ const output = Object.values(result.metafile.outputs).find(
 // Why check `original` and not just `path`: when electron is bundleable, esbuild
 // rewrites `path` to the resolved file under node_modules and the naive check passes
 // while the package is very much in the bundle.
-// Why both metafiles: the forked children ship in the same deployment and run under the
-// same plain Node. A daemon-entry that reached electron would fail at fork time, on the
-// path whose whole point is that terminals survive.
+// Every isolated entry ships under the same plain-Node compatibility contract.
 function collectImporters(metafiles, matches) {
   const importers = new Set()
   for (const metafile of metafiles) {
@@ -164,7 +167,7 @@ function collectImporters(metafiles, matches) {
   return importers
 }
 
-const metafiles = [result.metafile, ...childResults.map((child) => child.metafile)]
+const metafiles = [result.metafile, ...isolatedResults.map((entry) => entry.metafile)]
 const electronImporters = collectImporters(
   metafiles,
   (specifier) => specifier === 'electron' || specifier.startsWith('electron/')
@@ -254,6 +257,12 @@ if (graphErrors.length > 0) {
     )
     process.exitCode = 1
   }
+  try {
+    await smokeProfileStateWorkers(OUT_DIR)
+  } catch (error) {
+    console.error('[build-orcad] profile state worker check failed:', error)
+    process.exitCode = 1
+  }
 }
 
 // Why a content hash and not ORCAD_VERSION alone: the remote install directory is keyed on
@@ -295,7 +304,10 @@ async function smokeLoadWatcherChild() {
         resolve(failure)
       }
       child.on('message', (message) => {
-        if (message?.op === 'subscribe-started') {
+        // Wait until the subscribe lifecycle has sent its final acknowledgement.
+        // Disconnecting on subscribe-started races the subsequent subscribed or
+        // subscribe-failed message and makes the child report an expected EPIPE.
+        if (message?.op === 'subscribed' || message?.op === 'subscribe-failed') {
           child.disconnect()
         }
       })

src/cli/main-module-bundle-parity.test.ts → config/scripts/cli-main-module-bundle-parity.test.ts

@@ -1,6 +1,8 @@
 import { readFileSync, readdirSync } from 'node:fs'
 import { join, resolve } from 'node:path'
 import { describe, expect, it } from 'vitest'
+import { electronViteConfig } from '../../electron.vite.config'
+import { GUARDED_ENTRY_NAMES } from '../build-plugins/plain-node-entry-guard'
 
 const REPO_ROOT = resolve(__dirname, '..', '..')
 const CLI_ROOT = join(REPO_ROOT, 'src', 'cli')
@@ -18,7 +20,7 @@ function listCliSourceFiles(dir: string): string[] {
 }
 
 // Why: `import type` is erased by tsc, so it needs no emitted module at runtime.
-const VALUE_IMPORT_FROM_MAIN = /(?<!\btype\s)from '\.\.\/\.\.\/main\/([^']+)'/g
+const VALUE_IMPORT_FROM_MAIN = /(?<!\btype\s)from '(?:\.\.\/)+main\/([^']+)'/g
 
 function findMainImports(): { file: string; module: string }[] {
   return listCliSourceFiles(CLI_ROOT).flatMap((file) => {
@@ -30,12 +32,12 @@ function findMainImports(): { file: string; module: string }[] {
   })
 }
 
-function findElectronViteMainEntries(): Set<string> {
-  const config = readFileSync(join(REPO_ROOT, 'electron.vite.config.ts'), 'utf-8')
-  return new Set(
-    // Why: entries wrap across lines once the path is long, so allow whitespace.
-    [...config.matchAll(/resolve\(\s*'src\/main\/([^']+)\.ts'\s*\)/g)].map((match) => match[1])
-  )
+function findElectronViteMainEntries(): Record<string, string> {
+  const input = electronViteConfig.main?.build?.rollupOptions?.input
+  if (!input || typeof input !== 'object' || Array.isArray(input)) {
+    throw new Error('Expected named main-process inputs')
+  }
+  return input
 }
 
 describe('CLI imports of main-process modules', () => {
@@ -45,14 +47,25 @@ describe('CLI imports of main-process modules', () => {
   // final-artifact runtime verifier.
   it('has an electron-vite entry for every main module the CLI imports', () => {
     const entries = findElectronViteMainEntries()
-    const missing = findMainImports().filter(({ module }) => !entries.has(module))
+    const missing = findMainImports().filter(
+      ({ module }) => entries[module] !== join(REPO_ROOT, 'src', 'main', `${module}.ts`)
+    )
 
     expect(missing).toEqual([])
   })
 
+  it('guards every CLI main module against Electron imports', () => {
+    const guarded = new Set<string>(GUARDED_ENTRY_NAMES)
+    expect(findMainImports().filter(({ module }) => !guarded.has(module))).toEqual([])
+  })
+
   it('finds the imports it is meant to guard', () => {
     // Why: a broken matcher would make the guard above vacuously pass.
+    expect(findMainImports()).toContainEqual({
+      file: join('src', 'cli', 'profile-state-location.ts'),
+      module: 'persistence/profile-state/profile-state-active-location'
+    })
     expect(findMainImports().length).toBeGreaterThanOrEqual(2)
-    expect(findElectronViteMainEntries().size).toBeGreaterThanOrEqual(2)
+    expect(Object.keys(findElectronViteMainEntries()).length).toBeGreaterThanOrEqual(2)
   })
 })

config/scripts/electron-vite-output-contract.test.ts

@@ -73,9 +73,7 @@ function failBootstrapWithBanner(options: {
   return processMock
 }
 
-const electronBuilderConfig = createRequire(import.meta.url)('../electron-builder.config.cjs') as {
-  files: string[]
-}
+const electronBuilderConfig = createRequire(import.meta.url)('../electron-builder.config.cjs')
 
 describe('Electron Vite output contract', () => {
   it("minifies main and renderer with rolldown's in-process minifier", () => {
@@ -104,6 +102,33 @@ describe('Electron Vite output contract', () => {
     expect(output.chunkFileNames).toBe('chunks/[name]-[hash].js')
   })
 
+  it('keeps offline profile-state CLI imports unpacked at stable paths', () => {
+    const input = electronViteConfig.main?.build?.rollupOptions?.input
+    if (!input || typeof input !== 'object' || Array.isArray(input)) {
+      throw new Error('Expected named main-process inputs')
+    }
+
+    for (const name of [
+      'persistence/profile-state/profile-state-access',
+      'persistence/profile-state/profile-state-active-location',
+      'persistence/profile-state/profile-state-backup-path',
+      'persistence/profile-state/profile-state-database-recovery',
+      'persistence/profile-state/profile-state-domain-reader',
+      'persistence/profile-state/profile-state-export-path',
+      'persistence/profile-state/profile-state-offline-settings',
+      'persistence/profile-state/profile-state-recovery',
+      'persistence/profile-state/profile-state-recovery-command',
+      'persistence/profile-state/profile-state-storage-classification',
+      'startup/http1-compatibility-marker'
+    ]) {
+      expect(input).toHaveProperty(name)
+    }
+    expect(electronBuilderConfig.asarUnpack).toContain('out/main/persistence/profile-state/**')
+    expect(electronBuilderConfig.asarUnpack).toContain(
+      'out/main/startup/http1-compatibility-marker.js'
+    )
+  })
+
   it('externalizes packaged dependencies but bundles self-contained main dependencies', () => {
     const external = electronViteConfig.main?.build?.rollupOptions?.external
     if (typeof external !== 'function') {

config/scripts/plain-node-entry-guard.test.ts

@@ -4,6 +4,7 @@ import { join } from 'node:path'
 import type { Plugin, Rollup } from 'vite'
 import { afterEach, describe, expect, it } from 'vitest'
 import {
+  CLI_MAIN_ENTRY_NAMES,
   createPlainNodeEntryGuardPlugin,
   GUARDED_ENTRY_NAMES
 } from '../build-plugins/plain-node-entry-guard'
@@ -158,8 +159,8 @@ describe('guarded entry names', () => {
 // main-process worker and kills it at startup. The worker entries carried only
 // hand-written "must stay electron-free" comments, and the port-scan worker sits
 // one import away from a client that deliberately does require electron.
-describe('worker thread entry guard', () => {
-  function runWorkerWriteBundle(plugin: Plugin, bundle: Rollup.OutputBundle): void {
+describe('CLI and worker thread entry guard', () => {
+  function runEntryWriteBundle(plugin: Plugin, bundle: Rollup.OutputBundle): void {
     const hook = plugin.writeBundle
     if (typeof hook !== 'function') {
       throw new Error('Expected writeBundle hook')
@@ -171,7 +172,7 @@ describe('worker thread entry guard', () => {
     )
   }
 
-  function workerChunk(name: string, code: string, imports: string[] = []): Rollup.OutputChunk {
+  function entryChunk(name: string, code: string, imports: string[] = []): Rollup.OutputChunk {
     return {
       type: 'chunk',
       code,
@@ -183,33 +184,54 @@ describe('worker thread entry guard', () => {
     } as Rollup.OutputChunk
   }
 
+  it.each(CLI_MAIN_ENTRY_NAMES)('rejects direct and transitive Electron imports in %s', (name) => {
+    const plugin = createPlainNodeEntryGuardPlugin()
+    const entry = entryChunk(name, 'require("electron")')
+    const bundle: Rollup.OutputBundle = { [entry.fileName]: entry }
+    expect(() => runEntryWriteBundle(plugin, bundle)).toThrow('requires electron')
+
+    entry.code = ''
+    const shared = entryChunk('shared', 'require("electron/main")')
+    shared.isEntry = false
+    bundle[shared.fileName] = shared
+    for (const edge of ['imports', 'dynamicImports'] as const) {
+      entry[edge] = [shared.fileName]
+      expect(() => runEntryWriteBundle(plugin, bundle)).toThrow('requires electron')
+      entry[edge] = []
+    }
+
+    shared.code = 'require("node:fs")'
+    entry.imports = [shared.fileName]
+    expect(() => runEntryWriteBundle(plugin, bundle)).not.toThrow()
+  })
+
   it('rejects an Electron require reachable from a worker entry', () => {
     const plugin = createPlainNodeEntryGuardPlugin()
-    const bundle = {
-      'port-scan-command-worker-entry.js': workerChunk(
+    const bundle: Rollup.OutputBundle = {
+      'port-scan-command-worker-entry.js': entryChunk(
         'port-scan-command-worker-entry',
         'require("electron")'
       )
-    } as Rollup.OutputBundle
+    }
 
-    expect(() => runWorkerWriteBundle(plugin, bundle)).toThrow('requires electron')
+    expect(() => runEntryWriteBundle(plugin, bundle)).toThrow('requires electron')
   })
 
   it('names the worker-thread runtime so the failure is actionable', () => {
     const plugin = createPlainNodeEntryGuardPlugin()
-    const bundle = {
-      'stt-worker.js': workerChunk('stt-worker', 'require("electron")')
-    } as Rollup.OutputBundle
+    const bundle: Rollup.OutputBundle = {
+      'stt-worker.js': entryChunk('stt-worker', 'require("electron")')
+    }
 
-    expect(() => runWorkerWriteBundle(plugin, bundle)).toThrow('runs as a worker thread')
+    expect(() => runEntryWriteBundle(plugin, bundle)).toThrow('runs as a worker thread')
   })
 
   // The real risk is transitive: a worker entry importing a shared chunk that
   // reaches the electron-requiring client, not a direct import anyone would spot.
   it('follows shared chunks out of a worker entry', () => {
     const plugin = createPlainNodeEntryGuardPlugin()
-    const bundle = {
-      'session-scanner-opencode-sqlite-worker-entry.js': workerChunk(
+    const bundle: Rollup.OutputBundle = {
+      'session-scanner-opencode-sqlite-worker-entry.js': entryChunk(
         'session-scanner-opencode-sqlite-worker-entry',
         'require("./chunks/shared.js")',
         ['chunks/shared.js']
@@ -223,20 +245,20 @@ describe('worker thread entry guard', () => {
         isEntry: false,
         name: 'shared'
       } as Rollup.OutputChunk
-    } as Rollup.OutputBundle
+    }
 
-    expect(() => runWorkerWriteBundle(plugin, bundle)).toThrow('chunks/shared.js')
+    expect(() => runEntryWriteBundle(plugin, bundle)).toThrow('chunks/shared.js')
   })
 
   it('passes a clean worker entry', () => {
     const plugin = createPlainNodeEntryGuardPlugin()
-    const bundle = {
-      'warp-theme-parser-worker.js': workerChunk(
+    const bundle: Rollup.OutputBundle = {
+      'warp-theme-parser-worker.js': entryChunk(
         'warp-theme-parser-worker',
         'require("node:worker_threads")'
       )
-    } as Rollup.OutputBundle
+    }
 
-    expect(() => runWorkerWriteBundle(plugin, bundle)).not.toThrow()
+    expect(() => runEntryWriteBundle(plugin, bundle)).not.toThrow()
   })
 })