- root cause: window-all-closed called killBackend() (windows: taskkill /F) BEFORE before-quit could POST /shutdown-all, so the backend died before running stop_all(), orphaning the bundled vite node.exe; a running node.exe locks its own image at resources\node\x64\node.exe, so the next nsis upgrade cannot overwrite it and surfaces appCannotBeClosed via the file-lock retry path (extractAppPackage.nsh / installUtil.nsh), not the name-based app-running check
- windows-only because mac's killBackend sends SIGTERM, letting uvicorn run its lifespan shutdown -> stop_all(); only since 1.1.64 because app builder first spawned these children on windows in bf6d7a9 (before that they died with WinError 2)
- electron/main.js: drop the premature killBackend() in window-all-closed (will-quit still kills the backend, now AFTER the reap) and raise the pre-quit reap budget from 2s to 10s to cover stop_all's parallel taskkill (up to 5s) + 3s grace
- electron/build/installer-recovery.nsh: replace the customInit orphan-killer (wmic, removed from windows 11 24H2 so it silently no-oped) with a path-scoped powershell Stop-Process; backtick-delimited for valid nsis tokenization, verified the macro compiles with makensis + the bundled nsExec plugin
- mac unaffected: will-quit already kills the backend; the app reap just runs explicitly via /shutdown-all now instead of riding on SIGTERM timing; the .nsh path is windows-only
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- root cause: window-all-closed called killBackend() (windows: taskkill /F) BEFORE before-quit could POST /shutdown-all, so the backend was dead before it could run stop_all(), orphaning the bundled vite node.exe; a running node.exe locks its own image at resources\node\x64\node.exe, so the next nsis upgrade cannot overwrite it and surfaces appCannotBeClosed via the file-lock retry path (extractAppPackage.nsh / installUtil.nsh), not the name-based app-running check
- windows-only because mac's killBackend sends SIGTERM, which lets uvicorn run its lifespan shutdown -> stop_all(); only since 1.1.64 because app builder first started spawning these children on windows in bf6d7a9 (before that they died with WinError 2)
- fix: drop the premature killBackend() in window-all-closed (will-quit still kills the backend, now AFTER the reap) and raise the pre-quit reap budget from 2s to 10s to cover stop_all's parallel taskkill (up to 5s) + 3s SIGTERM grace
- mac unaffected: will-quit already kills the backend; the app reap simply runs explicitly via /shutdown-all now instead of riding on SIGTERM timing
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- installation_id was created lazily on the first analytics submission; 1.1.64 removed the workflows startup poller, which was the early backend ping that used to generate it, so on a clean install the sign-in window built its google/email oauth url with an empty install_id and the cloud rejected the start
- now generated in main.py at the same pre-bind moment as the auth token, so GET /api/settings carries it from the very first fetch (no dependency on analytics timing)
- idempotent uuid4 hex, only written when missing; lazy path kept as fallback; platform-agnostic so mac is unchanged except the id exists slightly earlier
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
preload.js awaited two ipcRenderer.invoke calls before exposing
window.openswarm. Renderer code running in the gap saw the global
undefined: BrowserCard fell back to iframe mode (grey panel on sites
with X-Frame-Options), and chat-spawn calls to getAuthToken threw at
mount, crashing the renderer on Electron 40 + Windows.
Only bit Windows post-lazy-boot (ddd82ef): startBackend now loads main
while preload runs. Mac lacks the downstream native crash trigger;
pre-lazy Windows had idle IPC at preload time.
Replace awaits with sendSync against new ipcMain.on mirrors.
backendPort is assigned before any window exists, so sendSync at
preload time always finds a real value.
The render-process-gone handler called mainWindow.reload() to recover from
renderer crashes (e.g. WebGL / native / OOM in chat-spawn flows). On the
Electron 40 CastLabs build the reload re-registers a session/webview observer
that Chromium base/observer_list.h:318 refuses to add twice. The DCHECK
aborts the entire main process with exit 3, taking the app down whenever the
renderer dies.
Recreate the BrowserWindow instead: a fresh webContents has no duplicate
observers to add. The closed handler is identity-checked so the old window
teardown does not null out the new mainWindow reference.
When the 3-in-60s crash cap trips we now surface a native dialog (Reload /
Quit) instead of leaving a stuck dead window. Native dialog runs outside the
render-process-gone call stack, so its Reload button cannot itself reproduce
the DCHECK.
Bumps to 1.1.43 (re-cutting the deleted release draft).
Eric