Merge branch 'main' into fix/guard-pending-transfer-quit

application/app/__fixtures__/transferQuitRenderer.cjs

@@ -0,0 +1,43 @@
+// A separate renderer thread lets the real main-process timeout run while
+// window.confirm is synchronously blocked, just like Electron's native dialog.
+require("tsx/cjs");
+const { parentPort, workerData } = require("node:worker_threads");
+const { EventEmitter } = require("node:events");
+const React = require("react");
+const { act, create } = require("react-test-renderer");
+const { useAppStartupEffects } = require("../useAppStartupEffects.ts");
+const { sftpTransferCenterStore } = require("../../state/sftpTransferCenterStore.ts");
+const { netcattyBridge } = require("../../../infrastructure/services/netcattyBridge.ts");
+const { createPreloadApi } = require("../../../electron/preload/api.cjs");
+const signal = new Int32Array(workerData.signal);
+let resumes = 0;
+global.IS_REACT_ACT_ENVIRONMENT = true;
+global.window = {
+  confirm() {
+    parentPort.postMessage({ type: "prompt" });
+    Atomics.wait(signal, 0, 0, 10000);
+    return workerData.accept;
+  },
+};
+sftpTransferCenterStore.getSnapshot = () => ({ tasks: [{ id: "held-prompt", status: "transferring" }] });
+sftpTransferCenterStore.pause = async () => {};
+sftpTransferCenterStore.resume = async () => { resumes++; };
+const ipcRenderer = Object.assign(new EventEmitter(), {
+  send(channel, payload) { parentPort.postMessage({ type: "reply", channel, payload }); },
+});
+const preload = createPreloadApi({ ipcRenderer, webUtils: {} });
+netcattyBridge.get = () => ({
+  onCheckDirtyEditors(callback) {
+    return preload.onCheckDirtyEditors((request) => {
+      void callback(request).then(() => parentPort.postMessage({ type: "done", resumes }));
+    });
+  },
+  reportDirtyEditorsResult: preload.reportDirtyEditorsResult,
+});
+function Probe() {
+  useAppStartupEffects({ enabled: false, updateState: {}, sessions: [], hosts: [], keys: [], identities: [], knownHosts: [], proxyProfiles: [], groupConfigs: [], workspaces: [], portForwardingRules: [], t: (key) => key });
+  return null;
+}
+parentPort.on("message", ({ channel, payload }) => ipcRenderer.emit(channel, {}, payload));
+void act(async () => { create(React.createElement(Probe)); })
+  .then(() => parentPort.postMessage({ type: "ready" }));

application/app/useAppStartupEffects.transferQuit.integration.test.ts

@@ -0,0 +1,114 @@
+/* eslint-disable @typescript-eslint/no-explicit-any -- Electron boundary doubles exercise production modules. */
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { EventEmitter } from 'node:events';
+import { createRequire } from 'node:module';
+import { useAppStartupEffects } from './useAppStartupEffects.ts';
+import { sftpTransferCenterStore } from '../state/sftpTransferCenterStore.ts';
+import { netcattyBridge } from '../../infrastructure/services/netcattyBridge.ts';
+const require = createRequire(import.meta.url);
+const React = require('react');
+const { act, create } = require('react-test-renderer');
+const { createMainWindowApi } = require('../../electron/bridges/windowManager/mainWindow.cjs');
+const { queryDirtyEditors } = require('../../electron/bridges/dirtyEditorGuard.cjs');
+const { createPreloadApi } = require('../../electron/preload/api.cjs');
+
+// No Electron UI, sockets, real transfers, or preferences. Only the network
+// pause completion is held. Actual renderer hook, window close callback, and
+// dirty-query helper run together with the actual 5000ms production deadline.
+for (const slowPause of [true, false]) test(`${slowPause ? 'slow pause refuses close at the production deadline' : 'control: fast pause preserves Cancel'}`, { timeout: 8000 }, async t => {
+  const oldWindow = Object.getOwnPropertyDescriptor(globalThis, 'window');
+  const oldAct = Object.getOwnPropertyDescriptor(globalThis, 'IS_REACT_ACT_ENVIRONMENT');
+  let confirmations = 0, reports = 0, resumeCalls = 0;
+  Object.defineProperty(globalThis, 'window', { configurable: true, value: { confirm() { confirmations++; return false; } } });
+  Object.defineProperty(globalThis, 'IS_REACT_ACT_ENVIRONMENT', { configurable: true, value: true });
+  let renderer: any, releasePause: any;
+  const queryPromises: Promise<void>[] = [];
+  const pause = new Promise<void>(resolve => { releasePause = resolve; });
+  if (!slowPause) releasePause();
+  const ipcMain = new EventEmitter();
+  let win: any;
+  t.after(async () => {
+    releasePause(); await Promise.allSettled(queryPromises);
+    await act(async () => renderer?.unmount());
+    if (oldWindow) Object.defineProperty(globalThis, 'window', oldWindow); else Reflect.deleteProperty(globalThis, 'window');
+    if (oldAct) Object.defineProperty(globalThis, 'IS_REACT_ACT_ENVIRONMENT', oldAct); else Reflect.deleteProperty(globalThis, 'IS_REACT_ACT_ENVIRONMENT');
+  });
+  t.mock.method(sftpTransferCenterStore, 'getSnapshot', () => ({ tasks: [{ id: 'slow-upload', status: 'transferring' }] }) as any);
+  t.mock.method(sftpTransferCenterStore, 'pause', () => pause);
+  t.mock.method(sftpTransferCenterStore, 'resume', async () => { resumeCalls++; });
+  const ipcRenderer = Object.assign(new EventEmitter(), {
+    send(channel: string, payload: any) { reports++; ipcMain.emit(channel, { sender: win.webContents }, payload); },
+  });
+  const preload = createPreloadApi({ ipcRenderer, webUtils: {} });
+  t.mock.method(netcattyBridge, 'get', () => ({
+    onCheckDirtyEditors(callback: any) {
+      return preload.onCheckDirtyEditors((request: any) => { queryPromises.push(callback(request)); });
+    },
+    reportDirtyEditorsResult: preload.reportDirtyEditorsResult,
+  }));
+  function Probe() {
+    useAppStartupEffects({ enabled: false, updateState: {}, sessions: [], hosts: [], keys: [], identities: [], knownHosts: [], proxyProfiles: [], groupConfigs: [], workspaces: [], portForwardingRules: [], t: (key: string) => key } as any);
+    return null;
+  }
+  await act(async () => { renderer = create(React.createElement(Probe)); });
+  class Window extends EventEmitter {
+    destroyed = false;
+    webContents = Object.assign(new EventEmitter(), {
+      id: 71, isDestroyed: () => this.destroyed, isCrashed: () => false,
+      setWindowOpenHandler() {}, openDevTools() {},
+      send(channel: string, payload: any) { ipcRenderer.emit(channel, {}, payload); },
+    });
+    close() { const event = { prevented: false, preventDefault() { this.prevented = true; } }; this.emit('close', event); if (!event.prevented) { this.destroyed = true; this.emit('closed'); } }
+    isDestroyed() { return this.destroyed; }
+    isMaximized() { return false; }
+    isFullScreen() { return false; }
+    getBounds() { return { width: 1000, height: 700 }; }
+    setBackgroundColor() {}
+    loadURL() { return Promise.resolve(); }
+  }
+  const api = createMainWindowApi({
+    mainWindow: null, electronApp: null, currentTheme: 'light', isQuitting: false,
+    pendingWindowStateWrite: null, queuedWindowState: null,
+    DEFAULT_WINDOW_WIDTH: 1400, DEFAULT_WINDOW_HEIGHT: 900, MIN_WINDOW_WIDTH: 1100, MIN_WINDOW_HEIGHT: 640,
+    V8_CACHE_OPTIONS: 'code', THEME_COLORS: { light: {} },
+    unhealthyWebContentsIds: new Set(), rendererReadySeenByWebContentsId: new Set(),
+    __dirname: '/unused/electron/bridges', URL, require, console, setTimeout, clearTimeout,
+    getGlobalShortcutBridge: () => ({ handleWindowClose: () => false }), getMainWindowCount: () => 1,
+    debugLog() {}, resolveFrontendBackgroundColor() { return null; }, loadWindowState() { return null; },
+    getDevRendererBaseUrl: (url: string) => url, getWindowBoundsState() { return null; },
+    queueWindowStateSave() {}, saveWindowStateSync() {}, setupDeferredShow() {},
+    createExternalOnlyWindowOpenHandler() { return {}; }, createAppWindowOpenHandler() { return {}; },
+    attachOAuthLoadingOverlay() {}, registerWindowHandlers() {}, requestWindowCommandClose() {}, shouldCloseWindowFromInput() { return false; },
+    registerMainWindow() {}, unregisterMainWindow() {}, registerAppContentWindow() {}, unregisterAppContentWindow() {},
+    notifyAppContentWindowClosed() {}, applyWindowOpacityToWindow() {}, closeSettingsWindow() {}, hideSettingsWindow() {},
+    hasEditorTabsForSource: () => false, closeEditorTabsForSource: async () => ({ success: true }),
+    queryDirtyEditors(wc: any, timeout: number, options: any) {
+      assert.equal(timeout, 5000, 'real close callback supplies the 5-second timeout');
+      return queryDirtyEditors(wc, timeout, options);
+    },
+  });
+  win = await api.createWindow({ BrowserWindow: Window, nativeTheme: {}, app: {}, screen: {}, shell: {}, ipcMain }, {
+    preload: '/tmp/unused-preload.cjs', devServerUrl: 'http://localhost:5173', isDev: true, isMac: false,
+    electronDir: '/unused/electron', registerAsMainWindow: true,
+  });
+  win.close();
+  assert.equal(win.destroyed, false, 'first close is correctly guarded');
+  await new Promise(resolve => setTimeout(resolve, slowPause ? 5250 : 50));
+  if (!slowPause) {
+    assert.equal(confirmations, 1); assert.equal(reports, 2); assert.equal(resumeCalls, 1);
+    assert.equal(win.destroyed, false, 'Cancel keeps owner alive when pause settles before deadline');
+    console.log('QUIT_FAST_CONTROL', JSON.stringify({ ownerAlive: true, confirmations, reports, resumeCalls }));
+    return;
+  }
+  assert.equal(confirmations, 0, 'slow pause prevents prompt');
+  assert.equal(win.destroyed, false, 'deadline refuses close while the pause is pending');
+  assert.equal(reports, 1, 'only the pending-transfer acknowledgement has been sent');
+  assert.equal(ipcMain.listenerCount('app:dirty-editors-result'), 0, 'main query is settled, not hung');
+  releasePause(); await Promise.allSettled(queryPromises);
+  await new Promise(resolve => setTimeout(resolve, 10));
+  assert.equal(confirmations, 0, 'the expired request must not show a late prompt');
+  assert.equal(win.destroyed, false);
+  assert.equal(resumeCalls, 1);
+  console.log('QUIT_TIMEOUT_REGRESSION', JSON.stringify({ ownerAlive: true, productionDeadlineMs: 5000, scaling: false, resumeCalls }));
+});

application/app/useAppStartupEffects.transferQuit.prompt.test.cjs

@@ -0,0 +1,52 @@
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const { EventEmitter, once } = require("node:events");
+const { Worker } = require("node:worker_threads");
+const { queryDirtyEditors } = require("../../electron/bridges/dirtyEditorGuard.cjs");
+
+for (const accept of [false, true]) {
+  test(`native confirmation held beyond deadline: late ${accept ? "Accept" : "Cancel"} keeps the owner alive`, { timeout: 10000 }, async (t) => {
+    const signal = new SharedArrayBuffer(4);
+    const worker = new Worker(require.resolve("./__fixtures__/transferQuitRenderer.cjs"), {
+      workerData: { accept, signal },
+    });
+    const ipcMain = new EventEmitter();
+    const events = new EventEmitter();
+    const replies = [];
+    let promptShown = false;
+    let closed = false;
+    const wc = {
+      isDestroyed: () => closed,
+      isCrashed: () => false,
+      send(channel, payload) { worker.postMessage({ channel, payload }); },
+    };
+    t.after(async () => { Atomics.store(new Int32Array(signal), 0, 1); Atomics.notify(new Int32Array(signal), 0); await worker.terminate(); });
+    worker.on("message", (message) => {
+      if (message.type === "reply") {
+        replies.push(message.payload);
+        ipcMain.emit(message.channel, { sender: wc }, message.payload);
+      } else {
+        if (message.type === "prompt") promptShown = true;
+        events.emit(message.type, message);
+      }
+    });
+    worker.on("error", (error) => events.emit("error", error));
+    await once(events, "ready");
+    const started = Date.now();
+    const result = await queryDirtyEditors(wc, 5000, { ipcMain });
+    if (!result) closed = true;
+    assert.equal(promptShown, true);
+    assert.equal(result, "transfers");
+    assert.equal(closed, false, "main refuses close while the renderer is blocked in its native prompt");
+    assert.ok(Date.now() - started >= 4900, "use the unchanged five-second production deadline");
+    assert.equal(ipcMain.listenerCount("app:dirty-editors-result"), 0, "main settled without hanging");
+    const done = once(events, "done");
+    Atomics.store(new Int32Array(signal), 0, 1);
+    Atomics.notify(new Int32Array(signal), 0);
+    const [completed] = await done;
+    assert.equal(completed.resumes, 1);
+    assert.equal(replies.at(-1).hasDirty, true, "an expired Accept cannot authorize a later close");
+    assert.equal(replies.at(-1).reason, "transfers");
+    assert.equal(closed, false);
+  });
+}

application/app/useAppStartupEffects.transferQuit.test.ts

@@ -1,11 +1,28 @@
 import assert from "node:assert/strict";
 import test from "node:test";
 import React from "react";
+import type { TransferTask } from "../../domain/models";
 import { act, create, type ReactTestRenderer } from "react-test-renderer";
 import { useAppStartupEffects } from "./useAppStartupEffects.ts";
 import { sftpTransferCenterStore } from "../state/sftpTransferCenterStore.ts";
 import { netcattyBridge } from "../../infrastructure/services/netcattyBridge.ts";
 
+const makeTask = (id: string, status: TransferTask["status"]): TransferTask => ({
+  id,
+  fileName: `${id}.txt`,
+  sourcePath: `/source/${id}.txt`,
+  targetPath: `/target/${id}.txt`,
+  sourceConnectionId: "local",
+  targetConnectionId: "remote",
+  direction: "upload",
+  status,
+  totalBytes: 10,
+  transferredBytes: 2,
+  speed: 1,
+  startTime: 1,
+  isDirectory: false,
+});
+
 for (const accept of [false, true]) {
   test(`app Quit with an unfinished transfer: ${accept ? "confirm quits" : "declining reports \"transfers\" before resuming only transferring and queued tasks"}`, async (t) => {
     const previous = Object.getOwnPropertyDescriptor(globalThis, "IS_REACT_ACT_ENVIRONMENT");
@@ -13,7 +30,8 @@ for (const accept of [false, true]) {
     const g = globalThis as unknown as { window?: { confirm?: (m: string) => boolean } };
     const hadWindow = "window" in g; const previousConfirm = g.window?.confirm;
     if (!g.window) g.window = {};
-    g.window.confirm = () => accept;
+    let prompts = 0;
+    g.window.confirm = () => { prompts++; return accept; };
     let renderer: ReactTestRenderer | undefined;
     let releaseResume!: () => void;
     const resumeGate = new Promise<void>((resolve) => { releaseResume = resolve; });
@@ -76,12 +94,159 @@ for (const accept of [false, true]) {
     }
     assert.equal(resumeSettled, false, "the dirty-check reply must not wait for resume");
     if (accept) {
-      assert.deepEqual(reports, [[false, undefined]]);
-      assert.deepEqual(calls, [...paused, "report"], "accepted quit leaves every prompted task paused");
+      assert.deepEqual(reports, [[true, "transfers"], [false, undefined]]);
+      assert.deepEqual(calls, ["report", ...paused, "report"], "accepted quit leaves every prompted task paused");
     } else {
-      assert.deepEqual(reports, [[true, "transfers"]], "main must be told the prompt was already answered");
-      assert.deepEqual(calls, [...paused, "report", "resume:running", "resume:queued"],
+      assert.deepEqual(reports, [[true, "transfers"], [true, "transfers"]], "main must be told the prompt was already answered");
+      assert.deepEqual(calls, ["report", ...paused, "report", "resume:running", "resume:queued"],
         "report precedes resume, and only transferring/queued rows the prompt paused are resumed");
+      // Dedicated resume promises can represent the whole transfer lifetime.
+      // A second close must still prompt while those promises remain pending.
+      await query();
+      assert.equal(prompts, 2);
+      assert.equal(resumeSettled, false);
+      assert.equal(reports.length, 4);
     }
   });
 }
+
+for (const outcome of ["pause-rejected", "pause-expired", "prompt-expired"] as const) {
+  test(`transfer quit refuses ${outcome} and resumes only the formerly active task`, async (t) => {
+    const previousWindow = Object.getOwnPropertyDescriptor(globalThis, "window");
+    const previousAct = Object.getOwnPropertyDescriptor(globalThis, "IS_REACT_ACT_ENVIRONMENT");
+    let renderer: ReactTestRenderer | undefined;
+    let now = 0;
+    let prompts = 0;
+    let resumes = 0;
+    const replies: Array<{ dirty: boolean; reason?: string; requestId?: string; pending?: boolean }> = [];
+    let query!: (request: { requestId: string; deadline: number }) => Promise<void>;
+    t.mock.method(Date, "now", () => now);
+    Object.defineProperty(globalThis, "IS_REACT_ACT_ENVIRONMENT", { configurable: true, value: true });
+    Object.defineProperty(globalThis, "window", { configurable: true, value: {
+      confirm() { prompts++; now = 6000; return true; },
+    } });
+    t.after(async () => {
+      await act(async () => renderer?.unmount());
+      if (previousWindow) Object.defineProperty(globalThis, "window", previousWindow); else Reflect.deleteProperty(globalThis, "window");
+      if (previousAct) Object.defineProperty(globalThis, "IS_REACT_ACT_ENVIRONMENT", previousAct); else Reflect.deleteProperty(globalThis, "IS_REACT_ACT_ENVIRONMENT");
+    });
+    t.mock.method(sftpTransferCenterStore, "getSnapshot", () => ({ activeCount: 1, queuedCount: 0, attentionCount: 0, tasks: [makeTask("running", "transferring")] }));
+    t.mock.method(sftpTransferCenterStore, "pause", async () => {
+      if (outcome === "pause-rejected") throw new Error("pause failed");
+      if (outcome === "pause-expired") now = 6000;
+    });
+    t.mock.method(sftpTransferCenterStore, "resume", async () => { resumes++; });
+    t.mock.method(netcattyBridge, "get", () => ({
+      onCheckDirtyEditors: (callback: typeof query) => { query = callback; return () => {}; },
+      reportDirtyEditorsResult: (dirty: boolean, reason?: string, options?: { requestId?: string; pending?: boolean }) => {
+        replies.push({ dirty, reason, ...options });
+      },
+    }));
+    function Probe() {
+      useAppStartupEffects({ enabled: false, updateState: {}, sessions: [], hosts: [], keys: [], identities: [], knownHosts: [], proxyProfiles: [], groupConfigs: [], workspaces: [], portForwardingRules: [], t: (key: string) => key });
+      return null;
+    }
+    await act(async () => { renderer = create(React.createElement(Probe)); });
+    await query({ requestId: outcome, deadline: 5000 });
+    assert.deepEqual(replies, [
+      { dirty: true, reason: "transfers", requestId: outcome, pending: true },
+      { dirty: true, reason: "transfers", requestId: outcome },
+    ]);
+    assert.equal(prompts, outcome === "prompt-expired" ? 1 : 0);
+    assert.equal(resumes, 1);
+  });
+}
+
+test("a cancelled task can close after an expired stuck pause, and its late completion cannot resume it", async (t) => {
+  const previousWindow = Object.getOwnPropertyDescriptor(globalThis, "window");
+  const previousAct = Object.getOwnPropertyDescriptor(globalThis, "IS_REACT_ACT_ENVIRONMENT");
+  let renderer: ReactTestRenderer | undefined;
+  let now = 0;
+  let cancelled = false;
+  let prompts = 0;
+  let resumes = 0;
+  let releasePause!: () => void;
+  const pause = new Promise<void>((resolve) => { releasePause = resolve; });
+  const replies: Array<{ dirty: boolean; requestId?: string; pending?: boolean }> = [];
+  let query!: (request: { requestId: string; deadline: number }) => Promise<void>;
+  t.mock.method(Date, "now", () => now);
+  Object.defineProperty(globalThis, "IS_REACT_ACT_ENVIRONMENT", { configurable: true, value: true });
+  Object.defineProperty(globalThis, "window", { configurable: true, value: { confirm() { prompts++; return false; } } });
+  t.after(async () => {
+    releasePause();
+    await act(async () => renderer?.unmount());
+    if (previousWindow) Object.defineProperty(globalThis, "window", previousWindow); else Reflect.deleteProperty(globalThis, "window");
+    if (previousAct) Object.defineProperty(globalThis, "IS_REACT_ACT_ENVIRONMENT", previousAct); else Reflect.deleteProperty(globalThis, "IS_REACT_ACT_ENVIRONMENT");
+  });
+  t.mock.method(sftpTransferCenterStore, "getSnapshot", () => ({ activeCount: cancelled ? 0 : 1, queuedCount: 0, attentionCount: 0, tasks: [makeTask("stuck", cancelled ? "cancelled" : "transferring")] }));
+  t.mock.method(sftpTransferCenterStore, "pause", () => pause);
+  t.mock.method(sftpTransferCenterStore, "resume", async () => { resumes++; });
+  t.mock.method(netcattyBridge, "get", () => ({
+    onCheckDirtyEditors: (callback: typeof query) => { query = callback; return () => {}; },
+    reportDirtyEditorsResult: (dirty: boolean, _reason?: string, options?: { requestId?: string; pending?: boolean }) => replies.push({ dirty, ...options }),
+  }));
+  function Probe() {
+    useAppStartupEffects({ enabled: false, updateState: {}, sessions: [], hosts: [], keys: [], identities: [], knownHosts: [], proxyProfiles: [], groupConfigs: [], workspaces: [], portForwardingRules: [], t: (key: string) => key });
+    return null;
+  }
+  await act(async () => { renderer = create(React.createElement(Probe)); });
+  const first = query({ requestId: "stuck", deadline: 5000 });
+  await query({ requestId: "overlap", deadline: 5000 });
+  assert.deepEqual(replies.at(-1), { dirty: true, requestId: "overlap" });
+  now = 6000;
+  cancelled = true;
+  await query({ requestId: "after-cancel", deadline: 11000 });
+  assert.deepEqual(replies.at(-1), { dirty: false, requestId: "after-cancel" });
+  const replyCount = replies.length;
+  releasePause();
+  await first;
+  assert.equal(replies.length, replyCount, "superseded attempt must not reply again");
+  assert.equal(prompts, 0);
+  assert.equal(resumes, 0, "late completion must not undo the user's cancellation");
+});
+
+test("retry Cancel preserves the expired attempt auto-resume ownership", async (t) => {
+  const previousWindow = Object.getOwnPropertyDescriptor(globalThis, "window");
+  const previousAct = Object.getOwnPropertyDescriptor(globalThis, "IS_REACT_ACT_ENVIRONMENT");
+  let renderer: ReactTestRenderer | undefined;
+  let now = 0;
+  let status: TransferTask["status"] = "transferring";
+  let prompts = 0;
+  let resumes = 0;
+  let releasePause!: () => void;
+  const pause = new Promise<void>((resolve) => { releasePause = resolve; });
+  const replies: Array<{ dirty: boolean; requestId?: string; pending?: boolean }> = [];
+  let query!: (request: { requestId: string; deadline: number }) => Promise<void>;
+  t.mock.method(Date, "now", () => now);
+  Object.defineProperty(globalThis, "IS_REACT_ACT_ENVIRONMENT", { configurable: true, value: true });
+  Object.defineProperty(globalThis, "window", { configurable: true, value: { confirm() { prompts++; return false; } } });
+  t.after(async () => {
+    releasePause();
+    await act(async () => renderer?.unmount());
+    if (previousWindow) Object.defineProperty(globalThis, "window", previousWindow); else Reflect.deleteProperty(globalThis, "window");
+    if (previousAct) Object.defineProperty(globalThis, "IS_REACT_ACT_ENVIRONMENT", previousAct); else Reflect.deleteProperty(globalThis, "IS_REACT_ACT_ENVIRONMENT");
+  });
+  t.mock.method(sftpTransferCenterStore, "getSnapshot", () => ({ activeCount: status === "transferring" || status === "pausing" ? 1 : 0, queuedCount: 0, attentionCount: 0, tasks: [makeTask("stuck", status)] }));
+  t.mock.method(sftpTransferCenterStore, "pause", () => { status = "pausing"; return pause; });
+  t.mock.method(sftpTransferCenterStore, "resume", async () => { resumes++; });
+  t.mock.method(netcattyBridge, "get", () => ({
+    onCheckDirtyEditors: (callback: typeof query) => { query = callback; return () => {}; },
+    reportDirtyEditorsResult: (dirty: boolean, _reason?: string, options?: { requestId?: string; pending?: boolean }) => replies.push({ dirty, ...options }),
+  }));
+  function Probe() {
+    useAppStartupEffects({ enabled: false, updateState: {}, sessions: [], hosts: [], keys: [], identities: [], knownHosts: [], proxyProfiles: [], groupConfigs: [], workspaces: [], portForwardingRules: [], t: (key: string) => key });
+    return null;
+  }
+  await act(async () => { renderer = create(React.createElement(Probe)); });
+  const first = query({ requestId: "stuck", deadline: 5000 });
+  await query({ requestId: "overlap", deadline: 5000 });
+  assert.deepEqual(replies.at(-1), { dirty: true, requestId: "overlap" });
+  now = 6000;
+  const retry = query({ requestId: "retry", deadline: 11000 });
+  status = "paused";
+  releasePause();
+  await Promise.all([first, retry]);
+  assert.equal(prompts, 1);
+  assert.equal(resumes, 1, "Cancel must restore work running before the first attempt");
+  assert.deepEqual(replies.at(-1), { dirty: true, requestId: "retry" });
+});

application/app/useAppStartupEffects.ts

@@ -344,12 +344,26 @@ export function useAppStartupEffects(ctx: StartupEffectsContext) {
     };
   }, [enabled, hasRuntimeTunnel, hosts, sessions, portForwardingRules, workspaces]);
 
+  const transferQuitPendingRef = useRef<{ deadline: number; resumeTaskIds: Set<string> } | null>(null);
+
   // Quit guard: block app exit while any editor tab has unsaved changes.
   // Main process sends "app:query-dirty-editors"; we respond with the result.
   useEffect(() => {
     const bridge = netcattyBridge.get();
     if (!bridge?.onCheckDirtyEditors) return;
-    const unsub = bridge.onCheckDirtyEditors(async () => {
+    const unsub = bridge.onCheckDirtyEditors(async (request) => {
+      const response = { requestId: request?.requestId };
+      // Another close request must not start a second pause/prompt while the
+      // first attempt is still pausing or awaiting a decision.
+      const previousAttempt = transferQuitPendingRef.current;
+      if (previousAttempt && Date.now() < previousAttempt.deadline) {
+        bridge.reportDirtyEditorsResult?.(true, "transfers", response);
+        return;
+      }
+      // An expired pause may never settle. Let a retry re-check current tasks
+      // (including a user's cancellation), without granting the old attempt
+      // permission to prompt or resume over that newer decision.
+      let attempt: typeof previousAttempt = null;
       // Always report SOMETHING so the main process doesn't time out for
       // 5 s on an unhandled exception. If we can't determine the state,
       // fail open — losing unsaved work is bad, but stranding the user
@@ -374,24 +388,44 @@ export function useAppStartupEffects(ctx: StartupEffectsContext) {
           if (unfinishedTasks.length > 0) {
             const resumable = unfinishedTasks.filter((task) => (
               task.status === "transferring" || task.status === "queued"
+              || previousAttempt?.resumeTaskIds.has(task.id)
             ));
-            await Promise.allSettled(unfinishedTasks.map((task) => sftpTransferCenterStore.pause(task.id)));
-            hasDirty = !window.confirm(t('sftp.transferCenter.quitConfirm', { count: unfinishedTasks.length }));
-            if (hasDirty) {
-              // The user chose to stay. Main must hear that before any resume:
-              // resume can outlive the 5s dirty-check timeout, and a late reply
-              // lets the app quit anyway. The synchronous dialog is also skipped
-              // because this prompt was already answered.
-              reason = "transfers";
-              tasksToResume = resumable;
+            // A slow pause must never turn the main-process timeout into
+            // permission to quit before the user has made a decision.
+            hasDirty = true;
+            reason = "transfers";
+            tasksToResume = resumable;
+            // A retry inherits the still-unfinished rows the expired attempt
+            // auto-paused. Their current status may already be pausing/paused.
+            attempt = {
+              deadline: request?.deadline ?? Date.now() + 5000,
+              resumeTaskIds: new Set(resumable.map((task) => task.id)),
+            };
+            transferQuitPendingRef.current = attempt;
+            bridge.reportDirtyEditorsResult?.(true, reason, { ...response, pending: true });
+            const paused = await Promise.allSettled(unfinishedTasks.map((task) => sftpTransferCenterStore.pause(task.id)));
+            if (transferQuitPendingRef.current !== attempt) return;
+            const expired = () => request && Date.now() >= request.deadline;
+            if (!expired() && paused.every((result) => result.status === "fulfilled")) {
+              hasDirty = !window.confirm(t('sftp.transferCenter.quitConfirm', { count: unfinishedTasks.length }));
+              // The native prompt can itself outlive the main-process deadline.
+              // An expired acceptance is not permission for a later close attempt.
+              if (expired()) hasDirty = true;
             }
+            if (!hasDirty) {
+              reason = undefined;
+              tasksToResume = [];
+            }
+          } else {
+            // All prior work was finished/cancelled; invalidate its late pause.
+            transferQuitPendingRef.current = null;
           }
         }
       } catch (err) {
         console.error('[App] dirty-editors check failed:', err);
       }
       try {
-        bridge.reportDirtyEditorsResult?.(hasDirty, reason);
+        bridge.reportDirtyEditorsResult?.(hasDirty, reason, response);
       } catch (err) {
         // Reporting itself shouldn't throw, but if the IPC bridge is in a
         // bad state we'd rather log than bubble out of the listener and
@@ -399,8 +433,12 @@ export function useAppStartupEffects(ctx: StartupEffectsContext) {
         console.error('[App] reportDirtyEditorsResult failed:', err);
       }
       if (tasksToResume.length > 0) {
+        // Report refusal before recovery, which may itself take a long time.
+        // A resume promise can span the entire transfer, so do not hold the
+        // close gate until it settles. A later close must be able to pause again.
         void Promise.allSettled(tasksToResume.map((task) => sftpTransferCenterStore.resume(task.id)));
       }
+      if (transferQuitPendingRef.current === attempt) transferQuitPendingRef.current = null;
     });
     return unsub;
   }, [enabled, t]);

application/state/editorWindowClient.test.ts

@@ -2,7 +2,7 @@ import assert from "node:assert/strict";
 import test from "node:test";
 import { netcattyBridge } from "../../infrastructure/services/netcattyBridge.ts";
 import { editorTabStore } from "./editorTabStore.ts";
-import { dockDetachedEditorTab, installEditorWindowSourceListeners, popOutEditorTab, saveDetachedEditorTab } from "./editorWindowClient.ts";
+import { dockDetachedEditorTab, installEditorWindowSourceListeners, popOutEditorTab, saveDetachedEditorTab, subscribeEditorWindowDirtyCheck } from "./editorWindowClient.ts";
 import { registerEditorSftpWriterScoped } from "./editorSftpBridge.ts";
 import { releaseEditorTabSaveCoordinator } from "./editorTabSave.ts";
 import type { EditorWindowSaveRequest, EditorWindowSaveResult } from "./editorWindowTypes.ts";
@@ -145,3 +145,16 @@ test("a closing destination rejects a popout without releasing source content",
   assert.equal(tab.baselineContent, "v1");
   assert.equal(editorTabStore.isDirty(tab.id), true);
 });
+
+
+test("detached editor dirty-check replies echo the main-process request", (t) => {
+  let query!: (request: { requestId: string; deadline: number }) => void;
+  const replies: unknown[] = [];
+  t.mock.method(netcattyBridge, "get", () => ({
+    onCheckDirtyEditors: (callback: typeof query) => { query = callback; return () => {}; },
+    reportDirtyEditorsResult: (...args: unknown[]) => replies.push(args),
+  }));
+  t.after(subscribeEditorWindowDirtyCheck(() => true));
+  query({ requestId: "detached-check", deadline: Date.now() + 5000 });
+  assert.deepEqual(replies, [[true, undefined, { requestId: "detached-check" }]]);
+});

application/state/editorWindowClient.ts

@@ -200,7 +200,7 @@ export function reportEditorWindowCloseTabsResult(
 export function subscribeEditorWindowDirtyCheck(cb: () => boolean): () => void {
   const bridge = netcattyBridge.get();
   if (!bridge?.onCheckDirtyEditors) return () => {};
-  return bridge.onCheckDirtyEditors(() => {
+  return bridge.onCheckDirtyEditors((request) => {
     let hasDirty = false;
     try {
       hasDirty = cb() === true;
@@ -208,7 +208,7 @@ export function subscribeEditorWindowDirtyCheck(cb: () => boolean): () => void {
       hasDirty = false;
     }
     try {
-      bridge.reportDirtyEditorsResult?.(hasDirty);
+      bridge.reportDirtyEditorsResult?.(hasDirty, undefined, { requestId: request?.requestId });
     } catch {
       // ignore
     }

electron/bridges/dirtyEditorGuard.cjs

@@ -1,3 +1,5 @@
+const { randomUUID } = require("node:crypto");
+
 /**
  * Dirty-editor guard helper.
  *
@@ -17,7 +19,8 @@
  *
  * Sends "app:query-dirty-editors" to the given webContents and resolves with
  * the renderer's reply. Resolves `false` (fail-open) if the renderer never
- * answers within `timeoutMs`, if the webContents can't be messaged, or if the
+ * answers within `timeoutMs` without acknowledging unfinished transfers,
+ * if the webContents can't be messaged, or if the
  * send throws — in every one of those cases there is no usable UI to surface a
  * "save first" warning on, so blocking the quit would only strand the user.
  *
@@ -31,7 +34,7 @@
  * @param {number} timeoutMs - Max time to wait for the renderer reply.
  * @param {{ ipcMain?: import("electron").IpcMain }} [options] - Inject ipcMain
  *   for tests; defaults to electron's ipcMain.
- * @returns {Promise<boolean>} true when the renderer reports unsaved changes.
+ * @returns {Promise<boolean | "transfers">} Truthy when closing must be refused.
  */
 function queryDirtyEditors(webContents, timeoutMs, options = {}) {
   const ipcMain = options.ipcMain || resolveIpcMain();
@@ -43,6 +46,8 @@ function queryDirtyEditors(webContents, timeoutMs, options = {}) {
   }
 
   return new Promise((resolve) => {
+    const request = { requestId: randomUUID(), deadline: Date.now() + timeoutMs };
+    let transfersPending = false;
     let settled = false;
     let timeoutId = null;
 
@@ -62,7 +67,11 @@ function queryDirtyEditors(webContents, timeoutMs, options = {}) {
       // Use `.on` (not `.once`) so a rogue reply from another window doesn't
       // consume the listener slot and let the real reply fall through. A
       // missing/falsy sender is anomalous and treated as a wrong-window reply.
-      if (evt?.sender !== webContents) return;
+      if (evt?.sender !== webContents || payload?.requestId !== request.requestId) return;
+      if (payload.pending === true && payload.hasDirty === true && payload.reason === "transfers") {
+        transfersPending = true;
+        return;
+      }
       // "transfers": the user already declined the renderer's unfinished-
       // transfer quit prompt. Still truthy, so existing callers keep quit
       // cancelled; handleBeforeQuit uses it to skip the editor dialog.
@@ -71,11 +80,13 @@ function queryDirtyEditors(webContents, timeoutMs, options = {}) {
     ipcMain.on("app:dirty-editors-result", onResult);
 
     // Timeout fallback: if the renderer never replies (crash, unhandled
-    // exception in its listener, etc.) we must not hang forever. Fail open.
-    timeoutId = setTimeout(() => settle(false), timeoutMs);
+    // exception in its listener, etc.) we must not hang forever. Once the
+    // renderer identifies unfinished transfers, silence is not permission to
+    // discard them. Keep the ordinary unresponsive-editor fallback unchanged.
+    timeoutId = setTimeout(() => settle(transfersPending ? "transfers" : false), timeoutMs);
 
     try {
-      webContents.send("app:query-dirty-editors");
+      webContents.send("app:query-dirty-editors", request);
     } catch (err) {
       // webContents.send can throw if the renderer was destroyed between the
       // isCrashed?.() check above and this call (a real race when the GPU

electron/bridges/dirtyEditorGuard.test.cjs

@@ -32,7 +32,8 @@ function makeWebContents() {
   const sent = [];
   return {
     sent,
-    send(channel) {
+    send(channel, request) {
+      this.request = request;
       sent.push(channel);
     },
     isDestroyed() {
@@ -52,7 +53,7 @@ test("resolves true when the renderer reports dirty editors", async () => {
   // The request is sent on the queried webContents.
   assert.deepEqual(wc.sent, ["app:query-dirty-editors"]);
   // Renderer replies from the same webContents.
-  ipcMain.emit("app:dirty-editors-result", { sender: wc }, { hasDirty: true });
+  ipcMain.emit("app:dirty-editors-result", { sender: wc }, { requestId: wc.request.requestId, hasDirty: true });
 
   assert.equal(await promise, true);
   // Listener was torn down.
@@ -64,7 +65,7 @@ test("resolves false when the renderer reports no dirty editors", async () => {
   const wc = makeWebContents();
 
   const promise = queryDirtyEditors(wc, 5000, { ipcMain });
-  ipcMain.emit("app:dirty-editors-result", { sender: wc }, { hasDirty: false });
+  ipcMain.emit("app:dirty-editors-result", { sender: wc }, { requestId: wc.request.requestId, hasDirty: false });
 
   assert.equal(await promise, false);
   assert.equal(ipcMain.listenerCount("app:dirty-editors-result"), 0);
@@ -75,7 +76,7 @@ test("a missing hasDirty payload is treated as not-dirty (fail open)", async ()
   const wc = makeWebContents();
 
   const promise = queryDirtyEditors(wc, 5000, { ipcMain });
-  ipcMain.emit("app:dirty-editors-result", { sender: wc }, undefined);
+  ipcMain.emit("app:dirty-editors-result", { sender: wc }, { requestId: wc.request.requestId });
 
   assert.equal(await promise, false);
 });
@@ -96,7 +97,7 @@ test("ignores replies from a different webContents, then times out to false", as
 
     // A rogue reply from another window claims dirty — it must be ignored, and
     // the listener must remain installed (we use .on, not .once).
-    ipcMain.emit("app:dirty-editors-result", { sender: otherWc }, { hasDirty: true });
+    ipcMain.emit("app:dirty-editors-result", { sender: otherWc }, { requestId: wc.request.requestId, hasDirty: true });
     assert.equal(ipcMain.listenerCount("app:dirty-editors-result"), 1);
 
     // No real reply ever arrives → the timeout fires and resolves false.
@@ -121,7 +122,7 @@ test("a falsy sender on the reply is rejected (treated as wrong window)", async
   };
   try {
     const promise = queryDirtyEditors(wc, 5000, { ipcMain });
-    ipcMain.emit("app:dirty-editors-result", { sender: null }, { hasDirty: true });
+    ipcMain.emit("app:dirty-editors-result", { sender: null }, { requestId: wc.request.requestId, hasDirty: true });
     // Not settled by the anomalous reply.
     assert.equal(ipcMain.listenerCount("app:dirty-editors-result"), 1);
     timeoutFn();
@@ -144,7 +145,7 @@ test("a late timeout cannot override an already-received reply", async () => {
   try {
     const promise = queryDirtyEditors(wc, 5000, { ipcMain });
     // Real reply: dirty=true.
-    ipcMain.emit("app:dirty-editors-result", { sender: wc }, { hasDirty: true });
+    ipcMain.emit("app:dirty-editors-result", { sender: wc }, { requestId: wc.request.requestId, hasDirty: true });
     // A stale timeout fires afterwards — it must be a no-op (settled guard).
     timeoutFn();
     assert.equal(await promise, true);
@@ -226,10 +227,53 @@ test("carries a declined unfinished-transfer prompt as a truthy \"transfers\" re
   const ipcMain = makeIpcMain();
   const wc = makeWebContents();
   const promise = queryDirtyEditors(wc, 5000, { ipcMain });
-  ipcMain.emit("app:dirty-editors-result", { sender: wc }, { hasDirty: true, reason: "transfers" });
+  ipcMain.emit("app:dirty-editors-result", { sender: wc }, { requestId: wc.request.requestId, hasDirty: true, reason: "transfers" });
   assert.equal(await promise, "transfers");
   // A clean reply that names a reason is still clean.
   const clean = queryDirtyEditors(wc, 5000, { ipcMain });
-  ipcMain.emit("app:dirty-editors-result", { sender: wc }, { hasDirty: false, reason: "transfers" });
+  ipcMain.emit("app:dirty-editors-result", { sender: wc }, { requestId: wc.request.requestId, hasDirty: false, reason: "transfers" });
   assert.equal(await clean, false);
 });
+
+
+test("unfinished-transfer acknowledgement changes only that request's timeout to fail closed", async () => {
+  const ipcMain = makeIpcMain();
+  const wc = makeWebContents();
+  const waiting = queryDirtyEditors(wc, 20, { ipcMain });
+  ipcMain.emit("app:dirty-editors-result", { sender: wc }, {
+    requestId: wc.request.requestId, hasDirty: true, reason: "transfers", pending: true,
+  });
+  assert.equal(await waiting, "transfers");
+  assert.equal(ipcMain.listenerCount("app:dirty-editors-result"), 0);
+  assert.equal(await queryDirtyEditors(wc, 20, { ipcMain }), false);
+});
+
+test("an expired query's late acceptance cannot authorize a later close", async () => {
+  const ipcMain = makeIpcMain();
+  const wc = makeWebContents();
+  const first = queryDirtyEditors(wc, 20, { ipcMain });
+  const oldRequest = wc.request;
+  ipcMain.emit("app:dirty-editors-result", { sender: wc }, {
+    requestId: oldRequest.requestId, hasDirty: true, reason: "transfers", pending: true,
+  });
+  assert.equal(await first, "transfers");
+  const second = queryDirtyEditors(wc, 1000, { ipcMain });
+  assert.notEqual(wc.request.requestId, oldRequest.requestId);
+  ipcMain.emit("app:dirty-editors-result", { sender: wc }, { requestId: oldRequest.requestId, hasDirty: false });
+  assert.equal(ipcMain.listenerCount("app:dirty-editors-result"), 1);
+  ipcMain.emit("app:dirty-editors-result", { sender: wc }, {
+    requestId: wc.request.requestId, hasDirty: true, reason: "transfers",
+  });
+  assert.equal(await second, "transfers");
+  assert.equal(ipcMain.listenerCount("app:dirty-editors-result"), 0);
+});
+
+test("wrong-window pending acknowledgement cannot change the timeout fallback", async () => {
+  const ipcMain = makeIpcMain();
+  const wc = makeWebContents();
+  const waiting = queryDirtyEditors(wc, 20, { ipcMain });
+  ipcMain.emit("app:dirty-editors-result", { sender: makeWebContents() }, {
+    requestId: wc.request.requestId, hasDirty: true, reason: "transfers", pending: true,
+  });
+  assert.equal(await waiting, false);
+});

electron/preload/api.cjs

@@ -1457,12 +1457,14 @@ function createPreloadApi(ctx) {
   // Quit guard: main process asks whether any editor tabs have unsaved changes.
   // Returns an unsubscribe function so React effects can clean up on unmount.
   onCheckDirtyEditors: (listener) => {
-    const handler = () => listener();
+    const handler = (_event, request) => listener(request);
     ipcRenderer.on("app:query-dirty-editors", handler);
     return () => ipcRenderer.removeListener("app:query-dirty-editors", handler);
   },
   // Renderer reports the dirty-check result back to the main process.
-  reportDirtyEditorsResult: (hasDirty, reason) => ipcRenderer.send("app:dirty-editors-result", { hasDirty, reason }),
+  reportDirtyEditorsResult: (hasDirty, reason, options) => ipcRenderer.send("app:dirty-editors-result", {
+    hasDirty, reason, requestId: options?.requestId, pending: options?.pending === true,
+  }),
   
   // Port Forwarding API
   startPortForward: async (options) => {

types/global/netcatty-bridge-sync.d.ts

@@ -295,10 +295,10 @@ declare global {
     onAppLockReopen?(listener: () => void): () => void;
 
     // Quit guard: subscribe to main-process quit requests that query for dirty editors.
-    // Listener is called with no arguments; return value is an unsubscribe function.
-    onCheckDirtyEditors?(listener: () => void): () => void;
+    // Each response must echo the request ID, including pending-transfer acknowledgements.
+    onCheckDirtyEditors?(listener: (request: { requestId: string; deadline: number }) => void): () => void;
     // Report the dirty-check result back to the main process.
-    reportDirtyEditorsResult?(hasDirty: boolean, reason?: "editors" | "transfers"): void;
+    reportDirtyEditorsResult?(hasDirty: boolean, reason?: "editors" | "transfers", options?: { requestId?: string; pending?: boolean }): void;
 
     onLanguageChanged?(cb: (language: string) => void): () => void;