You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(desktop): input during window teardown no longer throws in the main process - #33620
Quitting the desktop app with a held ⌘Q (Confirm quit: Hold) can show a main-process TypeError: Object has been destroyed dialog. A held quit can fire from the grace timer, so the trailing Q key-up reaches the before-input-event listener in apps/desktop/src/window/DesktopWindow.ts while the window is being torn down. That listener reads window.webContents to call setIgnoreMenuShortcuts without an isDestroyed() check, and Electron throws on any member access of a destroyed BrowserWindow. The sibling input-event listener (trackpad scroll begin/end) has the same missing guard.
Change
Both listeners now return early when window.isDestroyed(), the same guard the zoom-changed listener and the other handlers in the file already use. In before-input-event the guard comes after quitShortcutHandler(event, input), so the quit-hold flow still sees the trailing key-up. The guard is on the window, not window.webContents.isDestroyed(), because reading .webContents is itself what throws.
DesktopWindow > ignores input that arrives after the window is destroyed (new, apps/desktop/src/window/DesktopWindow.test.ts) marks the fake window destroyed, makes webContents throw TypeError("Object has been destroyed") as Electron does, then sends a trailing ⌘Q keyUp to before-input-event and a gestureScrollEnd to input-event. It fails on main with AssertionError: expected [Function] to not throw an error but 'TypeError: Object has been destroyed' was thrown, and still fails with only the before-input-event guard. With this change all 28 tests in the file pass.
vp run check:changed after merging main: format, lint, knip, typecheck and tests pass.
Evidence
The real T3 desktop app (the built dist-electron/main.cjs with its preload, renderer and bundled server) ran on Linux with Confirm quit set to Hold. Base is main at bbdc7dca and head is a103cf6d; the later head only merges main. Each side ran from its own checkout with fresh, isolated state. The fix has no rendered surface, so the proof is a set of chronological main-process transcripts. The driver captures the listener the app itself registered and calls that retained callback; it never copies the implementation.
Environment: Ubuntu 24.04, Electron 44.10.1 / Chromium 152, headless-desktop with Xvfb 1920×1080, scale 1, T3CODE_DEV_SEED=0.
All three throw on base. All three return on head, with no menu call and no IPC.
input-event after destroy: gestureScrollBegin, gestureScrollEnd, mouseMove
same
same
Begin and end throw on base and return without IPC on head. mouseMove returns on both.
Live window controls: Ctrl+W down, repeat and up; plain W; Ctrl+X; Alt/Shift+Ctrl+W; gesture begin and end
same
same
All ten outcomes are identical on base and head: menu interception, repeat prevention and scroll IPC.
What else changed: only the exceptions after destroy disappear. Outcomes on the live window match exactly (behaviour diff, comparison). Startup timing, repeat cadence and process IDs vary between runs.
cannot-verify macos: the native ⌘Q hold timing was not reproduced on macOS. On Linux, the native trailing key-up never reaches the listener under Xvfb, so the release route is a labelled harness run on the real app.
Verification log
Review round 1: two independent reviewers, both MERGE, with no findings. Not a sensitive area and no product decision.
Proof audit: pass 1 derived the matrix (matrix). Pass 2 returned SUFFICIENT. It rebuilt the after-side listener capture independently and all 16 case results matched (rebuilt logs).
Tests: 28/28 in DesktopWindow.test.ts. The quit-handler suite also passes.
Merged main at ad98905; the fix diff is unchanged.
AI-assisted; verified with the tests and tools listed above.
…33614)
Quitting with a held Cmd+Q can tear the window down before the trailing
Q keyUp reaches the before-input-event listener, which then calls
window.webContents.setIgnoreMenuShortcuts on a destroyed window and
throws "TypeError: Object has been destroyed". The sibling input-event
listener has the same missing guard. This test fails on main for both.
AI-assisted; verified with the tests and tools listed above.
…in process
A trailing key-up (e.g. releasing a held Cmd+Q) can reach the window's
before-input-event and input-event listeners after the BrowserWindow is
destroyed. Both read window.webContents unguarded, so Electron threw
"TypeError: Object has been destroyed" as an uncaught main-process error.
Both listeners now return early once the window is destroyed, like the
zoom-changed listener. The quit shortcut handler still runs first in
before-input-event, since it guards its own window access and must see
the key-up.
Fixes#33614
AI-assisted; verified with the tests and tools listed above.
Macroscope's review found this PR approvable — Adds guards that prevent keyboard and gesture events from accessing a destroyed desktop window during teardown. Normal input behavior remains unchanged, with no material operational or data risk identified.
No code changes detected at a364c2a. Prior analysis still applies.
You can add or adjust custom eligibility rules. Learn more.
No actionable comments were generated in the recent review.
Walkthrough
The main window’s input handlers now return when the window is destroyed. A regression test checks that trailing Cmd+Q key-up and scroll-end events do not throw.
Changes: Destroyed-window input handling
Layer / File(s)
Summary
Guard input handlers after destruction apps/desktop/src/window/DesktopWindow.ts, apps/desktop/src/window/DesktopWindow.test.ts
Both input handlers return before processing events when the window is destroyed. The test verifies that trailing Cmd+Q key-up and scroll-end events do not throw.
pingdotgg/t3code#25188: Adds macOS swipe handling to the input-event path. This PR adds a destruction guard to that path.
Suggested reviewers:yash-singh1
Merge Risk: Minimal · up to a364c
The input handlers guard destroyed windows, with no actionable merge-blocking risk identified.
Pre-merge checks: 4
Check name
Status
Explanation
Title check
The title clearly describes the fix for input events during window teardown. It is specific to the main change.
Description check
The description covers the problem, change, scope, and detailed verification. It also notes that macOS timing was not verified. Although it says AI assistance was used, it does not name the model and …
Linked Issues check
Issue #33614 requires a destroyed-window guard before before-input-event accesses window.webContents, plus a regression test. The reviewed summary reports that DesktopWindow.ts checks `window.is…
Out of Scope Changes check
The current PR summary identifies changes to the two DesktopWindow listeners and their regression test. These changes address issue #33614. The large incremental diff includes a merge of main; it do…
Full details: Description check
Explanation
The description covers the problem, change, scope, and detailed verification. It also notes that macOS timing was not verified. Although it says AI assistance was used, it does not name the model and harness requested by the template; the remaining content is complete.
Full details: Linked Issues check
Explanation
Issue #33614 requires a destroyed-window guard before before-input-event accesses window.webContents, plus a regression test. The reviewed summary reports that DesktopWindow.ts checks window.isDestroyed() after quitShortcutHandler and before the access. The test covers a trailing Cmd+Q key-up after destruction. The added input-event guard covers the same teardown failure in the related listener.
Full details: Out of Scope Changes check
Explanation
The current PR summary identifies changes to the two DesktopWindow listeners and their regression test. These changes address issue #33614. The large incremental diff includes a merge of main; it does not establish unrelated changes in the PR diff from the supplied merge base.
Finishing Touches
Generate docstrings
Commit to this branch
Create a new PR
Generate unit tests (beta)
Commit to this branch
Create a new PR
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Reviewing files that changed from the base of the PR and between 6512788 and a364c2a.
Files selected for processing: 2
apps/desktop/src/window/DesktopWindow.test.ts
apps/desktop/src/window/DesktopWindow.ts
Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 1 remain after this review.
Built and ran both revisions as real Electron desktop apps in separate worktrees. Every capture uses Linux x86_64, Electron 44.10.1, Xvfb 1920×1080, a 1100×780 app window, light theme, and fresh isolated state with imports disabled.
With quit mode Hold, focus the workspace, wait two seconds, press Ctrl-Q twice using xdotool key --delay 40 ctrl+q ctrl+q, then observe for five seconds. The identical driver produces the destroyed-object exception on base and a clean quit on head (exit status 0).
The held-key comparison used identical 300 ms / 30 Hz repeat settings and a two-second hold; it did not reproduce the bug on base. Internal stack paths are masked in the recordings; the exception text remains visible.
…contrast
* origin/main: (480 commits)
fix(scripts): scenarios run where localhost resolves to IPv6 first (pingdotgg#34121)
feat(opencode): track native image job outcomes and previews (pingdotgg#34089)
fix(web): scroll project picker to top on first result (pingdotgg#34113)
feat(server): voice models reuse copies already on disk (pingdotgg#34096)
fix(desktop): desktop IPC only answers the main app window (pingdotgg#34094)
feat(claude): Fable resets are offered and redeemed apart from weekly resets (pingdotgg#34106)
feat(scripts): scenarios prove a fix in the real app with e2e, on web and iOS (pingdotgg#34007)
fix(web): question panel header text sits centered in its row (pingdotgg#34095)
fix(server): a t3 thread send to a finished delegated child notifies its parent (pingdotgg#33446)
feat(mobile): pick a voice environment once, then its method (pingdotgg#34073)
fix(mobile): attaching larger images no longer crashes with a BigInt error (pingdotgg#34087)
fix(server): quitting stops an agent-device daemon left by an earlier server (pingdotgg#33587)
fix(web): sent messages keep the numbers written on list items (pingdotgg#33820)
fix(desktop): input during window teardown no longer throws in the main process (pingdotgg#33620)
fix(web): preserve previews during attachment preparation (pingdotgg#33949)
feat(usage): show Muse Code limits, and xAI and Antigravity accounts from a CLIProxyAPI hub (pingdotgg#33800)
fix(server): text generation fallback respects project provider settings (pingdotgg#33741)
fix(web): sending from an empty citation comment clears the composer (pingdotgg#33440)
fix(github): a proxy's 403 with Retry-After is no longer reported as a rate limit (pingdotgg#33676)
fix(web,mobile): replace sparkles icons and ban them with a lint rule (pingdotgg#25422)
...
# Conflicts:
# pnpm-lock.yaml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
bugfixFix PR opened by an issue lead; enters the PR looppr:needs-verificationReviewed and green; needs a run on a desktop, Android or iOS device and captures postedsize:XS0-9 changed lines (additions + deletions).vouch:trustedPR author is trusted by repo permissions or the VOUCHED list.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
github-actions
Bot
added
vouch:trusted
![macroscopeapp[bot]](https://avatars.githubusercontent.com/in/900172?s=60&v=4){kind=small}
juliusmarminge
added
bugfix
Problem
Quitting the desktop app with a held ⌘Q (Confirm quit: Hold) can show a main-process
TypeError: Object has been destroyeddialog. A held quit can fire from the grace timer, so the trailing Q key-up reaches thebefore-input-eventlistener inapps/desktop/src/window/DesktopWindow.tswhile the window is being torn down. That listener readswindow.webContentsto callsetIgnoreMenuShortcutswithout anisDestroyed()check, and Electron throws on any member access of a destroyedBrowserWindow. The siblinginput-eventlistener (trackpad scroll begin/end) has the same missing guard.Change
Both listeners now return early when
window.isDestroyed(), the same guard thezoom-changedlistener and the other handlers in the file already use. Inbefore-input-eventthe guard comes afterquitShortcutHandler(event, input), so the quit-hold flow still sees the trailing key-up. The guard is on the window, notwindow.webContents.isDestroyed(), because reading.webContentsis itself what throws.Scope and approval
Fixes #33614
Verification
DesktopWindow > ignores input that arrives after the window is destroyed(new,apps/desktop/src/window/DesktopWindow.test.ts) marks the fake window destroyed, makeswebContentsthrowTypeError("Object has been destroyed")as Electron does, then sends a trailing ⌘QkeyUptobefore-input-eventand agestureScrollEndtoinput-event. It fails on main withAssertionError: expected [Function] to not throw an error but 'TypeError: Object has been destroyed' was thrown, and still fails with only thebefore-input-eventguard. With this change all 28 tests in the file pass.vp run check:changedafter merging main: format, lint, knip, typecheck and tests pass.Evidence
The real T3 desktop app (the built
dist-electron/main.cjswith its preload, renderer and bundled server) ran on Linux with Confirm quit set to Hold. Base is main at bbdc7dca and head is a103cf6d; the later head only merges main. Each side ran from its own checkout with fresh, isolated state. The fix has no rendered surface, so the proof is a set of chronological main-process transcripts. The driver captures the listener the app itself registered and calls that retained callback; it never copies the implementation.Environment: Ubuntu 24.04, Electron 44.10.1 / Chromium 152, headless-desktop with Xvfb 1920×1080, scale 1,
T3CODE_DEV_SEED=0.Object has been destroyed. Head quits and returns cleanly.before-input-eventafter realBrowserWindow.destroy(): Q up, Control up, X downinput-eventafter destroy: gestureScrollBegin, gestureScrollEnd, mouseMoveWhat else changed: only the exceptions after destroy disappear. Outcomes on the live window match exactly (behaviour diff, comparison). Startup timing, repeat cadence and process IDs vary between runs.
Scripts and full index: evidence-index.md, reproduce.sh, run-one.mjs, driver.cjs, native-input.py. Supplemental Xvfb recordings (they include startup; the logs above are the proof): native-base.mp4 / native-head.mp4, release-base.mp4 / release-head.mp4.
cannot-verify macos: the native ⌘Q hold timing was not reproduced on macOS. On Linux, the native trailing key-up never reaches the listener under Xvfb, so the release route is a labelled harness run on the real app.
Verification log
DesktopWindow.test.ts. The quit-handler suite also passes.AI-assisted; verified with the tests and tools listed above.