feat(desktop-client): tighten window mode switching and add win/linux package scripts

- Track each window's renderer mode in a WeakMap (and fall back to
  parsing ?window= from the URL) so retireInactiveAppWindows can
  destroy stale login/main/settings windows when we switch modes,
  not just the previous one of the canonical pair.
- Replace closeWindowAfterIpcReturn with retireWindowAfterIpcReturn
  (hides immediately, then destroys instead of close()) so the IPC
  reply still reaches the caller before teardown.
- Add waitForWindowReady() with a 1.2s ceiling and call it from
  revealWindow so we don't show a half-loaded shell while
  switchWindowMode is running. Pass the source window from the IPC
  event into switchWindowMode so the closing target is the actual
  caller, not a guess based on mode.
- Silence console.* and skip the observed-fetch install in packaged
  runtime, and only auto-openDevTools in dev.
- Eagerly import LoginView in App.vue instead of defineAsyncComponent
  to remove the boot flash on the login window.
- package.json: prefix package:* with `pnpm run build` and add
  package:win and package:linux for parity.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/desktop-client/package.json

@@ -13,7 +13,9 @@
   "scripts": {
     "dev": "unset ELECTRON_RUN_AS_NODE && electron-vite dev --inspect=9229",
     "build": "electron-vite build",
-    "package:mac": "electron-builder --mac --arm64",
+    "package:mac": "pnpm run build && electron-builder --mac --arm64,universal",
+    "package:win": "pnpm run build && electron-builder --win --x64",
+    "package:linux": "pnpm run build && electron-builder --linux --x64,arm64",
     "sign:setup": "bash scripts/sign-setup.sh",
     "sign:mac": "bash scripts/sign-mac.sh",
     "test": "vitest run",

apps/desktop-client/src/main/bootstrap.ts

@@ -5,6 +5,7 @@ import { shell } from "electron";
 import { BrowserWindow, app, ipcMain, nativeTheme } from "electron/main";
 import type {
   BrowserWindow as ElectronBrowserWindow,
+  IpcMainInvokeEvent,
   WebContents as ElectronWebContents,
 } from "electron/main";
 import type { DesktopAccountInfo, DesktopRuntimeSessionSyncRequest } from "@geo/shared-types";
@@ -52,9 +53,29 @@ app.commandLine.appendSwitch(
 );
 app.commandLine.appendSwitch("disable-quic");
 app.commandLine.appendSwitch("disable-background-networking");
+// CDP is required by the hidden Playwright execution pool in packaged builds.
 app.commandLine.appendSwitch("remote-debugging-port", String(getPlaywrightCDPPort()));
 app.userAgentFallback = STANDARD_USER_AGENT;
-installObservedGlobalFetch();
+
+const isDevelopmentRuntime = !app.isPackaged;
+
+function silencePackagedConsole(): void {
+  if (isDevelopmentRuntime) {
+    return;
+  }
+
+  const noop = () => undefined;
+  console.log = noop;
+  console.info = noop;
+  console.warn = noop;
+  console.error = noop;
+  console.debug = noop;
+}
+
+silencePackagedConsole();
+if (isDevelopmentRuntime) {
+  installObservedGlobalFetch();
+}
 
 console.info("[desktop-main] boot", {
   electron: process.versions.electron,
@@ -77,6 +98,7 @@ let settingsWindow: ElectronBrowserWindow | null = null;
 let mainRendererContents: ElectronWebContents | null = null;
 let quitReleaseInFlight = false;
 const forceCloseWindows = new WeakSet<ElectronBrowserWindow>();
+const appWindowModes = new WeakMap<ElectronBrowserWindow, RendererWindowMode>();
 
 type WindowMode = "login" | "main";
 type RendererWindowMode = WindowMode | "settings";
@@ -95,6 +117,8 @@ interface WindowModeRequest {
   animate?: boolean;
 }
 
+const WINDOW_READY_TIMEOUT_MS = 1200;
+
 const WINDOW_SIZES: Record<WindowMode, WindowSizePreset> = {
   login: { width: 340, height: 540, minWidth: 340, minHeight: 540, resizable: false },
   main: { width: 1320, height: 860, minWidth: 900, minHeight: 600, resizable: true },
@@ -187,15 +211,87 @@ function currentActiveWindow(): ElectronBrowserWindow | null {
   return currentMainWindow() ?? currentLoginWindow();
 }
 
-function closeWindowAfterIpcReturn(window: ElectronBrowserWindow): void {
+function rendererModeFromWindow(window: ElectronBrowserWindow): RendererWindowMode | null {
+  if (window.isDestroyed()) {
+    return null;
+  }
+
+  const knownMode = appWindowModes.get(window);
+  if (knownMode) {
+    return knownMode;
+  }
+
+  try {
+    const url = new URL(window.webContents.getURL());
+    const mode = url.searchParams.get("window");
+    return mode === "login" || mode === "main" || mode === "settings" ? mode : null;
+  } catch {
+    return null;
+  }
+}
+
+function retireWindowAfterIpcReturn(window: ElectronBrowserWindow): void {
+  if (window.isDestroyed()) {
+    return;
+  }
+
   forceCloseWindows.add(window);
+  if (window.isVisible()) {
+    window.hide();
+  }
   setTimeout(() => {
     if (!window.isDestroyed()) {
-      window.close();
+      window.destroy();
     }
   }, 50);
 }
 
+function retireInactiveAppWindows(mode: WindowMode, target: ElectronBrowserWindow): void {
+  for (const candidate of BrowserWindow.getAllWindows()) {
+    if (candidate === target || candidate.isDestroyed()) {
+      continue;
+    }
+
+    const candidateMode = rendererModeFromWindow(candidate);
+    if (
+      (mode === "main" && (candidateMode === "login" || candidateMode === "main"))
+      || (mode === "login" && (candidateMode === "main" || candidateMode === "settings"))
+    ) {
+      retireWindowAfterIpcReturn(candidate);
+    }
+  }
+}
+
+async function waitForWindowReady(window: ElectronBrowserWindow): Promise<void> {
+  if (window.isDestroyed() || !window.webContents.isLoading()) {
+    return;
+  }
+
+  await new Promise<void>((resolve) => {
+    let settled = false;
+    let timeout: ReturnType<typeof setTimeout> | null = null;
+
+    const finish = () => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      if (timeout) {
+        clearTimeout(timeout);
+      }
+      window.off("ready-to-show", finish);
+      window.webContents.off("did-finish-load", finish);
+      window.webContents.off("did-fail-load", finish);
+      resolve();
+    };
+
+    timeout = setTimeout(finish, WINDOW_READY_TIMEOUT_MS);
+    window.once("ready-to-show", finish);
+    window.webContents.once("did-finish-load", finish);
+    window.webContents.once("did-fail-load", finish);
+  });
+}
+
 function captureRuntimeSnapshot() {
   const snapshot = createRuntimeSnapshot();
   applyDesktopHealthIndicatorFromSnapshot(snapshot, currentMainWindow());
@@ -241,6 +337,7 @@ async function ensureWindow(mode: WindowMode): Promise<ElectronBrowserWindow> {
 }
 
 async function revealWindow(window: ElectronBrowserWindow): Promise<void> {
+  await waitForWindowReady(window);
   if (window.isMinimized()) {
     window.restore();
   }
@@ -262,12 +359,28 @@ function revealActiveWindowSafely(source: string): void {
   });
 }
 
-async function switchWindowMode(mode: WindowMode, _request: WindowModeRequest = {}): Promise<void> {
+function windowFromIpcEvent(event: IpcMainInvokeEvent): ElectronBrowserWindow | null {
+  const window = BrowserWindow.fromWebContents(event.sender);
+  if (!window || window.isDestroyed()) {
+    return null;
+  }
+  return window;
+}
+
+async function switchWindowMode(
+  mode: WindowMode,
+  _request: WindowModeRequest = {},
+  sourceWindow: ElectronBrowserWindow | null = null,
+): Promise<void> {
   currentWindowMode = mode;
   persistWindowMode(mode);
 
   const target = await ensureWindow(mode);
-  const previous = mode === "main" ? currentLoginWindow() : currentMainWindow();
+  const previous = sourceWindow && sourceWindow !== target
+    ? sourceWindow
+    : mode === "main"
+      ? currentLoginWindow()
+      : currentMainWindow();
 
   if (!target.isVisible()) {
     target.center();
@@ -275,13 +388,14 @@ async function switchWindowMode(mode: WindowMode, _request: WindowModeRequest =
   await revealWindow(target);
 
   if (previous && previous !== target && !previous.isDestroyed()) {
-    closeWindowAfterIpcReturn(previous);
+    retireWindowAfterIpcReturn(previous);
   }
 
   const settings = currentSettingsWindow();
   if (mode === "login" && settings) {
-    closeWindowAfterIpcReturn(settings);
+    retireWindowAfterIpcReturn(settings);
   }
+  retireInactiveAppWindows(mode, target);
 }
 
 async function openSettingsWindow(): Promise<void> {
@@ -303,7 +417,7 @@ async function loadRenderer(window: ElectronBrowserWindow, mode: RendererWindowM
     const url = new URL(devServerURL);
     url.searchParams.set("window", mode);
     await window.webContents.loadURL(url.toString());
-    if (mode === "main") {
+    if (mode === "main" && isDevelopmentRuntime) {
       window.webContents.openDevTools({ mode: "detach" });
     }
     return;
@@ -319,8 +433,10 @@ async function mountRendererWebContents(window: ElectronBrowserWindow, mode: Ren
 
   contents.setWindowOpenHandler(() => ({ action: "deny" }));
   if (mode === "main") {
-    registerRendererDevtoolsProxyTarget(contents);
-    registerObservedRequestRendererTarget(contents);
+    if (isDevelopmentRuntime) {
+      registerRendererDevtoolsProxyTarget(contents);
+      registerObservedRequestRendererTarget(contents);
+    }
     mainRendererContents = contents;
     window.on("closed", () => {
       if (mainRendererContents === contents) {
@@ -355,6 +471,7 @@ async function createAppWindow(mode: WindowMode): Promise<ElectronBrowserWindow>
       nodeIntegration: false,
     },
   });
+  appWindowModes.set(window, mode);
 
   if (!initial.resizable) {
     window.setMinimumSize(initial.minWidth, initial.minHeight);
@@ -430,6 +547,7 @@ async function createSettingsWindow(): Promise<ElectronBrowserWindow> {
       nodeIntegration: false,
     },
   });
+  appWindowModes.set(window, "settings");
 
   window.once("closed", () => {
     if (settingsWindow === window) {
@@ -568,9 +686,9 @@ function registerBridgeHandlers(): void {
     await releaseRuntimeSession({ revoke: Boolean(revoke) });
     return null;
   });
-  ipcMain.handle("desktop:set-window-mode", async (_event, mode: WindowMode, request?: unknown) => {
+  ipcMain.handle("desktop:set-window-mode", async (event, mode: WindowMode, request?: unknown) => {
     if (mode === "login" || mode === "main") {
-      await switchWindowMode(mode, normalizeWindowModeRequest(request));
+      await switchWindowMode(mode, normalizeWindowModeRequest(request), windowFromIpcEvent(event));
     }
     return null;
   });

apps/desktop-client/src/main/execution-devtools.ts

@@ -1,3 +1,4 @@
+import { app } from "electron/main";
 import type { WebContents } from "electron/main";
 
 function normalizeBooleanEnv(value: string | undefined): boolean | null {
@@ -16,6 +17,10 @@ function normalizeBooleanEnv(value: string | undefined): boolean | null {
 }
 
 export function shouldAutoOpenExecutionDevtools(): boolean {
+  if (app.isPackaged) {
+    return false;
+  }
+
   const explicit = normalizeBooleanEnv(process.env.GEO_DESKTOP_EXECUTION_DEVTOOLS);
   if (explicit !== null) {
     return explicit;
@@ -25,6 +30,10 @@ export function shouldAutoOpenExecutionDevtools(): boolean {
 }
 
 export function shouldAutoOpenBackgroundExecutionDevtools(): boolean {
+  if (app.isPackaged) {
+    return false;
+  }
+
   const explicit = normalizeBooleanEnv(process.env.GEO_DESKTOP_EXECUTION_DEVTOOLS);
   if (explicit !== null) {
     return explicit;

apps/desktop-client/src/main/network-observer.ts

@@ -1,5 +1,6 @@
 import { randomUUID } from "node:crypto";
 
+import { app } from "electron/main";
 import type { Session, WebContents } from "electron/main";
 
 import type {
@@ -39,11 +40,16 @@ const requestFilter = {
   urls: ["http://*/*", "https://*/*", "ws://*/*", "wss://*/*"],
 };
 const redactedQueryKeys = /token|signature|sig|auth|key|password|session/i;
+const networkObserverEnabled = !app.isPackaged;
 
 let rendererTarget: WebContents | null = null;
 let originalFetch: typeof globalThis.fetch | null = null;
 
 export function installObservedGlobalFetch(): void {
+  if (!networkObserverEnabled) {
+    return;
+  }
+
   if (originalFetch || typeof globalThis.fetch !== "function") {
     return;
   }
@@ -79,6 +85,10 @@ export function installObservedGlobalFetch(): void {
 }
 
 export function registerObservedRequestRendererTarget(webContents: WebContents): void {
+  if (!networkObserverEnabled) {
+    return;
+  }
+
   rendererTarget = webContents;
   webContents.once("destroyed", () => {
     if (rendererTarget === webContents) {
@@ -91,6 +101,10 @@ export function observeSessionRequests(
   target: Session,
   options: { label: string; partition?: string | null },
 ): void {
+  if (!networkObserverEnabled) {
+    return;
+  }
+
   if (observedSessions.has(target)) {
     return;
   }
@@ -175,6 +189,10 @@ export function observeSessionRequests(
 }
 
 export function startObservedRequest(options: StartObservedRequestOptions): string {
+  if (!networkObserverEnabled) {
+    return "";
+  }
+
   const id = `main:${randomUUID()}`;
   const active: ActiveObservedRequest = {
     id,
@@ -239,6 +257,14 @@ export function failObservedRequest(id: string, error: unknown): void {
 }
 
 export function getObservedRequestSnapshot(): DesktopObservedRequestSnapshot {
+  if (!networkObserverEnabled) {
+    return {
+      rendererAttached: false,
+      activeCount: 0,
+      recent: [],
+    };
+  }
+
   return {
     rendererAttached: Boolean(rendererTarget && !rendererTarget.isDestroyed()),
     activeCount: activeRequests.size,

apps/desktop-client/src/main/renderer-devtools-proxy.ts

@@ -1,4 +1,4 @@
-import { ipcMain } from "electron/main";
+import { app, ipcMain } from "electron/main";
 import type { IpcMainEvent, WebContents } from "electron/main";
 
 interface RendererProxyRequest {
@@ -26,10 +26,17 @@ const pendingRequests = new Map<string, {
 }>();
 const rendererProxyRequestChannel = "desktop:renderer-devtools-proxy:request";
 const rendererProxyResponseChannel = "desktop:renderer-devtools-proxy:response";
+const rendererDevtoolsProxyEnabled = !app.isPackaged;
 
-ipcMain.on(rendererProxyResponseChannel, handleRendererProxyResponse);
+if (rendererDevtoolsProxyEnabled) {
+  ipcMain.on(rendererProxyResponseChannel, handleRendererProxyResponse);
+}
 
 export function registerRendererDevtoolsProxyTarget(webContents: WebContents): void {
+  if (!rendererDevtoolsProxyEnabled) {
+    return;
+  }
+
   rendererWebContents = webContents;
   webContents.once("destroyed", () => {
     if (rendererWebContents === webContents) {
@@ -39,12 +46,17 @@ export function registerRendererDevtoolsProxyTarget(webContents: WebContents): v
 }
 
 export function canUseRendererDevtoolsProxy(): boolean {
-  return Boolean(rendererWebContents && !rendererWebContents.isDestroyed());
+  return rendererDevtoolsProxyEnabled
+    && Boolean(rendererWebContents && !rendererWebContents.isDestroyed());
 }
 
 export async function rendererDevtoolsFetch(
   request: RendererProxyRequest,
 ): Promise<RendererProxyResponse> {
+  if (!rendererDevtoolsProxyEnabled) {
+    throw new Error("renderer_devtools_proxy_unavailable");
+  }
+
   if (!rendererWebContents || rendererWebContents.isDestroyed()) {
     throw new Error("renderer_devtools_proxy_unavailable");
   }

apps/desktop-client/src/preload/bridge.ts

@@ -35,64 +35,66 @@ interface DesktopAppSettings {
 const rendererProxyRequestChannel = "desktop:renderer-devtools-proxy:request";
 const rendererProxyResponseChannel = "desktop:renderer-devtools-proxy:response";
 
-ipcRenderer.on(
-  rendererProxyRequestChannel,
-  async (
-    _event,
-    payload: {
-      requestId?: unknown;
-      request?: {
-        url?: unknown;
-        method?: unknown;
-        headers?: unknown;
-        body?: unknown;
-      };
-    },
-  ) => {
-    const requestId = typeof payload?.requestId === "string" ? payload.requestId : "";
-    const request = payload?.request;
-    if (!requestId || !request || typeof request !== "object") {
-      return;
-    }
-
-    const url = typeof request.url === "string" ? request.url : "";
-    const method = typeof request.method === "string" ? request.method : "GET";
-    const headers = isStringRecord(request.headers) ? request.headers : {};
-    const body = typeof request.body === "string" ? request.body : undefined;
-
-    const response = await (async () => {
-      try {
-        const fetchResponse = await fetch(url, {
-          method,
-          headers,
-          body,
-        });
-        const bodyText = await fetchResponse.text();
-        return {
-          ok: fetchResponse.ok,
-          status: fetchResponse.status,
-          statusText: fetchResponse.statusText,
-          headers: Object.fromEntries(fetchResponse.headers.entries()),
-          bodyText,
-        };
-      } catch (error) {
-        return {
-          ok: false,
-          status: 0,
-          statusText: "",
-          headers: {},
-          bodyText: "",
-          error: String(error && ((error as Error).message || error)),
+if (import.meta.env.DEV) {
+  ipcRenderer.on(
+    rendererProxyRequestChannel,
+    async (
+      _event,
+      payload: {
+        requestId?: unknown;
+        request?: {
+          url?: unknown;
+          method?: unknown;
+          headers?: unknown;
+          body?: unknown;
         };
+      },
+    ) => {
+      const requestId = typeof payload?.requestId === "string" ? payload.requestId : "";
+      const request = payload?.request;
+      if (!requestId || !request || typeof request !== "object") {
+        return;
       }
-    })();
 
-    ipcRenderer.send(rendererProxyResponseChannel, {
-      requestId,
-      response,
-    });
-  },
-);
+      const url = typeof request.url === "string" ? request.url : "";
+      const method = typeof request.method === "string" ? request.method : "GET";
+      const headers = isStringRecord(request.headers) ? request.headers : {};
+      const body = typeof request.body === "string" ? request.body : undefined;
+
+      const response = await (async () => {
+        try {
+          const fetchResponse = await fetch(url, {
+            method,
+            headers,
+            body,
+          });
+          const bodyText = await fetchResponse.text();
+          return {
+            ok: fetchResponse.ok,
+            status: fetchResponse.status,
+            statusText: fetchResponse.statusText,
+            headers: Object.fromEntries(fetchResponse.headers.entries()),
+            bodyText,
+          };
+        } catch (error) {
+          return {
+            ok: false,
+            status: 0,
+            statusText: "",
+            headers: {},
+            bodyText: "",
+            error: String(error && ((error as Error).message || error)),
+          };
+        }
+      })();
+
+      ipcRenderer.send(rendererProxyResponseChannel, {
+        requestId,
+        response,
+      });
+    },
+  );
+}
 
 const desktopBridge = {
   app: {

apps/desktop-client/src/renderer/App.vue

@@ -1,9 +1,9 @@
 <script setup lang="ts">
 import { computed, defineAsyncComponent, onMounted, watch } from "vue";
 import { useDesktopSession } from "./composables/useDesktopSession";
+import LoginView from "./views/LoginView.vue";
 
 const DesktopShell = defineAsyncComponent(() => import("./components/DesktopShell.vue"));
-const LoginView = defineAsyncComponent(() => import("./views/LoginView.vue"));
 const SettingsWindow = defineAsyncComponent(() => import("./views/SettingsWindow.vue"));
 
 const { isAuthenticated, syncRuntimeSession } = useDesktopSession();

apps/desktop-client/src/renderer/console-guard.ts

@@ -0,0 +1,8 @@
+if (import.meta.env.PROD) {
+  const noop = () => undefined;
+  console.log = noop;
+  console.info = noop;
+  console.warn = noop;
+  console.error = noop;
+  console.debug = noop;
+}

apps/desktop-client/src/renderer/main.ts

@@ -1,3 +1,5 @@
+import "./console-guard";
+
 import { createApp } from "vue";
 
 import App from "./App.vue";