[juliusmarminge]

Problem

Quitting the desktop app with a held ⌘Q (Confirm quit: Hold) can show a main-process TypeError: Object has been destroyed dialog. A held quit can fire from the grace timer, so the trailing Q key-up reaches the before-input-event listener in apps/desktop/src/window/DesktopWindow.ts while the window is being torn down. That listener reads window.webContents to call setIgnoreMenuShortcuts without an isDestroyed() check, and Electron throws on any member access of a destroyed BrowserWindow. The sibling input-event listener (trackpad scroll begin/end) has the same missing guard.

Change

Both listeners now return early when window.isDestroyed(), the same guard the zoom-changed listener and the other handlers in the file already use. In before-input-event the guard comes after quitShortcutHandler(event, input), so the quit-hold flow still sees the trailing key-up. The guard is on the window, not window.webContents.isDestroyed(), because reading .webContents is itself what throws.

Scope and approval

Fixes #33614

Verification

• DesktopWindow > ignores input that arrives after the window is destroyed (new, apps/desktop/src/window/DesktopWindow.test.ts) marks the fake window destroyed, makes webContents throw TypeError("Object has been destroyed") as Electron does, then sends a trailing ⌘Q keyUp to before-input-event and a gestureScrollEnd to input-event. It fails on main with AssertionError: expected [Function] to not throw an error but 'TypeError: Object has been destroyed' was thrown, and still fails with only the before-input-event guard. With this change all 28 tests in the file pass.
• vp run check:changed after merging main: format, lint, knip, typecheck and tests pass.

Evidence

The real T3 desktop app (the built dist-electron/main.cjs with its preload, renderer and bundled server) ran on Linux with Confirm quit set to Hold. Base is main at bbdc7dca and head is a103cf6d; the later head only merges main. Each side ran from its own checkout with fresh, isolated state. The fix has no rendered surface, so the proof is a set of chronological main-process transcripts. The driver captures the listener the app itself registered and calls that retained callback; it never copies the implementation.

Environment: Ubuntu 24.04, Electron 44.10.1 / Chromium 152, headless-desktop with Xvfb 1920×1080, scale 1, T3CODE_DEV_SEED=0.

Row	Before (bbdc7dc)	After (a103cf6)	Result
Native Ctrl+Q held about 1550 ms, then released	native-base.log	native-head.log	Both reach the hold threshold and quit cleanly through the quiet-period timer. Electron under Xvfb delivers no Q key-up callback.
Release route (harness): native hold, then the missing Q key-up forced into the installed listener	release-base.log	release-head.log	Base quits, destroys the window, then throws Object has been destroyed. Head quits and returns cleanly.
Quiet-period route (harness): repeats stop while Q stays down	quiet-base.log	quiet-head.log	On both sides the timer starts shutdown about 920 ms before the physical release. Both exit 0.
before-input-event after real BrowserWindow.destroy(): Q up, Control up, X down	listeners-base.log	listeners-head.log	All three throw on base. All three return on head, with no menu call and no IPC.
input-event after destroy: gestureScrollBegin, gestureScrollEnd, mouseMove	same	same	Begin and end throw on base and return without IPC on head. mouseMove returns on both.
Live window controls: Ctrl+W down, repeat and up; plain W; Ctrl+X; Alt/Shift+Ctrl+W; gesture begin and end	same	same	All ten outcomes are identical on base and head: menu interception, repeat prevention and scroll IPC.

What else changed: only the exceptions after destroy disappear. Outcomes on the live window match exactly (behaviour diff, comparison). Startup timing, repeat cadence and process IDs vary between runs.

Scripts and full index: evidence-index.md, reproduce.sh, run-one.mjs, driver.cjs, native-input.py. Supplemental Xvfb recordings (they include startup; the logs above are the proof): native-base.mp4 / native-head.mp4, release-base.mp4 / release-head.mp4.

cannot-verify macos: the native ⌘Q hold timing was not reproduced on macOS. On Linux, the native trailing key-up never reaches the listener under Xvfb, so the release route is a labelled harness run on the real app.

Verification log

• Review round 1: two independent reviewers, both MERGE, with no findings. Not a sensitive area and no product decision.
• Proof audit: pass 1 derived the matrix (matrix). Pass 2 returned SUFFICIENT. It rebuilt the after-side listener capture independently and all 16 case results matched (rebuilt logs).
• Tests: 28/28 in DesktopWindow.test.ts. The quit-handler suite also passes.
• Merged main at ad98905; the fix diff is unchanged.

AI-assisted; verified with the tests and tools listed above.

[macroscopeapp]

Approvability

Verdict: Approved at a103cf6

Macroscope's review found this PR approvable — Adds guards that prevent keyboard and gesture events from accessing a destroyed desktop window during teardown. Normal input behavior remains unchanged, with no material operational or data risk identified.

No code changes detected at a364c2a. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The main window’s input handlers now return when the window is destroyed. A regression test checks that trailing Cmd+Q key-up and scroll-end events do not throw.

Changes: Destroyed-window input handling

Layer / File(s)	Summary
Guard input handlers after destruction apps/desktop/src/window/DesktopWindow.ts, apps/desktop/src/window/DesktopWindow.test.ts	Both input handlers return before processing events when the window is destroyed. The test verifies that trailing Cmd+Q key-up and scroll-end events do not throw.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Low

Possibly related PRs

• pingdotgg/t3code#25188: Adds macOS swipe handling to the input-event path. This PR adds a destruction guard to that path.

Suggested reviewers: yash-singh1

Merge Risk: Minimal · up to a364c

The input handlers guard destroyed windows, with no actionable merge-blocking risk identified.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly describes the fix for input events during window teardown. It is specific to the main change.
Description check		The description covers the problem, change, scope, and detailed verification. It also notes that macOS timing was not verified. Although it says AI assistance was used, it does not name the model and …
Linked Issues check		Issue #33614 requires a destroyed-window guard before before-input-event accesses window.webContents, plus a regression test. The reviewed summary reports that DesktopWindow.ts checks `window.is…
Out of Scope Changes check		The current PR summary identifies changes to the two DesktopWindow listeners and their regression test. These changes address issue #33614. The large incremental diff includes a merge of main; it do…

Full details: Description check

Explanation

The description covers the problem, change, scope, and detailed verification. It also notes that macOS timing was not verified. Although it says AI assistance was used, it does not name the model and harness requested by the template; the remaining content is complete.

Full details: Linked Issues check

Explanation

Issue #33614 requires a destroyed-window guard before before-input-event accesses window.webContents, plus a regression test. The reviewed summary reports that DesktopWindow.ts checks window.isDestroyed() after quitShortcutHandler and before the access. The test covers a trailing Cmd+Q key-up after destruction. The added input-event guard covers the same teardown failure in the related listener.

Full details: Out of Scope Changes check

Explanation

The current PR summary identifies changes to the two DesktopWindow listeners and their regression test. These changes address issue #33614. The large incremental diff includes a merge of main; it does not establish unrelated changes in the PR diff from the supplied merge base.

Finishing Touches

Generate docstrings

• Commit to this branch
• Create a new PR

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: pingdotgg/t3code
• Branch: fix/issue-33614
• File: .coderabbit.config.ts
• Commit: a364c2a
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Team
• Run ID: 17c20e04-9a5e-4931-9e48-e44b16cccc14

Commits

Reviewing files that changed from the base of the PR and between 6512788 and a364c2a.

Files selected for processing: 2

• apps/desktop/src/window/DesktopWindow.test.ts
• apps/desktop/src/window/DesktopWindow.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 1 remain after this review.

[juliusmarminge]

Evidence

Built and ran both revisions as real Electron desktop apps in separate worktrees. Every capture uses Linux x86_64, Electron 44.10.1, Xvfb 1920×1080, a 1100×780 app window, light theme, and fresh isolated state with imports disabled.

With quit mode Hold, focus the workspace, wait two seconds, press Ctrl-Q twice using xdotool key --delay 40 ctrl+q ctrl+q, then observe for five seconds. The identical driver produces the destroyed-object exception on base and a clean quit on head (exit status 0).

Before	After
5be6bc99c2	a364c2af19
Rapid double Ctrl-Q recording: uncaught main-process TypeError: Object has been destroyed dialog.	Identical rapid double Ctrl-Q recording: quits without an error dialog.
Held Ctrl-Q recording: clean quit.	Held Ctrl-Q recording: clean quit.

The held-key comparison used identical 300 ms / 30 Hz repeat settings and a two-second hold; it did not reproduce the bug on base. Internal stack paths are masked in the recordings; the exception text remains visible.

Interaction driver · Desktop launcher · Setup and observations

AI-assisted; verified with the tests and tools listed above.

Not shown:

• Native macOS Command-Q timing was not verified because this environment runs Linux; the demonstrated trigger uses Ctrl-Q.
• The held-key variant did not reproduce the exception on base: both revisions quit cleanly under the identical scripted hold.
• Late native gesture events and the input-event gesture guard were not exercised; the demonstrated failure covers keyboard input.
• Fetching origin failed with HTTP 503 (fatal: expected 'acknowledgments'); the base was resolved using the available local origin/main reference.