frame-fix-wrapper.js

{
  const _fs = require('fs');
  const _path = require('path');
  const _existing = _path.join(_path.dirname(process.resourcesPath || ''), 'Helpers', 'disclaimer');
  let _haveSystemDisclaimer = false;
  try {
    const _stat = _fs.statSync(_existing);
    _haveSystemDisclaimer = _stat.uid === 0;
  } catch (_) {}
  if (!_haveSystemDisclaimer) {
    const _xdgConfigHome = process.env.XDG_CONFIG_HOME || _path.join(require('os').userInfo().homedir, '.config');
    Object.defineProperty(process, 'resourcesPath', {
      value: _path.join(_xdgConfigHome, 'Claude', 'cowork-resources'),
      writable: true,
      configurable: true,
      enumerable: true,
    });
  }
}

// Patch macOS-only systemPreferences methods that don't exist on Linux
const { systemPreferences, app: _earlyApp } = require('electron');
if (typeof systemPreferences.setUserDefault !== 'function') {
  systemPreferences.setUserDefault = function(key, type, value) {
    // no-op on Linux
  };
}
if (typeof systemPreferences.getUserDefault !== 'function') {
  systemPreferences.getUserDefault = function(key, type) {
    return undefined;
  };
}
if (typeof systemPreferences.promptTouchID !== 'function') {
  systemPreferences.promptTouchID = function(reason) {
    return Promise.reject(new Error('Touch ID unavailable on Linux'));
  };
}

// Patch macOS-only Electron app methods (NSUserActivity / Handoff APIs).
// We spoof process.platform === "darwin" so the asar's darwin-gated callsites
// reach these methods; on Linux Electron they don't exist, throwing
// `TypeError: app.invalidateCurrentActivity is not a function` and crashing
// the main process with a JS error dialog.
// See: claude-cowork-linux issues #104, #106
if (_earlyApp) {
  const _macOnlyAppMethods = [
    'invalidateCurrentActivity',
    'setUserActivity',
    'updateCurrentActivity',
    'resignCurrentActivity',
    'getCurrentActivityType',
    // WebAuthn (passkey/security-key) setup is macOS-only; absent on Linux
    // Electron, so the darwin-gated callsite throws and crashes launch. See #128.
    'configureWebAuthn',
  ];
  for (const _m of _macOnlyAppMethods) {
    if (typeof _earlyApp[_m] !== 'function') {
      _earlyApp[_m] = function() { /* no-op on Linux */ };
    }
  }
  // moveToApplicationsFolder is macOS-only; the asar's prompt path is gated
  // by a confirm dialog but stub it defensively so a stray call can't crash.
  if (typeof _earlyApp.moveToApplicationsFolder !== 'function') {
    _earlyApp.moveToApplicationsFolder = function() { return false; };
  }
}

// Inject frame fix and Cowork support before main app loads
const Module = require('module');
const originalRequire = Module.prototype.require;
const path = require('path');
const os = require('os');
const fs = require('fs');

// Authoritative homedir from /etc/passwd (getpwuid_r), NOT from $HOME.
// os.homedir() trusts the HOME env var, which can be set to any path.
// os.userInfo().homedir reads from the system password database — the
// user's environment can't override it. Use this for all security
// boundaries (allowlists, path validation). Expose via global so
// downstream modules (ipc_overrides, spaces_store) use the same source.
const PASSWD_HOMEDIR = os.userInfo().homedir;
global.__coworkPasswdHomedir = PASSWD_HOMEDIR;
const {
  createAsarAdapter,
  DEFAULT_FILESYSTEM_PATH_ALIASES,
  isFileSystemPathRewriteChannel,
  rewriteAliasedFilePath,
} = require('./cowork/asar_adapter.js');
const { createDirs } = require('./cowork/dirs.js');
const { createSessionOrchestrator } = require('./cowork/session_orchestrator.js');
const { createSessionStore } = require('./cowork/session_store.js');
const { createIpcTap } = require('./cowork/ipc_tap.js');
const { createOverrideRegistry, matchOverride, extractEipcUuid, proactivelyRegisterOverrides, isProactiveChannel } = require('./cowork/ipc_overrides.js');
const { createAutoPermissionsCap } = require('./cowork/auto_permissions_cap.js');
const { createBridgeCanary } = require('./cowork/bridge_canary.js');

// Single cap instance for the process. Closure-private state lives inside
// the factory; we just keep the wrapHandler reference. The cap is one of
// the "wrapper-side rails" that bounds the manual permission flow which
// Phase 1 stopped shadowing -- see SECURITY notes in the cap module.
const _autoPermissionsCap = createAutoPermissionsCap();
// Opt-in canary that observes bridge-related channel registrations and
// warns once when a previously-unseen one shows up. The regression alarm
// for "Anthropic shipped a new bridge channel between releases."
const _bridgeCanary = createBridgeCanary();

// Suppress EPIPE errors on stdout/stderr (normal in piped/Electron environments)
// and prevent them from becoming uncaught exception crash dialogs.
function _epipeHandler(err) {
  if (err.code === 'EPIPE') return;
  throw err;
}
if (process.stdout && typeof process.stdout.on === 'function') {
  process.stdout.on('error', _epipeHandler);
}
if (process.stderr && typeof process.stderr.on === 'function') {
  process.stderr.on('error', _epipeHandler);
}
// Catch EPIPE from any other pipe (IPC, Winston transports, CCD subprocess)
// that would otherwise surface as uncaught exception error dialogs.
const _origListeners = process.listeners('uncaughtException');
process.removeAllListeners('uncaughtException');
process.on('uncaughtException', (err, origin) => {
  if (err && err.code === 'EPIPE') {
    // Log once, don't crash
    try { fs.appendFileSync(
      path.join(process.env.CLAUDE_LOG_DIR || path.join(PASSWD_HOMEDIR, '.local', 'state', 'claude-cowork', 'logs'), 'epipe-suppressed.log'),
      `[${new Date().toISOString()}] EPIPE suppressed: ${err.stack || err.message}\n`,
      { mode: 0o600 }
    ); } catch (_) {}
    return;
  }
  // Re-throw to existing handlers (Electron's dialog, etc.)
  for (const listener of _origListeners) {
    listener(err, origin);
  }
});

console.log('[Frame Fix] Wrapper v2.5 loaded');
console.log('[Frame Fix] EPIPE suppression enabled');
if (process.env.CLAUDE_DEVTOOLS === '1') console.log('[Frame Fix] DevTools mode enabled');

// ── Bridge forwardEvent patch ──────────────────────────────────────────
// The asar's sessions-bridge class has a forwardEvent method that drops
// "result" and "stream_event" types. On macOS the VM's MITM proxy
// forwards those to CCR instead. On Linux there's no proxy, so we patch
// forwardEvent to stop dropping them — the bridge transport (already
// connected) will POST them to CCR directly.
//
// Detection: the bridge class extends EventEmitter and subscribes to
// "remote_session_start" immediately after creation. We intercept that
// subscription to find the instance and patch its forwardEvent.
(function patchBridgeForwardEvent() {
  const EventEmitter = require('events').EventEmitter;
  const origOn = EventEmitter.prototype.on;
  let patched = false;

  EventEmitter.prototype.on = function patchedOn(event) {
    if (!patched && event === 'remote_session_start' && typeof this.forwardEvent === 'function') {
      patched = true;
      const originalForwardEvent = this.forwardEvent.bind(this);
      const bridge = this;

      this.forwardEvent = async function patchedForwardEvent(e) {
        // The original filter drops result/stream_event. We need those
        // forwarded on Linux since there's no VM proxy to handle it.
        const session = bridge.activeSessions && bridge.activeSessions.get(e.sessionId);
        const msg = e.message;
        const msgType = msg && msg.type;
        console.log('[bridge-patch] forwardEvent called: type=' + e.type
          + ' msgType=' + msgType
          + ' sessionId=' + e.sessionId
          + ' hasSession=' + !!session
          + ' hasTransport=' + !!(session && session.transport));
        if (!session || e.type !== 'message' || !e.message) {
          return originalForwardEvent(e);
        }

        // For types the original would NOT drop, call the original
        if (msgType !== 'result' && msgType !== 'stream_event') {
          return originalForwardEvent(e);
        }

        // For result/stream_event: POST via the bridge transport directly
        if (!session.transport) {
          console.warn('[bridge-patch] No transport for session ' + e.sessionId + ', dropping ' + msgType);
          return;
        }

        // Build event with userMessageUuid if present (matches original logic)
        let eventPayload = msg;
        if (e.userMessageUuid && msgType !== 'user') {
          eventPayload = { ...msg, user_message_uuid: e.userMessageUuid };
        }

        // Serialize writes through the session's writeQueue (same pattern
        // as the original forwardEvent) to prevent interleaving.
        session.writeQueue = (session.writeQueue || Promise.resolve()).then(async () => {
          try {
            if (!session.transport) return;
            if (session.transport.closed) {
              console.warn('[bridge-patch] transport closed for ' + e.sessionId);
              return;
            }
            await session.transport.write(eventPayload);
            console.log('[bridge-patch] write OK: ' + msgType + ' session=' + e.sessionId);
          } catch (err) {
            console.warn('[bridge-patch] Failed to write ' + msgType + ' for session '
              + e.sessionId + ': ' + (err && err.message));
          }
        });
        await session.writeQueue;
      };

      console.log('[bridge-patch] forwardEvent patched on sessions-bridge instance');
      // Restore original .on to avoid overhead on all future subscriptions
      EventEmitter.prototype.on = origOn;
    }
    return origOn.apply(this, arguments);
  };
})();

// ── Asset Dumper (--devtools only) ──────────────────────────────────────
// Saves JS/CSS/JSON from claude.ai and *.anthropic.com to:
//   ~/.local/state/claude-cowork/logs/webapp-assets/
// Previous dump is rotated to webapp-assets.bak/ on each launch.
function setupAssetDumper(win) {
  const logDir = process.env.CLAUDE_LOG_DIR || path.join(PASSWD_HOMEDIR, '.local', 'state', 'claude-cowork', 'logs');
  const dumpDir = path.join(logDir, 'webapp-assets');
  const bakDir = dumpDir + '.bak';

  // Rotate: remove old .bak, rename current to .bak
  try { fs.rmSync(bakDir, { recursive: true, force: true }); } catch (_) {}
  try { fs.renameSync(dumpDir, bakDir); } catch (_) {}
  try { fs.mkdirSync(dumpDir, { recursive: true }); } catch (_) {}

  const dumped = new Set();
  let dumpCount = 0;
  win.webContents.session.webRequest.onCompleted(
    { urls: ['*://*.anthropic.com/*', '*://claude.ai/*'] },
    (details) => {
      if (details.statusCode !== 200) return;
      const url = details.url;
      if (dumped.has(url)) return;
      const ext = path.extname(new URL(url).pathname).toLowerCase();
      if (!['.js', '.css', '.json', '.html'].includes(ext)) return;
      dumped.add(url);
      win.webContents.session.fetch(url).then(r => r.text()).then(body => {
        const safeName = new URL(url).pathname.replace(/\//g, '_').replace(/^_/, '');
        fs.writeFile(path.join(dumpDir, safeName), body, () => {
          dumpCount++;
          if (dumpCount <= 5 || dumpCount % 10 === 0) {
            console.log('[Asset Dump] ' + dumpCount + ' files -> ' + dumpDir);
          }
        });
      }).catch(() => {});
    }
  );

  console.log('');
  console.log('╔══════════════════════════════════════════════════════════════╗');
  console.log('║  DEVTOOLS MODE  —  Asset dumper active                      ║');
  console.log('║  Current: ' + dumpDir.padEnd(49) + '║');
  console.log('║  Backup:  ' + bakDir.padEnd(49) + '║');
  console.log('║  Diff with: diff <dir> <dir.bak> to spot protocol changes   ║');
  console.log('╚══════════════════════════════════════════════════════════════╝');
  console.log('');
}

function wrapAliasedFileSystemHandler(channel, handler, getAdapter) {
  if (typeof handler !== 'function' || !isFileSystemPathRewriteChannel(channel)) {
    return handler;
  }
  if (handler.__coworkAliasedFileSystemWrapped) {
    return handler;
  }

  const normalizedChannel = typeof channel === 'string' ? channel.toLowerCase() : '';
  function isPotentialIpcEvent(value) {
    if (!value || typeof value !== 'object') {
      return false;
    }
    return !!(
      value.sender ||
      value.senderFrame ||
      value.frameId ||
      value.processId
    );
  }

  function splitHandlerArgs(args) {
    if (!Array.isArray(args) || args.length === 0) {
      return {
        eventArg: null,
        payloadArgs: [],
      };
    }
    if (isPotentialIpcEvent(args[0])) {
      return {
        eventArg: args[0],
        payloadArgs: args.slice(1),
      };
    }
    return {
      eventArg: null,
      payloadArgs: args.slice(),
    };
  }

  function joinHandlerArgs(eventArg, payloadArgs) {
    return eventArg ? [eventArg, ...(payloadArgs || [])] : (payloadArgs || []);
  }

  function isSessionScopedFileSystemChannelName(value) {
    return value.endsWith('filesystem_$_readlocalfile') ||
      value.endsWith('filesystem_$_openlocalfile');
  }

  let delegatedHandler = null;
  const wrappedHandler = async function(...args) {
    if (!delegatedHandler && typeof getAdapter === 'function') {
      const adapter = getAdapter();
      if (adapter && typeof adapter.wrapHandler === 'function') {
        delegatedHandler = adapter.wrapHandler(channel, handler);
      }
    }

    if (delegatedHandler) {
      return delegatedHandler(...args);
    }

    if (!Array.isArray(args) || args.length === 0) {
      return handler(...args);
    }

    const { eventArg, payloadArgs } = splitHandlerArgs(args);
    const hasExplicitSessionId = isSessionScopedFileSystemChannelName(normalizedChannel) &&
      typeof payloadArgs[0] === 'string' &&
      payloadArgs[0].startsWith('local_');
    const targetPath = hasExplicitSessionId ? payloadArgs[1] : payloadArgs[0];
    const rest = hasExplicitSessionId ? payloadArgs.slice(2) : payloadArgs.slice(1);
    if (typeof targetPath !== 'string') {
      return handler(...args);
    }

    const rewrittenPath = rewriteAliasedFilePath(targetPath, DEFAULT_FILESYSTEM_PATH_ALIASES);
    if (rewrittenPath !== targetPath) {
      console.log('[Cowork] Rewrote stale FileSystem path:', targetPath, '->', rewrittenPath);
    }
    const nextPayloadArgs = hasExplicitSessionId
      ? [payloadArgs[0], rewrittenPath, ...rest]
      : [rewrittenPath, ...rest];
    return handler(...joinHandlerArgs(eventArg, nextPayloadArgs));
  };
  wrappedHandler.__coworkAliasedFileSystemWrapped = true;
  return wrappedHandler;
}

function resolveElectronApp(electronModule) {
  const candidate = electronModule && typeof electronModule === 'object'
    ? electronModule.app
    : null;
  if (candidate && typeof candidate.on === 'function') {
    return candidate;
  }

  try {
    const electron = require('electron');
    if (electron && electron.app && typeof electron.app.on === 'function') {
      return electron.app;
    }
  } catch (_) {}

  return null;
}

function registerElectronAppListener(electronModule, eventName, listener, description) {
  const label = description || eventName;
  try {
    const app = resolveElectronApp(electronModule);
    if (!app) {
      console.log('[Frame Fix] Skipping app listener registration for ' + label + ': app unavailable');
      return false;
    }
    app.on(eventName, listener);
    return true;
  } catch (error) {
    console.log('[Frame Fix] Failed to register app listener for ' + label + ': ' + error.message);
    return false;
  }
}

function hideLinuxMenuBars(electronModule) {
  if (REAL_PLATFORM !== 'linux') {
    return;
  }

  const BrowserWindow = electronModule && electronModule.BrowserWindow;
  if (!BrowserWindow || typeof BrowserWindow.getAllWindows !== 'function') {
    console.log('[Frame Fix] Skipping menu bar hide: BrowserWindow.getAllWindows unavailable');
    return;
  }

  try {
    for (const win of BrowserWindow.getAllWindows()) {
      if (win && typeof win.setMenuBarVisibility === 'function') {
        win.setMenuBarVisibility(false);
      }
    }
  } catch (error) {
    console.log('[Frame Fix] setMenuBarVisibility error:', error.message);
  }
}

function describeLinuxMenuApiShape(electronModule) {
  const menuApi = electronModule && electronModule.Menu;
  const app = resolveElectronApp(electronModule);
  const shape = {
    hasMenuObject: !!(menuApi && (typeof menuApi === 'object' || typeof menuApi === 'function')),
    hasMenuSetApplicationMenu: !!(menuApi && typeof menuApi.setApplicationMenu === 'function'),
    hasMenuSetDefaultApplicationMenu: !!(menuApi && typeof menuApi.setDefaultApplicationMenu === 'function'),
    hasAppObject: !!app,
    hasAppSetApplicationMenu: !!(app && typeof app.setApplicationMenu === 'function'),
    missing: [],
  };

  if (!shape.hasMenuObject) {
    shape.missing.push('Menu');
  }
  if (shape.hasMenuObject && !shape.hasMenuSetApplicationMenu) {
    shape.missing.push('Menu.setApplicationMenu');
  }
  if (shape.hasMenuObject && !shape.hasMenuSetDefaultApplicationMenu) {
    shape.missing.push('Menu.setDefaultApplicationMenu');
  }
  if (shape.hasAppObject && !shape.hasAppSetApplicationMenu) {
    shape.missing.push('app.setApplicationMenu');
  }

  return shape;
}

function installLinuxMenuInterceptors(electronModule) {
  if (!electronModule || typeof electronModule !== 'object') {
    return;
  }
  if (global.__coworkLinuxMenuInterceptorsInstalled) {
    return;
  }

  const menuApi = electronModule.Menu;
  const app = resolveElectronApp(electronModule);
  const menuApiShape = describeLinuxMenuApiShape(electronModule);
  if (!menuApi || (!menuApiShape.hasMenuObject && !menuApiShape.hasMenuSetApplicationMenu && !menuApiShape.hasMenuSetDefaultApplicationMenu)) {
    console.log('[Frame Fix] Skipping menu interception: Menu API unavailable');
    console.log('[Frame Fix] Menu API shape:', JSON.stringify(menuApiShape));
    return;
  }
  global.__coworkLinuxMenuInterceptorsInstalled = true;

  const originalSetAppMenu = typeof menuApi.setApplicationMenu === 'function'
    ? menuApi.setApplicationMenu.bind(menuApi)
    : null;
  const originalSetDefaultAppMenu = typeof menuApi.setDefaultApplicationMenu === 'function'
    ? menuApi.setDefaultApplicationMenu.bind(menuApi)
    : null;

  if (menuApiShape.missing.length > 0) {
    console.log('[Frame Fix] Menu API coverage gaps:', menuApiShape.missing.join(', '));
  }

  if (app && typeof app.setApplicationMenu !== 'function') {
    app.setApplicationMenu = function(menu) {
      global.__coworkApplicationMenu = menu;
      hideLinuxMenuBars(electronModule);
      return undefined;
    };
  }

  menuApi.setApplicationMenu = function(menu) {
    global.__coworkApplicationMenu = menu;
    // Call the original so Electron's native binding stays intact
    if (originalSetAppMenu) {
      try { originalSetAppMenu(menu); } catch (_) {}
    }
    hideLinuxMenuBars(electronModule);
    return undefined;
  };

  if (originalSetDefaultAppMenu) {
    menuApi.setDefaultApplicationMenu = function(...args) {
      if (REAL_PLATFORM === 'linux') {
        hideLinuxMenuBars(electronModule);
        return undefined;
      }
      return originalSetDefaultAppMenu(...args);
    };
  }
}

// ============================================================
// IPC TAP — must be created before the early ipcMain patch so
// it can instrument _invokeHandlers before any asar code runs.
// ============================================================
const ipcTap = createIpcTap();

// ============================================================
// CRITICAL: Patch ipcMain IMMEDIATELY before any asar code runs
// ============================================================
// NOTE: _invokeHandlers.get() is dead code — Electron dispatches via C++
// and never calls Map.get() from JavaScript. Synthetic handlers MUST be
// registered via ipcMain.handle() to land in Electron's C++ dispatch map.
// The .set() override here only wraps filesystem handlers with alias
// rewriting. Linux IPC overrides are applied at registration time via
// matchOverride() in both ipcMain.handle() and webContents.ipc.handle().
try {
  const electron = require('electron');
  const { ipcMain } = electron;
  if (ipcMain && ipcMain._invokeHandlers && !global.__coworkIpcMainAliasPatched) {
    global.__coworkIpcMainAliasPatched = true;
    const invokeHandlers = ipcMain._invokeHandlers;
    // Tap _invokeHandlers BEFORE our overrides so the tap sees raw handler behavior
    if (ipcTap.enabled) ipcTap.wrapInvokeHandlers(invokeHandlers);
    const originalSet = invokeHandlers.set.bind(invokeHandlers);
    invokeHandlers.set = function(channel, handler) {
      return originalSet(channel, wrapAliasedFileSystemHandler(channel, handler, () => global.__coworkAsarAdapter || null));
    };
    console.log('[Cowork] ipcMain._invokeHandlers patched (filesystem aliasing)');
  }
} catch (e) {
  console.error('[Cowork] Failed to patch ipcMain:', e.message);
}

// ============================================================
// CRITICAL: Register CoworkSpaces handlers on ipcMain IMMEDIATELY
// ============================================================
// The asar's native SpacesStore only registers handlers after account IPC
// from the renderer, which is unreliable on Linux. Without a handler,
// ipcRenderer.invoke() fails silently and the Projects page stays empty.
//
// We register our file-backed handlers on ipcMain.handle() BEFORE any
// webContents exists. When no webContents.ipc.handle() exists for a channel,
// Electron falls back to ipcMain.handle(). If/when the asar's native handler
// registers later (account init succeeds), it uses webContents.ipc.handle()
// which takes priority over our ipcMain handler.
try {
  const _electron = require('electron');
  const { createSpacesStore } = require('./cowork/spaces_store.js');
  const _earlyAllowedRoots = [PASSWD_HOMEDIR];
  function _earlyIsPathAllowed(filePath) {
    if (typeof filePath !== 'string' || !path.isAbsolute(filePath)) return false;
    const normalized = path.normalize(filePath);
    let resolved;
    try {
      resolved = fs.realpathSync(normalized);
    } catch (_) {
      let current = path.dirname(normalized);
      let tail = path.basename(normalized);
      resolved = null;
      while (current !== path.dirname(current)) {
        try {
          resolved = path.join(fs.realpathSync(current), tail);
          break;
        } catch (_) {
          tail = path.join(path.basename(current), tail);
          current = path.dirname(current);
        }
      }
      if (!resolved) resolved = normalized;
    }
    return _earlyAllowedRoots.some(root => resolved === root || resolved.startsWith(root + path.sep));
  }
  // Publish the early-created store to a global so ipc_overrides.js
  // (loaded later) reuses the same instance instead of creating a second
  // one with divergent validators and separate rate-limit state.
  const _spacesStore = createSpacesStore({
    localAgentRoot: path.join(
      process.env.XDG_CONFIG_HOME || path.join(PASSWD_HOMEDIR, '.config'),
      'Claude', 'local-agent-mode-sessions'
    ),
    isPathAllowed: _earlyIsPathAllowed,
    trace: (msg) => console.log(msg),
  });
  global.__coworkSpacesStore = _spacesStore;

  const EIPC_UUID = 'c42bb833-f6f9-4563-9861-03480449cfb1';
  const EIPC_NS = 'claude.web';
  const prefix = `$eipc_message$_${EIPC_UUID}_$_${EIPC_NS}_$_CoworkSpaces_$_`;

  const handlers = {
    getAllSpaces: async () => _spacesStore.getAllSpaces(),
    getSpace: async (_e, id) => _spacesStore.getSpace(_e, id),
    createSpace: async (_e, data) => _spacesStore.createSpace(_e, data),
    updateSpace: async (_e, id, upd) => _spacesStore.updateSpace(_e, id, upd),
    deleteSpace: async (_e, id) => _spacesStore.deleteSpace(_e, id),
    addFolderToSpace: async (_e, id, p) => _spacesStore.addFolderToSpace(_e, id, p),
    removeFolderFromSpace: async (_e, id, p) => _spacesStore.removeFolderFromSpace(_e, id, p),
    addProjectToSpace: async (_e, id, p) => _spacesStore.addProjectToSpace(_e, id, p),
    removeProjectFromSpace: async (_e, id, p) => _spacesStore.removeProjectFromSpace(_e, id, p),
    addLinkToSpace: async (_e, id, l) => _spacesStore.addLinkToSpace(_e, id, l),
    removeLinkFromSpace: async (_e, id, l) => _spacesStore.removeLinkFromSpace(_e, id, l),
    getAutoMemoryDir: async (_e, id) => _spacesStore.getAutoMemoryDir(_e, id),
    listFolderContents: async (_e, p) => _spacesStore.listFolderContents(_e, p),
    readFileContents: async (_e, p) => _spacesStore.readFileContents(_e, p),
    openFile: async (_e, p) => _spacesStore.openFile(_e, p),
    copyFilesToSpaceFolder: async (_e, id, f) => _spacesStore.copyFilesToSpaceFolder(_e, id, f),
    createSpaceFolder: async (_e, id, n) => _spacesStore.createSpaceFolder(_e, id, n),
    classifySessions: async (_e, s) => _spacesStore.classifySessions(_e, s),
    setAutoDescription: async (_e, id, d) => _spacesStore.setAutoDescription(_e, id, d),
    summarizeSpace: async (_e, id) => _spacesStore.summarizeSpace(_e, id),
    onSpaceEvent: async () => ({ dispose: () => {} }),
  };

  let registered = 0;
  for (const [method, handler] of Object.entries(handlers)) {
    const channel = prefix + method;
    try {
      _electron.ipcMain.handle(channel, handler);
      registered++;
    } catch (e) {
      // Already registered — skip
    }
  }
  console.log('[Cowork] Registered ' + registered + ' CoworkSpaces handlers on ipcMain (fallback)');
} catch (earlyRegErr) {
  console.error('[Cowork] EARLY CoworkSpaces registration FAILED:', earlyRegErr.message, earlyRegErr.stack);
}

// ============================================================
// 0. TMPDIR FIX - MUST BE ABSOLUTELY FIRST
// ============================================================
// Fix EXDEV error: App downloads VM to /tmp (tmpfs) then tries to
// rename() to ~/.config/Claude/ (disk). rename() can't cross filesystems.

const REAL_PLATFORM = process.platform;
const REAL_ARCH = process.arch;
const DIRS = createDirs();

// ── Global shortcut default ───────────────────────────────────────────
// The asar defaults to Alt+Space on darwin, Ctrl+Alt+Space on Linux.
// Since we spoof darwin, it picks Alt+Space which conflicts with most
// Linux WM launchers. Set the Linux default if the user hasn't chosen one.
try {
  const configPath = path.join(DIRS.claudeConfigRoot, 'config.json');
  const cfg = JSON.parse(fs.readFileSync(configPath, 'utf8'));
  if (!cfg.globalShortcut) {
    cfg.globalShortcut = 'Ctrl+Alt+Space';
    fs.writeFileSync(configPath, JSON.stringify(cfg, null, 2) + '\n');
    console.log('[Frame Fix] Set default global shortcut to Ctrl+Alt+Space');
  }
} catch (_) {}

const vmBundleDir = DIRS.claudeVmBundlesDir;
const vmTmpDir = path.join(vmBundleDir, 'tmp');
const claudeVmBundle = path.join(vmBundleDir, 'claudevm.bundle');
const LOCAL_AGENT_ROOT = DIRS.claudeLocalAgentRoot;
const localSessionStore = createSessionStore({ localAgentRoot: LOCAL_AGENT_ROOT });
const ipcSessionOrchestrator = createSessionOrchestrator({
  dirs: DIRS,
  sessionStore: localSessionStore,
});
const asarAdapter = createAsarAdapter({
  sessionOrchestrator: ipcSessionOrchestrator,
  sessionStore: localSessionStore,
});
global.__coworkAsarAdapter = asarAdapter;
global.__coworkSessionStore = localSessionStore;
global.__coworkSessionOrchestrator = ipcSessionOrchestrator;
global.__coworkDirs = DIRS;
localSessionStore.installMetadataPersistenceGuard();
global.__coworkIpcTap = ipcTap;

try {
  // Create temp dir on same filesystem as target
  fs.mkdirSync(vmTmpDir, { recursive: true, mode: 0o700 });

  // Set env vars for any code that reads them directly
  process.env.TMPDIR = vmTmpDir;
  process.env.TMP = vmTmpDir;
  process.env.TEMP = vmTmpDir;

  // CRITICAL: Patch os.tmpdir() directly - it may have cached /tmp already
  const originalTmpdir = os.tmpdir;
  os.tmpdir = function() {
    return vmTmpDir;
  };

  // Pre-create VM bundle to skip download entirely
  fs.mkdirSync(claudeVmBundle, { recursive: true, mode: 0o755 });

  // Create marker files the app checks
  const markers = ['bundle_complete', 'rootfs.img', 'rootfs.img.zst', 'vmlinux', 'config.json'];
  for (const m of markers) {
    const p = path.join(claudeVmBundle, m);
    if (!fs.existsSync(p)) {
      if (m === 'config.json') {
        fs.writeFileSync(p, '{"version":"linux-native","skip_vm":true}', { mode: 0o644 });
      } else {
        fs.writeFileSync(p, 'linux-native-placeholder', { mode: 0o644 });
      }
    }
  }
  fs.writeFileSync(path.join(claudeVmBundle, 'version'), '999.0.0-linux-native', { mode: 0o644 });

  console.log('[TMPDIR] Fixed: ' + vmTmpDir);
  console.log('[TMPDIR] os.tmpdir() patched');
  console.log('[VM_BUNDLE] Ready: ' + claudeVmBundle);

  // The asar wraps all git commands with a "disclaimer" binary on macOS
  // (Helpers/disclaimer git <args>). Since we spoof process.platform to
  // "darwin", this codepath activates on Linux too. The binary doesn't
  // exist in the Linux Electron distribution, causing ENOENT on every
  // git operation (diff, status, etc). Create a transparent passthrough
  // so the wrapper is a no-op — identical to what the asar's own
  // non-darwin branch does (returns the command unchanged).
  const disclaimerDir = path.join(path.dirname(process.resourcesPath), 'Helpers');
  const disclaimerBin = path.join(disclaimerDir, 'disclaimer');
  {
    try {
      fs.mkdirSync(disclaimerDir, { recursive: true, mode: 0o755 });
      fs.writeFileSync(disclaimerBin, '#!/bin/sh\nexit 127\n', { mode: 0o444 });
    } catch (_) {}

    const _cp = require('child_process');
    const _origExecFile = _cp.execFile;
    const _origSpawn = _cp.spawn;
    const { createExecCapabilityRegistry } = require('../cowork/exec_capability_registry');
    const _execRegistry = createExecCapabilityRegistry({
      homedir: PASSWD_HOMEDIR,
    });
    global.__coworkExecRegistry = _execRegistry;

    function _resolveDisclaimerArgs(file, args) {
      if (file !== disclaimerBin) return null;
      return _execRegistry.resolveDisclaimerCommand(args);
    }

    _cp.execFile = function(file, args, ...rest) {
      const resolved = _resolveDisclaimerArgs(file, args);
      if (resolved) return _origExecFile.call(_cp, resolved.cmd, resolved.rest, ...rest);
      return _origExecFile.call(_cp, file, args, ...rest);
    };
    Object.assign(_cp.execFile, _origExecFile);

    _cp.spawn = function(file, args, ...rest) {
      const resolved = _resolveDisclaimerArgs(file, args);
      if (resolved) return _origSpawn.call(_cp, resolved.cmd, resolved.rest, ...rest);
      return _origSpawn.call(_cp, file, args, ...rest);
    };
    Object.assign(_cp.spawn, _origSpawn);

    console.log('[disclaimer] Intercepting exec calls at ' + disclaimerBin);
  }
} catch (e) {
  console.error('[TMPDIR] Setup failed:', e.message);
}

// ============================================================
// 0a. PATCH fs TO REDIRECT /sessions/ PATHS TO SESSIONS_BASE
// ============================================================
// The asar and our stubs use /sessions/<name>/... as the VM-internal path
// prefix. On macOS a /sessions root symlink is created. On Linux we can't
// always create root symlinks (immutable rootfs, no sudo). Instead, patch
// all fs calls to rewrite /sessions/ -> SESSIONS_BASE/ transparently.
//
// SESSIONS_BASE is resolved lazily (DIRS is created below) so we capture
// a getter that reads from the global set during createDirs().
(function patchFsSessionsPaths() {
  const VM_SESSIONS_PREFIX = '/sessions/';

  function rewritePath(p) {
    if (typeof p === 'string' && p.startsWith(VM_SESSIONS_PREFIX)) {
      const base = (typeof SESSIONS_BASE !== 'undefined' ? SESSIONS_BASE : null)
        || (global.__coworkDirs && global.__coworkDirs.claudeSessionsBase)
        || require('path').join(
            (process.env.XDG_CONFIG_HOME || require('path').join(require('os').homedir(), '.config')),
            'Claude', 'local-agent-mode-sessions', 'sessions'
          );
      return base + '/' + p.slice(VM_SESSIONS_PREFIX.length);
    }
    return p;
  }

  function wrapFsMethod(obj, name) {
    const orig = obj[name];
    if (typeof orig !== 'function' || obj[name].__coworkSessionsPatched) return;
    obj[name] = function(p, ...rest) {
      return orig.call(this, rewritePath(p), ...rest);
    };
    obj[name].__coworkSessionsPatched = true;
  }

  const PATH_METHODS = [
    'access', 'accessSync',
    'chmod', 'chmodSync',
    'chown', 'chownSync',
    'copyFile', 'copyFileSync',
    'createReadStream', 'createWriteStream',
    'exists', 'existsSync',
    'lchmod', 'lchmodSync',
    'lchown', 'lchownSync',
    'lstat', 'lstatSync',
    'mkdir', 'mkdirSync',
    'mkdtemp', 'mkdtempSync',
    'open', 'openSync',
    'opendir', 'opendirSync',
    'readdir', 'readdirSync',
    'readFile', 'readFileSync',
    'readlink', 'readlinkSync',
    'realpath', 'realpathSync',
    'rmdir', 'rmdirSync',
    'rm', 'rmSync',
    'stat', 'statSync',
    'symlink', 'symlinkSync',
    'truncate', 'truncateSync',
    'unlink', 'unlinkSync',
    'utimes', 'utimesSync',
    'watch', 'watchFile',
    'writeFile', 'writeFileSync',
    'appendFile', 'appendFileSync',
  ];

  for (const name of PATH_METHODS) {
    if (typeof fs[name] === 'function') wrapFsMethod(fs, name);
  }

  const origRenameForSessions = fs.rename;
  if (origRenameForSessions && !origRenameForSessions.__coworkSessionsRenamePatched) {
    fs.rename = function(oldPath, newPath, cb) {
      return origRenameForSessions.call(this, rewritePath(oldPath), rewritePath(newPath), cb);
    };
    fs.rename.__coworkSessionsRenamePatched = true;
  }
  const origRenameSyncForSessions = fs.renameSync;
  if (origRenameSyncForSessions && !origRenameSyncForSessions.__coworkSessionsRenamePatched) {
    fs.renameSync = function(oldPath, newPath) {
      return origRenameSyncForSessions.call(this, rewritePath(oldPath), rewritePath(newPath));
    };
    fs.renameSync.__coworkSessionsRenamePatched = true;
  }

  try {
    const fsp = require('fs/promises') || fs.promises;
    if (fsp) {
      const ASYNC_PATH_METHODS = [
        'access', 'chmod', 'chown', 'copyFile', 'lchmod', 'lchown',
        'lstat', 'mkdir', 'mkdtemp', 'open', 'opendir', 'readdir',
        'readFile', 'readlink', 'realpath', 'rmdir', 'rm', 'stat',
        'symlink', 'truncate', 'unlink', 'utimes', 'writeFile', 'appendFile',
      ];
      for (const name of ASYNC_PATH_METHODS) {
        if (typeof fsp[name] === 'function' && !fsp[name].__coworkSessionsPatched) {
          const origFsp = fsp[name];
          fsp[name] = function(p, ...rest) {
            return origFsp.call(this, rewritePath(p), ...rest);
          };
          fsp[name].__coworkSessionsPatched = true;
        }
      }
      if (typeof fsp.rename === 'function' && !fsp.rename.__coworkSessionsRenamePatched) {
        const origFspRename = fsp.rename;
        fsp.rename = function(oldPath, newPath) {
          return origFspRename.call(this, rewritePath(oldPath), rewritePath(newPath));
        };
        fsp.rename.__coworkSessionsRenamePatched = true;
      }
    }
  } catch (_) {}

  console.log('[Sessions] fs path redirect /sessions/ -> SESSIONS_BASE installed');
})();

// ============================================================
// 0b. PATCH fs.rename TO HANDLE EXDEV ERRORS
// ============================================================
const originalRename = fs.rename;
const originalRenameSync = fs.renameSync;

fs.rename = function(oldPath, newPath, callback) {
  originalRename(oldPath, newPath, (err) => {
    if (err && err.code === 'EXDEV') {
      // Cross-filesystem rename — fall back to copy+delete
      const readStream = fs.createReadStream(oldPath);
      const writeStream = fs.createWriteStream(newPath);
      readStream.on('error', callback);
      writeStream.on('error', callback);
      writeStream.on('close', () => {
        fs.unlink(oldPath, () => callback(null));
      });
      readStream.pipe(writeStream);
    } else {
      callback(err);
    }
  });
};

fs.renameSync = function(oldPath, newPath) {
  try {
    return originalRenameSync(oldPath, newPath);
  } catch (err) {
    if (err.code === 'EXDEV') {
      // Cross-filesystem rename — fall back to copy+delete
      fs.copyFileSync(oldPath, newPath);
      fs.unlinkSync(oldPath);
      return;
    }
    throw err;
  }
};

// ============================================================
// 1. PLATFORM SPOOFING - Immediate, before any app code
// ============================================================

// ── Platform spoofing (performance-critical) ──────────────────────────
// App code must see darwin/arm64; Electron/Node internals need the real
// platform. The old approach used new Error().stack on every access —
// stack trace generation is extremely expensive in V8 and process.platform
// is read thousands of times per second (CSS, feature detection, Node APIs).
//
// New approach: default to 'darwin' (the common case — app code dominates
// runtime reads) and only use the real platform during the brief module-
// loading phase when Electron internals call it. A reentrant guard flips
// to real values when OUR code is executing (frame-fix-wrapper, stubs).
let _inOurCode = false;

function withRealPlatform(fn) {
  _inOurCode = true;
  try { return fn(); }
  finally { _inOurCode = false; }
}

Object.defineProperty(process, 'platform', {
  get() { return _inOurCode ? REAL_PLATFORM : 'darwin'; },
  configurable: true
});

Object.defineProperty(process, 'arch', {
  get() { return _inOurCode ? REAL_ARCH : 'arm64'; },
  configurable: true
});

const originalOsPlatform = os.platform;
const originalOsArch = os.arch;

os.platform = function() { return _inOurCode ? originalOsPlatform.call(os) : 'darwin'; };
os.arch = function() { return _inOurCode ? originalOsArch.call(os) : 'arm64'; };

// Spoof macOS version
const originalGetSystemVersion = process.getSystemVersion;
process.getSystemVersion = function() {
  return '14.0.0';
};

console.log('[Platform] Spoofing: darwin/arm64 macOS 14.0 (immediate)');
console.log('[Platform] Real platform was:', REAL_PLATFORM);

// ============================================================
// Cowork/YukonSilver Support for Linux
// On Linux we run Claude Code directly without a VM
// ============================================================

// Global state for Cowork
global.__cowork = {
  supported: true,
  status: 'supported', // This is what the app checks
  processes: new Map(),
};

const SESSIONS_BASE = DIRS.claudeSessionsBase;

// Items 9, 10: dead support-status overrides removed (handled by IPC stubs).

console.log('[Cowork] Linux support enabled - VM will be emulated');

const { isIgnoredLiveEventType } = require('./cowork/session_normalization.js');

function parseRequestedProcessId(args) {
  for (const arg of args) {
    if (typeof arg === 'string') {
      return arg;
    }
    if (arg && typeof arg === 'object' && typeof arg.id === 'string') {
      return arg.id;
    }
  }
  return null;
}

async function getCoworkProcessRunningState(processId) {
  const stub = global.__coworkSwiftStub;
  const specialKeepalive = processId === '__keepalive__' || processId === '__heartbeat__';

  try {
    if (stub && typeof stub.isProcessRunning === 'function' && !stub.isProcessRunning.__coworkSyntheticWrapper) {
      const result = await Promise.resolve(stub.isProcessRunning(processId));
      if (result && typeof result === 'object' && 'running' in result) {
        return {
          running: !!result.running,
          exitCode: result.exitCode ?? null,
        };
      }
      const running = !!result;
      return { running, exitCode: running ? null : 0 };
    }
    if (stub && stub.vm && typeof stub.vm.isProcessRunning === 'function' && !stub.vm.isProcessRunning.__coworkSyntheticWrapper) {
      const result = await Promise.resolve(stub.vm.isProcessRunning(processId));
      if (result && typeof result === 'object' && 'running' in result) {
        return {
          running: !!result.running,
          exitCode: result.exitCode ?? null,
        };
      }
      const running = !!result;
      return { running, exitCode: running ? null : 0 };
    }
  } catch (_) {}

  if (typeof processId === 'string' && global.__cowork.processes.has(processId)) {
    return { running: true, exitCode: null };
  }
  if (specialKeepalive) {
    return { running: true, exitCode: null };
  }
  return { running: false, exitCode: 0 };
}

// Delegates to consolidated isIgnoredLiveEventType in session_normalization.js
function getIgnoredLiveMessageType(channel, payload) {
  return isIgnoredLiveEventType(channel, payload);
}

function logIgnoredLiveMessage(channel, payload, messageType) {
  if (!global.__coworkIgnoredLiveMessageStats) {
    global.__coworkIgnoredLiveMessageStats = new Map();
  }

  const key = `${channel}:${messageType}`;
  const current = global.__coworkIgnoredLiveMessageStats.get(key) || { count: 0, lastLoggedAt: 0 };
  current.count += 1;

  const now = Date.now();
  const shouldLog = current.count <= 3 || (now - current.lastLoggedAt) >= 60000;
  if (shouldLog) {
    current.lastLoggedAt = now;
    console.log('[Cowork] Ignored live session event ' + JSON.stringify({
      channel: channel.includes('LocalAgentModeSessions') ? 'LocalAgentModeSessions.onEvent' : 'LocalSessions.onEvent',
      messageType,
      count: current.count,
      sessionId: payload && typeof payload === 'object' ? (payload.sessionId || null) : null,
    }));
  }

  global.__coworkIgnoredLiveMessageStats.set(key, current);
}

// ============================================================
// IPC OVERRIDE REGISTRY — single source of truth for all Linux overrides.
// Applied at registration time on both ipcMain.handle() and
// webContents.ipc.handle() via matchOverride(channel, overrides).
// ============================================================
const ipcOverrides = createOverrideRegistry(function getProcessState(args) {
  const processId = parseRequestedProcessId(args);
  return getCoworkProcessRunningState(processId);
});

// Phase 7: startup self-test. Verifies the three load-bearing rails
// (bridge overrides absent, auto-permissions cap armed, mount-bound
// armed) are present at app-ready time. On failure, logs a single
// [COWORK STARTUP CHECK FAILED] line and surfaces a desktop notification.
(function scheduleStartupCheck() {
  try {
    const { runStartupCheck } = require('./cowork/startup_check.js');
    const mountRootBound = require('./cowork/mount_root_bound.js');
    const { app: _readyApp, Notification: _ReadyNotification } = require('electron');
    if (!_readyApp || typeof _readyApp.whenReady !== 'function') return;
    _readyApp.whenReady().then(() => {
      try {
        runStartupCheck({
          ipcOverridesRegistry: ipcOverrides,
          autoPermissionsCap: _autoPermissionsCap,
          mountRootBound,
          execCapabilityRegistry: global.__coworkExecRegistry || null,
          notify: (msg) => {
            try {
              if (_ReadyNotification && typeof _ReadyNotification.isSupported === 'function' && _ReadyNotification.isSupported()) {
                new _ReadyNotification({ title: 'Claude', body: msg }).show();
              }
            } catch (_) {}
          },
        });
      } catch (e) {
        console.warn('[cowork-startup] check threw:', e && e.message);
      }
    }).catch((e) => console.warn('[cowork-startup] whenReady rejected:', e && e.message));
  } catch (e) {
    console.warn('[cowork-startup] failed to schedule check:', e && e.message);
  }
})();

// ============================================================
// GRACEFUL SHUTDOWN — on Linux, closing all windows must quit the
// app. The asar's handler checks `process.platform === "darwin"`
// and skips quit on macOS (dock convention). Since we spoof darwin,
// we must register our own handler first to call app.quit().
// Also handle SIGTERM/SIGHUP so WMs, systemd, and kill(1) work.
// ============================================================
let shuttingDown = false;
function gracefulQuit(reason) {
  if (shuttingDown) return;
  shuttingDown = true;
  console.log(`[Shutdown] ${reason}, quitting gracefully`);
  try {
    const { app } = require('electron');
    // app.quit() can be cancelled by before-quit handlers (the asar has one).
    // app.exit() is uncancellable — closes all windows and exits immediately.
    app.exit(0);
  } catch (e) {
    process.exit(0);
  }
}

// window-all-closed: registered early so it fires before the asar's
// handler (which short-circuits on "darwin" and never quits)
registerElectronAppListener(null, 'window-all-closed', () => {
  gracefulQuit('All windows closed');
}, 'window-all-closed');

for (const sig of ['SIGTERM', 'SIGHUP', 'SIGINT']) {
  process.on(sig, () => gracefulQuit(`Received ${sig}`));
}

// ============================================================
// APP NAME + SINGLE-INSTANCE LOCK — must run before index.js so:
//  1. setName('Claude') sets userData to ~/.config/Claude (otherwise it
//     would be ~/.config/@ant/desktop from package.json name).
//  2. requestSingleInstanceLock() is held by THIS process so the
//     protocol-forwarder (launched via `claude-desktop %u`) can detect
//     "main app running" and forward the URL via the second-instance event.
//
// The asar's index.js takes app.on('open-url', ...) under darwin spoof
// and never calls requestSingleInstanceLock() itself — so if we don't
// hold the lock here, the forwarder always spawns a duplicate instance.
try {
  const { app } = require('electron');
  if (typeof app.setName === 'function') app.setName('Claude');
  console.log('[SingleInstance] App name set to Claude');

  const gotLock = app.requestSingleInstanceLock();
  if (!gotLock) {
    console.log('[SingleInstance] Another instance is running, quitting');
    app.quit();
  } else {
    console.log('[SingleInstance] Lock acquired');
    app.on('second-instance', function(_event, argv) {
      // protocol-forwarder.js forwards a claude:// URL via its argv.
      // Find it, validate basic shape, then re-emit as open-url so the
      // asar's URL handler (registered under darwin spoof) processes it.
      try {
        var url = null;
        for (var i = 0; i < argv.length; i++) {
          if (typeof argv[i] === 'string' && argv[i].indexOf('claude://') === 0) {
            url = argv[i];
            break;
          }
        }
        if (url && url.length < 2048 && /^claude:\/\/[a-zA-Z0-9\-._~:/?#\[\]@!$&()*+,;=%]+$/.test(url)) {
          console.log('[SingleInstance] forwarding URL via open-url: ' + url);
          app.emit('open-url', { preventDefault: function() {} }, url);
        }
      } catch (e) {
        console.error('[SingleInstance] second-instance handler error:', e.message);
      }
    });
  }
} catch (e) {
  console.error('[SingleInstance] setup failed:', e.message);
}

Module.prototype.require = function(id) {
  // Intercept claude-swift to inject our Linux implementation
  if (id && id.includes('@ant/claude-swift')) {
    console.log('[Cowork] Intercepting @ant/claude-swift');
    const swiftStub = originalRequire.apply(this, arguments);
    global.__coworkSwiftStub = swiftStub;
    // Ensure the VM reports as supported
    if (swiftStub && swiftStub.vm) {
      const originalGetStatus = swiftStub.vm.getStatus;
      swiftStub.vm.getStatus = function() {
        console.log('[Cowork] vm.getStatus called - returning supported');
        return { supported: true, status: 'supported', running: true, connected: true };
      };
      swiftStub.vm.getSupportStatus = function() {
        console.log('[Cowork] vm.getSupportStatus called - returning supported');
        return 'supported';
      };
      swiftStub.vm.isSupported = function() {
        return true;
      };
      if (typeof swiftStub.vm.isProcessRunning !== 'function') {
        const syntheticVmIsProcessRunning = async function(processId) {
          const state = await getCoworkProcessRunningState(processId);
          return state.running;
        };
        syntheticVmIsProcessRunning.__coworkSyntheticWrapper = true;
        swiftStub.vm.isProcessRunning = syntheticVmIsProcessRunning;
      }
    }
    if (swiftStub && typeof swiftStub.isProcessRunning !== 'function') {
      const syntheticIsProcessRunning = async function(processId) {
        const state = await getCoworkProcessRunningState(processId);
        return state.running;
      };
      syntheticIsProcessRunning.__coworkSyntheticWrapper = true;
      swiftStub.isProcessRunning = syntheticIsProcessRunning;
    }
    return swiftStub;
  }

  const module = originalRequire.apply(this, arguments);

  if (id === 'electron' && !global.__coworkElectronPatched) {
    global.__coworkElectronPatched = true;
    console.log('[Frame Fix] Intercepting electron module');

    // ── Native titlebar for Linux/Wayland (KDE, GNOME, etc.) ──────────
    // On macOS, titleBarStyle:"hidden" + titleBarOverlay works fine:
    // the OS draws traffic lights and clicks pass through to child elements.
    // On Linux/Wayland, this creates an undecorated window where
    // -webkit-app-region:drag swallows ALL pointer events, making the
    // tab bar (Chat/Cowork/Código) unclickable.
    //
    // Fix: wrap BrowserWindow in a Proxy that strips macOS-specific
    // window chrome options (titleBarStyle, titleBarOverlay,
    // trafficLightPosition), giving the compositor (KWin, Mutter, etc.)
    // native window decorations. Also inject CSS to disable app-region:drag.
    //
    // Note: BrowserWindow is defined as a non-configurable getter on the
    // electron module, so Object.defineProperty cannot replace it.
    // A Proxy on the module object is the only way to intercept it.
    if (REAL_PLATFORM === 'linux') {
      const _OrigBrowserWindow = module.BrowserWindow;
      function _PatchedBrowserWindow(opts) {
        if (opts && typeof opts === 'object') {
          if (opts.titleBarStyle) {
            console.log('[Frame Fix] Removing titleBarStyle:', opts.titleBarStyle);
            delete opts.titleBarStyle;
          }
          if (opts.titleBarOverlay !== undefined) {
            delete opts.titleBarOverlay;
          }
          if (opts.trafficLightPosition !== undefined) {
            delete opts.trafficLightPosition;
          }
        }
        return new _OrigBrowserWindow(opts);
      }
      Object.setPrototypeOf(_PatchedBrowserWindow, _OrigBrowserWindow);
      _PatchedBrowserWindow.prototype = _OrigBrowserWindow.prototype;
      Object.defineProperty(_PatchedBrowserWindow, 'name', { value: 'BrowserWindow' });

      global.__coworkPatchedBrowserWindow = _PatchedBrowserWindow;
      console.log('[Frame Fix] BrowserWindow patched for native Linux decorations');

      // Inject CSS into all webContents to disable -webkit-app-region:drag.
      // With native decorations, window dragging is handled by the compositor,
      // so the CSS drag region is unnecessary and actively harmful on Linux.
      const _appRef = module.app || (module.default && module.default.app);
      if (_appRef) {
        const _fixCSS = '* { -webkit-app-region: no-drag !important; app-region: no-drag !important; }';
        _appRef.on('web-contents-created', (_ev, contents) => {
          contents.on('dom-ready', () => {
            contents.insertCSS(_fixCSS).catch(() => {});
          });
          contents.on('did-navigate', () => {
            contents.insertCSS(_fixCSS).catch(() => {});
          });
        });
        console.log('[Frame Fix] CSS app-region fix registered for all webContents');
      }
    }
    // ── End native titlebar ───────────────────────────────────────────

    // Spoof user agent to macOS so the webapp shows the correct branding
    // and auth flows (Google OAuth checks UA for platform compatibility).
    // Without this, the webapp sees "Linux" in the UA and falls through
    // to "Claude for Windows" or breaks Google auth.
    const app = resolveElectronApp(module);
    if (app) {
      const electronVersion = process.versions.electron || '33.0.0';
      const chromeVersion = process.versions.chrome || '130.0.0.0';
      app.userAgentFallback = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Claude/' + (app.getVersion ? app.getVersion() : '1.0.0') + ' Chrome/' + chromeVersion + ' Electron/' + electronVersion + ' Safari/537.36';
      console.log('[Frame Fix] User agent spoofed to macOS');

      // Set the Wayland app-id so COSMIC (and other compositors) match the
      // running window to claude.desktop, giving it the correct icon in the
      // taskbar and making pin-to-dock work.
      if (REAL_PLATFORM === 'linux') {
        if (typeof app.setDesktopName === 'function') {
          app.setDesktopName('claude.desktop');
          console.log('[Frame Fix] Desktop name set to claude.desktop');
        }
        if (typeof app.setName === 'function') {
          app.setName('Claude');
        }
      }
    }

    // Intercept ipcMain.handle to inject our VM handlers
    const { ipcMain } = module;
    // Hoisted to outer scope so webContents.ipc.handle() patch can reference them
    let originalHandle;
    let originalRemoveHandler;
    if (ipcMain && !global.__coworkIpcHandlePatched) {
      global.__coworkIpcHandlePatched = true;


      // Wire IPC tap before capturing originalHandle so the tap sees raw handler
      // behavior (before our overrides). Only active when CLAUDE_COWORK_IPC_TAP=1.
      if (ipcTap.enabled) {
        ipcTap.wrapHandle(ipcMain);
      }
      originalHandle = ipcMain.handle.bind(ipcMain);
      originalRemoveHandler = ipcMain.removeHandler ? ipcMain.removeHandler.bind(ipcMain) : (() => {});

      // Protect proactively registered channels from being removed by the asar
      if (ipcMain.removeHandler) {
        ipcMain.removeHandler = function(channel) {
          if (isProactiveChannel(channel)) return;
          return originalRemoveHandler(channel);
        };
      }

      ipcMain.handle = function(channel, handler) {
        // Phase 4: canary observation -- side-effect only, never blocks.
        _bridgeCanary.observe(channel);

        // Extract UUID from first EIPC channel and proactively register all overrides.
        // Handlers like ComputerUseTcc are never registered by the asar on Linux
        // (macOS-only native dependency), so registration-time interception can't
        // catch them. Proactive registration on ipcMain provides a fallback.
        const uuid = extractEipcUuid(channel);
        if (uuid) {
          proactivelyRegisterOverrides(originalHandle, originalRemoveHandler, ipcOverrides, uuid);
        }

        const overrideHandler = matchOverride(channel, ipcOverrides);
        if (overrideHandler) {
          if (isProactiveChannel(channel)) return; // Already registered proactively
          return originalHandle(channel, overrideHandler);
        }

        // Auto-permissions toggle TTL cap (Phase 2). The asar exposes two
        // toggles -- autoPermissionsModeEnabled, bypassPermissionsModeEnabled
        // -- that skip permission prompts. Both default to false with no
        // built-in TTL. Wrap the setPreference handler so flipping either
        // to true schedules an auto-revert to false after the cap.
        // EIPC UUID prefix varies per build; match by suffix.
        if (typeof channel === 'string' && channel.endsWith('AppPreferences_$_setPreference')) {
          return originalHandle(channel, _autoPermissionsCap.wrapHandler(handler));
        }

        // Debounce connect-to-mcp-server: the renderer fires duplicate connect
        // requests because mcp-server-auto-reconnect and mcpConfigChange both
        // arrive within ~1ms, each triggering a connect call. The asar's handler
        // already deduplicates (won't double-launch), but the IPC round-trips
        // add noise and latency. Coalesce calls for the same server within 2s.
        if (channel === 'connect-to-mcp-server') {
          const _mcpConnectTimes = new Map();
          const wrappedHandler = async function(event, serverName) {
            const now = Date.now();
            const lastConnect = _mcpConnectTimes.get(serverName);
            if (lastConnect && (now - lastConnect) < 2000) {
              return; // Already connecting this server
            }
            _mcpConnectTimes.set(serverName, now);
            return handler(event, serverName);
          };
          return originalHandle(channel, wrappedHandler);
        }

        return originalHandle(channel, asarAdapter.wrapHandler(channel, handler));
      };

      console.log('[Cowork] IPC handler interception enabled');
    }

    // Stub out macOS-only systemPreferences methods that cause crashes on Linux
    if (module.systemPreferences && !global.__coworkSystemPreferencesPatched) {
      global.__coworkSystemPreferencesPatched = true;
      module.systemPreferences.getMediaAccessStatus = function(mediaType) {
        console.log('[Frame Fix] Stubbed systemPreferences.getMediaAccessStatus:', mediaType, '-> denied');
        return 'denied';
      };
      module.systemPreferences.askForMediaAccess = async function(mediaType) {
        console.log('[Frame Fix] Stubbed systemPreferences.askForMediaAccess:', mediaType, '-> denied');
        return false;
      };
      module.systemPreferences.setUserDefault = function(key, type, value) {
        console.log('[Frame Fix] Stubbed systemPreferences.setUserDefault:', key);
      };
      module.systemPreferences.getUserDefault = function(key, type) {
        console.log('[Frame Fix] Stubbed systemPreferences.getUserDefault:', key);
        return undefined;
      };
      console.log('[Frame Fix] systemPreferences patched for Linux');
    }

    // ── Intercept setAsDefaultProtocolClient ──────────────────────────
    // On Linux, Electron's setAsDefaultProtocolClient creates/overwrites a
    // .desktop file pointing to the raw electron binary, breaking our
    // claude-desktop wrapper as the protocol handler. We already registered
    // the correct claude.desktop during install. Make this a no-op so
    // Electron doesn't clobber our registration.
    const _app = resolveElectronApp(module);
    if (_app && typeof _app.setAsDefaultProtocolClient === 'function' && !_app.__coworkProtocolClientPatched) {
      _app.__coworkProtocolClientPatched = true;
      const _origSetProtocol = _app.setAsDefaultProtocolClient.bind(_app);
      _app.setAsDefaultProtocolClient = function(protocol, ...rest) {
        if (REAL_PLATFORM === 'linux') {
          console.log('[Frame Fix] Suppressed setAsDefaultProtocolClient(' + protocol + ') — using install-time claude.desktop');
          return true;
        }
        return _origSetProtocol(protocol, ...rest);
      };
      if (typeof _app.removeAsDefaultProtocolClient === 'function') {
        const _origRemoveProtocol = _app.removeAsDefaultProtocolClient.bind(_app);
        _app.removeAsDefaultProtocolClient = function(protocol) {
          if (REAL_PLATFORM === 'linux') return true;
          return _origRemoveProtocol(protocol);
        };
      }
      console.log('[Frame Fix] setAsDefaultProtocolClient patched (no-op on Linux)');
    }

    // Patch BrowserWindow to stub macOS-only methods and handle close events
    // The asar's close handler does `if (isMac()) return;` which swallows
    // close events since we spoof darwin. We prepend a listener that forces
    // app.quit() so killactive/WM close works on all Linux DEs.
    let _closePatched = new WeakSet();
    let _sendPatched = new WeakSet();

    function patchWindowClose(win) {
      if (_closePatched.has(win)) return;
      _closePatched.add(win);

      // Stub macOS-only BrowserWindow methods
      if (!win.setWindowButtonPosition) {
        win.setWindowButtonPosition = function() {
          // no-op on Linux
        };
      }
      // Use prependListener so we fire before the asar's handler
      win.prependListener('close', (event) => {
        if (REAL_PLATFORM === 'linux' && !shuttingDown) {
          console.log('[Shutdown] Window close on Linux — scheduling exit');
          // Defer exit so the close event chain finishes without
          // hitting "Object has been destroyed" in downstream handlers
          setImmediate(() => gracefulQuit('Window closed'));
        }
      });
    }

    // MCP reconnect dedup: suppress auto-reconnect sends that overlap with
    // mcpConfigChange (both fire within ~1ms, causing the renderer to send
    // duplicate connect-to-mcp-server calls for each server).
    let _lastMcpConfigChangeTs = 0;

    function patchEventDispatch(contents) {
      if (!contents || _sendPatched.has(contents) || typeof contents.send !== 'function') {
        return;
      }
      _sendPatched.add(contents);
      const originalSend = contents.send.bind(contents);
      contents.send = function(channel, ...args) {
        // Fallback filter — always available, even before orchestrator
        const ignoredType = getIgnoredLiveMessageType(channel, args[0]);
        if (ignoredType) {
          logIgnoredLiveMessage(channel, args[0], ignoredType);
          return false;
        }

        // MCP dedup: track mcpConfigChange timing and suppress overlapping
        // auto-reconnect sends. Both arrive within ~1ms; the config change
        // already tells the renderer which servers need reconnection.
        if (typeof channel === 'string') {
          if (channel.includes('mcpConfigChange')) {
            _lastMcpConfigChangeTs = Date.now();
          } else if (channel === 'mcp-server-auto-reconnect') {
            if (Date.now() - _lastMcpConfigChangeTs < 500) {
              return false;
            }
          }
        }

        return originalSend(channel, ...args);
      };
    }

    // Hook webContents creation to catch windows as they appear
    registerElectronAppListener(module, 'web-contents-created', (_event, contents) => {
      const owner = contents.getOwnerBrowserWindow && contents.getOwnerBrowserWindow();
      if (owner) patchWindowClose(owner);
      patchEventDispatch(contents);
      if (ipcTap.enabled) ipcTap.wrapWebContents(contents);


      // Patch webContents.ipc.handle() to intercept handler registration.
      // When the asar calls contents.ipc.handle(channel, handler), we
      // check the channel suffix against our override registry and
      // substitute our handler if matched. No UUID discovery needed.
      if (contents.ipc && typeof contents.ipc.handle === 'function' && !contents.ipc.__coworkHandlePatched) {
        contents.ipc.__coworkHandlePatched = true;
        const origIpcHandle = contents.ipc.handle.bind(contents.ipc);
        contents.ipc.handle = function(channel, handler) {
          // Phase 4: canary observation -- side-effect only, never blocks.
          _bridgeCanary.observe(channel);

          // Extract UUID and proactively register overrides on ipcMain for
          // handlers the asar never registers (ComputerUseTcc, CoworkSpaces).
          const uuid = extractEipcUuid(channel);
          if (uuid) {
            proactivelyRegisterOverrides(originalHandle, originalRemoveHandler, ipcOverrides, uuid);
          }

          const overrideHandler = matchOverride(channel, ipcOverrides);
          if (overrideHandler) {
            if (channel.includes('CoworkSpaces')) {
              console.log('[Cowork] OVERRIDE applied for: ' + channel.split('_$_').pop());
            }
            return origIpcHandle(channel, overrideHandler);
          }
          return origIpcHandle(channel, asarAdapter.wrapHandler(channel, handler));
        };
        console.log('[Cowork] webContents.ipc.handle() patched for override interception');
      }
    }, 'web-contents-created');

    // Also patch on browser-window-created for certainty
    registerElectronAppListener(module, 'browser-window-created', (_event, win) => {
      patchWindowClose(win);
      if (win && win.webContents) {
        patchEventDispatch(win.webContents);
        if (process.env.CLAUDE_DEVTOOLS === '1' && !global.__coworkDevToolsOpened) {
          global.__coworkDevToolsOpened = true;
          win.webContents.once('dom-ready', () => {
            try { win.webContents.openDevTools({ mode: 'detach' }); } catch (_) {}
          });
          setupAssetDumper(win);
        }
      }
    }, 'browser-window-created');

    if (module.webContents && typeof module.webContents.getAllWebContents === 'function') {
      for (const contents of module.webContents.getAllWebContents()) {
        patchEventDispatch(contents);
      }
    }
    installLinuxMenuInterceptors(module);

    // ── Portal GlobalShortcuts (Wayland) ────────────────────────────────
    // Electron's globalShortcut.register() uses X11 XGrabKey which silently
    // fails on Wayland. Wrap it to route through xdg-desktop-portal instead.
    // On X11, leave the original alone — it works natively.
    if (REAL_PLATFORM === 'linux'
        && (process.env.WAYLAND_DISPLAY || process.env.XDG_SESSION_TYPE === 'wayland')
        && module.globalShortcut) {
      try {
        const { createPortalShortcuts } = require('./cowork/portal_shortcuts.js');
        const portal = createPortalShortcuts();
        if (portal.isAvailable()) {
          const origRegister = module.globalShortcut.register.bind(module.globalShortcut);
          const origUnregister = module.globalShortcut.unregister.bind(module.globalShortcut);
          const origUnregisterAll = module.globalShortcut.unregisterAll.bind(module.globalShortcut);
          const origIsRegistered = module.globalShortcut.isRegistered.bind(module.globalShortcut);

          module.globalShortcut.register = function(accelerator, callback) {
            portal.register(accelerator, callback);
            return true; // Match Electron's sync return
          };
          module.globalShortcut.unregister = function(accelerator) {
            portal.unregister(accelerator);
          };
          module.globalShortcut.unregisterAll = function() {
            portal.unregisterAll();
          };
          module.globalShortcut.isRegistered = function(accelerator) {
            return portal.isRegistered(accelerator);
          };

          // Clean up on quit
          const quitApp = resolveElectronApp(module);
          if (quitApp) {
            quitApp.on('will-quit', () => portal.destroy());
          }

          console.log('[Frame Fix] Global shortcuts routed through xdg-desktop-portal');
        } else {
          console.log('[Frame Fix] GlobalShortcuts portal not available, using Electron default');
        }
      } catch (e) {
        console.warn('[Frame Fix] Portal shortcuts setup failed:', e.message);
      }
    }

  }

  // On Linux, wrap the electron module in a Proxy to intercept the
  // non-configurable BrowserWindow getter (see native titlebar patch above).
  if (id === 'electron' && REAL_PLATFORM === 'linux' && global.__coworkPatchedBrowserWindow) {
    return new Proxy(module, {
      get(target, prop) {
        if (prop === 'BrowserWindow') return global.__coworkPatchedBrowserWindow;
        return target[prop];
      },
      set(target, prop, value) {
        target[prop] = value;
        return true;
      },
    });
  }

  return module;
};