0020: app: electron: Report rejected command exits

[illume]

Summary

Report command-exit events when desktop command execution is rejected before
spawning a child process:

• -1 for invalid command data
• -2 for rejected permission secrets
• -3 for denied command consent

This prevents renderer-side command objects from remaining pending when the
main process rejects a request.

Source

This upstreams the command-rejection portion of:

• Headlamp: fix ipc listener leak in runCommand and pluginManager Azure/aks-desktop#394
• Azure/aks-desktop@e479876

The change was later rebased in the downstream branch as:

• Azure/aks-desktop@10c313f

Patch 0020 was extracted while preparing the Headlamp source package in:

• build: replace Headlamp submodule with source package Azure/aks-desktop#823

Improvements over the existing changes

• Adds focused unit coverage before the behavior change and raises
  app/electron/runCmd.ts branch coverage to 93.45%. This protects the wider
  command lifecycle rather than only the newly added lines.
• Adds an Electron end-to-end test for the renderer-to-main IPC path. This
  verifies that invalid commands are rejected by the real desktop bridge and
  that the renderer receives exit code -1.
• Only reports invalid-data exits when the untrusted payload contains a string
  command ID. This avoids reflecting malformed identifiers back over IPC.
• Keeps the three rejection causes distinct so callers can diagnose why a
  command did not start.

Backwards compatibility

For users of the downstream patch code, rejected commands now complete with a
negative command-exit code instead of remaining pending. Callers that used a
timeout or the absence of an exit event to infer rejection should migrate.
Callers should handle rejection codes -1, -2, and -3 explicitly. Existing
listeners already accept numeric exit codes, so no API-shape change is required.
Command IDs must be non-empty strings; malformed IDs are rejected without being
reflected over IPC.

For users of Headlamp main, valid commands are unaffected. Command validation,
permission checks, consent prompts, process spawning, output forwarding, and
real child-process exit codes retain their existing behavior. The change is
additive. It only affects requests that the main process rejects before spawn.
Those requests now terminate predictably instead of remaining unresolved.
Choosing Deny on the first consent prompt now rejects immediately, matching
the behavior of a denial already stored in settings.

Testing

• npm --prefix app run tsc
• ./node_modules/.bin/vitest run electron/runCmd.test.ts (48 tests)
• Focused Istanbul coverage for app/electron/runCmd.ts (93.45% branches)
• npm --prefix app/e2e-tests run test-app -- tests/runCommand.spec.ts

The behavior is not visual, so screenshots are not applicable.

Assisted by copilot.

[kubernetes-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: illume

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [illume]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Copilot]

Pull request overview

Adds Electron IPC exit reporting for commands rejected before process creation.

Changes:

• Reports distinct exit codes for validation, permission, and consent failures.
• Expands command lifecycle unit coverage.
• Adds an Electron IPC end-to-end rejection test.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
app/electron/runCmd.ts	Emits rejection exit events.
app/electron/runCmd.test.ts	Adds lifecycle and rejection tests.
app/e2e-tests/tests/runCommand.spec.ts	Tests renderer-to-main invalid-command handling.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

app/electron/runCmd.ts:283

• validateCommandData rejects an empty ID, but this branch still reflects it because it checks only the type. That contradicts the stated non-empty-ID contract and sends command-exit for a malformed identifier. Require a non-empty string here (and cover the empty-string handler case), as is already done by validation.

    if (typeof eventData?.id === 'string') {