Reliability fixes and server decomposition, merged with main

electron/app-permissions.node-test.mjs

@@ -79,10 +79,11 @@ test("web links reject embedded credentials and non-web schemes", () => {
 });
 
 test("both external-link entry points use the policy and IPC retains the local-origin gate", () => {
-  const main = readFileSync(new URL("./main.mjs", import.meta.url), "utf8");
-  assert.match(main, /ipcMain\.handle\("desktop:open-external", localOnly\("desktop:open-external"/);
-  assert.match(main, /shell\.openExternal\(externalWebUrl\(rawUrl\)\)/);
-  assert.match(main, /shell\.openExternal\(externalWebUrl\(url\)\)/);
+  const createWindowModule = readFileSync(new URL("./main/create-window.mjs", import.meta.url), "utf8");
+  const desktopIpc = readFileSync(new URL("./main/desktop-ipc.mjs", import.meta.url), "utf8");
+  assert.match(desktopIpc, /ipcMain\.handle\("desktop:open-external", localOnly\("desktop:open-external"/);
+  assert.match(desktopIpc, /shell\.openExternal\(externalWebUrl\(rawUrl\)\)/);
+  assert.match(createWindowModule, /shell\.openExternal\(externalWebUrl\(url\)\)/);
 });
 
 test("fails closed on unparsable or opaque origins", () => {

electron/company-backup-main.node-test.mjs

@@ -12,15 +12,15 @@ import { createCompanyBackupSchedule } from "./company-backup-schedule.mjs";
 // importing Electron main (which would start the app). All IO, connection state,
 // and transfer results are synthetic; these tests do not prove archive transport,
 // OS keychain storage, or a renderer workflow.
-const mainSource = readFileSync(new URL("./main.mjs", import.meta.url), "utf8");
-function section(start, end) {
-  const from = mainSource.indexOf(start);
-  const to = mainSource.indexOf(end, from + start.length);
+const moduleSource = readFileSync(new URL("./main/company-backup.mjs", import.meta.url), "utf8");
+function section(start, end, includeEnd = false) {
+  const from = moduleSource.indexOf(start);
+  const to = moduleSource.indexOf(end, from + start.length);
   assert.ok(from >= 0 && to > from, `Main-process test section moved: ${start}`);
-  return mainSource.slice(from, to);
+  return moduleSource.slice(from, includeEnd ? to + end.length : to);
 }
 const functions = section("function ensureManagedDesktop()", "function syncDesktopMutationToken(");
-const registrations = section("const workspaceOnly =", "const savedWorkspace =");
+const registrations = section("const workspaceOnly =", "  } finally { companyRestoreCommitting = false; }\n}));", true);
 const ORIGIN = "http://127.0.0.1:48799";
 const STAGE = "11111111-1111-4111-8111-111111111111";
 const DEVICE = "22222222-2222-4222-8222-222222222222";

electron/diagnostics.test.mjs

@@ -18,12 +18,13 @@ const {
 } = require("./diagnostics.mjs");
 
 // The desktop shell cannot import TypeScript, so its credential list is a
-// hand copy of server/config.ts WORKSPACE_CREDENTIAL_ENV. This test is the
+// hand copy of WORKSPACE_CREDENTIAL_ENV (server/config/credentials.ts).
+// This test is the
 // drift alarm: a name added server-side without updating the copy here would
 // otherwise ship an unredacted export path.
-describe("credential env parity with server/config.ts", () => {
+describe("credential env parity with server/config/credentials.ts", () => {
   it("matches WORKSPACE_CREDENTIAL_ENV exactly", () => {
-    const config = readFileSync(new URL("../server/config.ts", import.meta.url), "utf8");
+    const config = readFileSync(new URL("../server/config/credentials.ts", import.meta.url), "utf8");
     const match = config.match(/WORKSPACE_CREDENTIAL_ENV = \[([\s\S]*?)\] as const/);
     expect(match).not.toBeNull();
     const names = [...match[1].matchAll(/"([A-Z0-9_]+)"/g)].map((m) => m[1]);