chore: bump version to 4.11.163 [skip ci]

Pull in timeline scroll memory, media height reservation, avatar caching, jumbo emoji, and Unicode 15 emoji font coverage.

.npmrc

@@ -1 +1,2 @@
-save-exact=true
+save-exact=true
+allow-git=all

electron/main.js

@@ -3,8 +3,10 @@ const path = require('path');
 const fs = require('fs');
 const { exec, execFile, execFileSync } = require('child_process');
 const { promisify } = require('util');
-const Store = require('electron-store');
-const open = require('open');
+const Store = require('electron-store').default;
+const openPkg = require('open');
+const open = openPkg.default;
+const openApps = openPkg.apps;
 const PaarrotAPIServer = require('./api-server');
 const https = require('https');
 const http = require('http');
@@ -14,8 +16,91 @@ const { autoUpdater } = require('electron-updater');
 // Development mode detection - MUST be declared before any code that might use it
 const isDev = process.env.NODE_ENV === 'development' || !app.isPackaged;
 const VITE_DEV_SERVER = 'http://localhost:38347';
+const VITE_DEV_PORT = '38347';
 const PORT = 44548;
 
+function isLoopbackHost(hostname) {
+  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1';
+}
+
+/**
+ * Open http(s) links in a real browser.
+ * On Linux, Electron's shell.openExternal / xdg-open often hit xdg-desktop-portal
+ * which can hand https:// to Discover instead of Firefox. Always launch a browser
+ * binary first; only fall back to the portal as a last resort.
+ */
+async function openExternalUrl(url) {
+  if (!url || (!url.startsWith('http://') && !url.startsWith('https://'))) {
+    await shell.openExternal(url);
+    return;
+  }
+
+  if (process.platform === 'linux') {
+    const browserCandidates = [
+      openApps?.browser,
+      openApps?.firefox,
+      openApps?.chrome,
+      openApps?.edge,
+      openApps?.brave,
+      'firefox',
+      'firefox-esr',
+      'google-chrome',
+      'google-chrome-stable',
+      'chromium',
+      'chromium-browser',
+      'brave-browser',
+      'microsoft-edge',
+      'microsoft-edge-stable',
+    ].filter(Boolean);
+
+    let lastError;
+    for (const name of browserCandidates) {
+      try {
+        await open(url, { app: { name } });
+        return;
+      } catch (err) {
+        lastError = err;
+      }
+    }
+    console.warn('[openExternalUrl] Browser candidates failed, falling back to shell.openExternal', lastError);
+    await shell.openExternal(url);
+    return;
+  }
+
+  try {
+    await open(url);
+  } catch (err) {
+    console.warn('[openExternalUrl] open() failed, falling back to shell.openExternal', err);
+    await shell.openExternal(url);
+  }
+}
+
+/** Keep Vite HMR / same-origin navigations inside Electron; only true externals go to the OS browser. */
+function isAppOwnedUrl(targetUrl, currentUrl) {
+  try {
+    const next = new URL(targetUrl);
+    if (currentUrl) {
+      const current = new URL(currentUrl);
+      if (current.origin === next.origin) return true;
+      // localhost ↔ 127.0.0.1 on the same Vite port after a full reload
+      if (
+        isDev &&
+        isLoopbackHost(current.hostname) &&
+        isLoopbackHost(next.hostname) &&
+        current.port === next.port
+      ) {
+        return true;
+      }
+    }
+    if (isDev && isLoopbackHost(next.hostname) && next.port === VITE_DEV_PORT) {
+      return true;
+    }
+  } catch {
+    return false;
+  }
+  return false;
+}
+
 const execAsync = promisify(exec);
 const execFileAsync = promisify(execFile);
 const store = new Store();
@@ -162,6 +247,10 @@ function extractDeepLinkFromArgv(argv) {
 
 /**
  * Converts a paarrot:// deep link into an in-app hash route.
+ * Supports:
+ * - Hash routes: paarrot://anything/#/login/server/
+ * - Path routes (SSO-safe): paarrot://desktop/login/server/?loginToken=...
+ * Preserves SSO loginToken from the URL query (Synapse inserts it before `#`).
  * @param {string} deepLink - The incoming protocol URL.
  * @returns {string|null} Hash route value without leading #.
  */
@@ -174,17 +263,63 @@ function deepLinkToHashRoute(deepLink) {
     return null;
   }
 
-  const hashIndex = deepLink.indexOf('#');
-  if (hashIndex === -1) {
-    return null;
+  let hashRoute = null;
+  let loginToken = null;
+
+  try {
+    const parsed = new URL(deepLink);
+    loginToken = parsed.searchParams.get('loginToken');
+
+    if (parsed.hash && parsed.hash.length > 1) {
+      const hashValue = parsed.hash.slice(1);
+      hashRoute = hashValue.startsWith('/') ? hashValue : `/${hashValue}`;
+    } else if (parsed.pathname && parsed.pathname !== '/') {
+      // paarrot://desktop/login/... → /login/...
+      hashRoute = parsed.pathname;
+      if (parsed.search && parsed.search.length > 1) {
+        // Keep non-loginToken query on the route; loginToken merged below
+        const params = new URLSearchParams(parsed.search);
+        params.delete('loginToken');
+        const rest = params.toString();
+        if (rest) {
+          hashRoute += `?${rest}`;
+        }
+      }
+    }
+  } catch {
+    const hashIndex = deepLink.indexOf('#');
+    if (hashIndex !== -1) {
+      const hashValue = deepLink.slice(hashIndex + 1);
+      if (hashValue) {
+        hashRoute = hashValue.startsWith('/') ? hashValue : `/${hashValue}`;
+      }
+    }
+
+    const match = deepLink.match(/[?&]loginToken=([^&#]+)/i);
+    if (match) {
+      try {
+        loginToken = decodeURIComponent(match[1]);
+      } catch {
+        loginToken = match[1];
+      }
+    }
   }
 
-  const hashValue = deepLink.slice(hashIndex + 1);
-  if (!hashValue) {
-    return null;
+  if (loginToken) {
+    if (!hashRoute) {
+      hashRoute = '/';
+    }
+    const queryIndex = hashRoute.indexOf('?');
+    const pathPart = queryIndex === -1 ? hashRoute : hashRoute.slice(0, queryIndex);
+    const params = new URLSearchParams(queryIndex === -1 ? '' : hashRoute.slice(queryIndex + 1));
+    if (!params.has('loginToken')) {
+      params.set('loginToken', loginToken);
+    }
+    const query = params.toString();
+    hashRoute = query ? `${pathPart}?${query}` : pathPart;
   }
 
-  return hashValue.startsWith('/') ? hashValue : `/${hashValue}`;
+  return hashRoute;
 }
 
 /**
@@ -304,6 +439,129 @@ function syncProtocolRegistrationState() {
   console.log(`[Protocol] ${PROTOCOL_SCHEME}:// before=${protocolRegistrationState.before} registerCall=${protocolRegistrationState.registerCall} after=${protocolRegistrationState.after}${protocolRegistrationState.error ? ` error=${protocolRegistrationState.error}` : ''}`);
 }
 
+/**
+ * Refresh Linux xdg-mime association for paarrot:// to the current app desktop file.
+ * AppImage upgrades often leave a stale desktop id in mimeapps.list.
+ */
+async function ensureLinuxProtocolHandler() {
+  const home = app.getPath('home');
+  const searchDirs = [
+    path.join(home, '.local', 'share', 'applications'),
+    '/usr/share/applications',
+    '/var/lib/flatpak/exports/share/applications',
+  ];
+
+  let desktopId = null;
+  for (const dir of searchDirs) {
+    try {
+      if (!fs.existsSync(dir)) continue;
+      const entries = fs.readdirSync(dir);
+      // Prefer the newest AppImageLauncher desktop entry when several exist.
+      const matches = entries
+        .filter((name) => /paarrot/i.test(name) && name.endsWith('.desktop'))
+        .map((name) => {
+          try {
+            return { name, mtime: fs.statSync(path.join(dir, name)).mtimeMs };
+          } catch {
+            return { name, mtime: 0 };
+          }
+        })
+        .sort((a, b) => b.mtime - a.mtime);
+      if (matches.length > 0) {
+        desktopId = matches[0].name;
+        break;
+      }
+    } catch {
+      // keep looking
+    }
+  }
+
+  if (!desktopId) {
+    desktopId = 'paarrot.desktop';
+  }
+
+  // Rewrite mimeapps.list so stale AppImage ids cannot win over xdg-mime default.
+  try {
+    const mimeappsPath = path.join(home, '.config', 'mimeapps.list');
+    let content = '';
+    try {
+      content = fs.readFileSync(mimeappsPath, 'utf8');
+    } catch {
+      content = '';
+    }
+
+    const schemeLine = `x-scheme-handler/${PROTOCOL_SCHEME}=${desktopId}`;
+    const lines = content ? content.split(/\r?\n/) : [];
+    let section = null;
+    const next = [];
+    let wroteDefault = false;
+    let wroteAdded = false;
+
+    for (const line of lines) {
+      const trimmed = line.trim();
+      if (trimmed === '[Default Applications]' || trimmed === '[Added Associations]') {
+        section = trimmed;
+        next.push(line);
+        continue;
+      }
+      if (trimmed.startsWith('x-scheme-handler/paarrot=')) {
+        if (section === '[Default Applications]') {
+          next.push(schemeLine);
+          wroteDefault = true;
+        } else if (section === '[Added Associations]') {
+          next.push(`${schemeLine};`);
+          wroteAdded = true;
+        }
+        continue;
+      }
+      next.push(line);
+    }
+
+    if (!next.some((l) => l.trim() === '[Default Applications]')) {
+      next.push('', '[Default Applications]');
+    }
+    if (!wroteDefault) {
+      const idx = next.findIndex((l) => l.trim() === '[Default Applications]');
+      next.splice(idx + 1, 0, schemeLine);
+    }
+    if (!next.some((l) => l.trim() === '[Added Associations]')) {
+      next.unshift('[Added Associations]');
+    }
+    if (!wroteAdded) {
+      const idx = next.findIndex((l) => l.trim() === '[Added Associations]');
+      next.splice(idx + 1, 0, `${schemeLine};`);
+    }
+
+    fs.mkdirSync(path.dirname(mimeappsPath), { recursive: true });
+    fs.writeFileSync(mimeappsPath, `${next.join('\n').replace(/\n{3,}/g, '\n\n').trim()}\n`);
+    console.log(`[Protocol] mimeapps.list → ${desktopId} for x-scheme-handler/${PROTOCOL_SCHEME}`);
+  } catch (error) {
+    console.warn('[Protocol] Failed to rewrite mimeapps.list:', error);
+  }
+
+  await new Promise((resolve) => {
+    execFile(
+      'xdg-mime',
+      ['default', desktopId, `x-scheme-handler/${PROTOCOL_SCHEME}`],
+      { timeout: 5000 },
+      (error, _stdout, stderr) => {
+        if (error) {
+          console.warn(`[Protocol] xdg-mime default failed (${desktopId}):`, error.message, stderr);
+        } else {
+          console.log(`[Protocol] xdg-mime default → ${desktopId} for x-scheme-handler/${PROTOCOL_SCHEME}`);
+        }
+        resolve();
+      }
+    );
+  });
+
+  await new Promise((resolve) => {
+    execFile('update-desktop-database', [path.join(home, '.local', 'share', 'applications')], { timeout: 5000 }, () => {
+      resolve();
+    });
+  });
+}
+
 /**
  * Reads a named Windows registry value.
  * @param {string} keyPath - Registry key path.
@@ -733,15 +991,10 @@ function createWindow() {
     mainWindow = null;
   });
 
-  // Open external links in default browser
-  mainWindow.webContents.setWindowOpenHandler(({ url, features }) => {
-    if (url.startsWith('http://') || url.startsWith('https://')) {
-      shell.openExternal(url);
-      return { action: 'deny' };
-    }
-    // Allow blank windows for screen share pop-outs with custom features
+  // Open external links in default browser (keep same-origin / Vite in Electron)
+  mainWindow.webContents.setWindowOpenHandler(({ url }) => {
     if (url === '' || url === 'about:blank') {
-      return { 
+      return {
         action: 'allow',
         overrideBrowserWindowOptions: {
           frame: false,
@@ -751,16 +1004,24 @@ function createWindow() {
             contextIsolation: true,
             nodeIntegration: false,
             backgroundThrottling: false,
-          }
-        }
+          },
+        },
       };
     }
+
+    if (isAppOwnedUrl(url, mainWindow.webContents.getURL())) {
+      return { action: 'allow' };
+    }
+
+    if (url.startsWith('http://') || url.startsWith('https://')) {
+      openExternalUrl(url);
+      return { action: 'deny' };
+    }
     return { action: 'allow' };
   });
 
   // Navigation handler - open external links in browser.
-  // Same-host navigations (e.g. Vite HMR full reload) must stay in-app;
-  // a hardcoded origin list breaks when the dev server port changes.
+  // Same-origin / local Vite navigations (HMR full reload) must stay in-app.
   mainWindow.webContents.on('will-navigate', (event, url) => {
     if (url.startsWith('blob:') || url.startsWith('data:')) {
       return;
@@ -770,19 +1031,12 @@ function createWindow() {
       return;
     }
 
-    try {
-      const requestedHost = new URL(url).host;
-      const currentUrl = mainWindow.webContents.getURL();
-      const currentHost = currentUrl ? new URL(currentUrl).host : '';
-
-      if (requestedHost && requestedHost !== currentHost) {
-        event.preventDefault();
-        shell.openExternal(url);
-      }
-    } catch {
-      event.preventDefault();
-      shell.openExternal(url);
+    if (isAppOwnedUrl(url, mainWindow.webContents.getURL())) {
+      return;
     }
+
+    event.preventDefault();
+    openExternalUrl(url);
   });
 
   return mainWindow;
@@ -839,6 +1093,12 @@ app.whenReady().then(() => {
 
   syncProtocolRegistrationState();
 
+  if (process.platform === 'linux') {
+    ensureLinuxProtocolHandler().catch((error) => {
+      console.warn('[Protocol] Startup Linux protocol ensure failed:', error);
+    });
+  }
+
   createWindow();
   createTray();
 
@@ -852,18 +1112,27 @@ app.whenReady().then(() => {
     console.error('Failed to start API server:', err);
   });
   
-  // Check for updates on startup (not in development mode)
-  if (!isDev) {
-    // Check for updates on start (after 3 seconds)
-    setTimeout(() => {
-      autoUpdater.checkForUpdates().catch(err => {
-        console.error('Failed to check for updates:', err);
+  // Check for updates on startup
+  setTimeout(() => {
+    if (isDev) {
+      // Exercise the title-bar updater UI with a mock update.
+      sendUpdaterEvent('update-available', {
+        version: '99.0.0-dev',
+        releaseNotes: 'Mock update for development — download to preview the title-bar progress UI.',
+        releaseDate: new Date().toISOString(),
+        mock: true,
       });
-    }, 3000);
+      return;
+    }
+    autoUpdater.checkForUpdates().catch((err) => {
+      console.error('Failed to check for updates:', err);
+    });
+  }, 2500);
 
+  if (!isDev) {
     // Check for updates every 6 hours
     setInterval(() => {
-      autoUpdater.checkForUpdates().catch(err => {
+      autoUpdater.checkForUpdates().catch((err) => {
         console.error('Failed to check for updates:', err);
       });
     }, 6 * 60 * 60 * 1000);
@@ -972,6 +1241,14 @@ ipcMain.handle('protocol:repair', async () => {
 
   syncProtocolRegistrationState();
 
+  if (process.platform === 'linux') {
+    try {
+      await ensureLinuxProtocolHandler();
+    } catch (error) {
+      console.warn('[Protocol] Failed to refresh Linux protocol handler:', error);
+    }
+  }
+
   const status = await getProtocolStatusPayload();
   return {
     success: true,
@@ -991,7 +1268,7 @@ ipcMain.handle('plugin:app|version', () => {
 // Open external URL
 ipcMain.handle('open-external-url', async (event, url) => {
   try {
-    await shell.openExternal(url);
+    await openExternalUrl(url);
     return { success: true };
   } catch (error) {
     return { success: false, error: error.message };
@@ -1114,10 +1391,61 @@ ipcMain.handle('get-background-sync-state', async () => {
   return { success: true, data: 'NotApplicable' };
 });
 
-// Auto-updater IPC handlers
+// Auto-updater IPC handlers (mock in development so title-bar UI can be exercised)
+let mockDownloadTimer = null;
+let mockDownloadPercent = 0;
+
+function sendUpdaterEvent(channel, payload) {
+  if (mainWindow && !mainWindow.isDestroyed()) {
+    mainWindow.webContents.send(channel, payload);
+  }
+}
+
+function startMockDownload() {
+  if (mockDownloadTimer) {
+    clearInterval(mockDownloadTimer);
+  }
+  mockDownloadPercent = 0;
+  sendUpdaterEvent('update-download-progress', {
+    percent: 0,
+    transferred: 0,
+    total: 100,
+    mock: true,
+  });
+
+  mockDownloadTimer = setInterval(() => {
+    mockDownloadPercent = Math.min(100, mockDownloadPercent + 4 + Math.random() * 6);
+    const percent = Math.round(mockDownloadPercent);
+    sendUpdaterEvent('update-download-progress', {
+      percent,
+      transferred: percent,
+      total: 100,
+      mock: true,
+    });
+
+    if (percent >= 100) {
+      clearInterval(mockDownloadTimer);
+      mockDownloadTimer = null;
+      sendUpdaterEvent('update-downloaded', {
+        version: '99.0.0-dev',
+        releaseNotes: 'Mock update for development.',
+        mock: true,
+      });
+    }
+  }, 180);
+}
+
 ipcMain.handle('check-for-updates', async () => {
   if (isDev) {
-    return { success: false, error: 'Updates are not available in development mode' };
+    sendUpdaterEvent('update-checking', { mock: true });
+    await new Promise((resolve) => setTimeout(resolve, 600));
+    sendUpdaterEvent('update-available', {
+      version: '99.0.0-dev',
+      releaseNotes: 'Mock update for development — download to preview the title-bar progress UI.',
+      releaseDate: new Date().toISOString(),
+      mock: true,
+    });
+    return { success: true, data: { updateInfo: { version: '99.0.0-dev' }, mock: true } };
   }
   try {
     const result = await autoUpdater.checkForUpdates();
@@ -1129,7 +1457,8 @@ ipcMain.handle('check-for-updates', async () => {
 
 ipcMain.handle('download-update', async () => {
   if (isDev) {
-    return { success: false, error: 'Updates are not available in development mode' };
+    startMockDownload();
+    return { success: true, data: { mock: true } };
   }
   try {
     await autoUpdater.downloadUpdate();
@@ -1141,7 +1470,12 @@ ipcMain.handle('download-update', async () => {
 
 ipcMain.handle('install-update', () => {
   if (isDev) {
-    return { success: false, error: 'Updates are not available in development mode' };
+    sendUpdaterEvent('update-not-available', {
+      version: app.getVersion(),
+      mock: true,
+      message: 'Mock install — restart skipped in development.',
+    });
+    return { success: true, data: { mock: true } };
   }
   autoUpdater.quitAndInstall();
   return { success: true };
@@ -1149,7 +1483,8 @@ ipcMain.handle('install-update', () => {
 
 ipcMain.handle('download-and-install-update', async () => {
   if (isDev) {
-    return { success: false, error: 'Updates are not available in development mode' };
+    startMockDownload();
+    return { success: true, data: { mock: true } };
   }
   try {
     await autoUpdater.downloadUpdate();
@@ -1160,6 +1495,8 @@ ipcMain.handle('download-and-install-update', async () => {
   }
 });
 
+ipcMain.handle('updater-is-mock', () => ({ success: true, data: { mock: isDev } }));
+
 // Screen capture / desktopCapturer handler
 ipcMain.handle('get-desktop-sources', async (event, opts) => {
   try {

electron/preload.js

@@ -130,6 +130,7 @@ contextBridge.exposeInMainWorld('electron', {
   updater: {
     checkForUpdates: () => ipcRenderer.invoke('check-for-updates'),
     downloadAndInstallUpdate: () => ipcRenderer.invoke('download-and-install-update'),
+    isMock: () => ipcRenderer.invoke('updater-is-mock'),
     onUpdateAvailable: (callback) => {
       ipcRenderer.on('update-available', (_, info) => callback(info));
     },
@@ -139,6 +140,9 @@ contextBridge.exposeInMainWorld('electron', {
     onUpdateDownloaded: (callback) => {
       ipcRenderer.on('update-downloaded', (_, info) => callback(info));
     },
+    onUpdateNotAvailable: (callback) => {
+      ipcRenderer.on('update-not-available', (_, info) => callback(info));
+    },
     downloadUpdate: () => ipcRenderer.invoke('download-update'),
     installUpdate: () => ipcRenderer.invoke('install-update'),
   },

package.json

@@ -1,6 +1,6 @@
 {
   "name": "paarrot",
-  "version": "4.11.131",
+  "version": "4.11.163",
   "description": "Paarrot - A Matrix client based on Cinny",
   "homepage": "https://github.com/Paarrot/Paarrot-Desktop",
   "repository": {
@@ -13,7 +13,7 @@
   },
   "scripts": {
     "dev": "concurrently \"npm run dev:vite\" \"npm run dev:electron\"",
-    "dev:vite": "cd cinny && npm start",
+    "dev:vite": "cross-env BROWSER=none sh -c 'cd cinny && npm start'",
     "dev:electron": "wait-on http://localhost:38347 && cross-env NODE_ENV=development electron .",
     "build": "node -e \"require('fs').copyFileSync('config.json', 'cinny/config.json')\" && cd cinny && npm run build && cd .. && electron-builder --publish always",
     "build:local": "node -e \"require('fs').copyFileSync('config.json', 'cinny/config.json')\" && cd cinny && npm run build && cd .. && electron-builder",
@@ -28,24 +28,28 @@
   },
   "license": "AGPL-3.0-only",
   "dependencies": {
-    "adm-zip": "^0.5.16",
-    "body-parser": "2.2.2",
+    "adm-zip": "^0.5.18",
+    "body-parser": "2.3.0",
     "cors": "2.8.6",
-    "electron-store": "^8.2.0",
-    "electron-updater": "^6.3.9",
+    "electron-store": "^11.0.2",
+    "electron-updater": "^6.8.9",
     "express": "5.2.1",
     "open": "11.0.0"
   },
   "devDependencies": {
-    "@actions/github": "6.0.0",
-    "@electron/rebuild": "4.0.3",
-    "concurrently": "9.2.1",
+    "@actions/github": "9.1.1",
+    "@electron/rebuild": "4.2.0",
+    "concurrently": "10.0.3",
     "cross-env": "10.1.0",
-    "electron": "40.6.0",
-    "electron-builder": "26.8.1",
+    "electron": "43.1.0",
+    "electron-builder": "26.15.3",
     "node-fetch": "3.3.2",
     "png2icons": "2.0.1",
-    "sharp": "0.34.5",
-    "wait-on": "9.0.4"
+    "sharp": "0.35.3",
+    "wait-on": "9.0.10"
+  },
+  "allowScripts": {
+    "electron-winstaller@5.4.0": true,
+    "electron@43.1.0": true
   }
 }