feat(recovery): autosave buffer + crash-recovery banner

VersionHistory snapshots the previous content on every explicit save — an
unsaved buffer is still lost on crash. AutosaveBuffer fills that gap.

- src/main/AutosaveBuffer.js — pure module mirroring VersionHistory's
  injectable-IO pattern; one blob per doc path under
  <userData>/autosave/by-path/<sha1>/recovery.md + meta.json. No history
  (VersionHistory owns that) — just the latest dirty buffer.
- src/main.js — IPC channels autosave:write/read/clear/list; real paths
  go through validatePath, synthetic 'untitled-tab-<id>' keys skip it.
- src/preload.js — added the four channels to ALLOWED_SEND_CHANNELS.
- src/renderer/autosave-client.js — debounced (2s) flush per tab +
  periodic safety net (10s max age) + dirty-write retry on failure.
- src/renderer.js — register on tab create, unregister on close,
  notifyChange piggybacks on performAutoSave's existing dirty-check,
  clearForDocPath after a successful save, showAutosaveRecoveryBanner
  on startup listing pending recoveries with Restore/Dismiss.

Tests (39 new):
- tests/main/AutosaveBuffer.test.js (19): round-trip, overwrite, isolation,
  unicode/emoji, empty content, null coercion, ENOENT vs corrupt meta,
  list ordering, corrupt-sibling skip, input validation, sha1 storage.
- tests/autosave-client.test.js (11): debounce, flushNow bypass,
  no-path skip, clearForDocPath, list proxy, IPC error fallback,
  unregister tear-down, failure-retry, periodic flush, idempotency.

Full suite: 692 tests pass, 63 suites, lint+format clean.

Amit Haridas

src/main.js

@@ -1735,8 +1735,7 @@ function showThirdPartyNoticesWindow() {
       return `(Could not read ${file} in this installation — see the source repository.)`;
     }
   };
-  const esc = (s) =>
-    s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+  const esc = (s) => s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
 
   const html =
     '<!doctype html><html><head><meta charset="utf-8"><title>Third-Party Notices</title><style>' +
@@ -3918,9 +3917,7 @@ async function importWithMarkItDown() {
     dialog.showErrorBox(
       'MarkItDown Import',
       sanitizeErrorMessage(
-        (error.code === 'not_installed'
-          ? error.message
-          : `Import failed: ${error.message}`) +
+        (error.code === 'not_installed' ? error.message : `Import failed: ${error.message}`) +
           '\n\nMarkItDown is an optional Python tool from Microsoft (MIT):\n' +
           '  pip install "markitdown[all]"'
       )
@@ -3980,6 +3977,7 @@ ipcMain.on('set-current-file', (event, filePath) => {
 // Version History (local rollback without Git)
 // ============================================
 const VersionHistory = require('./main/VersionHistory');
+const AutosaveBuffer = require('./main/AutosaveBuffer');
 
 /** IO bundle for VersionHistory bound to <userData>/versions. */
 function versionHistoryIo() {
@@ -4021,6 +4019,67 @@ ipcMain.handle('version-history:delete', (_event, { docPath, id } = {}) => {
   return VersionHistory.deleteVersion({ docPath, id, io: versionHistoryIo() });
 });
 
+// ================================
+// Autosave + crash-recovery buffer
+// ================================
+// The renderer periodically writes the current in-memory buffer here so an
+// unexpected quit (crash, force-kill, power loss) doesn't lose unsaved work.
+// On startup the renderer asks for the pending list and offers recovery; a
+// successful explicit save clears the entry because the buffer is now on
+// disk at its real path.
+function autosaveIo() {
+  return {
+    rootDir: path.join(app.getPath('userData'), 'autosave'),
+    fs,
+    pathUtil: path,
+  };
+}
+
+ipcMain.handle('autosave:write', (_event, { docPath, content } = {}) => {
+  if (typeof docPath !== 'string' || !docPath) {
+    throw new Error('Invalid docPath for autosave');
+  }
+  // Untitled tabs use synthetic keys like 'untitled-tab-<id>'; real paths go
+  // through the same validator VersionHistory uses so a renderer compromise
+  // can't escape the userData root.
+  const isSynthetic = docPath.startsWith('untitled-tab-');
+  if (!isSynthetic) {
+    const validation = validatePath(docPath);
+    if (!validation.valid) throw new Error('Invalid document path for autosave');
+  }
+  return AutosaveBuffer.writeRecovery({
+    docPath,
+    content,
+    appVersion: app.getVersion(),
+    io: autosaveIo(),
+  });
+});
+
+ipcMain.handle('autosave:read', (_event, { docPath } = {}) => {
+  if (typeof docPath !== 'string' || !docPath) return null;
+  const isSynthetic = docPath.startsWith('untitled-tab-');
+  if (!isSynthetic) {
+    const validation = validatePath(docPath);
+    if (!validation.valid) return null;
+  }
+  try {
+    return AutosaveBuffer.readRecovery({ docPath, io: autosaveIo() });
+  } catch (err) {
+    // Corrupt meta.json — surface the error so the renderer can warn, instead
+    // of swallowing it.
+    return { error: err.message };
+  }
+});
+
+ipcMain.handle('autosave:clear', (_event, { docPath } = {}) => {
+  if (typeof docPath !== 'string' || !docPath) return false;
+  return AutosaveBuffer.clearRecovery({ docPath, io: autosaveIo() });
+});
+
+ipcMain.handle('autosave:list', () => {
+  return AutosaveBuffer.listRecoveries({ io: autosaveIo() });
+});
+
 // Handle actual printing when renderer is ready
 ipcMain.on('do-print', (event, { withStyles }) => {
   if (mainWindow) {

src/main/AutosaveBuffer.js

@@ -0,0 +1,178 @@
+/**
+ * Autosave + crash-recovery buffer.
+ *
+ * Mirrors VersionHistory's pattern (per-doc isolated folder, injectable IO for
+ * tests) but covers a different gap: VersionHistory snapshots the *previous*
+ * content on every explicit save, so an unsaved buffer is lost when the app
+ * crashes. AutosaveBuffer fills that gap by periodically (renderer-driven)
+ * writing the current in-memory buffer to a recovery store.
+ *
+ * Recovery model:
+ *   - <userData>/autosave/by-path/<sha1-of-path>/recovery.md   — latest buffer
+ *   - <userData>/autosave/by-path/<sha1-of-path>/meta.json    — {docPath, savedAt, byteSize, appVersion}
+ *
+ * One recovery entry per document is sufficient — newer writes overwrite older
+ * ones. There's no history to keep (VersionHistory handles that).
+ *
+ * Safety:
+ *   - Writes are atomic via writeFileSync (small files; loss of partial write
+ *     is preferable to corrupted recovery)
+ *   - meta.json is read defensively; missing/corrupt = empty list
+ *   - All fs/path access is injectable for unit tests
+ *
+ * @module AutosaveBuffer
+ */
+
+function defaultCrypto() {
+  return require('crypto');
+}
+
+function folderFor(docPath, pathUtil, crypto) {
+  const hash = crypto.createHash('sha1').update(String(docPath)).digest('hex').slice(0, 16);
+  return pathUtil.join('by-path', hash);
+}
+
+/**
+ * Write the current buffer for a document. Overwrites any prior recovery
+ * entry — the latest buffer is the only one that matters for crash recovery.
+ *
+ * @param {object} args
+ * @param {string} args.docPath Absolute path of the document (use a synthetic
+ *   key like 'untitled-tab-<tabId>' for tabs that have never been saved)
+ * @param {string} args.content Buffer content to persist
+ * @param {string} [args.appVersion] Stored so a future schema change can ignore stale entries
+ * @param {object} args.io { rootDir, fs, pathUtil, crypto }
+ * @returns {{savedAt:number, byteSize:number}} meta written alongside the blob
+ */
+function writeRecovery({ docPath, content, appVersion = 'unknown', io }) {
+  if (!docPath || typeof docPath !== 'string') {
+    throw new Error('AutosaveBuffer: docPath is required');
+  }
+  const { rootDir, fs, pathUtil, crypto = defaultCrypto() } = io;
+  const dir = pathUtil.join(rootDir, folderFor(docPath, pathUtil, crypto));
+  fs.mkdirSync(dir, { recursive: true });
+
+  const body = String(content ?? '');
+  const savedAt = Date.now();
+  const byteSize = Buffer.byteLength(body, 'utf-8');
+
+  fs.writeFileSync(pathUtil.join(dir, 'recovery.md'), body, 'utf-8');
+  fs.writeFileSync(
+    pathUtil.join(dir, 'meta.json'),
+    JSON.stringify({ docPath, savedAt, byteSize, appVersion }, null, 2),
+    'utf-8'
+  );
+  return { savedAt, byteSize };
+}
+
+/**
+ * Read the recovery blob + meta for a document. Returns null when no entry
+ * exists; throws when meta.json is present but corrupt (so the renderer can
+ * surface a "couldn't read recovery" warning instead of silently swallowing it).
+ *
+ * @returns {{docPath:string, content:string, savedAt:number, byteSize:number, appVersion:string}|null}
+ */
+function readRecovery({ docPath, io }) {
+  if (!docPath || typeof docPath !== 'string') {
+    throw new Error('AutosaveBuffer: docPath is required');
+  }
+  const { rootDir, fs, pathUtil, crypto = defaultCrypto() } = io;
+  const dir = pathUtil.join(rootDir, folderFor(docPath, pathUtil, crypto));
+  const metaPath = pathUtil.join(dir, 'meta.json');
+  const blobPath = pathUtil.join(dir, 'recovery.md');
+
+  let meta;
+  try {
+    meta = JSON.parse(fs.readFileSync(metaPath, 'utf-8'));
+  } catch (err) {
+    if (err.code === 'ENOENT') return null;
+    throw new Error(`AutosaveBuffer: corrupt meta.json for ${docPath}: ${err.message}`);
+  }
+
+  let content;
+  try {
+    content = fs.readFileSync(blobPath, 'utf-8');
+  } catch (err) {
+    if (err.code === 'ENOENT') return null;
+    throw err;
+  }
+
+  return {
+    docPath: meta.docPath || docPath,
+    content,
+    savedAt: meta.savedAt || 0,
+    byteSize: meta.byteSize ?? Buffer.byteLength(content, 'utf-8'),
+    appVersion: meta.appVersion || 'unknown',
+  };
+}
+
+/**
+ * Delete the recovery entry for a document. Called after a successful explicit
+ * save (the buffer is now on disk at its real path) or after the user
+ * dismisses the recovery banner.
+ *
+ * @returns {boolean} whether an entry was removed
+ */
+function clearRecovery({ docPath, io }) {
+  if (!docPath || typeof docPath !== 'string') {
+    throw new Error('AutosaveBuffer: docPath is required');
+  }
+  const { rootDir, fs, pathUtil, crypto = defaultCrypto() } = io;
+  const dir = pathUtil.join(rootDir, folderFor(docPath, pathUtil, crypto));
+  let removedAny = false;
+  for (const file of ['recovery.md', 'meta.json']) {
+    try {
+      fs.unlinkSync(pathUtil.join(dir, file));
+      removedAny = true;
+    } catch (err) {
+      if (err.code !== 'ENOENT') throw err;
+    }
+  }
+  return removedAny;
+}
+
+/**
+ * List every recovery entry across all documents. Used at startup to decide
+ * whether to show a "recover unsaved work?" prompt.
+ *
+ * @returns {Array<{docPath:string, savedAt:number, byteSize:number, appVersion:string}>}
+ */
+function listRecoveries({ io }) {
+  const { rootDir, fs, pathUtil } = io;
+  const baseDir = pathUtil.join(rootDir, 'by-path');
+  let dirs;
+  try {
+    dirs = fs.readdirSync(baseDir);
+  } catch (err) {
+    if (err.code === 'ENOENT') return [];
+    throw err;
+  }
+  const out = [];
+  for (const hash of dirs) {
+    const metaPath = pathUtil.join(baseDir, hash, 'meta.json');
+    try {
+      const meta = JSON.parse(fs.readFileSync(metaPath, 'utf-8'));
+      if (meta && typeof meta.docPath === 'string') {
+        out.push({
+          docPath: meta.docPath,
+          savedAt: meta.savedAt || 0,
+          byteSize: meta.byteSize || 0,
+          appVersion: meta.appVersion || 'unknown',
+        });
+      }
+    } catch {
+      // Corrupt or missing meta — skip; the next write will rewrite it
+    }
+  }
+  // Newest first — most likely to be relevant
+  out.sort((a, b) => b.savedAt - a.savedAt);
+  return out;
+}
+
+module.exports = {
+  writeRecovery,
+  readRecovery,
+  clearRecovery,
+  listRecoveries,
+  folderFor,
+};

src/main/ExportThemes.js

@@ -152,9 +152,7 @@ function buildLatexThemeHeader(themeId) {
   // exotic minimal TeX install degrades by omission (pandoc still succeeds)
   lines.push('\\usepackage{titlesec}');
   if (p.sansHeadings) lines.push('\\renewcommand{\\familydefault}{\\sfdefault}');
-  const rule = p.sectionRule && p.ruleColor
-    ? '{\\color{mcthemerule}\\titlerule[0.6pt]}'
-    : '';
+  const rule = p.sectionRule && p.ruleColor ? '{\\color{mcthemerule}\\titlerule[0.6pt]}' : '';
   lines.push(
     `\\titleformat{\\section}{\\LARGE\\bfseries\\color{mcthemeheading}}{\\thesection}{0.8em}{}${rule}`
   );
@@ -167,7 +165,9 @@ function buildLatexThemeHeader(themeId) {
 
   // Pandoc loads hyperref itself; color links via \hypersetup in the header
   lines.push('\\usepackage{etoolbox}');
-  lines.push('\\AfterEndPreamble{\\hypersetup{colorlinks=true,linkcolor=mcthemelink,urlcolor=mcthemelink}}');
+  lines.push(
+    '\\AfterEndPreamble{\\hypersetup{colorlinks=true,linkcolor=mcthemelink,urlcolor=mcthemelink}}'
+  );
 
   return lines.join('\n') + '\n';
 }
@@ -193,7 +193,16 @@ function applyDocxTheme(docxPath, themeId, io = {}) {
   if (!stylesFile) return false;
   let xml = stylesFile.asText();
 
-  const headingIds = ['Title', 'Subtitle', 'Heading1', 'Heading2', 'Heading3', 'Heading4', 'Heading5', 'Heading6'];
+  const headingIds = [
+    'Title',
+    'Subtitle',
+    'Heading1',
+    'Heading2',
+    'Heading3',
+    'Heading4',
+    'Heading5',
+    'Heading6',
+  ];
   for (const styleId of headingIds) {
     // Match this style's <w:style …w:styleId="X">…</w:style> block (they
     // never nest), then rewrite its rPr color/rFonts
@@ -234,10 +243,7 @@ function applyDocxTheme(docxPath, themeId, io = {}) {
   // Body font: patch the docDefaults rPrDefault (affects Normal everywhere)
   if (d.bodyFont) {
     const patch = `<w:rFonts w:ascii="${d.bodyFont}" w:hAnsi="${d.bodyFont}" w:cs="${d.bodyFont}"/>`;
-    xml = xml.replace(
-      /(<w:docDefaults>\s*<w:rPrDefault>\s*<w:rPr>)/,
-      `$1${patch}`
-    );
+    xml = xml.replace(/(<w:docDefaults>\s*<w:rPrDefault>\s*<w:rPr>)/, `$1${patch}`);
   }
 
   zip.file('word/styles.xml', xml);

src/main/MarkItDown.js

@@ -160,7 +160,9 @@ async function convertToMarkdown(inputPath, options = {}) {
           // Prefer the LAST informative stderr line: markitdown ends its
           // output with the actionable install hint ("pip install
           // 'markitdown[pdf]'"), while the first lines are a traceback.
-          const stderrLines = safe(stderr).split('\n').filter((l) => l.trim().length > 0);
+          const stderrLines = safe(stderr)
+            .split('\n')
+            .filter((l) => l.trim().length > 0);
           const detail =
             stderrLines[stderrLines.length - 1] ||
             safe(error.message).split('\n')[0] ||

src/main/PDFOperations.js

@@ -445,10 +445,7 @@ async function loadPdfjs() {
 // Windows path (C:\...\standard_fonts\) fails that check and breaks
 // extractText/extractImages on Windows, so always hand pdfjs a file:// URL.
 function getStandardFontDataUrl() {
-  const dir = path.join(
-    path.dirname(require.resolve('pdfjs-dist/package.json')),
-    'standard_fonts'
-  );
+  const dir = path.join(path.dirname(require.resolve('pdfjs-dist/package.json')), 'standard_fonts');
   const url = require('url').pathToFileURL(dir);
   return url.href.endsWith('/') ? url.href : url.href + '/';
 }

src/plugins/built-in/writing-studio/panels/manuscript-panel.js

@@ -158,7 +158,9 @@ function askForProjectName() {
       overlay.remove();
       resolve(value);
     };
-    overlay.querySelector('[data-role="ok"]').addEventListener('click', () => done(input.value.trim() || null));
+    overlay
+      .querySelector('[data-role="ok"]')
+      .addEventListener('click', () => done(input.value.trim() || null));
     overlay.querySelector('[data-role="cancel"]').addEventListener('click', () => done(null));
     overlay.addEventListener('click', (event) => {
       if (event.target === overlay) done(null);

src/preload.js

@@ -180,6 +180,12 @@ const ALLOWED_SEND_CHANNELS = [
   'version-history:read',
   'version-history:save',
   'version-history:delete',
+
+  // Autosave + crash-recovery buffer
+  'autosave:write',
+  'autosave:read',
+  'autosave:clear',
+  'autosave:list',
 ];
 
 const ALLOWED_RECEIVE_CHANNELS = [

src/renderer.js

@@ -4,6 +4,15 @@
  */
 
 const { ipcRenderer, webUtils } = require('electron');
+const { AutosaveController } = require('./renderer/autosave-client');
+
+// Renderer-side autosave controller. The TabManager calls into this when a
+// tab becomes dirty so the current buffer is periodically persisted under
+// <userData>/autosave/ — recoverable on next launch after a crash. A
+// successful explicit save clears the entry (the buffer is now on disk at
+// its real path); closing a tab without saving leaves it in place so the
+// user can recover later.
+const autosaveController = new AutosaveController();
 const marked = require('marked');
 const { markedHighlight } = require('marked-highlight');
 const createDOMPurify = require('dompurify');
@@ -520,6 +529,17 @@ class TabManager {
     this.createTabElements(tab);
     this.switchToTab(newTabId);
     this.startAutoSave();
+
+    // Register with the crash-recovery autosave controller so unsaved
+    // edits are persisted to <userData>/autosave/ as the user types.
+    // The controller pulls docPath/content via the closures so it always
+    // sees the latest values.
+    autosaveController.registerTab(
+      tab.id,
+      () => tab.filePath || `untitled-tab-${tab.id}`,
+      () => tab.content
+    );
+
     this.updateTabBar();
   }
   createPdfTab(filePath) {
@@ -834,6 +854,11 @@ class TabManager {
     }
     this.tabs.delete(tabId);
 
+    // Stop tracking this tab with the autosave controller. The persisted
+    // recovery blob is left in place; if the user reopens the file later,
+    // the recovery banner will offer to restore it.
+    autosaveController.unregisterTab(tabId);
+
     // Switch to another tab if this was active
     if (this.activeTabId === tabId) {
       const remainingTabs = Array.from(this.tabs.keys());
@@ -1261,6 +1286,12 @@ class TabManager {
       // Show brief auto-save indicator
       this.showAutoSaveIndicator();
     }
+
+    // Crash-recovery autosave (independent of the on-disk save above): any
+    // tab with a path that's dirty since its last flush gets persisted to
+    // <userData>/autosave/. This survives crashes without polluting the
+    // real file.
+    autosaveController.notifyChange(tab.id);
   }
   showAutoSaveIndicator() {
     const indicator = document.createElement('div');
@@ -1992,10 +2023,100 @@ function showRestoreSessionPrompt(session) {
   });
 }
 
+/**
+ * Show a banner offering to restore unsaved buffers that were persisted by
+ * AutosaveBuffer before an unexpected quit. Each entry is shown with its
+ * savedAt timestamp and a byte-size hint; clicking "Restore" overwrites the
+ * matching open tab (or creates one), "Dismiss" clears the autosave entry.
+ *
+ * The banner is intentionally lighter than the session-restore overlay —
+ * recovery of buffer content is best-effort and shouldn't block startup.
+ */
+function showAutosaveRecoveryBanner(pending) {
+  const overlay = document.createElement('div');
+  overlay.className = 'autosave-recovery-banner';
+  overlay.style.cssText =
+    'position:fixed;top:0;left:0;right:0;z-index:10000;background:#fff8e1;border-bottom:2px solid #f6a623;padding:10px 16px;font-family:system-ui;font-size:13px;box-shadow:0 2px 6px rgba(0,0,0,0.08);display:flex;align-items:center;gap:12px;flex-wrap:wrap;';
+
+  const summary = document.createElement('span');
+  const fileList = pending
+    .slice(0, 3)
+    .map((p) => {
+      const name =
+        String(p.docPath || '')
+          .split(/[/\\]/)
+          .pop() || p.docPath;
+      const when = new Date(p.savedAt || 0).toLocaleString();
+      return `${name} (${when})`;
+    })
+    .join(' · ');
+  const extra = pending.length > 3 ? ` · +${pending.length - 3} more` : '';
+  summary.textContent = `Unsaved work from a previous session: ${fileList}${extra}`;
+  overlay.appendChild(summary);
+
+  const restoreBtn = document.createElement('button');
+  restoreBtn.textContent = 'Restore';
+  restoreBtn.style.cssText =
+    'background:#f6a623;color:#fff;border:none;padding:4px 12px;border-radius:4px;cursor:pointer;font-weight:600;';
+  restoreBtn.addEventListener('click', async () => {
+    for (const entry of pending) {
+      const rec = await autosaveController.readRecovery(entry.docPath);
+      if (!rec || !rec.content) continue;
+      const tab = tabManager?.tabs?.get(tabManager.activeTabId);
+      if (tab && (tab.filePath === entry.docPath || !tab.filePath)) {
+        // Overwrite the current untitled/same-path tab with the recovered buffer.
+        if (tab.editorView) {
+          tab.editorView.dispatch({
+            changes: { from: 0, to: tab.editorView.state.doc.length, insert: rec.content },
+          });
+        }
+        tab.content = rec.content;
+        tab.isDirty = true;
+        tabManager.updatePreview?.(tab.id, true);
+        autosaveController.notifyChange(tab.id);
+      }
+      // Dismiss the entry either way — one-shot offer.
+      autosaveController.dismissRecovery(entry.docPath).catch(() => {});
+    }
+    overlay.remove();
+  });
+
+  const dismissBtn = document.createElement('button');
+  dismissBtn.textContent = 'Dismiss';
+  dismissBtn.style.cssText =
+    'background:transparent;color:#333;border:1px solid #ccc;padding:4px 12px;border-radius:4px;cursor:pointer;';
+  dismissBtn.addEventListener('click', async () => {
+    for (const entry of pending) {
+      autosaveController.dismissRecovery(entry.docPath).catch(() => {});
+    }
+    overlay.remove();
+  });
+
+  overlay.appendChild(restoreBtn);
+  overlay.appendChild(dismissBtn);
+  document.body.appendChild(overlay);
+}
+
 document.addEventListener('DOMContentLoaded', async () => {
   const ModalManager = _ModalManager;
   tabManager = new TabManager();
 
+  // ================================
+  // Crash recovery: offer to restore unsaved buffers from autosave
+  // ================================
+  // Independent of the session-restore prompt above: that restores the tab
+  // list, this restores the BUFFER CONTENT of any tab whose autosave entry
+  // was written before an unexpected quit. SessionStore covers tab metadata;
+  // AutosaveBuffer covers what the user actually typed.
+  try {
+    const pending = await autosaveController.checkPendingRecoveries();
+    if (Array.isArray(pending) && pending.length > 0) {
+      showAutosaveRecoveryBanner(pending);
+    }
+  } catch (err) {
+    console.warn('[autosave] recovery sweep failed:', err && err.message);
+  }
+
   // ================================
   // Crash recovery: offer to restore the previous session
   // ================================
@@ -2759,6 +2880,10 @@ ipcRenderer.on('get-content-for-save', (event, filePath) => {
     tabManager.updateTabBar();
     tabManager.updateFilePath();
     tabManager.updateBreadcrumb();
+
+    // Buffer is now on disk at its real path — clear the crash-recovery
+    // autosave entry so we don't offer to "recover" what was just saved.
+    autosaveController.clearForDocPath(filePath).catch(() => {});
   }
 });
 ipcRenderer.on('get-content-for-spreadsheet', (event, format) => {

src/renderer/autosave-client.js

@@ -0,0 +1,174 @@
+/**
+ * Renderer-side autosave controller.
+ *
+ * Buffers every keystroke and flushes the current document body to the main
+ * process at most once per AUTOSAVE_DEBOUNCE_MS. The main process persists it
+ * under <userData>/autosave/ via the AutosaveBuffer module; a successful
+ * explicit save clears the entry because the buffer is now on disk at its
+ * real path.
+ *
+ * Three things the controller is responsible for:
+ *   1. Per-tab debounced flush — registerTab(tabId, getDocPath, getContent)
+ *      wires up the writer; unregisterTab(tabId) tears it down on close.
+ *   2. Periodic flush while the buffer is dirty — a hidden interval makes
+ *      sure the user can quit any time and not lose more than a few seconds
+ *      of work, even if they don't type again.
+ *   3. Startup recovery sweep — checkPendingRecoveries() lists every
+ *      pending recovery on startup so the UI can offer to restore.
+ *
+ * Recovery banners and "save cleared autosave" UX live in the renderer, not
+ * here — this module only manages the I/O.
+ */
+
+const { ipcRenderer } = require('electron');
+
+const AUTOSAVE_DEBOUNCE_MS = 2000;
+const AUTOSAVE_MAX_INTERVAL_MS = 10000; // flush dirty buffers even when idle
+
+class AutosaveController {
+  constructor() {
+    /** Map<tabId, {docPath, getContent, timer, dirty, lastFlushAt}> */
+    this._tabs = new Map();
+    this._interval = null;
+  }
+
+  /**
+   * Begin autosaving a tab. The docPath may be a synthetic 'untitled-tab-<id>'
+   * for never-saved buffers; it may also be a real absolute path.
+   *
+   * @param {string|number} tabId
+   * @param {() => string|null|undefined} getDocPath returns the current path
+   *   (or null/untitled key) for the tab
+   * @param {() => string} getContent returns the current buffer
+   */
+  registerTab(tabId, getDocPath, getContent) {
+    if (this._tabs.has(tabId)) return; // already registered
+    this._tabs.set(tabId, {
+      docPath: null,
+      getDocPath,
+      getContent,
+      timer: null,
+      dirty: false,
+      lastFlushAt: 0,
+    });
+    this._ensureInterval();
+  }
+
+  /**
+   * Stop autosaving a tab. Called on close; the persisted recovery blob is
+   * left in place — if the user reopens the file later, the recovery banner
+   * will offer to restore it.
+   */
+  unregisterTab(tabId) {
+    const entry = this._tabs.get(tabId);
+    if (!entry) return;
+    if (entry.timer) clearTimeout(entry.timer);
+    this._tabs.delete(tabId);
+    if (this._tabs.size === 0 && this._interval) {
+      clearInterval(this._interval);
+      this._interval = null;
+    }
+  }
+
+  /**
+   * Notify the controller that the tab's content changed. Schedules a debounced
+   * flush.
+   */
+  notifyChange(tabId) {
+    const entry = this._tabs.get(tabId);
+    if (!entry) return;
+    entry.dirty = true;
+    if (entry.timer) clearTimeout(entry.timer);
+    entry.timer = setTimeout(() => this._flush(tabId), AUTOSAVE_DEBOUNCE_MS);
+  }
+
+  /**
+   * Flush a specific tab immediately. Called after explicit saves and at
+   * shutdown.
+   */
+  async flushNow(tabId) {
+    return this._flush(tabId);
+  }
+
+  /**
+   * Clear the recovery entry for a document — called after a successful save
+   * (the buffer is now on disk at its real path).
+   */
+  async clearForDocPath(docPath) {
+    if (!docPath) return false;
+    try {
+      return await ipcRenderer.invoke('autosave:clear', { docPath });
+    } catch {
+      return false;
+    }
+  }
+
+  /**
+   * List every pending recovery across all documents. Returns
+   * [{docPath, savedAt, byteSize, appVersion}] newest-first.
+   */
+  async checkPendingRecoveries() {
+    try {
+      return await ipcRenderer.invoke('autosave:list');
+    } catch {
+      return [];
+    }
+  }
+
+  /**
+   * Read a specific recovery entry (content + meta). Returns null when the
+   * entry no longer exists or the docPath is missing.
+   */
+  async readRecovery(docPath) {
+    if (!docPath) return null;
+    try {
+      return await ipcRenderer.invoke('autosave:read', { docPath });
+    } catch {
+      return null;
+    }
+  }
+
+  /**
+   * Drop a specific recovery entry — called when the user dismisses the
+   * recovery banner without restoring.
+   */
+  async dismissRecovery(docPath) {
+    return this.clearForDocPath(docPath);
+  }
+
+  // ---- private ----
+
+  _ensureInterval() {
+    if (this._interval) return;
+    this._interval = setInterval(() => {
+      const now = Date.now();
+      for (const [tabId, entry] of this._tabs) {
+        if (!entry.dirty) continue;
+        if (now - entry.lastFlushAt < AUTOSAVE_MAX_INTERVAL_MS) continue;
+        // Best-effort flush — if main is busy, leave the timer in place.
+        this._flush(tabId).catch(() => {});
+      }
+    }, AUTOSAVE_MAX_INTERVAL_MS / 2);
+  }
+
+  async _flush(tabId) {
+    const entry = this._tabs.get(tabId);
+    if (!entry) return;
+    entry.timer = null;
+    if (!entry.dirty) return;
+    const docPath = entry.getDocPath();
+    if (!docPath) return; // tab has no path yet — nothing to recover
+    const content = entry.getContent();
+    entry.dirty = false;
+    entry.lastFlushAt = Date.now();
+    try {
+      await ipcRenderer.invoke('autosave:write', { docPath, content });
+    } catch (err) {
+      // Re-arm so the next change retries; don't swallow silently.
+      entry.dirty = true;
+      console.warn('[autosave] write failed:', err && err.message);
+    }
+  }
+}
+
+module.exports = { AutosaveController, AUTOSAVE_DEBOUNCE_MS };