Skip to content

fix(desktop): backend startup failures now surface a dialog and report themselves - #174

Merged
badcuban merged 4 commits into
mainfrom
worktree-startup-self-heal
Aug 22, 2026
Merged

badcuban merged 4 commits into
mainfrom
worktree-startup-self-heal

Conversation

@badcuban

Copy link
Copy Markdown
Collaborator

Problem

On a machine where the backend fails to start, the desktop shell was invisible forever: before the first successful readiness it restarted a crashing backend endlessly (or abandoned an alive-but-unresponsive one after a logged 60s timeout), with no window, no tray icon, and no dialog. Windows users then hit the "Threadlines is already running" box on every second click. A field report (Windows, latest stable, recurring after reboot) matches this exactly; PostHog shows that install has never sent a boot heartbeat on any version.

Fix

  • Before the first readiness, failures cap: three failed spawns (missing server entry included), or one readiness timeout, which now kills the zombie run. Then a native dialog offers Try Again / Open Logs Folder / Quit. Quit releases the single-instance lock. After first readiness, restart behavior is unchanged.
  • The failure sends one anonymous desktop.backend.startup_failed PostHog event under the existing telemetry consent (same lenient JSONC settings decode and anonymous install id as the server), with exit code and a 2000-char stderr tail that has the home directory scrubbed and credential-shaped values redacted.
  • Hardening from two independent review passes: a dialog defect falls back to a plain error box plus quit; a window-open failure after readiness re-arms the cap; pre-manager port discovery gets a 30s deadline routed to the fatal-startup error box; stop() cancels a pending prompt; output drains are flushed before the failure path reads the stderr tail; the second-instance dialog copy points at the recovery dialog and the Task Manager Details tab.

…isibly

Before the first successful readiness, a backend that crashed on start was
restarted forever with no window, tray icon, or dialog, and a backend that
started but never answered was abandoned after a logged warning while the
process sat invisible. Both wedges now cap: three failed spawns (or one
readiness timeout) kill the run and show a native dialog with Try Again,
Open Logs Folder, and Quit. Restarts after the backend has been ready once
keep the old unbounded behavior.

The failure also sends one anonymous crash report to PostHog (same consent
and install id as server telemetry) carrying the exit code and a stderr
tail with the user's home directory scrubbed, so startup failures in the
field become visible without asking users for log files.
…lures

A broken install (missing dist/bin.mjs) retried on the restart schedule
without ever creating a run, so the new failure cap never fired and the
loop stayed invisible. The missing-entry branch now applies the same
three-attempt budget and surfaces the same prompt.
- Consent now decodes settings.json with the same lenient JSONC parser the
  server uses; strict JSON.parse treated commented files as unreadable and
  defaulted a disabled opt-out back to enabled.
- The crash report is skipped when the anonymous install id cannot be
  persisted, matching server telemetry, instead of sending throwaway ids.
- stop() interrupts a pending startup-failure prompt fiber, and a retry
  answered after someone else started the backend no longer fights them.
- Output drains are flushed (bounded) before the failure path reads the
  stderr tail, without delaying normal run finalization.
- The recovery prompt can no longer fail back into invisibility: a defect
  in the dialog falls back to a plain error box and a clean quit, and the
  crash report is sent concurrently instead of delaying the dialog.
- A window-open failure after backend readiness re-arms the startup
  failure cap instead of unlocking unbounded silent restarts.
- Backend port discovery gets a 30s deadline routed to the existing fatal
  startup error box; a hanging bind probe wedged before the manager ran.
- Crash-report stderr tail shrinks to 2000 chars and passes a credential
  redaction pass on top of home-directory scrubbing.
- The second-instance dialog now points at the recovery dialog and the
  Task Manager Details tab.
@vercel

vercel Bot commented Aug 22, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated (UTC)
threadlines Skipped Skipped Aug 22, 2026 5:39pm

Request Review

@github-actions github-actions Bot added size:XL vouch:trusted PR author is trusted by repo permissions or the VOUCHED list. labels Aug 22, 2026
@badcuban
badcuban merged commit 0541074 into main Aug 22, 2026
13 checks passed
@badcuban
badcuban deleted the worktree-startup-self-heal branch August 22, 2026 17:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size:XL vouch:trusted PR author is trusted by repo permissions or the VOUCHED list.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant