feat(desktop): scope Settings to Runtime Hosts

Host-owned Settings previously followed the default Host, making multi-host configuration ambiguous. Add explicit target selection while keeping client preferences and bot configuration Desktop-owned. Route reads, writes, events, connections, and credentials through the verified target scope without changing the default Host or existing Sessions.

Generated-by: OpenAI Codex

Author: M4n5ter

apps/desktop/src/main/__tests__/client-settings-ipc-main.test.ts

@@ -0,0 +1,43 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import {
+  createDefaultSettings,
+  mergeSettings,
+  type UpdateAppSettingsInput,
+} from "@maka/core/settings";
+import { registerClientSettingsIpc } from "../client-settings-ipc-main.js";
+
+test("client settings updates cannot mutate Runtime Host policy", async () => {
+  const handlers = new Map<string, (...args: unknown[]) => unknown>();
+  let settings = createDefaultSettings();
+  let storedPatch: UpdateAppSettingsInput | undefined;
+  let applied = 0;
+  registerClientSettingsIpc({
+    ipcMain: {
+      handle(channel, listener) {
+        handlers.set(channel, listener as (...args: unknown[]) => unknown);
+      },
+    },
+    settingsStore: {
+      get: async () => settings,
+      update: async (patch: UpdateAppSettingsInput) => {
+        storedPatch = patch;
+        settings = mergeSettings(settings, patch);
+        return settings;
+      },
+    } as never,
+    apply: async () => {
+      applied += 1;
+    },
+  });
+
+  const result = await handlers.get("settings:client:update")?.({}, {
+    appearance: { theme: "dark" },
+    chatDefaults: { permissionMode: "bypass" },
+  });
+
+  assert.deepEqual(storedPatch, { appearance: { theme: "dark" } });
+  assert.equal((result as { settings: typeof settings }).settings.appearance.theme, "dark");
+  assert.equal(settings.chatDefaults.permissionMode, "ask");
+  assert.equal(applied, 1);
+});

apps/desktop/src/main/client-settings-ipc-main.ts

@@ -0,0 +1,39 @@
+import type {
+  AppSettings,
+  UpdateAppSettingsInput,
+  UpdateAppSettingsResult,
+} from "@maka/core/settings";
+import type { SettingsStore } from "@maka/storage";
+import type { IpcMain } from "electron";
+import {
+  clientOwnedSettingsPatch,
+  hasSettingsPatch,
+} from "../shared/settings-ownership.js";
+import {
+  buildSettingsUpdateResult,
+  maskAppSettings,
+} from "./settings-ipc-helpers.js";
+
+export function registerClientSettingsIpc(deps: {
+  readonly ipcMain: Pick<IpcMain, "handle">;
+  readonly settingsStore: SettingsStore;
+  readonly apply: (settings: AppSettings) => Promise<void>;
+}): void {
+  deps.ipcMain.handle("settings:client:get", async () =>
+    maskAppSettings(await deps.settingsStore.get()),
+  );
+  deps.ipcMain.handle(
+    "settings:client:update",
+    async (
+      _event,
+      patch: UpdateAppSettingsInput,
+    ): Promise<UpdateAppSettingsResult> => {
+      const clientPatch = clientOwnedSettingsPatch(patch);
+      const settings = hasSettingsPatch(clientPatch)
+        ? await deps.settingsStore.update(clientPatch)
+        : await deps.settingsStore.get();
+      await deps.apply(settings);
+      return buildSettingsUpdateResult(maskAppSettings(settings), clientPatch);
+    },
+  );
+}

apps/desktop/src/main/runtime-host-boot.ts

@@ -90,6 +90,7 @@ import { registerRuntimeHostConfigIpc } from "./runtime-host-config-ipc-main.js"
 import { createCapabilityRevisionPublisher } from "./runtime-host-capability-revision-publisher.js";
 import { buildClientSettingsTools } from "./client-settings-tools.js";
 import { createClientSettingsEffects } from "./client-settings-effects.js";
+import { registerClientSettingsIpc } from "./client-settings-ipc-main.js";
 import { startClientSettingsWatcher } from "./client-settings-watcher.js";
 import { registerRuntimeHostGitHubCopilotIpc } from "./runtime-host-github-copilot-ipc-main.js";
 import { registerRuntimeHostArtifactsIpc } from "./runtime-host-artifacts-ipc-main.js";
@@ -359,7 +360,7 @@ const botRegistry = new BotRegistry({
       .catch((error) => console.error("[runtime-host] bot message failed:", error));
   },
   onStatusChange: (status) => {
-    sendActiveRuntimeHostEvent("settings:bots:statusChanged", status);
+    mainWindowController.send("settings:bots:statusChanged", status);
   },
 });
 const clientSettingsEffects = createClientSettingsEffects({
@@ -370,8 +371,10 @@ const clientSettingsEffects = createClientSettingsEffects({
   applyBotSettings: useBotOnboardingFixture
     ? async () => undefined
     : (settings) => botRegistry.applySettings(settings),
-  emitExternalChanged: () =>
-    sendActiveRuntimeHostEvent("settings:externalChanged", { ts: Date.now() }),
+  emitExternalChanged: () => {
+    mainWindowController.send("settings:clientChanged");
+    sendActiveRuntimeHostEvent("settings:externalChanged", { ts: Date.now() });
+  },
 });
 const clientSettingsTools = buildClientSettingsTools({
   read: () => settingsStore.get(),
@@ -877,23 +880,6 @@ function registerHostClientIpc(
       updateRuntimeHostSettings(settingsIpcDeps, patch),
     emitConnectionsChanged: emitTargetConnectionListChanged,
   });
-  const candidateSettingsBotsIpc = registerSettingsBotsIpc({
-    ipcMain: scopedIpc,
-    settingsStore,
-    botRegistry,
-    applySettingsRuntimeEffects: async (settings) => {
-      await clientSettingsEffects.apply(settings, true);
-    },
-    productVersion: app.getVersion(),
-    openExternal: (url) => shell.openExternal(url),
-    ...(useBotOnboardingFixture
-      ? {
-          botOnboardingAdapters: createE2eFixtureBotOnboardingAdapters(),
-          botOnboardingReadChannelStatus: () => ({ running: true }),
-        }
-      : {}),
-  });
-  settingsBotsIpc = candidateSettingsBotsIpc;
   registerRuntimeHostPermissionsIpc({
     ipcMain: scopedIpc,
     client,
@@ -1061,10 +1047,6 @@ function registerHostClientIpc(
     unsubscribeSessionCatalogChanges();
     unsubscribeProjectCatalogChanges();
     unsubscribeScheduledTaskChanges();
-    candidateSettingsBotsIpc.dispose();
-    if (settingsBotsIpc === candidateSettingsBotsIpc) {
-      settingsBotsIpc = undefined;
-    }
     runtimePolicyTargets.delete(target);
     if (runtimePolicyTargetsByEpoch.get(scope.targetEpoch) === targetContext) {
       runtimePolicyTargetsByEpoch.delete(scope.targetEpoch);
@@ -1089,6 +1071,29 @@ function registerPersistentClientIpc(): void {
   });
   registerMarkdownSaveIpc({ ipcMain, mainWindowController });
   registerDesktopRuntimeHostProfileIpc(ipcMain, runtimeHostProfileService);
+  registerClientSettingsIpc({
+    ipcMain,
+    settingsStore,
+    apply: async (settings) => {
+      await clientSettingsEffects.apply(settings, true);
+    },
+  });
+  settingsBotsIpc = registerSettingsBotsIpc({
+    ipcMain,
+    settingsStore,
+    botRegistry,
+    applySettingsRuntimeEffects: async (settings) => {
+      await clientSettingsEffects.apply(settings, true);
+    },
+    productVersion: app.getVersion(),
+    openExternal: (url) => shell.openExternal(url),
+    ...(useBotOnboardingFixture
+      ? {
+          botOnboardingAdapters: createE2eFixtureBotOnboardingAdapters(),
+          botOnboardingReadChannelStatus: () => ({ running: true }),
+        }
+      : {}),
+  });
   ipcMain.handle("settings:usageStats", async (_event, range?: UsageRange) =>
     projectDesktopUsageStats(
       { hostId: localRuntimeHostId },

apps/desktop/src/main/runtime-host-settings-ipc-main.ts

@@ -25,6 +25,10 @@ import {
   handleReconnectableRead,
   type ReconnectableReadIpcMain,
 } from "./ipc-reconnect-policy.js";
+import {
+  clientOwnedSettingsPatch,
+  hasSettingsPatch,
+} from "../shared/settings-ownership.js";
 
 type RuntimeHostSettingsClient = Pick<
   DesktopRuntimeHostClient,
@@ -117,8 +121,8 @@ export async function updateRuntimeHostSettings(
   patch: UpdateAppSettingsInput,
 ): Promise<AppSettings> {
   await applyHostPatch(deps.client, patch);
-  const clientPatch = toClientOwnedPatch(patch);
-  const local = hasPatch(clientPatch)
+  const clientPatch = clientOwnedSettingsPatch(patch);
+  const local = hasSettingsPatch(clientPatch)
     ? await deps.settingsStore.update(clientPatch)
     : await deps.settingsStore.get();
   await deps.applyClientSettings(local);
@@ -368,33 +372,3 @@ function withoutSecret(
   const { password: _password, ...value } = patch;
   return value;
 }
-
-function toClientOwnedPatch(
-  patch: UpdateAppSettingsInput,
-): UpdateAppSettingsInput {
-  const personalization =
-    patch.personalization?.uiLocale === undefined &&
-    patch.personalization?.selectedPetId === undefined
-      ? undefined
-      : {
-          ...(patch.personalization.uiLocale === undefined
-            ? {}
-            : { uiLocale: patch.personalization.uiLocale }),
-          ...(patch.personalization.selectedPetId === undefined
-            ? {}
-            : { selectedPetId: patch.personalization.selectedPetId }),
-        };
-  return {
-    ...(patch.botChat ? { botChat: patch.botChat } : {}),
-    ...(patch.usage ? { usage: patch.usage } : {}),
-    ...(patch.appearance ? { appearance: patch.appearance } : {}),
-    ...(personalization ? { personalization } : {}),
-    ...(patch.notifications ? { notifications: patch.notifications } : {}),
-    ...(patch.projects ? { projects: patch.projects } : {}),
-    ...(patch.system ? { system: patch.system } : {}),
-  };
-}
-
-function hasPatch(patch: UpdateAppSettingsInput): boolean {
-  return Object.keys(patch).length > 0;
-}