fix(main): capture native/renderer/GPU crashes that left zero trace

User-reported: DevDeck sometimes closes with no apparent reason, taking every cockpit
session down with it. Investigated via systematic-debugging before touching any code:

- devdeck-errors.log (the v1.12.0 uncaughtException/unhandledRejection trap) doesn't
  exist — that guard has never fired.
- Windows Application log has no Event 1000 ("Application Error") for DevDeck.exe/
  electron.exe, ever.
- Windows System log shows only clean, scheduled restarts (no Kernel-Power 41 dirty
  shutdown) around the relevant period.
- No WER report or crash dump for the running app (CrashDumps only has entries for the
  OLD v0.3.0 NSIS *installer*, unrelated, from 2026-06-07).
- Only two app.quit() call sites in the codebase, both intentional (tray Quit, second-
  instance lock) — no hidden quit path.

This rules out a JS-catchable exception, an OS-level dirty shutdown, a classic
OS-recorded native crash, and a rogue quit call — but the remaining candidates (a native
crash swallowed by Electron's Crashpad handler since crashReporter was never configured,
an external TerminateProcess, a renderer/GPU crash, a V8 OOM abort) all share one trait:
they leave NO trace anywhere with the app's previous instrumentation. There was nothing
left to investigate without adding observability first.

Added, with user's explicit "don't restart the app I'm using right now" constraint
respected throughout (build/test/QA only — the running instance was never touched):
- crashReporter.start({ uploadToServer: false }) — local-only minidumps for native
  crashes (node-pty/conpty, Chromium) that previously vanished into Crashpad with no
  trace. Nothing is ever uploaded.
- New installAppCrashHandlers (errorGuard.ts) wires `render-process-gone` /
  `child-process-gone` — Electron `app` events (not `process` events, so the existing
  guard couldn't see them) covering renderer/GPU/utility crashes, previously completely
  unmonitored. Skips reason:'clean-exit' (a normal window close/reload) to avoid noise.
- Every diagnostic log line now includes a process.memoryUsage() snapshot, so a V8 OOM
  pattern (long-running cockpit sessions accumulating buffered output) is visible in
  hindsight even though the OOM abort itself can't be caught directly.

340 tests (+5, TDD). If DevDeck closes unexpectedly again, %APPDATA%\DevDeck\
devdeck-errors.log and app.getPath('crashDumps') should now hold real evidence instead
of nothing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: writingdeveloper

README.md

@@ -11,7 +11,7 @@ See every repo's state at a glance — git status, how long it's been neglected,
 ![License](https://img.shields.io/badge/license-MIT-blue)
 ![Platform](https://img.shields.io/badge/platform-Windows%20%7C%20macOS%20%7C%20Linux-0078D6)
 ![Built with Electron](https://img.shields.io/badge/Electron-31-47848F)
-![Tests](https://img.shields.io/badge/tests-302%20passing-3fb950)
+![Tests](https://img.shields.io/badge/tests-340%20passing-3fb950)
 ![CI](https://github.com/writingdeveloper/devdeck/actions/workflows/ci.yml/badge.svg)
 
 <img src="docs/demo/demo.gif" width="820" alt="DevDeck demo" />

package.json

@@ -1,6 +1,6 @@
 {
   "name": "devdeck",
-  "version": "1.12.0",
+  "version": "1.12.1",
   "description": "Project command deck — at-a-glance state + claude -c resume",
   "main": "dist/main/main.js",
   "type": "commonjs",

src/main/errorGuard.test.ts

@@ -1,6 +1,6 @@
 import { describe, it, expect } from 'vitest';
 import { EventEmitter } from 'node:events';
-import { installGlobalErrorHandlers } from './errorGuard';
+import { installGlobalErrorHandlers, installAppCrashHandlers } from './errorGuard';
 
 describe('installGlobalErrorHandlers', () => {
   it('forwards an uncaughtException to onError instead of letting it terminate the process', () => {
@@ -27,3 +27,46 @@ describe('installGlobalErrorHandlers', () => {
     expect(() => proc.emit('uncaughtException', new Error('boom'))).not.toThrow();
   });
 });
+
+describe('installAppCrashHandlers', () => {
+  // render-process-gone / child-process-gone are Electron `app` events (not `process` events) that
+  // installGlobalErrorHandlers cannot see — they cover renderer/GPU/utility-process crashes, which
+  // previously left zero trace anywhere (no devdeck-errors.log entry, no Windows crash event).
+  it('reports an abnormal render-process-gone (crashed/killed/oom) with reason + exitCode', () => {
+    const seen: unknown[] = [];
+    const appLike = new EventEmitter();
+    installAppCrashHandlers(appLike, (kind, detail) => seen.push({ kind, detail }));
+    appLike.emit('render-process-gone', {}, { id: 1 }, { reason: 'crashed', exitCode: 11 });
+    expect(seen).toEqual([{ kind: 'render-process-gone', detail: { reason: 'crashed', exitCode: 11 } }]);
+  });
+
+  it('does NOT report a clean-exit render-process-gone — that is a normal window close/reload, not a crash', () => {
+    const seen: unknown[] = [];
+    const appLike = new EventEmitter();
+    installAppCrashHandlers(appLike, (kind, detail) => seen.push({ kind, detail }));
+    appLike.emit('render-process-gone', {}, { id: 1 }, { reason: 'clean-exit', exitCode: 0 });
+    expect(seen).toEqual([]);
+  });
+
+  it('reports an abnormal child-process-gone (e.g. GPU crash) with its process type', () => {
+    const seen: unknown[] = [];
+    const appLike = new EventEmitter();
+    installAppCrashHandlers(appLike, (kind, detail) => seen.push({ kind, detail }));
+    appLike.emit('child-process-gone', {}, { type: 'GPU', reason: 'crashed', exitCode: 139 });
+    expect(seen).toEqual([{ kind: 'child-process-gone', detail: { type: 'GPU', reason: 'crashed', exitCode: 139 } }]);
+  });
+
+  it('does not report a clean-exit child-process-gone', () => {
+    const seen: unknown[] = [];
+    const appLike = new EventEmitter();
+    installAppCrashHandlers(appLike, (kind, detail) => seen.push({ kind, detail }));
+    appLike.emit('child-process-gone', {}, { type: 'Utility', reason: 'clean-exit', exitCode: 0 });
+    expect(seen).toEqual([]);
+  });
+
+  it('keeps running when onEvent itself throws', () => {
+    const appLike = new EventEmitter();
+    installAppCrashHandlers(appLike, () => { throw new Error('logger broke'); });
+    expect(() => appLike.emit('render-process-gone', {}, {}, { reason: 'crashed', exitCode: 1 })).not.toThrow();
+  });
+});

src/main/errorGuard.ts

@@ -24,3 +24,26 @@ export function installGlobalErrorHandlers(
   proc.on('uncaughtException', guard('uncaughtException'));
   proc.on('unhandledRejection', guard('unhandledRejection'));
 }
+
+export type AppCrashKind = 'render-process-gone' | 'child-process-gone';
+export interface AppCrashDetail { reason: string; exitCode: number; type?: string; }
+
+/**
+ * Electron's `render-process-gone` (renderer/GPU-tab crash) and `child-process-gone` (GPU/utility
+ * process crash) fire on `app`, not `process` — installGlobalErrorHandlers can't see them. Before
+ * this, a renderer or GPU crash left ZERO trace anywhere (no devdeck-errors.log entry, no Windows
+ * crash event), one of the leading suspects for DevDeck "closing for no reason". `reason ===
+ * 'clean-exit'` is a normal window close/reload, not a crash — skipped so it doesn't spam the log.
+ */
+export function installAppCrashHandlers(
+  appLike: NodeJS.EventEmitter,
+  onEvent: (kind: AppCrashKind, detail: AppCrashDetail) => void,
+): void {
+  const guard = (kind: AppCrashKind) => (...args: unknown[]) => {
+    const detail = args[args.length - 1] as AppCrashDetail;
+    if (detail?.reason === 'clean-exit') return;
+    try { onEvent(kind, detail); } catch { /* swallow — logging is best-effort */ }
+  };
+  appLike.on('render-process-gone', guard('render-process-gone'));
+  appLike.on('child-process-gone', guard('child-process-gone'));
+}

src/main/main.ts

@@ -1,4 +1,4 @@
-import { app, BrowserWindow, globalShortcut } from 'electron';
+import { app, BrowserWindow, globalShortcut, crashReporter } from 'electron';
 import * as path from 'node:path';
 import { appendFileSync } from 'node:fs';
 import * as nodePty from '@homebridge/node-pty-prebuilt-multiarch';
@@ -8,7 +8,13 @@ import { PtyHost, type PtySpawn } from './ptyHost';
 import { setupTray } from './tray';
 import { registerUpdater } from './updater';
 import { applyOpenAtLogin } from './autostart';
-import { installGlobalErrorHandlers } from './errorGuard';
+import { installGlobalErrorHandlers, installAppCrashHandlers } from './errorGuard';
+
+// Local-only crash capture (no upload — nothing is ever sent anywhere) so a NATIVE crash (a fault
+// inside node-pty/conpty or Chromium itself) writes an inspectable minidump instead of vanishing —
+// by default Electron's bundled Crashpad handler swallows unconfigured native crashes silently,
+// leaving no Windows Event Log entry and no trace in our own JS-level error guard below.
+crashReporter.start({ uploadToServer: false, compress: true });
 
 const realSpawn: PtySpawn = (file, args, opts) => {
   const p = nodePty.spawn(file, args, { name: 'xterm-256color', cwd: opts.cwd, cols: opts.cols, rows: opts.rows });
@@ -61,14 +67,28 @@ if (!gotLock) {
 
   app.whenReady().then(() => {
     const userData = app.getPath('userData');
+    // Every diagnostic line includes a memory snapshot: if DevDeck is dying to a V8
+    // "JavaScript heap out of memory" abort (long cockpit sessions accumulating buffered output),
+    // that abort itself bypasses uncaughtException — but a rising rss/heapUsed trend across
+    // whatever DID get logged before it is the only way to notice the pattern after the fact.
+    const logLine = (line: string): void => {
+      const m = process.memoryUsage();
+      const withMem = `${line} | rss=${Math.round(m.rss / 1048576)}MB heapUsed=${Math.round(m.heapUsed / 1048576)}MB`;
+      console.error('DevDeck', withMem);
+      try { appendFileSync(path.join(userData, 'devdeck-errors.log'), `${new Date().toISOString()} ${withMem}\n`); } catch { /* logging is best-effort */ }
+    };
     // Last-resort trap: keep the main process alive when an async callback (pty data/exit, the
     // PtyBatcher flush timer, a git spawn, a stray IPC reject) throws. Before this, such a throw
-    // closed DevDeck "out of nowhere" and took every cockpit terminal with it. We also append the
-    // stack to a log file so a future occurrence is diagnosable (console output is lost when packaged).
+    // closed DevDeck "out of nowhere" and took every cockpit terminal with it.
     installGlobalErrorHandlers((kind, err) => {
       const detail = err instanceof Error ? (err.stack ?? err.message) : String(err);
-      console.error(`DevDeck main ${kind}:`, detail);
-      try { appendFileSync(path.join(userData, 'devdeck-errors.log'), `${new Date().toISOString()} [${kind}] ${detail}\n`); } catch { /* logging is best-effort */ }
+      logLine(`[${kind}] ${detail}`);
+    });
+    // render-process-gone / child-process-gone fire on `app`, not `process` — a renderer or GPU
+    // crash previously left zero trace anywhere (no log entry, no Windows crash event either,
+    // since Crashpad intercepts it before the OS's own crash reporting sees it).
+    installAppCrashHandlers(app, (kind, detail) => {
+      logLine(`[${kind}] ${JSON.stringify(detail)}`);
     });
     // Match the installer shortcut's AppUserModelID (electron-builder sets it to
     // the appId) so Windows shows the DevDeck taskbar icon and groups windows