fix(terminals): negotiate explicit close intent for paired runtimes (#10129)

src/renderer/src/web/web-runtime-client.test.ts

@@ -11,6 +11,7 @@ import {
   encryptBytes as encryptSharedBytes
 } from '../../../shared/e2ee-crypto'
 import type { RuntimeRpcResponse } from '../../../shared/runtime-rpc-envelope'
+import { SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY } from '../../../shared/protocol-version'
 
 const fakeSockets: FakeWebSocket[] = []
 
@@ -51,6 +52,39 @@ describe('WebRuntimeClient', () => {
     vi.unstubAllGlobals()
   })
 
+  it('advertises explicit close intent support in encrypted authentication', async () => {
+    const client = new WebRuntimeClient({
+      v: 2,
+      endpoint: 'ws://127.0.0.1:6768',
+      deviceToken: 'token',
+      publicKeyB64: Buffer.alloc(32).toString('base64')
+    })
+    const call = client.call('status.get', {})
+    const socket = fakeSockets[0]!
+    socket.readyState = FakeWebSocket.OPEN
+    socket.onopen?.()
+
+    expect(JSON.parse(String(socket.send.mock.calls[0]?.[0]))).toEqual({
+      type: 'e2ee_hello',
+      publicKeyB64: expect.any(String)
+    })
+    socket.onmessage?.({ data: JSON.stringify({ type: 'e2ee_ready' }) })
+    const sharedKey = (
+      client as unknown as {
+        sharedKey: Uint8Array
+      }
+    ).sharedKey
+    const auth = decrypt(String(socket.send.mock.calls[1]?.[0]), sharedKey)
+    expect(JSON.parse(auth!)).toEqual({
+      type: 'e2ee_auth',
+      deviceToken: 'token',
+      clientCapabilities: [SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY]
+    })
+
+    client.close()
+    await expect(call).rejects.toThrow('Remote Orca runtime connection closed.')
+  })
+
   it('closes child subscription clients when the owning client closes', () => {
     const client = new WebRuntimeClient({
       v: 2,

src/renderer/src/web/web-runtime-client.ts

@@ -14,6 +14,7 @@ import {
   publicKeyFromBase64,
   publicKeyToBase64
 } from './web-e2ee'
+import { SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY } from '../../../shared/protocol-version'
 
 type WebRuntimeConnectionState =
   | 'disconnected'
@@ -450,7 +451,11 @@ export class WebRuntimeClient {
       try {
         const control = JSON.parse(raw) as { type?: unknown }
         if (control.type === 'e2ee_ready') {
-          this.sendEncrypted({ type: 'e2ee_auth', deviceToken: this.pairing.deviceToken })
+          this.sendEncrypted({
+            type: 'e2ee_auth',
+            deviceToken: this.pairing.deviceToken,
+            clientCapabilities: [SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY]
+          })
           return
         }
       } catch {