fix(android): reopen the startup project after the app process restarts (#1948)

On Android, both startup modes fell back to the default workspace on every cold
start and showed "The startup project is unavailable."

Two things were in the way. `openRecentProjectFile` sends the stored path to the
`read_project_file` Tauri command, whose guard requires a filesystem path, so a
`content://` URI was refused before anything was read. Routing content URIs
through `tauri-plugin-fs` instead (it resolves them via Android's
ContentResolver) gets past that, but only until the process ends:
`tauri-plugin-dialog`'s `open()` launches `ACTION_GET_CONTENT`, whose read grant
is tied to the activity that received it and cannot be renewed from inside the
app - a persistable grant needs `ACTION_OPEN_DOCUMENT` plus
`takePersistableUriPermission`, neither of which the plugin issues. The startup
restore runs exactly once per cold start, which is exactly when that grant is
gone, so the feature could never work there. This is the read-side half of the
problem #1833 fixed for saving.

So GeoLibre keeps its own copy. `lib/startup-project-snapshot.ts` writes the
project text into the app's private data directory whenever the startup
preference points at the project being opened or saved, and
`openRecentProjectFile` falls back to that copy when the original URI can no
longer be read. Two fixed slots ("specific" and "last") rather than one file per
project: the preference can only ever restore two projects, and a fixed pair
needs no pruning - which would need an `fs:allow-remove` scope the app
deliberately does not grant outside its own temp files.

Committing the preference in Settings also copies the project right then, via
`ensureStartupProjectSnapshot`. That is the path the report describes - open a
project, then ask for it back on the next launch - and nothing else re-reads the
project in between, so without it the preference would be saved with no copy
behind it.

Everything is gated on the path being a content URI, so desktop keeps re-reading
the real file and never doubles a project on disk. A copy over 25 MB is skipped
(the ceiling already applied to a project fetched by URL) rather than duplicating
hundreds of megabytes of embedded vector data on a phone. The source path must
match exactly, so a copy can never stand in for a different project, and a
`RecentProjectGoneError` still means gone - a deleted file is not resurrected
from a stale copy. Every failure is logged and swallowed: the copy is a fallback
for a later launch and must never fail the open or save that triggered it.

The `fs:scope` entry in the capability is required, not incidental. An fs
permission's scope applies only to the commands that permission grants, so
`fs:default`'s app-directory scope reaches `read_text_file` but not `mkdir` or
`write_text_file`; without the entry every copy fails with "forbidden path"
(caught on the emulator, not by inspection).

Verified on an Android 16 emulator with the reporter's own steps and a project at
the path from the report, /sdcard/Documents/json/General_Project.geolibre.json:
open it through the document picker, set the startup preference, force-stop, cold
start. Before the change the log shows "Could not restore the startup project ...
requires that you obtain access using ACTION_OPEN_DOCUMENT"; after it, both
"Reopen the last project" and "Open a specific project" come back with the
project, its layer, and its camera, no banner, and the log shows the fallback
taking over from the dead URI.

Fixes #1948

Author: giswqs

apps/geolibre-desktop/src-tauri/capabilities/default.json

@@ -24,6 +24,14 @@
       "identifier": "fs:allow-remove",
       "allow": [{ "path": "$TEMP/geolibre-gdb-*.geojson" }]
     },
+    {
+      "comment": "Restorable copies of the startup project (GeoLibre#1948). On Android a project picked from device storage is a content:// URI whose read grant dies with the process, so the startup restore has nothing to reopen; GeoLibre keeps its own copy here instead. This must be `fs:scope` rather than a path on the read/write permissions above: an fs permission's scope applies only to the commands that permission grants, so `fs:default`'s app-directory scope reaches `read_text_file` but not `mkdir` or `write_text_file` (the app's other writes are to paths a dialog just added to the runtime scope). Two entries because the directory itself is the mkdir target and its files are the read/write targets. See lib/startup-project-snapshot.ts.",
+      "identifier": "fs:scope",
+      "allow": [
+        { "path": "$APPLOCALDATA/startup-projects" },
+        { "path": "$APPLOCALDATA/startup-projects/*" }
+      ]
+    },
     {
       "identifier": "opener:allow-open-url",
       "allow": [{ "url": "http://*" }, { "url": "https://*" }]

apps/geolibre-desktop/src/components/layout/SettingsDialog.tsx

@@ -96,7 +96,7 @@ import { THEME_SCHEMES, normalizeHexColor, type ThemeScheme } from "../../lib/th
 import { IS_MAS_BUILD } from "../../lib/build-flags";
 import { resolveShareHost, shareHostLabel } from "../../lib/share-geolibre";
 import { IS_STORE_BUILD, type UpdateNotificationLevel } from "../../lib/updates";
-import { openProjectFile } from "../../lib/tauri-io";
+import { ensureStartupProjectSnapshot, openProjectFile } from "../../lib/tauri-io";
 import {
   DATA_SOURCE_CATALOG,
   DATA_SOURCE_SECTION_LABEL_KEYS,
@@ -1189,6 +1189,13 @@ export function SettingsDialog({
       updates: draftDesktopSettings.updates,
       startup: draftDesktopSettings.startup,
     });
+    // On Android the project behind the preference just saved is reachable only
+    // until this process ends, so keep a copy the next launch can open
+    // (GeoLibre#1948). A no-op on every other platform.
+    void ensureStartupProjectSnapshot(
+      draftDesktopSettings.startup,
+      useAppStore.getState().recentProjects,
+    );
     // The dockable panels are the one layout row nothing renders from the store:
     // the registry owns what is on screen, so move it to match what was just
     // saved (a no-op for a panel already there, so an untouched Save cannot

apps/geolibre-desktop/src/hooks/useProjectFileActions.ts

@@ -33,8 +33,10 @@ import {
   RecentProjectGoneError,
   saveProjectFile,
   saveProjectFileToPath,
+  saveStartupProjectSnapshot,
   saveTextFileWithFallback,
 } from "../lib/tauri-io";
+import { useDesktopSettingsStore } from "./useDesktopSettings";
 import { buildProjectHtml } from "../lib/html-export";
 import { ensureHtmlFileName, ensureProjectFileName } from "../lib/file-names";
 import { mergeStringLists } from "../lib/string-lists";
@@ -338,13 +340,27 @@ export function useProjectFileActions(mapControllerRef: MapControllerRef) {
     settleSaveNamePrompt,
   ]);
 
+  // On Android a project lives behind a `content://` URI whose read grant dies
+  // with the process, so the startup restore has nothing to reopen on the next
+  // launch (GeoLibre#1948). Keep a copy in the app's own storage whenever the
+  // startup preference points at the project being opened or saved. Fire and
+  // forget: a failed copy is logged inside and must not fail the open or save.
+  const rememberStartupProjectSnapshot = (path: string, text: string) => {
+    void saveStartupProjectSnapshot(
+      path,
+      text,
+      useDesktopSettingsStore.getState().desktopSettings.startup,
+    );
+  };
+
   const handleOpenFromFile = async () => {
     const result = await openProjectFile();
     if (result) {
       try {
         loadProject(await resolveProjectXyzLayers(result.project), result.path, {
           rememberRecent: isTauri(),
         });
+        rememberStartupProjectSnapshot(result.path, result.text);
       } catch (error) {
         console.error("Failed to open project", error);
         setActionError(
@@ -1107,6 +1123,9 @@ export function useProjectFileActions(mapControllerRef: MapControllerRef) {
       name: project.name,
       openedAt: new Date().toISOString(),
     });
+    // Refresh the restorable copy so a startup restore reopens what was just
+    // saved rather than the state the project was opened in.
+    rememberStartupProjectSnapshot(path, contentToSave);
     markSaved();
     recordExplicitProjectSave();
     return true;

apps/geolibre-desktop/src/lib/startup-project-snapshot.ts

@@ -0,0 +1,246 @@
+// Durable copies of the project a startup restore is meant to reopen, for the
+// one platform where the stored path stops working: Android.
+//
+// `tauri-plugin-dialog`'s `open()` launches `ACTION_GET_CONTENT`, so a project
+// picked from device storage is identified by a `content://` SAF URI rather
+// than a filesystem path. That URI carries a one-off read grant tied to the
+// activity that received it: it reads fine for the rest of the session, and is
+// dead the moment the process is gone. Nothing in the app can renew it -- a
+// persistable grant needs `ACTION_OPEN_DOCUMENT` plus
+// `takePersistableUriPermission`, neither of which the plugin issues (see
+// `android-content-uri.ts` for the write-side half of the same problem).
+//
+// So "Reopen the last project" and "Open a specific project" could never work
+// on Android: the restore runs exactly once per cold start, which is exactly
+// when the grant is gone (GeoLibre#1948). The fix is to keep our own copy. When
+// a project that the startup preference will reopen is opened or saved from a
+// content URI, its text is written to the app's private data directory --
+// always readable, no grant involved -- and the restore falls back to that copy
+// when the original URI can no longer be read.
+//
+// Kept free of Tauri and React imports so the rules can be unit-tested in Node;
+// `tauri-io.ts` binds the two I/O calls to `@tauri-apps/plugin-fs`.
+
+import type { StartupSettings } from "../hooks/useDesktopSettings";
+import { isAndroidContentUri } from "./android-content-uri";
+import { STARTUP_SNAPSHOTS_STORAGE_KEY } from "./storage-keys";
+
+/**
+ * Which startup preference a snapshot serves. One file per slot rather than one
+ * per project: the preference can only ever restore two projects (the one named
+ * by "specific" and whichever was used last), so a fixed pair needs no pruning
+ * -- and pruning would need a `fs:allow-remove` scope the app deliberately does
+ * not grant outside its own temp files.
+ */
+export type StartupSnapshotSlot = "specific" | "last";
+
+/** Where a slot's copy came from, so a restore only uses a copy of *that* project. */
+export interface StartupSnapshotEntry {
+  /** The path or content URI the project was opened from. */
+  sourcePath: string;
+  /** Snapshot file, relative to {@link STARTUP_SNAPSHOT_DIR}. */
+  file: string;
+  /** When the copy was written, for diagnostics. */
+  savedAt: string;
+}
+
+export type StartupSnapshotIndex = Partial<Record<StartupSnapshotSlot, StartupSnapshotEntry>>;
+
+/**
+ * Snapshot directory, relative to the app's private data directory.
+ *
+ * SYNC: the `fs:scope` entry in `src-tauri/capabilities/default.json` names this
+ * path literally — the fs plugin refuses anything outside its scope, so renaming
+ * the directory here alone makes every copy fail with "forbidden path".
+ */
+export const STARTUP_SNAPSHOT_DIR = "startup-projects";
+
+/**
+ * Above this the copy is skipped and the restore keeps today's behaviour (the
+ * "startup project is unavailable" banner). A project with embedded vector data
+ * can run to hundreds of megabytes, and silently doubling that on a phone's
+ * internal storage would be a worse bug than the one being fixed. Matches the
+ * ceiling `openRecentProjectFile` already applies to a project fetched by URL.
+ */
+export const MAX_STARTUP_SNAPSHOT_BYTES = 25 * 1024 * 1024;
+
+/** The subset of `Storage` this module uses, so tests can pass a plain fake. */
+export interface SnapshotStorage {
+  getItem: (key: string) => string | null;
+  setItem: (key: string, value: string) => void;
+}
+
+/** The two file operations {@link writeStartupSnapshot} and {@link readStartupSnapshot} need. */
+export interface StartupSnapshotIo {
+  /** Write `content` to `file` under {@link STARTUP_SNAPSHOT_DIR}, creating the directory. */
+  write: (file: string, content: string) => Promise<void>;
+  /** Read `file` under {@link STARTUP_SNAPSHOT_DIR}. Rejects when it is not there. */
+  read: (file: string) => Promise<string>;
+}
+
+/** The snapshot file name for a slot. `.geolibre.json` so the copy is recognizable on disk. */
+export function startupSnapshotFile(slot: StartupSnapshotSlot): string {
+  return `${slot}.geolibre.json`;
+}
+
+function defaultStorage(): SnapshotStorage | null {
+  try {
+    return typeof window === "undefined" ? null : window.localStorage;
+  } catch {
+    // Storage can throw outright when it is disabled (private browsing).
+    return null;
+  }
+}
+
+function isSnapshotEntry(value: unknown): value is StartupSnapshotEntry {
+  if (!value || typeof value !== "object") return false;
+  const entry = value as Partial<StartupSnapshotEntry>;
+  return (
+    typeof entry.sourcePath === "string" &&
+    entry.sourcePath.length > 0 &&
+    typeof entry.file === "string" &&
+    entry.file.length > 0 &&
+    typeof entry.savedAt === "string"
+  );
+}
+
+/**
+ * The persisted index of snapshots, dropping anything that does not parse.
+ *
+ * @param storage - Storage to read from; defaults to `window.localStorage`.
+ * @returns The stored index, or an empty one.
+ */
+export function readStartupSnapshotIndex(
+  storage: SnapshotStorage | null = defaultStorage(),
+): StartupSnapshotIndex {
+  if (!storage) return {};
+  let parsed: unknown;
+  try {
+    const raw = storage.getItem(STARTUP_SNAPSHOTS_STORAGE_KEY);
+    if (!raw) return {};
+    parsed = JSON.parse(raw);
+  } catch {
+    return {};
+  }
+  if (!parsed || typeof parsed !== "object") return {};
+  const candidate = parsed as Record<string, unknown>;
+  const index: StartupSnapshotIndex = {};
+  for (const slot of ["specific", "last"] as const) {
+    if (isSnapshotEntry(candidate[slot])) index[slot] = candidate[slot];
+  }
+  return index;
+}
+
+function writeStartupSnapshotIndex(
+  index: StartupSnapshotIndex,
+  storage: SnapshotStorage | null,
+): void {
+  if (!storage) return;
+  try {
+    storage.setItem(STARTUP_SNAPSHOTS_STORAGE_KEY, JSON.stringify(index));
+  } catch {
+    // A full or disabled storage costs the fallback, not the save itself.
+  }
+}
+
+/**
+ * The slot a project should be copied into, or null when it is not one the
+ * startup preference would reopen.
+ *
+ * "specific" only ever holds the project the user named, so opening something
+ * else must not overwrite it. "last" tracks whatever was opened or saved most
+ * recently, which is what `startupProjectPath` resolves that mode to.
+ *
+ * @param path - The path or content URI the project was opened from or saved to.
+ * @param settings - The committed startup preference.
+ * @returns The slot to write, or null to write nothing.
+ */
+export function startupSnapshotSlot(
+  path: string,
+  settings: StartupSettings,
+): StartupSnapshotSlot | null {
+  if (!isAndroidContentUri(path)) return null;
+  if (settings.mode === "specific") return settings.projectPath === path ? "specific" : null;
+  if (settings.mode === "last") return "last";
+  return null;
+}
+
+/**
+ * Keep a durable copy of a project the startup preference will reopen.
+ *
+ * A failure is logged and swallowed: this runs alongside opening or saving a
+ * project, and the copy is a fallback for a later launch, so it must never turn
+ * a successful save into a visible error.
+ *
+ * @param path - The path or content URI the project was opened from or saved to.
+ * @param text - The serialized project to copy.
+ * @param settings - The committed startup preference.
+ * @param io - Snapshot file access.
+ * @param options - `storage` overrides where the index is kept.
+ * @returns The slot written, or null when nothing was.
+ */
+export async function writeStartupSnapshot(
+  path: string,
+  text: string,
+  settings: StartupSettings,
+  io: StartupSnapshotIo,
+  options?: { storage?: SnapshotStorage | null },
+): Promise<StartupSnapshotSlot | null> {
+  const slot = startupSnapshotSlot(path, settings);
+  if (!slot) return null;
+  if (text.length > MAX_STARTUP_SNAPSHOT_BYTES) {
+    console.warn(
+      `Startup project is too large to keep a restorable copy (${text.length} bytes).`,
+      path,
+    );
+    return null;
+  }
+
+  const file = startupSnapshotFile(slot);
+  try {
+    await io.write(file, text);
+  } catch (error) {
+    console.warn("Could not keep a restorable copy of the startup project.", error);
+    return null;
+  }
+
+  const storage = options?.storage === undefined ? defaultStorage() : options.storage;
+  writeStartupSnapshotIndex(
+    {
+      ...readStartupSnapshotIndex(storage),
+      [slot]: { sourcePath: path, file, savedAt: new Date().toISOString() },
+    },
+    storage,
+  );
+  return slot;
+}
+
+/**
+ * The stored copy of the project at `path`, when there is one.
+ *
+ * The source path must match exactly: a copy of a different project is never a
+ * stand-in for the one the user asked for, so a stale slot yields null and the
+ * caller reports the original read failure.
+ *
+ * @param path - The path or content URI the restore could not read.
+ * @param io - Snapshot file access.
+ * @param storage - Storage holding the index; defaults to `window.localStorage`.
+ * @returns The copied project text, or null when there is none to use.
+ */
+export async function readStartupSnapshot(
+  path: string,
+  io: StartupSnapshotIo,
+  storage: SnapshotStorage | null = defaultStorage(),
+): Promise<string | null> {
+  const index = readStartupSnapshotIndex(storage);
+  const entry = Object.values(index).find((candidate) => candidate.sourcePath === path);
+  if (!entry) return null;
+  try {
+    return await io.read(entry.file);
+  } catch (error) {
+    // The index outlived its file (cleared app storage, a write that never
+    // landed). Nothing to restore, so let the caller report the real failure.
+    console.warn("Could not read the stored copy of the startup project.", error);
+    return null;
+  }
+}

apps/geolibre-desktop/src/lib/storage-keys.ts

@@ -24,3 +24,10 @@ export const UPDATE_DISMISSED_VERSION_STORAGE_KEY = "geolibre.updateDismissedVer
  * exhaust the per-IP rate limit (desktop only).
  */
 export const UPDATE_LAST_CHECK_STORAGE_KEY = "geolibre.lastUpdateCheck";
+
+/**
+ * Which project each durable startup snapshot was copied from. Only the index
+ * lives here; the project text itself is a file in the app's private data
+ * directory. See `lib/startup-project-snapshot.ts`.
+ */
+export const STARTUP_SNAPSHOTS_STORAGE_KEY = "geolibre.startupProjectSnapshots";