Address review feedback

- Refresh the restorable copy when a project is reopened from Open Recent.
  `loadProject` moves that path to the front of the recent list, so in "last"
  mode it becomes the project the next launch resolves to -- but the copy on
  disk still held whichever project was opened through the picker last, so its
  `sourcePath` no longer matched and the cold start fell back to the
  unavailable-project banner. Open A, open B, reopen A from the recent list was
  enough to hit it. `openRecentProjectFile` now returns the raw text alongside
  the parsed project so the caller can keep the copy in step without re-reading
  a URI whose grant may already be gone.

- Measure the snapshot size limit in UTF-8 bytes rather than `text.length`.
  The string is written as UTF-8, so a project of three-byte characters (CJK
  layer names, accented attribute values in embedded GeoJSON) could be three
  times the limit and still pass. `exceedsStartupSnapshotLimit` bounds the byte
  count by the code-unit count first and only encodes when that is inconclusive,
  so the oversized projects the guard exists to reject are still rejected
  without allocating a second copy of them on a phone. Covered by a boundary
  test over ASCII, three-byte, and surrogate-pair text.

- State in the capability comment that `mkdir` is already granted by
  `fs:default` (its `create-app-specific-dirs` set), so the missing
  `fs:allow-mkdir` next to the other explicit command permissions is deliberate
  rather than an oversight, and that without the scope entry the copies fail
  with "forbidden path".

- Drop the claim that `MAX_STARTUP_SNAPSHOT_BYTES` "matches" the ceiling on a
  project fetched by URL. The two share a number today but bound different
  things -- a download buffered into memory versus a file kept on disk -- and
  neither has to move when the other does, so the wording now says that instead
  of implying an invariant nothing enforces.

Author: giswqs

apps/geolibre-desktop/src-tauri/capabilities/default.json

@@ -25,7 +25,7 @@
       "allow": [{ "path": "$TEMP/geolibre-gdb-*.geojson" }]
     },
     {
-      "comment": "Restorable copies of the startup project (GeoLibre#1948). On Android a project picked from device storage is a content:// URI whose read grant dies with the process, so the startup restore has nothing to reopen; GeoLibre keeps its own copy here instead. This must be `fs:scope` rather than a path on the read/write permissions above: an fs permission's scope applies only to the commands that permission grants, so `fs:default`'s app-directory scope reaches `read_text_file` but not `mkdir` or `write_text_file` (the app's other writes are to paths a dialog just added to the runtime scope). Two entries because the directory itself is the mkdir target and its files are the read/write targets. See lib/startup-project-snapshot.ts.",
+      "comment": "Restorable copies of the startup project (GeoLibre#1948). On Android a project picked from device storage is a content:// URI whose read grant dies with the process, so the startup restore has nothing to reopen; GeoLibre keeps its own copy here instead. Only a scope entry is needed, no new command permission: `mkdir` is already granted by `fs:default` (its `create-app-specific-dirs` set), and `read_text_file`/`write_text_file` by the entries above. It must be `fs:scope` rather than a path on those entries because an fs permission's scope applies only to the commands that permission grants, so `fs:default`'s app-directory scope reaches `read_text_file` but not `mkdir` or `write_text_file` (the app's other writes are to paths a dialog just added to the runtime scope) — without this the copies fail with \"forbidden path\". Two entries because the directory itself is the mkdir target and its files are the read/write targets. See lib/startup-project-snapshot.ts.",
       "identifier": "fs:scope",
       "allow": [
         { "path": "$APPLOCALDATA/startup-projects" },

apps/geolibre-desktop/src/hooks/useProjectFileActions.ts

@@ -701,6 +701,13 @@ export function useProjectFileActions(mapControllerRef: MapControllerRef) {
       const project = await resolveProjectXyzLayers(result.project, controller.signal);
       if (controller.signal.aborted) return null;
       loadProject(project, result.path);
+      // `loadProject` moves this path to the front of the recent list, so in
+      // "last" mode it is now the project the next launch will reopen. Without
+      // this, reopening an older project from the recent list would leave the
+      // copy on disk holding whichever project was opened through the picker
+      // last, and the next cold start would find no copy matching the path it
+      // resolves (GeoLibre#1948 review).
+      rememberStartupProjectSnapshot(result.path, result.text);
       return null;
     } catch (error) {
       if (controller.signal.aborted) return null;

apps/geolibre-desktop/src/lib/startup-project-snapshot.ts

@@ -59,8 +59,12 @@ export const STARTUP_SNAPSHOT_DIR = "startup-projects";
  * Above this the copy is skipped and the restore keeps today's behaviour (the
  * "startup project is unavailable" banner). A project with embedded vector data
  * can run to hundreds of megabytes, and silently doubling that on a phone's
- * internal storage would be a worse bug than the one being fixed. Matches the
- * ceiling `openRecentProjectFile` already applies to a project fetched by URL.
+ * internal storage would be a worse bug than the one being fixed.
+ *
+ * Its own limit, deliberately: `openRecentProjectFile` happens to cap a project
+ * fetched by URL at the same number, but that one bounds a download buffered
+ * into memory and this one bounds a file kept on disk. Neither has to move when
+ * the other does.
  */
 export const MAX_STARTUP_SNAPSHOT_BYTES = 25 * 1024 * 1024;
 
@@ -83,6 +87,28 @@ export function startupSnapshotFile(slot: StartupSnapshotSlot): string {
   return `${slot}.geolibre.json`;
 }
 
+/**
+ * Whether a project is too large to keep a copy of, measured as the UTF-8 bytes
+ * the file would actually occupy.
+ *
+ * `text.length` counts UTF-16 code units, so a project full of non-ASCII (CJK
+ * layer names, accented attribute values in embedded GeoJSON) can be up to three
+ * times the size of the string that passed the check. The bounds below settle
+ * most projects without encoding anything: the byte count is never below the
+ * code-unit count and never above three times it, and encoding is a full second
+ * copy of the text -- which for the very projects this guard exists to reject
+ * would mean allocating hundreds of megabytes on a phone just to confirm they
+ * are too big.
+ *
+ * @param text - The serialized project.
+ * @returns True when the copy would exceed {@link MAX_STARTUP_SNAPSHOT_BYTES}.
+ */
+export function exceedsStartupSnapshotLimit(text: string): boolean {
+  if (text.length > MAX_STARTUP_SNAPSHOT_BYTES) return true;
+  if (text.length * 3 <= MAX_STARTUP_SNAPSHOT_BYTES) return false;
+  return new TextEncoder().encode(text).byteLength > MAX_STARTUP_SNAPSHOT_BYTES;
+}
+
 function defaultStorage(): SnapshotStorage | null {
   try {
     return typeof window === "undefined" ? null : window.localStorage;
@@ -188,9 +214,9 @@ export async function writeStartupSnapshot(
 ): Promise<StartupSnapshotSlot | null> {
   const slot = startupSnapshotSlot(path, settings);
   if (!slot) return null;
-  if (text.length > MAX_STARTUP_SNAPSHOT_BYTES) {
+  if (exceedsStartupSnapshotLimit(text)) {
     console.warn(
-      `Startup project is too large to keep a restorable copy (${text.length} bytes).`,
+      `Startup project is too large to keep a restorable copy (over ${MAX_STARTUP_SNAPSHOT_BYTES} bytes).`,
       path,
     );
     return null;

apps/geolibre-desktop/src/lib/tauri-io.ts

@@ -2850,12 +2850,23 @@ function isFileMissingError(error: unknown): boolean {
   );
 }
 
+/**
+ * Reopen a project from a remembered path, URL, or Android content URI.
+ *
+ * @param path - The remembered location.
+ * @param signal - Abort signal for the URL branch's fetch.
+ * @returns The parsed project, the path it came from, and the raw text -- which
+ *   callers hand to {@link saveStartupProjectSnapshot} so reopening from Open
+ *   Recent keeps the restorable copy pointing at the project that is now the
+ *   most recent one.
+ */
 export async function openRecentProjectFile(
   path: string,
   signal?: AbortSignal,
 ): Promise<{
   project: GeoLibreProject;
   path: string;
+  text: string;
 }> {
   if (isHttpUrl(path)) {
     const response = await fetch(path, {
@@ -2884,7 +2895,8 @@ export async function openRecentProjectFile(
       );
     }
 
-    return { project: parseProject(await response.text()), path };
+    const body = await response.text();
+    return { project: parseProject(body), path, text: body };
   }
 
   if (!isTauri()) {
@@ -2914,7 +2926,7 @@ export async function openRecentProjectFile(
     text = snapshot;
   }
 
-  return { project: parseProject(text), path };
+  return { project: parseProject(text), path, text };
 }
 
 export async function saveProjectFile(

tests/startup-project-snapshot.test.ts

@@ -4,6 +4,7 @@ import { afterEach, beforeEach, describe, it } from "node:test";
 import type { StartupSettings } from "../apps/geolibre-desktop/src/hooks/useDesktopSettings";
 import { STARTUP_SNAPSHOTS_STORAGE_KEY } from "../apps/geolibre-desktop/src/lib/storage-keys";
 import {
+  exceedsStartupSnapshotLimit,
   MAX_STARTUP_SNAPSHOT_BYTES,
   readStartupSnapshot,
   readStartupSnapshotIndex,
@@ -92,6 +93,27 @@ describe("startupSnapshotSlot", () => {
   });
 });
 
+describe("exceedsStartupSnapshotLimit", () => {
+  it("measures the bytes the file will hold, not the code units of the string", () => {
+    // The file is written as UTF-8, so a project of three-byte characters is
+    // over the limit at a third of the string length that ASCII would need.
+    const thirdOfLimit = Math.floor(MAX_STARTUP_SNAPSHOT_BYTES / 3);
+    assert.equal(exceedsStartupSnapshotLimit("a".repeat(thirdOfLimit)), false);
+    assert.equal(exceedsStartupSnapshotLimit("\u20ac".repeat(thirdOfLimit + 1)), true);
+    // A surrogate pair is four bytes over two code units, so it costs two bytes
+    // per code unit rather than three: this many is 20 MB, still under.
+    assert.equal(
+      exceedsStartupSnapshotLimit("\u{1f600}".repeat(Math.floor(MAX_STARTUP_SNAPSHOT_BYTES / 5))),
+      false,
+    );
+  });
+
+  it("accepts and rejects at the ASCII boundary", () => {
+    assert.equal(exceedsStartupSnapshotLimit("a".repeat(MAX_STARTUP_SNAPSHOT_BYTES)), false);
+    assert.equal(exceedsStartupSnapshotLimit("a".repeat(MAX_STARTUP_SNAPSHOT_BYTES + 1)), true);
+  });
+});
+
 describe("writeStartupSnapshot", () => {
   const warnings: unknown[][] = [];
   const originalWarn = console.warn;
@@ -177,6 +199,22 @@ describe("writeStartupSnapshot", () => {
     assert.equal(warnings.length, 1);
   });
 
+  it("skips one that is only too large once encoded as UTF-8", async () => {
+    const storage = makeStorage();
+    const { io, writes } = makeIo();
+    // Well under the limit counted as code units, well over it as bytes.
+    const slot = await writeStartupSnapshot(
+      CONTENT_URI,
+      "\u20ac".repeat(Math.floor(MAX_STARTUP_SNAPSHOT_BYTES / 2)),
+      settings({ mode: "last" }),
+      io,
+      { storage },
+    );
+    assert.equal(slot, null);
+    assert.equal(writes.length, 0);
+    assert.equal(warnings.length, 1);
+  });
+
   it("swallows a write failure so it cannot fail the save that triggered it", async () => {
     const storage = makeStorage();
     const { io } = makeIo({ writeError: new Error("No space left on device") });