From 4e41179d387c67005deaf28902db1970da62eb95 Mon Sep 17 00:00:00 2001 From: Local Dev Date: Wed, 7 Oct 2026 23:52:15 +0200 Subject: [PATCH] Theseus: sidebar and installed apps stay signed in across restarts "Clear site storage on quit" wiped the IndexedDB and localStorage where WhatsApp Web and Telegram Web keep their sessions, so both signed out at every launch; only sites with a login in the vault were spared. The keep list now also holds the sidebar web apps and the installed apps. The switch sits under both clearing switches it applies to (it read as a cookies-only option, indented under that one) and says what it covers. --- main.js | 18 +++++++++++++++--- settings.html | 8 ++++---- 2 files changed, 19 insertions(+), 7 deletions(-) diff --git a/main.js b/main.js index a71487b3..9c040c58 100644 --- a/main.js +++ b/main.js @@ -492,7 +492,7 @@ const SETTINGS_DEFAULTS = { clearCacheOnQuit: true, // drop HTTP cache (images, scripts, etc.) clearHistoryOnQuit: true, // drop navigation history (+ saved tabs unless restoreSession) clearStorageOnQuit: true, // drop localStorage / IndexedDB / service workers / cache API - keepSignInsOnQuit: true, // ...except for sites with a login saved in the vault (lib/signin-sites.cjs) + keepSignInsOnQuit: true, // ...except your apps (sidebar + installed) and sites with a login saved in the vault (lib/signin-sites.cjs) // Password manager offers (Settings › Passwords). pwOfferSave: true, // ask to save a password after a login or sign-up form is sent pwOfferFill: true, // offer saved logins when a login form appears @@ -4030,8 +4030,20 @@ function showPwFill(show, matches, extra = {}) { // Hostnames with a saved login, kept outside the vault (sealed) so the quit // clear can spare their sign-ins while the vault is locked. Rewritten only // when the vault is open and the set changed. -const { createSigninSites, normHost: normSigninHost } = require("./lib/signin-sites.cjs"); +const { createSigninSites, normHost: normSigninHost, keepOrigins: keepOriginsForHosts } = require("./lib/signin-sites.cjs"); let signinSitesInst = null; +// What the quit-time clear leaves signed in: the web apps in the sidebar and +// the installed apps (WhatsApp, Telegram keep their session in IndexedDB and +// localStorage, so "Clear site storage on quit" signed them out at every +// launch), plus every site with a login saved in the vault. +function quitKeepOrigins() { + const hosts = []; + for (const L of settings.quickLinks || []) { try { hosts.push(new URL(L.url).hostname); } catch {} } + try { for (const a of webapps.list()) { const h = a.host || (() => { try { return new URL(a.startUrl || a.origin).hostname; } catch { return ""; } })(); if (h) hosts.push(h); } } catch {} + const keep = new Set(keepOriginsForHosts(hosts)); + try { for (const o of signinSites().keepOrigins()) keep.add(o); } catch {} + return [...keep]; +} const signinSites = () => (signinSitesInst ||= createSigninSites({ file: path.join(app.getPath("userData"), "signin-sites.json"), safeStorage, log: (...a) => console.log("[signin-sites]", ...a) })); function refreshSigninSites() { if (!vaultState) return; @@ -10085,7 +10097,7 @@ if (!process.env.THESEUS_NO_AUTOSTART && !app.requestSingleInstanceLock()) { cookies: settings.clearCookiesOnQuit, cache: settings.clearCacheOnQuit, storage: settings.clearStorageOnQuit, - keep: settings.keepSignInsOnQuit ? signinSites().keepOrigins() : [], + keep: settings.keepSignInsOnQuit ? quitKeepOrigins() : [], }); // Session file AND the address-bar history (history.json). if (settings.clearHistoryOnQuit) { diff --git a/settings.html b/settings.html index 3b2b1c0a..7eaf4c2b 100644 --- a/settings.html +++ b/settings.html @@ -904,10 +904,6 @@
Clear cookies on quit
Drops session + persistent cookies. You'll sign in again next launch.
-
-
Keep sign-ins for sites in your vault
Sites with a login saved in Settings › Passwords keep their cookies and site storage, so you stay signed in. Everything else is still cleared. If a site signs you out anyway, Theseus offers your saved login on its sign-in form.
- -
Clear HTTP cache on quit
Drops cached images / scripts / stylesheets. Sites re-download; small disk win.
@@ -916,6 +912,10 @@
Clear site storage on quit
Drops localStorage, IndexedDB, service workers, and the cache API. Web-app state resets.
+
+
Keep my apps and vault sites signed in
When cookies or site storage are cleared on quit, these keep theirs, so you stay signed in: the web apps in the sidebar (WhatsApp, Telegram…), the apps you installed from Settings › Apps, and every site with a login saved in Settings › Passwords. Everything else is still cleared. If a site signs you out anyway, Theseus offers your saved login on its sign-in form.
+ +
Clear history on quit
Drops back/forward history and address-bar history. With "Open previous windows and tabs" on, the tabs themselves still reopen.