fix(backup): show the Windows Store backup path only when it exists (#9218)

* docs(sync): clarify multi-device token usage

* fix(backup): show Windows Store backup path only if it exists

Settings showed the MSIX-virtualized path unconditionally under
process.windowsStore, without ever checking it is there. On installs
where the package is not virtualized the backups sit in the real
AppData\Roaming, so the settings page advertised a folder that does not
exist and rendered a dead file:// link - for the backup feature, whose
whole point is being findable after a disaster (#9209).

AppData redirection is not a constant: it applies only to virtualized
packages, and since Windows 10 1903 the OS resolves it per file. That is
why #995 and #9209 report the exact opposite symptom and both are right.
Probe for the directory instead of assuming, and fall back to the path we
actually write to, which is correct in either case.

Closes #9209

* fix(backup): pin the Windows Store backup path with a regression test

Follow-up to the previous commit, addressing multi-agent review.

Move the display-path decision next to the constants it reads, as
getBackupDirForDisplay(). BACKUP_DIR_WINSTORE stops being exported, so
the rule "verify before displaying" is enforced by the only accessor
instead of being an honour-system note in a doc comment - which is the
shape the 2025 fix got wrong. backup.ts already imports existsSync, so
this costs no new import and matches getRelaunchExecPath in
ipc-handlers/app-control.ts.

Correct the doc comment: it claimed BACKUP_DIR_WINSTORE is never read,
while BACKUP_LOAD_DATA accepts it as an allow-listed read root fifty
lines below. Left as-is otherwise; narrowing a GHSA-x937-wf3j-88q3 guard
does not belong in a display-path fix.

Add electron/backup.test.cjs pinning both directions of the loop this
bug has already run once: Store + LocalCache present must show it (#995),
Store + LocalCache absent must fall back (#9209). Verified by sabotage -
restoring the unconditional path fails the #9209 case, deleting the probe
fails the #995 case, and each kills only its own test.

Document the two accepted shortcuts with their ceiling and upgrade path:
the hardcoded package family name (unverifiable from source, degrades
gracefully), and the stale LocalCache dir left by a virtualized to
full-trust flip.

* docs(backup): record how the hardcoded package family name was verified

Computed it from the shipped v18.15.1 AppxManifest: PublisherId is the
first 8 bytes of SHA-256 over the UTF-16LE Publisher string in base32
(digits + a-z minus i/l/o/u). CN=AC30A249-AFE7-4B23-AE54-A95B4FDF8928
yields ch45amy23cdv6, matching the constant exactly - so it has not
drifted, and the previous comment's claim that it cannot be verified was
too pessimistic: any release artifact re-checks it without Windows.

* docs: trim backup path comments and document the electron test harness

Cut the duplicated MSIX explanation across the two doc blocks (-7 lines)
while keeping the parts that stop this bug round-tripping a third time:
the per-file 1903 semantics, the #995/#9209 link, and both shortcuts'
ceilings.

Add npm run test:electron to AGENTS.md. It was absent, and the harness
is easy to miss because it uses electron/*.test.cjs while the rest of
the repo uses .spec.ts - which tsconfig.electron.json actively excludes,
so a spec dropped there silently never runs. Searching for the repo's
dominant convention turns up nothing and invites the conclusion that
main-process code is untestable; it is not.

AGENTS.md

@@ -30,6 +30,9 @@ npm run prettier               # multi-file format
 npm run lint                   # multi-file lint
 npm test                       # all unit tests (Jasmine/Karma, .spec.ts co-located)
 npm run test:file <filepath>   # single spec
+npm run test:electron          # main-process tests — `electron/*.test.cjs`, NOT .spec.ts
+                               # (tsconfig.electron.json excludes *.spec.ts, so a spec
+                               #  placed under electron/ silently never runs)
 npm run e2e                    # all E2E (Playwright, slow)
 npm run e2e:file <path> -- --retries=0   # single E2E (~20s/test); add --grep "name" for one test
 npm start                      # Electron dev

docs/wiki/2.09-Configure-Sync-Backend.md

@@ -17,6 +17,7 @@ The rest of the form depends on the selected provider. Common options (sync inte
 - **Info:** The app shows a short note that SuperSync keeps your tasks in sync across devices in real time and that data is stored on the sync server. SuperSync is currently in Beta.
 - **Get a token:** Click **Open Server & Get Token** to open the server login page in your browser. After logging in, copy your access token.
 - **Access Token:** Paste the token into the **Access Token** field. Required for SuperSync.
+- **Multiple devices:** You can reuse the same access token on every device or sign in separately on each device to get another token. Both options connect to the same SuperSync account and synchronize the same data. Do not use **Revoke & Replace Token** when adding a device; it invalidates all existing tokens and disconnects every device.
 - **Advanced:** Under **Advanced**, you can set a custom **Server URL** (leave as-is for the official server). Here you can also **Enable Encryption** for end-to-end encryption; the app shows warnings about password loss and server data being replaced.
 - **Encryption:** If encryption is enabled, you can **Change Password** or **Disable Encryption** from the same form. These actions replace server data and require the same password on all devices (or re-upload with a new password).
 
@@ -42,6 +43,7 @@ OneDrive sync requires your own **Microsoft Entra** (Azure AD) app registration
    - **Android / manual fallback:** `https://login.microsoftonline.com/common/oauth2/nativeclient`
 
    Do **not** register these under the **Web** or **Single-page application (SPA)** platforms — token redemption then fails with `HTTP 400` (e.g. `AADSTS9002327`).
+
 2. **Allow public client flows:** In **Authentication**, set **Allow public client flows** to **Yes**. Super Productivity authenticates with PKCE and sends no client secret; if this is **No**, sign-in appears to succeed but the token step fails with `HTTP 400 Bad Request` (`AADSTS7000218: ... 'client_assertion' or 'client_secret'`).
 3. **API permissions:** Under **API permissions**, add the Microsoft Graph **delegated** permissions `Files.ReadWrite.AppFolder` and `offline_access`.
 

docs/wiki/3.06-User-Data.md

@@ -41,7 +41,7 @@ For Snap packages on Linux, the app uses the `SNAP_USER_COMMON` directory so tha
 
 ### Windows Store
 
-The Windows Store build uses a different path that includes the Windows Store package identifier (under `Local\Packages\...\LocalCache\Roaming` instead of `Roaming`).
+The Windows Store build may use a different path that includes the Windows Store package identifier (under `Local\Packages\...\LocalCache\Roaming` instead of `Roaming`). This depends on whether Windows virtualizes the package: virtualized packages have their `AppData` writes redirected into `LocalCache`, while full-trust ones write to the plain `Roaming` path. Settings shows whichever location actually exists on your machine, so check there rather than assuming either one.
 
 ## Directory Structure
 

electron/backup.test.cjs

@@ -0,0 +1,110 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const path = require('node:path');
+const Module = require('node:module');
+
+require('ts-node/register/transpile-only');
+
+const originalModuleLoad = Module._load;
+const backupModulePath = path.resolve(__dirname, 'backup.ts');
+
+// Windows-shaped so the `.replace('Roaming', ...)` derivation actually fires on
+// Linux/macOS CI too — otherwise BACKUP_DIR_WINSTORE would equal BACKUP_DIR and
+// every assertion below would pass vacuously.
+const USER_DATA = 'C:\\Users\\testuser\\AppData\\Roaming\\superProductivity';
+// path.join, like the module under test — the separator is the host's, not '\'.
+const BACKUP_DIR = path.join(USER_DATA, 'backups');
+const BACKUP_DIR_WINSTORE = BACKUP_DIR.replace(
+  'Roaming',
+  'Local\\Packages\\53707johannesjo.SuperProductivity_ch45amy23cdv6\\LocalCache\\Roaming',
+);
+
+let existingPaths;
+
+const resetModule = () => {
+  delete require.cache[backupModulePath];
+};
+
+const installMocks = () => {
+  Module._load = function patchedLoad(request, parent, isMain) {
+    if (request === 'electron') {
+      return {
+        app: { getPath: () => USER_DATA },
+        ipcMain: { on: () => {}, handle: () => {} },
+      };
+    }
+
+    if (request === 'electron-log/main') {
+      return { log: () => {}, error: () => {} };
+    }
+
+    // Scoped to backup.ts so ts-node / node:test keep the real fs.
+    if (
+      request === 'fs' &&
+      parent &&
+      typeof parent.filename === 'string' &&
+      parent.filename.endsWith('backup.ts')
+    ) {
+      const realFs = originalModuleLoad.call(this, request, parent, isMain);
+      return { ...realFs, existsSync: (p) => existingPaths.has(p) };
+    }
+
+    return originalModuleLoad.call(this, request, parent, isMain);
+  };
+};
+
+const loadBackupModule = () => {
+  resetModule();
+  // eslint-disable-next-line @typescript-eslint/no-var-requires
+  return require(backupModulePath);
+};
+
+test.beforeEach(() => {
+  existingPaths = new Set();
+  installMocks();
+});
+
+test.afterEach(() => {
+  Module._load = originalModuleLoad;
+  delete process.windowsStore;
+  resetModule();
+});
+
+// Sanity check: without this the Windows-only branches below could never be
+// reached on a Linux CI runner and the suite would be green for the wrong reason.
+test('derives a distinct Windows Store path from the userData path', () => {
+  assert.notEqual(BACKUP_DIR_WINSTORE, BACKUP_DIR);
+  assert.match(BACKUP_DIR_WINSTORE, /LocalCache\\Roaming/);
+});
+
+test('non-Store builds always get the real backup dir', () => {
+  const { getBackupDirForDisplay } = loadBackupModule();
+
+  // Even if a LocalCache dir is left over from a previous Store install.
+  existingPaths.add(BACKUP_DIR_WINSTORE);
+
+  assert.equal(getBackupDirForDisplay(), BACKUP_DIR);
+});
+
+// Regression test for #995: a virtualized Store package redirects its writes
+// into LocalCache, so showing the plain Roaming path sends the user to a folder
+// their backups are not in.
+test('Store builds get the LocalCache path when it exists', () => {
+  process.windowsStore = true;
+  const { getBackupDirForDisplay } = loadBackupModule();
+
+  existingPaths.add(BACKUP_DIR_WINSTORE);
+
+  assert.equal(getBackupDirForDisplay(), BACKUP_DIR_WINSTORE);
+});
+
+// Regression test for #9209: a non-virtualized Store package writes to the real
+// AppData\Roaming, so the LocalCache path does not exist and must not be shown.
+test('Store builds fall back to the real backup dir when LocalCache is absent', () => {
+  process.windowsStore = true;
+  const { getBackupDirForDisplay } = loadBackupModule();
+
+  existingPaths.add(BACKUP_DIR);
+
+  assert.equal(getBackupDirForDisplay(), BACKUP_DIR);
+});

electron/backup.ts

@@ -22,11 +22,42 @@ import {
 } from './shared-with-frontend/backup-file-cleanup.util';
 
 export const BACKUP_DIR = path.join(app.getPath('userData'), `backups`);
-export const BACKUP_DIR_WINSTORE = BACKUP_DIR.replace(
+
+/**
+ * Where a virtualized MSIX package's writes to BACKUP_DIR physically land, so
+ * Explorer (which runs outside the package and sees no redirection) can be
+ * pointed at them. Display-oriented but not inert: `BACKUP_LOAD_DATA` below
+ * also accepts it as an allow-listed read root.
+ *
+ * shortcut: the package family name is hardcoded and nothing in CI would notice
+ * it drifting (the appx config lives in the WIN_STORE_ELECTRON_BUILDER_YML
+ * secret); drift just fails the probe and we show BACKUP_DIR. Verified against
+ * the shipped v18.15.1 appx on 2026-07-21 — it is `<Identity Name>_<PublisherId>`,
+ * PublisherId being base32(SHA-256(UTF-16LE Publisher)[0..8]), so any release
+ * artifact re-checks it without a Windows machine.
+ */
+const BACKUP_DIR_WINSTORE = BACKUP_DIR.replace(
   'Roaming',
   `Local\\Packages\\53707johannesjo.SuperProductivity_ch45amy23cdv6\\LocalCache\\Roaming`,
 );
 
+/**
+ * The backup location to *show* the user, which is not always the one we write
+ * to. Redirection applies only to virtualized packages and, since Windows 10
+ * 1903, is decided per file — it cannot be known statically, and assuming it
+ * always applies is what made #9209 the mirror image of #995.
+ *
+ * shortcut: an install that flipped from virtualized to full-trust keeps a
+ * stale LocalCache dir that still wins the probe, showing real but outdated
+ * backups. Accepted — restore reads BACKUP_DIR either way, so only manual
+ * recovery is affected. Upgrade path: probe for the newest filename in
+ * BACKUP_DIR (timestamps sort lexically) instead of for the directory.
+ */
+export const getBackupDirForDisplay = (): string =>
+  process.windowsStore && existsSync(BACKUP_DIR_WINSTORE)
+    ? BACKUP_DIR_WINSTORE
+    : BACKUP_DIR;
+
 // eslint-disable-next-line prefer-arrow/prefer-arrow-functions
 export function initBackupAdapter(): void {
   console.log('Saving backups to', BACKUP_DIR);

electron/ipc-handlers/app-data.ts

@@ -1,17 +1,11 @@
 import { app, ipcMain } from 'electron';
 import { IPC } from '../shared-with-frontend/ipc-events.const';
-import { BACKUP_DIR, BACKUP_DIR_WINSTORE } from '../backup';
+import { getBackupDirForDisplay } from '../backup';
 
 export const initAppDataIpc = (): void => {
   ipcMain.handle(IPC.GET_PATH, (ev, name: string) => {
     return app.getPath(name as Parameters<typeof app.getPath>[0]);
   });
 
-  ipcMain.handle(IPC.GET_BACKUP_PATH, () => {
-    if (process?.windowsStore) {
-      return BACKUP_DIR_WINSTORE;
-    } else {
-      return BACKUP_DIR;
-    }
-  });
+  ipcMain.handle(IPC.GET_BACKUP_PATH, () => getBackupDirForDisplay());
 };

src/assets/i18n/en.json

@@ -1492,7 +1492,7 @@
         },
         "PASSWORD_SET_INFO": "🔒 Encryption password is set.",
         "SUPER_SYNC": {
-          "ACCESS_TOKEN_DESCRIPTION": "Paste the token you copied from the server login page",
+          "ACCESS_TOKEN_DESCRIPTION": "Paste a token for your SuperSync account. On another device, reuse this token or sign in again to get another one.",
           "BTN_CHANGE_PASSWORD": "Change Password",
           "BTN_DISABLE_ENCRYPTION": "Disable Encryption",
           "BTN_ENABLE_ENCRYPTION": "Enable Encryption",