fix: close APT adversarial runtime gaps

main.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { app, BrowserWindow, ipcMain, shell } = require('electron');
+const { app, BrowserWindow, ipcMain, safeStorage, shell } = require('electron');
 const http = require('node:http');
 const path = require('node:path');
 const { pathToFileURL } = require('node:url');
@@ -110,6 +110,7 @@ function registerIpcHandlers() {
 }
 
 function startBridgeServer() {
+  if (!pairingController.bridgeAuth) return;
   const handler = createBridgeHandler({
     bridgeAuth: pairingController.bridgeAuth,
     sessionStore: runtime.sessionStore,
@@ -134,8 +135,11 @@ app.whenReady().then(() => {
   const sessionStore = createSessionStore();
   const altaClient = createAltaClient({ sessionStore });
   const proxyManager = createProxyManager({ appDirectory: getAppDirectory() });
+  const secureStorageAvailable = safeStorage && safeStorage.isEncryptionAvailable();
   pairingController = new PairingController({
     envelopePath: path.join(app.getPath('userData'), PAIRING_ENVELOPE_FILENAME),
+    protect: secureStorageAvailable ? (value) => safeStorage.encryptString(value) : undefined,
+    unprotect: secureStorageAvailable ? (value) => safeStorage.decryptString(value) : undefined,
   });
   const pairingState = pairingController.initialize();
   firstRunPairingSecret = pairingState.secret || null;
@@ -153,12 +157,17 @@ app.whenReady().then(() => {
   startBridgeServer();
 });
 
-app.on('before-quit', () => {
-  if (bridgeServer) bridgeServer.close();
+app.on('before-quit', (event) => {
   if (runtime) {
-    for (const proxy of runtime.getConnectionState().activeProxies) runtime.stopProxy(proxy.processId);
+    const state = runtime.disconnect();
+    if (state.activeProxies.length > 0) {
+      event.preventDefault();
+      sendConnectionState();
+      return;
+    }
     runtime.sessionStore.dispose();
   }
+  if (bridgeServer) bridgeServer.close();
 });
 
 app.on('window-all-closed', () => {