chore(deps): electron 44, verified where CI cannot see

[JOhnsonKC201]

Supersedes #37. Same bump, plus the verification that bump actually needs.

Why not just merge #37

npm audit flags electron <= 40.10.2 high, and extract-zip underneath it, so staying on 33 was not free. But green CI proves less here than it looks:

function startInputHook() {
  try {
    const { uIOhook } = require('uiohook-napi');   // native module, ABI-sensitive

That try/catch is correct at runtime (a machine without Accessibility permission should still get a pet) and misleading during an upgrade. A native module that fails to load under a new Electron ABI leaves an app that boots, renders, passes every test, and has silently stopped reacting to typing and scrolling. npm run test:boot cannot catch it, because a pet that never kneads still draws a perfectly good frame.

So the check is now a script

npm run check:hook (new, scripts/hook-check.js) runs inside the main process, loads uiohook-napi, checks the API surface, calls start(), waits for the hook thread to fall over on its own, and stops.

{ "electron": "44.0.0", "node": "24.18.1", "abi": "149",
  "loaded": true, "api": true, "started": true, "stopped": true }
input hook OK

Deliberately not in CI: a headless Linux runner has no input to hook, and a macOS runner cannot grant itself Accessibility, so it would fail for reasons that say nothing about the upgrade. Run it when the Electron major changes.

Verified locally

• npm run check:hook passes on 44 (this is the one that mattered)
• npm test 214 pass / 4 skipped (POSIX-shell iPad tests, which run on the Linux CI job)
• npm run lint clean
• npm run test:boot renders under 44
• npm run pack builds a Windows package against 44 + electron-builder 26.15.3
• npm audit now reports 0 vulnerabilities
• Every Electron API this app calls (app, BrowserWindow, Tray, Menu, ipcMain, screen, dialog, nativeImage, powerMonitor, safeStorage) is long-lived and unchanged across 33 to 44

What still needs eyes

No script can see window layering. Worth two minutes on the desktop after merge: overlay stays above a fullscreen window, clicks pass through to what is underneath, typing still kneads, scrolling still climbs, tray menu opens. Nothing ships from this either way, since releases are cut from a tag rather than from main, so a revert is free if anything looks off.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
pixelcat	Ready	Preview	Aug 28, 2026 3:29am