Add cancellable window close and application quit requests (#65)

- Shared EventRequest / EventDecision for cancellation and deferred
  decisions; retained asynchronous delivery with immediate unsubscription.
- Application.Quit() and Window.Close() go through confirmation requests;
  native window close and macOS application quit are routed to them,
  preserving host delegates and their decisions.
- Binding-owned votes are fenced by their event loop's lifetime.
- Real Flutter lifecycle and multi-window ownership tests.

Author: lijy91

include/nativeapi.h

@@ -16,6 +16,7 @@
 #include "../src/drop_target.h"
 #include "../src/file_dialog.h"
 #include "../src/foundation/color.h"
+#include "../src/foundation/event_request.h"
 #include "../src/foundation/geometry.h"
 #include "../src/foundation/keyboard.h"
 #include "../src/image.h"
@@ -53,6 +54,7 @@
 #include "../src/capi/display_manager_c.h"
 #include "../src/capi/drag_source_c.h"
 #include "../src/capi/drop_target_c.h"
+#include "../src/capi/event_request_c.h"
 #include "../src/capi/file_dialog_c.h"
 #include "../src/capi/geometry_c.h"
 #include "../src/capi/image_c.h"

src/application.cpp

@@ -1,12 +1,200 @@
+#include <atomic>
+
 #include "application.h"
+#include "application_quit_dispatch.h"
+#include "foundation/dispatcher.h"
+#include "foundation/event_request_dispatch.h"
 
 namespace nativeapi {
 
+struct detail::ApplicationQuitState {
+  std::shared_ptr<EventRequest> request;
+  std::atomic<bool> dispatch_failed{false};
+  bool retain_for_host = false;
+  bool has_loop_owner = false;
+  std::weak_ptr<void> loop_owner;
+};
+
 Application& Application::GetInstance() {
   static Application instance;
   return instance;
 }
 
+void Application::RequestQuit(int exit_code,
+                              std::function<void(int)> stop_loop,
+                              std::shared_ptr<void> loop_owner,
+                              std::function<void(bool)> native_confirmation) try {
+  const bool has_loop_owner = !!loop_owner;
+  auto dispatch = CreateGuardedCallback<>(
+      std::function<void()>([this, exit_code, stop_loop = std::move(stop_loop), has_loop_owner,
+                             weak_owner = std::weak_ptr<void>(loop_owner),
+                             native_confirmation = std::move(native_confirmation)] {
+        try {
+          if (has_loop_owner && weak_owner.expired())
+            return;
+          exit_code_ = exit_code;
+          if (quit_state_) {
+            if (!quit_state_->dispatch_failed.load() &&
+                !(quit_state_->has_loop_owner && quit_state_->loop_owner.expired()))
+              return;
+            InvalidateQuitRequest();
+          }
+
+          auto state = std::make_shared<detail::ApplicationQuitState>();
+          state->retain_for_host = !!native_confirmation;
+          state->has_loop_owner = has_loop_owner;
+          state->loop_owner = weak_owner;
+          std::weak_ptr<detail::ApplicationQuitState> weak_state = state;
+
+          auto finish = CreateGuardedCallback<bool>(std::function<void(bool)>(
+              [this, stop_loop, weak_state, native_confirmation](bool accepted) {
+                // Keep the request installed until its completion reaches the UI thread.
+                // Reentrant and worker requests cannot start a second confirmation.
+                auto state = weak_state.lock();
+                if (!state || quit_state_ != state)
+                  return;
+                if (!accepted || (state->has_loop_owner && state->loop_owner.expired())) {
+                  quit_state_.reset();
+                  if (native_confirmation)
+                    native_confirmation(false);
+                  return;
+                }
+                // Keep this attempt installed through its action too. An exiting
+                // listener can call Quit(), but must not start recursive termination.
+                const int code = exit_code_;
+                try {
+                  if (native_confirmation) {
+                    native_confirmation(true);
+                  } else if (stop_loop) {
+                    // A notification failure cannot undo an already approved quit.
+                    try {
+                      Emit<ApplicationExitingEvent>(code);
+                    } catch (...) {
+                    }
+                    stop_loop(code);
+                  } else {
+                    PerformQuit(code);
+                  }
+                } catch (...) {
+                }
+                if (quit_state_ == state && !state->retain_for_host)
+                  quit_state_.reset();
+              }));
+          std::shared_ptr<EventRequest> request;
+          try {
+            request =
+                detail::EventRequestDispatch::Create(true, [finish, weak_state](bool accepted) {
+                  auto complete = [finish, accepted] { finish(accepted); };
+                  if (IsMainThread())
+                    complete();
+                  else {
+                    try {
+                      if (RunOnMainThread(std::move(complete)))
+                        return;
+                    } catch (...) {
+                    }
+                    if (auto state = weak_state.lock())
+                      state->dispatch_failed = true;
+                  }
+                });
+          } catch (...) {
+            // Allocation failure must not silently approve termination.
+            return;
+          }
+          state->request = request;
+          quit_state_ = state;
+          try {
+            Emit<ApplicationQuitRequestedEvent>(request);
+          } catch (...) {
+            request->Cancel();
+          }
+          detail::EventRequestDispatch::Finish(request);
+        } catch (...) {
+          // The UI scheduler invokes this after a worker Quit() has returned.
+          // Failure here must also leave the application running.
+        }
+      }));
+  if (IsMainThread())
+    dispatch();
+  else
+    (void)RunOnMainThread(std::move(dispatch));
+} catch (...) {
+  // Public Quit() never throws, including failures to allocate/schedule work.
+}
+
+void Application::InvalidateQuitRequest() {
+  if (quit_state_)
+    detail::EventRequestDispatch::Invalidate(quit_state_->request);
+  quit_state_.reset();
+}
+
+void detail::ApplicationQuitDispatch::RequestForLoop(int exit_code,
+                                                     std::function<void(int)> stop_loop,
+                                                     std::shared_ptr<void> loop_owner) {
+  if (stop_loop)
+    Application::GetInstance().RequestQuit(exit_code, std::move(stop_loop), std::move(loop_owner));
+}
+
+void detail::ApplicationQuitDispatch::CancelForLoop(std::weak_ptr<void> loop_owner) try {
+  auto& app = Application::GetInstance();
+  auto cancel = app.CreateGuardedCallback<>(std::function<void()>([&app, loop_owner] {
+    const auto& state = app.quit_state_;
+    if (state && state->has_loop_owner && !state->loop_owner.owner_before(loop_owner) &&
+        !loop_owner.owner_before(state->loop_owner))
+      app.InvalidateQuitRequest();
+  }));
+  if (IsMainThread())
+    cancel();
+  else
+    (void)RunOnMainThread(std::move(cancel));
+} catch (...) {
+  // Expiring the binding's owner also fences later requests and completions,
+  // including when scheduling this eager invalidation fails.
+}
+
+std::shared_ptr<EventRequest> detail::ApplicationQuitDispatch::CurrentRequest() {
+  auto& app = Application::GetInstance();
+  if (!IsMainThread())
+    return nullptr;
+  const auto& state = app.quit_state_;
+  if (state &&
+      (state->dispatch_failed.load() || (state->has_loop_owner && state->loop_owner.expired())))
+    app.InvalidateQuitRequest();
+  return app.quit_state_ ? app.quit_state_->request : nullptr;
+}
+void detail::ApplicationQuitDispatch::RequestFromNative(std::function<void(bool)> confirmation) {
+  if (confirmation && IsMainThread())
+    Application::GetInstance().RequestQuit(0, nullptr, nullptr, std::move(confirmation));
+}
+void detail::ApplicationQuitDispatch::HoldForHost(const std::shared_ptr<EventRequest>& request) {
+  auto& app = Application::GetInstance();
+  if (IsMainThread() && app.quit_state_ && app.quit_state_->request == request)
+    app.quit_state_->retain_for_host = true;
+}
+void detail::ApplicationQuitDispatch::ReleaseFromHost(
+    const std::shared_ptr<EventRequest>& request) {
+  auto& app = Application::GetInstance();
+  if (IsMainThread() && app.quit_state_ && app.quit_state_->request == request)
+    app.InvalidateQuitRequest();
+}
+int detail::ApplicationQuitDispatch::ExitCode() {
+  return Application::GetInstance().exit_code_;
+}
+void detail::ApplicationQuitDispatch::NotifyRequired() try {
+  auto& app = Application::GetInstance();
+  if (!IsMainThread())
+    return;
+  app.InvalidateQuitRequest();
+  auto request = EventRequestDispatch::Create(false, nullptr);
+  try {
+    app.Emit<ApplicationQuitRequestedEvent>(request);
+  } catch (...) {
+  }
+  EventRequestDispatch::Finish(request);
+} catch (...) {
+  // Mandatory native termination cannot be vetoed by a failed notification.
+}
+
 int RunApp(std::shared_ptr<Window> window) {
   return Application::GetInstance().Run(window);
 }

src/application.h

@@ -3,6 +3,7 @@
 #include <functional>
 #include <memory>
 #include <string>
+#include <utility>
 #include <vector>
 
 #include "foundation/event.h"
@@ -13,6 +14,12 @@
 
 namespace nativeapi {
 
+class EventRequest;
+namespace detail {
+class ApplicationQuitDispatch;
+struct ApplicationQuitState;
+}  // namespace detail
+
 // ---------------------------------------------------------------------------
 // Events
 // ---------------------------------------------------------------------------
@@ -69,11 +76,24 @@ class ApplicationDeactivatedEvent : public ApplicationEvent {
 
 /**
  * @brief Event emitted when the application receives a quit request
+ *
+ * Programmatic Quit() and macOS native quit queries supply a shared,
+ * cancelable request. Native termination that must continue supplies a
+ * noncancelable request. An existing host retains its final termination decision.
  */
 class ApplicationQuitRequestedEvent : public ApplicationEvent {
  public:
-  ApplicationQuitRequestedEvent() = default;
+  explicit ApplicationQuitRequestedEvent(std::shared_ptr<EventRequest> request = nullptr)
+      : request_(std::move(request)) {}
+  /**
+   * @brief Gets the shared quit confirmation request.
+   * @return The shared request supplied by the producer.
+   */
+  std::shared_ptr<EventRequest> GetRequest() const { return request_; }
   std::string GetTypeName() const override { return "ApplicationQuitRequestedEvent"; }
+
+ private:
+  std::shared_ptr<EventRequest> request_;
 };
 
 /**
@@ -177,26 +197,46 @@ class Application : public EventEmitter<ApplicationEvent> {
   /**
    * @brief Request the application to quit
    *
-   * Emits ApplicationQuitRequestedEvent, then stops the event loop: Run()
+   * Emits ApplicationQuitRequestedEvent with a cancelable EventRequest. A
+   * listener can Cancel() or Defer() it for asynchronous confirmation. Only
+   * after every listener has finished and every deferred decision has accepted
+   * does the event loop stop: Run()
    * returns @p exit_code after emitting ApplicationExitingEvent, and the
    * process keeps going. Windows stay open until released. Callable from any
    * thread: the request is carried over to the main thread, where the events
    * are emitted.
+   * Repeated Quit() calls during confirmation share the pending request and
+   * update its exit code. A cancelled request leaves the application running;
+   * a later Quit() starts a fresh request. Exceptions during request dispatch
+   * cancel it. A failed main-thread dispatch does not quit from a worker.
    *
    * When the loop is not Run()'s own (a host such as a Flutter runner owns
    * it), there is nothing to return to and the process ends instead, after
    * ApplicationExitingEvent: on macOS through -[NSApplication terminate:],
-   * which exits with status 0 whatever @p exit_code is; on Linux with
+   * which exits with status 0 whatever @p exit_code is after the host delegate
+   * allows termination (the host may cancel or defer); on Linux with
    * @p exit_code; on Windows the main thread's windows are destroyed while
    * the host's loop still runs (a Flutter view shuts its engine down then),
    * and the loop gets WM_QUIT and ends it.
    *
-   * A quit the user or the system starts outside Quit() (Cmd+Q, logout) also
-   * emits ApplicationQuitRequestedEvent. On macOS it cannot be vetoed and
-   * ends the process without Run() returning.
+   * On macOS, a native AppKit quit query (Cmd+Q, Dock Quit, or an eligible
+   * system request) also emits a cancelable ApplicationQuitRequestedEvent.
+   * Native approval resumes the existing host's decision; the host may still
+   * refuse or defer. Duplicate attempts share the pending confirmation through
+   * the host's asynchronous reply. Mandatory termination only emits a
+   * noncancelable request, invalidates pending votes, and continues. Allowed
+   * native termination ends the process without Run() returning.
    *
    * @param exit_code The exit code to use when quitting (default: 0)
    *
+   * @note Platform availability:
+   * - macOS: Supported - cancelable programmatic and native quit queries, then the host decision
+   * - Windows: Supported - cancelable Quit(), then the native loop stops
+   * - Linux: Supported - cancelable Quit(), then the native loop stops
+   * - Android: Not applicable - ignored; the Activity owns its lifecycle
+   * - iOS: Not applicable - ignored; UIApplication owns its lifecycle
+   * - OpenHarmony: Not applicable - ignored; the Ability owns its lifecycle
+   *
    * @code
    * auto& app = Application::GetInstance();
    * app.Quit(0);  // Quit with success code
@@ -404,6 +444,10 @@ class Application : public EventEmitter<ApplicationEvent> {
    */
   std::vector<std::shared_ptr<Window>> GetAllWindows() const;
 
+ protected:
+  void StartEventListening() override;
+  void StopEventListening() override;
+
  private:
   /**
    * @brief Private constructor to enforce singleton pattern
@@ -413,6 +457,15 @@ class Application : public EventEmitter<ApplicationEvent> {
    */
   Application();
 
+  friend class detail::ApplicationQuitDispatch;
+  void RequestQuit(int exit_code,
+                   std::function<void(int)> stop_loop = nullptr,
+                   std::shared_ptr<void> loop_owner = nullptr,
+                   std::function<void(bool)> native_confirmation = nullptr);
+  void PerformQuit(int exit_code);
+  void InvalidateQuitRequest();
+  std::shared_ptr<detail::ApplicationQuitState> quit_state_;
+
   // Prevent copy construction and assignment to maintain singleton property
   Application(const Application&) = delete;
   Application& operator=(const Application&) = delete;
@@ -439,8 +492,6 @@ class Application : public EventEmitter<ApplicationEvent> {
    * @brief Primary application window
    */
   std::shared_ptr<Window> primary_window_;
-
- private:
 };
 
 /**

src/application_quit_dispatch.h

@@ -0,0 +1,36 @@
+#pragma once
+
+// Private binding/host protocol; not part of API_HEADERS or the umbrella.
+#include <functional>
+#include <memory>
+
+namespace nativeapi {
+class EventRequest;
+}
+
+namespace nativeapi::detail {
+
+class ApplicationQuitDispatch {
+ public:
+  // A binding owns a non-blocking loop. Confirm using the same application
+  // request as Quit(), then finish that loop rather than the host's process.
+  static void RequestForLoop(int exit_code,
+                             std::function<void(int)> stop_loop,
+                             std::shared_ptr<void> loop_owner = nullptr);
+
+  // Optional ownership fence for a cancellable binding loop. The binding
+  // alone retains loop_owner; queued requests/completions retain it weakly.
+  // Cancel only the matching attempt, even if a new loop has already started.
+  static void CancelForLoop(std::weak_ptr<void> loop_owner);
+
+  // Native UI producer and host confirmation continuation. These calls must
+  // run on UI; the host retains the slot until its async decision completes.
+  static std::shared_ptr<EventRequest> CurrentRequest();
+  static void RequestFromNative(std::function<void(bool)> confirmation);
+  static void HoldForHost(const std::shared_ptr<EventRequest>& request);
+  static void ReleaseFromHost(const std::shared_ptr<EventRequest>& request);
+  static void NotifyRequired();
+  static int ExitCode();
+};
+
+}  // namespace nativeapi::detail