fix(ci): simplify electron release - let electron-builder publish directly (#349)

* chore: bump version to 0.4.5 and add desktop app to README

* style: auto-format with Biome

---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

.github/workflows/electron-release.yml

@@ -0,0 +1,46 @@
+name: Electron Release
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version tag (e.g., v0.4.5)"
+        required: false
+
+jobs:
+  build:
+    permissions:
+      contents: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-latest
+            platform: mac
+          - os: windows-latest
+            platform: win
+          - os: ubuntu-latest
+            platform: linux
+
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: "npm"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build and publish Electron app
+        run: npm run dist:${{ matrix.platform }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -50,3 +50,16 @@ push-via-ec2.sh
 .wrangler/
 .env*.local
 
+# Electron
+/dist-electron/
+/release/
+/electron-standalone/
+*.dmg
+*.exe
+*.AppImage
+*.deb
+*.rpm
+*.snap
+
+CLAUDE.md
+.spec-workflow

README.md

@@ -33,6 +33,7 @@ https://github.com/user-attachments/assets/9d60a3e8-4a1c-4b5e-acbb-26af2d3eabd1
   - [MCP Server (Preview)](#mcp-server-preview)
   - [Getting Started](#getting-started)
     - [Try it Online](#try-it-online)
+    - [Desktop Application](#desktop-application)
     - [Run with Docker (Recommended)](#run-with-docker-recommended)
     - [Installation](#installation)
   - [Deployment](#deployment)
@@ -135,6 +136,28 @@ No installation needed! Try the app directly on our demo site:
 
 > **Bring Your Own API Key**: You can use your own API key to bypass usage limits on the demo site. Click the Settings icon in the chat panel to configure your provider and API key. Your key is stored locally in your browser and is never stored on the server.
 
+### Desktop Application
+
+Download the native desktop app for your platform from the [Releases page](https://github.com/DayuanJiang/next-ai-draw-io/releases):
+
+| Platform | Download |
+|----------|----------|
+| macOS | `.dmg` (Intel & Apple Silicon) |
+| Windows | `.exe` installer (x64 & ARM64) |
+| Linux | `.AppImage` or `.deb` (x64 & ARM64) |
+
+**Features:**
+- **Secure API key storage**: Credentials encrypted using OS keychain
+- **Configuration presets**: Save and switch between AI providers via menu
+- **Native file dialogs**: Open/save `.drawio` files directly
+- **Offline capable**: Works without internet after first launch
+
+**Quick Setup:**
+1. Download and install for your platform
+2. Open the app → **Menu → Configuration → Manage Presets**
+3. Add your AI provider credentials
+4. Start creating diagrams!
+
 ### Run with Docker (Recommended)
 
 If you just want to run it locally, the best way is to use Docker.

components/settings-dialog.tsx

@@ -452,6 +452,11 @@ export function SettingsDialog({
                         />
                     </div>
                 </div>
+                <div className="pt-4 border-t border-border/50">
+                    <p className="text-[0.75rem] text-muted-foreground text-center">
+                        Version {process.env.APP_VERSION}
+                    </p>
+                </div>
             </DialogContent>
         </Dialog>
     )

electron-builder.yml

@@ -0,0 +1,96 @@
+appId: com.nextaidrawio.app
+productName: Next AI Draw.io
+copyright: Copyright © 2024 Next AI Draw.io
+electronVersion: 39.2.7
+
+directories:
+  output: release
+  buildResources: resources
+
+afterPack: ./scripts/afterPack.cjs
+
+files:
+  - dist-electron/**/*
+  - "!node_modules"
+
+asarUnpack:
+  - "**/*.node"
+
+extraResources:
+  # Copy prepared standalone directory (includes node_modules)
+  - from: electron-standalone/
+    to: standalone/
+  # Copy icon for runtime use (Windows/Linux)
+  - from: resources/icon.png
+    to: icon.png
+
+# macOS configuration
+mac:
+  category: public.app-category.productivity
+  icon: resources/icon.png
+  target:
+    - target: dmg
+      arch:
+        - x64
+        - arm64
+    - target: zip
+      arch:
+        - x64
+        - arm64
+  hardenedRuntime: true
+  gatekeeperAssess: false
+  entitlements: resources/entitlements.mac.plist
+  entitlementsInherit: resources/entitlements.mac.plist
+
+dmg:
+  contents:
+    - x: 130
+      y: 220
+    - x: 410
+      y: 220
+      type: link
+      path: /Applications
+  window:
+    width: 540
+    height: 380
+
+# Windows configuration
+win:
+  icon: resources/icon.png
+  target:
+    - target: nsis
+      arch:
+        - x64
+        - arm64
+    - target: portable
+      arch:
+        - x64
+        - arm64
+
+nsis:
+  oneClick: false
+  perMachine: false
+  allowToChangeInstallationDirectory: true
+  deleteAppDataOnUninstall: false
+  createDesktopShortcut: true
+  createStartMenuShortcut: true
+
+# Linux configuration
+linux:
+  icon: resources/icon.png
+  category: Office
+  maintainer: Next AI Draw.io <nextaidrawio@users.noreply.github.com>
+  target:
+    - target: AppImage
+      arch:
+        - x64
+        - arm64
+    - target: deb
+      arch:
+        - x64
+        - arm64
+
+# Publish configuration (optional)
+publish:
+  provider: github
+  releaseType: release

electron.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Type declarations for Electron API exposed via preload script
+ */
+
+/** Configuration preset interface */
+interface ConfigPreset {
+    id: string
+    name: string
+    createdAt: number
+    updatedAt: number
+    config: {
+        AI_PROVIDER?: string
+        AI_MODEL?: string
+        AI_API_KEY?: string
+        AI_BASE_URL?: string
+        TEMPERATURE?: string
+        [key: string]: string | undefined
+    }
+}
+
+/** Result of applying a preset */
+interface ApplyPresetResult {
+    success: boolean
+    error?: string
+    env?: Record<string, string>
+}
+
+declare global {
+    interface Window {
+        /** Main window Electron API */
+        electronAPI?: {
+            /** Current platform (darwin, win32, linux) */
+            platform: NodeJS.Platform
+            /** Whether running in Electron environment */
+            isElectron: boolean
+            /** Get application version */
+            getVersion: () => Promise<string>
+            /** Minimize the window */
+            minimize: () => void
+            /** Maximize/restore the window */
+            maximize: () => void
+            /** Close the window */
+            close: () => void
+            /** Open file dialog and return file path */
+            openFile: () => Promise<string | null>
+            /** Save data to file via save dialog */
+            saveFile: (data: string) => Promise<boolean>
+        }
+
+        /** Settings window Electron API */
+        settingsAPI?: {
+            /** Get all configuration presets */
+            getPresets: () => Promise<ConfigPreset[]>
+            /** Get current preset ID */
+            getCurrentPresetId: () => Promise<string | null>
+            /** Get current preset */
+            getCurrentPreset: () => Promise<ConfigPreset | null>
+            /** Save (create or update) a preset */
+            savePreset: (preset: {
+                id?: string
+                name: string
+                config: Record<string, string | undefined>
+            }) => Promise<ConfigPreset>
+            /** Delete a preset */
+            deletePreset: (id: string) => Promise<boolean>
+            /** Apply a preset (sets environment variables and restarts server) */
+            applyPreset: (id: string) => Promise<ApplyPresetResult>
+            /** Close settings window */
+            close: () => void
+        }
+    }
+}
+
+export { ConfigPreset, ApplyPresetResult }

electron/main/app-menu.ts

@@ -0,0 +1,241 @@
+import {
+    app,
+    BrowserWindow,
+    dialog,
+    Menu,
+    type MenuItemConstructorOptions,
+    shell,
+} from "electron"
+import {
+    applyPresetToEnv,
+    getAllPresets,
+    getCurrentPresetId,
+    setCurrentPreset,
+} from "./config-manager"
+import { restartNextServer } from "./next-server"
+import { showSettingsWindow } from "./settings-window"
+
+/**
+ * Build and set the application menu
+ */
+export function buildAppMenu(): void {
+    const template = getMenuTemplate()
+    const menu = Menu.buildFromTemplate(template)
+    Menu.setApplicationMenu(menu)
+}
+
+/**
+ * Rebuild the menu (call this when presets change)
+ */
+export function rebuildAppMenu(): void {
+    buildAppMenu()
+}
+
+/**
+ * Get the menu template
+ */
+function getMenuTemplate(): MenuItemConstructorOptions[] {
+    const isMac = process.platform === "darwin"
+
+    const template: MenuItemConstructorOptions[] = []
+
+    // macOS app menu
+    if (isMac) {
+        template.push({
+            label: app.name,
+            submenu: [
+                { role: "about" },
+                { type: "separator" },
+                {
+                    label: "Settings...",
+                    accelerator: "CmdOrCtrl+,",
+                    click: () => {
+                        const win = BrowserWindow.getFocusedWindow()
+                        showSettingsWindow(win || undefined)
+                    },
+                },
+                { type: "separator" },
+                { role: "services" },
+                { type: "separator" },
+                { role: "hide" },
+                { role: "hideOthers" },
+                { role: "unhide" },
+                { type: "separator" },
+                { role: "quit" },
+            ],
+        })
+    }
+
+    // File menu
+    template.push({
+        label: "File",
+        submenu: [
+            ...(isMac
+                ? []
+                : [
+                      {
+                          label: "Settings",
+                          accelerator: "CmdOrCtrl+,",
+                          click: () => {
+                              const win = BrowserWindow.getFocusedWindow()
+                              showSettingsWindow(win || undefined)
+                          },
+                      },
+                      { type: "separator" } as MenuItemConstructorOptions,
+                  ]),
+            isMac ? { role: "close" } : { role: "quit" },
+        ],
+    })
+
+    // Edit menu
+    template.push({
+        label: "Edit",
+        submenu: [
+            { role: "undo" },
+            { role: "redo" },
+            { type: "separator" },
+            { role: "cut" },
+            { role: "copy" },
+            { role: "paste" },
+            ...(isMac
+                ? [
+                      {
+                          role: "pasteAndMatchStyle",
+                      } as MenuItemConstructorOptions,
+                      { role: "delete" } as MenuItemConstructorOptions,
+                      { role: "selectAll" } as MenuItemConstructorOptions,
+                  ]
+                : [
+                      { role: "delete" } as MenuItemConstructorOptions,
+                      { type: "separator" } as MenuItemConstructorOptions,
+                      { role: "selectAll" } as MenuItemConstructorOptions,
+                  ]),
+        ],
+    })
+
+    // View menu
+    template.push({
+        label: "View",
+        submenu: [
+            { role: "reload" },
+            { role: "forceReload" },
+            { role: "toggleDevTools" },
+            { type: "separator" },
+            { role: "resetZoom" },
+            { role: "zoomIn" },
+            { role: "zoomOut" },
+            { type: "separator" },
+            { role: "togglefullscreen" },
+        ],
+    })
+
+    // Configuration menu with presets
+    template.push(buildConfigMenu())
+
+    // Window menu
+    template.push({
+        label: "Window",
+        submenu: [
+            { role: "minimize" },
+            { role: "zoom" },
+            ...(isMac
+                ? [
+                      { type: "separator" } as MenuItemConstructorOptions,
+                      { role: "front" } as MenuItemConstructorOptions,
+                  ]
+                : [{ role: "close" } as MenuItemConstructorOptions]),
+        ],
+    })
+
+    // Help menu
+    template.push({
+        label: "Help",
+        submenu: [
+            {
+                label: "Documentation",
+                click: async () => {
+                    await shell.openExternal(
+                        "https://github.com/dayuanjiang/next-ai-draw-io",
+                    )
+                },
+            },
+            {
+                label: "Report Issue",
+                click: async () => {
+                    await shell.openExternal(
+                        "https://github.com/dayuanjiang/next-ai-draw-io/issues",
+                    )
+                },
+            },
+        ],
+    })
+
+    return template
+}
+
+/**
+ * Build the Configuration menu with presets
+ */
+function buildConfigMenu(): MenuItemConstructorOptions {
+    const presets = getAllPresets()
+    const currentPresetId = getCurrentPresetId()
+
+    const presetItems: MenuItemConstructorOptions[] = presets.map((preset) => ({
+        label: preset.name,
+        type: "radio",
+        checked: preset.id === currentPresetId,
+        click: async () => {
+            const previousPresetId = getCurrentPresetId()
+            const env = applyPresetToEnv(preset.id)
+
+            if (env) {
+                try {
+                    await restartNextServer()
+                    rebuildAppMenu() // Rebuild menu to update checkmarks
+                } catch (error) {
+                    console.error("Failed to restart server:", error)
+
+                    // Revert to previous preset on failure
+                    if (previousPresetId) {
+                        applyPresetToEnv(previousPresetId)
+                    } else {
+                        setCurrentPreset(null)
+                    }
+
+                    // Rebuild menu to restore previous checkmark state
+                    rebuildAppMenu()
+
+                    // Show error dialog to notify user
+                    dialog.showErrorBox(
+                        "Configuration Error",
+                        `Failed to apply preset "${preset.name}". The server could not be restarted.\n\nThe previous configuration has been restored.\n\nError: ${error instanceof Error ? error.message : String(error)}`,
+                    )
+                }
+            }
+        },
+    }))
+
+    return {
+        label: "Configuration",
+        submenu: [
+            ...(presetItems.length > 0
+                ? [
+                      { label: "Switch Preset", enabled: false },
+                      { type: "separator" } as MenuItemConstructorOptions,
+                      ...presetItems,
+                      { type: "separator" } as MenuItemConstructorOptions,
+                  ]
+                : []),
+            {
+                label:
+                    presetItems.length > 0
+                        ? "Manage Presets..."
+                        : "Add Configuration Preset...",
+                click: () => {
+                    const win = BrowserWindow.getFocusedWindow()
+                    showSettingsWindow(win || undefined)
+                },
+            },
+        ],
+    }
+}

electron/main/config-manager.ts

@@ -0,0 +1,460 @@
+import { randomUUID } from "node:crypto"
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"
+import path from "node:path"
+import { app, safeStorage } from "electron"
+
+/**
+ * Fields that contain sensitive data and should be encrypted
+ */
+const SENSITIVE_FIELDS = ["AI_API_KEY"] as const
+
+/**
+ * Prefix to identify encrypted values
+ */
+const ENCRYPTED_PREFIX = "encrypted:"
+
+/**
+ * Check if safeStorage encryption is available
+ */
+function isEncryptionAvailable(): boolean {
+    return safeStorage.isEncryptionAvailable()
+}
+
+/**
+ * Track if we've already warned about plaintext storage
+ */
+let hasWarnedAboutPlaintext = false
+
+/**
+ * Encrypt a sensitive value using safeStorage
+ * Warns if encryption is not available (API key stored in plaintext)
+ */
+function encryptValue(value: string): string {
+    if (!value) {
+        return value
+    }
+
+    if (!isEncryptionAvailable()) {
+        if (!hasWarnedAboutPlaintext) {
+            console.warn(
+                "⚠️ SECURITY WARNING: safeStorage not available. " +
+                    "API keys will be stored in PLAINTEXT. " +
+                    "On Linux, install gnome-keyring or similar for secure storage.",
+            )
+            hasWarnedAboutPlaintext = true
+        }
+        return value
+    }
+
+    try {
+        const encrypted = safeStorage.encryptString(value)
+        return ENCRYPTED_PREFIX + encrypted.toString("base64")
+    } catch (error) {
+        console.error("Encryption failed:", error)
+        // Fail secure: don't store if encryption fails
+        throw new Error(
+            "Failed to encrypt API key. Cannot securely store credentials.",
+        )
+    }
+}
+
+/**
+ * Decrypt a sensitive value using safeStorage
+ * Returns the original value if it's not encrypted or decryption fails
+ */
+function decryptValue(value: string): string {
+    if (!value || !value.startsWith(ENCRYPTED_PREFIX)) {
+        return value
+    }
+    if (!isEncryptionAvailable()) {
+        console.warn(
+            "Cannot decrypt value: safeStorage encryption is not available",
+        )
+        return value
+    }
+    try {
+        const base64Data = value.slice(ENCRYPTED_PREFIX.length)
+        const buffer = Buffer.from(base64Data, "base64")
+        return safeStorage.decryptString(buffer)
+    } catch (error) {
+        console.error("Failed to decrypt value:", error)
+        return value
+    }
+}
+
+/**
+ * Encrypt sensitive fields in a config object
+ */
+function encryptConfig(
+    config: Record<string, string | undefined>,
+): Record<string, string | undefined> {
+    const encrypted = { ...config }
+    for (const field of SENSITIVE_FIELDS) {
+        if (encrypted[field]) {
+            encrypted[field] = encryptValue(encrypted[field] as string)
+        }
+    }
+    return encrypted
+}
+
+/**
+ * Decrypt sensitive fields in a config object
+ */
+function decryptConfig(
+    config: Record<string, string | undefined>,
+): Record<string, string | undefined> {
+    const decrypted = { ...config }
+    for (const field of SENSITIVE_FIELDS) {
+        if (decrypted[field]) {
+            decrypted[field] = decryptValue(decrypted[field] as string)
+        }
+    }
+    return decrypted
+}
+
+/**
+ * Configuration preset interface
+ */
+export interface ConfigPreset {
+    id: string
+    name: string
+    createdAt: number
+    updatedAt: number
+    config: {
+        AI_PROVIDER?: string
+        AI_MODEL?: string
+        AI_API_KEY?: string
+        AI_BASE_URL?: string
+        TEMPERATURE?: string
+        [key: string]: string | undefined
+    }
+}
+
+/**
+ * Configuration file structure
+ */
+interface ConfigPresetsFile {
+    version: 1
+    currentPresetId: string | null
+    presets: ConfigPreset[]
+}
+
+const CONFIG_FILE_NAME = "config-presets.json"
+
+/**
+ * Get the path to the config file
+ */
+function getConfigFilePath(): string {
+    const userDataPath = app.getPath("userData")
+    return path.join(userDataPath, CONFIG_FILE_NAME)
+}
+
+/**
+ * Load presets from the config file
+ * Decrypts sensitive fields automatically
+ */
+export function loadPresets(): ConfigPresetsFile {
+    const configPath = getConfigFilePath()
+
+    if (!existsSync(configPath)) {
+        return {
+            version: 1,
+            currentPresetId: null,
+            presets: [],
+        }
+    }
+
+    try {
+        const content = readFileSync(configPath, "utf-8")
+        const data = JSON.parse(content) as ConfigPresetsFile
+
+        // Decrypt sensitive fields in each preset
+        data.presets = data.presets.map((preset) => ({
+            ...preset,
+            config: decryptConfig(preset.config) as ConfigPreset["config"],
+        }))
+
+        return data
+    } catch (error) {
+        console.error("Failed to load config presets:", error)
+        return {
+            version: 1,
+            currentPresetId: null,
+            presets: [],
+        }
+    }
+}
+
+/**
+ * Save presets to the config file
+ * Encrypts sensitive fields automatically
+ */
+export function savePresets(data: ConfigPresetsFile): void {
+    const configPath = getConfigFilePath()
+    const userDataPath = app.getPath("userData")
+
+    // Ensure the directory exists
+    if (!existsSync(userDataPath)) {
+        mkdirSync(userDataPath, { recursive: true })
+    }
+
+    // Encrypt sensitive fields before saving
+    const dataToSave: ConfigPresetsFile = {
+        ...data,
+        presets: data.presets.map((preset) => ({
+            ...preset,
+            config: encryptConfig(preset.config) as ConfigPreset["config"],
+        })),
+    }
+
+    try {
+        writeFileSync(configPath, JSON.stringify(dataToSave, null, 2), "utf-8")
+    } catch (error) {
+        console.error("Failed to save config presets:", error)
+        throw error
+    }
+}
+
+/**
+ * Get all presets
+ */
+export function getAllPresets(): ConfigPreset[] {
+    const data = loadPresets()
+    return data.presets
+}
+
+/**
+ * Get current preset ID
+ */
+export function getCurrentPresetId(): string | null {
+    const data = loadPresets()
+    return data.currentPresetId
+}
+
+/**
+ * Get current preset
+ */
+export function getCurrentPreset(): ConfigPreset | null {
+    const data = loadPresets()
+    if (!data.currentPresetId) {
+        return null
+    }
+    return data.presets.find((p) => p.id === data.currentPresetId) || null
+}
+
+/**
+ * Create a new preset
+ */
+export function createPreset(
+    preset: Omit<ConfigPreset, "id" | "createdAt" | "updatedAt">,
+): ConfigPreset {
+    const data = loadPresets()
+    const now = Date.now()
+
+    const newPreset: ConfigPreset = {
+        id: randomUUID(),
+        name: preset.name,
+        config: preset.config,
+        createdAt: now,
+        updatedAt: now,
+    }
+
+    data.presets.push(newPreset)
+    savePresets(data)
+
+    return newPreset
+}
+
+/**
+ * Update an existing preset
+ */
+export function updatePreset(
+    id: string,
+    updates: Partial<Omit<ConfigPreset, "id" | "createdAt">>,
+): ConfigPreset | null {
+    const data = loadPresets()
+    const index = data.presets.findIndex((p) => p.id === id)
+
+    if (index === -1) {
+        return null
+    }
+
+    const updatedPreset: ConfigPreset = {
+        ...data.presets[index],
+        ...updates,
+        updatedAt: Date.now(),
+    }
+
+    data.presets[index] = updatedPreset
+    savePresets(data)
+
+    return updatedPreset
+}
+
+/**
+ * Delete a preset
+ */
+export function deletePreset(id: string): boolean {
+    const data = loadPresets()
+    const index = data.presets.findIndex((p) => p.id === id)
+
+    if (index === -1) {
+        return false
+    }
+
+    data.presets.splice(index, 1)
+
+    // Clear current preset if it was deleted
+    if (data.currentPresetId === id) {
+        data.currentPresetId = null
+    }
+
+    savePresets(data)
+    return true
+}
+
+/**
+ * Set the current preset
+ */
+export function setCurrentPreset(id: string | null): boolean {
+    const data = loadPresets()
+
+    if (id !== null) {
+        const preset = data.presets.find((p) => p.id === id)
+        if (!preset) {
+            return false
+        }
+    }
+
+    data.currentPresetId = id
+    savePresets(data)
+    return true
+}
+
+/**
+ * Map generic AI_API_KEY and AI_BASE_URL to provider-specific environment variables
+ */
+const PROVIDER_ENV_MAP: Record<string, { apiKey: string; baseUrl: string }> = {
+    openai: { apiKey: "OPENAI_API_KEY", baseUrl: "OPENAI_BASE_URL" },
+    anthropic: { apiKey: "ANTHROPIC_API_KEY", baseUrl: "ANTHROPIC_BASE_URL" },
+    google: {
+        apiKey: "GOOGLE_GENERATIVE_AI_API_KEY",
+        baseUrl: "GOOGLE_BASE_URL",
+    },
+    azure: { apiKey: "AZURE_API_KEY", baseUrl: "AZURE_BASE_URL" },
+    openrouter: {
+        apiKey: "OPENROUTER_API_KEY",
+        baseUrl: "OPENROUTER_BASE_URL",
+    },
+    deepseek: { apiKey: "DEEPSEEK_API_KEY", baseUrl: "DEEPSEEK_BASE_URL" },
+    siliconflow: {
+        apiKey: "SILICONFLOW_API_KEY",
+        baseUrl: "SILICONFLOW_BASE_URL",
+    },
+    gateway: { apiKey: "AI_GATEWAY_API_KEY", baseUrl: "AI_GATEWAY_BASE_URL" },
+    // bedrock and ollama don't use API keys in the same way
+    bedrock: { apiKey: "", baseUrl: "" },
+    ollama: { apiKey: "", baseUrl: "OLLAMA_BASE_URL" },
+}
+
+/**
+ * Apply preset environment variables to the current process
+ * Returns the environment variables that were applied
+ */
+export function applyPresetToEnv(id: string): Record<string, string> | null {
+    const data = loadPresets()
+    const preset = data.presets.find((p) => p.id === id)
+
+    if (!preset) {
+        return null
+    }
+
+    const appliedEnv: Record<string, string> = {}
+    const provider = preset.config.AI_PROVIDER?.toLowerCase()
+
+    for (const [key, value] of Object.entries(preset.config)) {
+        if (value !== undefined && value !== "") {
+            // Map generic AI_API_KEY to provider-specific key
+            if (
+                key === "AI_API_KEY" &&
+                provider &&
+                PROVIDER_ENV_MAP[provider]
+            ) {
+                const providerApiKey = PROVIDER_ENV_MAP[provider].apiKey
+                if (providerApiKey) {
+                    process.env[providerApiKey] = value
+                    appliedEnv[providerApiKey] = value
+                }
+            }
+            // Map generic AI_BASE_URL to provider-specific key
+            else if (
+                key === "AI_BASE_URL" &&
+                provider &&
+                PROVIDER_ENV_MAP[provider]
+            ) {
+                const providerBaseUrl = PROVIDER_ENV_MAP[provider].baseUrl
+                if (providerBaseUrl) {
+                    process.env[providerBaseUrl] = value
+                    appliedEnv[providerBaseUrl] = value
+                }
+            }
+            // Apply other env vars directly
+            else {
+                process.env[key] = value
+                appliedEnv[key] = value
+            }
+        }
+    }
+
+    // Set as current preset
+    data.currentPresetId = id
+    savePresets(data)
+
+    return appliedEnv
+}
+
+/**
+ * Get environment variables from current preset
+ * Maps generic AI_API_KEY/AI_BASE_URL to provider-specific keys
+ */
+export function getCurrentPresetEnv(): Record<string, string> {
+    const preset = getCurrentPreset()
+    if (!preset) {
+        return {}
+    }
+
+    const env: Record<string, string> = {}
+    const provider = preset.config.AI_PROVIDER?.toLowerCase()
+
+    for (const [key, value] of Object.entries(preset.config)) {
+        if (value !== undefined && value !== "") {
+            // Map generic AI_API_KEY to provider-specific key
+            if (
+                key === "AI_API_KEY" &&
+                provider &&
+                PROVIDER_ENV_MAP[provider]
+            ) {
+                const providerApiKey = PROVIDER_ENV_MAP[provider].apiKey
+                if (providerApiKey) {
+                    env[providerApiKey] = value
+                }
+            }
+            // Map generic AI_BASE_URL to provider-specific key
+            else if (
+                key === "AI_BASE_URL" &&
+                provider &&
+                PROVIDER_ENV_MAP[provider]
+            ) {
+                const providerBaseUrl = PROVIDER_ENV_MAP[provider].baseUrl
+                if (providerBaseUrl) {
+                    env[providerBaseUrl] = value
+                }
+            }
+            // Apply other env vars directly
+            else {
+                env[key] = value
+            }
+        }
+    }
+    return env
+}

electron/main/env-loader.ts

@@ -0,0 +1,67 @@
+import fs from "node:fs"
+import path from "node:path"
+import { app } from "electron"
+
+/**
+ * Load environment variables from .env file
+ * Searches multiple locations in priority order
+ */
+export function loadEnvFile(): void {
+    const possiblePaths = [
+        // Next to the executable (for portable installations)
+        path.join(path.dirname(app.getPath("exe")), ".env"),
+        // User data directory (persists across updates)
+        path.join(app.getPath("userData"), ".env"),
+        // Development: project root
+        path.join(app.getAppPath(), ".env.local"),
+        path.join(app.getAppPath(), ".env"),
+    ]
+
+    for (const envPath of possiblePaths) {
+        if (fs.existsSync(envPath)) {
+            console.log(`Loading environment from: ${envPath}`)
+            loadEnvFromFile(envPath)
+            return
+        }
+    }
+
+    console.log("No .env file found, using system environment variables")
+}
+
+/**
+ * Parse and load environment variables from a file
+ */
+function loadEnvFromFile(filePath: string): void {
+    try {
+        const content = fs.readFileSync(filePath, "utf-8")
+        const lines = content.split("\n")
+
+        for (const line of lines) {
+            const trimmed = line.trim()
+
+            // Skip comments and empty lines
+            if (!trimmed || trimmed.startsWith("#")) continue
+
+            const equalIndex = trimmed.indexOf("=")
+            if (equalIndex === -1) continue
+
+            const key = trimmed.slice(0, equalIndex).trim()
+            let value = trimmed.slice(equalIndex + 1).trim()
+
+            // Remove surrounding quotes
+            if (
+                (value.startsWith('"') && value.endsWith('"')) ||
+                (value.startsWith("'") && value.endsWith("'"))
+            ) {
+                value = value.slice(1, -1)
+            }
+
+            // Don't override existing environment variables
+            if (!(key in process.env)) {
+                process.env[key] = value
+            }
+        }
+    } catch (error) {
+        console.error(`Failed to load env file ${filePath}:`, error)
+    }
+}

electron/main/index.ts

@@ -0,0 +1,105 @@
+import { app, BrowserWindow, dialog, shell } from "electron"
+import { buildAppMenu } from "./app-menu"
+import { getCurrentPresetEnv } from "./config-manager"
+import { loadEnvFile } from "./env-loader"
+import { registerIpcHandlers } from "./ipc-handlers"
+import { startNextServer, stopNextServer } from "./next-server"
+import { registerSettingsWindowHandlers } from "./settings-window"
+import { createWindow, getMainWindow } from "./window-manager"
+
+// Single instance lock
+const gotTheLock = app.requestSingleInstanceLock()
+
+if (!gotTheLock) {
+    app.quit()
+} else {
+    app.on("second-instance", () => {
+        const mainWindow = getMainWindow()
+        if (mainWindow) {
+            if (mainWindow.isMinimized()) mainWindow.restore()
+            mainWindow.focus()
+        }
+    })
+
+    // Load environment variables from .env files
+    loadEnvFile()
+
+    // Apply saved preset environment variables (overrides .env)
+    const presetEnv = getCurrentPresetEnv()
+    for (const [key, value] of Object.entries(presetEnv)) {
+        process.env[key] = value
+    }
+
+    const isDev = process.env.NODE_ENV === "development"
+    let serverUrl: string | null = null
+
+    app.whenReady().then(async () => {
+        // Register IPC handlers
+        registerIpcHandlers()
+        registerSettingsWindowHandlers()
+
+        // Build application menu
+        buildAppMenu()
+
+        try {
+            if (isDev) {
+                // Development: use the dev server URL
+                serverUrl =
+                    process.env.ELECTRON_DEV_URL || "http://localhost:6002"
+                console.log(`Development mode: connecting to ${serverUrl}`)
+            } else {
+                // Production: start Next.js standalone server
+                serverUrl = await startNextServer()
+            }
+
+            // Create main window
+            createWindow(serverUrl)
+        } catch (error) {
+            console.error("Failed to start application:", error)
+            dialog.showErrorBox(
+                "Startup Error",
+                `Failed to start the application: ${error instanceof Error ? error.message : "Unknown error"}`,
+            )
+            app.quit()
+        }
+
+        app.on("activate", () => {
+            if (BrowserWindow.getAllWindows().length === 0) {
+                if (serverUrl) {
+                    createWindow(serverUrl)
+                }
+            }
+        })
+    })
+
+    app.on("window-all-closed", () => {
+        if (process.platform !== "darwin") {
+            stopNextServer()
+            app.quit()
+        }
+    })
+
+    app.on("before-quit", () => {
+        stopNextServer()
+    })
+
+    // Open external links in default browser
+    app.on("web-contents-created", (_, contents) => {
+        contents.setWindowOpenHandler(({ url }) => {
+            // Allow diagrams.net iframe
+            if (
+                url.includes("diagrams.net") ||
+                url.includes("draw.io") ||
+                url.startsWith("http://localhost")
+            ) {
+                return { action: "allow" }
+            }
+            // Open other links in external browser
+            if (url.startsWith("http://") || url.startsWith("https://")) {
+                shell.openExternal(url)
+                return { action: "deny" }
+            }
+            return { action: "allow" }
+        })
+    })
+}

electron/main/ipc-handlers.ts

@@ -0,0 +1,212 @@
+import { app, BrowserWindow, dialog, ipcMain } from "electron"
+import {
+    applyPresetToEnv,
+    type ConfigPreset,
+    createPreset,
+    deletePreset,
+    getAllPresets,
+    getCurrentPreset,
+    getCurrentPresetId,
+    setCurrentPreset,
+    updatePreset,
+} from "./config-manager"
+import { restartNextServer } from "./next-server"
+
+/**
+ * Allowed configuration keys for presets
+ * This whitelist prevents arbitrary environment variable injection
+ */
+const ALLOWED_CONFIG_KEYS = new Set([
+    "AI_PROVIDER",
+    "AI_MODEL",
+    "AI_API_KEY",
+    "AI_BASE_URL",
+    "TEMPERATURE",
+])
+
+/**
+ * Sanitize preset config to only include allowed keys
+ */
+function sanitizePresetConfig(
+    config: Record<string, string | undefined>,
+): Record<string, string | undefined> {
+    const sanitized: Record<string, string | undefined> = {}
+    for (const key of ALLOWED_CONFIG_KEYS) {
+        if (key in config && typeof config[key] === "string") {
+            sanitized[key] = config[key]
+        }
+    }
+    return sanitized
+}
+
+/**
+ * Register all IPC handlers
+ */
+export function registerIpcHandlers(): void {
+    // ==================== App Info ====================
+
+    ipcMain.handle("get-version", () => {
+        return app.getVersion()
+    })
+
+    // ==================== Window Controls ====================
+
+    ipcMain.on("window-minimize", (event) => {
+        const win = BrowserWindow.fromWebContents(event.sender)
+        win?.minimize()
+    })
+
+    ipcMain.on("window-maximize", (event) => {
+        const win = BrowserWindow.fromWebContents(event.sender)
+        if (win?.isMaximized()) {
+            win.unmaximize()
+        } else {
+            win?.maximize()
+        }
+    })
+
+    ipcMain.on("window-close", (event) => {
+        const win = BrowserWindow.fromWebContents(event.sender)
+        win?.close()
+    })
+
+    // ==================== File Dialogs ====================
+
+    ipcMain.handle("dialog-open-file", async (event) => {
+        const win = BrowserWindow.fromWebContents(event.sender)
+        if (!win) return null
+
+        const result = await dialog.showOpenDialog(win, {
+            properties: ["openFile"],
+            filters: [
+                { name: "Draw.io Files", extensions: ["drawio", "xml"] },
+                { name: "All Files", extensions: ["*"] },
+            ],
+        })
+
+        if (result.canceled || result.filePaths.length === 0) {
+            return null
+        }
+
+        // Read the file content
+        const fs = await import("node:fs/promises")
+        try {
+            const content = await fs.readFile(result.filePaths[0], "utf-8")
+            return content
+        } catch (error) {
+            console.error("Failed to read file:", error)
+            return null
+        }
+    })
+
+    ipcMain.handle("dialog-save-file", async (event, data: string) => {
+        const win = BrowserWindow.fromWebContents(event.sender)
+        if (!win) return false
+
+        const result = await dialog.showSaveDialog(win, {
+            filters: [
+                { name: "Draw.io Files", extensions: ["drawio"] },
+                { name: "XML Files", extensions: ["xml"] },
+            ],
+        })
+
+        if (result.canceled || !result.filePath) {
+            return false
+        }
+
+        const fs = await import("node:fs/promises")
+        try {
+            await fs.writeFile(result.filePath, data, "utf-8")
+            return true
+        } catch (error) {
+            console.error("Failed to save file:", error)
+            return false
+        }
+    })
+
+    // ==================== Config Presets ====================
+
+    ipcMain.handle("config-presets:get-all", () => {
+        return getAllPresets()
+    })
+
+    ipcMain.handle("config-presets:get-current", () => {
+        return getCurrentPreset()
+    })
+
+    ipcMain.handle("config-presets:get-current-id", () => {
+        return getCurrentPresetId()
+    })
+
+    ipcMain.handle(
+        "config-presets:save",
+        (
+            _event,
+            preset: Omit<ConfigPreset, "id" | "createdAt" | "updatedAt"> & {
+                id?: string
+            },
+        ) => {
+            // Validate preset name
+            if (typeof preset.name !== "string" || !preset.name.trim()) {
+                throw new Error("Invalid preset name")
+            }
+
+            // Sanitize config to only allow whitelisted keys
+            const sanitizedConfig = sanitizePresetConfig(preset.config ?? {})
+
+            if (preset.id) {
+                // Update existing preset
+                return updatePreset(preset.id, {
+                    name: preset.name.trim(),
+                    config: sanitizedConfig,
+                })
+            }
+            // Create new preset
+            return createPreset({
+                name: preset.name.trim(),
+                config: sanitizedConfig,
+            })
+        },
+    )
+
+    ipcMain.handle("config-presets:delete", (_event, id: string) => {
+        return deletePreset(id)
+    })
+
+    ipcMain.handle("config-presets:apply", async (_event, id: string) => {
+        const env = applyPresetToEnv(id)
+        if (!env) {
+            return { success: false, error: "Preset not found" }
+        }
+
+        const isDev = process.env.NODE_ENV === "development"
+
+        if (isDev) {
+            // In development mode, the config file change will trigger
+            // the file watcher in electron-dev.mjs to restart Next.js
+            // We just need to save the preset (already done in applyPresetToEnv)
+            return { success: true, env, devMode: true }
+        }
+
+        // Production mode: restart the Next.js server to apply new environment variables
+        try {
+            await restartNextServer()
+            return { success: true, env }
+        } catch (error) {
+            return {
+                success: false,
+                error:
+                    error instanceof Error
+                        ? error.message
+                        : "Failed to restart server",
+            }
+        }
+    })
+
+    ipcMain.handle(
+        "config-presets:set-current",
+        (_event, id: string | null) => {
+            return setCurrentPreset(id)
+        },
+    )
+}

electron/main/next-server.ts

@@ -0,0 +1,161 @@
+import { existsSync } from "node:fs"
+import path from "node:path"
+import { app, type UtilityProcess, utilityProcess } from "electron"
+import {
+    findAvailablePort,
+    getAllocatedPort,
+    getServerUrl,
+    isPortAvailable,
+} from "./port-manager"
+
+let serverProcess: UtilityProcess | null = null
+
+/**
+ * Get the path to the standalone server resources
+ * In packaged app: resources/standalone
+ * In development: .next/standalone
+ */
+function getResourcePath(): string {
+    if (app.isPackaged) {
+        return path.join(process.resourcesPath, "standalone")
+    }
+    return path.join(app.getAppPath(), ".next", "standalone")
+}
+
+/**
+ * Wait for the server to be ready by polling the health endpoint
+ */
+async function waitForServer(url: string, timeout = 30000): Promise<void> {
+    const start = Date.now()
+    while (Date.now() - start < timeout) {
+        try {
+            const response = await fetch(url)
+            if (response.ok || response.status < 500) {
+                return
+            }
+        } catch {
+            // Server not ready yet
+        }
+        await new Promise((resolve) => setTimeout(resolve, 100))
+    }
+    throw new Error(`Server startup timeout after ${timeout}ms`)
+}
+
+/**
+ * Start the Next.js standalone server using Electron's utilityProcess
+ * This API is designed for running Node.js code in the background
+ */
+export async function startNextServer(): Promise<string> {
+    const resourcePath = getResourcePath()
+    const serverPath = path.join(resourcePath, "server.js")
+
+    console.log(`Starting Next.js server from: ${resourcePath}`)
+    console.log(`Server script path: ${serverPath}`)
+
+    // Verify server script exists before attempting to start
+    if (!existsSync(serverPath)) {
+        throw new Error(
+            `Server script not found at ${serverPath}. ` +
+                "Please ensure the app was built correctly with 'npm run build'.",
+        )
+    }
+
+    // Find an available port (random in production, fixed in development)
+    const port = await findAvailablePort()
+    console.log(`Using port: ${port}`)
+
+    // Set up environment variables
+    const env: Record<string, string> = {
+        NODE_ENV: "production",
+        PORT: String(port),
+        HOSTNAME: "localhost",
+    }
+
+    // Set cache directory to a writable location (user's app data folder)
+    // This is necessary because the packaged app might be on a read-only volume
+    if (app.isPackaged) {
+        const cacheDir = path.join(app.getPath("userData"), "cache")
+        env.NEXT_CACHE_DIR = cacheDir
+    }
+
+    // Copy existing environment variables
+    for (const [key, value] of Object.entries(process.env)) {
+        if (value !== undefined && !env[key]) {
+            env[key] = value
+        }
+    }
+
+    // Use Electron's utilityProcess API for running Node.js in background
+    // This is the recommended way to run Node.js code in Electron
+    serverProcess = utilityProcess.fork(serverPath, [], {
+        cwd: resourcePath,
+        env,
+        stdio: "pipe",
+    })
+
+    serverProcess.stdout?.on("data", (data) => {
+        console.log(`[Next.js] ${data.toString().trim()}`)
+    })
+
+    serverProcess.stderr?.on("data", (data) => {
+        console.error(`[Next.js Error] ${data.toString().trim()}`)
+    })
+
+    serverProcess.on("exit", (code) => {
+        console.log(`Next.js server exited with code ${code}`)
+        serverProcess = null
+    })
+
+    const url = getServerUrl()
+    await waitForServer(url)
+    console.log(`Next.js server started at ${url}`)
+
+    return url
+}
+
+/**
+ * Stop the Next.js server process
+ */
+export function stopNextServer(): void {
+    if (serverProcess) {
+        console.log("Stopping Next.js server...")
+        serverProcess.kill()
+        serverProcess = null
+    }
+}
+
+/**
+ * Wait for the server to fully stop
+ */
+async function waitForServerStop(timeout = 5000): Promise<void> {
+    const port = getAllocatedPort()
+    if (port === null) {
+        return
+    }
+
+    const start = Date.now()
+    while (Date.now() - start < timeout) {
+        const available = await isPortAvailable(port)
+        if (available) {
+            return
+        }
+        await new Promise((resolve) => setTimeout(resolve, 100))
+    }
+    console.warn("Server stop timeout, port may still be in use")
+}
+
+/**
+ * Restart the Next.js server with new environment variables
+ */
+export async function restartNextServer(): Promise<string> {
+    console.log("Restarting Next.js server...")
+
+    // Stop the current server
+    stopNextServer()
+
+    // Wait for the port to be released
+    await waitForServerStop()
+
+    // Start the server again
+    return startNextServer()
+}

electron/main/port-manager.ts

@@ -0,0 +1,129 @@
+import net from "node:net"
+import { app } from "electron"
+
+/**
+ * Port configuration
+ */
+const PORT_CONFIG = {
+    // Development mode uses fixed port for hot reload compatibility
+    development: 6002,
+    // Production mode port range (will find first available)
+    production: {
+        min: 10000,
+        max: 65535,
+    },
+    // Maximum attempts to find an available port
+    maxAttempts: 100,
+}
+
+/**
+ * Currently allocated port (cached after first allocation)
+ */
+let allocatedPort: number | null = null
+
+/**
+ * Check if a specific port is available
+ */
+export function isPortAvailable(port: number): Promise<boolean> {
+    return new Promise((resolve) => {
+        const server = net.createServer()
+        server.once("error", () => resolve(false))
+        server.once("listening", () => {
+            server.close()
+            resolve(true)
+        })
+        server.listen(port, "127.0.0.1")
+    })
+}
+
+/**
+ * Generate a random port within the production range
+ */
+function getRandomPort(): number {
+    const { min, max } = PORT_CONFIG.production
+    return Math.floor(Math.random() * (max - min + 1)) + min
+}
+
+/**
+ * Find an available port
+ * - In development: uses fixed port (6002)
+ * - In production: finds a random available port
+ * - If a port was previously allocated, verifies it's still available
+ *
+ * @param reuseExisting If true, try to reuse the previously allocated port
+ * @returns Promise<number> The available port
+ * @throws Error if no available port found after max attempts
+ */
+export async function findAvailablePort(reuseExisting = true): Promise<number> {
+    const isDev = !app.isPackaged
+
+    // Try to reuse cached port if requested and available
+    if (reuseExisting && allocatedPort !== null) {
+        const available = await isPortAvailable(allocatedPort)
+        if (available) {
+            return allocatedPort
+        }
+        console.warn(
+            `Previously allocated port ${allocatedPort} is no longer available`,
+        )
+        allocatedPort = null
+    }
+
+    if (isDev) {
+        // Development mode: use fixed port
+        const port = PORT_CONFIG.development
+        const available = await isPortAvailable(port)
+        if (available) {
+            allocatedPort = port
+            return port
+        }
+        console.warn(
+            `Development port ${port} is in use, finding alternative...`,
+        )
+    }
+
+    // Production mode or dev port unavailable: find random available port
+    for (let attempt = 0; attempt < PORT_CONFIG.maxAttempts; attempt++) {
+        const port = isDev
+            ? PORT_CONFIG.development + attempt + 1
+            : getRandomPort()
+
+        const available = await isPortAvailable(port)
+        if (available) {
+            allocatedPort = port
+            console.log(`Allocated port: ${port}`)
+            return port
+        }
+    }
+
+    throw new Error(
+        `Failed to find available port after ${PORT_CONFIG.maxAttempts} attempts`,
+    )
+}
+
+/**
+ * Get the currently allocated port
+ * Returns null if no port has been allocated yet
+ */
+export function getAllocatedPort(): number | null {
+    return allocatedPort
+}
+
+/**
+ * Reset the allocated port (useful for testing or restart scenarios)
+ */
+export function resetAllocatedPort(): void {
+    allocatedPort = null
+}
+
+/**
+ * Get the server URL with the allocated port
+ */
+export function getServerUrl(): string {
+    if (allocatedPort === null) {
+        throw new Error(
+            "No port allocated yet. Call findAvailablePort() first.",
+        )
+    }
+    return `http://localhost:${allocatedPort}`
+}

electron/main/settings-window.ts

@@ -0,0 +1,78 @@
+import path from "node:path"
+import { app, BrowserWindow, ipcMain } from "electron"
+
+let settingsWindow: BrowserWindow | null = null
+
+/**
+ * Create and show the settings window
+ */
+export function showSettingsWindow(parentWindow?: BrowserWindow): void {
+    // If settings window already exists, focus it
+    if (settingsWindow && !settingsWindow.isDestroyed()) {
+        settingsWindow.focus()
+        return
+    }
+
+    // Determine path to settings preload script
+    // In compiled output: dist-electron/preload/settings.js
+    const preloadPath = path.join(__dirname, "..", "preload", "settings.js")
+
+    // Determine path to settings HTML
+    // In packaged app: app.asar/dist-electron/settings/index.html
+    // In development: electron/settings/index.html
+    const settingsHtmlPath = app.isPackaged
+        ? path.join(__dirname, "..", "settings", "index.html")
+        : path.join(__dirname, "..", "..", "electron", "settings", "index.html")
+
+    settingsWindow = new BrowserWindow({
+        width: 600,
+        height: 700,
+        minWidth: 500,
+        minHeight: 500,
+        parent: parentWindow,
+        modal: false,
+        show: false,
+        title: "Settings - Next AI Draw.io",
+        webPreferences: {
+            preload: preloadPath,
+            contextIsolation: true,
+            nodeIntegration: false,
+            sandbox: true,
+        },
+    })
+    settingsWindow.loadFile(settingsHtmlPath)
+
+    settingsWindow.once("ready-to-show", () => {
+        settingsWindow?.show()
+    })
+
+    settingsWindow.on("closed", () => {
+        settingsWindow = null
+    })
+}
+
+/**
+ * Close the settings window if it exists
+ */
+export function closeSettingsWindow(): void {
+    if (settingsWindow && !settingsWindow.isDestroyed()) {
+        settingsWindow.close()
+        settingsWindow = null
+    }
+}
+
+/**
+ * Check if settings window is open
+ */
+export function isSettingsWindowOpen(): boolean {
+    return settingsWindow !== null && !settingsWindow.isDestroyed()
+}
+
+/**
+ * Register settings window IPC handlers
+ */
+export function registerSettingsWindowHandlers(): void {
+    ipcMain.on("settings:close", () => {
+        closeSettingsWindow()
+    })
+}

electron/main/window-manager.ts

@@ -0,0 +1,84 @@
+import path from "node:path"
+import { app, BrowserWindow, screen } from "electron"
+
+let mainWindow: BrowserWindow | null = null
+
+/**
+ * Get the icon path based on platform
+ * Note: electron-builder converts icon.png during packaging,
+ * but at runtime we use PNG directly - Electron handles it
+ */
+function getIconPath(): string | undefined {
+    // macOS doesn't need explicit icon - it's embedded in the app bundle
+    if (process.platform === "darwin" && app.isPackaged) {
+        return undefined
+    }
+
+    const iconName = "icon.png"
+
+    if (app.isPackaged) {
+        return path.join(process.resourcesPath, iconName)
+    }
+
+    // Development: use icon.png from resources
+    return path.join(__dirname, "../../resources/icon.png")
+}
+
+/**
+ * Create the main application window
+ */
+export function createWindow(serverUrl: string): BrowserWindow {
+    const { width, height } = screen.getPrimaryDisplay().workAreaSize
+
+    mainWindow = new BrowserWindow({
+        width: Math.min(1400, Math.floor(width * 0.9)),
+        height: Math.min(900, Math.floor(height * 0.9)),
+        minWidth: 800,
+        minHeight: 600,
+        title: "Next AI Draw.io",
+        icon: getIconPath(),
+        show: false, // Don't show until ready
+        webPreferences: {
+            preload: path.join(__dirname, "../preload/index.js"),
+            contextIsolation: true,
+            nodeIntegration: false,
+            sandbox: true,
+            webSecurity: true,
+        },
+    })
+
+    // Load the Next.js application
+    mainWindow.loadURL(serverUrl)
+
+    // Show window when ready to prevent flashing
+    mainWindow.once("ready-to-show", () => {
+        mainWindow?.show()
+    })
+
+    // Open DevTools in development
+    if (process.env.NODE_ENV === "development") {
+        mainWindow.webContents.openDevTools()
+    }
+
+    mainWindow.on("closed", () => {
+        mainWindow = null
+    })
+
+    // Handle page title updates
+    mainWindow.webContents.on("page-title-updated", (event, title) => {
+        if (title && !title.includes("localhost")) {
+            mainWindow?.setTitle(title)
+        } else {
+            event.preventDefault()
+        }
+    })
+
+    return mainWindow
+}
+
+/**
+ * Get the main window instance
+ */
+export function getMainWindow(): BrowserWindow | null {
+    return mainWindow
+}

electron/preload/index.ts

@@ -0,0 +1,24 @@
+import { contextBridge, ipcRenderer } from "electron"
+
+/**
+ * Expose safe APIs to the renderer process
+ */
+contextBridge.exposeInMainWorld("electronAPI", {
+    // Platform information
+    platform: process.platform,
+
+    // Check if running in Electron
+    isElectron: true,
+
+    // Application version
+    getVersion: () => ipcRenderer.invoke("get-version"),
+
+    // Window controls (optional, for custom title bar)
+    minimize: () => ipcRenderer.send("window-minimize"),
+    maximize: () => ipcRenderer.send("window-maximize"),
+    close: () => ipcRenderer.send("window-close"),
+
+    // File operations
+    openFile: () => ipcRenderer.invoke("dialog-open-file"),
+    saveFile: (data: string) => ipcRenderer.invoke("dialog-save-file", data),
+})

electron/preload/settings.ts

@@ -0,0 +1,35 @@
+/**
+ * Preload script for settings window
+ * Exposes APIs for managing configuration presets
+ */
+import { contextBridge, ipcRenderer } from "electron"
+
+// Expose settings API to the renderer process
+contextBridge.exposeInMainWorld("settingsAPI", {
+    // Get all presets
+    getPresets: () => ipcRenderer.invoke("config-presets:get-all"),
+
+    // Get current preset ID
+    getCurrentPresetId: () =>
+        ipcRenderer.invoke("config-presets:get-current-id"),
+
+    // Get current preset
+    getCurrentPreset: () => ipcRenderer.invoke("config-presets:get-current"),
+
+    // Save (create or update) a preset
+    savePreset: (preset: {
+        id?: string
+        name: string
+        config: Record<string, string | undefined>
+    }) => ipcRenderer.invoke("config-presets:save", preset),
+
+    // Delete a preset
+    deletePreset: (id: string) =>
+        ipcRenderer.invoke("config-presets:delete", id),
+
+    // Apply a preset (sets environment variables and restarts server)
+    applyPreset: (id: string) => ipcRenderer.invoke("config-presets:apply", id),
+
+    // Close settings window
+    close: () => ipcRenderer.send("settings:close"),
+})

electron/settings/index.html

@@ -0,0 +1,110 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self';">
+    <title>Settings - Next AI Draw.io</title>
+    <link rel="stylesheet" href="./settings.css">
+</head>
+<body>
+    <div class="container">
+        <h1>Configuration Presets</h1>
+
+        <div class="section">
+            <h2>Presets</h2>
+            <div id="preset-list" class="preset-list">
+                <!-- Presets will be loaded here -->
+            </div>
+            <button id="add-preset-btn" class="btn btn-primary">
+                + Add New Preset
+            </button>
+        </div>
+    </div>
+
+    <!-- Add/Edit Preset Modal -->
+    <div id="preset-modal" class="modal-overlay">
+        <div class="modal">
+            <div class="modal-header">
+                <h3 id="modal-title">Add Preset</h3>
+            </div>
+            <div class="modal-body">
+                <form id="preset-form">
+                    <input type="hidden" id="preset-id">
+
+                    <div class="form-group">
+                        <label for="preset-name">Preset Name *</label>
+                        <input type="text" id="preset-name" required placeholder="e.g., Work, Personal, Testing">
+                    </div>
+
+                    <div class="form-group">
+                        <label for="ai-provider">AI Provider</label>
+                        <select id="ai-provider">
+                            <option value="">-- Select Provider --</option>
+                            <option value="openai">OpenAI</option>
+                            <option value="anthropic">Anthropic (Claude)</option>
+                            <option value="google">Google AI (Gemini)</option>
+                            <option value="azure">Azure OpenAI</option>
+                            <option value="bedrock">AWS Bedrock</option>
+                            <option value="openrouter">OpenRouter</option>
+                            <option value="deepseek">DeepSeek</option>
+                            <option value="siliconflow">SiliconFlow</option>
+                            <option value="ollama">Ollama (Local)</option>
+                        </select>
+                    </div>
+
+                    <div class="form-group">
+                        <label for="ai-model">Model ID</label>
+                        <input type="text" id="ai-model" placeholder="e.g., gpt-4o, claude-sonnet-4-5">
+                        <div class="hint">The model identifier to use with the selected provider</div>
+                    </div>
+
+                    <div class="form-group">
+                        <label for="ai-api-key">API Key</label>
+                        <input type="password" id="ai-api-key" placeholder="Your API key">
+                        <div class="hint">This will be stored locally on your device</div>
+                    </div>
+
+                    <div class="form-group">
+                        <label for="ai-base-url">Base URL (Optional)</label>
+                        <input type="text" id="ai-base-url" placeholder="https://api.example.com/v1">
+                        <div class="hint">Custom API endpoint URL</div>
+                    </div>
+
+                    <div class="form-group">
+                        <label for="temperature">Temperature (Optional)</label>
+                        <input type="text" id="temperature" placeholder="0.7">
+                        <div class="hint">Controls randomness (0.0 - 2.0)</div>
+                    </div>
+                </form>
+            </div>
+            <div class="modal-footer">
+                <button type="button" id="cancel-btn" class="btn btn-secondary">Cancel</button>
+                <button type="button" id="save-btn" class="btn btn-primary">Save</button>
+            </div>
+        </div>
+    </div>
+
+    <!-- Delete Confirmation Modal -->
+    <div id="delete-modal" class="modal-overlay">
+        <div class="modal">
+            <div class="modal-header">
+                <h3>Delete Preset</h3>
+            </div>
+            <div class="modal-body">
+                <p>Are you sure you want to delete "<span id="delete-preset-name"></span>"?</p>
+                <p class="delete-warning">This action cannot be undone.</p>
+            </div>
+            <div class="modal-footer">
+                <button type="button" id="delete-cancel-btn" class="btn btn-secondary">Cancel</button>
+                <button type="button" id="delete-confirm-btn" class="btn btn-danger">Delete</button>
+            </div>
+        </div>
+    </div>
+
+    <!-- Toast notification -->
+    <div id="toast" class="toast"></div>
+
+    <script src="./settings.js"></script>
+</body>
+</html>

electron/settings/settings.css

@@ -0,0 +1,311 @@
+:root {
+    --bg-primary: #ffffff;
+    --bg-secondary: #f5f5f5;
+    --bg-hover: #e8e8e8;
+    --text-primary: #1a1a1a;
+    --text-secondary: #666666;
+    --border-color: #e0e0e0;
+    --accent-color: #0066cc;
+    --accent-hover: #0052a3;
+    --danger-color: #dc3545;
+    --success-color: #28a745;
+}
+
+@media (prefers-color-scheme: dark) {
+    :root {
+        --bg-primary: #1a1a1a;
+        --bg-secondary: #2d2d2d;
+        --bg-hover: #3d3d3d;
+        --text-primary: #ffffff;
+        --text-secondary: #a0a0a0;
+        --border-color: #404040;
+        --accent-color: #4da6ff;
+        --accent-hover: #66b3ff;
+    }
+}
+
+* {
+    margin: 0;
+    padding: 0;
+    box-sizing: border-box;
+}
+
+body {
+    font-family:
+        -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen, Ubuntu,
+        sans-serif;
+    background-color: var(--bg-primary);
+    color: var(--text-primary);
+    line-height: 1.5;
+}
+
+.container {
+    max-width: 560px;
+    margin: 0 auto;
+    padding: 24px;
+}
+
+h1 {
+    font-size: 24px;
+    font-weight: 600;
+    margin-bottom: 24px;
+    padding-bottom: 16px;
+    border-bottom: 1px solid var(--border-color);
+}
+
+h2 {
+    font-size: 16px;
+    font-weight: 600;
+    margin-bottom: 16px;
+    color: var(--text-secondary);
+}
+
+.section {
+    margin-bottom: 32px;
+}
+
+.preset-list {
+    display: flex;
+    flex-direction: column;
+    gap: 12px;
+    margin-bottom: 16px;
+}
+
+.preset-card {
+    background: var(--bg-secondary);
+    border: 1px solid var(--border-color);
+    border-radius: 8px;
+    padding: 16px;
+    cursor: pointer;
+    transition: all 0.2s ease;
+}
+
+.preset-card:hover {
+    background: var(--bg-hover);
+}
+
+.preset-card.active {
+    border-color: var(--accent-color);
+    box-shadow: 0 0 0 1px var(--accent-color);
+}
+
+.preset-header {
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    margin-bottom: 8px;
+}
+
+.preset-name {
+    font-weight: 600;
+    font-size: 15px;
+}
+
+.preset-badge {
+    background: var(--accent-color);
+    color: white;
+    font-size: 11px;
+    padding: 2px 8px;
+    border-radius: 10px;
+}
+
+.preset-info {
+    font-size: 13px;
+    color: var(--text-secondary);
+}
+
+.preset-actions {
+    display: flex;
+    gap: 8px;
+    margin-top: 12px;
+}
+
+.btn {
+    padding: 8px 16px;
+    border: none;
+    border-radius: 6px;
+    font-size: 14px;
+    cursor: pointer;
+    transition: all 0.2s ease;
+    font-weight: 500;
+}
+
+.btn-primary {
+    background: var(--accent-color);
+    color: white;
+}
+
+.btn-primary:hover {
+    background: var(--accent-hover);
+}
+
+.btn-secondary {
+    background: var(--bg-secondary);
+    color: var(--text-primary);
+    border: 1px solid var(--border-color);
+}
+
+.btn-secondary:hover {
+    background: var(--bg-hover);
+}
+
+.btn-danger {
+    background: var(--danger-color);
+    color: white;
+}
+
+.btn-danger:hover {
+    opacity: 0.9;
+}
+
+.btn-sm {
+    padding: 6px 12px;
+    font-size: 13px;
+}
+
+.empty-state {
+    text-align: center;
+    padding: 40px 20px;
+    color: var(--text-secondary);
+}
+
+.empty-state p {
+    margin-bottom: 16px;
+}
+
+/* Modal */
+.modal-overlay {
+    display: none;
+    position: fixed;
+    top: 0;
+    left: 0;
+    right: 0;
+    bottom: 0;
+    background: rgba(0, 0, 0, 0.5);
+    z-index: 100;
+    align-items: center;
+    justify-content: center;
+}
+
+.modal-overlay.show {
+    display: flex;
+}
+
+.modal {
+    background: var(--bg-primary);
+    border-radius: 12px;
+    width: 90%;
+    max-width: 480px;
+    max-height: 90vh;
+    overflow-y: auto;
+    box-shadow: 0 4px 20px rgba(0, 0, 0, 0.2);
+}
+
+.modal-header {
+    padding: 20px 24px;
+    border-bottom: 1px solid var(--border-color);
+}
+
+.modal-header h3 {
+    font-size: 18px;
+    font-weight: 600;
+}
+
+.modal-body {
+    padding: 24px;
+}
+
+.modal-footer {
+    padding: 16px 24px;
+    border-top: 1px solid var(--border-color);
+    display: flex;
+    justify-content: flex-end;
+    gap: 12px;
+}
+
+.form-group {
+    margin-bottom: 20px;
+}
+
+.form-group label {
+    display: block;
+    font-size: 14px;
+    font-weight: 500;
+    margin-bottom: 6px;
+}
+
+.form-group input,
+.form-group select {
+    width: 100%;
+    padding: 10px 12px;
+    border: 1px solid var(--border-color);
+    border-radius: 6px;
+    font-size: 14px;
+    background: var(--bg-primary);
+    color: var(--text-primary);
+}
+
+.form-group input:focus,
+.form-group select:focus {
+    outline: none;
+    border-color: var(--accent-color);
+    box-shadow: 0 0 0 2px rgba(0, 102, 204, 0.2);
+}
+
+.form-group .hint {
+    font-size: 12px;
+    color: var(--text-secondary);
+    margin-top: 4px;
+}
+
+.loading {
+    display: inline-block;
+    width: 16px;
+    height: 16px;
+    border: 2px solid var(--border-color);
+    border-top-color: var(--accent-color);
+    border-radius: 50%;
+    animation: spin 0.8s linear infinite;
+}
+
+@keyframes spin {
+    to {
+        transform: rotate(360deg);
+    }
+}
+
+.toast {
+    position: fixed;
+    bottom: 24px;
+    left: 50%;
+    transform: translateX(-50%);
+    background: var(--text-primary);
+    color: var(--bg-primary);
+    padding: 12px 24px;
+    border-radius: 8px;
+    font-size: 14px;
+    z-index: 200;
+    opacity: 0;
+    transition: opacity 0.3s ease;
+}
+
+.toast.show {
+    opacity: 1;
+}
+
+.toast.success {
+    background: var(--success-color);
+    color: white;
+}
+
+.toast.error {
+    background: var(--danger-color);
+    color: white;
+}
+
+/* Inline style replacements */
+.delete-warning {
+    color: var(--text-secondary);
+    margin-top: 8px;
+    font-size: 14px;
+}

electron/settings/settings.js

@@ -0,0 +1,311 @@
+// Settings page JavaScript
+// This file handles the UI interactions for the settings window
+
+let presets = []
+let currentPresetId = null
+let editingPresetId = null
+let deletingPresetId = null
+
+// DOM Elements
+const presetList = document.getElementById("preset-list")
+const addPresetBtn = document.getElementById("add-preset-btn")
+const presetModal = document.getElementById("preset-modal")
+const deleteModal = document.getElementById("delete-modal")
+const presetForm = document.getElementById("preset-form")
+const modalTitle = document.getElementById("modal-title")
+const toast = document.getElementById("toast")
+
+// Form fields
+const presetIdField = document.getElementById("preset-id")
+const presetNameField = document.getElementById("preset-name")
+const aiProviderField = document.getElementById("ai-provider")
+const aiModelField = document.getElementById("ai-model")
+const aiApiKeyField = document.getElementById("ai-api-key")
+const aiBaseUrlField = document.getElementById("ai-base-url")
+const temperatureField = document.getElementById("temperature")
+
+// Buttons
+const cancelBtn = document.getElementById("cancel-btn")
+const saveBtn = document.getElementById("save-btn")
+const deleteCancelBtn = document.getElementById("delete-cancel-btn")
+const deleteConfirmBtn = document.getElementById("delete-confirm-btn")
+
+// Initialize
+document.addEventListener("DOMContentLoaded", async () => {
+    await loadPresets()
+    setupEventListeners()
+})
+
+// Load presets from main process
+async function loadPresets() {
+    try {
+        presets = await window.settingsAPI.getPresets()
+        currentPresetId = await window.settingsAPI.getCurrentPresetId()
+        renderPresets()
+    } catch (error) {
+        console.error("Failed to load presets:", error)
+        showToast("Failed to load presets", "error")
+    }
+}
+
+// Render presets list
+function renderPresets() {
+    if (presets.length === 0) {
+        presetList.innerHTML = `
+            <div class="empty-state">
+                <p>No presets configured yet.</p>
+                <p>Add a preset to quickly switch between different AI configurations.</p>
+            </div>
+        `
+        return
+    }
+
+    presetList.innerHTML = presets
+        .map((preset) => {
+            const isActive = preset.id === currentPresetId
+            const providerLabel = getProviderLabel(preset.config.AI_PROVIDER)
+
+            return `
+            <div class="preset-card ${isActive ? "active" : ""}" data-id="${preset.id}">
+                <div class="preset-header">
+                    <span class="preset-name">${escapeHtml(preset.name)}</span>
+                    ${isActive ? '<span class="preset-badge">Active</span>' : ""}
+                </div>
+                <div class="preset-info">
+                    ${providerLabel ? `Provider: ${providerLabel}` : "No provider configured"}
+                    ${preset.config.AI_MODEL ? ` • Model: ${escapeHtml(preset.config.AI_MODEL)}` : ""}
+                </div>
+                <div class="preset-actions">
+                    ${!isActive ? `<button class="btn btn-primary btn-sm apply-btn" data-id="${preset.id}">Apply</button>` : ""}
+                    <button class="btn btn-secondary btn-sm edit-btn" data-id="${preset.id}">Edit</button>
+                    <button class="btn btn-secondary btn-sm delete-btn" data-id="${preset.id}">Delete</button>
+                </div>
+            </div>
+        `
+        })
+        .join("")
+
+    // Add event listeners to buttons
+    presetList.querySelectorAll(".apply-btn").forEach((btn) => {
+        btn.addEventListener("click", (e) => {
+            e.stopPropagation()
+            applyPreset(btn.dataset.id)
+        })
+    })
+
+    presetList.querySelectorAll(".edit-btn").forEach((btn) => {
+        btn.addEventListener("click", (e) => {
+            e.stopPropagation()
+            openEditModal(btn.dataset.id)
+        })
+    })
+
+    presetList.querySelectorAll(".delete-btn").forEach((btn) => {
+        btn.addEventListener("click", (e) => {
+            e.stopPropagation()
+            openDeleteModal(btn.dataset.id)
+        })
+    })
+}
+
+// Setup event listeners
+function setupEventListeners() {
+    addPresetBtn.addEventListener("click", () => openAddModal())
+    cancelBtn.addEventListener("click", () => closeModal())
+    saveBtn.addEventListener("click", () => savePreset())
+    deleteCancelBtn.addEventListener("click", () => closeDeleteModal())
+    deleteConfirmBtn.addEventListener("click", () => confirmDelete())
+
+    // Close modal on overlay click
+    presetModal.addEventListener("click", (e) => {
+        if (e.target === presetModal) closeModal()
+    })
+    deleteModal.addEventListener("click", (e) => {
+        if (e.target === deleteModal) closeDeleteModal()
+    })
+
+    // Handle Enter key in form
+    presetForm.addEventListener("keydown", (e) => {
+        if (e.key === "Enter") {
+            e.preventDefault()
+            savePreset()
+        }
+    })
+}
+
+// Open add modal
+function openAddModal() {
+    editingPresetId = null
+    modalTitle.textContent = "Add Preset"
+    presetForm.reset()
+    presetIdField.value = ""
+    presetModal.classList.add("show")
+    presetNameField.focus()
+}
+
+// Open edit modal
+function openEditModal(id) {
+    const preset = presets.find((p) => p.id === id)
+    if (!preset) return
+
+    editingPresetId = id
+    modalTitle.textContent = "Edit Preset"
+
+    presetIdField.value = preset.id
+    presetNameField.value = preset.name
+    aiProviderField.value = preset.config.AI_PROVIDER || ""
+    aiModelField.value = preset.config.AI_MODEL || ""
+    aiApiKeyField.value = preset.config.AI_API_KEY || ""
+    aiBaseUrlField.value = preset.config.AI_BASE_URL || ""
+    temperatureField.value = preset.config.TEMPERATURE || ""
+
+    presetModal.classList.add("show")
+    presetNameField.focus()
+}
+
+// Close modal
+function closeModal() {
+    presetModal.classList.remove("show")
+    editingPresetId = null
+}
+
+// Open delete modal
+function openDeleteModal(id) {
+    const preset = presets.find((p) => p.id === id)
+    if (!preset) return
+
+    deletingPresetId = id
+    document.getElementById("delete-preset-name").textContent = preset.name
+    deleteModal.classList.add("show")
+}
+
+// Close delete modal
+function closeDeleteModal() {
+    deleteModal.classList.remove("show")
+    deletingPresetId = null
+}
+
+// Save preset
+async function savePreset() {
+    const name = presetNameField.value.trim()
+    if (!name) {
+        showToast("Please enter a preset name", "error")
+        presetNameField.focus()
+        return
+    }
+
+    const preset = {
+        id: editingPresetId || undefined,
+        name: name,
+        config: {
+            AI_PROVIDER: aiProviderField.value || undefined,
+            AI_MODEL: aiModelField.value.trim() || undefined,
+            AI_API_KEY: aiApiKeyField.value.trim() || undefined,
+            AI_BASE_URL: aiBaseUrlField.value.trim() || undefined,
+            TEMPERATURE: temperatureField.value.trim() || undefined,
+        },
+    }
+
+    // Remove undefined values
+    Object.keys(preset.config).forEach((key) => {
+        if (preset.config[key] === undefined) {
+            delete preset.config[key]
+        }
+    })
+
+    try {
+        saveBtn.disabled = true
+        saveBtn.innerHTML = '<span class="loading"></span>'
+
+        await window.settingsAPI.savePreset(preset)
+        await loadPresets()
+        closeModal()
+        showToast(
+            editingPresetId ? "Preset updated" : "Preset created",
+            "success",
+        )
+    } catch (error) {
+        console.error("Failed to save preset:", error)
+        showToast("Failed to save preset", "error")
+    } finally {
+        saveBtn.disabled = false
+        saveBtn.textContent = "Save"
+    }
+}
+
+// Confirm delete
+async function confirmDelete() {
+    if (!deletingPresetId) return
+
+    try {
+        deleteConfirmBtn.disabled = true
+        deleteConfirmBtn.innerHTML = '<span class="loading"></span>'
+
+        await window.settingsAPI.deletePreset(deletingPresetId)
+        await loadPresets()
+        closeDeleteModal()
+        showToast("Preset deleted", "success")
+    } catch (error) {
+        console.error("Failed to delete preset:", error)
+        showToast("Failed to delete preset", "error")
+    } finally {
+        deleteConfirmBtn.disabled = false
+        deleteConfirmBtn.textContent = "Delete"
+    }
+}
+
+// Apply preset
+async function applyPreset(id) {
+    try {
+        const btn = presetList.querySelector(`.apply-btn[data-id="${id}"]`)
+        if (btn) {
+            btn.disabled = true
+            btn.innerHTML = '<span class="loading"></span>'
+        }
+
+        const result = await window.settingsAPI.applyPreset(id)
+        if (result.success) {
+            currentPresetId = id
+            renderPresets()
+            showToast("Preset applied, server restarting...", "success")
+        } else {
+            showToast(result.error || "Failed to apply preset", "error")
+        }
+    } catch (error) {
+        console.error("Failed to apply preset:", error)
+        showToast("Failed to apply preset", "error")
+    }
+}
+
+// Get provider display label
+function getProviderLabel(provider) {
+    const labels = {
+        openai: "OpenAI",
+        anthropic: "Anthropic",
+        google: "Google AI",
+        azure: "Azure OpenAI",
+        bedrock: "AWS Bedrock",
+        openrouter: "OpenRouter",
+        deepseek: "DeepSeek",
+        siliconflow: "SiliconFlow",
+        ollama: "Ollama",
+    }
+    return labels[provider] || provider
+}
+
+// Show toast notification
+function showToast(message, type = "") {
+    toast.textContent = message
+    toast.className = "toast show" + (type ? ` ${type}` : "")
+
+    setTimeout(() => {
+        toast.classList.remove("show")
+    }, 3000)
+}
+
+// Escape HTML to prevent XSS
+function escapeHtml(text) {
+    const div = document.createElement("div")
+    div.textContent = text
+    return div.innerHTML
+}

electron/tsconfig.json

@@ -0,0 +1,18 @@
+{
+    "compilerOptions": {
+        "target": "ES2022",
+        "module": "CommonJS",
+        "moduleResolution": "node",
+        "lib": ["ES2022"],
+        "outDir": "../dist-electron",
+        "rootDir": ".",
+        "strict": true,
+        "esModuleInterop": true,
+        "skipLibCheck": true,
+        "resolveJsonModule": true,
+        "declaration": false,
+        "sourceMap": true
+    },
+    "include": ["./**/*.ts"],
+    "exclude": ["node_modules"]
+}

lib/utils.ts

@@ -1054,7 +1054,31 @@ export function autoFixXml(xml: string): { fixed: string; fixes: string[] } {
         fixes.push("Fixed <Cell> tags to <mxCell>")
     }
 
-    // 8b. Remove non-draw.io tags (LLM sometimes includes Claude's function calling XML)
+    // 8b. Fix common closing tag typos (MUST run before foreign tag removal)
+    const tagTypos = [
+        { wrong: /<\/mxElement>/gi, right: "</mxCell>", name: "</mxElement>" },
+        { wrong: /<\/mxcell>/g, right: "</mxCell>", name: "</mxcell>" }, // case sensitivity
+        {
+            wrong: /<\/mxgeometry>/g,
+            right: "</mxGeometry>",
+            name: "</mxgeometry>",
+        },
+        { wrong: /<\/mxpoint>/g, right: "</mxPoint>", name: "</mxpoint>" },
+        {
+            wrong: /<\/mxgraphmodel>/gi,
+            right: "</mxGraphModel>",
+            name: "</mxgraphmodel>",
+        },
+    ]
+    for (const { wrong, right, name } of tagTypos) {
+        const before = fixed
+        fixed = fixed.replace(wrong, right)
+        if (fixed !== before) {
+            fixes.push(`Fixed typo ${name} to ${right}`)
+        }
+    }
+
+    // 8c. Remove non-draw.io tags (after typo fixes so lowercase variants are fixed first)
     // Valid draw.io tags: mxfile, diagram, mxGraphModel, root, mxCell, mxGeometry, mxPoint, Array, Object
     const validDrawioTags = new Set([
         "mxfile",
@@ -1079,7 +1103,7 @@ export function autoFixXml(xml: string): { fixed: string; fixes: string[] } {
     }
     if (foreignTags.size > 0) {
         console.log(
-            "[autoFixXml] Step 8b: Found foreign tags:",
+            "[autoFixXml] Step 8c: Found foreign tags:",
             Array.from(foreignTags),
         )
         for (const tag of foreignTags) {
@@ -1093,29 +1117,6 @@ export function autoFixXml(xml: string): { fixed: string; fixes: string[] } {
         )
     }
 
-    // 9. Fix common closing tag typos
-    const tagTypos = [
-        { wrong: /<\/mxElement>/gi, right: "</mxCell>", name: "</mxElement>" },
-        { wrong: /<\/mxcell>/g, right: "</mxCell>", name: "</mxcell>" }, // case sensitivity
-        {
-            wrong: /<\/mxgeometry>/g,
-            right: "</mxGeometry>",
-            name: "</mxgeometry>",
-        },
-        { wrong: /<\/mxpoint>/g, right: "</mxPoint>", name: "</mxpoint>" },
-        {
-            wrong: /<\/mxgraphmodel>/gi,
-            right: "</mxGraphModel>",
-            name: "</mxgraphmodel>",
-        },
-    ]
-    for (const { wrong, right, name } of tagTypos) {
-        if (wrong.test(fixed)) {
-            fixed = fixed.replace(wrong, right)
-            fixes.push(`Fixed typo ${name} to ${right}`)
-        }
-    }
-
     // 10. Fix unclosed tags by appending missing closing tags
     // Use parseXmlTags helper to track open tags
     const tagStack: string[] = []

next.config.ts

@@ -1,8 +1,12 @@
 import type { NextConfig } from "next"
+import packageJson from "./package.json"
 
 const nextConfig: NextConfig = {
     /* config options here */
     output: "standalone",
+    env: {
+        APP_VERSION: packageJson.version,
+    },
 }
 
 export default nextConfig

package.json

@@ -1,8 +1,9 @@
 {
     "name": "next-ai-draw-io",
-    "version": "0.4.3",
+    "version": "0.4.5",
     "license": "Apache-2.0",
     "private": true,
+    "main": "dist-electron/main/index.js",
     "scripts": {
         "dev": "next dev --turbopack --port 6002",
         "build": "next build",
@@ -10,7 +11,17 @@
         "lint": "biome lint .",
         "format": "biome check --write .",
         "check": "biome ci",
-        "prepare": "husky"
+        "prepare": "husky",
+        "electron:dev": "node scripts/electron-dev.mjs",
+        "electron:build": "npm run build && npm run electron:compile",
+        "electron:compile": "npx esbuild electron/main/index.ts electron/preload/index.ts electron/preload/settings.ts --bundle --platform=node --outdir=dist-electron --external:electron --sourcemap --packages=external && npx shx cp -r electron/settings dist-electron/",
+        "electron:start": "npx cross-env NODE_ENV=development npx electron .",
+        "electron:prepare": "node scripts/prepare-electron-build.mjs",
+        "dist": "npm run electron:build && npm run electron:prepare && npx electron-builder",
+        "dist:mac": "npm run electron:build && npm run electron:prepare && npx electron-builder --mac",
+        "dist:win": "npm run electron:build && npm run electron:prepare && npx electron-builder --win",
+        "dist:linux": "npm run electron:build && npm run electron:prepare && npx electron-builder --linux",
+        "dist:all": "npm run electron:build && npm run electron:prepare && npx electron-builder --mac --win --linux"
     },
     "dependencies": {
         "@ai-sdk/amazon-bedrock": "^3.0.70",
@@ -76,7 +87,7 @@
     },
     "devDependencies": {
         "@anthropic-ai/tokenizer": "^0.0.4",
-        "@biomejs/biome": "^2.3.8",
+        "@biomejs/biome": "^2.3.10",
         "@tailwindcss/postcss": "^4",
         "@tailwindcss/typography": "^0.5.19",
         "@types/negotiator": "^0.6.4",
@@ -84,11 +95,18 @@
         "@types/pako": "^2.0.3",
         "@types/react": "^19",
         "@types/react-dom": "^19",
+        "concurrently": "^9.2.1",
+        "cross-env": "^10.1.0",
+        "electron": "^39.2.7",
+        "electron-builder": "^26.0.12",
+        "esbuild": "^0.27.2",
         "eslint": "9.39.1",
         "eslint-config-next": "16.0.5",
         "husky": "^9.1.7",
         "lint-staged": "^16.2.7",
+        "shx": "^0.4.0",
         "tailwindcss": "^4",
-        "typescript": "^5"
+        "typescript": "^5",
+        "wait-on": "^9.0.3"
     }
 }

packages/mcp-server/README.md

@@ -86,6 +86,7 @@ Use the standard MCP configuration with:
 ## Features
 
 - **Real-time Preview**: Diagrams appear and update in your browser as the AI creates them
+- **Version History**: Restore previous diagram versions with visual thumbnails - click the clock button (bottom-right) to browse and restore earlier states
 - **Natural Language**: Describe diagrams in plain text - flowcharts, architecture diagrams, etc.
 - **Edit Support**: Modify existing diagrams with natural language instructions
 - **Export**: Save diagrams as `.drawio` files

packages/mcp-server/package-lock.json

@@ -1,12 +1,12 @@
 {
     "name": "@next-ai-drawio/mcp-server",
-    "version": "0.1.0",
+    "version": "0.1.5",
     "lockfileVersion": 3,
     "requires": true,
     "packages": {
         "": {
             "name": "@next-ai-drawio/mcp-server",
-            "version": "0.1.0",
+            "version": "0.1.5",
             "license": "Apache-2.0",
             "dependencies": {
                 "@modelcontextprotocol/sdk": "^1.0.4",

packages/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@next-ai-drawio/mcp-server",
-    "version": "0.1.2",
+    "version": "0.1.5",
     "description": "MCP server for Next AI Draw.io - AI-powered diagram generation with real-time browser preview",
     "type": "module",
     "main": "dist/index.js",

packages/mcp-server/src/history.ts

@@ -0,0 +1,62 @@
+/**
+ * Simple diagram history - matches Next.js app pattern
+ * Stores {xml, svg} entries in a circular buffer
+ */
+
+import { log } from "./logger.js"
+
+const MAX_HISTORY = 20
+const historyStore = new Map<string, Array<{ xml: string; svg: string }>>()
+
+export function addHistory(sessionId: string, xml: string, svg = ""): number {
+    let history = historyStore.get(sessionId)
+    if (!history) {
+        history = []
+        historyStore.set(sessionId, history)
+    }
+
+    // Dedupe: skip if same as last entry
+    const last = history[history.length - 1]
+    if (last?.xml === xml) {
+        return history.length - 1
+    }
+
+    history.push({ xml, svg })
+
+    // Circular buffer
+    if (history.length > MAX_HISTORY) {
+        history.shift()
+    }
+
+    log.debug(`History: session=${sessionId}, entries=${history.length}`)
+    return history.length - 1
+}
+
+export function getHistory(
+    sessionId: string,
+): Array<{ xml: string; svg: string }> {
+    return historyStore.get(sessionId) || []
+}
+
+export function getHistoryEntry(
+    sessionId: string,
+    index: number,
+): { xml: string; svg: string } | undefined {
+    const history = historyStore.get(sessionId)
+    return history?.[index]
+}
+
+export function clearHistory(sessionId: string): void {
+    historyStore.delete(sessionId)
+}
+
+export function updateLastHistorySvg(sessionId: string, svg: string): boolean {
+    const history = historyStore.get(sessionId)
+    if (!history || history.length === 0) return false
+    const last = history[history.length - 1]
+    if (!last.svg) {
+        last.svg = svg
+        return true
+    }
+    return false
+}

packages/mcp-server/src/http-server.ts

@@ -1,55 +1,77 @@
 /**
  * Embedded HTTP Server for MCP
- *
- * Serves a static HTML page with draw.io embed and handles state sync.
- * This eliminates the need for an external Next.js app.
+ * Serves draw.io embed with state sync and history UI
  */
 
 import http from "node:http"
+import {
+    addHistory,
+    clearHistory,
+    getHistory,
+    getHistoryEntry,
+    updateLastHistorySvg,
+} from "./history.js"
 import { log } from "./logger.js"
 
 interface SessionState {
     xml: string
     version: number
     lastUpdated: Date
+    svg?: string // Cached SVG from last browser save
+    syncRequested?: number // Timestamp when sync requested, cleared when browser responds
 }
 
-// In-memory state store (shared with MCP server in same process)
 export const stateStore = new Map<string, SessionState>()
 
 let server: http.Server | null = null
-let serverPort: number = 6002
-const MAX_PORT = 6020 // Don't retry beyond this port
-const SESSION_TTL = 60 * 60 * 1000 // 1 hour
+let serverPort = 6002
+const MAX_PORT = 6020
+const SESSION_TTL = 60 * 60 * 1000
 
-/**
- * Get state for a session
- */
 export function getState(sessionId: string): SessionState | undefined {
     return stateStore.get(sessionId)
 }
 
-/**
- * Set state for a session
- */
-export function setState(sessionId: string, xml: string): number {
+export function setState(sessionId: string, xml: string, svg?: string): number {
     const existing = stateStore.get(sessionId)
     const newVersion = (existing?.version || 0) + 1
-
     stateStore.set(sessionId, {
         xml,
         version: newVersion,
         lastUpdated: new Date(),
+        svg: svg || existing?.svg, // Preserve cached SVG if not provided
+        syncRequested: undefined, // Clear sync request when browser pushes state
     })
-
     log.debug(`State updated: session=${sessionId}, version=${newVersion}`)
     return newVersion
 }
 
-/**
- * Start the embedded HTTP server
- */
-export function startHttpServer(port: number = 6002): Promise<number> {
+export function requestSync(sessionId: string): boolean {
+    const state = stateStore.get(sessionId)
+    if (state) {
+        state.syncRequested = Date.now()
+        log.debug(`Sync requested for session=${sessionId}`)
+        return true
+    }
+    log.debug(`Sync requested for non-existent session=${sessionId}`)
+    return false
+}
+
+export async function waitForSync(
+    sessionId: string,
+    timeoutMs = 3000,
+): Promise<boolean> {
+    const start = Date.now()
+    while (Date.now() - start < timeoutMs) {
+        const state = stateStore.get(sessionId)
+        if (!state?.syncRequested) return true // Sync completed
+        await new Promise((r) => setTimeout(r, 100))
+    }
+    log.warn(`Sync timeout for session=${sessionId}`)
+    return false // Timeout
+}
+
+export function startHttpServer(port = 6002): Promise<number> {
     return new Promise((resolve, reject) => {
         if (server) {
             resolve(serverPort)
@@ -81,15 +103,12 @@ export function startHttpServer(port: number = 6002): Promise<number> {
 
         server.listen(port, () => {
             serverPort = port
-            log.info(`Embedded HTTP server running on http://localhost:${port}`)
+            log.info(`HTTP server running on http://localhost:${port}`)
             resolve(port)
         })
     })
 }
 
-/**
- * Stop the HTTP server
- */
 export function stopHttpServer(): void {
     if (server) {
         server.close()
@@ -97,39 +116,29 @@ export function stopHttpServer(): void {
     }
 }
 
-/**
- * Clean up expired sessions
- */
 function cleanupExpiredSessions(): void {
     const now = Date.now()
     for (const [sessionId, state] of stateStore) {
         if (now - state.lastUpdated.getTime() > SESSION_TTL) {
             stateStore.delete(sessionId)
+            clearHistory(sessionId)
             log.info(`Cleaned up expired session: ${sessionId}`)
         }
     }
 }
 
-// Run cleanup every 5 minutes
 setInterval(cleanupExpiredSessions, 5 * 60 * 1000)
 
-/**
- * Get the current server port
- */
 export function getServerPort(): number {
     return serverPort
 }
 
-/**
- * Handle HTTP requests
- */
 function handleRequest(
     req: http.IncomingMessage,
     res: http.ServerResponse,
 ): void {
     const url = new URL(req.url || "/", `http://localhost:${serverPort}`)
 
-    // CORS headers for local development
     res.setHeader("Access-Control-Allow-Origin", "*")
     res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
     res.setHeader("Access-Control-Allow-Headers", "Content-Type")
@@ -140,43 +149,23 @@ function handleRequest(
         return
     }
 
-    // Route handling
     if (url.pathname === "/" || url.pathname === "/index.html") {
-        serveHtml(req, res, url)
-    } else if (
-        url.pathname === "/api/state" ||
-        url.pathname === "/api/mcp/state"
-    ) {
+        res.writeHead(200, { "Content-Type": "text/html" })
+        res.end(getHtmlPage(url.searchParams.get("mcp") || ""))
+    } else if (url.pathname === "/api/state") {
         handleStateApi(req, res, url)
-    } else if (
-        url.pathname === "/api/health" ||
-        url.pathname === "/api/mcp/health"
-    ) {
-        res.writeHead(200, { "Content-Type": "application/json" })
-        res.end(JSON.stringify({ status: "ok", mcp: true }))
+    } else if (url.pathname === "/api/history") {
+        handleHistoryApi(req, res, url)
+    } else if (url.pathname === "/api/restore") {
+        handleRestoreApi(req, res)
+    } else if (url.pathname === "/api/history-svg") {
+        handleHistorySvgApi(req, res)
     } else {
         res.writeHead(404)
         res.end("Not Found")
     }
 }
 
-/**
- * Serve the HTML page with draw.io embed
- */
-function serveHtml(
-    req: http.IncomingMessage,
-    res: http.ServerResponse,
-    url: URL,
-): void {
-    const sessionId = url.searchParams.get("mcp") || ""
-
-    res.writeHead(200, { "Content-Type": "text/html" })
-    res.end(getHtmlPage(sessionId))
-}
-
-/**
- * Handle state API requests
- */
 function handleStateApi(
     req: http.IncomingMessage,
     res: http.ServerResponse,
@@ -189,14 +178,13 @@ function handleStateApi(
             res.end(JSON.stringify({ error: "sessionId required" }))
             return
         }
-
         const state = stateStore.get(sessionId)
         res.writeHead(200, { "Content-Type": "application/json" })
         res.end(
             JSON.stringify({
                 xml: state?.xml || null,
                 version: state?.version || 0,
-                lastUpdated: state?.lastUpdated?.toISOString() || null,
+                syncRequested: !!state?.syncRequested,
             }),
         )
     } else if (req.method === "POST") {
@@ -206,14 +194,13 @@ function handleStateApi(
         })
         req.on("end", () => {
             try {
-                const { sessionId, xml } = JSON.parse(body)
+                const { sessionId, xml, svg } = JSON.parse(body)
                 if (!sessionId) {
                     res.writeHead(400, { "Content-Type": "application/json" })
                     res.end(JSON.stringify({ error: "sessionId required" }))
                     return
                 }
-
-                const version = setState(sessionId, xml)
+                const version = setState(sessionId, xml, svg)
                 res.writeHead(200, { "Content-Type": "application/json" })
                 res.end(JSON.stringify({ success: true, version }))
             } catch {
@@ -227,35 +214,179 @@ function handleStateApi(
     }
 }
 
-/**
- * Generate the HTML page with draw.io embed
- */
+function handleHistoryApi(
+    req: http.IncomingMessage,
+    res: http.ServerResponse,
+    url: URL,
+): void {
+    if (req.method !== "GET") {
+        res.writeHead(405)
+        res.end("Method Not Allowed")
+        return
+    }
+
+    const sessionId = url.searchParams.get("sessionId")
+    if (!sessionId) {
+        res.writeHead(400, { "Content-Type": "application/json" })
+        res.end(JSON.stringify({ error: "sessionId required" }))
+        return
+    }
+
+    const history = getHistory(sessionId)
+    res.writeHead(200, { "Content-Type": "application/json" })
+    res.end(
+        JSON.stringify({
+            entries: history.map((entry, i) => ({ index: i, svg: entry.svg })),
+            count: history.length,
+        }),
+    )
+}
+
+function handleRestoreApi(
+    req: http.IncomingMessage,
+    res: http.ServerResponse,
+): void {
+    if (req.method !== "POST") {
+        res.writeHead(405)
+        res.end("Method Not Allowed")
+        return
+    }
+
+    let body = ""
+    req.on("data", (chunk) => {
+        body += chunk
+    })
+    req.on("end", () => {
+        try {
+            const { sessionId, index } = JSON.parse(body)
+            if (!sessionId || index === undefined) {
+                res.writeHead(400, { "Content-Type": "application/json" })
+                res.end(
+                    JSON.stringify({ error: "sessionId and index required" }),
+                )
+                return
+            }
+
+            const entry = getHistoryEntry(sessionId, index)
+            if (!entry) {
+                res.writeHead(404, { "Content-Type": "application/json" })
+                res.end(JSON.stringify({ error: "Entry not found" }))
+                return
+            }
+
+            const newVersion = setState(sessionId, entry.xml)
+            addHistory(sessionId, entry.xml, entry.svg)
+
+            log.info(`Restored session ${sessionId} to index ${index}`)
+
+            res.writeHead(200, { "Content-Type": "application/json" })
+            res.end(JSON.stringify({ success: true, newVersion }))
+        } catch {
+            res.writeHead(400, { "Content-Type": "application/json" })
+            res.end(JSON.stringify({ error: "Invalid JSON" }))
+        }
+    })
+}
+
+function handleHistorySvgApi(
+    req: http.IncomingMessage,
+    res: http.ServerResponse,
+): void {
+    if (req.method !== "POST") {
+        res.writeHead(405)
+        res.end("Method Not Allowed")
+        return
+    }
+
+    let body = ""
+    req.on("data", (chunk) => {
+        body += chunk
+    })
+    req.on("end", () => {
+        try {
+            const { sessionId, svg } = JSON.parse(body)
+            if (!sessionId || !svg) {
+                res.writeHead(400, { "Content-Type": "application/json" })
+                res.end(JSON.stringify({ error: "sessionId and svg required" }))
+                return
+            }
+
+            updateLastHistorySvg(sessionId, svg)
+            res.writeHead(200, { "Content-Type": "application/json" })
+            res.end(JSON.stringify({ success: true }))
+        } catch {
+            res.writeHead(400, { "Content-Type": "application/json" })
+            res.end(JSON.stringify({ error: "Invalid JSON" }))
+        }
+    })
+}
+
 function getHtmlPage(sessionId: string): string {
     return `<!DOCTYPE html>
 <html lang="en">
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Draw.io MCP - ${sessionId || "No Session"}</title>
+    <title>Draw.io MCP</title>
     <style>
         * { margin: 0; padding: 0; box-sizing: border-box; }
         html, body { width: 100%; height: 100%; overflow: hidden; }
         #container { width: 100%; height: 100%; display: flex; flex-direction: column; }
         #header {
-            padding: 8px 16px;
-            background: #1a1a2e;
-            color: #eee;
-            font-family: system-ui, sans-serif;
-            font-size: 14px;
-            display: flex;
-            justify-content: space-between;
-            align-items: center;
+            padding: 8px 16px; background: #1a1a2e; color: #eee;
+            font-family: system-ui, sans-serif; font-size: 14px;
+            display: flex; justify-content: space-between; align-items: center;
         }
         #header .session { color: #888; font-size: 12px; }
         #header .status { font-size: 12px; }
         #header .status.connected { color: #4ade80; }
         #header .status.disconnected { color: #f87171; }
         #drawio { flex: 1; border: none; }
+        #history-btn {
+            position: fixed; bottom: 24px; right: 24px;
+            width: 48px; height: 48px; border-radius: 50%;
+            background: #3b82f6; color: white; border: none; cursor: pointer;
+            box-shadow: 0 4px 12px rgba(0,0,0,0.3);
+            display: flex; align-items: center; justify-content: center;
+            z-index: 1000;
+        }
+        #history-btn:hover { background: #2563eb; }
+        #history-btn:disabled { background: #6b7280; cursor: not-allowed; }
+        #history-btn svg { width: 24px; height: 24px; }
+        #history-modal {
+            display: none; position: fixed; inset: 0;
+            background: rgba(0,0,0,0.5); z-index: 2000;
+            align-items: center; justify-content: center;
+        }
+        #history-modal.open { display: flex; }
+        .modal-content {
+            background: white; border-radius: 12px;
+            width: 90%; max-width: 500px; max-height: 70vh;
+            display: flex; flex-direction: column;
+        }
+        .modal-header { padding: 16px; border-bottom: 1px solid #e5e7eb; }
+        .modal-header h2 { font-size: 18px; margin: 0; }
+        .modal-body { flex: 1; overflow-y: auto; padding: 16px; }
+        .modal-footer { padding: 12px 16px; border-top: 1px solid #e5e7eb; display: flex; gap: 8px; justify-content: flex-end; }
+        .history-grid { display: grid; grid-template-columns: repeat(3, 1fr); gap: 8px; }
+        .history-item {
+            border: 2px solid #e5e7eb; border-radius: 8px; padding: 8px;
+            cursor: pointer; text-align: center;
+        }
+        .history-item:hover { border-color: #3b82f6; }
+        .history-item.selected { border-color: #3b82f6; box-shadow: 0 0 0 3px rgba(59,130,246,0.3); }
+        .history-item .thumb {
+            aspect-ratio: 4/3; background: #f3f4f6; border-radius: 4px;
+            display: flex; align-items: center; justify-content: center;
+            margin-bottom: 4px; overflow: hidden;
+        }
+        .history-item .thumb img { max-width: 100%; max-height: 100%; object-fit: contain; }
+        .history-item .label { font-size: 12px; color: #666; }
+        .btn { padding: 8px 16px; border-radius: 6px; font-size: 14px; cursor: pointer; border: none; }
+        .btn-primary { background: #3b82f6; color: white; }
+        .btn-primary:disabled { background: #93c5fd; cursor: not-allowed; }
+        .btn-secondary { background: #f3f4f6; color: #374151; }
+        .empty { text-align: center; padding: 40px; color: #666; }
     </style>
 </head>
 <body>
@@ -263,121 +394,191 @@ function getHtmlPage(sessionId: string): string {
         <div id="header">
             <div>
                 <strong>Draw.io MCP</strong>
-                <span class="session">${sessionId ? `Session: ${sessionId}` : "No MCP session"}</span>
+                <span class="session">${sessionId ? `Session: ${sessionId}` : "No session"}</span>
             </div>
             <div id="status" class="status disconnected">Connecting...</div>
         </div>
         <iframe id="drawio" src="https://embed.diagrams.net/?embed=1&proto=json&spin=1&libraries=1"></iframe>
     </div>
-
+    <button id="history-btn" title="History" ${sessionId ? "" : "disabled"}>
+        <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+            <circle cx="12" cy="12" r="10"></circle>
+            <polyline points="12 6 12 12 16 14"></polyline>
+        </svg>
+    </button>
+    <div id="history-modal">
+        <div class="modal-content">
+            <div class="modal-header"><h2>History</h2></div>
+            <div class="modal-body">
+                <div id="history-grid" class="history-grid"></div>
+                <div id="history-empty" class="empty" style="display:none;">No history yet</div>
+            </div>
+            <div class="modal-footer">
+                <button class="btn btn-secondary" id="cancel-btn">Cancel</button>
+                <button class="btn btn-primary" id="restore-btn" disabled>Restore</button>
+            </div>
+        </div>
+    </div>
     <script>
         const sessionId = "${sessionId}";
         const iframe = document.getElementById('drawio');
         const statusEl = document.getElementById('status');
+        let currentVersion = 0, isReady = false, pendingXml = null, lastXml = null;
+        let pendingSvgExport = null;
+        let pendingAiSvg = false;
 
-        let currentVersion = 0;
-        let isDrawioReady = false;
-        let pendingXml = null;
-        let lastLoadedXml = null;
-
-        // Listen for messages from draw.io
-        window.addEventListener('message', (event) => {
-            if (event.origin !== 'https://embed.diagrams.net') return;
-
+        window.addEventListener('message', (e) => {
+            if (e.origin !== 'https://embed.diagrams.net') return;
             try {
-                const msg = JSON.parse(event.data);
-                handleDrawioMessage(msg);
-            } catch (e) {
-                // Ignore non-JSON messages
-            }
+                const msg = JSON.parse(e.data);
+                if (msg.event === 'init') {
+                    isReady = true;
+                    statusEl.textContent = 'Ready';
+                    statusEl.className = 'status connected';
+                    if (pendingXml) { loadDiagram(pendingXml); pendingXml = null; }
+                } else if ((msg.event === 'save' || msg.event === 'autosave') && msg.xml && msg.xml !== lastXml) {
+                    // Request SVG export, then push state with SVG
+                    pendingSvgExport = msg.xml;
+                    iframe.contentWindow.postMessage(JSON.stringify({ action: 'export', format: 'svg' }), '*');
+                    // Fallback if export doesn't respond
+                    setTimeout(() => { if (pendingSvgExport === msg.xml) { pushState(msg.xml, ''); pendingSvgExport = null; } }, 2000);
+                } else if (msg.event === 'export' && msg.data) {
+                    // Handle sync export (XML format) - server requested fresh state
+                    if (pendingSyncExport && !msg.data.startsWith('data:') && !msg.data.startsWith('<svg')) {
+                        pendingSyncExport = false;
+                        pushState(msg.data, '');
+                        return;
+                    }
+                    // Handle SVG export
+                    let svg = msg.data;
+                    if (!svg.startsWith('data:')) svg = 'data:image/svg+xml;base64,' + btoa(unescape(encodeURIComponent(svg)));
+                    if (pendingSvgExport) {
+                        const xml = pendingSvgExport;
+                        pendingSvgExport = null;
+                        pushState(xml, svg);
+                    } else if (pendingAiSvg) {
+                        pendingAiSvg = false;
+                        fetch('/api/history-svg', {
+                            method: 'POST',
+                            headers: { 'Content-Type': 'application/json' },
+                            body: JSON.stringify({ sessionId, svg })
+                        }).catch(() => {});
+                    }
+                }
+            } catch {}
         });
 
-        function handleDrawioMessage(msg) {
-            if (msg.event === 'init') {
-                isDrawioReady = true;
-                statusEl.textContent = 'Ready';
-                statusEl.className = 'status connected';
-
-                // Load pending XML if any
-                if (pendingXml) {
-                    loadDiagram(pendingXml);
-                    pendingXml = null;
-                }
-            } else if (msg.event === 'save') {
-                // User saved - push to state
-                if (msg.xml && msg.xml !== lastLoadedXml) {
-                    pushState(msg.xml);
-                }
-            } else if (msg.event === 'export') {
-                // Export completed
-                if (msg.data) {
-                    pushState(msg.data);
-                }
-            } else if (msg.event === 'autosave') {
-                // Autosave - push to state
-                if (msg.xml && msg.xml !== lastLoadedXml) {
-                    pushState(msg.xml);
-                }
+        function loadDiagram(xml, capturePreview = false) {
+            if (!isReady) { pendingXml = xml; return; }
+            lastXml = xml;
+            iframe.contentWindow.postMessage(JSON.stringify({ action: 'load', xml, autosave: 1 }), '*');
+            if (capturePreview) {
+                setTimeout(() => {
+                    pendingAiSvg = true;
+                    iframe.contentWindow.postMessage(JSON.stringify({ action: 'export', format: 'svg' }), '*');
+                }, 500);
             }
         }
 
-        function loadDiagram(xml) {
-            if (!isDrawioReady) {
-                pendingXml = xml;
-                return;
-            }
-
-            lastLoadedXml = xml;
-            iframe.contentWindow.postMessage(JSON.stringify({
-                action: 'load',
-                xml: xml,
-                autosave: 1
-            }), '*');
-        }
-
-        async function pushState(xml) {
+        async function pushState(xml, svg = '') {
             if (!sessionId) return;
-
             try {
-                const response = await fetch('/api/state', {
+                const r = await fetch('/api/state', {
                     method: 'POST',
                     headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({ sessionId, xml })
+                    body: JSON.stringify({ sessionId, xml, svg })
                 });
-
-                if (response.ok) {
-                    const result = await response.json();
-                    currentVersion = result.version;
-                    lastLoadedXml = xml;
-                }
-            } catch (e) {
-                console.error('Failed to push state:', e);
-            }
+                if (r.ok) { const d = await r.json(); currentVersion = d.version; lastXml = xml; }
+            } catch (e) { console.error('Push failed:', e); }
         }
 
-        async function pollState() {
+        let pendingSyncExport = false;
+
+        async function poll() {
             if (!sessionId) return;
-
             try {
-                const response = await fetch('/api/state?sessionId=' + encodeURIComponent(sessionId));
-                if (!response.ok) return;
-
-                const state = await response.json();
-
-                if (state.version && state.version > currentVersion && state.xml) {
-                    currentVersion = state.version;
-                    loadDiagram(state.xml);
+                const r = await fetch('/api/state?sessionId=' + encodeURIComponent(sessionId));
+                if (!r.ok) return;
+                const s = await r.json();
+                // Handle sync request - server needs fresh state
+                if (s.syncRequested && !pendingSyncExport) {
+                    pendingSyncExport = true;
+                    iframe.contentWindow.postMessage(JSON.stringify({ action: 'export', format: 'xml' }), '*');
                 }
-            } catch (e) {
-                console.error('Failed to poll state:', e);
-            }
+                // Load new diagram from server
+                if (s.version > currentVersion && s.xml) {
+                    currentVersion = s.version;
+                    loadDiagram(s.xml, true);
+                }
+            } catch {}
         }
 
-        // Start polling if we have a session
-        if (sessionId) {
-            pollState();
-            setInterval(pollState, 2000);
+        if (sessionId) { poll(); setInterval(poll, 2000); }
+
+        // History UI
+        const historyBtn = document.getElementById('history-btn');
+        const historyModal = document.getElementById('history-modal');
+        const historyGrid = document.getElementById('history-grid');
+        const historyEmpty = document.getElementById('history-empty');
+        const restoreBtn = document.getElementById('restore-btn');
+        const cancelBtn = document.getElementById('cancel-btn');
+        let historyData = [], selectedIdx = null;
+
+        historyBtn.onclick = async () => {
+            if (!sessionId) return;
+            try {
+                const r = await fetch('/api/history?sessionId=' + encodeURIComponent(sessionId));
+                if (r.ok) {
+                    const d = await r.json();
+                    historyData = d.entries || [];
+                    renderHistory();
+                }
+            } catch {}
+            historyModal.classList.add('open');
+        };
+
+        cancelBtn.onclick = () => { historyModal.classList.remove('open'); selectedIdx = null; restoreBtn.disabled = true; };
+        historyModal.onclick = (e) => { if (e.target === historyModal) cancelBtn.onclick(); };
+
+        function renderHistory() {
+            if (historyData.length === 0) {
+                historyGrid.style.display = 'none';
+                historyEmpty.style.display = 'block';
+                return;
+            }
+            historyGrid.style.display = 'grid';
+            historyEmpty.style.display = 'none';
+            historyGrid.innerHTML = historyData.map((e, i) => \`
+                <div class="history-item" data-idx="\${e.index}">
+                    <div class="thumb">\${e.svg ? \`<img src="\${e.svg}">\` : '#' + e.index}</div>
+                    <div class="label">#\${e.index}</div>
+                </div>
+            \`).join('');
+            historyGrid.querySelectorAll('.history-item').forEach(item => {
+                item.onclick = () => {
+                    const idx = parseInt(item.dataset.idx);
+                    if (selectedIdx === idx) { selectedIdx = null; restoreBtn.disabled = true; }
+                    else { selectedIdx = idx; restoreBtn.disabled = false; }
+                    historyGrid.querySelectorAll('.history-item').forEach(el => el.classList.toggle('selected', parseInt(el.dataset.idx) === selectedIdx));
+                };
+            });
         }
+
+        restoreBtn.onclick = async () => {
+            if (selectedIdx === null) return;
+            restoreBtn.disabled = true;
+            restoreBtn.textContent = 'Restoring...';
+            try {
+                const r = await fetch('/api/restore', {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({ sessionId, index: selectedIdx })
+                });
+                if (r.ok) { cancelBtn.onclick(); await poll(); }
+                else { alert('Restore failed'); }
+            } catch { alert('Restore failed'); }
+            restoreBtn.textContent = 'Restore';
+        };
     </script>
 </body>
 </html>`

packages/mcp-server/src/index.ts

@@ -34,13 +34,16 @@ import {
     applyDiagramOperations,
     type DiagramOperation,
 } from "./diagram-operations.js"
+import { addHistory } from "./history.js"
 import {
-    getServerPort,
     getState,
+    requestSync,
     setState,
     startHttpServer,
+    waitForSync,
 } from "./http-server.js"
 import { log } from "./logger.js"
+import { validateAndFixXml } from "./xml-validation.js"
 
 // Server configuration
 const config = {
@@ -52,6 +55,7 @@ let currentSession: {
     id: string
     xml: string
     version: number
+    lastGetDiagramTime: number // Track when get_diagram was last called (for enforcing workflow)
 } | null = null
 
 // Create MCP server
@@ -117,6 +121,7 @@ server.registerTool(
                 id: sessionId,
                 xml: "",
                 version: 0,
+                lastGetDiagramTime: 0,
             }
 
             // Open browser
@@ -160,7 +165,7 @@ server.registerTool(
                 .describe("The draw.io XML to display (mxGraphModel format)"),
         },
     },
-    async ({ xml }) => {
+    async ({ xml: inputXml }) => {
         try {
             if (!currentSession) {
                 return {
@@ -174,8 +179,43 @@ server.registerTool(
                 }
             }
 
+            // Validate and auto-fix XML
+            let xml = inputXml
+            const { valid, error, fixed, fixes } = validateAndFixXml(xml)
+            if (fixed) {
+                xml = fixed
+                log.info(`XML auto-fixed: ${fixes.join(", ")}`)
+            }
+            if (!valid && error) {
+                log.error(`XML validation failed: ${error}`)
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: `Error: XML validation failed - ${error}`,
+                        },
+                    ],
+                    isError: true,
+                }
+            }
+
             log.info(`Displaying diagram, ${xml.length} chars`)
 
+            // Sync from browser state first
+            const browserState = getState(currentSession.id)
+            if (browserState?.xml) {
+                currentSession.xml = browserState.xml
+            }
+
+            // Save user's state before AI overwrites (with cached SVG)
+            if (currentSession.xml) {
+                addHistory(
+                    currentSession.id,
+                    currentSession.xml,
+                    browserState?.svg || "",
+                )
+            }
+
             // Update session state
             currentSession.xml = xml
             currentSession.version++
@@ -183,6 +223,9 @@ server.registerTool(
             // Push to embedded server state
             setState(currentSession.id, xml)
 
+            // Save AI result (no SVG yet - will be captured by browser)
+            addHistory(currentSession.id, xml, "")
+
             log.info(`Diagram displayed successfully`)
 
             return {
@@ -210,11 +253,14 @@ server.registerTool(
     "edit_diagram",
     {
         description:
-            "Edit the current diagram by ID-based operations (update/add/delete cells). " +
-            "ALWAYS fetches the latest state from browser first, so user's manual changes are preserved.\n\n" +
-            "IMPORTANT workflow:\n" +
-            "- For ADD operations: Can use directly - just provide new unique cell_id and new_xml.\n" +
-            "- For UPDATE/DELETE: Call get_diagram FIRST to see current cell IDs, then edit.\n\n" +
+            "Edit the current diagram by ID-based operations (update/add/delete cells).\n\n" +
+            "⚠️ REQUIRED: You MUST call get_diagram BEFORE this tool!\n" +
+            "This fetches the latest state from the browser including any manual user edits.\n" +
+            "Skipping get_diagram WILL cause user's changes to be LOST.\n\n" +
+            "Workflow:\n" +
+            "1. Call get_diagram to see current cell IDs and structure\n" +
+            "2. Use the returned XML to construct your edit operations\n" +
+            "3. Call edit_diagram with your operations\n\n" +
             "Operations:\n" +
             "- add: Add a new cell. Provide cell_id (new unique id) and new_xml.\n" +
             "- update: Replace an existing cell by its id. Provide cell_id and complete new_xml.\n" +
@@ -253,6 +299,27 @@ server.registerTool(
                 }
             }
 
+            // Enforce workflow: require get_diagram to be called first
+            const timeSinceGet = Date.now() - currentSession.lastGetDiagramTime
+            if (timeSinceGet > 30000) {
+                // 30 seconds
+                log.warn(
+                    "edit_diagram called without recent get_diagram - rejecting to prevent data loss",
+                )
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text:
+                                "Error: You must call get_diagram first before edit_diagram.\n\n" +
+                                "This ensures you have the latest diagram state including any manual edits the user made in the browser. " +
+                                "Please call get_diagram, then use that XML to construct your edit operations.",
+                        },
+                    ],
+                    isError: true,
+                }
+            }
+
             // Fetch latest state from browser
             const browserState = getState(currentSession.id)
             if (browserState?.xml) {
@@ -274,10 +341,38 @@ server.registerTool(
 
             log.info(`Editing diagram with ${operations.length} operation(s)`)
 
+            // Save before editing (with cached SVG from browser)
+            addHistory(
+                currentSession.id,
+                currentSession.xml,
+                browserState?.svg || "",
+            )
+
+            // Validate and auto-fix new_xml for each operation
+            const validatedOps = operations.map((op) => {
+                if (op.new_xml) {
+                    const { valid, error, fixed, fixes } = validateAndFixXml(
+                        op.new_xml,
+                    )
+                    if (fixed) {
+                        log.info(
+                            `Operation ${op.type} ${op.cell_id}: XML auto-fixed: ${fixes.join(", ")}`,
+                        )
+                        return { ...op, new_xml: fixed }
+                    }
+                    if (!valid && error) {
+                        log.warn(
+                            `Operation ${op.type} ${op.cell_id}: XML validation failed: ${error}`,
+                        )
+                    }
+                }
+                return op
+            })
+
             // Apply operations
             const { result, errors } = applyDiagramOperations(
                 currentSession.xml,
-                operations as DiagramOperation[],
+                validatedOps as DiagramOperation[],
             )
 
             if (errors.length > 0) {
@@ -294,6 +389,9 @@ server.registerTool(
             // Push to embedded server
             setState(currentSession.id, result)
 
+            // Save AI result (no SVG yet - will be captured by browser)
+            addHistory(currentSession.id, result, "")
+
             log.info(`Diagram edited successfully`)
 
             const successMsg = `Diagram edited successfully!\n\nApplied ${operations.length} operation(s).`
@@ -345,6 +443,18 @@ server.registerTool(
                 }
             }
 
+            // Request browser to push fresh state and wait for it
+            const syncRequested = requestSync(currentSession.id)
+            if (syncRequested) {
+                const synced = await waitForSync(currentSession.id)
+                if (!synced) {
+                    log.warn("get_diagram: sync timeout - state may be stale")
+                }
+            }
+
+            // Mark that get_diagram was called (for edit_diagram workflow check)
+            currentSession.lastGetDiagramTime = Date.now()
+
             // Fetch latest state from browser
             const browserState = getState(currentSession.id)
             if (browserState?.xml) {

packages/mcp-server/src/xml-validation.ts

@@ -0,0 +1,926 @@
+/**
+ * XML Validation and Auto-Fix for draw.io diagrams
+ * Copied from lib/utils.ts to avoid cross-package imports
+ */
+
+// ============================================================================
+// Constants
+// ============================================================================
+
+/** Maximum XML size to process (1MB) - larger XMLs may cause performance issues */
+const MAX_XML_SIZE = 1_000_000
+
+/** Maximum iterations for aggressive cell dropping to prevent infinite loops */
+const MAX_DROP_ITERATIONS = 10
+
+/** Structural attributes that should not be duplicated in draw.io */
+const STRUCTURAL_ATTRS = [
+    "edge",
+    "parent",
+    "source",
+    "target",
+    "vertex",
+    "connectable",
+]
+
+/** Valid XML entity names */
+const VALID_ENTITIES = new Set(["lt", "gt", "amp", "quot", "apos"])
+
+// ============================================================================
+// XML Parsing Helpers
+// ============================================================================
+
+interface ParsedTag {
+    tag: string
+    tagName: string
+    isClosing: boolean
+    isSelfClosing: boolean
+    startIndex: number
+    endIndex: number
+}
+
+/**
+ * Parse XML tags while properly handling quoted strings
+ */
+function parseXmlTags(xml: string): ParsedTag[] {
+    const tags: ParsedTag[] = []
+    let i = 0
+
+    while (i < xml.length) {
+        const tagStart = xml.indexOf("<", i)
+        if (tagStart === -1) break
+
+        // Find matching > by tracking quotes
+        let tagEnd = tagStart + 1
+        let inQuote = false
+        let quoteChar = ""
+
+        while (tagEnd < xml.length) {
+            const c = xml[tagEnd]
+            if (inQuote) {
+                if (c === quoteChar) inQuote = false
+            } else {
+                if (c === '"' || c === "'") {
+                    inQuote = true
+                    quoteChar = c
+                } else if (c === ">") {
+                    break
+                }
+            }
+            tagEnd++
+        }
+
+        if (tagEnd >= xml.length) break
+
+        const tag = xml.substring(tagStart, tagEnd + 1)
+        i = tagEnd + 1
+
+        const tagMatch = /^<(\/?)([a-zA-Z][a-zA-Z0-9:_-]*)/.exec(tag)
+        if (!tagMatch) continue
+
+        tags.push({
+            tag,
+            tagName: tagMatch[2],
+            isClosing: tagMatch[1] === "/",
+            isSelfClosing: tag.endsWith("/>"),
+            startIndex: tagStart,
+            endIndex: tagEnd,
+        })
+    }
+
+    return tags
+}
+
+// ============================================================================
+// Validation Helper Functions
+// ============================================================================
+
+/** Check for duplicate structural attributes in a tag */
+function checkDuplicateAttributes(xml: string): string | null {
+    const structuralSet = new Set(STRUCTURAL_ATTRS)
+    const tagPattern = /<[^>]+>/g
+    let tagMatch
+    while ((tagMatch = tagPattern.exec(xml)) !== null) {
+        const tag = tagMatch[0]
+        const attrPattern = /\s([a-zA-Z_:][a-zA-Z0-9_:.-]*)\s*=/g
+        const attributes = new Map<string, number>()
+        let attrMatch
+        while ((attrMatch = attrPattern.exec(tag)) !== null) {
+            const attrName = attrMatch[1]
+            attributes.set(attrName, (attributes.get(attrName) || 0) + 1)
+        }
+        const duplicates = Array.from(attributes.entries())
+            .filter(([name, count]) => count > 1 && structuralSet.has(name))
+            .map(([name]) => name)
+        if (duplicates.length > 0) {
+            return `Invalid XML: Duplicate structural attribute(s): ${duplicates.join(", ")}. Remove duplicate attributes.`
+        }
+    }
+    return null
+}
+
+/** Check for duplicate IDs in XML */
+function checkDuplicateIds(xml: string): string | null {
+    const idPattern = /\bid\s*=\s*["']([^"']+)["']/gi
+    const ids = new Map<string, number>()
+    let idMatch
+    while ((idMatch = idPattern.exec(xml)) !== null) {
+        const id = idMatch[1]
+        ids.set(id, (ids.get(id) || 0) + 1)
+    }
+    const duplicateIds = Array.from(ids.entries())
+        .filter(([, count]) => count > 1)
+        .map(([id, count]) => `'${id}' (${count}x)`)
+    if (duplicateIds.length > 0) {
+        return `Invalid XML: Found duplicate ID(s): ${duplicateIds.slice(0, 3).join(", ")}. All id attributes must be unique.`
+    }
+    return null
+}
+
+/** Check for tag mismatches using parsed tags */
+function checkTagMismatches(xml: string): string | null {
+    const xmlWithoutComments = xml.replace(/<!--[\s\S]*?-->/g, "")
+    const tags = parseXmlTags(xmlWithoutComments)
+    const tagStack: string[] = []
+
+    for (const { tagName, isClosing, isSelfClosing } of tags) {
+        if (isClosing) {
+            if (tagStack.length === 0) {
+                return `Invalid XML: Closing tag </${tagName}> without matching opening tag`
+            }
+            const expected = tagStack.pop()
+            if (expected?.toLowerCase() !== tagName.toLowerCase()) {
+                return `Invalid XML: Expected closing tag </${expected}> but found </${tagName}>`
+            }
+        } else if (!isSelfClosing) {
+            tagStack.push(tagName)
+        }
+    }
+    if (tagStack.length > 0) {
+        return `Invalid XML: Document has ${tagStack.length} unclosed tag(s): ${tagStack.join(", ")}`
+    }
+    return null
+}
+
+/** Check for invalid character references */
+function checkCharacterReferences(xml: string): string | null {
+    const charRefPattern = /&#x?[^;]+;?/g
+    let charMatch
+    while ((charMatch = charRefPattern.exec(xml)) !== null) {
+        const ref = charMatch[0]
+        if (ref.startsWith("&#x")) {
+            if (!ref.endsWith(";")) {
+                return `Invalid XML: Missing semicolon after hex reference: ${ref}`
+            }
+            const hexDigits = ref.substring(3, ref.length - 1)
+            if (hexDigits.length === 0 || !/^[0-9a-fA-F]+$/.test(hexDigits)) {
+                return `Invalid XML: Invalid hex character reference: ${ref}`
+            }
+        } else if (ref.startsWith("&#")) {
+            if (!ref.endsWith(";")) {
+                return `Invalid XML: Missing semicolon after decimal reference: ${ref}`
+            }
+            const decDigits = ref.substring(2, ref.length - 1)
+            if (decDigits.length === 0 || !/^[0-9]+$/.test(decDigits)) {
+                return `Invalid XML: Invalid decimal character reference: ${ref}`
+            }
+        }
+    }
+    return null
+}
+
+/** Check for invalid entity references */
+function checkEntityReferences(xml: string): string | null {
+    const xmlWithoutComments = xml.replace(/<!--[\s\S]*?-->/g, "")
+    const bareAmpPattern = /&(?!(?:lt|gt|amp|quot|apos|#))/g
+    if (bareAmpPattern.test(xmlWithoutComments)) {
+        return "Invalid XML: Found unescaped & character(s). Replace & with &amp;"
+    }
+    const invalidEntityPattern = /&([a-zA-Z][a-zA-Z0-9]*);/g
+    let entityMatch
+    while (
+        (entityMatch = invalidEntityPattern.exec(xmlWithoutComments)) !== null
+    ) {
+        if (!VALID_ENTITIES.has(entityMatch[1])) {
+            return `Invalid XML: Invalid entity reference: &${entityMatch[1]}; - use only valid XML entities (lt, gt, amp, quot, apos)`
+        }
+    }
+    return null
+}
+
+/** Check for nested mxCell tags using regex */
+function checkNestedMxCells(xml: string): string | null {
+    const cellTagPattern = /<\/?mxCell[^>]*>/g
+    const cellStack: number[] = []
+    let cellMatch
+    while ((cellMatch = cellTagPattern.exec(xml)) !== null) {
+        const tag = cellMatch[0]
+        if (tag.startsWith("</mxCell>")) {
+            if (cellStack.length > 0) cellStack.pop()
+        } else if (!tag.endsWith("/>")) {
+            const isLabelOrGeometry =
+                /\sas\s*=\s*["'](valueLabel|geometry)["']/.test(tag)
+            if (!isLabelOrGeometry) {
+                cellStack.push(cellMatch.index)
+                if (cellStack.length > 1) {
+                    return "Invalid XML: Found nested mxCell tags. Cells should be siblings, not nested inside other mxCell elements."
+                }
+            }
+        }
+    }
+    return null
+}
+
+// ============================================================================
+// Main Validation Function
+// ============================================================================
+
+/**
+ * Validates draw.io XML structure for common issues
+ * Uses DOM parsing + additional regex checks for high accuracy
+ * @param xml - The XML string to validate
+ * @returns null if valid, error message string if invalid
+ */
+export function validateMxCellStructure(xml: string): string | null {
+    // Size check for performance
+    if (xml.length > MAX_XML_SIZE) {
+        console.warn(
+            `[validateMxCellStructure] XML size (${xml.length}) exceeds ${MAX_XML_SIZE} bytes, may cause performance issues`,
+        )
+    }
+
+    // 0. First use DOM parser to catch syntax errors (most accurate)
+    try {
+        const parser = new DOMParser()
+        const doc = parser.parseFromString(xml, "text/xml")
+        const parseError = doc.querySelector("parsererror")
+        if (parseError) {
+            return `Invalid XML: The XML contains syntax errors (likely unescaped special characters like <, >, & in attribute values). Please escape special characters: use &lt; for <, &gt; for >, &amp; for &, &quot; for ". Regenerate the diagram with properly escaped values.`
+        }
+
+        // DOM-based checks for nested mxCell
+        const allCells = doc.querySelectorAll("mxCell")
+        for (const cell of allCells) {
+            if (cell.parentElement?.tagName === "mxCell") {
+                const id = cell.getAttribute("id") || "unknown"
+                return `Invalid XML: Found nested mxCell (id="${id}"). Cells should be siblings, not nested inside other mxCell elements.`
+            }
+        }
+    } catch (error) {
+        console.warn(
+            "[validateMxCellStructure] DOMParser threw unexpected error, falling back to regex validation:",
+            error,
+        )
+    }
+
+    // 1. Check for CDATA wrapper (invalid at document root)
+    if (/^\s*<!\[CDATA\[/.test(xml)) {
+        return "Invalid XML: XML is wrapped in CDATA section - remove <![CDATA[ from start and ]]> from end"
+    }
+
+    // 2. Check for duplicate structural attributes
+    const dupAttrError = checkDuplicateAttributes(xml)
+    if (dupAttrError) {
+        return dupAttrError
+    }
+
+    // 3. Check for unescaped < in attribute values
+    const attrValuePattern = /=\s*"([^"]*)"/g
+    let attrValMatch
+    while ((attrValMatch = attrValuePattern.exec(xml)) !== null) {
+        const value = attrValMatch[1]
+        if (/</.test(value) && !/&lt;/.test(value)) {
+            return "Invalid XML: Unescaped < character in attribute values. Replace < with &lt;"
+        }
+    }
+
+    // 4. Check for duplicate IDs
+    const dupIdError = checkDuplicateIds(xml)
+    if (dupIdError) {
+        return dupIdError
+    }
+
+    // 5. Check for tag mismatches
+    const tagMismatchError = checkTagMismatches(xml)
+    if (tagMismatchError) {
+        return tagMismatchError
+    }
+
+    // 6. Check invalid character references
+    const charRefError = checkCharacterReferences(xml)
+    if (charRefError) {
+        return charRefError
+    }
+
+    // 7. Check for invalid comment syntax (-- inside comments)
+    const commentPattern = /<!--([\s\S]*?)-->/g
+    let commentMatch
+    while ((commentMatch = commentPattern.exec(xml)) !== null) {
+        if (/--/.test(commentMatch[1])) {
+            return "Invalid XML: Comment contains -- (double hyphen) which is not allowed"
+        }
+    }
+
+    // 8. Check for unescaped entity references and invalid entity names
+    const entityError = checkEntityReferences(xml)
+    if (entityError) {
+        return entityError
+    }
+
+    // 9. Check for empty id attributes on mxCell
+    if (/<mxCell[^>]*\sid\s*=\s*["']\s*["'][^>]*>/g.test(xml)) {
+        return "Invalid XML: Found mxCell element(s) with empty id attribute"
+    }
+
+    // 10. Check for nested mxCell tags
+    const nestedCellError = checkNestedMxCells(xml)
+    if (nestedCellError) {
+        return nestedCellError
+    }
+
+    return null
+}
+
+// ============================================================================
+// Auto-Fix Function
+// ============================================================================
+
+/**
+ * Attempts to auto-fix common XML issues in draw.io diagrams
+ * @param xml - The XML string to fix
+ * @returns Object with fixed XML and list of fixes applied
+ */
+export function autoFixXml(xml: string): { fixed: string; fixes: string[] } {
+    let fixed = xml
+    const fixes: string[] = []
+
+    // 0. Fix JSON-escaped XML
+    if (/=\\"/.test(fixed)) {
+        fixed = fixed.replace(/\\"/g, '"')
+        fixed = fixed.replace(/\\n/g, "\n")
+        fixes.push("Fixed JSON-escaped XML")
+    }
+
+    // 1. Remove CDATA wrapper
+    if (/^\s*<!\[CDATA\[/.test(fixed)) {
+        fixed = fixed.replace(/^\s*<!\[CDATA\[/, "").replace(/\]\]>\s*$/, "")
+        fixes.push("Removed CDATA wrapper")
+    }
+
+    // 2. Remove text before XML declaration or root element
+    const xmlStart = fixed.search(/<(\?xml|mxGraphModel|mxfile)/i)
+    if (xmlStart > 0 && !/^<[a-zA-Z]/.test(fixed.trim())) {
+        fixed = fixed.substring(xmlStart)
+        fixes.push("Removed text before XML root")
+    }
+
+    // 3. Fix duplicate attributes
+    let dupAttrFixed = false
+    fixed = fixed.replace(/<[^>]+>/g, (tag) => {
+        let newTag = tag
+        for (const attr of STRUCTURAL_ATTRS) {
+            const attrRegex = new RegExp(
+                `\\s${attr}\\s*=\\s*["'][^"']*["']`,
+                "gi",
+            )
+            const matches = tag.match(attrRegex)
+            if (matches && matches.length > 1) {
+                let firstKept = false
+                newTag = newTag.replace(attrRegex, (m) => {
+                    if (!firstKept) {
+                        firstKept = true
+                        return m
+                    }
+                    dupAttrFixed = true
+                    return ""
+                })
+            }
+        }
+        return newTag
+    })
+    if (dupAttrFixed) {
+        fixes.push("Removed duplicate structural attributes")
+    }
+
+    // 4. Fix unescaped & characters
+    const ampersandPattern =
+        /&(?!(?:lt|gt|amp|quot|apos|#[0-9]+|#x[0-9a-fA-F]+);)/g
+    if (ampersandPattern.test(fixed)) {
+        fixed = fixed.replace(
+            /&(?!(?:lt|gt|amp|quot|apos|#[0-9]+|#x[0-9a-fA-F]+);)/g,
+            "&amp;",
+        )
+        fixes.push("Escaped unescaped & characters")
+    }
+
+    // 5. Fix invalid entity names (double-escaping)
+    const invalidEntities = [
+        { pattern: /&ampquot;/g, replacement: "&quot;", name: "&ampquot;" },
+        { pattern: /&amplt;/g, replacement: "&lt;", name: "&amplt;" },
+        { pattern: /&ampgt;/g, replacement: "&gt;", name: "&ampgt;" },
+        { pattern: /&ampapos;/g, replacement: "&apos;", name: "&ampapos;" },
+        { pattern: /&ampamp;/g, replacement: "&amp;", name: "&ampamp;" },
+    ]
+    for (const { pattern, replacement, name } of invalidEntities) {
+        if (pattern.test(fixed)) {
+            fixed = fixed.replace(pattern, replacement)
+            fixes.push(`Fixed double-escaped entity ${name}`)
+        }
+    }
+
+    // 6. Fix malformed attribute quotes
+    const malformedQuotePattern = /(\s[a-zA-Z][a-zA-Z0-9_:-]*)=&quot;/
+    if (malformedQuotePattern.test(fixed)) {
+        fixed = fixed.replace(
+            /(\s[a-zA-Z][a-zA-Z0-9_:-]*)=&quot;([^&]*?)&quot;/g,
+            '$1="$2"',
+        )
+        fixes.push("Fixed malformed attribute quotes")
+    }
+
+    // 7. Fix malformed closing tags
+    const malformedClosingTag = /<\/([a-zA-Z][a-zA-Z0-9]*)\s*\/>/g
+    if (malformedClosingTag.test(fixed)) {
+        fixed = fixed.replace(/<\/([a-zA-Z][a-zA-Z0-9]*)\s*\/>/g, "</$1>")
+        fixes.push("Fixed malformed closing tags")
+    }
+
+    // 8. Fix missing space between attributes
+    const missingSpacePattern = /("[^"]*")([a-zA-Z][a-zA-Z0-9_:-]*=)/g
+    if (missingSpacePattern.test(fixed)) {
+        fixed = fixed.replace(/("[^"]*")([a-zA-Z][a-zA-Z0-9_:-]*=)/g, "$1 $2")
+        fixes.push("Added missing space between attributes")
+    }
+
+    // 9. Fix unescaped quotes in style color values
+    const quotedColorPattern = /;([a-zA-Z]*[Cc]olor)="#/
+    if (quotedColorPattern.test(fixed)) {
+        fixed = fixed.replace(/;([a-zA-Z]*[Cc]olor)="#/g, ";$1=#")
+        fixes.push("Removed quotes around color values in style")
+    }
+
+    // 10. Fix unescaped < in attribute values
+    const attrPattern = /(=\s*")([^"]*?)(<)([^"]*?)(")/g
+    let attrMatch
+    let hasUnescapedLt = false
+    while ((attrMatch = attrPattern.exec(fixed)) !== null) {
+        if (!attrMatch[3].startsWith("&lt;")) {
+            hasUnescapedLt = true
+            break
+        }
+    }
+    if (hasUnescapedLt) {
+        fixed = fixed.replace(/=\s*"([^"]*)"/g, (_match, value) => {
+            const escaped = value.replace(/</g, "&lt;")
+            return `="${escaped}"`
+        })
+        fixes.push("Escaped < characters in attribute values")
+    }
+
+    // 11. Fix invalid hex character references
+    const invalidHexRefs: string[] = []
+    fixed = fixed.replace(/&#x([^;]*);/g, (match, hex) => {
+        if (/^[0-9a-fA-F]+$/.test(hex) && hex.length > 0) {
+            return match
+        }
+        invalidHexRefs.push(match)
+        return ""
+    })
+    if (invalidHexRefs.length > 0) {
+        fixes.push(
+            `Removed ${invalidHexRefs.length} invalid hex character reference(s)`,
+        )
+    }
+
+    // 12. Fix invalid decimal character references
+    const invalidDecRefs: string[] = []
+    fixed = fixed.replace(/&#([^x][^;]*);/g, (match, dec) => {
+        if (/^[0-9]+$/.test(dec) && dec.length > 0) {
+            return match
+        }
+        invalidDecRefs.push(match)
+        return ""
+    })
+    if (invalidDecRefs.length > 0) {
+        fixes.push(
+            `Removed ${invalidDecRefs.length} invalid decimal character reference(s)`,
+        )
+    }
+
+    // 13. Fix invalid comment syntax
+    fixed = fixed.replace(/<!--([\s\S]*?)-->/g, (match, content) => {
+        if (/--/.test(content)) {
+            let fixedContent = content
+            while (/--/.test(fixedContent)) {
+                fixedContent = fixedContent.replace(/--/g, "-")
+            }
+            fixes.push("Fixed invalid comment syntax")
+            return `<!--${fixedContent}-->`
+        }
+        return match
+    })
+
+    // 14. Fix <Cell> tags to <mxCell>
+    const hasCellTags = /<\/?Cell[\s>]/i.test(fixed)
+    if (hasCellTags) {
+        fixed = fixed.replace(/<Cell(\s)/gi, "<mxCell$1")
+        fixed = fixed.replace(/<Cell>/gi, "<mxCell>")
+        fixed = fixed.replace(/<\/Cell>/gi, "</mxCell>")
+        fixes.push("Fixed <Cell> tags to <mxCell>")
+    }
+
+    // 15. Fix common closing tag typos (MUST run before foreign tag removal)
+    const tagTypos = [
+        { wrong: /<\/mxElement>/gi, right: "</mxCell>", name: "</mxElement>" },
+        { wrong: /<\/mxcell>/g, right: "</mxCell>", name: "</mxcell>" },
+        {
+            wrong: /<\/mxgeometry>/g,
+            right: "</mxGeometry>",
+            name: "</mxgeometry>",
+        },
+        { wrong: /<\/mxpoint>/g, right: "</mxPoint>", name: "</mxpoint>" },
+        {
+            wrong: /<\/mxgraphmodel>/gi,
+            right: "</mxGraphModel>",
+            name: "</mxgraphmodel>",
+        },
+    ]
+    for (const { wrong, right, name } of tagTypos) {
+        const before = fixed
+        fixed = fixed.replace(wrong, right)
+        if (fixed !== before) {
+            fixes.push(`Fixed typo ${name} to ${right}`)
+        }
+    }
+
+    // 16. Remove non-draw.io tags (after typo fixes so lowercase variants are fixed first)
+    const validDrawioTags = new Set([
+        "mxfile",
+        "diagram",
+        "mxGraphModel",
+        "root",
+        "mxCell",
+        "mxGeometry",
+        "mxPoint",
+        "Array",
+        "Object",
+        "mxRectangle",
+    ])
+    const foreignTagPattern = /<\/?([a-zA-Z][a-zA-Z0-9_]*)[^>]*>/g
+    let foreignMatch
+    const foreignTags = new Set<string>()
+    while ((foreignMatch = foreignTagPattern.exec(fixed)) !== null) {
+        const tagName = foreignMatch[1]
+        if (!validDrawioTags.has(tagName)) {
+            foreignTags.add(tagName)
+        }
+    }
+    if (foreignTags.size > 0) {
+        for (const tag of foreignTags) {
+            fixed = fixed.replace(new RegExp(`<${tag}[^>]*>`, "gi"), "")
+            fixed = fixed.replace(new RegExp(`</${tag}>`, "gi"), "")
+        }
+        fixes.push(
+            `Removed foreign tags: ${Array.from(foreignTags).join(", ")}`,
+        )
+    }
+
+    // 17. Fix unclosed tags
+    const tagStack: string[] = []
+    const parsedTags = parseXmlTags(fixed)
+
+    for (const { tagName, isClosing, isSelfClosing } of parsedTags) {
+        if (isClosing) {
+            const lastIdx = tagStack.lastIndexOf(tagName)
+            if (lastIdx !== -1) {
+                tagStack.splice(lastIdx, 1)
+            }
+        } else if (!isSelfClosing) {
+            tagStack.push(tagName)
+        }
+    }
+
+    if (tagStack.length > 0) {
+        const tagsToClose: string[] = []
+        for (const tagName of tagStack.reverse()) {
+            const openCount = (
+                fixed.match(new RegExp(`<${tagName}[\\s>]`, "gi")) || []
+            ).length
+            const closeCount = (
+                fixed.match(new RegExp(`</${tagName}>`, "gi")) || []
+            ).length
+            if (openCount > closeCount) {
+                tagsToClose.push(tagName)
+            }
+        }
+        if (tagsToClose.length > 0) {
+            const closingTags = tagsToClose.map((t) => `</${t}>`).join("\n")
+            fixed = fixed.trimEnd() + "\n" + closingTags
+            fixes.push(
+                `Closed ${tagsToClose.length} unclosed tag(s): ${tagsToClose.join(", ")}`,
+            )
+        }
+    }
+
+    // 18. Remove extra closing tags
+    const tagCounts = new Map<
+        string,
+        { opens: number; closes: number; selfClosing: number }
+    >()
+    const fullTagPattern = /<(\/?[a-zA-Z][a-zA-Z0-9]*)[^>]*>/g
+    let tagCountMatch
+    while ((tagCountMatch = fullTagPattern.exec(fixed)) !== null) {
+        const fullMatch = tagCountMatch[0]
+        const tagPart = tagCountMatch[1]
+        const isClosing = tagPart.startsWith("/")
+        const isSelfClosing = fullMatch.endsWith("/>")
+        const tagName = isClosing ? tagPart.slice(1) : tagPart
+
+        let counts = tagCounts.get(tagName)
+        if (!counts) {
+            counts = { opens: 0, closes: 0, selfClosing: 0 }
+            tagCounts.set(tagName, counts)
+        }
+        if (isClosing) {
+            counts.closes++
+        } else if (isSelfClosing) {
+            counts.selfClosing++
+        } else {
+            counts.opens++
+        }
+    }
+
+    for (const [tagName, counts] of tagCounts) {
+        const extraCloses = counts.closes - counts.opens
+        if (extraCloses > 0) {
+            let removed = 0
+            const closeTagPattern = new RegExp(`</${tagName}>`, "g")
+            const matches = [...fixed.matchAll(closeTagPattern)]
+            for (
+                let i = matches.length - 1;
+                i >= 0 && removed < extraCloses;
+                i--
+            ) {
+                const match = matches[i]
+                const idx = match.index ?? 0
+                fixed = fixed.slice(0, idx) + fixed.slice(idx + match[0].length)
+                removed++
+            }
+            if (removed > 0) {
+                fixes.push(
+                    `Removed ${removed} extra </${tagName}> closing tag(s)`,
+                )
+            }
+        }
+    }
+
+    // 19. Remove trailing garbage after last XML tag
+    const closingTagPattern = /<\/[a-zA-Z][a-zA-Z0-9]*>|\/>/g
+    let lastValidTagEnd = -1
+    let closingMatch
+    while ((closingMatch = closingTagPattern.exec(fixed)) !== null) {
+        lastValidTagEnd = closingMatch.index + closingMatch[0].length
+    }
+    if (lastValidTagEnd > 0 && lastValidTagEnd < fixed.length) {
+        const trailing = fixed.slice(lastValidTagEnd).trim()
+        if (trailing) {
+            fixed = fixed.slice(0, lastValidTagEnd)
+            fixes.push("Removed trailing garbage after last XML tag")
+        }
+    }
+
+    // 20. Fix nested mxCell by flattening
+    const lines = fixed.split("\n")
+    let newLines: string[] = []
+    let nestedFixed = 0
+    let extraClosingToRemove = 0
+
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i]
+        const nextLine = lines[i + 1]
+
+        if (
+            nextLine &&
+            /<mxCell\s/.test(line) &&
+            /<mxCell\s/.test(nextLine) &&
+            !line.includes("/>") &&
+            !nextLine.includes("/>")
+        ) {
+            const id1 = line.match(/\bid\s*=\s*["']([^"']+)["']/)?.[1]
+            const id2 = nextLine.match(/\bid\s*=\s*["']([^"']+)["']/)?.[1]
+
+            if (id1 && id1 === id2) {
+                nestedFixed++
+                extraClosingToRemove++
+                continue
+            }
+        }
+
+        if (extraClosingToRemove > 0 && /^\s*<\/mxCell>\s*$/.test(line)) {
+            extraClosingToRemove--
+            continue
+        }
+
+        newLines.push(line)
+    }
+
+    if (nestedFixed > 0) {
+        fixed = newLines.join("\n")
+        fixes.push(`Flattened ${nestedFixed} duplicate-ID nested mxCell(s)`)
+    }
+
+    // 21. Fix true nested mxCell (different IDs)
+    const lines2 = fixed.split("\n")
+    newLines = []
+    let trueNestedFixed = 0
+    let cellDepth = 0
+    let pendingCloseRemoval = 0
+
+    for (let i = 0; i < lines2.length; i++) {
+        const line = lines2[i]
+        const trimmed = line.trim()
+
+        const isOpenCell = /<mxCell\s/.test(trimmed) && !trimmed.endsWith("/>")
+        const isCloseCell = trimmed === "</mxCell>"
+
+        if (isOpenCell) {
+            if (cellDepth > 0) {
+                const indent = line.match(/^(\s*)/)?.[1] || ""
+                newLines.push(indent + "</mxCell>")
+                trueNestedFixed++
+                pendingCloseRemoval++
+            }
+            cellDepth = 1
+            newLines.push(line)
+        } else if (isCloseCell) {
+            if (pendingCloseRemoval > 0) {
+                pendingCloseRemoval--
+            } else {
+                cellDepth = Math.max(0, cellDepth - 1)
+                newLines.push(line)
+            }
+        } else {
+            newLines.push(line)
+        }
+    }
+
+    if (trueNestedFixed > 0) {
+        fixed = newLines.join("\n")
+        fixes.push(`Fixed ${trueNestedFixed} true nested mxCell(s)`)
+    }
+
+    // 22. Fix duplicate IDs by appending suffix
+    const seenIds = new Map<string, number>()
+    const duplicateIds: string[] = []
+
+    const idPattern = /\bid\s*=\s*["']([^"']+)["']/gi
+    let idMatch
+    while ((idMatch = idPattern.exec(fixed)) !== null) {
+        const id = idMatch[1]
+        seenIds.set(id, (seenIds.get(id) || 0) + 1)
+    }
+
+    for (const [id, count] of seenIds) {
+        if (count > 1) duplicateIds.push(id)
+    }
+
+    if (duplicateIds.length > 0) {
+        const idCounters = new Map<string, number>()
+        fixed = fixed.replace(/\bid\s*=\s*["']([^"']+)["']/gi, (match, id) => {
+            if (!duplicateIds.includes(id)) return match
+
+            const count = idCounters.get(id) || 0
+            idCounters.set(id, count + 1)
+
+            if (count === 0) return match
+
+            const newId = `${id}_dup${count}`
+            return match.replace(id, newId)
+        })
+        fixes.push(`Renamed ${duplicateIds.length} duplicate ID(s)`)
+    }
+
+    // 23. Fix empty id attributes
+    let emptyIdCount = 0
+    fixed = fixed.replace(
+        /<mxCell([^>]*)\sid\s*=\s*["']\s*["']([^>]*)>/g,
+        (_match, before, after) => {
+            emptyIdCount++
+            const newId = `cell_${Date.now()}_${emptyIdCount}`
+            return `<mxCell${before} id="${newId}"${after}>`
+        },
+    )
+    if (emptyIdCount > 0) {
+        fixes.push(`Generated ${emptyIdCount} missing ID(s)`)
+    }
+
+    // 24. Aggressive: drop broken mxCell elements
+    if (typeof DOMParser !== "undefined") {
+        let droppedCells = 0
+        let maxIterations = MAX_DROP_ITERATIONS
+        while (maxIterations-- > 0) {
+            const parser = new DOMParser()
+            const doc = parser.parseFromString(fixed, "text/xml")
+            const parseError = doc.querySelector("parsererror")
+            if (!parseError) break
+
+            const errText = parseError.textContent || ""
+            const match = errText.match(/(\d+):\d+:/)
+            if (!match) break
+
+            const errLine = parseInt(match[1], 10) - 1
+            const lines = fixed.split("\n")
+
+            let cellStart = errLine
+            let cellEnd = errLine
+
+            while (cellStart > 0 && !lines[cellStart].includes("<mxCell")) {
+                cellStart--
+            }
+
+            while (cellEnd < lines.length - 1) {
+                if (
+                    lines[cellEnd].includes("</mxCell>") ||
+                    lines[cellEnd].trim().endsWith("/>")
+                ) {
+                    break
+                }
+                cellEnd++
+            }
+
+            lines.splice(cellStart, cellEnd - cellStart + 1)
+            fixed = lines.join("\n")
+            droppedCells++
+        }
+        if (droppedCells > 0) {
+            fixes.push(`Dropped ${droppedCells} unfixable mxCell element(s)`)
+        }
+    }
+
+    return { fixed, fixes }
+}
+
+// ============================================================================
+// Combined Validation and Fix
+// ============================================================================
+
+/**
+ * Validates XML and attempts to fix if invalid
+ * @param xml - The XML string to validate and potentially fix
+ * @returns Object with validation result, fixed XML if applicable, and fixes applied
+ */
+export function validateAndFixXml(xml: string): {
+    valid: boolean
+    error: string | null
+    fixed: string | null
+    fixes: string[]
+} {
+    // First validation attempt
+    let error = validateMxCellStructure(xml)
+
+    if (!error) {
+        return { valid: true, error: null, fixed: null, fixes: [] }
+    }
+
+    // Try to fix
+    const { fixed, fixes } = autoFixXml(xml)
+
+    // Validate the fixed version
+    error = validateMxCellStructure(fixed)
+
+    if (!error) {
+        return { valid: true, error: null, fixed, fixes }
+    }
+
+    // Still invalid after fixes
+    return {
+        valid: false,
+        error,
+        fixed: fixes.length > 0 ? fixed : null,
+        fixes,
+    }
+}
+
+/**
+ * Check if mxCell XML output is complete (not truncated).
+ * @param xml - The XML string to check (can be undefined/null)
+ * @returns true if XML appears complete, false if truncated or empty
+ */
+export function isMxCellXmlComplete(xml: string | undefined | null): boolean {
+    let trimmed = xml?.trim() || ""
+    if (!trimmed) return false
+
+    // Strip wrapper tags if present
+    let prev = ""
+    while (prev !== trimmed) {
+        prev = trimmed
+        trimmed = trimmed
+            .replace(/<\/mxParameter>\s*$/i, "")
+            .replace(/<\/invoke>\s*$/i, "")
+            .replace(/<\/antml:parameter>\s*$/i, "")
+            .replace(/<\/antml:invoke>\s*$/i, "")
+            .trim()
+    }
+
+    return trimmed.endsWith("/>") || trimmed.endsWith("</mxCell>")
+}

resources/entitlements.mac.plist

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.allow-dyld-environment-variables</key>
+    <true/>
+    <key>com.apple.security.network.client</key>
+    <true/>
+    <key>com.apple.security.network.server</key>
+    <true/>
+</dict>
+</plist>

scripts/afterPack.cjs

@@ -0,0 +1,43 @@
+/**
+ * electron-builder afterPack hook
+ * Copies node_modules to the standalone directory in the packaged app
+ */
+
+const { cpSync, existsSync } = require("fs")
+const path = require("path")
+
+module.exports = async (context) => {
+    const appOutDir = context.appOutDir
+    const resourcesDir = path.join(
+        appOutDir,
+        context.packager.platform.name === "mac"
+            ? `${context.packager.appInfo.productFilename}.app/Contents/Resources`
+            : "resources",
+    )
+    const standaloneDir = path.join(resourcesDir, "standalone")
+    const sourceNodeModules = path.join(
+        context.packager.projectDir,
+        "electron-standalone",
+        "node_modules",
+    )
+    const targetNodeModules = path.join(standaloneDir, "node_modules")
+
+    console.log(`[afterPack] Copying node_modules to ${targetNodeModules}`)
+
+    if (existsSync(sourceNodeModules) && existsSync(standaloneDir)) {
+        cpSync(sourceNodeModules, targetNodeModules, { recursive: true })
+        console.log("[afterPack] node_modules copied successfully")
+    } else {
+        console.error("[afterPack] Source or target directory not found!")
+        console.error(
+            `  Source: ${sourceNodeModules} exists: ${existsSync(sourceNodeModules)}`,
+        )
+        console.error(
+            `  Target dir: ${standaloneDir} exists: ${existsSync(standaloneDir)}`,
+        )
+        throw new Error(
+            "[afterPack] Failed: Required directories not found. " +
+                "Ensure 'npm run electron:prepare' was run before building.",
+        )
+    }
+}

scripts/electron-dev.mjs

@@ -0,0 +1,295 @@
+#!/usr/bin/env node
+
+/**
+ * Development script for running Electron with Next.js
+ * 1. Reads preset configuration (if exists)
+ * 2. Starts Next.js dev server with preset env vars
+ * 3. Waits for it to be ready
+ * 4. Compiles Electron TypeScript
+ * 5. Launches Electron
+ * 6. Watches for preset changes and restarts Next.js
+ */
+
+import { spawn } from "node:child_process"
+import { existsSync, readFileSync, watch } from "node:fs"
+import os from "node:os"
+import path from "node:path"
+import { fileURLToPath } from "node:url"
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const rootDir = path.join(__dirname, "..")
+
+const NEXT_PORT = 6002
+const NEXT_URL = `http://localhost:${NEXT_PORT}`
+
+/**
+ * Get the user data path (same as Electron's app.getPath("userData"))
+ */
+function getUserDataPath() {
+    const appName = "next-ai-draw-io"
+    switch (process.platform) {
+        case "darwin":
+            return path.join(
+                os.homedir(),
+                "Library",
+                "Application Support",
+                appName,
+            )
+        case "win32":
+            return path.join(
+                process.env.APPDATA ||
+                    path.join(os.homedir(), "AppData", "Roaming"),
+                appName,
+            )
+        default:
+            return path.join(os.homedir(), ".config", appName)
+    }
+}
+
+/**
+ * Load preset configuration from config file
+ */
+function loadPresetConfig() {
+    const configPath = path.join(getUserDataPath(), "config-presets.json")
+
+    if (!existsSync(configPath)) {
+        console.log("📋 No preset configuration found, using .env.local")
+        return null
+    }
+
+    try {
+        const content = readFileSync(configPath, "utf-8")
+        const data = JSON.parse(content)
+
+        if (!data.currentPresetId) {
+            console.log("📋 No active preset, using .env.local")
+            return null
+        }
+
+        const preset = data.presets.find((p) => p.id === data.currentPresetId)
+        if (!preset) {
+            console.log("📋 Active preset not found, using .env.local")
+            return null
+        }
+
+        console.log(`📋 Using preset: "${preset.name}"`)
+        return preset.config
+    } catch (error) {
+        console.error("Failed to load preset config:", error.message)
+        return null
+    }
+}
+
+/**
+ * Wait for the Next.js server to be ready
+ */
+async function waitForServer(url, timeout = 120000) {
+    const start = Date.now()
+    console.log(`Waiting for server at ${url}...`)
+
+    while (Date.now() - start < timeout) {
+        try {
+            const response = await fetch(url)
+            if (response.ok || response.status < 500) {
+                console.log("Server is ready!")
+                return true
+            }
+        } catch {
+            // Server not ready yet
+        }
+        await new Promise((r) => setTimeout(r, 500))
+        process.stdout.write(".")
+    }
+
+    throw new Error(`Timeout waiting for server at ${url}`)
+}
+
+/**
+ * Run a command and wait for it to complete
+ */
+function runCommand(command, args, options = {}) {
+    return new Promise((resolve, reject) => {
+        const proc = spawn(command, args, {
+            cwd: rootDir,
+            stdio: "inherit",
+            shell: true,
+            ...options,
+        })
+
+        proc.on("close", (code) => {
+            if (code === 0) {
+                resolve()
+            } else {
+                reject(new Error(`Command failed with code ${code}`))
+            }
+        })
+
+        proc.on("error", reject)
+    })
+}
+
+/**
+ * Start Next.js dev server with preset environment
+ */
+function startNextServer(presetEnv) {
+    const env = { ...process.env }
+
+    // Apply preset environment variables
+    if (presetEnv) {
+        for (const [key, value] of Object.entries(presetEnv)) {
+            if (value !== undefined && value !== "") {
+                env[key] = value
+            }
+        }
+    }
+
+    const nextProcess = spawn("npm", ["run", "dev"], {
+        cwd: rootDir,
+        stdio: "inherit",
+        shell: true,
+        env,
+    })
+
+    nextProcess.on("error", (err) => {
+        console.error("Failed to start Next.js:", err)
+    })
+
+    return nextProcess
+}
+
+/**
+ * Main entry point
+ */
+async function main() {
+    console.log("🚀 Starting Electron development environment...\n")
+
+    // Load preset configuration
+    const presetEnv = loadPresetConfig()
+
+    // Start Next.js dev server with preset env
+    console.log("1. Starting Next.js development server...")
+    let nextProcess = startNextServer(presetEnv)
+
+    // Wait for Next.js to be ready
+    try {
+        await waitForServer(NEXT_URL)
+        console.log("")
+    } catch (err) {
+        console.error("\n❌ Next.js server failed to start:", err.message)
+        nextProcess.kill()
+        process.exit(1)
+    }
+
+    // Compile Electron TypeScript
+    console.log("\n2. Compiling Electron code...")
+    try {
+        await runCommand("npm", ["run", "electron:compile"])
+    } catch (err) {
+        console.error("❌ Electron compilation failed:", err.message)
+        nextProcess.kill()
+        process.exit(1)
+    }
+
+    // Start Electron
+    console.log("\n3. Starting Electron...")
+    const electronProcess = spawn("npm", ["run", "electron:start"], {
+        cwd: rootDir,
+        stdio: "inherit",
+        shell: true,
+        env: {
+            ...process.env,
+            NODE_ENV: "development",
+            ELECTRON_DEV_URL: NEXT_URL,
+        },
+    })
+
+    // Watch for preset config changes
+    const configPath = path.join(getUserDataPath(), "config-presets.json")
+    let configWatcher = null
+    let restartPending = false
+
+    function setupConfigWatcher() {
+        if (!existsSync(path.dirname(configPath))) {
+            // Directory doesn't exist yet, check again later
+            setTimeout(setupConfigWatcher, 5000)
+            return
+        }
+
+        try {
+            configWatcher = watch(
+                configPath,
+                { persistent: false },
+                async (eventType) => {
+                    if (eventType === "change" && !restartPending) {
+                        restartPending = true
+                        console.log(
+                            "\n🔄 Preset configuration changed, restarting Next.js server...",
+                        )
+
+                        // Kill current Next.js process
+                        nextProcess.kill()
+
+                        // Wait a bit for process to die
+                        await new Promise((r) => setTimeout(r, 1000))
+
+                        // Reload preset and restart
+                        const newPresetEnv = loadPresetConfig()
+                        nextProcess = startNextServer(newPresetEnv)
+
+                        try {
+                            await waitForServer(NEXT_URL)
+                            console.log(
+                                "✅ Next.js server restarted with new configuration\n",
+                            )
+                        } catch (err) {
+                            console.error(
+                                "❌ Failed to restart Next.js:",
+                                err.message,
+                            )
+                        }
+
+                        restartPending = false
+                    }
+                },
+            )
+            console.log("👀 Watching for preset configuration changes...")
+        } catch (err) {
+            // File might not exist yet, that's ok
+            setTimeout(setupConfigWatcher, 5000)
+        }
+    }
+
+    // Start watching after a delay (config file might not exist yet)
+    setTimeout(setupConfigWatcher, 2000)
+
+    electronProcess.on("close", (code) => {
+        console.log(`\nElectron exited with code ${code}`)
+        if (configWatcher) configWatcher.close()
+        nextProcess.kill()
+        process.exit(code || 0)
+    })
+
+    electronProcess.on("error", (err) => {
+        console.error("Electron error:", err)
+        if (configWatcher) configWatcher.close()
+        nextProcess.kill()
+        process.exit(1)
+    })
+
+    // Handle termination signals
+    const cleanup = () => {
+        console.log("\n🛑 Shutting down...")
+        if (configWatcher) configWatcher.close()
+        electronProcess.kill()
+        nextProcess.kill()
+        process.exit(0)
+    }
+
+    process.on("SIGINT", cleanup)
+    process.on("SIGTERM", cleanup)
+}
+
+main().catch((err) => {
+    console.error("Fatal error:", err)
+    process.exit(1)
+})

scripts/prepare-electron-build.mjs

@@ -0,0 +1,41 @@
+#!/usr/bin/env node
+
+/**
+ * Prepare standalone directory for Electron packaging
+ * Copies the Next.js standalone output to a temp directory
+ * that electron-builder can properly include
+ */
+
+import { cpSync, existsSync, mkdirSync, rmSync } from "node:fs"
+import { join } from "node:path"
+import { fileURLToPath } from "node:url"
+
+const __dirname = fileURLToPath(new URL(".", import.meta.url))
+const rootDir = join(__dirname, "..")
+
+const standaloneDir = join(rootDir, ".next", "standalone")
+const staticDir = join(rootDir, ".next", "static")
+const targetDir = join(rootDir, "electron-standalone")
+
+console.log("Preparing Electron build...")
+
+// Clean target directory
+if (existsSync(targetDir)) {
+    console.log("Cleaning previous build...")
+    rmSync(targetDir, { recursive: true })
+}
+
+// Create target directory
+mkdirSync(targetDir, { recursive: true })
+
+// Copy standalone (includes node_modules)
+console.log("Copying standalone directory...")
+cpSync(standaloneDir, targetDir, { recursive: true })
+
+// Copy static files
+console.log("Copying static files...")
+const targetStaticDir = join(targetDir, ".next", "static")
+mkdirSync(targetStaticDir, { recursive: true })
+cpSync(staticDir, targetStaticDir, { recursive: true })
+
+console.log("Done! Files prepared in electron-standalone/")

tsconfig.json

@@ -29,5 +29,5 @@
         ".next/types/**/*.ts",
         ".next/dev/types/**/*.ts"
     ],
-    "exclude": ["node_modules", "packages"]
+    "exclude": ["node_modules", "packages", "electron", "dist-electron"]
 }