Report composition failures non-fatally and surface them to the user

A plugin whose assembly won't load, or an exported command whose
constructor can't be satisfied, previously either blanked the app into the
startup error window or threw mid-build and took the whole menu/toolbar
down with it. Collect such failures in a CompositionErrors sink instead,
skip the offending part, keep running, and show the errors in a document
tab via an ITextOutput once the window is up. Add a Composition log
category for opt-in file logging.

Assisted-by: Claude:claude-opus-4-8:Claude Code

ILSpy.Tests/AppEnv/CompositionErrorsTests.cs

@@ -0,0 +1,58 @@
+// Copyright (c) 2026 AlphaSierraPapa for the SharpDevelop Team
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy of this
+// software and associated documentation files (the "Software"), to deal in the Software
+// without restriction, including without limitation the rights to use, copy, modify, merge,
+// publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons
+// to whom the Software is furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all copies or
+// substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
+// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
+// PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE
+// FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+// DEALINGS IN THE SOFTWARE.
+
+using System;
+
+using AwesomeAssertions;
+
+using ICSharpCode.Decompiler;
+
+using ILSpy.AppEnv;
+
+using NUnit.Framework;
+
+namespace ICSharpCode.ILSpy.Tests.AppEnv;
+
+/// <summary>
+/// Composition errors are collected non-fatally and can be rendered to an <see cref="ITextOutput"/>
+/// for display to the user (the source label and the exception text both appear).
+/// </summary>
+[TestFixture]
+public class CompositionErrorsTests
+{
+	// The sink is a process-global static. Leaving entries behind would make every later test that
+	// boots MainWindow pop a "Composition Errors" tab, so clear it after each test here.
+	[TearDown]
+	public void TearDown() => CompositionErrors.Clear();
+
+	[Test]
+	public void Report_Collects_The_Error_And_WriteTo_Renders_It()
+	{
+		var marker = "Plugin 'Marker_" + Guid.NewGuid().ToString("N") + "'";
+		CompositionErrors.Report(marker, new InvalidOperationException("boom-message"));
+
+		CompositionErrors.Any.Should().BeTrue();
+
+		var output = new PlainTextOutput();
+		CompositionErrors.WriteTo(output);
+		var text = output.ToString();
+
+		text.Should().Contain(marker, "the failing part's label is shown");
+		text.Should().Contain("boom-message", "the exception detail is shown");
+	}
+}

ILSpy/AppEnv/AppComposition.cs

@@ -107,7 +107,9 @@ namespace ILSpy.AppEnv
 				}
 				catch (Exception ex)
 				{
-					StartupExceptions.Items.Add(new ExceptionData(ex) { PluginName = name });
+					// Non-fatal: a plugin that won't load is skipped and reported to the user,
+					// rather than aborting startup into the error window.
+					CompositionErrors.Report($"Plugin '{name}'", ex);
 				}
 				if (assembly != null)
 					yield return assembly;

ILSpy/AppEnv/AppLog.cs

@@ -67,6 +67,14 @@ namespace ILSpy.AppEnv
 			/// default; opt in with <c>ILSPY_LOG=DBUSDEBUG</c> (matched case-insensitively).
 			/// </summary>
 			public const string DBusDebug = "DBusDebug";
+
+			/// <summary>
+			/// Non-fatal MEF composition failures collected by <see cref="CompositionErrors"/> — a
+			/// plugin assembly that won't load, or an exported command whose constructor throws when
+			/// the menu/toolbar builder materialises it. Errors are always shown to the user in a
+			/// document tab; opt in with <c>ILSPY_LOG=Composition</c> to also log them to file.
+			/// </summary>
+			public const string Composition = "Composition";
 		}
 
 		static readonly Stopwatch sw = Stopwatch.StartNew();

ILSpy/AppEnv/CompositionErrors.cs

@@ -0,0 +1,67 @@
+// Copyright (c) 2026 AlphaSierraPapa for the SharpDevelop Team
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy of this
+// software and associated documentation files (the "Software"), to deal in the Software
+// without restriction, including without limitation the rights to use, copy, modify, merge,
+// publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons
+// to whom the Software is furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all copies or
+// substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
+// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
+// PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE
+// FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+// DEALINGS IN THE SOFTWARE.
+
+using System;
+using System.Collections.Generic;
+
+using ICSharpCode.Decompiler;
+
+namespace ILSpy.AppEnv
+{
+	/// <summary>A single non-fatal composition failure: which part failed, and why.</summary>
+	public sealed record CompositionError(string Source, Exception Exception);
+
+	/// <summary>
+	/// Collects non-fatal MEF composition failures -- a plugin assembly that fails to load, or an
+	/// exported command whose constructor throws when the menu/toolbar builder materialises it.
+	/// Unlike <see cref="StartupExceptions"/> (fatal startup errors that replace the app with an
+	/// error window), these are recoverable: the offending part is skipped, the app keeps running,
+	/// and the collected errors are surfaced to the user in a document tab (see <see cref="WriteTo"/>)
+	/// and, when <see cref="AppLog.Category.Composition"/> is enabled, written to the log file.
+	/// </summary>
+	public static class CompositionErrors
+	{
+		static readonly List<CompositionError> items = new();
+
+		public static IReadOnlyList<CompositionError> Items => items;
+
+		public static bool Any => items.Count > 0;
+
+		/// <summary>Records a composition failure and logs it under the Composition category.</summary>
+		public static void Report(string source, Exception exception)
+		{
+			items.Add(new CompositionError(source, exception));
+			AppLog.Write(AppLog.Category.Composition, $"{source}: {exception}");
+		}
+
+		/// <summary>Clears the collected errors. Intended for test isolation.</summary>
+		public static void Clear() => items.Clear();
+
+		/// <summary>Renders every collected error into <paramref name="output"/> for display.</summary>
+		public static void WriteTo(ITextOutput output)
+		{
+			ArgumentNullException.ThrowIfNull(output);
+			foreach (var error in items)
+			{
+				output.WriteLine($"[{error.Source}]");
+				output.WriteLine(error.Exception.ToString());
+				output.WriteLine();
+			}
+		}
+	}
+}

ILSpy/Docking/DockWorkspace.cs

@@ -1111,6 +1111,21 @@ namespace ILSpy.Docking
 		/// </summary>
 		public void ShowToolPane(string contentId) => factory.ShowToolPane(contentId);
 
+		/// <summary>
+		/// Opens a fresh frozen tab showing the supplied pre-rendered text output. Used to surface
+		/// reports that aren't tied to a tree node (e.g. composition-error listings).
+		/// </summary>
+		public void ShowTextInNewTab(string title, TextView.AvaloniaEditTextOutput output)
+		{
+			ArgumentNullException.ThrowIfNull(output);
+			var content = new TextView.DecompilerTabPageModel {
+				Language = languageService.CurrentLanguage,
+				Title = title,
+			};
+			OpenNewTab(content);
+			content.ShowText(output);
+		}
+
 		void ExecuteShowSearch()
 		{
 			ShowToolPane(ILSpy.Search.SearchPaneModel.PaneContentId);

ILSpy/Views/MainMenu.axaml.cs

@@ -22,13 +22,13 @@ using System.Composition;
 using System.Linq;
 using System.Windows.Input;
 
+using CommunityToolkit.Mvvm.Input;
+
 using global::Avalonia;
 using global::Avalonia.Controls;
 using global::Avalonia.Data;
 using global::Avalonia.Input;
 
-using CommunityToolkit.Mvvm.Input;
-
 using ICSharpCode.ILSpy.Properties;
 
 using ILSpy.AppEnv;
@@ -232,7 +232,19 @@ public static class MainMenu
 					}
 					else
 					{
-						var command = entry.CreateExport().Value;
+						ICommand command;
+						try
+						{
+							// Isolate each entry: instantiating a command export can throw for a
+							// misbehaving plugin (e.g. a DI ctor without [ImportingConstructor]); one
+							// bad command must not take down the whole menu bar.
+							command = entry.CreateExport().Value;
+						}
+						catch (Exception ex)
+						{
+							AppEnv.CompositionErrors.Report($"Main-menu command '{entry.Metadata?.Header}'", ex);
+							continue;
+						}
 						// No explicit IsEnabled: assigning Command lets NativeMenuItem track the
 						// command's CanExecute, so OS-gated commands (e.g. Open from GAC, which is
 						// Windows-only) grey out correctly. A hard-coded IsEnabled would override

ILSpy/Views/MainToolBar.axaml.cs

@@ -194,7 +194,18 @@ public partial class MainToolBar : UserControl
 
 	static Button? BuildButton(ExportFactory<System.Windows.Input.ICommand, ToolbarCommandMetadata> entry)
 	{
-		var command = entry.CreateExport().Value;
+		System.Windows.Input.ICommand command;
+		try
+		{
+			// Isolate each entry: a misbehaving plugin command (e.g. a DI ctor without
+			// [ImportingConstructor]) must not take down the whole toolbar.
+			command = entry.CreateExport().Value;
+		}
+		catch (System.Exception ex)
+		{
+			ILSpy.AppEnv.CompositionErrors.Report($"Toolbar command '{entry.Metadata.ToolTip}'", ex);
+			return null;
+		}
 		var button = new Button {
 			Tag = entry.Metadata.ToolTip,
 			Command = command,

ILSpy/Views/MainWindow.axaml.cs

@@ -68,10 +68,34 @@ namespace ILSpy.Views
 				AppLog.Mark("MainWindow.Opened handler returning");
 				if (App.CommandLineArguments is { } args)
 					await viewModel.AssemblyTreeModel.HandleCommandLineArgumentsAsync(args);
+				// Surface any non-fatal composition failures (failed plugins, uninstantiable menu/
+				// toolbar commands) once the menu and toolbar have finished building. Deferred to a
+				// later dispatcher turn so those builders' own Loaded handlers have run first.
+				Avalonia.Threading.Dispatcher.UIThread.Post(SurfaceCompositionErrors,
+					Avalonia.Threading.DispatcherPriority.Background);
 			};
 			AppLog.Mark("MainWindow ctor exited");
 		}
 
+		static void SurfaceCompositionErrors()
+		{
+			if (!AppEnv.CompositionErrors.Any)
+				return;
+			try
+			{
+				var output = new TextView.AvaloniaEditTextOutput { Title = "Composition Errors" };
+				AppEnv.CompositionErrors.WriteTo(output);
+				AppEnv.AppComposition.Current
+					.GetExport<ILSpy.Docking.DockWorkspace>()
+					.ShowTextInNewTab("Composition Errors", output);
+			}
+			catch (System.Exception ex)
+			{
+				// Surfacing the report must never itself crash startup.
+				System.Diagnostics.Debug.WriteLine($"[MainWindow] SurfaceCompositionErrors failed: {ex}");
+			}
+		}
+
 		void ApplySessionSettings(SessionSettings session)
 		{
 			Position = session.WindowPosition;