Code review fixes: publish safety, SQL guard, unsaved edits, hardening

.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns: ['*']
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      npm-minor-patch:
+        update-types: [minor, patch]

.github/workflows/ci.yml

@@ -18,8 +18,8 @@ jobs:
     env:
       ELECTRON_SKIP_BINARY_DOWNLOAD: '1'
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '24'
           cache: npm

.github/workflows/release.yml

@@ -32,8 +32,8 @@ jobs:
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '24'
           cache: npm
@@ -49,7 +49,7 @@ jobs:
         run: npm run package
       - name: Check packaged sample worker and SQLite persistence
         run: npm run package:smoke
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ultracart-studio-${{ matrix.platform }}-${{ matrix.arch }}
           path: |
@@ -70,8 +70,8 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           pattern: ultracart-studio-*
           path: release-assets

.gitignore

@@ -22,3 +22,4 @@ coverage/
 credentials.enc*
 *.pem
 *.key
+downloads/

package.json

@@ -51,6 +51,7 @@
     "zod": "^4.3.6"
   },
   "devDependencies": {
+    "@electron/fuses": "^2.1.3",
     "@electron/packager": "^18.3.6",
     "@tailwindcss/vite": "^4.1.0",
     "@types/node": "^24.0.0",
@@ -59,10 +60,10 @@
     "@vitejs/plugin-react": "^5.0.0",
     "electron": "44.5.1",
     "esbuild": "^0.27.0",
+    "prettier": "^3.6.2",
     "tailwindcss": "^4.1.0",
     "tsx": "^4.20.0",
     "typescript": "^5.9.0",
-    "vite": "^7.3.0",
-    "prettier": "^3.6.2"
+    "vite": "^7.3.0"
   }
 }

scripts/package-smoke.mjs

@@ -1,4 +1,6 @@
 import { spawnSync } from 'node:child_process';
+import { getCurrentFuseWire, FuseV1Options, FuseState } from '@electron/fuses';
+import { createRequire } from 'node:module';
 import { mkdtemp, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
@@ -14,9 +16,28 @@ const executable =
   process.platform === 'darwin'
     ? join(directory, 'UltraCart Studio.app/Contents/MacOS/UltraCart Studio')
     : join(directory, process.platform === 'win32' ? 'UltraCart Studio.exe' : 'ultracart-studio');
+const bundle = process.platform === 'darwin' ? join(directory, 'UltraCart Studio.app') : executable;
+const fuses = await getCurrentFuseWire(bundle);
+const expected = {
+  RunAsNode: false,
+  EnableNodeOptionsEnvironmentVariable: false,
+  EnableNodeCliInspectArguments: false,
+  EnableEmbeddedAsarIntegrityValidation: true,
+  OnlyLoadAppFromAsar: true,
+};
+for (const [name, enabled] of Object.entries(expected)) {
+  const state = fuses[FuseV1Options[name]];
+  if (state !== (enabled ? FuseState.ENABLE : FuseState.DISABLE))
+    throw new Error(`Electron fuse ${name} must be ${enabled ? 'enabled' : 'disabled'}.`);
+}
+console.log('Electron fuses verified on the packaged executable.');
+// RunAsNode is off in the packaged binary, so run the worker checks with the matching unfused
+// development Electron runtime against the packaged app.asar.
+const runtime = createRequire(import.meta.url)('electron');
+if (typeof runtime !== 'string') throw new Error('Could not resolve the development Electron runtime.');
 const data = await mkdtemp(join(tmpdir(), 'studio-package-smoke-'));
 try {
-  const result = spawnSync(executable, [join(root, 'scripts/package-smoke.cjs'), resources, data], {
+  const result = spawnSync(runtime, [join(root, 'scripts/package-smoke.cjs'), resources, data], {
     env: { ...process.env, ELECTRON_RUN_AS_NODE: '1' },
     stdio: 'inherit',
     timeout: 60000,

scripts/package.mjs

@@ -1,4 +1,5 @@
 import packager from '@electron/packager';
+import { flipFuses, FuseV1Options, FuseVersion } from '@electron/fuses';
 import { createHash } from 'node:crypto';
 import { createReadStream, existsSync } from 'node:fs';
 import { chmod, copyFile, readFile, rm, writeFile } from 'node:fs/promises';
@@ -57,6 +58,20 @@ function run(command, args, options = {}) {
   if (result.status !== 0) throw new Error(`${command} exited with ${result.status ?? result.signal}.`);
 }
 for (const directory of paths) {
+  // The asar archive is mandatory (asar: true above), so asar-only loading and integrity are safe to enforce.
+  const executable =
+    platform === 'darwin'
+      ? join(directory, 'UltraCart Studio.app')
+      : join(directory, platform === 'win32' ? 'UltraCart Studio.exe' : 'ultracart-studio');
+  await flipFuses(executable, {
+    version: FuseVersion.V1,
+    resetAdHocDarwinSignature: platform === 'darwin' && arch === 'arm64',
+    [FuseV1Options.RunAsNode]: false,
+    [FuseV1Options.EnableNodeOptionsEnvironmentVariable]: false,
+    [FuseV1Options.EnableNodeCliInspectArguments]: false,
+    [FuseV1Options.EnableEmbeddedAsarIntegrityValidation]: true,
+    [FuseV1Options.OnlyLoadAppFromAsar]: true,
+  });
   const resources =
     platform === 'darwin'
       ? join(directory, 'UltraCart Studio.app/Contents/Resources')

src/main/content-map.ts

@@ -2,6 +2,7 @@ import type { DraftScope } from '../shared/drafts';
 import { parseContentMap, type ContentMap } from '../shared/content-map';
 import { isSampleSelection } from '../shared/sample';
 import type { ConnectionService } from './domain/connection-service';
+import { parseJson } from './domain/draft-service';
 
 export async function readContentMap(
   connection: Pick<ConnectionService, 'verify' | 'run'>,
@@ -46,7 +47,7 @@ export async function readContentMap(
     ],
     { acceptedExitCodes: [0, 1] }
   );
-  const result = parseContentMap(JSON.parse(raw), scope);
+  const result = parseContentMap(parseJson(raw, 'The toolkit returned an unreadable content map.'), scope);
   await connection.verify(scope.selection);
   return result;
 }

src/main/database.ts

@@ -4,6 +4,23 @@ import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import type { Activity, Session } from '../shared/types';
 
+function parse<T>(text: string, message: string): T {
+  try {
+    return JSON.parse(text) as T;
+  } catch {
+    throw new Error(message);
+  }
+}
+function readable<T>(rows: Record<string, unknown>[], table: string): T[] {
+  return rows.flatMap((row) => {
+    try {
+      return [JSON.parse(row.value as string) as T];
+    } catch {
+      console.error(`Skipped an unreadable ${table} row.`);
+      return [];
+    }
+  });
+}
 export class Store {
   readonly db: DatabaseSync;
   constructor(readonly directory: string) {
@@ -29,7 +46,7 @@ export class Store {
   get<T>(key: string, fallback: T): T {
     const row = this.db.prepare('SELECT value FROM kv WHERE key = ?').get(key) as
       { value: string } | undefined;
-    return row ? (JSON.parse(row.value) as T) : fallback;
+    return row ? parse<T>(row.value, `Saved ${key.split(':')[0]} data is unreadable.`) : fallback;
   }
   set(key: string, value: unknown) {
     this.db
@@ -38,11 +55,14 @@ export class Store {
       )
       .run(key, JSON.stringify(value));
   }
+  delete(key: string) {
+    this.db.prepare('DELETE FROM kv WHERE key = ?').run(key);
+  }
   session(id: string): Session {
     const row = this.db.prepare('SELECT value FROM sessions WHERE id = ?').get(id) as
       { value: string } | undefined;
     if (!row) throw new Error('This conversation no longer exists.');
-    return JSON.parse(row.value);
+    return parse(row.value, 'This conversation is unreadable.');
   }
   saveSession(session: Session) {
     this.db
@@ -57,19 +77,23 @@ export class Store {
           .prepare('SELECT value FROM sessions WHERE workspace_id = ? ORDER BY updated_at DESC LIMIT 100')
           .all(workspaceId)
       : this.db.prepare('SELECT value FROM sessions ORDER BY updated_at DESC LIMIT 100').all();
-    return rows.map((row) => JSON.parse(row.value as string));
+    return readable(rows, 'conversation');
   }
   pendingSessions(): Session[] {
-    return this.db
-      .prepare("SELECT value FROM sessions WHERE json_extract(value, '$.status') = ?")
-      .all('working')
-      .map((row) => JSON.parse(row.value as string));
+    return readable(
+      this.db
+        .prepare("SELECT value FROM sessions WHERE json_valid(value) AND json_extract(value, '$.status') = ?")
+        .all('working'),
+      'conversation'
+    );
   }
   activity(workspaceId: string): Activity[] {
-    return this.db
-      .prepare('SELECT value FROM activity WHERE workspace_id = ? ORDER BY at DESC LIMIT 40')
-      .all(workspaceId)
-      .map((row) => JSON.parse(row.value as string));
+    return readable(
+      this.db
+        .prepare('SELECT value FROM activity WHERE workspace_id = ? ORDER BY at DESC LIMIT 40')
+        .all(workspaceId),
+      'activity'
+    );
   }
   log(workspaceId: string, kind: Activity['kind'], text: string, detail = '') {
     const item: Activity = {

src/main/domain/connection-service.ts

@@ -120,7 +120,11 @@ export function safeFailure(text: string) {
   return 'The toolkit could not complete the request. Check the selected profile, network, and installed toolkit, then retry.';
 }
 
+export type ChildObserver = (pid: number, state: 'started' | 'exited') => void;
+
 export class ConnectionService {
+  /** Lets the worker report toolkit child pids so the main process can kill them if the worker dies. */
+  static childObserver: ChildObserver | null = null;
   private children = new Set<ChildProcessWithoutNullStreams>();
   private login: Login | null = null;
   private loginChild: ChildProcessWithoutNullStreams | null = null;
@@ -197,15 +201,15 @@ export class ConnectionService {
           ...invocation.options,
           detached: process.platform !== 'win32',
         });
-        this.children.add(child);
+        this.track(child);
         let stdout = '',
           stderr = '',
           finished = false;
         const finish = (error?: Error) => {
           if (finished) return;
           finished = true;
           clearTimeout(timer);
-          this.children.delete(child);
+          this.untrack(child);
           if (error) reject(error);
           else resolve(stdout.trim());
         };
@@ -352,14 +356,14 @@ export class ConnectionService {
       if (this.disposed || this.login.phase !== 'starting') throw new Error('Sign-in cancelled.');
       const child = spawn(invocation.command, invocation.args, invocation.options);
       this.loginChild = child;
-      this.children.add(child);
+      this.track(child);
       child.stdin.end();
       let stderr = '',
         stdout = '';
       const finish = (phase: Login['phase'], message: string) => {
         if (this.loginTimer) clearTimeout(this.loginTimer);
         this.loginTimer = null;
-        this.children.delete(child);
+        this.untrack(child);
         if (this.loginChild === child) this.loginChild = null;
         if (this.login?.id === id && ['starting', 'waiting'].includes(this.login.phase))
           this.login = { id, profile, phase, message, url: null, code: null };
@@ -441,11 +445,24 @@ export class ConnectionService {
   dispose() {
     this.disposed = true;
     if (this.loginTimer) clearTimeout(this.loginTimer);
-    for (const child of this.children) this.stopChild(child);
-    this.children.clear();
+    for (const child of this.children) {
+      this.stopChild(child);
+      this.untrack(child);
+    }
     this.login = null;
     this.loginChild = null;
   }
+  private track(child: ChildProcessWithoutNullStreams) {
+    this.children.add(child);
+    if (child.pid) ConnectionService.childObserver?.(child.pid, 'started');
+    // The pid stays reported until the process has really exited, even after we stop waiting for it.
+    child.once('exit', () => {
+      if (child.pid) ConnectionService.childObserver?.(child.pid, 'exited');
+    });
+  }
+  private untrack(child: ChildProcessWithoutNullStreams) {
+    this.children.delete(child);
+  }
   private stopChild(child: ChildProcessWithoutNullStreams) {
     if (process.platform !== 'win32' && child !== this.loginChild && child.pid) {
       try {