@zerwiz/ymir 0.1.33 → 0.1.35

package/apps/sessrumnir/src/main/ipc/skills-mcp-handlers.ts

@@ -0,0 +1,192 @@
+import { ipcMain } from 'electron'
+import { IPC_CHANNELS } from '../../shared/ipc-contracts'
+import { readFile } from 'fs/promises'
+import { join } from 'path'
+import { existsSync } from 'fs'
+import type { IpcContext } from './context'
+import { getPiCli } from '../pi-rpc-manager'
+import { listSkills, mergeRpcSkills } from '../skills-discovery'
+
+export function registerSkillsMcpHandlers(ctx: IpcContext): void {
+  const { workspaceManager } = ctx
+
+  // ─── Skills ─────────────────────────────────────────────────────────────
+
+  ipcMain.handle(IPC_CHANNELS.SKILLS_LIST, async () => {
+    const ws = workspaceManager.getActiveWorkspace()
+    const cwd = ws?.path ?? process.cwd()
+    const pi = workspaceManager.getActivePiManager()
+    const engine = pi?.getEngineKind() ?? getPiCli().kind ?? 'pi'
+    const skills = await listSkills(cwd, engine)
+    // The disk scan cannot see skills shipped by installed packages/plugins,
+    // but the running engine reports them in its command catalog — merge those
+    // in so the panel matches what the agent can actually invoke.
+    if (pi && pi.getStatus().status === 'running') {
+      mergeRpcSkills(skills, await fetchCommands(pi))
+    }
+    return skills
+  })
+
+  ipcMain.handle(IPC_CHANNELS.COMMANDS_LIST, async () => {
+    const pi = workspaceManager.getActivePiManager()
+    if (!pi || pi.getStatus().status !== 'running') return []
+    return fetchCommands(pi)
+  })
+
+  ipcMain.handle(IPC_CHANNELS.MCP_SERVERS_LIST, async () => {
+    const ws = workspaceManager.getActiveWorkspace()
+    return listMcpServers(ws?.path)
+  })
+}
+
+// ─── Command Catalog ─────────────────────────────────────────────────────────
+
+/** Command catalog from the running engine (Pi and OMP name the request differently). */
+async function fetchCommands(pi: {
+  getEngineKind(): 'pi' | 'omp'
+  sendCommand(command: Record<string, unknown>): Promise<unknown>
+}): Promise<unknown[]> {
+  try {
+    const command = pi.getEngineKind() === 'omp' ? 'get_available_commands' : 'get_commands'
+    const response = (await pi.sendCommand({ type: command })) as {
+      success?: boolean
+      data?: { commands?: unknown[] }
+    } | null
+    if (response?.success && Array.isArray(response.data?.commands)) {
+      return response.data.commands
+    }
+    return []
+  } catch {
+    return []
+  }
+}
+
+// ─── MCP Server Discovery ────────────────────────────────────────────────────
+
+interface McpServerInfo {
+  name: string
+  command: string
+  args: string[]
+  env: Record<string, string>
+  source: 'global' | 'project'
+  status: 'configured' | 'unknown'
+}
+
+async function listMcpServers(wsPath?: string): Promise<McpServerInfo[]> {
+  const servers: McpServerInfo[] = []
+  const homeDir = process.env.HOME ?? process.env.USERPROFILE ?? ''
+  const omp = getPiCli().kind === 'omp'
+  const globalSettingsPaths = omp
+    ? [
+        join(homeDir, '.omp', 'agent', 'mcp.json'),
+        join(homeDir, '.omp', 'agent', '.mcp.json'),
+        join(homeDir, '.pi', 'agent', 'settings.json'),
+      ]
+    : [
+        join(homeDir, '.pi', 'agent', 'settings.json'),
+        join(homeDir, '.omp', 'agent', 'mcp.json'),
+        join(homeDir, '.omp', 'agent', '.mcp.json'),
+      ]
+  for (const settingsPath of globalSettingsPaths) {
+    await collectMcpServers(settingsPath, servers, 'global')
+  }
+
+  if (wsPath) {
+    const projectSettingsPaths = omp
+      ? [
+          join(wsPath, '.omp', 'mcp.json'),
+          join(wsPath, '.omp', '.mcp.json'),
+          join(wsPath, '.pi', 'settings.json'),
+        ]
+      : [
+          join(wsPath, '.pi', 'settings.json'),
+          join(wsPath, '.omp', 'mcp.json'),
+          join(wsPath, '.omp', '.mcp.json'),
+        ]
+    for (const settingsPath of projectSettingsPaths) {
+      await collectMcpServers(settingsPath, servers, 'project')
+    }
+  }
+
+  const mcpConfigPaths = [
+    join(homeDir, '.config', 'claude', 'claude_desktop_config.json'),
+    join(homeDir, '.cursor', 'mcp.json'),
+    join(homeDir, '.codeium', 'mcp.json'),
+  ]
+  for (const configPath of mcpConfigPaths) {
+    await collectMcpServersFromConfig(configPath, servers)
+  }
+
+  const unique = new Map<string, McpServerInfo>()
+  for (const server of servers) {
+    const existing = unique.get(server.name)
+    if (!existing || (existing.source === 'global' && server.source === 'project')) {
+      unique.set(server.name, server)
+    }
+  }
+  return [...unique.values()]
+}
+
+async function collectMcpServers(
+  settingsPath: string,
+  servers: McpServerInfo[],
+  source: 'global' | 'project'
+): Promise<void> {
+  try {
+    if (!existsSync(settingsPath)) return
+    const content = await readFile(settingsPath, 'utf-8')
+    const settings = JSON.parse(content)
+
+    // Pi settings may have mcpServers under various keys
+    const mcpServers = settings.mcpServers ?? settings.mcp?.servers ?? {}
+
+    for (const [name, config] of Object.entries(mcpServers)) {
+      if (typeof config === 'object' && config !== null) {
+        const cfg = config as Record<string, unknown>
+        servers.push({
+          name,
+          command: String(cfg.command ?? ''),
+          args: Array.isArray(cfg.args) ? cfg.args.map(String) : [],
+          env: typeof cfg.env === 'object' && cfg.env !== null ? cfg.env as Record<string, string> : {},
+          source,
+          status: 'configured',
+        })
+      }
+    }
+  } catch {
+    // Skip unreadable files
+  }
+}
+
+async function collectMcpServersFromConfig(
+  configPath: string,
+  servers: McpServerInfo[]
+): Promise<void> {
+  try {
+    if (!existsSync(configPath)) return
+    const content = await readFile(configPath, 'utf-8')
+    const config = JSON.parse(content)
+
+    // Claude Desktop format: { mcpServers: { name: { command, args } } }
+    const mcpServers = config.mcpServers ?? {}
+
+    for (const [name, serverConfig] of Object.entries(mcpServers)) {
+      if (typeof serverConfig === 'object' && serverConfig !== null) {
+        const cfg = serverConfig as Record<string, unknown>
+        // Avoid duplicates
+        if (!servers.some((s) => s.name === name)) {
+          servers.push({
+            name,
+            command: String(cfg.command ?? ''),
+            args: Array.isArray(cfg.args) ? cfg.args.map(String) : [],
+            env: typeof cfg.env === 'object' && cfg.env !== null ? cfg.env as Record<string, string> : {},
+            source: 'global',
+            status: 'configured',
+          })
+        }
+      }
+    }
+  } catch {
+    // Skip unreadable files
+  }
+}

package/apps/sessrumnir/src/main/ipc/system-handlers.ts

@@ -0,0 +1,131 @@
+import { ipcMain, dialog, shell, app } from 'electron'
+import type { ActivityStatsResult, OpenDialogOptions } from '../../shared/ipc-contracts'
+import { IPC_CHANNELS } from '../../shared/ipc-contracts'
+import { activityStatsStore } from '../activity-stats'
+import { stat } from 'fs/promises'
+import { resolve } from 'path'
+import { isString, isObject } from './validation'
+import type { IpcContext } from './context'
+import { t } from '../../shared/i18n'
+
+type OpenDialogMode = NonNullable<OpenDialogOptions['mode']>
+
+/**
+ * Only macOS shows one dialog that accepts a file OR a directory. Windows and
+ * Linux silently turn `['openFile', 'openDirectory']` into a directory-only
+ * selector, which would take the file half of `mode: 'either'` away from every
+ * platform this app actually ships to. Degrade to the file half there instead:
+ * a directory is reachable by asking for `mode: 'directory'`, an executable
+ * inside one is not reachable from a directory picker at all.
+ */
+const SUPPORTS_COMBINED_DIALOG = process.platform === 'darwin'
+
+function dialogProperties(mode: OpenDialogMode): Electron.OpenDialogOptions['properties'] {
+  if (mode === 'directory') return ['openDirectory']
+  if (mode === 'either' && SUPPORTS_COMBINED_DIALOG) return ['openFile', 'openDirectory']
+  return ['openFile']
+}
+
+export function registerSystemHandlers(ctx: IpcContext): void {
+  const { approvedAttachmentPaths } = ctx
+
+  // ─── System ─────────────────────────────────────────────────────────────
+
+  ipcMain.handle(IPC_CHANNELS.SYSTEM_OPEN_DIALOG, async (_event, options?: unknown) => {
+    // Default to directory selection for back-compat with workspace pickers.
+    const mode: OpenDialogMode = isObject(options) && (options.mode === 'file' || options.mode === 'either')
+      ? options.mode
+      : 'directory'
+    // Only the explicit attachment mode widens the attachment allowlist; a
+    // path chosen for a settings field is never read back as file content.
+    const pickFile = mode === 'file'
+    const dialogOptions: Electron.OpenDialogOptions = {
+      properties: dialogProperties(mode),
+    }
+    if (isObject(options)) {
+      if (isString(options.title)) dialogOptions.title = options.title
+      if (Array.isArray(options.filters)) {
+        dialogOptions.filters = options.filters as Electron.FileFilter[]
+      }
+    }
+    const result = await dialog.showOpenDialog(dialogOptions)
+    if (result.canceled || result.filePaths.length === 0) return null
+    const picked = result.filePaths[0]
+    // Remember file picks so the attachment reader will accept this exact path
+    // even when it lives outside the workspace.
+    if (pickFile) approvedAttachmentPaths.add(resolve(picked))
+    return picked
+  })
+
+  ipcMain.handle(IPC_CHANNELS.SYSTEM_GET_PATH, async (_event, name: unknown) => {
+    if (!isString(name)) throw new Error('name must be a string')
+    if (name === 'ymirRoot') {
+      // The Ymir repo root: the launcher sets it; else derive it (dev layout is
+      // <root>/apps/sessrumnir, so three levels up).
+      const fromEnv = process.env.YMIR_ROOT
+      return fromEnv && fromEnv.length > 0 ? fromEnv : resolve(app.getAppPath(), '..', '..', '..')
+    }
+    const validPaths = ['home', 'appData', 'userData', 'temp', 'desktop', 'documents'] as const
+    if (validPaths.includes(name as (typeof validPaths)[number])) {
+      return app.getPath(name as 'home' | 'appData' | 'userData' | 'temp' | 'desktop' | 'documents')
+    }
+    throw new Error(`Invalid path name: ${name}`)
+  })
+
+  /** Classify a filesystem path for drag-drop (folder → open as workspace). */
+  ipcMain.handle(IPC_CHANNELS.SYSTEM_PATH_KIND, async (_event, filePath: unknown) => {
+    if (!isString(filePath) || filePath.trim().length === 0) {
+      return { exists: false, isDirectory: false }
+    }
+    try {
+      const st = await stat(filePath)
+      return { exists: true, isDirectory: st.isDirectory() }
+    } catch {
+      return { exists: false, isDirectory: false }
+    }
+  })
+
+  ipcMain.handle(IPC_CHANNELS.SYSTEM_OPEN_EXTERNAL, async (_event, url: unknown) => {
+    if (!isString(url)) throw new Error('url must be a string')
+    if (!url.startsWith('https://') && !url.startsWith('http://')) {
+      throw new Error(t('errors.system.externalUrlHttpOnly'))
+    }
+    await shell.openExternal(url)
+  })
+
+  /**
+   * Where the Hall — the public landing page — lives. On this machine the site
+   * is usually served locally (:4322), so prefer that when it answers and fall
+   * back to the public hostname otherwise. The probe lives here, not in the
+   * renderer: the renderer's CSP allows no cross-origin fetch.
+   */
+  ipcMain.handle(IPC_CHANNELS.SYSTEM_HALL_URL, async () => {
+    // LOCAL ONLY. The hall is served on this machine; when it is not running the
+    // seat says so. It must never reach for a public hostname - an Electron window
+    // has no business with Cloudflare, and a desktop app that dials out is a
+    // desktop app that leaks its errands.
+    return process.env.YMIR_HALL_URL ?? 'http://127.0.0.1:4322'
+  })
+
+  ipcMain.handle(IPC_CHANNELS.FLEET_LIST, async () => {
+    // Who is standing, from the ONE source: the control plane's connector reads
+    // herdr's live panes. Nothing is inferred here; if it cannot answer, the
+    // seat says empty rather than inventing a fleet.
+    try {
+      const { execFileSync } = await import('node:child_process');
+      const out = execFileSync(process.env.YMIR_ROOT ? `${process.env.YMIR_ROOT}/bin/hlidskjalf-agents.sh` : 'hlidskjalf-agents.sh',
+        [], { timeout: 4000 }).toString().trim();
+      return out.startsWith('[') ? JSON.parse(out) : [];
+    } catch {
+      return [];
+    }
+  })
+
+  ipcMain.handle(IPC_CHANNELS.SYSTEM_GET_VERSION, async () => {
+    return app.getVersion()
+  })
+
+  ipcMain.handle(IPC_CHANNELS.ACTIVITY_GET_STATS, async (): Promise<ActivityStatsResult> => {
+    return activityStatsStore.computeStats()
+  })
+}

package/apps/sessrumnir/src/main/ipc/tag-handlers.ts

@@ -0,0 +1,69 @@
+import { ipcMain } from 'electron'
+import { IPC_CHANNELS } from '../../shared/ipc-contracts'
+import { isString } from './validation'
+import type { IpcContext } from './context'
+
+export function registerTagHandlers(ctx: IpcContext): void {
+  const { tagManager } = ctx
+
+  // ─── Session Tags ───────────────────────────────────────────────────────
+
+  ipcMain.handle(IPC_CHANNELS.TAG_GET, async (_event, sessionId: unknown) => {
+    if (!isString(sessionId)) throw new Error('sessionId must be a string')
+    return tagManager.getTags(sessionId)
+  })
+
+  ipcMain.handle(IPC_CHANNELS.TAG_SET, async (_event, sessionId: unknown, tags: unknown) => {
+    if (!isString(sessionId)) throw new Error('sessionId must be a string')
+    if (!Array.isArray(tags)) throw new Error('tags must be an array')
+    await tagManager.setTags(sessionId, tags.map(String))
+    return tagManager.getTags(sessionId)
+  })
+
+  ipcMain.handle(IPC_CHANNELS.TAG_ADD, async (_event, sessionId: unknown, tag: unknown) => {
+    if (!isString(sessionId)) throw new Error('sessionId must be a string')
+    if (!isString(tag)) throw new Error('tag must be a string')
+    return tagManager.addTag(sessionId, tag)
+  })
+
+  ipcMain.handle(IPC_CHANNELS.TAG_REMOVE, async (_event, sessionId: unknown, tag: unknown) => {
+    if (!isString(sessionId)) throw new Error('sessionId must be a string')
+    if (!isString(tag)) throw new Error('tag must be a string')
+    return tagManager.removeTag(sessionId, tag)
+  })
+
+  ipcMain.handle(IPC_CHANNELS.TAG_GET_ALL, async () => {
+    return tagManager.getAllTags()
+  })
+
+  ipcMain.handle(IPC_CHANNELS.TAG_GET_ALL_USED, async () => {
+    return tagManager.getAllUsedTags()
+  })
+
+  ipcMain.handle(IPC_CHANNELS.TAG_AUTO_GET_ALL, async () => {
+    return tagManager.getAutoTags()
+  })
+
+  ipcMain.handle(IPC_CHANNELS.TAG_AUTO_ENSURE, async (_event, sessions: unknown) => {
+    if (!Array.isArray(sessions)) throw new Error('sessions must be an array')
+    const refs: Array<{ sessionId: string; path: string }> = []
+    for (const s of sessions) {
+      if (
+        typeof s === 'object' && s !== null &&
+        isString((s as { sessionId?: unknown }).sessionId) &&
+        isString((s as { path?: unknown }).path)
+      ) {
+        refs.push({
+          sessionId: (s as { sessionId: string }).sessionId,
+          path: (s as { path: string }).path,
+        })
+      }
+    }
+    return tagManager.ensureAutoTags(refs)
+  })
+
+  ipcMain.handle(IPC_CHANNELS.TAG_AUTO_REMOVE, async (_event, sessionId: unknown) => {
+    if (!isString(sessionId)) throw new Error('sessionId must be a string')
+    await tagManager.removeAutoTag(sessionId)
+  })
+}

package/apps/sessrumnir/src/main/ipc/terminal-handlers.ts

@@ -0,0 +1,41 @@
+import { ipcMain } from 'electron'
+import { IPC_CHANNELS } from '../../shared/ipc-contracts'
+import { assertTrustedSender, isString, isObject } from './validation'
+import type { IpcContext } from './context'
+
+export function registerTerminalHandlers(ctx: IpcContext): void {
+  const { workspaceManager, terminalService, broadcast } = ctx
+
+  // ─── Terminal ──────────────────────────────────────────────────────────
+
+  ipcMain.handle(IPC_CHANNELS.TERMINAL_START, async (event, options: unknown) => {
+    assertTrustedSender(event)
+    const opts = isObject(options) ? options : {}
+    return terminalService.start(
+      {
+        cwd: isString(opts.cwd) ? opts.cwd : workspaceManager.getActiveWorkspace()?.path,
+        cols: typeof opts.cols === 'number' ? opts.cols : undefined,
+        rows: typeof opts.rows === 'number' ? opts.rows : undefined,
+      },
+      (data) => broadcast(IPC_CHANNELS.EVENT_TERMINAL_DATA, data),
+      (event) => broadcast(IPC_CHANNELS.EVENT_TERMINAL_EXIT, event)
+    )
+  })
+
+  ipcMain.handle(IPC_CHANNELS.TERMINAL_INPUT, async (event, data: unknown) => {
+    assertTrustedSender(event)
+    if (!isString(data)) throw new Error('terminal input must be a string')
+    terminalService.write(data)
+  })
+
+  ipcMain.handle(IPC_CHANNELS.TERMINAL_RESIZE, async (_event, size: unknown) => {
+    if (!isObject(size)) throw new Error('terminal size must be an object')
+    const cols = typeof size.cols === 'number' ? size.cols : 80
+    const rows = typeof size.rows === 'number' ? size.rows : 24
+    terminalService.resize(cols, rows)
+  })
+
+  ipcMain.handle(IPC_CHANNELS.TERMINAL_STOP, async () => {
+    terminalService.stop()
+  })
+}

package/apps/sessrumnir/src/main/ipc/theme-handlers.ts

@@ -0,0 +1,131 @@
+import { ipcMain, dialog, BrowserWindow } from 'electron'
+import { getGuiDataDir } from '../app-data-paths'
+import { toWindowBackgroundColor } from '../window-background'
+import { listUserThemes, saveUserTheme, deleteUserTheme, installThemeFromUrl, fetchGalleryThemes, fetchGalleryImage } from '../theme-store'
+import {
+  validateThemeFile, themeIdFromName, MAX_THEME_FILE_BYTES, type ThemeFile,
+} from '../../shared/theme/theme-file'
+import type {
+  ThemesListResult,
+  ThemeImportResult,
+  ThemeExportResult,
+  ThemeGalleryResult,
+  ThemeGalleryImageResult,
+} from '../../shared/ipc-contracts'
+import { IPC_CHANNELS } from '../../shared/ipc-contracts'
+import { readFile, writeFile, stat } from 'fs/promises'
+import { join } from 'path'
+import { isString } from './validation'
+import { t } from '../../shared/i18n'
+
+const THEMES_DIR_NAME = 'themes'
+function themeFileFilter(): Electron.FileFilter {
+  return { name: t('dialogs.theme.fileFilterName'), extensions: ['json'] }
+}
+
+function themesDir(): string {
+  return join(getGuiDataDir(), THEMES_DIR_NAME)
+}
+
+export function registerThemeHandlers(): void {
+  // ─── Themes ─────────────────────────────────────────────────────────────
+
+  ipcMain.handle(IPC_CHANNELS.THEMES_LIST, async (): Promise<ThemesListResult> => {
+    return listUserThemes(themesDir())
+  })
+
+  ipcMain.handle(IPC_CHANNELS.THEMES_SAVE, async (_event, file: unknown, existingId: unknown) => {
+    if (existingId !== undefined && !isString(existingId)) {
+      throw new Error('existingId must be a string')
+    }
+    return saveUserTheme(themesDir(), file as ThemeFile, existingId)
+  })
+
+  // Unsupported color forms are ignored rather than thrown: a wrong native
+  // background is cosmetic and only visible at window edges.
+  ipcMain.handle(IPC_CHANNELS.THEMES_SET_WINDOW_BACKGROUND, (event, color: unknown) => {
+    const background = toWindowBackgroundColor(color)
+    if (background) BrowserWindow.fromWebContents(event.sender)?.setBackgroundColor(background)
+  })
+
+  ipcMain.handle(IPC_CHANNELS.THEMES_DELETE, async (_event, id: unknown) => {
+    if (!isString(id)) throw new Error('id must be a string')
+    await deleteUserTheme(themesDir(), id)
+  })
+
+  ipcMain.handle(IPC_CHANNELS.THEMES_INSTALL_URL, async (_event, url: unknown): Promise<ThemeImportResult> => {
+    if (!isString(url)) throw new Error('url must be a string')
+    try {
+      const { id, file } = await installThemeFromUrl(themesDir(), url)
+      return { ok: true, theme: { id, file } }
+    } catch (error) {
+      return { ok: false, error: error instanceof Error ? error.message : String(error) }
+    }
+  })
+
+  ipcMain.handle(IPC_CHANNELS.THEMES_EXPORT, async (_event, file: unknown): Promise<ThemeExportResult> => {
+    let theme: ThemeFile
+    try {
+      theme = validateThemeFile(file)
+    } catch (error) {
+      return { ok: false, error: error instanceof Error ? error.message : String(error) }
+    }
+    const defaultName = `${themeIdFromName(theme.name) || 'theme'}.json`
+    const result = await dialog.showSaveDialog({
+      title: t('dialogs.theme.exportTitle'),
+      defaultPath: defaultName,
+      filters: [themeFileFilter()],
+    })
+    if (result.canceled || !result.filePath) return { ok: false, canceled: true }
+    try {
+      await writeFile(result.filePath, JSON.stringify(theme, null, 2))
+      return { ok: true }
+    } catch (error) {
+      console.error('Failed to write exported theme file:', error)
+      return {
+        ok: false,
+        error: error instanceof Error ? error.message : t('errors.theme.exportWriteFailed', { path: result.filePath }),
+      }
+    }
+  })
+
+  ipcMain.handle(IPC_CHANNELS.THEMES_IMPORT, async (): Promise<ThemeImportResult> => {
+    const result = await dialog.showOpenDialog({
+      title: t('dialogs.theme.importTitle'),
+      properties: ['openFile'],
+      filters: [themeFileFilter()],
+    })
+    if (result.canceled || result.filePaths.length === 0) return { ok: false, canceled: true }
+    try {
+      const filePath = result.filePaths[0]
+      const { size } = await stat(filePath)
+      if (size > MAX_THEME_FILE_BYTES) {
+        return { ok: false, error: t('errors.theme.fileTooLarge', { limit: MAX_THEME_FILE_BYTES }) }
+      }
+      const file = validateThemeFile(JSON.parse(await readFile(filePath, 'utf8')))
+      const { id } = await saveUserTheme(themesDir(), file)
+      return { ok: true, theme: { id, file } }
+    } catch (error) {
+      return { ok: false, error: error instanceof Error ? error.message : String(error) }
+    }
+  })
+
+  ipcMain.handle(IPC_CHANNELS.THEMES_GALLERY_LIST, async (): Promise<ThemeGalleryResult> => {
+    try {
+      const themes = await fetchGalleryThemes()
+      return { ok: true, themes }
+    } catch (error) {
+      return { ok: false, error: error instanceof Error ? error.message : String(error) }
+    }
+  })
+
+  ipcMain.handle(IPC_CHANNELS.THEMES_GALLERY_IMAGE, async (_event, url: unknown): Promise<ThemeGalleryImageResult> => {
+    if (!isString(url)) return { ok: false, error: 'url must be a string' }
+    try {
+      const { dataUri } = await fetchGalleryImage(url)
+      return { ok: true, dataUri }
+    } catch (error) {
+      return { ok: false, error: error instanceof Error ? error.message : String(error) }
+    }
+  })
+}

package/apps/sessrumnir/src/main/ipc/update-handlers.ts

@@ -0,0 +1,61 @@
+import { ipcMain, app } from 'electron'
+import type { UpdateCheckResult } from '../../shared/ipc-contracts'
+import { IPC_CHANNELS } from '../../shared/ipc-contracts'
+import { isNewerVersion } from '../../shared/version-compare'
+import { appLog } from '../app-log'
+
+const UPDATE_REPO = 'FaqFirebase/pi-desktop'
+const UPDATE_CHECK_TIMEOUT_MS = 8000
+
+interface GithubRelease {
+  tag_name: string
+  html_url: string
+  name: string | null
+  draft: boolean
+  prerelease: boolean
+}
+
+/** Check GitHub releases (including prereleases) for a version newer than this build. */
+async function checkForUpdate(): Promise<UpdateCheckResult> {
+  const currentVersion = app.getVersion()
+  const noUpdate: UpdateCheckResult = { updateAvailable: false, currentVersion, latestVersion: currentVersion, url: '' }
+
+  try {
+    const controller = new AbortController()
+    const timer = setTimeout(() => controller.abort(), UPDATE_CHECK_TIMEOUT_MS)
+    const res = await fetch(`https://api.github.com/repos/${UPDATE_REPO}/releases?per_page=10`, {
+      headers: { Accept: 'application/vnd.github+json', 'User-Agent': 'Pi-Desktop' },
+      signal: controller.signal,
+    })
+    clearTimeout(timer)
+    if (!res.ok) return noUpdate
+
+    const releases = (await res.json()) as GithubRelease[]
+    const published = releases.filter((r) => !r.draft)
+    if (published.length === 0) return noUpdate
+
+    // Pick the highest version among published releases (not just newest by date).
+    let latest = published[0]
+    for (const r of published) {
+      if (isNewerVersion(r.tag_name.replace(/^v/, ''), latest.tag_name.replace(/^v/, ''))) latest = r
+    }
+
+    const latestVersion = latest.tag_name.replace(/^v/, '')
+    return {
+      updateAvailable: isNewerVersion(latestVersion, currentVersion),
+      currentVersion,
+      latestVersion,
+      url: latest.html_url,
+      name: latest.name ?? latest.tag_name,
+    }
+  } catch (err) {
+    appLog.warn('updates', 'Update check failed', err)
+    return noUpdate
+  }
+}
+
+export function registerUpdateHandlers(): void {
+  ipcMain.handle(IPC_CHANNELS.UPDATE_CHECK, async (): Promise<UpdateCheckResult> => {
+    return checkForUpdate()
+  })
+}

package/apps/sessrumnir/src/main/ipc/validation.ts

@@ -0,0 +1,45 @@
+import type { IpcMainInvokeEvent } from 'electron'
+import { isTrustedRendererUrl, RENDERER_INDEX_PATH } from '../renderer-origin'
+
+// Reject privileged IPC calls whose sender frame is not the app's own renderer.
+// A belt-and-suspenders check: navigation is already pinned (see index.ts) and
+// preview <webview> guests have no preload, so nothing else should be able to
+// reach these channels — this makes that guarantee explicit at the boundary.
+export function assertTrustedSender(event: IpcMainInvokeEvent): void {
+  const url = event.senderFrame?.url
+  if (
+    !url ||
+    !isTrustedRendererUrl(url, {
+      devServerUrl: process.env.ELECTRON_RENDERER_URL,
+      rendererIndexPath: RENDERER_INDEX_PATH,
+    })
+  ) {
+    throw new Error('Unauthorized IPC sender')
+  }
+}
+
+// Type guard helpers
+export function isString(value: unknown): value is string {
+  return typeof value === 'string'
+}
+
+export function isObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+export function isOptionalString(value: unknown): value is string | undefined {
+  return value === undefined || typeof value === 'string'
+}
+
+export function parseStringArray(value: unknown, label: string): string[] {
+  if (!Array.isArray(value)) throw new Error(`${label} must be an array`)
+  return value.map(String)
+}
+
+export function isOptionalBoolean(value: unknown): value is boolean | undefined {
+  return value === undefined || typeof value === 'boolean'
+}
+
+export function isOptionalStringArray(value: unknown): value is string[] | undefined {
+  return value === undefined || (Array.isArray(value) && value.every(isString))
+}