FEA-1497: Address PR #264 review findings (validation, packaging, typecheck)

Targeted fixes for review comments that remained valid against the
current FEA-1497 code (most other comments were already resolved by the
in-process rewrite). Each fix is scoped and behavior-preserving.

- lifecycle: guard hook session_id at runtime (typeof string, non-empty)
  before it becomes a SQLite primary-key binding. It arrives as `unknown`
  through the zod envelope, so a non-string would be stringified to
  "[object Object]" and stored as a junk PK. (thread: thadeusb)
- db IPC: add shared coerceDbId() guard and apply it to every
  desktop:db:* handler that takes a renderer-supplied id/sessionId/
  agentId. IPC is a runtime boundary; TS annotations are erased, so a
  malformed value could otherwise reach node:sqlite bindings. Invalid
  args now return the same empty result as the disabled path. Adds
  db-ipc-validation unit tests. (thread: shafty023)
- renderer typecheck: add tsconfig.renderer.json and a typecheck:renderer
  script chained into `typecheck` so the .tsx renderer is type-checked in
  CI (previously only src/**/*.ts was, src/renderer excluded). Surfaced
  and fixed a real latent bug: 7 component files imported
  ../../main/database/types (resolves to the nonexistent renderer/main)
  instead of ../../../main/database/types — masked because they are
  erased `import type`s. Declared @types/react / @types/react-dom (used
  transitively but never as a direct dep). Renderer now type-checks
  clean with full strict. (thread: shafty023)
- packaging: re-chain build:agent-monitor into the package/release
  scripts. `build` no longer generates .generated/agent-monitor but
  stage-packaging hard-requires it and the runtime still loads the
  generated hook-handler scripts, so `pnpm package` failed on a clean
  checkout (not covered by CI). (thread: shafty023)
- packaging: exclude the file:vendor/design-system dep from the staged
  prod dependencies. Staging runs `pnpm install --prod` before copying
  app files, so the relative vendor path can't resolve; the renderer is
  already bundled into dist/renderer by Vite, so it isn't a runtime
  module. (thread: shafty023)
- vendor DS: fix the root export/main/module fields to point at files
  that exist — import/module/default -> dist/index.mjs (ESM),
  require/main -> dist/index.js (CJS). They previously pointed import at
  the CJS index.js and require/main at a nonexistent index.cjs.
  (thread: shafty023)
- window: gate the dev-server load (http://localhost:5173) behind an
  explicit CL_RENDERER_DEV_SERVER=1 opt-in, defaulting every build to the
  app:// renderer. The privileged preload would otherwise attach to
  whatever local process binds :5173 first. No current recipe starts a
  Vite dev server, so this also removes a pointless failed loadURL on the
  common dev path. (thread: shafty023)
- bump desktop version 0.15.108 -> 0.15.109

Testing: pnpm lint, pnpm typecheck (main + new renderer project),
pnpm build:renderer, and pnpm test (2032 pass / 0 fail) all green
locally. Staging script syntax-checked.

Risks: Packaging changes (build:agent-monitor re-chain, staged-dep
filter) are not exercised by CI; validated by code inspection and script
syntax check, full electron-builder package not run locally. Renderer
typecheck is now CI-gating — verified clean before wiring in.

Author: thadeusb

apps/desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "desktop",
-  "version": "0.15.108",
+  "version": "0.15.109",
   "description": "ClosedLoop Desktop",
   "author": "ClosedLoop AI <support@closedloop.ai>",
   "private": true,
@@ -18,7 +18,8 @@
     "dashboard:reset": "node scripts/reset-dashboard-db.mjs",
     "dashboard:reset-packs": "node scripts/reset-dashboard-db.mjs --packs-only",
     "stage:package": "node scripts/stage-packaging-app.mjs",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "typecheck": "tsc -p tsconfig.json --noEmit && pnpm typecheck:renderer",
+    "typecheck:renderer": "tsc -p tsconfig.renderer.json --noEmit",
     "lint": "eslint src/",
     "test": "tsx --test test/*.test.ts && node --test \"scripts/agent-monitor-packs/__tests__/*.test.js\" \"scripts/agent-monitor-pull-requests/__tests__/*.test.js\"",
     "pretest:contract": "pnpm build:agent-monitor",
@@ -34,8 +35,8 @@
     "test:audit:ui": "playwright test --config test-e2e/agent-monitor/playwright.audit.config.ts",
     "preaudit:report": "pnpm build:agent-monitor",
     "audit:report": "node test-e2e/agent-monitor/inventory/run-report.mjs",
-    "package": "pnpm clean:package && pnpm build && pnpm stage:package && node scripts/run-electron-builder.mjs",
-    "release": "pnpm clean:package && pnpm build && pnpm stage:package && node scripts/run-electron-builder.mjs --publish always"
+    "package": "pnpm clean:package && pnpm build && pnpm build:agent-monitor && pnpm stage:package && node scripts/run-electron-builder.mjs",
+    "release": "pnpm clean:package && pnpm build && pnpm build:agent-monitor && pnpm stage:package && node scripts/run-electron-builder.mjs --publish always"
   },
   "dependencies": {
     "@closedloop-ai/design-system": "file:vendor/design-system",
@@ -64,6 +65,8 @@
     "@tailwindcss/vite": "^4.3.0",
     "@types/busboy": "^1.5.4",
     "@types/node": "^22.13.8",
+    "@types/react": "^19.2.0",
+    "@types/react-dom": "^19.2.0",
     "@typescript-eslint/eslint-plugin": "^8.57.1",
     "@typescript-eslint/parser": "^8.57.1",
     "@vitejs/plugin-react": "4.3.4",

apps/desktop/scripts/stage-packaging-app.mjs

@@ -25,6 +25,15 @@ const rendererEntryFile = path.join(appDir, "src/renderer/index.html");
 const stageRendererDir = path.join(stageAppDir, "src/renderer");
 const stageNpmrcFile = path.join(stageAppDir, ".npmrc");
 
+// Dependencies that Vite bundles directly into `dist/renderer` and that are
+// therefore NOT needed as runtime node modules in the packaged app. The
+// vendored design-system is declared as `file:vendor/design-system`, but the
+// staging install (`pnpm install --prod` in the stage dir) runs before any app
+// files — including `vendor/` — are copied, so that relative spec cannot
+// resolve and the install fails. Excluding it here keeps staging install-able;
+// the renderer already ships its design-system code inside the Vite bundle.
+const BUNDLED_ONLY_DEPENDENCIES = new Set(["@closedloop-ai/design-system"]);
+
 function resolveStageDependencySpec(packageJson, dependencyName, dependency) {
   if (typeof dependency.resolved === "string" && dependency.resolved.length > 0) {
     return dependency.resolved;
@@ -106,10 +115,12 @@ const stagePackageJson = {
   type: packageJson.type,
   main: packageJson.main,
   dependencies: Object.fromEntries(
-    Object.entries(installedDependencies).map(([dependencyName, dependency]) => [
-      dependencyName,
-      resolveStageDependencySpec(packageJson, dependencyName, dependency),
-    ]),
+    Object.entries(installedDependencies)
+      .filter(([dependencyName]) => !BUNDLED_ONLY_DEPENDENCIES.has(dependencyName))
+      .map(([dependencyName, dependency]) => [
+        dependencyName,
+        resolveStageDependencySpec(packageJson, dependencyName, dependency),
+      ]),
   ),
 };
 const stageRootPackageJson = {

apps/desktop/src/main/app.ts

@@ -76,6 +76,7 @@ import { DesktopTray } from "./tray.js";
 import { DesktopWindow } from "./window.js";
 import { AgentHookListener } from "./agent-monitor-listener.js";
 import { openAgentDatabase } from "./database/index.js";
+import { coerceDbId } from "./database/ipc-validation.js";
 import { createLifecycle } from "./database/lifecycle.js";
 import { detectBillingMode } from "./billing-mode-detector.js";
 import { migrateVendorDashboardDb } from "./agent-monitor-db-migration.js";
@@ -3629,27 +3630,32 @@ export class DesktopApplication {
       return this.agentDatabase.sessions.getAll();
     });
 
-    ipcMain.handle("desktop:db:get-session", (_event, id: string) => {
+    ipcMain.handle("desktop:db:get-session", (_event, id: unknown) => {
       if (!this.isAgentMonitorEnabled()) return undefined;
-      return this.agentDatabase.sessions.getById(id);
+      const sessionId = coerceDbId(id);
+      if (sessionId === null) return undefined;
+      return this.agentDatabase.sessions.getById(sessionId);
     });
 
-    ipcMain.handle("desktop:db:get-agents", (_event, sessionId: string) => {
+    ipcMain.handle("desktop:db:get-agents", (_event, sessionId: unknown) => {
       if (!this.isAgentMonitorEnabled()) return [];
-      return this.agentDatabase.agents.getBySession(sessionId);
+      const id = coerceDbId(sessionId);
+      if (id === null) return [];
+      return this.agentDatabase.agents.getBySession(id);
     });
 
     ipcMain.handle(
       "desktop:db:get-events",
-      (_event, sessionId: string, agentId?: string) => {
+      (_event, sessionId: unknown, agentId?: unknown) => {
         if (!this.isAgentMonitorEnabled()) return [];
-        if (agentId) {
-          return this.agentDatabase.events.getBySessionAndAgent(
-            sessionId,
-            agentId,
-          );
+        const sid = coerceDbId(sessionId);
+        if (sid === null) return [];
+        // A missing or malformed agentId falls back to the session-wide query.
+        const aid = coerceDbId(agentId);
+        if (aid !== null) {
+          return this.agentDatabase.events.getBySessionAndAgent(sid, aid);
         }
-        return this.agentDatabase.events.getBySession(sessionId);
+        return this.agentDatabase.events.getBySession(sid);
       },
     );
 
@@ -3670,9 +3676,11 @@ export class DesktopApplication {
       return this.agentDatabase.events.getAll();
     });
 
-    ipcMain.handle("desktop:db:get-events-with-session", (_event, sessionId: string) => {
+    ipcMain.handle("desktop:db:get-events-with-session", (_event, sessionId: unknown) => {
       if (!this.isAgentMonitorEnabled()) return [];
-      return this.agentDatabase.events.getWithSession(sessionId);
+      const id = coerceDbId(sessionId);
+      if (id === null) return [];
+      return this.agentDatabase.events.getWithSession(id);
     });
 
     ipcMain.handle("desktop:db:get-event-count-by-type", () => {
@@ -3687,9 +3695,11 @@ export class DesktopApplication {
       return this.agentDatabase.dashboard.getTokenAnalytics();
     });
 
-    ipcMain.handle("desktop:db:get-agent-hierarchy", (_event, sessionId: string) => {
+    ipcMain.handle("desktop:db:get-agent-hierarchy", (_event, sessionId: unknown) => {
       if (!this.isAgentMonitorEnabled()) return [];
-      return this.agentDatabase.agents.getBySessionWithChildren(sessionId, this.agentDatabase.events);
+      const id = coerceDbId(sessionId);
+      if (id === null) return [];
+      return this.agentDatabase.agents.getBySessionWithChildren(id, this.agentDatabase.events);
     });
 
     ipcMain.handle("desktop:db:get-analytics", () => {

apps/desktop/src/main/database/ipc-validation.ts

@@ -0,0 +1,33 @@
+// Runtime validation for renderer-supplied identifiers that reach the
+// `desktop:db:*` IPC handlers. IPC is a runtime trust boundary: the TypeScript
+// annotations on the handler arguments are erased at runtime, so a malformed
+// `id` / `sessionId` / `agentId` (an object, number, null, or oversized string)
+// from a compromised or buggy renderer could otherwise reach `node:sqlite`
+// bindings and throw inside the query or alter its behavior. The DB IPC handlers
+// must coerce every identifier through these guards before it touches the store
+// layer. (CLAUDE.md: runtime-validate gateway, IPC, and persisted payloads.)
+
+/**
+ * Upper bound on identifier length. Session/agent ids are short UUID-ish
+ * strings; anything dramatically longer is malformed input, not a real id.
+ */
+export const MAX_DB_ID_LENGTH = 512;
+
+/**
+ * Validate a renderer-supplied database identifier.
+ *
+ * Returns the value unchanged when it is a usable id (a non-empty string within
+ * the length bound), or `null` when it is not. Callers treat `null` as "no such
+ * record" — they return the same empty/undefined result the handlers already
+ * return when the monitor is disabled, so a bad argument can never reach a
+ * SQLite binding.
+ */
+export function coerceDbId(value: unknown): string | null {
+  if (typeof value !== "string") {
+    return null;
+  }
+  if (value.length === 0 || value.length > MAX_DB_ID_LENGTH) {
+    return null;
+  }
+  return value;
+}

apps/desktop/src/main/database/lifecycle.ts

@@ -439,8 +439,14 @@ export function createLifecycle(db: DatabaseSync, deps: LifecycleDeps) {
      * the fail-silent hook handler.
      */
     processEvent(hookType: string, data: HookData, harness: string): boolean {
+      // `session_id` arrives as `unknown` through the listener's zod envelope
+      // (`data` is validated only as a string-keyed record), so its declared
+      // `string` type is not enforced at runtime. Guard the actual type before
+      // it becomes a SQLite primary-key binding: a non-string (e.g. an object)
+      // would otherwise be stringified to "[object Object]" and stored as a
+      // junk primary key. (CLAUDE.md: runtime-validate persisted payloads.)
       const sessionId = data.session_id;
-      if (!sessionId) {
+      if (typeof sessionId !== "string" || sessionId.length === 0) {
         return false;
       }
       // Read the transcript (file IO) BEFORE opening the write transaction.

apps/desktop/src/main/window.ts

@@ -80,16 +80,29 @@ export class DesktopWindow {
   private async loadContent(): Promise<void> {
     registerAppProtocol();
 
-    if (app.isPackaged) {
-      await this.browserWindow!.loadURL(`app://renderer/index.html`);
-      return;
+    // The privileged renderer window carries the full `desktopApi` preload
+    // bridge (approvals, settings, logs, DB reads, binary-path mutations). The
+    // Vite dev server (http://localhost:5173) is only ever loaded into it when a
+    // developer explicitly opts in via CL_RENDERER_DEV_SERVER=1 — otherwise any
+    // local process that binds :5173 first could serve renderer JS into the
+    // privileged window. The default path (including every packaged build) is
+    // the custom `app://` protocol, which also skips a pointless failed loadURL
+    // on the common dev workflow where no Vite server is running.
+    const devServerUrl =
+      !app.isPackaged && process.env.CL_RENDERER_DEV_SERVER === "1"
+        ? process.env.CL_RENDERER_DEV_SERVER_URL || "http://localhost:5173"
+        : null;
+
+    if (devServerUrl) {
+      try {
+        await this.browserWindow!.loadURL(devServerUrl);
+        return;
+      } catch {
+        // Dev server unreachable — fall through to the packaged renderer.
+      }
     }
 
-    try {
-      await this.browserWindow!.loadURL("http://localhost:5173");
-    } catch {
-      await this.browserWindow!.loadURL(`app://renderer/index.html`);
-    }
+    await this.browserWindow!.loadURL(`app://renderer/index.html`);
   }
 
   getWindow(): BrowserWindow | null {

apps/desktop/src/renderer/components/analytics/AnalyticsView.tsx

@@ -7,7 +7,7 @@ import { ActivityHeatmap } from "@closedloop-ai/design-system/components/ui/prim
 import { SegmentedBar } from "@closedloop-ai/design-system/components/ui/primitives/segmented-bar";
 import { Coins, ArrowDownToLine, ArrowUpFromLine, DatabaseZap } from "lucide-react";
 import { useQueryCache } from "../../hooks/useQueryCache";
-import type { AnalyticsData } from "../../main/database/types";
+import type { AnalyticsData } from "../../../main/database/types";
 
 const PALETTE = [
   "#3b82f6", "#10b981", "#f59e0b", "#ef4444", "#8b5cf6",

apps/desktop/src/renderer/components/dashboard/DashboardPage.tsx

@@ -2,7 +2,7 @@ import { MetricCard } from "@closedloop-ai/design-system/components/ui/primitive
 import { MonitorDot, Bot, Zap, Layers } from "lucide-react";
 import { useQueryCache } from "../../hooks/useQueryCache";
 import { SessionsView } from "../sessions/SessionsView";
-import type { DashboardSummary, AnalyticsData } from "../../main/database/types";
+import type { DashboardSummary, AnalyticsData } from "../../../main/database/types";
 
 export function DashboardPage() {
   const { data: summary, error } = useQueryCache<DashboardSummary>(

apps/desktop/src/renderer/components/feed/ActivityFeedView.tsx

@@ -3,7 +3,7 @@ import { Button } from "@closedloop-ai/design-system/components/ui/button";
 import { Badge } from "@closedloop-ai/design-system/components/ui/badge";
 import { MetricCard } from "@closedloop-ai/design-system/components/ui/primitives/metric-card";
 import { Zap, Wrench, AlertCircle, Layers } from "lucide-react";
-import type { EventRow } from "../../main/database/types";
+import type { EventRow } from "../../../main/database/types";
 
 const EVENT_TYPE_TONES: Record<string, string> = {
   tool_use: "bg-blue-500/10 text-blue-600",

apps/desktop/src/renderer/components/kanban/KanbanView.tsx

@@ -2,7 +2,7 @@ import { useState } from "react";
 import { KanbanBoardLayout, KanbanColumn, KanbanCardFrame } from "@closedloop-ai/design-system/components/ui/layout/kanban-board";
 import { Badge } from "@closedloop-ai/design-system/components/ui/badge";
 import { useQueryCache } from "../../hooks/useQueryCache";
-import type { SessionWithAgents } from "../../main/database/types";
+import type { SessionWithAgents } from "../../../main/database/types";
 
 function PlayIcon() { return <span className="text-blue-400 text-xs">&#9654;</span>; }
 function ClockIcon() { return <span className="text-yellow-400 text-xs">&#9201;</span>; }