Q120: every IPC call passes one gate - the app's own page, input checked against a typed contract

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/main/app/ipc-contracts/collaboration.ts

@@ -0,0 +1,56 @@
+import { z } from "zod";
+import type * as C from "../../../shared/commands";
+
+const id = z.string();
+const nullableId = z.string().nullable();
+const actor = z.enum(["employee", "agent"]);
+const sender = z.enum(["employee", "agent", "board", "system"]);
+const settings = z.record(z.string(), z.unknown());
+
+export const collaborationContracts = {
+  createDocument: z.strictObject({
+    orgId: id, title: z.string(), docType: z.string(), content: z.string(), authorAgentId: nullableId, reviewerAgentId: nullableId,
+    projectId: nullableId, goalId: nullableId, taskId: nullableId,
+  }) satisfies z.ZodType<C.CreateDocumentInput>,
+  updateDocument: z.strictObject({
+    orgId: id, documentId: id, title: z.string(), content: z.string(), status: z.string(), reason: z.string(), changedByType: actor, changedById: id,
+  }) satisfies z.ZodType<C.UpdateDocumentInput>,
+  deleteDocument: z.strictObject({ orgId: id, documentId: id, deletedByEmployeeId: id }) satisfies z.ZodType<C.DeleteDocumentInput>,
+  listDocumentVersions: z.strictObject({ orgId: id, documentId: id }) satisfies z.ZodType<C.ListDocumentVersionsInput>,
+  createKnowledgeEntry: z.strictObject({
+    orgId: id, topic: z.string(), category: z.string(), content: z.string(), importance: z.string(), sourceType: z.string(), sourceId: nullableId,
+    scopeType: z.enum(["organization", "project", "goal", "task", "agent"]), scopeId: nullableId, validUntil: z.string().nullable(), supersedesId: nullableId,
+  }) satisfies z.ZodType<C.CreateKnowledgeEntryInput>,
+  updateKnowledgeEntry: z.strictObject({
+    orgId: id, entryId: id, topic: z.string(), category: z.string(), content: z.string(), importance: z.string(), reason: z.string(),
+    changedByType: actor, changedById: id,
+  }) satisfies z.ZodType<C.UpdateKnowledgeEntryInput>,
+  deleteKnowledgeEntry: z.strictObject({ orgId: id, entryId: id, deletedByEmployeeId: id }) satisfies z.ZodType<C.DeleteKnowledgeEntryInput>,
+  listKnowledgeRevisions: z.strictObject({ orgId: id, entryId: id }) satisfies z.ZodType<C.ListKnowledgeRevisionsInput>,
+  createAutomationRule: z.strictObject({
+    orgId: id, name: z.string(), triggerEvent: z.string(), conditions: settings, actionType: z.string(), actionConfig: settings,
+    priority: z.number(), enabled: z.boolean(),
+  }) satisfies z.ZodType<C.CreateAutomationRuleInput>,
+  updateAutomationRule: z.strictObject({
+    orgId: id, ruleId: id, name: z.string(), triggerEvent: z.string(), conditions: settings, actionType: z.string(), actionConfig: settings,
+    priority: z.number(), enabled: z.boolean(),
+  }) satisfies z.ZodType<C.UpdateAutomationRuleInput>,
+  deleteAutomationRule: z.strictObject({ orgId: id, ruleId: id }) satisfies z.ZodType<C.DeleteAutomationRuleInput>,
+  createMeeting: z.strictObject({
+    orgId: id, title: z.string(), meetingType: z.string(), scheduledAt: z.string().nullable(), durationMinutes: z.number(), agenda: z.string(),
+  }) satisfies z.ZodType<C.CreateMeetingInput>,
+  deleteMeeting: z.strictObject({ orgId: id, meetingId: id }) satisfies z.ZodType<C.DeleteMeetingInput>,
+  createSprint: z.strictObject({ orgId: id, name: z.string(), goal: z.string(), startDate: z.string(), endDate: z.string() }) satisfies z.ZodType<C.CreateSprintInput>,
+  deleteSprint: z.strictObject({ orgId: id, sprintId: id }) satisfies z.ZodType<C.DeleteSprintInput>,
+  createChatSpace: z.strictObject({
+    orgId: id, spaceType: z.enum(["company", "division", "department", "project", "pod", "ad_hoc", "direct"]), name: z.string(), topic: z.string(),
+    visibility: z.enum(["workspace", "restricted"]), retentionPolicy: z.enum(["standard_365d", "restricted_365d"]).optional(),
+    memberEmployeeIds: z.array(id).optional(), memberAgentIds: z.array(id).optional(),
+  }) satisfies z.ZodType<C.CreateChatSpaceInput>,
+  sendMessage: z.strictObject({
+    orgId: id, spaceId: id, threadId: nullableId, senderType: sender, senderId: nullableId, bodyMd: z.string(), attachmentFileIds: z.array(id).optional(),
+  }) satisfies z.ZodType<C.SendMessageInput>,
+  editMessage: z.strictObject({ orgId: id, messageId: id, actorType: sender, actorId: nullableId, bodyMd: z.string() }) satisfies z.ZodType<C.EditMessageInput>,
+  deleteMessage: z.strictObject({ orgId: id, messageId: id, actorType: sender, actorId: nullableId }) satisfies z.ZodType<C.DeleteMessageInput>,
+  markChatSpaceRead: z.strictObject({ orgId: id, employeeId: id, spaceId: id }) satisfies z.ZodType<C.MarkChatSpaceReadInput>,
+};

src/main/app/ipc-contracts/index.ts

@@ -0,0 +1,24 @@
+import { z } from "zod";
+import type { DesktopApi } from "../../../shared/desktop-api";
+import { collaborationContracts } from "./collaboration";
+import { organizationContracts } from "./organization";
+import { platformContracts } from "./platform";
+
+/** Every desktop API method the renderer invokes (not the event subscription or the constants). */
+export type InvokedMethod = { [K in keyof DesktopApi]: DesktopApi[K] extends (...args: never[]) => Promise<unknown> ? K : never }[keyof DesktopApi];
+export type InputOf<K extends InvokedMethod> = Parameters<DesktopApi[K]> extends [infer I] ? I : undefined;
+
+const noInput = z.undefined();
+
+/** The runtime contract of each IPC call; a method without a schema, or a schema that disagrees with its type, fails the typecheck. */
+export const IPC_CONTRACTS: { [K in InvokedMethod]: z.ZodType<InputOf<K>> } = {
+  loadSnapshot: noInput,
+  pickDirectory: noInput,
+  listConnectorCatalog: noInput,
+  windowMinimize: noInput,
+  windowMaximize: noInput,
+  windowClose: noInput,
+  ...organizationContracts,
+  ...collaborationContracts,
+  ...platformContracts,
+};

src/main/app/ipc-contracts/organization.ts

@@ -0,0 +1,69 @@
+import { z } from "zod";
+import type * as C from "../../../shared/commands";
+import { APPROVAL_STATE, RISK_LEVEL, TASK_PRIORITY, TASK_STATUS, WRITING_MODE } from "../../../shared/domain";
+import { IDENTITY_SOURCE, ROLE_KEY } from "../../../shared/identity-domain";
+
+const id = z.string();
+const nullableId = z.string().nullable();
+
+export const organizationContracts = {
+  bootstrapOnboarding: z.strictObject({
+    companyName: z.string(), companyDescription: z.string(), employeeName: z.string(), workspacePath: z.string(),
+    executionMode: z.enum(["ai_ceo", "ai_cofounder"]), autoApproveHires: z.boolean(), reviewDeliverables: z.boolean(),
+    goalTitle: z.string(), goalDescription: z.string(), providerKey: z.string(), providerSecret: z.string(), providerModel: z.string(),
+  }) satisfies z.ZodType<C.BootstrapOnboardingInput>,
+  setActiveOrganization: z.strictObject({ orgId: id }) satisfies z.ZodType<C.SetActiveOrganizationInput>,
+  setUiPreferences: z.strictObject({ theme: z.enum(["system", "light", "dark"]).optional(), language: z.enum(["en", "zh"]).optional() }) satisfies z.ZodType<C.SetUiPreferencesInput>,
+  deleteOrganization: z.strictObject({ orgId: id }) satisfies z.ZodType<C.DeleteOrganizationInput>,
+  createOrganization: z.strictObject({
+    organizationName: z.string(), description: z.string().optional(), mission: z.string(), goal: z.string(), employeeName: z.string(),
+    executionMode: z.enum(["ai_ceo", "ai_cofounder"]).optional(), autoApproveHires: z.boolean().optional(), reviewDeliverables: z.boolean().optional(),
+  }) satisfies z.ZodType<C.CreateOrganizationInput>,
+  createAgent: z.strictObject({
+    orgId: id, name: z.string(), role: z.string(), department: z.string(), modelProviderId: nullableId, modelId: nullableId,
+    budgetCents: z.number(), managerAgentId: nullableId, title: z.string().optional(), roleLevel: z.string().optional(),
+    modelStrategy: z.string().optional(), workspaceId: nullableId.optional(), heartbeatEnabled: z.boolean().optional(), heartbeatIntervalSec: z.number().optional(),
+  }) satisfies z.ZodType<C.CreateAgentInput>,
+  updateAgent: z.strictObject({
+    orgId: id, agentId: id, name: z.string().optional(), role: z.string(), title: z.string(), roleLevel: z.string(), department: z.string(),
+    budgetCents: z.number(), modelProviderId: nullableId, modelId: nullableId,
+    avatarEmoji: z.string().optional(), avatarColor: z.string().optional(), avatarImage: z.string().optional(),
+  }) satisfies z.ZodType<C.UpdateAgentInput>,
+  updateEmployeeProfile: z.strictObject({
+    orgId: id, employeeId: id, displayName: z.string(), avatarEmoji: z.string().optional(), avatarColor: z.string().optional(), avatarImage: z.string().optional(),
+  }) satisfies z.ZodType<C.UpdateEmployeeProfileInput>,
+  setAutonomousPaused: z.strictObject({ paused: z.boolean() }) satisfies z.ZodType<C.SetAutonomousPausedInput>,
+  stopRun: z.strictObject({ runId: id }) satisfies z.ZodType<C.StopRunInput>,
+  createTask: z.strictObject({
+    orgId: id, title: z.string(), description: z.string(), status: z.enum(TASK_STATUS), assigneeAgentId: nullableId, risk: z.enum(RISK_LEVEL),
+    projectId: nullableId, goalId: nullableId, workspaceId: nullableId, priority: z.enum(TASK_PRIORITY), requiresFilesystem: z.boolean(),
+    writingMode: z.enum(WRITING_MODE).optional(), origin: z.enum(["chat_wake", "goal_review", "task_review"]).optional(),
+  }) satisfies z.ZodType<C.CreateTaskInput>,
+  updateTask: z.strictObject({
+    orgId: id, taskId: id, title: z.string(), description: z.string(), assigneeAgentId: nullableId, risk: z.enum(RISK_LEVEL),
+    priority: z.enum(TASK_PRIORITY), parentTaskId: nullableId,
+  }) satisfies z.ZodType<C.UpdateTaskInput>,
+  deleteTask: z.strictObject({ orgId: id, taskId: id }) satisfies z.ZodType<C.DeleteTaskInput>,
+  updateTaskStatus: z.strictObject({ orgId: id, taskId: id, status: z.enum(TASK_STATUS) }) satisfies z.ZodType<C.UpdateTaskStatusInput>,
+  runTask: z.strictObject({ orgId: id, taskId: id }) satisfies z.ZodType<C.RunTaskInput>,
+  createGoal: z.strictObject({ orgId: id, title: z.string(), description: z.string(), ownerAgentId: nullableId }) satisfies z.ZodType<C.CreateGoalInput>,
+  resumeGoal: z.strictObject({ orgId: id, goalId: id }) satisfies z.ZodType<C.ResumeGoalInput>,
+  createProject: z.strictObject({
+    orgId: id, goalId: nullableId, name: z.string(), description: z.string(), leadAgentId: nullableId,
+  }) satisfies z.ZodType<C.CreateProjectInput>,
+  createWorkspace: z.strictObject({ orgId: id, name: z.string(), localPath: z.string(), projectId: nullableId }) satisfies z.ZodType<C.CreateWorkspaceInput>,
+  createApproval: z.strictObject({
+    orgId: id, kind: z.string(), title: z.string(), details: z.string(), risk: z.enum(RISK_LEVEL),
+    requestedByType: z.enum(["employee", "agent", "system"]), requestedById: nullableId,
+  }) satisfies z.ZodType<C.CreateApprovalInput>,
+  decideApproval: z.strictObject({
+    orgId: id, approvalId: id, state: z.enum([APPROVAL_STATE.APPROVED, APPROVAL_STATE.DECLINED]), decidedByEmployeeId: id, notes: z.string().optional(),
+  }) satisfies z.ZodType<C.DecideApprovalInput>,
+  syncEmployeeIdentity: z.strictObject({
+    orgId: id, employeeId: id, source: z.enum(IDENTITY_SOURCE), externalSubject: z.string(), email: z.string().nullable(),
+  }) satisfies z.ZodType<C.SyncEmployeeIdentityInput>,
+  grantRole: z.strictObject({
+    orgId: id, principalType: z.enum(["employee", "agent", "service_identity"]), principalId: id, roleKey: z.enum(ROLE_KEY),
+    scopeType: z.enum(["organization", "workspace", "project", "department"]), scopeId: id, grantedByEmployeeId: id,
+  }) satisfies z.ZodType<C.GrantRoleInput>,
+};

src/main/app/ipc-contracts/platform.ts

@@ -0,0 +1,85 @@
+import { z } from "zod";
+import type * as C from "../../../shared/commands";
+import { INTEGRATION_KEY_NAMES } from "../../../shared/commands";
+import { COMPLIANCE_EXPORT_TYPE } from "../../../shared/compliance-domain";
+import { SOCIAL_PLATFORM } from "../../../shared/domain";
+import { PROVIDER_DATA_POLICY, PROVIDER_EXECUTION_MODE } from "../../../shared/provider-policy-domain";
+import { SDLC_REVIEW_TARGET_TYPE } from "../../../shared/sdlc-domain";
+import { SEARCH_ENTITY_TYPES } from "../../../shared/search-domain";
+
+const id = z.string();
+const nullableId = z.string().nullable();
+const providerResponse = z.strictObject({
+  orgId: id, providerId: id, workspaceId: nullableId.optional(), prompt: z.string(), instructions: z.string().nullable(),
+  executionMode: z.enum(PROVIDER_EXECUTION_MODE).optional(),
+}) satisfies z.ZodType<C.CreateProviderResponseInput>;
+
+export const platformContracts = {
+  setIntegrationKey: z.strictObject({ name: z.enum(INTEGRATION_KEY_NAMES), value: z.string() }) satisfies z.ZodType<C.SetIntegrationKeyInput>,
+  clearIntegrationKey: z.strictObject({ name: z.enum(INTEGRATION_KEY_NAMES) }) satisfies z.ZodType<C.ClearIntegrationKeyInput>,
+  saveProviderCredential: z.strictObject({ orgId: id, providerId: id, secret: z.string(), model: z.string().nullable() }) satisfies z.ZodType<C.SaveProviderCredentialInput>,
+  revokeProviderCredential: z.strictObject({ orgId: id, providerId: id }) satisfies z.ZodType<C.RevokeProviderCredentialInput>,
+  startProviderOAuth: z.strictObject({
+    providerKey: z.string(), enterpriseDomain: z.string().nullable().optional(), orgId: id.optional(), providerId: id.optional(),
+    employeeId: id.optional(), model: z.string().nullable().optional(),
+  }) satisfies z.ZodType<C.StartProviderOAuthInput>,
+  cancelProviderOAuth: z.strictObject({ providerKey: z.string() }) satisfies z.ZodType<C.CancelProviderOAuthInput>,
+  checkProviderHealth: z.strictObject({ orgId: id, providerId: id }) satisfies z.ZodType<C.CheckProviderHealthInput>,
+  listProviderModels: z.strictObject({ providerKey: z.string(), secret: z.string().optional(), orgId: id.optional(), providerId: id.optional() }) satisfies z.ZodType<C.ListProviderModelsInput>,
+  checkProviderModel: z.strictObject({ orgId: id, providerId: id, model: z.string() }),
+  updateProviderPolicy: z.strictObject({
+    orgId: id, providerId: id, dataPolicy: z.enum(PROVIDER_DATA_POLICY), backgroundEnabled: z.boolean(), monthlyRequestLimit: z.number(),
+    workspaceScope: z.enum(["organization", "workspace"]), contextWindowTokens: z.number(),
+  }) satisfies z.ZodType<C.UpdateProviderPolicyInput>,
+  setProviderPrices: z.strictObject({
+    orgId: id, providerId: id, inputDollarsPerMtok: z.number().nullable(), cachedInputDollarsPerMtok: z.number().nullable(), outputDollarsPerMtok: z.number().nullable(),
+  }) satisfies z.ZodType<C.SetProviderPricesInput>,
+  setGoalAuditor: z.strictObject({ orgId: id, providerId: id, modelId: z.string() }),
+  openExternalUrl: z.string(),
+  createProviderResponse: providerResponse,
+  streamProviderResponse: providerResponse,
+  cancelProviderResponse: z.strictObject({ orgId: id, requestId: id, providerResponseId: id.optional() }) satisfies z.ZodType<C.CancelProviderResponseInput>,
+  createSocialAccount: z.strictObject({
+    orgId: id, platform: z.enum(SOCIAL_PLATFORM), handle: z.string(), displayName: z.string(), createdByEmployeeId: id, authorizedEmployeeId: nullableId,
+  }) satisfies z.ZodType<C.CreateSocialAccountInput>,
+  launchSocialLogin: z.strictObject({ orgId: id, socialAccountId: id, employeeId: id }) satisfies z.ZodType<C.LaunchSocialLoginInput>,
+  createScheduledPost: z.strictObject({
+    orgId: id, socialAccountId: id, bodyMd: z.string(), scheduledFor: z.string(), createdByEmployeeId: id,
+  }) satisfies z.ZodType<C.CreateScheduledPostInput>,
+  setScheduledPostState: z.strictObject({
+    orgId: id, scheduledPostId: id, state: z.enum(["draft", "scheduled", "published", "cancelled"]), employeeId: id,
+  }) satisfies z.ZodType<C.SetScheduledPostStateInput>,
+  importFile: z.strictObject({ orgId: id }) satisfies z.ZodType<C.ImportFileInput>,
+  openFile: z.strictObject({ orgId: id, fileId: id }) satisfies z.ZodType<C.OpenFileInput>,
+  setFilePinned: z.strictObject({ orgId: id, fileId: id, pinned: z.boolean() }) satisfies z.ZodType<C.SetFilePinnedInput>,
+  createMigrationReport: z.strictObject({ orgId: id, sourceDatabasePath: z.string() }) satisfies z.ZodType<C.CreateMigrationReportInput>,
+  createRollbackSnapshot: z.strictObject({ orgId: id, migrationReportId: id, createdByEmployeeId: id }) satisfies z.ZodType<C.CreateRollbackSnapshotInput>,
+  setRollbackSnapshotActive: z.strictObject({ orgId: id, snapshotId: id, active: z.boolean(), employeeId: id }) satisfies z.ZodType<C.SetRollbackSnapshotActiveInput>,
+  resolveMigrationReconciliation: z.strictObject({ orgId: id, reconciliationItemId: id, employeeId: id }) satisfies z.ZodType<C.ResolveMigrationReconciliationInput>,
+  setFeatureFlag: z.strictObject({ orgId: id, flagId: id, enabled: z.boolean() }) satisfies z.ZodType<C.SetFeatureFlagInput>,
+  runChaosDrill: z.strictObject({ orgId: id, drillId: id }) satisfies z.ZodType<C.RunChaosDrillInput>,
+  runSdlcReview: z.strictObject({ orgId: id, reviewAgentId: id, targetType: z.enum(SDLC_REVIEW_TARGET_TYPE), targetRef: z.string() }) satisfies z.ZodType<C.RunSdlcReviewInput>,
+  runEvalSuite: z.strictObject({ orgId: id, suiteId: id }) satisfies z.ZodType<C.RunEvalSuiteInput>,
+  setPrBotGate: z.strictObject({ orgId: id, gateId: id, enabled: z.boolean() }) satisfies z.ZodType<C.SetPrBotGateInput>,
+  createComplianceExport: z.strictObject({
+    orgId: id, subjectType: z.enum(["employee", "agent"]), subjectId: id, exportType: z.enum(COMPLIANCE_EXPORT_TYPE), requestedByEmployeeId: id,
+  }) satisfies z.ZodType<C.CreateComplianceExportInput>,
+  createAuditReplay: z.strictObject({ orgId: id, threadId: id, createdByEmployeeId: id }) satisfies z.ZodType<C.CreateAuditReplayInput>,
+  createLegalHold: z.strictObject({
+    orgId: id, entityType: z.enum(["organization", "employee", "agent", "chat_thread", "file_object"]), entityId: id, reason: z.string(), createdByEmployeeId: id,
+  }) satisfies z.ZodType<C.CreateLegalHoldInput>,
+  setLegalHoldState: z.strictObject({ orgId: id, legalHoldId: id, active: z.boolean(), employeeId: id }) satisfies z.ZodType<C.SetLegalHoldStateInput>,
+  createRetentionFreeze: z.strictObject({
+    orgId: id, scopeType: z.enum(["organization", "chat_space", "file_object"]), scopeId: id, reason: z.string(), createdByEmployeeId: id,
+  }) satisfies z.ZodType<C.CreateRetentionFreezeInput>,
+  setRetentionFreezeState: z.strictObject({ orgId: id, retentionFreezeId: id, active: z.boolean(), employeeId: id }) satisfies z.ZodType<C.SetRetentionFreezeStateInput>,
+  connectComposioToolkit: z.strictObject({ orgId: id, toolkitSlug: z.string(), label: z.string() }) satisfies z.ZodType<C.ConnectComposioToolkitInput>,
+  disconnectComposioToolkit: z.strictObject({ orgId: id, toolkitSlug: z.string(), label: z.string() }) satisfies z.ZodType<C.DisconnectComposioToolkitInput>,
+  refreshComposioAccounts: z.strictObject({ orgId: id }) satisfies z.ZodType<C.RefreshComposioAccountsInput>,
+  grantConnector: z.strictObject({ orgId: id, agentId: id, toolkitSlug: z.string(), accountLabel: z.string(), employeeId: id }) satisfies z.ZodType<C.GrantConnectorInput>,
+  revokeConnector: z.strictObject({ orgId: id, agentId: id, toolkitSlug: z.string() }) satisfies z.ZodType<C.RevokeConnectorInput>,
+  approvalDrifts: z.strictObject({ orgId: id }),
+  search: z.strictObject({
+    orgId: id, employeeId: id, query: z.string(), entityTypes: z.array(z.enum(SEARCH_ENTITY_TYPES)).optional(), limit: z.number().optional(),
+  }) satisfies z.ZodType<C.SearchInput>,
+};