fix: address CodeRabbit review findings

Pin release workflow actions to commit SHAs, validate the IPC sender and
handle window-open rejections in the desktop app, keep the updater state
across window recreation and respect the auto-update preference on
manual checks, and inline single-use version-check wrappers in the CLI
launcher.

Author: elkaix

.changeset/sdk-event-union.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code-sdk": minor
+---
+
+Add question, approval, and prompt lifecycle events to the SDK session event types.

.github/workflows/desktop-release.yml

@@ -17,14 +17,14 @@ jobs:
     runs-on: macos-15
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # pinned from v4
         with:
           fetch-depth: 0
           persist-credentials: true
 
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # pinned from v6
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # pinned from v6
         with:
           node-version-file: .nvmrc
           cache: pnpm
@@ -64,7 +64,7 @@ jobs:
 
       - name: Upload macOS artifacts for manual runs
         if: github.event_name == 'workflow_dispatch'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # pinned from v7
         with:
           name: desktop-macos
           path: |

apps/desktop/src/main.ts

@@ -163,6 +163,13 @@ function hasOrigin(raw: string, expected: string): boolean {
   }
 }
 
+function assertTrustedSender(event: Electron.IpcMainInvokeEvent): void {
+  const frame = event.senderFrame
+  if (hostOrigin === undefined || frame === null || frame !== event.sender.mainFrame || !hasOrigin(frame.url, hostOrigin)) {
+    throw new Error('desktop update IPC rejected an untrusted sender')
+  }
+}
+
 /** Install navigation and permission policy before the first renderer loads. */
 function hardenSession(): void {
   const desktopSession = session.defaultSession
@@ -234,24 +241,40 @@ async function createMainWindow(): Promise<BrowserWindow> {
   return window
 }
 
-ipcMain.handle('pythinker:update:get', () => getUpdateState())
-ipcMain.handle('pythinker:update:set-auto', (_event, enabled: unknown) => {
+function showWindowSafely(): void {
+  void lifecycle?.showWindow().catch((error: unknown) => {
+    console.error('desktop window failed to open:', error)
+  })
+}
+
+ipcMain.handle('pythinker:update:get', (event) => {
+  assertTrustedSender(event)
+  return getUpdateState()
+})
+ipcMain.handle('pythinker:update:set-auto', (event, enabled: unknown) => {
+  assertTrustedSender(event)
   if (typeof enabled !== 'boolean') throw new TypeError('automatic updates must be a boolean')
   return setAutoUpdate(enabled)
 })
-ipcMain.handle('pythinker:update:check', () => checkForUpdatesNow())
-ipcMain.handle('pythinker:update:install', () => quitAndInstallNow())
+ipcMain.handle('pythinker:update:check', (event) => {
+  assertTrustedSender(event)
+  return checkForUpdatesNow()
+})
+ipcMain.handle('pythinker:update:install', (event) => {
+  assertTrustedSender(event)
+  return quitAndInstallNow()
+})
 
 function createTray(images: TrayImages): void {
   tray = new Tray(images.idle)
   tray.setToolTip(APP_NAME)
   const template: MenuItemConstructorOptions[] = [
-    { label: 'Open Pythinker', click: () => { void lifecycle?.showWindow() } },
+    { label: 'Open Pythinker', click: showWindowSafely },
     { type: 'separator' },
     { label: 'Quit', click: () => { void requestAppQuit() } },
   ]
   tray.setContextMenu(Menu.buildFromTemplate(template))
-  tray.on('click', () => { void lifecycle?.showWindow() })
+  tray.on('click', showWindowSafely)
 }
 
 function releaseAppQuit(): void {
@@ -333,8 +356,8 @@ async function boot(): Promise<void> {
 if (!app.requestSingleInstanceLock()) {
   app.quit()
 } else {
-  app.on('second-instance', () => { void lifecycle?.showWindow() })
-  app.on('activate', () => { void lifecycle?.showWindow() })
+  app.on('second-instance', showWindowSafely)
+  app.on('activate', showWindowSafely)
   app.on('window-all-closed', () => {
     // Tray and Host own application lifetime on every platform.
   })

apps/desktop/src/updater.ts

@@ -53,6 +53,7 @@ let getWindow: (() => BrowserWindow | undefined) | undefined
 let initialCheckTimer: ReturnType<typeof setTimeout> | undefined
 let checkInterval: ReturnType<typeof setInterval> | undefined
 let listenersWired = false
+let initialized = false
 let updateTelemetryTrack: UpdateTelemetryTrack = () => {}
 
 export function trackUpdateTransition(
@@ -162,6 +163,13 @@ export function initUpdater(
   windowGetter: () => BrowserWindow | undefined,
   track: UpdateTelemetryTrack = () => {},
 ): void {
+  if (initialized) {
+    getWindow = windowGetter
+    updateTelemetryTrack = track
+    updateState({})
+    return
+  }
+  initialized = true
   getWindow = windowGetter
   updateTelemetryTrack = track
   settings = readUpdateSettings(app.getPath('userData'))
@@ -176,7 +184,7 @@ export function initUpdater(
 
   try {
     autoUpdater.autoDownload = settings.autoUpdate
-    autoUpdater.autoInstallOnAppQuit = true
+    autoUpdater.autoInstallOnAppQuit = settings.autoUpdate
   } catch (error) {
     stateError(error)
     return
@@ -205,15 +213,16 @@ export function setAutoUpdate(enabled: boolean): UpdateState {
 
   try {
     autoUpdater.autoDownload = enabled
+    autoUpdater.autoInstallOnAppQuit = enabled
   } catch (error) {
     stateError(error)
     return state
   }
-  if (!enabled) {
-    clearTimers()
-  } else {
+  if (enabled) {
     scheduleChecks()
     if (!wasEnabled) void checkForUpdatesNow()
+  } else {
+    clearTimers()
   }
   return state
 }
@@ -230,7 +239,11 @@ export async function checkForUpdatesNow(): Promise<UpdateState> {
     stateError(error)
     return state
   }
-  return runCheck()
+  try {
+    return await runCheck()
+  } finally {
+    autoUpdater.autoDownload = settings.autoUpdate
+  }
 }
 
 export function quitAndInstallNow(): UpdateState {

apps/pythinker-code/src/launcher.ts

@@ -3,6 +3,7 @@ import { spawn } from 'node:child_process';
 const FFI_FLAG = '--experimental-ffi';
 const FFI_WARNING_FLAG = '--disable-warning=ExperimentalWarning';
 const FFI_CHILD_ENV = 'PYTHINKER_CODE_FFI_CHILD';
+// Local on purpose: the FFI launcher test executes this file standalone, so it must stay import-free beyond node builtins.
 const REQUIRED_RUNTIME = 'Node.js 20 or newer';
 const MINIMUM_NODE = [20, 0, 0] as const;
 const FFI_NODE = [26, 4, 0] as const;
@@ -27,14 +28,6 @@ function isVersionBelow(
   return patch < reqPatch;
 }
 
-function isRuntimeTooOld(): boolean {
-  return isVersionBelow(process.versions.node, MINIMUM_NODE);
-}
-
-function supportsFfi(): boolean {
-  return !isVersionBelow(process.versions.node, FFI_NODE);
-}
-
 function isFfiProcess(): boolean {
   // Only execArgv decides: a stale env marker must never bypass the FFI re-exec.
   return process.execArgv.includes(FFI_FLAG);
@@ -96,7 +89,7 @@ function launchWindowsFallback(
 }
 
 async function launch(): Promise<void> {
-  if (isRuntimeTooOld()) {
+  if (isVersionBelow(process.versions.node, MINIMUM_NODE)) {
     process.stderr.write(
       `Pythinker Code requires ${REQUIRED_RUNTIME}; you are running Node.js ${process.versions.node}.\n` +
         `${NATIVE_INSTALL_HINT}\n`,
@@ -105,7 +98,7 @@ async function launch(): Promise<void> {
     return;
   }
 
-  if (!supportsFfi()) {
+  if (isVersionBelow(process.versions.node, FFI_NODE)) {
     await import(new URL('./main.mjs', import.meta.url).href);
     return;
   }