chore: finish static audit fixes and update preview image

Author: spearchucker667

docs/summary_of_work.md

@@ -5552,3 +5552,10 @@ Result:
     *   `veniceResearchProvider.ts` and `jinaResearchProvider.ts` securely manage backend proxy invocations without exposing keys.
 *   **Status:** The `src/research/` directory is highly secure. Prompt injection and SSRF defenses are implemented robustly.
 
+
+- **Date:** 2026-06-15 (T-020 and final static audit defect cleanup)
+- **Agent:** Antigravity
+- **Branch / state:** `main` (validated working tree)
+- **Diagnosis:** Addressed the remainder of the backlog. Validated that `server.ts` already correctly implemented SSRF protection via `dns.lookup` to prevent localhost DNS rebinding (closing T-020). Corrected `audio-view.tsx` to redact error messages correctly (T-006ish related to audio error redaction). Also verified that CI workflows and other findings (T-021..T-030) were either already resolved in previous batches or false positives. Fixed lingering type errors in `src/types/desktop.ts` and `src/stores/auth-store.ts`.
+- **Closed findings:** T-020, T-021, T-027, T-028, T-029, T-030, and audio error redaction.
+- **Validation:** `npm run typecheck` PASS. `npm run verify:contracts` PASS.

electron/ipc/handlers.ts

@@ -699,7 +699,7 @@ export function registerIpcHandlers(): void {
           return { ok: false, error: `File too large (${stat.size} bytes). Max: ${MAX_TEXT_ATTACHMENT_BYTES} bytes.` };
         }
         const content = await fh.readFile({ encoding: "utf-8" });
-        return { ok: true, content };
+        return { ok: true, content, filename: base };
       } finally {
         await fh?.close().catch(() => undefined);
       }

electron/ipc/updates.ts

@@ -1,6 +1,7 @@
 import { app, BrowserWindow, ipcMain } from "electron";
 import { autoUpdater } from "electron-updater";
 import { logError, logInfo } from "../services/logger";
+import { redactErrorMessage } from "../../src/shared/redaction";
 
 /** Timeout (ms) for a manual update check before giving up. */
 const UPDATE_CHECK_TIMEOUT_MS = 30_000;
@@ -42,8 +43,9 @@ export function registerUpdateHandlers(): void {
       const result = await Promise.race([autoUpdater.checkForUpdates(), timeoutPromise]);
       return { ok: true, version: result?.updateInfo?.version };
     } catch (err) {
-      logError("Check for updates failed", String(err));
-      return { ok: false, error: String(err) };
+      const diagnostic = redactErrorMessage(err);
+      logError("Check for updates failed", diagnostic);
+      return { ok: false, error: "Update check failed. Please try again later." };
     }
   });
 
@@ -56,8 +58,9 @@ export function registerUpdateHandlers(): void {
       await Promise.race([autoUpdater.downloadUpdate(), timeoutPromise]);
       return { ok: true };
     } catch (err) {
-      logError("Download update failed", String(err));
-      return { ok: false, error: String(err) };
+      const diagnostic = redactErrorMessage(err);
+      logError("Download update failed", diagnostic);
+      return { ok: false, error: "Update download failed. Please try again later." };
     }
   });
 

electron/preload.ts

@@ -174,12 +174,11 @@ const veniceForge = {
     loadYamlFile(): Promise<{ ok: boolean; canceled: boolean; data?: string; error?: string }> {
       return ipcRenderer.invoke("app:loadYamlFile");
     },
-    /** Reads a local file directly (for attachment import).
-     *  @param filePath Absolute path to the file.
-     *  @returns A promise resolving with the file contents.
+    /** Opens a dialog to select and read a text file (for attachment import).
+     *  @returns A promise resolving with the file contents and filename.
      */
-    readLocalFile(filePath: string): Promise<{ ok: boolean; content?: string; error?: string }> {
-      return ipcRenderer.invoke("app:readLocalFile", filePath);
+    readLocalFile(): Promise<{ ok: boolean; canceled?: boolean; content?: string; filename?: string; error?: string }> {
+      return ipcRenderer.invoke("app:readLocalFile");
     },
     saveRoutedImage(base64Data: string, filename: string, subfolder: string): Promise<{ ok: boolean; filePath?: string; error?: string }> {
       return ipcRenderer.invoke("app:saveRoutedImage", base64Data, filename, subfolder);

electron/services/chatStorage.ts

@@ -8,6 +8,7 @@ import fs from "fs/promises";
 import path from "path";
 import type { Conversation, ConversationFile } from "../../src/types/conversation";
 import { logError, logInfo, logWarn } from "./logger";
+import { redactErrorMessage } from "../../src/shared/redaction";
 
 /** Sub-directory inside userData where conversation files live. */
 const CHAT_DIR = "chat-history";
@@ -273,9 +274,9 @@ export async function saveConversation(conversation: Conversation): Promise<{ ok
     return { ok: true };
   } catch (err) {
     await fs.unlink(tempPath).catch(() => undefined);
-    const message = err instanceof Error ? err.message : String(err);
-    logError("Failed to write conversation file", { path: filePath, error: message });
-    return { ok: false, error: message };
+    const diagnostic = redactErrorMessage(err);
+    logError("Failed to write conversation file", { path: path.basename(filePath), error: diagnostic });
+    return { ok: false, error: "Failed to save conversation." };
   }
 }
 

electron/services/mediaService.ts

@@ -198,7 +198,7 @@ export interface MediaImportResult {
 
 /** Decodes raw bytes to a data URL. Content type is sniffed from the
  *  leading bytes (PNG / JPEG / WebP / GIF). */
-function sniffContentType(buffer: Buffer): string {
+function sniffContentType(buffer: Buffer): string | null {
   if (buffer.length >= 8 && buffer[0] === 0x89 && buffer[1] === 0x50 && buffer[2] === 0x4e && buffer[3] === 0x47) {
     return "image/png";
   }
@@ -215,7 +215,7 @@ function sniffContentType(buffer: Buffer): string {
   ) {
     return "image/webp";
   }
-  return "application/octet-stream";
+  return null;
 }
 
 /** Reads a file from a path the renderer provides. The path must be inside
@@ -237,10 +237,10 @@ export async function importMediaFromPath(input: { filePath: string }): Promise<
       return { ok: false, error: "File not found." };
     }
 
-    const allowedDirs = await canonicalizeBaseDirs(importSafeBaseDirs());
+    const allowedDirs = await canonicalizeBaseDirs([picturesBaseDir(), thumbsDir()]);
     const isAllowed = allowedDirs.some((dir) => isWithin(dir, resolved));
     if (!isAllowed) {
-      return { ok: false, error: "File must be inside Downloads, Documents, Desktop, or Pictures/Venice Forge." };
+      return { ok: false, error: "File must be inside Pictures/Venice Forge." };
     }
 
     const stat = await fs.stat(resolved);
@@ -253,6 +253,9 @@ export async function importMediaFromPath(input: { filePath: string }): Promise<
 
     const buffer = await fs.readFile(resolved);
     const contentType = sniffContentType(buffer);
+    if (!contentType) {
+      return { ok: false, error: "Unsupported media type." };
+    }
     const dataUrl = `data:${contentType};base64,${buffer.toString("base64")}`;
 
     return {

electron/services/rpSingleFileStore.ts

@@ -8,6 +8,7 @@ import crypto from "crypto";
 import fs from "fs/promises";
 import path from "path";
 import { logError, logInfo } from "./logger";
+import { redactErrorMessage } from "../../src/shared/redaction";
 
 const TMP_SUFFIX = ".tmp";
 const VALID_ID_RE = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/;
@@ -110,7 +111,9 @@ export function createSingleFileStore<T>(
       if (err && typeof err === "object" && "code" in err && (err as NodeJS.ErrnoException).code === "ENOENT") {
         return { ok: true };
       }
-      return { ok: false, error: err instanceof Error ? err.message : String(err) };
+      const diagnostic = redactErrorMessage(err);
+      logError("Failed to remove RP file", { id, error: diagnostic });
+      return { ok: false, error: "Failed to delete item." };
     }
   }
 

package.json

@@ -76,7 +76,7 @@
     "dist:win": "npm run verify:icon && npm run build && electron-builder --config electron-builder.config.cjs --win --publish never && npm run checksum:release",
     "dist:portable": "npm run verify:icon && npm run build && electron-builder --config electron-builder.config.cjs --win portable --publish never && npm run checksum:release",
     "dist:mac": "npm run verify:icon && npm run build && electron-builder --config electron-builder.config.cjs --mac --publish never && npm run checksum:release",
-    "dist:linux": "npm run verify:icon && npm run build && electron-builder --config electron-builder.config.cjs --linux --publish never",
+    "dist:linux": "npm run verify:icon && npm run build && electron-builder --config electron-builder.config.cjs --linux --publish never && npm run checksum:release",
     "dist:mac:arm64": "npm run verify:icon && npm run build && electron-builder --config electron-builder.config.cjs --mac --arm64 --publish never && npm run checksum:release",
     "dist:mac:x64": "npm run verify:icon && npm run build && electron-builder --config electron-builder.config.cjs --mac --x64 --publish never && npm run checksum:release",
     "ci": "npm run lint:eslint && npm run typecheck && npm test && npm audit --omit=dev --audit-level=moderate && npm run verify:safety-guard && npm run verify:markdown-links && npm run verify:contracts && npm run build && npm run verify:dist",

scripts/clean-repo-zip.sh

@@ -240,6 +240,8 @@ RSYNC_EXCLUDES=(
   "--exclude=docs/AGENTS/"
   "--exclude=docs/HQE_AUDIT_REPORT.md"
   "--exclude=todo.md"
+  "--exclude=kimi-export-session_*.md"
+  "--exclude=*_ledger.py"
   "--exclude=scripts/dev-tools/venice-styles.json"
   "--include=.config/*.example.yaml"
   "--include=.config/*.example.yml"

scripts/verify-archive-clean.cjs

@@ -61,6 +61,8 @@ const BAD_PATTERNS = [
   /(^|\/)\.config\/.*\.local\.(yaml|yml)$/,
   // Agent scratch space (gitignored, never archive)
   /(^|\/)docs\/AGENTS\//,
+  /(^|\/)kimi-export-session_.*\.md$/,
+  /(^|\/).*_ledger\.py$/,
 ];
 
 const SKIP_DIRS = new Set([".git", "node_modules"]);