fix(desktop): address review findings (handoff callback gate, fail-closed guards)

- handoff: gate onCallback on a non-consuming state match so a format-valid but
  wrong/expired state no longer fires the callback (which surfaced a spurious
  "sign-in failed" UI while the genuine callback was still pending). The
  one-shot listener still survives wrong-state requests (self-DoS guard);
  consume() re-validates and tears it down on the real callback.
- session: the agent-partition onBeforeRequest SSRF check now fails closed —
  an unexpected rejection cancels the request instead of leaving it suspended.
- updater: the manual checkForUpdates() now has a .catch() that logs and shows
  an error dialog instead of silently swallowing network/manifest failures.

Author: waleedlatif1

apps/desktop/src/main/browser-agent/session.ts

@@ -79,12 +79,19 @@ function configureAgentPartition(ses: Session): void {
   // document's check).
   ses.webRequest.onBeforeRequest((details, callback) => {
     if (details.resourceType === 'mainFrame' || details.resourceType === 'subFrame') {
-      void checkAgentUrl(details.url).then((guard) => {
-        if (!guard.ok) {
-          logger.warn('Blocked agent document navigation to a private host')
-        }
-        callback({ cancel: !guard.ok })
-      })
+      void checkAgentUrl(details.url)
+        .then((guard) => {
+          if (!guard.ok) {
+            logger.warn('Blocked agent document navigation to a private host')
+          }
+          callback({ cancel: !guard.ok })
+        })
+        .catch((error) => {
+          // Fail closed: an unexpected rejection must cancel, never leave the
+          // request suspended with no callback.
+          logger.error('Agent SSRF check failed; cancelling request', { error })
+          callback({ cancel: true })
+        })
       return
     }
     callback({ cancel: isBlockedRequestUrl(details.url) })

apps/desktop/src/main/handoff.test.ts

@@ -97,11 +97,13 @@ describe('createHandoffManager', () => {
     expect(received).toHaveLength(0)
 
     // A format-valid but WRONG state must NOT tear down the one-shot listener
-    // (self-DoS guard) — the server stays up for the genuine callback.
+    // (self-DoS guard) and must NOT fire the callback — firing it would surface
+    // a spurious "sign-in failed" UI while the genuine callback is still pending.
     const wrongState = 'z'.repeat(state.length)
     expect(
       (await fetch(`${base}/auth/callback?token=${VALID_TOKEN}&state=${wrongState}`)).status
     ).toBe(200)
+    expect(received).toHaveLength(0)
     expect(manager.consume(wrongState)).toBe(false)
 
     // The genuine callback still lands while the server is up.

apps/desktop/src/main/handoff.ts

@@ -70,6 +70,14 @@ export function createHandoffManager(
     }
   }
 
+  /** Constant-time, non-consuming check that a callback's state matches the live
+   * pending handoff. Gates the callback so a wrong/expired state is ignored
+   * without consuming the pending handoff or surfacing a failure. */
+  const matchesPendingState = (state: string): boolean =>
+    pending !== null &&
+    now() - pending.createdAt <= HANDOFF_TTL_MS &&
+    safeCompare(pending.state, state)
+
   const startLoopback = async (): Promise<number | undefined> => {
     stopLoopback()
     const server = createServer((request, response) => {
@@ -87,11 +95,14 @@ export function createHandoffManager(
       response
         .writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' })
         .end(CALLBACK_RESPONSE_HTML)
-      // Do NOT tear the server down here: a request with a format-valid but
-      // wrong state must not kill the one-shot listener before the genuine
-      // callback arrives. `consume()` stops the server once the state actually
-      // validates (via clear()); the TTL timer is the backstop otherwise.
-      onCallback({ token, state })
+      // Only a state match advances the flow. A format-valid but wrong/expired
+      // state gets the generic 200 page and is otherwise ignored: the one-shot
+      // listener survives for the genuine callback (TTL is the backstop) and no
+      // spurious "sign-in failed" UI fires. `consume()` in the callback path
+      // re-validates and tears the server down once the real state lands.
+      if (matchesPendingState(state)) {
+        onCallback({ token, state })
+      }
     })
     loopbackServer = server
     try {

apps/desktop/src/main/updater.ts

@@ -237,9 +237,19 @@ export function checkForUpdatesInteractive(deps: UpdaterDeps): void {
   if (!autoUpdater) {
     return
   }
-  void autoUpdater.checkForUpdates().then((result) => {
-    if (!result || result.updateInfo.version === app.getVersion()) {
-      void dialog.showMessageBox({ type: 'info', message: 'Sim is up to date' })
-    }
-  })
+  void autoUpdater
+    .checkForUpdates()
+    .then((result) => {
+      if (!result || result.updateInfo.version === app.getVersion()) {
+        void dialog.showMessageBox({ type: 'info', message: 'Sim is up to date' })
+      }
+    })
+    .catch((error) => {
+      logger.error('Manual update check failed', { error })
+      void dialog.showMessageBox({
+        type: 'error',
+        message: 'Could not check for updates',
+        detail: 'Something went wrong reaching the update server. Try again later.',
+      })
+    })
 }