[Medium] Analysis edits are persisted without validating the payload shape

Severity

Medium — untrusted-shape data persisted and consumed downstream without validation.

Location

• electron/ipc.ts:173 (updateAnalysis handler) validates only input.sessionId; it forwards title / intent / steps unchecked.
• electron/describer/describer.ts:142 (edit) persists the edited analysis.

Mechanism

The renderer-supplied steps (and title/intent) are written to the persisted analysis with no schema validation of the array/step shape. Malformed or partial structures reach bundle/builder consumers that assume a well-formed Analysis.

Impact

A malformed edit can corrupt the persisted analysis and cause downstream builder failures or bad output — and, because it's persisted, the corruption survives restarts.

Suggested fix

Validate the payload against the Analysis/step schema (types, required fields, step shape) in the handler or in describer.edit before persisting; reject with a clear error otherwise.

Regression test to add (npm test)

Unit test updateAnalysis/edit with a malformed payload (missing/typo'd step fields); assert it's rejected and nothing is persisted. Deterministic; the evals/ suites score model output, not this IPC validation.

Start in electron/ipc.ts at the updateAnalysis handler and then read electron/describer/describer.ts around edit. Trace the Analysis and step shapes used before persistence, then run npm test with a malformed payload such as a step missing required fields. Done means the payload is rejected and the edited analysis is not persisted.