fix(electron): ensure valid values cross bridge (#1256)

This PR will surround the IPC message send with a try catch in case
someone attempts to send a non-serializable.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Changes renderer↔main IPC behavior by catching `sendSync`
serialization failures and returning fallbacks, which could mask errors
or change returned values in edge cases. Also adjusts Electron version
constraints, which may affect downstream compatibility.
> 
> **Overview**
> Improves Electron renderer→main IPC robustness by wrapping several
`ipcRenderer.sendSync` calls (`variation*`, `jsonVariation*`, `track`)
in `safeSendSync`, returning a fallback value when IPC
serialization/clone fails and emitting a warning via a new `log` IPC
channel.
> 
> Adds main-process handling for the new `log` channel in
`ElectronClient` (dispatching to `logger` for `error|warn|info|debug`
only) and updates tests to cover fallback behavior and invalid log
levels. Updates Electron dependency/peer dependency constraints (SDK
peer dep now `electron >=34.5.6`, dev/example use `^40.2.1`).
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
c6e89f1. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/launchdarkly/js-core/pull/1256"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

Author: joker23

packages/sdk/electron/__tests__/ElectronClient.ipcMain.test.ts

@@ -167,6 +167,28 @@ describe('given an initialized ElectronClient', () => {
     expect(result).toEqual({ status: 'completed' });
   });
 
+  it('handles log() by dispatching to the correct logger method', () => {
+    mockIpcMain.getHandler(getEventName('log'))?.({}, 'warn', 'test warning');
+    expect(logger.warn).toHaveBeenCalledWith('test warning');
+
+    mockIpcMain.getHandler(getEventName('log'))?.({}, 'error', 'test error');
+    expect(logger.error).toHaveBeenCalledWith('test error');
+
+    mockIpcMain.getHandler(getEventName('log'))?.({}, 'info', 'test info');
+    expect(logger.info).toHaveBeenCalledWith('test info');
+
+    mockIpcMain.getHandler(getEventName('log'))?.({}, 'debug', 'test debug');
+    expect(logger.debug).toHaveBeenCalledWith('test debug');
+  });
+
+  it('ignores log() calls with invalid severity levels', () => {
+    mockIpcMain.getHandler(getEventName('log'))?.({}, 'invalid', 'should be ignored');
+    expect(logger.warn).not.toHaveBeenCalled();
+    expect(logger.error).not.toHaveBeenCalled();
+    expect(logger.info).not.toHaveBeenCalled();
+    expect(logger.debug).not.toHaveBeenCalled();
+  });
+
   it('handles jsonVariation() call', () => {
     const expected = { key1: 'value', key2: true };
 

packages/sdk/electron/__tests__/bridge/LDClientBridge.test.ts

@@ -14,6 +14,7 @@ jest.mock('electron', () => ({
     }),
   },
   ipcRenderer: {
+    send: jest.fn(),
     sendSync: jest.fn(),
     invoke: jest.fn(),
     postMessage: jest.fn(),
@@ -360,6 +361,36 @@ describe('given a registered LDClientBridge', () => {
     expect(result).toEqual(true);
   });
 
+  it('sends log warning and returns fallback when sendSync throws', () => {
+    const error = new Error('Could not clone');
+    (ipcRenderer.sendSync as jest.Mock).mockImplementationOnce(() => {
+      throw error;
+    });
+
+    const defaultValue = { key: 'default' };
+    const result = bridge.jsonVariation('flag1', defaultValue);
+
+    expect(result).toEqual(defaultValue);
+    expect(ipcRenderer.send).toHaveBeenCalledWith(
+      getEventName('log'),
+      'warn',
+      expect.stringContaining('Could not clone'),
+    );
+  });
+
+  it('returns well-formed detail on error for variationDetail', () => {
+    (ipcRenderer.sendSync as jest.Mock).mockImplementationOnce(() => {
+      throw new Error('clone failed');
+    });
+
+    const result = bridge.variationDetail('flag1', 'fallback');
+
+    expect(result).toEqual({
+      value: 'fallback',
+      reason: { kind: 'ERROR', errorKind: 'EXCEPTION' },
+    });
+  });
+
   it('invokes optional onClose when the message port is closed', () => {
     const callback = jest.fn();
     const onClose = jest.fn();

packages/sdk/electron/src/ElectronClient.ts

@@ -18,6 +18,7 @@ import {
   LDHeaders,
   LDIdentifyOptions,
   LDIdentifyResult,
+  LDLogger,
   LDPluginEnvironmentMetadata,
   LDWaitForInitializationOptions,
   LDWaitForInitializationResult,
@@ -39,6 +40,8 @@ import type { LDPlugin } from './LDPlugin';
 import validateOptions, { filterToBaseOptions } from './options';
 import ElectronPlatform from './platform/ElectronPlatform';
 
+const VALID_LOG_LEVELS: ReadonlySet<string> = new Set(['error', 'warn', 'info', 'debug']);
+
 export class ElectronClient extends LDClientImpl {
   private readonly _initialContext: LDContext;
 
@@ -286,6 +289,12 @@ export class ElectronClient extends LDClientImpl {
       this.identifyResult(context, identifyOptions),
     );
 
+    ipcMain.on(getIPCChannelName(credential, 'log'), (_event, level: string, message: string) => {
+      if (VALID_LOG_LEVELS.has(level)) {
+        this.logger[level as keyof LDLogger](message);
+      }
+    });
+
     ipcMain.on(getIPCChannelName(credential, 'jsonVariation'), (event, key, defaultValue) => {
       // eslint-disable-next-line no-param-reassign
       event.returnValue = this.jsonVariation(key, defaultValue);

packages/sdk/electron/src/ElectronIPC.ts

@@ -12,6 +12,7 @@ type IPCSyncChannel =
   | 'getContext'
   | 'jsonVariation'
   | 'jsonVariationDetail'
+  | 'log'
   | 'numberVariation'
   | 'numberVariationDetail'
   | 'stringVariation'
@@ -36,6 +37,7 @@ export const AllSyncChannels: readonly IPCSyncChannel[] = [
   'getContext',
   'jsonVariation',
   'jsonVariationDetail',
+  'log',
   'numberVariation',
   'numberVariationDetail',
   'stringVariation',

packages/sdk/electron/src/bridge/index.ts

@@ -14,6 +14,7 @@ import type {
   LDWaitForInitializationResult,
 } from '@launchdarkly/js-client-sdk-common';
 
+import type { IPCChannel } from '../ElectronIPC';
 import { getIPCChannelName } from '../ElectronIPC';
 import type { LDClientBridge, LDMessagePort } from './LDClientBridge';
 
@@ -23,6 +24,25 @@ import type { LDClientBridge, LDMessagePort } from './LDClientBridge';
 const generateCallbackId = () =>
   `${Date.now().toString(36)}${Math.random().toString(36).substring(2)}`.toUpperCase();
 
+function safeSendSync<T>(
+  namespace: string,
+  method: IPCChannel,
+  fallback: T,
+  ...args: unknown[]
+): T {
+  try {
+    return ipcRenderer.sendSync(getIPCChannelName(namespace, method), ...args);
+  } catch (e: unknown) {
+    const message = e instanceof Error ? e.message : String(e);
+    ipcRenderer.send(
+      getIPCChannelName(namespace, 'log'),
+      'warn',
+      `${method}: a value is not IPC-serializable and will be dropped. ${message}`,
+    );
+    return fallback;
+  }
+}
+
 const ldClientBridge = (namespace: string): LDClientBridge => ({
   allFlags: (): LDFlagSet => ipcRenderer.sendSync(getIPCChannelName(namespace, 'allFlags')),
 
@@ -43,10 +63,16 @@ const ldClientBridge = (namespace: string): LDClientBridge => ({
     ipcRenderer.invoke(getIPCChannelName(namespace, 'identify'), context, identifyOptions),
 
   jsonVariation: (key: string, defaultValue: unknown): unknown =>
-    ipcRenderer.sendSync(getIPCChannelName(namespace, 'jsonVariation'), key, defaultValue),
+    safeSendSync<unknown>(namespace, 'jsonVariation', defaultValue, key, defaultValue),
 
   jsonVariationDetail: (key: string, defaultValue: unknown): LDEvaluationDetailTyped<unknown> =>
-    ipcRenderer.sendSync(getIPCChannelName(namespace, 'jsonVariationDetail'), key, defaultValue),
+    safeSendSync<LDEvaluationDetailTyped<unknown>>(
+      namespace,
+      'jsonVariationDetail',
+      { value: defaultValue, reason: { kind: 'ERROR', errorKind: 'EXCEPTION' } },
+      key,
+      defaultValue,
+    ),
 
   waitForInitialization: (
     options?: LDWaitForInitializationOptions,
@@ -65,14 +91,21 @@ const ldClientBridge = (namespace: string): LDClientBridge => ({
   stringVariationDetail: (key: string, defaultValue: string): LDEvaluationDetailTyped<string> =>
     ipcRenderer.sendSync(getIPCChannelName(namespace, 'stringVariationDetail'), key, defaultValue),
 
-  track: (key: string, data?: any, metricValue?: number): void =>
-    ipcRenderer.sendSync(getIPCChannelName(namespace, 'track'), key, data, metricValue),
+  track: (key: string, data?: any, metricValue?: number): void => {
+    safeSendSync<void>(namespace, 'track', undefined, key, data, metricValue);
+  },
 
   variation: (key: string, defaultValue?: LDFlagValue): LDFlagValue =>
-    ipcRenderer.sendSync(getIPCChannelName(namespace, 'variation'), key, defaultValue),
+    safeSendSync<LDFlagValue>(namespace, 'variation', defaultValue, key, defaultValue),
 
   variationDetail: (key: string, defaultValue?: LDFlagValue): LDEvaluationDetail =>
-    ipcRenderer.sendSync(getIPCChannelName(namespace, 'variationDetail'), key, defaultValue),
+    safeSendSync<LDEvaluationDetail>(
+      namespace,
+      'variationDetail',
+      { value: defaultValue, reason: { kind: 'ERROR', errorKind: 'EXCEPTION' } },
+      key,
+      defaultValue,
+    ),
 
   setConnectionMode: (mode: ConnectionMode): Promise<void> =>
     ipcRenderer.invoke(getIPCChannelName(namespace, 'setConnectionMode'), mode),