fix: harden R Console session transports and persistence

.github/workflows/build-sidecar.yml

@@ -23,6 +23,10 @@ on:
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.head.ref || github.ref_name }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/ci.yml

@@ -8,6 +8,10 @@ on:
   workflow_dispatch:
   workflow_call:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.head.ref || github.ref_name }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
@@ -35,10 +39,20 @@ jobs:
           r-version: release
           rtools-version: none
       - run: npm ci
+      - name: Audit npm dependencies
+        if: runner.os == 'Linux'
+        run: npm audit --audit-level=low
       - name: Type-check and bundle
         run: npm run package:extension
       - name: Unit tests
         run: npm test
+      - name: Install Linux system dependency for R fs
+        if: runner.os == 'Linux'
+        run: sudo apt-get update && sudo apt-get install -y libuv1-dev
+      - name: Real R LSP authentication and protocol integration
+        run: |
+          Rscript -e "packages <- c('digest', 'languageserver'); repo <- Sys.getenv('RSPM'); if (!nzchar(repo)) repo <- 'https://cloud.r-project.org'; needed <- setdiff(packages, rownames(installed.packages())); if (length(needed)) install.packages(needed, repos = repo); stopifnot(all(vapply(packages, requireNamespace, logical(1), quietly = TRUE)))"
+          node --test tests/lsp-startup.test.cjs tests/lsp-integration.test.cjs
       - name: Extension host smoke test (Linux)
         if: runner.os == 'Linux'
         run: xvfb-run -a npm run test:extension-host

.github/workflows/release.yml

@@ -128,6 +128,13 @@ jobs:
             exit 0
           fi
 
+          # Even if the version is unchanged, never restore a backend whose
+          # Rust implementation differs from the published binary.
+          if ! git diff --quiet "${previous_tag}" HEAD -- sidecar/pty-host/src sidecar/pty-host/Cargo.toml sidecar/pty-host/Cargo.lock; then
+            echo "Rust runtime inputs changed; building the sidecar rather than restoring a stale binary."
+            exit 0
+          fi
+
           runtime_build_inputs=(scripts/build-sidecar.js scripts/sidecar-targets.js)
           if [[ "${TARGET}" == win32-* ]]; then
             runtime_build_inputs+=(images/Rlogo.ico)

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to R Console will be documented in this file.
 
+## [Unreleased]
+
+### Security
+
+- Improved the security of R Console connections, including persistent sessions and language-server communication.
+
 ## [0.5.4] - 2026-10-23
 
 ### Added