meshbay.git/packages/meshbay-client/src, branch 0.17MeshBay — read-only public mirrorhttps://git.meshbay.org/meshbay.git/atom?h=0.172026-10-01T13:52:08Zfix(client): rotating a group key asks nothing2026-10-01T13:52:08ZChristophe Bessoncbesson@gmail.com2026-10-01T13:52:08Zurn:sha1:fcac9dcb6ba0ad346a754c7b9e7c59d38b64a4e8
Rotation narrows rather than widens: members still connected receive the
new key, and nothing already shared changes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fix(client): hosting a group asks nothing when its folder came from the picker2026-10-01T13:49:42ZChristophe Bessoncbesson@gmail.com2026-10-01T13:49:42Zurn:sha1:a64fe23de95f1495a831a1595b398fdd6149097e
The folder chosen in the native picker is the consent; the dialog that
followed on every group creation asked the same thing twice.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fix: an MBK2 bundle is opened once and stored again as MBK32026-10-01T11:06:32ZChristophe Bessoncbesson@gmail.com2026-10-01T11:06:32Zurn:sha1:e0905bd447f6214dc34e360554826ace45bde676
Transitional. The Argon2 run that makes M makes A, the key MBK2 bundles were
sealed under; a session keeps it as a decrypt-only key (IndexedDB in a browser,
the key storage in the desktop app). A client meeting an MBK2 bundle opens it —
or its recovery copy — and stores the same identity as MBK3 once connected; the
desktop app reseals or withdraws it as browser access says. A session without
A asks for the passphrase once. Older formats stay refused by name. Replaces
the unpin-and-reinvite step the 0.17 flag day required on every node.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fix: downloads are marked and keep their extension; Explorer files are refused2026-10-01T09:47:39ZChristophe Bessoncbesson@gmail.com2026-10-01T09:47:39Zurn:sha1:760ac421b1944cd69a80e3a92127a1a966f15938
The desktop app writes the Mark-of-the-Web on each file it saves on Windows, as
a browser does. Bidirectional controls are reserved characters in a saved name
(portable-name.js and paths.sanitize_for_download, and again in the main
process), so a name cannot display one extension and carry another. The node
refuses uploads of files Windows Explorer acts on by itself: desktop.ini,
.lnk, .url, .scf, .library-ms, .searchConnector-ms (F-19).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fix(node): how a hosted group admits people is the operator's, not the hub's2026-10-01T07:46:39ZChristophe Bessoncbesson@gmail.com2026-10-01T07:46:39Zurn:sha1:0d0898c656afb8c1faa9fa91ba525e8a3e6a34ee
attach_group no longer copies join_policy and visibility from the hub's
answer: they come with the operator's request (the desktop creation form,
`group add --open`) and default to invite/private; the CLI says when the hub
lists the group otherwise. Every string written into node.toml is escaped
(toml_string) and read back through tomllib, so a group or folder name cannot
write lines of its own (F-17).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fix: an identity signs a named kind, and a device approval answers a request2026-09-30T19:04:39ZChristophe Bessoncbesson@gmail.com2026-09-30T19:04:39Zurn:sha1:0378e8e0912a1a7e6cea4424e69d524e7afecbf8
The desktop main process builds every transcript itself from fields
(transcripts.js) and signs no raw bytes; the page's identity has the same
contract (crypto.js transcriptFor). The keyring seals no bundle while browser
access is off. On the node, device_add must redeem a pending request filed by
the same keys, and device_revoke is signed under its own prefix
(meshbay:device_revoke:v1), so a retirement signature admits nothing.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
feat(client): the desktop application keeps M and every node identity in its main process2026-09-30T14:58:31ZChristophe Bessoncbesson@gmail.com2026-09-30T14:58:31Zurn:sha1:6d167392f6f8ede37e2794a68a3738f8ba03131d
keyring.js derives, opens, mints, seals, signs and agrees there; the page gets
public keys and a handle. Argon2 comes from the page's own WebAssembly build
(Electron's crypto has none). Without OS key storage the page keeps its keys as
a browser does. A node's bundle is settled after connecting, re-sealed when the
key changed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fix: the page connects to its own origin and reCAPTCHA, nowhere else2026-09-30T11:09:54ZChristophe Bessoncbesson@gmail.com2026-09-30T11:09:47Zurn:sha1:87725dc7a2da27c2ca3b9e58af751f0e6f8c9de7
connect-src drops https: and wss: in both policies. Checked against Google's
reCAPTCHA test keys: in Chrome widget, token and registration unchanged; in
Firefox the widget loads; no violation reported in either.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fix(client): the page names node operations, and the app confirms what widens the node2026-09-30T10:57:58ZChristophe Bessoncbesson@gmail.com2026-09-30T10:57:58Zurn:sha1:2c6921aa2c35ffd41b6c453e6700574ef631ba2c
node:call is replaced by named operations with checked arguments; hosting a
group, sharing an unpicked folder, key rotation, denylist clearing and a change
of node account are confirmed by a native dialog. Every channel checks its
sender, secrets:get/set/clear are gone, node:start writes the app's own hub.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
refactor: remove dead code across packages2026-09-28T16:22:07ZChristophe Bessoncbesson@gmail.com2026-09-28T16:22:07Zurn:sha1:f63104b82da24ff3f406c53346300bd50788796f
Unused modules, functions, constants and client helpers with no caller,
the unreachable hub:probe IPC handler, and the CSAM hash matching.
Behaviour unchanged; the dispatch golden loses only the two removed
message types.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>