fix: the page connects to its own origin and reCAPTCHA, nowhere else

connect-src drops https: and wss: in both policies. Checked against Google's
reCAPTCHA test keys: in Chrome widget, token and registration unchanged; in
Firefox the widget loads; no violation reported in either.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

4 files changed, 21 insertions, 10 deletions

diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md
index d63f722..b44359f 100644
--- a/docs/MESHBAY_DESIGN.md
+++ b/docs/MESHBAY_DESIGN.md
@@ -3266,7 +3266,7 @@ be understood, not so the incident can be retold.
 | Label | The rule it names |
 |---|---|
 | **H1** | **Per-group isolation on a multi-group node**: the chat store, the peer registry and the broadcast set are per group |
-| **H2** | Every value that originates outside the node — filenames chosen by members, usernames originating at the hub — is escaped where it is rendered. A CSP contains exfiltration but cannot prevent injected inline script, so escaping is the actual fix |
+| **H2** | Every value that originates outside the node — filenames chosen by members, usernames originating at the hub — is escaped where it is rendered. A CSP contains exfiltration — `connect-src` names the page's own origin and reCAPTCHA's, nothing else — but cannot prevent injected inline script, so escaping is the actual fix. The reCAPTCHA hosts in `script-src` remain a known gadget risk: a nonce policy would remove it, and the application's page, served from disk, cannot carry one |
 | **H3** | **No public key is ever fetched from a directory to wrap a group key for.** The node wraps for a key the recipient proved possession of, bound to an account by a code the hub never sees (§3.4) |
 | **H4** | Revocation reaches nodes, drops live sessions, and **persists across a restart** (§7.5) |
 | **H5** | An admin challenge is a **structured, domain-separated transcript naming the operation and subject**, and the client refuses to sign anything that is not what the user asked for (§5.4) |
diff --git a/packages/meshbay-client/src/main.js b/packages/meshbay-client/src/main.js
index 80f49e4..5e1120b 100644
--- a/packages/meshbay-client/src/main.js
+++ b/packages/meshbay-client/src/main.js
@@ -133,7 +133,9 @@ const CSP = [
   `img-src 'self' data: blob: ${RECAPTCHA_SRC}`,
   "media-src 'self' blob:",
   "font-src 'self'",
-  "connect-src 'self' https: wss:",
+  // Every hub call leaves from this process, so the page connects to nothing
+  // but its own files and reCAPTCHA; see the hub's webapp.CSP.
+  `connect-src 'self' ${RECAPTCHA_SRC}`,
   "worker-src 'self'",
   // `blob:` here and in `frame-src` are one thing, not two: the PDF preview.
   //
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/webapp.py b/packages/meshbay-hub/src/meshbay_hub/api/webapp.py
index 1d3bc7e..badbdda 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/webapp.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/webapp.py
@@ -90,7 +90,13 @@ CSP = "; ".join([
     f"img-src 'self' data: blob: {_RECAPTCHA_SRC}",
     "media-src 'self' blob:",
     "font-src 'self'",
-    "connect-src 'self' https: wss:",
+    # The page talks to its own origin and nothing else — the hub, the node
+    # arrives over WebRTC, which this directive does not govern. reCAPTCHA's
+    # two origins are the only others, kept so its script may call home from
+    # this page; the register and reset views were driven in Chrome and Firefox
+    # against Google's test keys with this line and reported no violation.
+    # `https: wss:` let an injected script post anything anywhere.
+    f"connect-src 'self' {_RECAPTCHA_SRC}",
     "worker-src 'self'",
     # `object-src` exists for one thing, and `frame-src`'s `blob:` for the same
     # thing: previewing a PDF without writing it anywhere.
diff --git a/packages/meshbay-hub/tests/test_desktop_shell.py b/packages/meshbay-hub/tests/test_desktop_shell.py
index 732ba07..6e1c634 100644
--- a/packages/meshbay-hub/tests/test_desktop_shell.py
+++ b/packages/meshbay-hub/tests/test_desktop_shell.py
@@ -226,14 +226,17 @@ def _directive(name: str) -> str:
 
 def test_the_hub_is_reachable_but_never_executable():
     """
-    connect-src allows the hub's API and its signaling socket. script-src does
-    not: nothing the hub returns is ever executed. The only script sources are
-    'self', the wasm eval token, and the two reCAPTCHA hosts (see the next
-    test) — never a bare `https:` scheme, which would let the hub's own origin
-    serve script.
+    The page connects to its own files and to reCAPTCHA, nothing else: every
+    hub call leaves from the main process (a page on `app://` is refused by
+    CORS anyway), and the node arrives over WebRTC, which connect-src does not
+    govern. A bare `https:` there let injected script post anything anywhere.
+    script-src never names the hub: nothing it returns is ever executed. The
+    only script sources are 'self', the wasm eval token, and the two reCAPTCHA
+    hosts (see the next test) — never a bare `https:` scheme, which would let
+    the hub's own origin serve script.
     """
-    connect = _directive("connect-src")
-    assert "https:" in connect and "wss:" in connect
+    connect = _directive("connect-src").split()[1:]
+    assert set(connect) == {"'self'", "https://www.google.com", "https://www.gstatic.com"}
 
     script = _directive("script-src")
     assert script, "no script-src directive"