Merge branch 'fix/third-review-h1-h2-m1-m6'

Third security review (docs/third-review.md) plus its remediation.

Fixed and verified:
- H1  moderator could grant admin / hard-revoke  → handler split by field
- H2  unauthenticated 2-report global blocklist  → auth + distinct reporters
      + rate limit + refused when public groups are off
- M1  registration reCAPTCHA was inert           → gate unconditional; the
      desktop client's CSP allows the widget
- M2  QUIC chat/stream handlers lagged WebRTC    → brought to parity; the QUIC
      listener is now off by default ([node] quic_enabled)
- M3  link-preview SSRF gaps                      → rate limit + port allowlist
      + connect-address re-check + decompression-bomb guard
- M4  federated peer over-trust                   → source bound to the signer,
      push capped, revocation prunes the peer's own entries, replay rejected
- M5  no CSP / security headers on the SPA        → middleware; verified against
      the live app with no violations

Withdrawn:
- M6  add_group_member accepting node tokens is deliberate (commit 0443cf8,
      the CLI invite flow). The "fix" broke that flow on the deployed hub and
      was reverted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pG75yGK3NthNfyjH74omG

1 files changed, 17 insertions, 2 deletions

diff --git a/packages/meshbay-client/src/main.js b/packages/meshbay-client/src/main.js
index 3926c01..e071074 100644
--- a/packages/meshbay-client/src/main.js
+++ b/packages/meshbay-client/src/main.js
@@ -58,15 +58,29 @@ const SCHEME = 'app';
 // The hub is reachable under connect-src, for its API and its signaling socket.
 // It is deliberately absent from script-src: nothing it returns is executed,
 // which is the whole reason this application exists (T3).
+//
+// The one exception is reCAPTCHA, used to gate sign-up (and password reset) the
+// same way it gates them in the browser. Its script comes from www.google.com,
+// its challenge is a www.google.com iframe, and its assets sit on
+// www.gstatic.com. These two hosts — and only these two — are allowed under
+// `script-src`, `frame-src` and `img-src` for that purpose. It is a real, if
+// small, dent in "no third-party code runs here": Google's reCAPTCHA script
+// executes in the renderer. It is accepted deliberately so a native sign-up is
+// gated like a web one without asking the user to do anything extra, and it is
+// the *same* dependency the hub-served SPA already carries. If sign-up ever
+// moves to a proof-of-work challenge, delete RECAPTCHA_SRC and the three
+// directives that spread it, and the widget in auth-page.js with them.
+const RECAPTCHA_SRC = 'https://www.google.com https://www.gstatic.com';
 const CSP = [
   "default-src 'none'",
-  "script-src 'self' 'wasm-unsafe-eval'",
+  `script-src 'self' 'wasm-unsafe-eval' ${RECAPTCHA_SRC}`,
   "style-src 'self' 'unsafe-inline'",
-  "img-src 'self' data: blob:",
+  `img-src 'self' data: blob: ${RECAPTCHA_SRC}`,
   "media-src 'self' blob:",
   "font-src 'self'",
   "connect-src 'self' https: wss:",
   "worker-src 'self'",
+  `frame-src ${RECAPTCHA_SRC}`,
   "frame-ancestors 'none'",
   "base-uri 'none'",
   "form-action 'none'",
@@ -857,6 +871,7 @@ function registerBridge() {
         `username = "${username}"`,
         '',
         '[node]',
+        'quic_enabled = false  # QUIC direct path; no client uses it yet',
         'quic_port = 19010',
         'ui_port   = 18000',
         '',