feat(auth): the recovery key never reaches the hub

Ticking "also e-mail it to me" at registration sent the recovery key R in
the register body, and the hub appended it to the verification e-mail: the
hub saw R in clear on its way out, and the resend door — no captcha — let
anyone who knew a pending username and address have the hub mail a
"recovery key" of their choosing.

The box is gone. The recovery screen offers "E-mail it to myself", a mailto:
link that opens the person's own mail application with the key filled in;
the desktop shell hands mailto: to the system (http, https and mailto only)
and the Android shell to a mail application (ACTION_SENDTO). The CLI drops
--email-recovery-key and prints the key, as before. The hub mails the code
alone, and refuses a register that still carries a recovery_key rather than
dropping it, so an older client offering the option cannot tell someone
their key was sent when it was not.

A mailbox holding R remains, with the reset code that reaches the same
mailbox, enough to recover the account's identities; the link says so, and
it is the person's choice.

Checked in Chrome and Firefox (headless, the real page against a stubbed
hub) and by the CLI's end-to-end registration against a local hub. The
Android change was not built here, and the desktop link was not clicked in
the application.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 18 insertions, 0 deletions

diff --git a/packages/meshbay-hub/tests/test_desktop_shell.py b/packages/meshbay-hub/tests/test_desktop_shell.py
index 7a26dfb..587103f 100644
--- a/packages/meshbay-hub/tests/test_desktop_shell.py
+++ b/packages/meshbay-hub/tests/test_desktop_shell.py
@@ -72,6 +72,24 @@ def test_navigation_away_from_the_package_is_refused():
     assert "event.preventDefault()" in source
 
 
+def test_only_web_and_mail_links_reach_the_system():
+    """`shell.openExternal` hands a URL to whatever the system registered for
+    its scheme, so the handler names the schemes it passes: the web, and
+    `mailto:` for the recovery screen's "e-mail it to myself" (§3.6). A
+    `file:` or a custom scheme from the page would run a local program."""
+    import subprocess
+    source = _main()
+    block = source[source.index("setWindowOpenHandler"):]
+    block = block[:block.index("});")]
+    match = re.search(r"if \((/[^/]+/)\.test\(new URL\(url\)\.protocol\)\) shell\.openExternal\(url\)", block)
+    assert match, block
+    probe = ("const re = " + match.group(1) + ";"
+             "process.stdout.write(JSON.stringify(['https:','http:','mailto:','file:',"
+             "'javascript:','smb:','ms-settings:','vbscript:'].filter(p => re.test(p))))")
+    out = subprocess.run(["node", "-e", probe], capture_output=True, text=True, check=True)
+    assert json.loads(out.stdout) == ["https:", "http:", "mailto:"]
+
+
 def _granted_permissions() -> set[str]:
     """The allowlist, read out of the source rather than described here."""
     match = re.search(r"GRANTED_PERMISSIONS = new Set\(\[([^\]]*)\]\)", _main())