fix(node): the clear fields beside a chat message are bounded

sender_name and thread_id travel in clear beside the sealed envelope and were
stored and relayed whatever their type and size. A name longer than a username
or a thread id that is not a short id is now dropped (F-27).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 13 insertions, 2 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc/chat.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc/chat.py
index 5ef153e..493d7f0 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/webrtc/chat.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc/chat.py
@@ -283,7 +283,18 @@ class ChatMixin:
         # anyone on the node.
         gctx = self._group_ctx()
         chat_store = gctx.get("chat_store")
+        # The two fields that travel in clear beside the ciphertext (the sealed
+        # envelope carries its own). Stored and relayed to every member, so they
+        # are what they claim to be and no larger: a name as long as a username,
+        # a thread id as long as a message id. Anything else is dropped.
         sender_name = msg.get("sender_name", "")
+        if not isinstance(sender_name, str) or len(sender_name) > 64:
+            sender_name = ""
+        thread_id = msg.get("thread_id")
+        id_like = (isinstance(thread_id, int) and not isinstance(thread_id, bool)
+                   or isinstance(thread_id, str) and len(thread_id) <= 64)
+        if thread_id is not None and not id_like:
+            thread_id = None
 
         # Two shapes, and keeping them apart is what makes this deployable.
         #
@@ -329,7 +340,7 @@ class ChatMixin:
             self._spawn(self._store_chat_message(
                 chat_store,
                 iteration=msg.get("iteration", 0), payload=raw,
-                thread_id=msg.get("thread_id"), sender_name=sender_name,
+                thread_id=thread_id, sender_name=sender_name,
                 format=fmt, epoch=epoch, device=device, nonce=nonce, sig=sig,
             ))
 
@@ -340,7 +351,7 @@ class ChatMixin:
             "sender_id": self._user_id,
             "sender_name": sender_name,
             "payload": payload,
-            "thread_id": msg.get("thread_id"),
+            "thread_id": thread_id,
             "timestamp": time.time(),
             "format": fmt,
             "epoch": epoch,