fix(client): allow reCAPTCHA in the Electron CSP

Needed for the paired meshbay-hub commit that makes the registration
captcha unconditional (M1): the desktop client renders the same
RegisterPage widget the browser does, which needs its script, its
challenge iframe and its assets to load.

script-src, the new frame-src, and img-src now allow exactly
https://www.google.com and https://www.gstatic.com, and nothing else
external — the hub's own origin is still absent from script-src, so
T3 (nothing the hub returns is executed) is unaffected. This is a
one-time source change: it ships identical in every build via
`files: ["src/**"]` in electron-builder's config, with no build step,
packaging step, or installer action for anyone to perform, and no
setting for an end user to touch.

test_desktop_shell.py updated to pin the exception precisely: the
reCAPTCHA hosts are the *only* external origins allowed anywhere in
the policy, and a bare `https:` scheme is still refused in script-src.

Third security review, finding M1 (Option A, desktop half).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pG75yGK3NthNfyjH74omG

2 files changed, 54 insertions, 6 deletions

diff --git a/packages/meshbay-client/src/main.js b/packages/meshbay-client/src/main.js
index 3926c01..e3735e6 100644
--- a/packages/meshbay-client/src/main.js
+++ b/packages/meshbay-client/src/main.js
@@ -58,15 +58,29 @@ const SCHEME = 'app';
 // The hub is reachable under connect-src, for its API and its signaling socket.
 // It is deliberately absent from script-src: nothing it returns is executed,
 // which is the whole reason this application exists (T3).
+//
+// The one exception is reCAPTCHA, used to gate sign-up (and password reset) the
+// same way it gates them in the browser. Its script comes from www.google.com,
+// its challenge is a www.google.com iframe, and its assets sit on
+// www.gstatic.com. These two hosts — and only these two — are allowed under
+// `script-src`, `frame-src` and `img-src` for that purpose. It is a real, if
+// small, dent in "no third-party code runs here": Google's reCAPTCHA script
+// executes in the renderer. It is accepted deliberately so a native sign-up is
+// gated like a web one without asking the user to do anything extra, and it is
+// the *same* dependency the hub-served SPA already carries. If sign-up ever
+// moves to a proof-of-work challenge, delete RECAPTCHA_SRC and the three
+// directives that spread it, and the widget in auth-page.js with them.
+const RECAPTCHA_SRC = 'https://www.google.com https://www.gstatic.com';
 const CSP = [
   "default-src 'none'",
-  "script-src 'self' 'wasm-unsafe-eval'",
+  `script-src 'self' 'wasm-unsafe-eval' ${RECAPTCHA_SRC}`,
   "style-src 'self' 'unsafe-inline'",
-  "img-src 'self' data: blob:",
+  `img-src 'self' data: blob: ${RECAPTCHA_SRC}`,
   "media-src 'self' blob:",
   "font-src 'self'",
   "connect-src 'self' https: wss:",
   "worker-src 'self'",
+  `frame-src ${RECAPTCHA_SRC}`,
   "frame-ancestors 'none'",
   "base-uri 'none'",
   "form-action 'none'",
diff --git a/packages/meshbay-hub/tests/test_desktop_shell.py b/packages/meshbay-hub/tests/test_desktop_shell.py
index 36b261e..b82804e 100644
--- a/packages/meshbay-hub/tests/test_desktop_shell.py
+++ b/packages/meshbay-hub/tests/test_desktop_shell.py
@@ -175,11 +175,17 @@ def _policy() -> str:
     """
     import re
     source = _main()
+    # The array mixes plain strings and one `${RECAPTCHA_SRC}` template literal;
+    # resolve the constant so every directive reads as plain text.
+    rec = re.search(r"const RECAPTCHA_SRC = '([^']*)'", source)
     match = re.search(r"const CSP = \[(.*?)\]\.join", source, re.S)
     assert match, "no CSP constant in the main process"
+    body = match.group(1)
+    if rec:
+        body = body.replace("${RECAPTCHA_SRC}", rec.group(1))
     return "; ".join(
-        line.strip().strip('",').strip('"')
-        for line in match.group(1).splitlines() if line.strip())
+        line.strip().strip('`",').strip('`"')
+        for line in body.splitlines() if line.strip())
 
 
 def _directive(name: str) -> str:
@@ -193,18 +199,46 @@ def _directive(name: str) -> str:
 def test_the_hub_is_reachable_but_never_executable():
     """
     connect-src allows the hub's API and its signaling socket. script-src does
-    not include it: nothing the hub returns is ever executed.
+    not: nothing the hub returns is ever executed. The only script sources are
+    'self', the wasm eval token, and the two reCAPTCHA hosts (see the next
+    test) — never a bare `https:` scheme, which would let the hub's own origin
+    serve script.
     """
     connect = _directive("connect-src")
     assert "https:" in connect and "wss:" in connect
 
     script = _directive("script-src")
     assert script, "no script-src directive"
-    assert "https:" not in script, "the hub can serve script under this policy"
+    sources = script.split()[1:]  # drop the "script-src" keyword itself
+    allowed = {
+        "'self'", "'wasm-unsafe-eval'",
+        "https://www.google.com", "https://www.gstatic.com",
+    }
+    assert set(sources) <= allowed, \
+        f"unexpected script-src source: {set(sources) - allowed}"
+    assert "https:" not in sources, "a bare https: scheme lets the hub serve script"
     assert "'unsafe-eval'" not in script.replace("'wasm-unsafe-eval'", "")
     assert "default-src 'none'" in _policy()
 
 
+def test_recaptcha_is_the_only_third_party_and_stays_scoped_to_it():
+    """
+    reCAPTCHA gates sign-up in the app the same way it does in the browser.
+    www.google.com and www.gstatic.com are allowed under script-src, frame-src
+    and img-src for that — and no other external origin appears anywhere in the
+    policy. Remove this expectation only alongside the reCAPTCHA widget.
+    """
+    hosts = {"https://www.google.com", "https://www.gstatic.com"}
+    for directive in ("script-src", "frame-src", "img-src"):
+        srcs = set(_directive(directive).split()[1:])
+        assert hosts <= srcs, f"{directive} is missing a reCAPTCHA host"
+
+    for part in _policy().split(";"):
+        for tok in part.strip().split()[1:]:
+            if tok.startswith(("http://", "https://")):
+                assert tok in hosts, f"unexpected external origin in CSP: {tok}"
+
+
 # ── The bridge ──────────────────────────────────────────────────────────────
 
 def test_the_bridge_is_the_only_way_in():