diff options
Diffstat (limited to 'CLAUDE.md')
| -rw-r--r-- | CLAUDE.md | 20 |
1 files changed, 20 insertions, 0 deletions
@@ -382,6 +382,26 @@ anything that assumes one key per person. MNP 0.2 and 405 on the Stage-C endpoints while the tree had 0.3 — so testing against it proves what is deployed, not what is written +- **A second copy of the hub address is what breaks the app, not the protocol.** + `keyderive.js` carried `const HUB = '' // same origin` — true of a page the hub + served, false of one loaded from a package, where the origin is `app://meshbay` + and `/v1/users/register` hits the application's own protocol handler. **Sign-up + and sign-in, the first two things anybody does, failed with "Not found."** Found + by a person clicking Register. `test_hub_address_seam.py` now refuses any file + that decides where the hub is, or fetches `/v1/…` relative to the page origin + +- **safeStorage is real on a desktop and honest without one** (checked + 2026-08-18, Ubuntu GNOME). `secrets.bin` carries Chromium's `v11` prefix, + which means keyring-backed; the fixed-key fallback writes `v10`. Headless, the + same code reports `unavailable` and refuses to store rather than downgrading + silently + +- **`globalThis.navigator` is read-only from Node 22.** `test_locales.py` + assigned to it and broke the moment the suite ran under a newer Node — which + the desktop client's build already requires, so the first CI machine set up + for it would have failed these tests for no visible reason. Use + `Object.defineProperty`; the suite is now green on 18 and 24 + ## Two lessons that cost four rounds of live testing - **`QE/deploy/e2e.py` cannot test `app.js`.** It is a second implementation of the |