diff options
Diffstat (limited to 'CLAUDE.md')
| -rw-r--r-- | CLAUDE.md | 29 |
1 files changed, 21 insertions, 8 deletions
@@ -338,14 +338,27 @@ anything that assumes one key per person. key from the per-node identities. What it does cost is metadata: the hub now knows how many devices an account has and when each last signed in -- **The desktop client exists as source and has never been run.** There is no - npm on the development machine, so Electron was never installed and - `packages/meshbay-client/` has not been launched once. `test_desktop_shell.py` - pins its security contract by reading the source — sandbox, contextIsolation, - the privileged `app://` scheme, the CSP keeping `wasm-unsafe-eval`, the - traversal check, the bridge exposing no path. That is the same weak evidence - `test_downloads.py` gives the browser save paths, and for the same reason: it - catches a property being *removed*, and proves nothing about the thing running +- **The desktop client runs** (2026-08-18, Electron 42 / Chromium 148 under + xvfb). Build needs Node ≥ 22 — **Ubuntu 24.04's nodejs 18 cannot install + Electron at all**, its download script `require()`s an ESM module. Node 24 LTS + lives in `/opt/nodejs`, fetched and checksum-verified against nodejs.org. + `test_desktop_shell.py` pins the security contract by reading the source, and + that is still weak evidence — it catches a property being removed. Launching it + is what found the three things below + +- **Three things only launching it could find.** (1) A CSP in a `<meta>` tag + silently drops `frame-ancestors`; it is sent as a header by the protocol + handler now. (2) **Service workers do not work on a custom scheme** — Chromium + refuses whatever the privileges — so the app has none and uses the native save + dialog; `sw.js` stays for the browser. What `secure: true` actually buys was + measured at the same time: without it **all of `crypto.subtle` is undefined**, + AES-GCM included. X25519 and Ed25519 are present on Chromium 148. (3) **The + renderer cannot call the hub**: its `app://` origin is refused by CORS, and the + hub deliberately has no CORS middleware — its API is reachable from no web + origin. Every hub call therefore leaves from the main process, which also + refuses any origin that is not the signed-in hub. A script served by the hub is + refused by the policy, which is T3's mitigation demonstrated rather than + asserted - **A user unit cannot carry `User=`.** `meshbay-node.spec` installed the system template into `%{_userunitdir}`, where systemd refuses the file outright — the |