From 30e855f55f1d920b25da0bdd8e538c249d3c0c26 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Tue, 18 Aug 2026 09:42:34 +0200 Subject: feat(client): the platform seam, and an Electron shell that has never been run MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Stage D, and the honest half of it. D1 — the seam (done, and verified) ---------------------------------- `static/platform.js`. `HUB` becomes `platform.hubBase()` and the transport is built with the same base, so one address has one source. In a browser it returns '' and every path stays relative to the origin that served the page — the acceptance criterion for this split was "the browser SPA behaves identically", and it does. `platform.js` joins `_ASSETS`, or a change to it would not move the content hash and a cached browser would never ask for it. D2 — the shell (written, never launched) ----------------------------------------- **There is no npm on this machine. Electron was never installed and `packages/meshbay-client/` has not been run once.** That is stated here rather than discovered later. What is there: a main process serving the packaged interface over a privileged `app://` scheme (`secure` and `standard` are not cosmetic — without them the service worker refuses to register and streamed downloads break silently), a preload exposing an enumerated bridge that never passes a filesystem path, a window with `sandbox`, `contextIsolation` and no node integration, navigation away from the package refused, and a CSP where the hub is reachable over connect-src and is not a script source. The hub address arrives as a process argument because `platform.hubBase()` runs before anything can await. `test_desktop_shell.py` pins each of those by reading the source — the treatment `test_downloads.py` already gives the three browser save paths. It catches a property being removed and proves nothing about the application running. Two were checked by breaking them. The interface is *copied* into the package by `build/sync-ui.js` from the hub's static directory, and `ui/` is gitignored: a silent fork is the only real way to end up maintaining the interface twice. D3 — partial ------------ The bridge, and the part worth having now: safeStorage's backend is reported rather than assumed. On Linux it falls back to a fixed key when no keyring is running, silently — someone who believes the OS is holding their keys is told when it is not. The native key lifecycle belongs with D4 and needs a running application to mean anything. D8 — partial, and a real defect found -------------------------------------- `meshbay-node.spec` installed the SYSTEM template — the one carrying `User=%i` — into `%{_userunitdir}`. A user unit already runs as its owner and cannot carry `User=`; systemd refuses the file, so the packaged unit could never have started. Nothing noticed because nobody had built and installed the RPM. Two units now: the template to `%{_unitdir}`, and a new `meshbay-node-user.service` that a person enables themselves without a password — which is what lets the desktop client install a node without asking for one. It carries ExecReload, so `meshbay-node reload` does not have to stop a service somebody is streaming from, and documents the drop-in for a drive outside the home, RequiresMountsFor included. 798 tests pass; e2e.py still passes end to end. Nothing here was built or launched: no npm, no rpmbuild. Co-Authored-By: Claude Opus 5 --- packages/meshbay-client/src/preload.js | 66 ++++++++++++++++++++++++++++++++++ 1 file changed, 66 insertions(+) create mode 100644 packages/meshbay-client/src/preload.js (limited to 'packages/meshbay-client/src/preload.js') diff --git a/packages/meshbay-client/src/preload.js b/packages/meshbay-client/src/preload.js new file mode 100644 index 0000000..9c273e2 --- /dev/null +++ b/packages/meshbay-client/src/preload.js @@ -0,0 +1,66 @@ +/** + * The bridge, and the whole of it. + * + * `contextIsolation` puts this in its own world, so what is exposed here is all + * the page can reach — page script cannot read the closure, cannot replace + * these functions for other code, and cannot call an IPC channel that is not + * named below. That is what makes the enumeration meaningful rather than + * decorative. + * + * The rule for anything added here: **the renderer never names a path, a file + * handle or a process.** It asks for a dialog and receives an opaque id. The + * renderer parses decrypted content from nodes — video, images, filenames — + * which is attacker-controlled input, so it is treated as hostile even though + * it is our own code. + */ + +'use strict'; + +const { contextBridge, ipcRenderer } = require('electron'); + +const HUB_BASE = (process.argv.find(a => a.startsWith('--meshbay-hub=')) || '') + .slice('--meshbay-hub='.length); + +contextBridge.exposeInMainWorld('meshbay', { + // Where the hub is. The interface prefixes every API path with this; in a + // browser the same function returns '' and relative paths go to the origin + // that served the page. + // + // Read from a process argument, not over IPC: the interface asks for this + // while its modules are still loading, before anything can await, and + // synchronous IPC would block the renderer for a value that cannot change + // within a run. + hubBase: () => HUB_BASE, + setHubBase: (base) => ipcRenderer.invoke('hub:set', base), + + // What this build can do that a browser cannot. The interface renders + // features gated on these nowhere at all in a browser, rather than offering + // something that fails when clicked. + capabilities: { + nodeAdmin: true, + localFolders: true, + nativeSave: true, + }, + + secrets: { + get: (name) => ipcRenderer.invoke('secrets:get', name), + set: (name, value) => ipcRenderer.invoke('secrets:set', name, value), + clear: (name) => ipcRenderer.invoke('secrets:clear', name), + // 'unprotected_fallback' means safeStorage found no keyring and is using a + // fixed key. Encrypted on disk, by a key that is not a secret — the + // interface says so rather than letting someone believe otherwise. + backend: () => ipcRenderer.invoke('secrets:backend'), + }, + + // A save dialog and a write that never passes back through the page. The + // renderer holds an id, not a path. + saveFile: async (suggestedName) => { + const handle = await ipcRenderer.invoke('save:begin', suggestedName); + if (!handle) return null; + return { + name: handle.name, + write: (chunk) => ipcRenderer.invoke('save:write', handle.id, chunk), + close: () => ipcRenderer.invoke('save:end', handle.id), + }; + }, +}); -- cgit v1.2.3