thePR0M3TH3ANandClaude Opus 4.8 577ea5af15 [security] add a strict Content-Security-Policy to the HTML entry points ...

Defense-in-depth against XSS for a client that holds storage credentials in
memory. The critical directive is a strict script-src: 'self' + the hash of the
inline theme-bootstrap + the nostr-tools CDN fallbacks, with no 'unsafe-inline'
or 'unsafe-eval' (verified no bundle uses eval/Function/wasm). This blocks
injected script/object elements, inline handlers, and base-tag hijack, so an
injected payload cannot run and read the in-memory storage master key, the
signer, or DM plaintext. connect/img/media stay broad because relays, R2/S3
endpoints, and video/thumbnail URLs are user/content defined; worker-src allows
blob: for the WebTorrent module worker. Applied to index.html and embed.html.

Test (tests/csp-policy.test.mjs) locks the inline-script hash to script-src and
asserts script-src stays strict (no unsafe-inline/eval) with object-src 'none'
and base-uri 'self'.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

2026-06-18 12:15:14 -04:00

..

app

fix(nostr): circuit-break the dead nip-07 signer channel

2026-06-15 08:49:05 -04:00

auth

Add tests for NIP-07 signing adapter factory

2026-02-08 00:33:13 +00:00

compliance

Merge branch 'unstable' into agents/daily/style-agent-1740615175-12694853261144843326

2026-02-26 21:40:23 -05:00

designSystem

Fix lint errors in dynamicStyles.test.mjs

2026-02-08 00:41:34 +00:00

docs

docs: align upload guides with code and add consistency test

2026-02-05 03:00:29 +00:00

e2e

test(e2e): smoke the real upload -> publish -> feed -> delete pipeline

2026-06-17 05:56:38 -04:00

e2e-extension

improved playright integration

2026-02-21 20:45:47 -05:00

feed-engine

Optimize object allocation in kids scoring loop

2026-02-08 03:41:50 +00:00

helpers

fix: Resolve js/app.js syntax error and update test mocks

2026-02-08 01:29:09 +00:00

moderation

refactor(moderation): batch kind-1984 report subs via SubscriptionManager (P2)

2026-06-14 15:04:40 -04:00

nostr

[watch-history] thread chunkDecryptLimit through resolve + expose deferred count

2026-06-17 14:49:40 -04:00

nostr-specs

feat(agents): Execute nip-research-agent (NIP-65 compliance)

2026-02-18 17:07:47 +00:00

performance

perf: Batch video timestamp resolution to reduce N+1 network requests

2026-02-11 12:01:39 +00:00

race

fix: resolve NostrClient initialization race condition

2026-02-14 13:22:43 +00:00

services

test(s3): integration smoke for the upload -> publish -> cleanup round-trip

2026-06-17 06:23:06 -04:00

state

Remove legacy moderation overrides support

2026-02-08 00:33:27 +00:00

test-helpers

fix(test): polyfill synchronous requestIdleCallback for unit tests

2026-02-05 23:04:21 +00:00

torrent

Handle WebTorrent fallback without service worker

2025-10-15 14:54:24 -04:00

ui

feat(r2): clean up the superseded object when a video's URL is replaced on edit

2026-06-16 22:19:01 -04:00

unit

refactor(ui): extract bindThumbnailFallbacks from app.js

2026-02-23 01:16:32 +00:00

utils

test: add missing tests for LinkPreviewSettings utility

2026-02-26 17:44:51 +00:00

visual

test: harden harness polling and fix dm signer key usage

2026-03-04 12:25:23 -05:00

watchHistory

audit(tests): fix skipped auth tests and produce audit report

2026-02-12 14:36:45 +00:00

admin-list-store.test.mjs

fix(ci): resolve e2e timeouts and add app init safeguards

2026-02-22 18:33:41 +00:00

app-batch-fetch-profiles.test.mjs

refactor(profiles): batch profile fetch through SubscriptionManager (P4)

2026-06-14 16:15:06 -04:00

app-state.test.mjs

test(ai): add unit tests for storageService and appState (agent)

2026-01-24 11:44:16 +00:00

auth-service.test.mjs

audit(tests): fix skipped auth tests and produce audit report

2026-02-12 14:36:45 +00:00

authService.test.mjs

chore: add test audit workflow and improve AuthService coverage

2026-02-12 14:42:51 +00:00

benchmark-explore-data.spec.mjs

feat(perf): offload explore data computation to web worker

2026-02-05 17:00:13 +00:00

check_resize_observer.mjs

fix: Ensure ResizeObserver is undefined in global scope for fallback tests

2026-02-08 02:00:10 +00:00

comment-avatar.test.mjs

Add unit tests for commentAvatar.js utility functions

2026-02-26 17:36:00 +00:00

comment-event-builder.test.mjs

Fix CI, environment, linting, and unit test issues

2026-01-13 20:32:06 +00:00

comment-thread-service.test.mjs

chore(ai): CI health fixes (flaky tests)

2026-01-18 02:39:42 +00:00

csp-policy.test.mjs

[security] add a strict Content-Security-Policy to the HTML entry points

2026-06-18 12:15:14 -04:00

design-system-metrics.test.mjs

Refactor floating panel and metrics styling

2025-10-14 13:31:22 -04:00

discussion-count-service.test.mjs

Use uppercase tags for comment events

2026-01-06 16:22:49 -05:00

dm-block-filter.test.mjs

update with block list fix

2026-02-21 16:45:16 -05:00

dm-conversation-select.test.mjs

fix(dm): route Actions calls to the correct controller (open conversation, etc.)

2026-06-16 15:07:14 -04:00

dm-db.test.mjs

refactor(dm-db): use singleton IndexedDB connection to avoid N+1 overhead

2026-02-08 03:41:19 +00:00

dm-decrypt-context.test.mjs

fix(dm): can't open conversations + "helpers unavailable" on a working signer

2026-06-16 14:52:11 -04:00

dm-decryptor-order.test.mjs

Refactor decryptLegacyDm to use ordered parallel race for decryptors.

2026-02-26 17:45:31 +00:00

dm-decryptor.test.mjs

Fix DM decryptor to try recipient keys for outgoing messages

2025-10-26 19:23:40 -04:00

dm-normalization.test.mjs

chore(ai): CI health fixes (flaky tests)

2026-01-20 12:39:19 +00:00

edit-modal-submit-state.test.mjs

Fix edit modal magnet hint refresh

2025-10-27 18:19:14 -04:00

embed_playback_check.spec.mjs

Fix embed player crash and prevent duplicate initialization

2026-01-24 21:42:37 +00:00

event-schemas.test.mjs

chore(ai): event schema validation tool + fixes

2026-01-23 05:33:57 +00:00

feed-engine.test.mjs

Hydrate feed timestamps before sorting

2025-10-26 12:05:03 -04:00

for-you-scorer.test.mjs

feat(feed): make For You inclusive + ranked by your lists (G1-G5)

2026-06-14 16:57:05 -04:00

grid-health.test.mjs

test: improve gridHealth prioritization testing

2026-02-08 00:22:16 +00:00

hashtag-preferences.test.mjs

fix(nip46): route list decryption by ciphertext format (cut RPC fan-out)

2026-06-17 12:13:58 -04:00

link-preview-settings.test.mjs

test: Add unit tests for linkPreviewSettings.js

2026-02-26 17:38:30 +00:00

login-modal-controller.test.mjs

Refactor clipboard copy to use navigator.clipboard API

2026-02-17 04:52:40 +00:00

magnet-utils.test.mjs

Fix magnet query parsing for values containing '='

2026-02-09 23:22:49 -05:00

media-loader.test.mjs

Remove dynamic style system and tighten inline style checks

2025-10-14 08:48:17 -04:00

minimal-channel-profile.test.mjs

feat(test-audit): run daily test audit and fix zero-assertion test

2026-02-15 20:18:30 +00:00

minimal-webtorrent.test.mjs

Fix nostr-tools v2 compatibility and test quality issues

2026-02-27 03:43:14 +00:00

modal-accessibility.test.mjs

[security] replace innerHTML in RevertModal.js

2026-02-14 18:58:02 +00:00

moderation-service.test.mjs

Migrate user blocks to standard NIP-51 Mute List

2026-02-01 21:47:29 +00:00

moderation-stage.test.mjs

Fix viewer mute blur regression and update modal overrides

2025-10-26 16:06:40 -04:00

more-menu-controller.test.mjs

Migrate user blocks to standard NIP-51 Mute List

2026-02-01 21:47:29 +00:00

multipart-empty-file-guard.test.mjs

fix(upload): fail fast on 0-byte files in multipartUpload

2026-06-16 20:15:17 -04:00

nip07-concurrency.test.mjs

update

2026-02-21 16:08:33 -05:00

nip07-fair-scheduling.test.mjs

fix(login-perf): kill relay REQ storms and feedback loops

2026-06-14 09:52:33 -04:00

nip71-base-event-tags.test.mjs

Remove nostr shim and retarget imports

2026-01-06 15:32:21 -05:00

nip71-builder.test.mjs

Remove nostr shim and retarget imports

2026-01-06 15:32:21 -05:00

nip71-form-manager.test.mjs

Sanitize NIP-71 hashtag inputs

2025-10-08 16:39:30 -04:00

nostr-boost-actions.test.mjs

Serialize repost targets when available

2025-11-03 14:35:43 -05:00

nostr-count-fallback.test.mjs

Remove nostr shim and retarget imports

2026-01-06 15:32:21 -05:00

nostr-delete-flow.test.mjs

perf(nostr): verify event signatures off the main thread

2026-06-12 11:16:25 -04:00

nostr-ephemeral-dm-tester.html

Update nostr-tools bundle to restore nip46 handshake

2025-10-22 07:18:25 -04:00

nostr-login-permissions.test.mjs

update

2026-02-21 15:53:09 -05:00

nostr-nip46-queue.test.mjs

test(ai): add unit tests for nip46Queue and moderationActionController (agent)

2026-01-27 11:54:02 +00:00

nostr-private-key-signer.test.mjs

Refactor publishVideo logic and fix signer tests

2026-02-09 21:32:29 +00:00

nostr-publish-optimistic.test.mjs

fix(publish): flag + log unconfirmed (optimistic) relay publishes

2026-06-16 20:28:27 -04:00

nostr-publish-rejection.test.mjs

Remove nostr shim and retarget imports

2026-01-06 15:32:21 -05:00

nostr-rebroadcast-guard.test.mjs

Refactor nostr publish helpers into shared module

2025-10-22 15:48:59 -04:00

nostr-send-direct-message.test.mjs

test: harden harness polling and fix dm signer key usage

2026-03-04 12:25:23 -05:00

nostr-service-access-control-ready.test.mjs

perf(feed): don't block fresh load on remote admin-list fetch

2026-06-12 14:31:38 -04:00

nostr-service-access-control.test.mjs

fix(test): resolve hangs in multiple unit tests and harden runner

2026-01-31 10:33:50 +00:00

nostr-session-actor.test.mjs

test(ai): add unit tests for sessionActor and signRequestQueue

2026-01-29 11:53:42 +00:00

nostr-signer-race.test.mjs

Fix CI test failures: signer wiring, permission checks, and missing methods

2026-02-09 15:33:21 +00:00

nostr-view-event-bindings.test.mjs

Add nostr facades for client, view events, and watch history

2025-10-22 22:17:30 -04:00

nostr-view-events.test.mjs

Remove legacy view filter flag

2026-01-06 15:36:37 -05:00

nwc-client.test.mjs

Add wallet budget enforcement for NWC payments

2025-10-29 06:52:30 -04:00

nwc-settings-service.test.mjs

Add per-profile settings store and mask wallet inputs

2025-10-21 17:46:41 -04:00

position-floating-panel.test.mjs

Fix unit tests: Expose HTMLStyleElement in JSDOM setup

2026-01-14 03:52:53 +00:00

profile-cache.test.mjs

perf: Use requestIdleCallback for ProfileCache localStorage writes

2026-02-05 22:59:50 +00:00

profile-modal-controller.test.mjs

fix(exploreData): trigger refresh immediately on visibility change

2026-02-18 15:10:29 +00:00

qrcode_table_fallback.test.mjs

Refactor js/utils/qrcode.js to replace innerHTML with DOM manipulation

2026-02-26 17:42:43 +00:00

reaction-event-builder.test.mjs

Include event pointer tags for reactions

2025-10-29 22:14:20 -04:00

relay-subscribe-cap.test.mjs

fix(nostr): bound read/subscribe relay set to stop cold-login REQ storm

2026-06-14 22:51:36 -04:00

revert-modal-controller.test.mjs

refactor(ai): extract handleRevertVideo from js/app.js (agent)

2026-01-27 03:20:08 +00:00

safe-decode.test.mjs

refactor: centralize safe decode helpers

2025-10-02 12:48:24 -04:00

share-event-builder.test.mjs

Document and test share note events

2026-01-22 22:50:00 -05:00

shareNostrController.test.mjs

refactor(ai): extract ShareNostrController from js/app.js (agent)

2026-01-25 03:34:10 +00:00

sign-request-queue.test.mjs

test(ai): add unit tests for sessionActor and signRequestQueue

2026-01-29 11:53:42 +00:00

signer-health-notice.test.mjs

feat(signer): surface an actionable notice when the signer goes unresponsive

2026-06-16 14:18:46 -04:00

static-modal-accessibility.test.mjs

Add tests for staticModalAccessibility.js

2026-02-26 17:42:07 +00:00

storage-key-collection.test.mjs

feat(r2): delete the underlying storage objects when a video is deleted

2026-06-16 22:09:57 -04:00

storage-key-collision.test.mjs

fix(upload): content-address storage keys to stop URL-first overwrites

2026-06-16 16:56:12 -04:00

storage-service.test.mjs

test(storage): assert credentials never persist in plaintext at rest

2026-06-17 05:35:02 -04:00

subscriptions-feed.test.mjs

Normalize subscription authors to fix empty feed

2025-10-20 21:15:47 -04:00

subscriptions-manager.test.mjs

fix(subscriptions): guard the subscription-list refresh loop

2026-06-16 09:53:52 -04:00

test-setup.mjs

test: fix video modal tests and add missing polyfills

2026-01-27 02:09:22 +00:00

user-blocks.test.mjs

fix(nostr): bound read/subscribe relay set to stop cold-login REQ storm

2026-06-14 22:51:36 -04:00

validate-config.test.mjs

test: add comprehensive tests for config validation

2026-02-08 03:34:20 +00:00

video-card-source-visibility.test.mjs

Stop closing menus from refocusing unrelated cards

2025-10-16 16:43:58 -04:00

video-menu-renderers.test.mjs

Add unit tests for video menu renderers

2026-02-26 17:41:34 +00:00

video-modal-accessibility.test.mjs

refactor(app): Move heavy initialization from constructor to setup()

2026-02-08 03:44:38 +00:00

video-modal-comments.test.mjs

chore(torch): execute daily agent run for ci-health-agent

2026-02-28 19:48:57 +00:00

video-modal-controller.test.mjs

refactor(ai): extract VideoModalController from js/app.js (agent)

2026-01-30 03:40:36 +00:00

video-modal-controllers.test.mjs

test: update VideoModal tag expectations to include hash prefix

2026-01-27 03:54:41 +00:00

video-modal-moderation.test.mjs

test: fix video modal tests and add missing polyfills

2026-01-27 02:09:22 +00:00

video-modal-tags.test.mjs

Add VideoModal tag rendering tests

2025-10-23 13:43:05 -04:00

video-modal-zap.test.mjs

refactor(app): Move heavy initialization from constructor to setup()

2026-02-08 03:44:38 +00:00

video-note-payload.test.mjs

Support per-variant duration and bitrate in NIP-71 metadata

2025-10-29 17:06:19 -04:00

video-schema-and-conversion.test.mjs

Remove nostr shim and retarget imports

2026-01-06 15:32:21 -05:00

video-settings-menu-controller.test.mjs

refactor(ai): extract videoSettingsMenuController from js/app.js (agent)

2026-01-29 03:19:06 +00:00

view-count-batching.test.mjs

refactor(views): batch kind-30079 view counts via SubscriptionManager (P3)

2026-06-14 15:49:50 -04:00

view-counter.test.mjs

Ensure view counts are monotonic during hydration

2026-01-07 00:43:18 +00:00

watch-history-cold-load-backfill.test.mjs

[watch-history] activate fast cold-load render + background chunk backfill

2026-06-17 18:23:10 -04:00

watch-history-feed.test.mjs

Add watch history feed adapter and update renderer

2025-10-04 17:25:43 -04:00

watch-history.test.mjs

test(watch-history): rely on aggregated items from publishRecords

2026-02-26 18:02:18 +00:00

watchHistoryFingerprintEmit.test.mjs

test(watch-history): regression test for fingerprint emit-on-change

2026-06-13 08:00:28 -04:00

webtorrent-handlers.test.mjs

Refactor WebTorrent handlers to reduce duplication

2026-02-08 00:27:41 +00:00

webtorrent-regression.test.mjs

docs: add detailed webtorrent architecture and regression prevention comments

2026-02-01 19:35:02 +00:00

zap-shared-state.test.mjs

Fix zap fee parsing for split calculations

2025-10-05 22:03:07 -04:00

zap-split.test.mjs

Remove nostr shim and retarget imports

2026-01-06 15:32:21 -05:00