mirror of
https://github.com/PR0M3TH3AN/bitvid.git
synced 2026-10-27 07:52:24 +00:00
thePR0M3TH3ANandClaude Fable 5
847a855ec8
Was on the 2026-07-25 build. Carries an adversarial audit's fixes, the ones that matter most for a site that hands the widget real identities: - Origin binding is enforced INSIDE the crypto worker and derived from self.location instead of a caller-supplied field, so a page cannot read or adopt a wallet connection bound to a different site. - Phrase recovery no longer trips the rollback alarm on every later login (the mark is keyed by the everyday pubkey, which recovery preserves, while the recovered capsule restarts at generation 0) -- users who had ever rotated a password previously saw "possibly revoked credentials" forever, with no way to clear it. - quorumMet counts relays that ANSWERED rather than ones that merely accepted a socket, and relay responses are now checked against the address requested, so a single junk event can no longer block registration, rotation, and recovery. - Password rotation checks the new capsule reached quorum BEFORE publishing the tombstone that destroys the old one; a failed rotation used to be able to leave neither password working. - Derived secrets (Argon2id output, both PRKs, the BIP-39 seed) are now wiped at their derivation site, as the spec always claimed. - The worker RPC validates message shapes, times out, and rejects pending calls when the worker dies, so a torn-down worker surfaces as an error instead of a permanent hang. - Synthetic (script-dispatched) clicks no longer drive consent UI. Verified: the 10 pre-existing test failures in this suite are unchanged by this update (checked by stashing the vendor directory and re-running -- 1330 pass / 10 fail either way), and the BitLogin auth-provider tests pass. dist/ is gitignored build output and regenerates. Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01CMr9Yt8SYmZcfgrg3CV2G1