peach-browser / history

9b95e9847dff

fix: mesh routing fails closed on absent or unknown trustSource (PB-26-006) — isRouteCapableMeshPeer no longer treats undefined as direct/vouched, regression tests cover missing and mystery trust values; bump 5.0.4→5.0.5

time
2026-08-30 00:03 UTC · 1 month ago
machine
koh2
agent
glm-5.3-flash
session
pb-26 audit fixes
parent
73dccaa00b21

↓ peach-browser-9b95e984.tar.gzatlas at this save

files changed5 files manifest.firefox.json+1 −1manifest.json+1 −1package.json+1 −1src/background/mesh-relay-listener.test.ts+7 −0src/shared/mesh-peer-role.ts+3 −3
manifest.firefox.json+1 −1 
@@ -1,7 +1,7 @@11 {22   "manifest_version": 3,33   "name": "Peach Password Manager",4-  "version": "5.0.4",4+  "version": "5.0.5",55   "description": "Zero-knowledge password manager",66   "browser_specific_settings": {77     "gecko": {

view file

manifest.json+1 −1 
@@ -2,7 +2,7 @@22   "manifest_version": 3,33   "minimum_chrome_version": "116",44   "name": "Peach Password Manager",5-  "version": "5.0.4",5+  "version": "5.0.5",66   "description": "Zero-knowledge password manager",77   "action": {88     "default_popup": "src/popup/index.html",

view file

package.json+1 −1 
@@ -1,6 +1,6 @@11 {22   "name": "peach",3-  "version": "5.0.4",3+  "version": "5.0.5",44   "description": "Zero-knowledge password manager",55   "license": "GPL-3.0-only",66   "type": "module",

view file

src/background/mesh-relay-listener.test.ts+7 −0 
@@ -52,6 +52,13 @@5252     expect(isRouteCapableMeshPeer(peer("printer", key, {5353       deviceType: "printer" as PairedDevice["deviceType"],5454     }))).toBe(false);55+    // PB-26-006: absent or unknown trustSource fails closed.56+    expect(isRouteCapableMeshPeer(peer("no-trust", key, {57+      trustSource: undefined,58+    }))).toBe(false);59+    expect(isRouteCapableMeshPeer(peer("unknown-trust", key, {60+      trustSource: "mystery" as PairedDevice["trustSource"],61+    }))).toBe(false);5562   });5663 5764   it("backs off failed waiter reconnects and resets after a completed round", () => {

view file

src/shared/mesh-peer-role.ts+3 −3 
@@ -4,10 +4,10 @@44 export const MESH_WAITER_MAX_RETRY_DELAY_MS = 30_000;55 66 export function isRouteCapableMeshPeer(device: PairedDevice): boolean {7+  // PB-26-006: fail closed on an unknown/absent trustSource — sibling trust8+  // gates reject it, so routing must not treat it as direct/vouched.79   const trusted =8-    device.trustSource === undefined ||9-    device.trustSource === "direct" ||10-    device.trustSource === "vouched";10+    device.trustSource === "direct" || device.trustSource === "vouched";1111   return (1212     trusted &&1313     (device.deviceType === "extension" ||

view file