client: a chat bubble's image renders as alt text because #2313's link delegate shadows the host's file resolver - #2322

Self-test: PASS at ab094d3

Written-by: FlyBot Security

Advisory only — this is the team's security self-test of the #2201 capture handler, not the repository reviewer's conclusion, and it permits no merge on its own.

Scope: the 8-file diff at the tip above (base e40cecf6f5a5b0d19c95797792e98c98bf6382f5), read for: scheme gate, navigation target, window fallback, capture side effects, secrets/permissions/gates. No .github/, permission, ruleset or gate file is touched; no secret or token appears in the diff; no display-name or security-fence code changes (remote text still goes through remoteMessageText and the unchanged label helpers).

1. Scheme gate — holds. cells.js:42 tests the raw attribute value (getAttribute('href'), no decode/trim/URL parse) against /^https?:/i. I extracted the shipped handler and ran 36 href shapes through it: javascript: (mixed case, leading space/tab/newline, embedded tab), data:, file:, blob:, about:, vbscript:, //evil.com/x, \\evil.com\x, evil.com/x, /relative, #frag, "" — none is prevented or stopped; each falls through to the host. Accepted shapes start with http:/https: only. Two accepted edge shapes are handled downstream: navigate() re-parses every delivered address through browserAddress() (bot-browsers.js:46) and refuses a non-http(s) scheme or an unparseable address, so https:// lands in the "Only http and https addresses open here." error state and https:evil becomes a web search rather than a scheme; window.open('https:evil') resolves to https://evil/ under the URL standard. No path turns a hostile scheme into a navigation.

2. Delivery is the same value. cells.js:47 passes the exact href variable that :42 tested (probe shows the delivered string is byte-identical, including an uppercase HTTPS://…); nothing re-reads the DOM or re-derives the address. browserNavigate → bot-browsers.js:359 navigate(), which validates again before loading.

3. Window fallback — both flags, no jump-to-page escape. cells.js:53 is window.open(href, '_blank', 'noopener,noreferrer'); no location.href / assign / replace / synthetic anchor click exists in cells.js or the diff (the two document.createElement('a') uses are download links for transcript/save). A blocked popup returns null and nothing else happens.

4. Capture does not swallow the container's other clicks. The handler returns before preventDefault/stopPropagation unless an a[href] with an http(s) destination was hit. @mention links are https://bots.local/<botId> and are excluded; in Bubbles the same handler then reaches mentionTarget and openSession (test pins openSession('b2'), host delegate never sees it). Group-replies button test passes. Load earlier / Retry / bt-event-whole rows carry no a[href] ancestor, so they take the same early return.

Mention prefix — independently verified, not widened. MENTION_ORIGIN is 'https://bots.local/' with the trailing slash (text.js:8). Probe: https://bots.local/<id> is left to the host; https://bots.local.evil.tld/x, https://bots.local@evil.tld/x and https://bots.localevil/x are taken as page links (so the exception cannot be steered by a lookalike host). Only an uppercase HTTPS://BOTS.LOCAL/<id> misses the exception and goes to the panel; linkMentions never generates that casing, so it is informational.

Non-blocking notes (recorded, not raised to a blocker):

• Room/out-of-roster bubbles go through the window.open fallback, which (unlike the panel path) does not consult blockedAddress (bot-browsers.js:39,360 blocks 169.254.0.0/16, metadata.google.internal, [fd00:ec2::254]): a metadata-address link there opens in the shell's own window instead of being refused. Same shape as the previous tip; the shell's window policy is final and outside this repository.
• The repo's suite has no scheme-table case: its MarkdownText stub only emits an anchor for /^https?:/i destinations, so a javascript: link never becomes an anchor in the harness. The gate is covered by my out-of-repo probe only.
• Mentions inside an earlier part's user row (bt-urow) and inside GroupReplies have no mentionTarget; such a click falls to the host and opens https://bots.local/<id> there. Not a security change and not a regression of this PR, but the mention exception is only end-to-end in Bubbles.

Ran:

• node --test core/test/chat-link-open.test.js at ab094d3c… → 10 tests, 10 pass / 0 fail
• same file copied into a clean e40cecf6… tree → 10 tests, 5 pass / 5 fail (red proof for the fix, AssertionError)
• extracted shipped bubbleLinkClick (cells.js:34-56) and ran a 36-href table plus meta/ctrl/shift/alt and buttons 1/2 through it: dangerous schemes all fall through; only http(s) intercepted; identical value delivered
• node scripts/build-client.mjs --check → exit 0; node scripts/ds-bot-patches.mjs check → exit 0 (10 patches apply in order; core/ equals ds-bot/ + patches)
• read bot-browsers.js navigate/browserAddress/blockedAddress and text.js:8 to confirm the downstream re-validation and the mention prefix

Not run: full npm run verify (CI tests-ok is green at this tip); no live Desktop window.

as of my read: 0 comments, 0 reviews, 0 review comments (newest: none)

Self-test: PASS at 5a0d581

Written-by: FlyBot Security

Advisory only — the team's security self-test of the #2201 capture handler after it moved from the containers to the person's own rows, not the repository reviewer's conclusion, and it permits no merge on its own.

Scope: the 8-file diff at the tip above (base e40cecf6f5a5b0d19c95797792e98c98bf6382f5). The handler body is byte-identical to the previous tip: cells.js:34-56; the change is its mounts — Bubbles keeps onClick (:83, subject selfId ?? sessionId), EarlierParts puts bubbleLinkClick on its bt-urow (:621, selfId ?? sessionId) and GroupReplies on its own-line bt-urow (:1007, sessionId); bt-earlier and bt-group-replies now carry no capture handler. No .github/, permission, ruleset or gate file, no secret/token, no display-name or fence code in the diff.

1. Scheme gate and delivered value — unchanged and still correct. :42 tests the raw attribute (getAttribute('href'), no decode/trim/URL parse) with /^https?:/i. Re-ran the 36-shape table against this tip's shipped handler: javascript: (mixed case, leading space/tab/newline, embedded tab), data:, file:, blob:, about:, vbscript:, //evil.com, \\evil.com, relative, #frag, "" — none is prevented or stopped; only http(s) is claimed. :47 hands browserNavigate the same href variable that :42 tested (byte-identical, uppercase included), and bot-browsers.js:359 navigate() re-validates through browserAddress() (https:// → its own error state, https:evil → a web search). MENTION_ORIGIN is 'https://bots.local/' with the slash (text.js:8): https://bots.local.evil.tld/…, https://bots.local@evil.tld/… and https://bots.localevil/… are taken as page links, so the exception cannot be steered by a lookalike host.

2. Fallback — one window, both flags. :53 window.open(href, '_blank', 'noopener,noreferrer'); a null tab does not also navigate, and nothing in cells.js or the diff uses location.href/assign/replace or a synthetic anchor click.

3. One click, one claim. No container handler remains, so no click reaches two handlers: a person's row renders bare MarkdownText (no inner Bubbles), a Bot row renders only its own Bubbles (GroupMessage/RemoteMessage), and reply.other renders PersonMessage → Bubbles. The suite asserts exact call lists: an assistant link is ['tab', …] + one navigate; a Bot's group reply opens that Bot's tab (not the room); the person's own group line opens exactly one window; two links in an earlier part produce exactly two tab+navigate pairs.

4. Room id — read in the real host and observed. index.js:680 browserNewTab does roster.getSnapshot().byId[id] and returns null when absent; I ran its actual body with a stub roster: 'room-1' → null, no openTab call; 'b1' → a tab id. Then mounted GroupReplies with reply.other: true and clicked its link: observed [['tab','room-1']] → null → window.open(url,'_blank','noopener,noreferrer') exactly once, host delegate never called, preventDefault true. So the person's line in a group card takes the window branch — observed, not inferred.

5. Buttons are not swallowed. Load earlier / Retry are no longer under any capture handler; the reply-card bt-event-whole button test passes; the handler still returns before preventDefault/stopPropagation unless an http(s) anchor was hit, so no new prevent path applies to a button.

Non-blocking notes from the previous advisory still stand: the window.open branch does not consult blockedAddress (bot-browsers.js:39,360 refuses metadata hosts only on the panel path); the repo suite has no hostile-scheme case because its MarkdownText stub only emits anchors for /^https?:/i; and bt-urow/GroupReplies still have no mentionTarget, so a mention there goes to the host.

Ran:

• node --test core/test/chat-link-open.test.js at 5a0d581a… → 13 tests, 13 pass / 0 fail
• same file in a clean e40cecf6… tree → 13 tests, 8 pass / 5 fail (tests 3, 5, 6, 7, 12)
• same file at the previous tip ab094d3c… → 12 pass / 1 fail (a link in another Bot's reply opens that Bot's tab, not the room) — red for this round's claim fix
• extracted this tip's shipped bubbleLinkClick and re-ran the 36-href table plus modifier/middle-button matrix
• ran the real index.js:680 browserNewTab body with a stub roster (room-1 → null; b1 → tab) and mounted GroupReplies reply.other to observe the fallback branch
• node scripts/build-client.mjs --check → exit 0; node scripts/ds-bot-patches.mjs check → exit 0 (10 patches apply in order; core/ equals ds-bot/ + patches)

Not run: full npm run verify (CI tests-ok is green at this tip); no live Desktop window. CI at this tip: 14 success, enqueue-guard failing (draft, no Verifier report yet).

This advisory is at the current tip; the earlier advisory at ab094d3c… (comment 6619459557) is left unchanged and is superseded by the tip move.

as of my read: 1 comment (advisory 6619459557), 0 reviews, 0 review comments (newest 6619459557)

@Birfy one request on this pull request, at head 5a0d581a22ef9f18c3d558067e2c94ddf6f8524a.

• Head: 5a0d581a22ef9f18c3d558067e2c94ddf6f8524a (8 files, +2025/−1532), base e40cecf6f5a5b0d19c95797792e98c98bf6382f5, ready for review, maintainer_can_modify: true.
• Tier: T3 by the size rule — every path in this diff is T0/T1, but the four non-generated files come to 529 changed lines, over the T1 ceiling of 400 (core/client.js and patches/** are generated and not counted). That is why enqueue-guard reads no Verifier report names the tip 5a0d581a22ef: it is a missing conclusion, not a CI failure.
• On this tip: FlyBot Security's advisory is comment 6619774164 (five criteria, including the room-id branch measured against the real browserNewTab), and FlyBot Test's independent advisory is PASS — full npm run verify 4717/4717/0, repo test file 13/13, red-first on the clean base 13/8/5.
• What this head is missing is a conclusion that names it. Please give the formal Verdict for 5a0d581a22ef9f18c3d558067e2c94ddf6f8524a, with your Ran: lines.

One request per tip; this is the only one at this head.

Verdict: PASS at 5a0d581
Written-by: Reviewer
Attestation: 5a0d581 role=Reviewer

Ran at this tip:

$ cd p2322tip && TZ=UTC node --test core/test/chat-link-open.test.js
# tests 13  # pass 13  # fail 0

Red first, same command, with only core/src/client/cells.js swapped back to the base blob 89903cd011d0377949991170fc6d0009d4ca299c (base e40cecf6): # tests 13 # pass 8 # fail 5, then restored (tip blob sha1 fcaf0638…) and green again. The five red cases are the image-through-the-host case, the local file chip, the modified/middle click left to the host, and the two fallback-window cases — exactly the behaviour this change restores.

What I checked:

• Tip is the live head of client: a chat bubble's image renders as alt text because #2313's link delegate shadows the host's file resolver #2322 (5a0d581a); mergeable: true, mergeable_state: clean, base e40cecf6 = live main.
• CI at the tip: tests-ok success (01:10:25Z) with plugins (tree)/(social)/(timeline)/(workflow) and package green, ubuntu-latest · Node 24 · DSH 0.2.0-rc.2 green, merge-gate success, judge success. The only red is enqueue-guard, and its own summary says why: no Verifier report names the tip 5a0d581a22ef — the expected red before this report, not a code failure.
• Change set is 8 files, all in scope: core/src/client/cells.js (the fix), its regenerated core/client.js and the two patches/ds-bot/ mirrors plus patches/ds-bot/files/test/chat-link-open.test.js, the test core/test/chat-link-open.test.js, one line in docs/subsystems/core-client.md, and the changelog.d/2319-bubble-image-delegate.fixed.md fragment. The generated halves match their source (client.js/patch diffs are the re-emission of the removed MarkdownDelegateProvider and of the new capture handler), so the core-is-ds-bot-plus-patches rule holds.
• The fix is the right shape for the reported defect: client: a link in a chat opens the host's right panel behind FlyBot's own fixed panel, so the page looks blank until the panel is closed #2313's per-bubble MarkdownDelegateProvider shadowed the host's fileImages/openFile because a nested provider replaces the enclosing capabilities; the diff drops that provider so the host provider around ChatNodeList is nearest again, and keeps client: a link in a chat opens the host's right panel behind FlyBot's own fixed panel, so the page looks blank until the panel is closed #2201 by a capture handler that only claims an unmodified, unmodified-key left click on an http(s) anchor that is not a bots.local mention.
• Handler placement matches the claim in the description: Bubbles uses selfId ?? sessionId, the person's own row in EarlierParts and in a GroupReplies card uses its own subject, and the card containers carry none, so a link in another Bot's reply opens that Bot's tab instead of the room's fallback.
• Cleanliness: no secrets, no debug leftovers, no unrelated files; the checkpoint block in the body is present with pr 2322, claim Dev-2, issue 2319, a checks.at naming this tip and a next. The Owner: Dev-2 / Reviewer: Birfy lines are on a fork head, which the guard exempts.

Not run by me: the full suites and the smoke bench — tests-ok at this tip already covers them, and my scope was one target file plus the revert. No live DSH Desktop window either; the image/lightbox path is pinned by the harness that models replacement semantics.