refactor: remove unused capability kernel#288
Merged
Conversation
Deploying podnotes with
|
| Latest commit: |
340d9c0
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://71da4cce.podnotes.pages.dev |
| Branch Preview URL: | https://refactor-remove-capability-k.podnotes.pages.dev |
chhoumann
added a commit
that referenced
this pull request
Jul 11, 2026
…gate Route every fetch call site (episode download, streaming, chapters, iTunes search, Deepgram diarization, feed documents, universal links) through a single requestWithTimeout gate that classifies the target, bounds request and response sizes, applies timeouts, and returns redacted typed errors. Fold LiteralTargetClassifier's stricter address classification into assertFetchableUrl (full IANA special-purpose IPv4/IPv6 registries, canonical-form-only literal parsing) and delete the module - the last remnant of the removed capability architecture. Replace ad hoc per-site guards with one chokepoint so new call sites cannot bypass classification. requestUrl's documented limitations (no per-hop redirect inspection, no native cancellation, buffered bodies) remain the accepted design ceiling per #288. Concurrent downloads to the same destination now dedupe on the normalized destination path with ownership validation instead of racing.
chhoumann
added a commit
that referenced
this pull request
Jul 11, 2026
…gate (#290) * fix(security): consolidate all outbound requests behind one hardened gate Route every fetch call site (episode download, streaming, chapters, iTunes search, Deepgram diarization, feed documents, universal links) through a single requestWithTimeout gate that classifies the target, bounds request and response sizes, applies timeouts, and returns redacted typed errors. Fold LiteralTargetClassifier's stricter address classification into assertFetchableUrl (full IANA special-purpose IPv4/IPv6 registries, canonical-form-only literal parsing) and delete the module - the last remnant of the removed capability architecture. Replace ad hoc per-site guards with one chokepoint so new call sites cannot bypass classification. requestUrl's documented limitations (no per-hop redirect inspection, no native cancellation, buffered bodies) remain the accepted design ceiling per #288. Concurrent downloads to the same destination now dedupe on the normalized destination path with ownership validation instead of racing. * fix(download): defer destination-collision check to the sniffed final path The fast path threw a destination collision when a foreign file occupied the provisional URL-extension path, but that path is only a guess - the probe can resolve a different final extension whose destination is free. The fast path now returns early only for the registered owner and otherwise falls through; the collision check runs on the resolved final path, where it already existed. Costs one Range probe before the error in the true-collision case. (Codex review finding on #290.)
chhoumann
added a commit
that referenced
this pull request
Jul 11, 2026
…sts (#297) * fix(security): keep generated notes from making browser-managed requests Feed-controlled show-notes HTML could embed active media elements (img, audio, video, source, iframe, object, embed, link) whose requests fire when a generated note renders - reaching feed-selected local/private targets without ever passing PodNotes' network gate. Markdown image syntax in feed text formed the same live embeds after conversion. feedHtmlToMarkdown now strips active elements before htmlToMarkdown (keeping image alt text), neutralizes Markdown embeds afterwards with balanced escaping, and the portable resource tags ({{artwork}}, {{episodeartwork}}, {{feedartwork}}, {{stream}}) emit only public http(s) URLs without embedded credentials - anything else renders as an empty string. Deliberate UX change: show-note images render as their alt text instead of live embeds; a note render is an ambient fetch the reader never chose, unlike clicking a link (links are preserved). Ported from the salvaged pre-#288 hardening pass (salvage branch 0bf89a4) onto the current gate API. * docs: name the DNS-rebinding residual on portable resource URLs Review follow-up: sanitizePortableResourceUrl blocks literal private and credentialed targets but a public hostname that DNS-resolves to a private address still passes - the same ceiling #290 documents, unfixable without DNS resolution the render layer can't do. Document it rather than imply complete protection.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Remove the unshipped schema-v3 and capability-network architecture before any user data can migrate into it.
The capability aggregate was constructed and disposed by the plugin lifecycle but had no production feed, download, playback, or transcription consumer. This deletes that complete dependency closure and removes the now-dead lifecycle wiring.
The review boundary intentionally preserves:
requestUrl's concrete host limitations remain documented in capability-neutral language so the next network-boundary PR does not overstate redirect, DNS, peer, or cancellation guarantees.
Review focus:
Validation:
Bundle impact:
Release impact: none. This is a behavior-neutral refactor and should not cut a release.