Local archive showcase + open-source security hardening

[howieyoung]

What

A browsable archive (典藏) served by the resident local receiver. Every weekly email
carries a tokened "Open your archive" button to http://127.0.0.1:8787/archive, which
lays out every past issue like a magazine rack — rebuilt live from the DB, so even
email-only issues get a full web view. Each issue also gets a weekly reading digest: one
grounded editor-line naming what you actually read that week (the understanding that precedes
the cover), shown as the issue epigraph, the archive-card subtitle, and the email lead-in.

The UX principle throughout: the weekly email is the entry point — a button in the inbox
opens the local showcase; nothing leaves the machine.

Security foundation (open-source: safe under full source disclosure — Kerckhoffs)

Security rests only on a per-install random secret, never on code being hidden.

• Anti-DNS-rebinding: exact Host allowlist on all routes (incl. /capture).
• /capture hardened: requires Content-Type: application/json (blocks the no-cors
  drive-by that could poison the local DB); /health de-fingerprinted to {ok:true}.
• Capability token: 256-bit CSPRNG in the macOS Keychain (browstack-archive),
  fail-closed, sha256 + timingSafeEqual, short-TTL cached; ?k → sha256 cookie →
  302, SameSite=Lax. Never hardcoded/defaulted, never minted in a request handler.
• Strict CSP (default-src 'none'; img-src 'self' data:), CORP, nosniff, no-referrer.
• No arbitrary file reads: numeric-only /issues/:n & /covers/:n; cover via findCover
  exactOnly (never a sibling issue's art).
• Data-at-rest: idempotent 0700/0600 hardening on every DB open; .gitignore extended
  to .env variants and local *.db/*.sqlite.
• Guardrails: CI (npm ci → typecheck → node:test → grep-gates), CODEOWNERS on the
  security-critical files, and SECURITY.md documenting the threat model + the invariants
  above (please don't "simplify" past them).

Archive feature

• render/archive.ts rebuilds past issues from the issue window + issue_items + persisted
  summaries; render/issueView.ts is shared by preview and archive (one source of truth).
• render/digest.ts: editor-LLM distils the week's real reading into one line; stored in
  meta:issue_digest:N; surfaced in three places. Weekly pipeline now runs
  ingest → enrich → cover → digest → send (digest tolerated).
• Email button injected at send time only (token never written to out/).
• npm run archive:open / npm run token:rotate; heartbeat probes /health; the install
  script refuses to pin a node whose better-sqlite3 ABI won't load (prevents a silent
  crash-loop of the resident receiver).
• Archive section mirrored across all six READMEs; AGENTS.md gains the token + synthetic-
  sample rules.

Testing

• 18 hermetic security-invariant tests (test/security.test.ts) — pass on Node 20 & 22.
• Verified end-to-end on the live resident server: ?k → cookie → 302 → index/issue/cover
  serve; 403 without auth; 404 on missing/ traversal; gates active.

Operational note

The resident receiver is launched by launchd with a pinned node path. This branch's install
guard fails loudly (with npm rebuild better-sqlite3) if that node's better-sqlite3 ABI
won't load, rather than crash-looping silently. To pick up new server code, launchctl kickstart -k gui/$UID/com.browstack.serve (no re-pin) rather than reinstalling from a
different node.

🤖 Generated with Claude Code