security(persist): never eval persisted code + hardened CSP (TODO 10)

[lopugit]

Fixes TODO 10 — 🔒 SECURITY: persisted-state eval = arbitrary code execution on load; add a CSP (spec: TODO/claude-todo/09-security-hardening.md §C).

Stacked on #94 (claude/todo9-date-reviver-strict) — both PRs rewrite the same reviver/replacer in ThingtimeProvider.tsx; stacking avoids a guaranteed conflict. Merge #94 first, then this.

The vulnerability

The localforage persist reviver ran eval(value.code) (plus a second scoped eval) for any parsed {ttype:'function'} value, and the whole thingtime tree revives on every load. Anything able to write same-origin storage — an XSS, a browser extension, another tab — could plant a payload giving persistent arbitrary code execution on every subsequent load. No CSP existed anywhere.

The fix

1. Persisted code never executes. {ttype:'function'} values now revive as inert warning stubs (no eval, no scoped re-eval), and the replacer drops functions from persist entirely — load falls back to code-defined defaults for those slots. Legacy blobs keep working; their function entries just stop being live code.

2. Hardened CSP on the built shell. A build-only Vite plugin (cspMetaPlugin in remix/vite.config.ts) injects a CSP <meta> tag into dist/index.html:

• script-src 'self' 'unsafe-eval' 'sha256-…' 'sha256-…' — the two hashes are computed at build time from the shell's own inline scripts (theme pre-paint + title prefix). No 'unsafe-inline' for scripts, so injected inline/remote scripts are blocked.
• style/font allowances for Emotion/Chakra inline styles and Google Fonts; object-src 'none'; base-uri 'self'.
• Delivered as a meta tag deliberately: Vercel serves index.html via filesystem routing (bypassing Nitro), so a meta tag applies wherever the static shell is hosted. Dev is untouched (apply: 'build').
• No frame-ancestors on purpose — embedding Thingtime is a feature (embed SDK, default-open SSO origins, PR Thingtime SSO: default-open origins — any URL (incl. preview deploys) can use Login with Thingtime #87).

Why 'unsafe-eval' stays (deviation from the TODO's ideal)

smarts/index.tsx and both Commanders evaluate user-typed JS by design (≈20 eval sites — command execution, $context scoping, property access). A CSP without 'unsafe-eval' bricks the Commander outright. This PR eliminates the actual persistence-RCE vector (storage-planted code) and blocks script injection; dropping 'unsafe-eval' is a separate migration (sandboxed evaluator for smarts), noted in TODO/TODO.md and the spec checklist.

Verification

Node suite (26 checks, reviver/replacer extracted verbatim from the shipped file, real flatted): an attack payload {ttype:'function', code:'(globalThis.__pwned = true, …)'} does not execute at parse time nor when the stub is called; functions are dropped from persist while sibling values survive; all TODO 9 date/string semantics unchanged.

Live against the built shell (build:client + vite preview, Browser pane):

• CSP meta present with both hashes; in-browser crypto.subtle hash of the served inline scripts equals the meta hashes
• app boots and renders fully under the CSP; zero console errors/violations from its own resources
• a dynamically injected inline <script> is blocked (script-src-elem:inline violation — the only violation recorded)
• eval still works in-page (Commander/smarts safe)
• (The [LC] tab-title prefix disappearing under preview is pre-existing root.tsx:92 document.title = routeTitle behavior with no server loader data — unrelated to the CSP; hash-allowed scripts run.)

Also updates TODO/TODO.md item 10 and the §C/“Done when” status in claude-todo/09-security-hardening.md (A/B/D were already shipped).

Session 3 of 10 parallel todo sessions; claim branch pushed before work started.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
thingtime	Ready	Preview, Comment	Jul 26, 2026 12:48pm

[lopugit]

Consolidated into #94 (session 3/10): the eval-removal + CSP commit has been merged into the date-reviver branch, so #94 now carries both TODO 9 and TODO 10. Closing this to leave a single PR. See #94.