fix(persist): stop Date-reviver corruption + kill persisted-state eval RCE, add CSP (TODO 9 + 10)

[lopugit]

Fixes TODO 9 (persist Date-reviver data corruption) and TODO 10 (persisted-state eval RCE + CSP) — both rewrite the same ThingtimeProvider reviver/replacer, so they're combined into one PR. (Consolidated from the former #102, whose commit is merged into this branch.)

---

TODO 9 — 🐛 persist reviver turned ordinary strings into Dates

The localforage reviver revived any string passing V8's lenient Date.parse: "Post 1", "1", "2024", "March 2024" became Date objects on reload, then re-persisted as ISO strings — permanently corrupting user data after one save/reload cycle.

Fix: revive only exact toISOString() output. That's the real persist format — flatted (like JSON.stringify) calls Date.toJSON before the replacer runs, so the replacer's old instanceof Date branch was dead code and is removed. Legacy saves (bare ISO strings) still revive as Dates unchanged.

TODO 10 — 🔒 persisted-state eval = arbitrary code execution + no CSP

The same reviver ran eval(value.code) for any {ttype:'function'} value on every load. Anything able to write same-origin storage (XSS, extension, another tab) gained persistent arbitrary code execution.

Fix:

• Persisted {ttype:'function'} values now revive as inert warn stubs (no eval); functions are dropped from persist entirely (load falls back to code-defined defaults).
• A build-only Vite plugin injects a CSP meta tag into the static shell: script-src 'self' + sha256 hashes for the shell's two inline scripts (no 'unsafe-inline' for scripts → injected inline/remote scripts blocked). Delivered as a meta tag so it applies wherever Vercel serves index.html. 'unsafe-eval' is retained deliberately — smarts + the Commander evaluate user-typed JS by design; dropping it is a separate migration. No frame-ancestors (embedding is a feature).

Verification

• Node suites vs real flatted (reviver/replacer extracted verbatim): everyday strings survive persist→reload; real Dates round-trip; legacy blobs still revive Dates; an attack payload never executes at parse or stub-call; functions dropped from persist.
• Live browser (built shell via vite preview): probe strings survive the app's own load→autosave cycle with a legacy ISO date as the only revived Date; app boots under the CSP with zero violations from its own scripts (in-browser hash equality confirmed); an injected inline script is blocked; eval still works for the Commander.

Updates TODO/TODO.md items 9 & 10 and claude-todo/09-security-hardening.md §C/§D.

Session 3 of 10 parallel todo sessions.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
thingtime	Ready	Preview, Comment	Jul 29, 2026 2:31am

[lopugit]

Duplicate-work notice (parallel sessions): PR #94 and PR #96 both fix TODO 9 — they raced before the shared claims protocol (TODO/.claims/, created by session 1 mid-run) existed. One should be merged and the other closed. A precise comparison to help pick:

Where they agree — both revive bare strings only when they exactly match toISOString() output (YYYY-MM-DDTHH:mm:ss.sssZ) with a Date.parse validity check, both keep legacy persisted Dates working, both leave the ttype:'function' eval path (TODO 10) byte-identical, and both were verified against real flatted plus a live browser persist→reload cycle.

Where they differ — the persist format going forward:

• fix(persist): stop Date-reviver corruption + kill persisted-state eval RCE, add CSP (TODO 9 + 10) #94 keeps Dates as bare ISO strings (the Date.toJSON output) forever, and removes the replacer's dead instanceof Date branch. Simpler, no format change — but a user string that exactly matches full ISO format will be mis-revived as a Date permanently, since the format can never distinguish the two.
• fix: persist reviver no longer corrupts ordinary strings into Dates (TODO 9) #96 persists Dates tagged as {ttype:'date', iso}, mirroring the existing ttype:'function' scheme. fix(persist): stop Date-reviver corruption + kill persisted-state eval RCE, add CSP (TODO 9 + 10) #94's claim that tagging "can't work without an expensive pre-serialize tree walk" is not correct: JSON.stringify calls the replacer with the holder as this, so this[key] instanceof Date sees the original Date after toJSON has run — no tree walk needed, and flatted 3.4.2 forwards the holder ($.call(this, key, value), cjs/index.js L106). The tagged objects are visible in fix: persist reviver no longer corrupts ordinary strings into Dates (TODO 9) #96's persisted output. With tagging, the exact-ISO collision only applies to legacy blobs, and the bare-string heuristic can be deleted entirely after a migration window.

Recommendation: merge #96 (tagged format is strictly more future-proof and matches the TODO's suggested scheme), and cherry-pick #94's nice TODO/TODO.md ✅-annotation hunk. Merging #94 instead is also safe — the formats are compatible one-way (#96's reviver reads #94's output, not vice versa), so #94→#96 later would work, #96→#94 would strand tagged saves.

(Posted by session 1; identical comment on both PRs.)

[lopugit]

Consolidating the TODO 8/9/10 security PRs: #99 is the single winner and now carries this PR's unique value (see the consolidation note on #99 for exactly what was folded in and why). Closing as a duplicate.