debont80/AeroFetch
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 9 Wiki Activity

fix(main): L136 — enforce incognito in main (no errorlog / toast / cookie leak)

Browse Source 
Incognito lived only in the renderer (history skip), so a "private" download
still leaked in main: errorlog entries (title+URL), OS toasts showing the title,
and the signed-in cookies attached — the UI promised "no logging, no history, no
cookies" but only history held.

Plumb `incognito` through StartDownloadOptions and enforce it in main:
- logFailure skips the errorlog write (and the pre-spawn errorlog in ipc.ts).
- notify uses a generic outcome title and drops the detail body, so no title/URL
  lands in the Windows Action Center.
- both cookie sources (--cookies login jar, --cookies-from-browser) are withheld,
  so a private download can't be tied to the user's identity.

typecheck + 262 tests + eslint + prettier green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Devon Bontrager
2026-07-01 09:14:49 -04:00
parent 3baba3b7bc
commit 701c73a889
5 changed files with 59 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CODE-AUDIT.md
+8 -2
View File
@@ -755,9 +755,15 @@ token system + shared primitives (UI/SIMP — high value, larger effort) · i18n
*Round 6 (2026-06-29) — behavioral/logic edge cases:*
- [ ] **L136 — Incognito leaks outside history.** Even if the (unreachable, M6) private flag were set,
- [x] **L136 — Incognito leaks outside history.** Even if the (unreachable, M6) private flag were set,
`download.ts` still writes failures to `errorlog.json` (title + URL) and shows the title in completion
notifications — the "private" promise covers only history.
notifications — the "private" promise covers only history. *Fixed: `incognito` now flows through
`StartDownloadOptions` to main (the renderer's launch path passes `item.incognito`), where main enforces
the full "no logging, no history, no cookies" promise: `logFailure` skips the errorlog write (and the
pre-spawn errorlog in [ipc.ts](src/main/ipc.ts) too), `notify` uses a generic outcome title and drops the
detail body so no title/URL lands in the Windows Action Center, and both cookie sources
(`--cookies`/`--cookies-from-browser`) are withheld so a private download can't be tied to the signed-in
identity. (M6 wired the toggle; this makes the promise true in main, not just the renderer.)*
- [x] **L137 — Stuck 0% for unknown-size downloads.** `parseProgress` returns `progress: 0` when
`total_bytes`/`_estimate` are absent (livestreams, some sites), so the bar reads 0% the whole time
instead of an indeterminate state. *Fixed: `parseProgress` now sets `sizeUnknown: !totalBytes` on