In Theseus, Pithos now links the person's Theseus ID to their hosted account
by itself, once, right after signing in to Silent Mode (or on the first look
at an account already signed in): one consent prompt, then Pithos is listed
under Settings › Theseus ID. On a Theseus without the add-on API it does
nothing, so the add-on can ship before the Theseus release that carries it.
The gateway serves /console on its own origin: sign in with the Theseus ID
and see the account's state, sign-up, usage and Theseus ID, with a console
session that cannot reach files. Three fixed files under a CSP that allows
only this origin.
The bundled copy in TheseusNavigator/bundled-addons/pithos is rebuilt from
Pithos/ with no version bump; the release that ships it bumps the version.
Renaming refused on hosted drives because encrypted names and contents are
bound to their path. The encrypting client now renames itself: readable
files keep s3d's server-side copy, the rest are decrypted and encrypted again
for their new place. A drive with shared folders or links is not renamed,
since its rules belong to the old name.
Free space is forwarded to the server, whose s3d answers for its own
folder, instead of reporting nothing. space.js now builds on sia-account.js,
so BLAKE2b and the indexer request signing exist once.
The new site mode recognises a path by the s3d's user names. With drives on
Silent Mode the local s3d has none, so it now asks the server for them;
otherwise pithos.sia/<user> links stop working once drives move.
A server-sent file list could name paths outside the s3d folder (or the key
file in it), and a failed move back deleted every listed path. Transfers now
accept only s3d data paths, check all of them before writing, never
overwrite, and clean up only what they wrote.
A lost reply could lose or fork the drives: move-up and move-down now ask the
server who holds them before touching the local copy, and once the server is
told to release, the local copy is never removed (the release is retried).
The gateway no longer lets one account route another's access key id, refuses
. and .. in shared-key paths, strips presign parameters before re-signing,
counts upload size on disk, stops s3d before it can be restarted mid-move, and
claims sign-up proofs before checking them. The key file is never replaced
when unreadable, a local edit removes the older encrypted copy, listing pages
no longer repeat, and data hashes stream instead of loading whole files.
Settings gains a sign-in, sign-up and move card for Silent Mode; Overview,
the status pill, Access and Share follow the server when drives are hosted.
Folders get their own Share (public, or a key with read/add/edit rights),
since per-folder access is what hosting adds over a bare s3d. Files the
server can still read are marked, and Access can encrypt the ones that
predate the move.
s3d binds one Sia account per process, so the server runs one s3d per
person (pithos-hosted), started on demand and flushed and stopped when idle.
Only the connected s3d data folder moves between PC and server; the Sia
recovery phrase never leaves the PC and nothing is re-uploaded to Sia.
Because the server holds the connection key, local Pithos encrypts names and
contents before they leave the machine, with keys from the Theseus vault (or
a local key file elsewhere). What s3d cannot do on its own, the gateway now
enforces: public folders, expiring share links and S3 keys for other people
limited to one folder with read, add-only or edit rights. Files those reach
are stored readable, since visitors have no key, and go back to encrypted
when the rule is removed. Sign-up needs a BNS name signature, a deposit or
an invite, with a per-IP limit.
