theseus/PACKAGING-PROMPT.md

Theseus Navigator — packaging session brief

Goal of this session: turn Theseus from "runs via npm start" into a downloadable, secret-free Windows installer hosted at dl.silentmode.st, with its SHA-256 published on-chain. Do it in the three phases below, in order.

Working dir: D:\Dev\SilentMode\TheseusNavigator. Prefix shell commands with rtk. Windows + PowerShell primary; Bash tool available.

Read first: ..\README.md (hub), ..\BUILD-ROADMAP.md (this is Stage 5), ..\SECURITY.md (Rules 0/2/3 govern this session), ..\_coordination\INTERFACES.md (the resolver contract), and this file. Theseus already works for .bch; the engine (..\Argus\src\lib\resolver-web.js) is already multi-TLD and zero-dep.

---

Current state (verified 2026-07-25)

• Theseus runs (npm start): Electron, tabs, back/fwd/reload/home, address bar, DuckDuckGo search box, home page, Tor toggle (bundled tor/tor.exe, routes web session + resolver WS + content fetch via SOCKS).
• Resolution reuses ..\Argus\src\lib\resolver-web.js (import in main.js).
• bns:// custom protocol serves content; provenance strip shows chain/Sia/server.
• NOT packaged: no electron-builder, no installer.
• Two blockers for a public build (must fix):
  1. main.js resolveHost() is still .bch-only (host.replace(/\.bch$/,"").split(".").pop()), and navigate() / serveBns() / subFolder() assume .bch. The engine is multi-TLD; the browser must catch up.
  2. serveBns() fetches s3 content with your Sia credentials (getAws() reads ..\Argus\sia-s3.json). A public build MUST NOT ship credentials (SECURITY.md Rule 0). Switch s3 to the public gateway.

Phase 1 — Multi-TLD + registry badge (browser catches up to engine)

• resolveHost(host): stop stripping .bch/.pop(). Pass the full host to resolveName(host, { WebSocket: currentWS() }) — it already normalizes any <sub>.<label>.<tld> to the canonical key. Cache/serve by full host.
• navigate(): replace host.endsWith(".bch") checks with "is this a BNS name?" = has a dot and the rightmost label is a known BNS TLD (bch, p2p, deviant, bit, …) — everything else is normal web. Keep a small TLD allowlist constant.
• serveBns() + subFolder(): generalize off .bch (drop tld + label to get the subfolder — mirror resolver-web.js/the gateway).
• Registry badge (trusted chrome — the security invariant): in the toolbar provenance strip (chrome, NOT page content), show the registry / TLD the name resolved under (e.g. "BitcoinCash · .bch"). This is where the future multi-registry .bit (BCH vs Namecoin) switch will surface. Unspoofable because it's painted by the browser, not the page.
• Verify: hello.bch, demo.p2p, coinspectrum.deviant.bch all load in tabs; badge shows the right TLD; normal web (wikipedia.org) still works.

Phase 2 — Secret-free content (SECURITY.md Rule 0)

• Replace the getAws() signed-S3 path in serveBns() with a plain fetch from the public gateway: https://navigate.st/bns/<name>/<path> (or the subdomain form). The gateway already serves s3/ip/h/u and injects no secrets. Remove the aws4fetch dependency and any read of sia-s3.json.
• Net effect: a shipped Theseus contains no credentials. s3 sites render by asking the public relay for the bytes; resolution stays local/trustless.
• Grep the repo + built output for sia-s3, accessKey, secretKey, C:\\Users\\, the OS username — must be clean before packaging.

Phase 3 — Package, scrub, publish

• Add electron-builder; target Windows NSIS installer + a portable .exe. Bundle tor/, chrome.html, home.html, preload.js, and the resolver it imports (either vendor resolver-web.js into the app or include ../Argus path in files). Confirm tor.exe and geoip files are packaged.
• Unsigned by choice (SECURITY.md Rule 2). Document the SmartScreen warning.
• Scrub fingerprints (Rule 3): build in a neutral path or strip absolute paths/source maps; no real name/email/username in metadata; set the app author to "Silent Mode". Normalize timestamps where feasible.
• Compute SHA-256 of the installer. Publish the hash on-chain — a BNS record (e.g. a releases name) or note the mechanism in ..\SECURITY.md.
• Deploy the installer to dl.silentmode.st (nginx already serves /opt/silent-mode/dl/ on the VPS via the silentmode-st / dl vhost). Update the download page (..\site\index.html) — swap the "packaging in progress" chip for a real link + the SHA-256 + "unsigned, verify the hash" note.
• Verify end to end: download the installer on a clean path, install, launch, load hello.bch + a Sia site + normal web, confirm no secrets in the install dir, confirm the published hash matches.

Guardrails

• Do NOT touch D:\Dev\NameCoin (live/canonical) or register/spend on-chain beyond (optionally) one release-hash record. Reads are fine.
• Do NOT ship sia-s3.json, ca/root-ca.key, wallets.json, any keystore/ password. Follow the SECURITY.md pre-release checklist.
• Elevated installs, code-signing, and AMO steps are the user's to run — don't attempt them; hand off exact commands.

Definition of done

A downloadable dl.silentmode.st Windows installer that: contains no secrets, resolves .bch/.p2p/etc. with a trusted-chrome registry badge, renders Sia sites via the public gateway, browses the normal web, and whose SHA-256 is published on-chain and shown on the download page.