theseus/PACKAGING-PROMPT.md

# Theseus Navigator — packaging session brief

Goal of this session: turn Theseus from "runs via `npm start`" into a
**downloadable, secret-free Windows installer** hosted at `dl.silentmode.st`,
with its SHA-256 published on-chain. Do it in the three phases below, in order.

Working dir: `D:\Dev\SilentMode\TheseusNavigator`. Prefix shell commands with
`rtk`. Windows + PowerShell primary; Bash tool available.

**Read first:** `..\README.md` (hub), `..\BUILD-ROADMAP.md` (this is Stage 5),
`..\SECURITY.md` (Rules 0/2/3 govern this session), `..\_coordination\INTERFACES.md`
(the resolver contract), and this file. Theseus already works for `.bch`; the
engine (`..\Argus\src\lib\resolver-web.js`) is already multi-TLD and zero-dep.

---

## Current state (verified 2026-07-25)
- Theseus **runs** (`npm start`): Electron, tabs, back/fwd/reload/home, address
  bar, DuckDuckGo search box, home page, **Tor toggle** (bundled `tor/tor.exe`,
  routes web session + resolver WS + content fetch via SOCKS).
- Resolution reuses `..\Argus\src\lib\resolver-web.js` (import in `main.js`).
- `bns://` custom protocol serves content; provenance strip shows chain/Sia/server.
- **NOT** packaged: no `electron-builder`, no installer.
- **Two blockers for a public build (must fix):**
  1. `main.js` `resolveHost()` is still `.bch`-only
     (`host.replace(/\.bch$/,"").split(".").pop()`), and `navigate()` /
     `serveBns()` / `subFolder()` assume `.bch`. The engine is multi-TLD; the
     browser must catch up.
  2. `serveBns()` fetches `s3` content with **your Sia credentials**
     (`getAws()` reads `..\Argus\sia-s3.json`). **A public build MUST NOT ship
     credentials** (SECURITY.md Rule 0). Switch `s3` to the public gateway.

## Phase 1 — Multi-TLD + registry badge (browser catches up to engine)
- `resolveHost(host)`: stop stripping `.bch`/`.pop()`. Pass the **full host** to
  `resolveName(host, { WebSocket: currentWS() })` — it already normalizes any
  `<sub>.<label>.<tld>` to the canonical key. Cache/serve by full host.
- `navigate()`: replace `host.endsWith(".bch")` checks with "is this a BNS name?"
  = has a dot and the rightmost label is a known BNS TLD (`bch`, `p2p`, `deviant`,
  `bit`, …) — everything else is normal web. Keep a small TLD allowlist constant.
- `serveBns()` + `subFolder()`: generalize off `.bch` (drop tld + label to get
  the subfolder — mirror `resolver-web.js`/the gateway).
- **Registry badge (trusted chrome — the security invariant):** in the toolbar
  provenance strip (chrome, NOT page content), show the **registry / TLD** the
  name resolved under (e.g. "BitcoinCash · .bch"). This is where the future
  multi-registry `.bit` (BCH vs Namecoin) switch will surface. Unspoofable
  because it's painted by the browser, not the page.
- Verify: `hello.bch`, `demo.p2p`, `coinspectrum.deviant.bch` all load in tabs;
  badge shows the right TLD; normal web (wikipedia.org) still works.

## Phase 2 — Secret-free content (SECURITY.md Rule 0)
- Replace the `getAws()` signed-S3 path in `serveBns()` with a plain fetch from
  the **public gateway**: `https://navigate.st/bns/<name>/<path>` (or the
  subdomain form). The gateway already serves `s3`/`ip`/`h`/`u` and injects no
  secrets. Remove the `aws4fetch` dependency and any read of `sia-s3.json`.
- Net effect: a shipped Theseus contains **no credentials**. `s3` sites render by
  asking the public relay for the bytes; resolution stays local/trustless.
- Grep the repo + built output for `sia-s3`, `accessKey`, `secretKey`,
  `C:\\Users\\`, the OS username — must be clean before packaging.

## Phase 3 — Package, scrub, publish
- Add `electron-builder`; target Windows **NSIS installer** + a **portable .exe**.
  Bundle `tor/`, `chrome.html`, `home.html`, `preload.js`, and the resolver it
  imports (either vendor `resolver-web.js` into the app or include `../Argus`
  path in `files`). Confirm `tor.exe` and geoip files are packaged.
- **Unsigned by choice** (SECURITY.md Rule 2). Document the SmartScreen warning.
- **Scrub fingerprints** (Rule 3): build in a neutral path or strip absolute
  paths/source maps; no real name/email/username in metadata; set the app
  `author` to "Silent Mode". Normalize timestamps where feasible.
- Compute **SHA-256** of the installer. Publish the hash **on-chain** — a BNS
  record (e.g. a `releases` name) or note the mechanism in `..\SECURITY.md`.
- Deploy the installer to **`dl.silentmode.st`** (nginx already serves
  `/opt/silent-mode/dl/` on the VPS via the `silentmode-st` / `dl` vhost). Update
  the download page (`..\site\index.html`) — swap the "packaging in progress"
  chip for a real link + the SHA-256 + "unsigned, verify the hash" note.
- Verify end to end: download the installer on a clean path, install, launch,
  load `hello.bch` + a Sia site + normal web, confirm no secrets in the install
  dir, confirm the published hash matches.

## Guardrails
- Do NOT touch `D:\Dev\NameCoin` (live/canonical) or register/spend on-chain
  beyond (optionally) one release-hash record. Reads are fine.
- Do NOT ship `sia-s3.json`, `ca/root-ca.key`, `wallets.json`, any keystore/
  password. Follow the SECURITY.md pre-release checklist.
- Elevated installs, code-signing, and AMO steps are the user's to run — don't
  attempt them; hand off exact commands.

## Definition of done
A downloadable **`dl.silentmode.st`** Windows installer that: contains no
secrets, resolves `.bch`/`.p2p`/etc. with a trusted-chrome registry badge,
renders Sia sites via the public gateway, browses the normal web, and whose
SHA-256 is published on-chain and shown on the download page.