chore: update docs

.agents/conventions/android.md

@@ -6,4 +6,4 @@ Applies when editing `android/**/*.{java,kt}`.
 - Set `EXTRA_ALLOW_MULTIPLE` only when the chooser mode is multi-open.
 - Prefer existing bridge patterns in `MainActivity` for storage, file pick, and push.
 - After Android bridge changes, note whether emulator smoke or unit coverage is needed.
-- WebView navigation uses `RemoteBackendUrl.isAllowedShellNavigation` (backend origin only). Deny `data:` and userinfo. The JS bridge follows every loaded page. See `.agents/skills/url-origin-allowlists/SKILL.md`.
+- WebView navigation uses `RemoteBackendUrl.isAllowedShellNavigation` (backend origin only). Deny `data:` and userinfo. Keep file access off and mixed content never-allow. The JS bridge follows every loaded page. See `.agents/skills/url-origin-allowlists/SKILL.md`.

.agents/skills/android-webview-bridge/SKILL.md

@@ -32,6 +32,7 @@ Keep Chaquopy backend boot, WebView file choosers, storage locks, and external n
 - External http(s) links open in the system browser. Do not navigate the WebView away from the app.
 - `isAllowedWebViewNavigationUri` must call `RemoteBackendUrl.isAllowedShellNavigation`. Allow the configured backend origin, `about:blank`, and blobs whose inner origin matches the backend.
 - Deny `data:`, `javascript:`, `file:`, and userinfo URLs. The `MeshChatXAndroid` JS bridge is injected into every page the WebView loads.
+- Keep `setAllowFileAccess(false)`, `setAllowFileAccessFromFileURLs(false)`, `setAllowUniversalAccessFromFileURLs(false)`, and `MIXED_CONTENT_NEVER_ALLOW`. File pickers use Intents, not WebView `file:` URLs.
 - Any loopback host on any port is not an allowlist. Remote-backend mode must not still permit `127.0.0.1:<other-port>`.
 - Parse with `java.net.URI`. Reject `getUserInfo()`. Do not prefix-match `http://127.0.0.1`.
 - Vendored `lxmfy` and `rns_filesync` are synced into Chaquopy `src/main/python/`. Android pip does not install them like desktop setuptools.

.agents/skills/electron-frozen-packaging/SKILL.md

@@ -28,6 +28,7 @@ Package and recover the desktop shell correctly: frozen subprocess re-entry, loa
 - Attach `will-navigate`, `will-redirect`, `will-frame-navigate`, and `setWindowOpenHandler` on `web-contents-created` so popouts get the same guards.
 - Deny `will-attach-webview`. Deny `data:` in-window. Allow `blob:` only when the inner origin is the local backend.
 - Preload `window.electron` IPC runs only for `isTrustedShellOrigin` (file loading.html/crash.html, `127.0.0.1`/`localhost` port 9337, trusted blobs).
+- `ipcMain` handlers must call `isTrustedIpcEvent` (sender frame URL, same allowlist). Do not rely on preload alone.
 - `safeExternalUrl` sends remaining http(s)/mailto to the OS browser. Do not replace the app window with external sites.
 - Close behaviour (quit / tray / ask) persists per user choice. Guard re-entrancy on close.
 

.agents/skills/plugin-install-security/SKILL.md

@@ -37,6 +37,7 @@ Plugins are powerful. Treat install and enable as security-sensitive.
 - Invalid RSG signatures **hard-block** install. Do not add bypass paths.
 - ZIP extract must use zip-slip safe extraction. WASM must pass `validate_wasm_file`.
 - New hooks go in `KNOWN_HOOKS`. New managers go in `KNOWN_MANAGERS` in `plugin_permissions.py`.
+- Network endpoint scanning parses the URL host. A remote URL is not local because the string contains `127.0.0.1` or `localhost`.
 - Plugin i18n lives in the plugin bundle (`locales/{locale}.json`), not core `en.json`.
 - Disable everything with `--disable-plugins` / `MESHCHAT_DISABLE_PLUGINS=true` when diagnosing.
 

.agents/skills/url-origin-allowlists/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: url-origin-allowlists
-description: Parse URL origins for shell and outbound allowlists. Never prefix-match http(s). Use when changing Electron navigation, Android WebView nav, preload IPC, or HTTP URL guards.
+description: Parse URL origins for shell and outbound allowlists. Never prefix-match http(s). Use when changing Electron navigation, Android WebView nav, preload IPC, ipcMain handlers, or HTTP URL guards.
 ---
 
 # Skill: url-origin-allowlists
@@ -9,7 +9,7 @@ Decide allow/deny from a parsed URL (scheme, host, port, userinfo), never from a
 
 ## When to use
 
-- Electron `will-navigate`, `will-redirect`, `window.open`, preload IPC
+- Electron `will-navigate`, `will-redirect`, `window.open`, preload IPC, ipcMain sender URL
 - Android WebView navigation or `JavascriptInterface` pages
 - Outbound HTTP allowlists (`http_url_guard`, community directory, remote backend URL)
 - Any new "is this our local backend?" helper
@@ -23,8 +23,10 @@ Decide allow/deny from a parsed URL (scheme, host, port, userinfo), never from a
 5. Deny `data:` and `javascript:` in app shells. Those pages still receive Electron preload or Android `addJavascriptInterface`.
 6. Electron: attach guards on `web-contents-created` (every WebContents, including popouts). Handle `will-navigate`, `will-redirect`, and `will-frame-navigate`. Deny `will-attach-webview`.
 7. Electron preload: no-op IPC unless `isTrustedShellOrigin` (`file:` loading.html/crash.html, local backend `:9337`, trusted blobs).
-8. Android WebView: allow only `matchesBackend(url, resolveBackendUrl())`, `about:blank`, and blobs whose inner origin matches the backend. Any loopback host/port is not enough.
-9. Hostname RFC1918 checks must require a dotted-quad IPv4 (or a parsed hostname), not `host.startsWith("10.")`.
+8. Electron `ipcMain.handle`: reject unless `event.senderFrame.url` (fallback `sender.getURL()`) passes `isTrustedShellOrigin`. Preload checks are not enough.
+9. Android WebView: allow only `matchesBackend(url, resolveBackendUrl())`, `about:blank`, and blobs whose inner origin matches the backend. Any loopback host/port is not enough. Keep `setAllowFileAccess(false)` and `MIXED_CONTENT_NEVER_ALLOW`.
+10. Hostname RFC1918 checks must require a dotted-quad IPv4 (or a parsed hostname), not `host.startsWith("10.")`.
+11. Plugin `network:fetch` scanning: parse the URL host. Do not treat a remote URL as local because the string contains `127.0.0.1` or `localhost`.
 
 ## Tests (oracle, not crash-only)
 
@@ -40,12 +42,13 @@ Do not write exploit pages or PoCs. The oracle is accept/reject on the parser.
 ## Key files
 
 - `electron/shellOrigin.js`
-- `electron/main.js` (`web-contents-created`)
+- `electron/main.js` (`web-contents-created`, `trustedIpcHandle`)
 - `electron/preload.js`
 - `electron/safeExternalUrl.js`
 - `android/app/src/main/java/com/meshchatx/RemoteBackendUrl.java`
 - `meshchatx/src/frontend/js/remoteBackendUrl.js`
 - `meshchatx/src/backend/http_url_guard.py`
+- `meshchatx/src/backend/plugin_permissions.py` (`_is_external_http_url`)
 - `tests/electron/mainHelpers.test.js`
 - `android/app/src/test/java/com/meshchatx/RemoteBackendUrlTest.java`
 
@@ -53,4 +56,5 @@ Do not write exploit pages or PoCs. The oracle is accept/reject on the parser.
 
 - `.agents/skills/electron-frozen-packaging/SKILL.md`
 - `.agents/skills/android-webview-bridge/SKILL.md`
+- `.agents/skills/plugin-install-security/SKILL.md`
 - `.agents/skills/test-oracles/SKILL.md`