[0.9.1] FORK_IA_UX: review pass — remove dead code + Karvan security hardening

Dead code (from the abandoned thumb-zone/Explore-sheet nav experiment):
- OasisMobile.css: removed ~90 lines of orphaned CSS (.oasis-bottombar-fork/.bb-fab-*,
  .hive-sheet*/.fork-sheet*/.hsq-*, .omt-spacer, .hive-sheet-seg/.hs-seg, dead
  .oasis-bottombar-fixed) — no element emits any of them.
- main_views.js: removed renderHiveSheet() (never called; sole emitter of that CSS).
- karvan_view.js: dropped dead export karvanShortId + unused karvanView param.
- Added a style for .karvan-msg-live (client emitted it with no rule).

Karvan security (from the review):
- GET /karvan/:id only adopts a mirror room on a real navigation (sec-fetch-dest
  document / Accept text/html), not on <img>/subresources → fixes a CSRF that could
  spam/evict the user's ephemeral rooms.
- Cap room.members at 50 (was unbounded; each poll echoed it back).
- Reject signal payloads >16KB (SDP/ICE are tiny) — anti memory-DoS.
- karvan.js: guard malformed {kind:desc} signals so one bad signal can't abort a poll batch.
Tests: 15/15 (added members-cap + oversized-payload). Verified: CSRF fix (nav=200,
subresource=302), pages unchanged after CSS removal, boot clean.

src/backend/backend.js

@@ -3655,7 +3655,13 @@ router
   .get('/karvan/:id', async (ctx) => {
     if (!checkMod(ctx, 'karvanMod')) { ctx.redirect('/modules'); return; }
     let room = karvanModel.getRoom(ctx.params.id);
-    if (!room) room = karvanModel.adoptRoom({ id: ctx.params.id }); // unirse por enlace/invitación (espejo local)
+    // unirse por enlace/invitación crea un espejo local, pero SOLO en una navegación real (documento):
+    // un <img>/subrecurso de una web maliciosa NO debe poder crear/expulsar salas por GET (CSRF). El navegador
+    // controla sec-fetch-dest/accept, así que son señales fiables.
+    if (!room) {
+      const isNav = ctx.get('sec-fetch-dest') === 'document' || (ctx.get('accept') || '').includes('text/html');
+      if (isNav) room = karvanModel.adoptRoom({ id: ctx.params.id });
+    }
     if (!room) { ctx.redirect('/karvan'); return; }
     let selfId = ''; try { selfId = getViewerId(); } catch (e) {}
     const msgs = karvanModel.listMessages(room.id, 0) || [];

src/client/assets/themes/OasisMobile.css

@@ -1042,107 +1042,9 @@ button, input[type="submit"], input[type="button"],
 /* --- hive ahora global en el header (debajo de los 2 botones) --- */
 .header .hive-nav { margin: 34px auto 10px; }
 
-/* --- bottombar FIJA de 6 (Inbox·PM·Write·Search·Graphos·Peers): que quepan --- */
-.oasis-bottombar-fixed .bb-item { padding: 2px 0; gap: 2px; }
-.oasis-bottombar-fixed .bb-ico { font-size: 17px; }
-.oasis-bottombar-fixed .bb-lbl { font-size: 8.5px; }
-
-/* ==========================================================================
-   FORK_IA_UX — navegación thumb-zone: hive en HOJA INFERIOR + FAB de publicar + barra reordenada.
-   Respaldo real: Hoober 2013 (49% una mano), Bergstrom-Lehtovirta CHI 2011 (área del pulgar = arco),
-   Parhi 2006 (diana ≥9mm → ≥48px), NN/g 2016 (nav visible > oculta), Von Restorff (FAB destacado).
-   Sin JS (checkbox-hack), gateado por OASIS_MOBILE.
-   ========================================================================== */
-
-/* hive de vuelta en el header: holgura bajo la topbar fija (como en la versión que gustaba) */
+/* holgura bajo la topbar fija (el hive va en el header, solo en la home) */
 body { padding-top: 84px; }
 
-/* --- barra inferior FORK (thumb-zone): 5 huecos con FAB central elevado --- */
-.oasis-bottombar-fork { align-items: flex-end; gap: 2px; }
-.oasis-bottombar-fork .bb-item,
-.oasis-bottombar-fork .bb-explore {
-  min-height: 52px;                 /* diana táctil holgada (≥48px, Parhi 2006 / Material 48dp) */
-  justify-content: center;
-  cursor: pointer; text-decoration: none;
-}
-/* FAB central de publicar: círculo dorado destacado y elevado (Von Restorff + Jakob) */
-.oasis-bottombar-fork .bb-fab-btn {
-  flex: 0 0 auto;
-  display: flex; align-items: center; justify-content: center;
-  width: 58px; height: 58px; margin: 0 4px;
-  border-radius: 50%;
-  background: #FFD700; color: #121212;
-  box-shadow: 0 3px 10px rgba(0,0,0,.55);
-  text-decoration: none;
-  transform: translateY(-16px);     /* lo levanta por encima de la barra */
-}
-.oasis-bottombar-fork .bb-fab-glyph { font-size: 32px; font-weight: 700; line-height: 1; }
-.oasis-bottombar-fork .bb-fab-btn:active { filter: brightness(.9); }
-
-/* --- HOJA INFERIOR del hive (bottom-sheet, sin JS) --- */
-.fork-sheet-wrap { display: contents; }        /* no genera caja: el checkbox y la hoja quedan hermanos */
-.fork-sheet-toggle { position: absolute; width: 1px; height: 1px; opacity: 0; pointer-events: none; margin: 0; }
-
-.hive-sheet {
-  position: fixed; inset: 0; z-index: 1200;
-  visibility: hidden;                 /* CERRADA: fuera del hit-testing → el topbar y el contenido de abajo SIEMPRE reciben taps (fix del bug de "botones de arriba no funcionan") */
-  transition: visibility 0s linear .3s;  /* al cerrar, mantiene visible durante la animación de bajada */
-  background-color: transparent; box-shadow: none; border-radius: 0; /* anula el div{#222} global */
-}
-.hive-sheet-backdrop { position: absolute; inset: 0; background: rgba(0,0,0,.6); opacity: 0; transition: opacity .25s ease; }
-.hive-sheet-panel {
-  position: absolute; left: 0; right: 0; bottom: 0; margin: 0;
-  max-height: 82vh; overflow-y: auto;
-  background: #121212; border-top: 1px solid #333; border-radius: 18px 18px 0 0;
-  padding: 6px 10px calc(20px + env(safe-area-inset-bottom, 0px));
-  transform: translateY(100%); transition: transform .28s ease;
-  box-shadow: 0 -6px 24px rgba(0,0,0,.5);
-}
-/* abierto */
-.fork-sheet-toggle:checked ~ .hive-sheet { visibility: visible; transition: visibility 0s; }
-.fork-sheet-toggle:checked ~ .hive-sheet .hive-sheet-backdrop { opacity: 1; }
-.fork-sheet-toggle:checked ~ .hive-sheet .hive-sheet-panel { transform: translateY(0); }
-
-/* asa/grip para cerrar */
-.hive-sheet-grip { display: block; width: 44px; height: 5px; margin: 4px auto 10px; border-radius: 3px; background: #444; cursor: pointer; }
-/* fila de accesos que NO están en el hive (red y estado) */
-.hive-sheet-quick {
-  display: grid; grid-template-columns: repeat(4, 1fr); gap: 8px;
-  margin: 2px 0 10px; padding: 0 0 8px; border-bottom: 1px solid #262626;
-  background-color: transparent; box-shadow: none; border-radius: 0; /* anula div{#222} */
-}
-.hive-sheet-quick .hsq-item {
-  display: flex; flex-direction: column; align-items: center; gap: 4px;
-  min-height: 48px; justify-content: center;
-  text-decoration: none; color: #FFD700;
-  background: #161616; border: 1px solid #333; border-radius: 12px; padding: 6px 2px;
-}
-.hive-sheet-quick .hsq-ico { font-size: 20px; line-height: 1; }
-.hive-sheet-quick .hsq-lbl { font-size: 10px; }
-/* el hive dentro de la hoja */
-.hive-sheet .hive-nav { margin: 2px auto 0; max-width: 360px; }
-.hive-sheet .hive-mods { background-color: transparent; box-shadow: none; border-radius: 0; } /* por si el div{#222} lo alcanza */
-
-/* topbar v2: solo identidad (logo … avatar); el spacer empuja el avatar a la derecha */
-.oasis-mobile-topbar .omt-spacer {
-  flex: 1 1 auto; min-width: 0;
-  background-color: transparent; box-shadow: none; border-radius: 0; padding: 0; margin: 0; /* anula div{#222} */
-}
-
-/* control segmentado Personal/Community/Todo dentro de la hoja (movido desde el topbar) */
-.hive-sheet-seg {
-  display: flex; gap: 6px; margin: 2px 0 10px;
-  background-color: transparent; box-shadow: none; border-radius: 0; /* anula div{#222} */
-}
-.hive-sheet-seg .hs-seg {
-  flex: 1 1 0; text-align: center;
-  min-height: 40px; display: flex; align-items: center; justify-content: center;
-  border: 1px solid #FFD700; border-radius: 10px;
-  background: #161616; color: #FFD700; font-weight: 600; font-size: 13px;
-  text-decoration: none;
-}
-.hive-sheet-seg .hs-seg.active { background: #FFD700; color: #121212; }
-
 /* ==========================================================================
    FORK_IA_UX · Módulo KARVAN (mensajes temporales + WebRTC) — chat estilo burbujas
    ========================================================================== */
@@ -1179,6 +1081,7 @@ body { padding-top: 84px; }
 .karvan-msg { max-width: 82%; align-self: flex-start; background: #1c1c1c; border: 1px solid #333;
   border-radius: 14px; padding: 7px 11px; box-sizing: border-box; }
 .karvan-msg-self { align-self: flex-end; background: #2a2412; border-color: #FFD700; }
+.karvan-msg-live { border-left: 2px solid #35d07f; } /* recibido al instante por WebRTC (P2P) */
 .karvan-msg .km-from { display: block; font-size: 10px; color: #FFDD44; margin-bottom: 2px; }
 .karvan-msg .km-text { color: #FFD700; word-break: break-word; }
 .karvan-compose { display: flex; gap: 8px; margin-top: 10px; }

src/client/public/js/karvan.js

@@ -255,6 +255,7 @@
     var pc = peer.pc;
     if (payload.kind === "desc") {
       var desc = payload.desc;
+      if (!desc) return;                 // señal malformada (sin desc) — no reventar el lote de sondeo
       var collision = desc.type === "offer" && (peer.makingOffer || pc.signalingState !== "stable");
       peer.ignoreOffer = !peer.polite && collision;
       if (peer.ignoreOffer) return;

src/models/karvan_model.js

@@ -14,6 +14,8 @@ const MAX_ABS_TTL_MS = 24 * 60 * 60 * 1000;      // nunca más de 24 h
 const MAX_MSGS = 250;                            // anillo: solo los últimos N en RAM
 const MAX_SIGNALS = 500;
 const MAX_ROOMS = 100;
+const MAX_MEMBERS = 50;                          // tope de miembros por sala (evita crecimiento sin límite del Set)
+const MAX_SIGNAL_BYTES = 16384;                  // SDP/ICE son pequeños; rechaza payloads gigantes (anti-DoS de memoria)
 
 module.exports = ({ idleTtlMs = DEFAULT_IDLE_TTL_MS, absTtlMs = DEFAULT_ABS_TTL_MS } = {}) => {
   const rooms = new Map(); // id -> room
@@ -120,7 +122,7 @@ module.exports = ({ idleTtlMs = DEFAULT_IDLE_TTL_MS, absTtlMs = DEFAULT_ABS_TTL_
     };
     room.messages.push(msg);
     if (room.messages.length > MAX_MSGS) room.messages.shift();
-    room.members.add(msg.from);
+    if (room.members.has(msg.from) || room.members.size < MAX_MEMBERS) room.members.add(msg.from);
     resetIdle(room);
     return msg;
   };
@@ -136,6 +138,10 @@ module.exports = ({ idleTtlMs = DEFAULT_IDLE_TTL_MS, absTtlMs = DEFAULT_ABS_TTL_
   const postSignal = (id, { from = "", to = "", payload = null } = {}) => {
     const room = rooms.get(id);
     if (!room) return null;
+    if (payload != null) { // rechaza payloads gigantes (SDP/ICE son pequeños)
+      try { if (JSON.stringify(payload).length > MAX_SIGNAL_BYTES) return null; }
+      catch (e) { return null; }
+    }
     const sig = {
       seq: ++room.sigSeq,
       from: String(from || "").slice(0, 80),
@@ -145,7 +151,7 @@ module.exports = ({ idleTtlMs = DEFAULT_IDLE_TTL_MS, absTtlMs = DEFAULT_ABS_TTL_
     };
     room.signals.push(sig);
     if (room.signals.length > MAX_SIGNALS) room.signals.shift();
-    if (sig.from) room.members.add(sig.from);
+    if (sig.from && (room.members.has(sig.from) || room.members.size < MAX_MEMBERS)) room.members.add(sig.from);
     resetIdle(room);
     return sig;
   };

src/views/karvan_view.js

@@ -17,7 +17,6 @@ const shortId = (id) => {
   id = String(id || "?");
   return id.startsWith("@") ? id.slice(1, 7) : id.slice(0, 6);
 };
-exports.karvanShortId = shortId;
 
 const renderMsg = (m) =>
   li({ class: "karvan-msg", "data-seq": String(m.seq), "data-mid": m.mid || "" },
@@ -31,7 +30,7 @@ const ttlOpt = (val, lbl, checked) =>
     span(lbl)
   );
 
-exports.karvanView = (rooms, params = {}) =>
+exports.karvanView = (rooms) =>
   template(
     i18n.karvanTitle || "Karvan",
     section({ class: "karvan-intro" },

src/views/main_views.js

@@ -1272,33 +1272,6 @@ const renderHiveNav = () => {
 };
 exports.renderHiveNav = renderHiveNav;
 
-// FORK_IA_UX: el hive vive en una HOJA INFERIOR (bottom-sheet) alcanzable con el pulgar; sin JS (checkbox-hack).
-// Un checkbox oculto (#fork-explore-toggle) y la hoja son hermanos dentro de .fork-sheet-wrap (display:contents),
-// así `#fork-explore-toggle:checked ~ .hive-sheet` la despliega; el botón "Explore" de la barra es su <label>.
-const renderHiveSheet = () => {
-  if (process.env.OASIS_MOBILE !== '1') return "";
-  const q = (href, ico, lbl) => a({ class: "hsq-item", href },
-    span({ class: "hsq-ico" }, ico), span({ class: "hsq-lbl" }, lbl));
-  return div({ class: "fork-sheet-wrap" },
-    input({ type: "checkbox", id: "fork-explore-toggle", class: "fork-sheet-toggle" }),
-    div({ class: "hive-sheet" },
-      label({ class: "hive-sheet-backdrop", for: "fork-explore-toggle", "aria-label": "Close" }),
-      div({ class: "hive-sheet-panel" },
-        label({ class: "hive-sheet-grip", for: "fork-explore-toggle", "aria-label": "Close" }),
-        // accesos que no están en el hive (CATS): red y estado
-        div({ class: "hive-sheet-quick" },
-          q("/peers",    "⧖", "Peers"),
-          q("/graphos",  "◈", "Graphos"),
-          q("/inbox",    "☂", "Inbox"),
-          q("/settings", "⚙", "Settings")
-        ),
-        renderHiveNav()
-      )
-    )
-  );
-};
-exports.renderHiveSheet = renderHiveSheet;
-
 const template = (titlePrefix, ...elements) => {
   const currentConfig = getConfig();
   const theme = currentConfig.themes.current || "Dark-SNH";

test/karvan_model.test.js

@@ -151,6 +151,21 @@ async function test(name, fn) {
     assert.ok(m.postMessage(id, { from: "a", text: "hola" }), "se puede postear en la adoptada");
   });
 
+  await test("cap de miembros: no crece más allá de MAX_MEMBERS (50)", () => {
+    const m = makeModel();
+    const r = m.createRoom({});
+    for (let i = 0; i < 80; i++) m.postSignal(r.id, { from: "peer" + i, to: "", payload: { k: "hi" } });
+    const g = m.getSignals(r.id, { forId: "nadie", since: 0 });
+    assert.ok(g.members.length <= 50, "miembros capados a 50, got " + g.members.length);
+  });
+
+  await test("rechaza payload de señal gigante (>16KB), acepta pequeño", () => {
+    const m = makeModel();
+    const r = m.createRoom({});
+    assert.strictEqual(m.postSignal(r.id, { from: "a", to: "b", payload: { blob: "x".repeat(20000) } }), null);
+    assert.ok(m.postSignal(r.id, { from: "a", to: "b", payload: { sdp: "small" } }), "payload pequeño pasa");
+  });
+
   console.log("\n" + passed + " passed, " + failed + " failed");
   process.exit(failed ? 1 : 0);
 })();