#119 Honor update-trigger events only from local windows; rate-limit page-emitted events

[Anonymous]

Originally created by: kristofferR

The page→backend bridge means any facebook.com script can emit carrier:check-updates, which runs a full updater pass — on macOS: download, DMG install, app.restart(), and possibly an admin-password prompt — with no debounce (lib.rs listener → commands.rs). Minisign verification caps the damage at "forced restart onto a signed build," but update triggers should only be honored from the Settings window and native menu. listen_any carries no event origin, so this needs window-scoped listeners or a token rather than a drop-in check. While here: carrier:notify dedups identical content only, so distinct spoofed content is unlimited — a simple rate limit would help.

[Anonymous]

Ticket changed by: kristofferR

• status: open --> closed

[Anonymous]

Originally posted by: kristofferR

Fixed in [#140]. Page-emitted events can no longer force an updater pass — update discovery runs on Carrier's own schedule (startup + every 4h) with install gated behind explicit Settings consent, and the page-triggered update listener was removed. carrier:notify is also now rate-limited (NotificationRateLimiter), so spoofed distinct content can't flood notifications.