[sotashimozono]

souta's call, made when they corrected what this product is:

注釈機能は ssh-browser 側の機能ではないと思う。それは ssh 先で開発してその機能を見ること。

A site that wants notes should have notes built into it; this daemon's job is to let you see that site working.

What it bought

The daemon has no write path to a remote. Not "writes are restricted to one shape of path" — there is no code that writes.

SFTP requests it can issue :  OPEN  CLOSE  READ  OPENDIR  READDIR  REALPATH
open flags it defines      :  FXF_READ
RemoteFs                   :  no append, no mkdirs

That is checkable by grep rather than promised in a paragraph — the difference worth having in a daemon pointed at somebody's home directory.

The extension lost its only content script, so it no longer runs in, reads from, or modifies the sites it opens. With it went the scripting permission and the http://*/* optional host permission:

	before	after
permissions	proxy storage scripting	proxy storage
optional host permissions	http://*/*	none
bundled JavaScript	~152 KB	~14 KB

There is no permission prompt left in the product. The 138 KB content script was parse work on every single page load.

What left with it

Things that existed only to serve annotations:

• --author and [server] author, which named a log
• Entry.owner and the longname owner parse, which checked one — the numeric uid could never answer that question, and now nothing asks it
• SECURITY.md's two sections on what was written and who a log belonged to, replaced by one stating the read-only property and saying outright that it was bought by dropping a feature
• STORE.md and PRIVACY.md updated, since the permissions they justify have changed

e2e

Four checks went with it. The harness used the content script's registration as its readiness signal; that is now the daemon line naming the port it was asked for — which it already had to check anyway, because on this machine a daemon is usually already running on the default port.

175 tests, 33 e2e checks, two runs clean against a real host.

Breaking

The control API loses two routes and the command line loses a flag, against a published crate. Next release is a minor bump.

Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 89.47368% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/ssh-browser/src/main.rs	0.00%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!