security(smime): fix finding 5 (parser DoS) and harden finding 4

Finding 5 — the MIME parser runs on attacker-controlled input: the inner
content recovered after decrypt/verify is whatever the sender put there.
Upstream had no depth limit on nested multiparts and no size cap anywhere.

Verified against the unpatched upstream parser with the same input:

  UPSTREAM CRASHED: RangeError - Maximum call stack size exceeded
  UPSTREAM: 65MB accepted (no size cap)

So this was a live decrypt-time DoS reachable by anyone who can send mail.

Caps added: depth 20, parts 500, bytes 64 MB — generous enough that no
legitimate message comes close (real mail nests 3-4 levels). Past a limit a
subtree degrades to a leaf rather than throwing, so one pathological branch
doesn't discard the legitimate parts above it. Oversize input is refused
outright rather than truncated: half a MIME tree parses into misleading
nonsense, and showing part of a message is worse than saying no. Both
bodyStructure walkers in smime-detect.js are capped too — those run on
server-supplied structure BEFORE any decrypt/verify gate.

Finding 4 — hardened, not eliminated, per the agreed scope. Unlocked
CryptoKeys still live in durable IndexedDB rather than memory; moving them
would mean refactoring how the plugin shares state across iframes and
risking the unlock->decrypt path just verified.

What changed instead:

- Removed the lockOnLogout opt-out from the logout/account-switch wipes. A
  non-extractable key cannot be exported but can still be USED, so a handle
  outliving the session lets anyone with the browser profile decrypt mail
  without knowing the passphrase. That is not a preference to toggle off.
- Added a best-effort wipe on pagehide and beforeunload to narrow the window
  in which a usable handle exists on disk. Best-effort by nature: an
  IndexedDB write may not complete during teardown and neither event fires
  on a crash — which is precisely why the boot wipe in activate() remains
  the load-bearing control.
- Deliberately NOT wiping on visibilitychange: tabbing away would drop the
  unlock and force a passphrase re-entry every time, which trains users into
  turning S/MIME off entirely.
- Dropped the now-dead lockOnLogout setting from the manifest. A toggle that
  silently does nothing is worse than no toggle.

Tests: 49 unit assertions + 28 round trip. The round trip now feeds genuinely
hostile MIME through the real parser (5000-level nesting, 5000 siblings,
65 MB) and still confirms a normal multipart/alternative parses correctly.
Full crypto round trip unchanged and passing, so neither fix broke S/MIME.

Findings 6, 7, 8 and 9 remain open.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

vnc/plugins/smime/src/index.js

@@ -1082,12 +1082,17 @@ export const hooks = {
   onComposeSend,
   onRenderEmailBody,
   // Wipe unlocked keys from the shared session store on sign-out / account switch.
+  //
+  // VNC (audit finding 4): the `lockOnLogout` opt-out was removed. Unlocked keys
+  // live in DURABLE IndexedDB, not memory, so this wipe is the only thing that
+  // stops a usable key handle outliving the session on disk. A non-extractable
+  // key can't be exported but can still be USED — anyone with the browser
+  // profile could decrypt mail without ever knowing the passphrase. That is not
+  // a preference to be toggled off.
   async onAfterLogout() {
-    if (settings().lockOnLogout === false) return;
     try { await clearSessionKeys(); } catch (err) { host.log.warn('clearSessionKeys failed', err); }
   },
   async onAccountSwitch() {
-    if (settings().lockOnLogout === false) return;
     try { await clearSessionKeys(); } catch (err) { host.log.warn('clearSessionKeys failed', err); }
   },
 };
@@ -1108,7 +1113,27 @@ export async function activate(api) {
   }
   // Enforce session scope for unlocked keys: wipe any left over from a prior
   // app session at boot (mirrors the native "in-memory, cleared on reload").
+  //
+  // VNC (audit finding 4): this boot wipe is the load-bearing one. Because
+  // unlocked handles sit in durable IndexedDB rather than memory, it is what
+  // guarantees a handle surviving a crash or force-quit is destroyed before
+  // anything can use it.
   try { await clearSessionKeys(); } catch (err) { api.log.warn('S/MIME: clearSessionKeys failed', err); }
+
+  // VNC (audit finding 4): also wipe on the way out, to narrow the window in
+  // which a usable handle exists on disk at all. Best-effort by nature — an
+  // IndexedDB write may not complete during teardown, and neither event fires on
+  // a crash — which is exactly why the boot wipe above still has to exist.
+  //
+  // `pagehide` is used alongside `beforeunload` because Safari and mobile
+  // browsers often skip the latter. Deliberately NOT wiping on
+  // `visibilitychange`: tabbing away would drop the unlock and force a
+  // passphrase re-entry every time, which trains users into turning S/MIME off.
+  const wipeOnExit = () => { try { clearSessionKeys(); } catch { /* teardown, best effort */ } };
+  try {
+    window.addEventListener('pagehide', wipeOnExit);
+    window.addEventListener('beforeunload', wipeOnExit);
+  } catch { /* no window (non-browser test context) */ }
   let keyCount = 0;
   try { keyCount = (await listKeyRecords()).length; } catch (err) { api.log.warn('S/MIME: listKeyRecords failed', err); }
   api.log.info(`S/MIME plugin activated (${keyCount} key${keyCount === 1 ? '' : 's'} imported)`);