A forge link says when it ends and its sender revokes it in one tap #10830

A sender can now revoke an open forge link and undo it within a minute. A revoked or expired link shows a plain "This link has ended" page with status 410 and sets no session.

The new test/claim-revoke.test.ts and the MCP size and table tests pass, and bun x tsc --noEmit is clean. I ran the related forges*, mcp*, spawn-api, spawn-events and audience tests; the only two failures were the ones fixed below. I did not run the full suite. scripts/fast.ts called the diff too broad to name its tests.

What changed

• Link state: src/spawn/claim.ts stores a revoked timestamp (r) inside the existing claim setting. The link's secret is untouched and never logged.

- revokeClaim and restoreClaim flip that timestamp. A restore only works within 60 seconds of the revoke, while the link is unspent and still in date. - linkStateIn reads a child's state (open, used or ended) without writing to it.

• Revoke action: changeClaim in src/actions/spawn.ts is admin-only and same-origin checked. It writes a forge.claim_revoked or forge.claim_restored event whose payload holds only the forge name.
• Sent-links list: /forges shows a state badge on each row, plus a Revoke button when the link is open.

- Revoke and Undo go through POST /forges/:name/revoke-link and /undo-link, and the confirmation page carries the Undo button.

• MCP: claim_link takes action: "revoke" | "undo" instead of a new tool. docs/MCP.md is regenerated, and no ceiling was raised.
• Claim page: a revoked link answers 410 with "This link has ended". Expired links keep their existing page.

Tests

• test/claim-revoke.test.ts covers revoke-then-use (410 on both /claim/options and /claim, no set-cookie) and use-then-revoke (refused). It also checks that a cross-origin revoke is refused, and that undo works and the receipts omit the secret.
• I added link: null to hand-built rows in test/forges-attention.test.ts and test/tui-forges.test.ts, so they type-check with the new ClientRow.link field.
• test/mcp-forge-view.test.ts read only the first page of tools/list. My action enum pushed forge_view onto page two. That test was wrong, so it now follows nextCursor.

Not done: a revoked link cannot be revived after the minute; send a fresh link instead. There is no new MCP tool.

To try: open /forges as an admin and press Revoke beside an open link. Open the link in another browser to see the 410 page, then press Undo within a minute.

Closes #10725

A sender can now revoke an open forge link and undo it within a minute. A revoked or expired link shows a plain "This link has ended" page with status 410 and sets no session.

The new test/claim-revoke.test.ts and the MCP size and table tests pass, and bun x tsc --noEmit is clean. I ran the related forges*, mcp*, spawn-api, spawn-events and audience tests; the only two failures were the ones fixed below. I did not run the full suite. scripts/fast.ts called the diff too broad to name its tests.

What changed

• Link state: src/spawn/claim.ts stores a revoked timestamp (r) inside the existing claim setting. The link's secret is untouched and never logged.

- revokeClaim and restoreClaim flip that timestamp. A restore only works within 60 seconds of the revoke, while the link is unspent and still in date. - linkStateIn reads a child's state (open, used or ended) without writing to it.

• Revoke action: changeClaim in src/actions/spawn.ts is admin-only and same-origin checked. It writes a forge.claim_revoked or forge.claim_restored event whose payload holds only the forge name.
• Sent-links list: /forges shows a state badge on each row, plus a Revoke button when the link is open.

- Revoke and Undo go through POST /forges/:name/revoke-link and /undo-link, and the confirmation page carries the Undo button.

• MCP: claim_link takes action: "revoke" | "undo" instead of a new tool. docs/MCP.md is regenerated, and no ceiling was raised.
• Claim page: a revoked link answers 410 with "This link has ended". Expired links keep their existing page.

Tests

• test/claim-revoke.test.ts covers revoke-then-use (410 on both /claim/options and /claim, no set-cookie) and use-then-revoke (refused). It also checks that a cross-origin revoke is refused, and that undo works and the receipts omit the secret.
• I added link: null to hand-built rows in test/forges-attention.test.ts and test/tui-forges.test.ts, so they type-check with the new ClientRow.link field.
• test/mcp-forge-view.test.ts read only the first page of tools/list. My action enum pushed forge_view onto page two. That test was wrong, so it now follows nextCursor.

Not done: a revoked link cannot be revived after the minute; send a fresh link instead. There is no new MCP tool.

To try: open /forges as an admin and press Revoke beside an open link. Open the link in another browser to see the 410 page, then press Undo within a minute.

A forge link now says when it ends, and its sender can revoke it in one tap and undo it for the first minute. This round adds the terminal door, an Undo on the row, a cheaper /forges render and the missing tests.

The tests I ran pass: claim-revoke, tui-forges, mcp-forge-view, mcp-tools, mcp-table, client-list, forges-* and the spawn and claim suites. tsc and bun scripts/gate.ts are clean. I did not run the whole suite; the forge's check does that.

Changes, in the order of the review

1. Terminal. The forges screen in src/tui/screens/forges.ts gains l (end a link) and u (undo one), admin only. Each row says link open or link ended, undo with u. Page, MCP and terminal all go through one changeLink in src/spawn/manage.ts, which src/spawn/door.ts wraps with the admin and same-origin checks. The how-to is docs/features/forge-link-revoke.md.
2. Tests in test/claim-revoke.test.ts and test/tui-forges.test.ts:

- Undo is refused at 61 s and allowed at 59 s. - A link that expired cannot be revoked or brought back, and neither can a used one. - On the web routes, a member and a guest get 404, a cross-origin post is refused, the revoke redirect shows the receipt, and the row offers Undo. - The MCP revoke/undo and the terminal's changeLink are covered.

1. Undo on the row. An ended link revoked less than 60 s ago shows Undo on /forges, so it survives leaving the page. LinkInfo now carries revokedAt and undoable() decides.
2. Performance. clientRows no longer opens any child database. The child's /api/v1/forge answer now includes link, only for the parent's secret, and the list reads it from the cached probe it already makes. A revoke or undo drops that cache entry, so the next list asks again. A child running older code reports no link and shows no Revoke button.
3. Tidy. The duplicate sqlite import is gone and a single swap replaces the two UPDATE statements. restoreClaim no longer uses found ?? {}. changeClaim is removed from src/actions/spawn.ts.
4. MCP budget. I shortened the claim_link description and the schema, so forge_view stays on page one. I reverted the mcp-forge-view test to its original form. The margin was under 20 bytes, so the next tool added will hit it again.
5. Post-revoke page. It is replaced by a 303 back to /forges?link=revoked&forge=<name>, with an inline receipt. The receipt is fixed words and only appears for a forge in the list.

Not changed: any admin can revoke any child's link, not just its spawner. This matches re-issuing a link, which is already any admin's, so I left it. Say if you want it restricted to the spawner.

To try it: as an admin, open /forges and press Revoke on a forge with an open link. Undo sits beside the row for a minute. In the terminal, open Forges you sent and press l, then u. Over MCP, call claim_link with {name, action: "revoke"} or "undo".