Every error response carries the security floor: a test walks 400, 401, 403, 404, 405, 413 and 500 #10954

Error responses now carry the security floor on both a page route and an API route for 400, 401, 403, 404, 405, 413 and 500. json() in src/http/respond.ts now passes its response through securityFloor itself. Every responder in that file builds through json(), so a JSON error has the floor before it reaches the server's outer securityFloor. That covers anything carrying a response on a path that skips that wrapper, such as a test calling a handler directly. securityFloor only fills in headers that are missing, so a policy a responder set itself is kept.

The new test, test/security-floor-errors.test.ts:

• Floor on every error: it provokes each status on a page route and an API route, checks the status, and checks that Content-Security-Policy, X-Content-Type-Options and Referrer-Policy are all present. A second test fails if any status/side pair is left out.
• 500 body: the database's query is made to throw an error containing a path, a fake password and SQLITE_IOERR. The 500 body must contain none of these, and no stack frame.
• json() itself: each responder in respond.ts is called directly and must already have the floor. This test fails without the json() change.

Choices and findings:

• Page 405: page routes never answer 405; a wrong method on a page path answers 404, which does carry the floor. The test uses the one page that answers 405, GET /mcp with Accept: text/html, and also checks the 404 case.
• Bun's own 400: after an oversize body, the forge answers 413 and closes the connection. If a client reuses that socket, Bun's parser answers a bare 400 with only a connection header, without ever calling the forge's handler. The forge can't add headers to that response; only the edge can. The test opens a new connection for each request.
• Wrong status on issue create: a body over 16 MiB with no Idempotency-Key is read and answered 422 empty_title instead of 413. The floor is present; only the status is wrong.
• Not done: the issue said not to edit src/http/server.ts, so I didn't. The three findings above are posted on #10949.
• Plan not kept: the keep_plan tool wasn't available in this run, so no plan was kept on the issue.

Checks: bun scripts/gate.ts and bun x tsc --noEmit are clean. scripts/fast.ts named 1650 test files because nearly everything imports respond.ts, so I ran a chosen set instead: the security-floor tests, the tests that import respond.ts, the header-shape tests, and the API, MCP and limits tests. 287 tests passed, none failed.

To try it on the preview: curl -si "$PREVIEW/api/v1/explore?cursor=x" (400) and curl -si -H 'accept: text/html' "$PREVIEW/mcp" (405). Both responses should include all three headers.

🤖 Generated with Claude Code

Closes #10949

Error responses now carry the security floor on both a page route and an API route for 400, 401, 403, 404, 405, 413 and 500. json() in src/http/respond.ts now passes its response through securityFloor itself. Every responder in that file builds through json(), so a JSON error has the floor before it reaches the server's outer securityFloor. That covers anything carrying a response on a path that skips that wrapper, such as a test calling a handler directly. securityFloor only fills in headers that are missing, so a policy a responder set itself is kept.

The new test, test/security-floor-errors.test.ts:

• Floor on every error: it provokes each status on a page route and an API route, checks the status, and checks that Content-Security-Policy, X-Content-Type-Options and Referrer-Policy are all present. A second test fails if any status/side pair is left out.
• 500 body: the database's query is made to throw an error containing a path, a fake password and SQLITE_IOERR. The 500 body must contain none of these, and no stack frame.
• json() itself: each responder in respond.ts is called directly and must already have the floor. This test fails without the json() change.

Choices and findings:

• Page 405: page routes never answer 405; a wrong method on a page path answers 404, which does carry the floor. The test uses the one page that answers 405, GET /mcp with Accept: text/html, and also checks the 404 case.
• Bun's own 400: after an oversize body, the forge answers 413 and closes the connection. If a client reuses that socket, Bun's parser answers a bare 400 with only a connection header, without ever calling the forge's handler. The forge can't add headers to that response; only the edge can. The test opens a new connection for each request.
• Wrong status on issue create: a body over 16 MiB with no Idempotency-Key is read and answered 422 empty_title instead of 413. The floor is present; only the status is wrong.
• Not done: the issue said not to edit src/http/server.ts, so I didn't. The three findings above are posted on #10949.
• Plan not kept: the keep_plan tool wasn't available in this run, so no plan was kept on the issue.

Checks: bun scripts/gate.ts and bun x tsc --noEmit are clean. scripts/fast.ts named 1650 test files because nearly everything imports respond.ts, so I ran a chosen set instead: the security-floor tests, the tests that import respond.ts, the header-shape tests, and the API, MCP and limits tests. 287 tests passed, none failed.

To try it on the preview: curl -si "$PREVIEW/api/v1/explore?cursor=x" (400) and curl -si -H 'accept: text/html' "$PREVIEW/mcp" (405). Both responses should include all three headers.

🤖 Generated with Claude Code

Every error response, on a page or on the API, now carries the security floor (content-security-policy, x-content-type-options and referrer-policy). test/security-floor-errors.test.ts provokes 400, 401, 403, 404, 405, 413 and 500 against a running forge and checks the three headers on each. This push covers sentinel's two review points.

new Response( sites outside JSON answers. A response only reaches a client through a Bun.serve listener, so the proof is made at the listeners rather than at each of the roughly 260 call sites. The new test/security-floor-doors.test.ts:

• Lists every Bun.serve( in src/ with the reason its answers carry the floor, and fails on any listener it doesn't know about.
• Checks each return of the public door and of answered and fails if one isn't floored. failure is checked the same way.
• Asks the running forge for an HTML page, a redirect and plain text, and checks all three carry the floor.
• Calls the internal hook listener and the beat door directly, since neither floored before. Their fetch is now securityFloor(await answerInternal(...)) and securityFloor(await answerBeat(...)).

Hosted children are answered through answered, so they get the same floor. Two places answer requests without a listener (src/tui/screens/api.ts and src/spawn/preview-seed.ts); they never send a response to a client, so they aren't floored.

413 on issue create without an idempotency key. body() used to read an oversize body as {}, so issue create answered 422 for a missing title. It now throws BodyTooLarge, which failure in src/http/server.ts answers 413 too_large, floored. Every route that reads JSON through body() now stops before acting on an oversize body. I checked that no await body( sits inside a try that would swallow the error. The read cap itself was already enforced by readBounded; what was wrong was what happened past it. There is a 413 case without the key next to the one with it, and a test that the oversize create adds no issue.

Checks run:

• Type check and the two floor test files pass.
• scripts/fast.ts named 1844 files, too many to run here, so I ran the 40 test files that cover body caps, 413s, the beat door and the internal hook: 659 pass, 1 fail.
• The failure is in test/guest-contribute.test.ts (the agent attaching by OAuth). It fails the same way without this change, because it reaches maria--forge.test, which the sandbox refuses.
• scripts/design-lint.ts was not run, because src/web/ is untouched.

Try it: curl -si -X POST -H 'content-type: application/json' --data-binary @big.json $PREVIEW/api/v1/repos/<owner>/<repo>/issues with a signed-in cookie and a body past the cap. It answers 413 too_large with the three floor headers.

🤖 Generated with Claude Code

Every error response, on a page or on the API, now carries the security floor: content-security-policy, x-content-type-options and referrer-policy. test/security-floor-errors.test.ts provokes 400, 401, 403, 404, 405, 413 and 500 against a running forge and checks the three headers on each.

What changed in src/:

• Oversize JSON bodies get a 413. body() in src/http/respond.ts now throws BodyTooLarge instead of reading an oversize body as {}. The server's failure answers it 413 too_large, with the floor. Before, an oversize issue create answered 422 for a missing title. No route reads body() inside a try that would swallow the error. Tests cover issue create with and without an Idempotency-Key, and check that no issue is created.
• The internal hook listener and the beat door now floor their answers. Both pass their fetch through securityFloor; neither did before.

Why the floor reaches every new Response(: a response only reaches a client through a Bun.serve listener, so test/security-floor-doors.test.ts proves it at the listeners rather than at each call site:

• It lists every listener in src/ with the reason its answers are floored, and fails on one it doesn't know about.
• It fails if any return of the public door, of answered or of failure isn't floored.
• It asks the running forge for an HTML page, a redirect and plain text and checks all three, then calls the internal listener and the beat door directly.

Hosted children are answered through answered, so they get the same floor.

Tests fixed after the last check: the three failures were not caused by this change. Main had moved, and the check runs against it. On a checkout of main, the first two fail the same way when run together with the third file.

• mcp-write-scope: since #10959, flow only writes with apply: true or the drift update, so the walk's generic arguments only made a plan. It now gets real write arguments, in a separate map so the admin-arguments list still holds only admin tools.
• mcp-system-stalls: a stall is blamed on any request that finished inside its window before a job. A 5 s window picked up requests from earlier files in the same shard. The test now waits past the limit and stalls just over it.
• tui-transfer-repo: this one never failed here, even run five times. It touches no HTTP; it gave up waiting for the palette after 1 s and read the move's result straight after Enter. Both now wait up to 5 s for what they expect.

Checks run: gate, tsc --noEmit, and those six test files pass together after merging main. scripts/fast.ts named 1844 files, too many to run here. In an earlier run of the 40 files covering body caps, 413s, the beat door and the hook listener, only test/guest-contribute.test.ts failed. It fails the same way without this change, because the sandbox refuses the host it calls (maria--forge.test). scripts/design-lint.ts was not run, because src/web/ is untouched.

Try it: curl -si -X POST -H 'content-type: application/json' --data-binary @big.json $PREVIEW/api/v1/repos/<owner>/<repo>/issues, signed in, with a body over the cap. It should answer 413 too_large with the three floor headers.

🤖 Generated with Claude Code

Every error response now carries the security headers: securityFloor from src/http/respond.ts is set on all of them. A JSON body that is too large is refused with 413 before the route runs. A test proves that every listener in src/ sets the security headers on what it answers (#10949).

This update merges main again. Both conflicts were in tests that this branch and main had each fixed for the same flaky failure. The branch's versions are kept because they cover what main meant:

• test/mcp-system-stalls.test.ts: sizes the wait and the stall from LIMIT_MS instead of a hard-coded 300 ms.
• test/mcp-write-scope.test.ts: a WRITE_ARGS table holds the arguments that make flow a real write (the drift update from #10959). main wrote the same thing as an inline special case.

bun scripts/gate.ts and bun x tsc --noEmit are clean, and both merged test files pass (4 tests). scripts/fast.ts named 1851 test files for the merge, about 157 minutes against a 5-minute budget, so only the two merged files were run here; the forge's check runs the full suite on this push.

🤖 Generated with Claude Code

Every error response now carries the security headers: securityFloor from src/http/respond.ts is set on all of them. A JSON body that is too large is refused with 413 before the route runs. A test proves that every listener in src/ sets the security headers on what it answers (#10949).

This update merges main again. Both changes are in tests that this branch and main had each fixed for the same failure:

• test/mcp-system-stalls.test.ts (the conflict): keeps the branch's version, which sizes both the wait and the stall from LIMIT_MS, so the wait always covers the stall's window. main hard-codes a 400 ms wait.
• test/mcp-write-scope.test.ts (merged without a conflict but did not compile): main added the same WRITE_ARGS table for flow's drift update, so the merge declared it twice. main's copy stays and the branch's is removed.

bun scripts/gate.ts and bun x tsc --noEmit are clean, and both test files pass (4 tests). The rest of the suite was not run here; the forge's check runs it on this push.

🤖 Generated with Claude Code

Every error response now carries the security headers: json() in src/http/respond.ts applies securityFloor to every JSON response it builds. A JSON body that is too large is refused with 413 before the route runs. A test proves that every listener in src/ sets the security headers on what it answers (#10949).

This update merges main again, and the conflict in json() combines both sides. main (#10956) added withHint, which puts a hint on 4xx error bodies. This branch wraps the response in securityFloor. json() now adds the hint to the body first, then sets the security headers on the response, so a refused call gets both.

bun scripts/gate.ts and bun x tsc --noEmit are clean. These four test files pass (18 tests): test/security-floor-doors.test.ts, test/security-floor-errors.test.ts, test/mcp-system-stalls.test.ts and main's test/api-hints.test.ts. The rest of the suite was not run here; the forge's check runs it on this push.

🤖 Generated with Claude Code