A child forge's look of its own app ends on the browser's error page while the app answers 200 from outside #11651

A child forge's look of a private app should no longer end on the browser's error page. That cause is inferred from the code, not reproduced: the sandbox cannot run Chromium or a cell. I could not confirm it against probe-qzkd.

Cause. A forge whose public address is https marks the app's grant cookie Secure (proxySecure in src/apps/proxy.ts, from #6117). The look's browser opens the app over plain http on the forge's own listener, and Chrome drops a Secure cookie set over http. The app then saw nobody and sent the browser to sign in at https://<child forge>/apps/open. A cell can't reach that host, so the browser showed an error page. A forge with open network lands on its sign-in page and gets "left the app's host" instead.

What changed

• src/apps/proxy.ts: new plainProof(dataDir, token), an HMAC only this forge can mint. When the grant door sees a valid proof on an http request, it sets the grant cookie without Secure. Any other link, including one with a forged proof, still gets Secure.
• src/looks/service.ts: the look's URL now comes from a new exported lookUrl() that adds the proof.
• src/looks/capture.ts: the failure now leads with the code, as net::ERR_X: the browser showed an error page instead of the app. The code was already kept to 100 characters; it was the display that cut it off, so putting it first keeps it visible.

Test. test/look-secure-grant.test.ts builds a forge whose public address is https, with a private app. It follows the look's URL the way Chrome would, dropping Secure cookies from http.

• With the look's own link it stays on the app's host.
• With a bare grant link, or one with a forged proof, it is sent to the public host.

The loopback-only look test (test/look-loopback-only.test.ts) is unchanged and was not run here (no network namespace in this sandbox).

Checks.

• bun x tsc --noEmit is clean.
• bun scripts/gate.ts printed nothing I could read; I did not capture its exit status.
• look-secure-grant, look-refusal, cookie-flags, apps-adversarial-grants and private-app pass.
• Three real-Chromium cases in test/looks.test.ts fail here, the same three with and without my change, because Chromium can't start in this sandbox. They need the forge's check.

Not done. I did not test a look inside a real cell, so the acceptance test uses the same cookie rule rather than a literal cell. The follow-up cookie refresh on later requests still sets Secure on an http request. The browser ignores it and keeps the cookie it already has.

To try. Deploy to a child forge (https public URL) and watch for "no picture" lines on a private app. If one still appears, it now carries the full net:: code to diagnose from.

Closes #11519

A child forge's look of a private app should no longer end on the browser's error page. That cause is inferred from the code, not reproduced: the sandbox cannot run Chromium or a cell. I could not confirm it against probe-qzkd.

Cause. A forge whose public address is https marks the app's grant cookie Secure (proxySecure in src/apps/proxy.ts, from #6117). The look's browser opens the app over plain http on the forge's own listener, and Chrome drops a Secure cookie set over http. The app then saw nobody and sent the browser to sign in at https://<child forge>/apps/open. A cell can't reach that host, so the browser showed an error page. A forge with open network lands on its sign-in page and gets "left the app's host" instead.

What changed

• src/apps/proxy.ts: new plainProof(dataDir, token), an HMAC only this forge can mint. When the grant door sees a valid proof on an http request, it sets the grant cookie without Secure. Any other link, including one with a forged proof, still gets Secure.
• src/looks/service.ts: the look's URL now comes from a new exported lookUrl() that adds the proof.
• src/looks/capture.ts: the failure now leads with the code, as net::ERR_X: the browser showed an error page instead of the app. The code was already kept to 100 characters; it was the display that cut it off, so putting it first keeps it visible.

Test. test/look-secure-grant.test.ts builds a forge whose public address is https, with a private app. It follows the look's URL the way Chrome would, dropping Secure cookies from http.

• With the look's own link it stays on the app's host.
• With a bare grant link, or one with a forged proof, it is sent to the public host.

The loopback-only look test (test/look-loopback-only.test.ts) is unchanged and was not run here (no network namespace in this sandbox).

Checks.

• bun x tsc --noEmit is clean.
• bun scripts/gate.ts printed nothing I could read; I did not capture its exit status.
• look-secure-grant, look-refusal, cookie-flags, apps-adversarial-grants and private-app pass.
• Three real-Chromium cases in test/looks.test.ts fail here, the same three with and without my change, because Chromium can't start in this sandbox. They need the forge's check.

Not done. I did not test a look inside a real cell, so the acceptance test uses the same cookie rule rather than a literal cell. The follow-up cookie refresh on later requests still sets Secure on an http request. The browser ignores it and keeps the cookie it already has.

To try. Deploy to a child forge (https public URL) and watch for "no picture" lines on a private app. If one still appears, it now carries the full net:: code to diagnose from.

The reordered failure message in src/looks/capture.ts is now pinned by a test, which was the one change @sentinel asked for.

I added a test to test/look-refusal.test.ts. It checks that refusal(HOST, "net::ERR_X", "chrome-error://chromewebdata/") starts with net::ERR_X: the browser showed an error page. It also checks that a 200-character net:: code is cut to 100 characters before : the browser showed.

I ran bun test test/look-refusal.test.ts (6 pass) and bun x tsc --noEmit (clean). I did not run bun scripts/gate.ts or any other tests this round, since only the test file changed.

The rest of the pull is as before:

• Cookie fix: the look browser's grant link carries the forge's proof, an HMAC bound to the token. That lets a forge on http hand its look browser a cookie it keeps. Any other link still gets Secure.
• Failure message: the net:: code now leads it.
• Scope: I made no other changes and added no dependencies.

To try it, open a child forge's look on an http forge. The look should show the app, not the browser's error page.

🤖 Generated with Claude Code