The release smoke check reads a sign-in redirect as sign-in, 302 or 303 alike #2684

The release smoke check now treats an anonymous /board redirect to sign-in as sign-in whether it is a 302, 303 or 307. Before, it accepted only a 302, so the edge's 303 → /_plat/login?rd=%2Fboard made it call 0.7.169 unproven on the owner's home.

What changed: src/release/smoke.ts gains isSignInRedirect(url, res). A response counts as sign-in when:

• its status is 302, 303 or 307,
• its Location, resolved against the /board URL, is on the same origin,
• and its path is the forge's own /signin or the edge's /_plat/login. These are the two places signInFirst sends people (src/web/chrome.ts).

Any other target still fails. That includes another host, other paths like /signin/parent, and a 301. The failure message now reads "expected 200 (or a redirect to sign-in)". As before, this applies only to anonymousBoard callers holding no token, which means the forge proving itself (src/release/prove.ts). scripts/smoke.ts and token-holding callers behave as before.

What to look at: I chose to require the same origin. The edge's sign-in lives on the forge's own host (src/http/edge.ts), so a redirect to another host is not taken as sign-in.

Tests: test/smoke.test.ts adds:

• the pass cases: a 302 and a 303 to /signin, a 303 to an absolute /_plat/login URL (the production case), and a 307;
• the fail cases: a 303 to /elsewhere, to another host, and to /signin/parent, plus a 301;
• unit checks on isSignInRedirect.

The existing tests pass unchanged, as do test/release-boot.test.ts and test/src-imports.test.ts. I could not run bun x tsc --noEmit here: node_modules has no TypeScript, and bun install fails because the sandbox's tempdir is read-only. The forge's check runs the type check.

How to try it: bun test test/smoke.test.ts. On the forge, the 0.7.169 card should clear on the next proof.

🤖 Generated with Claude Code

Closes #2673

The release smoke check now treats an anonymous /board redirect to sign-in as sign-in whether it is a 302, 303 or 307. Before, it accepted only a 302, so the edge's 303 → /_plat/login?rd=%2Fboard made it call 0.7.169 unproven on the owner's home.

What changed: src/release/smoke.ts gains isSignInRedirect(url, res). A response counts as sign-in when:

• its status is 302, 303 or 307,
• its Location, resolved against the /board URL, is on the same origin,
• and its path is the forge's own /signin or the edge's /_plat/login. These are the two places signInFirst sends people (src/web/chrome.ts).

Any other target still fails. That includes another host, other paths like /signin/parent, and a 301. The failure message now reads "expected 200 (or a redirect to sign-in)". As before, this applies only to anonymousBoard callers holding no token, which means the forge proving itself (src/release/prove.ts). scripts/smoke.ts and token-holding callers behave as before.

What to look at: I chose to require the same origin. The edge's sign-in lives on the forge's own host (src/http/edge.ts), so a redirect to another host is not taken as sign-in.

Tests: test/smoke.test.ts adds:

• the pass cases: a 302 and a 303 to /signin, a 303 to an absolute /_plat/login URL (the production case), and a 307;
• the fail cases: a 303 to /elsewhere, to another host, and to /signin/parent, plus a 301;
• unit checks on isSignInRedirect.

The existing tests pass unchanged, as do test/release-boot.test.ts and test/src-imports.test.ts. I could not run bun x tsc --noEmit here: node_modules has no TypeScript, and bun install fails because the sandbox's tempdir is read-only. The forge's check runs the type check.

How to try it: bun test test/smoke.test.ts. On the forge, the 0.7.169 card should clear on the next proof.

🤖 Generated with Claude Code