Strangers cannot exhaust the forge: anonymous clones, code search and streams are rate-limited and capped #2948

Anonymous callers are now limited per address and across the whole forge at every expensive door. While strangers hold their full share of transfers, a signed-in push still lands. test/strangers.test.ts covers each door. That file, the type check and 27 related test files pass locally (445 tests in all), and the agents.test.ts backpressure tests also pass. The full gate was not run here.

What changed

• src/http/strangers.ts (new): limits for requests with no session and no token, kept separately per forge. Each door has a per-minute limit per address (an IPv6 /64) and one for all strangers together, and anything held open is counted until it ends. A refusal is a 429 with Retry-After.

- API reads: 600 a minute per address, 6000 for all strangers. Applied in answerGet and switched off by FORGE_RATE_LIMIT=0. Before this, only tokens were limited. - Clones and fetches (info/refs and upload-pack): 60 a minute per address. At most 4 in flight per address, and strangers together hold at most half of transferGate, so pushes and signed-in clones keep the rest. A stranger's transfer is killed after 300 s instead of 600 s. The limit is checked after access is decided, so a private repo still answers with the 401 challenge. - Code search (kind=code or all, API and /search page): 10 a minute per address, and only one stranger's search at a time. One search uses at most 4 of the 8 git plumbing slots, so the other half stays free for pushes, page renders and agents. When refused, the API answers 429; the page shows everything except code and says why. - Event streams: eventStream now takes the app and counts every stream: 8 open per stranger address, 256 for all strangers, 4096 for anyone. Because every stream route goes through it, none can skip the cap. - Spawn plans (anonymous POST /api/v1/forges or the new-forge form): 10 a minute per address, 60 for all strangers, checked in spawnDoor.

• src/git/smart-http.ts: an upload-pack request body that sends nothing for 30 s ends the fetch and gives its slot back. This applies to everyone, not only strangers, because a fetch's negotiation is sent all at once.
• Refused clones: the 429 closes the connection and stops reading the body, so a client sending an endless body still gets its answer.
• src/kernel/fresh.ts (new): a short-lived cache. When many requests arrive at once while a value is being built, they all wait on the same build. Used for /og/audit.svg (45 s) and /sitemap.xml (60 s per origin, at most 4 origins).
• HEAD requests: the unread response body is now cancelled, so a HEAD to /events no longer leaves a stream (and its slot) open forever.

Test changes: in test/system-stream.test.ts and test/agents.test.ts, the direct eventStream calls now pass an app ({} as App) because the signature changed. The tests themselves were not wrong.

Not done:

• /healthz is not limited. It is a select 1, and refusing a health probe would turn load into a restart.
• Anonymous page renders have no general rate limit; only their code-search part is limited.
• The limits are constants. setStrangerLimits changes them per forge (the tests use it), but there are no environment variables or settings page for them.

To try it: bun test test/strangers.test.ts. By hand, send repeated anonymous curl -H 'x-forwarded-for: 203.0.113.9' $BASE/api/v1/repos requests to see the 429. The limits are written up in docs/ARCHITECTURE.md (concurrency invariant 7) and docs/THREATS.md.

🤖 Generated with Claude Code

Closes #2920

Anonymous callers are now limited per address and across the whole forge at every expensive door. While strangers hold their full share of transfers, a signed-in push still lands. test/strangers.test.ts covers each door. That file, the type check and 27 related test files pass locally (445 tests in all), and the agents.test.ts backpressure tests also pass. The full gate was not run here.

What changed

• src/http/strangers.ts (new): limits for requests with no session and no token, kept separately per forge. Each door has a per-minute limit per address (an IPv6 /64) and one for all strangers together, and anything held open is counted until it ends. A refusal is a 429 with Retry-After.

- API reads: 600 a minute per address, 6000 for all strangers. Applied in answerGet and switched off by FORGE_RATE_LIMIT=0. Before this, only tokens were limited. - Clones and fetches (info/refs and upload-pack): 60 a minute per address. At most 4 in flight per address, and strangers together hold at most half of transferGate, so pushes and signed-in clones keep the rest. A stranger's transfer is killed after 300 s instead of 600 s. The limit is checked after access is decided, so a private repo still answers with the 401 challenge. - Code search (kind=code or all, API and /search page): 10 a minute per address, and only one stranger's search at a time. One search uses at most 4 of the 8 git plumbing slots, so the other half stays free for pushes, page renders and agents. When refused, the API answers 429; the page shows everything except code and says why. - Event streams: eventStream now takes the app and counts every stream: 8 open per stranger address, 256 for all strangers, 4096 for anyone. Because every stream route goes through it, none can skip the cap. - Spawn plans (anonymous POST /api/v1/forges or the new-forge form): 10 a minute per address, 60 for all strangers, checked in spawnDoor.

• src/git/smart-http.ts: an upload-pack request body that sends nothing for 30 s ends the fetch and gives its slot back. This applies to everyone, not only strangers, because a fetch's negotiation is sent all at once.
• Refused clones: the 429 closes the connection and stops reading the body, so a client sending an endless body still gets its answer.
• src/kernel/fresh.ts (new): a short-lived cache. When many requests arrive at once while a value is being built, they all wait on the same build. Used for /og/audit.svg (45 s) and /sitemap.xml (60 s per origin, at most 4 origins).
• HEAD requests: the unread response body is now cancelled, so a HEAD to /events no longer leaves a stream (and its slot) open forever.

Test changes: in test/system-stream.test.ts and test/agents.test.ts, the direct eventStream calls now pass an app ({} as App) because the signature changed. The tests themselves were not wrong.

Not done:

• /healthz is not limited. It is a select 1, and refusing a health probe would turn load into a restart.
• Anonymous page renders have no general rate limit; only their code-search part is limited.
• The limits are constants. setStrangerLimits changes them per forge (the tests use it), but there are no environment variables or settings page for them.

To try it: bun test test/strangers.test.ts. By hand, send repeated anonymous curl -H 'x-forwarded-for: 203.0.113.9' $BASE/api/v1/repos requests to see the 429. The limits are written up in docs/ARCHITECTURE.md (concurrency invariant 7) and docs/THREATS.md.

🤖 Generated with Claude Code

Anonymous callers ("strangers": no session, no token) are now limited at every door that costs the forge something. Each door is counted per client address (an IPv6 /64) and for all strangers together, and a refusal is a 429 with Retry-After (src/http/strangers.ts):

• API reads: 600 a minute per address, 6000 for all.
• Clones and fetches: 60 a minute. At most 4 transfers at once per address, and strangers together hold at most half the transfer pool, so a push always gets a permit. A stranger's transfer is killed after 300 s, and a negotiation that sends nothing for 30 s ends.
• Code search: 10 a minute, and only one stranger's search runs at a time. Refused, the page answers with everything except code and says so.
• Event streams: 8 open per address, 256 for all strangers, 4096 for anyone.
• Spawn plans: 10 a minute.

The audit card and the sitemap are now built at most once a minute (src/kernel/fresh.ts). /healthz is never limited.

This round, from review:

• Terminal guests: a guest (any unknown SSH key) searching from the palette now takes the same code-search limit, counted under its SSH peer address. forgeSearch in src/tui/forge.ts calls the new guestCodeSearch, which is built on a new takeDoorAt that takes an address bucket instead of a Request. The hold is released in a finally. When refused, the search runs without code and the palette shows one muted "Code was not searched" row with the reason and retry time.
• Same rule on both doors: the page's find now has the API's cleanQuery(query) !== "" condition. In practice the page already cleans q and returns its empty page before find runs, and cleanQuery removes no stop-words, so a blank query on the page never took the slot. The condition makes both doors state the same rule, and the new page test guards that early return rather than catching a bug.
• Docs: invariant 7 in docs/ARCHITECTURE.md and docs/THREATS.md now name the terminal guest search. The earlier THREATS edit had separated the anonymous-spawn bullet from its spawn-anon test line; that is fixed, and the stranger bullet now points at test/strangers.test.ts.

Tests: the new case in test/strangers.test.ts builds a guest Session and runs its palette search:

• with the slot free, it returns code rows;
• while another stranger holds the slot, it returns no code rows, shows the "not searched" row, and still returns repo results;
• once its own minute is spent, it is refused;
• a blank query takes nothing.

With the gate removed from forgeSearch, this test fails. The type check passes, and the strangers, system-stream, palette, outsider-tty, search, tui-app and guests suites pass.

Not done: the terminal's other guest screens (repo browse, issue lists) are left uncounted. They read SQLite and do not run git grep.

To try it: while another stranger holds the code slot, sign in over SSH with an unregistered key, open the palette and search a word that is in a public repo. Code results are replaced by the muted "Code was not searched" row.

🤖 Generated with Claude Code

Anonymous callers ("strangers": no session, no token) are now limited at every door that costs the forge something. Each door is counted per client address (an IPv6 /64) and for all strangers together, and a refusal is a 429 with Retry-After (src/http/strangers.ts):

• API reads: 600 a minute per address, 6000 for all.
• Clones and fetches: 60 a minute. At most 4 transfers at once per address, and strangers together hold at most half the transfer pool, so a push always gets a permit. A stranger's transfer is killed after 300 s, and a negotiation that sends nothing for 30 s ends.
• Code search: 10 a minute, and only one stranger's search runs at a time. This covers the page, the API and the terminal's guest palette; the palette is counted under its SSH peer address. Refused, the page and the palette answer with everything except code and say so.
• Event streams: 8 open per address, 256 for all strangers, 4096 for anyone. A HEAD now cancels the body of the GET it stands for, so a HEAD to /events gives its stream slot back straight away.
• Spawn plans: 10 a minute.

The audit card is built at most once every 45 s and the sitemap's rows at most once a minute (src/kernel/fresh.ts). /healthz is never limited.

This round, from review:

• New tests: test/strangers.test.ts adds a stranger's HEAD to /events, which must bring the held stream count back to 0, and an audit card fetched, then a new public app, then fetched again, which must give the same SVG. Each test fails with its code removed: the cancel() in answer(), and the audit card's Fresh.
• Sitemap: the sitemap now caches its rows (escaped repository paths, with no origin) under a single key and adds the request's origin to each answer. When FORGE_URL is set, publicUrl already fixes the origin, so Host could not rotate the key there. Without it, Host could rotate the key, and now it cannot make the forge read the rows again. This differs a little from the suggested fix (keying on the configured origin) because it also covers a forge with no FORGE_URL. The sitemap test now also fetches under another Host: it gets its own origin on the cached rows, and that check fails against the old per-origin key.
• heldNow comment: it now says it is for tests only.

Checks: the type check passes, and the strangers, og-designs, system-stream, standards, forge-looks and design-audit suites pass.

Not done: the terminal's other guest screens (repository browse, issue lists) are not counted. They read SQLite and do not run git grep.

To try it: while another stranger is running a code search, open /search?q=… signed out. Code is left out and the page says so. A HEAD to /events returns at once and does not keep a stream slot.

🤖 Generated with Claude Code