A note from the app's own origin is a visitor's unless it carries the forge panel's one-use proof #5743

A note from an app's own origin is now a visitor's unless it carries the forge panel's one-use proof. The four test files pass (74 tests). I could not type-check here: bun x tsc --noEmit fails with "Cannot find type definition file for 'bun'" because the repo has no @types/bun installed. The forge's check will be the first real type check.

• Minting: when a signed-in person loads a page, the panel's script tag gets data-proof, a random 24-byte token. It is bound to a hash of the grant cookie and the host, and it lasts 24 hours. A document load or a cross-site iframe gets one; a same-origin fetch or a same-origin frame gets none. The page then answers cache-control: private, no-store. This is in src/apps/proxy.ts and src/apps/toolbar.ts.
• Spending: POST /__forge/note and GET /__forge/notes spend the token from the x-forge-proof request header. With a valid one, the note is @name, the list is theirs and admin can be true. With none, or with a reused, foreign-grant or foreign-host token, the grant is ignored: the sender is visitor-…, admin is false, and a private app or sealed preview answers 404. Every answer to a valid proof, including errors, carries the next token in x-forge-proof. This is in src/apps/feedback.ts.
• Panel: the script reads the tag's token and removes the attribute. All its note calls go one at a time through a single call() that sends the current token and keeps the next one. The token is never in a URL.
• Tests: a new case in test/apps-feedback.test.ts covers all five behaviours from the issue, run through the real proxy with a stub app behind it. Unproven is a visitor, proven is @alice, and the reused, foreign-grant and foreign-host tokens are visitors. Same-origin fetch and same-origin iframe loads get no token, while document and cross-site iframe loads do. A second test checks the panel script strips the tag and sends the header.
• Existing tests changed: two tests used a signed-in cookie alone (the sealed-preview note and the private-app note), so they now take a proof first. The two fetch( counts in test/toolbar-actions.test.ts and test/apps-crew-pill.test.ts went from 3 to 2, because the note calls now share one fetch. The toolbar-actions assertion now checks call("/__forge/note".

I chose not to do these:

• Tokens live in memory, capped at 20,000 with the oldest dropped first. A restart makes everyone a visitor until their next page load.
• The app's own script can read the token from the tag before the panel strips it, if it runs earlier. That is inside the threat model you described.
• The panel is still an external script from the forge origin, as before; I did not add a nonce.

To try it, sign in, open an app, send a note from the panel, and the note shows as @you. The same request made with fetch from the page's console, without the header, shows as visitor-….

Closes #5612

A note from an app's own origin is now a visitor's unless it carries the forge panel's one-use proof. The four test files pass (74 tests). I could not type-check here: bun x tsc --noEmit fails with "Cannot find type definition file for 'bun'" because the repo has no @types/bun installed. The forge's check will be the first real type check.

• Minting: when a signed-in person loads a page, the panel's script tag gets data-proof, a random 24-byte token. It is bound to a hash of the grant cookie and the host, and it lasts 24 hours. A document load or a cross-site iframe gets one; a same-origin fetch or a same-origin frame gets none. The page then answers cache-control: private, no-store. This is in src/apps/proxy.ts and src/apps/toolbar.ts.
• Spending: POST /__forge/note and GET /__forge/notes spend the token from the x-forge-proof request header. With a valid one, the note is @name, the list is theirs and admin can be true. With none, or with a reused, foreign-grant or foreign-host token, the grant is ignored: the sender is visitor-…, admin is false, and a private app or sealed preview answers 404. Every answer to a valid proof, including errors, carries the next token in x-forge-proof. This is in src/apps/feedback.ts.
• Panel: the script reads the tag's token and removes the attribute. All its note calls go one at a time through a single call() that sends the current token and keeps the next one. The token is never in a URL.
• Tests: a new case in test/apps-feedback.test.ts covers all five behaviours from the issue, run through the real proxy with a stub app behind it. Unproven is a visitor, proven is @alice, and the reused, foreign-grant and foreign-host tokens are visitors. Same-origin fetch and same-origin iframe loads get no token, while document and cross-site iframe loads do. A second test checks the panel script strips the tag and sends the header.
• Existing tests changed: two tests used a signed-in cookie alone (the sealed-preview note and the private-app note), so they now take a proof first. The two fetch( counts in test/toolbar-actions.test.ts and test/apps-crew-pill.test.ts went from 3 to 2, because the note calls now share one fetch. The toolbar-actions assertion now checks call("/__forge/note".

I chose not to do these:

• Tokens live in memory, capped at 20,000 with the oldest dropped first. A restart makes everyone a visitor until their next page load.
• The app's own script can read the token from the tag before the panel strips it, if it runs earlier. That is inside the threat model you described.
• The panel is still an external script from the forge origin, as before; I did not add a nonce.

To try it, sign in, open an app, send a note from the panel, and the note shows as @you. The same request made with fetch from the page's console, without the header, shows as visitor-….

A note from an app's own origin is now a visitor's unless it carries a one-use proof that the forge puts on the panel's script tag. The first push failed the check on a leftover expect(toolbarJs).x; in test/apps-feedback.test.ts. I replaced it with a real assertion that the panel script removes its data-proof attribute. bun x tsc --noEmit is now clean, and apps-feedback, toolbar-actions, apps-crew-pill and apps-toolbar pass (74 tests).

• Minting: when the forge serves a signed-in person's page load (a document load, no Sec-Fetch-Dest, or a cross-site iframe), the panel's script tag gets data-proof. The token is bound to the grant cookie and the host, lasts 24 hours, and is never put in a URL. The page answers cache-control: private, no-store, and the panel strips the attribute on load. A same-origin fetch or same-origin frame gets no token.
• Spending: POST /__forge/note and GET /__forge/notes spend the token from the x-forge-proof request header. A valid token gives @name, the person's own list, and admin when they can administer the repo. A missing, reused, foreign-grant or foreign-host token makes the sender a visitor-… with the visitor's list and admin false. On a private app or sealed preview that means a 404. Every answer to a valid proof carries the next token in x-forge-proof.
• Panel: its note calls now go one at a time through a single call(), which sends the current token and keeps the next one.
• Tests: a new case in test/apps-feedback.test.ts covers unproven, proven, reused, foreign-grant, foreign-host and the same-origin page fetch. I did not run the new case with the change removed to confirm it fails without it. The sealed-preview and private-app notes tests now take a proof first. The two fetch( counts in test/toolbar-actions.test.ts and test/apps-crew-pill.test.ts went from 3 to 2, and toolbar-actions now checks call("/__forge/note".

I chose not to do these:

• Tokens live in memory, capped at 20,000, oldest dropped first. A restart makes everyone a visitor until their next page load.
• The app's own script can read the token from the tag if it runs before the panel strips it.
• The panel is still an external script from the forge origin; I did not add a CSP nonce.

To try it, sign in and open an app. A note sent from the panel shows as @you; the same request via fetch from the console without x-forge-proof shows as visitor-….

This pull does not fully stop app code that runs in the same page. I did not build the fix @juniper asked for, and the pull now says so. The type check and the four toolbar and feedback test files pass (76 tests). The forge's check on this push has not come back yet.

What it stops: app code that only holds the grant cookie, such as a fetch from the page, is now a visitor. So is app code that replays a spent or guessed token.

What it does not stop: app code that runs in the same page and watches for the script tag (a MutationObserver) or patches window.fetch before the panel runs. The token reaches the panel through the page, so that code can read it. I also could not make the panel use a pristine fetch, because app scripts in <head> run before the panel does. Closing this needs the panel in a cross-origin frame, which I judged too large for this pull. The README states the limit.

Other review points:

• Chain breaks (src/apps/toolbar.ts): if a call fails, or an answer to a call that sent a token comes back without the next one, the panel clears its token. It tells the person "Reload this page to send as yourself; until then notes go as a visitor." The wording is PROOF_LOST in src/apps/note_words.ts.
• Hostile-code test (test/apps-feedback.test.ts): a new test has the panel spend the page's token. It then shows that a copy of that token, a guessed token and an empty one each give a visitor with no next token, while the chain's real next token still gives @alice. A second new test checks the panel script contains the reload message.
• Run without the change: I put the base versions of feedback.ts, proxy.ts and toolbar.ts back and ran the earlier committed tests. Two failed: the unproven/proven/reused case and the panel-strips-the-token test. The two tests added in this round were not part of that run.
• Comment wrap: the long comment in test/apps-crew-pill.test.ts is now wrapped.

The earlier points still hold:

• Tokens live in memory, capped at 20,000, oldest dropped first.
• A restart makes everyone a visitor until their next page load.
• No CSP nonce was added.