An app's undeclared hosts, the list to copy into forge.json, speak the home page's language #9992

The #app-egress note on the app page (src/web/studio/egress.ts) used to be a boxed card. It is now a section.settings-block under the heading <h2>Reached, not declared</h2>. It has one sentence saying what this means for the current egress mode, one row per host (host:port, how many times it was reached, and the last day), and then the "egress": [...] line to copy into forge.json. Each host name is still escaped by html. The call site in src/web/studio/app.ts is unchanged, so only the app's writers see the note.

The new test/app-egress-language.test.ts fails on main and passes with this change. It checks:

• Writers: a writer sees the block with no card, two rows and the snippet.
• Readers: a signed-in reader and a signed-out visitor see nothing.
• Enforce mode: the block says the hosts "are refused now".
• Nothing to show: no block when nothing was reached or everything has since been declared.
• Escaping: a host named <img src=x> renders as text.

The gate, tsc --noEmit and bun scripts/design-lint.ts pass. The 37 test files scripts/fast.ts named, plus test/tui-deploys-egress.test.ts, gave 420 passing, 36 skipped (the unix-socket and cell suites, which this sandbox skips) and 0 failing.

Not done:

• Hiding the note in enforce mode. The issue says the note shows only while egress is reported. On main it also shows after enforcement, saying those hosts are refused now. I kept that because then the app is actually failing and the snippet is the fix, and I added a test for it rather than one proving it is hidden. If it should disappear under enforcement, that is a one-line if (mode === "enforce") return null.
• The issue's plan. It asks for a plan kept with the keep_plan tool, but that tool was not available in this run, so no plan was posted on the issue.

To try it: as an app's writer, with cells.egress set to report and some undeclared host reached, open /<owner>/<repo>/app.

🤖 Generated with Claude Code

Closes #9971

The #app-egress note on the app page (src/web/studio/egress.ts) used to be a boxed card. It is now a section.settings-block under the heading <h2>Reached, not declared</h2>. It has one sentence saying what this means for the current egress mode, one row per host (host:port, how many times it was reached, and the last day), and then the "egress": [...] line to copy into forge.json. Each host name is still escaped by html. The call site in src/web/studio/app.ts is unchanged, so only the app's writers see the note.

The new test/app-egress-language.test.ts fails on main and passes with this change. It checks:

• Writers: a writer sees the block with no card, two rows and the snippet.
• Readers: a signed-in reader and a signed-out visitor see nothing.
• Enforce mode: the block says the hosts "are refused now".
• Nothing to show: no block when nothing was reached or everything has since been declared.
• Escaping: a host named <img src=x> renders as text.

The gate, tsc --noEmit and bun scripts/design-lint.ts pass. The 37 test files scripts/fast.ts named, plus test/tui-deploys-egress.test.ts, gave 420 passing, 36 skipped (the unix-socket and cell suites, which this sandbox skips) and 0 failing.

Not done:

• Hiding the note in enforce mode. The issue says the note shows only while egress is reported. On main it also shows after enforcement, saying those hosts are refused now. I kept that because then the app is actually failing and the snippet is the fix, and I added a test for it rather than one proving it is hidden. If it should disappear under enforcement, that is a one-line if (mode === "enforce") return null.
• The issue's plan. It asks for a plan kept with the keep_plan tool, but that tool was not available in this run, so no plan was posted on the issue.

To try it: as an app's writer, with cells.egress set to report and some undeclared host reached, open /<owner>/<repo>/app.

🤖 Generated with Claude Code

The undeclared-hosts note on the app page (#app-egress, src/web/studio/egress.ts) used to be a boxed card. It is now a section.settings-block headed <h2>Reached, not declared</h2>, with:

• one sentence saying what this means under the current egress mode,
• one row per host (host:port, how many times it was reached, and the last day),
• the "egress": [...] line to copy into forge.json.

Each host name is still escaped by html. The call site in src/web/studio/app.ts is unchanged, so only the app's writers see the note.

Tests. The new test/app-egress-language.test.ts fails on main and passes with the change. It checks:

• Writers: a writer sees the block with no card, two rows and the snippet.
• Readers: a signed-in reader and a signed-out visitor see nothing.
• Enforce mode: the block says the hosts "are refused now".
• Nothing to show: there is no block when nothing was reached, or when every reached host has since been declared.
• Escaping: a host named <img src=x> renders as text.

bun scripts/gate.ts, bun x tsc --noEmit and bun scripts/design-lint.ts pass. The 37 test files that scripts/fast.ts named, plus test/tui-deploys-egress.test.ts, gave 420 passed, 36 skipped and 0 failed. The skipped ones are the unix-socket and cell suites, which this sandbox cannot run.

Not done. The issue says the note shows only while egress is reported. On main it also shows after enforcement, saying the hosts are refused now. I kept that, because by then the app is failing and the snippet is the fix, and I added a test for it instead. If the note should disappear once egress is enforced, add if (mode === "enforce") return null to egressNote. The issue also asks for a plan kept with the keep_plan tool; that tool was not available in this run, so no plan was posted on the issue.

Try: as the app's writer, with cells.egress set to report and a host the app reached without declaring it, open /<owner>/<repo>/app on the preview and read the "Reached, not declared" block. That line is now in a commit message, so the gate's "say how to try it on the preview" rule is met.

🤖 Generated with Claude Code

The undeclared-hosts note on the app page (#app-egress) is now a section.settings-block headed "Reached, not declared", instead of a boxed card. It shows:

• one sentence on what this means while egress is only reported,
• one row per host (host:port, how many times it was reached, the last day),
• the "egress": [...] line to copy into forge.json.

Each host name is escaped by html. Only the app's writers see the note, and only while egress is reported. Under enforce mode, egressNote returns null, as the issue asks.

What to look at:

• src/web/studio/egress.ts: the new block markup, and if (mode === "enforce") return null. The sentence is now always the reported wording.
• test/app-egress-language.test.ts (new): fails on main, passes here. It checks:

- a writer sees the block with no card, two rows, the copyable snippet and the reported sentence; - a signed-in reader and a signed-out visitor see nothing; - egressNote(..., "enforce") is null, and with cells.egress=enforce the page drops the block for a writer too; - there is no block when nothing was reached, or when every reached host has since been declared; - a host named <img src=x> renders as text.

• test/contain.test.ts: I changed this test. Its "egress, reported" case called egressNote without a mode, so it got the default from the environment, which is enforce. It now passes "report", which is what its title says it tests. The code was right; the test relied on a default that no longer shows the note.

The gate, tsc --noEmit and bun scripts/design-lint.ts pass. The 37 test files that scripts/fast.ts named passed: 417 tests, 0 failures. The previous push went out with the test/contain.test.ts failure; the latest commit fixes it.

Try: as the app's writer, with cells.egress=report and a host the app reached without declaring it, open /<owner>/<repo>/app on the preview and read the "Reached, not declared" block. Set cells.egress=enforce and the block is gone.

🤖 Generated with Claude Code