[dskvr]

Problem and result

Kehto's Firewall was effectively a rate limiter. This change makes Firewall the shared approval policy for NAP interfaces, scoped resources, scoped network destinations, and registered future categories. Rate limiting is an independent runtime budget. A manifest/interface grant no longer confers unrestricted resource or network access.

The runtime now coordinates prompts, trusted principals, lifetimes, pending-work bounds, persistence, revocation, cancellation, and request revalidation. Service handlers keep protocol validation and authorize the actual side effect or destination. Paja admits frames before executing bytes, shows the shared grant UI, and retires the exact source on revocation. Paja supports reviewed development origins through an exact closed CSP. The old Paja firewall simulation controls are rejected because they could not enforce these approvals.

Coverage and release

The change includes package/app consumers, NAP conformance guards, unit and real Chromium regression tests, package/host documentation, compatibility records, and changesets for shipped Firewall, runtime, shell, Paja, and services output.

• pnpm build and pnpm type-check passed.
• pnpm test:unit: 207 files, 2,625 tests passed.
• KEHTO_HARNESS_PORT=43173 pnpm test:e2e: 133 Chromium tests passed. An unrelated local process occupied the default harness port.
• pnpm docs:check, pnpm changeset status, git diff --check, and npx --yes aislop@0.12.0 scan -d passed; AI-slop score 100/100.

Protocol authority and bounded gaps

Checked the exact NIP-5D draft PR #2303 head 5560820fa4f37f45b8ab742a11aeb3001b17dc67; NAP-SHELL master 19de5ce1cea40cd4c76089cdd8126e9f87648049; NAP-RESOURCE PR #80 ae5b9c64ab8a4d8909f288829a01e99d6bd713bc; NAP-LINK PR #53 50a2cd45e76f06e87b87e93842badf4c61f17bde; NAP-CONNECT PR #19 ec81a3a4a1fc4da1ad2601215353b7f822e44b8f; NAP-NOTIFY PR #11 67877ef6c31ec8acee3125c1d8b4c781010e37dc; and NAP-CVM PR #52 b1ecaa529971ade6d5bc806bc0a990db0dc2356f. Other service refs and the consumer matrix are recorded in .planning/research/firewall-approvals.md.

The NIP-5D/NAP admission and service wire behavior is conformant to those checked refs. Kehto's directive-specific development CSP and approval UI are bounded host policy where the drafts do not prescribe one.

Review focus

Please examine exact principal binding and source retirement, once/session/persistent grant behavior, resource redirect and selected relay authorization, and CSP source matching. The browser tests cover required/optional admission, grant revocation, and approved and blocked network effects.

CI timeout follow-up

The isolation test completed its assertions but hung in HTTP fixture teardown on Node 20. Chromium can retain a speculative TCP connection without sending an HTTP request; server.close() then waits indefinitely. The fixture now stops listening and closes all remaining connections explicitly. CSP and network-denial assertions are unchanged.

Reproduced the original 90-second timeout on Node 20.20.2. The fix passed nine focused browser runs with tracing and all 133 Chromium tests under Node 20.20.2 (2.5 minutes, harness port 43373). Build, type-check, 2,625 unit tests, docs, diff checks, and pinned AI-slop 100/100 passed. Rechecked NIP-5D 5560820fa4f37f45b8ab742a11aeb3001b17dc67 and NAP-RESOURCE ae5b9c64ab8a4d8909f288829a01e99d6bd713bc; behavior remains conformant. This test-only fix changes no shipped package output.

The branch also incorporates main 47b2f1c8 to clear merge conflicts that prevented CI from starting. Conflict resolution preserves the released Paja catalog notifications, controller/title/FS diagnostics, and upload lifetime fixes alongside Firewall ownership. Upload cancellation exceptions cannot interrupt sibling cleanup; upstream upload regressions now wait for prepared uploads and preserve the unowned-status denial. New FS browser fixtures declare optional FS and use the shared session-approval driver. NAP-FS was checked at bd1b9e912f05203bf38f7a1b04f920744fe6d625, NAP-UPLOAD at f5cc981e527e2cc1572793a7a6e5082e5271ac49, and NAP-INTENT at 19de5ce1cea40cd4c76089cdd8126e9f87648049; behavior remains conformant.

Combined validation: build, type-check, 2,637 unit tests, docs, changesets, and AI-slop 100/100 passed. The complete 141-test Chromium run under Node 20.20.2 with CI settings passed (140 passed directly; one playground profile-loading test passed on its second retry). Earlier local runs encountered other playground page-load timeouts; no assertions or timeout thresholds were weakened.

Merging main again (playground retirement)

This merge brings in main at 1758524e, which clears the conflicts. Main retired @kehto/playground, so every playground edit on this branch is gone, along with the playground parts of this PR's description, docs, and tests. Earlier test counts above come from before this merge.

The rest needed real porting, not just conflict picking:

• NAP-MEDIA: main rewrote the service, so the session approval moved onto the new registry. media.command is now approved too, since it's a napplet-to-shell effect on shell-owned sessions.
• openStream: it relied on the origin-grant options this PR retired. It now goes through the same resource and network approvals as atomic requests.
• Scoped Paja services: the runtime plans relay work without handleMessage, so publishes were skipping main's window-scoped service and losing their source context. Planning and revocation now reach it.
• Media bytes: playback expected a Blob from resource.bytes, but this PR's wire carries base64, so playback now decodes it.
• Smaller moves: the nested-context lock goes through admitBrowserDocument, and LLM denials and onCapabilityRevoked moved into the extracted modules.

A heads up on test fixtures: main's specs relied on undeclared domains, and each declared domain costs a prompt per load against the 12-per-minute budget, so they now declare only what they use. A signer change reloads the frame and asks again, which could get noisy for real apps that declare many domains. Might be worth a look.

Checked NAP-MEDIA PR #10 at 7806f438 for media.command direction and the policy end reason, and it's conformant. NAP-LLM at 3e10939 only got a read of its consent text; main has since moved its docs to 5e93bdf, and I didn't review that draft separately. NIP-5D draft #2303 has moved to c041f846; I didn't re-chase it here, so the refs above still stand.

Verification: pnpm build, pnpm type-check, 2,786 unit tests, and pnpm docs:check pass. All 122 Chromium tests pass with 1 skipped under CI=1; an earlier run had two tests pass only on retry, and they didn't recur in the final run. That was local Node, not a re-run on 20.20.2.

Known gaps:

• AI-slop is 99/100. The one warning is installPajaLlmPanel length, unchanged from main.
• createLlmService keeps NAP-LLM host consent and doesn't call authorizeOperation, so LLM generation isn't under the shared per-operation approval.
• This merge doesn't address the open review findings from nrahulpub, and I didn't re-verify them against this head.

Merging main again (NAP-LLM chase)

This also brings in main at 8490d72c. The conflicts were only STATE.md and the NAP-LLM ref line in two READMEs, so no code needed porting. After this merge: build, type-check, docs, and 2,855 unit tests pass, and Chromium is 124 passed with 1 skipped under CI=1, with no retries needed. AI-slop stays at 99/100 with the same installPajaLlmPanel warning, in a file that matches main. The tool-use work main added also stays on NAP-LLM host consent, not the shared per-operation approval.

Merging main again (host firewall controls from #404)

This brings in main at 6eb1ea4f. Only three files conflicted, but #404 needed more than a merge, because most of it acts on the legacy gate and that gate never runs once permissions is set.

• Budget setters (runtime: setters for the firewall unfocusedMultiplier and burst guard #400): firewallState.setUnfocusedMultiplier and setBurstGuard did nothing on a configured host. There's now runtime.permissions.setRateLimit(config), plus rateLimit to read the current budget.
• Budget validation: it now accepts what runtime: setters for the firewall unfocusedMultiplier and burst guard #400 shipped: a multiplier above 1, and a zero burst.windowMs or burst.maxOperations. It's also checked when the budget is set. Before, a bad budget would've failed every operation closed at charge time.
• Hooks (shell: forward getFocusContext, onFirewallEvent and firewallPersistence through ShellAdapter #397): getFocusContext already worked and now has a test through the shell. onFirewallEvent and firewallPersistence stay legacy-only, since the permission path deliberately keeps payloads out of its diagnostics.
• FW-RUNTIME-LEGACY-IGNORED-001: this warns once per runtime when those hooks or a firewallState mutator are used on a configured host. It's in the compatibility register, and it retires with FW-RUNTIME-LEGACY-GATE-001.
• aclDefaultPolicy (runtime: let the host choose the ACL default policy #398): it needed no code. It's a ceiling: admission can still approve an interface, but an operation the ACL denies is refused with no prompt until the host grants the capability. That's now tested and documented.
• filterNappletMessage (shell: pre-dispatch hook for port traffic (onNappletMessage is observe-only) #399): it also needed no code. Held envelopes meet approvals and budgets at release. A revoked grant prompts again, and a retired source runs nothing.

A couple of things you might want to weigh in on:

• aclDefaultPolicy: 'restrictive' means a user can approve an interface at admission and then see every operation refused, with no prompt to explain it. It matches "nothing granted", but is that what we want, or should admission refuse sooner?
• setRateLimit takes a whole config rather than mirroring runtime: setters for the firewall unfocusedMultiplier and burst guard #400's two setters, so hosts spread rateLimit to change one field. Either works if you'd prefer the two names.

Checked NAP-SHELL at napplet/naps@43cb3a4 (still master) for shell.ready and session binding, and it's conformant. No wire behavior changes here. I didn't re-chase the NIP-5D draft or the other refs above.

Verification: pnpm build, pnpm type-check, 2,952 unit tests, and pnpm docs:check pass. Chromium is 124 passed with 1 skipped under CI=1, with no retries. That was local Node, not 20.20.2. AI-slop stays at 99/100 with the same installPajaLlmPanel warning.

Known gaps:

• A configured host gets no event when a stored deny grant refuses something. onRateLimit only covers budgets, so this part of shell: forward getFocusContext, onFirewallEvent and firewallPersistence through ShellAdapter #397's "show the user what was refused" isn't carried over.
• The new budgets only use focused, so msSinceFocusGain from getFocusContext is ignored on configured hosts.
• Paja and the e2e harness don't set filterNappletMessage, so the filter on a configured host is proven by unit tests, not in a browser.
• nrahulpub's open review findings aren't re-verified against this head.

🤖 Generated with Claude Code

[nrahulpub]

Note: This is just a slop review after I understood it on a high level. I haven't had the bandwidth to fully wrap my head around it. Day job :/.

I will do it asap.

[dskvr]

@nrahulpub had some useful bits in it still

[dskvr]

Thanks for the thorough pass. Addressed the numbered findings and actionable low items, including the main conflicts. The follow-up also covers cancellation/cleanup and duplicate or stale terminal replies.

Two qualifications:

• For [hyprgate] Track: @napplet/vite-plugin Vite 8 compatibility — Phase 2 smoke test pending #6, CONFIG snapshots/schema ACKs and INC channel listings have mandatory replies but no throttling-error contract. They remain diagnostic-only, so repeated CONFIG schema registration can still validate/persist values. Other enforceable operations are limited and cleanup stays available. Fully throttling those mandatory calls needs an upstream denial/backpressure contract; this residual gap is documented.
• CSP: Chromium 152 permits the default HTTP→HTTPS port upgrade, but rejects that upgrade on the same non-default port. Added browser regressions and disclosed portable CSP scheme matching in the prompt/docs.

Keeping the planning records here so the assessment and verification remain with the implementation.

Validation: 2,733 unit tests, 159 Chromium tests, build/type-check/docs/changesets/diff checks, and pinned AI-slop 100/100. Checked NAP-RELAY 9f30b350, OUTBOX 8865f73d, RESOURCE ae5b9c64, THEME/IDENTITY/INC/SHELL 19de5ce1, STORAGE 4f4cf0ca, CONFIG bed9cb5b, and NIP-5D 5560820f. Changed wire behavior is conformant; temporal budgets and CSP matching remain documented host policy.

Pushed 4a75cd03 and requested another review.