[prk-Jr]

Summary

Allow ts dev proxy to authenticate the browser-facing origin while preserving the browser's original Origin header. This lets trace Enable/End work when the proxy rewrites Host or sends plaintext to its upstream, without forging a trace-specific Origin.

Changes

• Add --forwarder-secret-file. Validate a single secret of at least 32 ASCII graphic bytes before listening, redact diagnostics and mark the outgoing credential header sensitive. Credential injection requires a loopback listener.
• On mapped intercepted requests, validate the actual browser Host or absolute-URI authority, retain its port, and stamp X-Forwarded-Host, X-Forwarded-Proto: https and X-TS-Forwarder-Auth after hop-by-hop sanitation. Conflicting or ambiguous authority is rejected; CONNECT fallback is never authenticated.
• Remove incoming forwarding credentials from initial headers, trailer declarations and actual streaming trailer frames. Preserve benign trailers and streaming behavior.
• Remove route-specific Origin rewriting. All Origin fields retain their original values on trace, publisher and vendor paths.
• Document server provisioning and rollout. Add real wire tests and actual proxy-to-Axum trace/public-URL regressions alongside the existing proxy suite.

Dependency

Requires the server-side authenticated-forwarder support from #1107, now on main: optional [trusted_forwarder] configuration, secret-store resolution and shared public-origin handling.

Configure the server's authentication header as x-ts-forwarder-auth; its shared_secret is a secret-store key, while the CLI file contains the actual matching secret. Deploy the server configuration before using the flag.

Validation

All required local CI gates passed before the final merge with main: all eight lint gates, every adapter suite, parity, JS build/tests and formatting, native build-digest tests/lint, core documentation, native CLI suites and adapter builds including Fastly/Spin release artifacts. The CLI unit, proxy wire and actual proxy-to-server suites pass. Explicit TLS provider setup makes the new shared fixture dependency deterministic; the isolated TLS wire test and serial 111-test proxy unit suite also pass. The actual ts config validate command accepts the forwarder secret-store key reference. The combined regressions use the production Axum HTTP listener behind the real proxy, covering encrypted/plaintext upstreams, rewritten/preserved Host, a public non-default port, Enable/End cookies, rejected Origins/queries/duplicates, missing credentials, server opt-out and transport fallback. Publisher tests check unchanged Origin, stripped credentials, generated public URLs and HTTPS protocol-relative signing.

Independent reviewers checked the CLI implementation, found and verified a streaming trailer credential leak fix, and reviewed the real-server fixture. Server ingress and configured identify CORS are covered by #1107, now on main.

Closes #1250

Spec: docs/superpowers/specs/2026-06-22-ts-dev-proxy-design.md (updated here), plan: docs/superpowers/plans/2026-10-09-authenticated-forwarder.md

The new CodeQL alert #204 was independently reviewed and dismissed as a false positive. SHA-256 only creates temporary fixed-size bearer-token digests for comparison; neither digest is stored or exposed. Operator documentation requires cryptographically random token generation and distinguishes minimum length from entropy. This assessment follows CodeQL's guidance for the distinction between password storage and other hashing uses.

Standalone runtime verification: launched the actual trusted-server-axum server and ts dev proxy binaries, loading server configuration through the normal blob envelope and environment-backed secret store. All 56 live HTTPS requests passed the expected checks across plaintext/TLS upstreams with --rewrite-host on/off. Enable → separate active-state request → publisher document with active trace context → End → separate inactive-state request succeeded with unchanged Secure/HttpOnly/host-only/SameSite=Lax cookies. Public URLs retain browser HTTPS authority and port; protocol-relative signing uses HTTPS; publisher and custom Didomi routes preserve browser Origin and receive no forwarding credentials. Foreign hosts/Origins, duplicate Origin, action queries, nonempty bodies, missing/wrong credentials, and server opt-out reject without cookie mutation. Browser-to-proxy TLS uses the isolated generated CA; the self-signed local upstream TLS relay uses --insecure. An independent subagent audited the response and recorded upstream evidence. This does not establish physical mobile/browser UI or deployed-runtime acceptance.

The standalone run found a TLS-provider startup panic when workspace features enable both providers. The proxy now calls the existing idempotent provider initializer before TLS setup; a fresh-process regression requires a real PAC HTTP response. CI also exposed a redaction-test sentinel collision with a backtrace symbol; the distinct short invalid token retains the complete Report Debug redaction assertion and passes with short/full backtraces.