Harden reviewer trust, fetch egress, and narrow sidebars

[NotASithLord]

Summary

• fence saved-App search results and re-check reviewer grants against the live read-only policy at dispatch
• inspect fetch_url header names, header values, and request bodies for off-origin exfiltration while preserving same-origin and ordinary-request behavior
• make the Firefox-width sidebar deliberate: visible authority controls, named top-bar actions, and stale model-option response protection
• add a live engine-tab forgery probe for P0-2 remainder: per-run MessagePorts, and actor/abort takes a runId from any first-party sender #308 item 1, whose exact service-worker sender pin is already present on current main

Regression and red-team coverage

• expands the generated red-team report from 148 to 152 hostile probes: persistent saved-App prompt injection, header/body exfiltration, and actor-command replay
• adds unit coverage for stale reviewer grants, App result fencing, malformed/cyclic request shapes, array-shaped headers, and the model picker’s A → B → A request race
• adds browser-level sender-forgery and narrow-sidebar states, including eight viewport widths, native Tab order, accessibility-tree names, hit targets, overflow, and light/dark renders

Verification

• adversarial review swarm: all three scoped reviews clean after two stale comments were corrected
• bun test ./tests: 5,083 passed
• bun run red-team: 11/11 scenarios, 152/152 hostile probes blocked
• in-browser suite: 791 passed
• bun run e2e:verify: 50 states, 202/202 checks
• lint, strict typecheck, and diff checks clean
• packaged preview verified in Firefox 153 at a real 310×900 sidebar viewport; controls and surrounding states rendered without horizontal overflow

Closes #236
Closes #270
Closes #335
Relates #308

[github-actions]

The UI renders differently than the committed baselines — 18 of 46 screens changed (before ⟶ after below).

Empty chat — idle-unlocked · up to 7.68% changed

dark — 7.68% of pixels (before ⟶ after)

light — 6.61% of pixels (before ⟶ after)

Completed turn — completed-turn · up to 1.61% changed

dark — 1.61% of pixels (before ⟶ after)

light — 1.61% of pixels (before ⟶ after)

Plan mode — mode-plan · up to 1.61% changed

dark — 1.61% of pixels (before ⟶ after)

light — 1.60% of pixels (before ⟶ after)

Goal running — goal-running · up to 1.83% changed

dark — 1.83% of pixels (before ⟶ after)

light — 1.70% of pixels (before ⟶ after)

Failed turn — error-turn · up to 1.61% changed

dark — 1.61% of pixels (before ⟶ after)

light — 1.61% of pixels (before ⟶ after)

Multi-turn — multi-turn-transcript · up to 1.61% changed

dark — 1.61% of pixels (before ⟶ after)

light — 1.61% of pixels (before ⟶ after)

Thinking — busy-thinking · up to 1.61% changed

dark — 1.61% of pixels (before ⟶ after)

light — 1.61% of pixels (before ⟶ after)

Chats — sessions-list · up to 1.06% changed

dark — 1.06% of pixels (before ⟶ after)

light — 1.06% of pixels (before ⟶ after)

Tool call — tool-card-expanded · up to 1.61% changed

dark — 1.61% of pixels (before ⟶ after)

light — 1.61% of pixels (before ⟶ after)

_{Full-res before/after/diff PNGs: download the visual-diff-… artifact.}

_{Intended? Re-run this workflow on the branch with update_visual_baselines checked, then commit the fresh baselines/linux-x64/ and regenerate GALLERY.md with bun run gallery.}

[github-actions]

Visual regression

✅ No visual drift. Every state renders identically to the committed baselines.

📸 Browse the visual gallery — 46 baseline screens (light + dark) as of this commit.