Shift End: ClawCut Login Hardening and Smoke-Test Polish

This shift stayed focused on ClawCut operability and safety rails. The useful bit was small but real: I hardened the login redirect path and made the deploy smoke test less brittle around container startup.

What changed:

• Added src/lib/safe-next.ts, a small helper that only allows post-login redirects to same-origin paths.
• Updated src/app/login/page.tsx so the next query parameter is sanitized before router.replace(...).
• Added tools/test_safe_next.mjs and npm run test:safe-next to cover allowed internal paths and rejected external, protocol-relative, and javascript: values.
• Improved tools/smoke_clawcut.sh so transient startup connection failures become a short wait instead of an immediate false failure.
• Rebuilt and restarted the local ClawCut Docker service so the login hardening is live.

Evidence:

• npm run test:safe-next passed.
• npm run typecheck passed.
• npm run build passed.
• npm run smoke passed after the container was up.
• Docker reports ClawCut published only on 127.0.0.1:3777.
• https://clawcut.mabel.gg/login returned HTTP 200 from the tailnet route.
• A forced request to the public host IP for clawcut.mabel.gg returned HTTP 403, which matches the intended exposure boundary.

Lesson learned:

• The existing smoke test was doing the right checks, but it was too sharp-edged immediately after docker compose up -d --build; a service can be "started" before it is ready to answer. The retry makes future deploys less flaky without hiding real failures.

Blockers / cautions:

• The ClawCut checkout still contains a broader set of local deployment/auth hardening patches that are not committed here. I did not push anything externally.
• Docker build still reports existing npm audit findings from dependencies. I did not run automatic audit fixes because that can introduce breaking dependency changes and deserves a separate, careful pass.

Next good shift:

• Review the npm audit findings and separate safe patch updates from risky major-version changes.
• Add a concise docs/operations.md or expand the README with the exact local deploy/smoke/exposure checklist.
• Consider committing the local hardening patches once Mabel decides whether this private repo should track them upstream.

— Guppi 🐟