docs(consent), test(bounded-body): state the guard's real limit, pin the shape

Two round-3 audit findings, one accepted as a documentation fix and one as a
test-instrument fix.

A local process running as the user can mint its own GUI session — the dashboard
bootstrap is served to any loopback GET — and can equally run `gh api -X PUT
/user/starred/...` without involving the proxy at all. No check inside this
process distinguishes that caller from the browser, because both hold every local
credential. Claiming the endpoint is a technical barrier would be false, so the
route comment and AGENTS.md now say what it actually does: it removes the casual
path and the raw-token path, and the real boundary is the normative rule that an
agent must not spend the user's identity by any mechanism. The unconditional
session requirement stays; it is just no longer described as more than it is.

The bounded-body growth counter caught an exact-fit reallocation mutation but not
the per-chunk `Uint8Array[]` it replaced, because that implementation never
increments the counter at all. The retained-object shape is now pinned
structurally — no per-chunk collection, one geometric buffer — the same
instrument this repository already uses for the relay retention rule. Driven red
by restoring the array accumulator.

Author: lidge-jun

AGENTS.md

@@ -130,6 +130,16 @@ with regression coverage in `tests/startup-prompt.test.ts`,
 another action that spends the user's identity, credits, or reputation, gate it
 the same way rather than relying on a prompt an agent can answer.
 
+**Be clear about what that enforcement is and is not.** The management endpoint
+requires a dashboard session, which stops the casual path — an agent that would
+have POSTed there because the endpoint existed, and one holding only the admin
+token. It is not a technical barrier against a determined local agent: a process
+running as the user can mint its own session from the loopback dashboard
+bootstrap, and can skip the proxy entirely by running `gh` itself. Every local
+credential is equally reachable by both the browser and the agent, so no check
+inside this process can tell them apart. The real boundary is the rule above, and
+it binds you regardless of which mechanism is within reach.
+
 ## Commands
 
 ```bash

src/server/management/sidebar-routes.ts

@@ -47,6 +47,16 @@ function hasBrowserSessionEvidence(ctx: ManagementContext): boolean {
 // and the response names the one-line `gh` command to run by hand. That is the
 // correct trade — an endpoint reachable with a readable token cannot establish that
 // a human chose to spend their own GitHub identity.
+//
+// The honest limit of this guard: a local process running AS THE USER can mint its
+// own GUI session (the dashboard bootstrap is served to any loopback GET) and can
+// equally just run `gh api -X PUT /user/starred/...` itself, which needs no proxy at
+// all. No check inside this process can distinguish that caller from the browser,
+// because both hold every local credential. So this endpoint is not a technical
+// barrier against a determined local agent — it removes the CASUAL path (an agent
+// that would have POSTed here because the endpoint existed) and makes the refusal
+// legible. The actual boundary is normative and lives in AGENTS.md: an agent must
+// not spend the user's identity, whichever mechanism is at hand.
 
 export async function handleSidebarRoutes(ctx: ManagementContext): Promise<Response | null> {
   const { req, url } = ctx;

tests/bounded-body.test.ts

@@ -165,11 +165,10 @@ describe("readBoundedResponseBody", () => {
 		});
 
 		test("retention is logarithmic in the body, not linear in the chunk count", async () => {
-			// The accumulator is the security property, and correctness cannot see it:
-			// a per-chunk array reassembles identically while retaining one object per
-			// transport chunk, which a fragmenting peer inflates far past the payload
-			// ceiling. Growth count is the observable that separates the two — a single
-			// geometric buffer doubles a handful of times regardless of fragmentation.
+			// Growth accounting for the single buffer: it doubles a handful of times no
+			// matter how the peer fragments the body. This catches an exact-fit
+			// reallocation mutation; the per-chunk ARRAY shape is caught structurally in
+			// the test below, because that implementation never touches this counter.
 			const fine = Array.from({ length: 20_000 }, () => new Uint8Array([0x61]));
 			await readBoundedResponseBody(responseFromChunks(...fine), { maxBytes: CUSTOM_CAP });
 			const fineGrowths = boundedBodyBufferGrowthsForTests();
@@ -189,6 +188,25 @@ describe("readBoundedResponseBody", () => {
 			await readBoundedResponseBody(responseFromChunks(...big), { maxBytes: CUSTOM_CAP });
 			expect(boundedBodyBufferGrowthsForTests()).toBeLessThanOrEqual(4);
 		});
+
+		test("the accumulator never retains one object per transport chunk", async () => {
+			// The retained-object shape is the actual security property and no behavioral
+			// assertion can see it: a `Uint8Array[]` of chunks reassembles byte-identically
+			// while holding one reference per chunk, which a fragmenting peer inflates far
+			// past the payload ceiling. It also never increments the growth counter above,
+			// so that test alone cannot catch it. Pin the shape, the same instrument this
+			// repository uses for the relay retention rule and the star-consent guard.
+			const source = (await Bun.file(new URL("../src/lib/bounded-body.ts", import.meta.url)).text())
+				.replace(/\/\*[\s\S]*?\*\//g, "")
+				.replace(/(^|[^:])\/\/.*$/gm, "$1");
+
+			// No per-chunk collection: the reader must accumulate into one buffer.
+			expect(source).not.toMatch(/chunks\s*\.\s*push\s*\(/);
+			expect(source).not.toMatch(/const\s+chunks\s*:\s*Uint8Array\[\]/);
+			// And that buffer must be the geometric one this module documents.
+			expect(source).toMatch(/let\s+retained\s*=\s*new\s+Uint8Array\(/);
+			expect(source).toMatch(/retained\.set\(value,\s*retainedBytes\)/);
+		});
 	});
 
 	test("parent abort rejects with the exact reason object", async () => {