Three defects found reviewing the forwarding path.
Express matches mount paths case-insensitively, so `/PREVIEW/boot` reaches the
same preview router as `/preview/boot` while a case-sensitive exclusion let it
through — carrying a forged flag set past `requireLensFlag` on routes the auth
gate exempts, on a `--no-auth` server with no token at all. The two questions
now have two predicates: what the auth gate exempts stays an exact match, and
what the flag gate skips is everything Express will route into that subtree.
Skipping an override on a request that still needs a token costs nothing;
exempting one from auth would not.
`Buffer.from(…, "base64")` stops at the padding rather than rejecting what
follows, so `<valid>GARBAGE` — and the comma-joined string Node builds from a
duplicated header — decoded to the first payload, were acknowledged, and
applied. The header value is now shape-checked before it is decoded.
A forwarded `__proto__` is dropped, because the flags.json reader assigns onto
a plain object where that key hits the prototype setter and stores nothing. The
claimed disk/wire parity was false for exactly that name; a test now asserts it
against the real reader instead of restating it.
`argent link` also warns about an unacknowledged probe when no flags are set.
An empty set is the strongest assertion in this protocol — it turns every
flag-gated tool off — so a server that ignores it serves tools the CLI just
said would be hidden. The earlier asymmetry had it backwards.
Two prose fixes for claims this feature falsified: `requireLensFlag` no longer
tracks the tool gate (it reads this machine's flags by design), and `argent
enable` rejects a flag only a newer linked server knows, which its error
message now says.
Ignacy Łątka
81ab110e8b