Sensitive posts: Popular leaves them out. The NSFW posts Adam saw (and blocked) in Popular were Misskey artists over the mostr bridge — every one carried a content-warning tag (Misskey's "sensitive" media), and their profiles said so too (":role_nsfw:", "🔞成人向け"); the posts had no words to fail the language test, and nothing read the tag. Popular (and its picture/video grids) now drops a post marked sensitive (NIP-36 content-warning, a NIP-32 content-warning/nsfw label, an NSFW hashtag, :nsfw: or 🔞 in the text) and the posts of accounts whose own name or bio says they post adult work. Everywhere else a marked post is folded behind its warning ("Sensitive: <reason>") with Show, and left out of media grids — Settings → Nostr → "Fold posts marked sensitive" (on by default). On the live snapshot: 6 of 184 posts dropped. tools/sensitive-feed-test.js

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Vps2H27rhbG9ZqseGfMrc3

1 files changed, 102 insertions, 0 deletions

diff --git a/tools/sensitive-feed-test.js b/tools/sensitive-feed-test.js
new file mode 100644
index 0000000..a050269
--- /dev/null
+++ b/tools/sensitive-feed-test.js
@@ -0,0 +1,102 @@
+// Sensitive posts: Popular (everyone's public feed) leaves out posts their
+// authors marked with a content warning (NIP-36 — what a Misskey artist's
+// "sensitive" media becomes over mostr), NSFW-tagged posts, and posts from
+// accounts whose own profile says they post adult work. Elsewhere a marked
+// post is folded behind its warning with a Show.
+// Run: bun tools/sensitive-feed-test.js
+import puppeteer from './puppeteer.js';
+import { cacheKeyFor } from '../src/wallet.js';
+import { finalizeEvent, generateSecretKey, getPublicKey } from 'nostr-tools/pure';
+import { buildHtml, buildVerifyWorker } from '../build.js';
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+let ok = true;
+const check = (n, c, d = '') => { console.log(` ${c ? '✓' : '✗'} ${n}${d ? ' — ' + d : ''}`); if (!c) ok = false; };
+const key = () => { const sk = generateSecretKey(); return { sk, pk: getPublicKey(sk) }; };
+const A = key(), ART = key(), B = key();
+const now = Math.floor(Date.now() / 1000);
+const post = (who, text, ago, tags = []) => finalizeEvent({ kind: 1, created_at: now - ago, tags, content: text }, who.sk);
+const SAFE = post(A, 'This is a perfectly ordinary post about the weather and the bitcoin price today', 100);
+const CW = post(A, 'This post was marked sensitive by its author for everyone to see', 200, [['content-warning', 'spoilers']]);
+const TAGGED = post(B, 'This post carries the nsfw hashtag and should not be in the public feed', 300, [['t', 'nsfw']]);
+const ARTIST = post(ART, 'This is a drawing I made for the autumn campaign please enjoy it', 400);
+const SAFE2 = post(B, 'Another ordinary post that everybody should see in the public feed', 500);
+const PROFILES = [
+  finalizeEvent({ kind: 0, created_at: now, tags: [], content: JSON.stringify({ name: 'Plain Person' }) }, A.sk),
+  finalizeEvent({ kind: 0, created_at: now, tags: [], content: JSON.stringify({ name: 'Artist', about: 'I draw things :role_nsfw: so please be 18 or older' }) }, ART.sk),
+  finalizeEvent({ kind: 0, created_at: now, tags: [], content: JSON.stringify({ name: 'Other Person' }) }, B.sk),
+];
+const html = await buildHtml({ minify: true, pwa: false });
+const worker = await buildVerifyWorker({ minify: true });
+const server = Bun.serve({ port: 0, fetch(req) {
+  const path = new URL(req.url).pathname;
+  if (path === '/api/feed') return Response.json({ version: 1, generatedAt: Date.now(), popUntil: now - 1000, notes: [SAFE, CW, TAGGED, ARTIST, SAFE2], profiles: PROFILES });
+  if (path === '/verify-worker.js') return new Response(worker, { headers: { 'Content-Type': 'text/javascript' } });
+  return new Response(html, { headers: { 'Content-Type': 'text/html' } });
+} });
+const browser = await puppeteer.launch({ executablePath: '/usr/bin/google-chrome', headless: 'new', args: ['--no-sandbox'] });
+const shim = () => {
+  const Real = window.WebSocket;
+  window.WebSocket = function (...a) {
+    const ws = new Real(...a);
+    const send = ws.send.bind(ws);
+    ws.send = (data) => {
+      try { const m = JSON.parse(data); if (m[0] === 'REQ') { setTimeout(() => ws.dispatchEvent(new MessageEvent('message', { data: JSON.stringify(['EOSE', m[1]]) })), 0); return; } if (m[0] === 'EVENT') return; } catch {}
+      return send(data);
+    };
+    return ws;
+  };
+  window.WebSocket.prototype = Real.prototype; Object.assign(window.WebSocket, Real);
+};
+const errs = [];
+try {
+  console.log('\n[Popular]');
+  let page = await browser.newPage();
+  page.on('pageerror', (e) => errs.push(String(e)));
+  await page.evaluateOnNewDocument(shim);
+  await page.goto(server.url.origin + '/feed');
+  await page.waitForFunction(() => document.body.innerText.includes('perfectly ordinary post'), { timeout: 15000 }).catch(() => {});
+  await sleep(1500);
+  let text = await page.evaluate(() => document.body.innerText);
+  check('ordinary posts are there', text.includes('perfectly ordinary post') && text.includes('Another ordinary post'));
+  check('a post marked sensitive is left out', !text.includes('marked sensitive by its author'));
+  check('...and an #nsfw one', !text.includes('carries the nsfw hashtag'));
+  check('...and one from an account whose profile says adult content', !text.includes('a drawing I made'));
+  await page.close();
+
+  console.log('\n[a followed person\'s marked post]');
+  page = await browser.newPage();
+  page.on('pageerror', (e) => errs.push(String(e)));
+  await page.evaluateOnNewDocument(shim);
+  await page.setViewport({ width: 390, height: 844 });
+  await page.goto(server.url.origin + '/', { waitUntil: 'domcontentloaded' });
+  await page.evaluate(() => localStorage.setItem('btc-wallet-network', 'regtest'));
+  await page.reload({ waitUntil: 'domcontentloaded' });
+  await sleep(400);
+  const click = (t) => page.evaluate((x) => { const e = [...document.querySelectorAll('button')].find((n) => n.textContent.trim().toLowerCase().includes(x)); if (e) { e.click(); return true; } return false; }, t);
+  await click('create a new wallet'); await sleep(600);
+  await page.waitForSelector('.words .w .t');
+  const mn = (await page.$$eval('.words .w .t', (l) => l.map((e) => e.textContent.trim()))).join(' ');
+  await click('skip verification');
+  await page.waitForFunction(() => /receive/i.test(document.body.innerText), { timeout: 20000 });
+  await sleep(3000); // the starter follows land first
+  const base = cacheKeyFor(mn + '\n');
+  await page.evaluate(([k, pk, ns]) => {
+    localStorage.setItem(k + ':follows', JSON.stringify({ tags: [['p', pk]], c: '', at: Math.floor(Date.now() / 1000) }));
+    localStorage.setItem(k + ':feedNotes', JSON.stringify(ns));
+    localStorage.setItem(k + ':profiles', JSON.stringify({ [pk]: { name: 'Plain Person', t: Date.now() } }));
+    localStorage.setItem('btc-wallet-feed:' + k, 'following');
+  }, [base, A.pk, [SAFE, CW]]);
+  await page.reload({ waitUntil: 'domcontentloaded' });
+  await page.waitForFunction(() => /receive/i.test(document.body.innerText), { timeout: 20000 });
+  await page.evaluate(() => document.querySelector('.app-nav-button[aria-label="Feed"]').click());
+  await page.waitForFunction(() => document.body.innerText.includes('perfectly ordinary post'), { timeout: 15000 }).catch(() => {});
+  await sleep(800);
+  text = await page.evaluate(() => document.body.innerText);
+  check('the marked post is folded behind its warning', text.includes('Sensitive: spoilers') && !text.includes('marked sensitive by its author'), (text.match(/Sensitive[^\n]*/) || [''])[0]);
+  await page.evaluate(() => [...document.querySelectorAll('.note-folded button')].find((b) => /show/i.test(b.textContent)).click());
+  await sleep(400);
+  check('Show opens it', (await page.evaluate(() => document.body.innerText)).includes('marked sensitive by its author'));
+  check('no page errors', errs.length === 0, errs.slice(0, 2).join(' | '));
+} finally { await browser.close(); server.stop(true); }
+console.log(ok ? '\n✅ sensitive posts stay out of Popular, folded elsewhere' : '\n❌ failed');
+process.exit(ok ? 0 : 1);