gate GET_LOCAL_IDENTITY to extension-page senders so a content script cannot exfiltrate the Pro license key (audit #4)

@@ -708,6 +708,11 @@708708         expect(r.error).not.toBe("invalid_sender");709709       });710710     }711+712+    it("GET_LOCAL_IDENTITY from a content-script sender is rejected (audit 2026-08-20 #4)", async () => {713+      const r = await dispatchFrom({ type: "GET_LOCAL_IDENTITY", payload: {} } as Message, contentScript);714+      expect(r).toEqual({ ok: false, error: "invalid_sender" });715+    });711716   });712717 713718   // ── ADD_ENTRY adversarial when locked ───────────────────────────────────

@@ -160,12 +160,15 @@160160 161161 // ---------------------------------------------------------------------------162162 // PCH-01-018: operations that irreversibly destroy or replace vault contents,163-// plus handlers that store passkey material. These are gated to trusted163+// handlers that store passkey material, and handlers that return sensitive164+// credential material (e.g. the Pro license key). These are gated to trusted164165 // extension-page senders in handleMessage; the confirmation UX otherwise165166 // lives only in the popup. Keep this in sync when adding new destructive or166167 // sensitive handlers. (Codex Security 2026-08-04: GET_ADOPTION_MATERIAL and167168 // COMPLETE_PAIRING were gated here, then deleted outright — they had no168-// legitimate senders; adoption runs in-background via relay-adoption-bg.ts.)169+// legitimate senders; adoption runs in-background via relay-adoption-bg.ts.170+// Audit 2026-08-20 #4: GET_LOCAL_IDENTITY gated here — it returns the Pro171+// license key, which a compromised content script could exfiltrate.)169172 const PRIVILEGED_MESSAGE_TYPES: ReadonlySet<string> = new Set([170173   "DESTROY_VAULT",171174   "CLEAR_VAULT_ENTRIES",@@ -175,6 +178,7 @@175178   "UNLOCK_WITH_PIN",176179   "SETUP_PIN",177180   "DISABLE_PIN",181+  "GET_LOCAL_IDENTITY",178182 ]);179183 180184 // LV-3: minimum interval between non-test canary pings per webhook+entry.