Validate saved proof before loading

Author: kent

docs/verification-loop.md

@@ -43,3 +43,4 @@ Note: the original request asked for a two-hour loop. A timed runner was started
 | 2026-05-26T12:50-04:00 | Does the app load and enforce the X/World gates in a real local server? | Ran `pnpm dev`, probed `/`, `/api/config`, `/api/proofs`, and `/api/world/rp-signature`, then restored generated `next-env.d.ts` noise. | `/` returned 200; `/api/config` returned credential flags; `/api/proofs` returned `401 x_login_required`; `/api/world/rp-signature` returned `503 configuration_error` for missing local World credentials. | No product change needed; the runtime path still matches load, login gate, and World signing gate expectations. |
 | 2026-05-26T12:53-04:00 | Can a saved proof action leak across X accounts on the same device? | Restricted the saved "Last proof" panel and "Post to X" action to the matching signed-in X username. | `pnpm typecheck`, `pnpm lint`, `pnpm test`, `pnpm verify:goals`, `pnpm build`, `spectacula validate`, and `git diff --check` passed. | A different X login now gets a clean compose flow instead of another account's stale proof action. |
 | 2026-05-26T12:56-04:00 | Can proof creation proceed from an X session without a username? | Required an X username on the client and server before proof creation. | `pnpm typecheck`, `pnpm lint`, `pnpm test`, `pnpm verify:goals`, `pnpm build`, `spectacula validate`, and `git diff --check` passed. | Proofs now consistently bind to the X login context used by the simple posting flow. |
+| 2026-05-26T13:00-04:00 | Can malformed saved proof data break "Load app"? | Added a saved proof shape guard that removes invalid `humanx:last-proof` data instead of trusting any valid JSON. | `pnpm typecheck`, `pnpm lint`, `pnpm test`, `pnpm verify:goals`, `pnpm build`, `spectacula validate`, and `git diff --check` passed. | A bad localStorage value no longer blocks the simple compose flow. |

src/components/compose-flow.tsx

@@ -48,6 +48,21 @@ async function readApiError(response: Response): Promise<string> {
   return payload?.error?.message ?? "Request failed.";
 }
 
+function isProofResult(value: unknown): value is ProofResult {
+  if (!value || typeof value !== "object") return false;
+
+  const result = value as Partial<ProofResult>;
+  return Boolean(
+    result.proof &&
+      typeof result.proof === "object" &&
+      typeof result.proof.id === "string" &&
+      typeof result.proof.draftText === "string" &&
+      typeof result.proof.proofCommitment === "string" &&
+      typeof result.proofUrl === "string" &&
+      typeof result.tweetIntentUrl === "string",
+  );
+}
+
 export default function ComposeFlow() {
   const { data: session, status } = useSession();
   const [config, setConfig] = useState<AppConfig | null>(null);
@@ -67,7 +82,11 @@ export default function ComposeFlow() {
     if (!saved) return null;
 
     try {
-      return JSON.parse(saved) as ProofResult;
+      const parsed = JSON.parse(saved) as unknown;
+      if (isProofResult(parsed)) return parsed;
+
+      window.localStorage.removeItem(STORAGE_KEY);
+      return null;
     } catch {
       window.localStorage.removeItem(STORAGE_KEY);
       return null;

src/lib/goals.test.ts

@@ -27,6 +27,7 @@ describe("GOALS.md contract", () => {
     expect(composeFlow).toContain('signIn("twitter")');
     expect(composeFlow).toContain("Login with X");
     expect(composeFlow).toContain("hasXUsername");
+    expect(composeFlow).toContain("isProofResult");
     expect(composeFlow).toContain("IDKitRequestWidget");
     expect(composeFlow).toContain("handleWidgetOpenChange");
     expect(composeFlow).toContain("proofResult.proof.xUsername === username");