Remote PWA /r forwarder + entitlement auto-recheck; mobile-safe invites + Gov/CUI onboarding; KG-packs status#317
Merged
Conversation
…boarding P-SHARE.3: the Session Share dock features the https phone/browser link (accent 'Copy phone link' + QR) and demotes the wss LUCID-to-LUCID link to a labeled 'desktop only' row; it never offers or QR-codes a wss (LAN) link to a phone (texting that fails to join AND leaks roomId.secret). New pure classifyInviteLink (share_dock.ts) picks the https link, discards non-http(s) values, and flags LAN-only https hosts. Tests + demo-P-SHARE.3. P-GOVCUI.1: first-run onboarding asks whether the user is a Government/GovCon user handling CUI; a 'yes' walks a novice into the CUI-safe posture (AskSage gov gateway lockdown) with the CIV routing endpoint prefilled and step-by-step token instructions, then opens Settings on the AskSage card. New pure gov_onboarding.ts (decideGovOnboarding + planGovSetup; fail-closed: no key never flips lockdown). Cosmetic govconCui state through settings_store/dev/bridge. Tests + demo-P-GOVCUI.1. Gate, prompt prefix, and trust labels untouched.
…ent auto-recheck r.html (ADR-0227 follow-up): a LUCID-to-LUCID relay link (wss://host/r/<roomId>.<secret>) opened in a phone browser arrives as an https path; this page moves the bare link into the PWA's URL fragment client-side (fragments never leave the browser) so a mis-shared invite still lands in LUCID Remote. build.ts copies it into dist. HANDOFF-covert-r-forwarder.md documents the remaining apex-side fix for the COVERT site repo. app.ts: an admin comp grant sets the premium claim server-side with no checkout moment, so the Subscribe screen could sit on a stale cached token for up to an hour. On first mount per sign-in, force a token refresh and connect if the claim already landed; one-shot so a refusing relay can never loop connect->4403. Also removes the remaining em dashes from the Subscribe UI. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
… reconciled, all packs building Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…-gate the fc/fd ULA check, guard the PWA auto-recheck - gov onboarding auto-enable now keys off managed asksageOnly, not locks.models (a commercial enterprise with a locked model picker was silently recorded as CUI) - isPrivateHost only treats fc/fd prefixes as IPv6 ULA when the host contains a colon, so a DNS name like fcdn.example.com no longer reads as LAN-only (+2 tests) - the PWA Subscribe auto-recheck wraps getIdToken in try/catch so an offline refresh can't strand the 'Checking your access' hint or reject unhandled Verified: share_dock+gov_onboarding 34/34, demo-P-SHARE.3 + demo-P-GOVCUI.1 green, desktop + PWA tsc clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
mlcyclops
added a commit
that referenced
this pull request
Jul 19, 2026
…ding + 11-SKU KG-pack storefront Rolls up since v1.11.9: P-SHARE.3 (the https phone link is featured + QR'd, the wss LUCID-to-LUCID link is demoted to a labeled desktop-only row, closing the room-secret-in-the-path leak), P-GOVCUI.1 (first-run Government/CUI step: CIV endpoint prefilled + token walkthrough; a key turns on lockdown, keyless never flips it), the KG-pack storefront reconcile (11 SKUs, SPM flagship), the Remote PWA /r forwarder + comp-grant auto-recheck, and the PR #317 review fixes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ships the three commits sitting on local master:
The /r forwarder is already live on lucid-agent.web.app (deployed 2026-07-18, re-verified today after the hosting restore).
🤖 Generated with Claude Code