Repository navigation
Fix scoped app access prompts and readonly recovery (FX-A) - #410
Merged
Merged
Conversation
Keep transient list failures with their current screen and retry once under identical freshly resolved authority. Open seeded forms with parallel readonly preflight, bounded recovery, and opaque source hydration. Hide external image placeholders until requested, and compute access prompts from visible record controls. Co-Authored-By: Claude Opus 5.5 <[email protected]>
Keep the VM fixtures aligned with the real request schema, screen-access state and Show images control. Re-review the unchanged opaque-frame flows against fresh Security run 39689516157 and pin their moved locations and source bytes. Co-Authored-By: Claude Opus 5.5 <[email protected]>
This was referenced Oct 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Apps now compute the compact access prompt from controls on the current screen. Read-only documents and lists do not request unrelated private stores; missing form/local-job access names the specific saved-record feature. Full access settings and every permission guard remain intact.
Seeded forms hydrate opaque Runtime-owned source defaults without creating a record. Independent locator/metadata and seed preflight reads run concurrently, with exact session/account/resource/store/consent pin checks before browser storage or disclosure. A stalled opening is bounded and offers an enabled Retry. Writes retain original acknowledgement and reconciliation rules.
Read-only list failures get one retry after resolving identical current authority and remain with their screen instead of leaving a false Runtime-outage banner on healthy settings. No writes replay and no consent lifetime extends. External image placeholders are hidden until requested, with Images hidden / Show images controls; saved automatic-image choices keep their existing checks.
Evidence: read-only demo search for
Deft Email Stage 1returned seven matches (HTTP 200). The reported provider banner correlated with concurrent automatic-image failures; a resource_list denied during an account status check explained the false Runtime outage. Email-specific behavior is in deft-email #22, whose CI is green. Coordinate both changes when integrating.Validation: the exact installed-app CI contract suite passed locally (522/522); focused Host regressions 84/84; final client/read-retry 26/26; web typecheck and app boundary gate passed (1274 exact findings, 1274 existing exceptions, zero errors). Real-browser image checks at 1440px and 390px confirmed zero image requests, hidden placeholders and no overflow.
Fresh raw CodeQL run 39689516157 was reviewed: the same 26 findings, with only three existing opaque-frame locations shifted by three lines. The query/message/partial fingerprints/flow steps are otherwise unchanged. Updated those exact findings and the one changed source pin; all supporting guard pins remain. The exact gate passes with 26 reviewed, zero unresolved and zero unused reviews; all ten disposition tests pass. Raw SARIF remains unchanged, and the evidence is recorded in docs/security/codeql-reviewed-findings.md.
FX-A ownership only. No demo data changed. The orchestrator owns merges and releases.
Current-head CI is green at be240e5: main CI 39690623944 (including API tests, production web build, image/browser smoke and upgrade), Security 39690624153 (including exact CodeQL disposition), and Native Mentions 39690624051. The Hermes gate is skipped by the existing core release scope. Both PRs remain open and unmerged; integrate Host support before enabling the updated Email app.
🤖 Generated with Claude Code