[DoodleBears]

Task #3 | Claim

Why the change

Recipients need a portable invitation link that previews the exact destination before joining, without giving the link holder access to another account's invitation.

Special things to note

• Merge risk: two-way door — revert the additive endpoints and CLI commands; medium blast radius — invitation metadata and cross-instance credentials. Review recipient checks before metadata, redirect refusal, explicit server binding and unchanged acceptance authority.
• Existing invitations remain recipient-bound; no schema migration, public bearer invite, automatic acceptance or Prod change. UAT API/CLI replay passed at f10437bfbe46c4cbcbfb71bc6b599e9551669051; mobile acceptance remains pending. Keep Draft/unmerged.
• Local checks: TypeScript, 62 real workerd tests and 42 Node tests passed (20 CLI). Task: codex/local/01a148ae-ec7f-74b2-8157-961411ce54c9.

Change outline

HTTPS /join?invitation=<id>
  → neutral landing → native client
  → existing instance trust + login
  → GET /api/{channel-invitations|invitations}/:id
      verified recipient → organization/channel preview
      wrong account → refusal, no metadata
  → existing explicit POST /:id/accept

CLI adds invitation-link <server> <id>, invite preview and channel-invite preview; preview/accept accept --link only when its origin equals the explicitly imported --server and its scope matches the command. Preview is read-only; channel-only invitation never grants workspace membership.

Tests exercise pending preview without joining, wrong recipient, revoked acceptance, neutral landing and mismatched-server refusal before credentials are sent. Live UAT replay evidence confirms those boundaries with synthetic A/B accounts. Mobile #2169 is awaiting its assigned Simulator run; new native screenshots are pending.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[DoodleBears]

UAT API/CLI tracer is verified at service f10437bfbe46c4cbcbfb71bc6b599e9551669051 (CI, sanitized evidence): recipient preview does not join; wrong account/anonymous refused; landing reveals no destination; mismatched origin refused before sending credentials; revoked acceptance denied; no organization membership or sibling access. Schemas remain D1/Org/Channel 5/4/5. No Prod or authentication-setting change.

Companion mobile #2169 is Draft. Native invitation acceptance, pending-target restart recovery and before/after screenshots are still pending the assigned Simulator window; real camera QR, QR display/save and workspace drawer remain separate unfinished gates. T1/#3 stays open.

Task: codex/local/01a148ae-ec7f-74b2-8157-961411ce54c9.

[DoodleBears]

Assigned Batch21 iOS Simulator acceptance is now verified and published in DeepSeekBot #2169. Evidence, recording, first failures and limits.

• Runtime 1a2c1c385fd842958a078da05bb85c841d69934e; UAT service f10437b, schemas 5/4/5. Runtime CI passes. Screenshot links render in the PR; video is published. Evidence/doc-only heads have their own CI.
• Deep-link recipient preview, pending cold restart, explicit guest accept/direct channel, one native message and accepted cold reopen pass. CLI independently proves no organization membership, sibling denial and exactly one committed message.
• Revoke blocks the old session and removes the guest channel. Phone refresh/logout revokes only its independent synthetic session, rejects latest refresh and preserves other sessions. Trusted config retained; own private fixture removed, original display settings restored, driver/Metro stopped, shared window released.
• Native QA found and fixed two issues: misleading saved-session label; absent cold-start identity cache hiding the loaded channel. The latter has a failing-before/passing-after regression (32 client tests and typecheck pass); original captures retained.

Still open: sender native copy/share, new-instance trust and Hosted AuthKit return carrying an invitation, real camera/Android; QR rendering/save, unified workspace drawer, organization-wide Agents and remaining umbrella gates. Synthetic login does not prove interactive Hosted AuthKit. No Prod or new PR merge. Task codex/local/01a148ae-ec7f-74b2-8157-961411ce54c9.