Repository navigation
Clarify desktop Rivet sign-in and retain rejected sessions - #14
Merged
Merged
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rivet sign-in links now say they open the installed desktop helper and explain what to do when viewing Accounts on a phone. A definitively rejected saved Google session displays "Sign-in expired" and directs recovery to the service owner, while preserving the saved session and history. The UI does not offer replacement pairing that the producer does not support.
The browser scenario now uses the native Rust producer fixture and checks the rejected-session state at phone width. The unfinished mobile extension flow is excluded.
Validation: workspace formatting, lint, all 45 typecheck tasks, all 39 test tasks, and the targeted selfhost Rivet setup browser scenario passed. The browser recording covers QR, cancel/retry, one-time credential handoff, emoji confirmation, verification, and rejected-session retention. All credentials and phone/account state are synthetic. Real passkey and phone acceptance remain separate.
Deployment update — October 29, 2026
Merged and deployed. The new web assets run over the previously qualified immutable server image. Production HTML, entry script and changed setup bundle match the qualified build. Managed backup, network-disabled candidate/predecessor startup, live account/key/config preservation, SQLite integrity, health and SSO-only checks passed. Fresh production Google authentication was not exercised.
The initial web rollout missed the existing SSO browser compatibility layer. Server policy checks did not prove the login page. #15 restores that source contract and is deployed; a fresh browser now shows the provider button, hides password fields, and follows the configured SSO redirect.