6 months ago
72c7cb3PR #83 had two real runtime gaps in the newly dynamic browser/desktop path: disabling remote access could hide an active relay without tearing it down, and loopback CORS preflight did not advertise DELETE for transcript removal. The PR also leaked a machine-local Claude lock file into version control. This commit removes the lock artifact from the repo and ignores it going forward, tears down the relay on remote-access disable with a disabled-state backstop in IPC, and extends loopback preflight headers to cover transcript DELETE. The regression coverage exercises both the remote-access disable path and the CORS preflight contract. Constraint: Remote-access disable must remain best-effort and must not fail the UI toggle if the bridge is already gone Rejected: Resolve the relay issue only inside mobileRelayGetState | leaves toggle-off able to hide a live relay until the next state read Rejected: Ignore the ConnectPage dependency comment with a code change | reviewer validation showed no correctness bug, so no product code change was needed there Confidence: high Scope-risk: moderate Reversibility: clean Directive: Keep remote-access feature flag changes paired with relay teardown semantics; do not treat disabled UI state as sufficient proof the bridge is stopped Tested: bun run typecheck Tested: bun test apps/desktop/test/mobile-relay-ipc.test.ts apps/desktop/test/settings-nav.test.ts test/server.test.ts Tested: bun test --max-concurrency 1 Not-tested: GitHub Actions runner-specific behavior on the previously failed CI job (local full suite is green)
Parentab32420
