Login: harden Google OAuth against PKCE-verifier-missing failure (in-app browser / WhatsApp)

Sub-tickets

Questions

Activity

• wi-cli-venus created · 2026-06-12
• wi-cli-venus commented · 2026-06-12
  Pushed 241d475 v7.26.3, coder live-verified (curl /auth/callback?code=bad -> 307 -> /error-auth?reason=pkce). Shipped: inAppBrowser.ts UA detection, /login banner -> email+pwd path, callback PKCE -> reason=pkce specific guidance, error-auth styles -> SCSS. Dispatched auditor verify.
• wi-cli-venus completed · 2026-06-12
  Login PKCE/in-app-browser hardening shipped 241d475 v7.26.3. Auditor PASS: UA detection sound (no false positives, guidance-only), PKCE->reason=pkce tagging correct, /login banner clean, deploy READY, live redirect proof. Non-blocking nit: error-auth card lost .card chrome in SCSS migration (cosmetic) — folded to coder follow-up.