Skip to content

fix: safe save validation and mobile recovery - #6

Merged
rayalexvector merged 1 commit into
mainfrom
fix/mobile-security-20261008
Oct 7, 2026
Merged

rayalexvector merged 1 commit into
mainfrom
fix/mobile-security-20261008

Conversation

@rayalexvector

Copy link
Copy Markdown
Owner

Scope

  • Render Frontier statistics as validated text and tolerate blocked settings storage.
  • Align merge tile validation with actual game rules; preserve invalid progress and provide explicit recovery choices.
  • Preserve historical saves with absent optional best fields; protect quarantined cloud data.
  • Refresh all historical Starfall service-worker entrypoints without changing cloud-save protocol v2.

Verification

  • 72 Node regression tests passed in an isolated worktree; syntax/resource/secret-pattern checks passed.
  • Added real browser recovery checks at 320x568, 390x844, 844x390 and blocked-storage/WebGL checks.
  • Full browser regression runs locally and in the required verify check.
  • Homepage source and MiMo maintenance behavior unchanged.

Rollout

Frontend protection ships before backend strict validation. No database migrations or paid resources.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 965accfb09

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

if (archived) {
const copy = record.conflicts.find(item => item.id === archived.id);
if (!record.invalidLocal || !copy || candidate.buckets.sessions.merge2048) throw new Error("session_changed");
if (!core.equal(record.payload, store.initial)) throw new Error("other_progress_changed");

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Permit recovery after the lobby refreshes daily-card state

In the actual arcade lobby flow, renderLobby() calls statText() for the daily-card game, which calls Storage.getCards() and automatically changes cards.date from the quarantined store's initial value. Consequently, by the time a user opens Merge 2048 and chooses either recovery action, record.payload no longer equals store.initial, this branch throws other_progress_changed, and the modal remains permanently pending even though the user made no conflicting gameplay changes. The recovery check needs to tolerate or preserve benign post-quarantine changes rather than requiring the entire payload to remain byte-for-byte initial.

Useful? React with 👍 / 👎.

Comment on lines +86 to +87
Storage.store.record.conflicts.slice().reverse().find(item => item.reason === "invalid_local" &&
item.payload.buckets && item.payload.buckets.sessions && item.payload.buckets.sessions.merge2048);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Guard malformed archive roots before dereferencing

When Store.reload() quarantines a save whose root payload is null or missing—both valid corruption scenarios for this recovery path—it archives that value and resets the live payload. Opening Merge 2048 then evaluates item.payload.buckets here and throws a TypeError, so the game cannot start or offer recovery. Check that the archived payload and its nested objects exist before inspecting the session.

Useful? React with 👍 / 👎.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-07T20:03:54.883232Z 965accf PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@rayalexvector
rayalexvector merged commit 6f9550e into main Oct 7, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant