The production build emits the manifest, sw.js and icons and passes an installability check; with the network disabled after one visit, the shell and previously viewed plan/recipe pages load; /auth/* requests are never served from cache; the update prompt and iOS hint have tests.
Guardrails
directed: never cache authenticated API responses for /auth or settings; never request notification permission outside onboarding step 3 / Settings; push and notificationclick handlers are Feature 19.
Feature 06 - PWA Shell and Offline. All four tasks done and independently reviewed:
- 58b74786 Web app manifest and icons via vite-plugin-pwa (PR #50)
- 8fa0d0bd Service worker caching strategy (PR #51)
- 63f6c6c2 Update prompt and offline indicator (PR #52)
- ad6b3d80 iOS install hint component (PR #56)
## Acceptance criteria (feature)
The production build emits the manifest, sw.js and icons and passes an installability check; with the network disabled after one visit, the shell and previously viewed plan/recipe pages load; /auth/* requests are never served from cache; the update prompt and iOS hint have tests.
## Guardrails
directed: never cache authenticated API responses for /auth or settings; never request notification permission outside onboarding step 3 / Settings; push and notificationclick handlers are Feature 19.
Feature branch head: 581ff217a9c7792a24a8eacab76ec8deb7b4d96d. Based on dev 8adbd2d7c2a5763698b18582018aa03c65936587.
Address the Feature 06 integration review:
- Offline bootstrap: the API client keeps a device-local verified-session
marker (localStorage "1" only, never the /me payload or CSRF token),
set when /me answers with a member and cleared on a 401 or a
not-in-household 403. When /me fails with a network error and the
marker is set, AuthBootstrap opens the saved pages read-only (writes
are refused for want of a CSRF token) and loads /me again when the
browser comes back online. /me runs with networkMode 'always' so an
offline load fails fast instead of pausing on the skeleton.
- Recipe reads (/api/v1/recipes) join the network-first API cache;
/auth, settings and jobs stay network-only, including encoded and
dot-segment forms.
- The network-first strategy marks a response answered from its cache
with X-MealQuest-Cache-Fallback; the client counts it as offline, so
the indicator shows while navigator.onLine is still true.
Tests: offline reload of /plan and /dinner/:id after an online visit,
no saved pages without a verified session or after a 401, reconnect
reloads /me; the real Workbox NetworkFirst strategy against an
in-memory cache opens a previously viewed recipe offline, marked; the
pill shows for a cache fallback while online.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- POST /auth/logout answers with Clear-Site-Data: "storage", "cache", which
removes the verified-session marker, the service worker and its caches, so
an offline visit after logout cannot reopen household data. The 401/403
clearing path is unchanged.
- The service worker no longer answers network-only requests; it leaves them
to the browser. Chrome stalls a Clear-Site-Data navigation that the worker
answered, so the logout POST must bypass it.
- New tests send plan and recipe reads through the real API client and the
real network-first strategy online, then serve them from the cache offline.
- The icon generator is now Go on golang.org/x/image (approved) instead of
Python on Pillow; the icons are regenerated with it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Feature 06 - PWA Shell and Offline. All four tasks done and independently reviewed:
Acceptance criteria (feature)
The production build emits the manifest, sw.js and icons and passes an installability check; with the network disabled after one visit, the shell and previously viewed plan/recipe pages load; /auth/* requests are never served from cache; the update prompt and iOS hint have tests.
Guardrails
directed: never cache authenticated API responses for /auth or settings; never request notification permission outside onboarding step 3 / Settings; push and notificationclick handlers are Feature 19.
Feature branch head:
581ff217a9. Based on dev8adbd2d7c2.Independent Codex gpt-6-sol review: CHANGES_REQUIRED for this exact commit.
Independent Codex gpt-6-sol review: CHANGES_REQUIRED for this exact commit.
Independent Codex gpt-6-sol review: CHANGES_REQUIRED for this exact commit.
Independent Codex gpt-6-sol review: APPROVED for this exact commit.