A stranger reaches their first pull on a public app from the app's page: get in, fork, send #12159

A public app's page now shows a signed-out stranger three steps to a first pull: get in, fork, send. The steps are links, and signed-in readers see "Fork and send a pull" instead. I did not run the full suite.

What changed

• src/web/studio/contribute_steps.ts is new and renders the steps block. src/web/studio/app.ts mounts it on the app page. Private apps show nothing.
• Signed out, each step links to its place: sign in with ?next=, then the fork, then the new-pull form.
• test/guest-contribute.test.ts has an end-to-end test of the walk. A signed-out person goes through the steps as a new guest to an open pull. The test also checks that a cross-origin POST to /pulls/new is refused and that a private app offers nothing.
• A later commit only rewraps a test comment to 100 columns, because the gate flagged it.

What I left out

• Signup is no wider than before. The guest path is the existing one.
• I did not touch apps.ts, packs.ts or guest.ts, since the existing flow needed no change.

Checks

• bun scripts/gate.ts and bun x tsc --noEmit pass.
• design-lint reports one off-scale 17px in src/web/studio/cards.ts:1216. It is not in this diff, so I left it.
• test/guest-contribute.test.ts ran 22 tests: 21 pass and 1 fails. The failing one is the MCP/git test, "a person's own agent attaches by OAuth and walks the guest path through MCP and git". Its git push exits 128 here, and I did not check whether it also fails without my change. My diff doesn't touch that test, and my guess is the sandbox blocks the git push. The forge's check will show whether it fails there too.

Try: open /<owner>/<app> of a public app on the preview signed out and follow Get in, Fork, Send a pull. Then sign in and see "Fork and send a pull".

🤖 Generated with Claude Code

I couldn't fix the 46 failures, because none of them come from this change. I merged the current main into the branch and pushed, so the next check shows whether main fixed them.

Every failure I traced points at files this pull doesn't touch:

• Header width: src/boards/chart.ts, src/web/studio/crew_key.ts, src/web/pages/home_flow.ts and others have header comment lines over the width limit.
• Unreached module: src/crew/week_burn.ts is imported by nothing under src/.
• Cookie sites: src/spawn/origin_broker.ts and src/web/pages/home_flow.ts have cookies with no entry in COOKIES.
• Reserved names: broker is a top-level page that isn't a reserved name.
• Home page:

- The query-count test sees a new run statement on the home page. - The first-view budget test finds the home over its limits. - The fingerprint test fails.

• Spawn sites: src/data/query.ts isn't on the spawn list. This one only appeared after the merge, so it comes from main.

The reserved-names, app-home-batched and door-ssh-fingerprint tests already fail two commits back, before my commits.

On the merged branch, tsc is clean and bun scripts/gate.ts printed nothing. bun scripts/design-lint.ts flags one off-scale font size in src/web/studio/cards.ts:1216, a file I didn't change. In test/guest-contribute.test.ts, 21 tests pass and one fails. The failure is the OAuth/MCP/git test, where git push to the local test server exits 128. I think that's the sandbox, but I haven't confirmed it.

What the pull does: src/web/studio/contribute_steps.ts adds a "Help build this" block to a public app's page, for readers who can't already write to it.

• Signed-out readers: three linked steps — get in, fork it, send a pull.
• Signed-in readers: a single "Fork and send a pull" button.
• Wiring: src/web/studio/app.ts renders it. Tests are in test/guest-contribute.test.ts.

It adds no new route and no dependency. Every link goes to a page that already exists.

To try it: open a public app's page signed out, then signed in as someone without write access.

No change is needed in this pull. origin/main has no commits beyond what I already merged and fails the same tests, so a new push would only repeat the failure.

I checked this by running four of the failing test files on origin/main and on my branch. They were server-timing-sweep, milestone-front-door, studio-shipping and later-gate. Each gave the same 5 failures and 72 passes on both. Earlier, reserved-names, app-home-batched and door-ssh-fingerprint also failed two commits before my first commit.

My diff against main is three files: src/web/studio/app.ts, src/web/studio/contribute_steps.ts and test/guest-contribute.test.ts. None of the failing tests reaches them. The failures sit in other files:

• Header comments over the width limit in src/boards/chart.ts and src/web/pages/home_flow.ts, among others.
• src/crew/week_burn.ts, which nothing imports.
• Cookies in src/spawn/origin_broker.ts and src/web/pages/home_flow.ts with no entry in COOKIES.
• The broker page, which isn't a reserved name.
• src/data/query.ts, which isn't on the spawn list.
• The home page's query count, first-view budget and fingerprint.

What the pull does: a public app's page shows a reader who can't write to it the steps to a first pull: get in, fork, send. Signed-in readers get a single "Fork and send a pull" button. It adds no new route and no dependency.

What I left out: I did not touch the other agents' files to turn main green. That should be its own pull.

To land it: main needs to be green first, then this pull's check can be re-run. I haven't pushed anything since the last merge.

Parked by the crew: the check stayed red through 2 automatic tries: event audience coverage > every kind the source emits is classified

The way in on a public app's page is now plain rows, and the owner, writer and archived cases are tested. I could not check the 360px first view here, so the placement is unchecked. test/guest-contribute.test.ts, tsc and design-lint pass, and bun scripts/gate.ts printed only "pin-migrations: every migration is already pinned". I did not run the full suite. test/attention.test.ts fails on the settings and forges pages, and it failed the same way with my change stashed, so I left it.

What changed

• Rows, not a card (src/web/studio/contribute_steps.ts): a signed-out reader sees one "Help build this" heading, one short sentence ("Anyone can send a change; a person reviews it first."), and three rows: Get in, Fork it, Send a pull. "or use your own forge" sits beside the Get in row. A signed-in reader who can't write the app sees one row with the "Fork and send a pull" button.
• Explanations dropped: HELP_BUILD_NEXT and the "you get your own copy" and "a person reviews it" clauses are gone from this block.
• Placement (src/web/studio/app.ts): the section now sits after the head, the crew and key cards, and the paused line, instead of right under the head. I did not check the 360px first view, because the sandbox has no browser. The block is now a heading, one sentence and three one-line rows, and it is below the cards.
• Tests:

- New cases show the owner, a writer and an archived app get no way in. They check offersWayIn and, for the owner and the writer, the rendered page; a reader on the same app does get the block. - The "writer" is an admin, which exercises the canWrite path. I did not build an org-collaborator case. - The signed-out test now opens signup and calls /signup/passkey/options, which returns a challenge. The passkey registration itself needs a browser and isn't followed.

• Both doors:

- I added a section to docs/features/guests.md. - I did not add a terminal screen. The commit carries a No door: line: the section only links pages that already have a terminal door (the Make it yours command in src/tui/screens/yours.ts) and adds no route. If you want a terminal screen anyway, say so.

• The red check (event audience coverage, forge.app_links) came from main. I merged the main commit that fixes it, and that test passes.