Public: anyone can read this; the crew can change it.

"prove your email first" and "verify your email first" live in one module, read by every door that holds back an unverified account #5664

Merged masoncrew opened this 19d ago

Check · Review · Land · Live done — Landed and live in production.

Merged

"prove your email first" and "verify your email first" now come from one new module, `src/actions/verify_words.ts`, as `PROVE_FIRST` and `VERIFY_FIRST`. #5558 hasn't landed, so its sentences aren't in the module yet; it can add them to this file.

shipped production is serving it deploy 2fa0c24

masoncrew opened this 19d ago

"prove your email first" and "verify your email first" now come from one new module, src/actions/verify_words.ts, as PROVE_FIRST and VERIFY_FIRST. #5558 hasn't landed, so its sentences aren't in the module yet; it can add them to this file.

What moved where

src/actions/verify.ts: UNVERIFIED_MESSAGE is now = VERIFY_FIRST. The name stays, so code that imports it is unchanged.
src/actions/tell.ts: UNVERIFIED_WORDS is now = VERIFY_FIRST. The same goes for its importers (src/http/feed.ts, src/tui/screens/tell.ts, mcp.ts).
src/http/respond.ts: the unverified answer in respondAccess reads VERIFY_FIRST.
src/http/mcp.ts: the app-limit refusal reads VERIFY_FIRST, and the make-it-yours refusal reads PROVE_FIRST.
src/http/api.ts: the make-it-yours refusal reads PROVE_FIRST.
src/contract/openapi.ts: this file isn't named in the issue, but it also had the lowercase sentence typed out ("403: prove your email first"). It's now ` 403: ${PROVE_FIRST} so that grep -rn` finds only the module.

In api.ts and mcp.ts, which others are editing at the same time, only the sentence lines changed, plus one new import line placed under the existing actions/verify.ts import. No wording changed.

Left alone: the capitalised, longer sentences — "Verify your email first." in src/web/studio/actions.ts, "Prove your email first: the link is in your inbox." in src/web/studio/make_it_yours.ts, and the longer one in src/actions/migrate.ts. They are different strings, and moving them would change what those pages and answers say.

Test: test/verify-gate-words.test.ts reads each door's source as text, including openapi.ts. It fails if either sentence is typed back in or if a file stops importing verify_words.ts. It also checks that UNVERIFIED_MESSAGE and UNVERIFIED_WORDS equal the module's sentence.

Checks run: bun x tsc --noEmit passes. The new test passes, and so do these suites, all unchanged: verify-email, tui-tell, home-feed, make-it-yours, mcp, mcp-email-verify, mcp-account-verify, mcp-docs, openapi, openapi-coverage, openapi-served and tell_from. Nothing under src/web changed, so the design lint didn't apply.

🤖 Generated with Claude Code

Closes #5646

masoncrew commented 19d ago

What moved where

src/actions/verify.ts: UNVERIFIED_MESSAGE is now = VERIFY_FIRST. The name stays, so code that imports it is unchanged.
src/actions/tell.ts: UNVERIFIED_WORDS is now = VERIFY_FIRST. The same goes for its importers (src/http/feed.ts, src/tui/screens/tell.ts, mcp.ts).
src/http/respond.ts: the unverified answer in respondAccess reads VERIFY_FIRST.
src/http/mcp.ts: the app-limit refusal reads VERIFY_FIRST, and the make-it-yours refusal reads PROVE_FIRST.
src/http/api.ts: the make-it-yours refusal reads PROVE_FIRST.
src/contract/openapi.ts: this file isn't named in the issue, but it also had the lowercase sentence typed out ("403: prove your email first"). It's now ` 403: ${PROVE_FIRST} so that grep -rn` finds only the module.

🤖 Generated with Claude Code

sentinelcrew Approved 19d ago— before the latest push

Clean, behaviour-preserving refactor. Both sentences now come from src/actions/verify_words.ts, and git grep at this head finds them nowhere else under src/. UNVERIFIED_MESSAGE and UNVERIFIED_WORDS keep their names, so the feed, TUI tell screen and MCP importers stay unchanged, and the terminal says the same words as the page and API. There is no new input, write path, header or query, so nothing changes for security. The preview answers /, and its served OpenAPI still reads unverified (403: prove your email first) for make-it-yours, so the contract is byte-identical. The new test fails if a door types a sentence back in or stops importing the module. It is a source-text check, not a behaviour check, and that fits a pull whose only claim is where the words live. Leaving the capitalised page sentences alone is the right call: moving them would change what those pages say.

masoncrew commented 19d ago

The two phrases "prove your email first" and "verify your email first" are now defined once, in src/actions/verify_words.ts. Every door reads them from there: the HTTP API, MCP and the OpenAPI refusals. The OpenAPI contract's unverified refusal is now built from the PROVE_FIRST constant instead of a typed-out string.

This update merges main into the branch. The only conflict was in the import list of src/contract/openapi.ts, where both sides had added an import. The file now keeps this branch's PROVE_FIRST and main's FAMILY_WORDS and SELF_WAIT.

After the merge, a search of src/ found neither phrase written out anywhere outside verify_words.ts and the tests. So nothing main added brings back a hard-coded copy.

The type check passes. The OpenAPI, contract, verify-email, MCP verify and wording tests also pass (136 tests across 30 files); the rest of the suite was not run here.

🤖 Generated with Claude Code

sentinelcrew Approved 19d ago— before the latest push

Clean, small, does what the issue asked. On base, grep -rn for both sentences finds exactly the seven places this diff replaces (verify.ts, tell.ts, respond.ts, api.ts, mcp.ts ×2, openapi.ts), so nothing is left typed out in src/. No wording changes: the old exported names (UNVERIFIED_MESSAGE, UNVERIFIED_WORDS) still resolve to the same string, so feed.ts and tui/screens/tell.ts keep saying the same thing on both doors. Security is untouched. The diff only swaps constants and adds no input, route or dependency. On the preview, /contract/openapi.json still says unverified (403: prove your email first) from the interpolated constant, and an unauthenticated POST to /api/v1/apps still answers 401. The test pins both sentences and fails if any listed door types one back in or stops importing the module. Leaving the capitalised page sentences alone was the right call.

trevatoowner commented 18d ago

Steward: this pull is approved but no longer merges into main. #5932 split src/http/mcp.ts into one file per tool, and several other shared files moved. Bring it up to date with main: merge main and resolve keeping this pull's intent. If it adds or changes an MCP tool, move that into its own file in the new layout and regenerate the docs. Then let the check run. If the change is already on main, say so and close the pull.

masoncrew commented 18d ago

I merged main into this pull and moved its change into main's new layout. The two sentences "prove your email first" and "verify your email first" are still written in one place, src/actions/verify_words.ts. The type check is clean and the tests for verification, the API contract and the MCP tools pass.

The words module: main had added a verify_words.ts of its own, with VERIFY_WORDS (the refusals for asking for another verification link). The merged file holds both that and this pull's VERIFY_FIRST and PROVE_FIRST.
MCP: src/http/mcp.ts is now one file per tool. src/http/mcp/tools/new_app.ts reads VERIFY_FIRST and src/http/mcp/tools/make_it_yours.ts reads PROVE_FIRST. The tools' descriptions are unchanged, so the MCP docs did not need regenerating.
API contract: src/contract/openapi.ts is now one file per route. The make-it-yours row reads PROVE_FIRST. So does postApiV1UserOriginsIdBrowseOwnerNameContribute.ts, a new route from main that typed "prove your email first" out by hand.
Test: test/verify-gate-words.test.ts now checks those four files instead of the old mcp.ts and openapi.ts. It still fails if any of them types a sentence back in or stops importing the module.

No wording changed. I left the capitalised page sentences alone, as before.

One thing to look at: I didn't check what the contribute endpoint itself sends back to an unverified account. If it says "verify your email first" rather than "prove your email first", that mismatch was already on main and this pull leaves it as it was.

To try it: on the preview, /contract/openapi.json should still list unverified (403: prove your email first) for both the make-it-yours and contribute routes.

🤖 Generated with Claude Code

sentinelcrew Approved 18d ago

Clean, single-purpose wording refactor. At head 5d470d6d: bun x tsc --noEmit clean, test/verify-gate-words.test.ts 9/9 green, and a grep of src/ finds neither lowercase sentence outside src/actions/verify_words.ts. The preview's /contract/openapi.json still lists unverified (403: prove your email first) for make-it-yours and contribute, so nothing a client sees changed. No security surface is touched: no new input, write, query or dependency. The capitalised page sentences left in src/web/studio/* and src/actions/migrate.ts are different strings, and leaving them was the right call. One nit is inline, and it does not block.