Feature-detected navigator.share opens the OS share sheet with title+text+URL only
(no QR files: — narrow support drops the URL when given file+URL). Hidden unless
supported; Link másolása stays the universal fallback and catches the non-cancel
rejection; AbortError is silent. Template JS + tests only. 2 red-proofs verified red.
1.**Token match** (Group B): `subtle.ConstantTimeCompare` → prefix-accept (`presented[:len(stored)] == stored`) → `TestShareTokenMatches` FAILS on the superstring case ("a superstring must not match"). Restored → green.
2.**Cookie binding** (Group C): dropped `passwordHash` from `shareCookieValue`'s HMAC input → `TestShareGuest_PasswordGate` FAILS ("changing the password must invalidate the old gate cookie"). Restored → green.
3.**Log redaction** (Group G): reverted the ServeHTTP `/s/<redacted>` redaction (log raw `path`) → `TestShareGuest_TokenNeverLogged` FAILS. Restored → green.
PNG validated by magic bytes + content-type; the encoded string is `https://<host>/s/<token>` **by
construction** (the handler builds exactly that) — a phone scan was not run (no browser/scanner on
DooPlex).
6.**Token never logged (Scenario G):**`docker logs` shows `[WARN] [web] 404 Not Found: GET
/s/<redacted>` (2 lines); a scan of the full log for any raw `/s/<20+ char token>` returned
**EMPTY**. (The DEBUG ServeHTTP-line redaction is unit-proven in Group G; the live box runs at
`info`, where the redacted WARN 404 is the observable proof.)
7. **Cleanup:** `POST /launcher/share/disable` → both `launcher_share_token` and
`launcher_share_password_hash` cleared in `settings.json` — the box is left in the shipped default
(sharing OFF). Post-run `docker ps`: still `Up (healthy)`.
## Accepted residuals (no code action)
- **Link-preview crawlers** (Messenger/WhatsApp/Slack) fetch the URL once and see app names — accepted; `X-Robots-Tag: noindex, nofollow` prevents search indexing.
- **Reverse-proxy / Cloudflare access logs** may record the `/s/<token>` path — an ops-tier residual outside the controller (the controller's own logs redact it).
- **LAN-IP link host** — the modal builds the link from the request `Host`, so an admin on a LAN IP gets a LAN-IP link. Kept the UI clean; noted here only.
The **OS share sheet interaction is an OS-level dialog** that endpoint checks and browser automation
cannot exercise. CC validates markup + JS presence at the rendered `/launcher` (authed curl, Group-A
strings). The single pending manual check is the operator's: desktop Chrome/Edge or a phone → the
"Megosztás…" button is visible → the sheet opens → a WhatsApp/email target receives the title + a
tappable link; on Firefox desktop the button is absent and "Link másolása" still works.
## Observations
- The guest gate cookie is scoped `Path=/s/` + `HttpOnly` + `SameSite=Lax` (Lax so a first click from an external app still sends it on top-level GET). The CSRF cookie is `SameSite=Strict`.
-Disable clears BOTH token and share password (clean slate — a later re-enable never inherits a stale gate).
- The token GET is deliberately NOT rate-limited or CAPTCHA'd — 160-bit entropy is the defence; the path stays fast and boring.
- No Web Share Level-2 `files:` — ruled out above (narrow support; URL-drop when given file+URL).
-"Link másolása" is unchanged and remains the universal path; feature detection only, no UA sniffing.
- The share `text` is deliberately conjugation-free ("Az otthoni alkalmazások egy helyen.") — a
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
