[DoodleBears]

Task #3 | Claim

Why the change

A channel-only guest needs to see the channel's workspace identity and select its authorized channels without becoming an organization member.

Special things to note

• Merge risk: two-way door, no schema migration; low blast radius in the authorized guest directory and CLI query. Organization names are read only after validating the current channel grant and local organization. This PR stacks on Add recipient-bound invitation links and target previews #25.
• Verified locally: 62 Worker tests, 20 CLI tests and TypeScript pass; authorized metadata, organization filter, unrelated-user/org denial and revoked listings are covered. UAT runtime bf6d896e813457382cd2bb2e7c74b22c03ba01ca is deployed/read back; formal CLI evidence verifies metadata/filter/no-membership/sibling denial/revocation. Mobile native acceptance remains pending.
• Draft / UAT only / do not merge. Pagination scans the recipient directory, so a filtered page may be empty while nextCursor remains non-null. Clients must keep offering continuation.

Change outline

GET /api/guest-channels?organizationId=org_…&after=ci_…
  current signed-in recipient → current Channel DO guest grant
  → optional organization filter → local organization check
  → Org DO name → authorized channel + organizationName

CLI guest-channel list --org … --after … → same public endpoint

The response is a display projection, never a WorkOS membership or authority to read sibling channels. Existing read/send endpoints continue to enforce the current channel grant.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[DoodleBears]

Workspace navigation tracer checkpoint (UAT only, no merge):

• Mobile Draft: Unify mobile cloud navigation, compact drawer and connection names DeepSeekBot#2170 — runtime 7c21394062695ecd47c93120cf4bdb28f554b84f. One root drawer, Computers + Cloud workspaces, current member/guest projection, instance/org deduplication, filtered guest entry and return to local Chats. Invitation prerequisite #2169 remains separate and unmerged.
• Service Draft: Expose authorized guest workspace identity and filtering #26 — UAT runtime bf6d896e813457382cd2bb2e7c74b22c03ba01ca, Cloudflare version e8427081-b4e3-420f-b344-aa844beae571. Deployment/readback pass. Formal CLI verifies authorized organization name, filter, unrelated-org empty result, no org membership, sibling denial and removal after revocation. Only the run's synthetic grant was revoked.
• Source: 647 mobile tests pass / 8 skipped, typecheck and focused lint pass; 62 Worker tests / 20 CLI tests pass. Initial sandbox loopback failures were rerun with the required permission. Full source-policy scan is deferred to CI because this checkout is sparse; changed-source scan passes. CodeRabbit skips Drafts and is not review approval.
• Native gate: queue request submitted, NOT ASSIGNED. Native inputs match existing signed build; no build/install/erase. Available disk fell to about 350 MiB, so no Simulator/Metro/capture started. Coordinator requires sufficient runtime headroom plus final CI before assignment. Native switching, revocation, large-text/theme screenshots and recording remain unverified; Android/physical/Human remain separate.
• Existing wider gates (QR camera, new-instance Hosted AuthKit continuation, org-wide Agents/WebSocket and T1 identity/recovery) remain open. Prod unchanged.

[DoodleBears]

Batch 22 native UAT completed; the shared Simulator window is released. No Prod or merge.

• Runtime bfb5cc4ec9b5b3029bebd7d544905efa6d2dcd4b; evidence-only head 3be6b52c384812f801d2b9d58013580c0d6e4c0f; native 494a20f1eb4f0666a2c90bc3c758af4e7ff5f46b; TOB UAT bf6d896e813457382cd2bb2e7c74b22c03ba01ca.
• PASS: one cloud-header workspace drawer, member organization → four channels, guest organization → one invited channel. Actual native-token HTTP readback confirms no guest-organization membership and denies the sibling. Revocation removes the guest organization on reopening.
• PASS: real session refresh retains an unsent draft, cold directory restoration, B sign-out removes its directory, A fixture after restart displays A's Owner roles. Both mobile sessions remotely revoked; latest refresh refused; other baseline sessions retained.
• PASS: default/intermediate/maximum Dynamic Type × light/dark, scrolling and reachable actions; maximum-size Cloud services was actually pressed. The PR body now embeds four images, all verified loaded at 402 × 874 in GitHub, and links a 26-second recording and inspected contact sheet.
• Boundaries: no paired computer existed, so computer-return is untested. Pagination/error/cancelled-request ordering remains source-only. In-place browser account replacement, Android, physical camera, Human/VoiceOver, new-instance Hosted AuthKit, sender sharing and QR rendering/save remain open. Synthetic sessions are not Hosted AuthKit proof. The first driver/IPv6/checkpoint issues are retained in the evidence record.
• Cleanup: only our test guest grant and temporary mobile sessions were removed, after revocation verification. Large/light restored; app, own driver and own Metro stopped. Installed app/config, original shared documents, other sessions, physical phone, Hosts and signed Products preserved.

Evidence and full limits. Runtime CI39104178457 passed; fresh evidence-head CI39108117819 passed every applicable check. The wider collaboration goal and issue #2161 remain open.