Diagnostic-purchase prompt: tech-triggered, paid on the store's checkout in the customer's browser#32
Open
mrjeeves wants to merge 2 commits into
Open
Conversation
mrjeeves
force-pushed
the
claude/cec-diagnostic-purchase-integration-hgphzb
branch
from
July 11, 2026 12:36
239f960 to
6900ce0
Compare
A technician can now require the $50 diagnostic session at any point in a help call: before connecting (quoting the work up front), mid-session, or after disconnecting. Strictly optional and only ever raised by the technician; the app never initiates a purchase. The prompt (PurchaseModal) follows the approve-modal's design and walks four beats driven by the node's cec://purchase events: the ask (item, price, the asker's name — the standing approval's name when one exists, else the name the ask carried, verified the same way the connect prompt's is), "finish up in your browser" once the customer opens the secure checkout, "confirming with your technician" after they tap I've-completed-my-purchase, and "You're all set" when the technician confirms the order actually landed in the store. Declining is always available until it's settled; a technician withdrawal takes the prompt down with a note. No payment data ever touches the app or the mesh: - "Open secure checkout" opens the customer's own default browser at the app's built-in purchase page (support.cec.direct/buy/diagnostic/) with attribution only (support number, reference, agent name) — the URL is never taken from the wire, and the new open_url Tauri command (via tauri-plugin-opener; the shell plugin's open is deprecated) refuses anything but that page. The now-unused shell:allow-open capability and shell open config are removed. - The store's hosted checkout handles payment, receipts, and refunds; the technician verifies the order (it carries the Support Number as cart attributes) and confirms from their side. Human confirmation, no webhooks, no server — the same shape as the agent-name check. Wiring: cec_purchase_status / cec_purchases passthrough commands (status words validated locally so the crate still compiles against a pre-purchase node release — the flow lights up at runtime once the bundled node carries the relay), the Purchase type + bridge listeners, store state + actions with a demo arc for the browser preview (plus a "Preview the purchase prompt" affordance), and docs (README contract table, ARCHITECTURE purchase section + trust model, ROADMAP status). Also refreshes the stale gui/src-tauri Cargo.lock (v0.2.34 -> v0.2.35 to match the manifest) and picks up rustfmt on build.rs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MzGQaTFkYtzYR7Hq1jBoGR
…path The purchase work moved URL-opening to tauri-plugin-opener and dropped the shell plugin's open grant (shell:allow-open, the plugins.shell config) as no longer used; main's waiting-screen TikTok link then arrived on the deprecated shell open, quietly relying on config this branch removes. Port it to the opener and drop tauri-plugin-shell entirely: every browser hand-off now goes through the one plugin, hardcoded or checkout-gated, and the deprecation warning goes with it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MzGQaTFkYtzYR7Hq1jBoGR
mrjeeves
force-pushed
the
claude/cec-diagnostic-purchase-integration-hgphzb
branch
from
July 12, 2026 23:41
6900ce0 to
11b44c3
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The customer side of the $50 CEC Diagnostic Session flow — sibling to the AllMyStuff PR (protocol + node relay + technician controls, mrjeeves/AllMyStuff#167) and the
support.cec.directPR (the checkout hand-off page).What the customer sees
Only ever when their technician asks — before connecting, mid-session, or after disconnecting; the app never initiates a purchase. A prompt in the house style (same skeleton, tokens, and manners as the approve modal) walks four beats:
$50price on an order line, plain-language reassurance ("you'll pay on our secure checkout in your own web browser — CEC never sees your card details"), one honest primary button, and a decline that's always available until it's settled.Done.A technician withdrawal takes the prompt down with a note (never a silent vanish). The demo/browser preview plays the whole arc (
Preview the purchase promptnext to the existing dial preview), including a pretend technician confirm — screenshots were driven headlessly through all four beats.Security posture
support.cec.direct/buy/diagnostic/?sn=…&ref=…&agent=…itself (attribution only), and the newopen_urlcommand refuses anything but that page (unit-tested against scheme/host/path escapes). No peer, and no compromised webview, can steer the customer's browser elsewhere through this path.tauri-plugin-opener: the checkout command and the waiting screen's TikTok link (which had landed on the shell plugin's deprecatedopen).tauri-plugin-shellis dropped entirely, along with theshell:allow-opencapability and shellopenconfig — a strictly smaller webview surface than before.Compatibility (no release deadlock)
The Rust side compiles without the purchase symbols on purpose — purchase status words are validated locally rather than imported — so this branch builds against whatever AllMyStuff tag main pins and the flow simply lights up at runtime once the bundled/running node carries the relay. Main currently forward-pins
v0.2.39(.allmystuff-rev+ the three git-dep tags), so the one remaining step is cutting that AllMyStuff release once #167 lands. The event bridge needed zero changes (it forwards every node event by name).Verification
pnpm check0 errors / 0 warnings; production build clean (the CI gate).gui/src-tauri:cargo check+ 4 unit tests green (URL lock-down, purchase-state validation), compile-checked against the sibling AllMyStuff branch via a temporary path override (not committed; the pinnedv0.2.39tag doesn't exist yet, so nothing resolves it today — same as main, whose CI doesn't build this crate).window.openwithnoopenerreturnsnullby spec — the demo no longer misreads that as failure.🤖 Generated with Claude Code
https://claude.ai/code/session_01MzGQaTFkYtzYR7Hq1jBoGR
Generated by Claude Code