0.60.0

CLIque installs as an app on a phone, from the page you actually arrive on. The panel had a correct manifest, a service worker and every icon size. The sign-in page had none of it, and the sign-in page is what a phone meets first, so "Add to Home Screen" gave you a bookmark with a screenshot for an icon and Safari's chrome around the result.

The cause was an allow-list that had quietly gone dead. PUBLIC_ASSETS names what may be served before login, and a past fix for a real traversal hole (/brand/../app.js resolved back to the app shell) replaced the whole check with a single "is it inside brand/" test. That closed the hole and, with it, silently un-published the manifest and the favicon: the constant was still declared, still read like documentation, and referenced by nothing. A browser cannot offer to install an app whose manifest it is not allowed to read.

The allow-list is honoured again and the traversal stays closed, because the comparison is between resolved paths rather than prefixes. sw.js joins the list, because Chrome judges installability from the page in front of it.

Three things fixed on the sign-in page, all found by tooling rather than by looking. The password field was 14px, so iOS zoomed the entire page the moment you tapped it. The field and the button were 42px against a 44px thumb. At 320px the page scrolled sideways for want of box-sizing: border-box.

tools/smoke_http.py now asserts both halves of the allow-list from a logged-out client, including four traversal attempts through brand/... That is the test whose absence let the list go dead.