Full in-depth audit + CloudStorage crash fix#116
Conversation
Adding .gitkeep for PR creation (default mode). This file will be removed when the task is complete. Issue: #115
Three modules called Telegram.WebApp.CloudStorage methods without
catching synchronous throws, which crashed the page on Telegram WebApp
< 6.1 (CloudStorage object exists but methods raise
WebAppMethodUnsupported). Gate behind isVersionAtLeast('6.1') and wrap
calls in try/catch so unsupported clients fall back to localStorage:
* assets/js/prefs.js — migrate() now always resolves; csGet/csSet/
csRemove catch synchronous throws and reject cleanly.
* assets/js/achievements.js — loadStats/saveStats fall back via a
shared cloudStorage() probe + localStorage fallback.
* assets/js/address-book.js — loadEntries/saveEntries probe the API
and catch throws around getItem/setItem.
AUDIT.md documents the audit done against issues #1, #2, and the
in-flight #115 work, plus the 6 follow-up GitHub issues it spawned
(#117–#122).
konard
changed the title
🤖 Solution Draft LogThis log file contains the complete execution trace of the AI solution draft process. 💰 Cost: $6.630777📊 Context and tokens usage:Claude Opus 4.7: (2 sub-sessions)
Total: (2.4K new + 182.9K cache writes + 8.4M cache reads) input tokens, 51.6K output tokens, $6.630777 cost 🤖 Models used:
📎 Log file uploaded as Gist (4115KB)Now working session is ended, feel free to review and add any feedback on the solution draft. |
🔄 Auto-restart 1/5Detected uncommitted changes from previous run. Starting new session to review and commit or discard them. Uncommitted files: Auto-restart will stop after changes are committed or discarded, or after 4 more iterations. Please wait until working session will end and give your feedback. |
`lhci collect` writes reports to `.lighthouseci/` and the audit pass saved ad-hoc PNGs at the repo root (`audit-bridge-en.png`, etc.). Neither should land in the tree; add explicit patterns so future audit runs leave a clean working copy.
Working session summaryРабочее дерево чистое, gitignore-обновление запушено в ветку PR. Резюме:
This summary was automatically extracted from the AI working session output. |
🔄 Auto-restart 1/5 LogThis log file contains the complete execution trace of the AI solution draft process. 💰 Cost: $0.596445📊 Context and tokens usage:
Total: (22 new + 38K cache writes + 465.0K cache reads) input tokens, 5.1K output tokens, $0.596445 cost 🤖 Models used:
📎 Log file uploaded as Gist (4598KB)Now working session is ended, feel free to review and add any feedback on the solution draft. |
🔄 Auto-restart triggered (iteration 1)Reason: CI failures detected Starting new session to address the issues. Auto-restart-until-mergeable mode is active. This run will stop after 5 restart iterations. |
|
CI зелёный на свежем коммите |
🔄 Auto-restart-until-mergeable Log (iteration 1)This log file contains the complete execution trace of the AI solution draft process. 💰 Cost: $6.384719📊 Context and tokens usage:Claude Opus 4.7: (2 sub-sessions)
Total: (2.0K new + 207.7K cache writes + 7.2M cache reads) input tokens, 58.3K output tokens, $6.383054 cost Claude Haiku 4.5:
Total: 225 input tokens, 288 output tokens, $0.001665 cost 🤖 Models used:
📎 Log file uploaded as Gist (7539KB)Now working session is ended, feel free to review and add any feedback on the solution draft. |
2 participants
Closes #115.
What this PR does
Second-pass audit of the work shipped against the improvements plan (#1)
and the 53-task roadmap (#2), extending the prior audit in PR #114 /
APPLICATION_AUDIT.md(2026-05-04).Code change (one)
Harden CloudStorage callers — three modules used
Telegram.WebApp.CloudStoragemethods without catching synchronousthrows. On Telegram WebApp 6.0 the object exists but its methods raise
WebAppMethodUnsupportedsynchronously, which crashed every consumer:assets/js/prefs.js—migrate()Promise never resolved, soprefs.init()hung forever and broke language / theme / last-pairpersistence.
assets/js/achievements.js—loadStats/saveStatsthrew and brokethe tier badge + celebration modal.
assets/js/address-book.js—loadEntries/saveEntriesthrew andbroke the chip list and the Manage Addresses page.
Fix: gate access behind
tg.isVersionAtLeast('6.1')and wrap calls intry/catchso unsupported clients fall back tolocalStorage(thefallback already present for non-Telegram envs).
Audit doc
AUDIT.mdadds the second-pass audit summary with the verificationmatrix, fixed findings, audit-only findings, and the new follow-up
issues filed below.
Follow-up issues filed
Items that surfaced during the audit but whose right fix belongs in
its own scoped PR:
Content-Security-Policy-Report-Onlyheader is not honoured inside
<meta>per the W3C spec — browsersdrop it. The report-only policy on all 12 page shells is therefore a
no-op end to end.
shapes (5 vs 8 items) across page shells, which loses navigation
options when moving between pages.
@lhci/clitransitivenpm auditadvisories.APIs.
OTC.
Verification
npm run buildnpm run check:i18nnpm run validate:manifestnpm run test:unitnpm run test:schemanpm run test:auth-verifynpm run test:accrualnpm run test:redeemnpm run test:rate-confignpm run test:installernpx playwright test(focused:prefs,achievements,address-book)npx playwright test --grep "RU\|Russian\|ru locale"npx html-validate "dist/*.html"Test plan