, and let the feedback site answer HEAD (#535) #551

Merged

claude-bot merged 1 commit from fix/pwa-feedback-fallback into main

2026-09-07 15:26:55 +00:00

claude-bot commented

2026-09-07 15:10:00 +00:00

Contributor

Reported by the owner: opening any page of the design-review feedback site at questboard-dev.rhoving.com/feedback/… redirected to the Quest Board dashboard.

Cause. The installed app's service worker (navigateFallback: "/index.html", scope /) answers every navigation on its origin with the app shell unless the path is denylisted, and only /api/, /auth/ and /public/ were. A browser that had visited the dev app therefore loaded /feedback/players as Quest Board, whose router sends unknown paths to /dashboard. Requests without a worker (curl, a fresh browser, the friend's phone) saw the real site, which is why the server-side checks all passed.

Fix. /feedback (and anything under it) joins the navigateFallbackDenylist and gets a NetworkOnly runtime route so its pages and API are never cached either. The built worker was checked to contain the new entry. The comment names the general rule: any non-app path served on this hostname needs the same treatment. Browsers holding the old worker pick up the new one on their next visit (autoUpdate, skipWaiting, clientsClaim) and are right after one reload.

Also. The feedback site's page routes now accept HEAD as well as GET; link previewers and uptime checks probe with HEAD, and a 405 there reads as a dead link. Already deployed on the dev box.

CHANGELOG: one **Fixed** entry.

🤖 Generated with Claude Code

Reported by the owner: opening any page of the design-review feedback site at `questboard-dev.rhoving.com/feedback/…` redirected to the Quest Board dashboard. **Cause.** The installed app's service worker (`navigateFallback: "/index.html"`, scope `/`) answers every navigation on its origin with the app shell unless the path is denylisted, and only `/api/`, `/auth/` and `/public/` were. A browser that had visited the dev app therefore loaded `/feedback/players` as Quest Board, whose router sends unknown paths to `/dashboard`. Requests without a worker (curl, a fresh browser, the friend's phone) saw the real site, which is why the server-side checks all passed. **Fix.** `/feedback` (and anything under it) joins the `navigateFallbackDenylist` and gets a `NetworkOnly` runtime route so its pages and API are never cached either. The built worker was checked to contain the new entry. The comment names the general rule: any non-app path served on this hostname needs the same treatment. Browsers holding the old worker pick up the new one on their next visit (`autoUpdate`, `skipWaiting`, `clientsClaim`) and are right after one reload. **Also.** The feedback site's page routes now accept `HEAD` as well as `GET`; link previewers and uptime checks probe with `HEAD`, and a 405 there reads as a dead link. Already deployed on the dev box. CHANGELOG: one `**Fixed**` entry. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit

2026-09-07 15:10:00 +00:00

fix(frontend): keep the service worker off /feedback/, and let the feedback site answer HEAD (#535 )

CI / Bot/backend version sync (pull_request) Successful in 23s

Details

CI / Backend lint (ruff) (pull_request) Successful in 45s

Details

CI / Docker image build (pull_request) Successful in 41s

Details

CI / Summarisation accuracy eval harness (stub provider) (pull_request) Successful in 1m26s

Details

CI / Bot tests and audit (pull_request) Successful in 2m41s

Details

CI / Frontend tests, audit, and build (pull_request) Successful in 3m10s

Details

CI / Backend migration, tests, and audit (pull_request) Successful in 10m48s

Details

CI / Synthetic session harness (no GPU, no LLM) (pull_request) Successful in 16m17s

Details

fed9c4a782

The installed app's worker answered every navigation on its hostname with
the app shell, so the design-review feedback site the edge proxy serves under
/feedback/ loaded as Quest Board and was bounced to the dashboard by the
router in any browser that had visited the dev app. /feedback is now on the
navigation-fallback denylist and network-only, as /api/, /auth/ and /public/
already were.

The feedback site's page routes also accept HEAD, which link previewers and
uptime checks use; a 405 there reads as a dead link.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

claude-bot scheduled this pull request to auto merge when all checks succeed

2026-09-07 15:10:22 +00:00

claude-bot merged commit 599829efca into main

2026-09-07 15:26:55 +00:00

claude-bot deleted branch fix/pwa-feedback-fallback

2026-09-07 15:26:55 +00:00

claude-bot referenced this pull request from a commit

2026-09-07 15:26:56 +00:00

Merge PR #551: fix(frontend): keep the service worker off /feedback/, and let the feedback site answer HEAD (#535)

claude-bot referenced this pull request

2026-09-07 15:30:19 +00:00

v4.4.0 build order: UX Overhaul in six phases, with two review checkpoints #535