fix: gallery layout, OTP auth, account sign-up, rate limiting, Google Ads, web demo key #1

2026-05-05T09:35:30Z

will.anderson commented

2026-05-05 09:35:30 +00:00

Summary

Fix gallery HTML structure bug
Replace email/password auth with OTP flow
Add email/password sign-up to account page
Add Google Ads conversion tracking (AW-18140150015)
Add El source files for all client-side JS
Daily rate limiting for chat demo (10/day per UID, live reset countdown)
Wire dedicated NEURON_LLM_0_KEY for web demo (isolated from main API key)
Remove letter.html
Gitignore all emitted .elh and .html files via wildcard
CI: enforce branch protection and source-branch rules

Deploy path

fix/gallery-layout-account-otp → dev → stage → main

## Summary - Fix gallery HTML structure bug - Replace email/password auth with OTP flow - Add email/password sign-up to account page - Add Google Ads conversion tracking (AW-18140150015) - Add El source files for all client-side JS - Daily rate limiting for chat demo (10/day per UID, live reset countdown) - Wire dedicated `NEURON_LLM_0_KEY` for web demo (isolated from main API key) - Remove letter.html - Gitignore all emitted `.elh` and `.html` files via wildcard - CI: enforce branch protection and source-branch rules ## Deploy path `fix/gallery-layout-account-otp` → dev → stage → main

will.anderson added 7 commits 2026-05-05 09:35:31 +00:00

Fix gallery HTML structure bug and replace email auth with OTP flow 246a5f0967

Gallery: remove <a> from share allowlist. Gallery cards wrap content in
<a class="gal-link">; allowing <a> in sanitized answer HTML causes nested
anchors that the HTML5 adoption agency algorithm resolves by restructuring
the DOM, producing mismatched </div> tags that leave gallery-grid open and
pull sibling elements into the grid as spurious grid columns.

Account: replace email+password sign-up/sign-in with magic-link OTP.
supabase.auth.signInWithOtp handles both new and existing users in one
flow. Existing onAuthStateChange listener (dadeb8ddb9a8.js) retained for
post-redirect dashboard display. sendMagicLink added to extract-js
RESERVED_GLOBALS so the obfuscator does not mangle the onclick reference.

Add El source files for all client-side JS 94f6e749a0

Recovers original JS from git history and ports it into proper El source
files under src/js/. Each file wraps the original JS in a native_js call
inside a main() function, making it valid El that compiles to a
self-contained IIFE via elc --target=js --bundle.

Files added:
  src/js/account-auth.el       - Supabase OTP magic-link (sendMagicLink)
  src/js/account-dashboard.el  - Account dashboard: session, plan card, family
  src/js/chat-widget.el        - Demo chat widget (neuronDemoToggle/Send/Reset)
  src/js/checkout-auth.el      - Checkout auth: OAuth, email sign-in/up
  src/js/checkout-free.el      - Free plan: auth-badge watch -> payment reveal
  src/js/checkout-stripe.el    - Stripe Payment Element (reads NEURON_CFG)
  src/js/enterprise.el         - Enterprise inquiry form + headcount filter
  src/js/environmental.el      - Efficiency calculator slider
  src/js/gallery.el            - Gallery nav, search/sort, Supabase voting
  src/js/main.el               - Share page voting + copyForPlatform
  src/js/marketplace.el        - Developer interest form
  src/js/nav.el                - Nav hamburger + Mission dropdown
  src/js/styles.el             - Landing: nav scroll, reveal, founding counter

Add Google Ads conversion tracking (AW-18140150015) 566cd568b7

Remove letter.html 260ea4edaa

Ignore .elh emitted files 7a3dc94dec

Ignore all emitted HTML files via wildcard 9b69783306

feat(chat): IP-keyed daily rate limit (10/day), live reset countdown, web_demo Anthropic key 70820cf078

will.anderson closed this pull request

2026-05-07 06:20:30 +00:00

tim.lingo referenced this pull request

2026-06-14 14:50:31 +00:00

[P0] Terms §5 overclaims: "cannot read network traffic" is false for first-party inference #156