[terencecho]

Re-inviting a removed reviewer now uses the revision returned by the grant list on its first request. Revoked entries stay hidden from the active list. Cached revisions are scoped to backend, account and project; older servers and stale revisions retain conflict recovery, and lost-response retries reuse the exact operation already sent.

Capability reads also reject review-spaces responses without a valid workspace list, so a malformed response cannot enable sharing. Empty lists remain valid and flags require explicit boolean true.

Validation: all 48 shared-kernel tests pass, including 13 new regressions for re-invites, pagination, retries, scope isolation and workspace-response validation. Seven regression cases fail without their respective fixes. Declaration build, lint, formatting and normal commit hooks passed. CI and CodeQL are running on the combined head.

No live backend invitations or packaged application acceptance were exercised. No visual change.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
hyperframes	🟢 Ready	View Preview	Nov 10, 2026, 12:47 AM

💡 Tip: Enable Automations to automatically generate PRs for you.

[jrusso1020]

Reviewed at b644eac82aef99a0ef505cb878447ab965f54a20.

No blocker found. reviewClient.mjs:207–219 reads all grant pages with revoked rows included, installs the revision cache only after a complete read, and keeps revoked rows out of the active list. :223–247 preserves explicit revisions, consumes the cached revision for a new invite, and retains the exact generated operation/body for an ambiguous lost-response retry. Existing regrantOf/rejectedGrantRequest behavior still handles older-server and stale-revision conflicts without an unbounded retry. Backend/account/project scopes remain separate; authorization remains on the server.

Validation: /home/ubuntu/workspaces/pytest-gate.sh node --test --test-concurrency=1 tests/*.test.mjs in packages/share on Node 22.22.3: 43 PASS. Running the eight new regrant cases against the merge-base reviewClient.mjs gives 3 FAIL / 5 PASS; restored head source has no diff. Fresh independent adversarial pass also covered transport failures, final refusals and pagination. All three changed files and the shared request/refusal consumers were read. No live backend invite or packaged-app acceptance was exercised; no full workspace build repeated. Hosted checks were still running when checked.

Need: yes · Size: ok · Reuse: existing regrantOf/rejectedGrantRequest and grant-list pagination · Simpler: reuse the listed revision before the existing conflict fallback · Structure: fine (checked prior grantCreator, existing managementClient pagination and signedInRequest; no split)
Risk: medium — changes revision and idempotency handling for review access grants.

— hf-review

Verdict: APPROVE
Reasoning: The direct re-invite optimization preserves conflict recovery and exact retry identity, with scoped cache replacement and discriminating regressions.

[jrusso1020]

Reviewed at 00d25628d279f0bc7b8596622c57da02a66c83a7.

No blocker found in the delta since my approval at b644eac. packages/share/src/reviewClient.mjs:95 applies the existing spaces() malformed-list check to reviewFlags(): missing/non-array items throw 502 malformed_spaces, while an empty array remains valid. Capability flags still require literal true; HTTP refusals and transport failures keep their existing paths. The prior regrant implementation is unchanged.

Validation: /home/ubuntu/workspaces/pytest-gate.sh <Node 22.22.3> --test --test-concurrency=1 tests/*.test.mjs in packages/share: 48 PASS. Running the five new flag cases with the previously approved reviewClient gives 4 FAIL / 1 PASS; head source restored with git diff --exit-code. Read both changed files in full, the shared request and wire contracts; a fresh independent adversarial pass found no new blocker. This checkout has no production reviewFlags caller, so external host UI behavior and live backend/packaged-app acceptance were not exercised. No full workspace build or typecheck repeated. Hosted checks are still running; no green-CI claim.

Need: yes · Size: ok · Reuse: existing spaces() validation and ReviewFailed · Simpler: one matching boundary check · Structure: fine (checked spaces()/dataOf and signedInRequest; no split)
Risk: medium — the full PR changes revision/idempotency handling for access grants; this delta tightens capability response validation.

— hf-review

Verdict: APPROVE
Reasoning: Malformed capability responses now fail consistently with the workspace read, while empty lists and explicit-boolean flag semantics remain compatible.