Merge branch 'codex/native-login-handoff' into main

# Conflicts:
#	public/index.html
#	src/bootstrap.ts
#	src/services/chat/service.ts
#	tests/chat-service-username-persist.test.ts

src/services/chat/service.ts

@@ -12,6 +12,7 @@ import type { ActiveChat, ChatMessage, ScrapedChatMessage, InvitationCooldown }
 
 export type { InvitationCooldown } from './types.js';
 import { fetchWithTimeout } from '../../utils/fetch-with-timeout.js';
+import type { AccountAuthGate } from '../account-auth-context.js';
 
 const ACTIVE_WINDOW_MS = 96 * 60 * 60 * 1000;
 const ROOM_URL_PREFIX = 'https://chat.reddit.com/room/';
@@ -131,6 +132,7 @@ export class ChatService {
     cache?: ChatCache,
     private messagesRepo?: MessagesRepository,
     private redditUsersRepo?: RedditUsersRepository,
+    private accountAuth?: AccountAuthGate,
   ) {
     this.cache = cache ?? new ChatCache(logger);
     if (this.redditUsersRepo) {
@@ -178,6 +180,11 @@ export class ChatService {
    * refresh itself fails, we propagate.
    */
   private async withAuth<T>(fn: () => Promise<T>): Promise<T> {
+    if (!this.accountAuth?.isFullyAuthenticated()) {
+      throw new MatrixAuthenticationUnavailableError(
+        new Error('Full account authentication is required'),
+      );
+    }
     try {
       return await fn();
     } catch (err) {
@@ -186,9 +193,15 @@ export class ChatService {
         try {
           await this.tokenRefresher.refresh();
         } catch (refreshError) {
+          this.accountAuth?.invalidate('Matrix authentication could not be restored');
           throw new MatrixAuthenticationUnavailableError(refreshError);
         }
-        return await fn();
+        try {
+          return await fn();
+        } catch (retryError) {
+          this.accountAuth?.invalidate('Matrix authentication was rejected after refresh');
+          throw retryError;
+        }
       }
       throw err;
     }
@@ -461,6 +474,7 @@ export class ChatService {
    * `chat.messages`.
    */
   async loadConversationDetails(chat: ActiveChat): Promise<void> {
+    if (!this.accountAuth?.isFullyAuthenticated()) return;
     return this.loadDetails(chat);
   }
 
@@ -470,6 +484,7 @@ export class ChatService {
    * a raw Matrix room ID like `!abc:reddit.com`.
    */
   async sendChatMessage(chatUrlOrRoomId: string, message: string): Promise<boolean> {
+    if (!this.accountAuth?.isFullyAuthenticated()) return false;
     const active = this.getInvitationCooldown();
     if (active) {
       const secondsLeft = Math.ceil((active.until - Date.now()) / 1000);
@@ -510,6 +525,7 @@ export class ChatService {
    * line. Returns the new chat (or null on failure).
    */
   async startConversation(username: string, message: string): Promise<ActiveChat | null> {
+    if (!this.accountAuth?.isFullyAuthenticated()) return null;
     const active = this.getInvitationCooldown();
     if (active) {
       const secondsLeft = Math.ceil((active.until - Date.now()) / 1000);
@@ -573,7 +589,7 @@ export class ChatService {
    * old Playwright sender; always returns true.
    */
   async verifyMessageSent(_recipient: string, _messageText: string): Promise<boolean> {
-    return true;
+    return this.accountAuth?.isFullyAuthenticated() ?? false;
   }
 
   /**
@@ -1030,6 +1046,10 @@ export class ChatService {
    * cache. Best-effort; safe to await or fire-and-forget.
    */
   async enrichUsernames(): Promise<void> {
+    if (!this.accountAuth?.isFullyAuthenticated()) {
+      this.logger.debug('[chat] username enrichment skipped until full account authentication');
+      return;
+    }
     if (!this.usernameResolver) return;
     let dirty = false;