fix(confirm): allow embedded approval to gain focus

[cyhhao]

Summary

• let a fully visible embedded approval card become interactive before its iframe has focus
• keep the focus check in the synchronous approval-click guard immediately before WebAuthn starts
• cover the mobile lifecycle where the iframe gains focus only after the user taps inside it

Evidence

• Unit: npm test (84 tests)
• Contract: confirmation-surface tests cover unfocused readiness, click-time focus rejection, and focused click acceptance
• Scenario: locked mobile approval can show and enable its action before iframe focus, while Passkey still requires a focused click
• Build: npm run build
• Residual manual check: repeat the protected Vault approval on the deployed regression origin after merge

Security Notes

• visibility, size, intersection, and pending-UI checks still gate button readiness
• document focus and the live surface sample are synchronously revalidated in the user click before WebAuthn

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
vault-sandbox	Ready	Preview, Comment	Jul 13, 2026 10:51am

[cyhhao]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: 8af4f09920

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".