Mobile mobieusKnow editor uses banned native prompt() for link insertion

Area: Cross-cutting infra (audit p14) · Surface: mobile/knowledge/editor.php (markdown toolbar) · Dimension: ui-law · Severity: major

On mobile, tapping the Link button in the mobieusKnow markdown editor pops a native browser prompt() to ask for the URL. Native prompts break the app theme, look like phishing/malware on mobile browsers, and contradict the banned-dialog rule the rest of the codebase follows. The mobile shell has no App.modal, but it has Mobile.confirm; there is no themed prompt yet.

Evidence

platform/templates/mobile/knowledge/editor.php:186 — `var url = prompt('URL:', 'https://'); if (!url) return;` inside insertLink(), wired to the toolbar's data-md-link button (line 107). Native dialogs are explicitly banned (CLAUDE/memory: feedback_no_native_browser_dialogs.md, 'confirm/alert/prompt banned; break theme + look like malware'). The DESKTOP knowledge editor does NOT use a native dialog for the same action — it inserts an editable placeholder via wrapSel('[','](url)') (platform/templates/knowledge/editor.php:144). The mobile shell loads neither app.js nor App.modal, but mobile-v2.js already provides a themed Mobile.confirm.open() (public/js/mobile-v2.js:99) and explicitly notes 'never window.confirm — banned' (line 96), so a native prompt() here is doubly inconsistent.

Suggested fix. Match the desktop editor: insert an editable '[selected](url)' placeholder via the existing wrapSel helper and let the user type the URL inline, OR add a themed Mobile.prompt() helper in mobile-v2.js (sibling to Mobile.confirm.open) and call it instead of prompt().

Filed by the automated tenant-app audit and adversarially evidence-verified. Status: verified. Open — not yet actioned.