kandev/docs/plans/native-html-preview/task-09-script-capable-preview-e2e.md

id, title, status, wave, depends_on, plan, requirements, acceptance_criteria, system_design

id	title	status	wave	depends_on	plan	requirements	acceptance_criteria	system_design
09-script-capable-preview-e2e	Prove script execution and isolation in browsers	cancelled	4	07-responsive-preview-surfaces	plan.md	REQ-UI-NATIVE-HTML-PREVIEW-001	AC-UI-NATIVE-HTML-PREVIEW-001.1 AC-UI-NATIVE-HTML-PREVIEW-001.2 AC-UI-NATIVE-HTML-PREVIEW-001.3 AC-UI-NATIVE-HTML-PREVIEW-001.4 AC-UI-NATIVE-HTML-PREVIEW-001.5 AC-UI-NATIVE-HTML-PREVIEW-001.6 AC-UI-NATIVE-HTML-PREVIEW-001.7 AC-UI-NATIVE-HTML-PREVIEW-001.8 AC-UI-NATIVE-HTML-PREVIEW-001.9	../../specs/ui/system-design/native-html-preview.md

Task 09: Prove script execution and isolation in browsers

Summary

Replace the static-only browser assertions with causal evidence that inline JavaScript executes in the preview runtime while network, credential, and navigation capabilities remain unavailable. Repeat the user flow on desktop and mobile, then add the required desktop WebView smoke evidence.

In scope

• Chromium desktop coverage for inline script output, event-driven mutation, runtime failure, source recovery, and same-session restoration.
• Negative request and navigation assertions for fetch, XHR, WebSocket, dynamic links, meta refresh, forms, location, history, downloads, and window opening.
• Mobile Chrome coverage for runtime output, touch target, source recovery, and containment.
• Desktop WebView smoke coverage for the same request and navigation policy.

Out of scope

• Broad E2E suite execution.
• Other browser engines and executor types.
• Review-diff, multi-file, remote-resource, or Browser-panel tests.

Acceptance

• Desktop Chromium proves a script changes visible output and a user event reaches the virtual runtime.
• Causal request and frame-state assertions prove blocked network and navigation attempts do not leave the preview or contact an external origin.
• Mobile Chrome and desktop WebView prove the same safe entry, recovery, and responsive behavior.

Verification

make build-web
cd apps/web
pnpm e2e:raw --project=chromium tests/chat/html-preview.spec.ts
pnpm e2e:raw --project=mobile-chrome tests/task/mobile-html-preview.spec.ts
cd ../desktop
pnpm e2e

Files likely touched

• apps/web/e2e/tests/chat/html-preview.spec.ts
• apps/web/e2e/tests/task/mobile-html-preview.spec.ts
• apps/web/e2e/pages/session-page.ts
• apps/desktop/e2e/desktop-launch-smoke.mjs or a focused WebView test.

Dependencies

Task 07 supplies the runtime-backed responsive surface and stable selectors.

Risks

• A test that only observes the final DOM can miss a request made before the runtime snapshot arrives. Request listeners and frame-state assertions must be causal and installed before preview activation.
• Chromium and WebView may differ in worker, blob, and resource behavior.

Parallelism

parallel-safe with Task 08 after Task 07.

Inputs

• The revised acceptance criteria .3 through .9.
• The browser verification strategy and security invariants in the system design.
• Existing desktop and mobile HTML preview fixtures from the superseded work.

Results

Replaced the static iframe assertions with runtime-backed Chromium and mobile coverage. The tests prove inline script output, event-driven mutation, inert links and forms, blocked dynamic resources and navigation, source recovery, same-session saved-source restoration, touch sizing, and page containment.

Verification completed:

pnpm e2e:raw --project=chromium tests/chat/html-preview.spec.ts: 1 passed
pnpm e2e:raw --project=mobile-chrome tests/task/mobile-html-preview.spec.ts: 1 passed
pnpm e2e (desktop): build and WebView launch smoke passed