Carlos Florêncio
113 lines
3.7 KiB
Markdown
113 lines
3.7 KiB
Markdown
---
|
|
id: "09-script-capable-preview-e2e"
|
|
title: "Prove script execution and isolation in browsers"
|
|
status: cancelled
|
|
wave: 4
|
|
depends_on:
|
|
- "07-responsive-preview-surfaces"
|
|
plan: "plan.md"
|
|
requirements:
|
|
- REQ-UI-NATIVE-HTML-PREVIEW-001
|
|
acceptance_criteria:
|
|
- AC-UI-NATIVE-HTML-PREVIEW-001.1
|
|
- AC-UI-NATIVE-HTML-PREVIEW-001.2
|
|
- AC-UI-NATIVE-HTML-PREVIEW-001.3
|
|
- AC-UI-NATIVE-HTML-PREVIEW-001.4
|
|
- AC-UI-NATIVE-HTML-PREVIEW-001.5
|
|
- AC-UI-NATIVE-HTML-PREVIEW-001.6
|
|
- AC-UI-NATIVE-HTML-PREVIEW-001.7
|
|
- AC-UI-NATIVE-HTML-PREVIEW-001.8
|
|
- AC-UI-NATIVE-HTML-PREVIEW-001.9
|
|
system_design:
|
|
- ../../specs/ui/system-design/native-html-preview.md
|
|
---
|
|
# Task 09: Prove script execution and isolation in browsers
|
|
|
|
## Summary
|
|
|
|
Replace the static-only browser assertions with causal evidence that inline
|
|
JavaScript executes in the preview runtime while network, credential, and
|
|
navigation capabilities remain unavailable. Repeat the user flow on desktop
|
|
and mobile, then add the required desktop WebView smoke evidence.
|
|
|
|
## In scope
|
|
|
|
- Chromium desktop coverage for inline script output, event-driven mutation,
|
|
runtime failure, source recovery, and same-session restoration.
|
|
- Negative request and navigation assertions for fetch, XHR, WebSocket,
|
|
dynamic links, meta refresh, forms, location, history, downloads, and
|
|
window opening.
|
|
- Mobile Chrome coverage for runtime output, touch target, source recovery, and
|
|
containment.
|
|
- Desktop WebView smoke coverage for the same request and navigation policy.
|
|
|
|
## Out of scope
|
|
|
|
- Broad E2E suite execution.
|
|
- Other browser engines and executor types.
|
|
- Review-diff, multi-file, remote-resource, or Browser-panel tests.
|
|
|
|
## Acceptance
|
|
|
|
- Desktop Chromium proves a script changes visible output and a user event
|
|
reaches the virtual runtime.
|
|
- Causal request and frame-state assertions prove blocked network and
|
|
navigation attempts do not leave the preview or contact an external origin.
|
|
- Mobile Chrome and desktop WebView prove the same safe entry, recovery, and
|
|
responsive behavior.
|
|
|
|
## Verification
|
|
|
|
```bash
|
|
make build-web
|
|
cd apps/web
|
|
pnpm e2e:raw --project=chromium tests/chat/html-preview.spec.ts
|
|
pnpm e2e:raw --project=mobile-chrome tests/task/mobile-html-preview.spec.ts
|
|
cd ../desktop
|
|
pnpm e2e
|
|
```
|
|
|
|
## Files likely touched
|
|
|
|
- `apps/web/e2e/tests/chat/html-preview.spec.ts`
|
|
- `apps/web/e2e/tests/task/mobile-html-preview.spec.ts`
|
|
- `apps/web/e2e/pages/session-page.ts`
|
|
- `apps/desktop/e2e/desktop-launch-smoke.mjs` or a focused WebView test.
|
|
|
|
## Dependencies
|
|
|
|
Task 07 supplies the runtime-backed responsive surface and stable selectors.
|
|
|
|
## Risks
|
|
|
|
- A test that only observes the final DOM can miss a request made before the
|
|
runtime snapshot arrives. Request listeners and frame-state assertions must
|
|
be causal and installed before preview activation.
|
|
- Chromium and WebView may differ in worker, blob, and resource behavior.
|
|
|
|
## Parallelism
|
|
|
|
`parallel-safe` with Task 08 after Task 07.
|
|
|
|
## Inputs
|
|
|
|
- The revised acceptance criteria `.3` through `.9`.
|
|
- The browser verification strategy and security invariants in the system
|
|
design.
|
|
- Existing desktop and mobile HTML preview fixtures from the superseded work.
|
|
|
|
## Results
|
|
|
|
Replaced the static iframe assertions with runtime-backed Chromium and mobile
|
|
coverage. The tests prove inline script output, event-driven mutation, inert
|
|
links and forms, blocked dynamic resources and navigation, source recovery,
|
|
same-session saved-source restoration, touch sizing, and page containment.
|
|
|
|
Verification completed:
|
|
|
|
```text
|
|
pnpm e2e:raw --project=chromium tests/chat/html-preview.spec.ts: 1 passed
|
|
pnpm e2e:raw --project=mobile-chrome tests/task/mobile-html-preview.spec.ts: 1 passed
|
|
pnpm e2e (desktop): build and WebView launch smoke passed
|
|
```
|