fix(daemon): isolate empty application state storage - #300
Merged
Merged
Conversation
Resolve the UI directory before extension installation and publish the same path through DaemonState. Remote extensions can now inspect the exact static root used by the local router during install and startup. Co-Authored-By: Nova (GPT-6) <noreply@openai.com>
Discover the versioned host bridge at runtime and install streaming HTTP and WebSocket transports alongside native discovery. Remote URL resolution is confined to the selected daemon's /api/v1 namespace, including encoded path traversal checks, while the bridge carries abortable request streams. Co-Authored-By: Nova (GPT-6) <noreply@openai.com>
Retire request cancellation watchers at EOF and abort pending exchanges on drop. Split browser chunks to each consumer's requested capacity. Socket drops clear JavaScript callbacks before closing. Startup rejects incomplete or malformed bridge contracts before installing transports. Co-Authored-By: Nova (GPT-6) <noreply@openai.com>
Let extension crates detect the browser Remote bridge before app transport initialization, preventing accidental same-origin requests during bootstrap. Pin the current reviewed raw HTML sinks so new injection surfaces fail CI. Co-Authored-By: Nova (GPT-5.6 Sol) <noreply@openai.com>
Render shapes through typed SVG nodes. Load vendor marks as rebased CSS mask assets so tinting works without injected SVG markup. Reject every future inner_html attribute in the UI security gate. Co-Authored-By: Nova (GPT-5.6 Sol) <noreply@openai.com>
Vendor tachys 0.2.18 with a narrow hc-static policy for compiler-generated DOM templates. Validate owned icon SVG against an inert structural grammar before conversion and leave general raw HTML assignments browser-blocked. Create preview workers through the private policy. Only registered blob URLs from embedded static source can become TrustedScriptURL values. Co-Authored-By: Nova (GPT-5.6 Sol) <noreply@openai.com>
Reject escaped paint URLs and limit owned SVG conversion to the SVG renderer. An embedding host can provide the sole static DOM policy so verified service workers and compiler templates share one named policy. Restore all other vendored source bytes to the published tachys package. Keep upstream formatting intact so future patch audits stay narrow.
Downstream tests compile the daemon without cfg(test), so the default application-state builder previously selected the real user directories. Empty-state constructors now own unique temporary storage in every build mode. Explicit storage builders and live daemon composition keep their selected directories. An external integration test proves dependency-mode isolation, independent fixtures, cleanup, and persistence for an explicitly supplied directory. Ambient overrides keep the regression test away from developer data even if the constructor regresses. Co-Authored-By: Nova (GPT-6) <noreply@openai.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (4)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthrough
ChangesAppState isolation
Priority: ⬇️ Low Estimated code review effort: 3 (Moderate) | ~20 minutes Change: Bug fix 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
Comment |
Persistence tests must use the same directory for seeded files and API stores. Pass those paths explicitly now that empty AppState constructors own isolated temporary storage instead of reading ambient overrides. Remove the effect registry fixture's unused global override and lock. The full daemon suite passes with the CI feature set: 1,847 tests.
Bring the merged public transport and CSP base into the isolation branch. The persistence change can now be reviewed directly against main.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this changes
Empty application-state constructors now use unique temporary storage in every build mode. Explicit directory builders and live daemon composition retain their selected storage.
Why
Dependent crates compile the daemon library without
cfg(test). The previous constructor consequently sent downstream tests to the developer's real data and state directories. The temporary directory now belongs to the state and is removed after its stores are dropped.Verification
just verifypasses locally (Rust fmt + lint + test)just denypasses (required for dependency or license changes)just ui-testandjust ui-buildpass (required forcrates/hypercolor-ui/)just sdk-lint,just sdk-check, andjust sdk-buildpass (required forsdk/)just python-verifypasses (required forpython/)just compat-checkpasses (required fordata/drivers/vendors/*.toml)just docs-buildpasses (required for docs or README changes)cd docs && zola checkpasses (required for docs link/content changes)scripts/orpackaging/)just e2e-buildpasses with the normal Servo stack (required for daemon/UI/effect integration changes)just e2e-build-cpupasses when validating the CPU smoke fallbackjust e2epasses against the Servo stack (required for end-to-end behavior changes; starts daemon/browser)The external integration regression, strict Clippy for that target, and rustfmt pass. The regression substitutes disposable ambient directories before constructing any state, so even a future failure cannot touch developer data. It checks independent fixtures, cleanup, and explicit-directory persistence. An independent source review passed.
The full daemon suite passes all 1,847 tests with the CI feature set (
builtin-drivers,persistence-test-hooks). Persistence fixtures now pass their directories explicitly so seeded files and API stores share the intended path. The fixture changes also passed independent review.Notes for reviewers
The host transport and CSP foundation (#299) is merged. This PR targets main and contains the constructor change, its regression test, and persistence fixture updates.
Summary by CodeRabbit
Bug Fixes
Tests