mirror of
https://github.com/stablyai/orca.git
synced 2026-10-18 08:03:22 +00:00
Merge remote-tracking branch 'origin/main' into fix-updater-instance-guards
This commit is contained in:
Brennan Benson
@@ -472,7 +472,10 @@ jobs:
|
||||
# message and tag name explicitly (avoids npm's `v1.2.3` prefix
|
||||
# assumptions and any lifecycle scripts that would run on bump).
|
||||
npm version "$VERSION" --no-git-tag-version --allow-same-version
|
||||
git add package.json
|
||||
# Why: package version is embedded in generated skill provenance; full tag
|
||||
# history preserves released snapshots while the current version is updated.
|
||||
node config/scripts/generate-skill-bundle-manifest.mjs --write
|
||||
git add package.json resources/skills
|
||||
commit_message="release: v$VERSION"
|
||||
if [[ "$EVENT_NAME" == "schedule" ]]; then
|
||||
commit_message="$commit_message [rc-slot:$SLOT]"
|
||||
|
||||
@@ -374,16 +374,28 @@ describe('Electron runtime package contract', () => {
|
||||
expect(afterInstallScript).not.toContain('chmod 0755 "$sandbox"')
|
||||
})
|
||||
|
||||
it('lets release-cut tag a version that is already present on main', () => {
|
||||
it('keeps release-cut version commits self-healing and taggable on retries', () => {
|
||||
const releaseWorkflow = readFileSync(
|
||||
join(projectDir, '.github/workflows/release-cut.yml'),
|
||||
'utf8'
|
||||
)
|
||||
const parsedWorkflow = parse(releaseWorkflow)
|
||||
const checkoutStep = parsedWorkflow.jobs.cut.steps.find((step) => step.name === 'Checkout ref')
|
||||
const bumpStep = parsedWorkflow.jobs.cut.steps.find(
|
||||
(step) => step.name === 'Bump package.json and tag'
|
||||
)
|
||||
|
||||
const bumpIndex = bumpStep.run.indexOf(
|
||||
'npm version "$VERSION" --no-git-tag-version --allow-same-version'
|
||||
)
|
||||
const generateIndex = bumpStep.run.indexOf(
|
||||
'node config/scripts/generate-skill-bundle-manifest.mjs --write'
|
||||
)
|
||||
const stageIndex = bumpStep.run.indexOf('git add package.json resources/skills')
|
||||
expect(checkoutStep.with['fetch-depth']).toBe(0)
|
||||
expect(bumpIndex).toBeGreaterThanOrEqual(0)
|
||||
expect(generateIndex).toBeGreaterThan(bumpIndex)
|
||||
expect(stageIndex).toBeGreaterThan(generateIndex)
|
||||
expect(bumpStep.run).toContain('git diff --cached --quiet')
|
||||
expect(bumpStep.run).toContain('git commit --allow-empty -m "$commit_message"')
|
||||
})
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" width="113" height="20" role="img" aria-label="downloads: 5.8m">
|
||||
<title>downloads: 5.8m</title>
|
||||
<svg xmlns="http://www.w3.org/2000/svg" width="113" height="20" role="img" aria-label="downloads: 5.9m">
|
||||
<title>downloads: 5.9m</title>
|
||||
<linearGradient id="s" x2="0" y2="100%">
|
||||
<stop offset="0" stop-color="#bbb" stop-opacity=".1"/>
|
||||
<stop offset="1" stop-opacity=".1"/>
|
||||
@@ -15,7 +15,7 @@
|
||||
<g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="11">
|
||||
<text x="37" y="15" fill="#010101" fill-opacity=".3">downloads</text>
|
||||
<text x="37" y="14">downloads</text>
|
||||
<text x="93.5" y="15" fill="#010101" fill-opacity=".3">5.8m</text>
|
||||
<text x="93.5" y="14">5.8m</text>
|
||||
<text x="93.5" y="15" fill="#010101" fill-opacity=".3">5.9m</text>
|
||||
<text x="93.5" y="14">5.9m</text>
|
||||
</g>
|
||||
</svg>
|
||||
|
||||
|
Before Width: | Height: | Size: 943 B After Width: | Height: | Size: 943 B |
@@ -0,0 +1,926 @@
|
||||
# Built-in Browser Local HTTPS and Certificate Trust
|
||||
|
||||
## Status
|
||||
|
||||
Implemented reference design for
|
||||
[issue #8454](https://github.com/stablyai/orca/issues/8454).
|
||||
|
||||
The branch includes scheme-less local-dev URL classification, certificate-specific
|
||||
failure copy, `Try HTTPS`, exact per-WebContents certificate grants,
|
||||
`Proceed Anyway (Unsafe)`, local IPC, remote/headless runtime propagation, and
|
||||
focused unit and real-Electron coverage. A session-level request gate contains
|
||||
Chromium's cached certificate continuation so approval cannot leak to sibling
|
||||
tabs, assets, fetches, iframes, or WebSockets. The release gates below remain
|
||||
the acceptance contract for Electron upgrades and cross-platform validation.
|
||||
|
||||
## Summary
|
||||
|
||||
Orca's built-in browser cannot open a local HTTPS development server when the
|
||||
server presents an untrusted certificate. A scheme-less local address also
|
||||
defaults to HTTP, so entering `localhost:3000` does not discover an HTTPS-only
|
||||
server.
|
||||
|
||||
This design keeps HTTP as the default for the scheme-less local forms that
|
||||
already use it, adds a visible `Try HTTPS` recovery action after a failed local
|
||||
HTTP navigation, and adds an explicit `Proceed Anyway (Unsafe)` path for an
|
||||
untrusted local HTTPS certificate. Certificate approval is narrow and
|
||||
temporary: it is bound to one browser WebContents, one secure endpoint, the
|
||||
SHA-256 digest of the exact leaf certificate, and the specific certificate
|
||||
error. A secure endpoint treats `https` and its companion `wss` scheme as one
|
||||
TLS endpoint but still includes the canonical hostname and effective port. No
|
||||
approval state is persisted.
|
||||
|
||||
The certificate decision runs in the process that owns the browser page. Local
|
||||
desktop webviews use the desktop main process; SSH/headless pages use the remote
|
||||
runtime process and expose the decision through runtime RPC.
|
||||
|
||||
## Problem
|
||||
|
||||
There are three independent behaviors behind the current failure.
|
||||
|
||||
1. `normalizeBrowserNavigationUrl` and the tab-create entry classifier prepend
|
||||
`http://` to scheme-less loopback input. Explicit `https://` input is already
|
||||
preserved.
|
||||
2. Electron rejects an untrusted server certificate by default. Orca has no
|
||||
`certificate-error` decision flow, so a self-signed development certificate
|
||||
fails with a Chromium certificate error such as
|
||||
`ERR_CERT_AUTHORITY_INVALID (-202)`.
|
||||
3. Browser load errors are presented as generic connectivity failures. For a
|
||||
loopback URL, Orca advises the user to check that the server is running even
|
||||
when the server responded and only certificate verification failed.
|
||||
|
||||
The same trust limitation exists in the offscreen browser backend used by
|
||||
headless and SSH-owned browser pages. A desktop-only handler would fix the
|
||||
visible local webview while leaving remote browser ownership inconsistent.
|
||||
|
||||
## Goals
|
||||
|
||||
- Show certificate-specific failure copy for main-frame certificate errors.
|
||||
- Let a user explicitly approve an untrusted local development certificate.
|
||||
- Bind approval to the exact browser surface, secure endpoint, leaf certificate
|
||||
digest, and certificate error.
|
||||
- Keep approval in memory only and clear it with the owning browser surface.
|
||||
- Support both desktop webviews and SSH/headless offscreen browser pages.
|
||||
- Give scheme-less local input a discoverable path to HTTPS without silently
|
||||
changing the existing HTTP default.
|
||||
- Preserve the current browser sandbox, navigation allowlist, session profiles,
|
||||
and mixed-content policy.
|
||||
- Keep browser failure state accurate across event-order races, early webview
|
||||
attachment, reload, stale user actions, and remote latency.
|
||||
|
||||
## Non-goals
|
||||
|
||||
- Do not automatically trust a self-signed certificate.
|
||||
- Do not disable `webSecurity`, enable insecure mixed content, or add
|
||||
`--ignore-certificate-errors`.
|
||||
- Do not install a certificate into the operating-system trust store.
|
||||
- Do not persist certificate exceptions across app restarts, browser surface
|
||||
recreation, or session-profile changes.
|
||||
- Do not default every scheme-less localhost URL to HTTPS.
|
||||
- Do not automatically probe HTTPS and then downgrade to HTTP.
|
||||
- Do not add a general-purpose exception flow for public websites in v1.
|
||||
- Do not make every Chromium certificate error overridable in v1.
|
||||
- Do not extend localhost worktree-label proxying to HTTPS targets.
|
||||
|
||||
## Product Decisions
|
||||
|
||||
### Scheme-less local input continues to use HTTP
|
||||
|
||||
`localhost:3000` remains `http://localhost:3000/`. HTTP is still the common
|
||||
development-server default, and changing the inference globally would turn
|
||||
working HTTP servers into certificate or TLS failures.
|
||||
|
||||
When an HTTP navigation to a loopback URL fails, the browser failure overlay
|
||||
offers `Try HTTPS`. The action replaces only the URL scheme and preserves the
|
||||
host, explicit non-default port, path, query, and fragment. An absent port, or
|
||||
an explicit `:80` normalized away by the URL parser, becomes HTTPS's default
|
||||
port 443. Orca does not automatically retry because an invisible
|
||||
cross-protocol retry would add latency, send an unexpected second request, and
|
||||
make downgrade behavior opaque.
|
||||
|
||||
Explicit input remains authoritative:
|
||||
|
||||
- `http://localhost:3000` stays HTTP.
|
||||
- `https://localhost:3000` stays HTTPS.
|
||||
- URLs advertised by a workspace process keep their advertised scheme.
|
||||
|
||||
The shared browser URL domain becomes the source of truth for the existing
|
||||
scheme-less local-dev classification. The tab-create entry classifier calls
|
||||
that shared logic instead of keeping a second regular expression and scheme
|
||||
rule. This consolidation must not reuse the stricter certificate-eligibility
|
||||
predicate: doing so would change current behavior for inputs such as
|
||||
`0.0.0.0`, bracketed non-loopback IPv6 addresses, and `.localhost` subdomains.
|
||||
|
||||
### V1 approval covers untrusted local authorities only
|
||||
|
||||
The first version offers `Proceed Anyway (Unsafe)` only when all of these are
|
||||
true:
|
||||
|
||||
- the failure is for the main frame;
|
||||
- the attempted URL is HTTPS;
|
||||
- Electron reports `net::ERR_CERT_AUTHORITY_INVALID`, corresponding to
|
||||
Chromium load error `-202`;
|
||||
- the host is an eligible loopback host;
|
||||
- the WebContents is a browser surface managed by Orca; and
|
||||
- Orca retained a live pending challenge for that browser surface.
|
||||
|
||||
Other certificate errors receive accurate copy but no bypass action. In
|
||||
particular, v1 does not bypass revoked certificates, malformed certificates,
|
||||
weak keys, date errors, or hostname/SAN mismatches. Expanding the allowlist
|
||||
requires a separate security decision and dedicated tests.
|
||||
|
||||
### Eligible loopback hosts
|
||||
|
||||
The shared predicate accepts:
|
||||
|
||||
- `localhost`, case-insensitively, with an optional trailing dot;
|
||||
- valid subdomains of `.localhost`, also with an optional trailing dot;
|
||||
- valid IPv4 addresses in `127.0.0.0/8`; and
|
||||
- IPv6 loopback `::1`.
|
||||
|
||||
The predicate does not treat `0.0.0.0`, `::`, arbitrary bracketed IPv6
|
||||
addresses, private LAN addresses, or a DNS name that merely resolves to
|
||||
loopback as certificate-bypass eligible. Wildcard bind addresses should already
|
||||
be normalized to a connectable loopback address before navigation.
|
||||
|
||||
SSH local forwards are eligible when their browser-facing URL uses one of these
|
||||
loopback hosts. Forwarding does not fix certificate names: a URL using
|
||||
`127.0.0.1` still needs an IP SAN for `127.0.0.1`; a certificate containing only
|
||||
`localhost` will fail with `ERR_CERT_COMMON_NAME_INVALID`, which v1 does not
|
||||
bypass. Custom advertised DNS names remain subject to normal system trust in
|
||||
v1, even if the name maps to loopback.
|
||||
|
||||
### Approval lifetime
|
||||
|
||||
An accepted grant is scoped to:
|
||||
|
||||
```text
|
||||
browser WebContents ID + secure endpoint + leaf SHA-256 digest + error name
|
||||
```
|
||||
|
||||
The secure endpoint canonicalizes `wss:` to its companion `https:` endpoint and
|
||||
includes the normalized hostname and effective port. This lets an approved
|
||||
local page load same-endpoint HTTPS assets and its WSS development socket. A
|
||||
grant for `https://localhost:3000` does not apply to port 3001, to
|
||||
`https://127.0.0.1:3000`, to another browser tab, or to a replacement
|
||||
certificate.
|
||||
|
||||
Construct the secure endpoint from the parsed request URL: map `https:` and
|
||||
`wss:` to `https:`, lowercase the hostname, remove one optional trailing dot,
|
||||
use the URL parser's canonical IP representation, and use port 443 when the
|
||||
parsed port is empty. Exclude credentials, path, query, and fragment. Reject
|
||||
every other scheme.
|
||||
|
||||
Accepted grants survive reloads and same-surface navigation back to the exact
|
||||
endpoint. They are cleared when the WebContents commits a main-frame navigation
|
||||
whose canonical secure endpoint differs from the grant's endpoint (reusing the
|
||||
per-WebContents navigation-sequence tracking), when the WebContents is destroyed
|
||||
or replaced, the session profile changes, the browser-owning process exits, or
|
||||
the app restarts. Binding grant lifetime to the granting main-frame document
|
||||
prevents a later top-level document in the same tab — for example a navigation
|
||||
to a public site — from silently reusing the loopback grant for a same-endpoint
|
||||
iframe, fetch, or WSS subrequest.
|
||||
Clearing a grant affects future requests; it cannot retroactively terminate a
|
||||
document that already loaded. Grants are not written to settings, browser
|
||||
history, workspace session state, or logs.
|
||||
|
||||
Chromium caches an accepted `certificate-error` continuation across the
|
||||
Electron session partition. Orca therefore retains every endpoint/certificate
|
||||
identity accepted in that partition until the browser-owning process exits and
|
||||
gates all later HTTPS/WSS requests with `webRequest.onBeforeRequest`. Only the
|
||||
WebContents holding the matching grant may reach a cached endpoint. A sibling
|
||||
main-frame navigation receives a synthetic challenge for the known identity;
|
||||
sibling subresources, fetches, iframes, workers, and WSS requests fail silently.
|
||||
|
||||
Because a preflight request gate cannot inspect the certificate that will be
|
||||
presented after Chromium's cache is consulted, one endpoint is locked to the
|
||||
first accepted untrusted leaf identity for that process lifetime. If that
|
||||
endpoint later presents a different untrusted leaf, strict verification rejects
|
||||
it and Orca does not offer another bypass until the browser-owning process
|
||||
restarts. A replacement system-trusted certificate may load normally; the
|
||||
conservative request gate still keeps sibling WebContents blocked until restart.
|
||||
|
||||
## User Experience
|
||||
|
||||
### Local HTTP failure
|
||||
|
||||
For a failed `http://` loopback navigation, keep the current connectivity
|
||||
title and recovery hint. Add `Try HTTPS` when an HTTPS form can be constructed.
|
||||
|
||||
Example:
|
||||
|
||||
```text
|
||||
Can't reach localhost:3000
|
||||
We couldn't connect to your local server.
|
||||
|
||||
[Try HTTPS] [Retry] [Copy Address] [Open Externally]
|
||||
```
|
||||
|
||||
`Try HTTPS` is the default button because it is the targeted recovery action
|
||||
for a local HTTP failure. Keep the existing `Copy Address` recovery action;
|
||||
`Retry` uses `outline`, while `Copy Address` and `Open Externally` stay quiet
|
||||
secondary actions. `Try HTTPS` does not appear for an already-HTTPS URL or a
|
||||
non-eligible host.
|
||||
|
||||
### Certificate failure
|
||||
|
||||
For `ERR_CERT_AUTHORITY_INVALID (-202)` on an eligible local endpoint, replace
|
||||
the generic connectivity content with:
|
||||
|
||||
```text
|
||||
Connection isn't secure
|
||||
Orca doesn't trust the authority that issued the certificate for localhost:3000.
|
||||
|
||||
For local development, use a trusted local certificate when possible.
|
||||
|
||||
[Open Externally] [Retry] [Copy Address] [Proceed Anyway (Unsafe)]
|
||||
```
|
||||
|
||||
- `Open Externally` is the default safe recovery action when the URL is
|
||||
reachable from the desktop.
|
||||
- When `Open Externally` is unavailable, `Retry` becomes the default action.
|
||||
- `Proceed Anyway (Unsafe)` uses `outline`; `Copy Address` stays quiet.
|
||||
- `Proceed Anyway (Unsafe)` is always visibly labeled; it is not hidden behind
|
||||
a tooltip.
|
||||
- The unsafe action does not use the destructive color. It does not delete or
|
||||
irreversibly mutate user data, and the explicit label carries the warning.
|
||||
- Use a muted `ShieldAlert` icon from `lucide-react`; do not add a warning color
|
||||
or new token.
|
||||
|
||||
For a remote-owned page whose URL is remote localhost, `Open Externally` is
|
||||
hidden because the desktop system browser cannot reach the remote loopback
|
||||
address. It remains available for a desktop-owned page or a locally forwarded
|
||||
URL.
|
||||
|
||||
For certificate errors that v1 does not permit bypassing, show the same
|
||||
certificate-specific title with error-specific body text, `Retry`,
|
||||
`Copy Address`, and an eligible `Open Externally` action. `Copy Address` remains
|
||||
present as a quiet secondary action in every certificate-failure branch,
|
||||
eligible or not, so only `Try HTTPS` and `Proceed Anyway (Unsafe)` toggle in and
|
||||
out across cases. The same default-action rule applies as for `-202`:
|
||||
`Open Externally` is the default when the URL is reachable from the desktop,
|
||||
otherwise `Retry` becomes the default. Do not show the local-server-running
|
||||
hint.
|
||||
|
||||
Use this presentation mapping, inserting the display host into the copy:
|
||||
|
||||
| Chromium code | Body copy | Proceed in v1 |
|
||||
| ----------------------- | -------------------------------------------------------------------------- | ----------------------------- |
|
||||
| `-200` | `The certificate doesn't match {host}.` | No |
|
||||
| `-201` | `The certificate for {host} isn't valid at the current date and time.` | No |
|
||||
| `-202` | `Orca doesn't trust the authority that issued the certificate for {host}.` | Eligible local endpoints only |
|
||||
| Other certificate error | `Orca couldn't verify the certificate for {host}.` | No |
|
||||
|
||||
Keep the raw error name/code available to diagnostics and optional details, but
|
||||
do not make users interpret it to understand the primary failure.
|
||||
|
||||
### Interaction behavior
|
||||
|
||||
- The overlay is persistent inline UI because the user must read and act on the
|
||||
failure; do not use a toast.
|
||||
- The overlay does not steal focus when it appears.
|
||||
- Actions are reachable by Tab and have visible focus rings.
|
||||
- Use `aria-live="polite"`; repeated background failures must not repeatedly
|
||||
announce the same message.
|
||||
- Clicking `Proceed Anyway (Unsafe)` disables the action immediately, and also
|
||||
disables the other overlay actions (`Retry`, `Try HTTPS`, `Copy Address`,
|
||||
`Open Externally`) for the duration of the approval round-trip so a stale
|
||||
click cannot race the controller's own `loadURL`. Re-enable them once a
|
||||
success or typed-failure response returns.
|
||||
- Map every `proceedCertificate` failure reason to an overlay outcome:
|
||||
`expired`, `changed`, `ineligible`, and `missing` keep the overlay open and
|
||||
show the inline recovery message below; `navigated` shows no message because
|
||||
the overlay for that navigation is already cleared. In every non-success case
|
||||
`Proceed Anyway (Unsafe)` stays disabled until a fresh pending challenge is
|
||||
announced rather than re-enabling on its own.
|
||||
- Delay the spinner by 200 ms, matching the style guide's remote-latency rule.
|
||||
After that delay, show the canonical `Loader2` with `Connecting…` and use a
|
||||
fixed button width so the label swap cannot move adjacent actions.
|
||||
- If approval expired or the certificate changed, keep the overlay open and
|
||||
show `The certificate changed or the approval expired. Retry the page.`
|
||||
- A successful main-frame navigation clears the visible certificate failure.
|
||||
|
||||
The UI must use existing `background`, `foreground`, `muted-foreground`,
|
||||
`border`, and `ring` tokens plus the existing shadcn `Button` primitive. No new
|
||||
color, radius, or shadow tier is required. Do not apply a blanket opacity to
|
||||
the overlay's interactive content; use semantic muted text classes so button
|
||||
and focus-ring contrast remains intact. Put every new user-visible string
|
||||
through the existing localization catalog.
|
||||
|
||||
## Architecture
|
||||
|
||||
### Ownership
|
||||
|
||||
The browser-owning main process is the only authority that can accept a
|
||||
certificate challenge.
|
||||
|
||||
- Desktop-owned `<webview>` pages are controlled by the desktop main process.
|
||||
- Headless/SSH-owned pages are controlled by the remote `orca serve` main
|
||||
process through `OffscreenBrowserBackend`.
|
||||
- The renderer only presents a pending challenge and requests approval. It
|
||||
never decides whether a certificate is trusted.
|
||||
|
||||
### New main-process controller
|
||||
|
||||
Add `src/main/browser/browser-certificate-trust-controller.ts` to manage pending
|
||||
certificate challenges, and
|
||||
`src/main/browser/browser-certificate-request-guard.ts` to manage grants plus
|
||||
the session-level cached-certificate request boundary.
|
||||
|
||||
The controller owns:
|
||||
|
||||
```ts
|
||||
type BrowserCertificateFailure = {
|
||||
challengeId: string
|
||||
browserPageId: string
|
||||
errorCode: number | null
|
||||
error: string
|
||||
origin: string
|
||||
displayHost: string
|
||||
canProceed: boolean
|
||||
observedAt: number
|
||||
}
|
||||
|
||||
type PendingBrowserCertificateChallenge = {
|
||||
challengeId: string
|
||||
guestWebContentsId: number
|
||||
browserPageId: string | null
|
||||
navigationSequence: number
|
||||
navigationUrl: string
|
||||
origin: string
|
||||
secureEndpoint: string
|
||||
leafCertificateSha256: string
|
||||
errorCode: number | null
|
||||
error: string
|
||||
expiresAt: number
|
||||
}
|
||||
|
||||
type BrowserCertificateGrant = {
|
||||
guestWebContentsId: number
|
||||
secureEndpoint: string
|
||||
leafCertificateSha256: string
|
||||
error: string
|
||||
}
|
||||
```
|
||||
|
||||
Generate challenge IDs with `randomUUID()`. Compute the certificate identity in
|
||||
the browser-owning main process as SHA-256 over the DER bytes of Electron's leaf
|
||||
`certificate.data`; do not depend on the undocumented formatting or algorithm
|
||||
of `certificate.fingerprint`. Renderer and runtime payloads expose no
|
||||
certificate bytes or digest—only the challenge ID, display host, origin, error
|
||||
code, error name, `canProceed`, and observation time.
|
||||
|
||||
Pending challenges expire after five minutes and are bounded to 32 entries.
|
||||
Accepted grants are bounded to 32 entries per browser-owning process and are
|
||||
also removed with their WebContents. Bounds evict the oldest entry and notify
|
||||
the affected UI when a live challenge is evicted. Ordinary cleanup should keep
|
||||
both collections much smaller. Accepted endpoint identities are not evicted:
|
||||
Chromium's corresponding cache cannot be cleared narrowly, so forgetting one
|
||||
would reopen cross-WebContents access until process exit.
|
||||
|
||||
### Certificate event handling
|
||||
|
||||
Register exactly one app-level `certificate-error` listener after Electron is
|
||||
ready but before either a desktop window or the offscreen backend can create a
|
||||
browser page. Every branch must call Electron's callback exactly once; an
|
||||
unexpected exception fails closed with `callback(false)`.
|
||||
|
||||
Electron supplies the certificate error as a string on this event, while
|
||||
`did-fail-load` supplies the Chromium number later. Normalize the string to one
|
||||
canonical error name and map only known names to numbers for presentation. An
|
||||
unknown name keeps `errorCode: null` and is never bypass-eligible.
|
||||
|
||||
For every event:
|
||||
|
||||
1. Resolve the WebContents through `BrowserManager` and reject unmanaged,
|
||||
retired, or popup WebContents.
|
||||
2. Parse the request URL, normalize its secure endpoint, and compute the leaf
|
||||
certificate SHA-256 digest. Invalid data fails closed.
|
||||
3. Compare the normalized error name, endpoint, and digest against an accepted
|
||||
grant for this exact WebContents. On an exact match, first retain the accepted
|
||||
identity in the owning Electron session, then call `event.preventDefault()`
|
||||
and `callback(true)`.
|
||||
4. If no grant matches, reject non-main-frame failures without creating a
|
||||
challenge. Subresources and iframes can consume an existing grant but cannot
|
||||
mint one.
|
||||
5. For a main-frame failure, record a pending challenge only when the URL and
|
||||
error are eligible. Notify the owning page when its page ID is known, then
|
||||
call `callback(false)`.
|
||||
|
||||
Track a monotonically increasing main-frame navigation sequence per
|
||||
WebContents. A new main-frame navigation invalidates its pending challenge in
|
||||
both main and renderer state before the next certificate decision. Repeated
|
||||
identical events within one sequence reuse the challenge ID; a retry or a
|
||||
different navigation gets a new ID. This prevents an old button or compromised
|
||||
renderer from approving a page the user has already left.
|
||||
|
||||
The first failure is always rejected. User approval records a grant and reloads
|
||||
the page; the next certificate event is the one that succeeds.
|
||||
|
||||
Do not leave Electron's callback pending while waiting for user input. Rejecting
|
||||
first gives Orca a normal load-failure lifecycle, avoids an unbounded blocked
|
||||
navigation, and makes stale approval cleanup deterministic.
|
||||
|
||||
Do not use `session.setCertificateVerifyProc`. It applies to an entire session
|
||||
partition, cannot bind a decision to one browser page, and verification results
|
||||
can be cached by Chromium's network service.
|
||||
|
||||
### Session request gate and Electron upgrade guard
|
||||
|
||||
The pinned Electron 43 binary caches `callback(true)` broadly enough that a
|
||||
second WebContents in the same partition can load the endpoint without another
|
||||
`certificate-error` event. The certificate callback alone is therefore not an
|
||||
isolation boundary.
|
||||
|
||||
Install exactly one `webRequest.onBeforeRequest` listener on every Orca browser
|
||||
session before its first page loads. Electron permits only one listener for this
|
||||
event, so the browser session registry owns installation and removal. Once an
|
||||
endpoint identity has been accepted, the listener blocks every HTTPS/WSS
|
||||
request to that endpoint unless `details.webContentsId` has the matching grant.
|
||||
Requests without a WebContents ID, including background/worker traffic, fail
|
||||
closed. A blocked main-frame request recreates the challenge and certificate
|
||||
load error; other resource types are canceled without replacing the current
|
||||
page's overlay.
|
||||
|
||||
The real-Electron integration suite must prove same-tab reload, same-endpoint
|
||||
HTTPS assets and WSS, different-tab documents and subresources, and
|
||||
different-port isolation against the exact Electron version in
|
||||
`pnpm-lock.yaml`. Any Electron upgrade that breaks those tests blocks release
|
||||
until the design is revised; unit mocks are insufficient.
|
||||
|
||||
### BrowserManager integration
|
||||
|
||||
Add a narrow BrowserManager query API instead of exposing its internal maps:
|
||||
|
||||
```ts
|
||||
getManagedBrowserGuestContext(webContentsId: number): {
|
||||
browserPageId: string | null
|
||||
worktreeId: string | null
|
||||
sessionProfileId: string | null
|
||||
owner: 'desktop-webview' | 'offscreen'
|
||||
} | null
|
||||
```
|
||||
|
||||
For guest lifecycle, follow the existing extracted-controller precedent
|
||||
(`browser-grab-session-controller.ts`, `browser-guest-ui.ts`,
|
||||
`browser-download-destination.ts`), all of which BrowserManager drives by
|
||||
calling a plain method on the controller directly from `registerGuest` /
|
||||
`unregisterGuest`. Have BrowserManager call
|
||||
`certificateTrustController.onGuestRegistered({ browserPageId, webContentsId })`
|
||||
and `.onGuestRetired(webContentsId)` from those same bodies, rather than adding a
|
||||
new listener/emitter registration API to BrowserManager — there is no such
|
||||
pub-sub surface in `src/main/browser` today and this single consumer does not
|
||||
warrant introducing one.
|
||||
|
||||
`getManagedBrowserGuestContext` must recognize an attached primary desktop
|
||||
guest before renderer registration, returning a null page ID, while rejecting
|
||||
popup descendants that merely inherited browser policies. It must also
|
||||
recognize offscreen pages after `registerOffscreenGuest` and stop recognizing a
|
||||
guest immediately when BrowserManager retires or unregisters it. The controller
|
||||
re-checks this ownership on every certificate event even if it still has an
|
||||
in-memory grant.
|
||||
|
||||
An attached desktop webview can encounter a certificate error before its
|
||||
document reaches `dom-ready`, which is when BrowserPane currently registers the
|
||||
guest. Keep pending challenges keyed by WebContents ID until registration
|
||||
supplies the page ID, then flush the failure to the renderer.
|
||||
|
||||
BrowserPane should also register idempotently on the webview's `did-attach`
|
||||
event, with `dom-ready` retained as a fallback. `registerGuest` should report
|
||||
whether the main process accepted the registration so a rare attach-policy race
|
||||
can retry at `dom-ready`; the renderer must not cache the WebContents ID as
|
||||
registered until it receives `true`.
|
||||
|
||||
Offscreen pages already register before `loadURL`, so their page ID is normally
|
||||
available when the certificate event fires. Bring their main-frame navigation
|
||||
and `did-fail-load` observation under the same BrowserManager lifecycle used by
|
||||
desktop guests; the current offscreen loader only logs a rejected `loadURL`, so
|
||||
it cannot by itself populate runtime failure snapshots.
|
||||
|
||||
### Renderer state
|
||||
|
||||
Certificate challenges are transient runtime state and must not be added to
|
||||
the persisted `BrowserPage` schema.
|
||||
|
||||
Add a transient map to the browser store:
|
||||
|
||||
```ts
|
||||
browserCertificateFailuresByPageId: Record<string, BrowserCertificateFailure>
|
||||
```
|
||||
|
||||
The workspace session serializer must omit this map. Clear an entry when:
|
||||
|
||||
- the page completes a successful main-frame navigation;
|
||||
- the user starts a different navigation;
|
||||
- the page or workspace closes;
|
||||
- the owning browser WebContents is replaced; or
|
||||
- the main process reports that the challenge expired.
|
||||
|
||||
The existing `BrowserLoadError` remains the persisted diagnostic source. Add a
|
||||
pure Chromium-error classifier for Electron 43's certificate range (`-200`
|
||||
through `-219`, excluding the unused values) so certificate failures still
|
||||
render accurate copy after restore even when no live challenge exists. A live
|
||||
certificate failure's error code takes presentation precedence over a
|
||||
synthesized `-1` Chromium-error-page fallback. Independently, only a live,
|
||||
matching challenge controls whether `Proceed Anyway (Unsafe)` is enabled.
|
||||
|
||||
Use both the page ID and attempted origin when combining the live challenge
|
||||
with `BrowserLoadError`. A stale challenge from a prior navigation must never
|
||||
add a proceed action to a different failure. Main-process navigation-sequence
|
||||
invalidation is the security boundary; renderer cleanup is defense in depth and
|
||||
keeps the UI honest.
|
||||
|
||||
### Local IPC
|
||||
|
||||
Extend the browser preload API with:
|
||||
|
||||
```ts
|
||||
onCertificateFailureChanged(
|
||||
callback: (event: {
|
||||
browserPageId: string
|
||||
failure: BrowserCertificateFailure | null
|
||||
}) => void
|
||||
): () => void
|
||||
|
||||
proceedCertificate(args: {
|
||||
browserPageId: string
|
||||
challengeId: string
|
||||
}): Promise<
|
||||
| { ok: true }
|
||||
| {
|
||||
ok: false
|
||||
reason: 'expired' | 'changed' | 'ineligible' | 'missing' | 'navigated'
|
||||
}
|
||||
>
|
||||
```
|
||||
|
||||
Register the handler with the existing browser IPC group and reuse
|
||||
`isTrustedBrowserRenderer`. The main process resolves the page to its current
|
||||
WebContents and then consumes the exact pending challenge. Renderer-provided
|
||||
origin, error code, or certificate identity are never trusted.
|
||||
|
||||
On success, main consumes the challenge, records the grant, and calls
|
||||
`loadURL` with the challenge's main-owned `navigationUrl`. It must not use
|
||||
`webContents.getURL()`, which may be `chrome-error://chromewebdata/` or a
|
||||
previously committed page. It also must not reload if the page's current
|
||||
navigation sequence no longer matches the challenge. The renderer does not
|
||||
assign `webview.src` as a second side effect.
|
||||
|
||||
### Remote runtime RPC
|
||||
|
||||
The remote browser owner exposes equivalent behavior through:
|
||||
|
||||
```text
|
||||
browser.certificate.proceed
|
||||
```
|
||||
|
||||
with the runtime worktree selector, remote browser page ID, and challenge ID.
|
||||
Advertise support through a new `browser.certificate-trust.v1` capability only
|
||||
when the runtime has both a browser backend and the certificate controller.
|
||||
Keep the method out of the mobile-scope RPC allowlist; it is for an
|
||||
authenticated runtime-scope Orca client presenting browser chrome, not a guest
|
||||
page or unauthenticated caller.
|
||||
|
||||
Extend `RuntimeMobileSessionBrowserTab` compatibly with optional `loadError`
|
||||
and `certificateFailure` fields. Both are emitted from live runtime state.
|
||||
`loadError` keeps the existing `BrowserPage` last-known diagnostic semantics,
|
||||
including workspace persistence; `certificateFailure` is transient and is
|
||||
never written to workspace persistence. Controller changes, challenge expiry,
|
||||
navigation, and offscreen `did-fail-load` must mark the runtime session snapshot
|
||||
dirty so clients do not wait for unrelated state to change. Web clients and
|
||||
desktop clients reconcile these fields through the existing remote page-handle
|
||||
mapping. Each full snapshot replaces the prior transient certificate failure
|
||||
for that page, including clearing it when the field is absent. An older runtime
|
||||
without the capability always clears any previously mirrored proceed action.
|
||||
|
||||
When the active page has a remote owner, BrowserPane routes approval to that
|
||||
environment. It must not call local desktop IPC. If the runtime lacks the new
|
||||
capability, the UI still classifies the certificate failure accurately but does
|
||||
not render `Proceed Anyway (Unsafe)`. `Try HTTPS`, retry, and other navigation
|
||||
actions continue through the existing owner-aware navigation path rather than
|
||||
touching a local webview for a remote-owned page.
|
||||
|
||||
### Scheme recovery
|
||||
|
||||
Add pure functions in the shared browser URL domain:
|
||||
|
||||
```ts
|
||||
classifySchemeLessLocalDevAddress(rawInput: string): URL | null
|
||||
isEligibleLocalCertificateHost(hostname: string): boolean
|
||||
toHttpsRecoveryUrl(rawUrl: string): string | null
|
||||
```
|
||||
|
||||
`classifySchemeLessLocalDevAddress` preserves the exact current HTTP-default
|
||||
input set and is shared by address-bar normalization and tab-create entry. It
|
||||
is deliberately broader than certificate eligibility.
|
||||
|
||||
`isEligibleLocalCertificateHost` accepts a parsed/canonical hostname; normalize
|
||||
case and an optional trailing dot and handle the brackets returned by
|
||||
`URL.hostname` for IPv6. Validate IPv4 octets and DNS label boundaries instead
|
||||
of using a substring or loose suffix check.
|
||||
|
||||
`toHttpsRecoveryUrl` returns a value only for an HTTP URL with an eligible
|
||||
loopback host. It changes `protocol` to `https:` on a parsed `URL` object and
|
||||
preserves credentials, hostname, an explicit non-default port, path, query, and
|
||||
fragment. When no port is present, including when the parsed HTTP URL normalized
|
||||
`:80` away, the result uses HTTPS's default port 443. It never probes either
|
||||
protocol.
|
||||
|
||||
Both address-bar submission and tab-create entry use the shared local-address
|
||||
classifier. Existing advertised workspace-port URLs remain authoritative and
|
||||
require no new probing.
|
||||
|
||||
## Security Model
|
||||
|
||||
### Invariants
|
||||
|
||||
- Default certificate verification remains strict.
|
||||
- Only a trusted Orca renderer or authenticated runtime-scope Orca client can
|
||||
request approval.
|
||||
- The renderer cannot choose the origin, certificate digest, error,
|
||||
WebContents, or eligibility result.
|
||||
- A grant is exact-match only and never applies across tabs, ports,
|
||||
certificates, or browser-owning processes.
|
||||
- Session-cached accepted endpoints remain request-gated until process exit,
|
||||
even after their original WebContents or bounded grant is removed.
|
||||
- Certificate PEM/DER data and certificate digests do not enter workspace
|
||||
state, history, telemetry, or ordinary logs.
|
||||
- Subresource and iframe certificate failures cannot mint an approval action;
|
||||
they can consume an already-approved exact-endpoint grant on the same
|
||||
WebContents.
|
||||
- The proceed affordance exists only in Orca chrome; guest content has no
|
||||
direct approval channel. Main-process challenge validation remains the
|
||||
security boundary and does not assume proof of a physical click.
|
||||
- A remote client cannot approve a certificate in a different runtime
|
||||
environment.
|
||||
- Starting another main-frame navigation invalidates the pending approval in
|
||||
the browser-owning process, not only in renderer state.
|
||||
|
||||
### Threat cases
|
||||
|
||||
| Threat | Required behavior |
|
||||
| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------- |
|
||||
| Compromised web page sends forged IPC | Guest WebContents has no preload API; trusted-renderer check rejects it. |
|
||||
| Compromised renderer invents a challenge | Main consumes only a server-created pending challenge tied to the current page and WebContents. |
|
||||
| Certificate changes after approval | Leaf-digest mismatch rejects; a second untrusted leaf for that endpoint cannot be bypassed until restart. |
|
||||
| Same host uses a different port | Secure-endpoint mismatch rejects. |
|
||||
| Another tab visits the approved endpoint | WebContents mismatch rejects. |
|
||||
| Approved tab later loads a foreign top document | Grant is invalidated when the main frame navigates to a different endpoint; the new document cannot reuse it. |
|
||||
| Challenge is replayed | Challenge ID is single-use and expires. |
|
||||
| User leaves the failed page before clicking | Navigation-sequence mismatch rejects without reloading the stale URL. |
|
||||
| Approved page opens same-endpoint WSS/HMR | Existing endpoint grant permits it; WSS cannot create a grant by itself. |
|
||||
| Public site presents an untrusted certificate | Host eligibility fails; no proceed action is available. |
|
||||
| Remote page approval is sent locally | Ownership routing and remote page handles select the browser-owning runtime. |
|
||||
| App restarts after approval | No persisted grant exists. |
|
||||
|
||||
## Failure Handling
|
||||
|
||||
- If a certificate event arrives before guest registration, retain it by
|
||||
WebContents ID and flush after registration.
|
||||
- If guest registration never completes, expire the pending challenge without
|
||||
notifying unrelated pages.
|
||||
- If `Proceed` arrives after expiry, navigation, or WebContents replacement,
|
||||
return a typed failure and leave strict verification in place.
|
||||
- If reload fails for a different reason, clear the certificate challenge and
|
||||
present the new load error.
|
||||
- If the same rejected challenge fires repeatedly in one navigation, coalesce
|
||||
it without rotating the challenge ID or stacking announcements.
|
||||
- If the certificate-error listener cannot parse the URL or leaf certificate,
|
||||
reject normally and do not offer approval.
|
||||
- If the remote connection drops during approval, keep the local UI stable and
|
||||
surface the runtime error inline after the latency threshold.
|
||||
- If an unexpected controller error occurs, call Electron's callback once with
|
||||
`false`; never leave the request suspended.
|
||||
- If an accepted main-frame page later opens a new same-endpoint TLS connection,
|
||||
apply the exact grant to that HTTPS/WSS subrequest. Reject unmatched
|
||||
subrequests silently without replacing the main-frame overlay.
|
||||
- If an accepted endpoint presents a different untrusted leaf, reject it without
|
||||
replacing the process-lifetime accepted identity or offering a second bypass.
|
||||
|
||||
## Data and Privacy
|
||||
|
||||
No migration is required.
|
||||
|
||||
Add no new product analytics in v1. Do not record URLs, certificate digests,
|
||||
challenge IDs, certificate subjects, or approval results. If product analytics
|
||||
becomes a requirement later, define coarse actions in the existing typed
|
||||
feature-interaction catalog as a separate reviewed change.
|
||||
|
||||
Existing diagnostics may retain the Chromium numerical error code, as they do
|
||||
for other browser load failures. Debug logging must contain at most the error
|
||||
name, page ID, owner kind, and normalized loopback host class; omit query
|
||||
strings, full URLs, and certificate digests.
|
||||
|
||||
## Test Plan
|
||||
|
||||
### Shared URL tests
|
||||
|
||||
- Explicit HTTP and HTTPS local URLs remain unchanged.
|
||||
- Scheme-less `localhost`, IPv4 loopback, and IPv6 loopback still normalize to
|
||||
HTTP.
|
||||
- Tab-create and address-bar local-address classification stay in parity for
|
||||
the full legacy set, including wildcard and bracketed IPv6 inputs.
|
||||
- The broader scheme-less classifier is not accidentally substituted for the
|
||||
stricter certificate-eligibility predicate.
|
||||
- `toHttpsRecoveryUrl` preserves host, an explicit non-default port, path,
|
||||
query, and fragment; a URL with no parsed port changes from HTTP's default 80
|
||||
to HTTPS's default 443.
|
||||
- `Try HTTPS` is unavailable for HTTPS, file URLs, public hosts, wildcard bind
|
||||
hosts, private LAN hosts, and invalid URLs.
|
||||
- Loopback eligibility covers `localhost`, trailing-dot localhost,
|
||||
`.localhost` subdomains with and without a trailing dot, the full valid IPv4
|
||||
127/8 range, and bracketed or unbracketed `::1` after URL parsing.
|
||||
- Reject malformed IPv4, arbitrary bracketed IPv6, `0.0.0.0`, `::`, and names
|
||||
that only contain the word `localhost`.
|
||||
|
||||
### Main-process trust-controller tests
|
||||
|
||||
- Unmanaged, retired, and popup WebContents are rejected without pending
|
||||
challenges.
|
||||
- A managed `-202` loopback failure creates one pending challenge and calls
|
||||
`callback(false)`.
|
||||
- Every event path calls its callback exactly once; only an accepted grant calls
|
||||
`preventDefault()` and `callback(true)`.
|
||||
- The digest is SHA-256 over DER leaf bytes and is stable across PEM formatting.
|
||||
- An exact accepted grant covers same-endpoint HTTPS assets, WSS, and iframes on
|
||||
the same WebContents without allowing those requests to mint a challenge.
|
||||
- Wrong page, WebContents, origin, port, certificate digest, error type, and
|
||||
challenge ID fail closed.
|
||||
- A token is single-use and expires after five minutes.
|
||||
- Repeated identical failures in one navigation coalesce; a new navigation
|
||||
invalidates the token and rotates the challenge ID.
|
||||
- Approving after navigation returns `navigated` and never reloads the old URL.
|
||||
- Approval loads the main-owned challenged URL, not the current Chromium error
|
||||
URL or a renderer-supplied URL.
|
||||
- Certificate rotation fails closed and cannot replace the process-lifetime
|
||||
accepted endpoint identity.
|
||||
- WebContents destruction removes pending challenges and grants.
|
||||
- Bounds evict the oldest pending challenge/grant.
|
||||
- Registering a page after an early certificate event flushes the event to the
|
||||
correct renderer.
|
||||
- Concurrent tabs and session profiles remain isolated.
|
||||
|
||||
### IPC and runtime tests
|
||||
|
||||
- Browser certificate IPC rejects untrusted senders and malformed arguments.
|
||||
- Renderer-supplied origin or certificate-identity fields are neither accepted
|
||||
nor used.
|
||||
- Local approval reloads only the currently mapped guest.
|
||||
- Remote approval calls the owning environment's RPC with the remote page ID.
|
||||
- Local IPC is not called for a remote-owned page.
|
||||
- Mobile-scope runtime clients cannot call the approval method.
|
||||
- Older runtimes without `browser.certificate-trust.v1` never show an enabled
|
||||
proceed action.
|
||||
- Runtime snapshots carry live load errors and certificate failure state,
|
||||
publish immediately on changes, and do not add certificate challenges to
|
||||
persisted session schemas.
|
||||
- A snapshot that omits or clears a challenge removes the mirrored proceed
|
||||
action rather than leaving a stale one behind.
|
||||
- Two runtime environments with identical page IDs cannot approve each other's
|
||||
challenge.
|
||||
|
||||
### Renderer tests
|
||||
|
||||
- `-202` renders certificate-specific copy and no server-running hint.
|
||||
- A live certificate challenge still wins when Chromium's error-page fallback
|
||||
produced diagnostic code `-1`.
|
||||
- A live eligible challenge renders `Proceed Anyway (Unsafe)`.
|
||||
- A restored `-202` load error without a live challenge remains accurate but
|
||||
cannot proceed.
|
||||
- Other certificate errors render accurate copy without v1 bypass.
|
||||
- Local HTTP failures render `Try HTTPS`; HTTPS and non-loopback failures do not.
|
||||
- Starting a new navigation clears stale certificate state.
|
||||
- Success clears the overlay.
|
||||
- Proceed disables immediately, delays the spinner, and preserves its width.
|
||||
- Expired/changed responses show the inline recovery message.
|
||||
- Keyboard focus and `aria-live` behavior do not regress the address bar.
|
||||
- `Copy Address` remains available, interactive content is not blanket-dimmed,
|
||||
and all new strings are present in the localization catalog.
|
||||
|
||||
### Electron integration
|
||||
|
||||
Run a local HTTPS server with a generated certificate whose SAN includes
|
||||
`localhost` but whose authority is not trusted.
|
||||
|
||||
1. `https://localhost:<port>` fails with `-202` and shows certificate copy.
|
||||
2. `Proceed Anyway (Unsafe)` reloads and renders the page.
|
||||
3. HTTPS assets and a WSS echo/HMR endpoint on the same host and port load after
|
||||
approval; a different-port asset remains blocked.
|
||||
4. Reload in the same tab remains allowed without broadening the grant.
|
||||
5. A second tab using the same session profile, origin, and certificate remains
|
||||
blocked. This is a release-blocking assertion against the pinned Electron
|
||||
binary, not a mocked controller test.
|
||||
6. Navigating away before clicking makes the old challenge unusable and does
|
||||
not pull the tab back to the failed URL.
|
||||
7. Replacing the certificate keeps the original tab blocked and offers no
|
||||
second bypass until the browser-owning process restarts.
|
||||
8. Closing and recreating the browser surface removes the grant.
|
||||
9. Restarting Orca removes the grant.
|
||||
10. A system-trusted local certificate loads without an interstitial.
|
||||
11. A public/non-loopback untrusted origin has no proceed action.
|
||||
12. A hostname/SAN mismatch shows certificate copy but no proceed action.
|
||||
13. `localhost:<port>` first attempts HTTP and its failure offers `Try HTTPS`.
|
||||
|
||||
Repeat the ownership-sensitive cases for:
|
||||
|
||||
- a local desktop webview;
|
||||
- an SSH local port forward opened in the desktop browser, using a certificate
|
||||
whose SAN matches the browser-facing forwarded hostname; and
|
||||
- a headless/offscreen browser page owned by `orca serve` under Linux/Xvfb.
|
||||
|
||||
## Implementation Plan
|
||||
|
||||
1. Add the shared scheme-less local classifier, strict certificate-host
|
||||
predicate, secure-endpoint canonicalizer, and HTTPS-recovery function with
|
||||
focused tests.
|
||||
2. Consolidate address-bar and tab-create local classification without changing
|
||||
current scheme defaults.
|
||||
3. Add BrowserManager ownership/registration/retirement hooks, early
|
||||
`did-attach` registration with a `dom-ready` fallback, and offscreen load
|
||||
failure observation.
|
||||
4. Add shared certificate failure/result types and the main-process trust
|
||||
controller, including navigation-sequence invalidation and the app-level
|
||||
listener. Its certificate-event handling resolves ownership through the
|
||||
BrowserManager hooks from step 3, so those must land first.
|
||||
5. Add local IPC, preload APIs, and transient renderer state.
|
||||
6. Add the certificate-specific classification and copy as new exported
|
||||
functions/branches in the existing `browser-notices.ts` (which already owns
|
||||
load-failure copy via `formatLoadFailureDescription` /
|
||||
`formatLoadFailureRecoveryHint`), and extract only the overlay JSX into a
|
||||
focused `browser-load-failure-overlay.tsx` module instead of growing the
|
||||
already grandfathered `BrowserPane.tsx`; do not add or extend a max-lines
|
||||
disable.
|
||||
7. Add certificate-specific and `Try HTTPS` UI, preserve existing recovery
|
||||
actions, and update the localization catalog.
|
||||
8. Add the offscreen/runtime capability, live snapshot fields and publication,
|
||||
and approval RPC.
|
||||
9. Add unit, IPC, renderer, runtime, and real-Electron integration coverage.
|
||||
10. Run formatting, typecheck, lint, localization verification, targeted tests,
|
||||
and cross-platform manual validation.
|
||||
|
||||
## Rollout
|
||||
|
||||
No feature flag is required for accurate error copy or `Try HTTPS` because both
|
||||
paths preserve strict certificate verification.
|
||||
|
||||
The proceed path should ship only after desktop and offscreen ownership tests
|
||||
pass. If remote runtime support cannot land in the same release, gate the
|
||||
button on `browser.certificate-trust.v1`; local desktop support may ship while
|
||||
older/remote owners retain accurate error copy and trusted-CA guidance.
|
||||
|
||||
Do not close issue #8454 until a packaged build has been validated against a
|
||||
real self-signed local HTTPS server. Unit mocks alone do not establish Electron
|
||||
certificate-event ordering.
|
||||
|
||||
## UI Quality Bar
|
||||
|
||||
- Follow `docs/STYLEGUIDE.md` and the adjacent browser failure overlay.
|
||||
- Use only existing semantic tokens, shadcn buttons, and lucide icons.
|
||||
- Keep the overlay quiet and monochrome; certificate failure must not introduce
|
||||
an amber warning treatment.
|
||||
- Copy must distinguish connection, DNS, and certificate failures without
|
||||
claiming more than the Chromium error proves.
|
||||
- Buttons must remain on one line at supported pane widths or wrap as one
|
||||
deliberate group without overlap.
|
||||
- Validate light/dark mode, macOS/Windows/Linux font metrics, and 200 ms remote
|
||||
latency.
|
||||
- Capture review evidence for local HTTP failure, eligible certificate failure,
|
||||
ineligible certificate failure, accepted certificate, and the same browser
|
||||
chrome after recovery.
|
||||
|
||||
## Release Gates and Open Risks
|
||||
|
||||
- The pinned Electron binary must prove that the session request gate blocks a
|
||||
second tab, sibling HTTPS subresources/WSS, and a second port even when
|
||||
Chromium does not re-emit `certificate-error`. If any isolation assertion
|
||||
fails, omit the proceed path or redesign it around a dedicated ephemeral
|
||||
partition; do not silently widen the grant.
|
||||
- Same-endpoint WSS and fresh HTTPS subresource connections must work after
|
||||
approval. A main document that renders while HMR/API traffic remains blocked
|
||||
does not fix the local-development use case.
|
||||
- A remote/headless certificate failure must reach the client as both accurate
|
||||
load-error copy and a live challenge. Logging a rejected offscreen `loadURL`
|
||||
is not sufficient.
|
||||
- Stale approval must be rejected in the browser-owning process after any new
|
||||
main-frame navigation, including when renderer cleanup or a remote snapshot
|
||||
is delayed.
|
||||
- SSH-forward validation must use a certificate whose SAN matches the
|
||||
browser-facing hostname. Authority bypass must not mask a hostname mismatch.
|
||||
- The app-level listener and real-certificate tests must pass on macOS, Windows,
|
||||
and Linux/Xvfb. Platform trust-store differences do not justify enabling a
|
||||
broader error allowlist.
|
||||
|
||||
## Review Decisions and Follow-ups
|
||||
|
||||
### From 2026-07-12 review
|
||||
|
||||
- The integrated browser is part of the development workflow (including
|
||||
automation, annotations, and remote ownership), so `Open Externally` and trusted
|
||||
local-certificate guidance remain safer alternatives but do not replace an
|
||||
explicit in-browser decision.
|
||||
- V1 intentionally limits approval to `ERR_CERT_AUTHORITY_INVALID (-202)`.
|
||||
Hostname/SAN, date, revoked, and malformed-certificate failures remain blocked;
|
||||
broadening that set requires a separate security review and real-certificate
|
||||
tests.
|
||||
- Raw error details remain available to existing diagnostics rather than adding a
|
||||
new disclosure affordance to the quiet recovery overlay.
|
||||
@@ -141,7 +141,6 @@ import {
|
||||
saveCustomKeys,
|
||||
type CustomKey
|
||||
} from '../../../../src/components/CustomKeyModal'
|
||||
import { buildMobileDiffLines } from '../../../../src/session/mobile-diff-lines'
|
||||
import {
|
||||
addMobileDiffComment,
|
||||
formatDiffComments,
|
||||
@@ -177,7 +176,7 @@ import { useMobileTerminalPaste } from '../../../../src/session/use-mobile-termi
|
||||
import { useTerminalLiveInputModePreference } from '../../../../src/session/use-terminal-live-input-mode-preference'
|
||||
import { MobileTerminalLiveInputStatus } from '../../../../src/session/MobileTerminalLiveInputStatus'
|
||||
import { MobileTerminalInputActions } from '../../../../src/session/MobileTerminalInputActions'
|
||||
import { classifyMobileArtifact } from '../../../../src/session/mobile-artifact-kind'
|
||||
import { resolveMobileFileTabDoc } from '../../../../src/files/mobile-file-tab-doc'
|
||||
import { openMobileTerminalFileTap } from '../../../../src/session/mobile-terminal-file-tap-open'
|
||||
import { useLiveWorktreeName } from '../../../../src/session/use-live-worktree-name'
|
||||
import {
|
||||
@@ -2043,93 +2042,12 @@ export default function SessionScreen() {
|
||||
}
|
||||
setFileDocs((prev) => new Map(prev).set(tab.id, { status: 'loading' }))
|
||||
try {
|
||||
if (tab.diffSource === 'staged' || tab.diffSource === 'unstaged') {
|
||||
const response = await client.sendRequest('git.diff', {
|
||||
worktree: `id:${worktreeId}`,
|
||||
filePath: tab.relativePath,
|
||||
staged: tab.diffSource === 'staged'
|
||||
})
|
||||
if (!response.ok) {
|
||||
throw new Error((response as RpcFailure).error.message)
|
||||
}
|
||||
const result = (response as RpcSuccess).result as
|
||||
| {
|
||||
kind: 'text'
|
||||
originalContent: string
|
||||
modifiedContent: string
|
||||
}
|
||||
| { kind: 'binary' }
|
||||
if (result.kind !== 'text') {
|
||||
throw new Error('binary_file')
|
||||
}
|
||||
const diff = buildMobileDiffLines(result.originalContent, result.modifiedContent)
|
||||
setFileDocs((prev) =>
|
||||
new Map(prev).set(tab.id, {
|
||||
status: 'ready',
|
||||
kind: 'diff',
|
||||
lines: diff.lines,
|
||||
truncated: diff.truncated
|
||||
})
|
||||
)
|
||||
return
|
||||
}
|
||||
const artifactKind = classifyMobileArtifact(tab.relativePath)
|
||||
if (artifactKind === 'image') {
|
||||
const preview = await client.sendRequest('files.readPreview', {
|
||||
worktree: `id:${worktreeId}`,
|
||||
relativePath: tab.relativePath
|
||||
})
|
||||
if (!preview.ok) {
|
||||
throw new Error((preview as RpcFailure).error.message)
|
||||
}
|
||||
const result = (preview as RpcSuccess).result as {
|
||||
content: string
|
||||
isImage?: boolean
|
||||
mimeType?: string
|
||||
}
|
||||
if (!result.isImage || !result.mimeType || result.content.length === 0) {
|
||||
throw new Error('binary_file')
|
||||
}
|
||||
setFileDocs((prev) =>
|
||||
new Map(prev).set(tab.id, {
|
||||
status: 'ready',
|
||||
kind: 'image',
|
||||
dataUri: `data:${result.mimeType};base64,${result.content}`
|
||||
})
|
||||
)
|
||||
return
|
||||
}
|
||||
const response = await client.sendRequest('files.read', {
|
||||
worktree: `id:${worktreeId}`,
|
||||
relativePath: tab.relativePath
|
||||
const doc = await resolveMobileFileTabDoc(client, {
|
||||
worktreeId,
|
||||
relativePath: tab.relativePath,
|
||||
diffSource: tab.diffSource
|
||||
})
|
||||
if (!response.ok) {
|
||||
throw new Error((response as RpcFailure).error.message)
|
||||
}
|
||||
const result = (response as RpcSuccess).result as {
|
||||
content: string
|
||||
truncated: boolean
|
||||
byteLength: number
|
||||
}
|
||||
if (artifactKind === 'html') {
|
||||
setFileDocs((prev) =>
|
||||
new Map(prev).set(tab.id, {
|
||||
status: 'ready',
|
||||
kind: 'html',
|
||||
content: result.content
|
||||
})
|
||||
)
|
||||
return
|
||||
}
|
||||
setFileDocs((prev) =>
|
||||
new Map(prev).set(tab.id, {
|
||||
status: 'ready',
|
||||
kind: 'file',
|
||||
content: result.content,
|
||||
truncated: result.truncated,
|
||||
byteLength: result.byteLength
|
||||
})
|
||||
)
|
||||
setFileDocs((prev) => new Map(prev).set(tab.id, doc))
|
||||
} catch (err) {
|
||||
const message = err instanceof Error ? err.message : ''
|
||||
const previewMessage =
|
||||
|
||||
@@ -0,0 +1,123 @@
|
||||
import { describe, expect, it } from 'vitest'
|
||||
import { mobileDiffImageDataUri } from './mobile-diff-image-preview'
|
||||
|
||||
describe('mobileDiffImageDataUri', () => {
|
||||
it('renders a modified image diff from the post-change bytes', () => {
|
||||
expect(
|
||||
mobileDiffImageDataUri({
|
||||
kind: 'binary',
|
||||
originalContent: 'b2xk',
|
||||
modifiedContent: 'bmV3',
|
||||
isImage: true,
|
||||
mimeType: 'image/png'
|
||||
})
|
||||
).toBe('data:image/png;base64,bmV3')
|
||||
})
|
||||
|
||||
it('renders an added image diff (no original) from the modified bytes', () => {
|
||||
expect(
|
||||
mobileDiffImageDataUri({
|
||||
kind: 'binary',
|
||||
originalContent: '',
|
||||
modifiedContent: 'bmV3',
|
||||
isImage: true,
|
||||
mimeType: 'image/png'
|
||||
})
|
||||
).toBe('data:image/png;base64,bmV3')
|
||||
})
|
||||
|
||||
it('falls back to the original bytes for a proven deletion (modifiedDeleted)', () => {
|
||||
expect(
|
||||
mobileDiffImageDataUri({
|
||||
kind: 'binary',
|
||||
originalContent: 'b2xk',
|
||||
originalIsBinary: true,
|
||||
modifiedContent: '',
|
||||
modifiedIsBinary: false,
|
||||
modifiedDeleted: true,
|
||||
isImage: true,
|
||||
mimeType: 'image/jpeg'
|
||||
})
|
||||
).toBe('data:image/jpeg;base64,b2xk')
|
||||
})
|
||||
|
||||
// The reviewer's read-failure case: a relay/SSH read returns an empty modified
|
||||
// side with modifiedIsBinary false and no modifiedDeleted flag. Without a proven
|
||||
// deletion, falling back to the original would show a stale pre-change image, so
|
||||
// "unavailable" (null) is the honest result.
|
||||
it('returns null on a read failure (empty modified, no modifiedDeleted flag)', () => {
|
||||
expect(
|
||||
mobileDiffImageDataUri({
|
||||
kind: 'binary',
|
||||
originalContent: 'b2xk',
|
||||
originalIsBinary: true,
|
||||
modifiedContent: '',
|
||||
modifiedIsBinary: false,
|
||||
isImage: true,
|
||||
mimeType: 'image/png'
|
||||
})
|
||||
).toBeNull()
|
||||
})
|
||||
|
||||
// Guards the >size-cap case: the modified side IS a binary image but its bytes
|
||||
// arrive empty. Falling back to the original would render the stale pre-change
|
||||
// image; "unavailable" is the honest result.
|
||||
it('returns null for a modify whose binary modified side is empty (no stale fallback)', () => {
|
||||
expect(
|
||||
mobileDiffImageDataUri({
|
||||
kind: 'binary',
|
||||
originalContent: 'b2xk',
|
||||
originalIsBinary: true,
|
||||
modifiedContent: '',
|
||||
modifiedIsBinary: true,
|
||||
isImage: true,
|
||||
mimeType: 'image/png'
|
||||
})
|
||||
).toBeNull()
|
||||
})
|
||||
|
||||
it('returns null for a non-previewable binary (no isImage/mimeType)', () => {
|
||||
expect(
|
||||
mobileDiffImageDataUri({
|
||||
kind: 'binary',
|
||||
originalContent: '',
|
||||
modifiedContent: 'AAAA'
|
||||
})
|
||||
).toBeNull()
|
||||
})
|
||||
|
||||
it('returns null when flagged as image but carrying no bytes', () => {
|
||||
expect(
|
||||
mobileDiffImageDataUri({
|
||||
kind: 'binary',
|
||||
originalContent: '',
|
||||
modifiedContent: '',
|
||||
isImage: true,
|
||||
mimeType: 'image/png'
|
||||
})
|
||||
).toBeNull()
|
||||
})
|
||||
|
||||
it('returns null for application/pdf even when flagged as previewable', () => {
|
||||
expect(
|
||||
mobileDiffImageDataUri({
|
||||
kind: 'binary',
|
||||
originalContent: '',
|
||||
modifiedContent: 'JVBER',
|
||||
isImage: true,
|
||||
mimeType: 'application/pdf'
|
||||
})
|
||||
).toBeNull()
|
||||
})
|
||||
|
||||
it('returns null when flagged as image but mimeType is missing', () => {
|
||||
expect(
|
||||
mobileDiffImageDataUri({
|
||||
kind: 'binary',
|
||||
originalContent: '',
|
||||
modifiedContent: 'bmV3',
|
||||
isImage: true
|
||||
})
|
||||
).toBeNull()
|
||||
})
|
||||
})
|
||||
@@ -0,0 +1,32 @@
|
||||
import { buildImageDataUri } from '../../../src/shared/image-data-uri'
|
||||
|
||||
// modifiedDeleted marks a proven deletion (modified side genuinely absent); an
|
||||
// empty modifiedContent alone can't, since a relay/SSH read failure also arrives
|
||||
// empty with modifiedIsBinary false.
|
||||
export type MobileBinaryDiffResult = {
|
||||
kind: 'binary'
|
||||
originalContent?: string
|
||||
modifiedContent?: string
|
||||
originalIsBinary?: boolean
|
||||
modifiedIsBinary?: boolean
|
||||
modifiedDeleted?: boolean
|
||||
isImage?: boolean
|
||||
mimeType?: string
|
||||
}
|
||||
|
||||
// Falls back to the original bytes only for a proven deletion; a read failure or
|
||||
// size-capped modify — also empty on the modified side — returns null instead of
|
||||
// the stale pre-change image.
|
||||
export function mobileDiffImageDataUri(result: MobileBinaryDiffResult): string | null {
|
||||
if (result.isImage !== true) {
|
||||
return null
|
||||
}
|
||||
const modified = result.modifiedContent || ''
|
||||
if (modified) {
|
||||
return buildImageDataUri(result.mimeType, modified)
|
||||
}
|
||||
if (result.modifiedDeleted === true) {
|
||||
return buildImageDataUri(result.mimeType, result.originalContent || '')
|
||||
}
|
||||
return null
|
||||
}
|
||||
@@ -0,0 +1,136 @@
|
||||
import { describe, expect, it } from 'vitest'
|
||||
import type { RpcResponse } from '../transport/types'
|
||||
import { resolveMobileFileTabDoc } from './mobile-file-tab-doc'
|
||||
|
||||
function ok(result: unknown): RpcResponse {
|
||||
return { id: 'x', ok: true, result, _meta: { runtimeId: 'r' } }
|
||||
}
|
||||
|
||||
function fail(code: string, message: string): RpcResponse {
|
||||
return { id: 'x', ok: false, error: { code, message }, _meta: { runtimeId: 'r' } }
|
||||
}
|
||||
|
||||
// Fake client that returns a canned response per RPC method.
|
||||
function clientOf(byMethod: Record<string, RpcResponse>): {
|
||||
sendRequest: (method: string) => Promise<RpcResponse>
|
||||
calls: string[]
|
||||
} {
|
||||
const calls: string[] = []
|
||||
return {
|
||||
calls,
|
||||
sendRequest: (method: string) => {
|
||||
calls.push(method)
|
||||
const response = byMethod[method]
|
||||
if (!response) {
|
||||
throw new Error(`unexpected method ${method}`)
|
||||
}
|
||||
return Promise.resolve(response)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
const WT = { worktreeId: 'wt1' }
|
||||
|
||||
describe('resolveMobileFileTabDoc', () => {
|
||||
it('renders a staged text diff', async () => {
|
||||
const client = clientOf({
|
||||
'git.diff': ok({ kind: 'text', originalContent: 'a\n', modifiedContent: 'a\nb\n' })
|
||||
})
|
||||
const doc = await resolveMobileFileTabDoc(client, {
|
||||
...WT,
|
||||
relativePath: 'a.ts',
|
||||
diffSource: 'staged'
|
||||
})
|
||||
expect(doc.kind).toBe('diff')
|
||||
expect(client.calls).toEqual(['git.diff'])
|
||||
})
|
||||
|
||||
it('renders an unstaged image diff from the modified bytes', async () => {
|
||||
const client = clientOf({
|
||||
'git.diff': ok({
|
||||
kind: 'binary',
|
||||
originalContent: 'b2xk',
|
||||
modifiedContent: 'bmV3',
|
||||
modifiedIsBinary: true,
|
||||
isImage: true,
|
||||
mimeType: 'image/png'
|
||||
})
|
||||
})
|
||||
const doc = await resolveMobileFileTabDoc(client, {
|
||||
...WT,
|
||||
relativePath: 'm1.png',
|
||||
diffSource: 'unstaged'
|
||||
})
|
||||
expect(doc).toEqual({ status: 'ready', kind: 'image', dataUri: 'data:image/png;base64,bmV3' })
|
||||
})
|
||||
|
||||
it('throws binary_file for an image modify whose bytes are empty (no stale fallback)', async () => {
|
||||
const client = clientOf({
|
||||
'git.diff': ok({
|
||||
kind: 'binary',
|
||||
originalContent: 'b2xk',
|
||||
modifiedContent: '',
|
||||
modifiedIsBinary: true,
|
||||
isImage: true,
|
||||
mimeType: 'image/png'
|
||||
})
|
||||
})
|
||||
await expect(
|
||||
resolveMobileFileTabDoc(client, { ...WT, relativePath: 'm1.png', diffSource: 'unstaged' })
|
||||
).rejects.toThrow('binary_file')
|
||||
})
|
||||
|
||||
it('throws binary_file for a non-image binary diff', async () => {
|
||||
const client = clientOf({ 'git.diff': ok({ kind: 'binary', modifiedContent: 'AAAA' }) })
|
||||
await expect(
|
||||
resolveMobileFileTabDoc(client, { ...WT, relativePath: 'a.bin', diffSource: 'unstaged' })
|
||||
).rejects.toThrow('binary_file')
|
||||
})
|
||||
|
||||
it('renders a live image preview via files.readPreview', async () => {
|
||||
const client = clientOf({
|
||||
'files.readPreview': ok({ content: 'bmV3', isImage: true, mimeType: 'image/png' })
|
||||
})
|
||||
const doc = await resolveMobileFileTabDoc(client, { ...WT, relativePath: 'logo.png' })
|
||||
expect(doc).toEqual({ status: 'ready', kind: 'image', dataUri: 'data:image/png;base64,bmV3' })
|
||||
expect(client.calls).toEqual(['files.readPreview'])
|
||||
})
|
||||
|
||||
it('throws binary_file when readPreview returns no image bytes', async () => {
|
||||
const client = clientOf({
|
||||
'files.readPreview': ok({ content: '', isImage: true, mimeType: 'image/png' })
|
||||
})
|
||||
await expect(
|
||||
resolveMobileFileTabDoc(client, { ...WT, relativePath: 'logo.png' })
|
||||
).rejects.toThrow('binary_file')
|
||||
})
|
||||
|
||||
it('renders html source via files.read', async () => {
|
||||
const client = clientOf({
|
||||
'files.read': ok({ content: '<h1>hi</h1>', truncated: false, byteLength: 11 })
|
||||
})
|
||||
const doc = await resolveMobileFileTabDoc(client, { ...WT, relativePath: 'page.html' })
|
||||
expect(doc).toEqual({ status: 'ready', kind: 'html', content: '<h1>hi</h1>' })
|
||||
})
|
||||
|
||||
it('renders a plain text file via files.read', async () => {
|
||||
const client = clientOf({
|
||||
'files.read': ok({ content: 'hello', truncated: true, byteLength: 5 })
|
||||
})
|
||||
const doc = await resolveMobileFileTabDoc(client, { ...WT, relativePath: 'notes.txt' })
|
||||
expect(doc).toEqual({
|
||||
status: 'ready',
|
||||
kind: 'file',
|
||||
content: 'hello',
|
||||
truncated: true,
|
||||
byteLength: 5
|
||||
})
|
||||
})
|
||||
|
||||
it('propagates the RPC error message when a read fails', async () => {
|
||||
const client = clientOf({ 'files.read': fail('EIO', 'file_too_large') })
|
||||
await expect(
|
||||
resolveMobileFileTabDoc(client, { ...WT, relativePath: 'notes.txt' })
|
||||
).rejects.toThrow('file_too_large')
|
||||
})
|
||||
})
|
||||
@@ -0,0 +1,94 @@
|
||||
import { buildImageDataUri } from '../../../src/shared/image-data-uri'
|
||||
import { classifyMobileArtifact } from '../session/mobile-artifact-kind'
|
||||
import { buildMobileDiffLines, type MobileDiffLine } from '../session/mobile-diff-lines'
|
||||
import type { RpcClient } from '../transport/rpc-client'
|
||||
import type { RpcFailure, RpcSuccess } from '../transport/types'
|
||||
import { mobileDiffImageDataUri, type MobileBinaryDiffResult } from './mobile-diff-image-preview'
|
||||
|
||||
type FileTabDocClient = Pick<RpcClient, 'sendRequest'>
|
||||
|
||||
// The ready doc a session file tab renders. Mirrors the ready arm of the route's
|
||||
// FileDocState; kept in src so the loader stays testable without the route.
|
||||
export type MobileFileTabDoc =
|
||||
| { status: 'ready'; kind: 'file'; content: string; truncated: boolean; byteLength: number }
|
||||
| { status: 'ready'; kind: 'diff'; lines: MobileDiffLine[]; truncated: boolean }
|
||||
| { status: 'ready'; kind: 'image'; dataUri: string }
|
||||
| { status: 'ready'; kind: 'html'; content: string }
|
||||
|
||||
export type MobileFileTabDocRequest = {
|
||||
worktreeId: string
|
||||
relativePath: string
|
||||
diffSource?: 'staged' | 'unstaged' | 'branch' | 'commit'
|
||||
}
|
||||
|
||||
// Throws 'binary_file'/'file_too_large'/the RPC error message; callers map those
|
||||
// to error docs.
|
||||
export async function resolveMobileFileTabDoc(
|
||||
client: FileTabDocClient,
|
||||
request: MobileFileTabDocRequest
|
||||
): Promise<MobileFileTabDoc> {
|
||||
const worktree = `id:${request.worktreeId}`
|
||||
const { relativePath } = request
|
||||
if (request.diffSource === 'staged' || request.diffSource === 'unstaged') {
|
||||
const response = await client.sendRequest('git.diff', {
|
||||
worktree,
|
||||
filePath: relativePath,
|
||||
staged: request.diffSource === 'staged'
|
||||
})
|
||||
if (!response.ok) {
|
||||
throw new Error((response as RpcFailure).error.message)
|
||||
}
|
||||
const result = (response as RpcSuccess).result as
|
||||
| { kind: 'text'; originalContent: string; modifiedContent: string }
|
||||
| MobileBinaryDiffResult
|
||||
if (result.kind !== 'text') {
|
||||
// Render image diffs (add/modify/delete) from the base64 the host already
|
||||
// sends; only non-previewable binaries stay unavailable.
|
||||
const dataUri = mobileDiffImageDataUri(result)
|
||||
if (!dataUri) {
|
||||
throw new Error('binary_file')
|
||||
}
|
||||
return { status: 'ready', kind: 'image', dataUri }
|
||||
}
|
||||
const diff = buildMobileDiffLines(result.originalContent, result.modifiedContent)
|
||||
return { status: 'ready', kind: 'diff', lines: diff.lines, truncated: diff.truncated }
|
||||
}
|
||||
|
||||
const artifactKind = classifyMobileArtifact(relativePath)
|
||||
if (artifactKind === 'image') {
|
||||
const preview = await client.sendRequest('files.readPreview', { worktree, relativePath })
|
||||
if (!preview.ok) {
|
||||
throw new Error((preview as RpcFailure).error.message)
|
||||
}
|
||||
const result = (preview as RpcSuccess).result as {
|
||||
content: string
|
||||
isImage?: boolean
|
||||
mimeType?: string
|
||||
}
|
||||
const dataUri = result.isImage ? buildImageDataUri(result.mimeType, result.content) : null
|
||||
if (!dataUri) {
|
||||
throw new Error('binary_file')
|
||||
}
|
||||
return { status: 'ready', kind: 'image', dataUri }
|
||||
}
|
||||
|
||||
const response = await client.sendRequest('files.read', { worktree, relativePath })
|
||||
if (!response.ok) {
|
||||
throw new Error((response as RpcFailure).error.message)
|
||||
}
|
||||
const result = (response as RpcSuccess).result as {
|
||||
content: string
|
||||
truncated: boolean
|
||||
byteLength: number
|
||||
}
|
||||
if (artifactKind === 'html') {
|
||||
return { status: 'ready', kind: 'html', content: result.content }
|
||||
}
|
||||
return {
|
||||
status: 'ready',
|
||||
kind: 'file',
|
||||
content: result.content,
|
||||
truncated: result.truncated,
|
||||
byteLength: result.byteLength
|
||||
}
|
||||
}
|
||||
@@ -2,6 +2,7 @@ import { describe, expect, expectTypeOf, it } from 'vitest'
|
||||
import type { GitStatusResult } from '../../../src/shared/git-status-types'
|
||||
import {
|
||||
buildMobileSourceControlSections,
|
||||
canOpenMobileGitStatusEntry,
|
||||
countStagedEntries,
|
||||
countUnstagedEntries,
|
||||
getStageablePaths,
|
||||
@@ -65,6 +66,31 @@ describe('mobile source control status helpers', () => {
|
||||
expect(isMobileGitDiscardableEntry(conflictedEntries[2])).toBe(false)
|
||||
})
|
||||
|
||||
it('allows opening deleted files so pre-delete text/image diffs can load', () => {
|
||||
expect(
|
||||
canOpenMobileGitStatusEntry({ path: 'deleted.png', status: 'deleted', area: 'unstaged' })
|
||||
).toBe(true)
|
||||
expect(
|
||||
canOpenMobileGitStatusEntry({ path: 'logo.png', status: 'modified', area: 'unstaged' })
|
||||
).toBe(true)
|
||||
expect(
|
||||
canOpenMobileGitStatusEntry({
|
||||
path: 'conflict.ts',
|
||||
status: 'modified',
|
||||
area: 'unstaged',
|
||||
conflictStatus: 'unresolved'
|
||||
})
|
||||
).toBe(false)
|
||||
expect(
|
||||
canOpenMobileGitStatusEntry({
|
||||
path: 'resolved.ts',
|
||||
status: 'modified',
|
||||
area: 'unstaged',
|
||||
conflictStatus: 'resolved_locally'
|
||||
})
|
||||
).toBe(true)
|
||||
})
|
||||
|
||||
it('sorts entries by desktop-compatible conflict rank, then path', () => {
|
||||
const sections = buildMobileSourceControlSections([
|
||||
{ path: 'zeta.ts', status: 'modified', area: 'unstaged' },
|
||||
|
||||
@@ -90,6 +90,12 @@ export function isMobileGitDiscardableEntry(entry: MobileGitStatusEntry): boolea
|
||||
return entry.conflictStatus !== 'unresolved' && entry.conflictStatus !== 'resolved_locally'
|
||||
}
|
||||
|
||||
// Why: unresolved conflicts are not a stable file to open. Deletions are —
|
||||
// git.diff still returns the pre-delete side (text or image via modifiedDeleted).
|
||||
export function canOpenMobileGitStatusEntry(entry: MobileGitStatusEntry): boolean {
|
||||
return entry.conflictStatus !== 'unresolved'
|
||||
}
|
||||
|
||||
export function isMobileGitUnavailable(code: string | undefined, message: string | undefined) {
|
||||
return (
|
||||
code === 'forbidden' ||
|
||||
|
||||
@@ -20,6 +20,7 @@ import type {
|
||||
MobileGitBranchCompareSummary
|
||||
} from './mobile-branch-compare'
|
||||
import {
|
||||
canOpenMobileGitStatusEntry,
|
||||
isMobileGitDiscardableEntry,
|
||||
isMobileGitStageableEntry,
|
||||
type MobileGitFileStatus,
|
||||
@@ -58,15 +59,14 @@ export type MobileGitStatusEntryView = MobileGitStatusEntry & {
|
||||
}
|
||||
|
||||
// Decorate raw status entries with the row-level capability/action-id fields the
|
||||
// file list needs. Deleted/unresolved entries are not openable (matches the
|
||||
// opener guards).
|
||||
// file list needs. Opener guards must use the same canOpen rule.
|
||||
export function buildMobileGitStatusEntryViews(
|
||||
entries: readonly MobileGitStatusEntry[]
|
||||
): MobileGitStatusEntryView[] {
|
||||
return entries.map((entry) => ({
|
||||
...entry,
|
||||
canDiscard: isMobileGitDiscardableEntry(entry),
|
||||
canOpen: entry.status !== 'deleted' && entry.conflictStatus !== 'unresolved',
|
||||
canOpen: canOpenMobileGitStatusEntry(entry),
|
||||
canStage: isMobileGitStageableEntry(entry),
|
||||
discardActionId: `discard:${entry.path}`,
|
||||
stageActionId: `stage:${entry.path}`,
|
||||
|
||||
@@ -12,7 +12,11 @@ import {
|
||||
canOpenMobileBranchCompareDiff,
|
||||
type MobileGitBranchChangeEntry
|
||||
} from './mobile-branch-compare'
|
||||
import { isMobileGitUnavailable, type MobileGitStatusEntry } from './mobile-git-status'
|
||||
import {
|
||||
canOpenMobileGitStatusEntry,
|
||||
isMobileGitUnavailable,
|
||||
type MobileGitStatusEntry
|
||||
} from './mobile-git-status'
|
||||
import { buildMobileReviewFileRoute } from './mobile-review-route'
|
||||
import type {
|
||||
GitDiffTextResult,
|
||||
@@ -70,7 +74,9 @@ export function useMobileSourceControlOpeners(params: Params) {
|
||||
|
||||
const openFile = useCallback(
|
||||
async (entry: MobileGitStatusEntry) => {
|
||||
if (entry.status === 'deleted' || entry.conflictStatus === 'unresolved') {
|
||||
// Deletions are openable (pre-delete text/image via git.diff); only block
|
||||
// unresolved conflicts, matching canOpenMobileGitStatusEntry / row UI.
|
||||
if (!canOpenMobileGitStatusEntry(entry)) {
|
||||
return
|
||||
}
|
||||
if (openingPathRef.current || busyActionRef.current) {
|
||||
|
||||
+1
-1
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"name": "orca",
|
||||
"version": "1.4.144-rc.2",
|
||||
"version": "1.4.144-rc.4",
|
||||
"description": "Next-gen IDE for parallel agentic development",
|
||||
"homepage": "https://github.com/stablyai/orca",
|
||||
"author": "stablyai",
|
||||
|
||||
@@ -1,11 +1,11 @@
|
||||
{
|
||||
"schemaVersion": 1,
|
||||
"appVersion": "1.4.144-rc.2",
|
||||
"appVersion": "1.4.144-rc.4",
|
||||
"skills": [
|
||||
{
|
||||
"name": "computer-use",
|
||||
"sourcePath": "skills/computer-use",
|
||||
"appVersion": "1.4.144-rc.2",
|
||||
"appVersion": "1.4.144-rc.4",
|
||||
"releaseRevision": 5,
|
||||
"packageDigest": "cd2809474d57fd7277adb277448e6fa446810d3cbad71ac0b473b9e8ff1bad68",
|
||||
"gitTreeSha": "306c0f8cb63bcac265a5b7975dc2f855be4f1344",
|
||||
@@ -24,7 +24,7 @@
|
||||
{
|
||||
"name": "linear-tickets",
|
||||
"sourcePath": "skills/linear-tickets",
|
||||
"appVersion": "1.4.144-rc.2",
|
||||
"appVersion": "1.4.144-rc.4",
|
||||
"releaseRevision": 4,
|
||||
"packageDigest": "f198d7b22e5ee1673dac403f9cca0553b124e0a90e4fdd05d2c23b7344e32d2b",
|
||||
"gitTreeSha": "de9fc106bbb4e313a90ff9a9513a720909bbd176",
|
||||
@@ -43,7 +43,7 @@
|
||||
{
|
||||
"name": "orca-cli",
|
||||
"sourcePath": "skills/orca-cli",
|
||||
"appVersion": "1.4.144-rc.2",
|
||||
"appVersion": "1.4.144-rc.4",
|
||||
"releaseRevision": 32,
|
||||
"packageDigest": "51740ff13f379ac5743d3fd28a14b17168dcef40f7048c20182dce166098c45f",
|
||||
"gitTreeSha": "ded93000a5f654e2b4f324501282459bd56afe19",
|
||||
@@ -62,7 +62,7 @@
|
||||
{
|
||||
"name": "orca-emulator",
|
||||
"sourcePath": "skills/orca-emulator",
|
||||
"appVersion": "1.4.144-rc.2",
|
||||
"appVersion": "1.4.144-rc.4",
|
||||
"releaseRevision": 4,
|
||||
"packageDigest": "453b1d9aa20b51b8a4d32c7b6def6a93f7ef9c730de32abbcbc1788ad1b1820b",
|
||||
"gitTreeSha": "66be6abe99f1807da85934aee0e22daefc8f7656",
|
||||
@@ -81,7 +81,7 @@
|
||||
{
|
||||
"name": "orca-emulator-android",
|
||||
"sourcePath": "skills/orca-emulator-android",
|
||||
"appVersion": "1.4.144-rc.2",
|
||||
"appVersion": "1.4.144-rc.4",
|
||||
"releaseRevision": 2,
|
||||
"packageDigest": "12272cf82e0731f11e424822b961882457034e730358cc65ea28e4eb9c8ff7f5",
|
||||
"gitTreeSha": "f7b0fc8cbf5cd78ca5156f6bbe3a20f1462d8f83",
|
||||
@@ -100,7 +100,7 @@
|
||||
{
|
||||
"name": "orca-linear",
|
||||
"sourcePath": "skills/orca-linear",
|
||||
"appVersion": "1.4.144-rc.2",
|
||||
"appVersion": "1.4.144-rc.4",
|
||||
"releaseRevision": 2,
|
||||
"packageDigest": "d44d09e6ecb6a64da177083aad26a95f031cd1cf26ba059fdc888c2628aef64f",
|
||||
"gitTreeSha": "c34f42030f43e5a85737996fa375bbd79cb5bea8",
|
||||
@@ -119,7 +119,7 @@
|
||||
{
|
||||
"name": "orca-per-workspace-env",
|
||||
"sourcePath": "skills/orca-per-workspace-env",
|
||||
"appVersion": "1.4.144-rc.2",
|
||||
"appVersion": "1.4.144-rc.4",
|
||||
"releaseRevision": 2,
|
||||
"packageDigest": "fa3b65a1a107fca3f0375c696852477b62f58c154b9eb5c0663c41edc4bcd30d",
|
||||
"gitTreeSha": "354e775b79ea6952ec63acac4d3ee8a9ae07a650",
|
||||
@@ -138,7 +138,7 @@
|
||||
{
|
||||
"name": "orchestration",
|
||||
"sourcePath": "skills/orchestration",
|
||||
"appVersion": "1.4.144-rc.2",
|
||||
"appVersion": "1.4.144-rc.4",
|
||||
"releaseRevision": 24,
|
||||
"packageDigest": "9fbfa2ae3f3f99441563a4b8b1c6302107944480db8718ddb326a862a51f7ab9",
|
||||
"gitTreeSha": "086c41e0b353b4908d2963694b4a7c791d4b3982",
|
||||
|
||||
@@ -140,7 +140,7 @@ describe('maybeAutoRenameBranchOnFirstWork', () => {
|
||||
})
|
||||
|
||||
it('strips a prefix the model leaked into the slug from both branch and display name', async () => {
|
||||
// Model ignored "no prefixes" and echoed `you/worktree-spinner`, which the
|
||||
// Model echoed `you/worktree-spinner`, which the
|
||||
// sanitizer folds to `you-worktree-spinner`; without stripping it would
|
||||
// double-prefix the branch (`you/you-...`) and show "You worktree spinner".
|
||||
generateBranchNameMock.mockResolvedValue({ success: true, slug: 'you-worktree-spinner' })
|
||||
|
||||
@@ -283,9 +283,8 @@ async function runAutoRename(
|
||||
const username = provider
|
||||
? (await getSshGitUsername(provider, repo.path)) || null
|
||||
: (await resolveLocalGitUsername(repo.path)) || null
|
||||
// The model is told not to add a prefix, but sometimes echoes the configured
|
||||
// one (e.g. `tmchow/...`); strip it so it doesn't double-prefix the branch or
|
||||
// leak into the display name.
|
||||
// The model sometimes echoes the configured prefix (e.g. `tmchow/...`); strip
|
||||
// it so it doesn't double-prefix the branch or leak into the display name.
|
||||
const slug = stripConfiguredBranchPrefix(
|
||||
generated.slug,
|
||||
getConfiguredBranchPrefix(settings, username)
|
||||
|
||||
@@ -79,6 +79,8 @@ function mockBrowserManager(
|
||||
getWebContentsIdByTabId: () => tabs,
|
||||
getWorktreeIdForTab: (tabId: string) => worktrees.get(tabId),
|
||||
getGuestWebContentsId: vi.fn(() => null),
|
||||
getBrowserPageLoadError: vi.fn(() => null),
|
||||
getBrowserPageCertificateFailure: vi.fn(() => null),
|
||||
unregisterGuest: vi.fn(),
|
||||
ensureWebviewVisible: vi.fn(async () => () => {}),
|
||||
acquireAutomationVisibility: vi.fn(async () => () => {}),
|
||||
@@ -531,6 +533,43 @@ describe('AgentBrowserBridge', () => {
|
||||
expect(result.tabs[0].url).toBe('https://a.com')
|
||||
})
|
||||
|
||||
it('surfaces the browser-manager load error on each listed tab', () => {
|
||||
const tabs = new Map([['tab-a', 1]])
|
||||
const wc1 = mockWebContents(1, 'chrome-error://chromewebdata/', '')
|
||||
webContentsFromIdMock.mockImplementation((id: number) => (id === 1 ? wc1 : null))
|
||||
const loadError = {
|
||||
code: -202,
|
||||
description: 'ERR_CERT_AUTHORITY_INVALID',
|
||||
validatedUrl: 'https://localhost:3443/'
|
||||
}
|
||||
const certificateFailure = {
|
||||
challengeId: 'challenge-1',
|
||||
browserPageId: 'tab-a',
|
||||
errorCode: -202,
|
||||
error: 'ERR_CERT_AUTHORITY_INVALID',
|
||||
origin: 'https://localhost:3443',
|
||||
displayHost: 'localhost:3443',
|
||||
canProceed: true,
|
||||
observedAt: 123
|
||||
}
|
||||
const b = new AgentBrowserBridge(
|
||||
mockBrowserManager(tabs, new Map(), {
|
||||
getBrowserPageLoadError: vi.fn((tabId: string) => (tabId === 'tab-a' ? loadError : null)),
|
||||
getBrowserPageCertificateFailure: vi.fn((tabId: string) =>
|
||||
tabId === 'tab-a' ? certificateFailure : null
|
||||
)
|
||||
})
|
||||
)
|
||||
|
||||
// Why: an agent driving the browser must see the structured cert failure,
|
||||
// not just chrome-error:// from getURL().
|
||||
expect(b.tabList().tabs[0]).toMatchObject({
|
||||
url: 'https://localhost:3443/',
|
||||
loadError,
|
||||
certificateFailure
|
||||
})
|
||||
})
|
||||
|
||||
it('does not mutate active-tab routing when tab-list infers the first live tab', () => {
|
||||
const tabs = new Map([
|
||||
['tab-a', 1],
|
||||
|
||||
@@ -698,12 +698,18 @@ export class AgentBrowserBridge {
|
||||
if (firstLiveWcId === null) {
|
||||
firstLiveWcId = wcId
|
||||
}
|
||||
const loadError = this.browserManager.getBrowserPageLoadError(tabId)
|
||||
const certificateFailure = this.browserManager.getBrowserPageCertificateFailure(tabId)
|
||||
result.push({
|
||||
browserPageId: tabId,
|
||||
index: index++,
|
||||
url: wc.getURL() ?? '',
|
||||
// Why: failed WebContents report chrome-error://, which is neither
|
||||
// actionable nor the address the user asked to load.
|
||||
url: loadError?.validatedUrl ?? wc.getURL() ?? '',
|
||||
title: wc.getTitle() ?? '',
|
||||
active: wcId === activeWcId
|
||||
active: wcId === activeWcId,
|
||||
loadError,
|
||||
certificateFailure
|
||||
})
|
||||
}
|
||||
// Why: if no tab has been explicitly activated yet, surface the first live
|
||||
|
||||
@@ -0,0 +1,77 @@
|
||||
import type { BrowserCertificateFailure } from '../../shared/types'
|
||||
import { SUPPORTED_CERTIFICATE_ERROR_CODE } from './browser-certificate-identity'
|
||||
|
||||
export const CERTIFICATE_CHALLENGE_TTL_MS = 5 * 60_000
|
||||
export const MAX_PENDING_CERTIFICATE_CHALLENGES = 32
|
||||
export const MAX_CERTIFICATE_GRANTS = 32
|
||||
|
||||
export type ManagedBrowserGuestContext = {
|
||||
browserPageId: string | null
|
||||
worktreeId: string | null
|
||||
sessionProfileId: string | null
|
||||
owner: 'desktop-webview' | 'offscreen'
|
||||
}
|
||||
|
||||
export type BrowserCertificateTrustControllerDependencies = {
|
||||
resolveManagedGuestContext: (webContentsId: number) => ManagedBrowserGuestContext | null
|
||||
resolveWebContentsIdForPage: (browserPageId: string) => number | null
|
||||
resolveWebContents: (webContentsId: number) => Electron.WebContents | null
|
||||
onFailureChanged: (
|
||||
webContentsId: number,
|
||||
failure: BrowserCertificateFailure | null,
|
||||
navigationUrl?: string
|
||||
) => void
|
||||
now?: () => number
|
||||
createChallengeId?: () => string
|
||||
}
|
||||
|
||||
export type PendingCertificateChallenge = {
|
||||
challengeId: string
|
||||
guestWebContentsId: number
|
||||
browserPageId: string | null
|
||||
navigationSequence: number
|
||||
navigationUrl: string
|
||||
origin: string
|
||||
displayHost: string
|
||||
secureEndpoint: string
|
||||
leafCertificateSha256: string
|
||||
errorCode: number | null
|
||||
error: string
|
||||
observedAt: number
|
||||
expiresAt: number
|
||||
}
|
||||
|
||||
export type CertificateTrustGrant = Pick<
|
||||
PendingCertificateChallenge,
|
||||
'guestWebContentsId' | 'secureEndpoint' | 'leafCertificateSha256' | 'error'
|
||||
>
|
||||
|
||||
export function certificateChallengeIdentityMatches(
|
||||
challenge: PendingCertificateChallenge,
|
||||
candidate: Pick<
|
||||
PendingCertificateChallenge,
|
||||
'navigationSequence' | 'secureEndpoint' | 'leafCertificateSha256' | 'error'
|
||||
>
|
||||
): boolean {
|
||||
return (
|
||||
challenge.navigationSequence === candidate.navigationSequence &&
|
||||
challenge.secureEndpoint === candidate.secureEndpoint &&
|
||||
challenge.leafCertificateSha256 === candidate.leafCertificateSha256 &&
|
||||
challenge.error === candidate.error
|
||||
)
|
||||
}
|
||||
|
||||
export function toBrowserCertificateFailure(
|
||||
challenge: PendingCertificateChallenge
|
||||
): BrowserCertificateFailure {
|
||||
return {
|
||||
challengeId: challenge.challengeId,
|
||||
browserPageId: challenge.browserPageId ?? '',
|
||||
errorCode: challenge.errorCode,
|
||||
error: challenge.error,
|
||||
origin: challenge.origin,
|
||||
displayHost: challenge.displayHost,
|
||||
canProceed: challenge.errorCode === SUPPORTED_CERTIFICATE_ERROR_CODE,
|
||||
observedAt: challenge.observedAt
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,32 @@
|
||||
import { createHash } from 'node:crypto'
|
||||
|
||||
export const SUPPORTED_CERTIFICATE_ERROR = 'ERR_CERT_AUTHORITY_INVALID'
|
||||
export const SUPPORTED_CERTIFICATE_ERROR_CODE = -202
|
||||
|
||||
export function normalizeCertificateError(error: string): string {
|
||||
return error
|
||||
.trim()
|
||||
.replace(/^net::/i, '')
|
||||
.toUpperCase()
|
||||
}
|
||||
|
||||
export function getSupportedCertificateErrorCode(error: string): number | null {
|
||||
return normalizeCertificateError(error) === SUPPORTED_CERTIFICATE_ERROR
|
||||
? SUPPORTED_CERTIFICATE_ERROR_CODE
|
||||
: null
|
||||
}
|
||||
|
||||
export function getLeafCertificateSha256(certificate: Electron.Certificate): string | null {
|
||||
const match = certificate.data.match(
|
||||
/-----BEGIN CERTIFICATE-----([\s\S]*?)-----END CERTIFICATE-----/
|
||||
)
|
||||
if (!match) {
|
||||
return null
|
||||
}
|
||||
try {
|
||||
const der = Buffer.from(match[1].replace(/\s+/g, ''), 'base64')
|
||||
return der.length > 0 ? createHash('sha256').update(der).digest('hex') : null
|
||||
} catch {
|
||||
return null
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,203 @@
|
||||
import type { Session } from 'electron'
|
||||
|
||||
import { toSecureCertificateEndpoint } from '../../shared/browser-url'
|
||||
import { MAX_CERTIFICATE_GRANTS, type CertificateTrustGrant } from './browser-certificate-challenge'
|
||||
|
||||
type CertificateIdentity = Pick<
|
||||
CertificateTrustGrant,
|
||||
'secureEndpoint' | 'leafCertificateSha256' | 'error'
|
||||
>
|
||||
|
||||
type BlockedMainFrame = CertificateIdentity & {
|
||||
webContentsId: number
|
||||
navigationUrl: string
|
||||
origin: string
|
||||
displayHost: string
|
||||
}
|
||||
|
||||
type RequestGuardDependencies = {
|
||||
onBlockedMainFrame: (blocked: BlockedMainFrame) => void
|
||||
}
|
||||
|
||||
function certificateIdentitiesMatch(
|
||||
left: CertificateIdentity | undefined,
|
||||
right: CertificateIdentity
|
||||
): boolean {
|
||||
return Boolean(
|
||||
left &&
|
||||
left.secureEndpoint === right.secureEndpoint &&
|
||||
left.leafCertificateSha256 === right.leafCertificateSha256 &&
|
||||
left.error === right.error
|
||||
)
|
||||
}
|
||||
|
||||
export class BrowserCertificateRequestGuard {
|
||||
private readonly grantsByGuestId = new Map<number, CertificateTrustGrant>()
|
||||
private readonly grantSessionByGuestId = new Map<number, Session>()
|
||||
private readonly guardedSessions = new Set<Session>()
|
||||
private readonly acceptedIdentityBySession = new Map<Session, Map<string, CertificateIdentity>>()
|
||||
|
||||
constructor(private readonly dependencies: RequestGuardDependencies) {}
|
||||
|
||||
installSession(session: Session): void {
|
||||
if (this.guardedSessions.has(session)) {
|
||||
return
|
||||
}
|
||||
// Why: Chromium caches certificate continuations at session scope. This
|
||||
// request gate restores the narrower per-WebContents approval boundary.
|
||||
session.webRequest.onBeforeRequest((details, callback) => {
|
||||
callback(this.shouldBlockRequest(session, details) ? { cancel: true } : {})
|
||||
})
|
||||
this.guardedSessions.add(session)
|
||||
}
|
||||
|
||||
removeSession(session: Session): void {
|
||||
if (!this.guardedSessions.delete(session)) {
|
||||
return
|
||||
}
|
||||
session.webRequest.onBeforeRequest(null)
|
||||
this.acceptedIdentityBySession.delete(session)
|
||||
for (const [webContentsId, grantSession] of this.grantSessionByGuestId) {
|
||||
if (grantSession === session) {
|
||||
this.revokeGuest(webContentsId)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
canOfferCertificate(session: Session, identity: CertificateIdentity): boolean {
|
||||
if (!this.guardedSessions.has(session)) {
|
||||
return false
|
||||
}
|
||||
const accepted = this.acceptedIdentityBySession.get(session)?.get(identity.secureEndpoint)
|
||||
// Why: the request gate cannot inspect TLS after Chromium caches a decision.
|
||||
// Never accept a second bad leaf for one endpoint in the same app process.
|
||||
return !accepted || certificateIdentitiesMatch(accepted, identity)
|
||||
}
|
||||
|
||||
grant(session: Session, grant: CertificateTrustGrant): boolean {
|
||||
if (!this.guardedSessions.has(session)) {
|
||||
return false
|
||||
}
|
||||
let acceptedByEndpoint = this.acceptedIdentityBySession.get(session)
|
||||
const accepted = acceptedByEndpoint?.get(grant.secureEndpoint)
|
||||
// Why: once one leaf is accepted for an endpoint in this session, Chromium
|
||||
// caches the TLS decision. Refuse a conflicting pending leaf so proceed()
|
||||
// cannot report success when the next certificate-error will still fail.
|
||||
if (accepted && !certificateIdentitiesMatch(accepted, grant)) {
|
||||
return false
|
||||
}
|
||||
// Why: pin the identity at grant time, not only on the later certificate
|
||||
// callback, so a concurrent sibling proceed cannot race in a second leaf.
|
||||
if (!acceptedByEndpoint) {
|
||||
acceptedByEndpoint = new Map()
|
||||
this.acceptedIdentityBySession.set(session, acceptedByEndpoint)
|
||||
}
|
||||
acceptedByEndpoint.set(grant.secureEndpoint, {
|
||||
secureEndpoint: grant.secureEndpoint,
|
||||
leafCertificateSha256: grant.leafCertificateSha256,
|
||||
error: grant.error
|
||||
})
|
||||
this.grantsByGuestId.delete(grant.guestWebContentsId)
|
||||
this.grantsByGuestId.set(grant.guestWebContentsId, grant)
|
||||
this.grantSessionByGuestId.set(grant.guestWebContentsId, session)
|
||||
this.enforceGrantBound()
|
||||
return true
|
||||
}
|
||||
|
||||
shouldTrustCertificate(
|
||||
session: Session,
|
||||
webContentsId: number,
|
||||
identity: CertificateIdentity
|
||||
): boolean {
|
||||
if (
|
||||
!this.guardedSessions.has(session) ||
|
||||
this.grantSessionByGuestId.get(webContentsId) !== session ||
|
||||
!certificateIdentitiesMatch(this.grantsByGuestId.get(webContentsId), identity)
|
||||
) {
|
||||
return false
|
||||
}
|
||||
let acceptedByEndpoint = this.acceptedIdentityBySession.get(session)
|
||||
if (!acceptedByEndpoint) {
|
||||
acceptedByEndpoint = new Map()
|
||||
this.acceptedIdentityBySession.set(session, acceptedByEndpoint)
|
||||
}
|
||||
const accepted = acceptedByEndpoint.get(identity.secureEndpoint)
|
||||
if (accepted && !certificateIdentitiesMatch(accepted, identity)) {
|
||||
return false
|
||||
}
|
||||
acceptedByEndpoint.set(identity.secureEndpoint, identity)
|
||||
return true
|
||||
}
|
||||
|
||||
revokeGuest(webContentsId: number): void {
|
||||
this.grantsByGuestId.delete(webContentsId)
|
||||
this.grantSessionByGuestId.delete(webContentsId)
|
||||
}
|
||||
|
||||
revokeForCommittedNavigation(webContentsId: number, url: string): void {
|
||||
const grant = this.grantsByGuestId.get(webContentsId)
|
||||
if (grant && toSecureCertificateEndpoint(url) !== grant.secureEndpoint) {
|
||||
this.revokeGuest(webContentsId)
|
||||
}
|
||||
}
|
||||
|
||||
private shouldBlockRequest(
|
||||
session: Session,
|
||||
details: Electron.OnBeforeRequestListenerDetails
|
||||
): boolean {
|
||||
const secureEndpoint = toSecureCertificateEndpoint(details.url)
|
||||
if (!secureEndpoint) {
|
||||
return false
|
||||
}
|
||||
const accepted = this.acceptedIdentityBySession.get(session)?.get(secureEndpoint)
|
||||
if (!accepted) {
|
||||
return false
|
||||
}
|
||||
const webContentsId = details.webContentsId ?? details.webContents?.id
|
||||
const grant = webContentsId === undefined ? undefined : this.grantsByGuestId.get(webContentsId)
|
||||
if (
|
||||
webContentsId !== undefined &&
|
||||
grant &&
|
||||
this.grantSessionByGuestId.get(webContentsId) === session &&
|
||||
certificateIdentitiesMatch(grant, accepted)
|
||||
) {
|
||||
return false
|
||||
}
|
||||
if (details.resourceType === 'mainFrame' && webContentsId !== undefined) {
|
||||
this.reportBlockedMainFrame(webContentsId, details.url, accepted)
|
||||
}
|
||||
return true
|
||||
}
|
||||
|
||||
private reportBlockedMainFrame(
|
||||
webContentsId: number,
|
||||
navigationUrl: string,
|
||||
identity: CertificateIdentity
|
||||
): void {
|
||||
try {
|
||||
const parsed = new URL(navigationUrl)
|
||||
if (parsed.protocol !== 'https:') {
|
||||
return
|
||||
}
|
||||
this.dependencies.onBlockedMainFrame({
|
||||
webContentsId,
|
||||
navigationUrl,
|
||||
origin: parsed.origin,
|
||||
displayHost: parsed.host,
|
||||
...identity
|
||||
})
|
||||
} catch {
|
||||
// The request remains blocked even if Chromium supplies a malformed URL.
|
||||
}
|
||||
}
|
||||
|
||||
private enforceGrantBound(): void {
|
||||
while (this.grantsByGuestId.size > MAX_CERTIFICATE_GRANTS) {
|
||||
const oldest = this.grantsByGuestId.keys().next().value as number | undefined
|
||||
if (oldest === undefined) {
|
||||
return
|
||||
}
|
||||
this.revokeGuest(oldest)
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,336 @@
|
||||
import { beforeEach, describe, expect, it, vi } from 'vitest'
|
||||
|
||||
import { BrowserCertificateTrustController } from './browser-certificate-trust-controller'
|
||||
|
||||
const FIRST_CERTIFICATE = certificate('first certificate')
|
||||
const SECOND_CERTIFICATE = certificate('replacement certificate')
|
||||
let beforeRequestListener:
|
||||
| ((
|
||||
details: Electron.OnBeforeRequestListenerDetails,
|
||||
callback: (response: Electron.CallbackResponse) => void
|
||||
) => void)
|
||||
| null = null
|
||||
const browserSession = {
|
||||
webRequest: {
|
||||
onBeforeRequest: vi.fn(
|
||||
(
|
||||
listener:
|
||||
| ((
|
||||
details: Electron.OnBeforeRequestListenerDetails,
|
||||
callback: (response: Electron.CallbackResponse) => void
|
||||
) => void)
|
||||
| null
|
||||
) => {
|
||||
beforeRequestListener = listener
|
||||
}
|
||||
)
|
||||
}
|
||||
} as unknown as Electron.Session
|
||||
|
||||
function certificate(contents: string): Electron.Certificate {
|
||||
return {
|
||||
data: `-----BEGIN CERTIFICATE-----\n${Buffer.from(contents).toString('base64')}\n-----END CERTIFICATE-----`
|
||||
} as Electron.Certificate
|
||||
}
|
||||
|
||||
function createGuest(id: number): Electron.WebContents {
|
||||
return {
|
||||
id,
|
||||
session: browserSession,
|
||||
isDestroyed: vi.fn(() => false),
|
||||
loadURL: vi.fn(() => Promise.resolve())
|
||||
} as unknown as Electron.WebContents
|
||||
}
|
||||
|
||||
function beforeRequest(args: {
|
||||
url?: string
|
||||
webContentsId?: number
|
||||
resourceType?: Electron.OnBeforeRequestListenerDetails['resourceType']
|
||||
}) {
|
||||
const callback = vi.fn()
|
||||
beforeRequestListener?.(
|
||||
{
|
||||
id: 1,
|
||||
url: args.url ?? 'https://localhost:3443/app',
|
||||
method: 'GET',
|
||||
webContentsId: args.webContentsId,
|
||||
resourceType: args.resourceType ?? 'mainFrame',
|
||||
referrer: '',
|
||||
timestamp: 1,
|
||||
uploadData: []
|
||||
},
|
||||
callback
|
||||
)
|
||||
return callback
|
||||
}
|
||||
|
||||
function certificateEvent(args: {
|
||||
controller: BrowserCertificateTrustController
|
||||
guest: Electron.WebContents
|
||||
url?: string
|
||||
error?: string
|
||||
certificate?: Electron.Certificate
|
||||
isMainFrame?: boolean
|
||||
}) {
|
||||
const preventDefault = vi.fn()
|
||||
const callback = vi.fn()
|
||||
args.controller.handleCertificateError({
|
||||
event: { preventDefault },
|
||||
webContents: args.guest,
|
||||
url: args.url ?? 'https://localhost:3443/app',
|
||||
error: args.error ?? 'net::ERR_CERT_AUTHORITY_INVALID',
|
||||
certificate: args.certificate ?? FIRST_CERTIFICATE,
|
||||
callback,
|
||||
isMainFrame: args.isMainFrame ?? true
|
||||
})
|
||||
return { preventDefault, callback }
|
||||
}
|
||||
|
||||
describe('BrowserCertificateTrustController', () => {
|
||||
const guest = createGuest(7)
|
||||
const otherGuest = createGuest(8)
|
||||
const onFailureChanged = vi.fn()
|
||||
let now = 1_000
|
||||
let challengeNumber = 0
|
||||
let pageByGuestId: Map<number, string | null>
|
||||
let guestByPageId: Map<string, number>
|
||||
let guestById: Map<number, Electron.WebContents>
|
||||
let controller: BrowserCertificateTrustController
|
||||
|
||||
beforeEach(() => {
|
||||
vi.clearAllMocks()
|
||||
vi.mocked(guest.isDestroyed).mockReturnValue(false)
|
||||
vi.mocked(otherGuest.isDestroyed).mockReturnValue(false)
|
||||
vi.mocked(guest.loadURL).mockResolvedValue(undefined)
|
||||
vi.mocked(otherGuest.loadURL).mockResolvedValue(undefined)
|
||||
now = 1_000
|
||||
challengeNumber = 0
|
||||
pageByGuestId = new Map([
|
||||
[guest.id, 'page-1'],
|
||||
[otherGuest.id, 'page-2']
|
||||
])
|
||||
guestByPageId = new Map([
|
||||
['page-1', guest.id],
|
||||
['page-2', otherGuest.id]
|
||||
])
|
||||
guestById = new Map([
|
||||
[guest.id, guest],
|
||||
[otherGuest.id, otherGuest]
|
||||
])
|
||||
controller = new BrowserCertificateTrustController({
|
||||
resolveManagedGuestContext: (webContentsId) => {
|
||||
if (!pageByGuestId.has(webContentsId)) {
|
||||
return null
|
||||
}
|
||||
return {
|
||||
browserPageId: pageByGuestId.get(webContentsId) ?? null,
|
||||
worktreeId: 'worktree-1',
|
||||
sessionProfileId: 'profile-1',
|
||||
owner: 'desktop-webview'
|
||||
}
|
||||
},
|
||||
resolveWebContentsIdForPage: (browserPageId) => guestByPageId.get(browserPageId) ?? null,
|
||||
resolveWebContents: (webContentsId) => guestById.get(webContentsId) ?? null,
|
||||
onFailureChanged,
|
||||
now: () => now,
|
||||
createChallengeId: () => `challenge-${++challengeNumber}`
|
||||
})
|
||||
controller.installSessionRequestGuard(browserSession)
|
||||
})
|
||||
|
||||
it('rejects first, then trusts only the approved guest, endpoint, certificate, and error', () => {
|
||||
controller.onMainFrameNavigationStarted(guest.id)
|
||||
const first = certificateEvent({ controller, guest })
|
||||
|
||||
expect(first.callback).toHaveBeenCalledOnce()
|
||||
expect(first.callback).toHaveBeenCalledWith(false)
|
||||
expect(first.preventDefault).not.toHaveBeenCalled()
|
||||
expect(controller.getFailure('page-1')).toMatchObject({
|
||||
challengeId: 'challenge-1',
|
||||
browserPageId: 'page-1',
|
||||
origin: 'https://localhost:3443',
|
||||
displayHost: 'localhost:3443',
|
||||
errorCode: -202,
|
||||
canProceed: true
|
||||
})
|
||||
|
||||
expect(controller.proceed('page-1', 'challenge-1')).toEqual({ ok: true })
|
||||
expect(guest.loadURL).toHaveBeenCalledWith('https://localhost:3443/app')
|
||||
expect(onFailureChanged).toHaveBeenLastCalledWith(guest.id, null)
|
||||
|
||||
const sameEndpoint = certificateEvent({
|
||||
controller,
|
||||
guest,
|
||||
url: 'wss://localhost:3443/socket'
|
||||
})
|
||||
expect(sameEndpoint.preventDefault).toHaveBeenCalledOnce()
|
||||
expect(sameEndpoint.callback).toHaveBeenCalledOnce()
|
||||
expect(sameEndpoint.callback).toHaveBeenCalledWith(true)
|
||||
|
||||
const otherTab = certificateEvent({ controller, guest: otherGuest })
|
||||
expect(otherTab.callback).toHaveBeenCalledWith(false)
|
||||
expect(otherTab.preventDefault).not.toHaveBeenCalled()
|
||||
|
||||
const otherPort = certificateEvent({
|
||||
controller,
|
||||
guest,
|
||||
url: 'https://localhost:3444/'
|
||||
})
|
||||
expect(otherPort.callback).toHaveBeenCalledWith(false)
|
||||
expect(otherPort.preventDefault).not.toHaveBeenCalled()
|
||||
|
||||
const otherCertificate = certificateEvent({
|
||||
controller,
|
||||
guest,
|
||||
certificate: SECOND_CERTIFICATE
|
||||
})
|
||||
expect(otherCertificate.callback).toHaveBeenCalledWith(false)
|
||||
expect(otherCertificate.preventDefault).not.toHaveBeenCalled()
|
||||
})
|
||||
|
||||
it('blocks a session-cached certificate for sibling requests until that guest approves it', () => {
|
||||
certificateEvent({ controller, guest })
|
||||
expect(controller.proceed('page-1', 'challenge-1')).toEqual({ ok: true })
|
||||
expect(certificateEvent({ controller, guest }).callback).toHaveBeenCalledWith(true)
|
||||
|
||||
const siblingMainFrame = beforeRequest({ webContentsId: otherGuest.id })
|
||||
expect(siblingMainFrame).toHaveBeenCalledWith({ cancel: true })
|
||||
expect(controller.getFailure('page-2')).toMatchObject({
|
||||
challengeId: 'challenge-2',
|
||||
browserPageId: 'page-2',
|
||||
origin: 'https://localhost:3443',
|
||||
canProceed: true
|
||||
})
|
||||
|
||||
expect(
|
||||
beforeRequest({ webContentsId: otherGuest.id, resourceType: 'webSocket' })
|
||||
).toHaveBeenCalledWith({ cancel: true })
|
||||
expect(beforeRequest({ resourceType: 'webSocket' })).toHaveBeenCalledWith({ cancel: true })
|
||||
expect(
|
||||
beforeRequest({ url: 'https://localhost:3444/app', webContentsId: otherGuest.id })
|
||||
).toHaveBeenCalledWith({})
|
||||
expect(beforeRequest({ webContentsId: guest.id })).toHaveBeenCalledWith({})
|
||||
|
||||
expect(controller.proceed('page-2', 'challenge-2')).toEqual({ ok: true })
|
||||
expect(beforeRequest({ webContentsId: otherGuest.id })).toHaveBeenCalledWith({})
|
||||
})
|
||||
|
||||
it('fails closed when an accepted endpoint presents a replacement bad certificate', () => {
|
||||
certificateEvent({ controller, guest })
|
||||
expect(controller.proceed('page-1', 'challenge-1')).toEqual({ ok: true })
|
||||
expect(certificateEvent({ controller, guest }).callback).toHaveBeenCalledWith(true)
|
||||
|
||||
controller.onMainFrameNavigationStarted(guest.id)
|
||||
const replacement = certificateEvent({ controller, guest, certificate: SECOND_CERTIFICATE })
|
||||
|
||||
expect(replacement.callback).toHaveBeenCalledWith(false)
|
||||
expect(replacement.preventDefault).not.toHaveBeenCalled()
|
||||
expect(controller.getFailure('page-1')).toBeNull()
|
||||
})
|
||||
|
||||
it('rejects proceed for a second tab whose pending leaf conflicts with an accepted identity', () => {
|
||||
// Both tabs observe different leaves before either is approved.
|
||||
certificateEvent({ controller, guest })
|
||||
certificateEvent({ controller, guest: otherGuest, certificate: SECOND_CERTIFICATE })
|
||||
expect(controller.getFailure('page-1')?.challengeId).toBe('challenge-1')
|
||||
expect(controller.getFailure('page-2')?.challengeId).toBe('challenge-2')
|
||||
|
||||
expect(controller.proceed('page-1', 'challenge-1')).toEqual({ ok: true })
|
||||
// First proceed pins the session identity; the sibling's conflicting leaf
|
||||
// must not report success (Chromium cannot honor a second bad leaf).
|
||||
expect(controller.proceed('page-2', 'challenge-2')).toEqual({
|
||||
ok: false,
|
||||
reason: 'ineligible'
|
||||
})
|
||||
expect(otherGuest.loadURL).not.toHaveBeenCalled()
|
||||
})
|
||||
|
||||
it('never offers approval for public hosts, non-authority failures, or subframes', () => {
|
||||
for (const event of [
|
||||
certificateEvent({ controller, guest, url: 'https://example.com/' }),
|
||||
certificateEvent({ controller, guest, error: 'ERR_CERT_DATE_INVALID' }),
|
||||
certificateEvent({ controller, guest, isMainFrame: false })
|
||||
]) {
|
||||
expect(event.callback).toHaveBeenCalledOnce()
|
||||
expect(event.callback).toHaveBeenCalledWith(false)
|
||||
expect(event.preventDefault).not.toHaveBeenCalled()
|
||||
}
|
||||
expect(controller.getFailure('page-1')).toBeNull()
|
||||
expect(onFailureChanged).not.toHaveBeenCalled()
|
||||
})
|
||||
|
||||
it('queues an early challenge until the guest receives its browser page identity', () => {
|
||||
pageByGuestId.set(guest.id, null)
|
||||
certificateEvent({ controller, guest })
|
||||
|
||||
expect(onFailureChanged).not.toHaveBeenCalled()
|
||||
expect(controller.getFailure('page-1')).toBeNull()
|
||||
|
||||
pageByGuestId.set(guest.id, 'page-1')
|
||||
controller.onGuestRegistered(guest.id, 'page-1')
|
||||
|
||||
expect(onFailureChanged).toHaveBeenCalledWith(
|
||||
guest.id,
|
||||
expect.objectContaining({ challengeId: 'challenge-1', browserPageId: 'page-1' }),
|
||||
'https://localhost:3443/app'
|
||||
)
|
||||
})
|
||||
|
||||
it('rejects stale, expired, destroyed, and mismatched approval attempts', () => {
|
||||
certificateEvent({ controller, guest })
|
||||
|
||||
expect(controller.proceed('page-1', 'wrong-challenge')).toEqual({
|
||||
ok: false,
|
||||
reason: 'changed'
|
||||
})
|
||||
now += 5 * 60_000
|
||||
expect(controller.proceed('page-1', 'challenge-1')).toEqual({
|
||||
ok: false,
|
||||
reason: 'expired'
|
||||
})
|
||||
|
||||
certificateEvent({ controller, guest })
|
||||
vi.mocked(guest.isDestroyed).mockReturnValue(true)
|
||||
expect(controller.proceed('page-1', 'challenge-2')).toEqual({
|
||||
ok: false,
|
||||
reason: 'missing'
|
||||
})
|
||||
expect(guest.loadURL).not.toHaveBeenCalled()
|
||||
})
|
||||
|
||||
it('clears pending approval and grants when navigation or guest ownership changes', () => {
|
||||
certificateEvent({ controller, guest })
|
||||
controller.onMainFrameNavigationStarted(guest.id)
|
||||
expect(controller.getFailure('page-1')).toBeNull()
|
||||
expect(controller.proceed('page-1', 'challenge-1')).toEqual({
|
||||
ok: false,
|
||||
reason: 'missing'
|
||||
})
|
||||
|
||||
certificateEvent({ controller, guest })
|
||||
expect(controller.proceed('page-1', 'challenge-2')).toEqual({ ok: true })
|
||||
controller.onMainFrameNavigationCommitted(guest.id, 'https://example.com/')
|
||||
const afterCommit = certificateEvent({ controller, guest })
|
||||
expect(afterCommit.callback).toHaveBeenCalledWith(false)
|
||||
|
||||
controller.onGuestRetired(guest.id)
|
||||
expect(controller.getFailure('page-1')).toBeNull()
|
||||
})
|
||||
|
||||
it('answers malformed and unmanaged events exactly once without overriding Electron', () => {
|
||||
pageByGuestId.delete(guest.id)
|
||||
const unmanaged = certificateEvent({ controller, guest })
|
||||
const malformedUrl = certificateEvent({ controller, guest: otherGuest, url: 'not a URL' })
|
||||
const malformedCertificate = certificateEvent({
|
||||
controller,
|
||||
guest: otherGuest,
|
||||
certificate: { data: 'not a PEM certificate' } as Electron.Certificate
|
||||
})
|
||||
|
||||
for (const event of [unmanaged, malformedUrl, malformedCertificate]) {
|
||||
expect(event.callback).toHaveBeenCalledOnce()
|
||||
expect(event.callback).toHaveBeenCalledWith(false)
|
||||
expect(event.preventDefault).not.toHaveBeenCalled()
|
||||
}
|
||||
})
|
||||
})
|
||||
@@ -0,0 +1,300 @@
|
||||
import { randomUUID } from 'node:crypto'
|
||||
import type { BrowserCertificateFailure, BrowserCertificateProceedResult } from '../../shared/types'
|
||||
import {
|
||||
isEligibleLocalCertificateHost,
|
||||
toSecureCertificateEndpoint
|
||||
} from '../../shared/browser-url'
|
||||
import {
|
||||
certificateChallengeIdentityMatches,
|
||||
CERTIFICATE_CHALLENGE_TTL_MS,
|
||||
MAX_PENDING_CERTIFICATE_CHALLENGES,
|
||||
toBrowserCertificateFailure,
|
||||
type BrowserCertificateTrustControllerDependencies,
|
||||
type PendingCertificateChallenge
|
||||
} from './browser-certificate-challenge'
|
||||
import {
|
||||
getLeafCertificateSha256,
|
||||
getSupportedCertificateErrorCode,
|
||||
normalizeCertificateError,
|
||||
SUPPORTED_CERTIFICATE_ERROR,
|
||||
SUPPORTED_CERTIFICATE_ERROR_CODE
|
||||
} from './browser-certificate-identity'
|
||||
import { BrowserCertificateRequestGuard } from './browser-certificate-request-guard'
|
||||
|
||||
export type { ManagedBrowserGuestContext } from './browser-certificate-challenge'
|
||||
|
||||
export class BrowserCertificateTrustController {
|
||||
private readonly pendingByGuestId = new Map<number, PendingCertificateChallenge>()
|
||||
private readonly navigationSequenceByGuestId = new Map<number, number>()
|
||||
private readonly expiryTimerByGuestId = new Map<number, ReturnType<typeof setTimeout>>()
|
||||
private readonly requestGuard: BrowserCertificateRequestGuard
|
||||
|
||||
constructor(private readonly dependencies: BrowserCertificateTrustControllerDependencies) {
|
||||
this.requestGuard = new BrowserCertificateRequestGuard({
|
||||
onBlockedMainFrame: (blocked) => {
|
||||
const context = this.dependencies.resolveManagedGuestContext(blocked.webContentsId)
|
||||
if (context) {
|
||||
this.recordPendingChallenge({
|
||||
...blocked,
|
||||
browserPageId: context.browserPageId
|
||||
})
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
installSessionRequestGuard(session: Electron.Session): void {
|
||||
this.requestGuard.installSession(session)
|
||||
}
|
||||
removeSessionRequestGuard(session: Electron.Session): void {
|
||||
this.requestGuard.removeSession(session)
|
||||
}
|
||||
|
||||
handleCertificateError(args: {
|
||||
event: Pick<Electron.Event, 'preventDefault'>
|
||||
webContents: Electron.WebContents
|
||||
url: string
|
||||
error: string
|
||||
certificate: Electron.Certificate
|
||||
callback: (isTrusted: boolean) => void
|
||||
isMainFrame: boolean
|
||||
}): void {
|
||||
let answered = false
|
||||
const answer = (trusted: boolean): void => {
|
||||
if (!answered) {
|
||||
answered = true
|
||||
args.callback(trusted)
|
||||
}
|
||||
}
|
||||
try {
|
||||
const context = this.dependencies.resolveManagedGuestContext(args.webContents.id)
|
||||
const parsed = new URL(args.url)
|
||||
const endpoint = toSecureCertificateEndpoint(args.url)
|
||||
const digest = getLeafCertificateSha256(args.certificate)
|
||||
const error = normalizeCertificateError(args.error)
|
||||
if (!context || !endpoint || !digest) {
|
||||
answer(false)
|
||||
return
|
||||
}
|
||||
const identity = { secureEndpoint: endpoint, leafCertificateSha256: digest, error }
|
||||
if (
|
||||
this.requestGuard.shouldTrustCertificate(
|
||||
args.webContents.session,
|
||||
args.webContents.id,
|
||||
identity
|
||||
)
|
||||
) {
|
||||
args.event.preventDefault()
|
||||
answer(true)
|
||||
return
|
||||
}
|
||||
if (
|
||||
args.isMainFrame &&
|
||||
parsed.protocol === 'https:' &&
|
||||
error === SUPPORTED_CERTIFICATE_ERROR &&
|
||||
isEligibleLocalCertificateHost(parsed.hostname) &&
|
||||
this.requestGuard.canOfferCertificate(args.webContents.session, identity)
|
||||
) {
|
||||
this.recordPendingChallenge({
|
||||
webContentsId: args.webContents.id,
|
||||
browserPageId: context.browserPageId,
|
||||
navigationUrl: args.url,
|
||||
origin: parsed.origin,
|
||||
displayHost: parsed.host,
|
||||
secureEndpoint: endpoint,
|
||||
leafCertificateSha256: digest,
|
||||
error
|
||||
})
|
||||
}
|
||||
answer(false)
|
||||
} catch {
|
||||
answer(false)
|
||||
}
|
||||
}
|
||||
|
||||
onGuestRegistered(webContentsId: number, browserPageId: string): void {
|
||||
const pending = this.pendingByGuestId.get(webContentsId)
|
||||
if (!pending) {
|
||||
return
|
||||
}
|
||||
pending.browserPageId = browserPageId
|
||||
this.emitFailure(pending)
|
||||
}
|
||||
|
||||
onGuestRetired(webContentsId: number): void {
|
||||
this.clearPending(webContentsId, true)
|
||||
this.requestGuard.revokeGuest(webContentsId)
|
||||
this.navigationSequenceByGuestId.delete(webContentsId)
|
||||
}
|
||||
|
||||
onMainFrameNavigationStarted(webContentsId: number): void {
|
||||
this.navigationSequenceByGuestId.set(
|
||||
webContentsId,
|
||||
(this.navigationSequenceByGuestId.get(webContentsId) ?? 0) + 1
|
||||
)
|
||||
this.clearPending(webContentsId, true)
|
||||
}
|
||||
|
||||
onMainFrameNavigationCommitted(webContentsId: number, url: string): void {
|
||||
this.requestGuard.revokeForCommittedNavigation(webContentsId, url)
|
||||
}
|
||||
|
||||
getFailure(browserPageId: string): BrowserCertificateFailure | null {
|
||||
this.pruneExpired()
|
||||
for (const pending of this.pendingByGuestId.values()) {
|
||||
if (pending.browserPageId === browserPageId) {
|
||||
return toBrowserCertificateFailure(pending)
|
||||
}
|
||||
}
|
||||
return null
|
||||
}
|
||||
|
||||
proceed(browserPageId: string, challengeId: string): BrowserCertificateProceedResult {
|
||||
const webContentsId = this.dependencies.resolveWebContentsIdForPage(browserPageId)
|
||||
if (webContentsId === null) {
|
||||
return { ok: false, reason: 'missing' }
|
||||
}
|
||||
const pending = this.pendingByGuestId.get(webContentsId)
|
||||
if (!pending) {
|
||||
return { ok: false, reason: 'missing' }
|
||||
}
|
||||
if (pending.challengeId !== challengeId || pending.browserPageId !== browserPageId) {
|
||||
return { ok: false, reason: 'changed' }
|
||||
}
|
||||
if (pending.expiresAt <= this.now()) {
|
||||
this.clearPending(webContentsId, true)
|
||||
return { ok: false, reason: 'expired' }
|
||||
}
|
||||
if (pending.errorCode !== SUPPORTED_CERTIFICATE_ERROR_CODE) {
|
||||
return { ok: false, reason: 'ineligible' }
|
||||
}
|
||||
if (pending.navigationSequence !== (this.navigationSequenceByGuestId.get(webContentsId) ?? 0)) {
|
||||
return { ok: false, reason: 'navigated' }
|
||||
}
|
||||
const context = this.dependencies.resolveManagedGuestContext(webContentsId)
|
||||
const guest = this.dependencies.resolveWebContents(webContentsId)
|
||||
if (!context || context.browserPageId !== browserPageId || !guest || guest.isDestroyed()) {
|
||||
return { ok: false, reason: 'missing' }
|
||||
}
|
||||
const granted = this.requestGuard.grant(guest.session, {
|
||||
guestWebContentsId: webContentsId,
|
||||
secureEndpoint: pending.secureEndpoint,
|
||||
leafCertificateSha256: pending.leafCertificateSha256,
|
||||
error: pending.error
|
||||
})
|
||||
if (!granted) {
|
||||
return { ok: false, reason: 'ineligible' }
|
||||
}
|
||||
const navigationUrl = pending.navigationUrl
|
||||
this.clearPending(webContentsId, true)
|
||||
void guest.loadURL(navigationUrl).catch(() => {})
|
||||
return { ok: true }
|
||||
}
|
||||
|
||||
private recordPendingChallenge(args: {
|
||||
webContentsId: number
|
||||
browserPageId: string | null
|
||||
navigationUrl: string
|
||||
origin: string
|
||||
displayHost: string
|
||||
secureEndpoint: string
|
||||
leafCertificateSha256: string
|
||||
error: string
|
||||
}): void {
|
||||
const navigationSequence = this.navigationSequenceByGuestId.get(args.webContentsId) ?? 0
|
||||
const existing = this.pendingByGuestId.get(args.webContentsId)
|
||||
if (
|
||||
existing &&
|
||||
certificateChallengeIdentityMatches(existing, {
|
||||
navigationSequence,
|
||||
secureEndpoint: args.secureEndpoint,
|
||||
leafCertificateSha256: args.leafCertificateSha256,
|
||||
error: args.error
|
||||
})
|
||||
) {
|
||||
return
|
||||
}
|
||||
this.clearPending(args.webContentsId, true)
|
||||
const observedAt = this.now()
|
||||
const pending: PendingCertificateChallenge = {
|
||||
challengeId: this.dependencies.createChallengeId?.() ?? randomUUID(),
|
||||
guestWebContentsId: args.webContentsId,
|
||||
browserPageId: args.browserPageId,
|
||||
navigationSequence,
|
||||
navigationUrl: args.navigationUrl,
|
||||
origin: args.origin,
|
||||
displayHost: args.displayHost,
|
||||
secureEndpoint: args.secureEndpoint,
|
||||
leafCertificateSha256: args.leafCertificateSha256,
|
||||
errorCode: getSupportedCertificateErrorCode(args.error),
|
||||
error: args.error,
|
||||
observedAt,
|
||||
expiresAt: observedAt + CERTIFICATE_CHALLENGE_TTL_MS
|
||||
}
|
||||
this.pendingByGuestId.set(args.webContentsId, pending)
|
||||
this.scheduleExpiry(pending)
|
||||
this.enforcePendingBound()
|
||||
this.emitFailure(pending)
|
||||
}
|
||||
|
||||
private emitFailure(pending: PendingCertificateChallenge): void {
|
||||
if (pending.browserPageId) {
|
||||
this.dependencies.onFailureChanged(
|
||||
pending.guestWebContentsId,
|
||||
toBrowserCertificateFailure(pending),
|
||||
pending.navigationUrl
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
private clearPending(webContentsId: number, notify: boolean): void {
|
||||
const pending = this.pendingByGuestId.get(webContentsId)
|
||||
this.pendingByGuestId.delete(webContentsId)
|
||||
const timer = this.expiryTimerByGuestId.get(webContentsId)
|
||||
if (timer) {
|
||||
clearTimeout(timer)
|
||||
this.expiryTimerByGuestId.delete(webContentsId)
|
||||
}
|
||||
if (notify && pending?.browserPageId) {
|
||||
this.dependencies.onFailureChanged(webContentsId, null)
|
||||
}
|
||||
}
|
||||
|
||||
private scheduleExpiry(pending: PendingCertificateChallenge): void {
|
||||
const timer = setTimeout(
|
||||
() => {
|
||||
if (
|
||||
this.pendingByGuestId.get(pending.guestWebContentsId)?.challengeId === pending.challengeId
|
||||
) {
|
||||
this.clearPending(pending.guestWebContentsId, true)
|
||||
}
|
||||
},
|
||||
Math.max(0, pending.expiresAt - this.now())
|
||||
)
|
||||
timer.unref?.()
|
||||
this.expiryTimerByGuestId.set(pending.guestWebContentsId, timer)
|
||||
}
|
||||
|
||||
private pruneExpired(): void {
|
||||
const now = this.now()
|
||||
for (const pending of this.pendingByGuestId.values()) {
|
||||
if (pending.expiresAt <= now) {
|
||||
this.clearPending(pending.guestWebContentsId, true)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
private enforcePendingBound(): void {
|
||||
while (this.pendingByGuestId.size > MAX_PENDING_CERTIFICATE_CHALLENGES) {
|
||||
const oldest = this.pendingByGuestId.keys().next().value as number | undefined
|
||||
if (oldest === undefined) {
|
||||
return
|
||||
}
|
||||
this.clearPending(oldest, true)
|
||||
}
|
||||
}
|
||||
|
||||
private now(): number {
|
||||
return this.dependencies.now?.() ?? Date.now()
|
||||
}
|
||||
}
|
||||
@@ -781,7 +781,7 @@ describe('browserManager grab operations', () => {
|
||||
const promise = browserManager.awaitGrabSelection('tab-1', 'op-1', guest)
|
||||
|
||||
// Find the did-start-navigation handler and trigger it with isMainFrame=true
|
||||
const navHandler = guestOnMock.mock.calls.find(
|
||||
const navHandler = guestOnMock.mock.calls.findLast(
|
||||
([event]) => event === 'did-start-navigation'
|
||||
)?.[1] as ((...args: unknown[]) => void) | undefined
|
||||
|
||||
@@ -798,7 +798,7 @@ describe('browserManager grab operations', () => {
|
||||
void browserManager.awaitGrabSelection('tab-1', 'op-1', guest)
|
||||
|
||||
// Trigger did-start-navigation with isMainFrame=false (subframe)
|
||||
const navHandler = guestOnMock.mock.calls.find(
|
||||
const navHandler = guestOnMock.mock.calls.findLast(
|
||||
([event]) => event === 'did-start-navigation'
|
||||
)?.[1] as ((...args: unknown[]) => void) | undefined
|
||||
|
||||
|
||||
@@ -104,6 +104,7 @@ describe('browserManager', () => {
|
||||
webContentsFromIdMock.mockReset()
|
||||
openPopupWithOriginBarMock.mockReset()
|
||||
browserManager.unregisterAll()
|
||||
browserManager.setBrowserGuestStateChangedListener(null)
|
||||
browserManager.setDictationShortcutForwardingPredicate(null)
|
||||
browserManager.setSettingsResolver(() => ({}))
|
||||
})
|
||||
@@ -583,6 +584,45 @@ describe('browserManager', () => {
|
||||
expect(browserManager.getSessionProfileIdForTab('browser-1')).toBe('work')
|
||||
})
|
||||
|
||||
it('tracks offscreen load failures for the owning worktree snapshot', () => {
|
||||
const stateChanged = vi.fn()
|
||||
const offscreenGuest = {
|
||||
id: 605,
|
||||
isDestroyed: vi.fn(() => false),
|
||||
getType: vi.fn(() => 'window'),
|
||||
setBackgroundThrottling: vi.fn(),
|
||||
setWindowOpenHandler: vi.fn(),
|
||||
on: vi.fn(),
|
||||
off: vi.fn(),
|
||||
getURL: vi.fn(() => 'https://localhost:3443/')
|
||||
}
|
||||
webContentsFromIdMock.mockReturnValue(offscreenGuest)
|
||||
browserManager.setBrowserGuestStateChangedListener(stateChanged)
|
||||
|
||||
browserManager.registerOffscreenGuest({
|
||||
browserPageId: 'offscreen-page',
|
||||
worktreeId: 'remote-worktree',
|
||||
webContentsId: offscreenGuest.id
|
||||
})
|
||||
const didFailLoad = offscreenGuest.on.mock.calls.find(
|
||||
([event]) => event === 'did-fail-load'
|
||||
)?.[1] as (
|
||||
event: unknown,
|
||||
errorCode: number,
|
||||
errorDescription: string,
|
||||
validatedUrl: string,
|
||||
isMainFrame: boolean
|
||||
) => void
|
||||
didFailLoad(null, -202, 'Certificate authority invalid', 'https://localhost:3443/', true)
|
||||
|
||||
expect(browserManager.getBrowserPageLoadError('offscreen-page')).toEqual({
|
||||
code: -202,
|
||||
description: 'Certificate authority invalid',
|
||||
validatedUrl: 'https://localhost:3443/'
|
||||
})
|
||||
expect(stateChanged).toHaveBeenCalledWith('remote-worktree')
|
||||
})
|
||||
|
||||
it('falls back to opening popup URLs externally before a guest is registered', () => {
|
||||
const guest = {
|
||||
id: 105,
|
||||
@@ -1588,6 +1628,163 @@ describe('browserManager', () => {
|
||||
validatedUrl: 'http://localhost:3000/'
|
||||
}
|
||||
})
|
||||
expect(browserManager.getBrowserPageLoadError('browser-1')).toEqual({
|
||||
code: -105,
|
||||
description: 'Name not resolved',
|
||||
validatedUrl: 'http://localhost:3000/'
|
||||
})
|
||||
|
||||
const didStartNavigationHandler = guestOnMock.mock.calls.find(
|
||||
([event]) => event === 'did-start-navigation'
|
||||
)?.[1] as
|
||||
| ((event: unknown, url: string, isInPlace: boolean, isMainFrame: boolean) => void)
|
||||
| undefined
|
||||
didStartNavigationHandler?.(null, 'http://localhost:3000/retry', false, true)
|
||||
expect(browserManager.getBrowserPageLoadError('browser-1')).toBeNull()
|
||||
})
|
||||
|
||||
it('drops a queued failure when a replacement navigation starts before registration', () => {
|
||||
const rendererSendMock = vi.fn()
|
||||
const guest = {
|
||||
id: 407,
|
||||
isDestroyed: vi.fn(() => false),
|
||||
getType: vi.fn(() => 'webview'),
|
||||
setBackgroundThrottling: guestSetBackgroundThrottlingMock,
|
||||
setWindowOpenHandler: guestSetWindowOpenHandlerMock,
|
||||
on: guestOnMock,
|
||||
off: guestOffMock,
|
||||
openDevTools: guestOpenDevToolsMock,
|
||||
getURL: vi.fn(() => 'https://example.com/')
|
||||
}
|
||||
webContentsFromIdMock.mockImplementation((id: number) =>
|
||||
id === guest.id
|
||||
? guest
|
||||
: id === rendererWebContentsId
|
||||
? { isDestroyed: vi.fn(() => false), send: rendererSendMock }
|
||||
: null
|
||||
)
|
||||
|
||||
browserManager.attachGuestPolicies(guest as never)
|
||||
const didFailLoad = guestOnMock.mock.calls.find(
|
||||
([event]) => event === 'did-fail-load'
|
||||
)?.[1] as (
|
||||
event: unknown,
|
||||
errorCode: number,
|
||||
errorDescription: string,
|
||||
validatedUrl: string,
|
||||
isMainFrame: boolean
|
||||
) => void
|
||||
const didStartNavigation = guestOnMock.mock.calls.find(
|
||||
([event]) => event === 'did-start-navigation'
|
||||
)?.[1] as (event: unknown, url: string, isInPlace: boolean, isMainFrame: boolean) => void
|
||||
|
||||
didFailLoad(null, -202, 'Certificate authority invalid', 'https://localhost:3443/', true)
|
||||
didStartNavigation(null, 'https://example.com/', false, true)
|
||||
expect(
|
||||
browserManager.registerGuest({
|
||||
browserPageId: 'browser-late-registration',
|
||||
webContentsId: guest.id,
|
||||
rendererWebContentsId
|
||||
})
|
||||
).toBe(true)
|
||||
|
||||
expect(rendererSendMock).not.toHaveBeenCalledWith(
|
||||
'browser:guest-load-failed',
|
||||
expect.anything()
|
||||
)
|
||||
expect(browserManager.getBrowserPageLoadError('browser-late-registration')).toBeNull()
|
||||
})
|
||||
|
||||
it('keeps a certificate failure until a real main-frame navigation starts', () => {
|
||||
const guest = {
|
||||
id: 405,
|
||||
isDestroyed: vi.fn(() => false),
|
||||
getType: vi.fn(() => 'webview'),
|
||||
setBackgroundThrottling: guestSetBackgroundThrottlingMock,
|
||||
setWindowOpenHandler: guestSetWindowOpenHandlerMock,
|
||||
on: guestOnMock,
|
||||
off: guestOffMock,
|
||||
openDevTools: guestOpenDevToolsMock,
|
||||
send: vi.fn(),
|
||||
getURL: vi.fn(() => 'chrome-error://chromewebdata/')
|
||||
}
|
||||
webContentsFromIdMock.mockReturnValue(guest)
|
||||
|
||||
browserManager.attachGuestPolicies(guest as never)
|
||||
const didStartNavigation = guestOnMock.mock.calls.find(
|
||||
([event]) => event === 'did-start-navigation'
|
||||
)?.[1] as (event: unknown, url: string, isInPlace: boolean, isMainFrame: boolean) => void
|
||||
const didFailLoad = guestOnMock.mock.calls.find(
|
||||
([event]) => event === 'did-fail-load'
|
||||
)?.[1] as (
|
||||
event: unknown,
|
||||
errorCode: number,
|
||||
errorDescription: string,
|
||||
validatedUrl: string,
|
||||
isMainFrame: boolean
|
||||
) => void
|
||||
|
||||
browserManager.registerGuest({
|
||||
browserPageId: 'browser-certificate-page',
|
||||
webContentsId: guest.id,
|
||||
rendererWebContentsId
|
||||
})
|
||||
didFailLoad(null, -202, 'Certificate authority invalid', 'https://localhost:3443/', true)
|
||||
didStartNavigation(null, 'chrome-error://chromewebdata/', false, true)
|
||||
expect(browserManager.getBrowserPageLoadError('browser-certificate-page')?.code).toBe(-202)
|
||||
|
||||
didStartNavigation(null, 'https://localhost:3443/', false, true)
|
||||
expect(browserManager.getBrowserPageLoadError('browser-certificate-page')).toBeNull()
|
||||
})
|
||||
|
||||
it('restores a certificate failure when a retry navigation aborts before committing', () => {
|
||||
const guest = {
|
||||
id: 406,
|
||||
isDestroyed: vi.fn(() => false),
|
||||
getType: vi.fn(() => 'webview'),
|
||||
setBackgroundThrottling: guestSetBackgroundThrottlingMock,
|
||||
setWindowOpenHandler: guestSetWindowOpenHandlerMock,
|
||||
on: guestOnMock,
|
||||
off: guestOffMock,
|
||||
openDevTools: guestOpenDevToolsMock,
|
||||
send: vi.fn(),
|
||||
getURL: vi.fn(() => 'chrome-error://chromewebdata/')
|
||||
}
|
||||
webContentsFromIdMock.mockReturnValue(guest)
|
||||
|
||||
browserManager.attachGuestPolicies(guest as never)
|
||||
const didStartNavigation = guestOnMock.mock.calls.find(
|
||||
([event]) => event === 'did-start-navigation'
|
||||
)?.[1] as (event: unknown, url: string, isInPlace: boolean, isMainFrame: boolean) => void
|
||||
const didFailLoad = guestOnMock.mock.calls.find(
|
||||
([event]) => event === 'did-fail-load'
|
||||
)?.[1] as (
|
||||
event: unknown,
|
||||
errorCode: number,
|
||||
errorDescription: string,
|
||||
validatedUrl: string,
|
||||
isMainFrame: boolean
|
||||
) => void
|
||||
|
||||
browserManager.registerGuest({
|
||||
browserPageId: 'browser-retry-abort-page',
|
||||
webContentsId: guest.id,
|
||||
rendererWebContentsId
|
||||
})
|
||||
didFailLoad(null, -202, 'Certificate authority invalid', 'https://localhost:3443/', true)
|
||||
// Retry: the new navigation starts (overlay optimistically cleared)...
|
||||
didStartNavigation(null, 'https://localhost:3443/', false, true)
|
||||
expect(browserManager.getBrowserPageLoadError('browser-retry-abort-page')).toBeNull()
|
||||
// ...then aborts (ERR_ABORTED) before committing, so the error is restored.
|
||||
didFailLoad(null, -3, 'Aborted', 'https://localhost:3443/', true)
|
||||
expect(browserManager.getBrowserPageLoadError('browser-retry-abort-page')?.code).toBe(-202)
|
||||
|
||||
// A fresh navigation from a non-errored state drops the stash, so a later
|
||||
// abort cannot resurrect the old error.
|
||||
didStartNavigation(null, 'https://localhost:3443/', false, true) // stashes -202, clears active
|
||||
didStartNavigation(null, 'https://example.com/', false, true) // active empty -> drops stash
|
||||
didFailLoad(null, -3, 'Aborted', 'https://example.com/', true)
|
||||
expect(browserManager.getBrowserPageLoadError('browser-retry-abort-page')).toBeNull()
|
||||
})
|
||||
|
||||
it('queues permission denials and download requests until the guest registers', () => {
|
||||
|
||||
@@ -9,7 +9,8 @@ import { ORCA_BROWSER_BLANK_URL } from '../../shared/constants'
|
||||
import {
|
||||
normalizeBrowserNavigationUrl,
|
||||
normalizeExternalBrowserUrl,
|
||||
redactKagiSessionToken
|
||||
redactKagiSessionToken,
|
||||
toSecureCertificateEndpoint
|
||||
} from '../../shared/browser-url'
|
||||
import type {
|
||||
BrowserDownloadFinishedEvent,
|
||||
@@ -52,9 +53,18 @@ import {
|
||||
buildBrowserAnnotationViewportBridgeScript
|
||||
} from '../../shared/browser-annotation-viewport-bridge'
|
||||
import type { KeybindingOverrides } from '../../shared/keybindings'
|
||||
import type { BrowserCertificateFailure, BrowserLoadError } from '../../shared/types'
|
||||
import {
|
||||
BrowserCertificateTrustController,
|
||||
type ManagedBrowserGuestContext
|
||||
} from './browser-certificate-trust-controller'
|
||||
|
||||
const AUTOMATION_VISIBILITY_ACQUIRE_TIMEOUT_MS = 2_000
|
||||
|
||||
function isChromiumInternalErrorUrl(url: string): boolean {
|
||||
return url.startsWith('chrome-error://')
|
||||
}
|
||||
|
||||
function resolveWithTimeout<T>(
|
||||
promise: Promise<T>,
|
||||
timeoutMs: number,
|
||||
@@ -238,23 +248,47 @@ export class BrowserManager {
|
||||
private readonly annotationViewportBridgeOpsByTabId = new Map<string, Promise<unknown>>()
|
||||
private readonly worktreeIdByTabId = new Map<string, string>()
|
||||
private readonly policyAttachedGuestIds = new Set<number>()
|
||||
private readonly offscreenGuestIds = new Set<number>()
|
||||
private readonly policyCleanupByGuestId = new Map<number, () => void>()
|
||||
private readonly clickedLinkFrameNameByGuestId = new Map<number, string>()
|
||||
private readonly loadErrorsByGuestId = new Map<number, BrowserLoadError>()
|
||||
// Why: did-start-navigation optimistically hides the overlay, but an aborted
|
||||
// nav never commits — stash the cleared error so did-fail-load(-3) can restore
|
||||
// it instead of stranding the user on a blank surface.
|
||||
private readonly clearedLoadErrorsByGuestId = new Map<number, BrowserLoadError>()
|
||||
private browserGuestStateChangedListener: ((worktreeId: string) => void) | null = null
|
||||
private certificateTrustController: BrowserCertificateTrustController | null = null
|
||||
private shouldForwardDictationShortcut: (() => boolean) | null = null
|
||||
private readonly pendingLoadFailuresByGuestId = new Map<
|
||||
number,
|
||||
{ code: number; description: string; validatedUrl: string }
|
||||
>()
|
||||
|
||||
setDictationShortcutForwardingPredicate(predicate: (() => boolean) | null): void {
|
||||
this.shouldForwardDictationShortcut = predicate
|
||||
}
|
||||
private readonly pendingPermissionEventsByGuestId = new Map<number, PendingPermissionEvent[]>()
|
||||
private readonly pendingPopupEventsByGuestId = new Map<number, PendingPopupEvent[]>()
|
||||
private readonly pendingDownloadIdsByGuestId = new Map<number, string[]>()
|
||||
private readonly downloadsById = new Map<string, ActiveDownload>()
|
||||
private readonly grabSessionController = new BrowserGrabSessionController()
|
||||
|
||||
setDictationShortcutForwardingPredicate(predicate: (() => boolean) | null): void {
|
||||
this.shouldForwardDictationShortcut = predicate
|
||||
}
|
||||
|
||||
setBrowserGuestStateChangedListener(listener: ((worktreeId: string) => void) | null): void {
|
||||
this.browserGuestStateChangedListener = listener
|
||||
}
|
||||
|
||||
setCertificateTrustController(controller: BrowserCertificateTrustController): void {
|
||||
this.certificateTrustController = controller
|
||||
}
|
||||
|
||||
installCertificateRequestGuard(session: Electron.Session): void {
|
||||
this.certificateTrustController?.installSessionRequestGuard(session)
|
||||
}
|
||||
|
||||
removeCertificateRequestGuard(session: Electron.Session): void {
|
||||
this.certificateTrustController?.removeSessionRequestGuard(session)
|
||||
}
|
||||
|
||||
setSettingsResolver(
|
||||
resolver: () => {
|
||||
keybindings?: KeybindingOverrides
|
||||
@@ -827,18 +861,84 @@ export class BrowserManager {
|
||||
validatedURL: string,
|
||||
isMainFrame: boolean
|
||||
): void => {
|
||||
if (!isMainFrame || errorCode === -3) {
|
||||
if (!isMainFrame) {
|
||||
return
|
||||
}
|
||||
this.forwardOrQueueGuestLoadFailure(guest.id, {
|
||||
const browserPageId = this.tabIdByWebContentsId.get(guest.id)
|
||||
const certificateFailure = browserPageId
|
||||
? this.certificateTrustController?.getFailure(browserPageId)
|
||||
: null
|
||||
if (
|
||||
certificateFailure &&
|
||||
toSecureCertificateEndpoint(validatedURL || guest.getURL()) ===
|
||||
toSecureCertificateEndpoint(certificateFailure.origin)
|
||||
) {
|
||||
// Why: a request-guard cancellation is the transport for the existing
|
||||
// certificate warning; do not replace it with ERR_ABORTED/blocked copy.
|
||||
return
|
||||
}
|
||||
if (errorCode === -3) {
|
||||
// Why: an aborted main-frame nav never committed, so restore the error
|
||||
// did-start-navigation optimistically cleared — otherwise a retry that
|
||||
// aborts leaves the failed page with no overlay.
|
||||
const clearedError = this.clearedLoadErrorsByGuestId.get(guest.id)
|
||||
if (clearedError !== undefined) {
|
||||
this.clearedLoadErrorsByGuestId.delete(guest.id)
|
||||
this.loadErrorsByGuestId.set(guest.id, clearedError)
|
||||
this.forwardOrQueueGuestLoadFailure(guest.id, clearedError)
|
||||
this.notifyBrowserGuestStateChanged(guest.id)
|
||||
}
|
||||
return
|
||||
}
|
||||
this.clearedLoadErrorsByGuestId.delete(guest.id)
|
||||
const loadError = {
|
||||
code: errorCode,
|
||||
description: errorDescription || 'This site could not be reached.',
|
||||
validatedUrl: validatedURL || guest.getURL() || 'about:blank'
|
||||
})
|
||||
validatedUrl: redactKagiSessionToken(validatedURL || guest.getURL() || 'about:blank')
|
||||
}
|
||||
this.loadErrorsByGuestId.set(guest.id, loadError)
|
||||
this.forwardOrQueueGuestLoadFailure(guest.id, loadError)
|
||||
this.notifyBrowserGuestStateChanged(guest.id)
|
||||
}
|
||||
|
||||
const didStartNavigationHandler = (
|
||||
_event: Electron.Event,
|
||||
url: string,
|
||||
_isInPlace: boolean,
|
||||
isMainFrame: boolean
|
||||
): void => {
|
||||
if (!isMainFrame || isChromiumInternalErrorUrl(url)) {
|
||||
return
|
||||
}
|
||||
this.certificateTrustController?.onMainFrameNavigationStarted(guest.id)
|
||||
// Why: a failure queued before renderer registration belongs only to the
|
||||
// navigation that produced it. A replacement navigation must not replay
|
||||
// that stale failure when its later dom-ready registers the guest.
|
||||
this.pendingLoadFailuresByGuestId.delete(guest.id)
|
||||
const activeError = this.loadErrorsByGuestId.get(guest.id)
|
||||
if (activeError === undefined) {
|
||||
// Why: no error to hide; drop any stale stash so a later abort cannot
|
||||
// resurrect an error from a navigation that already succeeded.
|
||||
this.clearedLoadErrorsByGuestId.delete(guest.id)
|
||||
return
|
||||
}
|
||||
this.clearedLoadErrorsByGuestId.set(guest.id, activeError)
|
||||
this.loadErrorsByGuestId.delete(guest.id)
|
||||
this.notifyBrowserGuestStateChanged(guest.id)
|
||||
}
|
||||
|
||||
const didNavigateHandler = (_event: Electron.Event, url: string): void => {
|
||||
// Why: a committed navigation means the optimistic stash from
|
||||
// did-start-navigation is obsolete — drop it so a later ERR_ABORTED
|
||||
// cannot restore a failure over the already-committed page.
|
||||
this.clearedLoadErrorsByGuestId.delete(guest.id)
|
||||
this.certificateTrustController?.onMainFrameNavigationCommitted(guest.id, url)
|
||||
}
|
||||
|
||||
guest.on('will-navigate', navigationGuard)
|
||||
guest.on('will-redirect', navigationGuard)
|
||||
guest.on('did-start-navigation', didStartNavigationHandler)
|
||||
guest.on('did-navigate', didNavigateHandler)
|
||||
guest.on('did-fail-load', didFailLoadHandler)
|
||||
const handleDestroyed = (): void => {
|
||||
// Why: guests can be destroyed before renderer registration. Without
|
||||
@@ -874,6 +974,8 @@ export class BrowserManager {
|
||||
if (!guest.isDestroyed()) {
|
||||
guest.off('will-navigate', navigationGuard)
|
||||
guest.off('will-redirect', navigationGuard)
|
||||
guest.off('did-start-navigation', didStartNavigationHandler)
|
||||
guest.off('did-navigate', didNavigateHandler)
|
||||
guest.off('did-fail-load', didFailLoadHandler)
|
||||
}
|
||||
})
|
||||
@@ -918,6 +1020,7 @@ export class BrowserManager {
|
||||
|
||||
private cleanupGuestPolicyAttachment(guestWebContentsId: number): void {
|
||||
const isPrimaryGuest = this.tabIdByWebContentsId.has(guestWebContentsId)
|
||||
this.certificateTrustController?.onGuestRetired(guestWebContentsId)
|
||||
const policyCleanup = this.policyCleanupByGuestId.get(guestWebContentsId)
|
||||
if (policyCleanup) {
|
||||
policyCleanup()
|
||||
@@ -925,6 +1028,7 @@ export class BrowserManager {
|
||||
}
|
||||
this.policyAttachedGuestIds.delete(guestWebContentsId)
|
||||
this.clickedLinkFrameNameByGuestId.delete(guestWebContentsId)
|
||||
this.offscreenGuestIds.delete(guestWebContentsId)
|
||||
this.popupOwnerContextByGuestId.delete(guestWebContentsId)
|
||||
// Why: a popup must stop inheriting authorization as soon as its primary
|
||||
// owner is retired, even if Chromium has not destroyed the child yet.
|
||||
@@ -936,6 +1040,8 @@ export class BrowserManager {
|
||||
}
|
||||
}
|
||||
this.pendingLoadFailuresByGuestId.delete(guestWebContentsId)
|
||||
this.loadErrorsByGuestId.delete(guestWebContentsId)
|
||||
this.clearedLoadErrorsByGuestId.delete(guestWebContentsId)
|
||||
this.pendingPermissionEventsByGuestId.delete(guestWebContentsId)
|
||||
this.pendingPopupEventsByGuestId.delete(guestWebContentsId)
|
||||
this.cancelPendingDownloadsForGuest(guestWebContentsId)
|
||||
@@ -949,10 +1055,10 @@ export class BrowserManager {
|
||||
sessionProfileId,
|
||||
webContentsId,
|
||||
rendererWebContentsId
|
||||
}: BrowserGuestRegistration): void {
|
||||
}: BrowserGuestRegistration): boolean {
|
||||
const browserTabId = browserPageId ?? legacyBrowserTabId
|
||||
if (!browserTabId) {
|
||||
return
|
||||
return false
|
||||
}
|
||||
// Why: re-registering the same browser tab can happen when Chromium swaps
|
||||
// or recreates the underlying guest surface. Any active grab is bound to
|
||||
@@ -968,7 +1074,7 @@ export class BrowserManager {
|
||||
|
||||
const guest = webContents.fromId(webContentsId)
|
||||
if (!guest || guest.isDestroyed()) {
|
||||
return
|
||||
return false
|
||||
}
|
||||
|
||||
// Why: the renderer sends webContentsId, which we must not blindly trust.
|
||||
@@ -976,21 +1082,20 @@ export class BrowserManager {
|
||||
// causing us to overwrite its setWindowOpenHandler or attach unintended
|
||||
// context menus. Only accept genuine webview guest surfaces.
|
||||
if (guest.getType() !== 'webview') {
|
||||
return
|
||||
return false
|
||||
}
|
||||
if (!this.policyAttachedGuestIds.has(webContentsId)) {
|
||||
// Why: renderer registration is only the second half of the guest setup.
|
||||
// Main must only trust guests that already passed attach-time policy
|
||||
// installation; otherwise a trusted renderer could point us at some other
|
||||
// arbitrary webview and bypass the intended host-window attach boundary.
|
||||
return
|
||||
return false
|
||||
}
|
||||
|
||||
const previousWebContentsId = this.webContentsIdByTabId.get(browserTabId)
|
||||
if (previousWebContentsId !== undefined && previousWebContentsId !== webContentsId) {
|
||||
this.retireStaleGuestWebContents(previousWebContentsId)
|
||||
}
|
||||
|
||||
this.webContentsIdByTabId.set(browserTabId, webContentsId)
|
||||
this.tabIdByWebContentsId.set(webContentsId, browserTabId)
|
||||
if (workspaceId) {
|
||||
@@ -1001,6 +1106,7 @@ export class BrowserManager {
|
||||
if (worktreeId) {
|
||||
this.worktreeIdByTabId.set(browserTabId, worktreeId)
|
||||
}
|
||||
this.certificateTrustController?.onGuestRegistered(webContentsId, browserTabId)
|
||||
|
||||
this.setupContextMenu(browserTabId, guest)
|
||||
this.setupGrabShortcut(browserTabId, guest)
|
||||
@@ -1010,6 +1116,7 @@ export class BrowserManager {
|
||||
this.flushPendingPermissionEvents(browserTabId, webContentsId)
|
||||
this.flushPendingPopupEvents(browserTabId, webContentsId)
|
||||
this.flushPendingDownloadRequests(browserTabId, webContentsId)
|
||||
return true
|
||||
}
|
||||
|
||||
unregisterGuest(browserTabId: string): void {
|
||||
@@ -1088,6 +1195,10 @@ export class BrowserManager {
|
||||
if (!guest || guest.isDestroyed()) {
|
||||
return
|
||||
}
|
||||
// Why: offscreen pages have no renderer webview listeners, so main owns
|
||||
// their load-failure lifecycle for remote browser chrome.
|
||||
this.offscreenGuestIds.add(webContentsId)
|
||||
this.attachGuestPolicies(guest)
|
||||
const previousWebContentsId = this.webContentsIdByTabId.get(browserPageId)
|
||||
if (previousWebContentsId !== undefined && previousWebContentsId !== webContentsId) {
|
||||
this.retireStaleGuestWebContents(previousWebContentsId)
|
||||
@@ -1098,6 +1209,7 @@ export class BrowserManager {
|
||||
if (worktreeId) {
|
||||
this.worktreeIdByTabId.set(browserPageId, worktreeId)
|
||||
}
|
||||
this.certificateTrustController?.onGuestRegistered(webContentsId, browserPageId)
|
||||
}
|
||||
|
||||
unregisterAll(): void {
|
||||
@@ -1111,6 +1223,7 @@ export class BrowserManager {
|
||||
this.unregisterGuest(browserTabId)
|
||||
}
|
||||
this.policyAttachedGuestIds.clear()
|
||||
this.offscreenGuestIds.clear()
|
||||
// Why: unregisterGuest only cleans up guests that were registered (have an
|
||||
// entry in webContentsIdByTabId). Guests that went through
|
||||
// attachGuestPolicies but were never registered still have cleanup closures
|
||||
@@ -1125,6 +1238,8 @@ export class BrowserManager {
|
||||
this.worktreeIdByTabId.clear()
|
||||
this.sessionProfileIdByPageId.clear()
|
||||
this.pendingLoadFailuresByGuestId.clear()
|
||||
this.loadErrorsByGuestId.clear()
|
||||
this.clearedLoadErrorsByGuestId.clear()
|
||||
this.pendingPermissionEventsByGuestId.clear()
|
||||
this.pendingPopupEventsByGuestId.clear()
|
||||
this.pendingDownloadIdsByGuestId.clear()
|
||||
@@ -1148,6 +1263,86 @@ export class BrowserManager {
|
||||
return this.sessionProfileIdByPageId.get(browserTabId) ?? null
|
||||
}
|
||||
|
||||
getBrowserPageLoadError(browserPageId: string): BrowserLoadError | null {
|
||||
const webContentsId = this.webContentsIdByTabId.get(browserPageId)
|
||||
return webContentsId === undefined
|
||||
? null
|
||||
: (this.loadErrorsByGuestId.get(webContentsId) ?? null)
|
||||
}
|
||||
|
||||
getBrowserPageCertificateFailure(browserPageId: string): BrowserCertificateFailure | null {
|
||||
return this.certificateTrustController?.getFailure(browserPageId) ?? null
|
||||
}
|
||||
|
||||
getManagedBrowserGuestContext(webContentsId: number): ManagedBrowserGuestContext | null {
|
||||
if (this.popupOwnerContextByGuestId.has(webContentsId)) {
|
||||
return null
|
||||
}
|
||||
const browserPageId = this.tabIdByWebContentsId.get(webContentsId) ?? null
|
||||
const offscreen = this.offscreenGuestIds.has(webContentsId)
|
||||
if (!offscreen && !this.policyAttachedGuestIds.has(webContentsId)) {
|
||||
return null
|
||||
}
|
||||
if (!offscreen) {
|
||||
const guest = webContents.fromId(webContentsId)
|
||||
if (!guest || guest.isDestroyed() || guest.getType() !== 'webview') {
|
||||
return null
|
||||
}
|
||||
}
|
||||
return {
|
||||
browserPageId,
|
||||
worktreeId: browserPageId ? (this.worktreeIdByTabId.get(browserPageId) ?? null) : null,
|
||||
sessionProfileId: browserPageId
|
||||
? (this.sessionProfileIdByPageId.get(browserPageId) ?? null)
|
||||
: null,
|
||||
owner: offscreen ? 'offscreen' : 'desktop-webview'
|
||||
}
|
||||
}
|
||||
|
||||
notifyCertificateFailureChanged(
|
||||
webContentsId: number,
|
||||
failure: BrowserCertificateFailure | null,
|
||||
navigationUrl?: string
|
||||
): void {
|
||||
if (failure && navigationUrl) {
|
||||
const loadError = {
|
||||
code: failure.errorCode ?? -1,
|
||||
description: failure.error,
|
||||
validatedUrl: redactKagiSessionToken(navigationUrl)
|
||||
}
|
||||
this.loadErrorsByGuestId.set(webContentsId, loadError)
|
||||
this.forwardOrQueueGuestLoadFailure(webContentsId, loadError)
|
||||
}
|
||||
const browserPageId = this.tabIdByWebContentsId.get(webContentsId)
|
||||
if (!browserPageId) {
|
||||
return
|
||||
}
|
||||
if (this.offscreenGuestIds.has(webContentsId)) {
|
||||
this.notifyBrowserGuestStateChanged(webContentsId)
|
||||
return
|
||||
}
|
||||
const renderer = this.resolveRendererForBrowserTab(browserPageId)
|
||||
renderer?.send('browser:certificate-failure-changed', { browserPageId, failure })
|
||||
}
|
||||
|
||||
private notifyBrowserGuestStateChanged(webContentsId: number): void {
|
||||
if (!this.offscreenGuestIds.has(webContentsId)) {
|
||||
return
|
||||
}
|
||||
const browserPageId = this.tabIdByWebContentsId.get(webContentsId)
|
||||
const worktreeId = browserPageId ? this.worktreeIdByTabId.get(browserPageId) : null
|
||||
if (worktreeId) {
|
||||
// Why: this runs inside an Electron guest event dispatch; the listener
|
||||
// synchronously reconciles mobile-session tabs, and an escaping throw would
|
||||
// become a fatal uncaught exception (no catch-all main-process guard).
|
||||
try {
|
||||
this.browserGuestStateChangedListener?.(worktreeId)
|
||||
} catch (error) {
|
||||
console.error('[browser-manager] browserGuestStateChanged listener failed', error)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
notifyPermissionDenied(args: {
|
||||
guestWebContentsId: number
|
||||
permission: string
|
||||
@@ -2033,3 +2228,13 @@ export class BrowserManager {
|
||||
}
|
||||
|
||||
export const browserManager = new BrowserManager()
|
||||
export const browserCertificateTrustController = new BrowserCertificateTrustController({
|
||||
resolveManagedGuestContext: (webContentsId) =>
|
||||
browserManager.getManagedBrowserGuestContext(webContentsId),
|
||||
resolveWebContentsIdForPage: (browserPageId) =>
|
||||
browserManager.getGuestWebContentsId(browserPageId),
|
||||
resolveWebContents: (webContentsId) => webContents.fromId(webContentsId) ?? null,
|
||||
onFailureChanged: (webContentsId, failure, navigationUrl) =>
|
||||
browserManager.notifyCertificateFailureChanged(webContentsId, failure, navigationUrl)
|
||||
})
|
||||
browserManager.setCertificateTrustController(browserCertificateTrustController)
|
||||
|
||||
@@ -109,7 +109,9 @@ function installModuleMocks(
|
||||
vi.doMock('./browser-manager', () => ({
|
||||
browserManager: {
|
||||
notifyPermissionDenied: browserManagerNotifyPermissionDeniedMock,
|
||||
handleGuestWillDownload: browserManagerHandleGuestWillDownloadMock
|
||||
handleGuestWillDownload: browserManagerHandleGuestWillDownloadMock,
|
||||
installCertificateRequestGuard: vi.fn(),
|
||||
removeCertificateRequestGuard: vi.fn()
|
||||
}
|
||||
}))
|
||||
vi.doMock('./browser-media-access', () => ({
|
||||
|
||||
@@ -21,7 +21,9 @@ vi.mock('electron', () => ({
|
||||
vi.mock('./browser-manager', () => ({
|
||||
browserManager: {
|
||||
notifyPermissionDenied: vi.fn(),
|
||||
handleGuestWillDownload: vi.fn()
|
||||
handleGuestWillDownload: vi.fn(),
|
||||
installCertificateRequestGuard: vi.fn(),
|
||||
removeCertificateRequestGuard: vi.fn()
|
||||
}
|
||||
}))
|
||||
|
||||
|
||||
@@ -551,6 +551,7 @@ class BrowserSessionRegistry {
|
||||
}
|
||||
|
||||
const sess = session.fromPartition(partition)
|
||||
browserManager.installCertificateRequestGuard(sess)
|
||||
if (typeof sess.getUserAgent === 'function') {
|
||||
const cleanUA = cleanElectronUserAgent(sess.getUserAgent())
|
||||
sess.setUserAgent(cleanUA)
|
||||
@@ -622,6 +623,7 @@ class BrowserSessionRegistry {
|
||||
// Electron Session object survives; clear policy callbacks and listener
|
||||
// bookkeeping so removed profiles do not leave retained closures behind.
|
||||
this.configuredPartitions.delete(partition)
|
||||
browserManager.removeCertificateRequestGuard(sess)
|
||||
sess.removeListener('will-download', this.handleWillDownload)
|
||||
clearBrowserWebAuthnAccessHandlers(sess)
|
||||
sess.setPermissionRequestHandler(null)
|
||||
|
||||
@@ -2210,7 +2210,7 @@ describe('createPtySubprocess', () => {
|
||||
|
||||
expect(spawnMock).toHaveBeenCalledWith(
|
||||
'C:\\PortableGit\\bin\\bash.exe',
|
||||
['--login', '-i'],
|
||||
['-c', 'chcp.com 65001 >/dev/null 2>&1; exec "$BASH" --login -i'],
|
||||
expect.objectContaining({
|
||||
cwd: 'C:\\Users\\jin\\repo',
|
||||
env: expect.objectContaining({ CHERE_INVOKING: '1' })
|
||||
|
||||
@@ -280,6 +280,121 @@ branch refs/heads/main
|
||||
expect(getGitCalls()).toContain('git worktree remove --force /repo-feature')
|
||||
})
|
||||
|
||||
it('force-retries removal when git refuses a clean worktree containing an initialised submodule', async () => {
|
||||
mockGitCommands({
|
||||
'git worktree list --porcelain': {
|
||||
stdout: `worktree /repo
|
||||
HEAD abc123
|
||||
branch refs/heads/main
|
||||
|
||||
worktree /repo-feature
|
||||
HEAD def456
|
||||
branch refs/heads/feature/test
|
||||
`
|
||||
},
|
||||
'git worktree list --porcelain#2': {
|
||||
stdout: `worktree /repo
|
||||
HEAD abc123
|
||||
branch refs/heads/main
|
||||
`
|
||||
},
|
||||
'git worktree remove /repo-feature': {
|
||||
error: new Error('git worktree remove failed'),
|
||||
stderr: 'fatal: working trees containing submodules cannot be moved or removed'
|
||||
},
|
||||
'git status --porcelain --untracked-files=all': { stdout: '' }
|
||||
})
|
||||
|
||||
await removeWorktree('/repo', '/repo-feature')
|
||||
|
||||
const calls = getGitCalls()
|
||||
expectGitCallOrder(
|
||||
calls,
|
||||
'git worktree remove /repo-feature',
|
||||
'git status --porcelain --untracked-files=all'
|
||||
)
|
||||
expectGitCallOrder(
|
||||
calls,
|
||||
'git status --porcelain --untracked-files=all',
|
||||
'git worktree remove --force /repo-feature'
|
||||
)
|
||||
expect(calls).toContain('git branch -d -- feature/test')
|
||||
})
|
||||
|
||||
it('surfaces uncommitted changes instead of force-removing a dirty submodule worktree', async () => {
|
||||
mockGitCommands({
|
||||
'git worktree list --porcelain': {
|
||||
stdout: `worktree /repo
|
||||
HEAD abc123
|
||||
branch refs/heads/main
|
||||
|
||||
worktree /repo-feature
|
||||
HEAD def456
|
||||
branch refs/heads/feature/test
|
||||
`
|
||||
},
|
||||
'git worktree remove /repo-feature': {
|
||||
error: new Error('git worktree remove failed'),
|
||||
stderr: 'fatal: working trees containing submodules cannot be moved or removed'
|
||||
},
|
||||
'git status --porcelain --untracked-files=all': { stdout: ' M sub\n' }
|
||||
})
|
||||
|
||||
await expect(removeWorktree('/repo', '/repo-feature')).rejects.toThrow(
|
||||
'Worktree has uncommitted or untracked changes.'
|
||||
)
|
||||
expect(getGitCalls()).not.toContain('git worktree remove --force /repo-feature')
|
||||
})
|
||||
|
||||
it('does not force-retry when the caller already forced removal', async () => {
|
||||
mockGitCommands({
|
||||
'git worktree list --porcelain': {
|
||||
stdout: `worktree /repo
|
||||
HEAD abc123
|
||||
branch refs/heads/main
|
||||
|
||||
worktree /repo-feature
|
||||
HEAD def456
|
||||
branch refs/heads/feature/test
|
||||
`
|
||||
},
|
||||
'git worktree remove --force /repo-feature': {
|
||||
error: new Error('git worktree remove failed'),
|
||||
stderr: 'fatal: working trees containing submodules cannot be moved or removed'
|
||||
}
|
||||
})
|
||||
|
||||
await expect(removeWorktree('/repo', '/repo-feature', true)).rejects.toThrow()
|
||||
expect(
|
||||
getGitCalls().filter((call) => call === 'git worktree remove --force /repo-feature')
|
||||
).toHaveLength(1)
|
||||
})
|
||||
|
||||
it('does not force-retry unrelated non-force remove failures', async () => {
|
||||
mockGitCommands({
|
||||
'git worktree list --porcelain': {
|
||||
stdout: `worktree /repo
|
||||
HEAD abc123
|
||||
branch refs/heads/main
|
||||
|
||||
worktree /repo-feature
|
||||
HEAD def456
|
||||
branch refs/heads/feature/test
|
||||
`
|
||||
},
|
||||
'git worktree remove /repo-feature': {
|
||||
error: new Error('git worktree remove failed'),
|
||||
stderr: 'fatal: contains modified or untracked files, use --force to delete it'
|
||||
}
|
||||
})
|
||||
|
||||
await expect(removeWorktree('/repo', '/repo-feature')).rejects.toThrow(
|
||||
'git worktree remove failed'
|
||||
)
|
||||
expect(getGitCalls()).not.toContain('git worktree remove --force /repo-feature')
|
||||
expect(getGitCalls()).not.toContain('git status --porcelain --untracked-files=all')
|
||||
})
|
||||
|
||||
it('rejects a locked worktree with stable app-owned copy before invoking remove', async () => {
|
||||
mockGitCommands({
|
||||
'git worktree list --porcelain': {
|
||||
|
||||
@@ -476,6 +476,37 @@ describe('getDiff', () => {
|
||||
})
|
||||
})
|
||||
|
||||
it('flags a deleted image so previewers can fall back to the original bytes', async () => {
|
||||
const pngBuffer = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x00])
|
||||
gitExecFileAsyncBufferMock.mockResolvedValueOnce({ stdout: pngBuffer })
|
||||
statMock.mockRejectedValueOnce(Object.assign(new Error('missing'), { code: 'ENOENT' }))
|
||||
|
||||
const result = await getDiff('/repo', 'assets/deleted.png', false)
|
||||
|
||||
expect(result.kind).toBe('binary')
|
||||
if (result.kind !== 'binary') {
|
||||
throw new Error('expected binary diff result')
|
||||
}
|
||||
expect(result.modifiedDeleted).toBe(true)
|
||||
expect(result.originalContent).toBe(pngBuffer.toString('base64'))
|
||||
expect(result.modifiedContent).toBe('')
|
||||
})
|
||||
|
||||
it('does not treat an unreadable working-tree image as a deletion', async () => {
|
||||
const pngBuffer = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x00])
|
||||
gitExecFileAsyncBufferMock.mockResolvedValueOnce({ stdout: pngBuffer })
|
||||
statMock.mockResolvedValueOnce({ isFile: () => true, size: 5 })
|
||||
readFileMock.mockRejectedValueOnce(new Error('EIO'))
|
||||
|
||||
const result = await getDiff('/repo', 'assets/unreadable.png', false)
|
||||
|
||||
expect(result.kind).toBe('binary')
|
||||
if (result.kind !== 'binary') {
|
||||
throw new Error('expected binary diff result')
|
||||
}
|
||||
expect(result.modifiedDeleted).toBeUndefined()
|
||||
})
|
||||
|
||||
it('coalesces concurrent identical staged diff reads while in flight', async () => {
|
||||
const leftBlob = deferredBuffer('head-content\n')
|
||||
const rightBlob = deferredBuffer('index-content\n')
|
||||
|
||||
+32
-10
@@ -1329,6 +1329,7 @@ async function loadDiff(
|
||||
let modifiedContent = ''
|
||||
let originalIsBinary = false
|
||||
let modifiedIsBinary = false
|
||||
let modifiedDeleted = false
|
||||
|
||||
try {
|
||||
const leftBlob = staged
|
||||
@@ -1343,22 +1344,30 @@ async function loadDiff(
|
||||
const rightBlob = await readGitBlobAtIndexPath(worktreePath, filePath, options)
|
||||
modifiedContent = rightBlob.content
|
||||
modifiedIsBinary = rightBlob.isBinary
|
||||
modifiedDeleted = !rightBlob.exists
|
||||
} else {
|
||||
const workingTreeBlob = await readWorkingTreeFile(path.join(worktreePath, filePath))
|
||||
modifiedContent = workingTreeBlob.content
|
||||
modifiedIsBinary = workingTreeBlob.isBinary
|
||||
modifiedDeleted = !workingTreeBlob.exists
|
||||
}
|
||||
} catch {
|
||||
// Fallback
|
||||
}
|
||||
|
||||
return buildDiffResult(
|
||||
const result = buildDiffResult(
|
||||
originalContent,
|
||||
modifiedContent,
|
||||
originalIsBinary,
|
||||
modifiedIsBinary,
|
||||
filePath
|
||||
)
|
||||
// Why: mark a proven deletion so previewers can fall back to the original bytes
|
||||
// without mistaking a read failure's empty modified side for a deletion.
|
||||
if (result.kind === 'binary' && modifiedDeleted) {
|
||||
return { ...result, modifiedDeleted: true }
|
||||
}
|
||||
return result
|
||||
}
|
||||
|
||||
export async function getBranchCompare(
|
||||
@@ -1859,20 +1868,33 @@ async function readGitBlobAtOidPath(
|
||||
}
|
||||
|
||||
async function readWorkingTreeFile(filePath: string): Promise<GitBlobReadResult> {
|
||||
let fileStat
|
||||
try {
|
||||
const fileStat = await stat(filePath)
|
||||
if (!fileStat.isFile()) {
|
||||
return { content: '', isBinary: false, exists: false }
|
||||
}
|
||||
if (fileStat.size > MAX_GIT_SHOW_BYTES) {
|
||||
// Why: git blob reads are capped through maxBuffer; mirror that bound for
|
||||
// unstaged working-tree content before readFile can pull in huge assets.
|
||||
return { content: '', isBinary: true, exists: true }
|
||||
fileStat = await stat(filePath)
|
||||
} catch (error) {
|
||||
// Why: ENOENT means the working-tree file is genuinely gone (a deletion);
|
||||
// any other stat error is a read failure, which must not be reported as an
|
||||
// absence since callers fall back to the original bytes only for deletions.
|
||||
return {
|
||||
content: '',
|
||||
isBinary: false,
|
||||
exists: (error as NodeJS.ErrnoException)?.code !== 'ENOENT'
|
||||
}
|
||||
}
|
||||
if (!fileStat.isFile()) {
|
||||
return { content: '', isBinary: false, exists: false }
|
||||
}
|
||||
if (fileStat.size > MAX_GIT_SHOW_BYTES) {
|
||||
// Why: git blob reads are capped through maxBuffer; mirror that bound for
|
||||
// unstaged working-tree content before readFile can pull in huge assets.
|
||||
return { content: '', isBinary: true, exists: true }
|
||||
}
|
||||
try {
|
||||
const buffer = await readFile(filePath)
|
||||
return bufferToBlob(buffer, filePath)
|
||||
} catch {
|
||||
return { content: '', isBinary: false, exists: false }
|
||||
// Why: the file exists but could not be read — a read failure, not a deletion.
|
||||
return { content: '', isBinary: false, exists: true }
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -14,6 +14,7 @@ import type {
|
||||
RemoveWorktreeResult
|
||||
} from '../../shared/types'
|
||||
import { assertWorktreeUnlockedForRemoval } from '../../shared/worktree-removal'
|
||||
import { isSubmoduleWorktreeRemovalRefusal } from '../../shared/worktree-submodule-removal'
|
||||
import { decodeGitCQuotedPath } from '../../shared/git-cquoted-path'
|
||||
import { parseGitRevListAheadBehindCounts } from '../../shared/git-rev-list-output'
|
||||
import { parseWslUncPath } from '../../shared/wsl-paths'
|
||||
@@ -1221,7 +1222,21 @@ async function performRemoveWorktree(
|
||||
args.push('--force')
|
||||
}
|
||||
args.push(worktreePath)
|
||||
await gitExecFileAsync(args, gitExecOptions(repoPath, options))
|
||||
try {
|
||||
await gitExecFileAsync(args, gitExecOptions(repoPath, options))
|
||||
} catch (error) {
|
||||
if (force || !isSubmoduleWorktreeRemovalRefusal(error)) {
|
||||
throw error
|
||||
}
|
||||
// Why: Git refuses non-force removal of any worktree with an initialised
|
||||
// submodule even when everything is clean. Re-prove cleanliness (parent
|
||||
// status reports dirty submodule content as ` M <sub>`), then --force.
|
||||
await assertWorktreeCleanForRemoval(worktreePath, false, options)
|
||||
await gitExecFileAsync(
|
||||
['worktree', 'remove', '--force', worktreePath],
|
||||
gitExecOptions(repoPath, options)
|
||||
)
|
||||
}
|
||||
|
||||
if (!branchName) {
|
||||
return {}
|
||||
|
||||
+23
-12
@@ -485,16 +485,32 @@ function mapIssueWorkItem(item: Record<string, unknown>): MainWorkItem {
|
||||
.filter(Boolean)
|
||||
: [],
|
||||
updatedAt: String(item.updated_at ?? item.updatedAt ?? ''),
|
||||
author:
|
||||
typeof item.user === 'object' && item.user !== null && 'login' in item.user
|
||||
? String((item.user as { login?: unknown }).login ?? '')
|
||||
: typeof item.author === 'object' && item.author !== null && 'login' in item.author
|
||||
? String((item.author as { login?: unknown }).login ?? '')
|
||||
: null,
|
||||
...authorFieldsFromUnknown(item),
|
||||
...(item.assignees !== undefined ? { assignees: usersFromUnknown(item.assignees) } : {})
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Derive both the author login and its API avatar_url in one place so GHE
|
||||
* avatars render (the login-only `github.com/{login}.png` URL 404s on GHE).
|
||||
*
|
||||
* REST exposes `user.avatar_url`; gh/GraphQL expose `author.avatarUrl`. `gh pr
|
||||
* view` omits the avatar entirely, so authorAvatarUrl is left undefined and the
|
||||
* UI falls back to the login URL then a placeholder. See #8784.
|
||||
*/
|
||||
function authorFieldsFromUnknown(
|
||||
item: Record<string, unknown>
|
||||
): Pick<MainWorkItem, 'author' | 'authorAvatarUrl'> {
|
||||
const user = userFromUnknown(item.user ?? item.author)
|
||||
if (!user) {
|
||||
return { author: null }
|
||||
}
|
||||
return {
|
||||
author: user.login,
|
||||
...(user.avatarUrl ? { authorAvatarUrl: user.avatarUrl } : {})
|
||||
}
|
||||
}
|
||||
|
||||
function extractHeadOwnerLogin(item: Record<string, unknown>): string | null {
|
||||
// gh CLI `pr list --json headRepositoryOwner` shape: { login }
|
||||
if (typeof item.headRepositoryOwner === 'object' && item.headRepositoryOwner !== null) {
|
||||
@@ -746,12 +762,7 @@ function mapPullRequestWorkItem(
|
||||
.filter(Boolean)
|
||||
: [],
|
||||
updatedAt: String(item.updated_at ?? item.updatedAt ?? ''),
|
||||
author:
|
||||
typeof item.user === 'object' && item.user !== null && 'login' in item.user
|
||||
? String((item.user as { login?: unknown }).login ?? '')
|
||||
: typeof item.author === 'object' && item.author !== null && 'login' in item.author
|
||||
? String((item.author as { login?: unknown }).login ?? '')
|
||||
: null,
|
||||
...authorFieldsFromUnknown(item),
|
||||
branchName:
|
||||
typeof item.head === 'object' && item.head !== null && 'ref' in item.head
|
||||
? String((item.head as { ref?: unknown }).ref ?? '')
|
||||
|
||||
@@ -216,6 +216,56 @@ describe('getWorkItemDetails', () => {
|
||||
expect(details?.participants?.[0]?.login).toBe('issue-author')
|
||||
})
|
||||
|
||||
it('enriches a non-participating assignee avatar from the GraphQL assignees connection', async () => {
|
||||
// Why: a GHE assignee who never commented is absent from `participants`, so
|
||||
// the enrichment must also draw avatars from the `assignees` connection or
|
||||
// item.assignees keeps the blank avatar `gh` returns.
|
||||
getWorkItemMock.mockResolvedValueOnce({
|
||||
id: 'issue:924',
|
||||
type: 'issue',
|
||||
number: 924,
|
||||
title: 'Assignee avatar',
|
||||
state: 'open',
|
||||
url: 'https://github.com/acme/widgets/issues/924',
|
||||
labels: [],
|
||||
updatedAt: '2026-04-01T00:00:00Z',
|
||||
author: 'issue-author',
|
||||
assignees: [{ login: 'ghe-assignee', name: 'GHE Assignee', avatarUrl: '' }]
|
||||
})
|
||||
getIssueOwnerRepoMock.mockResolvedValue({ owner: 'acme', repo: 'widgets' })
|
||||
ghExecFileAsyncMock
|
||||
.mockResolvedValueOnce({
|
||||
stdout: JSON.stringify({
|
||||
data: {
|
||||
repository: {
|
||||
issue: {
|
||||
body: 'Issue body',
|
||||
assignees: {
|
||||
nodes: [
|
||||
{
|
||||
login: 'ghe-assignee',
|
||||
name: 'GHE Assignee',
|
||||
avatarUrl: 'https://ghe.example.com/avatars/ghe-assignee'
|
||||
}
|
||||
]
|
||||
},
|
||||
participants: { nodes: [{ login: 'issue-author', avatarUrl: 'https://x/y' }] },
|
||||
comments: { nodes: [] }
|
||||
}
|
||||
}
|
||||
}
|
||||
})
|
||||
})
|
||||
.mockResolvedValueOnce({ stdout: '' })
|
||||
|
||||
const details = await getWorkItemDetails('/repo-root', 924, 'issue')
|
||||
|
||||
expect(details?.item.assignees?.[0]).toMatchObject({
|
||||
login: 'ghe-assignee',
|
||||
avatarUrl: 'https://ghe.example.com/avatars/ghe-assignee'
|
||||
})
|
||||
})
|
||||
|
||||
it('caps issue timeline pagination by supported activity items', async () => {
|
||||
getWorkItemMock.mockResolvedValueOnce({
|
||||
id: 'issue:923',
|
||||
@@ -568,4 +618,66 @@ describe('getWorkItemDetails', () => {
|
||||
expect(details?.filesUnavailable).toBe(false)
|
||||
expect(details?.files).toEqual([])
|
||||
})
|
||||
|
||||
// Why: `gh pr view` omits avatar_url, so the login-based github.com URL 404s on
|
||||
// GHE. getWorkItemDetails must resolve author/reviewer/assignee avatars via the
|
||||
// GraphQL user(login:) batch and stamp them onto the returned item. See #8784.
|
||||
it('enriches PR author, reviewer, and assignee avatars from the GraphQL user lookup', async () => {
|
||||
getWorkItemMock.mockResolvedValueOnce({
|
||||
id: 'pr:1102',
|
||||
type: 'pr',
|
||||
number: 1102,
|
||||
title: 'Enterprise PR',
|
||||
state: 'open',
|
||||
url: 'https://ghe.example.com/acme/widgets/pull/1102',
|
||||
labels: [],
|
||||
updatedAt: '2026-07-11T00:00:00Z',
|
||||
author: 'seah',
|
||||
reviewRequests: [{ login: 'ludi', name: null, avatarUrl: '' }],
|
||||
latestReviews: [{ login: 'inho', state: 'APPROVED', avatarUrl: '' }],
|
||||
// A default `u/0` placeholder must be replaced by the resolved avatar.
|
||||
assignees: [{ login: 'seah', name: 'Seah', avatarUrl: 'https://avatars.example.com/u/0?v=4' }]
|
||||
})
|
||||
getOwnerRepoMock.mockResolvedValue({ owner: 'acme', repo: 'widgets' })
|
||||
getPRCommentsMock.mockResolvedValue([])
|
||||
getPRChecksMock.mockResolvedValue([])
|
||||
const avatars: Record<string, string> = {
|
||||
seah: 'https://avatars.example.com/u/1?v=4',
|
||||
ludi: 'https://avatars.example.com/u/2?v=4',
|
||||
inho: 'https://avatars.example.com/u/3?v=4'
|
||||
}
|
||||
ghExecFileAsyncMock.mockImplementation(async (args: string[]) => {
|
||||
const target = args.at(-1)
|
||||
if (target === 'repos/acme/widgets/pulls/1102') {
|
||||
return {
|
||||
stdout: JSON.stringify({ body: 'PR body', head: { sha: 'h' }, base: { sha: 'b' } })
|
||||
}
|
||||
}
|
||||
if (target === 'repos/acme/widgets/pulls/1102/files?per_page=100') {
|
||||
return { stdout: '[]' }
|
||||
}
|
||||
const query = args.find((arg) => arg.startsWith('query=')) ?? ''
|
||||
if (query.includes('user(login:')) {
|
||||
// Return the aliased users the batch asked for, keyed by their login.
|
||||
const data: Record<string, { login: string; name: null; avatarUrl: string }> = {}
|
||||
let index = 0
|
||||
for (const login of Object.keys(avatars)) {
|
||||
if (query.includes(`user(login: "${login}")`)) {
|
||||
data[`u${index}`] = { login, name: null, avatarUrl: avatars[login] }
|
||||
index += 1
|
||||
}
|
||||
}
|
||||
return { stdout: JSON.stringify({ data }) }
|
||||
}
|
||||
return { stdout: JSON.stringify({ data: {} }) }
|
||||
})
|
||||
|
||||
const details = await getWorkItemDetails('/repo-root', 1102, 'pr')
|
||||
|
||||
expect(details?.item.authorAvatarUrl).toBe(avatars.seah)
|
||||
expect(details?.item.reviewRequests?.[0]?.avatarUrl).toBe(avatars.ludi)
|
||||
expect(details?.item.latestReviews?.[0]?.avatarUrl).toBe(avatars.inho)
|
||||
// The default u/0 placeholder is overridden by the resolved avatar.
|
||||
expect(details?.item.assignees?.[0]?.avatarUrl).toBe(avatars.seah)
|
||||
})
|
||||
})
|
||||
|
||||
@@ -85,7 +85,7 @@ const ISSUE_DETAILS_QUERY = `query($owner: String!, $repo: String!, $number: Int
|
||||
repository(owner: $owner, name: $repo) {
|
||||
issue(number: $number) {
|
||||
body
|
||||
assignees(first: 50) { nodes { login } }
|
||||
assignees(first: 50) { nodes { login avatarUrl(size: 48) ... on User { name } } }
|
||||
participants(first: 100) {
|
||||
nodes { login avatarUrl(size: 48) ... on User { name } }
|
||||
}
|
||||
@@ -111,7 +111,7 @@ type GraphQLIssueDetailsResponse = {
|
||||
repository?: {
|
||||
issue?: {
|
||||
body?: string | null
|
||||
assignees?: { nodes?: { login?: string }[] }
|
||||
assignees?: { nodes?: { login?: string; avatarUrl?: string; name?: string | null }[] }
|
||||
participants?: { nodes?: GitHubAssignableUser[] }
|
||||
comments?: {
|
||||
nodes?: {
|
||||
@@ -323,6 +323,12 @@ async function getIssueTimelineItems(
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Fetch an issue's body, comments, assignees, participants, and timeline in a
|
||||
* single GraphQL round-trip. Returns null on any partial error so the caller
|
||||
* falls back to the strict REST path. Assignee/participant avatars are resolved
|
||||
* here so GitHub Enterprise users don't render blank.
|
||||
*/
|
||||
async function getIssueDetailsViaGraphQL(
|
||||
repoPath: string,
|
||||
issueNumber: number,
|
||||
@@ -332,6 +338,10 @@ async function getIssueDetailsViaGraphQL(
|
||||
body: string
|
||||
comments: PRComment[]
|
||||
assignees: string[]
|
||||
// Avatar-bearing assignees, kept separate from the `assignees` login list so
|
||||
// callers that only need logins are unaffected; used to enrich assignee
|
||||
// avatars that `gh` leaves blank (notably GitHub Enterprise users).
|
||||
assigneeUsers: GitHubAssignableUser[]
|
||||
participants: GitHubAssignableUser[]
|
||||
timelineItems: GitHubIssueTimelineItem[]
|
||||
} | null> {
|
||||
@@ -386,9 +396,16 @@ async function getIssueDetailsViaGraphQL(
|
||||
url: c.url ?? '',
|
||||
isBot: c.author?.__typename === 'Bot'
|
||||
}))
|
||||
const assignees = (issue.assignees?.nodes ?? [])
|
||||
.map((a) => a.login)
|
||||
.filter((login): login is string => Boolean(login))
|
||||
const assigneeUsers: GitHubAssignableUser[] = (issue.assignees?.nodes ?? [])
|
||||
.filter((a): a is { login: string; avatarUrl?: string; name?: string | null } =>
|
||||
Boolean(a.login)
|
||||
)
|
||||
.map((a) => ({
|
||||
login: a.login,
|
||||
name: a.name ?? null,
|
||||
avatarUrl: a.avatarUrl ?? ''
|
||||
}))
|
||||
const assignees = assigneeUsers.map((a) => a.login)
|
||||
const participants: GitHubAssignableUser[] = (issue.participants?.nodes ?? [])
|
||||
.filter((u) => Boolean(u.login))
|
||||
.map((u) => ({
|
||||
@@ -401,6 +418,7 @@ async function getIssueDetailsViaGraphQL(
|
||||
body: issue.body ?? '',
|
||||
comments,
|
||||
assignees,
|
||||
assigneeUsers,
|
||||
participants,
|
||||
timelineItems
|
||||
}
|
||||
@@ -877,6 +895,11 @@ async function getGitHubUsersByLogin(
|
||||
return []
|
||||
}
|
||||
if (rateLimitGuard('graphql').blocked) {
|
||||
// Why: surface the skip. Callers degrade silently to login-based avatar URLs
|
||||
// (blank on GHE), so without this log "why are avatars missing" is untraceable.
|
||||
console.warn(
|
||||
`getGitHubUsersByLogin skipped: GraphQL rate-limit budget exhausted (${uniqueLogins.length} logins unresolved)`
|
||||
)
|
||||
return []
|
||||
}
|
||||
const fields = uniqueLogins
|
||||
@@ -921,19 +944,100 @@ async function getGitHubUsersByLogin(
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Stamp GraphQL-resolved avatars onto a work item's author, reviewers, review
|
||||
* requests, latest reviews, and assignees.
|
||||
*
|
||||
* The work item's users come from `gh pr view`, which omits avatar_url. On
|
||||
* GitHub Enterprise the login-based `github.com/{login}.png` URL 404s, so those
|
||||
* avatars render blank while comment avatars (fetched via GraphQL) work.
|
||||
* `knownUsers` (participants + the mention-author batch, which already includes
|
||||
* the item's reviewers/assignees) carries the resolved avatars, so we apply
|
||||
* them without any extra round-trip. See #8784.
|
||||
*/
|
||||
function enrichItemDisplayAvatars(
|
||||
item: Omit<GitHubWorkItem, 'repoId'>,
|
||||
knownUsers: GitHubAssignableUser[]
|
||||
): Omit<GitHubWorkItem, 'repoId'> {
|
||||
const avatarByLogin = new Map<string, string>()
|
||||
for (const user of knownUsers) {
|
||||
if (user.login && user.avatarUrl) {
|
||||
avatarByLogin.set(user.login.toLowerCase(), user.avatarUrl)
|
||||
}
|
||||
}
|
||||
if (avatarByLogin.size === 0) {
|
||||
return item
|
||||
}
|
||||
// Why: prefer the GraphQL-resolved avatar over whatever `gh` returned. `gh pr
|
||||
// view` often yields an empty avatar or the default `u/0` placeholder for
|
||||
// enterprise users; the resolved avatar is the authoritative one for that
|
||||
// login. Fall back to the original only when the lookup found nothing.
|
||||
const avatarFor = (login: string): string | undefined => avatarByLogin.get(login.toLowerCase())
|
||||
const resolvedAvatar = (login: string, existing?: string | null): string | undefined =>
|
||||
avatarFor(login) || existing || undefined
|
||||
// Callers coalesce a missing result to the field's "no avatar" sentinel (''
|
||||
// for GitHubAssignableUser, null for GitHubPRReviewSummary); GitHubUserAvatar
|
||||
// treats both as falsy and falls back to the login URL then initials.
|
||||
const authorAvatarUrl = (item.author ? avatarFor(item.author) : undefined) || item.authorAvatarUrl
|
||||
return {
|
||||
...item,
|
||||
...(authorAvatarUrl ? { authorAvatarUrl } : {}),
|
||||
...(item.reviewRequests
|
||||
? {
|
||||
reviewRequests: item.reviewRequests.map((user) => ({
|
||||
...user,
|
||||
avatarUrl: resolvedAvatar(user.login, user.avatarUrl) ?? ''
|
||||
}))
|
||||
}
|
||||
: {}),
|
||||
...(item.latestReviews
|
||||
? {
|
||||
latestReviews: item.latestReviews.map((review) => ({
|
||||
...review,
|
||||
avatarUrl: resolvedAvatar(review.login, review.avatarUrl) ?? null
|
||||
}))
|
||||
}
|
||||
: {}),
|
||||
...(item.assignees
|
||||
? {
|
||||
assignees: item.assignees.map((user) => ({
|
||||
...user,
|
||||
avatarUrl: resolvedAvatar(user.login, user.avatarUrl) ?? ''
|
||||
}))
|
||||
}
|
||||
: {})
|
||||
}
|
||||
}
|
||||
|
||||
async function getMentionParticipants(
|
||||
repoPath: string,
|
||||
item: Pick<GitHubWorkItem, 'author' | 'number' | 'type'>,
|
||||
item: Pick<
|
||||
GitHubWorkItem,
|
||||
'author' | 'number' | 'type' | 'reviewRequests' | 'latestReviews' | 'assignees'
|
||||
>,
|
||||
comments: PRComment[],
|
||||
participants: GitHubAssignableUser[],
|
||||
connectionId?: string | null,
|
||||
localGitOptions: LocalGitExecOptions = {}
|
||||
): Promise<GitHubAssignableUser[]> {
|
||||
const visibleLogins = [item.author ?? '', ...comments.map((comment) => comment.author)]
|
||||
// Why: one aliased GraphQL query returns login/name/avatarUrl for every
|
||||
// mentioned author in a single round-trip. The previous REST fan-out
|
||||
// (/users/<login>) returned the same fields but cost one rate-limit point
|
||||
// per user.
|
||||
// Why: resolve mention authors AND the item's reviewers/assignees in ONE
|
||||
// aliased GraphQL round-trip. Folding the display users in here means the
|
||||
// caller can reuse this result to stamp avatars (see enrichItemDisplayAvatars)
|
||||
// without a second, separately rate-limited lookup — which is what made GHE
|
||||
// reviewer/assignee avatars resolve intermittently. See #8784.
|
||||
// Why: order the always-visible display users (author, reviewers, assignees)
|
||||
// before comment authors so the 40-login cap in getGitHubUsersByLogin never
|
||||
// drops a reviewer/assignee avatar on a PR with many commenters. On a PR with
|
||||
// 40+ distinct participants the trailing comment authors are dropped from this
|
||||
// batch and lose only their @mention-suggestion avatar; rendered comment
|
||||
// avatars are unaffected (they carry their own avatarUrl from the comment).
|
||||
const visibleLogins = [
|
||||
item.author ?? '',
|
||||
...(item.reviewRequests ?? []).map((user) => user.login),
|
||||
...(item.latestReviews ?? []).map((review) => review.login),
|
||||
...(item.assignees ?? []).map((user) => user.login),
|
||||
...comments.map((comment) => comment.author)
|
||||
]
|
||||
const graphQlUsers = await getGitHubUsersByLogin(
|
||||
repoPath,
|
||||
visibleLogins,
|
||||
@@ -1007,7 +1111,13 @@ export async function getWorkItemDetails(
|
||||
)
|
||||
if (collapsed) {
|
||||
return {
|
||||
item,
|
||||
// Include assigneeUsers: a non-participating assignee is absent from
|
||||
// the participants connection, so without them item.assignees keeps a
|
||||
// blank/placeholder avatar (common for GitHub Enterprise users).
|
||||
item: enrichItemDisplayAvatars(item, [
|
||||
...collapsed.participants,
|
||||
...collapsed.assigneeUsers
|
||||
]),
|
||||
body: collapsed.body,
|
||||
comments: collapsed.comments,
|
||||
assignees: collapsed.assignees,
|
||||
@@ -1030,7 +1140,7 @@ export async function getWorkItemDetails(
|
||||
localGitOptions
|
||||
)
|
||||
return {
|
||||
item,
|
||||
item: enrichItemDisplayAvatars(item, mentionParticipants),
|
||||
body,
|
||||
comments,
|
||||
assignees,
|
||||
@@ -1064,7 +1174,7 @@ export async function getWorkItemDetails(
|
||||
])
|
||||
|
||||
return {
|
||||
item,
|
||||
item: enrichItemDisplayAvatars(item, mentionParticipants),
|
||||
body,
|
||||
comments,
|
||||
headSha: shas?.headSha,
|
||||
|
||||
+21
-1
@@ -164,7 +164,7 @@ import {
|
||||
} from './ipc/pty'
|
||||
import { AgentBrowserBridge } from './browser/agent-browser-bridge'
|
||||
import { EmulatorBridge } from './emulator/emulator-bridge'
|
||||
import { browserManager } from './browser/browser-manager'
|
||||
import { browserCertificateTrustController, browserManager } from './browser/browser-manager'
|
||||
import { OffscreenBrowserBackend } from './browser/offscreen-browser-backend'
|
||||
import { initializeBrowserSessionsForApp } from './browser/browser-session-startup'
|
||||
import { setUnreadDockBadgeCount } from './dock/unread-badge'
|
||||
@@ -1729,6 +1729,22 @@ function shouldSuppressCodexAutoApprovalSyntheticTitleFromHook(args: {
|
||||
|
||||
app.whenReady().then(async () => {
|
||||
logStartupMilestone('app-ready')
|
||||
// Why: certificate decisions must be installed before either desktop
|
||||
// webviews or headless browser windows can issue their first TLS request.
|
||||
app.on(
|
||||
'certificate-error',
|
||||
(event, webContents, url, error, certificate, callback, isMainFrame) => {
|
||||
browserCertificateTrustController.handleCertificateError({
|
||||
event,
|
||||
webContents,
|
||||
url,
|
||||
error,
|
||||
certificate,
|
||||
callback,
|
||||
isMainFrame
|
||||
})
|
||||
}
|
||||
)
|
||||
electronApp.setAppUserModelId(devInstanceIdentity.appUserModelId)
|
||||
app.setName(devInstanceIdentity.name)
|
||||
|
||||
@@ -1938,6 +1954,9 @@ app.whenReady().then(async () => {
|
||||
isAgentStatusHooksEnabled(store?.getSettings()) ? agentHookServer.buildPtyEnv() : {}
|
||||
})
|
||||
runtime = runtimeService
|
||||
browserManager.setBrowserGuestStateChangedListener((worktreeId) => {
|
||||
runtimeService.notifyMobileSessionTabsChanged(worktreeId)
|
||||
})
|
||||
automations = new AutomationService(store, {
|
||||
claudeUsage,
|
||||
codexUsage,
|
||||
@@ -2420,6 +2439,7 @@ app.on('will-quit', (e) => {
|
||||
// Why: headless offscreen browser windows are main-process owned; tear them
|
||||
// down explicitly on quit alongside the other browser/session shutdowns.
|
||||
runtime?.getOffscreenBrowserBackend()?.destroyAll?.()
|
||||
browserManager.setBrowserGuestStateChangedListener(null)
|
||||
const emulatorShutdown = runtime?.getEmulatorBridge()?.destroyAllSessions() ?? Promise.resolve()
|
||||
killAllPty()
|
||||
const watcherShutdown = shutdownWatchersOnce()
|
||||
|
||||
@@ -11,6 +11,7 @@ const {
|
||||
openDevToolsMock,
|
||||
setAnnotationViewportBridgeMock,
|
||||
cancelDownloadMock,
|
||||
proceedCertificateMock,
|
||||
browserWindowFromWebContentsMock,
|
||||
webContentsFromIdMock
|
||||
} = vi.hoisted(() => ({
|
||||
@@ -24,6 +25,7 @@ const {
|
||||
openDevToolsMock: vi.fn().mockResolvedValue(true),
|
||||
setAnnotationViewportBridgeMock: vi.fn().mockResolvedValue(true),
|
||||
cancelDownloadMock: vi.fn(),
|
||||
proceedCertificateMock: vi.fn(),
|
||||
browserWindowFromWebContentsMock: vi.fn(),
|
||||
webContentsFromIdMock: vi.fn()
|
||||
}))
|
||||
@@ -42,6 +44,9 @@ vi.mock('electron', () => ({
|
||||
}))
|
||||
|
||||
vi.mock('../browser/browser-manager', () => ({
|
||||
browserCertificateTrustController: {
|
||||
proceed: proceedCertificateMock
|
||||
},
|
||||
browserManager: {
|
||||
registerGuest: registerGuestMock,
|
||||
unregisterGuest: unregisterGuestMock,
|
||||
@@ -68,6 +73,7 @@ describe('registerBrowserHandlers', () => {
|
||||
removeHandlerMock.mockReset()
|
||||
handleMock.mockReset()
|
||||
registerGuestMock.mockReset()
|
||||
registerGuestMock.mockReturnValue(true)
|
||||
unregisterGuestMock.mockReset()
|
||||
getGuestWebContentsIdMock.mockReset()
|
||||
getWebContentsIdByTabIdMock.mockReset()
|
||||
@@ -76,6 +82,8 @@ describe('registerBrowserHandlers', () => {
|
||||
openDevToolsMock.mockReset()
|
||||
setAnnotationViewportBridgeMock.mockReset()
|
||||
cancelDownloadMock.mockReset()
|
||||
proceedCertificateMock.mockReset()
|
||||
proceedCertificateMock.mockReturnValue({ ok: true })
|
||||
browserWindowFromWebContentsMock.mockReset()
|
||||
webContentsFromIdMock.mockReset()
|
||||
webContentsFromIdMock.mockReturnValue({ isDestroyed: () => false })
|
||||
@@ -110,6 +118,41 @@ describe('registerBrowserHandlers', () => {
|
||||
expect(registerGuestMock).not.toHaveBeenCalled()
|
||||
})
|
||||
|
||||
it('does not resolve registration waiters when BrowserManager rejects the guest', async () => {
|
||||
vi.useFakeTimers()
|
||||
try {
|
||||
registerGuestMock.mockReturnValue(false)
|
||||
const settled = Promise.allSettled([waitForTabRegistration('page-1', 1000)])
|
||||
registerBrowserHandlers()
|
||||
const registerHandler = handleMock.mock.calls.find(
|
||||
([channel]) => channel === 'browser:registerGuest'
|
||||
)?.[1] as (event: { sender: Electron.WebContents }, args: object) => boolean
|
||||
|
||||
const result = registerHandler(
|
||||
{
|
||||
sender: {
|
||||
id: 91,
|
||||
isDestroyed: () => false,
|
||||
getType: () => 'window',
|
||||
getURL: () => 'file:///renderer/index.html'
|
||||
} as Electron.WebContents
|
||||
},
|
||||
{
|
||||
browserPageId: 'page-1',
|
||||
workspaceId: 'workspace-1',
|
||||
worktreeId: 'worktree-1',
|
||||
webContentsId: 123
|
||||
}
|
||||
)
|
||||
|
||||
expect(result).toBe(false)
|
||||
await vi.advanceTimersByTimeAsync(1001)
|
||||
expect(await settled).toEqual([{ status: 'rejected', reason: expect.any(Error) }])
|
||||
} finally {
|
||||
vi.useRealTimers()
|
||||
}
|
||||
})
|
||||
|
||||
it('authorizes browser download cancellation through the owning renderer', () => {
|
||||
cancelDownloadMock.mockReturnValue(true)
|
||||
registerBrowserHandlers()
|
||||
@@ -157,6 +200,60 @@ describe('registerBrowserHandlers', () => {
|
||||
expect(cancelDownloadMock).not.toHaveBeenCalled()
|
||||
})
|
||||
|
||||
it('allows only the trusted renderer to approve an exact certificate challenge', () => {
|
||||
registerBrowserHandlers()
|
||||
const proceedHandler = handleMock.mock.calls.find(
|
||||
([channel]) => channel === 'browser:proceedCertificate'
|
||||
)?.[1] as (event: { sender: Electron.WebContents }, args: unknown) => unknown
|
||||
const trustedSender = {
|
||||
id: 91,
|
||||
isDestroyed: () => false,
|
||||
getType: () => 'window',
|
||||
getURL: () => 'file:///renderer/index.html'
|
||||
} as Electron.WebContents
|
||||
|
||||
expect(
|
||||
proceedHandler(
|
||||
{ sender: trustedSender },
|
||||
{ browserPageId: 'page-1', challengeId: 'challenge-1' }
|
||||
)
|
||||
).toEqual({ ok: true })
|
||||
expect(proceedCertificateMock).toHaveBeenCalledWith('page-1', 'challenge-1')
|
||||
|
||||
proceedCertificateMock.mockClear()
|
||||
const untrustedSender = {
|
||||
id: 92,
|
||||
isDestroyed: () => false,
|
||||
getType: () => 'webview',
|
||||
getURL: () => 'https://localhost:3443/'
|
||||
} as Electron.WebContents
|
||||
expect(
|
||||
proceedHandler(
|
||||
{ sender: untrustedSender },
|
||||
{ browserPageId: 'page-1', challengeId: 'challenge-1' }
|
||||
)
|
||||
).toEqual({ ok: false, reason: 'missing' })
|
||||
expect(proceedCertificateMock).not.toHaveBeenCalled()
|
||||
})
|
||||
|
||||
it('rejects malformed certificate approval IPC arguments', () => {
|
||||
registerBrowserHandlers()
|
||||
const proceedHandler = handleMock.mock.calls.find(
|
||||
([channel]) => channel === 'browser:proceedCertificate'
|
||||
)?.[1] as (event: { sender: Electron.WebContents }, args: unknown) => unknown
|
||||
const sender = {
|
||||
id: 91,
|
||||
isDestroyed: () => false,
|
||||
getType: () => 'window',
|
||||
getURL: () => 'file:///renderer/index.html'
|
||||
} as Electron.WebContents
|
||||
|
||||
for (const args of [null, {}, { browserPageId: 1, challengeId: 'challenge-1' }]) {
|
||||
expect(proceedHandler({ sender }, args)).toEqual({ ok: false, reason: 'missing' })
|
||||
}
|
||||
expect(proceedCertificateMock).not.toHaveBeenCalled()
|
||||
})
|
||||
|
||||
it('updates the bridge active tab for the owning worktree', async () => {
|
||||
const onTabChangedMock = vi.fn()
|
||||
getGuestWebContentsIdMock.mockReturnValue(4242)
|
||||
|
||||
+24
-2
@@ -1,7 +1,7 @@
|
||||
/* eslint-disable max-lines -- Why: browser IPC handlers must be registered together so the
|
||||
trust boundary (isTrustedBrowserRenderer) and handler teardown stay consistent. */
|
||||
import { BrowserWindow, ipcMain, webContents } from 'electron'
|
||||
import { browserManager } from '../browser/browser-manager'
|
||||
import { browserCertificateTrustController, browserManager } from '../browser/browser-manager'
|
||||
import type { AgentBrowserBridge } from '../browser/agent-browser-bridge'
|
||||
import { browserSessionRegistry } from '../browser/browser-session-registry'
|
||||
import {
|
||||
@@ -24,6 +24,7 @@ import type {
|
||||
} from '../../shared/browser-grab-types'
|
||||
import type {
|
||||
BrowserCookieImportResult,
|
||||
BrowserCertificateProceedResult,
|
||||
BrowserSessionProfile,
|
||||
BrowserSessionProfileScope,
|
||||
BrowserViewportOverride
|
||||
@@ -180,6 +181,7 @@ export function registerBrowserHandlers(): void {
|
||||
ipcMain.removeHandler('browser:captureSelectionScreenshot')
|
||||
ipcMain.removeHandler('browser:extractHoverPayload')
|
||||
ipcMain.removeHandler('browser:activeTabChanged')
|
||||
ipcMain.removeHandler('browser:proceedCertificate')
|
||||
|
||||
ipcMain.handle(
|
||||
'browser:registerGuest',
|
||||
@@ -201,10 +203,13 @@ export function registerBrowserHandlers(): void {
|
||||
// with a new webContentsId. The bridge must destroy the old session's
|
||||
// proxy (its webContents is gone) and let the next command recreate it.
|
||||
const previousWcId = browserManager.getGuestWebContentsId(args.browserPageId)
|
||||
browserManager.registerGuest({
|
||||
const registered = browserManager.registerGuest({
|
||||
...args,
|
||||
rendererWebContentsId: event.sender.id
|
||||
})
|
||||
if (!registered) {
|
||||
return false
|
||||
}
|
||||
if (agentBrowserBridgeRef && previousWcId !== null && previousWcId !== args.webContentsId) {
|
||||
agentBrowserBridgeRef.onProcessSwap(args.browserPageId, args.webContentsId, previousWcId)
|
||||
}
|
||||
@@ -235,6 +240,23 @@ export function registerBrowserHandlers(): void {
|
||||
return true
|
||||
})
|
||||
|
||||
ipcMain.handle(
|
||||
'browser:proceedCertificate',
|
||||
(
|
||||
event,
|
||||
args: { browserPageId?: unknown; challengeId?: unknown }
|
||||
): BrowserCertificateProceedResult => {
|
||||
if (
|
||||
!isTrustedBrowserRenderer(event.sender) ||
|
||||
typeof args?.browserPageId !== 'string' ||
|
||||
typeof args.challengeId !== 'string'
|
||||
) {
|
||||
return { ok: false, reason: 'missing' }
|
||||
}
|
||||
return browserCertificateTrustController.proceed(args.browserPageId, args.challengeId)
|
||||
}
|
||||
)
|
||||
|
||||
// Why: keeps the bridge's active tab in sync with the renderer's UI state.
|
||||
// Without this, a user switching tabs in the UI would leave the agent operating
|
||||
// on the previous tab, which is confusing.
|
||||
|
||||
@@ -6497,7 +6497,7 @@ describe('registerPtyHandlers', () => {
|
||||
|
||||
expect(spawnMock).toHaveBeenCalledWith(
|
||||
'C:\\Program Files\\Git\\bin\\bash.exe',
|
||||
['--login', '-i'],
|
||||
['-c', 'chcp.com 65001 >/dev/null 2>&1; exec "$BASH" --login -i'],
|
||||
expect.objectContaining({
|
||||
env: expect.objectContaining({ CHERE_INVOKING: '1' })
|
||||
})
|
||||
|
||||
@@ -0,0 +1,189 @@
|
||||
import { afterEach, describe, expect, it, vi } from 'vitest'
|
||||
import { mkdtemp, mkdir, realpath, rm } from 'node:fs/promises'
|
||||
import { tmpdir } from 'node:os'
|
||||
import { join } from 'node:path'
|
||||
import { subscribeViaWatcherProcess } from './parcel-watcher-process'
|
||||
import type {
|
||||
WatcherProcessCallback,
|
||||
WatcherProcessHooks
|
||||
} from './parcel-watcher-process-subscription'
|
||||
import type { WorktreeBaseWatchTarget } from './worktree-base-directory-event-filter'
|
||||
import type { WorktreeBasePollEvent } from './worktree-base-directory-poller'
|
||||
import { startGitCommonWatch } from './worktree-git-common-watch'
|
||||
|
||||
vi.mock('./parcel-watcher-process', () => ({
|
||||
subscribeViaWatcherProcess: vi.fn()
|
||||
}))
|
||||
|
||||
const POLL_MS = 25
|
||||
|
||||
type ChildSubscription = {
|
||||
dir: string
|
||||
callback: WatcherProcessCallback
|
||||
hooks: WatcherProcessHooks
|
||||
unsubscribe: ReturnType<typeof vi.fn>
|
||||
}
|
||||
|
||||
describe('worktree git-common narrow watch (darwin)', () => {
|
||||
const cleanups: (() => Promise<void>)[] = []
|
||||
const subscribeMock = vi.mocked(subscribeViaWatcherProcess)
|
||||
let childSubscriptions: ChildSubscription[] = []
|
||||
|
||||
afterEach(async () => {
|
||||
await Promise.all(cleanups.splice(0).map((cleanup) => cleanup()))
|
||||
childSubscriptions = []
|
||||
subscribeMock.mockReset()
|
||||
})
|
||||
|
||||
function installSubscribeMock(): void {
|
||||
subscribeMock.mockImplementation(async (dir, callback, _opts, hooks = {}) => {
|
||||
const unsubscribe = vi.fn(async () => {})
|
||||
childSubscriptions.push({ dir, callback, hooks, unsubscribe })
|
||||
return { unsubscribe }
|
||||
})
|
||||
}
|
||||
|
||||
async function makeCommonDir(withWorktrees: boolean): Promise<string> {
|
||||
const root = await mkdtemp(join(tmpdir(), 'orca-git-common-watch-'))
|
||||
cleanups.push(() => rm(root, { recursive: true, force: true }))
|
||||
const commonDir = await realpath(root)
|
||||
if (withWorktrees) {
|
||||
await mkdir(join(commonDir, 'worktrees'))
|
||||
}
|
||||
return commonDir
|
||||
}
|
||||
|
||||
function makeTarget(path: string): WorktreeBaseWatchTarget {
|
||||
return {
|
||||
key: `git-common:local:${path}`,
|
||||
kind: 'git-common',
|
||||
path,
|
||||
repos: new Map([['repo-1', { repoId: 'repo-1', repoName: 'project', nestWorkspaces: false }]])
|
||||
}
|
||||
}
|
||||
|
||||
async function startWatch(commonDir: string, received: WorktreeBasePollEvent[][]): Promise<void> {
|
||||
const watch = await startGitCommonWatch(
|
||||
makeTarget(commonDir),
|
||||
(events) => received.push(events),
|
||||
POLL_MS,
|
||||
'darwin'
|
||||
)
|
||||
cleanups.push(() => watch.unsubscribe())
|
||||
}
|
||||
|
||||
it('hosts the narrow stream in the watcher child, not in-process', async () => {
|
||||
installSubscribeMock()
|
||||
const commonDir = await makeCommonDir(true)
|
||||
const received: WorktreeBasePollEvent[][] = []
|
||||
await startWatch(commonDir, received)
|
||||
|
||||
expect(subscribeMock).toHaveBeenCalledTimes(1)
|
||||
const [dir, , opts] = subscribeMock.mock.calls[0]
|
||||
expect(dir).toBe(join(commonDir, 'worktrees'))
|
||||
expect(opts).toEqual({})
|
||||
|
||||
const entryPath = join(commonDir, 'worktrees', 'wt-a')
|
||||
childSubscriptions[0].callback(null, [{ type: 'create', path: entryPath }])
|
||||
expect(received.flat()).toContainEqual({ type: 'create', path: entryPath })
|
||||
})
|
||||
|
||||
it('tears down and re-arms when the watched root is deleted', async () => {
|
||||
installSubscribeMock()
|
||||
const commonDir = await makeCommonDir(true)
|
||||
const worktreesDir = join(commonDir, 'worktrees')
|
||||
const received: WorktreeBasePollEvent[][] = []
|
||||
await startWatch(commonDir, received)
|
||||
|
||||
await rm(worktreesDir, { recursive: true, force: true })
|
||||
childSubscriptions[0].callback(null, [{ type: 'delete', path: worktreesDir }])
|
||||
await vi.waitFor(() => {
|
||||
expect(childSubscriptions[0].unsubscribe).toHaveBeenCalledTimes(1)
|
||||
})
|
||||
expect(received.flat()).toContainEqual({ type: 'delete', path: worktreesDir })
|
||||
|
||||
// The existence poll re-subscribes once a new first worktree recreates it.
|
||||
await mkdir(worktreesDir)
|
||||
await vi.waitFor(() => {
|
||||
expect(subscribeMock).toHaveBeenCalledTimes(2)
|
||||
})
|
||||
expect(received.flat()).toContainEqual({ type: 'create', path: worktreesDir })
|
||||
})
|
||||
|
||||
it('tears down and re-arms on watcher errors', async () => {
|
||||
installSubscribeMock()
|
||||
const commonDir = await makeCommonDir(true)
|
||||
const worktreesDir = join(commonDir, 'worktrees')
|
||||
const received: WorktreeBasePollEvent[][] = []
|
||||
await startWatch(commonDir, received)
|
||||
|
||||
childSubscriptions[0].callback(new Error('watcher child reported failure'), [])
|
||||
await vi.waitFor(() => {
|
||||
expect(childSubscriptions[0].unsubscribe).toHaveBeenCalledTimes(1)
|
||||
})
|
||||
// The error is surfaced as a structural change so worktrees re-sync.
|
||||
expect(received.flat()).toContainEqual({ type: 'update', path: worktreesDir })
|
||||
|
||||
// The dir still exists, so the existence poll re-subscribes.
|
||||
await vi.waitFor(() => {
|
||||
expect(subscribeMock).toHaveBeenCalledTimes(2)
|
||||
})
|
||||
|
||||
const receivedAfterRearm = received.length
|
||||
childSubscriptions[0].callback(new Error('late error from replaced watcher'), [])
|
||||
childSubscriptions[0].callback(null, [
|
||||
{ type: 'create', path: join(worktreesDir, 'late-old-event') }
|
||||
])
|
||||
childSubscriptions[0].hooks.onInterruption?.()
|
||||
|
||||
// A replaced watch cannot tear down its successor or report stale events.
|
||||
expect(received).toHaveLength(receivedAfterRearm)
|
||||
expect(childSubscriptions[1].unsubscribe).not.toHaveBeenCalled()
|
||||
})
|
||||
|
||||
it('reports a structural change after a watcher-child interruption', async () => {
|
||||
installSubscribeMock()
|
||||
const commonDir = await makeCommonDir(true)
|
||||
const worktreesDir = join(commonDir, 'worktrees')
|
||||
const received: WorktreeBasePollEvent[][] = []
|
||||
await startWatch(commonDir, received)
|
||||
|
||||
childSubscriptions[0].hooks.onInterruption?.()
|
||||
expect(received.flat()).toContainEqual({ type: 'update', path: worktreesDir })
|
||||
// The supervisor resubscribed the same record; no teardown should happen.
|
||||
expect(childSubscriptions[0].unsubscribe).not.toHaveBeenCalled()
|
||||
})
|
||||
|
||||
it('arms via existence polling when the worktrees dir appears later', async () => {
|
||||
installSubscribeMock()
|
||||
const commonDir = await makeCommonDir(false)
|
||||
const received: WorktreeBasePollEvent[][] = []
|
||||
await startWatch(commonDir, received)
|
||||
expect(subscribeMock).not.toHaveBeenCalled()
|
||||
|
||||
await mkdir(join(commonDir, 'worktrees'))
|
||||
await vi.waitFor(() => {
|
||||
expect(subscribeMock).toHaveBeenCalledTimes(1)
|
||||
})
|
||||
})
|
||||
|
||||
it('stops forwarding events and unsubscribes the child on dispose', async () => {
|
||||
installSubscribeMock()
|
||||
const commonDir = await makeCommonDir(true)
|
||||
const received: WorktreeBasePollEvent[][] = []
|
||||
const watch = await startGitCommonWatch(
|
||||
makeTarget(commonDir),
|
||||
(events) => received.push(events),
|
||||
POLL_MS,
|
||||
'darwin'
|
||||
)
|
||||
await watch.unsubscribe()
|
||||
expect(childSubscriptions[0].unsubscribe).toHaveBeenCalledTimes(1)
|
||||
|
||||
received.length = 0
|
||||
childSubscriptions[0].callback(null, [
|
||||
{ type: 'create', path: join(commonDir, 'worktrees', 'late') }
|
||||
])
|
||||
expect(received).toHaveLength(0)
|
||||
})
|
||||
})
|
||||
@@ -1,5 +1,6 @@
|
||||
import { stat } from 'node:fs/promises'
|
||||
import { join } from 'node:path'
|
||||
import { subscribeViaWatcherProcess } from './parcel-watcher-process'
|
||||
import type { WorktreeBaseWatchTarget } from './worktree-base-directory-event-filter'
|
||||
import type {
|
||||
WorktreeBasePollEvent,
|
||||
@@ -20,6 +21,10 @@ import {
|
||||
// included). Other platforms: dir-listing poll (no fseventsd to protect, and
|
||||
// on Windows an open directory handle on `worktrees/` could interfere with
|
||||
// `git worktree prune` removing it).
|
||||
// The native stream is hosted in the crash-isolated watcher child, never the
|
||||
// Electron main process: watcher.node teardown races heap-corrupt the hosting
|
||||
// process when unsubscribe overlaps in-flight callbacks (issue #8732), and
|
||||
// root deletion via `git worktree prune` makes that overlap routine here.
|
||||
|
||||
// Why: branch switches and commits made in the primary checkout rewrite these
|
||||
// top-level files (linked-worktree equivalents live under `worktrees/`).
|
||||
@@ -157,12 +162,14 @@ async function startGitCommonNarrowWatch(
|
||||
return false
|
||||
}
|
||||
let errored = false
|
||||
let active = true
|
||||
// Why: parcel tears its native stream down when the watched root is
|
||||
// deleted (e.g. `git worktree prune` removing an empty worktrees dir) —
|
||||
// sometimes surfaced as an error, sometimes as a delete event for the
|
||||
// root. Either way: notify, drop the dead stream, and let the existence
|
||||
// poll re-arm when a future worktree add recreates the dir.
|
||||
const teardownAndRearm = (): void => {
|
||||
active = false
|
||||
errored = true
|
||||
const current = subscription
|
||||
subscription = null
|
||||
@@ -172,26 +179,38 @@ async function startGitCommonNarrowWatch(
|
||||
armExistencePoll()
|
||||
}
|
||||
try {
|
||||
const watcher = await import('@parcel/watcher')
|
||||
const sub = await watcher.subscribe(worktreesDir, (error, events) => {
|
||||
if (disposed) {
|
||||
return
|
||||
}
|
||||
if (error) {
|
||||
onEvents([{ type: 'update', path: worktreesDir }])
|
||||
teardownAndRearm()
|
||||
return
|
||||
}
|
||||
if (events.length > 0) {
|
||||
const rootGone = events.some(
|
||||
(event) => event.type === 'delete' && event.path === worktreesDir
|
||||
)
|
||||
onEvents(events.map((event) => ({ type: event.type, path: event.path })))
|
||||
if (rootGone) {
|
||||
const sub = await subscribeViaWatcherProcess(
|
||||
worktreesDir,
|
||||
(error, events) => {
|
||||
if (disposed || !active) {
|
||||
return
|
||||
}
|
||||
if (error) {
|
||||
onEvents([{ type: 'update', path: worktreesDir }])
|
||||
teardownAndRearm()
|
||||
return
|
||||
}
|
||||
if (events.length > 0) {
|
||||
const rootGone = events.some(
|
||||
(event) => event.type === 'delete' && event.path === worktreesDir
|
||||
)
|
||||
onEvents(events.map((event) => ({ type: event.type, path: event.path })))
|
||||
if (rootGone) {
|
||||
teardownAndRearm()
|
||||
}
|
||||
}
|
||||
},
|
||||
{},
|
||||
{
|
||||
// Why: a watcher-child crash drops events during the automatic
|
||||
// resubscribe gap; report a structural change so worktrees re-sync.
|
||||
onInterruption: () => {
|
||||
if (!disposed && active) {
|
||||
onEvents([{ type: 'update', path: worktreesDir }])
|
||||
}
|
||||
}
|
||||
}
|
||||
})
|
||||
)
|
||||
if (disposed || errored) {
|
||||
void sub.unsubscribe().catch(() => {})
|
||||
return !errored
|
||||
|
||||
@@ -2508,7 +2508,7 @@ describe('Store', () => {
|
||||
})
|
||||
expect(persisted.settings.sourceControlAi.actions.branchName).toEqual({
|
||||
agentId: 'claude',
|
||||
commandInputTemplate: '{basePrompt}\n\nRollback commit prompt'
|
||||
commandInputTemplate: 'Rollback commit prompt\n\n{basePrompt}'
|
||||
})
|
||||
})
|
||||
|
||||
|
||||
@@ -936,7 +936,7 @@ describe('LocalPtyProvider', () => {
|
||||
|
||||
expect(spawnMock).toHaveBeenCalledWith(
|
||||
'C:\\Program Files\\Git\\bin\\bash.exe',
|
||||
['--login', '-i'],
|
||||
['-c', 'chcp.com 65001 >/dev/null 2>&1; exec "$BASH" --login -i'],
|
||||
expect.objectContaining({
|
||||
cwd: 'C:\\Users\\jin\\repo',
|
||||
env: expect.objectContaining({
|
||||
|
||||
@@ -196,14 +196,27 @@ describe('resolveWindowsShellLaunchArgs', () => {
|
||||
])
|
||||
})
|
||||
|
||||
it('starts Git Bash as an interactive login shell without changing cwd', () => {
|
||||
it('starts Git Bash as an interactive login shell with UTF-8 console setup', () => {
|
||||
const result = resolveWindowsShellLaunchArgs(
|
||||
'C:\\Program Files\\Git\\bin\\bash.exe',
|
||||
'C:\\Users\\alice\\code',
|
||||
'C:\\Users\\alice'
|
||||
)
|
||||
|
||||
expect(result.shellArgs).toEqual(['--login', '-i'])
|
||||
// Why: Git Bash inherits the ConPTY OEM code page (CP437), so a byte-writing
|
||||
// UTF-8 TUI mojibakes unless the console is switched to UTF-8 before it runs.
|
||||
// Assert the contract behaviorally: chcp.com 65001 must precede the exec'd
|
||||
// interactive login shell (which preserves `--login -i` and the shell's
|
||||
// foreground identity), rather than pinning the exact command string.
|
||||
expect(result.shellArgs[0]).toBe('-c')
|
||||
const bashCommand = result.shellArgs[1]
|
||||
expect(bashCommand).toContain('chcp.com 65001')
|
||||
expect(bashCommand).toMatch(/exec "\$BASH" --login -i$/)
|
||||
// The UTF-8 switch must run before the login shell is exec'd.
|
||||
expect(bashCommand.indexOf('chcp.com')).toBeLessThan(bashCommand.indexOf('exec'))
|
||||
// Must stay fail-open: `;` (not `&&`) so a missing chcp.com can't abort the
|
||||
// exec and kill the terminal on startup.
|
||||
expect(bashCommand).not.toContain('&&')
|
||||
expect(result.effectiveCwd).toBe('C:\\Users\\alice\\code')
|
||||
expect(result.validationCwd).toBe('C:\\Users\\alice\\code')
|
||||
})
|
||||
|
||||
@@ -16,6 +16,13 @@ const CMD_EXE_COMMAND_LINE_MAX_CHARS = 8191
|
||||
const STARTUP_COMMAND_TEXT_MAX_CHARS = 6000
|
||||
const POWERSHELL_ENCODED_COMMAND_ARG_MAX_CHARS = 28_000
|
||||
const CMD_UTF8_SETUP_COMMAND = 'chcp 65001 > nul'
|
||||
// Why: Git for Windows' bash inherits the ConPTY console's OEM code page
|
||||
// (CP437), so a TUI that writes UTF-8 bytes straight to the console — agents
|
||||
// like Claude Code use WriteFile, not WriteConsoleW — renders as mojibake
|
||||
// (`❯` -> `Γ¥»`). Switch the console to UTF-8, then exec the normal interactive
|
||||
// login shell; cmd.exe and PowerShell already do the equivalent. The `;` (not
|
||||
// `&&`) keeps startup working even if chcp.com is missing.
|
||||
const GIT_BASH_UTF8_LOGIN_COMMAND = 'chcp.com 65001 >/dev/null 2>&1; exec "$BASH" --login -i'
|
||||
|
||||
/** Result of resolving a Windows shell to its launch args + effective cwd.
|
||||
*
|
||||
@@ -176,7 +183,7 @@ export function resolveWindowsShellLaunchArgs(
|
||||
|
||||
if (isWindowsGitBashShellPath(shellPath)) {
|
||||
return {
|
||||
shellArgs: ['--login', '-i'],
|
||||
shellArgs: ['-c', GIT_BASH_UTF8_LOGIN_COMMAND],
|
||||
effectiveCwd: nativeCwd,
|
||||
validationCwd: nativeCwd
|
||||
}
|
||||
|
||||
@@ -49,9 +49,10 @@ import type {
|
||||
BrowserViewportResult,
|
||||
BrowserWaitResult
|
||||
} from '../../shared/runtime-types'
|
||||
import type { BrowserCertificateProceedResult } from '../../shared/types'
|
||||
import type { AgentBrowserBridge } from '../browser/agent-browser-bridge'
|
||||
import type { BrowserBackend } from '../browser/browser-backend'
|
||||
import { browserManager } from '../browser/browser-manager'
|
||||
import { browserCertificateTrustController, browserManager } from '../browser/browser-manager'
|
||||
import { BrowserError } from '../browser/cdp-bridge'
|
||||
import {
|
||||
startBrowserScreencast,
|
||||
@@ -633,6 +634,16 @@ export class RuntimeBrowserCommands {
|
||||
}
|
||||
}
|
||||
|
||||
async browserProceedCertificate(
|
||||
params: { challengeId: string } & BrowserCommandTargetParams
|
||||
): Promise<BrowserCertificateProceedResult> {
|
||||
const target = await this.resolveBrowserCommandTarget(params)
|
||||
if (!target.browserPageId) {
|
||||
return { ok: false, reason: 'missing' }
|
||||
}
|
||||
return browserCertificateTrustController.proceed(target.browserPageId, params.challengeId)
|
||||
}
|
||||
|
||||
async browserTabShow(params: { page: string; worktree?: string }): Promise<BrowserTabShowResult> {
|
||||
const target = await this.resolveBrowserCommandTarget(params)
|
||||
return { tab: this.describeBrowserTab(params.page, target.worktreeId) }
|
||||
|
||||
@@ -1538,6 +1538,123 @@ describe('OrcaRuntimeService', () => {
|
||||
expect(capabilities).toContain('browser.screencast.v1')
|
||||
// ...and the headless marker tells clients not to fall back to a local tab.
|
||||
expect(capabilities).toContain('browser.headless.v1')
|
||||
expect(capabilities).toContain('browser.certificate-trust.v1')
|
||||
})
|
||||
|
||||
it('surfaces live offscreen load failures in headless browser snapshots', () => {
|
||||
const runtime = createRuntime()
|
||||
runtime.setOffscreenBrowserBackend({ createTab: vi.fn(), closeTab: vi.fn() })
|
||||
runtime.setAgentBrowserBridge({
|
||||
tabList: vi.fn(() => ({
|
||||
tabs: [
|
||||
{
|
||||
browserPageId: 'page-certificate-error',
|
||||
index: 0,
|
||||
url: 'https://localhost:3443/',
|
||||
title: 'Local HTTPS',
|
||||
active: true,
|
||||
loadError: {
|
||||
code: -202,
|
||||
description: 'ERR_CERT_AUTHORITY_INVALID',
|
||||
validatedUrl: 'https://localhost:3443/'
|
||||
},
|
||||
certificateFailure: {
|
||||
challengeId: 'challenge-1',
|
||||
browserPageId: 'page-certificate-error',
|
||||
errorCode: -202,
|
||||
error: 'ERR_CERT_AUTHORITY_INVALID',
|
||||
origin: 'https://localhost:3443',
|
||||
displayHost: 'localhost:3443',
|
||||
canProceed: true,
|
||||
observedAt: 123
|
||||
}
|
||||
}
|
||||
]
|
||||
}))
|
||||
} as never)
|
||||
const browserTabs = runtime['buildHeadlessMobileSessionBrowserTabs'](TEST_WORKTREE_ID)
|
||||
expect(browserTabs).toContainEqual(
|
||||
expect.objectContaining({
|
||||
type: 'browser',
|
||||
browserPageId: 'page-certificate-error',
|
||||
loadError: {
|
||||
code: -202,
|
||||
description: 'ERR_CERT_AUTHORITY_INVALID',
|
||||
validatedUrl: 'https://localhost:3443/'
|
||||
},
|
||||
certificateFailure: {
|
||||
challengeId: 'challenge-1',
|
||||
browserPageId: 'page-certificate-error',
|
||||
errorCode: -202,
|
||||
error: 'ERR_CERT_AUTHORITY_INVALID',
|
||||
origin: 'https://localhost:3443',
|
||||
displayHost: 'localhost:3443',
|
||||
canProceed: true,
|
||||
observedAt: 123
|
||||
}
|
||||
})
|
||||
)
|
||||
})
|
||||
|
||||
it('detects headless browser-tab changes by field, treating absent and null loadError alike', () => {
|
||||
const runtime = createRuntime()
|
||||
const base = {
|
||||
type: 'browser' as const,
|
||||
id: 'page-1',
|
||||
title: 'Local',
|
||||
browserWorkspaceId: 'page-1',
|
||||
browserPageId: 'page-1',
|
||||
url: 'https://localhost:3443/',
|
||||
loading: false,
|
||||
canGoBack: false,
|
||||
canGoForward: false,
|
||||
isActive: true
|
||||
}
|
||||
const err = {
|
||||
code: -202,
|
||||
description: 'ERR_CERT_AUTHORITY_INVALID',
|
||||
validatedUrl: 'https://localhost:3443/'
|
||||
}
|
||||
const certificateFailure = {
|
||||
challengeId: 'challenge-1',
|
||||
browserPageId: 'page-1',
|
||||
errorCode: -202,
|
||||
error: 'ERR_CERT_AUTHORITY_INVALID',
|
||||
origin: 'https://localhost:3443',
|
||||
displayHost: 'localhost:3443',
|
||||
canProceed: true,
|
||||
observedAt: 123
|
||||
}
|
||||
const unchanged = (a: unknown[], b: unknown[]): boolean =>
|
||||
runtime['headlessBrowserTabsUnchanged'](a as never, b as never)
|
||||
|
||||
// Absent vs explicit null loadError are equivalent (the JSON.stringify trap).
|
||||
expect(unchanged([{ ...base }], [{ ...base, loadError: null }])).toBe(true)
|
||||
expect(unchanged([{ ...base, loadError: err }], [{ ...base, loadError: { ...err } }])).toBe(
|
||||
true
|
||||
)
|
||||
// A load-error-only change (identical ids/order) must not be missed.
|
||||
expect(unchanged([{ ...base }], [{ ...base, loadError: err }])).toBe(false)
|
||||
expect(
|
||||
unchanged([{ ...base, loadError: err }], [{ ...base, loadError: { ...err, code: -200 } }])
|
||||
).toBe(false)
|
||||
expect(
|
||||
unchanged(
|
||||
[{ ...base, certificateFailure }],
|
||||
[{ ...base, certificateFailure: { ...certificateFailure } }]
|
||||
)
|
||||
).toBe(true)
|
||||
expect(unchanged([{ ...base }], [{ ...base, certificateFailure }])).toBe(false)
|
||||
expect(
|
||||
unchanged(
|
||||
[{ ...base, certificateFailure }],
|
||||
[{ ...base, certificateFailure: { ...certificateFailure, challengeId: 'challenge-2' } }]
|
||||
)
|
||||
).toBe(false)
|
||||
// Scalar and length changes are detected.
|
||||
expect(unchanged([{ ...base }], [{ ...base, title: 'Changed' }])).toBe(false)
|
||||
expect(unchanged([{ ...base }], [{ ...base, isActive: false }])).toBe(false)
|
||||
expect(unchanged([{ ...base }], [{ ...base }, { ...base, id: 'page-2' }])).toBe(false)
|
||||
})
|
||||
|
||||
it('does not advertise headless browser capability when a renderer window exists', () => {
|
||||
@@ -1547,6 +1664,16 @@ describe('OrcaRuntimeService', () => {
|
||||
runtime.setOffscreenBrowserBackend({ createTab: vi.fn(), closeTab: vi.fn() })
|
||||
|
||||
expect(runtime.getStatus().capabilities).not.toContain('browser.headless.v1')
|
||||
// Desktop webviews still host certificate trust, so the proceed capability
|
||||
// remains advertised for remote clients controlling those pages.
|
||||
expect(runtime.getStatus().capabilities).toContain('browser.certificate-trust.v1')
|
||||
})
|
||||
|
||||
it('does not advertise certificate trust when no browser backend is available', () => {
|
||||
const runtime = createRuntime()
|
||||
|
||||
expect(runtime.getStatus().capabilities).not.toContain('browser.certificate-trust.v1')
|
||||
expect(runtime.getStatus().capabilities).not.toContain('browser.screencast.v1')
|
||||
})
|
||||
|
||||
it('closes a worktree’s offscreen browser pages when its metadata is removed (leak fix)', () => {
|
||||
@@ -19722,6 +19849,134 @@ describe('OrcaRuntimeService', () => {
|
||||
expect(getSession().terminalLayoutsByTabId['host-tab']).toBeUndefined()
|
||||
})
|
||||
|
||||
it('durably tears down a runtime-owned SSH headless tab when renderer cleanup fails', async () => {
|
||||
// #8958 regression: the acknowledged renderer relay cannot see headless tabs;
|
||||
// its advisory fallback must not prevent authoritative teardown or flushing.
|
||||
const persistedPtyId = 'ssh:ssh-1@@relay-pty'
|
||||
const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(
|
||||
makeWorkspaceSessionWithHeadlessTerminal({
|
||||
tabsByWorktree: {
|
||||
[TEST_WORKTREE_ID]: [
|
||||
{
|
||||
id: 'host-tab',
|
||||
ptyId: persistedPtyId,
|
||||
worktreeId: TEST_WORKTREE_ID,
|
||||
title: 'Remote Terminal',
|
||||
customTitle: null,
|
||||
color: null,
|
||||
sortOrder: 0,
|
||||
createdAt: 1
|
||||
}
|
||||
]
|
||||
},
|
||||
terminalLayoutsByTabId: {
|
||||
'host-tab': makeHeadlessTerminalLayout({ [HEADLESS_LEAF_ID]: persistedPtyId })
|
||||
}
|
||||
})
|
||||
)
|
||||
const kill = vi.fn(() => true)
|
||||
const flushOrThrow = vi.fn()
|
||||
const rendererError = new Error('renderer unavailable')
|
||||
const closeTerminal = vi.fn(() => {
|
||||
throw rendererError
|
||||
})
|
||||
const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
|
||||
const closeTerminalTab = vi.fn(async () => {})
|
||||
const runtime = new OrcaRuntimeService({ ...runtimeStore, flushOrThrow } as never)
|
||||
runtime.setPtyController({
|
||||
write: () => true,
|
||||
kill,
|
||||
getForegroundProcess: async () => null,
|
||||
listProcesses: async () => [{ id: persistedPtyId, cwd: TEST_WORKTREE_PATH, title: 'Remote' }]
|
||||
})
|
||||
runtime.setNotifier({ closeTerminal, closeTerminalTab } as never)
|
||||
runtime.syncWindowGraph(0, { tabs: [], leaves: [] })
|
||||
|
||||
await runtime.closeMobileSessionTab(`id:${TEST_WORKTREE_ID}`, 'host-tab')
|
||||
|
||||
expect(closeTerminalTab).not.toHaveBeenCalled()
|
||||
expect(kill).toHaveBeenCalledWith(persistedPtyId)
|
||||
expect(closeTerminal).toHaveBeenCalledWith('host-tab')
|
||||
expect(flushOrThrow).toHaveBeenCalledTimes(1)
|
||||
expect(warn).toHaveBeenCalledWith(
|
||||
'[runtime] failed to notify renderer after headless terminal close',
|
||||
{ parentTabId: 'host-tab', error: rendererError }
|
||||
)
|
||||
expect(getSession().tabsByWorktree[TEST_WORKTREE_ID]).toEqual([])
|
||||
expect(getSession().terminalLayoutsByTabId['host-tab']).toBeUndefined()
|
||||
})
|
||||
|
||||
it('keeps the renderer close transaction for an adopted runtime-owned tab', async () => {
|
||||
// The renderer pin state can be newer than the debounced workspace session.
|
||||
// Once adopted, its live close guard must win over stale persisted metadata.
|
||||
const servePtyId = 'serve-adopted-1'
|
||||
const { runtimeStore, getSession } = makeRuntimeStoreWithWorkspaceSession(
|
||||
makeWorkspaceSessionWithHeadlessTerminal({
|
||||
tabsByWorktree: {
|
||||
[TEST_WORKTREE_ID]: [
|
||||
{
|
||||
id: 'host-tab',
|
||||
ptyId: servePtyId,
|
||||
worktreeId: TEST_WORKTREE_ID,
|
||||
title: 'Adopted Terminal',
|
||||
customTitle: null,
|
||||
color: null,
|
||||
sortOrder: 0,
|
||||
createdAt: 1,
|
||||
isPinned: false
|
||||
}
|
||||
]
|
||||
},
|
||||
terminalLayoutsByTabId: {
|
||||
'host-tab': makeHeadlessTerminalLayout({ [HEADLESS_LEAF_ID]: servePtyId })
|
||||
}
|
||||
})
|
||||
)
|
||||
const kill = vi.fn(() => true)
|
||||
const closeTerminal = vi.fn()
|
||||
const closeTerminalTab = vi.fn(async () => {
|
||||
throw new Error('terminal_tab_pinned')
|
||||
})
|
||||
const runtime = new OrcaRuntimeService(runtimeStore as never)
|
||||
runtime.setPtyController({
|
||||
write: () => true,
|
||||
kill,
|
||||
getForegroundProcess: async () => null,
|
||||
listProcesses: async () => [{ id: servePtyId, cwd: TEST_WORKTREE_PATH, title: 'Adopted' }]
|
||||
})
|
||||
runtime.setNotifier({ closeTerminal, closeTerminalTab } as never)
|
||||
runtime.syncWindowGraph(1, {
|
||||
tabs: [
|
||||
{
|
||||
tabId: 'host-tab',
|
||||
worktreeId: TEST_WORKTREE_ID,
|
||||
title: 'Adopted Terminal',
|
||||
activeLeafId: HEADLESS_LEAF_ID,
|
||||
layout: null
|
||||
}
|
||||
],
|
||||
leaves: [
|
||||
{
|
||||
tabId: 'host-tab',
|
||||
worktreeId: TEST_WORKTREE_ID,
|
||||
leafId: HEADLESS_LEAF_ID,
|
||||
paneRuntimeId: 1,
|
||||
ptyId: servePtyId
|
||||
}
|
||||
]
|
||||
})
|
||||
|
||||
await expect(
|
||||
runtime.closeMobileSessionTab(`id:${TEST_WORKTREE_ID}`, 'host-tab')
|
||||
).rejects.toThrow('terminal_tab_pinned')
|
||||
|
||||
expect(closeTerminalTab).toHaveBeenCalledWith('host-tab')
|
||||
expect(closeTerminal).not.toHaveBeenCalled()
|
||||
expect(kill).not.toHaveBeenCalled()
|
||||
expect(getSession().tabsByWorktree[TEST_WORKTREE_ID]).toHaveLength(1)
|
||||
expect(getSession().terminalLayoutsByTabId['host-tab']).toBeDefined()
|
||||
})
|
||||
|
||||
it('materializes hydrated pending headless terminals with the persisted session identity', async () => {
|
||||
const { runtimeStore } = makeRuntimeStoreWithWorkspaceSession(
|
||||
makeWorkspaceSessionWithHeadlessTerminal()
|
||||
|
||||
@@ -264,6 +264,7 @@ import {
|
||||
} from '../../shared/worktree-ownership'
|
||||
import {
|
||||
BROWSER_HEADLESS_RUNTIME_CAPABILITY,
|
||||
BROWSER_CERTIFICATE_TRUST_RUNTIME_CAPABILITY,
|
||||
MIN_COMPATIBLE_RUNTIME_CLIENT_VERSION,
|
||||
RUNTIME_CAPABILITIES,
|
||||
RUNTIME_PROTOCOL_VERSION,
|
||||
@@ -3061,6 +3062,12 @@ export class OrcaRuntimeService {
|
||||
if (hasOffscreen) {
|
||||
capabilities.push(BROWSER_HEADLESS_RUNTIME_CAPABILITY)
|
||||
}
|
||||
// Why: certificate proceed is owned by the browser-hosting process for both
|
||||
// desktop webviews and offscreen pages. Advertise whenever either backend
|
||||
// can host a page so remote clients can surface Proceed Anyway (Unsafe).
|
||||
if (canBrowse) {
|
||||
capabilities.push(BROWSER_CERTIFICATE_TRUST_RUNTIME_CAPABILITY)
|
||||
}
|
||||
return {
|
||||
runtimeId: this.runtimeId,
|
||||
rendererGraphEpoch: this.rendererGraphEpoch,
|
||||
@@ -3430,13 +3437,16 @@ export class OrcaRuntimeService {
|
||||
allowAttachedWindow?: boolean
|
||||
onlyServeOwnedTerminals?: boolean
|
||||
} = {}
|
||||
): void {
|
||||
): Set<string> {
|
||||
// Why: report which worktrees were reconciled in place so callers don't
|
||||
// reconcile them a second time (see notifyMobileSessionTabsChanged).
|
||||
const reconciledWorktreeIds = new Set<string>()
|
||||
if (this.getAvailableAuthoritativeWindow() && options.allowAttachedWindow !== true) {
|
||||
return
|
||||
return reconciledWorktreeIds
|
||||
}
|
||||
const session = this.store?.getWorkspaceSession?.()
|
||||
if (!session) {
|
||||
return
|
||||
return reconciledWorktreeIds
|
||||
}
|
||||
const entries =
|
||||
worktreeId !== undefined
|
||||
@@ -3455,6 +3465,7 @@ export class OrcaRuntimeService {
|
||||
// Reconcile just the browser tabs against the live bridge instead of
|
||||
// leaving a stale snapshot that omits a freshly-opened browser tab.
|
||||
this.reconcileHeadlessMobileSessionBrowserTabs(entryWorktreeId, existing)
|
||||
reconciledWorktreeIds.add(entryWorktreeId)
|
||||
continue
|
||||
}
|
||||
const terminalTabs = this.buildHeadlessMobileSessionTerminalTabs(
|
||||
@@ -3554,6 +3565,7 @@ export class OrcaRuntimeService {
|
||||
tabs: mergedTabs
|
||||
})
|
||||
}
|
||||
return reconciledWorktreeIds
|
||||
}
|
||||
|
||||
// Why: keep an existing snapshot's browser tabs in sync with the live bridge
|
||||
@@ -3568,13 +3580,11 @@ export class OrcaRuntimeService {
|
||||
}
|
||||
const liveBrowserTabs = this.buildHeadlessMobileSessionBrowserTabs(worktreeId)
|
||||
const liveIds = liveBrowserTabs.map((tab) => tab.id)
|
||||
const existingBrowserIds = existing.tabs
|
||||
.filter((tab): tab is RuntimeMobileSessionBrowserTab => tab.type === 'browser')
|
||||
.map((tab) => tab.id)
|
||||
const unchanged =
|
||||
liveIds.length === existingBrowserIds.length &&
|
||||
liveIds.every((id, index) => existingBrowserIds[index] === id)
|
||||
if (unchanged) {
|
||||
const existingBrowserTabs = existing.tabs.filter(
|
||||
(tab): tab is RuntimeMobileSessionBrowserTab => tab.type === 'browser'
|
||||
)
|
||||
const existingBrowserIds = existingBrowserTabs.map((tab) => tab.id)
|
||||
if (this.headlessBrowserTabsUnchanged(liveBrowserTabs, existingBrowserTabs)) {
|
||||
return
|
||||
}
|
||||
const nonBrowserTabs = existing.tabs.filter((tab) => tab.type !== 'browser')
|
||||
@@ -4051,6 +4061,8 @@ export class OrcaRuntimeService {
|
||||
loading: false,
|
||||
canGoBack: false,
|
||||
canGoForward: false,
|
||||
loadError: tab.loadError ?? undefined,
|
||||
certificateFailure: tab.certificateFailure ?? undefined,
|
||||
...(persistedProps ? { color: persistedProps.color } : {}),
|
||||
...(persistedProps ? { isPinned: persistedProps.isPinned === true } : {}),
|
||||
isActive: tab.active === true
|
||||
@@ -4058,6 +4070,75 @@ export class OrcaRuntimeService {
|
||||
})
|
||||
}
|
||||
|
||||
// Why: change detection for headless browser tabs. Compares the fields that
|
||||
// actually vary (a JSON.stringify equality was order-sensitive and silently
|
||||
// dropped `undefined` keys, so it only worked while both sides shared one
|
||||
// construction path).
|
||||
private headlessBrowserTabsUnchanged(
|
||||
live: RuntimeMobileSessionBrowserTab[],
|
||||
existing: RuntimeMobileSessionBrowserTab[]
|
||||
): boolean {
|
||||
if (live.length !== existing.length) {
|
||||
return false
|
||||
}
|
||||
return live.every((tab, index) => {
|
||||
const prev = existing[index]
|
||||
return (
|
||||
tab.id === prev.id &&
|
||||
tab.title === prev.title &&
|
||||
tab.url === prev.url &&
|
||||
tab.isActive === prev.isActive &&
|
||||
(tab.isPinned ?? false) === (prev.isPinned ?? false) &&
|
||||
(tab.color ?? null) === (prev.color ?? null) &&
|
||||
this.browserLoadErrorsEqual(tab.loadError, prev.loadError) &&
|
||||
this.browserCertificateFailuresEqual(tab.certificateFailure, prev.certificateFailure)
|
||||
)
|
||||
})
|
||||
}
|
||||
|
||||
private browserLoadErrorsEqual(
|
||||
a: RuntimeMobileSessionBrowserTab['loadError'],
|
||||
b: RuntimeMobileSessionBrowserTab['loadError']
|
||||
): boolean {
|
||||
const left = a ?? null
|
||||
const right = b ?? null
|
||||
if (left === right) {
|
||||
return true
|
||||
}
|
||||
if (!left || !right) {
|
||||
return false
|
||||
}
|
||||
return (
|
||||
left.code === right.code &&
|
||||
left.description === right.description &&
|
||||
left.validatedUrl === right.validatedUrl
|
||||
)
|
||||
}
|
||||
|
||||
private browserCertificateFailuresEqual(
|
||||
a: RuntimeMobileSessionBrowserTab['certificateFailure'],
|
||||
b: RuntimeMobileSessionBrowserTab['certificateFailure']
|
||||
): boolean {
|
||||
const left = a ?? null
|
||||
const right = b ?? null
|
||||
if (left === right) {
|
||||
return true
|
||||
}
|
||||
if (!left || !right) {
|
||||
return false
|
||||
}
|
||||
return (
|
||||
left.challengeId === right.challengeId &&
|
||||
left.browserPageId === right.browserPageId &&
|
||||
left.errorCode === right.errorCode &&
|
||||
left.error === right.error &&
|
||||
left.origin === right.origin &&
|
||||
left.displayHost === right.displayHost &&
|
||||
left.canProceed === right.canProceed &&
|
||||
left.observedAt === right.observedAt
|
||||
)
|
||||
}
|
||||
|
||||
private getPersistedUnifiedSessionTabProps(
|
||||
worktreeId: string,
|
||||
tabId: string
|
||||
@@ -4685,26 +4766,33 @@ export class OrcaRuntimeService {
|
||||
(candidate) => candidate.type === 'terminal' && candidate.parentTabId === tab.parentTabId
|
||||
).length
|
||||
const closingWholeParent = tab.id !== tabId || parentLeafCount <= 1
|
||||
// Why: a runtime-owned headless tab is absent from renderer state, so the
|
||||
// closeTerminalTab relay below would ack success without killing its PTY,
|
||||
// and syncMobileSessionTabs would republish the "closed" tab. Only bypass
|
||||
// the relay when no renderer owns the parent: an adopted tab needs the
|
||||
// renderer's live pin guard and durable close transaction.
|
||||
if (closingWholeParent && !this.tabs.has(tab.parentTabId)) {
|
||||
this.closeHeadlessMobileTerminalTab(worktreeId, snapshot!, tab)
|
||||
this.notifyRendererOfHeadlessTerminalClose(tab.parentTabId)
|
||||
this.store?.flushOrThrow?.()
|
||||
return { closed: true }
|
||||
}
|
||||
if (closingWholeParent && this.notifier?.closeTerminalTab) {
|
||||
// Why: whole-tab close is a lifecycle transaction. The renderer reply
|
||||
// arrives only after canonical retirement and a forced session flush.
|
||||
await this.notifier.closeTerminalTab(tab.parentTabId)
|
||||
return { closed: true }
|
||||
}
|
||||
if (!this.notifier?.closeTerminal) {
|
||||
// Why: notifier implementations without the acknowledged relay may expose
|
||||
// only raw pane close. Runtime-owned parents still need de-persist + kill.
|
||||
if (closingWholeParent && this.isRuntimeOwnedHeadlessMobileTab(worktreeId, tab)) {
|
||||
this.closeHeadlessMobileTerminalTab(worktreeId, snapshot!, tab)
|
||||
this.notifyRendererOfHeadlessTerminalClose(tab.parentTabId)
|
||||
this.store?.flushOrThrow?.()
|
||||
return { closed: true }
|
||||
}
|
||||
// Why: a runtime-owned headless tab whose whole parent is being closed must
|
||||
// be torn down authoritatively even with a renderer attached — kill the
|
||||
// PTY, drop the persisted binding, and prune+emit — or syncMobileSessionTabs
|
||||
// keeps republishing the "closed" tab with a live PTY. Best-effort notify the
|
||||
// renderer too so any adopted pane closes (no dead pane). A single split leaf
|
||||
// (exact id, multi-leaf parent) keeps the per-leaf path so siblings survive.
|
||||
if (closingWholeParent && this.isRuntimeOwnedHeadlessMobileTab(worktreeId, tab)) {
|
||||
if (!this.notifier?.closeTerminal) {
|
||||
this.closeHeadlessMobileTerminalTab(worktreeId, snapshot!, tab)
|
||||
this.notifier?.closeTerminal(tab.parentTabId)
|
||||
this.store?.flushOrThrow?.()
|
||||
return { closed: true }
|
||||
}
|
||||
@@ -4732,6 +4820,19 @@ export class OrcaRuntimeService {
|
||||
return { closed: true }
|
||||
}
|
||||
|
||||
private notifyRendererOfHeadlessTerminalClose(parentTabId: string): void {
|
||||
// Why: this relay is advisory after main owns teardown; renderer failure must
|
||||
// not prevent the authoritative session flush or turn the close into failure.
|
||||
try {
|
||||
this.notifier?.closeTerminal(parentTabId)
|
||||
} catch (error) {
|
||||
console.warn('[runtime] failed to notify renderer after headless terminal close', {
|
||||
parentTabId,
|
||||
error
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
private async closeHeadlessMobileBrowserTab(
|
||||
worktreeId: string,
|
||||
snapshot: RuntimeMobileSessionTabsSnapshot,
|
||||
@@ -21545,6 +21646,17 @@ export class OrcaRuntimeService {
|
||||
this.notifyMobileSessionTabSnapshots()
|
||||
return
|
||||
}
|
||||
if (this.offscreenBrowserBackend) {
|
||||
const reconciled = this.hydrateHeadlessMobileSessionTabsFromWorkspaceSession(worktreeId)
|
||||
// Why: hydrate already reconciles an existing snapshot in place; only
|
||||
// reconcile here when it didn't (fresh build or an early-returned hydrate).
|
||||
if (!reconciled.has(worktreeId)) {
|
||||
const existing = this.mobileSessionTabsByWorktree.get(worktreeId)
|
||||
if (existing) {
|
||||
this.reconcileHeadlessMobileSessionBrowserTabs(worktreeId, existing)
|
||||
}
|
||||
}
|
||||
}
|
||||
// Why: structural changes (tab add/remove/activate) must propagate promptly,
|
||||
// so cancel any pending coalesced title/status notify — this immediate emit
|
||||
// already reflects the latest snapshot and supersedes it.
|
||||
@@ -25458,6 +25570,8 @@ export class OrcaRuntimeService {
|
||||
|
||||
browserTabList: RuntimeBrowserCommands['browserTabList'] =
|
||||
this.browserCommands.browserTabList.bind(this.browserCommands)
|
||||
browserProceedCertificate: RuntimeBrowserCommands['browserProceedCertificate'] =
|
||||
this.browserCommands.browserProceedCertificate.bind(this.browserCommands)
|
||||
|
||||
browserTabShow: RuntimeBrowserCommands['browserTabShow'] =
|
||||
this.browserCommands.browserTabShow.bind(this.browserCommands)
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
import { defineMethod, type RpcMethod } from '../core'
|
||||
import { BrowserTarget } from '../schemas'
|
||||
import { BrowserTarget, requiredString } from '../schemas'
|
||||
import {
|
||||
Check,
|
||||
Drag,
|
||||
@@ -34,6 +34,10 @@ import {
|
||||
} from './browser-schemas'
|
||||
import { BROWSER_TEXT_METHODS } from './browser-text-rpc-methods'
|
||||
|
||||
const CertificateProceed = BrowserTarget.extend({
|
||||
challengeId: requiredString('Missing required challengeId')
|
||||
})
|
||||
|
||||
export const BROWSER_CORE_METHODS: RpcMethod[] = [
|
||||
defineMethod({
|
||||
name: 'browser.snapshot',
|
||||
@@ -50,6 +54,11 @@ export const BROWSER_CORE_METHODS: RpcMethod[] = [
|
||||
params: Goto,
|
||||
handler: async (params, { runtime }) => runtime.browserGoto(params)
|
||||
}),
|
||||
defineMethod({
|
||||
name: 'browser.certificate.proceed',
|
||||
params: CertificateProceed,
|
||||
handler: async (params, { runtime }) => runtime.browserProceedCertificate(params)
|
||||
}),
|
||||
...BROWSER_TEXT_METHODS,
|
||||
defineMethod({
|
||||
name: 'browser.select',
|
||||
|
||||
@@ -1,7 +1,5 @@
|
||||
// Why: the browser method surface area is large enough that keeping every
|
||||
// schema in the same file as its handler registration pushes the file past
|
||||
// the 300-line lint cap. Grouping all browser schemas here keeps each
|
||||
// handler file focused on dispatch wiring.
|
||||
// Why: browser schemas stay separate from handler registration so both sides
|
||||
// remain under the line cap and dispatch wiring stays scannable.
|
||||
import { z } from 'zod'
|
||||
import {
|
||||
BrowserTarget,
|
||||
|
||||
@@ -1983,6 +1983,20 @@ describe('OrcaRuntimeRpcServer', () => {
|
||||
(response) => replies.push(JSON.parse(response) as Record<string, unknown>),
|
||||
() => {}
|
||||
)
|
||||
await server['handleWebSocketMessage'](
|
||||
JSON.stringify({
|
||||
id: 'req_browser_certificate_proceed',
|
||||
method: 'browser.certificate.proceed',
|
||||
deviceToken: mobile.token,
|
||||
params: {
|
||||
worktree: 'id:wt-1',
|
||||
page: 'page-1',
|
||||
challengeId: 'challenge-1'
|
||||
}
|
||||
}),
|
||||
(response) => replies.push(JSON.parse(response) as Record<string, unknown>),
|
||||
() => {}
|
||||
)
|
||||
await server['handleWebSocketMessage'](
|
||||
JSON.stringify({
|
||||
id: 'req_browser_dialog_accept',
|
||||
@@ -2123,6 +2137,13 @@ describe('OrcaRuntimeRpcServer', () => {
|
||||
expect(replies).toContainEqual(
|
||||
expect.objectContaining({ id: 'req_browser_viewport', ok: true })
|
||||
)
|
||||
expect(replies).toContainEqual(
|
||||
expect.objectContaining({
|
||||
id: 'req_browser_certificate_proceed',
|
||||
ok: false,
|
||||
error: expect.objectContaining({ code: 'forbidden' })
|
||||
})
|
||||
)
|
||||
expect(replies).toContainEqual(
|
||||
expect.objectContaining({ id: 'req_browser_dialog_accept', ok: true })
|
||||
)
|
||||
|
||||
@@ -1853,7 +1853,7 @@ describe('generateBranchNameFromContext', () => {
|
||||
})
|
||||
})
|
||||
|
||||
it('includes the branch-name custom prompt in the generated prompt', async () => {
|
||||
it('keeps branch-name guidance first without dropping the output contract', async () => {
|
||||
let prompt = ''
|
||||
await generateBranchNameFromContext(
|
||||
{ firstPrompt: 'Fix login flow' },
|
||||
@@ -1861,7 +1861,8 @@ describe('generateBranchNameFromContext', () => {
|
||||
agentId: 'custom',
|
||||
model: '',
|
||||
customAgentCommand: 'agent',
|
||||
customPrompt: 'Prefer auth terminology.'
|
||||
customPrompt: 'Prefer auth terminology.',
|
||||
commandInputTemplate: 'Prefer auth terminology.\n\n{basePrompt}'
|
||||
},
|
||||
{
|
||||
kind: 'remote',
|
||||
@@ -1879,8 +1880,11 @@ describe('generateBranchNameFromContext', () => {
|
||||
}
|
||||
)
|
||||
|
||||
expect(prompt).toContain('Additional user prompt:')
|
||||
expect(prompt.startsWith('Prefer auth terminology.')).toBe(true)
|
||||
expect(prompt).toContain('Prefer auth terminology.')
|
||||
expect(prompt).not.toContain('Additional user prompt:')
|
||||
expect(prompt).toContain('Generate a short git branch name')
|
||||
expect(prompt).toContain('Output ONLY the branch name on a single line')
|
||||
})
|
||||
})
|
||||
|
||||
|
||||
@@ -67,6 +67,8 @@ import type {
|
||||
BaseRefDefaultResult,
|
||||
BaseRefSearchResult,
|
||||
BrowserCookieImportResult,
|
||||
BrowserCertificateFailure,
|
||||
BrowserCertificateProceedResult,
|
||||
BrowserLoadError,
|
||||
BrowserSessionProfile,
|
||||
BrowserSessionProfileScope,
|
||||
@@ -479,7 +481,7 @@ export type BrowserApi = {
|
||||
worktreeId: string
|
||||
sessionProfileId?: string | null
|
||||
webContentsId: number
|
||||
}) => Promise<void>
|
||||
}) => Promise<boolean>
|
||||
unregisterGuest: (args: { browserPageId: string }) => Promise<void>
|
||||
openDevTools: (args: { browserPageId: string }) => Promise<boolean>
|
||||
setViewportOverride: (args: {
|
||||
@@ -490,6 +492,13 @@ export type BrowserApi = {
|
||||
onGuestLoadFailed: (
|
||||
callback: (args: { browserPageId: string; loadError: BrowserLoadError }) => void
|
||||
) => () => void
|
||||
onCertificateFailureChanged: (
|
||||
callback: (event: { browserPageId: string; failure: BrowserCertificateFailure | null }) => void
|
||||
) => () => void
|
||||
proceedCertificate: (args: {
|
||||
browserPageId: string
|
||||
challengeId: string
|
||||
}) => Promise<BrowserCertificateProceedResult>
|
||||
onPermissionDenied: (callback: (event: BrowserPermissionDeniedEvent) => void) => () => void
|
||||
onPopup: (callback: (event: BrowserPopupEvent) => void) => () => void
|
||||
onDownloadRequested: (callback: (event: BrowserDownloadRequestedEvent) => void) => () => void
|
||||
|
||||
+12
-1
@@ -2238,7 +2238,7 @@ const api = {
|
||||
worktreeId: string
|
||||
sessionProfileId?: string | null
|
||||
webContentsId: number
|
||||
}): Promise<void> => ipcRenderer.invoke('browser:registerGuest', args),
|
||||
}): Promise<boolean> => ipcRenderer.invoke('browser:registerGuest', args),
|
||||
|
||||
unregisterGuest: (args: { browserPageId: string }): Promise<void> =>
|
||||
ipcRenderer.invoke('browser:unregisterGuest', args),
|
||||
@@ -2271,6 +2271,17 @@ const api = {
|
||||
return () => ipcRenderer.removeListener('browser:guest-load-failed', listener)
|
||||
},
|
||||
|
||||
onCertificateFailureChanged: (callback): (() => void) => {
|
||||
const listener = (
|
||||
_event: Electron.IpcRendererEvent,
|
||||
data: Parameters<typeof callback>[0]
|
||||
): void => callback(data)
|
||||
ipcRenderer.on('browser:certificate-failure-changed', listener)
|
||||
return () => ipcRenderer.removeListener('browser:certificate-failure-changed', listener)
|
||||
},
|
||||
|
||||
proceedCertificate: (args) => ipcRenderer.invoke('browser:proceedCertificate', args),
|
||||
|
||||
onPermissionDenied: (
|
||||
callback: (event: { browserPageId: string; permission: string; origin: string }) => void
|
||||
): (() => void) => {
|
||||
|
||||
@@ -44,6 +44,7 @@ describe('git blob readers', () => {
|
||||
|
||||
const result = await readBlobAtIndex(gitBuffer, '/repo', 'large.log')
|
||||
|
||||
expect(result).toEqual({ content: '', isBinary: true })
|
||||
// Why: overflow is size-capped content, not a staged deletion (missing: false).
|
||||
expect(result).toEqual({ content: '', isBinary: true, missing: false })
|
||||
})
|
||||
})
|
||||
|
||||
@@ -52,17 +52,19 @@ export async function readBlobAtIndex(
|
||||
gitBuffer: GitBufferExec,
|
||||
cwd: string,
|
||||
filePath: string
|
||||
): Promise<{ content: string; isBinary: boolean }> {
|
||||
): Promise<{ content: string; isBinary: boolean; missing: boolean }> {
|
||||
// Why: Git's `:<path>` syntax expects forward slashes even on Windows.
|
||||
const gitPath = filePath.replace(/\\/g, '/')
|
||||
try {
|
||||
const buf = await gitBuffer(['show', '--end-of-options', `:${gitPath}`], cwd)
|
||||
return bufferToBlob(buf, filePath)
|
||||
return { ...bufferToBlob(buf, filePath), missing: false }
|
||||
} catch (error) {
|
||||
if (isGitBufferOverflowError(error)) {
|
||||
return { content: '', isBinary: true }
|
||||
return { content: '', isBinary: true, missing: false }
|
||||
}
|
||||
return { content: '', isBinary: false }
|
||||
// Why: a non-overflow failure means the path is absent from the index (a
|
||||
// staged deletion), distinct from the size-capped case handled above.
|
||||
return { content: '', isBinary: false, missing: true }
|
||||
}
|
||||
}
|
||||
|
||||
@@ -91,6 +93,7 @@ export async function computeDiff(
|
||||
let modifiedContent = ''
|
||||
let originalIsBinary = false
|
||||
let modifiedIsBinary = false
|
||||
let modifiedDeleted = false
|
||||
|
||||
try {
|
||||
if (staged) {
|
||||
@@ -101,6 +104,7 @@ export async function computeDiff(
|
||||
const right = await readBlobAtIndex(git, worktreePath, filePath)
|
||||
modifiedContent = right.content
|
||||
modifiedIsBinary = right.isBinary
|
||||
modifiedDeleted = right.missing
|
||||
} else {
|
||||
const left = compareAgainstHead
|
||||
? await readBlobAtOid(git, worktreePath, 'HEAD', filePath)
|
||||
@@ -111,18 +115,25 @@ export async function computeDiff(
|
||||
const right = await readWorkingDiffFile(path.join(worktreePath, filePath))
|
||||
modifiedContent = right.content
|
||||
modifiedIsBinary = right.isBinary
|
||||
modifiedDeleted = right.missing
|
||||
}
|
||||
} catch {
|
||||
// Fallback to empty
|
||||
}
|
||||
|
||||
return buildDiffResult(
|
||||
const result = buildDiffResult(
|
||||
originalContent,
|
||||
modifiedContent,
|
||||
originalIsBinary,
|
||||
modifiedIsBinary,
|
||||
filePath
|
||||
)
|
||||
// Why: mark a proven deletion so previewers can fall back to the original bytes
|
||||
// without mistaking a read failure's empty modified side for a deletion.
|
||||
if (result.kind === 'binary' && modifiedDeleted) {
|
||||
return { ...result, modifiedDeleted: true }
|
||||
}
|
||||
return result
|
||||
}
|
||||
|
||||
// ─── Branch compare ──────────────────────────────────────────────────
|
||||
|
||||
@@ -196,6 +196,117 @@ describe('removeWorktreeOp', () => {
|
||||
])
|
||||
})
|
||||
|
||||
it('force-retries removal when git refuses a clean worktree containing an initialised submodule', async () => {
|
||||
const calls: string[] = []
|
||||
let listCount = 0
|
||||
const git = vi.fn<GitExec>(async (args, cwd) => {
|
||||
calls.push(`${cwd}$ ${args.join(' ')}`)
|
||||
if (args[0] === 'rev-parse') {
|
||||
return { stdout: '/repo/.git\n', stderr: '' }
|
||||
}
|
||||
if (args[0] === 'worktree' && args[1] === 'list') {
|
||||
listCount += 1
|
||||
return {
|
||||
stdout:
|
||||
listCount === 1
|
||||
? worktreeList(
|
||||
{ path: '/repo', branch: 'main' },
|
||||
{ path: '/repo-feature', branch: 'feature/test' }
|
||||
)
|
||||
: worktreeList({ path: '/repo', branch: 'main' }),
|
||||
stderr: ''
|
||||
}
|
||||
}
|
||||
if (args[0] === 'worktree' && args[1] === 'remove' && !args.includes('--force')) {
|
||||
throw Object.assign(new Error('git worktree remove failed'), {
|
||||
stderr: 'fatal: working trees containing submodules cannot be moved or removed'
|
||||
})
|
||||
}
|
||||
return { stdout: '', stderr: '' }
|
||||
})
|
||||
|
||||
await removeWorktreeWithCapabilityCache(git, { worktreePath: '/repo-feature' })
|
||||
|
||||
expect(calls).toEqual([
|
||||
'/repo-feature$ rev-parse --git-common-dir',
|
||||
`${resolvedRepoPath()}$ worktree list --porcelain -z`,
|
||||
`${resolvedRepoPath()}$ worktree remove /repo-feature`,
|
||||
'/repo-feature$ status --porcelain --untracked-files=all',
|
||||
`${resolvedRepoPath()}$ worktree remove --force /repo-feature`,
|
||||
`${resolvedRepoPath()}$ branch -d -- feature/test`
|
||||
])
|
||||
})
|
||||
|
||||
it('surfaces uncommitted changes instead of force-removing a dirty submodule worktree', async () => {
|
||||
const git = vi.fn<GitExec>(async (args) => {
|
||||
if (args[0] === 'rev-parse') {
|
||||
return { stdout: '/repo/.git\n', stderr: '' }
|
||||
}
|
||||
if (args[0] === 'worktree' && args[1] === 'list') {
|
||||
return {
|
||||
stdout: worktreeList(
|
||||
{ path: '/repo', branch: 'main' },
|
||||
{ path: '/repo-feature', branch: 'feature/test' }
|
||||
),
|
||||
stderr: ''
|
||||
}
|
||||
}
|
||||
if (args[0] === 'worktree' && args[1] === 'remove') {
|
||||
throw Object.assign(new Error('git worktree remove failed'), {
|
||||
stderr: 'fatal: working trees containing submodules cannot be moved or removed'
|
||||
})
|
||||
}
|
||||
if (args[0] === 'status') {
|
||||
return { stdout: ' M sub\n', stderr: '' }
|
||||
}
|
||||
return { stdout: '', stderr: '' }
|
||||
})
|
||||
|
||||
await expect(
|
||||
removeWorktreeWithCapabilityCache(git, { worktreePath: '/repo-feature' })
|
||||
).rejects.toThrow('Worktree has uncommitted or untracked changes.')
|
||||
expect(git).not.toHaveBeenCalledWith(
|
||||
['worktree', 'remove', '--force', '/repo-feature'],
|
||||
expect.any(String)
|
||||
)
|
||||
})
|
||||
|
||||
it('does not force-retry when the caller already forced SSH removal', async () => {
|
||||
const git = vi.fn<GitExec>(async (args) => {
|
||||
if (args[0] === 'rev-parse') {
|
||||
return { stdout: '/repo/.git\n', stderr: '' }
|
||||
}
|
||||
if (args[0] === 'worktree' && args[1] === 'list') {
|
||||
return {
|
||||
stdout: worktreeList(
|
||||
{ path: '/repo', branch: 'main' },
|
||||
{ path: '/repo-feature', branch: 'feature/test' }
|
||||
),
|
||||
stderr: ''
|
||||
}
|
||||
}
|
||||
if (args[0] === 'worktree' && args[1] === 'remove') {
|
||||
throw Object.assign(new Error('git worktree remove failed'), {
|
||||
stderr: 'fatal: working trees containing submodules cannot be moved or removed'
|
||||
})
|
||||
}
|
||||
return { stdout: '', stderr: '' }
|
||||
})
|
||||
|
||||
await expect(
|
||||
removeWorktreeWithCapabilityCache(git, { worktreePath: '/repo-feature', force: true })
|
||||
).rejects.toThrow('git worktree remove failed')
|
||||
expect(
|
||||
git.mock.calls.filter(
|
||||
([args]) => args[0] === 'worktree' && args[1] === 'remove' && args.includes('--force')
|
||||
)
|
||||
).toHaveLength(1)
|
||||
expect(git).not.toHaveBeenCalledWith(
|
||||
['status', '--porcelain', '--untracked-files=all'],
|
||||
expect.any(String)
|
||||
)
|
||||
})
|
||||
|
||||
it('preserves the branch (does not throw) when `branch -d` refuses an unmerged branch', async () => {
|
||||
let listCount = 0
|
||||
const git = vi.fn<GitExec>(async (args) => {
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
import * as path from 'node:path'
|
||||
import type { RemoveWorktreeResult } from '../shared/types'
|
||||
import { assertWorktreeUnlockedForRemoval } from '../shared/worktree-removal'
|
||||
import { isSubmoduleWorktreeRemovalRefusal } from '../shared/worktree-submodule-removal'
|
||||
import { deleteAlreadyMergedRelayBranchAfterSafeDeleteFailure } from './git-handler-branch-cleanup'
|
||||
import type { GitExec } from './git-handler-ops'
|
||||
import type { GitCapabilityCache } from '../shared/git-capability-cache'
|
||||
@@ -156,7 +157,23 @@ export async function removeWorktreeOp(
|
||||
args.push('--force')
|
||||
}
|
||||
args.push(worktreePath)
|
||||
await git(args, repoPath)
|
||||
try {
|
||||
await git(args, repoPath)
|
||||
} catch (error) {
|
||||
if (force || !isSubmoduleWorktreeRemovalRefusal(error)) {
|
||||
throw error
|
||||
}
|
||||
// Why: Git refuses non-force removal of any worktree with an initialised
|
||||
// submodule even when everything is clean. Re-prove cleanliness (parent
|
||||
// status reports dirty submodule content as ` M <sub>`), then --force.
|
||||
const { stdout } = await git(['status', '--porcelain', '--untracked-files=all'], worktreePath)
|
||||
if (stdout.trim()) {
|
||||
const dirtyError = new Error('Worktree has uncommitted or untracked changes.')
|
||||
;(dirtyError as Error & { stdout?: string }).stdout = stdout
|
||||
throw dirtyError
|
||||
}
|
||||
await git(['worktree', 'remove', '--force', worktreePath], repoPath)
|
||||
}
|
||||
|
||||
if (!branchName) {
|
||||
return {}
|
||||
|
||||
@@ -21,7 +21,8 @@ describe('readWorkingDiffFile', () => {
|
||||
|
||||
await expect(readWorkingDiffFile(filePath)).resolves.toEqual({
|
||||
content: 'hello',
|
||||
isBinary: false
|
||||
isBinary: false,
|
||||
missing: false
|
||||
})
|
||||
})
|
||||
|
||||
@@ -32,7 +33,61 @@ describe('readWorkingDiffFile', () => {
|
||||
|
||||
await expect(readWorkingDiffFile(filePath)).resolves.toEqual({
|
||||
content: '',
|
||||
isBinary: true
|
||||
isBinary: true,
|
||||
missing: false
|
||||
})
|
||||
})
|
||||
|
||||
it('base64-encodes a previewable image by its extension', async () => {
|
||||
tmpDir = await mkdtemp(path.join(tmpdir(), 'relay-working-file-'))
|
||||
const filePath = path.join(tmpDir, 'icon.png')
|
||||
const pngBytes = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0x00, 0x01])
|
||||
await writeFile(filePath, pngBytes)
|
||||
|
||||
await expect(readWorkingDiffFile(filePath)).resolves.toEqual({
|
||||
content: pngBytes.toString('base64'),
|
||||
isBinary: true,
|
||||
missing: false
|
||||
})
|
||||
})
|
||||
|
||||
it('reports an absent working-tree file as a deletion', async () => {
|
||||
tmpDir = await mkdtemp(path.join(tmpdir(), 'relay-working-file-'))
|
||||
const filePath = path.join(tmpDir, 'deleted.png')
|
||||
|
||||
await expect(readWorkingDiffFile(filePath)).resolves.toEqual({
|
||||
content: '',
|
||||
isBinary: false,
|
||||
missing: true
|
||||
})
|
||||
})
|
||||
|
||||
it('returns base64 content for previewable image working-tree files', async () => {
|
||||
tmpDir = await mkdtemp(path.join(tmpdir(), 'relay-working-file-'))
|
||||
const filePath = path.join(tmpDir, 'image.png')
|
||||
// Why: PNG signature + trailing null byte forces the binary-detection heuristic to trip.
|
||||
const pngBuffer = Buffer.concat([
|
||||
Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]),
|
||||
Buffer.from([0x00])
|
||||
])
|
||||
await writeFile(filePath, pngBuffer)
|
||||
|
||||
await expect(readWorkingDiffFile(filePath)).resolves.toEqual({
|
||||
content: pngBuffer.toString('base64'),
|
||||
isBinary: true,
|
||||
missing: false
|
||||
})
|
||||
})
|
||||
|
||||
it('returns empty content for non-previewable binary working-tree files', async () => {
|
||||
tmpDir = await mkdtemp(path.join(tmpdir(), 'relay-working-file-'))
|
||||
const filePath = path.join(tmpDir, 'archive.bin')
|
||||
await writeFile(filePath, Buffer.from([0x00, 0x01, 0x02, 0x00, 0x03]))
|
||||
|
||||
await expect(readWorkingDiffFile(filePath)).resolves.toEqual({
|
||||
content: '',
|
||||
isBinary: true,
|
||||
missing: false
|
||||
})
|
||||
})
|
||||
})
|
||||
|
||||
@@ -5,19 +5,31 @@ const MAX_RELAY_DIFF_WORKING_FILE_BYTES = 10 * 1024 * 1024
|
||||
|
||||
export async function readWorkingDiffFile(
|
||||
absPath: string
|
||||
): Promise<{ content: string; isBinary: boolean }> {
|
||||
): Promise<{ content: string; isBinary: boolean; missing: boolean }> {
|
||||
let fileStat
|
||||
try {
|
||||
fileStat = await stat(absPath)
|
||||
} catch (error) {
|
||||
// Why: ENOENT means the working-tree file is genuinely gone (a deletion);
|
||||
// any other stat error is a read failure we must not mistake for one, since
|
||||
// callers fall back to the original bytes only for a proven deletion.
|
||||
const missing = (error as NodeJS.ErrnoException)?.code === 'ENOENT'
|
||||
return { content: '', isBinary: false, missing }
|
||||
}
|
||||
if (!fileStat.isFile()) {
|
||||
return { content: '', isBinary: false, missing: true }
|
||||
}
|
||||
if (fileStat.size > MAX_RELAY_DIFF_WORKING_FILE_BYTES) {
|
||||
// Why: mirror local git diff reads, which cap blob transfer at 10MB.
|
||||
return { content: '', isBinary: true, missing: false }
|
||||
}
|
||||
try {
|
||||
const fileStat = await stat(absPath)
|
||||
if (!fileStat.isFile()) {
|
||||
return { content: '', isBinary: false }
|
||||
}
|
||||
if (fileStat.size > MAX_RELAY_DIFF_WORKING_FILE_BYTES) {
|
||||
// Why: mirror local git diff reads, which cap blob transfer at 10MB.
|
||||
return { content: '', isBinary: true }
|
||||
}
|
||||
const buffer = await readFile(absPath)
|
||||
return bufferToBlob(buffer)
|
||||
// Why: bufferToBlob needs the path's extension to know an image is
|
||||
// previewable; omitting it made every relay-side binary diff empty.
|
||||
return { ...bufferToBlob(buffer, absPath), missing: false }
|
||||
} catch {
|
||||
return { content: '', isBinary: false }
|
||||
// Why: the file exists but could not be read — a read failure, not a deletion.
|
||||
return { content: '', isBinary: false, missing: false }
|
||||
}
|
||||
}
|
||||
|
||||
@@ -181,7 +181,7 @@ import {
|
||||
filterGitHubPRReviewerCandidates,
|
||||
getGitHubPRReviewerQueryState
|
||||
} from '@/components/github/github-pr-reviewer-candidate-filter'
|
||||
import { githubAvatarUrl } from '@/components/github/github-issue-comment-helpers'
|
||||
import { GitHubUserAvatar } from '@/components/github/github-user-avatar'
|
||||
import { presentGitHubPRMergeState } from '@/components/github-pr-merge-state'
|
||||
import {
|
||||
GITHUB_PR_MERGE_METHOD_LABELS,
|
||||
@@ -421,16 +421,7 @@ function ReviewerAvatar({
|
||||
login: string
|
||||
avatarUrl: string
|
||||
}): React.JSX.Element {
|
||||
return (
|
||||
<img
|
||||
src={avatarUrl || githubAvatarUrl(login)}
|
||||
alt=""
|
||||
loading="lazy"
|
||||
decoding="async"
|
||||
title={login}
|
||||
className="size-6 shrink-0 rounded-full border border-border/50 bg-muted object-cover"
|
||||
/>
|
||||
)
|
||||
return <GitHubUserAvatar login={login} avatarUrl={avatarUrl} title={login} className="size-6" />
|
||||
}
|
||||
|
||||
function mergeReviewerSuggestions(
|
||||
|
||||
@@ -157,7 +157,7 @@ import {
|
||||
filterGitHubPRReviewerCandidates,
|
||||
getGitHubPRReviewerQueryState
|
||||
} from '@/components/github/github-pr-reviewer-candidate-filter'
|
||||
import { githubAvatarUrl } from '@/components/github/github-issue-comment-helpers'
|
||||
import { GitHubUserAvatar } from '@/components/github/github-user-avatar'
|
||||
import { filterGitHubMentionOptions } from '@/components/github/github-mention-option-filter'
|
||||
import {
|
||||
getCommentBodySubmitState,
|
||||
@@ -468,16 +468,7 @@ function ReviewerAvatar({
|
||||
login: string
|
||||
avatarUrl: string
|
||||
}): React.JSX.Element {
|
||||
return (
|
||||
<img
|
||||
src={avatarUrl || githubAvatarUrl(login)}
|
||||
alt=""
|
||||
loading="lazy"
|
||||
decoding="async"
|
||||
title={login}
|
||||
className="size-6 shrink-0 rounded-full border border-border/50 bg-muted object-cover"
|
||||
/>
|
||||
)
|
||||
return <GitHubUserAvatar login={login} avatarUrl={avatarUrl} title={login} className="size-6" />
|
||||
}
|
||||
|
||||
function mergeReviewerSuggestions(
|
||||
@@ -7148,12 +7139,10 @@ export default function PullRequestPage({
|
||||
</span>
|
||||
<span className="flex min-w-0 items-center gap-1.5">
|
||||
{workItem.author ? (
|
||||
<img
|
||||
src={githubAvatarUrl(workItem.author)}
|
||||
alt=""
|
||||
loading="lazy"
|
||||
decoding="async"
|
||||
className="size-5 shrink-0 rounded-full border border-border/50 bg-muted object-cover"
|
||||
<GitHubUserAvatar
|
||||
login={workItem.author}
|
||||
avatarUrl={displayWorkItem?.authorAvatarUrl ?? workItem.authorAvatarUrl}
|
||||
className="size-5"
|
||||
/>
|
||||
) : null}
|
||||
<span className="font-semibold text-foreground">
|
||||
|
||||
@@ -133,6 +133,7 @@ import {
|
||||
} from '../../../shared/linear-links'
|
||||
import PRFilterDropdowns, { type PRFilterChange } from '@/components/github/PRFilterDropdowns'
|
||||
import { GitHubMarkdownComposer } from '@/components/github/GitHubMarkdownComposer'
|
||||
import { GitHubUserAvatar } from '@/components/github/github-user-avatar'
|
||||
import { buildGitHubRepoUrl, parseGitHubIssueOrPRLink } from '@/lib/github-links'
|
||||
import {
|
||||
findGithubWorkItemWorkspaceAttachment,
|
||||
@@ -1520,17 +1521,16 @@ function ReviewChipAvatar({
|
||||
reviewer: GitHubPRPrimaryReviewer | null
|
||||
}): React.JSX.Element {
|
||||
if (reviewer?.login) {
|
||||
// Why: `gh pr list --json reviewRequests` can return only logins; GitHub's
|
||||
// public avatar endpoint keeps the list visual aligned with assignee cells.
|
||||
const avatarUrl = reviewer.avatarUrl || `https://github.com/${reviewer.login}.png?size=40`
|
||||
// Why: `gh pr list --json reviewRequests` can return only logins. Prefer the
|
||||
// API avatar_url so GHE renders; GitHubUserAvatar falls back to the login URL
|
||||
// and then an initials placeholder when no avatar loads. See #8784.
|
||||
return (
|
||||
<img
|
||||
src={avatarUrl}
|
||||
alt=""
|
||||
loading="lazy"
|
||||
decoding="async"
|
||||
<GitHubUserAvatar
|
||||
login={reviewer.login}
|
||||
name={reviewer.name}
|
||||
avatarUrl={reviewer.avatarUrl}
|
||||
title={reviewer.name ? `${reviewer.name} (${reviewer.login})` : reviewer.login}
|
||||
className="size-5 shrink-0 rounded-full border border-border/50 bg-muted object-cover"
|
||||
className="size-5"
|
||||
/>
|
||||
)
|
||||
}
|
||||
|
||||
@@ -63,6 +63,7 @@ import { getRuntimeEnvironmentIdForWorktree } from '@/lib/worktree-runtime-owner
|
||||
import { ORCA_BROWSER_BLANK_URL, ORCA_BROWSER_PARTITION } from '../../../../shared/constants'
|
||||
import { getOrcaProfileBrowserDefaultPartition } from '../../../../shared/orca-profiles'
|
||||
import type {
|
||||
BrowserCertificateProceedResult,
|
||||
BrowserLoadError,
|
||||
BrowserPage as BrowserPageState,
|
||||
BrowserWorkspace as BrowserWorkspaceState
|
||||
@@ -70,7 +71,9 @@ import type {
|
||||
import {
|
||||
normalizeBrowserNavigationUrl,
|
||||
normalizeExternalBrowserUrl,
|
||||
redactKagiSessionToken
|
||||
redactKagiSessionToken,
|
||||
resolveRemoteFailureExternalUrl,
|
||||
toHttpsRecoveryUrl
|
||||
} from '../../../../shared/browser-url'
|
||||
import { keybindingMatchesAction } from '../../../../shared/keybindings'
|
||||
import { getScreenSubmitModifierLabel, isScreenSubmitShortcut } from '@/lib/screen-submit-shortcut'
|
||||
@@ -165,13 +168,7 @@ import {
|
||||
type BrowserScreencastFrameMetadata
|
||||
} from '../../../../shared/browser-screencast-protocol'
|
||||
import { withBrowserPaneUiRuntimeRpcSource } from '../../../../shared/runtime-rpc-feature-interaction-source'
|
||||
import {
|
||||
formatByteCount,
|
||||
formatLoadFailureDescription,
|
||||
formatLoadFailureRecoveryHint,
|
||||
formatPermissionNotice,
|
||||
formatPopupNotice
|
||||
} from './browser-notices'
|
||||
import { formatByteCount, formatPermissionNotice, formatPopupNotice } from './browser-notices'
|
||||
import {
|
||||
getDriverForBrowserPage,
|
||||
onBrowserDriverChange,
|
||||
@@ -186,6 +183,7 @@ import { useMarkupMode, type MarkupCaptureContext } from './markup/useMarkupMode
|
||||
import { MarkupOverlay } from './markup/MarkupOverlay'
|
||||
import { MarkupDrawButton } from './markup/MarkupDrawButton'
|
||||
import { deliverMarkupToClipboard } from './markup/markup-clipboard-delivery'
|
||||
import { BrowserLoadFailureOverlay } from './browser-load-failure-overlay'
|
||||
|
||||
type BrowserTabPageState = Partial<
|
||||
Pick<
|
||||
@@ -700,28 +698,6 @@ function getRemoteBrowserDeviceScaleFactor(): number {
|
||||
return Math.min(2, Math.max(1, Number(scale.toFixed(2))))
|
||||
}
|
||||
|
||||
function getLoadErrorMetadata(loadError: BrowserLoadError | null): {
|
||||
displayUrl: string
|
||||
host: string | null
|
||||
isLocalhostLike: boolean
|
||||
} {
|
||||
const rawUrl = loadError?.validatedUrl ?? 'about:blank'
|
||||
const displayUrl = toDisplayUrl(rawUrl)
|
||||
try {
|
||||
const parsed = new URL(rawUrl)
|
||||
const host = parsed.host || null
|
||||
const hostname = parsed.hostname
|
||||
const isLocalhostLike =
|
||||
hostname === 'localhost' ||
|
||||
hostname === '127.0.0.1' ||
|
||||
hostname === '0.0.0.0' ||
|
||||
hostname === '::1'
|
||||
return { displayUrl, host, isLocalhostLike }
|
||||
} catch {
|
||||
return { displayUrl, host: null, isLocalhostLike: false }
|
||||
}
|
||||
}
|
||||
|
||||
function getOpenableExternalUrl(
|
||||
webview: Electron.WebviewTag | null,
|
||||
fallbackUrl: string
|
||||
@@ -960,6 +936,12 @@ function RemoteBrowserPagePane({
|
||||
(token: RemoteBrowserOperationToken) => Promise<BrowserTabInfo | null>
|
||||
>(async () => null)
|
||||
const setRemoteBrowserPageHandle = useAppStore((s) => s.setRemoteBrowserPageHandle)
|
||||
const certificateFailure = useAppStore(
|
||||
(s) => s.browserCertificateFailuresByPageId[browserTab.id] ?? null
|
||||
)
|
||||
const remotePageHandle = useAppStore(
|
||||
(s) => s.remoteBrowserPageHandlesByPageId[browserTab.id] ?? null
|
||||
)
|
||||
const createBrowserTab = useAppStore((s) => s.createBrowserTab)
|
||||
const closeBrowserPage = useAppStore((s) => s.closeBrowserPage)
|
||||
const closeBrowserTab = useAppStore((s) => s.closeBrowserTab)
|
||||
@@ -1985,7 +1967,13 @@ function RemoteBrowserPagePane({
|
||||
setRemoteError(message)
|
||||
onUpdatePageState(browserTab.id, {
|
||||
loading: false,
|
||||
loadError: { code: 0, description: message, validatedUrl: url ?? browserTab.url }
|
||||
// Why: validatedUrl crosses process/persistence boundaries, so redact a
|
||||
// Kagi session token the same way the main-process failure path does.
|
||||
loadError: {
|
||||
code: 0,
|
||||
description: message,
|
||||
validatedUrl: redactKagiSessionToken(url ?? browserTab.url)
|
||||
}
|
||||
})
|
||||
} finally {
|
||||
if (isCurrentRemoteOperationToken(pageToken)) {
|
||||
@@ -2398,6 +2386,12 @@ function RemoteBrowserPagePane({
|
||||
}, [frameUrl, handleRemoteScreenshotWheel])
|
||||
|
||||
const remoteFrameStyle = useMemo(() => getRemoteBrowserFrameStyle(frameMetadata), [frameMetadata])
|
||||
const remoteFailureUrl = browserTab.loadError?.validatedUrl ?? browserTab.url
|
||||
const remoteFailureExternalUrl = resolveRemoteFailureExternalUrl(remoteFailureUrl)
|
||||
const showRemoteFailureOverlay =
|
||||
Boolean(browserTab.loadError) &&
|
||||
remoteFailureUrl !== 'about:blank' &&
|
||||
remoteFailureUrl !== ORCA_BROWSER_BLANK_URL
|
||||
|
||||
// Why: markup works on remote panes by snapshotting the already-displayed
|
||||
// screencast <img> — no in-page injection needed, so it is enabled here even
|
||||
@@ -2692,6 +2686,44 @@ function RemoteBrowserPagePane({
|
||||
</div>
|
||||
</div>
|
||||
)}
|
||||
{showRemoteFailureOverlay && browserTab.loadError ? (
|
||||
<BrowserLoadFailureOverlay
|
||||
loadError={browserTab.loadError}
|
||||
externalUrl={remoteFailureExternalUrl}
|
||||
currentUrl={toDisplayUrl(remoteFailureUrl)}
|
||||
httpsRecoveryUrl={toHttpsRecoveryUrl(remoteFailureUrl)}
|
||||
onRetry={() => void runRemoteNavigation('browser.reload')}
|
||||
onTryHttps={(url) => void runRemoteNavigation('browser.goto', url)}
|
||||
onCopy={(url) => void window.api.ui.writeClipboardText(url)}
|
||||
onOpenExternal={(url) => void window.api.shell.openUrl(url)}
|
||||
certificateFailure={certificateFailure}
|
||||
expectedBrowserPageId={
|
||||
remotePageHandle?.environmentId === activeRuntimeEnvironmentId
|
||||
? remotePageHandle.remotePageId
|
||||
: null
|
||||
}
|
||||
onProceedCertificate={async (challengeId) => {
|
||||
const target = runtimeTarget()
|
||||
if (
|
||||
!target ||
|
||||
remotePageHandle?.environmentId !== target.environmentId ||
|
||||
remotePageHandle.remotePageId !== certificateFailure?.browserPageId
|
||||
) {
|
||||
return { ok: false, reason: 'missing' }
|
||||
}
|
||||
return callRuntimeRpc<BrowserCertificateProceedResult>(
|
||||
target,
|
||||
'browser.certificate.proceed',
|
||||
{
|
||||
worktree: runtimeWorktree,
|
||||
page: remotePageHandle.remotePageId,
|
||||
challengeId
|
||||
},
|
||||
{ timeoutMs: 15_000, suppressFeatureInteraction: true }
|
||||
)
|
||||
}}
|
||||
/>
|
||||
) : null}
|
||||
{remoteError ? (
|
||||
<div className="absolute bottom-4 left-1/2 max-w-md -translate-x-1/2 rounded-md border border-border bg-popover px-3 py-2 text-xs text-popover-foreground shadow-md">
|
||||
{remoteError}
|
||||
@@ -2879,6 +2911,9 @@ function BrowserPagePane({
|
||||
const browserAnnotations = useAppStore(
|
||||
(s) => s.browserAnnotationsByPageId[browserTab.id] ?? EMPTY_BROWSER_ANNOTATIONS
|
||||
)
|
||||
const certificateFailure = useAppStore(
|
||||
(s) => s.browserCertificateFailuresByPageId[browserTab.id] ?? null
|
||||
)
|
||||
const activeGroupId = useAppStore((s) => s.activeGroupIdByWorktree[worktreeId])
|
||||
const browserAnnotationsRef = useRef(browserAnnotations)
|
||||
browserAnnotationsRef.current = browserAnnotations
|
||||
@@ -3731,21 +3766,53 @@ function BrowserPagePane({
|
||||
dismissAddressBarSuggestionsRef.current?.()
|
||||
}
|
||||
|
||||
const handleDomReady = (): void => {
|
||||
let registrationInFlight: { webContentsId: number; promise: Promise<boolean> } | null = null
|
||||
const registerGuest = (): Promise<boolean> => {
|
||||
const webContentsId = webview.getWebContentsId()
|
||||
let queuedAnnotationViewportBridgeSync = false
|
||||
if (registeredWebContentsIds.get(browserTab.id) !== webContentsId) {
|
||||
registeredWebContentsIds.set(browserTab.id, webContentsId)
|
||||
queuedAnnotationViewportBridgeSync = true
|
||||
void window.api.browser
|
||||
.registerGuest({
|
||||
browserPageId: browserTab.id,
|
||||
workspaceId,
|
||||
worktreeId,
|
||||
sessionProfileId,
|
||||
webContentsId
|
||||
})
|
||||
.finally(() => syncBrowserAnnotationViewportBridge())
|
||||
if (registeredWebContentsIds.get(browserTab.id) === webContentsId) {
|
||||
return Promise.resolve(true)
|
||||
}
|
||||
if (registrationInFlight?.webContentsId === webContentsId) {
|
||||
return registrationInFlight.promise
|
||||
}
|
||||
const promise = window.api.browser
|
||||
.registerGuest({
|
||||
browserPageId: browserTab.id,
|
||||
workspaceId,
|
||||
worktreeId,
|
||||
sessionProfileId,
|
||||
webContentsId
|
||||
})
|
||||
.then((registered) => {
|
||||
if (registered) {
|
||||
registeredWebContentsIds.set(browserTab.id, webContentsId)
|
||||
}
|
||||
return registered
|
||||
})
|
||||
// Why: normalize IPC rejection to false so the dom-ready fallback can
|
||||
// retry attach-policy races without an unhandled promise rejection.
|
||||
.catch(() => false)
|
||||
.finally(() => {
|
||||
if (registrationInFlight?.promise === promise) {
|
||||
registrationInFlight = null
|
||||
}
|
||||
})
|
||||
registrationInFlight = { webContentsId, promise }
|
||||
return promise
|
||||
}
|
||||
|
||||
const handleDidAttach = (): void => {
|
||||
// Why: certificate failures can happen before dom-ready. Register at
|
||||
// attach so main can map the initial failure to this page; dom-ready below
|
||||
// remains an idempotent fallback for attach-policy races.
|
||||
void registerGuest().finally(() => syncBrowserAnnotationViewportBridge())
|
||||
}
|
||||
|
||||
const handleDomReady = (): void => {
|
||||
const queuedAnnotationViewportBridgeSync =
|
||||
registeredWebContentsIds.get(browserTab.id) !== webview.getWebContentsId()
|
||||
if (queuedAnnotationViewportBridgeSync) {
|
||||
void registerGuest().finally(() => syncBrowserAnnotationViewportBridge())
|
||||
}
|
||||
syncNavigationState(webview)
|
||||
if (keepAddressBarFocusRef.current) {
|
||||
@@ -3964,6 +4031,7 @@ function BrowserPagePane({
|
||||
}
|
||||
}
|
||||
|
||||
webview.addEventListener('did-attach', handleDidAttach)
|
||||
webview.addEventListener('dom-ready', handleDomReady)
|
||||
webview.addEventListener('focus', dismissAddressBarSuggestions)
|
||||
webview.addEventListener('did-start-loading', handleDidStartLoading)
|
||||
@@ -3997,6 +4065,7 @@ function BrowserPagePane({
|
||||
}
|
||||
|
||||
return () => {
|
||||
webview.removeEventListener('did-attach', handleDidAttach)
|
||||
webview.removeEventListener('dom-ready', handleDomReady)
|
||||
webview.removeEventListener('focus', dismissAddressBarSuggestions)
|
||||
webview.removeEventListener('did-start-loading', handleDidStartLoading)
|
||||
@@ -4672,8 +4741,8 @@ function BrowserPagePane({
|
||||
const isBlankTab = browserTab.url === 'about:blank' || browserTab.url === ORCA_BROWSER_BLANK_URL
|
||||
const externalUrl = getOpenableExternalUrl(webviewRef.current, browserTab.url)
|
||||
const currentBrowserUrl = getCurrentBrowserUrl(webviewRef.current, browserTab.url)
|
||||
const loadErrorMeta = getLoadErrorMetadata(browserTab.loadError)
|
||||
const loadErrorHint = formatLoadFailureRecoveryHint(loadErrorMeta)
|
||||
const failedNavigationUrl = browserTab.loadError?.validatedUrl ?? currentBrowserUrl
|
||||
const failureExternalUrl = normalizeExternalBrowserUrl(failedNavigationUrl)
|
||||
const showFailureOverlay = Boolean(browserTab.loadError) && !isBlankTab
|
||||
const visibleDownloads = (() => {
|
||||
const active = downloadStates.filter((download) => download.status === 'downloading')
|
||||
@@ -5476,114 +5545,40 @@ function BrowserPagePane({
|
||||
onClose={() => setFindOpen(false)}
|
||||
webviewRef={webviewRef}
|
||||
/>
|
||||
{showFailureOverlay ? (
|
||||
<div className="absolute inset-0 z-10 flex items-center justify-center bg-[radial-gradient(circle_at_center,rgba(255,255,255,0.02),transparent_58%)] px-6">
|
||||
<div className="flex max-w-sm flex-col items-center px-8 py-8 text-center opacity-70">
|
||||
<div className="mb-4 rounded-full border border-border/70 bg-muted/30 p-3">
|
||||
<Globe className="size-5 text-muted-foreground" />
|
||||
</div>
|
||||
<h2 className="text-base font-semibold text-foreground/85">
|
||||
{loadErrorMeta.host
|
||||
? translate(
|
||||
'auto.components.browser.pane.BrowserPane.db325a7eeb',
|
||||
"Can't reach {{value0}}",
|
||||
{ value0: loadErrorMeta.host }
|
||||
)
|
||||
: translate(
|
||||
'auto.components.browser.pane.BrowserPane.b2856516e2',
|
||||
"Can't load this page"
|
||||
)}
|
||||
</h2>
|
||||
<p className="mt-2 text-sm text-muted-foreground">
|
||||
{formatLoadFailureDescription(browserTab.loadError, loadErrorMeta)}
|
||||
</p>
|
||||
{loadErrorHint ? (
|
||||
<p className="mt-2 text-xs text-muted-foreground/80">{loadErrorHint}</p>
|
||||
) : null}
|
||||
<div className="mt-5 flex items-center gap-2">
|
||||
<Button
|
||||
size="sm"
|
||||
variant="outline"
|
||||
className="h-9 gap-2 px-3"
|
||||
title={translate(
|
||||
'auto.components.browser.pane.BrowserPane.781d6459ad',
|
||||
'Retry'
|
||||
)}
|
||||
onClick={() => {
|
||||
const webview = webviewRef.current
|
||||
if (!webview) {
|
||||
return
|
||||
}
|
||||
onUpdatePageStateRef.current(browserTab.id, {
|
||||
loading: true
|
||||
})
|
||||
retryBrowserTabLoad(webview, browserTab, onUpdatePageStateRef.current)
|
||||
}}
|
||||
>
|
||||
<RefreshCw className="size-4" />
|
||||
<span>
|
||||
{translate(
|
||||
'auto.components.browser.pane.BrowserPane.c6be71329e',
|
||||
'Refresh'
|
||||
)}
|
||||
</span>
|
||||
</Button>
|
||||
<Button
|
||||
size="sm"
|
||||
variant="ghost"
|
||||
className="h-9 gap-2 px-3"
|
||||
title={translate(
|
||||
'auto.components.browser.pane.BrowserPane.3c085f638d',
|
||||
'Copy failed page URL'
|
||||
)}
|
||||
onClick={() => {
|
||||
// Why: failed guests often leave users stranded on a blank
|
||||
// error surface. Put the current URL on the clipboard from
|
||||
// the recovery UI itself so they can retry elsewhere
|
||||
// without having to discover the toolbar overflow first.
|
||||
void window.api.ui.writeClipboardText(currentBrowserUrl)
|
||||
setResourceNotice('Copied the current page URL.')
|
||||
}}
|
||||
>
|
||||
<Copy className="size-4" />
|
||||
<span>
|
||||
{translate(
|
||||
'auto.components.browser.pane.BrowserPane.93be92f8d1',
|
||||
'Copy Address'
|
||||
)}
|
||||
</span>
|
||||
</Button>
|
||||
{externalUrl ? (
|
||||
<Button
|
||||
size="sm"
|
||||
variant="ghost"
|
||||
className="h-9 gap-2 px-3"
|
||||
title={translate(
|
||||
'auto.components.browser.pane.BrowserPane.da68d35f7b',
|
||||
'Open failed page in default browser'
|
||||
)}
|
||||
onClick={() => {
|
||||
// Why: page failures inside Orca can still be recoverable
|
||||
// in the system browser, especially for OAuth, captive
|
||||
// portals, or enterprise auth flows that rely on a full
|
||||
// browser profile. Keep this action in the failed-state
|
||||
// overlay so recovery does not depend on toolbar affordance
|
||||
// discovery while the guest itself is unusable.
|
||||
void window.api.shell.openUrl(externalUrl)
|
||||
}}
|
||||
>
|
||||
<ExternalLink className="size-4" />
|
||||
<span>
|
||||
{translate(
|
||||
'auto.components.browser.pane.BrowserPane.1c78adc73d',
|
||||
'Open Externally'
|
||||
)}
|
||||
</span>
|
||||
</Button>
|
||||
) : null}
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
{showFailureOverlay && browserTab.loadError ? (
|
||||
<BrowserLoadFailureOverlay
|
||||
loadError={browserTab.loadError}
|
||||
externalUrl={failureExternalUrl}
|
||||
currentUrl={toDisplayUrl(failedNavigationUrl)}
|
||||
httpsRecoveryUrl={toHttpsRecoveryUrl(failedNavigationUrl)}
|
||||
onRetry={() => {
|
||||
const webview = webviewRef.current
|
||||
if (!webview) {
|
||||
return
|
||||
}
|
||||
onUpdatePageStateRef.current(browserTab.id, { loading: true })
|
||||
retryBrowserTabLoad(webview, browserTab, onUpdatePageStateRef.current)
|
||||
}}
|
||||
onTryHttps={navigateToUrl}
|
||||
onCopy={(url) => {
|
||||
void window.api.ui.writeClipboardText(url)
|
||||
setResourceNotice(
|
||||
translate(
|
||||
'browser.loadFailure.addressCopied',
|
||||
'Copied the current page address.'
|
||||
)
|
||||
)
|
||||
}}
|
||||
onOpenExternal={(url) => void window.api.shell.openUrl(url)}
|
||||
certificateFailure={certificateFailure}
|
||||
expectedBrowserPageId={browserTab.id}
|
||||
onProceedCertificate={(challengeId) =>
|
||||
window.api.browser.proceedCertificate({
|
||||
browserPageId: browserTab.id,
|
||||
challengeId
|
||||
})
|
||||
}
|
||||
/>
|
||||
) : null}
|
||||
{isBlankTab ? (
|
||||
<div className="pointer-events-none absolute inset-0 z-10 flex items-center justify-center bg-[radial-gradient(circle_at_center,rgba(255,255,255,0.02),transparent_58%)] px-6">
|
||||
|
||||
@@ -0,0 +1,319 @@
|
||||
// @vitest-environment happy-dom
|
||||
import '@testing-library/jest-dom/vitest'
|
||||
import { act, cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react'
|
||||
import { afterEach, describe, expect, it, vi } from 'vitest'
|
||||
|
||||
import { BrowserLoadFailureOverlay } from './browser-load-failure-overlay'
|
||||
|
||||
const callbacks = {
|
||||
onRetry: vi.fn(),
|
||||
onTryHttps: vi.fn(),
|
||||
onCopy: vi.fn(),
|
||||
onOpenExternal: vi.fn(),
|
||||
onProceedCertificate: vi.fn()
|
||||
}
|
||||
|
||||
const certificateFailure = {
|
||||
challengeId: 'challenge-1',
|
||||
browserPageId: 'page-1',
|
||||
errorCode: -202,
|
||||
error: 'ERR_CERT_AUTHORITY_INVALID',
|
||||
origin: 'https://localhost:3443',
|
||||
displayHost: 'localhost:3443',
|
||||
canProceed: true,
|
||||
observedAt: 123
|
||||
}
|
||||
|
||||
afterEach(() => {
|
||||
cleanup()
|
||||
vi.useRealTimers()
|
||||
vi.clearAllMocks()
|
||||
})
|
||||
|
||||
describe('BrowserLoadFailureOverlay', () => {
|
||||
it('uses certificate-specific copy while keeping strict verification', () => {
|
||||
render(
|
||||
<BrowserLoadFailureOverlay
|
||||
loadError={{
|
||||
code: -202,
|
||||
description: 'ERR_CERT_AUTHORITY_INVALID',
|
||||
validatedUrl: 'https://localhost:3443/app'
|
||||
}}
|
||||
externalUrl="https://localhost:3443/app"
|
||||
currentUrl="https://localhost:3443/app"
|
||||
httpsRecoveryUrl={null}
|
||||
{...callbacks}
|
||||
/>
|
||||
)
|
||||
|
||||
expect(screen.getByText("Connection isn't secure")).toBeInTheDocument()
|
||||
expect(
|
||||
screen.getByText(
|
||||
"Orca doesn't trust the authority that issued the certificate for localhost:3443."
|
||||
)
|
||||
).toBeInTheDocument()
|
||||
expect(screen.queryByRole('button', { name: 'Proceed Anyway (Unsafe)' })).toBeNull()
|
||||
expect(screen.queryByText(/make sure the server is running/i)).not.toBeInTheDocument()
|
||||
})
|
||||
|
||||
it('keeps restored certificate errors accurate without allowing approval', () => {
|
||||
render(
|
||||
<BrowserLoadFailureOverlay
|
||||
loadError={{
|
||||
code: -200,
|
||||
description: 'ERR_CERT_COMMON_NAME_INVALID',
|
||||
validatedUrl: 'https://localhost:3443/'
|
||||
}}
|
||||
externalUrl={null}
|
||||
currentUrl="https://localhost:3443/"
|
||||
httpsRecoveryUrl={null}
|
||||
{...callbacks}
|
||||
/>
|
||||
)
|
||||
|
||||
expect(screen.getByText("The certificate doesn't match localhost:3443.")).toBeInTheDocument()
|
||||
expect(screen.queryByRole('button', { name: 'Proceed Anyway (Unsafe)' })).toBeNull()
|
||||
expect(screen.getByRole('button', { name: 'Retry' })).toBeEnabled()
|
||||
expect(screen.getByRole('button', { name: 'Copy Address' })).toBeEnabled()
|
||||
})
|
||||
|
||||
it('offers HTTPS recovery only for an eligible failed HTTP address', () => {
|
||||
const { rerender } = render(
|
||||
<BrowserLoadFailureOverlay
|
||||
loadError={{
|
||||
code: -102,
|
||||
description: 'ERR_CONNECTION_REFUSED',
|
||||
validatedUrl: 'http://localhost:3000/app'
|
||||
}}
|
||||
externalUrl="http://localhost:3000/app"
|
||||
currentUrl="http://localhost:3000/app"
|
||||
httpsRecoveryUrl="https://localhost:3000/app"
|
||||
{...callbacks}
|
||||
/>
|
||||
)
|
||||
|
||||
fireEvent.click(screen.getByRole('button', { name: 'Try HTTPS' }))
|
||||
expect(callbacks.onTryHttps).toHaveBeenCalledWith('https://localhost:3000/app')
|
||||
|
||||
rerender(
|
||||
<BrowserLoadFailureOverlay
|
||||
loadError={{
|
||||
code: -102,
|
||||
description: 'ERR_CONNECTION_REFUSED',
|
||||
validatedUrl: 'https://localhost:3000/app'
|
||||
}}
|
||||
externalUrl="https://localhost:3000/app"
|
||||
currentUrl="https://localhost:3000/app"
|
||||
httpsRecoveryUrl={null}
|
||||
{...callbacks}
|
||||
/>
|
||||
)
|
||||
expect(screen.queryByRole('button', { name: 'Try HTTPS' })).toBeNull()
|
||||
})
|
||||
|
||||
it('hides Open Externally and works without an external handler', () => {
|
||||
render(
|
||||
<BrowserLoadFailureOverlay
|
||||
loadError={{
|
||||
code: -202,
|
||||
description: 'ERR_CERT_AUTHORITY_INVALID',
|
||||
validatedUrl: 'https://localhost:3443/'
|
||||
}}
|
||||
currentUrl="https://localhost:3443/"
|
||||
httpsRecoveryUrl={null}
|
||||
onRetry={callbacks.onRetry}
|
||||
onTryHttps={callbacks.onTryHttps}
|
||||
onCopy={callbacks.onCopy}
|
||||
/>
|
||||
)
|
||||
|
||||
// externalUrl / onOpenExternal omitted (e.g. a remote loopback failure):
|
||||
// the action is absent and the overlay still renders its other recovery UI.
|
||||
expect(screen.queryByRole('button', { name: 'Open Externally' })).toBeNull()
|
||||
expect(screen.getByRole('button', { name: 'Retry' })).toBeEnabled()
|
||||
expect(screen.getByRole('button', { name: 'Copy Address' })).toBeEnabled()
|
||||
})
|
||||
|
||||
it('does not show local-certificate guidance for a public-host failure', () => {
|
||||
render(
|
||||
<BrowserLoadFailureOverlay
|
||||
loadError={{
|
||||
code: -202,
|
||||
description: 'ERR_CERT_AUTHORITY_INVALID',
|
||||
validatedUrl: 'https://example.com/'
|
||||
}}
|
||||
externalUrl="https://example.com/"
|
||||
currentUrl="https://example.com/"
|
||||
httpsRecoveryUrl={null}
|
||||
{...callbacks}
|
||||
/>
|
||||
)
|
||||
|
||||
expect(screen.queryByText(/use a trusted local certificate/i)).not.toBeInTheDocument()
|
||||
})
|
||||
|
||||
it('offers approval only for a matching live challenge', () => {
|
||||
const { rerender } = render(
|
||||
<BrowserLoadFailureOverlay
|
||||
loadError={{
|
||||
code: -202,
|
||||
description: 'ERR_CERT_AUTHORITY_INVALID',
|
||||
validatedUrl: 'https://localhost:3443/app'
|
||||
}}
|
||||
externalUrl={null}
|
||||
currentUrl="https://localhost:3443/app"
|
||||
httpsRecoveryUrl={null}
|
||||
certificateFailure={certificateFailure}
|
||||
expectedBrowserPageId="page-1"
|
||||
{...callbacks}
|
||||
/>
|
||||
)
|
||||
|
||||
expect(screen.getByRole('button', { name: 'Proceed Anyway (Unsafe)' })).toBeEnabled()
|
||||
|
||||
rerender(
|
||||
<BrowserLoadFailureOverlay
|
||||
loadError={{
|
||||
code: -1,
|
||||
description: 'ERR_FAILED',
|
||||
validatedUrl: 'https://localhost:3443/app'
|
||||
}}
|
||||
externalUrl={null}
|
||||
currentUrl="https://localhost:3443/app"
|
||||
httpsRecoveryUrl={null}
|
||||
certificateFailure={certificateFailure}
|
||||
expectedBrowserPageId="page-1"
|
||||
{...callbacks}
|
||||
/>
|
||||
)
|
||||
expect(screen.getByText("Connection isn't secure")).toBeInTheDocument()
|
||||
expect(screen.getByRole('button', { name: 'Proceed Anyway (Unsafe)' })).toBeEnabled()
|
||||
|
||||
rerender(
|
||||
<BrowserLoadFailureOverlay
|
||||
loadError={{
|
||||
code: -202,
|
||||
description: 'ERR_CERT_AUTHORITY_INVALID',
|
||||
validatedUrl: 'https://localhost:3444/app'
|
||||
}}
|
||||
externalUrl={null}
|
||||
currentUrl="https://localhost:3444/app"
|
||||
httpsRecoveryUrl={null}
|
||||
certificateFailure={certificateFailure}
|
||||
expectedBrowserPageId="page-1"
|
||||
{...callbacks}
|
||||
/>
|
||||
)
|
||||
expect(screen.queryByRole('button', { name: 'Proceed Anyway (Unsafe)' })).toBeNull()
|
||||
|
||||
rerender(
|
||||
<BrowserLoadFailureOverlay
|
||||
loadError={{
|
||||
code: -202,
|
||||
description: 'ERR_CERT_AUTHORITY_INVALID',
|
||||
validatedUrl: 'https://localhost:3443/app'
|
||||
}}
|
||||
externalUrl={null}
|
||||
currentUrl="https://localhost:3443/app"
|
||||
httpsRecoveryUrl={null}
|
||||
certificateFailure={certificateFailure}
|
||||
expectedBrowserPageId="other-page"
|
||||
{...callbacks}
|
||||
/>
|
||||
)
|
||||
expect(screen.queryByRole('button', { name: 'Proceed Anyway (Unsafe)' })).toBeNull()
|
||||
})
|
||||
|
||||
it('disables every action immediately and delays connecting feedback', async () => {
|
||||
vi.useFakeTimers()
|
||||
let resolveProceed: ((result: { ok: true }) => void) | null = null
|
||||
callbacks.onProceedCertificate.mockReturnValue(
|
||||
new Promise((resolve) => {
|
||||
resolveProceed = resolve
|
||||
})
|
||||
)
|
||||
const { rerender } = render(
|
||||
<BrowserLoadFailureOverlay
|
||||
loadError={{
|
||||
code: -202,
|
||||
description: 'ERR_CERT_AUTHORITY_INVALID',
|
||||
validatedUrl: 'https://localhost:3443/app'
|
||||
}}
|
||||
externalUrl="https://localhost:3443/app"
|
||||
currentUrl="https://localhost:3443/app"
|
||||
httpsRecoveryUrl={null}
|
||||
certificateFailure={certificateFailure}
|
||||
expectedBrowserPageId="page-1"
|
||||
{...callbacks}
|
||||
/>
|
||||
)
|
||||
|
||||
fireEvent.click(screen.getByRole('button', { name: 'Proceed Anyway (Unsafe)' }))
|
||||
expect(callbacks.onProceedCertificate).toHaveBeenCalledWith('challenge-1')
|
||||
for (const name of ['Proceed Anyway (Unsafe)', 'Open Externally', 'Retry', 'Copy Address']) {
|
||||
expect(screen.getByRole('button', { name })).toBeDisabled()
|
||||
}
|
||||
expect(screen.queryByText('Connecting…')).toBeNull()
|
||||
|
||||
act(() => vi.advanceTimersByTime(199))
|
||||
expect(screen.queryByText('Connecting…')).toBeNull()
|
||||
act(() => vi.advanceTimersByTime(1))
|
||||
expect(screen.getByRole('button', { name: 'Connecting…' })).toBeDisabled()
|
||||
|
||||
await act(async () => resolveProceed?.({ ok: true }))
|
||||
rerender(
|
||||
<BrowserLoadFailureOverlay
|
||||
loadError={{
|
||||
code: -202,
|
||||
description: 'ERR_CERT_AUTHORITY_INVALID',
|
||||
validatedUrl: 'https://localhost:3443/app'
|
||||
}}
|
||||
externalUrl="https://localhost:3443/app"
|
||||
currentUrl="https://localhost:3443/app"
|
||||
httpsRecoveryUrl={null}
|
||||
certificateFailure={null}
|
||||
expectedBrowserPageId="page-1"
|
||||
{...callbacks}
|
||||
/>
|
||||
)
|
||||
expect(screen.queryByRole('button', { name: 'Proceed Anyway (Unsafe)' })).toBeNull()
|
||||
expect(screen.getByRole('button', { name: 'Retry' })).toBeEnabled()
|
||||
})
|
||||
|
||||
it('recovers from typed approval failures and resets for a new challenge', async () => {
|
||||
callbacks.onProceedCertificate.mockResolvedValue({ ok: false, reason: 'expired' })
|
||||
const props = {
|
||||
loadError: {
|
||||
code: -202,
|
||||
description: 'ERR_CERT_AUTHORITY_INVALID',
|
||||
validatedUrl: 'https://localhost:3443/app'
|
||||
},
|
||||
externalUrl: null,
|
||||
currentUrl: 'https://localhost:3443/app',
|
||||
httpsRecoveryUrl: null,
|
||||
expectedBrowserPageId: 'page-1',
|
||||
...callbacks
|
||||
}
|
||||
const { rerender } = render(
|
||||
<BrowserLoadFailureOverlay {...props} certificateFailure={certificateFailure} />
|
||||
)
|
||||
|
||||
fireEvent.click(screen.getByRole('button', { name: 'Proceed Anyway (Unsafe)' }))
|
||||
await waitFor(() =>
|
||||
expect(screen.getByRole('alert')).toHaveTextContent(/certificate approval expired/i)
|
||||
)
|
||||
expect(screen.getByRole('button', { name: 'Retry' })).toBeEnabled()
|
||||
|
||||
callbacks.onProceedCertificate.mockReturnValue(new Promise(() => {}))
|
||||
fireEvent.click(screen.getByRole('button', { name: 'Proceed Anyway (Unsafe)' }))
|
||||
expect(screen.getByRole('button', { name: 'Retry' })).toBeDisabled()
|
||||
rerender(
|
||||
<BrowserLoadFailureOverlay
|
||||
{...props}
|
||||
certificateFailure={{ ...certificateFailure, challengeId: 'challenge-2' }}
|
||||
/>
|
||||
)
|
||||
expect(screen.getByRole('button', { name: 'Proceed Anyway (Unsafe)' })).toBeEnabled()
|
||||
expect(screen.queryByRole('alert')).toBeNull()
|
||||
})
|
||||
})
|
||||
@@ -0,0 +1,340 @@
|
||||
import { useEffect, useRef, useState } from 'react'
|
||||
import { Copy, ExternalLink, Globe, Loader2, RefreshCw, ShieldAlert } from 'lucide-react'
|
||||
|
||||
import { Button } from '@/components/ui/button'
|
||||
import { translate } from '@/i18n/i18n'
|
||||
import type {
|
||||
BrowserCertificateFailure,
|
||||
BrowserCertificateProceedFailureReason,
|
||||
BrowserCertificateProceedResult,
|
||||
BrowserLoadError
|
||||
} from '../../../../shared/types'
|
||||
import { isEligibleLocalCertificateHost } from '../../../../shared/browser-url'
|
||||
import {
|
||||
formatLoadFailureDescription,
|
||||
formatLoadFailureRecoveryHint,
|
||||
isCertificateLoadError,
|
||||
type LoadFailureMeta
|
||||
} from './browser-notices'
|
||||
|
||||
type BrowserLoadFailureOverlayProps = {
|
||||
loadError: BrowserLoadError
|
||||
externalUrl?: string | null
|
||||
currentUrl: string
|
||||
httpsRecoveryUrl: string | null
|
||||
onRetry: () => void
|
||||
onTryHttps: (url: string) => void
|
||||
onCopy: (url: string) => void
|
||||
onOpenExternal?: (url: string) => void
|
||||
certificateFailure?: BrowserCertificateFailure | null
|
||||
expectedBrowserPageId?: string | null
|
||||
onProceedCertificate?: (challengeId: string) => Promise<BrowserCertificateProceedResult>
|
||||
}
|
||||
|
||||
type CertificateProceedAttempt = {
|
||||
challengeId: string
|
||||
state: 'submitting' | 'failed'
|
||||
showConnecting: boolean
|
||||
reason?: BrowserCertificateProceedFailureReason | 'request-failed'
|
||||
}
|
||||
|
||||
function getLoadErrorMetadata(loadError: BrowserLoadError): LoadFailureMeta {
|
||||
try {
|
||||
const parsed = new URL(loadError.validatedUrl)
|
||||
return {
|
||||
host: parsed.host || null,
|
||||
isLocalhostLike:
|
||||
parsed.hostname === '0.0.0.0' || isEligibleLocalCertificateHost(parsed.hostname)
|
||||
}
|
||||
} catch {
|
||||
return { host: null, isLocalhostLike: false }
|
||||
}
|
||||
}
|
||||
|
||||
function normalizeCertificateError(error: string): string {
|
||||
return error
|
||||
.trim()
|
||||
.replace(/^net::/i, '')
|
||||
.toUpperCase()
|
||||
}
|
||||
|
||||
function getMatchingCertificateFailure(args: {
|
||||
loadError: BrowserLoadError
|
||||
certificateFailure?: BrowserCertificateFailure | null
|
||||
expectedBrowserPageId?: string | null
|
||||
canProceed: boolean
|
||||
}): BrowserCertificateFailure | null {
|
||||
const { loadError, certificateFailure, expectedBrowserPageId, canProceed } = args
|
||||
const errorMatchesChallenge = Boolean(
|
||||
certificateFailure &&
|
||||
(loadError.code === -1 ||
|
||||
(loadError.code === certificateFailure.errorCode &&
|
||||
normalizeCertificateError(certificateFailure.error) ===
|
||||
normalizeCertificateError(loadError.description)))
|
||||
)
|
||||
if (
|
||||
!canProceed ||
|
||||
!certificateFailure?.canProceed ||
|
||||
!expectedBrowserPageId ||
|
||||
certificateFailure.browserPageId !== expectedBrowserPageId ||
|
||||
certificateFailure.errorCode !== -202 ||
|
||||
!errorMatchesChallenge
|
||||
) {
|
||||
return null
|
||||
}
|
||||
try {
|
||||
return new URL(loadError.validatedUrl).origin === certificateFailure.origin
|
||||
? certificateFailure
|
||||
: null
|
||||
} catch {
|
||||
return null
|
||||
}
|
||||
}
|
||||
|
||||
function formatCertificateProceedFailure(
|
||||
reason: BrowserCertificateProceedFailureReason | 'request-failed'
|
||||
): string {
|
||||
if (reason === 'expired') {
|
||||
return translate(
|
||||
'browser.loadFailure.certificateChallengeExpired',
|
||||
'This certificate approval expired. Retry the page to request a new one.'
|
||||
)
|
||||
}
|
||||
if (reason === 'changed' || reason === 'navigated') {
|
||||
return translate(
|
||||
'browser.loadFailure.certificateChallengeChanged',
|
||||
'The certificate request changed. Retry the page and review the new warning.'
|
||||
)
|
||||
}
|
||||
if (reason === 'request-failed') {
|
||||
return translate(
|
||||
'browser.loadFailure.certificateProceedFailed',
|
||||
'Orca could not approve this certificate request. Retry the page and try again.'
|
||||
)
|
||||
}
|
||||
return translate(
|
||||
'browser.loadFailure.certificateChallengeUnavailable',
|
||||
'This certificate request is no longer available. Retry the page to request a new one.'
|
||||
)
|
||||
}
|
||||
|
||||
export function BrowserLoadFailureOverlay({
|
||||
loadError,
|
||||
externalUrl,
|
||||
currentUrl,
|
||||
httpsRecoveryUrl,
|
||||
onRetry,
|
||||
onTryHttps,
|
||||
onCopy,
|
||||
onOpenExternal,
|
||||
certificateFailure,
|
||||
expectedBrowserPageId,
|
||||
onProceedCertificate
|
||||
}: BrowserLoadFailureOverlayProps): React.JSX.Element {
|
||||
const connectingTimerRef = useRef<{
|
||||
challengeId: string
|
||||
timer: ReturnType<typeof setTimeout>
|
||||
} | null>(null)
|
||||
const [proceedAttempt, setProceedAttempt] = useState<CertificateProceedAttempt | null>(null)
|
||||
const matchingCertificateFailure = getMatchingCertificateFailure({
|
||||
loadError,
|
||||
certificateFailure,
|
||||
expectedBrowserPageId,
|
||||
canProceed: Boolean(onProceedCertificate)
|
||||
})
|
||||
// Why: Chromium's error-page fallback can replace the diagnostic code with
|
||||
// -1 after main has already captured an exact live certificate challenge.
|
||||
const presentationLoadError =
|
||||
matchingCertificateFailure && loadError.code === -1
|
||||
? {
|
||||
...loadError,
|
||||
code: matchingCertificateFailure.errorCode ?? loadError.code,
|
||||
description: matchingCertificateFailure.error
|
||||
}
|
||||
: loadError
|
||||
const meta = getLoadErrorMetadata(presentationLoadError)
|
||||
const certificateError = isCertificateLoadError(presentationLoadError)
|
||||
const recoveryHint = formatLoadFailureRecoveryHint(meta, presentationLoadError)
|
||||
const activeProceedAttempt =
|
||||
proceedAttempt?.challengeId === matchingCertificateFailure?.challengeId ? proceedAttempt : null
|
||||
const actionsDisabled = activeProceedAttempt?.state === 'submitting'
|
||||
|
||||
useEffect(() => {
|
||||
return () => {
|
||||
if (connectingTimerRef.current) {
|
||||
clearTimeout(connectingTimerRef.current.timer)
|
||||
connectingTimerRef.current = null
|
||||
}
|
||||
}
|
||||
}, [matchingCertificateFailure?.challengeId])
|
||||
|
||||
const proceedCertificate = (): void => {
|
||||
if (!matchingCertificateFailure || !onProceedCertificate || actionsDisabled) {
|
||||
return
|
||||
}
|
||||
const challengeId = matchingCertificateFailure.challengeId
|
||||
setProceedAttempt({ challengeId, state: 'submitting', showConnecting: false })
|
||||
connectingTimerRef.current = {
|
||||
challengeId,
|
||||
timer: setTimeout(() => {
|
||||
setProceedAttempt((current) =>
|
||||
current?.challengeId === challengeId && current.state === 'submitting'
|
||||
? { ...current, showConnecting: true }
|
||||
: current
|
||||
)
|
||||
}, 200)
|
||||
}
|
||||
void onProceedCertificate(challengeId)
|
||||
.then((result) => {
|
||||
if (connectingTimerRef.current?.challengeId === challengeId) {
|
||||
clearTimeout(connectingTimerRef.current.timer)
|
||||
connectingTimerRef.current = null
|
||||
}
|
||||
if (!result.ok) {
|
||||
setProceedAttempt((current) =>
|
||||
current?.challengeId === challengeId
|
||||
? {
|
||||
challengeId,
|
||||
state: 'failed',
|
||||
showConnecting: false,
|
||||
reason: result.reason
|
||||
}
|
||||
: current
|
||||
)
|
||||
}
|
||||
})
|
||||
.catch(() => {
|
||||
if (connectingTimerRef.current?.challengeId === challengeId) {
|
||||
clearTimeout(connectingTimerRef.current.timer)
|
||||
connectingTimerRef.current = null
|
||||
}
|
||||
setProceedAttempt((current) =>
|
||||
current?.challengeId === challengeId
|
||||
? {
|
||||
challengeId,
|
||||
state: 'failed',
|
||||
showConnecting: false,
|
||||
reason: 'request-failed'
|
||||
}
|
||||
: current
|
||||
)
|
||||
})
|
||||
}
|
||||
const retryButton = (
|
||||
<Button
|
||||
size="sm"
|
||||
variant={certificateError && !externalUrl ? 'default' : 'outline'}
|
||||
className="h-9 gap-2 px-3"
|
||||
disabled={actionsDisabled}
|
||||
onClick={onRetry}
|
||||
>
|
||||
<RefreshCw className="size-4" />
|
||||
{translate('browser.loadFailure.retry', 'Retry')}
|
||||
</Button>
|
||||
)
|
||||
const copyButton = (
|
||||
<Button
|
||||
size="sm"
|
||||
variant="ghost"
|
||||
className="h-9 gap-2 px-3"
|
||||
disabled={actionsDisabled}
|
||||
onClick={() => onCopy(currentUrl)}
|
||||
>
|
||||
<Copy className="size-4" />
|
||||
{translate('browser.loadFailure.copyAddress', 'Copy Address')}
|
||||
</Button>
|
||||
)
|
||||
const externalButton =
|
||||
externalUrl && onOpenExternal ? (
|
||||
<Button
|
||||
size="sm"
|
||||
variant={certificateError ? 'default' : 'ghost'}
|
||||
className="h-9 gap-2 px-3"
|
||||
disabled={actionsDisabled}
|
||||
onClick={() => onOpenExternal(externalUrl)}
|
||||
>
|
||||
<ExternalLink className="size-4" />
|
||||
{translate('browser.loadFailure.openExternally', 'Open Externally')}
|
||||
</Button>
|
||||
) : null
|
||||
|
||||
return (
|
||||
<div className="absolute inset-0 z-20 flex items-center justify-center bg-background px-6">
|
||||
<div aria-live="polite" className="flex max-w-lg flex-col items-center px-8 py-8 text-center">
|
||||
<div className="mb-4 rounded-full border border-border bg-muted p-3 text-muted-foreground">
|
||||
{certificateError ? <ShieldAlert className="size-5" /> : <Globe className="size-5" />}
|
||||
</div>
|
||||
<h2 className="text-base font-semibold text-foreground">
|
||||
{certificateError
|
||||
? translate('browser.loadFailure.connectionNotSecure', "Connection isn't secure")
|
||||
: meta.host
|
||||
? translate('browser.loadFailure.cantReachHost', "Can't reach {{value0}}", {
|
||||
value0: meta.host
|
||||
})
|
||||
: translate('browser.loadFailure.cantLoadPage', "Can't load this page")}
|
||||
</h2>
|
||||
<p className="mt-2 text-sm text-muted-foreground">
|
||||
{formatLoadFailureDescription(presentationLoadError, meta)}
|
||||
</p>
|
||||
{certificateError && meta.isLocalhostLike ? (
|
||||
<p className="mt-2 text-xs text-muted-foreground">
|
||||
{translate(
|
||||
'browser.loadFailure.trustedCertificateGuidance',
|
||||
'For local development, use a trusted local certificate when possible.'
|
||||
)}
|
||||
</p>
|
||||
) : null}
|
||||
{recoveryHint ? <p className="mt-2 text-xs text-muted-foreground">{recoveryHint}</p> : null}
|
||||
{activeProceedAttempt?.state === 'failed' && activeProceedAttempt.reason ? (
|
||||
<p role="alert" className="mt-3 text-xs text-destructive">
|
||||
{formatCertificateProceedFailure(activeProceedAttempt.reason)}
|
||||
</p>
|
||||
) : null}
|
||||
<div className="mt-5 flex flex-wrap items-center justify-center gap-2">
|
||||
{certificateError ? (
|
||||
<>
|
||||
{externalButton}
|
||||
{retryButton}
|
||||
{copyButton}
|
||||
{matchingCertificateFailure ? (
|
||||
<Button
|
||||
size="sm"
|
||||
variant="outline"
|
||||
className="h-9 w-48 gap-2 px-3"
|
||||
disabled={actionsDisabled}
|
||||
onClick={proceedCertificate}
|
||||
>
|
||||
{activeProceedAttempt?.state === 'submitting' &&
|
||||
activeProceedAttempt.showConnecting ? (
|
||||
<>
|
||||
<Loader2 className="size-4 animate-spin" />
|
||||
{translate('browser.loadFailure.connecting', 'Connecting…')}
|
||||
</>
|
||||
) : (
|
||||
translate('browser.loadFailure.proceedUnsafe', 'Proceed Anyway (Unsafe)')
|
||||
)}
|
||||
</Button>
|
||||
) : null}
|
||||
</>
|
||||
) : (
|
||||
<>
|
||||
{httpsRecoveryUrl ? (
|
||||
<Button
|
||||
size="sm"
|
||||
className="h-9 gap-2 px-3"
|
||||
disabled={actionsDisabled}
|
||||
onClick={() => onTryHttps(httpsRecoveryUrl)}
|
||||
>
|
||||
{translate('browser.loadFailure.tryHttps', 'Try HTTPS')}
|
||||
</Button>
|
||||
) : null}
|
||||
{retryButton}
|
||||
{copyButton}
|
||||
{externalButton}
|
||||
</>
|
||||
)}
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
@@ -5,7 +5,8 @@ import {
|
||||
formatLoadFailureDescription,
|
||||
formatLoadFailureRecoveryHint,
|
||||
formatPermissionNotice,
|
||||
formatPopupNotice
|
||||
formatPopupNotice,
|
||||
isCertificateLoadError
|
||||
} from './browser-notices'
|
||||
|
||||
describe('browser notice formatting', () => {
|
||||
@@ -114,4 +115,29 @@ describe('browser notice formatting', () => {
|
||||
})
|
||||
).toBeNull()
|
||||
})
|
||||
|
||||
it('formats certificate failures without local-server recovery advice', () => {
|
||||
const meta = { host: 'localhost:3443', isLocalhostLike: true }
|
||||
const loadError = (code: number) => ({
|
||||
code,
|
||||
description: 'certificate error',
|
||||
validatedUrl: 'https://localhost:3443/'
|
||||
})
|
||||
|
||||
expect(formatLoadFailureDescription(loadError(-200), meta)).toBe(
|
||||
"The certificate doesn't match localhost:3443."
|
||||
)
|
||||
expect(formatLoadFailureDescription(loadError(-201), meta)).toBe(
|
||||
"The certificate for localhost:3443 isn't valid at the current date and time."
|
||||
)
|
||||
expect(formatLoadFailureDescription(loadError(-202), meta)).toBe(
|
||||
"Orca doesn't trust the authority that issued the certificate for localhost:3443."
|
||||
)
|
||||
expect(formatLoadFailureDescription(loadError(-208), meta)).toBe(
|
||||
"Orca couldn't verify the certificate for localhost:3443."
|
||||
)
|
||||
expect(isCertificateLoadError(loadError(-219))).toBe(true)
|
||||
expect(isCertificateLoadError(loadError(-215))).toBe(false)
|
||||
expect(formatLoadFailureRecoveryHint(meta, loadError(-202))).toBeNull()
|
||||
})
|
||||
})
|
||||
|
||||
@@ -4,8 +4,10 @@ import type {
|
||||
BrowserPopupEvent
|
||||
} from '../../../../shared/browser-guest-events'
|
||||
import type { BrowserLoadError } from '../../../../shared/types'
|
||||
import { isChromiumCertificateErrorCode } from '../../../../shared/browser-certificate-errors'
|
||||
import { translate } from '@/i18n/i18n'
|
||||
|
||||
type LoadFailureMeta = {
|
||||
export type LoadFailureMeta = {
|
||||
host: string | null
|
||||
isLocalhostLike: boolean
|
||||
}
|
||||
@@ -73,6 +75,35 @@ export function formatLoadFailureDescription(
|
||||
if (!loadError) {
|
||||
return 'The page did not respond.'
|
||||
}
|
||||
if (isChromiumCertificateErrorCode(loadError.code)) {
|
||||
const host = meta.host ?? 'this address'
|
||||
if (loadError.code === -200) {
|
||||
return translate(
|
||||
'browser.loadFailure.certificateNameMismatch',
|
||||
"The certificate doesn't match {{value0}}.",
|
||||
{ value0: host }
|
||||
)
|
||||
}
|
||||
if (loadError.code === -201) {
|
||||
return translate(
|
||||
'browser.loadFailure.certificateDateInvalid',
|
||||
"The certificate for {{value0}} isn't valid at the current date and time.",
|
||||
{ value0: host }
|
||||
)
|
||||
}
|
||||
if (loadError.code === -202) {
|
||||
return translate(
|
||||
'browser.loadFailure.certificateAuthorityInvalid',
|
||||
"Orca doesn't trust the authority that issued the certificate for {{value0}}.",
|
||||
{ value0: host }
|
||||
)
|
||||
}
|
||||
return translate(
|
||||
'browser.loadFailure.certificateVerificationFailed',
|
||||
"Orca couldn't verify the certificate for {{value0}}.",
|
||||
{ value0: host }
|
||||
)
|
||||
}
|
||||
if (meta.isLocalhostLike) {
|
||||
return "We couldn't connect to your local server."
|
||||
}
|
||||
@@ -82,9 +113,16 @@ export function formatLoadFailureDescription(
|
||||
return "We couldn't connect to this page."
|
||||
}
|
||||
|
||||
export function formatLoadFailureRecoveryHint(meta: LoadFailureMeta): string | null {
|
||||
if (!meta.isLocalhostLike) {
|
||||
export function formatLoadFailureRecoveryHint(
|
||||
meta: LoadFailureMeta,
|
||||
loadError?: BrowserLoadErrorLike
|
||||
): string | null {
|
||||
if (!meta.isLocalhostLike || (loadError && isChromiumCertificateErrorCode(loadError.code))) {
|
||||
return null
|
||||
}
|
||||
return 'If this should be a local app, make sure the server is running and listening on the expected port.'
|
||||
}
|
||||
|
||||
export function isCertificateLoadError(loadError: BrowserLoadErrorLike): boolean {
|
||||
return Boolean(loadError && isChromiumCertificateErrorCode(loadError.code))
|
||||
}
|
||||
|
||||
@@ -20,6 +20,7 @@ import {
|
||||
getZoomedImageLayoutSize
|
||||
} from './image-viewer-zoom'
|
||||
import { translate } from '@/i18n/i18n'
|
||||
import { buildImageDataUri } from '../../../../shared/image-data-uri'
|
||||
|
||||
const FALLBACK_IMAGE_MIME_TYPE = 'image/png'
|
||||
|
||||
@@ -59,8 +60,8 @@ export default function ImageViewer({
|
||||
const isPdf = mimeType === 'application/pdf'
|
||||
const isIntrinsicLayout = layout === 'intrinsic'
|
||||
const previewSrc = useMemo(
|
||||
() => (cleanedContent && !isPdf ? `data:${mimeType};base64,${cleanedContent}` : null),
|
||||
[cleanedContent, isPdf, mimeType]
|
||||
() => buildImageDataUri(mimeType, cleanedContent),
|
||||
[cleanedContent, mimeType]
|
||||
)
|
||||
const imageError = previewSrc !== null && failedPreviewSrc === previewSrc
|
||||
const estimatedSize = useMemo(() => {
|
||||
|
||||
@@ -0,0 +1,107 @@
|
||||
// @vitest-environment happy-dom
|
||||
|
||||
import { act } from 'react'
|
||||
import { createRoot, type Root } from 'react-dom/client'
|
||||
import { afterEach, describe, expect, it } from 'vitest'
|
||||
import { GitHubUserAvatar, resolveGitHubUserAvatarSrc } from './github-user-avatar'
|
||||
|
||||
function render(node: React.JSX.Element): { root: Root; container: HTMLDivElement } {
|
||||
const container = document.createElement('div')
|
||||
document.body.appendChild(container)
|
||||
const root = createRoot(container)
|
||||
act(() => {
|
||||
root.render(node)
|
||||
})
|
||||
return { root, container }
|
||||
}
|
||||
|
||||
describe('GitHubUserAvatar', () => {
|
||||
let root: Root | null = null
|
||||
let container: HTMLDivElement | null = null
|
||||
|
||||
afterEach(() => {
|
||||
act(() => root?.unmount())
|
||||
container?.remove()
|
||||
root = null
|
||||
container = null
|
||||
})
|
||||
|
||||
it('renders the API avatar_url when provided (works for github.com and GHE)', () => {
|
||||
const url = 'https://avatars.example.com/u/42?u=hash&v=4'
|
||||
;({ root, container } = render(<GitHubUserAvatar login="enterprise-user" avatarUrl={url} />))
|
||||
const img = container.querySelector('img')
|
||||
expect(img?.getAttribute('src')).toBe(url)
|
||||
})
|
||||
|
||||
it('falls back to the login URL when no avatar_url is available', () => {
|
||||
;({ root, container } = render(<GitHubUserAvatar login="octocat" />))
|
||||
const img = container.querySelector('img')
|
||||
expect(img?.getAttribute('src')).toBe('https://github.com/octocat.png?size=64')
|
||||
})
|
||||
|
||||
it('degrades to an initials placeholder when the image fails to load (GHE 404)', () => {
|
||||
;({ root, container } = render(
|
||||
<GitHubUserAvatar login="enterprise-user" name="Ada Lovelace" />
|
||||
))
|
||||
const img = container.querySelector('img')
|
||||
expect(img).not.toBeNull()
|
||||
act(() => {
|
||||
img?.dispatchEvent(new Event('error'))
|
||||
})
|
||||
expect(container.querySelector('img')).toBeNull()
|
||||
expect(container.textContent).toBe('AL')
|
||||
})
|
||||
|
||||
it('skips leading non-BMP chars so initials never render a broken surrogate', () => {
|
||||
;({ root, container } = render(<GitHubUserAvatar login="rocketdev" name="🚀 Developer" />))
|
||||
act(() => {
|
||||
container?.querySelector('img')?.dispatchEvent(new Event('error'))
|
||||
})
|
||||
// Emoji word is skipped entirely rather than split into a broken half.
|
||||
expect(container.textContent).toBe('D')
|
||||
})
|
||||
|
||||
it('derives initials from the login when no name is given', () => {
|
||||
;({ root, container } = render(<GitHubUserAvatar login="octocat" />))
|
||||
act(() => {
|
||||
container?.querySelector('img')?.dispatchEvent(new Event('error'))
|
||||
})
|
||||
expect(container.textContent).toBe('OC')
|
||||
})
|
||||
|
||||
it('retries when avatarUrl changes after an earlier src failed (late-arriving avatar)', () => {
|
||||
// Why: PR detail enrichment supplies avatar_url after first paint. A row that
|
||||
// 404s on the early login-based URL must recover once the real URL lands.
|
||||
;({ root, container } = render(<GitHubUserAvatar login="enterprise-user" />))
|
||||
// First src is the login fallback; simulate the GHE 404.
|
||||
act(() => {
|
||||
container?.querySelector('img')?.dispatchEvent(new Event('error'))
|
||||
})
|
||||
expect(container.querySelector('img')).toBeNull()
|
||||
// Enriched avatar_url arrives → component must render the new image, not the
|
||||
// latched placeholder.
|
||||
const url = 'https://avatars.example.com/u/7?v=4'
|
||||
act(() => {
|
||||
root?.render(<GitHubUserAvatar login="enterprise-user" avatarUrl={url} />)
|
||||
})
|
||||
expect(container.querySelector('img')?.getAttribute('src')).toBe(url)
|
||||
})
|
||||
|
||||
it('shows initials immediately when login and avatarUrl are both empty', () => {
|
||||
;({ root, container } = render(<GitHubUserAvatar login="" name="Ada" />))
|
||||
expect(container.querySelector('img')).toBeNull()
|
||||
expect(container.textContent).toBe('AD')
|
||||
})
|
||||
})
|
||||
|
||||
describe('resolveGitHubUserAvatarSrc', () => {
|
||||
it('prefers trimmed API avatar over login.png', () => {
|
||||
expect(resolveGitHubUserAvatarSrc('u', ' https://avatars.example.com/u/1?v=4 ')).toBe(
|
||||
'https://avatars.example.com/u/1?v=4'
|
||||
)
|
||||
})
|
||||
|
||||
it('skips empty login so no github.com/.png request is built', () => {
|
||||
expect(resolveGitHubUserAvatarSrc('', null)).toBeNull()
|
||||
})
|
||||
})
|
||||
@@ -0,0 +1,104 @@
|
||||
import { useState } from 'react'
|
||||
import { cn } from '@/lib/utils'
|
||||
import { githubAvatarUrl } from '@/components/github/github-issue-comment-helpers'
|
||||
|
||||
/**
|
||||
* Build a 1-2 character initials placeholder from a display name or login,
|
||||
* used when no avatar image is available or the image fails to load.
|
||||
*/
|
||||
function initialsFor(login: string, name?: string | null): string {
|
||||
const source = (name?.trim() || login).trim()
|
||||
if (!source) {
|
||||
return '?'
|
||||
}
|
||||
// Iterate by code point (not UTF-16 unit) and keep only letters/digits, so a
|
||||
// display name that leads with an emoji or other non-BMP char yields clean
|
||||
// initials instead of a broken surrogate half. Words that are all symbols are
|
||||
// skipped; an all-symbol name falls back to '?'.
|
||||
const alnum = (word: string): string[] => [...word].filter((ch) => /[\p{L}\p{N}]/u.test(ch))
|
||||
const parts = source.split(/\s+/).filter(Boolean)
|
||||
const letters =
|
||||
parts.length >= 2
|
||||
? parts
|
||||
.map((word) => alnum(word)[0])
|
||||
.filter(Boolean)
|
||||
.slice(0, 2)
|
||||
.join('')
|
||||
: alnum(source).slice(0, 2).join('')
|
||||
return letters.toUpperCase() || '?'
|
||||
}
|
||||
|
||||
/**
|
||||
* Prefer the API `avatar_url`, then the public login.png URL. Empty/whitespace
|
||||
* API values and empty logins never produce a bogus request. See #8784.
|
||||
*/
|
||||
export function resolveGitHubUserAvatarSrc(
|
||||
login: string,
|
||||
avatarUrl?: string | null
|
||||
): string | null {
|
||||
const fromApi = avatarUrl?.trim()
|
||||
if (fromApi) {
|
||||
return fromApi
|
||||
}
|
||||
const trimmedLogin = login.trim()
|
||||
if (!trimmedLogin) {
|
||||
return null
|
||||
}
|
||||
return githubAvatarUrl(trimmedLogin)
|
||||
}
|
||||
|
||||
/**
|
||||
* Avatar for a GitHub user that renders correctly on github.com and GitHub
|
||||
* Enterprise. GHE logins don't exist on github.com, so the login-based
|
||||
* `github.com/{login}.png` URL 404s. We prefer the API-provided `avatarUrl`
|
||||
* and, when it (or the login fallback) fails to load, degrade to an initials
|
||||
* placeholder instead of a broken image. See #8784.
|
||||
*/
|
||||
export function GitHubUserAvatar({
|
||||
login,
|
||||
name,
|
||||
avatarUrl,
|
||||
title,
|
||||
className
|
||||
}: {
|
||||
login: string
|
||||
name?: string | null
|
||||
avatarUrl?: string | null
|
||||
title?: string
|
||||
className?: string
|
||||
}): React.JSX.Element {
|
||||
// Why: track the specific src that failed rather than a boolean. Avatar data
|
||||
// arrives after the first paint (PR detail enrichment), so a row that 404s on
|
||||
// the early login-based URL must retry once the real avatar_url lands — a
|
||||
// latched boolean would keep showing the placeholder forever. See #8784.
|
||||
const [failedSrc, setFailedSrc] = useState<string | null>(null)
|
||||
const src = resolveGitHubUserAvatarSrc(login, avatarUrl)
|
||||
if (src && failedSrc !== src) {
|
||||
return (
|
||||
<img
|
||||
src={src}
|
||||
alt=""
|
||||
loading="lazy"
|
||||
decoding="async"
|
||||
title={title}
|
||||
onError={() => setFailedSrc(src)}
|
||||
className={cn(
|
||||
'shrink-0 rounded-full border border-border/50 bg-muted object-cover',
|
||||
className
|
||||
)}
|
||||
/>
|
||||
)
|
||||
}
|
||||
return (
|
||||
<span
|
||||
title={title}
|
||||
aria-hidden
|
||||
className={cn(
|
||||
'inline-flex shrink-0 items-center justify-center rounded-full border border-border/50 bg-muted text-[10px] font-semibold text-muted-foreground',
|
||||
className
|
||||
)}
|
||||
>
|
||||
{initialsFor(login, name)}
|
||||
</span>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,55 @@
|
||||
/**
|
||||
* Issue #8784 — GHE PR avatars must prefer API avatar_url over github.com/{login}.png.
|
||||
*
|
||||
* Regression guard (was a repro that documented the broken path). After the fix:
|
||||
* - resolveGitHubUserAvatarSrc prefers API URLs
|
||||
* - PullRequestPage author uses authorAvatarUrl via GitHubUserAvatar
|
||||
* - TaskPage ReviewChipAvatar no longer hardcodes github.com login.png
|
||||
*
|
||||
* Re-run:
|
||||
* pnpm exec vitest run --config config/vitest.config.ts \
|
||||
* src/renderer/src/components/github/repro-8784-ghe-avatar-fallback.test.ts
|
||||
*/
|
||||
import { describe, expect, it } from 'vitest'
|
||||
import { readFileSync } from 'node:fs'
|
||||
import { join } from 'node:path'
|
||||
import { githubAvatarUrl } from './github-issue-comment-helpers'
|
||||
import { resolveGitHubUserAvatarSrc } from './github-user-avatar'
|
||||
|
||||
describe('issue #8784 GHE avatar fallback (regression)', () => {
|
||||
it('prefers API avatar_url over login.png (GHE healthy path)', () => {
|
||||
const api = 'https://ghe.example.com/avatars/u/42?v=4'
|
||||
expect(resolveGitHubUserAvatarSrc('enterprise-only-user', api)).toBe(api)
|
||||
})
|
||||
|
||||
it('trims whitespace-only avatarUrl and falls back to login.png for github.com', () => {
|
||||
expect(resolveGitHubUserAvatarSrc('octocat', ' ')).toBe(
|
||||
'https://github.com/octocat.png?size=64'
|
||||
)
|
||||
expect(resolveGitHubUserAvatarSrc('octocat', null)).toBe(githubAvatarUrl('octocat'))
|
||||
})
|
||||
|
||||
it('returns null when neither avatarUrl nor login is usable (no bogus request)', () => {
|
||||
expect(resolveGitHubUserAvatarSrc('', '')).toBeNull()
|
||||
expect(resolveGitHubUserAvatarSrc(' ', null)).toBeNull()
|
||||
})
|
||||
|
||||
it('login-only fallback still hardcodes public github.com png (github.com path)', () => {
|
||||
// Why: github.com users without avatar_url still use this; GHE relies on
|
||||
// enrichment + image onError → initials when this 404s.
|
||||
expect(githubAvatarUrl('corp-user')).toBe('https://github.com/corp-user.png?size=64')
|
||||
})
|
||||
|
||||
it('source routes PR author/reviewer avatars through GitHubUserAvatar + authorAvatarUrl', () => {
|
||||
const prPage = readFileSync(join(__dirname, '../PullRequestPage.tsx'), 'utf8')
|
||||
expect(prPage).toMatch(/GitHubUserAvatar/)
|
||||
expect(prPage).toMatch(/authorAvatarUrl/)
|
||||
// Why: author chip must not ignore API avatar_url and only pass login.
|
||||
expect(prPage).not.toMatch(/githubAvatarUrl\(workItem\.author\)/)
|
||||
|
||||
const taskPage = readFileSync(join(__dirname, '../TaskPage.tsx'), 'utf8')
|
||||
expect(taskPage).toMatch(/GitHubUserAvatar/)
|
||||
// Why: list chip must not hardcode github.com/{login}.png.
|
||||
expect(taskPage).not.toMatch(/github\.com\/\$\{reviewer\.login\}\.png/)
|
||||
})
|
||||
})
|
||||
@@ -23,7 +23,6 @@ export { NATIVE_CHAT_ADVANCE_BUFFER_MS, NATIVE_CHAT_QUESTION_STEP_MS, NATIVE_CHA
|
||||
|
||||
export const NATIVE_CHAT_IMAGE_ATTACHMENT_SETTLE_MS = 300
|
||||
|
||||
|
||||
/** Cancels an in-flight send's pending pty writes (the delayed Enter, and any
|
||||
* later question bodies/Enters). Safe to call after the send completes. */
|
||||
export type NativeChatSendHandle = {
|
||||
|
||||
@@ -12,6 +12,7 @@ import {
|
||||
import { toast } from 'sonner'
|
||||
import type { GlobalSettings, OrcaHooks, ProjectHostSetup, Repo } from '../../../../shared/types'
|
||||
import type { SpeechModelState } from '../../../../shared/speech-types'
|
||||
import type { SkillFreshnessInventory } from '../../../../shared/skill-freshness'
|
||||
import type {
|
||||
SourceControlAiSettings,
|
||||
SourceControlAiSettingsPatch
|
||||
@@ -101,6 +102,7 @@ import {
|
||||
} from '@/hooks/useInstalledAgentSkills'
|
||||
import { useActiveProjectSkillRuntime } from '@/hooks/useActiveProjectSkillRuntime'
|
||||
import { useSkillFreshness } from '@/hooks/useSkillFreshness'
|
||||
import { getSkillFreshnessDisplayStatus } from '@/lib/skill-freshness-display-status'
|
||||
import { deriveNeededSectionIds, getInitialMountedSectionIds } from './settings-load-performance'
|
||||
import { translate } from '@/i18n/i18n'
|
||||
import { getProjectHostSetupProjectionFromState } from '../../store/selectors'
|
||||
@@ -206,9 +208,10 @@ function getSettingsNavGroupDefinitionsForSearch(
|
||||
}
|
||||
|
||||
function getSkillNavInstallStatus(skill: {
|
||||
name: string
|
||||
installed: boolean
|
||||
loading: boolean
|
||||
updateAvailable?: boolean
|
||||
inventory: SkillFreshnessInventory | null
|
||||
}): SettingsNavInstallStatus {
|
||||
if (skill.loading) {
|
||||
return 'checking'
|
||||
@@ -216,7 +219,7 @@ function getSkillNavInstallStatus(skill: {
|
||||
if (!skill.installed) {
|
||||
return 'install'
|
||||
}
|
||||
return skill.updateAvailable ? 'update-available' : 'installed'
|
||||
return getSkillFreshnessDisplayStatus(skill.inventory, skill.name)
|
||||
}
|
||||
|
||||
function hasReadyVoiceModel(
|
||||
@@ -733,16 +736,16 @@ function Settings(): React.JSX.Element {
|
||||
orchestrationSkill
|
||||
const { installed: computerUseSkillInstalled, loading: computerUseSkillLoading } =
|
||||
computerUseSkill
|
||||
const eligibleUpdateSkillNames = skillFreshnessInventory?.eligibleUpdateNames
|
||||
const capabilityInstallStatusBySectionId = useMemo(() => {
|
||||
const eligibleUpdates = new Set(skillFreshnessApplies ? (eligibleUpdateSkillNames ?? []) : [])
|
||||
const applicableFreshnessInventory = skillFreshnessApplies ? skillFreshnessInventory : null
|
||||
const next = new Map<string, SettingsNavInstallStatus>([
|
||||
[
|
||||
'orchestration',
|
||||
getSkillNavInstallStatus({
|
||||
name: ORCHESTRATION_SKILL_NAME,
|
||||
installed: orchestrationSkillInstalled,
|
||||
loading: orchestrationSkillLoading,
|
||||
updateAvailable: eligibleUpdates.has(ORCHESTRATION_SKILL_NAME)
|
||||
inventory: applicableFreshnessInventory
|
||||
})
|
||||
]
|
||||
])
|
||||
@@ -750,9 +753,10 @@ function Settings(): React.JSX.Element {
|
||||
next.set(
|
||||
'computer-use',
|
||||
getSkillNavInstallStatus({
|
||||
name: COMPUTER_USE_SKILL_NAME,
|
||||
installed: computerUseSkillInstalled,
|
||||
loading: computerUseSkillLoading,
|
||||
updateAvailable: eligibleUpdates.has(COMPUTER_USE_SKILL_NAME)
|
||||
inventory: applicableFreshnessInventory
|
||||
})
|
||||
)
|
||||
if (settings) {
|
||||
@@ -770,13 +774,13 @@ function Settings(): React.JSX.Element {
|
||||
}, [
|
||||
computerUseSkillInstalled,
|
||||
computerUseSkillLoading,
|
||||
eligibleUpdateSkillNames,
|
||||
modelStates,
|
||||
orchestrationSkillInstalled,
|
||||
orchestrationSkillLoading,
|
||||
settings,
|
||||
showDesktopOnlySettings,
|
||||
skillFreshnessApplies,
|
||||
skillFreshnessInventory,
|
||||
voiceModelStatesLoading
|
||||
])
|
||||
const navSections = useMemo(
|
||||
|
||||
@@ -62,6 +62,12 @@ function renderSidebar(
|
||||
title: 'Voice',
|
||||
icon: Mic,
|
||||
installStatus: 'installed'
|
||||
},
|
||||
{
|
||||
id: 'computer-use',
|
||||
title: 'Computer Use',
|
||||
icon: Bot,
|
||||
installStatus: 'up-to-date'
|
||||
}
|
||||
]
|
||||
},
|
||||
@@ -114,6 +120,7 @@ describe('SettingsSidebar', () => {
|
||||
|
||||
expect(markup).toContain('Not installed')
|
||||
expect(markup).toContain('Installed')
|
||||
expect(markup).toContain('Up to date')
|
||||
expect(markup).toContain('Optional')
|
||||
})
|
||||
|
||||
|
||||
@@ -155,6 +155,8 @@ export function SettingsSidebar({
|
||||
)
|
||||
case 'installed':
|
||||
return translate('auto.components.settings.AgentSkillSetupPanel.9fcebceb2a', 'Installed')
|
||||
case 'up-to-date':
|
||||
return translate('auto.components.skills.SkillFreshnessStatusPill.upToDate', 'Up to date')
|
||||
case 'update-available':
|
||||
return translate(
|
||||
'auto.components.skills.SkillFreshnessStatusPill.updateAvailable',
|
||||
@@ -167,7 +169,7 @@ export function SettingsSidebar({
|
||||
const installStatusClassName = (status: SettingsNavInstallStatus): string =>
|
||||
cn(
|
||||
'ml-auto shrink-0 rounded-full border px-1.5 py-0.5 text-[10px] font-medium leading-none',
|
||||
status === 'installed'
|
||||
status === 'installed' || status === 'up-to-date'
|
||||
? 'border-status-success-border bg-status-success-background text-status-success'
|
||||
: status === 'update-available'
|
||||
? 'border-amber-500/40 bg-amber-500/10 text-amber-700 dark:text-amber-300'
|
||||
|
||||
@@ -106,6 +106,8 @@ export function ShortcutCommandBlock({
|
||||
/>
|
||||
)
|
||||
|
||||
// Why: ShortcutsPane already filters rows against the global query;
|
||||
// forceVisible skips the re-match here that would hide rows it kept.
|
||||
return (
|
||||
<SearchableSetting
|
||||
title={item.title}
|
||||
@@ -115,6 +117,7 @@ export function ShortcutCommandBlock({
|
||||
{ value0: groupTitle }
|
||||
)}
|
||||
keywords={[...item.searchKeywords]}
|
||||
forceVisible
|
||||
className="group/shortcut flex max-w-none flex-col"
|
||||
>
|
||||
<div className="flex min-h-9 items-center gap-3 rounded-md px-2 py-1 transition-colors hover:bg-accent/40 focus-within:bg-accent/40">
|
||||
|
||||
@@ -2,6 +2,7 @@ import { describe, expect, it } from 'vitest'
|
||||
import type { KeybindingActionId } from '../../../../shared/keybindings'
|
||||
import {
|
||||
SHORTCUT_LOCAL_SEARCH_QUERY_MAX_BYTES,
|
||||
buildShortcutGlobalSearchMatcher,
|
||||
isShortcutLocalSearchQueryTooLarge,
|
||||
matchesShortcutLocalSearch,
|
||||
normalizeShortcutLocalSearchQuery,
|
||||
@@ -52,6 +53,40 @@ describe('ShortcutFilterRail search helpers', () => {
|
||||
expect(normalizeShortcutLocalSearchQuery(query)).toBeNull()
|
||||
})
|
||||
|
||||
it('narrows rows when the global settings query matches specific rows', () => {
|
||||
const settingsRow = createShortcutRow()
|
||||
const worktreeRow: ShortcutRowModel = {
|
||||
...createShortcutRow(),
|
||||
item: {
|
||||
...createShortcutRow().item,
|
||||
id: 'worktree.create' as KeybindingActionId,
|
||||
title: 'Create worktree',
|
||||
searchKeywords: ['worktree', 'create']
|
||||
}
|
||||
}
|
||||
|
||||
const matcher = buildShortcutGlobalSearchMatcher([settingsRow, worktreeRow], 'worktree')
|
||||
|
||||
expect(matcher(settingsRow)).toBe(false)
|
||||
expect(matcher(worktreeRow)).toBe(true)
|
||||
})
|
||||
|
||||
it('keeps every row visible on a pane-title-only global query', () => {
|
||||
const rows = [createShortcutRow()]
|
||||
|
||||
// Mirrors sidebar search selecting the pane with a query that matches only
|
||||
// pane-level metadata (e.g. a localized pane title) and no row metadata.
|
||||
const matcher = buildShortcutGlobalSearchMatcher(rows, '단축키')
|
||||
|
||||
expect(matcher(rows[0])).toBe(true)
|
||||
})
|
||||
|
||||
it('keeps every row visible when the global query is empty', () => {
|
||||
const rows = [createShortcutRow()]
|
||||
|
||||
expect(buildShortcutGlobalSearchMatcher(rows, '')(rows[0])).toBe(true)
|
||||
})
|
||||
|
||||
it('rejects oversized pasted shortcut searches before reading row metadata', () => {
|
||||
const oversizedQuery = 'secret-shortcut-search'.repeat(SHORTCUT_LOCAL_SEARCH_QUERY_MAX_BYTES)
|
||||
const row = {
|
||||
|
||||
@@ -6,7 +6,7 @@ import { cn } from '../../lib/utils'
|
||||
import { Button } from '../ui/button'
|
||||
import { Input } from '../ui/input'
|
||||
import type { ShortcutTerminalStatus } from './shortcut-terminal-status'
|
||||
import type { SettingsSearchEntry } from './settings-search'
|
||||
import { matchesSettingsSearch, type SettingsSearchEntry } from './settings-search'
|
||||
import { translate } from '@/i18n/i18n'
|
||||
|
||||
export type ShortcutFilter = 'all' | 'modified' | 'unassigned' | 'conflicts'
|
||||
@@ -60,6 +60,17 @@ export function getShortcutSearchEntry(row: ShortcutRowModel): SettingsSearchEnt
|
||||
}
|
||||
}
|
||||
|
||||
// Why: a sidebar query can select this pane by title alone while matching zero
|
||||
// rows; that would blank the list, so zero-row queries keep every row visible.
|
||||
export function buildShortcutGlobalSearchMatcher(
|
||||
rows: readonly ShortcutRowModel[],
|
||||
searchQuery: string
|
||||
): (row: ShortcutRowModel) => boolean {
|
||||
const rowMatches = (row: ShortcutRowModel): boolean =>
|
||||
matchesSettingsSearch(searchQuery, getShortcutSearchEntry(row))
|
||||
return rows.some(rowMatches) ? rowMatches : () => true
|
||||
}
|
||||
|
||||
export function matchesShortcutFilter(row: ShortcutRowModel, filter: ShortcutFilter): boolean {
|
||||
switch (filter) {
|
||||
case 'modified':
|
||||
|
||||
@@ -25,7 +25,7 @@ import {
|
||||
sameBindings
|
||||
} from './keybinding-override-edits'
|
||||
import {
|
||||
getShortcutSearchEntry,
|
||||
buildShortcutGlobalSearchMatcher,
|
||||
matchesShortcutFilter,
|
||||
matchesShortcutLocalSearch,
|
||||
normalizeShortcutLocalSearchQuery,
|
||||
@@ -138,9 +138,10 @@ export function ShortcutsPane(): React.JSX.Element {
|
||||
)
|
||||
const shortcutSearchQuery = normalizeShortcutLocalSearchQuery(shortcutQuery)
|
||||
const shortcutRows = shortcutGroups.flatMap((group) => group.rows)
|
||||
const matchesShortcutGlobalSearch = buildShortcutGlobalSearchMatcher(shortcutRows, searchQuery)
|
||||
const matchesShortcutSearch = (row: ShortcutRowsByGroup['rows'][number]): boolean =>
|
||||
shortcutSearchQuery !== null &&
|
||||
matchesSettingsSearch(searchQuery, getShortcutSearchEntry(row)) &&
|
||||
matchesShortcutGlobalSearch(row) &&
|
||||
matchesShortcutLocalSearch(row, shortcutSearchQuery, platform)
|
||||
const baseVisibleRows = shortcutRows.filter((row) => matchesShortcutSearch(row))
|
||||
const filterCounts: Record<ShortcutFilter, number> = {
|
||||
|
||||
@@ -5711,9 +5711,10 @@ const WorktreeList = React.memo(function WorktreeList({
|
||||
groupBy,
|
||||
repos: visibleReposForRows,
|
||||
worktreesByRepo,
|
||||
visibleWorktrees,
|
||||
filterRepoIds
|
||||
})
|
||||
}, [filterRepoIds, groupBy, visibleReposForRows, worktreesByRepo])
|
||||
}, [filterRepoIds, groupBy, visibleReposForRows, visibleWorktrees, worktreesByRepo])
|
||||
const allRepoIds = useMemo(() => repos.map((r) => r.id), [repos])
|
||||
|
||||
// Why: buildRows only needs which creates exist and their repo. Subscribe on a
|
||||
|
||||
@@ -38,6 +38,7 @@ describe('getEmptyProjectPlaceholderRepoIds', () => {
|
||||
groupBy: 'repo',
|
||||
repos: [repo],
|
||||
worktreesByRepo: { [repo.id]: [] },
|
||||
visibleWorktrees: [],
|
||||
filterRepoIds: []
|
||||
})
|
||||
)
|
||||
@@ -51,6 +52,7 @@ describe('getEmptyProjectPlaceholderRepoIds', () => {
|
||||
groupBy: 'repo',
|
||||
repos: [repo],
|
||||
worktreesByRepo: {},
|
||||
visibleWorktrees: [],
|
||||
filterRepoIds: []
|
||||
})
|
||||
)
|
||||
@@ -67,6 +69,7 @@ describe('getEmptyProjectPlaceholderRepoIds', () => {
|
||||
groupBy: 'repo',
|
||||
repos: [selectedRepo, hiddenRepo],
|
||||
worktreesByRepo: { [selectedRepo.id]: [], [hiddenRepo.id]: [] },
|
||||
visibleWorktrees: [],
|
||||
filterRepoIds: [selectedRepo.id]
|
||||
})
|
||||
)
|
||||
@@ -79,6 +82,7 @@ describe('getEmptyProjectPlaceholderRepoIds', () => {
|
||||
groupBy: 'none',
|
||||
repos: [repo],
|
||||
worktreesByRepo: { [repo.id]: [] },
|
||||
visibleWorktrees: [],
|
||||
filterRepoIds: []
|
||||
}).size
|
||||
).toBe(0)
|
||||
@@ -90,8 +94,109 @@ describe('getEmptyProjectPlaceholderRepoIds', () => {
|
||||
groupBy: 'repo',
|
||||
repos: [repo],
|
||||
worktreesByRepo: { [repo.id]: [worktree] },
|
||||
visibleWorktrees: [],
|
||||
filterRepoIds: []
|
||||
}).size
|
||||
).toBe(0)
|
||||
})
|
||||
|
||||
it('keeps grouped repos visible when workspace filters hide all of their rows', () => {
|
||||
const groupedRepo: Repo = { ...repo, projectGroupId: 'group-1' }
|
||||
const groupedWorktree: Worktree = { ...worktree, repoId: groupedRepo.id }
|
||||
|
||||
expect(
|
||||
Array.from(
|
||||
getEmptyProjectPlaceholderRepoIds({
|
||||
groupBy: 'repo',
|
||||
repos: [groupedRepo],
|
||||
worktreesByRepo: { [groupedRepo.id]: [groupedWorktree] },
|
||||
visibleWorktrees: [],
|
||||
filterRepoIds: []
|
||||
})
|
||||
)
|
||||
).toEqual([groupedRepo.id])
|
||||
})
|
||||
|
||||
it('does not create a grouped repo placeholder when one of its workspaces is visible', () => {
|
||||
const groupedRepo: Repo = { ...repo, projectGroupId: 'group-1' }
|
||||
const groupedWorktree: Worktree = { ...worktree, repoId: groupedRepo.id }
|
||||
|
||||
expect(
|
||||
getEmptyProjectPlaceholderRepoIds({
|
||||
groupBy: 'repo',
|
||||
repos: [groupedRepo],
|
||||
worktreesByRepo: { [groupedRepo.id]: [groupedWorktree] },
|
||||
visibleWorktrees: [groupedWorktree],
|
||||
filterRepoIds: []
|
||||
}).size
|
||||
).toBe(0)
|
||||
})
|
||||
|
||||
it('still respects explicit project filters for sleep-filtered grouped members', () => {
|
||||
const selected: Repo = { ...repo, id: 'repo-selected', projectGroupId: 'group-1' }
|
||||
const filteredOut: Repo = { ...repo, id: 'repo-hidden', projectGroupId: 'group-1' }
|
||||
const selectedWt: Worktree = { ...worktree, id: 'wt-selected', repoId: selected.id }
|
||||
const hiddenWt: Worktree = { ...worktree, id: 'wt-hidden', repoId: filteredOut.id }
|
||||
|
||||
expect(
|
||||
Array.from(
|
||||
getEmptyProjectPlaceholderRepoIds({
|
||||
groupBy: 'repo',
|
||||
repos: [selected, filteredOut],
|
||||
worktreesByRepo: {
|
||||
[selected.id]: [selectedWt],
|
||||
[filteredOut.id]: [hiddenWt]
|
||||
},
|
||||
// Why: simulate Hide sleeping removing every card while the project
|
||||
// filter still intentionally excludes `filteredOut`.
|
||||
visibleWorktrees: [],
|
||||
filterRepoIds: [selected.id]
|
||||
})
|
||||
)
|
||||
).toEqual([selected.id])
|
||||
})
|
||||
|
||||
it('placeholders only the fully-filtered members of a multi-project group', () => {
|
||||
const sleeping: Repo = { ...repo, id: 'repo-sleeping', projectGroupId: 'group-1' }
|
||||
const awake: Repo = { ...repo, id: 'repo-awake', projectGroupId: 'group-1' }
|
||||
const sleepingWt: Worktree = { ...worktree, id: 'wt-sleeping', repoId: sleeping.id }
|
||||
const awakeWt: Worktree = { ...worktree, id: 'wt-awake', repoId: awake.id }
|
||||
|
||||
expect(
|
||||
Array.from(
|
||||
getEmptyProjectPlaceholderRepoIds({
|
||||
groupBy: 'repo',
|
||||
repos: [sleeping, awake],
|
||||
worktreesByRepo: {
|
||||
[sleeping.id]: [sleepingWt],
|
||||
[awake.id]: [awakeWt]
|
||||
},
|
||||
visibleWorktrees: [awakeWt],
|
||||
filterRepoIds: []
|
||||
})
|
||||
)
|
||||
).toEqual([sleeping.id])
|
||||
})
|
||||
|
||||
it('does not placeholder ungrouped neighbors of a filtered grouped member', () => {
|
||||
const grouped: Repo = { ...repo, id: 'repo-grouped', projectGroupId: 'group-1' }
|
||||
const ungrouped: Repo = { ...repo, id: 'repo-ungrouped' }
|
||||
const groupedWt: Worktree = { ...worktree, id: 'wt-grouped', repoId: grouped.id }
|
||||
const ungroupedWt: Worktree = { ...worktree, id: 'wt-ungrouped', repoId: ungrouped.id }
|
||||
|
||||
expect(
|
||||
Array.from(
|
||||
getEmptyProjectPlaceholderRepoIds({
|
||||
groupBy: 'repo',
|
||||
repos: [grouped, ungrouped],
|
||||
worktreesByRepo: {
|
||||
[grouped.id]: [groupedWt],
|
||||
[ungrouped.id]: [ungroupedWt]
|
||||
},
|
||||
visibleWorktrees: [],
|
||||
filterRepoIds: []
|
||||
})
|
||||
)
|
||||
).toEqual([grouped.id])
|
||||
})
|
||||
})
|
||||
|
||||
@@ -5,6 +5,7 @@ export function getEmptyProjectPlaceholderRepoIds(args: {
|
||||
groupBy: WorktreeGroupBy
|
||||
repos: readonly Repo[]
|
||||
worktreesByRepo: Readonly<Record<string, readonly Worktree[] | undefined>>
|
||||
visibleWorktrees: readonly Worktree[]
|
||||
filterRepoIds: readonly string[]
|
||||
}): Set<string> {
|
||||
if (args.groupBy !== 'repo') {
|
||||
@@ -12,12 +13,17 @@ export function getEmptyProjectPlaceholderRepoIds(args: {
|
||||
}
|
||||
|
||||
const filterSet = args.filterRepoIds.length > 0 ? new Set(args.filterRepoIds) : null
|
||||
const visibleRepoIds = new Set(args.visibleWorktrees.map((worktree) => worktree.repoId))
|
||||
const placeholderRepoIds = new Set<string>()
|
||||
for (const repo of args.repos) {
|
||||
if (filterSet && !filterSet.has(repo.id)) {
|
||||
continue
|
||||
}
|
||||
if ((args.worktreesByRepo[repo.id]?.length ?? 0) === 0) {
|
||||
const hasNoWorktrees = (args.worktreesByRepo[repo.id]?.length ?? 0) === 0
|
||||
// Why: workspace filters hide cards, but must not rewrite the visible
|
||||
// membership of a persisted Project Group. #8865
|
||||
const isFilteredProjectGroupMember = repo.projectGroupId != null && !visibleRepoIds.has(repo.id)
|
||||
if (hasNoWorktrees || isFilteredProjectGroupMember) {
|
||||
placeholderRepoIds.add(repo.id)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1933,6 +1933,73 @@ describe('project groups', () => {
|
||||
expect(rows[0]).toMatchObject({ label: 'Platform' })
|
||||
})
|
||||
|
||||
it('keeps sleep-filtered Project Group members as empty project headers', () => {
|
||||
// Why: #8865 — Hide sleeping removes workspace cards; membership placeholders
|
||||
// must still project the grouped project header so the group count stays honest.
|
||||
const group: ProjectGroup = {
|
||||
id: 'group-1',
|
||||
name: 'Platform',
|
||||
parentPath: '/platform',
|
||||
parentGroupId: null,
|
||||
createdFrom: 'folder-scan',
|
||||
tabOrder: 0,
|
||||
isCollapsed: false,
|
||||
color: null,
|
||||
createdAt: 1,
|
||||
updatedAt: 1
|
||||
}
|
||||
const sleepingRepo: Repo = {
|
||||
...repo,
|
||||
id: 'repo-sleeping',
|
||||
displayName: 'sleeping-project',
|
||||
projectGroupId: group.id
|
||||
}
|
||||
const awakeRepo: Repo = {
|
||||
...repo,
|
||||
id: 'repo-awake',
|
||||
displayName: 'awake-project',
|
||||
projectGroupId: group.id
|
||||
}
|
||||
const awakeWorktree: Worktree = {
|
||||
...worktree,
|
||||
id: 'wt-awake',
|
||||
repoId: awakeRepo.id,
|
||||
path: '/tmp/awake'
|
||||
}
|
||||
|
||||
const rows = buildRows(
|
||||
'repo',
|
||||
[awakeWorktree],
|
||||
new Map([
|
||||
[sleepingRepo.id, sleepingRepo],
|
||||
[awakeRepo.id, awakeRepo]
|
||||
]),
|
||||
null,
|
||||
new Set(),
|
||||
undefined,
|
||||
undefined,
|
||||
undefined,
|
||||
{},
|
||||
new Map([[awakeWorktree.id, awakeWorktree]]),
|
||||
false,
|
||||
undefined,
|
||||
[group],
|
||||
new Set([sleepingRepo.id])
|
||||
)
|
||||
|
||||
expect(rows[0]).toMatchObject({
|
||||
type: 'header',
|
||||
key: 'project-group:group-1',
|
||||
count: 2
|
||||
})
|
||||
// Why: empty/placeholder projects sort after projects with visible activity.
|
||||
expect(rows.filter((row) => row.type === 'header').map((row) => row.key)).toEqual([
|
||||
'project-group:group-1',
|
||||
`repo:${awakeRepo.id}`,
|
||||
`repo:${sleepingRepo.id}`
|
||||
])
|
||||
})
|
||||
|
||||
it('renders ungrouped repos as top-level repo rows when Project Groups exist', () => {
|
||||
const group: ProjectGroup = {
|
||||
id: 'group-1',
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
import { useSkillFreshness } from '@/hooks/useSkillFreshness'
|
||||
import { translate } from '@/i18n/i18n'
|
||||
import { IntegrationStatusPill } from '@/components/integration-status-pill'
|
||||
import { getSkillFreshnessDisplayStatus } from '@/lib/skill-freshness-display-status'
|
||||
|
||||
// Why: the setup rails' Installed pill is presence-only; when freshness knows a
|
||||
// safe update exists (or that every copy is current) the pill should say so.
|
||||
@@ -8,7 +9,8 @@ import { IntegrationStatusPill } from '@/components/integration-status-pill'
|
||||
// placement is never advertised as updatable here.
|
||||
export function SkillFreshnessStatusPill({ skillName }: { skillName: string }): React.JSX.Element {
|
||||
const { inventory } = useSkillFreshness()
|
||||
if (inventory?.eligibleUpdateNames.includes(skillName)) {
|
||||
const status = getSkillFreshnessDisplayStatus(inventory, skillName)
|
||||
if (status === 'update-available') {
|
||||
return (
|
||||
<IntegrationStatusPill tone="attention">
|
||||
{translate(
|
||||
@@ -18,14 +20,7 @@ export function SkillFreshnessStatusPill({ skillName }: { skillName: string }):
|
||||
</IntegrationStatusPill>
|
||||
)
|
||||
}
|
||||
const placements = inventory?.installations.filter(
|
||||
(installation) => installation.name === skillName
|
||||
)
|
||||
if (
|
||||
placements &&
|
||||
placements.length > 0 &&
|
||||
placements.every((installation) => installation.status === 'current')
|
||||
) {
|
||||
if (status === 'up-to-date') {
|
||||
return (
|
||||
<IntegrationStatusPill tone="connected">
|
||||
{translate('auto.components.skills.SkillFreshnessStatusPill.upToDate', 'Up to date')}
|
||||
|
||||
@@ -50,6 +50,15 @@ describe('tab create entry classification', () => {
|
||||
})
|
||||
})
|
||||
|
||||
it('keeps the shared legacy local-dev forms in parity with address-bar normalization', () => {
|
||||
for (const input of ['0.0.0.0:3000', '[::1]:3000', '[2001:db8::1]:3000/path']) {
|
||||
expect(classifyTabEntryQuery(input, readyFiles([]))).toMatchObject({
|
||||
kind: 'host-url',
|
||||
url: expect.stringMatching(/^http:/)
|
||||
})
|
||||
}
|
||||
})
|
||||
|
||||
it('does not classify invalid numeric hosts as URLs', () => {
|
||||
expect(classifyTabEntryQuery('999.999.999.999', readyFiles([]))).toEqual({
|
||||
kind: 'new-file',
|
||||
|
||||
@@ -1,4 +1,5 @@
|
||||
import { translate } from '@/i18n/i18n'
|
||||
import { classifySchemeLessLocalDevAddress } from '../../../../shared/browser-url'
|
||||
|
||||
const HOST_FILE_EXTENSIONS = new Set([
|
||||
'css',
|
||||
@@ -15,9 +16,6 @@ const HOST_FILE_EXTENSIONS = new Set([
|
||||
'yml'
|
||||
])
|
||||
|
||||
const LOCAL_ADDRESS_PATTERN =
|
||||
/^(?:localhost|127(?:\.\d{1,3}){3}|0\.0\.0\.0|\[[0-9a-f:]+\])(?::\d+)?(?:[/?#].*)?$/i
|
||||
|
||||
const LOCALHOST_WITH_PORT_PATTERN = /^localhost(?::\d{1,5})?$/i
|
||||
const IPV4_WITH_PORT_PATTERN =
|
||||
/^(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?::\d{1,5})?$/
|
||||
@@ -33,7 +31,7 @@ export type HostUrlClassification = { kind: 'host-url'; url: string }
|
||||
export function classifyExplicitUrl(query: string): ExplicitUrlClassification | null {
|
||||
// Local dev inputs are handled by host-url classification so users can
|
||||
// enter localhost/IP addresses without an explicit scheme.
|
||||
if (LOCAL_ADDRESS_PATTERN.test(query)) {
|
||||
if (classifySchemeLessLocalDevAddress(query)) {
|
||||
return null
|
||||
}
|
||||
let url: URL
|
||||
@@ -55,15 +53,8 @@ export function classifyExplicitUrl(query: string): ExplicitUrlClassification |
|
||||
}
|
||||
|
||||
function classifyLocalDevUrl(query: string): HostUrlClassification | null {
|
||||
if (!LOCAL_ADDRESS_PATTERN.test(query)) {
|
||||
return null
|
||||
}
|
||||
try {
|
||||
const url = new URL(`http://${query}`)
|
||||
return url.hostname ? { kind: 'host-url', url: url.href } : null
|
||||
} catch {
|
||||
return null
|
||||
}
|
||||
const url = classifySchemeLessLocalDevAddress(query)
|
||||
return url?.hostname ? { kind: 'host-url', url: url.href } : null
|
||||
}
|
||||
|
||||
function classifyHostLikeUrl(query: string): HostUrlClassification | null {
|
||||
|
||||
@@ -0,0 +1,425 @@
|
||||
import type { IBufferLine } from '@xterm/xterm'
|
||||
import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
|
||||
import { registerHttpLinkStoreAccessor } from '@/lib/http-link-routing'
|
||||
import { openHttpLinkAtBufferPosition } from './terminal-url-link-hit-testing'
|
||||
|
||||
const COLS = 40
|
||||
const WIDE_GLYPH = '界'
|
||||
const openUrlMock = vi.fn()
|
||||
|
||||
function makeBufferLine(content: string, cols = COLS): IBufferLine {
|
||||
return makeBufferLineFromCells(
|
||||
Array.from(content, (text) => ({ text, width: text === WIDE_GLYPH ? 2 : 1 })),
|
||||
cols
|
||||
)
|
||||
}
|
||||
|
||||
function makeBufferLineFromCells(
|
||||
cells: { text: string; width: number }[],
|
||||
cols = COLS
|
||||
): IBufferLine {
|
||||
const columns: number[] = []
|
||||
let column = 0
|
||||
let text = ''
|
||||
for (const cell of cells) {
|
||||
text += cell.text
|
||||
for (let index = 0; index < cell.text.length; index++) {
|
||||
columns.push(column)
|
||||
}
|
||||
column += cell.width
|
||||
}
|
||||
while (column < cols) {
|
||||
text += ' '
|
||||
columns.push(column)
|
||||
column++
|
||||
}
|
||||
columns.push(column)
|
||||
|
||||
return {
|
||||
isWrapped: false,
|
||||
length: cols,
|
||||
translateToString: (
|
||||
_trimRight?: boolean,
|
||||
startColumn = 0,
|
||||
endColumn = text.length,
|
||||
outColumns?: number[]
|
||||
) => {
|
||||
outColumns?.splice(0, outColumns.length, ...columns.slice(startColumn, endColumn + 1))
|
||||
return text.slice(startColumn, endColumn)
|
||||
}
|
||||
} as IBufferLine
|
||||
}
|
||||
|
||||
describe('edge-wrapped terminal HTTP links', () => {
|
||||
beforeEach(() => {
|
||||
vi.stubGlobal('window', { api: { shell: { openUrl: openUrlMock } } })
|
||||
registerHttpLinkStoreAccessor(() => ({
|
||||
settings: { openLinksInApp: false },
|
||||
setActiveWorktree: vi.fn(),
|
||||
createBrowserTab: vi.fn()
|
||||
}))
|
||||
openUrlMock.mockReset()
|
||||
})
|
||||
|
||||
afterEach(() => {
|
||||
vi.unstubAllGlobals()
|
||||
})
|
||||
|
||||
it('opens a URL when a wide glyph starts the continuation row', () => {
|
||||
const prefix = 'https://example.com/wide/'
|
||||
const firstRow = `${prefix}${'c'.repeat(COLS - 1 - prefix.length)}`
|
||||
const continuationRow = `${WIDE_GLYPH}tail`
|
||||
const expectedUrl = new URL(`${firstRow}${continuationRow}`).toString()
|
||||
const rows = [makeBufferLine(firstRow), makeBufferLine(continuationRow)]
|
||||
const buffer = { getLine: (y: number) => rows[y] }
|
||||
|
||||
expect(
|
||||
openHttpLinkAtBufferPosition(buffer, { x: 11, y: 1 }, COLS, {
|
||||
worktreeId: 'wt-1',
|
||||
forceSystemBrowser: true
|
||||
})
|
||||
).toBe(true)
|
||||
expect(openUrlMock).toHaveBeenCalledOnce()
|
||||
expect(openUrlMock).toHaveBeenCalledWith(expectedUrl)
|
||||
|
||||
openUrlMock.mockReset()
|
||||
expect(
|
||||
openHttpLinkAtBufferPosition(buffer, { x: 3, y: 2 }, COLS, {
|
||||
worktreeId: 'wt-1',
|
||||
forceSystemBrowser: true
|
||||
})
|
||||
).toBe(true)
|
||||
expect(openUrlMock).toHaveBeenCalledOnce()
|
||||
expect(openUrlMock).toHaveBeenCalledWith(expectedUrl)
|
||||
})
|
||||
|
||||
it('opens a URL when a multi-code-point wide cell starts the continuation row', () => {
|
||||
const wideCell = '👩💻'
|
||||
const prefix = 'https://example.com/wide/'
|
||||
const firstRow = `${prefix}${'c'.repeat(COLS - 1 - prefix.length)}`
|
||||
const continuationRow = `${wideCell}tail`
|
||||
const expectedUrl = new URL(`${firstRow}${continuationRow}`).toString()
|
||||
const rows = [
|
||||
makeBufferLine(firstRow),
|
||||
makeBufferLineFromCells([
|
||||
{ text: wideCell, width: 2 },
|
||||
...Array.from('tail', (text) => ({ text, width: 1 }))
|
||||
])
|
||||
]
|
||||
const buffer = { getLine: (y: number) => rows[y] }
|
||||
|
||||
expect(
|
||||
openHttpLinkAtBufferPosition(buffer, { x: 11, y: 1 }, COLS, {
|
||||
worktreeId: 'wt-1',
|
||||
forceSystemBrowser: true
|
||||
})
|
||||
).toBe(true)
|
||||
expect(openUrlMock).toHaveBeenCalledOnce()
|
||||
expect(openUrlMock).toHaveBeenCalledWith(expectedUrl)
|
||||
|
||||
openUrlMock.mockReset()
|
||||
expect(
|
||||
openHttpLinkAtBufferPosition(buffer, { x: 1, y: 2 }, COLS, {
|
||||
worktreeId: 'wt-1',
|
||||
forceSystemBrowser: true
|
||||
})
|
||||
).toBe(true)
|
||||
expect(openUrlMock).toHaveBeenCalledOnce()
|
||||
expect(openUrlMock).toHaveBeenCalledWith(expectedUrl)
|
||||
})
|
||||
|
||||
it('does not use the wide-glyph tolerance for an ASCII continuation row', () => {
|
||||
const firstRow = `https://example.com/${'a'.repeat(COLS - 1 - 'https://example.com/'.length)}`
|
||||
const rows = [makeBufferLine(firstRow), makeBufferLine('next')]
|
||||
const buffer = { getLine: (y: number) => rows[y] }
|
||||
|
||||
expect(
|
||||
openHttpLinkAtBufferPosition(buffer, { x: 11, y: 1 }, COLS, {
|
||||
worktreeId: 'wt-1',
|
||||
forceSystemBrowser: true
|
||||
})
|
||||
).toBe(true)
|
||||
expect(openUrlMock).toHaveBeenCalledOnce()
|
||||
expect(openUrlMock).toHaveBeenCalledWith(firstRow)
|
||||
|
||||
openUrlMock.mockReset()
|
||||
expect(
|
||||
openHttpLinkAtBufferPosition(buffer, { x: 2, y: 2 }, COLS, {
|
||||
worktreeId: 'wt-1',
|
||||
forceSystemBrowser: true
|
||||
})
|
||||
).toBe(false)
|
||||
expect(openUrlMock).not.toHaveBeenCalled()
|
||||
})
|
||||
|
||||
it.each(['Description: 123', 'Description:', '404: Not Found', 'HTTP/2: 200', 'HTTP/2:200'])(
|
||||
'does not append a %s label when a complete URL ends at the terminal edge',
|
||||
(labelRow) => {
|
||||
const firstRow = `https://example.com/${'a'.repeat(COLS - 1 - 'https://example.com/'.length)}/`
|
||||
const rows = [makeBufferLine(firstRow), makeBufferLine(labelRow)]
|
||||
const buffer = { getLine: (y: number) => rows[y] }
|
||||
|
||||
expect(firstRow).toHaveLength(COLS)
|
||||
expect(
|
||||
openHttpLinkAtBufferPosition(buffer, { x: 11, y: 1 }, COLS, {
|
||||
worktreeId: 'wt-1',
|
||||
forceSystemBrowser: true
|
||||
})
|
||||
).toBe(true)
|
||||
expect(openUrlMock).toHaveBeenCalledOnce()
|
||||
expect(openUrlMock).toHaveBeenCalledWith(firstRow)
|
||||
|
||||
openUrlMock.mockReset()
|
||||
expect(
|
||||
openHttpLinkAtBufferPosition(buffer, { x: 2, y: 2 }, COLS, {
|
||||
worktreeId: 'wt-1',
|
||||
forceSystemBrowser: true
|
||||
})
|
||||
).toBe(false)
|
||||
expect(openUrlMock).not.toHaveBeenCalled()
|
||||
}
|
||||
)
|
||||
|
||||
it('does not append an adjacent URL that starts on the next row', () => {
|
||||
const firstRow = `https://example.com/${'a'.repeat(COLS - 'https://example.com/'.length)}`
|
||||
const secondRow = 'https://two.test/path'
|
||||
const rows = [makeBufferLine(firstRow), makeBufferLine(secondRow)]
|
||||
const buffer = { getLine: (y: number) => rows[y] }
|
||||
|
||||
expect(
|
||||
openHttpLinkAtBufferPosition(buffer, { x: 11, y: 1 }, COLS, {
|
||||
worktreeId: 'wt-1',
|
||||
forceSystemBrowser: true
|
||||
})
|
||||
).toBe(true)
|
||||
expect(openUrlMock).toHaveBeenCalledOnce()
|
||||
expect(openUrlMock).toHaveBeenCalledWith(firstRow)
|
||||
|
||||
openUrlMock.mockReset()
|
||||
expect(
|
||||
openHttpLinkAtBufferPosition(buffer, { x: 11, y: 2 }, COLS, {
|
||||
worktreeId: 'wt-1',
|
||||
forceSystemBrowser: true
|
||||
})
|
||||
).toBe(true)
|
||||
expect(openUrlMock).toHaveBeenCalledOnce()
|
||||
expect(openUrlMock).toHaveBeenCalledWith(secondRow)
|
||||
})
|
||||
|
||||
it('keeps a full-width continuation row that ends in a colon', () => {
|
||||
const prefix = 'https://example.com/'
|
||||
const firstRow = `${prefix}${'a'.repeat(COLS - prefix.length)}`
|
||||
const secondRow = `${'b'.repeat(COLS - 1)}:`
|
||||
const thirdRow = 'tail'
|
||||
const expectedUrl = new URL(`${firstRow}${secondRow}${thirdRow}`).toString()
|
||||
const rows = [makeBufferLine(firstRow), makeBufferLine(secondRow), makeBufferLine(thirdRow)]
|
||||
const buffer = { getLine: (y: number) => rows[y] }
|
||||
|
||||
expect(
|
||||
openHttpLinkAtBufferPosition(buffer, { x: 11, y: 1 }, COLS, {
|
||||
worktreeId: 'wt-1',
|
||||
forceSystemBrowser: true
|
||||
})
|
||||
).toBe(true)
|
||||
expect(openUrlMock).toHaveBeenCalledOnce()
|
||||
expect(openUrlMock).toHaveBeenCalledWith(expectedUrl)
|
||||
|
||||
openUrlMock.mockReset()
|
||||
expect(
|
||||
openHttpLinkAtBufferPosition(buffer, { x: 20, y: 2 }, COLS, {
|
||||
worktreeId: 'wt-1',
|
||||
forceSystemBrowser: true
|
||||
})
|
||||
).toBe(true)
|
||||
expect(openUrlMock).toHaveBeenCalledOnce()
|
||||
expect(openUrlMock).toHaveBeenCalledWith(expectedUrl)
|
||||
})
|
||||
|
||||
it('keeps a short colon-bearing URL continuation', () => {
|
||||
const firstRow = `https://example.com/${'a'.repeat(COLS - 'https://example.com/'.length)}`
|
||||
const secondRow = 'urn:abc'
|
||||
const expectedUrl = `${firstRow}${secondRow}`
|
||||
const rows = [makeBufferLine(firstRow), makeBufferLine(secondRow)]
|
||||
const buffer = { getLine: (y: number) => rows[y] }
|
||||
|
||||
expect(
|
||||
openHttpLinkAtBufferPosition(buffer, { x: 4, y: 2 }, COLS, {
|
||||
worktreeId: 'wt-1',
|
||||
forceSystemBrowser: true
|
||||
})
|
||||
).toBe(true)
|
||||
expect(openUrlMock).toHaveBeenCalledOnce()
|
||||
expect(openUrlMock).toHaveBeenCalledWith(expectedUrl)
|
||||
})
|
||||
|
||||
it('does not count text before the URL against the URL length limit', () => {
|
||||
const cols = 200
|
||||
const prefix = `${'P'.repeat(179)} `
|
||||
const url = `https://example.com/${'a'.repeat(1_880)}`
|
||||
const displayed = `${prefix}${url}`
|
||||
const rowTexts = Array.from({ length: Math.ceil(displayed.length / cols) }, (_value, index) =>
|
||||
displayed.slice(index * cols, (index + 1) * cols)
|
||||
)
|
||||
const rows = rowTexts.map((row) => makeBufferLine(row, cols))
|
||||
const buffer = { getLine: (y: number) => rows[y] }
|
||||
|
||||
expect(url).toHaveLength(1_900)
|
||||
expect(displayed.length).toBeGreaterThan(2_048)
|
||||
expect(
|
||||
openHttpLinkAtBufferPosition(buffer, { x: 191, y: 1 }, cols, {
|
||||
worktreeId: 'wt-1',
|
||||
forceSystemBrowser: true
|
||||
})
|
||||
).toBe(true)
|
||||
expect(openUrlMock).toHaveBeenCalledOnce()
|
||||
expect(openUrlMock).toHaveBeenCalledWith(url)
|
||||
|
||||
openUrlMock.mockReset()
|
||||
expect(
|
||||
openHttpLinkAtBufferPosition(buffer, { x: 10, y: rows.length }, cols, {
|
||||
worktreeId: 'wt-1',
|
||||
forceSystemBrowser: true
|
||||
})
|
||||
).toBe(true)
|
||||
expect(openUrlMock).toHaveBeenCalledOnce()
|
||||
expect(openUrlMock).toHaveBeenCalledWith(url)
|
||||
})
|
||||
|
||||
it('reconstructs a narrow-terminal URL spanning more than 20 rows from either end', () => {
|
||||
const url = `https://example.com/${'a'.repeat(1_000)}`
|
||||
const rowTexts = Array.from({ length: Math.ceil(url.length / COLS) }, (_value, index) =>
|
||||
url.slice(index * COLS, (index + 1) * COLS)
|
||||
)
|
||||
const rows = rowTexts.map((row) => makeBufferLine(row))
|
||||
const buffer = { getLine: (y: number) => rows[y] }
|
||||
|
||||
expect(url.length).toBeLessThanOrEqual(2_048)
|
||||
expect(rowTexts.length).toBeGreaterThan(20)
|
||||
expect(
|
||||
openHttpLinkAtBufferPosition(buffer, { x: 11, y: 1 }, COLS, {
|
||||
worktreeId: 'wt-1',
|
||||
forceSystemBrowser: true
|
||||
})
|
||||
).toBe(true)
|
||||
expect(openUrlMock).toHaveBeenCalledOnce()
|
||||
expect(openUrlMock).toHaveBeenCalledWith(url)
|
||||
|
||||
openUrlMock.mockReset()
|
||||
expect(
|
||||
openHttpLinkAtBufferPosition(buffer, { x: 5, y: rowTexts.length }, COLS, {
|
||||
worktreeId: 'wt-1',
|
||||
forceSystemBrowser: true
|
||||
})
|
||||
).toBe(true)
|
||||
expect(openUrlMock).toHaveBeenCalledOnce()
|
||||
expect(openUrlMock).toHaveBeenCalledWith(url)
|
||||
})
|
||||
|
||||
it('reconstructs a wide-glyph URL whose row span exceeds the single-width column bound', () => {
|
||||
const wideCount = 1_100
|
||||
const url = `https://example.com/${WIDE_GLYPH.repeat(wideCount)}`
|
||||
const rowTexts: string[] = []
|
||||
let row = ''
|
||||
let width = 0
|
||||
for (const char of url) {
|
||||
const charWidth = char === WIDE_GLYPH ? 2 : 1
|
||||
if (width + charWidth > COLS) {
|
||||
rowTexts.push(row)
|
||||
row = ''
|
||||
width = 0
|
||||
}
|
||||
row += char
|
||||
width += charWidth
|
||||
}
|
||||
if (row.length > 0) {
|
||||
rowTexts.push(row)
|
||||
}
|
||||
const rows = rowTexts.map((rowText) => makeBufferLine(rowText))
|
||||
const buffer = { getLine: (y: number) => rows[y] }
|
||||
|
||||
expect(url.length).toBeLessThanOrEqual(2_048)
|
||||
expect(rowTexts.length).toBeGreaterThan(Math.ceil(2_048 / COLS) + 1)
|
||||
expect(
|
||||
openHttpLinkAtBufferPosition(buffer, { x: 5, y: rowTexts.length }, COLS, {
|
||||
worktreeId: 'wt-1',
|
||||
forceSystemBrowser: true
|
||||
})
|
||||
).toBe(true)
|
||||
expect(openUrlMock).toHaveBeenCalledOnce()
|
||||
expect(openUrlMock).toHaveBeenCalledWith(new URL(url).toString())
|
||||
})
|
||||
|
||||
it('joins a real multi-line URL whose continuation is a Chinese path segment', () => {
|
||||
const prefix = 'https://example.com/'
|
||||
const firstRow = `${prefix}${'a'.repeat(COLS - prefix.length)}`
|
||||
const continuation = `${WIDE_GLYPH}文档/路径`
|
||||
const expectedUrl = new URL(`${firstRow}${continuation}`).toString()
|
||||
const rows = [makeBufferLine(firstRow), makeBufferLine(continuation)]
|
||||
const buffer = { getLine: (y: number) => rows[y] }
|
||||
|
||||
expect(firstRow).toHaveLength(COLS)
|
||||
expect(
|
||||
openHttpLinkAtBufferPosition(buffer, { x: 11, y: 1 }, COLS, {
|
||||
worktreeId: 'wt-1',
|
||||
forceSystemBrowser: true
|
||||
})
|
||||
).toBe(true)
|
||||
expect(openUrlMock).toHaveBeenCalledOnce()
|
||||
expect(openUrlMock).toHaveBeenCalledWith(expectedUrl)
|
||||
})
|
||||
|
||||
it('does not glue a mid-row URL to a next-line Windows path', () => {
|
||||
const firstRow = 'Repo: https://example.com/repo/'
|
||||
const secondRow = 'C:\\Users\\demo\\project\\file.ts'
|
||||
const rows = [makeBufferLine(firstRow), makeBufferLine(secondRow)]
|
||||
const buffer = { getLine: (y: number) => rows[y] }
|
||||
|
||||
expect(
|
||||
openHttpLinkAtBufferPosition(buffer, { x: firstRow.indexOf('https') + 8, y: 1 }, COLS, {
|
||||
worktreeId: 'wt-1',
|
||||
forceSystemBrowser: true
|
||||
})
|
||||
).toBe(true)
|
||||
expect(openUrlMock).toHaveBeenCalledOnce()
|
||||
expect(openUrlMock).toHaveBeenCalledWith('https://example.com/repo/')
|
||||
})
|
||||
|
||||
it('does not create an edge candidate for a scheme embedded in a word', () => {
|
||||
const embeddedUrl = `abchttps://example.com/${'a'.repeat(
|
||||
COLS - 'abchttps://example.com/'.length
|
||||
)}`
|
||||
const rows = [makeBufferLine(embeddedUrl), makeBufferLine('tail')]
|
||||
const buffer = { getLine: (y: number) => rows[y] }
|
||||
|
||||
expect(
|
||||
openHttpLinkAtBufferPosition(buffer, { x: 10, y: 1 }, COLS, {
|
||||
worktreeId: 'wt-1',
|
||||
forceSystemBrowser: true
|
||||
})
|
||||
).toBe(false)
|
||||
expect(openUrlMock).not.toHaveBeenCalled()
|
||||
})
|
||||
|
||||
it('keeps a URL under the length limit when its final row also contains a label', () => {
|
||||
const cols = 200
|
||||
const url = `https://example.com/${'a'.repeat(2_020)}`
|
||||
const displayed = `${url} ${'L'.repeat(159)}`
|
||||
const rowTexts = Array.from({ length: Math.ceil(displayed.length / cols) }, (_value, index) =>
|
||||
displayed.slice(index * cols, (index + 1) * cols)
|
||||
)
|
||||
const rows = rowTexts.map((row) => makeBufferLine(row, cols))
|
||||
const buffer = { getLine: (y: number) => rows[y] }
|
||||
|
||||
expect(url).toHaveLength(2_040)
|
||||
expect(rowTexts).toHaveLength(11)
|
||||
expect(rowTexts.at(-1)).toHaveLength(cols)
|
||||
expect(
|
||||
openHttpLinkAtBufferPosition(buffer, { x: 10, y: 1 }, cols, {
|
||||
worktreeId: 'wt-1',
|
||||
forceSystemBrowser: true
|
||||
})
|
||||
).toBe(true)
|
||||
expect(openUrlMock).toHaveBeenCalledOnce()
|
||||
expect(openUrlMock).toHaveBeenCalledWith(url)
|
||||
})
|
||||
})
|
||||
@@ -0,0 +1,183 @@
|
||||
import type { IBufferLine } from '@xterm/xterm'
|
||||
import { TERMINAL_HTTP_URL_MAX_LENGTH } from './terminal-http-link-limits'
|
||||
import { translateLineWithColumns, type WrappedLogicalLine } from './wrapped-terminal-link-ranges'
|
||||
|
||||
const HTTP_SCHEME_PATTERN = /https?:\/\//i
|
||||
const HTTP_SCHEME_START_PATTERN = /^https?:\/\//i
|
||||
const HTTP_STATUS_ROW_PATTERN = /^HTTP\/\d(?:\.\d)?:\d{3}(?:\s|$)/i
|
||||
const VERTICAL_LAYOUT_FRAME_PATTERN = /[│┃║╎╏┆┇┊┋|]/
|
||||
const EMPTY_LABEL_ROW_PATTERN = /^[^\s:][^:]*:$/
|
||||
const LABEL_WITH_SPACING_ROW_PATTERN = /^[^\s:][^:]*:\s/
|
||||
|
||||
function maxEdgeWrappedHttpRows(lineLength: number): number {
|
||||
// Why: every continued row reaches the terminal edge, so even all-width-2
|
||||
// cells carry at least floor(columns / 2) characters per row; the URL length
|
||||
// limit then bounds the scan without truncating URLs on narrow terminals.
|
||||
// The +2 covers the start and tail rows, which may hold only a fragment.
|
||||
const minCharsPerFullRow = Math.max(1, Math.floor(lineLength / 2))
|
||||
return Math.ceil(TERMINAL_HTTP_URL_MAX_LENGTH / minCharsPerFullRow) + 2
|
||||
}
|
||||
|
||||
type TrimmedTranslatedLine = {
|
||||
text: string
|
||||
sourceText: string
|
||||
columns: number[]
|
||||
lineLength: number
|
||||
}
|
||||
|
||||
function trimRightTranslatedLine(line: IBufferLine): TrimmedTranslatedLine | null {
|
||||
const translated = translateLineWithColumns(line)
|
||||
let endIndex = translated.text.length
|
||||
while (endIndex > 0 && /\s/.test(translated.text[endIndex - 1])) {
|
||||
endIndex--
|
||||
}
|
||||
if (endIndex === 0) {
|
||||
return null
|
||||
}
|
||||
return {
|
||||
text: translated.text.slice(0, endIndex),
|
||||
sourceText: translated.text,
|
||||
columns: translated.columns.slice(0, endIndex + 1),
|
||||
lineLength: line.length
|
||||
}
|
||||
}
|
||||
|
||||
function firstCellWidth(row: TrimmedTranslatedLine): number {
|
||||
const firstColumn = row.columns[0]
|
||||
if (firstColumn === undefined) {
|
||||
return 0
|
||||
}
|
||||
const nextColumn = row.columns.find((column) => column > firstColumn)
|
||||
return nextColumn === undefined ? 0 : nextColumn - firstColumn
|
||||
}
|
||||
|
||||
function isAsciiWordCode(code: number): boolean {
|
||||
return (
|
||||
(code >= 48 && code <= 57) ||
|
||||
(code >= 65 && code <= 90) ||
|
||||
code === 95 ||
|
||||
(code >= 97 && code <= 122)
|
||||
)
|
||||
}
|
||||
|
||||
function findHttpSchemeIndex(text: string): number {
|
||||
let searchStart = 0
|
||||
while (searchStart < text.length) {
|
||||
const relativeIndex = text.slice(searchStart).search(HTTP_SCHEME_PATTERN)
|
||||
if (relativeIndex === -1) {
|
||||
return -1
|
||||
}
|
||||
const schemeIndex = searchStart + relativeIndex
|
||||
if (schemeIndex === 0 || !isAsciiWordCode(text.charCodeAt(schemeIndex - 1))) {
|
||||
return schemeIndex
|
||||
}
|
||||
searchStart = schemeIndex + 1
|
||||
}
|
||||
return -1
|
||||
}
|
||||
|
||||
function rowsCanContinueAtTerminalEdge(
|
||||
row: WrappedLogicalLine['rows'][number],
|
||||
nextRow: TrimmedTranslatedLine
|
||||
): boolean {
|
||||
// Why: a cursor-positioned label is not URL continuation evidence even when
|
||||
// the preceding URL happens to end at the terminal edge (#8832).
|
||||
const nextColumnAfterText = nextRow.columns.at(-1)
|
||||
const nextRowReachesEdge =
|
||||
nextColumnAfterText !== undefined && nextColumnAfterText >= nextRow.lineLength
|
||||
const isLabelRow =
|
||||
LABEL_WITH_SPACING_ROW_PATTERN.test(nextRow.text) ||
|
||||
((EMPTY_LABEL_ROW_PATTERN.test(nextRow.text) || HTTP_STATUS_ROW_PATTERN.test(nextRow.text)) &&
|
||||
!nextRowReachesEdge)
|
||||
if (isLabelRow || HTTP_SCHEME_START_PATTERN.test(nextRow.text)) {
|
||||
return false
|
||||
}
|
||||
const columnAfterText = row.columns.at(-1)
|
||||
if (columnAfterText === undefined || columnAfterText < row.lineLength - 1) {
|
||||
return false
|
||||
}
|
||||
return columnAfterText >= row.lineLength || firstCellWidth(nextRow) > 1
|
||||
}
|
||||
|
||||
export function buildEdgeWrappedHttpLogicalLineCandidates(
|
||||
buffer: { getLine(y: number): IBufferLine | undefined },
|
||||
bufferLineNumber: number
|
||||
): WrappedLogicalLine[] {
|
||||
// Why: cursor-positioned output lacks xterm wrap metadata, but an HTTP URL
|
||||
// may still continue when each earlier row reaches the terminal edge.
|
||||
const currentY = bufferLineNumber - 1
|
||||
const currentLine = buffer.getLine(currentY)
|
||||
if (!currentLine) {
|
||||
return []
|
||||
}
|
||||
const maxRows = maxEdgeWrappedHttpRows(currentLine.length)
|
||||
|
||||
const candidates: WrappedLogicalLine[] = []
|
||||
const translatedLines = new Map<number, TrimmedTranslatedLine | null>()
|
||||
const getTranslatedLine = (rowY: number): TrimmedTranslatedLine | null => {
|
||||
if (translatedLines.has(rowY)) {
|
||||
return translatedLines.get(rowY) ?? null
|
||||
}
|
||||
const line = buffer.getLine(rowY)
|
||||
const translated = line ? trimRightTranslatedLine(line) : null
|
||||
translatedLines.set(rowY, translated)
|
||||
return translated
|
||||
}
|
||||
const minY = Math.max(0, currentY - maxRows + 1)
|
||||
for (let startY = currentY; startY >= minY; startY--) {
|
||||
const start = getTranslatedLine(startY)
|
||||
const schemeIndex = start ? findHttpSchemeIndex(start.text) : -1
|
||||
if (!start || schemeIndex === -1 || VERTICAL_LAYOUT_FRAME_PATTERN.test(start.text)) {
|
||||
continue
|
||||
}
|
||||
|
||||
let text = ''
|
||||
const rows: WrappedLogicalLine['rows'] = []
|
||||
for (let rowY = startY; rowY < startY + maxRows; rowY++) {
|
||||
const line = buffer.getLine(rowY)
|
||||
const translated = getTranslatedLine(rowY)
|
||||
if (!line || !translated) {
|
||||
break
|
||||
}
|
||||
if (VERTICAL_LAYOUT_FRAME_PATTERN.test(translated.text)) {
|
||||
break
|
||||
}
|
||||
if (
|
||||
rows.length > 0 &&
|
||||
!line.isWrapped &&
|
||||
!rowsCanContinueAtTerminalEdge(rows.at(-1)!, translated)
|
||||
) {
|
||||
break
|
||||
}
|
||||
const fragmentStartIndex = rowY === startY ? schemeIndex : 0
|
||||
const fragment = translated.text.slice(fragmentStartIndex)
|
||||
const whitespaceIndex = fragment.search(/\s/)
|
||||
const possibleUrlFragmentLength = whitespaceIndex === -1 ? fragment.length : whitespaceIndex
|
||||
if (text.length + possibleUrlFragmentLength > TERMINAL_HTTP_URL_MAX_LENGTH) {
|
||||
break
|
||||
}
|
||||
|
||||
rows.push({
|
||||
y: rowY,
|
||||
text: fragment,
|
||||
sourceText: translated.sourceText,
|
||||
columns: translated.columns.slice(fragmentStartIndex),
|
||||
startIndex: text.length,
|
||||
isWrapped: line.isWrapped,
|
||||
lineLength: line.length
|
||||
})
|
||||
text += fragment
|
||||
if (rows.length > 1 && rowY >= currentY) {
|
||||
candidates.push({
|
||||
text,
|
||||
rows: [...rows],
|
||||
fingerprint: `edge-http:${rows.map((row) => `${row.y}:${row.sourceText}`).join('\0')}`
|
||||
})
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return candidates.sort(
|
||||
(left, right) => right.rows.length - left.rows.length || right.text.length - left.text.length
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,203 @@
|
||||
/**
|
||||
* Issue #8832 — Cmd-click URL must not glue the next logical line.
|
||||
*
|
||||
* Root cause: path hard-wrap reconstruction (from #8339) still joins a URL
|
||||
* suffix ending in `/` with the next row's path-like prefix. HTTP hit-testing
|
||||
* must not consume those candidates; it uses soft-wrap, framed hard-wrap HTTP,
|
||||
* and edge-wrap reconstruction only.
|
||||
*
|
||||
* Re-run:
|
||||
* pnpm exec vitest run --config config/vitest.config.ts \
|
||||
* src/renderer/src/components/terminal-pane/repro-8832-url-next-line.test.ts
|
||||
*/
|
||||
import type { IBufferLine } from '@xterm/xterm'
|
||||
import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
|
||||
import { registerHttpLinkStoreAccessor } from '@/lib/http-link-routing'
|
||||
import { buildCandidateLogicalLinesForBufferPosition } from './terminal-file-link-hit-testing'
|
||||
import {
|
||||
extractTerminalHttpLinks,
|
||||
openHttpLinkAtBufferPosition
|
||||
} from './terminal-url-link-hit-testing'
|
||||
import { buildHardWrappedPathLogicalLineCandidates } from './wrapped-terminal-link-ranges'
|
||||
|
||||
const LINE_1 = 'Repo: https://github.com/stablyai/orca/'
|
||||
const LINE_2 = 'Description: 123'
|
||||
const EXPECTED_URL = 'https://github.com/stablyai/orca/'
|
||||
const BUGGY_URL = 'https://github.com/stablyai/orca/Description'
|
||||
|
||||
const openUrlMock = vi.fn()
|
||||
|
||||
function makeBufferLine(
|
||||
text: string,
|
||||
options: { cols?: number; isWrapped?: boolean } = {}
|
||||
): IBufferLine {
|
||||
const cols = options.cols ?? Math.max(text.length, 80)
|
||||
const padded = text.padEnd(cols)
|
||||
return {
|
||||
isWrapped: options.isWrapped ?? false,
|
||||
length: cols,
|
||||
getCell: () => undefined,
|
||||
translateToString: (
|
||||
_trimRight?: boolean,
|
||||
startColumn = 0,
|
||||
endColumn = padded.length,
|
||||
outColumns?: number[]
|
||||
) => {
|
||||
if (outColumns) {
|
||||
outColumns.length = 0
|
||||
for (let index = startColumn; index <= endColumn; index++) {
|
||||
outColumns.push(index)
|
||||
}
|
||||
}
|
||||
return padded.slice(startColumn, endColumn)
|
||||
}
|
||||
} as IBufferLine
|
||||
}
|
||||
|
||||
function twoRowBuffer(
|
||||
row0: string,
|
||||
row1: string,
|
||||
options: { cols?: number; softWrapped?: boolean } = {}
|
||||
): { getLine(y: number): IBufferLine | undefined } {
|
||||
const cols = options.cols ?? 120
|
||||
const rows = [
|
||||
makeBufferLine(row0, { cols, isWrapped: false }),
|
||||
makeBufferLine(row1, { cols, isWrapped: options.softWrapped === true })
|
||||
]
|
||||
return { getLine: (y: number) => rows[y] }
|
||||
}
|
||||
|
||||
function issueBuffer(): { getLine(y: number): IBufferLine | undefined } {
|
||||
return twoRowBuffer(LINE_1, LINE_2, { cols: 120 })
|
||||
}
|
||||
|
||||
function openUrlAt(
|
||||
buffer: { getLine(y: number): IBufferLine | undefined },
|
||||
x: number,
|
||||
y: number,
|
||||
cols = 120
|
||||
) {
|
||||
openUrlMock.mockReset()
|
||||
const opened = openHttpLinkAtBufferPosition(buffer, { x, y }, cols, {
|
||||
worktreeId: 'wt-repro-8832',
|
||||
forceSystemBrowser: true
|
||||
})
|
||||
return { opened, url: openUrlMock.mock.calls[0]?.[0] as string | undefined }
|
||||
}
|
||||
|
||||
describe('#8832 hard-wrapped path candidates glue next-line text into URLs', () => {
|
||||
beforeEach(() => {
|
||||
vi.stubGlobal('navigator', { userAgent: 'Macintosh' })
|
||||
vi.stubGlobal('window', { api: { shell: { openUrl: openUrlMock } } })
|
||||
registerHttpLinkStoreAccessor(() => ({
|
||||
settings: { openLinksInApp: false },
|
||||
setActiveWorktree: vi.fn(),
|
||||
createBrowserTab: vi.fn()
|
||||
}))
|
||||
openUrlMock.mockReset()
|
||||
})
|
||||
|
||||
afterEach(() => {
|
||||
vi.unstubAllGlobals()
|
||||
})
|
||||
|
||||
it('still builds a multi-row path candidate that concatenates Description onto the URL', () => {
|
||||
// Why: documents the path-reconstruction poison that HTTP hit-testing must
|
||||
// not consume. File links remain protected by existence checks.
|
||||
const buffer = issueBuffer()
|
||||
const candidates = buildHardWrappedPathLogicalLineCandidates(buffer, 1)
|
||||
const multiRow = candidates.filter((candidate) => candidate.rows.length > 1)
|
||||
|
||||
expect(multiRow.some((candidate) => candidate.text.includes('Description'))).toBe(true)
|
||||
|
||||
const glued = multiRow.find((candidate) => candidate.text.includes('https://'))
|
||||
expect(glued).toBeDefined()
|
||||
expect(glued!.text).toContain('https://github.com/stablyai/orca/Description')
|
||||
})
|
||||
|
||||
it('HTTP extraction on a path logical line still yields the glued URL', () => {
|
||||
const buffer = issueBuffer()
|
||||
const candidates = buildCandidateLogicalLinesForBufferPosition(buffer, 1)
|
||||
const extracted = candidates.flatMap((line) => extractTerminalHttpLinks(line.text))
|
||||
|
||||
expect(extracted.map((link) => link.url)).toContain(BUGGY_URL)
|
||||
const singleLineUrls = extractTerminalHttpLinks(LINE_1).map((link) => link.url)
|
||||
expect(singleLineUrls).toEqual([EXPECTED_URL])
|
||||
})
|
||||
|
||||
it('openHttpLinkAtBufferPosition opens the unglued URL when Cmd-clicking the URL row', () => {
|
||||
const buffer = issueBuffer()
|
||||
const urlStart = LINE_1.indexOf('https://')
|
||||
const { opened, url } = openUrlAt(buffer, urlStart + 10, 1)
|
||||
|
||||
expect(opened).toBe(true)
|
||||
expect(url).toBe(EXPECTED_URL)
|
||||
expect(url).not.toBe(BUGGY_URL)
|
||||
})
|
||||
|
||||
it.each([
|
||||
['Chinese label', '说明: 中文路径/文件.ts'],
|
||||
['Windows path', 'C:\\Users\\demo\\project\\README.md'],
|
||||
['POSIX path', '/usr/local/bin/orca'],
|
||||
['relative path', './src/main/index.ts'],
|
||||
['UNC-ish path', '\\\\server\\share\\file.txt']
|
||||
])('does not glue a mid-row URL to a next-line %s', (_label, nextLine) => {
|
||||
const row0 = 'See https://example.com/docs/'
|
||||
const buffer = twoRowBuffer(row0, nextLine, { cols: 100 })
|
||||
const urlStart = row0.indexOf('https://')
|
||||
const { opened, url } = openUrlAt(buffer, urlStart + 8, 1)
|
||||
|
||||
expect(opened).toBe(true)
|
||||
expect(url).toBe('https://example.com/docs/')
|
||||
expect(url).not.toMatch(/说明|Users|usr|src|server/)
|
||||
})
|
||||
|
||||
it('still joins a soft-wrapped multi-line URL via native wrap metadata', () => {
|
||||
const cols = 40
|
||||
const url = 'https://example.com/very/long/path/segments/that/continue/more'
|
||||
const row0 = url.slice(0, cols)
|
||||
const row1 = url.slice(cols)
|
||||
const buffer = twoRowBuffer(row0, row1, { cols, softWrapped: true })
|
||||
const first = openUrlAt(buffer, 11, 1, cols)
|
||||
const second = openUrlAt(buffer, 5, 2, cols)
|
||||
|
||||
expect(first.opened).toBe(true)
|
||||
expect(first.url).toBe(url)
|
||||
expect(second.opened).toBe(true)
|
||||
expect(second.url).toBe(url)
|
||||
})
|
||||
|
||||
it('still joins an edge-wrapped multi-line URL without wrap metadata', () => {
|
||||
const cols = 40
|
||||
const url = 'https://example.com/very/long/path/segments/that/continue/more'
|
||||
const row0 = url.slice(0, cols)
|
||||
const row1 = url.slice(cols)
|
||||
expect(row0).toHaveLength(cols)
|
||||
const buffer = twoRowBuffer(row0, row1, { cols, softWrapped: false })
|
||||
const first = openUrlAt(buffer, 11, 1, cols)
|
||||
const second = openUrlAt(buffer, 5, 2, cols)
|
||||
|
||||
expect(first.opened).toBe(true)
|
||||
expect(first.url).toBe(url)
|
||||
expect(second.opened).toBe(true)
|
||||
expect(second.url).toBe(url)
|
||||
})
|
||||
|
||||
it('does not treat file:// as an HTTP link (file routing stays separate)', () => {
|
||||
const row0 = 'open file:///Users/demo/project/README.md'
|
||||
const buffer = twoRowBuffer(row0, 'next: line', { cols: 100 })
|
||||
const { opened, url } = openUrlAt(buffer, row0.indexOf('file://') + 4, 1)
|
||||
|
||||
expect(opened).toBe(false)
|
||||
expect(url).toBeUndefined()
|
||||
})
|
||||
|
||||
it('opens only the HTTP URL when a Windows path shares the same row', () => {
|
||||
const row0 = 'https://example.com/a C:\\Users\\demo\\file.txt'
|
||||
const buffer = twoRowBuffer(row0, 'Description: more', { cols: 100 })
|
||||
const { opened, url } = openUrlAt(buffer, 8, 1)
|
||||
|
||||
expect(opened).toBe(true)
|
||||
expect(url).toBe('https://example.com/a')
|
||||
})
|
||||
})
|
||||
@@ -379,6 +379,44 @@ describe('hard-wrapped terminal HTTP clicks', () => {
|
||||
expect(openUrlMock).toHaveBeenCalledWith('http://example.com/')
|
||||
})
|
||||
|
||||
it('does not glue the next logical line onto a URL that ends mid-row (#8832)', () => {
|
||||
const { terminal, registrations } = makeTerminal({
|
||||
cols: 80,
|
||||
urlRows: ['Repo: https://github.com/stablyai/orca/', 'Description: 123'],
|
||||
softWrapped: false
|
||||
})
|
||||
const disposable = installHttpLinkClickFallback(terminal, { worktreeId: 'wt-1' })
|
||||
|
||||
const fallback = registrations.find(
|
||||
([name, _listener, options]) => name === 'mouseup' && options === undefined
|
||||
)?.[1]
|
||||
fallback!(mouseEventForRow(0))
|
||||
|
||||
expect(openUrlMock).toHaveBeenCalledOnce()
|
||||
expect(openUrlMock).toHaveBeenCalledWith('https://github.com/stablyai/orca/')
|
||||
disposable.dispose()
|
||||
})
|
||||
|
||||
it('still joins a URL hard-wrapped at the row edge without native wrap metadata', () => {
|
||||
const cols = 40
|
||||
const url = 'https://example.com/very/long/path/segments/that/continue/more'
|
||||
const { terminal, registrations } = makeTerminal({
|
||||
cols,
|
||||
urlRows: [url.slice(0, cols), url.slice(cols)],
|
||||
softWrapped: false
|
||||
})
|
||||
const disposable = installHttpLinkClickFallback(terminal, { worktreeId: 'wt-1' })
|
||||
|
||||
const fallback = registrations.find(
|
||||
([name, _listener, options]) => name === 'mouseup' && options === undefined
|
||||
)?.[1]
|
||||
fallback!(mouseEventForRow(0))
|
||||
|
||||
expect(openUrlMock).toHaveBeenCalledOnce()
|
||||
expect(openUrlMock).toHaveBeenCalledWith(url)
|
||||
disposable.dispose()
|
||||
})
|
||||
|
||||
it('does not suppress a modifier-click when the buffer position is not an HTTP link', () => {
|
||||
const { terminal, registrations } = makeTerminal({ urlRows: ['not-a-link'] })
|
||||
const disposable = installHttpLinkClickFallback(terminal, { worktreeId: 'wt-1' })
|
||||
|
||||
@@ -1,10 +1,8 @@
|
||||
import type { IBufferLine, IBufferRange, IDisposable, Terminal } from '@xterm/xterm'
|
||||
import { openHttpLink } from '@/lib/http-link-routing'
|
||||
import {
|
||||
buildCandidateLogicalLinesForBufferPosition,
|
||||
dedupeLogicalLines
|
||||
} from './terminal-file-link-hit-testing'
|
||||
import { buildEdgeWrappedHttpLogicalLineCandidates } from './edge-wrapped-terminal-http-links'
|
||||
import { buildHardWrappedHttpLogicalLineCandidates } from './hard-wrapped-terminal-http-links'
|
||||
import { dedupeLogicalLines } from './terminal-file-link-hit-testing'
|
||||
import { isTerminalHttpLinkActivation } from './terminal-http-link-activation'
|
||||
import { installTerminalLinkPtyMouseSuppression } from './terminal-link-pty-mouse-suppression'
|
||||
import { getTerminalBufferPositionForMouseEvent } from './terminal-mouse-buffer-position'
|
||||
@@ -271,7 +269,10 @@ function findHttpLinkAtBufferPosition(
|
||||
? [nativeWrappedLogicalLine]
|
||||
: []),
|
||||
...buildHardWrappedHttpLogicalLineCandidates(buffer, position.y),
|
||||
...buildCandidateLogicalLinesForBufferPosition(buffer, position.y)
|
||||
...buildEdgeWrappedHttpLogicalLineCandidates(buffer, position.y),
|
||||
...(nativeWrappedLogicalLine && nativeWrappedLogicalLine.rows.length === 1
|
||||
? [nativeWrappedLogicalLine]
|
||||
: [])
|
||||
])
|
||||
if (logicalLines.length === 0) {
|
||||
return null
|
||||
@@ -290,6 +291,17 @@ function findHttpLinkAtBufferPosition(
|
||||
return null
|
||||
}
|
||||
|
||||
function rangeContainsBufferPosition(
|
||||
range: IBufferRange,
|
||||
position: { x: number; y: number },
|
||||
terminalColumns: number
|
||||
): boolean {
|
||||
const lower = range.start.y * terminalColumns + range.start.x
|
||||
const upper = range.end.y * terminalColumns + range.end.x
|
||||
const current = position.y * terminalColumns + position.x
|
||||
return lower <= current && current <= upper
|
||||
}
|
||||
|
||||
export function openTerminalHttpLink(url: string, deps: UrlLinkHitTestDeps): void {
|
||||
if (deps.forceSystemBrowser) {
|
||||
openHttpLink(url, { worktreeId: deps.worktreeId, forceSystemBrowser: true })
|
||||
@@ -316,14 +328,3 @@ export function openTerminalHttpLink(url: string, deps: UrlLinkHitTestDeps): voi
|
||||
openHttpLink(url, { worktreeId: deps.worktreeId, forceSystemBrowser: true })
|
||||
})
|
||||
}
|
||||
|
||||
function rangeContainsBufferPosition(
|
||||
range: IBufferRange,
|
||||
position: { x: number; y: number },
|
||||
terminalColumns: number
|
||||
): boolean {
|
||||
const lower = range.start.y * terminalColumns + range.start.x
|
||||
const upper = range.end.y * terminalColumns + range.end.x
|
||||
const current = position.y * terminalColumns + position.x
|
||||
return lower <= current && current <= upper
|
||||
}
|
||||
|
||||
@@ -2108,6 +2108,18 @@ export function useIpcEvents(): void {
|
||||
})
|
||||
)
|
||||
|
||||
const unsubscribeCertificateFailure = window.api.browser.onCertificateFailureChanged?.(
|
||||
({ browserPageId, failure }) => {
|
||||
if (isRuntimeEnvironmentActive()) {
|
||||
return
|
||||
}
|
||||
useAppStore.getState().setBrowserPageCertificateFailure(browserPageId, failure)
|
||||
}
|
||||
)
|
||||
if (unsubscribeCertificateFailure) {
|
||||
unsubs.push(unsubscribeCertificateFailure)
|
||||
}
|
||||
|
||||
// Why: agent-browser drives navigation via CDP, bypassing Electron's webview
|
||||
// event system. The renderer's did-navigate listener never fires for those
|
||||
// navigations, so the Zustand store (address bar, tab title) stays stale.
|
||||
|
||||
@@ -7,6 +7,29 @@
|
||||
"webDescription": "Retry the web client or reconnect to the paired runtime."
|
||||
}
|
||||
},
|
||||
"browser": {
|
||||
"loadFailure": {
|
||||
"connectionNotSecure": "Connection isn't secure",
|
||||
"cantReachHost": "Can't reach {{value0}}",
|
||||
"cantLoadPage": "Can't load this page",
|
||||
"certificateNameMismatch": "The certificate doesn't match {{value0}}.",
|
||||
"certificateDateInvalid": "The certificate for {{value0}} isn't valid at the current date and time.",
|
||||
"certificateAuthorityInvalid": "Orca doesn't trust the authority that issued the certificate for {{value0}}.",
|
||||
"certificateVerificationFailed": "Orca couldn't verify the certificate for {{value0}}.",
|
||||
"trustedCertificateGuidance": "For local development, use a trusted local certificate when possible.",
|
||||
"retry": "Retry",
|
||||
"copyAddress": "Copy Address",
|
||||
"addressCopied": "Copied the current page address.",
|
||||
"openExternally": "Open Externally",
|
||||
"tryHttps": "Try HTTPS",
|
||||
"proceedUnsafe": "Proceed Anyway (Unsafe)",
|
||||
"connecting": "Connecting…",
|
||||
"certificateChallengeExpired": "This certificate approval expired. Retry the page to request a new one.",
|
||||
"certificateChallengeChanged": "The certificate request changed. Retry the page and review the new warning.",
|
||||
"certificateChallengeUnavailable": "This certificate request is no longer available. Retry the page to request a new one.",
|
||||
"certificateProceedFailed": "Orca could not approve this certificate request. Retry the page and try again."
|
||||
}
|
||||
},
|
||||
"settings": {
|
||||
"appearance": {
|
||||
"language": {
|
||||
|
||||
@@ -13284,5 +13284,28 @@
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"browser": {
|
||||
"loadFailure": {
|
||||
"connectionNotSecure": "Connection isn't secure",
|
||||
"cantReachHost": "Can't reach {{value0}}",
|
||||
"cantLoadPage": "Can't load this page",
|
||||
"certificateNameMismatch": "The certificate doesn't match {{value0}}.",
|
||||
"certificateDateInvalid": "The certificate for {{value0}} isn't valid at the current date and time.",
|
||||
"certificateAuthorityInvalid": "Orca doesn't trust the authority that issued the certificate for {{value0}}.",
|
||||
"certificateVerificationFailed": "Orca couldn't verify the certificate for {{value0}}.",
|
||||
"trustedCertificateGuidance": "For local development, use a trusted local certificate when possible.",
|
||||
"retry": "Retry",
|
||||
"copyAddress": "Copy Address",
|
||||
"addressCopied": "Copied the current page address.",
|
||||
"openExternally": "Open Externally",
|
||||
"tryHttps": "Try HTTPS",
|
||||
"proceedUnsafe": "Proceed Anyway (Unsafe)",
|
||||
"connecting": "Connecting…",
|
||||
"certificateChallengeExpired": "This certificate approval expired. Retry the page to request a new one.",
|
||||
"certificateChallengeChanged": "The certificate request changed. Retry the page and review the new warning.",
|
||||
"certificateChallengeUnavailable": "This certificate request is no longer available. Retry the page to request a new one.",
|
||||
"certificateProceedFailed": "Orca could not approve this certificate request. Retry the page and try again."
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -13284,5 +13284,28 @@
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"browser": {
|
||||
"loadFailure": {
|
||||
"connectionNotSecure": "Connection isn't secure",
|
||||
"cantReachHost": "Can't reach {{value0}}",
|
||||
"cantLoadPage": "Can't load this page",
|
||||
"certificateNameMismatch": "The certificate doesn't match {{value0}}.",
|
||||
"certificateDateInvalid": "The certificate for {{value0}} isn't valid at the current date and time.",
|
||||
"certificateAuthorityInvalid": "Orca doesn't trust the authority that issued the certificate for {{value0}}.",
|
||||
"certificateVerificationFailed": "Orca couldn't verify the certificate for {{value0}}.",
|
||||
"trustedCertificateGuidance": "For local development, use a trusted local certificate when possible.",
|
||||
"retry": "Retry",
|
||||
"copyAddress": "Copy Address",
|
||||
"addressCopied": "Copied the current page address.",
|
||||
"openExternally": "Open Externally",
|
||||
"tryHttps": "Try HTTPS",
|
||||
"proceedUnsafe": "Proceed Anyway (Unsafe)",
|
||||
"connecting": "Connecting…",
|
||||
"certificateChallengeExpired": "This certificate approval expired. Retry the page to request a new one.",
|
||||
"certificateChallengeChanged": "The certificate request changed. Retry the page and review the new warning.",
|
||||
"certificateChallengeUnavailable": "This certificate request is no longer available. Retry the page to request a new one.",
|
||||
"certificateProceedFailed": "Orca could not approve this certificate request. Retry the page and try again."
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -13284,5 +13284,28 @@
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"browser": {
|
||||
"loadFailure": {
|
||||
"connectionNotSecure": "Connection isn't secure",
|
||||
"cantReachHost": "Can't reach {{value0}}",
|
||||
"cantLoadPage": "Can't load this page",
|
||||
"certificateNameMismatch": "The certificate doesn't match {{value0}}.",
|
||||
"certificateDateInvalid": "The certificate for {{value0}} isn't valid at the current date and time.",
|
||||
"certificateAuthorityInvalid": "Orca doesn't trust the authority that issued the certificate for {{value0}}.",
|
||||
"certificateVerificationFailed": "Orca couldn't verify the certificate for {{value0}}.",
|
||||
"trustedCertificateGuidance": "For local development, use a trusted local certificate when possible.",
|
||||
"retry": "Retry",
|
||||
"copyAddress": "Copy Address",
|
||||
"addressCopied": "Copied the current page address.",
|
||||
"openExternally": "Open Externally",
|
||||
"tryHttps": "Try HTTPS",
|
||||
"proceedUnsafe": "Proceed Anyway (Unsafe)",
|
||||
"connecting": "Connecting…",
|
||||
"certificateChallengeExpired": "This certificate approval expired. Retry the page to request a new one.",
|
||||
"certificateChallengeChanged": "The certificate request changed. Retry the page and review the new warning.",
|
||||
"certificateChallengeUnavailable": "This certificate request is no longer available. Retry the page to request a new one.",
|
||||
"certificateProceedFailed": "Orca could not approve this certificate request. Retry the page and try again."
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user