mirror of
https://github.com/stablyai/orca.git
synced 2026-09-23 08:02:31 +00:00
* feat(mobile): put media picking behind a platform seam (OTA phase C, C7.6) The session screen picks images three ways — the photo library, Files, and the pasteboard — and all three are native modules a page cannot import: the codegen lookup `expo-image-picker` and `expo-document-picker` run at import throws in a browser, and the route manifest imports every route, so one of them in a page closure is the whole bundle down rather than one picker. `src/platform/media-picker.ts` is the phone's, delegating to the same three calls the screen already made. `.web.ts` is the page's: `native.media.pick`, then `read` in order to `eof`, then `release` for every handle it was handed, including the ones its caller never took — the shell holds eight staged files at a time and an abandoned pick otherwise waits out the five-minute TTL. A refusal rejects with the shell's code on it and is never folded into the empty answer that means the user cancelled. The bytes are concatenated decoded and encoded once, because the wire promises `eof` and nothing about the length: a shell answering a range shorter than the one asked for ends a chunk on a partial base64 group, and a reader joining the strings would fold that padding into the middle of the file. The census walks the session route module's own closure — the route is not registered until C7.7 — and names any module that reaches a picker or `Clipboard.getImageAsync` directly. Today that is the two modules C7.6's next commit moves, listed by name so the list goes empty rather than the rule going quiet. Inert: nothing calls the seam yet. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * feat(mobile): put the session's paste and attach on the media seam (OTA phase C, C7.6) The terminal paste read the pasteboard through `expo-clipboard` directly and the two attach paths called `pickMobileImage`/`pickMobileImages`, so the page's closure carried `expo-image-picker` and `expo-document-picker` — native modules whose import throws in a browser. All three now go through the seam. Text is `native.clipboard.read` on the page, which the clipboard seam gains a reader for: `expo-clipboard` resolves to `navigator.clipboard` there, which needs a secure context the iOS shell's custom scheme is not. An image is `pick { source: 'clipboard' }` rather than an inline value, because a clipboard image is 24 MiB of base64 against an 8 MiB reply ceiling. The census over the session closure is empty now and asserts the seam is in it, so a rule that found nothing is one that had something to find: with the three call sites restored it names all three. `mobile-image-source-picker.ts` stays the phone's implementation, reached only through the seam's native sibling, and resolves out of the web closure entirely. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * feat(mobile): resize a clipboard image on the page with a canvas (OTA phase C, C7.6) The paste hook carried the raster shrink inline over `expo-image-manipulator` and two `expo-file-system` writes. Both are native: the manipulator has no browser build, and the temp file exists only to work around an iOS loader that cannot decode a large base64 data URI, which a browser does not need. Split into `mobile-clipboard-image-resize.ts`, unchanged, and a `.web.ts` that decodes one `<img>` from the data URL the shell's `img-src 'self' data:` already admits, draws it into a canvas at the target size and reads the PNG back out of `toDataURL`. It reports the canvas's own size rather than the size asked for, because a browser clamps a canvas past its area limit and the downscale loop above would otherwise retry a raster that never shrank; and it awaits `decode()` rather than `onload`, which never fires for a source the browser cannot read and would leave the paste waiting on a promise nothing settles. Measured in Chromium under the shipped header, on a noise PNG because that is what PNG compresses least: 1400x1000 encodes to 5,476,032 base64 characters and converges in one pass to 368x263 and 397,220, which is 75.8% of the upload path's 512 KiB chunk. Zero policy violations and zero page errors. Red under three mutations: the source returned unchanged, a reported size the canvas did not draw, and `onload` in place of `decode()`. `computeMobileClipboardImageDownscale` moves to a leaf for the reason the upload-chunk constant has one: the check wants the arithmetic and not the upload path's RPC operations behind it. The page closure now carries none of `expo-image-picker`, `expo-document-picker`, `expo-image-manipulator` or `expo-file-system`, pinned beside the seam census. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * feat(mobile): give the two WebView editors their plain web fallbacks (OTA phase C, C7.6) `MobileRichMarkdownEditor` and `MobileHtmlPreview` are the session closure's other two `react-native-webview` consumers. On the web that package renders the line "React Native WebView does not support this platform" where the surface was, so nothing it was mounted for works and the closure pays for a module that cannot do its job. Ruling 8: each gets the plain state it already degrades to, and no second renderer. The editor renders the Markdown source in one field on the text-input seam, so the screen around it keeps the text, every edit through `onChange`, and Save, Discard, Copy and Refresh; the degradation is the formatting toolbar, whose fifteen commands are the rich document's. The preview renders its own Source tab; the degradation is the rendered artifact, and the toggle goes with it, because a control that can only be in one position is a control that lies. Neither is smaller than a DOM renderer, which is why neither is one here. The editor's toolbar would need a `contenteditable` implementation with its own escaping, and the preview has no nested frame to sandbox agent-produced HTML in at all — the shell's policy carries `frame-src 'none'` and `child-src 'none'`. `dismissKeyboard` blurs the field rather than calling `Keyboard.dismiss`, which is a stub on React Native Web; `onKeyboardInsetChange` is never called, because it exists to correct for a WebView's covered area and on the page `keyboard-occlusion.web.ts` is the only measurement there is. The closure census names the one consumer left, `TerminalWebView.tsx`, which is C7.5's: with both siblings removed it names all three. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * fix(mobile): read a destructured clipboard alias in the media census (OTA phase C, C7.6) The census recognised `Clipboard.getImageAsync` as a property access and nothing else, so `const { getImageAsync } = Clipboard` reached the same function without ever writing one and the closure was approved. On the page that call is `navigator.clipboard`, which needs a secure context the iOS shell's custom scheme is not, so the approval was for a path that dies at the browser clipboard API. Aliases are now resolved to a fixpoint — `const pasteboard = Clipboard` makes `pasteboard` the module too, and the chain has no length limit — and a destructuring off any of them is reported at its declaration, which is the line to delete. The destructured name is read the way the import clause's is, off `propertyName` when the element renames it, so `{ getImageAsync: readImage }` is the same offence spelled differently. A binding element's `name` can be a nested pattern and a `propertyName` can be computed, so the text is taken only off a node that has one. Red-first with each shape planted in the scratch tree before the rule moved: the plain destructuring, the renamed one and the re-destructured chain were all missed. Dropping the fixpoint afterwards loses the chain; reading the local name instead of the property loses the rename. `{ getStringAsync } = Clipboard` stays unreported, because text off the pasteboard is the clipboard seam's and not this rule's. The session closure is still empty under the widened rule. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * fix(mobile): release every item a clipboard pick answered (OTA phase C, C7.6) `readClipboardImage` destructured the first staged item and released only that one, while `pickImage` already guards the same shape through `readPicked`. `multiple: false` is what the page asks for and not what a shell promises, so a caller taking the first of several would hold the rest against the eight-handle cap until the five-minute TTL. Today's shell stages at most one on the clipboard arm, so this is the seam's own docstring made true rather than a leak in the field. Red-first with two staged clipboard items: releasing only the one read leaves `media-2` held, and the second is now returned without ever being read, which is what the single-image pick does. The refusal case is one path over both codes a pick can answer with: the registry's `native_media_handle_cap`, raised before a picker runs, and ruling 6c's `native_media_too_large`, raised once a picked item has been weighed. A code outside the seam's vocabulary floors to `native_verb_failed` rather than crossing verbatim, which is what makes naming the exact code load-bearing. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * test(mobile): read the upload chunk from its module in the resize check (OTA phase C, C7.6) The canvas resize check restated `512 * 1024` as the budget it holds a run to. A check carrying its own copy of a product constant is one that goes on passing after the upload path's chunk has moved, which is the reason the harness reads the CSP, the protocol version and the window caps out of their own sources. `readClipboardImageUploadChunkBase64Chars` joins them, evaluating the product the way the window caps reader does. Proved live by moving the constant: at 64 MiB the run reds on the fixture no longer being over the budget, and it is back to 512 KiB here. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * fix(mobile): read element access in the media census and correct two claims (OTA phase C, C7.6) Round 2, four lows. The census read `Clipboard.getImageAsync` and not `Clipboard['getImageAsync']`, which is the same call, the spelling a bundler produces, and the one a reader reaches for to get around a rule about dots. Element access with a string literal is now read the same way; a computed key is not, because its value is not in the source and guessing would report a line nobody can act on. The closure test cannot back this up — `expo-clipboard` legitimately sits in the session closure — so the scratch fixture is the whole of the evidence, and it reds with the arm removed. The fixture also could not tell the alias fixpoint from one source-order pass: every planted chain happened to be declared in the order a single walk learns it. `reverse-order-alias.ts` is declared back to front, and is valid at run time because the destructure sits inside a function the module body finishes before anything calls. Bounding the loop to one pass now reds it. The canvas resize justified reading its size back off the element by a browser clamping past its area limit. That is not what browsers do: the width attribute reflects whatever it was assigned, so the returned size is always the target. The real reason is narrower and is now what the comment and the override entry say — the dimensions and the bytes come from one element, so a caller's bookkeeping cannot describe a raster that was not encoded. The override entry also carried a stray apostrophe in `img-src 'self' data:`. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * fix(mobile): say what the clipboard contract shipped as, and read a backticked key (OTA phase C, C7.6) Round 3, three lows. The merge took main's `clipboard.ts` byte for byte, so its reader docstring still described the state C7.2 shipped: one verb on the web, and a page whose lack of an image verb degraded into the old path. The design that shipped is the other one — this seam owns the pasteboard on both platforms and the page's `readImage` runs `native.media.pick { source: 'clipboard' }` with the chunked read behind it. The prose now says that, and says that null still means an empty pasteboard while every other outcome rejects. The same merge left `clipboard` twice in the paste hook's dependency list, one from each side. Deduped. The census read a quoted element-access key and not a backticked one, so ``Clipboard[`getImageAsync`]`` escaped a rule that catches both other spellings. A template with no substitution is a string literal with a different quote, and reading only one of the two leaves the other as the way around. The computed-key plant could not see the literal-kind check at all: its variable was named `key`, so reading the identifier's text found nothing either way. It is now named after the method and holds a different one, which makes dropping the kind check a false positive on a call that reads text. Red-first: the backticked access planted before the rule moved is missed; ignoring template keys afterwards misses it again; accepting any key node reports the computed plant. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * fix(mobile): hold canPickMedia to all three verbs and seed the census from import() (OTA phase C, C7.6) Two bot findings. `canPickMedia` answered true on `native.media.pick` and `native.media.read` alone, but every image read releases what it picked. On a route without `native.media.release` the release rejects, the cleanup swallows it by design, and the staged file stays live to the five-minute TTL: eight pastes and the next pick is refused at the handle cap, with nothing on screen to say why. A route missing one verb has no working image path, so `contents()` now says so up front rather than after four of them. Red-first: a route granted pick and read but not release answered `image: true`. The census seeded its aliases from static import and export declarations only, so `const Clipboard = await import('expo-clipboard')` produced no offender — while the bundler resolves a literal dynamic import into the closure exactly as a static one. A dynamic import is now read wherever it appears: `await` and parentheses unwrapped, the assigned identifier seeded as an alias, a destructuring off one reported at its declaration, and a picker module reported at the call, since reaching one at all is the offence. A specifier that is not a literal is left alone, for the reason a computed key is. Red-first with all three forms planted and the seeding removed: the namespace alias, the destructuring and the picker import are each missed. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb * fix(mobile): seed the media census from a backticked import() too (OTA phase C, C7.6 bots) CodeRabbit: `import(`expo-image-picker`)` is as static to the bundler as the quoted form, but the census read only a string literal specifier, so a backticked one joined the closure unseen. A no-substitution template literal now seeds it the same way; the planted fixture is reported at its line and was unreported before the arm. pullfrog: the clipboard seam's docstring counted the web read as two verbs where its web sibling counts one for text and three for an image. It now counts the same way in both files. Claude-Session: https://claude.ai/code/session_01JNnE9qzUZMMnqpZWCqM3nb
184 lines
9.4 KiB
JavaScript
184 lines
9.4 KiB
JavaScript
/**
|
|
* What the session screen may reach to pick media, which is what its media grants are declared
|
|
* against.
|
|
*
|
|
* The route is not registered yet (C7.7 registers it), so this walks the route module's own closure
|
|
* rather than a page route's. The bundler resolves it exactly as it would a registered one — a
|
|
* `.web.ts` sibling wins — so the modules judged here are the ones the page would run.
|
|
*
|
|
* `expo-image-picker` and `expo-document-picker` throw at import in a browser and the manifest
|
|
* imports every route, so one of them in this closure is the whole bundle down rather than one
|
|
* picker; `expo-clipboard`'s `getImageAsync` resolves instead to a `navigator.clipboard` read
|
|
* needing a secure context, which the iOS shell's custom scheme is not.
|
|
*/
|
|
import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
|
|
import { tmpdir } from 'node:os'
|
|
import { join } from 'node:path'
|
|
import { fileURLToPath } from 'node:url'
|
|
import { describe, expect, it } from 'vitest'
|
|
import { mobileWebAppRouteClosure } from './build-mobile-web-app-bundle.mjs'
|
|
import { mobileWebAppDependenciesPresent } from './mobile-web-app-bundle-dependencies.mjs'
|
|
import {
|
|
MEDIA_PICKER_SEAM as SEAM,
|
|
mediaPickerOffenders,
|
|
mediaPickerSites
|
|
} from './mobile-web-app-media-picker-seam.mjs'
|
|
|
|
const mobileDir = fileURLToPath(new URL('../../mobile/', import.meta.url))
|
|
const describeClosure = mobileWebAppDependenciesPresent() ? describe : describe.skip
|
|
|
|
const SESSION = 'app/h/[hostId]/session/[worktreeId].tsx'
|
|
|
|
describeClosure(
|
|
'the session page closure',
|
|
() => {
|
|
it('reaches no picker but the seam', async () => {
|
|
const closure = await mobileWebAppRouteClosure(SESSION)
|
|
expect(mediaPickerOffenders(mobileDir, closure)).toEqual([])
|
|
})
|
|
|
|
it('carries the seam, so the rule above is not vacuous', async () => {
|
|
const closure = await mobileWebAppRouteClosure(SESSION)
|
|
expect(closure.local).toContain(SEAM)
|
|
// And not the native picker chain it stands in for: the two modules that reach the OS
|
|
// pickers resolve out of this closure entirely rather than sitting in it unused.
|
|
expect(closure.local).not.toContain('src/platform/media-picker.ts')
|
|
expect(closure.local).not.toContain('src/session/mobile-image-source-picker.ts')
|
|
})
|
|
|
|
it('carries none of the four native media modules at all', async () => {
|
|
const closure = await mobileWebAppRouteClosure(SESSION)
|
|
// Beyond the source rule: the seam and the canvas resize together take the pickers, the
|
|
// manipulator and the file system out of the bundle rather than leaving them in it unused.
|
|
// Each is a native module whose web build is absent or a stub, and `expo-file-system` was
|
|
// here only to read a picked file and to hold the manipulator's temp PNG.
|
|
for (const absent of [
|
|
'expo-image-picker',
|
|
'expo-document-picker',
|
|
'expo-image-manipulator',
|
|
'expo-file-system'
|
|
]) {
|
|
expect(
|
|
closure.modules.filter((module) => module.includes(`/${absent}/`)),
|
|
absent
|
|
).toEqual([])
|
|
}
|
|
expect(closure.local).toContain('src/session/mobile-clipboard-image-resize.web.ts')
|
|
})
|
|
|
|
it('is big enough that finding nothing would mean something', async () => {
|
|
const closure = await mobileWebAppRouteClosure(SESSION)
|
|
// The largest route of the series; a closure that collapsed would pass every rule above by
|
|
// containing nothing to judge.
|
|
expect(closure.local.length).toBeGreaterThan(900)
|
|
})
|
|
},
|
|
240_000
|
|
)
|
|
|
|
/**
|
|
* The rule itself, against modules planted in a scratch tree.
|
|
*
|
|
* A scan that happens to find today's three call sites is not a scan that would find a fourth, and
|
|
* the negatives matter as much: this closure is full of `expo-clipboard` text reads that are the
|
|
* clipboard seam's business and not this one's.
|
|
*/
|
|
describe('the rule that reads a module for a picker', () => {
|
|
const PLANTED = {
|
|
'namespace-picker.ts':
|
|
"import * as ImagePicker from 'expo-image-picker'\nexport const p = ImagePicker",
|
|
'documents.ts':
|
|
"import { getDocumentAsync } from 'expo-document-picker'\nexport const d = getDocumentAsync",
|
|
'side-effect.ts': "import 'expo-image-picker'",
|
|
're-export.ts': "export { getImageAsync } from 'expo-clipboard'",
|
|
'clipboard-image.ts':
|
|
"import * as Clipboard from 'expo-clipboard'\nexport const r = () => Clipboard.getImageAsync({ format: 'png' })",
|
|
'renamed-image-read.ts':
|
|
"import { getImageAsync as readImage } from 'expo-clipboard'\nexport const r = readImage",
|
|
'destructured.ts':
|
|
"import * as Clipboard from 'expo-clipboard'\nconst { getImageAsync } = Clipboard\nexport const r = getImageAsync",
|
|
'destructured-renamed.ts':
|
|
"import * as Clipboard from 'expo-clipboard'\nconst { getImageAsync: readImage } = Clipboard\nexport const r = readImage",
|
|
're-destructured.ts':
|
|
"import * as Clipboard from 'expo-clipboard'\nconst pasteboard = Clipboard\nconst again = pasteboard\nconst { getImageAsync } = again\nexport const r = getImageAsync",
|
|
'element-access.ts':
|
|
"import * as Clipboard from 'expo-clipboard'\nexport const r = () => Clipboard['getImageAsync']({ format: 'png' })",
|
|
'template-access.ts':
|
|
"import * as Clipboard from 'expo-clipboard'\nexport const r = () => Clipboard[`getImageAsync`]({ format: 'png' })",
|
|
// A key held in a variable is not read: its value is not at the call site, and a census
|
|
// reporting a line nobody can act on is one the next reader learns to ignore. The variable is
|
|
// named after the method and holds a different one, so a rule that read the identifier's text
|
|
// instead of a literal's would report a call that reads text.
|
|
'computed-access.ts':
|
|
"import * as Clipboard from 'expo-clipboard'\nconst getImageAsync = 'getStringAsync'\nexport const r = () => Clipboard[getImageAsync]()",
|
|
// Deliberately back to front: the alias `first` reads from `second`, which is only learned
|
|
// further down. Valid at run time, because the destructure is inside a function the module
|
|
// body has finished before anything calls. A walk that learned aliases in source order would
|
|
// never reach `first`, and this is the fixture that says so.
|
|
'reverse-order-alias.ts':
|
|
"import * as Clipboard from 'expo-clipboard'\nexport function read() {\n const { getImageAsync } = first\n return getImageAsync\n}\nconst first = second\nconst second = Clipboard",
|
|
// Reached through `import()`, which the bundler resolves into the closure exactly as a static
|
|
// import: the same two modules, the same offence, a form the static scan cannot see.
|
|
'dynamic-clipboard.ts':
|
|
"export async function r() {\n const Clipboard = await import('expo-clipboard')\n return Clipboard.getImageAsync({ format: 'png' })\n}",
|
|
'dynamic-destructured.ts':
|
|
"export async function r() {\n const { getImageAsync } = await import('expo-clipboard')\n return getImageAsync({ format: 'png' })\n}",
|
|
'dynamic-picker.ts':
|
|
"export async function r() {\n return await import('expo-image-picker')\n}",
|
|
// A backticked specifier without substitutions is as static as the quoted one to the bundler.
|
|
'dynamic-template-picker.ts':
|
|
'export async function r() {\n return await import(`expo-image-picker`)\n}',
|
|
'dynamic-clipboard-text.ts':
|
|
"export async function r() {\n const Clipboard = await import('expo-clipboard')\n return Clipboard.getStringAsync()\n}",
|
|
'clipboard-text.ts':
|
|
"import * as Clipboard from 'expo-clipboard'\nexport const r = () => Clipboard.getStringAsync()",
|
|
'destructured-text.ts':
|
|
"import * as Clipboard from 'expo-clipboard'\nconst { getStringAsync } = Clipboard\nexport const r = getStringAsync",
|
|
'mentions-only.ts':
|
|
"// expo-image-picker and Clipboard.getImageAsync are reached through the seam\nexport const note = 'expo-document-picker'"
|
|
}
|
|
|
|
it('names every way in and nothing else', () => {
|
|
const scratch = mkdtempSync(join(tmpdir(), 'orca-session-media-picker-'))
|
|
try {
|
|
mkdirSync(join(scratch, 'src'), { recursive: true })
|
|
for (const [name, source] of Object.entries(PLANTED)) {
|
|
writeFileSync(join(scratch, 'src', name), source)
|
|
}
|
|
const closure = { local: Object.keys(PLANTED).map((name) => `src/${name}`) }
|
|
expect(mediaPickerOffenders(scratch, closure)).toEqual([
|
|
'src/clipboard-image.ts:2',
|
|
'src/destructured-renamed.ts:2',
|
|
'src/destructured.ts:2',
|
|
'src/documents.ts:1',
|
|
'src/dynamic-clipboard.ts:3',
|
|
'src/dynamic-destructured.ts:2',
|
|
'src/dynamic-picker.ts:2',
|
|
'src/dynamic-template-picker.ts:2',
|
|
'src/element-access.ts:2',
|
|
'src/namespace-picker.ts:1',
|
|
'src/re-destructured.ts:4',
|
|
'src/re-export.ts:1',
|
|
'src/renamed-image-read.ts:1',
|
|
'src/reverse-order-alias.ts:3',
|
|
'src/side-effect.ts:1',
|
|
'src/template-access.ts:2'
|
|
])
|
|
} finally {
|
|
rmSync(scratch, { recursive: true, force: true })
|
|
}
|
|
})
|
|
|
|
it('reads a .ts generic arrow as TypeScript, so nothing after one is swallowed', () => {
|
|
const source =
|
|
"import * as Clipboard from 'expo-clipboard'\n" +
|
|
'export const id = <T,>(value: T) => value\n' +
|
|
'export const r = () => Clipboard.getImageAsync({ format: "png" })\n'
|
|
expect(mediaPickerSites(source, 'src/generic.ts')).toEqual([3])
|
|
})
|
|
|
|
it('exempts the seam itself, which is the one module allowed to reach them', () => {
|
|
expect(mediaPickerOffenders(mobileDir, { local: [SEAM] })).toEqual([])
|
|
})
|
|
})
|