96 lines
4.3 KiB
Markdown
96 lines
4.3 KiB
Markdown
# Task: Remediate X-01 stable preview injection origin
|
|
|
|
## Identity
|
|
|
|
- Task ID: 20260827-x01-injection-origin-6d7a91c4
|
|
- Mode: Feature
|
|
- Branch: codex/20260827-x01-injection-origin-6d7a91c4-x01-injection-origin-6d7a91c4
|
|
- Worktree: D:\Datas\OthersProjects\makelore-x01-injection-origin-6d7a91c4
|
|
- Base commit: 0a4f526c2c6b301a6b7fcaef982bea2f703b41c0
|
|
- Owner: codex
|
|
- Status: Ready for Integration
|
|
|
|
## Scope
|
|
|
|
- X-01 live-acceptance remediation on exact client coordinator product base
|
|
`0a4f526c2c6b301a6b7fcaef982bea2f703b41c0`.
|
|
- Fix the Agent Browser pre-document preview-data injection in
|
|
`electron/agent-browser/module.ts` so a transient early `location.origin`
|
|
does not prevent the capability from becoming available once the target
|
|
Origin is stable.
|
|
- Add only the focused regression in `tests/unit/agent-browser-core.test.ts`
|
|
and this task-scoped record.
|
|
|
|
## Intent And Constraints
|
|
|
|
- Follow spec §10.1/§10.4 and §14 groups 2/13, ticket ML-09, and X-01 live
|
|
acceptance. Preserve explicit opt-in, exact-Origin checking, the existing
|
|
non-enumerable/non-configurable descriptor contract, child/sessionRef
|
|
handling, and foreign-origin absence of the credential value.
|
|
- Live evidence shows CDP script registration and preview-session opening now
|
|
succeed, but packaged Electron sees no `globalThis.__MAKELORE_DATA__` on the
|
|
target page. The one-shot Origin check can run while Chromium reports an
|
|
early `null`/unstable Origin. Use the smallest safe closure-based fix: a
|
|
non-configurable getter resolves the closed-over value only for the exact
|
|
current Origin; it must not expose the credential for another Origin.
|
|
- Do not touch root main, the coordinator worktree, server code, PRs, routes,
|
|
other tests, or unrelated E2E behavior. Do not revert concurrent changes.
|
|
|
|
## Planning Gate
|
|
|
|
- Result: Passed on 2026-08-27.
|
|
- Ran `check_project_docs.py`, released the prior completed task through
|
|
`task_context.py release`, and started this feature task against the exact
|
|
coordinator base. Status JSON matches this task ID, absolute worktree and
|
|
branch, feature mode, and base commit.
|
|
- Read the required project-memory startup set, coordinator task scope,
|
|
relevant Agent Browser architecture/data-flow, spec §10.1/§10.4/§13/§14,
|
|
ticket graph ML-06/ML-09/X-01, and canonical preview contract. The
|
|
coordinator owns the parent path; this isolated task owns only the stated
|
|
module/test/record. Other active scopes are unrelated or placeholders.
|
|
|
|
## Outcome
|
|
|
|
- Replaced the one-shot Origin check in `previewDataInjectionScript` with an
|
|
IIFE closure containing the serialized value and expected Origin. The
|
|
non-enumerable, non-configurable getter returns the closed-over value only
|
|
while the current frame has the exact expected Origin; otherwise it returns
|
|
`undefined`. Child/sessionRef installation and lifecycle cleanup are
|
|
unchanged.
|
|
- Added regression coverage for an early `null` Origin becoming the target
|
|
Origin, foreign-origin denial, descriptor shape, and the getter source not
|
|
containing the credential value.
|
|
|
|
## Plan
|
|
|
|
1. Add a red regression that evaluates the injection script with an early
|
|
`null` Origin, then changes to the target Origin, and verifies the exact
|
|
value, descriptor, and foreign-origin behavior.
|
|
2. Replace the one-shot root injection guard with the smallest closure getter;
|
|
keep injection serialization, child sessions, and lifecycle cleanup intact.
|
|
3. Run focused Agent Browser/preview tests, typecheck, scoped lint, diff/doc
|
|
gates, then make one clean commit.
|
|
|
|
## Verification
|
|
|
|
- Red-first regression before the implementation failed: after the simulated
|
|
`null` → target Origin transition, `__MAKELORE_DATA__` remained `undefined`.
|
|
- `corepack pnpm vitest run tests/unit/agent-browser-core.test.ts` — 1 file,
|
|
77 tests passed.
|
|
- `corepack pnpm run typecheck` — passed.
|
|
- `corepack pnpm exec eslint electron/agent-browser/module.ts
|
|
tests/unit/agent-browser-core.test.ts` — passed.
|
|
- `git diff --check` — passed.
|
|
- No live/Electron E2E was run here; the coordinator must rerun X-01 live
|
|
acceptance after integration.
|
|
|
|
## Follow-ups
|
|
|
|
- Integrate the single commit into the client coordinator and rerun the
|
|
packaged Electron X-01 preview write/read with real PostgreSQL and a signed-in
|
|
preview. Focused repository tests do not establish live acceptance.
|
|
|
|
## Promotion Candidates
|
|
|
|
- None recorded.
|