Hibryda
ccbdc1b2b1
feat(e2e): Electrobun CEF E2E working — 13/18 specs pass!
...
Root cause: CEF views:// protocol can't serve ES modules.
Fix: navigate CEF to Vite dev server (http://localhost:9760/ ) via
ChromeDriver after launch. Graceful RPC degradation (no-ops when
RPC not initialized) allows app to mount without native bridge.
Results: 13 PASS, 5 FAIL (smoke, settings, theme, notifications,
diagnostics — selector differences, not infrastructure issues)
2026-03-22 07:46:47 +01:00
Hibryda
1cd4558740
fix(electrobun): address all 22 Codex review #2 findings
...
CRITICAL:
- DocsTab XSS: DOMPurify sanitization on all {@html} output
- File RPC path traversal: guardPath() validates against project CWDs
HIGH:
- SSH injection: spawn /usr/bin/ssh via PTY args, no shell string
- Search XSS: strip HTML, highlight matches client-side with <mark>
- Terminal listener leak: cleanup functions stored + called in onDestroy
- FileBrowser race: request token, discard stale responses
- SearchOverlay race: same request token pattern
- App startup ordering: groups.list chains into active_group restore
- PtyClient timeout: 5-second auth timeout on connect()
- Rule 55: 6 {#if} patterns converted to style:display toggle
MEDIUM:
- Agent persistence: only persist NEW messages (lastPersistedIndex)
- Search errors: typed error response, "Invalid query" UI
- Health store wired: agent events call recordActivity/setProjectStatus
- index.ts SRP: split into 8 domain handler modules (298 lines)
- App.svelte: extracted workspace-store.svelte.ts
- rpc.ts: typed AppRpcHandle, removed `any`
LOW:
- CommandPalette listener wired in App.svelte
- Dead code removed (removeGroup, onDragStart, plugin loaded)
2026-03-22 02:30:09 +01:00
Hibryda
29a3370e79
fix(electrobun): address all 20 Codex review findings
...
CRITICAL:
- PTY leak: Terminal.svelte now calls pty.close on destroy, not just unsubscribe
- Agent session cleanup: clearSession() removes done/error sessions, backend
deletes after 60s grace period
HIGH:
- Clone branch passthrough: user's branch name flows through callback
- Circular imports: extracted rpc.ts singleton, broke main.ts ↔ App.svelte cycle
- Settings wired to runtime: Terminal reads cursor/scrollback from settings
- Security disclaimer: added "prototype — not system keyring" notice
- ThemeEditor: fixed basePalette → initialPalette reference
MEDIUM:
- Clone race: UUID suffix instead of count-based index
- Silent failures: structured error returns from PTY handlers
- WebKitGTK mount: only current + previous group mounted
- Debug listeners: gated behind DEBUG, cleanup on destroy
- NDJSON residual buffer parsed on process exit
- Codex adapter: deduplicated tool_call/tool_result
- extraEnv: rejects CLAUDE*/CODEX*/OLLAMA* keys
- settings-db: runMigrations() with version tracking
- active_group: persisted via settings.set
LOW:
- Removed dead demo code, unused variables
- color-mix() fallbacks added
2026-03-22 01:20:23 +01:00
