skills/pbakaus_impeccable
1
0
Fork 0
mirror of https://github.com/pbakaus/impeccable.git synced 2026-09-12 14:16:28 +03:00
Code Issues Packages Projects Releases Wiki Activity

Oracle: record the engine's 'wasm-unsafe-eval' CSP meta patch as a reviewed delta

Browse Source 
Prepared with AI assistance (Claude Code).
This commit is contained in:
Paul Bakaus
2026-08-31 20:00:04 -07:00
parent fa1dfd0c43
commit b45da84d12
2 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/oracle/DELTAS.md
+9
View File
@@ -24,3 +24,12 @@ is that wording; behavior, exit codes, and every other byte are unchanged.
- `hook-session-fresh-then-pending-then-stop`, `hook-session-two-sessions`, `hbe-denial-downgrade-after-6`: the short footer names `impeccable hooks ignore-value`.
- `live-help`, `live-accept-help`, `live-inject-help`, `live-insert-help`, `live-server-help`, `live-resume-help`, `live-commit-help`, `live-discard-help`, `live-complete-help`, `live-complete-no-id`: usage text names `impeccable live*` verbs.
- `live-server-already-running`, `live-daemon-server-status-poll-complete`, `live-status-empty`, `live-status-generating`, `live-status-many-sessions`, `live-status-stale-server-json`, `live-status-legacy-sessions-dir`, `live-status-from-subdir`, `live-status-manual-apply`, `live-resume-manual-apply`, `live-status-mount-failed`, `live-resume-mount-failed`, `live-resume-generating`, `live-resume-by-id`, `live-resume-first-active-sorted`, `live-resume-accept-requested`, `live-resume-carbonize-required`: recovery hints and next-command lines spell `<self> live-poll` / `live-server` / `live-complete` / `live-commit-manual-edits` instead of the `.mjs` names.
## Recorded 2026-08-17: live-inject adds `'wasm-unsafe-eval'` to a CSP meta script-src
The detector the live overlay loads from the helper origin is a WebAssembly
module in the engine (its `docs/WASM-BUNDLE.md`); a `script-src` that names the
origin but not `'wasm-unsafe-eval'` still refuses to compile it. The JS
`patchCspMeta` predates the wasm bundle and appended only the origin.
- `live-inject-csp-meta-no-connect-src`: the patched `<meta http-equiv="Content-Security-Policy">` reads `script-src 'self' http://localhost:8412 'wasm-unsafe-eval'` (was `script-src 'self' http://localhost:8412`). The `data-impeccable-csp-original` marker, the `connect-src` and `img-src` additions, idempotence, and the revert on unpatch are unchanged. `live-inject-vite-csp-meta` and `live-inject-next-jsx` carry meta tags the patch does not touch, so their goldens did not move.
tests/oracle/golden/live-inject-csp-meta-no-connect-src.json
+1 -1
View File
@@ -7,6 +7,6 @@
".gitignore": "# impeccable-live-ignore-start\n.impeccable/hook.cache.json\n.impeccable/hook.pending.json\n.impeccable/config.local.json\n.impeccable/live/server.json\n.impeccable/live/roots.json\n.impeccable/live/app-root.json\n.impeccable/live/inject-journal.json\n.impeccable/live/sessions/\n.impeccable/live/previews/\n.impeccable/live/annotations/\n.impeccable/live/artifacts/\n.impeccable/live/accept-receipts/\n.impeccable/live/locks/\n.impeccable/live/cache/\n.impeccable/live/manual-edit-apply-transaction.json\n.impeccable/live/manual-edit-events.jsonl\n.impeccable/live/manual-edit-evidence/\n.impeccable/live/pending-manual-edits.json\n.impeccable/live/deferred-svelte-component-accepts.json\n.impeccable-live.json\n.impeccable-live/\napp/.impeccable-live/\nsrc/.impeccable-live/\nnode_modules/.impeccable-live/\nsrc/lib/impeccable/ImpeccableLiveRoot.svelte\nsrc/lib/impeccable/__runtime.js\nsrc/lib/impeccable/[0-9a-f]*/\nplugins/impeccable-live.client.ts\napp/plugins/impeccable-live.client.ts\nsrc/plugins/impeccable-live.client.ts\n# impeccable-live-ignore-end\n",
".impeccable/live/config.json": "{\n \"files\": [\"index.html\", \"public/**/*.html\"],\n \"insertBefore\": \"</body>\",\n \"commentSyntax\": \"html\"\n}\n",
".impeccable/live/inject-journal.json": "{\n \"version\": 1,\n \"appRoot\": \"<WS>\",\n \"framework\": \"static-html\",\n \"port\": 8412,\n \"pid\": <PID>,\n \"recordedAt\": \"<ISO>\",\n \"artifacts\": [\n {\n \"kind\": \"patched\",\n \"path\": \"index.html\",\n \"patch\": \"live-tag\",\n \"markers\": [\n \"impeccable-live-start\",\n \"data-impeccable-csp-original\"\n ]\n },\n {\n \"kind\": \"patched\",\n \"path\": \"public/docs/guide.html\",\n \"patch\": \"live-tag\",\n \"markers\": [\n \"impeccable-live-start\",\n \"data-impeccable-csp-original\"\n ]\n }\n ]\n}\n",
"index.html": "<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Security-Policy\" content=\"default-src 'self'; script-src 'self' http://localhost:8412; connect-src 'self' http://localhost:8412; img-src 'self' blob:\" data-impeccable-csp-original=\"ZGVmYXVsdC1zcmMgJ3NlbGYnOyBzY3JpcHQtc3JjICdzZWxmJw==\">\n</head>\n<body>\n<h1 class=\"hero-title\">Hi</h1>\n<!-- impeccable-live-start -->\n<script src=\"http://localhost:8412/live.js?token=t\"></script>\n<!-- impeccable-live-end -->\n</body>\n</html>\n"
"index.html": "<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Security-Policy\" content=\"default-src 'self'; script-src 'self' http://localhost:8412 'wasm-unsafe-eval'; connect-src 'self' http://localhost:8412; img-src 'self' blob:\" data-impeccable-csp-original=\"ZGVmYXVsdC1zcmMgJ3NlbGYnOyBzY3JpcHQtc3JjICdzZWxmJw==\">\n</head>\n<body>\n<h1 class=\"hero-title\">Hi</h1>\n<!-- impeccable-live-start -->\n<script src=\"http://localhost:8412/live.js?token=t\"></script>\n<!-- impeccable-live-end -->\n</body>\n</html>\n"
}
}