Claude Fable 5
0875e2a087
All checks were successful
CI / Build container images (push) Has been skipped
CI / Lint, typecheck, test (push) Successful in 2m57s
CI / Import/export fidelity gate (push) Successful in 46s
CD / Build and push images (push) Successful in 3m16s
CD / Deploy to Test (push) Successful in 8s
CI / Auth e2e pack (push) Successful in 4m8s
CD / Smoke tests against Test (push) Successful in 1m9s
CD / Promote to Int (push) Successful in 10s
Implements the security core of the plugin system: code-plugin surfaces run in opaque-origin iframes (sandbox="allow-scripts", never allow-same-origin) with a capability-filtered RPC bridge. - api: serve a per-plugin sandbox frame document at /plugins/:id/:version/frame with a CSP that pins every load to the plugin's own asset path (built from APP_BASE_URL, not the request Host, so a Host-rewriting proxy cannot break it) and forbids network access (connect-src 'none'). Plugin assets get Access-Control-Allow-Origin: * so the null-origin frame can load its own module bundle. - web: sandbox-host creates the frame, wires the SDK host bridge over a source-filtered postMessage transport, drives render under a 5 s deadline (hung/failed plugin -> placeholder, never a frozen page), and tears down on unmount. PluginFrame/PluginPreviewPage surface it; the built-in ui.resize handler clamps plugin-requested heights. - plugin-sdk: host bridge reports gate violations via onViolation and registers a gated handler for every v1 method, so an undeclared capability is rejected with capability_not_permitted (not unknown_method). - tests: SDK gate unit test; web sandbox unit tests (opaque origin, source filtering, timeout); and the e2e security pack with a permanent malicious fixture plugin proving no escape (DOM/cookies/storage/fetch/ undeclared capability all blocked) plus well-behaved and hung cases. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1
56 lines
1.6 KiB
JSON
56 lines
1.6 KiB
JSON
{
|
|
"name": "@dorfteich/web",
|
|
"version": "0.0.0",
|
|
"private": true,
|
|
"description": "Dorfteich single-page application",
|
|
"license": "MIT",
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite",
|
|
"build": "vite build",
|
|
"preview": "vite preview",
|
|
"typecheck": "tsc --noEmit",
|
|
"test": "vitest run --passWithNoTests",
|
|
"e2e": "playwright test"
|
|
},
|
|
"dependencies": {
|
|
"@dorfteich/plugin-sdk": "workspace:*",
|
|
"@dorfteich/shared": "workspace:*",
|
|
"@hocuspocus/provider": "^4.3.0",
|
|
"@hookform/resolvers": "^5.4.0",
|
|
"@tanstack/react-query": "^5.66.0",
|
|
"@tiptap/core": "^3.27.1",
|
|
"@tiptap/extension-bubble-menu": "^3.27.1",
|
|
"@tiptap/extension-collaboration": "^3.27.1",
|
|
"@tiptap/extension-collaboration-caret": "^3.27.1",
|
|
"@tiptap/pm": "^3.27.1",
|
|
"@tiptap/react": "^3.27.1",
|
|
"i18next": "^26.3.4",
|
|
"i18next-browser-languagedetector": "^8.2.1",
|
|
"prosemirror-model": "^1.25.9",
|
|
"prosemirror-schema-list": "^1.5.0",
|
|
"prosemirror-tables": "^1.8.5",
|
|
"react": "^19.0.0",
|
|
"react-dom": "^19.0.0",
|
|
"react-hook-form": "^7.80.0",
|
|
"react-i18next": "^17.0.8",
|
|
"react-router-dom": "^7.1.0",
|
|
"y-indexeddb": "^9.0.12",
|
|
"yjs": "^13.6.31",
|
|
"zod": "^4.4.3"
|
|
},
|
|
"devDependencies": {
|
|
"@playwright/test": "^1.61.1",
|
|
"fflate": "^0.8.2",
|
|
"@types/react": "^19.0.0",
|
|
"@types/react-dom": "^19.0.0",
|
|
"@vitejs/plugin-react": "^4.3.0",
|
|
"jsdom": "^26.0.0",
|
|
"typescript": "^5.7.0",
|
|
"vite": "^6.1.0",
|
|
"vite-plugin-pwa": "^1.3.0",
|
|
"vitest": "^3.0.0",
|
|
"y-prosemirror": "^1.3.7"
|
|
}
|
|
}
|