Repository navigation
Browser preview Console (#466) and /doctor document rendering (#462) - #504
Merged
Merged
Conversation
C in the Chromium preview lists what the page reported for the loaded document: script exceptions, console messages, failed loads and HTTP errors, CSP refusals and NMSh's own refusals. Entries come from the Runtime and Log events every page already receives, only for a preview opened with a Console and only from the page's default worlds, and are redacted before they are kept (the preview token, query values, credentials, likely secrets, controls). The Console only reads: scripts and network rules are untouched, nothing is evaluated, copying shows the exact text first, and Enter goes to a line only for an unchanged HTML document. A Console page keeps its first events until a listener attaches, so the first load's errors are not lost. /doctor gains a Documents section: the browser previews would use, the Mermaid found (version, compatibility warning), the Mermaid setting and why diagrams would not be drawn, gathered without launching a browser or reading the bundle.
…ped, token never in a label, only the document root maps to the buffer From the independent security review: query values after brackets or long values, credentials in unparsable addresses and the preview token reached as localhost or inside another address could survive redaction; a sibling index.html was mapped as the document. Also: line breaks the browser counts differently refuse the jump, a refresh forgets the old load at once, console arguments are cut before joining, copied continuation lines are indented, a refused navigation's blank page keeps the refusal, and /doctor reads package.json without blocking and bounds its Documents section.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #466, Refs #462
Console (#466, runtime slice)
Cin the Chromium preview of a Markdown/HTML document lists what the page reported for the loaded document: script exceptions,consoleerrors/warnings/messages, failed loads and HTTP errors, CSP refusals, NMSh's own refusals. Problems' UI pattern: newest first, Tab severity filter, typing searches, Shift+↑↓ marks, Del clears, Ctrl+C shows the exact text before copying, Enter goes to the line only for an HTML document unchanged since load (else says why), Esc back.Trust: a reader only. No
setScripts, navigation, reload or input to the page; no evaluation; scripts-off previews report only loading/policy messages. No new CDP domains (Runtime and Log were already enabled on every page). Only previews opened withconsolereport (never/browser, never the Mermaid renderer); Runtime events only from the page's default worlds. Entries are redacted before they are stored (preview token, query values, credentials, home, likely secrets, controls), bounded (200 entries, 256 KB, 2,000 chars), in memory, for the current load. A Console page holds its first 200 events until a listener attaches (the first load starts insideopen())./doctor (#462)
A Documents section: the browser previews would use (version only if already checked this session; running or not), the Mermaid found (path, version, warning for a major other than tested 12), the setting, and why diagrams would not be drawn. Launches nothing, never reads the bundle, says "detection only", bounded at 3 s.
Independent review
Opus security review: trust boundary held; four confirmed redaction/mapping issues and several minor ones fixed with regression tests (details in docs/design/document-workspace.md → Console).
Verification
Build,
test:fast, and the affected suites locally (browserConsole, browserConsoleView, browserConsoleChrome with a real Chrome, doctorDocuments, documentPreview, browserEngineChrome, diagrams*, problems, documentWorkspaceApp …). Full canonical suite: this PR's CI.Physical QA: NOT RUN (Ghostty, Zed) — items added to docs/testing/v024-editor-physical-qa.md.