🦀 P0 EPIC: trios-ext FULL Rust→WASM rewrite — fix CSP inline-script + DELETE all handwritten .js (детальный план для агента) #189

🚨 Symptom (2026-04-21 11:00 +07)

Chrome DevTools console error:

Executing inline script violates CSP directive 'script-src 'self''.
sidepanel.html:7  <script type="module">import init from './trios_ext.js';</script>

Агент снова пишет JS руками — inline <script> внутри sidepanel.html. Chrome MV3 CSP это блокирует → белый экран.

Это продолжение нарушения из #156. Делаем epic-rewrite с physical CI block, чтобы агент больше физически не мог написать handwritten JS.

Goal

Полностью переписать extension/ на Rust → WASM. Zero handwritten .js. CSP-compliant. Total Black brand (#155). Работающий chat через trios-server (#118).

Architecture

crates/trios-ext/              # Rust crate (Yew or raw web-sys)
  Cargo.toml                   # wasm-bindgen, web-sys, gloo-net, yew
  src/
    lib.rs                     # #[wasm_bindgen(start)] entry
    app.rs                     # Yew component (chat UI)
    ws.rs                      # gloo-net WebSocket → trios-server
    state.rs                   # app state, messages, agents

extension/                     # Chrome MV3 package (artefact only)
  manifest.json                # CSP-compliant, references dist/*
  sidepanel.html               # NO inline <script>. Only <script src="dist/bootstrap.js">
  dist/                        # generated by wasm-pack, gitignored
    trios_ext.js               # wasm-bindgen glue (AUTO-GENERATED)
    trios_ext_bg.wasm          # WASM bundle
    bootstrap.js               # 3-line init stub (the only .js allowed)
  icons/                       # PNG 16/32/48/128 (Trinity logo, #155)
  styles/brand.css             # Total Black palette (#155)

Acceptance Criteria

Phase 1 — Cleanup (delete JS)

• rm extension/sidepanel.js (125 lines handwritten — violation)
• rm extension/background.js (handwritten) → переписать на Rust
• Удалить inline <script type="module"> из sidepanel.html
• find extension -name '*.js' -not -path '*/dist/*' → 0 files

Phase 2 — Rust crate

• crates/trios-ext/Cargo.toml deps:
  • wasm-bindgen = "0.2"
  • web-sys = { version = "0.3", features = ["Document","Element","HtmlElement","Window","WebSocket","MessageEvent","console"] }
  • gloo-net = { version = "0.5", features = ["websocket"] }
  • yew = "0.21" (или leptos = "0.6")
  • wasm-bindgen-futures = "0.4"
  • serde, serde_json
• src/lib.rs:

use wasm_bindgen::prelude::*;

mod app;
mod ws;
mod state;

#[wasm_bindgen(start)]
pub fn main() -> Result<(), JsValue> {
    console_error_panic_hook::set_once();
    yew::Renderer::<app::App>::new().render();
    Ok(())
}

• src/app.rs — Yew component: header (Trinity logo), chat messages list, input, agent list panel
• src/ws.rs — gloo_net::websocket::futures::WebSocket подключается к ws://localhost:9005/mcp, отправляет MCP envelopes, принимает responses

Phase 3 — CSP-compliant HTML

• extension/sidepanel.html минимум:

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <title>Trios</title>
  <link rel="stylesheet" href="styles/brand.css">
</head>
<body>
  <div id="root"></div>
  <script src="dist/bootstrap.js"></script>
</body>
</html>

• extension/dist/bootstrap.js (3 строки, либо auto из wasm-pack):

import init from './trios_ext.js';
init();

• manifest.json → content_security_policy.extension_pages = "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'"
• Никаких inline <script>

Phase 4 — Build (cargo xtask, не .sh!)

• crates/xtask/src/main.rs с командой build-ext:
  • запускает wasm-pack build crates/trios-ext --target web --out-dir ../../extension/dist
  • копирует sidepanel.html, manifest.json, icons/, styles/ в финальный пакет
• cargo xtask build-ext → чистая сборка без ошибок

Phase 5 — CI physical enforcement

• .github/workflows/no-js.yml:

name: Enforce Rust-only extension
on: [push, pull_request]
jobs:
  reject-js:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Fail on handwritten JS
        run: |
          FOUND=$(find extension -name '*.js' -not -path '*/dist/*' | wc -l)
          if [ "$FOUND" -gt 0 ]; then
            echo "::error::Handwritten JS detected. Trinity is Rust-only."
            find extension -name '*.js' -not -path '*/dist/*'
            exit 1
          fi
      - name: Fail on inline scripts in HTML
        run: |
          if grep -rn '<script[^>]*>[^<]' extension/*.html 2>/dev/null | grep -v 'src='; then
            echo "::error::Inline <script> violates Chrome MV3 CSP."
            exit 1
          fi

• cargo clippy --target wasm32-unknown-unknown -- -D warnings = 0
• wasm-pack test --headless --chrome crates/trios-ext passes

Phase 6 — Visual (brand #155)

• Sidepanel рендерит Trinity logo (из extension/icons/128.png)
• Total Black #000000 background, foreground #FFFFFF, φ-gold accent #D4AF37
• Chat отправляет через gloo-net::websocket → trios-server, видит echo response
• chrome://extensions карточка показывает Trinity logo

Phase 7 — Docs / Logs

• Experience log .trinity/experience/2026-04-21-rust-only-extension.md
• ADR docs/adr/002-rust-only-extension.md (почему Yew/web-sys, почему не React)
• README раздел «Building the Extension» с cargo xtask build-ext

FORBIDDEN in this issue

• ❌ ANY handwritten .js кроме extension/dist/bootstrap.js (3 lines init)
• ❌ Inline <script> в HTML (CSP block)
• ❌ .sh скрипты — только cargo xtask (L1)
• ❌ TypeScript, React, Vue, Svelte
• ❌ Claim "done" без: cargo clippy clean + wasm-pack test passes + visual check of sidepanel (см. 🔌 P0: Comet ↔ Trios direct bridge — let the operator AI test the extension end-to-end (white screen blocker) #157 operator bridge)
• ❌ ln -s ~/.rustup ~/.zshenv или модификации shell

Test Plan

1. cargo xtask build-ext → clean build
2. find extension -name '*.js' -not -path '*/dist/*' → 0 files
3. grep -rn '<script[^>]*>[^<]' extension/*.html | grep -v 'src=' → empty
4. Chrome → load unpacked → extension/
5. Open sidepanel → Trinity logo визуально, Total Black фон, нет CSP errors в DevTools console
6. Type "привет" in chat → echo response from trios-server
7. DevTools → Application → WASM instance running
8. cargo clippy --target wasm32-unknown-unknown -- -D warnings = 0
9. CI workflow no-js.yml green

Related

• Closes 🚨 P0 VIOLATION: JS in extension/ — ALL extension code MUST be Rust → WASM (no .js handwritten) #156 (JS violation — same root cause, superseded by this epic)
• Unblocks 🎨 P0: Brand enforcement — Trinity logo + Total Black palette + working chat (Chrome Extension) #155 (brand)
• Unblocks 🔌 P0: Comet ↔ Trios direct bridge — let the operator AI test the extension end-to-end (white screen blocker) #157 (operator bridge — needs working extension first)
• Unblocks 🎯 IGLA RACE — Distributed Hunt: JEPA-T + NCA + GF16 + ASHA + Coq Invariants (Rust-only, Never-Stopping) #143 (ONE SHOT)
• Builds on feat: crates/trios-server — MCP WebSocket endpoint (мост Chrome Extension → агенты) #118 (trios-server MCP WebSocket)

L8 PUSH FIRST + L9 BOARD

• Branch feat/trios-ext-wasm pushed first
• PR body contains Closes #158 and Closes #156
• TRINITY board → In progress
• NATO call-sign: DELTA (JS-agent is dismissed; this is a Rust agent)

Message to agent (ENGLISH, commits/PR in English only)

This is Trinity. The stack is Rust → WASM, not JavaScript. Every handwritten .js file outside extension/dist/ = instant PR rejection. If you need DOM: web-sys. If you need reactive UI: Yew or Leptos. If you need WebSocket: gloo-net. If you need async: wasm-bindgen-futures. No exceptions. No "just this once". CI will physically block you (no-js.yml). Fix the CSP violation by deleting the inline <script type="module"> and letting wasm-pack generate the glue in dist/. HTML references dist/bootstrap.js via <script src=...> only. That is the entire contract.