Repository navigation
Lens: add Browser Run comparison surface - #12
Merged
Merged
Conversation
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
aadhar-sh | 0055c05 | Jul 16 2026, 03:29 PM |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
serendipity | 0055c05 | Commit Preview URL Branch Preview URL |
Jul 16 2026, 03:30 PM |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
cal-aadhar-sh | 0055c05 | Jul 16 2026, 03:30 PM |
oddharsh
marked this pull request as ready for review
July 16, 2026 15:32
oddharsh
added a commit
that referenced
this pull request
Jul 28, 2026
* fix(social): endpoint discovery was taking three of the decoys Ran the site's sender against the IndieWeb conformance suite at webmention.rocks, which plants deliberate traps in its 23 discovery pages. Three of them caught us. All three were the same shape: the parser was matching on text rather than on structure. #12 rel="not-webmention" took the decoy #13 decoy inside <!-- --> took the decoy #20 <link rel="webmention"> gave up instead of reading on 12 is the sharp one. The old test was /\bwebmention\b/, and "-" is a word boundary, so "not-webmention" matched. rel is a space-separated token list, so the check is now tokenize-and-compare, in the header path too. 13 needed comments stripped before the scan (escaped HTML in #14 was already safe, since these patterns want a literal "<"). 20 was treating the first rel=webmention tag as the answer even with no href, so a bare <link> shadowed the real <a> further down; it now skips candidates without an href and keeps looking. href="" is deliberately NOT that case: it is a legal self-reference, and #15 asserts it. Kept the single document-order scan. Tempting to look at every <link> before any <a>, but #16 exists precisely to punish that: it puts the real endpoint in an <a> and a decoy in a later <link>. 23/23 against the live suite now, up from 20. Frozen as fixtures rather than live fetches, because this file is deliberately network-free. Confirmed the fixtures fail against the old parser. discoverEndpoint is exported to make the suite runnable, matching the other helpers here that are already exported for tests. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(social): a real mention arrived reading like spam, twice over Drove an actual webmention through the deployed receiver from a public source page. It verified and stored correctly, but the moderation email was 280 characters of SVG path geometry: 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018…"> A throwaway source page. It exists to drive one real w Two causes, either of which is enough on its own. <svg> was not stripped alongside <script> and <style>, and a page like a GitHub gist is full of inline icons. On its own that is survivable, since the tag stripper removes complete tags with their attributes. What made it escape is the excerpt window. It is a fixed 400 characters either side of the target, cut at a byte offset, and the target lives inside an href — so centring on a link GUARANTEES the cut lands mid-tag, and often mid-attribute. A leading partial tag is not a complete tag, so the stripper leaves it as text. That is the stray "> in the middle. Now strips <svg>/<noscript> and drops the partial tags at both edges, detecting a mid-tag cut by whether > precedes < in the slice. Same page now yields the actual sentence around the link. Also fixes two things found alongside it: 202 no longer carries a Location header. The spec ties Location to 201, where it names a status URL the sender can poll; webmention.rocks receiver test #1 fails a 202 that sends one. /inbox was never a status URL for a pending mention anyway, since a pending mention deliberately does not appear there. Citations now skip anchors that exist to open a hover card: interestfor on the garage pages, class="car-link" on the homepage. Every one of them points at a Google SEARCH url, so telling google.com/search?q=Singer it had been cited is noise, not credit. Live citation targets drop 56 -> 53, and all three removed are search pages. Verified the excerpt test fails with both fixes removed, reproducing the exact garbage above. Each fix alone is sufficient, so it takes removing both to break it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Aadharsh Pannirselvam <19518661+oddharsh@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This was referenced Aug 5, 2026
oddharsh
added a commit
that referenced
this pull request
Aug 10, 2026
…312) Dependabot #12 flagged nanoid < 3.3.17: customAlphabet and customRandom spin forever when size is 0, because the generation loop never satisfies its exit condition. Dependabot could not land it, since it reached for the 5.1.6 the advisory text names and postcss asks for ^3.3.16. The range was never the problem. postcss@8.5.25 already permits 3.3.18, and pnpm still would not move it: `pnpm update nanoid -r --depth Infinity` re-resolves 320 other entries and leaves this one alone, across four invocations with and without --lockfile-only. Deleting the entry by hand is worse than it looks, because pnpm reads the shortened lockfile as up to date, skips resolution, and prunes nanoid out of postcss entirely. So an override, written as a selector that expires on its own: `nanoid@<3.3.17` matches only the versions the advisory names, so the pin stops applying the day postcss raises its floor or moves to the 5.x line. A bare `nanoid: 3.3.18` would hold every future resolution at a 2026 patch release and say nothing about it. Exposure here was nil either way. nanoid reaches this tree at ONE position and it is dev-only, `vitest -> vite -> postcss -> nanoid`, so nothing a Worker serves touches it and no code here calls either function. Verified: 3.3.18 returns "" for size 0 instead of hanging; contract suite 206/206, cal 59/59, typecheck clean, build stages 46 pages; `--frozen-lockfile` installs against the committed lockfile, which is the check that would otherwise fail first in CI. Co-authored-by: Aadharsh Pannirselvam <19518661+oddharsh@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Adds an opt-in Browser Run surface to Lens so Compare can show three observations side by side:
The normal HTTP scan stays cheap. Browser Run is lazy, rate-limited, KV-cached, and backed by the Workers
BROWSERbinding. The old screenshot path now uses the same binding instead of the legacy REST token path.WebMCP discovery is kept explicit: production-style Browser Run snapshots report that Chrome-beta lab discovery is required, while
scripts/lens-webmcp.mjscreates a short-lived lab session, probesnavigator.modelContextTesting.listTools(), prints Live View metadata, and closes the session by default. It never executes site tools.Validation
npm test— 7 passing contract tests.npm run build— build invariants pass; deploy assets are minified with readable twins.npm run perf-budget— all budgets green.npm run check-wrangler— all five Worker projects use Wrangler 4.111.0./lens/browserresponse returned 200 with rendered HTML, Markdown, accessibility tree, and PNG screenshot./lens/browserroute and lazy asset passed. The full local route oracle still reports the existing local-only KV/R2 fixture failures for/around/json,/photos, and one full photo asset.