f3e21c6b98
Accumulated uncommitted work: GHOST Web backend, WebGL/GPU web layer, web workflow engine and protocol, tooling, docs and task records. Large generated evidence, user-testing archives, build snapshots and imported test assets remain untracked. Co-Authored-By: Claude Code <noreply@anthropic.com>
1.9 KiB
1.9 KiB
WBV2-P1111-000: scripting security module
- task:
WBV2-P1111-000 - parent:
WBV2-P1110-000 - status:
in_progress - gap:
workflow:module_scripting_security - ownerFamily:
SCRIPTING - targetImplementationClass:
LOCAL_BOUNDED
目标
按功能模块验证 script source Main reader、deny-by-default permission policy、sandbox crash/timeout isolation 与新 generation recovery。
输入与范围
- Main reader/API:
blender-5.2.0/source/blender/web_engine/web_engine_blend_reader.cpp,blender-5.2.0/source/blender/web_engine/web_engine_api.cpp - Protocol:
web/protocol/scene-ir.ts,web/protocol/scripting-platform.ts - Workers/UI:
web/app/src/workers/web-engine.worker.ts,web/app/src/workers/script-permission-policy-test.worker.ts,web/app/src/workers/script-sandbox-isolation-test.worker.ts,web/app/src/workers/script-sandbox-recovery-test.worker.ts,web/app/src/testing/script-sandbox-recovery.ts,web/app/src/app/App.tsx - Existing receipts:
tests/golden/M13-02E/manifest.json,tests/golden/M13-03D/manifest.json,tests/golden/M13-03G/manifest.json
验收
npm --prefix web run test:script-main-reader
npm --prefix web run test:scripting-isolation
npm --prefix web run test:e2e -- --workers=1 tests/e2e/script-permission-policy.spec.ts tests/e2e/script-sandbox-isolation.spec.ts tests/e2e/script-sandbox-recovery.spec.ts
npm --prefix web run typecheck
必须记录 reader/policy 正例、autorun/undeclared permission/sandbox crash 负例、worker restart、generation rollover、audit chain 和 Chromium。服务端脚本执行能力仍按显式 BLOCKED 处理，不从本模块推导完整 scripting parity。
交付与回滚
- Receipt:
tests/golden/WBV2-P1111-000/module-receipt.json - Manifest:
tests/golden/WBV2-P1111-000/manifest.json - Status:
docs/status/WBV2-P1111-000.md - 回滚：恢复 P1110 manifest 为 queue parent，不改写 M13 历史 receipt。