f3e21c6b98
Accumulated uncommitted work: GHOST Web backend, WebGL/GPU web layer, web workflow engine and protocol, tooling, docs and task records. Large generated evidence, user-testing archives, build snapshots and imported test assets remain untracked. Co-Authored-By: Claude Code <noreply@anthropic.com>
38 lines
1.9 KiB
Markdown
38 lines
1.9 KiB
Markdown
# WBV2-P1111-000: scripting security module
|
||
|
||
- task: `WBV2-P1111-000`
|
||
- parent: `WBV2-P1110-000`
|
||
- status: `in_progress`
|
||
- gap: `workflow:module_scripting_security`
|
||
- ownerFamily: `SCRIPTING`
|
||
- targetImplementationClass: `LOCAL_BOUNDED`
|
||
|
||
## 目标
|
||
|
||
按功能模块验证 script source Main reader、deny-by-default permission policy、sandbox crash/timeout isolation 与新 generation recovery。
|
||
|
||
## 输入与范围
|
||
|
||
- Main reader/API: `blender-5.2.0/source/blender/web_engine/web_engine_blend_reader.cpp`, `blender-5.2.0/source/blender/web_engine/web_engine_api.cpp`
|
||
- Protocol: `web/protocol/scene-ir.ts`, `web/protocol/scripting-platform.ts`
|
||
- Workers/UI: `web/app/src/workers/web-engine.worker.ts`, `web/app/src/workers/script-permission-policy-test.worker.ts`, `web/app/src/workers/script-sandbox-isolation-test.worker.ts`, `web/app/src/workers/script-sandbox-recovery-test.worker.ts`, `web/app/src/testing/script-sandbox-recovery.ts`, `web/app/src/app/App.tsx`
|
||
- Existing receipts: `tests/golden/M13-02E/manifest.json`, `tests/golden/M13-03D/manifest.json`, `tests/golden/M13-03G/manifest.json`
|
||
|
||
## 验收
|
||
|
||
```bash
|
||
npm --prefix web run test:script-main-reader
|
||
npm --prefix web run test:scripting-isolation
|
||
npm --prefix web run test:e2e -- --workers=1 tests/e2e/script-permission-policy.spec.ts tests/e2e/script-sandbox-isolation.spec.ts tests/e2e/script-sandbox-recovery.spec.ts
|
||
npm --prefix web run typecheck
|
||
```
|
||
|
||
必须记录 reader/policy 正例、autorun/undeclared permission/sandbox crash 负例、worker restart、generation rollover、audit chain 和 Chromium。服务端脚本执行能力仍按显式 `BLOCKED` 处理，不从本模块推导完整 scripting parity。
|
||
|
||
## 交付与回滚
|
||
|
||
- Receipt: `tests/golden/WBV2-P1111-000/module-receipt.json`
|
||
- Manifest: `tests/golden/WBV2-P1111-000/manifest.json`
|
||
- Status: `docs/status/WBV2-P1111-000.md`
|
||
- 回滚：恢复 P1110 manifest 为 queue parent，不改写 M13 历史 receipt。
|