test(mv3): prove real downloads compatibility - #43
Open
seonghobae wants to merge 17 commits into
Open
Conversation
📝 WalkthroughWalkthroughMV3 호환성 실행기가 ChangesMV3 호환성 검증
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related issues
Possibly related PRs
Sequence Diagram(s)sequenceDiagram
participant 호환성 실행기
participant MV3 서비스 워커
participant Loopback HTTP 서버
participant 다운로드 디렉터리
호환성 실행기->>MV3 서비스 워커: downloads 표면 검사 요청
MV3 서비스 워커->>Loopback HTTP 서버: 로컬 payload 요청
Loopback HTTP 서버-->>MV3 서비스 워커: 다운로드 응답
MV3 서비스 워커->>다운로드 디렉터리: 파일 저장
MV3 서비스 워커-->>호환성 실행기: ready 상태와 진단 정보 반환
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
seonghobae
changed the title
seonghobae
marked this pull request as ready for review
August 10, 2026 03:40
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/ci/run_mv3_compatibility.py`:
- Around line 236-237: Update the evidence collection around the document
dataset mapping to include originweaveDownloadsDiagnostic and add that key to
SURFACE_EVIDENCE_KEYS. Apply a dedicated allowlist so only approved diagnostic
tokens, including download-source-rejected, are propagated into
CompatibilitySurfaceError and trial_results; do not expose raw error strings.
Add a contract test covering diagnostic collection and confirming raw errors are
omitted.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: d73a2eca-a087-402a-90f4-77b9e198f634
📒 Files selected for processing (7)
scripts/ci/run_mv3_compatibility.pytests/fixtures/mv3_basic/content_script.jstests/fixtures/mv3_basic/download.txttests/fixtures/mv3_basic/manifest.jsontests/fixtures/mv3_basic/service_worker.jstests/test_mv3_compatibility_contract.pytests/test_mv3_downloads_contract.py
This was referenced Aug 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Buyer-visible gap
Partial implementation of #27. OriginWeave's pinned real-Chromium Manifest V3 lane needed executable proof that the declared
downloadssurface works through a bounded controlled download rather than a source-text or mock-only assertion.Implemented boundary
Current exact head
27ce89066ed1473dcd66eb26a2f91becf9df5424:downloadspermission;127.0.0.1HTTP origin owned by the compatibility runner;chrome.downloads.downloadAPI;chrome.downloads.searchverification;The loopback fixture origin is test-only. This PR does not authorize arbitrary network downloads, filesystem access, or additional OriginWeave Agent capability.
Review RCA and TDD
CodeRabbit identified that
originweaveDownloadsDiagnosticexisted in the fixture but the Python runner did not collect it, so a failed download could degrade to onlydownloads=missing.The fix was test-first:
669e308358f7488e6899c9fb288c795562aa7f84added the regression contract requiring runner collection, an exact allowlist, preservation of reviewed stage tokens, and rejection of raw paths/browser errors;27ce89066ed1473dcd66eb26a2f91becf9df5424added the narrow runner implementation and requiresdownload-complete-readyon a successful browser pass.The review thread is resolved as addressed on the current code.
Exact-head evidence
On unchanged head
27ce89066ed1473dcd66eb26a2f91becf9df5424against protected main67af7c87589edc2039545af335c95064d9b8391c:Manifest V3 Compatibilityrun31355609614: success;CIrun31355609658: success;SAST Semgreprun31355609648: success;Security Scanrun31355609649: success;The submitted CodeRabbit review is
COMMENTED, not an independent formal approval. No predecessor-head check or review is being transferred.Truth and scope boundary
This PR proves one declared Manifest V3 compatibility capability only. It does not prove full Chrome extension compatibility, extension-to-Agent authority isolation, native messaging, enterprise managed-extension policy, Chrome Web Store behavior, Google services, codecs/DRM, remote-download policy, credentials, arbitrary filesystem authority, or release readiness. Those remain governed by issue #27 and canonical documentation maturity labels.
Partial implementation of #27.