test(plugin-detail): serve batch 3's four probes from doubles (objectui#7307) - #8019
Merged
Merged
Conversation
…ui#7307) The four `plugin-detail` files in the network-escape ledger each reached a REAL socket on every run. Each now serves its probe from a recording double, and its line leaves `KNOWN_ESCAPES` and `PINNED_LEDGER` in this same commit (both 12 -> 8, verified by diffing the two literals' quoted paths). Measured with a stack probe on the guard's attribution point, not inferred: all four reach `POST /api/v1/security/explain` through `useRecordEditable`'s `apiFetch ?? fetch` fallback, twice per render (edit, then delete). `guideCrudAppRenders` additionally reaches `GET /api/task/42` through `DetailView`'s `api` branch, so its router serves that route too and answers the record, the shape `setData(result?.data || result)` consumes. The doubles are routers, not sinks: each records every URL it is handed and its `afterEach` fails on any URL outside the set it serves, so an escape somewhere else reds here instead of vanishing into a best-effort `catch`. Teardown keeps the objectui#7439 ordering — `cleanup()` before `vi.unstubAllGlobals()`. Nothing is skipped, quarantined or silenced. Part of #7307 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FhBNJcLRZLe8M87VcUgpKr
Contributor
✅ Console Performance Budget
The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it. 📦 Bundle Size Report
Size Limits
|
Contributor
Author
|
Standing-down note — Generated by Claude Code |
baozhoutao
marked this pull request as ready for review
September 6, 2026 10:36
This was referenced Sep 6, 2026
This was referenced Sep 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #7307 — batch 3 of the network-escape burn-down (batch 1 was #7999, batch 2 was #8013).
The four
plugin-detailrows left in the ledger now serve their probes from therecording double batches 1 and 2 landed, and their lines leave
KNOWN_ESCAPESand
PINNED_LEDGERin the same commit.Per file
src/__tests__/defaultFieldGroupsPage.sectionHeadings.test.tsxPOST /api/v1/security/explainuseRecordEditable.ts:76(apiFetch ?? fetch)installExplainDouble()inbeforeEachsrc/__tests__/guideCrudAppRenders.test.tsxPOST /api/v1/security/explainandGET /api/task/42useRecordEditable.ts:76· plusDetailView.tsx:616, which calls the globalfetchwith no seam at allinstallFetchDouble()inbeforeEach— the one two-route router in this batchsrc/__tests__/recordDetailsBodySource.test.tsxPOST /api/v1/security/explainuseRecordEditable.ts:76installExplainDouble()inbeforeEachsrc/renderers/__tests__/record-details.emptySectionDefault.test.tsxPOST /api/v1/security/explainuseRecordEditable.ts:76installExplainDouble()inbeforeEachMechanism, measured rather than assumed. A trap-guarded stack probe on the
guard's own attribution point, restored by blob hash afterwards, attributes every
escape in all four files. Three of them render
RecordDetailsRenderer, whichrenders
DetailView(record-details.tsx:302); the fourth renders the guide'sdetail-viewsnippet directly. Either wayDetailViewcallsuseRecordEditabletwice per render —
DetailView.tsx:290for edit,:296for delete — and atuseRecordEditable.ts:76the hook degrades from the host's authenticatedapiFetchto the globalfetchby design, so a standalone embed keeps rendering.Under happy-dom that global is a real HTTP client whose document URL is
http://localhost:3000, so the relative path resolved to a live socket. The readis best-effort, which is why these files stayed green while the request always
failed.
guideCrudAppRendersis the exception the dispatch flagged, now measured: oneextra call from
DetailView.tsx:616, theapibranch that doesfetch(SCHEMA_API + '/' + SCHEMA_RESOURCEID)with noapiFetchseam. Its countswere 12 explain calls and exactly 1 record call. The probe was reverted with
git checkout HEAD --; the guard is byte-identical toHEADafterwards(
git diff HEADempty,git status --porcelainempty).The doubles are batch 1/2's shape verbatim:
vi.stubGlobal('fetch', router)in
beforeEach,cleanup()beforevi.unstubAllGlobals()inafterEach(the#7439 ordering). Each is a router, not a sink — it records every URL it is handed
and
afterEachfails on any URL outside the set it serves, so an escape elsewherereds here instead of vanishing into a best-effort
catch.What they answer, and why no assertion moves:
/api/v1/security/explain— the permissive verdict, in the two shapes the twoexplain hooks read:
{ record: { visible } }for a singlerecordId,{ records: [{ recordId, visible }] }for a batchedrecordIds. Only the firstis reached here; the batched branch is kept so the router stays byte-identical
to its siblings rather than forking per file.
useRecordEditableinitialisesallowedtotrueand its failure path leaves it there, so the permissiveverdict and the absent verdict are the same value at every read site.
/api/task/42— the record, which is the shape its reader consumes:DetailViewdoesres.json()thensetData(result?.data || result). The onecase that reaches it asserts only that the "No data source resolved" panel stays
absent, and that panel is a wiring gate in
ElementDataSourceGatedecidedbefore any response arrives — absent because the block declares
api, notbecause the request failed. Serving the record exercises the success path this
route always had without moving that assertion.
Nothing is skipped, quarantined or silenced.
Ledger arithmetic
12 to 8, in both lists. The four names are deleted from
KNOWN_ESCAPESinvitest.setup.network-escape-guard.ts(each with its endpoint comment) and fromPINNED_LEDGERinscripts/__tests__/network-escape-ledger.test.ts, in this onecommit. Checked in lockstep by diffing the quoted paths of the two literals
against each other on the branch: empty diff, both at 8, zero
plugin-detailrows left in either. The pin's non-vacuity floor is
length > 0, so 8 clears it.Remaining 8: all app-shell, across four endpoint families.
No prose count moved. All three "21" references in the guard are provenance
claims about the original sweep on
67dadd6, not live counts of the current list— batch 1 and batch 2 had already normalised the two sentences that were live.
Evidence
Per file, before then after (attribution lines /
ECONNREFUSEDlines, then thepost-fix run):
defaultFieldGroupsPage.sectionHeadingsTests 3 passedguideCrudAppRendersTests 10 passedrecordDetailsBodySourceTests 3 passedrecord-details.emptySectionDefaultTests 6 passedTest counts are unchanged in every file — the doubles add no cases and remove none.
pnpm exec vitest run packages/plugin-detail/ scripts/__tests__/network-escape-ledger.test.tson this head: exit 0,
Test Files 133 passed (133),Tests 1202 passed (1202),and zero lines matching
network-escapeorECONNREFUSEDin the whole run.That run also covers the third reader of
KNOWN_ESCAPES,record-details.hideEmptyRetired-7129.test.tsx, whose mention is prose in acomment rather than a read.
Ablation (on the committed tree, one script with
trap ... EXIT INT TERMandabsolute paths throughout).
guideCrudAppRenders.test.tsx— the two-route file —had its double reverted to its pre-batch-3 blob while its line stayed deleted from
BOTH ledgers. Mutation proven on disk, not by exit code: blob
54f75c12to7f7951dd, asserted equal to theeeda78a7base blob and unequal toHEAD's;anchors
installFetchDouble2 to 0 andvi.stubGlobal1 to 0; that path present0 times in
KNOWN_ESCAPESand 0 times inPINNED_LEDGERduring the run.Predicted direction stated before running: red naming the file. OBSERVED red —
exit 1,
Test Files 1 failed (1),Tests 6 failed | 4 passed (10), withNetwork escape: this test reached a REAL socket at http://localhost:3000/api/v1/security/explain, http://localhost:3000/api/task/42and
file: packages/plugin-detail/src/__tests__/guideCrudAppRenders.test.tsx.That the failure names both routes is the load-bearing half: it shows the
second route is genuinely served by this PR rather than incidentally quiet.
Restore proven by observation: blob back to
54f75c12,git diff HEADon thatpath empty,
git status --porcelainempty.No dist preflight leg: these are the vitest projects' own test files and the root
config aliases every package specifier to
src— measured, in that all foursuites ran green on a fully unbuilt tree before any build happened.
Gates, exit codes captured by redirect-then-capture, never through a pipe:
node scripts/check-changeset-presence.mjsexit 0 — "4 source file(s) of 1released package(s) changed, and this change declares 1 changeset(s)"; the
changeset has an EMPTY frontmatter, the explicit exemption for a test-only
change under a released package's
src/, and not a label.pnpm check:control-bytesexit 0 (6444 tracked text files), plus agrep -naPself-scan of the control range over all 7 changed paths, no hits.
node scripts/check-governed-queue-guard.mjs --testover all 7 changed paths:exit 0, "NOT GOVERNED — 7 path(s) checked against 5 governed surface(s)".
pnpm type-check:scriptsexit 0 ·pnpm check:vi-mock-inheritexit 0 (226 callsites judged, 226 inherit) ·
pnpm check:vi-mock-specifiersexit 0.type-checkandlintforplugin-detailviaturbo --concurrency=2 --force: exit 0,Tasks: 15 successful, 15 total,0 eslint errors. Proven non-vacuous rather than assumed:
tsc -p tsconfig.test.json --listFilesnames each of the four edited filesexactly once, and
eslint --format jsonlists each among the 183 linted files.Every warning in the touched files sits on a pre-existing line outside this
diff's hunks (checked hunk range by hunk range), and the warning totals are
unchanged.
type-checkdependsOn ^build, so turbo built the dependencyclosure first — the build was needed for the gate, not for the suites.
The repo-wide
eslint . --no-inline-configrun belongs to CI, and CI is notawaited here: the report is delivered at draft-PR time per the dispatch contract.
Concurrency
origin/mainwaseeda78a7when this branch was cut and was stilleeda78a7when this PR was opened (re-fetched into a private ref rather than reading a
shared remote-tracking name), so no merge was needed and every number above was
taken on the head that ships. Draft PR #7685 touches
plugin-detail'sindex.tsxandrecord-details.hideEmptyRetired-7129.test.tsx— neither is inthis diff. #5174's in-flight batch cannot land in this package (its README left
the ledger with batch 17), and PR #8016 is disjoint.
#7996 is untouched and stays open: the
{ allowed: true }stub it reports livesin
record-details.hideEmptyRetired-7129.test.tsx, which this PR deliberatelydoes not edit. Its shape was not copied — these four routers answer the keys
the hooks actually read.
Generated by Claude Code