Release: UI 2.11.10 + Solid 2.0.0-rc.4, capture viewport, and runtime script fetching

[pathscale]

This is the one to merge. Six commits, everything stacked: it now includes #27's frontend work as well as the corpus fixes. Supersedes #27, #28 and #29.

12ca80d fix(browser): fetch runtime-discovered scripts in the window too
5f3ea4f fix(capture): fetch the scripts a page discovers while running
34fce86 fix(capture): honour the capture viewport environment variables
d55e84c chore(deps): take @pathscale/ui 2.11.10
6c7cdbd docs(theme): drop the stale daisyUI reference from the layer comment
3d50ae0 chore(deps): move the frontend to @pathscale/ui 2.11.9 and Solid 2.0.0-rc.4

The bottom three are #27, unchanged and rebased forward. The top three are new, found by capturing a 104-site corpus headlessly and comparing against a reference browser. Sites are referred to by opaque id; the id-to-host map is local and not committed.

Capture viewport

scripts/render-check.sh has documented and exported CHUZZ_CAPTURE_WIDTH and CHUZZ_CAPTURE_HEIGHT since it was written, and the capture entry point read neither — it passed a literal 1440, 960.

Found because a re-capture at width 1507 produced a byte-identical tree dump to the 1440 run, which is not something a working viewport knob can do. It matters beyond tidiness: two engines laying the same page out at different widths disagree on every percentage width, centred box and responsive breakpoint, so an unhonoured viewport turns a rendering diff into noise that reads exactly like a rendering fault.

Scripts a page discovers while running

The prefetch walks the parsed HTML and loads every script it names. A page that builds a <script> from JavaScript asks for a URL nobody knew about until the page was running, and that request reached DefaultScriptFetcher, which serves file: and data: only. The script was dropped with unsupported URL scheme for script: https — reading like a policy decision rather than the missing capability it is.

The most common engine defect in the corpus: 26 of 104 sites, a quarter.

It hides well. Scripts the parser found load perfectly, so a page fails only in the parts it assembles itself, and jQuery/$ coming out undefined on 7 and 6 sites looks like its own bug until you notice the library was never fetched.

One commit fixes the capture path; the next fixes the window and moves the fetcher into script_fetch.rs so both share it rather than keeping two copies in step.

The deadlines differ per caller, deliberately

ScriptFetcher::fetch is synchronous, because classic scripts execute in document order. In the window, page scripts run on the UI thread, so this blocks everything — other tabs included — for as long as it waits. Five seconds there, ten in the capture: a capture is unattended and a dropped script costs it the fidelity it exists to provide, while a window has someone watching the frame.

Neither number is the real answer. The real answer is an asynchronous script-loading path in blitz-script, which would not have to choose. That is an engine change, not this one. This is a real tradeoff against the previous behaviour of silently dropping the script, and worth a second opinion before tagging.

Verification

Re-captured the six worst-affected sites: dropped scripts 12, 6, 4, 2, 2, 2 → 0 on every one, and still 0 after the refactor.

Rendering barely moved, which is the honest result rather than a disappointing one. On one site the error count rose 9 → 14 with a new kind, unescape is not defined: the scripts now run and reach the next missing global. This unblocks a layer; the missing web APIs behind it — fetch (4 sites), XMLHttpRequest (6), Image (4), getComputedStyle (3) — are what turn it into pixels.

The test serves a script from a real socket and asserts a synchronous fetch completes a round trip from inside the runtime driving the page. Its accept loop carries a deadline rather than blocking: restoring the defect means no connection is ever made, and a blocking accept hung the run instead of failing it — which it did, until the test was fixed. Confirmed by restoring the defect: fails in 10.02s.

Green on the stacked branch: cargo fmt --check, cargo clippy -D warnings, 34 Rust tests, and the frontend typecheck including the local @chuzz/ui layouts regeneration.

Not verified

The window path is the same code the tests cover and the capture exercises, but it is not itself exercised in a window: this machine has no screen access, and the control socket sees the chrome document rather than the page's sub-document. Worth a human look before tagging.

[pathscale]

Added feat(inspect): reach the diagnostics tool, not just agent control.

The browser advertises two tools over the same socket. chuzz-inspect only ever called blitz.agent.control, so blitz.diagnostics — DOM and layout snapshots, renderer metrics, idle settlement, and the console and runtime-error streams — was unreachable from the client whose whole job is reading the browser.

That gap has a cost. Driving honey.id here is what surfaced it: the page rendered blank, and the only way to learn why was to grep the process stdout for Uncaught JS error, where it sits mixed in with the renderer's own paint logging.

call keeps its shape and routes to the agent tool, diagnostics is the same round trip against the other one, and both share call_tool. The CLI grows console, metrics, settle, dom and a verbatim diag.

Verified against a running browser: metrics returns real renderer timings, dom returns a full DOM and layout snapshot with attributes.

Two limits, both upstream in the runtime rather than here, and both worth knowing:

• console answers streamingUnavailable — diagnostic subscriptions are not implemented. It says so rather than pretending, but it means neither the page nor an agent can observe a JS error.
• dom reports the chrome window. A page lives in a sub-document on its <web-view> mount and is not in the tree, so page content is still screenshot-only. Checked rather than assumed: of 87 nodes, the only matches for a loaded page were the address bar's value and the tab title.

cargo fmt --check, clippy and the 15 tests pass.

[pathscale]

Superseded by #33, which consolidates all chuzz work into one PR.