Roadmap and Known Gaps

Roadmap and Known Gaps

Stated plainly — the same bar the README holds itself to. Every gap here is measured or reproducible, not hand-waved.

Known gaps (shipped features navette doesn't have)

Gap	Status
Real (OS-level) mouse input	/key ships native-first keyboard (CGEvent/SendInput/XTEST); the mouse equivalent is not built yet. /click uses real pointer+mouse events in-page — but not OS-level cursor motion.
Request/response network interception	Not built. No CDP, no proxy-rewrite API. --proxy routes traffic but doesn't inspect it.
OS file-dialog automation	Not built — and deliberately side-stepped: /upload fills file inputs page-side via DataTransfer, no OS dialog involved.
Full-page screenshots	Not implemented; viewport capture only (set the viewport before navigating). Tracked honestly rather than approximated.
Passkey sheet on unsigned builds	The WebAuthn ceremony plumbing ships, but Apple's AuthenticationServicesAgent refuses the sheet to builds without a real signing Team ID (Told not to present authorization sheet, ASC 1 → AS 1004 — measured in the unified log). A Developer ID–signed build is the unlock to retest; everything else is in place.

Open issues carrying known residuals

• #6 — Linux disk footprint: WebKitGTK writes HTTP cache + HSTS to ~/.cache/navette / ~/.local/share/navette (no cookies, no logins). Needs a wry ephemeral-context lifetime fix; wry 0.57 has no upgrade path today. Also the origin of the WebView2 one-profile-per-session + InPrivate design.
• #7 — WebKitGTK cookie writes: /evaluate scripts that write document.cookie time out (reads work). Workaround: /sessions/load. Mitigation sibling shipped: NAVETTE_EVAL_TIMEOUT_SECS (default 20, clamp 5–300) for slow/contended environments.
• #8 — keychain states + origin-bound credentials: shipped in two stages (state save → keychain; creds + /login origin-bound fill). The origin-binding is the defense; at fill time the password does reach the page (same as human typing).
• #9 — cold CI freeze: the v1.9.0 release asset froze on cold CI runners before the listener bound (38 s cold boots are this repo's known constant). Every green Linux CI job builds from source.
• #10 — one-shot wry navigation race: redirected navigations timed out (completion was URL-match only) and two back-to-back navigations raced the event loop on CI. Fixes: URL-match completion shipped, nav_until retry everywhere, single-navigation install flows.

Platform stability work in progress

Native crashes on the non-macOS backends are being chased with a repro kit (docs/debug-vm.md): the Linux GTK/WebKit segfault ~10 s after boot (gdb backtrace names the guilty frame — libwebkit2gtk/libgtk/wry), and the Windows WebView2 crash during navigation (serve.log breadcrumbs show the last create_session step). Each backtrace becomes an issue with the exact data.

Roadmap direction

• Engine tier 2/3 hardening — WebView2 Fixed Version embed; WPE WebKit (~60 MB, no desktop stack) for bare containers (see Architecture).
• Hand-rolled backend seam — the WebviewKit trait is the plug point for direct WebKitGTK/WebView2 FFI (no wry) if/when wry's limits bite.
• Passkey retest on a Developer ID build — the one measurement blocking the WebAuthn story.
• Full-page screenshots, OS-level mouse, network interception — the three shipped-gaps above, in no promised order.
• A thin CDP shim — only if the world asks; not a drop-in Playwright is the point.

What will not change

• No vendored browser, ever — that trade is the thing navette exists to refuse.
• Loopback-only binding — there is no flag that changes it.
• Captchas are never solved by the machine — session_show is the design (Secrets and Logins).
• Claims stay measured: tables get corrections, not footnotes (Benchmarks).