@aiwg/cockpit 2026.7.25 → 2026.8.0

package/vscode/smoke.mjs

@@ -12,16 +12,24 @@ await writeFile(runtimePath, JSON.stringify({ token: 'vscode-shell-core-token-12
 const requests = [];
 globalThis.fetch = async (input, init = {}) => {
   requests.push({ url: String(input), init });
+  if (String(input).endsWith('/bootstrap/nonce')) {
+    return new Response(JSON.stringify({ nonce: 'vscode-one-time-nonce', expires_in_ms: 60000 }), {
+      status: 201,
+      headers: { 'Content-Type': 'application/json' },
+    });
+  }
   return new Response(JSON.stringify({ ok: true }), { status: 200, headers: { 'Content-Type': 'application/json' } });
 };
 
 const originalLoad = Module._load;
+const commands = new Map();
+const panel = { webview: { html: '' } };
 Module._load = function patchedLoad(request, parent, isMain) {
   if (request === 'vscode') {
     return {
       workspace: { getConfiguration: () => ({ get: () => runtimePath }) },
-      window: { showWarningMessage: () => undefined, createWebviewPanel: () => ({ webview: { html: '' } }) },
-      commands: { registerCommand: () => ({ dispose: () => undefined }) },
+      window: { showWarningMessage: () => undefined, createWebviewPanel: () => panel },
+      commands: { registerCommand: (name, callback) => { commands.set(name, callback); return { dispose: () => undefined }; } },
       env: { openExternal: () => undefined },
       Uri: { parse: (value) => ({ value }) },
       ViewColumn: { One: 1 },
@@ -40,6 +48,12 @@ try {
     requests.some((r) => r.url.endsWith('/api/health') && r.init.headers?.authorization === `Bearer ${rt.token}`),
     'shell-core performs the authenticated Bridge health check',
   );
+  extension.activate({ subscriptions: [] });
+  await commands.get('aiwg-cockpit.open')();
+  assert.match(panel.webview.html, /frame-src http:\/\/127\.0\.0\.1:8159;/, 'webview CSP permits only the resolved Bridge origin');
+  assert.doesNotMatch(panel.webview.html, /localhost:\*|127\.0\.0\.1:\*/, 'webview CSP has no wildcard local port');
+  assert.match(panel.webview.html, /#bootstrap=vscode-one-time-nonce&audience=vscode|#bootstrap=vscode-one-time-nonce&audience=vscode/, 'webview uses one-time fragment bootstrap');
+  assert.ok(!panel.webview.html.includes(rt.token), 'webview HTML does not contain the reusable token');
   console.log('SMOKE OK - VS Code shell delegates runtime resolution to shell-core');
 } finally {
   Module._load = originalLoad;