@botiverse/porthole 0.1.7 → 0.1.8

package/dist/conformance/limits.js

@@ -119,7 +119,7 @@ export const LIMIT_PROBES = [
     {
         id: "14.silent",
         item: 14,
-        title: "what the sandbox blocks fails silently: nothing loads, a fetch rejects, nothing is shown",
+        title: "what the sandbox blocks shows nothing on the page: nothing loads, a fetch rejects; the host hears of it where reportError is declared, and nothing where it isn't",
         async run(context) {
             const canary = await context.http();
             const seen = watch(context.page);
@@ -143,6 +143,21 @@ export const LIMIT_PROBES = [
             });
             expect(canary.requests()).toEqual([]);
             expect(seen.dialogs).toEqual([]);
+            // Where reportError is declared, each block is reported to the host (the manual says where
+            // it goes, by \`errors\`, #4); where it isn't, nothing is.
+            await expect
+                .poll(async () => (await display.errors()).some((each) => each.startsWith("Blocked by the sandbox:")))
+                .toBe(true);
+            const quiet = await context.launch({
+                config: inline({ errors: "none" }),
+                content: attack(`
+    r.fetch = await fetch(${js(`${c}/quiet`)}).then(() => "sent", (e) => "rejected " + e.name);`, `<img src="${c}/quiet.png">`),
+            });
+            expect(await context.result(quiet, 15_000)).toMatchObject({ fetch: "rejected TypeError" });
+            await settle();
+            expect(await quiet.errors()).toEqual([]);
+            expect(canary.requests()).toEqual([]);
+            expect(seen.dialogs).toEqual([]);
         },
     },
     {

package/dist/guide/limits.js

@@ -81,7 +81,15 @@ export function manualLimits(config, network) {
         : documents === "never"
             ? "It always shows in light: the app doesn't theme it, so style it yourself; prefers-color-scheme may report the reader's system setting, so don't rely on it."
             : 'It shows in light, as you style it; to follow the person\'s light or dark theme, declare it in its head (<meta name="color-scheme" content="light dark">) and draw with the variables below.');
-    add("silent", "What the sandbox blocks fails silently: a blocked script, style or image just doesn't load, a blocked fetch rejects, and nothing shows an error.");
+    // What a block does on the page, and where it is reported: as the Errors line says (#4).
+    const blocked = "a blocked script, style or image just doesn't load and a blocked fetch rejects";
+    add("silent", !declared.has("reportError")
+        ? "What the sandbox blocks fails silently: a blocked script, style or image just doesn't load, a blocked fetch rejects, and nothing shows an error."
+        : config.errors === "agent"
+            ? `What the sandbox blocks shows nothing on the page: ${blocked}. Each block comes back to you as an error, so check them.`
+            : config.errors === "host"
+                ? `What the sandbox blocks shows nothing on the page: ${blocked}. The app is told of each block, but you aren't: test what you write.`
+                : `What the sandbox blocks shows nothing on the page: ${blocked}. Each block is reported to the app.`);
     add("network", network);
     // Assets: what isn't opened goes inline (Network: none already says "everything inline").
     const anywhere = (kind) => (config.egress.anyHttps ?? []).some((each) => each === kind);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botiverse/porthole",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "A host-side sandbox for agent-made HTML: isolation, egress hardening, a themed shell, gated host functions, and the agent manual, from one config.",
   "license": "Apache-2.0",
   "files": [

package/src/conformance/limits.ts

@@ -150,7 +150,7 @@ export const LIMIT_PROBES: readonly Probe[] = [
     id: "14.silent",
     item: 14,
     title:
-      "what the sandbox blocks fails silently: nothing loads, a fetch rejects, nothing is shown",
+      "what the sandbox blocks shows nothing on the page: nothing loads, a fetch rejects; the host hears of it where reportError is declared, and nothing where it isn't",
     async run(context) {
       const canary = await context.http();
       const seen = watch(context.page);
@@ -177,6 +177,26 @@ export const LIMIT_PROBES: readonly Probe[] = [
       });
       expect(canary.requests()).toEqual([]);
       expect(seen.dialogs).toEqual([]);
+      // Where reportError is declared, each block is reported to the host (the manual says where
+      // it goes, by \`errors\`, #4); where it isn't, nothing is.
+      await expect
+        .poll(async () =>
+          (await display.errors()).some((each) => each.startsWith("Blocked by the sandbox:")),
+        )
+        .toBe(true);
+      const quiet = await context.launch({
+        config: inline({ errors: "none" }),
+        content: attack(
+          `
+    r.fetch = await fetch(${js(`${c}/quiet`)}).then(() => "sent", (e) => "rejected " + e.name);`,
+          `<img src="${c}/quiet.png">`,
+        ),
+      });
+      expect(await context.result(quiet, 15_000)).toMatchObject({ fetch: "rejected TypeError" });
+      await settle();
+      expect(await quiet.errors()).toEqual([]);
+      expect(canary.requests()).toEqual([]);
+      expect(seen.dialogs).toEqual([]);
     },
   },
   {

package/src/guide/limits.ts

@@ -110,9 +110,17 @@ export function manualLimits(config: PortholeConfig, network: string): ManualLim
         : 'It shows in light, as you style it; to follow the person\'s light or dark theme, declare it in its head (<meta name="color-scheme" content="light dark">) and draw with the variables below.',
   );
 
+  // What a block does on the page, and where it is reported: as the Errors line says (#4).
+  const blocked = "a blocked script, style or image just doesn't load and a blocked fetch rejects";
   add(
     "silent",
-    "What the sandbox blocks fails silently: a blocked script, style or image just doesn't load, a blocked fetch rejects, and nothing shows an error.",
+    !declared.has("reportError")
+      ? "What the sandbox blocks fails silently: a blocked script, style or image just doesn't load, a blocked fetch rejects, and nothing shows an error."
+      : config.errors === "agent"
+        ? `What the sandbox blocks shows nothing on the page: ${blocked}. Each block comes back to you as an error, so check them.`
+        : config.errors === "host"
+          ? `What the sandbox blocks shows nothing on the page: ${blocked}. The app is told of each block, but you aren't: test what you write.`
+          : `What the sandbox blocks shows nothing on the page: ${blocked}. Each block is reported to the app.`,
   );
   add("network", network);
   // Assets: what isn't opened goes inline (Network: none already says "everything inline").