@stevecastaneda/paseo-progress 1.14.3 → 1.14.4

package/README.md

@@ -178,6 +178,10 @@ The progress file, `progress.jsonl`, holds one JSON event per line, each with a
 
 ## Changelog
 
+### 1.14.4
+
+- [Improved] **Agents learn what Paseo's preview blocks.** Paseo opens an HTML deliverable in a sandboxed preview, where some common page code fails without a visible error. Saving to localStorage, sessionStorage, cookies or IndexedDB throws, so a page that loads its saved state first stops before it draws anything. `alert`, `confirm`, `prompt`, `window.open` and form submits do nothing, `navigator.clipboard` throws, and one syntax error stops a whole script. The skill and the command help now list these, with what to do instead.
+
 ### 1.14.3
 
 - [Fixed] **Open hands only pictures, video, audio, PDFs and text to their default app.** This fixes a security issue in opening deliverables. Progress used to open any file an agent recorded with its default app, and for a script or an app that means running it. Now Open works only for images, video, audio, PDFs and text files. Pressing any other file, an SVG file or a folder copies its path, and an HTML page always opens in Paseo.

package/dist/server/cli.js

@@ -21004,7 +21004,7 @@ ${modeLine(mode)}`
   },
   "deliverable add": {
     usage: `deliverable add "<title>" <path or http(s) URL> [--ticket <id>] [--kind ${DELIVERABLE_KINDS.join("|")}]`,
-    summary: `Add something the user can review. Paths are relative to where you run the command. Prints its id (D1, D2, ...). An HTML deliverable must be self-contained, with its CSS in the page and images embedded as data URIs, and no scripts or styles from the web, because Paseo's preview blocks the network.`,
+    summary: `Add something the user can review. Paths are relative to where you run the command. Prints its id (D1, D2, ...). An HTML deliverable opens in Paseo's sandboxed preview, which blocks everything from the web, so put its CSS in the page and embed images as data URIs. In the preview, storage APIs and navigator.clipboard throw an error. The alert, confirm, prompt and window.open calls and form submits do nothing. One syntax error stops a whole script.`,
     options: { ticket: { type: "string" }, kind: { type: "string" } },
     run({ positionals, values, state, cwd, root }) {
       const title = required2(positionals[0], "deliverable title");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stevecastaneda/paseo-progress",
-  "version": "1.14.3",
+  "version": "1.14.4",
   "description": "A live progress dashboard per worktree for Paseo, drawn from a file agents write with the Progress tools or the paseo-progress command.",
   "keywords": [
     "coding-agents",

package/server/cli.ts

@@ -397,7 +397,7 @@ const commands: Record<string, Command> = {
   },
   "deliverable add": {
     usage: `deliverable add "<title>" <path or http(s) URL> [--ticket <id>] [--kind ${DELIVERABLE_KINDS.join("|")}]`,
-    summary: `Add something the user can review. Paths are relative to where you run the command. Prints its id (D1, D2, ...). An HTML deliverable must be self-contained, with its CSS in the page and images embedded as data URIs, and no scripts or styles from the web, because Paseo's preview blocks the network.`,
+    summary: `Add something the user can review. Paths are relative to where you run the command. Prints its id (D1, D2, ...). An HTML deliverable opens in Paseo's sandboxed preview, which blocks everything from the web, so put its CSS in the page and embed images as data URIs. In the preview, storage APIs and navigator.clipboard throw an error. The alert, confirm, prompt and window.open calls and form submits do nothing. One syntax error stops a whole script.`,
     options: { ticket: { type: "string" }, kind: { type: "string" } },
     run({ positionals, values, state, cwd, root }) {
       const title = required(positionals[0], "deliverable title");

package/skills/paseo-progress/SKILL.md

@@ -25,7 +25,13 @@ Done when `show` lists every ticket with an estimate.
 
 Move each ticket through `--status working --stage Build`, then the stages `Review`, `Fixes` and `Verify`, then `--status done`. Along the way, record what the user would want to see: `deliverable add` for anything reviewable, `activity add` for milestones, `ticker set` for what you are doing right now. Tag each with `--ticket` unless it covers the whole run.
 
-- An HTML deliverable must be self-contained, with its CSS in the page and images embedded as data URIs, and no scripts or styles from the web, because Paseo's preview blocks the network.
+- An HTML deliverable opens in Paseo's preview, a sandboxed frame. Write the page for it:
+  - Keep it self-contained, with its CSS in the page and images embedded as data URIs. The preview blocks every script, style and image from the web.
+  - Keep the page's state in variables. localStorage, sessionStorage, cookies and IndexedDB throw an error.
+  - Show messages in the page. `alert`, `confirm`, `prompt` and `window.open` do nothing. `confirm` returns false and `prompt` returns null.
+  - Handle form input in a script. A form never submits.
+  - To copy text, select a hidden textarea and call `document.execCommand("copy")`. `navigator.clipboard` throws an error.
+  - Check that each script parses before you add the page. One syntax error stops that whole script, and the page can open blank.
 - A ticket past its estimate with no update turns stuck. Keep its stage current, or raise its `--estimate`.
 - A ticket another session adds is part of the plan. Work it in order.
 - `--status blocked` and `stuck set` are for things outside the run, like a service that's down or missing access.