fix(client,sdk): the smaller silent failures, and a dead SDK test file

The SDK's parity suite had an unescaped apostrophe in an it() title, so the
file did not parse and vitest reported it as "no tests". Both guards in it
were dead - including the byte-identical egress-policy check the package's own
notes call the worst possible bug in that module to lose. No CI job runs the
SDK suite, so it landed quietly; the next npm publish would have failed on it,
since prepublishOnly runs the tests.

Also in the SDK: the dev preview answered trek:geolocation without checking
the geolocation:read grant, so a plugin whose manifest is missing the
permission works perfectly in dev and is dead once installed. That is the
lenient direction, which is the one that ships broken plugins.

Client side: the background-task poll never dismissed a 404'd import job and
spun forever, "Update All" collapsed its busy flag after the first plugin
settled, the lightbox had no cancellation so a slow signed URL rendered the
wrong image, the plugin geolocation watch was torn down by any unrelated
settings write, manual date entry accepted 31 February, cover previews were
never revoked, and check-all issued one request per packing item.
This commit is contained in:
Maurice
2026-08-23 10:08:38 +02:00
committed by Maurice
parent b3d8bf08f1
commit c75e958fc0
27 changed files with 476 additions and 53 deletions
+12 -7
View File
@@ -483,7 +483,12 @@ export const TREK_THEME_JS = `(function () {
var seq = 0;
var lastH = -1;
function send(msg) { try { window.parent.postMessage(msg, '*'); } catch (e) {} }
function send(msg) { try { window.parent.postMessage(msg, '*'); return true; } catch (e) { return false; } }
// postMessage throws synchronously on a value structured clone cannot carry (a
// function, a DOM node, a Proxy). Swallowing that left the request registered and
// the promise pending forever, so the same call rejects under the mock host and
// hangs in the real one. Drop the entry and reject with the host's own code.
function unsendable(bucket, id, code, message) { delete bucket[id]; var e = new Error(message); e.code = code; return e; }
function setFlag(name, on) { if (on) { docEl.setAttribute(name, ''); } else { docEl.removeAttribute(name); } }
function applyContext(m) {
@@ -593,28 +598,28 @@ export const TREK_THEME_JS = `(function () {
var id = 's' + (++seq);
return new Promise(function (resolve, reject) {
pending[id] = { resolve: resolve, reject: reject };
send({ type: 'trek:session:get', requestId: id, key: key, scope: opts && opts.scope });
if (!send({ type: 'trek:session:get', requestId: id, key: key, scope: opts && opts.scope })) { reject(unsendable(pending, id, 'SESSION_INVALID_VALUE', 'session value must be JSON-serialisable')); }
});
},
set: function (key, value, opts) {
var id = 's' + (++seq);
return new Promise(function (resolve, reject) {
pending[id] = { resolve: resolve, reject: reject };
send({ type: 'trek:session:set', requestId: id, key: key, value: value, scope: opts && opts.scope });
if (!send({ type: 'trek:session:set', requestId: id, key: key, value: value, scope: opts && opts.scope })) { reject(unsendable(pending, id, 'SESSION_INVALID_VALUE', 'session value must be JSON-serialisable')); }
});
},
remove: function (key, opts) {
var id = 's' + (++seq);
return new Promise(function (resolve, reject) {
pending[id] = { resolve: resolve, reject: reject };
send({ type: 'trek:session:remove', requestId: id, key: key, scope: opts && opts.scope });
if (!send({ type: 'trek:session:remove', requestId: id, key: key, scope: opts && opts.scope })) { reject(unsendable(pending, id, 'SESSION_INVALID_VALUE', 'session value must be JSON-serialisable')); }
});
},
clear: function (opts) {
var id = 's' + (++seq);
return new Promise(function (resolve, reject) {
pending[id] = { resolve: resolve, reject: reject };
send({ type: 'trek:session:clear', requestId: id, scope: opts && opts.scope });
if (!send({ type: 'trek:session:clear', requestId: id, scope: opts && opts.scope })) { reject(unsendable(pending, id, 'SESSION_INVALID_VALUE', 'session value must be JSON-serialisable')); }
});
}
};
@@ -641,7 +646,7 @@ export const TREK_THEME_JS = `(function () {
var id = 'c' + (++seq);
return new Promise(function (resolve) {
pendingConfirms[id] = resolve;
send({ type: 'trek:confirm', requestId: id, title: opts.title, message: opts.message, confirmLabel: opts.confirmLabel, cancelLabel: opts.cancelLabel, danger: opts.danger });
if (!send({ type: 'trek:confirm', requestId: id, title: opts.title, message: opts.message, confirmLabel: opts.confirmLabel, cancelLabel: opts.cancelLabel, danger: opts.danger })) { delete pendingConfirms[id]; resolve(false); }
});
},
// Core-event names for the trip in view ({ event, tripId } only, no payloads) —
@@ -655,7 +660,7 @@ export const TREK_THEME_JS = `(function () {
var id = 'r' + (++seq);
return new Promise(function (resolve, reject) {
pending[id] = { resolve: resolve, reject: reject };
send({ type: 'trek:invoke', requestId: id, sub: sub, method: opts.method, body: opts.body });
if (!send({ type: 'trek:invoke', requestId: id, sub: sub, method: opts.method, body: opts.body })) { reject(unsendable(pending, id, 'error', 'invoke body must be JSON-serialisable')); }
});
},
// Host-brokered browser position (needs the geolocation:read grant; the