Skip to content

Add first-class Firefox Notebook modules - #370

Merged
NotASithLord merged 1 commit into
mainfrom
codex/issue-365-firefox-imports
Aug 9, 2026
Merged

Add first-class Firefox Notebook modules#370
NotASithLord merged 1 commit into
mainfrom
codex/issue-365-firefox-imports

Conversation

@NotASithLord

Copy link
Copy Markdown
Owner

Closes #365

What changed

  • Link the authorized Notebook module graph into one sealed module for Firefox. Chrome keeps its native module graph.
  • Run linked code in an opaque sandbox host with no extension APIs or network access.
  • Enable Preview remote imports on Firefox under the same compute-only policy and audited fetch path. Store packages still refuse them.
  • Make Stop and deadlines cancel resolution, linking, fetch, and execution.
  • Give users and models distinct stopped, busy, and timeout outcomes.
  • Map Firefox and Chrome failures back to source files without generated URLs.
  • Update the threat model, red-team suite, design notes, and vendored dependency record.

Verification

  • Release preflight passed.
  • 5,663 Bun tests passed.
  • 864 in-browser Chrome tests passed.
  • Packaged Firefox Store and Preview module smoke passed.
  • Full packaged Firefox runtime and 858 shared Gecko browser tests passed before the final focused fixes.
  • Chrome Notebook Stop, source mapping, recovery, focus, and screenshots passed.
  • All 13 red-team scenarios passed.
  • Security, browser-parity, human UX, accessibility, and model-UX reviews have no remaining findings.

@github-actions

github-actions Bot commented Aug 9, 2026

Copy link
Copy Markdown

Visual regression

No visual drift. Every state renders identically to the committed baselines.

📸 Browse the visual gallery — 54 baseline screens (light + dark) as of this commit.


import { linkSingleModuleWorkerDetailed } from '/peerd-engine/index.js';

self.addEventListener('message', async (event) => {
@NotASithLord
NotASithLord merged commit 5de5c9a into main Aug 9, 2026
19 checks passed
@NotASithLord
NotASithLord deleted the codex/issue-365-firefox-imports branch August 9, 2026 05:33
jonybur added a commit that referenced this pull request Aug 9, 2026
… SW start

The denylist seed hydrates async at service-worker boot, and webFetch's
getDenylist does a synchronous readiness check. A sw/web-fetch request
(Notebook module fetch, VM egress) that raced a cold start was refused
with DenylistPolicyUnavailableError instead of waiting - the packaged
page boot job hit exactly this on main's #370 merge run (the same tree
passed on the PR branch and locally).

The engine route now awaits an injected awaitDenylistPolicy gate
(requireDenylistPolicy(await denylistReady)) before any fetch work, so
the race becomes a short wait while a genuinely failed hydration still
refuses before any egress. The sync check inside getDenylist stays as
the last-resort chokepoint for every other direct caller.

Signed-off-by: Jonathan Bursztyn <jobur93@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Firefox Notebook static imports crash on generated child module URLs

2 participants