feat(onboarding): add real first-run export flow - #23
Merged
kristoffersodersten merged 3 commits intoAug 10, 2026
Merged
Conversation
Route a fixed local sample through the paid extraction contract and persist successful completion. Replace static AES material with a per-install non-exportable key and cover the locked path plus encrypted round-trip.\n\nVerified: pnpm typecheck; pnpm exec tsc -p tsconfig.json; node --test tests/panel/*.test.mjs
… codex/sod-617-first-run-export
Allow the full browser suite and unpacked-extension proof to run against the same explicitly selected Chrome binary.\n\nVerified: SELECTPILOT_CHROME_EXECUTABLE=<local Chrome> pnpm test:e2e (7 passed); pnpm lint
kristoffersodersten
merged commit Aug 10, 2026
12c4137
into
codex/ci-foundation-repair
3 checks passed
There was a problem hiding this comment.
Pull request overview
Adds a real “first-run” demo extraction flow that uses a fixed local example (no caller-provided text) and persists completion, while also upgrading local storage encryption to use a per-install random AES‑GCM key.
Changes:
- Replace static AES key material with a randomly generated per-install AES‑GCM key persisted in
chrome.storage.local. - Introduce a dedicated first-run example route + background message (
panel:extract_demo) and render/export the result once, then persist completion. - Add panel + e2e tests covering encryption round-trip and first-run flow (including unpacked extension verification).
Reviewed changes
Copilot reviewed 16 out of 16 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| utils/storage.ts | Switches encryption keying to a per-install random AES‑GCM key and caches the imported CryptoKey. |
| utils/storage.js | Built output matching the new per-install AES‑GCM key behavior. |
| tests/panel/storage-encryption.test.mjs | Adds panel-level test verifying encrypted storage round-trip and key persistence. |
| tests/panel/first-run-example.test.mjs | Adds test enforcing the first-run example is fixed/frozen and uses expected preset fields. |
| tests/e2e/playwright.config.mjs | Allows overriding Chrome executable path via SELECTPILOT_CHROME_EXECUTABLE. |
| tests/e2e/panel-user-flow.spec.mjs | Adds harness-level e2e test for unlocked first-run example flow and single resolution. |
| tests/e2e/panel-harness.html | Adds harness support for first-run mode and stubs panel:extract_demo response + message logging. |
| tests/e2e/extension-first-run-flow.spec.mjs | Adds unpacked-extension e2e proof that only canonical example text reaches /extract. |
| shared/first-run-example.ts | Introduces typed, frozen canonical first-run example payload. |
| shared/first-run-example.js | Built output for the canonical first-run example payload. |
| panel/panel.ts | Adds first-run UI state, button wiring, persistence, and demo extraction rendering/export. |
| panel/panel.js | Built output reflecting panel first-run flow behavior. |
| panel/panel.css | Styles the new “Try local example” button. |
| DEMO_SCRIPT.md | Updates demo steps to include the first-run local example and persistence behavior. |
| background/background.ts | Adds panel:extract_demo handler that enforces paid/feature gate and calls /extract with canonical example. |
| background/background.js | Built output reflecting the new background handler. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+20
to
+23
| function getCryptoKey(): Promise<CryptoKey> { | ||
| cryptoKeyPromise ||= loadOrCreateCryptoKey(); | ||
| return cryptoKeyPromise; | ||
| } |
Comment on lines
+18
to
+21
| function getCryptoKey() { | ||
| cryptoKeyPromise ||= loadOrCreateCryptoKey(); | ||
| return cryptoKeyPromise; | ||
| } |
|
|
||
| const { getDecrypted, setEncrypted } = await import('../../utils/storage.js'); | ||
|
|
||
| test('AES-GCM storage creates a non-exportable per-install key and round-trips data', async () => { |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/extractcontractVerification
pnpm lintpnpm lint:manifestpnpm typecheckpnpm test(5 panel tests, 25 server tests)SELECTPILOT_CHROME_EXECUTABLE=<local Chrome> pnpm test:e2e(7 passed, including unpacked extension)git diff --check origin/codex/ci-foundation-repair...HEADRisk / Rollout