From 80040ed982bc6bb154d35e86320fd3870fd7fa99 Mon Sep 17 00:00:00 2001 From: Nate Moore Date: Fri, 30 Oct 2026 08:03:25 -0700 Subject: [PATCH] Confirm the Safari sandbox probe on default feature flags --- docs/VISION.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/VISION.md b/docs/VISION.md index 0c6afcd..3f24043 100644 --- a/docs/VISION.md +++ b/docs/VISION.md @@ -88,7 +88,7 @@ Probed 2026-10-30 (sandbox origins): a coordinator page on `localhost` embedded Engine differences: - WebKit refuses an iframe served with COEP `credentialless`. Use `require-corp`. -- In Playwright's WebKit build, OPFS fails with `UnknownError` even in a top-level page. Real Safari 27.0, with non-default feature flags enabled (which flags is not recorded), does not have this problem: OPFS writes and a worker's sync access handle work both top-level and in a cross-site iframe, and the iframe is cross-origin isolated with `SharedArrayBuffer`. The real-runtime sandbox probe also passed in Safari 27.0 (boot, ESM run in 118 ms, re-run after `applyFiles` in 30 ms, guest HTTP in 30 ms). Use real Safari, not Playwright's WebKit, to test storage. Until the probe passes with Safari's default feature flags, treat Safari support as unconfirmed for consumers. +- In Playwright's WebKit build, OPFS fails with `UnknownError` even in a top-level page. Real Safari 27.0 on its default feature flags does not have this problem: OPFS writes and a worker's sync access handle work both top-level and in a cross-site iframe, and the iframe is cross-origin isolated with `SharedArrayBuffer`. The real-runtime sandbox probe also passed in Safari 27.0 on default flags (boot, ESM run in 151 ms, re-run after `applyFiles` in 110 ms, guest HTTP in 171 ms). An earlier run with extra feature flags enabled also passed. Use real Safari, not Playwright's WebKit, to test storage. - A synthetic probe saw Firefox's Service Worker fail to serve a nested worker's `import()` of a virtual module, while `fetch()` of the same URL worked. The runtime's own Service Worker, which also sets COEP and CORP on module responses, served nested-worker imports in Firefox without error. The difference is not explained yet. Changes the sandbox tier needs in `packages/runtime/src/node/server.ts`: sandbox origins must send CORP `cross-origin` (the `resourcePolicy` option exists; the default is `same-origin`), and `contentSecurityPolicy()` needs a `frame-src` option so a coordinator can frame its sandboxes. @@ -245,7 +245,7 @@ Consequences: 1. Accept or amend these decisions. 2. Probe gitoxide on WASI, since jj in the browser depends on it. (The CSP, knot CORS, and jj-lib probes ran on 2026-10-30; see D3 and the open questions.) -3. Done 2026-10-30 (see D3): the sandbox-origin probe passed in all three engines. Real Safari 27.0 also passed, but with non-default feature flags; it needs a re-run on defaults. Follow-ups are Service Worker restarts and the `server.ts` header options. +3. Done 2026-10-30 (see D3): the sandbox-origin probe passed in all three engines. Real Safari 27.0 also passed on its default feature flags. Follow-ups are Service Worker restarts and the `server.ts` header options. 4. Add personalities to the spawn spec (D2). 5. Add the `nib:` scheme with a scoped `nib:fs` and `nib:context`, and generate their types. 6. Design the store and namespace format (D5), then build OPFS on it. -- knotmirror 0.0.1