Repository navigation
Conversation
Actions are pinned to commit SHAs with the tag kept as a comment, so a moved tag cannot change what runs. The license check gets a read-only token, a concurrency group and a timeout, and pins license-checker to 25.0.1 so the gate is deterministic. Release runs are serialised. What each workflow runs is unchanged.
Summarises setup including the mcp package, the commands CI runs, the plugin boundary, display-units and license rules, and the style notes from CONTRIBUTING and the development guide.
The main chunk drops from 3522 kB to 2769 kB minified; three and three-mesh-bvh (632 kB) and react, react-dom and zustand (195 kB) now load as separate chunks that stay cached across app releases. Total bytes on first load are unchanged. Lazy-loading workspaces was left out because it touches the plugin registry and app shell.
public/_headers gives every static asset a CSP plus nosniff, a referrer policy and frame denial. The page allows its own scripts with wasm-unsafe-eval for the WebAssembly workers, https fetches for the file store and open links, and loopback http and WebSocket for the agent link. The CAD kernel workers alone also get unsafe-eval because the occt-wasm bindings are built with new Function. The theme bootstrap moves from an inline script to public/theme.js so the policy needs no inline-script allowance. Checked by serving the built dist with these headers and running the production smoke, agent and Reverse engineer kernel checks in headless Chrome with no CSP violations.
58 of 65 tasks
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The infra and docs items from #34, rebased on 0.9.3, one commit each:
Notes:
public/_headerssends a policy withscript-src 'self' 'wasm-unsafe-eval',connect-srcfor https and the local agent ports, andframe-ancestors 'none', plus nosniff and the referrer policy. The OCCT kernel's bindings usenew Function, so the two kernel worker paths get'unsafe-eval'; the page keeps the strict policy. The inline theme script moved topublic/theme.js. I tested it against the built app with the headers applied by a local server: import, the agent link, exports and the kernel all worked with no violations. Worth checking on a preview deploy: the mid-name*match on the worker paths, and that! Content-Security-Policyreplaces the base policy.Build:
npm run buildpasses.npm test(3094),npm --prefix mcp test(127), the plugin boundary and units checks, andnpm run e2e:ciall pass.