Merge main into codex/tempdir-media-spooling

pkg/download/engine/webview/rpc.go

@@ -5,6 +5,7 @@ import "encoding/json"
 const RPCEndpointPath = "/webview"
 
 const (
+	MethodProfileRemove     = "profile.remove"
 	MethodIsAvailable       = "webview.isAvailable"
 	MethodPageOpen          = "page.open"
 	MethodPageAddInitScript = "page.addInitScript"
@@ -68,6 +69,9 @@ type IsAvailableResult struct {
 }
 
 type PageOpenParams struct {
+	ProfileID string `json:"profileId,omitempty"`
+	DataPath  string `json:"dataPath,omitempty"`
+	ProxyURL  string `json:"proxyUrl,omitempty"`
 	Headless  bool   `json:"headless,omitempty"`
 	Debug     bool   `json:"debug,omitempty"`
 	Title     string `json:"title,omitempty"`
@@ -78,6 +82,9 @@ type PageOpenParams struct {
 
 func NewPageOpenParams(opts OpenOptions) PageOpenParams {
 	return PageOpenParams{
+		ProfileID: opts.ProfileID,
+		DataPath:  opts.DataPath,
+		ProxyURL:  opts.ProxyURL,
 		Headless:  opts.Headless,
 		Debug:     opts.Debug,
 		Title:     opts.Title,
@@ -141,3 +148,8 @@ type PageCloseParams struct {
 }
 
 type EmptyResult struct{}
+
+// ProfileRemoveParams belongs to the private host RPC.
+type ProfileRemoveParams struct {
+	ProfileID string `json:"profileId"`
+}

pkg/download/engine/webview/runtime.go

@@ -17,6 +17,11 @@ type Opener interface {
 	Open(opts OpenOptions) (Page, error)
 }
 
+// ProfileRemover is a host-only lifecycle operation, never exposed to extension JS.
+type ProfileRemover interface {
+	RemoveProfile(profileID, dataPath string) error
+}
+
 type Page interface {
 	AddInitScript(script string) error
 	Goto(url string, opts GotoOptions) error
@@ -29,6 +34,10 @@ type Page interface {
 }
 
 type OpenOptions struct {
+	// Host-owned fields are never parsed from extension JavaScript options.
+	ProfileID string
+	DataPath  string
+	ProxyURL  string
 	Headless  bool
 	Debug     bool
 	Title     string

pkg/download/engine/webview/runtime_test.go

@@ -336,3 +336,15 @@ func (p *fakePage) Close() error {
 	p.closed = true
 	return nil
 }
+
+func TestExtensionCannotSupplyHostProfileOrProxy(t *testing.T) {
+	opener := &fakeOpener{page: &fakePage{}}
+	runtime := NewRuntime(opener, true)
+	_, err := runtime.Open(map[string]any{"profileId": "other-extension", "dataPath": "/tmp/other-profile", "proxyUrl": "http://example.com:1234", "ProfileID": "other"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if opener.opts.ProfileID != "" || opener.opts.DataPath != "" || opener.opts.ProxyURL != "" {
+		t.Fatalf("extension controlled host settings: %+v", opener.opts)
+	}
+}