965f15f5ca
Prevent dashboard code from bypassing Vite's browser-safe core boundary. - Add an allowlist-backed scanner for dashboard core value imports, including dynamic template imports. - Run the scanner in test and merge-gate prechecks, with regression coverage and import guidance. - Document reviewed browser-safe core leaves and Vite alias requirements. Files changed: docs/dashboard-guide.md | 6 + package.json | 6 +- packages/dashboard/vite.config.ts | 5 + ...no-node-only-core-imports-in-dashboard.test.mjs | 80 ++++++++++ ...heck-no-node-only-core-imports-in-dashboard.mjs | 167 +++++++++++++++++++++ .../lib/dashboard-browser-safe-core-modules.json | 59 ++++++++ 6 files changed, 320 insertions(+), 3 deletions(-) Fusion-Task-Id: FN-8368 Fusion-Task-Lineage: 13e70672-d1da-430c-a360-0a714ad33d9f Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
60 lines
2.0 KiB
JSON
60 lines
2.0 KiB
JSON
{
|
|
"modules": [
|
|
{
|
|
"module": "types",
|
|
"reason": "2026-07-16: Vite aliases the package root to this browser-safe compatibility leaf.",
|
|
"verifiedAt": "2026-07-16"
|
|
},
|
|
{
|
|
"module": "near-duplicate-canonical",
|
|
"reason": "2026-07-16: Canonical activity helpers import types only, unlike near-duplicate which reaches node:crypto.",
|
|
"verifiedAt": "2026-07-16"
|
|
},
|
|
{
|
|
"module": "task-merge",
|
|
"reason": "2026-07-16: Shared task merge predicates are browser-safe UI logic.",
|
|
"verifiedAt": "2026-07-16"
|
|
},
|
|
{
|
|
"module": "model-pricing",
|
|
"reason": "2026-07-16: Model cost data and calculations have no Node-only dependencies.",
|
|
"verifiedAt": "2026-07-16"
|
|
},
|
|
{
|
|
"module": "mobile-nav-primary-items",
|
|
"reason": "2026-07-16: Mobile navigation selection helpers use erased core types only.",
|
|
"verifiedAt": "2026-07-16"
|
|
},
|
|
{
|
|
"module": "active-merge-status",
|
|
"reason": "2026-07-16: Merge-status predicate is a dependency-free browser helper.",
|
|
"verifiedAt": "2026-07-16"
|
|
},
|
|
{
|
|
"module": "workflow-settings-resolver",
|
|
"reason": "2026-07-16: Workflow setting resolution uses browser-safe workflow metadata helpers.",
|
|
"verifiedAt": "2026-07-16"
|
|
},
|
|
{
|
|
"module": "settings-schema",
|
|
"reason": "2026-07-16: Settings defaults and validation metadata are browser-safe.",
|
|
"verifiedAt": "2026-07-16"
|
|
},
|
|
{
|
|
"module": "session-advisor",
|
|
"reason": "2026-07-16: Session advisory predicates use erased core types only.",
|
|
"verifiedAt": "2026-07-16"
|
|
},
|
|
{
|
|
"module": "blocker-fanout",
|
|
"reason": "2026-07-16: Blocker fanout helper is dependency-free browser logic.",
|
|
"verifiedAt": "2026-07-16"
|
|
},
|
|
{
|
|
"module": "detect-content-language",
|
|
"reason": "2026-07-16: Language detection is pure shared string logic with an explicit Vite subpath alias.",
|
|
"verifiedAt": "2026-07-16"
|
|
}
|
|
]
|
|
}
|