Skip to content

feat: add chrome extension on top of wasm#24

Open
meysam81 wants to merge 4 commits into
mainfrom
claude/cli-to-extension-wasm-pc10E
Open

feat: add chrome extension on top of wasm#24
meysam81 wants to merge 4 commits into
mainfrom
claude/cli-to-extension-wasm-pc10E

Conversation

@meysam81
Copy link
Copy Markdown
Owner

Proves internal/audit, internal/rules (CEL), internal/model and
internal/schema compile cleanly under GOOS=js GOARCH=wasm and run
correctly: 24 real issues returned in 20ms, 0.54ms/audit warm, 2.9MB
gzipped with -ldflags="-s -w" -trimpath.

Build-tagged //go:build js && wasm so it stays inert for the native CLI.

claude and others added 3 commits April 22, 2026 18:12
… port

Proves internal/audit, internal/rules (CEL), internal/model and
internal/schema compile cleanly under GOOS=js GOARCH=wasm and run
correctly: 24 real issues returned in 20ms, 0.54ms/audit warm, 2.9MB
gzipped with -ldflags="-s -w" -trimpath.

Build-tagged //go:build js && wasm so it stays inert for the native CLI.
Move the audit logic out of internal/ into core/ so the CLI and the
new browser extension both consume one implementation with two
frontends:

  internal/audit  -> core/checks   (package renamed audit -> checks)
  internal/model  -> core/model
  internal/rules  -> core/rules
  internal/schema -> core/schema
  core/engine    (new)             thin orchestrator for both callers

cmd/wasm now uses core/engine and exposes a { ok, data, error }
envelope consumed by the extension over syscall/js.

The extension (extension/) is a Vue 3 + CRXJS + Vite 8 + TypeScript +
Zod + Bun side panel. It captures real response headers via
chrome.webRequest.onResponseStarted, extracts the DOM via a content
script, and hands a PageSnapshot to the service worker which owns a
single WasmRuntime instance. Every payload crossing the WASM ↔ JS
boundary is Zod-validated — invalid data becomes null, never a throw.

Design tokens (Sanity-inspired, dark-first) live in
extension/src/styles/tokens.css; no component hard-codes colour,
radius, font, or spacing. Home tab is the juiciest view: editorial
serif score dial, per-category health bars, top critical issues,
page facts, detected tech stack.

Pre-existing flaky tests in core/checks/structured_data_v2_test.go
are unchanged and still flaky (map iteration order); not addressed
here.
@socket-security
Copy link
Copy Markdown

socket-security Bot commented Apr 22, 2026

@socket-security
Copy link
Copy Markdown

socket-security Bot commented Apr 22, 2026

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm entities is 91.0% likely obfuscated

Confidence: 0.91

Location: Package overview

From: ?npm/@crxjs/vite-plugin@2.4.0npm/entities@4.5.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/entities@4.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@meysam81 meysam81 changed the title spike(wasm): expose audit engine via syscall/js for browser extension port feat: add chrome extension on top of wasm Apr 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants