A webview view for build parameters, persisted per workspace and applied to local runs as --name value.
Implemented on feature/views-and-run-config (#2) — src/runConfig.ts (RunConfigStore, RunConfigViewProvider).
Behaviour
- Parameters live in
workspaceState — per workspace, plain, no secrets.
buildArgs() renders them as --name value, quoting values containing whitespace and escaping embedded quotes.- The view is a form: add, edit inline, remove. Changes fire
onDidChange, which re-posts state to the webview.
Webview hardening
Worth preserving through any refactor:
- CSP with a per-load nonce;
default-src 'none', scripts only via the nonce.
- All DOM construction uses
textContent / .value, never innerHTML with data — no injection path from a parameter name or value.
Related
The view is free-form: it shows only what you hand-type. Populating it from the build's own [Parameter] declarations is #1, blocked on Fallout#499 (still open — build-graph.json has no parameters[] yet).
Depends on #9.
Acceptance
A webview view for build parameters, persisted per workspace and applied to local runs as
--name value.Implemented on
feature/views-and-run-config(#2) —src/runConfig.ts(RunConfigStore,RunConfigViewProvider).Behaviour
workspaceState— per workspace, plain, no secrets.buildArgs()renders them as--name value, quoting values containing whitespace and escaping embedded quotes.onDidChange, which re-posts state to the webview.Webview hardening
Worth preserving through any refactor:
default-src 'none', scripts only via the nonce.textContent/.value, neverinnerHTMLwith data — no injection path from a parameter name or value.Related
The view is free-form: it shows only what you hand-type. Populating it from the build's own
[Parameter]declarations is #1, blocked on Fallout#499 (still open —build-graph.jsonhas noparameters[]yet).Depends on #9.
Acceptance
innerHTMLused for data