test(wordpress): bind browser isolation to recorded parent namespace

Author: CompleteDotTech

docs/WORDPRESS.md

@@ -696,8 +696,8 @@ The edit-screen final-close metabox links to the private queue; it never nests a
 second form inside WordPress's post editor. Its actual projected database row
 includes every field required by the trusted-event validator. For an offline
 browser regression, run the standalone report fixture with
-`CT_SCAN_METABOX_DOM_FIXTURE` set to a new private HTML path, then invoke
-`standalone-tests/metabox-dom.mjs` under `bwrap --unshare-net` with that HTML,
+`CT_SCAN_METABOX_DOM_FIXTURE` set to a new private HTML path, record the current `/proc/self/ns/net` value in `CT_SCAN_DOM_PARENT_NETNS`,
+then invoke `standalone-tests/metabox-dom.mjs` under `bwrap --unshare-net` with that HTML,
 an already-installed Playwright module path and Chromium executable. The check
 intercepts ordinary post saving and requires one original post action/nonce,
 intact form ownership and zero network requests; it sends no submission.

integrations/wordpress/standalone-tests/metabox-dom.mjs

@@ -3,7 +3,8 @@ import fs from 'node:fs';
 import { pathToFileURL } from 'node:url';
 const [htmlPath, playwrightPath, chromiumPath] = process.argv.slice(2);
 if (!htmlPath || !playwrightPath || !chromiumPath) throw new Error('HTML, installed Playwright module, Chromium executable required');
-if(fs.readlinkSync('/proc/self/ns/net')===fs.readlinkSync('/proc/1/ns/net')) throw new Error('Browser check requires an isolated network namespace');
+const parentNetns=process.env.CT_SCAN_DOM_PARENT_NETNS;
+if(!/^net:\[\d+\]$/.test(parentNetns||'')||fs.readlinkSync('/proc/self/ns/net')===parentNetns) throw new Error('Browser check requires a recorded parent and isolated network namespace');
 const { chromium } = await import(pathToFileURL(playwrightPath).href);
 const browser = await chromium.launch({executablePath: chromiumPath, headless:true,
   args:['--no-sandbox','--disable-background-networking','--disable-dev-shm-usage']});