feat: upgrade browser target to Chrome 148 and implement extensive runtime facades for DOM, network, and performance shielding

Author: lemon-mint

biome.jsonc

@@ -18,10 +18,7 @@
       "!**/bin",
       "!rewriter-rs/target",
       "!package-lock.json",
-      // generated wasm glue / loaders — not hand-authored source
-      "!web/oxc-parser.js",
       "!web/wasm_exec.js",
-      "!web/oxc_parser_wasm_bg.wasm",
       "!**/*.wasm"
     ]
   },

cmd/wasm-kernel/deliver_test.go

@@ -74,6 +74,28 @@ func runDeliver(req *http.Request, resp *http.Response, finalURL *url.URL) deliv
 	return out
 }
 
+func installDeliverTestRewriter(t *testing.T) func() {
+	t.Helper()
+	rewriter := js.Global().Get("ZPRewriter")
+	rewriteHTML := js.FuncOf(func(_ js.Value, args []js.Value) any {
+		source := ""
+		if len(args) > 0 {
+			source = args[0].String()
+		}
+		return map[string]any{
+			"ok":   true,
+			"code": source + "<!--rewritten-by-test-rewriter-->",
+		}
+	})
+	js.Global().Set("ZPRewriter", map[string]any{
+		"rewriteHTMLDocument": rewriteHTML,
+	})
+	return func() {
+		rewriteHTML.Release()
+		js.Global().Set("ZPRewriter", rewriter)
+	}
+}
+
 func deliverReq(hdr map[string]string, raw string) *http.Request {
 	u, _ := url.Parse(raw)
 	r := &http.Request{Method: "GET", URL: u, Header: http.Header{}}
@@ -112,6 +134,9 @@ func mustURL(t *testing.T, raw string) *url.URL {
 // teardown-ownership flag), basic response delivery, document transform, and
 // cookie capture / credentials-omit.
 func TestDeliverResponseOwnershipAndDelivery(t *testing.T) {
+	cleanupRewriter := installDeliverTestRewriter(t)
+	defer cleanupRewriter()
+
 	plain := "https://t.test/a.js"
 
 	// Body present -> ownership transfers to the body cancel goroutine -> false.

cmd/wasm-kernel/main.go

@@ -208,11 +208,7 @@ func transformDocumentResponse(req *http.Request, resp *http.Response, tab *zpht
 			Servers:               headerServers(req.Header.Get("X-Zp-Relay-Servers")),
 			DynamicCompileAllowed: dynamicCompileAllowed,
 			ReferrerPolicy:        referrerPolicy,
-			ScriptRewriter:        rewriteScriptFromJS,
-			ScriptURLRewriter:     rewriteScriptURLFromJS,
-			FetchURLRewriter:      rewriteFetchURLFromJS,
-			CSSRewriter:           rewriteCSSFromJS,
-			ImportMapRewriter:     rewriteImportMapFromJS,
+			DocumentRewriter:      rewriteHTMLDocumentFromJS,
 		})
 		closeErr := source.Close()
 		if err != nil {
@@ -301,88 +297,31 @@ func cookieRecordsForJS(records []cookiejar.SnapshotRecord) []any {
 	return out
 }
 
-func rewriteScriptFromJS(source, kind, targetURL, controlPrefix, tabID, runtimeToken string) (string, error) {
+func rewriteHTMLDocumentFromJS(source, targetURL, controlPrefix, runtimePrelude, tabID, runtimeToken string, servers []string) (string, error) {
 	rewriter := js.Global().Get("ZPRewriter")
-	if !rewriter.Truthy() || rewriter.Get("rewriteScript").Type() != js.TypeFunction {
-		return "", fmt.Errorf("REALM_INJECTION_FAILURE")
+	if !rewriter.Truthy() || rewriter.Get("rewriteHTMLDocument").Type() != js.TypeFunction {
+		return "", fmt.Errorf("HTML_DOCUMENT_REWRITE_UNAVAILABLE")
 	}
-	out := rewriter.Call("rewriteScript", source, map[string]any{
-		"kind":          kind,
+	out := rewriter.Call("rewriteHTMLDocument", source, map[string]any{
 		"targetUrl":     targetURL,
 		"controlPrefix": controlPrefix,
+		"prelude":       runtimePrelude,
 		"tabId":         tabID,
 		"runtimeToken":  runtimeToken,
-		"strict":        true,
+		"servers":       stringsForJS(servers),
 	})
 	if out.Truthy() && out.Get("ok").Bool() {
 		return out.Get("code").String(), nil
 	}
-	return "", fmt.Errorf("REWRITE_FAILED")
+	return "", fmt.Errorf("HTML_DOCUMENT_REWRITE_FAILED")
 }
 
-func rewriteScriptURLFromJS(raw, kind, targetURL, controlPrefix, tabID, runtimeToken string) (string, string, error) {
-	rewriter := js.Global().Get("ZPRewriter")
-	if !rewriter.Truthy() || rewriter.Get("rewriteScriptURL").Type() != js.TypeFunction {
-		return "", "", fmt.Errorf("REALM_INJECTION_FAILURE")
-	}
-	out := rewriter.Call("rewriteScriptURL", raw, map[string]any{
-		"kind":          kind,
-		"targetUrl":     targetURL,
-		"controlPrefix": controlPrefix,
-		"tabId":         tabID,
-		"runtimeToken":  runtimeToken,
-	})
-	if out.Truthy() && out.Get("ok").Bool() {
-		return out.Get("url").String(), out.Get("target").String(), nil
+func stringsForJS(values []string) []any {
+	out := make([]any, 0, len(values))
+	for _, value := range values {
+		out = append(out, value)
 	}
-	return "", "", fmt.Errorf("REWRITE_FAILED")
-}
-
-func rewriteFetchURLFromJS(raw, targetURL, controlPrefix string) (string, string, error) {
-	rewriter := js.Global().Get("ZPRewriter")
-	if !rewriter.Truthy() || rewriter.Get("rewriteFetchURL").Type() != js.TypeFunction {
-		return "", "", fmt.Errorf("REALM_INJECTION_FAILURE")
-	}
-	out := rewriter.Call("rewriteFetchURL", raw, map[string]any{
-		"targetUrl":     targetURL,
-		"controlPrefix": controlPrefix,
-	})
-	if out.Truthy() && out.Get("ok").Bool() {
-		return out.Get("url").String(), out.Get("target").String(), nil
-	}
-	return "", "", fmt.Errorf("REWRITE_FAILED")
-}
-
-func rewriteCSSFromJS(source, baseURL string) (string, error) {
-	rewriter := js.Global().Get("ZPRewriter")
-	if !rewriter.Truthy() || rewriter.Get("rewriteCSS").Type() != js.TypeFunction {
-		return "", fmt.Errorf("CSS_REWRITE_UNAVAILABLE")
-	}
-	out := rewriter.Call("rewriteCSS", source, map[string]any{
-		"baseUrl":       baseURL,
-		"controlPrefix": "/zp/",
-	})
-	if out.Truthy() && out.Get("ok").Bool() {
-		return out.Get("code").String(), nil
-	}
-	return "", fmt.Errorf("CSS_REWRITE_FAILED")
-}
-
-func rewriteImportMapFromJS(source, baseURL, tabID, runtimeToken, controlPrefix string) (string, error) {
-	rewriter := js.Global().Get("ZPRewriter")
-	if !rewriter.Truthy() || rewriter.Get("rewriteImportMap").Type() != js.TypeFunction {
-		return "", fmt.Errorf("IMPORT_MAP_REWRITE_UNAVAILABLE")
-	}
-	out := rewriter.Call("rewriteImportMap", source, map[string]any{
-		"baseUrl":       baseURL,
-		"tabId":         tabID,
-		"runtimeToken":  runtimeToken,
-		"controlPrefix": controlPrefix,
-	})
-	if out.Truthy() && out.Get("ok").Bool() {
-		return out.Get("code").String(), nil
-	}
-	return "", fmt.Errorf("IMPORT_MAP_REWRITE_FAILED")
+	return out
 }
 
 func targetDynamicCompileAllowed(h http.Header) bool {

cmd/zeroproxy-server/main.go

@@ -134,6 +134,8 @@ func (s *server) serveAsset(w http.ResponseWriter, r *http.Request, name string)
 	switch name {
 	case "zp-core.js", "runtime-prelude.js", "rust-rewriter.js", "http-rewriter.js", "wasm_exec.js", "worker-prelude.js", "favicon.ico", "manifest.webmanifest":
 		s.serveWeb(w, r, name)
+	case "rust-rewriter.wasm":
+		s.serveFile(w, r, filepath.Join(s.webDir, name), "application/wasm")
 	default:
 		s.safeError(w, r, "POLICY_BLOCKED", http.StatusForbidden)
 	}

cmd/zeroproxy-server/routing_test.go

@@ -91,7 +91,8 @@ func TestServeAssetAllowlist(t *testing.T) {
 
 	allowed := []string{
 		"zp-core.js", "runtime-prelude.js", "rust-rewriter.js", "http-rewriter.js",
-		"wasm_exec.js", "worker-prelude.js", "favicon.ico", "manifest.webmanifest",
+		"rust-rewriter.wasm", "wasm_exec.js", "worker-prelude.js", "favicon.ico",
+		"manifest.webmanifest",
 	}
 	for _, name := range allowed {
 		req := httptest.NewRequest(http.MethodGet, assetPrefix+name, nil)