From 6f2bed352904c923eab8c3aa88de7bca4a630a29 Mon Sep 17 00:00:00 2001 From: slhx agent Date: Mon, 1 Jun 2026 23:53:35 +0200 Subject: [PATCH] test(js): lock selectorless runtime contract Add an explicit runtime guard for root-scoped DOM walks and against selector APIs, preserving the no selector/no hidden client framework boundary. req: pitch/002 req: runtime/001 req: target_policy/001 --- slhx-js/tests/runtime.rs | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/slhx-js/tests/runtime.rs b/slhx-js/tests/runtime.rs index 76863e5..468df40 100644 --- a/slhx-js/tests/runtime.rs +++ b/slhx-js/tests/runtime.rs @@ -20,6 +20,22 @@ fn runtime_preserves_multipart_file_upload_fallback_shape() { assert!(source.contains("if (body instanceof URLSearchParams) headers[\"Content-Type\"] = \"application/x-www-form-urlencoded;charset=UTF-8\"")); } +#[test] +fn runtime_uses_root_scoped_walks_not_dom_selector_apis() { + // req: pitch/002 req: runtime/001 req: target_policy/001 + let source = slhx_js::RUNTIME_JS; + + assert!(source.contains("function firstElement(scope, predicate)")); + assert!(source.contains("function closestInRoot(start, root, predicate)")); + assert!(source.contains("root.addEventListener(name, (event) =>")); + assert!(!source.contains("querySelector")); + assert!(!source.contains("querySelectorAll")); + assert!(!source.contains(".closest(")); + assert!(!source.contains(".matches(")); + assert!(!source.contains("getElementsBy")); + assert!(!source.contains("document.getElementById")); +} + #[test] fn runtime_targets_generated_resources_not_response_selectors() { // req: target_policy/001 req: target_policy/002