A 55-agent audit of the last few commits confirmed 32 findings. The high and medium ones are fixed here; the ranked leftovers are listed at the end. Boot-order crash (my regression, wave 2) - wp-format.js loaded AFTER wp-creation-app.js on every page, but the creator boots synchronously at parse time and its comment renderer calls wpFormatDateTime(). With any review comment present that threw a ReferenceError and aborted the rest of boot. The formatter now parses before the app scripts on all five pages. Verified with a comment seeded: the date renders and boot completes. The network-first fix didn't actually work - `fetch(req)` inherits the request's default cache mode, so it consults the browser HTTP cache — the previous commit's "network-first" still allowed a page to run against a stale sibling. Code is now fetched with cache:'no-cache' and precached with cache:'reload'. - Nothing pinned freshness on the wire either: no Cache-Control anywhere, so browsers applied heuristic caching (~10% of a file's age) and each file expired at a different moment. NGINX and the dev server now send no-cache for html/css/js/ webmanifest; images stay cacheable. Verified on the wire. - Non-ok responses were returned verbatim, so a 502 broke pages the cache could have served; they now fall back to the cache. Cache keys drop the query string, which fixes both the offline miss on every in-app link (?project=…&tab=…) and unbounded cache growth. respondWith can no longer resolve to undefined. Cache bumped to v5. Embedded creator - Dropped the &t=Date.now() cache-buster and made the frame's identity the PROJECT. The view and which package to open are now applied by calling into the loaded document, so switching tabs no longer reloads it — that reload discarded unsaved form edits, made the creator unreachable offline, and stored a fresh copy per click. - ?view=dashboard was re-read on every tab switch, so after one deep link the "Work Package Creation" tab kept opening the Dashboard for the rest of the session. Deep-link params are consumed once now. - ?wp=<id> — which the global search has been emitting since wave 2 — was read by nothing, so picking a work package in search opened a blank one. The creator now exposes openWpById() and the shell applies it after a new 'wp-creator-ready' event, because the frame's load fires before pullProject() resolves. - Math.max(320,…) could make the frame taller than the space available while page scrolling was disabled, pushing content off a window that couldn't scroll. Full-bleed is now only used when at least 460px remains, and the SOP-incomplete gate never runs inside it. A ResizeObserver re-measures when wp-chrome.js grows the app bar. Contract drift - .field-hint and .user-pick are used on the SOP suite page but their only rules lived in wp-creation-styles.css, which that page doesn't link — the CM hint and the sign-off pickers had no styling at all. Rules added to the suite's stylesheet. - The creator's critical floor now also hides modal overlays (a stale stylesheet rendered their contents inline in the form) and gives the jump bar a sane sticky top. - login.js dereferenced ids unguarded where the old version guarded, so a cached older login.html would break sign-in itself. Guarded. - The "Language & time" menu item was added only if wp-format.js had already parsed; the check now happens at click time. Verified: 157 API checks across five suites on a clean database, plus 22 driven UI checks — boot-with-comment, tab switching with a no-reload probe, short-viewport fallback, and the search deep link landing on the right package. Not done, ranked: ~50 dead CSS rules across three stylesheets; dead .team-pick and .constraint-option contracts; wp-chrome.js's documented '.header' mount branch is unreachable because the creator loads neither wp-chrome.js nor its CSS; the squeeze half of the embed layout (.content-area.embed-full) is still CSS-only, which degrades to the old narrow column rather than breaking; fingerprinted asset URLs would make a mismatched pair unrepresentable rather than merely unlikely. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
108 lines
4.7 KiB
JavaScript
108 lines
4.7 KiB
JavaScript
/* Service worker for the Work Package Suite PWA.
|
|
|
|
Goal: let the app (and especially the field view) load and run offline. Data
|
|
durability is already handled by the sync outbox in project-data.js — this
|
|
worker only caches the static app shell so the pages open without a network.
|
|
|
|
Strategy:
|
|
• /api/* and non-GET → never touched (pass straight to the network; offline
|
|
reads fall back to the app's localStorage cache, writes queue in the outbox).
|
|
• HTML / CSS / JS → network-first, cache as fallback. These reference each
|
|
other, so a page must never run against a stale sibling.
|
|
• images / icons / manifest → stale-while-revalidate (instant from cache).
|
|
*/
|
|
'use strict';
|
|
// Bumped when the shell file list changes, so clients fetch the new assets
|
|
// instead of serving a half-old shell from the previous cache.
|
|
const CACHE = 'wp-suite-shell-v5';
|
|
const SHELL = [
|
|
'/', '/index.html', '/work-package-suite.html', '/wp-creation-index.html',
|
|
'/field.html', '/login.html', '/admin.html',
|
|
'/theme-light.css', '/work-package-suite-styles.css', '/wp-creation-styles.css',
|
|
'/wp-chrome.css',
|
|
'/auth-guard.js', '/project-data.js', '/feedback-config.js', '/help.js',
|
|
'/work-package-suite-app.js', '/wp-creation-app.js', '/field.js',
|
|
'/wp-chrome.js', '/wp-format.js', '/login.js', '/admin.js',
|
|
'/prime-controls-logo.jpg', '/favicon.ico',
|
|
'/manifest.webmanifest', '/icon-192.png', '/icon-512.png',
|
|
];
|
|
|
|
self.addEventListener('install', (e) => {
|
|
// Cache each shell asset individually so one missing file doesn't abort install.
|
|
e.waitUntil(
|
|
caches.open(CACHE)
|
|
// cache:'reload' bypasses the browser HTTP cache. Without it the precache
|
|
// can be filled from stale HTTP entries, freezing a mismatched shell.
|
|
.then((c) => Promise.all(SHELL.map(
|
|
(u) => c.add(new Request(u, { cache: 'reload' })).catch(() => {}))))
|
|
.then(() => self.skipWaiting())
|
|
);
|
|
});
|
|
|
|
self.addEventListener('activate', (e) => {
|
|
e.waitUntil(
|
|
caches.keys()
|
|
.then((keys) => Promise.all(keys.filter((k) => k !== CACHE).map((k) => caches.delete(k))))
|
|
.then(() => self.clients.claim())
|
|
);
|
|
});
|
|
|
|
// Code (HTML / CSS / JS) is fetched NETWORK-FIRST, falling back to the cache when
|
|
// offline. Everything else (images, icons, the manifest) stays cache-first, which is
|
|
// where offline speed actually comes from.
|
|
//
|
|
// Why not cache-first for code: these files reference each other, and the cache
|
|
// stores them as independent entries. Cache-first served whichever copy of each file
|
|
// happened to be stored, so a browser could run new HTML against old CSS — which is
|
|
// exactly how the embedded creator once collapsed to a 300x150 iframe. A page must
|
|
// only ever run against the stylesheet and scripts it shipped with.
|
|
const CODE_RE = /\.(html|css|js)$|\/$/i;
|
|
|
|
self.addEventListener('fetch', (e) => {
|
|
const req = e.request;
|
|
if (req.method !== 'GET') return; // outbox owns writes
|
|
const url = new URL(req.url);
|
|
if (url.origin !== self.location.origin) return; // third-party: default
|
|
if (url.pathname.startsWith('/api/')) return; // never cache the API
|
|
|
|
const isCode = CODE_RE.test(url.pathname);
|
|
|
|
// Cache key WITHOUT the query string. Links inside the app carry ?project=…&tab=…,
|
|
// and the embedded creator used to carry a cache-busting timestamp, so keying on the
|
|
// full URL both missed every offline navigation and grew the cache without bound.
|
|
const key = new Request(url.origin + url.pathname, { credentials: 'same-origin' });
|
|
const fromCache = () => caches.match(key).then((c) => c || caches.match(req));
|
|
|
|
const store = (res) => {
|
|
if (res && res.ok && res.type !== 'opaque') {
|
|
const copy = res.clone();
|
|
caches.open(CACHE).then((c) => c.put(key, copy)).catch(() => {});
|
|
}
|
|
return res;
|
|
};
|
|
|
|
if (isCode) {
|
|
e.respondWith(
|
|
// cache:'no-cache' forces revalidation with the server. Plain fetch() inherits
|
|
// the request's default cache mode, which consults the browser HTTP cache — so
|
|
// "network-first" alone still let a page run against a stale sibling file.
|
|
fetch(req, { cache: 'no-cache' })
|
|
.then((res) => {
|
|
// A 502/404 must not replace a page the cache could still serve.
|
|
if (!res || !res.ok) return fromCache().then((c) => c || res);
|
|
return store(res);
|
|
})
|
|
.catch(() => fromCache()) // offline → last good copy
|
|
.then((res) => res || Response.error()) // never resolve to undefined
|
|
);
|
|
return;
|
|
}
|
|
|
|
e.respondWith(
|
|
caches.match(key).then((cached) => {
|
|
const network = fetch(req).then(store).catch(() => cached);
|
|
return cached || network.then((res) => res || Response.error());
|
|
})
|
|
);
|
|
});
|