Fix strict-CSP screenshots and editor activation

[SunkenInTime]

Problem and fix

On strict-CSP pages such as Devin, computer-use screenshots fail while reading layout metrics, and clicks on covered editor textareas fail during the AX scroll/activation fallback. These operations still compiled page scripts even after ordinary AX hit tests were fixed.

Route layout metrics, viewport size, device-pixel ratio, and the recorded Browser Use scrolling/activation callbacks through static extension operations. Preserve disabled/read-only checks and CDP exception responses.

Verification

• npm test passed.
• Real Zen npm run test:live passed with strict CSP, PNG capture, layout measurements, multiline replacement in a covered textarea below the viewport, read-only rejection, and background-tab preservation.
• The same test against released v1.4.12 fails with call to eval() blocked by CSP.
• Actual Codex computer use against a disposable Zen profile captured a screenshot, clicked the covered editor, selected its contents, and inserted multiline YAML successfully.

No permission or CSP changes. General arbitrary page evaluation remains outside this fix.

Summary by CodeRabbit

• Bug Fixes

  • Improved screenshot capture on pages with strict Content Security Policy settings.
  • Fixed computer-use scrolling and activation for editors covered by overlays.
  • Improved handling of device pixel ratio and layout measurements during capture.
  • Read-only controls are now correctly rejected during activation.

• Tests

  • Expanded browser coverage for strict-CSP screenshots, editor interactions, accessibility actions, and multiline text replacement.

• Documentation

  • Updated the changelog and test fixture documentation to reflect the new coverage.

[SunkenInTime]

@greptileai Please review the strict-CSP screenshot and covered-editor fix. The PR includes real Zen regression results and an actual Codex computer-use test; live-firefox CI installs Firefox explicitly and exercises the same flow, including read-only rejection and background-tab preservation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: b96936c6-422a-4438-8fa7-98f2640e6ee2

📥 Commits

Reviewing files that changed from the base of the PR and between 4f70a15 and 42fa8e5.

📒 Files selected for processing (5)

• CHANGELOG.md
• extension/firefox-compat.js
• tests/fixtures/README.md
• tests/fixtures/cua-ax-functions.json
• tests/test-firefox-lifecycle-live.mjs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The extension adds CSP-safe operations for page metrics, device-pixel ratio, accessibility scrolling, and activation. Live Firefox tests verify screenshot capture and covered-editor behavior under strict CSP.

Changes

Strict-CSP browser operations

Layer / File(s)	Summary
CSP-safe page operations extension/firefox-compat.js	Adds CSP-safe operations for layout metrics, viewport size, device-pixel ratio, accessibility scrolling, and accessibility activation.
Runtime and accessibility fallback routing extension/firefox-compat.js	Routes device-pixel ratio evaluation and Browser Use accessibility helpers through the new CSP-safe operations.
Live strict-CSP validation tests/test-firefox-lifecycle-live.mjs, tests/fixtures/cua-ax-functions.json, tests/fixtures/README.md, CHANGELOG.md	Adds a covered editor fixture and assertions for metrics, PNG capture, editor replacement, read-only rejection, and object-handle release. Documents the fixture and records the fixes.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~25 minutes

Merge Risk: ⚪ Minimal · up to 42fa8

This change swaps internal page-script evaluation for static extension operations to fix strict-CSP failures in screenshot capture and editor activation, without altering permissions or CSP policy. Verification (automated tests, live Firefox tests, and a manual Codex computer-use session) exercised the new paths directly, and no functional or safety regressions were found during review. The change looks safe to merge.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 2 files. (3 skipped: 3 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the primary changes: fixing strict-CSP screenshot handling and editor activation. It is concise and specific.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 2 files. (3 skipped: 3 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/csp-editor-and-screenshots

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 3/5

The focused strict-CSP compatibility checks passed, but live Firefox or Zen coverage remains unavailable.

What we checked:

• Strict-CSP metric evaluation failure: Layout and viewport reads use the static CSP-safe operation runner. The exact device-pixel-ratio expression is intercepted before the generic evaluation path.
• Covered-editor fallback evaluation failure: Recognized accessibility callback declarations are routed to static CSP-safe operations before generic function evaluation. The static operations resolve the existing object handle and perform scrolling or activation directly.
• Reviewed the static strict-CSP routing for layout metrics, viewport size, and device-pixel ratio, and verified that the focused compatibility harness completed successfully for both the parent and current revisions.
• Reviewed the recognized Browser Use accessibility callback routing and the static scroll, focus, and click operations, ran the focused strict-CSP Firefox compatibility test successfully, and noted that live lifecycle coverage could not start due to the absence of a configured Firefox or Zen browser.
• Reviewed the CSP-safe implementation excerpt and strict-CSP live-test assertions, and examined the before and after harness logs along with the browser-availability check showing no Firefox-family binary.
• Reviewed the exact callback-routing snippet and operation snippet in firefox-compat.js, and the CSP-safe injection snippet using firefox.scripting.executeScript, confirming the commands and their outcomes are captured in the uploaded artifacts.

Summary

• This change makes strict-CSP Firefox and Zen computer-use flows use static extension callbacks for screenshot metrics, device-pixel ratio, accessibility scrolling, and editor activation. The focused compatibility coverage passed for the metric and Browser Use callback routes.

• T-Rex validation blocked A real Firefox or Zen browser could not be started because the Firefox-family browser tool is missing and FIREFOX_BINARY is not configured. The live lifecycle test therefore could not run. Configure VMs

_{Reviews (2) · Last reviewed commit: "Fix strict-CSP screenshots and editor ac..."}

[SunkenInTime]

@greptileai Please re-review using the existing real-browser evidence. The current head is 42fa8e5. Your summary reports no remaining dispatcher defect; its blocker is the missing browser on the T-Rex worker.

The actual Firefox CI job for this exact head is green: https://github.com/SunkenInTime/codex-computer-use-firefox-zen/actions/runs/34540897898/job/103083085416

Its log at 23:10:26Z reports:

"ok": true,
"backgroundTabPreserved": true,
"strictCspAxClickTypeAndClear": true,
"objectCleanupAndExceptionContract": true,
"strictCspScreenshotAndEditor": true

This executes a real Firefox process installed by browser-actions/setup-firefox. The test dispatches the recorded scroll and activation callbacks for a covered textarea below the viewport, selects its text, inserts multiline YAML, and checks that the AX value equals the replacement. It also verifies that activation of a read-only textarea returns the expected exception. These are actual browser assertions, not mocks.

Separately, Codex computer use connected to the full patched extension in a disposable Zen profile and successfully captured a screenshot, clicked that covered textarea, selected all, and entered multiline YAML. The same live regression against the released v1.4.12 adapter fails with CSP blocking eval.

Please distinguish missing T-Rex tooling from a code defect and assess the supplied browser verification when determining merge readiness.