Skip to content

fix(vscode): escaped quotes in messaging template literal killed all webview handlers#374

Merged
evemcgivern merged 1 commit into
devfrom
fix/216-webview-script-syntax
Jun 18, 2026
Merged

fix(vscode): escaped quotes in messaging template literal killed all webview handlers#374
evemcgivern merged 1 commit into
devfrom
fix/216-webview-script-syntax

Conversation

@evemcgivern

Copy link
Copy Markdown
Contributor

What

The webview's inline <script> bodies in html.ts are backtick template literals. The dep-toggle querySelector used \", which the template literal collapses to a bare ", emitting data-depissue="" + depIssue + "" — adjacent string literals, a hard SyntaxError. That parse error killed the entire messaging IIFE, so every webview click handler (track select, focus toggle, and the new #216 graph zoom/pan/export controls) was silently dead.

Shipped in #257 (0.9.0); surfaced now because the brand-new graph controls were the first thing clicked.

Fix

  • Single-quote the selector string so no escaping is needed inside the template literal.
  • Add a regression guard that extracts every inline <script> and new Function()-parses it — the prior tests only asserted on the HTML string, never executing the JS, which is exactly how a syntax error shipped.

Verification

  • Reproduced dead controls (empty SVG transform, no postMessage) and verified working controls after the fix in a real browser harness driven from buildHtml output.
  • Confirmed the new guard fails on the buggy line and passes on the fix.
  • npm test: 681 pass.

🤖 Generated with Claude Code

…webview handlers

The webview's inline <script> bodies are built as backtick template literals in
html.ts. The dep-toggle querySelector used `\"`, which the template literal
collapses to a bare `"`, emitting `data-depissue="" + depIssue + ""` — adjacent
string literals, a hard SyntaxError. That parse error killed the ENTIRE messaging
IIFE, so every webview click handler (track select, focus toggle, and the new
#216 graph zoom/pan/export controls) was silently dead. Shipped in #257 (0.9.0);
surfaced now via the new graph controls.

Fix: single-quote the selector string so no escaping is needed. Add a regression
guard that extracts every inline <script> and new Function()-parses it — the old
tests asserted on the HTML string but never executed the JS. Verified the guard
fails on the buggy line and passes on the fix; reproduced dead/working controls
in a real browser harness. 681 tests pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@evemcgivern evemcgivern merged commit 28a7253 into dev Jun 18, 2026
9 checks passed
evemcgivern added a commit that referenced this pull request Jun 18, 2026
0.13.0 already shipped (2026-06-16), so bump to 0.14.0 — republishing 0.13.0
would no-op on the Marketplace (--skip-duplicate). Prepend the 0.14.0 Status
entry: proactive auto-slot suggestions (#241) + offline heuristic (#373) + the
critical webview-handler fix (#374). CLI floor unchanged (2026.06.15).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant