Skip to content

Keep completed WebView history updates from restarting loading - #94

Merged
ralyodio merged 2 commits into
mainfrom
fix/mobile-history-loading
Sep 8, 2026
Merged

Keep completed WebView history updates from restarting loading#94
ralyodio merged 2 commits into
mainfrom
fix/mobile-history-loading

Conversation

@phucnguyen1707

@phucnguyen1707 phucnguyen1707 commented Sep 8, 2026

Copy link
Copy Markdown
Contributor

Fix

Draft follow-up to #92/#93; not a native release approval.

Android WebView history updates can emit onLoadStart with loading=false, without a later load-end event. BrowserScreen used to turn the spinner on unconditionally and leave it spinning indefinitely.

Use the event's loading boolean on Android only. Preserve iOS's original unconditional start indication: its native callback is emitted before the new navigation is allowed and can sample loading=false. Keep load-end handling, navigation/security policy, reload and tab persistence unchanged.

Verification

  • Component regressions reproduced 5 failures before the fix. An additional iOS pre-navigation control caught the overbroad cross-platform change; all 8 now pass with Android-only gating.
  • Full mobile suite: 45/45. Mobile TypeScript and lint passed.
  • Additional private probes exercise the installed WebView JS hook: 5/5. These supplement, but are not part of, committed CI tests.
  • Parent reran the mobile suite in a network-isolated namespace.
  • Claude Opus approved this diff only after source/evidence review; no independent native test was claimed.

Remaining Gate

No iOS/Android native runtime was executed for this patch. Check first navigation and post-error reload on native WebView: event ordering could still omit a spinner even though the endless-spinner path is fixed. Browser/component mocks do not establish native dispatch timing.

No EAS build, store submission, production deployment or native project change was made. Keep draft until these limits are reviewed.

@github-actions

github-actions Bot commented Sep 8, 2026

Copy link
Copy Markdown

ThreatCrush Security Scan

49 finding(s)

MEDIUM: 31 | LOW: 18

Severity Rule Location
MEDIUM js-open-redirect apps/desktop/extensions/ai-sidebar/install-helper.js:156
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/media.js:34
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/media.js:57
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:237
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:266
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:336
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/options.js:305
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/sidepanel.js:77
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/sidepanel.js:165
MEDIUM sh-remote-script-execution apps/desktop/launcher/tronbrowser:84
MEDIUM sh-remote-script-execution apps/desktop/launcher/tronbrowser:394
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:77
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:227
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:569
MEDIUM js-unescaped-html-sink apps/web/public/app.js:29
MEDIUM js-unescaped-html-sink apps/web/public/dns.js:54
MEDIUM sh-remote-script-execution apps/web/public/install.sh:138
MEDIUM sh-remote-script-execution apps/web/public/install.sh:143
MEDIUM sh-remote-script-execution apps/web/public/install.sh:242
MEDIUM sh-remote-script-execution apps/web/public/install.sh:260
MEDIUM sh-remote-script-execution apps/web/public/install.sh:870
MEDIUM js-unescaped-html-sink apps/web/public/settings.js:96
MEDIUM js-unescaped-html-sink apps/web/public/settings.js:168
MEDIUM js-dynamic-code-execution packages/sdk/src/mcp/tools.ts:80
MEDIUM js-dynamic-code-execution packages/sdk/src/mcp/tools.ts:92
MEDIUM js-dynamic-code-execution packages/sdk/src/mcp/tools.ts:103
MEDIUM js-dynamic-code-execution packages/sdk/src/page.ts:65
MEDIUM js-dynamic-code-execution packages/sdk/src/page.ts:70
MEDIUM sql-template-interpolation services/api/src/store/db.ts:116
MEDIUM js-dynamic-code-execution services/api/src/store/scanner.ts:44
MEDIUM sh-predictable-temp-path start.sh:25
LOW js-dynamic-code-execution packages/agent-runtime/src/analyze/form-script.test.ts:6
LOW js-unescaped-html-sink packages/agent-runtime/src/analyze/form-script.test.ts:26
LOW js-unescaped-html-sink packages/agent-runtime/src/analyze/form-script.test.ts:49
LOW js-dynamic-code-execution packages/browser-core/src/automation/extract-script.test.ts:6
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:35
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:47
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:70
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:89
LOW js-dynamic-code-execution packages/browser-core/src/automation/snapshot-script.test.ts:11
LOW js-unescaped-html-sink packages/browser-core/src/automation/snapshot-script.test.ts:24
LOW js-unescaped-html-sink packages/browser-core/src/automation/snapshot-script.test.ts:63
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:47
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:170
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:216
LOW secret-generic-api-key packages/storage/src/config.ts:51
LOW secret-generic-credential packages/storage/src/config.ts:51
LOW js-dynamic-code-execution services/api/src/store/scanner.test.ts:32
LOW js-hardcoded-crypto-key services/api/src/store/signing.test.ts:24

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio marked this pull request as ready for review September 8, 2026 05:28
@ralyodio
ralyodio merged commit 10049af into main Sep 8, 2026
10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants