feat(compass-app): revive embedded dual-mode + supervisor pipeline (RIG-3197, RIG-3198)

go/cmd/compass-app/client_test.go

@@ -166,13 +166,12 @@ func pemEncodeCert(t *testing.T, cert *x509.Certificate) []byte {
 	return pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: cert.Raw})
 }
 
-// TestShellStartupJS covers the OQ-8 startup-global injection: the client mode
-// token, __COMPASS_SERVER_URL__ present in client mode, and JSON-escaping of a
-// hostile server URL so it cannot break out of the script. Client is now the
-// only mode (embedded was retired in RIG-2554).
+// TestShellStartupJS covers the OQ-8 startup-global injection in both modes: the
+// mode token, __COMPASS_SERVER_URL__ present only in client mode, and
+// JSON-escaping of a hostile server URL so it cannot break out of the script.
 func TestShellStartupJS(t *testing.T) {
 	t.Run("client injects mode and server url", func(t *testing.T) {
-		js, err := shellStartupJS("https://remote.example:8443")
+		js, err := shellStartupJS(appconfig.ModeClient.String(), "https://remote.example:8443")
 		if err != nil {
 			t.Fatalf("shellStartupJS err = %v, want nil", err)
 		}
@@ -184,9 +183,26 @@ func TestShellStartupJS(t *testing.T) {
 		}
 	})
 
+	t.Run("embedded injects mode and omits the server-url global", func(t *testing.T) {
+		// In embedded mode the app supervises a local stack and has no
+		// server_url, so shellStartupJS must emit only the mode token and MUST
+		// NOT emit __COMPASS_SERVER_URL__ (the branch at shellStartupJS's
+		// `if mode == client` gate). A non-empty serverURL argument is ignored.
+		js, err := shellStartupJS(appconfig.ModeEmbedded.String(), "https://ignored.example:8443")
+		if err != nil {
+			t.Fatalf("shellStartupJS err = %v, want nil", err)
+		}
+		if !strings.Contains(js, `window.__COMPASS_MODE__="embedded";`) {
+			t.Errorf("embedded JS = %q, want the embedded mode global", js)
+		}
+		if strings.Contains(js, "__COMPASS_SERVER_URL__") {
+			t.Errorf("embedded JS = %q, must not emit the server-url global", js)
+		}
+	})
+
 	t.Run("hostile server url is JSON-escaped, not a breakout", func(t *testing.T) {
 		hostile := `https://x/"+alert(1)+"</script><script>`
-		js, err := shellStartupJS(hostile)
+		js, err := shellStartupJS(appconfig.ModeClient.String(), hostile)
 		if err != nil {
 			t.Fatalf("shellStartupJS err = %v, want nil", err)
 		}