[mabry1985]

Problem (launch bug B3)

Asked "Show a vega-lite bar chart of monthly revenue Jan–Jun: 12k,15k,14k,19k,23k,28k.", check_artifact reported "Script error" on 3 valid specs. The agent burned versions and fell back to Chart.js (~54 s). The console logged a CSP violation each time: Loading the stylesheet '/plugins/artifact/vendor/pl-embed.css' violates … "style-src 'unsafe-inline'".

Root cause

The CSS failure is what produced the script error:

1. base() links the vendored DS element-default sheet pl-embed.css (security: opt-in CIDR allowlist for A2A callbacks + peer_consult (#572) #577) into every frame. vegaDoc (the only base() frame that runs under a CSP) allowed style-src 'unsafe-inline' only, so the sheet was refused on every chart.
2. ERRBOOT registers its error listener in the capture phase, so it also receives non-bubbling resource-load failures. The refused <link>'s error event carries no message, so ERRBOOT fell through to "⚠ Script error" and posted a failed render verdict. The chart itself had drawn fine: in a browser on main, the frame had a 724px SVG under the red "⚠ Script error" overlay.

No cross-origin script was involved: the vendored libraries already load with crossorigin="anonymous" and ACAO: *.

Fix

• vegaDoc CSP: style-src 'unsafe-inline' <origin>/plugins/artifact/vendor/pl-embed.css. This allows exactly that one vendored file, not a host-wide grant.
• ERRBOOT: a resource error (target is an element) no longer fails the render, except that a <script> which failed to load is reported by name (⚠ a script failed to load: <src>). A stylesheet or image failure is cosmetic. Real script errors (target is the window) still report as before. This also stops a broken <img> in an html artifact from being reported as "Script error".

Chart width: on this build the chart already fills the card (width:"container" + fit-x; 724 of 760 px in the embed, and full width in the chat card and the panel). The earlier "half width" look matched the failed-render overlay state, so no layout change was needed.

Tests

• test_the_chart_csp_admits_the_vendored_embed_stylesheet (tests/test_artifact_vega.py)
• test_a_resource_load_failure_is_not_a_script_error and test_a_real_script_error_still_reports (tests/test_artifact_embed.py), which run the real ERRBOOT source under node

The first two fail on main. tests/test_artifact_embed.py and tests/test_artifact_vega.py all pass (70 passed, 1 skipped). Live verification is in a comment.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 42 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 3702731b-c516-4c4f-a659-3d8c352668da

📥 Commits

Reviewing files that changed from the base of the PR and between b39c689 and ee39af9.

📒 Files selected for processing: 4

• changelog.d/4401.fixed.md
• plugins/artifact/shell.js
• tests/test_artifact_embed.py
• tests/test_artifact_vega.py

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[protoreview]

QA panel review — PASS

code-review-structural · head ee39af9d4ad4 · formal

No findings were raised, so there was nothing to verify. The panel (including the protoPatch structural pass) reviewed the two changes — the pl-embed.css CSP admission and the ERRBOOT resource-load failure filter — and found them correct and well-scoped. No coverage gaps identified.

No findings — the review came back clean.

findings JSON (machine-readable)

[]

[protoreview]

Promoting the PASS verdict for head ee39af9d4ad4: all checks terminal-green, zero unresolved review threads. (approve-on-green)

[mabry1985]

Live verification: isolated instance (PROTOAGENT_INSTANCE=launchfix, :7896, real Chromium via Playwright)

Prompt: "Show a vega-lite bar chart of monthly revenue Jan–Jun: 12k,15k,14k,19k,23k,28k."

main (reproduced): check_artifact failed with "Script error" on 3 vega-lite versions, then the agent fell back to Chart.js. The frame console showed Loading the stylesheet '…/vendor/pl-embed.css' violates … "style-src 'unsafe-inline'". Inspecting the failed artifact's frame found a 724px SVG chart actually drawn underneath the "⚠ Script error" overlay, so the error came from the refused stylesheet's error event and nothing else.

This branch:

• Fresh session: one show_artifact and one check_artifact. The render-status verdict was ok:true at 4.5 s into the turn. There was no fallback, the chart fills the chat card width, and there was no CSP violation in the console.
• Re-rendering the previously "failed" artifact from main now reports {"ok":true,"error":""}, with no overlay and no CSP error.