feedBack/static
topkoa 254e26bb3a feat(panes): mirrorGlobal, manifest-declared panes, and the plugin docs
Three things a plugin needs before it can actually use panes.

## mirrorGlobal — the camera-director problem

The 3D highways read their free camera from a plain global,
`window.__h3dCamCtl` (highway_3d/FREECAM_BRIDGE.md), once per frame in
_resolveFreeCam(). A camera panel in the main window just writes that
object and the camera moves. A panel in a POP-OUT window cannot:
window.__h3dCamCtl there is a different object in a different realm, and
writing it moves nothing.

So a pane declares one field — `mirrorGlobal: '__h3dCamCtl'` — and
pane-mirror.js (main realm, where the renderers live) copies that pane's
state onto the global whenever it changes. highway_3d, keys_highway_3d
and drum_highway_3d are NOT modified and do not know panes exist.

The rule that makes it work: MUTATE THE OBJECT, NEVER REPLACE IT. A
renderer may be holding the reference, and swapping in a new object would
leave it reading an orphan. Keys the pane doesn't set are left alone
rather than deleted — the global may carry a renderer's own bookkeeping.
Closing the pane deliberately leaves the global as-is: closing the camera
panel should not snap the camera back to a default, which is exactly what
happens today (nobody clears __h3dCamCtl).

## Manifest-declared panes

    "panes": [{ "id": "camera_director", "title": "Camera Director",
                "script": "panes/camera.js", "mirrorGlobal": "__h3dCamCtl" }]

Declaring a pane beats calling panes.register() from screen.js because it
becomes openable FROM THE RAIL OR THE TRAY WITHOUT THE PLUGIN'S SCREEN
EVER HAVING BEEN VISITED — core registers a stub from the manifest and
fetches the script only when the user opens it. A pane you can only reach
by first navigating to the screen it was meant to replace is not much of a
pane.

The script sets `window.feedBackPane_<id> = { mount, unmount }`, mirroring
the existing window.feedBackViz_<id> convention, and the SAME file is what
a pop-out window loads in its own realm.

`script` is validated as a relpath under the plugin's src/ and served
through the sandboxed /api/plugins/<id>/src/ route — the containment rule
`styles` already has for assets/. Traversal, absolute paths, drive letters,
backslashes and non-.js are rejected; a bad entry is dropped with a warning
rather than failing the whole plugin, because one malformed pane should not
cost the user a working plugin.

Note the projection is written TWICE — _nav_entry() and the /api/plugins
route re-project independently — so panes had to be added to both, plus the
pending branch (a pane can be opened while its plugin is still installing
deps; the script is fetched on open, not at discovery).

## docs/plugin-panes.md

The contract, and the one rule it all hangs on: mount(root, ctx) runs in a
realm that may not have the app in it. Everything comes through ctx, or the
pane works docked and silently dies popped out.

Verified: manifest validation rejects ../.., C:\, non-.js, dupes and
missing fields while passing a good entry; /api/plugins projects panes[] for
all 20 plugins. mirrorGlobal mutates the global IN PLACE — a reference held
the way _resolveFreeCam holds it sees the change, and a renderer's own field
on that object survives — both for a local write and for a write arriving
over the channel from a pop-out realm.

pytest: 2401 passed, 8 failed — all 8 reproduce on a clean main (including
the one in tests/test_plugins.py) and are unrelated.

Signed-off-by: topkoa <topkoa@gmail.com>
2026-07-12 17:38:05 -04:00
..
assets/venue/themes/small-club Clean release snapshot 2026-06-16 18:47:13 +02:00
capabilities refactor(ui): defer every classic script, keep boot() on DOMContentLoaded (R3a) (#872) 2026-07-11 16:57:04 +02:00
js fix(nav): nobody may monkey-patch window.showScreen — add screen:changing, make the shell listen (#924) (#925) 2026-07-12 16:06:28 +02:00
lottie rename: slopsmith → feedBack, byron → got-feedBack (#537) 2026-06-23 11:03:01 +02:00
panes feat(panes): mirrorGlobal, manifest-declared panes, and the plugin docs 2026-07-12 17:38:05 -04:00
svg Clean release snapshot 2026-06-16 18:47:13 +02:00
v3 feat(panes): mirrorGlobal, manifest-declared panes, and the plugin docs 2026-07-12 17:38:05 -04:00
vendor feat(highway_3d): hit-feedback juice + Hit-sparks toggle (#618) 2026-06-28 11:53:48 +02:00
_tailwind.src.css Clean release snapshot 2026-06-16 18:47:13 +02:00
app.js refactor(app): carve the keyboard-shortcuts subsystem into static/js/shortcuts.js (R3d) (#922) 2026-07-12 16:05:25 +02:00
audio-mixer.js refactor(ui): defer every classic script, keep boot() on DOMContentLoaded (R3a) (#872) 2026-07-11 16:57:04 +02:00
capabilities.js rename: slopsmith → feedBack, byron → got-feedBack (#537) 2026-06-23 11:03:01 +02:00
diagnostics.js rename: slopsmith → feedBack, byron → got-feedBack (#537) 2026-06-23 11:03:01 +02:00
highway.js refactor(highway): carve the 2D drawing layer into highway-draw.js (R3c) (#917) 2026-07-12 13:00:29 +02:00
lottie-api.js rename: slopsmith → feedBack, byron → got-feedBack (#537) 2026-06-23 11:03:01 +02:00
style.css feat(highway): show feedpak author/editor credits on song load (#629) 2026-06-28 22:08:44 +02:00
tailwind.min.css feat(career): career plugin — stars, venue tiers, pack downloads (career mode 2/3) (#907) 2026-07-12 22:39:19 +02:00
tour-engine.css rename: slopsmith → feedBack, byron → got-feedBack (#537) 2026-06-23 11:03:01 +02:00
tour-engine.js rename: slopsmith → feedBack, byron → got-feedBack (#537) 2026-06-23 11:03:01 +02:00