feat: Enhance Electron test harness with preload script and CSP configuration

test/electron/renderer.js

@@ -5,49 +5,83 @@
  * then loads the example plugin from disk and demonstrates every API surface.
  */
 (async () => {
-  const { pathToFileURL } = require('url');
-  const path = require('path');
-  const fs = require('fs');
+  const testApi = window.electronTestApi;
+  if (!testApi) {
+    throw new Error('Electron test preload API is unavailable.');
+  }
+
+  const {
+    examplePluginCode,
+    examplePluginPath,
+    pluginManagerEntryUrl,
+  } = testApi.getHarnessBootstrap();
 
-  // Resolve the plugin-manager dist entry using a file:// URL so Electron can
-  // import an ESM module located inside node_modules.
-  const pmEntry = path.join(
-    __dirname, 'node_modules', '@paarrot', 'plugin-manager', 'dist', 'index.js'
-  );
   const {
     PluginMarketplaceClient,
     PluginMarketplaceManager,
     PluginRegistry,
     createPluginContext,
-  } = await import(pathToFileURL(pmEntry).href);
+  } = await import(pluginManagerEntryUrl);
 
   // ---------------------------------------------------------------------------
   // Module loader — supports both CJS (module.exports) and ESM (export default)
   // ---------------------------------------------------------------------------
 
+  /**
+   * Imports arbitrary module source through a blob URL so CSP can remain free
+   * of unsafe-eval while still supporting test plugins loaded from strings.
+   * @param {string} source
+   * @returns {Promise<object>}
+   */
+  async function importModuleFromSource(source) {
+    const blob = new Blob([source], { type: 'text/javascript' });
+    const blobUrl = URL.createObjectURL(blob);
+
+    try {
+      return await import(blobUrl);
+    } finally {
+      URL.revokeObjectURL(blobUrl);
+    }
+  }
+
   /**
    * Evaluates plugin source code and returns the raw module exports.
-   * Tries CJS eval first; on SyntaxError falls back to ESM data-URL import.
+   * Tries CommonJS first by wrapping the code as ESM, then falls back to native
+   * ESM import when the source already uses module syntax.
    * @param {string} code
    * @returns {Promise<object>}
    */
   async function evalPluginCode(code) {
     try {
-      const m = { exports: {} };
-      // eslint-disable-next-line no-new-func
-      new Function('module', 'exports', code)(m, m.exports);
-      const result = m.exports?.default ?? m.exports;
-      if (result && typeof result === 'object') return result;
-      // Fall through to ESM if exports came back empty
+      const commonJsModule = await importModuleFromSource(
+        `const module = { exports: {} };\nconst exports = module.exports;\n${code}\nexport default module.exports;\n`
+      );
+      const result = commonJsModule.default;
+      if (result && typeof result === 'object') {
+        return result;
+      }
     } catch (err) {
-      if (!(err instanceof SyntaxError)) throw err;
-      // SyntaxError means ESM — fall through below
+      if (!(err instanceof SyntaxError)) {
+        throw err;
+      }
     }
 
-    // ESM path — import via data URL so the engine handles module syntax natively
-    const dataUrl = `data:text/javascript;charset=utf-8,${encodeURIComponent(code)}`;
-    const mod = await import(dataUrl);
-    return mod.default ?? mod;
+    const esmModule = await importModuleFromSource(code);
+    return esmModule.default ?? esmModule;
+  }
+
+  /**
+   * Infers a plugin id from an index.js path without relying on Node path APIs.
+   * @param {string} filePath
+   * @returns {string}
+   */
+  function inferPluginId(filePath) {
+    const segments = filePath.split(/[\\/]+/).filter(Boolean);
+    if (segments.length < 2) {
+      return 'plugin';
+    }
+
+    return segments[segments.length - 2];
   }
 
   /**
@@ -162,9 +196,8 @@
   // ---------------------------------------------------------------------------
   // Load the example plugin from disk (CJS eval — same pattern as cinny)
   // ---------------------------------------------------------------------------
-  const pluginPath = path.join(__dirname, 'plugins', 'example-plugin', 'index.js');
-  const pluginCode = fs.readFileSync(pluginPath, 'utf-8');
-  const plugin = await evalPluginCode(pluginCode);
+  const pluginPath = examplePluginPath;
+  const plugin = await evalPluginCode(examplePluginCode);
 
   // ---------------------------------------------------------------------------
   // Simple in-process event emitter (stands in for a real client like Matrix)
@@ -387,7 +420,7 @@
    */
   async function loadPluginFromPath(filePath) {
     try {
-      const code = fs.readFileSync(filePath, 'utf-8');
+      const code = await testApi.readTextFile(filePath);
       const raw  = await evalPluginCode(code);
       const p    = normalisePlugin(raw);
 
@@ -395,7 +428,7 @@
         throw new Error('File does not export a valid plugin (needs an onLoad function)');
       }
 
-      const id = p.id ?? path.basename(path.dirname(filePath));
+      const id = p.id ?? inferPluginId(filePath);
       if (knownPlugins.has(id) && registry.getRegisteredPlugins().some(r => r.id === id)) {
         throw new Error(`Plugin with id "${id}" is already loaded`);
       }