Import plain HTML and CSS projects safely

[robinbraemer]

Outcome

Import ordinary static HTML, CSS, JavaScript, assets, archives, directories, and Git repositories into a canonical Flect workspace with a precise compatibility report and no source execution during inspection.

Product-quality coverage

FQ-03.6, FQ-08.1 through FQ-08.7, and FQ-24.1 through FQ-24.3, FQ-24.6.

Dependencies

Consumes #3, #4, #5, and #25. It establishes the simplest importer before the React/Vite work in #8 and Vue/Svelte work in #9.

Required behavior

• Inspect source structure, HTML entrypoints, assets, CSS imports, modules, URLs, forms, storage, workers, and network assumptions without executing repository code.
• Produce a preserved, adapted, unsupported, and permission-required report before mutation.
• Copy supported source into a new Git branch or repository, adapt only reviewed portability boundaries, build, and preview in the isolated renderer.
• Exclude secrets, credentials, .env values, host paths, generated caches, and unsupported binaries by default.
• Preserve the original source and last accepted workspace after every failure.

Acceptance criteria

• Versioned real-browser fixtures cover a static site, multi-page site, ES modules, CSS and assets, forms, unsupported remote assumptions, and malicious archives.
• Import report and generated commits are attributable and reviewable.
• Traversal, symlink, archive bomb, hidden credential, executable, unsupported scheme, CSP escape, and network attempts fail before activation.
• Imported source remains recognizable, exports with ordinary Git history, and runs without a proprietary service after dependencies are cached.
• Unsupported behavior names a safe alternative or clearly states that no compatible path exists.

Non-goals

• Reproducing a closed website from its URL.
• Executing arbitrary scripts during compatibility analysis.
• Claiming behavioral equivalence without fixture tests.

[robinbraemer]

First plain-web importer slice (2026-08-01): the protected actions menu now selects a directory with one root index.html, validates every relative path before reading source, avoids reading .git/node_modules/.DS_Store, applies the 256-file/32 MiB capsule bounds, packages unchanged HTML/CSS/classic-JavaScript/assets without inspection-time execution, and sends the local capsule through the ordinary provenance review and isolated candidate frame. Production Chromium proves a four-file static site with CSS, SVG, and interaction; unit tests prove root normalization, ignored paths, ambiguous-entrypoint failure, and traversal rejection. #27 remains open for multi-page/module/forms/workers/remote-assumption analysis, archives/Git inputs, secret scanning, canonical source commits, full compatibility reports, and adversarial fixtures.

[robinbraemer]

Importer hardening follow-up: common secret-shaped inputs (.env*, .npmrc, .pypirc, SSH private-key names, key/certificate extensions) now join VCS/dependency/cache paths in the do-not-read set. Bounded text inspection reports forms, module graphs, remote URLs, storage, and workers; unsupported required assumptions become visible manifest requests and block Keep. Chromium accepts/exports the static fixture and the test decodes that exported capsule to prove the ignored .env.production name and sentinel value never entered it. Unit coverage now includes these compatibility findings. Content-aware secret scanning and the broader adversarial matrix remain open.

[robinbraemer]

Canonical source ownership progress: after the candidate initializes protected Git refs, supported static-project files checkpoint onto isolated flect/authoring; the existing proposal source-delta path incorporates them and only Keep promotes the recognizable project/ tree to flect/accepted. A checkpoint failure rejects the proposal rather than exposing a partial candidate. Production Chromium now exports the complete repository, passes native git fsck --full, reads the original HTML at flect/accepted:project/index.html, sees the CSS in the accepted tree, and proves the ignored .env.production is absent. Import-attribution UX and the remaining input/compatibility matrices stay open.

[robinbraemer]

Progress on 2026-08-01: the visible Import app project action now handles plain HTML/CSS and framework folders through one preflight/report/review flow. Static Chromium proof covers local assets, interaction, Keep, capsule export, Git export/fsck, and secret exclusion. Preflight additionally reserves Flect metadata, enforces the real 255-source-file and 100-character portable path limits, and reports ignored files. Remaining: multi-page behavior, archive/Git sources, fuller asset/CSS compatibility, and broader adversarial fixtures.

[robinbraemer]

Pushed local-ready evidence — 2026-08-10

Bounded static HTML/CSS/script/assets import now preserves ordinary files and attribution, isolates guest authority, rejects malformed or remote assumptions, compiles through the canonical workspace, exports as a capsule, and reopens offline.

Production Chromium evidence is pushed on codex/flect-vision-complete. This issue remains open until integration.