Cookie attributes, create-race fixes, and authored HTML at a real origin (for FlutterFlow desktop)

[wenkaifan0720]

What FlutterFlow's desktop app needed to render its Test Mode preview and Monaco editors through flutter_cef.

1. setCookie carries secure / httpOnly / sameSite (macOS + Windows)

FlutterFlow's Test Mode worker authenticates the preview with a session_jwt cookie that must be stored SameSite=None; Secure. Without the attributes CEF sent the top-level load authenticated but every cross-site subresource cookie-less, and the preview rendered blank. CefCookie.sameSite is reported back by getCookies. SameSite=None forces Secure (Chromium drops it otherwise).

2. Ops that race the create are no longer dropped

create() returns before cef_host has a slot for the browser: the slot is registered by a later TID_UI task, and on a shared host the create frame is itself paced behind earlier establishments while every other op is sent immediately. The reader thread's if (!slot) break silently dropped whatever arrived in that window.

• Cookie verbs (macOS + Windows) take the wire id, not a slot — the jar is process-global, the id only routes the reply. A dropped setCookie meant an unauthenticated first load; a dropped getCookies never replied, so the caller's future hung forever. This is what wedged FlutterFlow's preview on about:blank.
• evalReturning resolves by wire id on TID_UI and always replies ({ok:false,"no browser"} instead of silence).
• dispose resolves on TID_UI, so a dispose racing its own create no longer leaks the browser.
• navigate / loadTrusted that beat a paced create frame are parked and become that create's URL.

3. loadHtmlString(html, baseUrl:) / CefWebView(html:, htmlBaseUrl:) honour an http(s) base URL (macOS)

New op kOpSetAuthoredHtml (0x3f, {url}\0{html}): the host answers the main-frame request for exactly that URL with the HTML, so the document has the URL's real origin — relative URLs, fetches, workers and origin-keyed storage work, which a data: URL's opaque origin cannot give. (FlutterFlow's custom-code Monaco bundle loads its workers from the app origin.)

Stored by wire id on the reader thread and written in one write ahead of the create frame, so it is in place before the first request; kept on the Swift session so a re-home re-sends it. Sticky across reload(); a plain navigate() or another load ends it. Elsewhere (Windows for now) it falls back to data: with an injected <base href> — Windows parity is a follow-up.

Testing

• flutter test: 181 pass (new: authored-document channel contract, <base href> fallback, cookie attributes).
• example/lib/samesite_probe.dart: PASS. example/lib/authored_origin_probe.dart: 11/11 on macOS — early cookie verbs answer first try with no retry; origin / href / relative URLs / per-origin storage for both create-with-html and loadHtmlString; reload keeps serving; no-baseUrl stays opaque; navigate() ends it. The hosts used don't resolve, which proves the bytes came from the host, not the network.
• End to end in the FlutterFlow macOS app: Test Mode preview loads authenticated.
• The Windows host changes are mechanical mirrors of the macOS ones and have not been compiled here.

Also: the example's macOS deployment target moves to 12.0 (Xcode 27 refuses 10.15).

macOS text key bindings (caa7a26)

A windowless browser has no NSView in the responder chain, so AppKit's key-binding manager never runs and every binding it owns — ⌘←/→/↑/↓, ⌘⌫, ⌃A/⌃E/⌃K, … — did nothing in plain inputs, textareas and contenteditable (so also in Flutter web text fields). cef_host now reads the same source AppKit does (the system StandardKeyBinding.dict, then the user's DefaultKeyBinding.dict) and delivers a matching keydown through DevTools Input.dispatchKeyEvent with its commands — the edit-command channel a windowed Chrome uses. The page still sees a normal keydown first, so an editor that owns the key wins. No shortcut list to maintain. keyboard_shortcut_probe is 23/23.

Prebuilt cef_host on GitHub Releases (0848932)

The GCS bucket is no longer developer-writable, so the prebuilt moves onto this (public) repo: one release per content hash, tag cef-host-<hash>, targeted at the publishing commit, assets = tarball + .sha256. fetch_cef_host.sh reads releases/download/… anonymously; make publish-cef-host now needs gh with push instead of gsutil. Idempotency and the Developer-ID signature gates are unchanged. FLUTTER_CEF_GCS_BASE → FLUTTER_CEF_PREBUILT_BASE.

🤖 Generated with Claude Code