PluginProbe
OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin / 1.1.10
OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin v1.1.10
1.1.10 1.1.9 1.1.8 1.1.7 1.1.6 1.1.5 1.1.4 1.1.3 1.1.2 1.1.1 1.1.0 1.0.1 1.0.0 0.9.8 0.9.7 0.9.6 0.9.4 0.9.5 0.9.3 0.9.2 0.9.1 0.9.0 0.8.9 0.8.8 0.8.7 All 34 releases
← All changes | includes/render/chromeless-bridge.php +303 -2445 0.9.1 → 1.1.10 View file →
@@ -1,11 +1,11 @@
1 1 <?php
2 2 /**
3 - * Desktop Mode — Chromeless iframe bridge.
3 + * OpenStation — Chromeless iframe bridge.
4 4 *
5 - * Two cooperative pieces emitted into chromeless admin pages:
5 + * Three cooperative pieces emitted into chromeless admin pages:
6 6 *
7 - * - `desktop_mode_chromeless_offset_neutralizer_script()` —
7 + * - `openstation_chromeless_offset_neutralizer_script()` —
8 8 * runs on `admin_head @ 1` and rewrites positioned-element
9 9 * `top` values that match common admin-bar offsets (32px /
10 10 * 46px) to 0 inside chromeless iframes. Catches plugins that
11 11 * hardcode the admin-bar height instead of using the WP CSS
@@ -10,9 +10,12 @@
10 10 * 46px) to 0 inside chromeless iframes. Catches plugins that
11 11 * hardcode the admin-bar height instead of using the WP CSS
12 12 * custom property.
13 13 *
14 - * - `desktop_mode_chromeless_bridge_script()` — runs on
14 + * - `openstation_chromeless_navigation_ping_script()` — runs on
15 + * `admin_head @ 1` and tells the shell a navigation has landed.
16 + *
17 + * - `openstation_chromeless_bridge_script()` — runs on
15 18 * `admin_footer` and emits the chromeless ↔ shell bridge
16 19 * script that handles screen-meta detection, command-palette
17 20 * harvesting, plugin-changed payloads, etc. The biggest
18 21 * hook in the original render.php (~1,950 LOC) — the bulk is
@@ -20,10 +23,9 @@
20 23 *
21 24 * Extracted from `render.php` during the architecture-0.8.1 PHP
22 25 * slicing (phase 6).
23 26 *
24 - * @package Desktop_Mode
25 - * @since 0.8.1
27 + * @package OpenStation
26 28 */
27 29
28 30 defined( 'ABSPATH' ) || exit;
29 31
@@ -55,28 +57,36 @@
55 57 * unrelated to the admin bar AND need that exact value to remain
56 58 * inside chromeless. We've never seen one in the wild, and if a
57 59 * site hits it, the filter below lets them narrow the scan.
58 60 *
59 - * Scoped via the `desktop-mode-chromeless` body class. Runs ONE
61 + * Scoped via the `os-chromeless` body class. Runs ONE
60 62 * full walk at DOMContentLoaded, then watches for late additions
61 63 * with a `MutationObserver` so React-mounted components are
62 64 * corrected as they appear instead of via a second full-DOM walk
63 65 * at `load`. The observer only inspects added nodes, not the
64 - * whole document, which is roughly two orders of magnitude
65 - * cheaper than the old double-walk on a busy Gutenberg or
66 - * WooCommerce admin page (~2,000+ `getComputedStyle()` calls
67 - * collapsed into a one-time initial walk plus per-addition
68 - * checks).
66 + * whole document.
69 67 *
68 + * The observer callback itself does NO style reads: it only
69 + * enqueues added elements and schedules one idle flush
70 + * (`requestIdleCallback`, 500 ms timeout backstop; plain
71 + * `setTimeout` fallback). Every `getComputedStyle()` read forces
72 + * a synchronous style recalculation, and a MutationObserver
73 + * callback runs as a microtask BEFORE the next paint — so reading
74 + * computed style in the callback puts a forced style flush on the
75 + * exact path Gutenberg hammers hardest while the user types
76 + * (block toolbar mounts, popovers, autocompleters; hundreds of
77 + * descendants per batch). Deferring the walk to idle time takes
78 + * the neutralizer off the typing path entirely; a late-mounted
79 + * plugin header is corrected a frame or two later, which is
80 + * imperceptible for elements that only just appeared.
81 + *
70 82 * Fallback for very old browsers without `MutationObserver`:
71 83 * keep the second walk at `load`. The current minimum (IE 11+)
72 84 * already ships MO, so the fallback only fires on extreme
73 85 * outliers — but it's free insurance.
74 - *
75 - * @since 0.6.1
76 86 */
77 -function desktop_mode_chromeless_offset_neutralizer_script() {
78 - if ( ! desktop_mode_is_chromeless_request() ) {
87 +function openstation_chromeless_offset_neutralizer_script() {
88 + if ( ! openstation_is_chromeless_request() ) {
79 89 return;
80 90 }
81 91
82 92 /**
@@ -87,14 +97,12 @@
87 97 * for desktop, `46px` for the mobile breakpoint. Sites that
88 98 * customize the admin bar height (some accessibility themes
89 99 * raise it to 50px) can extend the list.
90 100 *
91 - * @since 0.6.1
92 - *
93 101 * @param string[] $values Default `[ '32px', '46px' ]`.
94 102 */
95 103 $top_values = apply_filters(
96 - 'desktop_mode_chromeless_admin_bar_top_values',
104 + 'openstation_chromeless_admin_bar_top_values',
97 105 array( '32px', '46px' )
98 106 );
99 107
100 108 $config = wp_json_encode(
@@ -115,58 +123,109 @@
115 123 $js = '(function(C){';
116 124 $js .= 'var TOPS={};';
117 125 $js .= 'for(var t=0;t<C.tops.length;t++){TOPS[C.tops[t]]=1;}';
118 126 $js .= 'function fixOne(el){';
119 - $js .= 'if(!el||el.nodeType!==1)return;';
120 - $js .= 'var cs;';
121 - $js .= 'try{cs=getComputedStyle(el);}catch(_e){return;}';
122 - $js .= "if(cs.position==='static')return;";
123 - $js .= "if(TOPS[cs.top]){el.style.setProperty('top','0px','important');}";
127 + $js .= 'if(!el||el.nodeType!==1)return;';
128 + $js .= 'var cs;';
129 + $js .= 'try{cs=getComputedStyle(el);}catch(_e){return;}';
130 + $js .= "if(cs.position==='static')return;";
131 + $js .= "if(TOPS[cs.top]){el.style.setProperty('top','0px','important');}";
124 132 $js .= '}';
125 133 $js .= 'function walkSubtree(root){';
126 - $js .= 'if(!root)return;';
127 - $js .= 'if(root.nodeType===1){fixOne(root);}';
128 - $js .= "var els=root.querySelectorAll?root.querySelectorAll('*'):[];";
129 - $js .= 'for(var i=0;i<els.length;i++){fixOne(els[i]);}';
134 + $js .= 'if(!root)return;';
135 + $js .= 'if(root.nodeType===1){fixOne(root);}';
136 + $js .= "var els=root.querySelectorAll?root.querySelectorAll('*'):[];";
137 + $js .= 'for(var i=0;i<els.length;i++){fixOne(els[i]);}';
130 138 $js .= '}';
139 + // Added nodes are queued and walked in ONE idle-time flush. The
140 + // observer callback must never read computed style itself — it
141 + // runs before the next paint, so a style read there is a forced
142 + // synchronous recalc on the editor's typing path.
143 + $js .= 'var queue=[];';
144 + $js .= 'var scheduled=false;';
145 + $js .= 'function flush(){';
146 + $js .= 'scheduled=false;';
147 + $js .= 'var batch=queue;';
148 + $js .= 'queue=[];';
149 + $js .= 'for(var i=0;i<batch.length;i++){';
150 + // Skip nodes detached between enqueue and flush (transient
151 + // popovers, React unmounts) — nothing visible to correct, and
152 + // getComputedStyle on a detached tree is wasted work.
153 + $js .= 'if(batch[i].isConnected===false)continue;';
154 + $js .= 'walkSubtree(batch[i]);';
155 + $js .= '}';
156 + $js .= '}';
157 + $js .= 'function schedule(){';
158 + $js .= 'if(scheduled)return;';
159 + $js .= 'scheduled=true;';
160 + $js .= 'if(window.requestIdleCallback){window.requestIdleCallback(flush,{timeout:500});}';
161 + $js .= 'else{window.setTimeout(flush,200);}';
162 + $js .= '}';
131 163 $js .= 'var started=false;';
132 164 $js .= 'function start(){';
133 - $js .= 'if(started)return;';
134 - $js .= "if(!document.body||!document.body.classList.contains('desktop-mode-chromeless'))return;";
135 - $js .= 'started=true;';
136 - $js .= 'var MO=window.MutationObserver;';
137 - $js .= 'if(MO){';
138 - $js .= 'var observer=new MO(function(records){';
139 - $js .= 'for(var r=0;r<records.length;r++){';
140 - $js .= 'var rec=records[r];';
141 - $js .= "if(rec.type!=='childList')continue;";
142 - $js .= 'var added=rec.addedNodes;';
143 - $js .= 'for(var n=0;n<added.length;n++){walkSubtree(added[n]);}';
144 - $js .= '}';
145 - $js .= '});';
146 - $js .= 'observer.observe(document.body,{childList:true,subtree:true});';
147 - $js .= '}';
148 - $js .= 'walkSubtree(document.body);';
165 + $js .= 'if(started)return;';
166 + $js .= "if(!document.body||!document.body.classList.contains('os-chromeless'))return;";
167 + $js .= 'started=true;';
168 + $js .= 'var MO=window.MutationObserver;';
169 + $js .= 'if(MO){';
170 + $js .= 'var observer=new MO(function(records){';
171 + $js .= 'var found=false;';
172 + $js .= 'for(var r=0;r<records.length;r++){';
173 + $js .= 'var rec=records[r];';
174 + $js .= "if(rec.type!=='childList')continue;";
175 + $js .= 'var added=rec.addedNodes;';
176 + $js .= 'for(var n=0;n<added.length;n++){';
177 + // Element nodes only — rich-text edits insert text nodes by the
178 + // dozen, and those can never carry a positioned offset.
179 + $js .= 'if(added[n].nodeType===1){queue.push(added[n]);found=true;}';
180 + $js .= '}';
181 + $js .= '}';
182 + $js .= 'if(found){schedule();}';
183 + $js .= '});';
184 + $js .= 'observer.observe(document.body,{childList:true,subtree:true});';
185 + $js .= '}';
186 + $js .= 'walkSubtree(document.body);';
149 187 // Defense in depth — pre-MutationObserver browsers fall back to the
150 188 // original double-walk so React-mounted components added between
151 189 // DOMContentLoaded and load still get neutralized.
152 - $js .= 'if(!MO){';
153 - $js .= "window.addEventListener('load',function(){walkSubtree(document.body);},{once:true});";
154 - $js .= '}';
190 + $js .= 'if(!MO){';
191 + $js .= "window.addEventListener('load',function(){walkSubtree(document.body);},{once:true});";
155 192 $js .= '}';
193 + $js .= '}';
156 194 $js .= "if(document.readyState==='loading'){";
157 - $js .= "document.addEventListener('DOMContentLoaded',start,{once:true});";
195 + $js .= "document.addEventListener('DOMContentLoaded',start,{once:true});";
158 196 $js .= '}else{';
159 - $js .= 'start();';
197 + $js .= 'start();';
160 198 $js .= '}';
161 199 $js .= '})(' . $config . ');';
162 200
163 201 wp_print_inline_script_tag( $js );
164 202 }
165 -add_action( 'admin_head', 'desktop_mode_chromeless_offset_neutralizer_script', 1 );
203 +add_action( 'admin_head', 'openstation_chromeless_offset_neutralizer_script', 1 );
166 204
167 205 /**
168 - * Short-circuit `admin.php?desktop_mode_menu_refresh=1` requests with
206 + * Tells the shell that a navigation has landed, for the status ring:
207 + * a submit's "end" can only come from the document answering it, and
208 + * the bridge below is the wrong messenger. Enqueued on `admin_footer`,
209 + * it runs after every other admin script — a second or more after the
210 + * browser painted the "Settings saved." notice the ring is
211 + * confirming. From the head it beats the body to the screen.
212 + *
213 + * The parent ignores it unless that window has a submit waiting.
214 + */
215 +function openstation_chromeless_navigation_ping_script() {
216 + if ( ! openstation_is_chromeless_request() ) {
217 + return;
218 + }
219 +
220 + wp_print_inline_script_tag(
221 + "try{if(window.parent&&window.parent!==window){window.parent.postMessage({type:'os-iframe-navigated'},window.location.origin);}}catch(e){}"
222 + );
223 +}
224 +add_action( 'admin_head', 'openstation_chromeless_navigation_ping_script', 1 );
225 +
226 +/**
227 + * Short-circuit `admin.php?openstation_menu_refresh=1` requests with
169 228 * a tiny inline-script response that postMessages the current menu
170 229 * payload to the parent shell.
171 230 *
172 231 * The full chromeless bridge is hooked on `admin_footer`, which Core
@@ -174,9 +233,9 @@
174 233 * `admin.php` without `?page=` (or one of the other dispatch paths
175 234 * in admin.php) never includes the footer — the file just runs the
176 235 * `load-{$pagenow}` hook in the `else` branch and exits. The full
177 236 * bridge therefore never emits its payload, and the parent's
178 - * `wp.desktop.refreshMenu()` waits out its 8-second timeout for a
237 + * `wp.os.refreshMenu()` waits out its 8-second timeout for a
179 238 * message that's never coming. That's the source of "deactivating a
180 239 * plugin leaves its dock icons behind" — the hidden probe iframe
181 240 * the shell spawns to harvest the post-mutation menu lands on a
182 241 * page that doesn't fire admin_footer.
@@ -193,17 +252,15 @@
193 252 * (the vast majority) still ship correctly; items that rely on a
194 253 * CSS `::before` on `#adminmenu .menu-icon-<slug>` fall back to the
195 254 * default gear icon on a live refresh until the next full page load
196 255 * — strictly better than today's "dock doesn't update at all."
197 - *
198 - * @since 0.18.4
199 256 */
200 -function desktop_mode_emit_menu_refresh_probe() {
257 +function openstation_emit_menu_refresh_probe() {
201 258 // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only payload harvest; capability-gated by chromeless gate below.
202 - if ( empty( $_GET['desktop_mode_menu_refresh'] ) ) {
259 + if ( empty( $_GET['openstation_menu_refresh'] ) ) {
203 260 return;
204 261 }
205 - if ( ! desktop_mode_is_chromeless_request() ) {
262 + if ( ! openstation_is_chromeless_request() ) {
206 263 return;
207 264 }
208 265 // Only short-circuit the bare `admin.php` probe — for any real
209 266 // admin page (plugins.php, edit.php, etc.) we still want the full
@@ -212,9 +269,9 @@
212 269 if ( 'admin.php' !== $pagenow ) {
213 270 return;
214 271 }
215 272
216 - $payload = desktop_mode_build_menu_payload();
273 + $payload = openstation_menu_refresh_probe_payload();
217 274 $encoded = wp_json_encode( $payload );
218 275 if ( false === $encoded ) {
219 276 return;
220 277 }
@@ -225,9 +282,9 @@
225 282 // Mirror the full bridge's message shape so the same shell-side
226 283 // listener consumes both.
227 284 echo '<!doctype html><html><head><meta charset="utf-8"><title></title></head><body>';
228 285 echo '<script>';
229 - echo '(function(){try{if(window.parent&&window.parent!==window){window.parent.postMessage({type:"desktop-mode-plugins-changed",payload:';
286 + echo '(function(){try{if(window.parent&&window.parent!==window){window.parent.postMessage({type:"os-plugins-changed",payload:';
230 287 echo $encoded; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- wp_json_encode produces JSON-safe output.
231 288 echo '},window.location.origin);}}catch(e){}})();';
232 289 echo '</script>';
233 290 echo '</body></html>';
@@ -232,11 +289,89 @@
232 289 echo '</script>';
233 290 echo '</body></html>';
234 291 exit;
235 292 }
236 -add_action( 'admin_init', 'desktop_mode_emit_menu_refresh_probe', 99 );
293 +add_action( 'admin_init', 'openstation_emit_menu_refresh_probe', 99 );
237 294
238 295 /**
296 + * Build the menu payload the refresh probe emits, with the script
297 + * data the harvest depends on attached first.
298 + *
299 + * `openstation_build_menu_payload()` harvests every lazy native
300 + * window's handle-attached data — `wp_localize_script` blobs and
301 + * `wp_add_inline_script` snippets — via
302 + * `openstation_resolve_script_payload()`. Modules attach that data on
303 + * `admin_enqueue_scripts` at priority ≤ 5 (the contract
304 + * `Tests_OpenStation_LazyWindowConfigPriority` pins), which holds on
305 + * every payload producer except this one: the probe short-circuits
306 + * `admin.php` on `admin_init`, long before Core would fire the
307 + * enqueue hook, so nothing was ever attached and the harvested
308 + * entries shipped with empty `scriptBefore` / `scriptL10n` arrays.
309 + *
310 + * The shell refreshes its native-window index from every payload it
311 + * receives, so one probe response silently downgraded windows the
312 + * boot payload had delivered complete — the first lazy open of WP
313 + * Explorer after a menu refresh found the WooCommerce companion with
314 + * no `openStationWooConfig`, and the store's order bands and preview
315 + * panels went dark with nothing in the console to say why.
316 + *
317 + * Replaying the hook here makes the probe's request faithful to the
318 + * real admin page it stands in for. The output buffer guards the
319 + * short-circuit response: an enqueue callback that echoes must not
320 + * beat our `header()` calls. Enqueued handles are never printed —
321 + * the probe exits before any print pipeline runs.
322 + *
323 + * @return array Menu payload, same shape as `openstation_build_menu_payload()`.
324 + */
325 +function openstation_menu_refresh_probe_payload() {
326 + if ( ! did_action( 'admin_enqueue_scripts' ) ) {
327 + // `admin.php` calls `set_current_screen()` AFTER `admin_init`,
328 + // so at probe time there is no screen yet — and Core's own
329 + // enqueue callbacks (the block-editor script loader among
330 + // them) read `get_current_screen()->id` unguarded. Build the
331 + // screen the real flow would have had before the hook fires,
332 + // in the request's own admin context — see
333 + // `openstation_menu_refresh_probe_screen_id()`.
334 + if ( function_exists( 'set_current_screen' ) && function_exists( 'get_current_screen' ) && ! get_current_screen() ) {
335 + set_current_screen( openstation_menu_refresh_probe_screen_id() );
336 + }
337 + ob_start();
338 + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- deliberate replay of Core's own hook so handle-attached script data exists before the harvest below.
339 + do_action( 'admin_enqueue_scripts', 'admin.php' );
340 + ob_end_clean();
341 + }
342 +
343 + return openstation_build_menu_payload();
344 +}
345 +
346 +/**
347 + * The screen id the refresh probe builds its placeholder `WP_Screen`
348 + * from: `admin-network` in the network admin, `admin-user` in the user
349 + * admin, `admin` on a site.
350 + *
351 + * Once a screen exists, `is_network_admin()` answers from it — and a
352 + * screen built from a bare id gets its admin context from the id's
353 + * SUFFIX (`-network`, `-user`, or none for a site screen), never from
354 + * `WP_NETWORK_ADMIN`. A plain `admin` screen therefore turned a
355 + * network-admin probe into a site request for everything after it:
356 + * `self_admin_url()` resolved every network menu slug against the site
357 + * admin, and a live refresh on the network shell painted a dock whose
358 + * tiles opened site pages. Read the context here, BEFORE any screen
359 + * exists, where the answer still comes from the request itself.
360 + *
361 + * @return string Screen id carrying the request's admin context.
362 + */
363 +function openstation_menu_refresh_probe_screen_id() {
364 + if ( is_network_admin() ) {
365 + return 'admin-network';
366 + }
367 + if ( is_user_admin() ) {
368 + return 'admin-user';
369 + }
370 + return 'admin';
371 +}
372 +
373 +/**
239 374 * Outputs the chromeless screen-meta bridge script.
240 375 *
241 376 * Detects Screen Options / Help panels in the iframed page and relays
242 377 * their availability + open/closed state to the parent desktop shell
@@ -241,24 +376,20 @@
241 376 * Detects Screen Options / Help panels in the iframed page and relays
242 377 * their availability + open/closed state to the parent desktop shell
243 378 * via postMessage. The parent shell uses this to render matching
244 379 * buttons in the window title bar.
245 - *
246 - * @since 0.1.0
247 380 */
248 -function desktop_mode_chromeless_bridge_script() {
249 - if ( ! desktop_mode_is_chromeless_request() ) {
381 +function openstation_chromeless_bridge_script() {
382 + if ( ! openstation_is_chromeless_request() ) {
250 383 return;
251 384 }
252 385
253 386 /**
254 - * Fires after chromeless content in desktop mode.
387 + * Fires after chromeless content in OpenStation.
255 388 *
256 - * @since 0.1.0
257 - *
258 389 * @param string $hook_suffix The current admin page hook suffix.
259 390 */
260 - do_action( 'desktop_mode_chromeless_after', isset( $GLOBALS['hook_suffix'] ) ? $GLOBALS['hook_suffix'] : '' );
391 + do_action( 'openstation_chromeless_after', isset( $GLOBALS['hook_suffix'] ) ? $GLOBALS['hook_suffix'] : '' );
261 392
262 393 // Menu payload — built from the LIVE $menu / $submenu globals
263 394 // populated by real admin-context bootstrapping. We capture it here
264 395 // rather than making the parent refetch via REST because many
@@ -272,10 +403,10 @@
272 403 // post-activation state.
273 404 //
274 405 // Narrowed to the set of pages whose completion commonly mutates
275 406 // the admin menu (activation / deactivation / install / theme
276 - // switch), plus the explicit `desktop_mode_menu_refresh=1` signal
277 - // the shell sets when `wp.desktop.refreshMenu()` spawns a hidden
407 + // switch), plus the explicit `openstation_menu_refresh=1` signal
408 + // the shell sets when `wp.os.refreshMenu()` spawns a hidden
278 409 // iframe to harvest a fresh payload from real admin context.
279 410 // Navigating to edit.php or similar doesn't change the menu so we
280 411 // don't bother sending a payload otherwise — the debounce +
281 412 // idempotent replaceItems on the parent side would still make it
@@ -281,9 +412,9 @@
281 412 // idempotent replaceItems on the parent side would still make it
282 413 // safe, just wasteful.
283 414 $menu_payload_json = 'null';
284 415 $pagenow = isset( $GLOBALS['pagenow'] ) ? (string) $GLOBALS['pagenow'] : '';
285 - $is_refresh_probe = ! empty( $_GET['desktop_mode_menu_refresh'] ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only payload harvest, capability-gated by the host admin page.
416 + $is_refresh_probe = ! empty( $_GET['openstation_menu_refresh'] ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only payload harvest, capability-gated by the host admin page.
286 417 if (
287 418 $is_refresh_probe
288 419 || in_array(
289 420 $pagenow,
@@ -290,2399 +421,126 @@
290 421 array( 'plugins.php', 'plugin-install.php', 'update.php', 'themes.php' ),
291 422 true
292 423 )
293 424 ) {
294 - $encoded = wp_json_encode( desktop_mode_build_menu_payload() );
425 + $encoded = wp_json_encode( openstation_build_menu_payload() );
295 426 if ( false !== $encoded ) {
296 427 $menu_payload_json = $encoded;
297 428 }
298 429 }
299 430
300 - // Emit via wp_print_inline_script_tag so CSP nonces and `<script>`
301 - // attribute hygiene go through Core rather than being hand-rolled.
302 - $js = <<<'JS'
303 -//# sourceURL=desktop-mode-chromeless-bridge.js
304 -( function() {
305 - // Escape hatch: a chromeless page is only meant to live inside a
306 - // desktop-mode window iframe. If the top window IS this page, the
307 - // user ended up here directly — either bookmarked it, followed a
308 - // stale link, or got stranded by a bad portal redirect. Without
309 - // an admin bar there's no toggle to turn desktop mode off, so
310 - // strip the chromeless flag and reload as classic admin. That
311 - // puts the admin bar back and lets the user decide what to do.
312 - if ( ! window.parent || window.parent === window ) {
313 - try {
314 - var here = new URL( window.location.href );
315 - if ( here.searchParams.has( 'desktop_mode_chromeless' ) ) {
316 - here.searchParams.delete( 'desktop_mode_chromeless' );
317 - here.searchParams.delete( 'desktop_mode_portal' );
318 - window.location.replace( here.toString() );
319 - }
320 - } catch ( err ) {
321 - /* URL parse failure — let the broken state stand rather than
322 - * navigate somewhere worse. */
323 - }
324 - return;
431 + // Content identity — which object this admin page shows ("comment 45
432 + // of post 123"). Built here, in real admin context, because the URL
433 + // alone can't resolve relations like comment → parent post. Always
434 + // emitted (including `null`) so navigating an iframe from an
435 + // identified page to an unidentified one clears the stale identity
436 + // in the parent's relations engine.
437 + $content_identity_json = wp_json_encode( openstation_build_content_identity() );
438 + if ( false === $content_identity_json ) {
439 + $content_identity_json = 'null';
325 440 }
326 441
327 - /*
328 - * Observability — iframe error + network capture.
329 - *
330 - * Everything admin-interesting (REST failures from Gutenberg,
331 - * admin-ajax 500s, plugin console warnings) fires INSIDE the
332 - * iframe whose parent is the desktop shell. Without relaying
333 - * those events to the shell, monitor / debug widgets would only
334 - * ever see the shell's own errors — the smallest, least-
335 - * interesting surface in the whole admin.
336 - *
337 - * Two listeners and two wrappers land here:
338 - *
339 - * - `error` + `unhandledrejection` on window → postMessage
340 - * `desktop-mode-iframe-error`. Parent dispatches `HOOKS.
341 - * IFRAME_ERROR`.
342 - * - `fetch` + `XMLHttpRequest` are wrapped so every completed
343 - * request (including failures) posts
344 - * `desktop-mode-iframe-network` with `{ method, url, status,
345 - * duration, failed }`. Parent dispatches `HOOKS.
346 - * IFRAME_NETWORK_COMPLETED`.
347 - *
348 - * Privacy: request / response bodies are NEVER captured — only
349 - * method, URL, status, duration. Monitor widgets that want the
350 - * full payload must ship their own deeper wrapper (at which
351 - * point they own the consent conversation).
352 - */
353 - try {
354 - window.addEventListener( 'error', function ( e ) {
355 - try {
356 - window.parent.postMessage( {
357 - type: 'desktop-mode-iframe-error',
358 - kind: 'error',
359 - message: e && e.message ? String( e.message ) : '',
360 - filename: e && e.filename ? String( e.filename ) : null,
361 - lineno: e && typeof e.lineno === 'number' ? e.lineno : null,
362 - colno: e && typeof e.colno === 'number' ? e.colno : null,
363 - stack: e && e.error && e.error.stack ? String( e.error.stack ) : null
364 - }, window.location.origin );
365 - } catch ( _err ) { /* swallow: don't let the relay compound the error */ }
366 - } );
367 -
368 - window.addEventListener( 'unhandledrejection', function ( e ) {
369 - try {
370 - var reason = e && 'reason' in e ? e.reason : null;
371 - var message = '';
372 - var stack = null;
373 - if ( reason instanceof Error ) {
374 - message = reason.message;
375 - stack = reason.stack || null;
376 - } else if ( reason !== null && reason !== undefined ) {
377 - try { message = String( reason ); } catch ( _s ) { message = '[unstringifiable]'; }
378 - }
379 - window.parent.postMessage( {
380 - type: 'desktop-mode-iframe-error',
381 - kind: 'unhandledrejection',
382 - message: message,
383 - filename: null,
384 - lineno: null,
385 - colno: null,
386 - stack: stack
387 - }, window.location.origin );
388 - } catch ( _err ) { /* swallow */ }
389 - } );
390 -
391 - // Devtools instrumentation slot — populated by
392 - // `desktop-mode-instrument-set` messages from the parent shell.
393 - // Mutable: parent overwrites the whole object on every change
394 - // (header add/remove, observe toggle).
395 - //
396 - // Headers: { name: 'value' } — already pre-merged by the parent
397 - // (RFC 7230 §3.2.2 join applied there).
398 - // Observe: when true, network reports include request +
399 - // response headers; otherwise only the privacy-conscious
400 - // summary travels parent-bound.
401 - window.__wpdInstrument = window.__wpdInstrument || { headers: {}, observe: false };
402 - try {
403 - window.addEventListener( 'message', function ( ev ) {
404 - if ( ev.origin !== window.location.origin || ev.source !== window.parent ) {
405 - return;
406 - }
407 - var d = ev && ev.data;
408 - if ( ! d || typeof d !== 'object' || d.type !== 'desktop-mode-instrument-set' ) {
409 - return;
410 - }
411 - window.__wpdInstrument = {
412 - headers: d.headers && typeof d.headers === 'object' ? d.headers : {},
413 - observe: !! d.observe
414 - };
415 - } );
416 - } catch ( _err ) { /* swallow — instrumentation is best-effort */ }
417 -
418 - var wpdReportNetwork = function ( method, url, status, duration, failed, extra ) {
419 - try {
420 - var msg = {
421 - type: 'desktop-mode-iframe-network',
422 - method: String( method || 'GET' ).toUpperCase(),
423 - url: String( url || '' ),
424 - status: typeof status === 'number' ? status : 0,
425 - duration: typeof duration === 'number' ? duration : 0,
426 - failed: !! failed
427 - };
428 - if ( extra && window.__wpdInstrument && window.__wpdInstrument.observe ) {
429 - if ( extra.requestHeaders ) {
430 - msg.requestHeaders = extra.requestHeaders;
431 - }
432 - if ( extra.responseHeaders ) {
433 - msg.responseHeaders = extra.responseHeaders;
434 - }
435 - }
436 - window.parent.postMessage( msg, window.location.origin );
437 - } catch ( _err ) { /* swallow */ }
438 - };
439 -
440 - // Helper — when an admin-side request returns 401/403 the
441 - // session is most likely toast. Don't wait up to 60s for the
442 - // next heartbeat tick to surface core's auth-check modal —
443 - // force an immediate tick. `wp.heartbeat.connectNow()` is
444 - // safe to call repeatedly; we still debounce to avoid storms
445 - // when many requests fail at once. Same-origin gate keeps us
446 - // out of third-party 403s. The URL gate avoids looping on
447 - // heartbeat itself (heartbeat shouldn't 403 — but if it does
448 - // the recursive connectNow would not help anyway).
449 - var wpdAuthCheckCooldownUntil = 0;
450 - var wpdMaybeForceAuthCheck = function ( status, url ) {
451 - if ( status !== 401 && status !== 403 ) {
452 - return;
442 + // On pages that don't carry a full payload, ship the lightweight
443 + // menu signature so the shell can detect an off-allowlist menu
444 + // change (e.g. a CPT registered via a settings tool) and refresh
445 + // only then. The full payload already embeds its own `menuSig`, so
446 + // there's no point recomputing it when one is being sent. GH#325.
447 + $menu_sig_json = 'null';
448 + if ( 'null' === $menu_payload_json ) {
449 + $menu_sig = openstation_menu_signature();
450 + if ( '' !== $menu_sig ) {
451 + $encoded_sig = wp_json_encode( $menu_sig );
452 + if ( false !== $encoded_sig ) {
453 + $menu_sig_json = $encoded_sig;
453 454 }
454 - var urlStr = String( url || '' );
455 - if ( ! urlStr ) {
456 - return;
457 - }
458 - // Cross-origin URLs aren't ours to interpret.
459 - try {
460 - var resolved = new URL( urlStr, window.location.href );
461 - if ( resolved.origin !== window.location.origin ) {
462 - return;
463 - }
464 - // Skip heartbeat to avoid recursion. Skip wp-login
465 - // because the login iframe itself returns 4xx during
466 - // the auth handshake and we don't want to retrigger.
467 - if (
468 - resolved.pathname.indexOf( '/wp-admin/admin-ajax.php' ) !== -1
469 - && /(?:^|&|\?)action=heartbeat(?:&|$)/.test( resolved.search )
470 - ) {
471 - return;
472 - }
473 - if ( resolved.pathname.indexOf( '/wp-login.php' ) !== -1 ) {
474 - return;
475 - }
476 - } catch ( _err ) {
477 - return;
478 - }
479 - var now = Date.now();
480 - if ( now < wpdAuthCheckCooldownUntil ) {
481 - return;
482 - }
483 - wpdAuthCheckCooldownUntil = now + 5000;
484 - try {
485 - if (
486 - window.wp
487 - && window.wp.heartbeat
488 - && typeof window.wp.heartbeat.connectNow === 'function'
489 - ) {
490 - window.wp.heartbeat.connectNow();
491 - }
492 - } catch ( _err ) { /* swallow */ }
493 - };
494 -
495 - // Helper — convert an arbitrary `init.headers` shape into a
496 - // plain `{ name: value }` map so the instrument layer can
497 - // merge contributed headers without caring whether the caller
498 - // passed a Headers, an array of pairs, or a plain object.
499 - var wpdHeadersToObject = function ( h ) {
500 - var out = {};
501 - if ( ! h ) {
502 - return out;
503 - }
504 - if ( typeof Headers !== 'undefined' && h instanceof Headers ) {
505 - try {
506 - h.forEach( function ( v, k ) { out[ k ] = v; } );
507 - } catch ( _e ) { /* swallow */ }
508 - return out;
509 - }
510 - if ( Array.isArray( h ) ) {
511 - for ( var i = 0; i < h.length; i++ ) {
512 - if ( h[ i ] && h[ i ].length >= 2 ) {
513 - out[ h[ i ][ 0 ] ] = h[ i ][ 1 ];
514 - }
515 - }
516 - return out;
517 - }
518 - if ( typeof h === 'object' ) {
519 - for ( var k in h ) {
520 - if ( Object.prototype.hasOwnProperty.call( h, k ) ) {
521 - out[ k ] = h[ k ];
522 - }
523 - }
524 - }
525 - return out;
526 - };
527 -
528 - // Helper — snapshot the contributed-header set at request time.
529 - // Header values can theoretically come and go between requests
530 - // (parent ref-counts contributions) so we read fresh on every
531 - // call rather than caching at wrap time.
532 - var wpdContributedHeaders = function () {
533 - var inst = window.__wpdInstrument || {};
534 - var headers = inst.headers || {};
535 - var out = {};
536 - for ( var k in headers ) {
537 - if ( Object.prototype.hasOwnProperty.call( headers, k ) && typeof headers[ k ] === 'string' ) {
538 - out[ k ] = headers[ k ];
539 - }
540 - }
541 - return out;
542 - };
543 -
544 - // Wrap fetch. Called AFTER `admin_footer` runs — plugin code
545 - // using fetch during synchronous page boot (rare in wp-admin)
546 - // bypasses this, but lazy calls (the common case) are captured.
547 - //
548 - // Two layers of behavior:
549 - //
550 - // - Always: timing + status reporting (the original
551 - // observability contract).
552 - // - When `__wpdInstrument.headers` is non-empty: merge those
553 - // headers into the request before dispatch so devtools can
554 - // tag every outgoing call without each plugin reinventing
555 - // a fetch wrapper.
556 - // - When `__wpdInstrument.observe`: also relay request +
557 - // response headers in the parent-bound network message.
558 - if ( typeof window.fetch === 'function' ) {
559 - var wpdOrigFetch = window.fetch;
560 - window.fetch = function ( input, init ) {
561 - var start = ( typeof performance !== 'undefined' && performance.now )
562 - ? performance.now()
563 - : Date.now();
564 - var method = 'GET';
565 - var url = '';
566 - if ( typeof input === 'string' ) {
567 - url = input;
568 - if ( init && typeof init.method === 'string' ) {
569 - method = init.method;
570 - }
571 - } else if ( input && typeof input === 'object' ) {
572 - url = input.url || '';
573 - method = ( input.method || ( init && init.method ) || 'GET' );
574 - }
575 -
576 - // Header contribution + capture. Build a single
577 - // `Headers` instance so contributed values overwrite /
578 - // stack predictably regardless of the caller's input
579 - // shape, then re-attach to a cloned init.
580 - var contributed = wpdContributedHeaders();
581 - var observe = window.__wpdInstrument && window.__wpdInstrument.observe;
582 - var requestHeaders = null;
583 - var hasContributed = false;
584 - for ( var ck in contributed ) {
585 - if ( Object.prototype.hasOwnProperty.call( contributed, ck ) ) {
586 - hasContributed = true;
587 - break;
588 - }
589 - }
590 - if ( hasContributed || observe ) {
591 - var existing = wpdHeadersToObject( init && init.headers );
592 - if ( input && typeof input === 'object' && input.headers ) {
593 - var fromReq = wpdHeadersToObject( input.headers );
594 - for ( var rk in fromReq ) {
595 - if ( Object.prototype.hasOwnProperty.call( fromReq, rk ) && ! ( rk in existing ) ) {
596 - existing[ rk ] = fromReq[ rk ];
597 - }
598 - }
599 - }
600 - for ( var ck2 in contributed ) {
601 - if ( Object.prototype.hasOwnProperty.call( contributed, ck2 ) ) {
602 - existing[ ck2 ] = contributed[ ck2 ];
603 - }
604 - }
605 - if ( hasContributed ) {
606 - init = init ? Object.assign( {}, init ) : {};
607 - init.headers = existing;
608 - arguments[ 1 ] = init;
609 - }
610 - if ( observe ) {
611 - requestHeaders = existing;
612 - }
613 - }
614 -
615 - var promise;
616 - try {
617 - promise = wpdOrigFetch.apply( this, arguments );
618 - } catch ( sync ) {
619 - wpdReportNetwork( method, url, 0, 0, true, requestHeaders ? { requestHeaders: requestHeaders } : null );
620 - throw sync;
621 - }
622 - return promise.then(
623 - function ( res ) {
624 - var dur = ( ( typeof performance !== 'undefined' && performance.now )
625 - ? performance.now()
626 - : Date.now() ) - start;
627 - var extra = null;
628 - if ( requestHeaders ) {
629 - extra = { requestHeaders: requestHeaders };
630 - try {
631 - var rh = {};
632 - if ( res && res.headers && typeof res.headers.forEach === 'function' ) {
633 - res.headers.forEach( function ( v, k ) { rh[ k ] = v; } );
634 - }
635 - extra.responseHeaders = rh;
636 - } catch ( _hErr ) { /* swallow */ }
637 - }
638 - wpdReportNetwork( method, url, res.status, Math.round( dur ), ! res.ok, extra );
639 - wpdMaybeForceAuthCheck( res.status, url );
640 - return res;
641 - },
642 - function ( err ) {
643 - var dur = ( ( typeof performance !== 'undefined' && performance.now )
644 - ? performance.now()
645 - : Date.now() ) - start;
646 - wpdReportNetwork( method, url, 0, Math.round( dur ), true, requestHeaders ? { requestHeaders: requestHeaders } : null );
647 - throw err;
648 - }
649 - );
650 - };
651 455 }
652 -
653 - // Wrap XHR — admin-ajax runs through jQuery which runs through
654 - // XHR, so fetch-only instrumentation would miss most of the
655 - // legacy admin surface. Record method + URL on open; fire on
656 - // loadend regardless of success / failure.
657 - //
658 - // Header contribution layer: `setRequestHeader` after open() but
659 - // before send() — that's the only window the spec allows. The
660 - // caller's own headers are tracked so observation can include
661 - // them alongside the contributed ones.
662 - if ( typeof XMLHttpRequest !== 'undefined' ) {
663 - var wpdOrigOpen = XMLHttpRequest.prototype.open;
664 - var wpdOrigSend = XMLHttpRequest.prototype.send;
665 - var wpdOrigSetHeader = XMLHttpRequest.prototype.setRequestHeader;
666 - XMLHttpRequest.prototype.open = function ( method, url ) {
667 - try {
668 - this.__wpdMethod = method;
669 - this.__wpdUrl = url;
670 - this.__wpdReqHeaders = {};
671 - } catch ( _err ) { /* frozen instance — skip */ }
672 - return wpdOrigOpen.apply( this, arguments );
673 - };
674 - XMLHttpRequest.prototype.setRequestHeader = function ( name, value ) {
675 - try {
676 - if ( ! this.__wpdReqHeaders ) {
677 - this.__wpdReqHeaders = {};
678 - }
679 - this.__wpdReqHeaders[ name ] = value;
680 - } catch ( _err ) { /* swallow */ }
681 - return wpdOrigSetHeader.apply( this, arguments );
682 - };
683 - XMLHttpRequest.prototype.send = function () {
684 - var xhr = this;
685 - var start = ( typeof performance !== 'undefined' && performance.now )
686 - ? performance.now()
687 - : Date.now();
688 -
689 - // Apply contributed headers right before send. Doing it
690 - // here rather than in open() means contributions added
691 - // after open() (e.g. in async-built request flows) still
692 - // land on the wire.
693 - var contributed = wpdContributedHeaders();
694 - var observe = window.__wpdInstrument && window.__wpdInstrument.observe;
695 - for ( var hk in contributed ) {
696 - if ( Object.prototype.hasOwnProperty.call( contributed, hk ) ) {
697 - try {
698 - wpdOrigSetHeader.call( xhr, hk, contributed[ hk ] );
699 - if ( ! xhr.__wpdReqHeaders ) {
700 - xhr.__wpdReqHeaders = {};
701 - }
702 - xhr.__wpdReqHeaders[ hk ] = contributed[ hk ];
703 - } catch ( _hErr ) { /* `setRequestHeader` rejects forbidden names — skip */ }
704 - }
705 - }
706 -
707 - var fire = function () {
708 - var dur = ( ( typeof performance !== 'undefined' && performance.now )
709 - ? performance.now()
710 - : Date.now() ) - start;
711 - var extra = null;
712 - if ( observe ) {
713 - extra = {
714 - requestHeaders: xhr.__wpdReqHeaders || {}
715 - };
716 - try {
717 - var raw = xhr.getAllResponseHeaders ? xhr.getAllResponseHeaders() : '';
718 - var resHeaders = {};
719 - if ( raw && typeof raw === 'string' ) {
720 - var lines = raw.trim().split( /[\r\n]+/ );
721 - for ( var li = 0; li < lines.length; li++ ) {
722 - var idx = lines[ li ].indexOf( ':' );
723 - if ( idx > 0 ) {
724 - resHeaders[ lines[ li ].slice( 0, idx ).trim() ] = lines[ li ].slice( idx + 1 ).trim();
725 - }
726 - }
727 - }
728 - extra.responseHeaders = resHeaders;
729 - } catch ( _rErr ) { /* swallow */ }
730 - }
731 - wpdReportNetwork(
732 - xhr.__wpdMethod,
733 - xhr.__wpdUrl,
734 - xhr.status,
735 - Math.round( dur ),
736 - xhr.status === 0 || xhr.status >= 400,
737 - extra
738 - );
739 - wpdMaybeForceAuthCheck( xhr.status, xhr.__wpdUrl );
740 - };
741 - try {
742 - xhr.addEventListener( 'loadend', fire );
743 - } catch ( _err ) { /* swallow */ }
744 - return wpdOrigSend.apply( this, arguments );
745 - };
746 - }
747 -
748 - // Wrap sendBeacon — used by analytics + telemetry. The Beacon
749 - // API doesn't accept headers (the entire point of beacons is
750 - // minimal payload + best-effort delivery). When devtools have
751 - // contributed headers we silently fall back to fetch with
752 - // `keepalive: true`, which is the closest semantic match —
753 - // guaranteed POST + same fire-and-forget intent + custom headers
754 - // allowed. Without contributions we just relay the call.
755 - if ( typeof navigator !== 'undefined' && typeof navigator.sendBeacon === 'function' ) {
756 - var wpdOrigBeacon = navigator.sendBeacon.bind( navigator );
757 - navigator.sendBeacon = function ( url, data ) {
758 - var contributed = wpdContributedHeaders();
759 - var hasContributed = false;
760 - for ( var ck in contributed ) {
761 - if ( Object.prototype.hasOwnProperty.call( contributed, ck ) ) {
762 - hasContributed = true;
763 - break;
764 - }
765 - }
766 - var start = ( typeof performance !== 'undefined' && performance.now )
767 - ? performance.now()
768 - : Date.now();
769 - if ( ! hasContributed ) {
770 - var ok = false;
771 - try { ok = !! wpdOrigBeacon( url, data ); } catch ( _e ) { ok = false; }
772 - wpdReportNetwork( 'POST', url, ok ? 200 : 0, 0, ! ok );
773 - return ok;
774 - }
775 - try {
776 - var observe = window.__wpdInstrument && window.__wpdInstrument.observe;
777 - var headers = {};
778 - for ( var hk2 in contributed ) {
779 - if ( Object.prototype.hasOwnProperty.call( contributed, hk2 ) ) {
780 - headers[ hk2 ] = contributed[ hk2 ];
781 - }
782 - }
783 - window.fetch( url, {
784 - method: 'POST',
785 - body: data,
786 - keepalive: true,
787 - credentials: 'same-origin',
788 - headers: headers
789 - } ).then(
790 - function ( res ) {
791 - var dur = ( ( typeof performance !== 'undefined' && performance.now )
792 - ? performance.now()
793 - : Date.now() ) - start;
794 - wpdReportNetwork( 'POST', url, res.status, Math.round( dur ), ! res.ok, observe ? { requestHeaders: headers } : null );
795 - },
796 - function () {
797 - var dur = ( ( typeof performance !== 'undefined' && performance.now )
798 - ? performance.now()
799 - : Date.now() ) - start;
800 - wpdReportNetwork( 'POST', url, 0, Math.round( dur ), true, observe ? { requestHeaders: headers } : null );
801 - }
802 - );
803 - return true;
804 - } catch ( _bErr ) {
805 - return false;
806 - }
807 - };
808 - }
809 - } catch ( _err ) {
810 - /* Whole observability block is best-effort. If something in
811 - * the environment disagrees (frozen prototypes, CSP blocking
812 - * postMessage, etc.) we don't want to tank the rest of the
813 - * chromeless bridge. */
814 456 }
815 457
816 - /*
817 - * Menu-changed signal.
818 - *
819 - * The shell's dock is built from `$menu` at page-load time and
820 - * then frozen — the iframe reload that follows plugin
821 - * activation / deactivation / installation doesn't tell the
822 - * parent the admin menu just mutated. This handler fires inside
823 - * the iframe that JUST LOADED plugins.php (or a sibling menu-
824 - * affecting page) and hands the parent a fresh payload the PHP
825 - * side built server-side from the live $menu globals.
826 - *
827 - * Why not a REST roundtrip: plugins commonly gate their
828 - * `admin_menu` registration on `is_admin()` evaluated AT PLUGIN
829 - * LOAD. REST requests don't define `WP_ADMIN` at plugin-load
830 - * time, so those plugins never register and a REST-context
831 - * bootstrap can't retroactively make them. By capturing the
832 - * payload here, inside a real admin context, we get the
833 - * authoritative post-activation state that any REST endpoint
834 - * would miss.
835 - *
836 - * Covered pages:
837 - * - plugins.php — activate, deactivate, bulk, delete.
838 - * - plugin-install.php — install new, install-and-activate.
839 - * - update.php — update / install handler (install-
840 - * plugin + upload-plugin actions).
841 - * - themes.php — theme switch (rare but can add menus).
842 - */
843 - var __DESKTOP_MODE_MENU_PAYLOAD__ = /*__DESKTOP_MODE_MENU_PAYLOAD__*/;
844 - /*
845 - * Icon harvest from the iframe's authoritative #adminmenu.
846 - *
847 - * The server-side payload only knows what the plugin set on
848 - * $menu[$i][6]. Plugins that register their icon with 'none' /
849 - * 'div' and paint it via a CSS rule on `#adminmenu .menu-icon-X`
850 - * (All in One WP Migration, plus a long tail of older plugins)
851 - * end up serialized with the gear fallback.
852 - *
853 - * On a regular page load the parent shell's resolveIcon() falls
854 - * back to the parent's hidden #adminmenu DOM and reads the icon
855 - * from there — but on a live activation the parent's #adminmenu
856 - * is stale (it was rendered before the plugin existed). This
857 - * iframe just rendered plugins.php in real admin context, so its
858 - * own #adminmenu DOM IS authoritative; harvest each menu item's
859 - * resolved icon here and patch the dockItems before postMessage.
860 - */
861 - try {
862 - if (
863 - __DESKTOP_MODE_MENU_PAYLOAD__
864 - && Array.isArray( __DESKTOP_MODE_MENU_PAYLOAD__.dockItems )
865 - ) {
866 - var __wpdAdminMenu = document.getElementById( 'adminmenu' );
867 - if ( __wpdAdminMenu ) {
868 - var __wpdHarvest = {};
869 - var __wpdLinks = __wpdAdminMenu.querySelectorAll( 'li.menu-top > a' );
870 - for ( var __wpdLi = 0; __wpdLi < __wpdLinks.length; __wpdLi++ ) {
871 - var __wpdLink = __wpdLinks[ __wpdLi ];
872 - var __wpdKey;
873 - try {
874 - var __wpdU = new URL( __wpdLink.href || '', window.location.href );
875 - __wpdKey = ( __wpdU.pathname.split( '/' ).pop() || '' ) + __wpdU.search;
876 - } catch ( __wpdE1 ) { continue; }
877 - if ( ! __wpdKey ) { continue; }
878 - var __wpdImgWrap = __wpdLink.querySelector( '.wp-menu-image' );
879 - if ( ! __wpdImgWrap ) { continue; }
458 + // Declarative soft-reload rules for list screens that are NOT a
459 + // standard `edit.php?post_type=<type>` / `upload.php` /
460 + // `edit-comments.php` page (those are matched generically in the
461 + // bridge script). Rule shape:
462 + // - `topic` — the `os.<type>.changed` topic.
463 + // - `path` — wp-admin filename (`admin.php`).
464 + // - `query` — required query params (exact match).
465 + // - `queryAbsent` — params that must NOT be present.
466 + //
467 + // The default rule covers WooCommerce's HPOS orders list.
468 + // `queryAbsent: [ 'action' ]` is load-bearing: with `&action=edit`
469 + // the same path is the single-order EDITOR, which must keep the
470 + // single-edit exclusion (a soft reload would destroy unsaved
471 + // order state). Shipped unconditionally — when WooCommerce is
472 + // absent the URL never renders and the rule is inert.
473 + $soft_reload_rules = array(
474 + array(
475 + 'topic' => 'os.shop_order.changed',
476 + 'path' => 'admin.php',
477 + 'query' => array( 'page' => 'wc-orders' ),
478 + 'queryAbsent' => array( 'action' ),
479 + ),
480 + );
880 481
881 - /* (a) <img src> nested inside .wp-menu-image */
882 - var __wpdImg = __wpdImgWrap.querySelector( 'img' );
883 - if ( __wpdImg && __wpdImg.src ) {
884 - __wpdHarvest[ __wpdKey ] = __wpdImg.src;
885 - continue;
886 - }
887 -
888 - /* (b) dashicon class on the wrap div itself */
889 - var __wpdDash = ( __wpdImgWrap.className || '' ).match( /\bdashicons-[\w-]+\b/ );
890 - if (
891 - __wpdDash
892 - && __wpdDash[ 0 ] !== 'dashicons-before'
893 - && __wpdDash[ 0 ] !== 'dashicons-admin-generic'
894 - ) {
895 - __wpdHarvest[ __wpdKey ] = __wpdDash[ 0 ];
896 - continue;
897 - }
898 -
899 - /* (c) ::before background-image — pass the raw
900 - * `url(...)` CSS value through; the parent's
901 - * resolveIcon can hand it straight to _makeSvgIcon
902 - * regardless of whether it's base64-encoded SVG,
903 - * URL-encoded SVG, or a plain http(s) URL. */
904 - try {
905 - var __wpdBefore = window.getComputedStyle( __wpdImgWrap, '::before' );
906 - var __wpdBg = __wpdBefore && __wpdBefore.backgroundImage;
907 - if ( __wpdBg && __wpdBg !== 'none' && __wpdBg.indexOf( 'url("")' ) === -1 ) {
908 - __wpdHarvest[ __wpdKey ] = __wpdBg;
909 - continue;
910 - }
911 - /* (d) background on the wrap itself */
912 - var __wpdWrapBg = window.getComputedStyle( __wpdImgWrap ).backgroundImage;
913 - if ( __wpdWrapBg && __wpdWrapBg !== 'none' && __wpdWrapBg.indexOf( 'url("")' ) === -1 ) {
914 - __wpdHarvest[ __wpdKey ] = __wpdWrapBg;
915 - }
916 - } catch ( __wpdE2 ) { /* getComputedStyle may throw on detached nodes */ }
917 - }
918 -
919 - var __wpdItems = __DESKTOP_MODE_MENU_PAYLOAD__.dockItems;
920 - for ( var __wpdDi = 0; __wpdDi < __wpdItems.length; __wpdDi++ ) {
921 - var __wpdItem = __wpdItems[ __wpdDi ];
922 - if ( ! __wpdItem || __wpdItem.icon !== 'dashicons-admin-generic' ) { continue; }
923 - if ( typeof __wpdItem.url !== 'string' || ! __wpdItem.url ) { continue; }
924 - try {
925 - var __wpdItemU = new URL( __wpdItem.url, window.location.href );
926 - var __wpdItemKey = ( __wpdItemU.pathname.split( '/' ).pop() || '' ) + __wpdItemU.search;
927 - if ( __wpdHarvest[ __wpdItemKey ] ) {
928 - __wpdItem.icon = __wpdHarvest[ __wpdItemKey ];
929 - }
930 - } catch ( __wpdE3 ) { /* malformed url — leave icon alone */ }
931 - }
932 - }
933 - }
934 - } catch ( __wpdHarvestErr ) {
935 - /* Harvest is best-effort; on any failure we still ship the
936 - * server-built payload, which is exactly the pre-fix behavior. */
937 - }
938 - try {
939 - if ( __DESKTOP_MODE_MENU_PAYLOAD__ ) {
940 - window.parent.postMessage(
941 - {
942 - type: 'desktop-mode-plugins-changed',
943 - payload: __DESKTOP_MODE_MENU_PAYLOAD__
944 - },
945 - window.location.origin
946 - );
947 - }
948 - } catch ( err ) {
949 - /* postMessage throws only on structured-clone failures, which
950 - * this static payload won't hit. Swallow defensively so a
951 - * wayward extension wrapping window.parent can't break the
952 - * rest of the bridge. */
953 - }
954 -
955 - /*
956 - * Link & form interceptor.
482 + /**
483 + * Filters the declarative soft-reload rules injected into every
484 + * chromeless iframe.
957 485 *
958 - * Every same-origin wp-admin <a> href and <form> action gets the
959 - * `desktop_mode_chromeless=1` flag appended so navigation inside the iframe stays
960 - * chromeless. Without this, a stray link to /wp-admin/edit.php (see
961 - * Gutenberg's fullscreen close button, help-tab links, "Return to
962 - * posts" affordances, etc.) re-renders the full classic admin inside
963 - * our window.
486 + * Lets a plugin whose list screen lives on a custom admin URL
487 + * participate in cross-window refresh: pair a rule here with
488 + * `openstation_content_changes_record()` calls (or your own
489 + * `os.<type>.changed` broadcasts) on the publish side.
964 490 *
965 - * Excluded from rewriting:
966 - * - modifier clicks (cmd/ctrl/shift/alt) — user wants to open a
967 - * new tab/window, respect that
968 - * - target="_blank" / target="_top" / target="_parent"
969 - * - download attribute
970 - * - in-page anchors (#)
971 - * - mailto:, tel:, javascript: schemes
972 - * - cross-origin URLs
973 - * - URLs that already carry desktop_mode_chromeless=
491 + * @param array $soft_reload_rules Rule arrays with keys `topic`,
492 + * `path`, `query`, `queryAbsent`.
974 493 */
975 - function rewriteAdminUrl( href, base ) {
976 - if ( ! href || href.charAt( 0 ) === '#' ) {
977 - return null;
978 - }
979 - if ( /^(mailto:|tel:|javascript:|data:)/i.test( href ) ) {
980 - return null;
981 - }
982 - var url;
983 - try {
984 - url = new URL( href, base );
985 - } catch ( err ) {
986 - return null;
987 - }
988 - if ( url.origin !== window.location.origin ) {
989 - return null;
990 - }
991 - if ( url.pathname.indexOf( '/wp-admin/' ) === -1 ) {
992 - return null;
993 - }
994 - if ( url.searchParams.has( 'desktop_mode_chromeless' ) ) {
995 - return null;
996 - }
997 - url.searchParams.set( 'desktop_mode_chromeless', '1' );
998 - return url.toString();
494 + $soft_reload_rules = (array) apply_filters( 'openstation_soft_reload_rules', $soft_reload_rules );
495 + $soft_reload_json = wp_json_encode( array_values( $soft_reload_rules ) );
496 + if ( ! $soft_reload_json ) {
497 + $soft_reload_json = '[]';
999 498 }
1000 499
1001 - /*
1002 - * Classify a link so we know whether to rewrite it (admin),
1003 - * escalate it to the parent shell (external / non-admin), or let
1004 - * the browser navigate naturally (mailto, anchor, download, etc.).
1005 - *
1006 - * 'admin' — same-origin /wp-admin/ URL we rewrite in place.
1007 - * 'external' — http(s) URL we want the parent shell to open
1008 - * as a sub-tab instead of navigating the iframe
1009 - * out of wp-admin. Covers both cross-origin
1010 - * links (plugin author sites, external docs) AND
1011 - * same-origin non-admin links (the site's own
1012 - * front-end pages).
1013 - * 'passthrough' — anything else (mailto, tel, javascript, data,
1014 - * anchors, unparseable). The browser handles it.
1015 - */
1016 - function classifyLink( href, base ) {
1017 - if ( ! href || href.charAt( 0 ) === '#' ) {
1018 - return 'passthrough';
1019 - }
1020 - if ( /^(mailto:|tel:|javascript:|data:)/i.test( href ) ) {
1021 - return 'passthrough';
1022 - }
1023 - var url;
1024 - try {
1025 - url = new URL( href, base );
1026 - } catch ( err ) {
1027 - return 'passthrough';
1028 - }
1029 - if ( url.protocol !== 'http:' && url.protocol !== 'https:' ) {
1030 - return 'passthrough';
1031 - }
1032 - if (
1033 - url.origin === window.location.origin &&
1034 - url.pathname.indexOf( '/wp-admin/' ) !== -1
1035 - ) {
1036 - return 'admin';
1037 - }
1038 - return 'external';
1039 - }
500 + // Per-request data for the bridge bundle.
501 + //
502 + // This used to be a `str_replace()` pass over a nowdoc holding the
503 + // whole bridge, printed inline — roughly 125 KB of unminified
504 + // JavaScript in the HTML of every window, comments included. The
505 + // document is the one asset no cache can help with, so that cost
506 + // was paid in full on every window open. The code now lives in
507 + // `src/chromeless-bridge.js` and builds to a bundle that is
508 + // fetched once and served from cache (browser, and the shared
509 + // service-worker cache) for every later window; only these four
510 + // values still have to vary per request.
511 + //
512 + // `wp_json_encode` already guarantees safe JSON output, so the
513 + // values are interpolated as-is — the same guarantee the
514 + // `str_replace` pass relied on. Keys are underscore-prefixed to
515 + // mark them as a private contract with the bundle rather than a
516 + // public API; `src/chromeless-bridge.js` reads exactly these four.
517 + $data = sprintf(
518 + 'window.__osChromelessData = { _menuPayload: %s, _menuSig: %s, _identity: %s, _softReload: %s };',
519 + $menu_payload_json,
520 + $menu_sig_json,
521 + $content_identity_json,
522 + $soft_reload_json
523 + );
1040 524
1041 - document.addEventListener( 'click', function ( e ) {
1042 - if ( e.defaultPrevented ) {
1043 - return;
1044 - }
1045 - if ( e.button !== 0 || e.metaKey || e.ctrlKey || e.shiftKey || e.altKey ) {
1046 - return;
1047 - }
1048 - var link = e.target && e.target.closest ? e.target.closest( 'a[href]' ) : null;
1049 - if ( ! link ) {
1050 - return;
1051 - }
1052 - if ( link.target && link.target !== '' && link.target !== '_self' ) {
1053 - return;
1054 - }
1055 - if ( link.hasAttribute( 'download' ) ) {
1056 - return;
1057 - }
1058 - /*
1059 - * Activity-footprint launcher. A "View activity footprint" row
1060 - * action (added to the Users list table by
1061 - * `desktop_mode_user_footprint_row_action`) carries the target
1062 - * user id in `data-desktop-mode-footprint`. The iframe has no
1063 - * shell API of its own, so we escalate the click to the parent
1064 - * shell, which opens the My WordPress window on that user's
1065 - * footprint. Checked BEFORE classifyLink so the link's real
1066 - * href — a graceful profile-edit fallback for no-JS — is never
1067 - * followed inside the shell. Modifier-key / middle clicks are
1068 - * already filtered above, so cmd/ctrl-click still opens that
1069 - * fallback in a new browser tab.
1070 - */
1071 - var footprintAttr = link.getAttribute( 'data-desktop-mode-footprint' );
1072 - if ( footprintAttr ) {
1073 - var footprintUid = parseInt( footprintAttr, 10 );
1074 - if ( footprintUid > 0 ) {
1075 - e.preventDefault();
1076 - try {
1077 - window.parent.postMessage(
1078 - {
1079 - type: 'desktop-mode-open-user-footprint',
1080 - userId: footprintUid,
1081 - userName: link.getAttribute( 'data-desktop-mode-footprint-name' ) || ''
1082 - },
1083 - window.location.origin
1084 - );
1085 - } catch ( footprintErr ) {
1086 - /* Same-origin postMessage can only fail in a sandbox
1087 - * we don't support — swallow rather than block the
1088 - * click. */
1089 - }
1090 - return;
1091 - }
1092 - }
1093 - /*
1094 - * WordPress core's wp-admin/js/updates.js owns the click on these
1095 - * AJAX-driven plugin/theme management buttons — it binds in bubble
1096 - * phase and calls preventDefault to take over with an in-place
1097 - * AJAX install / update / delete (with its own progress spinner
1098 - * and inline success/failure UX). Our capture-phase handler would
1099 - * preempt it: preventDefault here fires BEFORE updates.js's own,
1100 - * the AJAX call never starts, and the postMessage below diverts
1101 - * the user to the link's no-JS fallback URL (update.php?action=
1102 - * install-plugin&...) opened as a freshly spawned desktop window.
1103 - * That fallback technically completes the install server-side,
1104 - * but it's a long blocking page-load with no in-place feedback —
1105 - * which is what users perceive as "Install Now keeps loading and
1106 - * opens a new tab". Skip these classes so updates.js's bubble
1107 - * handler runs as core intended.
1108 - */
1109 - if (
1110 - link.classList.contains( 'install-now' ) ||
1111 - link.classList.contains( 'update-link' ) ||
1112 - link.classList.contains( 'update-now' ) ||
1113 - link.classList.contains( 'delete-plugin' ) ||
1114 - link.classList.contains( 'delete-theme' ) ||
1115 - link.classList.contains( 'install-theme' )
1116 - ) {
1117 - return;
1118 - }
1119 - var href = link.getAttribute( 'href' );
1120 - var kind = classifyLink( href, window.location.href );
1121 - if ( kind === 'admin' ) {
1122 - var rewritten = rewriteAdminUrl( href, window.location.href );
1123 - if ( rewritten ) {
1124 - link.setAttribute( 'href', rewritten );
1125 - }
1126 - /*
1127 - * Hand admin-internal navigation to the parent shell.
1128 - *
1129 - * The parent decides what to do with each click:
1130 - *
1131 - * - Native-window remap hits (e.g. `edit.php` while the
1132 - * user has the native Posts opt-in on) → parent opens
1133 - * the native window and closes THIS iframe.
1134 - * - Same-page nav (pagination, filtering on the same
1135 - * `edit.php?post_type=page` screen, etc.) → parent
1136 - * drives the iframe's `location.assign()` so the
1137 - * in-place navigation matches the user's intent.
1138 - * - Cross-page nav (e.g. clicking "Posts" from inside
1139 - * the Pages window) → parent opens a new window for
1140 - * the destination and leaves THIS iframe untouched,
1141 - * so the user keeps both contexts.
1142 - *
1143 - * We `preventDefault()` so the iframe never starts a
1144 - * navigation the parent might want to suppress; otherwise
1145 - * cross-page clicks would trash the source window before
1146 - * the parent had a chance to react. Modifier-key clicks
1147 - * (cmd/ctrl/shift/alt, middle-click) are already filtered
1148 - * upstream so the browser's native "open in new tab" path
1149 - * still works.
1150 - */
1151 - e.preventDefault();
1152 - try {
1153 - var absolute = new URL( rewritten || href, window.location.href ).toString();
1154 - /*
1155 - * Ship the link's visible text along with the URL so
1156 - * the parent can title a freshly-opened window with
1157 - * something the user recognises ("Scheduler") instead
1158 - * of the URL slug ("tools-php-page-scheduler") when
1159 - * the destination has no dock tile to copy a title
1160 - * from. The iframe itself never auto-emits a
1161 - * title-change, so without this hint the slug-as-
1162 - * title fallback would persist for the lifetime of
1163 - * the new window.
1164 - */
1165 - var adminLabel = ( link.textContent || '' ).trim() ||
1166 - link.getAttribute( 'title' ) ||
1167 - link.getAttribute( 'aria-label' ) ||
1168 - '';
1169 - window.parent.postMessage(
1170 - {
1171 - type: 'desktop-mode-iframe-admin-link',
1172 - url: absolute,
1173 - label: adminLabel.slice( 0, 80 )
1174 - },
1175 - window.location.origin
1176 - );
1177 - } catch ( bridgeErr ) {
1178 - /* Same-origin postMessage to the same window can only fail in
1179 - * a sandbox we don't support — swallow rather than block the
1180 - * click. */
1181 - }
1182 - return;
1183 - }
1184 - if ( kind === 'external' ) {
1185 - /*
1186 - * External navigation inside an admin iframe would leave
1187 - * the user stranded in a chrome-free version of whatever
1188 - * site the link points at. Escalate to the parent shell
1189 - * so it opens the URL as a closeable sub-tab (with a
1190 - * detach button) alongside the admin tab — the user
1191 - * stays inside the desktop shell.
1192 - *
1193 - * Resolving the href against the document base gives the
1194 - * parent an absolute URL it doesn't have to re-resolve.
1195 - */
1196 - e.preventDefault();
1197 - var absolute;
1198 - try {
1199 - absolute = new URL( href, window.location.href ).toString();
1200 - } catch ( err ) {
1201 - return;
1202 - }
1203 - var label = ( link.textContent || '' ).trim() ||
1204 - link.getAttribute( 'title' ) ||
1205 - absolute;
1206 - window.parent.postMessage(
1207 - {
1208 - type: 'desktop-mode-external-link',
1209 - url: absolute,
1210 - label: label.slice( 0, 80 )
1211 - },
1212 - window.location.origin
1213 - );
1214 - }
1215 - }, true );
1216 -
1217 - document.addEventListener( 'submit', function ( e ) {
1218 - var form = e.target;
1219 - if ( ! form || form.tagName !== 'FORM' ) {
1220 - return;
1221 - }
1222 - var action = form.getAttribute( 'action' );
1223 - var rewritten = rewriteAdminUrl( action || window.location.href, window.location.href );
1224 - if ( rewritten ) {
1225 - form.setAttribute( 'action', rewritten );
1226 - }
1227 - }, true );
1228 -
1229 - /*
1230 - * Focus-request bridge.
1231 - *
1232 - * Clicks inside an iframe don't cross the browsing-context
1233 - * boundary — the parent shell's pointerdown / focusin listeners
1234 - * never see them, so without this hook the only way to focus an
1235 - * iframe window would be clicking its title bar chrome. Post a
1236 - * `desktop-mode-focus-request` message on every pointerdown; the
1237 - * parent Window class treats it as an onFocusRequest. Capture
1238 - * phase so the signal fires before any stopPropagation inside
1239 - * a page's own handlers.
1240 - */
1241 - document.addEventListener( 'pointerdown', function () {
1242 - try {
1243 - window.parent.postMessage(
1244 - { type: 'desktop-mode-focus-request' },
1245 - window.location.origin
1246 - );
1247 - } catch ( err ) {
1248 - /* cross-origin parent (shouldn't happen for chromeless
1249 - * pages, but don't let a throw break the bridge) */
1250 - }
1251 - }, true );
1252 -
1253 - /*
1254 - * OS-file drop forwarder. When the user drags a file from the
1255 - * host OS into a chromeless admin iframe, intercept the drop
1256 - * before the browser's default "navigate the iframe to the
1257 - * file" handler fires, and `postMessage` the raw `File[]` up
1258 - * to the parent shell so the OS-file drop manager
1259 - * (`src/os-file-drop/manager.ts`) can show the upload dialog.
1260 - *
1261 - * Same-origin postMessage preserves `File` identity — the
1262 - * parent receives real `File` objects, no base64 round-trip.
1263 - *
1264 - * We only intercept drops whose `DataTransfer.types` includes
1265 - * `'Files'`. In-page DnD (Gutenberg block reorders, media
1266 - * library drags) carries non-`Files` types and passes through
1267 - * untouched.
1268 - */
1269 - function bridgeHasFiles( ev ) {
1270 - var t = ev && ev.dataTransfer && ev.dataTransfer.types;
1271 - if ( ! t ) {
1272 - return false;
1273 - }
1274 - if ( typeof t.includes === 'function' ) {
1275 - return t.includes( 'Files' );
1276 - }
1277 - if ( typeof t.contains === 'function' ) {
1278 - return t.contains( 'Files' );
1279 - }
1280 - for ( var i = 0; i < t.length; i++ ) {
1281 - if ( t[ i ] === 'Files' ) {
1282 - return true;
1283 - }
1284 - }
1285 - return false;
525 + // `in_footer` + a `before` inline block reproduces exactly what the
526 + // old inline print did: the data is defined, then the bridge runs,
527 + // both at the same point in the document. No `defer` / `async` —
528 + // the bridge expects to execute synchronously here, and deferring
529 + // it would move it after the page's own footer scripts.
530 + // Defensive re-registration. `WP_Dependencies::enqueue()` silently
531 + // no-ops on a handle that isn't registered, and plugins that
532 + // rebuild `WP_Scripts` wholesale are a real, documented shape —
533 + // see `includes/render/asset-guard.php` for the same class of
534 + // conflict. The bridge is the one script a window genuinely cannot
535 + // do without: losing it costs the window its title, its links, its
536 + // activity ring and its refresh signalling. `wp_register_script()`
537 + // no-ops when the handle is already there, so this costs nothing
538 + // on the normal path.
539 + if ( ! wp_script_is( 'os-chromeless-bridge', 'registered' ) ) {
540 + openstation_register_assets();
1286 541 }
1287 - /*
1288 - * Selectors of in-iframe drop receivers we leave alone —
1289 - * Gutenberg's drop zone, the legacy media uploader, any
1290 - * element a plugin marks with `data-drop-zone`. The whole
1291 - * point: file drops onto Gutenberg blocks keep firing
1292 - * Gutenberg's handler; only drops on the empty page
1293 - * background escalate to the shell.
1294 - */
1295 - var bridgeDropPassthroughSelectors = [
1296 - '.components-drop-zone',
1297 - '[data-drop-zone]',
1298 - '.uploader-window',
1299 - '.media-frame-content'
1300 - ];
1301 - function bridgeDropTargetWantsFile( target ) {
1302 - if ( ! target || ! target.closest ) {
1303 - return false;
1304 - }
1305 - for ( var s = 0; s < bridgeDropPassthroughSelectors.length; s++ ) {
1306 - if ( target.closest( bridgeDropPassthroughSelectors[ s ] ) ) {
1307 - return true;
1308 - }
1309 - }
1310 - return false;
1311 - }
1312 - /*
1313 - * Bubble phase (not capture): the inner-most handler — Gutenberg's
1314 - * drop zone, the legacy media uploader, or a third-party plugin
1315 - * like "Administrador de archivos WP" — runs FIRST and gets the
1316 - * chance to call `preventDefault()` to claim the drop. Our
1317 - * forwarder then runs LAST at the document level and yields to
1318 - * anyone who already took ownership.
1319 - *
1320 - * Two bail conditions, in order:
1321 - * 1. `bridgeDropTargetWantsFile()` — the curated allowlist
1322 - * (Gutenberg, wp.media, anything tagged `[data-drop-zone]`).
1323 - * Kept as the primary check so the well-known core surfaces
1324 - * behave identically to before, even if some edge case skips
1325 - * the `preventDefault()` step.
1326 - * 2. `ev.defaultPrevented` — the universal HTML5 contract: any
1327 - * drop zone willing to receive a file calls `preventDefault()`
1328 - * on `dragover` (mandatory per spec) and `drop` (to suppress
1329 - * the browser's default navigate-to-file). When that's true,
1330 - * some inner handler has taken the drop — yield so plugins
1331 - * outside the allowlist (WP File Manager, Yoast, etc.) keep
1332 - * their native UX.
1333 - */
1334 - document.addEventListener( 'dragover', function ( ev ) {
1335 - if ( ! bridgeHasFiles( ev ) ) {
1336 - return;
1337 - }
1338 - if ( bridgeDropTargetWantsFile( ev.target ) ) {
1339 - return;
1340 - }
1341 - if ( ev.defaultPrevented ) {
1342 - return;
1343 - }
1344 - ev.preventDefault();
1345 - if ( ev.dataTransfer ) {
1346 - ev.dataTransfer.dropEffect = 'copy';
1347 - }
1348 - }, false );
1349 - document.addEventListener( 'drop', function ( ev ) {
1350 - if ( ! bridgeHasFiles( ev ) ) {
1351 - return;
1352 - }
1353 - if ( bridgeDropTargetWantsFile( ev.target ) ) {
1354 - return;
1355 - }
1356 - if ( ev.defaultPrevented ) {
1357 - return;
1358 - }
1359 - ev.preventDefault();
1360 - ev.stopPropagation();
1361 - var files = [];
1362 - if ( ev.dataTransfer && ev.dataTransfer.files ) {
1363 - for ( var i = 0; i < ev.dataTransfer.files.length; i++ ) {
1364 - files.push( ev.dataTransfer.files[ i ] );
1365 - }
1366 - }
1367 - if ( files.length === 0 ) {
1368 - return;
1369 - }
1370 - try {
1371 - window.parent.postMessage(
1372 - {
1373 - type: 'desktop-mode-os-file-drop',
1374 - files: files,
1375 - x: ev.clientX,
1376 - y: ev.clientY,
1377 - },
1378 - window.location.origin
1379 - );
1380 - } catch ( err ) { /* cross-origin parent; swallow */ }
1381 - }, false );
1382 542
1383 - /*
1384 - * Cmd+K / Ctrl+K forwarder — single-press, unconditional.
1385 - *
1386 - * Native keydown events don't cross iframe boundaries. Inside a
1387 - * chromeless admin page we want exactly ONE command palette: the
1388 - * desktop shell's. WordPress's own `core/commands` palette is
1389 - * harvested by `__wpdHarvestCommands` below and re-surfaced in the
1390 - * shell palette, so there's no reason to ever let the in-page palette
1391 - * take the keystroke.
1392 - *
1393 - * Capture phase + `stopImmediatePropagation` so we win the race
1394 - * against Gutenberg / TinyMCE / plugin handlers bound to the same
1395 - * shortcut. Shift/Alt modifiers pass through so user shortcuts using
1396 - * those combos keep working.
1397 - */
1398 - document.addEventListener( 'keydown', function ( e ) {
1399 - if ( ! ( e.metaKey || e.ctrlKey ) ) return;
1400 - if ( e.key !== 'k' && e.key !== 'K' ) return;
1401 - if ( e.shiftKey || e.altKey ) return;
1402 -
1403 - e.preventDefault();
1404 - e.stopImmediatePropagation();
1405 -
1406 - try {
1407 - window.parent.postMessage(
1408 - { type: 'desktop-mode-palette-cycle' },
1409 - window.location.origin
1410 - );
1411 - } catch ( err ) { /* cross-origin parent; swallow */ }
1412 - }, true );
1413 -
1414 - /*
1415 - * Command harvester — bridges `wp.data.select('core/commands')` to
1416 - * the parent shell.
1417 - *
1418 - * On `desktop-mode-commands-subscribe` from the parent, subscribe to
1419 - * the `core/commands` store and post `desktop-mode-commands-list` on
1420 - * every change (de-duplicated). On `desktop-mode-commands-invoke`, run
1421 - * the original callback inside this iframe — the parent fires this
1422 - * when the user selects a proxied command from the shell palette.
1423 - *
1424 - * Commands are classified by dry-invoking their callback inside a
1425 - * `window.location`-intercept sandbox: pure-navigation callbacks
1426 - * are flagged `navigate` (with the captured URL) so the parent can
1427 - * open a new desktop window instead of navigating this iframe out
1428 - * of chromeless mode. Everything else is `action` and proxies back
1429 - * into this iframe on user selection.
1430 - */
1431 - var __wpdCommandsSubscribed = false;
1432 - var __wpdCommandsLastPayload = '';
1433 - var __wpdCommandsDebounceId = null;
1434 - var __wpdCommandsOrigin = window.location.origin;
1435 - // Cache per command name so the `window.location`-intercept
1436 - // sandbox only runs once per command. Re-classifying on every
1437 - // store tick would repeatedly fire side-effectful action
1438 - // callbacks (preference toggles, modal opens) — unacceptable.
1439 - // Keyed by name; value is the frozen classification minus the
1440 - // live `label` / `icon` (which we always re-read in case the
1441 - // command updated its own metadata).
1442 - var __wpdCommandsKindCache = Object.create( null );
1443 -
1444 - function __wpdRenderIconElement( icon ) {
1445 - if ( ! icon ) return '';
1446 - if ( typeof icon === 'string' ) return '';
1447 - if ( ! window.wp || ! window.wp.element || typeof window.wp.element.renderToString !== 'function' ) {
1448 - return '';
1449 - }
1450 - try {
1451 - var rendered = window.wp.element.renderToString( icon );
1452 - // `@wordpress/icons` entries render as a complete `<svg>`
1453 - // tag. Anything else (wrapped components, empty fragments,
1454 - // strings) falls back to dashicons in the palette — we only
1455 - // accept markup we can inject straight into the icon slot.
1456 - if ( typeof rendered === 'string' && rendered.toLowerCase().indexOf( '<svg' ) === 0 ) {
1457 - return rendered;
1458 - }
1459 - } catch ( _err ) { /* swallow */ }
1460 - return '';
1461 - }
1462 -
1463 - function __wpdClassifyCommand( cmd ) {
1464 - // Defensive defaults — a broken registry should not tank the bridge.
1465 - var out = {
1466 - name: String( cmd && cmd.name ? cmd.name : '' ),
1467 - label: String( cmd && cmd.label ? cmd.label : '' ),
1468 - icon: cmd && cmd.icon && typeof cmd.icon === 'string' ? cmd.icon : undefined,
1469 - iconSvg: undefined,
1470 - context: cmd && cmd.context ? String( cmd.context ) : undefined,
1471 - kind: 'action',
1472 - url: undefined
1473 - };
1474 - if ( ! cmd || typeof cmd.callback !== 'function' ) {
1475 - return out;
1476 - }
1477 -
1478 - // Short-circuit on cached classifications — `renderToString` on
1479 - // the React icon is expensive, and the static URL regex scan
1480 - // on `callback.toString()` is pure CPU we've already paid once.
1481 - var cached = __wpdCommandsKindCache[ out.name ];
1482 - if ( cached ) {
1483 - out.kind = cached.kind;
1484 - out.url = cached.url;
1485 - out.iconSvg = cached.iconSvg;
1486 - return out;
1487 - }
1488 -
1489 - // Render the React icon once per command name — Gutenberg
1490 - // commands ship `icon` as a `@wordpress/icons` React element
1491 - // the postMessage bridge can't serialize, so we flatten it to
1492 - // a static SVG string here.
1493 - if ( cmd.icon && typeof cmd.icon !== 'string' ) {
1494 - out.iconSvg = __wpdRenderIconElement( cmd.icon );
1495 - }
1496 -
1497 - // STATIC classification — read the callback's source text and
1498 - // look for a string-literal navigation target. We deliberately
1499 - // do NOT execute the callback. An earlier iteration tried a
1500 - // dry-run with a `window.location` intercept sandbox, but
1501 - // `Location.prototype.href` is non-configurable: the shim
1502 - // silently failed, every nav callback actually navigated the
1503 - // iframe, the new page re-harvested, and the cascade opened
1504 - // windows forever.
1505 - //
1506 - // Cases caught (WP's @wordpress/core-commands callbacks are
1507 - // all of this shape):
1508 - // document.location.href = 'url'
1509 - // window.location.href = "url"
1510 - // location.href = `url`
1511 - // location.assign( 'url' )
1512 - // location.replace( 'url' )
1513 - //
1514 - // Computed URLs (template-literal interpolation, addQueryArgs
1515 - // calls, variables) fall back to `action` — the user picking
1516 - // them will still run the real callback inside the iframe,
1517 - // which is the safe default.
1518 - var src = '';
1519 - try { src = Function.prototype.toString.call( cmd.callback ); } catch ( _err ) { src = ''; }
1520 - var navRe = /(?:document\.location\.href|window\.location\.href|location\.href)\s*=\s*['"]([^'"$]+?)['"]/;
1521 - var asgRe = /location\.(?:assign|replace)\s*\(\s*['"]([^'"$]+?)['"]\s*\)/;
1522 - var mm = src.match( navRe ) || src.match( asgRe );
1523 - if ( mm && mm[ 1 ] ) {
1524 - try {
1525 - out.url = new URL( mm[ 1 ], window.location.href ).toString();
1526 - out.kind = 'navigate';
1527 - } catch ( _err ) {
1528 - out.kind = 'action';
1529 - }
1530 - }
1531 - __wpdCommandsKindCache[ out.name ] = { kind: out.kind, url: out.url, iconSvg: out.iconSvg };
1532 - return out;
1533 - }
1534 -
1535 - // Harvested commands accumulate here. The React harvester writes
1536 - // the full list each render; `__wpdPostCommandsList` reads + posts.
1537 - var __wpdLastRawCommands = [];
1538 - // Name → live `callback` reference. Loader-returned commands are
1539 - // NOT in `wp.data.select('core/commands').getCommands()` — the
1540 - // store only exposes statically-registered entries. Without a
1541 - // private cache keyed off the React harvester's most recent render,
1542 - // invoking a loader command from the parent palette ("Duplicate
1543 - // block", "Transform to...", pattern commands) would silently fall
1544 - // through to the `getCommands()` lookup and no-op.
1545 - var __wpdCommandCallbacks = Object.create( null );
1546 -
1547 - function __wpdFinalizeCommands( raw ) {
1548 - var seen = Object.create( null );
1549 - var out = [];
1550 - var skipped = { missing: 0, disabled: 0, dup: 0 };
1551 - for ( var i = 0; i < raw.length; i++ ) {
1552 - var cmd = raw[ i ];
1553 - if ( ! cmd || ! cmd.name || ! cmd.label ) { skipped.missing++; continue; }
1554 - if ( cmd.disabled ) { skipped.disabled++; continue; }
1555 - if ( seen[ cmd.name ] ) { skipped.dup++; continue; }
1556 - seen[ cmd.name ] = true;
1557 - out.push( __wpdClassifyCommand( cmd ) );
1558 - }
1559 - return out;
1560 - }
1561 -
1562 - function __wpdHarvestCommands() {
1563 - return __wpdFinalizeCommands( __wpdLastRawCommands );
1564 - }
1565 -
1566 - // React-mounted harvester. Block-level / editor-contextual commands
1567 - // (tier 3 loaders like `core/block-editor/selected-block-commands`,
1568 - // `core/edit-post/pattern-commands`) are React *hooks* — they call
1569 - // `useSelect` internally, which only works inside a function-
1570 - // component render. So we mount an invisible React tree whose
1571 - // children invoke each loader's hook at render time. On every
1572 - // re-render (block selection changes, entity edits, welcome guide
1573 - // toggled) the effect re-posts the fresh command list to the
1574 - // parent. One component per loader keeps the rules-of-hooks
1575 - // contract — the hook count inside each `LoaderSlot` is fixed at
1576 - // one call (plus the constant `useEffect`), so React's reconciler
1577 - // is happy.
1578 - var __wpdReactMounted = false;
1579 - // Stashed so `__wpdUnsubscribeCommands` can tear the harvester
1580 - // down when focus leaves the window — otherwise the component
1581 - // keeps re-rendering on every store tick, calling `mergeAndPost`,
1582 - // and posting command lists the parent drops on the floor.
1583 - var __wpdReactRoot = null;
1584 - var __wpdReactHost = null;
1585 -
1586 - function __wpdMountReactHarvester() {
1587 - if ( __wpdReactMounted ) return;
1588 - if ( ! window.wp || ! window.wp.element || ! window.wp.data ) {
1589 - return;
1590 - }
1591 - var el = window.wp.element;
1592 - var createEl = el.createElement;
1593 - var useEffect = el.useEffect;
1594 - var useRef = el.useRef;
1595 - var useMemo = el.useMemo;
1596 - var useSelect = ( window.wp.data && window.wp.data.useSelect ) || null;
1597 - if ( ! createEl || ! useSelect || ! el.createRoot || ! useRef ) {
1598 - return;
1599 - }
1600 - __wpdReactMounted = true;
1601 -
1602 - // Hidden mount point. Positioned off-screen + `aria-hidden` so
1603 - // nothing the harvester renders (it renders null anyway) can
1604 - // leak into the accessibility tree or the visible document.
1605 - var host = document.createElement( 'div' );
1606 - host.setAttribute( 'aria-hidden', 'true' );
1607 - host.style.cssText = 'position:absolute;width:0;height:0;overflow:hidden;pointer-events:none;left:-9999px;top:-9999px;';
1608 - ( document.body || document.documentElement ).appendChild( host );
1609 - __wpdReactHost = host;
1610 -
1611 - // Shared mutable bucket — ref-based aggregation to avoid the
1612 - // classic setState-inside-useEffect loop. A `setState` here
1613 - // would fire a parent re-render, which would fire the loader
1614 - // hook again, which returns a fresh commands array with a new
1615 - // reference even when the contents are identical, which would
1616 - // re-fire the effect and setState again → Maximum update
1617 - // depth exceeded. Refs don't trigger renders, so the loop is
1618 - // broken even when hooks churn references.
1619 - var resultsBucket = { perLoader: {}, statics: [], loadersList: [] };
1620 -
1621 - function commandsFingerprint( cmds ) {
1622 - if ( ! Array.isArray( cmds ) || cmds.length === 0 ) return '';
1623 - // Cheap identity — name count is enough to decide whether
1624 - // to re-post. Accepts some false negatives (two different
1625 - // commands sharing a name) we'll never hit in practice.
1626 - var keys = new Array( cmds.length );
1627 - for ( var i = 0; i < cmds.length; i++ ) {
1628 - var c = cmds[ i ];
1629 - keys[ i ] = c && c.name ? c.name : '';
1630 - }
1631 - return keys.join( '|' );
1632 - }
1633 -
1634 - function mergeAndPost() {
1635 - var merged = [];
1636 - var loadersList = resultsBucket.loadersList;
1637 - if ( Array.isArray( loadersList ) ) {
1638 - for ( var i = 0; i < loadersList.length; i++ ) {
1639 - var bucket = resultsBucket.perLoader[ loadersList[ i ] ];
1640 - if ( Array.isArray( bucket ) ) merged = merged.concat( bucket );
1641 - }
1642 - }
1643 - if ( Array.isArray( resultsBucket.statics ) ) {
1644 - merged = merged.concat( resultsBucket.statics );
1645 - }
1646 - // Refresh the callback cache off the SAME snapshot we're
1647 - // about to post. Loader-returned commands close over React
1648 - // state (selected block, edited entity, etc.) that's only
1649 - // valid for this render pass, so rebuilding from scratch
1650 - // every merge keeps invoke-from-parent honest instead of
1651 - // calling a stale closure.
1652 - __wpdCommandCallbacks = Object.create( null );
1653 - for ( var j = 0; j < merged.length; j++ ) {
1654 - var cc = merged[ j ];
1655 - if ( cc && cc.name && typeof cc.callback === 'function' ) {
1656 - __wpdCommandCallbacks[ cc.name ] = cc.callback;
1657 - }
1658 - }
1659 - __wpdLastRawCommands = merged;
1660 - __wpdSchedulePost();
1661 - }
1662 -
1663 - // One slot per loader. Calls the loader's hook at render time;
1664 - // an effect keyed on the commands' name-fingerprint writes the
1665 - // fresh list into the shared bucket and posts. Ref-based, no
1666 - // setState → no re-render cascade.
1667 - function LoaderSlot( props ) {
1668 - var loader = props.loader;
1669 - var result = null;
1670 - try {
1671 - result = loader.hook( { search: '' } );
1672 - } catch ( _err ) {
1673 - /* swallow — a buggy loader hook shouldn't take the harvester down */
1674 - }
1675 - var cmds = ( result && Array.isArray( result.commands ) ) ? result.commands : [];
1676 - var key = useMemo( function () { return commandsFingerprint( cmds ); }, [ cmds ] );
1677 -
1678 - useEffect( function () {
1679 - resultsBucket.perLoader[ loader.name ] = cmds;
1680 - mergeAndPost();
1681 - }, [ key ] );
1682 -
1683 - useEffect( function () {
1684 - return function () {
1685 - delete resultsBucket.perLoader[ loader.name ];
1686 - mergeAndPost();
1687 - };
1688 - }, [] );
1689 -
1690 - return null;
1691 - }
1692 -
1693 - function Harvester() {
1694 - var loaders = useSelect( function ( s ) {
1695 - var ss = s( 'core/commands' );
1696 - return ( ss && typeof ss.getCommandLoaders === 'function' )
1697 - ? ss.getCommandLoaders( true )
1698 - : [];
1699 - }, [] );
1700 - var staticCmds = useSelect( function ( s ) {
1701 - var ss = s( 'core/commands' );
1702 - return ( ss && typeof ss.getCommands === 'function' )
1703 - ? ss.getCommands( true )
1704 - : [];
1705 - }, [] );
1706 -
1707 - // Track the loader-name ordering so `mergeAndPost` can emit
1708 - // tier-3 in a deterministic order (React reconciliation
1709 - // order = registration order = the order the user sees).
1710 - var loadersNames = useMemo( function () {
1711 - if ( ! Array.isArray( loaders ) ) return [];
1712 - return loaders.map( function ( l ) { return l ? l.name : ''; } );
1713 - }, [ loaders ] );
1714 - var loadersKey = loadersNames.join( '|' );
1715 - useEffect( function () {
1716 - resultsBucket.loadersList = loadersNames;
1717 - mergeAndPost();
1718 - }, [ loadersKey ] );
1719 -
1720 - var staticKey = useMemo( function () { return commandsFingerprint( staticCmds ); }, [ staticCmds ] );
1721 - useEffect( function () {
1722 - resultsBucket.statics = Array.isArray( staticCmds ) ? staticCmds : [];
1723 - mergeAndPost();
1724 - }, [ staticKey ] );
1725 -
1726 - if ( ! Array.isArray( loaders ) || loaders.length === 0 ) {
1727 - return null;
1728 - }
1729 - var children = [];
1730 - for ( var i = 0; i < loaders.length; i++ ) {
1731 - var loader = loaders[ i ];
1732 - if ( ! loader || typeof loader.hook !== 'function' ) continue;
1733 - children.push( createEl( LoaderSlot, {
1734 - key: loader.name,
1735 - loader: loader
1736 - } ) );
1737 - }
1738 - return createEl( el.Fragment || 'div', null, children );
1739 - }
1740 -
1741 - try {
1742 - var root = el.createRoot( host );
1743 - __wpdReactRoot = root;
1744 - root.render( createEl( Harvester ) );
1745 - } catch ( err ) {
1746 - __wpdReactMounted = false;
1747 - __wpdReactRoot = null;
1748 - if ( __wpdReactHost && __wpdReactHost.parentNode ) {
1749 - __wpdReactHost.parentNode.removeChild( __wpdReactHost );
1750 - }
1751 - __wpdReactHost = null;
1752 - }
1753 - }
1754 -
1755 - function __wpdUnmountReactHarvester() {
1756 - if ( __wpdReactRoot ) {
1757 - try { __wpdReactRoot.unmount(); } catch ( _err ) { /* swallow */ }
1758 - }
1759 - __wpdReactRoot = null;
1760 - if ( __wpdReactHost && __wpdReactHost.parentNode ) {
1761 - __wpdReactHost.parentNode.removeChild( __wpdReactHost );
1762 - }
1763 - __wpdReactHost = null;
1764 - __wpdReactMounted = false;
1765 - __wpdLastRawCommands = [];
1766 - __wpdCommandCallbacks = Object.create( null );
1767 - }
1768 -
1769 - function __wpdPostCommandsList() {
1770 - var list = __wpdHarvestCommands();
1771 - // Cheap de-dupe — the store fires on every unrelated preference
1772 - // change too, and shipping an identical payload is pure noise.
1773 - // Fingerprint on `name|kind|url` keeps us sensitive to the
1774 - // visible surface (name changes, navigate-vs-action flips,
1775 - // destination URL changes) while skipping `JSON.stringify` of
1776 - // the entire payload — label/icon churn inside a single command
1777 - // is rare and re-shipping on it is harmless noise vs. a hot
1778 - // path allocation cost.
1779 - var key = '';
1780 - for ( var k = 0; k < list.length; k++ ) {
1781 - var lc = list[ k ];
1782 - key += ( lc && lc.name ? lc.name : '' ) + '|'
1783 - + ( lc && lc.kind ? lc.kind : '' ) + '|'
1784 - + ( lc && lc.url ? lc.url : '' ) + '\n';
1785 - }
1786 - if ( key === __wpdCommandsLastPayload ) {
1787 - return;
1788 - }
1789 - __wpdCommandsLastPayload = key;
1790 - try {
1791 - window.parent.postMessage(
1792 - { type: 'desktop-mode-commands-list', commands: list },
1793 - __wpdCommandsOrigin
1794 - );
1795 - } catch ( _err ) {
1796 - /* cross-origin parent (shouldn't happen for chromeless pages, but
1797 - * don't let a throw break the bridge) */
1798 - }
1799 - }
1800 -
1801 - function __wpdSchedulePost() {
1802 - if ( __wpdCommandsDebounceId !== null ) return;
1803 - __wpdCommandsDebounceId = window.setTimeout( function () {
1804 - __wpdCommandsDebounceId = null;
1805 - __wpdPostCommandsList();
1806 - }, 60 );
1807 - }
1808 -
1809 - function __wpdSubscribeCommands() {
1810 - __wpdCommandsSubscribed = true;
1811 -
1812 - // If the React harvester is already running (focus left and
1813 - // came back), the bucket still holds the latest merged list.
1814 - // Reset the dedupe key so the next post actually ships, then
1815 - // schedule it. The harvester itself won't re-fire its effects
1816 - // just because the parent re-subscribed — React only reacts to
1817 - // store changes, and the store hasn't changed. We have to
1818 - // push from here.
1819 - if ( __wpdReactMounted ) {
1820 - __wpdCommandsLastPayload = '';
1821 - __wpdSchedulePost();
1822 - return;
1823 - }
1824 -
1825 - var attempts = 0;
1826 - function tryBind() {
1827 - if ( ! __wpdCommandsSubscribed ) return;
1828 - if ( ! window.wp || ! window.wp.data || typeof window.wp.data.subscribe !== 'function' ) {
1829 - if ( attempts++ < 40 ) {
1830 - window.setTimeout( tryBind, 150 );
1831 - }
1832 - return;
1833 - }
1834 - // Mount the React harvester — tier 3 loaders are hooks and
1835 - // need a legal render context to execute. On every re-render
1836 - // the component's effect calls `__wpdSchedulePost` with the
1837 - // fresh merged list, so we don't need a separate
1838 - // `wp.data.subscribe` callback.
1839 - __wpdMountReactHarvester();
1840 - }
1841 - tryBind();
1842 - }
1843 -
1844 - function __wpdUnsubscribeCommands() {
1845 - __wpdCommandsSubscribed = false;
1846 - __wpdCommandsLastPayload = '';
1847 - if ( __wpdCommandsDebounceId !== null ) {
1848 - try { window.clearTimeout( __wpdCommandsDebounceId ); } catch ( _err ) { /* swallow */ }
1849 - __wpdCommandsDebounceId = null;
1850 - }
1851 - // Fully tear down the React harvester. Keeping it mounted in
1852 - // the background wastes CPU: every store tick re-renders the
1853 - // loader hooks, which rebuild the callback cache and post to
1854 - // the parent (who drops the message because this window isn't
1855 - // the subscribed one). On re-subscribe we remount from scratch.
1856 - __wpdUnmountReactHarvester();
1857 - }
1858 -
1859 - function __wpdInvokeCommand( name ) {
1860 - // Primary lookup — the React harvester's latest snapshot. This
1861 - // covers loader-returned commands (Duplicate block, Transform
1862 - // to, pattern commands) that never appear in the static
1863 - // `getCommands()` list.
1864 - var cb = __wpdCommandCallbacks[ name ];
1865 - if ( typeof cb === 'function' ) {
1866 - try {
1867 - cb( { close: function () {} } );
1868 - } catch ( _err ) {
1869 - /* swallow — a plugin command callback that throws shouldn't break the bridge */
1870 - }
1871 - return;
1872 - }
1873 - // Fallback — statically registered commands that never passed
1874 - // through the harvester (registered after the last render).
1875 - if ( ! window.wp || ! window.wp.data ) {
1876 - return;
1877 - }
1878 - var sel = null;
1879 - try { sel = window.wp.data.select( 'core/commands' ); } catch ( _err ) { return; }
1880 - if ( ! sel || typeof sel.getCommands !== 'function' ) return;
1881 - var raw;
1882 - try { raw = sel.getCommands(); } catch ( _err ) { return; }
1883 - if ( ! raw ) return;
1884 - for ( var i = 0; i < raw.length; i++ ) {
1885 - if ( raw[ i ] && raw[ i ].name === name && typeof raw[ i ].callback === 'function' ) {
1886 - try {
1887 - raw[ i ].callback( { close: function () {} } );
1888 - } catch ( _err ) {
1889 - /* swallow — see note in primary path above */
1890 - }
1891 - return;
1892 - }
1893 - }
1894 - }
1895 -
1896 - // Attach the listener BEFORE the bridge-ready ping so a subscribe
1897 - // posted synchronously in response is guaranteed to land.
1898 - window.addEventListener( 'message', function ( e ) {
1899 - if ( e.origin !== __wpdCommandsOrigin ) return;
1900 - if ( ! e.data || typeof e.data.type !== 'string' ) return;
1901 - if ( e.data.type === 'desktop-mode-commands-subscribe' ) {
1902 - __wpdSubscribeCommands();
1903 - } else if ( e.data.type === 'desktop-mode-commands-unsubscribe' ) {
1904 - __wpdUnsubscribeCommands();
1905 - } else if ( e.data.type === 'desktop-mode-commands-invoke' && typeof e.data.name === 'string' ) {
1906 - __wpdInvokeCommand( e.data.name );
1907 - }
1908 - } );
1909 -
1910 - // Handshake: tell the parent we're ready so it can (re)send any
1911 - // subscribe that was dispatched before this listener attached.
1912 - // Without this ping, a subscribe posted during iframe navigation
1913 - // arrives at a context whose message listener isn't installed yet
1914 - // and is silently dropped — the symptom is an empty palette even
1915 - // though `wp.data.select('core/commands')` is perfectly happy.
1916 - try {
1917 - window.parent.postMessage(
1918 - { type: 'desktop-mode-bridge-ready' },
1919 - __wpdCommandsOrigin
1920 - );
1921 - } catch ( _err ) {
1922 - /* parent gone or cross-origin — bridge handshake will retry on next load */
1923 - }
1924 -
1925 - /*
1926 - * ` / Shift+` forwarder — window switcher.
1927 - *
1928 - * Bare backtick with no modifier. Must skip when focus is in a
1929 - * text-entry element, otherwise typing ` into a block, a text
1930 - * field, or TinyMCE would steal the keystroke. Non-text inputs
1931 - * (checkbox, button, select) don't accept character input, so
1932 - * cycling on those is fine.
1933 - *
1934 - * Same iframe-crossing rationale as the Cmd+K forwarder above:
1935 - * native keydown doesn't reach the parent, so we postMessage.
1936 - */
1937 - document.addEventListener( 'keydown', function ( e ) {
1938 - if ( e.ctrlKey || e.metaKey || e.altKey ) return;
1939 - if ( e.code !== 'Backquote' ) return;
1940 -
1941 - // IFRAME case catches Gutenberg: the block canvas is a nested
1942 - // iframe, and Gutenberg re-dispatches cloned keydowns up to
1943 - // this document for its shortcut system. Without this branch
1944 - // typing ` in a block would cycle windows. Any other nested
1945 - // iframe owning keyboard handling gets the same treatment.
1946 - var el = document.activeElement;
1947 - if ( el ) {
1948 - var tag = el.tagName;
1949 - if ( tag === 'IFRAME' ) return;
1950 - if ( tag === 'TEXTAREA' ) return;
1951 - if ( tag === 'INPUT' ) {
1952 - var type = ( el.type || '' ).toLowerCase();
1953 - var textTypes = [
1954 - 'text', 'search', 'url', 'email', 'password',
1955 - 'tel', 'number', 'date', 'datetime-local',
1956 - 'month', 'week', 'time'
1957 - ];
1958 - if ( textTypes.indexOf( type ) !== -1 ) return;
1959 - }
1960 - if ( el.isContentEditable ) return;
1961 - }
1962 -
1963 - e.preventDefault();
1964 - e.stopImmediatePropagation();
1965 -
1966 - try {
1967 - window.parent.postMessage(
1968 - {
1969 - type: 'desktop-mode-window-switch',
1970 - direction: e.shiftKey ? 'prev' : 'next'
1971 - },
1972 - window.location.origin
1973 - );
1974 - } catch ( err ) { /* cross-origin parent; swallow */ }
1975 - }, true );
1976 -
1977 - // Skip if the standalone iframe-bridge bundle already wired
1978 - // screen-meta hoisting on this page. Two bridges racing to read
1979 - // `aria-expanded` and reflect state would double-fire the
1980 - // `desktop-mode-screen-meta-state` message and flicker the
1981 - // title-bar buttons.
1982 - if ( window.__desktopModeScreenMetaInstalled ) {
1983 - return;
1984 - }
1985 - window.__desktopModeScreenMetaInstalled = true;
1986 -
1987 - // Real screen options render form controls (column toggles, a
1988 - // per-page input, custom settings). An empty wrap should not
1989 - // surface a dead gear button.
1990 - function hasScreenOptionsContent() {
1991 - var wrap = document.getElementById( 'screen-options-wrap' );
1992 - // WP always renders a nonce hidden input and an "Apply" submit
1993 - // inside the wrap, so match only interactive option controls
1994 - // (toggles, per-page, radios, selects) — never that always-
1995 - // present scaffolding — or an empty panel reads as non-empty.
1996 - return !! wrap && !! wrap.querySelector( 'input:not([type="hidden"]):not([type="submit"]):not([type="button"]):not([type="reset"]), select, textarea' );
1997 - }
1998 - // A help tab registered with empty content + no callback still
1999 - // produces #contextual-help-link but an empty panel. Require some
2000 - // non-whitespace tab/sidebar text before announcing the button.
2001 - function hasHelpContent() {
2002 - var wrap = document.getElementById( 'contextual-help-wrap' );
2003 - if ( ! wrap ) {
2004 - return false;
2005 - }
2006 - var panelEls = wrap.querySelectorAll( '.help-tab-content, .contextual-help-sidebar' );
2007 - for ( var i = 0; i < panelEls.length; i++ ) {
2008 - if ( ( panelEls[ i ].textContent || '' ).trim() !== '' ) {
2009 - return true;
2010 - }
2011 - }
2012 - return false;
2013 - }
2014 -
2015 - var links = document.getElementById( 'screen-meta-links' );
2016 - var screenOptionsBtn = links ? document.getElementById( 'show-settings-link' ) : null;
2017 - var helpBtn = links ? document.getElementById( 'contextual-help-link' ) : null;
2018 - var panels = [];
2019 - if ( screenOptionsBtn && hasScreenOptionsContent() ) {
2020 - panels.push( 'screen-options' );
2021 - }
2022 - if ( helpBtn && hasHelpContent() ) {
2023 - panels.push( 'help' );
2024 - }
2025 -
2026 - var origin = window.location.origin;
2027 -
2028 - // ALWAYS announce — including an empty array — so the parent removes
2029 - // stale gear/Help buttons when this page (e.g. after an in-place
2030 - // same-slug navigation) has no screen meta. addScreenMetaButtons()
2031 - // clears then repopulates, so an empty array removes everything.
2032 - window.parent.postMessage( {
2033 - type: 'desktop-mode-screen-meta',
2034 - panels: panels
2035 - }, origin );
2036 -
2037 - if ( panels.length === 0 ) {
2038 - return;
2039 - }
2040 -
2041 - function getOpenPanel() {
2042 - if ( screenOptionsBtn && screenOptionsBtn.getAttribute( 'aria-expanded' ) === 'true' ) {
2043 - return 'screen-options';
2044 - }
2045 - if ( helpBtn && helpBtn.getAttribute( 'aria-expanded' ) === 'true' ) {
2046 - return 'help';
2047 - }
2048 - return null;
2049 - }
2050 -
2051 - function reportState() {
2052 - window.parent.postMessage( {
2053 - type: 'desktop-mode-screen-meta-state',
2054 - open: getOpenPanel()
2055 - }, origin );
2056 - }
2057 -
2058 - reportState();
2059 -
2060 - var observer = new MutationObserver( reportState );
2061 - if ( screenOptionsBtn ) {
2062 - observer.observe( screenOptionsBtn, { attributes: true, attributeFilter: [ 'aria-expanded' ] } );
2063 - }
2064 - if ( helpBtn ) {
2065 - observer.observe( helpBtn, { attributes: true, attributeFilter: [ 'aria-expanded' ] } );
2066 - }
2067 -
2068 - // WP's close() animates and shares #screen-meta between both panels,
2069 - // so racing two animated clicks hides the panel that just opened.
2070 - // Jump the other panel to its closed end state synchronously instead.
2071 - function forceClose( button ) {
2072 - if ( ! button || button.getAttribute( 'aria-expanded' ) !== 'true' ) {
2073 - return;
2074 - }
2075 - var panelId = button.getAttribute( 'aria-controls' );
2076 - var panel = panelId ? document.getElementById( panelId ) : null;
2077 - if ( ! panel ) {
2078 - return;
2079 - }
2080 - if ( window.jQuery ) {
2081 - window.jQuery( panel ).stop( true, false );
2082 - }
2083 - panel.style.display = 'none';
2084 - panel.classList.add( 'hidden' );
2085 - if ( panel.parentNode instanceof HTMLElement ) {
2086 - panel.parentNode.style.display = 'none';
2087 - }
2088 - button.classList.remove( 'screen-meta-active' );
2089 - button.setAttribute( 'aria-expanded', 'false' );
2090 - var toggles = document.querySelectorAll( '.screen-meta-toggle' );
2091 - for ( var i = 0; i < toggles.length; i++ ) {
2092 - toggles[ i ].style.visibility = '';
2093 - }
2094 - }
2095 -
2096 - /* -----------------------------------------------------------------
2097 - * Broadcast receiver — iframe side.
2098 - *
2099 - * The parent shell publishes broadcasts via
2100 - * `wp.desktop.broadcast(topic, payload)` (see `src/broadcast.ts`).
2101 - * It posts `{ type: 'desktop-mode-broadcast', topic, payload }` to
2102 - * every open iframe. Here we re-dispatch that as a CustomEvent
2103 - * on the iframe's own document so admin pages can subscribe with
2104 - * plain `document.addEventListener( 'desktop-mode-broadcast', cb )`
2105 - * — no extra script handle required.
2106 - *
2107 - * Iframe-side admin code can also publish UPSTREAM by posting
2108 - * the same shape to `window.parent`; the parent's
2109 - * `installBroadcastReceiver()` re-broadcasts to every other
2110 - * iframe + native window.
2111 - * ----------------------------------------------------------------- */
2112 - window.addEventListener( 'message', function ( e ) {
2113 - if ( e.origin !== origin ) {
2114 - return;
2115 - }
2116 - if ( ! e.data || e.data.type !== 'desktop-mode-broadcast' ) {
2117 - return;
2118 - }
2119 - try {
2120 - document.dispatchEvent( new CustomEvent( 'desktop-mode-broadcast', {
2121 - detail: { topic: e.data.topic, payload: e.data.payload }
2122 - } ) );
2123 - } catch ( _err ) { /* old browser without CustomEvent ctor — ignore */ }
2124 - } );
2125 -
2126 - /* -----------------------------------------------------------------
2127 - * Soft-reload — iframe-side default handler.
2128 - *
2129 - * When a `desktop-mode.<post_type>.changed` broadcast fires AND the
2130 - * current iframe is on a known list page for that post type, we
2131 - * fetch the current URL and replace the iframe's `#wpbody-content`
2132 - * in place. The user sees the new state of the list — restored
2133 - * post appears, deleted media disappears — without the WP loading
2134 - * spinner that `location.reload()` would show.
2135 - *
2136 - * Single-edit pages (`post.php`, `post-new.php`) are deliberately
2137 - * NOT in the rule set: replacing their body would destroy any
2138 - * unsaved Gutenberg/classic-editor state. Plugins that want
2139 - * specific behaviour for those pages can subscribe to the same
2140 - * topic on `document` and handle it themselves.
2141 - *
2142 - * The fetch carries a custom header so a later phase can serve a
2143 - * minimal partial response if we want to optimise; for now WP
2144 - * returns the full admin page and we just pluck the body.
2145 - *
2146 - * WP list-table JS uses event delegation on `document`/`body`,
2147 - * which survives `replaceWith`. If a specific page breaks after
2148 - * a swap (e.g. inline-edit double-binding), that page's plugin
2149 - * should listen for `desktop-mode-soft-reloaded` and rebind.
2150 - * ----------------------------------------------------------------- */
2151 - var DESKTOP_MODE_SOFT_RELOAD_RULES = [
2152 - {
2153 - topic: 'desktop-mode.post.changed',
2154 - match: function () {
2155 - if ( ! _desktop_modeEndsWith( location.pathname, '/wp-admin/edit.php' ) ) return false;
2156 - var t = new URLSearchParams( location.search ).get( 'post_type' );
2157 - return t === null || t === 'post';
2158 - }
2159 - },
2160 - {
2161 - topic: 'desktop-mode.page.changed',
2162 - match: function () {
2163 - if ( ! _desktop_modeEndsWith( location.pathname, '/wp-admin/edit.php' ) ) return false;
2164 - return new URLSearchParams( location.search ).get( 'post_type' ) === 'page';
2165 - }
2166 - },
2167 - {
2168 - topic: 'desktop-mode.attachment.changed',
2169 - match: function () {
2170 - return _desktop_modeEndsWith( location.pathname, '/wp-admin/upload.php' );
2171 - }
2172 - },
2173 - {
2174 - topic: 'desktop-mode.comment.changed',
2175 - match: function () {
2176 - return _desktop_modeEndsWith( location.pathname, '/wp-admin/edit-comments.php' );
2177 - }
2178 - }
2179 - ];
2180 -
2181 - function _desktop_modeEndsWith( s, suffix ) { return s.lastIndexOf( suffix ) === s.length - suffix.length; }
2182 -
2183 - var _desktop_modeSoftReloadInFlight = false;
2184 - var _desktop_modeSoftReloadQueued = false;
2185 -
2186 - function _desktop_modeSoftReload() {
2187 - if ( _desktop_modeSoftReloadInFlight ) {
2188 - _desktop_modeSoftReloadQueued = true;
2189 - return;
2190 - }
2191 - _desktop_modeSoftReloadInFlight = true;
2192 - fetch( location.href, {
2193 - credentials: 'same-origin',
2194 - cache: 'no-cache',
2195 - headers: { 'X-WP-Desktop-Soft-Reload': '1' }
2196 - } ).then( function ( r ) {
2197 - if ( ! r.ok ) throw new Error( 'soft-reload fetch failed: ' + r.status );
2198 - return r.text();
2199 - } ).then( function ( html ) {
2200 - var doc = new DOMParser().parseFromString( html, 'text/html' );
2201 - var fresh = doc.querySelector( '#wpbody-content' );
2202 - var live = document.querySelector( '#wpbody-content' );
2203 - if ( ! fresh || ! live ) {
2204 - /* Markup we expected isn't there — admin pages we
2205 - * don't recognise (or core changes the structure).
2206 - * Don't reload; let the iframe stay as it is rather
2207 - * than show a spinner the user told us not to. */
2208 - return;
2209 - }
2210 - live.replaceWith( fresh );
2211 - try {
2212 - document.dispatchEvent( new CustomEvent( 'desktop-mode-soft-reloaded' ) );
2213 - } catch ( _err ) {}
2214 - /* Some WP scripts re-init on DOMContentLoaded only — let
2215 - * pages opt-in to a re-init by listening to the event
2216 - * above. We intentionally do NOT re-fire DOMContentLoaded;
2217 - * that's almost always wrong (double-init of jQuery/WP). */
2218 - } ).catch( function ( err ) {
2219 - /* Network error — leave the iframe untouched. The user's
2220 - * next manual interaction will refresh state, and the
2221 - * next broadcast will retry. */
2222 - if ( window.console && window.console.warn ) {
2223 - window.console.warn( '[desktop-mode] soft-reload skipped:', err );
2224 - }
2225 - } ).then( function () {
2226 - _desktop_modeSoftReloadInFlight = false;
2227 - if ( _desktop_modeSoftReloadQueued ) {
2228 - _desktop_modeSoftReloadQueued = false;
2229 - _desktop_modeSoftReload();
2230 - }
2231 - } );
2232 - }
2233 -
2234 - document.addEventListener( 'desktop-mode-broadcast', function ( e ) {
2235 - var detail = e.detail || {};
2236 - var topic = detail.topic;
2237 - if ( ! topic ) return;
2238 - for ( var i = 0; i < DESKTOP_MODE_SOFT_RELOAD_RULES.length; i++ ) {
2239 - var r = DESKTOP_MODE_SOFT_RELOAD_RULES[ i ];
2240 - if ( r.topic === topic && r.match() ) {
2241 - _desktop_modeSoftReload();
2242 - return;
2243 - }
2244 - }
2245 - } );
2246 -
2247 - window.addEventListener( 'message', function( e ) {
2248 - if ( e.origin !== origin ) {
2249 - return;
2250 - }
2251 - if ( ! e.data || e.data.type !== 'desktop-mode-toggle-panel' ) {
2252 - return;
2253 - }
2254 - var target = null;
2255 - if ( e.data.panel === 'screen-options' && screenOptionsBtn ) {
2256 - target = screenOptionsBtn;
2257 - } else if ( e.data.panel === 'help' && helpBtn ) {
2258 - target = helpBtn;
2259 - }
2260 - if ( ! target ) {
2261 - return;
2262 - }
2263 - if ( target.getAttribute( 'aria-expanded' ) !== 'true' ) {
2264 - var other = target === screenOptionsBtn ? helpBtn : screenOptionsBtn;
2265 - forceClose( other );
2266 - }
2267 - target.click();
2268 - } );
2269 -
2270 - /* -----------------------------------------------------------------
2271 - * Connection bridge — iframe side.
2272 - *
2273 - * Plugins call `wp.desktop.iframe.publish(topic, payload)` /
2274 - * `subscribe(topic, cb)` / `onConnection(cb)` to talk to a parent-
2275 - * side `wp.desktop.connect()` caller. The shell only routes;
2276 - * topic semantics are plugin-defined.
2277 - *
2278 - * Connections are tracked locally so `onConnection` can fire when
2279 - * the parent opens a new channel (typical use: start emitting
2280 - * heavy events only after at least one consumer subscribed). Each
2281 - * connection carries a topic-allowlist negotiated at handshake
2282 - * time — wildcard ('*') subscribers see everything.
2283 - * ----------------------------------------------------------------- */
2284 - var _wpdConnections = {};
2285 - var _wpdConnectionListeners = [];
2286 - var _wpdSubs = {}; // topic → [cb, ...]
2287 - var _wpdChannelSubs = {}; // channel → [cb, ...] (window-channel API)
2288 - var _wpdParentOrigin = window.location.origin;
2289 -
2290 - function _wpdEmitToParent( connectionId, topic, payload ) {
2291 - try {
2292 - window.parent.postMessage( {
2293 - type: 'desktop-mode-bridge-publish',
2294 - connectionId: connectionId,
2295 - topic: topic,
2296 - payload: payload
2297 - }, _wpdParentOrigin );
2298 - } catch ( _err ) { /* parent gone */ }
2299 - }
2300 -
2301 - window.addEventListener( 'message', function ( ev ) {
2302 - if ( ev.origin !== _wpdParentOrigin ) {
2303 - return;
2304 - }
2305 - var data = ev && ev.data;
2306 - if ( ! data || typeof data !== 'object' || typeof data.type !== 'string' ) {
2307 - return;
2308 - }
2309 -
2310 - if ( data.type === 'desktop-mode-bridge-handshake' && typeof data.connectionId === 'string' ) {
2311 - if ( _wpdConnections[ data.connectionId ] ) {
2312 - /* Re-handshake on iframe-ready re-arm — no-op besides
2313 - * acking again so the parent can resume. */
2314 - try {
2315 - window.parent.postMessage( {
2316 - type: 'desktop-mode-bridge-handshake-ack',
2317 - connectionId: data.connectionId
2318 - }, _wpdParentOrigin );
2319 - } catch ( _err ) { /* swallow */ }
2320 - return;
2321 - }
2322 - var conn = {
2323 - id: data.connectionId,
2324 - topics: Array.isArray( data.topics ) ? data.topics.slice() : []
2325 - };
2326 - _wpdConnections[ conn.id ] = conn;
2327 - try {
2328 - window.parent.postMessage( {
2329 - type: 'desktop-mode-bridge-handshake-ack',
2330 - connectionId: conn.id
2331 - }, _wpdParentOrigin );
2332 - } catch ( _err ) { /* swallow */ }
2333 - for ( var i = 0; i < _wpdConnectionListeners.length; i++ ) {
2334 - try {
2335 - _wpdConnectionListeners[ i ]( {
2336 - id: conn.id,
2337 - topics: conn.topics.slice()
2338 - } );
2339 - } catch ( _err ) { /* swallow listener */ }
2340 - }
2341 - return;
2342 - }
2343 -
2344 - if ( data.type === 'desktop-mode-bridge-publish' && typeof data.topic === 'string' ) {
2345 - var bucket = _wpdSubs[ data.topic ];
2346 - if ( bucket ) {
2347 - for ( var j = 0; j < bucket.length; j++ ) {
2348 - try {
2349 - bucket[ j ]( data.payload, { topic: data.topic, connectionId: data.connectionId } );
2350 - } catch ( _err ) { /* swallow subscriber */ }
2351 - }
2352 - }
2353 - var wildcard = _wpdSubs[ '*' ];
2354 - if ( wildcard ) {
2355 - for ( var k = 0; k < wildcard.length; k++ ) {
2356 - try {
2357 - wildcard[ k ]( data.payload, { topic: data.topic, connectionId: data.connectionId } );
2358 - } catch ( _err ) { /* swallow */ }
2359 - }
2360 - }
2361 - return;
2362 - }
2363 -
2364 - if ( data.type === 'desktop-mode-bridge-disconnect' && typeof data.connectionId === 'string' ) {
2365 - delete _wpdConnections[ data.connectionId ];
2366 - return;
2367 - }
2368 -
2369 - /* Unified window-channel delivery from the parent. Fires
2370 - * every `wp.desktop.on( channel, cb )` subscriber for the
2371 - * matching channel — same protocol as
2372 - * `assets/js/iframe-bridge.js`. */
2373 - if ( data.type === 'desktop-mode-window-send' && typeof data.channel === 'string' && data.channel !== '' ) {
2374 - var meta = { channel: data.channel };
2375 - var cBucket = _wpdChannelSubs[ data.channel ];
2376 - if ( cBucket ) {
2377 - var cBucketSnap = cBucket.slice();
2378 - for ( var ci = 0; ci < cBucketSnap.length; ci++ ) {
2379 - try {
2380 - cBucketSnap[ ci ]( data.payload, meta );
2381 - } catch ( _err ) { /* swallow */ }
2382 - }
2383 - }
2384 - var cWildcard = _wpdChannelSubs[ '*' ];
2385 - if ( cWildcard ) {
2386 - var cWildcardSnap = cWildcard.slice();
2387 - for ( var cw = 0; cw < cWildcardSnap.length; cw++ ) {
2388 - try {
2389 - cWildcardSnap[ cw ]( data.payload, meta );
2390 - } catch ( _err ) { /* swallow */ }
2391 - }
2392 - }
2393 - return;
2394 - }
2395 - } );
2396 -
2397 - var iframeApi = {
2398 - /**
2399 - * Publish a payload under a topic. Sent to every connection
2400 - * — typical case is one connection per parent caller, but
2401 - * a debug console may have several at once.
2402 - */
2403 - publish: function ( topic, payload ) {
2404 - if ( typeof topic !== 'string' || topic === '' ) {
2405 - return;
2406 - }
2407 - var ids = Object.keys( _wpdConnections );
2408 - for ( var i = 0; i < ids.length; i++ ) {
2409 - _wpdEmitToParent( ids[ i ], topic, payload );
2410 - }
2411 - },
2412 - /**
2413 - * Subscribe to a topic. Returns an unsubscribe function.
2414 - * Use `'*'` to receive every published payload (debugging).
2415 - */
2416 - subscribe: function ( topic, cb ) {
2417 - if ( typeof topic !== 'string' || topic === '' || typeof cb !== 'function' ) {
2418 - return function () {};
2419 - }
2420 - var bucket = _wpdSubs[ topic ];
2421 - if ( ! bucket ) {
2422 - bucket = [];
2423 - _wpdSubs[ topic ] = bucket;
2424 - }
2425 - bucket.push( cb );
2426 - return function () {
2427 - var i = bucket.indexOf( cb );
2428 - if ( i >= 0 ) {
2429 - bucket.splice( i, 1 );
2430 - }
2431 - };
2432 - },
2433 - /**
2434 - * Notified whenever a parent caller opens a connection. Use
2435 - * to start emitting heavy publish events only when somebody
2436 - * is listening.
2437 - */
2438 - onConnection: function ( cb ) {
2439 - if ( typeof cb !== 'function' ) {
2440 - return function () {};
2441 - }
2442 - _wpdConnectionListeners.push( cb );
2443 - /* Replay current connections — late subscribers still
2444 - * see who's already there. */
2445 - var ids = Object.keys( _wpdConnections );
2446 - for ( var i = 0; i < ids.length; i++ ) {
2447 - try {
2448 - cb( {
2449 - id: _wpdConnections[ ids[ i ] ].id,
2450 - topics: _wpdConnections[ ids[ i ] ].topics.slice()
2451 - } );
2452 - } catch ( _err ) { /* swallow */ }
2453 - }
2454 - return function () {
2455 - var i = _wpdConnectionListeners.indexOf( cb );
2456 - if ( i >= 0 ) {
2457 - _wpdConnectionListeners.splice( i, 1 );
2458 - }
2459 - };
2460 - },
2461 - /**
2462 - * Iframe-initiated connection request. See
2463 - * `assets/js/iframe-bridge.js` — same shape, same protocol.
2464 - */
2465 - requestConnection: function ( opts ) {
2466 - opts = opts || {};
2467 - var topics = Array.isArray( opts.topics ) ? opts.topics.slice() : [];
2468 - var requestId = 'wpdir-' + Math.random().toString( 36 ).slice( 2, 10 );
2469 -
2470 - return new Promise( function ( resolve, reject ) {
2471 - var settled = false;
2472 - var timeoutMs = typeof opts.timeoutMs === 'number'
2473 - ? opts.timeoutMs
2474 - : 5000;
2475 -
2476 - function settle( ok, value ) {
2477 - if ( settled ) {
2478 - return;
2479 - }
2480 - settled = true;
2481 - window.removeEventListener( 'message', onAck );
2482 - clearTimeout( timer );
2483 - if ( ok ) {
2484 - resolve( value );
2485 - } else {
2486 - reject( value );
2487 - }
2488 - }
2489 -
2490 - function onAck( ev ) {
2491 - if ( ev.origin !== _wpdParentOrigin ) {
2492 - return;
2493 - }
2494 - var d = ev && ev.data;
2495 - if (
2496 - ! d ||
2497 - typeof d !== 'object' ||
2498 - d.type !== 'desktop-mode-bridge-connection-ack' ||
2499 - d.requestId !== requestId
2500 - ) {
2501 - return;
2502 - }
2503 - if ( d.accepted ) {
2504 - var summary = {
2505 - id: typeof d.connectionId === 'string' ? d.connectionId : '',
2506 - topics: topics.slice()
2507 - };
2508 - if ( typeof opts.onOpen === 'function' ) {
2509 - try { opts.onOpen( summary ); } catch ( _err ) { /* swallow */ }
2510 - }
2511 - settle( true, summary );
2512 - } else {
2513 - settle( false, new Error( d.reason || 'rejected' ) );
2514 - }
2515 - }
2516 - window.addEventListener( 'message', onAck );
2517 -
2518 - var timer = setTimeout( function () {
2519 - settle( false, new Error( 'timeout' ) );
2520 - }, timeoutMs );
2521 -
2522 - try {
2523 - window.parent.postMessage( {
2524 - type: 'desktop-mode-bridge-connection-request',
2525 - requestId: requestId,
2526 - topics: topics
2527 - }, _wpdParentOrigin );
2528 - } catch ( err ) {
2529 - settle( false, err );
2530 - }
2531 - } );
2532 - }
2533 - };
2534 -
2535 - if ( ! window.wp ) { window.wp = {}; }
2536 - if ( ! window.wp.desktop ) { window.wp.desktop = {}; }
2537 - window.wp.desktop.iframe = iframeApi;
2538 -
2539 - /* Unified window-channel API. Mirror of the equivalent block
2540 - * in `assets/js/iframe-bridge.js` — keep both in sync. The
2541 - * parent shell posts `desktop-mode-window-send` on
2542 - * `Window.send( channel, payload )`; iframe-side handlers
2543 - * register via `wp.desktop.on( channel, cb )`. Sending the
2544 - * other way (`wp.desktop.send`) posts up to the parent where
2545 - * `Window.on( channel, cb )` subscribers fire. */
2546 - if ( typeof window.wp.desktop.send !== 'function' ) {
2547 - window.wp.desktop.send = function ( channel, payload ) {
2548 - if ( typeof channel !== 'string' || channel === '' ) {
2549 - return;
2550 - }
2551 - try {
2552 - window.parent.postMessage( {
2553 - type: 'desktop-mode-window-publish',
2554 - channel: channel,
2555 - payload: payload
2556 - }, _wpdParentOrigin );
2557 - } catch ( _err ) { /* parent gone */ }
2558 - };
2559 - }
2560 - if ( typeof window.wp.desktop.on !== 'function' ) {
2561 - window.wp.desktop.on = function ( channel, cb ) {
2562 - if ( typeof channel !== 'string' || channel === '' || typeof cb !== 'function' ) {
2563 - return function () {};
2564 - }
2565 - var bucket = _wpdChannelSubs[ channel ];
2566 - if ( ! bucket ) {
2567 - bucket = [];
2568 - _wpdChannelSubs[ channel ] = bucket;
2569 - }
2570 - bucket.push( cb );
2571 - return function () {
2572 - var i = bucket.indexOf( cb );
2573 - if ( i >= 0 ) {
2574 - bucket.splice( i, 1 );
2575 - }
2576 - };
2577 - };
2578 - }
2579 -
2580 - /* -----------------------------------------------------------------
2581 - * Stale-nonce recovery after wp-auth-check re-authentication.
2582 - *
2583 - * When the user's session expires while a chromeless window is
2584 - * open, core's `wp-auth-check.js` shows its login iframe inside
2585 - * this page. After re-auth the auth cookie is fresh — but every
2586 - * per-page nonce cached in JS globals
2587 - * (`_wpUpdatesSettings.ajax_nonce`, `commonL10n.nonce`, Gutenberg's
2588 - * `wpApiSettings.nonce`, etc.) was minted under the OLD nonce-tick
2589 - * and is now rejected by `check_ajax_referer`. WP reports that as
2590 - * "Cookie check failed" on the next plugin Install / Activate /
2591 - * Update click, which is misleading: the cookie is fine; the
2592 - * nonce is stale.
2593 - *
2594 - * Fix: watch jQuery's `heartbeat-tick`. If we ever see
2595 - * `wp-auth-check: false` (the modal trigger) and then later see
2596 - * the same field flip back to `true`, the user re-authed
2597 - * mid-session and every cached nonce in this iframe is stale —
2598 - * reload so they regenerate from the fresh session.
2599 - *
2600 - * Per-iframe scope is intentional: each chromeless iframe carries
2601 - * its own jQuery + heartbeat stack and its own nonce caches.
2602 - * Siblings recover on their own next tick. We don't broadcast a
2603 - * reload to peers because the parent shell may still be running
2604 - * core's confirm() prompts and we don't want to surprise-reload
2605 - * windows with unsaved state.
2606 - *
2607 - * If jQuery never loads on this page (rare — most admin screens
2608 - * pull it for heartbeat already), this block is a no-op.
2609 - * ----------------------------------------------------------------- */
2610 - ( function _wpdInstallAuthCheckRecovery() {
2611 - var attached = false;
2612 - var sawLoggedOut = false;
2613 - function attach() {
2614 - if ( attached || ! window.jQuery ) {
2615 - return;
2616 - }
2617 - attached = true;
2618 - window.jQuery( document ).on( 'heartbeat-tick.wpdAuthRecover', function ( ev, data ) {
2619 - if ( ! data || typeof data !== 'object' || ! ( 'wp-auth-check' in data ) ) {
2620 - return;
2621 - }
2622 - if ( data[ 'wp-auth-check' ] === false ) {
2623 - sawLoggedOut = true;
2624 - return;
2625 - }
2626 - if ( sawLoggedOut && data[ 'wp-auth-check' ] === true ) {
2627 - sawLoggedOut = false;
2628 - // Tell the parent shell BEFORE we reload so it
2629 - // doesn't have to wait for its own heartbeat
2630 - // tick (up to 60s on an idle shell) to discover
2631 - // the cookie is fresh. Parent runs its full
2632 - // recovery path on receipt — overlay teardown,
2633 - // iframe reload sweep, then a hard reload.
2634 - try {
2635 - if ( window.parent && window.parent !== window ) {
2636 - window.parent.postMessage(
2637 - { type: 'desktop-mode-reauth-detected' },
2638 - window.location.origin
2639 - );
2640 - }
2641 - } catch ( _err ) { /* parent gone */ }
2642 - try { window.location.reload(); } catch ( _err ) { /* swallow */ }
2643 - }
2644 - } );
2645 - }
2646 - attach();
2647 - if ( document.readyState === 'loading' ) {
2648 - document.addEventListener( 'DOMContentLoaded', attach, { once: true } );
2649 - }
2650 - window.addEventListener( 'load', attach, { once: true } );
2651 - } )();
2652 -
2653 - /*
2654 - * Bridge-ready signal. Every listener installed by this script
2655 - * is now wired; let the parent shell know so it can fire
2656 - * `HOOKS.IFRAME_READY` and re-arm any connection handshakes
2657 - * (`src/connection/index.ts#onIframeReady`) that arrived before
2658 - * we were listening. Without this, every consumer of
2659 - * `HOOKS.IFRAME_READY` (devtools replay, connection rearm)
2660 - * stays silent for the lifetime of the iframe — documented
2661 - * surface that never actually fires.
2662 - *
2663 - * Posted to the parent's own origin only. Wrapped in try/catch
2664 - * because cross-origin parents (top-level admin opened outside
2665 - * the shell) would throw on the postMessage and we don't want a
2666 - * single failed dispatch to wedge anything else above.
2667 - */
2668 - try {
2669 - if ( window.parent && window.parent !== window ) {
2670 - window.parent.postMessage(
2671 - { type: 'desktop-mode-ready' },
2672 - window.location.origin
2673 - );
2674 - }
2675 - } catch ( _err ) { /* parent gone or cross-origin */ }
2676 -} )();
2677 -JS;
2678 -
2679 - // Substitute the server-built menu payload into the bridge
2680 - // script. `wp_json_encode` guarantees safe JSON output — no need
2681 - // for an additional escape pass. When the page isn't on our
2682 - // menu-altering allowlist the placeholder resolves to `null` and
2683 - // the bridge skips the postMessage.
2684 - $js = str_replace( '/*__DESKTOP_MODE_MENU_PAYLOAD__*/', $menu_payload_json, $js );
2685 -
2686 - wp_print_inline_script_tag( $js );
543 + wp_enqueue_script( 'os-chromeless-bridge' );
544 + wp_add_inline_script( 'os-chromeless-bridge', $data, 'before' );
2687 545 }
2688 -add_action( 'admin_footer', 'desktop_mode_chromeless_bridge_script' );
546 +add_action( 'admin_footer', 'openstation_chromeless_bridge_script' );