Add bounded native file-panel v2 transport

experiments/WebScene.NativeEngine.Probe/CMakeLists.txt

@@ -5,6 +5,14 @@ include(CTest)
 include(FetchContent)
 
 if(BUILD_TESTING)
+    add_executable(webscene_file_panel_v2_contract_tests
+        tests/file_panel_v2_contract_tests.cpp)
+    target_compile_features(webscene_file_panel_v2_contract_tests PRIVATE cxx_std_20)
+    target_include_directories(webscene_file_panel_v2_contract_tests PRIVATE native)
+    add_test(NAME webscene_file_panel_v2_contract_tests
+        COMMAND webscene_file_panel_v2_contract_tests)
+    set_tests_properties(webscene_file_panel_v2_contract_tests PROPERTIES
+        LABELS "native;file-panel;security;lifecycle;performance" TIMEOUT 20)
     add_executable(webscene_indexeddb_storage_tests
         tests/indexeddb_storage_tests.cpp
         native/webscene_indexeddb_storage.cpp)

experiments/WebScene.NativeEngine.Probe/native/webscene_native_engine.cpp

@@ -1,4 +1,5 @@
 #include "webscene_native_engine.h"
+#include "webscene_file_panel_v2.hpp"
 #include "webscene/compiled_document.hpp"
 #include "webscene_native_dom.h"
 #include "webscene_v8_runtime.h"
@@ -386,6 +387,21 @@ struct webscene_engine final {
     size_t copy_runtime_failure(char* destination, size_t capacity) {
         return diagnostics_.copy_failure(destination, capacity);
     }
+    bool queue_file_panel_request_v2(
+        const webscene_file_panel_request_v2& request,
+        webscene_native::file_panel_completion_callback_v2 callback) {
+        if (!file_panel_broker_v2_.queue(request, std::move(callback))) return false;
+        notify_host_work();
+        return true;
+    }
+    std::unique_ptr<webscene_native::file_panel_request_lease_v2>
+    take_file_panel_request_v2() {
+        return file_panel_broker_v2_.take();
+    }
+    bool complete_file_panel_request_v2(
+        const webscene_file_panel_completion_v2& completion) {
+        return file_panel_broker_v2_.complete(completion);
+    }
 private:
 #if defined(WEBSCENE_GRAPHICS_SCENE_TESTS)
     friend void test_native_gpu_scene_leases();
@@ -463,6 +479,7 @@ struct webscene_engine final {
     std::atomic<bool> frame_paced_pointer_pending_{false};
     webscene_native::native_document document_;
     webscene_native::runtime_diagnostics diagnostics_;
+    webscene_native::file_panel_broker_v2 file_panel_broker_v2_;
 #if defined(WEBSCENE_NATIVE_ENGINE_WITH_V8)
     std::unique_ptr<webscene_native::v8_dom_runtime> runtime_;
     std::atomic<bool> file_service_enabled_{false};
@@ -1947,3 +1964,28 @@ uint8_t webscene_engine_complete_file_request_v1(webscene_engine* engine,
     }
     return engine->complete_file_request(std::move(completion));
 }
+const webscene_file_panel_request_v2*
+webscene_engine_take_file_panel_request_v2(webscene_engine* engine) {
+    if (!engine) return nullptr;
+    try {
+        auto request = engine->take_file_panel_request_v2();
+        return request ? &request.release()->view : nullptr;
+    } catch (...) {
+        return nullptr;
+    }
+}
+void webscene_file_panel_request_release_v2(
+    const webscene_file_panel_request_v2* request) {
+    delete reinterpret_cast<const webscene_native::file_panel_request_lease_v2*>(
+        request);
+}
+uint8_t webscene_engine_complete_file_panel_request_v2(
+    webscene_engine* engine,
+    const webscene_file_panel_completion_v2* completion) {
+    if (engine == nullptr || completion == nullptr) return 0;
+    try {
+        return engine->complete_file_panel_request_v2(*completion);
+    } catch (...) {
+        return 0;
+    }
+}

experiments/WebScene.NativeEngine.Probe/native/webscene_native_engine.exports

@@ -101,6 +101,9 @@ _webscene_engine_enable_file_service_v1
 _webscene_engine_take_file_request_v1
 _webscene_file_request_release_v1
 _webscene_engine_complete_file_request_v1
+_webscene_engine_take_file_panel_request_v2
+_webscene_file_panel_request_release_v2
+_webscene_engine_complete_file_panel_request_v2
 
 _webscene_engine_set_work_available_callback_v1
 

experiments/WebScene.NativeEngine.Probe/native/webscene_native_engine.h

@@ -1471,6 +1471,95 @@ WEBSCENE_API uint8_t webscene_engine_complete_file_request_v1(webscene_engine* e
     uint64_t request_id, uint32_t status, const webscene_file_data_v1* files,
     size_t file_count, const char* error_message);
 
+/* Native file panel transport v2. This queue is independent of the v1
+ * byte-copy service. Requests contain presentation metadata and an optional
+ * opaque initial-location token. Successful results contain only bounded
+ * display metadata and opaque grant identifiers; filesystem paths, bookmark
+ * bytes and platform objects remain owned by the native host.
+ *
+ * Request and nested views remain immutable until release. A completion is
+ * copied before the call returns. Limits: 16 pending requests, 64 selected
+ * entries, 32 filters, 64 total MIME/extension strings, 64 KiB request
+ * metadata, 4 KiB display names/messages, and 1 KiB opaque tokens/grant IDs. */
+enum {
+    WEBSCENE_FILE_PANEL_OPEN_FILE_V2 = 1,
+    WEBSCENE_FILE_PANEL_OPEN_DIRECTORY_V2 = 2,
+    WEBSCENE_FILE_PANEL_SAVE_FILE_V2 = 3
+};
+enum {
+    WEBSCENE_FILE_PANEL_ALLOW_MULTIPLE_V2 = 1U << 0U,
+    WEBSCENE_FILE_PANEL_SHOW_HIDDEN_V2 = 1U << 1U,
+    WEBSCENE_FILE_PANEL_CAN_CREATE_DIRECTORIES_V2 = 1U << 2U,
+    WEBSCENE_FILE_PANEL_CONFIRM_OVERWRITE_V2 = 1U << 3U
+};
+enum {
+    WEBSCENE_FILE_PANEL_SUCCESS_V2 = 0,
+    WEBSCENE_FILE_PANEL_CANCELLED_V2 = 1,
+    WEBSCENE_FILE_PANEL_DENIED_V2 = 2,
+    WEBSCENE_FILE_PANEL_ERROR_V2 = 3
+};
+enum {
+    WEBSCENE_FILE_PANEL_ENTRY_FILE_V2 = 1,
+    WEBSCENE_FILE_PANEL_ENTRY_DIRECTORY_V2 = 2
+};
+enum {
+    WEBSCENE_FILE_PANEL_GRANT_READ_V2 = 1U << 0U,
+    WEBSCENE_FILE_PANEL_GRANT_WRITE_V2 = 1U << 1U,
+    WEBSCENE_FILE_PANEL_GRANT_ENUMERATE_V2 = 1U << 2U,
+    WEBSCENE_FILE_PANEL_GRANT_CREATE_V2 = 1U << 3U,
+    WEBSCENE_FILE_PANEL_GRANT_DELETE_V2 = 1U << 4U
+};
+typedef struct webscene_file_panel_string_v2 {
+    const char* data;
+    size_t byte_count;
+} webscene_file_panel_string_v2;
+typedef struct webscene_file_panel_token_v2 {
+    const uint8_t* data;
+    size_t byte_count;
+} webscene_file_panel_token_v2;
+typedef struct webscene_file_panel_filter_v2 {
+    uint32_t struct_size, version;
+    webscene_file_panel_string_v2 description;
+    const webscene_file_panel_string_v2* mime_types;
+    size_t mime_type_count;
+    const webscene_file_panel_string_v2* extensions;
+    size_t extension_count;
+} webscene_file_panel_filter_v2;
+typedef struct webscene_file_panel_request_v2 {
+    uint32_t struct_size, version;
+    uint64_t request_id;
+    uint32_t kind, flags;
+    uint32_t maximum_selection_count, reserved;
+    webscene_file_panel_string_v2 title;
+    webscene_file_panel_string_v2 prompt;
+    webscene_file_panel_string_v2 suggested_name;
+    webscene_file_panel_token_v2 initial_location_token;
+    const webscene_file_panel_filter_v2* filters;
+    size_t filter_count;
+} webscene_file_panel_request_v2;
+typedef struct webscene_file_panel_entry_v2 {
+    uint32_t struct_size, version;
+    uint32_t kind, capabilities;
+    webscene_file_panel_string_v2 display_name;
+    webscene_file_panel_token_v2 grant_id;
+} webscene_file_panel_entry_v2;
+typedef struct webscene_file_panel_completion_v2 {
+    uint32_t struct_size, version;
+    uint64_t request_id;
+    uint32_t status, reserved;
+    const webscene_file_panel_entry_v2* entries;
+    size_t entry_count;
+    webscene_file_panel_string_v2 error_code;
+    webscene_file_panel_string_v2 error_message;
+} webscene_file_panel_completion_v2;
+WEBSCENE_API const webscene_file_panel_request_v2*
+webscene_engine_take_file_panel_request_v2(webscene_engine* engine);
+WEBSCENE_API void webscene_file_panel_request_release_v2(
+    const webscene_file_panel_request_v2* request);
+WEBSCENE_API uint8_t webscene_engine_complete_file_panel_request_v2(
+    webscene_engine* engine,
+    const webscene_file_panel_completion_v2* completion);
+
 /* Typed native desktop request ABI. Request memory is immutable and remains
  * valid until release. Byte payloads are capped at 16 MiB, strings are UTF-8,
  * and at most 16 completion-bearing operations may be pending per document. */

experiments/WebScene.NativeEngine.Probe/native/webscene_native_engine_worker.inc

@@ -27,6 +27,7 @@
 #if defined(WEBSCENE_NATIVE_ENGINE_WITH_V8_INSPECTOR)
         inspector_runtime_.store(nullptr, std::memory_order_release);
 #endif
+        file_panel_broker_v2_.retire();
         // V8 cleanup must stay on its owning worker even after a terminal throw.
         retire_file_runtime();
 #endif
@@ -336,6 +337,7 @@
             failure.stage = "bootstrap";
             failure.message = runtime_->last_error();
             diagnostics_.publish(std::move(failure));
+            file_panel_broker_v2_.retire();
             retire_file_runtime();
         } else {
             { std::lock_guard lock(file_runtime_mutex_); file_runtime_ready_=true; }
@@ -1057,6 +1059,7 @@
                 }
 #endif
                 if (auto* url = std::get_if<url_request>(&request)) {
+                    file_panel_broker_v2_.retire();
                     if (url->initial_viewport) apply(*url->initial_viewport);
                     bool loaded = false;
                     if (runtime_ != nullptr) {
@@ -1444,6 +1447,7 @@
 #if defined(WEBSCENE_NATIVE_ENGINE_ENABLE_GRAPHICS)
         if (runtime_) runtime_->shutdown_graphics();
 #endif
+        file_panel_broker_v2_.retire();
         retire_file_runtime();
 #endif
         frame_trace_.dump();