fix(play): tag runner postMessages with uuid for isolation#437
Draft
caugner wants to merge 1 commit into
Draft
Conversation
Read the `uuid` query param in the runner and include it in every
`postMessage` the runner sends to its parent frame: the `console` proxy
(all three branches) and the `ready` message now post
`{ uuid, typ, ... }` instead of `{ typ, ... }`.
This mirrors `mdn/fred`'s copy of the same file
(`vendor/yari/libs/play/index.js`), from which `src/internal/play` is
vendored. Tagging messages with a `uuid` lets a parent hosting multiple
runners on one page filter incoming messages so the runners cannot
cross-talk.
Backward-compatible: a parent that does not set the `uuid` query param
yields `uuid: undefined`, and fred's parent falls back to deriving the
value from the origin subdomain, preserving existing behavior.
caugner
force-pushed
the
436-play-runner-uuid-isolation
branch
from
July 17, 2026 13:55
a2739c0 to
3e7f0ba
Compare
caugner
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Tag every message the mirrored Playground runner (
cloud-function/src/internal/play/index.js) posts to its parent with auuidread from the runner URL'suuidquery param: theconsoleproxy (all threepostMessagebranches) and thereadymessage now post{ uuid, typ, ... }. Matches fred'svendor/yari/libs/play/index.js, from which this file is vendored.Motivation
Let a parent hosting multiple runners filter incoming messages by
uuidso runners can't cross-talk. This copy has never had it (git log -S uuidon the file is empty), unlike fred's.Additional details
Backward-compatible: the consumer is the parent frame (in fred,
components/play-runner/element.js), not this repo. Its_onMessagefalls back to deriving the uuid from the origin subdomain when a message omitsuuid, so a parent that doesn't set the query param keeps working unchanged; one that sets it gets exact per-runner filtering.Related issues and pull requests
Part of #436.
Ports mdn/fred#150.