suaveplan/openspec/changes/native-messaging/tasks.md

Tasks — native-messaging

Every checkbox MUST reflect work actually done in this change. Do not retroactively tick boxes for work that was already in main when this change opened. Do not tick a box for a test that doesn't exist or doesn't pin the requirement it claims to verify. Retroactive ticking is the failure mode this template guards against.

0. Pre-flight (non-negotiable)

• 0.1 Confirm clean working tree (git status reports nothing) and no in-flight worktrees with uncommitted work (git worktree list then git status in each)
• 0.2 If any worktrees exist under .claude/worktrees/, account for each one: still-active agent, work-pending-merge, or stale-and-prune. Stale worktrees MUST be removed (git worktree remove) before opening a new one — code that has been lost twice on main is the failure mode this guards against.
• 0.3 Confirm the package set in MANIFEST.md matches find packages -maxdepth 3 -name package.json count. Drift here means a prior change archived without regenerating the manifest.

1. Spec authoring

• 1.1 Read MIGRATION.md Sections 3.5, 4, 8, and 9 for package requirements and sequencing
• 1.2 Read openspec/AGENTS.md Sections 13 and 14
• 1.3 Draft proposal.md from openspec/templates/proposal.md
• 1.4 Draft specs/native-messaging/spec.md from openspec/templates/spec-delta.md
• 1.5 Every requirement in the spec delta carries a **Verified by:** line naming concrete it(...) titles

2. Implementation

• 2.1 Scaffold package at packages/plugin/native-messaging with package.json, tsconfig.json, vitest.config.ts
• 2.2 Implement Handshake class in src/handshake/handshake.ts using @suaveplan/crypto-curve X25519
• 2.3 Implement FrameEncoder / FrameDecoder in src/frame/frame.ts using @suaveplan/crypto-cipher ChaCha20-Poly1305
• 2.4 Implement ChromeTransport, FirefoxTransport, SafariTransport in src/transport/ with common Transport interface
• 2.5 Implement NativeMessagingClient in src/client/client.ts with typed request/response envelope
• 2.6 Implement NativeMessagingHost in src/host/host.ts with session-per-connection isolation
• 2.7 Implement ReconnectPolicy in src/reconnect/reconnect.ts with injectable Clock
• 2.8 Implement NativeMessagingError hierarchy in src/error/error.ts with error codes
• 2.9 Add subpath exports in package.json for every feature module
• 2.10 Wire Zod schemas at every external boundary (message parse, config validation)
• 2.11 Wire injectable Rng through Handshake options and transport config

3. Tests

• 3.1 Unit tests at src/handshake/handshake.test.ts covering every scenario
• 3.2 Unit tests at src/frame/frame.test.ts covering every scenario
• 3.3 Unit tests at src/transport/transport.test.ts covering every scenario
• 3.4 Unit tests at src/client/client.test.ts covering every scenario
• 3.5 Unit tests at src/host/host.test.ts covering every scenario
• 3.6 Unit tests at src/reconnect/reconnect.test.ts covering every scenario
• 3.7 Unit tests at src/error/error.test.ts covering every scenario
• 3.8 Spec-conformance tests at src/spec-conformance.test.ts pinning structural invariants
• 3.9 Integration / contract tests for full client-host encrypted round-trip
• 3.10 Every it(...) carries { timeout: 5000 } (or 30000 for genuinely async)
• 3.11 Property-based tests for frame encryption round-trip with random payloads

4. Documentation

• 4.1 Sibling .md for every implementation .ts (≥200 words, basic + advanced examples, full API reference)
• 4.2 README links every co-located .md under ## Modules
• 4.3 Update CLAUDE.md package listing

5. Pre-archive verification (the 5-gate triple)

• 5.1 bun run check — Biome 0 errors / 0 warnings / 0 info across the whole monorepo
• 5.2 bunx turbo lint typecheck test --filter=@suaveplan/native-messaging — green
• 5.3 bunx turbo test:coverage --filter=@suaveplan/native-messaging — 100/100/100/100
• 5.4 bun scripts/openspec-conformance.ts @suaveplan/native-messaging — exit 0, no error findings
• 5.5 bunx turbo build --filter=@suaveplan/native-messaging — green

6. Pre-archive 7-row checklist (AGENTS.md Section 13)

• 6.1 Generics threaded; expectTypeOf assertions on every literal-type claim
• 6.2 Zod schemas wired at every declared boundary
• 6.3 Every error code in error-codes.ts thrown by at least one production path
• 6.4 Strict-mode behaviors tested both on and off
• 6.5 OTel instruments emitted from production paths and asserted with a real in-memory MeterProvider
• 6.6 Lifecycle dedup tested where claimed (in-flight Promise, idempotent set/load)
• 6.7 No retroactive tick — every box above reflects work done in this change

7. Archive

• 7.1 Fold spec delta into openspec/specs/native-messaging/spec.md
• 7.2 Move openspec/changes/native-messaging/ → openspec/archive/2026-04-29-native-messaging/
• 7.3 Refresh MANIFEST.md if package set or deps changed