merge: bring main (#568 web UI audit, #570) under the style-editor follow-ups

One conflict, in the style editor's hand-off script. #568 bounded the wait for
the widget bundle (retries, MAX_RETRIES, giveUp) and kept the value-diffing
fallbackIsDirty guard; this branch replaced that guard, because it raced the
font-selector widget on a plain page load and removed the editor with nobody
touching anything.

Resolved by keeping both halves that were right: #568's bounded retry, and the
isTrusted watcher in place of the value diff. No reference to fallbackIsDirty
remains, the guard still backs off for a genuine in-progress edit, and the
selective removal of only the widget's own blocks merged cleanly.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

test/web_interface/test_calendar_oauth_endpoints.py

@@ -99,9 +99,15 @@ class TestTheRoutesExistAtAll:
         assert "'google-oauth'" in allow_list_line[0], allow_list_line[0]
 
     def test_the_widget_script_is_served(self):
+        # Widgets load through one bundle (web_interface/widget_bundle.py), so
+        # the page must request the bundle and the bundle must carry the file.
+        from web_interface import widget_bundle
         base = (Path(project_root) / 'web_interface/templates/v3/base.html'
                 ).read_text(encoding='utf-8')
-        assert 'widgets/google-oauth.js' in base
+        assert 'widgets_bundle_url()' in base
+        assert 'google-oauth.js' in widget_bundle.BUNDLE_ORDER
+        body, _version = widget_bundle.build_bundle()
+        assert '/* google-oauth.js */' in body
 
     def test_the_status_line_is_announced(self):
         # Every message the widget gives arrives after an async call, so a

test/web_interface/test_gzip_fallback.py

@@ -0,0 +1,68 @@
+"""The stdlib gzip fallback must compress the UI's text assets.
+
+flask-compress is optional (app.py tolerates its absence). Without a fallback a
+Pi missing it ships ~1.2 MB of uncompressed JavaScript to a phone over WiFi on
+every first load and every update. These pin the fallback's contract: text
+assets compress and round-trip byte-for-byte, clients that don't ask for gzip
+get the original bytes, and small or non-text responses are left alone.
+"""
+
+import gzip
+from pathlib import Path
+
+import pytest
+
+STATIC = Path(__file__).resolve().parents[2] / "web_interface" / "static"
+
+
+@pytest.fixture
+def client(monkeypatch):
+    import web_interface.app as web_app
+    # Exercise the fallback even on machines that do have flask-compress.
+    monkeypatch.setattr(web_app, "_HAVE_FLASK_COMPRESS", False)
+    web_app.app.config["TESTING"] = True
+    with web_app.app.test_client() as c:
+        yield c
+
+
+@pytest.mark.parametrize("url,path", [
+    ("/static/v3/plugins_manager.js", "v3/plugins_manager.js"),
+    ("/static/v3/app.css", "v3/app.css"),
+])
+def test_static_text_asset_is_gzipped_and_round_trips(client, url, path):
+    resp = client.get(url, headers={"Accept-Encoding": "gzip, deflate"})
+    assert resp.status_code == 200
+    assert resp.headers.get("Content-Encoding") == "gzip"
+    assert "Accept-Encoding" in resp.headers.get("Vary", "")
+    original = (STATIC / path).read_bytes()
+    assert gzip.decompress(resp.data) == original
+    assert len(resp.data) < len(original) / 2
+    assert int(resp.headers["Content-Length"]) == len(resp.data)
+
+
+def test_repeat_request_serves_identical_compressed_bytes(client):
+    headers = {"Accept-Encoding": "gzip"}
+    first = client.get("/static/v3/js/app-shell.js", headers=headers).data
+    second = client.get("/static/v3/js/app-shell.js", headers=headers).data
+    assert first == second
+
+
+def test_client_without_gzip_gets_the_original_bytes(client):
+    resp = client.get("/static/v3/app.css", headers={"Accept-Encoding": "identity"})
+    assert resp.status_code == 200
+    assert "Content-Encoding" not in resp.headers
+    assert resp.data == (STATIC / "v3/app.css").read_bytes()
+
+
+def test_binary_assets_are_not_recompressed(client):
+    resp = client.get("/static/v3/icons/icon-192.png", headers={"Accept-Encoding": "gzip"})
+    assert resp.status_code == 200
+    assert "Content-Encoding" not in resp.headers
+
+
+def test_widget_bundle_is_gzipped_and_immutable(client):
+    resp = client.get("/assets/widgets.js", headers={"Accept-Encoding": "gzip"})
+    assert resp.status_code == 200
+    assert resp.headers.get("Content-Encoding") == "gzip"
+    assert "immutable" in resp.headers.get("Cache-Control", "")
+    assert b"/* registry.js */" in gzip.decompress(resp.data)

test/web_interface/test_plugin_widget_route.py

@@ -165,6 +165,27 @@ class TestPathTraversal:
         assert "hunter2" not in r.get_data(as_text=True)
 
 
+    def test_a_symlinked_widgets_directory_cannot_escape(self, tmp_path, make_client):
+        """widgets/ itself is contained before the script is resolved under it,
+        so a symlink out of the plugin can't become the containment base."""
+        outside = tmp_path / "outside"
+        outside.mkdir()
+        (outside / "loot.js").write_text("const KEY='hunter2';", encoding="utf-8")
+        d = tmp_path / "soccer-scoreboard"
+        d.mkdir()
+        manifest = {"id": "soccer-scoreboard", "name": "soccer-scoreboard",
+                    "version": "1.0.0",
+                    "widgets": [{"name": "loot", "script": "loot.js"}]}
+        (d / "manifest.json").write_text(json.dumps(manifest), encoding="utf-8")
+        try:
+            (d / "widgets").symlink_to(outside, target_is_directory=True)
+        except (OSError, NotImplementedError):
+            pytest.skip("symlinks unavailable on this platform")
+        r = make_client().get(URL.format("soccer-scoreboard", "loot"))
+        assert r.status_code == 404
+        assert "hunter2" not in r.get_data(as_text=True)
+
+
 class TestDegradation:
     def test_an_unknown_plugin_is_404(self, tmp_path, make_client):
         assert make_client().get(URL.format("nope", "w")).status_code == 404