vela-browser-testlisted

# Vela browser/sanitizer testing The principle for Vela security work: **a defense is only proven once a payload is fed through the real code and observed to be neutralized.** Reading source is not proof. This skill gives you the two layers needed to do that here. ## Environment facts (this remote-execution container) - **Prebuilt Chromium exists** under `/opt/pw-browsers/chromium-*/chrome-linux/chrome` (and a `headless_shell`). It is part of the image, so it survives across sessions. - **Playwright's browser-download CDN is blocked** — `npx playwright install` fails. Do NOT try to download a browser. Launch the existing one via `executablePath` and ignore Playwright's version pin: ```js const { chromium } = require("./node_modules/playwright"); // or playwright-core const b = await chromium.launch({ executablePath: "/opt/pw-browsers/chromium-XXXX/chrome-linux/chrome", args: ["--no-sandbox"] }); ``` (`scripts/browser-probe.cjs` auto-discovers the path — don't hardcode the build number.) - **`registry.npmjs.org` is reachable (200); general web is blocked (403).** So `npm install jsdom playwright` works, but the React/Babel/cdnjs CDNs that `app/local.html` pulls are blocked → **the full Vela app will not boot from CDN** in the browser. Test the rendered **sinks** (the markup Vela emits) directly, or vendor react/react-dom/@babel-standalone into `node_modules` and rewrite the `<script src>` tags to local paths if you truly need the whole app