[05/36] Add OC-040 runtime scripting support

[cjohnsto-nz]

---

This is part 17 of 21 in a stack made with GitButler:

•  21  [22/36] Release 0.8.0 with packaged PDF.js preview #54
•  20  [21/36] Complete OC-070 protocol surface polish #56
•  19  [20/36] Record final OpenCollection supervisor acceptance #53
•  18  [19/36] Add OC-110 runtime authoring UX #52
•  17  [18/36] Add OC-080 runtime lifecycle and OC-110 task setup #51
•  16  [16/36] Record OC-050 OC-090 OC-100 supervisor audit #50
•  15  [15/36] Add OC-050 auth and transport support #49
•  14  [14/36] Add OC-100 request type UX #48
•  13  [13/36] Add OC-100 request type UX task #47
•  12  [12/36] Add OC-080 and OC-090 task tracks #46
•  11  [11/36] Record OC-010 through OC-040 supervisor audit #45
•  10  [10/36] Add OC-020 WebSocket support #44
•  9  [09/36] Add OC-010 GraphQL support #43
•  8  [08/36] Require demo server fixtures for parallel tracks #42
•  7  [07/36] Record OC-000 and OC-060 supervisor audit #41
•  6  [06/36] Add OC-060 schema round-trip validation #40
•  5  [05/36] Add OC-040 runtime scripting support #39 <-- current
•  4  [04/36] Add OC-090 gRPC streaming support #38
•  3  [03/36] Add OC-030 gRPC unary protobuf support #37
•  2  [02/36] Add OC-000 protocol dispatch foundation #36
•  1  [01/36] Add OpenCollection agent plan #35

[APKiwi]

Verdict: request changes. The webview half of the feature is provably inert, and the new network client ships untested in this increment.

• Major: the webview runtime rendering never executes. src/webview/response.ts:560-561 looks up respRuntimeTab and runtimeResults, but neither element exists anywhere on this branch. The response tab bar (src/panels/requestPanel.ts:942-945) only declares resp-body/resp-headers/resp-preview, so the if (runtimeTab && runtimePanel) guard is always false and the entire ~90-line renderer is dead. Run a request with tests/assertions, open the response panel: no Runtime tab, no results. Only the text virtual-document path actually shows them. If the tab DOM lands in a later stacked PR, fine, but as an increment this is unreachable code.
• Major: 396-line WebSocketClient with zero test coverage here. The only test added covers the text formatter. URL validation, auth, secret resolution, timeout, cancellation, binary payloads, the message/close/error state machine: all untested in this PR. (I know coverage arrives later in the stack, noting for the increment.)
• Minor: per-request settings.timeout is ignored, webSocketClient.ts:130 reads only global missio.timeout. The demo fixtures set timeout: 5000 and it does nothing, HTTP honors per-request timeout.
• Minor: the binary payload heuristic base64-decodes any binary-typed message matching the base64 alphabet. Literal text like DEADBEEF silently decodes to garbage, non-multiple-of-4 lengths truncate.
• Minor: the single-message exchange model (socket closes after first inbound frame) is undocumented. A server that sends a greeting before the real reply gets only the greeting captured. Reasonable model, state it.
• Nit: basic auth emits Authorization: Basic (base64 of ":") even with both fields empty. _isAuthComplete exists but only gates the inherit path.
• Nit: the WS client and the runtime-results display are unrelated features in one PR titled "runtime scripting".

Positives worth keeping: esc() is a correct text-context escaper and every runtime value renders into element text, so server-controlled data is not an XSS vector here. rejectUnauthorized defaults true. The settle/finish guard is sound and secrets resolve after interpolation so they don't leak into the variables map.

Deps: none added, ws already present upstream.

[cjohnsto-nz]

Already addressed / not changing in this increment.

• Runtime results UI — already addressed. PR [09/36] Add OC-010 GraphQL support #43, commit cc721db, adds the respRuntimeTab and runtimeResults DOM and the runtime execution coverage. That is the exact later-stack owner of the UI integration; duplicating it into this base increment would only create stack churn.
• WebSocket coverage — already addressed. PR [10/36] Add OC-020 WebSocket support #44, commit 87caf31, adds the local fixture server, demo requests, and 580-line WebSocket test suite covering URL validation, auth and inherited headers, variables, binary frames, close/error behavior, cancellation, editor round-tripping, dispatch, tools, and schema validation.
• Binary decoding — fixed on the rework branch. Commit 4631068 removes the lossy fallback and rejects malformed/non-canonical base64 before opening a socket, with a regression test. A valid string such as DEADBEEF is still decoded as base64 intentionally: type: binary uses base64 string data, matching the inbound representation and PR [10/36] Add OC-020 WebSocket support #44 binary round-trip test.
• Single-message lifecycle — already addressed. PR [29/36] Add OC-140 WebSocket lifecycle UX #61, commit a298aac, adds persistent connect/send/disconnect sessions, repeated sends, server-push history, UI controls, Copilot tooling, fixtures, and tests. The one-shot behavior in this increment is therefore an intermediate implementation, not the final lifecycle.
• Per-request timeout — not changing this. WebSocketRequest in the OpenCollection schema has only info, websocket, runtime, and docs, with additionalProperties: false; it has no settings.timeout. The WebSocket client therefore correctly uses the global missio.timeout. None of the committed WebSocket demo requests declares a request timeout.
• Empty Basic auth — not changing this. Explicit Basic auth serializes username:password, including : when both values are blank, and matches the existing HTTP client. _isAuthComplete only decides whether forced collection auth is eligible to override request auth; it is not an auth-validation gate.
• PR scope — no history rewrite. The WebSocket client landed here as shared stack scaffolding and its functional OC-020 owner is PR [10/36] Add OC-020 WebSocket support #44. Moving it now would rewrite every intervening branch for no behavioral benefit.

For a stacked series, functionality that has an exact later owner is not missing from the delivered stack merely because this intermediate diff is not independently feature-complete. PR #39 and immediate child PR #40 are currently MERGEABLE/CLEAN with successful checks. The rework fix passes TypeScript compilation and the full suite: 25 files, 493 tests.