Add Drop Updates button to simulate transport failing to deliver messages

[jackaperkins]

This toggles a dropUpdates value inside of the webxdc shim for a particular instance. When new updates come in they will be 'dropped' and not passed into the application. This lets you test what happens when certain devices miss a message!

This doesn't permanently modify the set of updates, so any app the replays them starting from the beginning will see the 'dropped' updates after being restarted. Doing this would require a refactor where we keep track of each instance's update set independently and to properly enumerate them over the websocket connection, probably not worth it for now.

[hpk42]

lgtm

[Simon-Laux]

I think it is not clear enough that this is just a quirk of the current simulator implementation.

and some typos:

Suggested change

	on a specific instance. While enabled the instance will not recieve any updates
	as if the transport has failed to deliver them. On
	later reloads of the page the instance will load all updates as this state is
	shared identically between all insances.
	on a specific instance. While enabled the instance will not receive any updates
	as if the transport has failed to deliver them. On
	later reloads of the page the instance will load all updates as this state is
	shared identically between all instances.

[WofWca]

Looks quite simple overall, and I like the idea. It's an important thing.

[WofWca]

It would be nice not to copy-paste this code, especially if it's security-related

webxdc-dev/sim/webxdc.ts

Lines 136 to 147 in f2d1f43

	window.addEventListener("message", (event) => {
	const isAllowed =
	event.origin.includes("localhost:") ||
	(location.host.endsWith(".webcontainer.io") &&
	event.origin.includes(".webcontainer.io"));
	if (!isAllowed) {
	return;
	}
	if (event.data === "reload") {
	window.location.reload();
	}
	});

[hpk42]

On Fri, Dec 12, 2025 at 22:15 -0800, WofWca wrote: > + const isAllowed = + event.origin.includes("localhost:") || + (location.host.endsWith(".webcontainer.io") && + event.origin.includes(".webcontainer.io")); + if (!isAllowed) { + return; + } It would be nice not to copy-paste this code, especially if it's security-related

webxdc-dev is about testing/running your own app. What do you have in mind here when you say "security-related"?

[jackaperkins]

Welcome into the new year 😁 I've updated the PR.
I've improved the language in the readme slightly, but it is a complex thing to explain relative to how the backend works. Also factored the duplicated code into a function.

[WofWca]

What do you have in mind here when you say "security-related"?

The code I'm talking about is about security, protecting against unauthorized access. Any website can win = window.open('http://localhost:7000') and then win.postMessage. We must check whether the message is trusted.