Add Web export preset and CI coverage for localStorage persistence path

[itsmiso-ai]

No Web export preset or CI coverage for localStorage/JavaScriptBridge persistence path

Fixes #316

Opened by foreman on review GO (workload wl-misospace-windowstead-316).

Superseded by a newer automated review for this pull request.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: dsv4f@https://litellm.jory.dev/v1 (openai) — primary route

Recommendation

Approve. This PR satisfies issue PR 316's acceptance criteria: it adds a Web export preset, an export-validation-web CI job, and extends the localStorage XSS tests to build and assert the exact eval'd statements. CI reports all checks green, including "Export validation (Web)".

Change-by-Change Findings

• .github/workflows/release.yml: New web job mirrors the existing export jobs (checksum-verified Godot and template download, headless Web export, artifact verification, zip, and release asset upload). Consistent with the repo's release pattern.
• .github/workflows/test.yml: New export-validation-web job performs a headless Web export and requires all four artifacts (.html, .pck, .wasm, .js) to be present and non-empty. This matches the issue's requested artifact-presence check.
• export_presets.cfg: Adds [preset.3] named "Web"; the CI --export-release "Web" matches the preset name. No user-controlled paths are introduced.
• scripts/game_state.gd: Extracts build_local_storage_write_eval, build_local_storage_read_eval, and build_local_storage_remove_eval static helpers, and routes JavaScriptBridge.eval calls through them. The JSON.stringify encoding is preserved, so the quote/backslash/backtick breakout protection from PR 306/PR 320 remains intact.
• tests/test_local_storage_xss.gd: Adds round-trip and single-call-shape assertions for the generated eval statements and refactors the old JSON.stringify assertions into the same harness. All assert_eq/assert_ne calls use the required 3-arg form.
• .uid files: Auto-generated Godot 4.7.1 UID sidecar files; expected with the recent toolchain bump.

Sources

• PR PR 327 metadata and body ("Fixes PR 316")
• Linked issue PR 316 and its acceptance criteria
• PR diff
• CI status: Headless smoke test, Script test suite, Export validation (Linux/Windows/macOS/Web), macOS validation — all success
• AGENTS.md / CLAUDE.md repository standards

Standards Compliance

• New tests comply with the AGENTS.md testing trap: all assert_eq/assert_ne calls pass the required name argument.
• The persistence change includes a corresponding test, satisfying CONTRIBUTING.md.
• The release workflow changes follow the existing tag-driven, checksum-verified pattern used by the Linux/Windows/macOS jobs.
• No deviation from documented repository conventions was detected.

Linked Issue Fit

• Acceptance: "Add a Web export preset to export_presets.cfg and an export-validation-web CI job (headless export + artifact presence check, mirroring the existing platform jobs)" — done.
• Acceptance (optional): "extend the XSS test to build and assert the exact eval'd statement strings produced by _local_storage_write/_local_storage_read/clear_game" — done via the new static helper functions and additional test flows.
• The extra release.yml web artifact upload addresses the problem statement's "release.yml uploads no web artifact" and is consistent with the issue.

Tool Harness Findings

• The tool harness section contains only a placeholder ("Tool harness planning pending") and produced no actionable findings. CI status from the commit API was used instead and is green.

Unknowns or Needs Verification

• The full release.yml job graph was not visible in the provided diff; the new web job's needs: validate dependency should be confirmed by running the manual release workflow once (the CI checks above validate test.yml, not release.yml).
• CI validates that Web artifacts are produced, but does not run the game in a browser; the localStorage/JavaScriptBridge runtime path remains unexercised in CI. This matches the issue's requested artifact-presence check and is not a blocker.

Must-Check Notes

• Path traversal: no user-controlled path handling is introduced in this diff; all file paths are fixed CI output paths and the static export_path in the preset.
• Edge-case paths (null bytes, symlinks): not applicable here — this PR does not add filesystem path construction from user input or modify desktop save-path handling.