[shannah]

Summary

Network-level content blocking on all three engines, in WebKit's content-blocker JSON format. Matching requests are refused before they are sent (block, block-cookies), and matching elements are hidden (css-display-none). This is the library half of a Brave-style ad blocker for agentic-app-framework's browser.

• WebViewContentRules compiles, looks up and removes a named list in a store directory the application chooses. The compiled list is kept there across launches. isSupported() reports whether the loaded native and engine can apply lists.
• WebViewComponent gains addContentRuleList, removeContentRuleList, removeAllContentRuleLists and getContentRuleLists. Lists added before display are applied before the first navigation. Popups inherit the opener's lists natively, and an adopted popup's component is seeded with them in Java.
• macOS: WKContentRuleListStore + addContentRuleList: on the view's WKUserContentController; lists are copied onto popup children at creation.
• Linux: WebKitUserContentFilterStore + webkit_user_content_manager_add_filter. The store symbols are optional loader symbols, so WebKitGTK older than 2.24 still loads and reports unsupported.
• Windows: WebView2 has no rule compiler.
  • A WebResourceRequested hook (* filter, added only once a list is applied) asks a portable Java matcher on every http(s)/ws(s) request: ContentRuleMatcher, indexed by 3-grams of each rule's required literal text.
  • Hide rules travel as one replaceable document-created script.
  • Popup children get the opener's hook (their own global ref) and script inside the NewWindowRequested deferral. Both are removed at adoption.

The SPDD documents are story 13, the analysis, and Canvas 37 (spdd/prompt/37-…-Block-Content-With-Rule-Lists.md).

Fixes found during on-device testing

• AWT before the JAWT preload (Canvas 8). WebViewNative's static initializer SIGSEGVed in libawt_lwawt JNI_OnLoad on macOS when it ran before AWT. This was latent until WebViewContentRules became a native entry point reachable before any Swing component exists. The initializer now calls Toolkit.getDefaultToolkit() first, except when headless.
• WKErrorDomain codes (Canvas 37 D12). The codes are LookUpFailed 7, RemoveFailed 8 and VersionMismatch 9. A lookup of a missing list, or of one compiled by another WebKit version, now answers null; removing a missing list completes normally.
• Windows 403 (Canvas 37 D9). WebView2 cannot fail a request with a network error from its request hook, so a blocked request is answered with HTTP 403. Nothing is sent, but the page's fetch() resolves with ok == false instead of rejecting. The demo's in-page check accepts either outcome, and the README documents it.

Known differences and limits (documented in the README and the Canvas)

• Windows third-party test: decided on an approximation of the public suffix list.
• Windows load-context: a rule limited to child-frame never matches, because the frame of a subresource is unknown.
• Windows make-https / notify: accepted and ignored.
• Windows blocked-request result: the page sees a 403 rather than a network error.
• Linux shared manager: an adopted popup shares its opener's content manager. Removing a list from either view removes it from both.
• Blocked-request reporting: not provided; no engine reports it portably.

Verification

• JUnit: mvn test passes, 311 tests including the new ContentRuleMatcherTest and ContentRuleSetTest. 50,000 rules decide 1,000 URLs well under a second.
• CRDEMO_AUTO=1 demo prints PASS on all three platforms:
  • Linux: xvfb-run -a env CRDEMO_AUTO=1 ./run-linux-content-rules-demo.sh (lightweight, the only Linux mode).
  • macOS: CRDEMO_AUTO=1 ./run-mac-content-rules-demo.sh on Apple Silicon (Corretto 8).
  • Windows: set CRDEMO_AUTO=1 then run-windows-content-rules-demo.bat on x64 (WebView2 156).
• The demo checks:
  • AC1/AC2/AC5: the /ads/ image, script and fetch beacon and the third-party script never reach the server; /ok/ and first-party requests do.
  • AC3: the ad slots are hidden.
  • AC6: lookup finds the stored list, and an unknown name answers null.
  • AC7: an invalid list is reported.
  • AC8: after removing the list and reloading, the blocked requests arrive.
  • Remove: lookup afterwards answers null.
• AC9 (adopted popups): not exercised by the auto demo on any platform.

Release note

Downstream, the agentic-app-framework ad blocker needs this release, and webview-run must re-shade it in lockstep before AAF's pins can move.

🤖 Generated with Claude Code

https://claude.ai/code/session_01SZMcbkWZkcYkmBAauwZXxZ