Phase 4 Step 11: Browser features (find-in-page, CSP, clipboard, permissions)

[thomasnemer]

Parent: #41

Goal

Implement a set of browser-level features: find-in-page, Content Security Policy, clipboard paste, and permissions API. These four sub-tasks are independent and can be parallelized.

Prerequisites

• None (independent of other Phase 4 steps)

Implementation

11a: Find in Page (Ctrl+F)

• Search overlay UI triggered by Ctrl+F / Cmd+F
• Text search across the DOM with match highlighting
• Navigate between matches (next/previous)
• Scroll to current match
• Match count display

11b: Content Security Policy (CSP)

• Parse Content-Security-Policy HTTP header and <meta> tag
• Enforce directives: script-src, style-src, img-src, connect-src, font-src, frame-src, default-src, etc.
• Block resource loads that violate policy
• Report violations to the console

11c: Clipboard Paste

• Implement navigator.clipboard.read() and navigator.clipboard.readText()
• Gate clipboard access behind user gesture requirement
• Integration with platform clipboard via winit/arboard

11d: Permissions API

• Implement navigator.permissions.query() returning PermissionStatus
• Deny-by-default permission model
• Support permission names: clipboard-read, clipboard-write, notifications, etc.
• PermissionStatus.onchange event

Tests

• Find-in-page: search, highlight, navigation, scroll-to-match tests
• CSP: directive parsing, enforcement, and violation reporting tests
• Clipboard: read/readText with and without user gesture tests
• Permissions: query, deny-by-default, status change tests

Acceptance Criteria

• Ctrl+F opens find overlay, highlights matches, and scrolls to them
• CSP headers and meta tags are parsed and enforced correctly
• Clipboard paste only works with a user gesture
• navigator.permissions.query() returns correct permission states