From ea4535a757095f42084fdb140c691a0f376df230 Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Sat, 7 Nov 2026 05:38:20 -0800
Subject: [PATCH 1/3] chore(quest): claim quest/m0/browser-offline.md

Quest-Claim: 30c4bce49d17de32

From 73ceb713fc1c28a2cd9782fc97ce45c5b354b4a4 Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Sat, 7 Nov 2026 06:45:52 -0800
Subject: [PATCH 2/3] fix(scene): browser sources request only what their pages
 load

The CEF helper asked Google, unprompted, for the network time, component
updates (the on-device AI model's manifest), a spellcheck dictionary, AI
Mode eligibility, and autofill predictions for each form. It now disables
NetworkTimeServiceQuerying, AutofillServerCommunication, and AimEnabled
(joined to CEF's own disabled features), points the component updater at
no server, and lists no spellcheck dictionaries. The browser suite routes
the helper through a proxy that fails the test on any request.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 README.md                        |  3 ++
 quest/m0/README.md               |  1 -
 quest/m0/browser-offline.md      | 24 ------------
 rs/moq-scene/src/browser/host.rs | 35 ++++++++++++++++++
 rs/moq-studio/tests/browser.rs   | 63 +++++++++++++++++++++++++++++++-
 5 files changed, 100 insertions(+), 26 deletions(-)
 delete mode 100644 quest/m0/browser-offline.md

diff --git a/README.md b/README.md
index f9cde43..d0b9c6b 100644
--- a/README.md
+++ b/README.md
@@ -327,6 +327,9 @@ stream carries on. A crash of the browser itself fails every browser source.
 Either shows at once, since the browser's processes dump no core. On Linux,
 pages run without Chromium's sandbox, as in OBS, so a page that exploits a
 browser bug can do anything you can: add only pages you trust.
+The browser requests only what its pages load, never asking Google for
+updates, the time, or autofill suggestions on its own, so pages are not
+spellchecked, which would need a dictionary from Google.
 **Reload** in Sources restarts a page, failed or not. A page's dropdown
 lists, such as a `<select>`'s, draw over it and take clicks under
 **Interact**, but it opens no other windows (`window.open` and new-tab links
diff --git a/quest/m0/README.md b/quest/m0/README.md
index 684b92f..3f20bf5 100644
--- a/quest/m0/README.md
+++ b/quest/m0/README.md
@@ -101,7 +101,6 @@ repository.
 - [Virtual camera](/quest/m0/vcam/README.md) - the program or a published scene exposed as a system camera on Linux, Windows, and macOS
 - [Browser sources on the GPU under Mesa](/quest/m0/cef-headless.md) - shared-texture pages paint on Intel and AMD under Wayland, and a page that cannot paint fails loudly
 - [The program reaches a relay on every runner](/quest/m0/relay-test-flake.md) - the relay engine test stops failing the nightly on GitHub's runner
-- [Browser sources make no outside requests](/quest/m0/browser-offline.md) - no component updates, spellcheck downloads, or network time from the helper
 - [moq-studio builds on its own](/quest/m0/studio-builds-alone.md) - `cargo build -p moq-studio` no longer leans on a test dependency's features
 - [Unpublishing a scene ends its broadcast cleanly](/quest/m0/unpublish-clean.md) - viewers get a clean finish, not `Unroutable`, when a scene stops publishing
 - [A media file's sound plays with its pictures](/quest/m0/media-av-sync.md) - media sources write a bus latency ahead, as broadcast sources do
diff --git a/quest/m0/browser-offline.md b/quest/m0/browser-offline.md
deleted file mode 100644
index 687aadc..0000000
--- a/quest/m0/browser-offline.md
+++ /dev/null
@@ -1,24 +0,0 @@
-# [S] Browser sources make no outside requests
-
-## Goal
-
-The CEF browser helper contacts only what its pages load: no component
-updates, spellcheck dictionary downloads, network time, or other background
-requests to Google. The browser suite asserts that no outside request is
-made.
-
-## Plan
-
-From [moq-dev/studio#78](https://github.com/moq-dev/studio/pull/78), picked
-2026-11-07 (maintainer away under /afk, recommended option), m0 by the rule
-that fixes join m0: each request is a privacy leak and a network dependency
-nobody asked for.
-
-Seen from the helper: the component updater (`update.googleapis.com`,
-`edgedl.me.gvt1.com`), the spellcheck dictionary (`redirector.gvt1.com`),
-network time (`clients2.google.com`), and `www.google.com/async/folae`.
-Chromium's switches, such as `--disable-component-update` and
-`--disable-background-networking`, and turning spellcheck off should stop
-them; confirm each one is gone rather than assuming. Pages run without
-Chromium's sandbox on Linux (decided on #78), so keep the helper's switches
-in one place.
diff --git a/rs/moq-scene/src/browser/host.rs b/rs/moq-scene/src/browser/host.rs
index 1f51216..a39ce7a 100644
--- a/rs/moq-scene/src/browser/host.rs
+++ b/rs/moq-scene/src/browser/host.rs
@@ -195,6 +195,11 @@ fn browse(shared: &Arc<Shared>, start: Start, reader: Channel, painted_tx: mpsc:
 		});
 	}
 
+	if let Err(err) = no_spellcheck() {
+		shutdown();
+		return Err(err);
+	}
+
 	// Pages asked for meanwhile open now.
 	inbox.up.store(true, Ordering::Release);
 	inbox.post(shared);
@@ -205,6 +210,20 @@ fn browse(shared: &Arc<Shared>, start: Start, reader: Channel, painted_tx: mpsc:
 	Ok(())
 }
 
+/// Spellcheck in no language. Chromium otherwise fetches the dictionary for
+/// the profile's language from Google, which no switch stops.
+fn no_spellcheck() -> Result<(), String> {
+	let context = request_context_get_global_context().ok_or("CEF has no profile")?;
+	let mut none = value_create().ok_or("CEF cannot create a value")?;
+	none.set_list(list_value_create().as_mut());
+	// CEF refuses to set anything without somewhere to say why it failed.
+	let mut error = CefString::from("unknown");
+	match context.set_preference(Some(&"spellcheck.dictionaries".into()), Some(&mut none), Some(&mut error)) {
+		1 => Ok(()),
+		_ => Err(format!("cannot turn off spellcheck: {error}")),
+	}
+}
+
 /// The studio's commands the UI thread has yet to apply.
 ///
 /// They wait coalesced, as in the studio, with one task at a time posted to
@@ -555,6 +574,22 @@ wrap_app! {
 			// which a user build lacks. Without either, the browser aborts
 			// rather than run unsandboxed, so the sandbox is off, as in OBS.
 			command_line.append_switch(Some(&"no-sandbox".into()));
+			// The browser requests only what its pages load. Otherwise it asks
+			// Google, unprompted, for the network time, for autofill's guesses
+			// at each form a page shows, and for whether AI Mode is offered.
+			// CEF disables features of its own, which ours join.
+			let disable = CefString::from("disable-features");
+			let theirs = CefString::from(&command_line.switch_value(Some(&disable))).to_string();
+			let ours = "NetworkTimeServiceQuerying,AutofillServerCommunication,AimEnabled";
+			let features = match theirs.is_empty() {
+				true => ours.to_string(),
+				false => format!("{theirs},{ours}"),
+			};
+			command_line.append_switch_with_value(Some(&disable), Some(&features.as_str().into()));
+			// Nor does it install components from Google: the updater's server is
+			// nowhere. `--disable-component-update` would leave the installers that
+			// ask for themselves, such as the on-device AI model's.
+			command_line.append_switch_with_value(Some(&"component-updater".into()), Some(&"url-source=data:".into()));
 			match &self.raster {
 				Raster::Gpu { render_node, display } => {
 					let platform = match display {
diff --git a/rs/moq-studio/tests/browser.rs b/rs/moq-studio/tests/browser.rs
index 4dc241e..2b7de37 100644
--- a/rs/moq-studio/tests/browser.rs
+++ b/rs/moq-studio/tests/browser.rs
@@ -5,6 +5,7 @@
 #![cfg(all(target_os = "linux", feature = "cef"))]
 
 use std::path::Path;
+use std::sync::{Arc, Mutex};
 use std::time::Duration;
 
 use kio::clock::Instant;
@@ -44,6 +45,12 @@ impl Studio {
 
 	/// A studio whose pages keep their cookies in `profile`.
 	async fn on(profile: &Path, sources: &[(&str, Source)]) -> Self {
+		Self::start(Path::new(env!("CARGO_BIN_EXE_moq-studio")), profile, sources).await
+	}
+
+	/// A studio whose helper is `program`, with its pages' cookies in
+	/// `profile`.
+	async fn start(program: &Path, profile: &Path, sources: &[(&str, Source)]) -> Self {
 		let instance = wgpu::Instance::default();
 		let adapter = instance
 			.request_adapter(&wgpu::RequestAdapterOptions::default())
@@ -73,7 +80,7 @@ impl Studio {
 		let (origin, driver) = moq_net::origin::Producer::new(Default::default());
 		tokio::spawn(moq_net::time::run(driver));
 		let (bus, mixer) = moq_audio::bus::Bus::new(Default::default()).unwrap();
-		let helper = Helper::new(env!("CARGO_BIN_EXE_moq-studio"), profile, &adapter, &device, &queue);
+		let helper = Helper::new(program, profile, &adapter, &device, &queue);
 		let mut sources = Sources::new(Context {
 			bus,
 			origin: origin.consume(),
@@ -699,6 +706,60 @@ async fn serve(html: &'static str) -> String {
 	url
 }
 
+/// The helper requests only what its pages load: nothing of its own, such as
+/// component updates, a spellcheck dictionary, the network time, or
+/// autofill's guesses at a page's text field.
+#[tokio::test(flavor = "multi_thread")]
+#[ignore = "needs CEF and a Vulkan device; run by just render-sw"]
+async fn the_helper_requests_only_its_pages() {
+	use std::os::unix::fs::PermissionsExt;
+	use tokio::io::AsyncBufReadExt;
+
+	// Everything off loopback goes through this proxy, which answers nothing
+	// and keeps each request's first line: `CONNECT host:443` for HTTPS, or
+	// the method and URL. Chromium sends loopback past a proxy, so the page
+	// still loads.
+	let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+	let proxy = listener.local_addr().unwrap();
+	let requests = Arc::new(Mutex::new(Vec::new()));
+	tokio::spawn({
+		let requests = requests.clone();
+		async move {
+			while let Ok((stream, _)) = listener.accept().await {
+				let mut line = String::new();
+				if tokio::io::BufReader::new(stream).read_line(&mut line).await.is_ok() {
+					requests.lock().unwrap().push(line.trim_end().to_string());
+				}
+			}
+		}
+	});
+	// The helper, told to use the proxy.
+	let dir = tempfile::tempdir().unwrap();
+	let program = dir.path().join("helper");
+	let script = format!(
+		"#!/bin/sh\nexec '{}' \"$@\" --proxy-server=http://{proxy}\n",
+		env!("CARGO_BIN_EXE_moq-studio")
+	);
+	std::fs::write(&program, script).unwrap();
+	std::fs::set_permissions(&program, std::fs::Permissions::from_mode(0o755)).unwrap();
+
+	local(async {
+		let url = serve("<body style='margin:0;background:lime'><textarea autofocus></textarea></body>").await;
+		let page = Source::Browser {
+			url,
+			width: 320,
+			height: 240,
+		};
+		let mut studio = Studio::start(&program, &dir.path().join("profile"), &[("page", page)]).await;
+		studio.until_center(GREEN, &[]).await;
+		// The browser asks for what it wants as it starts and as the page
+		// loads, so every request seen had begun by the time the page drew.
+		kio::clock::sleep(Duration::from_secs(2)).await;
+	})
+	.await;
+	assert_eq!(*requests.lock().unwrap(), Vec::<String>::new());
+}
+
 /// Where [`a_studio_that_dies`] keeps its pages' profile, which also tells it
 /// to run.
 const DYING: &str = "MOQ_STUDIO_TEST_DYING_PROFILE";

From d3e8b81f0193808013e4a427098a6480f60ef45e Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Sat, 7 Nov 2026 06:59:00 -0800
Subject: [PATCH 3/3] style(scene): name the spellcheck pref so the call fits a
 line

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 rs/moq-scene/src/browser/host.rs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/rs/moq-scene/src/browser/host.rs b/rs/moq-scene/src/browser/host.rs
index a39ce7a..0d2124a 100644
--- a/rs/moq-scene/src/browser/host.rs
+++ b/rs/moq-scene/src/browser/host.rs
@@ -218,7 +218,8 @@ fn no_spellcheck() -> Result<(), String> {
 	none.set_list(list_value_create().as_mut());
 	// CEF refuses to set anything without somewhere to say why it failed.
 	let mut error = CefString::from("unknown");
-	match context.set_preference(Some(&"spellcheck.dictionaries".into()), Some(&mut none), Some(&mut error)) {
+	let name = CefString::from("spellcheck.dictionaries");
+	match context.set_preference(Some(&name), Some(&mut none), Some(&mut error)) {
 		1 => Ok(()),
 		_ => Err(format!("cannot turn off spellcheck: {error}")),
 	}