Round 6's sweep of raw API.* calls that bypass Store entirely (a layer
none of the prior five rounds checked) found the most easily-triggered
gap yet: models.js's "Export settings..." button calls API.settingsCard
directly, a real unmocked POST /api/settings-card -- and it's on the
FIRST screen the tour's own "models-modal" step shows, no sidebar
navigation needed (unlike round 5's Combo Sweep panel, which needed a
click into Settings first). Fixed by mocking API.settingsCard with a real
Blob (the function resolves a Blob and feeds it straight to
URL.createObjectURL, so a JSON mock like every other entry uses would
break the button instead of blocking it) -- a 1x1 transparent PNG is
enough for the card to render.
Also closed the secondary finding: applyGlobalPromptQuiet has TWO
internal closure-scoped callers (setEditorSetting's anchorEnabled toggle,
applyPromptTemplate) besides its exported Store property -- the same
"block the export, miss the internal call" shape as commit()'s original
vulnerability, so a patchStore() block-list entry alone couldn't have
closed it. It reaches a real, unmocked API.parsePrompt call. Fixed with
the same root-cause pattern as commit()'s guard: a window.__FUNPACK_TOUR__
check directly inside the function, which also covers
scheduleGlobalPromptApply transitively since that just debounces into a
call to this same function.
Verified live: API.settingsCard resolves a real 68-byte PNG Blob (not an
error); toggling anchorEnabled and calling scheduleGlobalPromptApply
directly, waited past both debounce windows, zero prompt/expand or
settings-card requests in the network log; full tour sequence still
completes with zero thrown errors.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
