Surface the context menu Chromium already builds (OSR)

[wenkaifan0720]

Right-click did nothing in an OSR tile. Not because the menu was missing — Chromium builds a complete, correctly-stateful one for every right-click (back/forward/reload, cut/copy/paste with the right items greyed out, view-source, copy-link-address, the whole spellcheck block with live dictionary suggestions) — but because no CefContextMenuHandler was implemented, so CEF constructed it and threw it away.

Approach

We can't let CEF display it: the default path is a native menu parented to a window, and a windowless browser has none. So RunContextMenu takes over display only:

1. Serialise the model Chromium built — labels, command ids, enabled/checked, separators, one level of submenu — plus hit context (coords, link url, media source, selection, misspelled word).
2. The host draws it as ordinary Flutter UI over the texture.
3. The chosen command id goes back and Chromium executes it.

That split matters: every command's behaviour and its enabled/checked state stays authoritative instead of being reimplemented. Paste greys out with an empty clipboard because Chromium said so, not because we guessed.

The invariant

Answer exactly once. CEF requires the menu callback be continued or cancelled; a dropped answer wedges the page's menu handling so later right-clicks are silently ignored. Every path answers, with 0 = dismiss:

• item chosen → that id
• handler returns null → 0
• no handler at all → 0
• handler throws → reported via FlutterError, then 0
• malformed JSON → reported, then 0

OnContextMenuDismissed drops pending entries, because CEF has already invalidated the callback by then and answering later would be a use-after-free.

Protocol

6 → 7. kOpContextMenu (0x20) up, kOpContextMenuCommand (0x3e) down. Both sides bumped in the same commit — a mismatch is a hard processGone(protocolMismatch), so they can never land separately.

Verification

• flutter analyze — clean (1 pre-existing unrelated info).
• flutter test — 178 pass (173 before + 5 new covering each answer-exactly-once path).
• Native compiles clean; the example app builds and runs with the new host, so the v7 handshake is confirmed live (host process alive under the example — a mismatch would have killed it).
• Example app wires a real menu so the seam is demonstrable rather than theoretical.

Not yet verified: an actual interactive right-click producing the menu. That needs a real click in a frontmost window — an agent shell can't do it reliably (OSR reports false freezes when not frontmost). The example app is built and running for exactly that check.

Note for consumers

main.mm changed, so the content hash moved: make publish-cef-host is required for the new hash before any consumer can make pin-cef to this commit.

🤖 Generated with Claude Code