@agentrhq/webcmd 0.2.5 → 0.3.1

package/clis/linkedin/company.js

@@ -0,0 +1,153 @@
+import { cli, Strategy } from '@agentrhq/webcmd/registry';
+import { ArgumentError, CommandExecutionError } from '@agentrhq/webcmd/errors';
+import {
+  LINKEDIN_DOMAIN,
+  assertLinkedInAuthenticated,
+  normalizeWhitespace,
+  unwrapEvaluateResult,
+} from './shared.js';
+
+const SLUG_RE = /^[A-Za-z0-9%._-]+$/;
+const COMPANY_URL_RE = /^\/company\/([^/?#]+)/;
+const LINKEDIN_COMPANY_HOSTS = new Set(['linkedin.com', LINKEDIN_DOMAIN]);
+
+function normalizeCompanyUrl(value) {
+  const raw = normalizeWhitespace(value);
+  if (!raw) throw new ArgumentError('LinkedIn company requires a company universal name or URL');
+
+  let slug = raw;
+  if (/^https?:\/\//i.test(raw) || raw.startsWith('/company/')) {
+    let parsed;
+    try {
+      parsed = raw.startsWith('/') ? new URL(raw, `https://${LINKEDIN_DOMAIN}`) : new URL(raw);
+    } catch {
+      throw new ArgumentError(`LinkedIn company received a malformed URL: ${raw}`);
+    }
+    if (parsed.protocol !== 'https:' || parsed.username || parsed.password || parsed.port
+      || !LINKEDIN_COMPANY_HOSTS.has(parsed.hostname.toLowerCase())) {
+      throw new ArgumentError('LinkedIn company URL must point to linkedin.com');
+    }
+    const match = parsed.pathname.match(COMPANY_URL_RE);
+    if (!match) throw new ArgumentError('LinkedIn company URL must look like /company/<name>');
+    try {
+      slug = decodeURIComponent(match[1]);
+    } catch {
+      throw new ArgumentError(`LinkedIn company URL has a malformed company slug: ${match[1]}`);
+    }
+  }
+  if (!SLUG_RE.test(slug)) {
+    throw new ArgumentError(`LinkedIn company name has unexpected characters: ${slug}`);
+  }
+  return `https://www.linkedin.com/company/${encodeURIComponent(slug)}/about/`;
+}
+
+function buildCompanyExtractionScript() {
+  return String.raw`(() => {
+    const clean = (s) => String(s || '').replace(/[  ]+/g, ' ').replace(/\s+/g, ' ').trim();
+    const facts = {};
+    for (const dt of Array.from(document.querySelectorAll('dt'))) {
+      const key = clean(dt.innerText || dt.textContent || '').toLowerCase().replace(/:$/, '');
+      const dd = dt.nextElementSibling;
+      const val = dd ? clean(dd.innerText || dd.textContent || '') : '';
+      if (key && val && !(key in facts)) facts[key] = val;
+    }
+    const name = clean((document.querySelector('main h1') || document.querySelector('h1'))?.innerText || '');
+    const bodyText = clean(document.body ? (document.body.innerText || '') : '');
+    const followersMatch = bodyText.match(/([\d,]+)\s+followers/i);
+    const aboutHeading = Array.from(document.querySelectorAll('main h2, section h2'))
+      .find((el) => /^About$|^Overview$/i.test(clean(el.innerText || '')));
+    const aboutSection = aboutHeading ? aboutHeading.closest('section') : null;
+    const about = aboutSection
+      ? clean((aboutSection.innerText || '').replace(/^About\s*/i, '').replace(/^Overview\s*/i, ''))
+      : '';
+    return {
+      url: window.location.href,
+      name,
+      industry: facts.industry || '',
+      size: facts['company size'] || '',
+      headquarters: facts.headquarters || '',
+      founded: facts.founded || '',
+      website: facts.website || '',
+      specialties: facts.specialties || '',
+      followers: followersMatch ? followersMatch[1].replace(/,/g, '') : '',
+      about: about.slice(0, 2000),
+    };
+  })()`;
+}
+
+function normalizeCompanyOutputUrl(value, fallbackUrl) {
+  const raw = normalizeWhitespace(value || fallbackUrl);
+  let parsed;
+  try {
+    parsed = new URL(raw, `https://${LINKEDIN_DOMAIN}`);
+  } catch {
+    throw new CommandExecutionError('LinkedIn company extraction returned a malformed current URL');
+  }
+  if (parsed.protocol !== 'https:' || parsed.username || parsed.password || parsed.port
+    || !LINKEDIN_COMPANY_HOSTS.has(parsed.hostname.toLowerCase())) {
+    throw new CommandExecutionError('LinkedIn company extraction ended on a non-LinkedIn page');
+  }
+  const match = parsed.pathname.match(COMPANY_URL_RE);
+  if (!match?.[1]) {
+    throw new CommandExecutionError('LinkedIn company extraction ended outside a company page');
+  }
+  let slug;
+  try {
+    slug = decodeURIComponent(match[1]);
+  } catch {
+    throw new CommandExecutionError('LinkedIn company extraction returned a malformed company slug');
+  }
+  return `https://${LINKEDIN_DOMAIN}/company/${encodeURIComponent(slug)}/about/`;
+}
+
+function normalizeCompanyInfo(info, targetUrl) {
+  if (!info || typeof info !== 'object' || Array.isArray(info)) {
+    throw new CommandExecutionError('LinkedIn company extraction returned a malformed payload');
+  }
+  if (!info.name) {
+    throw new CommandExecutionError('LinkedIn company page rendered but no company name was found (layout drift or company not found)');
+  }
+  let followers = 0;
+  if (info.followers) {
+    followers = Number(info.followers);
+    if (!Number.isFinite(followers)) {
+      throw new CommandExecutionError('LinkedIn company extraction returned a malformed followers count');
+    }
+  }
+  return {
+    name: String(info.name),
+    industry: String(info.industry || ''),
+    size: String(info.size || ''),
+    headquarters: String(info.headquarters || ''),
+    founded: String(info.founded || ''),
+    website: String(info.website || ''),
+    specialties: String(info.specialties || ''),
+    followers,
+    about: String(info.about || ''),
+    url: normalizeCompanyOutputUrl(info.url, targetUrl),
+  };
+}
+
+cli({
+  site: 'linkedin',
+  name: 'company',
+  access: 'read',
+  description: 'Read a LinkedIn company page: industry, size, HQ, founded, website, followers, and about text',
+  domain: LINKEDIN_DOMAIN,
+  strategy: Strategy.COOKIE,
+  browser: true,
+  args: [
+    { name: 'company', type: 'string', required: true, positional: true, help: 'Company universal name, /company/<name> path, or full URL' },
+  ],
+  columns: ['name', 'industry', 'size', 'headquarters', 'founded', 'website', 'specialties', 'followers', 'about', 'url'],
+  func: async (page, args) => {
+    const targetUrl = normalizeCompanyUrl(args.company);
+    await page.goto(targetUrl);
+    await page.wait(2);
+    await assertLinkedInAuthenticated(page, 'linkedin company');
+    const info = unwrapEvaluateResult(await page.evaluate(buildCompanyExtractionScript()));
+    return [normalizeCompanyInfo(info, targetUrl)];
+  },
+});
+
+export const __test__ = { normalizeCompanyUrl, normalizeCompanyInfo, buildCompanyExtractionScript };

package/clis/linkedin/company.test.js

@@ -0,0 +1,111 @@
+import { describe, expect, it, vi } from 'vitest';
+import { getRegistry } from '@agentrhq/webcmd/registry';
+import { ArgumentError, CommandExecutionError } from '@agentrhq/webcmd/errors';
+import './company.js';
+
+const { normalizeCompanyInfo, normalizeCompanyUrl } = await import('./company.js').then((module) => module.__test__);
+
+function makePage(evaluateResult) {
+  return {
+    goto: vi.fn().mockResolvedValue(undefined),
+    wait: vi.fn().mockResolvedValue(undefined),
+    evaluate: vi.fn()
+      .mockResolvedValueOnce(false)
+      .mockResolvedValueOnce(evaluateResult),
+  };
+}
+
+describe('linkedin company', () => {
+  it('registers the company command', () => {
+    const command = getRegistry().get('linkedin/company');
+    expect(command).toMatchObject({
+      access: 'read',
+      browser: true,
+      strategy: 'cookie',
+      columns: ['name', 'industry', 'size', 'headquarters', 'founded', 'website', 'specialties', 'followers', 'about', 'url'],
+    });
+  });
+
+  it('normalizes bare names, paths, and URLs to the about page', () => {
+    expect(normalizeCompanyUrl('nvidia')).toBe('https://www.linkedin.com/company/nvidia/about/');
+    expect(normalizeCompanyUrl('/company/nvidia')).toBe('https://www.linkedin.com/company/nvidia/about/');
+    expect(normalizeCompanyUrl('https://www.linkedin.com/company/databricks/'))
+      .toBe('https://www.linkedin.com/company/databricks/about/');
+  });
+
+  it('rejects invalid company identifiers as argument errors', () => {
+    for (const value of [
+      '',
+      'bad name!',
+      'https://www.linkedin.com/in/someone/',
+      'https://evil.example/company/nvidia/',
+      'https://www.linkedin.com/company/%E0%A4%A',
+    ]) {
+      expect(() => normalizeCompanyUrl(value)).toThrow(ArgumentError);
+    }
+  });
+
+  it('maps extracted company facts to a row', async () => {
+    const command = getRegistry().get('linkedin/company');
+    const page = makePage({
+      url: 'https://www.linkedin.com/company/nvidia/about/',
+      name: 'NVIDIA',
+      industry: 'Computer Hardware Manufacturing',
+      size: '10,001+ employees',
+      headquarters: 'Santa Clara, CA',
+      founded: '1993',
+      website: 'http://www.nvidia.com',
+      specialties: 'GPU, AI',
+      followers: '42040089',
+      about: 'Accelerated computing.',
+    });
+
+    await expect(command.func(page, { company: 'nvidia' })).resolves.toEqual([{
+      name: 'NVIDIA',
+      industry: 'Computer Hardware Manufacturing',
+      size: '10,001+ employees',
+      headquarters: 'Santa Clara, CA',
+      founded: '1993',
+      website: 'http://www.nvidia.com',
+      specialties: 'GPU, AI',
+      followers: 42040089,
+      about: 'Accelerated computing.',
+      url: 'https://www.linkedin.com/company/nvidia/about/',
+    }]);
+    expect(page.goto).toHaveBeenCalledWith('https://www.linkedin.com/company/nvidia/about/');
+  });
+
+  it('fails closed when no company name is found', async () => {
+    const command = getRegistry().get('linkedin/company');
+    const page = makePage({ url: 'https://www.linkedin.com/company/ghost/about/', name: '' });
+
+    await expect(command.func(page, { company: 'ghost' })).rejects.toBeInstanceOf(CommandExecutionError);
+  });
+
+  it('normalizes emitted URLs and rejects non-company extraction URLs', () => {
+    expect(normalizeCompanyInfo({
+      url: 'https://www.linkedin.com/company/nvidia/posts/?trk=public_profile',
+      name: 'NVIDIA',
+      followers: '123',
+    }, 'https://www.linkedin.com/company/nvidia/about/')).toMatchObject({
+      url: 'https://www.linkedin.com/company/nvidia/about/',
+      followers: 123,
+    });
+
+    for (const url of [
+      'https://www.linkedin.com/in/not-a-company/',
+      'https://evil.example/company/nvidia/',
+    ]) {
+      expect(() => normalizeCompanyInfo({ url, name: 'NVIDIA' }, 'https://www.linkedin.com/company/nvidia/about/'))
+        .toThrow(CommandExecutionError);
+    }
+  });
+
+  it('rejects malformed follower counts', () => {
+    expect(() => normalizeCompanyInfo({
+      url: 'https://www.linkedin.com/company/nvidia/about/',
+      name: 'NVIDIA',
+      followers: 'many',
+    }, 'https://www.linkedin.com/company/nvidia/about/')).toThrow(CommandExecutionError);
+  });
+});

package/clis/linkedin/connections.js

@@ -0,0 +1,135 @@
+import { cli, Strategy } from '@agentrhq/webcmd/registry';
+import { AuthRequiredError, CommandExecutionError, EmptyResultError } from '@agentrhq/webcmd/errors';
+import {
+  LINKEDIN_DOMAIN,
+  assertLinkedInAuthenticated,
+  normalizeWhitespace,
+  parseLimit,
+  requireLinkedInCookie,
+  unwrapEvaluateResult,
+} from './shared.js';
+
+const CONNECTIONS_PATH = '/voyager/api/relationships/connections';
+const PAGE_SIZE = 40;
+
+async function fetchConnections(url, csrf) {
+  try {
+    const response = await fetch(url, {
+      credentials: 'include',
+      headers: {
+        'csrf-token': csrf,
+        accept: 'application/json',
+        'x-restli-protocol-version': '2.0.0',
+      },
+    });
+    if (response.status === 401 || response.status === 403) {
+      return { authRequired: true, error: `HTTP ${response.status}` };
+    }
+    if (!response.ok) return { error: `HTTP ${response.status}` };
+
+    const contentType = response.headers?.get?.('content-type') || '';
+    if (/\btext\/html\b/i.test(contentType)) {
+      return { authRequired: true, error: 'HTML auth/checkpoint response' };
+    }
+    try {
+      return { json: await response.json() };
+    } catch {
+      return { error: 'response was not valid JSON' };
+    }
+  } catch (error) {
+    return { error: `fetch failed: ${error?.message || String(error)}` };
+  }
+}
+
+function optionalText(value, field) {
+  if (value == null) return '';
+  if (typeof value !== 'string') {
+    throw new CommandExecutionError(`LinkedIn connection miniProfile field ${field} was malformed`);
+  }
+  return normalizeWhitespace(value);
+}
+
+function mapConnection(element, index) {
+  const miniProfile = element?.miniProfile;
+  if (!miniProfile || typeof miniProfile !== 'object') {
+    throw new CommandExecutionError('LinkedIn connections returned an element without a miniProfile');
+  }
+  const publicId = optionalText(miniProfile.publicIdentifier, 'publicIdentifier');
+  if (!publicId || /[\s/?#]/.test(publicId)) {
+    throw new CommandExecutionError('LinkedIn connection element missing a stable public identifier');
+  }
+  const name = normalizeWhitespace([
+    optionalText(miniProfile.firstName, 'firstName'),
+    optionalText(miniProfile.lastName, 'lastName'),
+  ].filter(Boolean).join(' ')) || publicId;
+  return {
+    rank: index + 1,
+    name,
+    occupation: optionalText(miniProfile.occupation, 'occupation'),
+    public_id: publicId,
+    connected_at: Number.isFinite(element.createdAt) ? element.createdAt : 0,
+    url: `https://www.linkedin.com/in/${encodeURIComponent(publicId)}`,
+  };
+}
+
+cli({
+  site: 'linkedin',
+  name: 'connections',
+  access: 'read',
+  description: 'List your LinkedIn first-degree connections with names, headlines, and profile URLs',
+  domain: LINKEDIN_DOMAIN,
+  strategy: Strategy.COOKIE,
+  browser: true,
+  args: [
+    { name: 'limit', type: 'int', default: 20, help: 'Number of connections to return (max 500)' },
+  ],
+  columns: ['rank', 'name', 'occupation', 'public_id', 'connected_at', 'url'],
+  func: async (page, args) => {
+    const limit = parseLimit(args.limit, 20, 500);
+    await page.goto('https://www.linkedin.com/mynetwork/invite-connect/connections/');
+    await page.wait(2);
+    await assertLinkedInAuthenticated(page, 'linkedin connections');
+    const csrf = await requireLinkedInCookie(page, 'linkedin connections');
+    const rows = [];
+    let start = 0;
+
+    while (rows.length < limit) {
+      const remaining = limit - rows.length;
+      const count = remaining < PAGE_SIZE ? remaining : PAGE_SIZE;
+      const url = `${CONNECTIONS_PATH}?start=${start}&count=${count}`;
+      const fetched = unwrapEvaluateResult(
+        await page.evaluate(`(${fetchConnections.toString()})(${JSON.stringify(url)}, ${JSON.stringify(csrf)})`),
+      );
+      if (fetched?.authRequired) {
+        throw new AuthRequiredError(
+          LINKEDIN_DOMAIN,
+          `LinkedIn connections API authentication failed: ${fetched.error}`,
+        );
+      }
+      if (!fetched || fetched.error || !fetched.json) {
+        throw new CommandExecutionError(
+          `LinkedIn connections API returned an unexpected response: ${fetched?.error || 'no data'}`,
+        );
+      }
+      const elements = fetched.json.elements;
+      if (!Array.isArray(elements)) {
+        throw new CommandExecutionError('LinkedIn connections API returned a malformed payload: missing elements array');
+      }
+      if (elements.length === 0) break;
+
+      for (const element of elements) {
+        rows.push(mapConnection(element, rows.length));
+        if (rows.length >= limit) break;
+      }
+      start += elements.length;
+      if (elements.length < count) break;
+    }
+
+    if (rows.length === 0) {
+      throw new EmptyResultError('linkedin connections', 'No LinkedIn connections were found.');
+    }
+    return rows;
+  },
+});
+
+export const __test__ = { fetchConnections, mapConnection };

package/clis/linkedin/connections.test.js

@@ -0,0 +1,141 @@
+import { describe, expect, it, vi } from 'vitest';
+import { getRegistry } from '@agentrhq/webcmd/registry';
+import {
+  ArgumentError,
+  AuthRequiredError,
+  CommandExecutionError,
+  EmptyResultError,
+} from '@agentrhq/webcmd/errors';
+import './connections.js';
+
+const { mapConnection } = await import('./connections.js').then((module) => module.__test__);
+
+function makePage({ evaluateResults = [false], cookies = [{ name: 'JSESSIONID', value: '"ajax:12345"' }] } = {}) {
+  const evaluate = vi.fn();
+  for (const result of evaluateResults) evaluate.mockResolvedValueOnce(result);
+  return {
+    goto: vi.fn().mockResolvedValue(undefined),
+    wait: vi.fn().mockResolvedValue(undefined),
+    getCookies: vi.fn().mockResolvedValue(cookies),
+    evaluate,
+  };
+}
+
+const connection = (id) => ({
+  createdAt: 1700000000000 + id,
+  miniProfile: {
+    firstName: `First${id}`,
+    lastName: `Last${id}`,
+    occupation: `Job ${id}`,
+    publicIdentifier: `user${id}`,
+  },
+});
+
+describe('linkedin connections', () => {
+  it('registers the connections command', () => {
+    const command = getRegistry().get('linkedin/connections');
+    expect(command).toMatchObject({
+      access: 'read',
+      browser: true,
+      strategy: 'cookie',
+      columns: ['rank', 'name', 'occupation', 'public_id', 'connected_at', 'url'],
+    });
+  });
+
+  it('maps a connection element to a row', () => {
+    expect(mapConnection(connection(1), 0)).toEqual({
+      rank: 1,
+      name: 'First1 Last1',
+      occupation: 'Job 1',
+      public_id: 'user1',
+      connected_at: 1700000000001,
+      url: 'https://www.linkedin.com/in/user1',
+    });
+  });
+
+  it('requires a miniProfile with a stable public identity', () => {
+    expect(() => mapConnection({ createdAt: 1 }, 0)).toThrow(CommandExecutionError);
+    expect(() => mapConnection({
+      createdAt: 1,
+      miniProfile: { firstName: 'Only', lastName: 'Name' },
+    }, 0)).toThrow(CommandExecutionError);
+    expect(() => mapConnection({
+      createdAt: 1,
+      miniProfile: { firstName: 'Bad', lastName: 'Id', publicIdentifier: 'bad/id' },
+    }, 0)).toThrow(CommandExecutionError);
+  });
+
+  it('fails closed for malformed miniProfile scalar fields', () => {
+    expect(() => mapConnection({
+      createdAt: 1,
+      miniProfile: { firstName: { text: 'Alice' }, lastName: 'Example', publicIdentifier: 'alice' },
+    }, 0)).toThrow(CommandExecutionError);
+  });
+
+  it('returns rows from the Voyager connections API', async () => {
+    const command = getRegistry().get('linkedin/connections');
+    const page = makePage({ evaluateResults: [false, { json: { elements: [connection(1), connection(2)] } }] });
+
+    const rows = await command.func(page, { limit: 2 });
+
+    expect(rows.map((row) => row.public_id)).toEqual(['user1', 'user2']);
+    expect(page.evaluate.mock.calls[1][0]).toContain('/voyager/api/relationships/connections?start=0&count=2');
+    expect(page.evaluate.mock.calls[1][0]).toContain('ajax:12345');
+  });
+
+  it('paginates with bounded page sizes', async () => {
+    const command = getRegistry().get('linkedin/connections');
+    const firstPage = Array.from({ length: 40 }, (_, index) => connection(index + 1));
+    const page = makePage({
+      evaluateResults: [
+        false,
+        { json: { elements: firstPage } },
+        { json: { elements: [connection(41)] } },
+      ],
+    });
+
+    const rows = await command.func(page, { limit: 41 });
+
+    expect(rows).toHaveLength(41);
+    expect(page.evaluate.mock.calls[1][0]).toContain('?start=0&count=40');
+    expect(page.evaluate.mock.calls[2][0]).toContain('?start=40&count=1');
+  });
+
+  it('maps page and API authentication failures to AuthRequiredError', async () => {
+    const command = getRegistry().get('linkedin/connections');
+    await expect(command.func(makePage({ evaluateResults: [true] }), { limit: 2 }))
+      .rejects.toBeInstanceOf(AuthRequiredError);
+    await expect(command.func(makePage({ evaluateResults: [false], cookies: [] }), { limit: 2 }))
+      .rejects.toBeInstanceOf(AuthRequiredError);
+
+    for (const error of ['HTTP 403', 'HTML auth/checkpoint response']) {
+      const page = makePage({ evaluateResults: [false, { authRequired: true, error }] });
+      await expect(command.func(page, { limit: 2 })).rejects.toBeInstanceOf(AuthRequiredError);
+    }
+  });
+
+  it('fails closed for malformed API responses', async () => {
+    const command = getRegistry().get('linkedin/connections');
+    for (const result of [
+      { error: 'response was not valid JSON' },
+      { json: {} },
+    ]) {
+      const page = makePage({ evaluateResults: [false, result] });
+      await expect(command.func(page, { limit: 2 })).rejects.toBeInstanceOf(CommandExecutionError);
+    }
+  });
+
+  it('throws EmptyResultError when no connections are found', async () => {
+    const command = getRegistry().get('linkedin/connections');
+    const page = makePage({ evaluateResults: [false, { json: { elements: [] } }] });
+
+    await expect(command.func(page, { limit: 2 })).rejects.toBeInstanceOf(EmptyResultError);
+  });
+
+  it('rejects invalid limits', async () => {
+    const command = getRegistry().get('linkedin/connections');
+    for (const limit of [0, 501, 1.5]) {
+      await expect(command.func(makePage(), { limit })).rejects.toBeInstanceOf(ArgumentError);
+    }
+  });
+});

package/clis/mercury/reimbursement-draft.js

@@ -26,7 +26,18 @@ cli({
     defaultWindowMode: 'foreground',
     navigateBefore: false,
     args: [
-        { name: 'receipt', required: true, help: 'Local receipt/proof file path' },
+        {
+            name: 'receipt',
+            required: true,
+            help: 'Local receipt/proof file path',
+            file: {
+                direction: 'input',
+                pathKind: 'file',
+                multiple: false,
+                contentTypes: ['image/jpeg', 'image/png', 'image/gif', 'image/webp', 'application/pdf'],
+                maxBytes: 26_214_400,
+            },
+        },
         { name: 'amount', required: true, help: 'Original-currency amount, e.g. 140.00' },
         { name: 'currency', default: 'CNY', help: 'Original currency code' },
         { name: 'date', required: true, help: 'Expense date as YYYY-MM-DD' },

package/clis/slock/whoami.test.js

@@ -14,10 +14,10 @@ function makePage(authMe, status = 200) {
 describe('slock whoami', () => {
   const command = getRegistry().get('slock/whoami');
 
-  it('returns a normalized identity object from /auth/me on 200', async () => {
+  it('returns a normalized identity row from /auth/me on 200', async () => {
     const page = makePage({ id: 'u1', name: 'Alice', email: 'a@b.c' });
     const identity = await command.func(page, {});
-    expect(identity).toEqual({ logged_in: true, site: 'slock', id: 'u1', name: 'Alice', email: 'a@b.c' });
+    expect(identity).toEqual([{ logged_in: true, site: 'slock', id: 'u1', name: 'Alice', email: 'a@b.c' }]);
     expect(page.goto).toHaveBeenCalled();
   });
 });

package/clis/twitter/article-evaluate.test.js

@@ -0,0 +1,27 @@
+import { describe, expect, it } from 'vitest';
+import { getRegistry } from '@agentrhq/webcmd/registry';
+import { createPageMock } from '../test-utils.js';
+import './article.js';
+
+describe('twitter article evaluated arguments', () => {
+  it('serializes tweet-id before embedding it in page.evaluate', async () => {
+    const command = getRegistry().get('twitter/article');
+    const tweetId = '123"; window.__webcmdInjected = true; //';
+    const rows = [{
+      title: '(Note Tweet)',
+      author: 'alice',
+      content: 'hello',
+      url: 'https://x.com/alice/status/123',
+    }];
+    const page = createPageMock([null, rows], {
+      getCookies: async () => [{ name: 'ct0', value: 'csrf-token' }],
+    });
+
+    await expect(command.func(page, { 'tweet-id': tweetId })).resolves.toEqual(rows);
+
+    expect(page.goto).toHaveBeenCalledWith(`https://x.com/i/status/${tweetId}`);
+    const graphqlScript = page.evaluate.mock.calls[1][0];
+    expect(graphqlScript).toContain(`const tweetId = ${JSON.stringify(tweetId)};`);
+    expect(graphqlScript).not.toContain('const tweetId = "123"; window.__webcmdInjected = true; //";');
+  });
+});