@agentrhq/webcmd 0.3.3 → 0.4.0

package/dist/src/browser/runtime/local-cloak/provider.test.js

@@ -1,8 +1,8 @@
 import { describe, expect, it, vi } from 'vitest';
 import { LocalCloakRuntimeProvider } from './provider.js';
-function fakePage(url) {
+function fakePage(url, initialViewport = { width: 1280, height: 720 }) {
     let closed = false;
-    let viewportSize = { width: 1280, height: 720 };
+    let viewportSize = initialViewport;
     return {
         isClosed: vi.fn(() => closed),
         goto: vi.fn(async (nextUrl) => {
@@ -24,8 +24,9 @@ function fakePage(url) {
         }),
     };
 }
-function makeProviderWithFakePage() {
-    const pages = [fakePage('https://example.com/')];
+function makeProviderWithFakePage(initialViewport = { width: 1280, height: 720 }) {
+    const pages = [fakePage('https://example.com/', initialViewport)];
+    const cdpSession = { send: vi.fn().mockResolvedValue(undefined), detach: vi.fn().mockResolvedValue(undefined) };
     const context = {
         on: vi.fn(),
         pages: vi.fn(() => pages.filter((page) => !page.isClosed())),
@@ -34,6 +35,7 @@ function makeProviderWithFakePage() {
             pages.push(page);
             return page;
         }),
+        newCDPSession: vi.fn().mockResolvedValue(cdpSession),
         cookies: vi.fn().mockResolvedValue([{ name: 'sid', value: '1', domain: 'example.com', path: '/' }]),
         close: vi.fn().mockResolvedValue(undefined),
     };
@@ -41,7 +43,7 @@ function makeProviderWithFakePage() {
         baseDir: '/tmp/webcmd-test',
         launchPersistentContext: vi.fn().mockResolvedValue(context),
     });
-    return { provider, page: pages[0], pages, context };
+    return { provider, page: pages[0], pages, context, cdpSession };
 }
 describe('LocalCloakRuntimeProvider', () => {
     it('reports a runtime-named connected status before any profile launches', async () => {
@@ -66,6 +68,20 @@ describe('LocalCloakRuntimeProvider', () => {
         expect(result).toMatchObject({ id: 'cmd-1', ok: true, page: expect.any(String) });
         expect(page.goto).toHaveBeenCalledWith('https://example.com/', expect.objectContaining({ waitUntil: 'load' }));
     });
+    it("maps waitUntil 'none' to a commit-only navigation wait", async () => {
+        const { provider, page } = makeProviderWithFakePage();
+        const result = await provider.dispatch({
+            id: 'cmd-1',
+            action: 'navigate',
+            session: 'work',
+            surface: 'browser',
+            url: 'https://example.com/',
+            waitUntil: 'none',
+            profileId: 'default',
+        });
+        expect(result).toMatchObject({ id: 'cmd-1', ok: true, page: expect.any(String) });
+        expect(page.goto).toHaveBeenCalledWith('https://example.com/', expect.objectContaining({ waitUntil: 'commit' }));
+    });
     it('evaluates JavaScript in the resolved page', async () => {
         const { provider } = makeProviderWithFakePage();
         const nav = await provider.dispatch({ id: 'nav', action: 'navigate', session: 'work', surface: 'browser', url: 'https://example.com/', profileId: 'default' });
@@ -146,6 +162,18 @@ describe('LocalCloakRuntimeProvider', () => {
         expect(page.setViewportSize).toHaveBeenNthCalledWith(2, { width: 1280, height: 720 });
         expect(page.screenshot).toHaveBeenCalledTimes(1);
     });
+    it('reversibly overrides via CDP and never pins the viewport when the context has no fixed viewport', async () => {
+        const { provider, page, cdpSession } = makeProviderWithFakePage(null);
+        const nav = await provider.dispatch({ id: 'nav', action: 'navigate', session: 'work', surface: 'browser', url: 'https://example.com/', profileId: 'default' });
+        await provider.dispatch({ id: 'shot', action: 'screenshot', session: 'work', surface: 'browser', page: nav.page, format: 'png', width: 375, height: 812, profileId: 'default' });
+        // The override must not permanently pin the real window via setViewportSize (#120).
+        expect(page.setViewportSize).not.toHaveBeenCalled();
+        expect(cdpSession.send).toHaveBeenCalledWith('Emulation.setDeviceMetricsOverride', expect.objectContaining({ width: 375, height: 812 }));
+        // ...and it must be cleared afterward so the override is per-shot only.
+        expect(cdpSession.send).toHaveBeenCalledWith('Emulation.clearDeviceMetricsOverride');
+        expect(cdpSession.detach).toHaveBeenCalledTimes(1);
+        expect(page.screenshot).toHaveBeenCalledTimes(1);
+    });
     it('ignores screenshot height overrides for full-page captures while applying width', async () => {
         const { provider, page } = makeProviderWithFakePage();
         const nav = await provider.dispatch({ id: 'nav', action: 'navigate', session: 'work', surface: 'browser', url: 'https://example.com/', profileId: 'default' });

package/dist/src/build-manifest.js

@@ -348,8 +348,8 @@ async function main() {
     fs.mkdirSync(path.dirname(OUTPUT), { recursive: true });
     fs.writeFileSync(OUTPUT, artifacts.manifestJson);
     fs.writeFileSync(HOSTED_CONTRACT_OUTPUT, artifacts.hostedContractJson);
-    console.log(`✅ Manifest compiled: ${entries.length} entries → ${OUTPUT}`);
-    console.log(`✅ Hosted contract compiled: ${packageMetadata.name}@${packageMetadata.version} → ${HOSTED_CONTRACT_OUTPUT}`);
+    console.error(`✅ Manifest compiled: ${entries.length} entries → ${OUTPUT}`);
+    console.error(`✅ Hosted contract compiled: ${packageMetadata.name}@${packageMetadata.version} → ${HOSTED_CONTRACT_OUTPUT}`);
     // Restore executable permissions on bin entries.
     // tsc does not preserve the +x bit, so after a clean rebuild the CLI
     // entry-point loses its executable permission, causing "Permission denied".
@@ -366,7 +366,7 @@ async function main() {
                 const abs = path.resolve(projectRoot, binPath);
                 if (fs.existsSync(abs)) {
                     fs.chmodSync(abs, 0o755);
-                    console.log(`✅ Restored executable permission: ${binPath}`);
+                    console.error(`✅ Restored executable permission: ${binPath}`);
                 }
             }
         }

package/dist/src/build-manifest.test.js

@@ -428,4 +428,18 @@ describe('manifest helper rules', () => {
         // Unknown flags are ignored.
         expect(parseBuildManifestArgs(['--something-else']).allowRemovals).toBe(0);
     });
+    it('keeps every browser login on the local handoff contract', () => {
+        const manifest = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'cli-manifest.json'), 'utf8'));
+        const logins = manifest.filter((entry) => entry.browser === true && entry.name === 'login');
+        const keys = new Set(manifest.map((entry) => `${entry.site}/${entry.name}`));
+        expect(logins.length).toBeGreaterThan(0);
+        for (const login of logins) {
+            expect(login.args.some((arg) => arg.name === 'timeout'), `${login.site}/login`).toBe(false);
+            expect(login.description, `${login.site}/login`).not.toMatch(/wait until/i);
+            expect(login.columns, `${login.site}/login`).toEqual(expect.arrayContaining([
+                'status', 'logged_in', 'site', 'action', 'verify_command',
+            ]));
+            expect(keys.has(`${login.site}/whoami`), `${login.site}/whoami`).toBe(true);
+        }
+    });
 });

package/dist/src/docs-sync-review.js

@@ -98,7 +98,7 @@ const GENERAL_DOCUMENTATION = [
 const BROWSER_DOCUMENTATION = [
     'README.md',
     'docs/agent-prompts.mdx',
-    'docs/agent-runtime.mdx',
+    'docs/browser-and-sitemap-memory.mdx',
     'docs/cli-reference.mdx',
     'docs/concepts.mdx',
     'skills/webcmd-browser-sitemap/SKILL.md',
@@ -109,7 +109,7 @@ const ADAPTER_DOCUMENTATION = [
     'README.md',
     'docs/authoring.mdx',
     'docs/cli-reference.mdx',
-    'docs/plugins-and-skills.mdx',
+    'docs/skills.mdx',
     'skills/webcmd-adapter-author/SKILL.md',
     'skills/webcmd-usage/SKILL.md',
 ];

package/dist/src/docs-sync-review.test.js

@@ -87,7 +87,7 @@ describe('review context', () => {
         ])).toEqual([
             'README.md',
             'docs/agent-prompts.mdx',
-            'docs/agent-runtime.mdx',
+            'docs/browser-and-sitemap-memory.mdx',
             'docs/cli-reference.mdx',
             'docs/concepts.mdx',
             'skills/webcmd-browser-sitemap/SKILL.md',
@@ -100,7 +100,7 @@ describe('review context', () => {
             'README.md',
             'docs/authoring.mdx',
             'docs/cli-reference.mdx',
-            'docs/plugins-and-skills.mdx',
+            'docs/skills.mdx',
             'skills/webcmd-adapter-author/SKILL.md',
             'skills/webcmd-usage/SKILL.md',
         ]);

package/dist/src/hosted/main-lifecycle.test.js

@@ -6,6 +6,7 @@ import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { afterEach, describe, expect, it } from 'vitest';
+import { PKG_VERSION } from '../version.js';
 const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
 const entrypoint = path.join(packageRoot, 'src/main.ts');
 const largeOutput = 'hosted-lifecycle-chunk\n'.repeat(64 * 1024);
@@ -152,7 +153,7 @@ async function createHostedFixture(outcome) {
                     userId: 'user_lifecycle',
                     metadata: {
                         contractSchemaVersion: 1,
-                        webcmdPackageVersion: '0.3.0',
+                        webcmdPackageVersion: PKG_VERSION,
                         generatedAt: '2026-07-14T00:00:00.000Z',
                     },
                     commands: [command, authCommand],

package/dist/src/hosted/manifest.test.js

@@ -8,11 +8,12 @@ import { makeHostedConfig } from './config.js';
 import { runHostedCli } from './runner.js';
 import { formatRootHelp } from '../command-presentation.js';
 import { HOSTED_ROOT_HELP } from '../completion-shared.js';
+import { PKG_VERSION } from '../version.js';
 const manifest = {
     userId: 'user_demo',
     metadata: {
         contractSchemaVersion: 1,
-        webcmdPackageVersion: '0.3.0',
+        webcmdPackageVersion: PKG_VERSION,
         generatedAt: '2026-07-08T00:00:00.000Z',
     },
     commands: [

package/dist/src/hosted/output-parity.test.js

@@ -3,6 +3,7 @@ import { Command } from 'commander';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import { Strategy } from '../registry.js';
 import { registerCommandToProgram } from '../commanderAdapter.js';
+import { PKG_VERSION } from '../version.js';
 import { makeHostedConfig } from './config.js';
 import { runHostedCli } from './runner.js';
 const { mockExecuteCommand } = vi.hoisted(() => ({
@@ -26,7 +27,7 @@ const manifest = {
     userId: 'user_demo',
     metadata: {
         contractSchemaVersion: 1,
-        webcmdPackageVersion: '0.3.0',
+        webcmdPackageVersion: PKG_VERSION,
         generatedAt: '2026-07-14T00:00:00.000Z',
     },
     commands: [{

package/dist/src/hosted/root-command-surface.test.js

@@ -26,7 +26,7 @@ const manifest = {
     userId: 'user_demo',
     metadata: {
         contractSchemaVersion: 1,
-        webcmdPackageVersion: '0.3.0',
+        webcmdPackageVersion: PKG_VERSION,
         generatedAt: '2026-07-08T00:00:00.000Z',
     },
     commands: [{

package/dist/src/hosted/runner.test.js

@@ -9,13 +9,17 @@ import { rewriteBrowserArgv } from '../cli-argv-preprocess.js';
 import { createProgram } from '../cli.js';
 import { formatRootHelp } from '../command-presentation.js';
 import { HOSTED_ROOT_HELP } from '../completion-shared.js';
+import { PKG_VERSION } from '../version.js';
 import { makeHostedConfig } from './config.js';
 import { runHostedCli } from './runner.js';
+const [packageMajor, packageMinor] = PKG_VERSION.split('.');
+const compatiblePatchVersion = `${packageMajor}.${packageMinor}.99`;
+const incompatibleMinorVersion = `${packageMajor}.${Number(packageMinor) + 1}.0`;
 const manifest = {
     userId: 'user_demo',
     metadata: {
         contractSchemaVersion: 1,
-        webcmdPackageVersion: '0.3.0',
+        webcmdPackageVersion: PKG_VERSION,
         generatedAt: '2026-07-08T00:00:00.000Z',
     },
     commands: [
@@ -1084,7 +1088,7 @@ describe('runHostedCli', () => {
         const stdout = sink();
         const patchBumped = {
             ...manifest,
-            metadata: { ...manifest.metadata, webcmdPackageVersion: '0.3.99' },
+            metadata: { ...manifest.metadata, webcmdPackageVersion: compatiblePatchVersion },
         };
         const result = await runHostedCli(['github', 'whoami', '-f', 'json'], {
             config: makeHostedConfig({ apiBaseUrl: 'https://api.example.com', apiKey: 'key' }),
@@ -1108,7 +1112,7 @@ describe('runHostedCli', () => {
         const stderr = sink();
         const mismatched = {
             ...manifest,
-            metadata: { ...manifest.metadata, webcmdPackageVersion: '0.4.0' },
+            metadata: { ...manifest.metadata, webcmdPackageVersion: incompatibleMinorVersion },
         };
         const result = await runHostedCli(['github', 'whoami'], {
             config: makeHostedConfig({ apiBaseUrl: 'https://api.example.com', apiKey: 'key' }),
@@ -1527,7 +1531,7 @@ describe('runHostedCli', () => {
         const stderr = sink();
         const mismatched = {
             ...manifest,
-            metadata: { ...manifest.metadata, webcmdPackageVersion: '0.4.0' },
+            metadata: { ...manifest.metadata, webcmdPackageVersion: incompatibleMinorVersion },
         };
         const result = await runHostedCli(['browser', 'work', 'state'], {
             config: makeHostedConfig({ apiBaseUrl: 'https://api.example.com', apiKey: 'key' }),

package/dist/src/skills.test.js

@@ -42,6 +42,9 @@ function makePackageRoot(label = 'current') {
 function real(filePath) {
     return fs.realpathSync(filePath);
 }
+function bundledSkill(name) {
+    return fs.readFileSync(path.join(process.cwd(), 'skills', name, 'SKILL.md'), 'utf8');
+}
 describe('webcmd skills content', () => {
     it('keeps bundled skill frontmatter valid yaml', () => {
         const skillsRoot = path.join(process.cwd(), 'skills');
@@ -80,6 +83,57 @@ describe('webcmd skills content', () => {
             'webcmd-usage',
         ]);
     });
+    it('enforces mode-neutral authentication and human handoff policy', () => {
+        const browser = bundledSkill('webcmd-browser');
+        const usage = bundledSkill('webcmd-usage');
+        const autofix = bundledSkill('webcmd-autofix');
+        const author = bundledSkill('webcmd-adapter-author');
+        const skills = [browser, usage, autofix, author];
+        const handoffSkills = [browser, usage, autofix];
+        const autofixAuthRequired = autofix.match(/^- \*\*`AUTH_REQUIRED`\*\*[\s\S]*?(?=\n- \*\*)/m)?.[0] ?? '';
+        const autofixAuthRequiredRow = autofix.split('\n')
+            .find((line) => line.startsWith('| AUTH_REQUIRED |')) ?? '';
+        expect(browser).toContain('webcmd <site> login');
+        expect(browser).toContain('webcmd <site> whoami');
+        expect(browser).toContain('CAPTCHA');
+        expect(browser).toContain('fresh browser state');
+        expect(browser).not.toContain('hunter2');
+        expect(browser).not.toMatch(/browser login type/i);
+        expect(usage).toContain('AUTH_REQUIRED');
+        expect(usage).toContain('action_required');
+        expect(autofix).toContain('webcmd <site> login');
+        expect(author).toContain('registerSiteAuthCommands');
+        for (const skill of handoffSkills) {
+            expect(skill).toContain('handoff.status');
+            expect(skill).toContain('handoff.viewUrl');
+            expect(skill).toContain('handoff.verifyCommand');
+            expect(skill).toContain('Webcmd browser:');
+            expect(skill).not.toMatch(/\bhosted\b|\bKernel\b|\blocal mode\b|\blocally\b/i);
+        }
+        for (const skill of [browser, usage]) {
+            expect(skill).toContain('already_logged_in');
+            expect(skill).toContain('in_progress');
+            expect(skill).toContain('action_url');
+            expect(skill).toContain('view_url');
+            expect(skill).toMatch(/in_progress[^\n]*(?:do not ask the user|do not wait for user confirmation)/i);
+            expect(skill).toMatch(/(?:action_url|view_url|handoff\.viewUrl|Webcmd browser:)[\s\S]{0,300}user/i);
+        }
+        for (const skill of skills) {
+            expect(skill).toContain('action_required');
+            expect(skill).toContain('verify_command');
+            expect(skill).toMatch(/verify_command[\s\S]{0,250}verification must succeed[\s\S]{0,250}retry/i);
+            expect(skill).toMatch(/verify_command[\s\S]{0,250}user[\s\S]{0,250}(?:done|complet)/i);
+            expect(skill).toMatch(/CAPTCHA[\s\S]{0,250}(?:human handoff|stop(?:s)? automation)/i);
+            expect(skill).toMatch(/(?:must not|never).*?(?:password|secret|credential)/i);
+        }
+        for (const skill of [browser, usage, autofix]) {
+            expect(skill).toMatch(/(?:no (?:site )?login command|without a verifier)[\s\S]{0,500}fresh browser state[\s\S]{0,500}(?:identity check|post-action state)[\s\S]{0,250}before (?:any )?retry/i);
+        }
+        expect(autofixAuthRequired).toMatch(/if (?:a|the) site login command exists[\s\S]*webcmd <site> login[\s\S]*returned `verify_command`[\s\S]*verification must succeed[\s\S]*retry/i);
+        expect(autofixAuthRequired).toMatch(/no site login command[\s\S]*stop (?:browser )?writes[\s\S]*visible browser[\s\S]*fresh browser state[\s\S]*(?:identity check|post-action state)[\s\S]*before retry[\s\S]*report alone is not verification/i);
+        expect(autofixAuthRequiredRow).toMatch(/conditional[^|]*Safety Boundaries|no site login command/i);
+        expect(autofix).toMatch(/CAPTCHA[\s\S]{0,250}stop automation[\s\S]{0,250}verification must succeed/i);
+    });
     it('adds bundled skills once and refreshes them after package updates', () => {
         const firstRoot = makePackageRoot('first');
         const secondRoot = makePackageRoot('second');