@agentrhq/webcmd 0.3.4 → 0.4.0

package/dist/src/build-manifest.test.js

@@ -428,4 +428,18 @@ describe('manifest helper rules', () => {
         // Unknown flags are ignored.
         expect(parseBuildManifestArgs(['--something-else']).allowRemovals).toBe(0);
     });
+    it('keeps every browser login on the local handoff contract', () => {
+        const manifest = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'cli-manifest.json'), 'utf8'));
+        const logins = manifest.filter((entry) => entry.browser === true && entry.name === 'login');
+        const keys = new Set(manifest.map((entry) => `${entry.site}/${entry.name}`));
+        expect(logins.length).toBeGreaterThan(0);
+        for (const login of logins) {
+            expect(login.args.some((arg) => arg.name === 'timeout'), `${login.site}/login`).toBe(false);
+            expect(login.description, `${login.site}/login`).not.toMatch(/wait until/i);
+            expect(login.columns, `${login.site}/login`).toEqual(expect.arrayContaining([
+                'status', 'logged_in', 'site', 'action', 'verify_command',
+            ]));
+            expect(keys.has(`${login.site}/whoami`), `${login.site}/whoami`).toBe(true);
+        }
+    });
 });

package/dist/src/docs-sync-review.js

@@ -98,7 +98,7 @@ const GENERAL_DOCUMENTATION = [
 const BROWSER_DOCUMENTATION = [
     'README.md',
     'docs/agent-prompts.mdx',
-    'docs/agent-runtime.mdx',
+    'docs/browser-and-sitemap-memory.mdx',
     'docs/cli-reference.mdx',
     'docs/concepts.mdx',
     'skills/webcmd-browser-sitemap/SKILL.md',
@@ -109,7 +109,7 @@ const ADAPTER_DOCUMENTATION = [
     'README.md',
     'docs/authoring.mdx',
     'docs/cli-reference.mdx',
-    'docs/plugins-and-skills.mdx',
+    'docs/skills.mdx',
     'skills/webcmd-adapter-author/SKILL.md',
     'skills/webcmd-usage/SKILL.md',
 ];

package/dist/src/docs-sync-review.test.js

@@ -87,7 +87,7 @@ describe('review context', () => {
         ])).toEqual([
             'README.md',
             'docs/agent-prompts.mdx',
-            'docs/agent-runtime.mdx',
+            'docs/browser-and-sitemap-memory.mdx',
             'docs/cli-reference.mdx',
             'docs/concepts.mdx',
             'skills/webcmd-browser-sitemap/SKILL.md',
@@ -100,7 +100,7 @@ describe('review context', () => {
             'README.md',
             'docs/authoring.mdx',
             'docs/cli-reference.mdx',
-            'docs/plugins-and-skills.mdx',
+            'docs/skills.mdx',
             'skills/webcmd-adapter-author/SKILL.md',
             'skills/webcmd-usage/SKILL.md',
         ]);

package/dist/src/hosted/main-lifecycle.test.js

@@ -6,6 +6,7 @@ import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { afterEach, describe, expect, it } from 'vitest';
+import { PKG_VERSION } from '../version.js';
 const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
 const entrypoint = path.join(packageRoot, 'src/main.ts');
 const largeOutput = 'hosted-lifecycle-chunk\n'.repeat(64 * 1024);
@@ -152,7 +153,7 @@ async function createHostedFixture(outcome) {
                     userId: 'user_lifecycle',
                     metadata: {
                         contractSchemaVersion: 1,
-                        webcmdPackageVersion: '0.3.0',
+                        webcmdPackageVersion: PKG_VERSION,
                         generatedAt: '2026-07-14T00:00:00.000Z',
                     },
                     commands: [command, authCommand],

package/dist/src/hosted/manifest.test.js

@@ -8,11 +8,12 @@ import { makeHostedConfig } from './config.js';
 import { runHostedCli } from './runner.js';
 import { formatRootHelp } from '../command-presentation.js';
 import { HOSTED_ROOT_HELP } from '../completion-shared.js';
+import { PKG_VERSION } from '../version.js';
 const manifest = {
     userId: 'user_demo',
     metadata: {
         contractSchemaVersion: 1,
-        webcmdPackageVersion: '0.3.0',
+        webcmdPackageVersion: PKG_VERSION,
         generatedAt: '2026-07-08T00:00:00.000Z',
     },
     commands: [

package/dist/src/hosted/output-parity.test.js

@@ -3,6 +3,7 @@ import { Command } from 'commander';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import { Strategy } from '../registry.js';
 import { registerCommandToProgram } from '../commanderAdapter.js';
+import { PKG_VERSION } from '../version.js';
 import { makeHostedConfig } from './config.js';
 import { runHostedCli } from './runner.js';
 const { mockExecuteCommand } = vi.hoisted(() => ({
@@ -26,7 +27,7 @@ const manifest = {
     userId: 'user_demo',
     metadata: {
         contractSchemaVersion: 1,
-        webcmdPackageVersion: '0.3.0',
+        webcmdPackageVersion: PKG_VERSION,
         generatedAt: '2026-07-14T00:00:00.000Z',
     },
     commands: [{

package/dist/src/hosted/root-command-surface.test.js

@@ -26,7 +26,7 @@ const manifest = {
     userId: 'user_demo',
     metadata: {
         contractSchemaVersion: 1,
-        webcmdPackageVersion: '0.3.0',
+        webcmdPackageVersion: PKG_VERSION,
         generatedAt: '2026-07-08T00:00:00.000Z',
     },
     commands: [{

package/dist/src/hosted/runner.test.js

@@ -9,13 +9,17 @@ import { rewriteBrowserArgv } from '../cli-argv-preprocess.js';
 import { createProgram } from '../cli.js';
 import { formatRootHelp } from '../command-presentation.js';
 import { HOSTED_ROOT_HELP } from '../completion-shared.js';
+import { PKG_VERSION } from '../version.js';
 import { makeHostedConfig } from './config.js';
 import { runHostedCli } from './runner.js';
+const [packageMajor, packageMinor] = PKG_VERSION.split('.');
+const compatiblePatchVersion = `${packageMajor}.${packageMinor}.99`;
+const incompatibleMinorVersion = `${packageMajor}.${Number(packageMinor) + 1}.0`;
 const manifest = {
     userId: 'user_demo',
     metadata: {
         contractSchemaVersion: 1,
-        webcmdPackageVersion: '0.3.0',
+        webcmdPackageVersion: PKG_VERSION,
         generatedAt: '2026-07-08T00:00:00.000Z',
     },
     commands: [
@@ -1084,7 +1088,7 @@ describe('runHostedCli', () => {
         const stdout = sink();
         const patchBumped = {
             ...manifest,
-            metadata: { ...manifest.metadata, webcmdPackageVersion: '0.3.99' },
+            metadata: { ...manifest.metadata, webcmdPackageVersion: compatiblePatchVersion },
         };
         const result = await runHostedCli(['github', 'whoami', '-f', 'json'], {
             config: makeHostedConfig({ apiBaseUrl: 'https://api.example.com', apiKey: 'key' }),
@@ -1108,7 +1112,7 @@ describe('runHostedCli', () => {
         const stderr = sink();
         const mismatched = {
             ...manifest,
-            metadata: { ...manifest.metadata, webcmdPackageVersion: '0.4.0' },
+            metadata: { ...manifest.metadata, webcmdPackageVersion: incompatibleMinorVersion },
         };
         const result = await runHostedCli(['github', 'whoami'], {
             config: makeHostedConfig({ apiBaseUrl: 'https://api.example.com', apiKey: 'key' }),
@@ -1527,7 +1531,7 @@ describe('runHostedCli', () => {
         const stderr = sink();
         const mismatched = {
             ...manifest,
-            metadata: { ...manifest.metadata, webcmdPackageVersion: '0.4.0' },
+            metadata: { ...manifest.metadata, webcmdPackageVersion: incompatibleMinorVersion },
         };
         const result = await runHostedCli(['browser', 'work', 'state'], {
             config: makeHostedConfig({ apiBaseUrl: 'https://api.example.com', apiKey: 'key' }),

package/dist/src/skills.test.js

@@ -42,6 +42,9 @@ function makePackageRoot(label = 'current') {
 function real(filePath) {
     return fs.realpathSync(filePath);
 }
+function bundledSkill(name) {
+    return fs.readFileSync(path.join(process.cwd(), 'skills', name, 'SKILL.md'), 'utf8');
+}
 describe('webcmd skills content', () => {
     it('keeps bundled skill frontmatter valid yaml', () => {
         const skillsRoot = path.join(process.cwd(), 'skills');
@@ -80,6 +83,57 @@ describe('webcmd skills content', () => {
             'webcmd-usage',
         ]);
     });
+    it('enforces mode-neutral authentication and human handoff policy', () => {
+        const browser = bundledSkill('webcmd-browser');
+        const usage = bundledSkill('webcmd-usage');
+        const autofix = bundledSkill('webcmd-autofix');
+        const author = bundledSkill('webcmd-adapter-author');
+        const skills = [browser, usage, autofix, author];
+        const handoffSkills = [browser, usage, autofix];
+        const autofixAuthRequired = autofix.match(/^- \*\*`AUTH_REQUIRED`\*\*[\s\S]*?(?=\n- \*\*)/m)?.[0] ?? '';
+        const autofixAuthRequiredRow = autofix.split('\n')
+            .find((line) => line.startsWith('| AUTH_REQUIRED |')) ?? '';
+        expect(browser).toContain('webcmd <site> login');
+        expect(browser).toContain('webcmd <site> whoami');
+        expect(browser).toContain('CAPTCHA');
+        expect(browser).toContain('fresh browser state');
+        expect(browser).not.toContain('hunter2');
+        expect(browser).not.toMatch(/browser login type/i);
+        expect(usage).toContain('AUTH_REQUIRED');
+        expect(usage).toContain('action_required');
+        expect(autofix).toContain('webcmd <site> login');
+        expect(author).toContain('registerSiteAuthCommands');
+        for (const skill of handoffSkills) {
+            expect(skill).toContain('handoff.status');
+            expect(skill).toContain('handoff.viewUrl');
+            expect(skill).toContain('handoff.verifyCommand');
+            expect(skill).toContain('Webcmd browser:');
+            expect(skill).not.toMatch(/\bhosted\b|\bKernel\b|\blocal mode\b|\blocally\b/i);
+        }
+        for (const skill of [browser, usage]) {
+            expect(skill).toContain('already_logged_in');
+            expect(skill).toContain('in_progress');
+            expect(skill).toContain('action_url');
+            expect(skill).toContain('view_url');
+            expect(skill).toMatch(/in_progress[^\n]*(?:do not ask the user|do not wait for user confirmation)/i);
+            expect(skill).toMatch(/(?:action_url|view_url|handoff\.viewUrl|Webcmd browser:)[\s\S]{0,300}user/i);
+        }
+        for (const skill of skills) {
+            expect(skill).toContain('action_required');
+            expect(skill).toContain('verify_command');
+            expect(skill).toMatch(/verify_command[\s\S]{0,250}verification must succeed[\s\S]{0,250}retry/i);
+            expect(skill).toMatch(/verify_command[\s\S]{0,250}user[\s\S]{0,250}(?:done|complet)/i);
+            expect(skill).toMatch(/CAPTCHA[\s\S]{0,250}(?:human handoff|stop(?:s)? automation)/i);
+            expect(skill).toMatch(/(?:must not|never).*?(?:password|secret|credential)/i);
+        }
+        for (const skill of [browser, usage, autofix]) {
+            expect(skill).toMatch(/(?:no (?:site )?login command|without a verifier)[\s\S]{0,500}fresh browser state[\s\S]{0,500}(?:identity check|post-action state)[\s\S]{0,250}before (?:any )?retry/i);
+        }
+        expect(autofixAuthRequired).toMatch(/if (?:a|the) site login command exists[\s\S]*webcmd <site> login[\s\S]*returned `verify_command`[\s\S]*verification must succeed[\s\S]*retry/i);
+        expect(autofixAuthRequired).toMatch(/no site login command[\s\S]*stop (?:browser )?writes[\s\S]*visible browser[\s\S]*fresh browser state[\s\S]*(?:identity check|post-action state)[\s\S]*before retry[\s\S]*report alone is not verification/i);
+        expect(autofixAuthRequiredRow).toMatch(/conditional[^|]*Safety Boundaries|no site login command/i);
+        expect(autofix).toMatch(/CAPTCHA[\s\S]{0,250}stop automation[\s\S]{0,250}verification must succeed/i);
+    });
     it('adds bundled skills once and refreshes them after package updates', () => {
         const firstRoot = makePackageRoot('first');
         const secondRoot = makePackageRoot('second');