@agentrhq/webcmd 0.3.4 → 0.4.1

package/dist/src/hosted/runner.test.js

@@ -9,13 +9,17 @@ import { rewriteBrowserArgv } from '../cli-argv-preprocess.js';
 import { createProgram } from '../cli.js';
 import { formatRootHelp } from '../command-presentation.js';
 import { HOSTED_ROOT_HELP } from '../completion-shared.js';
-import { makeHostedConfig } from './config.js';
+import { PKG_VERSION } from '../version.js';
+import { makeHostedConfig, makeLocalConfig } from './config.js';
 import { runHostedCli } from './runner.js';
+const [packageMajor, packageMinor] = PKG_VERSION.split('.');
+const compatiblePatchVersion = `${packageMajor}.${packageMinor}.99`;
+const incompatibleMinorVersion = `${packageMajor}.${Number(packageMinor) + 1}.0`;
 const manifest = {
     userId: 'user_demo',
     metadata: {
         contractSchemaVersion: 1,
-        webcmdPackageVersion: '0.3.0',
+        webcmdPackageVersion: PKG_VERSION,
         generatedAt: '2026-07-08T00:00:00.000Z',
     },
     commands: [
@@ -219,6 +223,131 @@ function captureLocalBrowserStructure(argv) {
     }
 }
 describe('runHostedCli', () => {
+    const publicProfile = {
+        id: 'profile_work',
+        name: 'Work',
+        userId: 'user_64256',
+        default: false,
+        status: 'available',
+        createdAt: '2026-07-24T00:00:00.000Z',
+        updatedAt: '2026-07-24T00:00:00.000Z',
+        lastUsedAt: '2026-07-24T00:00:00.000Z',
+    };
+    it('lists, creates, resolves, gets, and deletes hosted profiles without fetching the manifest', async () => {
+        const requests = [];
+        const fetchImpl = vi.fn(async (url, init) => {
+            const request = {
+                url: String(url),
+                method: init?.method ?? 'GET',
+                ...(init?.body ? { body: JSON.parse(String(init.body)) } : {}),
+            };
+            requests.push(request);
+            if (request.method === 'POST') {
+                return new Response(JSON.stringify({ ok: true, profile: publicProfile }), { status: 201 });
+            }
+            if (request.method === 'DELETE') {
+                return new Response(JSON.stringify({ ok: true, deleted: true }));
+            }
+            return new Response(JSON.stringify({ ok: true, profiles: [publicProfile] }));
+        });
+        for (const argv of [
+            ['profile', 'list', '-f', 'json'],
+            ['profile', 'create', 'Work', '--user-id', 'user_64256', '-f', 'json'],
+            ['profile', 'get', 'Work', '-f', 'json'],
+            ['profile', 'get', 'user_64256', '-f', 'json'],
+            ['profile', 'get', 'profile_work', '-f', 'json'],
+            ['profile', 'delete', 'profile_work', '-f', 'json'],
+        ]) {
+            const stdout = sink();
+            const stderr = sink();
+            const result = await runHostedCli(argv, {
+                config: makeHostedConfig({ apiBaseUrl: 'https://api.example.com', apiKey: 'key' }),
+                stdout: stdout.stream,
+                stderr: stderr.stream,
+                fetchImpl,
+            });
+            expect(result).toEqual({ handled: true, exitCode: 0 });
+            expect(stderr.text()).toBe('');
+            expect(stdout.text()).toContain(argv[1] === 'delete' ? '"deleted": true' : '"id": "profile_work"');
+        }
+        expect(requests).toEqual([
+            { url: 'https://api.example.com/v1/profiles', method: 'GET' },
+            {
+                url: 'https://api.example.com/v1/profiles',
+                method: 'POST',
+                body: { name: 'Work', userId: 'user_64256' },
+            },
+            { url: 'https://api.example.com/v1/profiles', method: 'GET' },
+            { url: 'https://api.example.com/v1/profiles', method: 'GET' },
+            { url: 'https://api.example.com/v1/profiles', method: 'GET' },
+            { url: 'https://api.example.com/v1/profiles/profile_work', method: 'DELETE' },
+        ]);
+        expect(requests.some(request => request.url.endsWith('/v1/manifest'))).toBe(false);
+    });
+    it('deduplicates universal profile matches and rejects missing or ambiguous selectors', async () => {
+        const cases = [
+            {
+                selector: 'same',
+                profiles: [{ ...publicProfile, id: 'profile_same', name: 'same', userId: 'same' }],
+                exitCode: 0,
+                stdout: '"id": "profile_same"',
+                stderr: '',
+            },
+            {
+                selector: 'missing',
+                profiles: [publicProfile],
+                exitCode: 66,
+                stdout: '',
+                stderr: 'code: PROFILE_NOT_FOUND',
+            },
+            {
+                selector: 'shared',
+                profiles: [
+                    { ...publicProfile, id: 'profile_one', name: 'shared' },
+                    { ...publicProfile, id: 'profile_two', name: 'Other', userId: 'shared' },
+                ],
+                exitCode: 75,
+                stdout: '',
+                stderr: 'code: AMBIGUOUS_PROFILE',
+            },
+        ];
+        for (const testCase of cases) {
+            const stdout = sink();
+            const stderr = sink();
+            const fetchImpl = vi.fn(async () => new Response(JSON.stringify({ ok: true, profiles: testCase.profiles })));
+            const result = await runHostedCli(['profile', 'get', testCase.selector, '-f', 'json'], {
+                config: makeHostedConfig({ apiBaseUrl: 'https://api.example.com', apiKey: 'key' }),
+                stdout: stdout.stream,
+                stderr: stderr.stream,
+                fetchImpl,
+            });
+            expect(result.exitCode).toBe(testCase.exitCode);
+            expect(stdout.text()).toContain(testCase.stdout);
+            expect(stderr.text()).toContain(testCase.stderr);
+            if (testCase.selector === 'shared') {
+                expect(stderr.text()).toContain('Use the immutable profile ID returned by webcmd profile list.');
+            }
+            expect(fetchImpl).toHaveBeenCalledTimes(1);
+        }
+    });
+    it.each(['rename', 'use'])('rejects local-only profile %s in hosted mode without an API call', async (command) => {
+        const stderr = sink();
+        const fetchImpl = vi.fn();
+        const result = await runHostedCli(['profile', command, 'value'], {
+            config: makeHostedConfig({ apiBaseUrl: 'https://api.example.com', apiKey: 'key' }),
+            stderr: stderr.stream,
+            fetchImpl,
+        });
+        expect(result).toEqual({ handled: true, exitCode: 78 });
+        expect(stderr.text()).toContain(`webcmd profile ${command} is not available in hosted mode.`);
+        expect(fetchImpl).not.toHaveBeenCalled();
+    });
+    it.each(['list', 'rename', 'use'])('leaves profile %s to the existing local command surface', async (command) => {
+        const result = await runHostedCli(['profile', command, 'value'], {
+            config: makeLocalConfig(),
+        });
+        expect(result).toEqual({ handled: false, exitCode: 0 });
+    });
     it.each([
         ['missing-site'],
         ['missing-site', 'child'],
@@ -1084,7 +1213,7 @@ describe('runHostedCli', () => {
         const stdout = sink();
         const patchBumped = {
             ...manifest,
-            metadata: { ...manifest.metadata, webcmdPackageVersion: '0.3.99' },
+            metadata: { ...manifest.metadata, webcmdPackageVersion: compatiblePatchVersion },
         };
         const result = await runHostedCli(['github', 'whoami', '-f', 'json'], {
             config: makeHostedConfig({ apiBaseUrl: 'https://api.example.com', apiKey: 'key' }),
@@ -1108,7 +1237,7 @@ describe('runHostedCli', () => {
         const stderr = sink();
         const mismatched = {
             ...manifest,
-            metadata: { ...manifest.metadata, webcmdPackageVersion: '0.4.0' },
+            metadata: { ...manifest.metadata, webcmdPackageVersion: incompatibleMinorVersion },
         };
         const result = await runHostedCli(['github', 'whoami'], {
             config: makeHostedConfig({ apiBaseUrl: 'https://api.example.com', apiKey: 'key' }),
@@ -1527,7 +1656,7 @@ describe('runHostedCli', () => {
         const stderr = sink();
         const mismatched = {
             ...manifest,
-            metadata: { ...manifest.metadata, webcmdPackageVersion: '0.4.0' },
+            metadata: { ...manifest.metadata, webcmdPackageVersion: incompatibleMinorVersion },
         };
         const result = await runHostedCli(['browser', 'work', 'state'], {
             config: makeHostedConfig({ apiBaseUrl: 'https://api.example.com', apiKey: 'key' }),

package/dist/src/hosted/types.d.ts

@@ -40,16 +40,23 @@ export interface HostedManifest {
     commands: HostedCommand[];
 }
 export interface HostedPublicProfile {
-    name: string;
+    id: string;
+    name: string | null;
+    userId: string | null;
     default: boolean;
-    status: 'available';
+    status: 'pending' | 'available';
     createdAt: string;
+    updatedAt: string;
     lastUsedAt: string;
 }
 export interface HostedProfilesResponse {
     ok: true;
     profiles: HostedPublicProfile[];
 }
+export interface HostedProfileResponse {
+    ok: true;
+    profile: HostedPublicProfile;
+}
 export interface HostedExecution {
     id: string;
     command: string;

package/dist/src/skills.test.js

@@ -42,6 +42,9 @@ function makePackageRoot(label = 'current') {
 function real(filePath) {
     return fs.realpathSync(filePath);
 }
+function bundledSkill(name) {
+    return fs.readFileSync(path.join(process.cwd(), 'skills', name, 'SKILL.md'), 'utf8');
+}
 describe('webcmd skills content', () => {
     it('keeps bundled skill frontmatter valid yaml', () => {
         const skillsRoot = path.join(process.cwd(), 'skills');
@@ -80,6 +83,57 @@ describe('webcmd skills content', () => {
             'webcmd-usage',
         ]);
     });
+    it('enforces mode-neutral authentication and human handoff policy', () => {
+        const browser = bundledSkill('webcmd-browser');
+        const usage = bundledSkill('webcmd-usage');
+        const autofix = bundledSkill('webcmd-autofix');
+        const author = bundledSkill('webcmd-adapter-author');
+        const skills = [browser, usage, autofix, author];
+        const handoffSkills = [browser, usage, autofix];
+        const autofixAuthRequired = autofix.match(/^- \*\*`AUTH_REQUIRED`\*\*[\s\S]*?(?=\n- \*\*)/m)?.[0] ?? '';
+        const autofixAuthRequiredRow = autofix.split('\n')
+            .find((line) => line.startsWith('| AUTH_REQUIRED |')) ?? '';
+        expect(browser).toContain('webcmd <site> login');
+        expect(browser).toContain('webcmd <site> whoami');
+        expect(browser).toContain('CAPTCHA');
+        expect(browser).toContain('fresh browser state');
+        expect(browser).not.toContain('hunter2');
+        expect(browser).not.toMatch(/browser login type/i);
+        expect(usage).toContain('AUTH_REQUIRED');
+        expect(usage).toContain('action_required');
+        expect(autofix).toContain('webcmd <site> login');
+        expect(author).toContain('registerSiteAuthCommands');
+        for (const skill of handoffSkills) {
+            expect(skill).toContain('handoff.status');
+            expect(skill).toContain('handoff.viewUrl');
+            expect(skill).toContain('handoff.verifyCommand');
+            expect(skill).toContain('Webcmd browser:');
+            expect(skill).not.toMatch(/\bhosted\b|\bKernel\b|\blocal mode\b|\blocally\b/i);
+        }
+        for (const skill of [browser, usage]) {
+            expect(skill).toContain('already_logged_in');
+            expect(skill).toContain('in_progress');
+            expect(skill).toContain('action_url');
+            expect(skill).toContain('view_url');
+            expect(skill).toMatch(/in_progress[^\n]*(?:do not ask the user|do not wait for user confirmation)/i);
+            expect(skill).toMatch(/(?:action_url|view_url|handoff\.viewUrl|Webcmd browser:)[\s\S]{0,300}user/i);
+        }
+        for (const skill of skills) {
+            expect(skill).toContain('action_required');
+            expect(skill).toContain('verify_command');
+            expect(skill).toMatch(/verify_command[\s\S]{0,250}verification must succeed[\s\S]{0,250}retry/i);
+            expect(skill).toMatch(/verify_command[\s\S]{0,250}user[\s\S]{0,250}(?:done|complet)/i);
+            expect(skill).toMatch(/CAPTCHA[\s\S]{0,250}(?:human handoff|stop(?:s)? automation)/i);
+            expect(skill).toMatch(/(?:must not|never).*?(?:password|secret|credential)/i);
+        }
+        for (const skill of [browser, usage, autofix]) {
+            expect(skill).toMatch(/(?:no (?:site )?login command|without a verifier)[\s\S]{0,500}fresh browser state[\s\S]{0,500}(?:identity check|post-action state)[\s\S]{0,250}before (?:any )?retry/i);
+        }
+        expect(autofixAuthRequired).toMatch(/if (?:a|the) site login command exists[\s\S]*webcmd <site> login[\s\S]*returned `verify_command`[\s\S]*verification must succeed[\s\S]*retry/i);
+        expect(autofixAuthRequired).toMatch(/no site login command[\s\S]*stop (?:browser )?writes[\s\S]*visible browser[\s\S]*fresh browser state[\s\S]*(?:identity check|post-action state)[\s\S]*before retry[\s\S]*report alone is not verification/i);
+        expect(autofixAuthRequiredRow).toMatch(/conditional[^|]*Safety Boundaries|no site login command/i);
+        expect(autofix).toMatch(/CAPTCHA[\s\S]{0,250}stop automation[\s\S]{0,250}verification must succeed/i);
+    });
     it('adds bundled skills once and refreshes them after package updates', () => {
         const firstRoot = makePackageRoot('first');
         const secondRoot = makePackageRoot('second');