@amg555/frameforge-mcp 2.7.6 → 2.7.7

package/.agent/skills/gstack-browse/test/restart-env.test.ts

@@ -1,39 +0,0 @@
-import { describe, test, expect } from "bun:test";
-import { buildRestartEnv } from "../src/cli";
-
-// #1781: an auto-restart triggered by a plain command (no --headed flag) must
-// NOT silently downgrade a headed session to headless. buildRestartEnv reapplies
-// headed/proxy/configHash from this invocation OR the persisted server state.
-describe("buildRestartEnv (#1781 headed persistence)", () => {
-  const headedState = { pid: 1, port: 9, token: "t", startedAt: "", serverPath: "", mode: "headed" as const };
-  const launchedState = { pid: 1, port: 9, token: "t", startedAt: "", serverPath: "", mode: "launched" as const };
-
-  test("headed flag on this invocation → BROWSE_HEADED=1", () => {
-    expect(buildRestartEnv({ headed: true } as any, null).BROWSE_HEADED).toBe("1");
-  });
-
-  test("plain command + persisted headed state → still BROWSE_HEADED=1 (the regression)", () => {
-    const env = buildRestartEnv({} as any, headedState as any);
-    expect(env.BROWSE_HEADED).toBe("1");
-  });
-
-  test("plain command + headless state → no BROWSE_HEADED (no spurious headed)", () => {
-    const env = buildRestartEnv({} as any, launchedState as any);
-    expect(env.BROWSE_HEADED).toBeUndefined();
-  });
-
-  test("nothing set → empty env", () => {
-    expect(buildRestartEnv(null, null)).toEqual({});
-  });
-
-  test("proxy + configHash reapplied from flags", () => {
-    const env = buildRestartEnv({ proxyUrl: "socks5://x", configHash: "abc" } as any, null);
-    expect(env.BROWSE_PROXY_URL).toBe("socks5://x");
-    expect(env.BROWSE_CONFIG_HASH).toBe("abc");
-  });
-
-  test("configHash falls back to persisted state", () => {
-    const env = buildRestartEnv({} as any, { ...launchedState, configHash: "fromstate" } as any);
-    expect(env.BROWSE_CONFIG_HASH).toBe("fromstate");
-  });
-});

package/.agent/skills/gstack-browse/test/route-test-harness.ts

@@ -1,121 +0,0 @@
-/**
- * Shared seams for behavioral browse route tests.
- *
- * makeServer() builds a real buildFetchHandler() instance over a temp state
- * dir; callRoute() runs one route-table entry's real handler against a stub
- * RouteContext, so a test can observe what the handler asks of the daemon
- * (terminal grants, tunnel probes, command dispatch) without a live
- * terminal-agent, ngrok or browser.
- */
-
-import * as crypto from 'crypto';
-import * as fs from 'node:fs';
-import * as os from 'node:os';
-import * as path from 'node:path';
-import { buildFetchHandler, type ServerConfig, type ServerHandle } from '../src/server';
-import { ROUTES } from '../src/routes';
-import type { RouteContext, RouteEntry, Surface } from '../src/routes/table';
-import { __resetRegistry, createToken, type ScopeCategory, type TokenInfo } from '../src/token-registry';
-import { BrowserManager } from '../src/browser-manager';
-import { resolveConfig } from '../src/config';
-
-export interface TestServer {
-  handle: ServerHandle;
-  rootToken: string;
-  local(urlPath: string, init?: RequestInit): Promise<Response>;
-  tunnel(urlPath: string, init?: RequestInit): Promise<Response>;
-  scopedToken(clientId?: string, scopes?: ScopeCategory[]): string;
-  cleanup(): void;
-}
-
-export function makeServer(opts: { browserManager?: BrowserManager; beforeRoute?: ServerConfig['beforeRoute'] } = {}): TestServer {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-route-harness-'));
-  __resetRegistry();
-  const rootToken = 'route-harness-' + crypto.randomBytes(16).toString('hex');
-  const handle = buildFetchHandler({
-    authToken: rootToken,
-    browsePort: 34567,
-    config: resolveConfig({ BROWSE_STATE_FILE: path.join(dir, 'state/browse.json') }),
-    browserManager: opts.browserManager ?? new BrowserManager(),
-    ownsTerminalAgent: false,
-    startTime: Date.now(),
-    beforeRoute: opts.beforeRoute,
-  });
-  const request = (urlPath: string, init?: RequestInit) => new Request(`http://127.0.0.1:34567${urlPath}`, init);
-  return {
-    handle,
-    rootToken,
-    local: (urlPath, init) => handle.fetchLocal(request(urlPath, init), null),
-    tunnel: (urlPath, init) => handle.fetchTunnel(request(urlPath, init), null),
-    scopedToken: (clientId = 'harness-agent', scopes = ['read', 'write']) => createToken({ clientId, scopes }).token,
-    cleanup: () => fs.rmSync(dir, { recursive: true, force: true }),
-  };
-}
-
-const unexpected = (name: string) => () => { throw new Error(`route handler unexpectedly called ctx.${name}`); };
-
-/** A RouteContext whose every dependency throws unless the test supplies it. */
-export function stubRouteContext(overrides: Partial<RouteContext> = {}): RouteContext {
-  return {
-    browserManager: {} as BrowserManager,
-    startTime: Date.now(),
-    browsePort: 34567,
-    validateAuth: () => true,
-    isRootRequest: () => true,
-    getTokenInfo: () => null,
-    hasSseCookie: () => false,
-    isPinnedExtensionRequest: () => false,
-    isRootTokenValue: () => false,
-    bootstrapRootToken: 'stub-root-token-0123456789',
-    resetIdleTimer: unexpected('resetIdleTimer'),
-    terminal: {
-      readPort: unexpected('terminal.readPort'),
-      grantToken: unexpected('terminal.grantToken'),
-      restartSession: unexpected('terminal.restartSession'),
-    },
-    tunnel: {
-      state: unexpected('tunnel.state'),
-      close: unexpected('tunnel.close'),
-      resolveAuthtoken: unexpected('tunnel.resolveAuthtoken'),
-      start: unexpected('tunnel.start'),
-    },
-    commands: { handle: unexpected('commands.handle'), handleInternal: unexpected('commands.handleInternal') },
-    ...overrides,
-  };
-}
-
-export function routeEntry(method: string, urlPath: string, surface: Surface = 'local'): RouteEntry {
-  const entry = ROUTES.find(r =>
-    r.surfaces.includes(surface)
-    && (r.method === '*' || r.method === method)
-    && (r.prefix ? urlPath.startsWith(r.path) : urlPath === r.path));
-  if (!entry) throw new Error(`no route-table entry for ${method} ${urlPath}`);
-  return entry;
-}
-
-/** Runs one entry's real handler (the auth gate is not involved). */
-export async function callRoute(
-  method: string,
-  urlPathAndQuery: string,
-  ctx: RouteContext,
-  init: { headers?: Record<string, string>; body?: unknown; surface?: Surface; tokenInfo?: TokenInfo | null } = {},
-): Promise<Response> {
-  const url = new URL(`http://127.0.0.1:34567${urlPathAndQuery}`);
-  const body = init.body === undefined ? undefined : typeof init.body === 'string' ? init.body : JSON.stringify(init.body);
-  const req = new Request(url, { method, headers: init.headers, body });
-  const surface = init.surface ?? 'local';
-  return routeEntry(method, url.pathname, surface).handler(req, { url, surface, tokenInfo: init.tokenInfo ?? null }, ctx);
-}
-
-/** A throwaway HTTP server standing in for an ngrok tunnel URL; records each request. */
-export function fakeTunnel(connectStatus: number): { url: string; hits: string[]; stop(): void } {
-  const hits: string[] = [];
-  const srv = Bun.serve({
-    port: 0, hostname: '127.0.0.1',
-    fetch: (req) => {
-      hits.push(`${req.method} ${new URL(req.url).pathname}`);
-      return new Response('{}', { status: connectStatus });
-    },
-  });
-  return { url: `http://127.0.0.1:${srv.port}`, hits, stop: () => srv.stop(true) };
-}

package/.agent/skills/gstack-browse/test/runtime-root-server-bundle.test.ts

@@ -1,100 +0,0 @@
-/**
- * A Windows host runtime root (~/.codex/skills/gstack and the other env-var
- * hosts) holds a copy of browse/dist with no node_modules, so its CLI starts
- * the source checkout's Node server bundle named by .source-path, and refuses
- * when the two come from different builds. Windows-safe (os.tmpdir paths
- * only), so the curated Windows lane runs it natively.
- */
-import { describe, expect, test } from 'bun:test';
-import * as path from 'path';
-
-describe('#3026: a Windows runtime root without node_modules runs the source checkout bundle', () => {
-  const { resolveNodeServerScript } = require('../src/cli');
-  const fs = require('fs');
-  const os = require('os');
-
-  function layout(opts: { runtimeModules: boolean; sourcePath: boolean; sourceModules: boolean }) {
-    const base = fs.mkdtempSync(path.join(os.tmpdir(), 'browse-runtime-root-'));
-    const source = path.join(base, 'gstack');
-    const runtime = path.join(base, 'home', '.codex', 'skills', 'gstack');
-    for (const dir of [source, runtime]) {
-      fs.mkdirSync(path.join(dir, 'browse', 'dist'), { recursive: true });
-      fs.writeFileSync(path.join(dir, 'browse', 'dist', 'server-node.mjs'), '');
-    }
-    const playwright = (root: string) => {
-      fs.mkdirSync(path.join(root, 'node_modules', 'playwright'), { recursive: true });
-      fs.writeFileSync(path.join(root, 'node_modules', 'playwright', 'package.json'), '{}');
-    };
-    if (opts.sourceModules) playwright(source);
-    if (opts.runtimeModules) playwright(runtime);
-    if (opts.sourcePath) fs.writeFileSync(path.join(runtime, '.source-path'), `${source}\n`);
-    return { base, source, runtime, exe: path.join(runtime, 'browse', 'dist', 'browse.exe') };
-  }
-
-  test('no reachable playwright beside the copy -> the checkout bundle named by .source-path', () => {
-    const l = layout({ runtimeModules: false, sourcePath: true, sourceModules: true });
-    try { expect(resolveNodeServerScript('/$bunfs/root', l.exe)).toBe(path.join(l.source, 'browse', 'dist', 'server-node.mjs')); }
-    finally { fs.rmSync(l.base, { recursive: true, force: true }); }
-  });
-
-  test('a runtime root that reaches playwright keeps its own bundle', () => {
-    const l = layout({ runtimeModules: true, sourcePath: true, sourceModules: true });
-    try { expect(resolveNodeServerScript('/$bunfs/root', l.exe)).toBe(path.join(l.runtime, 'browse', 'dist', 'server-node.mjs')); }
-    finally { fs.rmSync(l.base, { recursive: true, force: true }); }
-  });
-
-  test('without .source-path, or a checkout without node_modules, the adjacent bundle is unchanged', () => {
-    for (const opts of [{ runtimeModules: false, sourcePath: false, sourceModules: true }, { runtimeModules: false, sourcePath: true, sourceModules: false }]) {
-      const l = layout(opts);
-      try { expect(resolveNodeServerScript('/$bunfs/root', l.exe)).toBe(path.join(l.runtime, 'browse', 'dist', 'server-node.mjs')); }
-      finally { fs.rmSync(l.base, { recursive: true, force: true }); }
-    }
-  });
-
-  test('same build on both sides -> the checkout bundle; different builds -> refusal with the ./setup fix and anchor', () => {
-    const { BROWSE_VERSION_SKEW_ANCHOR } = require('../src/cli');
-    const l = layout({ runtimeModules: false, sourcePath: true, sourceModules: true });
-    const version = (root: string, v: string) => fs.writeFileSync(path.join(root, 'browse', 'dist', '.version'), `${v}\n`);
-    try {
-      version(l.runtime, 'a'.repeat(40));
-      version(l.source, 'a'.repeat(40));
-      expect(resolveNodeServerScript('/$bunfs/root', l.exe)).toBe(path.join(l.source, 'browse', 'dist', 'server-node.mjs'));
-      version(l.source, 'b'.repeat(40));
-      let message = '';
-      try { resolveNodeServerScript('/$bunfs/root', l.exe); } catch (err: any) { message = err.message; }
-      expect(message).toContain(`build ${'a'.repeat(12)}`);
-      expect(message).toContain(`build ${'b'.repeat(12)}`);
-      expect(message).toContain('are from different builds, so the server was not started');
-      expect(message).toContain(`Fix: cd "${l.source}" && ./setup`);
-      expect(message).toContain(BROWSE_VERSION_SKEW_ANCHOR);
-      expect(BROWSE_VERSION_SKEW_ANCHOR).toBe('https://github.com/garrytan/gstack/blob/main/docs/troubleshooting.md#browse-runtime-version-skew');
-      // resolveServerLaunch surfaces the same refusal on Windows.
-      expect(() => require('../src/cli').resolveServerLaunch('win32', {}, '/$bunfs/root', l.exe)).toThrow('different builds');
-    } finally { fs.rmSync(l.base, { recursive: true, force: true }); }
-  });
-
-  test('an unversioned build on either side is not called skew', () => {
-    const l = layout({ runtimeModules: false, sourcePath: true, sourceModules: true });
-    try {
-      fs.writeFileSync(path.join(l.runtime, 'browse', 'dist', '.version'), 'abc\n');
-      expect(resolveNodeServerScript('/$bunfs/root', l.exe)).toBe(path.join(l.source, 'browse', 'dist', 'server-node.mjs'));
-    } finally { fs.rmSync(l.base, { recursive: true, force: true }); }
-  });
-
-  test('setup records the source checkout in every runtime root it links', () => {
-    const setup = fs.readFileSync(path.resolve(__dirname, '../../setup'), 'utf8');
-    const fn = setup.slice(setup.indexOf('_link_runtime_dists() {'), setup.indexOf('\n}\n', setup.indexOf('_link_runtime_dists() {')));
-    expect(fn).toContain(`printf '%s\\n' "$1" > "$2/.source-path"`);
-    // Git Bash on Windows records a native (D:/...) path, not an MSYS one.
-    expect(fn).toContain('cygpath -m "$1" > "$2/.source-path"');
-  });
-
-  test('an MSYS .source-path (/d/a/gstack) resolves to the drive path on Windows only', () => {
-    const { nativeSourcePath } = require('../src/cli');
-    expect(nativeSourcePath('/d/a/gstack/gstack', 'win32')).toBe('D:/a/gstack/gstack');
-    expect(nativeSourcePath('/c', 'win32')).toBe('C:/');
-    expect(nativeSourcePath('D:/a/gstack', 'win32')).toBe('D:/a/gstack');
-    expect(nativeSourcePath('/home/u/gstack', 'linux')).toBe('/home/u/gstack');
-    expect(nativeSourcePath('/home/u/gstack', 'win32')).toBe('/home/u/gstack');
-  });
-});

package/.agent/skills/gstack-browse/test/sanitize.test.ts

@@ -1,112 +0,0 @@
-// Unit tests for browse/src/sanitize.ts (#1440).
-// Covers stripLoneSurrogates (raw UTF-16) and stripLoneSurrogateEscapes
-// (\uXXXX escape text) used by the response chokepoints.
-
-import { describe, expect, test } from 'bun:test';
-import { stripLoneSurrogates, stripLoneSurrogateEscapes, sanitizeBody } from '../src/sanitize';
-
-describe('stripLoneSurrogates', () => {
-  test('replaces lone high surrogate with U+FFFD', () => {
-    const lone = '\uD800x';
-    const out = stripLoneSurrogates(lone);
-    expect(out).toBe('�x');
-  });
-
-  test('replaces lone low surrogate with U+FFFD', () => {
-    const lone = 'x\uDC00';
-    expect(stripLoneSurrogates(lone)).toBe('x�');
-  });
-
-  test('leaves valid surrogate pairs (emoji) unchanged', () => {
-    const smiley = '😀'; // U+1F600 = 😀
-    expect(stripLoneSurrogates(smiley)).toBe(smiley);
-  });
-
-  test('empty string is unchanged', () => {
-    expect(stripLoneSurrogates('')).toBe('');
-  });
-
-  test('mixed valid + lone surrogates', () => {
-    const input = `a\uD800b😀c\uDC00d`;
-    const out = stripLoneSurrogates(input);
-    expect(out).toBe(`a�b😀c�d`);
-  });
-
-  test('clean text passes through unchanged', () => {
-    const text = 'The quick brown fox jumps over 13 lazy dogs.';
-    expect(stripLoneSurrogates(text)).toBe(text);
-  });
-
-  test('high surrogate immediately followed by high surrogate replaces both individually', () => {
-    const input = '\uD800\uD801'; // two lone highs in a row, neither paired
-    const out = stripLoneSurrogates(input);
-    expect(out).toBe('��');
-  });
-});
-
-describe('stripLoneSurrogateEscapes', () => {
-  test('replaces lone high surrogate ESCAPE with \\uFFFD', () => {
-    const json = '{"name":"\\uD800"}';
-    expect(stripLoneSurrogateEscapes(json)).toBe('{"name":"\\uFFFD"}');
-  });
-
-  test('replaces lone low surrogate ESCAPE with \\uFFFD', () => {
-    const json = '{"name":"\\uDC00"}';
-    expect(stripLoneSurrogateEscapes(json)).toBe('{"name":"\\uFFFD"}');
-  });
-
-  test('leaves valid escape pair unchanged', () => {
-    // 😀 = 😀 — must NOT be touched
-    const json = '{"emoji":"\\uD83D\\uDE00"}';
-    expect(stripLoneSurrogateEscapes(json)).toBe(json);
-  });
-
-  test('mixed escape pairs and lone escapes', () => {
-    const json = '{"a":"\\uD800","b":"\\uD83D\\uDE00","c":"\\uDC00"}';
-    expect(stripLoneSurrogateEscapes(json)).toBe('{"a":"\\uFFFD","b":"\\uD83D\\uDE00","c":"\\uFFFD"}');
-  });
-
-  test('clean JSON passes through unchanged', () => {
-    const json = '{"results":[{"status":200,"command":"text"}]}';
-    expect(stripLoneSurrogateEscapes(json)).toBe(json);
-  });
-
-  test('case-insensitive matching: \\uD8aa works like \\uD8AA', () => {
-    expect(stripLoneSurrogateEscapes('\\uD8aa')).toBe('\\uFFFD');
-  });
-});
-
-describe('sanitizeBody', () => {
-  test('text/plain body: applies raw-surrogate strip only', () => {
-    const input = `pre\uD800post`;
-    expect(sanitizeBody(input, false)).toBe(`pre�post`);
-  });
-
-  test('JSON body: applies both raw and escape passes', () => {
-    // Both raw and escape variants in the same body
-    const input = `{"raw":"\uD800","esc":"\\uD800"}`;
-    const out = sanitizeBody(input, true);
-    expect(out).toBe(`{"raw":"�","esc":"\\uFFFD"}`);
-  });
-
-  test('clean text/plain body unchanged', () => {
-    const text = 'Hello world\nLine 2';
-    expect(sanitizeBody(text, false)).toBe(text);
-  });
-
-  test('clean JSON body unchanged', () => {
-    const json = '{"ok":true}';
-    expect(sanitizeBody(json, true)).toBe(json);
-  });
-});
-
-describe('perf smoke', () => {
-  test('1MB of clean text sanitizes in <500ms', () => {
-    const big = 'A'.repeat(1024 * 1024);
-    const start = performance.now();
-    const out = stripLoneSurrogates(big);
-    const elapsed = performance.now() - start;
-    expect(out.length).toBe(big.length);
-    expect(elapsed).toBeLessThan(500);
-  });
-});

package/.agent/skills/gstack-browse/test/screenshot-size-guard.test.ts

@@ -1,118 +0,0 @@
-/**
- * Unit tests for the screenshot size guard (#1214).
- *
- * Verifies that images exceeding 2000px on the longest dimension get
- * downscaled to fit the Anthropic vision API cap, while images already
- * inside the cap pass through untouched.
- *
- * Integration with the three callsites (snapshot.ts, meta-commands.ts,
- * write-commands.ts) is exercised by the existing browse E2E suite — we
- * don't need to spin up Chromium just to verify the helper. The static
- * invariant test below pins that all three callsites import the guard.
- */
-
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'fs';
-import { tmpdir } from 'os';
-import { join } from 'path';
-import sharp from 'sharp';
-import {
-  SCREENSHOT_MAX_DIMENSION_PX,
-  guardScreenshotBuffer,
-  guardScreenshotPath,
-} from '../src/screenshot-size-guard';
-
-let tmp: string;
-
-beforeEach(() => {
-  tmp = mkdtempSync(join(tmpdir(), 'screenshot-guard-'));
-});
-
-afterEach(() => {
-  rmSync(tmp, { recursive: true, force: true });
-});
-
-async function makePng(width: number, height: number): Promise<Buffer> {
-  return sharp({
-    create: { width, height, channels: 3, background: { r: 200, g: 50, b: 50 } },
-  })
-    .png()
-    .toBuffer();
-}
-
-describe('guardScreenshotBuffer', () => {
-  test('passes through images already within the cap', async () => {
-    const input = await makePng(1500, 1800);
-    const { buffer, result } = await guardScreenshotBuffer(input);
-    expect(result.resized).toBe(false);
-    expect(result.width).toBe(1500);
-    expect(result.height).toBe(1800);
-    expect(buffer).toBe(input); // identity — no re-encode
-  });
-
-  test('downscales a 5000px-tall image to fit the cap', async () => {
-    const input = await makePng(1200, 5000);
-    const { buffer, result } = await guardScreenshotBuffer(input);
-    expect(result.resized).toBe(true);
-    expect(result.originalHeight).toBe(5000);
-    expect(Math.max(result.width, result.height)).toBeLessThanOrEqual(
-      SCREENSHOT_MAX_DIMENSION_PX,
-    );
-    // Aspect ratio preserved.
-    expect(result.height / result.width).toBeCloseTo(5000 / 1200, 1);
-    // Buffer is a different (smaller) PNG.
-    expect(buffer.length).toBeLessThan(input.length);
-  });
-
-  test('downscales a 6000px-wide image', async () => {
-    const input = await makePng(6000, 1200);
-    const { buffer, result } = await guardScreenshotBuffer(input);
-    expect(result.resized).toBe(true);
-    expect(result.originalWidth).toBe(6000);
-    expect(Math.max(result.width, result.height)).toBeLessThanOrEqual(
-      SCREENSHOT_MAX_DIMENSION_PX,
-    );
-    expect(buffer.length).toBeGreaterThan(0);
-  });
-
-  test('treats exactly-2000px images as in-bounds (no resize)', async () => {
-    const input = await makePng(2000, 1000);
-    const { result } = await guardScreenshotBuffer(input);
-    expect(result.resized).toBe(false);
-  });
-});
-
-describe('guardScreenshotPath', () => {
-  test('rewrites the file in place when downscale is needed', async () => {
-    const filePath = join(tmp, 'tall.png');
-    writeFileSync(filePath, await makePng(1200, 5000));
-    const result = await guardScreenshotPath(filePath);
-    expect(result.resized).toBe(true);
-    const written = readFileSync(filePath);
-    const meta = await sharp(written).metadata();
-    expect(Math.max(meta.width ?? 0, meta.height ?? 0)).toBeLessThanOrEqual(
-      SCREENSHOT_MAX_DIMENSION_PX,
-    );
-  });
-
-  test('leaves the file untouched when already within cap', async () => {
-    const filePath = join(tmp, 'short.png');
-    const original = await makePng(800, 600);
-    writeFileSync(filePath, original);
-    const result = await guardScreenshotPath(filePath);
-    expect(result.resized).toBe(false);
-    const written = readFileSync(filePath);
-    expect(written.equals(original)).toBe(true);
-  });
-});
-
-describe('static invariant: all three full-page callsites import the guard', () => {
-  test('snapshot.ts, meta-commands.ts, and write-commands.ts wire the size guard', () => {
-    const browseSrc = join(import.meta.dir, '..', 'src');
-    const paths = ['snapshot.ts', 'meta-commands.ts', 'write-commands.ts'];
-    for (const rel of paths) {
-      const content = readFileSync(join(browseSrc, rel), 'utf-8');
-      expect(content).toContain('screenshot-size-guard');
-    }
-  });
-});

package/.agent/skills/gstack-browse/test/security-adversarial-fixes.test.ts

@@ -1,101 +0,0 @@
-/**
- * Regression tests for the 4 adversarial findings fixed during /ship:
- *
- * 1. Canary stream-chunk split bypass — rolling-buffer detection across
- *    consecutive text_delta / input_json_delta events.
- * 2. Tool-output ensemble rule — single ML classifier >= BLOCK blocks
- *    directly when the content is tool output (not user input).
- * 3. escapeHtml quote escaping (unit-level check on the shape we expect).
- * 4. snapshot command added to PAGE_CONTENT_COMMANDS.
- *
- * These tests pin the fixes so future refactors don't silently re-open
- * the bypasses both adversarial reviewers (Claude + Codex) flagged.
- */
-import { describe, test, expect } from 'bun:test';
-import * as fs from 'fs';
-import * as path from 'path';
-import { combineVerdict, THRESHOLDS } from '../src/security';
-import { PAGE_CONTENT_COMMANDS } from '../src/commands';
-
-const REPO_ROOT = path.resolve(__dirname, '..', '..');
-
-// canary stream-chunk split detection — tested detectCanaryLeak inside
-// sidebar-agent.ts. Both the chat-stream pipeline and the function are
-// gone (Terminal pane uses an interactive PTY; user keystrokes are the
-// trust source, no chunked LLM stream to canary-scan).
-
-describe('tool-output ensemble rule (single-layer BLOCK)', () => {
-  test('user-input context: single layer at BLOCK degrades to WARN', () => {
-    const result = combineVerdict([
-      { layer: 'testsavant_content', confidence: 0.95 },
-      { layer: 'transcript_classifier', confidence: 0 },
-    ]);
-    expect(result.verdict).toBe('warn');
-    expect(result.reason).toBe('single_layer_high');
-  });
-
-  test('tool-output context: single layer at BLOCK blocks directly', () => {
-    const result = combineVerdict(
-      [
-        { layer: 'testsavant_content', confidence: 0.95 },
-        { layer: 'transcript_classifier', confidence: 0, meta: { degraded: true } },
-      ],
-      { toolOutput: true },
-    );
-    expect(result.verdict).toBe('block');
-    expect(result.reason).toBe('single_layer_tool_output');
-  });
-
-  test('tool-output context still respects ensemble path when 2 agree', () => {
-    const result = combineVerdict(
-      [
-        { layer: 'testsavant_content', confidence: 0.80 },
-        { layer: 'transcript_classifier', confidence: 0.75, meta: { verdict: 'block' } },
-      ],
-      { toolOutput: true },
-    );
-    expect(result.verdict).toBe('block');
-    expect(result.reason).toBe('ensemble_agreement');
-  });
-
-  test('tool-output context: below BLOCK threshold still WARN, not BLOCK', () => {
-    const result = combineVerdict(
-      [{ layer: 'testsavant_content', confidence: THRESHOLDS.WARN }],
-      { toolOutput: true },
-    );
-    expect(result.verdict).toBe('warn');
-  });
-});
-
-describe('sidepanel escapeHtml quote escaping', () => {
-  test('escapeHtml helper replaces double + single quotes', () => {
-    const src = fs.readFileSync(
-      path.join(REPO_ROOT, 'extension', 'sidepanel.js'),
-      'utf-8',
-    );
-    expect(src).toContain(".replace(/\"/g, '"')");
-    expect(src).toContain(".replace(/'/g, ''')");
-  });
-});
-
-describe('snapshot in PAGE_CONTENT_COMMANDS', () => {
-  test('snapshot is wrapped by untrusted-content envelope', () => {
-    expect(PAGE_CONTENT_COMMANDS.has('snapshot')).toBe(true);
-  });
-});
-
-// The transcript classifier (Haiku) and its tool_output parameter were
-// removed along with sidebar-agent.ts's tool-result scan pipeline. The
-// combineVerdict tests above retain the transcript_classifier vote-handling
-// coverage — the combiner still accepts those signals even though no live
-// layer produces them.
-
-describe('GSTACK_SECURITY_OFF kill switch', () => {
-  test('loadTestsavant honors env var early', () => {
-    const src = fs.readFileSync(
-      path.join(REPO_ROOT, 'browse', 'src', 'security-classifier.ts'),
-      'utf-8',
-    );
-    expect(src).toContain("process.env.GSTACK_SECURITY_OFF === '1'");
-  });
-});