@amg555/frameforge-mcp 2.7.6 → 2.7.7

package/.agent/skills/gstack-browse/test/server-auth.test.ts

@@ -1,600 +0,0 @@
-/**
- * Server auth security tests.
- *
- * Route auth is asserted behaviorally: requests go through a real
- * buildFetchHandler() (makeServer) or through one route's real handler with a
- * stub RouteContext (callRoute), so the tests pin what each route does, not
- * where its code sits. The remaining source-level checks cover code with no
- * behavioral seam (command-pipeline internals, cli.ts, the cookie-picker UI,
- * the constant-time compare, the ngrok authtoken file lookup).
- */
-
-import { describe, test, expect, beforeAll, afterAll } from 'bun:test';
-import * as fs from 'fs';
-import * as path from 'path';
-import { buildHeadedServerEnv } from '../src/cli';
-import { GSTACK_EXTENSION_ID } from '../src/server';
-import { DEFAULT_PAIR_SCOPES, createToken } from '../src/token-registry';
-import { getActivityHistory } from '../src/activity';
-import { makeServer, stubRouteContext, callRoute, fakeTunnel, type TestServer } from './route-test-harness';
-
-const SERVER_SRC = fs.readFileSync(path.join(import.meta.dir, '../src/server.ts'), 'utf-8');
-const CLI_SRC = fs.readFileSync(path.join(import.meta.dir, '../src/cli.ts'), 'utf-8');
-
-// Helper: extract a block of source between two markers
-function sliceBetween(source: string, startMarker: string, endMarker: string): string {
-  const startIdx = source.indexOf(startMarker);
-  if (startIdx === -1) throw new Error(`Marker not found: ${startMarker}`);
-  const endIdx = source.indexOf(endMarker, startIdx + startMarker.length);
-  if (endIdx === -1) throw new Error(`End marker not found: ${endMarker}`);
-  return source.slice(startIdx, endIdx);
-}
-
-const UNAUTHORIZED = { status: 401, body: { error: 'Unauthorized' } };
-const ROOT_REQUIRED = { status: 403, body: { error: 'Root token required' } };
-
-async function statusAndJson(resp: Response): Promise<{ status: number; body: any }> {
-  const text = await resp.text();
-  let body: any = text;
-  try { body = JSON.parse(text); } catch {}
-  return { status: resp.status, body };
-}
-
-let server: TestServer;
-let scoped = '';
-const bearer = (token: string) => ({ Authorization: `Bearer ${token}` });
-const savedPairAgent = process.env.GSTACK_PAIR_AGENT;
-
-beforeAll(() => {
-  server = makeServer();
-  scoped = server.scopedToken('auth-suite-agent');
-});
-afterAll(() => {
-  server.cleanup();
-  if (savedPairAgent === undefined) delete process.env.GSTACK_PAIR_AGENT;
-  else process.env.GSTACK_PAIR_AGENT = savedPairAgent;
-});
-
-describe('Server auth security', () => {
-  // Test 1a: the pinned-origin bootstrap endpoint releases the token only to
-  // the exact extension Origin with a loopback Host (parsed from host:port,
-  // never compared literally against the raw header).
-  test('POST /extension-token gates on pinned Origin and loopback Host', async () => {
-    const pinned = `chrome-extension://${GSTACK_EXTENSION_ID}`;
-    const post = (headers: Record<string, string>) => server.local('/extension-token', { method: 'POST', headers });
-    for (const host of ['127.0.0.1:34567', 'localhost:34567']) {
-      const ok = await statusAndJson(await post({ Origin: pinned, Host: host }));
-      expect(ok).toEqual({ status: 200, body: { token: server.rootToken } });
-    }
-    for (const headers of [
-      { Origin: pinned, Host: 'evil.example:34567' },
-      { Origin: pinned },
-      { Origin: 'chrome-extension://aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', Host: '127.0.0.1:34567' },
-      { Host: '127.0.0.1:34567', ...bearer(server.rootToken) },
-    ]) {
-      const denied = await statusAndJson(await post(headers));
-      expect(denied).toEqual({ status: 403, body: { error: 'Forbidden' } });
-    }
-  });
-
-  // Test 1c: newtab must check domain restrictions (CSO finding #5)
-  // Domain check for newtab is now unified with goto in the scope check section:
-  // (command === 'goto' || command === 'newtab') && args[0] → checkDomain
-  test('newtab enforces domain restrictions', () => {
-    const scopeBlock = sliceBetween(SERVER_SRC, "Scope check (for scoped tokens)", "Pin to a specific tab");
-    expect(scopeBlock).toContain("command === 'newtab'");
-    expect(scopeBlock).toContain('checkDomain');
-    expect(scopeBlock).toContain('Domain not allowed');
-  });
-
-  // Test 1d: validateAuth compares the bearer token in CONSTANT TIME with a
-  // length gate. A revert to `header === \`Bearer ${authToken}\`` keeps
-  // accept/reject behavior identical (functional tests still pass) but silently
-  // reintroduces the byte-by-byte timing side-channel; dropping the length gate
-  // makes timingSafeEqual throw RangeError (500 instead of 401) on a wrong-length
-  // token. Pin both properties, mirroring the token-registry sibling guard.
-  test('validateAuth uses constant-time comparison with a length gate', () => {
-    const authBlock = sliceBetween(SERVER_SRC, 'function validateAuth(req: Request): boolean {', '// Factory-scoped shutdown');
-    expect(authBlock).toContain('crypto.timingSafeEqual');
-    expect(authBlock).toContain('got.length === want.length');
-    // The null-header guard must remain (Buffer.from(null) would otherwise throw).
-    expect(authBlock).toContain('header === null');
-    // The raw === comparison of the header against the bearer string must be gone.
-    expect(authBlock).not.toContain('header === `Bearer ${authToken}`');
-  });
-
-  // Tests 2-5: /refs and /activity/history require the root bearer and never
-  // send a wildcard CORS header, on the denial or the success path.
-  for (const route of ['/refs', '/activity/history']) {
-    test(`${route} endpoint requires authentication`, async () => {
-      expect(await statusAndJson(await server.local(route))).toEqual(UNAUTHORIZED);
-      expect(await statusAndJson(await server.local(route, { headers: bearer(scoped) }))).toEqual(UNAUTHORIZED);
-      expect((await server.local(route, { headers: bearer(server.rootToken) })).status).toBe(200);
-    });
-
-    test(`${route} has no wildcard CORS header`, async () => {
-      for (const headers of [{}, bearer(server.rootToken)]) {
-        const resp = await server.local(route, { headers: { Origin: 'https://evil.example', ...headers } });
-        expect(resp.headers.get('access-control-allow-origin')).toBeNull();
-      }
-    });
-  }
-
-  // Test 6: /activity/stream requires auth via Bearer OR view-only session cookie
-  // (N1: ?token= query param was dropped in v1.6.0.0 — URLs leak to logs/referer)
-  test('/activity/stream requires authentication with inline token check', async () => {
-    expect(await statusAndJson(await server.local('/activity/stream'))).toEqual(UNAUTHORIZED);
-    const viaQuery = await server.local(`/activity/stream?token=${server.rootToken}`);
-    expect(await statusAndJson(viaQuery)).toEqual(UNAUTHORIZED);
-
-    const viaBearer = await server.local('/activity/stream', { headers: bearer(server.rootToken) });
-    expect(viaBearer.status).toBe(200);
-    expect(viaBearer.headers.get('access-control-allow-origin')).toBeNull();
-    await viaBearer.body?.cancel();
-
-    const minted = await server.local('/sse-session', { method: 'POST', headers: bearer(server.rootToken) });
-    const cookie = (minted.headers.get('set-cookie') ?? '').split(';')[0];
-    expect(cookie).toStartWith('gstack_sse=');
-    const viaCookie = await server.local('/activity/stream', { headers: { Cookie: cookie } });
-    expect(viaCookie.status).toBe(200);
-    expect(viaCookie.headers.get('access-control-allow-origin')).toBeNull();
-    await viaCookie.body?.cancel();
-  });
-
-  // Test 7: /command accepts scoped tokens (not just root). This was the
-  // Wintermute bug — /command sat below the blanket root-only check, so scoped
-  // tokens got 401'd before reaching getTokenInfo.
-  test('/command endpoint sits ABOVE the blanket root-only auth gate', async () => {
-    const resp = await statusAndJson(await server.local('/command', {
-      method: 'POST', headers: bearer(scoped), body: JSON.stringify({ command: '__auth_suite_unknown__' }),
-    }));
-    expect(resp.status).not.toBe(401);
-    expect(resp.body).not.toEqual({ error: 'Unauthorized' });
-  });
-
-  // Test 7b: /command authenticates with getTokenInfo (root or scoped), so an
-  // unknown bearer is still rejected.
-  test('/command uses getTokenInfo for auth, not validateAuth', async () => {
-    const body = JSON.stringify({ command: '__auth_suite_unknown__' });
-    expect(await statusAndJson(await server.local('/command', { method: 'POST', body }))).toEqual(UNAUTHORIZED);
-    expect(await statusAndJson(await server.local('/command', {
-      method: 'POST', body, headers: bearer('gsk_sess_not-a-real-token'),
-    }))).toEqual(UNAUTHORIZED);
-    expect((await server.local('/command', { method: 'POST', body, headers: bearer(server.rootToken) })).status).not.toBe(401);
-  });
-
-  // Test 8: /tunnel/start requires root token
-  test('/tunnel/start requires root token', async () => {
-    for (const headers of [{}, bearer(scoped)]) {
-      expect(await statusAndJson(await server.local('/tunnel/start', { method: 'POST', headers }))).toEqual(ROOT_REQUIRED);
-    }
-  });
-
-  // Test 8b: the ngrok authtoken lookup reads ngrok's native config files, and
-  // /tunnel/start asks for it only after the cached-tunnel check. The file
-  // lookup (resolveNgrokAuthtoken in server.ts) has no seam without a real
-  // ngrok config, so that half stays a source check.
-  test('/tunnel/start reads ngrok native config files', async () => {
-    const lookup = sliceBetween(SERVER_SRC, 'function resolveNgrokAuthtoken', 'async function closeTunnel');
-    expect(lookup).toContain("'ngrok.yml'");
-    expect(lookup).toContain('authtoken');
-
-    process.env.GSTACK_PAIR_AGENT = 'on';
-    const inactive = { active: false, url: null, hasListener: false };
-    const missing = await statusAndJson(await callRoute('POST', '/tunnel/start', stubRouteContext({
-      tunnel: { state: () => inactive, close: async () => {}, resolveAuthtoken: () => null, start: async () => { throw new Error('must not start'); } },
-    })));
-    expect(missing).toEqual({ status: 400, body: { error: 'No ngrok authtoken found', hint: 'Run: ngrok config add-authtoken YOUR_TOKEN' } });
-
-    const started: string[] = [];
-    const ok = await statusAndJson(await callRoute('POST', '/tunnel/start', stubRouteContext({
-      tunnel: {
-        state: () => inactive, close: async () => {}, resolveAuthtoken: () => 'ngrok-token-from-config',
-        start: async (authtoken) => { started.push(authtoken); return { ok: true, url: 'https://fresh.ngrok.example' }; },
-      },
-    })));
-    expect(ok).toEqual({ status: 200, body: { url: 'https://fresh.ngrok.example' } });
-    expect(started).toEqual(['ngrok-token-from-config']);
-  });
-
-  // Test 8c: /tunnel/start returns already_active if the cached tunnel answers
-  test('/tunnel/start returns already_active when tunnel exists', async () => {
-    process.env.GSTACK_PAIR_AGENT = 'on';
-    const tunnel = fakeTunnel(200);
-    try {
-      const resp = await statusAndJson(await callRoute('POST', '/tunnel/start', stubRouteContext({
-        tunnel: {
-          state: () => ({ active: true, url: tunnel.url, hasListener: true }),
-          close: async () => { throw new Error('a live tunnel must not be closed'); },
-          resolveAuthtoken: () => { throw new Error('a live tunnel must not be restarted'); },
-          start: async () => { throw new Error('a live tunnel must not be restarted'); },
-        },
-      })));
-      expect(resp).toEqual({ status: 200, body: { url: tunnel.url, already_active: true } });
-      expect(tunnel.hits).toEqual(['GET /connect']);
-    } finally { tunnel.stop(); }
-  });
-
-  // Test 9: /pair requires root token
-  test('/pair requires root token', async () => {
-    for (const headers of [{}, bearer(scoped)]) {
-      expect(await statusAndJson(await server.local('/pair', { method: 'POST', headers, body: '{}' }))).toEqual(ROOT_REQUIRED);
-    }
-  });
-
-  // Test 9b: /pair mints a one-time setup key (pending until /connect), never a
-  // session token a caller could use directly.
-  test('/pair creates setup keys, not session tokens', async () => {
-    const pair = await statusAndJson(await server.local('/pair', {
-      method: 'POST', headers: bearer(server.rootToken), body: JSON.stringify({ clientId: 'pair-setup-check' }),
-    }));
-    expect(pair.status).toBe(200);
-    expect(pair.body.setup_key).toStartWith('gsk_setup_');
-    const agents = await statusAndJson(await server.local('/agents', { headers: bearer(server.rootToken) }));
-    expect(agents.body.agents.find((a: any) => a.clientId === 'pair-setup-check')?.pending).toBe(true);
-    const exchanged = await statusAndJson(await server.local('/connect', {
-      method: 'POST', body: JSON.stringify({ setup_key: pair.body.setup_key }),
-    }));
-    expect(exchanged.status).toBe(200);
-    expect(exchanged.body.token).toStartWith('gsk_sess_');
-  });
-
-  // Test 10: tab ownership check happens before command dispatch
-  test('tab ownership check runs before command dispatch for scoped tokens', () => {
-    const handleBlock = sliceBetween(SERVER_SRC, "async function handleCommand", "Block mutation commands while watching");
-    expect(handleBlock).toContain('checkTabAccess');
-    expect(handleBlock).toContain('Tab not owned by your agent');
-  });
-
-  // Test 10a: tab gate is gated on own-only, not on isWrite
-  // Regression test for v1.20.0.0 footgun fix. Pre-fix the gate fired for
-  // any write command from any non-root token, which 403'd local skill
-  // spawns trying to drive the user's natural (unowned) tabs. The bundled
-  // hackernews-frontpage skill failed identically. The fix narrows the
-  // gate to `tabPolicy === 'own-only'` so pair-agent tunnel tokens stay
-  // strict while local shared-policy tokens (skill spawns) get unblocked.
-  test('tab gate predicate is own-only-scoped, not write-scoped', () => {
-    const handleBlock = sliceBetween(SERVER_SRC, "async function handleCommand", "Block mutation commands while watching");
-    // The gate condition must include the own-only check.
-    expect(handleBlock).toContain("tabPolicy === 'own-only'");
-    // It must NOT depend on WRITE_COMMANDS in the gate predicate (only inside
-    // the checkTabAccess call's isWrite arg, which is informational). The
-    // surrounding `if (...) {` for the gate must use `tabPolicy === 'own-only'`
-    // as the trigger, not `WRITE_COMMANDS.has(command) || ...`.
-    const gateLine = handleBlock.split('\n').find(l =>
-      l.includes("command !== 'newtab'") &&
-      l.includes('tokenInfo') &&
-      l.includes('tabPolicy')
-    );
-    expect(gateLine).toBeTruthy();
-    expect(gateLine).not.toMatch(/WRITE_COMMANDS\.has\(command\)\s*\|\|/);
-  });
-
-  // Test 10b: chain command pre-validates subcommand scopes
-  test('chain handler checks scope for each subcommand before dispatch', () => {
-    const metaSrc = fs.readFileSync(path.join(import.meta.dir, '../src/meta-commands.ts'), 'utf-8');
-    const chainBlock = metaSrc.slice(
-      metaSrc.indexOf("case 'chain':"),
-      metaSrc.indexOf("case 'diff':")
-    );
-    expect(chainBlock).toContain('checkScope');
-    expect(chainBlock).toContain('Chain rejected');
-    expect(chainBlock).toContain('tokenInfo');
-  });
-
-  // Test 10c: handleMetaCommand accepts tokenInfo parameter
-  test('handleMetaCommand accepts tokenInfo for chain scope checking', () => {
-    const metaSrc = fs.readFileSync(path.join(import.meta.dir, '../src/meta-commands.ts'), 'utf-8');
-    const sig = metaSrc.slice(
-      metaSrc.indexOf('export async function handleMetaCommand'),
-      metaSrc.indexOf('): Promise<string>')
-    );
-    expect(sig).toContain('tokenInfo');
-  });
-
-  // Test 10d: server passes tokenInfo to handleMetaCommand
-  // v1.35.0.0: shutdown is now factory-scoped; the call site uses shutdownFn,
-  // a thin wrapper that delegates to activeShutdown (set by buildFetchHandler).
-  test('server passes tokenInfo to handleMetaCommand', () => {
-    expect(SERVER_SRC).toContain('handleMetaCommand(command, args, browserManager, shutdownFn, tokenInfo,');
-  });
-
-  // Test 10e: activity attribution includes clientId
-  test('activity events include clientId from token', () => {
-    const commandStartBlock = sliceBetween(SERVER_SRC, "Activity: emit command_start", "try {");
-    expect(commandStartBlock).toContain('clientId: tokenInfo?.clientId');
-  });
-
-  // ─── Tunnel liveness verification ─────────────────────────────
-
-  // Tests 11a/11b: /pair probes the tunnel before reporting tunnel_url, tears
-  // the tunnel down when the probe fails, and never reports a raw
-  // tunnelActive flag.
-  test('/pair verifies tunnel is alive before returning tunnel_url', async () => {
-    for (const [status, expectUrl] of [[200, true], [503, false]] as const) {
-      const tunnel = fakeTunnel(status);
-      let closed = 0;
-      try {
-        const resp = await statusAndJson(await callRoute('POST', '/pair', stubRouteContext({
-          tunnel: {
-            state: () => ({ active: true, url: tunnel.url, hasListener: true }),
-            close: async () => { closed++; },
-            resolveAuthtoken: () => null, start: async () => { throw new Error('unused'); },
-          },
-        }), { body: {} }));
-        expect(resp.status).toBe(200);
-        expect(resp.body.tunnel_url).toBe(expectUrl ? tunnel.url : null);
-        expect(tunnel.hits).toEqual(['GET /connect']);
-        expect(closed).toBe(expectUrl ? 0 : 1);
-      } finally { tunnel.stop(); }
-    }
-  });
-
-  test('/pair returns verified tunnel URL, not raw tunnelActive flag', async () => {
-    const resp = await statusAndJson(await callRoute('POST', '/pair', stubRouteContext({
-      tunnel: {
-        state: () => ({ active: true, url: 'http://127.0.0.1:1', hasListener: true }),
-        close: async () => {}, resolveAuthtoken: () => null, start: async () => { throw new Error('unused'); },
-      },
-    }), { body: {} }));
-    expect(resp.status).toBe(200);
-    expect(resp.body.tunnel_url).toBeNull();
-    const inactive = await statusAndJson(await callRoute('POST', '/pair', stubRouteContext({
-      tunnel: {
-        state: () => ({ active: false, url: null, hasListener: false }),
-        close: async () => { throw new Error('nothing to close'); },
-        resolveAuthtoken: () => null, start: async () => { throw new Error('unused'); },
-      },
-    }), { body: {} }));
-    expect(inactive.body.tunnel_url).toBeNull();
-    expect(inactive.body.server_url).toBe('http://127.0.0.1:34567');
-  });
-
-  // Test 11c: /tunnel/start probes the cached tunnel before returning
-  // already_active; a dead one is torn down and restarted.
-  test('/tunnel/start verifies cached tunnel is alive before returning already_active', async () => {
-    process.env.GSTACK_PAIR_AGENT = 'on';
-    const tunnel = fakeTunnel(502);
-    const calls: string[] = [];
-    try {
-      const resp = await statusAndJson(await callRoute('POST', '/tunnel/start', stubRouteContext({
-        tunnel: {
-          state: () => ({ active: true, url: tunnel.url, hasListener: true }),
-          close: async () => { calls.push('close'); },
-          resolveAuthtoken: () => { calls.push('resolve'); return 'ngrok-token'; },
-          start: async () => { calls.push('start'); return { ok: true, url: 'https://restarted.ngrok.example' }; },
-        },
-      })));
-      expect(resp).toEqual({ status: 200, body: { url: 'https://restarted.ngrok.example' } });
-      expect(calls).toEqual(['close', 'resolve', 'start']);
-      expect(tunnel.hits).toEqual(['GET /connect']);
-    } finally { tunnel.stop(); }
-  });
-
-  // Test 11d: CLI verifies tunnel_url from server before printing instruction block
-  test('CLI probes tunnel_url before using it in instruction block', () => {
-    const pairSection = sliceBetween(CLI_SRC, 'Determine the URL to use', 'local HOST: write config');
-    // Must probe the tunnel URL
-    expect(pairSection).toContain('cliProbe');
-    expect(pairSection).toContain('Tunnel unreachable from CLI');
-    // Must fall through to restart logic on failure
-    expect(pairSection).toContain('attempting restart');
-  });
-
-  // ─── Batch endpoint security ─────────────────────────────────
-
-  // Tests 12a/12b: /batch accepts root and scoped tokens (like /command) and
-  // rejects an unknown bearer.
-  test('/batch endpoint sits ABOVE the blanket root-only auth gate', async () => {
-    const resp = await statusAndJson(await server.local('/batch', {
-      method: 'POST', headers: bearer(scoped), body: JSON.stringify({ commands: [] }),
-    }));
-    expect(resp).toEqual({ status: 400, body: { error: '"commands" must be a non-empty array' } });
-  });
-
-  test('/batch uses getTokenInfo for auth, not validateAuth', async () => {
-    const body = JSON.stringify({ commands: [] });
-    expect(await statusAndJson(await server.local('/batch', { method: 'POST', body }))).toEqual(UNAUTHORIZED);
-    expect(await statusAndJson(await server.local('/batch', {
-      method: 'POST', body, headers: bearer('gsk_sess_not-a-real-token'),
-    }))).toEqual(UNAUTHORIZED);
-    expect((await server.local('/batch', { method: 'POST', body, headers: bearer(server.rootToken) })).status).toBe(400);
-  });
-
-  function batchContext(calls: Array<{ body: any; opts: any }>) {
-    return stubRouteContext({
-      browserManager: { getCurrentUrl: () => 'about:blank', getTabCount: () => 1, getConnectionMode: () => 'launched' } as any,
-      resetIdleTimer: () => {},
-      commands: {
-        handle: async () => { throw new Error('/batch must not use the single-command wrapper'); },
-        handleInternal: async (body, _tokenInfo, opts) => { calls.push({ body, opts }); return { status: 200, result: 'ok' }; },
-      },
-    });
-  }
-
-  // Test 12c: /batch enforces max command limit
-  test('/batch enforces max 50 commands per batch', async () => {
-    const calls: Array<{ body: any; opts: any }> = [];
-    const commands = Array.from({ length: 51 }, () => ({ command: 'url' }));
-    const resp = await statusAndJson(await callRoute('POST', '/batch', batchContext(calls), { body: { commands } }));
-    expect(resp).toEqual({ status: 400, body: { error: 'Max 50 commands per batch' } });
-    expect(calls).toEqual([]);
-  });
-
-  // Test 12d: /batch rejects nested batches
-  test('/batch rejects nested batch commands', async () => {
-    const calls: Array<{ body: any; opts: any }> = [];
-    const resp = await statusAndJson(await callRoute('POST', '/batch', batchContext(calls), {
-      body: { commands: [{ command: 'batch', args: [] }, { command: 'url' }] },
-    }));
-    expect(resp.status).toBe(200);
-    expect(resp.body.results[0]).toMatchObject({ index: 0, status: 400, command: 'batch' });
-    expect(JSON.parse(resp.body.results[0].result)).toEqual({ error: 'Nested batch commands are not allowed' });
-    expect(calls.map(c => c.body.command)).toEqual(['url']);
-  });
-
-  // Tests 12e/12f/12h: each sub-command runs through handleCommandInternal
-  // with per-command rate limiting and activity suppressed, tabId passed
-  // through, and one batch-level command_start/command_end pair emitted.
-  test('/batch skips per-command rate limiting', async () => {
-    const calls: Array<{ body: any; opts: any }> = [];
-    await callRoute('POST', '/batch', batchContext(calls), { body: { commands: [{ command: 'url' }, { command: 'text' }] } });
-    expect(calls.map(c => c.opts.skipRateCheck)).toEqual([true, true]);
-  });
-
-  test('/batch emits batch-level activity, not per-command', async () => {
-    const calls: Array<{ body: any; opts: any }> = [];
-    const before = getActivityHistory(1000).totalAdded;
-    await callRoute('POST', '/batch', batchContext(calls), {
-      body: { commands: [{ command: 'url' }, { command: 'text' }] },
-      tokenInfo: { clientId: 'batch-activity-agent' } as any,
-    });
-    expect(calls.map(c => c.opts.skipActivity)).toEqual([true, true]);
-    const { entries, totalAdded } = getActivityHistory(1000);
-    const added = entries.slice(-(totalAdded - before));
-    expect(added.map(e => [e.type, e.command, e.clientId])).toEqual([
-      ['command_start', 'batch', 'batch-activity-agent'],
-      ['command_end', 'batch', 'batch-activity-agent'],
-    ]);
-  });
-
-  // Test 12g: /batch validates command field in each command
-  test('/batch validates each command has a command field', async () => {
-    const calls: Array<{ body: any; opts: any }> = [];
-    const resp = await statusAndJson(await callRoute('POST', '/batch', batchContext(calls), {
-      body: { commands: [{}, { command: 42 }] },
-    }));
-    expect(resp.body.results.map((r: any) => [r.status, JSON.parse(r.result).error])).toEqual([
-      [400, 'Missing "command" field'],
-      [400, 'Missing "command" field'],
-    ]);
-    expect(calls).toEqual([]);
-  });
-
-  test('/batch passes tabId to handleCommandInternal for multi-tab support', async () => {
-    const calls: Array<{ body: any; opts: any }> = [];
-    const resp = await statusAndJson(await callRoute('POST', '/batch', batchContext(calls), {
-      body: { commands: [{ command: 'url', tabId: 7 }, { command: 'text', args: ['x'], tabId: 9 }] },
-    }));
-    expect(calls.map(c => c.body)).toEqual([
-      { command: 'url', args: undefined, tabId: 7 },
-      { command: 'text', args: ['x'], tabId: 9 },
-    ]);
-    expect(resp.body.results.map((r: any) => r.tabId)).toEqual([7, 9]);
-  });
-
-  // ─── Pair-agent regression tests ──────────────────────────
-
-  // Regression: connect command crashed with "domains is not defined" because
-  // a stray `domains,` variable was in the status fetch body (cli.ts:852).
-  test('connect command status fetch body has no undefined variable references', () => {
-    const connectBlock = sliceBetween(CLI_SRC, 'Launching headed Chromium', 'Terminal agent started');
-    // The status fetch should use a clean JSON body
-    expect(connectBlock).toContain("command: 'status'");
-    // Must NOT contain a bare `domains` reference in the fetch body
-    // (it would be `domains,` on its own line, not part of a key like `domains:`)
-    const bodyMatch = connectBlock.match(/body:\s*JSON\.stringify\(\{([^}]+)\}\)/);
-    expect(bodyMatch).not.toBeNull();
-    if (bodyMatch) {
-      // The body should only contain command and args, no stray variables
-      expect(bodyMatch[1]).not.toMatch(/\bdomains\b/);
-    }
-  });
-
-  // Regression: pair-agent server died 15s after CLI exited because the server
-  // monitored the connect subprocess PID. pair-agent must set BROWSE_PARENT_PID=0
-  // to disable self-termination.
-  test('pair-agent disables parent PID monitoring via BROWSE_PARENT_PID=0', () => {
-    const pairBlock = sliceBetween(CLI_SRC, 'Ensure headed mode', 'handlePairAgent');
-    // The connect subprocess env must override BROWSE_PARENT_PID
-    expect(pairBlock).toContain("BROWSE_PARENT_PID");
-    expect(pairBlock).toContain("'0'");
-    // The connect command starts its server with buildHeadedServerEnv, the
-    // same env the --supervise respawn uses, and that env disables the
-    // parent-PID watchdog.
-    const connectBlock = sliceBetween(CLI_SRC, 'Launching headed Chromium', 'Terminal agent started');
-    expect(connectBlock).toContain('startServer(buildHeadedServerEnv(globalFlags))');
-    expect(buildHeadedServerEnv({ proxyUrl: null, configHash: '' }).BROWSE_PARENT_PID).toBe('0');
-  });
-
-  // Regression: newtab returned 403 for scoped tokens because the tab ownership
-  // check ran before the newtab handler, checking the active tab (owned by root).
-  test('newtab is excluded from tab ownership check', () => {
-    const ownershipBlock = sliceBetween(SERVER_SRC, 'Tab ownership check (own-only tokens / pair-agent isolation)', 'newtab with ownership for scoped tokens');
-    // The ownership check condition must exclude newtab
-    expect(ownershipBlock).toContain("command !== 'newtab'");
-  });
-
-  // CVE fix: cookie-picker HTML must NOT inline the auth token.
-  // getCookiePickerHTML() must not accept an authToken parameter.
-  test('cookie-picker UI does not accept or inline auth token', () => {
-    const uiSrc = fs.readFileSync(path.join(import.meta.dir, '../src/cookie-picker-ui.ts'), 'utf-8');
-    // Function signature must not include authToken
-    expect(uiSrc).not.toMatch(/getCookiePickerHTML\([^)]*authToken/);
-    // No AUTH_TOKEN interpolation in template
-    expect(uiSrc).not.toContain("AUTH_TOKEN = '${authToken");
-    expect(uiSrc).not.toContain("AUTH_TOKEN = '${auth");
-  });
-
-  // CVE fix: cookie-picker route handler uses one-time code exchange, not open access.
-  test('cookie-picker HTML route requires code or session cookie', () => {
-    const routeSrc = fs.readFileSync(path.join(import.meta.dir, '../src/cookie-picker-routes.ts'), 'utf-8');
-    // Must have code validation
-    expect(routeSrc).toContain('pendingCodes');
-    expect(routeSrc).toContain('validSessions');
-    // Must NOT pass authToken to getCookiePickerHTML
-    expect(routeSrc).not.toMatch(/getCookiePickerHTML\([^)]*authToken/);
-    // Must set HttpOnly session cookie
-    expect(routeSrc).toContain('HttpOnly');
-    expect(routeSrc).toContain('SameSite=Strict');
-  });
-});
-
-describe('Pair scope defaults and revocation surface', () => {
-  // Regression: the CLI only sent scopes when --restrict was passed, so the
-  // effective pairing default lived in two places (CLI omission + server
-  // fallback) and could silently drift. Both sides must use the shared
-  // DEFAULT_PAIR_SCOPES constant, and the CLI must send scopes
-  // unconditionally (the old conditional-spread shape is banned).
-  test('/pair default and CLI pairing body share DEFAULT_PAIR_SCOPES', async () => {
-    const pair = await statusAndJson(await server.local('/pair', {
-      method: 'POST', headers: bearer(server.rootToken), body: '{}',
-    }));
-    expect(pair.status).toBe(200);
-    expect(pair.body.scopes).toEqual([...DEFAULT_PAIR_SCOPES]);
-    const cliBlock = sliceBetween(CLI_SRC, 'async function handlePairAgent', 'Determine the URL to use');
-    // Match the CODE shape, not a comment: a bare toContain('DEFAULT_PAIR_SCOPES')
-    // is satisfied by the explanatory comment and passes vacuously on a revert.
-    expect(cliBlock).toMatch(/scopes:\s*restrict\s*\?[\s\S]{0,200}?:\s*\[\.\.\.DEFAULT_PAIR_SCOPES\]/);
-    expect(cliBlock).not.toMatch(/\.\.\.\(restrict\s*\?/);
-  });
-
-  // control is the only scope behind an explicit flag; a scopes list must
-  // not be able to smuggle it into a pairing grant.
-  test('/pair rejects control inside a scopes list without the control flag', async () => {
-    const pair = (body: unknown) => server.local('/pair', {
-      method: 'POST', headers: bearer(server.rootToken), body: JSON.stringify(body),
-    });
-    expect(await statusAndJson(await pair({ scopes: ['read', 'control'] }))).toEqual({
-      status: 400,
-      body: { error: 'The control scope requires the control flag (--control); it cannot be granted via a scopes list.' },
-    });
-    const flagged = await statusAndJson(await pair({ control: true }));
-    expect(flagged.status).toBe(200);
-    expect(flagged.body.scopes).toContain('control');
-  });
-
-  // CLI-encoded clientIds (spaces, UTF-8) must round-trip through the revoke
-  // route; slicing the raw pathname 404s on every encoded name.
-  test('DELETE /token decodes the clientId path segment', async () => {
-    createToken({ clientId: 'encoded agent é', scopes: ['read'] });
-    const resp = await statusAndJson(await server.local(`/token/${encodeURIComponent('encoded agent é')}`, {
-      method: 'DELETE', headers: bearer(server.rootToken),
-    }));
-    expect(resp).toEqual({ status: 200, body: { revoked: 'encoded agent é', tokens_deleted: 1, tabs_released: 0 } });
-    const malformed = await statusAndJson(await server.local('/token/%E0%A4%A', {
-      method: 'DELETE', headers: bearer(server.rootToken),
-    }));
-    expect(malformed).toEqual({ status: 400, body: { error: 'Malformed client ID encoding' } });
-  });
-});