@amg555/frameforge-mcp 2.7.6 → 2.7.8

package/.agent/skills/gstack-browse/test/cookie-import-native-qualification.ts

@@ -1,128 +0,0 @@
-import { spawnSync } from 'node:child_process';
-import { existsSync, mkdtempSync, writeFileSync } from 'node:fs';
-import { createRequire } from 'node:module';
-import { release, tmpdir } from 'node:os';
-import path from 'node:path';
-import { nativeBrowserPaths } from '../src/cookie-import-native';
-import { nativeCookieEnvironment, probeNativeCookieMember } from '../src/cookie-import-native-worker';
-import { hashNativeFile, nativeCodeHashes, nativeCodeMatches, NATIVE_BROWSER_VERSION_COMMAND, NATIVE_QUALIFICATION_DATA } from '../src/cookie-import-native-integrity';
-import { createNativeCookieJob, NativeCookieJobError, nativeCookieDiagnostic, type NativeCookieDiagnostic, type NativeCookieJob } from '../src/cookie-import-native-job';
-
-if (process.platform !== 'win32') {
-  console.error('Native cookie qualification requires Windows; no cases ran and no qualification was issued.');
-  process.exit(1);
-}
-if (process.env.GITHUB_ACTIONS !== 'true' || process.env.CI !== 'true') {
-  console.error('Native cookie qualification requires a disposable GitHub Actions runner and never uses an existing browser profile.');
-  process.exit(1);
-}
-
-const output = mkdtempSync(path.join(process.argv[2] || tmpdir(), 'cookie-native-qualification-'));
-function incomplete(reason: string, diagnostic?: NativeCookieDiagnostic): never {
-  const receipt = { status: 'incomplete', reason, ...(diagnostic ? { diagnostic } : {}), counts: { pass: 0, fail: 0, skip: 0 }, activation: 'No build was qualified; production extraction remains disabled.' };
-  writeFileSync(path.join(output, 'qualification.json'), JSON.stringify(receipt, null, 2) + '\n', { mode: 0o600, flag: 'wx' });
-  console.log(JSON.stringify({ ...receipt, artifactDirectory: output }));
-  process.exit(2);
-}
-if (Bun.version !== '1.4.2') incomplete('bun_1_4_2_required');
-let emptyJob: NativeCookieJob | undefined;
-try {
-  emptyJob = await createNativeCookieJob();
-  if (emptyJob.activeProcesses() !== 0) throw new NativeCookieJobError('job_query');
-  emptyJob.terminate();
-  if (emptyJob.activeProcesses() !== 0) throw new NativeCookieJobError('job_query');
-  emptyJob.close();
-  const preflight = { status: 'passed', activeProcesses: 0 };
-  writeFileSync(path.join(output, 'job-preflight.json'), JSON.stringify(preflight, null, 2) + '\n', { mode: 0o600, flag: 'wx' });
-  console.log(JSON.stringify({ nativeJobPreflight: preflight }));
-} catch (error) {
-  const diagnostic = nativeCookieDiagnostic(error, 'job_create');
-  try { emptyJob?.close(); } catch {}
-  writeFileSync(path.join(output, 'job-preflight.json'), JSON.stringify({ status: 'failed', diagnostic }, null, 2) + '\n', { mode: 0o600, flag: 'wx' });
-  incomplete('native_job_preflight_failed', diagnostic);
-}
-const memberProbe = await probeNativeCookieMember();
-const memberPreflight = 'cookies' in memberProbe ? { status: 'passed', activeProcesses: 0 } : { status: 'failed', error: memberProbe.error, diagnostic: memberProbe.diagnostic };
-writeFileSync(path.join(output, 'member-preflight.json'), JSON.stringify(memberPreflight, null, 2) + '\n', { mode: 0o600, flag: 'wx' });
-console.log(JSON.stringify({ nativeMemberPreflight: memberPreflight }));
-if ('error' in memberProbe) incomplete('native_member_preflight_failed', memberProbe.diagnostic);
-const root = path.resolve(import.meta.dir, '../..');
-let sourceHashes: Record<string, string>;
-try {
-  sourceHashes = await nativeCodeHashes(root, Date.now() + 25_000);
-} catch {
-  incomplete('source_inputs_unavailable_or_timed_out');
-}
-const environment = nativeCookieEnvironment(process.env);
-const browser = nativeBrowserPaths('Edge', environment);
-const executable = browser.executables.find(existsSync);
-const node = Bun.which('node');
-if (!executable || !node) incomplete('node_or_edge_not_installed');
-if (existsSync(browser.userDataDir)) incomplete('existing_default_profile_refused');
-const executableSha256 = await hashNativeFile(executable, Date.now() + 25_000);
-const nodeProbe = spawnSync(node, ['-p', 'JSON.stringify({ version: process.version, architecture: process.arch })'], { env: environment, encoding: 'utf8', timeout: 10_000, windowsHide: true });
-if (nodeProbe.status !== 0) incomplete('node_runtime_preflight_failed');
-const nodeInfo = JSON.parse(nodeProbe.stdout);
-if (nodeInfo.architecture !== process.arch || !['x64', 'arm64'].includes(process.arch)) incomplete('runtime_architecture_mismatch');
-const require = createRequire(import.meta.url);
-const playwrightVersion = require('playwright/package.json').version;
-if (playwrightVersion !== '1.62.1') incomplete('playwright_1_62_1_required');
-const versionProbe = spawnSync(path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe'), [
-  '-NoProfile', '-NonInteractive', '-Command', NATIVE_BROWSER_VERSION_COMMAND,
-], { env: { ...environment, GSTACK_QUALIFY_BROWSER_EXE: executable }, encoding: 'utf8', timeout: 10_000, windowsHide: true });
-const versionErrorCode = (versionProbe.error as NodeJS.ErrnoException | undefined)?.code;
-const versionMetadata = {
-  exitCode: versionProbe.status,
-  signal: versionProbe.signal,
-  spawnError: versionProbe.error ? (['ENOENT', 'EACCES', 'EPERM', 'ETIMEDOUT'].includes(versionErrorCode || '') ? versionErrorCode : 'spawn_failed') : undefined,
-  stdoutBytes: Buffer.byteLength(versionProbe.stdout || ''),
-  stderrBytes: Buffer.byteLength(versionProbe.stderr || ''),
-  versionValid: /^\d+(?:\.\d+){2,3}$/.test((versionProbe.stdout || '').trim()),
-};
-writeFileSync(path.join(output, 'browser-version-preflight.json'), JSON.stringify(versionMetadata, null, 2) + '\n', { mode: 0o600, flag: 'wx' });
-console.log(JSON.stringify({ nativeBrowserVersionPreflight: versionMetadata }));
-if (versionProbe.status !== 0 || !versionMetadata.versionValid) incomplete('browser_version_preflight_failed');
-const result = spawnSync(process.execPath, ['--no-env-file', '--no-install', '--no-macros', '--config=NUL', 'test', 'browse/test/cookie-import-native-job.test.ts', '--test-name-pattern', '^native Windows process qualification'], {
-  cwd: root,
-  env: { ...environment, CI: 'true', GITHUB_ACTIONS: 'true', GSTACK_COOKIE_NATIVE_DEFAULT_FIXTURE: '1', NO_COLOR: '1' },
-  encoding: 'utf8',
-  timeout: 300_000,
-  maxBuffer: 16 * 1024 * 1024,
-  windowsHide: true,
-});
-const log = `${result.stdout || ''}\n${result.stderr || ''}`;
-writeFileSync(path.join(output, 'qualification.log'), log, { mode: 0o600, flag: 'wx' });
-const count = (kind: string) => Number([...log.matchAll(new RegExp(`(?:^|\\n)\\s*(\\d+) ${kind}\\b`, 'g'))].at(-1)?.[1] ?? 0);
-const counts = { pass: count('pass'), fail: count('fail'), skip: count('skip') };
-let inputsUnchanged = false;
-try {
-  const deadline = Date.now() + 25_000;
-  inputsUnchanged = await hashNativeFile(executable, deadline) === executableSha256 && nativeCodeMatches(sourceHashes, await nativeCodeHashes(root, deadline));
-} catch {}
-const passed = result.status === 0 && !result.error && counts.pass === 7 && counts.fail === 0 && counts.skip === 0 && inputsUnchanged && !existsSync(browser.userDataDir);
-const receipt = {
-  status: passed ? 'passed' : 'failed',
-  scope: 'Edge default-profile v20 extraction, pipe transport, profile identity, and owned-process cleanup',
-  qualifiedBuild: {
-    browserName: 'Edge',
-    architecture: nodeInfo.architecture,
-    windowsRelease: release(),
-    executableSha256,
-    nodeVersion: nodeInfo.version,
-    bunVersion: Bun.version,
-    playwrightVersion,
-    sourceHashes,
-  },
-  browserVersion: versionProbe.stdout.trim(),
-  supervisorArchitecture: process.arch,
-  jobPreflight: { status: 'passed', activeProcesses: 0 },
-  memberPreflight,
-  counts,
-  inputsUnchanged,
-  sourceHashes,
-  activationData: NATIVE_QUALIFICATION_DATA,
-  activation: 'Review this receipt and add only this exact qualifiedBuild to the separate activation data; the runner never enables extraction and activation does not modify the recorded code hashes.',
-};
-writeFileSync(path.join(output, 'qualification.json'), JSON.stringify(receipt, null, 2) + '\n', { mode: 0o600, flag: 'wx' });
-console.log(JSON.stringify({ status: receipt.status, counts, artifactDirectory: output }));
-process.exitCode = passed ? 0 : 1;

package/.agent/skills/gstack-browse/test/cookie-import-native.test.ts

@@ -1,436 +0,0 @@
-import { afterAll, describe, expect, test } from 'bun:test';
-import { copyFileSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { release, tmpdir } from 'node:os';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { createRequire } from 'node:module';
-import { pathToFileURL } from 'node:url';
-import { nativeBrowserPaths, importNativeCookies } from '../src/cookie-import-native';
-import { nativeCookieEnvironment, NATIVE_COOKIE_NODE_SCRIPT, NATIVE_PROGRESS_PREFIX } from '../src/cookie-import-native-worker';
-import { parseNativeCookieDiagnostic } from '../src/cookie-import-native-job';
-import { hashNativeFile, nativeCodeHashes, nativeCodeMatches, NATIVE_CODE_INPUTS, NATIVE_QUALIFICATION_DATA, readNativeQualifications } from '../src/cookie-import-native-integrity';
-
-const root = mkdtempSync(path.join(tmpdir(), 'native-cookies-'));
-const env = { LOCALAPPDATA: 'C:\\fixture\\Local', PROGRAMFILES: 'C:\\Apps', 'PROGRAMFILES(X86)': 'C:\\Apps32' };
-const node = Bun.which('node');
-if (!node) throw new Error('Node is required for native-cookie transport tests');
-
-afterAll(() => rmSync(root, { recursive: true, force: true }));
-
-function isolatedEnv(): NodeJS.ProcessEnv {
-  const local = path.join(root, 'AppData', 'Local');
-  const roaming = path.join(root, 'AppData', 'Roaming');
-  const temporary = path.join(local, 'Temp');
-  for (const directory of [local, roaming, temporary]) mkdirSync(directory, { recursive: true });
-  return {
-    PATH: path.dirname(node!),
-    HOME: root,
-    USERPROFILE: root,
-    LOCALAPPDATA: local,
-    APPDATA: roaming,
-    TEMP: temporary,
-    TMP: temporary,
-    ...(process.env.SystemRoot ? { SystemRoot: process.env.SystemRoot } : {}),
-  };
-}
-
-function expectNativeProgress(stderr: string) {
-  const lines = stderr.trim().split(/\r?\n/).filter(Boolean);
-  expect(lines.length).toBeGreaterThan(0);
-  return lines.map(line => {
-    expect(line.startsWith(NATIVE_PROGRESS_PREFIX)).toBe(true);
-    const record = JSON.parse(line.slice(NATIVE_PROGRESS_PREFIX.length));
-    expect(parseNativeCookieDiagnostic(record)).toEqual(record);
-    return record;
-  });
-}
-
-function adapter(options: object, extraEnv: object = {}) {
-  const script = `
-    const { importNativeCookies } = await import(${JSON.stringify(path.resolve(import.meta.dir, '../src/cookie-import-native.ts'))});
-    const { CookieImportError } = await import(${JSON.stringify(path.resolve(import.meta.dir, '../src/cookie-import-browser.ts'))});
-    Object.defineProperty(process, 'platform', { value: 'win32' });
-    Object.defineProperty(process.versions, 'bun', { value: undefined });
-    process.env.LOCALAPPDATA = ${JSON.stringify(env.LOCALAPPDATA)};
-    Object.assign(process.env, ${JSON.stringify(extraEnv)});
-    try { console.log(JSON.stringify({ cookies: await importNativeCookies(${JSON.stringify(options)}) })); }
-    catch (error) { console.log(JSON.stringify({ code: error.code, message: error.message, typed: error instanceof CookieImportError })); }
-  `;
-  const result = spawnSync(process.execPath, ['--no-env-file', '--no-install', `--config=${process.platform === 'win32' ? 'NUL' : '/dev/null'}`, '-e', script], { env: isolatedEnv(), encoding: 'utf8', timeout: 10_000 });
-  expect(result.status).toBe(0);
-  expect(result.stderr).toBe('');
-  return JSON.parse(result.stdout);
-}
-
-const options = {
-  browserName: 'Edge',
-  userDataDir: 'C:\\fixture\\Local\\Microsoft\\Edge\\User Data',
-  profile: 'Default',
-  domains: ['example.test'],
-};
-
-describe('native-cookie production admission', () => {
-  test('the real member entry reports boot and decoded input before refusing an unowned job', () => {
-    const result = spawnSync(process.execPath, ['--no-env-file', '--no-install', '--no-macros', `--config=${process.platform === 'win32' ? 'NUL' : '/dev/null'}`, path.resolve(import.meta.dir, '../src/cookie-import-native-worker.ts'), '--member-smoke'], {
-      env: isolatedEnv(), input: JSON.stringify({ jobName: 'Local\\gstack-cookie-00000000-0000-0000-0000-000000000000' }), encoding: 'utf8', timeout: 10_000,
-    });
-    const progress = expectNativeProgress(result.stderr);
-    expect(progress).toContainEqual({ stage: 'worker_boot', memberMode: true });
-    expect(progress).toContainEqual({ stage: 'member_input' });
-    expect(progress).toContainEqual({ stage: 'member_decoded' });
-    expect(result.status).toBe(1);
-    expect(JSON.parse(result.stdout)).toMatchObject({ error: 'native_supervision_failed', diagnostic: { stage: 'job_open' } });
-  });
-
-  test.each([['malformed', '{'], ['oversized', 'x'.repeat(1024 * 1024 + 1)]])('the real member rejects %s input before opening a job', (_name, input) => {
-    const result = spawnSync(process.execPath, ['--no-env-file', '--no-install', '--no-macros', `--config=${process.platform === 'win32' ? 'NUL' : '/dev/null'}`, path.resolve(import.meta.dir, '../src/cookie-import-native-worker.ts'), '--member-smoke'], {
-      env: isolatedEnv(), input, encoding: 'utf8', timeout: 10_000,
-    });
-    const progress = expectNativeProgress(result.stderr);
-    expect(progress).toContainEqual({ stage: 'member_input' });
-    expect(progress).not.toContainEqual({ stage: 'member_decoded' });
-    expect(progress).not.toContainEqual({ stage: 'job_open' });
-    expect(result.status).toBe(1);
-    expect(JSON.parse(result.stdout)).toEqual({ error: 'native_supervision_failed', diagnostic: { stage: 'member_input' } });
-  });
-
-  test.skipIf(process.platform === 'win32')('qualification refuses non-Windows without issuing a receipt', () => {
-    const result = spawnSync(process.execPath, ['--no-env-file', '--no-install', '--config=/dev/null', path.resolve(import.meta.dir, 'cookie-import-native-qualification.ts'), root], {
-      env: isolatedEnv(), encoding: 'utf8', timeout: 10_000,
-    });
-    expect(result.status).toBe(1);
-    expect(result.stdout).toBe('');
-    expect(result.stderr).toContain('no cases ran and no qualification was issued');
-  });
-
-  test('activation data is separate from the receipt code inputs', () => {
-    expect(NATIVE_CODE_INPUTS).toContain('browse/src/cookie-import-native.ts');
-    expect(NATIVE_CODE_INPUTS).toContain('browse/src/cookie-database.ts');
-    expect(NATIVE_CODE_INPUTS).toContain('browse/src/cookie-import-native-worker.ts');
-    expect(NATIVE_CODE_INPUTS).toContain('browse/scripts/build-node-server.sh');
-    expect(NATIVE_CODE_INPUTS).toContain('browse/dist/server-node.mjs');
-    expect(NATIVE_CODE_INPUTS).not.toContain(NATIVE_QUALIFICATION_DATA);
-  });
-
-  test('empty selection never launches or widens to all cookies', async () => {
-    expect(await importNativeCookies({ ...options, domains: [] })).toEqual([]);
-  });
-
-  test('rejects unsupported production runtime', async () => {
-    await expect(importNativeCookies(options)).rejects.toMatchObject({ code: 'not_supported' });
-  });
-
-  test('rejects invalid domains before launching', async () => {
-    for (const domain of ['https://example.test', 'example.test/path', '*', 'example.test\n--flag']) {
-      await expect(importNativeCookies({ ...options, domains: [domain] })).rejects.toMatchObject({ code: 'invalid_domain' });
-    }
-  });
-
-  test('valid Chromium hostname forms reach runtime admission', async () => {
-    for (const domain of ['service_name.example.test', '-service.example.test', '[::1]']) {
-      await expect(importNativeCookies({ ...options, domains: [domain] })).rejects.toMatchObject({ code: 'not_supported' });
-    }
-  });
-
-  test('unqualified Windows extraction is closed with a typed safe error', () => {
-    expect(adapter(options)).toMatchObject({ code: 'native_unqualified', typed: true });
-  });
-
-  test('environment flags cannot activate unqualified extraction', () => {
-    expect(adapter(options, { GSTACK_COOKIE_NATIVE_QUALIFY: '1', GSTACK_NATIVE_COOKIES: '1' })).toMatchObject({ code: 'native_unqualified', typed: true });
-  });
-
-  test('Chrome default user-data policy also blocks numbered profiles', () => {
-    const result = adapter({ ...options, browserName: 'Chrome', userDataDir: 'C:\\fixture\\Local\\Google\\Chrome\\User Data', profile: 'Profile 2' });
-    expect(result.code).toBe('native_profile_unsupported');
-    expect(result.message).toContain('Chrome 136');
-    expect(result.message).toContain('both pipe and TCP');
-    expect(result.message).toContain('sign in manually');
-  });
-
-  test('does not substitute a different browser for an unsupported identity', () => {
-    expect(adapter({ ...options, browserName: 'Dia' })).toMatchObject({ code: 'not_supported', typed: true });
-  });
-
-  test('rejects mismatched and copied profile roots', () => {
-    expect(adapter({ ...options, browserName: 'Brave' })).toMatchObject({ code: 'native_profile_unsupported' });
-    expect(adapter({ ...options, userDataDir: 'C:\\copied-profile' })).toMatchObject({ code: 'native_profile_unsupported' });
-  });
-
-  test('rejects profile traversal without echoing the supplied text', () => {
-    const result = adapter({ ...options, profile: '../sensitive-sentinel' });
-    expect(result.code).toBe('invalid_profile');
-    expect(JSON.stringify(result)).not.toContain('sensitive-sentinel');
-  });
-
-  test('maps every supported browser to only its own executable and data root', () => {
-    const expected = [
-      ['Chrome', 'Google\\Chrome', 'chrome.exe'],
-      ['Chromium', 'Chromium', 'chrome.exe'],
-      ['Brave', 'BraveSoftware\\Brave-Browser', 'brave.exe'],
-      ['Edge', 'Microsoft\\Edge', 'msedge.exe'],
-    ];
-    for (const [name, relative, exe] of expected) {
-      const mapping = nativeBrowserPaths(name, env);
-      expect(mapping.userDataDir).toBe(`${env.LOCALAPPDATA}\\${relative}\\User Data`);
-      expect(mapping.executables.length).toBeGreaterThan(0);
-      for (const candidate of mapping.executables) expect(candidate.endsWith(`\\${relative}\\Application\\${exe}`)).toBe(true);
-    }
-    expect(nativeBrowserPaths('Edge', env).executables[0]).toStartWith('C:\\Apps32');
-    expect(nativeBrowserPaths('Brave', env).executables.join(' ')).not.toContain('chrome.exe');
-  });
-
-  test('browser environment excludes inherited secrets and runtime injection', () => {
-    expect(nativeCookieEnvironment({ ...env, SystemRoot: 'C:\\Windows', API_KEY: 'sensitive-sentinel', NODE_OPTIONS: '--require=unsafe', DEBUG: 'pw:*', PWDEBUG: '1' })).toEqual({ ...env, SystemRoot: 'C:\\Windows' });
-  });
-});
-
-async function qualifiedAdapterFixture() {
-  const fixture = mkdtempSync(path.join(root, 'admission-'));
-  for (const file of NATIVE_CODE_INPUTS) {
-    const destination = path.join(fixture, file);
-    mkdirSync(path.dirname(destination), { recursive: true });
-    if (file === 'browse/dist/server-node.mjs') continue;
-    copyFileSync(path.resolve(import.meta.dir, '../..', file === 'browse/dist/bun-polyfill.cjs' ? 'browse/src/bun-polyfill.cjs' : file), destination);
-  }
-  const activation = path.join(fixture, NATIVE_QUALIFICATION_DATA);
-  writeFileSync(activation, '[]\n');
-  const bundle = path.join(fixture, 'browse/dist/server-node.mjs');
-  const build = async () => {
-    const result = await Bun.build({
-      entrypoints: [path.join(fixture, 'browse/src/cookie-import-native.ts')],
-      target: 'node',
-      define: { 'import.meta.dir': JSON.stringify(path.join(fixture, 'browse/src')) },
-    });
-    expect(result.success).toBe(true);
-    writeFileSync(bundle, await result.outputs[0].text());
-  };
-  await build();
-  const probe = spawnSync(node!, ['-p', 'JSON.stringify({ version: process.version, architecture: process.arch })'], { env: isolatedEnv(), encoding: 'utf8', timeout: 10_000 });
-  expect(probe.status).toBe(0);
-  const runtime = JSON.parse(probe.stdout);
-  const sourceHashes = await nativeCodeHashes(fixture, Date.now() + 25_000);
-  const receipt = {
-    browserName: 'Edge', architecture: runtime.architecture, windowsRelease: release(),
-    executableSha256: '0'.repeat(64), nodeVersion: runtime.version, bunVersion: Bun.version,
-    playwrightVersion: '1.62.1', sourceHashes,
-  };
-  const virtualRoot = `C:\\gstack-${path.basename(fixture)}`;
-  const windowsEnv = { LOCALAPPDATA: `${virtualRoot}\\Local`, PROGRAMFILES: `${virtualRoot}\\Apps`, 'PROGRAMFILES(X86)': `${virtualRoot}\\Apps32` };
-  const input = { ...options, userDataDir: nativeBrowserPaths('Edge', windowsEnv).userDataDir };
-  const invoke = () => {
-    const script = `
-      import cp from 'node:child_process';
-      import { syncBuiltinESMExports } from 'node:module';
-      let spawns = 0;
-      cp.spawn = () => { spawns++; throw new Error('Unexpected browser launch before source admission'); };
-      syncBuiltinESMExports();
-      const { importNativeCookies } = await import(${JSON.stringify(pathToFileURL(bundle).href)});
-      Object.defineProperty(process, 'platform', { value: 'win32' });
-      Object.assign(process.env, ${JSON.stringify(windowsEnv)});
-      try { await importNativeCookies(${JSON.stringify(input)}); console.log(JSON.stringify({ accepted: true, spawns })); }
-      catch (error) { console.log(JSON.stringify({ code: error.code, message: error.message, spawns, typed: error.name === 'CookieImportError' })); }
-    `;
-    const result = spawnSync(node!, ['--input-type=module', '-e', script], { cwd: fixture, env: isolatedEnv(), encoding: 'utf8', timeout: 10_000 });
-    expect(result.status).toBe(0);
-    expect(result.stderr).toBe('');
-    return JSON.parse(result.stdout);
-  };
-  return { fixture, activation, bundle, build, receipt, invoke };
-}
-
-describe('production adapter source-bound qualification', () => {
-  test('matching code passes admission, while later worker/core/database/bundle edits reject the old receipt', async () => {
-    const fixture = await qualifiedAdapterFixture();
-    expect(fixture.invoke()).toMatchObject({ code: 'native_unqualified', spawns: 0, typed: true });
-    writeFileSync(fixture.activation, JSON.stringify([fixture.receipt]));
-    expect(fixture.invoke()).toMatchObject({ code: 'not_installed', spawns: 0, typed: true });
-    for (const file of ['browse/src/cookie-import-native-worker.ts', 'browse/src/cookie-import-native-job.ts', 'browse/src/cookie-import-native-integrity.ts', 'browse/src/cookie-import-browser.ts', 'browse/src/cookie-database.ts', 'browse/scripts/build-node-server.sh', 'browse/dist/server-node.mjs']) {
-      const target = path.join(fixture.fixture, file);
-      const original = readFileSync(target);
-      writeFileSync(target, Buffer.concat([original, Buffer.from('\n')]));
-      expect(fixture.invoke()).toMatchObject({ code: 'native_unqualified', spawns: 0, typed: true });
-      writeFileSync(target, original);
-    }
-    expect(fixture.invoke()).toMatchObject({ code: 'not_installed', spawns: 0, typed: true });
-  });
-
-  test('activation-only edits preserve all bound bytes, including a rebuilt Node bundle', async () => {
-    const fixture = await qualifiedAdapterFixture();
-    const before = readFileSync(fixture.bundle);
-    writeFileSync(fixture.activation, JSON.stringify([fixture.receipt], null, 2) + '\n');
-    await fixture.build();
-    expect(readFileSync(fixture.bundle)).toEqual(before);
-    expect(await nativeCodeHashes(fixture.fixture, Date.now() + 25_000)).toEqual(fixture.receipt.sourceHashes);
-    expect(fixture.invoke()).toMatchObject({ code: 'not_installed', spawns: 0 });
-  });
-
-  test('partial or legacy receipts cannot activate even when their browser/runtime tuple matches', async () => {
-    const fixture = await qualifiedAdapterFixture();
-    const sourceHashes = { ...fixture.receipt.sourceHashes };
-    delete sourceHashes['browse/src/cookie-database.ts'];
-    writeFileSync(fixture.activation, JSON.stringify([{ ...fixture.receipt, sourceHashes }]));
-    expect(fixture.invoke()).toMatchObject({ code: 'native_unqualified', spawns: 0 });
-    writeFileSync(fixture.activation, JSON.stringify([{ ...fixture.receipt, sourceHashes: undefined }]));
-    expect(fixture.invoke()).toMatchObject({ code: 'native_unqualified', spawns: 0 });
-    expect(nativeCodeMatches(sourceHashes, fixture.receipt.sourceHashes)).toBe(false);
-  });
-
-  test('qualification reads have a size cap and share the operation deadline', async () => {
-    const fixture = mkdtempSync(path.join(root, 'bounds-'));
-    const activation = path.join(fixture, NATIVE_QUALIFICATION_DATA);
-    mkdirSync(path.dirname(activation), { recursive: true });
-    writeFileSync(activation, ' '.repeat(1024 * 1024 + 1));
-    await expect(readNativeQualifications(fixture, Date.now() + 25_000)).rejects.toThrow('native_unqualified');
-    await expect(hashNativeFile(activation, Date.now() - 1)).rejects.toThrow('native_timeout');
-  });
-
-  test('a stalled source read aborts and destroys its stream at the deadline', async () => {
-    const fixture = mkdtempSync(path.join(root, 'stalled-read-'));
-    const entry = path.join(fixture, 'integrity.mjs');
-    const built = await Bun.build({ entrypoints: [path.resolve(import.meta.dir, '../src/cookie-import-native-integrity.ts')], target: 'node' });
-    expect(built.success).toBe(true);
-    writeFileSync(entry, await built.outputs[0].text());
-    const script = `
-      import fs from 'node:fs';
-      import { Readable } from 'node:stream';
-      import { syncBuiltinESMExports } from 'node:module';
-      let aborted = false;
-      let closed = false;
-      fs.createReadStream = (file, options) => {
-        const stream = new Readable({ read() {} });
-        stream.once('close', () => { closed = true; });
-        options.signal.addEventListener('abort', () => { aborted = true; stream.destroy(new Error('synthetic interruption')); }, { once: true });
-        return stream;
-      };
-      syncBuiltinESMExports();
-      const { hashNativeFile } = await import(${JSON.stringify(pathToFileURL(entry).href)});
-      const started = Date.now();
-      let code;
-      try { await hashNativeFile('synthetic-source', started + 20); }
-      catch (error) { code = error.message; }
-      await new Promise(resolve => setImmediate(resolve));
-      console.log(JSON.stringify({ code, aborted, closed, elapsed: Date.now() - started }));
-    `;
-    const result = spawnSync(node!, ['--input-type=module', '-e', script], { env: isolatedEnv(), encoding: 'utf8', timeout: 10_000 });
-    expect(result.status).toBe(0);
-    expect(result.stderr).toBe('');
-    const outcome = JSON.parse(result.stdout);
-    expect(outcome).toMatchObject({ code: 'native_timeout', aborted: true, closed: true });
-    expect(outcome.elapsed).toBeLessThan(1500);
-  });
-});
-
-function runNodeWorker(mode: string, cookies: object[] = [], exitCode = 21) {
-  const fixture = mkdtempSync(path.join(root, 'worker-'));
-  const observation = path.join(fixture, 'observed.json');
-  const playwrightEntry = path.join(fixture, 'playwright.cjs');
-  writeFileSync(playwrightEntry, `
-    exports.chromium = {
-      async launchPersistentContext(userDataDir, options) {
-        require('node:fs').writeFileSync(${JSON.stringify(observation)}, JSON.stringify({ userDataDir, options, nodeVersion: process.version }));
-        if (${JSON.stringify(mode)} === 'locked') throw new Error('ProcessSingleton sensitive-sentinel');
-        if (${JSON.stringify(mode)} === 'policy') throw new Error('Remote debugging requires a non-default data directory sensitive-sentinel');
-        if (${JSON.stringify(mode)} === 'failure') throw new Error('sensitive-sentinel');
-        if (${JSON.stringify(mode)} === 'process-exit') throw new Error('<process did exit: exitCode=${exitCode}, signal=null> sensitive-sentinel');
-        return { cookies: async () => ${JSON.stringify(cookies)}, close: async () => {} };
-      },
-    };
-  `);
-  const userDataDir = path.join(fixture, 'profile');
-  mkdirSync(userDataDir);
-  const result = spawnSync(node!, ['--input-type=commonjs', '-e', NATIVE_COOKIE_NODE_SCRIPT], {
-    env: isolatedEnv(),
-    input: JSON.stringify({ playwrightEntry, userDataDir, executablePath: 'C:\\Apps\\Microsoft\\Edge\\Application\\msedge.exe', profile: 'Profile 2', domains: ['EXAMPLE.TEST.'], deadline: Date.now() + 25_000 }),
-    encoding: 'utf8',
-    timeout: 30_000,
-  });
-  expect(result.status).toBe(0);
-  const progress = expectNativeProgress(result.stderr);
-  expect(progress).toContainEqual({ stage: 'node_input' });
-  expect(progress).toContainEqual({ stage: 'node_load' });
-  return { result: JSON.parse(result.stdout), observation: JSON.parse(readFileSync(observation, 'utf8')), userDataDir };
-}
-
-describe('production Node Playwright worker', () => {
-  test('real synthetic Playwright pipe smoke uses no TCP and leaves no browser', () => {
-    const require = createRequire(import.meta.url);
-    const { chromium } = require('playwright');
-    const fixture = mkdtempSync(path.join(root, 'pipe-'));
-    const observation = path.join(fixture, 'launch.json');
-    const playwrightEntry = path.join(fixture, 'instrumented-playwright.cjs');
-    writeFileSync(playwrightEntry, `
-      const cp = require('node:child_process');
-      const spawn = cp.spawn;
-      cp.spawn = function(command, args, options) {
-        const child = spawn.call(this, command, args, options);
-        require('node:fs').writeFileSync(${JSON.stringify(observation)}, JSON.stringify({ args, pid: child.pid }));
-        return child;
-      };
-      const { chromium } = require(${JSON.stringify(require.resolve('playwright'))});
-      exports.chromium = { async launchPersistentContext(root, options) {
-        const context = await chromium.launchPersistentContext(root, options);
-        await context.addCookies([{ name: 'synthetic', value: 'synthetic', domain: 'example.test', path: '/' }]);
-        return context;
-      } };
-    `);
-    const result = spawnSync(node!, ['--input-type=commonjs', '-e', NATIVE_COOKIE_NODE_SCRIPT], {
-      env: isolatedEnv(),
-      input: JSON.stringify({ playwrightEntry, userDataDir: path.join(fixture, 'User Data'), executablePath: chromium.executablePath(), profile: 'Default', domains: ['example.test'], deadline: Date.now() + 25_000 }),
-      encoding: 'utf8',
-      timeout: 30_000,
-    });
-    expect(result.status).toBe(0);
-    const progress = expectNativeProgress(result.stderr);
-    expect(progress).toContainEqual({ stage: 'browser_launch' });
-    expect(progress).toContainEqual({ stage: 'cookie_read' });
-    expect(JSON.parse(result.stdout).cookies).toHaveLength(1);
-    const launched = JSON.parse(readFileSync(observation, 'utf8'));
-    expect(launched.args).toContain('--remote-debugging-pipe');
-    expect(launched.args.some((arg: string) => arg.startsWith('--remote-debugging-port'))).toBe(false);
-    expect(launched.args.some((arg: string) => /^--(?:no-sandbox|disable-setuid-sandbox)(?:=|$)/.test(arg))).toBe(false);
-    expect(launched.args).toContain(`--user-data-dir=${path.join(fixture, 'User Data')}`);
-    expect(() => process.kill(launched.pid, 0)).toThrow();
-  }, 35_000);
-
-  test('launches the requested profile once through Playwright with no TCP or bypass arguments', () => {
-    const { result, observation, userDataDir } = runNodeWorker('success');
-    expect(result).toEqual({ cookies: [] });
-    expect(observation.userDataDir).toBe(userDataDir);
-    expect(observation.options).toMatchObject({
-      executablePath: 'C:\\Apps\\Microsoft\\Edge\\Application\\msedge.exe',
-      args: ['--profile-directory=Profile 2'],
-      handleSIGINT: false, handleSIGTERM: false, handleSIGHUP: false,
-      headless: true,
-      chromiumSandbox: true,
-    });
-    expect(observation.options.timeout).toBeGreaterThan(0);
-    expect(observation.options.timeout).toBeLessThanOrEqual(25_000);
-    expect(observation.nodeVersion).toStartWith('v');
-    expect(Object.keys(observation.options.env)).not.toContain('NODE_OPTIONS');
-  });
-
-  test('bare/dotted matching preserves scope and cookie attributes', () => {
-    const cookie = { name: 'synthetic', value: 'synthetic', domain: 'example.test', path: '/', httpOnly: true, secure: true, sameSite: 'Lax', expires: -1 };
-    const selected = [cookie, { ...cookie, domain: '.example.test' }];
-    const { result } = runNodeWorker('success', [...selected, { ...cookie, domain: 'other.example.test' }, { ...cookie, domain: 'badexample.test' }]);
-    expect(result.cookies).toEqual(selected);
-  });
-
-  test.each([['locked', 'browser_running'], ['policy', 'native_profile_unsupported'], ['failure', 'native_failed']])('classifies %s without leaking browser stderr or retrying', (mode, error) => {
-    const { result } = runNodeWorker(mode);
-    expect(result).toEqual({ error, diagnostic: { stage: 'browser_launch' } });
-    expect(JSON.stringify(result)).not.toContain('sensitive-sentinel');
-  });
-
-  test('reports only the managed browser exit code, not raw launch errors', () => {
-    const { result } = runNodeWorker('process-exit');
-    expect(result).toEqual({ error: 'browser_running', diagnostic: { stage: 'browser_launch', exitCode: 21 } });
-    expect(JSON.stringify(result)).not.toContain('sensitive-sentinel');
-  });
-
-  test.each([0, 1, 20, 22, 24, -1, -1073741819])('does not classify unrelated browser exit %d as a profile lock', exitCode => {
-    const { result } = runNodeWorker('process-exit', [], exitCode);
-    expect(result).toEqual({ error: 'native_failed', diagnostic: { stage: 'browser_launch', exitCode } });
-  });
-});