@amg555/frameforge-mcp 2.7.6 → 2.7.8

package/.agent/skills/gstack-browse/test/session-persist.test.ts

@@ -1,287 +0,0 @@
-/**
- * Opt-in session-state persistence (#778, #2193, #1128, #1129).
- *
- * Pins the leg of the browser-lifecycle contract that had no coverage:
- * "shut down without losing live session state." Pre-fix, the headless
- * daemon used non-persistent chromium.launch() with zero storage
- * persistence — any crash or binary-version auto-restart silently lost all
- * auth. These tests fail on the old tree (module absent, no wiring).
- *
- * Suites:
- *   1. Pure serialize/deserialize/filter units (free, instant).
- *   2. Real-Chromium round-trip: cookie + localStorage survive a full
- *      manager teardown + relaunch via persist/restore.
- *   3. Static wiring tripwire: server.ts restores at launch, snapshots at
- *      shutdown, and the gate is BROWSE_PERSIST_STATE (default off).
- */
-
-import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
-import { canRevokeWrites } from '../../test/helpers/fs-caps';
-import * as fs from 'fs';
-import * as os from 'os';
-import * as path from 'path';
-import {
-  serializeSessionState, deserializeSessionState, filterSessionCookies,
-  isSessionPersistEnabled, persistSessionState, restoreSessionState,
-} from '../src/session-persist';
-import type { BrowserState } from '../src/browser-manager';
-
-// Per-FILE Chromium profile: this file launches an in-process persistent
-// context (BrowserManager.launch()), and sharing a profile dir with the
-// long-lived browse daemon a sibling file may have spawned kills one side's
-// Chromium (ProcessSingleton on user-data-dir). Scoped via hooks, never
-// module scope (see test/gstack-home-module-scope.test.ts's rationale).
-const ORIGINAL_CHROMIUM_PROFILE = process.env.CHROMIUM_PROFILE;
-let CHROMIUM_PROFILE_DIR: string | undefined;
-beforeAll(() => {
-  CHROMIUM_PROFILE_DIR = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-test-profile-'));
-  process.env.CHROMIUM_PROFILE = CHROMIUM_PROFILE_DIR;
-});
-afterAll(() => {
-  if (ORIGINAL_CHROMIUM_PROFILE === undefined) delete process.env.CHROMIUM_PROFILE;
-  else process.env.CHROMIUM_PROFILE = ORIGINAL_CHROMIUM_PROFILE;
-  if (CHROMIUM_PROFILE_DIR) { try { fs.rmSync(CHROMIUM_PROFILE_DIR, { recursive: true, force: true }); } catch {} }
-});
-
-
-const tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'browse-persist-'));
-afterAll(() => { fs.rmSync(tmpRoot, { recursive: true, force: true }); });
-
-describe('session-persist units', () => {
-  test('config gate: default off, exactly "1" enables', () => {
-    expect(isSessionPersistEnabled({} as NodeJS.ProcessEnv)).toBe(false);
-    expect(isSessionPersistEnabled({ BROWSE_PERSIST_STATE: '0' } as any)).toBe(false);
-    expect(isSessionPersistEnabled({ BROWSE_PERSIST_STATE: 'true' } as any)).toBe(false);
-    expect(isSessionPersistEnabled({ BROWSE_PERSIST_STATE: '1' } as any)).toBe(true);
-  });
-
-  test('serialize strips loadedHtml/owner, keeps cookies + storage', () => {
-    const state: BrowserState = {
-      cookies: [{ name: 'sid', value: 'abc', domain: 'example.com', path: '/', expires: -1, httpOnly: false, secure: false, sameSite: 'Lax' } as any],
-      pages: [{
-        url: 'https://example.com/app',
-        isActive: true,
-        storage: { localStorage: { k: 'v' }, sessionStorage: {} },
-        loadedHtml: '<script>evil</script>',
-        loadedHtmlWaitUntil: 'load',
-        owner: 'agent-1',
-      }],
-    };
-    const raw = serializeSessionState(state);
-    expect(raw).not.toContain('loadedHtml');
-    expect(raw).not.toContain('evil');
-    expect(raw).not.toContain('owner');
-    const parsed = JSON.parse(raw);
-    expect(parsed.version).toBe(1);
-    expect(parsed.cookies[0].name).toBe('sid');
-    expect(parsed.pages[0].storage.localStorage.k).toBe('v');
-  });
-
-  test('deserialize rejects corrupt JSON, wrong version, missing arrays', () => {
-    expect(deserializeSessionState('not json{')).toBeNull();
-    expect(deserializeSessionState('{"version":99,"cookies":[],"pages":[]}')).toBeNull();
-    expect(deserializeSessionState('{"version":1,"cookies":{}}')).toBeNull();
-  });
-
-  test('deserialize strips loadedHtml/owner even if tampered onto disk', () => {
-    const raw = JSON.stringify({
-      version: 1,
-      cookies: [],
-      pages: [{ url: 'https://x.com', isActive: true, storage: null, loadedHtml: '<h1>x</h1>', owner: 'evil' }],
-    });
-    const state = deserializeSessionState(raw)!;
-    expect((state.pages[0] as any).loadedHtml).toBeUndefined();
-    expect((state.pages[0] as any).owner).toBeUndefined();
-  });
-
-  test('cookie filter drops malformed + internal-network domains', () => {
-    const kept = filterSessionCookies([
-      { name: 'ok', value: 'v', domain: 'example.com' },
-      { name: 'ok2', value: 'v', domain: '.example.com' }, // leading-dot public domain kept
-      { name: 'bad1', value: 'v', domain: 'localhost' },
-      { name: 'bad2', value: 'v', domain: '.corp.internal' },
-      { name: 'bad3', value: 'v', domain: '169.254.169.254' },
-      { name: 'bad4', value: 'v', domain: '169.254.1.2' }, // whole link-local block, not just metadata
-      { name: 'bad5', value: 'v', domain: '127.0.0.1' }, // IPv4 loopback literal
-      { name: 'bad6', value: 'v', domain: '.127.0.0.1' }, // leading-dot loopback variant
-      { name: 'bad7', value: 'v', domain: '::1' }, // IPv6 loopback
-      { name: 'bad8', value: 'v', domain: '[::1]' }, // bracketed IPv6 loopback
-      { name: 'bad9', value: 42, domain: 'example.com' },
-      null,
-    ]);
-    expect(kept.map((c: any) => c.name)).toEqual(['ok', 'ok2']);
-  });
-
-  test('restoreSessionState: missing file → null, corrupt file → quarantined to .corrupt', async () => {
-    const bmNeverCalled = { closeAllPages() { throw new Error('must not restore'); } } as any;
-    expect(await restoreSessionState(bmNeverCalled, path.join(tmpRoot, 'nope.json'))).toBeNull();
-    const corrupt = path.join(tmpRoot, 'corrupt.json');
-    fs.writeFileSync(corrupt, '{oops');
-    expect(await restoreSessionState(bmNeverCalled, corrupt)).toBeNull();
-    expect(fs.existsSync(corrupt)).toBe(false); // moved aside, won't block every future launch
-    expect(fs.existsSync(`${corrupt}.corrupt`)).toBe(true); // forensic artifact kept (R3)
-  });
-
-  test('persistSessionState is a no-op in headed mode (profile owns state)', async () => {
-    const file = path.join(tmpRoot, 'headed.json');
-    const bm = {
-      getConnectionMode: () => 'headed',
-      saveState() { throw new Error('must not snapshot headed session'); },
-    } as any;
-    await persistSessionState(bm, file);
-    expect(fs.existsSync(file)).toBe(false);
-  });
-
-  test('persist writes atomically: no .tmp left behind, file parses', async () => {
-    const file = path.join(tmpRoot, 'atomic.json');
-    const state: BrowserState = {
-      cookies: [{ name: 'sid', value: 'abc', domain: 'example.com' } as any],
-      pages: [{ url: 'https://example.com', isActive: true, storage: null }],
-    };
-    const bm = { getConnectionMode: () => 'launched', saveState: async () => state } as any;
-    await persistSessionState(bm, file);
-    expect(fs.existsSync(`${file}.tmp`)).toBe(false); // staged copy renamed away
-    const parsed = JSON.parse(fs.readFileSync(file, 'utf-8'));
-    expect(parsed.cookies[0].name).toBe('sid');
-  });
-
-  test('a failed snapshot write preserves the previous good snapshot', async () => {
-    // chmod-based read-only dirs don't bind on Windows or when running as root.
-    if (!canRevokeWrites()) return; // chmod is advisory here (win32, root, DAC-override containers)
-    const dir = path.join(tmpRoot, 'ro');
-    fs.mkdirSync(dir);
-    const file = path.join(dir, 'session-state.json');
-    const goodState: BrowserState = {
-      cookies: [],
-      pages: [{ url: 'https://good.example', isActive: true, storage: null }],
-    };
-    const bm = { getConnectionMode: () => 'launched', saveState: async () => goodState } as any;
-    await persistSessionState(bm, file);
-    fs.chmodSync(dir, 0o500); // next .tmp write throws EACCES mid-persist
-    try {
-      await expect(persistSessionState(bm, file)).rejects.toThrow();
-      // The crash-mid-write scenario the feature exists to survive: the
-      // previous good snapshot is untouched and still parses.
-      const parsed = JSON.parse(fs.readFileSync(file, 'utf-8'));
-      expect(parsed.pages[0].url).toBe('https://good.example');
-    } finally {
-      fs.chmodSync(dir, 0o700);
-    }
-  });
-});
-
-describe('session-persist round-trip (real Chromium)', () => {
-  test('cookie + localStorage + URL survive teardown → relaunch; loopback cookies dropped', async () => {
-    const { BrowserManager } = await import('../src/browser-manager');
-    const { startTestServer } = await import('./test-server');
-    const { server, url } = startTestServer(0);
-    const stateFile = path.join(tmpRoot, 'roundtrip.json');
-
-    const bm1 = new BrowserManager();
-    await bm1.launch();
-    try {
-      const page = bm1.getPage();
-      await page.goto(`${url}/basic.html`, { waitUntil: 'domcontentloaded' });
-      // Real-site cookie: set on the context for a non-loopback domain (the
-      // restore hygiene filter deliberately drops loopback/link-local
-      // domains, so a 127.0.0.1 test-server cookie can't stand in for it).
-      await page.context().addCookies([
-        { name: 'session_marker', value: 'alive-after-restart', domain: 'example.com', path: '/' },
-      ]);
-      await page.evaluate(() => {
-        document.cookie = 'loopback_marker=must-be-dropped; path=/'; // 127.0.0.1 host cookie
-        localStorage.setItem('auth_marker', 'still-logged-in');
-      });
-      await persistSessionState(bm1, stateFile);
-    } finally {
-      await bm1.close();
-    }
-
-    // File on disk is owner-only (cookies are secrets).
-    if (process.platform !== 'win32') {
-      expect(fs.statSync(stateFile).mode & 0o777).toBe(0o600);
-    }
-
-    const bm2 = new BrowserManager();
-    await bm2.launch();
-    try {
-      const restored = await restoreSessionState(bm2, stateFile);
-      expect(restored).not.toBeNull();
-      expect(restored!.pages.length).toBe(1); // counts derivable without a saveState() round-trip
-      // Hygiene filter applied at restore: the real-site cookie survives,
-      // the loopback cookie does not.
-      expect(restored!.cookies.map((c: any) => c.name)).toEqual(['session_marker']);
-      const page = bm2.getPage();
-      expect(page.url()).toContain('/basic.html');
-      const marker = await page.evaluate(() => ({
-        cookie: document.cookie,
-        auth: localStorage.getItem('auth_marker'),
-      }));
-      expect(marker.cookie).not.toContain('loopback_marker'); // dropped by isInternalCookieDomain
-      expect(marker.auth).toBe('still-logged-in');
-      const restoredCookies = await page.context().cookies('https://example.com');
-      expect(restoredCookies.map((c) => `${c.name}=${c.value}`)).toContain('session_marker=alive-after-restart');
-    } finally {
-      await bm2.close();
-      server.stop(true);
-    }
-  }, 60_000);
-});
-
-describe('server wiring (static tripwire)', () => {
-  const SERVER_SRC = fs.readFileSync(path.join(import.meta.dir, '..', 'src', 'server.ts'), 'utf-8');
-
-  test('start() restores and schedules interval snapshots behind the gate', () => {
-    expect(SERVER_SRC).toContain('isSessionPersistEnabled()');
-    expect(SERVER_SRC).toContain('restoreSessionState(browserManager');
-    expect(SERVER_SRC).toContain('sessionPersistIntervalMs()');
-  });
-
-  test('start() restores in the background AFTER the port binds (CLI readiness must not wait)', () => {
-    // Restore re-creates tabs with up-to-15s goto timeouts; the CLI gives up
-    // at 8s. A restore that runs before Bun.serve() makes every $B command
-    // report "Server failed to start" on one slow saved URL.
-    const serveAt = SERVER_SRC.indexOf('const server = Bun.serve(');
-    const restoreAt = SERVER_SRC.indexOf('restoreSessionState(browserManager');
-    expect(serveAt).toBeGreaterThan(-1);
-    expect(restoreAt).toBeGreaterThan(serveAt);
-  });
-
-  test('interval snapshots carry an in-flight guard (no overlapping persists)', () => {
-    expect(SERVER_SRC).toContain('persistInFlight');
-  });
-
-  test('interval ticks are gated on isShuttingDown (belt half of the shutdown ordering fix)', () => {
-    // A tick that fires during browser teardown snapshots a degraded state
-    // (zero tabs) over the good final snapshot. The handle-clear in shutdown()
-    // is the suspenders; this gate is the belt for a tick already scheduled.
-    const tickerAt = SERVER_SRC.indexOf('sessionPersistInterval = setInterval(');
-    expect(tickerAt).toBeGreaterThan(-1);
-    const tickerBlock = SERVER_SRC.slice(tickerAt, tickerAt + 500);
-    expect(tickerBlock).toContain('if (isShuttingDown) return;');
-  });
-
-  test('shutdown() clears the persist ticker BEFORE the final snapshot (suspenders half)', () => {
-    const shutdownStart = SERVER_SRC.indexOf('async function shutdown(');
-    const clearAt = SERVER_SRC.indexOf('clearInterval(sessionPersistInterval)', shutdownStart);
-    const persistAt = SERVER_SRC.indexOf('persistSessionState(cfgBrowserManager', shutdownStart);
-    expect(clearAt).toBeGreaterThan(shutdownStart);
-    expect(persistAt).toBeGreaterThan(clearAt);
-  });
-
-  test('shutdown() takes a final snapshot BEFORE closing the browser', () => {
-    const shutdownStart = SERVER_SRC.indexOf('async function shutdown(');
-    const persistAt = SERVER_SRC.indexOf('persistSessionState(cfgBrowserManager', shutdownStart);
-    const closeAt = SERVER_SRC.indexOf('await cfgBrowserManager.close()', shutdownStart);
-    expect(persistAt).toBeGreaterThan(shutdownStart);
-    expect(closeAt).toBeGreaterThan(persistAt);
-  });
-
-  test('shutdown() snapshot is deadlined — a wedged page.evaluate cannot hang shutdown', () => {
-    const shutdownStart = SERVER_SRC.indexOf('async function shutdown(');
-    const closeAt = SERVER_SRC.indexOf('await cfgBrowserManager.close()', shutdownStart);
-    const raceAt = SERVER_SRC.indexOf('Promise.race', shutdownStart);
-    expect(raceAt).toBeGreaterThan(shutdownStart);
-    expect(raceAt).toBeLessThan(closeAt);
-  });
-});

package/.agent/skills/gstack-browse/test/sidebar-tabs.test.ts

@@ -1,268 +0,0 @@
-/**
- * Regression: sidebar layout invariants after the chat-tab rip.
- *
- * The Chrome side panel used to host two surfaces: Chat (one-shot
- * `claude -p` queue) and Terminal (interactive PTY). Chat was ripped
- * once the PTY proved out — sidebar-agent.ts is gone, the chat queue
- * endpoints are gone, and the primary-tab nav (Terminal | Chat) is
- * gone. Terminal is now the sole primary surface.
- *
- * This file locks the load-bearing invariants of that layout so a
- * future refactor can't silently re-introduce the old surface or break
- * the new one.
- */
-
-import { describe, test, expect } from 'bun:test';
-import * as fs from 'fs';
-import * as path from 'path';
-import { ROUTES } from '../src/routes';
-import { makeServer } from './route-test-harness';
-
-const HTML = fs.readFileSync(path.join(import.meta.dir, '../../extension/sidepanel.html'), 'utf-8');
-const JS = fs.readFileSync(path.join(import.meta.dir, '../../extension/sidepanel.js'), 'utf-8');
-const TERM_JS = fs.readFileSync(path.join(import.meta.dir, '../../extension/sidepanel-terminal.js'), 'utf-8');
-const MANIFEST = JSON.parse(fs.readFileSync(path.join(import.meta.dir, '../../extension/manifest.json'), 'utf-8'));
-
-describe('sidebar: chat tab + nav are removed, Terminal is sole primary surface', () => {
-  test('No primary-tab nav element exists', () => {
-    expect(HTML).not.toContain('class="primary-tabs"');
-    expect(HTML).not.toContain('data-pane="chat"');
-    expect(HTML).not.toContain('data-pane="terminal"');
-  });
-
-  test('No <main id="tab-chat"> pane', () => {
-    expect(HTML).not.toMatch(/<main[^>]*id="tab-chat"/);
-    expect(HTML).not.toContain('id="chat-messages"');
-    expect(HTML).not.toContain('id="chat-loading"');
-    expect(HTML).not.toContain('id="chat-welcome"');
-  });
-
-  test('No chat input / send button / experimental banner', () => {
-    expect(HTML).not.toContain('class="command-bar"');
-    expect(HTML).not.toContain('id="command-input"');
-    expect(HTML).not.toContain('id="send-btn"');
-    expect(HTML).not.toContain('id="stop-agent-btn"');
-    expect(HTML).not.toContain('id="experimental-banner"');
-  });
-
-  test('No clear-chat button in footer', () => {
-    expect(HTML).not.toContain('id="clear-chat"');
-  });
-
-  test('Terminal pane is .active by default and has the toolbar', () => {
-    expect(HTML).toMatch(/<main[^>]*id="tab-terminal"[^>]*class="tab-content active"/);
-    expect(HTML).toContain('id="terminal-toolbar"');
-    expect(HTML).toContain('id="terminal-restart-now"');
-  });
-
-  test('Quick-actions buttons (Cleanup / Screenshot / Cookies) survive in the terminal toolbar', () => {
-    // Garry explicitly wanted these kept after the chat rip — they drive
-    // browser actions, not chat.
-    expect(HTML).toContain('id="chat-cleanup-btn"');
-    expect(HTML).toContain('id="chat-screenshot-btn"');
-    expect(HTML).toContain('id="chat-cookies-btn"');
-    // They live inside the terminal toolbar now (siblings of the Restart
-    // button), not as a separate strip below all panes.
-    const toolbarStart = HTML.indexOf('id="terminal-toolbar"');
-    const toolbarEnd = HTML.indexOf('</div>', toolbarStart);
-    const toolbarBlock = HTML.slice(toolbarStart, toolbarEnd + 6);
-    expect(toolbarBlock).toContain('id="chat-cleanup-btn"');
-    expect(toolbarBlock).toContain('id="chat-screenshot-btn"');
-    expect(toolbarBlock).toContain('id="chat-cookies-btn"');
-  });
-});
-
-describe('sidepanel.js: chat helpers ripped, terminal-injection helper survives', () => {
-  test('No primary-tab click handler', () => {
-    expect(JS).not.toContain("querySelectorAll('.primary-tab')");
-    expect(JS).not.toContain('activePrimaryPaneId');
-  });
-
-  test('No chat polling, sendMessage, sendChat, stopAgent, or pollTabs', () => {
-    expect(JS).not.toContain('chatPollInterval');
-    expect(JS).not.toContain('function sendMessage');
-    expect(JS).not.toContain('function pollChat');
-    expect(JS).not.toContain('function pollTabs');
-    expect(JS).not.toContain('function switchChatTab');
-    expect(JS).not.toContain('function stopAgent');
-    expect(JS).not.toContain('function applyChatEnabled');
-    expect(JS).not.toContain('function showSecurityBanner');
-  });
-
-  test('Cleanup runs through the live PTY (no /sidebar-command POST)', () => {
-    // The new Cleanup handler injects the prompt straight into claude's
-    // PTY via gstackInjectToTerminal. The dead code path was a POST to
-    // /sidebar-command which kicked off a fresh claude -p subprocess.
-    const cleanup = JS.slice(JS.indexOf('async function runCleanup'));
-    expect(cleanup).toContain('window.gstackInjectToTerminal');
-    expect(cleanup).not.toContain('/sidebar-command');
-    expect(cleanup).not.toContain('addChatEntry');
-  });
-
-  test('Inspector "Send to Code" routes through the live PTY', () => {
-    const sendBtn = JS.slice(JS.indexOf('inspectorSendBtn.addEventListener'));
-    expect(sendBtn).toContain('window.gstackInjectToTerminal');
-    expect(sendBtn).not.toContain("type: 'sidebar-command'");
-  });
-
-  test('updateConnection no longer kicks off chat / tab polling', () => {
-    const update = JS.slice(JS.indexOf('function updateConnection'), JS.indexOf('function updateConnection') + 1500);
-    expect(update).not.toContain('chatPollInterval');
-    expect(update).not.toContain('tabPollInterval');
-    expect(update).not.toContain('pollChat');
-    expect(update).not.toContain('pollTabs');
-    // BUT must still expose the bootstrap globals for sidepanel-terminal.js.
-    expect(update).toContain('window.gstackServerPort');
-    expect(update).toContain('window.gstackAuthToken');
-  });
-});
-
-describe('sidepanel-terminal.js: eager auto-connect + injection API', () => {
-  test('Exposes window.gstackInjectToTerminal for cross-pane use', () => {
-    expect(TERM_JS).toContain('window.gstackInjectToTerminal');
-    // Returns false when no live session, true when bytes go out.
-    const inject = TERM_JS.slice(TERM_JS.indexOf('window.gstackInjectToTerminal'));
-    expect(inject).toContain('return false');
-    expect(inject).toContain('return true');
-    expect(inject).toContain('ws.readyState !== WebSocket.OPEN');
-  });
-
-  test('Auto-connects on init (no keypress required)', () => {
-    expect(TERM_JS).not.toContain('function onAnyKey');
-    expect(TERM_JS).not.toContain("addEventListener('keydown'");
-    expect(TERM_JS).toContain('function tryAutoConnect');
-  });
-
-  test('Repaint hook fires when Terminal pane becomes visible', () => {
-    // The chat-tab rip removed gstack:primary-tab-changed; we use a
-    // MutationObserver on #tab-terminal's class attr instead. The
-    // observer must call repaintIfLive when the .active class returns.
-    expect(TERM_JS).toContain('MutationObserver');
-    expect(TERM_JS).toContain("attributeFilter: ['class']");
-    expect(TERM_JS).toContain('repaintIfLive');
-    const repaint = TERM_JS.slice(TERM_JS.indexOf('function repaintIfLive'));
-    expect(repaint).toContain('fitAddon && fitAddon.fit()');
-    expect(repaint).toContain('term.refresh');
-    expect(repaint).toContain("type: 'resize'");
-  });
-
-  test('No auto-reconnect on close (Restart is user-initiated)', () => {
-    const closeOnly = TERM_JS.slice(
-      TERM_JS.indexOf("ws.addEventListener('close'"),
-      TERM_JS.indexOf("ws.addEventListener('error'"),
-    );
-    expect(closeOnly).not.toContain('setTimeout');
-    expect(closeOnly).not.toContain('tryAutoConnect');
-    expect(closeOnly).not.toContain('connect()');
-  });
-
-  test('forceRestart helper closes ws, disposes xterm, returns to IDLE', () => {
-    expect(TERM_JS).toContain('function forceRestart');
-    const fn = TERM_JS.slice(TERM_JS.indexOf('function forceRestart'));
-    // close() carries an intentional-restart close code so the agent's
-    // close handler can distinguish user restarts from network drops.
-    expect(fn).toContain("ws && ws.close(4001, 'intentional-restart')");
-    expect(fn).toContain('term.dispose()');
-    expect(fn).toContain('STATE.IDLE');
-    expect(fn).toContain('tryAutoConnect()');
-  });
-
-  test('Both restart buttons (mid-session and ENDED) call forceRestart', () => {
-    expect(TERM_JS).toContain("els.restart?.addEventListener('click', forceRestart)");
-    expect(TERM_JS).toContain("els.restartNow?.addEventListener('click', forceRestart)");
-  });
-});
-
-describe('server.ts: chat / sidebar-agent endpoints are gone', () => {
-  const SERVER_SRC = fs.readFileSync(path.join(import.meta.dir, '../src/server.ts'), 'utf-8');
-
-  test('No /sidebar-command, /sidebar-chat, /sidebar-agent/* routes', async () => {
-    // Routes are dispatched only through the route table, so absence from
-    // the table plus the unmatched 404 with the root token is the contract.
-    const gone = ['/sidebar-command', '/sidebar-chat', '/sidebar-agent/event', '/sidebar-agent/x', '/sidebar-tabs', '/sidebar-session'];
-    for (const p of gone) {
-      expect(ROUTES.some(r => r.prefix ? p.startsWith(r.path) : r.path === p), p).toBe(false);
-    }
-    const server = makeServer();
-    try {
-      for (const p of gone) {
-        for (const method of ['GET', 'POST']) {
-          const resp = await server.local(p, { method, headers: { Authorization: `Bearer ${server.rootToken}` } });
-          expect([p, method, resp.status, await resp.text()]).toEqual([p, method, 404, 'Not found']);
-        }
-      }
-    } finally { server.cleanup(); }
-  });
-
-  test('No chat-related state declarations or helpers', () => {
-    // Allow the symbol names inside the rip-marker comments — but no
-    // `let`, `const`, `function`, or `interface` declarations of them.
-    expect(SERVER_SRC).not.toMatch(/^let agentProcess/m);
-    expect(SERVER_SRC).not.toMatch(/^let agentStatus/m);
-    expect(SERVER_SRC).not.toMatch(/^let messageQueue/m);
-    expect(SERVER_SRC).not.toMatch(/^let sidebarSession/m);
-    expect(SERVER_SRC).not.toMatch(/^const tabAgents/m);
-    expect(SERVER_SRC).not.toMatch(/^function pickSidebarModel/m);
-    expect(SERVER_SRC).not.toMatch(/^function processAgentEvent/m);
-    expect(SERVER_SRC).not.toMatch(/^function killAgent/m);
-    expect(SERVER_SRC).not.toMatch(/^function addChatEntry/m);
-    expect(SERVER_SRC).not.toMatch(/^interface ChatEntry/m);
-    expect(SERVER_SRC).not.toMatch(/^interface SidebarSession/m);
-  });
-});
-
-describe('cli.ts: sidebar-agent is no longer spawned', () => {
-  const CLI_SRC = fs.readFileSync(path.join(import.meta.dir, '../src/cli.ts'), 'utf-8');
-
-  test('No Bun.spawn of sidebar-agent.ts', () => {
-    expect(CLI_SRC).not.toMatch(/Bun\.spawn\(\s*\['bun',\s*'run',\s*\w*[Aa]gent[Ss]cript\][\s\S]{0,300}sidebar-agent/);
-    // The variable name `agentScript` was for sidebar-agent. After the
-    // rip there's only termAgentScript. Allow comments to mention the
-    // history but not active spawn calls.
-    expect(CLI_SRC).not.toMatch(/^\s*let agentScript = path\.resolve/m);
-  });
-
-  test('Terminal-agent spawn survives', () => {
-    // v1.44 moved the raw Bun.spawn into the shared spawnTerminalAgent
-    // helper (terminal-agent-control.ts) so cli.ts, the supervisor respawn
-    // loop, and the watchdog all share identity-based process control.
-    // cli.ts must still route through that helper.
-    expect(CLI_SRC).toContain('spawnTerminalAgent');
-    const CONTROL_SRC = fs.readFileSync(
-      path.join(import.meta.dir, '../src/terminal-agent-control.ts'),
-      'utf-8',
-    );
-    expect(CONTROL_SRC).toContain('terminal-agent.ts');
-    expect(CONTROL_SRC).toMatch(/\.spawn\(\['bun',\s*'run',\s*\.\.\.bunChildFlags\(\),\s*script,\s*`--agent-gen=\$\{gen\}`\]/);
-    expect(CONTROL_SRC).toContain('BROWSE_OWNER_PID: String(opts.ownerPid)');
-  });
-});
-
-describe('manifest: ws permission + xterm-safe CSP', () => {
-  test('host_permissions covers ws localhost', () => {
-    expect(MANIFEST.host_permissions).toContain('ws://127.0.0.1:*/');
-  });
-
-  test('host_permissions still covers http localhost', () => {
-    expect(MANIFEST.host_permissions).toContain('http://127.0.0.1:*/');
-  });
-
-  test('manifest does NOT add unsafe-eval to extension_pages CSP', () => {
-    const csp = MANIFEST.content_security_policy;
-    if (csp && csp.extension_pages) {
-      expect(csp.extension_pages).not.toContain('unsafe-eval');
-    }
-  });
-});
-
-describe('manifest: live tab awareness needs "tabs" permission', () => {
-  // Without "tabs", chrome.tabs.query() returns tab objects with undefined
-  // url/title for any site outside host_permissions (e.g., everything except
-  // 127.0.0.1). snapshotTabs() then writes empty strings into tabs.json and
-  // active-tab.json silently skips the write — the sidebar agent loses track
-  // of what page the user is on. activeTab is too narrow (only after a user
-  // gesture on the extension action) for background polling.
-  test('permissions includes "tabs"', () => {
-    expect(MANIFEST.permissions).toContain('tabs');
-  });
-});