@amg555/frameforge-mcp 2.7.6 → 2.7.8

package/.agent/skills/gstack-browse/test/sse-session-cookie.test.ts

@@ -1,155 +0,0 @@
-/**
- * Unit tests for the view-only SSE session cookie module.
- *
- * Verifies the registry lifecycle (mint/validate/expire), cookie flag
- * invariants (HttpOnly, SameSite=Strict, no Secure), token entropy, and
- * that scope is implicit (the registry has no cross-endpoint footprint
- * that could be used to escalate the cookie to a scoped token).
- */
-
-import { describe, test, expect, beforeEach } from 'bun:test';
-import * as fs from 'fs';
-import * as path from 'path';
-import {
-  mintSseSessionToken, validateSseSessionToken, extractSseCookie,
-  buildSseSetCookie, SSE_COOKIE_NAME,
-  __resetSseSessions,
-} from '../src/sse-session-cookie';
-
-const MODULE_SRC = fs.readFileSync(
-  path.join(import.meta.dir, '../src/sse-session-cookie.ts'), 'utf-8'
-);
-
-beforeEach(() => __resetSseSessions());
-
-describe('SSE session cookie: mint + validate', () => {
-  test('mint returns a token and an expiry', () => {
-    const { token, expiresAt } = mintSseSessionToken();
-    expect(typeof token).toBe('string');
-    expect(token.length).toBeGreaterThan(20);
-    expect(expiresAt).toBeGreaterThan(Date.now());
-  });
-
-  test('mint uses 32 random bytes (256-bit entropy)', () => {
-    // base64url of 32 bytes is 43 chars (no padding)
-    const { token } = mintSseSessionToken();
-    expect(token).toMatch(/^[A-Za-z0-9_-]{43}$/);
-  });
-
-  test('two mint calls produce different tokens', () => {
-    const a = mintSseSessionToken();
-    const b = mintSseSessionToken();
-    expect(a.token).not.toBe(b.token);
-  });
-
-  test('validate returns true for a just-minted token', () => {
-    const { token } = mintSseSessionToken();
-    expect(validateSseSessionToken(token)).toBe(true);
-  });
-
-  test('validate returns false for an unknown token', () => {
-    expect(validateSseSessionToken('not-a-real-token')).toBe(false);
-  });
-
-  test('validate returns false for null/undefined/empty', () => {
-    expect(validateSseSessionToken(null)).toBe(false);
-    expect(validateSseSessionToken(undefined)).toBe(false);
-    expect(validateSseSessionToken('')).toBe(false);
-  });
-});
-
-describe('SSE session cookie: TTL enforcement', () => {
-  test('TTL is 30 minutes', () => {
-    // Assert via source — the actual constant is module-private
-    expect(MODULE_SRC).toContain('const TTL_MS = 30 * 60 * 1000');
-  });
-
-  test('a token with artificially rewound expiry is rejected', () => {
-    // Mint a token, then monkey-patch Date.now to simulate 31 minutes elapsed.
-    const { token, expiresAt } = mintSseSessionToken();
-    const originalNow = Date.now;
-    try {
-      Date.now = () => expiresAt + 1;
-      expect(validateSseSessionToken(token)).toBe(false);
-    } finally {
-      Date.now = originalNow;
-    }
-  });
-});
-
-describe('SSE session cookie: cookie flag invariants', () => {
-  test('Set-Cookie is HttpOnly', () => {
-    const { token } = mintSseSessionToken();
-    expect(buildSseSetCookie(token)).toContain('HttpOnly');
-  });
-
-  test('Set-Cookie is SameSite=Strict', () => {
-    const { token } = mintSseSessionToken();
-    expect(buildSseSetCookie(token)).toContain('SameSite=Strict');
-  });
-
-  test('Set-Cookie includes the token value', () => {
-    const { token } = mintSseSessionToken();
-    expect(buildSseSetCookie(token)).toContain(`${SSE_COOKIE_NAME}=${token}`);
-  });
-
-  test('Set-Cookie Max-Age matches TTL', () => {
-    const { token } = mintSseSessionToken();
-    // 30 minutes = 1800 seconds
-    expect(buildSseSetCookie(token)).toContain('Max-Age=1800');
-  });
-
-  test('Set-Cookie does NOT set Secure (local HTTP daemon)', () => {
-    const { token } = mintSseSessionToken();
-    // Adding Secure would block the browser from ever sending the cookie
-    // back to a 127.0.0.1 daemon over HTTP. If gstack ever moves to HTTPS,
-    // add Secure then.
-    expect(buildSseSetCookie(token)).not.toContain('Secure');
-  });
-});
-
-describe('SSE session cookie: extract from request', () => {
-  function mockReq(cookieHeader: string | null): Request {
-    const headers = new Headers();
-    if (cookieHeader !== null) headers.set('cookie', cookieHeader);
-    return new Request('http://127.0.0.1/activity/stream', { headers });
-  }
-
-  test('extracts the token when cookie is present', () => {
-    const req = mockReq(`${SSE_COOKIE_NAME}=abc123`);
-    expect(extractSseCookie(req)).toBe('abc123');
-  });
-
-  test('returns null when no cookie header', () => {
-    const req = mockReq(null);
-    expect(extractSseCookie(req)).toBeNull();
-  });
-
-  test('returns null when cookie header has no gstack_sse', () => {
-    const req = mockReq('other=x; unrelated=y');
-    expect(extractSseCookie(req)).toBeNull();
-  });
-
-  test('extracts gstack_sse from a multi-cookie header', () => {
-    const req = mockReq(`other=x; ${SSE_COOKIE_NAME}=real-token; trailing=y`);
-    expect(extractSseCookie(req)).toBe('real-token');
-  });
-
-  test('handles tokens with base64url padding-like chars', () => {
-    // real tokens contain A-Z, a-z, 0-9, _, -
-    const req = mockReq(`${SSE_COOKIE_NAME}=AbCd-_xyz`);
-    expect(extractSseCookie(req)).toBe('AbCd-_xyz');
-  });
-});
-
-describe('SSE session cookie: scope isolation (prior learning cookie-picker-auth-isolation)', () => {
-  test('the module exposes ONLY view-only functions, no scoped-token hooks', () => {
-    // This is a contract guard: if someone later makes SSE session tokens
-    // valid as scoped tokens (e.g., by exporting a helper that registers
-    // them in the main token registry), a leaked cookie could execute
-    // /command. The module must not import from token-registry.
-    expect(MODULE_SRC).not.toContain("from './token-registry'");
-    expect(MODULE_SRC).not.toContain('createToken');
-    expect(MODULE_SRC).not.toContain('initRegistry');
-  });
-});

package/.agent/skills/gstack-browse/test/state-ttl.test.ts

@@ -1,35 +0,0 @@
-/**
- * State file TTL security tests
- *
- * Verifies that state save includes savedAt timestamp and state load
- * warns on old state files.
- */
-
-import { describe, test, expect } from 'bun:test';
-import * as fs from 'fs';
-import * as path from 'path';
-
-const META_SRC = fs.readFileSync(path.join(import.meta.dir, '../src/meta-commands.ts'), 'utf-8');
-
-describe('State file TTL', () => {
-  test('state save includes savedAt timestamp in output', () => {
-    // Verify the save code writes savedAt to the state file
-    const saveBlock = META_SRC.slice(
-      META_SRC.indexOf("if (action === 'save')"),
-      META_SRC.indexOf("if (action === 'load')"),
-    );
-    expect(saveBlock).toContain('savedAt: new Date().toISOString()');
-  });
-
-  test('state load warns when savedAt is older than 7 days', () => {
-    // Verify the load code checks savedAt age and warns
-    const loadStart = META_SRC.indexOf("if (action === 'load')");
-    // Find the second occurrence of "Usage: state save|load" (appears after the load block)
-    const loadEnd = META_SRC.indexOf("Usage: state save|load", loadStart);
-    const loadBlock = META_SRC.slice(loadStart, loadEnd);
-    expect(loadBlock).toContain('data.savedAt');
-    expect(loadBlock).toContain('SEVEN_DAYS');
-    expect(loadBlock).toContain('console.warn');
-    expect(loadBlock).toContain('days old');
-  });
-});

package/.agent/skills/gstack-browse/test/stealth-extended.test.ts

@@ -1,127 +0,0 @@
-/**
- * Tests for the opt-in extended stealth mode (#1112 rebased into the
- * v1.41 wave).
- *
- * Pins:
- * 1. Default mode applies the always-on Layer C stealth script (and NOT
- *    the extended script) — the consistency-first default.
- * 2. GSTACK_STEALTH=extended adds EXTENDED_STEALTH_SCRIPT on top of Layer C.
- * 3. EXTENDED_STEALTH_SCRIPT contains the six detection-vector patches.
- * 4. Apply order: Layer C first, extended second (so the extended
- *    delete-from-prototype path layers on top of Layer C's getter without
- *    silently overriding it if delete fails).
- *
- * Live SannySoft pass-rate verification is a periodic-tier E2E test
- * (gated behind external network + Chromium); this file pins the
- * static + applyStealth semantics that run on every commit.
- */
-
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
-import {
-  EXTENDED_STEALTH_SCRIPT,
-  isExtendedStealthEnabled,
-  applyStealth,
-} from '../src/stealth';
-
-let originalEnv: string | undefined;
-
-beforeEach(() => {
-  originalEnv = process.env.GSTACK_STEALTH;
-});
-
-afterEach(() => {
-  if (originalEnv === undefined) delete process.env.GSTACK_STEALTH;
-  else process.env.GSTACK_STEALTH = originalEnv;
-});
-
-describe('extended stealth — opt-in mode flag', () => {
-  test('default mode is OFF (consistency-first contract)', () => {
-    delete process.env.GSTACK_STEALTH;
-    expect(isExtendedStealthEnabled()).toBe(false);
-  });
-
-  test('GSTACK_STEALTH=extended enables extended mode', () => {
-    process.env.GSTACK_STEALTH = 'extended';
-    expect(isExtendedStealthEnabled()).toBe(true);
-  });
-
-  test('GSTACK_STEALTH=1 also enables (env-style boolean)', () => {
-    process.env.GSTACK_STEALTH = '1';
-    expect(isExtendedStealthEnabled()).toBe(true);
-  });
-
-  test('GSTACK_STEALTH=anything-else does NOT enable', () => {
-    process.env.GSTACK_STEALTH = 'verbose';
-    expect(isExtendedStealthEnabled()).toBe(false);
-  });
-});
-
-describe('EXTENDED_STEALTH_SCRIPT — six detection-vector patches', () => {
-  test('1. deletes navigator.webdriver from prototype', () => {
-    expect(EXTENDED_STEALTH_SCRIPT).toMatch(/delete.*Object\.getPrototypeOf\(navigator\)\.webdriver/);
-  });
-
-  test('2. spoofs WebGL renderer to Apple M1 Pro', () => {
-    expect(EXTENDED_STEALTH_SCRIPT).toContain('Apple M1 Pro');
-    expect(EXTENDED_STEALTH_SCRIPT).toContain('UNMASKED_VENDOR_WEBGL');
-  });
-
-  test('3. installs PluginArray-prototype-passing navigator.plugins', () => {
-    expect(EXTENDED_STEALTH_SCRIPT).toContain('PluginArray');
-    expect(EXTENDED_STEALTH_SCRIPT).toContain('MimeType');
-  });
-
-  test('4. populates window.chrome with app, runtime, loadTimes, csi', () => {
-    expect(EXTENDED_STEALTH_SCRIPT).toContain('chrome.app');
-    expect(EXTENDED_STEALTH_SCRIPT).toContain('chrome.runtime');
-    expect(EXTENDED_STEALTH_SCRIPT).toContain('chrome.loadTimes');
-    expect(EXTENDED_STEALTH_SCRIPT).toContain('chrome.csi');
-  });
-
-  test('5. backfills navigator.mediaDevices when missing', () => {
-    expect(EXTENDED_STEALTH_SCRIPT).toContain('mediaDevices');
-    expect(EXTENDED_STEALTH_SCRIPT).toContain('enumerateDevices');
-  });
-
-  test('6. clears CDP cdc_* property names from window', () => {
-    expect(EXTENDED_STEALTH_SCRIPT).toContain("startsWith('cdc_')");
-  });
-});
-
-describe('applyStealth — script wiring', () => {
-  test('default mode applies Layer C + cleanup, not extended', async () => {
-    delete process.env.GSTACK_STEALTH;
-    const calls: string[] = [];
-    const fakeCtx = {
-      addInitScript: async (opts: { content: string }) => {
-        calls.push(opts.content);
-      },
-    } as unknown as Parameters<typeof applyStealth>[0];
-    await applyStealth(fakeCtx);
-    expect(calls).toHaveLength(2);
-    // [0] = Layer C (toString-proxy native-code lie + webdriver mask).
-    expect(calls[0]).toContain('[native code]');
-    expect(calls[0]).toContain('webdriver');
-    // [1] = automation-artifact cleanup (cdc_ scan + Permissions shim) —
-    //       now applied on EVERY launch path, not just the headed one.
-    expect(calls[1]).toContain('cdc_');
-    expect(calls[1]).toContain('setTimeout(cleanup');
-    // Extended script must NOT be applied by default.
-    expect(calls).not.toContain(EXTENDED_STEALTH_SCRIPT);
-  });
-
-  test('extended mode applies Layer C, cleanup, then extended (in order)', async () => {
-    process.env.GSTACK_STEALTH = 'extended';
-    const calls: string[] = [];
-    const fakeCtx = {
-      addInitScript: async (opts: { content: string }) => {
-        calls.push(opts.content);
-      },
-    } as unknown as Parameters<typeof applyStealth>[0];
-    await applyStealth(fakeCtx);
-    expect(calls).toHaveLength(3);
-    expect(calls[0]).toContain('[native code]');     // Layer C first
-    expect(calls[1]).toContain('cdc_');              // cleanup second
-    expect(calls[2]).toBe(EXTENDED_STEALTH_SCRIPT);  // extended last
-  });
-});

package/.agent/skills/gstack-browse/test/stealth-layer-c.test.ts

@@ -1,284 +0,0 @@
-/**
- * stealth.ts Layer C additions (T3 + D6 for GBrowser anti-detection):
- * verifies the build-time scaffolding without requiring a live browser.
- *
- * Live-browser verification of these spoofs in actual page contexts is
- * covered by the gbrowser-side `test/anti-bot.test.sh` (Phase 1 / T7)
- * which loads the probe page through the built GBrowser app post-bundle.
- * These tests only exercise the JS script builder + the static export
- * shapes — fast, hermetic, no chromium launch.
- */
-import { describe, test, expect, afterEach } from 'bun:test';
-import {
-  buildStealthScript,
-  buildGStackLaunchArgs,
-  readHostProfile,
-  AUTOMATION_ARTIFACT_CLEANUP_SCRIPT,
-  STEALTH_LAUNCH_ARGS,
-  STEALTH_IGNORE_DEFAULT_ARGS,
-} from '../src/stealth';
-
-describe('STEALTH_IGNORE_DEFAULT_ARGS — T1', () => {
-  test('includes --enable-automation (kills infobar)', () => {
-    expect(STEALTH_IGNORE_DEFAULT_ARGS).toContain('--enable-automation');
-  });
-  test('includes the 4 Patchright-recommended adds', () => {
-    expect(STEALTH_IGNORE_DEFAULT_ARGS).toContain('--disable-popup-blocking');
-    expect(STEALTH_IGNORE_DEFAULT_ARGS).toContain('--disable-component-update');
-    expect(STEALTH_IGNORE_DEFAULT_ARGS).toContain('--disable-default-apps');
-  });
-  test('preserves the original extension-loading blockers', () => {
-    expect(STEALTH_IGNORE_DEFAULT_ARGS).toContain('--disable-extensions');
-    expect(STEALTH_IGNORE_DEFAULT_ARGS).toContain('--disable-component-extensions-with-background-pages');
-  });
-});
-
-describe('buildStealthScript — T3 Layer C', () => {
-  const hw = { platform: 'MacARM', hwConcurrency: 16, deviceMemory: 8 };
-
-  test('builds a self-invoking function (atomic injection)', () => {
-    const s = buildStealthScript(hw);
-    expect(s.trim().startsWith('(() => {')).toBe(true);
-    expect(s.trim().endsWith('})();')).toBe(true);
-  });
-
-  test('installs the Function.prototype.toString Proxy FIRST', () => {
-    const s = buildStealthScript(hw);
-    const proxyIdx = s.indexOf('new Proxy(nativeToString');
-    const webdriverIdx = s.indexOf("'webdriver'");
-    expect(proxyIdx).toBeGreaterThan(0);
-    expect(webdriverIdx).toBeGreaterThan(proxyIdx);
-  });
-
-  test('navigator.webdriver getter returns false', () => {
-    const s = buildStealthScript(hw);
-    expect(s).toMatch(/Object\.defineProperty\(navigator, 'webdriver'/);
-    expect(s).toMatch(/return false/);
-  });
-
-  test('window.chrome.runtime ships full enum shape', () => {
-    const s = buildStealthScript(hw);
-    expect(s).toContain('OnInstalledReason');
-    expect(s).toContain('PlatformArch');
-    expect(s).toContain('PlatformOs');
-    expect(s).toContain('RequestUpdateCheckStatus');
-    expect(s).not.toContain('function connect()');
-    expect(s).not.toContain('function sendMessage()');
-  });
-
-  test('chrome.csi and chrome.loadTimes provide method bodies', () => {
-    const s = buildStealthScript(hw);
-    expect(s).toContain('chrome.csi = markNative(function csi()');
-    expect(s).toContain('chrome.loadTimes = markNative(function loadTimes()');
-    // loadTimes shape must include wasFetchedViaSpdy/connectionInfo —
-    // those are what real Chrome's loadTimes() returns on HTTP/2 sites.
-    expect(s).toContain('wasFetchedViaSpdy');
-    expect(s).toContain('connectionInfo');
-  });
-
-  test('Notification.permission aligned to default', () => {
-    const s = buildStealthScript(hw);
-    expect(s).toMatch(/Notification, 'permission'/);
-    expect(s).toMatch(/return 'default'/);
-  });
-
-  test('hardware values interpolated from host profile (NOT hardcoded)', () => {
-    const s = buildStealthScript({ platform: 'MacARM', hwConcurrency: 12, deviceMemory: 4 });
-    expect(s).toContain('return 12');
-    expect(s).toContain('return 4');
-    expect(s).not.toMatch(/return 8;.*hardwareConcurrency/);
-  });
-
-  test('cleans up Selenium + Playwright + Phantom + Nightmare globals', () => {
-    const s = buildStealthScript(hw);
-    // Spot-check a few from each category
-    expect(s).toContain('__webdriver_evaluate');     // Selenium
-    expect(s).toContain('domAutomationController');  // Chrome Driver classic
-    expect(s).toContain('__pwInitScripts');          // Playwright
-    expect(s).toContain('callPhantom');              // PhantomJS
-    expect(s).toContain('__nightmare');              // NightmareJS
-    expect(s).toContain('_Selenium_IDE_Recorder');   // Selenium IDE
-  });
-
-  test('uses markNative wrapper for every patched function', () => {
-    const s = buildStealthScript(hw);
-    // Every getter (hardwareConcurrency, deviceMemory, webdriver, Notification.permission)
-    // should be wrapped through markNative so the toString Proxy covers it.
-    for (const declaration of [
-      'const webdriverGetter', 'chrome.csi', 'chrome.loadTimes',
-      'const notificationPermissionGetter', 'const hwConcurrencyGetter', 'const deviceMemoryGetter',
-    ]) {
-      expect(s).toContain(`${declaration} = markNative(`);
-    }
-  });
-
-  test('script does not include "GStackBrowser" branding string', () => {
-    const s = buildStealthScript(hw);
-    // D6: dropped from UA, must not leak in via stealth payload either.
-    expect(s).not.toContain('GStackBrowser');
-  });
-});
-
-describe('buildGStackLaunchArgs — Pack 1 cmdline-switch construction', () => {
-  // Helper: clear all GSTACK_* env, run test body, restore env.
-  function withEnv(env: Record<string, string | undefined>, body: () => void) {
-    const saved: Record<string, string | undefined> = {};
-    for (const k of Object.keys(process.env)) {
-      if (k.startsWith('GSTACK_')) {
-        saved[k] = process.env[k];
-        delete process.env[k];
-      }
-    }
-    for (const [k, v] of Object.entries(env)) {
-      if (v !== undefined) process.env[k] = v;
-    }
-    try {
-      body();
-    } finally {
-      for (const k of Object.keys(process.env)) {
-        if (k.startsWith('GSTACK_')) delete process.env[k];
-      }
-      for (const [k, v] of Object.entries(saved)) {
-        if (v !== undefined) process.env[k] = v;
-      }
-    }
-  }
-
-  test('empty env produces no switches (suppress-stack is opt-in)', () => {
-    withEnv({}, () => {
-      // All switches are opt-in: the six per-install flags fall through
-      // (nothing in env), and the Pack 2 / B11 suppression flag is only
-      // emitted when GSTACK_CDP_STEALTH is on/1/true. Empty env → [].
-      expect(buildGStackLaunchArgs()).toEqual([]);
-    });
-  });
-
-  test('all env values populated (incl. CDP stealth opt-in) → all 7 switches emitted', () => {
-    withEnv({
-      GSTACK_GPU_VENDOR: 'Apple Inc.',
-      GSTACK_GPU_RENDERER: 'ANGLE (Apple, ANGLE Metal Renderer: Apple M4 Max, Unspecified Version)',
-      GSTACK_PLATFORM: 'MacARM',
-      GSTACK_GPU_CHIPSET: 'Apple M4 Max',
-      GSTACK_HW_CONCURRENCY: '16',
-      GSTACK_DEVICE_MEMORY: '8',
-      GSTACK_CDP_STEALTH: 'on',
-    }, () => {
-      const args = buildGStackLaunchArgs();
-      expect(args).toContain('--gstack-gpu-vendor=Apple Inc.');
-      expect(args).toContain('--gstack-gpu-renderer=ANGLE (Apple, ANGLE Metal Renderer: Apple M4 Max, Unspecified Version)');
-      expect(args).toContain('--gstack-ua-platform=macOS');
-      expect(args).toContain('--gstack-ua-model=Apple M4 Max');
-      expect(args).toContain('--gstack-hw-concurrency=16');
-      expect(args).toContain('--gstack-device-memory=8');
-      expect(args).toContain('--gstack-suppress-prepare-stack-trace');
-      expect(args.length).toBe(7);
-    });
-  });
-
-  test('platform mapping: MacARM and MacIntel both → macOS', () => {
-    withEnv({ GSTACK_PLATFORM: 'MacARM' }, () => {
-      expect(buildGStackLaunchArgs()).toContain('--gstack-ua-platform=macOS');
-    });
-    withEnv({ GSTACK_PLATFORM: 'MacIntel' }, () => {
-      expect(buildGStackLaunchArgs()).toContain('--gstack-ua-platform=macOS');
-    });
-  });
-
-  test('platform mapping: Win32 → Windows, Linux x86_64 → Linux', () => {
-    withEnv({ GSTACK_PLATFORM: 'Win32' }, () => {
-      expect(buildGStackLaunchArgs()).toContain('--gstack-ua-platform=Windows');
-    });
-    withEnv({ GSTACK_PLATFORM: 'Linux x86_64' }, () => {
-      expect(buildGStackLaunchArgs()).toContain('--gstack-ua-platform=Linux');
-    });
-  });
-
-  test('partial env: only set switches that have values', () => {
-    withEnv({ GSTACK_HW_CONCURRENCY: '12' }, () => {
-      const args = buildGStackLaunchArgs();
-      // hw only — suppress-stack is opt-in and GSTACK_CDP_STEALTH is unset.
-      expect(args).toContain('--gstack-hw-concurrency=12');
-      expect(args).not.toContain('--gstack-suppress-prepare-stack-trace');
-      expect(args.length).toBe(1);
-    });
-  });
-
-  test('prepare-stack-trace suppression is opt-in via GSTACK_CDP_STEALTH', () => {
-    // on/1/true enable it; off and unset omit it, so stock Playwright
-    // Chromium (no GSTACK_CDP_STEALTH) never receives the unknown switch.
-    for (const v of ['on', '1', 'true']) {
-      withEnv({ GSTACK_CDP_STEALTH: v }, () => {
-        expect(buildGStackLaunchArgs()).toContain('--gstack-suppress-prepare-stack-trace');
-      });
-    }
-    withEnv({ GSTACK_CDP_STEALTH: 'off' }, () => {
-      expect(buildGStackLaunchArgs()).not.toContain('--gstack-suppress-prepare-stack-trace');
-    });
-    withEnv({}, () => {
-      expect(buildGStackLaunchArgs()).not.toContain('--gstack-suppress-prepare-stack-trace');
-    });
-  });
-
-  test('unrecognized platform falls through without --gstack-ua-platform', () => {
-    withEnv({ GSTACK_PLATFORM: 'OS/2' }, () => {
-      const args = buildGStackLaunchArgs();
-      expect(args.some(a => a.startsWith('--gstack-ua-platform='))).toBe(false);
-    });
-  });
-
-  test('GPU vendor with spaces survives intact (no quote/escape regression)', () => {
-    withEnv({ GSTACK_GPU_VENDOR: 'NVIDIA Corporation' }, () => {
-      const args = buildGStackLaunchArgs();
-      expect(args).toContain('--gstack-gpu-vendor=NVIDIA Corporation');
-    });
-  });
-});
-
-describe('backwards-compat exports', () => {
-  test('STEALTH_LAUNCH_ARGS still includes blink-features=AutomationControlled', () => {
-    expect(STEALTH_LAUNCH_ARGS).toContain('--disable-blink-features=AutomationControlled');
-  });
-});
-
-describe('readHostProfile — clamp/fallback', () => {
-  let savedHw: string | undefined;
-  let savedMem: string | undefined;
-  afterEach(() => {
-    if (savedHw === undefined) delete process.env.GSTACK_HW_CONCURRENCY;
-    else process.env.GSTACK_HW_CONCURRENCY = savedHw;
-    if (savedMem === undefined) delete process.env.GSTACK_DEVICE_MEMORY;
-    else process.env.GSTACK_DEVICE_MEMORY = savedMem;
-  });
-  function withHw(hw: string | undefined, mem: string | undefined): ReturnType<typeof readHostProfile> {
-    savedHw = process.env.GSTACK_HW_CONCURRENCY;
-    savedMem = process.env.GSTACK_DEVICE_MEMORY;
-    if (hw === undefined) delete process.env.GSTACK_HW_CONCURRENCY; else process.env.GSTACK_HW_CONCURRENCY = hw;
-    if (mem === undefined) delete process.env.GSTACK_DEVICE_MEMORY; else process.env.GSTACK_DEVICE_MEMORY = mem;
-    return readHostProfile();
-  }
-
-  test('valid env values pass through', () => {
-    expect(withHw('16', '8')).toEqual({ hwConcurrency: 16, deviceMemory: 8 });
-  });
-
-  test('missing env → default 8/8', () => {
-    expect(withHw(undefined, undefined)).toEqual({ hwConcurrency: 8, deviceMemory: 8 });
-  });
-
-  test('zero / negative / NaN / empty all clamp to 8 (never a 0 or NaN bot tell)', () => {
-    for (const bad of ['0', '-4', 'abc', '']) {
-      const p = withHw(bad, bad);
-      expect(p.hwConcurrency).toBe(8);
-      expect(p.deviceMemory).toBe(8);
-    }
-  });
-});
-
-describe('AUTOMATION_ARTIFACT_CLEANUP_SCRIPT — static shape', () => {
-  test('strips cdc_/__webdriver and maps notifications query to prompt', () => {
-    expect(AUTOMATION_ARTIFACT_CLEANUP_SCRIPT).toContain("startsWith('cdc_')");
-    expect(AUTOMATION_ARTIFACT_CLEANUP_SCRIPT).toContain("startsWith('__webdriver')");
-    expect(AUTOMATION_ARTIFACT_CLEANUP_SCRIPT).toContain("name === 'notifications'");
-    expect(AUTOMATION_ARTIFACT_CLEANUP_SCRIPT).toContain("state: 'prompt'");
-  });
-});