@extenshi/cli 0.24.0 → 0.25.0

package/dist/smoke.d.ts

@@ -1,9 +1,10 @@
 /**
- * `extenshi test smoke <zip> --browser chromium|edge|firefox` — install the
- * EXACT packaged zip in a real browser and check that it actually works:
- * it loads, its service worker / background starts, the browser reports no
- * manifest errors, and its popup / options / side-panel pages open without
- * console errors.
+ * `extenshi test smoke <zip|dir> --browser chromium|edge|firefox` — install the
+ * EXACT packaged zip (or an unpacked build folder) in a real browser and check
+ * that it actually works: it loads, its service worker / background starts,
+ * the browser reports no manifest errors, and its popup / options / side-panel
+ * pages open without console errors. With `--site <url>` it then opens each
+ * site and checks that the `content_scripts` entries matching it were injected.
  *
  * Engines (all optional, resolved lazily — the CLI install stays small):
  *   chromium  Playwright's bundled Chromium (`npx playwright install chromium`).
@@ -15,7 +16,15 @@
  *
  * Chromium engines get the zip extracted to a temp directory (they load
  * unpacked extensions only); Firefox installs the zip file itself. Either way
- * the bytes are the package's, and the result carries its sha256.
+ * the bytes are the package's, and the result carries its sha256. A folder is
+ * read the way `extenshi package` reads one (dot-entries and node_modules left
+ * out) into a reproducible zip, which then takes the same path.
+ *
+ * Content scripts (Chromium/Edge only for now) are observed over the DevTools
+ * protocol, without the extension's cooperation: the browser reports each
+ * extension file it compiles into the page (Debugger.scriptParsed) and each
+ * stylesheet it injects (CSS origin "injected"). That proves injection, not
+ * that the script then did its job.
  *
  * Limits, stated in every result: the popup is opened as a tab, not from the
  * toolbar, and no page is interacted with — this proves the package boots
@@ -34,6 +43,8 @@ export interface SmokeCheck {
 }
 export interface SmokeResult {
     artifact: string;
+    /** `directory`: an unpacked folder; `sha256` is then that of the zip built from it. */
+    source: 'zip' | 'directory';
     sha256: string;
     browser: SmokeEngine;
     engine: {
@@ -55,6 +66,41 @@ export interface ExtensionPage {
 }
 /** The extension's own pages a user can open, as the manifest declares them. */
 export declare function extensionPages(manifest: Json): ExtensionPage[];
+/**
+ * A manifest match pattern as the browser applies it to a page: `<all_urls>`;
+ * scheme `*` = http or https; host `*.example.com` = the host and its
+ * subdomains; no port = any port; the path glob covers path + query. A pattern
+ * the browser would reject matches nothing.
+ */
+export declare function matchesPattern(pattern: string, url: URL): boolean;
+export interface MatchingContentScript {
+    /** Position in manifest.content_scripts. */
+    index: number;
+    js: string[];
+    css: string[];
+}
+/** The `content_scripts` entries the browser injects into a top-level page at `url`. */
+export declare function contentScriptsFor(manifest: Json, url: string): MatchingContentScript[];
+/** What the browser reported while one site was open (top frame only). */
+export interface SiteObservation {
+    /** The URL as given. */
+    site: string;
+    /** Where the tab ended up (redirects); absent when it did not open. */
+    finalUrl?: string;
+    openError?: string;
+    /** Extension files compiled into the page, relative to the extension root. */
+    scripts: string[];
+    /** Stylesheets the browser injected for the extension. */
+    injectedSheets: number;
+    /** Errors attributed to the extension (its isolated world, its files, its URLs). */
+    errors: string[];
+}
+/** The checks one visited site yields: injection of every matching entry, then extension errors. */
+export declare function siteChecks(manifest: Json, observation: SiteObservation): SmokeCheck[];
+/** A `--site` value: an absolute http(s) URL. */
+export declare function parseSiteUrl(value: string): string;
+/** A directory (an unpacked build) rather than a package file. */
+export declare function isExtensionDirectory(file: string): boolean;
 /** Checks that need no browser: the files the manifest names exist, and Firefox has a real add-on ID. */
 export declare function staticChecks(manifest: Json, paths: Set<string>, engine: SmokeEngine): SmokeCheck[];
 export interface SmokeOptions {
@@ -69,6 +115,8 @@ export interface SmokeOptions {
     browserPath?: string;
     /** Where to resolve Playwright from first (default: cwd). */
     cwd?: string;
+    /** http(s) pages to open after install, checking the content scripts that match each (Chromium/Edge). */
+    sites?: string[];
 }
 export declare function runSmoke(options: SmokeOptions): Promise<SmokeResult>;
 /** Resolve Playwright from the project first, then next to the CLI (global installs, CI tool prefixes). */

package/dist/smoke.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"smoke.d.ts","sourceRoot":"","sources":["../src/smoke.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAcH,eAAO,MAAM,aAAa,0CAA2C,CAAA;AACrE,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAA;AACxD,sDAAsD;AACtD,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,CAI7E,CAAA;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAMvE;AAED,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAA;AACzD,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,WAAW,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,WAAW;IAC3B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,WAAW,CAAA;IACpB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACtG,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAA;IAC3B,MAAM,EAAE,UAAU,EAAE,CAAA;IACpB,MAAM,EAAE,MAAM,EAAE,CAAA;CAChB;AAED,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;AAQ/B,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,OAAO,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAAA;IACpD,IAAI,EAAE,MAAM,CAAA;CACZ;AAED,gFAAgF;AAChF,wBAAgB,cAAc,CAAC,QAAQ,EAAE,IAAI,GAAG,aAAa,EAAE,CAgB9D;AA+BD,yGAAyG;AACzG,wBAAgB,YAAY,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,GAAG,UAAU,EAAE,CAsBlG;AAED,MAAM,WAAW,YAAY;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,WAAW,CAAA;IACnB,qFAAqF;IACrF,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,6DAA6D;IAC7D,GAAG,CAAC,EAAE,MAAM,CAAA;CACZ;AAED,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA2B1E;AASD,2GAA2G;AAC3G,wBAAsB,cAAc,CAAC,GAAG,SAAgB,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,GAAG,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAwBtG;AA6VD,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAOvD"}
+{"version":3,"file":"smoke.d.ts","sourceRoot":"","sources":["../src/smoke.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAeH,eAAO,MAAM,aAAa,0CAA2C,CAAA;AACrE,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAA;AACxD,sDAAsD;AACtD,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,CAI7E,CAAA;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAMvE;AAED,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAA;AACzD,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,WAAW,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,WAAW;IAC3B,QAAQ,EAAE,MAAM,CAAA;IAChB,uFAAuF;IACvF,MAAM,EAAE,KAAK,GAAG,WAAW,CAAA;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,WAAW,CAAA;IACpB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACtG,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAA;IAC3B,MAAM,EAAE,UAAU,EAAE,CAAA;IACpB,MAAM,EAAE,MAAM,EAAE,CAAA;CAChB;AAED,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;AAgB/B,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,OAAO,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAAA;IACpD,IAAI,EAAE,MAAM,CAAA;CACZ;AAED,gFAAgF;AAChF,wBAAgB,cAAc,CAAC,QAAQ,EAAE,IAAI,GAAG,aAAa,EAAE,CAgB9D;AAYD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAqBjE;AAED,MAAM,WAAW,qBAAqB;IACrC,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAA;IACb,EAAE,EAAE,MAAM,EAAE,CAAA;IACZ,GAAG,EAAE,MAAM,EAAE,CAAA;CACb;AAMD,wFAAwF;AACxF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG,qBAAqB,EAAE,CAuBtF;AAED,0EAA0E;AAC1E,MAAM,WAAW,eAAe;IAC/B,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAA;IACZ,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,8EAA8E;IAC9E,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,0DAA0D;IAC1D,cAAc,EAAE,MAAM,CAAA;IACtB,oFAAoF;IACpF,MAAM,EAAE,MAAM,EAAE,CAAA;CAChB;AAED,oGAAoG;AACpG,wBAAgB,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,GAAG,UAAU,EAAE,CAkCrF;AAED,iDAAiD;AACjD,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAYlD;AA+BD,kEAAkE;AAClE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D;AAeD,yGAAyG;AACzG,wBAAgB,YAAY,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,GAAG,UAAU,EAAE,CAsBlG;AAED,MAAM,WAAW,YAAY;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,WAAW,CAAA;IACnB,qFAAqF;IACrF,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,6DAA6D;IAC7D,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,yGAAyG;IACzG,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAChB;AAED,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAqC1E;AASD,2GAA2G;AAC3G,wBAAsB,cAAc,CAAC,GAAG,SAAgB,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,GAAG,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAwBtG;AAkdD,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAQvD"}

package/dist/smoke.js

@@ -1,9 +1,10 @@
 /**
- * `extenshi test smoke <zip> --browser chromium|edge|firefox` — install the
- * EXACT packaged zip in a real browser and check that it actually works:
- * it loads, its service worker / background starts, the browser reports no
- * manifest errors, and its popup / options / side-panel pages open without
- * console errors.
+ * `extenshi test smoke <zip|dir> --browser chromium|edge|firefox` — install the
+ * EXACT packaged zip (or an unpacked build folder) in a real browser and check
+ * that it actually works: it loads, its service worker / background starts,
+ * the browser reports no manifest errors, and its popup / options / side-panel
+ * pages open without console errors. With `--site <url>` it then opens each
+ * site and checks that the `content_scripts` entries matching it were injected.
  *
  * Engines (all optional, resolved lazily — the CLI install stays small):
  *   chromium  Playwright's bundled Chromium (`npx playwright install chromium`).
@@ -15,7 +16,15 @@
  *
  * Chromium engines get the zip extracted to a temp directory (they load
  * unpacked extensions only); Firefox installs the zip file itself. Either way
- * the bytes are the package's, and the result carries its sha256.
+ * the bytes are the package's, and the result carries its sha256. A folder is
+ * read the way `extenshi package` reads one (dot-entries and node_modules left
+ * out) into a reproducible zip, which then takes the same path.
+ *
+ * Content scripts (Chromium/Edge only for now) are observed over the DevTools
+ * protocol, without the extension's cooperation: the browser reports each
+ * extension file it compiles into the page (Debugger.scriptParsed) and each
+ * stylesheet it injects (CSS origin "injected"). That proves injection, not
+ * that the script then did its job.
  *
  * Limits, stated in every result: the popup is opened as a tab, not from the
  * toolbar, and no page is interacted with — this proves the package boots
@@ -31,7 +40,8 @@ import JSZip from 'jszip';
 import { InvalidInputError } from './expected-error.js';
 import { findFirefox, launchFirefox } from './firefox-rdp.js';
 import { isPlaceholderGeckoId, isValidGeckoId } from './gecko-id.js';
-import { manifestGeckoId, manifestReferences } from './package.js';
+import { collectFiles, manifestGeckoId, manifestReferences, reproducibleMtime } from './package.js';
+import { ZipBuilder } from './zip.js';
 export const SMOKE_ENGINES = ['chromium', 'edge', 'firefox'];
 /** The store browser the evidence is recorded for. */
 export const ENGINE_BROWSER = {
@@ -46,11 +56,19 @@ export function parseSmokeEngine(value) {
         throw new InvalidInputError('--browser must be one of: chromium (alias chrome), edge, firefox');
     return engine;
 }
-const LIMITS = [
-    'The popup is opened as a regular tab, not from the toolbar button.',
-    'Pages are opened, not interacted with: this proves the package boots without errors, not that its features work.',
-    'Content scripts are not exercised (no target site is visited).',
-];
+function limitsFor(engine, sites) {
+    return [
+        'The popup is opened as a regular tab, not from the toolbar button.',
+        'Pages are opened, not interacted with: this proves the package boots without errors, not that its features work.',
+        !sites.length
+            ? 'Content scripts are not exercised (no --site given).'
+            : engine === 'firefox'
+                ? 'Content scripts are not exercised: --site is not supported on Firefox yet (use chromium or edge).'
+                : 'Content scripts are checked in the top frame only: each declared js file was compiled into the page and ' +
+                    'the declared CSS was injected (counted — the browser does not say which file a sheet came from). ' +
+                    'Whether the script then did its job is not checked.',
+    ];
+}
 /** The extension's own pages a user can open, as the manifest declares them. */
 export function extensionPages(manifest) {
     const pages = [];
@@ -68,6 +86,125 @@ export function extensionPages(manifest) {
     add('sidebar', manifest.sidebar_action?.default_panel);
     return pages;
 }
+// ── Content scripts ─────────────────────────────────────────────────────────
+const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+/** `*` = any run of characters (including `/`); `?` = one character where `question` is set (globs). */
+const wildcard = (pattern, question) => new RegExp(`^${[...pattern].map((ch) => (ch === '*' ? '.*' : question && ch === '?' ? '.' : escapeRe(ch))).join('')}$`);
+const DEFAULT_PORTS = { http: '80', https: '443', ws: '80', wss: '443' };
+/**
+ * A manifest match pattern as the browser applies it to a page: `<all_urls>`;
+ * scheme `*` = http or https; host `*.example.com` = the host and its
+ * subdomains; no port = any port; the path glob covers path + query. A pattern
+ * the browser would reject matches nothing.
+ */
+export function matchesPattern(pattern, url) {
+    const scheme = url.protocol.replace(/:$/, '');
+    if (pattern === '<all_urls>')
+        return ['http', 'https', 'ws', 'wss', 'ftp', 'file'].includes(scheme);
+    const parts = /^(\*|[a-z][a-z0-9+.-]*):\/\/([^/]*)(\/.*)$/i.exec(pattern);
+    if (!parts)
+        return false;
+    const [, wantScheme, hostPort, pathGlob] = parts;
+    if (wantScheme === '*' ? scheme !== 'http' && scheme !== 'https' : wantScheme.toLowerCase() !== scheme)
+        return false;
+    if (scheme !== 'file') {
+        const hp = /^(\*|\*\.[^:*/]+|\[[^\]]+\]|[^:*/]+)(?::(\*|\d+))?$/.exec(hostPort);
+        if (!hp)
+            return false;
+        const host = hp[1].toLowerCase();
+        const hostname = url.hostname.toLowerCase();
+        const hostOk = host === '*' ||
+            hostname === host ||
+            (host.startsWith('*.') && (hostname === host.slice(2) || hostname.endsWith(host.slice(1))));
+        if (!hostOk)
+            return false;
+        if (hp[2] && hp[2] !== '*' && hp[2] !== (url.port || DEFAULT_PORTS[scheme]))
+            return false;
+    }
+    return wildcard(pathGlob, false).test(url.pathname + url.search);
+}
+const asList = (value) => Array.isArray(value) ? value.filter((v) => typeof v === 'string' && !!v.trim()) : [];
+const normalizePath = (p) => p.trim().replace(/^\.?\/+/, '');
+/** The `content_scripts` entries the browser injects into a top-level page at `url`. */
+export function contentScriptsFor(manifest, url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return [];
+    }
+    const entries = Array.isArray(manifest.content_scripts) ? manifest.content_scripts : [];
+    const result = [];
+    entries.forEach((entry, index) => {
+        const js = asList(entry?.js).map(normalizePath);
+        const css = asList(entry?.css).map(normalizePath);
+        if (!js.length && !css.length)
+            return;
+        if (!asList(entry.matches).some((p) => matchesPattern(p, parsed)))
+            return;
+        if (asList(entry.exclude_matches).some((p) => matchesPattern(p, parsed)))
+            return;
+        // Globs see the whole URL, #fragment included (checked in Chromium) — unlike the
+        // match pattern's path, which stops at the query.
+        const include = asList(entry.include_globs);
+        if (include.length && !include.some((g) => wildcard(g, true).test(parsed.href)))
+            return;
+        if (asList(entry.exclude_globs).some((g) => wildcard(g, true).test(parsed.href)))
+            return;
+        result.push({ index, js, css });
+    });
+    return result;
+}
+/** The checks one visited site yields: injection of every matching entry, then extension errors. */
+export function siteChecks(manifest, observation) {
+    const { site } = observation;
+    const name = `content scripts inject on ${site}`;
+    if (observation.openError || !observation.finalUrl)
+        return [{ name, status: 'failed', detail: `did not open: ${observation.openError ?? 'unknown error'}` }];
+    const landed = observation.finalUrl !== site ? ` (landed on ${observation.finalUrl})` : '';
+    const entries = contentScriptsFor(manifest, observation.finalUrl);
+    if (!entries.length)
+        return [{ name, status: 'skipped', detail: `no content_scripts entry matches this URL${landed}` }];
+    const loaded = new Set(observation.scripts);
+    const cssDeclared = new Set(entries.flatMap((e) => e.css)).size;
+    let ok = true;
+    const parts = entries.map((entry) => {
+        const js = entry.js.map((file) => {
+            if (!loaded.has(file))
+                ok = false;
+            return `${file} ${loaded.has(file) ? 'ran' : 'did not run'}`;
+        });
+        return `content_scripts[${entry.index}]: ${js.length ? js.join(', ') : 'no js'}`;
+    });
+    if (cssDeclared) {
+        if (observation.injectedSheets < cssDeclared)
+            ok = false;
+        parts.push(`${Math.min(observation.injectedSheets, cssDeclared)}/${cssDeclared} declared stylesheet(s) injected`);
+    }
+    const errors = [...new Set(observation.errors)];
+    return [
+        { name, status: ok ? 'passed' : 'failed', detail: `${parts.join(' · ')}${landed}` },
+        {
+            name: `no extension errors on ${site}`,
+            status: errors.length ? 'failed' : 'passed',
+            ...(errors.length ? { detail: errors.slice(0, 5).join(' | ') } : {}),
+        },
+    ];
+}
+/** A `--site` value: an absolute http(s) URL. */
+export function parseSiteUrl(value) {
+    let url;
+    try {
+        url = new URL(value.trim());
+    }
+    catch {
+        throw new InvalidInputError(`--site ${value}: not an absolute URL`);
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:')
+        throw new InvalidInputError(`--site ${value}: only http(s) pages — content scripts do not run on file:// without an extra permission; serve local pages with a static server.`);
+    return url.href;
+}
 async function readPackage(bytes) {
     let zip;
     try {
@@ -91,6 +228,23 @@ async function readPackage(bytes) {
         .map((f) => f.name));
     return { manifest, paths, zip };
 }
+/** A directory (an unpacked build) rather than a package file. */
+export function isExtensionDirectory(file) {
+    return !!fs.statSync(file, { throwIfNoEntry: false })?.isDirectory();
+}
+/**
+ * The folder as `extenshi package` would read it, in a reproducible zip (the
+ * same stamp as package.ts), so the rest of the run — static checks,
+ * extraction, Firefox's install — treats it exactly like a package.
+ */
+function zipDirectory(dir) {
+    if (!fs.existsSync(path.join(dir, 'manifest.json')))
+        throw new InvalidInputError(`${dir} has no manifest.json — pass the extension's root folder, or a zip.`);
+    const writer = new ZipBuilder({ mtime: reproducibleMtime() });
+    for (const file of collectFiles(dir).files)
+        writer.addFile(file.path, file.bytes);
+    return Buffer.from(writer.toBytes());
+}
 /** Checks that need no browser: the files the manifest names exist, and Firefox has a real add-on ID. */
 export function staticChecks(manifest, paths, engine) {
     const missing = manifestReferences(manifest).filter((ref) => !paths.has(ref));
@@ -116,13 +270,22 @@ export function staticChecks(manifest, paths, engine) {
 export async function runSmoke(options) {
     const artifact = path.resolve(options.artifactPath);
     const stat = fs.statSync(artifact, { throwIfNoEntry: false });
-    if (!stat?.isFile())
+    if (!stat?.isFile() && !stat?.isDirectory())
         throw new InvalidInputError(`Package not found: ${options.artifactPath}`);
-    const bytes = fs.readFileSync(artifact);
+    const sites = (options.sites ?? []).map(parseSiteUrl);
+    const source = stat?.isDirectory() ? 'directory' : 'zip';
+    const bytes = source === 'directory' ? zipDirectory(artifact) : fs.readFileSync(artifact);
     const sha256 = createHash('sha256').update(bytes).digest('hex');
     const loaded = await readPackage(bytes);
     const checks = staticChecks(loaded.manifest, loaded.paths, options.engine);
-    const base = { artifact, sha256, browser: options.engine, limits: LIMITS };
+    const base = {
+        artifact,
+        source,
+        sha256,
+        browser: options.engine,
+        limits: limitsFor(options.engine, sites),
+    };
+    const run = { ...options, sites };
     let engineChecks;
     if (checks.some((c) => c.status === 'failed')) {
         // A package that cannot load is reported as such, without a browser run
@@ -130,10 +293,10 @@ export async function runSmoke(options) {
         engineChecks = { engine: { name: options.engine }, checks: [] };
     }
     else if (options.engine === 'firefox') {
-        engineChecks = await smokeFirefox(artifact, loaded.manifest, options);
+        engineChecks = await smokeFirefox(source === 'directory' ? bytes : artifact, loaded.manifest, run);
     }
     else {
-        engineChecks = await smokeChromium(loaded, options);
+        engineChecks = await smokeChromium(loaded, run);
     }
     const all = [...checks, ...engineChecks.checks];
     return {
@@ -312,6 +475,9 @@ async function smokeChromium(loaded, options) {
             });
             await tab.close();
         }
+        // Sites before the final error read, so content-script errors also land there.
+        for (const site of options.sites ?? [])
+            checks.push(...siteChecks(loaded.manifest, await observeSite(context, id, loaded.manifest, site, timeout)));
         const final = (await info()).find((e) => e.id === id) ?? {};
         const manifestProblems = [
             ...(final.manifestErrors ?? []).map((e) => String(e.message)),
@@ -336,8 +502,94 @@ async function smokeChromium(loaded, options) {
         fs.rmSync(profile, { recursive: true, force: true });
     }
 }
+/**
+ * Open `site` in a fresh tab with a DevTools session attached BEFORE the
+ * navigation, and record what the browser itself reports for the top frame:
+ * extension files compiled into the page (isolated world or MAIN), stylesheets
+ * injected for an extension, and errors raised by the extension's world, its
+ * files or its URLs. Nothing is asked of the extension, and its state is not
+ * touched.
+ */
+async function observeSite(context, id, manifest, site, timeout) {
+    const base = `chrome-extension://${id}/`;
+    const fromExtension = (url) => typeof url === 'string' && url.startsWith(base);
+    const observation = { site, scripts: [], injectedSheets: 0, errors: [] };
+    const tab = await context.newPage();
+    try {
+        const cdp = await context.newCDPSession(tab);
+        const top = (await cdp.send('Page.getFrameTree')).frameTree.frame.id;
+        const frameOf = new Map();
+        const extensionWorlds = new Set();
+        let scripts = new Set();
+        let sheets = new Set();
+        // A new document in the tab (redirect, client-side navigation) starts the count over.
+        cdp.on('Runtime.executionContextsCleared', () => {
+            scripts = new Set();
+            sheets = new Set();
+        });
+        cdp.on('Runtime.executionContextCreated', ({ context: world }) => {
+            frameOf.set(world.id, world.auxData?.frameId);
+            if (world.origin === base.slice(0, -1))
+                extensionWorlds.add(world.id);
+        });
+        cdp.on('Debugger.scriptParsed', (script) => {
+            const frame = script.executionContextAuxData?.frameId ?? frameOf.get(script.executionContextId);
+            if (frame === top && fromExtension(script.url))
+                scripts.add(script.url.slice(base.length).split(/[?#]/)[0]);
+        });
+        cdp.on('CSS.styleSheetAdded', ({ header }) => {
+            if (header.origin === 'injected' && header.frameId === top)
+                sheets.add(header.styleSheetId);
+        });
+        cdp.on('CSS.styleSheetRemoved', ({ styleSheetId }) => sheets.delete(styleSheetId));
+        const byExtension = (contextId, frames, url) => extensionWorlds.has(contextId) || fromExtension(url) || !!frames?.some((f) => fromExtension(f.url));
+        cdp.on('Runtime.exceptionThrown', ({ exceptionDetails: d }) => {
+            if (byExtension(d.executionContextId, d.stackTrace?.callFrames, d.url))
+                observation.errors.push(`uncaught: ${String(d.exception?.description ?? d.text).split('\n')[0]}`);
+        });
+        cdp.on('Runtime.consoleAPICalled', (call) => {
+            if (call.type === 'error' && byExtension(call.executionContextId, call.stackTrace?.callFrames))
+                observation.errors.push(`console.error: ${(call.args ?? []).map((a) => a.value ?? a.description ?? a.type).join(' ')}`);
+        });
+        // Browser-raised messages: a blocked web_accessible_resource, a failed load of an extension URL.
+        cdp.on('Log.entryAdded', ({ entry }) => {
+            if (entry.level === 'error' && (fromExtension(entry.url) || String(entry.text).includes(base)))
+                observation.errors.push(String(entry.text));
+        });
+        await cdp.send('Runtime.enable');
+        await cdp.send('Debugger.enable');
+        // A `debugger;` statement in the extension or the site must not stall the run.
+        await cdp.send('Debugger.setSkipAllPauses', { skip: true });
+        await cdp.send('DOM.enable');
+        await cdp.send('CSS.enable');
+        await cdp.send('Log.enable');
+        try {
+            await tab.goto(site, { waitUntil: 'load', timeout });
+        }
+        catch (error) {
+            observation.openError = error.message.split('\n')[0];
+            return observation;
+        }
+        // document_idle scripts go in shortly after load: wait for what is expected, then for late errors.
+        const expected = contentScriptsFor(manifest, tab.url());
+        const js = expected.flatMap((e) => e.js);
+        const css = new Set(expected.flatMap((e) => e.css)).size;
+        if (expected.length)
+            await until(async () => js.every((f) => scripts.has(f)) && sheets.size >= css, Math.min(timeout, 5_000));
+        await sleep(Math.min(1_500, timeout));
+        observation.finalUrl = tab.url();
+        observation.scripts = [...scripts];
+        observation.injectedSheets = sheets.size;
+        return observation;
+    }
+    finally {
+        await tab.close().catch(() => { });
+    }
+}
 // ── Firefox ─────────────────────────────────────────────────────────────────
-async function smokeFirefox(artifact, manifest, options) {
+async function smokeFirefox(
+/** The zip on disk, or the bytes of one built from a folder. */
+artifact, manifest, options) {
     const timeout = options.timeoutMs ?? 15_000;
     const binary = findFirefox(options.firefoxBinary);
     if (!binary)
@@ -345,12 +597,25 @@ async function smokeFirefox(artifact, manifest, options) {
     const addonId = manifestGeckoId(manifest);
     const uuid = randomUUID();
     const base = `moz-extension://${uuid}/`;
-    const firefox = await launchFirefox({
-        binary,
-        uuids: { [addonId]: uuid },
-        headless: !options.headed,
-        timeoutMs: timeout * 2,
-    });
+    // Firefox installs a zip file: give a folder's bytes one, removed afterwards.
+    const tmp = typeof artifact === 'string' ? null : fs.mkdtempSync(path.join(os.tmpdir(), 'extenshi-smoke-xpi-'));
+    const addonPath = tmp ? path.join(tmp, 'extension.zip') : artifact;
+    let firefox;
+    try {
+        if (tmp)
+            fs.writeFileSync(addonPath, artifact);
+        firefox = await launchFirefox({
+            binary,
+            uuids: { [addonId]: uuid },
+            headless: !options.headed,
+            timeoutMs: timeout * 2,
+        });
+    }
+    catch (error) {
+        if (tmp)
+            fs.rmSync(tmp, { recursive: true, force: true });
+        throw error;
+    }
     const checks = [];
     const engine = { name: 'firefox-rdp', binary };
     try {
@@ -387,7 +652,7 @@ async function smokeFirefox(artifact, manifest, options) {
             if (typeof version === 'string')
                 engine.browserVersion = version;
         }
-        const installed = await client.request(root.addonsActor, 'installTemporaryAddon', { addonPath: artifact });
+        const installed = await client.request(root.addonsActor, 'installTemporaryAddon', { addonPath });
         if (installed.error) {
             checks.push({
                 name: 'temporary install accepted',
@@ -467,6 +732,14 @@ async function smokeFirefox(artifact, manifest, options) {
                 detail: problems.length ? `${page.path}: ${problems.slice(0, 5).join(' | ')}` : page.path,
             });
         }
+        // Content scripts live in the web page's process, which this add-on watcher
+        // does not see; observing them needs the tab's own targets — not built yet.
+        for (const site of options.sites ?? [])
+            checks.push({
+                name: `content scripts inject on ${site}`,
+                status: 'skipped',
+                detail: 'not supported on Firefox yet — run --site with --browser chromium or edge',
+            });
         await sleep(250);
         const runtime = errors.map((e) => `${e.text}${e.url ? ` (${e.url.replace(base, '')})` : ''}`);
         checks.push({
@@ -478,12 +751,15 @@ async function smokeFirefox(artifact, manifest, options) {
     }
     finally {
         await firefox.close();
+        if (tmp)
+            fs.rmSync(tmp, { recursive: true, force: true });
     }
 }
 export function renderSmoke(result) {
     const mark = { passed: '✓', failed: '✗', skipped: '–' };
+    const unpacked = result.source === 'directory' ? '  (unpacked folder; sha256 of the zip built from it)' : '';
     return [
-        `${result.browser} smoke — ${result.status.toUpperCase()}  ${result.sha256}  ${result.artifact}`,
+        `${result.browser} smoke — ${result.status.toUpperCase()}  ${result.sha256}  ${result.artifact}${unpacked}`,
         ...result.checks.map((c) => `  ${mark[c.status]} ${c.name}${c.detail ? ` — ${c.detail}` : ''}`),
         ...result.limits.map((l) => `  note: ${l}`),
     ].join('\n');