@flrande/browserctl 0.1.0-dev.7.1

package/apps/browserd/src/main.test.ts

@@ -0,0 +1,864 @@
+import { describe, expect, it } from "vitest";
+import { PassThrough } from "node:stream";
+import { createConnection } from "node:net";
+
+import { createContainer, loadBrowserdConfig } from "./container";
+import { bootstrapBrowserd } from "./bootstrap";
+
+function waitForNextJsonLine(stream: PassThrough): Promise<Record<string, unknown>> {
+  return new Promise((resolve, reject) => {
+    let buffer = "";
+    const timeout = setTimeout(() => {
+      stream.off("data", onData);
+      reject(new Error("Timed out waiting for JSON line response."));
+    }, 1000);
+
+    const onData = (chunk: string | Buffer) => {
+      buffer += typeof chunk === "string" ? chunk : chunk.toString("utf8");
+      const newlineIndex = buffer.indexOf("\n");
+      if (newlineIndex < 0) {
+        return;
+      }
+
+      clearTimeout(timeout);
+      stream.off("data", onData);
+      const line = buffer.slice(0, newlineIndex);
+
+      resolve(JSON.parse(line) as Record<string, unknown>);
+    };
+
+    stream.on("data", onData);
+  });
+}
+
+function sendToolRequest(
+  input: PassThrough,
+  output: PassThrough,
+  request: Record<string, unknown>
+): Promise<Record<string, unknown>> {
+  const responsePromise = waitForNextJsonLine(output);
+  input.write(`${JSON.stringify(request)}\n`);
+  return responsePromise;
+}
+
+function sendTcpToolRequest(
+  port: number,
+  request: Record<string, unknown>
+): Promise<Record<string, unknown>> {
+  return new Promise((resolve, reject) => {
+    const socket = createConnection({ host: "127.0.0.1", port });
+    socket.setEncoding("utf8");
+
+    let buffer = "";
+    const timeout = setTimeout(() => {
+      socket.destroy();
+      reject(new Error("Timed out waiting for TCP response."));
+    }, 1000);
+
+    socket.on("error", (error) => {
+      clearTimeout(timeout);
+      reject(error);
+    });
+
+    socket.on("connect", () => {
+      socket.write(`${JSON.stringify(request)}\n`);
+    });
+
+    socket.on("data", (chunk: string) => {
+      buffer += chunk;
+      const lineBreakIndex = buffer.indexOf("\n");
+      if (lineBreakIndex < 0) {
+        return;
+      }
+
+      clearTimeout(timeout);
+      socket.end();
+      resolve(JSON.parse(buffer.slice(0, lineBreakIndex)) as Record<string, unknown>);
+    });
+  });
+}
+
+describe("browserd container", () => {
+  it("uses secure defaults for new security config fields", () => {
+    const config = loadBrowserdConfig({});
+
+    expect(config.defaultDriver).toBe("managed-local");
+    expect(config.managedLocalEnabled).toBe(true);
+    expect(config.uploadRoot).toBeUndefined();
+    expect(config.downloadRoot).toBeUndefined();
+    expect(config.authToken).toBeUndefined();
+    expect(config.authScopes).toEqual(["read", "act", "upload", "download"]);
+  });
+
+  it("registers managed-local, managed, chrome-relay, and remote-cdp drivers by default", () => {
+    const c = createContainer();
+
+    expect(c.drivers.has("managed-local")).toBe(true);
+    expect(c.drivers.has("managed")).toBe(true);
+    expect(c.drivers.has("chrome-relay")).toBe(true);
+    expect(c.drivers.has("remote-cdp")).toBe(true);
+  });
+
+  it("uses env override in loadBrowserdConfig", () => {
+    const config = loadBrowserdConfig({
+      BROWSERD_REMOTE_CDP_URL: "http://127.0.0.1:9333/devtools/browser/override",
+      BROWSERD_UPLOAD_ROOT: "C:\\safe\\uploads",
+      BROWSERD_DOWNLOAD_ROOT: "C:\\safe\\downloads",
+      BROWSERD_AUTH_TOKEN: "test-token",
+      BROWSERD_AUTH_SCOPES: " read, download "
+    });
+
+    expect(config.remoteCdpUrl).toBe("http://127.0.0.1:9333/devtools/browser/override");
+    expect(config.chromeRelayUrl).toBe("http://127.0.0.1:9223");
+    expect(config.defaultDriver).toBe("managed-local");
+    expect(config.managedLocalEnabled).toBe(true);
+    expect(config.uploadRoot).toBe("C:\\safe\\uploads");
+    expect(config.downloadRoot).toBe("C:\\safe\\downloads");
+    expect(config.authToken).toBe("test-token");
+    expect(config.authScopes).toEqual(["read", "download"]);
+  });
+
+  it("parses chrome relay extension mode env values", () => {
+    const config = loadBrowserdConfig({
+      BROWSERD_CHROME_RELAY_MODE: "extension",
+      BROWSERD_CHROME_RELAY_URL: "http://127.0.0.1:9555",
+      BROWSERD_CHROME_RELAY_EXTENSION_TOKEN: "relay-secret",
+      BROWSERD_CHROME_RELAY_EXTENSION_REQUEST_TIMEOUT_MS: "7000"
+    });
+
+    expect(config.chromeRelayMode).toBe("extension");
+    expect(config.chromeRelayUrl).toBe("http://127.0.0.1:9555");
+    expect(config.chromeRelayExtensionToken).toBe("relay-secret");
+    expect(config.chromeRelayExtensionRequestTimeoutMs).toBe(7000);
+  });
+
+  it("requires extension relay token when extension mode is enabled", () => {
+    expect(() =>
+      loadBrowserdConfig({
+        BROWSERD_CHROME_RELAY_MODE: "extension"
+      })
+    ).toThrow("BROWSERD_CHROME_RELAY_EXTENSION_TOKEN");
+  });
+
+  it("defaults to managed when managed-local is explicitly disabled", () => {
+    const config = loadBrowserdConfig({
+      BROWSERD_MANAGED_LOCAL_ENABLED: "false"
+    });
+
+    expect(config.managedLocalEnabled).toBe(false);
+    expect(config.defaultDriver).toBe("managed");
+  });
+
+  it("does not register managed-local driver when explicitly disabled", () => {
+    const c = createContainer(
+      loadBrowserdConfig({
+        BROWSERD_MANAGED_LOCAL_ENABLED: "false"
+      })
+    );
+
+    expect(c.drivers.has("managed-local")).toBe(false);
+  });
+});
+
+describe("browserd bootstrap", () => {
+  it("starts mcp stdio runtime with container wiring", () => {
+    const input = new PassThrough();
+    const output = new PassThrough();
+
+    const runtime = bootstrapBrowserd({ input, output });
+
+    expect(runtime.mcpStdioStarted).toBe(true);
+    expect(runtime.container.drivers.has("managed")).toBe(true);
+    expect(runtime.container.drivers.has("chrome-relay")).toBe(true);
+    expect(runtime.container.drivers.has("remote-cdp")).toBe(true);
+    expect(runtime.container.drivers.has("managed-local")).toBe(true);
+
+    runtime.close();
+    input.end();
+    output.end();
+  });
+
+  it("supports tcp transport mode for persistent daemon use", async () => {
+    const port = 41419;
+    const runtime = bootstrapBrowserd({
+      env: {
+        BROWSERD_TRANSPORT: "tcp",
+        BROWSERD_PORT: String(port),
+        BROWSERD_AUTH_TOKEN: "tcp-token"
+      }
+    });
+
+    const response = await sendTcpToolRequest(port, {
+      id: "request-tcp-status",
+      name: "browser.status",
+      traceId: "trace:tcp",
+      arguments: {
+        sessionId: "session:tcp",
+        authToken: "tcp-token"
+      }
+    });
+
+    expect(response.ok).toBe(true);
+    expect(response.id).toBe("request-tcp-status");
+    expect(response.traceId).toBe("trace:tcp");
+    expect(response.sessionId).toBe("session:tcp");
+    expect(response.data).toMatchObject({
+      kind: "browserd",
+      ready: true
+    });
+
+    runtime.close();
+  });
+
+  it("rejects tcp transport mode when auth token is not configured", () => {
+    let runtime: ReturnType<typeof bootstrapBrowserd> | undefined;
+    try {
+      expect(() => {
+        runtime = bootstrapBrowserd({
+          env: {
+            BROWSERD_TRANSPORT: "tcp",
+            BROWSERD_PORT: "41420"
+          }
+        });
+      }).toThrow("BROWSERD_AUTH_TOKEN");
+    } finally {
+      runtime?.close();
+    }
+  });
+
+  it("processes line-delimited requests and writes response with id", async () => {
+    const input = new PassThrough();
+    const output = new PassThrough();
+    const runtime = bootstrapBrowserd({ input, output, stdioProtocol: "legacy" });
+
+    const response = await sendToolRequest(input, output, {
+      id: "request-1",
+      name: "browser.status",
+      traceId: "trace:test-1",
+      arguments: {
+        sessionId: "session:test-1"
+      }
+    });
+
+    expect(response.id).toBe("request-1");
+    expect(response.ok).toBe(true);
+    expect(response.traceId).toBe("trace:test-1");
+    expect(response.sessionId).toBe("session:test-1");
+    expect(response.data).toMatchObject({
+      kind: "browserd",
+      ready: true,
+      driver: "managed-local"
+    });
+
+    runtime.close();
+    input.end();
+    output.end();
+  });
+
+  it("supports managed-local as default driver when enabled", async () => {
+    const input = new PassThrough();
+    const output = new PassThrough();
+    const runtime = bootstrapBrowserd({
+      env: {
+        BROWSERD_MANAGED_LOCAL_ENABLED: "true",
+        BROWSERD_DEFAULT_DRIVER: "managed-local"
+      },
+      input,
+      output,
+      stdioProtocol: "legacy"
+    });
+
+    const response = await sendToolRequest(input, output, {
+      id: "request-local-default",
+      name: "browser.status",
+      traceId: "trace:local-default",
+      arguments: {
+        sessionId: "session:local-default"
+      }
+    });
+
+    expect(response.ok).toBe(true);
+    expect(response.data).toMatchObject({
+      kind: "browserd",
+      ready: true,
+      driver: "managed-local"
+    });
+    expect((response.data as { status: { kind: string; launched: boolean } }).status).toMatchObject({
+      kind: "managed-local",
+      launched: false
+    });
+
+    runtime.close();
+    input.end();
+    output.end();
+  });
+
+  it("falls back to managed when configured default is unavailable", async () => {
+    const input = new PassThrough();
+    const output = new PassThrough();
+    const runtime = bootstrapBrowserd({
+      env: {
+        BROWSERD_DEFAULT_DRIVER: "managed-local",
+        BROWSERD_MANAGED_LOCAL_ENABLED: "false"
+      },
+      input,
+      output,
+      stdioProtocol: "legacy"
+    });
+
+    const response = await sendToolRequest(input, output, {
+      id: "request-default-fallback",
+      name: "browser.status",
+      traceId: "trace:default-fallback",
+      arguments: {
+        sessionId: "session:default-fallback"
+      }
+    });
+
+    expect(response.ok).toBe(true);
+    expect(response.data).toMatchObject({
+      kind: "browserd",
+      ready: true,
+      driver: "managed"
+    });
+
+    runtime.close();
+    input.end();
+    output.end();
+  });
+
+  it("requires auth token when configured", async () => {
+    const input = new PassThrough();
+    const output = new PassThrough();
+    const runtime = bootstrapBrowserd({
+      env: {
+        BROWSERD_AUTH_TOKEN: "secret-token"
+      },
+      input,
+      output,
+      stdioProtocol: "legacy"
+    });
+
+    const response = await sendToolRequest(input, output, {
+      id: "request-auth-missing",
+      name: "browser.status",
+      traceId: "trace:auth-missing",
+      arguments: {
+        sessionId: "session:auth-missing"
+      }
+    });
+
+    expect(response.ok).toBe(false);
+    expect(response.error).toMatchObject({
+      code: "E_PERMISSION"
+    });
+
+    runtime.close();
+    input.end();
+    output.end();
+  });
+
+  it("rejects invalid auth token", async () => {
+    const input = new PassThrough();
+    const output = new PassThrough();
+    const runtime = bootstrapBrowserd({
+      env: {
+        BROWSERD_AUTH_TOKEN: "secret-token"
+      },
+      input,
+      output,
+      stdioProtocol: "legacy"
+    });
+
+    const response = await sendToolRequest(input, output, {
+      id: "request-auth-invalid",
+      name: "browser.status",
+      traceId: "trace:auth-invalid",
+      arguments: {
+        sessionId: "session:auth-invalid",
+        authToken: "wrong-token"
+      }
+    });
+
+    expect(response.ok).toBe(false);
+    expect(response.error).toMatchObject({
+      code: "E_PERMISSION"
+    });
+
+    runtime.close();
+    input.end();
+    output.end();
+  });
+
+  it("denies calls when requested tool scope is not allowed", async () => {
+    const input = new PassThrough();
+    const output = new PassThrough();
+    const runtime = bootstrapBrowserd({
+      env: {
+        BROWSERD_DEFAULT_DRIVER: "managed",
+        BROWSERD_AUTH_TOKEN: "secret-token",
+        BROWSERD_AUTH_SCOPES: "read"
+      },
+      input,
+      output,
+      stdioProtocol: "legacy"
+    });
+
+    const response = await sendToolRequest(input, output, {
+      id: "request-scope-deny",
+      name: "browser.tab.open",
+      traceId: "trace:scope-deny",
+      arguments: {
+        sessionId: "session:scope-deny",
+        authToken: "secret-token",
+        url: "https://example.com"
+      }
+    });
+
+    expect(response.ok).toBe(false);
+    expect(response.error).toMatchObject({
+      code: "E_PERMISSION"
+    });
+
+    runtime.close();
+    input.end();
+    output.end();
+  });
+
+  it("denies upload and download tools when scopes exclude them", async () => {
+    const input = new PassThrough();
+    const output = new PassThrough();
+    const runtime = bootstrapBrowserd({
+      env: {
+        BROWSERD_DEFAULT_DRIVER: "managed",
+        BROWSERD_AUTH_TOKEN: "secret-token",
+        BROWSERD_AUTH_SCOPES: "read,act"
+      },
+      input,
+      output,
+      stdioProtocol: "legacy"
+    });
+
+    const openResponse = await sendToolRequest(input, output, {
+      id: "request-scope-open",
+      name: "browser.tab.open",
+      traceId: "trace:scope:open",
+      arguments: {
+        sessionId: "session:scope:file-transfer",
+        authToken: "secret-token",
+        url: "https://example.com/scopes"
+      }
+    });
+
+    const targetId = (openResponse.data as { targetId: string }).targetId;
+
+    const uploadResponse = await sendToolRequest(input, output, {
+      id: "request-scope-upload",
+      name: "browser.upload.arm",
+      traceId: "trace:scope:upload",
+      arguments: {
+        sessionId: "session:scope:file-transfer",
+        authToken: "secret-token",
+        targetId,
+        files: ["C:\\allowed\\uploads\\file.txt"]
+      }
+    });
+
+    expect(uploadResponse.ok).toBe(false);
+    expect(uploadResponse.error).toMatchObject({
+      code: "E_PERMISSION"
+    });
+
+    const downloadResponse = await sendToolRequest(input, output, {
+      id: "request-scope-download",
+      name: "browser.download.wait",
+      traceId: "trace:scope:download",
+      arguments: {
+        sessionId: "session:scope:file-transfer",
+        authToken: "secret-token",
+        targetId
+      }
+    });
+
+    expect(downloadResponse.ok).toBe(false);
+    expect(downloadResponse.error).toMatchObject({
+      code: "E_PERMISSION"
+    });
+
+    runtime.close();
+    input.end();
+    output.end();
+  });
+
+  it("rejects upload paths that escape configured upload root", async () => {
+    const input = new PassThrough();
+    const output = new PassThrough();
+    const runtime = bootstrapBrowserd({
+      env: {
+        BROWSERD_DEFAULT_DRIVER: "managed",
+        BROWSERD_UPLOAD_ROOT: "C:\\allowed\\uploads"
+      },
+      input,
+      output,
+      stdioProtocol: "legacy"
+    });
+
+    const openResponse = await sendToolRequest(input, output, {
+      id: "request-upload-open",
+      name: "browser.tab.open",
+      traceId: "trace:upload:open",
+      arguments: {
+        sessionId: "session:upload-root",
+        url: "https://example.com/upload"
+      }
+    });
+
+    const targetId = (openResponse.data as { targetId: string }).targetId;
+    const uploadResponse = await sendToolRequest(input, output, {
+      id: "request-upload-arm",
+      name: "browser.upload.arm",
+      traceId: "trace:upload:arm",
+      arguments: {
+        sessionId: "session:upload-root",
+        targetId,
+        files: ["..\\..\\escape.txt"]
+      }
+    });
+
+    expect(uploadResponse.ok).toBe(false);
+    expect(uploadResponse.error).toMatchObject({
+      code: "E_PERMISSION"
+    });
+
+    runtime.close();
+    input.end();
+    output.end();
+  });
+
+  it("rejects upload-arm when upload root is not configured", async () => {
+    const input = new PassThrough();
+    const output = new PassThrough();
+    const runtime = bootstrapBrowserd({
+      env: {
+        BROWSERD_DEFAULT_DRIVER: "managed"
+      },
+      input,
+      output,
+      stdioProtocol: "legacy"
+    });
+
+    const openResponse = await sendToolRequest(input, output, {
+      id: "request-upload-root-open",
+      name: "browser.tab.open",
+      traceId: "trace:upload-root:open",
+      arguments: {
+        sessionId: "session:upload-root:required",
+        url: "https://example.com/upload-root"
+      }
+    });
+
+    const targetId = (openResponse.data as { targetId: string }).targetId;
+    const uploadResponse = await sendToolRequest(input, output, {
+      id: "request-upload-root-required",
+      name: "browser.upload.arm",
+      traceId: "trace:upload-root:required",
+      arguments: {
+        sessionId: "session:upload-root:required",
+        targetId,
+        files: ["C:\\temp\\upload.txt"]
+      }
+    });
+
+    expect(uploadResponse.ok).toBe(false);
+    expect(uploadResponse.error).toMatchObject({
+      code: "E_PERMISSION"
+    });
+    expect(String(uploadResponse.error?.message ?? "")).toContain("BROWSERD_UPLOAD_ROOT");
+
+    runtime.close();
+    input.end();
+    output.end();
+  });
+
+  it("rejects download paths outside configured download root", async () => {
+    const input = new PassThrough();
+    const output = new PassThrough();
+    const runtime = bootstrapBrowserd({
+      env: {
+        BROWSERD_DEFAULT_DRIVER: "managed",
+        BROWSERD_DOWNLOAD_ROOT: "C:\\allowed\\downloads"
+      },
+      input,
+      output,
+      stdioProtocol: "legacy"
+    });
+
+    const openResponse = await sendToolRequest(input, output, {
+      id: "request-download-open",
+      name: "browser.tab.open",
+      traceId: "trace:download:open",
+      arguments: {
+        sessionId: "session:download-root",
+        url: "https://example.com/download"
+      }
+    });
+
+    const targetId = (openResponse.data as { targetId: string }).targetId;
+
+    const traversalResponse = await sendToolRequest(input, output, {
+      id: "request-download-wait-traversal",
+      name: "browser.download.wait",
+      traceId: "trace:download:wait:traversal",
+      arguments: {
+        sessionId: "session:download-root",
+        targetId,
+        path: "..\\escape.bin"
+      }
+    });
+
+    expect(traversalResponse.ok).toBe(false);
+    expect(traversalResponse.error).toMatchObject({
+      code: "E_PERMISSION"
+    });
+
+    const outsideResponse = await sendToolRequest(input, output, {
+      id: "request-download-wait-outside",
+      name: "browser.download.wait",
+      traceId: "trace:download:wait:outside",
+      arguments: {
+        sessionId: "session:download-root",
+        targetId,
+        path: "D:\\outside\\escape.bin"
+      }
+    });
+
+    expect(outsideResponse.ok).toBe(false);
+    expect(outsideResponse.error).toMatchObject({
+      code: "E_PERMISSION"
+    });
+
+    runtime.close();
+    input.end();
+    output.end();
+  });
+
+  it("rejects download-wait when download root is not configured", async () => {
+    const input = new PassThrough();
+    const output = new PassThrough();
+    const runtime = bootstrapBrowserd({
+      env: {
+        BROWSERD_DEFAULT_DRIVER: "managed"
+      },
+      input,
+      output,
+      stdioProtocol: "legacy"
+    });
+
+    const openResponse = await sendToolRequest(input, output, {
+      id: "request-download-root-open",
+      name: "browser.tab.open",
+      traceId: "trace:download-root:open",
+      arguments: {
+        sessionId: "session:download-root:required",
+        url: "https://example.com/download-root"
+      }
+    });
+
+    const targetId = (openResponse.data as { targetId: string }).targetId;
+    const downloadResponse = await sendToolRequest(input, output, {
+      id: "request-download-root-required",
+      name: "browser.download.wait",
+      traceId: "trace:download-root:required",
+      arguments: {
+        sessionId: "session:download-root:required",
+        targetId
+      }
+    });
+
+    expect(downloadResponse.ok).toBe(false);
+    expect(downloadResponse.error).toMatchObject({
+      code: "E_PERMISSION"
+    });
+    expect(String(downloadResponse.error?.message ?? "")).toContain("BROWSERD_DOWNLOAD_ROOT");
+
+    runtime.close();
+    input.end();
+    output.end();
+  });
+
+  it("routes tab.open and tab.list through driver-backed tool handlers", async () => {
+    const input = new PassThrough();
+    const output = new PassThrough();
+    const runtime = bootstrapBrowserd({
+      env: {
+        BROWSERD_DEFAULT_DRIVER: "managed"
+      },
+      input,
+      output,
+      stdioProtocol: "legacy"
+    });
+
+    const openResponse = await sendToolRequest(input, output, {
+      id: "request-open",
+      name: "browser.tab.open",
+      traceId: "trace:open",
+      arguments: {
+        sessionId: "session:flow",
+        url: "https://example.com"
+      }
+    });
+
+    expect(openResponse.ok).toBe(true);
+    expect(openResponse.data).toMatchObject({
+      driver: "managed"
+    });
+    const openedTargetId = (openResponse.data as Record<string, unknown>).targetId;
+    expect(typeof openedTargetId).toBe("string");
+
+    const listResponse = await sendToolRequest(input, output, {
+      id: "request-list",
+      name: "browser.tab.list",
+      traceId: "trace:list",
+      arguments: {
+        sessionId: "session:flow"
+      }
+    });
+
+    expect(listResponse.ok).toBe(true);
+    expect(listResponse.data).toMatchObject({
+      driver: "managed"
+    });
+    expect((listResponse.data as { tabs: string[] }).tabs).toContain(openedTargetId);
+
+    runtime.close();
+    input.end();
+    output.end();
+  });
+
+  it("routes console and network tools for known targets", async () => {
+    const input = new PassThrough();
+    const output = new PassThrough();
+    const runtime = bootstrapBrowserd({
+      env: {
+        BROWSERD_DEFAULT_DRIVER: "managed"
+      },
+      input,
+      output,
+      stdioProtocol: "legacy"
+    });
+
+    const openResponse = await sendToolRequest(input, output, {
+      id: "request-open-tools",
+      name: "browser.tab.open",
+      traceId: "trace:tools:open",
+      arguments: {
+        sessionId: "session:tools",
+        url: "https://example.com/tools"
+      }
+    });
+
+    const targetId = (openResponse.data as { targetId: string }).targetId;
+
+    const consoleResponse = await sendToolRequest(input, output, {
+      id: "request-console",
+      name: "browser.console.list",
+      traceId: "trace:tools:console",
+      arguments: {
+        sessionId: "session:tools",
+        targetId
+      }
+    });
+
+    expect(consoleResponse.ok).toBe(true);
+    expect(consoleResponse.data).toEqual({
+      driver: "managed",
+      targetId,
+      entries: []
+    });
+
+    const networkResponse = await sendToolRequest(input, output, {
+      id: "request-network",
+      name: "browser.network.responseBody",
+      traceId: "trace:tools:network",
+      arguments: {
+        sessionId: "session:tools",
+        targetId,
+        requestId: "request-42"
+      }
+    });
+
+    expect(networkResponse.ok).toBe(true);
+    expect(networkResponse.data).toEqual({
+      driver: "managed",
+      targetId,
+      requestId: "request-42",
+      body: "",
+      encoding: "utf8"
+    });
+
+    const screenshotResponse = await sendToolRequest(input, output, {
+      id: "request-screenshot",
+      name: "browser.screenshot",
+      traceId: "trace:tools:screenshot",
+      arguments: {
+        sessionId: "session:tools",
+        targetId
+      }
+    });
+
+    expect(screenshotResponse.ok).toBe(false);
+    expect(screenshotResponse.error).toMatchObject({
+      code: "E_DRIVER_UNAVAILABLE"
+    });
+
+    runtime.close();
+    input.end();
+    output.end();
+  });
+
+  it("preserves id and trace/session metadata when queue-level error handling runs", async () => {
+    const input = new PassThrough();
+    const output = new PassThrough();
+    const runtime = bootstrapBrowserd({ input, output, stdioProtocol: "legacy" });
+
+    const originalWrite = output.write.bind(output);
+    let shouldThrow = true;
+    (output as unknown as { write: (chunk: string | Buffer) => boolean }).write = (
+      chunk: string | Buffer
+    ) => {
+      if (shouldThrow) {
+        shouldThrow = false;
+        throw new Error("simulated output failure");
+      }
+
+      return originalWrite(chunk);
+    };
+
+    const responsePromise = waitForNextJsonLine(output);
+    input.write(
+      `${JSON.stringify({
+        id: "request-failure",
+        name: "browser.status",
+        traceId: "trace:failure",
+        arguments: {
+          sessionId: "session:failure"
+        }
+      })}\n`
+    );
+
+    const response = await responsePromise;
+
+    expect(response.id).toBe("request-failure");
+    expect(response.ok).toBe(false);
+    expect(response.traceId).toBe("trace:failure");
+    expect(response.sessionId).toBe("session:failure");
+    expect(response.error).toEqual({
+      code: "E_INVALID_ARG",
+      message: "simulated output failure"
+    });
+
+    runtime.close();
+    input.end();
+    output.end();
+  });
+});