@getopencrawl/cli 0.1.1 → 0.2.0

package/src/product-letter-read.mjs

@@ -1,178 +0,0 @@
-/** Explicit read adapter. Diagnostics retain finite labels and query-free target hashes only. */
-import {createHash} from 'node:crypto';
-import {LETTER_CAPABILITIES_ADAPTER} from './product-letter-capabilities.mjs';
-export const LETTER_ADAPTER='letter-connections-read-v1';
-export const LETTER_SCREEN='https://app.letterstory.com/letterpress?view=connections';
-const ORIGIN='https://app.letterstory.com',PREFIX=ORIGIN+'/api/console/tools/';
-const READS=['list_cms_connections','list_sites','list_repo_sites'];
-const BLOCKED=['prepare_account','refresh_site'];
-// Observed unrelated startup inventory. These are denied, never fetched.
-const BACKGROUND=['export_org_config','list_phantoms','list_collections','list_kernels','list_kernel_endpoints','list_shredder_endpoints','list_seers','list_arenas','list_lede_endpoints','list_mailers','list_prospect_lists','list_sequences','list_dispatches','list_simulations','letterprove_get_vendor_link','list_api_keys','list_integrations','visitors_list_sites','list_growth_builds'];
-const ORG_QUERY=/^\?org_id=([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})$/;
-function toolTarget(url){
-  for(const op of [...READS,...BLOCKED,...BACKGROUND]){
-    const base=PREFIX+op;if(url===base)return {op,org:null,url};
-    if(url.startsWith(base+'?')){const match=ORG_QUERY.exec(url.slice(base.length));if(match)return {op,org:match[1],url};}
-  }
-  return null;
-}
-function blockedTelemetry(url){
-  // Deny-only endpoints: query parameters cannot grant forwarding authority.
-  if(url==='https://app.letterprove.com/api/v1/observe')return true;
-  try{const u=new URL(url);return u.origin===ORIGIN&&u.pathname==='/ingest/flags/'&&!u.hash&&!u.username&&!u.password&&url===u.origin+u.pathname+u.search;}catch{return false;}
-}
-// Diagnostic classification is separate from toolTarget: it never grants forwarding
-// or converts a fatal rejection into a known-background rejection.
-function deniedTarget(req){
-  const value={method:'OTHER',origin_class:'invalid',known_target:'other',target_sha256:null};
-  try{const method=req.method();if(['GET','HEAD','OPTIONS','POST','PUT','PATCH','DELETE'].includes(method))value.method=method;}catch{}
-  try{
-    const raw=req.url();if(typeof raw!=='string'||raw.length>8192)return value;
-    const url=new URL(raw);if(!['http:','https:'].includes(url.protocol))return value;
-    value.origin_class=url.origin===ORIGIN?'letter_app':url.origin==='https://app.letterprove.com'?'letter_telemetry':'other';
-    if(url.origin===ORIGIN){
-      value.known_target=[...READS,...BLOCKED,...BACKGROUND].find(op=>url.pathname==='/api/console/tools/'+op)||'other';
-      if(url.pathname==='/ingest/flags/')value.known_target='telemetry_flags';
-    }else if(url.origin==='https://app.letterprove.com'&&url.pathname==='/api/v1/observe')value.known_target='telemetry_observe';
-    // URL origin excludes credentials; pathname excludes query and fragment.
-    // No percent-decoding: parser normalization is diagnostic, not authority.
-    value.target_sha256=createHash('sha256').update('letter-denied-target-v1\0'+url.origin+url.pathname).digest('hex');
-  }catch{}
-  return value;
-}
-const JSON_TYPE=/^application\/json(?:\s*;\s*charset=utf-8)?$/i;
-const PROVIDERS={webflow:['site_id','site_name'],framer:['project_id','project_url','project_name','auto_deploy'],sanity:['project_id','dataset','project_name','workspace_name'],contentful:['space_id','environment_id','space_name','default_locale'],github:['account_login']};
-const object=v=>v!==null&&typeof v==='object'&&!Array.isArray(v);
-const keys=(v,allowed)=>object(v)&&Object.keys(v).length===allowed.length&&Object.keys(v).every(k=>allowed.includes(k));
-const nullable=v=>v===null||typeof v==='string'&&v.length<=2048;
-export function validConnections(v){
-  if(!keys(v,['connections'])||!Array.isArray(v.connections)||v.connections.length!==5)return false;
-  const seen=new Set();
-  return v.connections.every(row=>{
-    if(!keys(row,['provider','connected','label','created_at','fields'])||!Object.hasOwn(PROVIDERS,row.provider)||seen.has(row.provider)||typeof row.connected!=='boolean'||!nullable(row.label)||!nullable(row.created_at))return false;
-    seen.add(row.provider);
-    return keys(row.fields,PROVIDERS[row.provider])&&Object.entries(row.fields).every(([k,x])=>k==='auto_deploy'?typeof x==='boolean':nullable(x));
-  });
-}
-/** v3 keeps private rows bounded but does not equate capability discovery with five CMS names. */
-export function validCapabilityConnections(v){
-  if(!keys(v,['connections'])||!Array.isArray(v.connections)||v.connections.length<1||v.connections.length>32)return false;
-  const seen=new Set();return v.connections.every(row=>{
-    if(!keys(row,['provider','connected','label','created_at','fields'])||typeof row.provider!=='string'||!(/^[a-z][a-z0-9_-]{0,63}$/).test(row.provider)||seen.has(row.provider)||typeof row.connected!=='boolean'||!nullable(row.label)||!nullable(row.created_at)||!object(row.fields)||Object.keys(row.fields).length>16)return false;
-    seen.add(row.provider);return Object.entries(row.fields).every(([k,x])=>/^[a-z][a-z0-9_]{0,63}$/.test(k)&&(typeof x==='boolean'||nullable(x)));
-  });
-}
-function connectionShape(v){
-  const rows=Array.isArray(v?.connections)?v.connections:[];
-  return {root_keys:keys(v,['connections']),five_rows:Array.isArray(v?.connections)&&rows.length===5,provider_roster:rows.length===5&&new Set(rows.map(r=>r?.provider)).size===5&&rows.every(r=>object(r)&&Object.hasOwn(PROVIDERS,r.provider)),row_keys:rows.length===5&&rows.every(r=>keys(r,['provider','connected','label','created_at','fields'])),row_types:rows.length===5&&rows.every(r=>object(r)&&typeof r.connected==='boolean'&&nullable(r.label)&&nullable(r.created_at)),field_keys:rows.length===5&&rows.every(r=>object(r)&&Object.hasOwn(PROVIDERS,r.provider)&&keys(r.fields,PROVIDERS[r.provider])),field_types:rows.length===5&&rows.every(r=>object(r?.fields)&&Object.entries(r.fields).every(([k,x])=>k==='auto_deploy'?typeof x==='boolean':nullable(x)))};
-}
-export function isLetterPolicy(policy,screen){return policy?.version===2&&policy.request_adapter===LETTER_ADAPTER&&screen.url===LETTER_SCREEN&&screen.account_marker?.required===true;}
-
-export class LetterReadAttempt {
-  constructor(page,deadline,capabilities=false){this.capabilities=capabilities;this.shared=new Map();this.shareTimer=null;this.coalesced=0;this.page=page;this.deadline=deadline;this.requests=new Map();this.seen=new Set();this.scopeSet=false;this.org=null;this.required='missing';this.requiredChecks={};this.readStates=Object.fromEntries(READS.map(op=>[op,{state:'not_requested',phase:null,reason:null,checks:{}}]));this.readiness={state:'not_checked',in_flight:0};this.invalid=false;this.closed=false;this.inFlight=0;this.counts={allowed_reads:0,blocked_setup:0,blocked_refresh:0,blocked_background:0,blocked_other:0};this.denials={version:1,samples:[],omitted:0};}
-  /** Called for each non-read-only request before any forwarding. */
-  request(req){
-    const url=req.url(),target=toolTarget(url),op=target?.op;
-    if(this.capabilities&&(this.closed||this.invalid||performance.now()>=this.deadline))return this.reject(req);
-    let exact=false,reason='unavailable';
-    try{
-      reason=req.method()!=='POST'?'method':req.frame()!==this.page.mainFrame()?'frame':req.redirectedFrom()?'redirect':this.page.url()!==LETTER_SCREEN?'selected_page':req.headers().origin!==ORIGIN?'request_origin':null;
-      exact=reason===null;
-    }catch{}
-    if(exact&&(BLOCKED.includes(op)||BACKGROUND.includes(op)||blockedTelemetry(url))){const key=op==='prepare_account'?'blocked_setup':op==='refresh_site'?'blocked_refresh':'blocked_background';this.counts[key]=Math.min(64,this.counts[key]+1);return 'block_known';}
-    if(!exact)return this.reject(req,reason);
-    if(!READS.includes(op))return this.reject(req,'target');
-    if(req.postData()!=='{}')return this.reject(req,'body_shape');
-    if(!JSON_TYPE.test(req.headers()['content-type']||''))return this.reject(req,'content_type');
-    if(!this.capabilities&&this.seen.has(op))return this.reject(req,'duplicate_read');
-    if(this.scopeSet&&this.org!==target.org)return this.reject(req,'organization_scope');
-    if(this.capabilities){
-      let shared=this.shared.get(op);
-      if(shared){
-        if(shared.url!==url||this.requests.has(req)||shared.followers>=2)return this.reject(req,'duplicate_read');
-        shared.followers++;this.coalesced++;this.requests.set(req,{...target,shared,follower:true,started:false});this.inFlight++;return 'allow';
-      }
-      shared={url,followers:0,value:null};shared.done=new Promise(resolve=>{shared.resolve=resolve});this.shared.set(op,shared);
-      target.shared=shared;target.started=false;this.inFlight++;
-      // One absolute timer also releases followers of a slow or never-started leader.
-      if(this.shareTimer===null)this.shareTimer=setTimeout(()=>{this.invalid=true;this.clearShared();},Math.max(0,this.deadline-performance.now()));
-    }
-    this.scopeSet=true;this.org=target.org;this.seen.add(op);this.requests.set(req,target);this.readStates[op].state='accepted';this.counts.allowed_reads++;return 'allow';
-  }
-  recordDenial(req,reason='unavailable',outerKind='non_read'){
-    try{
-      if(this.closed)return;
-      const sample={...deniedTarget(req),outer_kind:['non_read','navigation_scope','approved_read_redirect'].includes(outerKind)?outerKind:'non_read',reason:['method','frame','redirect','selected_page','request_origin','target','body_shape','content_type','duplicate_read','organization_scope'].includes(reason)?reason:'unavailable'};
-      const match=this.denials.samples.find(row=>Object.entries(sample).every(([key,value])=>row[key]===value));
-      if(match)match.count=Math.min(64,match.count+1);
-      else if(this.denials.samples.length<8)this.denials.samples.push({...sample,count:1});
-      else this.denials.omitted=Math.min(64,this.denials.omitted+1);
-    }catch{} // Diagnostic failure never changes denial or prevents route.abort.
-  }
-  clearShared(){for(const item of this.shared.values()){item.value=null;item.resolve(false);}clearTimeout(this.shareTimer);this.shareTimer=null;}
-  shareActive(req,target){return !this.closed&&!this.invalid&&performance.now()<this.deadline&&this.page.url()===LETTER_SCREEN&&req.frame()===this.page.mainFrame()&&req.url()===target.url;}
-  reject(req,reason='unavailable',outerKind='non_read'){this.invalid=true;if(this.capabilities)this.clearShared();this.counts.blocked_other=Math.min(64,this.counts.blocked_other+1);this.recordDenial(req,reason,outerKind);return 'block';}
-  async replay(route,target){
-    const req=route.request();
-    try{
-      if(!this.shareActive(req,target))throw Error();
-      if(!await target.shared.done)throw Error();
-      const value=target.shared.value;
-      if(!value||!this.shareActive(req,target))throw Error();
-      // Detached validated JSON only: never repeat cookies or other response headers.
-      await route.fulfill({status:value.status,headers:{'content-type':value.contentType},body:value.bytes});
-    }catch{this.invalid=true;this.clearShared();await route.abort('blockedbyclient').catch(()=>{});}
-    finally{this.inFlight--;}
-  }
-  async forward(route){
-    const req=route.request(),target=this.requests.get(req),op=target?.op;
-    if(this.capabilities){
-      if(!target||target.started){this.reject(req);await route.abort('blockedbyclient').catch(()=>{});return;}
-      target.started=true;if(target.follower)return this.replay(route,target);
-    }
-    let response,phase='preflight',reason=null;const diagnostic=this.readStates[op];if(diagnostic)diagnostic.state='in_flight';if(!this.capabilities)this.inFlight++;
-    try{
-      const remaining=Math.floor(this.deadline-performance.now());
-      if(!op||this.closed||remaining<=0||this.capabilities&&!this.shareActive(req,target)){reason=!op?'unaccepted':this.closed?'closed':'deadline';throw Error();}
-      if(op==='list_cms_connections')this.required='pending';
-      // route.continue may follow redirects outside subsequent route handlers.
-      // Fetch exactly once with redirects/retries disabled, then fulfill only a valid response.
-      phase='fetch';response=await route.fetch({maxRedirects:0,maxRetries:0,timeout:remaining});
-      phase='protocol';const headers=response.headers(),status=response.status();
-      const checks={url_exact:response.url()===target.url,status_ok:status>=200&&status<300,content_type_json:JSON_TYPE.test(headers['content-type']||''),declared_size_ok:headers['content-length']===undefined||/^[0-9]+$/.test(headers['content-length'])&&Number(headers['content-length'])<=65536};
-      if(diagnostic)Object.assign(diagnostic.checks,checks);
-      if(op==='list_cms_connections')Object.assign(this.requiredChecks,checks);
-      if(this.closed||performance.now()>=this.deadline||!Object.values(checks).every(Boolean)){reason=this.closed?'closed':performance.now()>=this.deadline?'deadline':!checks.url_exact?'response_url':!checks.status_ok?'http_status':!checks.content_type_json?'content_type':'declared_size';throw Error();}
-      phase='body';const bytes=await response.body();
-      if(diagnostic)diagnostic.checks.body_size_ok=bytes.length<=65536;
-      if(op==='list_cms_connections')this.requiredChecks.body_size_ok=bytes.length<=65536;
-      if(bytes.length>65536){reason='body_size';throw Error();}
-      if(op==='list_cms_connections')this.requiredChecks.json_valid=false;
-      phase='json';if(diagnostic)diagnostic.checks.json_valid=false;const value=JSON.parse(bytes.toString('utf8'));if(diagnostic)diagnostic.checks.json_valid=true;
-      if(op==='list_cms_connections')Object.assign(this.requiredChecks,{json_valid:true,schema_valid:this.capabilities?validCapabilityConnections(value):validConnections(value),schema_shape:this.capabilities?{bounded_rows:Array.isArray(value?.connections)&&value.connections.length>=1&&value.connections.length<=32}:connectionShape(value)});
-      phase='schema';const valid=op==='list_cms_connections'?(this.capabilities?validCapabilityConnections(value):validConnections(value)):object(value)||Array.isArray(value);
-      if(diagnostic)diagnostic.checks.schema_valid=valid;
-      if(!valid){reason='schema';throw Error();}
-      if(this.closed||performance.now()>=this.deadline||this.capabilities&&!this.shareActive(req,target)){reason=this.closed?'closed':performance.now()>=this.deadline?'deadline':'attempt_invalid';throw Error();}
-      phase='fulfill';await route.fulfill({response,body:bytes});if(diagnostic)diagnostic.state='verified';
-      if(op==='list_cms_connections'&&!this.closed)this.required='verified';
-      if(this.capabilities){
-        if(!this.shareActive(req,target)){reason='attempt_invalid';throw Error();}
-        target.shared.value={status,contentType:headers['content-type'],bytes:Buffer.from(bytes)};
-        target.shared.resolve(true);
-      }
-    }catch{
-      if(diagnostic){diagnostic.state='failed';diagnostic.phase=phase;diagnostic.reason=reason||({preflight:'preflight_failed',fetch:'fetch_failed',protocol:'protocol_failed',body:'body_read_failed',json:'invalid_json',schema:'schema_failed',fulfill:'fulfill_failed'})[phase];}
-      this.invalid=true;if(this.capabilities)this.clearShared();if(op==='list_cms_connections')this.required='invalid';
-      await route.abort('blockedbyclient').catch(()=>{});
-    }finally{await response?.dispose().catch(()=>{});this.inFlight--;}
-  }
-  /** Finite wait within capture's original 60s deadline; never reissues a read. */
-  async ready(signal){
-    while(!this.closed&&!this.invalid&&!signal?.aborted&&(this.inFlight>0||['missing','pending'].includes(this.required))&&performance.now()<this.deadline)await new Promise(r=>setTimeout(r,Math.min(25,Math.max(0,this.deadline-performance.now()))));
-    const ready=!this.closed&&!this.invalid&&!signal?.aborted&&performance.now()<this.deadline&&this.inFlight===0&&this.required==='verified';
-    this.readiness={state:ready?'ready':this.closed?'closed':signal?.aborted?'cancelled':this.invalid?'invalid':'capture_deadline',in_flight:Math.min(this.capabilities?9:3,Math.max(0,this.inFlight))};return ready;
-  }
-  report(){return structuredClone({version:1,adapter:this.capabilities?LETTER_CAPABILITIES_ADAPTER:LETTER_ADAPTER,required_read:this.required==='verified'?'verified':this.required==='invalid'?'invalid':'missing',...this.counts,...(this.capabilities?{coalesced_reads:this.coalesced}:{}),required_response_checks:this.requiredChecks,reads:this.readStates,readiness:this.readiness,invalid:this.invalid,in_flight:Math.min(this.capabilities?9:3,Math.max(0,this.inFlight)),...(this.denials.samples.length||this.denials.omitted?{blocked_requests:this.denials}:{})});}
-  close(){this.closed=true;if(this.capabilities)this.clearShared();}
-}

package/src/product-monitor-login.test.mjs

@@ -1,140 +0,0 @@
-/** Offline DOM/fake-browser controls: no provider, browser or API calls. */
-import {test} from 'node:test';
-import assert from 'node:assert/strict';
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import vm from 'node:vm';
-import {PassThrough} from 'node:stream';
-import {loginPrompt,loginScreenReady,waitForLogin,monitorRunner} from './product-monitors.mjs';
-
-const fixture=JSON.parse(await fs.readFile(new URL('./fixtures/product-monitor-contract.json',import.meta.url),'utf8'));
-const screen=fixture.monitor.pages[0];
-const pendingPrompt=(_message,{signal})=>new Promise((_,reject)=>signal.addEventListener('abort',()=>reject(signal.reason),{once:true}));
-test('real readline fallback accepts Enter or aborts and removes stream listeners',async()=>{
-  for(const cancel of [false,true]){
-    const input=new PassThrough(),output=new PassThrough(),controller=new AbortController();input.isTTY=true;
-    const before=input.eventNames().map(n=>[n,input.listenerCount(n)]);
-    const wait=loginPrompt('Sign in in the browser. ',{signal:controller.signal,input,output});
-    if(cancel){controller.abort();await assert.rejects(wait,{code:'cancelled'});}else{input.write('\n');await wait;}
-    assert.deepEqual(input.eventNames().map(n=>[n,input.listenerCount(n)]),before);input.destroy();output.destroy();
-  }
-});
-test('real terminal readline Ctrl+C reports cancellation and restores raw mode without process SIGINT',{timeout:1000},async()=>{
-  const input=new PassThrough(),output=new PassThrough(),rawModes=[];input.isTTY=true;output.isTTY=true;output.columns=80;input.setRawMode=value=>rawModes.push(value);
-  let processSignals=0,decoderListeners;const observed=()=>{processSignals++;};process.on('SIGINT',observed);
-  try{
-    for(let attempt=0;attempt<2;attempt++){
-      const wait=loginPrompt('Sign in in the browser. ',{input,output});input.write('\u0003');await assert.rejects(wait,{code:'cancelled'});
-      assert.equal(input.listenerCount('keypress'),0);assert.equal(input.isPaused(),true);
-      // Node retains its shared keypress decoder on the stream, not a question listener.
-      if(attempt===0)decoderListeners=input.listenerCount('data');else assert.equal(input.listenerCount('data'),decoderListeners);
-    }
-    assert.equal(processSignals,0);assert.deepEqual(rawModes,[true,false,true,false]);
-  }finally{process.off('SIGINT',observed);input.destroy();output.destroy();}
-});
-function domReady(change=()=>{}){
-  const node=(text='')=>({innerText:text,style:{display:'block',visibility:'visible',opacity:'1'},getBoundingClientRect:()=>({width:100,height:30})});
-  const rows=new Map([[screen.ready_selector,[node()]],[screen.account_marker.selector,[node('Example account')]]]);
-  const context={location:{href:screen.url},document:{querySelectorAll:s=>rows.get(s)||[]},getComputedStyle:n=>n.style,argument:{screen,expected:'Example account'}};
-  change(context,rows,node);
-  return vm.runInNewContext('('+loginScreenReady.toString()+')(argument)',context);
-}
-test('automatic hint requires exact URL, unique visible readiness/scope and matching required account',()=>{
-  assert.equal(domReady(),true);
-  for(const change of [
-    c=>{c.location.href=screen.url.replace('#overview','#other');},
-    c=>{c.location.href='https://login.example/';},
-    c=>{c.argument={screen:{...screen,account_marker:null},expected:'Example account'};},
-    c=>{c.argument.expected='Wrong account';},
-    (_c,r,n)=>r.set(screen.login_selector,[n()]),
-    (_c,r)=>r.set(screen.ready_selector,[]),
-    (_c,r,n)=>r.set(screen.ready_selector,[n(),n()]),
-    (c,r)=>{c.argument.screen={...screen,scope_selector:'.missing'};r.delete('.missing');},
-    (_c,r)=>r.get(screen.account_marker.selector)[0].style.visibility='hidden',
-    (_c,r)=>r.get(screen.account_marker.selector)[0].style.opacity='0',
-    (_c,r,n)=>r.set(screen.account_marker.selector,[n('Example account'),n('Example account')]),
-    (_c,r)=>r.get(screen.account_marker.selector)[0].getBoundingClientRect=()=>({width:0,height:0}),
-  ])assert.equal(domReady(change),false);
-});
-test('automatic hint cancels the pending manual prompt and returns no page content',async()=>{
-  const external=new AbortController();let promptSignal,evaluations=0;
-  const page={url:()=>screen.url,isClosed:()=>false,evaluate:async(fn,args)=>{evaluations++;assert.equal(fn,loginScreenReady);assert.deepEqual(args,{screen,expected:'Example account'});return true;}};
-  const result=await waitForLogin(page,screen,{[screen.id]:'Example account'},external.signal,(message,options)=>{assert.match(message,/continue when ready/);promptSignal=options.signal;return pendingPrompt(message,options);});
-  assert.equal(result,undefined);assert.equal(evaluations,1);assert.equal(promptSignal.aborted,true);assert.equal(external.signal.aborted,false);
-});
-test('marker-free screen requires deliberate Enter fallback without a DOM read',async()=>{
-  let entered=0;const page={url:()=>screen.url,isClosed:()=>false,evaluate:async()=>assert.fail('no automatic marker-free completion')};
-  await waitForLogin(page,{...screen,account_marker:null},{},new AbortController().signal,async()=>{entered++;});assert.equal(entered,1);
-});
-test('transient auth navigation is polled without navigating or collecting content',async()=>{
-  let ready=false,reads=0;const page={url:()=>ready?screen.url:'https://login.example/',isClosed:()=>false,evaluate:async()=>{reads++;return true;}};
-  await waitForLogin(page,screen,{[screen.id]:'Example account'},new AbortController().signal,(message,options)=>{ready=true;return pendingPrompt(message,options);});assert.equal(reads,1);
-});
-
-async function local(fn){
-  const directory=await fs.mkdtemp(path.join(os.tmpdir(),'product-login-')),prior=process.env.OPENCRAWL_CONFIG_DIR;process.env.OPENCRAWL_CONFIG_DIR=directory;
-  const m=structuredClone(fixture.monitor);m.pages[0].latest_snapshot=null;
-  const markers=path.join(directory,'markers.json');await fs.writeFile(markers,JSON.stringify({[screen.id]:'Example account'}));
-  const events=[],client={baseUrl:'https://opencrawl.example',request:async(route,options={})=>{events.push([route,options.method||'GET']);return route==='/api/auth/me'?{user:{id:'usr_'+'1'.repeat(32)},workspace:{id:'ws_'+'2'.repeat(32)}}:m;}};
-  const file=path.join(directory,'product-monitor-profiles/test/binding.json');
-  const run=(browser,overrides={})=>monitorRunner('login',m,client,{profile:'test',markers},{playwright:browser.pw,waitForLogin:pendingPrompt,...overrides});
-  const locksGone=async()=>{const entries=await fs.readdir(directory,{recursive:true});assert.equal(entries.some(x=>path.basename(x)==='lock'),false);assert.equal(events.some(x=>x[1]!=='GET'),false);};
-  const listeners=['SIGINT','SIGTERM'].map(s=>process.listenerCount(s));
-  try{await fn({directory,m,client,events,file,run,locksGone});}
-  finally{assert.deepEqual(['SIGINT','SIGTERM'].map(s=>process.listenerCount(s)),listeners);if(prior===undefined)delete process.env.OPENCRAWL_CONFIG_DIR;else process.env.OPENCRAWL_CONFIG_DIR=prior;await fs.rm(directory,{recursive:true,force:true});}
-}
-function browser({auto=true,headlessError,onScreenshot,onLaunch,onGoto,closed=false}={}){
-  const contexts=[],evaluations=[],navigations=[];const png=Buffer.from(fixture.capture_request.screenshot_png_base64,'base64');
-  const pw={chromium:{launchPersistentContext:async(_directory,options)=>{
-    assert.ok(options.timeout>0&&options.timeout<=30000);await onLaunch?.(options);
-    const context={headless:options.headless,closes:0,route:async()=>{},routeWebSocket:async()=>{},pages:()=>[],close:async()=>{context.closes++;},newPage:async()=>{
-      let url='about:blank';return {on(){},close:async()=>{},isClosed:()=>closed,route:async()=>{},routeWebSocket:async()=>{},mainFrame:()=>({}),url:()=>url,
-        goto:async value=>{url=value;navigations.push({value,headless:options.headless});await onGoto?.(options);return {status:()=>200};},locator:()=>({waitFor:async()=>{}}),
-        evaluate:async(fn,args)=>{evaluations.push(fn.name);if(fn===loginScreenReady)return auto;if(args)return headlessError?{error:headlessError}:{text:'Observed workflow',title:'Overview',marker:'Example account'};if(String(fn).includes('__opencrawlChanged'))return false;},
-        screenshot:async()=>{onScreenshot?.();return png;}};
-    }};contexts.push(context);return context;
-  }}};return {pw,contexts,evaluations,navigations};
-}
-test('automatic completion still verifies every configured screen, then saves once with no upload',()=>local(async x=>{
-  x.m.pages.push({...x.m.pages[0],id:'ppg_'+'3'.repeat(32),account_marker:null,url:'https://product.example/second'});
-  const b=browser();assert.equal((await x.run(b)).state,'session_saved_locally');assert.deepEqual(b.contexts.map(c=>[c.headless,c.closes]),[[false,1],[true,1]]);
-  assert.deepEqual(b.navigations.map(x=>x.value),[screen.url,screen.url,'https://product.example/second']);assert.equal(b.evaluations.filter(x=>x==='extractScreen').length,2);
-  const saved=JSON.parse(await fs.readFile(x.file));assert.equal(saved.markers[screen.id],'Example account');await x.locksGone();
-}));
-test('an automatic hint never overrides headless account or masking failure',()=>local(async x=>{
-  for(const error of ['context_mismatch','mask_unresolved','request_blocked']){const b=browser({headlessError:error});await assert.rejects(x.run(b),new RegExp(error));assert.equal(b.contexts.length,2);assert.ok(b.contexts.every(c=>c.closes===1));await assert.rejects(fs.stat(x.file),{code:'ENOENT'});await x.locksGone();}
-}));
-test('authority change after headed readiness refuses before verification or binding',()=>local(async x=>{
-  const b=browser();const request=x.client.request;x.client.request=async(route,options)=>{const r=await request(route,options);return route==='/api/auth/me'&&b.evaluations.length?{...r,user:{id:'usr_'+'4'.repeat(32)}}:r;};
-  await assert.rejects(x.run(b),/identity_changed/);assert.equal(b.contexts.length,1);assert.equal(b.contexts[0].closes,1);await assert.rejects(fs.stat(x.file),{code:'ENOENT'});await x.locksGone();
-}));
-test('login timeout closes owned headed context, cancels prompt and releases both locks',()=>local(async x=>{
-  const b=browser({auto:false});let promptSignal;await assert.rejects(x.run(b,{loginTimeoutMs:20,waitForLogin:(message,options)=>{promptSignal=options.signal;return pendingPrompt(message,options);}}),/login_timeout/);
-  assert.equal(promptSignal.aborted,true);assert.equal(b.contexts.length,1);assert.equal(b.contexts[0].closes,1);await assert.rejects(fs.stat(x.file),{code:'ENOENT'});await x.locksGone();
-}));
-test('external cancellation and SIGTERM stop login without a headless attempt or saved binding',()=>local(async x=>{
-  for(const mode of ['external','SIGTERM']){const signal=new AbortController(),b=browser({auto:false});await assert.rejects(x.run(b,{signal:signal.signal,waitForLogin:(message,options)=>{queueMicrotask(()=>mode==='external'?signal.abort():process.emit('SIGTERM'));return pendingPrompt(message,options);}}),/cancelled/);assert.equal(b.contexts.length,1);assert.equal(b.contexts[0].closes,1);await assert.rejects(fs.stat(x.file),{code:'ENOENT'});await x.locksGone();}
-}));
-test('closed login window stops instead of leaving an indefinite manual prompt',()=>local(async x=>{
-  const b=browser({closed:true});await assert.rejects(x.run(b),/login_window_closed/);assert.equal(b.contexts[0].closes,1);await x.locksGone();
-}));
-test('deadline reached during launch closes the returned context without navigating',()=>local(async x=>{
-  const b=browser({onLaunch:()=>new Promise(r=>setTimeout(r,20))});await assert.rejects(x.run(b,{loginTimeoutMs:5}),/login_timeout/);assert.equal(b.contexts[0].closes,1);assert.deepEqual(b.navigations,[]);await x.locksGone();
-}));
-test('cancellation during verification preserves an earlier valid binding',()=>local(async x=>{
-  await x.run(browser());const prior=await fs.readFile(x.file);const signal=new AbortController(),b=browser({onScreenshot:()=>signal.abort()});
-  await assert.rejects(x.run(b,{signal:signal.signal}),/cancelled/);assert.deepEqual(await fs.readFile(x.file),prior);assert.ok(b.contexts.every(c=>c.closes===1));await x.locksGone();
-}));
-test('cancellation during binding fsync refuses the commit and removes only the new temporary file',()=>local(async x=>{
-  await x.run(browser());const prior=await fs.readFile(x.file),signal=new AbortController(),open=fs.open;
-  fs.open=async(...args)=>{const h=await open(...args);if(String(args[0]).startsWith(x.file+'.')){const sync=h.sync.bind(h);h.sync=async()=>{await sync();signal.abort();};}return h;};
-  try{await assert.rejects(x.run(browser(),{signal:signal.signal}),/cancelled/);}finally{fs.open=open;}
-  assert.deepEqual(await fs.readFile(x.file),prior);assert.deepEqual((await fs.readdir(path.dirname(x.file))).filter(x=>x.endsWith('.tmp')),[]);await x.locksGone();
-}));
-
-
-test('v3 automatic hint uses the fixed opener before the picker exists and still requires the marker',()=>{
- const ready=change=>domReady((c,r,n)=>{c.argument.capabilities=true;c.argument.screen={...screen,ready_selector:'[data-testid="connect-integration-open"]',scope_selector:'[data-testid="connect-integration"]'};r.set(c.argument.screen.ready_selector,[n()]);change?.(c,r,n);});
- assert.equal(ready(),true);assert.equal(ready(c=>{c.argument.expected='wrong';}),false);assert.equal(ready((c,r)=>r.delete(c.argument.screen.ready_selector)),false);
-});