@harness-fe/runtime 3.0.1 → 3.1.0

package/src/commandsNetwork.e2e.test.ts

@@ -0,0 +1,146 @@
+// @vitest-environment happy-dom
+/**
+ * End-to-end tests for the runtime-side command handlers added by the new
+ * tooling: `network.wait_for`, `network.wait_for_idle`, `network.get`, and
+ * `ws.get`. These were previously untested at the handler level — the unit
+ * test suite covered tail()-shaped commands but not the async ones.
+ *
+ * We exercise the handler directly with a real CaptureStore, pushing entries
+ * on a real timer the same way the patched fetch / WebSocket would.
+ */
+
+import { describe, expect, it } from 'vitest';
+import { COMMAND, type NetworkEntry, type WsEntry } from '@harness-fe/protocol';
+import { commandHandlers } from './commands.js';
+import { CaptureStore } from './capture.js';
+
+function makeCapture(): CaptureStore {
+    // We don't install patches — we drive the RingBuffer directly so the
+    // tests don't fight happy-dom's fetch.
+    return new CaptureStore();
+}
+
+describe('NETWORK_WAIT_FOR', () => {
+    it('resolves when a matching request arrives after the call', async () => {
+        const cap = makeCapture();
+        const promise = commandHandlers[COMMAND.NETWORK_WAIT_FOR](
+            { urlContains: '/logout', timeoutMs: 2000 },
+            { capture: cap },
+        );
+        setTimeout(() => {
+            cap.network.push({ ts: Date.now(), id: 'r1', phase: 'req', method: 'POST', url: 'https://api.test/logout' } satisfies NetworkEntry);
+        }, 100);
+        const result = (await promise) as { ok: boolean; entry: NetworkEntry };
+        expect(result.ok).toBe(true);
+        expect(result.entry.url).toContain('/logout');
+    });
+
+    it('rejects on timeout when no match arrives', async () => {
+        const cap = makeCapture();
+        const promise = commandHandlers[COMMAND.NETWORK_WAIT_FOR](
+            { urlContains: '/never', timeoutMs: 200 },
+            { capture: cap },
+        );
+        cap.network.push({ ts: Date.now(), id: 'x', phase: 'req', method: 'GET', url: 'https://api.test/users' });
+        await expect(promise).rejects.toThrow(/no matching request/);
+    });
+
+    it('matches by method + statusCode and ignores pre-baseline matches', async () => {
+        const cap = makeCapture();
+        // Pre-existing entry — should NOT satisfy the wait (baseline anchored on call).
+        cap.network.push({ ts: Date.now() - 1000, id: 'old', phase: 'res', method: 'POST', url: '/x', status: 401 });
+        const promise = commandHandlers[COMMAND.NETWORK_WAIT_FOR](
+            { method: 'POST', statusCode: 401, timeoutMs: 2000 },
+            { capture: cap },
+        );
+        setTimeout(() => {
+            cap.network.push({ ts: Date.now(), id: 'new', phase: 'res', method: 'POST', url: '/y', status: 401 });
+        }, 80);
+        const out = (await promise) as { entry: NetworkEntry };
+        expect(out.entry.id).toBe('new');
+    });
+
+    it('matches by urlRegex (case-insensitive)', async () => {
+        const cap = makeCapture();
+        const promise = commandHandlers[COMMAND.NETWORK_WAIT_FOR](
+            { urlRegex: 'api\\.test/(login|logout)', timeoutMs: 2000 },
+            { capture: cap },
+        );
+        setTimeout(() => {
+            cap.network.push({ ts: Date.now(), id: 'x', phase: 'req', method: 'POST', url: 'https://API.test/logout' });
+        }, 60);
+        const out = (await promise) as { entry: NetworkEntry };
+        expect(out.entry.url).toContain('logout');
+    });
+});
+
+describe('NETWORK_WAIT_FOR_IDLE', () => {
+    it('resolves once no new entries arrive for idleMs', async () => {
+        const cap = makeCapture();
+        cap.network.push({ ts: Date.now(), id: 'a', phase: 'req', method: 'GET', url: '/a' });
+        const promise = commandHandlers[COMMAND.NETWORK_WAIT_FOR_IDLE](
+            { idleMs: 150, timeoutMs: 2000 },
+            { capture: cap },
+        );
+        setTimeout(() => cap.network.push({ ts: Date.now(), id: 'b', phase: 'req', method: 'GET', url: '/b' }), 50);
+        const out = (await promise) as { ok: boolean; idleFor: number };
+        expect(out.ok).toBe(true);
+        expect(out.idleFor).toBeGreaterThanOrEqual(150);
+    });
+
+    it('rejects when the network never quiets within timeoutMs', async () => {
+        const cap = makeCapture();
+        const promise = commandHandlers[COMMAND.NETWORK_WAIT_FOR_IDLE](
+            { idleMs: 200, timeoutMs: 300 },
+            { capture: cap },
+        );
+        const handle = setInterval(() => {
+            cap.network.push({ ts: Date.now(), id: `n-${Math.random()}`, phase: 'req', method: 'GET', url: '/spam' });
+        }, 50);
+        await expect(promise).rejects.toThrow(/never quiet/);
+        clearInterval(handle);
+    });
+});
+
+describe('NETWORK_GET', () => {
+    it('returns req + res entries for the given reqId', async () => {
+        const cap = makeCapture();
+        cap.network.push({ ts: 1, id: 'r1', phase: 'req', method: 'GET', url: '/x', requestBody: { q: 1 } });
+        cap.network.push({ ts: 2, id: 'r1', phase: 'res', method: 'GET', url: '/x', status: 200, responseBody: { ok: true } });
+        cap.network.push({ ts: 3, id: 'r2', phase: 'req', method: 'GET', url: '/y' });
+
+        const out = await commandHandlers[COMMAND.NETWORK_GET]({ reqId: 'r1' }, { capture: cap }) as { entries: NetworkEntry[]; found: boolean };
+        expect(out.found).toBe(true);
+        expect(out.entries).toHaveLength(2);
+        expect(out.entries.map((e) => e.phase)).toEqual(['req', 'res']);
+        // Bodies survive untouched.
+        expect((out.entries[0] as NetworkEntry).requestBody).toEqual({ q: 1 });
+        expect((out.entries[1] as NetworkEntry).responseBody).toEqual({ ok: true });
+    });
+
+    it('returns found=false when id is unknown', async () => {
+        const cap = makeCapture();
+        cap.network.push({ ts: 1, id: 'r1', phase: 'req', method: 'GET', url: '/x' });
+        const out = await commandHandlers[COMMAND.NETWORK_GET]({ reqId: 'nope' }, { capture: cap }) as { entries: NetworkEntry[]; found: boolean };
+        expect(out.found).toBe(false);
+        expect(out.entries).toHaveLength(0);
+    });
+});
+
+describe('WS_GET', () => {
+    it('returns all phases (open/send/recv/close) for a single ws id', async () => {
+        const cap = makeCapture();
+        const id = 'w1';
+        cap.ws.push({ ts: 1, id, phase: 'open', url: 'wss://x/' });
+        cap.ws.push({ ts: 2, id, phase: 'send', url: 'wss://x/', payload: { ping: 1 } });
+        cap.ws.push({ ts: 3, id, phase: 'recv', url: 'wss://x/', payload: { pong: 1 } });
+        cap.ws.push({ ts: 4, id, phase: 'close', url: 'wss://x/', code: 1000, wasClean: true });
+        cap.ws.push({ ts: 5, id: 'w-other', phase: 'open', url: 'wss://y/' });
+
+        const out = await commandHandlers[COMMAND.WS_GET]({ wsId: id }, { capture: cap }) as { entries: WsEntry[]; found: boolean };
+        expect(out.found).toBe(true);
+        expect(out.entries).toHaveLength(4);
+        expect(out.entries.map((e) => e.phase)).toEqual(['open', 'send', 'recv', 'close']);
+        expect(out.entries.every((e) => e.id === id)).toBe(true);
+    });
+});

package/src/fetchPatch.test.ts

@@ -101,6 +101,20 @@ describe('installFetchPatch — emission', () => {
         expect(res.responseBody).toEqual({ ok: true });
     });
 
+    it('stamps initiator.stack on req entries', async () => {
+        setMockFetch(() => Promise.resolve(jsonResponse({ ok: true })));
+        dispose = installFetchPatch({ onEntry: (e) => entries.push(e) });
+        await window.fetch('http://x/');
+        await new Promise((r) => setTimeout(r, 10));
+        const req = entries.find((e) => e.phase === 'req')!;
+        expect(req.initiator).toBeDefined();
+        // Stack should be a non-empty string when V8 produced one.
+        if (req.initiator?.stack !== undefined) {
+            expect(typeof req.initiator.stack).toBe('string');
+            expect(req.initiator.stack.length).toBeGreaterThan(0);
+        }
+    });
+
     it('captures and caps a large JSON response body', async () => {
         const huge = 'x'.repeat(2000);
         setMockFetch(() => Promise.resolve(jsonResponse({ s: huge })));

package/src/fetchPatch.ts

@@ -24,6 +24,7 @@
  */
 
 import type { NetworkEntry } from '@harness-fe/protocol';
+import { captureInitiator } from './initiator.js';
 
 const DEFAULT_BODY_CAP = 256 * 1024;
 const INTERNAL_FLAG = '__hfeInternal';
@@ -76,6 +77,7 @@ export function installFetchPatch(opts: FetchPatchOptions): () => void {
         const id = generateId();
         const startedAt = performance.now();
         const startedTs = Date.now();
+        const initiator = captureInitiator();
 
         // Emit request record eagerly (req body is read async — second emit
         // updates the record once body is serialized; consumers join by id).
@@ -86,6 +88,7 @@ export function installFetchPatch(opts: FetchPatchOptions): () => void {
             method: meta.method,
             url: meta.url,
             requestHeaders: meta.headers,
+            initiator,
         };
         emit(reqRecord);
         cloneRequestBody(input, init, bodyCap).then(

package/src/initiator.ts

@@ -0,0 +1,40 @@
+/**
+ * Initiator stack capture — answers "who issued this network/storage call?".
+ *
+ * Called synchronously from inside a patched API (fetch / xhr / ws / storage).
+ * `new Error().stack` walks the JS call stack from the V8 perspective:
+ *   - frame 0: this helper
+ *   - frame 1: the patched wrapper
+ *   - frame 2+: caller code
+ *
+ * We trim the first 2 frames so the returned `stack` starts at the business
+ * code that triggered the call. Best-effort: shapes vary across engines, so
+ * if the format is unexpected we return the raw stack.
+ *
+ * Cost: ~0.2–0.5 ms per call on a modern V8. Safe to leave on in development;
+ * gated behind NODE_ENV elsewhere so production is unaffected.
+ */
+
+const FRAMES_TO_TRIM = 2;
+
+export interface Initiator {
+    stack?: string;
+}
+
+export function captureInitiator(): Initiator {
+    const err = new Error();
+    const raw = err.stack;
+    if (!raw) return {};
+
+    const lines = raw.split('\n');
+    if (lines.length <= FRAMES_TO_TRIM + 1) return { stack: raw };
+
+    // Preserve the "Error" header line + caller frames. Drop the frames
+    // representing the helper and the patched wrapper.
+    const header = lines[0].startsWith('Error') ? lines[0] : '';
+    const callerFrames = lines.slice(FRAMES_TO_TRIM + 1);
+    const trimmed = header
+        ? [header, ...callerFrames].join('\n')
+        : callerFrames.join('\n');
+    return { stack: trimmed };
+}

package/src/runtimeClient.e2e.test.ts

@@ -0,0 +1,246 @@
+// @vitest-environment happy-dom
+/**
+ * End-to-end test for the complete runtime-client → bridge → store path on
+ * the capabilities added in this sweep:
+ *
+ *   user code triggers `new WebSocket(...)` / `localStorage.setItem(...)`
+ *     → patched runtime captures + emits via outbox
+ *     → real Bridge over a real WebSocket connection
+ *     → events land in JsonlStore with the right `t` field
+ *
+ * We use a real `RuntimeClient` instance (happy-dom is its environment) and
+ * a real Bridge bound to an ephemeral port on 127.0.0.1.
+ */
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+// rrweb has CommonJS interop issues under happy-dom + Vite ESM. We never need
+// the actual recorder in this test — it's purely background DOM capture — so
+// stub the module surface used by client.ts before any imports resolve it.
+vi.mock('rrweb', () => ({
+    record: () => () => {},
+    EventType: { Custom: 5 },
+}));
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Bridge } from '../../mcp-server/src/bridge.js';
+import { JsonlStore } from '../../mcp-server/src/store/index.js';
+import { RuntimeClient } from './client.js';
+import { getCaptureStore } from './capture.js';
+import type { StoreEvent } from '../../mcp-server/src/store/index.js';
+import type { NetworkEntry, StorageEntry, WsEntry } from '@harness-fe/protocol';
+
+interface Env {
+    bridge: Bridge;
+    store: JsonlStore;
+    dir: string;
+    port: number;
+    client: RuntimeClient;
+    sessionId: string;
+}
+
+let env: Env | undefined;
+
+async function setup(): Promise<Env> {
+    const dir = mkdtempSync(join(tmpdir(), 'harness-rt-e2e-'));
+    const store = new JsonlStore(dir);
+    const bridge = new Bridge({ port: 0, host: '127.0.0.1', store, taskStore: null, autoPurge: { enabled: false } });
+    await bridge.start();
+    const port = bridge.getBoundPort();
+    if (!port) throw new Error('no port');
+
+    // happy-dom keeps singletons across tests — reset the patch state so this
+    // RuntimeClient's onEvent wiring takes hold.
+    getCaptureStore().dispose();
+
+    const client = new RuntimeClient({
+        projectId: 'rt-e2e',
+        mcpUrl: `ws://127.0.0.1:${port}`,
+    });
+    client.start();
+
+    // Wait for hello.ack — bridge logs `peer connected` when the runtime is
+    // registered. We poll the store's session list until ours shows up.
+    const deadline = Date.now() + 2000;
+    while (Date.now() < deadline) {
+        const sessions = store.listSessions({ projectId: 'rt-e2e', limit: 5 });
+        if (sessions.length > 0 && client.getConnectionState() === 'open') {
+            break;
+        }
+        await new Promise((r) => setTimeout(r, 30));
+    }
+    if (client.getConnectionState() !== 'open') {
+        throw new Error('runtime-client never connected');
+    }
+
+    return { bridge, store, dir, port, client, sessionId: client.sessionId };
+}
+
+beforeEach(async () => {
+    env = await setup();
+});
+
+afterEach(async () => {
+    if (!env) return;
+    env.client.stop();
+    await env.bridge.stop();
+    env.store.close();
+    rmSync(env.dir, { recursive: true, force: true });
+    // Reset capture singleton so subsequent tests get a clean install.
+    const cap = getCaptureStore();
+    cap.dispose();
+    cap.console.clear();
+    cap.network.clear();
+    cap.errors.clear();
+    cap.ws.clear();
+    cap.storage.clear();
+    env = undefined;
+});
+
+/** Read events of a given type from the session timeline, polling for flush. */
+async function readTypedEvents(
+    store: JsonlStore,
+    sessionId: string,
+    type: string,
+    expectedMin: number,
+    timeoutMs = 1500,
+): Promise<StoreEvent[]> {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        await store.flush();
+        const rows = store.tail(sessionId, { n: 200, type });
+        if (rows.length >= expectedMin) return rows;
+        await new Promise((r) => setTimeout(r, 30));
+    }
+    await store.flush();
+    return store.tail(sessionId, { n: 200, type });
+}
+
+describe('RuntimeClient E2E — bridge connection sanity', () => {
+    it('connects, sends hello, opens a session in the store', () => {
+        const e = env!;
+        const sessions = e.store.listSessions({ projectId: 'rt-e2e', limit: 5 });
+        expect(sessions.length).toBeGreaterThanOrEqual(1);
+        expect(sessions.find((s) => s.id === e.sessionId)).toBeDefined();
+    });
+
+    it('daemon connection is denylisted from ws capture (no self-loop)', async () => {
+        const e = env!;
+        // No user code touched WebSocket yet, but the runtime opened its own
+        // ws to the daemon. If the patch were intercepting, the buffer would
+        // already have a `phase:'open'` entry for that URL.
+        const cap = getCaptureStore();
+        const selfFrames = cap.ws.tail(50).filter((f) =>
+            f.url.startsWith(`ws://127.0.0.1:${e.port}`),
+        );
+        expect(selfFrames).toHaveLength(0);
+    });
+});
+
+describe('RuntimeClient E2E — patched WebSocket flows to bridge', () => {
+    it('user-issued ws frames land in the store as t=ws', async () => {
+        const e = env!;
+        // happy-dom's WebSocket attempts real network, which we don't want.
+        // Replace the global WebSocket BEFORE we trigger user code, then the
+        // patched constructor wraps our fake instead.
+        const realWs = (window as unknown as { WebSocket: typeof WebSocket }).WebSocket;
+        class FakeWS extends EventTarget {
+            static readonly CONNECTING = 0;
+            static readonly OPEN = 1;
+            static readonly CLOSING = 2;
+            static readonly CLOSED = 3;
+            url: string;
+            readyState = 1;
+            constructor(url: string | URL) {
+                super();
+                this.url = typeof url === 'string' ? url : url.toString();
+            }
+            send(_data: unknown): void { /* swallow */ }
+            close(): void { this.readyState = 3; }
+        }
+        // Patched WebSocket caches the OriginalWS reference inside, but it
+        // was captured at install-time. We must point window.WebSocket to
+        // FakeWS BEFORE that — which means re-installing the patch. Easiest:
+        // tear down + re-install via a fresh dispose + capture install.
+        const cap = getCaptureStore();
+        cap.dispose();
+        (window as unknown as { WebSocket: typeof WebSocket }).WebSocket = FakeWS as unknown as typeof WebSocket;
+        cap.install(
+            (name, payload) => e.client.sendEvent(name, payload),
+            { daemonUrl: `ws://127.0.0.1:${e.port}` },
+        );
+
+        try {
+            const ws = new window.WebSocket('wss://chat.test/v1') as unknown as FakeWS;
+            ws.dispatchEvent(new MessageEvent('message', { data: JSON.stringify({ kind: 'kick' }) }));
+            ws.send(JSON.stringify({ kind: 'ack' }));
+            ws.dispatchEvent(new CloseEvent('close', { code: 4001, reason: 'kicked', wasClean: false }));
+
+            const rows = await readTypedEvents(e.store, e.sessionId, 'ws', 3);
+            const phases = rows.map((r) => (r.d as WsEntry).phase);
+            expect(phases).toContain('open');
+            expect(phases).toContain('recv');
+            expect(phases).toContain('send');
+            expect(phases).toContain('close');
+
+            const close = rows.find((r) => (r.d as WsEntry).phase === 'close')!;
+            expect((close.d as WsEntry).code).toBe(4001);
+            // visitorId stamped on row by bridge ingestion.
+            expect(close.visitorId).toBe(e.client.visitorId);
+        } finally {
+            (window as unknown as { WebSocket: typeof WebSocket }).WebSocket = realWs;
+        }
+    });
+});
+
+describe('RuntimeClient E2E — patched storage flows to bridge', () => {
+    it('localStorage.setItem / removeItem reaches the store as t=storage', async () => {
+        const e = env!;
+        localStorage.setItem('Tanka_tokenInfo', 'abc');
+        localStorage.removeItem('Tanka_tokenInfo');
+
+        const rows = await readTypedEvents(e.store, e.sessionId, 'storage', 2);
+        const ops = rows.map((r) => (r.d as StorageEntry).op);
+        expect(ops).toContain('set');
+        expect(ops).toContain('remove');
+        const removeRow = rows.find((r) => (r.d as StorageEntry).op === 'remove')!;
+        expect((removeRow.d as StorageEntry).key).toBe('Tanka_tokenInfo');
+        // initiator stack survives the round-trip.
+        expect((removeRow.d as StorageEntry).initiator?.stack).toBeDefined();
+    });
+});
+
+describe('RuntimeClient E2E — patched fetch initiator round-trip', () => {
+    it('fetch() carries an initiator.stack into the store', async () => {
+        const e = env!;
+        // Stub fetch with a minimal mock — happy-dom's fetch would try real
+        // network, which we don't want.
+        const origFetch = window.fetch;
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        (window as any).fetch = async () => new Response('{}', {
+            status: 200,
+            headers: { 'content-type': 'application/json' },
+        });
+        const cap = getCaptureStore();
+        // Re-install so fetch patch wraps the new stub.
+        cap.dispose();
+        cap.install(
+            (name, payload) => e.client.sendEvent(name, payload),
+            { daemonUrl: `ws://127.0.0.1:${e.port}` },
+        );
+
+        try {
+            await window.fetch('http://api.test/users');
+            await new Promise((r) => setTimeout(r, 20));
+
+            const rows = await readTypedEvents(e.store, e.sessionId, 'network', 1);
+            const req = rows.find((r) => (r.d as NetworkEntry).phase === 'req')!;
+            expect(req).toBeDefined();
+            expect((req.d as NetworkEntry).initiator?.stack).toBeDefined();
+        } finally {
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            (window as any).fetch = origFetch;
+        }
+    });
+});

package/src/storagePatch.test.ts

@@ -0,0 +1,137 @@
+// @vitest-environment happy-dom
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { installStoragePatch } from './storagePatch.js';
+import type { StorageEntry } from '@harness-fe/protocol';
+
+let entries: StorageEntry[];
+let dispose: () => void;
+
+beforeEach(() => {
+    entries = [];
+    try {
+        window.localStorage.clear();
+        window.sessionStorage.clear();
+    } catch {
+        /* ignore */
+    }
+});
+
+afterEach(() => {
+    dispose?.();
+});
+
+describe('installStoragePatch', () => {
+    it('captures localStorage.setItem with initiator stack', () => {
+        dispose = installStoragePatch({ onEntry: (e) => entries.push(e) });
+        localStorage.setItem('token', 'abc123');
+        const entry = entries.find((e) => e.op === 'set' && e.which === 'local')!;
+        expect(entry).toBeDefined();
+        expect(entry.key).toBe('token');
+        expect(entry.value).toBe('abc123');
+        expect(entry.initiator).toBeDefined();
+        // setItem still actually wrote.
+        expect(localStorage.getItem('token')).toBe('abc123');
+    });
+
+    it('captures localStorage.removeItem', () => {
+        localStorage.setItem('token', 'x');
+        dispose = installStoragePatch({ onEntry: (e) => entries.push(e) });
+        localStorage.removeItem('token');
+        const entry = entries.find((e) => e.op === 'remove')!;
+        expect(entry).toBeDefined();
+        expect(entry.key).toBe('token');
+        expect(entry.which).toBe('local');
+        expect(localStorage.getItem('token')).toBeNull();
+    });
+
+    it('captures localStorage.clear', () => {
+        dispose = installStoragePatch({ onEntry: (e) => entries.push(e) });
+        localStorage.setItem('a', '1');
+        entries.length = 0;
+        localStorage.clear();
+        const entry = entries.find((e) => e.op === 'clear')!;
+        expect(entry).toBeDefined();
+        expect(entry.which).toBe('local');
+    });
+
+    it('disambiguates sessionStorage vs localStorage when they are distinct instances', () => {
+        // happy-dom's sessionStorage and localStorage may share an underlying
+        // instance, in which case the patch dispatches once with kind='local'.
+        // We only assert the disambiguation in environments where the two are
+        // genuinely distinct objects.
+        if (window.sessionStorage === window.localStorage) {
+            return;
+        }
+        dispose = installStoragePatch({ onEntry: (e) => entries.push(e) });
+        sessionStorage.setItem('s', '1');
+        localStorage.setItem('l', '1');
+        const session = entries.find((e) => e.which === 'session');
+        const local = entries.find((e) => e.which === 'local');
+        expect(session?.key).toBe('s');
+        expect(local?.key).toBe('l');
+    });
+
+    it('clips oversized values', () => {
+        dispose = installStoragePatch({ onEntry: (e) => entries.push(e), valueCap: 5 });
+        localStorage.setItem('big', 'x'.repeat(50));
+        const entry = entries.find((e) => e.key === 'big')!;
+        expect(entry.value?.startsWith('xxxxx')).toBe(true);
+        expect(entry.value?.includes('+45B')).toBe(true);
+    });
+
+    it('captures crossTab event without initiator', () => {
+        dispose = installStoragePatch({ onEntry: (e) => entries.push(e) });
+        // Simulate cross-tab event by dispatching a StorageEvent manually.
+        const ev = new StorageEvent('storage', {
+            key: 'token',
+            newValue: null,
+            oldValue: 'x',
+            storageArea: window.localStorage,
+        });
+        window.dispatchEvent(ev);
+        const entry = entries.find((e) => e.crossTab)!;
+        expect(entry).toBeDefined();
+        expect(entry.op).toBe('remove');
+        expect(entry.which).toBe('local');
+        expect(entry.initiator).toBeUndefined();
+    });
+
+    it('captures cookie set / remove via Max-Age=0 when document.cookie is descriptor-backed', () => {
+        // happy-dom may not expose document.cookie via Document.prototype with
+        // a property descriptor. We skip when the descriptor isn't writable
+        // since the patch path is provably unreachable in that environment.
+        const desc = Object.getOwnPropertyDescriptor(Document.prototype, 'cookie');
+        if (!desc?.set || !desc?.get) return;
+        dispose = installStoragePatch({ onEntry: (e) => entries.push(e) });
+        document.cookie = 'sid=abc; Path=/';
+        document.cookie = 'sid=; Max-Age=0; Path=/';
+        const sets = entries.filter((e) => e.which === 'cookie' && e.op === 'set');
+        const removes = entries.filter((e) => e.which === 'cookie' && e.op === 'remove');
+        expect(sets.length).toBeGreaterThanOrEqual(1);
+        expect(removes.length).toBeGreaterThanOrEqual(1);
+        expect(sets[0].key).toBe('sid');
+        expect(removes[0].key).toBe('sid');
+    });
+
+    it('parses cookie removal via past Expires', () => {
+        const desc = Object.getOwnPropertyDescriptor(Document.prototype, 'cookie');
+        if (!desc?.set || !desc?.get) return;
+        dispose = installStoragePatch({ onEntry: (e) => entries.push(e) });
+        document.cookie = 'sid=; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Path=/';
+        const removes = entries.filter((e) => e.which === 'cookie' && e.op === 'remove');
+        expect(removes.length).toBeGreaterThanOrEqual(1);
+    });
+
+    it('dispose stops capture and leaves storage operations working', () => {
+        dispose = installStoragePatch({ onEntry: (e) => entries.push(e) });
+        localStorage.setItem('foo', 'bar');
+        expect(entries.length).toBeGreaterThan(0);
+        const before = entries.length;
+        dispose();
+        // After dispose, further mutations should not push new entries.
+        localStorage.setItem('foo2', 'bar2');
+        expect(entries.length).toBe(before);
+        // But the write itself still happened.
+        expect(localStorage.getItem('foo2')).toBe('bar2');
+    });
+});