@jackwener/opencli 1.3.3 → 1.4.0

package/dist/pipeline/steps/download.test.js

@@ -0,0 +1,101 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import * as os from 'node:os';
+import * as path from 'node:path';
+const { mockHttpDownload, mockYtdlpDownload, mockExportCookiesToNetscape } = vi.hoisted(() => ({
+    mockHttpDownload: vi.fn(),
+    mockYtdlpDownload: vi.fn(),
+    mockExportCookiesToNetscape: vi.fn(),
+}));
+vi.mock('../../download/index.js', async () => {
+    const actual = await vi.importActual('../../download/index.js');
+    return {
+        ...actual,
+        httpDownload: mockHttpDownload,
+        ytdlpDownload: mockYtdlpDownload,
+        exportCookiesToNetscape: mockExportCookiesToNetscape,
+    };
+});
+import { stepDownload } from './download.js';
+function createMockPage(getCookies) {
+    return {
+        goto: vi.fn(),
+        evaluate: vi.fn().mockResolvedValue(null),
+        getCookies,
+        snapshot: vi.fn().mockResolvedValue(''),
+        click: vi.fn(),
+        typeText: vi.fn(),
+        pressKey: vi.fn(),
+        scrollTo: vi.fn(),
+        getFormState: vi.fn().mockResolvedValue({}),
+        wait: vi.fn(),
+        tabs: vi.fn().mockResolvedValue([]),
+        closeTab: vi.fn(),
+        newTab: vi.fn(),
+        selectTab: vi.fn(),
+        networkRequests: vi.fn().mockResolvedValue([]),
+        consoleMessages: vi.fn().mockResolvedValue([]),
+        scroll: vi.fn(),
+        autoScroll: vi.fn(),
+        installInterceptor: vi.fn(),
+        getInterceptedRequests: vi.fn().mockResolvedValue([]),
+        screenshot: vi.fn().mockResolvedValue(''),
+    };
+}
+describe('stepDownload', () => {
+    beforeEach(() => {
+        mockHttpDownload.mockReset();
+        mockHttpDownload.mockResolvedValue({ success: true, size: 2 });
+        mockYtdlpDownload.mockReset();
+        mockYtdlpDownload.mockResolvedValue({ success: true, size: 2 });
+        mockExportCookiesToNetscape.mockReset();
+    });
+    it('scopes browser cookies to each direct-download target domain', async () => {
+        const page = createMockPage(vi.fn().mockImplementation(async (opts) => {
+            const domain = opts?.domain ?? 'unknown';
+            return [{ name: 'sid', value: domain, domain }];
+        }));
+        await stepDownload(page, {
+            url: '${{ item.url }}',
+            dir: path.join(os.tmpdir(), 'opencli-download-test'),
+            filename: '${{ index }}.txt',
+            progress: false,
+            concurrency: 1,
+        }, [
+            { url: 'https://a.example/file-1.txt' },
+            { url: 'https://b.example/file-2.txt' },
+        ], {});
+        expect(mockHttpDownload).toHaveBeenNthCalledWith(1, 'https://a.example/file-1.txt', path.join(os.tmpdir(), 'opencli-download-test', '0.txt'), expect.objectContaining({ cookies: 'sid=a.example' }));
+        expect(mockHttpDownload).toHaveBeenNthCalledWith(2, 'https://b.example/file-2.txt', path.join(os.tmpdir(), 'opencli-download-test', '1.txt'), expect.objectContaining({ cookies: 'sid=b.example' }));
+    });
+    it('builds yt-dlp cookies from all target domains instead of only the first item', async () => {
+        const getCookies = vi.fn().mockImplementation(async (opts) => {
+            const domain = opts?.domain ?? 'unknown';
+            return [{
+                    name: `sid-${domain}`,
+                    value: domain,
+                    domain,
+                    path: '/',
+                    secure: false,
+                    httpOnly: false,
+                }];
+        });
+        const page = createMockPage(getCookies);
+        await stepDownload(page, {
+            url: '${{ item.url }}',
+            dir: '/tmp/opencli-download-test',
+            filename: '${{ index }}.mp4',
+            progress: false,
+            concurrency: 1,
+        }, [
+            { url: 'https://www.youtube.com/watch?v=one' },
+            { url: 'https://www.bilibili.com/video/BV1xx411c7mD' },
+        ], {});
+        expect(getCookies).toHaveBeenCalledWith({ domain: 'www.youtube.com' });
+        expect(getCookies).toHaveBeenCalledWith({ domain: 'www.bilibili.com' });
+        expect(mockExportCookiesToNetscape).toHaveBeenCalledWith(expect.arrayContaining([
+            expect.objectContaining({ name: 'sid-www.youtube.com', domain: 'www.youtube.com' }),
+            expect.objectContaining({ name: 'sid-www.bilibili.com', domain: 'www.bilibili.com' }),
+        ]), expect.any(String));
+        expect(mockYtdlpDownload).toHaveBeenCalledTimes(2);
+    });
+});

package/dist/pipeline/steps/fetch.js

@@ -1,24 +1,10 @@
 /**
  * Pipeline step: fetch — HTTP API requests.
  */
+import { CliError, getErrorMessage } from '../../errors.js';
+import { log } from '../../logger.js';
 import { render } from '../template.js';
-function isRecord(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-/** Simple async concurrency limiter */
-async function mapConcurrent(items, limit, fn) {
-    const results = new Array(items.length);
-    let index = 0;
-    async function worker() {
-        while (index < items.length) {
-            const i = index++;
-            results[i] = await fn(items[i], i);
-        }
-    }
-    const workers = Array.from({ length: Math.min(limit, items.length) }, () => worker());
-    await Promise.all(workers);
-    return results;
-}
+import { isRecord, mapConcurrent } from '../../utils.js';
 /** Single URL fetch helper */
 async function fetchSingle(page, url, method, queryParams, headers, args, data) {
     const renderedParams = {};
@@ -34,19 +20,32 @@ async function fetchSingle(page, url, method, queryParams, headers, args, data)
     }
     if (page === null) {
         const resp = await fetch(finalUrl, { method: method.toUpperCase(), headers: renderedHeaders });
+        if (!resp.ok) {
+            throw new CliError('FETCH_ERROR', `HTTP ${resp.status} ${resp.statusText} from ${finalUrl}`);
+        }
         return resp.json();
     }
     const headersJs = JSON.stringify(renderedHeaders);
     const urlJs = JSON.stringify(finalUrl);
     const methodJs = JSON.stringify(method.toUpperCase());
-    return page.evaluate(`
+    // Return error status instead of throwing inside evaluate to avoid CDP wrapper
+    // rewriting the message (CDP prepends "Evaluate error: " to thrown errors).
+    const result = await page.evaluate(`
     async () => {
       const resp = await fetch(${urlJs}, {
         method: ${methodJs}, headers: ${headersJs}, credentials: "include"
       });
+      if (!resp.ok) {
+        return { __httpError: resp.status, statusText: resp.statusText };
+      }
       return await resp.json();
     }
   `);
+    if (result && typeof result === 'object' && '__httpError' in result) {
+        const { __httpError: status, statusText } = result;
+        throw new CliError('FETCH_ERROR', `HTTP ${status} ${statusText} from ${finalUrl}`);
+    }
+    return result;
 }
 /**
  * Batch fetch: send all URLs into the browser as a single evaluate() call.
@@ -56,10 +55,11 @@ async function fetchSingle(page, url, method, queryParams, headers, args, data)
 async function fetchBatchInBrowser(page, urls, method, headers, concurrency) {
     const headersJs = JSON.stringify(headers);
     const urlsJs = JSON.stringify(urls);
+    const methodJs = JSON.stringify(method);
     return (await page.evaluate(`
     async () => {
       const urls = ${urlsJs};
-      const method = "${method}";
+      const method = ${methodJs};
       const headers = ${headersJs};
       const concurrency = ${concurrency};
 
@@ -71,9 +71,13 @@ async function fetchBatchInBrowser(page, urls, method, headers, concurrency) {
           const i = idx++;
           try {
             const resp = await fetch(urls[i], { method, headers, credentials: "include" });
+            if (!resp.ok) {
+              throw new Error('HTTP ' + resp.status + ' ' + resp.statusText + ' from ' + urls[i]);
+            }
             results[i] = await resp.json();
           } catch (e) {
-            results[i] = { error: e.message };
+            results[i] = { error: e instanceof Error ? e.message : String(e) };
+            // Note: getErrorMessage() is a Node.js utility — can't use it inside evaluate()
           }
         }
       }
@@ -111,12 +115,26 @@ export async function stepFetch(page, params, data, args) {
         });
         // BATCH IPC: if browser is available, batch all fetches into a single evaluate() call
         if (page !== null) {
-            return fetchBatchInBrowser(page, urls, method.toUpperCase(), renderedHeaders, concurrency);
+            const results = await fetchBatchInBrowser(page, urls, method.toUpperCase(), renderedHeaders, concurrency);
+            for (let i = 0; i < results.length; i++) {
+                const r = results[i];
+                if (r && typeof r === 'object' && 'error' in r) {
+                    log.warn(`Batch fetch failed for ${urls[i]}: ${r.error}`);
+                }
+            }
+            return results;
         }
         // Non-browser: use concurrent pool (already optimized)
         return mapConcurrent(data, concurrency, async (item, index) => {
             const itemUrl = String(render(urlTemplate, { args, data, item, index }));
-            return fetchSingle(null, itemUrl, method, queryParams, headers, args, data);
+            try {
+                return await fetchSingle(null, itemUrl, method, queryParams, headers, args, data);
+            }
+            catch (error) {
+                const message = getErrorMessage(error);
+                log.warn(`Batch fetch failed for ${itemUrl}: ${message}`);
+                return { error: message };
+            }
         });
     }
     const url = render(urlOrObj, { args, data });

package/dist/pipeline/steps/fetch.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/pipeline/steps/fetch.test.js

@@ -0,0 +1,123 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { CliError } from '../../errors.js';
+import { stepFetch } from './fetch.js';
+afterEach(() => {
+    vi.restoreAllMocks();
+    vi.unstubAllGlobals();
+});
+describe('stepFetch', () => {
+    // W1 + W4: non-browser single fetch throws CliError with FETCH_ERROR code and full message
+    it('throws CliError with FETCH_ERROR code on non-ok responses without a browser session', async () => {
+        const jsonMock = vi.fn().mockResolvedValue({ error: 'rate limited' });
+        const fetchMock = vi.fn().mockResolvedValue({
+            ok: false,
+            status: 429,
+            statusText: 'Too Many Requests',
+            json: jsonMock,
+        });
+        vi.stubGlobal('fetch', fetchMock);
+        const err = await stepFetch(null, { url: 'https://api.example.com/items' }, null, {}).catch((e) => e);
+        expect(err).toBeInstanceOf(CliError);
+        expect(err.code).toBe('FETCH_ERROR');
+        expect(err.message).toBe('HTTP 429 Too Many Requests from https://api.example.com/items');
+        expect(jsonMock).not.toHaveBeenCalled();
+    });
+    // W1 + W3: browser single fetch returns error status from evaluate, outer code throws CliError
+    it('throws CliError with FETCH_ERROR code on non-ok responses inside the browser session', async () => {
+        const jsonMock = vi.fn().mockResolvedValue({ error: 'auth required' });
+        const fetchMock = vi.fn().mockResolvedValue({
+            ok: false,
+            status: 401,
+            statusText: 'Unauthorized',
+            json: jsonMock,
+        });
+        vi.stubGlobal('fetch', fetchMock);
+        // Simulate real CDP behavior: evaluate returns a value, errors are thrown outside
+        const page = {
+            evaluate: vi.fn(async (js) => Function(`return (${js})`)()()),
+        };
+        const err = await stepFetch(page, { url: 'https://api.example.com/items' }, null, {}).catch((e) => e);
+        expect(err).toBeInstanceOf(CliError);
+        expect(err.code).toBe('FETCH_ERROR');
+        expect(err.message).toBe('HTTP 401 Unauthorized from https://api.example.com/items');
+        expect(jsonMock).not.toHaveBeenCalled();
+    });
+    it('returns per-item HTTP errors for batch fetches without a browser session', async () => {
+        const jsonMock = vi.fn().mockResolvedValue({ error: 'upstream unavailable' });
+        const fetchMock = vi.fn().mockResolvedValue({
+            ok: false,
+            status: 503,
+            statusText: 'Service Unavailable',
+            json: jsonMock,
+        });
+        vi.stubGlobal('fetch', fetchMock);
+        await expect(stepFetch(null, { url: 'https://api.example.com/items/${{ item.id }}' }, [{ id: 1 }], {})).resolves.toEqual([
+            { error: 'HTTP 503 Service Unavailable from https://api.example.com/items/1' },
+        ]);
+        expect(jsonMock).not.toHaveBeenCalled();
+    });
+    it('returns per-item HTTP errors for batch browser fetches', async () => {
+        const jsonMock = vi.fn().mockResolvedValue({ error: 'upstream unavailable' });
+        const fetchMock = vi.fn().mockResolvedValue({
+            ok: false,
+            status: 503,
+            statusText: 'Service Unavailable',
+            json: jsonMock,
+        });
+        vi.stubGlobal('fetch', fetchMock);
+        const page = {
+            evaluate: vi.fn(async (js) => Function(`return (${js})`)()()),
+        };
+        await expect(stepFetch(page, { url: 'https://api.example.com/items/${{ item.id }}' }, [{ id: 1 }], {})).resolves.toEqual([
+            { error: 'HTTP 503 Service Unavailable from https://api.example.com/items/1' },
+        ]);
+        expect(jsonMock).not.toHaveBeenCalled();
+    });
+    it('stringifies non-Error batch browser failures consistently', async () => {
+        vi.stubGlobal('fetch', vi.fn().mockRejectedValue('socket hang up'));
+        const page = {
+            evaluate: vi.fn(async (js) => Function(`return (${js})`)()()),
+        };
+        await expect(stepFetch(page, { url: 'https://api.example.com/items/${{ item.id }}' }, [{ id: 1 }], {})).resolves.toEqual([
+            { error: 'socket hang up' },
+        ]);
+    });
+    it('stringifies non-Error batch non-browser failures consistently', async () => {
+        vi.stubGlobal('fetch', vi.fn().mockRejectedValue('socket hang up'));
+        await expect(stepFetch(null, { url: 'https://api.example.com/items/${{ item.id }}' }, [{ id: 1 }], {})).resolves.toEqual([
+            { error: 'socket hang up' },
+        ]);
+    });
+    // W2: batch item failures emit a warning log
+    it('logs a warning for each failed batch item in non-browser mode', async () => {
+        const { log } = await import('../../logger.js');
+        const warnSpy = vi.spyOn(log, 'warn');
+        vi.stubGlobal('fetch', vi.fn().mockResolvedValue({
+            ok: false,
+            status: 503,
+            statusText: 'Service Unavailable',
+            json: vi.fn(),
+        }));
+        await stepFetch(null, { url: 'https://api.example.com/items/${{ item.id }}' }, [{ id: 1 }, { id: 2 }], {});
+        expect(warnSpy).toHaveBeenCalledTimes(2);
+        expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('https://api.example.com/items/1'));
+        expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('https://api.example.com/items/2'));
+    });
+    it('logs a warning for each failed batch item in browser mode', async () => {
+        const { log } = await import('../../logger.js');
+        const warnSpy = vi.spyOn(log, 'warn');
+        vi.stubGlobal('fetch', vi.fn().mockResolvedValue({
+            ok: false,
+            status: 502,
+            statusText: 'Bad Gateway',
+            json: vi.fn(),
+        }));
+        const page = {
+            evaluate: vi.fn(async (js) => Function(`return (${js})`)()()),
+        };
+        await stepFetch(page, { url: 'https://api.example.com/items/${{ item.id }}' }, [{ id: 1 }, { id: 2 }], {});
+        expect(warnSpy).toHaveBeenCalledTimes(2);
+        expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('https://api.example.com/items/1'));
+        expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('https://api.example.com/items/2'));
+    });
+});

package/dist/pipeline/steps/transform.js

@@ -2,9 +2,7 @@
  * Pipeline steps: data transforms — select, map, filter, sort, limit.
  */
 import { render, evalExpr } from '../template.js';
-function isRecord(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
+import { isRecord } from '../../utils.js';
 export async function stepSelect(_page, params, data, args) {
     const pathStr = String(render(params, { args, data }));
     if (data && typeof data === 'object') {
@@ -61,9 +59,7 @@ export async function stepSort(_page, params, data, _args) {
     return [...data].sort((a, b) => {
         const left = isRecord(a) ? a[key] : undefined;
         const right = isRecord(b) ? b[key] : undefined;
-        const va = left ?? '';
-        const vb = right ?? '';
-        const cmp = va < vb ? -1 : va > vb ? 1 : 0;
+        const cmp = String(left ?? '').localeCompare(String(right ?? ''), undefined, { numeric: true });
         return reverse ? -cmp : cmp;
     });
 }

package/dist/pipeline/template.js

@@ -1,9 +1,8 @@
 /**
  * Pipeline template engine: ${{ ... }} expression rendering.
  */
-function isRecord(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
+import vm from 'node:vm';
+import { isRecord } from '../utils.js';
 export function render(template, ctx) {
     if (typeof template !== 'string')
         return template;
@@ -29,46 +28,28 @@ export function evalExpr(expr, ctx) {
     const data = ctx.data;
     const index = ctx.index ?? 0;
     // ── Pipe filters: expr | filter1(arg) | filter2 ──
-    // Supports: default(val), join(sep), upper, lower, truncate(n), trim, replace(old,new)
-    if (expr.includes('|') && !expr.includes('||')) {
-        const segments = expr.split('|').map(s => s.trim());
-        const mainExpr = segments[0];
-        let result = resolvePath(mainExpr, { args, item, data, index });
-        for (let i = 1; i < segments.length; i++) {
-            result = applyFilter(segments[i], result);
+    // Split on single | (not ||) so "item.a || item.b | upper" works correctly.
+    const pipeSegments = expr.split(/(?<!\|)\|(?!\|)/).map(s => s.trim());
+    if (pipeSegments.length > 1) {
+        let result = evalExpr(pipeSegments[0], ctx);
+        for (let i = 1; i < pipeSegments.length; i++) {
+            result = applyFilter(pipeSegments[i], result);
         }
         return result;
     }
-    // Arithmetic: index + 1
-    const arithMatch = expr.match(/^([\w][\w.]*)\s*([+\-*/])\s*(\d+)$/);
-    if (arithMatch) {
-        const [, varName, op, numStr] = arithMatch;
-        const val = resolvePath(varName, { args, item, data, index });
-        if (val !== null && val !== undefined) {
-            const numVal = Number(val);
-            const num = Number(numStr);
-            if (!isNaN(numVal)) {
-                switch (op) {
-                    case '+': return numVal + num;
-                    case '-': return numVal - num;
-                    case '*': return numVal * num;
-                    case '/': return num !== 0 ? numVal / num : 0;
-                }
-            }
-        }
-    }
-    // JS-like fallback expression: item.tweetCount || 'N/A'
-    const orMatch = expr.match(/^(.+?)\s*\|\|\s*(.+)$/);
-    if (orMatch) {
-        const left = evalExpr(orMatch[1].trim(), ctx);
-        if (left)
-            return left;
-        const right = orMatch[2].trim();
-        return right.replace(/^['"]|['"]$/g, '');
-    }
+    // Fast path: quoted string literal — skip VM overhead
+    const strLit = expr.match(/^(['"])(.*)\1$/);
+    if (strLit)
+        return strLit[2];
+    // Fast path: numeric literal
+    if (/^\d+(\.\d+)?$/.test(expr))
+        return Number(expr);
+    // Try resolving as a simple dotted path (item.foo.bar, args.limit, index)
     const resolved = resolvePath(expr, { args, item, data, index });
     if (resolved !== null && resolved !== undefined)
         return resolved;
+    // Fallback: evaluate as JS in a sandboxed VM.
+    // Handles ||, ??, arithmetic, ternary, method calls, etc. natively.
     return evalJsExpr(expr, { args, item, data, index });
 }
 /**
@@ -87,7 +68,7 @@ function applyFilter(filterExpr, value) {
         case 'default': {
             if (value === null || value === undefined || value === '') {
                 const intVal = parseInt(filterArg, 10);
-                if (!isNaN(intVal) && String(intVal) === filterArg.trim())
+                if (!Number.isNaN(intVal) && String(intVal) === filterArg.trim())
                     return intVal;
                 return filterArg;
             }
@@ -103,7 +84,7 @@ function applyFilter(filterExpr, value) {
             return typeof value === 'string' ? value.trim() : value;
         case 'truncate': {
             const n = parseInt(filterArg, 10) || 50;
-            return typeof value === 'string' && value.length > n ? value.slice(0, n) + '...' : value;
+            return typeof value === 'string' && value.length > n ? `${value.slice(0, n)}...` : value;
         }
         case 'replace': {
             if (typeof value !== 'string')
@@ -132,6 +113,7 @@ function applyFilter(filterExpr, value) {
         case 'sanitize':
             // Remove invalid filename characters
             return typeof value === 'string'
+                // biome-ignore lint/suspicious/noControlCharactersInRegex: intentional - strips C0 control chars from filenames
                 ? value.replace(/[<>:"/\\|?*\x00-\x1f]/g, '_')
                 : value;
         case 'ext': {
@@ -196,26 +178,58 @@ export function resolvePath(pathStr, ctx) {
 }
 /**
  * Evaluate arbitrary JS expressions as a last-resort fallback.
- *
- * ⚠️  SECURITY NOTE: Uses `new Function()` to execute the expression.
- * This is acceptable here because:
- *   1. YAML adapters are authored by trusted repo contributors only.
- *   2. The expression runs in the same Node.js process (no sandbox).
- *   3. Only a curated set of globals is exposed (no require/import/process/fs).
- * If opencli ever loads untrusted third-party adapters, this MUST be replaced
- * with a proper sandboxed evaluator.
+ * Runs inside a `node:vm` sandbox with dynamic code generation disabled.
+ */
+const FORBIDDEN_EXPR_PATTERNS = /\b(constructor|__proto__|prototype|globalThis|process|require|import|eval)\b/;
+/**
+ * Deep-copy plain data to sever prototype chains, preventing sandbox escape
+ * via `args.constructor.constructor('return process')()` etc.
  */
+function sanitizeContext(obj) {
+    if (obj === null || obj === undefined)
+        return obj;
+    if (typeof obj !== 'object' && typeof obj !== 'function')
+        return obj;
+    try {
+        return JSON.parse(JSON.stringify(obj));
+    }
+    catch {
+        return {};
+    }
+}
 function evalJsExpr(expr, ctx) {
     // Guard against absurdly long expressions that could indicate injection.
     if (expr.length > 2000)
         return undefined;
-    const args = ctx.args ?? {};
-    const item = ctx.item ?? {};
-    const data = ctx.data;
+    // Block obvious sandbox escape attempts.
+    if (FORBIDDEN_EXPR_PATTERNS.test(expr))
+        return undefined;
+    const args = sanitizeContext(ctx.args ?? {});
+    const item = sanitizeContext(ctx.item ?? {});
+    const data = sanitizeContext(ctx.data);
     const index = ctx.index ?? 0;
     try {
-        const fn = new Function('args', 'item', 'data', 'index', 'encodeURIComponent', 'decodeURIComponent', 'JSON', 'Math', 'Number', 'String', 'Boolean', 'Array', 'Object', 'Date', `"use strict"; return (${expr});`);
-        return fn(args, item, data, index, encodeURIComponent, decodeURIComponent, JSON, Math, Number, String, Boolean, Array, Object, Date);
+        return vm.runInNewContext(`(${expr})`, {
+            args,
+            item,
+            data,
+            index,
+            encodeURIComponent,
+            decodeURIComponent,
+            JSON,
+            Math,
+            Number,
+            String,
+            Boolean,
+            Array,
+            Date,
+        }, {
+            timeout: 50,
+            contextCodeGeneration: {
+                strings: false,
+                wasm: false,
+            },
+        });
     }
     catch {
         return undefined;

package/dist/pipeline/template.test.js

@@ -51,6 +51,31 @@ describe('evalExpr', () => {
     it('evaluates || with truthy left', () => {
         expect(evalExpr("item.name || 'N/A'", { item: { name: 'Alice' } })).toBe('Alice');
     });
+    it('evaluates chained || fallback (issue #303)', () => {
+        // When first two are falsy, should evaluate through to the string literal
+        expect(evalExpr("item.a || item.b || 'default'", { item: {} })).toBe('default');
+    });
+    it('evaluates chained || with middle value truthy', () => {
+        expect(evalExpr("item.a || item.b || 'default'", { item: { b: 'middle' } })).toBe('middle');
+    });
+    it('evaluates chained || with first value truthy', () => {
+        expect(evalExpr("item.a || item.b || 'default'", { item: { a: 'first', b: 'middle' } })).toBe('first');
+    });
+    it('evaluates || with 0 as falsy left (JS semantics)', () => {
+        expect(evalExpr("item.count || 'N/A'", { item: { count: 0 } })).toBe('N/A');
+    });
+    it('evaluates || with empty string as falsy left', () => {
+        expect(evalExpr("item.name || 'unknown'", { item: { name: '' } })).toBe('unknown');
+    });
+    it('evaluates || with numeric fallback returning number type', () => {
+        expect(evalExpr('item.a || 42', { item: {} })).toBe(42);
+    });
+    it('evaluates 4-way chained ||', () => {
+        expect(evalExpr("item.a || item.b || item.c || 'last'", { item: { c: 'third' } })).toBe('third');
+    });
+    it('handles || combined with pipe filter', () => {
+        expect(evalExpr("item.a || item.b | upper", { item: { b: 'hello' } })).toBe('HELLO');
+    });
     it('resolves simple path', () => {
         expect(evalExpr('item.title', { item: { title: 'Test' } })).toBe('Test');
     });
@@ -63,6 +88,9 @@ describe('evalExpr', () => {
     it('evaluates method calls on values', () => {
         expect(evalExpr("args.username.startsWith('@') ? args.username : '@' + args.username", { args: { username: 'alice' } })).toBe('@alice');
     });
+    it('rejects constructor-based sandbox escapes', () => {
+        expect(evalExpr("args['cons' + 'tructor']['constructor']('return process')()", { args: {} })).toBeUndefined();
+    });
     it('applies join filter', () => {
         expect(evalExpr('item.tags | join(,)', { item: { tags: ['a', 'b', 'c'] } })).toBe('a,b,c');
     });

package/dist/pipeline/transform.test.js

@@ -85,6 +85,24 @@ describe('stepSort', () => {
         await stepSort(null, 'score', SAMPLE_DATA, {});
         expect(SAMPLE_DATA).toEqual(original);
     });
+    it('sorts string-encoded numbers naturally by default', async () => {
+        const data = [
+            { name: 'A', volume: '99' },
+            { name: 'B', volume: '1000' },
+            { name: 'C', volume: '250' },
+        ];
+        const result = await stepSort(null, { by: 'volume', order: 'desc' }, data, {});
+        expect(result.map((r) => r.name)).toEqual(['B', 'C', 'A']);
+    });
+    it('handles missing fields gracefully', async () => {
+        const data = [
+            { name: 'A', value: '10' },
+            { name: 'B' },
+            { name: 'C', value: '5' },
+        ];
+        const result = await stepSort(null, { by: 'value', order: 'asc' }, data, {});
+        expect(result.map((r) => r.name)).toEqual(['B', 'C', 'A']);
+    });
 });
 describe('stepLimit', () => {
     it('limits array to N items', async () => {