@jackwener/opencli 1.3.3 → 1.4.1

package/src/pipeline/steps/download.test.ts

@@ -0,0 +1,136 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import type { IPage } from '../../types.js';
+
+const { mockHttpDownload, mockYtdlpDownload, mockExportCookiesToNetscape } = vi.hoisted(() => ({
+  mockHttpDownload: vi.fn(),
+  mockYtdlpDownload: vi.fn(),
+  mockExportCookiesToNetscape: vi.fn(),
+}));
+
+vi.mock('../../download/index.js', async () => {
+  const actual = await vi.importActual<typeof import('../../download/index.js')>('../../download/index.js');
+  return {
+    ...actual,
+    httpDownload: mockHttpDownload,
+    ytdlpDownload: mockYtdlpDownload,
+    exportCookiesToNetscape: mockExportCookiesToNetscape,
+  };
+});
+
+import { stepDownload } from './download.js';
+
+function createMockPage(getCookies: IPage['getCookies']): IPage {
+  return {
+    goto: vi.fn(),
+    evaluate: vi.fn().mockResolvedValue(null),
+    getCookies,
+    snapshot: vi.fn().mockResolvedValue(''),
+    click: vi.fn(),
+    typeText: vi.fn(),
+    pressKey: vi.fn(),
+    scrollTo: vi.fn(),
+    getFormState: vi.fn().mockResolvedValue({}),
+    wait: vi.fn(),
+    tabs: vi.fn().mockResolvedValue([]),
+    closeTab: vi.fn(),
+    newTab: vi.fn(),
+    selectTab: vi.fn(),
+    networkRequests: vi.fn().mockResolvedValue([]),
+    consoleMessages: vi.fn().mockResolvedValue([]),
+    scroll: vi.fn(),
+    autoScroll: vi.fn(),
+    installInterceptor: vi.fn(),
+    getInterceptedRequests: vi.fn().mockResolvedValue([]),
+    screenshot: vi.fn().mockResolvedValue(''),
+  };
+}
+
+describe('stepDownload', () => {
+  beforeEach(() => {
+    mockHttpDownload.mockReset();
+    mockHttpDownload.mockResolvedValue({ success: true, size: 2 });
+    mockYtdlpDownload.mockReset();
+    mockYtdlpDownload.mockResolvedValue({ success: true, size: 2 });
+    mockExportCookiesToNetscape.mockReset();
+  });
+
+  it('scopes browser cookies to each direct-download target domain', async () => {
+    const page = createMockPage(vi.fn().mockImplementation(async (opts?: { domain?: string }) => {
+      const domain = opts?.domain ?? 'unknown';
+      return [{ name: 'sid', value: domain, domain }];
+    }));
+
+    await stepDownload(
+      page,
+      {
+        url: '${{ item.url }}',
+        dir: path.join(os.tmpdir(), 'opencli-download-test'),
+        filename: '${{ index }}.txt',
+        progress: false,
+        concurrency: 1,
+      },
+      [
+        { url: 'https://a.example/file-1.txt' },
+        { url: 'https://b.example/file-2.txt' },
+      ],
+      {},
+    );
+
+    expect(mockHttpDownload).toHaveBeenNthCalledWith(
+      1,
+      'https://a.example/file-1.txt',
+      path.join(os.tmpdir(), 'opencli-download-test', '0.txt'),
+      expect.objectContaining({ cookies: 'sid=a.example' }),
+    );
+    expect(mockHttpDownload).toHaveBeenNthCalledWith(
+      2,
+      'https://b.example/file-2.txt',
+      path.join(os.tmpdir(), 'opencli-download-test', '1.txt'),
+      expect.objectContaining({ cookies: 'sid=b.example' }),
+    );
+  });
+
+  it('builds yt-dlp cookies from all target domains instead of only the first item', async () => {
+    const getCookies = vi.fn().mockImplementation(async (opts?: { domain?: string }) => {
+      const domain = opts?.domain ?? 'unknown';
+      return [{
+        name: `sid-${domain}`,
+        value: domain,
+        domain,
+        path: '/',
+        secure: false,
+        httpOnly: false,
+      }];
+    });
+    const page = createMockPage(getCookies);
+
+    await stepDownload(
+      page,
+      {
+        url: '${{ item.url }}',
+        dir: '/tmp/opencli-download-test',
+        filename: '${{ index }}.mp4',
+        progress: false,
+        concurrency: 1,
+      },
+      [
+        { url: 'https://www.youtube.com/watch?v=one' },
+        { url: 'https://www.bilibili.com/video/BV1xx411c7mD' },
+      ],
+      {},
+    );
+
+    expect(getCookies).toHaveBeenCalledWith({ domain: 'www.youtube.com' });
+    expect(getCookies).toHaveBeenCalledWith({ domain: 'www.bilibili.com' });
+    expect(mockExportCookiesToNetscape).toHaveBeenCalledWith(
+      expect.arrayContaining([
+        expect.objectContaining({ name: 'sid-www.youtube.com', domain: 'www.youtube.com' }),
+        expect.objectContaining({ name: 'sid-www.bilibili.com', domain: 'www.bilibili.com' }),
+      ]),
+      expect.any(String),
+    );
+    expect(mockYtdlpDownload).toHaveBeenCalledTimes(2);
+  });
+});

package/src/pipeline/steps/download.ts

@@ -13,6 +13,7 @@ import * as path from 'node:path';
 import * as os from 'node:os';
 import type { IPage } from '../../types.js';
 import { render } from '../template.js';
+import { getErrorMessage } from '../../errors.js';
 import {
   httpDownload,
   ytdlpDownload,
@@ -26,6 +27,7 @@ import {
   formatCookieHeader,
 } from '../../download/index.js';
 import { DownloadProgressTracker, formatBytes } from '../../download/progress.js';
+import { mapConcurrent } from '../../utils.js';
 
 export interface DownloadResult {
   status: 'success' | 'skipped' | 'failed';
@@ -35,35 +37,14 @@ export interface DownloadResult {
   duration?: number;
 }
 
-/**
- * Simple async concurrency limiter for downloads.
- */
-async function mapConcurrent<T, R>(
-  items: T[],
-  limit: number,
-  fn: (item: T, index: number) => Promise<R>,
-): Promise<R[]> {
-  const results: R[] = new Array(items.length);
-  let index = 0;
-
-  async function worker() {
-    while (index < items.length) {
-      const i = index++;
-      results[i] = await fn(items[i], i);
-    }
-  }
 
-  const workers = Array.from({ length: Math.min(limit, items.length) }, () => worker());
-  await Promise.all(workers);
-  return results;
-}
 
 /**
  * Extract cookies from browser page.
  */
-async function extractBrowserCookies(page: IPage, domain?: string): Promise<string> {
+async function extractBrowserCookies(page: IPage, domain: string): Promise<string> {
   try {
-    const cookies = await page.getCookies(domain ? { domain } : {});
+    const cookies = await page.getCookies({ domain });
     return formatCookieHeader(cookies);
   } catch {
     return '';
@@ -94,6 +75,16 @@ async function extractCookiesArray(
   }
 }
 
+function dedupeCookies(
+  cookies: Array<{ name: string; value: string; domain: string; path: string; secure: boolean; httpOnly: boolean }>,
+): Array<{ name: string; value: string; domain: string; path: string; secure: boolean; httpOnly: boolean }> {
+  const deduped = new Map<string, { name: string; value: string; domain: string; path: string; secure: boolean; httpOnly: boolean }>();
+  for (const cookie of cookies) {
+    deduped.set(`${cookie.domain}\t${cookie.path}\t${cookie.name}`, cookie);
+  }
+  return [...deduped.values()];
+}
+
 /**
  * Download step handler for YAML pipelines.
  *
@@ -143,23 +134,29 @@ export async function stepDownload(
   // Create progress tracker
   const tracker = new DownloadProgressTracker(items.length, showProgress);
 
-  // Extract cookies if browser is available
-  let cookies = '';
+  // Cache cookie lookups per domain so mixed-domain batches stay isolated without repeated browser calls.
+  const cookieHeaderCache = new Map<string, Promise<string>>();
   let cookiesFile: string | undefined;
 
   if (page) {
-    cookies = await extractBrowserCookies(page);
-
     // For yt-dlp, we need to export cookies to Netscape format
     if (useYtdlp || items.some((item, index) => {
       const url = String(render(urlTemplate, { args, data, item, index }));
       return requiresYtdlp(url);
     })) {
       try {
-        // Try to get domain from first URL
-        const firstUrl = String(render(urlTemplate, { args, data, item: items[0], index: 0 }));
-        const domain = new URL(firstUrl).hostname;
-        const cookiesArray = await extractCookiesArray(page, domain);
+        const ytdlpDomains = [...new Set(items.flatMap((item, index) => {
+          const url = String(render(urlTemplate, { args, data, item, index }));
+          if (!useYtdlp && !requiresYtdlp(url)) return [];
+          try {
+            return [new URL(url).hostname];
+          } catch {
+            return [];
+          }
+        }))];
+        const cookiesArray = dedupeCookies(
+          (await Promise.all(ytdlpDomains.map((domain) => extractCookiesArray(page, domain)))).flat(),
+        );
 
         if (cookiesArray.length > 0) {
           const tempDir = getTempDir();
@@ -254,6 +251,21 @@ export async function stepDownload(
         }
       } else {
         // Direct HTTP download
+        let cookies = '';
+        if (page) {
+          try {
+            const targetDomain = new URL(url).hostname;
+            let cookiePromise = cookieHeaderCache.get(targetDomain);
+            if (!cookiePromise) {
+              cookiePromise = extractBrowserCookies(page, targetDomain);
+              cookieHeaderCache.set(targetDomain, cookiePromise);
+            }
+            cookies = await cookiePromise;
+          } catch {
+            cookies = '';
+          }
+        }
+
         result = await httpDownload(url, destPath, {
           cookies,
           timeout,
@@ -268,10 +280,11 @@ export async function stepDownload(
           progressBar.complete(result.success, result.success ? formatBytes(result.size) : undefined);
         }
       }
-    } catch (err: any) {
-      result = { success: false, size: 0, error: err.message };
+    } catch (err) {
+      const msg = getErrorMessage(err);
+      result = { success: false, size: 0, error: msg };
       if (progressBar) {
-        progressBar.fail(err.message);
+        progressBar.fail(msg);
       }
     }
 

package/src/pipeline/steps/fetch.test.ts

@@ -0,0 +1,179 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { CliError } from '../../errors.js';
+import type { IPage } from '../../types.js';
+import { stepFetch } from './fetch.js';
+
+afterEach(() => {
+  vi.restoreAllMocks();
+  vi.unstubAllGlobals();
+});
+
+describe('stepFetch', () => {
+  // W1 + W4: non-browser single fetch throws CliError with FETCH_ERROR code and full message
+  it('throws CliError with FETCH_ERROR code on non-ok responses without a browser session', async () => {
+    const jsonMock = vi.fn().mockResolvedValue({ error: 'rate limited' });
+    const fetchMock = vi.fn().mockResolvedValue({
+      ok: false,
+      status: 429,
+      statusText: 'Too Many Requests',
+      json: jsonMock,
+    });
+    vi.stubGlobal('fetch', fetchMock);
+
+    const err = await stepFetch(null, { url: 'https://api.example.com/items' }, null, {}).catch((e: unknown) => e);
+    expect(err).toBeInstanceOf(CliError);
+    expect((err as CliError).code).toBe('FETCH_ERROR');
+    expect((err as CliError).message).toBe('HTTP 429 Too Many Requests from https://api.example.com/items');
+    expect(jsonMock).not.toHaveBeenCalled();
+  });
+
+  // W1 + W3: browser single fetch returns error status from evaluate, outer code throws CliError
+  it('throws CliError with FETCH_ERROR code on non-ok responses inside the browser session', async () => {
+    const jsonMock = vi.fn().mockResolvedValue({ error: 'auth required' });
+    const fetchMock = vi.fn().mockResolvedValue({
+      ok: false,
+      status: 401,
+      statusText: 'Unauthorized',
+      json: jsonMock,
+    });
+    vi.stubGlobal('fetch', fetchMock);
+
+    // Simulate real CDP behavior: evaluate returns a value, errors are thrown outside
+    const page = {
+      evaluate: vi.fn(async (js: string) => Function(`return (${js})`)()()),
+    } as unknown as IPage;
+
+    const err = await stepFetch(page, { url: 'https://api.example.com/items' }, null, {}).catch((e: unknown) => e);
+    expect(err).toBeInstanceOf(CliError);
+    expect((err as CliError).code).toBe('FETCH_ERROR');
+    expect((err as CliError).message).toBe('HTTP 401 Unauthorized from https://api.example.com/items');
+    expect(jsonMock).not.toHaveBeenCalled();
+  });
+
+  it('returns per-item HTTP errors for batch fetches without a browser session', async () => {
+    const jsonMock = vi.fn().mockResolvedValue({ error: 'upstream unavailable' });
+    const fetchMock = vi.fn().mockResolvedValue({
+      ok: false,
+      status: 503,
+      statusText: 'Service Unavailable',
+      json: jsonMock,
+    });
+    vi.stubGlobal('fetch', fetchMock);
+
+    await expect(stepFetch(
+      null,
+      { url: 'https://api.example.com/items/${{ item.id }}' },
+      [{ id: 1 }],
+      {},
+    )).resolves.toEqual([
+      { error: 'HTTP 503 Service Unavailable from https://api.example.com/items/1' },
+    ]);
+    expect(jsonMock).not.toHaveBeenCalled();
+  });
+
+  it('returns per-item HTTP errors for batch browser fetches', async () => {
+    const jsonMock = vi.fn().mockResolvedValue({ error: 'upstream unavailable' });
+    const fetchMock = vi.fn().mockResolvedValue({
+      ok: false,
+      status: 503,
+      statusText: 'Service Unavailable',
+      json: jsonMock,
+    });
+    vi.stubGlobal('fetch', fetchMock);
+
+    const page = {
+      evaluate: vi.fn(async (js: string) => Function(`return (${js})`)()()),
+    } as unknown as IPage;
+
+    await expect(stepFetch(
+      page,
+      { url: 'https://api.example.com/items/${{ item.id }}' },
+      [{ id: 1 }],
+      {},
+    )).resolves.toEqual([
+      { error: 'HTTP 503 Service Unavailable from https://api.example.com/items/1' },
+    ]);
+    expect(jsonMock).not.toHaveBeenCalled();
+  });
+
+  it('stringifies non-Error batch browser failures consistently', async () => {
+    vi.stubGlobal('fetch', vi.fn().mockRejectedValue('socket hang up'));
+
+    const page = {
+      evaluate: vi.fn(async (js: string) => Function(`return (${js})`)()()),
+    } as unknown as IPage;
+
+    await expect(stepFetch(
+      page,
+      { url: 'https://api.example.com/items/${{ item.id }}' },
+      [{ id: 1 }],
+      {},
+    )).resolves.toEqual([
+      { error: 'socket hang up' },
+    ]);
+  });
+
+  it('stringifies non-Error batch non-browser failures consistently', async () => {
+    vi.stubGlobal('fetch', vi.fn().mockRejectedValue('socket hang up'));
+
+    await expect(stepFetch(
+      null,
+      { url: 'https://api.example.com/items/${{ item.id }}' },
+      [{ id: 1 }],
+      {},
+    )).resolves.toEqual([
+      { error: 'socket hang up' },
+    ]);
+  });
+
+  // W2: batch item failures emit a warning log
+  it('logs a warning for each failed batch item in non-browser mode', async () => {
+    const { log } = await import('../../logger.js');
+    const warnSpy = vi.spyOn(log, 'warn');
+
+    vi.stubGlobal('fetch', vi.fn().mockResolvedValue({
+      ok: false,
+      status: 503,
+      statusText: 'Service Unavailable',
+      json: vi.fn(),
+    }));
+
+    await stepFetch(
+      null,
+      { url: 'https://api.example.com/items/${{ item.id }}' },
+      [{ id: 1 }, { id: 2 }],
+      {},
+    );
+
+    expect(warnSpy).toHaveBeenCalledTimes(2);
+    expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('https://api.example.com/items/1'));
+    expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('https://api.example.com/items/2'));
+  });
+
+  it('logs a warning for each failed batch item in browser mode', async () => {
+    const { log } = await import('../../logger.js');
+    const warnSpy = vi.spyOn(log, 'warn');
+
+    vi.stubGlobal('fetch', vi.fn().mockResolvedValue({
+      ok: false,
+      status: 502,
+      statusText: 'Bad Gateway',
+      json: vi.fn(),
+    }));
+
+    const page = {
+      evaluate: vi.fn(async (js: string) => Function(`return (${js})`)()()),
+    } as unknown as IPage;
+
+    await stepFetch(
+      page,
+      { url: 'https://api.example.com/items/${{ item.id }}' },
+      [{ id: 1 }, { id: 2 }],
+      {},
+    );
+
+    expect(warnSpy).toHaveBeenCalledTimes(2);
+    expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('https://api.example.com/items/1'));
+    expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('https://api.example.com/items/2'));
+  });
+});

package/src/pipeline/steps/fetch.ts

@@ -2,29 +2,14 @@
  * Pipeline step: fetch — HTTP API requests.
  */
 
+import { CliError, getErrorMessage } from '../../errors.js';
+import { log } from '../../logger.js';
 import type { IPage } from '../../types.js';
 import { render } from '../template.js';
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-
-/** Simple async concurrency limiter */
-async function mapConcurrent<T, R>(items: T[], limit: number, fn: (item: T, index: number) => Promise<R>): Promise<R[]> {
-  const results: R[] = new Array(items.length);
-  let index = 0;
+import { isRecord, mapConcurrent } from '../../utils.js';
 
-  async function worker() {
-    while (index < items.length) {
-      const i = index++;
-      results[i] = await fn(items[i], i);
-    }
-  }
 
-  const workers = Array.from({ length: Math.min(limit, items.length) }, () => worker());
-  await Promise.all(workers);
-  return results;
-}
 
 /** Single URL fetch helper */
 async function fetchSingle(
@@ -45,20 +30,33 @@ async function fetchSingle(
 
   if (page === null) {
     const resp = await fetch(finalUrl, { method: method.toUpperCase(), headers: renderedHeaders });
+    if (!resp.ok) {
+      throw new CliError('FETCH_ERROR', `HTTP ${resp.status} ${resp.statusText} from ${finalUrl}`);
+    }
     return resp.json();
   }
 
   const headersJs = JSON.stringify(renderedHeaders);
   const urlJs = JSON.stringify(finalUrl);
   const methodJs = JSON.stringify(method.toUpperCase());
-  return page.evaluate(`
+  // Return error status instead of throwing inside evaluate to avoid CDP wrapper
+  // rewriting the message (CDP prepends "Evaluate error: " to thrown errors).
+  const result = await page.evaluate(`
     async () => {
       const resp = await fetch(${urlJs}, {
         method: ${methodJs}, headers: ${headersJs}, credentials: "include"
       });
+      if (!resp.ok) {
+        return { __httpError: resp.status, statusText: resp.statusText };
+      }
       return await resp.json();
     }
   `);
+  if (result && typeof result === 'object' && '__httpError' in result) {
+    const { __httpError: status, statusText } = result as { __httpError: number; statusText: string };
+    throw new CliError('FETCH_ERROR', `HTTP ${status} ${statusText} from ${finalUrl}`);
+  }
+  return result;
 }
 
 /**
@@ -72,10 +70,11 @@ async function fetchBatchInBrowser(
 ): Promise<unknown[]> {
   const headersJs = JSON.stringify(headers);
   const urlsJs = JSON.stringify(urls);
+  const methodJs = JSON.stringify(method);
   return (await page.evaluate(`
     async () => {
       const urls = ${urlsJs};
-      const method = "${method}";
+      const method = ${methodJs};
       const headers = ${headersJs};
       const concurrency = ${concurrency};
 
@@ -87,9 +86,13 @@ async function fetchBatchInBrowser(
           const i = idx++;
           try {
             const resp = await fetch(urls[i], { method, headers, credentials: "include" });
+            if (!resp.ok) {
+              throw new Error('HTTP ' + resp.status + ' ' + resp.statusText + ' from ' + urls[i]);
+            }
             results[i] = await resp.json();
           } catch (e) {
-            results[i] = { error: e.message };
+            results[i] = { error: e instanceof Error ? e.message : String(e) };
+            // Note: getErrorMessage() is a Node.js utility — can't use it inside evaluate()
           }
         }
       }
@@ -130,13 +133,26 @@ export async function stepFetch(page: IPage | null, params: unknown, data: unkno
 
     // BATCH IPC: if browser is available, batch all fetches into a single evaluate() call
     if (page !== null) {
-      return fetchBatchInBrowser(page, urls, method.toUpperCase(), renderedHeaders, concurrency);
+      const results = await fetchBatchInBrowser(page, urls, method.toUpperCase(), renderedHeaders, concurrency);
+      for (let i = 0; i < results.length; i++) {
+        const r = results[i];
+        if (r && typeof r === 'object' && 'error' in r) {
+          log.warn(`Batch fetch failed for ${urls[i]}: ${(r as { error: string }).error}`);
+        }
+      }
+      return results;
     }
 
     // Non-browser: use concurrent pool (already optimized)
     return mapConcurrent(data, concurrency, async (item, index) => {
       const itemUrl = String(render(urlTemplate, { args, data, item, index }));
-      return fetchSingle(null, itemUrl, method, queryParams, headers, args, data);
+      try {
+        return await fetchSingle(null, itemUrl, method, queryParams, headers, args, data);
+      } catch (error) {
+        const message = getErrorMessage(error);
+        log.warn(`Batch fetch failed for ${itemUrl}: ${message}`);
+        return { error: message };
+      }
     });
   }
   const url = render(urlOrObj, { args, data });

package/src/pipeline/steps/transform.ts

@@ -5,9 +5,7 @@
 import type { IPage } from '../../types.js';
 import { render, evalExpr } from '../template.js';
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
+import { isRecord } from '../../utils.js';
 
 export async function stepSelect(_page: IPage | null, params: unknown, data: unknown, args: Record<string, unknown>): Promise<unknown> {
   const pathStr = String(render(params, { args, data }));
@@ -62,9 +60,7 @@ export async function stepSort(_page: IPage | null, params: unknown, data: unkno
   return [...data].sort((a, b) => {
     const left = isRecord(a) ? a[key] : undefined;
     const right = isRecord(b) ? b[key] : undefined;
-    const va = left ?? '';
-    const vb = right ?? '';
-    const cmp = va < vb ? -1 : va > vb ? 1 : 0;
+    const cmp = String(left ?? '').localeCompare(String(right ?? ''), undefined, { numeric: true });
     return reverse ? -cmp : cmp;
   });
 }

package/src/pipeline/template.test.ts

@@ -54,6 +54,31 @@ describe('evalExpr', () => {
   it('evaluates || with truthy left', () => {
     expect(evalExpr("item.name || 'N/A'", { item: { name: 'Alice' } })).toBe('Alice');
   });
+  it('evaluates chained || fallback (issue #303)', () => {
+    // When first two are falsy, should evaluate through to the string literal
+    expect(evalExpr("item.a || item.b || 'default'", { item: {} })).toBe('default');
+  });
+  it('evaluates chained || with middle value truthy', () => {
+    expect(evalExpr("item.a || item.b || 'default'", { item: { b: 'middle' } })).toBe('middle');
+  });
+  it('evaluates chained || with first value truthy', () => {
+    expect(evalExpr("item.a || item.b || 'default'", { item: { a: 'first', b: 'middle' } })).toBe('first');
+  });
+  it('evaluates || with 0 as falsy left (JS semantics)', () => {
+    expect(evalExpr("item.count || 'N/A'", { item: { count: 0 } })).toBe('N/A');
+  });
+  it('evaluates || with empty string as falsy left', () => {
+    expect(evalExpr("item.name || 'unknown'", { item: { name: '' } })).toBe('unknown');
+  });
+  it('evaluates || with numeric fallback returning number type', () => {
+    expect(evalExpr('item.a || 42', { item: {} })).toBe(42);
+  });
+  it('evaluates 4-way chained ||', () => {
+    expect(evalExpr("item.a || item.b || item.c || 'last'", { item: { c: 'third' } })).toBe('third');
+  });
+  it('handles || combined with pipe filter', () => {
+    expect(evalExpr("item.a || item.b | upper", { item: { b: 'hello' } })).toBe('HELLO');
+  });
   it('resolves simple path', () => {
     expect(evalExpr('item.title', { item: { title: 'Test' } })).toBe('Test');
   });
@@ -66,6 +91,9 @@ describe('evalExpr', () => {
   it('evaluates method calls on values', () => {
     expect(evalExpr("args.username.startsWith('@') ? args.username : '@' + args.username", { args: { username: 'alice' } })).toBe('@alice');
   });
+  it('rejects constructor-based sandbox escapes', () => {
+    expect(evalExpr("args['cons' + 'tructor']['constructor']('return process')()", { args: {} })).toBeUndefined();
+  });
   it('applies join filter', () => {
     expect(evalExpr('item.tags | join(,)', { item: { tags: ['a', 'b', 'c'] } })).toBe('a,b,c');
   });