@runchr/gstack-antigravity 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (297) hide show
  1. package/.agents/rules/ETHOS.md +129 -0
  2. package/.agents/rules/global-gstack.md +117 -0
  3. package/.agents/rules/persona-gstack-autoplan.md +14 -0
  4. package/.agents/rules/persona-gstack-benchmark.md +14 -0
  5. package/.agents/rules/persona-gstack-browse.md +14 -0
  6. package/.agents/rules/persona-gstack-canary.md +14 -0
  7. package/.agents/rules/persona-gstack-careful.md +14 -0
  8. package/.agents/rules/persona-gstack-codex.md +14 -0
  9. package/.agents/rules/persona-gstack-cso.md +14 -0
  10. package/.agents/rules/persona-gstack-design-consultation.md +14 -0
  11. package/.agents/rules/persona-gstack-design-review.md +14 -0
  12. package/.agents/rules/persona-gstack-document-release.md +14 -0
  13. package/.agents/rules/persona-gstack-freeze.md +14 -0
  14. package/.agents/rules/persona-gstack-gstack-upgrade.md +14 -0
  15. package/.agents/rules/persona-gstack-guard.md +14 -0
  16. package/.agents/rules/persona-gstack-investigate.md +14 -0
  17. package/.agents/rules/persona-gstack-land-and-deploy.md +14 -0
  18. package/.agents/rules/persona-gstack-office-hours.md +14 -0
  19. package/.agents/rules/persona-gstack-plan-ceo-review.md +14 -0
  20. package/.agents/rules/persona-gstack-plan-design-review.md +14 -0
  21. package/.agents/rules/persona-gstack-plan-eng-review.md +14 -0
  22. package/.agents/rules/persona-gstack-qa-only.md +14 -0
  23. package/.agents/rules/persona-gstack-qa.md +14 -0
  24. package/.agents/rules/persona-gstack-retro.md +14 -0
  25. package/.agents/rules/persona-gstack-review.md +14 -0
  26. package/.agents/rules/persona-gstack-setup-browser-cookies.md +14 -0
  27. package/.agents/rules/persona-gstack-setup-deploy.md +14 -0
  28. package/.agents/rules/persona-gstack-ship.md +14 -0
  29. package/.agents/rules/persona-gstack-unfreeze.md +14 -0
  30. package/.agents/rules/persona-gstack.md +40 -0
  31. package/.agents/rules/recursive-identities.md +22 -0
  32. package/.agents/workflows/autoplan.md +30 -0
  33. package/.agents/workflows/benchmark.md +31 -0
  34. package/.agents/workflows/browse.md +26 -0
  35. package/.agents/workflows/canary.md +33 -0
  36. package/.agents/workflows/careful.md +22 -0
  37. package/.agents/workflows/codex.md +36 -0
  38. package/.agents/workflows/cso.md +29 -0
  39. package/.agents/workflows/design-consultation.md +28 -0
  40. package/.agents/workflows/design-review.md +28 -0
  41. package/.agents/workflows/document-release.md +32 -0
  42. package/.agents/workflows/freeze.md +17 -0
  43. package/.agents/workflows/gstack-upgrade.md +54 -0
  44. package/.agents/workflows/gstack.md +56 -0
  45. package/.agents/workflows/guard.md +18 -0
  46. package/.agents/workflows/investigate.md +37 -0
  47. package/.agents/workflows/land-and-deploy.md +35 -0
  48. package/.agents/workflows/office-hours.md +27 -0
  49. package/.agents/workflows/plan-ceo-review.md +34 -0
  50. package/.agents/workflows/plan-design-review.md +31 -0
  51. package/.agents/workflows/plan-eng-review.md +28 -0
  52. package/.agents/workflows/qa-only.md +28 -0
  53. package/.agents/workflows/qa.md +73 -0
  54. package/.agents/workflows/retro.md +34 -0
  55. package/.agents/workflows/review.md +30 -0
  56. package/.agents/workflows/setup-browser-cookies.md +15 -0
  57. package/.agents/workflows/setup-cookies.md +8 -0
  58. package/.agents/workflows/setup-deploy.md +21 -0
  59. package/.agents/workflows/ship.md +93 -0
  60. package/.agents/workflows/unfreeze.md +12 -0
  61. package/LICENSE +22 -0
  62. package/README.md +189 -0
  63. package/README_KO.md +191 -0
  64. package/bin/install.js +105 -0
  65. package/gstack-origin/.agents/skills/gstack/SKILL.md +651 -0
  66. package/gstack-origin/.agents/skills/gstack-autoplan/SKILL.md +678 -0
  67. package/gstack-origin/.agents/skills/gstack-benchmark/SKILL.md +482 -0
  68. package/gstack-origin/.agents/skills/gstack-browse/SKILL.md +511 -0
  69. package/gstack-origin/.agents/skills/gstack-canary/SKILL.md +486 -0
  70. package/gstack-origin/.agents/skills/gstack-careful/SKILL.md +50 -0
  71. package/gstack-origin/.agents/skills/gstack-cso/SKILL.md +607 -0
  72. package/gstack-origin/.agents/skills/gstack-design-consultation/SKILL.md +615 -0
  73. package/gstack-origin/.agents/skills/gstack-design-review/SKILL.md +988 -0
  74. package/gstack-origin/.agents/skills/gstack-document-release/SKILL.md +604 -0
  75. package/gstack-origin/.agents/skills/gstack-freeze/SKILL.md +67 -0
  76. package/gstack-origin/.agents/skills/gstack-guard/SKILL.md +62 -0
  77. package/gstack-origin/.agents/skills/gstack-investigate/SKILL.md +415 -0
  78. package/gstack-origin/.agents/skills/gstack-land-and-deploy/SKILL.md +873 -0
  79. package/gstack-origin/.agents/skills/gstack-office-hours/SKILL.md +986 -0
  80. package/gstack-origin/.agents/skills/gstack-plan-ceo-review/SKILL.md +1268 -0
  81. package/gstack-origin/.agents/skills/gstack-plan-design-review/SKILL.md +668 -0
  82. package/gstack-origin/.agents/skills/gstack-plan-eng-review/SKILL.md +826 -0
  83. package/gstack-origin/.agents/skills/gstack-qa/SKILL.md +1006 -0
  84. package/gstack-origin/.agents/skills/gstack-qa-only/SKILL.md +626 -0
  85. package/gstack-origin/.agents/skills/gstack-retro/SKILL.md +1065 -0
  86. package/gstack-origin/.agents/skills/gstack-review/SKILL.md +704 -0
  87. package/gstack-origin/.agents/skills/gstack-setup-browser-cookies/SKILL.md +325 -0
  88. package/gstack-origin/.agents/skills/gstack-setup-deploy/SKILL.md +450 -0
  89. package/gstack-origin/.agents/skills/gstack-ship/SKILL.md +1312 -0
  90. package/gstack-origin/.agents/skills/gstack-unfreeze/SKILL.md +36 -0
  91. package/gstack-origin/.agents/skills/gstack-upgrade/SKILL.md +220 -0
  92. package/gstack-origin/.env.example +5 -0
  93. package/gstack-origin/.github/workflows/skill-docs.yml +17 -0
  94. package/gstack-origin/AGENTS.md +49 -0
  95. package/gstack-origin/ARCHITECTURE.md +359 -0
  96. package/gstack-origin/BROWSER.md +271 -0
  97. package/gstack-origin/CHANGELOG.md +800 -0
  98. package/gstack-origin/CLAUDE.md +284 -0
  99. package/gstack-origin/CONTRIBUTING.md +370 -0
  100. package/gstack-origin/ETHOS.md +129 -0
  101. package/gstack-origin/LICENSE +21 -0
  102. package/gstack-origin/README.md +228 -0
  103. package/gstack-origin/SKILL.md +657 -0
  104. package/gstack-origin/SKILL.md.tmpl +281 -0
  105. package/gstack-origin/TODOS.md +564 -0
  106. package/gstack-origin/VERSION +1 -0
  107. package/gstack-origin/autoplan/SKILL.md +689 -0
  108. package/gstack-origin/autoplan/SKILL.md.tmpl +416 -0
  109. package/gstack-origin/benchmark/SKILL.md +489 -0
  110. package/gstack-origin/benchmark/SKILL.md.tmpl +233 -0
  111. package/gstack-origin/bin/dev-setup +68 -0
  112. package/gstack-origin/bin/dev-teardown +56 -0
  113. package/gstack-origin/bin/gstack-analytics +191 -0
  114. package/gstack-origin/bin/gstack-community-dashboard +113 -0
  115. package/gstack-origin/bin/gstack-config +38 -0
  116. package/gstack-origin/bin/gstack-diff-scope +71 -0
  117. package/gstack-origin/bin/gstack-global-discover.ts +591 -0
  118. package/gstack-origin/bin/gstack-repo-mode +93 -0
  119. package/gstack-origin/bin/gstack-review-log +9 -0
  120. package/gstack-origin/bin/gstack-review-read +12 -0
  121. package/gstack-origin/bin/gstack-slug +15 -0
  122. package/gstack-origin/bin/gstack-telemetry-log +158 -0
  123. package/gstack-origin/bin/gstack-telemetry-sync +127 -0
  124. package/gstack-origin/bin/gstack-update-check +196 -0
  125. package/gstack-origin/browse/SKILL.md +517 -0
  126. package/gstack-origin/browse/SKILL.md.tmpl +141 -0
  127. package/gstack-origin/browse/bin/find-browse +21 -0
  128. package/gstack-origin/browse/bin/remote-slug +14 -0
  129. package/gstack-origin/browse/scripts/build-node-server.sh +48 -0
  130. package/gstack-origin/browse/src/browser-manager.ts +634 -0
  131. package/gstack-origin/browse/src/buffers.ts +137 -0
  132. package/gstack-origin/browse/src/bun-polyfill.cjs +109 -0
  133. package/gstack-origin/browse/src/cli.ts +420 -0
  134. package/gstack-origin/browse/src/commands.ts +111 -0
  135. package/gstack-origin/browse/src/config.ts +150 -0
  136. package/gstack-origin/browse/src/cookie-import-browser.ts +417 -0
  137. package/gstack-origin/browse/src/cookie-picker-routes.ts +207 -0
  138. package/gstack-origin/browse/src/cookie-picker-ui.ts +541 -0
  139. package/gstack-origin/browse/src/find-browse.ts +61 -0
  140. package/gstack-origin/browse/src/meta-commands.ts +269 -0
  141. package/gstack-origin/browse/src/platform.ts +17 -0
  142. package/gstack-origin/browse/src/read-commands.ts +335 -0
  143. package/gstack-origin/browse/src/server.ts +369 -0
  144. package/gstack-origin/browse/src/snapshot.ts +398 -0
  145. package/gstack-origin/browse/src/url-validation.ts +91 -0
  146. package/gstack-origin/browse/src/write-commands.ts +352 -0
  147. package/gstack-origin/browse/test/bun-polyfill.test.ts +72 -0
  148. package/gstack-origin/browse/test/commands.test.ts +1836 -0
  149. package/gstack-origin/browse/test/config.test.ts +250 -0
  150. package/gstack-origin/browse/test/cookie-import-browser.test.ts +397 -0
  151. package/gstack-origin/browse/test/cookie-picker-routes.test.ts +205 -0
  152. package/gstack-origin/browse/test/find-browse.test.ts +50 -0
  153. package/gstack-origin/browse/test/fixtures/basic.html +33 -0
  154. package/gstack-origin/browse/test/fixtures/cursor-interactive.html +22 -0
  155. package/gstack-origin/browse/test/fixtures/dialog.html +15 -0
  156. package/gstack-origin/browse/test/fixtures/empty.html +2 -0
  157. package/gstack-origin/browse/test/fixtures/forms.html +55 -0
  158. package/gstack-origin/browse/test/fixtures/qa-eval-checkout.html +108 -0
  159. package/gstack-origin/browse/test/fixtures/qa-eval-spa.html +98 -0
  160. package/gstack-origin/browse/test/fixtures/qa-eval.html +51 -0
  161. package/gstack-origin/browse/test/fixtures/responsive.html +49 -0
  162. package/gstack-origin/browse/test/fixtures/snapshot.html +55 -0
  163. package/gstack-origin/browse/test/fixtures/spa.html +24 -0
  164. package/gstack-origin/browse/test/fixtures/states.html +17 -0
  165. package/gstack-origin/browse/test/fixtures/upload.html +25 -0
  166. package/gstack-origin/browse/test/gstack-config.test.ts +125 -0
  167. package/gstack-origin/browse/test/gstack-update-check.test.ts +467 -0
  168. package/gstack-origin/browse/test/handoff.test.ts +235 -0
  169. package/gstack-origin/browse/test/path-validation.test.ts +63 -0
  170. package/gstack-origin/browse/test/platform.test.ts +37 -0
  171. package/gstack-origin/browse/test/snapshot.test.ts +467 -0
  172. package/gstack-origin/browse/test/test-server.ts +57 -0
  173. package/gstack-origin/browse/test/url-validation.test.ts +72 -0
  174. package/gstack-origin/canary/SKILL.md +493 -0
  175. package/gstack-origin/canary/SKILL.md.tmpl +220 -0
  176. package/gstack-origin/careful/SKILL.md +59 -0
  177. package/gstack-origin/careful/SKILL.md.tmpl +57 -0
  178. package/gstack-origin/careful/bin/check-careful.sh +112 -0
  179. package/gstack-origin/codex/SKILL.md +677 -0
  180. package/gstack-origin/codex/SKILL.md.tmpl +356 -0
  181. package/gstack-origin/conductor.json +6 -0
  182. package/gstack-origin/cso/SKILL.md +615 -0
  183. package/gstack-origin/cso/SKILL.md.tmpl +376 -0
  184. package/gstack-origin/design-consultation/SKILL.md +625 -0
  185. package/gstack-origin/design-consultation/SKILL.md.tmpl +369 -0
  186. package/gstack-origin/design-review/SKILL.md +998 -0
  187. package/gstack-origin/design-review/SKILL.md.tmpl +262 -0
  188. package/gstack-origin/docs/images/github-2013.png +0 -0
  189. package/gstack-origin/docs/images/github-2026.png +0 -0
  190. package/gstack-origin/docs/skills.md +877 -0
  191. package/gstack-origin/document-release/SKILL.md +613 -0
  192. package/gstack-origin/document-release/SKILL.md.tmpl +357 -0
  193. package/gstack-origin/freeze/SKILL.md +82 -0
  194. package/gstack-origin/freeze/SKILL.md.tmpl +80 -0
  195. package/gstack-origin/freeze/bin/check-freeze.sh +68 -0
  196. package/gstack-origin/gstack-upgrade/SKILL.md +226 -0
  197. package/gstack-origin/gstack-upgrade/SKILL.md.tmpl +224 -0
  198. package/gstack-origin/guard/SKILL.md +82 -0
  199. package/gstack-origin/guard/SKILL.md.tmpl +80 -0
  200. package/gstack-origin/investigate/SKILL.md +435 -0
  201. package/gstack-origin/investigate/SKILL.md.tmpl +196 -0
  202. package/gstack-origin/land-and-deploy/SKILL.md +880 -0
  203. package/gstack-origin/land-and-deploy/SKILL.md.tmpl +575 -0
  204. package/gstack-origin/office-hours/SKILL.md +996 -0
  205. package/gstack-origin/office-hours/SKILL.md.tmpl +624 -0
  206. package/gstack-origin/package.json +55 -0
  207. package/gstack-origin/plan-ceo-review/SKILL.md +1277 -0
  208. package/gstack-origin/plan-ceo-review/SKILL.md.tmpl +838 -0
  209. package/gstack-origin/plan-design-review/SKILL.md +676 -0
  210. package/gstack-origin/plan-design-review/SKILL.md.tmpl +314 -0
  211. package/gstack-origin/plan-eng-review/SKILL.md +836 -0
  212. package/gstack-origin/plan-eng-review/SKILL.md.tmpl +279 -0
  213. package/gstack-origin/qa/SKILL.md +1016 -0
  214. package/gstack-origin/qa/SKILL.md.tmpl +316 -0
  215. package/gstack-origin/qa/references/issue-taxonomy.md +85 -0
  216. package/gstack-origin/qa/templates/qa-report-template.md +126 -0
  217. package/gstack-origin/qa-only/SKILL.md +633 -0
  218. package/gstack-origin/qa-only/SKILL.md.tmpl +101 -0
  219. package/gstack-origin/retro/SKILL.md +1072 -0
  220. package/gstack-origin/retro/SKILL.md.tmpl +833 -0
  221. package/gstack-origin/review/SKILL.md +849 -0
  222. package/gstack-origin/review/SKILL.md.tmpl +259 -0
  223. package/gstack-origin/review/TODOS-format.md +62 -0
  224. package/gstack-origin/review/checklist.md +190 -0
  225. package/gstack-origin/review/design-checklist.md +132 -0
  226. package/gstack-origin/review/greptile-triage.md +220 -0
  227. package/gstack-origin/scripts/analytics.ts +190 -0
  228. package/gstack-origin/scripts/dev-skill.ts +82 -0
  229. package/gstack-origin/scripts/eval-compare.ts +96 -0
  230. package/gstack-origin/scripts/eval-list.ts +116 -0
  231. package/gstack-origin/scripts/eval-select.ts +86 -0
  232. package/gstack-origin/scripts/eval-summary.ts +187 -0
  233. package/gstack-origin/scripts/eval-watch.ts +172 -0
  234. package/gstack-origin/scripts/gen-skill-docs.ts +2414 -0
  235. package/gstack-origin/scripts/skill-check.ts +167 -0
  236. package/gstack-origin/setup +269 -0
  237. package/gstack-origin/setup-browser-cookies/SKILL.md +330 -0
  238. package/gstack-origin/setup-browser-cookies/SKILL.md.tmpl +74 -0
  239. package/gstack-origin/setup-deploy/SKILL.md +459 -0
  240. package/gstack-origin/setup-deploy/SKILL.md.tmpl +220 -0
  241. package/gstack-origin/ship/SKILL.md +1457 -0
  242. package/gstack-origin/ship/SKILL.md.tmpl +528 -0
  243. package/gstack-origin/supabase/config.sh +10 -0
  244. package/gstack-origin/supabase/functions/community-pulse/index.ts +59 -0
  245. package/gstack-origin/supabase/functions/telemetry-ingest/index.ts +135 -0
  246. package/gstack-origin/supabase/functions/update-check/index.ts +37 -0
  247. package/gstack-origin/supabase/migrations/001_telemetry.sql +89 -0
  248. package/gstack-origin/test/analytics.test.ts +277 -0
  249. package/gstack-origin/test/codex-e2e.test.ts +197 -0
  250. package/gstack-origin/test/fixtures/coverage-audit-fixture.ts +76 -0
  251. package/gstack-origin/test/fixtures/eval-baselines.json +7 -0
  252. package/gstack-origin/test/fixtures/qa-eval-checkout-ground-truth.json +43 -0
  253. package/gstack-origin/test/fixtures/qa-eval-ground-truth.json +43 -0
  254. package/gstack-origin/test/fixtures/qa-eval-spa-ground-truth.json +43 -0
  255. package/gstack-origin/test/fixtures/review-eval-design-slop.css +86 -0
  256. package/gstack-origin/test/fixtures/review-eval-design-slop.html +41 -0
  257. package/gstack-origin/test/fixtures/review-eval-enum-diff.rb +30 -0
  258. package/gstack-origin/test/fixtures/review-eval-enum.rb +27 -0
  259. package/gstack-origin/test/fixtures/review-eval-vuln.rb +14 -0
  260. package/gstack-origin/test/gemini-e2e.test.ts +173 -0
  261. package/gstack-origin/test/gen-skill-docs.test.ts +1049 -0
  262. package/gstack-origin/test/global-discover.test.ts +187 -0
  263. package/gstack-origin/test/helpers/codex-session-runner.ts +282 -0
  264. package/gstack-origin/test/helpers/e2e-helpers.ts +239 -0
  265. package/gstack-origin/test/helpers/eval-store.test.ts +548 -0
  266. package/gstack-origin/test/helpers/eval-store.ts +689 -0
  267. package/gstack-origin/test/helpers/gemini-session-runner.test.ts +104 -0
  268. package/gstack-origin/test/helpers/gemini-session-runner.ts +201 -0
  269. package/gstack-origin/test/helpers/llm-judge.ts +130 -0
  270. package/gstack-origin/test/helpers/observability.test.ts +283 -0
  271. package/gstack-origin/test/helpers/session-runner.test.ts +96 -0
  272. package/gstack-origin/test/helpers/session-runner.ts +357 -0
  273. package/gstack-origin/test/helpers/skill-parser.ts +206 -0
  274. package/gstack-origin/test/helpers/touchfiles.ts +260 -0
  275. package/gstack-origin/test/hook-scripts.test.ts +373 -0
  276. package/gstack-origin/test/skill-e2e-browse.test.ts +293 -0
  277. package/gstack-origin/test/skill-e2e-deploy.test.ts +279 -0
  278. package/gstack-origin/test/skill-e2e-design.test.ts +614 -0
  279. package/gstack-origin/test/skill-e2e-plan.test.ts +538 -0
  280. package/gstack-origin/test/skill-e2e-qa-bugs.test.ts +194 -0
  281. package/gstack-origin/test/skill-e2e-qa-workflow.test.ts +412 -0
  282. package/gstack-origin/test/skill-e2e-review.test.ts +535 -0
  283. package/gstack-origin/test/skill-e2e-workflow.test.ts +586 -0
  284. package/gstack-origin/test/skill-e2e.test.ts +3325 -0
  285. package/gstack-origin/test/skill-llm-eval.test.ts +787 -0
  286. package/gstack-origin/test/skill-parser.test.ts +179 -0
  287. package/gstack-origin/test/skill-routing-e2e.test.ts +605 -0
  288. package/gstack-origin/test/skill-validation.test.ts +1520 -0
  289. package/gstack-origin/test/telemetry.test.ts +278 -0
  290. package/gstack-origin/test/touchfiles.test.ts +262 -0
  291. package/gstack-origin/unfreeze/SKILL.md +40 -0
  292. package/gstack-origin/unfreeze/SKILL.md.tmpl +38 -0
  293. package/package.json +38 -0
  294. package/scripts/install-antigravity-skill.ps1 +33 -0
  295. package/scripts/install-antigravity-skill.sh +41 -0
  296. package/scripts/sync-gstack-origin.ps1 +37 -0
  297. package/scripts/sync-gstack-origin.sh +35 -0
package/gstack-origin/browse/test/commands.test.ts ADDED
@@ -0,0 +1,1836 @@
1
+ /**
2
+ * Integration tests for all browse commands
3
+ *
4
+ * Tests run against a local test server serving fixture HTML files.
5
+ * A real browse server is started and commands are sent via the CLI HTTP interface.
6
+ */
7
+
8
+ import { describe, test, expect, beforeAll, afterAll } from 'bun:test';
9
+ import { startTestServer } from './test-server';
10
+ import { BrowserManager } from '../src/browser-manager';
11
+ import { resolveServerScript } from '../src/cli';
12
+ import { handleReadCommand } from '../src/read-commands';
13
+ import { handleWriteCommand } from '../src/write-commands';
14
+ import { handleMetaCommand } from '../src/meta-commands';
15
+ import { consoleBuffer, networkBuffer, dialogBuffer, addConsoleEntry, addNetworkEntry, addDialogEntry, CircularBuffer } from '../src/buffers';
16
+ import * as fs from 'fs';
17
+ import { spawn } from 'child_process';
18
+ import * as path from 'path';
19
+
20
+ let testServer: ReturnType<typeof startTestServer>;
21
+ let bm: BrowserManager;
22
+ let baseUrl: string;
23
+
24
+ beforeAll(async () => {
25
+ testServer = startTestServer(0);
26
+ baseUrl = testServer.url;
27
+
28
+ bm = new BrowserManager();
29
+ await bm.launch();
30
+ });
31
+
32
+ afterAll(() => {
33
+ // Force kill browser instead of graceful close (avoids hang)
34
+ try { testServer.server.stop(); } catch {}
35
+ // bm.close() can hang — just let process exit handle it
36
+ setTimeout(() => process.exit(0), 500);
37
+ });
38
+
39
+ // ─── Navigation ─────────────────────────────────────────────────
40
+
41
+ describe('Navigation', () => {
42
+ test('goto navigates to URL', async () => {
43
+ const result = await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
44
+ expect(result).toContain('Navigated to');
45
+ expect(result).toContain('200');
46
+ });
47
+
48
+ test('url returns current URL', async () => {
49
+ const result = await handleMetaCommand('url', [], bm, async () => {});
50
+ expect(result).toContain('/basic.html');
51
+ });
52
+
53
+ test('back goes back', async () => {
54
+ await handleWriteCommand('goto', [baseUrl + '/forms.html'], bm);
55
+ const result = await handleWriteCommand('back', [], bm);
56
+ expect(result).toContain('Back');
57
+ });
58
+
59
+ test('forward goes forward', async () => {
60
+ const result = await handleWriteCommand('forward', [], bm);
61
+ expect(result).toContain('Forward');
62
+ });
63
+
64
+ test('reload reloads page', async () => {
65
+ const result = await handleWriteCommand('reload', [], bm);
66
+ expect(result).toContain('Reloaded');
67
+ });
68
+ });
69
+
70
+ // ─── Content Extraction ─────────────────────────────────────────
71
+
72
+ describe('Content extraction', () => {
73
+ beforeAll(async () => {
74
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
75
+ });
76
+
77
+ test('text returns cleaned page text', async () => {
78
+ const result = await handleReadCommand('text', [], bm);
79
+ expect(result).toContain('Hello World');
80
+ expect(result).toContain('Item one');
81
+ expect(result).not.toContain('<h1>');
82
+ });
83
+
84
+ test('html returns full page HTML', async () => {
85
+ const result = await handleReadCommand('html', [], bm);
86
+ expect(result).toContain('<!DOCTYPE html>');
87
+ expect(result).toContain('<h1 id="title">Hello World</h1>');
88
+ });
89
+
90
+ test('html with selector returns element innerHTML', async () => {
91
+ const result = await handleReadCommand('html', ['#content'], bm);
92
+ expect(result).toContain('Some body text here.');
93
+ expect(result).toContain('<li>Item one</li>');
94
+ });
95
+
96
+ test('links returns all links', async () => {
97
+ const result = await handleReadCommand('links', [], bm);
98
+ expect(result).toContain('Page 1');
99
+ expect(result).toContain('Page 2');
100
+ expect(result).toContain('External');
101
+ expect(result).toContain('→');
102
+ });
103
+
104
+ test('forms discovers form fields', async () => {
105
+ await handleWriteCommand('goto', [baseUrl + '/forms.html'], bm);
106
+ const result = await handleReadCommand('forms', [], bm);
107
+ const forms = JSON.parse(result);
108
+ expect(forms.length).toBe(2);
109
+ expect(forms[0].id).toBe('login-form');
110
+ expect(forms[0].method).toBe('post');
111
+ expect(forms[0].fields.length).toBeGreaterThanOrEqual(2);
112
+ expect(forms[1].id).toBe('profile-form');
113
+
114
+ // Check field discovery
115
+ const emailField = forms[0].fields.find((f: any) => f.name === 'email');
116
+ expect(emailField).toBeDefined();
117
+ expect(emailField.type).toBe('email');
118
+ expect(emailField.required).toBe(true);
119
+ });
120
+
121
+ test('accessibility returns ARIA tree', async () => {
122
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
123
+ const result = await handleReadCommand('accessibility', [], bm);
124
+ expect(result).toContain('Hello World');
125
+ });
126
+ });
127
+
128
+ // ─── JavaScript / CSS / Attrs ───────────────────────────────────
129
+
130
+ describe('Inspection', () => {
131
+ beforeAll(async () => {
132
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
133
+ });
134
+
135
+ test('js evaluates expression', async () => {
136
+ const result = await handleReadCommand('js', ['document.title'], bm);
137
+ expect(result).toBe('Test Page - Basic');
138
+ });
139
+
140
+ test('js returns objects as JSON', async () => {
141
+ const result = await handleReadCommand('js', ['({a: 1, b: 2})'], bm);
142
+ const obj = JSON.parse(result);
143
+ expect(obj.a).toBe(1);
144
+ expect(obj.b).toBe(2);
145
+ });
146
+
147
+ test('js supports await expressions', async () => {
148
+ const result = await handleReadCommand('js', ['await Promise.resolve(42)'], bm);
149
+ expect(result).toBe('42');
150
+ });
151
+
152
+ test('js does not false-positive on await substring', async () => {
153
+ const result = await handleReadCommand('js', ['(() => { const awaitable = 5; return awaitable })()'], bm);
154
+ expect(result).toBe('5');
155
+ });
156
+
157
+ test('eval supports await in single-line file', async () => {
158
+ const tmp = '/tmp/eval-await-test.js';
159
+ fs.writeFileSync(tmp, 'await Promise.resolve("hello from eval")');
160
+ try {
161
+ const result = await handleReadCommand('eval', [tmp], bm);
162
+ expect(result).toBe('hello from eval');
163
+ } finally {
164
+ fs.unlinkSync(tmp);
165
+ }
166
+ });
167
+
168
+ test('eval does not wrap when await is only in a comment', async () => {
169
+ const tmp = '/tmp/eval-comment-test.js';
170
+ fs.writeFileSync(tmp, '// no need to await this\ndocument.title');
171
+ try {
172
+ const result = await handleReadCommand('eval', [tmp], bm);
173
+ expect(result).toBe('Test Page - Basic');
174
+ } finally {
175
+ fs.unlinkSync(tmp);
176
+ }
177
+ });
178
+
179
+ test('eval multi-line with await and explicit return', async () => {
180
+ const tmp = '/tmp/eval-multiline-await.js';
181
+ fs.writeFileSync(tmp, 'const data = await Promise.resolve("multi");\nreturn data;');
182
+ try {
183
+ const result = await handleReadCommand('eval', [tmp], bm);
184
+ expect(result).toBe('multi');
185
+ } finally {
186
+ fs.unlinkSync(tmp);
187
+ }
188
+ });
189
+
190
+ test('eval multi-line with await but no return gives empty string', async () => {
191
+ const tmp = '/tmp/eval-multiline-no-return.js';
192
+ fs.writeFileSync(tmp, 'const data = await Promise.resolve("lost");\ndata;');
193
+ try {
194
+ const result = await handleReadCommand('eval', [tmp], bm);
195
+ expect(result).toBe('');
196
+ } finally {
197
+ fs.unlinkSync(tmp);
198
+ }
199
+ });
200
+
201
+ test('js handles multi-line with await', async () => {
202
+ const code = 'const x = await Promise.resolve(42);\nreturn x;';
203
+ const result = await handleReadCommand('js', [code], bm);
204
+ expect(result).toBe('42');
205
+ });
206
+
207
+ test('js handles await with semicolons', async () => {
208
+ const result = await handleReadCommand('js', ['const x = await Promise.resolve(5); return x + 1;'], bm);
209
+ expect(result).toBe('6');
210
+ });
211
+
212
+ test('js handles await with statement keywords', async () => {
213
+ const result = await handleReadCommand('js', ['const res = await Promise.resolve("ok"); return res;'], bm);
214
+ expect(result).toBe('ok');
215
+ });
216
+
217
+ test('js still works for simple expressions', async () => {
218
+ const result = await handleReadCommand('js', ['1 + 2'], bm);
219
+ expect(result).toBe('3');
220
+ });
221
+
222
+ test('css returns computed property', async () => {
223
+ const result = await handleReadCommand('css', ['h1', 'color'], bm);
224
+ // Navy color
225
+ expect(result).toContain('0, 0, 128');
226
+ });
227
+
228
+ test('css returns font-family', async () => {
229
+ const result = await handleReadCommand('css', ['body', 'font-family'], bm);
230
+ expect(result).toContain('Helvetica');
231
+ });
232
+
233
+ test('attrs returns element attributes', async () => {
234
+ const result = await handleReadCommand('attrs', ['#content'], bm);
235
+ const attrs = JSON.parse(result);
236
+ expect(attrs.id).toBe('content');
237
+ expect(attrs['data-testid']).toBe('main-content');
238
+ expect(attrs['data-version']).toBe('1.0');
239
+ });
240
+ });
241
+
242
+ // ─── Interaction ────────────────────────────────────────────────
243
+
244
+ describe('Interaction', () => {
245
+ test('fill + click works on form', async () => {
246
+ await handleWriteCommand('goto', [baseUrl + '/forms.html'], bm);
247
+
248
+ let result = await handleWriteCommand('fill', ['#email', 'test@example.com'], bm);
249
+ expect(result).toContain('Filled');
250
+
251
+ result = await handleWriteCommand('fill', ['#password', 'secret123'], bm);
252
+ expect(result).toContain('Filled');
253
+
254
+ // Verify values were set
255
+ const emailVal = await handleReadCommand('js', ['document.querySelector("#email").value'], bm);
256
+ expect(emailVal).toBe('test@example.com');
257
+
258
+ result = await handleWriteCommand('click', ['#login-btn'], bm);
259
+ expect(result).toContain('Clicked');
260
+ });
261
+
262
+ test('select works on dropdown', async () => {
263
+ await handleWriteCommand('goto', [baseUrl + '/forms.html'], bm);
264
+ const result = await handleWriteCommand('select', ['#role', 'admin'], bm);
265
+ expect(result).toContain('Selected');
266
+
267
+ const val = await handleReadCommand('js', ['document.querySelector("#role").value'], bm);
268
+ expect(val).toBe('admin');
269
+ });
270
+
271
+ test('click on option ref auto-routes to selectOption', async () => {
272
+ await handleWriteCommand('goto', [baseUrl + '/forms.html'], bm);
273
+ // Reset select to default
274
+ await handleReadCommand('js', ['document.querySelector("#role").value = ""'], bm);
275
+ const snap = await handleMetaCommand('snapshot', [], bm, async () => {});
276
+ // Find an option ref (e.g., "Admin" option)
277
+ const optionLine = snap.split('\n').find((l: string) => l.includes('[option]') && l.includes('"Admin"'));
278
+ expect(optionLine).toBeDefined();
279
+ const refMatch = optionLine!.match(/@(e\d+)/);
280
+ expect(refMatch).toBeDefined();
281
+ const ref = `@${refMatch![1]}`;
282
+ const result = await handleWriteCommand('click', [ref], bm);
283
+ expect(result).toContain('auto-routed');
284
+ expect(result).toContain('Selected');
285
+ // Verify the select value actually changed
286
+ const val = await handleReadCommand('js', ['document.querySelector("#role").value'], bm);
287
+ expect(val).toBe('admin');
288
+ });
289
+
290
+ test('click CSS selector on option gives helpful error', async () => {
291
+ await handleWriteCommand('goto', [baseUrl + '/forms.html'], bm);
292
+ try {
293
+ await handleWriteCommand('click', ['option[value="admin"]'], bm);
294
+ expect(true).toBe(false); // Should not reach here
295
+ } catch (err: any) {
296
+ expect(err.message).toContain('select');
297
+ expect(err.message).toContain('option');
298
+ }
299
+ }, 15000);
300
+
301
+ test('hover works', async () => {
302
+ const result = await handleWriteCommand('hover', ['h1'], bm);
303
+ expect(result).toContain('Hovered');
304
+ });
305
+
306
+ test('wait finds existing element', async () => {
307
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
308
+ const result = await handleWriteCommand('wait', ['#title'], bm);
309
+ expect(result).toContain('appeared');
310
+ });
311
+
312
+ test('scroll works', async () => {
313
+ const result = await handleWriteCommand('scroll', ['footer'], bm);
314
+ expect(result).toContain('Scrolled');
315
+ });
316
+
317
+ test('viewport changes size', async () => {
318
+ const result = await handleWriteCommand('viewport', ['375x812'], bm);
319
+ expect(result).toContain('Viewport set');
320
+
321
+ const size = await handleReadCommand('js', ['`${window.innerWidth}x${window.innerHeight}`'], bm);
322
+ expect(size).toBe('375x812');
323
+
324
+ // Reset
325
+ await handleWriteCommand('viewport', ['1280x720'], bm);
326
+ });
327
+
328
+ test('type and press work', async () => {
329
+ await handleWriteCommand('goto', [baseUrl + '/forms.html'], bm);
330
+ await handleWriteCommand('click', ['#name'], bm);
331
+
332
+ const result = await handleWriteCommand('type', ['John Doe'], bm);
333
+ expect(result).toContain('Typed');
334
+
335
+ const val = await handleReadCommand('js', ['document.querySelector("#name").value'], bm);
336
+ expect(val).toBe('John Doe');
337
+ });
338
+ });
339
+
340
+ // ─── SPA / Console / Network ───────────────────────────────────
341
+
342
+ describe('SPA and buffers', () => {
343
+ test('wait handles delayed rendering', async () => {
344
+ await handleWriteCommand('goto', [baseUrl + '/spa.html'], bm);
345
+ const result = await handleWriteCommand('wait', ['.loaded'], bm);
346
+ expect(result).toContain('appeared');
347
+
348
+ const text = await handleReadCommand('text', [], bm);
349
+ expect(text).toContain('SPA Content Loaded');
350
+ });
351
+
352
+ test('console captures messages', async () => {
353
+ const result = await handleReadCommand('console', [], bm);
354
+ expect(result).toContain('[SPA] Starting render');
355
+ expect(result).toContain('[SPA] Render complete');
356
+ });
357
+
358
+ test('console --clear clears buffer', async () => {
359
+ const result = await handleReadCommand('console', ['--clear'], bm);
360
+ expect(result).toContain('cleared');
361
+
362
+ const after = await handleReadCommand('console', [], bm);
363
+ expect(after).toContain('no console messages');
364
+ });
365
+
366
+ test('network captures requests', async () => {
367
+ const result = await handleReadCommand('network', [], bm);
368
+ expect(result).toContain('GET');
369
+ expect(result).toContain('/spa.html');
370
+ });
371
+
372
+ test('network --clear clears buffer', async () => {
373
+ const result = await handleReadCommand('network', ['--clear'], bm);
374
+ expect(result).toContain('cleared');
375
+ });
376
+ });
377
+
378
+ // ─── Cookies / Storage ──────────────────────────────────────────
379
+
380
+ describe('Cookies and storage', () => {
381
+ test('cookies returns array', async () => {
382
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
383
+ const result = await handleReadCommand('cookies', [], bm);
384
+ // Test server doesn't set cookies, so empty array
385
+ expect(result).toBe('[]');
386
+ });
387
+
388
+ test('storage set and get works', async () => {
389
+ await handleReadCommand('storage', ['set', 'testData', 'testValue'], bm);
390
+ const result = await handleReadCommand('storage', [], bm);
391
+ const storage = JSON.parse(result);
392
+ expect(storage.localStorage.testData).toBe('testValue');
393
+ });
394
+
395
+ test('storage read redacts sensitive keys', async () => {
396
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
397
+ await handleReadCommand('storage', ['set', 'auth_token', 'my-secret-token'], bm);
398
+ await handleReadCommand('storage', ['set', 'api_key', 'key-12345'], bm);
399
+ await handleReadCommand('storage', ['set', 'displayName', 'normalValue'], bm);
400
+ const result = await handleReadCommand('storage', [], bm);
401
+ const storage = JSON.parse(result);
402
+ expect(storage.localStorage.auth_token).toMatch(/REDACTED/);
403
+ expect(storage.localStorage.api_key).toMatch(/REDACTED/);
404
+ expect(storage.localStorage.displayName).toBe('normalValue');
405
+ });
406
+
407
+ test('storage read redacts sensitive values by prefix', async () => {
408
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
409
+ // JWT value under innocuous key name
410
+ await handleReadCommand('storage', ['set', 'userData', 'eyJhbGciOiJIUzI1NiJ9.payload.sig'], bm);
411
+ // GitHub PAT under innocuous key name
412
+ await handleReadCommand('storage', ['set', 'repoAccess', 'ghp_abc123def456'], bm);
413
+ const result = await handleReadCommand('storage', [], bm);
414
+ const storage = JSON.parse(result);
415
+ expect(storage.localStorage.userData).toMatch(/REDACTED/);
416
+ expect(storage.localStorage.repoAccess).toMatch(/REDACTED/);
417
+ });
418
+
419
+ test('storage redaction includes value length', async () => {
420
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
421
+ await handleReadCommand('storage', ['set', 'session_token', 'abc123'], bm);
422
+ const result = await handleReadCommand('storage', [], bm);
423
+ const storage = JSON.parse(result);
424
+ expect(storage.localStorage.session_token).toBe('[REDACTED — 6 chars]');
425
+ });
426
+ });
427
+
428
+ // ─── Performance ────────────────────────────────────────────────
429
+
430
+ describe('Performance', () => {
431
+ test('perf returns timing data', async () => {
432
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
433
+ const result = await handleReadCommand('perf', [], bm);
434
+ expect(result).toContain('dns');
435
+ expect(result).toContain('ttfb');
436
+ expect(result).toContain('load');
437
+ expect(result).toContain('ms');
438
+ });
439
+ });
440
+
441
+ // ─── Visual ─────────────────────────────────────────────────────
442
+
443
+ describe('Visual', () => {
444
+ test('screenshot saves file', async () => {
445
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
446
+ const screenshotPath = '/tmp/browse-test-screenshot.png';
447
+ const result = await handleMetaCommand('screenshot', [screenshotPath], bm, async () => {});
448
+ expect(result).toContain('Screenshot saved');
449
+ expect(fs.existsSync(screenshotPath)).toBe(true);
450
+ const stat = fs.statSync(screenshotPath);
451
+ expect(stat.size).toBeGreaterThan(1000);
452
+ fs.unlinkSync(screenshotPath);
453
+ });
454
+
455
+ test('screenshot --viewport saves viewport-only', async () => {
456
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
457
+ const p = '/tmp/browse-test-viewport.png';
458
+ const result = await handleMetaCommand('screenshot', ['--viewport', p], bm, async () => {});
459
+ expect(result).toContain('Screenshot saved (viewport)');
460
+ expect(fs.existsSync(p)).toBe(true);
461
+ expect(fs.statSync(p).size).toBeGreaterThan(1000);
462
+ fs.unlinkSync(p);
463
+ });
464
+
465
+ test('screenshot with CSS selector crops to element', async () => {
466
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
467
+ const p = '/tmp/browse-test-element-css.png';
468
+ const result = await handleMetaCommand('screenshot', ['#title', p], bm, async () => {});
469
+ expect(result).toContain('Screenshot saved (element)');
470
+ expect(fs.existsSync(p)).toBe(true);
471
+ expect(fs.statSync(p).size).toBeGreaterThan(100);
472
+ fs.unlinkSync(p);
473
+ });
474
+
475
+ test('screenshot with @ref crops to element', async () => {
476
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
477
+ await handleMetaCommand('snapshot', [], bm, async () => {});
478
+ const p = '/tmp/browse-test-element-ref.png';
479
+ const result = await handleMetaCommand('screenshot', ['@e1', p], bm, async () => {});
480
+ expect(result).toContain('Screenshot saved (element)');
481
+ expect(fs.existsSync(p)).toBe(true);
482
+ expect(fs.statSync(p).size).toBeGreaterThan(100);
483
+ fs.unlinkSync(p);
484
+ });
485
+
486
+ test('screenshot --clip crops to region', async () => {
487
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
488
+ const p = '/tmp/browse-test-clip.png';
489
+ const result = await handleMetaCommand('screenshot', ['--clip', '0,0,100,100', p], bm, async () => {});
490
+ expect(result).toContain('Screenshot saved (clip 0,0,100,100)');
491
+ expect(fs.existsSync(p)).toBe(true);
492
+ expect(fs.statSync(p).size).toBeGreaterThan(100);
493
+ fs.unlinkSync(p);
494
+ });
495
+
496
+ test('screenshot --clip + selector throws', async () => {
497
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
498
+ try {
499
+ await handleMetaCommand('screenshot', ['--clip', '0,0,100,100', '#title'], bm, async () => {});
500
+ expect(true).toBe(false);
501
+ } catch (err: any) {
502
+ expect(err.message).toContain('Cannot use --clip with a selector/ref');
503
+ }
504
+ });
505
+
506
+ test('screenshot --viewport + --clip throws', async () => {
507
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
508
+ try {
509
+ await handleMetaCommand('screenshot', ['--viewport', '--clip', '0,0,100,100'], bm, async () => {});
510
+ expect(true).toBe(false);
511
+ } catch (err: any) {
512
+ expect(err.message).toContain('Cannot use --viewport with --clip');
513
+ }
514
+ });
515
+
516
+ test('screenshot --clip with invalid coords throws', async () => {
517
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
518
+ try {
519
+ await handleMetaCommand('screenshot', ['--clip', 'abc'], bm, async () => {});
520
+ expect(true).toBe(false);
521
+ } catch (err: any) {
522
+ expect(err.message).toContain('all must be numbers');
523
+ }
524
+ });
525
+
526
+ test('screenshot unknown flag throws', async () => {
527
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
528
+ try {
529
+ await handleMetaCommand('screenshot', ['--bogus', '/tmp/foo.png'], bm, async () => {});
530
+ expect(true).toBe(false);
531
+ } catch (err: any) {
532
+ expect(err.message).toContain('Unknown screenshot flag');
533
+ }
534
+ });
535
+
536
+ test('screenshot --viewport still validates path', async () => {
537
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
538
+ try {
539
+ await handleMetaCommand('screenshot', ['--viewport', '/etc/evil.png'], bm, async () => {});
540
+ expect(true).toBe(false);
541
+ } catch (err: any) {
542
+ expect(err.message).toContain('Path must be within');
543
+ }
544
+ });
545
+
546
+ test('screenshot with nonexistent selector throws timeout', async () => {
547
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
548
+ try {
549
+ await handleMetaCommand('screenshot', ['.nonexistent-element-xyz'], bm, async () => {});
550
+ expect(true).toBe(false);
551
+ } catch (err: any) {
552
+ expect(err.message).toBeDefined();
553
+ }
554
+ }, 10000);
555
+
556
+ test('responsive saves 3 screenshots', async () => {
557
+ await handleWriteCommand('goto', [baseUrl + '/responsive.html'], bm);
558
+ const prefix = '/tmp/browse-test-resp';
559
+ const result = await handleMetaCommand('responsive', [prefix], bm, async () => {});
560
+ expect(result).toContain('mobile');
561
+ expect(result).toContain('tablet');
562
+ expect(result).toContain('desktop');
563
+
564
+ expect(fs.existsSync(`${prefix}-mobile.png`)).toBe(true);
565
+ expect(fs.existsSync(`${prefix}-tablet.png`)).toBe(true);
566
+ expect(fs.existsSync(`${prefix}-desktop.png`)).toBe(true);
567
+
568
+ // Cleanup
569
+ fs.unlinkSync(`${prefix}-mobile.png`);
570
+ fs.unlinkSync(`${prefix}-tablet.png`);
571
+ fs.unlinkSync(`${prefix}-desktop.png`);
572
+ });
573
+ });
574
+
575
+ // ─── Tabs ───────────────────────────────────────────────────────
576
+
577
+ describe('Tabs', () => {
578
+ test('tabs lists all tabs', async () => {
579
+ const result = await handleMetaCommand('tabs', [], bm, async () => {});
580
+ expect(result).toContain('[');
581
+ expect(result).toContain(']');
582
+ });
583
+
584
+ test('newtab opens new tab', async () => {
585
+ const result = await handleMetaCommand('newtab', [baseUrl + '/forms.html'], bm, async () => {});
586
+ expect(result).toContain('Opened tab');
587
+
588
+ const tabCount = bm.getTabCount();
589
+ expect(tabCount).toBeGreaterThanOrEqual(2);
590
+ });
591
+
592
+ test('tab switches to specific tab', async () => {
593
+ const result = await handleMetaCommand('tab', ['1'], bm, async () => {});
594
+ expect(result).toContain('Switched to tab 1');
595
+ });
596
+
597
+ test('closetab closes a tab', async () => {
598
+ const before = bm.getTabCount();
599
+ // Close the last opened tab
600
+ const tabs = await bm.getTabListWithTitles();
601
+ const lastTab = tabs[tabs.length - 1];
602
+ const result = await handleMetaCommand('closetab', [String(lastTab.id)], bm, async () => {});
603
+ expect(result).toContain('Closed tab');
604
+ expect(bm.getTabCount()).toBe(before - 1);
605
+ });
606
+ });
607
+
608
+ // ─── Diff ───────────────────────────────────────────────────────
609
+
610
+ describe('Diff', () => {
611
+ test('diff shows differences between pages', async () => {
612
+ const result = await handleMetaCommand(
613
+ 'diff',
614
+ [baseUrl + '/basic.html', baseUrl + '/forms.html'],
615
+ bm,
616
+ async () => {}
617
+ );
618
+ expect(result).toContain('---');
619
+ expect(result).toContain('+++');
620
+ // basic.html has "Hello World", forms.html has "Form Test Page"
621
+ expect(result).toContain('Hello World');
622
+ expect(result).toContain('Form Test Page');
623
+ });
624
+ });
625
+
626
+ // ─── Chain ──────────────────────────────────────────────────────
627
+
628
+ describe('Chain', () => {
629
+ test('chain executes sequence of commands', async () => {
630
+ const commands = JSON.stringify([
631
+ ['goto', baseUrl + '/basic.html'],
632
+ ['js', 'document.title'],
633
+ ['css', 'h1', 'color'],
634
+ ]);
635
+ const result = await handleMetaCommand('chain', [commands], bm, async () => {});
636
+ expect(result).toContain('[goto]');
637
+ expect(result).toContain('Test Page - Basic');
638
+ expect(result).toContain('[css]');
639
+ });
640
+
641
+ test('chain reports real error when write command fails', async () => {
642
+ const commands = JSON.stringify([
643
+ ['goto', 'http://localhost:1/unreachable'],
644
+ ]);
645
+ const result = await handleMetaCommand('chain', [commands], bm, async () => {});
646
+ expect(result).toContain('[goto] ERROR:');
647
+ expect(result).not.toContain('Unknown meta command');
648
+ expect(result).not.toContain('Unknown read command');
649
+ });
650
+ });
651
+
652
+ // ─── Status ─────────────────────────────────────────────────────
653
+
654
+ describe('Status', () => {
655
+ test('status reports health', async () => {
656
+ const result = await handleMetaCommand('status', [], bm, async () => {});
657
+ expect(result).toContain('Status: healthy');
658
+ expect(result).toContain('Tabs:');
659
+ });
660
+ });
661
+
662
+ // ─── CLI server script resolution ───────────────────────────────
663
+
664
+ describe('CLI server script resolution', () => {
665
+ test('prefers adjacent browse/src/server.ts for compiled project installs', () => {
666
+ const root = fs.mkdtempSync('/tmp/gstack-cli-');
667
+ const execPath = path.join(root, '.claude/skills/gstack/browse/dist/browse');
668
+ const serverPath = path.join(root, '.claude/skills/gstack/browse/src/server.ts');
669
+
670
+ fs.mkdirSync(path.dirname(execPath), { recursive: true });
671
+ fs.mkdirSync(path.dirname(serverPath), { recursive: true });
672
+ fs.writeFileSync(serverPath, '// test server\n');
673
+
674
+ const resolved = resolveServerScript(
675
+ { HOME: path.join(root, 'empty-home') },
676
+ '$bunfs/root',
677
+ execPath
678
+ );
679
+
680
+ expect(resolved).toBe(serverPath);
681
+
682
+ fs.rmSync(root, { recursive: true, force: true });
683
+ });
684
+ });
685
+
686
+ // ─── CLI lifecycle ──────────────────────────────────────────────
687
+
688
+ describe('CLI lifecycle', () => {
689
+ test('dead state file triggers a clean restart', async () => {
690
+ const stateFile = `/tmp/browse-test-state-${Date.now()}.json`;
691
+ fs.writeFileSync(stateFile, JSON.stringify({
692
+ port: 1,
693
+ token: 'fake',
694
+ pid: 999999,
695
+ }));
696
+
697
+ const cliPath = path.resolve(__dirname, '../src/cli.ts');
698
+ const cliEnv: Record<string, string> = {};
699
+ for (const [k, v] of Object.entries(process.env)) {
700
+ if (v !== undefined) cliEnv[k] = v;
701
+ }
702
+ cliEnv.BROWSE_STATE_FILE = stateFile;
703
+ const result = await new Promise<{ code: number; stdout: string; stderr: string }>((resolve) => {
704
+ const proc = spawn('bun', ['run', cliPath, 'status'], {
705
+ timeout: 15000,
706
+ env: cliEnv,
707
+ });
708
+ let stdout = '';
709
+ let stderr = '';
710
+ proc.stdout.on('data', (d) => stdout += d.toString());
711
+ proc.stderr.on('data', (d) => stderr += d.toString());
712
+ proc.on('close', (code) => resolve({ code: code ?? 1, stdout, stderr }));
713
+ });
714
+
715
+ let restartedPid: number | null = null;
716
+ if (fs.existsSync(stateFile)) {
717
+ restartedPid = JSON.parse(fs.readFileSync(stateFile, 'utf-8')).pid;
718
+ fs.unlinkSync(stateFile);
719
+ }
720
+ if (restartedPid) {
721
+ try { process.kill(restartedPid, 'SIGTERM'); } catch {}
722
+ }
723
+
724
+ expect(result.code).toBe(0);
725
+ expect(result.stdout).toContain('Status: healthy');
726
+ expect(result.stderr).toContain('Starting server');
727
+ }, 20000);
728
+ });
729
+
730
+ // ─── Buffer bounds ──────────────────────────────────────────────
731
+
732
+ describe('Buffer bounds', () => {
733
+ test('console buffer caps at 50000 entries', () => {
734
+ consoleBuffer.clear();
735
+ for (let i = 0; i < 50_010; i++) {
736
+ addConsoleEntry({ timestamp: i, level: 'log', text: `msg-${i}` });
737
+ }
738
+ expect(consoleBuffer.length).toBe(50_000);
739
+ const entries = consoleBuffer.toArray();
740
+ expect(entries[0].text).toBe('msg-10');
741
+ expect(entries[entries.length - 1].text).toBe('msg-50009');
742
+ consoleBuffer.clear();
743
+ });
744
+
745
+ test('network buffer caps at 50000 entries', () => {
746
+ networkBuffer.clear();
747
+ for (let i = 0; i < 50_010; i++) {
748
+ addNetworkEntry({ timestamp: i, method: 'GET', url: `http://x/${i}` });
749
+ }
750
+ expect(networkBuffer.length).toBe(50_000);
751
+ const entries = networkBuffer.toArray();
752
+ expect(entries[0].url).toBe('http://x/10');
753
+ expect(entries[entries.length - 1].url).toBe('http://x/50009');
754
+ networkBuffer.clear();
755
+ });
756
+
757
+ test('totalAdded counters keep incrementing past buffer cap', () => {
758
+ const startConsole = consoleBuffer.totalAdded;
759
+ const startNetwork = networkBuffer.totalAdded;
760
+ for (let i = 0; i < 100; i++) {
761
+ addConsoleEntry({ timestamp: i, level: 'log', text: `t-${i}` });
762
+ addNetworkEntry({ timestamp: i, method: 'GET', url: `http://t/${i}` });
763
+ }
764
+ expect(consoleBuffer.totalAdded).toBe(startConsole + 100);
765
+ expect(networkBuffer.totalAdded).toBe(startNetwork + 100);
766
+ consoleBuffer.clear();
767
+ networkBuffer.clear();
768
+ });
769
+ });
770
+
771
+ // ─── CircularBuffer Unit Tests ─────────────────────────────────
772
+
773
+ describe('CircularBuffer', () => {
774
+ test('push and toArray return items in insertion order', () => {
775
+ const buf = new CircularBuffer<number>(5);
776
+ buf.push(1); buf.push(2); buf.push(3);
777
+ expect(buf.toArray()).toEqual([1, 2, 3]);
778
+ expect(buf.length).toBe(3);
779
+ });
780
+
781
+ test('overwrites oldest when full', () => {
782
+ const buf = new CircularBuffer<number>(3);
783
+ buf.push(1); buf.push(2); buf.push(3); buf.push(4);
784
+ expect(buf.toArray()).toEqual([2, 3, 4]);
785
+ expect(buf.length).toBe(3);
786
+ });
787
+
788
+ test('totalAdded increments past capacity', () => {
789
+ const buf = new CircularBuffer<number>(2);
790
+ buf.push(1); buf.push(2); buf.push(3); buf.push(4); buf.push(5);
791
+ expect(buf.totalAdded).toBe(5);
792
+ expect(buf.length).toBe(2);
793
+ expect(buf.toArray()).toEqual([4, 5]);
794
+ });
795
+
796
+ test('last(n) returns most recent entries', () => {
797
+ const buf = new CircularBuffer<number>(5);
798
+ for (let i = 1; i <= 5; i++) buf.push(i);
799
+ expect(buf.last(3)).toEqual([3, 4, 5]);
800
+ expect(buf.last(10)).toEqual([1, 2, 3, 4, 5]); // clamped
801
+ expect(buf.last(1)).toEqual([5]);
802
+ });
803
+
804
+ test('get and set work by index', () => {
805
+ const buf = new CircularBuffer<string>(3);
806
+ buf.push('a'); buf.push('b'); buf.push('c');
807
+ expect(buf.get(0)).toBe('a');
808
+ expect(buf.get(2)).toBe('c');
809
+ buf.set(1, 'B');
810
+ expect(buf.get(1)).toBe('B');
811
+ expect(buf.get(-1)).toBeUndefined();
812
+ expect(buf.get(5)).toBeUndefined();
813
+ });
814
+
815
+ test('clear resets size but not totalAdded', () => {
816
+ const buf = new CircularBuffer<number>(5);
817
+ buf.push(1); buf.push(2); buf.push(3);
818
+ buf.clear();
819
+ expect(buf.length).toBe(0);
820
+ expect(buf.totalAdded).toBe(3);
821
+ expect(buf.toArray()).toEqual([]);
822
+ });
823
+
824
+ test('works with capacity=1', () => {
825
+ const buf = new CircularBuffer<number>(1);
826
+ buf.push(10);
827
+ expect(buf.toArray()).toEqual([10]);
828
+ buf.push(20);
829
+ expect(buf.toArray()).toEqual([20]);
830
+ expect(buf.totalAdded).toBe(2);
831
+ });
832
+ });
833
+
834
+ // ─── Dialog Handling ─────────────────────────────────────────
835
+
836
+ describe('Dialog handling', () => {
837
+ test('alert does not hang — auto-accepted', async () => {
838
+ await handleWriteCommand('goto', [baseUrl + '/dialog.html'], bm);
839
+ await handleWriteCommand('click', ['#alert-btn'], bm);
840
+ // If we get here, dialog was handled (no hang)
841
+ const result = await handleReadCommand('dialog', [], bm);
842
+ expect(result).toContain('alert');
843
+ expect(result).toContain('Hello from alert');
844
+ expect(result).toContain('accepted');
845
+ });
846
+
847
+ test('confirm is auto-accepted by default', async () => {
848
+ await handleWriteCommand('goto', [baseUrl + '/dialog.html'], bm);
849
+ await handleWriteCommand('click', ['#confirm-btn'], bm);
850
+ // Wait for DOM update
851
+ await new Promise(r => setTimeout(r, 100));
852
+ const result = await handleReadCommand('js', ['document.querySelector("#confirm-result").textContent'], bm);
853
+ expect(result).toBe('confirmed');
854
+ });
855
+
856
+ test('dialog-dismiss changes behavior', async () => {
857
+ const setResult = await handleWriteCommand('dialog-dismiss', [], bm);
858
+ expect(setResult).toContain('dismissed');
859
+
860
+ await handleWriteCommand('goto', [baseUrl + '/dialog.html'], bm);
861
+ await handleWriteCommand('click', ['#confirm-btn'], bm);
862
+ await new Promise(r => setTimeout(r, 100));
863
+ const result = await handleReadCommand('js', ['document.querySelector("#confirm-result").textContent'], bm);
864
+ expect(result).toBe('cancelled');
865
+
866
+ // Reset to accept
867
+ await handleWriteCommand('dialog-accept', [], bm);
868
+ });
869
+
870
+ test('dialog-accept with text provides prompt response', async () => {
871
+ const setResult = await handleWriteCommand('dialog-accept', ['TestUser'], bm);
872
+ expect(setResult).toContain('TestUser');
873
+
874
+ await handleWriteCommand('goto', [baseUrl + '/dialog.html'], bm);
875
+ await handleWriteCommand('click', ['#prompt-btn'], bm);
876
+ await new Promise(r => setTimeout(r, 100));
877
+ const result = await handleReadCommand('js', ['document.querySelector("#prompt-result").textContent'], bm);
878
+ expect(result).toBe('TestUser');
879
+
880
+ // Reset
881
+ await handleWriteCommand('dialog-accept', [], bm);
882
+ });
883
+
884
+ test('dialog --clear clears buffer', async () => {
885
+ const cleared = await handleReadCommand('dialog', ['--clear'], bm);
886
+ expect(cleared).toContain('cleared');
887
+ const after = await handleReadCommand('dialog', [], bm);
888
+ expect(after).toContain('no dialogs');
889
+ });
890
+ });
891
+
892
+ // ─── Element State Checks (is) ─────────────────────────────────
893
+
894
+ describe('Element state checks', () => {
895
+ beforeAll(async () => {
896
+ await handleWriteCommand('goto', [baseUrl + '/states.html'], bm);
897
+ });
898
+
899
+ test('is visible returns true for visible element', async () => {
900
+ const result = await handleReadCommand('is', ['visible', '#visible-div'], bm);
901
+ expect(result).toBe('true');
902
+ });
903
+
904
+ test('is hidden returns true for hidden element', async () => {
905
+ const result = await handleReadCommand('is', ['hidden', '#hidden-div'], bm);
906
+ expect(result).toBe('true');
907
+ });
908
+
909
+ test('is visible returns false for hidden element', async () => {
910
+ const result = await handleReadCommand('is', ['visible', '#hidden-div'], bm);
911
+ expect(result).toBe('false');
912
+ });
913
+
914
+ test('is enabled returns true for enabled input', async () => {
915
+ const result = await handleReadCommand('is', ['enabled', '#enabled-input'], bm);
916
+ expect(result).toBe('true');
917
+ });
918
+
919
+ test('is disabled returns true for disabled input', async () => {
920
+ const result = await handleReadCommand('is', ['disabled', '#disabled-input'], bm);
921
+ expect(result).toBe('true');
922
+ });
923
+
924
+ test('is checked returns true for checked checkbox', async () => {
925
+ const result = await handleReadCommand('is', ['checked', '#checked-box'], bm);
926
+ expect(result).toBe('true');
927
+ });
928
+
929
+ test('is checked returns false for unchecked checkbox', async () => {
930
+ const result = await handleReadCommand('is', ['checked', '#unchecked-box'], bm);
931
+ expect(result).toBe('false');
932
+ });
933
+
934
+ test('is editable returns true for normal input', async () => {
935
+ const result = await handleReadCommand('is', ['editable', '#enabled-input'], bm);
936
+ expect(result).toBe('true');
937
+ });
938
+
939
+ test('is editable returns false for readonly input', async () => {
940
+ const result = await handleReadCommand('is', ['editable', '#readonly-input'], bm);
941
+ expect(result).toBe('false');
942
+ });
943
+
944
+ test('is focused after click', async () => {
945
+ await handleWriteCommand('click', ['#enabled-input'], bm);
946
+ const result = await handleReadCommand('is', ['focused', '#enabled-input'], bm);
947
+ expect(result).toBe('true');
948
+ });
949
+
950
+ test('is with @ref works', async () => {
951
+ await handleMetaCommand('snapshot', ['-i'], bm, async () => {});
952
+ // Find a ref for the enabled input
953
+ const snap = await handleMetaCommand('snapshot', ['-i'], bm, async () => {});
954
+ const textboxLine = snap.split('\n').find(l => l.includes('[textbox]'));
955
+ if (textboxLine) {
956
+ const refMatch = textboxLine.match(/@(e\d+)/);
957
+ if (refMatch) {
958
+ const ref = `@${refMatch[1]}`;
959
+ const result = await handleReadCommand('is', ['visible', ref], bm);
960
+ expect(result).toBe('true');
961
+ }
962
+ }
963
+ });
964
+
965
+ test('is with unknown property throws', async () => {
966
+ try {
967
+ await handleReadCommand('is', ['bogus', '#enabled-input'], bm);
968
+ expect(true).toBe(false);
969
+ } catch (err: any) {
970
+ expect(err.message).toContain('Unknown property');
971
+ }
972
+ });
973
+
974
+ test('is with missing args throws', async () => {
975
+ try {
976
+ await handleReadCommand('is', ['visible'], bm);
977
+ expect(true).toBe(false);
978
+ } catch (err: any) {
979
+ expect(err.message).toContain('Usage');
980
+ }
981
+ });
982
+ });
983
+
984
+ // ─── File Upload ─────────────────────────────────────────────────
985
+
986
+ describe('File upload', () => {
987
+ test('upload single file', async () => {
988
+ await handleWriteCommand('goto', [baseUrl + '/upload.html'], bm);
989
+ // Create a temp file to upload
990
+ const tempFile = '/tmp/browse-test-upload.txt';
991
+ fs.writeFileSync(tempFile, 'test content');
992
+ const result = await handleWriteCommand('upload', ['#file-input', tempFile], bm);
993
+ expect(result).toContain('Uploaded');
994
+ expect(result).toContain('browse-test-upload.txt');
995
+
996
+ // Verify upload handler fired
997
+ await new Promise(r => setTimeout(r, 100));
998
+ const text = await handleReadCommand('js', ['document.querySelector("#upload-result").textContent'], bm);
999
+ expect(text).toContain('browse-test-upload.txt');
1000
+ fs.unlinkSync(tempFile);
1001
+ });
1002
+
1003
+ test('upload with @ref works', async () => {
1004
+ await handleWriteCommand('goto', [baseUrl + '/upload.html'], bm);
1005
+ const tempFile = '/tmp/browse-test-upload2.txt';
1006
+ fs.writeFileSync(tempFile, 'ref upload test');
1007
+ const snap = await handleMetaCommand('snapshot', ['-i'], bm, async () => {});
1008
+ // Find the file input ref (it won't appear as "file input" in aria — use CSS selector instead)
1009
+ const result = await handleWriteCommand('upload', ['#file-input', tempFile], bm);
1010
+ expect(result).toContain('Uploaded');
1011
+ fs.unlinkSync(tempFile);
1012
+ });
1013
+
1014
+ test('upload nonexistent file throws', async () => {
1015
+ await handleWriteCommand('goto', [baseUrl + '/upload.html'], bm);
1016
+ try {
1017
+ await handleWriteCommand('upload', ['#file-input', '/tmp/nonexistent-file-12345.txt'], bm);
1018
+ expect(true).toBe(false);
1019
+ } catch (err: any) {
1020
+ expect(err.message).toContain('File not found');
1021
+ }
1022
+ });
1023
+
1024
+ test('upload missing args throws', async () => {
1025
+ try {
1026
+ await handleWriteCommand('upload', ['#file-input'], bm);
1027
+ expect(true).toBe(false);
1028
+ } catch (err: any) {
1029
+ expect(err.message).toContain('Usage');
1030
+ }
1031
+ });
1032
+ });
1033
+
1034
+ // ─── Eval command ───────────────────────────────────────────────
1035
+
1036
+ describe('Eval', () => {
1037
+ test('eval runs JS file', async () => {
1038
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
1039
+ const tempFile = '/tmp/browse-test-eval.js';
1040
+ fs.writeFileSync(tempFile, 'document.title + " — evaluated"');
1041
+ const result = await handleReadCommand('eval', [tempFile], bm);
1042
+ expect(result).toBe('Test Page - Basic — evaluated');
1043
+ fs.unlinkSync(tempFile);
1044
+ });
1045
+
1046
+ test('eval returns object as JSON', async () => {
1047
+ const tempFile = '/tmp/browse-test-eval-obj.js';
1048
+ fs.writeFileSync(tempFile, '({title: document.title, keys: Object.keys(document.body.dataset)})');
1049
+ const result = await handleReadCommand('eval', [tempFile], bm);
1050
+ const obj = JSON.parse(result);
1051
+ expect(obj.title).toBe('Test Page - Basic');
1052
+ expect(Array.isArray(obj.keys)).toBe(true);
1053
+ fs.unlinkSync(tempFile);
1054
+ });
1055
+
1056
+ test('eval file not found throws', async () => {
1057
+ try {
1058
+ await handleReadCommand('eval', ['/tmp/nonexistent-eval.js'], bm);
1059
+ expect(true).toBe(false);
1060
+ } catch (err: any) {
1061
+ expect(err.message).toContain('File not found');
1062
+ }
1063
+ });
1064
+
1065
+ test('eval no arg throws', async () => {
1066
+ try {
1067
+ await handleReadCommand('eval', [], bm);
1068
+ expect(true).toBe(false);
1069
+ } catch (err: any) {
1070
+ expect(err.message).toContain('Usage');
1071
+ }
1072
+ });
1073
+ });
1074
+
1075
+ // ─── Press command ──────────────────────────────────────────────
1076
+
1077
+ describe('Press', () => {
1078
+ test('press Tab moves focus', async () => {
1079
+ await handleWriteCommand('goto', [baseUrl + '/forms.html'], bm);
1080
+ await handleWriteCommand('click', ['#email'], bm);
1081
+ const result = await handleWriteCommand('press', ['Tab'], bm);
1082
+ expect(result).toContain('Pressed Tab');
1083
+ });
1084
+
1085
+ test('press no arg throws', async () => {
1086
+ try {
1087
+ await handleWriteCommand('press', [], bm);
1088
+ expect(true).toBe(false);
1089
+ } catch (err: any) {
1090
+ expect(err.message).toContain('Usage');
1091
+ }
1092
+ });
1093
+ });
1094
+
1095
+ // ─── Cookie command ─────────────────────────────────────────────
1096
+
1097
+ describe('Cookie command', () => {
1098
+ test('cookie sets value', async () => {
1099
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
1100
+ const result = await handleWriteCommand('cookie', ['testcookie=testvalue'], bm);
1101
+ expect(result).toContain('Cookie set');
1102
+
1103
+ const cookies = await handleReadCommand('cookies', [], bm);
1104
+ expect(cookies).toContain('testcookie');
1105
+ expect(cookies).toContain('testvalue');
1106
+ });
1107
+
1108
+ test('cookie no arg throws', async () => {
1109
+ try {
1110
+ await handleWriteCommand('cookie', [], bm);
1111
+ expect(true).toBe(false);
1112
+ } catch (err: any) {
1113
+ expect(err.message).toContain('Usage');
1114
+ }
1115
+ });
1116
+
1117
+ test('cookie no = throws', async () => {
1118
+ try {
1119
+ await handleWriteCommand('cookie', ['invalid'], bm);
1120
+ expect(true).toBe(false);
1121
+ } catch (err: any) {
1122
+ expect(err.message).toContain('Usage');
1123
+ }
1124
+ });
1125
+ });
1126
+
1127
+ // ─── Header command ─────────────────────────────────────────────
1128
+
1129
+ describe('Header command', () => {
1130
+ test('header sets value and is sent', async () => {
1131
+ const result = await handleWriteCommand('header', ['X-Test:test-value'], bm);
1132
+ expect(result).toContain('Header set');
1133
+
1134
+ await handleWriteCommand('goto', [baseUrl + '/echo'], bm);
1135
+ const echoText = await handleReadCommand('text', [], bm);
1136
+ expect(echoText).toContain('x-test');
1137
+ expect(echoText).toContain('test-value');
1138
+ });
1139
+
1140
+ test('header no arg throws', async () => {
1141
+ try {
1142
+ await handleWriteCommand('header', [], bm);
1143
+ expect(true).toBe(false);
1144
+ } catch (err: any) {
1145
+ expect(err.message).toContain('Usage');
1146
+ }
1147
+ });
1148
+
1149
+ test('header no colon throws', async () => {
1150
+ try {
1151
+ await handleWriteCommand('header', ['invalid'], bm);
1152
+ expect(true).toBe(false);
1153
+ } catch (err: any) {
1154
+ expect(err.message).toContain('Usage');
1155
+ }
1156
+ });
1157
+ });
1158
+
1159
+ // ─── PDF command ────────────────────────────────────────────────
1160
+
1161
+ describe('PDF', () => {
1162
+ test('pdf saves file with size', async () => {
1163
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
1164
+ const pdfPath = '/tmp/browse-test.pdf';
1165
+ const result = await handleMetaCommand('pdf', [pdfPath], bm, async () => {});
1166
+ expect(result).toContain('PDF saved');
1167
+ expect(fs.existsSync(pdfPath)).toBe(true);
1168
+ const stat = fs.statSync(pdfPath);
1169
+ expect(stat.size).toBeGreaterThan(100);
1170
+ fs.unlinkSync(pdfPath);
1171
+ });
1172
+ });
1173
+
1174
+ // ─── Empty page edge cases ──────────────────────────────────────
1175
+
1176
+ describe('Empty page', () => {
1177
+ test('text returns empty on empty page', async () => {
1178
+ await handleWriteCommand('goto', [baseUrl + '/empty.html'], bm);
1179
+ const result = await handleReadCommand('text', [], bm);
1180
+ expect(result).toBe('');
1181
+ });
1182
+
1183
+ test('links returns empty on empty page', async () => {
1184
+ const result = await handleReadCommand('links', [], bm);
1185
+ expect(result).toBe('');
1186
+ });
1187
+
1188
+ test('forms returns empty array on empty page', async () => {
1189
+ const result = await handleReadCommand('forms', [], bm);
1190
+ expect(JSON.parse(result)).toEqual([]);
1191
+ });
1192
+ });
1193
+
1194
+ // ─── Error paths ────────────────────────────────────────────────
1195
+
1196
+ describe('Errors', () => {
1197
+ // Write command errors
1198
+ test('goto with no arg throws', async () => {
1199
+ try {
1200
+ await handleWriteCommand('goto', [], bm);
1201
+ expect(true).toBe(false);
1202
+ } catch (err: any) {
1203
+ expect(err.message).toContain('Usage');
1204
+ }
1205
+ });
1206
+
1207
+ test('click with no arg throws', async () => {
1208
+ try {
1209
+ await handleWriteCommand('click', [], bm);
1210
+ expect(true).toBe(false);
1211
+ } catch (err: any) {
1212
+ expect(err.message).toContain('Usage');
1213
+ }
1214
+ });
1215
+
1216
+ test('fill with no value throws', async () => {
1217
+ try {
1218
+ await handleWriteCommand('fill', ['#input'], bm);
1219
+ expect(true).toBe(false);
1220
+ } catch (err: any) {
1221
+ expect(err.message).toContain('Usage');
1222
+ }
1223
+ });
1224
+
1225
+ test('select with no value throws', async () => {
1226
+ try {
1227
+ await handleWriteCommand('select', ['#sel'], bm);
1228
+ expect(true).toBe(false);
1229
+ } catch (err: any) {
1230
+ expect(err.message).toContain('Usage');
1231
+ }
1232
+ });
1233
+
1234
+ test('hover with no arg throws', async () => {
1235
+ try {
1236
+ await handleWriteCommand('hover', [], bm);
1237
+ expect(true).toBe(false);
1238
+ } catch (err: any) {
1239
+ expect(err.message).toContain('Usage');
1240
+ }
1241
+ });
1242
+
1243
+ test('type with no arg throws', async () => {
1244
+ try {
1245
+ await handleWriteCommand('type', [], bm);
1246
+ expect(true).toBe(false);
1247
+ } catch (err: any) {
1248
+ expect(err.message).toContain('Usage');
1249
+ }
1250
+ });
1251
+
1252
+ test('wait with no arg throws', async () => {
1253
+ try {
1254
+ await handleWriteCommand('wait', [], bm);
1255
+ expect(true).toBe(false);
1256
+ } catch (err: any) {
1257
+ expect(err.message).toContain('Usage');
1258
+ }
1259
+ });
1260
+
1261
+ test('viewport with bad format throws', async () => {
1262
+ try {
1263
+ await handleWriteCommand('viewport', ['badformat'], bm);
1264
+ expect(true).toBe(false);
1265
+ } catch (err: any) {
1266
+ expect(err.message).toContain('Usage');
1267
+ }
1268
+ });
1269
+
1270
+ test('useragent with no arg throws', async () => {
1271
+ try {
1272
+ await handleWriteCommand('useragent', [], bm);
1273
+ expect(true).toBe(false);
1274
+ } catch (err: any) {
1275
+ expect(err.message).toContain('Usage');
1276
+ }
1277
+ });
1278
+
1279
+ // Read command errors
1280
+ test('js with no expression throws', async () => {
1281
+ try {
1282
+ await handleReadCommand('js', [], bm);
1283
+ expect(true).toBe(false);
1284
+ } catch (err: any) {
1285
+ expect(err.message).toContain('Usage');
1286
+ }
1287
+ });
1288
+
1289
+ test('css with missing property throws', async () => {
1290
+ try {
1291
+ await handleReadCommand('css', ['h1'], bm);
1292
+ expect(true).toBe(false);
1293
+ } catch (err: any) {
1294
+ expect(err.message).toContain('Usage');
1295
+ }
1296
+ });
1297
+
1298
+ test('attrs with no selector throws', async () => {
1299
+ try {
1300
+ await handleReadCommand('attrs', [], bm);
1301
+ expect(true).toBe(false);
1302
+ } catch (err: any) {
1303
+ expect(err.message).toContain('Usage');
1304
+ }
1305
+ });
1306
+
1307
+ // Meta command errors
1308
+ test('tab with non-numeric id throws', async () => {
1309
+ try {
1310
+ await handleMetaCommand('tab', ['abc'], bm, async () => {});
1311
+ expect(true).toBe(false);
1312
+ } catch (err: any) {
1313
+ expect(err.message).toContain('Usage');
1314
+ }
1315
+ });
1316
+
1317
+ test('diff with missing urls throws', async () => {
1318
+ try {
1319
+ await handleMetaCommand('diff', [baseUrl + '/basic.html'], bm, async () => {});
1320
+ expect(true).toBe(false);
1321
+ } catch (err: any) {
1322
+ expect(err.message).toContain('Usage');
1323
+ }
1324
+ });
1325
+
1326
+ test('chain with invalid JSON throws', async () => {
1327
+ try {
1328
+ await handleMetaCommand('chain', ['not json'], bm, async () => {});
1329
+ expect(true).toBe(false);
1330
+ } catch (err: any) {
1331
+ expect(err.message).toContain('Invalid JSON');
1332
+ }
1333
+ });
1334
+
1335
+ test('chain with no arg throws', async () => {
1336
+ try {
1337
+ await handleMetaCommand('chain', [], bm, async () => {});
1338
+ expect(true).toBe(false);
1339
+ } catch (err: any) {
1340
+ expect(err.message).toContain('Usage');
1341
+ }
1342
+ });
1343
+
1344
+ test('unknown read command throws', async () => {
1345
+ try {
1346
+ await handleReadCommand('bogus' as any, [], bm);
1347
+ expect(true).toBe(false);
1348
+ } catch (err: any) {
1349
+ expect(err.message).toContain('Unknown');
1350
+ }
1351
+ });
1352
+
1353
+ test('unknown write command throws', async () => {
1354
+ try {
1355
+ await handleWriteCommand('bogus' as any, [], bm);
1356
+ expect(true).toBe(false);
1357
+ } catch (err: any) {
1358
+ expect(err.message).toContain('Unknown');
1359
+ }
1360
+ });
1361
+
1362
+ test('unknown meta command throws', async () => {
1363
+ try {
1364
+ await handleMetaCommand('bogus' as any, [], bm, async () => {});
1365
+ expect(true).toBe(false);
1366
+ } catch (err: any) {
1367
+ expect(err.message).toContain('Unknown');
1368
+ }
1369
+ });
1370
+ });
1371
+
1372
+ // ─── Workflow: Navigation + Snapshot + Interaction ───────────────
1373
+
1374
+ describe('Workflows', () => {
1375
+ test('navigation → snapshot → click @ref → verify URL', async () => {
1376
+ await handleWriteCommand('goto', [baseUrl + '/snapshot.html'], bm);
1377
+ const snap = await handleMetaCommand('snapshot', ['-i'], bm, async () => {});
1378
+ // Find a link ref
1379
+ const linkLine = snap.split('\n').find(l => l.includes('[link]'));
1380
+ expect(linkLine).toBeDefined();
1381
+ const refMatch = linkLine!.match(/@(e\d+)/);
1382
+ expect(refMatch).toBeDefined();
1383
+ // Click the link
1384
+ await handleWriteCommand('click', [`@${refMatch![1]}`], bm);
1385
+ // URL should have changed
1386
+ const url = await handleMetaCommand('url', [], bm, async () => {});
1387
+ expect(url).toBeTruthy();
1388
+ });
1389
+
1390
+ test('form: goto → snapshot → fill @ref → click @ref', async () => {
1391
+ await handleWriteCommand('goto', [baseUrl + '/snapshot.html'], bm);
1392
+ const snap = await handleMetaCommand('snapshot', ['-i'], bm, async () => {});
1393
+ // Find textbox and button
1394
+ const textboxLine = snap.split('\n').find(l => l.includes('[textbox]'));
1395
+ const buttonLine = snap.split('\n').find(l => l.includes('[button]') && l.includes('"Submit"'));
1396
+ if (textboxLine && buttonLine) {
1397
+ const textRef = textboxLine.match(/@(e\d+)/)![1];
1398
+ const btnRef = buttonLine.match(/@(e\d+)/)![1];
1399
+ await handleWriteCommand('fill', [`@${textRef}`, 'testuser'], bm);
1400
+ await handleWriteCommand('click', [`@${btnRef}`], bm);
1401
+ }
1402
+ });
1403
+
1404
+ test('tabs: newtab → goto → switch → verify isolation', async () => {
1405
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
1406
+ const tabsBefore = bm.getTabCount();
1407
+ await handleMetaCommand('newtab', [baseUrl + '/forms.html'], bm, async () => {});
1408
+ expect(bm.getTabCount()).toBe(tabsBefore + 1);
1409
+
1410
+ const url = await handleMetaCommand('url', [], bm, async () => {});
1411
+ expect(url).toContain('/forms.html');
1412
+
1413
+ // Switch back to previous tab
1414
+ const tabs = await bm.getTabListWithTitles();
1415
+ const prevTab = tabs.find(t => t.url.includes('/basic.html'));
1416
+ if (prevTab) {
1417
+ bm.switchTab(prevTab.id);
1418
+ const url2 = await handleMetaCommand('url', [], bm, async () => {});
1419
+ expect(url2).toContain('/basic.html');
1420
+ }
1421
+
1422
+ // Clean up extra tab
1423
+ const allTabs = await bm.getTabListWithTitles();
1424
+ const formTab = allTabs.find(t => t.url.includes('/forms.html'));
1425
+ if (formTab) await bm.closeTab(formTab.id);
1426
+ });
1427
+
1428
+ test('cookies: set → read → reload → verify persistence', async () => {
1429
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
1430
+ await handleWriteCommand('cookie', ['workflow-test=persisted'], bm);
1431
+ await handleWriteCommand('reload', [], bm);
1432
+ const cookies = await handleReadCommand('cookies', [], bm);
1433
+ expect(cookies).toContain('workflow-test');
1434
+ expect(cookies).toContain('persisted');
1435
+ });
1436
+ });
1437
+
1438
+ // ─── Wait load states ──────────────────────────────────────────
1439
+
1440
+ describe('Wait load states', () => {
1441
+ test('wait --networkidle succeeds after page load', async () => {
1442
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
1443
+ const result = await handleWriteCommand('wait', ['--networkidle'], bm);
1444
+ expect(result).toBe('Network idle');
1445
+ });
1446
+
1447
+ test('wait --load succeeds', async () => {
1448
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
1449
+ const result = await handleWriteCommand('wait', ['--load'], bm);
1450
+ expect(result).toBe('Page loaded');
1451
+ });
1452
+
1453
+ test('wait --domcontentloaded succeeds', async () => {
1454
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
1455
+ const result = await handleWriteCommand('wait', ['--domcontentloaded'], bm);
1456
+ expect(result).toBe('DOM content loaded');
1457
+ });
1458
+
1459
+ test('wait --networkidle with custom timeout', async () => {
1460
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
1461
+ const result = await handleWriteCommand('wait', ['--networkidle', '5000'], bm);
1462
+ expect(result).toBe('Network idle');
1463
+ });
1464
+
1465
+ test('wait with selector still works', async () => {
1466
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
1467
+ const result = await handleWriteCommand('wait', ['#title'], bm);
1468
+ expect(result).toContain('appeared');
1469
+ });
1470
+ });
1471
+
1472
+ // ─── Console --errors ──────────────────────────────────────────
1473
+
1474
+ describe('Console --errors', () => {
1475
+ test('console --errors filters to error and warning only', async () => {
1476
+ // Clear existing entries
1477
+ await handleReadCommand('console', ['--clear'], bm);
1478
+
1479
+ // Add mixed entries
1480
+ addConsoleEntry({ timestamp: Date.now(), level: 'log', text: 'info message' });
1481
+ addConsoleEntry({ timestamp: Date.now(), level: 'warning', text: 'warn message' });
1482
+ addConsoleEntry({ timestamp: Date.now(), level: 'error', text: 'error message' });
1483
+
1484
+ const result = await handleReadCommand('console', ['--errors'], bm);
1485
+ expect(result).toContain('warn message');
1486
+ expect(result).toContain('error message');
1487
+ expect(result).not.toContain('info message');
1488
+
1489
+ // Cleanup
1490
+ consoleBuffer.clear();
1491
+ });
1492
+
1493
+ test('console --errors returns empty message when no errors', async () => {
1494
+ consoleBuffer.clear();
1495
+ addConsoleEntry({ timestamp: Date.now(), level: 'log', text: 'just a log' });
1496
+
1497
+ const result = await handleReadCommand('console', ['--errors'], bm);
1498
+ expect(result).toBe('(no console errors)');
1499
+
1500
+ consoleBuffer.clear();
1501
+ });
1502
+
1503
+ test('console --errors on empty buffer', async () => {
1504
+ consoleBuffer.clear();
1505
+ const result = await handleReadCommand('console', ['--errors'], bm);
1506
+ expect(result).toBe('(no console errors)');
1507
+ });
1508
+
1509
+ test('console without flag still returns all messages', async () => {
1510
+ consoleBuffer.clear();
1511
+ addConsoleEntry({ timestamp: Date.now(), level: 'log', text: 'all messages test' });
1512
+
1513
+ const result = await handleReadCommand('console', [], bm);
1514
+ expect(result).toContain('all messages test');
1515
+
1516
+ consoleBuffer.clear();
1517
+ });
1518
+ });
1519
+
1520
+ // ─── Cookie Import ─────────────────────────────────────────────
1521
+
1522
+ describe('Cookie import', () => {
1523
+ test('cookie-import loads valid JSON cookies', async () => {
1524
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
1525
+ const tempFile = '/tmp/browse-test-cookies.json';
1526
+ const cookies = [
1527
+ { name: 'test-cookie', value: 'test-value' },
1528
+ { name: 'another', value: '123' },
1529
+ ];
1530
+ fs.writeFileSync(tempFile, JSON.stringify(cookies));
1531
+
1532
+ const result = await handleWriteCommand('cookie-import', [tempFile], bm);
1533
+ expect(result).toBe('Loaded 2 cookies from /tmp/browse-test-cookies.json');
1534
+
1535
+ // Verify cookies were set
1536
+ const cookieList = await handleReadCommand('cookies', [], bm);
1537
+ expect(cookieList).toContain('test-cookie');
1538
+ expect(cookieList).toContain('test-value');
1539
+ expect(cookieList).toContain('another');
1540
+
1541
+ fs.unlinkSync(tempFile);
1542
+ });
1543
+
1544
+ test('cookie-import auto-fills domain from page URL', async () => {
1545
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
1546
+ const tempFile = '/tmp/browse-test-cookies-nodomain.json';
1547
+ // Cookies without domain — should auto-fill from page URL
1548
+ const cookies = [{ name: 'autofill-test', value: 'works' }];
1549
+ fs.writeFileSync(tempFile, JSON.stringify(cookies));
1550
+
1551
+ const result = await handleWriteCommand('cookie-import', [tempFile], bm);
1552
+ expect(result).toContain('Loaded 1');
1553
+
1554
+ const cookieList = await handleReadCommand('cookies', [], bm);
1555
+ expect(cookieList).toContain('autofill-test');
1556
+
1557
+ fs.unlinkSync(tempFile);
1558
+ });
1559
+
1560
+ test('cookie-import preserves explicit domain', async () => {
1561
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
1562
+ const tempFile = '/tmp/browse-test-cookies-domain.json';
1563
+ const cookies = [{ name: 'explicit', value: 'domain', domain: 'example.com', path: '/foo' }];
1564
+ fs.writeFileSync(tempFile, JSON.stringify(cookies));
1565
+
1566
+ const result = await handleWriteCommand('cookie-import', [tempFile], bm);
1567
+ expect(result).toContain('Loaded 1');
1568
+
1569
+ fs.unlinkSync(tempFile);
1570
+ });
1571
+
1572
+ test('cookie-import with empty array succeeds', async () => {
1573
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
1574
+ const tempFile = '/tmp/browse-test-cookies-empty.json';
1575
+ fs.writeFileSync(tempFile, '[]');
1576
+
1577
+ const result = await handleWriteCommand('cookie-import', [tempFile], bm);
1578
+ expect(result).toBe('Loaded 0 cookies from /tmp/browse-test-cookies-empty.json');
1579
+
1580
+ fs.unlinkSync(tempFile);
1581
+ });
1582
+
1583
+ test('cookie-import throws on file not found', async () => {
1584
+ try {
1585
+ await handleWriteCommand('cookie-import', ['/tmp/nonexistent-cookies.json'], bm);
1586
+ expect(true).toBe(false);
1587
+ } catch (err: any) {
1588
+ expect(err.message).toContain('File not found');
1589
+ }
1590
+ });
1591
+
1592
+ test('cookie-import throws on invalid JSON', async () => {
1593
+ const tempFile = '/tmp/browse-test-cookies-bad.json';
1594
+ fs.writeFileSync(tempFile, 'not json {{{');
1595
+
1596
+ try {
1597
+ await handleWriteCommand('cookie-import', [tempFile], bm);
1598
+ expect(true).toBe(false);
1599
+ } catch (err: any) {
1600
+ expect(err.message).toContain('Invalid JSON');
1601
+ }
1602
+
1603
+ fs.unlinkSync(tempFile);
1604
+ });
1605
+
1606
+ test('cookie-import throws on non-array JSON', async () => {
1607
+ const tempFile = '/tmp/browse-test-cookies-obj.json';
1608
+ fs.writeFileSync(tempFile, '{"name": "not-an-array"}');
1609
+
1610
+ try {
1611
+ await handleWriteCommand('cookie-import', [tempFile], bm);
1612
+ expect(true).toBe(false);
1613
+ } catch (err: any) {
1614
+ expect(err.message).toContain('JSON array');
1615
+ }
1616
+
1617
+ fs.unlinkSync(tempFile);
1618
+ });
1619
+
1620
+ test('cookie-import throws on cookie missing name', async () => {
1621
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
1622
+ const tempFile = '/tmp/browse-test-cookies-noname.json';
1623
+ fs.writeFileSync(tempFile, JSON.stringify([{ value: 'no-name' }]));
1624
+
1625
+ try {
1626
+ await handleWriteCommand('cookie-import', [tempFile], bm);
1627
+ expect(true).toBe(false);
1628
+ } catch (err: any) {
1629
+ expect(err.message).toContain('name');
1630
+ }
1631
+
1632
+ fs.unlinkSync(tempFile);
1633
+ });
1634
+
1635
+ test('cookie-import no arg throws', async () => {
1636
+ try {
1637
+ await handleWriteCommand('cookie-import', [], bm);
1638
+ expect(true).toBe(false);
1639
+ } catch (err: any) {
1640
+ expect(err.message).toContain('Usage');
1641
+ }
1642
+ });
1643
+ });
1644
+
1645
+ // ─── Security: Redact sensitive values (PR #21) ─────────────────
1646
+
1647
+ describe('Sensitive value redaction', () => {
1648
+ test('type command does not echo typed text', async () => {
1649
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
1650
+ const result = await handleWriteCommand('type', ['my-secret-password'], bm);
1651
+ expect(result).not.toContain('my-secret-password');
1652
+ expect(result).toContain('18 characters');
1653
+ });
1654
+
1655
+ test('cookie command redacts value', async () => {
1656
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
1657
+ const result = await handleWriteCommand('cookie', ['session=secret123'], bm);
1658
+ expect(result).toContain('session');
1659
+ expect(result).toContain('****');
1660
+ expect(result).not.toContain('secret123');
1661
+ });
1662
+
1663
+ test('header command redacts Authorization value', async () => {
1664
+ const result = await handleWriteCommand('header', ['Authorization:Bearer token-xyz'], bm);
1665
+ expect(result).toContain('Authorization');
1666
+ expect(result).toContain('****');
1667
+ expect(result).not.toContain('token-xyz');
1668
+ });
1669
+
1670
+ test('header command shows non-sensitive values', async () => {
1671
+ const result = await handleWriteCommand('header', ['Content-Type:application/json'], bm);
1672
+ expect(result).toContain('Content-Type');
1673
+ expect(result).toContain('application/json');
1674
+ expect(result).not.toContain('****');
1675
+ });
1676
+
1677
+ test('header command redacts X-API-Key', async () => {
1678
+ const result = await handleWriteCommand('header', ['X-API-Key:sk-12345'], bm);
1679
+ expect(result).toContain('X-API-Key');
1680
+ expect(result).toContain('****');
1681
+ expect(result).not.toContain('sk-12345');
1682
+ });
1683
+
1684
+ test('storage set does not echo value', async () => {
1685
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
1686
+ const result = await handleReadCommand('storage', ['set', 'apiKey', 'secret-api-key-value'], bm);
1687
+ expect(result).toContain('apiKey');
1688
+ expect(result).not.toContain('secret-api-key-value');
1689
+ });
1690
+
1691
+ test('forms redacts password field values', async () => {
1692
+ await handleWriteCommand('goto', [baseUrl + '/forms.html'], bm);
1693
+ const formsResult = await handleReadCommand('forms', [], bm);
1694
+ const forms = JSON.parse(formsResult);
1695
+ // Find password fields and verify they're redacted
1696
+ for (const form of forms) {
1697
+ for (const field of form.fields) {
1698
+ if (field.type === 'password') {
1699
+ expect(field.value === undefined || field.value === '[redacted]').toBe(true);
1700
+ }
1701
+ }
1702
+ }
1703
+ });
1704
+ });
1705
+
1706
+ // ─── Security: Path traversal prevention (PR #26) ───────────────
1707
+
1708
+ describe('Path traversal prevention', () => {
1709
+ test('screenshot rejects path outside safe dirs', async () => {
1710
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
1711
+ try {
1712
+ await handleMetaCommand('screenshot', ['/etc/evil.png'], bm, () => {});
1713
+ expect(true).toBe(false);
1714
+ } catch (err: any) {
1715
+ expect(err.message).toContain('Path must be within');
1716
+ }
1717
+ });
1718
+
1719
+ test('screenshot allows /tmp path', async () => {
1720
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
1721
+ const result = await handleMetaCommand('screenshot', ['/tmp/test-safe.png'], bm, () => {});
1722
+ expect(result).toContain('Screenshot saved');
1723
+ try { fs.unlinkSync('/tmp/test-safe.png'); } catch {}
1724
+ });
1725
+
1726
+ test('pdf rejects path outside safe dirs', async () => {
1727
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
1728
+ try {
1729
+ await handleMetaCommand('pdf', ['/home/evil.pdf'], bm, () => {});
1730
+ expect(true).toBe(false);
1731
+ } catch (err: any) {
1732
+ expect(err.message).toContain('Path must be within');
1733
+ }
1734
+ });
1735
+
1736
+ test('responsive rejects path outside safe dirs', async () => {
1737
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
1738
+ try {
1739
+ await handleMetaCommand('responsive', ['/var/evil'], bm, () => {});
1740
+ expect(true).toBe(false);
1741
+ } catch (err: any) {
1742
+ expect(err.message).toContain('Path must be within');
1743
+ }
1744
+ });
1745
+
1746
+ test('eval rejects path traversal with ..', async () => {
1747
+ try {
1748
+ await handleReadCommand('eval', ['../../etc/passwd'], bm);
1749
+ expect(true).toBe(false);
1750
+ } catch (err: any) {
1751
+ expect(err.message).toContain('Path traversal');
1752
+ }
1753
+ });
1754
+
1755
+ test('eval rejects absolute path outside safe dirs', async () => {
1756
+ try {
1757
+ await handleReadCommand('eval', ['/etc/passwd'], bm);
1758
+ expect(true).toBe(false);
1759
+ } catch (err: any) {
1760
+ expect(err.message).toContain('Absolute path must be within');
1761
+ }
1762
+ });
1763
+
1764
+ test('eval allows /tmp path', async () => {
1765
+ const tmpFile = '/tmp/test-eval-safe.js';
1766
+ fs.writeFileSync(tmpFile, 'document.title');
1767
+ try {
1768
+ const result = await handleReadCommand('eval', [tmpFile], bm);
1769
+ expect(typeof result).toBe('string');
1770
+ } finally {
1771
+ try { fs.unlinkSync(tmpFile); } catch {}
1772
+ }
1773
+ });
1774
+
1775
+ test('screenshot rejects /tmpevil prefix collision', async () => {
1776
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
1777
+ try {
1778
+ await handleMetaCommand('screenshot', ['/tmpevil/steal.png'], bm, () => {});
1779
+ expect(true).toBe(false);
1780
+ } catch (err: any) {
1781
+ expect(err.message).toContain('Path must be within');
1782
+ }
1783
+ });
1784
+
1785
+ test('cookie-import rejects path traversal', async () => {
1786
+ try {
1787
+ await handleWriteCommand('cookie-import', ['../../etc/shadow'], bm);
1788
+ expect(true).toBe(false);
1789
+ } catch (err: any) {
1790
+ expect(err.message).toContain('Path traversal');
1791
+ }
1792
+ });
1793
+
1794
+ test('cookie-import rejects absolute path outside safe dirs', async () => {
1795
+ try {
1796
+ await handleWriteCommand('cookie-import', ['/etc/passwd'], bm);
1797
+ expect(true).toBe(false);
1798
+ } catch (err: any) {
1799
+ expect(err.message).toContain('Path must be within');
1800
+ }
1801
+ });
1802
+
1803
+ test('snapshot -a -o rejects path outside safe dirs', async () => {
1804
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
1805
+ // First get a snapshot so refs exist
1806
+ await handleMetaCommand('snapshot', ['-i'], bm, () => {});
1807
+ try {
1808
+ await handleMetaCommand('snapshot', ['-a', '-o', '/etc/evil.png'], bm, () => {});
1809
+ expect(true).toBe(false);
1810
+ } catch (err: any) {
1811
+ expect(err.message).toContain('Path must be within');
1812
+ }
1813
+ });
1814
+ });
1815
+
1816
+ // ─── Chain command: cookie-import in chain ──────────────────────
1817
+
1818
+ describe('Chain with cookie-import', () => {
1819
+ test('cookie-import works inside chain', async () => {
1820
+ await handleWriteCommand('goto', [baseUrl + '/basic.html'], bm);
1821
+ const tmpCookies = '/tmp/test-chain-cookies.json';
1822
+ fs.writeFileSync(tmpCookies, JSON.stringify([
1823
+ { name: 'chain_test', value: 'chain_value', domain: 'localhost', path: '/' }
1824
+ ]));
1825
+ try {
1826
+ const commands = JSON.stringify([
1827
+ ['cookie-import', tmpCookies],
1828
+ ]);
1829
+ const result = await handleMetaCommand('chain', [commands], bm, async () => {});
1830
+ expect(result).toContain('[cookie-import]');
1831
+ expect(result).toContain('Loaded 1 cookie');
1832
+ } finally {
1833
+ try { fs.unlinkSync(tmpCookies); } catch {}
1834
+ }
1835
+ });
1836
+ });