@sovovs/bycli 1.8.0 → 2.1.0

package/dist/src/registry.d.ts

@@ -20,7 +20,11 @@ export interface Arg {
     choices?: string[];
 }
 export type CommandArgs = Record<string, any>;
+export type BrowserRequirementResolver = (args: CommandArgs) => boolean;
+export type BrowserDeclaration = boolean | BrowserRequirementResolver;
+export type NormalizedBrowserRequirement = boolean | 'conditional';
 export type BrowserCommandFunc = (page: IPage, kwargs: CommandArgs, debug?: boolean) => Promise<unknown>;
+export type ConditionalBrowserCommandFunc = (page: IPage | null, kwargs: CommandArgs, debug?: boolean) => Promise<unknown>;
 export type NonBrowserCommandFunc = (kwargs: CommandArgs, debug?: boolean) => Promise<unknown>;
 export type CommandAccess = 'read' | 'write';
 export type SiteSessionMode = 'ephemeral' | 'persistent';
@@ -28,8 +32,9 @@ export type SiteSessionMode = 'ephemeral' | 'persistent';
  * 所有已注册 adapter command 的共享元数据和运行选项。
  *
  * 这里故意不包含 `browser` 和 `func` 这类执行形态字段，因为浏览器命令和
- * 非浏览器命令的执行签名不同。`BrowserCliCommand` 和 `NonBrowserCliCommand`
- * 会在 normalize 之后扩展这个共同底座，形成最终可执行的命令类型。
+ * 非浏览器命令、条件浏览器命令的执行签名不同。`BrowserCliCommand`、
+ * `NonBrowserCliCommand` 和 `ConditionalBrowserCliCommand` 会在 normalize 之后
+ * 扩展这个共同底座，形成最终可执行的命令类型。
  */
 interface BaseCliCommand {
     /** 站点或命名空间名称，对应命令中的 `<site>`，例如 `devto`、`brave`。 */
@@ -81,8 +86,8 @@ interface BaseCliCommand {
     defaultFormat?: 'table' | 'plain' | 'json' | 'yaml' | 'yml' | 'md' | 'markdown' | 'csv';
 }
 export interface BrowserCliCommand extends BaseCliCommand {
-    /** Browser commands receive an IPage. Omitted means true after normalization. */
-    browser?: true;
+    /** Browser commands receive an IPage. */
+    browser: true;
     func?: BrowserCommandFunc;
 }
 export interface NonBrowserCliCommand extends BaseCliCommand {
@@ -90,25 +95,50 @@ export interface NonBrowserCliCommand extends BaseCliCommand {
     browser: false;
     func?: NonBrowserCommandFunc;
 }
-export type CliCommand = BrowserCliCommand | NonBrowserCliCommand;
+export interface ConditionalBrowserCliCommand extends BaseCliCommand {
+    /** Browser use is resolved from the final command arguments at execution time. */
+    browser: 'conditional';
+    requiresBrowser: BrowserRequirementResolver;
+    func?: ConditionalBrowserCommandFunc;
+}
+export type CliCommand = BrowserCliCommand | NonBrowserCliCommand | ConditionalBrowserCliCommand;
 /**
  * `cli()` 注册 adapter 时使用的内部预归一化命令形态。
  *
  * adapter 作者传入的是 `CliOptions`，它的 TypeScript union 会保证公开调用点足够精确。
- * registry 内部会先把这些选项复制成这个更宽松的形态，再交给 `normalizeCommand()`
- * 根据 `strategy` 推导 `browser`、`navigateBefore` 等运行时意图，最后存成具体的
- * `CliCommand`。
+ * registry 内部会先把这些选项复制成对应的预归一化分支，再交给
+ * `normalizeCommand()` 根据 `strategy` 推导 `browser`、`navigateBefore` 等运行时意图，
+ * 最后存成具体的 `CliCommand`。
  */
-type RawCliCommand = BaseCliCommand & {
-    /** 预归一化阶段的浏览器需求标记；可省略，之后会由 strategy 推导。 */
-    browser?: boolean;
-    /** 预归一化阶段的执行函数；可能是浏览器签名，也可能是非浏览器签名。 */
-    func?: BrowserCommandFunc | NonBrowserCommandFunc;
+type RawCliCommandBase = Omit<BaseCliCommand, 'strategy'>;
+type RawBrowserCliCommand = RawCliCommandBase & {
+    func?: BrowserCommandFunc;
+} & ({
+    browser: true;
+    strategy?: Strategy;
+} | {
+    browser?: true;
+    strategy?: BrowserStrategy;
+});
+type RawNonBrowserCliCommand = RawCliCommandBase & {
+    func?: NonBrowserCommandFunc;
+} & ({
+    browser: false;
+    strategy?: Strategy;
+} | {
+    browser?: false;
+    strategy: Strategy.PUBLIC | Strategy.LOCAL;
+});
+type RawConditionalBrowserCliCommand = RawCliCommandBase & {
+    browser: BrowserRequirementResolver;
+    strategy?: Strategy;
+    func?: ConditionalBrowserCommandFunc;
 };
 /** Internal extension for lazy-loaded TS modules (not exposed in public API) */
 export type InternalCliCommand = CliCommand & {
     _lazy?: boolean;
     _modulePath?: string;
+    _hydrateBeforeBrowserRouting?: boolean;
 };
 type RequiredCliOptions = {
     site: string;
@@ -131,13 +161,25 @@ type NonBrowserCliOptions = Partial<Omit<NonBrowserCliCommand, 'args' | 'descrip
     strategy: Strategy.PUBLIC | Strategy.LOCAL;
     browser?: false;
 });
-export type CliOptions = BrowserCliOptions | NonBrowserCliOptions;
+type ConditionalBrowserCliOptions = Partial<Omit<ConditionalBrowserCliCommand, 'args' | 'description' | 'browser' | 'requiresBrowser'>> & RequiredCliOptions & {
+    browser: BrowserRequirementResolver;
+};
+export type CliOptions = BrowserCliOptions | NonBrowserCliOptions | ConditionalBrowserCliOptions;
 declare global {
     var __bycli_registry__: Map<string, CliCommand> | undefined;
 }
-export declare function cli(opts: CliOptions): CliCommand;
+export declare function cli(opts: ConditionalBrowserCliOptions): ConditionalBrowserCliCommand;
+export declare function cli(opts: NonBrowserCliOptions): NonBrowserCliCommand;
+export declare function cli(opts: BrowserCliOptions): BrowserCliCommand;
 export declare function getRegistry(): Map<string, CliCommand>;
 export declare function fullName(cmd: Pick<BaseCliCommand, 'site' | 'name'>): string;
 export declare function strategyLabel(cmd: CliCommand): string;
-export declare function registerCommand(cmd: RawCliCommand): void;
+/** Whether a command may use browser-backed execution for some invocation. */
+export declare function hasBrowserCapability(cmd: CliCommand): boolean;
+/** Stable human-readable label for the normalized browser requirement. */
+export declare function browserRequirementLabel(cmd: CliCommand): 'yes' | 'no' | 'conditional';
+export declare function registerCommand(cmd: RawConditionalBrowserCliCommand): void;
+export declare function registerCommand(cmd: RawNonBrowserCliCommand): void;
+export declare function registerCommand(cmd: RawBrowserCliCommand): void;
+export declare function registerCommand(cmd: CliCommand): void;
 export {};

package/dist/src/registry.js

@@ -1,6 +1,7 @@
 /**
  * Core registry: Strategy enum, Arg/CliCommand interfaces, cli() registration.
  */
+import { pruneRegistryMutationKey, recordRegistryMutation, registryMutationKeys, withRegistryMutationGroup, } from './registry-transaction.js';
 export var Strategy;
 (function (Strategy) {
     Strategy["PUBLIC"] = "public";
@@ -9,9 +10,77 @@ export var Strategy;
     Strategy["INTERCEPT"] = "intercept";
     Strategy["UI"] = "ui";
 })(Strategy || (Strategy = {}));
-const _registry = globalThis.__bycli_registry__ ??= new Map();
+const TRACKED_REGISTRY_MARKER = Symbol.for('@sovovs/bycli/tracked-registry');
+function isTrackedRegistry(registry) {
+    return registry !== undefined
+        && registry[TRACKED_REGISTRY_MARKER] === true;
+}
+function instrumentRegistry(registry) {
+    if (isTrackedRegistry(registry))
+        return registry;
+    Object.defineProperties(registry, {
+        set: {
+            value(key, value) {
+                const before = { present: this.has(key), value: this.get(key) };
+                recordRegistryMutation(key, before, { present: true, value });
+                return Map.prototype.set.call(this, key, value);
+            },
+        },
+        delete: {
+            value(key) {
+                const before = { present: this.has(key), value: this.get(key) };
+                recordRegistryMutation(key, before, { present: false, value: undefined });
+                const deleted = Map.prototype.delete.call(this, key);
+                pruneRegistryMutationKey(key, this);
+                return deleted;
+            },
+        },
+        clear: {
+            value() {
+                const keys = new Set([...this.keys(), ...registryMutationKeys()]);
+                if (keys.size === 0)
+                    return;
+                withRegistryMutationGroup(() => {
+                    for (const key of keys) {
+                        const present = this.has(key);
+                        recordRegistryMutation(key, { present, value: present ? this.get(key) : undefined }, { present: false, value: undefined });
+                    }
+                    Map.prototype.clear.call(this);
+                    for (const key of keys)
+                        pruneRegistryMutationKey(key, this);
+                });
+            },
+        },
+        [TRACKED_REGISTRY_MARKER]: { value: true },
+    });
+    return registry;
+}
+const existingRegistry = globalThis.__bycli_registry__ ?? new Map();
+const _registry = instrumentRegistry(existingRegistry);
+globalThis.__bycli_registry__ = _registry;
 export function cli(opts) {
-    const cmd = {
+    const base = rawCommandBase(opts);
+    let cmd;
+    if (typeof opts.browser === 'function') {
+        cmd = { ...base, strategy: opts.strategy, browser: opts.browser, func: opts.func };
+    }
+    else if (opts.browser === false) {
+        cmd = { ...base, strategy: opts.strategy, browser: false, func: opts.func };
+    }
+    else if (opts.browser === true) {
+        cmd = { ...base, strategy: opts.strategy, browser: true, func: opts.func };
+    }
+    else if (isImplicitNonBrowserOptions(opts)) {
+        cmd = { ...base, strategy: opts.strategy, browser: opts.browser, func: opts.func };
+    }
+    else {
+        cmd = { ...base, strategy: opts.strategy, browser: opts.browser, func: opts.func };
+    }
+    registerCommandInput(cmd);
+    return _registry.get(fullName(cmd));
+}
+function rawCommandBase(opts) {
+    return {
         site: opts.site,
         name: opts.name,
         aliases: opts.aliases,
@@ -19,11 +88,8 @@ export function cli(opts) {
         access: opts.access,
         example: opts.example,
         domain: opts.domain,
-        strategy: opts.strategy,
-        browser: opts.browser,
         args: opts.args ?? [],
         columns: opts.columns,
-        func: opts.func,
         pipeline: opts.pipeline,
         footerExtra: opts.footerExtra,
         validateArgs: opts.validateArgs,
@@ -31,8 +97,10 @@ export function cli(opts) {
         siteSession: opts.siteSession,
         defaultFormat: opts.defaultFormat,
     };
-    registerCommand(cmd);
-    return _registry.get(fullName(cmd));
+}
+function isImplicitNonBrowserOptions(opts) {
+    return opts.browser === undefined
+        && (opts.strategy === Strategy.PUBLIC || opts.strategy === Strategy.LOCAL);
 }
 export function getRegistry() {
     return _registry;
@@ -43,6 +111,14 @@ export function fullName(cmd) {
 export function strategyLabel(cmd) {
     return cmd.strategy ?? Strategy.PUBLIC;
 }
+/** Whether a command may use browser-backed execution for some invocation. */
+export function hasBrowserCapability(cmd) {
+    return cmd.browser !== false;
+}
+/** Stable human-readable label for the normalized browser requirement. */
+export function browserRequirementLabel(cmd) {
+    return cmd.browser === 'conditional' ? 'conditional' : cmd.browser ? 'yes' : 'no';
+}
 /**
  * Normalize a command's runtime fields. This is the single place where
  * `strategy` is decoded into the concrete fields that the execution path
@@ -57,10 +133,8 @@ export function strategyLabel(cmd) {
  *   2. Derived from strategy + domain (the defaults below)
  */
 function normalizeCommand(cmd) {
-    assertCommandAccess(cmd);
-    assertSiteSession(cmd);
-    const strategy = cmd.strategy ?? (cmd.browser === false ? Strategy.PUBLIC : Strategy.COOKIE);
-    const browser = cmd.browser ?? (strategy !== Strategy.PUBLIC && strategy !== Strategy.LOCAL);
+    const declaredBrowser = cmd.browser;
+    const strategy = cmd.strategy ?? (declaredBrowser === false ? Strategy.PUBLIC : Strategy.COOKIE);
     let navigateBefore = cmd.navigateBefore;
     if (navigateBefore === undefined) {
         if (strategy === Strategy.COOKIE && cmd.domain) {
@@ -73,9 +147,34 @@ function normalizeCommand(cmd) {
             navigateBefore = true;
         }
     }
-    return browser
-        ? { ...cmd, strategy, browser: true, navigateBefore }
-        : { ...cmd, strategy, browser: false, navigateBefore };
+    if (typeof cmd.browser === 'function') {
+        const normalized = {
+            ...cmd,
+            strategy,
+            browser: 'conditional',
+            requiresBrowser: cmd.browser,
+            navigateBefore,
+        };
+        return normalized;
+    }
+    if (cmd.browser === false) {
+        const normalized = { ...cmd, strategy, browser: false, navigateBefore };
+        return normalized;
+    }
+    if (cmd.browser === true) {
+        const normalized = { ...cmd, strategy, browser: true, navigateBefore };
+        return normalized;
+    }
+    if (isImplicitNonBrowserCommand(cmd)) {
+        const normalized = { ...cmd, strategy, browser: false, navigateBefore };
+        return normalized;
+    }
+    const normalized = { ...cmd, strategy, browser: true, navigateBefore };
+    return normalized;
+}
+function isImplicitNonBrowserCommand(cmd) {
+    return cmd.browser === undefined
+        && (cmd.strategy === Strategy.PUBLIC || cmd.strategy === Strategy.LOCAL);
 }
 function assertCommandAccess(cmd) {
     if (cmd.access === 'read' || cmd.access === 'write')
@@ -92,7 +191,24 @@ function assertSiteSession(cmd) {
     }
 }
 export function registerCommand(cmd) {
-    const normalized = normalizeCommand(cmd);
+    registerCommandInput(cmd);
+}
+function registerCommandInput(cmd) {
+    withRegistryMutationGroup(() => {
+        assertCommandAccess(cmd);
+        assertSiteSession(cmd);
+        if (cmd.browser === 'conditional') {
+            if (typeof cmd.requiresBrowser !== 'function') {
+                const key = `${cmd.site}/${cmd.name}`;
+                throw new Error(`Command ${key} requiresBrowser must be a function`);
+            }
+            insertNormalizedCommand(cmd);
+            return;
+        }
+        insertNormalizedCommand(normalizeCommand(cmd));
+    });
+}
+function insertNormalizedCommand(normalized) {
     const canonicalKey = fullName(normalized);
     const existing = _registry.get(canonicalKey);
     if (existing?.aliases) {

package/dist/src/serialization.d.ts

@@ -26,7 +26,7 @@ export declare function serializeCommand(cmd: CliCommand): {
     description: string;
     access: import("./registry.js").CommandAccess;
     strategy: string;
-    browser: boolean;
+    browser: boolean | "conditional";
     args: SerializedArg[];
     columns: string[];
     domain: string | null;

package/dist/src/serialization.js

@@ -4,7 +4,7 @@
  * Used by the `list` command, Commander --help, and build-manifest.
  * Separated from registry.ts to keep the registry focused on types + registration.
  */
-import { fullName, strategyLabel } from './registry.js';
+import { browserRequirementLabel, fullName, strategyLabel } from './registry.js';
 /** Stable arg schema — every field is always present (no sparse objects). */
 export function serializeArg(a) {
     return {
@@ -28,7 +28,7 @@ export function serializeCommand(cmd) {
         description: cmd.description,
         access: cmd.access,
         strategy: strategyLabel(cmd),
-        browser: !!cmd.browser,
+        browser: cmd.browser,
         args: cmd.args.map(serializeArg),
         columns: cmd.columns ?? [],
         domain: cmd.domain ?? null,
@@ -87,7 +87,7 @@ export function formatRegistryHelpText(cmd) {
     }
     const meta = [];
     meta.push(`Access: ${cmd.access}`);
-    meta.push(`Browser: ${cmd.browser ? 'yes' : 'no'}`);
+    meta.push(`Browser: ${browserRequirementLabel(cmd)}`);
     if (cmd.domain)
         meta.push(`Domain: ${cmd.domain}`);
     if (cmd.defaultFormat)

package/dist/src/types.d.ts

@@ -207,6 +207,8 @@ export interface IPage {
      * Useful for rich editors that ignore synthetic DOM value/text mutations.
      */
     insertText?(text: string): Promise<void>;
+    /** Focus the browser window containing the active page for interactive login. */
+    focusWindow?(): Promise<void>;
     closeWindow?(): Promise<void>;
     /** Returns the current page URL, or null if unavailable. */
     getCurrentUrl?(): Promise<string | null>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sovovs/bycli",
-  "version": "1.8.0",
+  "version": "2.1.0",
   "publishConfig": {
     "access": "public"
   },
@@ -9,6 +9,10 @@
     "node": ">=20.0.0"
   },
   "type": "module",
+  "workspaces": [
+    "packages/*",
+    "dashboard-be"
+  ],
   "main": "dist/src/main.js",
   "bin": {
     "bycli": "dist/src/main.js"
@@ -38,25 +42,24 @@
     "README.md",
     "README.zh-CN.md",
     "LICENSE",
-    "NOTICE"
+    "NOTICE",
+    "!**/*.test.js",
+    "!**/*.e2e.test.js"
   ],
   "scripts": {
     "dev": "tsx src/main.ts",
-    "dev:bun": "bun src/main.ts",
     "build": "npm run clean-dist && npm run copy-yaml && npm run build-manifest",
     "prebuild-manifest": "tsc --build && node -e \"require('fs').chmodSync('dist/src/main.js', 0o755)\"",
     "build-manifest": "tsx src/build-manifest.ts",
     "clean-dist": "node scripts/clean-dist.cjs",
     "copy-yaml": "node scripts/copy-yaml.cjs",
     "start": "node dist/src/main.js",
-    "start:bun": "bun dist/src/main.js",
     "preuninstall": "node -e \"fetch('http://127.0.0.1:'+(process.env.BYCLI_DAEMON_PORT||'19825')+'/shutdown',{method:'POST',headers:{'X-byCLI':'1'},signal:AbortSignal.timeout(3000)}).catch(()=>{})\" || true",
     "postinstall": "node scripts/postinstall.js || true; node scripts/fetch-adapters.js || true",
     "typecheck": "tsc --noEmit",
     "prepare": "[ -d src ] && npm run build || true",
     "prepublishOnly": "npm run build",
     "test": "vitest run --project unit --project extension --project adapter",
-    "test:bun": "bun vitest run --project unit --project extension --project adapter",
     "test:adapter": "vitest run --project adapter",
     "test:all": "vitest run",
     "test:e2e": "vitest run --project e2e",

package/scripts/m1-daemon-navigate-drive.mjs

@@ -0,0 +1,138 @@
+/**
+ * M1 P0-1 semi-auto live driver (#1, extension form, full chain).
+ *
+ * Drives a REAL daemon → byCLI extension → chrome.debugger Fetch interception and
+ * asserts a 302 redirect to a forbidden target reaches it ZERO times. This is the
+ * extension-form counterpart to scripts/m1-live-spike.mjs (direct CDP).
+ *
+ * MANUAL PREREQUISITES (this script does NOT automate them):
+ *   1. Build + load the extension:  (cd extension && npm run build)  then load
+ *      extension/ as an unpacked extension at chrome://extensions (Developer Mode).
+ *   2. Start the daemon:  bycli daemon start   (or run any bycli browser command
+ *      once so the daemon auto-spawns and the extension connects).
+ *   3. Make sure the extension shows "connected" (bycli doctor / daemon status).
+ *
+ * Then run:  node scripts/m1-daemon-navigate-drive.mjs
+ *
+ * HOW THE NO-HIT TEST IS CONSTRUCTED (and what it proves):
+ *   - Navigate target = http://<sub>.localtest.me:<R>/start. localtest.me publicly
+ *     resolves to 127.0.0.1, so it passes the extension's syntax-only policy (a
+ *     domain, not a literal) and the browser connects to our local redirector.
+ *   - The redirector 302s to http://127.0.0.1:<F>/secret — a LITERAL loopback.
+ *   - The extension's armed Fetch guard re-checks that redirected main-frame request
+ *     and failRequest's it before send → the forbidden server gets 0 requests.
+ *   This proves before-send interception in the real extension runtime + daemon chain.
+ *   It does NOT prove DNS-rebinding closure: a redirect to a DOMAIN that resolves to
+ *   loopback would NOT be caught (ip-observed-only, ADR-0006) — that needs the proxy.
+ *
+ * Requires DNS resolution of *.localtest.me (needs network). If offline, add a hosts
+ * entry mapping a test host to 127.0.0.1 and pass it via PROBE_HOST.
+ */
+import http from 'node:http';
+
+const DAEMON = process.env.BYCLI_DAEMON || 'http://127.0.0.1:19825';
+const PROBE_HOST = process.env.PROBE_HOST || 'probe.localtest.me';
+const SESSION = process.env.SESSION || 'm1-drive';
+const log = (...a) => console.log('[m1-drive]', ...a);
+
+let forbiddenHits = 0;
+let redirectHits = 0;
+
+const forbidden = http.createServer((req, res) => {
+  forbiddenHits++;
+  log(`!!! FORBIDDEN target HIT: ${req.method} ${req.url}`);
+  res.end('forbidden-body');
+});
+const redirector = http.createServer((req, res) => {
+  redirectHits++;
+  res.writeHead(302, { Location: `http://127.0.0.1:${forbidden.address().port}/secret` });
+  res.end();
+});
+const listen = (srv) => new Promise((r) => srv.listen(0, '127.0.0.1', () => r()));
+
+async function daemonCommand(cmd) {
+  const res = await fetch(`${DAEMON}/command`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', 'X-byCLI': '1' },
+    body: JSON.stringify(cmd),
+  });
+  const text = await res.text();
+  let json;
+  try { json = JSON.parse(text); } catch { json = { raw: text }; }
+  return { status: res.status, json };
+}
+
+async function main() {
+  // 0. Daemon reachable + extension connected?
+  let status;
+  try {
+    const r = await fetch(`${DAEMON}/status`, { headers: { 'X-byCLI': '1' } });
+    status = await r.json();
+  } catch (e) {
+    log(`ERROR: daemon not reachable at ${DAEMON}. Start it first (see header comment).`);
+    process.exitCode = 1;
+    return;
+  }
+  log('daemon status:', JSON.stringify(status));
+  if (status.state && status.state !== 'ready') {
+    log(`WARNING: daemon state is "${status.state}" (need "ready" with the extension connected).`);
+  }
+
+  await listen(forbidden);
+  await listen(redirector);
+  const R = redirector.address().port;
+  const F = forbidden.address().port;
+  const target = `http://${PROBE_HOST}:${R}/start`;
+  log(`forbidden=127.0.0.1:${F}  redirector=127.0.0.1:${R}  navigate target=${target}`);
+
+  try {
+    // 1. Drive a guarded navigation through the daemon → extension chain.
+    const { status: httpStatus, json } = await daemonCommand({
+      id: `m1-${Date.now()}`,
+      action: 'navigate',
+      surface: 'browser',
+      session: SESSION,
+      url: target,
+      timeout: 30,
+    });
+    log(`navigate HTTP ${httpStatus}, result:`, JSON.stringify(json));
+
+    // 2. Settle for redirect + any blocked follow-up.
+    await new Promise((r) => setTimeout(r, 2000));
+
+    // A blocked redirect can surface two equally-correct ways:
+    //  (a) ok:false with errorCode 'navigation_blocked_by_policy' (the redirect was
+    //      blocked, so the navigation as a whole failed) — the deterministic path; or
+    //  (b) ok:true with data.interception.blocked listing the forbidden URL (the page
+    //      still settled, e.g. on an error/blank page, but the request was blocked).
+    const interception = json?.data?.interception;
+    const blockedList = interception?.blocked ?? [];
+    const errBlockedForbidden = json?.errorCode === 'navigation_blocked_by_policy'
+      && typeof json?.error === 'string' && json.error.includes(`127.0.0.1:${F}`);
+    const dataBlockedForbidden = blockedList.some((u) => u.includes(`127.0.0.1:${F}`));
+    const blockedForbidden = errBlockedForbidden || dataBlockedForbidden;
+
+    log('--- RESULTS ---');
+    log(`navigate ok          = ${json?.ok}`);
+    log(`errorCode            = ${json?.errorCode ?? '(none)'}`);
+    log(`interception.tier    = ${interception?.tier ?? '(n/a on blocked path)'}`);
+    log(`blocked (data|error) = ${JSON.stringify(blockedList)} | ${errBlockedForbidden}`);
+    log(`redirector hits      = ${redirectHits}               (expect >=1)`);
+    log(`forbidden hits       = ${forbiddenHits}              (expect 0)`);
+
+    // The security invariant: the forbidden target received 0 requests AND the
+    // redirect was actually attempted (proving the guard, not a no-op) AND we have
+    // explicit evidence the forbidden URL was blocked before send.
+    const pass = forbiddenHits === 0 && redirectHits >= 1 && blockedForbidden;
+    log(pass
+      ? '✅ PASS: daemon→extension blocked the forbidden redirect before send (forbidden target got 0 requests)'
+      : '❌ FAIL: see counts above (if redirector hits=0, the browser never reached the local redirector — check *.localtest.me DNS / PROBE_HOST)');
+    process.exitCode = pass ? 0 : 1;
+  } finally {
+    // Best-effort: close the owned tab/session we created.
+    await daemonCommand({ id: `m1-close-${Date.now()}`, action: 'close-window', surface: 'browser', session: SESSION }).catch(() => {});
+    forbidden.close(); redirector.close();
+  }
+}
+
+main().catch((e) => { log('ERROR', e.message); process.exitCode = 1; forbidden.close(); redirector.close(); });