@vellumai/assistant 0.6.5 → 0.7.0

package/src/__tests__/host-browser-e2e-cloud.test.ts

@@ -66,7 +66,8 @@ mock.module("../config/loader.js", () => ({
 import type { Conversation } from "../daemon/conversation.js";
 import { HostBrowserProxy } from "../daemon/host-browser-proxy.js";
 import type { ServerMessage } from "../daemon/message-protocol.js";
-import { getDb, initializeDb } from "../memory/db.js";
+import { getDb } from "../memory/db-connection.js";
+import { initializeDb } from "../memory/db-init.js";
 import { mintToken } from "../runtime/auth/token-service.js";
 import {
   __resetChromeExtensionRegistryForTests,
@@ -568,6 +569,313 @@ describe("macOS message ingress with connected extension", () => {
   });
 });
 
+// ── macOS SSE bridge ingress (no extension registry) ────────────────
+//
+// Exercises the cloud-hosted + desktop SSE bridge path for macOS turns
+// WITHOUT relying on the ChromeExtensionRegistry. This validates the
+// native macOS host-browser proxy path where `host_browser_request`
+// frames travel through `assistantEventHub` (SSE) rather than the
+// extension WebSocket.
+//
+// In production, this path is used when:
+//   - The macOS desktop client is connected to the assistant via SSE
+//   - The user does NOT have the Chrome extension installed
+//   - The desktop client receives `host_browser_request` frames via SSE,
+//     executes CDP commands against the local Chrome, and POSTs results
+//     back to `/v1/host-browser-result`
+//
+// The test constructs a HostBrowserProxy wired to a mock SSE sender
+// (simulating the `onEvent` hub publisher) and a mock macOS client that
+// observes the sent frames and returns results via POST.
+
+describe("macOS SSE bridge ingress (no extension registry)", () => {
+  let server: RuntimeHttpServer;
+  let port: number;
+  let runtimeBaseUrl: string;
+
+  beforeEach(async () => {
+    const db = getDb();
+    db.run("DELETE FROM contact_channels");
+    db.run("DELETE FROM contacts");
+    pendingInteractions.clear();
+    __resetChromeExtensionRegistryForTests();
+
+    port = 20200 + Math.floor(Math.random() * 200);
+    runtimeBaseUrl = `http://127.0.0.1:${port}`;
+    server = new RuntimeHttpServer({ port });
+    await server.start();
+  });
+
+  afterEach(async () => {
+    await server?.stop();
+    pendingInteractions.clear();
+    __resetChromeExtensionRegistryForTests();
+  });
+
+  /**
+   * Create a HostBrowserProxy wired to a mock SSE sender. The sender
+   * captures `host_browser_request` frames and simulates what the macOS
+   * desktop client does: execute the CDP command locally and POST the
+   * result back to `/v1/host-browser-result`.
+   *
+   * Unlike `createBoundProxy` (which routes through the extension
+   * registry), this helper routes through a direct function call —
+   * simulating the `onEvent` SSE hub publisher path.
+   */
+  function createSseBoundProxy(
+    conversationId: string,
+    token: string,
+  ): {
+    proxy: HostBrowserProxy;
+    conversation: Conversation;
+    sentFrames: Array<{ type: string; [key: string]: unknown }>;
+  } {
+    let proxyRef: HostBrowserProxy | null = null;
+    const conversation = {
+      resolveHostBrowser(
+        requestId: string,
+        response: { content: string; isError: boolean },
+      ) {
+        proxyRef?.resolve(requestId, response);
+      },
+    } as unknown as Conversation;
+
+    const sentFrames: Array<{ type: string; [key: string]: unknown }> = [];
+
+    // The SSE sender simulates what `assistantEventHub.publish` does in
+    // production: it delivers the message to the connected SSE client.
+    // Here we capture the frame and immediately simulate the macOS client
+    // handling it — executing a mock CDP command and POSTing the result
+    // back to the runtime.
+    const sseSender = (msg: ServerMessage) => {
+      const frame = msg as { type: string; [key: string]: unknown };
+      sentFrames.push(frame);
+
+      if (frame.type === "host_browser_request") {
+        const requestId = frame.requestId as string;
+
+        // Register the pending interaction (in production this happens
+        // in makeHubPublisher inside conversation-routes.ts).
+        pendingInteractions.register(requestId, {
+          conversation,
+          conversationId,
+          kind: "host_browser",
+        });
+
+        // Simulate the macOS desktop client processing the CDP command
+        // and POSTing the result back to the runtime.
+        const cdpMethod = frame.cdpMethod as string;
+        let content: string;
+        let isError = false;
+        if (cdpMethod === "Browser.getVersion") {
+          content = JSON.stringify({
+            product: "Chrome/macOS-SSE-Test",
+            protocolVersion: "1.3",
+            revision: "@macos-sse",
+            userAgent: "Mozilla/5.0 (macOS SSE bridge e2e fixture)",
+            jsVersion: "0.0.0-macos-sse",
+          });
+        } else if (cdpMethod === "Runtime.evaluate") {
+          content = JSON.stringify({ result: { value: "complete" } });
+        } else {
+          content = `mock macOS client: unsupported cdpMethod "${cdpMethod}"`;
+          isError = true;
+        }
+
+        // POST result asynchronously (simulating the real macOS client).
+        void fetch(`${runtimeBaseUrl}/v1/host-browser-result`, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            Authorization: `Bearer ${token}`,
+          },
+          body: JSON.stringify({ requestId, content, isError }),
+        })
+          .then((res) => res.body?.cancel())
+          .catch(() => {});
+      }
+    };
+
+    const proxy = new HostBrowserProxy(sseSender);
+    proxyRef = proxy;
+    return { proxy, conversation, sentFrames };
+  }
+
+  test("happy path: Browser.getVersion round-trips through the SSE bridge without extension registry", async () => {
+    const guardianId = `test-guardian-macos-sse-${crypto.randomUUID()}`;
+    const token = mintActorToken(guardianId);
+
+    const { proxy, sentFrames } = createSseBoundProxy(
+      "conv-macos-sse-happy",
+      token,
+    );
+
+    const result = await proxy.request(
+      { cdpMethod: "Browser.getVersion" },
+      "conv-macos-sse-happy",
+    );
+
+    // The request completed via the SSE bridge path, not the extension registry.
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain("Chrome/macOS-SSE-Test");
+
+    // The SSE sender received exactly one host_browser_request frame.
+    const requests = sentFrames.filter(
+      (f) => f.type === "host_browser_request",
+    );
+    expect(requests).toHaveLength(1);
+    expect(requests[0].cdpMethod).toBe("Browser.getVersion");
+    expect(requests[0].conversationId).toBe("conv-macos-sse-happy");
+
+    // The extension registry should NOT have been involved — no entries exist.
+    expect(getChromeExtensionRegistry().get(guardianId)).toBeUndefined();
+
+    proxy.dispose();
+  });
+
+  test("abort: SSE-bridged request resolves to 'Aborted' when signal fires", async () => {
+    const guardianId = `test-guardian-macos-sse-abort-${crypto.randomUUID()}`;
+    const _token = mintActorToken(guardianId);
+
+    // Use a CDP handler that hangs forever so we can abort mid-flight.
+    const sentFrames: Array<{ type: string; [key: string]: unknown }> = [];
+    let proxyRef: HostBrowserProxy | null = null;
+    const conversation = {
+      resolveHostBrowser(
+        requestId: string,
+        response: { content: string; isError: boolean },
+      ) {
+        proxyRef?.resolve(requestId, response);
+      },
+    } as unknown as Conversation;
+
+    const hangingSender = (msg: ServerMessage) => {
+      const frame = msg as { type: string; [key: string]: unknown };
+      sentFrames.push(frame);
+      if (frame.type === "host_browser_request") {
+        const requestId = frame.requestId as string;
+        pendingInteractions.register(requestId, {
+          conversation,
+          conversationId: "conv-macos-sse-abort",
+          kind: "host_browser",
+        });
+        // Simulate a macOS client that never responds (hangs).
+      }
+    };
+
+    const proxy = new HostBrowserProxy(hangingSender);
+    proxyRef = proxy;
+
+    const controller = new AbortController();
+    const resultPromise = proxy.request(
+      { cdpMethod: "Browser.getVersion" },
+      "conv-macos-sse-abort",
+      controller.signal,
+    );
+
+    // Wait for the SSE sender to observe the request.
+    await waitFor(() => sentFrames.length === 1);
+
+    controller.abort();
+    const result = await resultPromise;
+
+    expect(result.content).toBe("Aborted");
+    expect(result.isError).toBe(true);
+
+    // The cancel frame should have been sent through the SSE sender.
+    const cancels = sentFrames.filter((f) => f.type === "host_browser_cancel");
+    expect(cancels).toHaveLength(1);
+
+    proxy.dispose();
+  });
+
+  test("timeout: SSE-bridged request surfaces timeout when macOS client never responds", async () => {
+    const guardianId = `test-guardian-macos-sse-timeout-${crypto.randomUUID()}`;
+    const _token = mintActorToken(guardianId);
+
+    const sentFrames: Array<{ type: string; [key: string]: unknown }> = [];
+    let proxyRef: HostBrowserProxy | null = null;
+    const conversation = {
+      resolveHostBrowser(
+        requestId: string,
+        response: { content: string; isError: boolean },
+      ) {
+        proxyRef?.resolve(requestId, response);
+      },
+    } as unknown as Conversation;
+
+    const hangingSender = (msg: ServerMessage) => {
+      const frame = msg as { type: string; [key: string]: unknown };
+      sentFrames.push(frame);
+      if (frame.type === "host_browser_request") {
+        const requestId = frame.requestId as string;
+        pendingInteractions.register(requestId, {
+          conversation,
+          conversationId: "conv-macos-sse-timeout",
+          kind: "host_browser",
+        });
+        // Never respond — simulate unresponsive macOS client.
+      }
+    };
+
+    const proxy = new HostBrowserProxy(hangingSender);
+    proxyRef = proxy;
+
+    const result = await proxy.request(
+      { cdpMethod: "Browser.getVersion", timeout_seconds: 0.05 },
+      "conv-macos-sse-timeout",
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("timed out");
+
+    // The SSE sender received the request frame (confirming the timeout
+    // is from the proxy timer, not a send failure).
+    const requests = sentFrames.filter(
+      (f) => f.type === "host_browser_request",
+    );
+    expect(requests).toHaveLength(1);
+    expect(requests[0].cdpMethod).toBe("Browser.getVersion");
+
+    proxy.dispose();
+  });
+
+  test("multiple sequential commands round-trip through the SSE bridge", async () => {
+    const guardianId = `test-guardian-macos-sse-seq-${crypto.randomUUID()}`;
+    const token = mintActorToken(guardianId);
+
+    const { proxy, sentFrames } = createSseBoundProxy(
+      "conv-macos-sse-seq",
+      token,
+    );
+
+    // First command: Browser.getVersion
+    const result1 = await proxy.request(
+      { cdpMethod: "Browser.getVersion" },
+      "conv-macos-sse-seq",
+    );
+    expect(result1.isError).toBe(false);
+    expect(result1.content).toContain("Chrome/macOS-SSE-Test");
+
+    // Second command: Runtime.evaluate
+    const result2 = await proxy.request(
+      { cdpMethod: "Runtime.evaluate", cdpParams: { expression: "1+1" } },
+      "conv-macos-sse-seq",
+    );
+    expect(result2.isError).toBe(false);
+
+    // Both requests went through the SSE sender.
+    const requests = sentFrames.filter(
+      (f) => f.type === "host_browser_request",
+    );
+    expect(requests).toHaveLength(2);
+    expect(requests[0].cdpMethod).toBe("Browser.getVersion");
+    expect(requests[1].cdpMethod).toBe("Runtime.evaluate");
+
+    proxy.dispose();
+  });
+});
+
 // ── Local wait helpers ──────────────────────────────────────────────
 
 async function waitFor(

package/src/__tests__/host-browser-e2e-self-hosted-capability.test.ts

@@ -60,8 +60,13 @@ mock.module("../config/loader.js", () => ({
 import type { Conversation } from "../daemon/conversation.js";
 import { HostBrowserProxy } from "../daemon/host-browser-proxy.js";
 import type { ServerMessage } from "../daemon/message-protocol.js";
-import { getDb, initializeDb } from "../memory/db.js";
-import { mintHostBrowserCapability } from "../runtime/capability-tokens.js";
+import { getDb } from "../memory/db-connection.js";
+import { initializeDb } from "../memory/db-init.js";
+import {
+  mintHostBrowserCapability,
+  resetCapabilityTokenSecretForTests,
+  setCapabilityTokenSecretForTests,
+} from "../runtime/capability-tokens.js";
 import {
   __resetChromeExtensionRegistryForTests,
   getChromeExtensionRegistry,
@@ -125,6 +130,10 @@ describe("host_browser self-hosted capability-token e2e round-trip", () => {
   let runtimeBaseUrl: string;
 
   beforeEach(async () => {
+    // Inject a deterministic secret so mintHostBrowserCapability works
+    // in-process without a live gateway.
+    setCapabilityTokenSecretForTests(Buffer.alloc(32, 0xab));
+
     // Each test gets a clean DB and a fresh registry so connection
     // state doesn't leak between cases.
     const db = getDb();
@@ -143,6 +152,7 @@ describe("host_browser self-hosted capability-token e2e round-trip", () => {
     await server?.stop();
     pendingInteractions.clear();
     __resetChromeExtensionRegistryForTests();
+    resetCapabilityTokenSecretForTests();
   });
 
   test("capability token round-trips Browser.getVersion over WS result transport", async () => {

package/src/__tests__/host-browser-routes.test.ts

@@ -1,32 +1,34 @@
 /**
  * Unit tests for the /v1/host-browser-result route handler.
  *
- * Tests handleHostBrowserResult directly with mocked AuthContext, Request,
- * and a stub Conversation whose resolveHostBrowser method records calls.
+ * Tests handleHostBrowserResult directly via RouteHandlerArgs with a
+ * stub Conversation whose resolveHostBrowser method records calls.
  */
 import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 
 import type { Conversation } from "../daemon/conversation.js";
-import type { AuthContext } from "../runtime/auth/types.js";
 
 // ── Module mocks ─────────────────────────────────────────────────────
 
-let fakeHttpAuthDisabled = true;
-
 mock.module("../config/env.js", () => ({
-  isHttpAuthDisabled: () => fakeHttpAuthDisabled,
+  isHttpAuthDisabled: () => true,
   hasUngatedHttpAuthDisabled: () => false,
 }));
 
 // ── Real imports (after mocks) ───────────────────────────────────────
 
 import * as pendingInteractions from "../runtime/pending-interactions.js";
-import { handleHostBrowserResult } from "../runtime/routes/host-browser-routes.js";
+import { BadRequestError, ConflictError, NotFoundError } from "../runtime/routes/errors.js";
+import { ROUTES } from "../runtime/routes/host-browser-routes.js";
 
 afterAll(() => {
   mock.restore();
 });
 
+const handleHostBrowserResult = ROUTES.find(
+  (r) => r.endpoint === "host-browser-result",
+)!.handler;
+
 // ── Helpers ──────────────────────────────────────────────────────────
 
 interface ResolveHostBrowserCall {
@@ -45,40 +47,11 @@ function makeStubConversation(spy: ResolveHostBrowserCall[]): Conversation {
   } as unknown as Conversation;
 }
 
-const AUTHED_CONTEXT: AuthContext = {
-  subject: "actor:test",
-  principalType: "actor",
-  assistantId: "test-assistant",
-  actorPrincipalId: "actor-principal-1",
-  scopeProfile: "actor_client_v1",
-  scopes: new Set(),
-  policyEpoch: 0,
-};
-
-const UNAUTHED_CONTEXT: AuthContext = {
-  subject: "actor:test",
-  principalType: "actor",
-  assistantId: "test-assistant",
-  // actorPrincipalId intentionally absent
-  scopeProfile: "actor_client_v1",
-  scopes: new Set(),
-  policyEpoch: 0,
-};
-
-function makeJsonRequest(body: unknown): Request {
-  return new Request("http://localhost/v1/host-browser-result", {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify(body),
-  });
-}
-
 // ── Tests ────────────────────────────────────────────────────────────
 
 describe("handleHostBrowserResult", () => {
   beforeEach(() => {
     pendingInteractions.clear();
-    fakeHttpAuthDisabled = true;
   });
 
   test("happy path: resolves a pending host_browser interaction", async () => {
@@ -92,17 +65,11 @@ describe("handleHostBrowserResult", () => {
       kind: "host_browser",
     });
 
-    const req = makeJsonRequest({
-      requestId,
-      content: "ok",
-      isError: false,
+    const result = await handleHostBrowserResult({
+      body: { requestId, content: "ok", isError: false },
     });
 
-    const res = await handleHostBrowserResult(req, AUTHED_CONTEXT);
-    const body = (await res.json()) as { accepted: boolean };
-
-    expect(res.status).toBe(200);
-    expect(body.accepted).toBe(true);
+    expect(result).toEqual({ accepted: true });
     expect(spy).toHaveLength(1);
     expect(spy[0].requestId).toBe(requestId);
     expect(spy[0].response).toEqual({ content: "ok", isError: false });
@@ -111,38 +78,29 @@ describe("handleHostBrowserResult", () => {
     expect(pendingInteractions.get(requestId)).toBeUndefined();
   });
 
-  test("unauthorized: returns 403 when actor is not guardian-bound", async () => {
-    fakeHttpAuthDisabled = false;
-
-    const req = makeJsonRequest({
-      requestId: "browser-req-unauth",
-      content: "anything",
-      isError: false,
-    });
-
-    const res = await handleHostBrowserResult(req, UNAUTHED_CONTEXT);
-    expect(res.status).toBe(403);
+  test("missing body: throws BadRequestError", () => {
+    expect(() => handleHostBrowserResult({})).toThrow(BadRequestError);
   });
 
-  test("missing requestId: returns 400", async () => {
-    const req = makeJsonRequest({ content: "x" });
-
-    const res = await handleHostBrowserResult(req, AUTHED_CONTEXT);
-    expect(res.status).toBe(400);
+  test("missing requestId: throws BadRequestError", () => {
+    expect(() =>
+      handleHostBrowserResult({ body: { content: "x" } }),
+    ).toThrow(BadRequestError);
   });
 
-  test("unknown requestId: returns 404", async () => {
-    const req = makeJsonRequest({
-      requestId: "00000000-0000-0000-0000-000000000000",
-      content: "x",
-      isError: false,
-    });
-
-    const res = await handleHostBrowserResult(req, AUTHED_CONTEXT);
-    expect(res.status).toBe(404);
+  test("unknown requestId: throws NotFoundError", () => {
+    expect(() =>
+      handleHostBrowserResult({
+        body: {
+          requestId: "00000000-0000-0000-0000-000000000000",
+          content: "x",
+          isError: false,
+        },
+      }),
+    ).toThrow(NotFoundError);
   });
 
-  test("wrong kind: returns 409 with mismatch message", async () => {
+  test("wrong kind: throws ConflictError with mismatch message", () => {
     const spy: ResolveHostBrowserCall[] = [];
     const conversation = makeStubConversation(spy);
     const requestId = "browser-req-wrong-kind";
@@ -153,20 +111,11 @@ describe("handleHostBrowserResult", () => {
       kind: "host_bash",
     });
 
-    const req = makeJsonRequest({
-      requestId,
-      content: "x",
-      isError: false,
-    });
-
-    const res = await handleHostBrowserResult(req, AUTHED_CONTEXT);
-    expect(res.status).toBe(409);
-
-    const body = (await res.json()) as {
-      error: { message: string; code?: string };
-    };
-    expect(body.error.message).toContain('"host_bash"');
-    expect(body.error.message).toContain('"host_browser"');
+    expect(() =>
+      handleHostBrowserResult({
+        body: { requestId, content: "x", isError: false },
+      }),
+    ).toThrow(ConflictError);
 
     // Pending interaction should NOT have been consumed
     expect(pendingInteractions.get(requestId)).toBeDefined();
@@ -184,13 +133,9 @@ describe("handleHostBrowserResult", () => {
       kind: "host_browser",
     });
 
-    const req = makeJsonRequest({ requestId });
-
-    const res = await handleHostBrowserResult(req, AUTHED_CONTEXT);
-    const body = (await res.json()) as { accepted: boolean };
+    const result = await handleHostBrowserResult({ body: { requestId } });
 
-    expect(res.status).toBe(200);
-    expect(body.accepted).toBe(true);
+    expect(result).toEqual({ accepted: true });
     expect(spy).toHaveLength(1);
     expect(spy[0].requestId).toBe(requestId);
     expect(spy[0].response).toEqual({ content: "", isError: false });

package/src/__tests__/host-browser-ws-events-e2e.test.ts

@@ -68,8 +68,13 @@ import {
   type ForwardedCdpEvent,
   onCdpEvent,
 } from "../browser-session/index.js";
-import { getDb, initializeDb } from "../memory/db.js";
-import { mintHostBrowserCapability } from "../runtime/capability-tokens.js";
+import { getDb } from "../memory/db-connection.js";
+import { initializeDb } from "../memory/db-init.js";
+import {
+  mintHostBrowserCapability,
+  resetCapabilityTokenSecretForTests,
+  setCapabilityTokenSecretForTests,
+} from "../runtime/capability-tokens.js";
 import {
   __resetChromeExtensionRegistryForTests,
   getChromeExtensionRegistry,
@@ -114,6 +119,8 @@ describe("host_browser WS event + invalidation e2e", () => {
   let runtimeBaseUrl: string;
 
   beforeEach(async () => {
+    setCapabilityTokenSecretForTests(Buffer.alloc(32, 0xab));
+
     const db = getDb();
     db.run("DELETE FROM contact_channels");
     db.run("DELETE FROM contacts");
@@ -135,6 +142,7 @@ describe("host_browser WS event + invalidation e2e", () => {
     pendingInteractions.clear();
     __resetChromeExtensionRegistryForTests();
     __resetBrowserSessionEventsForTests();
+    resetCapabilityTokenSecretForTests();
   });
 
   test("host_browser_event frame fans out to browser-session event bus subscribers", async () => {

package/src/__tests__/host-proxy-interface.test.ts

@@ -24,7 +24,7 @@ describe("supportsHostProxy (runtime)", () => {
       "cli",
       "telegram",
       "phone",
-      "vellum",
+      "web",
       "whatsapp",
       "slack",
       "email",
@@ -42,11 +42,11 @@ describe("supportsHostProxy (runtime)", () => {
     expect(supportsHostProxy("chrome-extension", "host_cu")).toBe(false);
   });
 
-  test("capability form grants host_bash/file/cu to macOS but not host_browser", () => {
+  test("capability form grants all four capabilities to macOS including host_browser", () => {
     expect(supportsHostProxy("macos", "host_bash")).toBe(true);
     expect(supportsHostProxy("macos", "host_file")).toBe(true);
     expect(supportsHostProxy("macos", "host_cu")).toBe(true);
-    expect(supportsHostProxy("macos", "host_browser")).toBe(false);
+    expect(supportsHostProxy("macos", "host_browser")).toBe(true);
   });
 
   test("capability form rejects everything for non-host-proxy interfaces", () => {
@@ -141,7 +141,7 @@ describe("isHostProxyTransport", () => {
       "cli",
       "telegram",
       "phone",
-      "vellum",
+      "web",
       "whatsapp",
       "slack",
       "email",
@@ -163,3 +163,37 @@ describe("isHostProxyTransport", () => {
     expect(isHostProxyTransport(transport)).toBe(false);
   });
 });
+
+// ---------------------------------------------------------------------------
+// macOS host_browser capability — regression guards
+// ---------------------------------------------------------------------------
+
+describe("macOS host_browser capability", () => {
+  test("macOS supports host_browser via supportsHostProxy capability check", () => {
+    // macOS is now host-browser-capable, enabling host_browser_request
+    // frames to be sent to the desktop client via SSE or extension registry.
+    expect(supportsHostProxy("macos", "host_browser")).toBe(true);
+  });
+
+  test("macOS still passes the no-arg host-proxy check (full desktop proxy)", () => {
+    // The no-arg form gates computer-use preactivation and full proxy restore.
+    // macOS must still pass this check.
+    expect(supportsHostProxy("macos")).toBe(true);
+  });
+
+  test("non-macOS non-extension interfaces remain host_browser-ineligible", () => {
+    const ineligible: InterfaceId[] = [
+      "ios",
+      "cli",
+      "telegram",
+      "phone",
+      "web",
+      "whatsapp",
+      "slack",
+      "email",
+    ];
+    for (const id of ineligible) {
+      expect(supportsHostProxy(id, "host_browser")).toBe(false);
+    }
+  });
+});