@vitest/browser 4.1.8 → 4.1.10

package/dist/client/.vite/manifest.json

@@ -4,7 +4,7 @@
     "name": "utils"
   },
   "orchestrator.html": {
-    "file": "__vitest_browser__/orchestrator-B-wB8WWP.js",
+    "file": "__vitest_browser__/orchestrator-KVYrTcFi.js",
     "name": "orchestrator",
     "src": "orchestrator.html",
     "isEntry": true,
@@ -13,7 +13,7 @@
     ]
   },
   "tester/tester.html": {
-    "file": "__vitest_browser__/tester-DQAp97S5.js",
+    "file": "__vitest_browser__/tester-BJtsJFpD.js",
     "name": "tester",
     "src": "tester/tester.html",
     "isEntry": true,

package/dist/client/__vitest_browser__/{orchestrator-B-wB8WWP.js → orchestrator-KVYrTcFi.js}

@@ -10,6 +10,8 @@ class IframeOrchestrator {
   cancelled = false;
   recreateNonIsolatedIframe = false;
   iframes = /* @__PURE__ */ new Map();
+  readyIframes = /* @__PURE__ */ new Set();
+  readyWaiters = /* @__PURE__ */ new Map();
   eventTarget = new EventTarget();
   traces;
   constructor() {
@@ -27,6 +29,9 @@ class IframeOrchestrator {
       "message",
       (e) => this.onGlobalChannelEvent(e)
     );
+    void client.waitForConnection().then(() => client.rpc.onOrchestratorReady()).catch((error) => {
+      debug("failed to notify orchestrator readiness", error);
+    });
   }
   async createTesters(options) {
     await this.traces.waitInit();
@@ -63,6 +68,8 @@ class IframeOrchestrator {
     }
     this.iframes.forEach((iframe) => iframe.remove());
     this.iframes.clear();
+    this.readyIframes.clear();
+    this.readyWaiters.clear();
     for (let i = 0; i < options.files.length; i++) {
       if (this.cancelled) {
         await endSpan();
@@ -104,8 +111,7 @@ class IframeOrchestrator {
   async runNonIsolatedTests(container, options, startTime, otelContext) {
     if (this.recreateNonIsolatedIframe) {
       this.recreateNonIsolatedIframe = false;
-      this.iframes.get(ID_ALL).remove();
-      this.iframes.delete(ID_ALL);
+      this.removeIframe(ID_ALL);
       debug("recreate non-isolated iframe");
     }
     if (!this.iframes.has(ID_ALL)) {
@@ -131,8 +137,7 @@ class IframeOrchestrator {
     const { width, height } = config.browser.viewport;
     const file = spec.filepath;
     if (this.iframes.has(file)) {
-      this.iframes.get(file).remove();
-      this.iframes.delete(file);
+      this.removeIframe(file);
     }
     const iframe = await this.prepareIframe(
       container,
@@ -181,12 +186,12 @@ Expected: ${iframe.src}`
           }
         } else {
           this.iframes.set(iframeId, iframe);
-          this.sendEventToIframe({
+          this.waitForReady(iframeId).then(() => this.sendEventToIframe({
             event: "prepare",
             iframeId,
             startTime,
             otelCarrier: this.traces.getContextCarrier(otelContext)
-          }).then(resolve, (error) => reject(this.dispatchIframeError(error)));
+          })).then(resolve, (error) => reject(this.dispatchIframeError(error)));
         }
       };
       iframe.onerror = (e) => {
@@ -201,6 +206,29 @@ Expected: ${iframe.src}`
     });
     return iframe;
   }
+  markReady(iframeId) {
+    this.readyIframes.add(iframeId);
+    const waiter = this.readyWaiters.get(iframeId);
+    if (waiter) {
+      this.readyWaiters.delete(iframeId);
+      waiter();
+    }
+  }
+  waitForReady(iframeId) {
+    if (this.readyIframes.has(iframeId)) {
+      return Promise.resolve();
+    }
+    return new Promise((resolve) => {
+      this.readyWaiters.set(iframeId, resolve);
+    });
+  }
+  removeIframe(iframeId) {
+    const iframe = this.iframes.get(iframeId);
+    this.iframes.delete(iframeId);
+    this.readyIframes.delete(iframeId);
+    this.readyWaiters.delete(iframeId);
+    iframe == null ? void 0 : iframe.remove();
+  }
   loggedIframe = /* @__PURE__ */ new WeakSet();
   createWarningMessage(iframeId, location) {
     return `The iframe${iframeId === ID_ALL ? "" : ` for "${iframeId}"`} was reloaded ${location}. This can lead to unexpected behavior during tests, duplicated test results or tests hanging.
@@ -257,6 +285,10 @@ If you are using a framework that manipulates browser history (like React Router
   async onIframeEvent(e) {
     debug("iframe event", JSON.stringify(e.data));
     switch (e.data.event) {
+      case "ready": {
+        this.markReady(e.data.iframeId);
+        break;
+      }
       case "viewport": {
         const { width, height, iframeId: id } = e.data;
         const iframe = this.iframes.get(id);

package/dist/client/__vitest_browser__/{tester-DQAp97S5.js → tester-BJtsJFpD.js}

@@ -2151,6 +2151,10 @@ const commands = new CommandsManager();
 getBrowserState().commands = commands;
 getBrowserState().activeTraceTaskIds = /* @__PURE__ */ new Set();
 getBrowserState().iframeId = iframeId;
+channel.postMessage({
+  event: "ready",
+  iframeId
+});
 let contextSwitched = false;
 async function prepareTestEnvironment(options) {
   debug == null ? void 0 : debug("trying to resolve the runner");

package/dist/client/orchestrator.html

@@ -26,7 +26,7 @@
     {__VITEST_INJECTOR__}
     {__VITEST_ERROR_CATCHER__}
     {__VITEST_SCRIPTS__}
-    <script type="module" crossorigin src="/__vitest_browser__/orchestrator-B-wB8WWP.js"></script>
+    <script type="module" crossorigin src="/__vitest_browser__/orchestrator-KVYrTcFi.js"></script>
     <link rel="modulepreload" crossorigin href="/__vitest_browser__/utils-BsFW67Gk.js">
   </head>
   <body>

package/dist/client/tester/tester.html

@@ -5,7 +5,7 @@
     <link rel="icon" href="{__VITEST_FAVICON__}" type="image/svg+xml">
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>Vitest Browser Tester</title>
-    <script type="module" crossorigin src="/__vitest_browser__/tester-DQAp97S5.js"></script>
+    <script type="module" crossorigin src="/__vitest_browser__/tester-BJtsJFpD.js"></script>
     <link rel="modulepreload" crossorigin href="/__vitest_browser__/utils-BsFW67Gk.js">
   </head>
   <body>

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { ResolvedConfig, BrowserServerFactory, BrowserCommand, BrowserProviderOption } from 'vitest/node';
+import { TestProject, ResolvedConfig, BrowserServerFactory, BrowserCommand, BrowserProviderOption } from 'vitest/node';
 import { ScreenshotMatcherOptions, NonStandardScreenshotComparators, ScreenshotComparatorRegistry } from '@vitest/browser/context';
 
 interface BaseMetadata {
@@ -61,6 +61,8 @@ declare function parseKeyDef(text: string): {
 	repeat: number;
 }[];
 declare function resolveScreenshotPath(testPath: string, name: string, config: ResolvedConfig, customPath: string | undefined): string;
+declare function assertBrowserFileAccess(project: TestProject, path: string): void;
+declare function assertBrowserApiWrite(project: TestProject, path: string): void;
 
 //#endregion
 //#region src/locatorGenerators.d.ts
@@ -89,5 +91,5 @@ declare function defineBrowserProvider<T extends object = object>(options: Omit<
 	options?: T;
 }): BrowserProviderOption;
 
-export { asLocator, createBrowserServer, defineBrowserCommand, defineBrowserProvider, parseKeyDef, resolveScreenshotPath };
+export { asLocator, assertBrowserApiWrite, assertBrowserFileAccess, createBrowserServer, defineBrowserCommand, defineBrowserProvider, parseKeyDef, resolveScreenshotPath };
 export type { CustomComparatorsRegistry };

package/dist/index.js

@@ -1,7 +1,7 @@
 import { ManualMockedModule, RedirectedModule, AutomockedModule, AutospiedModule, MockerRegistry } from '@vitest/mocker';
 import { dynamicImportPlugin, ServerMockResolver, interceptorPlugin } from '@vitest/mocker/node';
 import c from 'tinyrainbow';
-import { isValidApiRequest, isFileServingAllowed, distDir, rolldownVersion, resolveApiServerConfig, resolveFsAllow, isFileLoadingAllowed, createDebugger, createViteLogger, createViteServer } from 'vitest/node';
+import { isFileLoadingAllowed, isValidApiRequest, isFileServingAllowed, distDir, rolldownVersion, resolveApiServerConfig, resolveFsAllow, createDebugger, createViteLogger, createViteServer } from 'vitest/node';
 import { fileURLToPath } from 'node:url';
 import fs, { readFileSync, createReadStream, promises, existsSync } from 'node:fs';
 import { createRequire } from 'node:module';
@@ -18,7 +18,7 @@ import { PNG } from 'pngjs';
 import { diff } from '@blazediff/core';
 import { WebSocketServer } from 'ws';
 
-var version = "4.1.8";
+var version = "4.1.10";
 
 const _DRIVE_LETTER_START_RE = /^[A-Za-z]:\//;
 function normalizeWindowsPath(input = "") {
@@ -674,6 +674,17 @@ async function getBrowserProvider(options, project) {
 function slash(path) {
 	return path.replace(/\\/g, "/").replace(/\/+/g, "/");
 }
+function assertBrowserFileAccess(project, path) {
+	const normalized = slash(path);
+	if (!isFileLoadingAllowed(project.vite.config, normalized) && !isFileLoadingAllowed(project.vitest.vite.config, normalized)) {
+		throw new Error(`Access denied to "${path}". See Vite config documentation for "server.fs": https://vitejs.dev/config/server-options.html#server-fs-strict.`);
+	}
+}
+function assertBrowserApiWrite(project, path) {
+	if (!project.config.browser.api.allowWrite || !project.vitest.config.api.allowWrite) {
+		throw new Error(`Cannot modify file "${path}". File writing is disabled because the server is exposed to the internet, see https://vitest.dev/config/browser/api.`);
+	}
+}
 
 async function resolveOrchestrator(globalServer, url, res) {
 	let sessionId = url.searchParams.get("sessionId");
@@ -1896,19 +1907,9 @@ _Mime_extensionToType = new WeakMap(), _Mime_typeToExtension = new WeakMap(), _M
 
 var mime = new Mime(types)._freeze();
 
-function assertFileAccess(path, project) {
-	if (!isFileLoadingAllowed(project.vite.config, path) && !isFileLoadingAllowed(project.vitest.vite.config, path)) {
-		throw new Error(`Access denied to "${path}". See Vite config documentation for "server.fs": https://vitejs.dev/config/server-options.html#server-fs-strict.`);
-	}
-}
-function assertWrite(path, project) {
-	if (!project.config.browser.api.allowWrite || !project.vitest.config.api.allowWrite) {
-		throw new Error(`Cannot modify file "${path}". File writing is disabled because server is exposed to the internet, see https://vitest.dev/config/browser/api.`);
-	}
-}
 const readFile = async ({ project }, path, options = {}) => {
 	const filepath = resolve$1(project.config.root, path);
-	assertFileAccess(slash(filepath), project);
+	assertBrowserFileAccess(project, filepath);
 	// never return a Buffer
 	if (typeof options === "object" && !options.encoding) {
 		options.encoding = "utf-8";
@@ -1916,9 +1917,9 @@ const readFile = async ({ project }, path, options = {}) => {
 	return promises.readFile(filepath, options);
 };
 const writeFile = async ({ project }, path, data, options) => {
-	assertWrite(path, project);
+	assertBrowserApiWrite(project, path);
 	const filepath = resolve$1(project.config.root, path);
-	assertFileAccess(slash(filepath), project);
+	assertBrowserFileAccess(project, filepath);
 	const dir = dirname$1(filepath);
 	if (!fs.existsSync(dir)) {
 		await promises.mkdir(dir, { recursive: true });
@@ -1926,14 +1927,14 @@ const writeFile = async ({ project }, path, data, options) => {
 	await promises.writeFile(filepath, data, options);
 };
 const removeFile = async ({ project }, path) => {
-	assertWrite(path, project);
+	assertBrowserApiWrite(project, path);
 	const filepath = resolve$1(project.config.root, path);
-	assertFileAccess(slash(filepath), project);
+	assertBrowserFileAccess(project, filepath);
 	await promises.rm(filepath);
 };
 const _fileInfo = async ({ project }, path, encoding) => {
 	const filepath = resolve$1(project.config.root, path);
-	assertFileAccess(slash(filepath), project);
+	assertBrowserFileAccess(project, filepath);
 	const content = await promises.readFile(filepath, encoding || "base64");
 	return {
 		content,
@@ -2249,7 +2250,7 @@ const screenshotMatcher = async (context, name, testName, options) => {
 		comparator,
 		comparatorOptions
 	});
-	await performSideEffects(outcome, codec);
+	await performSideEffects(outcome, codec, context.project);
 	return buildOutput(outcome, timeout);
 };
 /**
@@ -2335,17 +2336,17 @@ async function determineOutcome({ comparator, comparatorOptions, paths, referenc
 *
 * Only `missing-reference`, `update-reference`, and `mismatch` write files. Successful matches produce no side effects.
 */
-async function performSideEffects(outcome, codec) {
+async function performSideEffects(outcome, codec, project) {
 	switch (outcome.type) {
 		case "missing-reference":
 		case "update-reference": {
-			await writeScreenshot(outcome.reference.path, await codec.encode(outcome.reference.image, {}));
+			await writeScreenshot(outcome.reference.path, await codec.encode(outcome.reference.image, {}), project);
 			break;
 		}
 		case "mismatch": {
-			await writeScreenshot(outcome.actual.path, await codec.encode(outcome.actual.image, {}));
+			await writeScreenshot(outcome.actual.path, await codec.encode(outcome.actual.image, {}), project);
 			if (outcome.diff) {
-				await writeScreenshot(outcome.diff.path, await codec.encode(outcome.diff.image, {}));
+				await writeScreenshot(outcome.diff.path, await codec.encode(outcome.diff.image, {}), project);
 			}
 			break;
 		}
@@ -2479,8 +2480,10 @@ async function getStableScreenshot({ codec, context, comparator, comparatorOptio
 	};
 }
 /** Writes encoded images to disk, creating parent directories as needed. */
-async function writeScreenshot(path, image) {
+async function writeScreenshot(path, image, project) {
 	try {
+		assertBrowserApiWrite(project, path);
+		assertBrowserFileAccess(project, path);
 		await mkdir(dirname(path), { recursive: true });
 		await writeFile$1(path, image);
 	} catch (cause) {
@@ -3024,7 +3027,8 @@ function setupBrowserRpc(globalServer, defaultMockerRegistry) {
 		}
 		if (type === "orchestrator") {
 			const session = sessions.getSession(sessionId);
-			// it's possible the session was already resolved by the preview provider
+			// it's possible the session was already resolved by the preview provider,
+			// but we still mark the websocket connection when the page reconnects
 			session?.connected();
 		}
 		const project = vitest.getProjectByName(projectName);
@@ -3033,7 +3037,7 @@ function setupBrowserRpc(globalServer, defaultMockerRegistry) {
 		}
 		wss.handleUpgrade(request, socket, head, (ws) => {
 			wss.emit("connection", ws, request);
-			const { rpc, offCancel } = setupClient(project, rpcId, ws);
+			const { rpc, offCancel } = setupClient(project, rpcId, ws, { sessionId });
 			const state = project.browser.state;
 			const clients = type === "tester" ? state.testers : state.orchestrators;
 			clients.set(rpcId, rpc);
@@ -3072,10 +3076,14 @@ function setupBrowserRpc(globalServer, defaultMockerRegistry) {
 			throw new Error(`Cannot use CDP because browser API write or exec operations are disabled. See https://vitest.dev/config/browser/api.`);
 		}
 	}
-	function setupClient(project, rpcId, ws) {
+	function setupClient(project, rpcId, ws, options) {
 		const mockResolver = new ServerMockResolver(globalServer.vite, { moduleDirectories: project.config?.deps?.moduleDirectories });
 		const mocker = project.browser?.provider.mocker;
 		const rpc = createBirpc({
+			onOrchestratorReady() {
+				const sessions = vitest._browserSessions;
+				sessions.getSession(options.sessionId)?.ready();
+			},
 			async onUnhandledError(error, type) {
 				if (error && typeof error === "object") {
 					const _error = error;
@@ -3109,6 +3117,16 @@ function setupBrowserRpc(globalServer, defaultMockerRegistry) {
 						artifact.attachments = [];
 						vitest.logger.error(`[vitest] Cannot record attachments ("${attachments}") because file writing is disabled, removing attachments from artifact "${artifact.type}". See https://vitest.dev/config/browser/api.`);
 					}
+				} else {
+					// attachment files are copied into `attachmentsDir`, so confine
+					// client-supplied paths to Vite's `server.fs` boundary
+					const attachments = artifact.type === "internal:annotation" ? artifact.annotation.attachment ? [artifact.annotation.attachment] : [] : artifact.attachments ?? [];
+					for (const attachment of attachments) {
+						const path = attachment.path;
+						if (path && !path.startsWith("http://") && !path.startsWith("https://")) {
+							checkFileAccess(resolve(project.config.root, path));
+						}
+					}
 				}
 				return vitest._testRun.recordArtifact(id, artifact);
 			},
@@ -7945,4 +7963,4 @@ function defineBrowserProvider(options) {
 	};
 }
 
-export { asLocator, createBrowserServer, defineBrowserCommand, defineBrowserProvider, parseKeyDef, resolveScreenshotPath };
+export { asLocator, assertBrowserApiWrite, assertBrowserFileAccess, createBrowserServer, defineBrowserCommand, defineBrowserProvider, parseKeyDef, resolveScreenshotPath };

package/dist/types.d.ts

@@ -11,6 +11,7 @@ export interface WebSocketBrowserHandlers {
 	onTaskArtifactRecord: <Artifact extends TestArtifact>(testId: string, artifact: Artifact) => Promise<Artifact>;
 	onTaskUpdate: (method: TestExecutionMethod, packs: TaskResultPack[], events: TaskEventPack[]) => void;
 	onAfterSuiteRun: (meta: AfterSuiteRunMeta) => void;
+	onOrchestratorReady: () => void;
 	cancelCurrentRun: (reason: CancelReason) => void;
 	getCountOfFailedTests: () => number;
 	readSnapshotFile: (id: string) => Promise<string | null>;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vitest/browser",
   "type": "module",
-  "version": "4.1.8",
+  "version": "4.1.10",
   "description": "Browser running for Vitest",
   "license": "MIT",
   "funding": "https://opencollective.com/vitest",
@@ -57,7 +57,7 @@
     "providers"
   ],
   "peerDependencies": {
-    "vitest": "4.1.8"
+    "vitest": "4.1.10"
   },
   "dependencies": {
     "@blazediff/core": "1.9.1",
@@ -66,8 +66,8 @@
     "sirv": "^3.0.2",
     "tinyrainbow": "^3.1.0",
     "ws": "^8.19.0",
-    "@vitest/mocker": "4.1.8",
-    "@vitest/utils": "4.1.8"
+    "@vitest/mocker": "4.1.10",
+    "@vitest/utils": "4.1.10"
   },
   "devDependencies": {
     "@opentelemetry/api": "^1.9.0",
@@ -79,8 +79,8 @@
     "ivya": "^1.8.0",
     "mime": "^4.1.0",
     "pathe": "^2.0.3",
-    "vitest": "4.1.8",
-    "@vitest/runner": "4.1.8"
+    "@vitest/runner": "4.1.10",
+    "vitest": "4.1.10"
   },
   "scripts": {
     "typecheck": "tsc -p ./src/client/tsconfig.json --noEmit",