@wenathlan/devthink 2.0.12 → 2.0.14

package/tests/environments.test.ts

@@ -0,0 +1,259 @@
+import { describe, expect, it } from "vitest";
+import {
+  closeoffscreen,
+  defaultenvironment,
+  environmentrequirementsof,
+  environmentsof,
+  executorregistry,
+  isolatedinjection,
+  markuprenderstep,
+  offloadkinds,
+  openoffscreen,
+  poolplan,
+  routeenvironment,
+  transferablekeys,
+  workerrequestof,
+  workerresponseof,
+  acceptworkerresponse,
+} from "../environments.js";
+import { reviewedkinds } from "../policy.js";
+import type { toolstep } from "../types.js";
+
+const now = 1_000;
+
+function step(kind: toolstep["kind"], extra: Partial<toolstep> = {}): toolstep {
+  return { id: `${kind}-step`, kind, summary: `Run the ${kind} step.`, risk: "read", ...extra };
+}
+
+describe("execution environments", () => {
+  it("routes every reviewed action kind to an allowed environment set with a default", () => {
+    const kinds = reviewedkinds();
+    expect(kinds.length).toBeGreaterThan(330);
+    const requirements = environmentrequirementsof(kinds as toolstep["kind"][]);
+    expect(requirements).toHaveLength(kinds.length);
+    for (const requirement of requirements) {
+      expect(requirement.environments.length).toBeGreaterThan(0);
+      expect(requirement.environments).toContain(requirement.defaultenvironment);
+      for (const environment of requirement.environments)
+        expect(["pagecontext", "isolatedworld", "offscreenworker", "sandboxframe"]).toContain(environment);
+    }
+  });
+
+  it("marks evaluate steps as isolatedworld only and untrusted markup renders as sandboxframe only", () => {
+    expect(environmentsof(step("evaluate"))).toEqual(["isolatedworld"]);
+    expect(defaultenvironment(step("evaluate"))).toBe("isolatedworld");
+    const markupstep = step("setattribute", {
+      options: JSON.stringify({ name: "data-summary", value: "inert", markup: "<p>untrusted</p>" }),
+    });
+    expect(environmentsof(markupstep)).toEqual(["sandboxframe"]);
+    expect(defaultenvironment(markupstep)).toBe("sandboxframe");
+    expect(markuprenderstep(markupstep)).toBe(true);
+    expect(
+      markuprenderstep(step("setattribute", { options: JSON.stringify({ name: "data-summary", value: "inert" }) })),
+    ).toBe(false);
+    expect(markuprenderstep(step("setattribute", { options: "{not json" }))).toBe(false);
+  });
+
+  it("marks the parse heavy read kinds as offscreenworker eligible beside the live page", () => {
+    const families = offloadkinds();
+    expect(families.map((family) => family.task)).toEqual([
+      "htmlsnapshot",
+      "jsonpayload",
+      "tablerows",
+      "a11ytree",
+      "complexselector",
+      "stitchshots",
+    ]);
+    for (const kind of [
+      "readhtml",
+      "parsehtml",
+      "readjson",
+      "parsejson",
+      "readtable",
+      "scrapetable",
+      "a11ytree",
+      "resolvexpath",
+      "deriveselector",
+      "contactsheet",
+      "timelapse",
+      "makethumbs",
+    ] as const) {
+      expect(environmentsof(step(kind))).toEqual(["pagecontext", "offscreenworker"]);
+      expect(defaultenvironment(step(kind))).toBe("pagecontext");
+    }
+    expect(environmentsof(step("click"))).toEqual(["pagecontext"]);
+    expect(environmentsof(step("fillform"))).toEqual(["pagecontext"]);
+  });
+
+  it("maps every environmentkind to its runtime adapter in the executor registry", () => {
+    const registry = executorregistry();
+    expect(registry.map((entry) => entry.environment)).toEqual([
+      "pagecontext",
+      "isolatedworld",
+      "offscreenworker",
+      "sandboxframe",
+    ]);
+    expect(registry.map((entry) => entry.adapter)).toEqual([
+      "pagebridge",
+      "scriptingapi",
+      "offscreendocument",
+      "sandboxpage",
+    ]);
+    for (const entry of registry) expect(entry.description).toMatch(/\./);
+  });
+
+  it("routes steps by the reviewed environment field, the offload toggle and the capability grant with an inline fallback", () => {
+    expect(routeenvironment(step("readhtml"), { offload: false, granted: true }).environment).toBe("pagecontext");
+    expect(routeenvironment(step("readhtml"), { offload: true, granted: true })).toMatchObject({
+      environment: "offscreenworker",
+      fallback: false,
+    });
+    const fallback = routeenvironment(step("readhtml"), { offload: true, granted: false });
+    expect(fallback).toMatchObject({ environment: "pagecontext", fallback: true });
+    expect(fallback.reason).toMatch(/inline parsing/i);
+    expect(routeenvironment(step("evaluate"), { offload: true, granted: true }).environment).toBe("isolatedworld");
+    expect(routeenvironment(step("click"), { offload: true, granted: true }).environment).toBe("pagecontext");
+    const named = routeenvironment(step("readhtml", { environment: "offscreenworker" }), {
+      offload: false,
+      granted: true,
+    });
+    expect(named.environment).toBe("offscreenworker");
+    const refused = routeenvironment(step("click", { environment: "isolatedworld" }), { offload: true, granted: true });
+    expect(refused.environment).toBe("pagecontext");
+    expect(refused.reason).toMatch(/outside the pagecontext the click kind permits/i);
+  });
+
+  it("builds worker requests with the parse family and the transferable keys and reads their answers", () => {
+    const buffer = new ArrayBuffer(8);
+    const request = workerrequestof({
+      id: "w1",
+      runid: "run1",
+      stepid: "s1",
+      kind: "readhtml",
+      payload: "<html><body>heavy</body></html>",
+      options: { snapshot: buffer, label: "front page" },
+      sentat: now,
+    });
+    expect(request.task).toBe("htmlsnapshot");
+    expect(request.transferables).toEqual(["snapshot"]);
+    const partial = acceptworkerresponse(
+      workerresponseof({
+        id: "a1",
+        requestid: request.id,
+        ok: true,
+        partial: 1,
+        summary: "The first chunk streams back.",
+        receivedat: now + 5,
+      }),
+    );
+    expect(partial).toMatchObject({ done: false, partial: true });
+    const final = acceptworkerresponse(
+      workerresponseof({
+        id: "a2",
+        requestid: request.id,
+        ok: true,
+        result: "front page text",
+        summary: "The parse finished.",
+        receivedat: now + 20,
+      }),
+    );
+    expect(final).toMatchObject({ done: true, partial: false, result: "front page text" });
+    const refused = acceptworkerresponse(
+      workerresponseof({
+        id: "a3",
+        requestid: request.id,
+        ok: false,
+        summary: "The payload was malformed.",
+        receivedat: now + 25,
+      }),
+    );
+    expect(refused.done).toBe(true);
+    expect(refused.result).toBeUndefined();
+    expect(transferablekeys({ snapshot: buffer, label: "text" })).toEqual(["snapshot"]);
+    expect(transferablekeys({ label: "text" })).toEqual([]);
+    expect(() =>
+      workerrequestof({ id: "w2", runid: "run1", stepid: "s2", kind: "click", payload: "x", sentat: now }),
+    ).toThrow(/outside the offscreen worker pool families/i);
+    expect(() =>
+      workerrequestof({ id: "w3", runid: "run1", stepid: "s3", kind: "readjson", payload: "  ", sentat: now }),
+    ).toThrow(/payload/i);
+    expect(() => workerresponseof({ id: "w4", requestid: "r", ok: true, summary: " ", receivedat: now })).toThrow(
+      /summary/i,
+    );
+  });
+
+  it("grows and shrinks the worker pool with the pending parse queue and the user configured size with no engine cap", () => {
+    expect(poolplan({ pending: 5, current: 2 })).toMatchObject({ workers: 5, added: 3, retired: 0 });
+    expect(poolplan({ pending: 1, current: 4 })).toMatchObject({ workers: 1, added: 0, retired: 3 });
+    expect(poolplan({ pending: 3, current: 3 })).toMatchObject({ workers: 3, added: 0, retired: 0 });
+    expect(poolplan({ pending: 2, current: 1, size: 8 })).toMatchObject({ workers: 8, added: 7 });
+    expect(poolplan({ pending: 9, current: 6, size: 2 })).toMatchObject({ workers: 2, retired: 4 });
+    expect(poolplan({ pending: 2, current: 2, size: 2 }).reason).toMatch(/user configured/i);
+    expect(poolplan({ pending: 2, current: 2 }).reason).toMatch(/no engine cap|match/i);
+    expect(poolplan({ pending: 1, current: 1, size: 0 })).toMatchObject({ workers: 1, added: 0, retired: 0 });
+  });
+
+  it("spawns the offscreen document on first use, reuses it across the steps of one run and closes it at completion", () => {
+    const first = openoffscreen({
+      registry: [],
+      document: "offscreen.html",
+      runid: "run1",
+      reasons: ["DOM_PARSER", "WORKERS"],
+      justification: "Heavy parsing of reviewed snapshots.",
+      now,
+    });
+    expect(first.reused).toBe(false);
+    const second = openoffscreen({
+      registry: first.registry,
+      document: "offscreen.html",
+      runid: "run1",
+      reasons: ["DOM_PARSER"],
+      justification: "Heavy parsing of reviewed snapshots.",
+      now: now + 10,
+    });
+    expect(second.reused).toBe(true);
+    expect(second.entry).toBe(first.entry);
+    const otherrun = openoffscreen({
+      registry: first.registry,
+      document: "offscreen.html",
+      runid: "run2",
+      reasons: ["DOM_PARSER"],
+      justification: "Heavy parsing of reviewed snapshots.",
+      now: now + 20,
+    });
+    expect(otherrun.reused).toBe(false);
+    const closed = closeoffscreen(otherrun.registry, "run1", now + 30);
+    expect(closed.closed).toBe(true);
+    expect(closed.registry.find((entry) => entry.runid === "run1")?.closedat).toBe(now + 30);
+    expect(closeoffscreen(closed.registry, "run1", now + 40).closed).toBe(false);
+    expect(() =>
+      openoffscreen({ registry: [], document: " ", runid: "run1", reasons: ["DOM_PARSER"], justification: "j", now }),
+    ).toThrow(/document/i);
+    expect(() =>
+      openoffscreen({ registry: [], document: "offscreen.html", runid: "run1", reasons: [], justification: "j", now }),
+    ).toThrow(/reasons/i);
+    expect(() =>
+      openoffscreen({
+        registry: [],
+        document: "offscreen.html",
+        runid: "run1",
+        reasons: ["DOM_PARSER"],
+        justification: " ",
+        now,
+      }),
+    ).toThrow(/justification/i);
+  });
+
+  it("builds the isolated world injection of evaluate steps with reviewed arguments only", () => {
+    const injection = isolatedinjection(
+      step("evaluate", { value: "document.title", options: JSON.stringify(["arg one", "arg two"]) }),
+    );
+    expect(injection.world).toBe("ISOLATED");
+    expect(injection.code).toBe("document.title");
+    expect(injection.args).toEqual(["arg one", "arg two"]);
+    const bare = isolatedinjection(step("evaluate", { value: "1 + 1" }));
+    expect(bare.args).toEqual([]);
+    expect(() => isolatedinjection(step("evaluate", { value: " " }))).toThrow(/reviewed expression/i);
+    expect(() => isolatedinjection(step("click"))).toThrow(/evaluate kind only/i);
+  });
+});

package/tests/evidenceviews.test.ts

@@ -0,0 +1,88 @@
+import { describe, expect, it } from "vitest";
+import {
+  comparepairof,
+  comparepairsforsteps,
+  overlayslider,
+  shotpanelof,
+  shotpanelpan,
+  shotpanelzoom,
+} from "../views.js";
+import { shotpanelgate } from "../policy.js";
+
+const now = 1_800_000_000_000;
+
+describe("shotpanel and compareviewer", () => {
+  it("opens the shotpanel view of a granted origin with its redaction verdicts and refuses ungranted captures", () => {
+    const view = shotpanelof({
+      stepid: "step-2",
+      runid: "run-1",
+      captureid: "shot-9",
+      provenance: "fullpage",
+      origin: "https://example.com",
+      granted: ["https://example.com"],
+      redactions: [{ region: "top right card", verdict: "The card number region stays redacted." }],
+      at: now,
+    });
+    expect(view.captureid).toBe("shot-9");
+    expect(view.provenance).toBe("fullpage");
+    expect(view.redactions[0]?.verdict).toMatch(/redacted/);
+    expect(view.zoom).toBe(1);
+    expect(() =>
+      shotpanelof({
+        stepid: "step-2",
+        runid: "run-1",
+        captureid: "shot-9",
+        provenance: "viewport",
+        origin: "https://other.example",
+        granted: ["https://example.com"],
+        at: now,
+      }),
+    ).toThrow(/allowlist/);
+    expect(shotpanelgate({ captureorigin: "https://example.com", granted: ["https://example.com"] }).allowed).toBe(
+      true,
+    );
+    expect(shotpanelgate({ captureorigin: "https://other.example", granted: ["https://example.com"] }).reason).toMatch(
+      /granted origins/,
+    );
+  });
+
+  it("zooms and pans the large stitched captures", () => {
+    let view = shotpanelof({
+      stepid: "step-2",
+      runid: "run-1",
+      captureid: "shot-9",
+      provenance: "fullpage",
+      origin: "https://example.com",
+      granted: ["https://example.com"],
+      at: now,
+    });
+    view = shotpanelzoom(view, 2);
+    expect(view.zoom).toBe(2);
+    view = shotpanelzoom(view, 1.5);
+    expect(view.zoom).toBe(3);
+    view = shotpanelpan(view, { x: 40, y: -10 });
+    expect(view.pan).toEqual({ x: 40, y: -10 });
+    expect(() => shotpanelzoom(view, 0)).toThrow(/positive/);
+  });
+
+  it("pairs the before and after captures of every executed write step and overlays them with a slider", () => {
+    const pair = comparepairof({ stepid: "step-5", beforecaptureid: "shot-10", aftercaptureid: "shot-11" });
+    expect(pair.slidervalue).toBe(50);
+    const slid = overlayslider(pair, 80);
+    expect(slid.slidervalue).toBe(80);
+    expect(() => overlayslider(pair, 120)).toThrow(/between zero and one hundred/);
+    expect(() => comparepairof({ stepid: "step-5", beforecaptureid: "shot-10", aftercaptureid: "shot-10" })).toThrow(
+      /distinct/,
+    );
+    const pairs = comparepairsforsteps(
+      [
+        { stepid: "read-1", risk: "read", writeexecuted: false },
+        { stepid: "fill-2", risk: "sensitive", writeexecuted: true },
+        { stepid: "fill-3", risk: "sensitive", writeexecuted: false },
+      ],
+      { "fill-2": { beforecaptureid: "b-2", aftercaptureid: "a-2" }, "fill-3": { beforecaptureid: "b-3" } },
+    );
+    expect(pairs.map((candidate) => candidate.stepid)).toEqual(["fill-2"]);
+    expect(pairs[0]?.beforecaptureid).toBe("b-2");
+  });
+});

package/tests/exporttools.test.ts

@@ -0,0 +1,185 @@
+import { describe, expect, it } from "vitest";
+import {
+  chainrows,
+  csvfield,
+  csvof,
+  exportchain,
+  exportdescriptorof,
+  exportextractions,
+  exportnotes,
+  exportrecords,
+  noterow,
+  unmaskedfieldsof,
+} from "../export.js";
+import { defaultmaskshapes } from "../security.js";
+import { appendlogentry, openrunlog } from "../security.js";
+
+const now = 1_800_000_000_000;
+
+describe("exporttools descriptors", () => {
+  it("validates the format and scope pair of every export", () => {
+    expect(exportdescriptorof("csv", "runs")).toEqual({ format: "csv", scope: "runs" });
+    expect(exportdescriptorof("json", "extractions").scope).toBe("extractions");
+    expect(exportdescriptorof("log", "notes").format).toBe("log");
+    expect(exportdescriptorof("jsonl", "audit").format).toBe("jsonl");
+    expect(exportdescriptorof("markdown", "extraction").scope).toBe("extraction");
+    expect(() => exportdescriptorof("xml", "runs")).toThrow(/csv, json, log, jsonl and markdown/);
+    expect(() => exportdescriptorof("csv", "profiles")).toThrow(
+      /runs, extractions, notes, session, audit and extraction/,
+    );
+  });
+
+  it("escapes csv fields the csv way", () => {
+    expect(csvfield("plain")).toBe("plain");
+    expect(csvfield('with "quote"')).toBe('"with ""quote"""');
+    expect(csvfield("a,b")).toBe('"a,b"');
+    expect(csvfield("line\nbreak")).toBe('"line\nbreak"');
+    expect(csvof([{ a: "1", b: "2" }, { a: "x,y" }])).toBe('a,b\n1,2\n"x,y",');
+  });
+});
+
+describe("exporttools records", () => {
+  it("honors the mask verdicts in every format: the verdicts mask the fields they hold back", () => {
+    const records = [{ name: "email", password: "hunter2", author: "user", note: "plain" }];
+    const csv = exportrecords({
+      descriptor: exportdescriptorof("csv", "extractions"),
+      records: [{ name: "email", password: "[redacted]", author: "user", note: "plain" }],
+      shapes: [...defaultmaskshapes],
+    });
+    expect(csv.result.rows).toBe(1);
+    expect(csv.content).toContain("[redacted]");
+    expect(csv.content).toContain("plain");
+    const json = exportrecords({
+      descriptor: exportdescriptorof("json", "extractions"),
+      records: [{ name: "email", password: "[redacted]", author: "user", note: "plain" }],
+      shapes: [...defaultmaskshapes],
+    });
+    expect(JSON.parse(json.content)[0].password).toBe("[redacted]");
+    expect(JSON.parse(json.content)[0].author).toBe("[redacted]");
+    const log = exportrecords({
+      descriptor: exportdescriptorof("log", "extractions"),
+      records: [{ name: "email", password: "[redacted]", note: "plain" }],
+      shapes: [...defaultmaskshapes],
+    });
+    expect(log.content).toContain("password=[redacted]");
+    expect(log.content).toContain("note=plain");
+    const usershapes = exportrecords({
+      descriptor: exportdescriptorof("csv", "extractions"),
+      records: [{ internalcode: "raw" }],
+      shapes: [...defaultmaskshapes, "internalcode"],
+    });
+    expect(usershapes.result.rows).toBe(1);
+    expect(usershapes.content).toContain("[redacted]");
+    expect(unmaskedfieldsof(records)).toEqual(["password"]);
+  });
+
+  it("refuses to export unmasked values in full under any format", () => {
+    const records = [{ name: "email", password: "hunter2" }];
+    const refused = exportrecords({
+      descriptor: exportdescriptorof("csv", "extractions"),
+      records,
+      shapes: [...defaultmaskshapes],
+    });
+    expect(refused.result.rows).toBe(0);
+    expect(refused.result.bytes).toBe(0);
+    expect(refused.content).toBe("");
+    expect(refused.result.reason).toMatch(/refuses 1 unmasked value.*password/);
+    expect(unmaskedfieldsof(records)).toEqual(["password"]);
+    expect(unmaskedfieldsof([{ apikey: "xyz" }])).toEqual(["apikey"]);
+    expect(unmaskedfieldsof([{ authorization: "Bearer raw" }])).toEqual(["authorization"]);
+    expect(unmaskedfieldsof([{ password: "[redacted]" }])).toEqual([]);
+    expect(unmaskedfieldsof([{ note: "plain" }])).toEqual([]);
+    expect(unmaskedfieldsof([{ password: "" }])).toEqual([]);
+  });
+
+  it("exports notes with the sealed bodies intact and the plain bodies masked", () => {
+    const notes = [
+      {
+        id: "n1",
+        origin: "https://example.org",
+        title: "Release notes",
+        author: "user",
+        sensitive: true,
+        sealedbody: "sealed:abc",
+        createdat: now,
+        updatedat: now,
+      },
+      {
+        id: "n2",
+        origin: "https://example.org",
+        title: "Plain note",
+        body: "the changelog",
+        author: "user",
+        sensitive: false,
+        createdat: now,
+        updatedat: now,
+      },
+    ];
+    const row = noterow(notes[0] as never);
+    expect(row.sealedbody).toBe("sealed:abc");
+    expect(row.body).toBeUndefined();
+    const exported = exportnotes({
+      descriptor: exportdescriptorof("json", "notes"),
+      notes,
+      shapes: [...defaultmaskshapes],
+    });
+    expect(exported.result.rows).toBe(2);
+    expect(exported.content).toContain("sealed:abc");
+    expect(exported.content).toContain("Release notes");
+    const extractions = exportextractions({
+      descriptor: exportdescriptorof("csv", "extractions"),
+      rows: [{ title: "row", password: "[redacted]" }],
+      shapes: [...defaultmaskshapes],
+    });
+    expect(extractions.content).toContain("[redacted]");
+    const refusedextraction = exportextractions({
+      descriptor: exportdescriptorof("csv", "extractions"),
+      rows: [{ title: "row", password: "hunter2" }],
+      shapes: [...defaultmaskshapes],
+    });
+    expect(refusedextraction.result.reason).toMatch(/refuses 1 unmasked value/);
+  });
+});
+
+describe("exporttools chains", () => {
+  it("verifies the log chain before any byte leaves the store", async () => {
+    let log = openrunlog({ runid: "run:1", sessionid: "flowrun", now });
+    log = await appendlogentry({
+      log,
+      kind: "step",
+      summary: "The step ran.",
+      origin: "https://example.org",
+      stepid: "observe",
+      at: now,
+    });
+    log = await appendlogentry({
+      log,
+      kind: "flowrun",
+      summary: "The flowrun completed.",
+      origin: "https://example.org",
+      at: now + 10,
+    });
+    const rows = chainrows(log.entries);
+    expect(rows).toHaveLength(2);
+    expect(rows[0]).toMatchObject({ kind: "step", origin: "https://example.org", stepid: "observe" });
+    const csv = await exportchain({
+      descriptor: exportdescriptorof("csv", "runs"),
+      log,
+      shapes: [...defaultmaskshapes],
+    });
+    expect(csv.result.rows).toBe(2);
+    expect(csv.content.split("\n")[0]).toContain("kind");
+    const json = await exportchain({
+      descriptor: exportdescriptorof("json", "runs"),
+      log,
+      shapes: [...defaultmaskshapes],
+    });
+    expect(JSON.parse(json.content)).toHaveLength(2);
+    const second = log.entries[1];
+    if (second === undefined) throw new Error("The fixture chain needs its second entry.");
+    const broken = { ...log, entries: [...log.entries.slice(0, 1), { ...second, summary: "tampered" }] };
+    const refused = await exportchain({ descriptor: exportdescriptorof("csv", "runs"), log: broken, shapes: [] });
+    expect(refused.result.rows).toBe(0);
+    expect(refused.result.reason).toMatch(/chain|verification/i);
+  });
+});

package/tests/firefoxprep.test.ts

@@ -0,0 +1,134 @@
+import { describe, expect, it } from "vitest";
+import {
+  firefoxdenylist,
+  firefoxpermissionmap,
+  firefoxprepoverlay,
+  firefoxprepadapt,
+  firefoxprepsplitbundle,
+  firefoxprepdenylistcheck,
+  firefoxactionmap,
+} from "../crossbrowser.js";
+import type { browsermanifestsource, browsermanifestoverlay } from "../types.js";
+
+const sourcesmanifest: browsermanifestsource = {
+  manifest_version: 3,
+  name: "Devthink",
+  version: "1.1.86",
+  description: "test",
+  permissions: ["activeTab", "storage", "scripting", "sidePanel"],
+  optional_permissions: ["tabs", "downloads", "clipboardRead", "clipboardWrite", "offscreen", "nativeMessaging"],
+  optional_host_permissions: ["https://*/*"],
+  background: { service_worker: "background.js", type: "module" },
+  action: { default_popup: "popup.html" },
+  side_panel: { default_path: "sidepanel.html" },
+  options_ui: { page: "optionspage.html", open_in_tab: true },
+  offscreen: { document: "offscreen.html", reasons: ["DOM_PARSER", "WORKERS"], justification: "test" },
+};
+
+describe("firefoxprep", () => {
+  it("writes the browser specific settings with the generated extension id", () => {
+    const overlay = firefoxprepoverlay({
+      extensionid: "devthink@wenathlan",
+      strictminversion: "115.0",
+      backgroundscript: "background.js",
+    });
+    expect(overlay.browser_specific_settings?.id).toBe("devthink@wenathlan");
+    expect(overlay.browser_specific_settings?.strict_min_version).toBe("115.0");
+  });
+
+  it("maps action keys to the firefox equivalents", () => {
+    expect(firefoxactionmap()).toEqual({
+      default_popup: "default_popup",
+      default_title: "default_title",
+      default_icon: "default_icon",
+    });
+  });
+
+  it("moves the service worker to an event page for firefox", () => {
+    const overlay = firefoxprepoverlay({ extensionid: "devthink@wenathlan", backgroundscript: "background.js" });
+    expect(overlay.background?.scripts).toEqual(["background.js"]);
+    expect(overlay.background?.service_worker).toBeUndefined();
+    const split = firefoxprepsplitbundle({ backgroundscript: "background.js" });
+    expect(split.scripts).toEqual(["background.js"]);
+    expect(split.serviceworkerdropped).toBe(true);
+  });
+
+  it("rewrites optional permission names where they differ", () => {
+    const map = firefoxpermissionmap();
+    expect(map.offscreen).toBe("");
+    expect(map.tabs).toBe("tabs");
+    expect(map.nativeMessaging).toBe("nativeMessaging");
+  });
+
+  it("keeps host permissions empty on every browser", () => {
+    const overlay = firefoxprepoverlay({ extensionid: "devthink@wenathlan", backgroundscript: "background.js" });
+    expect(overlay.host_permissions).toEqual([]);
+    const adapted = firefoxprepadapt({ manifest: sourcesmanifest, overlay, backgroundscripts: ["background.js"] });
+    expect(adapted.manifest.host_permissions).toEqual([]);
+  });
+
+  it("splits the background bundle for event page semantics", () => {
+    const overlay = firefoxprepoverlay({ extensionid: "devthink@wenathlan", backgroundscript: "background.js" });
+    expect(overlay.background?.scripts).toEqual(["background.js"]);
+  });
+
+  it("keeps the deny list in force across overlays", () => {
+    const check = firefoxprepdenylistcheck({ manifest: sourcesmanifest });
+    expect(check.ok).toBe(true);
+    expect(check.refused).toEqual([]);
+    const refused: browsermanifestsource = { ...sourcesmanifest, permissions: ["debugger", "storage"] };
+    const refusedcheck = firefoxprepdenylistcheck({ manifest: refused });
+    expect(refusedcheck.ok).toBe(false);
+    expect(refusedcheck.refused).toEqual(["debugger"]);
+  });
+
+  it("drops the offscreen field and the side_panel field on the firefox manifest", () => {
+    const overlay = firefoxprepoverlay({ extensionid: "devthink@wenathlan", backgroundscript: "background.js" });
+    const adapted = firefoxprepadapt({ manifest: sourcesmanifest, overlay, backgroundscripts: ["background.js"] });
+    expect(adapted.manifest.offscreen).toBeUndefined();
+    expect(adapted.manifest.side_panel).toBeUndefined();
+    expect(adapted.changes.length).toBeGreaterThan(5);
+  });
+
+  it("writes the browser_specific_settings gecko block with the extension id", () => {
+    const overlay = firefoxprepoverlay({
+      extensionid: "devthink@wenathlan",
+      strictminversion: "115.0",
+      backgroundscript: "background.js",
+    });
+    const adapted = firefoxprepadapt({ manifest: sourcesmanifest, overlay, backgroundscripts: ["background.js"] });
+    expect(adapted.manifest.browser_specific_settings?.gecko?.id).toBe("devthink@wenathlan");
+    expect(adapted.manifest.browser_specific_settings?.gecko?.strict_min_version).toBe("115.0");
+  });
+
+  it("refuses an overlay for the wrong browser", () => {
+    const wrong: browsermanifestoverlay = { browser: "safari" };
+    expect(() =>
+      firefoxprepadapt({ manifest: sourcesmanifest, overlay: wrong, backgroundscripts: ["background.js"] }),
+    ).toThrow();
+  });
+
+  it("refuses a manifest with required host permissions", () => {
+    const overlay = firefoxprepoverlay({ extensionid: "devthink@wenathlan", backgroundscript: "background.js" });
+    const withHosts: browsermanifestsource = { ...sourcesmanifest, host_permissions: ["https://example.com/*"] };
+    expect(() => firefoxprepadapt({ manifest: withHosts, overlay, backgroundscripts: ["background.js"] })).toThrow();
+  });
+
+  it("removes the offscreen optional permission for firefox", () => {
+    const overlay = firefoxprepoverlay({ extensionid: "devthink@wenathlan", backgroundscript: "background.js" });
+    const adapted = firefoxprepadapt({ manifest: sourcesmanifest, overlay, backgroundscripts: ["background.js"] });
+    expect(adapted.manifest.optional_permissions).not.toContain("offscreen");
+    expect(adapted.manifest.optional_permissions).toContain("tabs");
+    expect(adapted.manifest.optional_permissions).toContain("nativeMessaging");
+  });
+
+  it("declares the firefox deny list of forbidden permissions", () => {
+    expect(firefoxdenylist).toContain("debugger");
+    expect(firefoxdenylist).toContain("cookies");
+    expect(firefoxdenylist).toContain("webRequest");
+    expect(firefoxdenylist).toContain("history");
+    expect(firefoxdenylist).toContain("bookmarks");
+    expect(firefoxdenylist).toContain("proxy");
+    expect(firefoxdenylist).toContain("management");
+  });
+});