@wenathlan/devthink 2.0.13 → 2.0.15

package/tests/core.test.ts

@@ -0,0 +1,417 @@
+import { afterEach, describe, it } from "vitest";
+import assert from "node:assert/strict";
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { createMemoryStore } from "../workbenchmemory.js";
+import {
+  migrateLegacyCredentials,
+  readAuth,
+  readConfig,
+  redactAuth,
+  redactConfig,
+  resolveCredential,
+  resolvePaths,
+  saveConfig,
+  setAuthCredential,
+  type DevThinkConfig,
+} from "../config.js";
+import { listModes } from "../modes.js";
+import { parseEventStream, type ChatEvent } from "../streaming.js";
+import { startServer, type ServerHandle } from "../server.js";
+import { appendMessage, createSession, createTab, loadWorkspace } from "../workbenchsession.js";
+import { createPairing, createPairingLink, getIdentity, setIdentityUserId } from "../identity.js";
+import { isCompactId } from "../ids.js";
+import {
+  isAllowedOrigin,
+  isSecureRemoteEndpoint,
+  normalizeBasePath,
+  redactProviderError,
+  retryDelay,
+} from "../compatibility.js";
+
+const temporary: string[] = [];
+const servers: ServerHandle[] = [];
+
+afterEach(async () => {
+  for (const server of servers.splice(0)) await server.stop();
+  for (const path of temporary.splice(0)) rmSync(path, { recursive: true, force: true });
+});
+
+function streamResponse(payload: string): Response {
+  const body = new ReadableStream<Uint8Array>({
+    start(controller) {
+      controller.enqueue(new TextEncoder().encode(payload));
+      controller.close();
+    },
+  });
+  return new Response(body, { headers: { "content-type": "text/event-stream" } });
+}
+
+async function eventsFrom(response: Response, provider: string): Promise<ChatEvent[]> {
+  const events: ChatEvent[] = [];
+  for await (const event of parseEventStream(response, { provider, model: "test-model" })) events.push(event);
+  return events;
+}
+
+describe("stream normalization", () => {
+  it("normalizes OpenAI-shaped text deltas", async () => {
+    const events = await eventsFrom(
+      streamResponse('data: {"choices":[{"delta":{"content":"hello"}}]}\n\ndata: [DONE]\n\n'),
+      "openai",
+    );
+    assert.equal(
+      events.some((event) => event.type === "text" && event.text === "hello"),
+      true,
+    );
+  });
+
+  it("normalizes Anthropic named events", async () => {
+    const events = await eventsFrom(
+      streamResponse(
+        'event: content_block_delta\ndata: {"type":"content_block_delta","delta":{"type":"text_delta","text":"hello"}}\n\nevent: message_stop\ndata: {"type":"message_stop"}\n\n',
+      ),
+      "anthropic",
+    );
+    assert.equal(
+      events.some((event) => event.type === "text" && event.text === "hello"),
+      true,
+    );
+    assert.equal(
+      events.some((event) => event.type === "finish"),
+      true,
+    );
+  });
+
+  it("normalizes Gemini candidates", async () => {
+    const events = await eventsFrom(
+      streamResponse('data: {"candidates":[{"content":{"parts":[{"text":"hello"}]}}]}\n\n'),
+      "google",
+    );
+    assert.equal(
+      events.some((event) => event.type === "text" && event.text === "hello"),
+      true,
+    );
+  });
+});
+
+describe("local memory", () => {
+  it("resolves session before project and global memory", () => {
+    const root = mkdtempSync(join(tmpdir(), "devthink-test-"));
+    temporary.push(root);
+    const paths = resolvePaths(root);
+    const store = createMemoryStore(paths);
+    store.remember({ layer: "global", key: "topic", content: "global" });
+    store.remember({ layer: "project", key: "topic", content: "project" });
+    store.remember({ layer: "session", key: "session-1", content: "session topic" });
+    assert.equal(store.resolve({ text: "topic", sessionId: "session-1" })?.content, "session topic");
+  });
+});
+
+describe("configuration and modes", () => {
+  it("redacts configured credentials", () => {
+    const config: DevThinkConfig = { provider: "openai", apiKey: "secret-value" };
+    assert.equal(String(redactConfig(config).apiKey).includes("secret-value"), false);
+  });
+
+  it("registers all 20 modes", () => {
+    assert.equal(listModes().length, 20);
+  });
+
+  it("redacts nested provider secrets", () => {
+    const config: DevThinkConfig = {
+      providers: { zai: { apiKey: "nested-secret-value", auth: { kind: "bearer", value: "nested-token-value" } } },
+    };
+    const redacted = JSON.stringify(redactConfig(config));
+    assert.equal(redacted.includes("nested-secret-value"), false);
+    assert.equal(redacted.includes("nested-token-value"), false);
+  });
+
+  it("stores explicit official credentials in auth.json and resolves them before legacy config", () => {
+    const root = mkdtempSync(join(tmpdir(), "devthink-auth-"));
+    temporary.push(root);
+    const paths = resolvePaths(root);
+    setAuthCredential("zai", { kind: "api-key", value: "official-user-key" }, paths);
+    assert.equal(paths.auth.endsWith("auth.json"), true);
+    assert.equal(existsSync(paths.auth), true);
+    assert.equal(
+      resolveCredential("zai", { providers: { zai: { apiKey: "legacy-key" } } }, paths),
+      "official-user-key",
+    );
+    assert.equal(JSON.stringify(redactAuth(readAuth(paths))).includes("official-user-key"), false);
+  });
+
+  it("rejects browser-session fields in auth.json and migrates legacy credential values explicitly", () => {
+    const root = mkdtempSync(join(tmpdir(), "devthink-auth-migrate-"));
+    temporary.push(root);
+    const paths = resolvePaths(root);
+    writeFileSync(
+      paths.auth,
+      JSON.stringify({
+        version: 1,
+        providers: { zai: { kind: "bearer", value: "unsafe", cookies: ["browser-session"] } },
+      }),
+    );
+    assert.deepEqual(readAuth(paths).providers, {});
+    const legacy: DevThinkConfig = { providers: { zai: { apiKey: "legacy-zai-key" } } };
+    const result = migrateLegacyCredentials(legacy, paths);
+    assert.deepEqual(result.migrated, ["zai"]);
+    assert.equal(readAuth(paths).providers.zai?.value, "legacy-zai-key");
+    assert.equal(readConfig(paths).providers?.zai?.apiKey, undefined);
+  });
+});
+
+describe("converted TypeScript compatibility", () => {
+  it("bounds retries and redacts bearer text before output", () => {
+    assert.equal(retryDelay(0), 250);
+    assert.equal(retryDelay(20), 4_000);
+    assert.equal(
+      redactProviderError("upstream Bearer private-token-value failed").includes("private-token-value"),
+      false,
+    );
+  });
+
+  it("requires an explicit origin and a secure remote endpoint", () => {
+    assert.equal(isAllowedOrigin("https://pages.example", ["https://pages.example"]), true);
+    assert.equal(isAllowedOrigin("https://other.example", ["https://pages.example"]), false);
+    assert.equal(isSecureRemoteEndpoint("https://sync.example/api"), true);
+    assert.equal(isSecureRemoteEndpoint("http://sync.example/api"), false);
+  });
+
+  it("normalizes repository-scoped Pages base paths", () => {
+    assert.equal(normalizeBasePath(undefined, "Devthink"), "/Devthink/");
+    assert.equal(normalizeBasePath("Devthink", "ignored"), "/Devthink/");
+  });
+});
+
+describe("embedded gateway configuration", () => {
+  it("uses devthink.json and atomically preserves nested provider data", () => {
+    const root = mkdtempSync(join(tmpdir(), "devthink-config-"));
+    temporary.push(root);
+    const paths = resolvePaths(root);
+    const config: DevThinkConfig = {
+      activeProvider: "zai",
+      activeModel: "glm-5",
+      providers: { zai: { baseUrl: "https://gateway.example/v1", auth: { kind: "api-key", value: "secret" } } },
+    };
+    saveConfig(config, paths);
+    assert.equal(paths.config.endsWith("devthink.json"), true);
+    assert.equal(existsSync(paths.config), true);
+    assert.equal(readConfig(paths).providers?.zai?.baseUrl, "https://gateway.example/v1");
+  });
+});
+
+describe("shared local identity", () => {
+  it("persists one workspace, session, tab and message contract into JSON and SQLite", () => {
+    const root = mkdtempSync(join(tmpdir(), "devthink-identity-"));
+    temporary.push(root);
+    const paths = resolvePaths(root);
+    const session = createSession(paths, { mode: "chat", provider: "zai", model: "glm-5" });
+    const withTab = createTab(paths, session, { label: "route review", sectionId: "inspector" });
+    const persisted = appendMessage(
+      paths,
+      withTab,
+      { role: "user", content: "Preserve this ID." },
+      { tabId: withTab.activeTabId, sectionId: "inspector" },
+    );
+    assert.equal(isCompactId(persisted.workspaceId), true);
+    assert.equal(isCompactId(persisted.id), true);
+    assert.equal(isCompactId(persisted.activeTabId), true);
+    assert.equal(isCompactId(persisted.messages[0].id), true);
+    assert.equal(
+      persisted.tabs.some((tab) => tab.id === persisted.activeTabId),
+      true,
+    );
+    assert.equal(persisted.messages[0].sessionId, persisted.id);
+    assert.equal(persisted.messages[0].workspaceId, persisted.workspaceId);
+    assert.equal(persisted.messages[0].tabId, persisted.activeTabId);
+    assert.equal(loadWorkspace(paths, persisted.workspaceId)?.id, persisted.workspaceId);
+    assert.equal(existsSync(paths.database), true);
+  });
+
+  it("creates one stable public identity with a temporary pairing code", () => {
+    const root = mkdtempSync(join(tmpdir(), "devthink-pairing-"));
+    temporary.push(root);
+    const paths = resolvePaths(root);
+    const identity = getIdentity(paths);
+    const pairing = createPairing(paths);
+    assert.equal(pairing.identity.userId, identity.userId);
+    assert.equal(isCompactId(identity.userId), true);
+    assert.equal(isCompactId(identity.deviceId), true);
+    assert.equal(isCompactId(pairing.pairingId), true);
+    assert.equal(pairing.code.length, 8);
+    assert.equal(existsSync(paths.identity), true);
+    assert.equal(existsSync(paths.pairings), true);
+  });
+
+  it("keeps a user-selected public ID across CLI identity and pairing records", () => {
+    const root = mkdtempSync(join(tmpdir(), "devthink-public-id-"));
+    temporary.push(root);
+    const paths = resolvePaths(root);
+    const updated = setIdentityUserId(paths, "devthinkuser13");
+    const pairing = createPairing(paths);
+    assert.equal(updated.userId, "devthinkuser13");
+    assert.equal(getIdentity(paths).userId, "devthinkuser13");
+    assert.equal(pairing.identity.userId, "devthinkuser13");
+    assert.throws(() => setIdentityUserId(paths, "short"));
+  });
+
+  it("builds a temporary invitation link without provider credentials", () => {
+    const link = createPairingLink(
+      "https://wenathlan.github.io/devthink/",
+      "http://127.0.0.1:42042",
+      "pair_example",
+      "ABCDEFGH",
+    );
+    assert.equal(link?.includes("pair=pair_example"), true);
+    assert.equal(link?.includes("code=ABCDEFGH"), true);
+    assert.equal(link?.includes("gateway=http%3A%2F%2F127.0.0.1%3A42042"), true);
+    assert.equal(link?.includes("token="), false);
+    assert.equal(createPairingLink("not-a-url", "http://127.0.0.1:42042", "pair", "ABCDEFGH"), undefined);
+  });
+});
+
+describe("local server", () => {
+  it("serves health on loopback", async () => {
+    const server = await startServer({ config: {} });
+    servers.push(server);
+    const response = await fetch(`${server.address}/health`);
+    assert.equal(response.status, 200);
+    assert.deepEqual(await response.json(), { status: "ok", service: "devthink" });
+    assert.equal(server.address.startsWith("http://127.0.0.1:"), true);
+  });
+
+  it("uses identical IDs through the workspace, session and tab gateway routes", async () => {
+    const root = mkdtempSync(join(tmpdir(), "devthink-gateway-"));
+    temporary.push(root);
+    const paths = resolvePaths(root);
+    const server = await startServer({ config: {}, paths });
+    servers.push(server);
+    const created = await fetch(`${server.address}/sessions`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ mode: "chat", provider: "mimo", model: "mimo-v2.5-pro", sectionId: "chat" }),
+    });
+    assert.equal(created.status, 201);
+    const session = (await created.json()) as { id: string; workspaceId: string; activeTabId: string };
+    const read = await fetch(`${server.address}/sessions/${session.id}`);
+    assert.equal(read.status, 200);
+    const tabResponse = await fetch(`${server.address}/sessions/${session.id}/tabs`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ label: "inspector route", sectionId: "inspector" }),
+    });
+    assert.equal(tabResponse.status, 201);
+    const updated = (await tabResponse.json()) as {
+      workspaceId: string;
+      activeTabId: string;
+      tabs: Array<{ id: string; sectionId: string }>;
+    };
+    assert.equal(updated.workspaceId, session.workspaceId);
+    assert.equal(
+      updated.tabs.some((tab) => tab.id === updated.activeTabId && tab.sectionId === "inspector"),
+      true,
+    );
+    const workspace = await fetch(`${server.address}/workspaces/${session.workspaceId}`);
+    assert.equal(workspace.status, 200);
+  });
+
+  it("lists local projects and usage while allowing a paired browser to set the active provider", async () => {
+    const root = mkdtempSync(join(tmpdir(), "devthink-dashboard-"));
+    temporary.push(root);
+    const paths = resolvePaths(root);
+    const origin = "https://pages.example";
+    const server = await startServer({ config: { web: { allowedOrigins: [origin] } }, paths });
+    servers.push(server);
+    const pairing = createPairing(paths);
+    const paired = await fetch(`${server.address}/pairings/consume`, {
+      method: "POST",
+      headers: { origin, "content-type": "application/json" },
+      body: JSON.stringify({ pairingId: pairing.pairingId, code: pairing.code }),
+    });
+    const { token } = (await paired.json()) as { token: string };
+    const headers = { origin, authorization: `Bearer ${token}`, "content-type": "application/json" };
+    const created = await fetch(`${server.address}/sessions`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({ mode: "chat", provider: "zai", model: "glm-5" }),
+    });
+    assert.equal(created.status, 201);
+    const projects = await fetch(`${server.address}/workspaces`, { headers });
+    assert.equal(((await projects.json()) as { workspaces: unknown[] }).workspaces.length, 1);
+    const usage = await fetch(`${server.address}/usage`, { headers });
+    assert.equal(((await usage.json()) as { sessions: number }).sessions, 1);
+    const settings = await fetch(`${server.address}/settings`, { headers });
+    assert.equal(settings.status, 200);
+    assert.equal(
+      ((await settings.json()) as { database: { local: boolean; ownerUserId: string } }).database.local,
+      true,
+    );
+    const provider = await fetch(`${server.address}/providers/active`, {
+      method: "PATCH",
+      headers,
+      body: JSON.stringify({ provider: "zai", model: "glm-5" }),
+    });
+    assert.equal(provider.status, 200);
+  });
+
+  it("consumes a web pairing once and revokes browser access", async () => {
+    const root = mkdtempSync(join(tmpdir(), "devthink-web-pairing-"));
+    temporary.push(root);
+    const paths = resolvePaths(root);
+    const origin = "https://pages.example";
+    const server = await startServer({ config: { web: { allowedOrigins: [origin] } }, paths });
+    servers.push(server);
+    const pairing = createPairing(paths);
+    const consumed = await fetch(`${server.address}/pairings/consume`, {
+      method: "POST",
+      headers: { origin, "content-type": "application/json" },
+      body: JSON.stringify({ pairingId: pairing.pairingId, code: pairing.code }),
+    });
+    assert.equal(consumed.status, 201);
+    const credential = (await consumed.json()) as { token: string; userId: string };
+    const identity = await fetch(`${server.address}/identity`, {
+      headers: { origin, authorization: `Bearer ${credential.token}` },
+    });
+    assert.equal(identity.status, 200);
+    assert.equal(((await identity.json()) as { identity: { userId: string } }).identity.userId, credential.userId);
+    const selectedIdentity = await fetch(`${server.address}/identity`, {
+      method: "PUT",
+      headers: { origin, authorization: `Bearer ${credential.token}`, "content-type": "application/json" },
+      body: JSON.stringify({ userId: "devthinkuser13" }),
+    });
+    assert.equal(selectedIdentity.status, 200);
+    assert.equal(
+      ((await selectedIdentity.json()) as { identity: { userId: string } }).identity.userId,
+      "devthinkuser13",
+    );
+    const created = await fetch(`${server.address}/sessions`, {
+      method: "POST",
+      headers: { origin, authorization: `Bearer ${credential.token}`, "content-type": "application/json" },
+      body: JSON.stringify({ mode: "chat", provider: "zai", model: "glm-5" }),
+    });
+    assert.equal(created.status, 201);
+    const expiredPair = createPairing(paths, -1);
+    const expiredCode = await fetch(`${server.address}/pairings/consume`, {
+      method: "POST",
+      headers: { origin, "content-type": "application/json" },
+      body: JSON.stringify({ pairingId: expiredPair.pairingId, code: expiredPair.code }),
+    });
+    assert.equal(expiredCode.status, 401);
+    const replay = await fetch(`${server.address}/pairings/consume`, {
+      method: "POST",
+      headers: { origin, "content-type": "application/json" },
+      body: JSON.stringify({ pairingId: pairing.pairingId, code: pairing.code }),
+    });
+    assert.equal(replay.status, 401);
+    const revoke = await fetch(`${server.address}/pairings/revoke`, {
+      method: "POST",
+      headers: { origin, authorization: `Bearer ${credential.token}` },
+    });
+    assert.equal(revoke.status, 200);
+    const expired = await fetch(`${server.address}/identity`, {
+      headers: { origin, authorization: `Bearer ${credential.token}` },
+    });
+    assert.equal(expired.status, 401);
+  });
+});

package/tests/costcert.test.ts

@@ -0,0 +1,95 @@
+import { describe, expect, it } from "vitest";
+import { execFile } from "node:child_process";
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { promisify } from "node:util";
+
+const execute = promisify(execFile);
+
+/* ── The 1.1.96 shared accounting certification coverage. ── */
+
+describe("the costcert reconciliation artifact", () => {
+  it("declares every accounting check of the release candidate reconciliation with its family and module", async () => {
+    const source = await readFile("tests/costcert.mjs", "utf8");
+    const declarations = [
+      ...source.matchAll(/await entry\(\{ id: (\d+), title: "([^"]+)", family: "([^"]+)", module: "([^"]+)" \}/g),
+    ].map((match) => ({ id: Number(match[1]), title: match[2], family: match[3], module: match[4] }));
+    expect(declarations).toHaveLength(9);
+    expect(declarations.map((entry) => entry.id)).toEqual(Array.from({ length: 9 }, (_, index) => index + 1));
+    const families = new Set(declarations.map((entry) => entry.family));
+    for (const family of [
+      "replay",
+      "token accounting",
+      "shared accounting",
+      "budgets",
+      "refunds",
+      "routing",
+      "export",
+      "audit trail",
+      "report",
+    ])
+      expect(families.has(family)).toBe(true);
+    for (const entry of declarations) expect((entry.title ?? "").length).toBeGreaterThan(10);
+  });
+
+  it("covers every accounting check with a passing outcome once the gate has run", async () => {
+    const artifactpath = "tests/artifacts/costcert.json";
+    const built = existsSync("dist/extension/manifest.json");
+    const packagejson = JSON.parse(await readFile("package.json", "utf8")) as { version: string };
+    /* a built tree runs the gate itself when no fresh artifact of this release exists, so every lane that builds before the suite — the bun lane, the deno lane, a local two-pass validate — verifies the reconciliation artifact without depending on the gate having run before the tests */
+    if (built && !existsSync(artifactpath)) await execute("node", ["tests/costcert.mjs"]);
+    if (built && existsSync(artifactpath)) {
+      const stored = JSON.parse(await readFile(artifactpath, "utf8")) as { release: string };
+      if (stored.release !== packagejson.version) await execute("node", ["tests/costcert.mjs"]);
+    }
+    const stored = existsSync(artifactpath);
+    if (built) expect(stored).toBe(true);
+    if (!stored) return;
+    const report = JSON.parse(await readFile(artifactpath, "utf8")) as {
+      release: string;
+      entries: Array<{ id: number; title: string; outcome: string; detail: string }>;
+      summary: { total: number; passed: number; failed: number };
+    };
+    expect(report.release).toBe(packagejson.version);
+    expect(report.summary.total).toBe(9);
+    expect(report.summary.failed).toBe(0);
+    expect(report.summary.passed).toBe(9);
+    expect(report.entries.map((entry) => entry.id)).toEqual(Array.from({ length: 9 }, (_, index) => index + 1));
+    for (const entry of report.entries) {
+      expect(entry.outcome).toBe("pass");
+      expect(entry.detail.length).toBeGreaterThan(10);
+    }
+  });
+
+  it("keeps the reconciliation invariants of the artifact summary and the recorded checks", async () => {
+    const artifactpath = "tests/artifacts/costcert.json";
+    if (!existsSync(artifactpath)) return;
+    const report = JSON.parse(await readFile(artifactpath, "utf8")) as {
+      release: string;
+      entries: Array<{ id: number; outcome: string }>;
+      summary: { total: number; passed: number; failed: number };
+    };
+    /* the reconciliation invariants: the summary total equals the recorded check count, the passed count equals the passing outcomes, the failed count equals the failing outcomes and the totals sum back to the whole */
+    const passing = report.entries.filter((entry) => entry.outcome === "pass").length;
+    const failing = report.entries.filter((entry) => entry.outcome === "fail").length;
+    expect(report.summary.total).toBe(report.entries.length);
+    expect(report.summary.passed).toBe(passing);
+    expect(report.summary.failed).toBe(failing);
+    expect(report.summary.total).toBe(report.summary.passed + report.summary.failed);
+    expect(report.summary.failed).toBe(0);
+  });
+
+  it("exercises the real compiled accounting modules and recomputes the cost lines from recorded evidence", async () => {
+    const source = await readFile("tests/costcert.mjs", "utf8");
+    expect(source).toContain('import("../dist/index.js")');
+    expect(source).toContain('import("../dist/memory.js")');
+    expect(source).toContain("usagetotals");
+    expect(source).toContain("recordagentusage");
+    expect(source).toContain("swarmcosts");
+    expect(source).toContain("sharedcostsplit");
+    /* the recorded evidence replays through the real sessionmemory store behind the in-memory adapter seam and every fixture time flows from the fixed epoch, so reruns stay byte identical */
+    expect(source).toContain("fakeadapter");
+    expect(source).toContain("1_800_000_000_000");
+    expect(source).toContain("process.exitCode = 1");
+  });
+});

package/tests/crossbrowser.test.ts

@@ -0,0 +1,115 @@
+import { describe, expect, it } from "vitest";
+import { apimapentries, apimapunmapped } from "../crossbrowser.js";
+import { firefoxprepoverlay, firefoxprepadapt } from "../crossbrowser.js";
+import { xpipackassemble } from "../crossbrowser.js";
+import { apimapentries as firefoxentries } from "../crossbrowser.js";
+
+const sourcesmanifest = {
+  manifest_version: 3,
+  name: "Devthink",
+  version: "1.1.86",
+  description: "test",
+  permissions: ["activeTab", "storage", "scripting", "sidePanel"],
+  optional_permissions: ["tabs", "downloads", "clipboardRead", "clipboardWrite", "offscreen", "nativeMessaging"],
+  optional_host_permissions: ["https://*/*"],
+  background: { service_worker: "background.js", type: "module" },
+  action: { default_popup: "popup.html" },
+  side_panel: { default_path: "sidepanel.html" },
+  options_ui: { page: "optionspage.html", open_in_tab: true },
+  offscreen: { document: "offscreen.html", reasons: ["DOM_PARSER", "WORKERS"], justification: "test" },
+};
+
+describe("cross browser invariants", () => {
+  it("keeps the kind catalog identical on every browser", () => {
+    const chromium = apimapentries();
+    const firefox = firefoxentries();
+    expect(chromium.length).toBe(firefox.length);
+    for (let index = 0; index < chromium.length; index += 1) {
+      const left = chromium[index];
+      const right = firefox[index];
+      expect(left?.api).toBe(right?.api);
+    }
+  });
+
+  it("keeps the policy gates identical on every browser through the deny list", () => {
+    const overlay = firefoxprepoverlay({ extensionid: "devthink@wenathlan", backgroundscript: "background.js" });
+    const adapted = firefoxprepadapt({
+      manifest: sourcesmanifest as never,
+      overlay,
+      backgroundscripts: ["background.js"],
+    });
+    const forbidden = ["debugger", "cookies", "webRequest", "history", "bookmarks", "proxy", "management"];
+    for (const permission of forbidden) {
+      expect(adapted.manifest.permissions).not.toContain(permission);
+    }
+  });
+
+  it("keeps the observation schema byte identical across browsers", () => {
+    const overlay = firefoxprepoverlay({ extensionid: "devthink@wenathlan", backgroundscript: "background.js" });
+    const adapted = firefoxprepadapt({
+      manifest: sourcesmanifest as never,
+      overlay,
+      backgroundscripts: ["background.js"],
+    });
+    expect(adapted.manifest.manifest_version).toBe(3);
+    expect(adapted.manifest.name).toBe("Devthink");
+    expect(adapted.manifest.version).toBe(sourcesmanifest.version);
+    expect(adapted.manifest.description).toBe(sourcesmanifest.description);
+    expect(adapted.manifest.options_ui).toEqual(sourcesmanifest.options_ui);
+  });
+
+  it("keeps the audit trail format identical across browsers", () => {
+    const overlay = firefoxprepoverlay({ extensionid: "devthink@wenathlan", backgroundscript: "background.js" });
+    const adapted = firefoxprepadapt({
+      manifest: sourcesmanifest as never,
+      overlay,
+      backgroundscripts: ["background.js"],
+    });
+    expect(adapted.manifest.content_security_policy?.extension_pages).toContain("script-src");
+    expect(adapted.manifest.content_security_policy?.extension_pages).toContain("object-src");
+  });
+
+  it("extension id per browser feeds the servercontract handshake", () => {
+    const overlay = firefoxprepoverlay({ extensionid: "devthink@wenathlan", backgroundscript: "background.js" });
+    const adapted = firefoxprepadapt({
+      manifest: sourcesmanifest as never,
+      overlay,
+      backgroundscripts: ["background.js"],
+    });
+    expect(adapted.manifest.browser_specific_settings?.gecko?.id).toBe("devthink@wenathlan");
+  });
+
+  it("native transport stays chromium first and reports unsupported elsewhere", () => {
+    const entries = apimapentries();
+    const native = entries.find((entry) => entry.api === "nativeMessaging");
+    expect(native).toBeDefined();
+    expect(native?.chromium).toBe("chrome.runtime.connectNative");
+    expect(native?.firefox).toBe("browser.runtime.connectNative");
+    expect(native?.safari).toBe("");
+  });
+
+  it("version sync stamps the same version into every browser manifest", () => {
+    const overlay = firefoxprepoverlay({ extensionid: "devthink@wenathlan", backgroundscript: "background.js" });
+    const adapted = firefoxprepadapt({
+      manifest: sourcesmanifest as never,
+      overlay,
+      backgroundscripts: ["background.js"],
+    });
+    expect(adapted.manifest.version).toBe(sourcesmanifest.version);
+    const xpibuilt = xpipackassemble({
+      manifest: adapted.manifest as never,
+      bundleentries: [],
+      version: sourcesmanifest.version,
+    });
+    expect(xpibuilt.archive.name).toBe(`devthink-${sourcesmanifest.version}.xpi`);
+  });
+
+  it("apimap reports every recorded api has a chromium and firefox mapping", () => {
+    const report = apimapunmapped();
+    expect(report.failed).toBe(false);
+    for (const row of report.rows) {
+      expect(row.chromium).toBe(true);
+      expect(row.firefox).toBe(true);
+    }
+  });
+});