amalgm 0.1.93 → 0.1.94

package/runtime/scripts/amalgm-mcp/tests/browser-transport.test.js

@@ -0,0 +1,155 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const test = require('node:test');
+
+// Transport semantics introduced after the 2026-06-11 stress tests: in
+// attached mode every command re-pins the session's webview target inside
+// the same batch. The daemon's tab selection is process state that silently
+// falls back to "the active tab" when the selected target dies — that
+// fallback is how one session read another session's page.
+
+const attach = require('../browser/attach');
+const { attachedSessions, knownSessions } = require('../browser/sessions');
+
+// Patch attach.run before engine destructures it (engine binds at require).
+const calls = [];
+let nextResults = [];
+const realRun = attach.run;
+attach.run = async (session, commandArgs, options) => {
+  calls.push({ session, commandArgs });
+  const next = nextResults.shift();
+  if (next instanceof Error) throw next;
+  return next ?? { success: true, data: null };
+};
+const engine = require('../browser/engine');
+
+test('eval retries a top-level return as a function body', async () => {
+  calls.length = 0;
+  nextResults = [
+    new Error('Eval failed: Illegal return statement'),
+    { success: true, data: { origin: 'x', result: 42 } },
+  ];
+  const { result } = await engine.evaluate({ script: 'return 21 * 2', session: 'wrap-test' }, {});
+  assert.equal(result, 42);
+  assert.equal(calls.length, 2);
+  assert.deepEqual(calls[0].commandArgs, ['eval', 'return 21 * 2']);
+  assert.deepEqual(calls[1].commandArgs, ['eval', '(() => { return 21 * 2 })()']);
+});
+
+test('eval does not rewrite genuine script errors', async () => {
+  calls.length = 0;
+  nextResults = [new Error('Eval failed: ReferenceError: nope is not defined')];
+  await assert.rejects(
+    () => engine.evaluate({ script: 'nope()', session: 'wrap-test' }, {}),
+    /ReferenceError/,
+  );
+  assert.equal(calls.length, 1, 'only Illegal return triggers the wrapped retry');
+});
+
+test('select drives native dropdowns through the real select command', async () => {
+  calls.length = 0;
+  nextResults = [{ success: true, data: null }];
+  const result = await engine.select({ target: '#mode', value: 'gamma', session: 'select-test' }, {});
+  assert.deepEqual(calls[0].commandArgs, ['select', '#mode', 'gamma']);
+  assert.equal(result.selected, '#mode');
+});
+
+test('passthrough refuses tab hops in attached mode, allows listing', async () => {
+  const saved = process.env.AMALGM_BROWSER_BACKEND;
+  process.env.AMALGM_BROWSER_BACKEND = 'attached';
+  try {
+    await assert.rejects(
+      () => engine.passthrough({ args: ['tab', 't3'], session: 'hop-test' }, {}),
+      /Tab switching is managed per session/,
+    );
+    // Bare listing is diagnostics, not a hop — it goes through to the daemon.
+    calls.length = 0;
+    nextResults = [{ success: true, data: { tabs: [] } }];
+    await engine.passthrough({ args: ['tab'], session: 'hop-test' }, {});
+    assert.deepEqual(calls[0].commandArgs, ['tab']);
+  } finally {
+    if (saved === undefined) delete process.env.AMALGM_BROWSER_BACKEND;
+    else process.env.AMALGM_BROWSER_BACKEND = saved;
+    attach.run = realRun;
+  }
+});
+
+// The pin itself: execute() turns every attached call into a batch that
+// re-selects the session's webview first, and maps the single-command result
+// back to its unbatched shape.
+
+test('attached commands re-pin the webview target inside the batch', async (t) => {
+  const fs = require('node:fs');
+  const os = require('node:os');
+  const path = require('node:path');
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-pin-test-'));
+  const stub = path.join(dir, 'stub.sh');
+  // The stub answers `batch` by echoing stdin back as batch entries.
+  fs.writeFileSync(stub, `#!/bin/sh
+input=$(cat)
+node -e '
+const cmds = JSON.parse(process.argv[1]);
+console.log(JSON.stringify({ success: true, data: cmds.map((c) => ({ command: c, success: true, result: { echoed: c } })) }));
+' "$input"
+`, { mode: 0o755 });
+
+  const savedBin = process.env.AMALGM_AGENT_BROWSER_BIN;
+  const savedBackend = process.env.AMALGM_BROWSER_BACKEND;
+  const savedCdp = process.env.AMALGM_BROWSER_CDP_URL;
+  process.env.AMALGM_AGENT_BROWSER_BIN = stub;
+  process.env.AMALGM_BROWSER_BACKEND = 'attached';
+  process.env.AMALGM_BROWSER_CDP_URL = '9242';
+  attachedSessions.add('pin-test');
+  knownSessions.set('pin-test', { webviewTabId: 't7' });
+  try {
+    const single = await attach.run('pin-test', ['get', 'url'], { timeoutMs: 5000 });
+    assert.deepEqual(single.data, { echoed: ['get', 'url'] }, 'single result keeps its unbatched shape');
+
+    const entries = await attach.runBatch('pin-test', [['open', 'https://example.com'], ['get', 'url']], { timeoutMs: 5000 });
+    assert.equal(entries.length, 2, 'the pin step is internal — callers see their own commands only');
+    assert.deepEqual(entries[0].command, ['open', 'https://example.com']);
+  } finally {
+    attachedSessions.delete('pin-test');
+    knownSessions.delete('pin-test');
+    if (savedBin === undefined) delete process.env.AMALGM_AGENT_BROWSER_BIN; else process.env.AMALGM_AGENT_BROWSER_BIN = savedBin;
+    if (savedBackend === undefined) delete process.env.AMALGM_BROWSER_BACKEND; else process.env.AMALGM_BROWSER_BACKEND = savedBackend;
+    if (savedCdp === undefined) delete process.env.AMALGM_BROWSER_CDP_URL; else process.env.AMALGM_BROWSER_CDP_URL = savedCdp;
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('a dead pin is classified as a lost target; page errors are not', () => {
+  // The pin failure carries the "surface target lost" prefix so the retry
+  // path re-attaches. Ordinary page errors must NOT look like lost
+  // connections — a spurious re-attach on "Element not found" would tear
+  // down and rebuild the surface on every typo'd selector.
+  assert.equal(attach.looksLikeLostConnection(new Error('surface target lost (tab t7: tab not found)')), true);
+  assert.equal(attach.looksLikeLostConnection(new Error('WebSocket connection closed')), true);
+  assert.equal(attach.looksLikeLostConnection(new Error('Element not found: #submit')), false);
+  assert.equal(attach.looksLikeLostConnection(new Error('Timed out waiting for selector')), false);
+});
+
+test('pinFailure reclassifies envelope-level batch rejections', () => {
+  // agent-browser --bail rejects with the serialized entries as the message
+  // (live-verified shape). A failed pin step inside must become "surface
+  // target lost" so the retry path re-attaches.
+  const envelope = new Error(JSON.stringify([
+    { command: ['tab', 't16'], error: 'Tab t16 not found; run `agent-browser tab` to list open tabs', result: null },
+  ]));
+  const classified = attach.pinFailure(envelope, 't16');
+  assert.match(classified.message, /surface target lost/);
+  assert.equal(attach.looksLikeLostConnection(classified), true);
+
+  // A failing page step inside the same shape stays a page error.
+  const pageError = new Error(JSON.stringify([
+    { command: ['tab', 't16'], error: null, result: { ok: true } },
+    { command: ['click', '#gone'], error: 'Element not found', result: null },
+  ]));
+  assert.equal(attach.pinFailure(pageError, 't16'), pageError);
+
+  // Headless (no pin) and non-JSON messages pass through untouched.
+  const plain = new Error('agent-browser exited with code 1');
+  assert.equal(attach.pinFailure(plain, null), plain);
+  assert.equal(attach.pinFailure(plain, 't16'), plain);
+});

package/runtime/scripts/amalgm-mcp/tests/core-tools.test.js

@@ -54,6 +54,7 @@ test('browser is a single toolbox entry holding every browser action', () => {
     'click',
     'fill',
     'press',
+    'select',
     'eval',
     'wait',
     'cli',
@@ -106,7 +107,7 @@ test('browser actions carry capability tags so UIs can section one card', () =>
     .filter((tool) => tool.capability === capability)
     .map((tool) => tool.name);
 
-  assert.equal(byCapability('core').length, 10);
+  assert.equal(byCapability('core').length, 11);
   assert.equal(byCapability('computer-use').every((name) => name.startsWith('cua_')), true);
   assert.deepEqual(byCapability('recording'), ['record_start', 'record_stop', 'record_list']);
   assert.deepEqual(byCapability('auth'), ['auth_list', 'auth_link_create', 'auth_save', 'auth_load']);

package/runtime/scripts/platform-context.txt

@@ -121,19 +121,20 @@ One persistent browser per chat session. When the Amalgm desktop app is open, th
 
 Browser actions are MCP tools named `toolbox__browser_<action>` (your harness may add its own prefix, e.g. `mcp__amalgm__toolbox__browser_open`).
 
-The loop: `open` a URL → `snapshot` to see interactive elements as @refs → `click`/`fill`/`press` by @ref → re-`snapshot` after the page changes.
+The loop: `open` a URL → `snapshot` to see interactive elements as @refs → `click`/`fill`/`select`/`press` by @ref → re-`snapshot` after the page changes.
 
 - `open` — go to a URL (the session persists across calls; navigate once, then interact)
 - `snapshot` — read the page: every interactive element gets a stable @ref
 - `click` / `fill` / `press` — act on @refs, CSS selectors, or `text=Label` targets
-- `eval` — run JavaScript in the page and get the result
+- `select` — choose an option in a native dropdown (clicks and key presses cannot drive those)
+- `eval` — run JavaScript in the page and get the result (bare expressions or `return` bodies both work)
 - `wait` — wait for a selector, URL, or delay
-- `screenshot` — PNG when you need pixels (snapshot is cheaper for driving)
-- `cli` — the full agent-browser command surface: scroll, hover, back, tabs, cookies, storage, network, traces, find-by-role, and more
-- `close` — end the session
+- `screenshot` — PNG when you need pixels (snapshot is cheaper for driving); image coordinates match cua input 1:1
+- `cli` — the full agent-browser command surface: scroll, hover, back, cookies, storage, network, traces, find-by-role, and more
+- `close` — end the session (in the desktop app this also tidies away its split view)
 - `cua_screenshot` / `cua_click` / `cua_type` / … — coordinate-based control for vision loops
 - `record_start` / `record_stop` / `record_list` — capture the session to a local WebM video (QA evidence)
-- `auth_list` / `auth_link_create` / `auth_save` / `auth_load` — reuse logins: mint a link for the user to sign in, then save/load encrypted auth bundles
+- `auth_list` / `auth_link_create` / `auth_save` / `auth_load` — reuse logins: in the desktop app the login page opens directly in the split view for the user to sign in; from the web, share the minted link. Save/load encrypted auth bundles afterward
 
 Recordings and auth bundles stay on this computer. Use the browser to test apps, scrape data, or automate web interactions.