browser-commander 0.25.0 → 0.26.1

package/.jscpd-baseline.json

@@ -3,11 +3,12 @@
   "fingerprints": {
     "00d381dd611ae8ac": 1,
     "029a62ef1f48e856": 1,
-    "03241c1f33f40d14": 1,
     "038170e72e0af1f5": 1,
+    "0413f601c8911a92": 1,
     "04b28d01d0bb47dc": 1,
     "04f605be138bc350": 1,
     "0796d358ad2562c3": 1,
+    "080e47b73f48a044": 1,
     "08e28c7706cdddd6": 1,
     "090a69d9528e4cdb": 1,
     "09694dc8fb9d683c": 1,
@@ -30,6 +31,7 @@
     "17c26c0db2d35ad1": 1,
     "193b46c0e7f72053": 1,
     "19ff70fc80fad524": 1,
+    "1a9f0f0f68ed445c": 1,
     "1ad4dc7e19a77f68": 1,
     "1c1baf1bc8ea0eae": 1,
     "1d61f5c49f12d2dc": 1,
@@ -79,7 +81,6 @@
     "4715a17d690865ee": 1,
     "4b0d3cc5c27227e7": 1,
     "4c3b94caa28045d0": 1,
-    "4e090d6bb30e6551": 1,
     "4f3c541b3f3e3f23": 1,
     "4f93b074bc2ac9e8": 1,
     "5085765e1f103f3e": 1,
@@ -114,6 +115,7 @@
     "6880d620e0e67229": 1,
     "69d50e6f6a5f2ee9": 1,
     "6a7ed9ad3fc00a39": 1,
+    "6a9854bcdc9f71d7": 1,
     "6af3c307939ef75e": 1,
     "6b35b48512756192": 1,
     "6cd00d6b6a039022": 1,
@@ -182,7 +184,7 @@
     "acc95d694eb2f581": 1,
     "ad4cfa76daa1b6fc": 1,
     "ad50b48938af8aef": 1,
-    "ae477ba64bafba3f": 1,
+    "add45ff3644fbeeb": 1,
     "aee1e5c65f783848": 1,
     "aee45e8b58c2d87f": 1,
     "af702b20ebd45ef2": 1,
@@ -246,13 +248,13 @@
     "e5feedc0c24e103e": 1,
     "e67726a913675120": 1,
     "e686288f2e9b8a6d": 1,
+    "e7d7bb7e163d2327": 1,
     "ea1195048ded896c": 1,
     "ea88711c5deb1fe5": 1,
     "eb9a70c2a21094ff": 1,
     "ebe03c5f8c2f5147": 1,
     "ee19c8b9b332ee98": 1,
     "eeca0ccf8d821f21": 1,
-    "f022b763ff342b2d": 1,
     "f07f979f8c2706e8": 1,
     "f186f73c118b8e8a": 1,
     "f38f72095a67c95e": 1,

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## 0.26.1
+
+### Patch Changes
+
+- f2988a3: Close the parity probe server only after it stops listening, so a connection
+  that arrives during shutdown can no longer keep `close()` waiting. Test fixture
+  servers now drop idle browser preconnections too, which stopped the Safari
+  smoke test from timing out during cleanup on Node 24.
+
+  Parse Playwright `:has-text("…")` and `:text-is("…")` selectors with string
+  operations instead of a backtracking regular expression. A long selector that
+  did not match took quadratic time (16 seconds for 550,000 characters); it is
+  now rejected in linear time. CodeQL reported it as `js/polynomial-redos`.
+
+  Failure artifact names are trimmed of leading and trailing dashes by index, so
+  a test name with a long run of dashes no longer takes quadratic time.
+
+  A Safari launch right after a previous Safari session closed starts a fresh
+  `safaridriver`, up to three attempts, when the driver exits before it is ready
+  or refuses the connection. safaridriver serves one automation session at a
+  time, and CI saw both failures on back-to-back launches. A refused connection
+  now also names the driver server and whether it had exited. Authorization
+  errors are still reported at once. Set `VERBOSE=1` to log each retry.
+
+## 0.26.0
+
+### Minor Changes
+
+- 8f9ef1c: Add native Safari and Technology Preview W3C WebDriver control through real/common launchers and CLI, with isolated cookie seeding, setup diagnostics and typed unsupported feature errors.
+
+  Update the transitive shell-quote lock entry to fix GHSA-pqg4-j6r4-53mv and unblock npm audit.
+
 ## 0.25.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "browser-commander",
-  "version": "0.25.0",
+  "version": "0.26.1",
   "description": "Universal browser automation library that supports Playwright, Puppeteer, and Selenium with a unified API",
   "main": "src/index.js",
   "bin": {
@@ -32,7 +32,7 @@
     "format": "prettier --write .",
     "format:check": "prettier --check .",
     "docs:api": "jsdoc -c jsdoc.json",
-    "check:duplication": "jscpd . --baseline .jscpd-baseline.json --fail-on-new-clones",
+    "check:duplication": "node scripts/check-duplication.mjs",
     "check": "npm run lint && npm run format:check && npm run check:duplication",
     "changeset": "changeset",
     "changeset:version": "node scripts/changeset-version.mjs",

package/scripts/check-duplication.mjs

@@ -0,0 +1,176 @@
+#!/usr/bin/env node
+
+/**
+ * Duplication gate that prints the clones it fails on, and only those.
+ *
+ * With the console reporter, `jscpd --baseline … --fail-on-new-clones` lists
+ * every clone it finds, accepted or not. A passing run printed 272 "Clone
+ * found" blocks, about 840 lines, for clones the baseline already accepts. The
+ * one clone that failed a run was marked only by a `[NEW]` tag somewhere in
+ * that list (issue #128). This runs jscpd with the JSON reporter instead. It
+ * prints the new clones from the report (as error annotations in GitHub
+ * Actions) and a one-line total.
+ *
+ * `npx jscpd .` still prints every clone, and `.jscpd.json` keeps the console
+ * reporter for that.
+ *
+ * Usage (from js/): node scripts/check-duplication.mjs
+ */
+
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const BASELINE = '.jscpd-baseline.json';
+
+/**
+ * Path to jscpd's CLI entry point, or null when it is not installed. Running
+ * it through `process.execPath` avoids the `.bin` shims, which Windows cannot
+ * execute directly.
+ */
+export function resolveJscpdCli() {
+  const require = createRequire(import.meta.url);
+  let manifestPath;
+  try {
+    manifestPath = require.resolve('jscpd/package.json');
+  } catch {
+    return null;
+  }
+  const { bin } = JSON.parse(readFileSync(manifestPath, 'utf8'));
+  const entry = typeof bin === 'string' ? bin : bin?.jscpd;
+  const cli = entry && path.join(path.dirname(manifestPath), entry);
+  return cli && existsSync(cli) ? cli : null;
+}
+
+function escapeProperty(value) {
+  return String(value)
+    .replaceAll('%', '%25')
+    .replaceAll('\r', '%0D')
+    .replaceAll('\n', '%0A')
+    .replaceAll(':', '%3A')
+    .replaceAll(',', '%2C');
+}
+
+function escapeMessage(value) {
+  return String(value)
+    .replaceAll('%', '%25')
+    .replaceAll('\r', '%0D')
+    .replaceAll('\n', '%0A');
+}
+
+/**
+ * The new clones in a jscpd JSON report, one line each.
+ *
+ * jscpd names code embedded in Markdown `README.md:javascript`, so the
+ * language suffix is dropped before the name is used as a path. In GitHub
+ * Actions each clone becomes an `::error` annotation on the
+ * repository-relative path. `cwd` is where jscpd ran, and `workspace` is the
+ * checkout root.
+ *
+ * @param {{duplicates: Array<object>}} report
+ * @param {{githubActions?: boolean, cwd?: string, workspace?: string}} [options]
+ */
+export function formatNewClones(report, options = {}) {
+  const {
+    githubActions = false,
+    cwd = process.cwd(),
+    workspace = cwd,
+  } = options;
+  const fileOf = (side) => {
+    const name = side.name.replace(/:[a-z]+$/, '');
+    return githubActions
+      ? path
+          .relative(workspace, path.resolve(cwd, name))
+          .split(path.sep)
+          .join('/')
+      : name;
+  };
+
+  return report.duplicates
+    .filter((duplicate) => duplicate.isNew)
+    .map(({ firstFile, secondFile, lines }) => {
+      const first = fileOf(firstFile);
+      const second = `${fileOf(secondFile)}:${secondFile.start}-${secondFile.end}`;
+      if (!githubActions) {
+        return `New clone: ${first}:${firstFile.start}-${firstFile.end} ~ ${second} (${lines} lines)\n`;
+      }
+      const properties = [
+        `file=${escapeProperty(first)}`,
+        `line=${firstFile.start}`,
+        `endLine=${firstFile.end}`,
+        'title=New duplicated code',
+      ].join(',');
+      const message =
+        `${lines} lines duplicate ${second}. Extract the shared code, or ` +
+        'accept the clone with `npm run check:duplication:update`.';
+      return `::error ${properties}::${escapeMessage(message)}\n`;
+    })
+    .join('');
+}
+
+function main() {
+  const cli = resolveJscpdCli();
+  if (!cli) {
+    console.error('jscpd is not installed; run npm ci in js/.');
+    return 2;
+  }
+
+  const output = mkdtempSync(path.join(tmpdir(), 'jscpd-report-'));
+  try {
+    const jscpd = spawnSync(
+      process.execPath,
+      [
+        cli,
+        '.',
+        '--baseline',
+        BASELINE,
+        '--fail-on-new-clones',
+        '--reporters',
+        'json',
+        '--output',
+        output,
+        '--no-colors',
+      ],
+      { encoding: 'utf8' }
+    );
+    const reportPath = path.join(output, 'jscpd-report.json');
+    if (jscpd.error || !existsSync(reportPath)) {
+      // Fail closed: a run that produced no report proved nothing.
+      process.stdout.write(jscpd.stdout ?? '');
+      process.stderr.write(jscpd.stderr ?? '');
+      console.error(
+        `jscpd wrote no report (exit ${jscpd.status}): ${jscpd.error?.message ?? reportPath}`
+      );
+      return jscpd.status || 2;
+    }
+
+    const report = JSON.parse(readFileSync(reportPath, 'utf8'));
+    const newCount = report.duplicates.filter((d) => d.isNew).length;
+    process.stdout.write(
+      formatNewClones(report, {
+        githubActions: process.env.GITHUB_ACTIONS === 'true',
+        workspace: process.env.GITHUB_WORKSPACE || process.cwd(),
+      })
+    );
+    const total = report.duplicates.length;
+    console.log(
+      `jscpd: ${total} clone${total === 1 ? '' : 's'}, ${newCount} new ` +
+        `(the rest are accepted in ${BASELINE}).`
+    );
+    if (jscpd.status !== 0 && newCount === 0) {
+      // jscpd failed for a reason other than new clones; show what it said.
+      process.stdout.write(jscpd.stdout);
+      process.stderr.write(jscpd.stderr);
+    }
+    return jscpd.status ?? 2;
+  } finally {
+    rmSync(output, { recursive: true, force: true });
+  }
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+  process.exitCode = main();
+}

package/scripts/create-manual-changeset.mjs

@@ -13,6 +13,8 @@
 import { writeFileSync } from 'fs';
 import { randomBytes } from 'crypto';
 
+import { printUntrusted } from '../../scripts/github-actions-log.mjs';
+
 const PACKAGE_NAME = 'browser-commander';
 
 import {
@@ -69,7 +71,7 @@ ${description}
 
   console.log(`Created changeset: ${changesetFile}`);
   console.log('Content:');
-  console.log(content);
+  printUntrusted(content);
 
   // Format with Prettier
   console.log('\nFormatting with Prettier...');

package/scripts/format-release-notes.mjs

@@ -70,6 +70,9 @@ if (!releaseId || !version || !repository) {
   process.exit(1);
 }
 
+/** Start of the npm badge appended below, which marks a formatted body. */
+const NPM_BADGE_PREFIX = '[![npm version](';
+
 try {
   // Get current release body
   const result = await $`gh api repos/${repository}/releases/${releaseId}`.run({
@@ -79,8 +82,10 @@ try {
 
   const currentBody = releaseData.body || '';
 
-  // Skip if already formatted (has shields.io badge image)
-  if (currentBody.includes('img.shields.io')) {
+  // Skip if already formatted (has the npm badge this script appends). The
+  // badge's alt text marks it: matching the image host would also skip a
+  // body whose changelog text mentions that host.
+  if (currentBody.includes(NPM_BADGE_PREFIX)) {
     console.log('ℹ️ Release notes already formatted');
     process.exit(0);
   }
@@ -186,7 +191,7 @@ try {
 
   // Build formatted release notes
   const versionWithoutV = version.replace(/^v/, '');
-  const npmBadge = `[![npm version](https://img.shields.io/badge/npm-${versionWithoutV}-blue.svg)](https://www.npmjs.com/package/${PACKAGE_NAME}/v/${versionWithoutV})`;
+  const npmBadge = `${NPM_BADGE_PREFIX}https://img.shields.io/badge/npm-${versionWithoutV}-blue.svg)](https://www.npmjs.com/package/${PACKAGE_NAME}/v/${versionWithoutV})`;
 
   let formattedBody = `${cleanDescription}`;
 

package/scripts/merge-changesets.mjs

@@ -23,6 +23,8 @@ import {
 } from 'fs';
 import { join } from 'path';
 
+import { printUntrusted } from '../../scripts/github-actions-log.mjs';
+
 const PACKAGE_NAME = 'browser-commander';
 const CHANGESET_DIR = '.changeset';
 
@@ -254,7 +256,8 @@ function main() {
   }
 
   console.log('\nChangeset merge completed successfully');
-  console.log(`\nMerged changeset content:\n${mergedContent}`);
+  console.log('\nMerged changeset content:');
+  printUntrusted(mergedContent);
 }
 
 main();

package/scripts/validate-changeset.mjs

@@ -7,13 +7,17 @@
  * - Only checks changeset files ADDED by the current PR (not pre-existing ones)
  * - Uses git diff to compare PR head against base branch
  * - Validates that the PR adds exactly one changeset with proper format
- * - Falls back to checking all changesets for local development
+ * - Fails when a pull request's diff cannot be computed (issue #128): checking
+ *   every changeset on disk instead would let a stale one satisfy the check
+ * - Outside a pull request (local runs), checks the changesets on disk
  */
 
 import { execSync } from 'child_process';
 import { readFileSync, readdirSync, existsSync } from 'fs';
 import { join } from 'path';
 
+import { printUntrusted } from '../../scripts/github-actions-log.mjs';
+
 const PACKAGE_NAME = 'browser-commander';
 // When running from js/ directory, the changeset dir is local
 const CHANGESET_DIR = '.changeset';
@@ -113,13 +117,11 @@ function tryBaseBranchComparison(prBase) {
 }
 
 /**
- * Fallback: get all changesets in directory
+ * Outside a pull request: get all changesets in directory
  * @returns {string[]} Array of all changeset file names
  */
 function getAllChangesets() {
-  console.log(
-    'Warning: Could not determine PR diff, checking all changesets in directory'
-  );
+  console.log('No pull request to compare; checking all changesets on disk');
   if (!existsSync(CHANGESET_DIR)) {
     return [];
   }
@@ -136,6 +138,8 @@ function getAddedChangesetFiles() {
   const baseSha = process.env.GITHUB_BASE_SHA || process.env.BASE_SHA;
   const headSha = process.env.GITHUB_HEAD_SHA || process.env.HEAD_SHA;
 
+  const prBase = process.env.GITHUB_BASE_REF;
+
   // Try explicit SHAs first
   if (baseSha && headSha) {
     const result = tryExplicitShaComparison(baseSha, headSha);
@@ -145,7 +149,6 @@ function getAddedChangesetFiles() {
   }
 
   // Try base branch comparison
-  const prBase = process.env.GITHUB_BASE_REF;
   if (prBase) {
     const result = tryBaseBranchComparison(prBase);
     if (result !== null) {
@@ -153,7 +156,14 @@ function getAddedChangesetFiles() {
     }
   }
 
-  // Fallback to checking all changesets
+  // In a pull request, every changeset on disk includes ones already on the
+  // base branch, so falling back to them would pass a PR that adds none.
+  if (prBase || baseSha || headSha) {
+    throw new Error(
+      'Could not determine which changesets this pull request adds, because git could not diff it against its base'
+    );
+  }
+
   return getAllChangesets();
 }
 
@@ -252,7 +262,9 @@ try {
     console.error(`::error::${validation.error}`);
     console.error(`\nFile content of ${changesetFile}:`);
     try {
-      console.error(readFileSync(changesetFile, 'utf-8'));
+      printUntrusted(readFileSync(changesetFile, 'utf-8'), {
+        stream: process.stderr,
+      });
     } catch {
       console.error('(could not read file)');
     }
@@ -261,9 +273,10 @@ try {
 
   console.log('Changeset validation passed');
   console.log(`   Type: ${validation.type}`);
-  console.log(`   Description: ${validation.description}`);
+  console.log('   Description:');
+  printUntrusted(validation.description);
 } catch (error) {
-  console.error('Error during changeset validation:', error.message);
+  console.error(`::error::${error.message}`);
   if (process.env.DEBUG) {
     console.error('Stack trace:', error.stack);
   }

package/scripts/version-and-commit.mjs

@@ -24,6 +24,7 @@ import {
   loadCommandStream,
   loadLinoArguments,
 } from '../../scripts/use-module.mjs';
+import { printUntrusted } from '../../scripts/github-actions-log.mjs';
 
 const { $ } = await loadCommandStream();
 const { makeConfig } = await loadLinoArguments();
@@ -53,11 +54,9 @@ const config = makeConfig({
 const { mode, bumpType, description } = config;
 
 // Debug: Log parsed configuration
-console.log('Parsed configuration:', {
-  mode,
-  bumpType,
-  description: description || '(none)',
-});
+console.log('Parsed configuration:', { mode, bumpType });
+console.log('Description:');
+printUntrusted(description || '(none)');
 
 // Detect if positional arguments were used (common mistake)
 const args = process.argv.slice(2);
@@ -145,7 +144,7 @@ async function main() {
   try {
     // Configure git
     await $`git config user.name "github-actions[bot]"`;
-    await $`git config user.email "github-actions[bot]@users.noreply.github.com"`;
+    await $`git config user.email "41898282+github-actions[bot]@users.noreply.github.com"`;
 
     // Check if remote main has advanced (handles re-runs after partial success)
     console.log('Checking for remote changes...');
@@ -231,10 +230,9 @@ async function main() {
       // Stage all changes (package.json, package-lock.json, CHANGELOG.md, deleted changesets)
       await $`git add -A`;
 
-      // Commit with version number as message
-      const commitMessage = newVersion;
-      const escapedMessage = commitMessage.replace(/"/g, '\\"');
-      await $`git commit -m "${escapedMessage}"`;
+      // Commit with version number as message. command-stream quotes the
+      // interpolated value itself; escaping it here would add backslashes.
+      await $`git commit -m ${newVersion}`;
 
       // Push directly to main.
       //

package/src/browser/browser-sources.json

@@ -766,7 +766,9 @@
       },
       "default": {
         "darwin": ["com.apple.safari"]
-      }
+      },
+      "executables": { "darwin": ["/usr/bin/safaridriver"] },
+      "controlProtocol": "webdriver"
     },
     {
       "id": "safari-technology-preview",
@@ -781,7 +783,13 @@
       },
       "default": {
         "darwin": ["com.apple.safaritechnologypreview"]
-      }
+      },
+      "executables": {
+        "darwin": [
+          "/Applications/Safari Technology Preview.app/Contents/MacOS/safaridriver"
+        ]
+      },
+      "controlProtocol": "webdriver"
     },
     {
       "id": "whale",

package/src/browser/launcher.js

@@ -17,6 +17,8 @@ import { resolveSystemBrowserExecutable } from './system-browser.js';
 import { applyFingerprint } from '../fingerprint/apply.js';
 import { attachDownloads } from '../downloads/attach.js';
 import { launchWebDriver } from './webdriver.js';
+import { launchSafari } from './safari-launch.js';
+import { isSafariChannel } from './safari-support.js';
 import {
   loadStorageState,
   restorePlaywrightStorageState,
@@ -300,6 +302,18 @@ export async function launchBrowserWithDependencies(
   options = {},
   dependencies = {}
 ) {
+  if (isSafariChannel(options.channel ?? options.browser)) {
+    validateLaunchMode({
+      engine: options.engine ?? 'playwright',
+      launch: options.launch ?? 'real',
+      attach: options.attach,
+    });
+    return await launchSafari(options, dependencies);
+  }
+  return await launchNonSafariBrowser(options, dependencies);
+}
+
+async function launchNonSafariBrowser(options, dependencies) {
   const {
     engine = 'playwright',
     launch = 'real',

package/src/browser/real-browser.js

@@ -1,6 +1,8 @@
 import { readFile } from 'node:fs/promises';
 import path from 'node:path';
 import { findBrowserSource } from './browser-sources.js';
+import { launchSafari } from './safari-launch.js';
+import { isSafariChannel } from './safari-support.js';
 
 import { startProcess } from '../utilities/subprocess.js';
 import {
@@ -563,6 +565,9 @@ export async function launchAndConnectRealBrowserWithDependencies(
   options = {},
   dependencies = {}
 ) {
+  if (isSafariChannel(options.channel ?? options.browser)) {
+    return launchSafari(options, dependencies);
+  }
   const {
     engine = 'playwright',
     channel = 'chrome',

package/src/browser/safari-launch.js

@@ -0,0 +1,42 @@
+import { launchWebDriver } from './webdriver.js';
+import { findBrowserSource } from './browser-sources.js';
+import { validateSafariOptions } from './safari-support.js';
+import { restoreWebDriverStorageState } from './storage-state.js';
+
+/** Launch installed Safari through its native W3C WebDriver server. */
+export async function launchSafari(options = {}, dependencies = {}) {
+  validateSafariOptions(options);
+  const channel = findBrowserSource(
+    options.channel ?? options.browser ?? 'safari'
+  ).id;
+  const launched = await (dependencies.launchWebDriver ?? launchWebDriver)(
+    {
+      ...options,
+      browser: channel,
+      driverPath: options.driverPath ?? options.executablePath,
+      executablePath: undefined,
+    },
+    dependencies
+  );
+  try {
+    const state = options.storageState;
+    await restoreWebDriverStorageState({
+      page: launched.page,
+      storageState: state,
+      seedCookies: options.seedCookies,
+    });
+  } catch (error) {
+    await launched.close();
+    throw error;
+  }
+  return {
+    ...launched,
+    browser: launched.driver,
+    engine: 'selenium',
+    controlProtocol: 'webdriver',
+    executablePath: launched.driverPath,
+    browserProcess: launched.driverProcess,
+    downloads: null,
+    launch: options.launch ?? 'real',
+  };
+}