browser-commander 0.25.0 → 0.26.1

package/tests/unit/scripts/check-version-modification.test.js

@@ -1,7 +1,17 @@
 import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
 import { describe, it } from 'node:test';
 
-import { findManualVersionChanges } from '../../../../scripts/check-version-modification.mjs';
+import {
+  checkVersionModification,
+  findManualVersionChanges,
+} from '../../../../scripts/check-version-modification.mjs';
+import { repoPath } from '../../helpers/repo.js';
+
+const SCRIPT = repoPath('scripts/check-version-modification.mjs');
 
 // The real implementation shells out to git; injecting the diff keeps these
 // cases independent of the branch the suite happens to run on.
@@ -68,3 +78,99 @@ describe('check-version-modification', () => {
     assert.deepEqual(findManualVersionChanges('main', diff), []);
   });
 });
+
+describe('check-version-modification when git cannot diff', () => {
+  // Issue #128 (link-foundation/rust-ai-driven-development-pipeline-template
+  // #174): a failed `git diff` used to read as "nothing changed", so a missing
+  // base ref turned the check into a pass.
+  function failingDiff() {
+    throw new Error("fatal: ambiguous argument 'origin/main...HEAD'");
+  }
+
+  it('fails rather than reporting no change', () => {
+    assert.throws(
+      () => findManualVersionChanges('main', failingDiff),
+      /Could not diff js\/package\.json against origin\/main/
+    );
+  });
+
+  it('fetches the base once and retries before giving up', () => {
+    let fetched = 0;
+    const diff = (_baseRef, path) => {
+      if (fetched === 0) {
+        failingDiff();
+      }
+      return path === 'rust/Cargo.toml' ? '+version = "0.9.1"' : '';
+    };
+
+    assert.deepEqual(
+      checkVersionModification('main', {
+        diff,
+        fetchBase: () => {
+          fetched += 1;
+        },
+      }),
+      ['rust/Cargo.toml']
+    );
+    assert.equal(fetched, 1);
+  });
+
+  it('reports the failure when the retry fails too', () => {
+    let fetched = 0;
+
+    assert.throws(
+      () =>
+        checkVersionModification('main', {
+          diff: failingDiff,
+          fetchBase: () => {
+            fetched += 1;
+          },
+        }),
+      /Could not diff/
+    );
+    assert.equal(fetched, 1);
+  });
+
+  it('exits 1 with an error annotation from the command line', () => {
+    const directory = mkdtempSync(path.join(tmpdir(), 'version-check-'));
+
+    try {
+      // A repository with no origin: the base ref cannot exist, and neither
+      // can the fetch that would bring it in.
+      spawnSync('git', ['init', '-q', directory]);
+      spawnSync(
+        'git',
+        [
+          '-C',
+          directory,
+          '-c',
+          'user.name=t',
+          '-c',
+          'user.email=t@example.com',
+          'commit',
+          '-q',
+          '--allow-empty',
+          '-m',
+          'init',
+        ],
+        { encoding: 'utf8' }
+      );
+
+      const result = spawnSync(process.execPath, [SCRIPT], {
+        cwd: directory,
+        encoding: 'utf8',
+        env: {
+          ...process.env,
+          GITHUB_BASE_REF: 'main',
+          GITHUB_HEAD_REF: 'feature',
+        },
+      });
+
+      assert.equal(result.status, 1, result.stdout + result.stderr);
+      assert.match(result.stderr, /::error::Could not diff/);
+      assert.doesNotMatch(result.stdout, /No manual version changes/);
+    } finally {
+      rmSync(directory, { force: true, recursive: true });
+    }
+  });
+});

package/tests/unit/scripts/ci-timeout-budgets.test.js

@@ -199,18 +199,31 @@ describe('CI execution budgets', () => {
       'parity.yml cli CLI and API coverage suites',
       'parity.yml cli Cross-language CLI contract',
       'parity.yml cli Rust CLI build',
+      'parity.yml engine-suites Engine lifecycle suites',
+      'parity.yml fixture-suites React fixture suites',
       'parity.yml parity Fingerprint parity suite',
       'parity.yml parity WebDriver suite',
+      'parity.yml snapshots Python headful real-browser launches',
       'parity.yml snapshots Python native snapshot launches',
+      'parity.yml snapshots Rust launch and connect smokes',
       'parity.yml snapshots Rust native snapshots and parity',
       'parity.yml storage-state Rust storage state transfer',
       'python.yml test pytest suite',
       'rust.yml coverage Rust code coverage',
-      'rust.yml test Rust doc tests',
       'rust.yml test Rust test suite',
     ]);
   });
 
+  it('runs the Rust doc tests once, inside the main test suite', () => {
+    // `cargo test --all-features` already runs them. A second `cargo test
+    // --doc` with the default features rebuilt the crate and, on Windows,
+    // stalled silently until its budget killed it (issue #128).
+    const block = getJobBlock(readWorkflow('rust.yml'), 'test');
+
+    assert.match(block, /cargo test --all-features/);
+    assert.doesNotMatch(block, /cargo test --doc/);
+  });
+
   it('warns at the same share of a budget that this invariant allows', () => {
     const wrapper = readFileSync(
       repoPath('scripts/run-with-budget-warning.sh'),
@@ -313,7 +326,7 @@ describe('pipeline status gate', () => {
 
       assert.match(
         block,
-        /RUN_SHA: \$\{\{ github\.sha \}\}/,
+        /RUN_SHA: \$\{\{ github\.event\.pull_request\.head\.sha \|\| github\.sha \}\}/,
         `${fileName}: ${GATE_JOB} cannot tell a supersede from an overrun without RUN_SHA`
       );
     }

package/tests/unit/scripts/ci-workflow-policy.test.js

@@ -36,19 +36,21 @@ function workflow({ on = 'push', preamble = '', job = 'test', steps }) {
     '  GIT_CONFIG_KEY_0: init.defaultBranch',
     'jobs:',
     `  ${job}:`,
-    '    runs-on: ubuntu-latest',
+    '    runs-on: ubuntu-24.04',
     '    timeout-minutes: 5',
     '    concurrency:',
     `      group: \${{ github.workflow }}-\${{ github.ref }}-${job}`,
     '      cancel-in-progress: true',
     '    steps:',
     '      - uses: actions/checkout@v6',
+    '        with:',
+    '          persist-credentials: false',
     steps,
     // Every workflow has to end in the gate that reads the other jobs'
     // results, so the scaffolding carries one; the gate's own tests are in
     // ci-timeout-budgets.test.js.
     '  pipeline-status:',
-    '    runs-on: ubuntu-latest',
+    '    runs-on: ubuntu-24.04',
     '    timeout-minutes: 5',
     '    concurrency:',
     '      group: ${{ github.workflow }}-${{ github.ref }}-pipeline-status',
@@ -100,9 +102,11 @@ concurrency:
   cancel-in-progress: true
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - run: npm install
       - run: echo "\${{ github.head_ref }}"
       - uses: codecov/codecov-action@v6
@@ -163,6 +167,82 @@ jobs:
     assert.equal(countFailures(content), 1);
   });
 
+  it('rejects the moving ubuntu-latest label in runs-on and in a matrix', () => {
+    // ubuntu-latest moves to Ubuntu 26.04 from 2026-10-19
+    // (actions/runner-images#14748), and every job using it carried that
+    // migration warning in issue #128's runs.
+    const content = workflow({
+      preamble: '',
+      steps: [
+        '    strategy:',
+        '      matrix:',
+        '        os: [ubuntu-latest, windows-latest]',
+      ].join('\n'),
+    }).replace('    runs-on: ubuntu-24.04', '    runs-on: ubuntu-latest');
+
+    assert.equal(countFailures(content), 2);
+  });
+
+  it('rejects a checker that npx fetches at whatever version is newest', () => {
+    // `npx --yes -p secretlint` resolves the latest release on every run, so a
+    // new rule set could fail a pull request that changed nothing it scans.
+    const content = workflow({
+      steps: [
+        '      - run: npx --yes -p secretlint -p @secretlint/secretlint-rule-preset-recommend secretlint "**/*"',
+        '      - run: npx --yes -p secretlint@13.0.7 -p @secretlint/secretlint-rule-preset-recommend@13.0.7 secretlint "**/*"',
+      ].join('\n'),
+    });
+
+    assert.equal(countFailures(content), 1);
+  });
+
+  it('rejects a cargo audit that passes on advisory warnings', () => {
+    // Without --deny warnings, an unmaintained, unsound or yanked crate prints
+    // "warning: 1 allowed warning found" and exits 0 (issue #128,
+    // reproductions/cargo-audit-deny-warnings.log).
+    const content = workflow({
+      steps: [
+        '      - run: cargo audit --file Cargo.lock',
+        '      - run: cargo audit --file Cargo.lock --deny warnings',
+      ].join('\n'),
+    });
+
+    assert.equal(countFailures(content), 1);
+  });
+
+  it('rejects a checkout that leaves the job token in .git/config', () => {
+    // actions/checkout persists the token unless told not to, so any later
+    // step - an install script, an artifact upload of the workspace - can
+    // read it. zizmor reports this as artipacked at low confidence, below the
+    // floor the audit ran with, so 38 checkouts did it unreported (#128).
+    const content = workflow({ steps: '' }).replace(
+      '        with:\n          persist-credentials: false\n',
+      ''
+    );
+
+    assert.equal(countFailures(content), 1);
+  });
+
+  it('rejects a persisted credential in a job that does not write to main', () => {
+    const content = workflow({ steps: '' }).replace(
+      'persist-credentials: false',
+      'persist-credentials: true'
+    );
+
+    assert.equal(countFailures(content), 1);
+  });
+
+  it('accepts a persisted credential in a main-writer job that pushes', () => {
+    const content = workflow({ job: 'release', steps: '' })
+      .replace(
+        'group: ${{ github.workflow }}-${{ github.ref }}-release\n      cancel-in-progress: true',
+        'group: main-writer-${{ github.repository }}-main\n      cancel-in-progress: false'
+      )
+      .replace('persist-credentials: false', 'persist-credentials: true');
+
+    assert.equal(countFailures(content), 0);
+  });
+
   it('accepts a base_ref bound to any environment variable name', () => {
     const content = workflow({
       on: 'pull_request',
@@ -229,7 +309,7 @@ jobs:
       steps: '      - run: npm ci --ignore-scripts',
     })}
   drifted:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
     concurrency:
       group: \${{ github.workflow }}-\${{ github.ref }}-drifted
@@ -286,15 +366,17 @@ function lintAndTest({ needs, condition = '' }) {
     '  GIT_CONFIG_KEY_0: init.defaultBranch',
     'jobs:',
     '  lint:',
-    '    runs-on: ubuntu-latest',
+    '    runs-on: ubuntu-24.04',
     '    timeout-minutes: 5',
     '    concurrency:',
     '      group: ${{ github.workflow }}-${{ github.ref }}-lint',
     '      cancel-in-progress: true',
     '    steps:',
     '      - uses: actions/checkout@v6',
+    '        with:',
+    '          persist-credentials: false',
     '  test:',
-    '    runs-on: ubuntu-latest',
+    '    runs-on: ubuntu-24.04',
     '    timeout-minutes: 5',
     '    concurrency:',
     '      group: ${{ github.workflow }}-${{ github.ref }}-test',
@@ -303,8 +385,10 @@ function lintAndTest({ needs, condition = '' }) {
     condition,
     '    steps:',
     '      - uses: actions/checkout@v6',
+    '        with:',
+    '          persist-credentials: false',
     '  pipeline-status:',
-    '    runs-on: ubuntu-latest',
+    '    runs-on: ubuntu-24.04',
     '    timeout-minutes: 5',
     '    concurrency:',
     '      group: ${{ github.workflow }}-${{ github.ref }}-pipeline-status',

package/tests/unit/scripts/command-stream-errexit.test.js

@@ -23,20 +23,18 @@
  */
 
 import assert from 'node:assert/strict';
+import { readdirSync, readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
 import { describe, it } from 'node:test';
+import { fileURLToPath } from 'node:url';
 
 import {
+  isUseMReachable,
   loadCommandStream,
   USE_M_URL,
 } from '../../../../scripts/use-module.mjs';
 
-async function hasNetwork() {
-  try {
-    return (await fetch(USE_M_URL, { method: 'HEAD' })).ok;
-  } catch {
-    return false;
-  }
-}
+const REPO_ROOT = join(dirname(fileURLToPath(import.meta.url)), '../../../..');
 
 /**
  * Load command-stream, or a reason to skip.
@@ -51,7 +49,7 @@ async function load(t) {
     t.skip('use-m cannot import absolute paths on Windows');
     return null;
   }
-  if (!(await hasNetwork())) {
+  if (!(await isUseMReachable())) {
     t.skip(`${USE_M_URL} is unreachable, so use-m cannot be evaluated`);
     return null;
   }
@@ -70,6 +68,20 @@ async function load(t) {
   }
 }
 
+/**
+ * A test that runs commands through `$`, skipped when it cannot be loaded.
+ * @param {string} name
+ * @param {(shell: (...args: any[]) => Promise<any>) => Promise<void>} body
+ */
+function itWithShell(name, body) {
+  it(name, async (t) => {
+    const $ = (await load(t))?.$;
+    if ($) {
+      await body($);
+    }
+  });
+}
+
 describe('loadCommandStream makes a failed command fail', () => {
   it('turns errexit on, so the release scripts catch what they try to catch', async (t) => {
     const cs = await load(t);
@@ -85,48 +97,78 @@ describe('loadCommandStream makes a failed command fail', () => {
     );
   });
 
-  it('rejects on a non-zero exit and reports the exit code', async (t) => {
-    const cs = await load(t);
-    if (!cs) {
-      return;
-    }
-    const { $ } = cs;
-
-    await assert.rejects(
-      () => $`exit 7`,
-      (error) => {
-        assert.equal(error.code, 7, 'the exit code must survive on the error');
-        return true;
-      },
-      'a command exiting 7 must reject, not resolve'
-    );
-  });
-
-  it('still resolves with stdout on success', async (t) => {
-    const cs = await load(t);
-    if (!cs) {
-      return;
+  itWithShell(
+    'rejects on a non-zero exit and reports the exit code',
+    async ($) => {
+      // A real process, as in the release scripts. command-stream's virtual
+      // `exit` builtin would also reject, but it writes "Command failed with
+      // exit code 7" to stderr on top, which surfaced as a stray line at the end
+      // of every CI test log (issue #128).
+      await assert.rejects(
+        () => $`sh -c "exit 7"`,
+        (error) => {
+          assert.equal(
+            error.code,
+            7,
+            'the exit code must survive on the error'
+          );
+          return true;
+        },
+        'a command exiting 7 must reject, not resolve'
+      );
     }
-    const { $ } = cs;
+  );
 
+  itWithShell('still resolves with stdout on success', async ($) => {
     // errexit must not turn every command into a throw: the success path is
     // what the release scripts read version numbers and git status out of.
     const result = await $`echo errexit-ok`;
     assert.match(String(result.stdout), /errexit-ok/);
   });
 
-  it('reports a non-zero exit for the exact command that broke the Rust release', async (t) => {
-    const cs = await load(t);
-    if (!cs) {
-      return;
+  itWithShell(
+    'reports a non-zero exit for the exact command that broke the Rust release',
+    async ($) => {
+      // `git diff --cached --quiet` exits 1 when there ARE staged changes.
+      // rust/scripts/version-and-commit.mjs relied on that becoming a rejection
+      // and, because it did not, reported "No changes to commit" after staging
+      // two modified files. `false` stands in for it here so the test needs no
+      // git fixture; the contract under test is identical.
+      await assert.rejects(() => $`false`, 'a command exiting 1 must reject');
     }
-    const { $ } = cs;
+  );
+});
+
+describe('command-stream quotes interpolated values itself', () => {
+  // `${value}` in a `$` template is passed through as one argument, quoted by
+  // the library. Escaping by hand on top of that is not a no-op: inside
+  // `"${…}"` the backslashes survive into the argument. CodeQL flagged the
+  // hand escaping in js/scripts/version-and-commit.mjs
+  // (js/incomplete-sanitization, issue #128); this pins why it was removed.
+  const message = 'a "quoted" $HOME `id` back\\slash';
+
+  itWithShell('passes a bare interpolation through unchanged', async ($) => {
+    const result = await $({ mirror: false })`printf '%s' ${message}`;
+    assert.equal(String(result.stdout), message);
+  });
 
-    // `git diff --cached --quiet` exits 1 when there ARE staged changes.
-    // rust/scripts/version-and-commit.mjs relied on that becoming a rejection
-    // and, because it did not, reported "No changes to commit" after staging
-    // two modified files. `false` stands in for it here so the test needs no
-    // git fixture; the contract under test is identical.
-    await assert.rejects(() => $`false`, 'a command exiting 1 must reject');
+  itWithShell('keeps hand-added backslashes inside quotes', async ($) => {
+    // What the removed code produced: `"` escaped, nothing else.
+    const handEscaped = 'a \\"quoted\\" $HOME `id` back\\slash';
+    const result = await $({ mirror: false })`printf '%s' "${handEscaped}"`;
+    assert.notEqual(String(result.stdout), message);
+  });
+
+  it('no release script escapes quotes by hand before interpolating', () => {
+    const offenders = ['js/scripts', 'rust/scripts']
+      .flatMap((dir) =>
+        readdirSync(join(REPO_ROOT, dir))
+          .filter((name) => name.endsWith('.mjs'))
+          .map((name) => join(dir, name))
+      )
+      .filter((file) =>
+        /\.replace\(\/"\/g/.test(readFileSync(join(REPO_ROOT, file), 'utf8'))
+      );
+    assert.deepEqual(offenders, []);
   });
 });

package/tests/unit/scripts/e2e-suite-coverage.test.js

@@ -0,0 +1,174 @@
+/**
+ * Every real-browser suite is run by some workflow, or says why it is not.
+ *
+ * An end-to-end suite skips itself without `RUN_E2E` (or, in Rust, is marked
+ * `#[ignore]`), and a skipped suite exits zero. So a suite that no workflow
+ * opts into is not a failing check: it is no check at all, and CI stays green
+ * while it rots. Issue #128 found ten of them across the three languages.
+ *
+ * This test lists the suites on disk and fails when one is neither invoked by
+ * a workflow nor named in MANUAL_ONLY with a reason a reviewer can judge.
+ * "Invoked" means the suite's file (JavaScript, Python) or test target (Rust,
+ * together with `--ignored`) appears in a command a workflow runs, directly or
+ * through the js/package.json script the command calls. Comments and `paths:`
+ * filters do not count, and neither does a whole-directory run such as
+ * `pytest tests/`, which collects the suites only to skip them.
+ */
+
+import assert from 'node:assert/strict';
+import { readdirSync } from 'node:fs';
+import { describe, it } from 'node:test';
+
+import { readRepoText, repoPath } from '../../helpers/repo.js';
+
+/**
+ * Suites no workflow can run, keyed by repository path. The reason is the
+ * point: it is what a reviewer weighs when deciding whether the gap is real.
+ */
+const MANUAL_ONLY = {
+  'js/tests/e2e/google-signin-probe.e2e.test.js':
+    "Drives Google's live sign-in page, so a CI run would depend on a third-party site and risk tripping its abuse detection from a shared runner IP; it is opt-in through RUN_GOOGLE_PROBE.",
+};
+
+function listFiles(directory, pattern) {
+  return readdirSync(repoPath(directory))
+    .filter((name) => pattern.test(name))
+    .sort()
+    .map((name) => `${directory}/${name}`);
+}
+
+function baseName(file) {
+  return file.slice(file.lastIndexOf('/') + 1);
+}
+
+const SUITES = [
+  ...listFiles('js/tests/e2e', /\.e2e\.test\.js$/),
+  ...listFiles('python/tests/e2e', /^test_.*\.py$/),
+  ...listFiles('rust/tests', /\.rs$/).filter((file) =>
+    /#\[ignore/.test(readRepoText(file))
+  ),
+];
+
+/**
+ * The commands a workflow runs: comment lines dropped, shell line
+ * continuations joined so one command is one line, and the `on:` trigger
+ * section (whose `paths:` filters list file names) left out.
+ */
+function workflowCommands(text) {
+  const jobsStart = text.indexOf('\njobs:\n');
+
+  return (jobsStart === -1 ? '' : text.slice(jobsStart))
+    .replace(/\\\n\s*/g, ' ')
+    .split('\n')
+    .filter((line) => !/^\s*#/.test(line))
+    .join('\n');
+}
+
+const COMMANDS = readdirSync(repoPath('.github/workflows'))
+  .filter((name) => name.endsWith('.yml'))
+  .sort()
+  .map((name) => ({
+    workflow: name,
+    commands: workflowCommands(readRepoText('.github/workflows', name)),
+  }));
+
+const PACKAGE_SCRIPTS = JSON.parse(readRepoText('js/package.json')).scripts;
+
+function tokens(command) {
+  return command.split(/[\s'"]+/).filter(Boolean);
+}
+
+/** The js/package.json scripts whose command names this file. */
+function scriptsRunning(file) {
+  const relative = file.replace(/^js\//, '');
+
+  return Object.entries(PACKAGE_SCRIPTS)
+    .filter(([, command]) => tokens(command).includes(relative))
+    .map(([name]) => name);
+}
+
+/** Where the suite is run, as "<workflow>: <how>" strings. */
+function findRunners(file) {
+  const name = baseName(file);
+  const runners = [];
+
+  for (const { workflow, commands } of COMMANDS) {
+    const lines = commands.split('\n');
+
+    if (file.startsWith('rust/')) {
+      const target = name.replace(/\.rs$/, '');
+      const runsIt = lines.some((line) => {
+        const words = tokens(line);
+        return (
+          words.includes('--ignored') &&
+          words.some(
+            (word, index) => word === '--test' && words[index + 1] === target
+          )
+        );
+      });
+      if (runsIt) {
+        runners.push(`${workflow}: --test ${target} --ignored`);
+      }
+      continue;
+    }
+
+    if (
+      lines.some((line) =>
+        tokens(line).some((word) => word === name || word.endsWith(`/${name}`))
+      )
+    ) {
+      runners.push(`${workflow}: ${name}`);
+    }
+
+    for (const script of scriptsRunning(file)) {
+      const runsScript = lines.some((line) =>
+        tokens(line).some(
+          (word, index, words) =>
+            word === script &&
+            words[index - 1] === 'run' &&
+            words[index - 2] === 'npm'
+        )
+      );
+      if (runsScript) {
+        runners.push(`${workflow}: npm run ${script}`);
+      }
+    }
+  }
+
+  return runners;
+}
+
+describe('end-to-end suite coverage', () => {
+  it('finds the suites to check', () => {
+    for (const language of ['js/', 'python/', 'rust/']) {
+      assert.ok(
+        SUITES.some((file) => file.startsWith(language)),
+        `no ${language} end-to-end suites found; the file patterns are stale`
+      );
+    }
+  });
+
+  it('runs every end-to-end suite in some workflow, or says why not', () => {
+    const unrun = SUITES.filter(
+      (file) => !(file in MANUAL_ONLY) && findRunners(file).length === 0
+    );
+
+    assert.deepEqual(
+      unrun,
+      [],
+      'these suites skip in every workflow, so CI is green whether or not they pass; run them in a workflow (.github/workflows/parity.yml) or add them to MANUAL_ONLY with a reason'
+    );
+  });
+
+  it('keeps MANUAL_ONLY to suites that exist and that no workflow runs', () => {
+    for (const [file, reason] of Object.entries(MANUAL_ONLY)) {
+      assert.ok(SUITES.includes(file), `${file} is not an end-to-end suite`);
+      assert.ok(reason.length > 40, `${file} needs a real reason`);
+      assert.deepEqual(
+        findRunners(file),
+        [],
+        `${file} is run by a workflow; drop it from MANUAL_ONLY`
+      );
+    }
+  });
+});