browser-commander 0.26.0 → 0.26.2

package/src/tests/index.js

@@ -176,7 +176,18 @@ function expandBrowserTestEntries(scenarios, engines) {
 }
 
 function sanitizeArtifactName(value) {
-  return value.replace(/[^a-zA-Z0-9._-]+/g, '-').replace(/^-+|-+$/g, '');
+  const name = value.replace(/[^a-zA-Z0-9._-]+/g, '-');
+  // Trimmed by index: /^-+|-+$/g backtracks quadratically on a long run of
+  // inner dashes (CodeQL js/polynomial-redos).
+  let start = 0;
+  let end = name.length;
+  while (start < end && name[start] === '-') {
+    start++;
+  }
+  while (end > start && name[end - 1] === '-') {
+    end--;
+  }
+  return name.slice(start, end);
 }
 
 function closeBrowserLike(browser) {

package/tests/e2e/engine-matrix.e2e.test.js

@@ -5,6 +5,7 @@ import { createServer } from 'node:http';
 import { describe, it } from 'node:test';
 import { launchBrowser } from '../../src/browser/launcher.js';
 import { makeBrowserCommander } from '../../src/factory.js';
+import { closeServer } from '../helpers/fixture-server.js';
 import {
   CHROME_LAUNCH_OPTIONS,
   PARITY_CHROME,
@@ -50,7 +51,7 @@ describe('Common native engine API', { skip: !process.env.RUN_E2E }, () => {
         );
       } finally {
         await session?.close();
-        await new Promise((resolve) => server.close(resolve));
+        await closeServer(server);
       }
     }
   );

package/tests/e2e/safari.e2e.test.js

@@ -8,6 +8,7 @@ import {
   makeBrowserCommander,
 } from '../../src/index.js';
 import { createDispatcher } from '../../src/cli/dispatcher.js';
+import { closeServer } from '../helpers/fixture-server.js';
 
 it(
   'Safari drives a local page in an isolated automation session',
@@ -97,7 +98,7 @@ it(
       await commander?.destroy();
       phase('close remaining session and server');
       await session?.close();
-      await new Promise((resolve) => server.close(resolve));
+      await closeServer(server);
       phase('cleanup complete');
     }
   }

package/tests/e2e/webdriver.e2e.test.js

@@ -20,6 +20,7 @@ import path from 'node:path';
 import { launchWebDriver } from '../../src/browser/webdriver.js';
 import { makeBrowserCommander } from '../../src/factory.js';
 import { CHROME_LAUNCH_OPTIONS } from '../helpers/e2e-browser.js';
+import { closeServer } from '../helpers/fixture-server.js';
 
 const PAGE = `<!doctype html>
 <title>WebDriver e2e</title>
@@ -42,7 +43,7 @@ async function startPageServer() {
   await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
   return {
     url: `http://127.0.0.1:${server.address().port}/`,
-    close: () => new Promise((resolve) => server.close(resolve)),
+    close: () => closeServer(server),
   };
 }
 

package/tests/helpers/fixture-server.js

@@ -31,6 +31,23 @@ export function sendNotFound(res) {
   res.end('not found');
 }
 
+/**
+ * Close an HTTP server without waiting for the browser's idle connections.
+ *
+ * Browsers open speculative connections they may never send a request on.
+ * Node 24's http.Server#close() waits for those until the client drops them,
+ * which stalled the Safari smoke cleanup for ~30s (issue #128), so stop
+ * listening first and then drop every connection that is left.
+ *
+ * @param {import('node:http').Server} server - Listening server
+ * @returns {Promise<void>} Resolves once the server is closed
+ */
+export function closeServer(server) {
+  const closed = new Promise((resolve) => server.close(() => resolve()));
+  server.closeAllConnections();
+  return closed;
+}
+
 /**
  * Start a fixture server on an ephemeral port.
  *
@@ -50,7 +67,7 @@ export async function startFixtureHost(handle, onClose) {
     baseUrl: `http://127.0.0.1:${port}`,
     close: async () => {
       await onClose?.();
-      await new Promise((resolve) => server.close(resolve));
+      await closeServer(server);
     },
   };
 }

package/tests/unit/browser/webdriver.test.js

@@ -488,6 +488,106 @@ describe('Safari driver lifecycle', () => {
       (error) => error.code === 'SAFARI_SETUP_REQUIRED'
     );
     assert.ok(started[0].child.killed);
+    assert.equal(started.length, 1, 'setup errors are not retried');
+  });
+});
+
+/**
+ * Safari dependencies whose first `failures` driver starts fail the way CI
+ * saw right after the previous session closed: `'exit'` is a safaridriver that
+ * exits with code 1 before /status answers, `'refused'` is one that answered
+ * /status and then refused the new-session request.
+ */
+function flakySafariDependencies(failures) {
+  const setup = safariDependencies();
+  const { dependencies, started, mock } = setup;
+  let port = 49000;
+  dependencies.reservePort = async () => (port += 1);
+  dependencies.safariRetryDelay = 0;
+  const startProcess = dependencies.startProcess;
+  dependencies.startProcess = (...args) => {
+    const child = startProcess(...args);
+    if (failures[started.length - 1] === 'exit') {
+      child.exitCode = 1;
+      child.stdout = {
+        on: (_event, listener) => listener('safaridriver: busy\n'),
+      };
+    }
+    return child;
+  };
+  dependencies.fetch = async () => ({
+    ok: true,
+    json: async () => ({ value: { ready: true } }),
+  });
+  const build = mock.selenium.webdriver.Builder.prototype.build;
+  mock.selenium.webdriver.Builder.prototype.build = function () {
+    if (failures[started.length - 1] === 'refused') {
+      throw new Error(
+        `ECONNREFUSED connect ECONNREFUSED 127.0.0.1:${port} (attempt ${started.length})`
+      );
+    }
+    return build.call(this);
+  };
+  return setup;
+}
+
+describe('Safari launch right after a previous session', () => {
+  for (const failure of ['exit', 'refused']) {
+    it(`starts a new driver when the first one fails with '${failure}'`, async () => {
+      const { dependencies, started } = flakySafariDependencies([failure]);
+      const result = await launchWebDriver({ browser: 'safari' }, dependencies);
+      assert.equal(started.length, 2);
+      assert.equal(result.driverProcess, started[1].child);
+      assert.ok(started[0].child.killed || started[0].child.exitCode === 1);
+      assert.equal(result.serverUrl, 'http://127.0.0.1:49002');
+      await result.close();
+    });
+  }
+
+  it('gives up after three attempts and reports what the driver printed', async () => {
+    const { dependencies, started } = flakySafariDependencies([
+      'exit',
+      'refused',
+      'exit',
+    ]);
+    await assert.rejects(
+      () => launchWebDriver({ browser: 'safari' }, dependencies),
+      /exited with code 1 before it was ready: safaridriver: busy/
+    );
+    assert.equal(started.length, 3);
+  });
+
+  it('adds the driver exit status to a refused session request', async () => {
+    const { dependencies } = flakySafariDependencies([
+      'refused',
+      'refused',
+      'refused',
+    ]);
+    await assert.rejects(
+      () => launchWebDriver({ browser: 'safari' }, dependencies),
+      (error) =>
+        /ECONNREFUSED .*\(attempt 3\)/.test(error.message) &&
+        /WebDriver server at http:\/\/127\.0\.0\.1:49003/.test(error.message)
+    );
+  });
+
+  it('does not retry other browsers', async () => {
+    const { dependencies, started, mock } = launchDependencies({
+      checkAccess: accessOnly('/opt/drivers/chromedriver'),
+      safariRetryDelay: 0,
+    });
+    mock.selenium.webdriver.Builder.prototype.build = () => {
+      throw new Error('ECONNREFUSED connect ECONNREFUSED 127.0.0.1:41001');
+    };
+    await assert.rejects(
+      () =>
+        launchWebDriver(
+          { driverPath: '/opt/drivers/chromedriver' },
+          dependencies
+        ),
+      /ECONNREFUSED/
+    );
+    assert.equal(started.length, 1);
   });
 });
 

package/tests/unit/elements/selectors.test.js

@@ -192,6 +192,81 @@ describe('selectors', () => {
     });
   });
 
+  describe('normalizeSelector with Playwright text selectors', () => {
+    /** A page whose evaluate records the parsed selector it was given. */
+    function capturingPage() {
+      const page = {
+        parsed: null,
+        evaluate: async (_fn, parsed) => {
+          page.parsed = parsed;
+          return 'button:nth-of-type(1)';
+        },
+      };
+      return page;
+    }
+
+    it('splits :has-text into base selector and text', async () => {
+      const page = capturingPage();
+      await normalizeSelector({
+        page,
+        engine: 'playwright',
+        selector: 'nav a:has-text("Sign in")',
+      });
+      assert.deepStrictEqual(page.parsed, {
+        baseSelector: 'nav a',
+        text: 'Sign in',
+        exact: false,
+      });
+    });
+
+    it('splits :text-is into base selector and exact text', async () => {
+      const page = capturingPage();
+      await normalizeSelector({
+        page,
+        engine: 'playwright',
+        selector: 'button:text-is("Submit")',
+      });
+      assert.deepStrictEqual(page.parsed, {
+        baseSelector: 'button',
+        text: 'Submit',
+        exact: true,
+      });
+    });
+
+    it('returns an unparseable selector unchanged', async () => {
+      for (const selector of [
+        ':has-text("no base")',
+        'a:has-text("")',
+        'a:has-text("unclosed',
+      ]) {
+        const page = capturingPage();
+        const result = await normalizeSelector({
+          page,
+          engine: 'playwright',
+          selector,
+        });
+        assert.strictEqual(result, selector);
+        assert.strictEqual(page.parsed, null);
+      }
+    });
+
+    it('rejects a long unparseable selector in linear time', async () => {
+      // The former /^(.+?):has-text\("(.+?)"\)$/ backtracked quadratically
+      // on this input: about 18s at this length (CodeQL js/polynomial-redos,
+      // issue #128; experiments/issue-128/text-selector-redos.mjs).
+      const selector = `a${':has-text("'.repeat(50_000)}`;
+      const started = performance.now();
+      const result = await normalizeSelector({
+        page: capturingPage(),
+        engine: 'playwright',
+        selector,
+      });
+      const elapsed = performance.now() - started;
+      assert.strictEqual(result, selector);
+      assert.ok(elapsed < 1000, `took ${elapsed.toFixed(0)}ms`);
+    });
+  });
+
   describe('normalizeSelector', () => {
     it('should throw when selector is not provided', async () => {
       const page = createMockPlaywrightPage();

package/tests/unit/helpers/fixture-server.test.js

@@ -0,0 +1,60 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { createServer } from 'node:http';
+import { connect } from 'node:net';
+import { closeServer, startFixtureHost } from '../../helpers/fixture-server.js';
+
+/**
+ * Open a connection the way a browser preconnects: TCP only, no request.
+ * Node 24's http.Server#close() waits for such a socket until the client
+ * drops it, which is what stalled the Safari smoke cleanup (issue #128).
+ */
+async function preconnect(url) {
+  const { hostname, port } = new URL(url);
+  const socket = connect(Number(port), hostname);
+  socket.on('error', () => {});
+  await new Promise((resolve) => socket.once('connect', resolve));
+  return socket;
+}
+
+/** Fail instead of hanging when a close does not finish in time. */
+function within(promise, ms) {
+  let timer;
+  return Promise.race([
+    promise,
+    new Promise((_resolve, reject) => {
+      timer = setTimeout(
+        () => reject(new Error(`did not close within ${ms}ms`)),
+        ms
+      );
+    }),
+  ]).finally(() => clearTimeout(timer));
+}
+
+describe('fixture server shutdown', { timeout: 10_000 }, () => {
+  it('closeServer does not wait for a preconnected idle socket', async () => {
+    const server = createServer((_request, response) => response.end('ok'));
+    await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+    const socket = await preconnect(
+      `http://127.0.0.1:${server.address().port}/`
+    );
+    try {
+      await within(closeServer(server), 2_000);
+      assert.equal(server.listening, false);
+    } finally {
+      socket.destroy();
+    }
+  });
+
+  it('startFixtureHost close does not wait for a preconnected idle socket', async () => {
+    const host = await startFixtureHost((_path, _request, response) =>
+      response.end('ok')
+    );
+    const socket = await preconnect(host.baseUrl);
+    try {
+      await within(host.close(), 2_000);
+    } finally {
+      socket.destroy();
+    }
+  });
+});

package/tests/unit/playwright-protocol-coverage.test.js

@@ -198,12 +198,15 @@ describe('Rust Playwright protocol bindings', () => {
     const installed = JSON.parse(
       fs.readFileSync(path.join(root, 'package.json'), 'utf8')
     ).version;
-    if (installed !== version) {
-      t.skip(
-        `playwright-core ${installed} is installed, the spec is ${version}`
-      );
-      return;
-    }
+    // A version mismatch is the drift this test exists to catch, so it fails
+    // rather than skips (issue #128: the same skip in the Puppeteer bindings
+    // test hid a stale manifest on every CI run).
+    assert.equal(
+      version,
+      installed,
+      `playwright-core ${installed} is installed, the spec is ${version}; ` +
+        'refresh rust/protocol/playwright/ as its README describes'
+    );
     // The driver validates every message against these schemes; one exists per
     // command (`<Interface><Command>Params`) and event (`<Interface><Event>Event`).
     const bundle = fs.readFileSync(

package/tests/unit/puppeteer-bindings-coverage.test.js

@@ -7,7 +7,8 @@
  * extracts from puppeteer-core's `lib/types.d.ts`. These tests fail when:
  *
  * - the committed wrappers differ from what the generator writes;
- * - the committed manifest differs from the installed puppeteer-core;
+ * - the committed manifest differs from the installed puppeteer-core,
+ *   including its version (a mismatch fails rather than skips);
  * - a public method or getter declared in `lib/types.d.ts` (own or inherited)
  *   has no typed entry point in Rust or Python.
  */
@@ -131,12 +132,15 @@ describe('Puppeteer bindings (Rust and Python)', () => {
       t.skip('puppeteer-core is not installed');
       return;
     }
-    if (installed.version !== manifest.version) {
-      t.skip(
-        `puppeteer-core ${installed.version} is installed, the manifest is ${manifest.version}`
-      );
-      return;
-    }
+    // A version mismatch is exactly the drift this test exists to catch (issue
+    // #128: puppeteer-core was upgraded to 25.12.0 while the manifest stayed
+    // at 25.10.0, and a skip here hid it), so it fails instead of skipping.
+    assert.equal(
+      manifest.version,
+      installed.version,
+      `puppeteer-core ${installed.version} is installed, the manifest is ${manifest.version}; ` +
+        'run node scripts/generate-puppeteer-bindings.mjs --update-api'
+    );
     const fresh = {
       package: 'puppeteer-core',
       version: installed.version,
@@ -149,6 +153,23 @@ describe('Puppeteer bindings (Rust and Python)', () => {
     );
   });
 
+  it('are read through virtual paths the TypeScript API can find on Windows', () => {
+    // TypeScript 7's virtual file system matches file names as exact keys, and
+    // the native compiler asks for them with forward slashes. Keys built with
+    // path.join on Windows (`D:\a\…\tsconfig.json`) were never found, so the
+    // project came back undefined (issue #128, run 37526767522).
+    const paths = extractor.virtualProjectPaths(
+      'D:\\a\\browser-commander\\browser-commander'
+    );
+    assert.deepEqual(paths, {
+      cwd: 'D:/a/browser-commander/browser-commander/experiments/puppeteer-api-virtual',
+      config:
+        'D:/a/browser-commander/browser-commander/experiments/puppeteer-api-virtual/tsconfig.json',
+      declaration:
+        'D:/a/browser-commander/browser-commander/experiments/puppeteer-api-virtual/types.d.ts',
+    });
+  });
+
   it('give every declared Puppeteer method a typed entry point', () => {
     const missing = [];
     let checked = 0;

package/tests/unit/scripts/bot-commit-attribution.test.js

@@ -0,0 +1,70 @@
+/**
+ * CI commits use the bot's documented no-reply address (issue #128).
+ *
+ * GitHub documents a user's no-reply address as
+ * `{user.id}+{user.login}@users.noreply.github.com`, and the actions/checkout
+ * README configures `41898282+github-actions[bot]@users.noreply.github.com`
+ * for commits pushed from a workflow. The three release paths here used the
+ * legacy `github-actions[bot]@users.noreply.github.com` instead.
+ *
+ * Checked on 2026-10-06: GitHub still links the legacy address to the bot
+ * (the commits API returns `author.login: github-actions[bot]` for release
+ * commits 9f8a552, cca988f, fda33e7 and d159aeb), so no release was ever
+ * unattributed here. The JS pipeline template switched for that reason
+ * (link-foundation/js-ai-driven-development-pipeline-template#144), which
+ * this repository could not reproduce. The test pins the documented form so
+ * the three packages agree with each other and with the template, without
+ * relying on GitHub continuing to resolve the undocumented one.
+ */
+
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { describe, it } from 'node:test';
+
+import { REPO_ROOT, repoPath } from '../../helpers/repo.js';
+
+const BOT_EMAIL = '41898282+github-actions[bot]@users.noreply.github.com';
+const UNPREFIXED = 'github-actions[bot]@users.noreply.github.com';
+
+// Every place that configures the commit author for CI, per language.
+const ROOTS = [
+  '.github/workflows',
+  'scripts',
+  'js/scripts',
+  'python/scripts',
+  'rust/scripts',
+];
+
+// Tracked files only: a local __pycache__ holds stale copies of the scripts.
+function trackedFiles(roots) {
+  return execFileSync('git', ['ls-files', '-z', '--', ...roots], {
+    cwd: REPO_ROOT,
+    encoding: 'utf8',
+  })
+    .split('\0')
+    .filter(Boolean);
+}
+
+describe('github-actions[bot] commit attribution', () => {
+  const files = trackedFiles(ROOTS);
+
+  it('configures the prefixed bot e-mail somewhere', () => {
+    assert.ok(
+      files.some((file) =>
+        readFileSync(repoPath(file), 'utf8').includes(BOT_EMAIL)
+      ),
+      `no file configures ${BOT_EMAIL}`
+    );
+  });
+
+  it('never configures the unprefixed bot e-mail', () => {
+    const offenders = files.filter((file) =>
+      readFileSync(repoPath(file), 'utf8')
+        .split(BOT_EMAIL)
+        .join('')
+        .includes(UNPREFIXED)
+    );
+    assert.deepEqual(offenders, []);
+  });
+});

package/tests/unit/scripts/check-duplication.test.js

@@ -0,0 +1,139 @@
+/**
+ * The duplication gate must print the clones it fails on, not the baseline
+ * (issue #128).
+ *
+ * With the console reporter, `jscpd --baseline … --fail-on-new-clones` lists
+ * every clone it finds. A passing run printed 272 "Clone found" blocks, about
+ * 840 lines, all of them clones the baseline already accepts. The one clone
+ * that fails a run was marked only by a `[NEW]` tag somewhere in that list.
+ */
+
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { describe, it } from 'node:test';
+
+import {
+  formatNewClones,
+  resolveJscpdCli,
+} from '../../../scripts/check-duplication.mjs';
+import { repoPath } from '../../helpers/repo.js';
+
+const SCRIPT = repoPath('js/scripts/check-duplication.mjs');
+
+function clone(first, second, isNew) {
+  const side = (name, start, end) => ({ name, start, end });
+  return {
+    format: 'javascript',
+    lines: second[2] - second[1] + 1,
+    isNew,
+    firstFile: side(...first),
+    secondFile: side(...second),
+  };
+}
+
+const REPORT = {
+  duplicates: [
+    clone(['README.md:javascript', 61, 92], ['src/README.md', 29, 60], false),
+    clone(['src/a.js', 21, 40], ['src/b,c.js', 3, 22], true),
+  ],
+};
+
+describe('formatNewClones', () => {
+  it('lists only the clones missing from the baseline', () => {
+    const text = formatNewClones(REPORT, { githubActions: false });
+    assert.match(text, /src\/a\.js:21-40 ~ src\/b,c\.js:3-22 \(20 lines\)/);
+    assert.doesNotMatch(text, /README/);
+  });
+
+  it('raises one error annotation per new clone, on the repository path', () => {
+    const text = formatNewClones(REPORT, {
+      githubActions: true,
+      cwd: repoPath('js'),
+      workspace: repoPath(),
+    });
+    const lines = text.trim().split('\n');
+    assert.equal(lines.length, 1);
+    assert.equal(
+      lines[0],
+      '::error file=js/src/a.js,line=21,endLine=40,title=New duplicated code::' +
+        '20 lines duplicate js/src/b,c.js:3-22. Extract the shared code, or ' +
+        'accept the clone with `npm run check:duplication:update`.'
+    );
+  });
+
+  it('strips the embedded-language suffix jscpd adds to Markdown code', () => {
+    const report = {
+      duplicates: [
+        clone(
+          ['README.md:javascript', 5, 9],
+          ['docs/x.md:markdown', 1, 5],
+          true
+        ),
+      ],
+    };
+    assert.match(
+      formatNewClones(report, {
+        githubActions: true,
+        cwd: repoPath('js'),
+        workspace: repoPath(),
+      }),
+      /^::error file=js\/README\.md,line=5,endLine=9,/
+    );
+  });
+});
+
+describe('check-duplication.mjs end to end', () => {
+  function run(cwd) {
+    return spawnSync(process.execPath, [SCRIPT], {
+      cwd,
+      encoding: 'utf8',
+      env: { ...process.env, GITHUB_ACTIONS: '', NO_COLOR: '1' },
+    });
+  }
+
+  it('is quiet about accepted clones and names a new one', (t) => {
+    if (!resolveJscpdCli()) {
+      return t.skip('jscpd is not installed; run npm ci in js/');
+    }
+    const fixture = fs.mkdtempSync(path.join(tmpdir(), 'check-duplication-'));
+    try {
+      fs.copyFileSync(
+        repoPath('js/.jscpd.json'),
+        path.join(fixture, '.jscpd.json')
+      );
+      const body = fs.readFileSync(repoPath('js/src/core/dialog-manager.js'));
+      fs.writeFileSync(path.join(fixture, 'one.js'), body);
+      fs.writeFileSync(path.join(fixture, 'two.js'), body);
+      const update = spawnSync(
+        process.execPath,
+        [
+          resolveJscpdCli(),
+          '.',
+          '--baseline',
+          '.jscpd-baseline.json',
+          '--update-baseline',
+          '--reporters',
+          'silent',
+        ],
+        { cwd: fixture, encoding: 'utf8' }
+      );
+      assert.equal(update.status, 0, update.stderr);
+
+      const accepted = run(fixture);
+      assert.equal(accepted.status, 0, accepted.stdout + accepted.stderr);
+      assert.doesNotMatch(accepted.stdout, /Clone found|one\.js/);
+      assert.match(accepted.stdout, /\d+ clones?, 0 new/);
+
+      fs.writeFileSync(path.join(fixture, 'three.js'), body);
+      const failed = run(fixture);
+      assert.equal(failed.status, 1, failed.stdout + failed.stderr);
+      assert.match(failed.stdout, /^New clone: \S+:\d+-\d+ ~ /m);
+      assert.match(failed.stdout, /clones, [1-9]\d* new/);
+    } finally {
+      fs.rmSync(fixture, { recursive: true, force: true });
+    }
+  });
+});