browser-commander 0.30.0 → 0.30.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.30.1
+
+### Patch Changes
+
+- aee418c: Upgrade Command Stream to ^2.0.2 to remove the vulnerable ShellJS/braces dependency chain from fresh consumer installations while preserving subprocess and detached browser launch behavior.
+
 ## 0.30.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "browser-commander",
-  "version": "0.30.0",
+  "version": "0.30.1",
   "description": "Universal browser automation library that supports Playwright, Puppeteer, and Selenium with a unified API",
   "main": "src/index.js",
   "bin": {
@@ -81,7 +81,7 @@
   },
   "dependencies": {
     "bplist-parser": "^0.5.0",
-    "command-stream": "^1.4.0",
+    "command-stream": "^2.0.2",
     "csv-parse": "^7.0.3",
     "gifenc": "^1.0.3",
     "links-notation": "^0.23.0",

package/src/utilities/subprocess.js

@@ -9,7 +9,7 @@ export async function startDetachedProcess(file, args = [], options = {}) {
     runner.child.once('error', reject);
   });
   const child = runner.child;
-  // command-stream 1.x starts noninteractive children in their own process
+  // command-stream starts noninteractive children in their own process
   // group. Release its controller-owned cancellation registry while retaining
   // the child's exit listeners. Keep this adapter isolated until it exposes a
   // public detach operation; normal subprocesses retain managed cancellation.

package/tests/e2e/capture.e2e.test.js

@@ -0,0 +1,96 @@
+/** Real launch and capture contracts for the Command Stream upgrade (#164). */
+import { it } from 'node:test';
+import assert from 'node:assert/strict';
+import UPNG from 'upng-js';
+import {
+  screenshot,
+  startRecording,
+  encodeAnimation,
+  encodeVideo,
+  launchBrowser,
+} from '../../src/index.js';
+import { CHROME_LAUNCH_OPTIONS } from '../helpers/e2e-browser.js';
+
+for (const engine of ['playwright', 'puppeteer', 'selenium']) {
+  it(
+    `${engine}: screenshots and bounded animation/video capture after a real launch`,
+    { skip: !process.env.RUN_E2E, timeout: 60000 },
+    async () => {
+      const session = await launchBrowser({
+        engine,
+        headless: process.env.HEADLESS !== 'false',
+        ...CHROME_LAUNCH_OPTIONS,
+        ...(engine === 'selenium' ? { bidi: true } : {}),
+      });
+      let recording;
+      try {
+        const { page } = session;
+        await page.goto(
+          'data:text/html,<input id="focus"><div style="height:2000px;background:teal">Capture fixture</div>'
+        );
+        const state = () =>
+          page.evaluate(() => ({
+            scroll: window.scrollY,
+            active: document.activeElement.id,
+          }));
+        await page.evaluate(() => {
+          document.querySelector('input').focus();
+          window.scrollTo(0, 200);
+        });
+        const before = await state();
+        const png = await screenshot({ page, engine, stableViewport: true });
+        assert.equal(png.subarray(1, 4).toString(), 'PNG');
+        assert.deepEqual(await state(), before);
+        const jpeg = await screenshot({ page, engine, format: 'jpeg' });
+        assert.equal(jpeg.readUInt16BE(0), 0xffd8);
+        const webp = await screenshot({ page, engine, format: 'webp' });
+        assert.equal(webp.subarray(8, 12).toString(), 'WEBP');
+
+        recording = await startRecording({
+          page,
+          engine,
+          format: 'frames',
+          fps: 2,
+          maxFrames: 2,
+          maxBytes: 1024 * 1024,
+          maxDurationMs: 3000,
+          size: { width: 120, height: 100 },
+        });
+        await page.evaluate(() => {
+          document.querySelector('div').style.background = 'red';
+        });
+        const deadline = Date.now() + 3000;
+        while (recording.frames.length < 2 && Date.now() < deadline) {
+          await new Promise((resolve) => setTimeout(resolve, 50));
+        }
+        const { frames } = await recording.stop();
+        assert.equal(frames.length, 2);
+        const gif = await encodeAnimation(frames, { format: 'gif', fps: 2 });
+        assert.equal(gif.subarray(0, 6).toString(), 'GIF89a');
+        const apng = await encodeAnimation(frames, { format: 'apng', fps: 2 });
+        assert.equal(UPNG.decode(apng).frames.length, 2);
+        const animatedWebp = await encodeAnimation(frames, {
+          format: 'webp',
+          fps: 2,
+        });
+        assert.equal(
+          animatedWebp.toString('latin1').split('ANMF').length - 1,
+          2
+        );
+        const video = await encodeVideo(frames, {
+          page,
+          engine,
+          format: 'webm',
+          fps: 2,
+        });
+        assert.equal(video.readUInt32BE(0), 0x1a45dfa3);
+      } finally {
+        try {
+          await recording?.stop();
+        } finally {
+          await session.close();
+        }
+      }
+    }
+  );
+}

package/tests/unit/utilities/subprocess.test.js

@@ -1,14 +1,18 @@
 import { describe, it } from 'node:test';
 import assert from 'node:assert';
+import * as fs from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
 import {
   CommandError,
   runCommand,
   startProcess,
 } from '../../../src/utilities/subprocess.js';
+import { repoPath } from '../../helpers/repo.js';
 
 const node = process.execPath;
 
-describe('runCommand', () => {
+describe('runCommand', { timeout: 10000 }, () => {
   it('passes arguments without a shell and captures output', async () => {
     const result = await runCommand(node, [
       '-e',
@@ -46,9 +50,25 @@ describe('runCommand', () => {
     const result = await runCommand(node, args, { check: false });
     assert.equal(result.code, 3);
   });
+
+  it('reports a missing executable as exit 127 with ENOENT diagnostics', async () => {
+    const file = path.join(tmpdir(), 'bc-missing-executable-164', 'missing');
+    await assert.rejects(
+      () => runCommand(file),
+      (error) => {
+        assert.ok(error instanceof CommandError);
+        assert.equal(error.code, 127);
+        assert.match(error.stderr, /ENOENT/);
+        return true;
+      }
+    );
+    const result = await runCommand(file, [], { check: false });
+    assert.equal(result.code, 127);
+    assert.match(result.stderr, /ENOENT/);
+  });
 });
 
-describe('startProcess', () => {
+describe('startProcess', { timeout: 10000 }, () => {
   it('streams output and reports the exit code', async () => {
     const child = startProcess(node, [
       '-e',
@@ -78,3 +98,61 @@ describe('startProcess', () => {
     assert.notEqual(exitCode, 0);
   });
 });
+
+describe(
+  'startDetachedProcess',
+  {
+    timeout: 10000,
+    // Both the original 1.4.0 and 2.0.2 runner disable Windows detachment.
+    skip:
+      process.platform === 'win32' &&
+      'Command Stream only creates detached process groups on Unix',
+  },
+  () => {
+    it('lets the launcher exit while the detached child survives', async (t) => {
+      const directory = await fs.mkdtemp(
+        path.join(tmpdir(), 'bc-detached-164-')
+      );
+      const marker = path.join(directory, 'survived');
+      let pid;
+      const launcher = startProcess(node, [
+        repoPath('experiments', 'issue-164', 'detached-launcher.mjs'),
+        marker,
+      ]);
+      t.after(async () => {
+        launcher.kill();
+        if (pid) {
+          try {
+            process.kill(pid, 'SIGKILL');
+          } catch (error) {
+            if (error.code !== 'ESRCH') {
+              throw error;
+            }
+          }
+        }
+        await fs.rm(directory, { recursive: true, force: true });
+      });
+      let output = '';
+      launcher.stdout.on('data', (chunk) => {
+        output += chunk;
+        pid = Number(output.trim());
+      });
+      assert.equal(await launcher.exited, 0, launcher.stderrTail);
+      assert.ok(pid > 0);
+      await assert.rejects(fs.readFile(marker), { code: 'ENOENT' });
+      const deadline = Date.now() + 5000;
+      while (Date.now() < deadline) {
+        try {
+          assert.equal(await fs.readFile(marker, 'utf8'), 'survived');
+          return;
+        } catch (error) {
+          if (error.code !== 'ENOENT') {
+            throw error;
+          }
+          await new Promise((resolve) => setTimeout(resolve, 50));
+        }
+      }
+      assert.fail('detached child did not survive the launcher exit');
+    });
+  }
+);