browser-commander 0.32.0 → 0.33.0

package/tests/unit/browser/webdriver.test.js

@@ -381,6 +381,45 @@ describe('launchWebDriver', () => {
     await session.close(); // idempotent
   });
 
+  it('adds the Chrome for Testing defaults for the browser it resolves (issue #179)', async () => {
+    const launchWith = async (browserPath, options = {}) => {
+      const { mock, dependencies } = launchDependencies({
+        runCommand: async () =>
+          managerOutput({
+            driver_path: '/cache/chromedriver',
+            browser_path: browserPath,
+          }),
+      });
+      const session = await launchWebDriver(options, dependencies);
+      await session.close();
+      const { args } = mock.record.builders[0].options;
+      return {
+        defaults: session.defaultRestrictions,
+        switches: args.filter((arg) =>
+          ['--test-type=gpu', '--use-mock-keychain'].includes(arg)
+        ),
+      };
+    };
+
+    // Selenium Manager downloads Chrome for Testing when no Chrome is installed.
+    const cft = await launchWith(
+      '/home/u/.cache/selenium/chrome/linux64/131.0.6778.85/chrome'
+    );
+    assert.deepEqual(cft.defaults, [
+      'no-chrome-for-testing-infobar',
+      'mock-keychain',
+    ]);
+    assert.deepEqual(cft.switches, ['--test-type=gpu', '--use-mock-keychain']);
+
+    const chrome = await launchWith('/opt/google/chrome/chrome');
+    assert.deepEqual(chrome, { defaults: [], switches: [] });
+    const off = await launchWith(
+      '/home/u/.cache/selenium/chrome/linux64/131.0.6778.85/chrome',
+      { defaultRestrictions: [] }
+    );
+    assert.deepEqual(off, { defaults: [], switches: [] });
+  });
+
   it('starts geckodriver for Firefox with a -profile argument', async () => {
     const { mock, started, dependencies } = launchDependencies({
       environment: { PATH: '/usr/bin' },

package/tests/unit/scripts/preflight-credentials.test.js

@@ -90,6 +90,7 @@ function environment(overrides) {
     NPM_REGISTRY: `${stub.origin}/npm`,
     CRATES_API: `${stub.origin}/crates`,
     NPM_PACKAGE: '@link-foundation/probe',
+    CRATES_PACKAGE: 'probe-crate',
     CARGO_REGISTRY_TOKEN: '',
     CARGO_TOKEN: '',
     GITHUB_STEP_SUMMARY: '',
@@ -133,6 +134,13 @@ const EXCHANGE =
   'POST /npm/-/npm/v1/oidc/token/exchange/package/@link-foundation%2Fprobe';
 const CRATES_MINT = 'POST /crates/api/v1/trusted_publishing/tokens';
 const CRATES_REVOKE = 'DELETE /crates/api/v1/trusted_publishing/tokens';
+const CRATES_PUBLISH = 'PUT /crates/api/v1/crates/new';
+// What crates.io answers to an authorised publish that omits the archive.
+const TOKEN_ACCEPTED = [
+  400,
+  { errors: [{ detail: 'invalid tarball length' }] },
+];
+const TOKEN_REJECTED = [403, { errors: [{ detail: 'authentication failed' }] }];
 const INVALID_PUBLISHER = [
   422,
   {
@@ -157,6 +165,33 @@ function probeCrates(answer, overrides = {}) {
   return preflight({ PREFLIGHT_REGISTRIES: 'crates', ...overrides });
 }
 
+/**
+ * Refuse the crates.io OIDC exchange and answer the token publish probe with
+ * `answer`, so the outcome rests on the token fallback.
+ */
+function probeFallback(answer, overrides = {}) {
+  stub.routes[CRATES_PUBLISH] = answer;
+  return probeCrates([403, {}], { CARGO_TOKEN: CARGO_SECRET, ...overrides });
+}
+
+/** Run the crates.io probe in a job without `id-token: write`. */
+function preflightWithoutOidc(overrides = {}) {
+  return preflight({
+    PREFLIGHT_REGISTRIES: 'crates',
+    ACTIONS_ID_TOKEN_REQUEST_URL: '',
+    ACTIONS_ID_TOKEN_REQUEST_TOKEN: '',
+    ...overrides,
+  });
+}
+
+/** The metadata of a token publish probe: a u32 length, then JSON. */
+function probeMetadata(body) {
+  const bytes = Buffer.from(body, 'latin1');
+  const length = bytes.readUInt32LE(0);
+  assert.equal(bytes.length, 4 + length, 'the probe must carry no archive');
+  return JSON.parse(bytes.subarray(4).toString('utf8'));
+}
+
 describe('scripts/preflight-credentials.sh', scriptOptions, () => {
   before(async () => {
     stub.server = createServer(respond);
@@ -349,11 +384,11 @@ describe('scripts/preflight-credentials.sh', scriptOptions, () => {
       assertNoSecrets(output);
     });
 
-    it('fails a release when no trusted publisher matches, even with a legacy secret', async () => {
-      const { status, output } = await probeCrates(
-        [403, { errors: [{ detail: 'no matching publisher' }] }],
-        { CARGO_TOKEN: CARGO_SECRET }
-      );
+    it('fails a release when no trusted publisher matches and no token is set', async () => {
+      const { status, output } = await probeCrates([
+        403,
+        { errors: [{ detail: 'no matching publisher' }] },
+      ]);
 
       assert.equal(status, 1, output);
       assert.match(
@@ -362,18 +397,80 @@ describe('scripts/preflight-credentials.sh', scriptOptions, () => {
       );
       assert.match(output, /rust\.yml/);
       assert.match(output, /docs\/PUBLISHING\.md/);
+      assert.match(output, /neither CARGO_REGISTRY_TOKEN nor CARGO_TOKEN/);
       assert.equal(stub.requests.length, 2);
+    });
+
+    it('passes a release on the token fallback when no trusted publisher matches', async () => {
+      const { status, output } = await probeFallback(TOKEN_ACCEPTED);
+
+      assert.equal(status, 0, output);
+      assert.match(output, /1 verified, 0 failed, 0 unknown/);
+      assert.match(
+        output,
+        /PASS: crates.io accepted the CARGO_REGISTRY_TOKEN\/CARGO_TOKEN fallback for probe-crate/
+      );
+      assert.match(
+        output,
+        /::warning::release-preflight: crates.io refused the OIDC token exchange \(403\).*falls back to the CARGO_REGISTRY_TOKEN\/CARGO_TOKEN secret/
+      );
+      assert.doesNotMatch(output, /::error::/);
+      const publish = stub.requests.at(-1);
+      assert.equal(publish.route, CRATES_PUBLISH);
+      assert.equal(publish.authorization, CARGO_SECRET);
+      assert.match(publish.userAgent, /^release-preflight /);
+      assert.deepEqual(probeMetadata(publish.body), {
+        name: 'probe-crate',
+        vers: '0.0.0-preflight',
+      });
+      assert.equal(stub.requests.length, 3);
       assertNoSecrets(output);
     });
 
-    it('fails when the job has no OIDC permission, with no secret fallback', async () => {
-      const { status, output } = await preflight({
-        PREFLIGHT_REGISTRIES: 'crates',
-        ACTIONS_ID_TOKEN_REQUEST_URL: '',
-        ACTIONS_ID_TOKEN_REQUEST_TOKEN: '',
+    it('prefers CARGO_REGISTRY_TOKEN over CARGO_TOKEN for the fallback', async () => {
+      const { status, output } = await probeFallback(TOKEN_ACCEPTED, {
+        CARGO_REGISTRY_TOKEN: CARGO_SECRET,
+        CARGO_TOKEN: 'cio-other-token-must-not-be-used',
+      });
+
+      assert.equal(status, 0, output);
+      assert.equal(stub.requests.at(-1).authorization, CARGO_SECRET);
+    });
+
+    it('fails a release when trusted publishing and the token fallback are both refused', async () => {
+      const { status, output } = await probeFallback(TOKEN_REJECTED);
+
+      assert.equal(status, 1, output);
+      assert.match(output, /0 verified, 1 failed, 0 unknown/);
+      assert.match(
+        output,
+        /::error::release-preflight: crates.io refused the OIDC token exchange \(403\).*; crates.io rejected the CARGO_REGISTRY_TOKEN\/CARGO_TOKEN fallback for probe-crate \(403\)/
+      );
+      assert.equal(stub.requests.length, 3);
+      assertNoSecrets(output);
+    });
+
+    it('falls back to the token when the job has no OIDC permission', async () => {
+      stub.routes[CRATES_PUBLISH] = TOKEN_ACCEPTED;
+      const { status, output } = await preflightWithoutOidc({
         CARGO_REGISTRY_TOKEN: CARGO_SECRET,
       });
 
+      assert.equal(status, 0, output);
+      assert.match(
+        output,
+        /::warning::release-preflight: crates.io: no OIDC token available: .*id-token: write/
+      );
+      assert.deepEqual(
+        stub.requests.map(({ route }) => route),
+        [CRATES_PUBLISH]
+      );
+      assertNoSecrets(output);
+    });
+
+    it('fails when the job has no OIDC permission and no token is set', async () => {
+      const { status, output } = await preflightWithoutOidc();
+
       assert.equal(status, 1, output);
       assert.match(
         output,
@@ -382,6 +479,54 @@ describe('scripts/preflight-credentials.sh', scriptOptions, () => {
       assert.equal(stub.requests.length, 0);
     });
 
+    it('treats an unproven token fallback as unknown, never as a pass', async () => {
+      for (const answer of [
+        [400, { errors: [{ detail: 'invalid upload request' }] }],
+        [429, {}],
+        [500, { token: CARGO_SECRET }],
+      ]) {
+        const { status, output } = await probeFallback(answer);
+        assert.equal(status, 1, output);
+        assert.match(output, /0 verified, 0 failed, 1 unknown/);
+        assert.match(output, /verified nothing/);
+        assertNoSecrets(output);
+      }
+    });
+
+    it('reads the crate name from Cargo.toml when CRATES_PACKAGE is unset', async () => {
+      writeFileSync(
+        path.join(workDir, 'Cargo.toml'),
+        [
+          '[package]',
+          'name = "from-manifest"',
+          'version = "1.2.3"',
+          '',
+          '[dependencies.serde]',
+          'name = "not-this-one"',
+          '',
+        ].join('\n')
+      );
+      const { status, output } = await probeFallback(TOKEN_ACCEPTED, {
+        CRATES_PACKAGE: '',
+      });
+
+      assert.equal(status, 0, output);
+      assert.equal(
+        probeMetadata(stub.requests.at(-1).body).name,
+        'from-manifest'
+      );
+    });
+
+    it('cannot probe the token without a crate name', async () => {
+      const { status, output } = await probeFallback(TOKEN_ACCEPTED, {
+        CRATES_PACKAGE: '',
+      });
+
+      assert.equal(status, 1, output);
+      assert.match(output, /cannot tell which crate to probe/);
+      assert.equal(stub.requests.length, 2);
+    });
+
     it('keeps missing publishers advisory on pull requests', async () => {
       const { status, output } = await probeCrates([403, {}], {
         PREFLIGHT_MODE: 'report',
@@ -429,6 +574,7 @@ describe('scripts/preflight-credentials.sh', scriptOptions, () => {
       stub.routes[MINT] = INVALID_PUBLISHER;
       stub.routes[EXCHANGE] = [403, { message: 'forbidden' }];
       stub.routes[CRATES_MINT] = [401, { errors: [{ detail: 'bad token' }] }];
+      stub.routes[CRATES_PUBLISH] = TOKEN_REJECTED;
       const summary = path.join(workDir, 'summary.md');
       writeFileSync(summary, '');
 

package/tests/unit/scripts/trusted-publishing.test.js

@@ -7,8 +7,13 @@ import { readRepoText } from '../../helpers/repo.js';
 describe('trusted publishing configuration', () => {
   const rust = parse(readRepoText('.github/workflows/rust.yml'));
 
+  // Organization policy: trusted publishing (OIDC) first, the token secret
+  // only when OIDC is unavailable.
+  const FALLBACK =
+    '${{ steps.crates_auth.outputs.token || secrets.CARGO_REGISTRY_TOKEN || secrets.CARGO_TOKEN }}';
+
   for (const jobId of ['auto-release', 'manual-release']) {
-    it(`${jobId} uses a fresh OIDC token only when publishing`, () => {
+    it(`${jobId} publishes with a fresh OIDC token, falling back to the token secret`, () => {
       const job = rust.jobs[jobId];
       assert.equal(job.permissions['id-token'], 'write');
       const auth = job.steps.find((step) => step.id === 'crates_auth');
@@ -20,9 +25,11 @@ describe('trusted publishing configuration', () => {
       );
       assert.equal(auth.if, publish.if);
       assert.equal(
-        publish.env.CARGO_REGISTRY_TOKEN,
-        '${{ steps.crates_auth.outputs.token }}'
+        auth['continue-on-error'],
+        true,
+        'a trusted publishing failure must leave the token fallback reachable'
       );
+      assert.equal(publish.env.CARGO_REGISTRY_TOKEN, FALLBACK);
       assert.ok(job.steps.indexOf(auth) < job.steps.indexOf(publish));
       assert.ok(
         job.steps.indexOf(auth) >
@@ -31,13 +38,28 @@ describe('trusted publishing configuration', () => {
     });
   }
 
-  it('never reads the long-lived Cargo secret in the Rust workflow', () => {
-    assert.doesNotMatch(
-      readRepoText('.github/workflows/rust.yml'),
-      /secrets\.CARGO_TOKEN/
+  it('gives the release preflight the same token fallback', () => {
+    const probe = rust.jobs['release-preflight'].steps.find(
+      (step) => step.name === 'Probe crates.io trusted publishing'
+    );
+    assert.equal(
+      probe.env.CARGO_REGISTRY_TOKEN,
+      '${{ secrets.CARGO_REGISTRY_TOKEN || secrets.CARGO_TOKEN }}'
     );
   });
 
+  it('reads the Cargo secrets only as the trusted publishing fallback', () => {
+    const uses = readRepoText('.github/workflows/rust.yml')
+      .split('\n')
+      .filter((line) => /secrets\.CARGO_/.test(line))
+      .map((line) => line.trim());
+    assert.deepEqual(uses, [
+      'CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN || secrets.CARGO_TOKEN }}',
+      `CARGO_REGISTRY_TOKEN: ${FALLBACK}`,
+      `CARGO_REGISTRY_TOKEN: ${FALLBACK}`,
+    ]);
+  });
+
   it('keeps the registered PyPI identity identical across preflight and releases', () => {
     const python = parse(readRepoText('.github/workflows/python.yml'));
     for (const jobId of [

package/tests/unit/traces/issue-162-defaults.test.js

@@ -181,7 +181,7 @@ describe('complete recording defaults (issue #162)', { timeout: 15000 }, () => {
         },
       };
       const launched = await launchBrowserWithDependencies(
-        { debug: { output } },
+        { channel: 'chrome', debug: { output } },
         {
           resolveSystem: async () => '/usr/bin/google-chrome',
           settleMs: 0,

package/tests/unit/traces/issue-166-policy.test.js

@@ -244,7 +244,7 @@ describe('opt-in recording policy (issue #166)', { timeout: 15000 }, () => {
     await fixture(async ({ root }) => {
       await assert.rejects(
         launchBrowserWithDependencies(
-          { debug: { directory: root } },
+          { channel: 'chrome', debug: { directory: root } },
           {
             resolveSystem: async () => '/usr/bin/google-chrome',
             launchRealBrowser: async () => {

package/tests/unit/traces/issue-180-screenshots.test.js

@@ -0,0 +1,173 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { startTrace } from '../../../src/traces/recorder.js';
+import { TRACE_MODE } from '../../../src/traces/schema.js';
+import { screenshot } from '../../../src/capture/index.js';
+import {
+  createFakeCommander,
+  createFakePage,
+  useTempTraceDirectory,
+} from '../../helpers/trace-fixtures.js';
+
+/**
+ * A clipped engine screenshot of a headful window can leave Chrome's emulated
+ * size stuck after a resize (issue #180). Without a fixed viewport, captures
+ * go through CDP `Page.captureScreenshot` with no `clip`.
+ */
+function cdpFake({ viewport = null, failWith, engine = 'playwright' } = {}) {
+  const calls = { cdp: [], engine: [], detached: 0 };
+  const session = {
+    send: async (method, params) => {
+      calls.cdp.push({ method, params });
+      if (failWith) {
+        throw new Error(failWith);
+      }
+      return { data: Buffer.from('cdp-png').toString('base64') };
+    },
+    detach: async () => {
+      calls.detached += 1;
+    },
+  };
+  const page = createFakePage();
+  page.screenshot = async (options) => {
+    calls.engine.push(options);
+    return Buffer.from('engine-png');
+  };
+  if (engine === 'playwright') {
+    page.context = () => ({ newCDPSession: async () => session });
+    page.viewportSize = () => viewport;
+  } else {
+    page.createCDPSession = async () => session;
+    page.viewport = () => viewport;
+  }
+  return { page, calls };
+}
+
+describe('trace checkpoint screenshots (issue #180)', () => {
+  const directory = useTempTraceDirectory();
+
+  async function checkpointShot(page, { withCommander = true, engine } = {}) {
+    const commander = createFakeCommander(page, engine ? { engine } : {});
+    const trace = await startTrace({
+      page,
+      ...(withCommander ? { commander } : {}),
+      output: path.join(directory.path, 'run'),
+      mode: TRACE_MODE.CHECKPOINTS,
+      network: false,
+      links: false,
+      screenshots: true,
+    });
+    await trace.checkpoint('resized');
+    const stopped = await trace.stop();
+    return (
+      await fs.readFile(path.join(stopped.path, 'checkpoints/0001.png'))
+    ).toString();
+  }
+
+  for (const engine of ['playwright', 'puppeteer']) {
+    for (const withCommander of [true, false]) {
+      it(`${engine} ${withCommander ? 'commander' : 'bare page'} without a fixed viewport sends no clip`, async () => {
+        const { page, calls } = cdpFake({ engine });
+        assert.equal(
+          await checkpointShot(page, { withCommander, engine }),
+          'cdp-png'
+        );
+        assert.deepEqual(calls.cdp, [
+          {
+            method: 'Page.captureScreenshot',
+            params: {
+              format: 'png',
+              fromSurface: false,
+              captureBeyondViewport: false,
+            },
+          },
+        ]);
+        assert.equal(calls.engine.length, 0);
+        assert.equal(calls.detached, 1);
+      });
+    }
+  }
+
+  it('a fixed viewport keeps the engine screenshot', async () => {
+    const { page, calls } = cdpFake({
+      viewport: { width: 800, height: 600 },
+    });
+    assert.equal(await checkpointShot(page), 'engine-png');
+    assert.equal(calls.cdp.length, 0);
+    assert.deepEqual(calls.engine, [{ type: 'png' }]);
+  });
+
+  it('falls back to the engine screenshot when the view cannot be captured', async () => {
+    const { page, calls } = cdpFake({
+      failWith: 'Unable to capture screenshot',
+    });
+    assert.equal(await checkpointShot(page), 'engine-png');
+    assert.equal(calls.cdp.length, 1);
+    assert.equal(calls.detached, 1);
+  });
+
+  it('a page without CDP keeps the engine screenshot', async () => {
+    const page = createFakePage();
+    assert.equal(
+      await checkpointShot(page, { withCommander: false }),
+      'fake-png'
+    );
+  });
+});
+
+describe('default commander screenshots (issue #180)', () => {
+  for (const engine of ['playwright', 'puppeteer']) {
+    it(`${engine} without a fixed viewport sends no clip`, async () => {
+      const { page, calls } = cdpFake({ engine });
+      assert.equal((await screenshot({ page, engine })).toString(), 'cdp-png');
+      assert.equal(calls.cdp.length, 1);
+      assert.equal('clip' in calls.cdp[0].params, false);
+      assert.equal(calls.engine.length, 0);
+    });
+
+    it(`${engine} with a fixed viewport keeps the engine screenshot`, async () => {
+      const { page, calls } = cdpFake({
+        engine,
+        viewport: { width: 800, height: 600 },
+      });
+      assert.equal(
+        (await screenshot({ page, engine })).toString(),
+        'engine-png'
+      );
+      assert.equal(calls.cdp.length, 0);
+      assert.equal(calls.engine[0].fullPage, false);
+    });
+  }
+
+  it('JPEG quality reaches the view capture', async () => {
+    const { page, calls } = cdpFake();
+    await screenshot({ page, format: 'jpeg', quality: 60 });
+    assert.deepEqual(calls.cdp[0].params, {
+      format: 'jpeg',
+      fromSurface: false,
+      captureBeyondViewport: false,
+      quality: 60,
+    });
+  });
+
+  for (const options of [
+    { fullPage: true },
+    { clip: { x: 0, y: 0, width: 1, height: 1 } },
+    { selector: '#pager' },
+    { omitBackground: true },
+    { hideScrollbars: true },
+    { animations: 'disabled' },
+    { scale: 'css' },
+    { stableViewport: false },
+  ]) {
+    it(`${JSON.stringify(options)} keeps the engine screenshot`, async () => {
+      const { page, calls } = cdpFake();
+      page.locator = () => ({ first: () => page });
+      await screenshot({ page, ...options });
+      assert.equal(calls.cdp.length, 0);
+      assert.equal(calls.engine.length, 1);
+    });
+  }
+});