browser-commander 0.33.0 → 0.33.1

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.33.1
+
+### Patch Changes
+
+- d75bce4: Selenium drives Chrome for Testing with the ChromeDriver of its own release (issue #179): a `chromedriver` on `PATH` belongs to the installed Google Chrome and is skipped, Selenium Manager is asked with `--skip-driver-in-path`, and the real-browser launch and the hand-off reattach give ChromeDriver the browser that started. `defaultRestrictionsFor()` is exported.
+
+  `migrateFrom` re-encrypts passwords with the key of the browser that starts (issue #179): Chrome for Testing reads "Chromium Safe Storage", and with its default `mock-keychain` restriction (or `--password-store=basic` on Linux) Chromium's fixed mock password, so migrated passwords decrypt in it. macOS logins are written with the `v10` prefix Chromium uses there.
+
 ## 0.33.0
 
 ### Minor Changes

package/README.md

@@ -412,6 +412,10 @@ with.
 
 #### Chrome for Testing by default
 
+See [Chrome for Testing by default](../docs/chrome-for-testing.md) for the
+download each engine starts, its matching ChromeDriver and the Ubuntu sandbox
+note.
+
 Without `channel` or `executablePath`, a launch starts Chrome for Testing - the
 one Playwright or Puppeteer downloaded, or else another build in its download
 cache (`ms-playwright`, moved by `PLAYWRIGHT_BROWSERS_PATH`; `~/.cache/puppeteer`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "browser-commander",
-  "version": "0.33.0",
+  "version": "0.33.1",
   "description": "Universal browser automation library that supports Playwright, Puppeteer, and Selenium with a unified API",
   "main": "src/index.js",
   "bin": {

package/src/browser/browser-handoff.js

@@ -249,6 +249,10 @@ export async function reconnectBrowserWithDependencies(
       cdpEndpoint: descriptor.cdpEndpoint,
       targetId: descriptor.targetId,
       fallback: false,
+      // ChromeDriver must match the browser it reattaches to (issue #179).
+      ...(engine === 'selenium' && descriptor.executablePath
+        ? { executablePath: descriptor.executablePath }
+        : {}),
     });
   } catch (error) {
     throw new BrowserHandoffError(

package/src/browser/migration/firefox.js

@@ -218,7 +218,7 @@ export async function migrateFirefoxPasswords({
   targetProfileDir,
   platform,
   targetKey,
-  targetPrefix = platform === 'win32' ? 'v10' : 'v11',
+  targetPrefix = platform === 'linux' ? 'v11' : 'v10',
   primaryPassword = Buffer.alloc(0),
   domains,
 }) {

package/src/browser/migration/index.js

@@ -122,6 +122,7 @@ async function resolvePasswordKeys({
   keys,
   browser,
   targetBrowser,
+  targetKeystore,
   platform,
   sourceProfileDir,
   environment,
@@ -135,6 +136,7 @@ async function resolvePasswordKeys({
   const { key: targetKey, prefix: targetPrefix } = await resolveTargetKey({
     browser: targetBrowser,
     platform,
+    keystore: targetKeystore,
     environment,
   });
   const resolveSourceKey = isChromiumBrowser(browser)
@@ -159,6 +161,7 @@ async function resolvePasswordKeys({
  * @param {boolean} [options.includePaymentCards=false] - Separate explicit payment-card consent
  * @param {string} [options.platform=process.platform]
  * @param {string} [options.targetBrowser] - Launching browser channel (key derivation)
+ * @param {'mock'|'os'} [options.targetKeystore='os'] - 'mock' when the launch bypasses the OS keystore (`targetKeystoreFor`)
  * @param {Object} [options.keys] - Injected password keys {resolveSourceKey, targetKey, targetPrefix, primaryPassword}
  * @param {string} [options.homeDir]
  * @param {Object} [options.environment]
@@ -171,6 +174,7 @@ export async function migrateProfile({
   domains,
   platform = process.platform,
   targetBrowser,
+  targetKeystore,
   keys,
   homeDir = os.homedir(),
   environment = process.env,
@@ -272,6 +276,7 @@ export async function migrateProfile({
       keys,
       browser,
       targetBrowser,
+      targetKeystore,
       platform,
       sourceProfileDir,
       environment,
@@ -352,6 +357,7 @@ export async function migrateProfile({
       keys,
       browser,
       targetBrowser,
+      targetKeystore,
       platform,
       sourceProfileDir,
       environment,
@@ -377,6 +383,7 @@ async function migrateSafariProfile({
   selected,
   sourceProfileDir,
   targetBrowser,
+  targetKeystore,
   to,
 }) {
   const passwordKeys =
@@ -385,6 +392,7 @@ async function migrateSafariProfile({
           keys,
           browser,
           targetBrowser: targetBrowser ?? 'chrome',
+          targetKeystore,
           platform,
           sourceProfileDir,
           environment,
@@ -442,6 +450,7 @@ async function migratePasswordClass(
     platform,
     sourceProfileDir,
     targetBrowser,
+    targetKeystore,
     to,
   }
 ) {
@@ -464,6 +473,7 @@ async function migratePasswordClass(
     keys,
     browser,
     targetBrowser: targetBrowser ?? (isFirefox ? 'chrome' : browser),
+    targetKeystore,
     platform,
     sourceProfileDir,
     environment,

package/src/browser/migration/os-crypt-keys.js

@@ -73,12 +73,34 @@ export function createSourceKeyResolver({
   };
 }
 
+/**
+ * Which keystore a launch encrypts its new profile with: `'mock'` when the
+ * launch switches bypass the OS keystore (`--use-mock-keychain` on macOS, as
+ * Chrome for Testing gets by default, or `--password-store=basic` on Linux),
+ * `'os'` otherwise.
+ *
+ * @param {string[]} args - The browser command-line switches
+ * @param {string} platform
+ * @returns {'mock'|'os'}
+ */
+export function targetKeystoreFor(args, platform) {
+  const bypass =
+    platform === 'darwin' ? '--use-mock-keychain' : '--password-store=basic';
+  return platform !== 'win32' && args.includes(bypass) ? 'mock' : 'os';
+}
+
 /**
  * Resolve the target (launching) profile's encryption key on macOS/Linux.
  *
+ * macOS Chromium only knows the `v10` tag; Linux tags keyring keys `v11` and
+ * its fixed basic-store key `v10`. A `'mock'` keystore uses Chromium's fixed
+ * mock passwords: `mock_password` for the mock keychain, `peanuts` for the
+ * basic store.
+ *
  * @param {Object} options
  * @param {string} options.browser - Launching browser channel
  * @param {string} options.platform
+ * @param {'mock'|'os'} [options.keystore='os'] - See `targetKeystoreFor`
  * @param {Object} [options.environment]
  * @param {Function} [options.readSafeStoragePassword]
  * @returns {Promise<{key: Buffer, prefix: string}>}
@@ -86,16 +108,24 @@ export function createSourceKeyResolver({
 export async function resolveTargetKey({
   browser,
   platform,
+  keystore = 'os',
   environment = process.env,
   readSafeStoragePassword: readSafeStorage = readSafeStoragePassword,
 }) {
-  if (platform === 'darwin' || platform === 'linux') {
-    const password = await readSafeStorage({ browser, platform, environment });
-    return { key: deriveChromiumCookieKey(password, platform), prefix: 'v11' };
+  if (platform !== 'darwin' && platform !== 'linux') {
+    throw new Error(
+      `resolveTargetKey does not derive a Windows key; use createWindowsProfileKey`
+    );
   }
-  throw new Error(
-    `resolveTargetKey does not derive a Windows key; use createWindowsProfileKey`
-  );
+  if (keystore === 'mock') {
+    const password = platform === 'darwin' ? 'mock_password' : 'peanuts';
+    return { key: deriveChromiumCookieKey(password, platform), prefix: 'v10' };
+  }
+  const password = await readSafeStorage({ browser, platform, environment });
+  return {
+    key: deriveChromiumCookieKey(password, platform),
+    prefix: platform === 'darwin' ? 'v10' : 'v11',
+  };
 }
 
 /** Convenience: the Local State path next to a profile directory. */

package/src/browser/migration/passwords.js

@@ -108,7 +108,7 @@ export async function migratePasswords({
   platform = process.platform,
   resolveSourceKey,
   targetKey,
-  targetPrefix = platform === 'win32' ? 'v10' : 'v11',
+  targetPrefix = platform === 'linux' ? 'v11' : 'v10',
   domains,
 }) {
   const sourcePath = path.join(sourceProfileDir, 'Login Data');

package/src/browser/real-browser.js

@@ -23,6 +23,7 @@ import {
 } from './attach/snapshot-launch.js';
 import { connectBrowser } from './connector.js';
 import { migrateProfile } from './migration/index.js';
+import { targetKeystoreFor } from './migration/os-crypt-keys.js';
 import {
   assertFixedDebuggingPort,
   classifyDevToolsOwnership,
@@ -50,6 +51,7 @@ import {
 } from './system-browser.js';
 import {
   defaultRestrictionsFor,
+  isChromeForTesting,
   resolveLaunchExecutable,
 } from './launch-executable.js';
 
@@ -372,10 +374,12 @@ function createCloser({
 
 /**
  * Selenium attaches through a chromedriver the launch starts; the driver
- * follows the browser's interruption ownership (issue #174).
+ * follows the browser's interruption ownership (issue #174) and must match
+ * the browser just started, not the installed Chrome Selenium Manager would
+ * otherwise pick (issue #179).
  */
-function driverInterruption(engine, interruption) {
-  return engine === 'selenium' ? { interruption } : {};
+function driverOptions(engine, { interruption, executablePath }) {
+  return engine === 'selenium' ? { interruption, executablePath } : {};
 }
 
 /**
@@ -602,6 +606,9 @@ async function runPreLaunchMigration({
   migrateFrom,
   userDataDir,
   channel,
+  executablePath,
+  argOptions,
+  platform,
   temporaryProfile,
   migrate,
 }) {
@@ -610,6 +617,14 @@ async function runPreLaunchMigration({
   }
   const { include, domains, passwordCsv, includePaymentCards, ...from } =
     migrateFrom;
+  // Passwords are re-encrypted with the key of the browser that starts:
+  // Chrome for Testing keeps "Chromium Safe Storage", and its default mock
+  // keychain uses Chromium's fixed mock password (issue #179).
+  const launchArgs = [
+    ...resolveRestrictions(argOptions.restrictions).args,
+    ...argOptions.args,
+    ...argOptions.extraArgs,
+  ];
   try {
     const report = await migrate({
       from,
@@ -618,7 +633,8 @@ async function runPreLaunchMigration({
       domains,
       passwordCsv,
       includePaymentCards,
-      targetBrowser: channel,
+      targetBrowser: isChromeForTesting(executablePath) ? 'chromium' : channel,
+      targetKeystore: targetKeystoreFor(launchArgs, platform),
     });
     const { cookies, ...migration } = report;
     return { migration, migratedCookies: cookies ?? [] };
@@ -753,6 +769,9 @@ export async function launchAndConnectRealBrowserWithDependencies(
     migrateFrom,
     userDataDir,
     channel,
+    executablePath,
+    argOptions,
+    platform: dependencies.platform ?? process.platform,
     temporaryProfile,
     migrate: dependencies.migrateProfile ?? migrateProfile,
   });
@@ -806,7 +825,7 @@ export async function launchAndConnectRealBrowserWithDependencies(
       engine,
       cdpEndpoint: resolvedCdpEndpoint,
       ...connectionOptions,
-      ...driverInterruption(engine, interruption),
+      ...driverOptions(engine, { interruption, executablePath }),
       seedCookies,
       verbose,
     });

package/src/browser/webdriver.js

@@ -42,7 +42,10 @@ import {
 } from './profile-directory.js';
 import { buildRealBrowserArgs } from './real-browser.js';
 import { resolveRestrictions } from './restrictions.js';
-import { defaultRestrictionsFor } from './launch-executable.js';
+import {
+  defaultRestrictionsFor,
+  isChromeForTesting,
+} from './launch-executable.js';
 import { findBrowserSource } from './browser-sources.js';
 import {
   isSafariChannel,
@@ -219,7 +222,12 @@ export async function resolveWebDriverExecutable({
     };
   }
 
-  const onPath = await findOnPath(name, { environment, platform, checkAccess });
+  // A driver on PATH belongs to an installed browser; Chrome for Testing gets
+  // the driver of its own release from Selenium Manager (issue #179).
+  const ownDriver = isChromeForTesting(executablePath);
+  const onPath =
+    !ownDriver &&
+    (await findOnPath(name, { environment, platform, checkAccess }));
   if (onPath) {
     return {
       driverPath: onPath,
@@ -228,11 +236,39 @@ export async function resolveWebDriverExecutable({
     };
   }
 
+  return await askSeleniumManager({
+    browser,
+    name,
+    executablePath,
+    ownDriver,
+    environment,
+    platform,
+    runCommand,
+    managerPath,
+  });
+}
+
+/** Ask Selenium Manager for the driver of `browser` (and the browser itself). */
+async function askSeleniumManager({
+  browser,
+  name,
+  executablePath,
+  ownDriver,
+  environment,
+  platform,
+  runCommand,
+  managerPath,
+}) {
   const manager = managerPath ?? seleniumManagerPath({ platform, environment });
-  const args = ['--browser', browser, '--output', 'json'];
-  if (executablePath) {
-    args.push('--browser-path', executablePath);
-  }
+  const args = [
+    '--browser',
+    browser,
+    '--output',
+    'json',
+    ...(executablePath ? ['--browser-path', executablePath] : []),
+    // Selenium Manager itself prefers a driver on PATH, whatever its release.
+    ...(ownDriver ? ['--skip-driver-in-path'] : []),
+  ];
   const { stdout, code } = await runCommand(manager, args, { check: false });
   let output;
   try {

package/src/exports.js

@@ -106,6 +106,7 @@ export {
 } from './browser/launcher.js';
 export {
   CHROME_FOR_TESTING_RESTRICTIONS,
+  defaultRestrictionsFor,
   isChromeForTesting,
 } from './browser/launch-executable.js';
 export {

package/tests/e2e/chrome-for-testing.e2e.test.js

@@ -0,0 +1,105 @@
+/**
+ * Issue #179: without a channel or executablePath every engine starts Chrome
+ * for Testing, hides its "only for automated testing" infobar and keeps it
+ * away from the user's keychain.
+ */
+// feature-parity: launch.chrome-for-testing@native-typed
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+
+import { isChromeForTesting } from '../../src/browser/launch-executable.js';
+import { launchBrowser } from '../../src/browser/launcher.js';
+import { readBrowserVersionPage } from '../../src/browser/parity.js';
+import { SANDBOX_ARGS } from '../helpers/e2e-browser.js';
+
+function skipReason() {
+  if (!process.env.RUN_E2E) {
+    return 'set RUN_E2E=true';
+  }
+  if (process.platform === 'linux' && !process.env.DISPLAY) {
+    return 'the infobar is only drawn in a window; run under xvfb-run';
+  }
+  return false;
+}
+
+/** What chrome://version reports about the browser a session started. */
+async function versionPage(engine, session) {
+  if (engine !== 'selenium') {
+    return await readBrowserVersionPage(session.page);
+  }
+  await session.browser.get('chrome://version');
+  return await session.browser.executeScript(`
+    const text = (id) => (document.getElementById(id)?.textContent ?? '').trim();
+    return { commandLine: text('command_line'), executablePath: text('executable_path') };
+  `);
+}
+
+/** Height of the browser UI above the page: tab strip, toolbar, infobars. */
+async function frameHeight(session) {
+  await session.page.goto('data:text/html,<title>frame</title>');
+  // The infobar appears just after the first window is shown.
+  await new Promise((resolve) => setTimeout(resolve, 1500));
+  return await session.page.evaluate(
+    () => globalThis.outerHeight - globalThis.innerHeight
+  );
+}
+
+describe(
+  'Chrome for Testing by default (issue #179)',
+  { skip: skipReason(), timeout: 180000 },
+  () => {
+    for (const engine of ['playwright', 'puppeteer', 'selenium']) {
+      it(`${engine} starts Chrome for Testing without its infobar or keychain`, async () => {
+        const session = await launchBrowser({
+          engine,
+          headless: false,
+          args: SANDBOX_ARGS,
+        });
+        try {
+          const { commandLine, executablePath } = await versionPage(
+            engine,
+            session
+          );
+          assert.equal(
+            isChromeForTesting(executablePath),
+            true,
+            executablePath
+          );
+          assert.deepEqual(session.defaultRestrictions, [
+            'no-chrome-for-testing-infobar',
+            'mock-keychain',
+          ]);
+          assert.match(commandLine, /--test-type=gpu(\s|$)/u);
+          assert.match(commandLine, /--use-mock-keychain(\s|$)/u);
+        } finally {
+          await session.close();
+        }
+      });
+    }
+
+    it('the default restrictions remove the infobar the opt-out shows', async () => {
+      const heights = {};
+      for (const [name, defaultRestrictions] of [
+        ['defaults', undefined],
+        ['opt-out', []],
+      ]) {
+        const session = await launchBrowser({
+          engine: 'playwright',
+          headless: false,
+          args: SANDBOX_ARGS,
+          ...(defaultRestrictions ? { defaultRestrictions } : {}),
+        });
+        try {
+          heights[name] = await frameHeight(session);
+        } finally {
+          await session.close();
+        }
+      }
+      // The infobar is about 40px tall; nothing else differs between the two.
+      assert.ok(
+        heights['opt-out'] - heights.defaults >= 20,
+        JSON.stringify(heights)
+      );
+    });
+  }
+);

package/tests/unit/browser/browser-handoff.test.js

@@ -109,6 +109,19 @@ describe('browser hand-off (issue #174)', () => {
     assert.deepEqual(await session.handoff(), handoffFor(endpoint));
   });
 
+  it('reattaches Selenium with the driver of the handed-off browser (issue #179)', async () => {
+    const endpoint = await fakeEndpoint();
+    const cft =
+      '/home/u/.cache/ms-playwright/chromium-1243/chrome-linux64/chrome';
+    const calls = [];
+    await reconnectBrowserWithDependencies(
+      handoffFor(endpoint, { executablePath: cft }),
+      {},
+      { connect: fakeConnect(calls) }
+    );
+    assert.equal(calls[0][1].executablePath, cft);
+  });
+
   it('reads a hand-off from a JSON file', async () => {
     const endpoint = await fakeEndpoint();
     const directory = await mkdtemp(path.join(os.tmpdir(), 'bc-handoff-'));

package/tests/unit/browser/launch-executable.test.js

@@ -89,5 +89,6 @@ describe('defaultRestrictionsFor (issue #179)', () => {
       'mock-keychain',
     ]);
     assert.equal(api.isChromeForTesting, isChromeForTesting);
+    assert.equal(api.defaultRestrictionsFor, defaultRestrictionsFor);
   });
 });

package/tests/unit/browser/migration/os-crypt-keys.test.js

@@ -6,6 +6,7 @@ import {
   createSourceKeyResolver,
   localStatePathForProfile,
   resolveTargetKey,
+  targetKeystoreFor,
 } from '../../../../src/browser/migration/os-crypt-keys.js';
 import { deriveChromiumCookieKey } from '../../../../src/browser/browser-cookie-crypto.js';
 
@@ -77,6 +78,45 @@ describe('resolveTargetKey', () => {
     assert.equal(result.prefix, 'v11');
   });
 
+  it('tags macOS keys v10, the only tag macOS Chromium reads', async () => {
+    const result = await resolveTargetKey({
+      browser: 'chromium',
+      platform: 'darwin',
+      readSafeStoragePassword: async () => 'target-pass',
+    });
+    assert.deepEqual(
+      result.key,
+      deriveChromiumCookieKey('target-pass', 'darwin')
+    );
+    assert.equal(result.prefix, 'v10');
+  });
+
+  it("uses Chromium's fixed mock passwords for a mock keystore (issue #179)", async () => {
+    const unreadable = async () => {
+      throw new Error('the OS keystore must not be asked');
+    };
+    const mac = await resolveTargetKey({
+      browser: 'chromium',
+      platform: 'darwin',
+      keystore: 'mock',
+      readSafeStoragePassword: unreadable,
+    });
+    assert.deepEqual(mac, {
+      key: deriveChromiumCookieKey('mock_password', 'darwin'),
+      prefix: 'v10',
+    });
+    const linux = await resolveTargetKey({
+      browser: 'chrome',
+      platform: 'linux',
+      keystore: 'mock',
+      readSafeStoragePassword: unreadable,
+    });
+    assert.deepEqual(linux, {
+      key: deriveChromiumCookieKey('peanuts', 'linux'),
+      prefix: 'v10',
+    });
+  });
+
   it('refuses to derive a Windows key', async () => {
     await assert.rejects(
       resolveTargetKey({ browser: 'chrome', platform: 'win32' }),
@@ -85,6 +125,23 @@ describe('resolveTargetKey', () => {
   });
 });
 
+describe('targetKeystoreFor (issue #179)', () => {
+  it('reports the switches that bypass the OS keystore', () => {
+    assert.equal(targetKeystoreFor(['--use-mock-keychain'], 'darwin'), 'mock');
+    assert.equal(
+      targetKeystoreFor(['--password-store=basic'], 'linux'),
+      'mock'
+    );
+    assert.equal(targetKeystoreFor(['--use-mock-keychain'], 'linux'), 'os');
+    assert.equal(
+      targetKeystoreFor(['--password-store=gnome-libsecret'], 'linux'),
+      'os'
+    );
+    assert.equal(targetKeystoreFor([], 'darwin'), 'os');
+    assert.equal(targetKeystoreFor(['--use-mock-keychain'], 'win32'), 'os');
+  });
+});
+
 describe('localStatePathForProfile', () => {
   it('points at Local State next to the profile directory', () => {
     assert.equal(

package/tests/unit/browser/migration/safari-data.test.js

@@ -24,6 +24,24 @@ const fixture = (name) =>
     )
   );
 
+function migratedPasswords(profile) {
+  const db = new Database(path.join(profile, 'Login Data'));
+  try {
+    return db.prepare('SELECT origin_url,password_value FROM logins').all();
+  } finally {
+    db.close();
+  }
+}
+
+const decryptPassword = (row, key, platform) =>
+  decryptChromiumCookie({
+    encryptedValue: row.password_value,
+    key,
+    platform,
+    databaseVersion: 0,
+    host: 'github.com',
+  });
+
 describe('Safari data sources', () => {
   for (const format of ['binary', 'xml']) {
     it(`preserves hierarchy and reading list from ${format} plist`, async () => {
@@ -103,25 +121,31 @@ describe('Safari data sources', () => {
         ({ reason }) => reason === 'safari-reading-list-translated'
       )
     );
-    const db = new Database(path.join(target, 'Login Data'));
-    try {
-      const rows = db
-        .prepare('SELECT origin_url,password_value FROM logins')
-        .all();
-      assert.equal(rows.length, 1);
-      assert.equal(
-        decryptChromiumCookie({
-          encryptedValue: rows[0].password_value,
-          key,
-          platform: 'linux',
-          databaseVersion: 0,
-          host: 'github.com',
-        }),
-        'p"a\nss'
-      );
-    } finally {
-      db.close();
-    }
+    const rows = migratedPasswords(target);
+    assert.equal(rows.length, 1);
+    assert.equal(decryptPassword(rows[0], key, 'linux'), 'p"a\nss');
+  });
+
+  it('encrypts migrated passwords with the mock keychain key of a Chrome for Testing launch (issue #179)', async () => {
+    const source = await temporary();
+    const target = await temporary();
+    // No keys are injected and the OS keystore is never asked: Chromium's
+    // --use-mock-keychain derives its key from the fixed "mock_password".
+    const report = await migrateProfile({
+      from: { browser: 'safari', userDataDir: source },
+      to: target,
+      include: ['passwords'],
+      domains: ['github.com'],
+      passwordCsv: fixture('Passwords.csv'),
+      platform: 'darwin',
+      targetBrowser: 'chromium',
+      targetKeystore: 'mock',
+    });
+    assert.equal(report.migrated.passwords, 1);
+    const [row] = migratedPasswords(target);
+    assert.equal(row.password_value.subarray(0, 3).toString(), 'v10');
+    const key = deriveChromiumCookieKey('mock_password', 'darwin');
+    assert.equal(decryptPassword(row, key, 'darwin'), 'p"a\nss');
   });
 
   it('names the executing app and retry link for non-cookie protection failures', async () => {

package/tests/unit/browser/real-browser.test.js

@@ -282,6 +282,28 @@ describe('launchAndConnectRealBrowser', () => {
     await access(path.join(temporaryDirectory, 'First Run'));
   });
 
+  it('gives Selenium the started browser so its driver matches it (issue #179)', async () => {
+    temporaryDirectory = await makeDedicatedProfile();
+    const cft =
+      '/home/u/.cache/ms-playwright/chromium-1243/chrome-linux64/chrome';
+    let connectOptions;
+    await launchAndConnectRealBrowserWithDependencies(
+      { engine: 'selenium', userDataDir: temporaryDirectory },
+      {
+        resolveExecutable: async () => cft,
+        reservePort: async () => 9444,
+        spawnBrowser: () => fakeProcess([]),
+        waitForEndpoint: async () => 'http://127.0.0.1:9444',
+        connect: async (options) => {
+          connectOptions = options;
+          return { browser: null, page: null };
+        },
+      }
+    );
+    assert.equal(connectOptions.engine, 'selenium');
+    assert.equal(connectOptions.executablePath, cft);
+  });
+
   it('migrates a profile before launch and seeds the migrated cookies', async () => {
     temporaryDirectory = await makeDedicatedProfile();
     const calls = [];
@@ -568,6 +590,57 @@ describe('launchAndConnectRealBrowser', () => {
     ]);
   });
 
+  it('migrates passwords with the key of the browser that starts (issue #179)', async () => {
+    const cft =
+      '/Users/u/Library/Caches/ms-playwright/chromium-1248/chrome-mac-arm64/Google Chrome for Testing.app/Contents/MacOS/Google Chrome for Testing';
+    const migrateTarget = async (executablePath, options = {}) => {
+      let migrateOptions;
+      const result = await launchAndConnectRealBrowserWithDependencies(
+        {
+          closeTimeout: 50,
+          migrateFrom: { browser: 'chrome', include: ['passwords'] },
+          ...options,
+        },
+        {
+          platform: 'darwin',
+          resolveExecutable: async () => executablePath,
+          reservePort: async () => 40007,
+          spawnBrowser: () => fakeProcess([]),
+          waitForEndpoint: async () => 'http://127.0.0.1:40007',
+          connect: async () => ({ browser: null, page: null }),
+          migrateProfile: async (migration) => {
+            migrateOptions = migration;
+            return { migrated: {}, skipped: [], warnings: [], cookies: [] };
+          },
+        }
+      );
+      await result.close();
+      const { targetBrowser, targetKeystore } = migrateOptions;
+      return { targetBrowser, targetKeystore };
+    };
+
+    // Chrome for Testing keeps "Chromium Safe Storage", and its default
+    // mock keychain encrypts with Chromium's fixed mock password.
+    assert.deepEqual(await migrateTarget(cft), {
+      targetBrowser: 'chromium',
+      targetKeystore: 'mock',
+    });
+    assert.deepEqual(await migrateTarget(cft, { defaultRestrictions: [] }), {
+      targetBrowser: 'chromium',
+      targetKeystore: 'os',
+    });
+    assert.deepEqual(await migrateTarget('/opt/google/chrome'), {
+      targetBrowser: 'chrome',
+      targetKeystore: 'os',
+    });
+    assert.deepEqual(
+      await migrateTarget('/opt/google/chrome', {
+        restrictions: ['mock-keychain'],
+      }),
+      { targetBrowser: 'chrome', targetKeystore: 'mock' }
+    );
+  });
+
   it('terminates the spawned browser when connection fails', async () => {
     temporaryDirectory = await makeDedicatedProfile();
     let killed = false;

package/tests/unit/browser/webdriver.test.js

@@ -166,6 +166,31 @@ function launchDependencies(overrides = {}) {
   };
 }
 
+// Resolve through a fake Selenium Manager that answers browserPath.
+async function managerResolve(
+  options,
+  { checkAccess = accessOnly(), browserPath }
+) {
+  const commands = [];
+  const resolved = await resolveWebDriverExecutable({
+    managerPath: '/sm',
+    checkAccess,
+    runCommand: async (file, args) => {
+      commands.push([file, ...args]);
+      return managerOutput({
+        driver_path: '/cache/chromedriver',
+        browser_path: browserPath,
+      });
+    },
+    ...options,
+  });
+  return { commands, resolved };
+}
+
+const SELENIUM_CFT = '/home/u/.cache/selenium/chrome/linux64/156.0/chrome';
+const PLAYWRIGHT_CFT =
+  '/home/u/.cache/ms-playwright/chromium-1243/chrome-linux64/chrome';
+
 describe('resolveWebDriverExecutable', () => {
   it('uses an explicit driverPath first', async () => {
     const resolved = await resolveWebDriverExecutable({
@@ -210,21 +235,38 @@ describe('resolveWebDriverExecutable', () => {
     assert.equal(resolved.driverPath, 'C:\\b\\chromedriver.exe');
   });
 
-  it('then asks Selenium Manager for a matching driver', async () => {
-    const commands = [];
-    const resolved = await resolveWebDriverExecutable({
-      executablePath: '/usr/bin/google-chrome',
-      environment: { PATH: '' },
-      managerPath: '/sm',
-      checkAccess: accessOnly(),
-      runCommand: async (file, args) => {
-        commands.push([file, ...args]);
-        return managerOutput({
-          driver_path: '/cache/chromedriver',
-          browser_path: '/usr/bin/google-chrome',
-        });
-      },
+  // A chromedriver on PATH drives the installed Google Chrome: never used
+  // for Chrome for Testing (issue #179). Selenium Manager returns a PATH
+  // driver of another release too, so it is told to skip it (run
+  // 39651456089: ChromeDriver 155 for Chrome 153).
+  for (const cft of [PLAYWRIGHT_CFT, SELENIUM_CFT]) {
+    it(`matches ${cft} with its own driver, not the one on PATH (issue #179)`, async () => {
+      const { commands, resolved } = await managerResolve(
+        { executablePath: cft, environment: { PATH: '/bin' } },
+        { checkAccess: accessOnly('/bin/chromedriver'), browserPath: cft }
+      );
+      assert.deepEqual(commands, [
+        [
+          '/sm',
+          '--browser',
+          'chrome',
+          '--output',
+          'json',
+          '--browser-path',
+          cft,
+          '--skip-driver-in-path',
+        ],
+      ]);
+      assert.equal(resolved.driverPath, '/cache/chromedriver');
+      assert.equal(resolved.source, 'selenium-manager');
     });
+  }
+
+  it('then asks Selenium Manager for a matching driver', async () => {
+    const { commands, resolved } = await managerResolve(
+      { executablePath: '/usr/bin/google-chrome', environment: { PATH: '' } },
+      { browserPath: '/usr/bin/google-chrome' }
+    );
     assert.deepEqual(commands, [
       [
         '/sm',

package/tests/unit/scripts/check-web-archive.test.js

@@ -16,6 +16,7 @@ import {
   classifyStatus,
   extractRejectedLinks,
   judge,
+  ownRepositoryPath,
 } from '../../../../scripts/check-web-archive.mjs';
 
 // Verbatim shape of lychee/out.md from run 33959793880.
@@ -131,8 +132,8 @@ const waybackHas = (timestamp, archiveUrl) => async () => ({
   timestamp,
 });
 
-const verdictFor = (link, recheckImpl, waybackImpl) =>
-  judge(link, { recheckImpl, waybackImpl });
+const verdictFor = (link, recheckImpl, waybackImpl, extra = {}) =>
+  judge(link, { recheckImpl, waybackImpl, ...extra });
 
 describe('judging one rejected link', () => {
   const playwright = {
@@ -151,6 +152,14 @@ describe('judging one rejected link', () => {
     assert.equal(verdict.verdict, 'transient');
   });
 
+  it('does not fail for a host that answered 5xx and then timed out', async () => {
+    // chromium.googlesource.com answered 503 to lychee and then let the
+    // re-check time out: neither said the link is gone, and a host that
+    // answered at all still resolves.
+    const verdict = await verdictFor(playwright, unreachable(), waybackNever());
+    assert.equal(verdict.verdict, 'transient');
+  });
+
   it('does not fail for a host that keeps rate-limiting the runner', async () => {
     const verdict = await verdictFor(
       { url: 'https://example.com/x', status: '429' },
@@ -189,3 +198,69 @@ describe('judging one rejected link', () => {
     assert.equal(verdict.verdict, 'gone');
   });
 });
+
+describe('a link to a file this branch adds', () => {
+  // Run 39651456194: the READMEs link the new docs/chrome-for-testing.md on
+  // main, which is published to npm, PyPI and crates.io, so it must be an
+  // absolute URL. Until the pull request merges, main has no such file.
+  const repository = 'link-foundation/browser-commander';
+  const newDoc = {
+    url: 'https://github.com/link-foundation/browser-commander/blob/main/docs/chrome-for-testing.md',
+    status: '404',
+  };
+  const checkout = (...files) => ({
+    repository,
+    fileExists: (relative) => files.includes(relative),
+  });
+
+  it('maps this repository’s main-branch links to checkout paths', () => {
+    assert.equal(
+      ownRepositoryPath(`${newDoc.url}#verifying-it`, repository),
+      'docs/chrome-for-testing.md'
+    );
+    assert.equal(
+      ownRepositoryPath(
+        'https://github.com/link-foundation/browser-commander/tree/main/docs/case%20studies',
+        repository
+      ),
+      'docs/case studies'
+    );
+    assert.equal(
+      ownRepositoryPath(
+        'https://github.com/link-foundation/browser-commander/blob/v1/x.md',
+        repository
+      ),
+      null
+    );
+    assert.equal(
+      ownRepositoryPath(
+        'https://github.com/other/repo/blob/main/x.md',
+        repository
+      ),
+      null
+    );
+    assert.equal(ownRepositoryPath(newDoc.url, undefined), null);
+  });
+
+  it('does not fail when the checkout has the file main is about to get', async () => {
+    const verdict = await verdictFor(
+      newDoc,
+      () => {
+        throw new Error('a file in the checkout needs no network request');
+      },
+      waybackNever(),
+      checkout('docs/chrome-for-testing.md')
+    );
+    assert.equal(verdict.verdict, 'unmerged');
+  });
+
+  it('still fails when the checkout does not have the file either', async () => {
+    const verdict = await verdictFor(
+      newDoc,
+      answers(404),
+      waybackNothing(),
+      checkout('docs/feature-parity.md')
+    );
+    assert.equal(verdict.verdict, 'gone');
+  });
+});