browser4-cli 4.14.0-rc.5 → 4.14.0-rc.7

package/scripts/reconcile-release-assets.sh

@@ -0,0 +1,293 @@
+#!/bin/bash
+# ---------------------------------------------------------------------------
+# reconcile-release-assets.sh -- make a GitHub release carry exactly the
+# assets the build produced, retrying GitHub's transient upload failures
+# ---------------------------------------------------------------------------
+# Usage:
+#   reconcile-release-assets.sh --tag <tag> [--repo <owner/name>] \
+#       [--timeout <seconds>] [--interval <seconds>] [--settle <seconds>] \
+#       <file>...
+#   reconcile-release-assets.sh --tag <tag> [options] --files-from <path>
+#
+# Defaults: timeout 600 s, interval 30 s, settle 5 s.
+#
+# GitHub's release upload endpoint answers with a transient 5xx a few times a
+# month: "Error creating asset temp dir", "Error saving asset", "Unicorn!".
+# v4.14.0-rc.6 (release.yml run 35265014949) failed exactly this way -- the
+# "Publish GitHub release" job uploaded 6 of 11 assets and then died on
+#   ##[error]Error creating asset temp dir
+# which skipped the artifact attestation, the release verification and the
+# OSS sync: the whole release pipeline was lost to a server-side blip, with a
+# half-populated GitHub release left behind.
+#
+# GitHub does not say which upload failed, and a failed upload can leave a
+# partial asset behind, so re-running the whole upload is both slow and not
+# obviously correct. This script instead treats the release as the source of
+# truth and converges on it:
+#
+#   1. list the assets the release already carries (name and size),
+#   2. upload every local file that is missing or whose size differs, using
+#      `gh release upload --clobber` (which also replaces a partial asset),
+#   3. re-check, and repeat until the release matches the local files or the
+#      time budget runs out.
+#
+# It is idempotent: a release that already matches its files costs one API
+# call and no upload. Assets are matched by file name, which is the name the
+# publishing action uses for them. A release that does not exist is reported
+# as a failure rather than recreated here -- that is the release-creation
+# path, which the publishing action creates (and retries) with the workflow's
+# metadata.
+#
+# Exit codes:
+#   0  the release carries every given file with the local byte size
+#   1  still missing/mismatched when the budget expired, the release does not
+#      exist, a given file does not exist, or bad usage
+#
+# Designed for CI (GitHub Actions) but also runs on developer machines.
+# Requires `gh`, authenticated via GH_TOKEN/GITHUB_TOKEN or `gh auth login`.
+# ---------------------------------------------------------------------------
+set -euo pipefail
+
+TAG=''
+REPO=''
+TIMEOUT_SECONDS=600
+POLL_INTERVAL_SECONDS=30
+SETTLE_SECONDS=5
+FILES_FROM=''
+FILES=()
+
+usage() {
+    local code="${1:-1}"
+    {
+        echo "Usage: $0 --tag <tag> [--repo <owner/name>] [--timeout <seconds>]"
+        echo "          [--interval <seconds>] [--settle <seconds>]"
+        echo "          [--files-from <path>] <file>..."
+    } >&2
+    exit "$code"
+}
+
+while [ $# -gt 0 ]; do
+    case "${1:-}" in
+        --tag)
+            TAG="${2:-}"
+            shift 2 || usage
+            ;;
+        --repo)
+            REPO="${2:-}"
+            shift 2 || usage
+            ;;
+        --timeout)
+            TIMEOUT_SECONDS="${2:-}"
+            shift 2 || usage
+            ;;
+        --interval)
+            POLL_INTERVAL_SECONDS="${2:-}"
+            shift 2 || usage
+            ;;
+        --settle)
+            SETTLE_SECONDS="${2:-}"
+            shift 2 || usage
+            ;;
+        --files-from)
+            FILES_FROM="${2:-}"
+            shift 2 || usage
+            ;;
+        -h|--help)
+            usage 0
+            ;;
+        --)
+            shift
+            while [ $# -gt 0 ]; do
+                FILES+=("$1")
+                shift
+            done
+            ;;
+        -*)
+            echo "ERROR: unknown option '$1'" >&2
+            usage
+            ;;
+        *)
+            FILES+=("$1")
+            shift
+            ;;
+    esac
+done
+
+[ -n "$TAG" ] || { echo "ERROR: --tag is required" >&2; usage; }
+case "$TIMEOUT_SECONDS" in ''|*[!0-9]*) echo "ERROR: --timeout must be a whole number of seconds" >&2; usage ;; esac
+case "$POLL_INTERVAL_SECONDS" in ''|*[!0-9]*) echo "ERROR: --interval must be a whole number of seconds" >&2; usage ;; esac
+case "$SETTLE_SECONDS" in ''|*[!0-9]*) echo "ERROR: --settle must be a whole number of seconds" >&2; usage ;; esac
+[ "$POLL_INTERVAL_SECONDS" -gt 0 ] || { echo "ERROR: --interval must be at least 1 s" >&2; usage; }
+
+if [ -n "$FILES_FROM" ]; then
+    if [ ! -f "$FILES_FROM" ]; then
+        echo "ERROR: --files-from '$FILES_FROM' does not exist" >&2
+        exit 1
+    fi
+    # Newline-separated paths: the shape the publishing action's `files` input
+    # and this repository's release asset manifest already use.
+    while IFS= read -r manifest_line || [ -n "$manifest_line" ]; do
+        manifest_line="${manifest_line%$'\r'}"
+        [ -n "$manifest_line" ] || continue
+        FILES+=("$manifest_line")
+    done < "$FILES_FROM"
+fi
+
+if [ "${#FILES[@]}" -eq 0 ]; then
+    echo "ERROR: no asset files given" >&2
+    usage
+fi
+
+for f in "${FILES[@]}"; do
+    if [ -z "$f" ]; then
+        echo "ERROR: empty asset file argument (is the asset list a real path list?)" >&2
+        exit 1
+    fi
+    if [ ! -f "$f" ]; then
+        echo "ERROR: asset file '$f' does not exist" >&2
+        exit 1
+    fi
+done
+
+if ! command -v gh >/dev/null 2>&1; then
+    echo "ERROR: gh is not installed -- https://cli.github.com" >&2
+    exit 1
+fi
+
+STDERR_FILE="$(mktemp)"
+trap 'rm -f "$STDERR_FILE"' EXIT
+
+# --repo is appended to the subcommand (gh declares it per command), so the two
+# call sites below branch instead of building an argument array that `set -u`
+# and old bash versions disagree about while it is empty.
+list_release_assets() {
+    if [ -n "$REPO" ]; then
+        gh release view "$TAG" --repo "$REPO" --json assets --jq '.assets[] | "\(.name) \(.size)"'
+    else
+        gh release view "$TAG" --json assets --jq '.assets[] | "\(.name) \(.size)"'
+    fi
+}
+
+upload_assets() {
+    if [ -n "$REPO" ]; then
+        gh release upload "$TAG" "$@" --repo "$REPO" --clobber
+    else
+        gh release upload "$TAG" "$@" --clobber
+    fi
+}
+
+local_size_of() {
+    wc -c < "$1" | tr -d '[:space:]'
+}
+
+# remote_size_of <name> -- size the release reports for <name>; returns 1 when
+# the release does not carry that asset. Asset names may contain spaces, so the
+# size is read as the last field of "name size".
+remote_size_of() {
+    local wanted="$1" line name size
+    while IFS= read -r line; do
+        [ -n "$line" ] || continue
+        name="${line% *}"
+        size="${line##* }"
+        if [ "$name" = "$wanted" ]; then
+            printf '%s' "$size"
+            return 0
+        fi
+    done <<< "$remote_listing"
+    return 1
+}
+
+started=$SECONDS
+attempt=0
+remote_listing=''
+gh_error=''
+
+while :; do
+    attempt=$((attempt + 1))
+    upload_status=1
+
+    set +e
+    remote_listing="$(list_release_assets 2>"$STDERR_FILE")"
+    status=$?
+    set -e
+
+    gh_error="$(head -n 1 "$STDERR_FILE" 2>/dev/null || true)"
+    elapsed=$((SECONDS - started))
+
+    if [ "$status" -eq 0 ]; then
+        NEEDED=()
+        REASONS=()
+        for f in "${FILES[@]}"; do
+            name="${f##*/}"
+            local_size="$(local_size_of "$f")"
+            if remote_size="$(remote_size_of "$name")"; then
+                if [ "$remote_size" = "$local_size" ]; then
+                    continue
+                fi
+                reason="size mismatch: the release has $remote_size bytes, the file has $local_size"
+            else
+                reason="missing from the release"
+            fi
+            NEEDED+=("$f")
+            REASONS+=("$reason")
+        done
+
+        if [ "${#NEEDED[@]}" -eq 0 ]; then
+            echo "Verified ${#FILES[@]} asset(s) on release $TAG after ${elapsed}s (attempt $attempt)"
+            exit 0
+        fi
+
+        echo "Uploading ${#NEEDED[@]} of ${#FILES[@]} asset(s) to release $TAG (attempt $attempt, ${elapsed}s elapsed):"
+        for i in "${!NEEDED[@]}"; do
+            echo "  - ${NEEDED[$i]##*/}: ${REASONS[$i]}"
+        done
+
+        set +e
+        upload_assets "${NEEDED[@]}" 2>&1 | sed 's/^/    /'
+        upload_status="${PIPESTATUS[0]}"
+        set -e
+
+        if [ "$upload_status" -ne 0 ]; then
+            echo "WARN: gh release upload failed (exit $upload_status) -- GitHub's upload endpoint returns a transient 5xx a few times a month ('Error creating asset temp dir', 'Error saving asset', 'Unicorn!'); retrying"
+        fi
+    else
+        if printf '%s' "$gh_error" | grep -qiE 'not found|HTTP 404'; then
+            echo "ERROR: release $TAG does not exist -- the publishing action failed before it could create the release" >&2
+            echo "ERROR: last GitHub answer: ${gh_error:-<no output>}" >&2
+            exit 1
+        fi
+        echo "WARN: could not list the assets of release $TAG (attempt $attempt, ${elapsed}s elapsed): ${gh_error:-<no output>}"
+    fi
+
+    remaining=$((TIMEOUT_SECONDS - elapsed))
+    if [ "$remaining" -le 0 ]; then
+        break
+    fi
+
+    # A finished upload round can stay invisible to the listing API for a
+    # moment; a short settle avoids re-uploading a file the release already
+    # has. A failed round waits the full interval before trying again.
+    if [ "$status" -eq 0 ] && [ "$upload_status" -eq 0 ]; then
+        delay="$SETTLE_SECONDS"
+    else
+        delay="$POLL_INTERVAL_SECONDS"
+    fi
+    # never sleep past the deadline: the total wait stays within the budget
+    if [ "$delay" -gt "$remaining" ]; then
+        sleep "$remaining"
+    elif [ "$delay" -gt 0 ]; then
+        sleep "$delay"
+    fi
+done
+
+echo "ERROR: release $TAG still does not match the build output after ${TIMEOUT_SECONDS}s" >&2
+for i in "${!NEEDED[@]}"; do
+    echo "ERROR:   - ${NEEDED[$i]##*/}: ${REASONS[$i]}" >&2
+done
+if [ -n "$gh_error" ]; then
+    echo "ERROR: last GitHub answer: ${gh_error}" >&2
+fi
+echo "ERROR: GitHub's release upload endpoint returns transient 5xx responses" >&2
+echo "ERROR: ('Error creating asset temp dir', 'Error saving asset', 'Unicorn!')." >&2
+echo "ERROR: Re-run the failed jobs of this workflow to retry the upload." >&2
+exit 1

package/scripts/smoke-test-runtime-bundle.sh

@@ -174,17 +174,32 @@ cat > "$TEST_PAGE" <<'HTML'
 </body></html>
 HTML
 
-python3 -m http.server "$TEST_PORT" --bind 127.0.0.1 > /dev/null 2>&1 &
+# Serve the fixture from $TEMP_DIR: without --directory, python http.server
+# serves the *current working directory* (the CI workspace / repo checkout),
+# so every run browsed Python's 404 "Error response" page instead of the
+# fixture.  Backends that tolerate type/click on a missing element let that
+# pass silently; the loud "no element found for selector [#input1]" failure
+# exposed the harness bug on all three platforms.
+python3 -m http.server "$TEST_PORT" --bind 127.0.0.1 --directory "$TEMP_DIR" > /dev/null 2>&1 &
 HTTP_PID=$!
 TEST_URL="http://127.0.0.1:$TEST_PORT/test.html"
 
-# Wait for HTTP server to be ready
+# Wait for the HTTP server to actually serve the fixture.  curl -f fails on
+# 4xx/5xx, so a server serving the wrong directory (or not yet ready) cannot
+# silently hand the browser an error page — earlier runs typed into a 404
+# page whenever the interactive commands tolerated a missing element.
+SERVING_OK=""
 for i in $(seq 1 10); do
-    if curl -s -o /dev/null "$TEST_URL" 2>/dev/null; then
+    if curl -sf -o /dev/null "$TEST_URL" 2>/dev/null; then
+        SERVING_OK=1
         break
     fi
     sleep 0.5
 done
+if [ -z "$SERVING_OK" ]; then
+    info "FATAL: test page not served at $TEST_URL (python http.server not serving $TEMP_DIR?)"
+    exit 1
+fi
 
 # ---------------------------------------------------------------------------
 # step 3: determine server URL (let CLI auto-start the server)

package/scripts/tests/install-browser4-cli.tests.ps1

@@ -37,6 +37,21 @@ function Test($name, [ScriptBlock]$block) {
     }
 }
 
+# ── Harness self-test ──
+# An assertion that throws MUST be counted as a failure.  Without this check a
+# harness that silently swallows failures looks perfectly green, which is
+# exactly how this suite's PowerShell sibling (the bash one) stayed green while
+# running no assertions at all.
+$selfTestFail = $script:fail
+Write-Host "  (one deliberate FAIL follows -- the harness self-test)" -ForegroundColor DarkGray
+Test "__harness self-test (must be reported as a failure)" { throw "expected failure" }
+if ($script:fail -ne ($selfTestFail + 1)) {
+    Write-Host "  FATAL  the harness does not record failures -- aborting" -ForegroundColor Red
+    exit 1
+}
+$script:fail = $selfTestFail
+Write-Host "  OK    harness self-test (a throwing assertion is counted as a failure)" -ForegroundColor DarkGray
+
 function RunScript([string]$scriptArgs, [ref]$exitCode) {
     # Use -Command to control stderr redirect (2> path must come before script args,
     # which -File would pass as literal arguments to the script).
@@ -52,7 +67,15 @@ function RunScript([string]$scriptArgs, [ref]$exitCode) {
     $out = $proc.StandardOutput.ReadToEnd()
     $proc.WaitForExit()
     $exitCode.Value = $proc.ExitCode
-    $err = if (Test-Path $tmpErr) { Get-Content $tmpErr -Raw -ErrorAction SilentlyContinue; Remove-Item $tmpErr -Force -ErrorAction SilentlyContinue } else { "" }
+    # Never leave $err as AutomationNull: `$null -eq $err` is true for it, but
+    # `$err -notmatch 'x'` returns an empty array, which is falsey -- an
+    # assertion written that way can never fail.
+    $err = ""
+    if (Test-Path $tmpErr) {
+        $err = Get-Content $tmpErr -Raw -ErrorAction SilentlyContinue
+        Remove-Item $tmpErr -Force -ErrorAction SilentlyContinue
+    }
+    if ($null -eq $err) { $err = "" }
     return [PSCustomObject]@{ Output = $out; Error = $err; ExitCode = $proc.ExitCode }
 }
 
@@ -217,10 +240,24 @@ Test "-SkipLocal flag accepted" {
     if ($ec4 -ne 0) { throw "Exit code: $ec4, output: $($r4.Output)" }
 }
 
-Test "-Force rejected (replaced by -SkipIfInstalled)" {
-    $ec5 = 0; $r5 = RunScript -scriptArgs "-Force -DryRun" -exitCode ([ref]$ec5)
-    if ($r5.Error -notmatch 'Force') {
-        throw "-Force should be rejected, got: $($r5.Error)"
+Test "-Force overrides -SkipIfInstalled, and is a live parameter" {
+    $tmp = Join-Path ([System.IO.Path]::GetTempPath()) "b4-force-$([System.IO.Path]::GetRandomFileName())"
+    New-Item -ItemType Directory -Path $tmp -Force | Out-Null
+    foreach ($n in @('browser4-cli-win32-x64.exe', 'browser4-cli-linux-x64', 'browser4-cli-darwin-arm64')) {
+        Set-Content -Path (Join-Path $tmp $n) -Value "dummy" -Encoding Ascii
+    }
+    try {
+        $ecA = 0; $rA = RunScript -scriptArgs "-SkipIfInstalled -DryRun -SkipBackend -AddToPath:`$false -InstallDir `"$tmp`"" -exitCode ([ref]$ecA)
+        if ($rA.Output -notmatch 'Binary already installed') {
+            throw "Expected the -SkipIfInstalled skip path, got: $($rA.Output)"
+        }
+        $ecB = 0; $rB = RunScript -scriptArgs "-SkipIfInstalled -Force -DryRun -SkipBackend -AddToPath:`$false -InstallDir `"$tmp`"" -exitCode ([ref]$ecB)
+        if ($ecB -ne 0) { throw "-Force must be accepted, exit code: $ecB" }
+        if ($rB.Output -match 'Binary already installed') {
+            throw "-Force must override -SkipIfInstalled, got: $($rB.Output)"
+        }
+    } finally {
+        Remove-Item $tmp -Recurse -Force -ErrorAction SilentlyContinue
     }
 }
 
@@ -236,8 +273,8 @@ Test "-Source github accepted" {
 
 Test "-Source invalid rejected" {
     $ec8 = 0; $r8 = RunScript -scriptArgs "-Source invalid -DryRun" -exitCode ([ref]$ec8)
-    if ($r8.Error -notmatch 'Source|invalid|parameter') {
-        throw "-Source invalid should be rejected, got: $($r8.Error)"
+    if ($ec8 -eq 0) {
+        throw "-Source invalid must fail, output: $($r8.Output)"
     }
 }
 
@@ -246,9 +283,33 @@ Test "-Silent flag accepted" {
     if ($ec9 -ne 0) { throw "Exit code: $ec9, output: $($r9.Output)" }
 }
 
-Test "-Version flag accepted" {
-    $ec10 = 0; $r10 = RunScript -scriptArgs "-Version v4.11.0 -DryRun" -exitCode ([ref]$ec10)
+Test "-Version reaches the download URLs" {
+    $ec10 = 0; $r10 = RunScript -scriptArgs "-Version v4.11.0 -DryRun -AddToPath:`$false" -exitCode ([ref]$ec10)
     if ($ec10 -ne 0) { throw "Exit code: $ec10, output: $($r10.Output)" }
+    if ($r10.Output -notmatch 'releases/download/v4\.11\.0/') {
+        throw "The tag never reached the URLs: $($r10.Output)"
+    }
+}
+
+Test "-Version accepts a bare semver and prefixes it with v" {
+    $ec11 = 0; $r11 = RunScript -scriptArgs "-Version 4.11.0 -DryRun -AddToPath:`$false" -exitCode ([ref]$ec11)
+    if ($ec11 -ne 0) { throw "Exit code: $ec11, output: $($r11.Output)" }
+    if ($r11.Output -notmatch 'releases/download/v4\.11\.0/') {
+        throw "Bare semver was not normalised to v4.11.0: $($r11.Output)"
+    }
+}
+
+Test "-Version rejects a path-traversal tag" {
+    $ec12 = 0; $r12 = RunScript -scriptArgs "-Version ../../evil -DryRun" -exitCode ([ref]$ec12)
+    if ($ec12 -eq 0) { throw "Traversal tag must be rejected, output: $($r12.Output)" }
+}
+
+Test "-DryRun does not probe the installed CLI" {
+    $ec13 = 0; $r13 = RunScript -scriptArgs "-DryRun -AddToPath:`$false" -exitCode ([ref]$ec13)
+    if ($ec13 -ne 0) { throw "Exit code: $ec13, output: $($r13.Output)" }
+    if ($r13.Output -match 'Backend already installed') {
+        throw "-DryRun ran 'status' on the installed CLI: $($r13.Output)"
+    }
 }
 
 Write-Host ""
@@ -256,10 +317,25 @@ Write-Host ""
 # ── Functions via dot-source ──
 Write-Host "--- Functions ---" -ForegroundColor Cyan
 
-# Strip trailing Main call and dot-source for function-level tests
-$scriptContent = Get-Content $installScript -Raw
-$scriptContent = $scriptContent -replace '\r?\nMain\s*$', ''
-$scriptContent = $scriptContent -replace '\$ErrorActionPreference\s*=\s*"Stop"', ''
+# Strip the trailing `Main` call and dot-source for function-level tests.
+# Strip it by AST extent, never by regex: if a line is ever appended after
+# `Main`, a regex silently stops matching and this suite would perform a REAL
+# install and edit the user PATH.
+$installAst = [System.Management.Automation.Language.Parser]::ParseFile($installScript, [ref]$null, [ref]$null)
+$mainCall = @($installAst.FindAll({
+    param($node)
+    $node -is [System.Management.Automation.Language.CommandAst] -and
+    $node.GetCommandName() -eq 'Main' -and
+    $node.Extent.Text.Trim() -eq 'Main'
+}, $true)) | Select-Object -Last 1
+if (-not $mainCall) {
+    throw "Could not locate the top-level 'Main' invocation in $installScript -- refusing to dot-source the installer"
+}
+$allLines = Get-Content $installScript
+$scriptContent = ($allLines[0..($mainCall.Extent.StartLineNumber - 2)] -join "`n") -replace '\$ErrorActionPreference\s*=\s*"Stop"', ''
+if ($scriptContent -match '(?m)^\s*Main\s*$') {
+    throw "The stripped copy still invokes Main -- refusing to dot-source the installer"
+}
 $sb = [ScriptBlock]::Create($scriptContent)
 
 & {
@@ -313,6 +389,31 @@ $sb = [ScriptBlock]::Create($scriptContent)
         if ($result -ne $null) { throw "Expected null, got: $result" }
     }
 
+    Test "Find-LocalBinary finds a bundled binary and enforces the 100 KB gate" {
+        # The bundled-binary path is what a sideload install uses; it used to be
+        # untestable because the dot-sourced copy never had a usable ScriptDir.
+        $tmp = Join-Path ([System.IO.Path]::GetTempPath()) "b4-local-$([System.IO.Path]::GetRandomFileName())"
+        New-Item -ItemType Directory -Path $tmp -Force | Out-Null
+        try {
+            $name = Get-BinaryName -PlatformKey (Get-PlatformKey)
+            [System.IO.File]::WriteAllBytes((Join-Path $tmp $name), (New-Object byte[] 204800))
+            $savedScriptDir = $ScriptDir
+            try {
+                $ScriptDir = $tmp
+                $found = Find-LocalBinary -BinaryName $name
+                if (-not $found) { throw "A 200 KB bundled binary was not found in $tmp" }
+                [System.IO.File]::WriteAllBytes((Join-Path $tmp 'browser4-cli-too-small'), (New-Object byte[] 10))
+                if (Find-LocalBinary -BinaryName 'browser4-cli-too-small') {
+                    throw "A 10-byte file passed the 100 KB gate"
+                }
+            } finally {
+                $ScriptDir = $savedScriptDir
+            }
+        } finally {
+            Remove-Item $tmp -Recurse -Force -ErrorAction SilentlyContinue
+        }
+    }
+
     Test "Test-LocalBinary returns false for empty string" {
         if (Test-LocalBinary -Path "") { throw "Should be false" }
     }
@@ -331,9 +432,43 @@ $sb = [ScriptBlock]::Create($scriptContent)
         if ($action -ne "upgrade") { throw "Expected 'upgrade', got: $action" }
     }
 
-    Test "Get-BackendAction defaults to upgrade on empty status" {
+    Test "Get-BackendAction defaults to install on empty status" {
+        # An empty status means "no CLI answer" (fresh machine, or `status`
+        # failed).  Defaulting to upgrade would run `upgrade` on a machine that
+        # has nothing to upgrade.
         $action = Get-BackendAction -StatusOutput ""
-        if ($action -ne "upgrade") { throw "Expected 'upgrade', got: $action" }
+        if ($action -ne "install") { throw "Expected 'install', got: $action" }
+    }
+
+    Test "Test-BinaryMagic accepts ELF, PE and Mach-O" {
+        $tmp = [System.IO.Path]::GetTempFileName()
+        try {
+            $cases = @{
+                'elf'    = [byte[]]@(0x7f, 0x45, 0x4c, 0x46, 0x02, 0x01)
+                'pe'     = [byte[]]@(0x4d, 0x5a, 0x90, 0x00, 0x03)
+                'macho'  = [byte[]]@(0xcf, 0xfa, 0xed, 0xfe, 0x07)
+            }
+            foreach ($name in $cases.Keys) {
+                [System.IO.File]::WriteAllBytes($tmp, $cases[$name])
+                if (-not (Test-BinaryMagic -Path $tmp)) { throw "Rejected a valid $name header" }
+            }
+        } finally {
+            Remove-Item $tmp -Force -ErrorAction SilentlyContinue
+        }
+    }
+
+    Test "Test-BinaryMagic rejects an HTML error page" {
+        $tmp = [System.IO.Path]::GetTempFileName()
+        try {
+            [System.IO.File]::WriteAllText($tmp, "<html><body>404 Not Found</body></html>")
+            if (Test-BinaryMagic -Path $tmp) { throw "An HTML body was accepted as a binary" }
+        } finally {
+            Remove-Item $tmp -Force -ErrorAction SilentlyContinue
+        }
+    }
+
+    Test "Test-BinaryMagic rejects a missing file" {
+        if (Test-BinaryMagic -Path "/nonexistent/binary-xyz") { throw "A missing file was accepted" }
     }
 }