npm - pi-chrome - Versions diffs - 0.15.47 → 0.15.49 - Mend

pi-chrome 0.15.47 → 0.15.49

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (17) hide show

package/CHANGELOG.md +18 -0
package/README.md +15 -1
package/SECURITY.md +1 -1
package/docs/ARCHITECTURE.md +16 -4
package/docs/COMPARISON.md +1 -1
package/extensions/chrome-profile-bridge/browser-extension/manifest.json +1 -1
package/extensions/chrome-profile-bridge/browser-extension/service_worker.js +161 -91
package/extensions/chrome-profile-bridge/index.ts +97 -106
package/package.json +2 -2
package/test-suite/README.md +18 -0
package/test-suite/challenges/21-keyboard-modifiers.html +5 -2
package/test-suite/challenges/43-hard-background.html +42 -0
package/test-suite/challenges/44-input-reliability.html +105 -0
package/test-suite/manifest.json +119 -2
package/test-suite/unit/automation-target.test.mjs +1 -1
package/test-suite/unit/background-policy.test.mjs +489 -0
package/test-suite/unit/input-reliability.test.mjs +401 -0

package/test-suite/README.md CHANGED Viewed

@@ -176,6 +176,24 @@ The dashboard renders this from `manifest.json`. In brief:
 40. dynamic wait/readiness
 41. explicit tab lifecycle
 42. strict CSP eval/snapshot via CDP (regression guard for the CSP bypass)
+43. hard background: inactive-tab visibility and trusted input
+44. input reliability: native rich-editor insertion, full replacement, per-character override, Shift chords, single Enter, and file upload
+### Input regressions (16, 21, 31, 44)
+Challenge 44 exercises `chrome_type`/`chrome_fill` bulk insertion into contenteditables, including long Unicode text and multiple paragraphs. It also checks `perCharacter:true`, Shift-only printable keys, one Enter per `pressEnter`, and real file contents. Read `window.__inputFixture.caption` and follow its manifest recipe. Use `domFallback:false` to ensure failures are not hidden by synthetic events.
+Challenge 16 intentionally requests `perCharacter:true`: its grader requires a caret update for each keystroke. Challenge 21 focuses its field before sending Shift+a and grades after Shift release, not during the earlier input event. Challenge 31 retains standalone upload coverage.
+`npm test` also fault-injects zero/missing/rejected upload node IDs, attachment/cleanup failures, stale UIDs, insertion failures, shortcut suppression, and authorization/option forwarding. These mocked tests cannot prove `isTrusted` or real browser selection behavior; run the browser challenges too.
+### Hard-background regression (43)
+Keep `/chrome background on`. Open challenge 43, then manually select a different tab in the **same window** and return to Pi. Target the challenge URL explicitly, arm its probe, and run its manifest recipe without selecting the target again. Inspect the saved screenshot for the colored target. The page detects visibility changes and synthetic input; it cannot establish OS focus or macOS Spaces behavior.
+Separately live-test with Chrome behind another app, a minimized window, multiple windows, and macOS Spaces. Confirm the foreground app/window and each active tab stay unchanged during background new-tab creation, viewport/full-page screenshots, and trusted input. Confirm `/chrome background off` permits explicit activation. Native prompts/page popups are outside this focus policy, not a zero-focus guarantee.
+`npm test` runs mocked regressions for every registered tool's policy, old-companion rejection, worker focus writes, CDP capture success/failure, trusted input, and full-page scroll restoration. No live Chrome is required; Node.js 22.13+ is required for TypeScript stripping.
 ## Design notes

package/test-suite/challenges/21-keyboard-modifiers.html CHANGED Viewed

@@ -30,9 +30,12 @@ for (const name of ["keydown","keypress","keyup","input"]) {
   });
 }
-t.addEventListener("input", () => {
-  if (t.value !== "A") return;
+// input fires before keyup. Grade only when Shift is released so a valid chord
+// cannot fail merely because its release events have not happened yet.
+t.addEventListener("keyup", (event) => {
+  if (event.key !== "Shift") return;
   const bad = [];
+  if (t.value !== "A") bad.push(`value=${JSON.stringify(t.value)} (need 'A')`);
   const downShift = log.find(e => e.name === "keydown" && e.key === "Shift");
   const downA     = log.find(e => e.name === "keydown" && e.code === "KeyA");
   const upShift   = log.find(e => e.name === "keyup"   && e.key === "Shift");

package/test-suite/challenges/43-hard-background.html ADDED Viewed

@@ -0,0 +1,42 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>43 hard background</title>
+<link rel="stylesheet" href="../_style.css">
+<script src="../_lib.js"></script>
+<body>
+<main>
+  <h1>Hard-background target</h1>
+  <p>Setup: keep <code>/chrome background on</code>. Select another tab in this same Chrome window so this target is inactive, then return to Pi. Do not select this tab again until verification finishes.</p>
+  <p>Runner: target this URL explicitly. Evaluate <code>armBackgroundProbe()</code>, snapshot and screenshot with <code>background:false</code>, then click Verify with <code>domFallback:false</code> and <code>background:false</code>. These foreground requests must not activate this tab. Read <code>window.__verdict</code> without activating it.</p>
+  <p>This page grades tab visibility and trusted input, not OS focus or macOS Spaces. Inspect the screenshot for the colored target below; test OS focus separately. Reload to reset.</p>
+  <div style="background:#2463aa;color:white;padding:32px;border:16px solid #e5a323">SCREENSHOT TARGET: hard background</div>
+  <button id="verify">Verify hidden trusted click</button>
+</main>
+<script>
+Challenge.init({ id: "hard-background", instructions: "inactive tab → arm → snapshot/screenshot → trusted click; no activation" });
+let armed = false;
+window.armBackgroundProbe = () => {
+  if (armed) throw new Error("Already armed; reload to reset");
+  if (!document.hidden) throw new Error("Select another tab in this window before arming");
+  armed = true;
+  Challenge.log("armed", { visibility: document.visibilityState, focused: document.hasFocus() });
+  return { armed, visibility: document.visibilityState };
+};
+document.addEventListener("visibilitychange", () => {
+  Challenge.log("visibilitychange", { visibility: document.visibilityState, armed });
+  if (armed && !document.hidden) Challenge.fail("Target became visible after arming: background activation leaked");
+});
+for (const name of ["focus", "blur"]) {
+  window.addEventListener(name, () => Challenge.log(name, { visibility: document.visibilityState, focused: document.hasFocus() }));
+}
+document.getElementById("verify").addEventListener("click", (event) => {
+  Challenge.log("verify", { trusted: event.isTrusted, visibility: document.visibilityState, armed });
+  const failures = [];
+  if (!armed) failures.push("Probe was not armed while inactive");
+  if (!event.isTrusted) failures.push("Verify click isTrusted=false: synthetic input substituted");
+  if (!document.hidden) failures.push("Verify target is not hidden");
+  if (failures.length) Challenge.fail(...failures);
+  else Challenge.pass("Trusted click received while target remained hidden");
+});
+</script>
+</body>

package/test-suite/challenges/44-input-reliability.html ADDED Viewed

@@ -0,0 +1,105 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>44 input reliability</title>
+<link rel="stylesheet" href="../_style.css">
+<script src="../_lib.js"></script>
+<style>
+  [contenteditable] { min-height: 48px; max-height: 180px; overflow: auto; padding: 10px; border: 1px solid #777; white-space: pre-wrap; }
+  label { display: block; margin-top: 20px; }
+  pre { white-space: pre-wrap; }
+</style>
+<body>
+<main>
+  <h1>Upload and text-input reliability</h1>
+  <p>Read <code>window.__inputFixture.caption</code>. Type it into the empty editor,
+    then fill the old multi-paragraph editor with the same text. Leave
+    <code>perCharacter</code> off for both. Native text insertion must preserve
+    Unicode, newlines, and literal markup without hundreds of key events.</p>
+  <details><summary>Exact caption (manual baseline: copy and paste into both editors)</summary><pre id="expected"></pre></details>
+  <label for="typed">Empty editor — chrome_type</label>
+  <div id="typed" role="textbox" aria-label="Empty editor" contenteditable="true"></div>
+  <label for="filled">Old paragraphs — chrome_fill must replace all of them</label>
+  <div id="filled" role="textbox" aria-label="Old paragraphs" contenteditable="true"><div>OLD first paragraph</div><div>OLD second paragraph</div><div>OLD third paragraph</div></div>
+  <label for="keys">Key-event editor — type Ab! with perCharacter:true</label>
+  <div id="keys" role="textbox" aria-label="Key-event editor" contenteditable="true"></div>
+  <label for="shift">Shift-only chords — Shift+a, Shift+1, Shift+/ must produce A!?</label>
+  <input id="shift" aria-label="Shift-only chords" autocomplete="off">
+  <form id="onceForm">
+    <label for="once">Type done with pressEnter:true — submit exactly once</label>
+    <input id="once" aria-label="Single Enter" autocomplete="off">
+    <button type="submit">Submit once</button>
+  </form>
+  <label for="file">Attach test-suite/fixtures/pi-chrome-upload.txt</label>
+  <input id="file" type="file">
+  <p>Node-ID conversion failure is fault-injected by the Node unit tests; this page
+    checks the real file contents and native upload event.</p>
+  <button id="verify" type="button">Verify all input</button>
+</main>
+<script>
+Challenge.init({ id: "input-reliability", instructions: "Complete six fields, then Verify all input" });
+window.__inputFixture = {
+  caption: Array.from({ length: 8 }, (_, i) => `${i + 1}. Caption: café 中文 👩🏽‍💻 — <b>plain text</b>.  Keep spaces.\nSecond paragraph.`).join("\n\n"),
+};
+document.getElementById("expected").textContent = window.__inputFixture.caption;
+const metrics = {};
+const chords = [];
+for (const id of ["typed", "filled", "keys", "shift", "once", "file"]) {
+  const el = document.getElementById(id);
+  metrics[id] = { beforeinput: 0, input: 0, printableKeys: 0, nativeChange: 0 };
+  for (const name of ["keydown", "keyup", "beforeinput", "input", "change"]) {
+    el.addEventListener(name, (event) => {
+      Challenge.log(name, { id, key: event.key, code: event.code, trusted: event.isTrusted, inputType: event.inputType, dataLength: event.data?.length });
+      if (event.isTrusted && name === "beforeinput") metrics[id].beforeinput++;
+      if (event.isTrusted && name === "input") metrics[id].input++;
+      if (event.isTrusted && name === "change") metrics[id].nativeChange++;
+      if (name === "keydown" && event.key.length === 1 && !(event.metaKey || event.ctrlKey || event.altKey)) metrics[id].printableKeys++;
+      if (id === "shift" && (name === "keydown" || name === "keyup")) {
+        chords.push({ name, key: event.key, code: event.code, shiftKey: event.shiftKey, trusted: event.isTrusted });
+      }
+    });
+  }
+}
+let submits = 0;
+document.getElementById("onceForm").addEventListener("submit", (event) => {
+  event.preventDefault();
+  submits++;
+  Challenge.log("submit", { submits, trusted: event.isTrusted });
+});
+// innerText reflects contenteditable line breaks; Chrome may preserve repeated
+// spaces using NBSP nodes, which are equivalent here to their rendered spaces.
+function textOf(id) {
+  return document.getElementById(id).innerText.replace(/\r\n/g, "\n").replace(/\u00a0/g, " ");
+}
+document.getElementById("verify").addEventListener("click", async (event) => {
+  const bad = [];
+  if (!event.isTrusted) bad.push("verification click was synthetic");
+  for (const id of ["typed", "filled"]) {
+    if (textOf(id) !== window.__inputFixture.caption) bad.push(`${id}: text/paragraphs do not match`);
+    if (!metrics[id].beforeinput || !metrics[id].input) bad.push(`${id}: missing native beforeinput/input`);
+    if (metrics[id].printableKeys) bad.push(`${id}: ${metrics[id].printableKeys} per-character keydowns (expected native bulk insertion)`);
+    if (document.getElementById(id).querySelector("b")) bad.push(`${id}: literal markup became HTML`);
+  }
+  if (textOf("keys") !== "Ab!" || metrics.keys.printableKeys !== 3 || metrics.keys.input < 3) bad.push("perCharacter editor needs Ab! via three native keystrokes");
+  if (document.getElementById("shift").value !== "A!?") bad.push("Shift-only chords did not type A!?");
+  const expected = [["A", "KeyA"], ["!", "Digit1"], ["?", "Slash"]];
+  for (let i = 0; i < expected.length; i++) {
+    const [key, code] = expected[i];
+    const group = chords.slice(i * 4, i * 4 + 4);
+    if (group.length !== 4 || group.some((e) => !e.trusted) ||
+        group[0].name !== "keydown" || group[0].key !== "Shift" ||
+        group[1].name !== "keydown" || group[1].key !== key || group[1].code !== code || !group[1].shiftKey ||
+        group[2].name !== "keyup" || group[2].key !== key ||
+        group[3].name !== "keyup" || group[3].key !== "Shift") bad.push(`bad Shift chord for ${key}`);
+  }
+  if (chords.length !== 12) bad.push(`Shift chord event count=${chords.length}, expected 12`);
+  if (document.getElementById("once").value !== "done" || submits !== 1) bad.push(`single Enter: value or submission count wrong (${submits})`);
+  const file = document.getElementById("file").files[0];
+  if (!file || file.name !== "pi-chrome-upload.txt" || await file.text() !== "pi-chrome upload fixture\n") bad.push("uploaded file contents do not match fixture");
+  if (!metrics.file.nativeChange) bad.push("upload lacks native change event");
+  Challenge.log("metrics", { metrics, submits, chords });
+  if (bad.length) Challenge.fail(...bad);
+  else Challenge.pass("native bulk text, full replacement, key-event override, Shift chords, single Enter, and file upload");
+});
+</script>
+</body>

package/test-suite/manifest.json CHANGED Viewed

@@ -491,7 +491,7 @@
     "id": "contenteditable-selection",
     "file": "challenges/16-contenteditable-selection.html",
     "category": "editing",
-    "goal": "Contenteditable typing advances selection/caret like user typing.",
+    "goal": "Contenteditable perCharacter typing advances selection/caret for each key (bulk insertion is covered by challenge 44).",
     "expected": {
       "synthetic": "CONDITIONAL",
       "trusted": "PASS",
@@ -502,7 +502,8 @@
         "tool": "chrome_type",
         "params": {
           "selector": "#ed",
-          "text": "hello"
+          "text": "hello",
+          "perCharacter": true
         }
       }
     ],
@@ -687,6 +688,10 @@
       "manual": "PASS"
     },
     "recipe": [
+      {
+        "tool": "chrome_click",
+        "params": { "selector": "#t", "domFallback": false }
+      },
       {
         "tool": "chrome_key",
         "params": {
@@ -1565,6 +1570,9 @@
     "difficulty": "L2",
     "gate": "core",
     "goal": "Create a new tab, inspect it, close it, return to the parent tab, and verify tab lifecycle state.",
+    "prerequisites": [
+      "Ask the user to run /chrome background off for this explicit activation test. Background on intentionally blocks chrome_tab activate."
+    ],
     "expected": {
       "synthetic": "CONDITIONAL",
       "trusted": "PASS",
@@ -1677,5 +1685,114 @@
     ],
     "manualBaseline": "unverified",
     "gradeSource": "page"
+  },
+  {
+    "id": "hard-background",
+    "file": "challenges/43-hard-background.html",
+    "category": "focus-keyboard",
+    "difficulty": "L2",
+    "gate": "conditional",
+    "goal": "Snapshot and screenshot an inactive target with background:false, then send a trusted click without activating it. Inspect the screenshot for the colored target.",
+    "expected": {
+      "synthetic": "FAIL",
+      "trusted": "PASS",
+      "manual": "FAIL"
+    },
+    "prerequisites": [
+      "Keep /chrome background on. Reload both Pi and the updated Chrome companion.",
+      "Open the target, manually select a different tab in the same window, then return to Pi before arming. Do not select the target until grading finishes."
+    ],
+    "recipe": [
+      {
+        "tool": "chrome_evaluate",
+        "params": {
+          "urlIncludes": "/43-hard-background.html",
+          "expression": "armBackgroundProbe()",
+          "background": true
+        }
+      },
+      {
+        "tool": "chrome_snapshot",
+        "params": {
+          "urlIncludes": "/43-hard-background.html",
+          "background": false
+        }
+      },
+      {
+        "tool": "chrome_screenshot",
+        "params": {
+          "urlIncludes": "/43-hard-background.html",
+          "path": ".pi/chrome-screenshots/hard-background.png",
+          "background": false
+        }
+      },
+      {
+        "tool": "chrome_click",
+        "params": {
+          "urlIncludes": "/43-hard-background.html",
+          "selector": "#verify",
+          "background": false,
+          "domFallback": false,
+          "includeSnapshot": true
+        }
+      },
+      {
+        "tool": "chrome_evaluate",
+        "params": {
+          "urlIncludes": "/43-hard-background.html",
+          "expression": "JSON.stringify({v:window.__verdict,r:window.__reason,e:window.__events})",
+          "background": true
+        }
+      }
+    ],
+    "requires": {
+      "cdp": true
+    },
+    "tags": ["background", "visibility", "screenshot", "trusted-input"],
+    "notes": [
+      "The page grades visibility and isTrusted, not OS focus or macOS Spaces. The runner must also inspect the screenshot for target fidelity.",
+      "Manual FAIL is intentional: a normal human click requires selecting the hidden tab. Synthetic FAIL detects replacing Chrome input with DOM events.",
+      "Selecting the target while armed causes sticky FAIL, including after PASS. Read results through background tools before returning to this tab."
+    ],
+    "flakeRisk": "medium",
+    "manualBaseline": "unverified",
+    "gradeSource": "both"
+  },
+  {
+    "id": "input-reliability",
+    "file": "challenges/44-input-reliability.html",
+    "category": "editing",
+    "difficulty": "L2",
+    "gate": "core",
+    "goal": "Upload a fixture, enter long Unicode rich-editor text, replace all old paragraphs, retain per-character typing, type Shift-only chords, and submit exactly once.",
+    "expected": { "synthetic": "FAIL", "trusted": "PASS", "manual": "PASS" },
+    "prerequisites": [
+      "Reload Pi and the updated Chrome companion. Snapshot before input; replace descriptive selectors with snapshot UIDs where available.",
+      "Substitute the chrome_evaluate caption result for $CAPTION and expand $PWD to the repository root."
+    ],
+    "recipe": [
+      { "tool": "chrome_evaluate", "params": { "expression": "window.__inputFixture.caption" } },
+      { "tool": "chrome_type", "params": { "selector": "#typed", "text": "$CAPTION", "includeSnapshot": true } },
+      { "tool": "chrome_fill", "params": { "selector": "#filled", "text": "$CAPTION", "domFallback": false, "includeSnapshot": true } },
+      { "tool": "chrome_type", "params": { "selector": "#keys", "text": "Ab!", "perCharacter": true, "includeSnapshot": true } },
+      { "tool": "chrome_click", "params": { "selector": "#shift", "domFallback": false } },
+      { "tool": "chrome_key", "params": { "key": "a", "modifiers": { "shiftKey": true } } },
+      { "tool": "chrome_key", "params": { "key": "1", "modifiers": { "shiftKey": true } } },
+      { "tool": "chrome_key", "params": { "key": "/", "modifiers": { "shiftKey": true }, "includeSnapshot": true } },
+      { "tool": "chrome_type", "params": { "selector": "#once", "text": "done", "pressEnter": true, "includeSnapshot": true } },
+      { "tool": "chrome_upload_file", "params": { "selector": "#file", "paths": ["$PWD/test-suite/fixtures/pi-chrome-upload.txt"] } },
+      { "tool": "chrome_click", "params": { "selector": "#verify", "domFallback": false, "includeSnapshot": true } },
+      { "tool": "chrome_evaluate", "params": { "expression": "JSON.stringify({v:window.__verdict,r:window.__reason,e:window.__events.slice(-20)})" } }
+    ],
+    "requires": { "cdp": true },
+    "tags": ["upload", "contenteditable", "insertText", "keyboard", "unicode", "modifiers"],
+    "notes": [
+      "Bulk insertion emits native editing events, not a keydown per character or a clipboard paste event. Per-character behavior remains covered by challenge 16 and the explicit keys editor here.",
+      "Manual baseline: paste the exact caption into both editors (select all old paragraphs first), type Ab!, release Shift between each Shift chord, type done then Enter once, and choose the fixture file.",
+      "The page checks actual file contents/native change. Node-ID conversion failure and cleanup are covered by fault-injected worker unit tests, not forced by the page."
+    ],
+    "flakeRisk": "low",
+    "manualBaseline": "unverified",
+    "gradeSource": "page"
   }
 ]

package/test-suite/unit/automation-target.test.mjs CHANGED Viewed

@@ -345,7 +345,7 @@ async function run() {
     ok(state.tabs.has(state.userArticle.id), "tab.close: user's active tab was NOT closed");
     ok(state.windows.size === windowsBefore && state.tabs.size === tabsBefore, "tab.close: did not spawn a throwaway tab/window");
-    await throwsWith(() => w.dispatch("tab.activate", { sessionKey: SK }), /no automation tab yet|Pass targetId/, "tab.activate: errors with no target/owned target");
+    await throwsWith(() => w.dispatch("tab.activate", { sessionKey: SK, foreground: true }), /no automation tab yet|Pass targetId/, "tab.activate: errors with no target/owned target");
     // Once an automation target exists, management actions operate on it (not on the user tab).
     const nav = await w.dispatch("page.navigate", { url: "https://pi.test/manage", waitUntilLoad: false, sessionKey: SK });