pi-lean-dimension 0.2.4 → 0.3.0

package/node_modules/pi-lean-portal/__tests__/fetch-backend.test.ts

@@ -1,8 +1,7 @@
 /**
  * Tests for fetch-backend.ts — webFetch() and supporting utilities.
  *
- * Uses vi.spyOn(global, 'fetch') to mock HTTP responses, avoiding
- * URL safety restrictions (127.0.0.1 is blocked) and providing
+ * Uses vi.spyOn(global, 'fetch') to mock HTTP responses, providing
  * deterministic control over response timing.
  */
 
@@ -187,40 +186,14 @@ describe("webFetch — core fetch", () => {
 	});
 });
 
-// ─── URL Safety ───────────────────────────────────────────────
+// ─── URL Validation ───────────────────────────────────────────
 
-describe("webFetch — URL safety", () => {
+describe("webFetch — URL validation", () => {
 	it("rejects invalid URLs before fetching", async () => {
 		const result = await webFetch({ url: "not a url" });
 		expect(result.success).toBe(false);
 		expect(result.error).toBe("Invalid URL");
 	});
-
-	it("rejects SSRF (localhost) before fetching", async () => {
-		const result = await webFetch({ url: "http://localhost/admin" });
-		expect(result.success).toBe(false);
-		expect(result.error).toMatch(/URL blocked/i);
-	});
-
-	it("rejects SSRF (private IP) before fetching", async () => {
-		const result = await webFetch({ url: "http://127.0.0.1/secret" });
-		expect(result.success).toBe(false);
-		expect(result.error).toMatch(/URL blocked/i);
-	});
-
-	it("rejects dangerous schemes before fetching", async () => {
-		const result = await webFetch({ url: "file:///etc/passwd" });
-		expect(result.success).toBe(false);
-		expect(result.error).toMatch(/URL blocked/i);
-	});
-
-	it("rejects URLs containing secrets before fetching", async () => {
-		const result = await webFetch({
-			url: "http://example.com/api?api_key=secret123",
-		});
-		expect(result.success).toBe(false);
-		expect(result.error).toMatch(/URL blocked/i);
-	});
 });
 
 // ─── JavaScript Detection ─────────────────────────────────────
@@ -314,11 +287,12 @@ describe("webFetch — content capping", () => {
 	});
 
 	it("preserves both temp files when two large fetches share a taskId", async () => {
+		const tid = "preserve-shared";
 		mockFetch({ body: `<p>${longText(6000)}</p>` });
-		const a = await webFetch({ url: "http://example.com/a", taskId: "shared" });
+		const a = await webFetch({ url: "http://example.com/a", taskId: tid });
 
 		mockFetch({ body: `<p>${"B".repeat(6000)}</p>` });
-		const b = await webFetch({ url: "http://example.com/b", taskId: "shared" });
+		const b = await webFetch({ url: "http://example.com/b", taskId: tid });
 
 		expect(a.filePath).toBeTruthy();
 		expect(b.filePath).toBeTruthy();

package/node_modules/pi-lean-portal/__tests__/helpers/mock-python-bridge.py

@@ -37,7 +37,7 @@ def main() -> None:
             write_response(req_id, result="pong")
 
         elif method == "browser.init":
-            # Phase 0: accept plugin config forwarded from the adapter after ping.
+            # Accept plugin config forwarded from the adapter after ping.
             write_response(req_id, result={"ok": True})
 
         elif method == "shutdown":

package/node_modules/pi-lean-portal/__tests__/helpers/probe-user-backend.ts

@@ -43,8 +43,7 @@ import { isAbsolute, join } from "node:path";
  * and non-empty; otherwise defaults to
  * `~/.pi/agent/pi-lean-portal/user-backends/`.
  *
- * Vendored locally — see the module doc for the rationale. Sprint 2's
- * generic runner reuses this same helper for consistency.
+ * Vendored locally — reused by the contributed test runner for consistency.
  */
 export function userBackendsDir(): string {
 	const env = process.env.PI_USER_BACKENDS_DIR;

package/node_modules/pi-lean-portal/__tests__/helpers/setup-temp-dir.ts

@@ -0,0 +1,26 @@
+/**
+ * Test setup: isolate each worker's temp directory using process.pid.
+ *
+ * vitest's default `forks` pool runs each test file in a separate Node
+ * process with a unique PID.  Keying PI_BROWSER_TEMP_DIR on the PID
+ * gives each worker a disjoint filesystem namespace, preventing
+ * cross-worker `removeAllSnapshotFiles()` races that cause flaky
+ * ENOENT / null-result failures in snapshot-cache.test.ts.
+ *
+ * This file must be listed in vitest's `setupFiles` so it runs *before*
+ * any test file import, including the module-level `const BROWSER_TEMP_DIR`
+ * evaluation in `core/shared/paths.ts`.
+ */
+import { tmpdir } from "node:os";
+import { rmSync } from "node:fs";
+
+const dir = `${tmpdir()}/pi-lean-portal-test-${process.pid}`;
+process.env.PI_BROWSER_TEMP_DIR = dir;
+
+process.on("exit", () => {
+	try {
+		rmSync(dir, { recursive: true, force: true });
+	} catch {
+		/* best-effort cleanup */
+	}
+});

package/node_modules/pi-lean-portal/__tests__/plugin-config-browser.test.ts

@@ -190,7 +190,7 @@ describe("loadFullConfig().browser", () => {
 	});
 });
 
-// ─── Default plugin fallback (Phase 0b) ─────────────────────────
+// ─── Default plugin fallback ───────────────────────────────────────
 
 describe("loadFullConfig().plugins default fallback", () => {
 	it("returns the four shipped backends when browser.plugins is absent", () => {

package/node_modules/pi-lean-portal/__tests__/plugin-contract.test.ts

@@ -3,7 +3,7 @@
  * test harness itself works correctly against a known-good fixture.
  *
  * These tests exercise the structural (non-browser) contract only.
- * Real-browser behavioral tests run in chromium-py.test.ts (Phase B6).
+ * Real-browser behavioral tests run in the per-backend contract test files.
  */
 
 import { runContractTests } from "./helpers/plugin-contract.js";

package/node_modules/pi-lean-portal/__tests__/plugin-loading.test.ts

@@ -259,7 +259,7 @@ describe("DEFAULT_BACKENDS_ROOT", () => {
 	});
 });
 
-// ─── Multi-root discovery (Phase 0b) ─────────────────────────────
+// ─── Multi-root discovery ────────────────────────────────────────────
 
 describe("detectPluginType — multi-root", () => {
 	let packageRoot: string;

package/node_modules/pi-lean-portal/__tests__/probe-user-backend.test.ts

@@ -1,5 +1,5 @@
 /**
- * Unit tests for `probeUserBackend` (Sprint 1, AC 1.2).
+ * Unit tests for `probeUserBackend`.
  *
  * Structural — no real browser, no MiniWoB content. Uses a temp
  * directory as `PI_USER_BACKENDS_DIR` so nothing is written to the

package/node_modules/pi-lean-portal/__tests__/python-adapter.test.ts

@@ -814,12 +814,12 @@ describeStderr("stderr capture", () => {
 // ═════════════════════════════════════════════════════════════════════
 
 // ══════════════════════════════════════════════════════════════════════
-//  browser.init RPC (Phase 0)
+//  browser.init RPC
 // ══════════════════════════════════════════════════════════════════════
 
 const describeBrowserInit = PYTHON_AVAILABLE ? describe : describe.skip;
 
-describeBrowserInit("browser.init RPC (Phase 0)", () => {
+describeBrowserInit("browser.init RPC", () => {
 	/**
 	 * Build a bridge that records every method received (in order) and
 	 * optionally answers `browser.init` with success or an error.
@@ -1087,7 +1087,7 @@ describeBrowserInit("browser.init RPC (Phase 0)", () => {
 });
 
 // ═════════════════════════════════════════════════════════════════════
-//  PYTHONPATH injection (Phase 0b)
+//  PYTHONPATH injection
 // ═════════════════════════════════════════════════════════════════════
 
 /**
@@ -1095,7 +1095,7 @@ describeBrowserInit("browser.init RPC (Phase 0)", () => {
  * module-level `DEFAULT_BACKENDS_ROOT` only, never `this`), so it can be
  * invoked without binding.  These unit tests don't need a subprocess.
  */
-describe("_buildPythonPath — PYTHONPATH injection (Phase 0b)", () => {
+describe("_buildPythonPath — PYTHONPATH injection", () => {
 	it("includes the package python-base directory when PYTHONPATH is unset", () => {
 		const adapter = createAdapter();
 		const saved = process.env.PYTHONPATH;
@@ -1131,73 +1131,69 @@ describe("_buildPythonPath — PYTHONPATH injection (Phase 0b)", () => {
 
 const describePythonPathEnv = PYTHON_AVAILABLE ? describe : describe.skip;
 
-describePythonPathEnv(
-	"PYTHONPATH reaches the spawned bridge (Phase 0b)",
-	() => {
-		it("the bridge process env includes the package python-base path", async () => {
-			const dir = mkdtempSync(join(tmpdir(), "pi-lean-portal-pypath-"));
-			const bridgePath = join(dir, "bridge.py");
-			const lines: string[] = [
-				"import json, sys, os",
-				"sys.stderr.write('PYPATH:' + (os.environ.get('PYTHONPATH') or '') + '\\n')",
-				"sys.stderr.flush()",
-				"for _line in sys.stdin:",
-				"    _line = _line.strip()",
-				"    if not _line: continue",
-				"    _req = json.loads(_line)",
-				"    _m = _req.get('method','')",
-				"    _rid = _req.get('id')",
-				"    if _m == 'ping':",
-				"        sys.stdout.write(json.dumps({'jsonrpc':'2.0','id':_rid,'result':'pong'}) + '\\n')",
-				"        sys.stdout.flush()",
-				"    elif _m == 'browser.init':",
-				"        sys.stdout.write(json.dumps({'jsonrpc':'2.0','id':_rid,'result':{'ok':True}}) + '\\n')",
-				"        sys.stdout.flush()",
-				"    elif _m == 'shutdown':",
-				"        sys.stdout.write(json.dumps({'jsonrpc':'2.0','id':_rid,'result':'bye'}) + '\\n')",
-				"        sys.stdout.flush()",
-				"        break",
-				"    elif _m == 'browser.navigate':",
-				"        sys.stdout.write(json.dumps({'jsonrpc':'2.0','id':_rid,'result':{'success':True,'url':_req.get('params',{}).get('url',''),'title':'P','snapshot':'','elementCount':0}}) + '\\n')",
-				"        sys.stdout.flush()",
-				"    else:",
-				"        sys.stdout.write(json.dumps({'jsonrpc':'2.0','id':_rid,'error':{'code':-32601,'message':'unknown'}}) + '\\n')",
-				"        sys.stdout.flush()",
-			];
-			writeFileSync(bridgePath, lines.join("\n"), "utf-8");
-			const adapter = new PythonPluginAdapter("pypath-test", {
-				bridgeScript: bridgePath,
-				pythonPath: "python3",
-			});
+describePythonPathEnv("PYTHONPATH reaches the spawned bridge", () => {
+	it("the bridge process env includes the package python-base path", async () => {
+		const dir = mkdtempSync(join(tmpdir(), "pi-lean-portal-pypath-"));
+		const bridgePath = join(dir, "bridge.py");
+		const lines: string[] = [
+			"import json, sys, os",
+			"sys.stderr.write('PYPATH:' + (os.environ.get('PYTHONPATH') or '') + '\\n')",
+			"sys.stderr.flush()",
+			"for _line in sys.stdin:",
+			"    _line = _line.strip()",
+			"    if not _line: continue",
+			"    _req = json.loads(_line)",
+			"    _m = _req.get('method','')",
+			"    _rid = _req.get('id')",
+			"    if _m == 'ping':",
+			"        sys.stdout.write(json.dumps({'jsonrpc':'2.0','id':_rid,'result':'pong'}) + '\\n')",
+			"        sys.stdout.flush()",
+			"    elif _m == 'browser.init':",
+			"        sys.stdout.write(json.dumps({'jsonrpc':'2.0','id':_rid,'result':{'ok':True}}) + '\\n')",
+			"        sys.stdout.flush()",
+			"    elif _m == 'shutdown':",
+			"        sys.stdout.write(json.dumps({'jsonrpc':'2.0','id':_rid,'result':'bye'}) + '\\n')",
+			"        sys.stdout.flush()",
+			"        break",
+			"    elif _m == 'browser.navigate':",
+			"        sys.stdout.write(json.dumps({'jsonrpc':'2.0','id':_rid,'result':{'success':True,'url':_req.get('params',{}).get('url',''),'title':'P','snapshot':'','elementCount':0}}) + '\\n')",
+			"        sys.stdout.flush()",
+			"    else:",
+			"        sys.stdout.write(json.dumps({'jsonrpc':'2.0','id':_rid,'error':{'code':-32601,'message':'unknown'}}) + '\\n')",
+			"        sys.stdout.flush()",
+		];
+		writeFileSync(bridgePath, lines.join("\n"), "utf-8");
+		const adapter = new PythonPluginAdapter("pypath-test", {
+			bridgeScript: bridgePath,
+			pythonPath: "python3",
+		});
+		try {
+			await adapter.init({});
+			const r = await adapter.navigate(
+				"https://example.com",
+				"pypath-t1",
+				30_000,
+			);
+			expect(r.success).toBe(true);
+			const stderr =
+				(adapter as unknown as Record<string, string>)["_stderrAccumulated"] ??
+				"";
+			const pypathLine = stderr
+				.split("\n")
+				.find((l) => l.startsWith("PYPATH:"));
+			expect(pypathLine).toBeDefined();
+			const pypath = (pypathLine ?? "").slice("PYPATH:".length);
+			expect(pypath).toContain(join(DEFAULT_BACKENDS_ROOT, "python-base"));
+		} finally {
+			await adapter.cleanupAll().catch(() => {});
 			try {
-				await adapter.init({});
-				const r = await adapter.navigate(
-					"https://example.com",
-					"pypath-t1",
-					30_000,
-				);
-				expect(r.success).toBe(true);
-				const stderr =
-					(adapter as unknown as Record<string, string>)[
-						"_stderrAccumulated"
-					] ?? "";
-				const pypathLine = stderr
-					.split("\n")
-					.find((l) => l.startsWith("PYPATH:"));
-				expect(pypathLine).toBeDefined();
-				const pypath = (pypathLine ?? "").slice("PYPATH:".length);
-				expect(pypath).toContain(join(DEFAULT_BACKENDS_ROOT, "python-base"));
-			} finally {
-				await adapter.cleanupAll().catch(() => {});
-				try {
-					rmSync(dir, { recursive: true, force: true });
-				} catch {
-					/* ignore */
-				}
+				rmSync(dir, { recursive: true, force: true });
+			} catch {
+				/* ignore */
 			}
-		});
-	},
-);
+		}
+	});
+});
 
 const describePersistence = PYTHON_AVAILABLE ? describe : describe.skip;
 

package/node_modules/pi-lean-portal/__tests__/router-dispatch.test.ts

@@ -64,19 +64,6 @@ describe("Router dispatch", () => {
 			expect(mock.calls.get("navigate")).toBeUndefined();
 		});
 
-		it("blocks SSRF URLs without calling the plugin", async () => {
-			const result = await router.navigate("http://localhost:8080/");
-			expect(result.success).toBe(false);
-			expect(result.error).toMatch(/blocked/i);
-			expect(mock.calls.get("navigate")).toBeUndefined();
-		});
-
-		it("blocks private IP ranges", async () => {
-			const result = await router.navigate("http://192.168.1.1/");
-			expect(result.success).toBe(false);
-			expect(result.error).toMatch(/blocked/i);
-		});
-
 		it("returns error for unknown strategy", async () => {
 			const result = await router.navigate("https://example.com", {
 				strategy: "nonexistent",
@@ -836,7 +823,7 @@ describe("bot detection UX", () => {
 		});
 	});
 
-	// ─── Profile-aware auto-recovery (Phase 7) ─────────────────
+	// ─── Profile-aware auto-recovery ────────────────────────────────
 	describe("profile-aware auto-recovery", () => {
 		it("restores profileName from lastNav on auto-creation", async () => {
 			await sessionManager.removeAll();

package/node_modules/pi-lean-portal/__tests__/run-contributed-suites.test.ts

@@ -11,8 +11,7 @@
  * invisible-py's lifecycle/deadlock tests) keep a hand-authored
  * file under ``__tests__/contributed/<name>-py/``.
  *
- * Gated by `CONTRIB_RUN === "1"` (the same env var Sprint 2 established
- * for the contributed MiniWoB parity helper).  No-op in bare CI (no
+ * Gated by `CONTRIB_RUN === "1"` (the same env var the contributed MiniWoB parity helper established).  No-op in bare CI (no
  * user-backends installed → discovered list empty → registers nothing)
  * and also no-op when `CONTRIB_RUN` is unset, so `npm run test:ci`
  * stays green with the file present even on a machine that has
@@ -20,8 +19,8 @@
  *
  * No stealth engine is **named** in this file.  Discovery is purely
  * runtime — whatever the user has installed under `user-backends/` is
- * what runs.  The shared suites own parametrized `it` titles (Sprint 1
- * mitigation) so a helper regression is attributable per-backend.
+ * what runs.  The shared suites own parametrized `it` titles so a helper
+ * regression is attributable per-backend.
  *
  * @module
  */
@@ -188,6 +187,21 @@ ${Array.from({ length: 80 }, (_, i) => `<p>Paragraph ${i + 1}: content to make t
 			// absent or has no matching entry, cfg stays {} (synthetic fallback).
 			const entry = pluginCfg?.plugins.find((p) => p.name === name);
 			const cfg = entry?.config ?? {};
+			// Camoufox ``152.0.4-beta.27+`` humanized-click motion makes
+			// ``locator.click(timeout=5s)`` flake/timeout and eats MiniWoB
+			// task budgets (~1.5s/click vs 10s task timers).  The contributed
+			// suite exercises the backend *contract*, not human-emulation
+			// stealth, so force ``launch.humanize=false`` for every discovered
+			// backend.  Real users keep the humanize=True default for
+			// evasion-sensitive browsing.
+			const launchOverride = {
+				...((cfg.launch as Record<string, unknown> | undefined) ?? {}),
+				humanize: false,
+			};
+			const testCfg: Record<string, unknown> = {
+				...cfg,
+				launch: launchOverride,
+			};
 			if (!entry) {
 				console.warn(
 					`[contributed-runner] ${name}: no settings entry — synthetic config`,
@@ -202,12 +216,12 @@ ${Array.from({ length: 80 }, (_, i) => `<p>Paragraph ${i + 1}: content to make t
 				new PythonPluginAdapter(`${name}-${idSuffix}`, {
 					bridgeScript: probe.bridgePath,
 					pythonPath:
-						typeof cfg.pythonPath === "string"
-							? cfg.pythonPath
+						typeof testCfg.pythonPath === "string"
+							? testCfg.pythonPath
 							: probe.venvPython,
-					capabilities: mergeCapabilities(cfg.capabilities),
-					...(typeof cfg.transportTimeoutMs === "number"
-						? { transportTimeoutMs: cfg.transportTimeoutMs }
+					capabilities: mergeCapabilities(testCfg.capabilities),
+					...(typeof testCfg.transportTimeoutMs === "number"
+						? { transportTimeoutMs: testCfg.transportTimeoutMs }
 						: {}),
 				});
 
@@ -232,7 +246,7 @@ ${Array.from({ length: 80 }, (_, i) => `<p>Paragraph ${i + 1}: content to make t
 					getServerUrl: () => serverUrl,
 					createPlugin: async () => {
 						const p = buildAdapter("persist");
-						await p.init(cfg);
+						await p.init(testCfg);
 						return p;
 					},
 				});
@@ -247,12 +261,13 @@ ${Array.from({ length: 80 }, (_, i) => `<p>Paragraph ${i + 1}: content to make t
 				registerContributedParitySuite({
 					name,
 					probe,
-					...(cfg.capabilities !== undefined
+					...(testCfg.capabilities !== undefined
 						? {
-								capabilities: cfg.capabilities as Partial<PluginCapabilities>,
+								capabilities:
+									testCfg.capabilities as Partial<PluginCapabilities>,
 							}
 						: {}),
-					config: cfg,
+					config: testCfg,
 					getBaseUrl: async () => miniwobBaseUrl,
 				});
 
@@ -269,7 +284,7 @@ ${Array.from({ length: 80 }, (_, i) => `<p>Paragraph ${i + 1}: content to make t
 				describe("quirks", () => {
 					beforeAll(async () => {
 						const p = buildAdapter("quirks");
-						await p.init(cfg);
+						await p.init(testCfg);
 						quirks_ = await p.describeQuirks();
 						await p.cleanupAll().catch(() => {});
 					});
@@ -277,7 +292,7 @@ ${Array.from({ length: 80 }, (_, i) => `<p>Paragraph ${i + 1}: content to make t
 					it("eval_prefix: evaluate('1 + 1') === 2", async () => {
 						if (!quirks_.eval_prefix) return;
 						const p = buildAdapter("quirks-eval");
-						await p.init(cfg);
+						await p.init(testCfg);
 						const nav = await p.navigate(
 							`${serverUrl}/simple`,
 							"quirks-eval",
@@ -293,7 +308,7 @@ ${Array.from({ length: 80 }, (_, i) => `<p>Paragraph ${i + 1}: content to make t
 					it("scroll_via_wheel: scroll moves the page", async () => {
 						if (!quirks_.scroll_via_wheel) return;
 						const p = buildAdapter("quirks-scroll");
-						await p.init(cfg);
+						await p.init(testCfg);
 						const nav = await p.navigate(
 							`${serverUrl}/scroll`,
 							"quirks-scroll",

package/node_modules/pi-lean-portal/__tests__/snapshot-cache.test.ts

@@ -1,5 +1,5 @@
 /**
- * Snapshot Disk Cache tests — Phase 1 of the browser-intelligence plan.
+ * Snapshot Disk Cache tests — disk-backed snapshot caching.
  *
  * All tests are browser-free — no Chromium needed.
  * Cleanup of temp files happens in afterEach.