browsertap-mcp 0.4.12__tar.gz

browsertap_mcp-0.4.12/.github/dependabot.yml

@@ -0,0 +1,28 @@
+# Only the GitHub Actions ecosystem is watched here, and that is a decision
+# rather than an omission.
+#
+# Every action in this repository is pinned to a commit SHA (see release.yml),
+# which is the right thing for a workflow holding `id-token: write` -- but a SHA
+# has no update channel, so without this file the pins simply age. Dependabot is
+# that channel.
+#
+# The Python side is deliberately absent. `supply-chain.yml` already audits the
+# real dependency closure with pip-audit and publishes an SBOM, and the upper
+# bounds in pyproject.toml's `dev` extra are load-bearing: they exist so that a
+# new ruff or pytest minor cannot move a gate number with no commit behind it.
+# A bot raising those bounds would undo exactly what they are for. Runtime
+# dependencies carry lower bounds on purpose too -- a user's resolver picks the
+# version, not this repository.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: monthly
+    open-pull-requests-limit: 3
+    commit-message:
+      prefix: chore
+    groups:
+      actions:
+        patterns:
+          - "*"

browsertap_mcp-0.4.12/.github/workflows/live.yml

@@ -0,0 +1,115 @@
+name: BTAP live Chrome gates
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: btap-live-browser
+  cancel-in-progress: false
+
+env:
+  BTAP_PYTHON: ${{ vars.BTAP_LIVE_PYTHON || 'python' }}
+
+jobs:
+  preflight:
+    # This job exists because the `live` job below cannot report its own missing
+    # prerequisite. A job whose `runs-on` labels match no online runner does not
+    # fail -- it queues, for up to 24 hours, and `timeout-minutes` governs
+    # execution time only, not queue time. So a "check the runner first" step
+    # placed inside `live` would never execute on the one path where it matters.
+    # Only a job that is guaranteed to start can say "there is no runner", which
+    # means a GitHub-hosted one.
+    #
+    # It gates on a repository variable rather than querying the runner API on
+    # purpose: listing self-hosted runners needs the Administration permission,
+    # which `permissions:` cannot grant to GITHUB_TOKEN, so an API check would
+    # need a long-lived PAT secret just to produce a better error message.
+    name: Check live prerequisites
+    if: github.repository == 'LinVireo/browsertap-mcp'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Require a registered self-hosted browser runner
+        if: vars.BTAP_LIVE_RUNNER != 'ready'
+        run: |
+          echo "::error title=No live runner registered::The live browser suite has no machine to run on; failing now instead of queueing."
+          cat <<'EOF'
+          The live suite drives a real Chrome window through the bridge and the
+          unpacked extension, so it only runs on a self-hosted Windows runner
+          that a maintainer owns. None is declared, and without one the `live`
+          job would sit in Queued for up to 24 hours and then expire -- which
+          reads as an infrastructure hiccup rather than as "this was never
+          configured".
+
+          To enable it:
+
+            1. Register a self-hosted runner on a Windows machine with Chrome,
+               the bridge and the unpacked extension already working. Give it the
+               labels: self-hosted Windows X64 btap
+            2. Optionally set the repository variable BTAP_LIVE_PYTHON to the
+               interpreter to use; it defaults to `python` on PATH.
+            3. Set the repository variable BTAP_LIVE_RUNNER to: ready
+               (Settings -> Secrets and variables -> Actions -> Variables)
+
+          The `btap-live` environment referenced by the live job is created by
+          GitHub on first use; add required reviewers there if a run should need
+          approval before it touches that desktop.
+
+          Until then, run the live gates locally:
+
+            python -m pytest tests/ -q -m live
+
+          and leave the browser idle while they run. The suite checks that for
+          itself now: it samples the tab list before the first test and skips the
+          whole live layer if anything moved, then compares the inventory again
+          at the end. CONTRIBUTING.md describes both checks and the override.
+          EOF
+          exit 1
+      - name: Report prerequisites satisfied
+        run: |
+          echo "BTAP_LIVE_RUNNER=ready; handing off to the self-hosted browser runner."
+          echo "Interpreter: ${BTAP_PYTHON}"
+
+  live:
+    name: Live Chrome verification
+    needs: preflight
+    environment: btap-live
+    runs-on: [self-hosted, Windows, X64, btap]
+    timeout-minutes: 10
+    steps:
+      - name: Check out source
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - name: Resolve configured Python
+        shell: powershell
+        run: |
+          $python = Get-Command $env:BTAP_PYTHON -ErrorAction Stop
+          "BTAP_PYTHON=$($python.Source)" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+      - name: Install editable package
+        shell: powershell
+        run: |
+          & $env:BTAP_PYTHON -m pip install -e ".[desktop,dev]"
+      - name: Verify bridge and extension diagnostics
+        shell: powershell
+        run: |
+          & $env:BTAP_PYTHON -c 'import json; from browsertap_mcp import server as S; s = S.get_setup_status(); print(json.dumps(s, ensure_ascii=False, indent=2, default=str)); raise SystemExit(2 if s.get("reload_extension_required") or s.get("restart_bridge_required") else 0)'
+      - name: Run live browser suite
+        shell: powershell
+        run: |
+          New-Item -ItemType Directory -Force artifacts | Out-Null
+          & $env:BTAP_PYTHON -m pytest tests -q -m live --junitxml=artifacts/live-junit.xml
+      - name: Recheck diagnostics after cleanup
+        if: always()
+        shell: powershell
+        run: |
+          New-Item -ItemType Directory -Force artifacts | Out-Null
+          & $env:BTAP_PYTHON -c "import json; from browsertap_mcp import server as S; print(json.dumps(S.get_setup_status(), ensure_ascii=False, indent=2, default=str))" | Out-File -Encoding utf8 artifacts/setup-status.json
+      - name: Upload live evidence
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: btap-live-evidence
+          path: artifacts/
+          if-no-files-found: ignore

browsertap_mcp-0.4.12/.github/workflows/release.yml

@@ -0,0 +1,175 @@
+name: BTAP publish to PyPI
+
+# Nothing here runs on a push. Publishing is a deliberate act with an
+# irreversible result -- a PyPI filename can never be reused, so a wrong upload
+# burns that version number for good -- so the only triggers are a manual run
+# and a published GitHub Release.
+on:
+  workflow_dispatch:
+    inputs:
+      index:
+        description: Which index to upload to
+        type: choice
+        default: testpypi
+        options:
+          - testpypi
+          - pypi
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: btap-publish
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: Build and check distributions
+    runs-on: ubuntu-latest
+    if: github.repository == 'LinVireo/browsertap-mcp'
+    timeout-minutes: 15
+    steps:
+      - name: Check out source
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          fetch-depth: 0
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: '3.13'
+          cache: pip
+      # The version being published comes from the source tree, not from the ref
+      # that started this run, so a tag left behind on an older commit would ship
+      # a tree nobody validated under that name. This is the cheapest step that
+      # can fail, so it runs before anything is installed or built.
+      # A TestPyPI rehearsal may legitimately run from a branch that is not tagged
+      # yet, so there a missing tag is a note -- but a tag that points somewhere
+      # else is still a failure.
+      - name: Check the release tag names this commit (rehearsal)
+        if: github.event_name == 'workflow_dispatch' && inputs.index == 'testpypi'
+        run: python -m scripts.check_release_tag --allow-missing-tag
+      - name: Check the release tag names this commit
+        if: github.event_name == 'release' || inputs.index == 'pypi'
+        run: python -m scripts.check_release_tag
+      - name: Install package and development dependencies
+        run: python -m pip install --upgrade pip && python -m pip install -e ".[dev,desktop]"
+      # A release must not ship a tree that fails its own gates. This is the
+      # offline suite only: the live-Chrome gates need a real browser and are a
+      # separate, self-hosted workflow.
+      - name: Run offline tests with coverage
+        run: >-
+          python -m pytest tests -q
+          --cov=browsertap_mcp
+          --cov-fail-under=85
+      - name: Check documentation and versions
+        run: python -m scripts.check_tool_docs --format markdown
+      - name: Build distributions
+        run: python -m build --wheel --sdist --outdir dist
+      # `check_distribution` reads what is inside the archives -- required files,
+      # no machine-local data, and the publishing metadata the index needs.
+      - name: Check distribution contents and metadata
+        run: python -m scripts.check_distribution dist
+      # And this is the other question a reader actually cares about: does a
+      # stranger's `pip install` leave them with something that runs. The wheel
+      # goes into a throwaway virtual environment with no repository on the path,
+      # and the console script, the packaged skills, and the extension files are
+      # exercised there rather than inferred from the archive listing.
+      - name: Check a clean install of the built wheel
+        run: python -m scripts.check_install dist
+      # `twine check` is the other half: it renders the long description the way
+      # the index will. Only a built archive can be checked this way, and only
+      # before the upload -- afterwards the version is spent.
+      - name: Check the rendered long description
+        run: python -m twine check --strict dist/*
+      # Supply-chain evidence for exactly what is about to be published: the
+      # dependency closure this wheel pulls onto a user's machine, audited against
+      # the advisory database, plus a CycloneDX SBOM of that same closure. Blocking
+      # on purpose, unlike the informational run in supply-chain.yml -- a
+      # known-vulnerable dependency is a reason not to publish, and this is the
+      # last point at which not publishing is still free.
+      - name: Audit and describe what the wheel installs
+        run: |
+          set -euo pipefail
+          python -m venv sbom-venv
+          ./sbom-venv/bin/python -m pip install --quiet --no-input dist/*.whl
+          ./sbom-venv/bin/python -m pip freeze --exclude-editable > runtime-requirements.txt
+          cat runtime-requirements.txt
+          # `pip freeze` lists the package under audit alongside its dependencies,
+          # and because it was installed from a local wheel it comes out as a PEP
+          # 610 direct reference -- `browsertap-mcp @ file:///.../*.whl#sha256=...`.
+          # `pip-audit --strict` then fails the whole run with "Dependency not found
+          # on PyPI and could not be audited", naming the exact version this
+          # workflow is about to upload, which by definition is not on the index
+          # yet. That made the first release of any name impossible to publish and
+          # went unnoticed because the same step does not block in
+          # supply-chain.yml. The subject of an audit is not one of its own
+          # dependencies, so it is dropped from the auditor's input -- after the
+          # full freeze has been printed above, so the wheel and its hash stay in
+          # the log as evidence. The SBOM below still describes the whole
+          # environment, package included, which is what an SBOM is for.
+          sed -i -E '/^browsertap[-_]mcp([[:space:]=@]|$)/d' runtime-requirements.txt
+          python -m pip install --quiet pip-audit==2.10.1 cyclonedx-bom==7.3.1
+          pip-audit --requirement runtime-requirements.txt --no-deps --strict --desc
+          mkdir -p sbom
+          python -m cyclonedx_py environment ./sbom-venv --spec-version 1.6 \
+            --output-format JSON --output-file sbom/browsertap-mcp.cdx.json
+      # A separate artifact, never dist/: the publish job uploads everything under
+      # dist/ to the index, and a stray .json there would either be rejected or
+      # published as part of the release.
+      - name: Upload the SBOM
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: btap-sbom
+          path: sbom/
+          if-no-files-found: error
+      # The version the archives carry is what the index will hold forever, so it
+      # is printed here rather than inferred from the tag by a reader later.
+      - name: Report the version being published
+        run: python -c "import pathlib; print('\n'.join(p.name for p in sorted(pathlib.Path('dist').iterdir())))"
+      - name: Upload built distributions
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: btap-dist
+          path: dist/
+          if-no-files-found: error
+
+  publish:
+    name: Upload to ${{ github.event_name == 'release' && 'pypi' || inputs.index }}
+    needs: build
+    runs-on: ubuntu-latest
+    # The environment is the approval gate: configure required reviewers on it so
+    # a human confirms before an upload that cannot be undone. It is also where
+    # the PyPI Trusted Publisher is scoped -- see CONTRIBUTING.md, "Publishing to
+    # PyPI", for the one-time setup this workflow assumes.
+    environment: ${{ github.event_name == 'release' && 'pypi' || inputs.index }}
+    permissions:
+      # Trusted Publishing exchanges this short-lived OIDC token for an upload
+      # token at request time. No API token is stored in the repository, so there
+      # is none to leak or rotate.
+      id-token: write
+    timeout-minutes: 15
+    steps:
+      - name: Download built distributions
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: btap-dist
+          path: dist/
+      # The only action here not pinned to a commit. PyPA publishes security and
+      # protocol fixes for Trusted Publishing onto this branch and asks callers
+      # to track it, and a stale pin on the one step holding `id-token: write`
+      # fails closed in the worst place -- a release that cannot upload. The
+      # trade-off is deliberate and asserted in tests/test_supply_chain.py, so
+      # adding a second floating action is a test failure rather than a habit.
+      - name: Publish to TestPyPI
+        if: github.event_name == 'workflow_dispatch' && inputs.index == 'testpypi'
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          print-hash: true
+      - name: Publish to PyPI
+        if: github.event_name == 'release' || inputs.index == 'pypi'
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          print-hash: true

browsertap_mcp-0.4.12/.github/workflows/supply-chain.yml

@@ -0,0 +1,132 @@
+name: BTAP supply chain
+
+# Two questions this repository could not answer before: did a credential ever
+# reach a commit, and what exactly does `pip install browsertap-mcp` pull onto a
+# stranger's machine. Both are answered here on every push and once a week --
+# weekly because an advisory can appear without a single line of this repository
+# changing.
+on:
+  push:
+  pull_request:
+  schedule:
+    # Monday morning, off the hour so it does not queue behind everyone's cron.
+    - cron: '17 6 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: supply-chain-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  secrets:
+    name: Secret scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check out source
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          # The whole point is the history: a secret that was committed and then
+          # deleted is still published. A shallow clone would scan one commit and
+          # report a clean repository.
+          fetch-depth: 0
+      - name: Install the pinned gitleaks build
+        env:
+          GITLEAKS_VERSION: 8.30.1
+          # sha256 of gitleaks_8.30.1_linux_x64.tar.gz, read out of that release's
+          # own checksums file. Version and digest are bumped together and never
+          # separately: a scanner resolved at run time is a third party that can
+          # change what it does to this repository between two green runs.
+          GITLEAKS_SHA256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
+        run: |
+          set -euo pipefail
+          base=https://github.com/gitleaks/gitleaks/releases/download
+          archive="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          curl --fail --silent --show-error --location --output gitleaks.tar.gz \
+            "${base}/v${GITLEAKS_VERSION}/${archive}"
+          echo "${GITLEAKS_SHA256}  gitleaks.tar.gz" | sha256sum --check --strict -
+          tar -xzf gitleaks.tar.gz gitleaks
+          ./gitleaks version
+      # --redact is not cosmetic: a scan report is world-readable build output, so
+      # printing the secret it found would publish the very thing it detected.
+      - name: Scan the full history for secrets
+        run: >-
+          ./gitleaks git . --no-banner --redact --exit-code 1
+          --report-format json --report-path gitleaks-history.json
+      - name: Scan the working tree for secrets
+        run: >-
+          ./gitleaks dir . --no-banner --redact --exit-code 1
+          --report-format json --report-path gitleaks-worktree.json
+      - name: Upload scan reports
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: btap-secret-scan
+          path: |
+            gitleaks-history.json
+            gitleaks-worktree.json
+          if-no-files-found: ignore
+
+  dependencies:
+    name: Dependency audit and SBOM
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Check out source
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: '3.13'
+          cache: pip
+      # The runtime closure, not this job's environment: development extras are
+      # not what a user installs, and auditing them would report risk nobody is
+      # exposed to while hiding nothing.
+      - name: Resolve the closure a plain install produces
+        run: |
+          set -euo pipefail
+          python -m venv runtime-venv
+          ./runtime-venv/bin/python -m pip install --quiet --upgrade pip
+          ./runtime-venv/bin/python -m pip install --quiet .
+          ./runtime-venv/bin/python -m pip freeze --exclude-editable > runtime-requirements.txt
+          cat runtime-requirements.txt
+          # The package itself is in that list, as a PEP 610 direct reference to
+          # the local checkout, and `pip-audit --strict` treats a requirement it
+          # cannot resolve on PyPI as a failure. Here the step is
+          # `continue-on-error`, so the job stayed green while the audit had in
+          # fact stopped -- the whole closure was going unaudited and the report
+          # said so to nobody. Same removal as release.yml, where it is fatal.
+          sed -i -E '/^browsertap[-_]mcp([[:space:]=@]|$)/d' runtime-requirements.txt
+      # Informational here, blocking in release.yml. An advisory published
+      # overnight would otherwise turn every branch red for a reason unrelated to
+      # the commit that is being pushed -- but it is a perfectly good reason not
+      # to publish a new version, which is where the same check is required.
+      - name: Audit the closure against the advisory database (informational)
+        continue-on-error: true
+        run: |
+          set -euo pipefail
+          python -m pip install --quiet pip-audit==2.10.1
+          pip-audit --requirement runtime-requirements.txt --no-deps --strict --desc \
+            --format markdown --output pip-audit.md
+          cat pip-audit.md
+      - name: Describe the closure as a CycloneDX SBOM
+        run: |
+          set -euo pipefail
+          python -m pip install --quiet cyclonedx-bom==7.3.1
+          mkdir -p sbom
+          python -m cyclonedx_py environment ./runtime-venv --spec-version 1.6 \
+            --output-format JSON --output-file sbom/browsertap-mcp.cdx.json
+          python -c "import json; print(len(json.load(open('sbom/browsertap-mcp.cdx.json')).get('components', [])), 'components described')"
+      - name: Upload the audit and the SBOM
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: btap-supply-chain
+          path: |
+            runtime-requirements.txt
+            pip-audit.md
+            sbom/
+          if-no-files-found: ignore

browsertap_mcp-0.4.12/.github/workflows/test.yml

@@ -0,0 +1,226 @@
+name: BTAP offline gates
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+# One in-flight run per ref. Re-pushing a branch cancels the previous run
+# instead of racing it, so the newest commit owns the gate result.
+concurrency:
+  group: offline-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  offline:
+    name: Python ${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ['3.10', '3.11', '3.12', '3.13']
+    steps:
+      - name: Check out source
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          fetch-depth: 0
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+      - name: Install package and development dependencies
+        run: python -m pip install --upgrade pip && python -m pip install -e ".[dev,desktop]"
+      - name: Check Python lint
+        if: matrix.python-version == '3.13'
+        run: python -m ruff check src tests scripts
+      - name: Compile Python sources
+        run: python -m compileall -q src
+      - name: Prepare evidence directory
+        run: mkdir -p artifacts
+      - name: Run offline tests with coverage
+        run: >-
+          python -m pytest tests -q
+          --cov=browsertap_mcp
+          --cov-fail-under=85
+          --cov-report=term-missing
+          --cov-report=xml
+          --cov-report=json:artifacts/coverage.json
+          --junitxml=artifacts/offline-junit.xml
+      - name: Check tool behavior coverage
+        run: >-
+          python -m scripts.tool_coverage_report --format markdown
+          --output artifacts/tool-coverage-offline.json
+      - name: Check documentation and versions
+        run: python -m scripts.check_tool_docs --format markdown
+      - name: Check SemVer bump on release branches
+        if: github.event_name == 'push' && startsWith(github.ref, 'refs/heads/release/') && github.event.before != '0000000000000000000000000000000000000000'
+        run: python -m scripts.versioning check-bump --base "${{ github.event.before }}"
+      - name: Build distributions
+        run: python -m build --wheel --sdist --outdir artifacts/dist
+      - name: Check distribution contents
+        run: python -m scripts.check_distribution artifacts/dist
+      # The other half of the same question: not what is inside the archive,
+      # but what a stranger has after `pip install`. Runs on every version in
+      # the matrix, because package data and console scripts are exactly what
+      # breaks on one interpreter and not another.
+      - name: Check a clean install of the built wheel
+        run: python -m scripts.check_install artifacts/dist
+      - name: Check installed dependency consistency
+        run: python -m pip check
+      # The evidence chain is only meaningful if something other than the release
+      # operator's own machine exercises it. CI seals the artifacts it just
+      # generated and immediately re-validates the seal, so a broken manifest
+      # writer or validator fails here rather than at release time. Committed
+      # artifacts are not used: `artifacts/` is gitignored, so this always runs
+      # against a clean checkout plus this run's own output.
+      - name: Seal and verify this run's evidence
+        if: matrix.python-version == '3.13'
+        run: >-
+          python -m scripts.evidence_manifest &&
+          python -m scripts.evidence_manifest --check
+      # Scored for visibility only. The live-Chrome gates cannot pass on a
+      # headless runner, so a non-zero exit is expected and must not fail the job.
+      - name: Score offline acceptance gates (informational)
+        if: matrix.python-version == '3.13'
+        continue-on-error: true
+        run: python -m scripts.acceptance_report --output artifacts/acceptance-report.md
+      - name: Upload gate artifacts
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: btap-offline-${{ matrix.python-version }}
+          path: artifacts/
+          if-no-files-found: ignore
+
+  # Every OS-specific failure this product has is a Windows one: wsgiref resets a
+  # rejected request that still has an unread body (so a 401 reaches the caller as
+  # a dropped connection), the host lock is `SO_EXCLUSIVEADDRUSE`, `pythonw.exe`
+  # is a forwarding stub whose child holds the port, a minimised window accepts
+  # focus calls that put nothing on screen, and a log file cannot be renamed while
+  # the daemon holds it open. The job above runs on Linux only, so none of that was
+  # ever exercised by CI -- and `bridge.py`, where most of it lives, is the least
+  # covered module in the package. Oldest and newest interpreter only: this is
+  # about the platform, and the version matrix is already covered above.
+  windows-offline:
+    name: Windows offline (Python ${{ matrix.python-version }})
+    runs-on: windows-latest
+    timeout-minutes: 20
+    defaults:
+      run:
+        # Deliberately the same shell as the Linux job. `mkdir -p` and the folded
+        # multi-line commands below are POSIX, and a step whose text differs
+        # between the two jobs stops being a comparison of the platform.
+        shell: bash
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ['3.10', '3.13']
+    steps:
+      - name: Check out source
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+      - name: Install package and development dependencies
+        run: python -m pip install --upgrade pip && python -m pip install -e ".[dev,desktop]"
+      - name: Compile Python sources
+        run: python -m compileall -q src
+      - name: Prepare evidence directory
+        run: mkdir -p artifacts
+      # No coverage gate here: the threshold is enforced once, on Linux, and a
+      # second instrumented run would only add wall clock. The junit file is kept
+      # because which test failed on Windows is the whole point of this job.
+      - name: Run offline tests
+        run: >-
+          python -m pytest tests -q
+          --junitxml=artifacts/windows-offline-junit.xml
+      # What a stranger has after `pip install` on the platform most of this
+      # product's users run, where the console script is a generated .exe rather
+      # than a shebang. Newest interpreter only, to keep the job short.
+      - name: Build distributions
+        if: matrix.python-version == '3.13'
+        run: python -m build --wheel --sdist --outdir artifacts/dist
+      - name: Check distribution contents
+        if: matrix.python-version == '3.13'
+        run: python -m scripts.check_distribution artifacts/dist
+      - name: Check a clean install of the built wheel
+        if: matrix.python-version == '3.13'
+        run: python -m scripts.check_install artifacts/dist
+      - name: Check installed dependency consistency
+        run: python -m pip check
+      - name: Upload gate artifacts
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: btap-windows-offline-${{ matrix.python-version }}
+          path: artifacts/
+          if-no-files-found: ignore
+
+  # The third platform, and the only one with no coverage at all until now. Two
+  # code paths in this package exist solely for it -- `_macos_pointer_position`
+  # reads the cursor through Quartz, and `_darwin_process_identity` is how the
+  # bridge decides whether the PID in its lock file is still the daemon it wrote
+  # -- and neither had ever been executed by anything but a reviewer's eyes. The
+  # quiet-input gate also degrades here rather than on Windows: macOS answers the
+  # pointer read only once someone grants the accessibility permission, which a
+  # hosted runner never does, so this job is where `input_quiet.enforced: false`
+  # is actually produced instead of merely documented. Oldest and newest
+  # interpreter only, same as Windows: this is about the platform.
+  macos-offline:
+    name: macOS offline (Python ${{ matrix.python-version }})
+    runs-on: macos-latest
+    timeout-minutes: 20
+    defaults:
+      run:
+        # Same shell as the other two jobs on purpose; a step whose text differs
+        # between them stops being a comparison of the platform.
+        shell: bash
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ['3.10', '3.13']
+    steps:
+      - name: Check out source
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+      - name: Install package and development dependencies
+        run: python -m pip install --upgrade pip && python -m pip install -e ".[dev,desktop]"
+      - name: Compile Python sources
+        run: python -m compileall -q src
+      - name: Prepare evidence directory
+        run: mkdir -p artifacts
+      # No coverage gate here either: the threshold is enforced once, on Linux.
+      - name: Run offline tests
+        run: >-
+          python -m pytest tests -q
+          --junitxml=artifacts/macos-offline-junit.xml
+      # Console scripts and package data on the third platform. Newest
+      # interpreter only, to keep the job short.
+      - name: Build distributions
+        if: matrix.python-version == '3.13'
+        run: python -m build --wheel --sdist --outdir artifacts/dist
+      - name: Check distribution contents
+        if: matrix.python-version == '3.13'
+        run: python -m scripts.check_distribution artifacts/dist
+      - name: Check a clean install of the built wheel
+        if: matrix.python-version == '3.13'
+        run: python -m scripts.check_install artifacts/dist
+      - name: Check installed dependency consistency
+        run: python -m pip check
+      - name: Upload gate artifacts
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: btap-macos-offline-${{ matrix.python-version }}
+          path: artifacts/
+          if-no-files-found: ignore