flowproof 0.2.3__tar.gz → 0.2.5__tar.gz

{flowproof-0.2.3 → flowproof-0.2.5}/Cargo.lock

@@ -722,7 +722,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-adapters"
-version = "0.2.3"
+version = "0.2.5"
 dependencies = [
  "anyhow",
  "flowproof-driver",
@@ -738,7 +738,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-agent"
-version = "0.2.3"
+version = "0.2.5"
 dependencies = [
  "chrono",
  "flowproof-driver",
@@ -753,7 +753,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-cli"
-version = "0.2.3"
+version = "0.2.5"
 dependencies = [
  "ab_glyph",
  "clap",
@@ -771,7 +771,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-driver"
-version = "0.2.3"
+version = "0.2.5"
 dependencies = [
  "image",
  "postgres",
@@ -785,7 +785,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-python"
-version = "0.2.3"
+version = "0.2.5"
 dependencies = [
  "flowproof-agent",
  "flowproof-cli",
@@ -797,7 +797,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-replay"
-version = "0.2.3"
+version = "0.2.5"
 dependencies = [
  "chrono",
  "flowproof-agent",
@@ -811,7 +811,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-trace"
-version = "0.2.3"
+version = "0.2.5"
 dependencies = [
  "jsonschema",
  "serde",

{flowproof-0.2.3 → flowproof-0.2.5}/Cargo.toml

@@ -3,7 +3,7 @@ resolver = "2"
 members = ["crates/flowproof-driver", "crates/flowproof-trace", "crates/flowproof-replay", "crates/flowproof-agent", "crates/flowproof-adapters", "crates/flowproof-cli", "crates/flowproof-python"]
 
 [workspace.package]
-version = "0.2.3"
+version = "0.2.5"
 edition = "2021"
 license = "Apache-2.0"
 repository = "https://github.com/automators-com/flowproof"

{flowproof-0.2.3 → flowproof-0.2.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: flowproof
-Version: 0.2.3
+Version: 0.2.5
 Classifier: Development Status :: 2 - Pre-Alpha
 Classifier: Intended Audience :: Developers
 Classifier: Programming Language :: Python :: 3

{flowproof-0.2.3 → flowproof-0.2.5}/crates/flowproof-adapters/src/web.rs

@@ -19,16 +19,64 @@ use crate::AdapterError;
 
 const FIND_TIMEOUT: Duration = Duration::from_secs(5);
 
+/// Wrap a browser-driver failure. Transport faults (a dead CDP websocket,
+/// a dropped event) are classified apart from app observations: an
+/// assertion polling inside its recorded wait budget tolerates the former
+/// as a miss, because a call that never reached the page learned nothing
+/// about it.
 fn web_err(context: &str, err: impl std::fmt::Display) -> DriverError {
-    DriverError::Uia(format!("web: {context}: {err}"))
+    let message = format!("{context}: {err}");
+    if is_transport_fault(&message) {
+        DriverError::Transport(message)
+    } else {
+        DriverError::Browser(message)
+    }
 }
 
+/// How long the CDP transport may sit without a BROWSER-level event before
+/// headless_chrome reaps its listener thread. Its default is 30 seconds,
+/// which is a live grenade for real test flows:
+///
+/// 1. a flow spends 30+ seconds doing page-level work (typing, polling an
+///    auto-waiting assertion) without producing a single browser-level
+///    event, so the listener thread times out and exits;
+/// 2. the next navigation fires `TargetInfoChanged` - a browser-level
+///    event - and the transport cannot deliver it to the receiver that
+///    just went away;
+/// 3. it treats that undeliverable event as fatal, shuts the whole message
+///    loop down, and every later call fails with "Unable to make method
+///    calls because underlying connection is closed", permanently.
+///
+/// That is the entire mechanism behind the round-3 field blocker: EVERY
+/// flow that logged in recorded fine and then failed to replay, because
+/// the login redirect is exactly a post-idle navigation. Silence is not
+/// evidence of a dead browser - a browser that actually dies closes the
+/// socket, which surfaces immediately and through a different path.
+///
+/// Choosing the value is a genuine trade-off, because headless_chrome
+/// OVERLOADS this one knob across three jobs with opposite needs:
+///
+/// - `Browser`'s event-listener reap and the transport's idle reap want it
+///   LONG (that is the bug above);
+/// - `Transport::call_method` uses it as the bound on waiting for a call's
+///   RESPONSE, which wants it SHORT: a response that never arrives blocks
+///   for exactly this long. Setting it to "effectively never" turned a
+///   failing CI job into one that hung for over three hours.
+///
+/// So: comfortably longer than any real gap between browser-level events
+/// (the field flows idled 30-90 s; `Wait until` defaults to a 60 s bound),
+/// and short enough that a lost response fails visibly instead of hanging.
+/// A flow that deliberately waits longer than this in one step without
+/// touching the browser is the case to revisit if it ever shows up.
+const BROWSER_IDLE_TIMEOUT: Duration = Duration::from_secs(300);
+
 /// Launch a fresh headless Chromium (`CHROME` env var overrides the
 /// binary), optionally with extra command-line flags.
 fn launch_browser(extra_args: &[String]) -> Result<Browser, AdapterError> {
     let os_args: Vec<std::ffi::OsString> = extra_args.iter().map(Into::into).collect();
     let mut options = LaunchOptions::default_builder();
     options.headless(true).sandbox(false);
+    options.idle_browser_timeout(BROWSER_IDLE_TIMEOUT);
     options.args(os_args.iter().map(AsRef::as_ref).collect());
     if let Ok(path) = std::env::var("CHROME") {
         options.path(Some(path.into()));
@@ -210,7 +258,7 @@ impl WebAppDriver {
     fn tab(&self) -> Result<&Arc<Tab>, DriverError> {
         self.tab
             .as_ref()
-            .ok_or_else(|| DriverError::Uia("web: no page open: call launch first".into()))
+            .ok_or_else(|| DriverError::Browser("no page open: call launch first".into()))
     }
 
     fn locator_of(selector: &UiaSelector) -> Option<WebLocator> {
@@ -234,8 +282,8 @@ impl WebAppDriver {
 
     fn locator(selector: &UiaSelector) -> Result<WebLocator, DriverError> {
         Self::locator_of(selector).ok_or_else(|| {
-            DriverError::Uia(format!(
-                "web: selector [{selector}] has no css, automation_id, or text"
+            DriverError::Browser(format!(
+                "selector [{selector}] has no css, automation_id, or text"
             ))
         })
     }
@@ -279,7 +327,7 @@ impl WebAppDriver {
                 return Ok(element);
             }
             if std::time::Instant::now() >= deadline {
-                return Err(DriverError::Uia(format!("web: no element for {locator}")));
+                return Err(DriverError::Browser(format!("no element for {locator}")));
             }
             std::thread::sleep(Duration::from_millis(100));
         }
@@ -473,8 +521,8 @@ impl AppDriver for WebAppDriver {
         // isolated), paying its cold start instead of sharing.
         if let Some(config) = &staged_browser {
             if !config.args.is_empty() {
-                self.browser =
-                    launch_browser(&config.args).map_err(|e| DriverError::Uia(e.to_string()))?;
+                self.browser = launch_browser(&config.args)
+                    .map_err(|e| DriverError::Browser(e.to_string()))?;
                 self.context_id = None;
             }
         }
@@ -667,6 +715,17 @@ impl AppDriver for WebAppDriver {
         Ok(Some(flowproof_driver::DebugBundle { dom_html, console }))
     }
 
+    fn current_url(&mut self) -> Result<String, DriverError> {
+        let value = self
+            .tab()?
+            .evaluate("window.location.href", false)
+            .map_err(|e| web_err("reading page url", e))?;
+        Ok(value
+            .value
+            .and_then(|v| v.as_str().map(str::to_string))
+            .unwrap_or_default())
+    }
+
     fn surface_text(&mut self) -> Result<String, DriverError> {
         // Visible text PLUS the accessible names of visible elements:
         // icon-only buttons (a command palette, an account menu) exist on
@@ -764,6 +823,15 @@ impl AppDriver for WebAppDriver {
         let locator = Self::locator(selector)?;
         let value =
             self.with_element(&locator, &format!("hit-testing [{selector}]"), |element| {
+                // Scroll first, exactly as the click itself will: headless
+                // chrome's `Element::click` begins with `scroll_into_view`,
+                // so hit-testing before scrolling asks about a position the
+                // click will never use. An element below the fold then reads
+                // as "obscured" - `elementFromPoint` outside the viewport
+                // returns null - and the gate blocks a click that would have
+                // worked. A whole settings form under the fold was
+                // untestable this way (field report, round 3).
+                element.scroll_into_view()?;
                 // Playwright's obscured check: does elementFromPoint at the
                 // element's center resolve to it (or a relative)? A toast or
                 // modal backdrop on top makes the click land elsewhere.
@@ -1035,7 +1103,7 @@ impl AppDriver for WebAppDriver {
         let json = value
             .value
             .and_then(|v| v.as_str().map(str::to_string))
-            .ok_or_else(|| DriverError::Uia("web: scene script returned no value".into()))?;
+            .ok_or_else(|| DriverError::Browser("scene script returned no value".into()))?;
         Ok(Some(json))
     }
 

{flowproof-0.2.3 → flowproof-0.2.5}/crates/flowproof-agent/src/recorder.rs

@@ -334,6 +334,8 @@ fn step_for(id: usize, intent: &str, app: &str, action: &ResolvedAction) -> Step
                 TextMatch::NumericEquals => {
                     serde_json::json!({ "value_equals": expected, "normalize": "numeric" })
                 }
+                TextMatch::UrlEquals => serde_json::json!({ "url_equals": expected }),
+                TextMatch::UrlContains => serde_json::json!({ "url_contains": expected }),
             };
             expect["timeout_ms"] = serde_json::json!(timeout_ms);
             let selectors = selectors_for(app, target, None);
@@ -896,15 +898,36 @@ fn poll_oob(
 }
 
 fn assert_holds(actual: &str, expected: &str, matcher: TextMatch) -> bool {
+    // Case-insensitive FALLBACK, mirroring element anchors: an exact
+    // match always wins; when it misses, lowercased comparison decides
+    // ("page shows Close Account" against a page reading "Close
+    // account").
+    //
+    // Widening-only, and it must stay byte-identical to replay's
+    // `text_matches`: if record and replay disagree about a single
+    // assertion, record mints a trace that cannot replay - the exact
+    // failure mode the round-3 field run was built to catch. The negative
+    // form therefore does NOT take the fallback (widening it would fail
+    // traces that used to pass), and a nonzero case-sensitive count is
+    // the count.
+    let (actual_ci, expected_ci) = (actual.to_lowercase(), expected.to_lowercase());
     match matcher {
-        TextMatch::Contains => actual.contains(expected),
+        TextMatch::Contains => actual.contains(expected) || actual_ci.contains(&expected_ci),
         TextMatch::NotContains => !actual.contains(expected),
-        TextMatch::CountEquals(n) => actual.matches(expected).count() as u64 == n,
-        TextMatch::Equals => actual == expected,
+        TextMatch::CountEquals(n) => {
+            let sensitive = actual.matches(expected).count() as u64;
+            sensitive == n
+                || (sensitive == 0 && actual_ci.matches(&expected_ci).count() as u64 == n)
+        }
+        TextMatch::Equals => actual == expected || actual_ci == expected_ci,
         TextMatch::NumericEquals => matches!(
             (flowproof_driver::numeric_value(actual), expected.parse::<f64>()),
             (Some(a), Ok(e)) if a == e
         ),
+        // Shared with replay so record and replay cannot drift: a URL
+        // assertion that holds while recording must hold when replayed.
+        TextMatch::UrlEquals => flowproof_driver::url_matches(expected, true, actual),
+        TextMatch::UrlContains => flowproof_driver::url_matches(expected, false, actual),
     }
 }
 
@@ -1237,13 +1260,18 @@ pub fn record_with_reuse<D: AppDriver, C: ModelClient>(
                     let wanted = flowproof_trace::secret::resolve_refs(expected)?;
                     let deadline = std::time::Instant::now() + Duration::from_millis(*timeout_ms);
                     loop {
-                        let actual = if selector.is_none() {
-                            Some(driver.surface_text()?)
-                        } else if driver.element_exists(targeted())? {
-                            Some(driver.read_text(targeted())?)
-                        } else {
-                            None
-                        };
+                        let actual =
+                            if matches!(matcher, TextMatch::UrlEquals | TextMatch::UrlContains) {
+                                // The URL is a different reading of the surface,
+                                // not a different target: same poll, same bound.
+                                Some(driver.current_url()?)
+                            } else if selector.is_none() {
+                                Some(driver.surface_text()?)
+                            } else if driver.element_exists(targeted())? {
+                                Some(driver.read_text(targeted())?)
+                            } else {
+                                None
+                            };
                         if let Some(actual) = &actual {
                             if assert_holds(actual, &wanted, *matcher) {
                                 break;

{flowproof-0.2.3 → flowproof-0.2.5}/crates/flowproof-agent/src/rules.rs

@@ -164,6 +164,12 @@ pub enum TextMatch {
     Equals,
     /// Compare the trailing numeric value instead of raw text.
     NumericEquals,
+    /// The surface's URL equals the expectation - `page url is /signin`.
+    /// See `url_matches` in flowproof-replay for what "equals" means for a
+    /// path, a path with a query, and a whole URL.
+    UrlEquals,
+    /// The surface's URL contains the expectation - `page url contains x`.
+    UrlContains,
 }
 
 /// Default auto-wait for assertions (Playwright's expect default).
@@ -175,11 +181,13 @@ pub const WAIT_STEP_TIMEOUT_MS: u64 = 60_000;
 /// Parse a trailing `within <N>s` / `within <N> seconds` qualifier off a
 /// step, returning (rest, timeout override).
 fn split_within(text: &str) -> (&str, Option<u64>) {
-    let lower = text.to_lowercase();
-    let Some(pos) = lower.rfind(" within ") else {
+    // rfind_ci returns indices valid in `text` itself — never positions
+    // from a lowercased copy, whose byte offsets can differ.
+    let Some(pos) = rfind_ci(text, " within ") else {
         return (text, None);
     };
-    let qualifier = lower[pos + " within ".len()..].trim();
+    let qualifier = text[pos + " within ".len()..].trim().to_lowercase();
+    let qualifier = qualifier.as_str();
     let digits = qualifier
         .strip_suffix(" seconds")
         .or_else(|| qualifier.strip_suffix(" second"))
@@ -207,29 +215,68 @@ fn unresolvable(step: &str, reason: impl Into<String>) -> RulesError {
 }
 
 /// Case-insensitively strip an ASCII `prefix`, returning the rest of the
-/// ORIGINAL string (case preserved).
+/// ORIGINAL string (case preserved). Boundary-safe: `get` returns None
+/// when the cut would split a multibyte char, and an ASCII prefix cannot
+/// match across one — so "no match" is the correct answer, never a panic.
 fn strip_prefix_ci<'a>(text: &'a str, prefix: &str) -> Option<&'a str> {
-    if text.len() >= prefix.len() && text[..prefix.len()].eq_ignore_ascii_case(prefix) {
-        Some(&text[prefix.len()..])
-    } else {
-        None
-    }
+    let head = text.get(..prefix.len())?;
+    head.eq_ignore_ascii_case(prefix)
+        .then(|| &text[prefix.len()..])
 }
 
 /// Case-insensitively strip an ASCII `suffix`, returning the front of the
-/// ORIGINAL string (case preserved).
+/// ORIGINAL string (case preserved). Boundary-safe like `strip_prefix_ci`:
+/// `text.len() - suffix.len()` is a byte offset that can land inside a
+/// multibyte char (`4 × 5=20` with suffix ` times`), which must mean "no
+/// match", not a slice panic — the 0.2.3 escape.
 fn strip_suffix_ci<'a>(text: &'a str, suffix: &str) -> Option<&'a str> {
-    if text.len() >= suffix.len() && text[text.len() - suffix.len()..].eq_ignore_ascii_case(suffix)
-    {
-        Some(&text[..text.len() - suffix.len()])
-    } else {
-        None
-    }
+    let split = text.len().checked_sub(suffix.len())?;
+    let tail = text.get(split..)?;
+    tail.eq_ignore_ascii_case(suffix).then(|| &text[..split])
+}
+
+/// Byte index of the last case-insensitive occurrence of ASCII `needle`
+/// in `text`, ALWAYS valid for slicing `text` itself. The
+/// `text.to_lowercase().find(…)` idiom is the sibling of the slice-panic
+/// bug: lowercasing can change byte lengths (e.g. 'İ' grows), so an index
+/// found in the copy is not an index into the original.
+fn rfind_ci(text: &str, needle: &str) -> Option<usize> {
+    ci_positions(text, needle).last()
+}
+
+fn ci_positions<'a>(text: &'a str, needle: &'a str) -> impl Iterator<Item = usize> + 'a {
+    text.char_indices().map(|(i, _)| i).filter(move |&i| {
+        text.get(i..i + needle.len())
+            .is_some_and(|window| window.eq_ignore_ascii_case(needle))
+    })
 }
 
 /// Resolve one spec step into concrete actions for `app`. Out-of-band
 /// assertions are app-independent — they never touch the UI at all.
+///
+/// NEVER panics: a panic inside parsing (the 0.2.2/0.2.3 multibyte
+/// slice bugs were this class) is caught and degraded to a clean
+/// `Unresolvable` error naming the step — one bad step must fail one
+/// step, not abort the whole suite. The specific known sites are fixed;
+/// this is the backstop for the variant nobody has written yet.
 pub fn resolve_step(app: &str, step: &SpecStep) -> Result<Vec<ResolvedAction>, RulesError> {
+    std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+        resolve_step_inner(app, step)
+    }))
+    .unwrap_or_else(|panic| {
+        let detail = panic
+            .downcast_ref::<String>()
+            .map(String::as_str)
+            .or_else(|| panic.downcast_ref::<&str>().copied())
+            .unwrap_or("unknown panic");
+        Err(unresolvable(
+            &step.intent(),
+            format!("internal parser error ({detail}) — please report this step text"),
+        ))
+    })
+}
+
+fn resolve_step_inner(app: &str, step: &SpecStep) -> Result<Vec<ResolvedAction>, RulesError> {
     match step {
         SpecStep::AssertSql { assert_sql } => {
             return Ok(vec![ResolvedAction::AssertSql {
@@ -410,6 +457,35 @@ mod assertions {
             .unwrap_or(std::borrow::Cow::Borrowed(trimmed));
         let trimmed = trimmed.as_ref();
 
+        // `page url is <expected>` / `page url contains <text>`. Checked
+        // BEFORE `page shows`, and both auto-wait like every other
+        // assertion: an SPA redirect lands asynchronously, so a
+        // non-waiting URL assert would be the grammar's only racy form.
+        if let Some(rest) = strip_prefix_ci(trimmed, "page url is ") {
+            let expected = rest.trim();
+            if expected.is_empty() {
+                return Err(unresolvable(trimmed, "no expected url"));
+            }
+            return Ok(vec![ResolvedAction::AssertText {
+                target: Target::Surface,
+                expected: expected.to_string(),
+                matcher: TextMatch::UrlEquals,
+                timeout_ms,
+            }]);
+        }
+        if let Some(rest) = strip_prefix_ci(trimmed, "page url contains ") {
+            let expected = rest.trim();
+            if expected.is_empty() {
+                return Err(unresolvable(trimmed, "no expected url"));
+            }
+            return Ok(vec![ResolvedAction::AssertText {
+                target: Target::Surface,
+                expected: expected.to_string(),
+                matcher: TextMatch::UrlContains,
+                timeout_ms,
+            }]);
+        }
+
         if let Some(rest) = strip_prefix_ci(trimmed, "page shows ") {
             let (expected, count) = split_count(rest.trim());
             if expected.is_empty() {
@@ -522,7 +598,8 @@ mod assertions {
 
         Err(unresolvable(
             trimmed,
-            "expected '[the ]page shows <text>[ N times]', '[the ]page does not show \
+            "expected '[the ]page shows <text>[ N times]', '[the ]page url is|contains \
+             <url>', '[the ]page does not show \
              <text>', 'the \"<label>\" field contains <text>', 'the \"<target>\" shows \
              <text>', 'the \"<target>\" is [not] visible', or 'the \"<target>\" is \
              enabled|disabled' (see docs/authoring.md for the full grammar)",
@@ -796,8 +873,7 @@ mod web {
         // `css:` selector) target; `Type <text> into the <id> field` →
         // `#<id>`; bare `Type <text>` → the focused element.
         if let Some(rest) = strip_prefix_ci(trimmed, "type ") {
-            let lower = rest.to_lowercase();
-            let Some(pos) = lower.rfind(" into the ") else {
+            let Some(pos) = rfind_ci(rest, " into the ") else {
                 let value = rest.trim();
                 if value.is_empty() {
                     return Err(unresolvable(trimmed, "nothing to type"));
@@ -842,8 +918,7 @@ mod web {
         // file-chooser input. The path is stored as written; relative paths
         // resolve against the working directory at execution time.
         if let Some(rest) = strip_prefix_ci(trimmed, "upload ") {
-            let lower = rest.to_lowercase();
-            if let Some(pos) = lower.rfind(" into the ") {
+            if let Some(pos) = rfind_ci(rest, " into the ") {
                 let path = rest[..pos].trim().trim_matches('"');
                 let field = rest[pos + " into the ".len()..].trim();
                 if path.is_empty() {
@@ -882,11 +957,9 @@ mod web {
         // option its own way (the web driver goes through the select's
         // native value setter and fires input+change).
         if let Some(rest) = strip_prefix_ci(trimmed, "select ") {
-            let lower = rest.to_lowercase();
-            let split = lower
-                .rfind(" from the ")
+            let split = rfind_ci(rest, " from the ")
                 .map(|p| (p, " from the ".len()))
-                .or_else(|| lower.rfind(" in the ").map(|p| (p, " in the ".len())));
+                .or_else(|| rfind_ci(rest, " in the ").map(|p| (p, " in the ".len())));
             if let Some((pos, sep_len)) = split {
                 let value = rest[..pos].trim();
                 let (nth, field) = split_ordinal(rest[pos + sep_len..].trim());
@@ -1930,3 +2003,105 @@ mod tests {
         );
     }
 }
+
+#[cfg(test)]
+mod multibyte_tests {
+    use super::*;
+
+    /// The 0.2.2 and 0.2.3 field escapes were both char-boundary slice
+    /// panics on multibyte step text. Sweep every grammar form with a
+    /// zoo of multibyte content — with and without `=`, which is what
+    /// pushed the 0.2.3 variant past the suffix-strip boundary — and
+    /// require that EVERY step either resolves or fails cleanly. A panic
+    /// here is the bug, regardless of which slice site regressed.
+    #[test]
+    fn multibyte_step_text_never_panics_across_the_grammar() {
+        const ZOO: &[&str] = &["×", "÷", "é", "café", "測試", "🚀", "İstanbul"];
+        let mut cases: Vec<(String, String)> = Vec::new();
+        for chunk in ZOO {
+            for tail in ["", "=20", "=x", " = 5"] {
+                let payload = format!("4 {chunk} 5{tail}");
+                for step in [
+                    format!("page shows {payload}"),
+                    format!("page shows {payload} 2 times"),
+                    format!("page does not show {payload}"),
+                    format!("Wait until page shows {payload} within 5s"),
+                    format!("Type {payload} into the \"Name\" field"),
+                    format!("Type {payload}"),
+                    format!("Replace the \"Name\" field with {payload}"),
+                    format!("Select {payload} from the \"Kind\" field"),
+                    format!("Upload {payload} into the \"File\" field"),
+                    format!("Click \"{payload}\""),
+                    format!("Right-click \"{payload}\""),
+                    format!("Press the \"{payload}\" button"),
+                    format!("the \"{payload}\" shows {payload}"),
+                    format!("the \"Name\" field contains {payload}"),
+                    payload.clone(),
+                ] {
+                    cases.push((step, payload.clone()));
+                }
+            }
+        }
+        for (step_text, _payload) in &cases {
+            for kind in [
+                SpecStep::Plain(step_text.clone()),
+                SpecStep::Assert {
+                    assert: step_text.clone(),
+                },
+            ] {
+                // Ok or Err are both fine — only a panic is a failure.
+                let _ = resolve_step("web", &kind);
+                let _ = resolve_step("vision", &kind);
+            }
+        }
+    }
+
+    /// The exact 0.2.3 field repro, pinned: multibyte char followed
+    /// later by `=` must resolve as a surface-text assertion.
+    #[test]
+    fn multibyte_with_equals_resolves_as_page_shows() {
+        for text in ["page shows 4 × 5=20", "page shows a × b=c"] {
+            let step = SpecStep::Assert {
+                assert: text.to_string(),
+            };
+            let actions = resolve_step("web", &step).expect("resolves cleanly");
+            match &actions[0] {
+                ResolvedAction::AssertText {
+                    expected, matcher, ..
+                } => {
+                    assert_eq!(
+                        expected,
+                        text.strip_prefix("page shows ").expect("test constant")
+                    );
+                    assert_eq!(*matcher, TextMatch::Contains);
+                }
+                other => panic!("expected surface AssertText, got {other:?}"),
+            }
+        }
+        // The counting form survives multibyte too (its ` times` suffix
+        // strip was the 0.2.3 panic site).
+        let step = SpecStep::Assert {
+            assert: "page shows 4 × 5=20 2 times".into(),
+        };
+        let actions = resolve_step("web", &step).expect("resolves cleanly");
+        assert!(matches!(
+            &actions[0],
+            ResolvedAction::AssertText {
+                matcher: TextMatch::CountEquals(2),
+                ..
+            }
+        ));
+    }
+
+    /// The backstop: even if a future slice bug panics inside parsing,
+    /// the caller gets a clean error, not a dead suite.
+    #[test]
+    fn parser_panics_degrade_to_clean_errors() {
+        // No known panicking input exists anymore (that is the point of
+        // the fixes), so prove the mechanism directly.
+        let caught = std::panic::catch_unwind(|| {
+            resolve_step("web", &SpecStep::Plain("page shows anything".into()))
+        });
+        assert!(caught.is_ok(), "resolve_step must never unwind");
+    }
+}