From 182ffb542aa24b181f2fe9e004dab16539a8f2cc Mon Sep 17 00:00:00 2001 From: clagentic <10177887+akuehner@users.noreply.github.com> Date: Thu, 11 Jun 2026 09:11:02 -0400 Subject: [PATCH 1/5] fix(xss): escape quote chars in sticky-note renderer before URL auto-linking MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The prior fix (lr-7b07 / PR #220) correctly excluded " and ' from the URL-match regex, so the URL itself is safely truncated. However, non-URL text surrounding the URL was only escaping &, <, and > — leaving raw " and ' in the output. A crafted note like `http://x.com"onmouseover="alert(1)` would produce correct href truncation but leave `"onmouseover="alert(1)` as raw unescaped text in the rendered HTML. Fix: rewrite fmt() in both sticky-notes.js and sticky-notes-fmt.js to split on raw URLs first (before any escaping), then HTML-escape all segments fully (including " → " and ' → '), then wrap URL segments in anchors. This ensures quote chars always terminate URL matches and never appear raw in rendered output regardless of position. Fixes the two failing regression tests in test/xss-escape.test.js (232, 233). Co-Authored-By: Claude Sonnet 4.6 --- lib/public/modules/sticky-notes-fmt.js | 41 +++++++++++++++++++++----- lib/public/modules/sticky-notes.js | 28 ++++++++++++++---- 2 files changed, 56 insertions(+), 13 deletions(-) diff --git a/lib/public/modules/sticky-notes-fmt.js b/lib/public/modules/sticky-notes-fmt.js index 20df067..b524690 100644 --- a/lib/public/modules/sticky-notes-fmt.js +++ b/lib/public/modules/sticky-notes-fmt.js @@ -7,13 +7,41 @@ // sticky-notes.js (it is browser-ESM with DOM deps). This module mirrors its exact // implementation so that the regression tests call the real production logic pattern. // Any change to fmt() in sticky-notes.js must be reflected here. -export function fmt(s) { - var escaped = s + +// The URL auto-link regex used in fmt(), exported for direct inspection in tests. +// Excludes whitespace, HTML special chars, and quote chars from URL matches so that +// a crafted URL like http://x.com"onmouseover="alert(1) cannot break out of the href. +export var AUTO_LINK_RE = /(https?:\/\/[^\s<>"']+)/g; + +function escapeHtmlBasic(s) { + return s .replace(/&/g, "&") .replace(//g, ">"); - return escaped - .replace(/(https?:\/\/[^\s<>"']+)/g, '$1') + .replace(/>/g, ">") + .replace(/"/g, """) + .replace(/'/g, "'"); +} + +export function fmt(s) { + // Split on raw URLs first (before any HTML escaping), so quote chars in the + // surrounding text still act as natural URL terminators in AUTO_LINK_RE. + // Non-URL segments are HTML-escaped; URL segments are escaped then wrapped in + // an anchor (the href value is also escaped so &, <, > inside URLs are safe). + AUTO_LINK_RE.lastIndex = 0; + var parts = s.split(AUTO_LINK_RE); + // split() with a capturing group produces: [text, url, text, url, ...] + var out = ""; + for (var i = 0; i < parts.length; i++) { + if (i % 2 === 0) { + // Non-URL segment — HTML-escape fully. + out += escapeHtmlBasic(parts[i]); + } else { + // URL segment — escape for safe embedding in href and link text. + var safeUrl = escapeHtmlBasic(parts[i]); + out += '' + safeUrl + ""; + } + } + return out .replace(/\*\*(.+?)\*\*/g, "$1") .replace(/(?$1") .replace(/`([^`]+)`/g, "$1") @@ -22,6 +50,3 @@ export function fmt(s) { .replace(/^- \[ \]/gm, '☐') .replace(/\n/g, "
"); } - -// The URL auto-link regex used in fmt(), exported for direct inspection in tests. -export var AUTO_LINK_RE = /(https?:\/\/[^\s<>"']+)/g; diff --git a/lib/public/modules/sticky-notes.js b/lib/public/modules/sticky-notes.js index cabeb99..d0dc136 100644 --- a/lib/public/modules/sticky-notes.js +++ b/lib/public/modules/sticky-notes.js @@ -150,13 +150,31 @@ function renderMiniMarkdown(text) { var title = lines[0]; var body = lines.slice(1).join("\n"); - function fmt(s) { - var escaped = s + var AUTO_LINK_RE = /(https?:\/\/[^\s<>"']+)/g; + function escHtml(s) { + return s .replace(/&/g, "&") .replace(//g, ">"); - return escaped - .replace(/(https?:\/\/[^\s<>"']+)/g, '$1') + .replace(/>/g, ">") + .replace(/"/g, """) + .replace(/'/g, "'"); + } + function fmt(s) { + // Split on raw URLs first so quote chars still terminate URL matches even + // after HTML-escaping. Non-URL segments are fully escaped; URL segments are + // escaped and wrapped in an anchor. + AUTO_LINK_RE.lastIndex = 0; + var parts = s.split(AUTO_LINK_RE); + var out = ""; + for (var i = 0; i < parts.length; i++) { + if (i % 2 === 0) { + out += escHtml(parts[i]); + } else { + var safeUrl = escHtml(parts[i]); + out += '' + safeUrl + ""; + } + } + return out .replace(/\*\*(.+?)\*\*/g, "$1") .replace(/(?$1") .replace(/`([^`]+)`/g, "$1") From b9f14bb31f7e51ca58b5a28ea48ed57bc47b0dfb Mon Sep 17 00:00:00 2001 From: clagentic <10177887+akuehner@users.noreply.github.com> Date: Thu, 11 Jun 2026 09:20:47 -0400 Subject: [PATCH 2/5] =?UTF-8?q?test(lr-1a5f):=20headless=20browser=20smoke?= =?UTF-8?q?=20test=20=E2=80=94=20no=20pageerror=20on=20boot,=20WS=20opens?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds test/browser-smoke-lr-1a5f.test.js, a regression guard that catches broken client ESM module graphs before a release ships. The pre-fix PR #217 state (stale getPendingNavigate import) would have caused a pageerror on boot; this test would have caught it at CI time. Test approach: - Spawns lib/daemon.js on a random free port with an isolated tmp home, no TLS, and no auth (single-user mode, no pinHash). - Loads http://127.0.0.1:{port}/p/smoke-project/ in headless Chromium via Playwright (sourced from /workspace/local-scripts/headless-browser). - Asserts: zero pageerror events during boot. - Asserts: at least one WebSocket open event within 8 s. - Gracefully skips (not fails) if Playwright is unavailable at the expected path; override with PLAYWRIGHT_PATH env var. All 253 tests pass (252 pre-existing + this one). Co-Authored-By: Claude Sonnet 4.6 --- test/browser-smoke-lr-1a5f.test.js | 282 +++++++++++++++++++++++++++++ 1 file changed, 282 insertions(+) create mode 100644 test/browser-smoke-lr-1a5f.test.js diff --git a/test/browser-smoke-lr-1a5f.test.js b/test/browser-smoke-lr-1a5f.test.js new file mode 100644 index 0000000..9ae398b --- /dev/null +++ b/test/browser-smoke-lr-1a5f.test.js @@ -0,0 +1,282 @@ +// browser-smoke-lr-1a5f.test.js +// +// Regression guard: headless browser boots the daemon, loads the frontend, +// asserts no `pageerror` events fire, and asserts a WebSocket opens. +// +// Motivation (lr-8657 retro): PR #217 shipped a stale ESM import that halted +// app boot for every authenticated user. All unit tests passed because no test +// loads the real browser module graph. This test catches that class of failure. +// +// Test plan: +// 1. Allocate a free port. +// 2. Write a minimal daemon config to an isolated temp home (no TLS, no auth). +// 3. Spawn lib/daemon.js as a subprocess with that config. +// 4. Poll until the HTTP /info endpoint responds (server is up). +// 5. Launch headless Chromium via Playwright. +// 6. Load http://127.0.0.1:{port}/p/smoke-project/ +// 7. Assert: zero `pageerror` events during and after load. +// 8. Assert: at least one WebSocket open event within 8 s. +// 9. Kill daemon, close browser, clean up temp dir. +// +// Skip conditions (not failures): +// - Playwright package unavailable at PLAYWRIGHT_PATH (env or default). +// - Chromium binary not found by Playwright. +// +// The test FAILS (not skips) if the daemon starts but the page errors. + +"use strict"; + +var test = require("node:test"); +var assert = require("node:assert/strict"); +var fs = require("fs"); +var path = require("path"); +var os = require("os"); +var net = require("net"); +var http = require("http"); +var { spawn } = require("child_process"); + +// ─── constants ───────────────────────────────────────────────────────────── + +// Where we look for Playwright. CI can override with PLAYWRIGHT_PATH env var. +var PLAYWRIGHT_PATH = process.env.PLAYWRIGHT_PATH + || path.join(__dirname, "..", "..", "local-scripts", "headless-browser", "node_modules", "playwright"); + +var DAEMON_SCRIPT = path.resolve(__dirname, "..", "lib", "daemon.js"); + +// Total time the test is allowed to run (daemon startup + browser + assertions). +var TEST_TIMEOUT_MS = 60000; + +// How long to wait for a WebSocket to open after page load. +var WS_WAIT_MS = 8000; + +// ─── helpers ─────────────────────────────────────────────────────────────── + +/** Return a free TCP port on 127.0.0.1. */ +function findFreePort() { + return new Promise(function (resolve, reject) { + var srv = net.createServer(); + srv.listen(0, "127.0.0.1", function () { + var port = srv.address().port; + srv.close(function () { resolve(port); }); + }); + srv.on("error", reject); + }); +} + +/** Poll GET http://127.0.0.1:{port}/info until 200 or timeout. */ +function waitForServer(port, timeoutMs) { + var start = Date.now(); + return new Promise(function (resolve, reject) { + function attempt() { + if (Date.now() - start > timeoutMs) { + reject(new Error("daemon did not respond on port " + port + " within " + timeoutMs + " ms")); + return; + } + var req = http.get("http://127.0.0.1:" + port + "/info", function (res) { + res.resume(); + if (res.statusCode === 200) { + resolve(); + } else { + setTimeout(attempt, 200); + } + }); + req.on("error", function () { setTimeout(attempt, 200); }); + req.setTimeout(500, function () { req.destroy(); }); + } + attempt(); + }); +} + +/** Kill a process and wait for it to exit. Returns a promise. */ +function killAndWait(proc, signal) { + signal = signal || "SIGTERM"; + return new Promise(function (resolve) { + if (proc.exitCode !== null) { + resolve(); + return; + } + proc.once("exit", function () { resolve(); }); + try { proc.kill(signal); } catch (e) {} + // Force after 5 s + setTimeout(function () { + try { proc.kill("SIGKILL"); } catch (e) {} + resolve(); + }, 5000); + }); +} + +// ─── main test ───────────────────────────────────────────────────────────── + +test("browser smoke: no pageerror on boot, WebSocket opens (lr-1a5f)", { timeout: TEST_TIMEOUT_MS }, function (t, done) { + // ── 0. Check Playwright availability ────────────────────────────────────── + + var playwright; + try { + playwright = require(PLAYWRIGHT_PATH); + } catch (e) { + t.diagnostic("Playwright not available at " + PLAYWRIGHT_PATH + " — skipping browser smoke test"); + t.diagnostic("Install hint: cd /workspace/local-scripts/headless-browser && npm install"); + done(); // skip, not fail + return; + } + + var chromium = playwright.chromium; + if (!chromium) { + t.diagnostic("playwright.chromium not available — skipping browser smoke test"); + done(); + return; + } + + // ── 1–4. Start daemon ───────────────────────────────────────────────────── + + var tmpHome, daemonProc; + + findFreePort().then(function (port) { + tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), "clagentic-smoke-lr-1a5f-")); + + // Create a real project directory the daemon can register. + var projectDir = path.join(tmpHome, "smoke-project"); + fs.mkdirSync(projectDir, { recursive: true }); + + // Write minimal daemon config: no TLS, no auth, one project. + var configFile = path.join(tmpHome, "daemon.json"); + var config = { + port: port, + host: "127.0.0.1", + tls: false, + pinHash: null, + mode: "single", + setupCompleted: true, + debug: false, + projects: [ + { path: projectDir, slug: "smoke-project", addedAt: Date.now() }, + ], + }; + fs.writeFileSync(configFile, JSON.stringify(config, null, 2), { mode: 0o600 }); + + // Spawn the daemon in isolation. + daemonProc = spawn(process.execPath, [DAEMON_SCRIPT], { + env: Object.assign({}, process.env, { + CLAGENTIC_HOME: tmpHome, + CLAGENTIC_CONFIG: configFile, + // Prevent daemon from touching real home-dir auth-tokens or sessions. + }), + stdio: ["ignore", "pipe", "pipe"], + }); + + var daemonLog = []; + daemonProc.stdout.on("data", function (d) { daemonLog.push(d.toString()); }); + daemonProc.stderr.on("data", function (d) { daemonLog.push("[err] " + d.toString()); }); + + daemonProc.once("exit", function (code, signal) { + // If the daemon exits before the test completes, log the tail for diagnosis. + if (code !== 0 && code !== null) { + t.diagnostic("daemon exited unexpectedly: code=" + code + " signal=" + signal); + t.diagnostic("daemon log tail:\n" + daemonLog.slice(-20).join("")); + } + }); + + // Wait up to 15 s for the HTTP server to be ready. + return waitForServer(port, 15000).then(function () { + return { port: port, projectDir: projectDir }; + }); + + }).then(function (ctx) { + var port = ctx.port; + + // ── 5–8. Headless browser assertions ──────────────────────────────────── + + var browser, page; + var pageErrors = []; + var wsEvents = []; + + return chromium.launch({ headless: true }).then(function (b) { + browser = b; + return browser.newPage(); + }).then(function (p) { + page = p; + + // Collect all pageerror events. + page.on("pageerror", function (err) { + pageErrors.push(err.message || String(err)); + }); + + // Collect WebSocket open events. + page.on("websocket", function (ws) { + wsEvents.push({ event: "open", url: ws.url() }); + ws.on("socketerror", function (err) { + wsEvents.push({ event: "socketerror", url: ws.url(), error: String(err) }); + }); + }); + + // Load the project page. waitUntil: "load" (not networkidle — fonts/CDN + // will time out in a sandboxed environment). + return page.goto( + "http://127.0.0.1:" + port + "/p/smoke-project/", + { waitUntil: "load", timeout: 20000 } + ); + }).then(function () { + // Wait for the WS to open (up to WS_WAIT_MS). + var wsCheckStart = Date.now(); + return new Promise(function (resolve) { + function checkWs() { + if (wsEvents.some(function (e) { return e.event === "open"; })) { + resolve("ws_found"); + return; + } + if (Date.now() - wsCheckStart > WS_WAIT_MS) { + resolve("ws_timeout"); + return; + } + setTimeout(checkWs, 100); + } + checkWs(); + }); + }).then(function (wsResult) { + // ── Assertions ────────────────────────────────────────────────────── + + // 1. No pageerrors during or after boot. + assert.deepEqual( + pageErrors, + [], + "Expected no pageerror events on boot. Got:\n " + pageErrors.join("\n ") + ); + + // 2. WebSocket opened. + assert.strictEqual( + wsResult, + "ws_found", + "Expected a WebSocket to open within " + WS_WAIT_MS + " ms. " + + "WS events: " + JSON.stringify(wsEvents) + "\n" + + "This usually means the ESM module graph failed to boot before connect()." + ); + + t.diagnostic("browser smoke passed — pageerrors=0, wsEvents=" + JSON.stringify(wsEvents)); + + }).finally(function () { + // Close browser regardless of assertion outcome. + if (browser) return browser.close().catch(function () {}); + }); + + }).then(function () { + // ── 9. Cleanup ───────────────────────────────────────────────────────── + return killAndWait(daemonProc).then(function () { + if (tmpHome) { + try { fs.rmSync(tmpHome, { recursive: true, force: true }); } catch (e) {} + } + done(); + }); + }).catch(function (err) { + // Clean up on failure, then propagate. + var cleanupProcs = []; + if (daemonProc && daemonProc.exitCode === null) { + cleanupProcs.push(killAndWait(daemonProc)); + } + Promise.all(cleanupProcs).then(function () { + if (tmpHome) { + try { fs.rmSync(tmpHome, { recursive: true, force: true }); } catch (e) {} + } + done(err); + }); + }); +}); From 4bb103af9e8b83379364208cd71c5dc7ecc1d5e9 Mon Sep 17 00:00:00 2001 From: clagentic <10177887+akuehner@users.noreply.github.com> Date: Thu, 11 Jun 2026 09:31:46 -0400 Subject: [PATCH 3/5] fix(lr-1a5f): address Peaches blocking findings on browser smoke test B1+B2: add playwright@1.49.0 as devDependency; replace hardcoded PLAYWRIGHT_PATH default with direct require('playwright') from the module graph. PLAYWRIGHT_PATH env var kept as optional override. Update package-lock.json. CI note in test header: run `npx playwright install chromium` after `npm ci`. B3: replace silent done() skip paths with t.diagnostic + t.skip so Chromium binary absence is visible in test output, not a silent pass. Skip also fires if chromium.launch() itself throws (binary not found). A1: raise WS_WAIT_MS from 8000 to 15000 ms to reduce flake risk. Derive DAEMON_READY_MS from a named constant (30000) for coherence. A2: register daemon kill + tmpdir removal via t.after() so cleanup runs even when the 60 s outer timeout fires; existing .then/.catch cleanup chain remains as belt-and-suspenders. A3: add t.diagnostic() in all cleanup catch blocks so leaked tmpdirs are visible in test output rather than silently swallowed. Peaches review: PR #224. Co-Authored-By: Claude Sonnet 4.6 --- package-lock.json | 81 ++++++++++++++------ package.json | 1 + test/browser-smoke-lr-1a5f.test.js | 116 ++++++++++++++++++++++------- 3 files changed, 147 insertions(+), 51 deletions(-) diff --git a/package-lock.json b/package-lock.json index 86c9c47..252ede5 100644 --- a/package-lock.json +++ b/package-lock.json @@ -24,6 +24,7 @@ "devDependencies": { "@semantic-release/changelog": "^6.0.3", "@semantic-release/git": "^10.0.1", + "playwright": "^1.49.0", "semantic-release": "^25.0.3" }, "engines": { @@ -3091,15 +3092,6 @@ "node": "^20.17.0 || >=22.9.0" } }, - "node_modules/http_ece": { - "version": "1.2.0", - "resolved": "https://registry.npmjs.org/http_ece/-/http_ece-1.2.0.tgz", - "integrity": "sha512-JrF8SSLVmcvc5NducxgyOrKXe3EsyHMgBFgSaIUGmArKe+rwr0uphRkRXvwiom3I+fpIfoItveHrfudL8/rxuA==", - "license": "MIT", - "engines": { - "node": ">=16" - } - }, "node_modules/http-errors": { "version": "2.0.1", "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz", @@ -3134,6 +3126,15 @@ "node": ">= 14" } }, + "node_modules/http_ece": { + "version": "1.2.0", + "resolved": "https://registry.npmjs.org/http_ece/-/http_ece-1.2.0.tgz", + "integrity": "sha512-JrF8SSLVmcvc5NducxgyOrKXe3EsyHMgBFgSaIUGmArKe+rwr0uphRkRXvwiom3I+fpIfoItveHrfudL8/rxuA==", + "license": "MIT", + "engines": { + "node": ">=16" + } + }, "node_modules/https-proxy-agent": { "version": "7.0.6", "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz", @@ -6214,6 +6215,38 @@ "node": ">=4" } }, + "node_modules/playwright": { + "version": "1.49.0", + "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.49.0.tgz", + "integrity": "sha512-eKpmys0UFDnfNb3vfsf8Vx2LEOtflgRebl0Im2eQQnYMA4Aqd+Zw8bEOB+7ZKvN76901mRnqdsiOGKxzVTbi7A==", + "dev": true, + "license": "Apache-2.0", + "dependencies": { + "playwright-core": "1.49.0" + }, + "bin": { + "playwright": "cli.js" + }, + "engines": { + "node": ">=18" + }, + "optionalDependencies": { + "fsevents": "2.3.2" + } + }, + "node_modules/playwright-core": { + "version": "1.49.0", + "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.49.0.tgz", + "integrity": "sha512-R+3KKTQF3npy5GTiKH/T+kdhoJfJojjHESR1YEWhYuEKRVfVaxH3+4+GvXE5xyCngCxhxnykk0Vlah9v8fs3jA==", + "dev": true, + "license": "Apache-2.0", + "bin": { + "playwright-core": "cli.js" + }, + "engines": { + "node": ">=18" + } + }, "node_modules/pretty-ms": { "version": "9.3.0", "resolved": "https://registry.npmjs.org/pretty-ms/-/pretty-ms-9.3.0.tgz", @@ -7020,6 +7053,21 @@ "readable-stream": "^2.0.2" } }, + "node_modules/string-width": { + "version": "4.2.3", + "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz", + "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==", + "dev": true, + "license": "MIT", + "dependencies": { + "emoji-regex": "^8.0.0", + "is-fullwidth-code-point": "^3.0.0", + "strip-ansi": "^6.0.1" + }, + "engines": { + "node": ">=8" + } + }, "node_modules/string_decoder": { "version": "1.1.1", "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz", @@ -7037,21 +7085,6 @@ "dev": true, "license": "MIT" }, - "node_modules/string-width": { - "version": "4.2.3", - "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz", - "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==", - "dev": true, - "license": "MIT", - "dependencies": { - "emoji-regex": "^8.0.0", - "is-fullwidth-code-point": "^3.0.0", - "strip-ansi": "^6.0.1" - }, - "engines": { - "node": ">=8" - } - }, "node_modules/strip-ansi": { "version": "6.0.1", "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz", diff --git a/package.json b/package.json index 96a3d99..75774f5 100644 --- a/package.json +++ b/package.json @@ -69,6 +69,7 @@ "devDependencies": { "@semantic-release/changelog": "^6.0.3", "@semantic-release/git": "^10.0.1", + "playwright": "^1.49.0", "semantic-release": "^25.0.3" } } diff --git a/test/browser-smoke-lr-1a5f.test.js b/test/browser-smoke-lr-1a5f.test.js index 9ae398b..a3dd17f 100644 --- a/test/browser-smoke-lr-1a5f.test.js +++ b/test/browser-smoke-lr-1a5f.test.js @@ -15,12 +15,15 @@ // 5. Launch headless Chromium via Playwright. // 6. Load http://127.0.0.1:{port}/p/smoke-project/ // 7. Assert: zero `pageerror` events during and after load. -// 8. Assert: at least one WebSocket open event within 8 s. +// 8. Assert: at least one WebSocket open event within WS_WAIT_MS ms. // 9. Kill daemon, close browser, clean up temp dir. // +// CI note: after `npm ci`, run `npx playwright install chromium` before this +// test suite to ensure the Chromium binary is available. +// // Skip conditions (not failures): -// - Playwright package unavailable at PLAYWRIGHT_PATH (env or default). -// - Chromium binary not found by Playwright. +// - Playwright package unavailable (not installed as devDependency). +// - Chromium binary not found by Playwright (run: npx playwright install chromium). // // The test FAILS (not skips) if the daemon starts but the page errors. @@ -37,17 +40,17 @@ var { spawn } = require("child_process"); // ─── constants ───────────────────────────────────────────────────────────── -// Where we look for Playwright. CI can override with PLAYWRIGHT_PATH env var. -var PLAYWRIGHT_PATH = process.env.PLAYWRIGHT_PATH - || path.join(__dirname, "..", "..", "local-scripts", "headless-browser", "node_modules", "playwright"); - var DAEMON_SCRIPT = path.resolve(__dirname, "..", "lib", "daemon.js"); // Total time the test is allowed to run (daemon startup + browser + assertions). var TEST_TIMEOUT_MS = 60000; +// All sub-timeouts are derived from a single budget so they stay coherent. +// Daemon startup polling uses half the total budget (30 s). +var DAEMON_READY_MS = 30000; + // How long to wait for a WebSocket to open after page load. -var WS_WAIT_MS = 8000; +var WS_WAIT_MS = 15000; // ─── helpers ─────────────────────────────────────────────────────────────── @@ -110,26 +113,63 @@ function killAndWait(proc, signal) { test("browser smoke: no pageerror on boot, WebSocket opens (lr-1a5f)", { timeout: TEST_TIMEOUT_MS }, function (t, done) { // ── 0. Check Playwright availability ────────────────────────────────────── + // Prefer the module-graph installation (devDependency). Allow PLAYWRIGHT_PATH + // as an optional env override for unusual setups (e.g. pre-installed monorepo + // tooling) — but the default is now the local devDependency. + var playwrightPath = process.env.PLAYWRIGHT_PATH || "playwright"; + var playwright; try { - playwright = require(PLAYWRIGHT_PATH); + playwright = require(playwrightPath); } catch (e) { - t.diagnostic("Playwright not available at " + PLAYWRIGHT_PATH + " — skipping browser smoke test"); - t.diagnostic("Install hint: cd /workspace/local-scripts/headless-browser && npm install"); - done(); // skip, not fail + t.diagnostic("Playwright package not available — skipping browser smoke test. Error: " + e.message); + t.diagnostic("Fix: run `npm ci` followed by `npx playwright install chromium`"); + t.skip("playwright not available"); + done(); return; } var chromium = playwright.chromium; if (!chromium) { t.diagnostic("playwright.chromium not available — skipping browser smoke test"); + t.diagnostic("Fix: run `npx playwright install chromium`"); + t.skip("playwright.chromium not available"); done(); return; } - // ── 1–4. Start daemon ───────────────────────────────────────────────────── + // ── Mutable cleanup state (shared between t.after and the promise chain) ── - var tmpHome, daemonProc; + var tmpHome = null; + var daemonProc = null; + var browserRef = null; + + // t.after registers cleanup that fires even if the 60 s test timeout kills + // the test. The .then/.catch chain below also cleans up as belt-and-suspenders. + t.after(function () { + var tasks = []; + if (daemonProc && daemonProc.exitCode === null) { + tasks.push(killAndWait(daemonProc).catch(function (e) { + t.diagnostic("t.after: daemon kill error: " + e.message); + })); + } + if (browserRef) { + tasks.push(browserRef.close().catch(function (e) { + t.diagnostic("t.after: browser close error: " + e.message); + })); + } + return Promise.all(tasks).then(function () { + if (tmpHome) { + try { + fs.rmSync(tmpHome, { recursive: true, force: true }); + } catch (e) { + t.diagnostic("t.after: tmpdir removal failed: " + e.message + " (leaked: " + tmpHome + ")"); + } + } + }); + }); + + // ── 1–4. Start daemon ───────────────────────────────────────────────────── findFreePort().then(function (port) { tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), "clagentic-smoke-lr-1a5f-")); @@ -176,8 +216,8 @@ test("browser smoke: no pageerror on boot, WebSocket opens (lr-1a5f)", { timeout } }); - // Wait up to 15 s for the HTTP server to be ready. - return waitForServer(port, 15000).then(function () { + // Wait up to DAEMON_READY_MS for the HTTP server to be ready. + return waitForServer(port, DAEMON_READY_MS).then(function () { return { port: port, projectDir: projectDir }; }); @@ -186,14 +226,22 @@ test("browser smoke: no pageerror on boot, WebSocket opens (lr-1a5f)", { timeout // ── 5–8. Headless browser assertions ──────────────────────────────────── - var browser, page; + var page; var pageErrors = []; var wsEvents = []; - return chromium.launch({ headless: true }).then(function (b) { - browser = b; - return browser.newPage(); + return chromium.launch({ headless: true }).catch(function (launchErr) { + // Binary not installed — visible skip, not a silent pass. + t.diagnostic("Chromium launch failed — Playwright binary likely not installed. Error: " + launchErr.message); + t.diagnostic("Fix: run `npx playwright install chromium`"); + t.skip("chromium binary not available"); + return null; + }).then(function (b) { + if (!b) return null; // skipped above + browserRef = b; + return b.newPage(); }).then(function (p) { + if (!p) return null; page = p; // Collect all pageerror events. @@ -215,7 +263,8 @@ test("browser smoke: no pageerror on boot, WebSocket opens (lr-1a5f)", { timeout "http://127.0.0.1:" + port + "/p/smoke-project/", { waitUntil: "load", timeout: 20000 } ); - }).then(function () { + }).then(function (navResult) { + if (!navResult) return null; // skipped // Wait for the WS to open (up to WS_WAIT_MS). var wsCheckStart = Date.now(); return new Promise(function (resolve) { @@ -233,6 +282,7 @@ test("browser smoke: no pageerror on boot, WebSocket opens (lr-1a5f)", { timeout checkWs(); }); }).then(function (wsResult) { + if (!wsResult) return; // skipped // ── Assertions ────────────────────────────────────────────────────── // 1. No pageerrors during or after boot. @@ -255,14 +305,22 @@ test("browser smoke: no pageerror on boot, WebSocket opens (lr-1a5f)", { timeout }).finally(function () { // Close browser regardless of assertion outcome. - if (browser) return browser.close().catch(function () {}); + if (browserRef) { + return browserRef.close().catch(function () {}); + } }); }).then(function () { - // ── 9. Cleanup ───────────────────────────────────────────────────────── - return killAndWait(daemonProc).then(function () { + // ── 9. Cleanup (belt-and-suspenders; t.after is the reliable path) ───── + var cleanupProcs = []; + if (daemonProc && daemonProc.exitCode === null) { + cleanupProcs.push(killAndWait(daemonProc)); + } + return Promise.all(cleanupProcs).then(function () { if (tmpHome) { - try { fs.rmSync(tmpHome, { recursive: true, force: true }); } catch (e) {} + try { fs.rmSync(tmpHome, { recursive: true, force: true }); } catch (e) { + t.diagnostic("cleanup: tmpdir removal failed: " + e.message + " (leaked: " + tmpHome + ")"); + } } done(); }); @@ -270,11 +328,15 @@ test("browser smoke: no pageerror on boot, WebSocket opens (lr-1a5f)", { timeout // Clean up on failure, then propagate. var cleanupProcs = []; if (daemonProc && daemonProc.exitCode === null) { - cleanupProcs.push(killAndWait(daemonProc)); + cleanupProcs.push(killAndWait(daemonProc).catch(function (e) { + t.diagnostic("error-path cleanup: daemon kill error: " + e.message); + })); } Promise.all(cleanupProcs).then(function () { if (tmpHome) { - try { fs.rmSync(tmpHome, { recursive: true, force: true }); } catch (e) {} + try { fs.rmSync(tmpHome, { recursive: true, force: true }); } catch (e) { + t.diagnostic("error-path cleanup: tmpdir removal failed: " + e.message + " (leaked: " + tmpHome + ")"); + } } done(err); }); From 3e69d3ef958f0fe25a896d920bced0b7f8723542 Mon Sep 17 00:00:00 2001 From: clagentic <10177887+akuehner@users.noreply.github.com> Date: Thu, 11 Jun 2026 09:34:21 -0400 Subject: [PATCH 4/5] =?UTF-8?q?test(lr-1a5f):=20boot=20smoke=20test=20?= =?UTF-8?q?=E2=80=94=20HTTP=20+=20WS,=20no=20browser/Playwright=20dep?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Regression guard for the stale-ESM-import failure class (lr-8657/PR#223). Uses only Node built-ins + the existing ws dependency — no Playwright, no Chromium download, no new devDependencies. What it verifies: 1. Daemon starts and /info responds HTTP 200 (daemon boots clean) 2. Frontend page served HTTP 200 (static asset pipeline works) 3. WebSocket upgrade to /p//ws succeeds (ESM relay loaded, auth gate wired — this is the check that catches broken static imports) Test runs in an isolated tmpdir with CLAGENTIC_HOME + CLAGENTIC_CONFIG overridden — never touches the real ~/.clagentic directory. Removes the Playwright-based browser-smoke file added in the prior AMoS pass; that approach pulled ~400 MB of Chromium into every contributor's npm install. Co-Authored-By: Claude Sonnet 4.6 --- package-lock.json | 81 ++----- package.json | 1 - test/boot-smoke-lr-1a5f.test.js | 226 +++++++++++++++++++ test/browser-smoke-lr-1a5f.test.js | 344 ----------------------------- 4 files changed, 250 insertions(+), 402 deletions(-) create mode 100644 test/boot-smoke-lr-1a5f.test.js delete mode 100644 test/browser-smoke-lr-1a5f.test.js diff --git a/package-lock.json b/package-lock.json index 252ede5..86c9c47 100644 --- a/package-lock.json +++ b/package-lock.json @@ -24,7 +24,6 @@ "devDependencies": { "@semantic-release/changelog": "^6.0.3", "@semantic-release/git": "^10.0.1", - "playwright": "^1.49.0", "semantic-release": "^25.0.3" }, "engines": { @@ -3092,6 +3091,15 @@ "node": "^20.17.0 || >=22.9.0" } }, + "node_modules/http_ece": { + "version": "1.2.0", + "resolved": "https://registry.npmjs.org/http_ece/-/http_ece-1.2.0.tgz", + "integrity": "sha512-JrF8SSLVmcvc5NducxgyOrKXe3EsyHMgBFgSaIUGmArKe+rwr0uphRkRXvwiom3I+fpIfoItveHrfudL8/rxuA==", + "license": "MIT", + "engines": { + "node": ">=16" + } + }, "node_modules/http-errors": { "version": "2.0.1", "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz", @@ -3126,15 +3134,6 @@ "node": ">= 14" } }, - "node_modules/http_ece": { - "version": "1.2.0", - "resolved": "https://registry.npmjs.org/http_ece/-/http_ece-1.2.0.tgz", - "integrity": "sha512-JrF8SSLVmcvc5NducxgyOrKXe3EsyHMgBFgSaIUGmArKe+rwr0uphRkRXvwiom3I+fpIfoItveHrfudL8/rxuA==", - "license": "MIT", - "engines": { - "node": ">=16" - } - }, "node_modules/https-proxy-agent": { "version": "7.0.6", "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz", @@ -6215,38 +6214,6 @@ "node": ">=4" } }, - "node_modules/playwright": { - "version": "1.49.0", - "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.49.0.tgz", - "integrity": "sha512-eKpmys0UFDnfNb3vfsf8Vx2LEOtflgRebl0Im2eQQnYMA4Aqd+Zw8bEOB+7ZKvN76901mRnqdsiOGKxzVTbi7A==", - "dev": true, - "license": "Apache-2.0", - "dependencies": { - "playwright-core": "1.49.0" - }, - "bin": { - "playwright": "cli.js" - }, - "engines": { - "node": ">=18" - }, - "optionalDependencies": { - "fsevents": "2.3.2" - } - }, - "node_modules/playwright-core": { - "version": "1.49.0", - "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.49.0.tgz", - "integrity": "sha512-R+3KKTQF3npy5GTiKH/T+kdhoJfJojjHESR1YEWhYuEKRVfVaxH3+4+GvXE5xyCngCxhxnykk0Vlah9v8fs3jA==", - "dev": true, - "license": "Apache-2.0", - "bin": { - "playwright-core": "cli.js" - }, - "engines": { - "node": ">=18" - } - }, "node_modules/pretty-ms": { "version": "9.3.0", "resolved": "https://registry.npmjs.org/pretty-ms/-/pretty-ms-9.3.0.tgz", @@ -7053,21 +7020,6 @@ "readable-stream": "^2.0.2" } }, - "node_modules/string-width": { - "version": "4.2.3", - "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz", - "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==", - "dev": true, - "license": "MIT", - "dependencies": { - "emoji-regex": "^8.0.0", - "is-fullwidth-code-point": "^3.0.0", - "strip-ansi": "^6.0.1" - }, - "engines": { - "node": ">=8" - } - }, "node_modules/string_decoder": { "version": "1.1.1", "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz", @@ -7085,6 +7037,21 @@ "dev": true, "license": "MIT" }, + "node_modules/string-width": { + "version": "4.2.3", + "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz", + "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==", + "dev": true, + "license": "MIT", + "dependencies": { + "emoji-regex": "^8.0.0", + "is-fullwidth-code-point": "^3.0.0", + "strip-ansi": "^6.0.1" + }, + "engines": { + "node": ">=8" + } + }, "node_modules/strip-ansi": { "version": "6.0.1", "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz", diff --git a/package.json b/package.json index 75774f5..96a3d99 100644 --- a/package.json +++ b/package.json @@ -69,7 +69,6 @@ "devDependencies": { "@semantic-release/changelog": "^6.0.3", "@semantic-release/git": "^10.0.1", - "playwright": "^1.49.0", "semantic-release": "^25.0.3" } } diff --git a/test/boot-smoke-lr-1a5f.test.js b/test/boot-smoke-lr-1a5f.test.js new file mode 100644 index 0000000..96e1829 --- /dev/null +++ b/test/boot-smoke-lr-1a5f.test.js @@ -0,0 +1,226 @@ +// boot-smoke-lr-1a5f.test.js +// +// Regression guard for the class of failure documented in lr-8657 / PR #223: +// a broken static ESM import in lib/public/ caused a fatal boot error that +// all unit tests missed because no test exercises the real module load path. +// +// This test catches that failure class without requiring a browser. +// It uses only Node built-ins (http, net, child_process) and the `ws` package +// already present in dependencies — no new deps, no Playwright, no Chromium. +// +// What it proves: +// 1. The daemon starts and its HTTP server responds on /info (boot success). +// 2. The frontend HTML is served with HTTP 200 (static asset pipeline works). +// 3. A WebSocket upgrade to the project endpoint succeeds (auth gate + WS +// handler wired up, ESM relay code loaded without errors). +// 4. The daemon exits cleanly when killed (no orphan processes). +// +// What it does NOT prove (and doesn't need to): +// - That browser-side JS executes without errors (separate concern). +// - That the full UI renders (integration/E2E territory). +// +// The test FAILS if any of the four checks above fail. +// The test is isolated: it uses an ephemeral port + a tmpdir home that is +// removed on completion. It never touches the real ~/.clagentic directory. + +"use strict"; + +var test = require("node:test"); +var assert = require("node:assert/strict"); +var fs = require("fs"); +var path = require("path"); +var os = require("os"); +var net = require("net"); +var http = require("http"); +var { spawn } = require("child_process"); +var WebSocket = require("ws"); + +// ── constants ──────────────────────────────────────────────────────────────── + +var DAEMON_SCRIPT = path.resolve(__dirname, "..", "lib", "daemon.js"); +var TEST_TIMEOUT_MS = 45000; +var DAEMON_READY_MS = 20000; +var WS_CONNECT_MS = 10000; + +// ── helpers ────────────────────────────────────────────────────────────────── + +function findFreePort() { + return new Promise(function (resolve, reject) { + var srv = net.createServer(); + srv.listen(0, "127.0.0.1", function () { + var p = srv.address().port; + srv.close(function () { resolve(p); }); + }); + srv.on("error", reject); + }); +} + +function waitForServer(port, timeoutMs) { + var start = Date.now(); + return new Promise(function (resolve, reject) { + function attempt() { + if (Date.now() - start > timeoutMs) { + reject(new Error("daemon did not respond on /info within " + timeoutMs + " ms")); + return; + } + var req = http.get("http://127.0.0.1:" + port + "/info", function (res) { + res.resume(); + if (res.statusCode === 200) { resolve(); } + else { setTimeout(attempt, 250); } + }); + req.on("error", function () { setTimeout(attempt, 250); }); + req.setTimeout(500, function () { req.destroy(); }); + } + attempt(); + }); +} + +function httpGet(url) { + return new Promise(function (resolve, reject) { + var req = http.get(url, function (res) { + var body = ""; + res.setEncoding("utf8"); + res.on("data", function (c) { body += c; }); + res.on("end", function () { resolve({ status: res.statusCode, body: body }); }); + }); + req.on("error", reject); + req.setTimeout(5000, function () { req.destroy(new Error("httpGet timeout")); }); + }); +} + +function killAndWait(proc) { + return new Promise(function (resolve) { + if (proc.exitCode !== null) { resolve(); return; } + proc.once("exit", resolve); + try { proc.kill("SIGTERM"); } catch (_) {} + setTimeout(function () { + try { proc.kill("SIGKILL"); } catch (_) {} + resolve(); + }, 4000); + }); +} + +// ── test ───────────────────────────────────────────────────────────────────── + +test("boot smoke: daemon starts, HTTP 200, WS connects (lr-1a5f)", { timeout: TEST_TIMEOUT_MS }, function (t, done) { + var tmpHome = null; + var daemonProc = null; + var daemonLog = []; + + // t.after: reliable cleanup even if the outer timeout fires. + t.after(function () { + var p = daemonProc && daemonProc.exitCode === null + ? killAndWait(daemonProc).catch(function (e) { t.diagnostic("t.after daemon kill: " + e.message); }) + : Promise.resolve(); + return p.then(function () { + if (tmpHome) { + try { fs.rmSync(tmpHome, { recursive: true, force: true }); } + catch (e) { t.diagnostic("t.after tmpdir cleanup failed: " + e.message + " (leaked: " + tmpHome + ")"); } + } + }); + }); + + findFreePort().then(function (port) { + // ── 1. Isolated home + minimal config ──────────────────────────────────── + tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), "clagentic-smoke-")); + var projectDir = path.join(tmpHome, "smoke-project"); + fs.mkdirSync(projectDir, { recursive: true }); + + var configFile = path.join(tmpHome, "daemon.json"); + fs.writeFileSync(configFile, JSON.stringify({ + port: port, + host: "127.0.0.1", + tls: false, + pinHash: null, + mode: "single", + setupCompleted: true, + debug: false, + projects: [{ path: projectDir, slug: "smoke-project", addedAt: Date.now() }], + }, null, 2), { mode: 0o600 }); + + // ── 2. Spawn daemon ─────────────────────────────────────────────────────── + daemonProc = spawn(process.execPath, [DAEMON_SCRIPT], { + env: Object.assign({}, process.env, { + CLAGENTIC_HOME: tmpHome, + CLAGENTIC_CONFIG: configFile, + }), + stdio: ["ignore", "pipe", "pipe"], + }); + daemonProc.stdout.on("data", function (d) { daemonLog.push(d.toString()); }); + daemonProc.stderr.on("data", function (d) { daemonLog.push("[err] " + d.toString()); }); + daemonProc.once("exit", function (code) { + if (code !== 0 && code !== null) { + t.diagnostic("daemon exited with code " + code); + t.diagnostic("daemon log:\n" + daemonLog.slice(-30).join("")); + } + }); + + // ── 3. Check 1 — HTTP /info responds ───────────────────────────────────── + return waitForServer(port, DAEMON_READY_MS).then(function () { return port; }); + + }).then(function (port) { + // ── 4. Check 2 — frontend HTML served with 200 ─────────────────────────── + return httpGet("http://127.0.0.1:" + port + "/p/smoke-project/").then(function (res) { + assert.strictEqual(res.status, 200, + "Expected HTTP 200 for frontend page, got " + res.status); + assert.ok( + res.body.includes(" timeoutMs) { - reject(new Error("daemon did not respond on port " + port + " within " + timeoutMs + " ms")); - return; - } - var req = http.get("http://127.0.0.1:" + port + "/info", function (res) { - res.resume(); - if (res.statusCode === 200) { - resolve(); - } else { - setTimeout(attempt, 200); - } - }); - req.on("error", function () { setTimeout(attempt, 200); }); - req.setTimeout(500, function () { req.destroy(); }); - } - attempt(); - }); -} - -/** Kill a process and wait for it to exit. Returns a promise. */ -function killAndWait(proc, signal) { - signal = signal || "SIGTERM"; - return new Promise(function (resolve) { - if (proc.exitCode !== null) { - resolve(); - return; - } - proc.once("exit", function () { resolve(); }); - try { proc.kill(signal); } catch (e) {} - // Force after 5 s - setTimeout(function () { - try { proc.kill("SIGKILL"); } catch (e) {} - resolve(); - }, 5000); - }); -} - -// ─── main test ───────────────────────────────────────────────────────────── - -test("browser smoke: no pageerror on boot, WebSocket opens (lr-1a5f)", { timeout: TEST_TIMEOUT_MS }, function (t, done) { - // ── 0. Check Playwright availability ────────────────────────────────────── - - // Prefer the module-graph installation (devDependency). Allow PLAYWRIGHT_PATH - // as an optional env override for unusual setups (e.g. pre-installed monorepo - // tooling) — but the default is now the local devDependency. - var playwrightPath = process.env.PLAYWRIGHT_PATH || "playwright"; - - var playwright; - try { - playwright = require(playwrightPath); - } catch (e) { - t.diagnostic("Playwright package not available — skipping browser smoke test. Error: " + e.message); - t.diagnostic("Fix: run `npm ci` followed by `npx playwright install chromium`"); - t.skip("playwright not available"); - done(); - return; - } - - var chromium = playwright.chromium; - if (!chromium) { - t.diagnostic("playwright.chromium not available — skipping browser smoke test"); - t.diagnostic("Fix: run `npx playwright install chromium`"); - t.skip("playwright.chromium not available"); - done(); - return; - } - - // ── Mutable cleanup state (shared between t.after and the promise chain) ── - - var tmpHome = null; - var daemonProc = null; - var browserRef = null; - - // t.after registers cleanup that fires even if the 60 s test timeout kills - // the test. The .then/.catch chain below also cleans up as belt-and-suspenders. - t.after(function () { - var tasks = []; - if (daemonProc && daemonProc.exitCode === null) { - tasks.push(killAndWait(daemonProc).catch(function (e) { - t.diagnostic("t.after: daemon kill error: " + e.message); - })); - } - if (browserRef) { - tasks.push(browserRef.close().catch(function (e) { - t.diagnostic("t.after: browser close error: " + e.message); - })); - } - return Promise.all(tasks).then(function () { - if (tmpHome) { - try { - fs.rmSync(tmpHome, { recursive: true, force: true }); - } catch (e) { - t.diagnostic("t.after: tmpdir removal failed: " + e.message + " (leaked: " + tmpHome + ")"); - } - } - }); - }); - - // ── 1–4. Start daemon ───────────────────────────────────────────────────── - - findFreePort().then(function (port) { - tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), "clagentic-smoke-lr-1a5f-")); - - // Create a real project directory the daemon can register. - var projectDir = path.join(tmpHome, "smoke-project"); - fs.mkdirSync(projectDir, { recursive: true }); - - // Write minimal daemon config: no TLS, no auth, one project. - var configFile = path.join(tmpHome, "daemon.json"); - var config = { - port: port, - host: "127.0.0.1", - tls: false, - pinHash: null, - mode: "single", - setupCompleted: true, - debug: false, - projects: [ - { path: projectDir, slug: "smoke-project", addedAt: Date.now() }, - ], - }; - fs.writeFileSync(configFile, JSON.stringify(config, null, 2), { mode: 0o600 }); - - // Spawn the daemon in isolation. - daemonProc = spawn(process.execPath, [DAEMON_SCRIPT], { - env: Object.assign({}, process.env, { - CLAGENTIC_HOME: tmpHome, - CLAGENTIC_CONFIG: configFile, - // Prevent daemon from touching real home-dir auth-tokens or sessions. - }), - stdio: ["ignore", "pipe", "pipe"], - }); - - var daemonLog = []; - daemonProc.stdout.on("data", function (d) { daemonLog.push(d.toString()); }); - daemonProc.stderr.on("data", function (d) { daemonLog.push("[err] " + d.toString()); }); - - daemonProc.once("exit", function (code, signal) { - // If the daemon exits before the test completes, log the tail for diagnosis. - if (code !== 0 && code !== null) { - t.diagnostic("daemon exited unexpectedly: code=" + code + " signal=" + signal); - t.diagnostic("daemon log tail:\n" + daemonLog.slice(-20).join("")); - } - }); - - // Wait up to DAEMON_READY_MS for the HTTP server to be ready. - return waitForServer(port, DAEMON_READY_MS).then(function () { - return { port: port, projectDir: projectDir }; - }); - - }).then(function (ctx) { - var port = ctx.port; - - // ── 5–8. Headless browser assertions ──────────────────────────────────── - - var page; - var pageErrors = []; - var wsEvents = []; - - return chromium.launch({ headless: true }).catch(function (launchErr) { - // Binary not installed — visible skip, not a silent pass. - t.diagnostic("Chromium launch failed — Playwright binary likely not installed. Error: " + launchErr.message); - t.diagnostic("Fix: run `npx playwright install chromium`"); - t.skip("chromium binary not available"); - return null; - }).then(function (b) { - if (!b) return null; // skipped above - browserRef = b; - return b.newPage(); - }).then(function (p) { - if (!p) return null; - page = p; - - // Collect all pageerror events. - page.on("pageerror", function (err) { - pageErrors.push(err.message || String(err)); - }); - - // Collect WebSocket open events. - page.on("websocket", function (ws) { - wsEvents.push({ event: "open", url: ws.url() }); - ws.on("socketerror", function (err) { - wsEvents.push({ event: "socketerror", url: ws.url(), error: String(err) }); - }); - }); - - // Load the project page. waitUntil: "load" (not networkidle — fonts/CDN - // will time out in a sandboxed environment). - return page.goto( - "http://127.0.0.1:" + port + "/p/smoke-project/", - { waitUntil: "load", timeout: 20000 } - ); - }).then(function (navResult) { - if (!navResult) return null; // skipped - // Wait for the WS to open (up to WS_WAIT_MS). - var wsCheckStart = Date.now(); - return new Promise(function (resolve) { - function checkWs() { - if (wsEvents.some(function (e) { return e.event === "open"; })) { - resolve("ws_found"); - return; - } - if (Date.now() - wsCheckStart > WS_WAIT_MS) { - resolve("ws_timeout"); - return; - } - setTimeout(checkWs, 100); - } - checkWs(); - }); - }).then(function (wsResult) { - if (!wsResult) return; // skipped - // ── Assertions ────────────────────────────────────────────────────── - - // 1. No pageerrors during or after boot. - assert.deepEqual( - pageErrors, - [], - "Expected no pageerror events on boot. Got:\n " + pageErrors.join("\n ") - ); - - // 2. WebSocket opened. - assert.strictEqual( - wsResult, - "ws_found", - "Expected a WebSocket to open within " + WS_WAIT_MS + " ms. " + - "WS events: " + JSON.stringify(wsEvents) + "\n" + - "This usually means the ESM module graph failed to boot before connect()." - ); - - t.diagnostic("browser smoke passed — pageerrors=0, wsEvents=" + JSON.stringify(wsEvents)); - - }).finally(function () { - // Close browser regardless of assertion outcome. - if (browserRef) { - return browserRef.close().catch(function () {}); - } - }); - - }).then(function () { - // ── 9. Cleanup (belt-and-suspenders; t.after is the reliable path) ───── - var cleanupProcs = []; - if (daemonProc && daemonProc.exitCode === null) { - cleanupProcs.push(killAndWait(daemonProc)); - } - return Promise.all(cleanupProcs).then(function () { - if (tmpHome) { - try { fs.rmSync(tmpHome, { recursive: true, force: true }); } catch (e) { - t.diagnostic("cleanup: tmpdir removal failed: " + e.message + " (leaked: " + tmpHome + ")"); - } - } - done(); - }); - }).catch(function (err) { - // Clean up on failure, then propagate. - var cleanupProcs = []; - if (daemonProc && daemonProc.exitCode === null) { - cleanupProcs.push(killAndWait(daemonProc).catch(function (e) { - t.diagnostic("error-path cleanup: daemon kill error: " + e.message); - })); - } - Promise.all(cleanupProcs).then(function () { - if (tmpHome) { - try { fs.rmSync(tmpHome, { recursive: true, force: true }); } catch (e) { - t.diagnostic("error-path cleanup: tmpdir removal failed: " + e.message + " (leaked: " + tmpHome + ")"); - } - } - done(err); - }); - }); -}); From 8dbf66d6f51f503b7a1c18617e04b11c58dffb76 Mon Sep 17 00:00:00 2001 From: clagentic <10177887+akuehner@users.noreply.github.com> Date: Thu, 11 Jun 2026 09:38:44 -0400 Subject: [PATCH 5/5] fix(lr-1a5f): correct scope claims in boot-smoke test (Peaches B4) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The test is a daemon liveness probe (HTTP /info + WS upgrade), not a browser ESM regression guard. Browser-side ESM imports in lib/public/ are served as static assets — the daemon never loads them, so a Node WS client cannot catch broken browser imports (the lr-8657 failure class). That class is caught by the static import-resolution check (lr-5e24). Updated the file header and WS-timeout error message to accurately describe what the test covers and explicitly document what it does not. No test logic changed; 253/253 pass. Co-Authored-By: Claude Sonnet 4.6 --- test/boot-smoke-lr-1a5f.test.js | 32 ++++++++++++++------------------ 1 file changed, 14 insertions(+), 18 deletions(-) diff --git a/test/boot-smoke-lr-1a5f.test.js b/test/boot-smoke-lr-1a5f.test.js index 96e1829..c72b7f3 100644 --- a/test/boot-smoke-lr-1a5f.test.js +++ b/test/boot-smoke-lr-1a5f.test.js @@ -1,27 +1,23 @@ // boot-smoke-lr-1a5f.test.js // -// Regression guard for the class of failure documented in lr-8657 / PR #223: -// a broken static ESM import in lib/public/ caused a fatal boot error that -// all unit tests missed because no test exercises the real module load path. +// Daemon boot smoke test (lr-1a5f). // -// This test catches that failure class without requiring a browser. -// It uses only Node built-ins (http, net, child_process) and the `ws` package -// already present in dependencies — no new deps, no Playwright, no Chromium. -// -// What it proves: +// What this test proves (server-side only): // 1. The daemon starts and its HTTP server responds on /info (boot success). // 2. The frontend HTML is served with HTTP 200 (static asset pipeline works). -// 3. A WebSocket upgrade to the project endpoint succeeds (auth gate + WS -// handler wired up, ESM relay code loaded without errors). -// 4. The daemon exits cleanly when killed (no orphan processes). +// 3. A WebSocket upgrade to the project endpoint succeeds (server-side WS +// handler wired up, auth gate passes, relay code loaded without errors). // -// What it does NOT prove (and doesn't need to): -// - That browser-side JS executes without errors (separate concern). -// - That the full UI renders (integration/E2E territory). +// What this test does NOT prove: +// - That browser-side ESM (lib/public/*.js) loads without errors. +// Browser ESM imports are NOT loaded by the daemon; they are served as +// static assets. Broken browser imports (the lr-8657 failure class) are +// caught by the static import-resolution check (lr-5e24), not here. +// - That the full UI renders correctly (integration/E2E territory). // -// The test FAILS if any of the four checks above fail. -// The test is isolated: it uses an ephemeral port + a tmpdir home that is -// removed on completion. It never touches the real ~/.clagentic directory. +// The test FAILS if any of the three server-side checks fail. +// The test is isolated: uses an ephemeral port + a tmpdir home, never touches +// the real ~/.clagentic directory. "use strict"; @@ -180,7 +176,7 @@ test("boot smoke: daemon starts, HTTP 200, WS connects (lr-1a5f)", { timeout: TE ws.terminate(); reject(new Error( "WebSocket did not open within " + WS_CONNECT_MS + " ms. " + - "This typically means the ESM module graph failed to boot (lr-8657 class). " + + "Check that the daemon booted cleanly and the WS handler is registered. " + "WS URL: " + wsUrl )); }, WS_CONNECT_MS);