
> tablaze@0.1.0 test
> npm run build && node --test --test-concurrency=1 tests/*.test.mjs


> tablaze@0.1.0 build
> tsc -p tsconfig.json

✔ workspace export keeps active selection consistent when the active tab closes during storage capture (1319.737583ms)
✔ PDF metadata stays bound to its captured tab through asynchronous artifact persistence (669.496792ms)
✔ drag revalidates observed targets after asynchronous geometry reads before mouse input (675.586042ms)
✔ upload chooser revalidates its visible trigger after asynchronous local file checks (621.964833ms)
✔ newly discovered scroll containers retain node identity guards when replaced (524.77025ms)
✔ scrollable containers expose ranges and accept guarded horizontal and vertical input (608.565833ms)
✔ dragging emits the browser drop event and delivers the real data payload (702.756167ms)
✔ hidden file chooser transfers explicit local bytes without a hidden DOM reference (637.650083ms)
✔ PDF exports real private artifacts with verifiable digest and source (647.665458ms)
✔ workspace roundtrip restores isolated durable storage, owned tabs, and active selection (1964.846917ms)
✔ workspace validation precedes navigation and failed restore rolls back owned sessions (897.511958ms)
✔ per-decision catalogs hide execution metadata and context changes skip queued writes (12.448333ms)
✔ a context change during planning or write-ahead persistence never executes the stale handler (2.886ms)
✔ trusted write effects retain ambiguity for thrown, malformed, error, and unknown outcomes (7.354084ms)
✔ finish rechecks its lease and cannot reuse verification from the old context (1.710375ms)
✔ a context change between closed and newly prepared leases invalidates old verification (3.3295ms)
✔ only a confirmed session close preserves current evidence across context changes and later writes still invalidate it (5.114834ms)
✔ bound checkpoints reject missing runtimes and changed registry or same-origin tenant identities (1.172125ms)
✔ version-one and version-two checkpoints explicitly migrate unbound and cannot gain a registry (1.265042ms)
✔ resume rechecks a pending call effect rather than trusting a tampered mutating flag (1.103875ms)
✔ initialization uses the bound dispatcher and each lease closes before terminal persistence (1.361166ms)
✔ a prepared lease that arrives after cancellation is still closed without planning (2.56425ms)
✔ catalog release failure or cancellation cannot turn accepted verification into success (1.870125ms)
✔ run CLI completes a scripted model task through real Chrome and prints a bounded report (833.142334ms)
✔ run CLI returns human input with exit 2 and an explicit failure with exit 1 (411.880791ms)
✔ run CLI does not accept an unverified model completion and enforces the step limit (223.534625ms)
✔ CLI rejects agent-only options outside run and validates required arguments and limits (2271.532709ms)
✔ CLI reports cleanup failure separately from an already verified successful agent result (833.857834ms)
✔ restoration abort handles a rejected asynchronous dispose without an unhandled rejection (320.903875ms)
✔ CLI publishes bounded planner diagnostics without exposing endpoint, key, or upstream error text (211.74075ms)
✔ HTTP planner failures expose only status and fixed classification without enabling default retries (18.999042ms)
✔ unknown exceptions cannot inject diagnostic codes and custom retry policy remains authoritative (2.702792ms)
✔ transport and malformed response diagnostics remain distinct and omit raw response data (3.652167ms)
✔ catalog failure is distinguishable before any planner or mutation runs (1.60075ms)
✔ application callbacks are classified without recursively notifying a broken event hook (3.005ms)
✔ adapter usage callback failures retain their application phase and original retry policy input (0.808834ms)
✔ persistence failures prevent mutation or successful completion without changing resume schema (1.531125ms)
✔ a noncooperating checkpoint callback receives a bounded persistence-timeout diagnosis (5003.075917ms)
✔ ordinary MCP explicit unknown write persists uncertainty, skips the batch and cannot replay on resume (17.35175ms)
▶ explicit uncertainty overrides a superficially successful write in legacy and bound MCP execution
  ✔ ordinary MCP write annotation (1.668583ms)
  ✔ bound trusted write metadata (2.955666ms)
✔ explicit uncertainty overrides a superficially successful write in legacy and bound MCP execution (4.822708ms)
▶ ordinary pre-write failures and non-protocol markers remain recoverable by fresh observation
  ✔ absent (2.101667ms)
  ✔ false (1.696ms)
  ✔ string true (1.30775ms)
  ✔ nested payload (1.297583ms)
  ✔ text-only JSON (1.784166ms)
✔ ordinary pre-write failures and non-protocol markers remain recoverable by fresh observation (8.571584ms)
▶ read-only metadata and trusted not-started outcomes do not invent mutation ambiguity
  ✔ ordinary read (1.928542ms)
  ✔ bound read despite misleading write annotation (0.901291ms)
  ✔ not_started overrides a contradictory result marker (0.657125ms)
✔ read-only metadata and trusted not-started outcomes do not invent mutation ambiguity (3.646083ms)
▶ failure after an explicit unknown result cannot erase the persisted reconciliation requirement
  ✔ after_tool persistence (1.161167ms)
  ✔ tool_result callback (0.946792ms)
✔ failure after an explicit unknown result cannot erase the persisted reconciliation requirement (2.192084ms)
✔ explicit initialization and popup following complete a real workflow without executing remaining origin calls (1164.673791ms)
✔ cancellation during terminal persistence cannot return succeeded with accepted evidence (5.332375ms)
✔ deadline expiry during terminal persistence is reported and returned elapsed time includes the wait (152.846291ms)
✔ returned checkpoint accounts for final persistence time before a later resume (43.145ms)
✔ resume retains application restrictions unless the caller explicitly replaces them (2.65175ms)
✔ resume cannot silently remove a previously required application completion policy (2.603792ms)
✔ decision checkpoint resume preserves counters and IDs but requires fresh verification (16.753625ms)
✔ an interrupted maybe-applied mutation blocks every resumed planner until trusted reconciliation (2.979834ms)
✔ failed checkpoint persistence prevents dispatch and never retries a tool (2.428417ms)
✔ restored sessions reject old session IDs and refs until a fresh snapshot is obtained (2.910458ms)
✔ untrusted checkpoint shape, protocol pairing, IDs, and budgets are validated before execution (2.355542ms)
✔ stall detection uses repeated actual outcomes, provides one replan, then stops (2.243583ms)
✔ bounded retry and fallback only repeat planning; tools with uncertain effects are not retried (3.810417ms)
✔ opt-in compaction preserves complete tool groups and real verification evidence (8.225291ms)
✔ HTTP adapter reports only actual provider usage and exposes transient status classification (10.8505ms)
✔ separate CLI processes restore private storage and fresh sessions without replaying completed writes (1904.737542ms)
✔ interrupted external side effect requires explicit reconciliation before CLI restores or plans (1684.244834ms)
✔ an exhausted saved CLI budget performs no page restoration or model request (1208.2315ms)
✔ explicit initialization traverses actual MCP before planning, with step-zero write-ahead and real evidence (12.741875ms)
✔ start URL is explicit and invalid targets fail before catalog, tools, or planning (0.567417ms)
✔ initialization obeys tool, history, deadline, and cancellation budgets without planning (32.448792ms)
✔ unknown initial effects require reconciliation and the initializer is never replayed after it (1.039083ms)
✔ an initializer that was never registered can start once when its saved prerequisite is supplied (0.415125ms)
✔ settled initialization survives resume and compaction with unique subsequent IDs (1.735791ms)
✔ version-one checkpoints migrate explicitly and initialization manifests reject inconsistent history (0.7995ms)
✔ write-ahead persistence failure never dispatches or replays the registered initializer (0.396416ms)
✔ replan_required skips later tool calls and still requires separate verification (0.330417ms)
✔ CLI start URL reaches real Chrome before its first model request and resumes without another initializer (1980.666333ms)
✔ CLI accepts a browser-wide popup policy but restricts start URL to run and validates both (1144.998791ms)
✔ agent drives real MCP browser tools and requires verified form state before finishing (699.618083ms)
✔ MCP schema rejects malformed arguments before side effects, then planner can recover (2.452916ms)
✔ stale-reference result stops the batch and is returned for replanning without retry (1.373541ms)
✔ failed checks and isError=true cannot satisfy completion even when passed=true (1.973625ms)
✔ completion rejects stale evidence, another session, invented IDs, and contradicted checks (4.405375ms)
✔ application task-specific acceptance can reject a technically passing unrelated check (0.873375ms)
✔ tool and planning budgets are bounded; invalid decisions never dispatch a tool (1.238583ms)
✔ deadline bounds a non-cooperating planner and abort propagates into an in-flight tool (22.484834ms)
✔ MCP cancellation reaches the actual server request signal (1.022458ms)
✔ HTTP planner preserves MCP image evidence and structured errors without real model calls (10.08575ms)
✔ HTTP planner rejects malformed model arguments, mixed finish calls, and oversized output (0.672167ms)
✔ an installed completion policy must explicitly return true (2.652375ms)
✔ history budget stops later mutations within the same planning decision (0.558917ms)
✔ cancellation before the dispatch microtask never starts a custom tool (0.256ms)
✔ binding is frozen trusted metadata; observations and DOM edits do not consume it or hold the queue (639.162333ms)
✔ same-URL reload invalidates a document lease even if the cached navigation counter is delayed (589.7165ms)
✔ history routes and tab switch ABA invalidate bindings permanently (563.626333ms)
✔ a navigation during the asynchronous assertion cannot produce a valid stale result (596.364959ms)
✔ signal, explicit close, session close and engine disposal revoke leases without exposing browser handles (675.041708ms)
✔ cancelled acquisition releases a real late Document handle without affecting the session (609.654042ms)
✔ pre-cancelled acquisition creates no remote handle and opaque origins are refused (621.1835ms)
✔ engine disposal revokes an in-flight acquisition and releases its late handle (513.973875ms)
✔ independent CDP navigation invalidates a lease and lease cleanup leaves the external browser alive (712.583208ms)
✔ hotel form batch navigates and independent checks verify real URL and DOM (886.091042ms)
✔ snapshots obey budgets and do not include password or hidden values (346.505ms)
✔ a newer snapshot rejects the older revision before input (167.142375ms)
✔ a replaced DOM node with an identical label is rejected (201.523292ms)
✔ changed target semantics are rejected before a click (185.160416ms)
✔ overlay blocks input and retry requires fresh observation (1284.882417ms)
✔ semantic change during actionability waiting prevents the delayed click (463.177958ms)
✔ a base URL change invalidates the observed resolved link destination (225.283334ms)
✔ value verification never leaks a password substituted after a field-type read (277.168292ms)
✔ batch preserves completed work and reports failed and skipped steps (253.428292ms)
✔ incremental snapshots expose added and removed controls (308.597417ms)
✔ open shadow controls and explicitly selected frame controls execute (350.693833ms)
✔ sessions isolate storage and reject cross-session references (409.654208ms)
✔ concurrent operations serialize within one session (222.890875ms)
✔ capture contains a real JPEG and closing removes a session (191.564792ms)
✔ CDP disposal closes only owned pages and preserves the independent browser and existing state (841.1455ms)
✔ stream and item error diagnostics may precede a successful completed turn (70.451541ms)
✔ only allowlisted structured diagnostic fields survive without deriving a retry policy (26.406708ms)
✔ a failed turn stays failed even if termination flushes completion usage and exits zero (26.045167ms)
✔ valid output and exit zero cannot substitute for an actual completed event (25.472ms)
✔ a message-only error followed by a hanging process ends at the original deadline (259.490875ms)
✔ a nonzero exit and a completed response with invalid schema both remain failures (90.241542ms)
✔ gateway counts one successful dispatch after diagnostics and retains unknown usage on incomplete failure (112.338458ms)
✔ run failure classification uses terminal AgentFailure and never erases a returned failure (0.178708ms)
✔ Codex process decisions complete the Agent write/verify/evidence loop with isolated transient files (108.042458ms)
✔ Codex only inherits allowlisted environment and uses bounded deduplicated inline images (26.269416ms)
✔ Codex generic notifications do not abort successful terminal events or leak provider text (26.41525ms)
✔ Codex incomplete cannot dispatch or imply Agent success (25.030875ms)
✔ Codex nonzero cannot dispatch or imply Agent success (25.165334ms)
✔ Codex failed-terminal cannot dispatch or imply Agent success (24.721ms)
✔ Codex bad-event cannot dispatch or imply Agent success (25.587917ms)
✔ Codex external cannot dispatch or imply Agent success (24.010125ms)
✔ Codex stderr-limit cannot dispatch or imply Agent success (25.725417ms)
✔ Codex large cannot dispatch or imply Agent success (25.037375ms)
✔ Codex bad-json cannot dispatch or imply Agent success (27.610916ms)
✔ Codex symlink cannot dispatch or imply Agent success (25.695458ms)
✔ Codex validates original tool arguments and the final schema before dispatch (134.856667ms)
✔ Codex timeout drains final reported usage, deletes files and keeps fixed failure diagnostics (517.286458ms)
✔ Codex one-request cancellation is isolated and close drains every outstanding process (57.733958ms)
✔ Codex missing usage counters remain absent and usage hook errors still produce process diagnostics (32.55475ms)
✔ Codex file cleanup failure remains visible to Agent and close without dropping measured usage (34.108208ms)
✔ Codex invalid configuration fails before child launch (0.288583ms)
✔ successful Codex leader cannot leave an owned stdio-independent descendant running (68.938416ms)
✔ cancelled Codex process retains usage emitted while handling SIGTERM (543.112375ms)
✔ gateway close waits for cancellation usage before exposing final metrics (94.044458ms)
✔ named tool_choice rejects a different schema-valid tool (42.977166ms)
✔ tool_choice none permits a text response with tools present (31.334709ms)
✔ tool_choice auto with no selected tools is a stopped text completion (29.97575ms)
✔ timeout terminates a SIGTERM-resistant descendant after its parent exits (1715.996167ms)
✔ Codex transport adapts function decisions, disables external tools, and preserves actual CLI usage (40.441709ms)
✔ Browser Use structured schema and inline images share the same Codex inference transport (27.961959ms)
✔ Codex transport rejects schema-invalid function arguments before the browser runtime sees them (27.300583ms)
✔ automatic tool choice can return ordinary text without inventing an executed call (27.799541ms)
✔ unexpected Codex tool activity invalidates the attempt and stops its own process (26.135125ms)
✔ Codex inference deadline and cancellation stop owned child processes without treating them as model answers (212.627084ms)
✔ shared model gateway bridges both framework formats through the same fake Codex process settings (95.456417ms)
✔ network-receipt comparison task requires the authenticated response and one independently judged write (1554.851ms)
✔ Browser Use retains done, true counts, portable history and judge phase when post-task judge times out (242.102542ms)
✔ explicit judge false is preserved and ordinary full return stays distinct from cleanup (63.477375ms)
✔ judge usage contains only reported public response values, and judge exceptions retain their original phase (160.290416ms)
✔ pre-done timeout, post-done exception and non-judge finalization timeout preserve distinct observed phases (490.264584ms)
✔ owned cleanup has a bounded outcome and cannot silently count as a completed run (101.352292ms)
✔ Browser Use retains observed download paths when public kill resets browser metadata (56.568625ms)
✔ runner reports independent business success, observed agent done, and full return as separate axes after adapter failure (1285.469291ms)
✔ summary retains legacy completedAndPassed while adding explicit axes (0.074292ms)
✔ Tablaze flags reach the official SDK, and proposed finish stays distinct from accepted completion (164.443209ms)
✔ comparison runner stops the owned adapter process group after output overflow (1115.40275ms)
✔ Browser Use source pin accepts only exact git commits or hashed official archives (53.392042ms)
✔ fixture judges actual records, rejects claimed success, and resets isolated attempts (18.336167ms)
✔ download judge requires the actual matching file, not a download request or a claimed path (3.495541ms)
✔ authorization-return judge requires one provider approval and one app submission (3.452417ms)
✔ model gateway enforces equal wire settings and measures returned usage without a paid provider (3.842083ms)
✔ missing model/dependencies stay not_run and never become a competitor failure or a win (515.41775ms)
✔ scripted Tablaze smoke completes diverse real-browser tasks with independent judges (17328.749917ms)
✔ typed backend write, actual browser receipt, and Agent verification complete one reservation (636.578875ms)
✔ real navigation while planning removes the restricted tool before its stale decision dispatches (607.303ms)
✔ handler rechecks a real browser binding after waiting and rejects a stale external write (588.276292ms)
✔ same-origin tenant change cannot resume an uncertain write; matching identity reconciles without replay (1666.709333ms)
✔ CLI rejects a bound checkpoint before launching a browser or restoring its URLs (199.808458ms)
✔ input validation rejects extra fields and attempted context injection before entering a handler (3.357875ms)
✔ global tools work without a browser and receive trusted context, stable callId and a signal (0.957083ms)
✔ caller-selected output may deliberately include a context value (0.579208ms)
✔ published output schema validates the actual MCP envelope and relocated reusable refs (15.867584ms)
✔ write handler exceptions and invalid outputs remain unknown without exposing raw errors (2.668917ms)
✔ trusted read effects remain reads when handlers report failures (0.321709ms)
✔ duplicate registrations, forged handles and reserved names are rejected (0.476834ms)
✔ origins reject wildcard and non-origin restrictions and require a browser binding (0.306208ms)
✔ site filtering includes the exact port and metadata still covers invisible tools (6.875292ms)
✔ closed catalogs release a captured guard once and cannot dispatch handlers (0.383834ms)
✔ catalog context keys stay stable across leases and change when the captured document changes (0.4805ms)
✔ binding changes after catalog preparation refuse dispatch before entering a handler (0.768459ms)
✔ context identity is rechecked after asynchronous validation before the handler starts (0.38825ms)
✔ handler assertCurrent rejects a binding change across await and a started write remains unknown (0.406958ms)
✔ handler assertCurrent also rejects its cancelled dispatch after a noncooperating await (0.270917ms)
✔ a retained execution context is revoked when a successful dispatch has returned (0.272083ms)
✔ independent dispatch cancellation bounds a hanging getContext check before_handler (0.445542ms)
✔ independent dispatch cancellation bounds a hanging guard check before_handler (0.262ms)
✔ independent dispatch cancellation bounds a hanging getContext check after_handler (0.395125ms)
✔ independent dispatch cancellation bounds a hanging guard check after_handler (0.3705ms)
✔ stable contract hashes exclude opaque context values while including schemas and all registry tools (0.314958ms)
✔ an already established registry rejects base-contract and tenant identity changes (0.161333ms)
✔ context resolver failures expose only a fixed registry error (0.213708ms)
✔ runAgent uses catalog dispatch, preserves callId, and records unknown custom writes for reconciliation (2.438833ms)
✔ resume rejects schema, version, effect, origin, base-contract and same-origin tenant changes before planning (7.057208ms)
✔ reconciliation of an unknown write cannot rebind its checkpoint to another tenant on the same origin (0.999208ms)
✔ runAgent discards a decision when the captured browser binding changes during planning (0.875958ms)
✔ viewport observation reaches the 501st button after scrolling a truncated page (701.352ms)
✔ scoped observation exposes the selected subtree and resets incompatible diff baselines (193.915917ms)
✔ viewport text clips individual offscreen lines within a single text node (168.425875ms)
✔ viewport observation excludes controls and text clipped by scroll-container ancestry (167.248541ms)
✔ snapshots, extraction, verification and guarded actions share open shadow and slot content (227.778458ms)
✔ hidden hosts, hidden slots and raw form values do not leak through composed readers (277.995667ms)
✔ text matching searches beyond bounded evidence and across composed text-node boundaries (194.625084ms)
✔ explicit hidden accessibility labels still name guarded controls without leaking form values (240.525916ms)
✔ link and table extraction report item and character truncation accurately (180.184667ms)
✔ scan-budget exhaustion is explicit in both snapshots and extraction (262.418584ms)
✔ ordinary draggable and aria-labeled divs deliver actual native drop payload (734.860292ms)
✔ mouse-driven custom drag supports the observed source covering its drop target (901.470875ms)
✔ nested scaled iframe drag maps main-page coordinates and preserves native payload (1496.263417ms)
✔ open Shadow DOM drag target hit testing reaches the actual source and destination (730.127459ms)
✔ an overlay appearing after the initial mouse move cannot intercept mousedown (1415.107625ms)
✔ an overlay appearing during movement cancels the drag before drop and releases the mouse (920.435542ms)
✔ mouseup RPC rejection is a failed action even if the release was applied; cleanup releases held input (1399.910917ms)
✔ an unreleasable mouse closes only the owned session and reports input cleanup failure (879.814625ms)
✔ schema extraction binds every populated leaf to exact source text and authoritative URLs (15.090584ms)
✔ multiple sources can produce nested data and a checked aggregate without a provider dependency (6.120334ms)
✔ invented sources, URLs, approximate quotes and missing or non-leaf citations are rejected (21.435792ms)
✔ JSON pointers escape literal keys and require evidence for null and empty containers (2.229417ms)
✔ schema types, required fields, formats and local references are enforced without coercion (9.733708ms)
✔ literal schema const data is not interpreted as schema references (3.655792ms)
✔ source and candidate limits fail before accepting output (13.999292ms)
✔ quote presence is distinct from truth and the application can reject unsupported claims (16.472417ms)
✔ cancellation and deadline stop waiting on non-cooperating extractors without retries (16.5505ms)
✔ deterministic fields create typed values and preserve their exact DOM provenance (1.794958ms)
✔ field-map cardinality, optional omissions, strict conversions and observation binding are enforced (20.101ms)
✔ browser inspector uses composed text, current form state and real page provenance (634.144416ms)
✔ find traverses actual virtualized rows and returns a fresh actionable viewport ref (4832.934791ms)
✔ MCP find supports a selected iframe and preserves current snapshot semantics (817.183792ms)
✔ closing a CDP session cancels its unfinished download without closing the external browser (820.605375ms)
✔ a tab created after disposal begins is closed instead of escaping session ownership (742.89325ms)
✔ coordinate clicks never move to a sibling tab when the observed tab closes (799.256125ms)
✔ allowed native form submission preserves one POST with the actual encoded business values (785.655834ms)
✔ allowed 307 redirect preserves the original POST method and body without duplicate dispatch (666.025292ms)
✔ same-origin 302 processes Set-Cookie and a matching workspace restores that cookie and policy (1153.135417ms)
✔ explicit open/goto/new-tab deny the other port before a request or a new tab exists (659.22475ms)
✔ multi-hop HTTP 302 is intercepted before the denied hop during open, goto and new-tab (928.975875ms)
✔ iframe redirect is blocked before its denied server receives a request and counts remain per context (1007.311958ms)
✔ one context blocking a document does not interrupt a different context pending business action (1241.791834ms)
✔ a new popup first-document redirect is blocked even before an ordinary popup snapshot exists (860.017125ms)
✔ page script and meta refresh cannot issue an HTTP document request to a denied origin (1115.06125ms)
✔ an allowed localhost child of the 127.0.0.1 page retains interception through its cross-site redirect (1003.831833ms)
✔ non-document fetch and image requests reach the other origin: navigation policy is not a network firewall (591.073959ms)
✔ workspace policy changes, missing hashes, policy removal and newly added policy reject before browser launch (0.670333ms)
✔ CDP with configured navigation policy is rejected by the constructor without a connection attempt (52.573125ms)
✔ absent navigation policy retains ordinary browsing and does not attach a policy hash or diagnostics (570.897333ms)
✔ doctor validates and summarizes canonical policy without launching or printing origins (777.668458ms)
✔ policy file parsing rejects unsafe shapes, origin syntax, unknown fields and raw error disclosure (2886.20275ms)
✔ policy reader enforces a 64 KiB file bound and refuses directories and missing files (763.656958ms)
✔ policy reader refuses a FIFO without waiting for a writer (194.710125ms)
✔ policy and external CDP or setup are rejected before reading the policy path (770.956792ms)
✔ malformed private checkpoints do not disclose JSON excerpts before policy restoration (577.282041ms)
✔ MCP startup accepts a valid policy and exposes tools without launching a browser (203.914791ms)
✔ empty CLI checkpoints retain policy identity and reject changed, removed or legacy policy on resume (1218.553ms)
✔ dispose closes its already-owned browser while policy bootstrap is still awaiting a CDP response (2.566541ms)
✔ an in-flight real navigation reports a safe policy fault instead of the transport URL/error (569.811625ms)
✔ policy failure after a real write retains partial action evidence and skips the next mutation (738.708083ms)
✔ undefined disables policy while configured empty policy permits only HTTP(S) (0.672958ms)
✔ explicit empty allowlist denies all targets and differs from an absent allowlist (0.317875ms)
✔ exact origin matching preserves scheme, port and host boundaries with blocked precedence (0.230792ms)
✔ WHATWG normalization covers case, default ports, Unicode hostnames, IPv4 and IPv6 (0.10825ms)
✔ canonical identity is versioned, stable across equivalent ordering and does not collapse deny-all (0.21425ms)
✔ compiled policy and copied arrays cannot be mutated and detached methods retain their policy (0.213583ms)
✔ only origins are accepted as rules; URL parser repairs and wildcard guesses are rejected (0.867667ms)
✔ strict bounded configuration rejects unknown fields, wrong types, sparse arrays and accessors (0.700625ms)
✔ combined allow/block input is limited to 200 entries before normalization or deduplication (0.606333ms)
✔ invalid configuration, malformed navigation and denied URLs never surface private input (0.407541ms)
✔ opt-in MCP journal correlates an authenticated popup response without exposing request query or headers (840.473416ms)
✔ network capture is absent by default and refuses bodies without a declared bound (590.616292ms)
✔ attached CDP capture ignores independent Chrome pages (727.859792ms)
✔ response bodies remain gated after a scoped credential is filled (601.664459ms)
✔ pre-cancelled open does not start a browser or create a session (3.468833ms)
✔ cancellation during shared browser startup returns promptly and leaves it available (539.691625ms)
✔ a context that arrives after cancellation is closed without touching a sibling session (573.23325ms)
✔ page creation cancellation closes the owned context and any late page (714.772583ms)
✔ navigation cancellation removes only the opening attempt and drains its resources (663.019542ms)
✔ snapshot cancellation cannot register a completed late observation as a live session (729.910708ms)
✔ MCP tab_open propagates cancellation to the engine while sibling sessions survive (688.117ms)
✔ CDP cancellation cleans a late owned page and leaves independent pages and browser alive (984.132875ms)
✔ dispose is bounded while an isolated context acquisition has not returned (2436.559458ms)
✔ dispose is bounded while an isolated page acquisition has not returned (2611.120542ms)
✔ dispose reports context close failures rather than claiming complete cleanup (617.553584ms)
✔ dispose retains an existing session cleanup after close removes the session from its map (2454.630917ms)
✔ CDP disposal reports an unidentified pending page and closes it after late arrival (2798.444125ms)
✔ owned profile survives a cold browser restart, rejects concurrent use, and isolates same-origin users (2182.531042ms)
✔ an existing unrelated browser directory is never adopted as a Tablaze profile (1.575666ms)
✔ a failed Chrome launch leaves the profile reusable without exposing its path (638.653ms)
✔ stdio MCP can reopen its owned profile with an operator-supplied identity (1705.786791ms)
✔ page scripts are absent by default and incompatible with guarded configurations (199.808542ms)
✔ opt-in page scripts return JSON and fresh observations; an applied write followed by an error is uncertain (633.083125ms)
✔ timed-out script closes only its session and reports an unknown outcome (761.72525ms)
✔ planner removes only exact plain duplicates while preserving errors and distinct or annotated text (10.615375ms)
✔ planner retains text-only fallback and near-duplicate serialization (0.2585ms)
✔ projection preserves image order and complete assistant/tool groups with and without image support (0.502042ms)
✔ projection leaves successful evidence, full history, events, and saved checkpoints intact (3.627834ms)
✔ default stay keeps the opener active and completes remaining actions (758.418708ms)
✔ follow-single returns popup observation and truthfully skips remaining old-ref actions (913.786125ms)
✔ multiple candidates are retained without choosing the first or stealing focus (880.233333ms)
✔ a late popup is owned but never retroactively changes the active tab (1574.4925ms)
✔ a different owned background opener cannot enter the foreground action window (936.661334ms)
✔ iframe-triggered unique popup is associated with the observed owning page (945.970833ms)
✔ about:blank popups return bounded observations without waiting for eventual navigation (900.316208ms)
✔ popup collection consumes the existing batch deadline and never retries the input (667.683958ms)
✔ workspace preserves policy and old version-one records restore the stay default (2007.556042ms)
✔ failed workspace restoration rolls back policy as well as newly owned sessions (523.823709ms)
✔ stdio handshake exposes the bounded browser tools and structured session errors (211.723834ms)
✔ stdio tools drive isolated Chromium and return browser evidence (880.11975ms)
✔ SDK cancellation stops the browser batch before its later side effect (865.846042ms)
✔ CDP connection errors never return endpoint credentials (218.724291ms)
✔ a total batch budget ends a longer individual wait and reports skipped work (925.396416ms)
✔ CLI help, version and doctor are usable without launching a browser (765.466041ms)
✔ provider selection preserves required explicit model and rejects mismatched options before execution (2865.780792ms)
✔ new provider-only options cannot start the default MCP server (760.532417ms)
✔ Anthropic CLI forwards its explicit model, native tool schema, key and output cap; retains real usage (214.536291ms)
✔ Ollama CLI uses native requests, optional num_predict and no invented token counters (419.049958ms)
✔ explicit compatible provider keeps the previous endpoint and key contract (207.00875ms)
✔ Codex CLI uses the chosen executable and explicit model/effort without a model endpoint (657.339875ms)
✔ Codex executable defaults to codex on PATH without inventing a reasoning setting (670.096958ms)
✔ Codex failures expose fixed diagnostics without stderr, credentials or provider error text (640.490625ms)
✔ Codex provider integrates start-url, actual browser verification and normal cleanup (1282.555917ms)
✔ Codex checkpoint resume preserves prior budgets and still requires provider/model on each invocation (893.325667ms)
✔ bound checkpoints are rejected before any Codex process or browser restoration (197.56275ms)
✔ SIGTERM cancels an in-flight Codex planner and terminates its child (653.815083ms)
✔ anthropic: native wire request completes a verified real MCP tool loop (33.88275ms)
✔ anthropic: images and errors preserve paired repeated-name tool results without mutating history (5.275875ms)
✔ anthropic: text-only selection omits image bytes and native defaults remain explicit (1.420458ms)
✔ anthropic: malformed native decisions, mixed controls and unknown control fields fail safely (6.850875ms)
✔ anthropic: HTTP diagnostics discard private error bodies and do not retry (1.581167ms)
✔ anthropic: native response size is bounded before dropping unknown fields (2.080375ms)
✔ anthropic: cancellation interrupts a pending native response body (2.065708ms)
✔ anthropic: actual missing or invalid usage counters stay absent (1.202916ms)
✔ anthropic: malformed JSON and interrupted bodies retain distinct safe response failures (54.887084ms)
✔ anthropic: unpaired history is rejected before any native request (0.571292ms)
✔ ollama: native wire request completes a verified real MCP tool loop (5.089709ms)
✔ ollama: images and errors preserve paired repeated-name tool results without mutating history (1.121625ms)
✔ ollama: text-only selection omits image bytes and native defaults remain explicit (0.728791ms)
✔ ollama: malformed native decisions, mixed controls and unknown control fields fail safely (3.096625ms)
✔ ollama: HTTP diagnostics discard private error bodies and do not retry (0.854292ms)
✔ ollama: native response size is bounded before dropping unknown fields (0.783417ms)
✔ ollama: cancellation interrupts a pending native response body (0.815459ms)
✔ ollama: actual missing or invalid usage counters stay absent (0.637375ms)
✔ ollama: malformed JSON and interrupted bodies retain distinct safe response failures (53.74725ms)
✔ ollama: unpaired history is rejected before any native request (0.293125ms)
✔ native adapters validate configuration and use only their configured/default native endpoint (0.541666ms)
✔ native factory header validation never includes private names, values or keys in exceptions (0.613958ms)
✔ spawned native-provider CLI rejects an invalid environment key without echoing it to stderr (402.898291ms)
✔ real MCP form fill/save verifies current refs and visible status without another snapshot (724.468ms)
✔ read-only ref checks preserve actionability and can read a consumed current revision (242.399375ms)
✔ ref checks support textarea, select, empty values and open shadow controls (265.793625ms)
✔ MCP and engine reject missing/ambiguous targets and a ref without snapshot_id (180.808083ms)
✔ new observations and other sessions reject old snapshot identities; unknown refs fail (348.907166ms)
✔ replaced, renamed, hidden and navigated targets are rejected without selector fallback (939.332083ms)
✔ parallel status waits cannot preserve ref evidence from a replaced node or old document (821.222334ms)
✔ a later status cannot keep a previously matching value after the same node changes (403.948625ms)
✔ iframe refs retain their frame identity and reject detached frame evidence (386.064834ms)
✔ sensitive and non-form targets fail without leaking values; evidence remains bounded (350.4455ms)
✔ queued verification waits for the action batch and shares the original readonly revision (425.194583ms)
✔ scoped credential completes a real login and never appears in normal evidence or artifacts (997.051417ms)
✔ iframe credentials require both the frame and top-level origin to match (839.636417ms)
✔ MCP uses only the credential alias and reports login evidence without disclosing the value (2721.891417ms)
✔ doctor reports only secret metadata and never launches the configured browser (389.089ms)
✔ malformed secret configuration fails before doctor or run with one fixed message (1149.785ms)
✔ CDP and setup reject secrets before reading the configuration path (762.719041ms)
✔ stdio accepts configured aliases and exposes the public action without resolving or launching (204.545ms)
✔ CLI run saves secret policy identity and requires the same configuration on resume (816.261667ms)
✔ configuration does not read env values until an allowed-origin resolution and supports rotation (4.536333ms)
✔ returned configuration and scopes are frozen, with only explicit artifact opt-in (1.231375ms)
✔ resolvers reject missing, inherited, empty and oversized values without disclosing their source (1.077375ms)
✔ aborted resolution does not read env and an abort during a getter cannot return the value (0.575125ms)
✔ strict JSON shape and shared SDK metadata limits reject malformed private configurations (4.101541ms)
✔ reader enforces the actual 64 KiB boundary, UTF-8 and regular files with fixed errors (0.920417ms)
✔ reader refuses a FIFO without blocking on a writer (3.417625ms)
✔ pre-page bridge exposes only bounded metadata and fills the original control without focusing a decoy (469.292333ms)
✔ old handles fail after identical DOM replacement without filling the replacement (174.08475ms)
✔ opaque HTTP sandbox remains denied despite replacing window.origin in page script (189.544375ms)
✔ captured native primitives withstand later prototype and global replacements (144.135458ms)
✔ bridge property and operation references cannot be replaced by page code (146.104042ms)
✔ invalid bindings, values and unsupported or disabled controls reject before writing (165.208208ms)
✔ an input listener detaching the filled node reports wrote=true and does not dispatch change or fill its replacement (161.968125ms)
✔ same-URL navigation generates a fresh document identity and rejects the prior binding (175.201042ms)
✔ text projection uses lookahead before clipping and never promotes its trailing content (0.913333ms)
✔ raw boundaries remain exact when a secret resembles the replacement marker or overlaps another secret (0.777042ms)
✔ snapshot projection covers fields, options, diffs and metadata without changing reference identity (0.528292ms)
✔ link extraction preserves href-first raw allocation when redaction shrinks the last field (0.151708ms)
✔ link text and table cells redact before their field and aggregate boundaries (0.129291ms)
✔ short secrets cannot expand links or table cells past the aggregate public budget (1.70725ms)
✔ expansion followed by shrinking never reallocates the original reader budget to later fields (0.56225ms)
✔ text extraction restores the original 20000 character boundary (0.090292ms)
✔ selected metadata is copied and recursively redacted with bounded rejection (0.272291ms)
✔ metadata bounds replacement expansion as well as raw input size (43.768792ms)
✔ published and runtime MCP schemas accept only a bounded alias plus observed ref for fill_secret (29.00475ms)
✔ secret failures retain their fixed public code in structured and text MCP results (1.348459ms)
✔ SDK server rejects secret configuration with external CDP before any resolver is called (0.231166ms)
✔ undefined disables secrets; compiled facade is frozen, detached methods work, and values are private (1.749375ms)
✔ strict options reject unknown keys, accessors, prototypes and wrong optional types without invoking getters (0.27925ms)
✔ strict definitions reject invalid names, versions, duplicate aliases, unknown fields and inherited resolvers (0.297875ms)
✔ arrays reject holes, extra properties and getters; alias and configured-origin limits are bounded (0.967917ms)
✔ origin lists require exact nonempty HTTP(S) origins; wildcard, credentials, path and opaque origins are rejected (0.251958ms)
✔ frame and top origins are both required, including port and scheme; scope failure never invokes resolver (0.392375ms)
✔ hash normalizes ordering, duplicates and explicit default top scope; excludes callbacks and resolved values (0.65625ms)
✔ caller mutations cannot change cloned scopes, metadata or captured resolver (0.14ms)
✔ context is checked before resolving and again before delivering; failed delivery still redacts the resolved value (0.215166ms)
✔ resolver and context exceptions are fixed and never expose raw thrown objects or messages (0.697834ms)
✔ pre-aborted calls invoke neither context nor resolver and never expose the abort reason (0.139833ms)
✔ cancellation bounds a hanging pre-context check and does not enter the resolver later (2.265042ms)
✔ cancellation bounds resolver wait, passes an aborted signal, and registers its late value while store remains alive (0.370791ms)
✔ late resolver rejection after cancellation is observed without unhandled rejection (0.209916ms)
✔ cancellation bounds a hanging post-resolution context check while preserving redaction (0.227083ms)
✔ all rotated and cross-alias values remain redacted; duplicate values do not consume retention slots (1.860417ms)
✔ resolved values must be nonempty bounded well-formed strings and errors contain no returned value (0.256166ms)
✔ 128 distinct-value limit fails before delivery without dropping earlier redactions (2.155125ms)
✔ 64 KiB retention limit counts UTF-8 bytes and rejects overflow atomically (9.819375ms)
✔ raw, whitespace-normalized, URI and JSON-escaped variants redact literally and contains follows the same set (0.260416ms)
✔ overlapping secrets use longest simultaneous replacement and never reprocess the replacement marker (0.154084ms)
✔ crossing and chained matches cover every sensitive character in original coordinates (0.18525ms)
✔ public aliases equal to known values are hidden without changing configured resolution or unrelated names (0.143458ms)
✔ a late cancelled value and a newer rotated value are both retained until close (1.496083ms)
✔ padding covers maximum URI and JSON forms; redaction before truncation does not reveal a secret prefix (2.882708ms)
✔ close revokes active resolution, aborts the resolver signal and prevents silent redaction bypass afterward (0.360667ms)
✔ MCP schema extraction returns typed shadow/form data and keeps observed references usable (558.520167ms)
✔ MCP preserves structured validation error codes and pointer issues without raw page values (199.866625ms)
✔ MCP rejects sensitive, hidden, raw-form and truncated fields without partial extracted data (225.507084ms)
✔ MCP extraction follows the explicitly observed frame and cites its own URL (234.523458ms)
✔ MCP bounds field counts and rejects unsupported field options before extraction (166.59175ms)
✔ popup tabs stay owned, switching invalidates references and last close ends session (598.201125ms)
✔ navigation and explicit tabs preserve session state and handle browser history (329.872583ms)
✔ upload reads an explicit local fixture and download produces the actual file (373.466333ms)
✔ native confirm and prompt use one-shot policies and disclose actual results (449.771875ms)
✔ storage state restores cookies and localStorage across independent engine lifetimes (1033.948292ms)
✔ hover and double-click execute guarded references, coordinates reject offscreen input (312.66775ms)
✔ CSS-pixel screenshots support actual canvas coordinate input (228.668042ms)
ℹ tests 447
ℹ suites 0
ℹ pass 447
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 188655.116583
