test: full test-suite refactor sweep (#61)

* chore(test): start test-suite refactor sweep

* test(ltl): pin exact multi-obligation residual AST

* test(ltl): table-test finalize Kleene connective combinations

* test(ltl): pin reduce over pending inner for bound, Or, Not

* test(ltl): marshal bounded Always steps/duration/deadline

* test(verifier): cover LTL combinator verdict transitions and within unit panic

* test(verifier): table-test DecodeAction kinds and lastAction field exposure

* test(verifier): assert WithPlatform(ios) reaches the picker host and key pool

* test(verifier): widen weighted-selection assertion to a 5x skew margin

* test(verifier): un-skip ax-find round trip with a committed tree fixture

* test(runner): pin isWDADrop to sidecar reconnect-failed message origin

* test(runner): assert PressKey/Wait trace encoding records kind-specific fields

* test(runner): cover RenderSummary unsupported-verbs surfacing branch

* test(trace): set Hierarchy in round-trip and lock lossy Tree contract

Also add a -race concurrent WriteStep test that asserts N well-formed JSONL lines, catching torn lines if the writer mutex is dropped.

* test(trace): round-trip witnesses/changes/metrics/exceptions, pin step-0 witness

* test(trace): document ViolationsAreGreppable grep contract and lock-free WriteScreenshot

* test(hierarchy): cover invalid-JSON and malformed-bounds parser paths

* test(trace): guard writer mutex via WriteStep/Close race on w.file

* test(replay): drop unfailable assets and devproxy assertions

* test(replay): cache reuses on equal mtime, reparses after append

* test(replay): violation marker falls back to detection step when attributed missing

* test(replay): corrupt meta/trace dirs return 500 with error body

* test(replay): SSE client receives runs.changed after a broadcast

* test(replay): Run coalesces creates, ignores write/chmod, closes subs on cancel

* fix(sidecar): synchronize health fixture writes and exercise healthError

* test(sidecar): cover swipe/longpress/doubletap/erase/presskey/metrics/logs translations

* test(sidecar): cover DoubleTapSelector composition and mid-gesture cancel

* test(sidecar): assert gRPC error status surfaces from action RPC

* fix(chrome): route action methods through runCtx so caller cancellation aborts CDP

* fix(chrome): route hierarchy/screenshot/waitidle/metrics through runCtx

* refactor(ios): extract pure simctl JSON parsers

* refactor(ios): add command-runner seams for EnsureSimulator

* test(ios): table-test simctl parsers and EnsureSimulator seams

* test(sidecarassets): cover placeholder build path

* test(sidecarassets): assert reuse via sentinel bytes not mtime

* test(bundler): cover properties-only spec registration

* refactor(testrun): extract prepareBundleInputs from Execute

* test(testrun): cover prepareBundleInputs aliases and missing-runtime error

* test(testrun): table-test resolveRuntimeSibling search edges

* test(testrun): exact-output tests for progressHandler line format

* fix(cmd): point bundle-check aliases at pkg/spec/src

* test(cmd): smoke-test bundle-check resolves spec aliases

* test(cmd): table-test hier-check parse and FindAll on fixture

* test(cmd): unit-test buildBrowseURL deep-link vs root

* test(cmd): drop flaky TestRun_Doctor that launched real Chromium

* test(cmd): pin pipeline error to bundle resolution on web platform

* test(replay-ui): add bun test script

* ci(replay-ui): run bun test via make web-test target

* ci(replay-ui): point bun cache key at replay-ui/bun.lock

* test(replay-ui): exercise real URL encoding and non-ok throw in getJson

* refactor(replay-ui): extract snapshot flatten/getAtPath into lib module

* test(replay-ui): pin snapshot flatten/getAtPath path round-trip

* refactor(replay-ui): extract action selector/format into lib module

* test(replay-ui): pin action selector parse and row formatting

* refactor(replay-ui): share one statusFor between panels

* refactor(replay-ui): extract run-history derivation into lib module

* test(replay-ui): pin shared statusFor precedence and ordering

* test(replay-ui): pin run-history derivation alignment

* refactor(replay-ui): export clampIndex for testing

* refactor(replay-ui): extract keyboard-nav dispatch into pure module

* refactor(replay-ui): extract metrics formatters into lib module

* test(replay-ui): pin clampIndex step boundaries

* test(replay-ui): pin keyboard-nav ownership and key routing

* test(replay-ui): pin metrics formatters and path gap handling

* refactor(sidecar): expose device-output parsers as internal for testing

* test(sidecar): table-test device-output parsers against malformed input

* test(sidecar): cover logcat parsing year inference and line skipping

* test(sidecar): pin pressKey keycode mapping and unknown-key rejection

* test(sidecar): metrics bundleId falls back to launched app and honors override

* test(sidecar): loosen deadline upper bound to tolerate slow CI scheduling

* test(web-runtime): export selector builders for unit tests

* test(web-runtime): guard sanitize cycle, function, and depth limits

* test(web-runtime): table-test selector builder quoting and escaping

* test(sidecar): collapse scalar-forwarding RPC tests into a table

* test(replay-ui): dedup step/summary fixtures into shared module

* test(ios): collapse pickSimulator point-tests into a table

pkg/spec/test/web-runtime.test.ts

@@ -9,6 +9,44 @@ import { test } from "node:test";
 // A 64-bit seed that loses precision as a JS Number must survive as a BigInt.
 process.env.SANDERLING_SEED = "9007199254740993";
 
+// cssEscape delegates to the browser's CSS.escape, absent in node. Install the
+// WHATWG CSSOM escape algorithm so selector-builder tests exercise the real
+// escaping production relies on, not a stub.
+if (!(globalThis as { CSS?: unknown }).CSS) {
+  (globalThis as { CSS?: { escape(v: string): string } }).CSS = {
+    escape(value: string): string {
+      let out = "";
+      for (let i = 0; i < value.length; i++) {
+        const c = value.charCodeAt(i);
+        if (c === 0) {
+          out += "�";
+        } else if (
+          (c >= 0x1 && c <= 0x1f) ||
+          c === 0x7f ||
+          (i === 0 && c >= 0x30 && c <= 0x39) ||
+          (i === 1 && c >= 0x30 && c <= 0x39 && value.charCodeAt(0) === 0x2d)
+        ) {
+          out += "\\" + c.toString(16) + " ";
+        } else if (i === 0 && c === 0x2d && value.length === 1) {
+          out += "\\" + value[i];
+        } else if (
+          c >= 0x80 ||
+          c === 0x2d ||
+          c === 0x5f ||
+          (c >= 0x30 && c <= 0x39) ||
+          (c >= 0x41 && c <= 0x5a) ||
+          (c >= 0x61 && c <= 0x7a)
+        ) {
+          out += value[i];
+        } else {
+          out += "\\" + value[i];
+        }
+      }
+      return out;
+    },
+  };
+}
+
 const { __testing__ } = await import("../src/web-runtime.ts");
 const { host } = __testing__;
 
@@ -183,3 +221,121 @@ test("an uncaught cross-extractor read aborts evaluateExtractors", () => {
     /inside another extractor is not allowed/,
   );
 });
+
+// sanitize runs over every extractor's return value before it leaves the
+// runtime. A user extractor that returns a page object reachable from
+// document/window can be self-referential, carry functions, or nest deeply;
+// without cycle, function, and depth guards extraction overflows the stack or
+// emits non-serializable values. These exercise sanitize via the real path.
+function sanitizeViaExtract(value: unknown): unknown {
+  __testing__.extractors.length = 0;
+  __testing__.runtime.extract(() => value);
+  let out: Record<number, unknown> = {};
+  withState(() => {
+    out = __testing__.evaluateExtractors();
+  });
+  return out[0];
+}
+
+test("sanitize breaks a self-referential cycle instead of overflowing", () => {
+  const cyclic: Record<string, unknown> = { name: "root" };
+  cyclic.self = cyclic;
+  const result = sanitizeViaExtract(cyclic) as Record<string, unknown>;
+  assert.equal(result.name, "root");
+  assert.equal(result.self, null);
+});
+
+test("sanitize drops function-valued properties", () => {
+  const result = sanitizeViaExtract({ keep: 1, fn: () => 7 }) as Record<string, unknown>;
+  assert.deepEqual(result, { keep: 1 });
+});
+
+test("sanitize drops a top-level function to undefined", () => {
+  assert.equal(sanitizeViaExtract(() => 7), undefined);
+});
+
+test("sanitize bounds recursion past its depth limit", () => {
+  let deep: Record<string, unknown> = { leaf: true };
+  for (let i = 0; i < 40; i++) deep = { next: deep };
+  // Walk to the depth cap; beyond it sanitize must yield null, not recurse on.
+  let node: unknown = sanitizeViaExtract(deep);
+  for (let i = 0; i < 32 && node && typeof node === "object"; i++) {
+    node = (node as Record<string, unknown>).next;
+  }
+  assert.equal(node, null);
+});
+
+test("sanitize preserves arrays and nested plain values", () => {
+  const result = sanitizeViaExtract({ items: [1, "two", { ok: true }] });
+  assert.deepEqual(result, { items: [1, "two", { ok: true }] });
+});
+
+// xpathStringLiteral builds XPath 1.0 string literals by hand (no escape
+// syntax in XPath 1.0). A value carrying a quote that isn't wrapped or
+// concat()-composed produces a malformed expression, so document.evaluate
+// throws or, worse, matches the wrong node by truncating at the quote.
+const { xpathStringLiteral } = __testing__;
+
+test("xpathStringLiteral table: quote handling stays well-formed", () => {
+  const cases: Array<[string, string]> = [
+    ["plain", '"plain"'],
+    ['has"double', `'has"double'`],
+    ["has'single", `"has'single"`],
+    [`both"and'`, `concat("both", '"', "and'")`],
+    [`"`, `'"'`],
+  ];
+  for (const [input, want] of cases) {
+    assert.equal(xpathStringLiteral(input), want, input);
+  }
+});
+
+// selectorFromString routes a "kind:value" prefix; text becomes an XPath
+// equality, everything else a CSS attribute selector. A value containing a
+// colon must not be re-split, and a quote in a text value must reach the
+// well-formed XPath literal rather than corrupting the predicate.
+const { selectorFromString, selectorFromObject } = __testing__;
+
+test("selectorFromString routes text to a normalize-space XPath", () => {
+  assert.deepEqual(selectorFromString("text:Hello"), {
+    xpath: `//*[normalize-space(text())="Hello"]`,
+  });
+});
+
+test("selectorFromString keeps colons in the value intact", () => {
+  // Only the first colon splits kind from value; the rest is the value.
+  assert.deepEqual(selectorFromString("text:a:b:c"), {
+    xpath: `//*[normalize-space(text())="a:b:c"]`,
+  });
+});
+
+test("selectorFromString text value with both quote kinds uses concat", () => {
+  assert.deepEqual(selectorFromString(`text:say "hi" o'clock`), {
+    xpath: `//*[normalize-space(text())=concat("say ", '"', "hi", '"', " o'clock")]`,
+  });
+});
+
+test("selectorFromObject escapes attribute values to prevent injection", () => {
+  // A quote in an id value, left unescaped, would close the attribute selector
+  // early and match a different element.
+  assert.deepEqual(selectorFromObject({ id: 'a"]' }), {
+    css: `[id="a\\"\\]"]`,
+  });
+});
+
+test("selectorFromObject maps known keys to their canonical attribute", () => {
+  assert.deepEqual(selectorFromObject({ testID: "submit" }), {
+    css: `[data-testid="submit"]`,
+  });
+});
+
+test("selectorFromObject falls back to a literal attribute for unknown keys", () => {
+  assert.deepEqual(selectorFromObject({ "data-foo": "bar" }), {
+    css: `[data-foo="bar"]`,
+  });
+});
+
+test("selectorFromObject text-only selector becomes an XPath", () => {
+  assert.deepEqual(selectorFromObject({ text: "Go" }), {
+    xpath: `//*[normalize-space(text())="Go"]`,
+  });
+});