// Actual Chromium; every HTTP request is fulfilled or aborted, with disposable data only.
const {chromium}=require('playwright');
const fs=require('fs');const assert=require('node:assert/strict');
(async()=>{
 const browser=await chromium.launch({headless:true,args:['--no-sandbox','--disable-background-networking']});
 try {
  const context=await browser.newContext({serviceWorkers:'block'});
  const page=await context.newPage();
  const marker='<img src="data:," onerror="window.__discoveryAudit=1">';
  const commands=[];const unexpected=[];
  const observations=[0,1].map(n=>({id:'00000000-0000-4000-8000-00000000000'+(n+1),agent_id:'Agent '+n,agent_zone_id:'Zone '+n,version:'2026-01-01T00:00:00.00000'+n+'+00:00',created_at:'2026-01-01T00:00:00Z',ip_address:'198.51.100.10',room_name:marker,model:marker,mac_address:marker,discovery_status:'new'}));
  await page.route('**/*',async route=>{
   const url=new URL(route.request().url());
   if(url.origin!=='http://minerops.invalid'){unexpected.push(url.href);return route.abort();}
   const path=url.pathname;
   if(path==='/agent/control')return route.fulfill({contentType:'text/html',body:fs.readFileSync(process.argv[2],'utf8')});
   if(path==='/api/agent/status-summary')return route.fulfill({json:{live_database_counts:{total:2,online:2},latest_snapshot:{},agent:{agent_id:marker,hostname:marker,version:marker},recent_commands:[{command_type:marker,command_status:'failed',requested_by_username:marker,error_message:marker}]}});
   if(path==='/api/agent/discoveries')return route.fulfill({json:{discoveries:observations}});
   if(path==='/api/agent/discoveries/summary')return route.fulfill({json:{total:2,counts:{new:2}}});
   if(path==='/api/agent/discoveries/review'||path==='/api/agent/discoveries/enrich-match'){
    commands.push({path,body:route.request().postDataJSON()});return route.fulfill({json:{ok:true,message:'Saved'}});
   }
   return route.abort();
  });
  await context.addInitScript(()=>localStorage.setItem('minerops_token','disposable-browser-token'));
  page.on('dialog',dialog=>dialog.accept());
  await page.goto('http://minerops.invalid/agent/control');
  await page.waitForSelector('#discoveriesBody tr button');
  if(process.argv[3]==='baseline'){
   await page.waitForFunction(()=>window.__discoveryAudit===1);
   console.log('Baseline positive control: harmless stored event handler executed.');
  } else {
   assert.equal(await page.evaluate(()=>window.__discoveryAudit),undefined);
   assert.equal(await page.locator('#discoveriesBody img,#commandsBody img,[onerror]').count(),0);
   assert.ok((await page.locator('#discoveriesBody').innerText()).includes(marker));
   await page.locator('#discoveriesBody tr').nth(0).getByRole('button',{name:'Add as New',exact:true}).click();
   await page.waitForFunction(()=>document.getElementById('statusBox').textContent==='Agent status loaded.');
   await page.locator('#discoveriesBody tr').nth(1).getByRole('button',{name:'Enrich / Match',exact:true}).click();
   assert.equal(commands.length,2);
   assert.equal(commands[0].body.discovery_id,observations[0].id);
   assert.equal(commands[0].body.version,observations[0].version);
   assert.equal(commands[1].body.discovery_id,observations[1].id);
   assert.equal(commands[1].body.version,observations[1].version);
   assert.ok(commands.every(c=>!Object.hasOwn(c.body,'ip_address')));
   assert.deepEqual(unexpected,[]);
   console.log('Chromium passed: stored markup inert; Agent/status/error data escaped; same-IP actions retain exact observation IDs/versions; no external requests.');
  }
 } finally {await browser.close();}
})().catch(e=>{console.error(e);process.exitCode=1});