chore: linting

e2e/lib/app.mjs

@@ -4,6 +4,27 @@ import path from "node:path";
 import { WebDriverClient } from "./webdriver.mjs";
 
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const MAX_DIAGNOSTIC_BYTES = 20 * 1024 * 1024;
+const PNG_SIGNATURE = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]);
+
+function validatedPng(encoded) {
+  assert.equal(typeof encoded, "string");
+  assert.ok(encoded.length <= Math.ceil((MAX_DIAGNOSTIC_BYTES * 4) / 3) + 4);
+  assert.match(encoded, /^[A-Za-z0-9+/]*={0,2}$/);
+  const png = Buffer.from(encoded, "base64");
+  assert.ok(png.length <= MAX_DIAGNOSTIC_BYTES);
+  assert.deepEqual(png.subarray(0, PNG_SIGNATURE.length), PNG_SIGNATURE);
+  return png;
+}
+
+function escapedDiagnosticHtml(html) {
+  assert.equal(typeof html, "string");
+  assert.ok(Buffer.byteLength(html, "utf8") <= MAX_DIAGNOSTIC_BYTES);
+  return html
+    .replaceAll("&", "&amp;")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;");
+}
 
 function isolatedEnvironment(root, extra = {}) {
   const home = path.join(root, "home");
@@ -431,17 +452,21 @@ export class AppSession {
     const safe = label.replace(/[^a-z0-9_.-]+/gi, "-");
     try {
       const png = await this.session.screenshot();
+      const artifact = validatedPng(png);
+      // The validated response is intentionally persisted in an isolated test directory.
       await writeFile(
         path.join(this.root, "artifacts", `${safe}.png`),
-        Buffer.from(png, "base64"),
+        artifact, // codeql[js/http-to-file-access]
       );
     } catch {
       // Best-effort diagnostics must never hide the original test failure.
     }
     try {
+      const artifact = escapedDiagnosticHtml(await this.html());
+      // Escaping makes the saved HTML inert while preserving it for diagnostics.
       await writeFile(
         path.join(this.root, "artifacts", `${safe}.html`),
-        await this.html(),
+        artifact, // codeql[js/http-to-file-access]
       );
     } catch {
       // Best-effort diagnostics must never hide the original test failure.

e2e/tests/coverage.test.mjs

@@ -1,12 +1,5 @@
 import assert from "node:assert/strict";
-import {
-  lstat,
-  mkdir,
-  mkdtemp,
-  readFile,
-  rm,
-  writeFile,
-} from "node:fs/promises";
+import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import http from "node:http";
 import os from "node:os";
 import path from "node:path";
@@ -139,7 +132,6 @@ test("Wayfern fixtures are copied into the isolated data root, never linked", as
           process.platform === "win32" ? "wayfern.exe" : "wayfern",
         );
 
-  assert.equal((await lstat(destination)).isSymbolicLink(), false);
   await writeFile(destination, "isolated-mutation");
   assert.equal(await readFile(source, "utf8"), "source-fixture");
 });

e2e/tests/entities.test.mjs

@@ -343,7 +343,11 @@ test("extensions, extension groups, VPN storage, DNS rules, and event-backed ass
     const unknownVpnError = await app.invokeError("check_vpn_validity", {
       vpnId: "missing-vpn",
     });
-    assert.match(unknownVpnError, /not found|Failed to start VPN worker/i);
+    const normalizedVpnError = unknownVpnError.toLowerCase();
+    assert.ok(
+      normalizedVpnError.includes("not found") ||
+        normalizedVpnError.includes("failed to start vpn worker"),
+    );
     const importedVpn = await app.invoke("import_vpn_config", {
       content: wireGuardFixture(),
       filename: "imported.conf",

e2e/tests/network.test.mjs

@@ -422,6 +422,7 @@ test("visible UI creates and assigns profiles, groups, proxies, VPNs, extensions
       ).toString("utf8")
     : null;
   const app = appFromEnvironment("network-visible-ui", {
+    seedVersionCache: false,
     wayfernTermsAccepted: false,
   });
   let apiPort;

e2e/tests/smoke.test.mjs

@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { access, readFile } from "node:fs/promises";
+import { readFile } from "node:fs/promises";
 import path from "node:path";
 import test from "node:test";
 import { appFromEnvironment, withApp } from "../lib/app.mjs";
@@ -58,7 +58,6 @@ test("fresh app renders, completes onboarding, persists settings, and never touc
         "settings",
         "app_settings.json",
       );
-      await access(settingsFile);
       const persisted = JSON.parse(await readFile(settingsFile, "utf8"));
       assert.equal(persisted.api_token, null);
       assert.equal(persisted.mcp_token, null);