test: add data platform tests and media fixture

Tests for SizeCappedBuffer (eviction, export, summary), validateTempPath
(TEMP_DIR only, rejects cwd), command registration (all new commands in
correct scope sets), and MIME mapping source checks.

Rich HTML fixture with: standard images, lazy-loaded images, srcset,
video with sources + HLS, audio, CSS background-images, JSON-LD,
Open Graph, Twitter Cards, and meta tags.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

browse/test/data-platform.test.ts

@@ -0,0 +1,176 @@
+/**
+ * Tests for the browser data platform: media extraction, network capture,
+ * path security, and structured data extraction.
+ */
+
+import { describe, it, expect } from 'bun:test';
+import { SizeCappedBuffer, type CapturedResponse } from '../src/network-capture';
+import { validateTempPath, validateOutputPath, validateReadPath } from '../src/path-security';
+import { TEMP_DIR } from '../src/platform';
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+
+// ─── SizeCappedBuffer ─────────────────────────────────────────
+
+describe('SizeCappedBuffer', () => {
+  function makeEntry(size: number, url = 'https://example.com'): CapturedResponse {
+    return {
+      url,
+      status: 200,
+      headers: {},
+      body: 'x'.repeat(size),
+      contentType: 'text/plain',
+      timestamp: Date.now(),
+      size,
+      bodyTruncated: false,
+    };
+  }
+
+  it('stores entries within capacity', () => {
+    const buf = new SizeCappedBuffer(1000);
+    buf.push(makeEntry(100));
+    buf.push(makeEntry(200));
+    expect(buf.length).toBe(2);
+    expect(buf.byteSize).toBe(300);
+  });
+
+  it('evicts oldest entries when over capacity', () => {
+    const buf = new SizeCappedBuffer(500);
+    buf.push(makeEntry(200, 'https://a.com'));
+    buf.push(makeEntry(200, 'https://b.com'));
+    buf.push(makeEntry(200, 'https://c.com')); // should evict first entry
+    expect(buf.length).toBe(2);
+    const urls = buf.toArray().map(e => e.url);
+    expect(urls).toContain('https://b.com');
+    expect(urls).toContain('https://c.com');
+    expect(urls).not.toContain('https://a.com');
+  });
+
+  it('evicts multiple entries for one large push', () => {
+    const buf = new SizeCappedBuffer(500);
+    buf.push(makeEntry(100));
+    buf.push(makeEntry(100));
+    buf.push(makeEntry(100));
+    buf.push(makeEntry(400)); // evicts first two (need totalSize + 400 <= 500, so totalSize <= 100)
+    expect(buf.length).toBe(2); // one 100-byte entry + one 400-byte entry
+    expect(buf.byteSize).toBe(500);
+  });
+
+  it('clear resets buffer', () => {
+    const buf = new SizeCappedBuffer(1000);
+    buf.push(makeEntry(100));
+    buf.push(makeEntry(200));
+    buf.clear();
+    expect(buf.length).toBe(0);
+    expect(buf.byteSize).toBe(0);
+  });
+
+  it('exports to JSONL file', () => {
+    const buf = new SizeCappedBuffer(1000);
+    buf.push(makeEntry(10, 'https://a.com'));
+    buf.push(makeEntry(20, 'https://b.com'));
+
+    const tmpFile = path.join(os.tmpdir(), `test-export-${Date.now()}.jsonl`);
+    try {
+      const count = buf.exportToFile(tmpFile);
+      expect(count).toBe(2);
+      const lines = fs.readFileSync(tmpFile, 'utf-8').trim().split('\n');
+      expect(lines.length).toBe(2);
+      const parsed = JSON.parse(lines[0]);
+      expect(parsed.url).toBe('https://a.com');
+    } finally {
+      fs.unlinkSync(tmpFile);
+    }
+  });
+
+  it('summary shows entries', () => {
+    const buf = new SizeCappedBuffer(1000);
+    buf.push(makeEntry(1024, 'https://api.example.com/graphql'));
+    const summary = buf.summary();
+    expect(summary).toContain('1 responses');
+    expect(summary).toContain('graphql');
+    expect(summary).toContain('1KB');
+  });
+
+  it('summary shows empty message when no entries', () => {
+    const buf = new SizeCappedBuffer(1000);
+    expect(buf.summary()).toBe('No captured responses.');
+  });
+});
+
+// ─── validateTempPath ─────────────────────────────────────────
+
+describe('validateTempPath', () => {
+  let tmpFile: string;
+
+  it('allows paths within /tmp that exist', () => {
+    tmpFile = path.join(TEMP_DIR, `test-temp-path-${Date.now()}.jpg`);
+    fs.writeFileSync(tmpFile, 'test');
+    try {
+      expect(() => validateTempPath(tmpFile)).not.toThrow();
+    } finally {
+      fs.unlinkSync(tmpFile);
+    }
+  });
+
+  it('rejects non-existent files', () => {
+    expect(() => validateTempPath('/tmp/nonexistent-file-12345.jpg')).toThrow(/not found/i);
+  });
+
+  it('rejects paths in cwd', () => {
+    // Create a real file in cwd to test the path check (not the existence check)
+    const cwdFile = path.join(process.cwd(), 'package.json');
+    expect(() => validateTempPath(cwdFile)).toThrow(/temp directory/i);
+  });
+
+  it('rejects absolute paths outside safe dirs', () => {
+    expect(() => validateTempPath('/etc/passwd')).toThrow();
+  });
+});
+
+// ─── Command registration ─────────────────────────────────────
+
+describe('command registration', () => {
+  it('all new commands have descriptions', () => {
+    // The load-time validation in commands.ts throws if any command
+    // is missing from COMMAND_DESCRIPTIONS. If this import succeeds,
+    // all commands are properly registered.
+    const { COMMAND_DESCRIPTIONS, ALL_COMMANDS } = require('../src/commands');
+    const newCommands = ['media', 'data', 'download', 'scrape', 'archive'];
+    for (const cmd of newCommands) {
+      expect(ALL_COMMANDS.has(cmd)).toBe(true);
+      expect(COMMAND_DESCRIPTIONS[cmd]).toBeTruthy();
+    }
+  });
+
+  it('new commands are in correct scope sets', () => {
+    const { SCOPE_READ, SCOPE_WRITE } = require('../src/token-registry');
+    expect(SCOPE_READ.has('media')).toBe(true);
+    expect(SCOPE_READ.has('data')).toBe(true);
+    expect(SCOPE_WRITE.has('download')).toBe(true);
+    expect(SCOPE_WRITE.has('scrape')).toBe(true);
+    expect(SCOPE_WRITE.has('archive')).toBe(true);
+  });
+
+  it('media and data are in PAGE_CONTENT_COMMANDS', () => {
+    const { PAGE_CONTENT_COMMANDS } = require('../src/commands');
+    expect(PAGE_CONTENT_COMMANDS.has('media')).toBe(true);
+    expect(PAGE_CONTENT_COMMANDS.has('data')).toBe(true);
+  });
+});
+
+// ─── MIME type mapping ─────────────────────────────────────────
+
+describe('mimeToExt', () => {
+  // mimeToExt is a private function in write-commands.ts,
+  // so we test it indirectly through command behavior.
+  // This test verifies the source contains the expected mappings.
+  it('write-commands.ts contains MIME mappings', () => {
+    const src = fs.readFileSync(path.join(import.meta.dir, '../src/write-commands.ts'), 'utf-8');
+    expect(src).toContain("'image/png': '.png'");
+    expect(src).toContain("'image/jpeg': '.jpg'");
+    expect(src).toContain("'video/mp4': '.mp4'");
+    expect(src).toContain("'audio/mpeg': '.mp3'");
+  });
+});

browse/test/fixtures/media-page.html

@@ -0,0 +1,67 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>Media Test Page</title>
+  <meta property="og:title" content="Test Product">
+  <meta property="og:description" content="A test product description">
+  <meta property="og:image" content="https://example.com/og-image.jpg">
+  <meta property="og:type" content="product">
+  <meta name="twitter:card" content="summary_large_image">
+  <meta name="twitter:title" content="Test Product Tweet">
+  <meta name="description" content="Page description for SEO">
+  <meta name="keywords" content="test, product, media">
+  <meta name="author" content="Test Author">
+  <link rel="canonical" href="https://example.com/test-product">
+  <script type="application/ld+json">
+  {
+    "@context": "https://schema.org",
+    "@type": "Product",
+    "name": "Test Widget",
+    "description": "A widget for testing",
+    "image": "https://example.com/widget.jpg",
+    "offers": {
+      "@type": "Offer",
+      "price": "29.99",
+      "priceCurrency": "USD"
+    }
+  }
+  </script>
+  <style>
+    .hero { background-image: url('https://example.com/hero-bg.jpg'); width: 100%; height: 300px; }
+    .banner { background-image: url('https://example.com/banner.png'); width: 100%; height: 100px; }
+  </style>
+</head>
+<body>
+  <div class="hero"></div>
+  <div class="banner"></div>
+
+  <!-- Standard images -->
+  <img src="https://example.com/photo1.jpg" alt="Photo 1" width="800" height="600">
+  <img src="https://example.com/photo2.png" alt="Photo 2" width="400" height="300">
+
+  <!-- Lazy loaded image -->
+  <img data-src="https://example.com/lazy.jpg" alt="Lazy Image" loading="lazy" width="600" height="400">
+
+  <!-- Image with srcset -->
+  <img src="https://example.com/responsive-sm.jpg"
+       srcset="https://example.com/responsive-sm.jpg 480w, https://example.com/responsive-lg.jpg 1200w"
+       alt="Responsive Image"
+       width="480" height="320">
+
+  <!-- Video with sources -->
+  <video width="640" height="480" poster="https://example.com/poster.jpg">
+    <source src="https://example.com/video.mp4" type="video/mp4">
+    <source src="https://example.com/video.webm" type="video/webm">
+  </video>
+
+  <!-- HLS video -->
+  <video width="1920" height="1080">
+    <source src="https://example.com/stream.m3u8" type="application/x-mpegURL">
+  </video>
+
+  <!-- Audio -->
+  <audio>
+    <source src="https://example.com/podcast.mp3" type="audio/mpeg">
+  </audio>
+</body>
+</html>