Version 0.5.1 in package.json, the lockfile, the plugin manifest, the
marketplace entry, and the npx pins inside the skill. CHANGELOG covers the
fingerprint fallback (#40), the footer no longer offering planned commands
(#44), and find in every footer (#46). The README install note and llms.txt
now describe the full transport chain: Chrome, then Firefox, then native
fetch.
cache.js had no test importing it, and cli.js was tested only through its
auth commands. Both now have a file of their own.
tests/cache.test.js proves the policy the module's comment states: a miss
fetches, parses, and writes under host and extension; a fresh copy is served
from disk without touching the network; a copy older than a day is refetched
and replaced; a body the parser rejects is never written, and a stale good
copy survives such a refetch; a cache directory that cannot be created costs
only the refetch. The network is a local proxy that records what it sees, so
"never asked" is asserted, not assumed.
tests/cli.test.js spawns the real binary against a throwaway OC_HOME with a
page seeded straight into a session file, so read, next, find, and do on
text all have something to answer with and nothing fetches. It covers help
on no command and both help flags, the help text naming every dispatchable
command once, unknown first words, a site name reaching the shortcut
resolver before being called unknown, budget and session name validation
running before any command, the nothing-open message from every session
command, the usage lines of open, raw, read, find, and do, do on a text
number reading in place with a recording proxy proving no request left, the
four planned commands failing with one line that names themselves, sites,
and flags placed before or after the command.
Each test was checked against a deliberate break in the code it guards.
find is the cheapest way to go deeper on a rendered page: one command lands
on the block that matters, where read needs the right number first and next
pages toward it. SKILL.md already lists it first under "going further,
cheapest first", but no footer offered it, and the footer is what an agent
actually reads, so callers were steered toward read, next, and raw instead.
The entry now appears in all three footers, after do and before read, so the
order matches the skill. On find's own output it turns the "narrow the
query" hint into an action.
Cost on the fixtures is 3 or 4 tokens per render (news 127 to 131, login 30
to 33, forum 695 to 699). Skipping one next on a long page pays for a
hundred of those.
The test checks the same three footer sites as the stub probe: find is
present and listed ahead of read. It fails on main.
Closes#46.
The footer is the line an agent reads to pick its next command, so a name
in it that cannot run costs a turn and returns nothing. fill and submit are
still stubs, so every page with an input was offering two commands that
throw NotImplemented. Removing them also takes 7 tokens off the rendered
news fixture and 6 off login.
The test probes act.js for handlers that throw NotImplemented rather than
listing them by name, so the next stub to land is covered without anyone
remembering to come back here. It checks all three footers: the render, and
both of find's paths.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
impers resolves the chrome alias to its newest fingerprint (chrome150 as
of impers 0.1.1), but the native library it loads can be an older system
copy of libcurl-impersonate found before its own pinned download. Such a
copy refuses the fingerprint with an ImpersonateError before any request
leaves, and oc died on the spot with "Impersonating chrome150 is not
supported" (#40).
A refused identity now downgrades the same way a 403 already did: chrome
falls back to firefox, and when both are refused the plain fetch
transport still gets the page. Any other impers failure propagates
unchanged.
CONTRIBUTING described a command as a URL template only, so a contributor
adding a docs site had no way to learn that a search verb can also name a
static index (sphinx, rdoc, nodedoc), a JSON endpoint (api), or fall back
to DuckDuckGo with a site: filter, or how to pick between them. It also
still counted six files in src/.
The rust, java, ts, and php search verbs had no test; only cpp's did. #25
asked for both verbs per language to be covered offline.
Dependabot opened separate PRs for init (#35) and analyze (#34). Each
failed because the two steps must run the same version of the action.
Bump init, analyze and upload-sarif together and add a Dependabot group
so future codeql-action bumps arrive as one PR.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The title and every heading are the page's to write, and both skipped
truncate(), so one hostile scalar could print unbounded output whatever
the budget said. The compact view now cuts titles, headings, and input
names at the same cap and marker every other block gets, and read cuts
even a first block bigger than its whole budget, since 'up to N tokens'
is a promise the page must not be able to break. The distilled page
keeps the full values: --json stays the machine-stable view, bounded by
the fetch cap, and machines cut for themselves.
Fixes#28
contentFailure called every render under 25 tokens a failure, which
made exit 2 claim a terse page was JavaScript-only, gated, or
challenged when it had simply arrived terse. The verdict now needs
evidence: nothing extracted is empty whatever the page weighed, and a
short render is only a failure when the markup behind it was far too
big to have carried only that. A status endpoint or a one-line answer
now exits 0, script-only shells and consent walls still exit 2, and
raw applies the same rule before refusing. The --json empty field
follows the same policy, so callers keep a machine-stable distinction
between empty and merely short.
Fixes#29
