[freeqaz]

Problem

#3731, #3733, #3737, #3740 and #3741 added console browser tests in parallel. Some of them repeat helpers that other files already define, or paste product sentences instead of reading them from tests/helpers/refusal-text.mjs:

• denyRevisionRead was defined twice, in console-agent-state and console-agent-overview. The same AgentRevision read restriction was also written out inline three more times, in console-agent-deploy-again and twice in console-next-steps.
• The Stop Agent row-button locator was defined in console-next-steps and written out inline in console-agent-state.
• The authorization-denial audit filter was written out four times, in console-agent-deploy-again (twice), console-namespace-create and the new D45 test in console-agent-state.
• 17 checks pasted six console sentences. Two of these checks matched only part of the sentence:
  • the workspace refusal matched /^Not authorized: this needs Agent read on Agent /;
  • the plugin rejection matched /credential was rejected or cannot access plugins/.
• The "You cannot read this version" heading checks matched a substring. A mutant that added text to the heading passed all four of those tests.

Change

Test-only. 11 files, +96/−129. No product file changes.

• console-agents-browser-helpers.mjs gets three shared helpers:
  • denyRevisionRead replaces 2 local copies and 3 inline restriction pushes.
  • stopAgentButton replaces 1 local copy and 1 inline locator.
  • authorizationDenials(auditSink, action) takes an exact action or a RegExp and replaces 4 inline filters.
• refusal-text.mjs gets six constants, added at the end of the file:
  • VERSION_READ_DENIED_HEADING
  • READ_ONLY_DRAFT_NOTICE and PLUGINS_READ_ONLY, moved from local constants in console-agent-detail
  • NO_TEST_REQUEST
  • GRANT_EXCEEDS_CEILING
  • PLUGIN_CREDENTIALS_REJECTED
• Stronger checks:
  • The version-read heading checks now use exact: true. The checks that the heading is absent still use substring matching, so they stay broad.
  • The workspace refusal check now matches the whole callerDenied("Agent read", "Agent <id>") sentence.
  • The plugin rejection check now matches the whole sentence, followed by the Request ID label.
  • In console-next-steps, the read-only draft notice check now matches the whole sentence instead of a prefix regex.

Left as they are:

• The two redeployUnreadable cases. One has paged versions and the other does not, which are different setups.
• The D45 test, next to the observability-link test in console.test.mjs. The setups are different: a reader with Agent read on the Access tab with an audit sink, against a Namespace-read-only account that carries an administrator's stale cached answer.

I found no fixed waits in the new tests. The slowest new case takes 2.2 s, and none of them builds a fixture it could share.

Verification

All runs were on a remote test VM.

• Pins: 20/20 at 2 CPUs, in a private network namespace, for all 9 changed test files.
  • Group 1: console-agent-deploy-again, -detail, -detail-2, -overview, console-namespace-create. 20/20 passed.
  • Group 2: console-agent-draft-guards, -presets, -state, console-next-steps. 20/20 passed.
• CI lanes: checks-browser and checks-browser-2 both pass.
  • checks-browser: 803.8 CPU-s before, 797.2 after.
  • checks-browser-2: 865.3 CPU-s before, 926.4 after.
  • These differences are run-to-run noise. Only import lines changed in the checks-browser-2 files, and this change is not meant to make the tests faster.
• Mutants: 8 of 8 killed.
  1. The "sends no test request" sentence changes: the detail and overview tests fail.
  2. The version-read heading gets extra text: the tests survived this mutant before exact, and now fail.
  3. The read-only draft notice gets extra text: console-next-steps fails.
  4. denyRevisionRead does nothing: the state, overview, deploy-again and next-steps tests fail.
  5. authorizationDenials matches no event kind: the deploy-again and namespace-create tests fail.
  6. Members get the Installation probe again (D45): the state test fails.
  7. The plugin rejection text changes: the presets test fails.
  8. The caller denial text changes: the detail-2 workspace test fails.
• Static checks: tsc --build tsconfig.json tests/tsconfig.json passes, as do the suite audit and eslint and prettier on the touched files.

Risks

Low. The change is test-only.

• Match rejected-credential recovery to what the operator can do #3734, which is held, also edits the import blocks of console-next-steps.test.mjs and console-agent-detail-2.test.mjs, and appends to refusal-text.mjs. Whichever PR lands second gets a small conflict in the import lines and at the end of that file.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.