test: add vitest coverage for tool render modules

Add per-renderer vitest coverage with XSS escaping assertions, a shared
test helper, registry-driven smoke tests, and raised coverage thresholds.

Author: clean6378-max-it

static/js/render/registry.test.js

@@ -188,6 +188,54 @@ describe('renderTodoWriteResult', () => {
     });
 });
 
+/** Representative fixtures for registry-driven behavioral smoke tests. */
+const TOOL_USE_FIXTURES = {
+    Bash: { input: { command: 'echo hi', description: 'say hi' } },
+    Read: { input: { file_path: 'README.md' } },
+    Write: { input: { file_path: 'out.txt', content: 'data' } },
+    Edit: { input: { file_path: 'a.js', old_string: 'x', new_string: 'y' } },
+    Glob: { input: { pattern: '*.js', path: 'src' } },
+    Grep: { input: { pattern: 'TODO', path: 'lib' } },
+    Task: { input: { subagent_type: 'explore', description: 'scan', prompt: 'go' } },
+    TodoWrite: { input: { todos: [{ status: 'pending', content: 'task' }] } },
+    AskUserQuestion: { input: { questions: [{ question: 'OK?' }] } },
+    WebFetch: { input: { url: 'https://example.com' } },
+    WebSearch: { input: { query: 'vitest' } },
+};
+
+const TOOL_RESULT_FIXTURES = {
+    bash: { exit_code: 0, stdout: 'ok' },
+    file_read: { file_path: '/a.txt', num_lines: 10 },
+    file_edit: { file_path: 'b.js' },
+    file_write: { file_path: 'c.txt' },
+    glob: { num_files: 3 },
+    grep: { num_files: 2, num_lines: 5 },
+    web_search: { query: 'test', result_count: 1 },
+    web_fetch: { url: 'https://x.com', status_code: 200 },
+    task: { status: 'completed', total_duration_ms: 1000 },
+    todo_write: { todos: [{ status: 'pending', content: 'x' }] },
+    user_input: { questions: [{ question: 'Q' }], answers: { Q: 'A' } },
+    plan: { file_path: 'plan.md' },
+};
+
+describe('registry behavioral smoke tests', () => {
+    it('every registered tool_use renderer produces non-empty HTML', () => {
+        for (const name of CORE_TOOL_USE) {
+            const html = renderToolUse({ name, ...TOOL_USE_FIXTURES[name] });
+            expect(html, name).toContain('tool-call');
+            expect(html.length, name).toBeGreaterThan(20);
+        }
+    });
+
+    it('every registered tool_result renderer produces non-empty HTML', () => {
+        for (const rt of CORE_TOOL_RESULT) {
+            const html = renderToolResult({ result_type: rt, ...TOOL_RESULT_FIXTURES[rt] });
+            expect(html, rt).toContain('tool-result');
+            expect(html.length, rt).toBeGreaterThan(20);
+        }
+    });
+});
+
 describe('renderToolResult fallback', () => {
     it('renders raw result type and JSON payload for unknown result types', () => {
         const html = renderToolResult({

static/js/render/test_helpers.js

@@ -0,0 +1,36 @@
+import { expect } from 'vitest';
+import { renderToolUse, renderToolResult } from './registry.js';
+
+/** Common XSS payloads for renderer escaping assertions. */
+export const XSS_SCRIPT = '<script>alert(1)</script>';
+export const XSS_IMG = '<img onerror=alert(1)>';
+
+/**
+ * Render a tool-use card via the registry and return the HTML string.
+ */
+export function mountToolUse(tool) {
+    return renderToolUse(tool);
+}
+
+/**
+ * Render a tool-result card via the registry and return the HTML string.
+ */
+export function mountToolResult(parsed) {
+    return renderToolResult(parsed);
+}
+
+/**
+ * Assert raw HTML fragments are escaped (not present verbatim).
+ */
+export function expectNoRawHtml(html, rawFragments) {
+    for (const frag of rawFragments) {
+        expect(html).not.toContain(frag);
+    }
+}
+
+/**
+ * Assert an HTML-escaped fragment appears in output.
+ */
+export function expectEscaped(html, escapedFragment) {
+    expect(html).toContain(escapedFragment);
+}

static/js/render/tool_result/bash.test.js

@@ -0,0 +1,45 @@
+import { describe, expect, it } from 'vitest';
+import { renderBashResult } from './bash.js';
+import { mountToolResult, expectNoRawHtml, XSS_IMG } from '../test_helpers.js';
+
+describe('renderBashResult', () => {
+    it('renders success status with stdout', () => {
+        const html = renderBashResult({
+            result_type: 'bash',
+            exit_code: 0,
+            stdout: 'hello\nworld',
+        });
+        expect(html).toContain('Bash Result (success)');
+        expect(html).toContain('hello');
+        expect(html).toContain('stdout');
+        expect(html).toContain('tool-result');
+    });
+
+    it('renders error status with stderr', () => {
+        const html = renderBashResult({
+            result_type: 'bash',
+            exit_code: 1,
+            is_error: true,
+            stderr: 'command failed',
+        });
+        expect(html).toContain('error (exit 1)');
+        expect(html).toContain('command failed');
+        expect(html).toContain('stderr');
+    });
+
+    it('renders interrupted status', () => {
+        const html = renderBashResult({ result_type: 'bash', interrupted: true });
+        expect(html).toContain('Bash Result (interrupted)');
+    });
+
+    it('escapes HTML in stdout and stderr', () => {
+        const html = mountToolResult({
+            result_type: 'bash',
+            exit_code: 0,
+            stdout: XSS_IMG,
+            stderr: '<script>x</script>',
+        });
+        expectNoRawHtml(html, [XSS_IMG, '<script>']);
+        expect(html).toContain('&lt;img');
+    });
+});

static/js/render/tool_result/fallback.test.js

@@ -0,0 +1,32 @@
+import { describe, expect, it } from 'vitest';
+import { renderToolResultFallback } from './fallback.js';
+import { mountToolResult, expectNoRawHtml, XSS_SCRIPT } from '../test_helpers.js';
+
+describe('renderToolResultFallback', () => {
+    it('renders unknown result type and JSON payload', () => {
+        const html = renderToolResultFallback({
+            result_type: 'custom_widget',
+            widget_id: 99,
+            label: 'test',
+        });
+        expect(html).toContain('Unknown tool result: custom_widget');
+        expect(html).toContain('"widget_id"');
+        expect(html).toContain('99');
+        expect(html).toContain('tool-result');
+    });
+
+    it('uses unknown dispatch key when result_type is missing', () => {
+        const html = renderToolResultFallback({ payload: 'data' });
+        expect(html).toContain('Unknown tool result:');
+        expect(html).toContain('tool-result');
+    });
+
+    it('escapes HTML in JSON fallback body', () => {
+        const html = mountToolResult({
+            result_type: 'mystery',
+            content: XSS_SCRIPT,
+        });
+        expectNoRawHtml(html, [XSS_SCRIPT]);
+        expect(html).toContain('<script>');
+    });
+});

static/js/render/tool_result/file_edit.test.js

@@ -0,0 +1,28 @@
+import { describe, expect, it } from 'vitest';
+import { renderFileEditResult } from './file_edit.js';
+import { mountToolResult, expectNoRawHtml, XSS_SCRIPT } from '../test_helpers.js';
+
+describe('renderFileEditResult', () => {
+    it('renders edited file path in summary', () => {
+        const html = renderFileEditResult({
+            result_type: 'file_edit',
+            file_path: 'src/app.js',
+        });
+        expect(html).toContain('Edited: src/app.js');
+        expect(html).toContain('tool-result');
+    });
+
+    it('handles missing file path', () => {
+        const html = renderFileEditResult({ result_type: 'file_edit' });
+        expect(html).toContain('Edited:');
+        expect(html).not.toContain('undefined');
+    });
+
+    it('escapes HTML in file path via registry', () => {
+        const html = mountToolResult({
+            result_type: 'file_edit',
+            file_path: XSS_SCRIPT,
+        });
+        expectNoRawHtml(html, [XSS_SCRIPT]);
+    });
+});

static/js/render/tool_result/file_write.test.js

@@ -0,0 +1,28 @@
+import { describe, expect, it } from 'vitest';
+import { renderFileWriteResult } from './file_write.js';
+import { mountToolResult, expectNoRawHtml, XSS_SCRIPT } from '../test_helpers.js';
+
+describe('renderFileWriteResult', () => {
+    it('renders written file path in summary', () => {
+        const html = renderFileWriteResult({
+            result_type: 'file_write',
+            file_path: 'output/data.json',
+        });
+        expect(html).toContain('Wrote: output/data.json');
+        expect(html).toContain('tool-result');
+    });
+
+    it('handles missing file path', () => {
+        const html = renderFileWriteResult({ result_type: 'file_write' });
+        expect(html).toContain('Wrote:');
+        expect(html).not.toContain('undefined');
+    });
+
+    it('escapes HTML in file path via registry', () => {
+        const html = mountToolResult({
+            result_type: 'file_write',
+            file_path: XSS_SCRIPT,
+        });
+        expectNoRawHtml(html, [XSS_SCRIPT]);
+    });
+});

static/js/render/tool_result/glob.test.js

@@ -0,0 +1,27 @@
+import { describe, expect, it } from 'vitest';
+import { renderGlobResult } from './glob.js';
+
+describe('renderGlobResult', () => {
+    it('renders file count in summary', () => {
+        const html = renderGlobResult({
+            result_type: 'glob',
+            num_files: 12,
+        });
+        expect(html).toContain('Glob: 12 files found');
+        expect(html).toContain('tool-result');
+    });
+
+    it('shows truncated flag when set', () => {
+        const html = renderGlobResult({
+            result_type: 'glob',
+            num_files: 100,
+            truncated: true,
+        });
+        expect(html).toContain('(truncated)');
+    });
+
+    it('defaults to zero files when num_files is absent', () => {
+        const html = renderGlobResult({ result_type: 'glob' });
+        expect(html).toContain('Glob: 0 files found');
+    });
+});

static/js/render/tool_result/grep.test.js

@@ -0,0 +1,19 @@
+import { describe, expect, it } from 'vitest';
+import { renderGrepResult } from './grep.js';
+
+describe('renderGrepResult', () => {
+    it('renders file and line counts in summary', () => {
+        const html = renderGrepResult({
+            result_type: 'grep',
+            num_files: 5,
+            num_lines: 42,
+        });
+        expect(html).toContain('Grep: 5 files, 42 lines');
+        expect(html).toContain('tool-result');
+    });
+
+    it('defaults counts to zero when absent', () => {
+        const html = renderGrepResult({ result_type: 'grep' });
+        expect(html).toContain('Grep: 0 files, 0 lines');
+    });
+});

static/js/render/tool_result/plan.test.js

@@ -0,0 +1,28 @@
+import { describe, expect, it } from 'vitest';
+import { renderPlanResult } from './plan.js';
+import { mountToolResult, expectNoRawHtml, XSS_SCRIPT } from '../test_helpers.js';
+
+describe('renderPlanResult', () => {
+    it('renders plan file path in summary', () => {
+        const html = renderPlanResult({
+            result_type: 'plan',
+            file_path: '.cursor/plans/sprint.md',
+        });
+        expect(html).toContain('Plan: .cursor/plans/sprint.md');
+        expect(html).toContain('tool-result');
+    });
+
+    it('handles missing file path', () => {
+        const html = renderPlanResult({ result_type: 'plan' });
+        expect(html).toContain('Plan:');
+        expect(html).not.toContain('undefined');
+    });
+
+    it('escapes HTML in file path via registry', () => {
+        const html = mountToolResult({
+            result_type: 'plan',
+            file_path: XSS_SCRIPT,
+        });
+        expectNoRawHtml(html, [XSS_SCRIPT]);
+    });
+});

static/js/render/tool_result/task.test.js

@@ -0,0 +1,46 @@
+import { describe, expect, it } from 'vitest';
+import { renderTaskResult } from './task.js';
+import { mountToolResult, expectNoRawHtml, XSS_SCRIPT } from '../test_helpers.js';
+
+describe('renderTaskResult', () => {
+    it('renders completed task with duration and token stats', () => {
+        const html = renderTaskResult({
+            result_type: 'task',
+            status: 'completed',
+            total_duration_ms: 2500,
+            total_tokens: 1500,
+            total_tool_use_count: 3,
+        });
+        expect(html).toContain('Task completed');
+        expect(html).toContain('2.5s');
+        expect(html).toContain('1,500 tokens');
+        expect(html).toContain('3 tool calls');
+        expect(html).toContain('tool-result');
+    });
+
+    it('prefers retrieval status summary when set', () => {
+        const html = renderTaskResult({
+            result_type: 'task',
+            retrieval_status: 'found',
+            status: 'completed',
+        });
+        expect(html).toContain('Task retrieval: found');
+        expect(html).not.toContain('Task completed');
+    });
+
+    it('prefers description summary when set', () => {
+        const html = renderTaskResult({
+            result_type: 'task',
+            description: 'explore auth module',
+        });
+        expect(html).toContain('Task launched: explore auth module');
+    });
+
+    it('escapes HTML in description via registry', () => {
+        const html = mountToolResult({
+            result_type: 'task',
+            description: XSS_SCRIPT,
+        });
+        expectNoRawHtml(html, [XSS_SCRIPT]);
+    });
+});