Add deterministic browser coverage for documentation routes

.github/workflows/browser.yml

@@ -0,0 +1,35 @@
+name: Documentation browser flows
+on:
+  pull_request:
+  push:
+    branches: [main]
+permissions:
+  contents: read
+jobs:
+  browser:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    defaults:
+      run:
+        working-directory: docs-app
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+        with:
+          node-version: 24
+      - run: npm ci --prefix ..
+      - run: npx tsc --project tsconfig.e2e.json
+      - run: npm run docs:build --prefix ..
+      - run: npx e2e-web install chromium --with-deps
+      - run: npm run test:e2e
+        env:
+          E2E_TELEMETRY_DISABLED: '1'
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        if: failure()
+        with:
+          name: documentation-browser-traces
+          path: docs-app/.e2e/results/
+          retention-days: 7
+          include-hidden-files: true

.gitignore

@@ -24,3 +24,5 @@ coverage/
 # Crustini/crabbox remote-build runtime state and captures: machine-local
 # artifacts, never committed or synced.
 .crabbox/
+
+.e2e/

.tegami/audited-dependencies.md

@@ -0,0 +1,9 @@
+---
+packages:
+  "cargo:microck-pangram-cli": patch
+  "npm:@microck/pangram-cli": patch
+---
+
+## Security
+
+Update TLS, QUIC, and ZIP dependencies to patched releases while retaining signed-archive validation and the Rust 1.88 minimum. Update development test dependencies to remove reported npm advisories.

Cargo.toml

@@ -106,7 +106,7 @@ url = "=2.5.8"
 uuid = { version = "=1.24.0", features = ["serde", "v7"] }
 xz2 = { version = "=0.1.7", features = ["static"] }
 zeroize = "=1.8.2"
-zip = { version = "=8.4.0", default-features = false, features = ["deflate-flate2-zlib-rs"] }
+zip = { version = "=9.0.0", default-features = false, features = ["deflate-flate2-zlib-rs"] }
 
 [target."cfg(windows)".dependencies]
 windows-sys = { version = "=0.61.2", features = [

README.md

@@ -252,3 +252,11 @@ use of Pangram services remains subject to Pangram's terms, billing, retention,
 ## license
 
 [mit license](LICENSE)
+
+### Browser regression tests
+
+Run `npm ci`, `npm run docs:build`, `npx e2e-web install chromium`, then
+`npm run test:e2e -w docs-app`. The pinned tester-army/e2e tests open every
+documentation route against the production server. No provider accounts, model
+agents, billable submissions or update-network operations are used. Native CLI,
+TUI and MCP acceptance remain in their existing real-process suites.

docs-app/e2e-runner.mjs

@@ -0,0 +1,16 @@
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { spawnSync } from "node:child_process";
+const require = createRequire(import.meta.url);
+const [major, minor] = process.versions.node.split(".").map(Number);
+if (major < 24 || (major === 24 && minor < 8)) {
+  console.error("Browser E2E requires Node >=24.8.0.");
+  process.exit(1);
+}
+const cli = join(dirname(require.resolve("e2e")), "cli", "bin.js");
+const result = spawnSync(process.execPath, [cli, "run", ...process.argv.slice(2)], {
+  stdio: "inherit",
+  env: { ...process.env, E2E_TELEMETRY_DISABLED: "1" },
+});
+if (result.error) throw result.error;
+process.exit(result.status ?? 1);

docs-app/e2e.config.ts

@@ -0,0 +1,9 @@
+import type { E2EConfig } from 'e2e';
+import { web } from '@e2e-dev/web';
+export default {
+ tests: 'tests/**/*.e2e.ts', workers: 1, retries: 0, timeout: 30_000,
+ targets: [{name: 'chromium', engine: web(), app: {
+  url: 'http://127.0.0.1:4186',
+  command: {executable: 'node', args: ['../node_modules/next/dist/bin/next','start','--hostname','127.0.0.1','--port','4186']}
+ }}]
+} satisfies E2EConfig;

docs-app/package.json

@@ -7,7 +7,8 @@
     "check": "npm run typecheck && npm run build",
     "dev": "NEXT_TELEMETRY_DISABLED=1 next dev",
     "generate": "fumadocs-mdx",
-    "typecheck": "NEXT_TELEMETRY_DISABLED=1 next typegen && tsc --noEmit"
+    "typecheck": "NEXT_TELEMETRY_DISABLED=1 next typegen && tsc --noEmit",
+    "test:e2e": "node e2e-runner.mjs"
   },
   "dependencies": {
     "fumadocs-core": "16.15.1",

docs-app/tests/docs.e2e.ts

@@ -0,0 +1,19 @@
+import { readFileSync,readdirSync } from "node:fs";
+import { join, relative, sep } from "node:path";
+import { test } from "@e2e-dev/web";
+import { expect } from "e2e";
+const root="content/docs";
+function pages(directory=root):{route:string;title:string}[]{
+ return readdirSync(directory,{withFileTypes:true}).flatMap(entry=>{
+  const path=join(directory,entry.name);
+  if(entry.isDirectory())return entry.name==="reviews"?[]:pages(path);
+  if(!/\.mdx?$/.test(entry.name))return [];
+  const title=readFileSync(path,"utf8").match(/^title:\s*(.+)$/m)?.[1]?.replace(/^["']|["']$/g,"");
+  if(!title)throw new Error(`Missing title: ${path}`);
+  return [{route:"/docs/"+relative(root,path).split(sep).join("/").replace(/\.mdx?$/,"").replace(/(^|\/)index$/,""),title}];
+ });
+}
+for(const page of pages())test(`documentation ${page.route}`,async({app,screen})=>{
+ await app.open(page.route);
+ await expect(screen.getByRole("heading",{name:page.title,exact:true})).toBeVisible();
+});

docs-app/tsconfig.e2e.json

@@ -0,0 +1,16 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "incremental": false,
+    "types": [
+      "node"
+    ]
+  },
+  "include": [
+    "e2e.config.ts",
+    "tests/**/*.ts"
+  ],
+  "exclude": [
+    "node_modules"
+  ]
+}

docs-app/tsconfig.json

@@ -1,7 +1,11 @@
 {
   "compilerOptions": {
     "target": "ESNext",
-    "lib": ["dom", "dom.iterable", "esnext"],
+    "lib": [
+      "dom",
+      "dom.iterable",
+      "esnext"
+    ],
     "allowJs": false,
     "skipLibCheck": true,
     "strict": true,
@@ -14,8 +18,16 @@
     "isolatedModules": true,
     "jsx": "react-jsx",
     "incremental": true,
-    "paths": { "@/*": ["./*"] },
-    "plugins": [{ "name": "next" }]
+    "paths": {
+      "@/*": [
+        "./*"
+      ]
+    },
+    "plugins": [
+      {
+        "name": "next"
+      }
+    ]
   },
   "include": [
     "next-env.d.ts",
@@ -24,5 +36,9 @@
     ".next/types/**/*.ts",
     ".next/dev/types/**/*.ts"
   ],
-  "exclude": ["node_modules"]
+  "exclude": [
+    "node_modules",
+    "tests",
+    "e2e.config.ts"
+  ]
 }