Kpa-clawbot 852986a009 test(coverage): add Playwright E2E for channel-decode chrome (#1297 B2) (#1302) ...

**Red commit:**
[`173f6937`](https://github.com/Kpa-clawbot/CoreScope/commit/173f69378fe69399955443dc3b55978fced3dae7)
wires the new suites into `.github/workflows/deploy.yml` BEFORE the
files exist — `Run Playwright E2E tests (fail-fast)` fails when node
cannot resolve `test-channel-decrypt-e2e.js` (verified locally). CI for
green HEAD:
https://github.com/Kpa-clawbot/CoreScope/actions/runs/26144360959

`Refs #1297`

## Why this batch

Per the **refined live-coverage audit** (comment 4494913008 on #1297,
2026-05-20), three frontend modules in the channel-decode chrome were
measured under 10 % statement coverage:

| file | LOC | live stmt cov before |
|---|---:|---:|
| `public/channel-decrypt.js` | 439 | **8.54 %** |
| `public/channel-qr.js` | 280 | **2.29 %** |
| `public/channel-color-picker.js` | 284 | **6.62 %** |

These were all marked 🟡 MED by the static audit; live measurement put
them in the 🔴 HIGH bucket. This PR is the **B2 channel-decode chrome**
batch from the refined plan.

## What changed

### New Playwright suites (all targeting `localhost:13581` against the
e2e fixture)

#### `test-channel-decrypt-e2e.js` — 15 steps
Drives `window.ChannelDecrypt` in a real browser so the **SubtleCrypto**
paths execute end-to-end:
- `deriveKey('#public')` produces a 16-byte key (SHA-256[:16])
- `hexToBytes` / `bytesToHex` roundtrip
- `computeChannelHash` returns a byte (0–255)
- `parsePlaintext`: success path with `"sender: message\0"`, null on
too-short input, null on non-printable garbage
- **Full `decrypt()` roundtrip** via a precomputed AES-128-ECB +
HMAC-SHA256 vector — exercises `verifyMAC` + `decryptECB` +
`parsePlaintext` in one shot
- MAC-mismatch → `null`, non-16-multiple ciphertext → `null` (error
paths)
- `saveKey` / `getKeys` / `removeKey` + labels via `localStorage`
- `setCache` enforces `MAX_CACHED_MESSAGES = 1000` (truncation)
- `cacheMessages` / `getCachedMessages` roundtrip
- `buildKeyMap` indexes stored keys by computed hash byte
- `tryDecryptLive` returns `null` for non-`GRP_TXT` and for unmatched
`channelHash`

#### `test-channel-qr-e2e.js` — 11 steps
Drives `window.ChannelQR` in a real browser:
- `buildUrl('My Room', secret)` →
`meshcore://channel/add?name=My%20Room&secret=…`
- `parseChannelUrl` roundtrip + rejects wrong scheme / missing secret /
non-32-hex / null / empty / non-string
- `generate()` renders a QR `<img>` (vendored `qrcode-generator`) + URL
line + `📋 Copy Key` button
- `generate({ qrOnly: true })` (Share modal mode) skips URL line + Copy
Key
- Copy Key button writes hex to `navigator.clipboard` and flips label to
`✓ Copied`
- `generate()` is a silent no-op when target is `null`
- `scan()` returns `null` and renders the `.channel-qr-fallback` toast
when `jsQR` is unavailable

#### `test-channel-color-picker-e2e.js` — 9 steps
Drives `window.ChannelColorPicker.show()` on `/#/channels`:
- 8-color palette renders (`#ef4444`, `#f97316`, `#eab308`, `#22c55e`,
`#06b6d4`, `#3b82f6`, `#8b5cf6`, `#ec4899`)
- `Escape` closes the popover
- swatch click writes `ChannelColors.set` and persists to `localStorage`
`live-channel-colors`
- reopening for an assigned channel marks the active swatch + reveals
`Clear color`
- `Clear color` removes the assignment
- Clear button is hidden when no color is assigned
- ArrowRight cycles focus across swatches; `Enter` assigns the focused
color
- outside-click closes the popover

### Workflow
`.github/workflows/deploy.yml` — three new lines under the Playwright
`fail-fast` step (after `test-nav-drawer-1064-e2e.js`).

## Local verification

35 / 35 assertions pass locally against the unmodified `origin/master`
modules:

```
$ node test-channel-decrypt-e2e.js
=== Results: passed 15 failed 0 ===
$ node test-channel-qr-e2e.js
=== Results: passed 11 failed 0 ===
$ node test-channel-color-picker-e2e.js
=== Results: passed 9 failed 0 ===
```

## Preflight

`bash ~/.openclaw/skills/pr-preflight/scripts/run-all.sh origin/master`
→ **all gates clean** (PII, branch scope, red commit, CSS vars, sync
migration, fixture coverage).

## Out of scope

- Per-statement coverage delta is reported by the existing `Collect
frontend coverage (parallel)` workflow step + badge job.
- No production code touched. No new vendored deps. No fixture changes.

---------

Co-authored-by: corescope-bot <bot@corescope.local>

2026-05-20 18:05:19 -07:00

..

agents

chore: normalize all files to LF line endings

2026-03-30 22:52:46 -07:00

instructions

chore: normalize all files to LF line endings

2026-03-30 22:52:46 -07:00

workflows

test(coverage): add Playwright E2E for channel-decode chrome (#1297 B2) (#1302)

2026-05-20 18:05:19 -07:00