Add scoped native history and window agent controls

tests/history-snapshot.test.mjs

@@ -0,0 +1,10 @@
+import test from 'node:test';import assert from 'node:assert/strict';import {createRequire} from 'node:module';
+const {readHistorySnapshot}=createRequire(import.meta.url)('../apps/browser/history-snapshot.cjs');
+function fixture(){const rows=[{url:'https://work.example/',title:'Work',pageState:'PRIVATE_FORM_VALUES',extra:'PRIVATE_NATIVE'}];return {rows,contents:{isDestroyed:()=>false,navigationHistory:{getAllEntries:()=>rows,getActiveIndex:()=>0}}};}
+test('native history strips form state and retains only a private exact-state checksum',()=>{
+ const f=fixture(),first=readHistorySnapshot(f.contents);assert.deepEqual(first.entries,[{url:'https://work.example/',title:'Work'}]);assert.equal(JSON.stringify(first).includes('PRIVATE'),false);assert.match(first.nativeBinding,/^[a-f0-9]{64}$/);assert.equal(readHistorySnapshot(f.contents).nativeBinding,first.nativeBinding);
+ f.rows[0].pageState='REPLACED_FORM_VALUES';assert.notEqual(readHistorySnapshot(f.contents).nativeBinding,first.nativeBinding);assert.deepEqual(readHistorySnapshot(f.contents).entries,first.entries);
+});
+test('unavailable or oversized native history cannot produce a comparison authority',()=>{
+ for(const mutate of [f=>f.contents.isDestroyed=()=>true,f=>f.rows[0].pageState='x'.repeat(1048577),f=>f.rows[0].pageState={},f=>f.rows[0].title='x'.repeat(201),f=>f.contents.navigationHistory.getActiveIndex=()=>-1,f=>f.contents.navigationHistory.getAllEntries=()=>Array(101).fill(f.rows[0])]){const f=fixture();mutate(f);assert.throws(()=>readHistorySnapshot(f.contents));}
+});