Implement managed browser security, individual agents and observability

tests/evidence-capture.test.mjs

@@ -0,0 +1,7 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createRequire} from 'node:module';
+const {buildDownloadEvidence,validateDownloadEvidence}=createRequire(import.meta.url)('../apps/browser/evidence-capture.cjs');
+const policy={evidence:{enabled:true,captureDownloads:true}},input={url:'https://example.com/file?secret=omit#omit',name:'../report.pdf',mime:'Application/PDF; charset=utf8',facts:{size:4,sha256:'a'.repeat(64)},decision:'allow',ruleId:'scanner-allow'};
+test('metadata builder allowlists and canonicalizes fields',()=>{const p=buildDownloadEvidence({...input,contents:'never stored'},policy);assert.deepEqual(p,{sourceUrl:'https://example.com/file',name:'report.pdf',sha256:'a'.repeat(64),bytes:4,mime:'application/pdf',decision:'allow',ruleId:'scanner-allow'});assert.equal(validateDownloadEvidence({...p,password:'secret'}),false);});
+test('metadata rejects incomplete facts and recognizable credential paths or names',()=>{for(const extra of [{facts:null},{facts:{size:-1,sha256:'a'.repeat(64)}},{url:'file:///secret'},{url:'https://example.com/password%3Dsecret123'},{name:'api_key=secret123.txt'},{url:'https://example.com/%ZZ'}])assert.equal(buildDownloadEvidence({...input,...extra},policy),null);});