From 29a5d85e5d58c6a42b3ac8a9440a115498bdc8b0 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Sat, 9 May 2026 18:21:29 +0100
Subject: [PATCH] test: tighten sandbox browser assertions

---
 src/agents/sandbox/browser.create.test.ts | 40 +++++++++++------------
 1 file changed, 19 insertions(+), 21 deletions(-)

diff --git a/src/agents/sandbox/browser.create.test.ts b/src/agents/sandbox/browser.create.test.ts
index 4c71207e1e9..db22c8c4e7e 100644
--- a/src/agents/sandbox/browser.create.test.ts
+++ b/src/agents/sandbox/browser.create.test.ts
@@ -156,6 +156,18 @@ function requireValue<T>(value: T | null | undefined, label: string): T {
   return value;
 }
 
+function latestBridgeResolved(): Record<string, unknown> {
+  const params = bridgeMocks.startBrowserBridgeServer.mock.calls.at(-1)?.[0];
+  if (!params || typeof params !== "object") {
+    throw new Error("expected browser bridge start params");
+  }
+  const resolved = params.resolved;
+  if (!resolved || typeof resolved !== "object") {
+    throw new Error("expected resolved browser bridge config");
+  }
+  return resolved;
+}
+
 describe("ensureSandboxBrowser create args", () => {
   beforeAll(async () => {
     await loadFreshBrowserModulesForTest();
@@ -287,13 +299,9 @@ describe("ensureSandboxBrowser create args", () => {
       ssrfPolicy: { dangerouslyAllowPrivateNetwork: true },
     });
 
-    expect(bridgeMocks.startBrowserBridgeServer).toHaveBeenCalledWith(
-      expect.objectContaining({
-        resolved: expect.objectContaining({
-          ssrfPolicy: { dangerouslyAllowPrivateNetwork: true },
-        }),
-      }),
-    );
+    expect(latestBridgeResolved().ssrfPolicy).toEqual({
+      dangerouslyAllowPrivateNetwork: true,
+    });
   });
 
   it("recreates a cached bridge when the SSRF policy changes", async () => {
@@ -353,13 +361,9 @@ describe("ensureSandboxBrowser create args", () => {
     });
 
     expect(bridgeMocks.stopBrowserBridgeServer).toHaveBeenCalledWith(existingBridge.server);
-    expect(bridgeMocks.startBrowserBridgeServer).toHaveBeenCalledWith(
-      expect.objectContaining({
-        resolved: expect.objectContaining({
-          ssrfPolicy: { allowedHostnames: ["example.com"] },
-        }),
-      }),
-    );
+    expect(latestBridgeResolved().ssrfPolicy).toEqual({
+      allowedHostnames: ["example.com"],
+    });
   });
 
   it("recreates a cached bridge when evaluate permission changes", async () => {
@@ -418,13 +422,7 @@ describe("ensureSandboxBrowser create args", () => {
     });
 
     expect(bridgeMocks.stopBrowserBridgeServer).toHaveBeenCalledWith(existingBridge.server);
-    expect(bridgeMocks.startBrowserBridgeServer).toHaveBeenCalledWith(
-      expect.objectContaining({
-        resolved: expect.objectContaining({
-          evaluateEnabled: false,
-        }),
-      }),
-    );
+    expect(latestBridgeResolved().evaluateEnabled).toBe(false);
   });
 
   it("mounts the main workspace read-only when workspaceAccess is none", async () => {