tests: add stress, leak, css-vector, and perf regression coverage

Author: unadlib

tests/core.test.ts

@@ -452,6 +452,52 @@ test("core renderPromptStream uses incremental codegen session", async () => {
   await app.stop();
 });
 
+test("core renderPromptStream supports 120 concurrent streams", async () => {
+  const app = createRenderifyApp(createDependencies());
+  await app.start();
+
+  const concurrentStreams = 120;
+  const started = Date.now();
+  const runs = await Promise.all(
+    Array.from({ length: concurrentStreams }, async (_, index) => {
+      let sawDelta = false;
+      let sawFinal = false;
+      let finalHtml = "";
+
+      for await (const chunk of app.renderPromptStream(`parallel-${index}`, {
+        previewEveryChunks: 64,
+      })) {
+        if (chunk.type === "llm-delta") {
+          sawDelta = true;
+        }
+
+        if (chunk.type === "final" && chunk.final) {
+          sawFinal = true;
+          finalHtml = chunk.final.html;
+        }
+      }
+
+      return {
+        sawDelta,
+        sawFinal,
+        finalHtml,
+      };
+    }),
+  );
+  const elapsed = Date.now() - started;
+
+  assert.equal(runs.length, concurrentStreams);
+  assert.ok(runs.every((entry) => entry.sawDelta));
+  assert.ok(runs.every((entry) => entry.sawFinal));
+  assert.ok(runs.every((entry) => entry.finalHtml.length > 0));
+  assert.ok(
+    elapsed < 25000,
+    `concurrent stream regression: elapsed=${elapsed}ms`,
+  );
+
+  await app.stop();
+});
+
 test("core renderPromptStream emits error chunk before throwing", async () => {
   const app = createRenderifyApp(
     createDependencies({

tests/perf-regression.test.ts

@@ -78,3 +78,47 @@ test("perf regression: runtime executes large plan under threshold", async () =>
     await runtime.terminate();
   }
 });
+
+test("perf regression: runtime executes deeply nested tree under threshold", async () => {
+  const runtime = new DefaultRuntimeManager();
+  await runtime.initialize();
+
+  try {
+    const depth = 320;
+    let root: RuntimePlan["root"] = createTextNode("leaf");
+    for (let index = 0; index < depth; index += 1) {
+      root = createElementNode("section", { [`data-depth-${index}`]: "1" }, [
+        root,
+      ]);
+    }
+
+    const plan: RuntimePlan = {
+      specVersion: DEFAULT_RUNTIME_PLAN_SPEC_VERSION,
+      id: "perf_runtime_deep_plan",
+      version: 1,
+      capabilities: {
+        domWrite: true,
+      },
+      root,
+    };
+
+    const started = nowMs();
+    const result = await runtime.executePlan(plan);
+    const elapsed = nowMs() - started;
+
+    assert.equal(result.root.type, "element");
+    let traversedDepth = 0;
+    let cursor = result.root;
+    while (cursor.type === "element" && cursor.children?.length) {
+      traversedDepth += 1;
+      cursor = cursor.children[0];
+    }
+    assert.ok(traversedDepth >= depth, `deep tree depth=${traversedDepth}`);
+    assert.ok(
+      elapsed < 2500,
+      `runtime deep-tree regression: elapsed=${elapsed}ms`,
+    );
+  } finally {
+    await runtime.terminate();
+  }
+});

tests/runtime.test.ts

@@ -1823,6 +1823,59 @@ test("runtime source loader supports disabling fallback cdn attempts", async ()
   }
 });
 
+test("runtime module caches are released across lifecycle cycles", async () => {
+  const runtime = new DefaultRuntimeManager({
+    remoteFallbackCdnBases: [],
+    remoteFetchRetries: 0,
+    remoteFetchBackoffMs: 10,
+    remoteFetchTimeoutMs: 600,
+  });
+
+  const internals = runtime as unknown as {
+    createSourceModuleLoader: (
+      moduleManifest: RuntimeModuleManifest | undefined,
+      diagnostics: Array<{ code?: string; message?: string }>,
+    ) => {
+      materializeRemoteModule(url: string): Promise<string>;
+    };
+    browserModuleUrlCache: Map<string, string>;
+    browserModuleInflight: Map<string, Promise<string>>;
+    browserBlobUrls: Set<string>;
+  };
+
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = (async (_input: RequestInfo | URL) => {
+    return new Response("export default 'ok';", {
+      status: 200,
+      headers: {
+        "content-type": "text/javascript; charset=utf-8",
+      },
+    });
+  }) as typeof fetch;
+
+  try {
+    for (let cycle = 0; cycle < 3; cycle += 1) {
+      await runtime.initialize();
+
+      const diagnostics: Array<{ code?: string; message?: string }> = [];
+      const loader = internals.createSourceModuleLoader(undefined, diagnostics);
+      await loader.materializeRemoteModule(
+        `https://ga.jspm.io/npm:lit@3.3.0/index.js?cycle=${cycle}`,
+      );
+
+      assert.ok(internals.browserModuleUrlCache.size > 0);
+      await runtime.terminate();
+
+      assert.equal(internals.browserModuleUrlCache.size, 0);
+      assert.equal(internals.browserModuleInflight.size, 0);
+      assert.equal(internals.browserBlobUrls.size, 0);
+    }
+  } finally {
+    globalThis.fetch = originalFetch;
+    await runtime.terminate();
+  }
+});
+
 test("runtime enforces moduleManifest for bare component specifiers by default", async () => {
   const runtime = new DefaultRuntimeManager({
     moduleLoader: new MockLoader({

tests/ui.test.ts

@@ -209,6 +209,34 @@ test("ui renderer drops null-byte obfuscated unsafe inline styles", () => {
   assert.doesNotMatch(literalNullHtml, /\sstyle=/);
 });
 
+test("ui renderer blocks additional css injection vectors", () => {
+  const renderer = new DefaultUIRenderer();
+  const vectors = [
+    "@import url(https://evil.example/style.css);",
+    "@im\\70ort url(https://evil.example/style.css);",
+    "behavior:url(#default#time2);",
+    "-moz-binding:url(https://evil.example/xbl.xml#payload);",
+  ];
+
+  for (const styleValue of vectors) {
+    const html = renderer.renderNode(
+      createElementNode(
+        "div",
+        {
+          style: styleValue,
+        },
+        [createTextNode("unsafe style vector")],
+      ),
+    );
+
+    assert.doesNotMatch(
+      html,
+      /\sstyle=/,
+      `expected style sanitizer to block vector: ${styleValue}`,
+    );
+  }
+});
+
 test("ui renderer tolerates css escape edge cases in safe styles", () => {
   const renderer = new DefaultUIRenderer();
   const safeEscapedHtml = renderer.renderNode(