test: strengthen public input and module lookup controls

Incorporate the independent query-bearing ESM and cjs-only directory cases from #2031 and #2032 into existing Node-backed CLI/MCP tests. Their production patches are already superseded on main.

Make invalid Swift-symbol validation prove it precedes artifact access, and bound the test child so failures retain output before the outer test deadline. Clarify that network API content types project only the type/subtype essence.

Validation: module lookup CLI/MCP and native demangle CLI tests pass. A bounded Flameox reproduction passed in under one second; the CI timeout was not reproduced and no provider hang fix is claimed.

Co-authored-by: hhang <169027046+xu91102@users.noreply.github.com>

docs/web-network-captures.md

@@ -143,8 +143,9 @@ origin, and exact segment rules match. The view does not infer further
 cross-sample patterns.
 
 Groups cite parent record ordinals and distinct statuses and MIME types (lowercase
-type/subtype without parameters). A malformed media type is unknown, not a content
-type. Flags report single samples, mixed statuses or mixed content types.
+type/subtype without parameters). An invalid type/subtype essence is unknown;
+parameters do not affect this projection. Flags report single samples, mixed
+statuses or mixed content types.
 `coverage` pages groups; `records` separately reports examined, total and excluded
 parent records. Ordinal subsets carry a limitation. Null URLs are excluded as
 `url-redacted`; unparseable URLs, URLs without an origin, spellings without

tests/acceptance/applications/JavaScriptModuleLookupCli.test.ts

@@ -19,6 +19,7 @@ const createModuleLookupFixture = async () => {
       'import "./directory";',
       'import "./explicit.js";',
       'import "./exact.js";',
+      'import "./actual.cjs?cache=1";',
       'import fallback from "empty-main";',
       'import "nested-main";',
       'import "file-only";',
@@ -31,8 +32,10 @@ const createModuleLookupFixture = async () => {
     "esm/directory/index.js": "module.exports = 2;",
     "esm/explicit.js.js": "module.exports = 3;",
     "esm/exact.js": "module.exports = 4;",
+    "esm/actual.cjs": "module.exports = 5;",
     "cjs/entry.cjs": [
       'require("./extensionless");',
+      'require("./directory");',
       'require("./feature");',
       'require("./feature.cjs");',
       'require("./default-js");',
@@ -45,6 +48,7 @@ const createModuleLookupFixture = async () => {
       'require("ancestor-blocked");',
       'require("ancestor-sub/parser");',
     ].join("\n"),
+    "cjs/directory/index.cjs": "module.exports = 6;",
     "cjs/extensionless.cjs": "module.exports = 1;",
     "cjs/feature.cjs": "module.exports = 2;",
     "cjs/default-js.js": "module.exports = 3;",
@@ -63,7 +67,7 @@ const createModuleLookupFixture = async () => {
     "node_modules/ancestor-blocked/index.js": "module.exports = 9;",
     "node_modules/ancestor-sub/parser.js": "module.exports = 10;",
     "esm/runtime-control.mjs": [
-      'const specifiers = ["./extensionless", "./directory", "./explicit.js", "./exact.js", "empty-main", "nested-main", "file-only", "ancestor-empty", "ancestor-blocked", "ancestor-sub/parser"];',
+      'const specifiers = ["./extensionless", "./directory", "./explicit.js", "./exact.js", "./actual.cjs?cache=1", "empty-main", "nested-main", "file-only", "ancestor-empty", "ancestor-blocked", "ancestor-sub/parser"];',
       "const results = [];",
       "for (const specifier of specifiers) {",
       "  try { await import(specifier); results.push({ specifier, ok: true }); }",
@@ -72,7 +76,7 @@ const createModuleLookupFixture = async () => {
       "console.log(JSON.stringify(results));",
     ].join("\n"),
     "cjs/runtime-control.cjs": [
-      'const specifiers = ["./extensionless", "./feature", "./feature.cjs", "./default-js", "./default-json", "empty-main", "nested-main", "file-only", "ancestor-empty", "ancestor-blocked", "ancestor-sub/parser"];',
+      'const specifiers = ["./extensionless", "./directory", "./feature", "./feature.cjs", "./default-js", "./default-json", "empty-main", "nested-main", "file-only", "ancestor-empty", "ancestor-blocked", "ancestor-sub/parser"];',
       "const results = [];",
       "for (const specifier of specifiers) {",
       "  try { require(specifier); results.push({ specifier, ok: true }); }",
@@ -134,6 +138,7 @@ cliTest.for(["CLI", "stdio MCP"] as const)(
         code: "ERR_MODULE_NOT_FOUND",
       },
       { specifier: "./exact.js", ok: true },
+      { specifier: "./actual.cjs?cache=1", ok: true },
       { specifier: "empty-main", ok: true },
       { specifier: "nested-main", ok: false, code: "ERR_MODULE_NOT_FOUND" },
       { specifier: "file-only", ok: false, code: "ERR_MODULE_NOT_FOUND" },
@@ -155,6 +160,11 @@ cliTest.for(["CLI", "stdio MCP"] as const)(
         ok: false,
         code: "MODULE_NOT_FOUND",
       },
+      {
+        specifier: "./directory",
+        ok: false,
+        code: "MODULE_NOT_FOUND",
+      },
       {
         specifier: "./feature",
         ok: false,
@@ -177,6 +187,7 @@ cliTest.for(["CLI", "stdio MCP"] as const)(
       ["import", "./directory", null, "not-found"],
       ["import", "./explicit.js", null, "not-found"],
       ["import", "./exact.js", "esm/exact.js", "resolved"],
+      ["import", "./actual.cjs?cache=1", "esm/actual.cjs", "resolved"],
       ["import", "empty-main", "node_modules/empty-main/index.js", "resolved"],
       ["import", "nested-main", null, "not-found"],
       ["import", "file-only", null, "external"],
@@ -184,6 +195,7 @@ cliTest.for(["CLI", "stdio MCP"] as const)(
       ["import", "ancestor-blocked", null, "not-found"],
       ["import", "ancestor-sub/parser", null, "not-found"],
       ["require", "./extensionless", null, "not-found"],
+      ["require", "./directory", null, "not-found"],
       ["require", "./feature", null, "not-found"],
       ["require", "./feature.cjs", "cjs/feature.cjs", "resolved"],
       ["require", "./default-js", "cjs/default-js.js", "resolved"],

tests/boundary/cli/nativeDemangleCli.test.ts

@@ -44,15 +44,20 @@ describe.skipIf(process.platform !== "darwin")(
     });
 
     cliTest("rejects a symbol spanning lines as input", async ({ cli }) => {
+      const missingTarget = join(
+        await createTestTempDirectory("rea-demangle-invalid-input-"),
+        "absent",
+      );
       const result = await cli.run({
         arguments: [
           "demangle-swift",
-          await evidenceTarget(),
+          missingTarget,
           "$s4main3FooV",
           "$s4main\n3FooV",
           "--json",
         ],
         environment,
+        timeoutMs: 20_000,
       });
       expect(result.exitCode).not.toBe(0);
       expect(result.json).toMatchObject({ code: "VALIDATION_ERROR" });