agent-desktop/tests/e2e

Native macOS end-to-end tests

This suite drives the release agent-desktop binary against a real macOS app and verifies effects through independent accessibility observations. A command returning ok: true is never sufficient when the fixture exposes an observable status, value, process, window, or surface transition.

Run the fixture suite

AGENT_DESKTOP_E2E_EXCLUSIVE=1 bash tests/e2e/run.sh

The single prerequisite gate requires:

• macOS;
• Accessibility permission granted to the terminal or runner; and
• a buildable Swift fixture app.

AGENT_DESKTOP_E2E_EXCLUSIVE=1 is a safety acknowledgement that the caller has made the desktop exclusive, including stopping user input and other automation. The harness lock prevents a second native harness from starting, but it cannot stop an unrelated agent-desktop process from starting between commands. Do not set the acknowledgement while the desktop is in use.

Before taking the desktop lock, run.sh builds the CLI, macOS helper, and FFI library from the current checkout with --locked into the canonical repository target directory. It then hashes and copies those exact artifacts to read-only paths under a private suite directory. The suite uses only those copies plus an isolated HOME, ref/session stores, fixture build, and TMPDIR. Every CLI child runs in its own process group with an absolute timeout and bounded stdout/stderr capture. Artifact hashes and exact JSON/Clap version identity are checked again before success is reported.

The harness then builds and launches AgentDeskFixture.app. Once the fixture is running, a missing control, window, status readout, bounds record, or surface is a test failure. Scenarios never turn a missing prerequisite into a successful SKIP. Exit 0 means every assertion passed from an uncontaminated run, exit 1 means a behavioral failure, and exit 2 means the global prerequisite gate failed.

Headed cases move the real cursor. Run them on a machine where that is safe. The fixture process is force-closed by the cleanup trap even when a test fails.

Exact ref namespaces

Every non-count find returns two inseparable values:

{"ref_id":"@e12","snapshot_id":"..."}

lib.sh carries that pair as one target and every ref action, get, is, and element wait passes the exact --snapshot value. The harness deliberately runs unrelated observations between find and get to prove that a ref does not depend on the mutable latest-snapshot pointer. Do not add a helper that returns a bare @eN.

Layout

Path	Responsibility
run.sh	Global gate, fixture lifecycle, semantic suite orchestration
lib.sh	Fail-closed assertions and exact {ref_id,snapshot_id} target helpers
scenarios/observation.sh	Snapshots, locators, namespace pinning, strict twins
scenarios/interaction.sh	Headless/headed actions and exact-once effects
scenarios/acceptance.sh	Named AE1-AE7 acceptance contract
scenarios/reliability.sh	Stale refs, waits, drill-down, sessions
scenarios/surfaces.sh	Sheets, menus, drag, disclosure
scenarios/trace_performance.sh	Trace artifacts, redaction, timings, cleanup
permission-contract.sh	Deterministic AE5 mapping tests without mutating TCC
electron-live.sh	Opt-in installed Electron/Chromium app measurement

Every shell file stays below the repository's 400-line limit.

AE1-AE7 acceptance map

scenarios/acceptance.sh names and fails closed on every plan example:

Example	Native fixture assertion
AE1	An addressable button whose live AX frame is zero reports visible=false.
AE2	CLI and native release-FFI consumers wait for a button enabled after 800 ms, dispatch exactly once, and perform one immediate check under timeout zero without a late effect.
AE3	A permanently disabled button with --timeout-ms 2000 returns TIMEOUT, details.kind=actionability_timeout, and details.last_report near 2 s.
AE4	Two windows with the same title receive distinct ids; focusing the second id focuses that exact window.
AE5	Deterministic tests prove prompt isolation and nonprompting Automation probes; when the runner already has denied Automation TCC, a native headed Notification Center operation must return PERM_DENIED. Other TCC states are explicitly logged as unavailable rather than claimed as exercised.
AE6	One batch captures a pre-action baseline, clicks open a sheet, and reports surface_appeared without naming the surface title.
AE7	The same disabled action with no timeout flag returns the structured timeout near the untouched 5 s default.

AE2, AE3, and AE7 run in both headless and headed policy modes. Elapsed-time tolerances account for process launch and scheduler noise but are narrow enough to detect a missing wait, the wrong default, or an unbounded overrun. Delayed action status is observed after a settle interval so a duplicate late dispatch cannot pass.

permission-contract.sh is intentionally deterministic. It tests the expired deadline, helper result, and Automation-not-required contracts without calling native prompt APIs, resetting TCC, or assuming the developer's consent state.

Installed Electron/Chromium measurement

The live harness is opt-in and is never called by run.sh or unprivileged CI:

AGENT_DESKTOP_E2E_EXCLUSIVE=1 bash tests/e2e/electron-live.sh --app Slack
AGENT_DESKTOP_E2E_EXCLUSIVE=1 bash tests/e2e/electron-live.sh \
  --app "Visual Studio Code" \
  --baseline-binary /path/to/previous/agent-desktop \
  --out /tmp/vscode-ax.json

The app must already be installed, running, and exposing at least one window. The harness does not launch, focus, click, type into, or close the user's app. If any prerequisite is unavailable, invocation fails instead of emitting a successful partial benchmark.

It performs exactly five warmup pairs and 31 measured release-binary pairs of find --role button --first. When --baseline-binary is supplied, immutable baseline (A) and current (B) binaries run in balanced AB/BA order against one exact process generation and window inventory, with separate HOME directories. State is checked before and after every pair. The v3 JSON schema includes nearest-rank wall and CPU p50/p95, paired current-minus-baseline deltas, success and correctness rates, AX traversal/read statistics when a binary emits them, renderer activation counts, SHA-256/version identities, raw samples, and exact-snapshot re-resolution checks. It deliberately omits RSS: RUSAGE_CHILDREN.ru_maxrss is a cumulative harness maximum, not a per-command measurement.

The report explicitly labels its limits: it describes one machine, app state, and TCC state; it measures observation and ref re-resolution rather than action delivery; and it never invents a baseline when none was explicitly supplied. The default output is a timestamped file under /tmp; pass --out to retain it elsewhere.

Adding a scenario

1. Add a stable accessibility label and an independently observable status to the fixture.
2. Resolve action targets with require_target; never retain a bare ref.
3. Use act_target, get_target, is_target, or wait_target so the source snapshot id is always explicit.
4. Treat missing controls and unsupported behavior as failures after setup.
5. When timing behavior, assert both the structured JSON contract and elapsed bounds, then verify that no duplicate effect appears after settling.