test: parity and input oracles

[clean6378-max-it]

Closes #137

We had structural parity checks on dispatch keys but nothing that ran the same nasty tool_result through Python export and the JS renderer and compared what came out. This PR adds that, plus parser tests that expect a specific degraded outcome for bad JSONL instead of only checking that nothing blows up.

The shared payload is a bash tool_result with in stdout. Python goes through _parse_tool_result and _render_tool_result and checks the output sits in a code fence. JS goes through renderToolResult / renderBashResult and checks the tag is escaped in HTML. Same blob on both sides.

On the parser side we cover a truncated last line (earlier messages still parse), a parentUuid that points nowhere (value kept as-is), a line with NUL bytes (that line drops, the next good line still parses), and a user toolUseResult with no matching tool_use (tool_result_parsed still lands as bash with the stdout you sent).

pytest -q and npm test both pass. If you break escaping on the JS bash path or drop the md code fence on Python, the parity test should fail.

Summary by CodeRabbit

• Bug Fixes

  • Improved protection against HTML/script injection by escaping adversarial tool-result content so it renders as inert text.
  • Enhanced resilience with malformed or incomplete conversation data by skipping corrupted entries, preserving valid messages, and correctly handling unmatched tool results.

• Tests

  • Added dual-path parity oracle coverage to ensure tool-result rendering matches across JS dispatch and direct bash rendering, including escaping validation.
  • Added Python dual-path oracle tests covering adversarial bash handling (rendered as inert text), truncated inputs, broken references, NUL-byte–polluted lines, and unmatched tool results.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 96fe5ba2-425c-4db6-9b15-c75e7ce30847

📥 Commits

Reviewing files that changed from the base of the PR and between 68f41f4 and c15588b.

📒 Files selected for processing (2)

• static/js/render/tool_result/dual_path_parity_oracle.test.js
• tests/test_dual_path_parity_oracle.py

🚧 Files skipped from review as they are similar to previous changes (2)

• static/js/render/tool_result/dual_path_parity_oracle.test.js
• tests/test_dual_path_parity_oracle.py

---

📝 Walkthrough

Walkthrough

Adds Python and JavaScript oracle tests for adversarial bash rendering parity, HTML escaping, malformed JSONL recovery, broken parent links, NUL-byte handling, and orphaned tool-result dispatch.

Changes

Rendering parity and parser resilience

Layer / File(s)	Summary
Adversarial bash rendering parity static/js/render/tool_result/dual_path_parity_oracle.test.js, tests/test_dual_path_parity_oracle.py	Tests Python and JavaScript bash dispatch, escaped adversarial output, and parity between registry and direct JavaScript renderers.
Malformed session input oracles tests/test_dual_path_parity_oracle.py	Verifies truncated lines are skipped, malformed parent UUIDs are preserved, NUL-tainted lines are dropped, and orphaned tool results retain parsed bash data and slugs.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• cppalliance/claude-code-chat-browser#57: Exercises the tool-result dispatch machinery covered by these tests.
• cppalliance/claude-code-chat-browser#123: Adds related Vitest coverage for bash tool-result rendering and HTML escaping.
• cppalliance/claude-code-chat-browser#124: Covers related tool_result dispatch classification for bash fixtures.

Suggested reviewers: timon0305

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	Clear, specific title that matches the test-focused parity and input-oracle changes.
Linked Issues check	✅ Passed	The PR adds the adversarial Python/JS parity tests and malformed-input oracle tests required by #137, with observable assertions over real paths.
Out of Scope Changes check	✅ Passed	All changes are test-only and stay within the parity/oracle scope; no tool types, scaffold, or unrelated production code were added.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch test/dual-path-parity-oracle

---

_{Comment @coderabbitai help to get the list of available commands.}