# 🤖 Behaviour suite

The same tests for every app, run twice: once with JavaScript on
(`js-on`) and once with it off (`js-off`).

    scripts/test-app.sh <base-url> [results.json]

- `todomvc.spec.ts`: the 29 tests of TodoMVC's own Cypress suite
  (`tastejs/todomvc/cypress/e2e/spec.cy.js`), ported. Each test gets a
  fresh browser context, so a fresh cookie and an empty list.
  Persistence is checked by reloading, and routing uses real paths.
  With JS off, "save edits on blur" and "cancel edits on escape" are
  skipped, and editing goes through the edit link.
- `robustness.spec.ts`: HTML in titles, UTF-8 and `Content-Length`,
  blank and very long titles, per-visitor isolation and garbled cookies,
  and cross-site and cross-list POSTs.
- `visual.spec.ts`: with JS on, the page must match a screenshot of
  `shared/reference.html` within 2% of pixels, with `footer.info`
  masked. To regenerate the golden image: `npm run golden`.

Against the reference fixture (2026-10-23): **67 passed, 3 skipped**
(the two JS-only edit tests and the screenshot test with JS off). Each
of these deliberate breaks was caught: a 500 on a foreign id, unescaped
titles, `#/` filter links, untrimmed edits, and no-JS controls visible
with JS on.