[gareth-morgan-nv]

Summary

Real-browser integration tests for the OOB teleop path: the merged fake-adb test double plays the headset's adb, real Chrome opens the exact URL that am start receives, the real web client (MockCloudXR build) runs in it, and the real wss.run + OOBControlHub serve it. The first cases cover fragment token delivery from #1318; the harness is meant to host further end-to-end OOB cases. Based on #1318; the diff here is the new test only.

What changed

• tests/python/core/cloudxr/test_oob_token_integration.py:
  • A fast /bin/sh test that the -d URL survives shell quoting with a token containing &, ?, #, +, a space and quotes. Always runs.
  • Browser cases (generated and awkward configured token): the launch URL carries the token only in the fragment after the route, the hub accepts the client, the page URL is cleaned, the mock session reports streaming, and no request target or Referer seen by the static server contains the token.
  • A wrong fragment token is rejected: the client logs the 1008 policy close and the hub has no headset.
• The browser cases need Chrome and an npm build, so they run only with RUN_OOB_BROWSER_TESTS=1 (-m oob_browser); nothing runs them automatically. Chrome here ignores TLS errors, so certificate trust is bypassed, not covered.
• Test dependency cryptography and the oob_browser marker in the leaf pyproject.toml.

Validation

• RUN_OOB_BROWSER_TESTS=1 uv run --extra dev pytest test_oob_token_integration.py in tests/python/core/cloudxr: 4 passed locally.
• Hand mutation checks (each made the tests fail): no token capture in the client, no sessionStorage persistence, token also in the URL query, hub accepting any token, URL not shell-quoted.
• SKIP=check-copyright-year pre-commit run --all-files clean.
• Browser cases in CI: not wired; they are opt-in and run locally only.

Known limitations / follow-ups

• Reload persistence is covered by the jest and Playwright tests from fix(cloudxr): deliver the OOB control token in the URL fragment #1318, not here. A reload step in this test failed intermittently (the new page did not connect to the hub within 30 s); it was removed rather than retried, and the cause was not found.
• No CI job runs the browser cases yet.
• Further cases that need a real browser: cross-origin requests to the hub API being refused (fix(cloudxr): stop serving the OOB hub API cross-origin and reject oversized hub frames before parsing #1317), and client watchdog timeouts driven from the bookmark through MockCloudXR's connect delay.

Test plan

• CI checks pass on this PR.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: NVIDIA/IsaacCapture
• Branch: gmorgan/oob-hub-token-fragment
• File: .coderabbit.yaml
• Commit: 9d3b091
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 46ab4617-f8f8-4e97-91b6-3912f09352c5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[gareth-morgan-nv]

🤖 Agent-generated (Claude Code · claude-sonnet-5-5)

Closing: these tests are combined into #1148, which now holds the whole real-browser OOB test suite.