The loopback-only looks test runs in the forge's check and says what Chrome does there #10633

I added the loopback-only look test, but I haven't seen it run: in my sandbox it skips because ip isn't installed. The forge's check log is the evidence, and I can't tell yet whether it will run or skip there. In my sandbox it printed loopback-only look: skipped, ip is not installed, and test/look-refusal.test.ts still passes (5 pass). bun x tsc --noEmit and bun scripts/gate.ts are clean.

I couldn't find pull #10625's branch on the forge, so I wrote test/look-loopback-only.test.ts fresh instead of taking it from there.

What changed

• test/look-loopback-only.test.ts runs sh -c "ip link set lo up && exec bun child" inside unshare -rn, so only lo is up.
• test/look-loopback-only.child.ts serves a page on 127.0.0.1 with Bun.serve and calls the real takeLook on it. It prints exactly one line: loopback-only look: png <bytes> or loopback-only look: error <message>.
• The test asserts only that this line came back. A 30 s budget kills the child past that and fails with a named error, so it never hangs.
• It skips by name, printing the reason, when any of these is missing: Linux, unshare, ip, Chromium, or permission to make a network namespace.
• src/looks/capture.ts is unchanged.
• The gate list needs no entry, because the gate picks up every test/*.test.ts.

To see the result: read the check's log for the line starting loopback-only look:.

• A png or error line means it ran, and error <message> is what Chrome does with only loopback up.
• A skipped line means the check's environment lacks something, and the reason follows it.

The pull can't claim "ran, not skipped" until that log line is read.

Closes #10631

I added the loopback-only look test, but I haven't seen it run: in my sandbox it skips because ip isn't installed. The forge's check log is the evidence, and I can't tell yet whether it will run or skip there. In my sandbox it printed loopback-only look: skipped, ip is not installed, and test/look-refusal.test.ts still passes (5 pass). bun x tsc --noEmit and bun scripts/gate.ts are clean.

I couldn't find pull #10625's branch on the forge, so I wrote test/look-loopback-only.test.ts fresh instead of taking it from there.

What changed

• test/look-loopback-only.test.ts runs sh -c "ip link set lo up && exec bun child" inside unshare -rn, so only lo is up.
• test/look-loopback-only.child.ts serves a page on 127.0.0.1 with Bun.serve and calls the real takeLook on it. It prints exactly one line: loopback-only look: png <bytes> or loopback-only look: error <message>.
• The test asserts only that this line came back. A 30 s budget kills the child past that and fails with a named error, so it never hangs.
• It skips by name, printing the reason, when any of these is missing: Linux, unshare, ip, Chromium, or permission to make a network namespace.
• src/looks/capture.ts is unchanged.
• The gate list needs no entry, because the gate picks up every test/*.test.ts.

To see the result: read the check's log for the line starting loopback-only look:.

• A png or error line means it ran, and error <message> is what Chrome does with only loopback up.
• A skipped line means the check's environment lacks something, and the reason follows it.

The pull can't claim "ran, not skipped" until that log line is read.

Left #10631 open: 1 unticked item remain (It skips by name, the reason printed, where unshare, ip, Chromium or namespace permission is missing; the pull says the check log line it produced (ran, not skipped) and what it printed.).