test: harden host compatibility and TypeScript tooling

.github/workflows/ci.yml

@@ -14,8 +14,8 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  verify:
-    name: Verify
+  validate:
+    name: Validate and prepare hosts
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
@@ -33,5 +33,84 @@ jobs:
       - name: Install locked dependencies
         run: mise run setup
 
-      - name: Verify repository
-        run: mise run verify
+      - name: Validate repository
+        run: mise run validate
+
+      - name: Build host test runners
+        run: mise run test:host-runners:build
+
+      - name: Upload prepared host artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: host-artifacts-${{ github.sha }}
+          path: |
+            dist/
+            out/
+          if-no-files-found: error
+          retention-days: 1
+
+  desktop-host:
+    name: Desktop host (${{ matrix.name }})
+    needs: validate
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: 1.125.0 floor
+            task: test:desktop:floor
+          - name: stable
+            task: test:desktop:stable
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install locked tools
+        uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5
+        with:
+          install: true
+          version: '2026.8.4'
+
+      - name: Install locked dependencies
+        run: mise run setup
+
+      - name: Download prepared host artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: host-artifacts-${{ github.sha }}
+          path: .
+
+      - name: Run desktop compatibility contract
+        run: mise run ${{ matrix.task }}
+
+  web-host:
+    name: Web host (stable Chromium)
+    needs: validate
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install locked tools
+        uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5
+        with:
+          install: true
+          version: '2026.8.4'
+
+      - name: Install locked dependencies
+        run: mise run setup
+
+      - name: Download prepared host artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: host-artifacts-${{ github.sha }}
+          path: .
+
+      - name: Run web compatibility contract
+        run: mise run test:web:stable

.gitignore

@@ -1,6 +1,8 @@
 out
 dist
 artifacts
+coverage
 node_modules
 .vscode-test/
+.vscode-test-web/
 *.vsix

.markdownlint-cli2.jsonc

@@ -21,6 +21,7 @@
 	],
 	"ignores": [
 		".vscode-test/**",
+		".vscode-test-web/**",
 		"CLAUDE.md",
 		"artifacts/**",
 		"dist/**",

.prettierignore

@@ -1,8 +1,10 @@
 artifacts
+coverage
 dist
 docs/plans
 mise.lock
 node_modules
 out
 pnpm-lock.yaml
 .vscode-test
+.vscode-test-web

.vscode-test.mjs

@@ -1,6 +1,15 @@
 import { defineConfig } from '@vscode/test-cli';
+import { DESKTOP_FLOOR_VERSION } from './scripts/lib/host-tests.mts';
 
-export default defineConfig({
-	files: 'out/test/**/*.test.js',
-	version: '1.125.0',
-});
+export default defineConfig([
+	{
+		label: 'desktop-floor',
+		files: 'out/test/desktop/**/*.test.js',
+		version: DESKTOP_FLOOR_VERSION,
+	},
+	{
+		label: 'desktop-stable',
+		files: 'out/test/desktop/**/*.test.js',
+		version: 'stable',
+	},
+]);

.vscodeignore

@@ -2,6 +2,7 @@
 .github/**
 .vscode-test/**
 artifacts/**
+coverage/**
 docs/**
 media/**
 img/*.svg
@@ -19,16 +20,16 @@ AGENTS.md
 CLAUDE.md
 .gitignore
 .yarnrc
-esbuild.js
+esbuild.mts
 mise.lock
 mise.toml
 pnpm-lock.yaml
 pnpm-workspace.yaml
 vsc-extension-quickstart.md
 **/tsconfig.json
 **/tsconfig.*.json
-**/eslint.config.mjs
-**/vitest.config.mjs
+**/eslint.config.mts
+**/vitest.config.mts
 **/*.map
 **/*.ts
 **/.vscode-test.*

AGENTS.md

@@ -13,12 +13,15 @@ Better Markdown Preview extends VS Code's built-in Markdown preview. Read
 - `src/preview/`: idempotent browser runtime, local Mermaid adapter, and DOM
   lifecycle tests.
 - `media/preview.css`: source for the theme-aware contributed preview style.
-- `src/test/`: tests executed in a real VS Code Extension Host.
+- `src/test/render-contract.ts`: browser-safe host rendering contract shared by
+  desktop and web tests.
+- `src/test/desktop/`: tests executed in real desktop Extension Hosts.
+- `src/test/web/`: bundled runner executed in stable VS Code for the Web.
 - `test/`: fast manifest and packaged-artifact contract tests.
 - `scripts/`: small cross-platform harness helpers.
 - `docs/plans/`: accepted implementation contracts; do not treat them as
   proof that later phases shipped.
-- `esbuild.js`: paired desktop and web bundles.
+- `esbuild.mts`: paired desktop and web bundles plus the web test runner.
 - `mise.toml`: canonical tool versions and task surface.
 
 ## Working Rules
@@ -31,11 +34,11 @@ Better Markdown Preview extends VS Code's built-in Markdown preview. Read
   manifest tests whenever contributions change intentionally.
 - Keep preview enhancements inside VS Code's supported Markdown extension
   hooks; do not replace the built-in preview with a custom webview.
-- Generated output belongs in `dist/`, `out/`, `artifacts/`, or `.vscode-test/`
-  and must stay untracked.
-- `.vscode-test/` contains a complete downloaded VS Code distribution, including
-  its own tool configs. Keep it excluded from repository-wide format and lint
-  discovery.
+- Generated output belongs in `dist/`, `out/`, `artifacts/`, `coverage/`,
+  `.vscode-test/`, or `.vscode-test-web/` and must stay untracked.
+- `.vscode-test/` and `.vscode-test-web/` contain downloaded VS Code/browser
+  distributions, including their own tool configs. Keep them excluded from
+  repository-wide format and lint discovery.
 - Native preview typography uses `--markdown-font-size` and
   `--markdown-line-height` (without a `--vscode-` prefix). VS Code 1.125 injects
   Markdown alert IDs as custom properties such as

README.md

@@ -84,7 +84,10 @@ are:
 - `mise run dev` watches the desktop, web, preview runtime, Mermaid, CSS, and
   TypeScript targets.
 - `mise run check` runs the fast formatter, linter, type, and unit gate.
-- `mise run test:extension` exercises activation in a real Extension Host.
+- `mise run test:coverage` enforces all-files V8 coverage floors.
+- `mise run test:desktop` exercises the engine floor and stable desktop hosts.
+- `mise run test:web:stable` exercises stable VS Code for the Web in Chromium
+  after `mise run test:hosts:prepare`.
 - `mise run package:validate` builds and inspects the VSIX.
 - `mise run verify` runs the intended-final-head local gate.
 

docs/architecture.md

@@ -62,8 +62,7 @@ dialog.
 
 - `dist/node/extension.js` targets the desktop Extension Host.
 - `dist/web/extension.js` is browser-compatible for eligible web Extension
-  Hosts; the current harness provides structural build evidence rather than an
-  executed vscode.dev host.
+  Hosts and is executed in stable VS Code for the Web under headless Chromium.
 
 Code reachable from the shared entry point must avoid Node-only APIs. If a
 future feature genuinely needs platform-specific code, split the entry points
@@ -72,6 +71,27 @@ and keep shared rendering contracts platform-neutral.
 Both bundles are declared in `package.json` and asserted inside the produced
 VSIX. A successful desktop build alone is not sufficient evidence.
 
+The repository's direct `markdown-it` development dependency is a controlled
+unit-test fixture only. Host compatibility tests render through the built-in
+Markdown extension's `markdown.api.render` command, so they exercise the
+Markdown-It version, options, plugin ordering, fence renderer, and source maps
+actually supplied by VS Code. If stable VS Code adopts a new Markdown-It major,
+first use the host contract to identify the behavioral delta, then update the
+direct fixture and focused unit expectations deliberately; do not make the
+fixture masquerade as host evidence.
+
+## Tooling Boundary
+
+Repository-owned Node configuration, scripts, helpers, and contract tests use
+explicit ESM `.mts` files. Node 24 executes these files through native type
+stripping, while `tsconfig.tooling.json` independently applies strict NodeNext,
+no-emit checking and restricts the files to erasable TypeScript syntax.
+
+`.vscode-test.mjs` is the sole JavaScript compatibility exception because
+`@vscode/test-cli` 0.0.15 discovers `.json`, `.js`, `.cjs`, and `.mjs` configs
+but not `.mts`. Reusable version and invocation logic remains in checked `.mts`
+helpers rather than the compatibility file.
+
 ## Public Contracts
 
 The extension manifest, Markdown-It behavior, contributed preview assets, and