{
  "name": "qURL CLI behaviour test",
  "description": "What happens when a local app is published and shared with the qURL CLI and no account: link defaults, single use, WebSocket, Server-Sent Events, streaming, how sessions are admitted, and a Vite dev server.",
  "license": "CC-BY-4.0",
  "publisher": "LayerV",
  "homepage": "https://layerv.ai/research/qurl-behaviour",
  "dateTested": "2026-10-01",
  "environment": {
    "cli": "qurl 3.2.0 (darwin/arm64), checksum-verified release binary",
    "account": "none (fresh device identity in an isolated state directory)",
    "mode": "qurl publish --foreground (no background service installed)",
    "os": "macOS on Apple silicon",
    "browser": "headless Chromium driven by agent-browser",
    "node": "20.18.3",
    "probe": "probe-server.js in this folder, listening on 127.0.0.1"
  },
  "checks": [
    {
      "id": "publish-no-account",
      "check": "Publish a local app with no account",
      "result": "pass",
      "detail": "qurl publish printed a CRID with no prompts, sign-in, or API key."
    },
    {
      "id": "share-defaults",
      "check": "qurl share <CRID> with no flags",
      "result": "pass",
      "detail": "JSON output reported expires_in_seconds 86400 (24 hours) and single_use true."
    },
    {
      "id": "landing-host",
      "check": "Where the recipient lands",
      "result": "observed",
      "detail": "The browser went from qurl.link to https://r_<11 characters>.qurl.site/ with no warning or sign-up page."
    },
    {
      "id": "websocket",
      "check": "WebSocket upgrade through the link",
      "result": "pass",
      "detail": "The upgrade reached the local app and 3 of 3 echo round trips completed over wss://."
    },
    {
      "id": "sse",
      "check": "Server-Sent Events through the link",
      "result": "pass",
      "detail": "Six events sent one second apart arrived one second apart; none were batched."
    },
    {
      "id": "chunked",
      "check": "Chunked streaming response through the link",
      "result": "pass",
      "detail": "Five 1 KiB chunks sent one second apart arrived one second apart."
    },
    {
      "id": "single-use",
      "check": "Open the same link a second time",
      "result": "pass",
      "detail": "The second open showed \"Access link invalid\" and stated the link may already have been used."
    },
    {
      "id": "session-admission",
      "check": "How an opened session is authorized",
      "result": "observed",
      "detail": "No request carried a cookie. After the link was opened, a cookie-less curl from the same public IP address received the app. This matches the API reference: redeeming a link grants network access to the IP address that redeemed it."
    },
    {
      "id": "request-headers",
      "check": "Headers the local app receives",
      "result": "observed",
      "detail": "Host and X-Forwarded-Host are c-<connector id>.qurl.site; X-Forwarded-Proto is http; browser requests send Origin https://r_<id>.qurl.site."
    },
    {
      "id": "delete",
      "check": "Reach the app after qurl delete",
      "result": "pass",
      "detail": "The r_ host stopped answering after the resource was deleted."
    },
    {
      "id": "resource-expiry",
      "check": "Resource expiry reported by qurl list",
      "result": "observed",
      "detail": "A resource created 2026-10-01 reported expires_at 2126-09-07, about 100 years out."
    },
    {
      "id": "vite-localhost",
      "check": "qurl publish http://localhost:5173 against a default Vite 6.4.3 dev server",
      "result": "fail",
      "detail": "Vite listened only on [::1]; qurl dialled 127.0.0.1 and reported that the local app was not accepting TCP connections. Publishing http://[::1]:5173 worked."
    },
    {
      "id": "vite-allowed-hosts",
      "check": "Open a link to the Vite dev server",
      "result": "fail without config, pass with it",
      "detail": "Without configuration Vite answered \"Blocked request. This host is not allowed.\" With server.allowedHosts set to ['.qurl.site'] the page loaded, the HMR socket connected, and an edit to src/main.js reached the remote browser."
    }
  ],
  "measurements": {
    "note": "One run on one network. Published for transparency, not as a latency benchmark.",
    "sseArrivalMs": {
      "viaQurl": [1176, 2175, 3171, 4174, 5171, 6182],
      "localhost": [1005, 2005, 3006, 4007, 5009, 6008]
    },
    "chunkArrivalMs": {
      "viaQurl": [1165, 2175, 3172, 4174, 5170],
      "localhost": [1005, 2005, 3006, 4006, 5006]
    },
    "websocketEchoRoundTrips": 3
  }
}