Add fuzz/property-based tests for blob parsing

[bradjin8]

Repository: cppa-cursor-browser
Assignee: Brad @bradjin8
Points: 5
Severity: Medium

Problem

No property-based testing or fuzzing covers the blob/bubble parsing pipeline. The pipeline parses Cursor's undocumented, evolving internal format — particularly the CLI agent blob chains stored under ~/.cursor/chats/. The test suite (28 files) is strong at the boundaries (model validation, path traversal, API request/response) but the interior assembly functions that transform raw database rows into structured tabs are tested primarily through integration paths. Adversarial or generative test inputs would be the most direct way to discover schema drift scenarios that the silent failure chain will hide in production.

Acceptance Criteria

• hypothesis is added to dev dependencies in pyproject.toml
• At least 3 property-based tests cover: Bubble.from_dict with arbitrary dict inputs, blob chain parsing with randomized byte sequences, and text extraction from generated conversation structures
• Tests use @given(st.dictionaries(...)) or equivalent Hypothesis strategies to generate inputs
• Tests verify that parsing never raises unhandled exceptions (always returns a result or raises SchemaError)
• Tests complete within a reasonable time bound (< 30 seconds with default Hypothesis settings)
• Tests pass in CI
• PR approved by at least 1 reviewer

Implementation Notes

Use the hypothesis library (standard for Python property-based testing). Create a new test file tests/test_blob_parsing_fuzz.py. Define strategies for the blob input shapes: st.binary() for raw blobs, st.dictionaries(st.text(), st.one_of(st.text(), st.integers(), st.none())) for from_dict inputs. The key property to test is "the parser never crashes" — it should always return a valid result or raise a structured SchemaError. A secondary property: "parsing is idempotent" — parsing the same input twice produces the same output. Focus on the services/workspace_tabs.py bubble assembly and the Bubble.from_dict entry point. The CLI agent blob chain parsing (if implemented in services/cli_tabs.py) should also be covered.

References

• Eval finding: Test 31 (Test Depth) — part of the "Unverified Dark Path" compound (T11+T20+T30+T31)
• Related files: services/workspace_tabs.py, models/conversation.py (Bubble), services/cli_tabs.py, tests/