fix(Obscura): pass --allow-file-access when launching obscura serve

0.2.2 gates DOM.setFileInputFiles behind --allow-file-access, so attachFile
failed with "DOM.setFileInputFiles is disabled" on a self-launched server. The
flag exists in 0.2.0 too, so passing it works against both.

Also drops "file uploads" from the documented limitations: they work, and the
two skipped #attachFile tests are skipped for an unrelated <select multiple>
bug, not for lack of upload support.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017bdxGACghDuRVjn3hzmdy4

Author: DavertMik

docs/helpers/Obscura.md

@@ -28,9 +28,9 @@ process lifecycle, the same way Playwright manages its own browser process.
     never spawns or kills anything, no matter what `binaryPath`/`port` are set to.
 *   **SELF-LAUNCH** — `endpoint` is unset and a binary can be resolved, in order: `binaryPath` in
     the config, then the `OBSCURA_PATH` environment variable, then `obscura` on `PATH`. The helper
-    spawns `obscura serve --port <port> --allow-private-network` (`port` from the config, or a
-    free port picked automatically), waits for it to answer, connects, and kills it in
-    `_finishTest`.
+    spawns `obscura serve --port <port> --allow-private-network --allow-file-access` (`port` from
+    the config, or a free port picked automatically), waits for it to answer, connects, and kills
+    it in `_finishTest`.
 *   **COURTESY-ATTACH** — `endpoint` is unset and no binary can be resolved, but something already
     answers `http://127.0.0.1:9222/json/version` (e.g. `obscura serve` started by hand, or by CI
     before this process ever ran). The helper attaches to it and never kills it — it isn't the
@@ -46,9 +46,10 @@ it directly) and the helper launches and tears it down for you automatically:
 curl -sL https://github.com/h4ckf0r0day/obscura/releases/download/v0.2.2/obscura-x86_64-linux.tar.gz | tar xz
 ```
 
-`--allow-private-network` is always passed by this helper (it's required to reach apps running
-on `localhost`/private IPs, e.g. a dev server on `127.0.0.1:8000` — Obscura blocks
-private-network requests by default).
+`--allow-private-network` and `--allow-file-access` are always passed by this helper: the first
+is required to reach apps running on `localhost`/private IPs, e.g. a dev server on
+`127.0.0.1:8000`, the second to let `attachFile` upload local files. Obscura blocks both by
+default.
 
 ## Config presets
 
@@ -67,7 +68,7 @@ Set them explicitly in your own config to skip probing or to force a mode.
 ## Limitations
 
 *   `input` is always `synthetic`, even on rendering builds — see `input` above.
-*   No frames, popups, or file uploads.
+*   No frames or popups.
 *   On `-no-render` builds and v0.1.x: no screenshots, no visibility assertions
     (`seeElement`/`dontSeeElement` always throw) — only DOM presence
     (`seeElementInDOM`/`dontSeeElementInDOM`) is meaningful without a layout engine.

lib/helper/Obscura.js

@@ -45,9 +45,9 @@ const config = {}
  *   never spawns or kills anything, no matter what `binaryPath`/`port` are set to.
  * - **SELF-LAUNCH** — `endpoint` is unset and a binary can be resolved, in order: `binaryPath` in
  *   the config, then the `OBSCURA_PATH` environment variable, then `obscura` on `PATH`. The helper
- *   spawns `obscura serve --port <port> --allow-private-network` (`port` from the config, or a
- *   free port picked automatically), waits for it to answer, connects, and kills it in
- *   `_finishTest`.
+ *   spawns `obscura serve --port <port> --allow-private-network --allow-file-access` (`port` from
+ *   the config, or a free port picked automatically), waits for it to answer, connects, and kills
+ *   it in `_finishTest`.
  * - **COURTESY-ATTACH** — `endpoint` is unset and no binary can be resolved, but something already
  *   answers `http://127.0.0.1:9222/json/version` (e.g. `obscura serve` started by hand, or by CI
  *   before this process ever ran). The helper attaches to it and never kills it — it isn't the
@@ -63,9 +63,10 @@ const config = {}
  * curl -sL https://github.com/h4ckf0r0day/obscura/releases/download/v0.2.2/obscura-x86_64-linux.tar.gz | tar xz
  * ```
  *
- * `--allow-private-network` is always passed by this helper (it's required to reach apps running
- * on `localhost`/private IPs, e.g. a dev server on `127.0.0.1:8000` — Obscura blocks
- * private-network requests by default).
+ * `--allow-private-network` and `--allow-file-access` are always passed by this helper: the first
+ * is required to reach apps running on `localhost`/private IPs, e.g. a dev server on
+ * `127.0.0.1:8000`, the second to let `attachFile` upload local files. Obscura blocks both by
+ * default.
  *
  * ## Config presets
  *
@@ -84,7 +85,7 @@ const config = {}
  * ## Limitations
  *
  * - `input` is always `synthetic`, even on rendering builds — see `input` above.
- * - No frames, popups, or file uploads.
+ * - No frames or popups.
  * - On `-no-render` builds and v0.1.x: no screenshots, no visibility assertions
  *   (`seeElement`/`dontSeeElement` always throw) — only DOM presence
  *   (`seeElementInDOM`/`dontSeeElementInDOM`) is meaningful without a layout engine.
@@ -179,7 +180,7 @@ class Obscura extends CDPBrowser {
       const port = this.options.port || (await this._findFreePort())
       this.options.port = port
       this.serverError = null
-      this.serverProcess = spawn(binaryPath, ['serve', '--port', String(port), '--allow-private-network'], { stdio: 'ignore' })
+      this.serverProcess = spawn(binaryPath, ['serve', '--port', String(port), '--allow-private-network', '--allow-file-access'], { stdio: 'ignore' })
       this.serverProcess.on('error', err => {
         this.serverError = err
       })