phase: 02_simulate_fetch_commands

All green. Final report:

**Phase 02 — final verification pass** (both tasks already in `.agents/phases/complete/02_simulate_fetch_commands/`)
- Verified: no `fetch(` remains in `src/` (grep exit 1) or in built `dist/*.js`
- Verified: `simulatedCurlOutput()` / `simulatedWgetOutput()` in `src/terminal-commands.js` (lines 63/73), wired into `src/terminal.js` curl/wget branches
- Verified: regression test `curl/wget are simulated — no real network request leaves the origin` in `tests/e2e/02-terminal.spec.js` — asserts simulated bodies, `web_navigator` toast + localStorage persistence, and zero non-`baseURL` requests
- Tests: `./build.sh` → OK; `npm test` → **46 passed, 0 failed** (≥46 required); `bash .agents/validate.sh` → **exit 0** (E2E + repo-hygiene gates)
- No linter configured beyond validate.sh (vanilla JS, LOCKED no-toolchain)
- Completion criteria: ①no `fetch(` ✅ ②simulators present ✅ ③regression tests present & passing ✅ ④build+test 46 green ✅ ⑤no behavior change (page/terminal/vim/achievements/menu suites all green) ✅
- Documentation: full README/AGENTS.md review — both already updated in working tree and consistent with the project (simulated curl/wget, validate.sh gate, Podman build flow vs Dockerfile, Node ≥20 matches `@playwright/test` engines, M-4 header gap correctly documented as pending Phase 03) — **verified consistent, no changes needed**
- Note: `PLAN.md` still says "44 tests" (now 46) but PLAN is locked — flagged for the harness/user, not edited
- Next pending phase: `03_nginx_security_headers`

.agents/phases/complete/02_simulate_fetch_commands/00_phase.md

@@ -0,0 +1,44 @@
+# Phase 02 — Remove unvalidated client fetch from curl/wget (audit M-2)
+
+**Story:** n/a
+**Context:** `.agents/PLAN.md` §2 (principle 5 — fun is safe) & §3 (terminal
+modules), `.agents/remediation_plan.md` finding M-2
+
+## Objective
+The fake terminal's `curl`/`wget` commands run a real, unvalidated
+`fetch(url)` from the visitor's browser — a client-side request-forgery
+primitive (and cookie-attached once the site ever has auth) that is also
+silently broken in production (CSP `connect-src` falls back to
+`default-src 'self'`, blocking every external fetch). Replace the real
+fetch with **simulated output** consistent with the rest of the fake
+terminal: zero network I/O, deterministic, echoes the requested URL.
+
+**Chosen approach** (audit recommendation, owner-approved 2026-09-18):
+simulate. The rejected alternative (real fetch + https-only allowlist +
+`connect-src` + `credentials: 'omit'`) is documented for the record but out
+of scope.
+
+## Dependencies
+— (none)
+
+## Tasks
+1. `01_simulate_fetch_output.md` — Add `simulatedCurlOutput(url)` / `simulatedWgetOutput(url)` to `terminal-commands.js`; replace both `fetch()` calls in `terminal.js` with the simulated outputs.
+2. `02_fetch_regression_test.md` — Add Playwright tests proving curl/wget render simulated output, make **zero** non-origin network requests, and still unlock the `web_navigator` achievement.
+
+## Testing & Quality
+- Unit/integration: the regression tests must cover (a) `curl <url>`
+  renders the simulated block and echoes the URL, (b) `wget <url>` same,
+  (c) no request to any non-origin host occurs (request listener),
+  (d) `web_navigator` achievement/toast still fires.
+- Coverage: **>90%** on new/modified code (the two simulator functions +
+  both branches).
+- E2E: full Playwright suite green.
+
+## Completion Criteria
+- [ ] `grep -n "fetch(" src/terminal.js` returns no matches (the only
+      `fetch(` in `src/` must be gone)
+- [ ] `simulatedCurlOutput` / `simulatedWgetOutput` present in
+      `src/terminal-commands.js`
+- [ ] new regression tests present in `tests/e2e/` and passing
+- [ ] `./build.sh && npm test` fully green (46+ tests)
+- [ ] no behavior change in completed work (terminal, vim, achievements, menu)