Reject URL fragments in internal path builder

Co-authored-by: Shri Sukhani <shrisukhani@users.noreply.github.com>

Author: cursoragent

hyperbrowser/client/base.py

@@ -77,6 +77,8 @@ def _build_url(self, path: str) -> str:
         parsed_path = urlparse(stripped_path)
         if parsed_path.scheme:
             raise HyperbrowserError("path must be a relative API path")
+        if parsed_path.fragment:
+            raise HyperbrowserError("path must not include URL fragments")
         normalized_path = f"/{stripped_path.lstrip('/')}"
         base_has_api_suffix = (
             urlparse(self.config.base_url).path.rstrip("/").endswith("/api")

tests/test_url_building.py

@@ -97,6 +97,10 @@ def test_client_build_url_rejects_empty_or_non_string_paths():
             client._build_url("mailto:ops@hyperbrowser.ai")
         with pytest.raises(HyperbrowserError, match="path must be a relative API path"):
             client._build_url("http:example.com")
+        with pytest.raises(
+            HyperbrowserError, match="path must not include URL fragments"
+        ):
+            client._build_url("/session#fragment")
     finally:
         client.close()