PR #416 #1359
codeql
on: dynamic
Matrix: analyze
Annotations
8 warnings
|
`it.skip` used to avoid updating stale `cli/json` swipe fixture instead of re-baselining:
src/snapshot-tests/suites/ui-automation-suite.ts#L144
The `cli/json` swipe success test is skipped via `it.skip` because the stored fixture still reflects the old coordinate-based swipe contract — this masks a contract change rather than treating it as one requiring review.
|
|
Drag tool requires 'touch' action but application/window elements never have it, making `usesWithinElementDragPoints` dead code for those roles:
src/mcp/tools/ui-automation/drag.ts#L111
Calling `resolveElementRef(simulatorId, elementRef, 'touch')` rejects elements with `application` or `window` roles with `TARGET_NOT_ACTIONABLE` before the `usesWithinElementDragPoints` branch is ever reached, because `deriveActions` in `runtime-snapshot.ts` explicitly excludes `touch` from those roles (`if (role !== 'application' && role !== 'window')`). The intended swipe-based drag path for viewport-level elements is therefore unreachable. Fix by resolving without a strict action requirement and then validating the element can support drag (e.g. has `touch` or `swipeWithin`), or by passing `'swipeWithin'` as the required action and checking `touch` availability for the non-container path after resolution.
|
|
touch tool omits post-action snapshot capture, leaving runtime snapshot store empty after success:
src/mcp/tools/ui-automation/touch.ts#L151
After a successful touch, `clearRuntimeSnapshot` is called but `captureRuntimeSnapshotAfterActionSafely` is never called, so the response has no `capture` payload and `previousRuntimeSnapshot` is not set — unlike every other semantic UI action tool (`tap`, `long_press`, `swipe`, `drag`, `gesture`, `type_text`, `batch`). Any follow-up `resolveElementRef` call will immediately fail with `SNAPSHOT_MISSING`, and `setUiActionStructuredOutput` falls back to the stale `snapshot_ui` next-step rather than the runtime-snapshot guidance path.
|
|
`type_text` omits `previousRuntimeSnapshot` so the typed-into field is never suppressed from next-step suggestions:
src/mcp/tools/ui-automation/type_text.ts#L183
Add `previousRuntimeSnapshot: resolution.snapshot.payload` to the `createUiActionSuccessResult` options object so the text-field element is suppressed from next-step guidance after typing, consistent with `tap`, `swipe`, `long_press`, and `drag`.
|
|
O(n²) scan in `findActiveForegroundRoot` called on every UI action:
src/mcp/tools/ui-automation/shared/runtime-next-steps.ts#L389
For every scrollable candidate, `foregroundScore` calls both `findSheetGrabberDescendant` (`records.find`) and `records.filter(isForegroundCandidateForRoot)`, each O(n), making the whole function O(n²) over the snapshot element count. On a complex screen with hundreds of accessibility elements this runs on every UI action tool call.
|
|
[2BK-PF4] O(n²) scan in `findActiveForegroundRoot` called on every UI action (additional location):
src/mcp/tools/ui-automation/shared/runtime-snapshot.ts#L484
For every scrollable candidate, `foregroundScore` calls both `findSheetGrabberDescendant` (`records.find`) and `records.filter(isForegroundCandidateForRoot)`, each O(n), making the whole function O(n²) over the snapshot element count. On a complex screen with hundreds of accessibility elements this runs on every UI action tool call.
|
|
HIDDEN_RUNTIME_TARGET_LABELS and LOW_PRIORITY_RUNTIME_TARGET_LABELS duplicated from domain-result-text.ts:
src/utils/structured-output-envelope.ts#L55
These constants (and the `compactRuntimeSnapshotText`, `normalizedRuntimeSnapshotText`, `isHiddenRuntimeTarget`, `isLowPriorityRuntimeTarget` helpers) are copied verbatim from `domain-result-text.ts`; extract them into a shared module to eliminate the duplication.
|
|
[Y3S-84A] HIDDEN_RUNTIME_TARGET_LABELS and LOW_PRIORITY_RUNTIME_TARGET_LABELS duplicated from domain-result-text.ts (additional location):
src/utils/renderers/domain-result-text.ts#L1169
These constants (and the `compactRuntimeSnapshotText`, `normalizedRuntimeSnapshotText`, `isHiddenRuntimeTarget`, `isLowPriorityRuntimeTarget` helpers) are copied verbatim from `domain-result-text.ts`; extract them into a shared module to eliminate the duplication.
|