Skip to content

PR #416

PR #416 #1359

Triggered via dynamic May 21, 2026 12:57
Status Success
Total duration 1m 31s
Artifacts

codeql

on: dynamic
Matrix: analyze
Fit to window
Zoom out
Zoom in

Annotations

8 warnings
`it.skip` used to avoid updating stale `cli/json` swipe fixture instead of re-baselining: src/snapshot-tests/suites/ui-automation-suite.ts#L144
The `cli/json` swipe success test is skipped via `it.skip` because the stored fixture still reflects the old coordinate-based swipe contract — this masks a contract change rather than treating it as one requiring review.
Drag tool requires 'touch' action but application/window elements never have it, making `usesWithinElementDragPoints` dead code for those roles: src/mcp/tools/ui-automation/drag.ts#L111
Calling `resolveElementRef(simulatorId, elementRef, 'touch')` rejects elements with `application` or `window` roles with `TARGET_NOT_ACTIONABLE` before the `usesWithinElementDragPoints` branch is ever reached, because `deriveActions` in `runtime-snapshot.ts` explicitly excludes `touch` from those roles (`if (role !== 'application' && role !== 'window')`). The intended swipe-based drag path for viewport-level elements is therefore unreachable. Fix by resolving without a strict action requirement and then validating the element can support drag (e.g. has `touch` or `swipeWithin`), or by passing `'swipeWithin'` as the required action and checking `touch` availability for the non-container path after resolution.
touch tool omits post-action snapshot capture, leaving runtime snapshot store empty after success: src/mcp/tools/ui-automation/touch.ts#L151
After a successful touch, `clearRuntimeSnapshot` is called but `captureRuntimeSnapshotAfterActionSafely` is never called, so the response has no `capture` payload and `previousRuntimeSnapshot` is not set — unlike every other semantic UI action tool (`tap`, `long_press`, `swipe`, `drag`, `gesture`, `type_text`, `batch`). Any follow-up `resolveElementRef` call will immediately fail with `SNAPSHOT_MISSING`, and `setUiActionStructuredOutput` falls back to the stale `snapshot_ui` next-step rather than the runtime-snapshot guidance path.
`type_text` omits `previousRuntimeSnapshot` so the typed-into field is never suppressed from next-step suggestions: src/mcp/tools/ui-automation/type_text.ts#L183
Add `previousRuntimeSnapshot: resolution.snapshot.payload` to the `createUiActionSuccessResult` options object so the text-field element is suppressed from next-step guidance after typing, consistent with `tap`, `swipe`, `long_press`, and `drag`.
O(n²) scan in `findActiveForegroundRoot` called on every UI action: src/mcp/tools/ui-automation/shared/runtime-next-steps.ts#L389
For every scrollable candidate, `foregroundScore` calls both `findSheetGrabberDescendant` (`records.find`) and `records.filter(isForegroundCandidateForRoot)`, each O(n), making the whole function O(n²) over the snapshot element count. On a complex screen with hundreds of accessibility elements this runs on every UI action tool call.
[2BK-PF4] O(n²) scan in `findActiveForegroundRoot` called on every UI action (additional location): src/mcp/tools/ui-automation/shared/runtime-snapshot.ts#L484
For every scrollable candidate, `foregroundScore` calls both `findSheetGrabberDescendant` (`records.find`) and `records.filter(isForegroundCandidateForRoot)`, each O(n), making the whole function O(n²) over the snapshot element count. On a complex screen with hundreds of accessibility elements this runs on every UI action tool call.
HIDDEN_RUNTIME_TARGET_LABELS and LOW_PRIORITY_RUNTIME_TARGET_LABELS duplicated from domain-result-text.ts: src/utils/structured-output-envelope.ts#L55
These constants (and the `compactRuntimeSnapshotText`, `normalizedRuntimeSnapshotText`, `isHiddenRuntimeTarget`, `isLowPriorityRuntimeTarget` helpers) are copied verbatim from `domain-result-text.ts`; extract them into a shared module to eliminate the duplication.
[Y3S-84A] HIDDEN_RUNTIME_TARGET_LABELS and LOW_PRIORITY_RUNTIME_TARGET_LABELS duplicated from domain-result-text.ts (additional location): src/utils/renderers/domain-result-text.ts#L1169
These constants (and the `compactRuntimeSnapshotText`, `normalizedRuntimeSnapshotText`, `isHiddenRuntimeTarget`, `isLowPriorityRuntimeTarget` helpers) are copied verbatim from `domain-result-text.ts`; extract them into a shared module to eliminate the duplication.