Skip to content

PR #416

PR #416 #1363

Triggered via dynamic May 21, 2026 13:36
Status Success
Total duration 1m 28s
Artifacts

codeql

on: dynamic
Matrix: analyze
Fit to window
Zoom out
Zoom in

Annotations

4 warnings
CLI JSON snapshot fixtures for long_press not updated to elementRef-based format: src/mcp/tools/ui-automation/long_press.ts#L124
The `cli/json` snapshot fixtures (`long-press--success.json` and `long-press--error-no-simulator.json`) still contain the old coordinate-based action shape (`x: 100, y: 400`) and the old `snapshot_ui has not been called yet` warning, so the CLI JSON runtime snapshot tests will fail against the new `elementRef`-based output.
O(n²) element scans in inferScrollableContainers: src/mcp/tools/ui-automation/shared/runtime-snapshot.ts#L461
Both loops in `inferScrollableContainers` call O(n) helpers (`findSheetGrabberDescendant`, `hasPreferredDescendantSwipeTarget`, `hasSemanticVerticalOverflowingDescendant`, and the inline `elements.some`) for every element, making the whole function O(n²). Consider pre-grouping descendants by parent path prefix so each lookup is O(1) or O(k) instead of re-scanning the full list.
swipe tool removes coordinate-based parameters with no migration shim: src/mcp/tools/ui-automation/swipe.ts#L40
`swipe.ts` replaces its prior coordinate API (`x1`/`y1`/`x2`/`y2`/`delta`) with a semantic schema (`withinElementRef`, `direction`, `distance`). Both the `sessionAware` and `legacy` branches of `getSessionAwareToolSchemaShape` are derived from the same new `swipeSchema`, so callers still sending the old coordinate fields receive a generic Zod validation error rather than a deprecation/migration hint. Consider adding a deprecation message or accepting and translating the legacy fields for one release to ease the transition for existing agent integrations.
type_text omits previousRuntimeSnapshot from success result, losing action-context for next-step generation: src/mcp/tools/ui-automation/type_text.ts#L185
Pass `previousRuntimeSnapshot: resolution.snapshot.payload` in the `createUiActionSuccessResult` options to populate the action-context used for next-step targeting and screen-hash comparison, matching the pattern in `tap.ts`.