Skip to content

Conversation

@IovetsNikolay
Copy link
Contributor

@IovetsNikolay IovetsNikolay commented Feb 10, 2026

User description

Connect the unused performInteractiveExploration() to --deep research flow, producing a deterministic element inventory alongside AI analysis.

Changes:

  • Add --deep flag to TUI /research command and CLI
  • Call performInteractiveExploration after performDeepAnalysis in deep mode
  • Expand CLICKABLE_ROLES with checkbox, radio, slider, textbox, treeitem
  • Include unnamed buttons in ARIA collection (mark with unnamed flag)
  • Remove 30-char link name length filter
  • Handle unnamed elements with role-only click fallback
  • Accept maxElements override param, use 50 in deep mode

CodeAnt-AI Description

Enable deep interactive exploration during research (--deep) and include unnamed/clickable elements

What Changed

  • Add --deep option to CLI and TUI research command; when used, research performs an interactive exploration that clicks UI elements after analysis
  • Exploration now considers more element types (checkbox, radio, slider, textbox, treeitem) and includes unnamed buttons/links (marks them as unnamed and falls back to role-only clicks)
  • Increased allowable name length and removed the previous short-name filter; exploration accepts a maxElements override and deep mode uses up to 50 elements

Impact

✅ Deeper UI coverage during research
✅ Discover previously ignored unnamed interactive elements
✅ Broader interactive element sampling (up to 50 clicks in deep mode)

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Connect the unused performInteractiveExploration() to --deep research
flow, producing a deterministic element inventory alongside AI analysis.

Changes:
- Add --deep flag to TUI /research command and CLI
- Call performInteractiveExploration after performDeepAnalysis in deep mode
- Expand CLICKABLE_ROLES with checkbox, radio, slider, textbox, treeitem
- Include unnamed buttons in ARIA collection (mark with unnamed flag)
- Remove 30-char link name length filter
- Handle unnamed elements with role-only click fallback
- Accept maxElements override param, use 50 in deep mode

Co-authored-by: Cursor <cursoragent@cursor.com>
@codeant-ai
Copy link

codeant-ai bot commented Feb 10, 2026

CodeAnt AI is reviewing your PR.

@codeant-ai codeant-ai bot added the size:S This PR changes 10-29 lines, ignoring generated files label Feb 10, 2026
@codeant-ai
Copy link

codeant-ai bot commented Feb 10, 2026

Nitpicks 🔍

🔒 No security issues identified
⚡ Recommended areas for review

  • Click Command Safety
    The code builds a JS command string that embeds element text and role directly:
    I.click({ role: '${role}', text: '${name}' }). If name contains quotes, newlines or other special characters
    this can break the generated code or cause unexpected behavior. Use a safer serialization method when injecting values
    into the action string (e.g. JSON.stringify or a dedicated command builder) to avoid injection/formatting issues.

  • Markdown Table Escaping
    Element labels are inserted directly into a Markdown table without escaping. If an element name contains pipe characters,
    newlines, or markdown-sensitive characters the generated table will be malformed. Sanitize or escape values before composing the table.

Comment on lines 9 to +11
const includeData = args.includes('--data');
const target = args.replace('--data', '').trim();
const enableDeep = args.includes('--deep');
const target = args.replace('--data', '').replace('--deep', '').trim();
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: The current argument parsing removes the substrings '--data' and '--deep' from the entire args string, so if a URL itself contains these sequences (for example as query parameters), the URL will be mangled before navigation, causing the command to visit an unintended page or an invalid URL; instead, parse args into tokens and strip flags only when they are separate arguments. [logic error]

Severity Level: Major ⚠️
- ❌ /research navigates to wrong page when URL contains flags.
- ⚠️ AI research summary mismatched with user's intended target URL.
Suggested change
const includeData = args.includes('--data');
const target = args.replace('--data', '').trim();
const enableDeep = args.includes('--deep');
const target = args.replace('--data', '').replace('--deep', '').trim();
const tokens = args.split(/\s+/).filter(Boolean);
const includeData = tokens.includes('--data');
const enableDeep = tokens.includes('--deep');
const target = tokens.filter((t) => t !== '--data' && t !== '--deep').join(' ');
Steps of Reproduction ✅
1. In the TUI or CLI, run the `/research` command with a URL that legitimately contains
the substring `--deep` or `--data` as part of the URL, for example:

   `/research https://example.test/search?q=--deep&x=1 --data`.

   This flows into the `ResearchCommand` implementation at
   `src/commands/research-command.ts:8` (`execute(args: string)`).

2. The command framework (via `BaseCommand`) invokes `ResearchCommand.execute()` with
`args` equal to `https://example.test/search?q=--deep&x=1 --data` (verified from the
signature and usage at `src/commands/research-command.ts:8-11`).

3. Inside `execute` at `src/commands/research-command.ts:9-11`, the following happens:

   - `includeData = args.includes('--data')` becomes `true` because the string ends with
   `--data`.

   - `enableDeep = args.includes('--deep')` becomes `true` because the query parameter
   value is `--deep`.

   - `target = args.replace('--data', '').replace('--deep', '').trim()` produces
   `https://example.test/search?q=&x=1`, because both occurrences of the substrings
   `--data` and `--deep` anywhere in the string are stripped, including the query
   parameter value.

4. With this mangled URL, the navigation call
`this.explorBot.agentNavigator().visit(target)` at
`src/commands/research-command.ts:13-15` is executed using
`https://example.test/search?q=&x=1` instead of the user-specified
`https://example.test/search?q=--deep&x=1`, causing the navigator to open the wrong or an
unintended page.

5. After navigation, `const state =
this.explorBot.getExplorer().getStateManager().getCurrentState();` at
`src/commands/research-command.ts:17` retrieves the current page state (the wrong page)
via the underlying `getCurrentState()` implementation (see
`/tmp/pr-review/repo-clones/testomatio/explorbot/7fc8e06e315045d0eda04b721a873f36dd09b4cd/src/action.ts:336-338`),
and `agentResearcher().research(state, ...)` at `src/commands/research-command.ts:22-26`
then performs research on this unintended page, leading to incorrect research results for
the command the user actually entered.
Prompt for AI Agent 🤖
This is a comment left during a code review.

**Path:** src/commands/research-command.ts
**Line:** 9:11
**Comment:**
	*Logic Error: The current argument parsing removes the substrings '--data' and '--deep' from the entire args string, so if a URL itself contains these sequences (for example as query parameters), the URL will be mangled before navigation, causing the command to visit an unintended page or an invalid URL; instead, parse args into tokens and strip flags only when they are separate arguments.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
👍 | 👎

@codeant-ai
Copy link

codeant-ai bot commented Feb 10, 2026

CodeAnt AI finished reviewing your PR.

@DavertMik DavertMik merged commit c172923 into testomatio:main Feb 11, 2026
0 of 4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size:S This PR changes 10-29 lines, ignoring generated files

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants