PR #416 #1322
cameroncookecodeql
on: dynamic
Matrix: analyze
Annotations
6 warnings
|
type-text success snapshot contract silently removed:
src/snapshot-tests/suites/ui-automation-suite.ts#L228
The `type-text--success` fixture has been dropped and replaced with only error-path fixtures (`type-text--error-not-actionable`), removing end-to-end snapshot validation of the `type-text` success contract entirely. Per the skill guardrails, snapshot removals are contract changes that require explicit review.
|
|
Non-parse snapshot capture failures reported as `ACTION_FAILED` despite action succeeding:
src/mcp/tools/ui-automation/shared/post-action-snapshot.ts#L53
When `executeAxeCommand` or related infrastructure throws (but the UI action itself already completed), the `uiError.code` is set to `'ACTION_FAILED'`, contradicting the `warning` message which says "UI action succeeded". Agents or callers that branch on `uiError.code === 'ACTION_FAILED'` will incorrectly conclude the action itself failed and may retry it, causing duplicate taps, swipes, or text input.
|
|
`/statictext|text/` substring match shadows the `menu` role check:
src/mcp/tools/ui-automation/shared/runtime-snapshot.ts#L119
Any element whose joined role text contains `"text"` as a substring — including iOS `role_description` values like `"context menu item"` ("con**text** menu item") — is classified as `'text'` at line 119 before the `/menu/` check at line 127 is ever reached, producing wrong role assignment and incorrect action hints.
|
|
[ZKQ-EYK] `/statictext|text/` substring match shadows the `menu` role check (additional location):
src/mcp/tools/ui-automation/shared/runtime-snapshot.ts#L113
Any element whose joined role text contains `"text"` as a substring — including iOS `role_description` values like `"context menu item"` ("con**text** menu item") — is classified as `'text'` at line 119 before the `/menu/` check at line 127 is ever reached, producing wrong role assignment and incorrect action hints.
|
|
Error code `ACTION_FAILED` contradicts the message that the action succeeded:
src/mcp/tools/ui-automation/shared/post-action-snapshot.ts#L56
When snapshot capture fails (not a parse failure), `uiError.code` is set to `'ACTION_FAILED'`, but the message explicitly says "UI action succeeded" — an agent keying off the error code may incorrectly retry the action instead of refreshing with `snapshot_ui`.
|
|
resolveElementRef duplicates the missing/expired lookup logic already in getRuntimeSnapshotLookup:
src/mcp/tools/ui-automation/shared/snapshot-ui-state.ts#L87
Delegate to `getRuntimeSnapshotLookup` to eliminate the duplicated Map access, null guard, expiry check, and `runtimeSnapshots.delete` call — both paths must be kept in sync by hand otherwise.
|