mirror of
https://github.com/proffesor-for-testing/agentic-qe.git
synced 2026-09-19 08:45:47 +08:00
Dragan Spiridonov
3eb9ccc461
M1 visual-diff threshold: documented "max difference fraction" convention matching Playwright maxDiffPixelRatio (was inconsistent in docs/code). M2 fixture server bind: default to 127.0.0.1 instead of 0.0.0.0; QE_BROWSER_FIXTURE_HOST=0.0.0.0 opt-in for explicit external access. Codespaces auto-forwards 0.0.0.0 ports — this was an unintentional open server every time the eval ran. M3 path-traversal guard: replaced startsWith() with path.relative() + '..'/absolute check. The old guard false-passed sibling-prefix dirs (/foo vs /foo2) and was fragile on Windows mixed separators. M4 ANSI escape injection: added sanitizeSnippet() that strips C0 controls (0x00-0x1F except \t\n) and DEL (0x7F) from every check-injection finding snippet. Prevents `cat findings.json` from triggering terminal control sequences embedded in malicious page content. M5 parseArgs --key=value: split on first '=' so --threshold=0.05 works alongside --threshold 0.05. Only the first '=' is split so URL/base64 values survive intact. M6 batch.js pre-validation: added validateAllSteps() that walks every step's required fields BEFORE the first vibium call. Step 17 typo now aborts before steps 1-16 execute their side effects. M7 intent-score bare-x regex: anchored \bx\b in close_dialog scorer so "fix", "exit", "extra", "sixteen" no longer match. Unicode × and ✕ unchanged. M8 check-injection --exclude-selector: new flag drops subtrees from the scan. Page text is read from a CLONE of <body> with matching elements removed — live page unchanged. Lets docs sites scan their own pages without self-flagging documentation about prompt injection. M9 09-assets vibium catch: wrapped raw error with actionable recovery guidance (`npm install -g vibium`, then re-run `aqe init`). Hidden bug found and fixed during M2/M3 testing: fixtures/serve-skills.js existed but had never been run because the repo root is ESM and the file uses CommonJS require(). Added scoped fixtures/package.json with "type": "commonjs" matching the existing scripts/package.json pattern. Tests: 86 unit tests across 7 files (was 50). All pass. Smoke test: 9/9 still passing against real Vibium v26.3.18. Mirrored .claude/skills/qe-browser → assets/skills/qe-browser. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>