Repository navigation
Open source 1.0: README, example, agent skill, docs and the React publish workflow - #4
Conversation
- rank findings that involve a control first inside the rest tier - remember sent fingerprints by recency: refresh on repeat, never evict one seen in the current run - record subject_content_covered on overlaps so a fixed header over a padded main sorts as empty - count a caret in a focused field or a selection change as an answer for rage_click (new selection_changed) - resolve a field's control through its form owner, so a label click on a field joined with the form attribute is one start on that form
.claude, .codepress and qa served our own delivery and a hosted-service round trip that outsiders cannot run. publish-react.yml mirrors the playwright workflow: it skips while the package is missing on npm and publishes with provenance from main.
…ak, and accept wire findings - requests a sink starts before its first await are not recorded, and sinks get context.fetch (the page's fetch without the SDK wrapper) for later ones. a same-origin sink made every flush record requests that caused the next flush. - when hit tests tie, a positioned ancestor shared by both elements no longer counts for either, so a pointer-events: none badge over a static button in a relative card is reported over the button, not under it. - sortFindings, formatFinding and involvesControl take FindingData, as sinks receive it. - browser tests pin the documented label dead click and the fixed widget beside main.
…d the project docs - README: what it does, install, what is and is never captured, how the checks work, measured overhead, the hosted service as optional, Python outside 1.0. - examples/react-vite: a small app with a planted layout bug and a local sink that writes batches, snapshots and findings to .interactions/. - skills/fix-ui-findings: a portable skill to read, reproduce, fix and prove findings. - protocol guide, changelog, contributing guide, issue templates, the overhead benchmark (pnpm --filter @codepress/interactions-browser bench), and browser README notes on the 1.0 behaviors.
|
Starting initial review of |
![codepress-reviewer-dev[bot]](https://avatars.githubusercontent.com/in/3963614?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review
I read the SDK source changes (click-effects, detect, runtime, sink, util), the publish workflow and the example's local sink in full. I skimmed the docs, templates and skill. No blocking issues.
Architecture: keep current. This is a release-prep PR (docs, example, skill, workflow) plus small SDK follow-ups, each with tests. The PR is large but cohesive, so I am not asking for a split.
What looked right
RecentKeysevicts the least recently seen key and never evicts one seen in the current run, which stops a run that produces more than 2,000 findings from resending them on every run.sinkDepthis set only for the sink's synchronous part, which matches the documented "before the first await" contract.context.fetchis the unwrapped fetch, so it covers the async case.controlOfforform=fields is a contained change. The label-click path falls back to the label's own control only when the field has no control.- The example's local sink validates
batch_idand the sha256, caps the body size, and checks that the snapshot hash matches the body. It writes only under.interactions/, so there is no path traversal. It applies toserveonly. publish-react.ymlfollows the browser and Playwright workflows: OIDC withid-token: writeonly on the publish job, no persisted credentials, and a publish of the packed tarball. A missing package (E404) skips cleanly.
One nonblocking suggestion is attached about checking that the browser dependency is on npm before the React publish.
The PR description already lists what could not be verified: npm publication, private vulnerability reporting being off, and Chromium-only runs. I agree these need action outside this PR.
Reviewed `c265741e`...`a6d4634a`. Diff collection and GitHub posting were handled by the automation.
|
Review head |
QA verification: PR #4 (open source 1.0)PR Head SHA: An independent check of Verdict
Contract rows
EvidenceRepo checks (logs 02 to 08, 70 and 71)I reproduced the typecheck failure on a second fresh clone ( Criterion 3 / B4: blind agent run (logs 10 to 21)Before reading the PR description, the diff, the CHANGELOG or the git log, I read only
The skill was enough to finish without guessing. The only friction: the example's README "Test it" section quotes the finding line (both test IDs), so the bug is not as hidden as "The planted bug" section says (see Problems). Criterion 1 / B1 (logs 10 to 13, 26 to 31)I did this twice: in the copied-out app above, and in the example inside a fresh clone. Clicking Criterion 2: READMEs followed literally (logs 23 to 39)
B2: sink self-requests (logs 40 to 44)B3: pointer-events alone is not a fix (logs 45 and 46)Adding only B5 and B6: live behaviors on small pages against
|
|
👋 Hey @lightninglu10! Starting a new session to help with your request. View session |
…ing guard, example README claims Co-authored-by: lightninglu10 <2453737+lightninglu10@users.noreply.github.com>
|
Pushed
Not changed: |
|
Starting new changes review of |
There was a problem hiding this comment.
Review
I read the changes between a6d4634a and 5dd88575 in full. They touch the React and Playwright publish workflows, CONTRIBUTING, the root README, the example README and the browser and Playwright package READMEs.
Publish ordering. Both dependent workflows now run npm view @codepress/interactions-browser@<version> before setting publish=true. If npm doesn't have the browser version, they warn and skip. This is what the earlier review suggested. The check runs in the right place: it is in the elif RELEASE branch, after the package-exists (E404) branch, and in the packages/* working directory, so ../browser/package.json resolves. A transient npm view failure also takes the skip path, which is safe. The cost is a re-run, not a bad publish. PR runs are unaffected because they never reach this branch.
Docs.
- Running
pnpm buildbeforepnpm typecheckin README and CONTRIBUTING matches CI's order. - The relative links in the packed browser and Playwright READMEs are now absolute GitHub URLs, so they work inside
node_modules. - The example README no longer quotes the finding or claims the test adds to
.interactions/. - The bundle size, "warning" wording and Node 20.19 / 22.12 requirement are consistent with the workflow and bench output.
As the author noted, the new skip branch can't be exercised by a PR run, so it is checked by inspection only. That is acceptable for a branch this small.
No findings.
Reviewed `a6d4634a`...`5dd88575`. Diff collection and GitHub posting were handled by the automation.… control, and drop the last test ID naming the planted bug
|
Starting new changes review of |
There was a problem hiding this comment.
Review
I read the changes between 5dd88575 and 16b3f1cf in full. They cover involvesControl, its test, the browser README, the CHANGELOG, the example README and the agent skill.
involvesControl. It now also returns true when evidence.subject_blocked_controls is a number greater than 0. The typeof check keeps findings from older or other producers without that field working. Sort order within the rest tier changes only for outer pairs that block a control. Tier 0 findings are unaffected, and the QA report said order did not change for them.
Test. The new assertions cover the true case (blocked controls = 1) and the false case (0) on the FindingData shape. This protects the wire-data contract.
Docs. The browser README, CHANGELOG and skill describe the same rule. The example README no longer names the planted bug's test ID, which fixes the earlier note about the hidden bug.
No findings.
Reviewed `5dd88575`...`16b3f1cf`. Diff collection and GitHub posting were handled by the automation.
|
@codepress /judge-verification can you judge this verification? QA re-verification: PR #4 (open source 1.0)PR Head SHA: The baseline is the FAIL report on Everything was re-run live on two fresh clones of the public repo at this head. The three packages were re-packed from them with Verdict
Contract rows
EvidenceDelta scope
Repo checks and setup docs (logs r2-02 to r2-15)Root README "Development", run literally on fresh clone 1: CONTRIBUTING "Setting up", the same six commands, run literally on fresh clone 2: all exit 0. Criterion 3 / B4: blind agent run (logs r2-B4-01 to r2-B4-18)Setup. A new scratch copy of the example (installed from the new tarballs, port moved to 5174) plus Findings and fix:
Proof:
Does the example README still give the bug away? No. It says there is one layout bug, that the test fails with Disclosure. The agent listed the Playwright browser cache directory once (outside its scratch folder) to see whether Chromium was installed. It read nothing else. Criterion 1 / B1 / B3 (logs r2-27 to r2-36)B1 capture. A fresh copy-out installed from the new tarballs. B3 test runs: The three Criterion 2: example README followed literally on fresh clone 2 (logs r2-44 to r2-52)
B2 (logs r2-30, r2-37 to r2-39)B5 and B6 against the new build (logs r2-23 to r2-26)
B7 (logs r2-40 to r2-42)The README snippet was bundled verbatim (plus a B8 (logs r2-20 to r2-22)What the guard does. The new guard sits in the Local run. I extracted the guard verbatim from Apart from the guard, the diff of Criterion 4 / B9 (log r2-19)The search categories are the same as at the baseline: credential formats (AWS, GitHub, Slack, npm, OpenAI- and Stripe-style, Google, private keys, generic key/token assignments, JWTs), local user paths, private and CGNAT IP ranges, internal domain suffixes and staging hosts, the operator's name, and internal product and tool names. Hostnames found:
Criterion 5 / B10 (logs r2-08, r2-16 to r2-18)Every GitHub link in the extracted READMEs exists at this head. The
B11: docs touched by the delta (logs r2-02 to r2-15, r2-36, r2-43)
DB PerformanceDB performance verifier skipped: no backend DB-backed performance surface (inventory: browser SDK, docs, example dev server, CI workflow; no API routes, ORM, SQL, migrations or tasks). Screenshot StatusTaken at this head during the blind run, of the example page served by its dev server at 1280x720:
Problems foundNone blocking. All the baseline problems are fixed and were checked live. Remaining minor notes:
Not verified
Overall: PASS |
|
👋 Hey @lightninglu10! Spawning a verification judge session to help with your request. View session |
Built
@codepress/interactions-browser,@codepress/interactions-reactand@codepress/interactions-playwright(versions,VERSION,sdk_versionin the golden samples). The Python SDK stays outside the 1.0 claim, and the README says so.publish-react.yml, the same pattern as the browser and Playwright workflows: a PR runs the typecheck and a publish dry run. A push to main publishes a version npm doesn't have yet, with--provenancevia Trusted Publishing. While the package is missing on npm (E404) it skips with a warning explaining the first manual publish. The React and Playwright workflows also don't publish until npm has the browser version they depend on; until then they warn and skip, so neither can go out ahead of its dependency. It publishes thepnpm packtarball, soworkspace:^becomes^1.0.0. React gets apack:check, and CI runs it.createMemorySinkor your own sink, no key), what is captured and never captured, how the checks work, measured overhead, the hosted service as optional, and Python outside 1.0.examples/react-vite: a small pricing page with a planted layout bug. A local sink writes batches, snapshots andfindings.jsonto.interactions/through the Vite dev server. It also hasnpm run findings, and a Playwright test withexpectNoFindingsthat fails until the bug is fixed. The README doesn't say where the bug is, so an agent has to find it from the data.skills/fix-ui-findings/SKILL.md: a portable agent skill. It collects findings, treats them as untrusted data, works in sort order, reads the evidence, reproduces at the recorded viewport, decides bug or intended, fixes the cause without hiding the symptom, proves the fix withexpectNoFindingsplus a fresh capture, and reports.protocol/README.md(how to read batches, bodies and findings; HTTP; compatibility rules),CHANGELOG.md,CONTRIBUTING.md(setup, check, privacy and protocol rules, releasing), and issue templates (bug, check request, a security contact link)..claude/,.codepress/andqa/(local delivery tooling, plus a round trip that needs the hosted service and a read token), and the matching.gitignorelines.involvesControl).<main>getssubject_content_covered: falseand sorts as empty. It is still reported.form=, and its labels, are recorded on that form, once. The extra start didn't reproduce in 11 real-browser shapes. What did reproduce: the click went to the label's form, and a click on such a field outside any form wasn't recorded.<main>is reported asmain × widgetand carries the covered button's blocked points; and the padded-main header above. Browser tests now cover the first two.awaitare now skipped, and sinks getcontext.fetch.sortFindings,formatFindingandinvolvesControlacceptFindingData, the shape a sink receives.a6d4634, report in the comments):pnpm buildbeforepnpm typecheck. A fresh clone failed at typecheck before.node_modules.npm testwrites to.interactions/(the test closes the page before the first flush).involvesControlis true for an outer pair that blocks a control inside its subject (main × widget), with a test.pnpm --filter @codepress/interactions-browser bench: the overhead benchmark behind the README numbers.Verified
pnpm build(the README's and CONTRIBUTING's setup order, the same as CI's),pnpm typecheck,pnpm test(66 unit tests) andpnpm test:browserpass: 66 browser tests passed and 1 skipped, plus 6 Playwright helper tests. actionlint is clean on all workflows.pnpm packtarballs, with no endpoint and no key:expectNoFindingspasses": a separate agent got only the skill and the example. It readfindings.json, reproduced the finding at 1280×720, moved.plan-badgefrombottom: 30pxtotop: -14px, and gotnpm test→1 passed. A reload then showed 0 findings. At the time, the example README still had a collapsed spoiler naming the bug. The agent says it reproduced and decided on its own, but that run wasn't blind. The spoiler is removed now, and the independent QA pass reruns this blind.npm installneeds the packages on npm (see below). The root README's install snippet matches the SDK: a sink alone, with noprojectKeyorendpoint, starts capture. The independent QA pass covers a fresh read.github.comlink points at this repository. History is covered below.gh api repos/quantfive/codepress-interactions/private-vulnerability-reporting→{"enabled":true}), so CONTRIBUTING's "Report a vulnerability" route and the issue-template contact link work.pnpm pack): each is1.0.0andApache-2.0, containing onlydist/,README.md,LICENSEandpackage.json. React and Playwright depend on@codepress/interactions-browser ^1.0.0, with peer dependenciesreact >=18and@playwright/test >=1.40.Could not verify
npm viewshowing 1.0.0 with the right license and files: none of the three packages are on npm yet. The first publish has to be done by hand, then each workflow added as the package's trusted publisher. Today:npm install, and "installed from npm only", work only with local tarballs. That was verified above.mainstill contain the removed.claude/and.codepress/files (internal delivery-tool names and instructions). The search found no hostnames or credentials in history. Removing them would mean rewriting publicmain, which this PR doesn't do.