@aarwitz/tapp 0.17.14 → 0.17.17

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "tapp",
   "description": "Give Claude hands and eyes on iOS, Android, and web apps, with exploration, replayable flows, evidence, and deterministic CI gates.",
-  "version": "0.17.14",
+  "version": "0.17.17",
   "author": {
     "name": "Aaron Horowitz",
     "url": "https://github.com/aarwitz"
@@ -24,7 +24,7 @@
       "command": "npx",
       "args": [
         "-y",
-        "@aarwitz/tapp@0.17.14",
+        "@aarwitz/tapp@0.17.17",
         "mcp"
       ],
       "cwd": "${CLAUDE_PROJECT_DIR}"

package/Harness/OCQAHarnessUITests/ExplorerTests.swift

@@ -231,6 +231,11 @@ class ExplorerTests: XCTestCase {
         for query in queries {
             let element = query[identifier]
             if element.exists && element.isHittable {
+                if !waitForEnabled(element) {
+                    print("OCQA_ACTION:{\"type\":\"tap\",\"identifier\":\"\(identifier)\",\"status\":\"disabled\"}")
+                    Thread.sleep(forTimeInterval: 0.5)
+                    return
+                }
                 element.tap()
                 print("OCQA_ACTION:{\"type\":\"tap\",\"identifier\":\"\(identifier)\"}")
                 Thread.sleep(forTimeInterval: 0.5)
@@ -240,8 +245,12 @@ class ExplorerTests: XCTestCase {
         let predicate = NSPredicate(format: "label == %@", identifier)
         let match = app.descendants(matching: .any).matching(predicate).firstMatch
         if match.exists && match.isHittable {
-            match.tap()
-            print("OCQA_ACTION:{\"type\":\"tap\",\"label\":\"\(identifier)\"}")
+            if !waitForEnabled(match) {
+                print("OCQA_ACTION:{\"type\":\"tap\",\"label\":\"\(identifier)\",\"status\":\"disabled\"}")
+            } else {
+                match.tap()
+                print("OCQA_ACTION:{\"type\":\"tap\",\"label\":\"\(identifier)\"}")
+            }
         } else {
             print("OCQA_ACTION:{\"type\":\"tap\",\"identifier\":\"\(identifier)\",\"status\":\"not_found\"}")
         }
@@ -382,7 +391,32 @@ class ExplorerTests: XCTestCase {
                 }
             case "tap":
                 if let id = cmd["id"] as? String, !id.isEmpty {
+                    let beforeElements = readUITree(app)
+                    let beforeHash = computeHash(beforeElements)
+                    let beforeTitle = detectTitle(beforeElements) ?? "Unknown"
                     status = sessionTapById(id)
+                    if status == "ok" {
+                        waitForUIStability(timeout: 1.5)
+                        let afterElements = readUITree(app)
+                        // Nothing moved and the target is still sitting there: the tap landed on
+                        // something that is not the control the caller meant — classically a system
+                        // sheet ("Save Password?") whose buttons belong to SpringBoard, not the app
+                        // (field issue #6: three "ok" taps while the sheet stayed up).
+                        let unchanged = computeHash(afterElements) == beforeHash
+                            && (detectTitle(afterElements) ?? "Unknown") == beforeTitle
+                        if unchanged && elementPresent(id) {
+                            if tapSystemSheetButton(id) {
+                                waitForUIStability(timeout: 1.5)
+                                let recovered = readUITree(app)
+                                status = computeHash(recovered) == beforeHash ? "no_effect" : "ok"
+                            } else {
+                                status = "no_effect"
+                            }
+                            if status == "no_effect" {
+                                loginDetail = "‘\(id)’ is still on screen and nothing changed — the tap did not reach the control you meant; if this is a system sheet, tap by {x, y}"
+                            }
+                        }
+                    }
                 } else if let x = cmd["x"] as? Double, let y = cmd["y"] as? Double {
                     app.coordinate(withNormalizedOffset: .zero).withOffset(CGVector(dx: x, dy: y)).tap()
                 } else { status = "bad_args" }
@@ -394,7 +428,8 @@ class ExplorerTests: XCTestCase {
                 case "down": app.swipeDown(); case "left": app.swipeLeft(); case "right": app.swipeRight(); default: app.swipeUp()
                 }
             case "back":
-                sessionBack()
+                status = sessionBack()
+                if status == "no_effect" { loginDetail = "the screen did not change — there may be no back destination here, or the Back control belongs to a different navigation stack (try tap {id: \"Back\"})" }
             case "wait":
                 let target = (cmd["id"] as? String).flatMap { $0.isEmpty ? nil : $0 } ?? (cmd["text"] as? String ?? "")
                 let waitMs = (cmd["timeoutMs"] as? Int) ?? 5000
@@ -434,10 +469,27 @@ class ExplorerTests: XCTestCase {
     /// Returns "ok" if tapped, "not_hittable" if the element exists but couldn't be tapped (disabled,
     /// or covered by the keyboard even after dismissing it), or "not_found" if nothing matched. The
     /// distinction tells the caller whether to enter valid input first vs. that the target is absent.
+    /// A disabled control is still `exists` and still `isHittable`, so tapping one
+    /// succeeds and reports a normal action while nothing happens: the step passes and
+    /// the flow carries on against a screen that never advanced. Wait before calling it
+    /// disabled — a button guarded by form validation becomes enabled a moment after the
+    /// last field is filled, and failing on that would be its own kind of wrong answer.
+    private func waitForEnabled(_ element: XCUIElement, timeout: TimeInterval = 3) -> Bool {
+        if element.isEnabled { return true }
+        let deadline = Date().addingTimeInterval(timeout)
+        while Date() < deadline {
+            if element.isEnabled { return true }
+            Thread.sleep(forTimeInterval: 0.15)
+        }
+        return false
+    }
+
     private func sessionTapById(_ identifier: String) -> String {
         var existedButNotHittable = false
+        var existedButDisabled = false
         func tryTap(_ el: XCUIElement) -> Bool {
             guard el.exists else { return false }
+            if !waitForEnabled(el) { existedButDisabled = true; return false }
             if el.isHittable { el.tap(); return true }
             // Often covered by the keyboard (a submit button below filled fields) — dismiss + retry,
             // like Playwright auto-scrolls a target into view.
@@ -472,6 +524,9 @@ class ExplorerTests: XCTestCase {
         // label) — "Password" must reach the secureTextField or a later `type` lands in whatever
         // field still has keyboard focus.
         if let field = resolveFieldByHint(identifier), tryTap(field) { return "ok" }
+        // "disabled" outranks the others: the control was found and refused to act, which
+        // is a different answer from "it is not here" and needs a different fix.
+        if existedButDisabled { return "disabled" }
         return existedButNotHittable ? "not_hittable" : "not_found"
     }
 
@@ -721,14 +776,104 @@ class ExplorerTests: XCTestCase {
         return ("still_on_login", errTexts.prefix(2).joined(separator: " | "))
     }
 
-    private func sessionBack() {
-        let backButton = app.navigationBars.buttons.firstMatch
-        if backButton.exists && backButton.isHittable {
-            backButton.tap()
+    /// Go back and PROVE it: a caller that believes a no-op navigated keeps driving the wrong
+    /// screen (field issue #10 — four "ok" backs in a row while the title never changed, then
+    /// every following tap failed `not_hittable` because the pushed screen was still on top).
+    /// Returns "ok" only when the screen actually changed; "no_effect" otherwise.
+    /// A surface the SYSTEM owns even though it renders inside the app process: the share sheet
+    /// (`UIActivityContentView`) and the app extensions it hosts, the photo picker's unavailable
+    /// view, and other remote-view hosts. Their content belongs to Apple or a third-party
+    /// extension, so an empty or unreadable accessibility tree there says nothing about the app
+    /// under test — scoring it produced this app's only "high" finding (field issue #4).
+    private func systemSurfaceName(_ elements: [SimpleElement], title: String) -> String? {
+        let markers = ["UIActivityContentView", "ActivityListView", "PUPickerUnavailableView",
+                       "RemoteViewBridge", "_UIRemoteView", "UIDocumentPickerViewController",
+                       "SFSafariView", "UIActivityGroupView"]
+        for element in elements {
+            let signature = element.type + " " + element.identifier + " " + element.label
+            if let hit = markers.first(where: { signature.contains($0) }) { return hit }
+        }
+        // The share sheet hands off to an extension whose whole UI is out of process; the title
+        // is then the extension's name over a tree the app cannot see.
+        if title == "UIActivityContentView" { return "UIActivityContentView" }
+        return nil
+    }
+
+    /// Leave a system-owned surface. A share sheet is a presented sheet, not a pushed screen:
+    /// `back` does nothing and a mid-screen swipe scrolls its content instead of dismissing it.
+    /// Try its real affordances in order, and say honestly whether we actually got out.
+    private func dismissSystemSurface(currentTitle: String) -> Bool {
+        let stillThere = { () -> Bool in
+            let elements = self.readUITree(self.app)
+            return self.systemSurfaceName(elements, title: self.detectTitle(elements) ?? "Unknown") != nil
+        }
+        // 1. An explicit dismissal control, in the app and in SpringBoard (extensions live there).
+        for label in ["Close", "Cancel", "Done", "Dismiss"] {
+            for candidate in [app.buttons[label], XCUIApplication(bundleIdentifier: "com.apple.springboard").buttons[label]] {
+                if candidate.exists && candidate.isHittable {
+                    candidate.tap()
+                    waitForUIStability(timeout: 1.5)
+                    if !stillThere() { return true }
+                }
+            }
+        }
+        // 2. Drag the sheet down by its top edge (the grabber), not from the middle.
+        app.coordinate(withNormalizedOffset: CGVector(dx: 0.5, dy: 0.35))
+            .press(forDuration: 0.1, thenDragTo: app.coordinate(withNormalizedOffset: CGVector(dx: 0.5, dy: 0.98)))
+        waitForUIStability(timeout: 1.5)
+        if !stillThere() { return true }
+        // 3. Tap the dimmed backdrop above the sheet.
+        app.coordinate(withNormalizedOffset: CGVector(dx: 0.5, dy: 0.06)).tap()
+        waitForUIStability(timeout: 1.5)
+        if !stillThere() { return true }
+        // 4. Last resort: relaunch. The surface belongs to iOS; the app is still healthy.
+        app.terminate()
+        Thread.sleep(forTimeInterval: 0.8)
+        app.launch()
+        _ = app.wait(for: .runningForeground, timeout: 10)
+        waitForUIStability(timeout: 2.0)
+        return !stillThere()
+    }
+
+    /// iOS renders "Save Password?", location prompts and similar sheets in SpringBoard, not in
+    /// the app under test, so an app-scoped query silently matches something else. Tap the real
+    /// button when a system sheet is up (field issue #6).
+    private func tapSystemSheetButton(_ identifier: String) -> Bool {
+        let springboard = XCUIApplication(bundleIdentifier: "com.apple.springboard")
+        for query in [springboard.buttons, springboard.staticTexts] {
+            let element = query[identifier]
+            if element.exists && element.isHittable { element.tap(); return true }
+        }
+        let matches = springboard.descendants(matching: .any)
+            .matching(NSPredicate(format: "label ==[c] %@", identifier)).allElementsBoundByIndex
+        if let match = matches.first(where: { $0.exists && $0.isHittable }) { match.tap(); return true }
+        return false
+    }
+
+    private func sessionBack() -> String {
+        let beforeElements = readUITree(app)
+        let beforeTitle = detectTitle(beforeElements) ?? "Unknown"
+        let beforeHash = computeHash(beforeElements)
+
+        // A NavigationStack inside a sheet has its own navigation bar; `navigationBars.firstMatch`
+        // can resolve the wrong one, so prefer an explicitly labelled, hittable Back control.
+        let labelled = app.buttons.matching(NSPredicate(format: "label ==[c] %@", "Back")).allElementsBoundByIndex
+        if let back = labelled.first(where: { $0.exists && $0.isHittable }) {
+            back.tap()
         } else {
-            app.coordinate(withNormalizedOffset: CGVector(dx: 0, dy: 0.5))
-                .press(forDuration: 0.05, thenDragTo: app.coordinate(withNormalizedOffset: CGVector(dx: 0.8, dy: 0.5)))
+            let backButton = app.navigationBars.buttons.firstMatch
+            if backButton.exists && backButton.isHittable {
+                backButton.tap()
+            } else {
+                app.coordinate(withNormalizedOffset: CGVector(dx: 0, dy: 0.5))
+                    .press(forDuration: 0.05, thenDragTo: app.coordinate(withNormalizedOffset: CGVector(dx: 0.8, dy: 0.5)))
+            }
         }
+        waitForUIStability(timeout: 1.5)
+        let afterElements = readUITree(app)
+        let afterTitle = detectTitle(afterElements) ?? "Unknown"
+        if afterTitle != beforeTitle || computeHash(afterElements) != beforeHash { return "ok" }
+        return "no_effect"
     }
 
     /// Replays an explicit, config-driven login flow (OCQA_LOGIN_STEPS) before exploration — for the
@@ -827,8 +972,19 @@ class ExplorerTests: XCTestCase {
 
             switch action {
             case "tap":
-                status = sessionTapById(target) == "ok" ? "pass" : "fail"
-                if status == "fail" { detail = "could not tap ‘\(target)’" }
+                let tapStatus = sessionTapById(target)
+                status = tapStatus == "ok" ? "pass" : "fail"
+                if status == "fail" {
+                    // Name which of the three it was. "Disabled" in particular sends the
+                    // author somewhere completely different from "not found": the control
+                    // is right there, and something upstream in the flow has not satisfied
+                    // whatever guards it.
+                    switch tapStatus {
+                    case "disabled":     detail = "‘\(target)’ is on screen but disabled — an earlier step has not met whatever enables it"
+                    case "not_hittable": detail = "‘\(target)’ exists but could not be reached, even after dismissing the keyboard and scrolling"
+                    default:             detail = "could not find ‘\(target)’ on this screen"
+                    }
+                }
             case "type":
                 status = sessionType(value, id: target.isEmpty ? nil : target) ? "pass" : "fail"
                 if status == "fail" { detail = lastTypeFailure.isEmpty ? "no field ‘\(target)’ to type into" : lastTypeFailure }
@@ -893,6 +1049,20 @@ class ExplorerTests: XCTestCase {
             print("OCQA_FLOW_STEP:{\"index\":\(idx),\"action\":\"\(escapeJSON(action))\",\"target\":\"\(escapeJSON(target.isEmpty ? value : target))\",\"assert\":\(isAssert),\"status\":\"\(status)\",\"detail\":\"\(escapeJSON(detail))\"\(taskEvidence)\(contractEvidence)}")
             if status == "fail" {
                 failed += 1
+                // Web and Android flows write flow-failure-N.png next to the log; iOS buried the
+                // evidence in the .xcresult, so seeing the failing screen needed a second run
+                // (field issue #8). Write the same file, and keep the XCTest attachment too.
+                let failureShot = app.screenshot()
+                let failureAttachment = XCTAttachment(screenshot: failureShot)
+                failureAttachment.name = "flow_failure_\(idx)"
+                failureAttachment.lifetime = .keepAlways
+                add(failureAttachment)
+                let evidenceDir = resolve("OCQA_FLOW_EVIDENCE_DIR")
+                if !evidenceDir.isEmpty {
+                    let destination = URL(fileURLWithPath: evidenceDir).appendingPathComponent("flow-failure-\(idx).png")
+                    try? FileManager.default.createDirectory(at: URL(fileURLWithPath: evidenceDir), withIntermediateDirectories: true)
+                    try? failureShot.pngRepresentation.write(to: destination)
+                }
                 // A failed step surfaces as a finding, with the same shape QA findings use.
                 let screen = detectTitle(readUITree(app)) ?? "Unknown"
                 print("OCQA_ISSUE:{\"type\":\"flow_assertion_failed\",\"severity\":\"high\",\"title\":\"\(escapeJSON("Step \(idx) (\(action)) failed: \(detail)"))\",\"screen\":\"\(escapeJSON(screen))\",\"step\":\(idx)}")
@@ -1393,6 +1563,7 @@ class ExplorerTests: XCTestCase {
         // defect (field issue #9: "Personal Info ↔ back" filed as a finding). Remember when we
         // last navigated backwards so the loop detector can tell the two apart.
         var lastExplorerBackStep = -99
+        var systemSurfaceEscapes = 0
         while actionCount < maxActions {
             // Subtract time spent paused for interactive input so human typing never eats the budget.
             if Date().timeIntervalSince(startTime) - totalWaitSeconds > timeoutSeconds {
@@ -1740,6 +1911,31 @@ class ExplorerTests: XCTestCase {
                 )
             }
 
+            // ---- System-owned surface: catalogue, back out, never score ----
+            // The share sheet and the extensions it hosts run inside the app process, so the
+            // left-app detector (which watches the frontmost process) cannot see them. Their
+            // tree is Apple's or a third party's, not the app's: report the handoff as an
+            // observation and leave, instead of filing blank/limited findings against it.
+            if let systemSurface = systemSurfaceName(elements, title: titleStr) {
+                let surfaceKey = "system_surface:\(systemSurface)"
+                if !reportedIssueKeys.contains(surfaceKey) {
+                    reportedIssueKeys.insert(surfaceKey)
+                    print("OCQA_ACTION:{\"type\":\"system_surface\",\"target\":\"\(escapeJSON(systemSurface))\",\"screen\":\"\(escapedTitle)\",\"step\":\(actionCount),\"narrative\":\"\(escapeJSON("Reached \(systemSurface), a system-owned surface — its content belongs to iOS, not the app under test. Backing out."))\"}")
+                }
+                actionCount += 1
+                systemSurfaceEscapes += 1
+                let escaped = dismissSystemSurface(currentTitle: titleStr)
+                // Never let a surface we refuse to explore eat the whole budget: a share sheet
+                // that will not dismiss is a dead end for the run, not a reason to keep trying.
+                if !escaped && systemSurfaceEscapes >= 3 {
+                    print("OCQA_STATE:system_surface_unrecoverable screen=\(escapedTitle) step=\(actionCount)")
+                    explorationStopCause = "system-surface-unrecoverable"
+                    break
+                }
+                emitProgress(action: actionCount, maxActions: maxActions, states: visitedStates.count)
+                continue
+            }
+
             // Screenshot
             let screenshot = app.screenshot()
             let attachment = XCTAttachment(screenshot: screenshot)
@@ -4792,23 +4988,46 @@ class ExplorerTests: XCTestCase {
             } while Date() < deadline
             return focused()
         }
-        for attempt in 0..<3 {
+        // A field further down a form is usually UNDER the keyboard that the previous
+        // field opened, so every tap below lands on a key instead and three attempts
+        // report "never took keyboard focus" for a field that was simply unreachable.
+        // sessionTapById already dismisses and scrolls for taps; typing needs the same
+        // or no form taller than the keyboard can be filled at all.
+        func keyboardCovers(_ el: XCUIElement) -> Bool {
+            let keyboard = app.keyboards.firstMatch
+            guard keyboard.exists else { return false }
+            let f = el.frame, k = keyboard.frame
+            return f.intersects(k) || f.minY >= k.minY
+        }
+
+        for attempt in 0..<5 {
             switch attempt {
             case 0:
                 if element.isHittable { element.tap() } else { element.coordinate(withNormalizedOffset: CGVector(dx: 0.5, dy: 0.5)).tap() }
             case 1:
                 element.coordinate(withNormalizedOffset: CGVector(dx: 0.5, dy: 0.5)).tap()
-            default:
+            case 2:
                 // Frame may be stale by a few rows: tap just inside its top edge, which stays
                 // within the visible control when content shifted up.
                 element.coordinate(withNormalizedOffset: CGVector(dx: 0.35, dy: 0.2)).tap()
+            case 3:
+                // Get the keyboard out of the way and try where the field now sits.
+                dismissKeyboardIfPresent()
+                waitForAnimationsToSettle()
+                if element.isHittable { element.tap() } else { element.coordinate(withNormalizedOffset: CGVector(dx: 0.5, dy: 0.5)).tap() }
+            default:
+                // Still out of reach: bring it up the screen, then tap.
+                dismissKeyboardIfPresent()
+                app.swipeUp()
+                Thread.sleep(forTimeInterval: 0.25)
+                if element.isHittable { element.tap() } else { element.coordinate(withNormalizedOffset: CGVector(dx: 0.5, dy: 0.5)).tap() }
             }
             if settleUntilFocused() {
                 if attempt > 0 { print("OCQA_STATE:type_focus_recovered attempt=\(attempt + 1)") }
                 return true
             }
             let f = element.frame
-            print("OCQA_STATE:type_focus_miss attempt=\(attempt + 1) frame=\(Int(f.minX)),\(Int(f.minY)),\(Int(f.width))x\(Int(f.height)) keyboard=\(app.keyboards.count) focusedElsewhere=\(focusedField().map { fieldDesc($0) } ?? "none")")
+            print("OCQA_STATE:type_focus_miss attempt=\(attempt + 1) frame=\(Int(f.minX)),\(Int(f.minY)),\(Int(f.width))x\(Int(f.height)) keyboard=\(app.keyboards.count) covered=\(keyboardCovers(element)) focusedElsewhere=\(focusedField().map { fieldDesc($0) } ?? "none")")
         }
         return false
     }
@@ -4821,7 +5040,7 @@ class ExplorerTests: XCTestCase {
         lastTypeFailure = ""
         guard focusForTyping(element) else {
             let f = element.frame
-            lastTypeFailure = "‘\(fieldDesc(element))’ was found (frame \(Int(f.minX)),\(Int(f.minY)) \(Int(f.width))×\(Int(f.height))) but never took keyboard focus after 3 taps"
+            lastTypeFailure = "‘\(fieldDesc(element))’ was found (frame \(Int(f.minX)),\(Int(f.minY)) \(Int(f.width))×\(Int(f.height))) but never took keyboard focus, including after dismissing the keyboard and scrolling it into view"
                 + (app.keyboards.count == 0 ? " — no keyboard appeared" : "")
                 + (focusedField().map { " — focus is on ‘\(fieldDesc($0))’" } ?? "")
             print("OCQA_STATE:type_focus_failed detail=\(escapeJSON(lastTypeFailure))")

package/mcp-server/src/index.js

@@ -471,10 +471,26 @@ export async function prepareAndroidInteractiveTarget({ projectDir = process.cwd
   return { ...built, appId, selectedTarget:selected };
 }
 
-export async function installAppOnBootedSim(appPath, { cleanInstall = true } = {}) {
+// Said before a build overwrites whatever is on the simulator. The clean install
+// below wipes the old app's data with it, so a build someone deliberately
+// configured — pointed at a local server, a staging key, a test account —
+// disappears without being mentioned. Naming it is the difference between "my run
+// is slow" and "my run is now testing something else entirely". Passing a bundle
+// id instead of a project path uses what is installed and never builds.
+export function replacingInstalledBuildNotice(bundleId) {
+  const id = String(bundleId || "").trim();
+  if (!id) return "";
+  return `Replacing the installed build of ${id} (its data is wiped too). To use what is already installed instead of building, pass the bundle id: ${id}`;
+}
+
+export async function installAppOnBootedSim(appPath, { cleanInstall = true, onStatus = () => {} } = {}) {
   const bid = await runCommand("/usr/libexec/PlistBuddy", ["-c", "Print CFBundleIdentifier", path.join(appPath, "Info.plist")], { timeoutMs: 30_000 });
   const bundleId = (bid.stdout || "").trim();
   if (!bundleId) return { error: `Could not read CFBundleIdentifier from ${appPath}/Info.plist — is this a simulator .app build?` };
+  if (cleanInstall) {
+    const existing = await runCommand("xcrun", ["simctl", "get_app_container", "booted", bundleId, "app"], { timeoutMs: 15_000 });
+    if (existing.code === 0 && (existing.stdout || "").trim()) onStatus(replacingInstalledBuildNotice(bundleId));
+  }
   if (cleanInstall) {
     // Clean install: stale keychain items from a previous install leave apps half-signed-in
     // (Firebase Auth's "error accessing the keychain") — uninstall first for a fresh state.
@@ -496,7 +512,7 @@ export async function resolveAppTarget(input, { cwd = process.cwd(), onStatus =
     const sim = await ensureBootedSim({ autoBoot: true });
     if (sim.error) return { error: sim.error };
     onStatus(`Installing ${path.basename(appPath)}…`);
-    const inst = await installAppOnBootedSim(appPath);
+    const inst = await installAppOnBootedSim(appPath, { onStatus });
     if (inst.error) return inst;
     return {
       bundleId: inst.bundleId,
@@ -522,7 +538,7 @@ export async function resolveAppTarget(input, { cwd = process.cwd(), onStatus =
     const built = await buildAppForSim({ container, scheme, configuration });
     if (built.error) return built;
     onStatus(`Built ${path.basename(built.appPath)} (scheme ${built.scheme}) — installing…`);
-    const inst = await installAppOnBootedSim(built.appPath);
+    const inst = await installAppOnBootedSim(built.appPath, { onStatus });
     if (inst.error) return inst;
     return {
       bundleId: inst.bundleId,

package/mcp-server/src/web-explorer.js

@@ -139,6 +139,11 @@ function cssAttrEscape(value) {
 async function installWebListenerTracking(context) {
   await context.addInitScript(() => {
     const key = Symbol.for("tapp.clickListeners");
+    // Delegated handlers live on document/window, not on the control, so an
+    // element-only record says "nothing is listening" for a page where every
+    // button works. Keep their source text: it is the only way to tell which
+    // controls such a handler actually claims.
+    const delegatedKey = Symbol.for("tapp.delegatedClickHandlers");
     const add = EventTarget.prototype.addEventListener;
     const remove = EventTarget.prototype.removeEventListener;
     EventTarget.prototype.addEventListener = function tappTrackedAdd(type, listener, options) {
@@ -146,6 +151,11 @@ async function installWebListenerTracking(context) {
         if (!this[key]) Object.defineProperty(this, key, { value: new Set(), configurable: true });
         this[key].add(listener);
       }
+      if (type === "click" && listener && (this === document || this === window)) {
+        const target = this === window ? window : document;
+        if (!target[delegatedKey]) Object.defineProperty(target, delegatedKey, { value: new Set(), configurable: true });
+        try { target[delegatedKey].add(String(listener).slice(0, 4000)); } catch { /* exotic handler */ }
+      }
       return add.call(this, type, listener, options);
     };
     EventTarget.prototype.removeEventListener = function tappTrackedRemove(type, listener, options) {
@@ -1227,6 +1237,56 @@ export async function auditWebPage({ url, timeoutMs = NAV_TIMEOUT_MS, device = "
       };
       const name = (el) => (el.getAttribute("aria-label") || el.textContent || el.getAttribute("value") || "").replace(/\s+/g, " ").trim().slice(0, 80);
       const selectorFor = (el) => el.id ? `#${el.id}` : el.getAttribute("data-testid") ? `[data-testid="${el.getAttribute("data-testid")}"]` : el.tagName.toLowerCase();
+      // Some controls are wired in CSS, not JavaScript: a menu that opens while
+      // its trigger is hovered or focused has no listener to find, and calling
+      // it dead is wrong. Collect the selectors that some rule reacts to — the
+      // trigger side of any `X:hover Y` / `X:focus-within Y` rule whose
+      // declarations change whether Y can be seen. A rule that only restyles
+      // the trigger itself (`button:hover { background: … }`) is not behaviour
+      // and is ignored, which is why the descendant part must be present.
+      const REVEALS = /(^|;)\s*(display|visibility|opacity|height|max-height|transform|pointer-events|clip-path)\s*:/i;
+      const revealTriggers = [];
+      const collectTriggers = (rules) => {
+        for (const rule of rules || []) {
+          // A plain style rule also exposes .cssRules now that CSS nesting is
+          // supported — an empty list, which is truthy. Recursing on that and
+          // skipping the rule would walk straight past every selector there is.
+          if (rule.cssRules && rule.cssRules.length) collectTriggers(rule.cssRules);
+          const selector = rule.selectorText;
+          if (!selector || !REVEALS.test(rule.style?.cssText || "")) continue;
+          for (const part of selector.split(",")) {
+            const match = part.match(/^(.*?):(?:hover|focus-within|focus-visible|focus)\b(.+)$/);
+            if (!match) continue;
+            const trigger = match[1].trim();
+            if (trigger && match[2].trim()) revealTriggers.push(trigger);
+          }
+        }
+      };
+      for (const sheet of document.styleSheets) {
+        try { collectTriggers(sheet.cssRules); } catch { /* cross-origin sheet */ }
+      }
+      const opensSomethingOnHoverOrFocus = (el) => revealTriggers.some((trigger) => {
+        try { return el.matches(trigger) || Boolean(el.closest(trigger)); } catch { return false; }
+      });
+
+      // What a delegated handler on document/window claims. The dominant idiom is
+      // `e.target.closest(SELECTOR)` / `.matches(SELECTOR)`, so pull those
+      // selectors out and test controls against them. A handler we cannot read
+      // this way (an outside-click closer, say) claims nothing and is ignored,
+      // rather than excusing every unwired control on the page.
+      const delegatedSelectors = [];
+      for (const source of [
+        ...(document[Symbol.for("tapp.delegatedClickHandlers")] || []),
+        ...(window[Symbol.for("tapp.delegatedClickHandlers")] || []),
+      ]) {
+        for (const m of String(source).matchAll(/\.(?:closest|matches)\(\s*["'`]([^"'`]+)["'`]/g)) {
+          delegatedSelectors.push(m[1]);
+        }
+      }
+      const claimedByDelegate = (el) => delegatedSelectors.some((selector) => {
+        try { return el.matches(selector) || Boolean(el.closest(selector)); } catch { return false; }
+      });
+
       const dead = [];
       for (const el of document.querySelectorAll("a[href], button, [role=button], [aria-controls]")) {
         if (!visible(el)) continue;
@@ -1255,6 +1315,8 @@ export async function auditWebPage({ url, timeoutMs = NAV_TIMEOUT_MS, device = "
         }
         if (!wired && el.matches("button[type=submit], input[type=submit]") && el.closest("form")) wired = true;
         if (!wired && el.closest("label")) wired = true; // a label drives its own control
+        if (!wired && opensSomethingOnHoverOrFocus(el)) wired = true;
+        if (!wired && claimedByDelegate(el)) wired = true;
         if (!wired) dead.push({ kind: "unwired_control", label, selector: selectorFor(el) });
       }
       return { dead, controlCount: document.querySelectorAll("a[href], button, [role=button]").length, title: document.title };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aarwitz/tapp",
-  "version": "0.17.14",
+  "version": "0.17.17",
   "mcpName": "io.github.aarwitz/tapp",
   "description": "Let coding agents verify UI changes on real iOS, Android, and web surfaces, then enforce reviewed proof in deterministic CI.",
   "license": "MIT",

package/scripts/run-flow.sh

@@ -48,12 +48,15 @@ case "$FLOW" in
   *) FLOW_EVIDENCE_SOURCE="$EVIDENCE_DIR/flow-source.yml" ;;
 esac
 cp "$FLOW" "$FLOW_EVIDENCE_SOURCE"
-python3 - "$CFG" "$APP" "$FLOW_JSON" "$AI_RESP" "$AI_DIR" <<'PY'
+TAPP_FLOW_EVIDENCE_DIR_RESOLVED="$EVIDENCE_DIR" python3 - "$CFG" "$APP" "$FLOW_JSON" "$AI_RESP" "$AI_DIR" <<'PY'
 import json, os, sys
 cfg, app, flow_json, ai_resp, ai_dir = sys.argv[1:6]
 d = {
   "OCQA_BUNDLE_ID": app,
   "OCQA_FLOW_JSON": flow_json,
+  # Where the harness writes per-step failure screenshots, so iOS flow evidence matches web
+  # and android instead of living only inside the .xcresult (field issue #8).
+  "OCQA_FLOW_EVIDENCE_DIR": os.environ.get("TAPP_FLOW_EVIDENCE_DIR_RESOLVED", ""),
   "OCQA_TEST_EMAIL": os.environ.get("OCQA_TEST_EMAIL", "test@example.com"),
   "OCQA_TEST_PASSWORD": os.environ.get("OCQA_TEST_PASSWORD", "TestPass123!"),
 }