@duckduckgo/autoconsent 16.16.0 → 16.18.0

package/.agents/skills/proxy-testing/SKILL.md

@@ -4,8 +4,19 @@ description: Test autoconsent via regional proxies in Playwright. Use when verif
 ---
 
 # Proxy Testing
+This skill provides a JS library to run autoconsent via regional proxies in Playwright.
 
-All rule changes must be tested across ALL supported geographic regions to catch regional popup variations. This skill provides a JS library to run autoconsent via regional proxies in Playwright.
+Rule changes are verified with a two-level regional policy.
+The **core region set** (default for detection, iteration, and verification) covers `us` (CCPA), `gb` (UK GDPR), `de` (EEA GDPR), plus the reported region from the task when specified (if the reported region is not a supported proxy region, use the closest supported one, e.g. `es` for `pt`). Iterate in the single most relevant region; run the full core set once when the fix is stable.
+
+Escalate to the **expanded set** (`us`, `gb`, `de`, `fr`, `nl`, `pl`, `au`, `ca`, `jp`) if any of these is true:
+- core results diverge
+- the rule contains region-dependent logic
+- the fix relies on language-specific or brittle structural selectors
+- the change touches a widely-used generic rule (as final pre-PR validation)
+- a non-core region named in the report behaves differently.
+
+The remaining GDPR/EEA regions (`ch`, `no`, `it`, `es`, `se`, `dk`) are optional even in an expanded pass: test them only when named in the report or clearly relevant (e.g. the site's ccTLD).
 
 Important! Autoconsent results can have false positives. When testing, always inspect the screenshots and confirm that opt-out was successful.
 
@@ -74,7 +85,10 @@ export default defineConfig({
 ## API
 
 - `testUrl(url, regionKey, options?)` — test one URL in a single region; launches a proxied browser, runs autoconsent, returns a `TestResult`.
-- `testRegions(url, regions?, options?)` — test one URL across several regions (defaults to all supported regions), a fresh browser per region; returns `TestResult[]`.
+- `testRegions(url, regions?, options?)` — test one URL across several regions (defaults to `CORE_REGIONS`), a fresh browser per region; returns `TestResult[]`. Remember to include the reported region when not already covered.
+- `CORE_REGIONS` — the core region set (default); add the reported region when not already covered.
+- `EXPANDED_REGIONS` — the expanded region set used on escalation.
+- `ALL_REGIONS` — all supported regions.
 - `testPage(page, url, regionKey, options?)` — run a full test on a page you created yourself (you own the browser/context); returns a `TestResult`.
 - `injectAutoconsent(page, options?)` — set up isolated-world injection; call before `page.goto()`. Returns a context (`received`, `hasMessage`, `waitForCompletion`, `waitForMessage`, `collectResult`).
 - `buildProxyConfig(regionKey)` — build the Playwright `{ server, username, password }` proxy object for a region from its env vars.
@@ -108,7 +122,7 @@ await browser.close();
 
 1. Run `npm run build-rules` after changing rule JSON.
 2. Smoke-test each regional proxy.
-3. Test in ALL supported regions.
+3. Verify on the core region set (`us`, `gb`, `de` + reported region); escalate to the expanded set per the policy above.
 4. Inspect screenshots, not just API results.
 5. Reload after dismissal and confirm the rule does not keep matching, unless cosmetic-only.
 

package/.agents/skills/proxy-testing/scripts/regional-proxy.mjs

@@ -82,7 +82,14 @@ const contentScript = fs.readFileSync(path.join(projectRoot, 'dist/autoconsent.p
 const rulesJson = JSON.parse(fs.readFileSync(path.join(projectRoot, 'rules/rules.json'), 'utf-8'));
 const fullRules = rulesJson.autoconsent;
 
-export const DEFAULT_REGIONS = ['us', 'gb', 'au', 'ca', 'de', 'fr', 'nl', 'ch', 'no', 'it', 'es', 'pl', 'se', 'dk', 'jp'];
+/** All supported proxy regions. */
+export const ALL_REGIONS = ['us', 'gb', 'au', 'ca', 'de', 'fr', 'nl', 'ch', 'no', 'it', 'es', 'pl', 'se', 'dk', 'jp'];
+
+/** Core pass: default verification set (CCPA, UK GDPR, EEA GDPR). Add the reported region when not already covered. */
+export const CORE_REGIONS = ['us', 'gb', 'de'];
+
+/** Expanded pass: escalation set covering all non-GDPR regimes plus GDPR representatives. */
+export const EXPANDED_REGIONS = ['us', 'gb', 'de', 'fr', 'nl', 'pl', 'au', 'ca', 'jp'];
 
 /**
  * Build the Playwright proxy object for a region.
@@ -560,11 +567,11 @@ export async function testUrl(url, regionKey, options = {}) {
 /**
  * Test one URL across several regions.
  * @param {string} url
- * @param {string[]} [regions]
+ * @param {string[]} [regions] Defaults to the core pass; pass EXPANDED_REGIONS or ALL_REGIONS to widen.
  * @param {Partial<TestOptions>} [options]
  * @returns {Promise<TestResult[]>}
  */
-export async function testRegions(url, regions = DEFAULT_REGIONS, options = {}) {
+export async function testRegions(url, regions = CORE_REGIONS, options = {}) {
     const results = [];
     for (const region of regions) {
         results.push(await testUrl(url, region, options));

package/AGENTS.md

@@ -60,7 +60,7 @@ CMPs behave differently by region:
 
 Use `if`/`then`/`else` to handle regional variants within a single rule.
 
-**All rule changes MUST be tested across ALL supported geographic regions** to catch regional popup variations. Test from real geographic locations using available regional testing tooling (e.g. `proxy-testing` skill).
+**Test all rule changes across the core region set** — US, GB, DE, plus the reported region from the task (or the closest supported proxy region, e.g. ES for PT) — using the `proxy-testing` skill. Escalate to the expanded set according to the skill's policy.
 
 ### Generic vs Site-Specific Rules
 
@@ -116,14 +116,15 @@ shadow root or same-origin iframe.
 
 ### Updating existing rules
 - If an existing generic rule fails on a specific site: first look for other sites with the same failure (spec sites, data/coverage.json, publicwww). If the issue applies to more sites, update the generic rule; if the issue is truly site-specific, prefer making a site-specific rule or a config exception. Never change a generic rule to fix a site-specific implementation problem.
-- After updating an existing generic rule, do a heavy testing run: all known sites (specs + data/coverage.json + publicwww) using available regional testing tooling. Inspect both API results and screenshots.
+- After updating an existing generic rule, do a heavy testing run: all known sites (specs + data/coverage.json + publicwww) across the expanded set. Inspect both API results AND screenshots.
 - if a site-specific rule is obsolete (the site switched CMP in ALL regions), propose removal.
 - if a popup does not provide an opt-out button, `optOut` _may_ click "dismiss"/"acknowledge" instead. Check with the existing heuristic patterns in /lib/heuristic-patterns.ts for reference.
 - do not keep outdated selectors in changed rules, unless they are actually used in some conditions
 - If the pop-up has an explicit "reject"-like button, you should first consider why HEURISTIC rule didn't handle it. A fix to the heuristic rule is always preferred to a new rule, as long as it doesn't cause potential false-positives on other sites.
 
 ### Verification guidelines
-- **Regional testing is mandatory** for any rule change — CMPs behave differently under GDPR (EU), CCPA (US), and other jurisdictions. Run the rule against different regions using available regional testing tooling before considering the change done.
+- **Regional testing is mandatory** for any rule change — CMPs behave differently under GDPR (EU), CCPA (US), and other jurisdictions. Run the rule against different regions using `proxy-testing` skill before considering the change done. Iterate on the fix in the single most relevant region and run the verification according to the skill's policy.
+- **Mobile policy**: by default test desktop across the current set's regions, plus one mobile sanity check in the region where the popup reproduces. If the mobile sanity check differs from desktop (different popup, rule, or outcome), expand mobile across the current set's regions. If the original report is from a mobile OS, test both desktop and mobile from the start.
 - When verifying a rule, **look at the screenshots** on top of the API results — sometimes a rule reports success, but the popup is not actually handled - a screenshot will detect this.
 - **Watch out for race conditions**. A common pitfall is that a rule starts clicking before JS handlers are ready. If you detect this, add an appropriate wait step before the click, preferably based on a specific DOM state. Unconditional `wait` is a LAST RESORT because it leads to a poor UX.
 - **Watch out for false positive detections**. Always verify that the rule does NOT match after the popup is dismissed and the page is reloaded. Over-detection can lead to reload loops.
@@ -183,4 +184,4 @@ After creating or modifying a rule:
 3. `npx playwright test tests/<name>.spec.ts` — run the E2E test
 4. `npm run prepublish` — full build including extension bundle
 5. Validate that the rule stops matching after the popup is dismissed and the page is reloaded (unless it's a cosmetic rule).
-6. Check the rule works across all supported geographic regions using available regional testing tooling.
+6. Check the rule works across regions as per guidelines above.

package/CHANGELOG.md

@@ -1,3 +1,38 @@
+# v16.18.0 (Wed Jul 29 2026)
+
+#### Rules
+
+- Fix Pornhub reload loop by merging compact cookie banner rule [#1463](https://github.com/duckduckgo/autoconsent/pull/1463) ([@cursoragent](https://github.com/cursoragent) [@sammacbeth](https://github.com/sammacbeth))
+- Fix stale cmp rules [#1459](https://github.com/duckduckgo/autoconsent/pull/1459) ([@cursoragent](https://github.com/cursoragent) [@muodov](https://github.com/muodov))
+- Fix borlabs rule [#1462](https://github.com/duckduckgo/autoconsent/pull/1462) ([@cursoragent](https://github.com/cursoragent) [@sammacbeth](https://github.com/sammacbeth))
+
+#### AI / Agent Workflow
+
+- Introduce test region sets [#1461](https://github.com/duckduckgo/autoconsent/pull/1461) ([@muodov](https://github.com/muodov))
+
+#### Authors: 3
+
+- Cursor Agent ([@cursoragent](https://github.com/cursoragent))
+- Maxim Tsoy ([@muodov](https://github.com/muodov))
+- Sam Macbeth ([@sammacbeth](https://github.com/sammacbeth))
+
+---
+
+# v16.17.0 (Tue Jul 28 2026)
+
+#### Rules
+
+- make youtube-mobile more reliable [#1460](https://github.com/duckduckgo/autoconsent/pull/1460) ([@muodov](https://github.com/muodov))
+- Dismiss The Guardian "consent or pay" wall in EU/UK via cosmetic rule [#1455](https://github.com/duckduckgo/autoconsent/pull/1455) ([@cursoragent](https://github.com/cursoragent) [@sammacbeth](https://github.com/sammacbeth))
+
+#### Authors: 3
+
+- Cursor Agent ([@cursoragent](https://github.com/cursoragent))
+- Maxim Tsoy ([@muodov](https://github.com/muodov))
+- Sam Macbeth ([@sammacbeth](https://github.com/sammacbeth))
+
+---
+
 # v16.16.0 (Sat Jul 25 2026)
 
 #### Rules