@duckduckgo/autoconsent 16.43.1 → 16.43.2

package/AGENTS.md

@@ -76,7 +76,7 @@ Site-specific rules are rules scoped to specific sites with a `urlPattern`. Rule
 
 ### JSON Rules vs Code-based rules
 
-JSON rules live in `rules/autoconsent/` (hand-maintained) and `rules/generated/` (auto-generated). Each file defines one CMP rule following the `AutoConsentCMPRule` type in `lib/rules.ts`.
+JSON rules live in `rules/autoconsent/` (hand-maintained) and `rules/generated/` (auto-generated). Each file defines one CMP rule following the `AutoConsentCMPRule` type in `lib/rules.ts`. **Add new JSON rules only to `rules/autoconsent/`.** Do not add new files to `rules/generated/`: only the crawler creates them. You may remove a generated rule, for example when it is stale.
 
 ```json
 {
@@ -122,6 +122,14 @@ shadow root or same-origin iframe.
 - Use `npm run create-rule` to scaffold a new rule and a spec file.
 - Code comments: keep them brief (max one line), explain why not what, no references to specific sites in library code
 
+### Rule step traps
+
+- **For "not visible", use `check: "none"`, never `negated`.** `negated` only inverts the final result. `waitForVisible` + `negated` does not wait for the element to disappear: it fails at once while the element is visible. `visible` + `negated` is true when one match is visible and another is hidden.
+- **Array selectors search only inside the first match.** `["iframe", "button"]` searches only the first `iframe` on the page.
+- **`cookieContains` is a plain substring match.** `consent=1` also matches `myconsent=10`. It cannot see `HttpOnly` cookies.
+- **`setStyle` replaces the full inline style.** Use `addStyle` to keep the other inline styles.
+- **`npm run rule-syntax-check` does not check `rules/generated/`.** Check generated rules against the schema yourself.
+
 ### Updating existing rules
 - **For site-specific popups, prefer a heuristic-pattern fix over a new rule, and check whether a rule is needed at all.** If the popup is unique to a site (not a shared CMP) and already has a reject, dismiss, or acknowledge button that the heuristic should match, extend `lib/heuristic-patterns.ts` instead of adding a `urlPattern`-scoped JSON rule. Do not use a heuristic fix in place of a generic CMP rule. A heuristic change must not cause false positives on other sites.
 - If an existing generic rule fails on a specific site: first look for other sites with the same failure (spec sites, data/coverage.json, publicwww). If the issue applies to more sites, update the generic rule; if the issue is truly site-specific, prefer making a site-specific rule or a config exception. Never change a generic rule to fix a site-specific implementation problem.

package/CHANGELOG.md

@@ -1,3 +1,21 @@
+# v16.43.2 (Thu Oct 01 2026)
+
+#### AI / Agent Workflow
+
+- Document rule step traps for agents [#1582](https://github.com/duckduckgo/autoconsent/pull/1582) ([@claude](https://github.com/claude) [@muodov](https://github.com/muodov))
+
+#### Other
+
+- Coverage data update [#1575](https://github.com/duckduckgo/autoconsent/pull/1575) ([@daxtheduck](https://github.com/daxtheduck))
+
+#### Authors: 3
+
+- Claude ([@claude](https://github.com/claude))
+- Dax ([@daxtheduck](https://github.com/daxtheduck))
+- Maxim Tsoy ([@muodov](https://github.com/muodov))
+
+---
+
 # v16.43.1 (Wed Sep 30 2026)
 
 #### Dependencies