@duckduckgo/autoconsent 16.48.0 → 16.50.0

package/.agents/skills/optimize-button-patterns/SKILL.md

@@ -0,0 +1,145 @@
+---
+name: optimize-button-patterns
+description: >-
+  Iteratively improves the heuristic button regex patterns in lib/heuristic-patterns.ts
+  against data/labelled-button-texts.csv. Use when labels are updated, benchmark
+  coverage is low, or the user asks to optimize/fix button pattern regexes.
+  Targets zero false positives and ≥90% weighted coverage per label (settings,
+  accept, reject, acknowledge).
+disable-model-invocation: true
+---
+
+# Optimize Button Patterns
+
+Improve the button patterns in `lib/heuristic-patterns.ts` so `classifyButtonTextRegex` matches the labelled dataset in `data/labelled-button-texts.csv`.
+
+These patterns decide what autoconsent clicks in users' browsers, and tracker-radar-collector imports them for crawl post-processing. A pattern that moves a button between labels changes which heuristic tier handles its popup (see `classifyPopup`): an `acknowledge` button is clicked in tier1, an `accept` button only in tier2. Keep that in mind when a fix moves text between `ACCEPT_PATTERNS` and `ACKNOWLEDGE_PATTERNS`.
+
+## Prerequisites
+
+1. Confirm `data/labelled-button-texts.csv` has up-to-date labels. New rows come from tracker-radar-collector: `collect-popup-button-texts.js` adds unlabelled rows and `label-button-texts.js` labels them with an LLM (see that repo's `post-processing/README.md`). If the CSV has unlabelled rows, suggest running `label-button-texts.js` first.
+2. For label semantics, read the `classifyButtonTextLLM` prompt in tracker-radar-collector's `post-processing/generate-autoconsent-rules/detection.js`. That prompt is the source of truth for labels; do not duplicate it here.
+3. If a label looks wrong, fix the row in the CSV rather than bending patterns to fit it (see AGENTS.md).
+
+## Success criteria
+
+Stop when all three are met:
+
+1. **Zero false positives** (occurrence-weighted total across labels)
+2. **Per-label weighted coverage > 90%** for each of `settings`, `accept`, `reject`, and `acknowledge` (`other` is excluded from optimization)
+3. **Pattern consolidation**: merge literal clusters into regexes where safe; dedupe exact duplicates
+
+`npm run test:lib` enforces criteria 1 and 2 (`tests-wtr/heuristics/button-classification-accuracy.test.ts`), so it must pass before you finish.
+
+## Benchmark
+
+Run after every batch of edits:
+
+```bash
+npm run benchmark-buttons -- --top 25
+```
+
+The output has the totals (weighted false positives, weighted misses) and, per label, the row and occurrence-weighted correct rate, the false-positive count, and the top false positives and misses sorted by occurrences, formatted as `[label -> predicted] "text" (xN)`. A label passes when its weighted rate is above 90%. Check all four labels every iteration. Use `--top <n>` for longer example lists.
+
+Count patterns before and after with:
+
+```bash
+npx ts-node -e "import * as p from './lib/heuristic-patterns'; for (const [k, v] of Object.entries(p)) console.log(k, v.length)"
+```
+
+## Run loop
+
+Max ~10 iterations. Each iteration:
+
+### 1. Measure
+
+Run the benchmark. Record each label's weighted rate (and which labels are below 90%), weighted false positives, and pattern counts.
+
+### 2. Fix false positives first
+
+For each false positive (predicted as a label, but the ground truth is a different label):
+
+- Find the matching pattern in `lib/heuristic-patterns.ts` (grep the cleaned text; remember the classification order: reject → settings → accept → acknowledge).
+- Fix by removing the pattern, moving it to the correct list, narrowing it with `^...$` anchors, or adding a `BUTTON_NEVER_MATCH_PATTERNS` guard.
+- Re-run the benchmark. **Do not add new coverage patterns while false positives remain.**
+
+### 3. Improve coverage
+
+While any label is below 90%, prioritize the labels furthest below (by the gap in weighted correct count: weighted support minus weighted correct).
+
+Each iteration, take the top 15–25 misses by occurrences from **under-target labels only**.
+
+For each miss:
+
+- Add the smallest pattern that fixes it in the correct list (`REJECT_PATTERNS`, `SETTINGS_PATTERNS`, `ACCEPT_PATTERNS` or `ACKNOWLEDGE_PATTERNS`, keeping the per-language sub-lists for reject).
+- Prefer extending an existing regex over adding a literal string.
+- Run the collision check (below) before keeping it.
+- Re-run the benchmark after each batch. False positives must not increase, and no label's rate may drop below its previous value.
+
+### 4. Merge patterns
+
+Once false positives are 0 and **every** label is above 90%:
+
+- Remove exact duplicate literals within the same list.
+- Replace clusters of 3+ similar literals with one anchored alternation regex, e.g. `/^(alles accepteren|accepteer alles|alles akzeptieren)$/i`.
+- Re-run the benchmark to confirm there is no regression.
+
+### 5. Verify and report
+
+Run `npm run test:lib` and `npm run lint`, then report using the output template at the end of this file.
+
+## Pattern authoring rules
+
+- Edit the button lists in `lib/heuristic-patterns.ts` only. Do not change `DETECT_PATTERNS`/`DETECT_NEVER_MATCH_PATTERNS` or the classification code in `lib/heuristics.ts` as part of this loop.
+- Classification order: **reject → settings → accept → acknowledge → other** (see `classifyButtonTextRegex`). Patterns are matched against `cleanButtonText` output (lowercased, punctuation and emoji stripped, whitespace collapsed).
+- Essential/necessary-only phrases → **reject**, even when "accept" appears.
+- `allow` / `permit` + selection → **accept**; `customize` / `manage` / show details → **settings**.
+- Neutral dismiss (OK, close, got it) → **acknowledge**. Accept-and-close (e.g. "akzeptieren schließen") → **accept**.
+- Use anchored regexes (`^...$`) for short action verbs to avoid substring false positives.
+- Preserve the language section comments (`// German`, `// Dutch`, etc.) and existing explanatory comments.
+
+## Known pitfalls
+
+Patterns misplaced across lists cause false positives:
+
+| Text | Correct label | Common mistake |
+|------|---------------|----------------|
+| `selectie toestaan` | accept | Listed in the Dutch reject patterns |
+| `widerrufen` | other (revoke link, not a reject button) | Added to the German reject patterns |
+| bare `essential` / `required` | other (category labels) | Matched by the essential-only reject pattern |
+
+When fixing false positives, search `lib/heuristic-patterns.ts` for the literal or a regex that matches the cleaned text, then move, remove or narrow it.
+
+## Collision check
+
+Before adding pattern `P` for label `L`:
+
+1. Apply `cleanButtonText` when matching (same as runtime).
+2. Scan the labelled CSV: if `P` would match a row where `label !== L`, that is a collision. Include rows labelled `other`: the benchmark does not count those as false positives, but autoconsent would still click them.
+3. If a high-occurrence collision exists, narrow `P` or skip it.
+4. String patterns match the exact cleaned text; regex patterns use `.test(cleanedText)`.
+
+## Stop conditions
+
+- All success criteria met (including every label above 90%), or
+- No improvement in any under-target label's weighted rate for 2 consecutive iterations (report blockers per label), or
+- User iteration budget reached
+
+## Output template
+
+End with:
+
+```markdown
+## Button pattern optimization results
+- False positives: N → 0
+- Per-label weighted coverage (target >90% each):
+  - settings: X% → Y%
+  - accept: X% → Y%
+  - reject: X% → Y%
+  - acknowledge: X% → Y%
+- Pattern count: A → B
+- Key changes:
+  - ...
+- Remaining top misses (if any, by label below target):
+  - [label -> predicted] "text" (xN)
+```

package/.agents/skills/oxylabs-testing/SKILL.md

@@ -93,7 +93,7 @@ With `solveCaptcha: true`, a listener in autoconsent's isolated world forwards t
 
 - **CAPTCHA events arrive via `window.postMessage`, not CDP.** With `solveCaptcha: true`, autoconsent's wait pauses whenever a start event arrives, until `oxylabs-captcha-end`, `oxylabs-captcha-solve-end` or `oxylabs-captcha-error`, for at most 60s from the first start (the timeout in Oxylabs' example). Oxylabs documents no deadline for the start event, so captcha-free pages aren't held up waiting for one. Agent Browser sends `oxylabs-captcha-solve-start` with a `captchaType` (e.g. `turnstile`); the documented `oxylabs-captcha-start` is accepted too. A Cloudflare Turnstile took about 35-40s to solve. Hard blocks without a captcha (e.g. DataDome "Access is temporarily restricted", Akamai "Access denied") send no events, so solving doesn't help there.
 - **Main-world CDP bindings don't work on Agent Browser.** `page.exposeBinding`, and `Runtime.addBinding` without `executionContextName`, never reach the page. Bindings scoped to an isolated world (what the harness uses) work, and `window` messages reach isolated-world listeners, so listen there.
-- **Limits:** 100 concurrent sessions and 10 new sessions per second per account.
+- **Limits:** 100 concurrent sessions and 10 new sessions per second per account. Going over the per-second limit fails `connectOverCDP` with `WebSocket error: ... 429 Too Many Requests`, and the library does not retry it. `testRegions` opens sessions one at a time, but a script that opens sessions in parallel (several `withOxylabsPage` calls in a `Promise.all`, or several such scripts at once) can easily send 10 within a second. Stagger the session opens (for example 200ms apart), and rerun any test that failed with a 429. A 429 is not a result about the site.
 - **Call injection before `page.goto`**, so autoconsent is in place before page scripts run.
 - **Oxylabs blocks certain site categories** (e.g. government sites), and some sites block Oxylabs too: check the screenshots. Use alternative URLs for the same CMP, or retest as described in the `proxy-testing` gotchas.
 - **Each region test creates a new browser session** — there's no session reuse across regions.

package/.claude/skills/optimize-button-patterns/SKILL.md

@@ -0,0 +1,7 @@
+---
+name: optimize-button-patterns
+description: Iteratively improves the heuristic button regex patterns in lib/heuristic-patterns.ts against data/labelled-button-texts.csv. Use when labels are updated, benchmark coverage is low, or the user asks to optimize/fix button pattern regexes.
+disable-model-invocation: true
+---
+
+@.agents/skills/optimize-button-patterns/SKILL.md

package/.github/workflows/release-labels.yml

@@ -18,13 +18,9 @@ permissions:
 
 jobs:
     # No concurrency group here: a 'labeled' event right after 'opened' must not cancel this job.
+    # Only on 'opened': a later run would re-add category labels that the author replaced.
     path-labels:
-        if: >-
-            ${{
-              github.event.action == 'opened' ||
-              github.event.action == 'reopened' ||
-              github.event.action == 'ready_for_review'
-            }}
+        if: ${{ github.event.action == 'opened' }}
         runs-on: ubuntu-latest
         steps:
             - uses: actions/checkout@v4

package/AGENTS.md

@@ -41,6 +41,7 @@ npm run watch         # auto-rebuild on changes to lib/, addon/, rules/
 | `npm run test:chrome` | Playwright tests in Chrome only |
 | `npm run build-rules` | Rebuild `rules.json`, `compact-rules.json` |
 | `npm run create-rule` | Scaffold a new JSON rule + test spec |
+| `npm run benchmark-buttons` | Score heuristic button classification against labelled button texts |
 
 ## Code Style
 - **Preserve existing comments.** Do not remove JSDoc comments, TODO comments, or inline explanations unless the related code is also being removed. Rewriting a comment to reflect updated logic is fine.
@@ -135,6 +136,7 @@ shadow root or same-origin iframe.
 - If an existing generic rule fails on a specific site: first look for other sites with the same failure (spec sites, data/coverage.json, publicwww). If the issue applies to more sites, update the generic rule; if the issue is truly site-specific, prefer making a site-specific rule or a config exception. Never change a generic rule to fix a site-specific implementation problem.
 - After updating an existing generic rule, do a heavy testing run: all known sites (specs + data/coverage.json + publicwww) across the expanded set. Inspect both API results AND screenshots.
 - **When adding or fixing a rule for a site, remove stale site-specific rules covering the same site.** If a site-specific rule is obsolete in all regions (the site switched CMP), remove it rather than leaving it alongside the new or updated rule.
+- **Heuristic pattern changes must keep the labelled button benchmark green.** `lib/heuristic-patterns.ts` is the source of truth for heuristic patterns; downstream projects (e.g. tracker-radar-collector) should import them rather than keep copies. `tests-wtr/heuristics/button-classification-accuracy.test.ts` checks `classifyButtonTextRegex` against `data/labelled-button-texts.csv` (no false positives, >90% weighted accuracy per label). Use `npm run benchmark-buttons` to see what a change gains or loses, and the `optimize-button-patterns` skill to tune patterns against it. New labelled rows come from the tracker-radar-collector post-processing scripts (`collect-popup-button-texts.js`, `label-button-texts.js`). Fix a mislabelled row in the CSV rather than bending patterns to fit it.
 - if a popup does not provide an opt-out button, `optOut` _may_ click "dismiss"/"acknowledge" instead. Check with the existing heuristic patterns in /lib/heuristic-patterns.ts for reference. Do **not** click a TIER2 (single Accept) button — see General Guidelines.
 - do not keep outdated selectors in changed rules, unless they are actually used in some conditions
 

package/CHANGELOG.md

@@ -1,3 +1,80 @@
+# v16.50.0 (Sat Oct 10 2026)
+
+#### Rules
+
+- Rule update: ddg_android (eun) CPM magic report: openrouter.ai [#1646](https://github.com/duckduckgo/autoconsent/pull/1646) ([@daxtheduck](https://github.com/daxtheduck) [@muodov](https://github.com/muodov))
+- Rule update: ddg_android (usc) CPM magic report: hiring.amazon.ca [#1647](https://github.com/duckduckgo/autoconsent/pull/1647) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: ddg_ios (use) CPM magic report: www.foodnetwork.com [#1649](https://github.com/duckduckgo/autoconsent/pull/1649) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: bigcrunch [#1655](https://github.com/duckduckgo/autoconsent/pull/1655) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: avada-cookie-consent [#1670](https://github.com/duckduckgo/autoconsent/pull/1670) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: ceneo [#1660](https://github.com/duckduckgo/autoconsent/pull/1660) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: axeptio [#1658](https://github.com/duckduckgo/autoconsent/pull/1658) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: dhbbank [#1669](https://github.com/duckduckgo/autoconsent/pull/1669) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: laravel-cookie-consent [#1668](https://github.com/duckduckgo/autoconsent/pull/1668) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: mackeeper [#1666](https://github.com/duckduckgo/autoconsent/pull/1666) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: fera-cookies [#1665](https://github.com/duckduckgo/autoconsent/pull/1665) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: uft-cookie-notice [#1664](https://github.com/duckduckgo/autoconsent/pull/1664) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: ndl-go-jp [#1663](https://github.com/duckduckgo/autoconsent/pull/1663) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: la7-cmp [#1662](https://github.com/duckduckgo/autoconsent/pull/1662) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: thenounproject [#1661](https://github.com/duckduckgo/autoconsent/pull/1661) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: bricklink [#1659](https://github.com/duckduckgo/autoconsent/pull/1659) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: texas-instruments [#1657](https://github.com/duckduckgo/autoconsent/pull/1657) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: legislation-gov-uk [#1656](https://github.com/duckduckgo/autoconsent/pull/1656) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: toyota [#1654](https://github.com/duckduckgo/autoconsent/pull/1654) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: [E2E test] bryantpark.org fix path [#1651](https://github.com/duckduckgo/autoconsent/pull/1651) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: Cookie popup on www.thegrandyork.co.uk [#1650](https://github.com/duckduckgo/autoconsent/pull/1650) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: Cookie prompt not dismissed for erewhon.com [#1644](https://github.com/duckduckgo/autoconsent/pull/1644) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: Cookie Popup on vaquerogengage.com [#1620](https://github.com/duckduckgo/autoconsent/pull/1620) ([@daxtheduck](https://github.com/daxtheduck) [@muodov](https://github.com/muodov))
+- paypal: hide the no-Decline banner, retry the Decline click [#1652](https://github.com/duckduckgo/autoconsent/pull/1652) ([@muodov](https://github.com/muodov))
+- Rule update: conjointly [#1648](https://github.com/duckduckgo/autoconsent/pull/1648) ([@daxtheduck](https://github.com/daxtheduck))
+
+#### CI / Release Automation
+
+- Apply path-based labels only when a PR is opened [#1671](https://github.com/duckduckgo/autoconsent/pull/1671) ([@muodov](https://github.com/muodov))
+
+#### Authors: 2
+
+- Dax ([@daxtheduck](https://github.com/daxtheduck))
+- Maxim Tsoy ([@muodov](https://github.com/muodov))
+
+---
+
+# v16.49.0 (Fri Oct 09 2026)
+
+#### Rules
+
+- Rule update: ddg_mac_desktop (use) CPM magic report: us.select-sport.com [#1645](https://github.com/duckduckgo/autoconsent/pull/1645) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: evium.de [#1643](https://github.com/duckduckgo/autoconsent/pull/1643) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: pandectes [#1641](https://github.com/duckduckgo/autoconsent/pull/1641) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: ensembleartsphilly [#1618](https://github.com/duckduckgo/autoconsent/pull/1618) ([@daxtheduck](https://github.com/daxtheduck))
+- Add button classification benchmarking suite [#1604](https://github.com/duckduckgo/autoconsent/pull/1604) ([@claude](https://github.com/claude) [@sammacbeth](https://github.com/sammacbeth))
+- Rule update: costco.ca cookie prompt not handled [#1639](https://github.com/duckduckgo/autoconsent/pull/1639) ([@daxtheduck](https://github.com/daxtheduck) [@muodov](https://github.com/muodov))
+- Rule update: ddg_mac_desktop (use) CPM magic report: www.mcgeeandco.com [#1637](https://github.com/duckduckgo/autoconsent/pull/1637) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: ddg_ios (ase) CPM magic report: www.ctgt.ai [#1636](https://github.com/duckduckgo/autoconsent/pull/1636) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: CPM feedback: shinden.pl [#1635](https://github.com/duckduckgo/autoconsent/pull/1635) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: Cookie popup on jfe-holdings.co.jp (Datasign CMP) [#1633](https://github.com/duckduckgo/autoconsent/pull/1633) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: Cookie popup on www.jclewislincoln.com [#1632](https://github.com/duckduckgo/autoconsent/pull/1632) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: Cookie popup on catflooringaccessories.com [#1631](https://github.com/duckduckgo/autoconsent/pull/1631) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: Cookie popup on technologylaw.fkks.com (Passle CMP) [#1630](https://github.com/duckduckgo/autoconsent/pull/1630) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: goaexperience.co.uk (Cookieconsent CMP) [#1629](https://github.com/duckduckgo/autoconsent/pull/1629) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: ddg_ios (ase) CPM magic report: www.poconopoolandspallc.com [#1628](https://github.com/duckduckgo/autoconsent/pull/1628) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: Cookie consent not dismissed on https://www.yogurtland.com/ (no-reject version of Iubenda) [#1625](https://github.com/duckduckgo/autoconsent/pull/1625) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: Cookie popup on goorin.com [#1623](https://github.com/duckduckgo/autoconsent/pull/1623) ([@daxtheduck](https://github.com/daxtheduck))
+- Rule update: https://www.headphonecheck.com/ (Borlabs CMP, Easylist breakage) [#1622](https://github.com/duckduckgo/autoconsent/pull/1622) ([@daxtheduck](https://github.com/daxtheduck))
+
+#### AI / Agent Workflow
+
+- oxylabs-testing: note what happens over the new-session limit [#1640](https://github.com/duckduckgo/autoconsent/pull/1640) ([@muodov](https://github.com/muodov))
+
+#### Authors: 4
+
+- Claude ([@claude](https://github.com/claude))
+- Dax ([@daxtheduck](https://github.com/daxtheduck))
+- Maxim Tsoy ([@muodov](https://github.com/muodov))
+- Sam Macbeth ([@sammacbeth](https://github.com/sammacbeth))
+
+---
+
 # v16.48.0 (Thu Oct 08 2026)
 
 #### Rules

package/data/Readme.md

@@ -4,8 +4,14 @@ This folder contains statistics gathered from running crawls with autoconsent ac
 The crawler uses [tracker-radar-collector](https://github.com/duckduckgo/tracker-radar-collector/) to crawl a list of the top 10k sites for US, DE and GB regions.
 The results report how many sites in this list the rule triggered for, and some error counts.
 
+## Labelled button texts
+
+`labelled-button-texts.csv` holds cookie popup button texts collected from crawls (`button_text`, normalized with `cleanButtonText`), the number of sites each appeared on (`occurences`), and a `label`: `settings`, `accept`, `reject`, `acknowledge` or `other`.
+It is produced by the [tracker-radar-collector](https://github.com/duckduckgo/tracker-radar-collector/) post-processing scripts (`collect-popup-button-texts.js`, then `label-button-texts.js`), and is used by `npm run benchmark-buttons` and `tests-wtr/heuristics/button-classification-accuracy.test.ts` to measure heuristic button classification.
+
 ## Data format
 
+
 In `coverage.json` the data is included as a JSON object. Keys correspond to rule names and contain stats for `US`, `DE` and `GB` regions, where applicable.
 The stats contain the following keys:
  - `sites`: Number of sites where this rule was triggered (`detectCmp` was true).