@hover-dev/core 0.12.0 → 0.13.0

package/README.md

@@ -2,7 +2,7 @@
 
 The local Node service. Owns:
 
-- **Agent invocation** (`src/agents/`) — Local CLI Agent First. Spawns `claude` / `codex` / `cursor` / ... and normalizes their output into a single `InvokeEvent` stream.
+- **Agent invocation** (`src/agents/`) — Local CLI Agent First. Spawns `claude` / `codex` / `cursor-agent` / `aider` / `gemini-cli` / `qwen-code` and normalizes their output into a single `InvokeEvent` stream.
 - **Playwright preflight** (`src/playwright/`) — verifies CDP connection to the user's Chrome.
 - **Smoke test** (`src/smoke.ts`) — end-to-end verification of the whole chain.
 
@@ -20,6 +20,9 @@ The local Node service. Owns:
 | `claude.ts` | Claude Code descriptor: `claude -p`, stream-json parser, hard sandbox flags |
 | `codex.ts` | OpenAI Codex CLI descriptor: `codex exec --json`, JSONL parser, soft sandbox (`--sandbox read-only`) |
 | `cursor.ts` | Cursor CLI descriptor (v0.9): stream-JSON / NDJSON parser, soft sandbox |
+| `aider.ts` | Aider CLI descriptor (v0.10): JSON-stream parser, soft sandbox |
+| `gemini.ts` | Gemini CLI descriptor (v0.10): stream parser, soft sandbox |
+| `qwen.ts` | Qwen Code descriptor (v0.10): stream parser, soft sandbox |
 
 To add an agent: implement an `AgentDescriptor`, register it in `registry.ts`. Done.
 
@@ -45,7 +48,7 @@ pnpm smoke http://localhost:5173/ "log in then add a todo named 'verify hover'"
 Environment variables:
 
 - `HOVER_CDP` — CDP URL (default `http://localhost:9222`)
-- `HOVER_AGENT` — agent id (omit to auto-detect; tries the user's stated preference, then the first installed agent in registry order — `claude` → `codex` → `cursor-agent` today)
+- `HOVER_AGENT` — agent id (omit to auto-detect; tries the user's stated preference, then the first installed agent in registry order — `claude` → `codex` → `cursor-agent` → `aider` → `gemini-cli` → `qwen-code` today)
 - `HOVER_MODEL` — model for the agent (default `sonnet`, much cheaper than opus)
 
 ## Sandboxing (what the smoke test enforces)
@@ -53,9 +56,9 @@ Environment variables:
 The `claude -p` invocation is locked down so Claude can only drive the browser:
 
 - `--strict-mcp-config` — ignore any MCP servers in `~/.claude/` or `.mcp.json`
-- `--allowedTools mcp__playwright` — only Playwright MCP is callable
-- `--disallowedTools Bash Edit Write Read Grep Glob Task WebFetch WebSearch` — every built-in tool explicitly denied
+- `--allowedTools mcp__playwright Skill` — only Playwright MCP and the Skill tool are callable
+- `--disallowedTools Bash Edit Write Read Grep Glob Task WebFetch WebSearch EnterWorktree CronCreate …` — every built-in tool explicitly denied (full list in `CLAUDE_DEFAULT_DISALLOWED_TOOLS` in `claude.ts`)
 - `--permission-mode dontAsk` — anything not whitelisted aborts the run
-- `--max-budget-usd 0.50` — hard ceiling per session
+- `--max-budget-usd <n>` — optional hard $ ceiling per session (no default; pass `maxBudgetUsd` in plugin options or via the CLI flag to enable)
 
 Together these enforce the rule that the spawned agent can only reach the browser via Playwright MCP — never the host filesystem, shell, or network. A hijacked prompt or hallucinated destructive action has nowhere to land.

package/dist/specs/writeSpec.js

@@ -122,10 +122,19 @@ function renderSpec(slug, displayName, description, steps, assertions) {
             continue;
         const calls = translateStep(s.tool, s.input);
         for (const c of calls) {
+            // Each emitted line gets the test-body indent (2 spaces). Lines
+            // inside an emitInteraction block carry an additional 2 spaces of
+            // relative indent embedded in the line itself, so this single
+            // 2-space prefix produces correct 4-space nesting inside `{ … }`.
             lines.push(`  ${c}`);
             hasAwait = true;
         }
     }
+    // `expect` is imported at the top of the generated file regardless of
+    // whether assertions are present — the visibility preludes emitted by
+    // translateStep depend on it for any element-targeting step. (Cheap:
+    // unused imports get tree-shaken out of any future test bundle, and
+    // Playwright's runner doesn't care.)
     if (assertions.length > 0) {
         if (hasAwait)
             lines.push('');
@@ -152,30 +161,30 @@ function translateStep(tool, rawInput) {
             return [`await page.goto(${JSON.stringify(path)});`];
         }
         case 'browser_click':
-            return [`await ${selectorFromDescription(String(input.element ?? ''))}.click();`];
+            return emitInteraction(selectorFromDescription(String(input.element ?? '')), 'click()');
         case 'browser_double_click':
-            return [`await ${selectorFromDescription(String(input.element ?? ''))}.dblclick();`];
+            return emitInteraction(selectorFromDescription(String(input.element ?? '')), 'dblclick()');
         case 'browser_hover':
-            return [`await ${selectorFromDescription(String(input.element ?? ''))}.hover();`];
+            return emitInteraction(selectorFromDescription(String(input.element ?? '')), 'hover()');
         case 'browser_fill_form': {
             const fields = input.fields ?? [];
-            return fields.map(raw => {
+            return fields.flatMap(raw => {
                 const f = raw;
                 const value = String(f.value ?? '');
                 const target = f.name ?? f.element ?? '';
-                return `await ${selectorForFormField(target, f.type)}.fill(${JSON.stringify(value)});`;
+                return emitInteraction(selectorForFormField(target, f.type), `fill(${JSON.stringify(value)})`);
             });
         }
         case 'browser_type': {
             const text = String(input.text ?? '');
             const target = String(input.element ?? '');
-            return [`await ${selectorFromDescription(target)}.fill(${JSON.stringify(text)});`];
+            return emitInteraction(selectorFromDescription(target), `fill(${JSON.stringify(text)})`);
         }
         case 'browser_select_option': {
             const target = String(input.element ?? '');
             const values = input.values;
             const val = (values && values.length > 0 ? values[0] : input.value) ?? '';
-            return [`await ${selectorFromDescription(target)}.selectOption(${JSON.stringify(String(val))});`];
+            return emitInteraction(selectorFromDescription(target), `selectOption(${JSON.stringify(String(val))})`);
         }
         case 'browser_press_key': {
             const key = String(input.key ?? '');
@@ -197,6 +206,40 @@ function translateStep(tool, rawInput) {
             return [`// TODO: translate ${tool} (skipped — unknown tool for spec emission)`];
     }
 }
+/**
+ * Wrap an interaction (click / dblclick / hover / fill / selectOption) in a
+ * block-scoped visibility prelude. Replaces the prior one-liner emit:
+ *
+ *    // before
+ *    await page.getByRole('button', { name: 'Submit' }).click();
+ *
+ *    // after
+ *    {
+ *      const el = page.getByRole('button', { name: 'Submit' });
+ *      await expect(el).toBeVisible();
+ *      await el.click();
+ *    }
+ *
+ * Why: `getByRole` is "visible OR attached" by default. A button that drifted
+ * behind a closed `<details>` / kebab menu / drawer is still in the role tree,
+ * so the locator stays green AND `.click()` may still fire — but the actual
+ * user flow has degraded. Asserting visibility before each interaction makes
+ * that drift fail loudly with "Locator expected to be visible" instead of
+ * silently passing or timing out generically. Issue raised externally;
+ * the fix is a 1-emit change here.
+ *
+ * Block-scoped (`{ … }`) so each step's local `el` doesn't shadow the next.
+ * The 4-line shape keeps the diff readable when re-record regenerates a spec.
+ */
+function emitInteraction(selectorExpr, action) {
+    return [
+        `{`,
+        `  const el = ${selectorExpr};`,
+        `  await expect(el).toBeVisible();`,
+        `  await el.${action};`,
+        `}`,
+    ];
+}
 /**
  * Parse element descriptions like "Submit button" / "+1 button" / "Email
  * textbox" / "Plan radio" into `getByRole(role, { name })` selectors. The

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hover-dev/core",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Hover's local Node service: agent invocation, Playwright CDP preflight, WebSocket bridge.",
   "license": "Apache-2.0",
   "author": "Hyperyond",