@jrpool/kilotest 60.0.10 → 60.1.1

package/api/util.test.ts

@@ -16,7 +16,7 @@ for (const key of ['MANAGER_EMAIL', 'ALERT_API_HOST', 'ALERT_API_PATH', 'ALERT_A
   process.env[key] = '';
 }
 
-import {getReportBasics, getResponseMetadata, getRuleEngineFacts, getRuleEnginesFacts, getIssueSpec, getToolsFacts} from './util.ts';
+import {getReportBasics, getResponseMetadata, getRuleEngineFacts, getRuleEnginesFacts, getIssueSpec, getToolsFacts, getRequestFailureReason} from './util.ts';
 import {processTestRequest} from '../util.ts';
 
 // SETUP
@@ -136,3 +136,12 @@ test('getToolsFacts returns facts about the Kilotest tool collection', () => {
   assert.ok(facts.description['how to retrieve findings']);
   assert.ok(facts.description['how to generate more findings']);
 });
+
+test('getRequestFailureReason returns the URL-length reason for a urlLength result', () => {
+  // processTestRequest can return urlLength for a new-test request whose URL is
+  // outside the 12-to-300-character bound. No current caller reaches this
+  // branch, because each checks length itself first, but the mapping must be
+  // correct for any caller that relies on the shared check instead.
+  const reason = getRequestFailureReason('urlLength');
+  assert.equal(reason, 'the URL is not between 12 and 300 characters long.');
+});

package/api/util.ts

@@ -70,9 +70,9 @@ export const getToolsFacts = () => ({
 });
 // Returns the human-readable reason a test/retest/instant-test request was not
 // processed, given the result processTestRequest returned. requestResult is always a
-// rejection reason here ('description', 'url', 'queueFull', or an unrecognized value
-// meaning 'duplicate'); callers pass their own extra branch for a requestResult value
-// specific to their own request type ('reportExists' for requestNewTest, 'superseded' for
+// rejection reason here ('description', 'url', 'urlLength', 'queueFull', or an
+// unrecognized value meaning 'duplicate'); callers pass their own extra branch for a
+// requestResult value specific to their own request type ('reportExists' for requestNewTest, 'superseded' for
 // requestRetest), since that is the one branch not shared between them.
 export const getRequestFailureReason = (
   requestResult: Exclude<TestRequestResult, 'ok'>,
@@ -84,6 +84,9 @@ export const getRequestFailureReason = (
   if (requestResult === 'url') {
     return 'a request to test a page with the same URL is already approved.';
   }
+  if (requestResult === 'urlLength') {
+    return 'the URL is not between 12 and 300 characters long.';
+  }
   if (extraBranch && requestResult === extraBranch.result) {
     return extraBranch.reason;
   }

package/index.test.ts

@@ -489,6 +489,30 @@ test('POST /requestNewTest.html with invalid data returns an error', async () =>
   assert.ok(res.body.includes('Invalid test request'));
 });
 
+test('POST /requestNewTest.html with a URL shorter than 12 characters returns an error', async () => {
+  // processTestRequest enforces the 12-to-300-character bound on new-test
+  // request URLs for every surface, so this 11-character URL is rejected even
+  // though it is a syntactically valid https URL.
+  const res = await formRequest('POST', '/requestNewTest.html', {
+    description: `Short URL Page ${uniqueStamp}`,
+    url: 'https://a.b',
+    why: 'Because accessibility matters'
+  });
+  assert.equal(res.statusCode, 400);
+  assert.ok(res.body.includes('The URL must be between 12 and 300 characters long'));
+});
+
+test('POST /requestNewTest.html with a URL longer than 300 characters returns an error', async () => {
+  // The same bound rejects this 320-character URL.
+  const res = await formRequest('POST', '/requestNewTest.html', {
+    description: `Long URL Page ${uniqueStamp}`,
+    url: `https://example.com/${'a'.repeat(300)}`,
+    why: 'Because accessibility matters'
+  });
+  assert.equal(res.statusCode, 400);
+  assert.ok(res.body.includes('The URL must be between 12 and 300 characters long'));
+});
+
 test('POST /requestNewTest.html with an unreadable body returns an error', async () => {
   const res = await request('POST', '/requestNewTest.html', 'rawbody', {'content-type': 'text/plain'});
   assert.equal(res.statusCode, 400);

package/lhm.plugin.json

@@ -4423,5 +4423,5 @@
       }
     }
   ],
-  "version": "60.0.10"
+  "version": "60.1.1"
 }

package/openapi-3.0.yaml

@@ -2,7 +2,7 @@ openapi: 3.0.3
 info:
   title: Kilotest API
   description: 'Kilotest is an ensemble testing and reporting service for front-end web quality. It uses an ensemble of 12 rule engines to test web pages for front-end quality (accessibility, usability, and web standards, including HTML, CSS, ARIA, and WCAG). Kilotest acts as a web server for human users, an MCP server for AI platforms, and an API for programmatic access. With this API you can request that a page be tested or retested, discover available reports, incrementally retrieve facts from a report: from what reports are available, to what issues were reported in one report, to what elements violated one issue, to what diagnoses rule engines gave for one violation.'
-  version: 60.0.10
+  version: 60.1.1
   license:
     name: MIT
     url: https://github.com/jrpool/kilotest/blob/main/LICENSE

package/openapi.yaml

@@ -2,7 +2,7 @@ openapi: 3.1.0
 info:
   title: Kilotest API
   description: 'Kilotest is an ensemble testing and reporting service for front-end web quality. It uses an ensemble of 12 rule engines to test web pages for front-end quality (accessibility, usability, and web standards, including HTML, CSS, ARIA, and WCAG). Kilotest acts as a web server for human users, an MCP server for AI platforms, and an API for programmatic access. With this API you can request that a page be tested or retested, discover available reports, incrementally retrieve facts from a report: from what reports are available, to what issues were reported in one report, to what elements violated one issue, to what diagnoses rule engines gave for one violation.'
-  version: 60.0.10
+  version: 60.1.1
   license:
     name: MIT
     identifier: MIT

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jrpool/kilotest",
-  "version": "60.0.10",
+  "version": "60.1.1",
   "description": "Ensemble testing for front-end web quality",
   "type": "module",
   "main": "index.ts",

package/server.json

@@ -6,7 +6,7 @@
     "url": "https://github.com/jrpool/kilotest",
     "source": "github"
   },
-  "version": "60.0.10",
+  "version": "60.1.1",
   "remotes": [
     {
       "type": "streamable-http",

package/util.test.ts

@@ -757,6 +757,23 @@ test('processTestRequest succeeds for a valid new-test request', {timeout: 500},
   await fs.writeFile(testRequestsPath(), '{}\n');
 });
 
+test('processTestRequest returns a urlLength error for a URL shorter than 12 characters', {timeout: 500}, async () => {
+  // New-test request URLs must be 12 to 300 characters long; the bound lives
+  // here, not in callers, so it applies on every submission surface.
+  const {result} = await processTestRequest(
+    'because accessibility', {description: 'Short URL Page', url: 'https://a.b'}
+  );
+  assert.equal(result, 'urlLength');
+});
+
+test('processTestRequest returns a urlLength error for a URL longer than 300 characters', {timeout: 500}, async () => {
+  const {result} = await processTestRequest(
+    'because accessibility',
+    {description: 'Long URL Page', url: `https://example.com/${'a'.repeat(300)}`}
+  );
+  assert.equal(result, 'urlLength');
+});
+
 test('processTestRequest returns a duplicate error for a repeated request', {timeout: 500}, async () => {
   // Reset testRequests.json to empty, then make a successful request.
   await fs.writeFile(testRequestsPath(), '{}\n');

package/util.ts

@@ -86,7 +86,8 @@ export type TestRequests = Record<string, TestRequest[]>;
 // retest a page that already has a report (a request kind); the two must not be
 // confused with one another.
 export type TestRequestResult
-= 'url' | 'description' | 'reportExists' | 'duplicate' | 'superseded' | 'nonreport' | 'queueFull' | 'ok';
+= 'url' | 'description' | 'reportExists' | 'duplicate' | 'superseded' | 'nonreport' | 'queueFull'
+| 'urlLength' | 'ok';
 
 // Target of a new-test or retest request: a description and URL for a new-test request,
 // or the identifier of the cited report for a retest request.
@@ -1019,6 +1020,12 @@ export const processTestRequest = (
   else {
     requestType = 'newTest';
     ({description, url} = target);
+    // If the URL violates the 12-to-300-character bound on new-test requests:
+    if (url.length < 12 || url.length > 300) {
+      // Reject it here, where every new-test request passes, rather than in each
+      // caller, so the bound applies on every submission surface.
+      return {result: 'urlLength', description, url};
+    }
   }
   try {
     // Get any property the page shares with a claimed job.

package/web/listDiagnoses/index.ts

@@ -60,9 +60,9 @@ const populateQuery = async (
   // If the violator has a linkable text item, add a take-me-there link.
   if (catalogIndex && catalogItem?.textLinkable) {
     const href = getTextFragmentHref(catalogItem.text as string, url);
-    const label = `Take me to element ${catalogIndex} on the page (in a new tab)`;
-    const link = `<a href="${href}" target="_blank" aria-label="${label}">Take me there</a>`;
-    query.takeMeThere = `${margin}    <p>${link}</p>`;
+    const label = `Take me there (to element ${catalogIndex})`;
+    const link = `<a href="${href}" aria-label="${label}">Take me there</a>`;
+    query.takeMeThere = `${margin}    <li>${link}</li>`;
   }
   else {
     query.takeMeThere = '';

package/web/listViolators/index.ts

@@ -124,7 +124,7 @@ const populateQuery = async (
   // If any lines contain text-fragment links:
   if (takeMeAdviceNeeded) {
     // Include advice about them in the answer.
-    query.takeMeThere = '<p><q>Take me there</q> links will open the page in a new tab and try to scroll to the element and highlight it. This does not always succeed. You can return here by closing the new tab.</p>';
+    query.takeMeThere = '<p><q>Take me there</q> links will open the page and try to scroll to the element and highlight it. This does not always succeed.</p>';
   }
 };
 // Returns a page answering the violators question.

package/web/requestNewTest/index.ts

@@ -50,6 +50,14 @@ export const answer = async (description: string, url: string, reason: string) =
         'or post your request at https://github.com/jrpool/kilotest/issues or email info@kilotest.com.'
     }
   }
+  // Otherwise, if the URL is shorter than 12 or longer than 300 characters:
+  else if (result === 'urlLength') {
+    // Report this.
+    return {
+      status: 'error',
+      message: 'The URL must be between 12 and 300 characters long'
+    }
+  }
   // Otherwise, i.e. if a request to test a page with the same description or URL is approved:
   else {
     // Report this.

package/web/requestNewTest/requestNewTest.test.ts

@@ -144,3 +144,24 @@ test('answer returns an error with a fallback channel when the request queue is
   assert.ok(result.message.includes('https://github.com/jrpool/kilotest/issues'));
   assert.ok(result.message.includes('info@kilotest.com'));
 });
+
+test('answer returns an error for a URL shorter than 12 characters', {timeout: 500}, async () => {
+  const {answer} = await import('./index.ts');
+  // processTestRequest enforces the 12-to-300-character bound stated by the
+  // request form’s minlength/maxlength, so this 11-character URL is rejected.
+  const result: any = await answer(
+    'Short URL Page', 'https://a.b', 'Because accessibility'
+  );
+  assert.equal(result.status, 'error');
+  assert.equal(result.message, 'The URL must be between 12 and 300 characters long');
+});
+
+test('answer returns an error for a URL longer than 300 characters', {timeout: 500}, async () => {
+  const {answer} = await import('./index.ts');
+  // The same bound rejects this 320-character URL.
+  const result: any = await answer(
+    'Long URL Page', `https://example.com/${'a'.repeat(300)}`, 'Because accessibility'
+  );
+  assert.equal(result.status, 'error');
+  assert.equal(result.message, 'The URL must be between 12 and 300 characters long');
+});

package/web/requestNewTestForm/index.html

@@ -21,7 +21,7 @@
         </label></p>
         <p><label>
           What is the URL (starting with <code>https://</code>)?<br>
-          <input type="url" size="60" maxlength="80" name="url" pattern="https://.+\..+" required>
+          <input type="url" size="60" minlength="12" maxlength="300" name="url" pattern="https://.+\..+" required>
         </label></p>
         <p><label>
           Why test the page?<br>