@mmerterden/multi-agent-toolkit-mcp 3.13.1 → 3.15.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mmerterden/multi-agent-toolkit-mcp",
-  "version": "3.13.1",
-  "description": "MCP server for iOS Simulator, Android Emulator and headless web control. 115 tools: device automation (tap/swipe/type), accessibility audits, visual diff, crash logs, App Store / Play Store pre-submission compliance. Runs standalone over stdio with any MCP client.",
+  "version": "3.15.0",
+  "description": "MCP server for iOS Simulator, Android Emulator and headless web control. 118 tools: device automation (tap/swipe/type), accessibility audits, visual diff, crash logs, App Store / Play Store pre-submission compliance, offline CVSS scoring + dependency inventory. Runs standalone over stdio with any MCP client.",
   "type": "module",
   "main": "index.js",
   "bin": {
@@ -10,7 +10,7 @@
   },
   "scripts": {
     "start": "node index.js",
-    "test": "node --test tools/design-check/__tests__/design-check.test.mjs tools/design-check/__tests__/plan-determinism.test.mjs tools/ios-app-store-audit/__tests__/app-store-audit.test.mjs tools/ios-testflight/__tests__/testflight.test.mjs tools/ui-inspect/__tests__/ui-inspect.test.mjs tools/code-intel/__tests__/code-intel.test.mjs tools/pass-kit/__tests__/pass-kit.test.mjs tools/crash-logs/__tests__/crash-logs.test.mjs tools/a11y/__tests__/a11y.test.mjs tools/launch-time/__tests__/launch-time.test.mjs tools/memory/__tests__/memory.test.mjs tools/offload/__tests__/offload.test.mjs tools/context/__tests__/context.test.mjs __tests__/server-tools.test.mjs __tests__/injection.test.mjs",
+    "test": "node --test tools/design-check/__tests__/design-check.test.mjs tools/design-check/__tests__/plan-determinism.test.mjs tools/design-check/__tests__/design-targets.test.mjs tools/ios-app-store-audit/__tests__/app-store-audit.test.mjs tools/ios-testflight/__tests__/testflight.test.mjs tools/ui-inspect/__tests__/ui-inspect.test.mjs tools/code-intel/__tests__/code-intel.test.mjs tools/pass-kit/__tests__/pass-kit.test.mjs tools/crash-logs/__tests__/crash-logs.test.mjs tools/a11y/__tests__/a11y.test.mjs tools/launch-time/__tests__/launch-time.test.mjs tools/memory/__tests__/memory.test.mjs tools/offload/__tests__/offload.test.mjs tools/context/__tests__/context.test.mjs tools/security/__tests__/security.test.mjs tools/policy/__tests__/policy.test.mjs tools/spawn-collect/__tests__/spawn-collect.test.mjs __tests__/server-tools.test.mjs __tests__/injection.test.mjs __tests__/hardening.test.mjs",
     "gates": "bash scripts/gates.sh"
   },
   "keywords": [
@@ -62,7 +62,7 @@
     "url": "https://github.com/mmerterden/multi-agent-toolkit-mcp/issues"
   },
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=22.13.0"
   },
   "files": [
     "index.js",

package/tools/context/index.js

@@ -8,7 +8,8 @@
 // right 60 lines and reading the first 60 that happen to contain the word.
 //
 // So the same file is also indexed: chunked, stored in SQLite FTS5, and ranked
-// with bm25(). node:sqlite ships with Node, so this costs no dependency.
+// with bm25(). node:sqlite ships with Node (unflagged from 22.13), so this costs
+// no dependency.
 //
 // Three layers, cheapest first:
 //   context_search  ranked snippets, ~50-100 tokens, enough to decide
@@ -20,7 +21,7 @@
 
 import { DatabaseSync } from "node:sqlite";
 import { createHash } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, statSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, statSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { homedir } from "node:os";
 
@@ -41,8 +42,13 @@ function dbPathFor(dir) {
   return join(dir, "context.db");
 }
 
+// Owner-only, like the offload directory whose payloads it indexes. A
+// directory that already exists is narrowed as well: mkdir's mode applies only
+// to what it creates, and an index left 0755 by an older install or another
+// tool would expose every indexed passage to other accounts.
 export function openIndex(dir = INDEX_DIR) {
-  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 0o700 });
+  chmodSync(dir, 0o700);
   const db = new DatabaseSync(dbPathFor(dir));
   db.exec(`
     create table if not exists docs (
@@ -86,22 +92,32 @@ export function indexFile(db, path) {
     const n = db.prepare("select count(*) as n from chunks where doc_id = ?").get(existing.id);
     return { indexed: false, reason: "unchanged", docId: existing.id, chunks: n?.n ?? 0 };
   }
-  if (existing) {
-    db.prepare("delete from chunks where doc_id = ?").run(existing.id);
-    db.prepare("delete from docs where id = ?").run(existing.id);
-  }
-  db.prepare("insert into docs (path, mtime, size) values (?, ?, ?)").run(
-    path,
-    Math.floor(st.mtimeMs),
-    st.size,
-  );
-  const docId = db.prepare("select id from docs where path = ?").get(path).id;
-  const insert = db.prepare(
-    "insert into chunks (body, doc_id, first_line, last_line) values (?, ?, ?, ?)",
-  );
   const pieces = chunk(readFileSync(path, "utf8"));
-  for (const p of pieces) insert.run(p.body, docId, p.firstLine, p.lastLine);
-  return { indexed: true, docId, chunks: pieces.length };
+  // One transaction for the doc row and all of its chunks. Committed row by
+  // row, a failure partway leaves a doc row whose (mtime, size) matches the
+  // file, and every later call answers "unchanged" over a partial set of chunks.
+  db.exec("begin");
+  try {
+    if (existing) {
+      db.prepare("delete from chunks where doc_id = ?").run(existing.id);
+      db.prepare("delete from docs where id = ?").run(existing.id);
+    }
+    db.prepare("insert into docs (path, mtime, size) values (?, ?, ?)").run(
+      path,
+      Math.floor(st.mtimeMs),
+      st.size,
+    );
+    const docId = db.prepare("select id from docs where path = ?").get(path).id;
+    const insert = db.prepare(
+      "insert into chunks (body, doc_id, first_line, last_line) values (?, ?, ?, ?)",
+    );
+    for (const p of pieces) insert.run(p.body, docId, p.firstLine, p.lastLine);
+    db.exec("commit");
+    return { indexed: true, docId, chunks: pieces.length };
+  } catch (e) {
+    db.exec("rollback");
+    throw e;
+  }
 }
 
 // FTS5 treats a bare `-` or an unbalanced quote as syntax, and a caller typing

package/tools/design-check/component-walk.js

@@ -0,0 +1,359 @@
+/**
+ * design_component_variants - resolve a design node to the component set it
+ * belongs to and list that set's variants, so a live component can be compared
+ * against its own variant instead of against a screen frame.
+ *
+ * A screen frame carries whatever content its mock fixture had (five rows in the
+ * design, three in the app), so every container height and every position below
+ * it differs for a reason that is not a defect. A component set already models
+ * those states as variants (`Rows=3`, `State=Error`), and comparing the live
+ * component region against the matching variant removes the fixture dimension.
+ *
+ * Nothing is fetched here. The caller supplies what it already fetched from
+ * Figma, per file:
+ *   - `nodes`     a REST GET /v1/files/:key/nodes response
+ *                 ({ nodes: { <id>: { document, components, componentSets } } }),
+ *   - `metadata`  or MCP get_metadata XML, whose x/y are relative to the parent
+ * plus, optionally, the library's GET /v1/files/:key/component_sets listing,
+ * which is how a set living in another file is located. When a node the walk
+ * needs is not in any supplied source, it is returned in `needs[]` for the
+ * caller to fetch, rather than guessed.
+ *
+ * Output per requested node:
+ *   { requested, resolvedVia: "instance"|"component"|"component-set", instanceOf?,
+ *     component, componentSet: { nodeId, name, fileKey }, codeConnect,
+ *     properties: { <prop>: [values] },
+ *     variants: [ { name, nodeId, fileKey, properties, frame:{w,h}, spec[],
+ *                   render:{ fileKey, nodeId, format, scale }, image } ],
+ *     matches: [ { stateId, variant, nodeId, score } ], unmatchedStates: [...] }
+ * plus top-level `needs[]`, `rendersNeeded[]` and `unresolved[]`.
+ *
+ * `spec` is geometry only (role, label, text, identifier, x, y, w, h) relative
+ * to the variant's own origin: it is the `figma_spec` for design_visual_compare
+ * with `figma_frame` = the variant's frame. Colour and typography expectations
+ * are deliberately not emitted.
+ */
+
+import { flattenFigmaNode } from "./geometry.js";
+
+const VARIANT_NAME_RE = /^\s*[^=,]+=[^=,]*(\s*,\s*[^=,]+=[^=,]*)*\s*$/;
+const MATCH_THRESHOLD = 0.5;
+
+export function variantProperties(name) {
+  if (!VARIANT_NAME_RE.test(String(name || ""))) return {};
+  const out = {};
+  for (const part of String(name).split(",")) {
+    const [k, ...v] = part.split("=");
+    out[k.trim()] = v.join("=").trim();
+  }
+  return out;
+}
+
+function decodeXml(s) {
+  return String(s).replace(/&(amp|lt|gt|quot|apos|#39);/g, (_, e) => (
+    { amp: "&", lt: "<", gt: ">", quot: '"', apos: "'", "#39": "'" }[e]
+  ));
+}
+
+const XML_TYPES = { instance: "INSTANCE", text: "TEXT", frame: "FRAME", group: "GROUP", section: "SECTION" };
+
+// MCP get_metadata XML -> REST-shaped documents with absolute bounding boxes.
+function parseMetadataXml(xml) {
+  const roots = [];
+  const stack = [];
+  const tagRe = /<(\/?)([A-Za-z][\w-]*)((?:\s+[\w:-]+\s*=\s*"[^"]*")*)\s*(\/?)>/g;
+  for (let m; (m = tagRe.exec(xml)); ) {
+    const [, closing, tag, attrText, selfClosing] = m;
+    if (closing) { stack.pop(); continue; }
+    const attrs = {};
+    for (const a of attrText.matchAll(/([\w:-]+)\s*=\s*"([^"]*)"/g)) attrs[a[1]] = decodeXml(a[2]);
+    const parent = stack[stack.length - 1] || null;
+    const px = parent ? parent.absoluteBoundingBox.x : 0;
+    const py = parent ? parent.absoluteBoundingBox.y : 0;
+    const node = {
+      id: attrs.id, name: attrs.name || "", tag,
+      type: XML_TYPES[tag] || tag.toUpperCase(),
+      absoluteBoundingBox: {
+        x: px + Number(attrs.x || 0), y: py + Number(attrs.y || 0),
+        width: Number(attrs.width || 0), height: Number(attrs.height || 0),
+      },
+      children: [],
+    };
+    if (node.type === "TEXT") node.characters = node.name;
+    (parent ? parent.children : roots).push(node);
+    if (!selfClosing) stack.push(node);
+  }
+  // A symbol is a component; one whose children are all variant-named is the set.
+  const settle = (n) => {
+    n.children.forEach(settle);
+    if (n.tag === "symbol") {
+      const variantKids = n.children.length && n.children.every((c) => c.tag === "symbol" && VARIANT_NAME_RE.test(c.name));
+      n.type = variantKids ? "COMPONENT_SET" : "COMPONENT";
+    }
+  };
+  roots.forEach(settle);
+  return roots;
+}
+
+function indexSource(src, i) {
+  if (!src || typeof src !== "object") throw new Error(`sources[${i}] must be an object`);
+  if (typeof src.fileKey !== "string" || !src.fileKey) throw new Error(`sources[${i}].fileKey is required`);
+  const docs = [];
+  const components = {}, componentSets = {};
+  if (src.nodes && typeof src.nodes === "object") {
+    for (const entry of Object.values(src.nodes.nodes || {})) {
+      if (entry && entry.document) docs.push(entry.document);
+      Object.assign(components, entry?.components || {});
+      Object.assign(componentSets, entry?.componentSets || {});
+    }
+  } else if (typeof src.metadata === "string") {
+    docs.push(...parseMetadataXml(src.metadata));
+  } else {
+    throw new Error(`sources[${i}] needs nodes or metadata`);
+  }
+  const byId = new Map(), parentOf = new Map();
+  const visit = (n, parent) => {
+    if (!n || typeof n !== "object" || !n.id) return;
+    if (!byId.has(n.id)) byId.set(n.id, n);
+    if (parent) parentOf.set(n.id, parent);
+    for (const c of n.children || []) visit(c, n);
+  };
+  docs.forEach((d) => visit(d, null));
+  return { fileKey: src.fileKey, byId, parentOf, components, componentSets };
+}
+
+function componentSetListing(componentSets) {
+  const list = Array.isArray(componentSets) ? componentSets
+    : (componentSets && componentSets.meta && Array.isArray(componentSets.meta.component_sets)) ? componentSets.meta.component_sets
+    : [];
+  return list.filter((e) => e && e.node_id && e.file_key);
+}
+
+// Parses https://www.figma.com/design/<key>/...?node-id=1-2 (also /file/).
+// The query is decoded first: a link copied from a browser or a chat client
+// often arrives as node-id=1%3A2, which is the same node.
+export function parseFigmaUrl(url) {
+  const raw = String(url || "");
+  const q = raw.indexOf("?");
+  let decoded = raw;
+  if (q >= 0) {
+    try {
+      decoded = raw.slice(0, q + 1) + decodeURIComponent(raw.slice(q + 1));
+    } catch {
+      return null;
+    }
+  }
+  const m = /figma\.com\/(?:design|file)\/([A-Za-z0-9]+)(?:\/branch\/([A-Za-z0-9]+))?[^?]*\?(?:[^#]*&)?node-id=([0-9]+[-:][0-9]+)/.exec(decoded);
+  if (!m) return null;
+  return { fileKey: m[2] || m[1], nodeId: m[3].replace("-", ":") };
+}
+
+function codeConnectIndex(entries) {
+  const out = [];
+  for (const e of entries || []) {
+    if (!e || !e.component) continue;
+    const ref = e.url ? parseFigmaUrl(e.url) : (e.nodeId ? { fileKey: e.fileKey || null, nodeId: String(e.nodeId).replace("-", ":") } : null);
+    if (ref) out.push({ ...ref, component: String(e.component), source: e.source || null });
+  }
+  return out;
+}
+
+const tokens = (s) => new Set(String(s || "")
+  .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
+  .toLowerCase()
+  .split(/[^a-z0-9]+/)
+  .filter(Boolean));
+
+// How much of the state's wording the variant name covers: |state ∩ variant| /
+// |state tokens|. Coverage rather than Jaccard, because dividing by the union
+// lets the property names and the other properties of a multi-property variant
+// dilute the score: a one-word state such as "Error" would score 1/4 against
+// "State=Error, Size=L" and never clear the threshold. Jaccard is the second
+// key, so between two variants that cover the state equally the tighter name
+// wins.
+function similarity(a, b) {
+  const x = tokens(a), y = tokens(b);
+  if (!x.size || !y.size) return { coverage: 0, jaccard: 0 };
+  let inter = 0;
+  for (const t of x) if (y.has(t)) inter++;
+  return { coverage: inter / x.size, jaccard: inter / (x.size + y.size - inter) };
+}
+
+// Best variant per state, accepted only when it clears the threshold and no
+// other variant ties it on both keys: an ambiguous state is reported, never
+// assigned.
+function matchStates(states, variants) {
+  const matches = [], unmatched = [];
+  for (const s of states || []) {
+    if (!s || !s.id) continue;
+    const text = s.label || s.id;
+    const scored = variants.map((v) => ({ v, ...similarity(text, v.name) }))
+      .sort((a, b) => b.coverage - a.coverage || b.jaccard - a.jaccard || a.v.nodeId.localeCompare(b.v.nodeId));
+    const best = scored[0];
+    const tie = scored[1] && best && scored[1].coverage === best.coverage && scored[1].jaccard === best.jaccard;
+    if (best && best.coverage >= MATCH_THRESHOLD && !tie) {
+      matches.push({ stateId: String(s.id), variant: best.v.name, nodeId: best.v.nodeId, score: Math.round(best.coverage * 100) / 100 });
+    } else {
+      unmatched.push({
+        stateId: String(s.id), label: text,
+        reason: !best || best.coverage < MATCH_THRESHOLD ? "no variant name is close enough" : "two or more variants match equally",
+        candidates: scored.filter((x) => x.coverage > 0).slice(0, 3).map((x) => x.v.name),
+      });
+    }
+  }
+  const byId = (a, b) => a.stateId.localeCompare(b.stateId);
+  return { matches: matches.sort(byId), unmatched: unmatched.sort(byId) };
+}
+
+function geometrySpec(doc) {
+  const bb = doc.absoluteBoundingBox || { x: 0, y: 0 };
+  return flattenFigmaNode(doc, bb.x, bb.y).map(({ role, label, text, identifier, x, y, w, h }) => ({ role, label, text, identifier, x, y, w, h }));
+}
+
+export function walkComponents({ sources, componentSets = null, nodeIds = null, codeConnect = [], states = [], renders = {} } = {}) {
+  if (!Array.isArray(sources) || !sources.length) throw new Error("sources must be a non-empty array of { fileKey, nodes | metadata }");
+  const idx = sources.map(indexSource);
+  const listing = componentSetListing(componentSets);
+  const cc = codeConnectIndex(codeConnect);
+
+  const find = (nodeId, fileKey = null) => {
+    for (const s of idx) {
+      if (fileKey && s.fileKey !== fileKey) continue;
+      const n = s.byId.get(nodeId);
+      if (n) return { node: n, src: s };
+    }
+    return null;
+  };
+  // Node ids are only unique within a file, so a reference found in one source
+  // is looked up there first; another source is a fallback, not a peer.
+  const findNear = (nodeId, src) => find(nodeId, src.fileKey) || find(nodeId);
+
+  // A requested id may be `fileKey/nodeId` to pick one of several files that
+  // use the same id.
+  const parseRequested = (raw) => {
+    const slash = raw.lastIndexOf("/");
+    return slash > 0 ? { fileKey: raw.slice(0, slash), nodeId: raw.slice(slash + 1) } : { fileKey: null, nodeId: raw };
+  };
+
+  const requested = nodeIds && nodeIds.length ? nodeIds.map(String) : [...idx[0].byId.keys()].filter((id) => !idx[0].parentOf.has(id));
+  const components = [], needs = [], unresolved = [];
+  const needKeys = new Set();
+  const need = (fileKey, nodeId, why) => {
+    const k = `${fileKey}/${nodeId}`;
+    if (!needKeys.has(k)) { needKeys.add(k); needs.push({ fileKey, nodeId, why }); }
+  };
+
+  // Where the set with this local id / key lives: the same source first, then
+  // the library listing, which carries the owning file.
+  const locateSet = (src, setId, why) => {
+    const local = src.byId.get(setId);
+    if (local && local.type === "COMPONENT_SET") return { node: local, src };
+    const meta = src.componentSets[setId];
+    const listed = listing.find((e) => (meta && meta.key && e.key === meta.key) || e.node_id === setId);
+    if (listed) {
+      const hit = find(listed.node_id, listed.file_key);
+      if (hit) return hit;
+      need(listed.file_key, listed.node_id, why(meta ? meta.name : listed.name));
+      return null;
+    }
+    need(src.fileKey, setId, why(meta ? meta.name : setId));
+    return null;
+  };
+
+  for (const id of requested) {
+    const ref = parseRequested(id);
+    const hit = find(ref.nodeId, ref.fileKey);
+    if (!hit) { unresolved.push({ nodeId: id, reason: "not present in any supplied source" }); continue; }
+    const { node, src } = hit;
+    let resolvedVia, set = null, single = null, instanceOf = null;
+    if (node.type === "COMPONENT_SET") {
+      resolvedVia = "component-set"; set = hit;
+    } else if (node.type === "COMPONENT") {
+      resolvedVia = "component";
+      const parent = src.parentOf.get(node.id);
+      if (parent && parent.type === "COMPONENT_SET") set = { node: parent, src };
+      else if (src.components[node.id] && src.components[node.id].componentSetId) {
+        set = locateSet(src, src.components[node.id].componentSetId, (n) => `component set of ${id} (${n})`);
+        if (!set) continue;
+      } else single = hit;
+    } else if (node.type === "INSTANCE" && node.componentId) {
+      resolvedVia = "instance"; instanceOf = node.componentId;
+      const meta = src.components[node.componentId];
+      if (meta && meta.componentSetId) {
+        set = locateSet(src, meta.componentSetId, (n) => `component set of ${id} (${n})`);
+        if (!set) continue;
+      } else {
+        const comp = findNear(node.componentId, src);
+        if (!comp) { need(src.fileKey, node.componentId, `main component of ${id}`); continue; }
+        single = comp;
+      }
+    } else {
+      unresolved.push({ nodeId: id, reason: `a ${node.type || "node"} that is not a component, variant or instance` });
+      continue;
+    }
+
+    const owner = set || single;
+    const variantDocs = set ? (owner.node.children || []).filter((c) => c.type === "COMPONENT" || VARIANT_NAME_RE.test(c.name)) : [owner.node];
+    const variants = variantDocs.map((doc) => {
+      const bb = doc.absoluteBoundingBox || { width: 0, height: 0 };
+      const image = renders[`${owner.src.fileKey}/${doc.id}`] || renders[doc.id] || null;
+      return {
+        name: doc.name, nodeId: doc.id, fileKey: owner.src.fileKey,
+        properties: variantProperties(doc.name),
+        frame: { w: Math.round(bb.width), h: Math.round(bb.height) },
+        spec: geometrySpec(doc),
+        render: { fileKey: owner.src.fileKey, nodeId: doc.id, format: "png", scale: 2 },
+        image,
+      };
+    });
+    const properties = {};
+    for (const v of variants) {
+      for (const [k, val] of Object.entries(v.properties)) (properties[k] = properties[k] || new Set()).add(val);
+    }
+    for (const k of Object.keys(properties)) properties[k] = [...properties[k]].sort((a, b) => a.localeCompare(b, "en", { numeric: true }));
+
+    const ownerRef = { nodeId: owner.node.id, name: owner.node.name, fileKey: owner.src.fileKey };
+    const mapping = cc.find((e) => e.nodeId === ownerRef.nodeId && (!e.fileKey || e.fileKey === ownerRef.fileKey))
+      || cc.find((e) => variants.some((v) => v.nodeId === e.nodeId && (!e.fileKey || e.fileKey === v.fileKey)))
+      || null;
+    const { matches, unmatched } = matchStates(states, variants);
+    components.push({
+      requested: id, resolvedVia, ...(instanceOf ? { instanceOf } : {}),
+      component: mapping ? mapping.component : ownerRef.name,
+      componentSet: set ? ownerRef : null,
+      ...(set ? {} : { mainComponent: ownerRef }),
+      codeConnect: mapping ? { component: mapping.component, source: mapping.source } : null,
+      properties, variants, matches, unmatchedStates: unmatched,
+    });
+  }
+
+  const rendersNeeded = [];
+  const seenRender = new Set();
+  for (const c of components) {
+    for (const v of c.variants) {
+      const k = `${v.fileKey}/${v.nodeId}`;
+      if (v.image || seenRender.has(k)) continue;
+      seenRender.add(k);
+      rendersNeeded.push({ fileKey: v.fileKey, nodeId: v.nodeId, variant: v.name });
+    }
+  }
+  return { components, needs, rendersNeeded, unresolved };
+}
+
+/**
+ * The per-finding component fields design_report renders: the main component
+ * link plus one thumbnail per variant. `variantNodeId` names the variant the
+ * capture was compared against.
+ */
+export function componentFindingFields(entry, variantNodeId = null) {
+  if (!entry) return {};
+  const owner = entry.componentSet || entry.mainComponent || {};
+  const chosen = entry.variants.find((v) => v.nodeId === variantNodeId) || null;
+  return {
+    component: entry.component,
+    componentNode: owner.nodeId || null,
+    componentFileKey: owner.fileKey || null,
+    ...(chosen ? { componentVariant: chosen.name } : {}),
+    componentVariants: entry.variants.map((v) => ({ name: v.name, node: v.nodeId, fileKey: v.fileKey, image: v.image })),
+  };
+}

package/tools/design-check/content-cardinality.js

@@ -4,7 +4,7 @@
  *
  * The problem (docs/design-check-gaps.md section 1). A live capture is compared
  * against a screen frame, and a screen frame carries whatever the mock fixture
- * produced. A design showing 5 passenger rows against an app rendering 3 makes
+ * produced. A design showing 5 item rows against an app rendering 3 makes
  * every container height and every downstream position differ for a reason that
  * is not a defect. On a real 109-target module that noise dominated the report.
  *
@@ -65,8 +65,8 @@ const NEVER_DEMOTE_TYPES = new Set([
 
 /**
  * Strip the varying tail from an element name so repeated siblings collapse to
- * one group key: `passengerRow_2` / `passenger row 3` / `PassengerRow-4` all
- * become `passengerrow`.
+ * one group key: `itemRow_2` / `item row 3` / `ItemRow-4` all
+ * become `itemrow`.
  *
  * @param {string} name
  * @returns {string}