@qaguardian/playwright-score 2.1.0 → 2.2.0

package/dist/index.js

@@ -1,12 +1,13 @@
+import { triageFindings } from './finding-triage.js';
 import fs from 'node:fs';
 import path from 'node:path';
-import { globSync } from 'glob';
+import { globSync, hasMagic, Ignore } from 'glob';
 import { runEslint } from './eslint-runner.js';
 import { commonAncestorDir } from './fs-util.js';
 import { collectLocallyImportedFiles } from './import-graph.js';
 import { analyzeSource, attributeFindingScopes, countLocators, findLocalAssertionHelperNames, getTestSpans, looksLikeNonPlaywrightTest, } from './metrics.js';
 import { detectExtendedTestAliases } from './test-aliases.js';
-import { findPlaywrightConfig, findRepoBoundary, importsPlaywrightTestTransitively, parsePlaywrightConfig, resolveConfigScopedRoot, testDirEscapesRepo, } from './playwright-config.js';
+import { findPlaywrightConfig, findRepoBoundary, importsPlaywrightTestTransitively, isAncestorOrSame, parsePlaywrightConfig, resolveConfigScopedRoot, safeRealpath, testDirEscapesRepo, } from './playwright-config.js';
 import { DEFAULT_THRESHOLDS } from './profiles.js';
 import { computeScore } from './score-engine.js';
 export { computeScore, MODEL, locatorsScore, gradeFromScore, ratioDimensionScore, } from './score-engine.js';
@@ -57,6 +58,86 @@ const DEFAULT_IGNORE_GLOBS = [
     '**/playwright-report/**',
     '**/test-results/**',
 ];
+/**
+ * Wraps glob's own default `Ignore` (the string-pattern matcher behind
+ * DEFAULT_IGNORE_GLOBS/testIgnore) so this package can *also* prune the
+ * walk at a symlinked directory whose realpath escapes `realRoot`,
+ * without giving up the string-pattern ignores glob's `ignore` option
+ * only accepts one or the other of (a plain string[] XOR an IgnoreLike
+ * object — see glob's own types).
+ *
+ * Only `childrenIgnored` does the extra realpath work, and only for an
+ * actual symlink: a plain (non-symlinked) directory can't walk outside a
+ * root its own parent is already inside, so resolving its realpath would
+ * just be wasted syscalls on every directory in a large tree. This is
+ * what stops discovery from following a `testDir -> /` (or any other
+ * huge, real) symlinked directory arbitrarily far (QAG-230) — the
+ * per-match realpath containment check in expandPaths below still
+ * catches an escaping *match*, but only after the walk already paid to
+ * get there; this stops the walk itself from ever descending.
+ */
+class RepoBoundaryIgnore {
+    realRoot;
+    inner;
+    constructor(patterns, realRoot) {
+        this.realRoot = realRoot;
+        this.inner = new Ignore(patterns, {});
+    }
+    ignored(p) {
+        return this.inner.ignored(p);
+    }
+    // Forwarded, not required by any globSync call this package makes today
+    // (includeChildMatches defaults to true, which never checks for this) —
+    // present anyway so relying on that default doesn't quietly become a
+    // hard requirement if it's ever overridden.
+    add(pattern) {
+        this.inner.add(pattern);
+    }
+    childrenIgnored(p) {
+        if (this.inner.childrenIgnored(p))
+            return true;
+        if (!p.isSymbolicLink())
+            return false;
+        return !isAncestorOrSame(this.realRoot, safeRealpath(p.fullpath()));
+    }
+}
+/**
+ * The literal (non-magic) leading-directory prefix of a raw glob pattern
+ * string, resolved against `cwd` — e.g. `/abs/repoB/e2e/*.spec.ts` ->
+ * `/abs/repoB/e2e`; `../repoB/e2e/*.spec.ts` -> `<cwd>/../repoB/e2e`
+ * (collapsed by path.resolve). Used to find *that pattern's own* repo
+ * boundary (QAG-230 round 3): a bare glob-pattern input isn't necessarily
+ * anywhere near `cwd`'s own repo — it can be an absolute path, or a
+ * relative one that climbs out via `../` — into a completely different
+ * repo, and computing containment from cwd's repo root regardless made
+ * every match there look like an escape (hard-failing a perfectly legit
+ * `['/abs/repoB/e2e/*.spec.ts']` down to 0 files, where the equivalent
+ * directory input `../repoB/e2e` already scored fine).
+ *
+ * Segments are checked with glob's own `hasMagic` — with `magicalBraces`
+ * on, since an unexpanded `{a,b}` segment isn't a real, literal directory
+ * name any more than a `*` is — so this only ever returns a directory
+ * that's guaranteed to be a plain path segment, never a piece the glob
+ * engine itself still has to interpret.
+ */
+function literalPrefixDir(pattern, cwd) {
+    const segments = pattern.split('/');
+    const prefix = [];
+    let sawMagic = false;
+    for (const segment of segments) {
+        if (hasMagic(segment, { magicalBraces: true })) {
+            sawMagic = true;
+            break;
+        }
+        prefix.push(segment);
+    }
+    // No magic anywhere in the pattern: it's a literal path (only reachable
+    // here because it didn't exist on disk — an existing path is handled by
+    // the file/directory branches above) — its directory is the parent of
+    // the last (literal) segment, not the whole joined string.
+    const dirSegments = sawMagic ? prefix : prefix.slice(0, -1);
+    return path.resolve(cwd, dirSegments.join('/') || '.');
+}
 /**
  * `explicit`: paths the caller named directly (a literal existing file) —
  * always scored, regardless of whether they look like a Playwright spec.
@@ -84,6 +165,19 @@ function expandPaths(inputs, cwd) {
             // needs this wider boundary, not the narrower common ancestor of
             // only the matched spec files.
             scanRootDirs.add(abs);
+            // Repo boundary for this scan's per-match realpath containment check
+            // and glob-walk pruning below (see the containment check itself, and
+            // RepoBoundaryIgnore, for why this must be the *repo root*, not the
+            // narrower `abs`): a scan pointed at one monorepo package's specs
+            // must still keep an in-repo symlink that resolves to a sibling
+            // directory outside that subpath, while still rejecting anything
+            // that resolves outside the repo entirely (QAG-230). Starts with the
+            // same conservative fallback-to-`abs` findRepoBoundary uses
+            // elsewhere in this file; replaced below with the wider boundary a
+            // successfully parsed config already computes for testDirEscapesRepo,
+            // so both checks share one repo boundary instead of computing it
+            // twice.
+            let repoRootForContainment = findRepoBoundary(abs, abs);
             // A playwright.config.* at or above this directory, when it can be
             // read statically, is authoritative about what this target itself
             // considers a spec — see playwright-config.ts. Falls back to the
@@ -120,13 +214,14 @@ function expandPaths(inputs, cwd) {
                     // same of it), else `abs` itself. Never the filesystem root or
                     // 20 levels up — see findRepoBoundary's doc comment.
                     const repoRoot = findRepoBoundary(abs, path.dirname(configFile));
+                    repoRootForContainment = repoRoot;
                     if (testDirEscapesRepo(parsedConfig.testDirAbs, repoRoot)) {
                         // The config's testDir resolves outside the repo boundary
                         // (directly, or via a symlink — see testDirEscapesRepo). Its
                         // testMatch/testIgnore were written for that escaped testDir,
                         // so applying them to the clamped repoRoot instead would be a
                         // silent mismatch; fall back to filename-based discovery.
-                        configWarnings.push(`Found ${path.relative(cwd, configFile) || configFile} but its testDir (${parsedConfig.testDirAbs}) resolves outside the repository (${repoRoot}) — falling back to filename-based spec discovery for ${path.relative(cwd, abs) || abs}.`);
+                        configWarnings.push(`Found ${path.relative(cwd, configFile) || configFile} but its testDir (${path.relative(cwd, parsedConfig.testDirAbs) || parsedConfig.testDirAbs}) resolves outside the repository (${path.relative(cwd, repoRoot) || repoRoot}) — falling back to filename-based spec discovery for ${path.relative(cwd, abs) || abs}.`);
                     }
                     else {
                         const scopedRoot = resolveConfigScopedRoot(abs, parsedConfig.testDirAbs, repoRoot);
@@ -143,12 +238,21 @@ function expandPaths(inputs, cwd) {
                     }
                 }
             }
+            const realRepoRoot = safeRealpath(repoRootForContainment);
             for (const g of specGlobs) {
                 for (const f of globSync(g, {
                     cwd: globCwd,
                     absolute: true,
                     nodir: true,
-                    ignore: ignoreGlobs,
+                    // RepoBoundaryIgnore keeps ignoreGlobs' own string-pattern
+                    // matching (node_modules/, testIgnore, ...) and *additionally*
+                    // stops the walk from ever descending into a symlinked directory
+                    // whose realpath escapes realRepoRoot — see its own doc comment.
+                    // Pruning during the walk (not just filtering matches after the
+                    // fact, below) is what keeps a `testDir/evil -> /` (or any
+                    // other huge, real symlinked target) from making discovery
+                    // actually walk arbitrary parts of the filesystem (QAG-230).
+                    ignore: new RepoBoundaryIgnore(ignoreGlobs, realRepoRoot),
                     // glob's own default for `follow` is already false (don't
                     // descend into a symlinked directory while expanding `**`), but
                     // this is untrusted-repo territory (see testDirEscapesRepo
@@ -157,6 +261,31 @@ function expandPaths(inputs, cwd) {
                     follow: false,
                 })) {
                     const resolved = path.resolve(f);
+                    // testDirEscapesRepo (above) only clamps testDir itself before
+                    // it becomes a glob root — it can't see what the glob then
+                    // actually walks *through* on the way to a match. A testMatch
+                    // entry that names a symlinked directory by a literal path
+                    // segment (not a `**` wildcard) still gets followed even with
+                    // `follow: false` on the globSync call above, since that option
+                    // only stops `**` from *expanding into* a symlinked directory —
+                    // it doesn't stop a pattern from naming one explicitly (e.g.
+                    // `tests/evil -> /` with `testMatch: ['evil/**/*.ts']` walks
+                    // `/`, and every match still lexically looks like it's under
+                    // `abs`). The same gap lets an individually symlinked spec file
+                    // sitting directly in the repo (no testMatch trickery needed)
+                    // resolve to a file outside it. A lexical containment check
+                    // can't catch either case — both matches still "look" like they
+                    // live under `abs` right up until the symlink is resolved — so
+                    // this compares realpaths on both sides. Checked against the
+                    // *repo root* (realRepoRoot), not `abs` itself: a scan pointed
+                    // at one monorepo package's specs must still keep a match that
+                    // resolves, in-repo, to a sibling directory outside that
+                    // subpath — only a true escape of the repo itself is dropped
+                    // here (QAG-230; the config-scoped re-narrowing to `abs` right
+                    // below handles the "don't silently widen past what the caller
+                    // asked for" half of this separately).
+                    if (!isAncestorOrSame(realRepoRoot, safeRealpath(resolved)))
+                        continue;
                     // resolveConfigScopedRoot always globs from testDir (Playwright's
                     // own testMatch/testIgnore semantics — see its doc comment), which
                     // can be wider than the directory the caller actually pointed
@@ -191,16 +320,65 @@ function expandPaths(inputs, cwd) {
             }
             continue;
         }
-        // treat as glob
+        // treat as glob — a raw pattern the caller passed directly (e.g.
+        // `tests/*.spec.ts`), resolved relative to `cwd` rather than a
+        // directory this function itself walked. Same realpath containment
+        // and walk-pruning as the directory branch above applies here too
+        // (QAG-230): a bare glob input is just as capable of naming a
+        // symlinked path segment explicitly, and skipping this check here
+        // would have made switching from a directory argument to an
+        // equivalent glob argument silently bypass it.
+        //
+        // The boundary itself comes from *this pattern's own* literal prefix
+        // directory (literalPrefixDir), not from `cwd` (QAG-230 round 3) — see
+        // that function's doc comment for why cwd's repo root is the wrong
+        // boundary for a pattern that points somewhere else entirely.
+        const prefixDir = literalPrefixDir(input, cwd);
+        const repoRootForPattern = safeRealpath(findRepoBoundary(prefixDir, prefixDir));
         for (const f of globSync(input, {
             cwd,
             absolute: true,
             nodir: true,
-            ignore: DEFAULT_IGNORE_GLOBS,
+            ignore: new RepoBoundaryIgnore(DEFAULT_IGNORE_GLOBS, repoRootForPattern),
+            follow: false,
         })) {
-            expanded.add(path.resolve(f));
+            const resolved = path.resolve(f);
+            if (!isAncestorOrSame(repoRootForPattern, safeRealpath(resolved)))
+                continue;
+            expanded.add(resolved);
         }
     }
+    // De-dupe by realpath: an in-repo symlinked spec and its real target can
+    // both independently match discovery (the symlink itself sitting under
+    // one scanned root, its target sitting somewhere else under the same
+    // repo) and would otherwise be scored twice, as if they were two
+    // different files. Keeps the first lexical path per realpath, in sorted
+    // order, so which one "wins" is deterministic rather than depending on
+    // Set insertion order. Pre-existing gap, not new to the escape fixes
+    // above — those only ever drop a true escape, never a legitimate
+    // in-repo duplicate (see CHANGELOG: this can change file counts for a
+    // repo that happens to have such a link).
+    const firstPathByRealpath = new Map();
+    // Seeded with `explicit`'s own realpaths first: an explicit target and a
+    // directory scan containing a symlink to that same file are two
+    // different literal paths for the same file, so the plain "explicit
+    // wins" delete below (which only matches identical literal paths) can't
+    // catch that pairing — without this seeding, the symlinked match survives
+    // dedup (its realpath hadn't been seen yet) and gets scored a second
+    // time alongside the explicit path.
+    for (const f of [...explicit].sort()) {
+        const real = safeRealpath(f);
+        if (!firstPathByRealpath.has(real))
+            firstPathByRealpath.set(real, f);
+    }
+    for (const f of [...expanded].sort()) {
+        const real = safeRealpath(f);
+        if (!firstPathByRealpath.has(real))
+            firstPathByRealpath.set(real, f);
+    }
+    expanded.clear();
+    for (const f of firstPathByRealpath.values())
+        expanded.add(f);
     // A file can be reached both explicitly and via expansion (e.g. an
     // explicit path plus an overlapping glob); explicit intent wins.
     for (const f of explicit)
@@ -230,6 +408,7 @@ function hardFail(profile, threshold, findings, extra = {}, skippedFiles, config
             nativeLocators: 0,
             rawLocators: 0,
             unassertedTests: 0,
+            unverifiedTests: 0,
             cleanTests: 0,
             ...extra,
         },
@@ -337,13 +516,13 @@ export async function scorePaths(options) {
     // below) and this package's own AST checks (getTestSpans/countTests,
     // base-plugin.ts).
     const testAliasNames = detectExtendedTestAliases(sources, importedFiles, importBoundary);
-    const eslintFindings = await runEslint({
+    const eslintFindings = triageFindings(await runEslint({
         files,
         profile,
         cwd,
         assertFunctionNames: [...assertFunctionNames],
         testAliasNames,
-    });
+    }), { filesBase, sources, importedFiles, importBoundary });
     let totalSloc = 0;
     let totalTests = 0;
     let native = 0;

package/dist/metrics.js

@@ -1,5 +1,6 @@
 import { parseForESLint } from '@typescript-eslint/parser';
 import { countSloc } from './sloc.js';
+import { PLAYWRIGHT_API_METHODS } from './playwright-api-names.js';
 // A positive "this IS a Playwright spec" check turned out to be unsafe:
 // Playwright's own custom-fixtures pattern (test/expect re-exported from a
 // project-local module built with base.extend()) is extremely common in
@@ -269,10 +270,25 @@ export function findLocalAssertionHelperNames(source, file) {
     if (!ast)
         return [];
     const candidates = [];
+    // `test.extend({ login: async ({page}, use) => {...} })` entries are
+    // fixtures, not callable helpers: an expect in their setup says nothing
+    // about whoever uses the name, so they never register as helper names
+    // (src/finding-triage.ts resolves a fixture that hands `use()` an
+    // asserting callable). Parents are visited before children, so marking
+    // the entries when the extend call is seen is early enough.
+    const fixtureEntries = new Set();
     walk(ast, (node) => {
         let name;
         let body;
-        if (node.type === 'FunctionDeclaration') {
+        if (node.type === 'CallExpression') {
+            const callee = node.callee;
+            const arg0 = node.arguments?.[0];
+            if (callee?.type === 'MemberExpression' && callee.property?.name === 'extend' && arg0?.type === 'ObjectExpression') {
+                for (const p of arg0.properties ?? [])
+                    fixtureEntries.add(p);
+            }
+        }
+        else if (node.type === 'FunctionDeclaration') {
             const id = node.id;
             if (id?.type === 'Identifier') {
                 name = id.name;
@@ -288,6 +304,21 @@ export function findLocalAssertionHelperNames(source, file) {
                 body = init;
             }
         }
+        else if (
+        // `{ checkTab: async () => { await expect(...) } }` — an object-literal
+        // method (a fixture factory's returned object, a test.extend entry) or
+        // a class property holding an arrow function (`check = async () => {}`).
+        (node.type === 'Property' || node.type === 'PropertyDefinition') &&
+            !node.computed &&
+            !fixtureEntries.has(node)) {
+            const key = node.key;
+            const value = node.value;
+            if (key?.type === 'Identifier' &&
+                (value?.type === 'ArrowFunctionExpression' || value?.type === 'FunctionExpression')) {
+                name = key.name;
+                body = value;
+            }
+        }
         else if (node.type === 'MethodDefinition') {
             const key = node.key;
             if (!node.computed && key?.type === 'Identifier' && node.kind === 'method') {
@@ -295,7 +326,7 @@ export function findLocalAssertionHelperNames(source, file) {
                 body = node.value;
             }
         }
-        if (name && body)
+        if (name && body && !PLAYWRIGHT_API_METHODS.has(name))
             candidates.push({ name, body });
     });
     const names = new Set();

package/dist/playwright-api-names.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Method names of the Playwright objects a spec calls directly (Page,
+ * Locator, FrameLocator, Frame, APIRequestContext, Keyboard, Mouse,
+ * Touchscreen, BrowserContext). A user-defined helper that shares one of
+ * these names must never be registered as an "assertion helper": upstream
+ * `expect-expect` matches the LAST property of any call chain, so a helper
+ * `nav.goto` that asserts would make every `page.goto()` count as an
+ * assertion. One exported set, used by metrics.ts and finding-triage.ts.
+ */
+export declare const PLAYWRIGHT_API_METHODS: ReadonlySet<string>;

package/dist/playwright-api-names.js

@@ -0,0 +1,35 @@
+/**
+ * Method names of the Playwright objects a spec calls directly (Page,
+ * Locator, FrameLocator, Frame, APIRequestContext, Keyboard, Mouse,
+ * Touchscreen, BrowserContext). A user-defined helper that shares one of
+ * these names must never be registered as an "assertion helper": upstream
+ * `expect-expect` matches the LAST property of any call chain, so a helper
+ * `nav.goto` that asserts would make every `page.goto()` count as an
+ * assertion. One exported set, used by metrics.ts and finding-triage.ts.
+ */
+export const PLAYWRIGHT_API_METHODS = new Set([
+    // navigation / page
+    'goto', 'goBack', 'goForward', 'reload', 'close', 'bringToFront', 'evaluate', 'evaluateHandle',
+    'evaluateAll', 'setContent', 'content', 'title', 'url', 'screenshot', 'pdf', 'route', 'unroute',
+    'routeFromHAR', 'on', 'once', 'off', 'addInitScript', 'addScriptTag', 'addStyleTag', 'exposeFunction',
+    'exposeBinding', 'pause', 'frame', 'frames', 'mainFrame', 'opener', 'setViewportSize',
+    'setExtraHTTPHeaders', 'emulateMedia', 'dragAndDrop', 'setDefaultTimeout',
+    'setDefaultNavigationTimeout', 'storageState', 'newPage', 'cookies', 'addCookies', 'clearCookies',
+    'grantPermissions', 'clearPermissions', 'setGeolocation', 'setOffline', 'newContext', 'newCDPSession',
+    // locators
+    'locator', 'getByRole', 'getByText', 'getByLabel', 'getByPlaceholder', 'getByAltText', 'getByTitle',
+    'getByTestId', 'frameLocator', 'filter', 'and', 'or', 'first', 'last', 'nth', 'all', 'count',
+    'contentFrame', 'elementHandle', 'elementHandles', 'highlight', 'describe',
+    // actions
+    'click', 'dblclick', 'tap', 'fill', 'clear', 'type', 'press', 'pressSequentially', 'check', 'uncheck',
+    'setChecked', 'hover', 'focus', 'blur', 'selectOption', 'selectText', 'setInputFiles', 'dispatchEvent',
+    'scrollIntoViewIfNeeded', 'down', 'up', 'insertText', 'move', 'wheel',
+    // reads / waits
+    'textContent', 'innerText', 'innerHTML', 'inputValue', 'getAttribute', 'allTextContents',
+    'allInnerTexts', 'isVisible', 'isHidden', 'isEnabled', 'isDisabled', 'isEditable', 'isChecked',
+    'boundingBox', 'ariaSnapshot', 'waitFor', 'waitForSelector', 'waitForTimeout', 'waitForLoadState',
+    'waitForURL', 'waitForEvent', 'waitForFunction', 'waitForRequest', 'waitForResponse',
+    'waitForNavigation',
+    // APIRequestContext
+    'get', 'post', 'put', 'patch', 'delete', 'head', 'fetch', 'dispose',
+]);

package/dist/playwright-config.d.ts

@@ -57,6 +57,19 @@ export interface ParsedPlaywrightConfig {
  * partial or guessed reading.
  */
 export declare function parsePlaywrightConfig(configFile: string): ParsedPlaywrightConfig | undefined;
+/** Exported for index.ts's own realpath containment check on matched spec
+ * files (see expandPaths) — a config-scoped `testDir`/`testMatch` can be
+ * clamped to the repo boundary here, but the glob it drives can still walk
+ * through a symlinked directory *inside* that boundary whose real target
+ * is outside it (see testDirEscapesRepo's doc comment for why a lexical
+ * check alone isn't enough); index.ts needs the same primitive to catch
+ * that per-match, not just per-testDir. */
+export declare function isAncestorOrSame(ancestor: string, descendant: string): boolean;
+/** Resolves symlinks; falls back to the input path unchanged when it
+ * doesn't exist on disk (matches the existing "testDir doesn't exist"
+ * behavior elsewhere in this file rather than throwing). Exported for the
+ * same reason as isAncestorOrSame above. */
+export declare function safeRealpath(p: string): string;
 /**
  * True when `testDirAbs`, resolved through any symlinks, is NOT inside
  * (or equal to) `repoRoot`, also resolved through symlinks. A scored
@@ -67,6 +80,19 @@ export declare function parsePlaywrightConfig(configFile: string): ParsedPlaywri
  * this public tool glob outside its own boundary. Both sides are
  * realpath'd (never just testDirAbs) because `repoRoot` itself could in
  * principle be reached through a symlinked path.
+ *
+ * A nonexistent `testDirAbs` (nothing to score there — resolveConfigScopedRoot's
+ * own existence check downstream already handles that) short-circuits to
+ * "doesn't escape" *before* either side is realpath'd: `safeRealpath` only
+ * resolves symlinks up to the point where a path stops existing on disk,
+ * so a testDir that doesn't exist keeps its literal (unresolved) form
+ * while `repoRoot` — which does exist — gets fully resolved. On a host
+ * where the repo itself sits under a symlinked prefix (macOS: `/tmp` ->
+ * `/private/tmp`), that asymmetry alone made the two sides disagree and
+ * fired a false "escapes the repository" warning for a perfectly ordinary
+ * missing testDir (QAG-230). Checked with a plain `fs.existsSync`, not
+ * `safeRealpath`'s own try/catch, so this stays a pure existence check
+ * with no symlink resolution of its own to get wrong.
  */
 export declare function testDirEscapesRepo(testDirAbs: string, repoRoot: string): boolean;
 /**

package/dist/playwright-config.js

@@ -276,14 +276,22 @@ export function parsePlaywrightConfig(configFile) {
         testIgnore: sawTestIgnoreKey ? testIgnore : undefined,
     };
 }
-function isAncestorOrSame(ancestor, descendant) {
+/** Exported for index.ts's own realpath containment check on matched spec
+ * files (see expandPaths) — a config-scoped `testDir`/`testMatch` can be
+ * clamped to the repo boundary here, but the glob it drives can still walk
+ * through a symlinked directory *inside* that boundary whose real target
+ * is outside it (see testDirEscapesRepo's doc comment for why a lexical
+ * check alone isn't enough); index.ts needs the same primitive to catch
+ * that per-match, not just per-testDir. */
+export function isAncestorOrSame(ancestor, descendant) {
     const rel = path.relative(ancestor, descendant);
     return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
 }
 /** Resolves symlinks; falls back to the input path unchanged when it
  * doesn't exist on disk (matches the existing "testDir doesn't exist"
- * behavior elsewhere in this file rather than throwing). */
-function safeRealpath(p) {
+ * behavior elsewhere in this file rather than throwing). Exported for the
+ * same reason as isAncestorOrSame above. */
+export function safeRealpath(p) {
     try {
         return fs.realpathSync(p);
     }
@@ -301,8 +309,23 @@ function safeRealpath(p) {
  * this public tool glob outside its own boundary. Both sides are
  * realpath'd (never just testDirAbs) because `repoRoot` itself could in
  * principle be reached through a symlinked path.
+ *
+ * A nonexistent `testDirAbs` (nothing to score there — resolveConfigScopedRoot's
+ * own existence check downstream already handles that) short-circuits to
+ * "doesn't escape" *before* either side is realpath'd: `safeRealpath` only
+ * resolves symlinks up to the point where a path stops existing on disk,
+ * so a testDir that doesn't exist keeps its literal (unresolved) form
+ * while `repoRoot` — which does exist — gets fully resolved. On a host
+ * where the repo itself sits under a symlinked prefix (macOS: `/tmp` ->
+ * `/private/tmp`), that asymmetry alone made the two sides disagree and
+ * fired a false "escapes the repository" warning for a perfectly ordinary
+ * missing testDir (QAG-230). Checked with a plain `fs.existsSync`, not
+ * `safeRealpath`'s own try/catch, so this stays a pure existence check
+ * with no symlink resolution of its own to get wrong.
  */
 export function testDirEscapesRepo(testDirAbs, repoRoot) {
+    if (!fs.existsSync(testDirAbs))
+        return false;
     const realRepoRoot = safeRealpath(repoRoot);
     const realTestDirAbs = safeRealpath(testDirAbs);
     return !isAncestorOrSame(realRepoRoot, realTestDirAbs);

package/dist/profiles.js

@@ -52,6 +52,8 @@ export const ESLINT_RULE_MAP = {
     },
     // Assertions
     'playwright/expect-expect': { dimension: 'assertions' },
+    // Report-only: see finding-triage.ts. A test that calls into code the scan cannot read.
+    'playwright-score/assertion-unverified': { dimension: 'assertions', severityOverride: 'info', reportOnly: true },
     // No severityOverride: matches eslint-plugin-playwright's own
     // recommended severity ('error'), set via eslint-runner.ts's rule config.
     'playwright/prefer-web-first-assertions': { dimension: 'assertions' },