@sun-asterisk/sungen 3.2.24 → 3.2.26

package/src/orchestrator/templates/specs-regex-escape.ts

@@ -0,0 +1,16 @@
+/* eslint-disable */
+/**
+ * Sungen regex-escape helper — auto-generated into specs/regex-escape.ts. DO NOT EDIT.
+ *
+ * Test-data values are LITERAL TEXT. When a generated assertion needs an anchored
+ * match (`filter({ hasText: /^…$/ })`), the runtime value is interpolated into a
+ * `new RegExp(...)` — so a value containing `( [ $ . * +` would either throw a
+ * SyntaxError or silently match the wrong element unless it is escaped HERE, at
+ * runtime, where the real value is finally known. Template-time escaping cannot do
+ * this: at generate time the value is still a placeholder marker.
+ */
+
+/** Escape a runtime string so RegExp treats every character literally. */
+export function escapeRegExp(text: string): string {
+  return String(text).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}

package/src/orchestrator/templates/specs-test-data.ts

@@ -50,16 +50,42 @@ export class TestDataLoader {
     if (value === undefined || value === null) {
       throw new Error(`Test data key not found: ${key}`);
     }
-    // A projected array (e.g. `{{q.rows[*].name}}`) serializes as a JSON list so the full
-    // ordered set is preserved for the assert-compare — String([...]) would flatten it to a
-    // lossy comma-join that can't be distinguished from a scalar containing commas.
-    const result = Array.isArray(value)
-      ? this.interpolate(JSON.stringify(value))
+    // A projected array (e.g. `{{q.rows[*].name}}`) and a PLAIN object (an API response
+    // body) serialize as JSON text — String([...]) flattens to a lossy comma-join and
+    // String({}) is "[object Object]", both un-assertable. Embedded `{{ref}}`s interpolate
+    // INSIDE the value before stringify, so a ref carrying quotes/backslashes can never
+    // corrupt the serialized JSON (the old order substituted raw text into JSON text).
+    // Only PLAIN objects take this path: Date/Buffer/ObjectId values bound by @query from
+    // a real driver keep their String()/toString() output — JSON.stringify would wrap a
+    // Date in quotes and flip every assertion that already compares its string form.
+    const result = isJsonContainer(value)
+      ? JSON.stringify(this.interpolateDeep(value))
       : this.interpolate(String(value));
     assertNoUnresolvedEnvRef(key, result);
     return result;
   }
 
+  /**
+   * Interpolate `{{ref}}`s in every string leaf AND key of a JSON container,
+   * recursively (matching the old whole-JSON-text pass). Non-plain nested
+   * objects are passed through untouched — JSON.stringify serializes them via
+   * toJSON. A truly cyclic object throws a RangeError; every current bind
+   * source (JSON.parse output, DB rows, YAML after load-time resolution) is
+   * acyclic. Built with Object.fromEntries, which DEFINES data properties — a
+   * body field literally named "__proto__" survives instead of silently
+   * rewiring the result's prototype to external input.
+   */
+  private interpolateDeep(value: any): any {
+    if (typeof value === 'string') return this.interpolate(value);
+    if (Array.isArray(value)) return value.map((v) => this.interpolateDeep(v));
+    if (isPlainObject(value)) {
+      return Object.fromEntries(
+        Object.entries(value).map(([k, v]) => [this.interpolate(k), this.interpolateDeep(v)])
+      );
+    }
+    return value;
+  }
+
   /**
    * Resolve a key to its RAW, uncoerced value (array/object/number kept as-is) — for binding
    * DB query / API request params, where type-strict sinks (MySQL numeric columns, MongoDB,
@@ -68,7 +94,8 @@ export class TestDataLoader {
    * as get()), so an override like `token={{login.body.token}}` or `id={{prefix}}-001` still
    * interpolates — only the final scalar/array/object type is preserved uncoerced. Arrays and
    * objects are returned as-is; refs embedded inside their elements are not interpolated (unlike
-   * get()'s JSON-text pass), since raw() callers bind structured values directly, not text.
+   * get(), which interpolates every string leaf of a plain container before serializing), since
+   * raw() callers bind structured values directly, not text.
    * Throws on missing, mirroring get()'s guard.
    */
   raw(key: string): any {
@@ -202,6 +229,26 @@ export class TestDataLoader {
   }
 }
 
+/**
+ * A value get() must serialize as JSON: an array, or a PLAIN object (literal or
+ * null-prototype). Class instances at the TOP level (Date, Buffer, ObjectId…,
+ * and driver row wrappers like mysql2's RowDataPacket) are NOT containers —
+ * they keep the String()/toString() path their existing assertions rely on;
+ * nested inside a plain container they serialize through JSON.stringify/toJSON.
+ */
+function isJsonContainer(value: any): boolean {
+  return Array.isArray(value) || isPlainObject(value);
+}
+
+// Prototype check only — a `value.constructor === Object` probe is defeated by
+// a body FIELD literally named "constructor" (JSON.parse gives it as an own
+// property), which would silently fall back to "[object Object]" again.
+function isPlainObject(value: any): boolean {
+  if (value === null || typeof value !== 'object') return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+
 function loadYamlSync(filePath: string): Record<string, any> | null {
   if (!fs.existsSync(filePath)) return null;
   const content = fs.readFileSync(filePath, 'utf-8');

package/src/orchestrator/templates/wdio.conf.ts

@@ -233,6 +233,25 @@ function restoreConnectivity(hook: string): void {
   console.log('[sungen] connectivity self-heal: no ICMP reply within ~30s — continuing (fine if this network blocks ping; otherwise the device may need a cold boot).');
 }
 
+// Evidence readability: render a dot at every injected tap so screen recordings show WHERE the
+// test touched. Android-only (iOS has no supported equivalent). The pre-run value is remembered
+// and restored on onComplete, so a developer's own device setting is not permanently mutated.
+let showTouchesBefore: string | null = null;
+function setShowTouches(hook: 'onPrepare' | 'onComplete'): void {
+  if (!RUN_ANDROID) return;
+  const adbBin = process.env.ANDROID_HOME ? path.join(process.env.ANDROID_HOME, 'platform-tools', 'adb') : 'adb';
+  const adb = `"${adbBin}" -s ${process.env.ANDROID_UDID || '__ANDROID_UDID__'} shell`;
+  const sh = (cmd: string) => execSync(`${adb} ${cmd}`, { timeout: 10000, stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim();
+  try {
+    if (hook === 'onPrepare') {
+      showTouchesBefore = sh('settings get system show_touches');
+      if (showTouchesBefore !== '1') sh('settings put system show_touches 1');
+    } else if (showTouchesBefore !== null && showTouchesBefore !== '1') {
+      sh(`settings put system show_touches ${showTouchesBefore === 'null' ? '0' : showTouchesBefore}`);
+    }
+  } catch { /* device gone / key absent — cosmetic feature, never block the run */ }
+}
+
 export const config: WebdriverIO.Config = {
   runner: 'local',
   tsConfigPath: './tsconfig.json',
@@ -265,13 +284,13 @@ export const config: WebdriverIO.Config = {
             'appium:udid': process.env.ANDROID_UDID || '__ANDROID_UDID__',
             // APP_APK installs from a file (Appium reads pkg/activity from the manifest);
             // otherwise target an already-installed app by package + activity.
-            ...(APP_APK
-              ? { 'appium:app': APP_APK }
-              : {
-                  'appium:appPackage': APP_PACKAGE,
-                  // Omit when unset → UiAutomator2 launches the package's default launcher activity.
-                  ...(HAS_REAL_APP_ACTIVITY ? { 'appium:appActivity': APP_ACTIVITY } : {}),
-                }),
+            ...(APP_APK ? { 'appium:app': APP_APK } : {}),
+            // Explicit APP_PACKAGE/APP_ACTIVITY are passed even alongside APP_APK: the driver's
+            // APK-manifest parse can flake (empty activity → bare MAIN/LAUNCHER intent, which
+            // Android rejects as "matches multiple activities"), and explicit caps override it.
+            ...(process.env.APP_PACKAGE || !APP_APK ? { 'appium:appPackage': APP_PACKAGE } : {}),
+            // Omit when unset → UiAutomator2 launches the package's default launcher activity.
+            ...(HAS_REAL_APP_ACTIVITY ? { 'appium:appActivity': APP_ACTIVITY } : {}),
             'appium:noReset': true,
             'appium:autoGrantPermissions': true,
             'appium:newCommandTimeout': 300,
@@ -385,8 +404,8 @@ export const config: WebdriverIO.Config = {
   // Connectivity self-heal (#615): onPrepare heals a device wedged by a previous KILLED run
   // (its onComplete never fired) before the session starts; onComplete restores after this run,
   // pass or fail. Both run in the launcher process, so they fire even when the worker/session died.
-  onPrepare: () => restoreConnectivity('onPrepare'),
-  onComplete: () => restoreConnectivity('onComplete'),
+  onPrepare: () => { restoreConnectivity('onPrepare'); setShowTouches('onPrepare'); },
+  onComplete: () => { restoreConnectivity('onComplete'); setShowTouches('onComplete'); },
 
   // iOS + locale: XCUITest's `noReset:false` does NOT actually clear the app's data container
   // (verified live 2026-06-11) — a Flutter app that persisted its language on a previous launch keeps