argusqa-os 9.4.5 → 9.4.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "argusqa-os",
-  "version": "9.4.5",
+  "version": "9.4.6",
   "mcpName": "io.github.ironclawdevs27/argus",
   "description": "Argus — AI-powered automated dev-testing platform using Chrome DevTools MCP and Claude Code",
   "keywords": [

package/src/mcp-server.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * Argus MCP Server (v9.4.5)
+ * Argus MCP Server (v9.4.6)
  *
  * Exposes Argus as an MCP server so Claude (or any MCP client) can call
  * argus_audit, argus_audit_full, argus_compare, argus_last_report, and
@@ -125,6 +125,9 @@ async function withMcp(fn) {
   const mcp = await createMcpClient();
   try {
     return await fn(mcp);
+  } catch (err) {
+    logger.error('[ARGUS] MCP tool handler error:', err.message);
+    throw err;
   } finally {
     try { mcp.close(); } catch { /* ignore — process already gone */ }
   }
@@ -283,7 +286,7 @@ async function handleLastReport() {
 // ── Server bootstrap ──────────────────────────────────────────────────────────
 
 const server = new Server(
-  { name: 'argus', version: '9.4.5' },
+  { name: 'argus', version: '9.4.6' },
   { capabilities: { tools: {} } },
 );
 

package/src/orchestration/orchestrator.js

@@ -280,7 +280,7 @@ function classifyConsoleMessage(msg, routeIsCritical) {
 function classifyNetworkRequest(req, routeIsCritical) {
   const status = req.status ?? 0;
   if (status >= 500) return 'critical';
-  if (status === 401 || status === 403) return 'critical';
+  if (status === 401 || status === 403) return routeIsCritical ? 'critical' : 'warning';
   if (status >= 400) return routeIsCritical ? 'warning' : 'info';
   return null;
 }
@@ -806,16 +806,22 @@ export async function crawlRouteExpensive(route, baseUrl, mcp) {
     const linksRaw = await browser.evaluate(INTERNAL_LINKS_SCRIPT);
     const rawLinks = unwrapEval(linksRaw);
     const links    = [...new Set(Array.isArray(rawLinks) ? rawLinks.filter(Boolean) : [])];
-    const headResults = await Promise.all(
-      links.map(async href => {
-        try {
-          const res = await fetch(href, { method: 'HEAD', signal: AbortSignal.timeout(5000) });
-          return { href, status: res.status };
-        } catch (err) {
-          return { href, status: 0, error: err.message };
-        }
-      })
-    );
+    const BROKEN_LINK_BATCH_TIMEOUT_MS = 15000;
+    const headResults = await Promise.race([
+      Promise.all(
+        links.map(async href => {
+          try {
+            const res = await fetch(href, { method: 'HEAD', signal: AbortSignal.timeout(5000) });
+            return { href, status: res.status };
+          } catch (err) {
+            return { href, status: 0, error: err.message };
+          }
+        })
+      ),
+      new Promise((_, reject) =>
+        setTimeout(() => reject(new Error('broken-link batch timeout')), BROKEN_LINK_BATCH_TIMEOUT_MS)
+      ),
+    ]);
     for (const { href, status } of headResults) {
       if (status === 404) {
         errors.push({

package/src/orchestration/slack-notifier.js

@@ -22,7 +22,13 @@ import { childLogger } from '../utils/logger.js';
 
 const logger = childLogger('slack-notifier');
 
-const slack = new WebClient(process.env.SLACK_BOT_TOKEN);
+// Lazy-init — avoid constructing WebClient at module load so importing slack-notifier
+// when SLACK_BOT_TOKEN is absent (HTML-report mode) doesn't create a useless client.
+let _slack = null;
+function getSlack() {
+  if (!_slack) _slack = new WebClient(process.env.SLACK_BOT_TOKEN);
+  return _slack;
+}
 
 const CHANNELS = {
   critical: process.env.SLACK_CHANNEL_CRITICAL,
@@ -43,7 +49,7 @@ const SLACK_RATE_LIMIT_RETRIES = 3;
 async function slackPostWithBackoff(args) {
   for (let attempt = 0; attempt < SLACK_RATE_LIMIT_RETRIES; attempt++) {
     try {
-      return await slack.chat.postMessage(args);
+      return await getSlack().chat.postMessage(args);
     } catch (err) {
       const isRateLimit = err.code === 'slack_webapi_rate_limited'
         || err.message?.toLowerCase().includes('ratelimited');
@@ -75,7 +81,7 @@ async function uploadFileToSlack(filePath, channelId, filename) {
   // Step 1: Get a pre-signed upload URL from Slack
   let uploadUrl, fileId;
   try {
-    const urlResponse = await slack.files.getUploadURLExternal({
+    const urlResponse = await getSlack().files.getUploadURLExternal({
       filename,
       length: fileSize,
     });
@@ -106,7 +112,7 @@ async function uploadFileToSlack(filePath, channelId, filename) {
 
   // Step 3: Complete the upload and share to channel
   try {
-    await slack.files.completeUploadExternal({
+    await getSlack().files.completeUploadExternal({
       files: [{ id: fileId, title: filename }],
       channel_id: channelId,
     });
@@ -299,7 +305,7 @@ export async function acknowledgeMessage(ts, channelId, acknowledgingUser) {
 
   try {
     // Append an acknowledged context block by updating the message
-    const existing = await slack.conversations.history({
+    const existing = await getSlack().conversations.history({
       channel: channelId,
       latest: ts,
       inclusive: true,
@@ -325,7 +331,7 @@ export async function acknowledgeMessage(ts, channelId, acknowledgingUser) {
       },
     ];
 
-    await slack.chat.update({
+    await getSlack().chat.update({
       channel: channelId,
       ts,
       blocks: updatedBlocks,

package/src/utils/contract-validator.js

@@ -108,10 +108,11 @@ export function matchesContract(reqUrl, reqMethod, contract) {
 function loadSchema(contract) {
   if (contract.schema) return contract.schema;
   if (contract.schemaFile) {
-    // Prevent path traversal — schemaFile must stay within the project directory
+    // Prevent path traversal — schemaFile must resolve inside the project directory.
+    // path.relative() + '..' check is robust across case differences and path separator variants.
     const resolved = path.resolve(contract.schemaFile);
-    const cwd = process.cwd();
-    if (!resolved.startsWith(cwd + path.sep) && resolved !== cwd) {
+    const rel = path.relative(process.cwd(), resolved);
+    if (rel.startsWith('..') || path.isAbsolute(rel)) {
       logger.warn('[ARGUS] contract-validator: schemaFile outside project directory — skipping:', contract.schemaFile);
       return null;
     }

package/src/utils/mcp-client.js

@@ -119,6 +119,13 @@ export async function createMcpClient() {
           } else {
             resolve(msg.result);
           }
+        } else if (msg.id !== undefined && !pending.has(msg.id)) {
+          // Response arrived after timeout already fired — log for observability
+          logger.debug(`[ARGUS] MCP late response for id=${msg.id} (already timed out or unknown)`);
+        } else if (msg.method) {
+          // Server-initiated notification (e.g. progress) — not an error, no action needed
+        } else {
+          logger.debug('[ARGUS] MCP unexpected message shape:', JSON.stringify(msg).slice(0, 200));
         }
       } catch {
         // non-JSON line from process — ignore