blastproof 0.17.0 → 0.19.0

package/README.md

@@ -133,7 +133,7 @@ steps:
   - complete checkout
 ```
 
-`priority` is P0–P2 (default P1). `tags`, `setup` steps and `auth` are optional — `auth: false` runs the test signed out, which a login test needs. `routes` declares the URLs a test covers, which is what `--impacted` selects on; write route strings consistently, since they compare by exact equality (`/cart` ≠ `/cart/`). `run` warns to stderr — non-fatal — when a test declares a route no `routes:` mapping declares, since that route contributes nothing to `--impacted` selection.
+`priority` is P0–P2 (default P1). `tags`, `setup` steps and `auth` are optional — `auth: false` runs the test signed out, which a login test needs, and a selection in which *every* test declares it skips the login altogether. `routes` declares the URLs a test covers, which is what `--impacted` selects on; write route strings consistently, since they compare by exact equality (`/cart` ≠ `/cart/`). `run` warns to stderr — non-fatal — when a test declares a route no `routes:` mapping declares, since that route contributes nothing to `--impacted` selection.
 
 ### Say what each step should produce
 
@@ -227,6 +227,10 @@ The key is the file glob and the value is the routes it can affect — the oppos
 
 Every changed file lands in one of three buckets: it matches `routes:` and contributes them, matches `ignore:` and is knowingly irrelevant, or **matches neither — nobody has said what it affects**. `--fail-on-unmapped` blocks on that third case, naming the files and both ways to resolve them.
 
+**The diff is `git diff <base>...HEAD`, so it compares commits.** Work you have not committed — edited, staged or untracked — is not in it. That is the right comparison in CI, where everything is committed by the time the workflow runs, and the wrong one on the machine you are writing the change on: a run against a dirty working tree selects from your last commit, not from your editor.
+
+It says so rather than leaving you to notice. Any working-tree change the diff excluded is named on stderr, with the routes it maps to, on `run --impacted` and `plan --base` alike — non-fatal, and it changes no exit code and nothing about what is selected. Files your `ignore:` globs already cover stay silent, and so do files already in the diff, whose routes are selected either way.
+
 **Nothing is ignored by default**, on purpose: a default that guesses on your behalf would hide the first files worth thinking about. The flag is additive — a run can meet `--min-score` and still be blocked here, because "the tests I ran passed" and "something changed that nobody classified" are different claims.
 
 Its limit is worth knowing: it catches files that are *unclassified*, not *misclassified*. A shared module mapped to one route when it can break five still slips through. Impact by import graph is the fix, and blastproof does not do it yet.

package/dist/cli.js

@@ -598,6 +598,23 @@ var StepRecovery = class {
   observe(maskedSnapshot) {
     this.readable.push(normalise(maskedSnapshot));
   }
+  /**
+   * Whether anything succeeded during this step (design close-a-step D1).
+   *
+   * Reads the history `record` already keeps rather than a flag threaded
+   * through the loop: `record` is reached at one place, after `performAction`
+   * returns without throwing, so this is "what worked" and not "what was
+   * attempted" — a click that raised is correctly absent. A separate counter
+   * would be one more thing a future branch can forget to increment, which is
+   * the shape that let `timeoutMs` and the budget go unset at a single call
+   * site while every other one set them.
+   *
+   * `observe` deliberately does not move it. Being shown a page is not doing
+   * something to it.
+   */
+  get acted() {
+    return this.history.length > 0;
+  }
   /** Records an action that was actually performed and succeeded. */
   record(action, description, result) {
     this.performed.add(identity(action));
@@ -691,6 +708,7 @@ function slugify(text) {
   const slug = text.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60);
   return slug || "test";
 }
+var NOTHING_DONE_REFUSAL = "refused: nothing succeeded during this step, so it was NOT closed. A step closes on what was done in it, not on being declared finished. If the outcome already holds \u2014 there was nothing left to do \u2014 assert that it holds and let the judgment close the step; an assertion is evidence, a declaration is not. If the step cannot be carried out at all, fail it and say why.";
 var StepFailure = class extends Error {
 };
 async function executeTest(page, test, options) {
@@ -775,6 +793,15 @@ async function executeTest(page, test, options) {
         }
         iterations++;
         if (action.action === "done") {
+          if (!recovery.acted) {
+            failedAttempts++;
+            lastResult = NOTHING_DONE_REFUSAL;
+            emitAction(index, action, lastResult);
+            if (failedAttempts >= maxRetries) {
+              throw new StepFailure(lastResult);
+            }
+            continue;
+          }
           emitAction(index, action, action.reasoning);
           break;
         }
@@ -1289,6 +1316,20 @@ async function getChangedFiles(baseRef, cwd = process.cwd()) {
     throw toDiffError(error, baseRef);
   }
 }
+async function getUncommittedFiles(cwd = process.cwd()) {
+  try {
+    const status = await simpleGit(cwd).status();
+    const paths = /* @__PURE__ */ new Set();
+    for (const file of status.files) {
+      paths.add(file.path.replace(/\\/g, "/"));
+      const from = file.from;
+      if (from) paths.add(from.replace(/\\/g, "/"));
+    }
+    return [...paths].sort();
+  } catch {
+    return [];
+  }
+}
 
 // src/impact.ts
 import picomatch from "picomatch";
@@ -1327,6 +1368,25 @@ function mapImpact(changedFiles, routes, ignore = []) {
   };
 }
 
+// src/report/uncommitted.ts
+function printUncommitted(uncommitted, changedFiles, config, baseRef) {
+  const inDiff = new Set(changedFiles.map((file) => file.replace(/\\/g, "/")));
+  const routes = config.routes ?? {};
+  const ignore = config.ignore ?? [];
+  const findings = uncommitted.filter((file) => !inDiff.has(file)).map((file) => ({ file, impact: mapImpact([file], routes, ignore) })).filter(({ impact }) => impact.ignoredFiles.length === 0);
+  if (findings.length === 0) return;
+  console.error(
+    `
+warning: ${findings.length} file(s) changed in the working tree are not in the diff against '${baseRef}':`
+  );
+  for (const { file, impact } of findings) {
+    console.error(
+      impact.affectedRoutes.length > 0 ? `  ${file} -> ${impact.affectedRoutes.join(", ")}` : `  ${file}  (matched by no routes: or ignore: glob)`
+    );
+  }
+  console.error("Nothing above was considered. Commit or stash them to include them.");
+}
+
 // src/llm/brain.ts
 import { generateObject } from "ai";
 
@@ -2547,7 +2607,8 @@ Dry run: ${selected.length} test(s) selected, base_url=${config.base_url}`);
   for (const test of selected) {
     console.log(`  ${test.summary} [${test.priority}] (${path9.relative(cwd, test.path)})`);
   }
-  const authSteps = config.auth?.steps ?? [];
+  const needsLogin = selected.some((test) => test.auth);
+  const authSteps = needsLogin ? config.auth?.steps ?? [] : [];
   const withAuth = authSteps.length > 0 ? [...selected, { steps: authSteps }] : selected;
   const ceiling = estimateMaxModelCalls(
     withAuth,
@@ -2592,6 +2653,7 @@ async function runCommand(options) {
       throw error;
     }
     impact = mapImpact(changedFiles, config.routes ?? {}, config.ignore ?? []);
+    printUncommitted(await getUncommittedFiles(options.cwd), changedFiles, config, base);
   }
   const testsDir = path9.join(options.cwd, TESTS_RELATIVE_DIR);
   let files;
@@ -2684,7 +2746,7 @@ ${results.length} test file(s) could not be parsed:`);
   let incomplete;
   try {
     let session;
-    if (config.auth) {
+    if (config.auth && selected.some((test) => test.auth)) {
       try {
         console.log("Authenticating...");
         session = await authenticate({
@@ -2805,6 +2867,7 @@ async function resolveTargets(options, config, suite) {
   const base = options.base ?? "main";
   const changedFiles = await getChangedFiles(base, options.cwd);
   const impact = mapImpact(changedFiles, config.routes ?? {}, config.ignore ?? []);
+  printUncommitted(await getUncommittedFiles(options.cwd), changedFiles, config, base);
   const filesForRoute = (route) => changedFiles.filter(
     (file) => mapImpact([file], config.routes ?? {}, config.ignore ?? []).affectedRoutes.includes(route)
   );
@@ -3082,7 +3145,7 @@ function parsePositiveNumber(flag) {
   };
 }
 var program = new Command();
-program.name("blastproof").description("Open-source AI testing agent: plain-English YAML tests executed agentically on a real browser.").version("0.17.0");
+program.name("blastproof").description("Open-source AI testing agent: plain-English YAML tests executed agentically on a real browser.").version("0.19.0");
 program.command("init").description("Scaffold .blastproof/ (config, tests, sample tests) in the current directory").action(async () => {
   try {
     const result = await initProject(process.cwd());