blastproof 0.4.0 → 0.5.0

package/README.md

@@ -107,9 +107,9 @@ jobs:
 
       - run: npm start &          # however your app boots
 
-      - uses: hamc/blastproof@v0.4.0
+      - uses: hamc/blastproof@v0.5.0
         with:
-          version: '0.4.0'        # pin both when this gates merges
+          version: '0.5.0'        # pin both when this gates merges
           api-key: ${{ secrets.ANTHROPIC_API_KEY }}
           base: ${{ github.event.pull_request.base.ref }}
           min-score: '80'

package/dist/cli.js

@@ -256,7 +256,7 @@ function estimateMaxModelCalls(tests, maxIterationsPerStep, maxRetriesPerStep) {
     (sum, test) => sum + (test.setup?.length ?? 0) + test.steps.length,
     0
   );
-  return totalSteps * (maxIterationsPerStep + maxRetriesPerStep);
+  return totalSteps * (maxIterationsPerStep + maxRetriesPerStep + Math.min(maxIterationsPerStep, maxRetriesPerStep));
 }
 
 // src/runner/env.ts
@@ -439,6 +439,19 @@ async function performAction(page, action, ctx) {
 
 // src/runner/executor.ts
 var DEFAULT_MAX_ITERATIONS_PER_STEP = 15;
+var SETTLE_TIMEOUT_MS = 2e3;
+async function waitForSettled(page) {
+  const deadline = Date.now() + SETTLE_TIMEOUT_MS;
+  const urlBefore = page.url();
+  await page.waitForLoadState("networkidle", { timeout: SETTLE_TIMEOUT_MS }).catch(() => {
+  });
+  if (page.url() === urlBefore) return;
+  const remaining = deadline - Date.now();
+  if (remaining > 0) {
+    await page.waitForLoadState("networkidle", { timeout: remaining }).catch(() => {
+    });
+  }
+}
 async function defaultSnapshot(page, maxLines) {
   const { captureSnapshot } = await import("./snapshot-CAIB2OHX.js");
   return captureSnapshot(page, { maxLines });
@@ -496,6 +509,7 @@ async function executeTest(page, test, options) {
         if (iterations >= maxIterationsPerStep) {
           throw new StepFailure(`step exceeded ${maxIterationsPerStep} actions without completing`);
         }
+        await waitForSettled(page);
         const snap = await takeSnapshot(page);
         let action;
         try {
@@ -527,7 +541,12 @@ async function executeTest(page, test, options) {
         }
         if (action.action === "assert") {
           const expectation = action.expectation ?? action.reasoning;
-          const judgment = await brain.judge(mask(expectation), mask(snap));
+          let judgment = await brain.judge(mask(expectation), mask(snap));
+          if (!judgment.pass) {
+            await waitForSettled(page);
+            const freshSnap = await takeSnapshot(page);
+            judgment = await brain.judge(mask(expectation), mask(freshSnap));
+          }
           const result = judgment.pass ? `ok: assertion passed: ${judgment.reason}` : `assertion failed: ${judgment.reason}`;
           emitAction(index, action, result);
           if (judgment.pass) {
@@ -1033,6 +1052,7 @@ Rules:
 - Return "done" when the current step's outcome holds \u2014 including when it already held before you acted, or was achieved by your previous action. "Already true" is done, never failure. Do not return "done" for work belonging to later steps.
 - Return "fail" only when the step's outcome cannot be reached: the element is still absent after retries, the page cannot support the step, or an error blocks progress. Never return "fail" because the work appears to have been done already.
 - If your previous action errored, re-read the fresh snapshot and choose an alternative element or approach. Do not repeat the exact same failing action.
+- \`***\` in a snapshot is a redacted secret \u2014 a password, token or key deliberately withheld from you. Seeing it is expected and is not a problem. A field showing \`***\` after you filled it from an {{env.VAR}} placeholder means the fill worked; treat that as success and move on. Never retry a fill because its value is redacted, and never report failure because a value was withheld.
 - Keep reasoning to one short sentence.`;
 }
 function agentUserPrompt(input) {
@@ -1053,7 +1073,9 @@ function agentUserPrompt(input) {
   return parts.join("\n");
 }
 function assertSystemPrompt() {
-  return `You are a QA judge. You receive a page accessibility snapshot and an expectation. Decide whether the snapshot satisfies the expectation. Be strict: only pass when the expectation is clearly met by the snapshot content. Answer with pass=true/false and a one-sentence reason.`;
+  return `You are a QA judge. You receive a page accessibility snapshot and an expectation. Decide whether the snapshot satisfies the expectation. Be strict: only pass when the expectation is clearly met by the snapshot content. Answer with pass=true/false and a one-sentence reason.
+
+\`***\` marks a secret deliberately withheld from you \u2014 a password, token or key. Seeing it is expected. A field holding \`***\` is filled, not empty, so do not fail an expectation on the grounds that a value was redacted. This applies only to the redaction itself: everything else the expectation asks for must still be visibly satisfied by the snapshot, and an expectation you genuinely cannot check against what you were shown still fails.`;
 }
 function assertUserPrompt(expectation, snapshot) {
   return [
@@ -2534,7 +2556,7 @@ function parsePositiveNumber(flag) {
   };
 }
 var program = new Command();
-program.name("blastproof").description("Open-source AI testing agent: plain-English YAML tests executed agentically on a real browser.").version("0.4.0");
+program.name("blastproof").description("Open-source AI testing agent: plain-English YAML tests executed agentically on a real browser.").version("0.5.0");
 program.command("init").description("Scaffold .blastproof/ (config, tests, sample tests) in the current directory").action(async () => {
   try {
     const result = await initProject(process.cwd());