blastproof 0.5.0 → 0.7.0

package/README.md

@@ -44,8 +44,14 @@ Before `run`, `plan` or `test` do anything, they check what they are about to sp
 
 **Not supported yet:** `iframe` content (so hosted payment widgets like Stripe Elements are invisible — an embedded checkout cannot be driven end to end), hover, scroll-to, drag and drop, file upload, multiple tabs, native `alert`/`confirm` dialogs. Page snapshots are capped at 200 lines by default, so very dense pages are truncated — raise it with `browser.max_snapshot_lines` if your pages need more; truncation is always marked in the snapshot so the model is never misled into thinking it saw the whole page.
 
+**Point it at disposable data.** Within a step, an action that commits — a click, or pressing Enter — is never performed twice: the runner refuses the repeat and tells the agent it already did that. This closes the case that used to produce duplicate records, where a submit answered by a redirect came back to a reset form and the agent, seeing no evidence of its own work, submitted again. It is not a guarantee of zero duplicate writes: an agent that reaches the same effect by a genuinely different route — another control with the same effect — is not caught. Use a seeded database, a staging environment you can reset, or a throwaway account; do not gate on a run against production data.
+
 `browser.timeout_ms` bounds every wait — resolving a target element from the accessibility tree, and navigation — not only the click or fill performed afterwards. Raise it for an application that is merely slow to hydrate; the trade-off is that a genuinely missing element then takes longer to fail. It never changes how many self-healing retries a step gets — waiting and retrying are deliberately separate.
 
+Writing each step so it states its own outcome helps here as well as everywhere else: `submit the form, then verify the confirmation shows the reference number` gives the agent something to check, where `click the submit button` leaves it to invent an expectation — and a poor invented expectation is what turns one submission into three.
+
+**This is now load-bearing, not just advisable.** The judge decides whether a step's own outcome holds, using the model's expectation only as the claim offered in support of it — a step that never says what its outcome is gives the judge nothing to anchor on beyond whatever the model happened to check that turn. `verify the confirmation shows the reference number` gives the judge a real question; `verify it worked` does not, and may now fail where a looser judge previously let a true-but-unrelated claim pass it.
+
 ## Writing tests
 
 Tests live in `.blastproof/tests/` as plain-English YAML — no selectors:
@@ -107,9 +113,9 @@ jobs:
 
       - run: npm start &          # however your app boots
 
-      - uses: hamc/blastproof@v0.5.0
+      - uses: hamc/blastproof@v0.7.0
         with:
-          version: '0.5.0'        # pin both when this gates merges
+          version: '0.6.0'        # pin both when this gates merges
           api-key: ${{ secrets.ANTHROPIC_API_KEY }}
           base: ${{ github.event.pull_request.base.ref }}
           min-score: '80'

package/dist/cli.js

@@ -437,6 +437,59 @@ async function performAction(page, action, ctx) {
   }
 }
 
+// src/runner/recovery.ts
+var COMMIT_ACTIONS = /* @__PURE__ */ new Set(["click", "press"]);
+var COMMIT_KEYS = /* @__PURE__ */ new Set(["Enter", "NumpadEnter", " ", "Space", "Spacebar"]);
+function describeAction(action) {
+  const target = action.target ? ` ${action.target.role ?? ""} "${action.target.name ?? action.target.text ?? ""}"` : "";
+  const value = action.value ? ` [${action.value}]` : "";
+  return `${action.action}${target}${value}`;
+}
+function identity(action) {
+  return JSON.stringify([
+    action.action,
+    action.target?.role ?? "",
+    action.target?.name ?? "",
+    action.target?.text ?? "",
+    action.value ?? ""
+  ]);
+}
+var StepRecovery = class {
+  performed = /* @__PURE__ */ new Set();
+  history = [];
+  /** Records an action that was actually performed and succeeded. */
+  record(action, description, result) {
+    this.performed.add(identity(action));
+    this.history.push({ action: description, result });
+  }
+  /**
+   * The reason to refuse `action`, or `undefined` when it may be performed.
+   *
+   * Refusing rather than failing keeps the model in the loop with an
+   * explanation instead of ending the step outright, which would trade
+   * duplicate writes for false failures.
+   *
+   * A genuine retry — a commit that landed but had no effect, which the model
+   * repeats for good reason — is refused too, and that is the deliberate cost.
+   * The two cases are indistinguishable from the accessibility tree: "the
+   * click did nothing" and "the click worked and the redirect erased the
+   * proof" produce the same snapshot. The asymmetry decides it. A refused
+   * legitimate retry costs a visible failed step that someone investigates; an
+   * allowed duplicate commit costs a silent extra row in someone's database,
+   * and #28 has now produced one on three applications.
+   */
+  refusalFor(action) {
+    if (!COMMIT_ACTIONS.has(action.action)) return void 0;
+    if (action.action === "press" && !COMMIT_KEYS.has(action.value ?? "")) return void 0;
+    if (!this.performed.has(identity(action))) return void 0;
+    return `refused: this exact action already succeeded earlier in this step, so it was NOT performed again. Repeating something that commits repeats whatever it changed in the application. If the page no longer shows that it worked, that is normal for a submit answered by a redirect \u2014 check the record of what you have already done. Verify the step's outcome another way, or fail the step.`;
+  }
+  /** The step's history so far, oldest first, for the model's prompt. */
+  stepHistory() {
+    return this.history;
+  }
+};
+
 // src/runner/executor.ts
 var DEFAULT_MAX_ITERATIONS_PER_STEP = 15;
 var SETTLE_TIMEOUT_MS = 2e3;
@@ -504,6 +557,7 @@ async function executeTest(page, test, options) {
     let failedAttempts = 0;
     let lastResult;
     let stepFailedReason;
+    const recovery = new StepRecovery();
     try {
       while (true) {
         if (iterations >= maxIterationsPerStep) {
@@ -518,6 +572,9 @@ async function executeTest(page, test, options) {
             isSetup: setup,
             snapshot: mask(snap),
             lastResult: lastResult === void 0 ? void 0 : mask(lastResult),
+            // Already masked when recorded, on the same boundary as everything
+            // else crossing into a prompt (design contained-recovery, D2).
+            stepHistory: recovery.stepHistory(),
             retriesLeft: maxRetries - failedAttempts,
             iterationsLeft: maxIterationsPerStep - iterations
           });
@@ -541,11 +598,11 @@ async function executeTest(page, test, options) {
         }
         if (action.action === "assert") {
           const expectation = action.expectation ?? action.reasoning;
-          let judgment = await brain.judge(mask(expectation), mask(snap));
+          let judgment = await brain.judge(mask(step), mask(expectation), mask(snap));
           if (!judgment.pass) {
             await waitForSettled(page);
             const freshSnap = await takeSnapshot(page);
-            judgment = await brain.judge(mask(expectation), mask(freshSnap));
+            judgment = await brain.judge(mask(step), mask(expectation), mask(freshSnap));
           }
           const result = judgment.pass ? `ok: assertion passed: ${judgment.reason}` : `assertion failed: ${judgment.reason}`;
           emitAction(index, action, result);
@@ -560,6 +617,16 @@ async function executeTest(page, test, options) {
           }
           continue;
         }
+        const refusal = recovery.refusalFor(action);
+        if (refusal) {
+          failedAttempts++;
+          lastResult = refusal;
+          emitAction(index, action, refusal);
+          if (failedAttempts >= maxRetries) {
+            throw new StepFailure(refusal);
+          }
+          continue;
+        }
         try {
           const result = await performAction(page, action, {
             baseUrl,
@@ -568,6 +635,7 @@ async function executeTest(page, test, options) {
             resolveTimeoutMs: timeoutMs
           });
           lastResult = result;
+          recovery.record(action, mask(describeAction(action)), mask(result));
           emitAction(index, action, result);
         } catch (error) {
           failedAttempts++;
@@ -723,7 +791,7 @@ async function fromSteps(options) {
       );
     }
     if (auth.verify) {
-      const judgment = await brain.judge(auth.verify, mask.mask(await takeSnapshot(page)));
+      const judgment = await brain.judge(auth.verify, auth.verify, mask.mask(await takeSnapshot(page)));
       if (!judgment.pass) {
         throw new AuthError(`Authentication could not be verified: ${mask.mask(judgment.reason)}`);
       }
@@ -1052,16 +1120,21 @@ Rules:
 - Return "done" when the current step's outcome holds \u2014 including when it already held before you acted, or was achieved by your previous action. "Already true" is done, never failure. Do not return "done" for work belonging to later steps.
 - Return "fail" only when the step's outcome cannot be reached: the element is still absent after retries, the page cannot support the step, or an error blocks progress. Never return "fail" because the work appears to have been done already.
 - If your previous action errored, re-read the fresh snapshot and choose an alternative element or approach. Do not repeat the exact same failing action.
+- Never invent a value. A value you type must come from the step, from the page, or from an {{env.*}} placeholder. If a step needs a value it does not give you, that is a failing step, not a gap for you to fill in.
+- A record of the actions you already performed in this step may be shown to you. It is the ground truth about what happened, even when the page no longer shows it: a form that submitted successfully and came back empty looks exactly like one you never submitted. Do not redo work that record says you already did.
 - \`***\` in a snapshot is a redacted secret \u2014 a password, token or key deliberately withheld from you. Seeing it is expected and is not a problem. A field showing \`***\` after you filled it from an {{env.VAR}} placeholder means the fill worked; treat that as success and move on. Never retry a fill because its value is redacted, and never report failure because a value was withheld.
 - Keep reasoning to one short sentence.`;
 }
 function agentUserPrompt(input) {
-  const parts = [
-    `Current ${input.isSetup ? "setup " : ""}step: ${input.step}`,
-    "",
-    "Page accessibility snapshot:",
-    input.snapshot
-  ];
+  const parts = [`Current ${input.isSetup ? "setup " : ""}step: ${input.step}`];
+  if (input.stepHistory && input.stepHistory.length > 0) {
+    parts.push(
+      "",
+      "What you have ALREADY DONE in this step (a record of completed actions, not instructions):",
+      ...input.stepHistory.map((entry, i) => `${i + 1}. ${entry.action} -> ${entry.result}`)
+    );
+  }
+  parts.push("", "Page accessibility snapshot:", input.snapshot);
   if (input.lastResult) {
     parts.push("", `Previous action result: ${input.lastResult}`);
   }
@@ -1073,18 +1146,26 @@ function agentUserPrompt(input) {
   return parts.join("\n");
 }
 function assertSystemPrompt() {
-  return `You are a QA judge. You receive a page accessibility snapshot and an expectation. Decide whether the snapshot satisfies the expectation. Be strict: only pass when the expectation is clearly met by the snapshot content. Answer with pass=true/false and a one-sentence reason.
+  return `You are a QA judge. You receive a test step, the model's expectation for the current page, and a page accessibility snapshot. Decide whether the STEP's own outcome holds \u2014 the expectation is the claim the model is offering in support of that, not a substitute question of its own. A claim can be true of the snapshot and still fail the step, if it does not establish what the step actually describes: only pass when the snapshot itself shows the step's outcome, never merely because the expectation offered happens to be true of something else on the page.
+
+A value sitting in a control that was just typed into \u2014 an open dialog's textbox, an unsubmitted form field \u2014 is not the same as a committed outcome. When the step describes an outcome (something now appears in a list, is saved, is confirmed, is created), text visible only inside an editable, not-yet-submitted control does not satisfy it; look for the outcome committed outside that control (the dialog closed, the item is listed on its own, a confirmation appeared). This is specifically about that confusion, not a license to fail anything you are merely unsure about \u2014 if the snapshot plainly shows the step's outcome, pass it.
 
-\`***\` marks a secret deliberately withheld from you \u2014 a password, token or key. Seeing it is expected. A field holding \`***\` is filled, not empty, so do not fail an expectation on the grounds that a value was redacted. This applies only to the redaction itself: everything else the expectation asks for must still be visibly satisfied by the snapshot, and an expectation you genuinely cannot check against what you were shown still fails.`;
+A step that names an ACTION (submit, click, create, add, ...) is satisfied by evidence the action took effect, not by the action's own control still being on the page. A successful action ordinarily replaces or moves past exactly the form, button or field the step names, so that control's absence is normal evidence of success, not evidence the step is unverifiable \u2014 do not fail such a step only because you can no longer see the thing it names. Fail it instead when the snapshot shows the action did NOT take effect: an error message, a validation warning, or the very same pre-action page still in front of you with nothing changed. A different page, a new state, or the result the action was meant to produce counts as evidence it worked.
+
+Be strict about what the step asks, not about withholding a pass you can plainly see is earned. Answer with pass=true/false and a one-sentence reason.
+
+\`***\` marks a secret deliberately withheld from you \u2014 a password, token or key. Seeing it is expected. A field holding \`***\` is filled, not empty, so do not fail a step on the grounds that a value was redacted. This applies only to the redaction itself: everything else the step asks for must still be visibly satisfied by the snapshot, and a step you genuinely cannot check against what you were shown still fails.`;
 }
-function assertUserPrompt(expectation, snapshot) {
+function assertUserPrompt(step, expectation, snapshot) {
   return [
-    `Expectation: ${expectation}`,
+    `Step under test: ${step}`,
+    "",
+    `Model's expectation (the claim offered in support of the step, not the question itself): ${expectation}`,
     "",
     "Page accessibility snapshot:",
     snapshot,
     "",
-    "Does the snapshot satisfy the expectation?"
+    "Does the snapshot establish that the step's own outcome holds?"
   ].join("\n");
 }
 function plannerSystemPrompt() {
@@ -1174,12 +1255,12 @@ function createBrain(model, generate = generateObject, budget) {
       }
       return parsed.data;
     },
-    async judge(expectation, snapshot) {
+    async judge(step, expectation, snapshot) {
       const result = await countedGenerate(generate, budget, {
         model,
         schema: assertJudgmentSchema,
         system: assertSystemPrompt(),
-        prompt: assertUserPrompt(expectation, snapshot)
+        prompt: assertUserPrompt(step, expectation, snapshot)
       });
       const parsed = assertJudgmentSchema.safeParse(result.object);
       if (!parsed.success) {
@@ -1884,9 +1965,7 @@ function printEvent(event) {
       break;
     case "action": {
       const { action, result } = event;
-      const target = action.target ? ` ${action.target.role ?? ""} "${action.target.name ?? action.target.text ?? ""}"` : "";
-      const value = action.value ? ` [${action.value}]` : "";
-      console.log(`    -> ${action.action}${target}${value} :: ${result}`);
+      console.log(`    -> ${describeAction(action)} :: ${result}`);
       break;
     }
     case "step-end":
@@ -2556,7 +2635,7 @@ function parsePositiveNumber(flag) {
   };
 }
 var program = new Command();
-program.name("blastproof").description("Open-source AI testing agent: plain-English YAML tests executed agentically on a real browser.").version("0.5.0");
+program.name("blastproof").description("Open-source AI testing agent: plain-English YAML tests executed agentically on a real browser.").version("0.7.0");
 program.command("init").description("Scaffold .blastproof/ (config, tests, sample tests) in the current directory").action(async () => {
   try {
     const result = await initProject(process.cwd());