synapse-hub 2.2.3 → 2.2.4

package/.agents/rules/git-push-protocol.md

@@ -51,7 +51,7 @@ git commit -m "<type>(<scope>): <summary>"
 # Examples:
 # git commit -m "feat(billing): add Clean POM for Invoice Reconciliation"
 # git commit -m "test(auth): add automated login boundary test cases"
-# git commit -m "fix(locators): heal stale table row selector in DataMiningPage"
+# git commit -m "fix(locators): heal stale table row selector in OrderSummaryPage"
 ```
 
 ### Step 4: Direct Push to Project Remote

package/.agents/rules/lessons-learned.md

@@ -11,9 +11,9 @@ description: Critical anti-patterns, past mistakes, and strict avoidance rules (
 | # | Mistake / Anti-Pattern | Root Cause | Mandatory Avoidance Rule |
 |---|---|---|---|
 | **1** | **XPath strings parsed as methods** | Regex captured `String TXT = "...contains(...)"`. | In Groovy, `=` before `(` denotes a variable/constant, **never** a method. |
-| **2** | **GIS map polygon rejected** | Fixed `(100, 200)` coordinates caused overlap. | Always randomize coordinates via `TestHelper.getUniquePolygonCoordinates()`. |
-| **3** | **`ElementClickInterceptedException`** | Clicked while PrimeNG overlay backdrop was fading. | Always use `BasePage.clickJS()` or `window.__helper.clickSafe()` to bypass overlays. |
-| **4** | **Context window blowout** | Read 4,368-line `DataMiningPage.groovy` directly. | **Never read large files whole.** Query `tools/repo_map.txt` or read 20-50 line ranges. |
+| **2** | **GIS map / geometric polygon collision** | Hardcoded fixed coordinates `(100, 200)` caused overlap. | Always randomize geometric coordinates via dynamic bounding box/offset randomizer. |
+| **3** | **`ElementClickInterceptedException`** | Clicked while modal/spinner backdrop overlay was fading. | Wait for overlay detachment or bypass via JS dispatch (`clickJS` / `window.__helper.clickSafe()`). |
+| **4** | **Context window blowout** | Read monolithic 4,000+ line Page Class directly. | **Never read large files whole.** Query `tools/repo_map.txt` or read 20-50 line ranges. |
 | **5** | **Flaky timing on CI/CD** | `Thread.sleep` failed under variable network lag. | Replace 100% with Smart Wait: Angular `isStable()` and CDP `Network Idle 0`. |
 | **6** | **DB polluted with test junk** | Created entities without executing deletion. | Every data creation test case **must** execute idempotent teardown cleanup. |
 | **7** | **Graphify/CLI ran on Skill Hub instead of target project** | Defaulted to `CWD = Agent Skill` without checking Active Workspaces. | **Agent Skill folder = read-only hub, NEVER a CLI target.** Always identify the real target project from `Active Workspaces` (the non-hub workspace). If multiple project workspaces exist, ask the user. All outputs (graphify-out/, reports) must land inside the target project folder. |

package/.agents/rules/skill-precedence.md

@@ -30,7 +30,7 @@ When executing tasks within automated testing repositories, Agent must strictly
 | **Test Script & POM Generation** | `clean-pom-crafter`<br/>`lam-script-generator` | `QA Automation Engineer` | Enforces Flat Architecture, zero XPaths in scripts, dynamic `uniqueCode`, and 2-phase search. Generic plugin templates violate Clean POM standards. |
 | **Locator Healing & DOM Diffing** | `self-healing-locator`<br/>`failure-autopsy-and-healing` | `Locator Healer Agent` | Uses token-efficient AOM diffing (Role > Label > TestId) and reads local JUnit XML/Screenshots. |
 | **Flaky Test Triage & Root Cause** | `failure-autopsy-and-healing` | `Flaky Test Analyzer` | Triage occurs via 0-token JUnit XML parsing, `Screenshots/FAILED_*.png` autopsy, and SQLite cosine cache (`memory_cache.db`). |
-| **Live Web & Locator Probing** | `playwright-live-interaction` | `Smart Locator Agent` | Direct CDP network idle 0, PrimeNG overlay bypass, and in-browser helper integration. |
+| **Live Web & Locator Probing** | `playwright-live-interaction` | `Smart Locator Agent` | Direct CDP network idle 0, dynamic overlay bypass, and in-browser helper integration. |
 | **Code Refactoring & Tech Debt** | `code-refactoring-refactor-clean` | *(Consolidated)* | Single unified skill covering SOLID refactoring, code smells, and technical debt remediation. |
 | **Accessibility (A11y) Testing** | `wcag-audit-patterns`<br/>*(Guideline)* | `a11y-debugging`<br/>*(Tooling Only)* | `wcag-audit-patterns` governs WCAG 2.2 rules; `a11y-debugging` is used solely for low-level Chrome DevTools inspection. |
 

package/.agents/skills/auth-session-and-cookie-manager/SKILL.md

@@ -18,6 +18,9 @@ description: "Manage browser authentication sessions, storageState, JWT tokens,
    - Maintain distinct session fixtures for different privilege tiers (e.g. `admin_state.json`, `reviewer_state.json`, `viewer_state.json`).
 3. **Session Freshness & Auto-Refresh:**
    - Inspect token expiry timestamp (`exp` in JWT payload); auto-refresh via API endpoint if token lifetime has elapsed.
+4. **Security & Credential Hygiene:**
+   - Saved browser states contain live cookies, session tokens, and local storage values.
+   - **Mandatory:** Always add `.auth/` and `*storageState*.json` to your project's `.gitignore` to prevent committing live credentials to version control.
 
 ---
 

package/.agents/skills/code-refactoring-refactor-clean/resources/implementation-playbook.md

@@ -564,7 +564,7 @@ jobs:
 
 **Static Analysis Toolchain**
 
-```python
+```	oml
 # pyproject.toml
 [tool.ruff]
 line-length = 100
@@ -614,7 +614,7 @@ fail_under = 80
 
 **Automated Refactoring Suggestions**
 
-```python
+```yaml
 # Use Sourcery for automatic refactoring suggestions
 # sourcery.yaml
 rules:
@@ -622,7 +622,9 @@ rules:
   - id: merge-duplicate-blocks
   - id: use-named-expression
   - id: inline-immediately-returned-variable
+`
 
+`python
 # Example: Sourcery will suggest
 # BEFORE
 result = []
@@ -636,7 +638,7 @@ result = [item.name for item in items if item.is_active]
 
 **Code Quality Dashboard Configuration**
 
-```yaml
+```properties
 # sonar-project.properties
 sonar.projectKey=my-project
 sonar.sources=src
@@ -658,7 +660,7 @@ sonar.security.rating=A
 
 **Security-Focused Refactoring**
 
-```python
+```yaml
 # Use Semgrep for security-aware refactoring
 # .semgrep.yml
 rules:
@@ -815,12 +817,12 @@ Include specific optimizations:
 for item in items:
     for other in items:
         if item.id == other.id:
-            # process
+            pass  # process
 
 # After: O(n)
 item_map = {item.id: item for item in items}
 for item_id, item in item_map.items():
-    # process
+    pass  # process
 ```
 
 **Caching Strategy**
@@ -830,7 +832,7 @@ from functools import lru_cache
 @lru_cache(maxsize=128)
 def calculate_expensive_metric(data_id: str) -> float:
     # Expensive calculation cached
-    return result
+    return 0.0
 ```
 
 ### 12. Code Quality Checklist

package/.agents/skills/security-dast-sentinel/SKILL.md

@@ -6,6 +6,9 @@ description: "Run dynamic security audits: OWASP Top 10, security headers, IDOR,
 # Security DAST Sentinel (Dynamic Application Security & OWASP Top 10)
 
 > **Purpose:** Automated Dynamic Application Security Testing (DAST) and defensive runtime verification across enterprise web applications and REST/GraphQL APIs. Bridges functional automated testing with OWASP Top 10 defensive compliance gates.
+>
+> [!IMPORTANT] Authorization & Scope of Engagement
+> Dynamic security testing and fuzzing must **ONLY** be conducted against environments, domains, and applications for which explicit written authorization and testing agreements are established. Never direct automated security payloads or fuzzers against third-party production infrastructure.
 
 ---
 

package/README.md

@@ -4,7 +4,7 @@
 
 > **Bộ não trí tuệ dùng chung và mạng lưới kỹ năng tự hành, tăng cường năng lực cho các trợ lý AI (Google Antigravity, Cursor, Windsurf, Claude Code) trên mọi hệ sinh thái kiểm thử tự động.**  
 > **Tác giả:** Thế Vị ([@TeeVee998](https://github.com/TeeVee998))  
-> **Phiên bản Hub:** `v2.2.3` | **Quy mô:** 28 Kỹ năng chuẩn hóa, 6 Vai trò AI Swarm, 7 Quy tắc cốt lõi, 20+ Công cụ tự động.
+> **Phiên bản Hub:** `v2.2.4` | **Quy mô:** 28 Kỹ năng chuẩn hóa, 6 Vai trò AI Swarm, 7 Quy tắc cốt lõi, 20+ Công cụ tự động.
 
 ---
 
@@ -14,7 +14,7 @@
 
 ```mermaid
 flowchart TD
-    subgraph Hub["🧠 Synapse Hub (Intelligence Core v2.2.3)"]
+    subgraph Hub["🧠 Synapse Hub (Intelligence Core v2.2.4)"]
         Skills[".agents/skills/ (28 Skills)"]
         Agents[".agents/agents/ (6 Specialized Roles)"]
         Rules[".agents/rules/ (7 Core Rules)"]
@@ -66,6 +66,8 @@ flowchart TD
 | **Hiện tượng quên ngữ cảnh (Context Rot)** | Xảy ra nhanh chóng sau 40k – 60k tokens | **Miễn nhiễm nhờ 3 tầng Progressive Disclosure** |
 | **Thời gian tự phục hồi lỗi (MTTR)** | 5 – 15 phút mò mẫm thử nghiệm | **< 1 giây (Tra cứu kinh nghiệm có sẵn)** |
 
+*(Lưu ý: 300–800 token là chi phí ngữ cảnh động của từng lượt sửa lỗi vi mô (micro-turn payload) nhờ repo_map và distill_log; chưa tính chi phí nạp hệ thống/rules ban đầu của IDE ~7.000 tokens).*
+
 ---
 
 ## 🚀 2. Hướng Dẫn Bắt Đầu & Tích Hợp (3 Cách Dùng)
@@ -301,7 +303,7 @@ Dự án được phân phối chính thức dưới giấy phép **[MIT License
 
 > **The shared intelligence core and autonomous skill hub empowering AI coding assistants (Google Antigravity / Cursor / Windsurf / Claude Code) across automated testing suites.**  
 > **Author:** Thế Vị ([@TeeVee998](https://github.com/TeeVee998))  
-> **Hub Version:** `v2.2.3` (Semantic Versioning) | **Integrity Index:** 28 Skills, 6 Agent Swarm Roles, 8 Core Rules, 50+ Specialized Python Tools, 9 Quality Gates.
+> **Hub Version:** `v2.2.4` (Semantic Versioning) | **Integrity Index:** 28 Skills, 6 Agent Swarm Roles, 8 Core Rules, 50+ Specialized Python Tools, 9 Quality Gates.
 
 ---
 
@@ -311,7 +313,7 @@ Dự án được phân phối chính thức dưới giấy phép **[MIT License
 
 ```mermaid
 flowchart TD
-    subgraph Hub["🧠 Synapse Hub (Intelligence Core v2.2.3)"]
+    subgraph Hub["🧠 Synapse Hub (Intelligence Core v2.2.4)"]
         Skills[".agents/skills/ (28 Skills)"]
         Agents[".agents/agents/ (6 Specialized Roles)"]
         Rules[".agents/rules/ (8 Core Rules)"]
@@ -363,6 +365,8 @@ flowchart TD
 | **Context Rot / Lost-in-the-Middle** | High degradation after 40k – 60k tokens | **Immune via 3-Tier Progressive Disclosure** |
 | **Mean Time-to-Heal (MTTR)** | 5 – 15 minutes of trial-and-error | **< 1 second (Direct cache resolution)** |
 
+*(Note: 300–800 tokens represents the dynamic micro-turn execution payload achieved via repo_map and distill_log, excluding the one-time IDE system rules prefix overhead of ~7,000 tokens).*
+
 ---
 
 ## 🚀 2. Getting Started & Integration (3 Approaches)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "synapse-hub",
-  "version": "2.2.3",
+  "version": "2.2.4",
   "description": "Enterprise AI Agent Intelligence Hub & Autonomous Skill Network",
   "publishConfig": {
     "access": "public"

package/skills_manifest.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "name": "Enterprise Agent Skills Hub",
-  "version": "2.2.3",
+  "version": "2.2.4",
   "description": "Unified Catalog of 28 Specialized Skills for Autonomous AI Agents in Enterprise Software Quality Engineering, Performance, and Architecture.",
   "totalSkills": 28,
   "categories": {

package/tools/browser_helpers.js

@@ -13,7 +13,7 @@
 (function () {
   'use strict';
 
-  if (window.__qa && window.__qa.__version === '2.2.3') {
+  if (window.__qa && window.__qa.__version === '2.2.4') {
     return window.__qa;
   }
 
@@ -47,7 +47,7 @@
   }
 
   const qa = {
-    __version: '2.2.3',
+    __version: '2.2.4',
 
     /**
      * 1. Smart Action Batching

package/tools/cli.py

@@ -29,7 +29,7 @@ sys.path.insert(0, SCRIPT_DIR)
 
 def cmd_version(args):
     manifest_path = os.path.join(REPO_ROOT, "skills_manifest.json")
-    version = "2.2.3"
+    version = "2.2.4"
     if os.path.exists(manifest_path):
         try:
             import json

package/tools/export_postman_collection.py

@@ -36,6 +36,7 @@ Usage:
 import os
 import sys
 import json
+import re
 import uuid
 import csv
 import argparse
@@ -82,7 +83,7 @@ def build_test_script(
         "// Auto-generated Test Assertions by Synapse-Hub",
         f"// 1. Assert Status Code is {expected_status}",
         f"pm.test('Status code is {expected_status}', function () {{",
-        f"    pm.expect(pm.response.code).to.be.oneOf([{expected_status}, 200, 201]);",
+        f"    pm.expect(pm.response.code).to.eql({expected_status});",
         "});",
         "",
         f"// 2. Assert SLA Latency (< {max_time_ms}ms)",
@@ -280,13 +281,34 @@ def parse_openapi_spec(spec_data: Dict[str, Any], base_url_override: Optional[st
                         "options": {"raw": {"language": "json"}}
                     }
 
-            # URL decomposition
-            path_segments = [seg for seg in path.strip("/").split("/") if seg]
+            # URL decomposition and path parameterization
+            raw_path = path
+            path_variables = []
+            normalized_segments = []
+            for seg in path.strip("/").split("/"):
+                if not seg:
+                    continue
+                match = re.match(r"^\{([a-zA-Z0-9_-]+)\}$", seg)
+                if match:
+                    param_name = match.group(1)
+                    raw_path = raw_path.replace(f"{{{param_name}}}", f":{param_name}")
+                    normalized_segments.append(f":{param_name}")
+                    default_val = "{{lastCreatedId}}" if param_name.lower() in ("id", "entityid", "orderid") else f"{{{{{param_name}}}}}"
+                    path_variables.append({
+                        "key": param_name,
+                        "value": default_val,
+                        "description": f"URL Path variable {param_name}"
+                    })
+                else:
+                    normalized_segments.append(seg)
+
             url_obj = {
-                "raw": f"{{{{baseUrl}}}}{path}",
+                "raw": f"{{{{baseUrl}}}}{raw_path}",
                 "host": ["{{baseUrl}}"],
-                "path": path_segments
+                "path": normalized_segments
             }
+            if path_variables:
+                url_obj["variable"] = path_variables
             if query_params:
                 url_obj["query"] = query_params
 
@@ -451,10 +473,10 @@ def generate_postman_environment(name: str = "Enterprise-Staging-Env", base_url:
         "name": name,
         "values": [
             {"key": "baseUrl", "value": base_url, "enabled": True},
-            {"key": "bearerToken", "value": "", "enabled": True},
+            {"key": "bearerToken", "value": "", "type": "secret", "enabled": True},
             {"key": "lastCreatedId", "value": "1", "enabled": True},
             {"key": "adminUser", "value": "qa_admin@enterprise.local", "enabled": True},
-            {"key": "adminPass", "value": "SecretVault#2026", "enabled": True}
+            {"key": "adminPass", "value": "SecretVault#2026", "type": "secret", "enabled": True}
         ],
         "_postman_variable_scope": "environment"
     }

package/tools/generate_jmx_plan.py

@@ -122,6 +122,16 @@ def build_jmx_xml(
         f'            <stringProp name="Argument.value">{sla_p95}</stringProp>',
         '            <stringProp name="Argument.metadata">=</stringProp>',
         '          </elementProp>',
+        '          <elementProp name="MAX_LATENCY" elementType="Argument">',
+        '            <stringProp name="Argument.name">MAX_LATENCY</stringProp>',
+        f'            <stringProp name="Argument.value">${{__P(max_latency, {max(3000, sla_p95 * 2)})}}</stringProp>',
+        '            <stringProp name="Argument.metadata">=</stringProp>',
+        '          </elementProp>',
+        '          <elementProp name="LAST_CREATED_ID" elementType="Argument">',
+        '            <stringProp name="Argument.name">LAST_CREATED_ID</stringProp>',
+        '            <stringProp name="Argument.value">1</stringProp>',
+        '            <stringProp name="Argument.metadata">=</stringProp>',
+        '          </elementProp>',
         '          <elementProp name="BEARER_TOKEN" elementType="Argument">',
         '            <stringProp name="Argument.name">BEARER_TOKEN</stringProp>',
         '            <stringProp name="Argument.value"></stringProp>',
@@ -469,9 +479,9 @@ def build_jmx_xml(
             f'{indent}    <intProp name="Assertion.test_type">40</intProp>',
             f'{indent}  </ResponseAssertion>',
             f'{indent}  <hashTree/>',
-            f'{indent}  <!-- SLA Latency Assertion -->',
-            f'{indent}  <DurationAssertion guiclass="DurationAssertionGui" testclass="DurationAssertion" testname="Assert SLA Latency (&lt; ${{SLA_P95}}ms)" enabled="true">',
-            f'{indent}    <stringProp name="DurationAssertion.duration">${{SLA_P95}}</stringProp>',
+            f'{indent}  <!-- SLA Ceiling Assertion (Percentile P95 is validated post-run by jtl_analyzer.py) -->',
+            f'{indent}  <DurationAssertion guiclass="DurationAssertionGui" testclass="DurationAssertion" testname="Assert Max Latency Ceiling (&lt; ${{MAX_LATENCY}}ms)" enabled="true">',
+            f'{indent}    <stringProp name="DurationAssertion.duration">${{MAX_LATENCY}}</stringProp>',
             f'{indent}  </DurationAssertion>',
             f'{indent}  <hashTree/>'
         ])
@@ -492,7 +502,7 @@ def build_jmx_xml(
                 f'{indent}  <!-- Deep Correlation: Random Array Item Selection (Match No: 0) -->',
                 f'{indent}  <JSONPostProcessor guiclass="JSONPostProcessorGui" testclass="JSONPostProcessor" testname="JSON Extractor - Random Item Selector" enabled="true">',
                 f'{indent}    <stringProp name="JSONPostProcessor.referenceNames">RANDOM_ITEM_ID</stringProp>',
-                f'{indent}    <stringProp name="JSONPostProcessor.jsonPathExprs">$..items[?(@.stock &gt; 0)].id, $..id, $..code</stringProp>',
+                f'{indent}    <stringProp name="JSONPostProcessor.jsonPathExprs">$..id</stringProp>',
                 f'{indent}    <stringProp name="JSONPostProcessor.match_numbers">0</stringProp>',
                 f'{indent}    <stringProp name="JSONPostProcessor.defaultValues">${{RANDOM_ITEM_ID}}</stringProp>',
                 f'{indent}  </JSONPostProcessor>',
@@ -505,7 +515,7 @@ def build_jmx_xml(
                 f'{indent}  <!-- Auto-Extract Dynamic Bearer Token -->',
                 f'{indent}  <JSONPostProcessor guiclass="JSONPostProcessorGui" testclass="JSONPostProcessor" testname="JSON Extractor - Bearer Token" enabled="true">',
                 f'{indent}    <stringProp name="JSONPostProcessor.referenceNames">BEARER_TOKEN</stringProp>',
-                f'{indent}    <stringProp name="JSONPostProcessor.jsonPathExprs">$.token, $.access_token, $.data.token, $.data.access_token</stringProp>',
+                f'{indent}    <stringProp name="JSONPostProcessor.jsonPathExprs">$..[\'token\',\'access_token\']</stringProp>',
                 f'{indent}    <stringProp name="JSONPostProcessor.match_numbers">1</stringProp>',
                 f'{indent}    <stringProp name="JSONPostProcessor.defaultValues">${{BEARER_TOKEN}}</stringProp>',
                 f'{indent}  </JSONPostProcessor>',
@@ -516,9 +526,9 @@ def build_jmx_xml(
                 f'{indent}  <!-- Auto-Extract Created Entity ID -->',
                 f'{indent}  <JSONPostProcessor guiclass="JSONPostProcessorGui" testclass="JSONPostProcessor" testname="JSON Extractor - Entity ID" enabled="true">',
                 f'{indent}    <stringProp name="JSONPostProcessor.referenceNames">LAST_CREATED_ID</stringProp>',
-                f'{indent}    <stringProp name="JSONPostProcessor.jsonPathExprs">$.id, $.code, $.data.id, $.data.code</stringProp>',
+                f'{indent}    <stringProp name="JSONPostProcessor.jsonPathExprs">$..[\'id\',\'code\']</stringProp>',
                 f'{indent}    <stringProp name="JSONPostProcessor.match_numbers">1</stringProp>',
-                f'{indent}    <stringProp name="JSONPostProcessor.defaultValues"></stringProp>',
+                f'{indent}    <stringProp name="JSONPostProcessor.defaultValues">${{LAST_CREATED_ID}}</stringProp>',
                 f'{indent}  </JSONPostProcessor>',
                 f'{indent}  <hashTree/>'
             ])
@@ -752,7 +762,10 @@ def parse_openapi_for_jmeter(spec_data: Dict[str, Any]) -> tuple:
 
             def replace_path_param(match):
                 pname = match.group(1)
-                if pname.lower() in ("id", "categoryid", "entityid", "userid"):
+                plow = pname.lower()
+                if plow in ("itemid", "productid", "item_id", "product_id"):
+                    return "${RANDOM_ITEM_ID}"
+                if plow in ("id", "categoryid", "entityid", "userid", "orderid", "order_id"):
                     return "${LAST_CREATED_ID}"
                 return f"${{{pname}}}"
 
@@ -794,6 +807,25 @@ def parse_openapi_for_jmeter(spec_data: Dict[str, Any]) -> tuple:
                 "expected_status": expected_status
             })
 
+    def sampler_sort_key(s: Dict[str, Any]) -> int:
+        p = s.get("path", "").lower()
+        m = s.get("method", "GET")
+        if "auth" in p or "login" in p or "token" in p:
+            return 1
+        if m == "POST" and "{" not in s.get("path", "") and "${" not in s.get("path", ""):
+            return 2
+        if m == "GET" and "{" not in s.get("path", "") and "${" not in s.get("path", ""):
+            return 3
+        if m == "GET":
+            return 4
+        if m in ("PUT", "PATCH"):
+            return 5
+        if m == "DELETE":
+            return 6
+        return 7
+
+    samplers.sort(key=sampler_sort_key)
+
     return plan_name, base_host, protocol, port, samplers
 
 
@@ -993,8 +1025,8 @@ def main():
         plan_name, base_host, protocol, port, samplers = parse_openapi_for_jmeter(spec_data)
     else:
         # Fallback to built-in sample spec
-        from export_postman_collection import get_sample_spec
-        spec_data = get_sample_spec()
+        from export_postman_collection import get_domain_spec
+        spec_data = get_domain_spec("ecommerce")
         plan_name, base_host, protocol, port, samplers = parse_openapi_for_jmeter(spec_data)
 
     # Base URL override if provided

package/tools/jtl_analyzer.py

@@ -362,7 +362,7 @@ def main():
     parser.add_argument("--sla-p95", type=float, default=None, help="P95 Latency threshold in ms (fails if exceeded).")
     parser.add_argument("--sla-p99", type=float, default=None, help="P99 Latency threshold in ms (fails if exceeded).")
     parser.add_argument("--sla-avg", type=float, default=None, help="Average Latency threshold in ms (fails if exceeded).")
-    parser.add_argument("--max-error-rate", type=float, default=None, help="Maximum allowed error rate percentage (e.g. 1.0 = 1%).")
+    parser.add_argument("--max-error-rate", type=float, default=None, help="Maximum allowed error rate percentage (e.g. 1.0 = 1%%).")
     parser.add_argument("--markdown", "-m", help="Output path for Markdown summary report.")
     parser.add_argument("--json", "-j", help="Output path for JSON summary metrics.")
     parser.add_argument("--telemetry", help="Path to server telemetry CSV (timestamp, cpu_pct, memory_pct, db_pool_pct) for Full-Stack APM correlation.")

package/tools/mcp_excel_server.ps1

@@ -160,7 +160,7 @@ while (($line = $inputReader.ReadLine()) -ne $null) {
                 result = @{
                     protocolVersion = "2024-11-05"
                     capabilities = @{ tools = @{} }
-                    serverInfo = @{ name = "excel-qa-mcp-server"; version = "2.2.3" }
+                    serverInfo = @{ name = "excel-qa-mcp-server"; version = "2.2.4" }
                 }
             }
             [System.Console]::Out.WriteLine(($resp | ConvertTo-Json -Compress -Depth 10))

package/tools/mcp_server.py

@@ -43,7 +43,7 @@ import traffic_session_converter
 import visual_som_helper
 
 SERVER_NAME = "enterprise-agent-qa"
-SERVER_VERSION = "2.2.3"
+SERVER_VERSION = "2.2.4"
 
 MCP_TOOLS = [
     {

package/tools/safety_firewall.py

@@ -41,6 +41,13 @@ DANGEROUS_ACTION_KEYWORDS = [
     r"\breset\b",
     r"\btransfer\b",
     r"\bformat\b",
+    # Multilingual & Vietnamese destructive keywords
+    r"x[oóòỏõọ][aáàảãạ]",
+    r"x[oóòỏõọ]a\s+t[aáàảãạ]t\s+c[aảáàãạ]",
+    r"h[uủúùũụ]y",
+    r"thanh\s+to[aáàảãạ]n",
+    r"r[uúùủũụ]t\s+ti[eềéèẻẽẹ]n",
+    r"n[aạáàảã]p\s+ti[eềéèẻẽẹ]n",
 ]
 
 DANGEROUS_SELECTOR_PATTERNS = [
@@ -50,6 +57,8 @@ DANGEROUS_SELECTOR_PATTERNS = [
     r"\.p-button-danger\b",
     r"\[aria-label\*=['\"]?delete['\"]?\]",
     r"button[#\.\-_a-zA-Z0-9]*[_\-]*(?:del|delete|purge|remove|wipe|drop)",
+    r":(?:has-text|text)\s*\(\s*['\"][^'\"]*(?:delete|remove|wipe|purge|pay|x[oóòỏõọ][aáàảãạ]|h[uủúùũụ]y|thanh\s*to[aáàảãạ]n)[^'\"]*['\"]\s*\)",
+    r"text=['\"][^'\"]*(?:delete|remove|wipe|purge|pay|x[oóòỏõọ][aáàảãạ]|h[uủúùũụ]y|thanh\s*to[aáàảãạ]n)",
 ]
 
 COMPILED_TEXT_REGEX = re.compile("|".join(DANGEROUS_ACTION_KEYWORDS), re.IGNORECASE)
@@ -84,8 +93,12 @@ def is_action_dangerous(action_type: str, text: str = "", selector: str = "") ->
         return True, f"Element text contains dangerous keyword: '{match}'"
 
     # Check selector
-    if sel_clean and COMPILED_SEL_REGEX.search(sel_clean):
-        return True, f"Element selector matches destructive pattern: '{sel_clean}'"
+    if sel_clean:
+        if COMPILED_SEL_REGEX.search(sel_clean):
+            return True, f"Element selector matches destructive pattern: '{sel_clean}'"
+        if COMPILED_TEXT_REGEX.search(sel_clean):
+            match = COMPILED_TEXT_REGEX.search(sel_clean).group(0)
+            return True, f"Element selector contains dangerous keyword: '{match}' in '{sel_clean}'"
 
     # Specific dangerous action types
     if action_type.lower() in ("drop_database", "wipe_environment", "execute_payment"):

package/tools/skillspector.py

@@ -165,7 +165,7 @@ PROHIBITION_PREFIX = re.compile(
 )
 
 ALERT_BLOCK_PREFIX = re.compile(
-    r"^\s*>\s*\[!(?:WARNING|CAUTION|DANGER|ALERT|IMPORTANT|NOTE|TIP)\]",
+    r"^\s*>\s*\[!(?:WARNING|CAUTION|DANGER|ALERT)\]",
     re.IGNORECASE | re.MULTILINE,
 )
 
@@ -189,23 +189,20 @@ def is_in_prohibition_context(content: str, start: int, end: int) -> bool:
     if PROHIBITION_PREFIX.search(current_line):
         return True
 
-    # 2. Markdown Caution/Warning Callout Block
-    if any(ALERT_BLOCK_PREFIX.search(line) for line in lines[-5:]):
+    # 2. Markdown Caution/Warning Callout Block with explicit negative imperative
+    has_alert = any(ALERT_BLOCK_PREFIX.search(line) for line in lines[-5:])
+    if has_alert and any(re.search(r'\b(never|do not|don[\'’]t|must not|forbidden|prohibited|avoid)\b', line, re.IGNORECASE) for line in lines[-5:]):
         return True
 
     # 3. Defensive Guideline headings ("Anti-Pattern Blacklist", "Forbidden actions")
     preceding_lower = preceding_text.lower()
     defensive_markers = (
-        "anti-pattern",
+        "anti-pattern blacklist",
         "mistake / anti-pattern",
         "strictly forbidden",
         "never use",
         "mandatory avoidance",
         "forbidden actions",
-        "prohibited",
-        "blacklist",
-        "threat model",
-        "vulnerability check",
         "zero-token error blacklist",
     )
     if any(marker in preceding_lower for marker in defensive_markers):
@@ -927,6 +924,9 @@ def scan_target(target_path: str) -> ScanReport:
         pass
 
     path_obj = Path(target_path).resolve()
+    if not path_obj.exists():
+        raise FileNotFoundError(f"Target path does not exist: {target_path}")
+
     all_findings: List[Finding] = []
     scanned_count = 0