synapse-hub 2.2.3 → 2.4.0

package/tools/output_formatter.py

@@ -0,0 +1,128 @@
+#!/usr/bin/env python3
+"""
+Enterprise Standardized Output Formatter & Exit Code Specification
+------------------------------------------------------------------
+Provides centralized terminal styling, NO_COLOR standard compliance,
+and deterministic exit codes across all Synapse Hub CLI tools.
+
+Exit Code Standards:
+  0: EXIT_SUCCESS           (Operation passed, DoD compliant)
+  1: EXIT_FAILURE           (Test failure, linter defect, gate rejection)
+  2: EXIT_USAGE_ERROR       (Invalid CLI arguments, syntax error)
+  3: EXIT_SECURITY_BLOCK    (Destructive action blocked, secret leaked, MIT license altered)
+  4: EXIT_ENVIRONMENT_ERROR (Missing required tool, incompatible runtime)
+"""
+
+import os
+import sys
+import json
+from typing import Any, Dict, Optional
+
+# Standard Exit Codes
+EXIT_SUCCESS = 0
+EXIT_FAILURE = 1
+EXIT_USAGE_ERROR = 2
+EXIT_SECURITY_BLOCK = 3
+EXIT_ENVIRONMENT_ERROR = 4
+
+
+def is_color_enabled() -> bool:
+    """
+    Determines if ANSI color codes should be rendered.
+    Honors https://no-color.org specification (NO_COLOR env var).
+    """
+    if os.environ.get("NO_COLOR") is not None:
+        return False
+    if os.environ.get("TERM") == "dumb":
+        return False
+    if os.environ.get("FORCE_COLOR") in ("1", "true", "TRUE"):
+        return True
+    return hasattr(sys.stdout, "isatty") and sys.stdout.isatty()
+
+
+class Colors:
+    """ANSI color codes with dynamic NO_COLOR enforcement."""
+    ESC = "\033"
+    CYAN = "\033[96m"
+    GREEN = "\033[92m"
+    YELLOW = "\033[93m"
+    RED = "\033[91m"
+    BOLD = "\033[1m"
+    DIM = "\033[2m"
+    RESET = "\033[0m"
+
+    @staticmethod
+    def _c(code: str) -> str:
+        return code if is_color_enabled() else ""
+
+    @classmethod
+    def cyan(cls, text: str) -> str:
+        return f"{cls._c(cls.CYAN)}{text}{cls._c(cls.RESET)}"
+
+    @classmethod
+    def green(cls, text: str) -> str:
+        return f"{cls._c(cls.GREEN)}{text}{cls._c(cls.RESET)}"
+
+    @classmethod
+    def yellow(cls, text: str) -> str:
+        return f"{cls._c(cls.YELLOW)}{text}{cls._c(cls.RESET)}"
+
+    @classmethod
+    def red(cls, text: str) -> str:
+        return f"{cls._c(cls.RED)}{text}{cls._c(cls.RESET)}"
+
+    @classmethod
+    def bold(cls, text: str) -> str:
+        return f"{cls._c(cls.BOLD)}{text}{cls._c(cls.RESET)}"
+
+    @classmethod
+    def dim(cls, text: str) -> str:
+        return f"{cls._c(cls.DIM)}{text}{cls._c(cls.RESET)}"
+
+
+class OutputFormatter:
+    """Standardized console & machine-readable output renderer."""
+
+    def __init__(self, quiet: bool = False, json_mode: bool = False):
+        self.quiet = quiet
+        self.json_mode = json_mode
+
+    def header(self, title: str):
+        if not self.quiet and not self.json_mode:
+            border = "=" * 70
+            print(f"\n{Colors.cyan(border)}")
+            print(f"   {Colors.bold(title)}")
+            print(f"{Colors.cyan(border)}\n")
+
+    def step(self, current: int, total: int, title: str):
+        if not self.quiet and not self.json_mode:
+            print(f"{Colors.bold(f'[{current}/{total}]')} {title}")
+
+    def pass_msg(self, message: str):
+        if not self.json_mode:
+            print(f"{Colors.green('✅ [PASS]')} {message}")
+
+    def fail_msg(self, message: str):
+        if not self.json_mode:
+            print(f"{Colors.red('❌ [FAIL]')} {message}")
+
+    def warn_msg(self, message: str):
+        if not self.quiet and not self.json_mode:
+            print(f"{Colors.yellow('⚠️  [WARN]')} {message}")
+
+    def info_msg(self, message: str):
+        if not self.quiet and not self.json_mode:
+            print(f"{Colors.cyan('ℹ️  [INFO]')} {message}")
+
+    def print_data(self, data: Any, format_type: str = "text"):
+        if format_type == "json" or self.json_mode:
+            if isinstance(data, (dict, list)):
+                print(json.dumps(data, indent=2, ensure_ascii=False))
+            else:
+                print(str(data))
+        else:
+            print(str(data))
+
+
+# Global default instance
+console = OutputFormatter()

package/tools/pinpoint_failure.py

@@ -1,88 +1,88 @@
-#!/usr/bin/env python3
-"""
-Fast Zero-Token Failure Pinpointer for Katalon & Jenkins Reports.
-Scans the latest Reports/**/JUnit_Report.xml, extracts failed Test Cases,
-exact failed lines in Groovy/Script, and the root-cause exception.
-Outputs < 100 tokens.
-
-Usage:
-    python3 tools/pinpoint_failure.py
-    python3 tools/pinpoint_failure.py path/to/JUnit_Report.xml
-"""
-import os
-import sys
-import glob
-import xml.etree.ElementTree as ET
-import re
-
-def find_latest_report():
-    reports = glob.glob("Reports/**/JUnit_Report.xml", recursive=True)
-    if not reports:
-        return None
-    reports.sort(key=lambda x: os.path.getmtime(x), reverse=True)
-    return reports[0]
-
-def parse_failures(xml_path):
-    if not os.path.exists(xml_path):
-        print(f"Error: {xml_path} does not exist.")
-        return []
-
-    tree = ET.parse(xml_path)
-    root = tree.getroot()
-    failures = []
-
-    suites = [root] if root.tag == "testsuite" else root.findall("testsuite")
-
-    for suite in suites:
-        for tc in suite.findall("testcase"):
-            tc_name = tc.get("name", "Unknown")
-            tc_time = tc.get("time", "0")
-            fail = tc.find("failure")
-            err = tc.find("error")
-            target = fail if fail is not None else err
-
-            if target is not None:
-                msg = target.get("message", "")
-                text = target.text or ""
-                combined = (msg + "\n" + text).replace("&#xa;", "\n")
-
-                # Extract Root Cause Reason
-                reason_match = re.search(r"Reason:\s*(.+?)(?=\n\s*at|\Z)", combined, re.DOTALL)
-                if reason_match:
-                    reason = reason_match.group(1).strip()
-                else:
-                    lines = [l.strip() for l in combined.split("\n") if l.strip()]
-                    reason = lines[0] if lines else "Unknown Error"
-
-                # Extract Failed Line in Groovy Page / Script
-                Enterprise_lines = re.findall(r"(?:Enterprise\.pages\.[\w]+|TC-[\w\s\u00C0-\u1EF9]+|Script\d+)\.groovy:\d+|(?:TC-[\w\s\u00C0-\u1EF9]+:\d+)", combined)
-
-                failures.append({
-                    "tc": tc_name.split("/")[-1],
-                    "time": f"{float(tc_time):.1f}s",
-                    "reason": reason.split("\n")[0][:180],
-                    "failed_at": Enterprise_lines[:2] if Enterprise_lines else ["See JUnit report"]
-                })
-
-    return failures
-
-def main():
-    xml_path = sys.argv[1] if len(sys.argv) > 1 else find_latest_report()
-    if not xml_path:
-        print("No JUnit_Report.xml found in Reports/.")
-        sys.exit(0)
-
-    print(f"=== Report: {xml_path} ===")
-    failures = parse_failures(xml_path)
-    if not failures:
-        print("✅ 100% PASSED: Zero failures found in report.")
-        return
-
-    print(f"❌ Found {len(failures)} Failed Test Case(s):")
-    for i, f in enumerate(failures, 1):
-        print(f"[{i}] {f['tc']} ({f['time']})")
-        print(f"    Cause: {f['reason']}")
-        print(f"    Line:  {', '.join(f['failed_at'])}")
-
-if __name__ == "__main__":
-    main()
+#!/usr/bin/env python3
+"""
+Fast Zero-Token Failure Pinpointer for Katalon & Jenkins Reports.
+Scans the latest Reports/**/JUnit_Report.xml, extracts failed Test Cases,
+exact failed lines in Groovy/Script, and the root-cause exception.
+Outputs < 100 tokens.
+
+Usage:
+    python3 tools/pinpoint_failure.py
+    python3 tools/pinpoint_failure.py path/to/JUnit_Report.xml
+"""
+import os
+import sys
+import glob
+import xml.etree.ElementTree as ET
+import re
+
+def find_latest_report():
+    reports = glob.glob("Reports/**/JUnit_Report.xml", recursive=True)
+    if not reports:
+        return None
+    reports.sort(key=lambda x: os.path.getmtime(x), reverse=True)
+    return reports[0]
+
+def parse_failures(xml_path):
+    if not os.path.exists(xml_path):
+        print(f"Error: {xml_path} does not exist.")
+        return []
+
+    tree = ET.parse(xml_path)
+    root = tree.getroot()
+    failures = []
+
+    suites = [root] if root.tag == "testsuite" else root.findall("testsuite")
+
+    for suite in suites:
+        for tc in suite.findall("testcase"):
+            tc_name = tc.get("name", "Unknown")
+            tc_time = tc.get("time", "0")
+            fail = tc.find("failure")
+            err = tc.find("error")
+            target = fail if fail is not None else err
+
+            if target is not None:
+                msg = target.get("message", "")
+                text = target.text or ""
+                combined = (msg + "\n" + text).replace("&#xa;", "\n")
+
+                # Extract Root Cause Reason
+                reason_match = re.search(r"Reason:\s*(.+?)(?=\n\s*at|\Z)", combined, re.DOTALL)
+                if reason_match:
+                    reason = reason_match.group(1).strip()
+                else:
+                    lines = [l.strip() for l in combined.split("\n") if l.strip()]
+                    reason = lines[0] if lines else "Unknown Error"
+
+                # Extract Failed Line in Groovy Page / Script
+                Enterprise_lines = re.findall(r"(?:Enterprise\.pages\.[\w]+|TC-[\w\s\u00C0-\u1EF9]+|Script\d+)\.groovy:\d+|(?:TC-[\w\s\u00C0-\u1EF9]+:\d+)", combined)
+
+                failures.append({
+                    "tc": tc_name.split("/")[-1],
+                    "time": f"{float(tc_time):.1f}s",
+                    "reason": reason.split("\n")[0][:180],
+                    "failed_at": Enterprise_lines[:2] if Enterprise_lines else ["See JUnit report"]
+                })
+
+    return failures
+
+def main():
+    xml_path = sys.argv[1] if len(sys.argv) > 1 else find_latest_report()
+    if not xml_path:
+        print("No JUnit_Report.xml found in Reports/.")
+        sys.exit(0)
+
+    print(f"=== Report: {xml_path} ===")
+    failures = parse_failures(xml_path)
+    if not failures:
+        print("✅ 100% PASSED: Zero failures found in report.")
+        return
+
+    print(f"❌ Found {len(failures)} Failed Test Case(s):")
+    for i, f in enumerate(failures, 1):
+        print(f"[{i}] {f['tc']} ({f['time']})")
+        print(f"    Cause: {f['reason']}")
+        print(f"    Line:  {', '.join(f['failed_at'])}")
+
+if __name__ == "__main__":
+    main()

package/tools/project_state.py

@@ -56,7 +56,7 @@ def init_state(target_dir, goal="Initial Autonomous Setup"):
 - Failing Locator / Line: `[None]`
 
 ## 4. Quality Verification
-- 7 Quality Gates: `READY`
+- 9 Quality Gates: `READY`
 - Clean POM Integrity: `VERIFIED`
 """
     with open(state_file, "w", encoding="utf-8") as f:
@@ -146,7 +146,7 @@ def update_state(target_dir, goal=None, completed_task=None, pending_task=None,
 {watch_block}
 
 ## 4. Quality Verification
-- 7 Quality Gates: `{current_gate}`
+- 9 Quality Gates: `{current_gate}`
 - Clean POM Integrity: `VERIFIED`
 """
     with open(state_file, "w", encoding="utf-8") as f:

package/tools/repo_map.py

@@ -221,7 +221,7 @@ def build_repo_map(target_repo=None, output_txt=None, output_json=None):
 
     rendered_text = "\n".join(out_lines)
     compressed_bytes = len(rendered_text.encode("utf-8"))
-    ratio = (1.0 - (compressed_bytes / max(1, total_raw_bytes))) * 100
+    ratio = (1.0 - (compressed_bytes / total_raw_bytes)) * 100 if total_raw_bytes > 0 else 0.0
     est_tokens = len(rendered_text) // 4
 
     # 1. Save to primary destination (tools/repo_map.txt in Hub)

package/tools/safety_firewall.py

@@ -29,27 +29,52 @@ if hasattr(sys.stdout, 'reconfigure'):
 
 DANGEROUS_ACTION_KEYWORDS = [
     r"\bdelete\b",
-    r"\bremove\b",
     r"\bpurge\b",
     r"\bwipe\b",
     r"\bdrop\b",
     r"\bpay\b",
     r"\bpurchase\b",
-    r"\bcheckout\b",
-    r"\bterminate\b",
+    r"\bplace\s+order\b",
+    r"\bconfirm\s+(?:payment|order|delete|deletion|purge|wipe|destroy)\b",
+    r"\bsubmit\s+order\b",
+    r"\barchive\s+(?:all|data|system|database|account)\b",
+    r"\brevoke\s+access\b",
+    r"\bcancel\s+subscription\b",
+    r"\berase\s+all\s+data\b",
+    r"\bterminate(?:\s+account)?\b",
     r"\bdestroy\b",
-    r"\breset\b",
-    r"\btransfer\b",
-    r"\bformat\b",
+    r"\bformat\s+(?:disk|drive|system|database|table|partition)\b",
+    # Multilingual & Vietnamese destructive keywords with strict word boundaries
+    r"(?<!\w)x[oóòỏõọ][aáàảãạ](?!\w)",
+    r"(?<!\w)x[oóòỏõọ]a\s+t[aáàảãạ]t\s+c[aảáàãạ](?!\w)",
+    r"(?<!\w)h[uủúùũụ]y\s+b[oỏóòõọ](?!\w)",
+    r"(?<!\w)h[uủúùũụ]y\s+t[aàáảãạ]i\s+kho[aảáàãạ]n(?!\w)",
+    r"(?<!\w)thanh\s+to[aáàảãạ]n(?!\w)",
+    r"(?<!\w)r[uúùủũụ]t\s+ti[eềéèẻẽẹ]n(?!\w)",
+    r"(?<!\w)n[aạáàảã]p\s+ti[eềéèẻẽẹ]n(?!\w)",
 ]
 
+# Explicit whitelist of benign user-flow patterns that require exact fullmatch to authorize
+BENIGN_ACTIONS_WHITELIST = [
+    re.compile(r"(?i)^\s*(?:checkout|proceed\s+to\s+checkout)\s*$"),
+    re.compile(r"(?i)^\s*(?:reset\s+password)\s*$"),
+    re.compile(r"(?i)^\s*(?:remove\s+from\s+cart)\s*$"),
+    re.compile(r"(?i)^\s*(?:xoay\s+[aảáàãạ]nh)\s*$"),
+]
+
+def _split_words_and_camel(s: str) -> str:
+    """Expands camelCase and PascalCase into separated words for keyword inspection."""
+    return re.sub(r'([a-z0-9])([A-Z])', r'\1 \2', s)
+
 DANGEROUS_SELECTOR_PATTERNS = [
-    r"\[data-action\*=['\"]?delete['\"]?\]",
-    r"\[data-action\*=['\"]?pay['\"]?\]",
+    r"\[data-action\*=['\"]?(?:delete|pay|confirm)['\"]?\]",
     r"\.btn-danger\b",
     r"\.p-button-danger\b",
-    r"\[aria-label\*=['\"]?delete['\"]?\]",
-    r"button[#\.\-_a-zA-Z0-9]*[_\-]*(?:del|delete|purge|remove|wipe|drop)",
+    r"#(?:btn-confirm|btn-delete|btn-purge)\b",
+    r"\[aria-label\*=['\"]?(?:delete|pay|confirm)['\"]?\]",
+    r"button[#\.\-_a-zA-Z0-9]*[_\-]*(?:del|delete|purge|wipe|drop|confirm|archive)",
+    r":(?:has-text|text)\s*\(\s*(['\"])[^'\"]*(?:delete|wipe|purge|pay|confirm|archive|x[oóòỏõọ][aáàảãạ]|h[uủúùũụ]y\s+b[oỏóòõọ]|thanh\s*to[aáàảãạ]n)[^'\"]*\1\s*\)",
+    r"text=(['\"])[^'\"]*(?:delete|wipe|purge|pay|confirm|archive|x[oóòỏõọ][aáàảãạ]|h[uủúùũụ]y\s+b[oỏóòõọ]|thanh\s*to[aáàảãạ]n)\1",
 ]
 
 COMPILED_TEXT_REGEX = re.compile("|".join(DANGEROUS_ACTION_KEYWORDS), re.IGNORECASE)
@@ -57,16 +82,20 @@ COMPILED_SEL_REGEX = re.compile("|".join(DANGEROUS_SELECTOR_PATTERNS), re.IGNORE
 
 # Pattern to extract interaction statements from Playwright / Selenium / Groovy
 INTERACTION_CODE_PATTERNS = [
-    # page.click('selector'), page.fill('selector', 'val')
-    re.compile(r"""(?:page|frame)\.(?P<act>click|dblclick|fill|type|press|check)\s*\(\s*['"](?P<sel>[^'"]+)['"](?:\s*,\s*['"](?P<text>[^'"]*)['"])?""", re.IGNORECASE),
-    # page.locator('selector').click()
-    re.compile(r"""(?:page|frame)\.locator\s*\(\s*['"](?P<sel>[^'"]+)['"]\s*\)\.(?P<act>click|fill|press)""", re.IGNORECASE),
+    # page.click('selector'), page.fill('selector', 'val') - supports nested quotes
+    re.compile(r"""(?:page|frame)\.(?P<act>click|dblclick|fill|type|press|check)\s*\(\s*(?P<q>['"])(?P<sel>(?:(?!(?P=q)|\\).|\\.)*)(?P=q)(?:\s*,\s*['"](?P<text>[^'"]*)['"])?""", re.IGNORECASE),
+    # page.locator('selector').click() or page.locator(VAR).click()
+    re.compile(r"""(?:page|frame)\.locator\s*\(\s*(?:(?P<q>['"])(?P<sel>(?:(?!(?P=q)|\\).|\\.)*)(?P=q)|(?P<var_arg>[a-zA-Z0-9_]+))\s*\)\.(?P<act>click|fill|press)""", re.IGNORECASE),
     # page.getByText('text').click()
-    re.compile(r"""(?:page|frame)\.getByText\s*\(\s*['"](?P<text>[^'"]+)['"]\s*\)\.(?P<act>click)""", re.IGNORECASE),
+    re.compile(r"""(?:page|frame)\.getByText\s*\(\s*(?P<q>['"])(?P<text>(?:(?!(?P=q)|\\).|\\.)*)(?P=q)\s*\)\.(?P<act>click)""", re.IGNORECASE),
     # page.getByRole('button', { name: 'Delete' }).click()
     re.compile(r"""(?:page|frame)\.getByRole\s*\(\s*['"](?P<role>[^'"]+)['"]\s*,\s*\{[^}]*name:\s*['"](?P<text>[^'"]+)['"]""", re.IGNORECASE),
     # WebUI.click(findTestObject(...)) or WebUI.clickOffset
     re.compile(r"""WebUI\.(?P<act>click|setText)\s*\([^)]*['"](?P<sel>[^'"]*)['"]""", re.IGNORECASE),
+    # Variable locator call: e.g. deleteBtn.click(), btn.click()
+    re.compile(r"""\b(?!(?:page|frame|WebUI)\b)(?P<var>[a-zA-Z0-9_]+)\.(?P<act>click|dblclick|fill|press|tap)\s*\(""", re.IGNORECASE),
+    # Clean POM method invocation: e.g. customerPage.deleteAllCustomers(), accountPO.purgeAccount(userId)
+    re.compile(r"""\b(?!(?:page|frame|WebUI)\b)(?P<page>[a-zA-Z0-9_]*(?:Page|PO|View|Service|Component|[a-z]))\.(?P<act>[a-zA-Z0-9_]+)\s*\((?P<args>[^)]*)\)""", re.IGNORECASE),
 ]
 
 
@@ -77,19 +106,36 @@ def is_action_dangerous(action_type: str, text: str = "", selector: str = "") ->
     """
     text_clean = text.strip() if text else ""
     sel_clean = selector.strip() if selector else ""
+    act_clean = action_type.strip() if action_type else "click"
 
-    # Check text content
-    if text_clean and COMPILED_TEXT_REGEX.search(text_clean):
-        match = COMPILED_TEXT_REGEX.search(text_clean).group(0)
-        return True, f"Element text contains dangerous keyword: '{match}'"
-
-    # Check selector
-    if sel_clean and COMPILED_SEL_REGEX.search(sel_clean):
-        return True, f"Element selector matches destructive pattern: '{sel_clean}'"
-
-    # Specific dangerous action types
-    if action_type.lower() in ("drop_database", "wipe_environment", "execute_payment"):
+    # 1. Action type verification
+    act_expanded = _split_words_and_camel(act_clean)
+    if act_clean.lower() in ("drop_database", "wipe_environment", "execute_payment"):
         return True, f"Action type '{action_type}' is classified as irreversible"
+    match_act = COMPILED_TEXT_REGEX.search(act_clean) or COMPILED_TEXT_REGEX.search(act_expanded)
+    if match_act:
+        return True, f"Action method contains dangerous verb: '{match_act.group(0)}'"
+
+    # 2. Check text (Dangerous check runs FIRST; benign whitelist requires strict fullmatch)
+    if text_clean:
+        text_expanded = _split_words_and_camel(text_clean)
+        match = COMPILED_TEXT_REGEX.search(text_clean) or COMPILED_TEXT_REGEX.search(text_expanded)
+        if match:
+            # Check strict benign whitelist fullmatch before flagging
+            if any(p.fullmatch(text_clean) for p in BENIGN_ACTIONS_WHITELIST):
+                pass
+            else:
+                return True, f"Element text contains dangerous keyword: '{match.group(0)}'"
+
+    # 3. Check selector
+    if sel_clean:
+        if not any(p.fullmatch(sel_clean) for p in BENIGN_ACTIONS_WHITELIST):
+            if COMPILED_SEL_REGEX.search(sel_clean):
+                return True, f"Element selector matches destructive pattern: '{sel_clean}'"
+            sel_expanded = _split_words_and_camel(sel_clean)
+            match = COMPILED_TEXT_REGEX.search(sel_clean) or COMPILED_TEXT_REGEX.search(sel_expanded)
+            if match:
+                return True, f"Element selector contains dangerous keyword: '{match.group(0)}' in '{sel_clean}'"
 
     return False, "Action passed safety firewall inspection"
 
@@ -117,38 +163,132 @@ def inspect_and_authorize(action_type: str, text: str = "", selector: str = "",
 def inspect_code_snippet(code: str, force: bool = False) -> List[Dict[str, Any]]:
     """
     Parses a code snippet or script and checks all discovered UI interaction statements.
+    Tracks variable locator assignments across lines to detect chained and indirect invocations.
     """
     inspections = []
     lines = code.splitlines()
+    tracked_vars: Dict[str, str] = {}
+
+    var_assign_re = re.compile(
+        r"""(?:const|let|var|def|\$)?\s*(?P<var>[a-zA-Z0-9_]+)\s*=\s*(?:(?:page|frame)\.(?:locator|getByTestId|getByText)\s*\(\s*(?:(?P<q1>['"])(?P<val1>(?:(?!(?P=q1)|\\).|\\.)*)(?P=q1)|(?P<arg_var>[a-zA-Z0-9_]+))\s*\)|(?:page|frame)\.getByRole\s*\(\s*['"][^'"]+['"]\s*,\s*\{[^}]*name:\s*(?P<q_role>['"])(?P<val_role>(?:(?!(?P=q_role)|\\).|\\.)*)(?P=q_role)|(?P<q2>['"])(?P<val2>(?:(?!(?P=q2)|\\).|\\.)*)(?P=q2))""",
+        re.IGNORECASE
+    )
 
     for line_idx, line in enumerate(lines, start=1):
         stripped = line.strip()
         if not stripped or stripped.startswith(("//", "#", "/*", "*")):
             continue
 
+        # Track variable definitions
+        m_assign = var_assign_re.search(stripped)
+        if m_assign:
+            var_name = m_assign.group("var")
+            val = m_assign.group("val1") or m_assign.group("val2") or m_assign.group("val_role") or ""
+            if not val and m_assign.group("arg_var"):
+                arg_v = m_assign.group("arg_var")
+                val = tracked_vars.get(arg_v, arg_v)
+            # Recursively unwrap aliases
+            while val in tracked_vars:
+                val = tracked_vars[val]
+            if var_name and val:
+                tracked_vars[var_name] = val
+
         matched = False
         for pattern in INTERACTION_CODE_PATTERNS:
+            found_any = False
             for match in pattern.finditer(line):
-                matched = True
                 groups = match.groupdict()
                 act = groups.get("act") or "click"
                 sel = groups.get("sel") or ""
                 text = groups.get("text") or ""
+                var_arg = groups.get("var_arg")
+                var_name = groups.get("var")
+
+                if var_arg:
+                    sel = tracked_vars.get(var_arg, var_arg)
+                elif not sel and groups.get("page"):
+                    sel = f"{groups.get('page')}.{act}"
+                elif not sel and var_name:
+                    sel = tracked_vars.get(var_name, var_name)
+
+                # Recursively unwrap selector if it matches an alias
+                while sel in tracked_vars:
+                    sel = tracked_vars[sel]
+
                 auth = inspect_and_authorize(act, text=text, selector=sel, force=force)
                 auth["line"] = line_idx
                 auth["code"] = stripped
                 inspections.append(auth)
+                found_any = True
+            if found_any:
+                matched = True
+                break
 
-        # Fallback: line itself contains dangerous keyword and an action verb
-        if not matched and COMPILED_TEXT_REGEX.search(stripped) and any(w in stripped.lower() for w in ("click", "press", "submit", "post", "delete")):
-            auth = inspect_and_authorize("dispatch", text=stripped, selector="", force=force)
-            auth["line"] = line_idx
-            auth["code"] = stripped
-            inspections.append(auth)
+        # Fallback: line itself contains dangerous keyword and an action verb (ignore pure assignments)
+        if not matched and not m_assign:
+            line_expanded = _split_words_and_camel(stripped)
+            if (COMPILED_TEXT_REGEX.search(stripped) or COMPILED_TEXT_REGEX.search(line_expanded)) and any(w in stripped.lower() for w in ("click", "press", "submit", "post", "delete", "purge", "wipe", "drop", "pay")):
+                auth = inspect_and_authorize("dispatch", text=stripped, selector="", force=force)
+                auth["line"] = line_idx
+                auth["code"] = stripped
+                inspections.append(auth)
 
     return inspections
 
 
+def detect_action_loop(action_history: List[str], repeat_threshold: int = 4) -> Dict[str, Any]:
+    """
+    Detects infinite action loops and repeating cycle patterns among agent tool calls.
+    Inspired by agentblazo/blazo deterministic detection rules.
+    
+    Checks:
+      1. Consecutive identical actions (>= repeat_threshold)
+      2. 2-action repeating cycle: [A, B, A, B]
+      3. 3-action repeating cycle: [A, B, C, A, B, C]
+    """
+    if not action_history or len(action_history) < 2:
+        return {"loop_detected": False, "reason": "History too short", "severity": "none", "pattern": []}
+
+    names = [a.strip() for a in action_history if a.strip()]
+
+    # 1. Check consecutive identical repeats
+    i = 0
+    while i < len(names):
+        name = names[i]
+        end = i + 1
+        while end < len(names) and names[end] == name:
+            end += 1
+        length = end - i
+        if length >= repeat_threshold:
+            return {
+                "loop_detected": True,
+                "type": "consecutive_repeat",
+                "severity": "critical",
+                "message": f"Possible loop: action '{name}' repeated {length} times in a row",
+                "pattern": [name] * length
+            }
+        i = end
+
+    # 2. Check 2-action and 3-action trailing cycles
+    for block in (2, 3):
+        if len(names) < block * 2:
+            continue
+        start = len(names) - block * 2
+        left_block = names[start : start + block]
+        right_block = names[start + block : start + block * 2]
+        if left_block == right_block and len(set(left_block)) >= 2:
+            pattern_str = " -> ".join(left_block)
+            return {
+                "loop_detected": True,
+                "type": f"cycle_{block}",
+                "severity": "critical",
+                "message": f"Possible loop: cycle pattern [{pattern_str}] repeated",
+                "pattern": left_block
+            }
+
+    return {"loop_detected": False, "reason": "No loop patterns detected", "severity": "none", "pattern": []}
+
+
 def main():
     parser = argparse.ArgumentParser(description="Action Safety Firewall & Blast Radius Containment Engine")
     parser.add_argument("--action", default="click", help="Action type (click, fill, submit)")
@@ -160,8 +300,32 @@ def main():
     parser.add_argument("--dry-run", action="store_true", help="Execute in pre-execution dry-run mode (outputs validation report)")
     parser.add_argument("--force", action="store_true", help="Force bypass safety firewall")
     parser.add_argument("--json", action="store_true", help="Output results in JSON format")
+    parser.add_argument("--history", default="", help="Comma-separated or JSON list of historical action names to check for infinite loops")
+    parser.add_argument("--check-loop", action="store_true", help="Explicitly audit action history for cycle/infinite loops")
     args = parser.parse_args()
 
+    # Loop check mode (Blazo-inspired)
+    if args.history or args.check_loop:
+        hist_items = []
+        if args.history:
+            if args.history.strip().startswith("[") and args.history.strip().endswith("]"):
+                try:
+                    hist_items = json.loads(args.history)
+                except Exception:
+                    hist_items = [h.strip() for h in args.history.split(",") if h.strip()]
+            else:
+                hist_items = [h.strip() for h in args.history.split(",") if h.strip()]
+
+        loop_res = detect_action_loop(hist_items)
+        if args.json:
+            print(json.dumps(loop_res, indent=2))
+        else:
+            if loop_res["loop_detected"]:
+                print(f"❌ [LOOP_DETECTED] {loop_res['message']} (Severity: {loop_res['severity'].upper()})")
+            else:
+                print("✅ [LOOP_CLEAR] No infinite loop or cycle pattern detected in action history.")
+        return 1 if loop_res["loop_detected"] else 0
+
     # Determine input source: explicit stdin flag/arg, --file, --code, or parameters
     code_content = ""
     if args.code and args.code != "-":