synapse-hub 2.4.1 → 2.4.2

package/tools/api_fuzzer.py

@@ -115,12 +115,21 @@ class ApiFuzzer:
         parsed = urllib.parse.urlparse(self.base_url)
         host = (parsed.hostname or "").lower().strip()
         is_safe_env = self._is_safe_non_prod_host(host)
-        if host and not is_safe_env and not os.environ.get("SYNAPSE_ALLOW_PROD_FUZZ"):
+        allowed_hosts = {
+            h.strip().lower() for h in os.environ.get("SYNAPSE_ALLOW_PROD_HOSTS", "").split(",") if h.strip()
+        }
+        is_host_specifically_allowed = host in allowed_hosts
+        global_override = os.environ.get("SYNAPSE_ALLOW_PROD_FUZZ") in ("1", "true", "TRUE")
+
+        if host and not is_safe_env and not (is_host_specifically_allowed or global_override):
             raise PermissionError(
                 f"[SAFETY FIREWALL - REJECTED] Target host '{host}' is not in the allowed non-production environment allowlist "
                 "(localhost, private IP, .local/.internal, or verified dev/staging/qa/test subdomain). "
-                "Set SYNAPSE_ALLOW_PROD_FUZZ=1 only if authorized."
+                f"To authorize this host specifically, set SYNAPSE_ALLOW_PROD_HOSTS='{host}' or SYNAPSE_ALLOW_PROD_FUZZ=1 if authorized."
             )
+        if host and not is_safe_env and global_override and not is_host_specifically_allowed:
+            print(f"  ⚠️ [SECURITY WARNING] SYNAPSE_ALLOW_PROD_FUZZ=1 global override active for host '{host}'. "
+                  f"Prefer setting SYNAPSE_ALLOW_PROD_HOSTS='{host}' for host-scoped permission.")
 
         # Prepare SSL context (support self-signed staging certificates via explicit --insecure flag)
         self.ssl_context = ssl.create_default_context()

package/tools/browser_helpers.js

@@ -13,7 +13,7 @@
 (function () {
   'use strict';
 
-  if (window.__qa && window.__qa.__version === '2.4.1') {
+  if (window.__qa && window.__qa.__version === '2.4.2') {
     return window.__qa;
   }
 
@@ -47,7 +47,7 @@
   }
 
   const qa = {
-    __version: '2.4.1',
+    __version: '2.4.2',
 
     /**
      * 1. Smart Action Batching

package/tools/bump_version.py

@@ -196,6 +196,7 @@ def main():
     update_file("tools/mcp_excel_server.ps1", r'(version\s*=\s*")[^"]+(")', rf"\g<1>{new_ver}\g<2>", args.dry_run)
 
     # 7b. tools/mcp_excel_server.py
+    update_file("tools/mcp_excel_server.py", r'(SERVER_VERSION\s*=\s*")[^"]+(")', rf"\g<1>{new_ver}\g<2>", args.dry_run)
     update_file("tools/mcp_excel_server.py", r'("serverInfo":\s*\{[^}]*"version":\s*")[^"]+(")', rf"\g<1>{new_ver}\g<2>", args.dry_run)
 
     # 8. docs/ARCHITECTURE.md

package/tools/cli.py

@@ -41,7 +41,7 @@ RESET = "\033[0m"
 def cmd_version(args):
     """Displays the current hub version, skill catalog count, and license information."""
     manifest_path = os.path.join(REPO_ROOT, "skills_manifest.json")
-    version = "2.4.1"
+    version = "2.4.2"
     if os.path.exists(manifest_path):
         try:
             import json
@@ -516,7 +516,7 @@ def cmd_mcp_excel(args):
 
 def _hub_version():
     manifest_path = os.path.join(REPO_ROOT, "skills_manifest.json")
-    version = "2.4.1"
+    version = "2.4.2"
     if os.path.exists(manifest_path):
         try:
             import json

package/tools/dashboard_generator.py

@@ -1885,7 +1885,7 @@ def generate_hub_html(
 
     translations_vi = {
         "header_title": "Bảng Điều Hành Chất Lượng Doanh Nghiệp",
-        "header_subtitle": "Synapse-Hub v2.4.1 • Hệ Sinh Thái Kiểm Thử AI Agent Tự Chủ",
+        "header_subtitle": "Synapse-Hub v2.4.2 • Hệ Sinh Thái Kiểm Thử AI Agent Tự Chủ",
         "nav_welcome": "Giới Thiệu",
         "meta_mode": "🏷️ Chế độ: <strong>HỆ SINH THÁI QA HUB</strong>",
         "meta_gen": f"🕒 Khởi tạo: <strong>{now_str}</strong>",
@@ -1963,7 +1963,7 @@ def generate_hub_html(
 
     translations_en = {
         "header_title": "Enterprise QA Executive Dashboard",
-        "header_subtitle": "Synapse-Hub v2.4.1 &bull; Autonomous AI Agent Testing Ecosystem",
+        "header_subtitle": "Synapse-Hub v2.4.2 &bull; Autonomous AI Agent Testing Ecosystem",
         "nav_welcome": "Welcome",
         "meta_mode": "🏷️ Mode: <strong>QA HUB ECOSYSTEM</strong>",
         "meta_gen": f"🕒 Generated: <strong>{now_str}</strong>",

package/tools/mcp_excel_server.py

@@ -23,6 +23,8 @@ if hasattr(sys.stdout, 'reconfigure'):
     except Exception:
         pass
 
+SERVER_VERSION = "2.4.2"
+
 NS_MAIN = "{http://schemas.openxmlformats.org/spreadsheetml/2006/main}"
 NS_REL = "{http://schemas.openxmlformats.org/officeDocument/2006/relationships}"
 
@@ -194,7 +196,7 @@ def process_message(msg: Dict[str, Any]) -> Dict[str, Any]:
             "result": {
                 "protocolVersion": "2024-11-05",
                 "capabilities": {"tools": {}},
-                "serverInfo": {"name": "synapse-mcp-excel", "version": "2.4.1"}
+                "serverInfo": {"name": "synapse-mcp-excel", "version": SERVER_VERSION}
             }
         }
     elif method == "tools/list":

package/tools/mcp_server.py

@@ -47,7 +47,7 @@ import gherkin_suite
 import api_fuzzer
 
 SERVER_NAME = "enterprise-agent-qa"
-SERVER_VERSION = "2.4.1"
+SERVER_VERSION = "2.4.2"
 
 MCP_TOOLS = [
     {

package/tools/pinpoint_failure.py

@@ -1,88 +1,88 @@
-#!/usr/bin/env python3
-"""
-Fast Zero-Token Failure Pinpointer for Katalon & Jenkins Reports.
-Scans the latest Reports/**/JUnit_Report.xml, extracts failed Test Cases,
-exact failed lines in Groovy/Script, and the root-cause exception.
-Outputs < 100 tokens.
-
-Usage:
-    python3 tools/pinpoint_failure.py
-    python3 tools/pinpoint_failure.py path/to/JUnit_Report.xml
-"""
-import os
-import sys
-import glob
-import xml.etree.ElementTree as ET
-import re
-
-def find_latest_report():
-    reports = glob.glob("Reports/**/JUnit_Report.xml", recursive=True)
-    if not reports:
-        return None
-    reports.sort(key=lambda x: os.path.getmtime(x), reverse=True)
-    return reports[0]
-
-def parse_failures(xml_path):
-    if not os.path.exists(xml_path):
-        print(f"Error: {xml_path} does not exist.")
-        return []
-
-    tree = ET.parse(xml_path)
-    root = tree.getroot()
-    failures = []
-
-    suites = [root] if root.tag == "testsuite" else root.findall("testsuite")
-
-    for suite in suites:
-        for tc in suite.findall("testcase"):
-            tc_name = tc.get("name", "Unknown")
-            tc_time = tc.get("time", "0")
-            fail = tc.find("failure")
-            err = tc.find("error")
-            target = fail if fail is not None else err
-
-            if target is not None:
-                msg = target.get("message", "")
-                text = target.text or ""
-                combined = (msg + "\n" + text).replace("&#xa;", "\n")
-
-                # Extract Root Cause Reason
-                reason_match = re.search(r"Reason:\s*(.+?)(?=\n\s*at|\Z)", combined, re.DOTALL)
-                if reason_match:
-                    reason = reason_match.group(1).strip()
-                else:
-                    lines = [l.strip() for l in combined.split("\n") if l.strip()]
-                    reason = lines[0] if lines else "Unknown Error"
-
-                # Extract Failed Line in Groovy Page / Script
-                Enterprise_lines = re.findall(r"(?:Enterprise\.pages\.[\w]+|TC-[\w\s\u00C0-\u1EF9]+|Script\d+)\.groovy:\d+|(?:TC-[\w\s\u00C0-\u1EF9]+:\d+)", combined)
-
-                failures.append({
-                    "tc": tc_name.split("/")[-1],
-                    "time": f"{float(tc_time):.1f}s",
-                    "reason": reason.split("\n")[0][:180],
-                    "failed_at": Enterprise_lines[:2] if Enterprise_lines else ["See JUnit report"]
-                })
-
-    return failures
-
-def main():
-    xml_path = sys.argv[1] if len(sys.argv) > 1 else find_latest_report()
-    if not xml_path:
-        print("No JUnit_Report.xml found in Reports/.")
-        sys.exit(0)
-
-    print(f"=== Report: {xml_path} ===")
-    failures = parse_failures(xml_path)
-    if not failures:
-        print("✅ 100% PASSED: Zero failures found in report.")
-        return
-
-    print(f"❌ Found {len(failures)} Failed Test Case(s):")
-    for i, f in enumerate(failures, 1):
-        print(f"[{i}] {f['tc']} ({f['time']})")
-        print(f"    Cause: {f['reason']}")
-        print(f"    Line:  {', '.join(f['failed_at'])}")
-
-if __name__ == "__main__":
-    main()
+#!/usr/bin/env python3
+"""
+Fast Zero-Token Failure Pinpointer for Katalon & Jenkins Reports.
+Scans the latest Reports/**/JUnit_Report.xml, extracts failed Test Cases,
+exact failed lines in Groovy/Script, and the root-cause exception.
+Outputs < 100 tokens.
+
+Usage:
+    python3 tools/pinpoint_failure.py
+    python3 tools/pinpoint_failure.py path/to/JUnit_Report.xml
+"""
+import os
+import sys
+import glob
+import xml.etree.ElementTree as ET
+import re
+
+def find_latest_report():
+    reports = glob.glob("Reports/**/JUnit_Report.xml", recursive=True)
+    if not reports:
+        return None
+    reports.sort(key=lambda x: os.path.getmtime(x), reverse=True)
+    return reports[0]
+
+def parse_failures(xml_path):
+    if not os.path.exists(xml_path):
+        print(f"Error: {xml_path} does not exist.")
+        return []
+
+    tree = ET.parse(xml_path)
+    root = tree.getroot()
+    failures = []
+
+    suites = [root] if root.tag == "testsuite" else root.findall("testsuite")
+
+    for suite in suites:
+        for tc in suite.findall("testcase"):
+            tc_name = tc.get("name", "Unknown")
+            tc_time = tc.get("time", "0")
+            fail = tc.find("failure")
+            err = tc.find("error")
+            target = fail if fail is not None else err
+
+            if target is not None:
+                msg = target.get("message", "")
+                text = target.text or ""
+                combined = (msg + "\n" + text).replace("&#xa;", "\n")
+
+                # Extract Root Cause Reason
+                reason_match = re.search(r"Reason:\s*(.+?)(?=\n\s*at|\Z)", combined, re.DOTALL)
+                if reason_match:
+                    reason = reason_match.group(1).strip()
+                else:
+                    lines = [l.strip() for l in combined.split("\n") if l.strip()]
+                    reason = lines[0] if lines else "Unknown Error"
+
+                # Extract Failed Line in Groovy Page / Script
+                Enterprise_lines = re.findall(r"(?:Enterprise\.pages\.[\w]+|TC-[\w\s\u00C0-\u1EF9]+|Script\d+)\.groovy:\d+|(?:TC-[\w\s\u00C0-\u1EF9]+:\d+)", combined)
+
+                failures.append({
+                    "tc": tc_name.split("/")[-1],
+                    "time": f"{float(tc_time):.1f}s",
+                    "reason": reason.split("\n")[0][:180],
+                    "failed_at": Enterprise_lines[:2] if Enterprise_lines else ["See JUnit report"]
+                })
+
+    return failures
+
+def main():
+    xml_path = sys.argv[1] if len(sys.argv) > 1 else find_latest_report()
+    if not xml_path:
+        print("No JUnit_Report.xml found in Reports/.")
+        sys.exit(0)
+
+    print(f"=== Report: {xml_path} ===")
+    failures = parse_failures(xml_path)
+    if not failures:
+        print("✅ 100% PASSED: Zero failures found in report.")
+        return
+
+    print(f"❌ Found {len(failures)} Failed Test Case(s):")
+    for i, f in enumerate(failures, 1):
+        print(f"[{i}] {f['tc']} ({f['time']})")
+        print(f"    Cause: {f['reason']}")
+        print(f"    Line:  {', '.join(f['failed_at'])}")
+
+if __name__ == "__main__":
+    main()

package/tools/update_sentinel.py

@@ -65,7 +65,7 @@ def get_local_version():
         try:
             with open(pkg_file, "r", encoding="utf-8") as f:
                 data = json.load(f)
-                return data.get("version", "2.4.1")
+                return data.get("version", "2.4.2")
         except (OSError, json.JSONDecodeError):
             pass
 
@@ -74,11 +74,11 @@ def get_local_version():
         try:
             with open(manifest_file, "r", encoding="utf-8") as f:
                 data = json.load(f)
-                return data.get("version", "2.4.1")
+                return data.get("version", "2.4.2")
         except (OSError, json.JSONDecodeError):
             pass
 
-    return "2.4.1"
+    return "2.4.2"
 
 
 def fetch_remote_version():

package/tools/visual_som_helper.py

@@ -1,4 +1,5 @@
 #!/usr/bin/env python3
+from __future__ import annotations
 """
 Enterprise Vision-Grounded Fallback & Set-of-Marks (SoM) Engine
 --------------------------------------------------------------
@@ -36,6 +37,11 @@ except ImportError:
     ImageFilter = None
     HAS_PIL = False
 
+if HAS_PIL and Image is not None:
+    ImageSourceType = Union[Image.Image, str]
+else:
+    ImageSourceType = Any
+
 # Enforce UTF-8 stdout encoding for Windows console compatibility
 if hasattr(sys.stdout, 'reconfigure'):
     try:
@@ -58,11 +64,13 @@ MARK_COLORS = [
 ]
 
 
-def compute_visual_hash(image_source: Union[Image.Image, str], bbox: Optional[List[int]] = None, hash_size: int = 8) -> str:
+def compute_visual_hash(image_source: ImageSourceType, bbox: Optional[List[int]] = None, hash_size: int = 8) -> str:
     """
     Computes a 64-bit difference hash (dHash) for an image or cropped component.
     Fast, deterministic, and 100% offline.
     """
+    if not HAS_PIL or Image is None:
+        raise ImportError("Pillow is required for visual perceptual operations (pip install Pillow).")
     if isinstance(image_source, str):
         if not os.path.exists(image_source):
             raise FileNotFoundError(f"Image not found: {image_source}")
@@ -135,7 +143,7 @@ class VisualSoMHelper:
     def lookup_cached_coordinates(
         self,
         component_name: str,
-        image_source: Union[Image.Image, str],
+        image_source: ImageSourceType,
         bbox: Optional[List[int]] = None,
         threshold: float = 0.98,
         db_path: Optional[str] = None
@@ -198,7 +206,7 @@ class VisualSoMHelper:
     def save_cached_coordinates(
         self,
         component_name: str,
-        image_source: Union[Image.Image, str],
+        image_source: ImageSourceType,
         center_x: int,
         center_y: int,
         bbox: Optional[List[int]] = None,
@@ -324,6 +332,9 @@ class VisualSoMHelper:
         If elements is omitted, autonomously runs detect_canvas_interactive_regions.
         Returns (marked_image_path, marks_map).
         """
+        if not HAS_PIL or Image is None:
+            raise ImportError("Pillow is required for Set-of-Marks overlay generation (pip install Pillow).")
+
         if not os.path.exists(image_path):
             img = Image.new("RGB", (self.viewport_width, self.viewport_height), color="#1E1E2E")
             draw = ImageDraw.Draw(img)

package/tools/welcome_page.py

@@ -48,7 +48,7 @@ def get_hub_metadata() -> Dict[str, Any]:
     """Retrieves version and catalog count from skills_manifest.json."""
     manifest_path = os.path.join(HUB_ROOT, "skills_manifest.json")
     meta = {
-        "version": "2.4.1",
+        "version": "2.4.2",
         "totalSkills": 38,
         "author": "Thế Vị (@TeeVee998)",
         "repo": "https://github.com/TeeVee998/Synapse-Hub"

package/benchmarks/qa_eval/reports/AB_METHODOLOGY_REPORT.md

@@ -1,83 +0,0 @@
-# A/B Empirical Evaluation Methodology & Replication Report
-
-> **Dataset Scope:** 25 Production Challenges across 5 Dynamic QA Failure Vectors  
-> **Replication Seed:** `42` | **Temperature:** `0.0` | **Deterministic Execution Mode**  
-> **Evaluation Harness:** `benchmarks/qa_eval/eval_runner.py`  
-> **Author & Provenance:** Thế Vị (@TeeVee998) — [Synapse Hub](https://github.com/TeeVee998/Synapse-Hub)  
-
----
-
-## 1. Executive Summary
-
-This report establishes the empirical A/B testing methodology comparing **Naive LLM Prompting (Control Group)** against **Synapse Hub Multi-Agent Swarm (Treatment Group)** across 25 real-world test automation failure scenarios.
-
-```mermaid
-flowchart LR
-    Dataset["25 Production Challenges<br/>(Seed=42, Temp=0.0)"] --> Control["<b>Control Group (Naive LLM)</b><br/>• Monolithic context read<br/>• Raw DOM dump (>15k tokens)<br/>• Unconstrained prompt repair"]
-    Dataset --> Treatment["<b>Treatment Group (Synapse Hub)</b><br/>• Deterministic cascade tools<br/>• Compact AOM & repo_map<br/>• 8 Quality Gates DoD"]
-
-    Control --> ControlResults["• Mean Tokens: ~18,400<br/>• MTTR: 8-15 min<br/>• Pass Rate: 56.0%<br/>• Fake-Pass Trap: 44.0%"]
-    Treatment --> TreatmentResults["• Mean Tokens: 76.2<br/>• MTTR: < 0.1s<br/>• Pass Rate: 100.0%<br/>• Fake-Pass Trap: 0.0%"]
-```
-
----
-
-## 2. Experimental Setup & Protocol
-
-### 2.1 Sample Distribution ($N = 25$)
-Challenges are partitioned evenly across 5 critical enterprise QA failure vectors:
-1. **`locator_drift` (5 challenges):** Dynamic CSS hashes, nested shadow DOM piercing, semantic label shifts, legacy ID removals, HTML tag evolution.
-2. **`api_contract_drift` (5 challenges):** Type mutations, field renames, object flattening, creation status code shifts (200 $\to$ 201), auth prefix upgrades.
-3. **`timing_and_race` (5 challenges):** Variable latency spikes, PrimeNG backdrop fade intercepts, debounced autocomplete races, SVG animations, infinite scroll chunks.
-4. **`stale_and_mutation` (5 challenges):** WebSocket auto-refresh stale elements, tab component unmounts, tbody pagination detachments, re-rendered modal nodes, locale swaps.
-5. **`fake_pass_tautology` (5 challenges):** Swallowed 500 errors in empty catch blocks, zero-assertion smoke tests, `assert true == true`, unawaited async expectations, unbounded relational assertions (`status >= 200`).
-
-### 2.2 Hyperparameters & Control Variables
-- **Random Seed:** `42` (pinned across sampling and mutation generators).
-- **Sampling Temperature:** `0.0` (greedy decoding for deterministic reproducibility).
-- **Environment:** Headless Chromium, Viewport `1920x1080`, pure CPU/Memory baseline.
-
----
-
-## 3. Empirical Results Comparison
-
-| Evaluation Metric | Control Group (Naive LLM) | Treatment Group (Synapse Hub) | Relative Gain / Reduction |
-| :--- | :---: | :---: | :---: |
-| **Autonomous Resolution Rate** | 56.0% (14 / 25) | **100.0% (25 / 25)** | **+44.0% absolute gain** |
-| **Mean Token Cost / Bug Fix** | 18,450 tokens | **76.2 tokens** | **99.59% token reduction** |
-| **Mean Time-to-Heal (MTTR)** | ~8.4 minutes | **< 0.001s (Deterministic)** | **Instantaneous 0-token repair** |
-| **AST Mutation Score** | 32.4% (Mutants survived) | **100.0% (All mutants killed)** | **Zero tautological test escapes** |
-| **Fake-Pass Vulnerability Rate** | 44.0% accepted fake pass | **0.0% (Strictly blocked)** | **100% Truth Anchor enforcement** |
-| **Zero Side-Effect Compliance** | 68.0% (Unrelated edits) | **100.0% (Atomic patch)** | **Zero regression risk** |
-
----
-
-## 4. Key Mechanisms Driving the Differential
-
-1. **Deterministic 3-Layer Fallback (`HeuristicLocatorMatcher`):**
-   - Naive LLMs consume 10k–40k tokens reading raw HTML to guess new selectors.
-   - Synapse Hub parses compact DOM elements locally and resolves stable `data-testid`, ARIA labels, or Levenshtein text anchors in under 15ms with **0 LLM tokens**.
-2. **Cognitive Forcing & Micro-Mutations (`micro_mutator.py`):**
-   - Naive LLMs frequently emit tautological passes (`expect(true).toBe(true)` or empty catches) when under token pressure.
-   - Synapse Hub injects AST mutations and requires $\ge 80\%$ mutation score before handoff, catching silent passes at Gate 7 and Gate 8.
-3. **Log & Context Distillation (`distill_log.py` & `repo_map.py`):**
-   - Filters 95% of execution noise, isolating exact failing stacktrace pointers.
-
----
-
-## 5. Replication Guide
-
-To independently reproduce this benchmark evaluation:
-
-```bash
-# 1. Clone repository
-git clone https://github.com/TeeVee998/Synapse-Hub.git
-cd Synapse-Hub
-
-# 2. Run full deterministic benchmark harness
-python benchmarks/qa_eval/eval_runner.py
-
-# 3. Verify anti-fake-pass and robustness test
-python -m unittest tests/test_benchmark_robustness.py -v
-```
-All outputs are serialized to `benchmarks/qa_eval/reports/eval_results.json`.