synapse-hub 3.0.0 → 3.0.1

package/tools/mcp_server.py

@@ -46,7 +46,7 @@ import gherkin_suite
 import api_fuzzer
 
 SERVER_NAME = "enterprise-agent-qa"
-SERVER_VERSION = "3.0.0"
+SERVER_VERSION = "3.0.1"
 
 MCP_TOOLS = [
     {
@@ -473,13 +473,15 @@ def _handle_pull_alm_story(arguments: Dict[str, Any]) -> str:
 
 def _handle_report_alm_defect(arguments: Dict[str, Any]) -> str:
     bridge = tms_sync_bridge.TMSBridge()
+    raw_screenshot = arguments.get("screenshot_path", "")
+    safe_screenshot = _validate_safe_path(raw_screenshot) if raw_screenshot else ""
     ticket = bridge.report_defect(
         project_key=arguments["project_key"],
         test_case_id=arguments["test_case_id"],
         summary=arguments["summary"],
         error_message=arguments["error_message"],
         stack_trace=arguments.get("stack_trace", ""),
-        screenshot_path=arguments.get("screenshot_path", "")
+        screenshot_path=safe_screenshot
     )
     return json.dumps(ticket, indent=2)
 
@@ -517,7 +519,8 @@ def _handle_convert_traffic_session(arguments: Dict[str, Any]) -> str:
 
 def _handle_resolve_visual_som_coordinates(arguments: Dict[str, Any]) -> str:
     helper = visual_som_helper.VisualSoMHelper()
-    img = arguments.get("image_path", "screenshot.png")
+    raw_img = arguments.get("image_path", "screenshot.png")
+    img = _validate_safe_path(raw_img)
     lbl = arguments.get("target_label")
     mid = arguments.get("mark_id")
     marked_img, marks_map = helper.generate_som_overlay(img, [])
@@ -526,7 +529,7 @@ def _handle_resolve_visual_som_coordinates(arguments: Dict[str, Any]) -> str:
 
 
 def _handle_compile_gherkin_suite(arguments: Dict[str, Any]) -> str:
-    target = arguments["target"]
+    target = _validate_safe_path(arguments["target"])
     res = gherkin_suite.compile_feature(target) if os.path.isfile(target) else gherkin_suite.run(target)
     if isinstance(res, int):
         return json.dumps({"exit_code": res, "detail": "see reports/gherkin_suite_report.json"}, indent=2)

package/tools/micro_mutator.py

@@ -22,6 +22,7 @@ import os
 import re
 import sys
 import json
+import ast
 import shlex
 import html as html_lib
 import argparse
@@ -59,11 +60,12 @@ MUTATION_RULES = [
     (r"\breturn\s+true\b", "return false", "Return Value Inversion (return true -> return false)"),
     (r"\breturn\s+false\b", "return true", "Return Value Inversion (return false -> return true)"),
     (r"\breturn\s+0\b", "return -1", "Return Value Shift (return 0 -> return -1)"),
+    (r"\s\?\?\s", " || ", "Nullish Coalescing Inversion (?? -> ||)"),
 ]
 
 # Action statement pattern for Statement Deletion Mutants
 ACTION_STATEMENT_PATTERN = re.compile(
-    r'\.(click|submit|save|update|delete|send|fill|press|type|execute)\s*\(',
+    r'\.(click|submit|save|update|delete|send|fill|press|type|execute|check|uncheck|hover|dragTo|selectOption|clear|focus|setInputFiles)\s*\(',
     re.IGNORECASE
 )
 
@@ -74,7 +76,12 @@ ASSERTION_PATTERN = re.compile(
 
 # Tautological / fake assertions that do not test application logic
 TAUTOLOGY_PATTERN = re.compile(
-    r'(?:assert\s+(?:true|1\s*==\s*1)\b|assert\s+([a-zA-Z_]\w*)\s*==\s*\1\b|assertEquals\s*\(\s*([a-zA-Z_]\w*)\s*,\s*\2\s*\)|expect\s*\(\s*([a-zA-Z_]\w*)\s*\)\.toBe\s*\(\s*\3\s*\)|assertTrue\s*\(\s*true\s*\))',
+    r'(?:assert\s+(?:true|1\s*==\s*1)\b'
+    r'|\bassert\s+([a-zA-Z0-9_\.]+(?:\([^)]*\))?)\s*==\s*\1\b'
+    r'|\bassert\s+(?:len\s*\([^)]*\)|[a-zA-Z0-9_\.]+\.(?:length|size\(\)))\s*(?:>=\s*0|>\s*-(?:1|0))\b'
+    r'|assertEquals\s*\(\s*([a-zA-Z_]\w*)\s*,\s*\1\s*\)'
+    r'|expect\s*\(\s*([a-zA-Z_]\w*)\s*\)\.toBe\s*\(\s*\1\s*\)'
+    r'|assertTrue\s*\(\s*true\s*\))',
     re.IGNORECASE
 )
 
@@ -301,6 +308,10 @@ def evaluate_mutants_statically(code: str, mutants: List[Dict[str, Any]]) -> Tup
 
         # Case 1: Mutation directly in an assertion statement
         if ASSERTION_PATTERN.search(snippet):
+            if TAUTOLOGY_PATTERN.search(snippet):
+                m["status"] = "SURVIVED"
+                m["reason"] = "Mutant in tautological/dummy assertion - cannot kill mutant without genuine assertion logic"
+                continue
             m["status"] = "KILLED"
             m["reason"] = "Direct assertion mutation caught by verification condition"
             killed_count += 1
@@ -324,6 +335,13 @@ def evaluate_mutants_statically(code: str, mutants: List[Dict[str, Any]]) -> Tup
                     tgt = asgn.group(1)
                     if any(re.search(rf'\b{re.escape(t)}\b', l_code) for t in dataflow_tokens):
                         dataflow_tokens.add(tgt)
+                destruct = re.match(r'^\s*(?:(?:const|let|var|val)\s+)?[\{\(]([^\}\)]+)[\}\)]\s*=', l_code)
+                if destruct:
+                    vars_in_destruct = [v.strip().split(':')[0].strip() for v in destruct.group(1).split(',') if v.strip()]
+                    if any(re.search(rf'\b{re.escape(t)}\b', l_code) for t in dataflow_tokens):
+                        for v in vars_in_destruct:
+                            if re.match(r'^[a-zA-Z_][a-zA-Z0-9_]*$', v):
+                                dataflow_tokens.add(v)
 
             # Check if any assertion references the variables mutated in this logic branch or downstream dataflow
             has_variable_link = any(any(re.search(rf'\b{re.escape(tok)}\b', a_text) for tok in dataflow_tokens) for _, a_text in downstream)
@@ -633,7 +651,7 @@ def main():
         print(format_junit(report))
     else:
         mode_tag = "LIVE DYNAMIC RUNNER" if report.get("mode") == "DYNAMIC" else "STATIC HEURISTIC"
-        mode_desc = f"LIVE DYNAMIC RUNNER (cmd: '{args.test_cmd}')" if report.get("mode") == "DYNAMIC" else "STATIC HEURISTIC (fast 0.1s AST; pass --test-cmd for dynamic run)"
+        mode_desc = f"LIVE DYNAMIC RUNNER (cmd: '{args.test_cmd}')" if report.get("mode") == "DYNAMIC" else "STATIC HEURISTIC (fast heuristic assertion sensitivity scan; pass --test-cmd for dynamic run)"
         print("\n======================================================================")
         print(f"   ASSERTION SENSITIVITY & SYNTACTIC MUTATION SENTINEL [{mode_tag}]    ")
         print("======================================================================")

package/tools/reversible_sandbox.py

@@ -60,7 +60,7 @@ class ExecutionSandbox:
         """Executes a forward shell command and immediately records its reversible undo counterpart."""
         try:
             args = shlex.split(forward_cmd) if isinstance(forward_cmd, str) else forward_cmd
-            res = subprocess.run(args, text=True, capture_output=True)
+            res = subprocess.run(args, text=True, capture_output=True, timeout=60.0)
             if res.returncode == 0:
                 self.record_mutation(action_type, target_resource, undo_cmd, {"forward_cmd": forward_cmd})
                 return True
@@ -97,7 +97,7 @@ class ExecutionSandbox:
             elif cmd:
                 try:
                     args = shlex.split(cmd) if isinstance(cmd, str) else cmd
-                    res = subprocess.run(args, text=True, capture_output=True)
+                    res = subprocess.run(args, text=True, capture_output=True, timeout=60.0)
                     success = (res.returncode == 0)
                     if not success:
                         err_msg = res.stderr.strip()

package/tools/senior_code_review.py

@@ -80,7 +80,8 @@ def get_git_diff(repo_dir: str, target: str = "uncommitted") -> str:
             text=True,
             encoding="utf-8",
             errors="ignore",
-            check=True
+            check=True,
+            timeout=30.0
         )
         return res.stdout
     except Exception:

package/tools/skill_vault.py

@@ -50,11 +50,25 @@ QA_SYNONYMS: Dict[str, Set[str]] = {
     "dropdown": {"select", "combobox", "option", "menu", "picker", "choice"},
     "invoice": {"billing", "order", "receipt", "payment", "charge", "reconcile"},
     "cart": {"checkout", "basket", "purchase", "item", "order"},
-    "upload": {"attachment", "file", "import", "choose-file", "document"},
+    "upload": {"attachment", "file", "import", "choose-file", "document", "dropzone"},
+    "export": {"export", "download", "csv", "excel", "pdf", "report"},
+    "toast": {"toast", "notification", "snackbar", "alert", "message", "banner", "popup"},
+    "spinner": {"spinner", "loader", "loading", "shimmer", "skeleton", "progress", "wait"},
+    "drawer": {"drawer", "sidebar", "panel", "modal", "aside", "sheet"},
+    "tab": {"tab", "tabs", "tabpanel", "nav", "segment"},
     "wait": {"detach", "detached", "sleep", "loading", "spinner", "ready", "networkidle", "smartwait"},
 }
 
 
+def split_identifier(identifier: str) -> List[str]:
+    """Splits camelCase, PascalCase, and snake_case tokens into lowercase sub-tokens."""
+    tokens = re.sub(r'([A-Z]+)', r' \1', identifier).split()
+    sub_tokens = []
+    for t in tokens:
+        sub_tokens.extend(re.split(r'[_\\-]+', t))
+    return [t.lower() for t in sub_tokens if len(t) >= 2]
+
+
 def _expand_tokens_with_synonyms(tokens: List[str]) -> Set[str]:
     """Expands query tokens using the QA domain synonym clusters."""
     expanded = set(tokens)
@@ -185,7 +199,13 @@ class SkillVault:
         Queries verified primitives using intelligent fuzzy semantic matching:
         combines exact tokens, synonym expansion, n-gram substring match, and SequenceMatcher similarity.
         """
-        raw_tokens = [t.lower() for t in re.findall(r'[a-zA-Z0-9_-]+', query) if len(t) >= 2]
+        words = re.findall(r'[a-zA-Z0-9_-]+', query)
+        raw_tokens = []
+        for w in words:
+            sub = split_identifier(w)
+            raw_tokens.extend(sub if sub else [w.lower()])
+        raw_tokens = list(dict.fromkeys(raw_tokens))
+
         if not raw_tokens and not tag:
             return self.list_primitives(limit=top_k)
 
@@ -203,7 +223,12 @@ class SkillVault:
         scored = []
         for r in rows:
             corpus_text = f"{r['page_class']} {r['method_signature']} {r['semantic_docstring'] or ''} {r['tags'] or ''}".lower()
-            corpus_tokens = [t.lower() for t in re.findall(r'[a-zA-Z0-9_-]+', corpus_text) if len(t) >= 2]
+            corpus_words = re.findall(r'[a-zA-Z0-9_-]+', corpus_text)
+            corpus_tokens = []
+            for cw in corpus_words:
+                sub = split_identifier(cw)
+                corpus_tokens.extend(sub if sub else [cw.lower()])
+            corpus_tokens = list(dict.fromkeys(corpus_tokens))
 
             # Calculate individual query token matches
             token_scores = [_calculate_token_match_score(qt, corpus_tokens) for qt in raw_tokens]
@@ -229,6 +254,54 @@ class SkillVault:
         scored.sort(key=lambda x: (x["relevance_score"], x["mutation_score"]), reverse=True)
         return scored[:top_k]
 
+    def harvest_page_classes(self, dir_path: str) -> int:
+        """
+        Scans a directory for Page Classes across TS, JS, Python, and Groovy,
+        extracts method signatures, and registers them into SkillVault.
+        """
+        if not os.path.isdir(dir_path):
+            return 0
+        count = 0
+        for root, _, files in os.walk(dir_path):
+            for f in files:
+                ext = os.path.splitext(f)[1].lower()
+                if ext not in (".py", ".ts", ".js", ".groovy", ".java"):
+                    continue
+                file_path = os.path.join(root, f)
+                try:
+                    with open(file_path, "r", encoding="utf-8", errors="ignore") as fp:
+                        content = fp.read()
+                except OSError:
+                    continue
+
+                page_class = os.path.splitext(f)[0]
+                method_matches = re.finditer(r'(?:def\s+([a-zA-Z_]\w*)\s*\(([^)]*)\)|(?:async\s+)?([a-zA-Z_]\w*)\s*\(([^)]*)\)\s*(?::\s*[^\{]+)?\s*\{)', content)
+                for mm in method_matches:
+                    m_name = mm.group(1) or mm.group(3)
+                    m_args = mm.group(2) if mm.group(1) else mm.group(4)
+                    if not m_name or m_name.startswith("_") or m_name in ("constructor", "constructor__"):
+                        continue
+                    skill_id = f"SKILL_{page_class.upper()}_{m_name.upper()}"
+                    sig = f"{m_name}({m_args.strip() if m_args else ''})"
+                    doc_m = re.search(rf'{re.escape(m_name)}[^\n]*\n\s*[\'\""""/]+([^\'\""""\n*]+)', content)
+                    doc = doc_m.group(1).strip() if doc_m else f"Page method for {m_name} on {page_class}"
+                    tags = ",".join(split_identifier(page_class) + split_identifier(m_name))
+
+                    prim = PageClassPrimitive(
+                        skill_id=skill_id,
+                        page_class=page_class,
+                        method_signature=sig,
+                        method_code=f"// Harvested from {f}\n{sig}",
+                        locator_tier=1,
+                        semantic_docstring=doc,
+                        verified_on_url=f"local://{f}",
+                        mutation_score=85.0,
+                        tags=tags
+                    )
+                    if self.register_primitive(prim):
+                        count += 1
+        return count
+
     def list_primitives(self, limit: int = 50) -> List[Dict[str, Any]]:
         with self._get_connection() as conn:
             rows = conn.execute("SELECT * FROM page_primitives ORDER BY created_at DESC LIMIT ?", (limit,)).fetchall()
@@ -239,12 +312,18 @@ def main():
     parser = argparse.ArgumentParser(description="SkillVault Lifelong POM Library")
     parser.add_argument("--query", default=None, help="Query verified primitives by keyword (fuzzy semantic search)")
     parser.add_argument("--tag", default=None, help="Filter primitives by domain tag (e.g. auth, table, invoice)")
+    parser.add_argument("--harvest", default=None, help="Directory path to harvest Page Classes from")
     parser.add_argument("--list", action="store_true", help="List all stored primitives")
     parser.add_argument("--seed-samples", action="store_true", help="Seed initial verified POM primitives")
     args = parser.parse_args()
 
     vault = SkillVault()
 
+    if args.harvest:
+        num = vault.harvest_page_classes(args.harvest)
+        print(f"✅ Harvested {num} Page Class primitives from '{args.harvest}'.")
+        return 0
+
     if args.seed_samples:
         samples = [
             PageClassPrimitive(

package/tools/skillspector.py

@@ -956,7 +956,11 @@ def scan_target(target_path: str) -> ScanReport:
     all_findings: List[Finding] = []
     scanned_count = 0
 
-    SKIP_DIRS = {".git", ".venv", "venv", "node_modules", "__pycache__", ".pytest_cache", "dist", "build"}
+    SKIP_DIRS = {
+        ".git", ".venv", "venv", "node_modules", "__pycache__", ".pytest_cache",
+        "dist", "build", "claude-ecosystem-repos", "graphify-out", ".synapse",
+        ".mypy_cache", ".ruff_cache", ".sandbox_snapshots", "reports"
+    }
     SKIP_FILES = {"skillspector.py"}
     SCANNABLE_EXTS = {".md", ".py", ".json", ".yaml", ".yml", ".sh", ".ps1", ".txt", ".ts", ".js"}
 

package/tools/sync_agent_rules.py

@@ -92,6 +92,7 @@ In accordance with the MIT License, the original copyright notice crediting **Th
 5. **Pragmatic Communication Protocol:**
    - Conversational responses, explanation, and telemetry MUST be in Vietnamese.
    - All codebase assets, test scripts, Page Classes, docstrings, and commits MUST remain strictly in English.
+   - English-First Document Ingestion: When reading bilingual docs (e.g. ARCHITECTURE.en.md vs ARCHITECTURE.md), always read the English version (*.en.md) to save 50–65% BPE tokens.
 
 6. **Lean Senior Dev Protocol (The 7-Rung Ladder & YAGNI):**
    - The best code is the code never written. Solve the whole problem with the least new code.

package/tools/test_impact.py

@@ -175,7 +175,8 @@ def get_git_modified_files(repo_root=None):
             stdout=subprocess.PIPE,
             stderr=subprocess.PIPE,
             text=True,
-            check=True
+            check=True,
+            timeout=30.0
         )
         files = [line.strip() for line in res.stdout.splitlines() if line.strip()]
         return files

package/tools/update_sentinel.py

@@ -65,7 +65,7 @@ def get_local_version():
         try:
             with open(pkg_file, "r", encoding="utf-8") as f:
                 data = json.load(f)
-                return data.get("version", "3.0.0")
+                return data.get("version", "3.0.1")
         except (OSError, json.JSONDecodeError):
             data = {}
 
@@ -74,11 +74,11 @@ def get_local_version():
         try:
             with open(manifest_file, "r", encoding="utf-8") as f:
                 data = json.load(f)
-                return data.get("version", "3.0.0")
+                return data.get("version", "3.0.1")
         except (OSError, json.JSONDecodeError):
             data = {}
 
-    return "3.0.0"
+    return "3.0.1"
 
 
 def fetch_remote_version():

package/tools/verify_all.py

@@ -296,7 +296,7 @@ def gate_3_clean_pom(repo_root, mode="AUTO"):
         print("[N/A] Hub Mode: Not Applicable (Clean POM rules apply to target test suites in Spokes).")
         return True
 
-    test_dirs = ["Scripts", "tests", "test", "e2e", "specs", "cypress"]
+    test_dirs = ["tests"] if effective_mode == "HUB" else ["Scripts", "tests", "test", "e2e", "specs", "cypress"]
     test_files = []
     for td in test_dirs:
         d = os.path.join(repo_root, td)
@@ -708,7 +708,7 @@ def gate_7_infer_linter(repo_root, mode="AUTO"):
         except (ImportError, OSError) as err:
             print(f"[WARN] Failed to run check_version_sync: {err}")
 
-    test_dirs = ["Scripts", "tests", "test", "e2e", "specs", "cypress"]
+    test_dirs = ["tests"] if effective_mode == "HUB" else ["Scripts", "tests", "test", "e2e", "specs", "cypress"]
     has_tests = False
     target_scan_dir = None
     for td in test_dirs:

package/tools/visual_diff_canvas.py

@@ -55,11 +55,12 @@ def compare_canvas_images(
     """
     with Image.open(baseline_path) as img_base, Image.open(current_path) as img_curr:
         # Normalize dimensions and color mode
+        curr_image: Image.Image = img_curr
         if img_base.size != img_curr.size:
-            img_curr = img_curr.resize(img_base.size, Image.Resampling.LANCZOS)
+            curr_image = img_curr.resize(img_base.size, Image.Resampling.LANCZOS)
 
         base_rgb = img_base.convert("RGB")
-        curr_rgb = img_curr.convert("RGB")
+        curr_rgb = curr_image.convert("RGB")
 
         # C-level accelerated pixel difference via Pillow vectorization
         diff = ImageChops.difference(base_rgb, curr_rgb)

package/tools/welcome_page.py

@@ -47,7 +47,7 @@ def get_hub_metadata() -> Dict[str, Any]:
     """Retrieves version and catalog count from skills_manifest.json."""
     manifest_path = os.path.join(HUB_ROOT, "skills_manifest.json")
     meta = {
-        "version": "3.0.0",
+        "version": "3.0.1",
         "totalSkills": 42,
         "author": "Thế Vị (@TeeVee998)",
         "repo": "https://github.com/TeeVee998/Synapse-Hub"