flowproof 0.23.2__tar.gz → 0.23.4__tar.gz

{flowproof-0.23.2 → flowproof-0.23.4}/Cargo.lock

@@ -930,7 +930,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-adapters"
-version = "0.23.2"
+version = "0.23.4"
 dependencies = [
  "anyhow",
  "flowproof-driver",
@@ -949,7 +949,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-agent"
-version = "0.23.2"
+version = "0.23.4"
 dependencies = [
  "chrono",
  "flowproof-driver",
@@ -967,7 +967,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-cli"
-version = "0.23.2"
+version = "0.23.4"
 dependencies = [
  "ab_glyph",
  "chrono",
@@ -992,7 +992,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-driver"
-version = "0.23.2"
+version = "0.23.4"
 dependencies = [
  "calamine",
  "flowproof-trace",
@@ -1008,7 +1008,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-python"
-version = "0.23.2"
+version = "0.23.4"
 dependencies = [
  "flowproof-agent",
  "flowproof-cli",
@@ -1020,7 +1020,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-replay"
-version = "0.23.2"
+version = "0.23.4"
 dependencies = [
  "chrono",
  "flowproof-agent",
@@ -1034,7 +1034,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-trace"
-version = "0.23.2"
+version = "0.23.4"
 dependencies = [
  "jsonschema",
  "regex",

{flowproof-0.23.2 → flowproof-0.23.4}/Cargo.toml

@@ -22,7 +22,7 @@ members = ["crates/flowproof-driver", "crates/flowproof-trace", "crates/flowproo
 exclude = ["spike/windows-containment"]
 
 [workspace.package]
-version = "0.23.2"
+version = "0.23.4"
 edition = "2021"
 license = "Apache-2.0"
 repository = "https://github.com/automators-com/flowproof"

{flowproof-0.23.2 → flowproof-0.23.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: flowproof
-Version: 0.23.2
+Version: 0.23.4
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Developers
 Classifier: Programming Language :: Python :: 3

{flowproof-0.23.2 → flowproof-0.23.4}/crates/flowproof-adapters/src/web.rs

@@ -4691,8 +4691,14 @@ impl AppDriver for WebAppDriver {
                 KeyMod::Meta => ModifierKey::Meta,
             })
             .collect();
+        // CDP's key table uses the literal space as the key value; models
+        // and human-authored specs commonly use its code/name instead.
+        let browser_key = match key {
+            "Space" | "Spacebar" => " ",
+            _ => key,
+        };
         self.tab()?
-            .press_key_with_modifiers(key, (!mods.is_empty()).then_some(mods.as_slice()))
+            .press_key_with_modifiers(browser_key, (!mods.is_empty()).then_some(mods.as_slice()))
             .map_err(|e| web_err(&format!("pressing key '{key}'"), e))?;
         Ok(())
     }
@@ -4911,7 +4917,7 @@ impl AppDriver for WebAppDriver {
                 standInHosts.add(host);
               }
               const interactive = el => el.matches(
-                'input, button, a, select, textarea, [role=button], [role=checkbox], [role=radio], [role=menuitem], [draggable], [ondrop], .draggable-row, .droparea'
+                'input, button, a, select, textarea, [role=textbox], [role=combobox], [role=button], [role=checkbox], [role=radio], [role=menuitem], [draggable], [ondrop], .draggable-row, .droparea'
               ) || (!!el.id && el.children.length === 0 && ['DIV', 'SPAN'].includes(el.tagName)) ||
                 styledLeaf(el) || standInHosts.has(el);
               const readableLeaf = el => {
@@ -4921,7 +4927,23 @@ impl AppDriver for WebAppDriver {
                   (child.textContent || '').trim()
                 ) && (semanticCss(el) || scopedReadable(el));
               };
-              const ordered = all.filter(interactive).concat(
+              // Empty custom grid editors are controls too. Keep the first
+              // editable row ahead of decorative toolbar leaves so the scene
+              // budget cannot remove the fields needed to create an item.
+              const firstGridRows = new Set();
+              for (const editor of all.filter(el => el.matches('[role=textbox], [role=combobox]'))) {
+                if (!isRendered(editor)) continue;
+                const cell = editor.closest('[role=gridcell]');
+                const row = cell && cell.closest('tr, [role=row]');
+                const grid = cell && cell.closest('table, [role=grid]');
+                if (row && grid && !Array.from(firstGridRows).some(r => r.closest('table, [role=grid]') === grid)) {
+                  firstGridRows.add(row);
+                }
+              }
+              const priorityField = el => el.matches('input, select, textarea') ||
+                (el.matches('[role=textbox], [role=combobox]') &&
+                  firstGridRows.has(el.closest('tr, [role=row]')));
+              const ordered = all.filter(priorityField).concat(all.filter(interactive),
                 all.filter(el => !interactive(el) && readableLeaf(el))
               );
               const seen = new Set();
@@ -4956,8 +4978,15 @@ impl AppDriver for WebAppDriver {
               const entries = chosen.map(el => {
                 const css = cssPath(el);
                 const scoped = !interactive(el) && !semanticCss(el) ? scopedReadable(el) : null;
+                const labelledBy = (el.getAttribute('aria-labelledby') || '').split(/\s+/)
+                  .map(id => document.getElementById(id)?.textContent?.trim() || '').filter(Boolean).join(' ');
                 const label = el.labels && el.labels[0] ? el.labels[0].textContent.trim()
-                    : (el.getAttribute('aria-label') || el.getAttribute('placeholder') || '');
+                    : (el.getAttribute('aria-label') || labelledBy || el.getAttribute('placeholder') || '');
+                const gridCell = el.closest('[role=gridcell]');
+                const rowIndex = gridCell && (gridCell.getAttribute('aria-rowindex') ||
+                  gridCell.getAttribute('lsmatrixrowindex') ||
+                  gridCell.closest('[role=row]')?.getAttribute('aria-rowindex'));
+
                 const ticks = el.tagName === 'INPUT' && ['checkbox', 'radio'].includes(el.type);
                 const isField = ['INPUT', 'SELECT', 'TEXTAREA'].includes(el.tagName);
                 const entry = {
@@ -4967,7 +4996,9 @@ impl AppDriver for WebAppDriver {
                     actionable: interactive(el),
                     type: el.getAttribute('type') || undefined,
                     text: (el.textContent || '').trim().slice(0, 80) || undefined,
-                    label: label || undefined,
+                    label: label.trim().slice(0, 160) || undefined,
+                    row: rowIndex || undefined,
+                    role: el.getAttribute('role') || undefined,
                     value: fieldValue(el),
                     checked: ticks ? el.checked : undefined,
                     required: el.required || undefined,

flowproof-0.23.4/crates/flowproof-adapters/tests/grid_scene_e2e.rs

@@ -0,0 +1,54 @@
+//! SAP-style empty custom editors must survive a crowded scene inventory.
+use flowproof_driver::AppDriver;
+
+#[test]
+fn empty_grid_editors_have_column_labels_and_row_identity() {
+    if std::env::var("FLOWPROOF_E2E").as_deref() != Ok("1") {
+        return;
+    }
+    let _guard = flowproof_adapters::SharedBrowserGuard::new();
+    let toolbar = (0..120)
+        .map(|i| format!("<span id='tool{i}'>Tool {i}</span>"))
+        .collect::<String>();
+    let html = format!(
+        r#"<html><body>{toolbar}
+      <table><tr><th id="material-label">Material</th><th id="plant-label">Plant</th></tr>
+      <tr><td role="gridcell" lsmatrixrowindex="1"><span id="material" role="textbox" aria-labelledby="material-label" tabindex="0" style="display:block;width:100px;height:24px"></span></td>
+      <td role="gridcell" lsmatrixrowindex="1"><span id="plant" role="textbox" aria-labelledby="plant-label" tabindex="0" style="display:block;width:100px;height:24px"></span></td></tr></table>
+      <input type="password" value="never-export-this">
+      </body></html>"#
+    );
+    let listener = std::net::TcpListener::bind("127.0.0.1:0").expect("fixture listener");
+    let port = listener.local_addr().expect("listener address").port();
+    std::thread::spawn(move || {
+        use std::io::{Read, Write};
+        for mut stream in listener.incoming().flatten() {
+            let mut buf = [0; 2048];
+            let _ = stream.read(&mut buf);
+            let _ = write!(stream, "HTTP/1.1 200 OK\r\nContent-Type: text/html\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{}", html.len(), html);
+        }
+    });
+    let mut driver = flowproof_adapters::WebAppDriver::new().expect("Chrome launches");
+    driver
+        .launch(
+            &format!("http://127.0.0.1:{port}"),
+            "",
+            std::time::Duration::from_secs(30),
+        )
+        .expect("fixture loads");
+    let scene = driver.scene().expect("scene reads").expect("scene exists");
+    let entries: serde_json::Value = serde_json::from_str(&scene).expect("scene JSON");
+    for (id, label) in [("material", "Material"), ("plant", "Plant")] {
+        let entry = entries
+            .as_array()
+            .expect("scene entries")
+            .iter()
+            .find(|e| e["target"] == format!("css:#{id}"))
+            .expect("empty editor in scene");
+        assert_eq!(entry["label"], label);
+        assert_eq!(entry["row"], "1");
+        assert_eq!(entry["actionable"], true);
+        assert_eq!(entry["role"], "textbox");
+    }
+    assert!(!scene.contains("never-export-this"));
+}

{flowproof-0.23.2 → flowproof-0.23.4}/crates/flowproof-adapters/tests/static_area_e2e.rs

@@ -32,6 +32,7 @@ fn serve(html: &'static str) -> String {
 }
 
 const FIXTURE: &str = r#"<!doctype html><html><body>
+    <input id="space-toggle" type="checkbox">
     <div id="app">
       <button id="open" onclick="
         var d = document.createElement('div');
@@ -69,6 +70,26 @@ fn search_reaches_content_outside_the_app_root() {
         .invoke(&UiaSelector::css("#open"))
         .expect("opening the dialog succeeds");
 
+    // Space aliases must produce real keyboard activation, not text insertion.
+    driver
+        .invoke(&UiaSelector::css("#space-toggle"))
+        .expect("focus checkbox");
+    assert!(driver
+        .element_exists(&UiaSelector::css("#space-toggle:checked"))
+        .expect("checked"));
+    for key in ["Space", "Spacebar", " "] {
+        driver
+            .press_key(key, &[])
+            .expect("space key activates checkbox");
+        assert!(driver
+            .element_exists(&UiaSelector::css("#space-toggle:not(:checked)"))
+            .expect("unchecked"));
+        driver.press_key(key, &[]).expect("space toggles back");
+        assert!(driver
+            .element_exists(&UiaSelector::css("#space-toggle:checked"))
+            .expect("checked again"));
+    }
+
     // Native-id (css) reach: the sibling div is appended to <body>, a
     // structural ancestor of neither #app nor anything inside it.
     assert!(

{flowproof-0.23.2 → flowproof-0.23.4}/crates/flowproof-agent/src/author.rs

@@ -67,7 +67,7 @@ action that reaches the goal.
 - Respond with ONLY JSON, no prose, no code fences.
 - The JSON action is one of: \"click\", \"click_at\", \"drag\", \"type_text\", \
 \"assert_text\", \"capture_text\", \"capture_count\", \"type_captured\", \
-\"select_option\", \"select_options\", \"scroll\", \"press_key\", \"rule_step\", or \
+\"select_option\", \"select_options\", \"scroll\", \"scroll_into_view\", \"press_key\", \"rule_step\", or \
 \"capture_ambiguity\".
 - UI actions MUST include \"target\": \"<target token of a listed element>\". \
 Clicking and typing require an entry whose \"actionable\" field is true. \
@@ -77,7 +77,11 @@ type_text also needs \"text\"; assert_text needs \"expected\" and optional \
 drag needs \"onto\" with a second listed actionable target. click_at needs \
 \"x_pct\" and \"y_pct\" from 0 through 100. capture_count needs a safe \"name\". \
 select_option needs one \"text\" value; select_options is only for a multi-select \
-and needs a non-empty \"values\" array. scroll needs \"to_px\". \
+and needs a non-empty \"values\" array. scroll needs \"to_px\" and means an exact \
+vertical offset inside a scroll container. To reveal a field or cell, use \
+scroll_into_view with that individual target instead; it needs no offset. \
+Never scroll a collection (tag=collection): it represents multiple rows for counting, \
+not a scroll container. For horizontal grids, reveal the desired cell, not a row collection. \
 press_key needs \"key\" and has no target. \
 For another action, use rule_step with \"step\" containing exact \
 deterministic grammar and copy listed target tokens into quoted targets, for \
@@ -881,12 +885,32 @@ fn ground_one(
                 .ok_or("select_option needs a non-empty 'text'")?;
             Ok(vec![ResolvedAction::TypeText { target, text }])
         }
-        "scroll" => Ok(vec![ResolvedAction::Scroll {
-            target: Some(target),
-            to: crate::rules::ScrollTo::Offset(
-                authored.to_px.ok_or("scroll needs a 'to_px' offset")?,
-            ),
-        }]),
+        "scroll" | "scroll_into_view" => {
+            let entries: Vec<serde_json::Value> = serde_json::from_str(scene).unwrap_or_default();
+            if entries.iter().any(|entry| {
+                (entry["target"].as_str() == Some(token)
+                    || entry["css"]
+                        .as_str()
+                        .is_some_and(|css| token == css || token == format!("css:{css}")))
+                    && entry["tag"] == "collection"
+            }) {
+                return Err("cannot scroll a collection; choose an individual cell with scroll_into_view or a scroll container with scroll".into());
+            }
+            let to = if authored.action == "scroll_into_view" {
+                if authored.to_px.is_some() {
+                    return Err("scroll_into_view does not accept to_px".into());
+                }
+                crate::rules::ScrollTo::IntoView
+            } else {
+                crate::rules::ScrollTo::Offset(
+                    authored.to_px.ok_or("scroll needs a 'to_px' offset")?,
+                )
+            };
+            Ok(vec![ResolvedAction::Scroll {
+                target: Some(target),
+                to,
+            }])
+        }
         "type_captured" => {
             let name = authored
                 .capture
@@ -2329,6 +2353,34 @@ mod tests {
         }
     }
 
+    #[test]
+    fn collection_scroll_is_rejected_and_reauthored_as_reveal_cell() {
+        let mut client = Scripted {
+            replies: vec![
+                r#"{"action":"scroll","target":"css:#rows tr","to_px":0}"#.into(),
+                r#"{"action":"scroll_into_view","target":"css:#task-1"}"#.into(),
+            ],
+            calls: 0,
+        };
+        let result = author_step(
+            &mut client,
+            &AuthorContext {
+                intent: "Bring the first task into view",
+                scene: HUMAN_PRIMITIVE_SCENE,
+                ..ctx()
+            },
+        )
+        .expect("collection rejection should reauthor an individual target");
+        assert_eq!(client.calls, 2);
+        assert_eq!(
+            result,
+            ResolvedAction::Scroll {
+                target: Some(Target::css("#task-1")),
+                to: crate::rules::ScrollTo::IntoView,
+            }
+        );
+    }
+
     #[test]
     fn rule_step_covers_grounded_actions_outside_the_small_json_vocabulary() {
         let mut client = Scripted {

{flowproof-0.23.2 → flowproof-0.23.4}/crates/flowproof-agent/src/llm.rs

@@ -225,20 +225,24 @@ impl HttpModelClient {
         if let Some(key) = &self.config.api_key {
             request = request.header("authorization", format!("Bearer {key}"));
         }
-        // `temperature` stays here: OpenAI's API and a local vLLM both accept
-        // it, and determinism is worth having where it is free. The
-        // deprecation that forced it out of the Anthropic request is specific
-        // to that API's current models.
+        let mut body = json!({
+            "model": self.model(),
+            "messages": [
+                {"role": "system", "content": system},
+                {"role": "user", "content": user},
+            ],
+        });
+        if self.config.kind == BackendKind::OpenAi {
+            // Includes reasoning tokens. GPT-5 rejects legacy max_tokens and
+            // temperature=0; leave sampling at the model's supported default.
+            body["max_completion_tokens"] = json!(16_384);
+        } else {
+            // Preserve the contract of local OpenAI-compatible servers.
+            body["max_tokens"] = json!(OPENAI_COMPATIBLE_MAX_TOKENS);
+            body["temperature"] = json!(0);
+        }
         let mut response = request
-            .send_json(json!({
-                "model": self.model(),
-                "max_tokens": OPENAI_COMPATIBLE_MAX_TOKENS,
-                "temperature": 0,
-                "messages": [
-                    {"role": "system", "content": system},
-                    {"role": "user", "content": user},
-                ],
-            }))
+            .send_json(body)
             .map_err(|e| Self::http_err("openai-compatible", e))?;
         let response: serde_json::Value = Self::json_or_error(
             "openai-compatible",

{flowproof-0.23.2 → flowproof-0.23.4}/crates/flowproof-agent/tests/model_client_http.rs

@@ -132,3 +132,33 @@ fn an_echoed_key_is_redacted_from_the_error() {
         "and the redaction is visible: {text}"
     );
 }
+
+#[test]
+fn openai_reasoning_request_and_compatible_server_use_their_own_parameters() {
+    for kind in [BackendKind::OpenAi, BackendKind::OpenAiCompatible] {
+        let (base, rx) = serve_once(200, r#"{"choices":[{"message":{"content":"ok"}}]}"#);
+        let mut client = HttpModelClient::new(BackendConfig {
+            kind: kind.clone(),
+            base_url: Some(base),
+            model: Some("gpt-5".into()),
+            api_key: Some("test-key".into()),
+        });
+        assert_eq!(
+            client
+                .complete("system", "user")
+                .expect("completion succeeds"),
+            "ok"
+        );
+        let sent: serde_json::Value = serde_json::from_str(&rx.recv().expect("request captured"))
+            .expect("valid request JSON");
+        if kind == BackendKind::OpenAi {
+            assert_eq!(sent["max_completion_tokens"], 16384);
+            assert!(sent.get("max_tokens").is_none());
+            assert!(sent.get("temperature").is_none());
+        } else {
+            assert_eq!(sent["max_tokens"], 1024);
+            assert_eq!(sent["temperature"], 0);
+            assert!(sent.get("max_completion_tokens").is_none());
+        }
+    }
+}

{flowproof-0.23.2 → flowproof-0.23.4}/flowproof/__init__.py

@@ -24,7 +24,7 @@ from flowproof.flow import (
     run,
 )
 
-__version__ = "0.23.2"
+__version__ = "0.23.4"
 
 __all__ = [
     "ClarificationNeeded",

{flowproof-0.23.2 → flowproof-0.23.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "flowproof"
-version = "0.23.2"
+version = "0.23.4"
 description = "Test that a bot only ever does the job it was given — and never deletes, sends or approves the thing it must not. Record it doing the job once, then replay on every commit with zero LLM calls. For the agents and RPA already running real work in production: web, desktop, SAP, Citrix."
 readme = "README.md"
 license = "Apache-2.0"