Code Quality: PR #416 #1332
codeql
on: dynamic
Matrix: analyze
Annotations
1 error and 9 warnings
|
`SNAPSHOT_CAPTURE_FAILED` error code missing from `ui-action-result` v2 outputSchema enum:
src/mcp/tools/ui-automation/__tests__/tap.test.ts#L113
The `SNAPSHOT_CAPTURE_FAILED` code emitted by `captureRuntimeSnapshotAfterActionSafely` is not listed in the `recoverableUiError.code` enum in `schemas/structured-output/xcodebuildmcp.output.ui-action-result/2.schema.json`, so any consumer validating against the published outputSchema will reject responses that contain this code.
|
|
long_press omits post-action runtime snapshot capture that all other complete gestures include:
src/mcp/tools/ui-automation/long_press.ts#L101
After a successful long press the runtime snapshot is cleared but never refreshed, so agents receive no updated UI context. Long press typically opens context menus or action sheets, yet unlike `tap`, `swipe`, `type_text`, and `batch`, it never calls `captureRuntimeSnapshotAfterActionSafely` — forcing agents to make an extra `snapshot_ui` call to see the resulting UI.
|
|
[UHD-PKX] long_press omits post-action runtime snapshot capture that all other complete gestures include (additional location):
src/types/domain-results.ts#L55
After a successful long press the runtime snapshot is cleared but never refreshed, so agents receive no updated UI context. Long press typically opens context menus or action sheets, yet unlike `tap`, `swipe`, `type_text`, and `batch`, it never calls `captureRuntimeSnapshotAfterActionSafely` — forcing agents to make an extra `snapshot_ui` call to see the resulting UI.
|
|
[UHD-PKX] long_press omits post-action runtime snapshot capture that all other complete gestures include (additional location):
src/types/domain-results.ts#L373
After a successful long press the runtime snapshot is cleared but never refreshed, so agents receive no updated UI context. Long press typically opens context menus or action sheets, yet unlike `tap`, `swipe`, `type_text`, and `batch`, it never calls `captureRuntimeSnapshotAfterActionSafely` — forcing agents to make an extra `snapshot_ui` call to see the resulting UI.
|
|
touch tool clears runtime snapshot but never recaptures it, leaving state as SNAPSHOT_MISSING:
src/types/domain-results.ts#L368
In `src/mcp/tools/ui-automation/touch.ts`, the success path of the touch executor calls `clearRuntimeSnapshot(simulatorId)` but never calls `captureRuntimeSnapshotAfterActionSafely`. Every other elementRef-based action tool changed in this PR (`tap.ts`, `swipe.ts`, `type_text.ts`, `batch.ts`) recaptures a fresh runtime snapshot after a successful action so the agent can chain a follow-up ref-based action. Because `touch` now requires `elementRef`, the inconsistency means any follow-up touch/tap on a resolved ref will fail with `SNAPSHOT_MISSING` until the agent manually re-invokes `snapshot_ui`, defeating the rs/1 parity goal of this PR.
|
|
`SNAPSHOT_CAPTURE_FAILED` error code is absent from the `recoverableUiError.code` enum in the JSON output schema:
src/types/domain-results.ts#L646
The new `uiError?` field on `UiActionResultDomainResult` can carry `code: 'SNAPSHOT_CAPTURE_FAILED'` (set by `captureRuntimeSnapshotAfterActionSafely` in `post-action-snapshot.ts`), but that code is not included in the `recoverableUiError.code` enum in `schemas/structured-output/xcodebuildmcp.output.ui-action-result/2.schema.json`, causing schema validation failures for any MCP client that validates structured output.
|
|
`getObjectSchemaKeys` returns null for ZodEffects-wrapped schemas, bypassing session-default filtering for strict schemas:
src/utils/typed-tool-factory.ts#L104
When `internalSchema` is a `ZodEffects` (created by `.superRefine()` or `.refine()`), `getObjectSchemaKeys` finds no `shape` property and returns `null`, so `filterSessionDefaultsForSchema` falls through and returns **all** session defaults unfiltered. `waitForUiSchema` is `z.strictObject(waitForUiSchemaShape).superRefine(...)`, so passing build-related session defaults (`projectPath`, `scheme`, `configuration`, etc.) to its strict inner `ZodObject` causes a `PARAMETER_VALIDATION_FAILED` error — the tool silently fails instead of running.
|
|
O(n²) element scan in inferScrollableContainers on every UI action:
src/mcp/tools/ui-automation/shared/runtime-snapshot.ts#L422
For each container element, the function scans the entire `elements` array twice — once for `hasOverflowingDescendant` and once for `findSheetGrabberDescendant` — giving O(n²) complexity that will degrade noticeably on rich UI screens where the flattened accessibility tree can have hundreds of nodes.
|
|
Clearing snapshot after `touch down` makes sequential `touch up` impossible:
src/mcp/tools/ui-automation/touch.ts#L128
After a successful `touch down`, `clearRuntimeSnapshot(simulatorId)` is called unconditionally (line 128), so a subsequent `touch up` call will immediately fail with `SNAPSHOT_MISSING` when it tries to `resolveElementRef` — making drag-style interactions (down on element A, release on element B) impossible without an intervening `snapshot_ui` call.
|
|
[SJF-FPE] Clearing snapshot after `touch down` makes sequential `touch up` impossible (additional location):
src/mcp/tools/ui-automation/long_press.ts#L103
After a successful `touch down`, `clearRuntimeSnapshot(simulatorId)` is called unconditionally (line 128), so a subsequent `touch up` call will immediately fail with `SNAPSHOT_MISSING` when it tries to `resolveElementRef` — making drag-style interactions (down on element A, release on element B) impossible without an intervening `snapshot_ui` call.
|