Code Quality: PR #416 #1344
codeql
on: dynamic
Matrix: analyze
Annotations
5 warnings
|
gesture tool clears runtime snapshot on success but never captures a fresh one:
src/mcp/tools/ui-automation/gesture.ts#L143
After a successful gesture, `clearRuntimeSnapshot` is called but no post-action `captureRuntimeSnapshotAfterActionSafely` call follows, so the runtime snapshot is permanently cleared and the success result contains no `capture` payload — unlike every comparable tool (`swipe`, `tap`, `key_press`, etc.).
|
|
`uiError.message` silently dropped from Recovery section rendering:
src/utils/renderers/domain-result-text.ts#L1339
`createUiErrorItems` renders `code`, `elementRef`, `timeoutMs`, and `recoveryHint`, but never includes `uiError.message` — the required, specific error description (e.g. "Element ref 'e99' was not found in the current snapshot") is lost from all CLI and tool output.
|
|
O(n²) path-string scan in findActiveForegroundRoot:
src/mcp/tools/ui-automation/shared/runtime-next-steps.ts#L247
For each scrollable element `records.filter(isForegroundCandidateForRoot)` scans all `n` records, and `isSameOrDescendantPath` does a string `startsWith` on full AX hierarchy paths — making this O(s × n × path_length). With memoization the filter runs once per scrollable element, but in a worst-case flat tree where most elements are scrollable this degrades to O(n²). Consider pre-building a path-prefix index keyed by path segments so descendant lookup is O(1) instead of O(n).
|
|
Breaking API contract: required fields removed and replaced across UiAction interfaces:
src/types/domain-results.ts#L357
Multiple `UiAction` interfaces have had their fields replaced (e.g., `UiActionTap` drops `x?/y?/id?/label?` for required `elementRef`; `UiActionSwipe` drops `from?/to?` for required `withinElementRef` + `direction`; `UiActionLongPress` drops `x/y` for `elementRef`). Any external MCP client or agent that reads/persists the structured output of UI automation tools using the old field shape will silently receive `undefined` for those fields after this change — this warrants a senior review of any consumers outside this repo.
|
|
Runtime snapshot helper functions and constants are duplicated across two files:
src/utils/renderers/domain-result-text.ts#L1169
The constants `HIDDEN_RUNTIME_TARGET_LABELS`, `LOW_PRIORITY_RUNTIME_TARGET_LABELS` and functions `compactRuntimeSnapshotText`, `normalizedRuntimeSnapshotText`, `isHiddenRuntimeTarget`, `isLowPriorityRuntimeTarget`, `isContentRichTapTarget`, `isAlreadySelectedRuntimeTarget`, `getRuntimeTargetDisplayPriority`, and `sortRuntimeTargetsForDisplay` are defined identically in both this file and `src/utils/structured-output-envelope.ts`; extract them into a shared utility module and import from both sites.
|