Experimental/brain-of-reese
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

various fixes

Browse Source
This commit is contained in:
ducoterra
2026-08-28 09:42:19 -04:00
parent 5d679f5184
commit 03bead092c
19 changed files with 983 additions and 1443 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/e2e/test_steering.py
+52 -62
View File
@@ -13,8 +13,9 @@ stored in Postgres (``steering_notes``) → injected into the system prompt
of every subsequent turn as the ``<tuning>`` section. The mock LLM
echoes the first tuning note into its answer
(`` (tuning: <first note line>)``), so prompt injection is observable in
the UI deterministically. Notes are listed newest-first in the header
"Tuning" panel, where each can be deleted.
the UI deterministically. Notes are listed newest-first on the Tuning
page (``/tuning.html``), where each can be deleted — the header "Tuning"
toggle was removed from the navbar at owner request (2026-08-28).
Test → story mapping (Playwright Mapping Rule):
1. ``test_tune_under_answer_persists_and_steers``
@@ -45,8 +46,9 @@ QUESTION = "How is my Kubernetes cluster set up?"
MOCK_ANSWER_MARKER = "Deterministic mock answer for E2E"
NOTE = "STEEER-MARKER be concise"
XSS_NOTE = "<script>window.__xss = true; alert('xss')</script>"
#: index.html ships exactly three classic/module script tags: the
#: phase-39 brand.js classic layer + markdown.js + the app.js module.
#: Both index.html and tuning.html ship exactly three classic/module
#: script tags: the phase-39 brand.js classic layer + markdown.js + the
#: page module (app.js / tuning.js).
BASE_SCRIPT_COUNT = 3
@@ -113,11 +115,6 @@ def _tune_and_save(page: Page, note: str) -> None:
expect(saved).to_contain_text("Saved — future answers will follow this.", timeout=15_000)
def _open_panel(page: Page) -> None:
page.click("#steering-toggle")
expect(page.locator("#steering-panel")).to_be_visible()
# ---------------------------------------------------------------------------
# 1. Tune under an answer → persisted → next answer carries the note
# ---------------------------------------------------------------------------
@@ -147,14 +144,15 @@ def test_tune_under_answer_persists_and_steers(
rows = db.scalars(select(SteeringNote)).all()
assert [r.note for r in rows] == [NOTE]
# The header panel shows the note with an updated count badge.
_open_panel(page)
expect(page.locator("#steering-count")).to_have_text("1")
expect(page.locator("#steering-list .steering-note")).to_have_count(1)
expect(page.locator("#steering-list .steering-note-text")).to_have_text(NOTE)
page.click("#steering-toggle") # close again
# The Tuning page (the steering-notes manager — the navbar toggle
# was removed at owner request, 2026-08-28) lists the note.
page.goto(app_url + "/tuning.html")
expect(page.locator("#tune-list .tuning-note")).to_have_count(1)
expect(page.locator("#tune-list .tuning-note-text")).to_have_text(NOTE)
# The NEXT answer carries the note — it reached the system prompt.
page.goto(app_url + "/")
expect(page.locator("#send-btn")).to_be_enabled()
_ask(page, QUESTION)
bubble = page.locator(".msg.brain .bubble").last
expect(bubble).to_contain_text(f"(tuning: {NOTE})")
@@ -179,19 +177,21 @@ def test_delete_note_stops_steering(
_ask(page, QUESTION)
expect(page.locator(".msg.brain .bubble").last).to_contain_text(f"(tuning: {NOTE})")
# Delete the note from the panel.
_open_panel(page)
expect(page.locator("#steering-count")).to_have_text("1")
page.locator("#steering-list .steering-delete").click()
expect(page.locator("#steering-list .steering-note")).to_have_count(0)
expect(page.locator("#steering-count")).to_have_text("0")
expect(page.locator("#steering-empty")).to_be_visible()
expect(page.locator("#steering-announcer")).to_contain_text("deleted")
# Delete the note from the Tuning page (the header panel is no
# longer reachable — the navbar toggle is gone).
page.goto(app_url + "/tuning.html")
expect(page.locator("#tune-list .tuning-note")).to_have_count(1)
page.locator(".tuning-delete").click()
expect(page.locator("#tune-list .tuning-note")).to_have_count(0, timeout=15_000)
expect(page.locator("#tune-empty")).to_be_visible()
expect(page.locator("#tune-announcer")).to_contain_text("deleted")
with SessionLocal() as db:
assert db.scalars(select(SteeringNote)).all() == []
# The next answer no longer carries the marker.
page.goto(app_url + "/")
expect(page.locator("#send-btn")).to_be_enabled()
_ask(page, QUESTION)
bubble = page.locator(".msg.brain .bubble").last
expect(bubble).to_contain_text(MOCK_ANSWER_MARKER)
@@ -222,12 +222,13 @@ def test_note_rendered_as_text_xss_safe(
_ask(page, QUESTION)
_tune_and_save(page, XSS_NOTE)
# Panel: the payload is visible as LITERAL text…
_open_panel(page)
expect(page.locator("#steering-list .steering-note-text")).to_have_text(XSS_NOTE)
# Tuning page: the payload is visible as LITERAL text…
page.goto(app_url + "/tuning.html")
expect(page.locator("#tune-list .tuning-note-text")).to_have_text(XSS_NOTE)
# …never as an executed element: no script tag anywhere, no dialog.
assert page.locator("#steering-panel script").count() == 0
# …never as an executed element: no script tag in the list, the page
# still carries exactly its own three scripts, no dialog.
assert page.locator("#tune-list script").count() == 0
expect(page.locator("script")).to_have_count(BASE_SCRIPT_COUNT)
assert dialogs == [], f"the note must never execute as script: {dialogs}"
assert page.evaluate("() => window.__xss === undefined") is True
@@ -239,34 +240,27 @@ def test_note_rendered_as_text_xss_safe(
def test_tuning_panel_a11y(page: Page, app_url: str, db_ready: None) -> None:
_reset_db(mock_port=0, seed=False) # no KB seeding needed for the panel a11y
"""The steering surface's a11y now lives on the Tuning page (the
header toggle was removed from the navbar at owner request,
2026-08-28): the note list, the polite live region, and the labeled
per-note delete (≥44px)."""
_reset_db(mock_port=0, seed=False) # no KB seeding needed for the page a11y
page.set_default_timeout(30_000)
page.goto(app_url)
login(page, app_url, next="/") # phase 16: the panel is admin-only
login(page, app_url, next="/tuning.html") # phase 16: the notes are admin-only
toggle = page.locator("#steering-toggle")
panel = page.locator("#steering-panel")
announcer = page.locator("#steering-announcer")
# The navbar no longer carries a steering toggle — absent for the
# admin too — and the header panel section still ships hidden.
assert page.locator("#steering-toggle").count() == 0
expect(page.locator("#steering-panel")).to_be_hidden()
# Initial: closed, correctly wired, polite live region present.
expect(toggle).to_have_attribute("aria-expanded", "false")
expect(toggle).to_have_attribute("aria-controls", "steering-panel")
expect(panel).to_have_attribute("role", "region")
assert "Tuning notes" in (panel.get_attribute("aria-label") or "")
expect(panel).to_be_hidden()
# The page's own polite live region.
announcer = page.locator("#tune-announcer")
assert announcer.get_attribute("role") == "status"
assert announcer.get_attribute("aria-live") == "polite"
# Accessible name comes from its visible text (icon is aria-hidden).
assert "Tuning" in toggle.inner_text()
# Open: expanded + the designed empty state.
toggle.click()
expect(toggle).to_have_attribute("aria-expanded", "true")
expect(panel).to_be_visible()
expect(page.locator("#steering-empty")).to_be_visible()
expect(page.locator("#steering-count")).to_have_text("0")
# Add a note (API), then re-open the panel to refresh it.
# Add a note (API), reload to refresh the list (tuning.js fetches
# on boot).
page.evaluate(
"""async () => {
const r = await fetch('/api/steering', {
@@ -277,26 +271,22 @@ def test_tuning_panel_a11y(page: Page, app_url: str, db_ready: None) -> None:
if (!r.ok) throw new Error('steering POST failed: ' + r.status);
}"""
)
toggle.click() # close
toggle.click() # re-open (refreshes the list)
note_item = page.locator("#steering-list .steering-note")
page.reload()
expect(page.locator("#sign-out-btn")).to_be_visible(timeout=15_000)
note_item = page.locator("#tune-list .tuning-note")
expect(note_item).to_have_count(1)
expect(note_item.locator(".steering-note-text")).to_have_text("a11y note one")
expect(note_item.locator(".tuning-note-text")).to_have_text("a11y note one")
# The per-note delete is a real, labeled button (≥44px target).
delete = page.locator("#steering-list .steering-delete")
delete = page.locator(".tuning-delete")
expect(delete).to_have_attribute("type", "button")
assert (delete.get_attribute("aria-label") or "").startswith("Delete tuning note:")
box = delete.bounding_box()
assert box is not None and box["height"] >= 44
# Delete: list empties, count updates, the live region announces it.
# Delete: list empties, the empty state shows, the live region
# announces it.
delete.click()
expect(page.locator("#steering-list .steering-note")).to_have_count(0)
expect(page.locator("#steering-count")).to_have_text("0")
expect(page.locator("#tune-list .tuning-note")).to_have_count(0, timeout=15_000)
expect(page.locator("#tune-empty")).to_be_visible()
expect(announcer).to_contain_text("deleted")
# And the toggle closes cleanly again.
toggle.click()
expect(toggle).to_have_attribute("aria-expanded", "false")
expect(panel).to_be_hidden()