mirror of
https://github.com/Kpa-clawbot/meshcore-analyzer.git
synced 2026-10-15 08:50:23 +00:00
4d2033da0f412d76c1d9dcfa48e4b0952962529c
4
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
|
69fba8032d |
test(a11y): expand axe CI gate to all 14 analytics tabs + prefix-tool (#1706) (#1711)
## Summary Closes #1706. Expands the axe-core a11y CI gate (`test-a11y-axe-1668.js`) to cover the 7 missing analytics tabs plus the `prefix-tool` utility surface. Before this PR, only 7 of 14 analytics tabs were gated; the other 7 could regress on contrast/aria without CI noticing. ## Changes **`test-a11y-axe-1668.js`** — adds 8 hash-routes to `ROUTES`: - `/analytics?tab=subpaths` - `/analytics?tab=nodes` - `/analytics?tab=distance` - `/analytics?tab=neighbor-graph` - `/analytics?tab=rf-health` - `/analytics?tab=clock-health` - `/analytics?tab=scopes` - `/analytics?tab=prefix-tool` The `prefix-tool` route was verified by greppping `public/analytics.js`: the dispatch arm is `case 'prefix-tool':` (line 292), the nav button uses `data-tab="prefix-tool"` (line 132), and existing UI cross-links use `#/analytics?tab=prefix-tool` (lines 1467, 1469, 1795, 3064). It lives in the analytics tab strip, not a separate `/tools/...` route. `REGISTERED_ANALYTICS_TABS` already lists all 15 tabs (the selftest's reciprocity check kept the constant honest), so no sibling slug-list at line ~82 needed updating beyond the existing list. **`test-a11y-axe-1668-selftest.js`** — adds a meta-assertion that loops over `REGISTERED_ANALYTICS_TABS` and asserts each `tab` has a matching `/analytics?tab=<tab>` entry in `ROUTES`. This locks the gate forever: any new analytics tab added to `analytics.js` will fail the selftest unless its route is also gated. ## TDD shape (red → green) - **Red commit** `a1d9aa8e` — adds the meta-assertion to the selftest. Selftest fails with `#1706: ROUTES missing analytics tab coverage for "/analytics?tab=subpaths"` (asserted, not a build error). - **Green commit** `501d9572` — adds the 8 missing entries to `ROUTES`. Selftest passes: `routes=24 themes=2 allowlist=0`. Cell count: 24 routes × 2 themes × 2 viewports = **96 cells** (was 64). ## Allowlist / tracking issues None yet. The 7 new analytics tabs and `prefix-tool` have not yet been exercised by the full axe browser run in CI — that happens when this PR runs. Per the M5 policy embedded in the gate's header, if any of the new routes fails axe on first run, a follow-up tracking issue + per-policy allowlist entry will be filed (the violations will NOT be silenced in this PR, and the routes will NOT be removed). I'll watch CI and report back. ## Out of scope Per the issue: - No keyboard-nav / focus-visible coverage (separate gap). - No modal / slideover open-state scans (separate gap). - No tufte / density work. - No source-code modifications to any analytics tab (contrast/aria fixes happen in follow-up PRs, not here). ## Preflight Ran `bash ~/.openclaw/skills/pr-preflight/scripts/run-all.sh origin/master` — all hard gates pass, no warnings. ## Verification ``` $ node test-a11y-axe-1668-selftest.js PASS: a11y-axe-1668 selftest — routes=24 themes=2 allowlist=0 ``` --------- Co-authored-by: clawbot <bot@kpa-clawbot.local> Co-authored-by: Kpa-clawbot <bot@openclaw.local> Co-authored-by: openclaw-bot <bot@openclaw> |
||
|
|
d954ea7444 |
feat(#1668): axe-core CI gate for WCAG AA color-contrast (M5) (#1696)
Partial fix for #1668 (M5 of 6). After M1 (audit), M2 (color tokens, #1676), M3 (typography floor, #1679), and M4 (per-route polish, #1681) cleared ~95% of contrast/typography violations, M5 **locks in the wins** by adding an axe-core CI gate that fails the build on any new WCAG AA color-contrast regression. ## What's in the box - `test-a11y-axe-1668.js` — Playwright + `@axe-core/playwright`. Runs every major CoreScope route × `{dark, light}` at 1200×900 desktop, injects axe, runs only the `color-contrast` rule, asserts net violations === 0. - `test-a11y-axe-1668-selftest.js` — fast, deterministic, browser-free unit test that exercises the YAML allowlist parser, the `violationAllowed` matcher, and the route/theme metadata. Runs in the JS unit block (no browser needed). - `tests/a11y-allowlist.yaml` — operator-flagged false-positive allowlist. **0 entries at M5 baseline.** ## Allowlist format Each entry MUST cite a GH issue # and an `expires_at` date. Missing fields = refused. Expired `expires_at` = refused (warning logged). This **forces a periodic revisit** — no permanent suppressions. ```yaml - route: /analytics?tab=channels selector: ".some-known-stale-element" rule: color-contrast issue: 1234 expires_at: 2026-09-01 ``` ## Routes covered (19 × 2 themes = 38 cells) `/`, `/packets`, `/nodes`, `/channels`, `/live`, `/map`, `/observers`, `/compare`, `/analytics?tab={overview,rf,topology,channels,hashsizes,collisions,roles,airtime}`, `/audio-lab`, `/customize`, `/replay`. ## TDD red→green - **RED** (`08adafdb`) — adds the gate + deliberately regresses `--text-muted` from `palette-gray-700` (~10:1) to `#9ca3af` (~2.4:1). axe-core fails on every light-theme cell. - **GREEN** (`f62fb1e0`) — restores the M2 token. Net violations = 0 across all 38 cells. ## Scope discipline - Only `color-contrast` (matches M2/M3/M4 scope). M6 owns `image-alt`, `aria-required-attr`, `label`, mobile viewports, and letsmesh A/B. - No new design tokens. - M2-M4 tokens untouched. ## CI wiring - `.github/workflows/deploy.yml:155` — selftest in JS unit block. - `.github/workflows/deploy.yml:367` — real axe browser run in the Playwright E2E block after the fixture server is up. ## Deps `@axe-core/playwright@4.11.3` + `axe-core@4.12.1` added to `devDependencies`. Pinned versions. --------- Co-authored-by: openclaw-bot <bot@openclaw.local> Co-authored-by: clawbot <clawbot@users.noreply.github.com> |
||
|
Kpa-clawbotandmeshcore-bot
|
e74e860725 |
fix(#1648): final emoji leaks — .obs-clock-naive-chip warning + analytics Channels encrypted group labels (#1665)
## What Two Phosphor lint-gate breaches found by the v3.8.4 manual-test executor — app-controlled UI labels still shipping raw emoji glyphs that the M6 final sweep (#1648) missed. One PR, two sprite swaps, same playbook as #1657. ### Findings | Test ID | Surface | Glyph | File:line | Fix | |---|---|---|---|---| | v384-1.2 | `/observers` `.obs-clock-naive-chip` | `⚠️` (U+26A0) ×14 | `public/observers.js:30` | `ph-warning` sprite | | v384-12.18 | `/analytics?tab=channels` encrypted row name cells | `🔒` (U+1F512) ×158 | `public/analytics.js:978–979` | `ph-lock` sprite | Finding 2 is a different surface from the M3/#1657 fix (which swapped the section-header label, not the per-row `displayName`). The unknown-encrypted row's `displayName` carried a raw `🔒 Encrypted (0xNN)` text label that then flowed through `esc()` into the rendered name cell as an escaped emoji glyph — exactly the same `innerText → innerHTML` class of bug. Refactored to mirror the section-header pattern: `displayNameHtml` carries the sprite-bearing raw HTML; `displayName` stays plain text for sort/aria/tests. ## TDD - **RED** `cde12370` — `test-issue-1648-followup-phosphor-leaks.js` asserts ph-warning sprite + zero ⚠ in chip output, and ph-lock sprite + zero 🔒 in analytics row labels. 6 assertions failed on master. - **GREEN** `f1c64b17` — sprite swaps applied. All 9 assertions pass. - **Anti-tautology proven both directions**: reverting only `public/observers.js` → 2 chip-related assertions fail; reverting only `public/analytics.js` → 4 analytics-related assertions fail. ## Verify - ✅ `node test-issue-1648-followup-phosphor-leaks.js` — 9/9 pass - ✅ `node test-issue-1648-m6-final-sweep.js` — 0 violations - ✅ `node test-observer-naive-clock-1478.js` — 8/8 pass (existing chip test accepts ph-warning sprite) - ✅ `node test-analytics-channels-integration.js` — pre-existing unrelated `Channel Analytics` failure only; encrypted-row assertions all pass with new plain-text `displayName` - ✅ pr-preflight all gates green (PII, branch-scope, red-commit, CSS-var, LIKE-on-JSON, async-migration, XSS sinks) - ✅ Browser-verified on staging: 11 chips render ph-warning sprite (0 emoji), 156 ph-lock sprites in row name cells (0 lock emoji on page) Browser verified: http://analyzer-stg.00id.net/#/observers + /#/analytics?tab=channels (hot-patched) E2E assertion added: `test-issue-1648-followup-phosphor-leaks.js:67` (chip), `test-issue-1648-followup-phosphor-leaks.js:147` (row cell) --------- Co-authored-by: meshcore-bot <bot@meshcore.dev> |
||
|
Kpa-clawbotandBot
|
89eade6e7b |
M6: emoji → Phosphor — final sweep, lint gate, carry-forwards (#1648) (#1654)
Red commit:
|