five46 - npm Package Compare versions

Comparing version 0.3.0 to 0.3.1

dist/agent/apiPlanner.js

@@ -56,5 +56,5 @@ "use strict";
     const hosts = [safety.targetOrigin, ...safety.allowedHosts].join(', ');
-    return `Allowed methods this run: ${methods.join(', ')}. Allowed host(s): ${hosts}. Any other method or host will be rejected — don't attempt one.`;
+    return `Base URL for this run: ${safety.baseUrl}. Build every request's "url" as this base plus the appropriate path (e.g. "${safety.baseUrl}/users"), not just the origin. Allowed methods this run: ${methods.join(', ')}. Allowed host(s): ${hosts}. Any other method or host will be rejected — don't attempt one.`;
 }
-const ACTION_SCHEMA_EXAMPLE = `{"action":"request","method":"POST","url":"/users","headers":{"Content-Type":"application/json"},"body":"{\\"name\\":\\"Ada\\"}","saveAs":{"name":"userId","path":"id"},"reason":"create a user to test with"}`;
+const ACTION_SCHEMA_EXAMPLE = `{"action":"request","method":"POST","url":"<baseUrl>/users","headers":{"Content-Type":"application/json"},"body":"{\\"name\\":\\"Ada\\"}","saveAs":{"name":"userId","path":"id"},"reason":"create a user to test with"}`;
 /** Builds the "what's the next single action" prompt for API testing —
@@ -152,3 +152,3 @@ * same single-shot-JSON-per-step shape as `planner.ts`'s
 }
-const API_PLAN_SCHEMA_EXAMPLE = `{"steps":[{"action":"request","method":"POST","url":"/users","body":"{\\"name\\":\\"Ada\\"}","saveAs":{"name":"userId","path":"id"},"reason":"create a user"},{"action":"request","method":"GET","url":"/users/{{userId}}","reason":"fetch it back"},{"action":"assert_json_path_equals","path":"name","expected":"Ada","reason":"confirm the name matches"},{"action":"done","outcome":"goal-reached","reason":"confirmed"}]}`;
+const API_PLAN_SCHEMA_EXAMPLE = `{"steps":[{"action":"request","method":"POST","url":"<baseUrl>/users","body":"{\\"name\\":\\"Ada\\"}","saveAs":{"name":"userId","path":"id"},"reason":"create a user"},{"action":"request","method":"GET","url":"<baseUrl>/users/{{userId}}","reason":"fetch it back"},{"action":"assert_json_path_equals","path":"name","expected":"Ada","reason":"confirm the name matches"},{"action":"done","outcome":"goal-reached","reason":"confirmed"}]}`;
 /** Builds the upfront "plan the whole goal" prompt for the API engine —
@@ -155,0 +155,0 @@ * the same second-`complete()`-call pattern `planner.ts`'s `buildPlanPrompt`

dist/agent/apiTypes.d.ts

@@ -18,2 +18,12 @@ import type { RunOutcome } from './types';
     allowedHosts: ReadonlySet<string>;
+    /** The full `<base-url>` CLI/MCP argument the run was invoked with,
+     * including any path (e.g. `http://host/api`) — unlike `targetOrigin`
+     * (protocol+host+port only, the actual security boundary `isHostAllowed`
+     * checks), this is purely informational, disclosed to the model via
+     * `apiPlanner.ts`'s `describeSafetyMode` so it knows to build request
+     * URLs under this base instead of guessing against the bare origin. A
+     * real, live-found bug: without this, a base URL with a path prefix
+     * (`/api`, `/v1`, ...) was silently discarded everywhere, and the model
+     * had no way to know a prefix mattered at all. */
+    baseUrl: string;
 }
@@ -20,0 +30,0 @@ /** Co-located with `SafetyMode` (not duplicated in both `apiPlanner.ts` and

dist/mcp/tools.js

@@ -336,3 +336,3 @@ "use strict";
         }
-        const safety = { allowWrites: context.allowWrites, allowDeletes: context.allowDeletes, targetOrigin, allowedHosts: new Set() };
+        const safety = { allowWrites: context.allowWrites, allowDeletes: context.allowDeletes, targetOrigin, allowedHosts: new Set(), baseUrl: params.baseUrl };
         if (params.story) {
@@ -339,0 +339,0 @@ const { goals, clamped } = await (0, storySplitter_1.splitUserStory)(params.story, provider, llmApiKey);

package.json

 {
   "name": "five46",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "mcpName": "io.github.sekharsdet/five46",
@@ -5,0 +5,0 @@ "description": "Autonomous AI testing agent that verifies your app or API actually works while you're still building it. Give it a plain-English goal, your own LLM key (OpenAI/Anthropic/Gemini/Groq/Bedrock) drives the real thing locally, and a real standalone Playwright/node:test spec is captured as a permanent regression test afterward. Fully local, BYOK, no cloud sandbox.",

New alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

708555

0.13%

Lines of code

11858

0.09%

No dependency changes