Playwright adversary

Deterministic static review of Playwright tests, published as web/playwright. The adversary parses JavaScript and TypeScript without importing target files, running tests, launching a browser, or using network access.

Checks

The rule set reports:

playwright.wait.hard-timeout for fixed page.waitForTimeout(...) delays;
playwright.focus.only for Playwright test.only(...) and test.describe.only(...); and
playwright.assertion.immediate-state for boolean assertions around immediate locator state methods, such as expect(await button.isVisible()).toBe(true);
playwright.test.static-content-only for browser tests that navigate and verify only initial presentation without exercising a user workflow; and
playwright.test.unverified-interaction for user actions with no subsequent assertion or explicit outcome wait.

Findings require imports from @playwright/test, concrete syntax evidence, and an eligible changed line when Doomer supplies patch ranges. Repeated occurrences of one rule in one file are grouped into a single finding.

Automatic selection uses a content-aware detector. Candidate JavaScript and TypeScript changes only invoke the review runtime when a changed source file imports Playwright test APIs; Node, Jest, and Vitest-only changes are reported as inapplicable.

See docs/scope.md for ownership boundaries and docs/issue-catalog.md for examples and limitations.

Local development

Requires Node.js 22 and npm.

npm ci
npm test
doomer validate .
doomer pack --check .

To exercise the built adversary against a local fixture repository without a Git diff:

npm run build
doomer run . --path /absolute/path/to/playwright-fixture --all-files --format json

Omit --all-files to review the fixture repository's staged, unstaged, and untracked working-tree changes. The target repository does not need Playwright installed because its files are parsed as untrusted source text, not executed.

Packaging

The build bundles the SDK and TypeScript parser into dist/index.js, copies the review schema, and regenerates THIRD_PARTY_NOTICES.md. The packaged-artifact test runs that exact bundle without node_modules and uses a target file that would throw if it were imported.

Depot workflows run tests for pushes to main and pull requests targeting main. Release tags synchronize versions and publish through the configured Doomer registry workflow; local development does not publish or create a release.

SDK source coverage

This release uses SDK 0.1.43. This reviewer uses deterministic prepared evidence rather than repository-tool model retrieval, so it has no model coverage result to reinterpret. Existing evidence gates and deterministic findings are preserved.

SDK 0.1.43

This release rebuilds with SDK 0.1.43. SDK PR #73 adds a tested neutral fallback to formatOpinionAsync when concern wording validation is exhausted, preserving completed findings and the ship decision. Reviewers that do not call this API retain their existing opinion behavior. Provider and transport failures remain errors. Domain rules and evidence requirements are unchanged.