CRT
81313b6fa4
A real `console fill apple-app-privacy` clicked Next onto a console page the engine did not recognise and logged nothing for 8 hours. - Step watchdog: after a click, or while the form is expected, no known page within --step-timeout seconds (default 30) -> "the page after "Next" is not a page storebound knows ... Buttons there: ...", a debug dump, and the manual steps. It keeps watching, but 20 min without progress closes the window and exits 1. - A heartbeat line every minute while waiting (also during sign-in); the final review wait is bounded (2 h) with a reminder every 10 min. - Debug dump (cli/console/debug.ts) in .storebound/console-debug/ <form>-<time>/: page.json (URL without query, headings, dialogs, every visible control with role and name), page.html (rebuilt from a clone: no scripts, values, hidden inputs or non-whitelisted attributes) and a small screenshot. Emails, phone numbers and the header / account area are replaced; cookies, storage and tokens are never read. --debug-dump writes one at every step for bug reports. - Guardrail tests: an unknown-page fixture (dump sanitized, bounded exit) and a scan of cli/console for while loops without a deadline and Playwright waits without a timeout (one waitForLoadState fixed). - Pitfall 14 (docs/pitfalls.md, store-pitfalls skill); the console-autofill skill says how to send a dump.
33 lines
2.1 KiB
HTML
33 lines
2.1 KiB
HTML
<!doctype html>
|
|
<!-- MODELED, not recorded: App Privacy where the page after "Next" is one storebound does not know (the data types as
|
|
switches in groups, a "Done" button). The engine must not wait silently: after the step timeout it writes a debug
|
|
dump and stops after the idle limit. Personal-looking data (the account name in the header, an email, a typed
|
|
value, a hidden token) must not reach the dump. Placeholder data only. -->
|
|
<html lang="en"><head><meta charset="utf-8"><title>App Privacy - App Store Connect</title><script src="/_common.js"></script>
|
|
<script>window.__secret = 'sb-token-should-not-leak';</script></head>
|
|
<body>
|
|
<header aria-label="Account menu"><span>Example Owner</span> <button type="button">Example Owner Studio</button></header>
|
|
<h1>App Privacy</h1>
|
|
<button type="button" id="publish">Publish</button>
|
|
<p><button type="button" id="start">Get Started</button></p>
|
|
<p>Contact: owner@example.com, +1 (555) 010-9999</p>
|
|
<input type="hidden" name="csrf" value="sb-csrf-should-not-leak">
|
|
<div role="dialog" aria-label="Data Collection" id="collect" hidden>
|
|
<div id="c1">
|
|
<label><input type="radio" name="c"> Yes, we collect data from this app</label>
|
|
<label><input type="radio" name="c"> No, we do not collect data from this app</label>
|
|
<button type="button" id="next">Next</button>
|
|
</div>
|
|
<div id="c2" hidden>
|
|
<h2>Which kinds of data do you collect?</h2>
|
|
<div role="group" aria-label="Contact Info"><span role="switch" aria-checked="false" tabindex="0">Contact details</span></div>
|
|
<div role="group" aria-label="Identifiers"><span role="switch" aria-checked="false" tabindex="0">Device identifiers</span></div>
|
|
<label>Notes <input type="text" value="typed-by-owner-should-not-leak"></label>
|
|
<button type="button">Done</button>
|
|
</div>
|
|
</div>
|
|
<script>
|
|
document.getElementById('start').addEventListener('click', () => { document.getElementById('collect').hidden = false; });
|
|
document.getElementById('next').addEventListener('click', () => { document.getElementById('c1').hidden = true; document.getElementById('c2').hidden = false; });
|
|
</script>
|
|
</body></html>
|