Skip to content

fix(automate): read visual-log screenshots in fetchAutomationScreenshots - #481

Open
SavioBS629 wants to merge 3 commits into
browserstack:mainfrom
SavioBS629:fix/automate-debug-screenshots
Open

SavioBS629 wants to merge 3 commits into
browserstack:mainfrom
SavioBS629:fix/automate-debug-screenshots

Conversation

@SavioBS629

Copy link
Copy Markdown
Collaborator

Problem

fetchAutomationScreenshots returned "No screenshots found" for sessions that do have screenshots in their logs.

Session logs (written by SeleniumHub) carry screenshots in two forms:

Form Log shape When it appears
Test-initiated REQUEST … GET /session/<id>/screenshot then RESPONSE {"value":"<url>"} Test calls driver.save_screenshot() / page.screenshot(); no capability needed
Visual logs DEBUG <url> browserstack.debug: true; after each click/goto (Playwright) or each command in config/commandlist.txt (Selenium)

Only the first form was parsed. Debug-mode sessions without explicit screenshot calls came back empty, and Selenium sessions with both returned only the test-initiated ones.

Changes

  • Parse both forms in log order, dedupe, keep the last five
  • Accept every DEBUG URL form SeleniumHub emits (s3-debug, b2-debug, direct bucket)
  • Find the RESPONSE for a screenshot request even when other log lines (PERFORMANCE, SELFHEAL, …) sit in between, without crossing into the next REQUEST
  • Detect the image mime type from the bytes; DEBUG screenshots are JPEG and were labelled image/png
  • Empty-result message now points to browserstack.debug: true
  • Hardening: request/response payloads are logged verbatim, so a user could plant " DEBUG <url>" or a "value" in their own commands and make the server fetch it. All patterns are now anchored to the log line prefix, the screenshot RESPONSE must have a top-level value, and only https URLs on browserstack.com, S3 or B2 hosts are fetched. This also closes the same gap in the pre-existing GET /screenshot path.

Verification

npm run build passes on Node 22 (82 files, 1278 tests). New tests/tools/fetch-screenshots.test.ts uses log lines taken from real sessions.

Against live sessions:

Session Type Before After
9eaca30c… Playwright, debug on, no explicit screenshots 0 4 (JPEG)
c239114f… Playwright, explicit page.screenshot() 5 5 (unchanged)
94d6e8ef… Selenium, debug on + 1 explicit screenshot 1 3

🤖 Generated with Claude Code

SavioBS629 and others added 2 commits October 13, 2026 15:26
Session logs carry screenshots in two forms: `REQUEST GET /screenshot`
followed by a RESPONSE value (test-initiated), and `DEBUG <url>` lines
written for every click/goto (Playwright) or listed command (Selenium)
when browserstack.debug is on. Only the first form was parsed, so
debug-mode sessions without explicit screenshot calls returned nothing.

- Parse both forms in log order, dedupe, keep the last five
- Accept s3-debug, b2-debug and direct bucket URLs on DEBUG lines
- Match the RESPONSE after the screenshot request even when other log
  lines sit in between
- Report the detected image mime type instead of always image/png
- Point to browserstack.debug in the empty-result message

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Request and response payloads are written verbatim into session logs,
so unanchored patterns could pick up an attacker-supplied " DEBUG <url>"
or "value" and make the server fetch it (SSRF from hosted pods).

- Anchor REQUEST/RESPONSE/DEBUG patterns to the log line prefix
- Require a top-level "value" in the screenshot RESPONSE
- Only fetch https URLs on browserstack.com, S3 or B2 hosts

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented Oct 13, 2026 •

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: Central YAML (base), Organization UI (inherited), Workspace UI (inherited)
  • Review profile: ASSERTIVE
  • Plan: Enterprise
  • Run ID: d771c6ad-9641-4050-874c-a4f7012cdc42

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
SavioBS629 added a commit to SavioBS629/mcp-server that referenced this pull request Oct 15, 2026
PR browserstack#481 and this branch both rewrote fetchAndCompress, so they could not be
merged independently. This brings browserstack#481's changes onto the size-cap work:

- parse DEBUG visual-log screenshots alongside test-initiated ones, anchored
  on the timestamped log prefix so a REQUEST cannot borrow a later RESPONSE
- restrict screenshot URLs to https on BrowserStack, S3 and B2 hosts
- detect the image mime type from the bytes, after compression: sharp
  re-encodes anything over 1 MB to PNG, so reading the original bytes would
  label a large JPEG wrongly
- report the empty result as a debug-mode hint rather than an unexpected error

Screenshot keeps both shapes: it carries mimeType and fetchAndCompress still
returns null for an oversized download so the remaining screenshots load.

The size-cap tests now use timestamped log lines and allowlisted https URLs,
routed to the local server by the apiClient spy; the previous fixtures were
written against the older permissive parser and would otherwise parse to no
URLs at all.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants