[Aaryan430]

Why

Follow-up to #502. Its review raised these points, but the PR was merged before they were fixed. This change fixes them in the code #502 added to main.

What changed

Comparing runs (compareWith)

• Still-processing runs. The compare path now reads both runs' status in parallel and passes stillProcessing to each export. A run that is still processing has its export neither reused nor kept. The answer also says Run <id> is still <status>: its issues are still being added, so the comparison may change once it completes.
• Arguments it used to drop. compareWith with cursor (above 0), pageUrl or exportTaskId now returns compareWith cannot be combined with <name>. Comparing a run with itself is refused too. Both checks live inside compareScanRuns, after the source is known to be a scan, so the App Accessibility build comparison in feat(accessibility): read App Accessibility builds, and set up App Automate runs for them #504 can still page with cursor. The scan's runs are walked only for "previous". For a given run id they are not, so there are no dashboard counts in that case.
• previousScanRun. A walk that stops at the 10-page cap no longer reports "first run". If the run isn't among the pages read, the error says so. If the run before it is older than the pages read, the error says that. Both errors ask for the earlier run's scanRunId as compareWith. A run that isn't in the scan at all, or a failed read of the scan's runs, now gives its own error. Only a genuine first run returns undefined.

Report links and exports

• Automate build links. Up to 5 of the build's sessions are listed (AUTOMATE_SESSIONS_TRIED), and each session's test-code record is tried in order until one names an SDK build. The "not linked to a BrowserStack SDK build" message appears only when none of them does. The 404 and non-404 distinctions are unchanged.
• exportTaskId is now an opaque token. It is base64url JSON of { t: taskId, r: <short sha256 of the report key>, s: <start time> }. The canonical report key (scan:<scanId>:<scanRunId>, build:<id>, workflow:<id>) is also used for the cache key, so numeric and string ids now match. A token that doesn't decode is refused as "not an export this tool handed out". One for another report is refused as "another report's export". ExportPendingError.taskId carries the token.
• Stuck exports. A task still pending 10 minutes after it started (EXPORT_TASK_MAX_AGE_MS) is dropped and a new export is started. Not in the review: a task started while the report was still processing is continued only while the report is still processing, and its CSV is never cached. Without this, the compare path's "the exports continue where they are" would have stopped being true, and a partial snapshot could have been cached as the finished report.
• Poll loop.
  • Polls use raise_error: false.
  • A failed poll throws with its HTTP status and drops the cache entry.
  • A response body that isn't an object no longer causes a TypeError.
  • The loop never sleeps past the wait budget: it hands the export back before a pause that would end past it.
  • EXPORT_WAIT_MS is now 40 s, counted from the start request. Its doc comment is updated.

Pages and hints

• pageIssues. A page address such as http:// gets the usual no-match note instead of throwing ERR_INVALID_URL.
• pageUrl in follow-up hints. It is written with JSON.stringify, both in the next-page hint and in the export-pending hint.

Schema and timeouts

• cursor. It is now .int().nonnegative().
• Request timeouts. AccessibilityReportFetcher and AccessibilityScanner send their GETs through a private get wrapper that adds a 15 s timeout. apiClient's global default is unchanged, so long-running tools elsewhere are not affected.

Tool descriptions are unchanged.

Verified

• npm run build (lint, prettier, vitest, tsc) exits 0: 93 test files, 1429 tests passed. New tests cover each item above. The existing tests that passed raw task ids now go through tokens, and the Automate build-link test now expects ?limit=5.
• Live check: I ran the built server over MCP stdio against a real account.
  • Comparing with "previous" gives the dashboard's counts. Comparing with an explicit run id skips them.
  • Comparing a run with itself, and compareWith with cursor, pageUrl or exportTaskId, are each refused.
  • A scan's first run still says "first run". A run id that isn't in the scan says "not a run of scan".
  • A raw task id, and a token made for another report, are both refused.
  • pageUrl: "http://" gives the no-match note.
  • An Automate build link resolves to its Accessibility build.
  • Not checked live: the still-processing note and the stuck-export restart. No processing run or slow export was available, so only the unit tests cover them.

Also: #502 raised the CSV page size from 5,000 to 10,000 characters per call (the maxCharacterLength default in report-parser.ts), which its description didn't mention.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Central YAML (base), Organization UI (inherited), Workspace UI (inherited); Enforced overrides: Organization
• Review profile: ASSERTIVE
• Plan: Enterprise
• Run ID: 47bc50c8-9850-4df3-8712-79e65264b11d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}