[dev] [Marfuen] mariano/sale-45-screenshot-automation-feature-improvements

[github-actions]

This is an automated pull request to merge mariano/sale-45-screenshot-automation-feature-improvements into dev.
It was created by the [Auto Pull Request] action.

---

Summary by cubic

Adds an audit overlay to automation screenshots and replaces stale full‑size links with a signed redirect to meet SALE‑45 auditor requirements. Also adds per‑automation evaluation criteria with pass/fail verdicts and clearer run errors, fixing “Access denied” and “evaluation error” cases.

• New Features

  • Screenshot overlay bakes in UTC timestamp, source URL, and instruction; rendered via sharp with Comp AI branding.
  • Stable full‑size link: GET /v1/browserbase/runs/{runId}/screenshot issues a fresh 302 to a signed S3 URL; supports ?download=true. UI now links to this endpoint.
  • Optional evaluationCriteria on automations; runs produce pass/fail with a short reason when set. DTOs and OpenAPI updated.
  • Improved error messages: classify session-ended/timeouts and surface concise, user‑friendly text.

• Migration

  • Run DB migration adding nullable BrowserAutomation.evaluationCriteria.
  • No breaking changes; API images now include fontconfig and fonts-dejavu-core so overlay text renders in production.

^{Written for commit ff83c69. Summary will update on new commits.}

[linear]

SALE-45 Screenshot automation: feature improvements

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app	Ready	Preview, Comment	Apr 24, 2026 1:22pm
comp-framework-editor	Ready	Preview, Comment	Apr 24, 2026 1:22pm
portal	Ready	Preview, Comment	Apr 24, 2026 1:22pm

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
CompAI	🟢 Ready	View Preview	Apr 24, 2026, 1:22 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[cubic-dev-ai]

cubic analysis

1 issue found across 20 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="docs/plans/2026-04-22-sale-45-screenshot-automation-improvements.md">

<violation number="1" location="docs/plans/2026-04-22-sale-45-screenshot-automation-improvements.md:1024">
P2: The generic fallback error message is self-referential: it says "see run error details for specifics" but the `error` field _is_ the run error details — the raw error has been discarded (only logged server-side). The user would read this message and find no further specifics anywhere.

Consider either including a sanitised summary of the original error, or removing the misleading "see run error details" clause.</violation>
</file>

Linked issue analysis

Linked issue: SALE-45: Screenshot automation: feature improvements

Status	Acceptance criteria	Notes
✅	Bake audit metadata into screenshot image: include timestamp	renderOverlay supports capturedAt and tests assert timestamp rendering
✅	Bake audit metadata into screenshot image: include source URL	renderOverlay accepts sourceUrl and tests include sourceUrl prop
✅	Bake audit metadata into screenshot image: include auditor requirement text (instruction)	renderOverlay accepts instruction and tests assert instruction truncated/visible
✅	Install fonts at runtime so sharp/librsvg can render text	Dockerfiles add fontconfig and fonts-dejavu-core packages
⚠️	Integrate overlay rendering into automation capture/upload flow (bake into stored screenshot)	renderOverlay imported into service, but usage in execute flow not fully shown
✅	Replace stale presigned-URL 'Open full size' with stable redirect endpoint	New controller endpoint /runs/:runId/screenshot and OpenAPI path added
✅	Redirect endpoint mints a fresh presigned S3 URL (302 redirect)	Service/controller add getSignedUrl usage and controller annotated for 302
⚠️	Support ?download=true to force attachment download on redirect	Controller docs & OpenAPI include download param but implementation snippet truncated
✅	Front-end 'Open full size' link points at stable redirect endpoint (not expired signed URL)	RunItem builds /v1/browserbase/runs/:id/screenshot and tests assert it
✅	Front-end download link uses stable endpoint with ?download=true	RunItem defines downloadHref = `${fullSizeHref}?download=true`
✅	Database schema stores evaluation criteria (evaluationCriteria column and migration)	Prisma schema updated and SQL migration added
✅	API DTOs accept evaluationCriteria on create/update	Create/Update DTOs include optional evaluationCriteria fields
✅	UI form allows entering evaluation criteria (create/edit dialog)	BrowserAutomationConfigDialog schema and initialValues include evaluationCriteria
✅	Add tests for overlay rendering, redirect, run-item links, and error formatting	Multiple spec/test files added for overlay, service, controller, run item, formatter
⚠️	Diagnose and repair 'evaluation error' UI state (classify and surface run errors appropriately)	run-error-formatter added and imported, but full fix in eval path not fully shown
✅	OpenAPI docs updated to include new screenshot redirect endpoint	openapi.json includes /v1/browserbase/runs/{runId}/screenshot path
✅	Controller/service return 404 when run or screenshot not found	Controller annotated with 404 response and NotFoundException used in tests

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}

[cubic-dev-ai]

P2: The generic fallback error message is self-referential: it says "see run error details for specifics" but the error field is the run error details — the raw error has been discarded (only logged server-side). The user would read this message and find no further specifics anywhere.

Consider either including a sanitised summary of the original error, or removing the misleading "see run error details" clause.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At docs/plans/2026-04-22-sale-45-screenshot-automation-improvements.md, line 1024:

<comment>The generic fallback error message is self-referential: it says "see run error details for specifics" but the `error` field _is_ the run error details — the raw error has been discarded (only logged server-side). The user would read this message and find no further specifics anywhere.

Consider either including a sanitised summary of the original error, or removing the misleading "see run error details" clause.</comment>

<file context>
@@ -0,0 +1,1093 @@
+        ? 'Browser session ended before we could capture evidence. Please retry.'
+        : isTimeout
+          ? 'Automation timed out before completing. Please retry — if this keeps happening, simplify the instruction or check the target site.'
+          : 'Automation failed to complete. Please retry — see run error details for specifics.';
+
+      return {
</file context>