feat(browser): let a project name its test-id attribute - #1395

Thanks, the shape is right. One module owns the attribute, every site from #1376 goes through it, and with the default attribute nothing changes, so saved flows keep replaying. I also checked the wire side: testidFoundUnder is optional and the contract fingerprint doesn't cover hint fields, so older daemons and SDKs are fine. And init keeps the new .reticle.json key on a re-run.

There are two real bugs, two red checks, and a few smaller things.

Bugs

1. Secret redaction gets narrower. With data-cy configured, <input data-testid="api-key"> is no longer treated as sensitive, so its raw value goes out. I reproduced it: isSensitiveField returns true on main and false on this branch. In dom/a11y.ts:361 and observers/field.ts:69, check the configured attribute and DEFAULT_TESTID_ATTR. Changing this setting should only ever widen redaction. Please add that exact case as a test.

2. Some valid-looking names crash every query. TESTID_ATTR_PATTERN (core/src/identity/testid-attribute.ts:24) accepts . and :. With data.test or xlink:foo, runQuery throws "Invalid selector", and so does closest() in the DOM observer on every mutation. Tightening it to /^[a-zA-Z_][\w-]*$/ fixes it. Add a test for both names. Injection itself is already handled: x],[onclick falls back to the default.

Red checks

3. verify: server/src/surface/tools/tools.ts goes from 997 to 1003 lines, over the 1000-line cap. Shorten the testidFoundUnder description, or move the hint schema out of that file.

4. unit-tests: the new testid-attr.ts makes 13 loose files in adapters/realm/browser/src/dom, and server/src/guards/harness/flat-directories-are-recorded.test.ts:347 records 12. Either bump that count with a one-line reason next to it, or put the file in a subfolder.

Smaller

5. Next.js and Remix ignore the setting. The .reticle.json setting only reaches the SDK through the Vite plugin's generated connect. The Next adapter (adapters/build/next/index.cjs) already reads .reticle.json, so passing testIdAttribute through there is a small change. If you'd rather not, say "Vite only" in the changes file, in connect-options.ts and in the hint text at tools.ts:511.

6. The miss hint skips data-testid. In query.ts:714, when another attribute is configured, also check DEFAULT_TESTID_ATTR. Otherwise a project that switches attributes gets no hint when its old flows miss.

7. The wiring has no tests. Deleting setTestIdAttr(options.testIdAttribute) (reticle.ts:428) or the forwarding in connect-args.ts:74 wouldn't fail anything. A connectArgs test, plus one where connect({ testIdAttribute }) makes a query resolve, would cover both.

The red install-gate is a cancelled duplicate run, not your change. #1385 and #1171 also touch query.ts and a11y.ts, so expect a rebase depending on which lands first.

Nice work. I went through all seven points, deleting each fix to check the tests go red. Six are done properly: the pattern, the line cap, the dom/addressing/ move, the hint fallback, both wiring tests, and the a11y.ts side of redaction. CI is green too.

Two small things left:

1. field.ts checks both attributes now, but nothing tests it. I deleted the DEFAULT_TESTID_ATTR check at field.ts:72 and all 1816 browser tests still passed. This test in observers/field.test.ts, inside the redaction block, covers it. It passes on your branch and fails with that check removed:

   it('still redacts a data-testid secret after data-cy is configured', () => {
     setTestIdAttr('data-cy'); // reset with setTestIdAttr(undefined) in afterEach
     const { events } = page('<input data-testid="api-key" value="s3cret" />');
     const input = document.querySelector('input');
     if (null === input) throw new Error('no input');
     fire(input, 'change');
     expect(events[0]?.data['value']).toBeUndefined();
     expect(events[0]?.data['redacted']).toBe(true);
   });

2. connect-options.ts:38 still says "Normally supplied by the build plugin". Make it say it comes from the Vite plugin only, and that Next.js, Remix and manual setups pass it here, to match the changes file.

Also, the comment at review/mark-anchor.ts:12 ("Attribute names — defined locally…") doesn't describe anything anymore. Please delete it.

After those, I'll merge it.

Thanks. I checked the new field test by deleting the DEFAULT_TESTID_ATTR check in field.ts, and it fails, so the redaction fix is covered now. The comment is fixed and the stale one is gone. Merging.