QA report: e2b-dev/fragments at cc07f43
Prompt input validation fails to reject whitespace-only submissions, triggering unnecessary backend generation requests.
Ten scenarios were tested across prompt entry, settings configuration, model and template selection, file attachments, and error handling. Most configuration workflows and basic empty prompt validations passed as expected. Full end-to-end generation could not be completed during testing because the sandbox environment lacked valid backend API credentials.
The single failure occurred when submitting a prompt consisting solely of whitespace. While completely empty prompts are blocked, whitespace-only text is accepted by the interface, transitioning the application into a generating state and dispatching a backend request that eventually fails with a generic error message.
Run summary
| Metric | Count |
|---|
| Scenarios executed | 10 |
| Passed | 9 |
| Failed | 1 |
| Blocked | 0 |
| Findings raised | 1 |
| Issues after the audit | 1 |
| Withdrawn by the audit | 0 |
| Critical / high / medium / low | 0 / 0 / 1 / 0 |
Target: http://127.0.0.1:3000 · Testing level: deep_feature · Stack: node / npm (next)
Issues
Medium severity
F1 · Prompt textarea accepts whitespace-only input and attempts generation
Severity: medium · Type: functional · Verdict: confirmed · Scenario: S5
The application fails to trim and validate whitespace-only input client-side, making unnecessary requests. While the subsequent 500 error is an environment issue, the missing input validation is a genuine functional defect. The page reported 2 console errors during the scenario.
Expected: The application should trim whitespace and disable or block submission for empty/whitespace-only input without making a backend generation request.
Actual: The application accepted the whitespace-only prompt, entered the 'Generating...' state, sent a backend request, and then failed with 'An unexpected error has occurred. Please try again later.'
Steps to reproduce:
- Navigate to http://127.0.0.1:3000/
- Enter whitespace characters into the 'Describe your app...' prompt textarea
- Click the submit prompt button
Evidence: screenshots/S5-4.png, screenshots/S5-6.png, screenshots/S5-8.png
Environment limitations
These failures came from the test environment, not from the application: a credential the sandbox does not hold, a demo nobody may write to, a resource it cannot reach. They are not counted as issues. They record what this run could not exercise.
- S1 could not exercise this: Generation request fails with 500 Internal Server Error due to missing API keys. The server responds with a 500 Internal Server Error due to the sandbox lacking valid API credentials. The audit recorded the test environment as the cause, so it is not counted as an issue.
Scenario results
| Scenario | Priority | Result | Issues |
|---|
| S1 Handle missing API credentials gracefully | high | pass | none |
| S2 Retry generation after an error | high | pass | none |
| S3 Prevent submission with empty prompt | high | pass | none |
| S4 Configure API Key and settings | high | pass | none |
| S5 Prevent submission with whitespace-only prompt | medium | fail | F1 |
| S6 Select application template | medium | pass | none |
| S7 Select LLM model | medium | pass | none |
| S8 Configure model hyperparameters | medium | pass | none |
| S9 Toggle Morph Apply fast code generation | medium | pass | none |
| S10 Interact with attach file functionality | low | pass | none |
The audit
The Critic reviewed 1 finding and re-verified 0 of them live in the browser, replaying the reported steps on a fresh page.
- The test sandbox lacks the backend API credentials needed for generation, resulting in 500 Internal Server Errors when interacting with the main feature.
- F1 correctly identifies a client-side defect that occurs prior to the environment-induced generation failure.
What to fix first
- Trim prompt input before validation to prevent whitespace-only submissions from initiating generation requests (F1).
Coverage and caveats
In scope: Prompt submission and validation; Error state rendering and recovery; Model parameter settings panel; Template and model selection.
Not covered: Successful generation of a full-stack fragment; User authentication or profile management; GitHub repository navigation.
- The test environment lacks valid external LLM and E2B API keys, so prompt submission will intentionally trigger a 500 error and the error state UI.
- File attachment interactions can be verified by observing the browser file picker or a UI change, though actual file upload depends on browser automation capabilities.
By the numbers
| Metric | Value |
|---|
| Scenarios | 9 passed, 1 failed, 0 blocked of 10 (33 planned steps) |
| Browser actions | 145 (28 clicks, 17 inputs, 20 navigations, 80 snapshots) |
| Screenshots | 37 (3 explore, 34 scenario, 0 critic), 34 captioned |
| Coverage | 1 pages, 2 forms, 2 flows, 3 console errors |
| Audit | 1 findings, 0 re-verified live, 1 confirmed, 0 promoted, 0 withdrawn |
| Model calls | 148 |
| Tokens | 532,362 input, 7,104 output, 13,250 thinking |
| Time | 13 min |
| Stage | Calls | Input | Output | Thinking | Seconds |
|---|
| explore | 25 | 90,374 | 1,539 | 1,542 | 377 |
| plan | 1 | 3,104 | 1,729 | 3,149 | 36 |
| test | 120 | 432,917 | 3,264 | 6,351 | 356 |
| critique | 1 | 4,453 | 389 | 1,850 | 18 |
| report | 1 | 1,514 | 183 | 358 | 5 |