Open-source web and mobile UI for coding agent CLIs: setup wizard, project workspaces, chat, shell, files and source control views. Run from its repository in the DeepQA sandbox.
Tested byDeepQA Teamfromsiteboon/claudecodeuiat fd424f3onSep 20, 2026
Run #1model gemini-balanced (vertex)took 11m
10 of 12 scenarios passed, 1 failed, 1 blocked, no issues after the audit.
By the numbers
Every scenario DeepQA drove in the browser, in plan order, with the 33 screenshots it captured along the way. A passing scenario is evidence too.
2 steps, 3 screenshots
4 steps, 2 screenshots
5 steps, 3 screenshots
3 steps
5 steps, 4 screenshots
3 steps, 4 screenshots
3 steps, 2 screenshots
3 steps, 3 screenshots
3 steps, 2 screenshots
3 steps, 2 screenshots
3 steps, 4 screenshots
1 step, 4 screenshots
Findings that survived the Critic's audit. Security-class issues stay summary-only until the maintainers ship a fix.
Security-class issue (high) confirmed by the audit. Reproduction detail and evidence are withheld from the public projection until the maintainers ship a fix.
These failures came from the test environment, not from the application: a credential the sandbox does not hold, a demo nobody may write to, a resource it cannot reach. They are not counted as issues.
An adversarial second pass over every finding before it reaches the report.
Scenarios S3 and S6 demonstrate that the application correctly blocks system directories (like /tmp and /var) during the final workspace creation in Step 2, meaning the input is validated before the action completes. The live replay was inconclusive: The replay ran out of tool calls before it reached the reported state.
No confirmed defects were found during deep feature testing of the application.
Testing exercised twelve scenarios across the application, covering account creation and setup wizards, workspace directory validation and view switching, chat interactions, source control validations, dark mode toggling, and project filtering.
Ten scenarios passed, while one finding regarding workspace directory validation was withdrawn during audit after verifying that path validation is enforced in a subsequent wizard step. Environment limitations prevented verification of TaskMaster installation checks and initial authentication responses, and execution constraints left the final folder selection step of the workspace creation happy path incomplete.
With zero confirmed issues after audit, the evaluated interface controls and client-side validation logic performed as expected across the tested feature set.
| Metric | Count |
|---|---|
| Scenarios executed | 12 |
| Passed | 10 |
| Failed | 1 |
| Blocked | 1 |
| Findings raised | 1 |
| Issues after the audit | 0 |
| Withdrawn by the audit | 1 |
| Critical / high / medium / low | 0 / 0 / 0 / 0 |
Target: http://localhost:5173 · Testing level: deep_feature · Stack: node / npm (vite)
No issues survived the audit.
These failures came from the test environment, not from the application: a credential the sandbox does not hold, a demo nobody may write to, a resource it cannot reach. They are not counted as issues. They record what this run could not exercise.
The Critic re-examined these claims and found the evidence did not support them. They are kept here rather than deleted.
| Scenario | Priority | Result | Issues |
|---|---|---|---|
| S1 Complete Admin Account Creation | high | pass | none |
| S2 Complete Setup Wizard Configuration | high | pass | none |
| S3 Create Project Workspace - Happy Path | high | blocked (Ran out of tool calls before completing the folder selection and final workspace creation step.) | none |
| S4 Create Project Workspace - System Directory Validation | high | fail | none |
| S5 Switch Workspace Views | high | pass | none |
| S6 Create Project Workspace - Outside Root Validation | medium | pass | none |
| S7 Create Project Workspace - Empty Path Validation | medium | pass | none |
| S8 Chat Interaction - Send Prompt | medium | pass | none |
| S9 Chat Interaction - Empty Prompt Validation | medium | pass | none |
| S10 Source Control - Empty Commit Validation | medium | pass | none |
| S11 Settings - Toggle Dark Mode | low | pass | none |
| S12 Project Search - Filter by Name | low | pass | none |
The Critic reviewed 1 finding and re-verified 2 of them live in the browser, replaying the reported steps on a fresh page.
In scope: Initial setup wizard flow; Deep validation of project workspace creation paths; Workspace view tabs and interactions; Form validation on chat prompts and source control commits.
Not covered: Deep testing of terminal/shell command execution; Settings categories other than Appearance due to the scenario cap.
| Metric | Value |
|---|---|
| Scenarios | 10 passed, 1 failed, 1 blocked of 12 (38 planned steps) |
| Browser actions | 258 (70 clicks, 33 inputs, 21 navigations, 134 snapshots) |
| Screenshots | 41 (4 explore, 37 scenario, 0 critic), 37 captioned |
| Coverage | 1 pages, 6 forms, 4 flows, 6 console errors |
| Audit | 1 findings, 2 re-verified live, 0 confirmed, 0 promoted, 1 withdrawn |
| Model calls | 214 |
| Tokens | 1,145,881 input, 8,981 output, 17,317 thinking |
| Time | 10 min |
| Stage | Calls | Input | Output | Thinking | Seconds |
|---|---|---|---|---|---|
| explore | 36 | 161,729 | 1,812 | 1,155 | 76 |
| plan | 1 | 3,731 | 1,780 | 3,720 | 40 |
| test | 159 | 941,021 | 4,097 | 8,062 | 431 |
| critique | 17 | 37,746 | 1,122 | 3,712 | 71 |
| report | 1 | 1,654 | 170 | 668 | 7 |
| stage | calls | tokens | time |
|---|---|---|---|
| Explore | 36 | 164.7k | 1m 16s |
| Plan | 1 | 9.2k | 40s |
| Test | 159 | 953.2k | 7m 11s |
| Critique | 17 | 42.6k | 1m 11s |
| Report | 1 | 2.5k | 7s |
| Total | 214 | 1.2M | 10m 24s |
Connect a repo, dispatch a Run, and read an audited, evidence-backed report the same day.