@aarwitz/tapp 0.15.0 → 0.15.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aarwitz/tapp",
-  "version": "0.15.0",
+  "version": "0.15.1",
   "mcpName": "io.github.aarwitz/tapp",
   "description": "Release contracts, autonomous QA, and evidence-backed CI gates for iOS, Android, and web.",
   "license": "MIT",
@@ -24,7 +24,19 @@
     "docs/application-model.md",
     "docs/scenarios.md",
     "mcp-server/src/",
-    "scripts/",
+    "scripts/ci-gate.sh",
+    "scripts/compile-contract.js",
+    "scripts/compile-flow.js",
+    "scripts/flow-platform.js",
+    "scripts/flow_ai_judge.py",
+    "scripts/flow_lib.py",
+    "scripts/platform-gate.js",
+    "scripts/pr-plan.js",
+    "scripts/quick-capture.sh",
+    "scripts/run-android-flow.js",
+    "scripts/run-flow.sh",
+    "scripts/run-web-flow.js",
+    "scripts/run-web-scenario.js",
     "Harness/OCQAHarness/",
     "Harness/OCQAHarnessUITests/",
     "Harness/OCQAHarness.xcodeproj/",
@@ -75,7 +87,7 @@
     "mobile"
   ],
   "scripts": {
-    "test": "node --test tests/report.test.js tests/regression.test.js tests/engine.test.js tests/project-config.test.js tests/application-model.test.js tests/ui-map.test.js tests/task-runtime.test.js tests/release-contract.test.js tests/pr-selection.test.js tests/flow-runtime.test.js tests/web-explorer.test.js tests/web-session.test.js tests/web-flow.test.js tests/scenario-runtime.test.js tests/android-driver.test.js tests/android-explorer.test.js tests/android-flow.test.js tests/managed-web.test.js tests/product-operations.test.js tests/browser-product.test.js tests/browser-onboarding.test.js tests/managed-operation.test.js tests/cloud-runner.test.js tests/ci-setup.test.js tests/ci-install.test.js tests/cli.test.js tests/action.test.js tests/ci-gate.test.js tests/ci-report.test.js tests/desktop-protocol.test.js tests/ios-flow-protocol.test.js",
+    "test": "node --test tests/report.test.js tests/regression.test.js tests/engine.test.js tests/project-config.test.js tests/application-model.test.js tests/ui-map.test.js tests/task-runtime.test.js tests/release-contract.test.js tests/pr-selection.test.js tests/flow-runtime.test.js tests/web-explorer.test.js tests/web-session.test.js tests/web-flow.test.js tests/scenario-runtime.test.js tests/android-driver.test.js tests/android-explorer.test.js tests/android-flow.test.js tests/managed-web.test.js tests/product-operations.test.js tests/browser-product.test.js tests/browser-onboarding.test.js tests/managed-operation.test.js tests/cloud-runner.test.js tests/ci-setup.test.js tests/ci-install.test.js tests/cli.test.js tests/action.test.js tests/package-surface.test.js tests/ci-gate.test.js tests/ci-report.test.js tests/desktop-protocol.test.js tests/ios-flow-protocol.test.js",
     "test:browser-journey": "node --test tests/browser-journey.test.js",
     "test:browser-native": "TAPP_RUN_NATIVE_BROWSER=1 node --test tests/browser-native-journey.test.js"
   }

package/scripts/ci-gate.sh

@@ -254,7 +254,7 @@ print(named[0] if named else (iphones[0] if iphones else ''))
   if [[ -z "$UDID" ]]; then
     RUNTIME="$(xcrun simctl list runtimes -j | python3 -c 'import sys,json; rts=[r for r in json.load(sys.stdin)["runtimes"] if r.get("isAvailable") and r["platform"]=="iOS"]; print(rts[-1]["identifier"] if rts else "")')"
     [[ -n "$RUNTIME" ]] || { echo "❌ No iOS simulator runtime available" >&2; exit 1; }
-    UDID="$(xcrun simctl create "AutoTap CI" "$DEVICE" "$RUNTIME")" || { echo "❌ Could not create simulator" >&2; exit 1; }
+    UDID="$(xcrun simctl create "Tapp CI" "$DEVICE" "$RUNTIME")" || { echo "❌ Could not create simulator" >&2; exit 1; }
   fi
   echo "Booting $UDID …"
   xcrun simctl boot "$UDID" || true
@@ -269,7 +269,7 @@ xcrun simctl install "$UDID" "$APP_PATH" || { echo "❌ simctl install failed
 # ── Autonomous exploration (quick-capture builds the harness itself if needed).
 step "Explore ($ACTIONS actions, ${TIMEOUT}s watchdog)"
 set +e
-CAPTURE_ROOT="${AUTOTAP_HOME:-$ROOT}/captures"
+CAPTURE_ROOT="${TAPP_HOME:-${AUTOTAP_HOME:-$ROOT}}/captures"
 mkdir -p "$CAPTURE_ROOT"
 CAPTURE_DIR="$(mktemp -d "$CAPTURE_ROOT/ci.XXXXXX")"
 TAPP_CAPTURE_DIR="$CAPTURE_DIR" OCQA_PR_TARGET_JSON="$IOS_PR_TARGET_JSON" "$ROOT/scripts/quick-capture.sh" explore "$BUNDLE_ID" --actions "$ACTIONS" --timeout "$TIMEOUT"
@@ -282,7 +282,7 @@ echo "Markers: $MARKERS"
 FLOW_LOG_ARGS=()
 if [[ "${#FLOW_FILES[@]}" -gt 0 ]]; then
   step "Flows"
-  FLOW_LOG_DIR="$(mktemp -d /tmp/autotap-ci-flows.XXXXXX)"
+  FLOW_LOG_DIR="$(mktemp -d /tmp/tapp-ci-flows.XXXXXX)"
   for flow in "${FLOW_FILES[@]}"; do
     name="$(basename "$flow" .yml)"
     log="$FLOW_LOG_DIR/$name.log"

package/scripts/flow_ai_judge.py

@@ -26,7 +26,7 @@ def _ctx():
 
 
 SSL_CTX = _ctx()
-MODEL = os.environ.get("AUTOTAP_VISION_MODEL", "claude-haiku-4-5-20251001")
+MODEL = os.environ.get("TAPP_VISION_MODEL") or os.environ.get("AUTOTAP_VISION_MODEL", "claude-haiku-4-5-20251001")
 SYSTEM = (
     "You are a QA test oracle. You are shown one iOS app screenshot and a CLAIM the test asserts about "
     "it. Decide if the claim is TRUE of what is actually visible. Be strict and literal — only pass if "

package/scripts/quick-capture.sh

@@ -12,27 +12,28 @@ set -euo pipefail
 #          [--timeout <secs>]                         # Hard timeout for explore command
 #   quick-capture.sh tree <bundleId>                  # Dump accessibility tree
 #
-# All output goes to ~/repos/AutoTap/captures/<timestamp>/
+# All output goes to the configured Tapp home or the repository capture directory.
 
 PROJECT_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 # TAPP_CAPTURE_DIR selects one exact run directory (used by CI so a failed run can never
-# accidentally reuse stale markers). AUTOTAP_HOME redirects all writable output otherwise —
-# set by the `autotap` CLI when running as an installed npm package, where the package dir
+# accidentally reuse stale markers). TAPP_HOME redirects all writable output otherwise —
+# set by the `tapp` CLI when running as an installed npm package, where the package dir
 # must stay read-only. Unset (repo dev flow), everything lands in the repo as before.
+TAPP_RUNTIME_HOME="${TAPP_HOME:-${AUTOTAP_HOME:-}}"
 if [[ -n "${TAPP_CAPTURE_DIR:-}" ]]; then
   CAPTURE_DIR="$TAPP_CAPTURE_DIR"
-elif [[ -n "${AUTOTAP_HOME:-}" ]]; then
-  CAPTURE_DIR="$AUTOTAP_HOME/captures/$(date +%Y%m%d-%H%M%S)"
+elif [[ -n "$TAPP_RUNTIME_HOME" ]]; then
+  CAPTURE_DIR="$TAPP_RUNTIME_HOME/captures/$(date +%Y%m%d-%H%M%S)"
 else
   CAPTURE_DIR="$PROJECT_ROOT/captures/$(date +%Y%m%d-%H%M%S)"
 fi
-if [[ -n "${AUTOTAP_HOME:-}" ]]; then
-  HARNESS_DERIVED="$AUTOTAP_HOME/harness-derived"
+if [[ -n "$TAPP_RUNTIME_HOME" ]]; then
+  HARNESS_DERIVED="$TAPP_RUNTIME_HOME/harness-derived"
 else
-  HARNESS_DERIVED="/tmp/autotap-harness-derived"
+  HARNESS_DERIVED="/tmp/tapp-harness-derived"
 fi
 HARNESS_PROJECT="$PROJECT_ROOT/Harness/OCQAHarness.xcodeproj"
-DEFAULT_BUNDLE="com.autotap.demoapp"
+DEFAULT_BUNDLE="io.github.aarwitz.tapp.demoapp"
 
 get_booted_sim() {
   xcrun simctl list devices booted -j 2>/dev/null \
@@ -168,13 +169,13 @@ run_harness_test() {
   "OCQA_MAX_ACTIONS": "$max_actions",
   "OCQA_TIMEOUT_SECONDS": "$timeout_secs",
   "OCQA_TEST_EMAIL": "${OCQA_TEST_EMAIL:-qa@example.com}",
-  "OCQA_TEST_PASSWORD": "${OCQA_TEST_PASSWORD:-Autotap123!}"$interactive_line$overrides_line$launch_args_line$launch_env_line$login_steps_line$pr_target_line
+  "OCQA_TEST_PASSWORD": "${OCQA_TEST_PASSWORD:-Tapp123!}"$interactive_line$overrides_line$launch_args_line$launch_env_line$login_steps_line$pr_target_line
 }
 CONF
 
   local xctestrun=$(find "$HARNESS_DERIVED/Build/Products" -name "*.xctestrun" 2>/dev/null | head -1)
   if [[ -z "$xctestrun" ]]; then
-    echo "ERROR: No xctestrun found. Run: ./scripts/deploy-and-build.sh --harness" >&2
+    echo "ERROR: No xctestrun found. Run: tapp install" >&2
     return 1
   fi
 
@@ -382,12 +383,12 @@ case "$MODE" in
   "OCQA_SESSION_RESULT_PATH": "$SESS_RES",
   "OCQA_SESSION_TIMEOUT": "$SESS_TIMEOUT",
   "OCQA_TEST_EMAIL": "${OCQA_TEST_EMAIL:-qa@example.com}",
-  "OCQA_TEST_PASSWORD": "${OCQA_TEST_PASSWORD:-Autotap123!}"$sess_args_line$sess_env_line
+  "OCQA_TEST_PASSWORD": "${OCQA_TEST_PASSWORD:-Tapp123!}"$sess_args_line$sess_env_line
 }
 CONF
     xctestrun=$(find "$HARNESS_DERIVED/Build/Products" -name "*.xctestrun" 2>/dev/null | head -1)
     if [[ -z "$xctestrun" ]]; then
-      echo "ERROR: No xctestrun. Run: ./scripts/deploy-and-build.sh --harness" >&2
+      echo "ERROR: No xctestrun. Run: tapp install" >&2
       exit 1
     fi
     export TEST_RUNNER_OCQA_CONFIG_PATH=/tmp/ocqa-run-config.json
@@ -399,7 +400,7 @@ CONF
     ;;
 
   build-harness)
-    # Just (re)build the harness cache for the booted sim — used by `autotap install`
+    # Just (re)build the harness cache for the booted sim — used by `tapp install`
     # for a fast first tool call later. No capture output.
     ensure_harness_built "$SIM_NAME"
     rmdir "$CAPTURE_DIR" 2>/dev/null || true

package/scripts/run-flow.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Run an AutoTap Flow — a deterministic, authored/recorded E2E test (see docs/flows-architecture.md).
+# Run a Tapp Flow — a deterministic, authored/recorded E2E test.
 #
 # Replays the flow's steps against an app on the BOOTED simulator with wait-for-condition timing and
 # poll-with-timeout assertions (no sleeps), then prints a scannable pass/fail report. Deterministic by
@@ -24,14 +24,14 @@ APP="${2:-}"
 
 UDID="$(xcrun simctl list devices booted -j 2>/dev/null | python3 -c 'import sys,json; d=json.load(sys.stdin); print(next((x["udid"] for v in d["devices"].values() for x in v if x.get("state")=="Booted"), ""))')"
 [ -z "$UDID" ] && { echo "❌ No booted simulator."; exit 2; }
-# When run through the `autotap` CLI (installed npm package), the harness cache lives under
-# AUTOTAP_HOME — check there first, then the repo-dev locations.
+# When run through the installed `tapp` CLI, the harness cache lives under TAPP_HOME.
 XCTR=""
-[ -n "${AUTOTAP_HOME:-}" ] && XCTR="$(find "$AUTOTAP_HOME/harness-derived/Build/Products" -name '*.xctestrun' 2>/dev/null | head -1)"
+TAPP_RUNTIME_HOME="${TAPP_HOME:-${AUTOTAP_HOME:-}}"
+[ -n "$TAPP_RUNTIME_HOME" ] && XCTR="$(find "$TAPP_RUNTIME_HOME/harness-derived/Build/Products" -name '*.xctestrun' 2>/dev/null | head -1)"
 [ -z "$XCTR" ] && XCTR="$(find "$HOME/Library/Developer/Xcode/DerivedData/OCQAHarness-"*/Build/Products -name '*.xctestrun' 2>/dev/null | head -1)"
-[ -z "$XCTR" ] && XCTR="$(find /tmp/autotap-harness-derived/Build/Products -name '*.xctestrun' 2>/dev/null | head -1)"
+[ -z "$XCTR" ] && XCTR="$(find /tmp/tapp-harness-derived/Build/Products -name '*.xctestrun' 2>/dev/null | head -1)"
 [ -z "$XCTR" ] && XCTR="$(find /tmp/harness-build/Build/Products -name '*.xctestrun' 2>/dev/null | head -1)"
-[ -z "$XCTR" ] && { echo "❌ Harness not built. Run: scripts/deploy-and-build.sh --harness"; exit 2; }
+[ -z "$XCTR" ] && { echo "❌ Harness not built. Run: tapp install"; exit 2; }
 
 NAME="$(python3 -c "import sys,json;print(json.loads(sys.argv[1]).get('name','flow'))" "$FLOW_JSON")"
 echo "▶️  Running flow \"$NAME\" against $APP …"

package/scripts/android-corpus-e2e.sh

@@ -1,30 +0,0 @@
-#!/usr/bin/env bash
-# Build and exercise every native Android fixture through the same release gate
-# customers use. A connected, booted emulator/device is required.
-set -euo pipefail
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-CORPUS="$ROOT/AndroidCorpus"
-SERIAL="${1:-${ANDROID_SERIAL:-}}"
-SERIAL_ARGS=()
-[[ -n "$SERIAL" ]] && SERIAL_ARGS=(--serial "$SERIAL")
-
-"$CORPUS/gradlew" -p "$CORPUS" \
-  :demoapp:assembleDebug :logindemo:assembleDebug :shopdemo:assembleDebug --no-daemon --quiet
-
-run_fixture() {
-  local module="$1" app_id="$2" flow="$3"
-  local apk="$CORPUS/$module/build/outputs/apk/debug/$module-debug.apk"
-  local output_dir="${RUNNER_TEMP:-/tmp}/tapp-android-corpus-$module"
-  mkdir -p "$output_dir"
-  echo "Testing Android corpus fixture: $module ($app_id)"
-  "$ROOT/scripts/ci-gate.sh" --platform android --apk "$apk" --app-id "$app_id" \
-    "${SERIAL_ARGS[@]}" --actions 12 --timeout 180 --flows "$CORPUS/$module/.autotap/flows/$flow" \
-    --project-dir "$CORPUS/$module" --json-out "$output_dir/report.json" --md-out "$output_dir/report.md"
-}
-
-run_fixture demoapp io.tapp.corpus.demo smoke.yml
-run_fixture logindemo io.tapp.corpus.login sign-in.yml
-run_fixture shopdemo io.tapp.corpus.shop checkout.yml
-
-echo "All Android corpus gates passed."

package/scripts/cleanup-xcode.sh

@@ -1,157 +0,0 @@
-#!/usr/bin/env bash
-# Reclaim disk space consumed by Xcode build artifacts.
-#
-# Default run (no flags): deletes unavailable simulators and stale DerivedData
-# from unrelated projects.  Flags unlock more aggressive passes.
-#
-# Usage:
-#   scripts/cleanup-xcode.sh              # safe defaults
-#   scripts/cleanup-xcode.sh --dry-run    # preview only, nothing deleted
-#   scripts/cleanup-xcode.sh --device-support  # also wipe iOS DeviceSupport caches
-#   scripts/cleanup-xcode.sh --all        # everything above + Xcode caches
-#
-# AutoTap-related DerivedData (OCQAHarness, DemoApp, LoginDemo, etc.) is always
-# preserved.  The local build/ directory in this repo is never touched.
-set -uo pipefail
-
-DRY_RUN=0
-CLEAN_DEVICE_SUPPORT=0
-CLEAN_ALL=0
-
-for arg in "$@"; do
-    case "$arg" in
-        --dry-run)        DRY_RUN=1 ;;
-        --device-support) CLEAN_DEVICE_SUPPORT=1 ;;
-        --all)            CLEAN_DEVICE_SUPPORT=1; CLEAN_ALL=1 ;;
-        -h|--help)
-            sed -n '/^# /s/^# //p' "$0" | head -15
-            exit 0 ;;
-        *) echo "Unknown flag: $arg  (try --help)"; exit 1 ;;
-    esac
-done
-
-DERIVED="$HOME/Library/Developer/Xcode/DerivedData"
-SIMS="$HOME/Library/Developer/CoreSimulator/Devices"
-DEVICE_SUPPORT="$HOME/Library/Developer/Xcode/iOS DeviceSupport"
-XCODE_CACHES="$HOME/Library/Caches/com.apple.dt.Xcode"
-
-# Projects to preserve in DerivedData (all AutoTap-related build products).
-KEEP_PREFIXES=("AutoTap" "OCQAHarness" "DemoApp" "LoginDemo" "WizardDemo"
-               "ShopDemo" "RestaurantDemo" "SymbolCache")
-
-hr() { printf '%0.s─' {1..60}; echo; }
-human() { du -sh "$1" 2>/dev/null | cut -f1; }
-
-run() {
-    if [[ $DRY_RUN -eq 1 ]]; then
-        echo "  [dry-run] $*"
-    else
-        eval "$@"
-    fi
-}
-
-echo ""
-hr
-echo "  Xcode Cleanup  $(date '+%Y-%m-%d %H:%M')"
-[[ $DRY_RUN -eq 1 ]] && echo "  DRY RUN — nothing will be deleted"
-hr
-
-# ── Before snapshot ──────────────────────────────────────────────────────────
-echo ""
-echo "Before:"
-printf "  %-38s %s\n" "CoreSimulator/Devices"  "$(human "$SIMS")"
-printf "  %-38s %s\n" "Xcode/DerivedData"      "$(human "$DERIVED")"
-printf "  %-38s %s\n" "Xcode/iOS DeviceSupport" "$(human "$DEVICE_SUPPORT")"
-printf "  %-38s %s\n" "Xcode caches"            "$(human "$XCODE_CACHES")"
-echo ""
-
-# ── 1. Unavailable simulators ─────────────────────────────────────────────────
-echo "1/3  Removing unavailable simulators …"
-UNAVAIL=$(xcrun simctl list devices --json 2>/dev/null | \
-    python3 -c '
-import sys, json
-d = json.load(sys.stdin)
-n = sum(1 for v in d["devices"].values() for x in v if not x.get("isAvailable", True))
-print(n)
-')
-echo "     Found $UNAVAIL unavailable device(s)."
-if [[ "$UNAVAIL" -gt 0 ]]; then
-    run "xcrun simctl delete unavailable"
-fi
-
-# ── 2. Unrelated DerivedData ──────────────────────────────────────────────────
-echo ""
-echo "2/3  Scanning DerivedData for unrelated projects …"
-STALE=()
-if [[ -d "$DERIVED" ]]; then
-    while IFS= read -r -d '' entry; do
-        base="$(basename "$entry")"
-        keep=0
-        for prefix in "${KEEP_PREFIXES[@]}"; do
-            if [[ "$base" == "$prefix"* ]]; then
-                keep=1; break
-            fi
-        done
-        [[ $keep -eq 0 ]] && STALE+=("$entry")
-    done < <(find "$DERIVED" -maxdepth 1 -mindepth 1 -type d -print0)
-fi
-
-if [[ ${#STALE[@]} -eq 0 ]]; then
-    echo "     Nothing to remove."
-else
-    echo "     Will remove ${#STALE[@]} unrelated build folder(s):"
-    for entry in "${STALE[@]}"; do
-        printf "       %-8s %s\n" "$(human "$entry")" "$(basename "$entry")"
-    done
-    for entry in "${STALE[@]}"; do
-        run "rm -rf \"$entry\""
-    done
-fi
-
-# ── 3. iOS DeviceSupport (optional) ──────────────────────────────────────────
-echo ""
-echo "3/3  iOS DeviceSupport …"
-if [[ $CLEAN_DEVICE_SUPPORT -eq 1 ]]; then
-    if [[ -d "$DEVICE_SUPPORT" ]]; then
-        echo "     Removing $(human "$DEVICE_SUPPORT") of device symbol caches …"
-        echo "     (Xcode re-downloads these automatically when a device is connected.)"
-        run "rm -rf \"$DEVICE_SUPPORT\""
-    else
-        echo "     Directory not found — nothing to do."
-    fi
-else
-    SIZE=$(human "$DEVICE_SUPPORT")
-    echo "     Skipped ($SIZE on disk). Pass --device-support to remove."
-fi
-
-# ── 4. Xcode caches (--all only) ─────────────────────────────────────────────
-if [[ $CLEAN_ALL -eq 1 ]]; then
-    echo ""
-    echo "4/4  Xcode caches …"
-    if [[ -d "$XCODE_CACHES" ]]; then
-        echo "     Removing $(human "$XCODE_CACHES") …"
-        run "rm -rf \"$XCODE_CACHES\""
-    fi
-fi
-
-# ── Simulator data cache (always safe) ───────────────────────────────────────
-SIM_CACHES="$HOME/Library/Developer/CoreSimulator/Caches"
-if [[ -d "$SIM_CACHES" ]] && [[ "$(du -sk "$SIM_CACHES" 2>/dev/null | cut -f1)" -gt 0 ]]; then
-    echo ""
-    echo "     Removing simulator caches ($(human "$SIM_CACHES")) …"
-    run "rm -rf \"$SIM_CACHES\""
-fi
-
-# ── After snapshot ─────────────────────────────────────────────────────────────
-echo ""
-if [[ $DRY_RUN -eq 0 ]]; then
-    hr
-    echo "After:"
-    printf "  %-38s %s\n" "CoreSimulator/Devices"   "$(human "$SIMS")"
-    printf "  %-38s %s\n" "Xcode/DerivedData"       "$(human "$DERIVED")"
-    printf "  %-38s %s\n" "Xcode/iOS DeviceSupport"  "$(human "$DEVICE_SUPPORT")"
-    printf "  %-38s %s\n" "Xcode caches"             "$(human "$XCODE_CACHES")"
-    echo ""
-fi
-
-echo "Done."

package/scripts/corpus-apps.txt

@@ -1,9 +0,0 @@
-# Corpus sweep list — curated from dkhamsing/open-source-ios-apps across backend classes.
-# Class coverage: self-hostable-service client (login wall), public API (no key),
-# public API (keyed), no-backend/local-first, heavyweight real-world.
-https://github.com/Dimillian/IceCubesApp
-https://github.com/weiran/Hackers
-https://github.com/Ranchero-Software/NetNewsWire
-https://github.com/yattee/yattee
-https://github.com/wikimedia/wikipedia-ios
-https://github.com/mastodon/mastodon-ios

package/scripts/corpus-sweep.sh

@@ -1,121 +0,0 @@
-#!/usr/bin/env bash
-# Corpus sweep — run a list of real open-source iOS apps through the tapp pipeline and
-# produce a friction scoreboard. Failures ARE the data: every app gets a row recording
-# how far it got (clone → detect → build → install → explore) and why it stopped.
-#
-# Usage: scripts/corpus-sweep.sh <urls-file> [--actions N] [--out <dir>]
-#   urls-file: one git URL per line (# comments ok)
-#
-# Needs a booted simulator. Rows land in <out>/scoreboard.tsv; per-app logs in <out>/<app>/.
-set -uo pipefail
-ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-
-URLS_FILE="${1:?usage: corpus-sweep.sh <urls-file> [--actions N] [--out dir]}"; shift
-ACTIONS=25
-OUT="/tmp/tapp-corpus"
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --actions) ACTIONS="$2"; shift 2 ;;
-    --out) OUT="$2"; shift 2 ;;
-    *) echo "unknown arg $1" >&2; exit 2 ;;
-  esac
-done
-mkdir -p "$OUT"
-BOARD="$OUT/scoreboard.tsv"
-[[ -f "$BOARD" ]] || echo -e "app\tstage\tbackend_signals\tbundle\tscreens\tactions\tfindings\tverdict\tnote" > "$BOARD"
-
-UDID="$(xcrun simctl list devices booted -j | python3 -c 'import sys,json; d=json.load(sys.stdin); print(next((x["udid"] for v in d["devices"].values() for x in v if x.get("state")=="Booted"), ""))')"
-[[ -n "$UDID" ]] || { echo "❌ boot a simulator first" >&2; exit 1; }
-
-row() { echo -e "$1\t$2\t$3\t$4\t$5\t$6\t$7\t$8\t$9" >> "$BOARD"; }
-
-# Cheap backend-class signals from the repo tree (feeds the classifier's rules).
-backend_signals() {
-  local dir="$1" sig=()
-  [[ -n "$(find "$dir" -maxdepth 4 -name 'GoogleService-Info.plist' -print -quit 2>/dev/null)" ]] && sig+=("firebase-plist")
-  grep -rqli "firebase" "$dir"/Podfile "$dir"/*/Package.resolved "$dir"/Package.resolved 2>/dev/null && sig+=("firebase-dep")
-  grep -rqli "supabase" "$dir"/Podfile "$dir"/*/Package.resolved "$dir"/Package.resolved 2>/dev/null && sig+=("supabase-dep")
-  [[ -n "$(find "$dir" -maxdepth 2 -name 'docker-compose.y*ml' -print -quit 2>/dev/null)" ]] && sig+=("in-repo-backend")
-  grep -rqli "mastodon" "$dir"/Package.resolved 2>/dev/null && sig+=("mastodon-client")
-  grep -rql "YOUR_API_KEY\|INSERT_API_KEY\|<API_KEY>" --include="*.xcconfig" --include="*.plist" --include="*.swift" "$dir" 2>/dev/null | head -1 | grep -q . && sig+=("key-placeholder")
-  local IFS=","; echo "${sig[*]:-none}"
-}
-
-# fd 3 for the URL list — xcodebuild/git inside the loop consume stdin and would
-# silently swallow the remaining lines (this truncated the first sweep run).
-while IFS= read -r url <&3; do
-  [[ -z "$url" || "$url" == \#* ]] && continue
-  name="$(basename "$url" .git)"
-  dir="$OUT/$name"
-  log="$OUT/$name.log"
-  echo "━━━ $name"
-
-  # 1. clone
-  if [[ ! -d "$dir" ]]; then
-    git clone --depth 1 --recurse-submodules --shallow-submodules "$url" "$dir" >"$log" 2>&1 \
-      || { row "$name" clone none - - - - - "git clone failed"; continue; }
-  fi
-  signals="$(backend_signals "$dir")"
-
-  # 2. detect workspace/project + scheme (workspace wins; ignore Pods)
-  target="$(find "$dir" -maxdepth 3 -name '*.xcworkspace' -not -path '*/Pods/*' -not -path '*/.*' | head -1)"
-  flag="-workspace"
-  if [[ -z "$target" ]]; then
-    target="$(find "$dir" -maxdepth 3 -name '*.xcodeproj' -not -path '*/Pods/*' | head -1)"
-    flag="-project"
-  fi
-  [[ -n "$target" ]] || { row "$name" detect "$signals" - - - - - "no xcworkspace/xcodeproj found"; continue; }
-  schemes="$(xcodebuild -list -json $flag "$target" 2>>"$log" | python3 -c 'import sys,json
-try:
-  d=json.load(sys.stdin); o=d.get("workspace") or d.get("project") or {}
-  print("\n".join(o.get("schemes") or []))
-except Exception: pass')"
-  # Prefer an explicitly-iOS scheme (multi-platform repos like NetNewsWire name-match the
-  # macOS scheme first, which can't build for an iOS Simulator destination).
-  scheme="$(echo "$schemes" | grep -i "ios" | grep -iv "test\|widget\|extension\|notification\|clip" | head -1)"
-  [[ -z "$scheme" ]] && scheme="$(echo "$schemes" | grep -ix "$name" | head -1)"
-  [[ -z "$scheme" ]] && scheme="$(echo "$schemes" | grep -iv "test\|uitests\|widget\|extension\|notification\|clip\|watch\|mac" | head -1)"
-  [[ -z "$scheme" ]] && scheme="$(echo "$schemes" | head -1)"
-  [[ -n "$scheme" ]] || { row "$name" detect "$signals" - - - - - "no schemes listed"; continue; }
-  echo "  scheme: $scheme"
-
-  # 3. build for simulator (20 min cap; perl alarm — stock macOS has no `timeout`)
-  dd="$OUT/dd-$name"
-  if ! perl -e 'alarm shift; exec @ARGV' 1200 xcodebuild $flag "$target" -scheme "$scheme" \
-      -destination 'generic/platform=iOS Simulator' -derivedDataPath "$dd" \
-      CODE_SIGN_IDENTITY="" CODE_SIGNING_REQUIRED=NO CODE_SIGNING_ALLOWED=NO \
-      build >>"$log" 2>&1; then
-    reason="$(grep -m1 -E "error: |xcodebuild: error" "$log" | tail -c 120 || true)"
-    row "$name" build "$signals" - - - - - "build failed: ${reason:-see log}"
-    continue
-  fi
-  app="$(find "$dd/Build/Products" -maxdepth 2 -name '*.app' -path '*iphonesimulator*' | head -1)"
-  [[ -n "$app" ]] || { row "$name" build "$signals" - - - - - "built but no simulator .app (macOS-only scheme?)"; continue; }
-  bundle="$(/usr/libexec/PlistBuddy -c 'Print CFBundleIdentifier' "$app/Info.plist" 2>/dev/null || echo "?")"
-
-  # 4. install
-  xcrun simctl install "$UDID" "$app" >>"$log" 2>&1 \
-    || { row "$name" install "$signals" "$bundle" - - - - "simctl install failed"; continue; }
-
-  # 5. explore + report
-  "$ROOT/scripts/quick-capture.sh" explore "$bundle" --actions "$ACTIONS" --timeout 420 >>"$log" 2>&1
-  cap="$(ls -td "$ROOT"/captures/*/ 2>/dev/null | head -1)"
-  if [[ ! -f "$cap/ocqa-markers.txt" ]]; then
-    row "$name" explore "$signals" "$bundle" - - - - "exploration produced no markers"
-    continue
-  fi
-  json="$OUT/$name-report.json"
-  node "$ROOT/mcp-server/src/ci-report.js" --markers "$cap/ocqa-markers.txt" --json-out "$json" >>"$log" 2>&1 || true
-  read -r screens acted findings verdict <<< "$(python3 -c "
-import json,sys
-try:
-  r=json.load(open('$json'))
-  print(r.get('screensExplored','?'), r.get('actionsPerformed','?'), r.get('findingCounts',{}).get('total','?'), r.get('verdict','?'))
-except Exception: print('? ? ? ?')")"
-  row "$name" explored "$signals" "$bundle" "$screens" "$acted" "$findings" "$verdict" "capture: $(basename "$cap")"
-  echo "  ✅ $verdict — $screens screens"
-done 3< "$URLS_FILE"
-
-echo ""
-echo "═══ scoreboard: $BOARD ═══"
-column -t -s $'\t' "$BOARD"

package/scripts/coverage-eval.sh

@@ -1,92 +0,0 @@
-#!/usr/bin/env bash
-# AutoTap penetration / coverage eval — the "real-app scoreboard".
-#
-# Unlike validation-matrix.sh (which asserts *expected findings* against DemoApp, i.e. accuracy on a
-# known fixture), this measures how far AutoTap actually PENETRATES an arbitrary app: did it get past
-# launch, did it hit a login wall, how many distinct screens it reached, how much of its budget went
-# to productive exploration vs. stuck/recovery flailing, and what it found. There is no ground truth —
-# this is a diagnostic you point at real apps to see where they stall, so coverage work is measurable.
-#
-# Usage:
-#   scripts/coverage-eval.sh [bundleId ...]        # defaults to the local corpus apps
-#   scripts/coverage-eval.sh com.acme.app          # a real app (must be installed on the booted sim)
-#   ACTIONS=120 scripts/coverage-eval.sh com.acme.app
-#   VISION_ESCALATION=1 ANTHROPIC_API_KEY=... scripts/coverage-eval.sh com.acme.app
-#     # opt-in: when the a11y tree goes blank or exploration gets stuck, a sidecar
-#     # (vision_escalation_responder.py) answers the harness's OCQA_VISION_QUERY with a
-#     # model-chosen next move — same channel the desktop app serves.
-#
-# Prereqs: a booted simulator, the harness built (scripts/deploy-and-build.sh --harness), and each
-# app installed on the sim. Writes a JSON report to captures/coverage-eval-<timestamp>.json.
-#
-# NOTE: auth sessions stored in the keychain (Firebase et al) SURVIVE app reinstall — a "fresh"
-# run may silently resume the previous account. For a genuinely fresh login:
-#   xcrun simctl keychain <udid> reset
-set -uo pipefail
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-ACTIONS="${ACTIONS:-70}"
-TIMEOUT="${TIMEOUT:-600}"
-DEFAULT_APPS=(com.autotap.demoapp com.autotap.logindemo com.autotap.wizarddemo com.autotap.shopdemo com.autotap.restaurantdemo)
-APPS=("$@"); [ ${#APPS[@]} -eq 0 ] && APPS=("${DEFAULT_APPS[@]}")
-
-UDID="$(xcrun simctl list devices booted -j 2>/dev/null | python3 -c 'import sys,json; d=json.load(sys.stdin); print(next((x["udid"] for v in d["devices"].values() for x in v if x.get("state")=="Booted"), ""))')"
-[ -z "$UDID" ] && { echo "❌ No booted simulator. Boot one first."; exit 2; }
-
-XCTR="$(find "$HOME/Library/Developer/Xcode/DerivedData/OCQAHarness-"*/Build/Products -name '*.xctestrun' 2>/dev/null | head -1)"
-[ -z "$XCTR" ] && XCTR="$(find /tmp/autotap-harness-derived/Build/Products -name '*.xctestrun' 2>/dev/null | head -1)"
-[ -z "$XCTR" ] && XCTR="$(find /tmp/harness-build/Build/Products -name '*.xctestrun' 2>/dev/null | head -1)"
-[ -z "$XCTR" ] && { echo "❌ Harness not built. Run: scripts/deploy-and-build.sh --harness"; exit 2; }
-
-TS="$(date +%Y%m%d-%H%M%S)"
-REPORT="$ROOT/captures/coverage-eval-$TS.json"
-mkdir -p "$ROOT/captures"
-echo "AutoTap coverage eval — $ACTIONS actions/app, sim $UDID"
-echo "Apps: ${APPS[*]}"
-echo ""
-
-RESULTS_JSON="["
-FIRST=1
-for APP in "${APPS[@]}"; do
-  if ! xcrun simctl get_app_container "$UDID" "$APP" >/dev/null 2>&1; then
-    printf "  %-32s ⏭  not installed — skipping\n" "$APP"
-    continue
-  fi
-  CFG="/tmp/ocqa-coverage-$APP.json"
-  LOG="/tmp/ocqa-coverage-$APP.log"
-  RESPONDER_PID=""
-  # Real test credentials (OCQA_TEST_EMAIL / OCQA_TEST_PASSWORD env) let the heuristic login
-  # preamble get PAST a real auth wall — the single biggest coverage unlock on gated apps.
-  CREDS_LINE=""
-  [ -n "${OCQA_TEST_EMAIL:-}" ] && CREDS_LINE=",
-  \"OCQA_TEST_EMAIL\": \"$OCQA_TEST_EMAIL\", \"OCQA_TEST_PASSWORD\": \"${OCQA_TEST_PASSWORD:-}\""
-  if [ "${VISION_ESCALATION:-0}" = "1" ] && [ -n "${ANTHROPIC_API_KEY:-}" ]; then
-    VRESP="/tmp/ocqa-vision-response-eval-$APP.json"
-    VDIR="/tmp/ocqa-vision-eval-$APP"; mkdir -p "$VDIR"
-    cat > "$CFG" <<JSON
-{ "OCQA_BUNDLE_ID": "$APP", "OCQA_MAX_ACTIONS": "$ACTIONS", "OCQA_TIMEOUT_SECONDS": "$TIMEOUT",
-  "OCQA_VISION_ESCALATION": "1", "OCQA_VISION_RESPONSE_PATH": "$VRESP",
-  "OCQA_VISION_IMAGE_DIR": "$VDIR", "OCQA_VISION_BUDGET": "4", "OCQA_VISION_WAIT_TIMEOUT": "60"$CREDS_LINE }
-JSON
-    : > "$LOG"
-    python3 "$ROOT/scripts/vision_escalation_responder.py" "$LOG" "$VRESP" > "/tmp/ocqa-vision-responder-$APP.log" 2>&1 &
-    RESPONDER_PID=$!
-  else
-    cat > "$CFG" <<JSON
-{ "OCQA_BUNDLE_ID": "$APP", "OCQA_MAX_ACTIONS": "$ACTIONS", "OCQA_TIMEOUT_SECONDS": "$TIMEOUT"$CREDS_LINE }
-JSON
-  fi
-  TEST_RUNNER_OCQA_CONFIG_PATH="$CFG" xcodebuild test-without-building \
-    -xctestrun "$XCTR" -destination "platform=iOS Simulator,id=$UDID" \
-    -only-testing:"OCQAHarnessUITests/ExplorerTests/testAutonomousExploration" > "$LOG" 2>&1
-  if [ -n "$RESPONDER_PID" ]; then kill "$RESPONDER_PID" 2>/dev/null; wait "$RESPONDER_PID" 2>/dev/null; fi
-
-  ROW="$(python3 "$ROOT/scripts/coverage_eval_parse.py" "$LOG" "$APP")"
-  echo "$ROW" | python3 -c 'import sys,json; d=json.load(sys.stdin); ca=d.get("crash_action") or {}; print("  %-32s screens=%-3s launch=%-3s login_wall=%-3s stuck=%-4s findings=%s%s" % (d["app"], d["screens"], "ok" if d["launch_ok"] else "NO", "YES" if d["login_wall"] else "no", d["stuck_ratio"], d["findings_total"], ("  ⚠️ CRASHED on %s %s" % (ca.get("type",""), ca.get("screen","")) if d.get("crashed") else "")))'
-  [ $FIRST -eq 0 ] && RESULTS_JSON+=","
-  RESULTS_JSON+="$ROW"; FIRST=0
-done
-RESULTS_JSON+="]"
-echo "$RESULTS_JSON" | python3 -m json.tool > "$REPORT" 2>/dev/null || echo "$RESULTS_JSON" > "$REPORT"
-echo ""
-echo "Report: $REPORT"