@aarwitz/tapp 0.17.12 → 0.17.13

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "tapp",
   "description": "Give Claude hands and eyes on iOS, Android, and web apps, with exploration, replayable flows, evidence, and deterministic CI gates.",
-  "version": "0.17.12",
+  "version": "0.17.13",
   "author": {
     "name": "Aaron Horowitz",
     "url": "https://github.com/aarwitz"
@@ -24,7 +24,7 @@
       "command": "npx",
       "args": [
         "-y",
-        "@aarwitz/tapp@0.17.12",
+        "@aarwitz/tapp@0.17.13",
         "mcp"
       ],
       "cwd": "${CLAUDE_PROJECT_DIR}"

package/Harness/OCQAHarnessUITests/ExplorerTests.swift

@@ -1136,8 +1136,24 @@ class ExplorerTests: XCTestCase {
         // --- Login preamble: if credentials are provided and login fields are visible, log in first ---
         if !ranExplicitLogin, !testEmail.isEmpty, !testPassword.isEmpty {
             waitForUIStability(timeout: 2.0) // let app fully settle
-            let allTextFields = app.textFields.allElementsBoundByIndex.filter { $0.exists && $0.frame.width > 0 }
-            let allSecureFields = app.secureTextFields.allElementsBoundByIndex.filter { $0.exists && $0.frame.width > 0 }
+            var allTextFields = app.textFields.allElementsBoundByIndex.filter { $0.exists && $0.frame.width > 0 }
+            var allSecureFields = app.secureTextFields.allElementsBoundByIndex.filter { $0.exists && $0.frame.width > 0 }
+
+            if allSecureFields.count > 1 {
+                let existingAccountLabels = ["Back to login", "Back to Login", "Already have an account?", "Sign in instead", "Log in instead"]
+                for label in existingAccountLabels {
+                    let control = app.buttons[label].exists ? app.buttons[label] : app.staticTexts[label]
+                    if control.exists && control.isHittable {
+                        control.tap()
+                        print("OCQA_STATE:login_preamble_switched_from_signup")
+                        Thread.sleep(forTimeInterval: 0.8)
+                        waitForUIStability(timeout: 2.0)
+                        allTextFields = app.textFields.allElementsBoundByIndex.filter { $0.exists && $0.frame.width > 0 }
+                        allSecureFields = app.secureTextFields.allElementsBoundByIndex.filter { $0.exists && $0.frame.width > 0 }
+                        break
+                    }
+                }
+            }
             print("OCQA_STATE:login_preamble_fields textFields=\(allTextFields.count) secureFields=\(allSecureFields.count)")
 
             let emailField = allTextFields.first { f in

package/mcp-server/src/html-report.js

@@ -84,6 +84,9 @@ export function writeHtmlReport(captureDir, { report, label = "", recordingWarni
   ${esc(f.title)}${f.screen ? ` <span class="dim">— on ${esc(f.screen)}</span>` : ""}${f.url ? ` <span class="dim">— ${esc(f.url)}</span>` : ""}
   ${f.aiAnalysis ? `<div class="ai">why: ${esc(f.aiAnalysis)}</div>` : ""}
   ${f.suggestedFix ? `<div class="ai">fix: ${esc(f.suggestedFix)}</div>` : ""}
+  ${f.evidence && fs.existsSync(path.join(captureDir, f.evidence))
+      ? `<a class="evidence" href="${esc(f.evidence)}"><img loading="lazy" src="${esc(f.evidence)}" alt="The specific control named above, scrolled into view"></a>`
+      : ""}
 </li>`
         )
         .join("\n")
@@ -129,6 +132,8 @@ ${r.conditionsNotReached?.length ? `<div><h2>Conditions not reached</h2><ul>${sc
   table.trace th, table.trace td { text-align: left; padding: 0.25rem 0.7rem 0.25rem 0; border-bottom: 1px solid #eceef1; }
   table.trace th { color: #57606a; font-weight: 600; }
   .ai { color: #57606a; font-size: 0.88rem; margin: 0.15rem 0 0 0.2rem; }
+  a.evidence { display: block; margin: 0.4rem 0 0 0.2rem; max-width: 360px; }
+  a.evidence img { width: 100%; border: 1px solid #d0d7de; border-radius: 6px; }
   .dim { color: #57606a; }
   .grid { display: grid; grid-template-columns: repeat(auto-fill, minmax(200px, 1fr)); gap: 0.8rem; }
   figure { margin: 0; } figure img { width: 100%; border: 1px solid #d0d7de; border-radius: 6px; }

package/mcp-server/src/report.js

@@ -175,7 +175,10 @@ export function buildQaReport(markersFilePath, { platform = "ios", target = null
         // same screen are two findings, and fixing one while breaking another is a regression.
         const target = (typeof o.control === "string" && o.control) || (typeof o.target === "string" && o.target) || null;
         const url = typeof o.url === "string" && o.url.trim() ? o.url.trim() : null;
-        rawIssues.push({ type: o.type, severity: sev, title: o.title, screen: o.screen || null, target, url, step: o.step ?? null });
+        // Element-scoped screenshot proving the specific control the finding names is actually
+        // visible — set only for web findings that name one (anchor_missing, placeholder_link).
+        const evidence = typeof o.evidence === "string" && o.evidence.trim() ? o.evidence.trim() : null;
+        rawIssues.push({ type: o.type, severity: sev, title: o.title, screen: o.screen || null, target, url, step: o.step ?? null, evidence });
       } catch {
         /* ignore malformed */
       }

package/mcp-server/src/web-explorer.js

@@ -25,6 +25,13 @@ const NAV_TIMEOUT_MS = 15_000;
 const BUTTONS_PER_PAGE = 4;
 const OUTBOUND_LINK_LIMIT = 10;
 const WATCH_ACTION_DELAY_MS = 350;
+// A page's visible signature (waitForWebStability's basis) can go quiet before an async-injected
+// widget (a third-party tour scheduler, a chat launcher, ...) has actually finished mounting its
+// target element — nothing about that wait shows a spinner. One snapshot cannot tell "genuinely
+// dead" from "hasn't finished loading"; give a real anchor-missing candidate a second look before
+// treating it as a confirmed defect.
+const ANCHOR_RECHECK_MS = 4_000;
+const ANCHOR_RECHECK_INTERVAL_MS = 400;
 const ERROR_TEXT_RE = /\b(something went wrong|internal server error|an error occurred|failed to load|unhandled exception)\b/i;
 const STANDALONE_ERROR_TEXT_RE = /^(something went wrong|internal server error|an error occurred|failed to load|unhandled exception)(?:[.!:]|\s|$)/i;
 
@@ -82,6 +89,53 @@ export function webPageAppearsBlank({ textLen = 0, controlCount = 0, visualConte
   return Number(textLen) === 0 && Number(controlCount) === 0 && Number(visualContentCount) === 0;
 }
 
+function webAnchorIdMissing(rawId) {
+  try {
+    const esc = window.CSS && CSS.escape ? CSS.escape(rawId) : rawId;
+    return !document.getElementById(rawId) && !document.querySelector(`a[name="${esc}"]`);
+  } catch {
+    return !document.getElementById(rawId);
+  }
+}
+
+// A single DOM snapshot cannot distinguish "this anchor target will never exist" from "the
+// script that creates it hasn't run yet". Poll for up to timeoutMs before accepting the miss —
+// cheap when the target is genuinely absent (every poll agrees), and it only spends the extra
+// time on pages that actually have a candidate anchor_missing finding.
+export async function webAnchorStillMissing(page, anchor, { timeoutMs = ANCHOR_RECHECK_MS, intervalMs = ANCHOR_RECHECK_INTERVAL_MS } = {}) {
+  const id = decodeURIComponent(String(anchor || "").slice(1));
+  if (!id) return true;
+  const deadline = Date.now() + Math.max(0, Number(timeoutMs) || 0);
+  for (;;) {
+    const missing = await page.evaluate(webAnchorIdMissing, id).catch(() => true);
+    if (!missing) return false;
+    if (Date.now() >= deadline) return true;
+    await page.waitForTimeout(intervalMs);
+  }
+}
+
+// Evidence for a finding that names a specific control is worthless if the screenshot never
+// actually shows that control — a generic per-screen shot proves nothing about where the element
+// is on the page. Scroll it into view and shoot it directly; fall back to a viewport shot (still
+// scrolled to the element) if the element itself can't be screenshotted (zero-size, clipped).
+export async function captureElementEvidence(page, locator, outDir, name) {
+  try {
+    const target = locator.first();
+    if ((await target.count()) === 0) return null;
+    await target.scrollIntoViewIfNeeded({ timeout: 2_000 });
+    await page.waitForTimeout(120);
+    const evidencePath = path.join(outDir, name);
+    await target.screenshot({ path: evidencePath }).catch(() => page.screenshot({ path: evidencePath }));
+    return path.basename(evidencePath);
+  } catch {
+    return null;
+  }
+}
+
+function cssAttrEscape(value) {
+  return String(value).replace(/["\\]/g, (c) => "\\" + c);
+}
+
 async function installWebListenerTracking(context) {
   await context.addInitScript(() => {
     const key = Symbol.for("tapp.clickListeners");
@@ -612,13 +666,13 @@ export async function exploreWeb({ url, maxActions = 40, timeoutSec = 300, outDi
 
   const deadline = Date.now() + timeoutSec * 1000;
   const issues = []; // emitted immediately; kept for counting only
-  const issue = (type, severity, title, screen, target, sourceUrl) => {
+  const issue = (type, severity, title, screen, target, sourceUrl, evidence) => {
     issues.push(type);
     // Findings belong to the page that CARRIED the defect. Async detectors default to the
     // current page; the post-crawl outbound audit passes the link's source page explicitly so
     // a bad footer link is never attributed to whatever page happened to be visited last.
     const pageUrl = sourceUrl || page.url();
-    emit("ISSUE", { type, severity, title, screen, ...(target ? { target } : {}), ...(pageUrl && pageUrl !== "about:blank" ? { url: pageUrl } : {}) });
+    emit("ISSUE", { type, severity, title, screen, ...(target ? { target } : {}), ...(pageUrl && pageUrl !== "about:blank" ? { url: pageUrl } : {}), ...(evidence ? { evidence } : {}) });
   };
 
   // Async defect listeners: attribute to whatever screen is current when they fire.
@@ -805,14 +859,33 @@ export async function exploreWeb({ url, maxActions = 40, timeoutSec = 300, outDi
       for (const finding of webPlaceholderLinkFindings(info.placeholderLinks)) {
         if (placeholderLinksSeen.has(finding.target)) continue;
         placeholderLinksSeen.add(finding.target);
-        issue(finding.type, finding.severity, finding.title, screen, finding.target);
+        // Only a labeled link's evidence can be located with any confidence — an unlabeled
+        // link's `target` is a synthetic fingerprint, not text a locator can find on the page.
+        const evidence = finding.target.startsWith("unlabeled:")
+          ? null
+          : await captureElementEvidence(
+              page,
+              page.locator("a[href]").filter({ hasText: finding.target }),
+              outDir,
+              `evidence_${screenshotFor.size}_${slug(screen)}_${slug(finding.target)}.png`
+            );
+        issue(finding.type, finding.severity, finding.title, screen, finding.target, null, evidence);
       }
-      // Anchor links pointing at ids that do not exist are deterministic dead navigation.
+      // Anchor links pointing at ids that do not exist are deterministic dead navigation — but
+      // one snapshot can't tell "genuinely dead" from "the script that creates the target hasn't
+      // finished running yet" (an async-mounted widget shows no spinner while it loads).
       for (const anchor of info.missingAnchors || []) {
         const anchorTarget = `${key}${anchor}`;
         if (missingAnchorsSeen.has(anchorTarget)) continue;
         missingAnchorsSeen.add(anchorTarget);
-        issue("anchor_missing", "medium", `Anchor link "${anchor}" has no matching element on the page`, screen, anchorTarget);
+        if (!(await webAnchorStillMissing(page, anchor))) continue;
+        const evidence = await captureElementEvidence(
+          page,
+          page.locator(`a[href="${cssAttrEscape(anchor)}"]`),
+          outDir,
+          `evidence_${screenshotFor.size}_${slug(screen)}_${slug(anchor)}.png`
+        );
+        issue("anchor_missing", "medium", `Anchor link "${anchor}" has no matching element on the page`, screen, anchorTarget, null, evidence);
       }
     }
     return { key, screen, info };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aarwitz/tapp",
-  "version": "0.17.12",
+  "version": "0.17.13",
   "mcpName": "io.github.aarwitz/tapp",
   "description": "Let coding agents verify UI changes on real iOS, Android, and web surfaces, then enforce reviewed proof in deterministic CI.",
   "license": "MIT",