@arcadialdev/arcality 2.4.30 → 2.4.31

package/.agents/skills/security-qa/SKILL.md

@@ -0,0 +1,254 @@
+# SKILL: Security QA Analyst
+
+You are a Security QA Analyst. Your goal is to identify, validate, classify, and report security findings in the web application under test with precision and low ambiguity.
+
+Adopt a hacker mindset, but do not overstate risk. Distinguish clearly between:
+- confirmed vulnerabilities
+- security misconfigurations
+- potential issues
+- informational findings
+
+Your reports must help developers and security reviewers understand:
+1. what was detected,
+2. how certain the finding is,
+3. whether exploitation was confirmed,
+4. what evidence supports it,
+5. how to remediate it.
+
+## Core Objectives
+
+1. Identify security weaknesses in the application.
+2. Validate findings whenever possible before escalating severity.
+3. Classify each finding correctly.
+4. Report findings using a structured JSON attachment.
+5. Avoid false positives and avoid presenting unverified issues as confirmed vulnerabilities.
+
+---
+
+## Classification Rules
+
+Every finding MUST be classified as one of the following:
+
+### 1. confirmed_vulnerability
+Use this only when there is direct evidence of exploitable behavior or unauthorized access.
+
+Examples:
+- XSS payload executed
+- SQL injection altered behavior or response
+- IDOR allowed access to another user's resource
+- Auth bypass allowed access to a protected page
+- Open redirect successfully redirected to an external untrusted domain
+- CSRF was successfully executed or clearly lacks protection in a state-changing action
+
+### 2. security_misconfiguration
+Use this when a security control is missing, weak, or improperly configured, but exploitation was not directly demonstrated.
+
+Examples:
+- Missing Content-Security-Policy
+- Missing Strict-Transport-Security
+- Missing X-Frame-Options or missing frame-ancestors CSP directive
+- Cookies missing Secure, HttpOnly, or SameSite
+- Overly permissive CORS
+- Sensitive pages cached improperly
+
+### 3. potential_issue
+Use this when there is a suspicious condition, but the issue is not fully validated.
+
+Examples:
+- Input appears suspicious for XSS but payload execution not confirmed
+- Parameter suggests open redirect but redirect not confirmed
+- Sequential resource IDs suggest possible IDOR but unauthorized access not confirmed
+- Error messages may leak internal info but impact is limited or unclear
+
+### 4. informational
+Use this for low-impact observations that are useful but not actionable as vulnerabilities by themselves.
+
+Examples:
+- Server technology disclosure
+- Minor header omissions with low direct impact
+- Non-sensitive debug indicators
+
+---
+
+## Confidence Levels
+
+Each finding MUST include a confidence field:
+
+- high: direct evidence clearly supports the finding
+- medium: evidence is strong but not fully conclusive
+- low: weak signal or heuristic suspicion only
+
+Never assign high confidence to a finding with speculative evidence.
+
+---
+
+## Exploitability Status
+
+Each finding MUST include exploitability:
+
+- confirmed
+- likely
+- unknown
+- not_confirmed
+
+Examples:
+- Missing CSP => not_confirmed
+- XSS payload executed => confirmed
+- IDOR suspected from URL pattern only => unknown
+
+---
+
+## Severity Guidance
+
+Severity must reflect actual impact and proof, not just category.
+
+### High
+Use for:
+- confirmed unauthorized access
+- confirmed code/script execution
+- sensitive data exposure with real impact
+- auth bypass
+- exploitable SQLi
+- exploitable IDOR
+- confirmed stored/reflected/DOM XSS with meaningful execution
+
+### Medium
+Use for:
+- meaningful security misconfigurations
+- missing defense-in-depth controls
+- insecure cookie attributes
+- CSP missing
+- weak CSRF protections not fully exploited
+- permissive CORS with realistic risk
+
+### Low
+Use for:
+- low-impact disclosures
+- minor hardening gaps
+- findings with limited impact
+
+### Info
+Use for:
+- observations without direct security impact
+
+Do not automatically mark missing security headers as High.
+Missing CSP is usually security_misconfiguration and commonly Medium unless stronger contextual evidence justifies otherwise.
+
+---
+
+## Vulnerability Checklist
+
+As you navigate and test the application, actively assess the following areas.
+
+### Input Fields & Forms
+Check for:
+- reflected XSS
+- stored XSS
+- DOM XSS
+- SQL injection
+- weak input handling
+- insecure file upload behavior
+
+When a field looks suspicious for script injection, test carefully.
+Use available XSS testing tooling where applicable.
+
+### Navigation & URLs
+Check for:
+- open redirect
+- IDOR
+- auth bypass
+- parameter tampering
+- direct access to protected routes
+
+### Data Exposure
+Check for:
+- sensitive data in API responses
+- excessive data exposure
+- tokens or secrets in localStorage/sessionStorage
+- verbose errors
+- stack traces
+- internal paths or implementation details
+- source maps or debug artifacts in production when visible
+
+### Authentication & Session Management
+Check for:
+- CSRF protections on state-changing requests
+- weak password policy
+- session fixation
+- insecure session cookies
+- missing cookie flags
+- session not rotated after login
+- user enumeration signals
+
+### Security Headers & Browser Protections
+Check for:
+- Content-Security-Policy
+- Strict-Transport-Security
+- X-Frame-Options
+- X-Content-Type-Options
+- Referrer-Policy
+- Permissions-Policy
+- frame-ancestors via CSP where relevant
+
+Remember:
+Missing headers usually indicate misconfiguration, not automatically an exploitable vulnerability.
+
+---
+
+## Evidence Standards
+
+Every reported finding MUST include evidence appropriate to the type of finding.
+
+Evidence should include as many of these as possible:
+- url
+- method
+- selector
+- parameter
+- payload
+- request summary
+- response summary
+- observed behavior
+- storage key
+- cookie attributes
+- screenshot reference if available
+- reproduction steps
+
+If exploitation was not confirmed, explicitly state that in the finding.
+
+---
+
+## Required Attachment Format
+
+Whenever you identify a finding, you MUST attach it as JSON with the name `security_finding`.
+
+Use this exact shape:
+
+```javascript
+test.info().attach('security_finding', {
+  body: JSON.stringify({
+    type: 'security_misconfiguration',
+    category: 'Missing Security Header',
+    subcategory: 'Content-Security-Policy',
+    severity: 'Medium',
+    confidence: 'High',
+    exploitability: 'not_confirmed',
+    status: 'detected',
+    description: 'The response does not include a Content-Security-Policy header, reducing defense-in-depth against XSS and malicious script/resource injection.',
+    impact: 'If an injection issue exists elsewhere in the application, the lack of CSP may increase exploitability and impact.',
+    evidence: {
+      url: page.url(),
+      missingHeader: 'Content-Security-Policy'
+    },
+    reproductionSteps: [
+      'Navigate to the target page.',
+      'Inspect the response headers.',
+      'Verify that Content-Security-Policy is absent.'
+    ],
+    remediation: 'Implement a restrictive Content-Security-Policy and avoid unsafe-inline and unsafe-eval where possible.',
+    classification: {
+      owaspTop10: 'A05:2021 Security Misconfiguration',
+      cwe: 'CWE-16'
+    }
+  }),
+  contentType: 'application/json'
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arcadialdev/arcality",
-  "version": "2.4.30",
+  "version": "2.4.31",
   "description": "AI-powered QA testing tool — Autonomous web testing agent by Arcadial",
   "main": "index.js",
   "scripts": {
@@ -18,6 +18,7 @@
     "bin/",
     "scripts/",
     "src/",
+    ".agents/",
     "tests/_helpers/agentic-runner.bundle.spec.js",
     "tests/_helpers/ArcalityReporter.js",
     "playwright.config.js",

package/scripts/gen-and-run.mjs

@@ -586,7 +586,7 @@ async function main() {
 
             if (!discoverPath) {
                 const knownBaseUrl = projectConfig?.project?.baseUrl || process.env.BASE_URL;
-                const promptMsg = knownBaseUrl 
+                const promptMsg = knownBaseUrl
                     ? `🌐 Initial navigation path (relative to ${knownBaseUrl}):`
                     : '🌐 Full Navigation URL (e.g., http://localhost:3000/):';
 
@@ -623,7 +623,7 @@ async function main() {
             if (!validation.valid) {
                 const errorMessages = {
                     'no_api_key': '🔑 API Key not found.\n   Configure it via `arcality init` or in .env (ARCALITY_API_KEY)',
-                    'invalid_format': '🔑 Invalid API Key. It must start with "arc_k_"',
+                    'invalid_format': '🔑 Invalid API Key. It must start with "arc_"',
                     'invalid_api_key': '🔑 API Key not recognized by the server',
                     'plan_expired': '💳 Your plan has expired'
                 };

package/scripts/init.mjs

@@ -109,10 +109,10 @@ async function main() {
     // ── Step 1: API Key ──
     const apiKey = await text({
         message: chalk.cyan('🔑 Enter your Arcality API Key:'),
-        placeholder: 'arc_k_live_xxxxx',
+        placeholder: 'arc_live_xxxxx',
         validate: (v) => {
             if (!v || !v.trim()) return 'API Key is required.';
-            if (!v.startsWith('arc_k_')) return 'API Key must start with "arc_k_"';
+            if (!v.startsWith('arc_')) return 'API Key must start with "arc_"';
         },
     });
 

package/scripts/setup.mjs

@@ -71,8 +71,8 @@ async function main() {
 
     const newKey = await question('  👉 Ingresa Arcality API Key (Enter p. mantener): ');
     if (newKey) {
-        if (!newKey.startsWith('arc_k_')) {
-            console.log('  ❌ La API Key debe iniciar con "arc_k_"');
+        if (!newKey.startsWith('arc_')) {
+            console.log('  ❌ La API Key debe iniciar con "arc_"');
             process.exit(1);
         }
         config.api_key = newKey;

package/src/arcalityClient.mjs

@@ -119,7 +119,7 @@ export async function validateApiKey() {
         return { valid: false, error: 'no_api_key', mode: 'mock' };
     }
 
-    if (!key.startsWith('arc_k_')) {
+    if (!key.startsWith('arc_')) {
         return { valid: false, error: 'invalid_format', mode: 'mock' };
     }
 

package/tests/_helpers/agentic-runner.bundle.spec.js

@@ -939,7 +939,11 @@ ${relevantFailures.map((m) => `- ${m.prompt}`).join("\n")}
             const role = htmlEl.getAttribute("role") || "";
             const text = (htmlEl.innerText || htmlEl.getAttribute("aria-label") || htmlEl.getAttribute("title") || "").trim().replace(/\s+/g, " ");
             const textLower = text.toLowerCase();
-            const isCriticalFailure = (textLower.includes("error") || textLower.includes("fall\xF3") || textLower.includes("no se puede") || textLower.includes("ya existe") || textLower.includes("existe") || textLower.includes("inv\xE1lido") || textLower.includes("incorrecto") || textLower.includes("ligado") || textLower.includes("depende") || textLower.includes("duplicado") || textLower.includes("repetido")) && text.length < 200;
+            const isCriticalFailure = (textLower.includes("error") || textLower.includes("fall\xF3") || textLower.includes("no se puede") || textLower.includes("ya existe") || textLower.includes("existe") || textLower.includes("inv\xE1lido") || textLower.includes("incorrecto") || textLower.includes("ligado") || textLower.includes("depende") || textLower.includes("duplicado") || textLower.includes("repetido") || /* Validaciones ZOD / Wizard de campos de formulario */
+            textLower.includes("debe ser mayor") || textLower.includes("debe ser menor") || textLower.includes("debe ser igual") || textLower.includes("debe ser mayor o igual") || textLower.includes("debe ser menor o igual") || /* ZOD date messages (Spanish) */
+            textLower.includes("debe ser posterior") || textLower.includes("debe ser anterior") || textLower.includes("debe ser una fecha") || textLower.includes("fecha debe ser") || textLower.includes("posterior o igual a la fecha") || textLower.includes("anterior o igual a la fecha") || textLower.includes("posterior a la fecha") || textLower.includes("anterior a la fecha") || textLower.includes("fecha") && (textLower.includes("actual") || textLower.includes("pasada") || textLower.includes("futura") || textLower.includes("requerida") || textLower.includes("inv\xE1lida") || textLower.includes("incorrecta") || textLower.includes("posterior") || textLower.includes("anterior")) || /* ZOD number/range messages */
+            textLower.includes("debe ser un n\xFAmero") || textLower.includes("debe ser positivo") || textLower.includes("debe ser negativo") || textLower.includes("m\xEDnimo") && textLower.includes("caracteres") || textLower.includes("m\xE1ximo") && textLower.includes("caracteres") || textLower.includes("al menos") || textLower.includes("como m\xE1ximo") || /* Generic ZOD/form required */
+            textLower.includes("campo requerido") || textLower.includes("campo obligatorio") || textLower.includes("requerido") || textLower.includes("obligatorio") || textLower.includes("no puede estar vac\xEDo") || textLower.includes("no puede ser") || textLower.includes("no es v\xE1lido") || textLower.includes("no es correcto") || textLower.includes("recuerda llenar") || textLower.includes("completa los campos") || textLower.includes("campos obligatorios") || textLower.includes("formato incorrecto") || textLower.includes("formato inv\xE1lido") || textLower.includes("valor no permitido")) && text.length < 250;
             const isCriticalSuccess = (textLower.includes("exitosamente") || textLower.includes("guardado") || textLower.includes("creado") || textLower.includes("success") || textLower.includes("correctamente") && text.length < 100) && text.length < 200;
             const isCriticalFeedback = isCriticalFailure || isCriticalSuccess;
             if (!isCriticalFeedback && (tag === "span" || tag === "p" || tag === "label" || tag === "i" || tag === "svg" || tag === "img" || tag === "div")) {
@@ -1445,6 +1449,13 @@ These are NOT optional. You MUST use these tools in these situations:
 4. **PAGE TRANSITIONS**: If URL contains '/edit' or you see a 'Save' button, you ARE in the edit view. Don't go back.
 5. **MENUS & DROPDOWNS**: After clicking a toggle/menu, WAIT for the next turn. Never click the same menu icon twice in a row.
 6. **ERROR HANDLING**: If you see '\u{1F6D1} [ERROR_CR\xCDTICO]', STOP everything. Analyze the error, fix the data, then retry.
+6b. **DUPLICATE / REPEATED VALUE ERROR \u2014 MANDATORY PROTOCOL**:
+   - If HISTORY contains a line with "ERROR VISIBLE EN PANTALLA" or "ERROR POST-GUARDADO" with words like "repetido", "duplicado", "ya existe", or "already exists":
+     1. You MUST identify WHICH field caused the duplication (usually the main name/title field).
+     2. You MUST use \`fill\` to REPLACE that field's value with a NEW unique value. Add a numeric suffix like \`_${(/* @__PURE__ */ new Date()).getMinutes()}${(/* @__PURE__ */ new Date()).getSeconds()}\` or a short random number.
+     3. ONLY AFTER changing the value, attempt to save again.
+     4. **NEVER attempt to save with the same value that was already rejected.** This is FORBIDDEN.
+     5. If you cannot determine which field is the duplicate, use \`capture_console_errors\` to get hints from the application.
 7. **DATA UNIQUENESS**: When generating test data, ALWAYS include a unique suffix (timestamp, counter). Never use "Test123" or "Prueba" alone.
 8. **FINISH CORRECTLY**: Use \`finish: true\` ONLY when the mission objective is FULLY achieved. 
    - **BEWARE**: If you see a record in a table, confirm it is the one you JUST created (e.g., check timestamp or log message). Do NOT assume an existing record is your success.
@@ -1453,7 +1464,34 @@ These are NOT optional. You MUST use these tools in these situations:
 10. **STUCK DETECTION**: If history shows 3+ similar actions without progress, use \`report_inability_to_proceed\`.
 11. **NEGATIVE TESTING**: If mission expects an error (e.g., "verifica que no se pueda guardar sin campos"), and you see that error, the mission is SUCCESS. Use \`finish: true\`.
 12. **GUIDE CONFLICT**: If SUCCESS MEMORY disagrees with what you see on screen, ABANDON the memory and trust your eyes.
-13. **NATIVE CONTROLS**: For \`<input type="time">\`, \`<input type="date">\`, or similar native pickers, NEVER use \`fill\` repeatedly. Use \`interact_native_control\` or \`send_keyboard_event\` instead. If \`fill\` fails once, switch strategy immediately.`,
+13. **NATIVE CONTROLS**: For \`<input type="time">\`, \`<input type="date">\`, or similar native pickers, NEVER use \`fill\` repeatedly. Use \`interact_native_control\` or \`send_keyboard_event\` instead. If \`fill\` fails once, switch strategy immediately.
+
+# WIZARD & MULTI-STEP FORMS (CRITICAL)
+When a form is divided into numbered steps (e.g., Step 1 \u2192 Step 2 \u2192 Step 3):
+
+1. **VALIDATION ERROR ON SAVE = STEP HAS INVALID DATA**: If you see a \u{1F6D1} [ERROR_CR\xCDTICO] after clicking Save/Next and you are on step N, it means a PREVIOUS step contains bad data. You MUST navigate BACK to that step.
+   - Look for a "Back" / "Anterior" / "Periodo" / step-number button and click it to return.
+   - NEVER retry the Save button without first fixing the invalid data in the previous step.
+
+2. **DATE VALIDATION ERRORS \u2014 MANDATORY PROTOCOL (ZOD-AWARE)**:
+   - ZOD generates Spanish validation messages such as:
+     - "La fecha de inicio debe ser posterior o igual a la fecha actual."
+     - "La fecha debe ser una fecha futura."
+     - "Debe ser posterior a la fecha de inicio."
+     - "El valor debe ser mayor o igual a X."
+   - ANY \u{1F6D1} [ERROR_CR\xCDTICO] containing FECHA + (POSTERIOR/ANTERIOR/ACTUAL/PASADA/FUTURA) is a **ZOD DATE VALIDATION ERROR**.
+   - **RECOVERY PROTOCOL** (follow in order, NEVER skip):
+     1. STOP \u2014 do NOT click Save/Siguiente again with the same data.
+     2. Identify which wizard step contains the failing date field (check HISTORY \u2014 usually Step 1 or Step 2).
+     3. Click the Back/Anterior/step-number button to return to that step.
+     4. Locate the date input using \`validate_element_state\` with 'has_value' to confirm its current (bad) value.
+     5. Clear and re-fill the date using \`interact_native_control\` with control_type \`'date'\` and a value \u2265 TODAY in YYYY-MM-DD format.
+     6. TODAY: \`${(/* @__PURE__ */ new Date()).toISOString().split("T")[0]}\` \u2014 use this exact expression to compute the date dynamically.
+     7. After fixing ALL date fields, advance through each wizard step again.
+
+3. **NEVER LOOP ON THE SAME STEP**: If you've been on the same wizard step for 3+ turns without advancing, go back one step and verify the data is correct before trying to advance again.
+
+4. **STEP VERIFICATION**: Before clicking Next/Save on any step, VERIFY that date fields have future-or-today dates. Use \`validate_element_state\` with 'has_value' to confirm.`,
         cache_control: { type: "ephemeral" }
       }
     ];
@@ -1536,7 +1574,7 @@ ${history.slice(-25).join("\n") || "None"}`
             headers,
             signal: controller.signal,
             body: JSON.stringify({
-              model: process.env.CLAUDE_MODEL || "claude-3-5-sonnet-20241022",
+              model: process.env.CLAUDE_MODEL || "claude-4-5-sonnet-latest",
               max_tokens: 4096,
               system: systemPromptBlocks,
               tools: rawTools.map((t) => ({
@@ -1581,7 +1619,7 @@ ${history.slice(-25).join("\n") || "None"}`
       const textResponse = message.content.find((c) => c.type === "text")?.text || "";
       if (toolCalls.length === 0) {
         console.log(`(${((Date.now() - startTime) / 1e3).toFixed(1)}s)`);
-        return { thought: textResponse || "No action decided", actions: [] };
+        return { thought: textResponse || "No action decided", actions: [], usage: data.usage };
       }
       const toolResults = [];
       let uiActionCall = null;
@@ -1640,7 +1678,8 @@ ${history.slice(-25).join("\n") || "None"}`
 
 \u{1F4A1} SUGERENCIA: ${toolInput.prompt_suggestion}`,
             actions: [],
-            finish: true
+            finish: true,
+            usage: data.usage
           };
         } else if (toolName === "validate_element_state") {
           const { idx, validations } = toolInput;
@@ -2147,7 +2186,8 @@ ${report}` });
             }
             return { ...a, value: finalValue, selector: c?.selector, frameIdx: c?.frameIdx, description: c?.name, type: c?.type };
           }),
-          finish: input.finish
+          finish: input.finish,
+          usage: data.usage
         };
       }
     }
@@ -2178,7 +2218,7 @@ ${report}` });
         method: "POST",
         headers,
         body: JSON.stringify({
-          model: process.env.CLAUDE_MODEL || "claude-3-5-sonnet-20241022",
+          model: process.env.CLAUDE_MODEL || "claude-4-5-sonnet-latest",
           max_tokens: 300,
           system: "Eres un Senior QA personalizador de reportes. Tu tarea es resumir en una sola frase corta, profesional y amigable por qu\xE9 una misi\xF3n de testing fue exitosa bas\xE1ndote en el historial de pasos. Usa un tono de victoria. No menciones detalles t\xE9cnicos como 'selectores' o 'DOM'. El resumen debe empezar con algo como '\xA1Misi\xF3n cumplida! ...'",
           messages: [
@@ -2226,7 +2266,7 @@ ${history.join("\n")}` }
         method: "POST",
         headers,
         body: JSON.stringify({
-          model: process.env.CLAUDE_MODEL || "claude-3-5-sonnet-20241022",
+          model: process.env.CLAUDE_MODEL || "claude-4-5-sonnet-latest",
           max_tokens: 1e3,
           system: `You are an elite QA Engineer. Your task is to transform a raw execution history into a clean, human-friendly English YAML Mission Card.
                     
@@ -2409,6 +2449,7 @@ function captureValidationRule(errorMessage, context) {
   let stepsDataBackup = [];
   const maxSteps = 30;
   let lastSeenSuccessToast = "";
+  let accumulatedCost = 0;
   const saveMissionResults = () => {
     if (resultsSaved)
       return;
@@ -2612,6 +2653,22 @@ function captureValidationRule(errorMessage, context) {
         stepsDataBackup = [...stepsData];
         stepsData.length = 0;
       }
+      try {
+        const errorEls = await page.locator('.toast, .alert, [role="alert"], [role="status"], .snackbar, .notification, .error-message, .mat-snack-bar-container').all();
+        for (const el of errorEls) {
+          if (await el.isVisible().catch(() => false)) {
+            const errTxt = await el.innerText().catch(() => "");
+            if (errTxt && failureKeywords.test(errTxt.toLowerCase())) {
+              const isDuplicateError = /repetido|duplicado|ya existe|already exists/i.test(errTxt);
+              const correctionHint = isDuplicateError ? `\u{1F6D1} ACCI\xD3N REQUERIDA: El valor que ingresaste ya existe en el sistema. DEBES regresar al campo que caus\xF3 el error y cambiar su valor por uno \xDANICO (agrega un sufijo como _${Date.now().toString().slice(-4)} o un n\xFAmero aleatorio). NO intentes guardar sin cambiar el valor primero.` : `\u{1F6D1} ACCI\xD3N REQUERIDA: El sistema mostr\xF3 un error de validaci\xF3n. Analiza el error y corrige el dato antes de reintentar.`;
+              history.push(`Turno ${stepCount}: \u{1F6D1} ERROR VISIBLE EN PANTALLA: "${errTxt.trim().substring(0, 200)}". ${correctionHint}`);
+              console.log(`>>ARCALITY_STATUS>> \u{1F6D1} Error inyectado en historial: "${errTxt.substring(0, 80)}"`);
+              break;
+            }
+          }
+        }
+      } catch {
+      }
     }
     if (response) {
       const guideActionDesc = response.actions?.[0] ? `${response.actions[0].action} en "${response.actions[0].description || ""}"`.toLowerCase() : "";
@@ -2629,6 +2686,21 @@ function captureValidationRule(errorMessage, context) {
       stepCount++;
       console.log(`>>ARCALITY_STATUS>> \u23F3 Turno IA ${stepCount} de ${maxSteps} (Gu\xEDa us\xF3 ${guideStepCount} turnos gratis)...`);
       response = await agent.askIA(prompt, history, stepCount);
+      if (response.usage) {
+        const inputs = response.usage.input_tokens || 0;
+        const outputs = response.usage.output_tokens || 0;
+        const cost = inputs / 1e6 * 3 + outputs / 1e6 * 15;
+        accumulatedCost += cost;
+        if (accumulatedCost >= 6) {
+          console.warn(`
+\u{1F6D1} [AUTO-STOP] Capacidad m\xE1xima de exploraci\xF3n t\xE9cnica alcanzada para esta prueba.`);
+          response.thought = `LIMIT REACHED: He llegado a la capacidad m\xE1xima de ciclos y turnos permitidos para analizar esta tarea (L\xEDmite de la prueba). Detendr\xE9 esta misi\xF3n para evitar sobrecarga del sistema.`;
+          response.finish = true;
+          response.actions = [];
+          aiMarkedSuccess = false;
+          hasCriticalError = true;
+        }
+      }
     }
     console.log(`\u{1F9E0} Pensamiento: ${response.thought}`);
     if (!response.finish && history.length >= 6) {
@@ -2771,6 +2843,9 @@ function captureValidationRule(errorMessage, context) {
                   } else if (failureKeywords.test(fbText.toLowerCase())) {
                     console.log(`>>ARCALITY_STATUS>> \u{1F4DA} [BUSINESS RULE] Error de validaci\xF3n capturado: "${fbText.substring(0, 80)}"`);
                     captureValidationRule(fbText.trim(), `Acci\xF3n: click en "${desc}" en ${page.url()}`);
+                    const isDuplicateError = /repetido|duplicado|ya existe|already exists/i.test(fbText);
+                    const correctionHint = isDuplicateError ? `CORRECCI\xD3N OBLIGATORIA: El valor que ingresaste ya existe. Ve al campo que lo caus\xF3 y c\xE1mbialo por uno \xFAnico (a\xF1ade _${Date.now().toString().slice(-4)} como sufijo).` : `CORRECCI\xD3N OBLIGATORIA: Corrige el campo se\xF1alado antes de intentar guardar de nuevo.`;
+                    history.push(`Turno ${stepCount}: \u{1F6D1} ERROR POST-GUARDADO: "${fbText.trim().substring(0, 200)}". ${correctionHint}`);
                   }
                 }
               }

package/scripts/cleanup-qmsdev.mjs

@@ -1,63 +0,0 @@
-import fs from 'fs';
-import path from 'path';
-
-const baseDir = 'c:/Users/apulido/OneDrive - Block Networks/Documentos/Arcadial Projects/Char.Dev/out/qmsDev';
-const nestedDir = path.join(baseDir, 'context', 'qmsDev');
-const targetContextDir = path.join(baseDir, 'context');
-const targetMissionsDir = path.join(baseDir, 'missions');
-
-function cleanup() {
-    if (!fs.existsSync(nestedDir)) {
-        console.log('Nested directory not found, skipping.');
-        return;
-    }
-
-    const files = fs.readdirSync(nestedDir);
-
-    files.forEach(file => {
-        const filePath = path.join(nestedDir, file);
-        if (file.startsWith('agent-log-')) {
-            console.log(`Moving ${file} to context/`);
-            fs.renameSync(filePath, path.join(targetContextDir, file));
-        } else if (file === 'memoria-agente.json') {
-            const targetMemory = path.join(targetContextDir, 'memoria-agente.json');
-            if (fs.existsSync(targetMemory)) {
-                console.log('Merging memoria-agente.json...');
-                const mainMemory = JSON.parse(fs.readFileSync(targetMemory, 'utf8'));
-                const nestedMemory = JSON.parse(fs.readFileSync(filePath, 'utf8'));
-                const combined = [...mainMemory, ...nestedMemory];
-                fs.writeFileSync(targetMemory, JSON.stringify(combined, null, 2));
-                fs.unlinkSync(filePath);
-            } else {
-                console.log('Moving memoria-agente.json...');
-                fs.renameSync(filePath, targetMemory);
-            }
-        } else if (file === 'saved_missions') {
-            const missions = fs.readdirSync(filePath);
-            missions.forEach(m => {
-                if (m.endsWith('.yaml') || m.endsWith('.yml')) {
-                    console.log(`Moving mission ${m} to missions/`);
-                    fs.renameSync(path.join(filePath, m), path.join(targetMissionsDir, m));
-                }
-            });
-            fs.rmdirSync(filePath, { recursive: true });
-        } else if (fs.statSync(filePath).isFile()) {
-            console.log(`Moving other file ${file} to context/`);
-            fs.renameSync(filePath, path.join(targetContextDir, file));
-        }
-    });
-
-    // Try to remove the empty nested dir
-    try {
-        if (fs.readdirSync(nestedDir).length === 0) {
-            fs.rmdirSync(nestedDir);
-            console.log('Removed empty nested directory.');
-        } else {
-            console.warn('Nested directory not empty, keeping it.');
-        }
-    } catch (e) {
-        console.error('Error removing nested dir:', e.message);
-    }
-}
-
-cleanup();

package/scripts/discover-view.mjs

@@ -1,52 +0,0 @@
-#!/usr/bin/env node
-import 'dotenv/config';
-import fs from 'node:fs';
-import { spawn } from 'node:child_process';
-import path from 'node:path';
-
-const targetPath = process.argv[2] || '/';
-const isWin = process.platform === 'win32';
-const cmd = isWin ? 'npx.cmd' : 'npx';
-const testFile = 'tests/_helpers/discover-view.spec.ts';
-
-function parseDotEnvFile(p) {
-  try {
-    const raw = fs.readFileSync(p, 'utf8');
-    const lines = raw.split(/\r?\n/);
-    const out = {};
-    for (const line of lines) {
-      const trimmed = line.trim();
-      if (!trimmed || trimmed.startsWith('#')) continue;
-      const idx = trimmed.indexOf('=');
-      if (idx === -1) continue;
-      let k = trimmed.slice(0, idx).trim();
-      let v = trimmed.slice(idx + 1).trim();
-      if ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'"))) v = v.slice(1, -1);
-      out[k] = v;
-    }
-    return out;
-  } catch {
-    return {};
-  }
-}
-
-const fileEnv = parseDotEnvFile(path.join(process.cwd(), '.env'));
-const env = { ...process.env, ...fileEnv, TARGET_PATH: targetPath };
-
-const args = ['playwright', 'test', testFile, '--project=chromium'];
-// Debug printing removed to avoid leaking placeholders; command is spawned directly
-
-const child = spawn(cmd, args, {
-  stdio: 'inherit',
-  shell: isWin,
-  env,
-});
-
-child.on('exit', (code) => {
-  process.exit(code ?? 0);
-});
-
-child.on('error', (err) => {
-  console.error('Failed to run playwright:', err);
-  process.exit(1);
-});