@arcadialdev/arcality 2.5.0 → 2.6.1

package/README.md

@@ -29,16 +29,23 @@
 npm install @arcadialdev/arcality
 ```
 
-> After install, Arcality automatically adds the following scripts to your `package.json`:
-> ```json
-> "dev": "node scripts/gen-and-run.mjs",
-> "postinstall": "node scripts/postinstall.mjs",
-> "setup": "node scripts/setup.mjs",
-> "build:runner": "npx esbuild tests/_helpers/agentic-runner.spec.ts --bundle --platform=node --target=node18 --format=cjs --external:@playwright/test --external:chalk --external:dotenv --external:node-fetch --external:js-yaml --external:axios --external:crypto --external:fs --external:path --outfile=tests/_helpers/agentic-runner.bundle.spec.js",
-> "prepublishOnly": "npm run build:runner"
-> ```
->
-> **Current version:** `2.5.0`
+
+### 2. Initialize your project
+Run the setup wizard to connect your project and generate the configuration.
+
+```bash
+npx arcality init
+```
+
+### 3. Run your first mission
+```bash
+# Open interactive menu
+npx arcality
+
+# Or run directly (Ghost Mode)
+npx arcality run
+```
+
 
 ### 📦 Updating Arcality
 Run the following to get the latest version:
@@ -47,12 +54,8 @@ npm update @arcadialdev/arcality
 ```
 
 ### ⚙️ Configuration (`arcality.config.json`)
-After initializing with `npm run arcality:init`, a config file is created in the project root. Edit it to set your project name, base URL, and authentication details. The CLI reads this file on every run, ensuring consistent environment variables.
+After initializing with `npx arcality init`, a config file is created in the project root. Edit it to set your project name, base URL, and authentication details. The CLI reads this file on every run, ensuring consistent environment variables.
 
-### 🚀 Getting Started (revised)
-1. **Install** – `npm install @arcadialdev/arcality`
-2. **Initialize** – `npm run arcality:init`
-3. **Run a mission** – `npm run dev` (interactive menu) or `npm run dev -- --run "Your prompt"` for direct execution.
 
 ---
 
@@ -62,8 +65,11 @@ The Arcality flow is designed to be used globally or project-wide via `npx`. Bel
 
 | Command | Description | Internal Behavior |
 | :--- | :--- | :--- |
-| \`npx arcality run\` | **Mission Runner (Agent Mode)**<br/>Launches the QA Agent directly. | Skips the interactive menu, scans the _package.json_ ("Ghost Mode"), injects ephemeral _autoskills_, and unleashes the AI agent. Ideal for CI/CD. |
-| \`npx arcality --logs\` | **History Viewer**<br/>Displays test performance and tokens spent. | Reads the local \`arcality-history.log\` and renders a colorful table listing each mission, token consumption, and success status. |
+| `npx arcality` | **Interactive Menu**<br/>Launches a visual menu in the terminal to guide the user. | Prompts for the Mission to execute. Ideal for new users who want a guided experience. |
+| `npx arcality init` | **Initial Configuration**<br/>Connects the current project to Arcadial. | Prompts for your API Key and Project ID, generates `arcality.config.json`, and validates the portal connection. |
+| `npx arcality run` | **Mission Runner (Agent Mode)**<br/>Launches the QA Agent directly. | Skips the interactive menu, scans the _package.json_ ("Ghost Mode"), and unleashes the AI agent. Ideal for CI/CD. |
+| `npx arcality --logs` | **History Viewer**<br/>Displays test performance and tokens spent. | Reads the local `arcality-history.log` and renders a colorful table listing each mission and success status. |
+
 
 ---
 
@@ -81,7 +87,7 @@ Arcality operates on a highly decoupled modular system designed for maximum resi
 
 ## 📁 Configuration (`arcality.config.json`)
 
-When you run `arcality init`, a configuration is generated in your project root. 
+When you run `npx arcality init`, a configuration is generated in your project root. 
 ```json
 {
   "project": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arcadialdev/arcality",
-  "version": "2.5.0",
+  "version": "2.6.1",
   "description": "El primer ingeniero QA Autónomo integrado al CI/CD. Creado por Arcadial.",
   "main": "index.js",
   "scripts": {

package/scripts/gen-and-run.mjs

@@ -770,12 +770,8 @@ async function main() {
                     }
                 } catch { /* silencioso */ }
 
-                // 2. Llamar endMission con estado 'canceled'
-                try {
-                    const { endMission: endM } = await import('../src/arcalityClient.mjs');
-                    await endM(mission.mission_id, 'canceled', null, 'user_canceled');
-                    console.log(chalk.gray('   >> Misión registrada como "cancelada" en el servidor.'));
-                } catch { /* silencioso si el backend no está disponible */ }
+                // 2. Registraremos la misión como 'canceled' en el bloque finally
+                console.log(chalk.gray('   >> Registrando misión como "cancelada"...'));
 
                 // 3. Matar el proceso hijo de Playwright — hacerlo AL FINAL para dar tiempo
                 //    a que el agente-log y endMission terminen antes del kill.
@@ -852,6 +848,11 @@ async function main() {
                 process.exit(1);
             }
 
+            let missionResult = null;
+            let finalFailReason = null;
+            let finalUsageData = undefined;
+            let finalReportUrl = null;
+
             try {
                 // No test file path is passed — playwright.config.js uses testMatch:'agentic-runner.spec.ts'
                 // This eliminates the Windows regex path issue permanently on any user's machine.
@@ -872,46 +873,15 @@ async function main() {
                 process.off('SIGINT', cancelHandler);
                 process.off('SIGTERM', cancelHandler);
 
-                if (userCanceledMission) return; // El handler ya tomó el control
-                if (!process.argv.includes('--debug')) s.stop(chalk.green('✅ Mission completed successfully.'));
-                else console.log(chalk.green('✅ Mission completed successfully.'));
-
-                let finalUsage = undefined;
-                try {
-                    const ctxDir = process.env.CONTEXT_DIR;
-                    if (fs.existsSync(ctxDir)) {
-                        const files = fs.readdirSync(ctxDir);
-                        const logFiles = files.filter(f => f.startsWith('agent-log-') && f.endsWith('.json')).sort();
-                        if (logFiles.length > 0) {
-                            const lastLog = path.join(ctxDir, logFiles[logFiles.length - 1]);
-                            const logData = JSON.parse(fs.readFileSync(lastLog, 'utf8'));
-                            finalUsage = logData.usage;
-                        }
-                    }
-                } catch(e) {}
-
-                // ── Upload Evidence ──
-                const { endMission, getEvidenceSasToken } = await import('../src/arcalityClient.mjs');
-                const { uploadEvidence } = await import('../src/EvidenceUploader.mjs');
-
-                try {
-                    const sasData = await getEvidenceSasToken(mission.mission_id, finalProjectId);
-                    if (sasData && sasData.sasUrl) {
-                        if (!process.argv.includes('--debug')) s.start('☁️  Uploading evidence to Azure...');
-                        const reportsDir = process.env.REPORTS_DIR || path.join(ORIGINAL_CWD, 'tests-report');
-                        
-                        await run("node", [path.join(PROJECT_ROOT, "scripts/rebrand-report.mjs")]).catch(() => { });
-                        
-                        await uploadEvidence(reportsDir, sasData.sasUrl, sasData.basePath);
-                        if (!process.argv.includes('--debug')) s.stop(chalk.green('✅ Evidence uploaded successfully.'));
-                    }
-                } catch (e) {
-                    if (process.argv.includes('--debug')) console.log(chalk.yellow(`⚠️  Could not upload evidence: ${e.message}`));
-                    if (!process.argv.includes('--debug')) s.stop(chalk.yellow('⚠️  Evidence upload failed.'));
+                if (userCanceledMission) {
+                    missionResult = 'canceled';
+                    finalFailReason = 'user_canceled';
+                    return; // El handler ya tomó el control, finally se ejecutará y luego saldrá del CLI
                 }
 
-                // ── End Mission ──
-                await endMission(mission.mission_id, 'success', finalUsage);
+                missionResult = 'success';
+                if (!process.argv.includes('--debug')) s.stop(chalk.green('✅ Mission completed successfully.'));
+                else console.log(chalk.green('✅ Mission completed successfully.'));
 
                 // ── Ping Project ──
                 await pingProject(finalProjectId, process.env.ARCALITY_API_KEY);
@@ -967,58 +937,24 @@ async function main() {
                 process.off('SIGTERM', cancelHandler);
 
                 if (userCanceledMission) {
+                    missionResult = 'canceled';
+                    finalFailReason = 'user_canceled';
                     // El cancelHandler ya registró la cancelación en el servidor.
                     // Solo mostramos un mensaje y dejamos que el finally genere el reporte.
                     console.log(chalk.yellow('\n⚠️  Misión cancelada — generando reporte de evidencia...'));
                 } else {
+                    missionResult = 'failed';
+                    finalFailReason = 'timeout_or_crash';
                     s.stop(chalk.red(`❌ Mission could not be completed.`));
                     console.error(chalk.red(`\nError Details: ${e.message}`));
                     if (e.stack && process.argv.includes('--debug')) {
                         console.error(chalk.gray(e.stack));
                     }
-
-                    // Si NO fue cancelación de usuario, cerrar la misión como fallida en el servidor
-                    try {
-                        let finalUsage = undefined;
-                        let failReason = "timeout_or_crash";
-                        try {
-                            const ctxDir = process.env.CONTEXT_DIR;
-                            if (fs.existsSync(ctxDir)) {
-                                const files = fs.readdirSync(ctxDir);
-                                const logFiles = files.filter(f => f.startsWith('agent-log-') && f.endsWith('.json')).sort();
-                                if (logFiles.length > 0) {
-                                    const lastLog = path.join(ctxDir, logFiles[logFiles.length - 1]);
-                                    const logData = JSON.parse(fs.readFileSync(lastLog, 'utf8'));
-                                    finalUsage = logData.usage;
-                                    failReason = logData.fail_reason || failReason;
-                                }
-                            }
-                        } catch(e) {}
-
-                        // ── Upload Evidence ──
-                        const { endMission, getEvidenceSasToken } = await import('../src/arcalityClient.mjs');
-                        const { uploadEvidence } = await import('../src/EvidenceUploader.mjs');
-
-                        try {
-                            const sasData = await getEvidenceSasToken(mission.mission_id, finalProjectId);
-                            if (sasData && sasData.sasUrl) {
-                                if (!process.argv.includes('--debug')) s.start('☁️  Uploading evidence to Azure...');
-                                const reportsDir = process.env.REPORTS_DIR || path.join(ORIGINAL_CWD, 'tests-report');
-
-                                await run("node", [path.join(PROJECT_ROOT, "scripts/rebrand-report.mjs")]).catch(() => { });
-
-                                await uploadEvidence(reportsDir, sasData.sasUrl, sasData.basePath);
-                                if (!process.argv.includes('--debug')) s.stop(chalk.green('✅ Evidence uploaded successfully.'));
-                            }
-                        } catch (e) {}
-
-                        await endMission(mission.mission_id, 'failed', finalUsage, failReason);
-                    } catch { }
                 }
             } finally {
-                // Si fue cancelación de usuario, dar un breve margen para que el cancelHandler
-                // async (endMission, escritura de log) termine antes de generar el reporte.
                 if (userCanceledMission) {
+                    missionResult = 'canceled';
+                    finalFailReason = 'user_canceled';
                     await new Promise(r => setTimeout(r, 800));
                 }
 
@@ -1029,6 +965,58 @@ async function main() {
                 const reportDir = process.env.REPORTS_DIR || 'tests-report';
                 const arcalityPath = path.resolve(reportDir, 'index.html');
 
+                sRep.stop();
+
+                // Read final usage and failReason from agent-log
+                try {
+                    const ctxDir = process.env.CONTEXT_DIR;
+                    if (fs.existsSync(ctxDir)) {
+                        const files = fs.readdirSync(ctxDir);
+                        const logFiles = files.filter(f => f.startsWith('agent-log-') && f.endsWith('.json')).sort();
+                        if (logFiles.length > 0) {
+                            const lastLog = path.join(ctxDir, logFiles[logFiles.length - 1]);
+                            const logData = JSON.parse(fs.readFileSync(lastLog, 'utf8'));
+                            finalUsageData = logData.usage || finalUsageData;
+                            if (missionResult === 'failed' && !finalFailReason) {
+                                finalFailReason = logData.fail_reason || "timeout_or_crash";
+                            }
+                        }
+                    }
+                } catch(e) {}
+
+                // ── Upload Evidence ──
+                try {
+                    const { endMission, getEvidenceSasToken } = await import('../src/arcalityClient.mjs');
+                    const { uploadEvidence } = await import('../src/EvidenceUploader.mjs');
+
+                    const sasData = await getEvidenceSasToken(mission.mission_id, finalProjectId);
+                    if (process.argv.includes('--debug')) console.log(`[DEBUG] sasData received:`, sasData);
+                    
+                    // Soporte para camelCase y snake_case debido al serializador JSON del backend
+                    const actualSasUrl = sasData?.sasTokenUrl || sasData?.sasUrl || sasData?.sas_url;
+                    const actualBasePath = sasData?.basePath || sasData?.base_path;
+
+                    if (sasData && actualSasUrl && actualBasePath) {
+                        if (!process.argv.includes('--debug')) sRep.start('☁️  Uploading evidence to Azure...');
+                        
+                        await uploadEvidence(reportDir, actualSasUrl, actualBasePath);
+                        
+                        // Construct the public URL
+                        try {
+                            const parsedSas = new URL(actualSasUrl);
+                            finalReportUrl = `${parsedSas.origin}${parsedSas.pathname}/${actualBasePath}/index.html`;
+                        } catch(e) {}
+                        
+                        if (!process.argv.includes('--debug')) sRep.stop(chalk.green('✅ Evidence uploaded successfully.'));
+                    }
+
+                    // ── End Mission ──
+                    await endMission(mission.mission_id, missionResult || 'failed', finalUsageData, finalFailReason, finalReportUrl);
+                } catch (e) {
+                    if (process.argv.includes('--debug')) console.log(chalk.yellow(`⚠️  Could not upload evidence or end mission: ${e.message}`));
+                    if (!process.argv.includes('--debug')) sRep.stop(chalk.yellow('⚠️  Evidence upload or end mission failed.'));
+                }
+
                 if (globalReportProcess) {
                     try {
                         if (process.platform === "win32") {
@@ -1052,7 +1040,6 @@ async function main() {
                 }
 
                 await new Promise(resolve => setTimeout(resolve, 2000));
-                sRep.stop(chalk.cyan('Report process initialized.'));
 
                 // Ping project after report
                 await pingProject(

package/src/EvidenceUploader.mjs

@@ -1,45 +1,45 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import { ContainerClient } from '@azure/storage-blob';
-import mime from 'mime-types';
-
-/**
- * Subes la evidencia de prueba iterativamente a Azure Blob Storage usando una URL de SAS.
- * @param {string} reportsDir Directorio local de reportes.
- * @param {string} sasUrl URL de SAS para el ContainerClient.
- * @param {string} basePath Path base dentro del contenedor de Azure.
- */
-export async function uploadEvidence(reportsDir, sasUrl, basePath) {
-    if (!fs.existsSync(reportsDir)) return;
-
-    const containerClient = new ContainerClient(sasUrl);
-
-    async function walkAndUpload(currentDir, relativePath = '') {
-        const entries = fs.readdirSync(currentDir, { withFileTypes: true });
-        const uploadPromises = [];
-
-        for (const entry of entries) {
-            const fullPath = path.join(currentDir, entry.name);
-            const entryRelativePath = path.posix.join(relativePath, entry.name);
-
-            if (entry.isDirectory()) {
-                uploadPromises.push(walkAndUpload(fullPath, entryRelativePath));
-            } else {
-                // Blob path en Azure: basePath/ruta_relativa_del_archivo
-                const blobPath = `${basePath}/${entryRelativePath}`;
-                const blockBlobClient = containerClient.getBlockBlobClient(blobPath);
-                
-                const contentType = mime.lookup(entry.name) || 'application/octet-stream';
-
-                uploadPromises.push(
-                    blockBlobClient.uploadFile(fullPath, {
-                        blobHTTPHeaders: { blobContentType: contentType }
-                    })
-                );
-            }
-        }
-        await Promise.all(uploadPromises);
-    }
-
-    await walkAndUpload(reportsDir);
-}
+import fs from 'node:fs';
+import path from 'node:path';
+import { ContainerClient } from '@azure/storage-blob';
+import mime from 'mime-types';
+
+/**
+ * Subes la evidencia de prueba iterativamente a Azure Blob Storage usando una URL de SAS.
+ * @param {string} reportsDir Directorio local de reportes.
+ * @param {string} sasUrl URL de SAS para el ContainerClient.
+ * @param {string} basePath Path base dentro del contenedor de Azure.
+ */
+export async function uploadEvidence(reportsDir, sasUrl, basePath) {
+    if (!fs.existsSync(reportsDir)) return;
+
+    const containerClient = new ContainerClient(sasUrl);
+
+    async function walkAndUpload(currentDir, relativePath = '') {
+        const entries = fs.readdirSync(currentDir, { withFileTypes: true });
+        const uploadPromises = [];
+
+        for (const entry of entries) {
+            const fullPath = path.join(currentDir, entry.name);
+            const entryRelativePath = path.posix.join(relativePath, entry.name);
+
+            if (entry.isDirectory()) {
+                uploadPromises.push(walkAndUpload(fullPath, entryRelativePath));
+            } else {
+                // Blob path en Azure: basePath/ruta_relativa_del_archivo
+                const blobPath = `${basePath}/${entryRelativePath}`;
+                const blockBlobClient = containerClient.getBlockBlobClient(blobPath);
+                
+                const contentType = mime.lookup(entry.name) || 'application/octet-stream';
+
+                uploadPromises.push(
+                    blockBlobClient.uploadFile(fullPath, {
+                        blobHTTPHeaders: { blobContentType: contentType }
+                    })
+                );
+            }
+        }
+        await Promise.all(uploadPromises);
+    }
+
+    await walkAndUpload(reportsDir);
+}

package/src/KnowledgeService.ts

@@ -144,7 +144,7 @@ export class KnowledgeService {
                 if (data.status === 'skipped_duplicate_dom') {
                     // console.log(chalk.gray(`[Knowledge] Ingesta omitida (Duplicado).`));
                 } else {
-                    console.log(chalk.cyan(`[Knowledge] Ingesta exitosa (Project: ${payload.project_id})`));
+                    if (process.env.DEBUG) console.log(chalk.cyan(`[Knowledge] Ingesta exitosa (Project: ${payload.project_id})`));
                 }
             }
         } catch (e: any) {

package/src/arcalityClient.mjs

@@ -250,7 +250,7 @@ export async function startMission(prompt, targetUrl) {
  * @param {'success'|'failed'|'cancelled'} result
  * @param {object} usage - Optional usage statistics directly from the AI
  */
-export async function endMission(missionId, result, usage = null, failReason = null) {
+export async function endMission(missionId, result, usage = null, failReason = null, reportUrl = null) {
     const apiBase = getEffectiveApiBase();
     if (!apiBase || !missionId) return { ok: true };
 
@@ -262,7 +262,7 @@ export async function endMission(missionId, result, usage = null, failReason = n
                 'Content-Type': 'application/json',
                 'x-api-key': key
             },
-            body: JSON.stringify({ result, usage, failReason })
+            body: JSON.stringify({ result, usage, failReason, reportUrl })
         });
     } catch { }
     return { ok: true };
@@ -288,25 +288,32 @@ function simpleHash(str) {
  */
 export async function getEvidenceSasToken(missionId, projectId) {
     const apiBase = getEffectiveApiBase();
-    if (!apiBase || !missionId || !projectId) return null;
+    if (!apiBase || !missionId) return null;
 
     const key = getEffectiveApiKey();
     if (!key) return null;
 
     try {
+        const organization_id = process.env.ARCALITY_ORG_ID || '';
         const res = await fetch(`${apiBase}/api/v1/missions/${missionId}/evidence/sas`, {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
-                'Authorization': `Bearer ${key}`
+                'x-api-key': key
             },
-            body: JSON.stringify({ projectId })
+            body: JSON.stringify({ organization_id, project_id: projectId })
         });
 
-        if (!res.ok) return null;
+        if (!res.ok) {
+            const txt = await res.text();
+            console.log(`[DEBUG] SAS Token API Failed: ${res.status} - ${txt}`);
+            return null;
+        }
         
-        return await res.json();
-    } catch {
+        const data = await res.json();
+        return data;
+    } catch (e) {
+        console.log(`[DEBUG] SAS Token API Error: ${e.message}`);
         return null;
     }
 }

package/src/services/collectiveMemoryService.ts

@@ -73,15 +73,15 @@ export async function pushRule(rule: {
         });
 
         if (!res.ok) {
-            console.warn(`[CollectiveMemory] pushRule HTTP ${res.status}: ${await res.text().catch(() => '')}`);
+            if (process.env.DEBUG) console.warn(`[CollectiveMemory] pushRule HTTP ${res.status}: ${await res.text().catch(() => '')}`);
             return null;
         }
 
         const data = await res.json();
-        console.log(`\x1b[32m[CollectiveMemory] ✅ Regla guardada: "${rule.title}"\x1b[0m`);
+        if (process.env.DEBUG) console.log(`\x1b[32m[CollectiveMemory] ✅ Regla guardada: "${rule.title}"\x1b[0m`);
         return data.id ?? null;
     } catch (err: any) {
-        console.warn(`[CollectiveMemory] pushRule error: ${err?.message}`);
+        if (process.env.DEBUG) console.warn(`[CollectiveMemory] pushRule error: ${err?.message}`);
         return null;
     }
 }
@@ -164,15 +164,15 @@ export async function pushKnowledge(knowledge: {
         });
 
         if (!res.ok) {
-            console.warn(`[CollectiveMemory] pushKnowledge HTTP ${res.status}: ${await res.text().catch(() => '')}`);
+            if (process.env.DEBUG) console.warn(`[CollectiveMemory] pushKnowledge HTTP ${res.status}: ${await res.text().catch(() => '')}`);
             return null;
         }
 
         const data = await res.json();
-        console.log(`\x1b[32m[CollectiveMemory] ✅ Conocimiento guardado: "${knowledge.title}"\x1b[0m`);
+        if (process.env.DEBUG) console.log(`\x1b[32m[CollectiveMemory] ✅ Conocimiento guardado: "${knowledge.title}"\x1b[0m`);
         return data.id ?? null;
     } catch (err: any) {
-        console.warn(`[CollectiveMemory] pushKnowledge error: ${err?.message}`);
+        if (process.env.DEBUG) console.warn(`[CollectiveMemory] pushKnowledge error: ${err?.message}`);
         return null;
     }
 }
@@ -228,7 +228,7 @@ export async function savePromptPattern(patternData: any): Promise<boolean> {
             mission_id: getMissionId(),
             ...patternData
         };
-        console.log(`[PatternSave] 📤 POST ${apiUrl} | org=${payload.organization_id} proj=${payload.project_id} mission=${payload.mission_id}`);
+        if (process.env.DEBUG) console.log(`[PatternSave] 📤 POST ${apiUrl} | org=${payload.organization_id} proj=${payload.project_id} mission=${payload.mission_id}`);
 
         const res = await fetch(apiUrl, {
             method: 'POST',
@@ -240,13 +240,13 @@ export async function savePromptPattern(patternData: any): Promise<boolean> {
         });
 
         if (!res.ok) {
-            console.warn(`[PatternSave] ⚠️ HTTP ${res.status} al guardar patrón en ${apiUrl}: ${await res.text().catch(() => '')}`);
+            if (process.env.DEBUG) console.warn(`[PatternSave] ⚠️ HTTP ${res.status} al guardar patrón en ${apiUrl}: ${await res.text().catch(() => '')}`);
         } else {
-            console.log(`[PatternSave] ✅ Patrón guardado exitosamente.`);
+            if (process.env.DEBUG) console.log(`[PatternSave] ✅ Patrón guardado exitosamente.`);
         }
         return res.ok;
     } catch (err: any) {
-        console.warn(`[PatternSave] ⚠️ Error guardando patrón: ${err?.message || 'unknown'}`);
+        if (process.env.DEBUG) console.warn(`[PatternSave] ⚠️ Error guardando patrón: ${err?.message || 'unknown'}`);
         return false;
     }
 }

package/src/services/securityScanner.ts

@@ -23,7 +23,7 @@ export class SecurityScanner {
    * @returns A promise that resolves to an array of found vulnerabilities.
    */
   async runAllScans(): Promise<SecurityFinding[]> {
-    console.log('[QA-SEC] Starting comprehensive security scan...');
+    if (process.env.DEBUG) console.log('[QA-SEC] Starting comprehensive security scan...');
     
     // Scan 1: Audit HTTP Security Headers
     const headerVulnerabilities = await audit_http_headers(this.page);
@@ -38,7 +38,7 @@ export class SecurityScanner {
 
     // More scans like auth bypass for known admin URLs could be added here.
 
-    console.log(`[QA-SEC] Comprehensive scan finished. Found ${this.report.length} potential vulnerabilities.`);
+    if (process.env.DEBUG) console.log(`[QA-SEC] Comprehensive scan finished. Found ${this.report.length} potential vulnerabilities.`);
     return this.getReport();
   }
 
@@ -55,7 +55,7 @@ export class SecurityScanner {
             const payload = 'https://www.evil-redirect.com';
             url.searchParams.set(param, payload);
 
-            console.log(`[QA-SEC] Testing Open Redirect on param: ${param}`);
+            if (process.env.DEBUG) console.log(`[QA-SEC] Testing Open Redirect on param: ${param}`);
             
             try {
                 await this.page.goto(url.toString(), { waitUntil: 'networkidle' });
@@ -89,7 +89,7 @@ export class SecurityScanner {
                     await this.page.goBack();
                 }
             } catch (error) {
-                console.log(`[QA-SEC] Error during open redirect test, this might be expected if the navigation was blocked. Continuing scan.`);
+                if (process.env.DEBUG) console.log(`[QA-SEC] Error during open redirect test, this might be expected if the navigation was blocked. Continuing scan.`);
                 // It's possible the navigation to the evil site fails, which is good.
                 // We should ensure we can recover and continue.
                 await this.page.goBack(); // Try to recover state