@assertrx/dino 1.0.3 → 1.0.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assertrx/dino",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "A friendly purple dinosaur pi package with a custom TUI header, theme, and Playwright skills.",
   "keywords": [
     "pi-package"

package/prompts/generate-bdd-from-url.md

@@ -1,6 +1,6 @@
 ---
 description: Generate exhaustive Gherkin BDD scenarios for a single page using the bdd-gherkin skill
-argument-hint: "<URL> [output-dir]"
+argument-hint: "<URL> [output-dir] [auth-env-file]"
 ---
 
 Use the `bdd-gherkin` skill and `playwright-cli` commands to inspect the page at $1 and generate exhaustive Gherkin BDD scenarios for **that page only**. Fall back to the Playwright MCP bridge (`browser_*` tools) only if `playwright-cli` is unavailable or fails.
@@ -20,7 +20,7 @@ Use the `bdd-gherkin` skill and `playwright-cli` commands to inspect the page at
    - Run `playwright-cli open $1` to load the page.
    - Run `playwright-cli snapshot` to capture the accessibility tree, visible fields, buttons, links, tables, and any validation/error messages.
    - If `playwright-cli` cannot be resolved or its commands fail, fall back to the Playwright MCP bridge: use `browser_navigate` to load $1 and `browser_snapshot` to inspect it.
-   - If the page requires authentication and an env file is provided, follow the secure login flow from the `playwright-cli` skill.
+   - If the page requires authentication and an auth env file was provided (`$3`), follow the secure login flow from the `playwright-cli` skill to log in before snapshotting.
    - Identify the primary actor(s), the business capability the page supports, and every interactive element or workflow step on the page.
    - Do **not** navigate away from the page; generate scenarios for the page pointed to by $1 only.
 
@@ -58,8 +58,30 @@ Use the `bdd-gherkin` skill and `playwright-cli` commands to inspect the page at
    - Use a clear, kebab-case file name derived from the page (e.g., `transfer-money-page.feature`, `login-page.feature`).
    - If the page supports multiple distinct capabilities, split into multiple feature files in the output directory.
 
+## Authentication
+
+If the site requires login, handle credentials securely:
+
+1. **Preferred: provide an auth env file** as the third argument (`$3`).
+   - The env file should contain variables such as:
+     ```bash
+     BDD_AUTH_URL=https://example.com/login
+     BDD_USERNAME=user@example.com
+     BDD_PASSWORD=secret
+     ```
+   - Load the file in a single bash command, use the values immediately to log in via `playwright-cli` (e.g., `open` the login page, then `fill` the credentials), and **do not echo, log, or persist the values anywhere**.
+   - Do not include the env file or its values in generated `.feature` files, snapshots, or test code.
+   - Mark the env file in `.gitignore` and delete it when the session is complete.
+
+2. **Fallback: manual login**.
+   - If no env file is provided, open the login page with `playwright-cli open` and ask the user to complete login manually in the browser session.
+   - Then continue generating scenarios from the authenticated state.
+
+3. **Never** ask the user to paste credentials into the chat, and **never** hardcode credentials into generated files.
+
 ## Output
 
 - The saved `.feature` file path(s).
 - A brief summary of the scenario categories covered (happy path, validation, edge cases, errors, etc.).
 - Any clarifying assumptions made about business rules or user roles.
+- How authentication was handled (env file or manual).

package/scripts/api-server.mjs

@@ -54,6 +54,7 @@ const PROMPT_REGISTRY = {
     params: [
       { name: "url", required: true, description: "Target website URL" },
       { name: "outputDir", required: false, description: "Output directory (default: tests/features/)" },
+      { name: "authEnvFile", required: false, description: "Auth env file for login credentials" },
     ],
     description: "Generate Gherkin BDD scenarios for a page by inspecting it with playwright-cli",
   },
@@ -77,6 +78,13 @@ const PROMPT_REGISTRY = {
   },
 };
 
+// ── Server-level agent defaults ────────────────────────────────────────
+// Thinking level applied to every agent session created by this server.
+// Valid: "off" | "minimal" | "low" | "medium" | "high" | "xhigh" | "max".
+// Undefined → pi default (from settings, else "medium").
+const VALID_THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh", "max"];
+let thinkingLevel;
+
 // ── Helpers ────────────────────────────────────────────────────────────────
 
 /** Load a prompt template and substitute $1..$N positional arguments. */
@@ -228,6 +236,7 @@ async function createSession({ cwd, apiKey, apiKeys, provider, model: modelSelec
     resourceLoader: loader,
     sessionManager: SessionManager.inMemory(),
     ...(model ? { model } : {}),
+    ...(thinkingLevel ? { thinkingLevel } : {}),
   });
 
   return session;
@@ -251,6 +260,26 @@ process.on("SIGTERM", shutdown);
 // Health check
 app.get("/api/health", async () => ({ status: "ok", package: "@assertrx/dino" }));
 
+// Get the thinking level applied to agent sessions
+app.get("/api/settings/thinking", async () => ({
+  thinkingLevel: thinkingLevel ?? null,
+  default: "medium",
+  valid: VALID_THINKING_LEVELS,
+}));
+
+// Set the thinking level for subsequent agent sessions
+app.post("/api/settings/thinking", async (request, reply) => {
+  const { level } = request.body || {};
+  if (!VALID_THINKING_LEVELS.includes(level)) {
+    reply.code(400);
+    return {
+      error: `Invalid thinking level: ${JSON.stringify(level)}. Valid: ${VALID_THINKING_LEVELS.join(", ")}`,
+    };
+  }
+  thinkingLevel = level;
+  return { thinkingLevel };
+});
+
 // List all available prompts
 app.get("/api/prompts", async () => {
   const prompts = Object.entries(PROMPT_REGISTRY).map(([name, entry]) => ({