@assertrx/dino 1.0.3 → 1.0.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assertrx/dino",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "A friendly purple dinosaur pi package with a custom TUI header, theme, and Playwright skills.",
   "keywords": [
     "pi-package"

package/prompts/generate-bdd-from-url.md

@@ -1,6 +1,6 @@
 ---
 description: Generate exhaustive Gherkin BDD scenarios for a single page using the bdd-gherkin skill
-argument-hint: "<URL> [output-dir]"
+argument-hint: "<URL> [output-dir] [auth-env-file]"
 ---
 
 Use the `bdd-gherkin` skill and `playwright-cli` commands to inspect the page at $1 and generate exhaustive Gherkin BDD scenarios for **that page only**. Fall back to the Playwright MCP bridge (`browser_*` tools) only if `playwright-cli` is unavailable or fails.
@@ -20,7 +20,7 @@ Use the `bdd-gherkin` skill and `playwright-cli` commands to inspect the page at
    - Run `playwright-cli open $1` to load the page.
    - Run `playwright-cli snapshot` to capture the accessibility tree, visible fields, buttons, links, tables, and any validation/error messages.
    - If `playwright-cli` cannot be resolved or its commands fail, fall back to the Playwright MCP bridge: use `browser_navigate` to load $1 and `browser_snapshot` to inspect it.
-   - If the page requires authentication and an env file is provided, follow the secure login flow from the `playwright-cli` skill.
+   - If the page requires authentication and an auth env file was provided (`$3`), follow the secure login flow from the `playwright-cli` skill to log in before snapshotting.
    - Identify the primary actor(s), the business capability the page supports, and every interactive element or workflow step on the page.
    - Do **not** navigate away from the page; generate scenarios for the page pointed to by $1 only.
 
@@ -58,8 +58,30 @@ Use the `bdd-gherkin` skill and `playwright-cli` commands to inspect the page at
    - Use a clear, kebab-case file name derived from the page (e.g., `transfer-money-page.feature`, `login-page.feature`).
    - If the page supports multiple distinct capabilities, split into multiple feature files in the output directory.
 
+## Authentication
+
+If the site requires login, handle credentials securely:
+
+1. **Preferred: provide an auth env file** as the third argument (`$3`).
+   - The env file should contain variables such as:
+     ```bash
+     BDD_AUTH_URL=https://example.com/login
+     BDD_USERNAME=user@example.com
+     BDD_PASSWORD=secret
+     ```
+   - Load the file in a single bash command, use the values immediately to log in via `playwright-cli` (e.g., `open` the login page, then `fill` the credentials), and **do not echo, log, or persist the values anywhere**.
+   - Do not include the env file or its values in generated `.feature` files, snapshots, or test code.
+   - Mark the env file in `.gitignore` and delete it when the session is complete.
+
+2. **Fallback: manual login**.
+   - If no env file is provided, open the login page with `playwright-cli open` and ask the user to complete login manually in the browser session.
+   - Then continue generating scenarios from the authenticated state.
+
+3. **Never** ask the user to paste credentials into the chat, and **never** hardcode credentials into generated files.
+
 ## Output
 
 - The saved `.feature` file path(s).
 - A brief summary of the scenario categories covered (happy path, validation, edge cases, errors, etc.).
 - Any clarifying assumptions made about business rules or user roles.
+- How authentication was handled (env file or manual).

package/scripts/.playwright-mcp/console-2026-08-27T20-47-33-834Z.log

@@ -0,0 +1,9 @@
+[     296ms] [VERBOSE] [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o @ https://www.saucedemo.com/:0
+[     342ms] [ERROR] Failed to load resource: the server responded with a status of 401 (Unauthorized) @ https://events.backtrace.io/api/summed-events/submit?universe=UNIVERSE&token=TOKEN:0
+[     359ms] [ERROR] Failed to load resource: the server responded with a status of 401 (Unauthorized) @ https://events.backtrace.io/api/unique-events/submit?universe=UNIVERSE&token=TOKEN:0
+[   10471ms] [ERROR] Failed to load resource: the server responded with a status of 401 (Unauthorized) @ https://events.backtrace.io/api/summed-events/submit?universe=UNIVERSE&token=TOKEN:0
+[   10492ms] [ERROR] Failed to load resource: the server responded with a status of 401 (Unauthorized) @ https://events.backtrace.io/api/unique-events/submit?universe=UNIVERSE&token=TOKEN:0
+[   30601ms] [ERROR] Failed to load resource: the server responded with a status of 401 (Unauthorized) @ https://events.backtrace.io/api/summed-events/submit?universe=UNIVERSE&token=TOKEN:0
+[   30654ms] [ERROR] Failed to load resource: the server responded with a status of 401 (Unauthorized) @ https://events.backtrace.io/api/unique-events/submit?universe=UNIVERSE&token=TOKEN:0
+[   33201ms] [ERROR] Access to fetch at 'https://submit.backtrace.io/UNIVERSE/TOKEN/json' from origin 'https://www.saucedemo.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. @ https://www.saucedemo.com/:0
+[   33202ms] [ERROR] Failed to load resource: net::ERR_FAILED @ https://submit.backtrace.io/UNIVERSE/TOKEN/json:0

package/scripts/.playwright-mcp/console-2026-08-27T20-56-22-679Z.log

@@ -0,0 +1 @@
+[     283ms] [VERBOSE] [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o @ https://www.saucedemo.com/:0

package/scripts/.playwright-mcp/console-2026-08-27T20-59-22-023Z.log

@@ -0,0 +1,3 @@
+[     230ms] [VERBOSE] [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o @ https://www.saucedemo.com/:0
+[   58486ms] [ERROR] Access to fetch at 'https://submit.backtrace.io/UNIVERSE/TOKEN/json' from origin 'https://www.saucedemo.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. @ https://www.saucedemo.com/:0
+[   58486ms] [ERROR] Failed to load resource: net::ERR_FAILED @ https://submit.backtrace.io/UNIVERSE/TOKEN/json:0

package/scripts/.playwright-mcp/page-2026-08-27T20-47-34-065Z.yml

@@ -0,0 +1,14 @@
+- generic [ref=e3]:
+  - generic [ref=e4]: Swag Labs
+  - generic [ref=e5]:
+    - generic [ref=e9]:
+      - textbox "Username" [ref=e11]
+      - textbox "Password" [ref=e13]
+      - button "Login" [ref=e15] [cursor=pointer]
+    - generic [ref=e17]:
+      - generic [ref=e18]:
+        - heading "Accepted usernames are:" [level=4] [ref=e19]
+        - text: standard_userlocked_out_userproblem_userperformance_glitch_usererror_uservisual_user
+      - generic [ref=e20]:
+        - heading "Password for all users:" [level=4] [ref=e21]
+        - text: secret_sauce

package/scripts/.playwright-mcp/page-2026-08-27T20-48-07-553Z.yml

@@ -0,0 +1,17 @@
+- generic [ref=e3]:
+  - generic [ref=e4]: Swag Labs
+  - generic [ref=e5]:
+    - generic [ref=e9]:
+      - textbox "Username" [ref=e11]: standard_user
+      - textbox "Password" [ref=e13]: wrong_password
+      - heading [level=3] [ref=e26]:
+        - button [ref=e27] [cursor=pointer]
+        - text: "Epic sadface: Username and password do not match any user in this service"
+      - button "Login" [active] [ref=e15] [cursor=pointer]
+    - generic [ref=e17]:
+      - generic [ref=e18]:
+        - heading "Accepted usernames are:" [level=4] [ref=e19]
+        - text: standard_userlocked_out_userproblem_userperformance_glitch_usererror_uservisual_user
+      - generic [ref=e20]:
+        - heading "Password for all users:" [level=4] [ref=e21]
+        - text: secret_sauce

package/scripts/.playwright-mcp/page-2026-08-27T20-56-22-876Z.yml

@@ -0,0 +1,14 @@
+- generic [ref=e3]:
+  - generic [ref=e4]: Swag Labs
+  - generic [ref=e5]:
+    - generic [ref=e9]:
+      - textbox "Username" [ref=e11]
+      - textbox "Password" [ref=e13]
+      - button "Login" [ref=e15] [cursor=pointer]
+    - generic [ref=e17]:
+      - generic [ref=e18]:
+        - heading "Accepted usernames are:" [level=4] [ref=e19]
+        - text: standard_userlocked_out_userproblem_userperformance_glitch_usererror_uservisual_user
+      - generic [ref=e20]:
+        - heading "Password for all users:" [level=4] [ref=e21]
+        - text: secret_sauce

package/scripts/.playwright-mcp/page-2026-08-27T20-59-22-174Z.yml

@@ -0,0 +1,14 @@
+- generic [ref=e3]:
+  - generic [ref=e4]: Swag Labs
+  - generic [ref=e5]:
+    - generic [ref=e9]:
+      - textbox "Username" [ref=e11]
+      - textbox "Password" [ref=e13]
+      - button "Login" [ref=e15] [cursor=pointer]
+    - generic [ref=e17]:
+      - generic [ref=e18]:
+        - heading "Accepted usernames are:" [level=4] [ref=e19]
+        - text: standard_userlocked_out_userproblem_userperformance_glitch_usererror_uservisual_user
+      - generic [ref=e20]:
+        - heading "Password for all users:" [level=4] [ref=e21]
+        - text: secret_sauce

package/scripts/.playwright-mcp/page-2026-08-27T21-00-21-032Z.yml

@@ -0,0 +1,17 @@
+- generic [ref=e3]:
+  - generic [ref=e4]: Swag Labs
+  - generic [ref=e5]:
+    - generic [ref=e9]:
+      - textbox "Username" [ref=e11]: standard_user
+      - textbox "Password" [ref=e13]: wrong_password
+      - heading [level=3] [ref=e26]:
+        - button [ref=e27] [cursor=pointer]
+        - text: "Epic sadface: Username and password do not match any user in this service"
+      - button "Login" [active] [ref=e15] [cursor=pointer]
+    - generic [ref=e17]:
+      - generic [ref=e18]:
+        - heading "Accepted usernames are:" [level=4] [ref=e19]
+        - text: standard_userlocked_out_userproblem_userperformance_glitch_usererror_uservisual_user
+      - generic [ref=e20]:
+        - heading "Password for all users:" [level=4] [ref=e21]
+        - text: secret_sauce

package/scripts/api-server.mjs

@@ -54,6 +54,7 @@ const PROMPT_REGISTRY = {
     params: [
       { name: "url", required: true, description: "Target website URL" },
       { name: "outputDir", required: false, description: "Output directory (default: tests/features/)" },
+      { name: "authEnvFile", required: false, description: "Auth env file for login credentials" },
     ],
     description: "Generate Gherkin BDD scenarios for a page by inspecting it with playwright-cli",
   },
@@ -77,6 +78,13 @@ const PROMPT_REGISTRY = {
   },
 };
 
+// ── Server-level agent defaults ────────────────────────────────────────
+// Thinking level applied to every agent session created by this server.
+// Valid: "off" | "minimal" | "low" | "medium" | "high" | "xhigh" | "max".
+// Undefined → pi default (from settings, else "medium").
+const VALID_THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh", "max"];
+let thinkingLevel;
+
 // ── Helpers ────────────────────────────────────────────────────────────────
 
 /** Load a prompt template and substitute $1..$N positional arguments. */
@@ -228,6 +236,7 @@ async function createSession({ cwd, apiKey, apiKeys, provider, model: modelSelec
     resourceLoader: loader,
     sessionManager: SessionManager.inMemory(),
     ...(model ? { model } : {}),
+    ...(thinkingLevel ? { thinkingLevel } : {}),
   });
 
   return session;
@@ -251,6 +260,26 @@ process.on("SIGTERM", shutdown);
 // Health check
 app.get("/api/health", async () => ({ status: "ok", package: "@assertrx/dino" }));
 
+// Get the thinking level applied to agent sessions
+app.get("/api/settings/thinking", async () => ({
+  thinkingLevel: thinkingLevel ?? null,
+  default: "medium",
+  valid: VALID_THINKING_LEVELS,
+}));
+
+// Set the thinking level for subsequent agent sessions
+app.post("/api/settings/thinking", async (request, reply) => {
+  const { level } = request.body || {};
+  if (!VALID_THINKING_LEVELS.includes(level)) {
+    reply.code(400);
+    return {
+      error: `Invalid thinking level: ${JSON.stringify(level)}. Valid: ${VALID_THINKING_LEVELS.join(", ")}`,
+    };
+  }
+  thinkingLevel = level;
+  return { thinkingLevel };
+});
+
 // List all available prompts
 app.get("/api/prompts", async () => {
   const prompts = Object.entries(PROMPT_REGISTRY).map(([name, entry]) => ({
@@ -433,10 +462,19 @@ app.post("/api/prompts/:name", async (request, reply) => {
 
     await session.prompt(promptContent);
 
+    let stats;
+    try {
+      const s = session.getSessionStats();
+      stats = { tokens: s.tokens, cost: s.cost, toolCalls: s.toolCalls };
+    } catch {
+      /* stats unavailable */
+    }
+
     return {
       prompt: name,
       response: messages.join(""),
       toolCalls,
+      stats,
     };
   }
 
@@ -476,10 +514,22 @@ app.post("/api/prompts/:name", async (request, reply) => {
         sendSSE("tool_end", { tool: event.toolName, error: event.isError });
         break;
 
-      case "agent_end":
-        sendSSE("done", {});
+      case "agent_end": {
+        let stats;
+        try {
+          const s = session.getSessionStats();
+          stats = {
+            tokens: s.tokens,
+            cost: s.cost,
+            toolCalls: s.toolCalls,
+          };
+        } catch {
+          /* stats unavailable */
+        }
+        sendSSE("done", { stats });
         reply.raw.end();
         break;
+      }
     }
   });