@bugmole/cli 0.4.0

package/.bugmole.env.example

@@ -0,0 +1,20 @@
+# Safe local template for Bugmole. Copy to .bugmole.env and fill values privately.
+# Never commit .bugmole.env or credentials.
+BUGMOLE_PROJECT_ID=bugmole
+BUGMOLE_PROJECT_NAME=Bugmole
+BUGMOLE_ENVIRONMENT=local
+BUGMOLE_STORAGE_PROVIDER=local
+BUGMOLE_LOCAL_ARTIFACTS_DIR=./qa/bugmole-runs
+
+# Bugmole CLI registry and machine credential
+BUGMOLE_REGISTRY_URL=https://api.bugmole.com
+# Optional override for device-code onboarding.
+BUGMOLE_DASHBOARD_URL=https://app.bugmole.com
+# Keep this machine credential in the private .bugmole.env or a secret manager.
+BUGMOLE_API_KEY=
+
+# Optional LLM configuration
+LLM_PROVIDER=manual
+LLM_MODEL=manual-review
+LLM_API_KEY=
+LLM_BASE_URL=

package/LICENSE

@@ -0,0 +1,7 @@
+Copyright (c) 2026 The AI, Inc.
+
+All rights reserved.
+
+This software and its source code are proprietary and confidential. No license
+or right to use, copy, modify, distribute, sublicense, or sell this software
+is granted without prior written permission from The AI, Inc.

package/README.md

@@ -0,0 +1,293 @@
+## TestFlight feedback
+
+The standalone Bugmole dashboard accepts normalized TestFlight feedback at
+`POST /api/integrations/testflight/feedback` and displays the read-only local queue in its
+TestFlight feedback panel. See `docs/testflight-feedback.md` for the payload, HMAC signature,
+curl example, and production persistence limitations.
+
+# @bugmole/cli
+
+The `@bugmole/cli` package contains the Bugmole MCP framework and the typed project
+configuration contract used by the standalone dashboard. The framework is
+English-only; the rental product remains separate and Vietnamese-only.
+
+The framework provides QA/MCP orchestration, typed project registries, browser evidence helpers, and autonomous smoke-testing workflows. It is maintained independently from the Arion rental application and its dashboard.
+
+## Root Repository Commands
+
+```bash
+npm test
+npm run bugmole:mcp
+npm run bugmole:explore
+npm run bugmole:report
+not included in this repository
+not included in this repository
+```
+
+`npm test` runs the package's safe MCP/unit tests and does not require secrets. The moved dashboard lives in `apps/qa` and runs at `http://localhost:3020`:
+
+```bash
+cd apps/qa
+npm install
+npm run dev
+```
+
+Automated exploration modes may require the rental app to be running:
+
+```bash
+npm run dev -- -p 3010
+npm run bugmole:explore
+```
+
+The published CLI exposes both `bugmole` (primary) and `bm` (alias) binaries.
+Run the MCP server with either alias:
+
+```bash
+npm install
+npx bugmole --mcp
+bugmole --mcp
+bm --mcp
+```
+
+### Interactive initialization
+
+Run the configuration wizard from the workspace you want to configure:
+
+```bash
+bugmole init
+# equivalent:
+bugmole --init
+npm run bugmole:init
+```
+
+The wizard prompts for project id/name, environment, spec and evidence paths, artifact
+directory, and storage provider (`local`, `gcs`, `s3`, or `r2`). Cloud providers additionally
+prompt for non-secret bucket/region/account/endpoint identifiers. It writes `.bugmole/config.yaml`
+and, when absent, `.bugmole.env`; credential fields contain only `REPLACE_ME` placeholders.
+Existing configuration is shown as the default and is not overwritten without confirmation.
+
+For CI or scripts, no prompt is opened:
+
+```bash
+BUGMOLE_NON_INTERACTIVE=true bugmole init
+bugmole init --non-interactive --storage-provider local --force
+bugmole init --non-interactive --storage-provider r2 --bucket qa-artifacts --account-id ACCOUNT_ID
+```
+
+Non-interactive mode keeps an existing config unless `--force` is supplied. It never reads,
+prints, or stores credential values. `.bugmole.env` is ignored by git; use `.bugmole.env.example` as
+the safe template for local/cloud variable names. `bugmole --mcp` remains non-interactive.
+
+The legacy `--mode mcp` form remains accepted for compatibility. Cursor should
+invoke the moved `scripts/bugmole.ts` entrypoint with `--mcp`.
+
+## Web suites
+
+`--mode suite` runs a directory of Maestro-style flow files against a running web
+app with the Playwright driver. It is deterministic: no LLM, no project
+configuration, no registry — just flows, a base URL, and evidence.
+
+```bash
+bugmole --mode suite --flows qa/flows --base-url http://localhost:3111 --project cinely
+```
+
+Flows run in file-name order, so a numbered directory reads as one journey. Each
+run writes per-flow screenshots, a video, a step log, and a `web-suite-report.json`
+summary under the artifacts directory, and the process exits non-zero if any flow
+failed or was blocked.
+
+| Flag | Meaning |
+| --- | --- |
+| `--flows <dir>` | Flow directory (default `.maestro`) |
+| `--base-url <url>` | Application base URL, or `BUGMOLE_BASE_URL` |
+| `--project <id>` | Project id used in the evidence path |
+| `--artifacts-dir <dir>` | Evidence directory (default `qa/bugmole-runs`) |
+| `--grep <list>` | Only run flows whose file name contains one of these comma-separated substrings |
+| `--share-session` | Keep one signed-in session across the whole suite |
+| `--headed` | Run with a visible browser |
+
+`assertVisible`/`assertNotVisible` check that an element is painted on screen.
+`assertClickable` checks something stronger: that it is the actual hit-test
+target at its own center point -- catching a bug class those cannot, where an
+unrelated fixed-position element (a chat mascot, a floating action button, a
+toast) is visually painted somewhere else but silently swallows the tap
+because it sits on top in z-order.
+
+Each flow gets its own browser context, so one journey cannot silently prop up
+the next. `--share-session` opts into the opposite: cookies and local storage
+carry forward, which is what a multi-step signed-in journey needs.
+
+### Flow vocabulary
+
+The web driver interprets the Maestro subset that web journeys actually need:
+
+`launchApp`, `stopApp`, `openLink` (absolute or relative to the base URL),
+`tapOn` (plain text, or `{ text, index, optional }`), `inputText`, `eraseText`,
+`pressKey`, `assertVisible`, `assertNotVisible`, `assertClickable` (plain text,
+or `{ text, index, timeout }`), `extendedWaitUntil` (`visible` or `notVisible`
+with a `timeout`), `scrollUntilVisible`, `wait`, `takeScreenshot`, `retry`
+(`{ maxRetries, commands }`), `requestTempEmail`, and `openEmailLink`.
+
+Two behaviors are worth knowing when authoring flows:
+
+- **Assertions match what a person sees** — rendered text, the value typed into
+  a field, and a control's accessible name. Matching only rendered text would
+  report an edited form field as missing.
+- **An uncaught page error fails the flow** even when every step passed, because
+  a journey that "passes" on a crashed page is not evidence. Set
+  `ignorePageErrors: true` in the flow header to opt out.
+
+A header may declare `url`; when the driver target supplies a base URL, that
+wins over a mobile `appId`, so device flows can be replayed on the web. It may
+also declare `viewport: 390x844` (or `{ width, height }`) to pin the width a
+layout is asserted at.
+
+Screen-reader-only text -- content clipped to a 1x1 box -- is not treated as
+visible, so a flow can assert that a visually-hidden label stayed hidden.
+
+Only the `.*` wildcard idiom (e.g. `.*Falling For You.*`) is treated as a
+regex pattern; every other character is matched literally. Real UI copy is
+full of regex metacharacters -- periods, dollar signs, parentheses, plus
+signs -- and a flow author should never have to escape ordinary text like
+"$3.99" or "(USD)" to assert it.
+
+### Passwords and other secrets
+
+Never write a real password into a flow. Reference it instead, and set it on
+the machine that runs the flow:
+
+```yaml
+- tapOn: "Password"
+- inputText: "{{secret.APP_PASSWORD}}"
+```
+
+```bash
+export BUGMOLE_FLOW_SECRET_APP_PASSWORD='…'
+```
+
+`{{secret.NAME}}` reads only `BUGMOLE_FLOW_SECRET_NAME` -- a flow cannot read
+any other environment variable -- and only `inputText` may use it, so a secret
+is typed but never asserted, navigated to, or shown. Logs and step results
+mask everything typed (`•••• (12 chars)`), email links are logged without
+their query string, and the session a suite shares between flows
+(`--share-session`) is deleted when the suite ends.
+
+### Real email, for real signup flows
+
+`requestTempEmail` creates a genuinely receivable disposable inbox (via
+[mail.tm](https://mail.tm)'s public API, not browser automation against a
+temp-mail website -- several of those gate message content behind a CAPTCHA)
+and binds its address to a name -- `tempEmail` by default -- that any later
+step can reference as `{{tempEmail}}`:
+
+```yaml
+- requestTempEmail
+- openLink: "/signup"
+- tapOn: "Email"
+- inputText: "{{tempEmail}}"
+- tapOn: "Password"
+- inputText: "{{secret.SIGNUP_PASSWORD}}"
+- tapOn: "Create account"
+- openEmailLink:
+    from: "cinely.net"
+    subject: "Confirm"
+    match: "confirm"
+    timeout: 30000
+```
+
+`openEmailLink` waits for a message at the bound inbox (optionally filtered
+by `from` and/or `subject`, both substring/case-insensitive), pulls the first
+link out of it -- or the first link whose URL or text contains `match` --
+and navigates the page there. Real transactional email routes links through
+the sending provider's own click-tracking redirect; this follows that
+redirect exactly like a person clicking it in their real mail client would,
+rather than trying to parse out the "real" destination underneath it. Give a
+custom `as:` to either step to run more than one inbox in the same flow
+(`requestTempEmail: "secondInbox"` / `openEmailLink: { as: "secondInbox" }`).
+
+Every inbox created this way is deleted when the flow ends, pass or fail --
+these are disposable by design, and a QA run must not accumulate live
+mail.tm accounts every time it executes. What is **not** cleaned up
+automatically is whatever your own application created because of the
+signup (an auth user, a database row): that's application-specific, and
+Bugmole has no way to know what your app did with the address it received.
+
+This turned a real, live production bug (an auth confirmation link that
+silently redirected to the wrong environment) from something that could only
+be checked by a person manually driving a disposable-inbox website into a
+flow that runs like any other.
+
+## Cloud worker
+
+`Dockerfile.worker` builds a headless project worker that runs `bugmole serve` on Linux: it claims web runs from the registry, reads plans and flows from remote object storage, runs them with Playwright, and writes evidence back to that storage. It doesn't run agent tasks or drive devices. See `docs/cloud-worker.md` for configuration and limits.
+
+## Configuration
+
+Defaults are defined in `bugmole.config.yaml`:
+
+- Base URL QA: `http://localhost:3010`.
+- Spec package: `spec`.
+- Artifact runtime: `qa/bugmole-runs`.
+- Current browser evidence manifest: `qa/browser-evidence.json`.
+- Current screenshot evidence: `qa/screenshots`.
+
+Never print `.env` values, service-role keys, webhook secrets, or LLM keys in QA logs. To run an LLM-backed mode, provide `LLM_PROVIDER`, `LLM_MODEL`, and `LLM_API_KEY` through a private local/CI environment.
+
+Project registration uses the private `.bugmole.env` file for `BUGMOLE_API_KEY`;
+the CLI does not load the dashboard or registry `.env`. The key is never
+written to generated configuration or printed.
+
+## External QA UI
+
+The read-only QA dashboard is maintained in `apps/qa`. It does not read `.env` in the browser
+or write rental application data. With `AEGIS_AUTH_REQUIRED=true`, its server routes require an
+existing Aegis identity and only expose authorized project context.
+
+## Multiple projects
+
+The shared schema is in `projects/types.ts`. A project has an
+`id`, display metadata, `environment.baseUrl`, `plans`, `testCases`,
+`evidence`, `blockers`, an `evidenceRun`, and aggregate `stats`. The registry
+helper in `projects/registry.ts` validates duplicate IDs.
+
+The `arion-rent` project is assembled from the existing
+`spec/*`, `QA_TEST_PLAN.md`, `QA_EVIDENCE.md`, and
+`qa/browser-evidence.json` data in the Arion repository.
+The `Bugmole` project (stable id `qa-framework`) covers this package and the
+standalone dashboard using its own tests, specs, and documentation. It has no screenshot evidence
+until a dedicated framework browser run captures it.
+
+### Copyable test-case references
+
+Each standalone-dashboard test-case card and detail modal offers **Copy reference**. It copies
+the stable project, environment, test-plan, and test-case IDs from the typed registry, plus names,
+status, evidence/screenshot information, and a suggested coding-agent context block. See
+`docs/test-case-references.md` for the exact format and clipboard fallback behavior. The prompt is
+context for an agent request only; it does not imply automatic fixing.
+
+To add a project, define a typed object in `projects`, give it a
+unique stable `id`, set its environment, plans, test cases, blockers, and real
+evidence references, then add it to the `createQaProjectRegistry([...])` call
+used by the dashboard. This is a typed TypeScript configuration path; it
+contains no secrets. Changes require restarting the QA dev server (and
+rebuilding for production). There is no runtime persistence or authentication
+for project configuration.
+
+Each project declares one or more URL-only environments with a stable `id`,
+display `name`, `baseUrl`, optional `apiUrl`, `isDefault`, and `status`
+(`active`, `inactive`, or `planned`). Add local, staging, or production
+environments to the project object; the dashboard selector and query state
+derive from that list without UI changes. Evidence may optionally set
+`environmentId`; evidence for another environment is not shown as current
+proof, and missing evidence remains explicitly unavailable.
+
+## Arion Specs
+
+The spec files are tailored to the current MVP:
+
+- `spec/project_config.yaml`: route, manifest, and app startup configuration.
+- `spec/journey_graph.yaml`: landing page, public booking, payments, owner dashboard, reporting, and webhooks.
+- `spec/domain_rules.yaml`: Vietnamese rental-app copy, missing Supabase schema, private Storage, QR/bank transfer payments, and OM secret headers.
+- `spec/blockers.yaml`: setup states, disabled forms, missing payment data, destructive confirmations, and the secret-output hard stop.
+
+The Arion rental app and its QA dashboard remain in their own repository; this standalone package should reference external projects through explicit environment paths when needed.

package/TESTING.md

@@ -0,0 +1,117 @@
+# MCP Server Testing
+
+## Overview
+
+Comprehensive unit tests for all MCP tools to ensure they handle errors gracefully and never crash the server. The test suite covers:
+
+- ✅ All Bugmole MCP tools (`bugmole_*`)
+- ✅ Error handling and edge cases
+- ✅ Path resolution (relative, absolute, with/without spec/ prefix)
+- ✅ File operations (read, write, create directories)
+- ✅ Environment variable handling
+- ✅ JSON-RPC error format compliance
+
+## Running Tests
+
+```bash
+# Run all MCP server tests
+npm run test:mcp
+
+# Run all tests (if more test files are added)
+npm test
+```
+
+From the workspace root, use `npm test` for this package and `not included in this repository`
+to verify an external read-only QA UI. The QA UI runs with
+`not included in this repository` on `http://localhost:3020`; the rental app remains separate at
+the repo root and is normally explored on `http://localhost:3010`.
+
+## Test Coverage
+
+### bugmole_read_spec
+
+- ✅ Reads existing spec files
+- ✅ Handles file not found gracefully with helpful error messages
+- ✅ Resolves paths with `spec/` prefix
+- ✅ Handles absolute paths
+- ✅ Tries multiple path resolution strategies
+- ✅ Uses environment variables for project directory detection
+
+### bugmole_write_spec
+
+- ✅ Writes spec files successfully
+- ✅ Creates nested directories automatically
+- ✅ Handles invalid file paths gracefully
+
+### bugmole_report_progress
+
+- ✅ Creates progress report files
+- ✅ Handles all status types (working, blocked, completed)
+
+### bugmole_commit_response
+
+- ✅ Saves commit responses with all fields
+- ✅ Always includes `next_steps` as array (never undefined)
+
+### bugmole_explore
+
+- ✅ Returns error when not implemented (doesn't crash)
+- ✅ Handles invalid URLs gracefully
+
+### bugmole_plan & bugmole_run
+
+- ✅ Handle missing journeys/plans gracefully
+- ✅ Don't crash on invalid inputs
+
+### Error Handling
+
+- ✅ All tool calls wrapped in error handler
+- ✅ Errors returned in JSON-RPC format
+- ✅ Server never crashes on tool errors
+
+### Path Resolution
+
+- ✅ Handles relative paths from different directories
+- ✅ Uses environment variables (BUGMOLE_PROJECT_DIR, CURSOR_PROJECT_DIRECTORY)
+- ✅ Tries multiple resolution strategies
+
+## Test Results
+
+```
+✅ 20 tests passing
+✅ 0 tests failing
+✅ All MCP tools covered
+```
+
+## Key Principles
+
+1. **Never Crash**: All tools must handle errors gracefully and return JSON-RPC error responses
+2. **Helpful Errors**: Error messages include debug information (paths tried, working directory, etc.)
+3. **Path Flexibility**: Tools try multiple path resolution strategies to find files
+4. **Robustness**: Tools handle missing files, invalid inputs, and edge cases without crashing
+
+## Adding New Tests
+
+When adding new MCP tools:
+
+1. Add test cases in `src/mcp/server.test.ts`
+2. Test both success and failure scenarios
+3. Ensure errors are returned in JSON-RPC format
+4. Verify the server doesn't crash on any input
+5. Test path resolution if the tool reads/writes files
+
+## Continuous Integration
+
+These tests should be run:
+
+- Before committing changes to MCP tools
+- In CI/CD pipeline
+- When adding new MCP tools
+- When fixing MCP tool bugs
+
+## Notes
+
+- Tests use temporary directories that are cleaned up after execution
+- All file operations are isolated to test directories
+- Environment variables are restored after tests
+- Tests can run in parallel (each uses its own temp directory)

package/bugmole.config.yaml

@@ -0,0 +1,39 @@
+version: 1
+name: Bugmole MCP
+
+runtime:
+  env: ${BUGMOLE_ENV:-sandbox}
+  workspace_id: ${BUGMOLE_WORKSPACE_ID:-default}
+  artifacts_dir: ${BUGMOLE_ARTIFACTS_DIR:-./qa/bugmole-runs}
+  spec_dir: ${BUGMOLE_SPEC_DIR:-./spec}
+
+llm:
+  provider: ${LLM_PROVIDER:-manual}
+  api_key: ${LLM_API_KEY:-not-set}
+  model: ${LLM_MODEL:-manual-review}
+  base_url: ${LLM_BASE_URL}
+
+mcp:
+  enabled: ${MCP_ENABLED:-true}
+  host: ${MCP_HOST:-127.0.0.1}
+  port: ${MCP_PORT:-3187}
+
+execution:
+  driver: ${BUGMOLE_DRIVER:-maestro}
+  maestro:
+    command: ${MAESTRO_COMMAND:-maestro}
+    timeout_ms: ${MAESTRO_TIMEOUT_MS:-300000}
+  playwright:
+    base_url: ${PLAYWRIGHT_BASE_URL:-http://localhost:3010}
+    headless: ${PLAYWRIGHT_HEADLESS:-true}
+  retries:
+    step: 2
+    journey: 1
+
+# Optional: Project directory to open in Cursor for testing
+# If specified, will open a new Cursor window in this directory before running tests
+cursor_driver:
+  # Self-QA explores the dashboard app under apps/qa, not the monorepo root,
+  # so that is the default — but this stays overridable, because the same
+  # config is used when pointing Bugmole at any other project.
+  project_directory: ${CURSOR_PROJECT_DIRECTORY:-apps/qa}

package/package.json

@@ -0,0 +1,85 @@
+{
+  "name": "@bugmole/cli",
+  "version": "0.4.0",
+  "private": false,
+  "publishConfig": {
+    "access": "public"
+  },
+  "description": "Bugmole CLI and MCP server for autonomous QA and smoke testing.",
+  "type": "module",
+  "engines": {
+    "node": ">=22"
+  },
+  "main": "scripts/bugmole.ts",
+  "files": [
+    "scripts/",
+    "src/",
+    "spec/",
+    "LICENSE",
+    "README.md",
+    "TESTING.md",
+    ".bugmole.env.example",
+    "tsconfig.json",
+    "bugmole.config.yaml"
+  ],
+  "bin": {
+    "bugmole": "scripts/bugmole.cjs",
+    "bm": "scripts/bugmole.cjs"
+  },
+  "scripts": {
+    "postinstall": "node scripts/ensure-maestro.cjs",
+    "bugmole:mcp": "NODE_OPTIONS=--max-old-space-size=512 tsx --no-cache scripts/bugmole.ts --mcp",
+    "bugmole:explore": "NODE_OPTIONS=--max-old-space-size=512 tsx scripts/bugmole.ts --mode explore",
+    "bugmole:plan": "NODE_OPTIONS=--max-old-space-size=512 tsx scripts/bugmole.ts --mode plan",
+    "bugmole:run": "NODE_OPTIONS=--max-old-space-size=512 tsx scripts/bugmole.ts --mode run",
+    "bugmole:propose-diff": "NODE_OPTIONS=--max-old-space-size=512 tsx scripts/bugmole.ts --mode propose-diff",
+    "bugmole:review": "NODE_OPTIONS=--max-old-space-size=512 tsx scripts/bugmole.ts --mode review",
+    "bugmole:report": "NODE_OPTIONS=--max-old-space-size=512 tsx scripts/bugmole.ts --mode report",
+    "bugmole:cursor-driver": "NODE_OPTIONS=--max-old-space-size=512 tsx scripts/bugmole.ts --mode cursor-driver",
+    "bugmole:init-env": "NODE_OPTIONS=--max-old-space-size=512 tsx scripts/bugmole.ts --mode init-env",
+    "bugmole:init": "NODE_OPTIONS=--max-old-space-size=512 tsx scripts/bugmole.ts init",
+    "bugmole:cursor-init": "NODE_OPTIONS=--max-old-space-size=512 tsx scripts/bugmole-init.ts",
+    "bugmole:continue": "NODE_OPTIONS=--max-old-space-size=512 tsx scripts/bugmole-continue.ts",
+    "registry:dev": "wrangler dev --local",
+    "registry:deploy": "wrangler deploy",
+    "registry:migrate": "wrangler d1 migrations apply valkyrie-registry --remote",
+    "runner:dev": "wrangler dev -c wrangler.runner.jsonc",
+    "runner:deploy": "wrangler deploy -c wrangler.runner.jsonc",
+    "sync:catalog": "node scripts/sync-plan-catalog.mjs",
+    "test": "NODE_OPTIONS=--max-old-space-size=512 tsx --test --test-concurrency=1 scripts/bugmole.test.ts src/mcp/server.test.ts projects/registry.test.ts src/integrations/testflight-feedback.test.ts src/integrations/temp-email.test.ts src/storage/object-store.test.ts src/storage/local-artifact-server.test.ts src/storage/storage-directory.test.ts src/runtime/reset.test.ts src/runtime/serve-gateway.test.ts src/registry/task-scheduling.test.ts src/registry-worker/artifacts.test.ts src/registry-worker/runs.test.ts src/registry-worker/org/routes.test.ts src/registry-worker/billing/billing-core.test.ts src/registry-worker/billing/paypal.test.ts src/registry-worker/ai/routes.test.ts src/registry-worker/runner/runner.test.ts src/registry-worker/signup/signup.test.ts src/registry-worker/notifications/notifications.test.ts src/registry-worker/github/checks.test.ts src/registry-worker/gitlab/checks.test.ts src/registry-worker/personas/personas.test.ts src/registry-worker/feedback/feedback.test.ts src/registry-worker/devices/devices.test.ts src/registry-worker/domains/domains.test.ts src/registry-worker/sso/sso.test.ts src/registry-worker/mcp/mcp.test.ts src/integrations/github-app.test.ts src/runtime/run-once.test.ts src/runtime/appium-driver.test.ts src/integrations/aws-sigv4.test.ts src/runtime/ai-work.test.ts src/billing/plan-catalog.test.ts src/mcp/write-test-cases.test.ts src/runtime/pipeline.test.ts src/runtime/planner.test.ts src/runtime/test-case-verdicts.test.ts src/runtime/journey-graph.test.ts src/runtime/journey-evidence.test.ts src/runtime/local-browser.test.ts src/runtime/serve-worker.test.ts src/runtime/cursor-driver-run.test.ts src/runtime/explorer.test.ts src/runtime/nav-crawl.test.ts src/runtime/app-understanding.test.ts src/runtime/environment.test.ts src/runtime/blocker-resolution.test.ts src/runtime/ui-reverse-engineering/coordinator.test.ts src/runtime/maestro-driver.test.ts src/runtime/playwright-driver.test.ts src/runtime/flow-language.test.ts src/runtime/web-suite.test.ts src/runtime/canonical-flow.test.ts src/runtime/executor.test.ts src/runtime/ios-screen-record.test.ts src/runtime/android-screen-record.test.ts src/runtime/reviewer.test.ts src/runtime/reporter.test.ts src/runtime/cursor-cli-driver.test.ts src/runtime/local-registry-stub.test.ts src/runtime/browser-matrix.test.ts src/runtime/browser-matrix.integration.test.ts src/runtime/failure-analysis.test.ts src/runtime/site-discovery.test.ts src/runtime/ai-exploration.test.ts src/runtime/discovery-task.test.ts",
+    "test:mcp": "NODE_OPTIONS=--max-old-space-size=512 tsx --test --test-concurrency=1 scripts/bugmole.test.ts src/mcp/server.test.ts projects/registry.test.ts src/integrations/testflight-feedback.test.ts src/storage/object-store.test.ts src/runtime/maestro-driver.test.ts src/runtime/canonical-flow.test.ts",
+    "typecheck": "NODE_OPTIONS=--max-old-space-size=512 tsc --noEmit"
+  },
+  "keywords": [
+    "e2e",
+    "testing",
+    "qa",
+    "playwright",
+    "ai",
+    "automation"
+  ],
+  "author": "",
+  "license": "UNLICENSED",
+  "dependencies": {
+    "@aws-sdk/client-s3": "^3.1085.0",
+    "@aws-sdk/s3-request-presigner": "^3.1085.0",
+    "@google-cloud/storage": "^8.0.1",
+    "@types/ws": "^8.18.1",
+    "dotenv": "^17.4.2",
+    "playwright": "^1.62.1",
+    "tsx": "^4.7.0",
+    "ws": "^8.21.1",
+    "yaml": "^2.4.0"
+  },
+  "devDependencies": {
+    "@cloudflare/containers": "^0.3.7",
+    "@types/node": "^26.4.0",
+    "typescript": "^7.0.2",
+    "wrangler": "^4.110.0"
+  },
+  "overrides": {
+    "gaxios": {
+      "uuid": "^11.1.1"
+    }
+  }
+}