@bugmole/cli 0.4.0

package/spec/blockers.yaml

@@ -0,0 +1,79 @@
+# Bugmole MCP Blockers Specification for Arion Rent
+# Defines setup states and interruptions QA agents should treat carefully.
+
+blockers:
+  - name: supabase_schema_missing
+    type: setup_state
+    description: The page shows a setup warning when the Supabase project has credentials but app tables are missing.
+    selectors:
+      - "[data-testid='setup-warning']"
+      - "[role='alert']"
+    resolution:
+      strategy: document_and_continue
+      steps:
+        - capture_screenshot
+        - log: "Supabase schema is not ready; verify that the page does not crash."
+    hard_stop: false
+    on_encounter: record_setup_gap
+
+  - name: owner_write_form_disabled
+    type: expected_disabled_state
+    description: Owner write forms are disabled when the schema or runtime configuration is missing.
+    selectors:
+      - "form [disabled]"
+      - "button[disabled]"
+    resolution:
+      strategy: verify_disabled_state
+      steps:
+        - capture_screenshot
+        - log: "Owner write form disabled as expected."
+    hard_stop: false
+
+  - name: payment_record_missing
+    type: data_state
+    description: The sample payment page handles an unknown paymentId or a missing booking_payments table.
+    selectors:
+      - "[role='alert']"
+      - "[data-testid='payment-error']"
+    resolution:
+      strategy: document_and_continue
+      steps:
+        - capture_screenshot
+        - log: "The payment page handles the data error clearly."
+    hard_stop: false
+
+  - name: destructive_confirmation
+    type: dialog
+    description: QA does not confirm destructive operations on persistent data without explicit instruction.
+    selectors:
+      - "[role='dialog'][aria-label*='confirm']"
+      - "[data-testid='confirmation-dialog']"
+    resolution:
+      strategy: hard_stop_and_report
+      steps:
+        - capture_screenshot
+        - log: "Stop before destructive confirmation."
+    hard_stop: true
+    on_encounter: fail_test
+
+  - name: secret_value_requested
+    type: policy
+    description: Do not read or print secret values from .env, service-role keys, webhook secrets, or LLM keys.
+    selectors: []
+    resolution:
+      strategy: refuse_secret_output
+      steps:
+        - log: "Only confirm whether a secret is present; never print its value."
+    hard_stop: true
+    on_encounter: fail_test
+
+hard_stops:
+  - name: production_data_mutation
+    description: Stop if a QA flow is about to seed or write production/persistent Supabase data without confirmation.
+    condition: "environment == production OR target_database == persistent"
+    action: "fail_test_with_message Production or persistent data mutation needs explicit confirmation"
+
+  - name: secret_output
+    description: Stop if a step would print a local secret or server-only credential.
+    condition: "action == print_secret OR path matches .env"
+    action: "fail_test_with_message Secret output is not allowed"

package/spec/bugs.index.json

@@ -0,0 +1,42 @@
+{
+  "version": "1.0.0",
+  "bugs": [],
+  "metadata": {
+    "created_at": "2025-01-27T00:00:00Z",
+    "last_updated": "2025-01-27T00:00:00Z",
+    "total_bugs": 0,
+    "severity_distribution": {
+      "critical": 0,
+      "high": 0,
+      "medium": 0,
+      "low": 0
+    },
+    "status_distribution": {
+      "open": 0,
+      "in_progress": 0,
+      "resolved": 0,
+      "closed": 0
+    }
+  },
+  "categories": {
+    "public_booking": [],
+    "payments": [],
+    "owner_dashboard": [],
+    "documents": [],
+    "tracking": [],
+    "finance": [],
+    "supabase_setup": [],
+    "data_integrity": [],
+    "ui_ux": [],
+    "performance": [],
+    "api": []
+  },
+  "tags": [],
+  "filters": {
+    "by_severity": {},
+    "by_status": {},
+    "by_category": {},
+    "by_journey": {},
+    "by_role": {}
+  }
+}

package/spec/design-dna.schema.json

@@ -0,0 +1,38 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://app.bugmole.com/schemas/design-dna.schema.json",
+  "title": "Bugmole Project Design DNA",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "revision", "projectId", "spacing", "radii", "elevation", "colors", "motion", "iconography", "typography"],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "revision": { "type": "integer", "minimum": 1 },
+    "projectId": { "type": "string", "minLength": 1 },
+    "spacing": { "$ref": "#/$defs/tokens" },
+    "radii": { "$ref": "#/$defs/tokens" },
+    "elevation": { "$ref": "#/$defs/tokens" },
+    "colors": { "$ref": "#/$defs/tokens" },
+    "motion": { "$ref": "#/$defs/tokens" },
+    "iconography": { "$ref": "#/$defs/tokens" },
+    "typography": { "$ref": "#/$defs/tokens" },
+    "metadata": { "type": "object" }
+  },
+  "$defs": {
+    "tokens": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["id", "value", "provenance", "confidence"],
+        "properties": {
+          "id": { "type": "string" },
+          "value": {},
+          "aliases": { "type": "array", "items": { "type": "string" } },
+          "provenance": { "type": "array" },
+          "confidence": { "enum": ["high", "medium", "low", "blocked"] },
+          "locked": { "type": "boolean" }
+        }
+      }
+    }
+  }
+}

package/spec/domain_rules.yaml

@@ -0,0 +1,24 @@
+domain_rules:
+  - name: vietnamese_only_user_copy
+    description: Rental-app UI, metadata, setup/error states, labels, and payment instructions stay in Vietnamese; the standalone QA framework UI and documentation are English.
+    rule: "Rental-app user-facing text must be Vietnamese; QA framework surfaces must be English. Code identifiers and storage enums may remain English."
+
+  - name: supabase_missing_schema_handling
+    description: App must not crash when Supabase credentials exist but app tables have not been migrated.
+    rule: "Public and owner pages show setup/error states, and owner write forms remain disabled when required schema is missing."
+
+  - name: private_storage
+    description: Identity, vehicle, intake, template and booking document files remain private.
+    rule: "Private files are served through server-side signed URL flows, not broad anonymous Storage policies."
+
+  - name: payment_provider_boundary
+    description: Current real payment mode is Vietnam bank QR/manual transfer.
+    rule: "Payment pages show bank transfer instructions without exposing server-only webhook or service-role secrets."
+
+  - name: om_tracking_secret_headers
+    description: OM/GPS webhook accepts current and compatibility secret headers when configured.
+    rule: "POST /api/tracking/om accepts x-arion-om-secret, bearer token, and compatibility x-arion-webhook-secret only when the configured secret matches."
+
+  - name: screenshot_evidence_manifest
+    description: Browser evidence is manifest-backed.
+    rule: "Screenshots live under qa/screenshots and the current manifest lives at qa/browser-evidence.json."

package/spec/flows/flow_manage-to-plans-64c3c61b.yaml

@@ -0,0 +1,8 @@
+url: http://localhost:3020/plans?project=bugmole
+---
+- launchApp
+- assertVisible: "Coverage, as paths."
+- assertVisible: "Test plans"
+- tapOn: "Journey: flow:manage-to-plans-64c3c61b"
+- assertVisible: "Run tests"
+- tapOn: "Run tests"

package/spec/flows/flow_screen-to-evidence-6c3ab309.yaml

@@ -0,0 +1,7 @@
+url: http://localhost:3020/?project=bugmole
+---
+- launchApp
+- assertVisible: "Quality, as a flow."
+- tapOn: "App Audit"
+- assertVisible: "Every control, accounted for."
+- tapOn: "Open screenshot evidence"

package/spec/journey_graph.yaml

@@ -0,0 +1,126 @@
+# Journey Graph - Arion Rent MVP Routes and User Journeys
+# Keep this aligned with ../../QA_TEST_PLAN.md and qa/browser-evidence.json.
+
+journeys:
+  - id: "marketing-entry"
+    name: "Marketing Entry"
+    description: "Customer visits the Arion Rent landing page and starts the booking flow."
+    screens:
+      - path: "/"
+        component: "LandingPage"
+        type: "marketing"
+    actions:
+      - type: "navigate"
+        target: "/book"
+
+  - id: "public-booking"
+    name: "Public Booking"
+    description: "Customer views vehicles, checks rental dates, submits a booking request, and views deposit payment instructions."
+    screens:
+      - path: "/book"
+        component: "PublicBookingPage"
+        type: "list"
+      - path: "/book/[vehicleId]"
+        component: "VehicleBookingPage"
+        type: "form"
+      - path: "/book/requested"
+        component: "BookingRequestedPage"
+        type: "confirmation"
+      - path: "/book/payments/[paymentId]"
+        component: "BookingPaymentPage"
+        type: "payment"
+    actions:
+      - type: "filter_availability"
+      - type: "preview_quote"
+      - type: "request_booking"
+      - type: "view_bank_transfer_instructions"
+
+  - id: "owner-operations"
+    name: "Owner Operations"
+    description: "Owner navigates the dashboard, calendar, bookings, vehicles, customers, documents, income and expenses, and tracking."
+    screens:
+      - path: "/owner#overview"
+        component: "OwnerDashboard"
+        type: "dashboard"
+      - path: "/owner#calendar"
+        component: "OwnerCalendarSection"
+        type: "schedule"
+      - path: "/owner#orders"
+        component: "OwnerOrdersSection"
+        type: "list"
+      - path: "/owner#vehicles"
+        component: "OwnerVehiclesSection"
+        type: "list"
+      - path: "/owner#customers"
+        component: "OwnerCustomersSection"
+        type: "list"
+      - path: "/owner#create-booking"
+        component: "OwnerCreateBookingSection"
+        type: "form"
+      - path: "/owner#documents"
+        component: "OwnerDocumentsSection"
+        type: "documents"
+      - path: "/owner#income-expense"
+        component: "OwnerIncomeExpenseSection"
+        type: "finance"
+      - path: "/owner#tracking"
+        component: "OwnerTrackingSection"
+        type: "tracking"
+    actions:
+      - type: "verify_setup_warning_when_schema_missing"
+      - type: "verify_write_forms_disabled_when_schema_missing"
+      - type: "capture_section_screenshots"
+
+  - id: "finance-reporting"
+    name: "Finance Reporting"
+    description: "Owner views ROI, CAC, cash flow, vehicle loans, and forecasts using typed sample data."
+    screens:
+      - path: "/owner/reports"
+        component: "OwnerReportsPage"
+        type: "report"
+    actions:
+      - type: "verify_report_cards"
+      - type: "verify_finance_calculations"
+
+  - id: "webhooks"
+    name: "Webhook Contracts"
+    description: "Verify payment and OM/GPS tracking webhook contracts without exposing secrets."
+    screens:
+      - path: "/api/payments/webhook"
+        component: "PaymentWebhookRoute"
+        type: "api"
+      - path: "/api/tracking/om"
+        component: "OmTrackingWebhookRoute"
+        type: "api"
+    actions:
+      - type: "validate_payment_webhook_secret_header"
+      - type: "validate_om_tracking_secret_headers"
+      - type: "verify_normalized_tracking_events"
+
+screens:
+  - path: "/"
+    type: "marketing"
+  - path: "/book"
+    type: "public"
+  - path: "/book/[vehicleId]"
+    type: "public"
+  - path: "/book/requested"
+    type: "public"
+  - path: "/book/payments/[paymentId]"
+    type: "public"
+  - path: "/owner"
+    type: "owner"
+  - path: "/owner/reports"
+    type: "owner"
+  - path: "/api/payments/webhook"
+    type: "api"
+  - path: "/api/tracking/om"
+    type: "api"
+
+navigation_groups:
+  - id: "public_booking"
+    items: ["landing", "book", "requested", "payment"]
+  - id: "owner_admin"
+    items: ["overview", "calendar", "orders", "vehicles", "customers", "documents", "tracking"]
+  - id: "finance"
+    items: ["income_expense", "reports"]