@debugg-ai/debugg-ai-mcp 4.1.0 → 4.2.0

package/README.md

@@ -75,7 +75,7 @@ Runs an AI browser agent against your app. The agent navigates, interacts, and r
 | `username` | string | Username for login (ephemeral — not persisted) |
 | `password` | string | Password for login (ephemeral — not persisted) |
 | `loginCredentials` | array | Accounts for logins the agent hits **during** the task — `[{username, password, label?}]` |
-| `useEnvironmentCredentials` | boolean | Default `true`. `false` forbids auto-filling the environment's stored credentials |
+| `useEnvironmentCredentials` | boolean | Default `true`. `false` forbids auto-filling the environment's stored credentials; with no account named it means **do not log in at all** |
 | `freshSession` | boolean | Default `false`. `true` forces a real login instead of reusing the warm session held for that account |
 | `auth` | object | Auth precondition — `{precondition, entryUrl, deepUrl, environmentId, username, password}` |
 | `repoName` | string | Override auto-detected git repo name (e.g. `my-org/my-repo`) |
@@ -90,7 +90,9 @@ Naming an account only in `description` does **not** make the agent use it — i
 - `auth.username` / `auth.password` — pins the precondition login when you also use `auth.precondition: "login"`.
 - `loginCredentials` — accounts for a login form the agent reaches **part-way through** the task. This is the one for flows like *set a password → get bounced to sign-in → log in as the account you just created*, where splitting into separate calls would lose browser state.
 
-Set `useEnvironmentCredentials: false` when a silent fallback to the default test user would invalidate the check. The call is rejected if you opt out without naming an account, since the run would have no way to authenticate.
+Set `useEnvironmentCredentials: false` when a silent fallback to the default test user would invalidate the check.
+
+**Checking a page that needs no login at all?** Pass `useEnvironmentCredentials: false` and name no account. That combination means exactly what it says — *do not log in* — and the run skips authentication entirely instead of hunting for a login form. Use it for public pages, marketing sites, docs, and anything pre-auth. It is also faster: on the default (`auto`) the agent will follow a "Log in" link off your page and try the environment's stored account before it evaluates anything.
 
 ##### Session reuse: why a check can report "no login form"
 

package/dist/handlers/testPageChangesHandler.js

@@ -3,6 +3,7 @@
  * Executes the App Evaluation Workflow via the 4-step pattern:
  *   find template → execute → poll → result
  */
+import { meansDoNotLogIn, } from '../types/index.js';
 import { config } from '../config/index.js';
 import { Logger } from '../utils/logger.js';
 import { handleExternalServiceError } from '../utils/errors.js';
@@ -419,6 +420,18 @@ async function testPageChangesHandlerInner(input, context, rawProgressCallback)
         if (input.useEnvironmentCredentials === false) {
             env.useEnvironmentCredentials = false;
         }
+        // sentinal-oj7dp.3: opting out of the environment's credentials WITHOUT naming
+        // an account means "do not log in" — say so in the language the backend already
+        // speaks instead of leaving auth_mode on its 'auto' default. On 'auto' the auth
+        // subworkflow hunts for a login on a page that needs none: measured 2026-08-18,
+        // a public-homepage check spent 38 of its 111 seconds following the site's login
+        // link to a sibling host, submitting the environment's default credential three
+        // times, and parking the browser on a login screen the run was then graded
+        // against (execution 2c787273). no_auth short-circuits that cleanly and marks
+        // the run auth.skipped, which is explicitly NOT an auth failure (sentinal-76f8y.12).
+        if (meansDoNotLogIn(input)) {
+            contextData.auth_mode = 'no_auth';
+        }
         // Same rule for the session opt-out: send it only when it IS one, so the
         // default (reuse a warm session when one exists for this account) is
         // expressed by absence rather than by an explicit false.

package/dist/types/index.js

@@ -66,14 +66,23 @@ export const TestPageChangesInputSchema = z.object({
     freshSession: z.boolean().optional(),
     // Auth-precondition deep-link intent (bead 56kd.6) — "log in THEN go to X".
     auth: AuthPreconditionSchema.optional(),
-}).refine((v) => !(v.useEnvironmentCredentials === false
-    && !v.username && !v.credentialId && !v.credentialRole
-    && !(v.loginCredentials && v.loginCredentials.length > 0)
-    && !v.auth?.username), {
-    message: 'useEnvironmentCredentials:false leaves the run with no way to authenticate. '
-        + 'Pass username/password, credentialId, credentialRole, or loginCredentials alongside it.',
-    path: ['useEnvironmentCredentials'],
 });
+/**
+ * True when the caller opted out of the environment's credentials AND named no
+ * account of their own — i.e. "do not log in at all".
+ *
+ * This used to be a hard validation error ("leaves the run with no way to
+ * authenticate"), which made the single most common check — "is my PUBLIC page
+ * still up?" — the one thing the tool refused to express. It is not an error; it
+ * is an instruction, and the backend already has the enum for it
+ * (auth_mode: no_auth, sentinal-i7fnc). See sentinal-oj7dp.3.
+ */
+export function meansDoNotLogIn(v) {
+    return v.useEnvironmentCredentials === false
+        && !v.username && !v.credentialId && !v.credentialRole
+        && !(v.loginCredentials && v.loginCredentials.length > 0)
+        && !v.auth?.username;
+}
 export const TriggerCrawlInputSchema = z.object({
     url: z.preprocess(normalizeUrl, z.string().url('Invalid URL. Pass a full URL like "http://localhost:3000" or "https://example.com". Localhost URLs are auto-tunneled to the remote browser.')),
     projectUuid: z.string().uuid().optional(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@debugg-ai/debugg-ai-mcp",
-  "version": "4.1.0",
+  "version": "4.2.0",
   "description": "Zero-Config, Fully AI-Managed End-to-End Testing for all code gen platforms.",
   "type": "module",
   "caddy": "2.11.3",