@flowriki/agent 0.1.0-beta.62 → 0.1.0-beta.63

package/dist/{chunk-YCFTNJQU.js → chunk-IFUODU4W.js}

@@ -658,6 +658,7 @@ import { z as z9 } from "zod";
 import { z as z10 } from "zod";
 import { z as z11 } from "zod";
 import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 var EngineSchema = z3.enum(["chromium", "firefox", "webkit", "android", "ios"]);
 var CapabilitySchema = z3.object({
   id: z3.string(),
@@ -1858,6 +1859,13 @@ var RunMemorySchema = z12.object({
   buckets: z12.array(Bucket).max(RUN_MEMORY_WEEKS + 1),
   updatedAt: z12.number()
 }).strict();
+var WhatToDoSchema = z13.object({
+  id: z13.string().regex(/^wtd_/),
+  projectId: z13.string().min(1),
+  /** Step ids skipped — "we do this differently". */
+  skipped: z13.array(z13.string().min(1).max(80)).max(100),
+  updatedAt: z13.string()
+}).strict();
 
 // ../engine-appium/dist/index.js
 import path5 from "path";

package/dist/{chunk-GPSLXDGQ.js → chunk-QIZZ4HZ7.js}

@@ -68,7 +68,7 @@ import {
   textIndependent,
   validateActors,
   webCloudOf
-} from "./chunk-YCFTNJQU.js";
+} from "./chunk-IFUODU4W.js";
 
 // src/engine/machine.ts
 import fs from "fs";
@@ -76,7 +76,7 @@ import os from "os";
 import path from "path";
 import { createRequire } from "module";
 import { spawnSync } from "child_process";
-var AGENT_VERSION = "0.1.0-beta.62";
+var AGENT_VERSION = "0.1.0-beta.63";
 async function prepareBrowsers() {
   if (browsersReady()) {
     return { ok: true, already: true, message: "chromium is already installed" };
@@ -136,7 +136,7 @@ async function checkMachine() {
     }
   } catch {
   }
-  const { mobileDoctor: mobileDoctor2 } = await import("./dist-EGC7VEBG.js");
+  const { mobileDoctor: mobileDoctor2 } = await import("./dist-Z67YCHL5.js");
   return {
     agentVersion: AGENT_VERSION,
     node: process.versions.node,

package/dist/cli.js

@@ -24,7 +24,7 @@ import {
   runtimeValue,
   start,
   status
-} from "./chunk-GPSLXDGQ.js";
+} from "./chunk-QIZZ4HZ7.js";
 import {
   CLOUD_PROVIDERS,
   CLOUD_PROVIDER_NAME,
@@ -52,7 +52,7 @@ import {
   slugify,
   stepRefusedOn,
   targetFor
-} from "./chunk-YCFTNJQU.js";
+} from "./chunk-IFUODU4W.js";
 
 // src/cli.ts
 import { parseArgs } from "util";
@@ -433,6 +433,22 @@ var STEP_TIMEOUT_MS = 1e4;
 var SECRET_WORDS = /password|passwd|pass[-_\s]?code|pwd|secret|otp|one[-_\s]?time[-_\s]?(code|pass)|security[-_\s]?(code|answer)|cvv|cvc|\bpin\b/i;
 var TYPED = "typed_";
 var withoutTyped = (steps) => steps.map((st) => st.secretRef?.startsWith(TYPED) ? (({ secretRef: _, ...rest }) => rest)(st) : st);
+var SIGN_UP = /\b(sign[\s-]?up|register|registration|create (an |your )?account|join)\b/i;
+function shapeOf(draft, typed) {
+  const fills = draft.steps.filter((st) => st.type === "fill" && !st.disabled);
+  const values = {};
+  for (const st of fills) {
+    const value = st.secret ? st.secretRef ? typed.get(st.secretRef) : void 0 : st.value;
+    if (st.name && typeof value === "string") values[st.name] = value;
+  }
+  const base = { flowName: draft.name, platform: draft.platform ?? "web", values };
+  const secret = fills.some((st) => st.secret);
+  const fixed = Object.values(values).every((v) => !v.includes("{{"));
+  if (!secret || !fixed || Object.keys(values).length !== fills.length) return { kind: null, ...base };
+  if (SIGN_UP.test(draft.name) || fills.length > 3) return { kind: "signup", ...base };
+  if (draft.signIn || draft.after?.length) return { kind: null, ...base };
+  return { kind: "login", ...base };
+}
 var ACTIONS = [
   "click",
   "dblclick",
@@ -756,6 +772,14 @@ ${view}`;
     }
     if (this.liveCase) await this.sendCaseReport();
   }
+  /** What the last saved flow was — a login sign-in can be made from, a
+   *  sign-up — with the values it typed. Taken once. */
+  lastSaved = null;
+  takeLastSaved() {
+    const saved = this.lastSaved;
+    this.lastSaved = null;
+    return saved;
+  }
   // ── The test case a recording is for ────────────────────────────────
   //
   // A PERSON THINKS IN TEST CASES. The flows are how the assistant makes one
@@ -1181,6 +1205,7 @@ Fix the step that failed (remove_step, then act again) and save again \u2014 or
     const note = others.length ? `
 Claude has ${others.length} other open branch${others.length === 1 ? "" : "es"} on this project \u2014 gather_branches puts them into this one, for one review.` : "";
     const after = draft.after?.length ? ` It starts after ${draft.after.map((a) => `"${a.name}"`).join(", ")}.` : "";
+    this.lastSaved = { projectId: draft.projectId, ...shapeOf(draft, this.typed) };
     this.dropDraft(draft.projectId, draft.name);
     const live = this.liveCase;
     if (live && live.projectId === draft.projectId) {
@@ -1495,12 +1520,36 @@ THE MODEL \u2014 get this right before recording anything:
   write_test_cases. To automate one, record the flows its steps need, then
   save_case with the SAME name in the SAME folder: that fills it, and its
   business steps stay. Its Then lines are the checks to switch on.
-- SIGN-IN is shared setup: a flow or case that needs somebody signed in uses a
-  sign-in profile from the catalog (start_flow's signIn), never typed login steps.
-  None yet? Make it: record the login as a flow that ends with a check proving
-  it worked (the account menu, a heading, the URL), then create_sign_in from it
-  and create_account for each person who signs in (a customer, an admin). The
-  login flow types into its fields; the account supplies the values.
+- AUTHENTICATION IS YOURS, END TO END. The person records nothing by hand and
+  is not asked to set sign-in up. A flow or case that needs somebody signed in
+  starts signed in with a sign-in profile (start_flow's signIn) \u2014 never typed
+  login steps. Use one from project_catalog made on the SAME platform, with an
+  account for the role. None yet? Make it, without asking:
+  1. A test account, in this order: credentials the person gave you; a demo
+     login the app itself shows; or SIGN UP a dedicated test user yourself \u2014 a
+     fixed address for the role (e.g. flowriki.customer@ the domain of the
+     project's mailbox helper) and a strong password you invent (it is sealed
+     in the vault). Sign it up once; it is reused by every run.
+  2. Record the login as a flow on that platform that ends with a check proving
+     it worked (the account menu, a heading, the URL), then create_sign_in from
+     it \u2014 one per platform per role, e.g. "Customer sign-in" \u2014 and
+     create_account with the test user's values.
+  3. Only what you cannot create yourself \u2014 an admin, a role only staff can
+     grant, a mailbox when sign-up must verify an email and the catalog has no
+     mailbox helper \u2014 is asked of the person: once, saying exactly what you
+     need, while you carry on with everything else.
+- AUTHENTICATION IS ALSO A PRODUCT AREA TO TEST. Asked to test sign-up,
+  sign-in, accounts or security, cover it as a tester would \u2014 each its own
+  test case, in folders such as "Account \u2013 Sign up", "Account \u2013 Sign in":
+  sign up (valid; an email already taken; a weak password; required fields
+  missing), sign in (valid; wrong password; unknown email; empty fields),
+  password reset (request it, set a new one through the mailbox helper),
+  sign out (and Back cannot return to a signed-in page), a signed-in page
+  opened while signed out goes to sign-in, a session survives a reload,
+  lockout or throttling after repeated wrong passwords (stop at the limit plus
+  one), and roles (a customer cannot reach an admin page). Test the app's own
+  behaviour only: no attacks, no load, no other systems, no real person's
+  account.
 - HELPERS (an inbox for email codes, an authenticator, SMS, an API call) are made
   with create_helper when the catalog has none that fits.
 - SEVERAL ELEMENTS WITH THE SAME NAME (two "Proceed to Checkout" buttons, twelve
@@ -1510,8 +1559,9 @@ THE MODEL \u2014 get this right before recording anything:
 - PASSWORDS AND KEYS never go into a flow or a reply. Typed into a password
   field, a value is kept as a secret and saved to the project's vault; given to
   create_account or create_helper, it is sealed there too and never shown back.
-  Only use credentials the person gave you or that the app itself shows for
-  testing (a demo login) \u2014 never guess or reuse anyone's real password.
+  Only use credentials the person gave you, that the app itself shows for
+  testing (a demo login), or of a test user you signed up yourself \u2014 never
+  guess or reuse anyone's real password.
 - FOLDERS do not nest. Name each one after the product area and what is in it,
   the way a tester would look for it \u2014 "Account \u2013 Sign up", "Account \u2013 Sign in",
   "Ordering \u2013 Pizza builder", "Checkout \u2013 Payment". Flows (features) and the
@@ -1698,6 +1748,33 @@ function authoringTools(service, session) {
     const lines = session.caseLinesFor(spec.name);
     return lines ? { ...spec, businessSteps: lines } : spec;
   };
+  const signInFrom = async (shape) => {
+    if (!shape?.kind) return "";
+    const NAME = { web: "Web", android: "Android", ios: "iOS" };
+    if (shape.kind === "signup") {
+      return `
+
+That signed up a fixed test user. Next: record the login as that user on ${NAME[shape.platform]} (a flow that types its email or username and password, then checks it is signed in) \u2014 saving it sets sign-in up for the project.`;
+    }
+    try {
+      const catalog = await catalogOf(shape.projectId, true);
+      const same = catalog.signIns.find((si) => (si.platform ?? "web") === shape.platform);
+      if (same) return `
+
+${NAME[shape.platform]} already has the sign-in "${same.name}" (profileId ${same.profileId}) \u2014 use it with start_flow signIn.`;
+      const made = await service.createSignIn(shape.projectId, { flow: shape.flowName, name: `${NAME[shape.platform]} sign-in` });
+      const values = Object.fromEntries(made.fields.flatMap((f) => shape.values[f.label] !== void 0 ? [[f.label, shape.values[f.label]]] : []));
+      const account = await service.createAccount(shape.projectId, { signIn: made.profileId, name: "Test user", values });
+      catalogs.delete(shape.projectId);
+      return `
+
+This is a login, so it is now the project's sign-in on ${NAME[shape.platform]}: "${made.name}" (profileId ${made.profileId}) with the account "${account.name}" (accountId ${account.accountId}; its secrets are in the vault). Every flow that needs somebody signed in starts with start_flow signIn {"profileId": "${made.profileId}", "accountId": "${account.accountId}"}.`;
+    } catch (error) {
+      return `
+
+It looks like a login, but sign-in could not be set up from it (${error.message.split("\n")[0]}) \u2014 create_sign_in and create_account can do it.`;
+    }
+  };
   const tools = [
     {
       name: "list_projects",
@@ -2027,10 +2104,13 @@ ${page}`);
         },
         additionalProperties: false
       },
-      run: async (args) => text(await session.save(str(args["title"]), {
-        ...str(args["branch"]) ? { changeId: str(args["branch"]) } : {},
-        ...args["newBranch"] === true ? { newBranch: true } : {}
-      }, { ...args["force"] === true ? { force: true } : {} }))
+      run: async (args) => {
+        const saved = await session.save(str(args["title"]), {
+          ...str(args["branch"]) ? { changeId: str(args["branch"]) } : {},
+          ...args["newBranch"] === true ? { newBranch: true } : {}
+        }, { ...args["force"] === true ? { force: true } : {} });
+        return text(saved + await signInFrom(session.takeLastSaved()));
+      }
     },
     {
       name: "list_my_branches",

package/dist/{dist-EGC7VEBG.js → dist-Z67YCHL5.js}

@@ -46,7 +46,7 @@ import {
   textOf,
   toolEnv,
   typesSecrets
-} from "./chunk-YCFTNJQU.js";
+} from "./chunk-IFUODU4W.js";
 export {
   AGENT_HOME,
   APPIUM_DIR,

package/dist/engine.js

@@ -9,8 +9,8 @@ import {
   resolveCheckouts,
   start,
   status
-} from "./chunk-GPSLXDGQ.js";
-import "./chunk-YCFTNJQU.js";
+} from "./chunk-QIZZ4HZ7.js";
+import "./chunk-IFUODU4W.js";
 export {
   AGENT_VERSION,
   browsersReady,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flowriki/agent",
-  "version": "0.1.0-beta.62",
+  "version": "0.1.0-beta.63",
   "description": "Run Flowriki UI tests on your own computer. Connects this machine to your Flowriki account.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",