npm - @ia-qa/pal - Versions diffs - 1.4.0 → 1.7.0 - Mend

@ia-qa/pal 1.4.0 → 1.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (32) hide show

package/README.md +31 -1
package/TUTORIAL.md +26 -2
package/dist/cli/index.js +38 -1
package/dist/cli/index.js.map +1 -1
package/dist/history.d.ts +2 -0
package/dist/history.js +1 -0
package/dist/history.js.map +1 -1
package/dist/mcp/server.d.ts +6 -0
package/dist/mcp/server.js +33 -1
package/dist/mcp/server.js.map +1 -1
package/dist/project.d.ts +11 -0
package/dist/project.js +2 -0
package/dist/project.js.map +1 -1
package/dist/report.js +17 -0
package/dist/report.js.map +1 -1
package/dist/run.d.ts +2 -0
package/dist/run.js +7 -0
package/dist/run.js.map +1 -1
package/dist/session.d.ts +5 -0
package/dist/session.js +3 -3
package/dist/session.js.map +1 -1
package/dist/tour.d.ts +37 -0
package/dist/tour.js +73 -2
package/dist/tour.js.map +1 -1
package/dist/ui/page.d.ts +15 -0
package/dist/ui/page.js +362 -0
package/dist/ui/page.js.map +1 -0
package/dist/ui/server.d.ts +100 -0
package/dist/ui/server.js +362 -0
package/dist/ui/server.js.map +1 -0
package/package.json +2 -2
package/skills/ia-qa-pal/SKILL.md +11 -0

package/dist/ui/page.js ADDED Viewed

@@ -0,0 +1,362 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderConsolePage = renderConsolePage;
+/**
+ * The console page: one self-contained document, no network resource, polling its own server.
+ *
+ * Every value that comes from the app or the disk is written with `textContent` — never HTML —
+ * because page names, persona names and runner output are data, and the report's rule that
+ * app-derived strings are escaped applies here with even less excuse: this page is live.
+ *
+ * Four panels, in the order somebody uses them: who the tour runs as, start one, watch it, see
+ * what it found. Counts are "X of Y", never a percentage — the same rule as everywhere else.
+ *
+ * It is allowed to be friendly, never to flatter: the confetti fires only when a tour that
+ * COMPARED something comes back clean. A first tour is "Baseline established" and gets none —
+ * celebrating a run that measured nothing would be the false green in a party hat.
+ */
+function renderConsolePage(token) {
+    return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>ia-qa-pal console</title>
+<style>
+:root{--bg:#fff7ed;--bg2:#f5f3ff;--card:#ffffff;--ink:#1c1917;--muted:#78716c;--line:#f1e7dc;--code:#faf5ef;--accent:#f97316;--accent2:#ec4899;--accent3:#8b5cf6;--ok:#10b981;--warn:#f59e0b;--bad:#ef4444;--info:#8b5cf6;--shadow:0 1px 2px #0000000a,0 8px 24px -12px #7c2d1233}
+@media (prefers-color-scheme:dark){:root{--bg:#0c0a09;--bg2:#110d1c;--card:#18151f;--ink:#fafaf9;--muted:#a8a29e;--line:#2a2433;--code:#221d2b;--shadow:0 1px 2px #0006,0 10px 30px -14px #000}}
+*{box-sizing:border-box}
+body{margin:0;min-height:100vh;color:var(--ink);font:15px/1.55 system-ui,-apple-system,"Segoe UI",Roboto,sans-serif;background:radial-gradient(1200px 500px at 10% -10%,#fdba7433,transparent 60%),radial-gradient(900px 500px at 100% 0%,#c4b5fd33,transparent 60%),linear-gradient(180deg,var(--bg),var(--bg2))}
+main{max-width:1000px;margin:0 auto;padding:22px 16px 60px}
+.hero{position:relative;overflow:hidden;border-radius:20px;padding:22px 24px;color:#fff;background:linear-gradient(120deg,var(--accent) 0%,var(--accent2) 55%,var(--accent3) 100%);box-shadow:0 18px 40px -20px #db277799}
+.hero:after{content:"";position:absolute;right:-60px;top:-60px;width:220px;height:220px;border-radius:50%;background:#ffffff22}
+.hero .top{display:flex;align-items:center;gap:14px;flex-wrap:wrap;position:relative;z-index:1}
+.mascot{width:54px;height:54px;border-radius:16px;background:#ffffff2e;display:grid;place-items:center;font-size:30px;animation:bob 3.2s ease-in-out infinite}
+@keyframes bob{0%,100%{transform:translateY(0) rotate(-3deg)}50%{transform:translateY(-4px) rotate(3deg)}}
+h1{font-size:24px;margin:0;letter-spacing:-.02em}
+.hello{opacity:.92;font-size:14px}
+.where{margin-top:10px;font-size:14px;opacity:.95;overflow-wrap:anywhere;position:relative;z-index:1}
+.chip{margin-left:auto;display:inline-flex;align-items:center;gap:8px;background:#ffffff2e;border-radius:999px;padding:5px 12px;font-size:13px;font-weight:600}
+.dot{width:9px;height:9px;border-radius:50%;background:#fff;opacity:.7}
+.dot.live{background:#4ade80;opacity:1;box-shadow:0 0 0 0 #4ade80aa;animation:pulse 1.4s infinite}
+@keyframes pulse{0%{box-shadow:0 0 0 0 #4ade80aa}100%{box-shadow:0 0 0 10px #4ade8000}}
+.grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(300px,1fr));gap:16px}
+.card{background:var(--card);border:1px solid var(--line);border-radius:16px;padding:18px 20px;margin:16px 0;box-shadow:var(--shadow)}
+.grid .card{margin:0}
+.grid{margin:16px 0}
+.card h2{font-size:16px;margin:0 0 12px;display:flex;align-items:center;gap:8px}
+.card h2 .ic{width:30px;height:30px;border-radius:10px;display:grid;place-items:center;font-size:16px;background:var(--code)}
+.row{display:flex;flex-wrap:wrap;align-items:center;gap:8px;margin:8px 0}
+button{font:inherit;border:1px solid var(--line);background:var(--card);color:var(--ink);border-radius:10px;padding:7px 14px;cursor:pointer;transition:transform .12s,box-shadow .12s,border-color .12s}
+button:hover:not(:disabled){transform:translateY(-1px);border-color:var(--accent);box-shadow:0 6px 14px -8px #f9731699}
+button.primary{background:linear-gradient(120deg,var(--accent),var(--accent2));border:0;color:#fff;font-weight:700;padding:10px 20px;font-size:16px}
+button:disabled{opacity:.5;cursor:not-allowed}
+select,input[type=text],input[type=password]{font:inherit;border:1px solid var(--line);background:var(--card);color:var(--ink);border-radius:10px;padding:7px 10px}
+input:focus,select:focus{outline:2px solid #f9731666;border-color:var(--accent)}
+label.check{display:inline-flex;align-items:center;gap:6px;color:var(--muted);font-size:14px}
+.pill{display:inline-block;border-radius:999px;padding:1px 10px;font-size:12px;font-weight:600;border:1px solid var(--line)}
+.pill.ok{color:var(--ok);border-color:var(--ok);background:#10b98112}.pill.bad{color:var(--bad);border-color:var(--bad);background:#ef444412}
+.pill.warn{color:var(--warn);border-color:var(--warn);background:#f59e0b12}.pill.info{color:var(--info);border-color:var(--info);background:#8b5cf612}
+.muted{color:var(--muted)}
+.avatar{width:34px;height:34px;border-radius:50%;display:grid;place-items:center;color:#fff;font-weight:700;font-size:14px;flex:none}
+.idle{display:flex;align-items:center;gap:12px;color:var(--muted)}
+.idle .big{font-size:30px}
+.bar{height:14px;border-radius:999px;background:var(--code);overflow:hidden;margin:12px 0 6px}
+.bar>i{display:block;height:100%;width:0;transition:width .5s;background:repeating-linear-gradient(45deg,var(--accent) 0 12px,var(--accent2) 12px 24px);background-size:34px 34px;animation:stripes 1s linear infinite}
+@keyframes stripes{to{background-position:34px 0}}
+.mood{display:inline-flex;align-items:center;gap:10px;border-radius:14px;padding:8px 14px;font-weight:800;font-size:18px}
+.mood.ok{background:#10b9811a;color:var(--ok)}.mood.warn{background:#f59e0b1a;color:var(--warn)}
+.mood.bad{background:#ef44441a;color:var(--bad)}.mood.info{background:#8b5cf61a;color:var(--info)}
+.stats{display:grid;grid-template-columns:repeat(auto-fit,minmax(110px,1fr));gap:10px;margin:12px 0}
+.stat{background:var(--code);border-radius:12px;padding:10px 12px}
+.stat b{display:block;font-size:22px;line-height:1.1}
+.stat span{font-size:12px;color:var(--muted)}
+.stat.ok b{color:var(--ok)}.stat.bad b{color:var(--bad)}.stat.warn b{color:var(--warn)}.stat.info b{color:var(--info)}
+.strip{display:flex;gap:6px;flex-wrap:wrap;margin:6px 0 10px}
+.strip i{width:14px;height:14px;border-radius:4px;display:block}
+.strip i.ok{background:var(--ok)}.strip i.warn{background:var(--warn)}.strip i.bad{background:var(--bad)}.strip i.info{background:var(--info)}
+a{color:var(--accent);font-weight:600}
+code,.line{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:13px;background:var(--code);border-radius:6px;padding:2px 6px;overflow-wrap:anywhere}
+.line{display:block;padding:8px 10px;margin-top:8px;white-space:pre-wrap}
+ul{list-style:none;margin:0;padding:0}
+li{padding:9px 0;border-top:1px dashed var(--line);display:flex;flex-wrap:wrap;align-items:center;gap:8px}
+li:first-child{border-top:0}
+.notice{border-left:4px solid var(--warn);background:#f59e0b14;border-radius:10px;padding:10px 12px;margin:10px 0;white-space:pre-wrap}
+.notice.bad{border-color:var(--bad);background:#ef444414}
+.notice.ok{border-color:var(--ok);background:#10b98114}
+.hidden{display:none!important}
+footer{color:var(--muted);font-size:13px;margin-top:24px;text-align:center}
+#confetti{position:fixed;inset:0;pointer-events:none;overflow:hidden;z-index:9}
+#confetti i{position:absolute;top:-12px;width:9px;height:14px;border-radius:2px;animation:fall 2.6s ease-in forwards}
+@keyframes fall{to{transform:translateY(105vh) rotate(720deg);opacity:.2}}
+@media (prefers-reduced-motion:reduce){*,*:before,*:after{animation:none!important;transition:none!important}}
+</style></head>
+<body><div id="confetti"></div><main>
+<header class="hero">
+  <div class="top">
+    <div class="mascot">🧭</div>
+    <div><h1>ia-qa-pal</h1><div class="hello" id="hello">Your QA pal — it walks your app and tells you what moved.</div></div>
+    <span class="chip"><span class="dot" id="liveDot"></span><span id="liveWord">Idle</span></span>
+  </div>
+  <div class="where" id="where">loading…</div>
+</header>
+<section class="card" id="whoCard">
+  <h2><span class="ic">👥</span>Who the tour runs as</h2>
+  <p class="muted" id="whoHelp">An admin and a guest see different apps. A tour never picks one for you.</p>
+  <ul id="personas"></ul>
+  <div class="row">
+    <input type="text" id="newPersona" placeholder="new user name, e.g. admin" maxlength="64" autocomplete="off" spellcheck="false">
+    <button id="addPersona">🔑 Log in as this user</button>
+  </div>
+  <div id="loginBox" class="notice hidden"></div>
+</section>
+<div class="grid">
+<section class="card">
+  <h2><span class="ic">🚀</span>Run a tour</h2>
+  <div class="row"><span class="muted">As</span><select id="tourPersona"></select></div>
+  <div class="row">
+    <label class="check"><input type="checkbox" id="optSuite"> also run my tests (which pages they visit)</label>
+  </div>
+  <div class="row">
+    <label class="check"><input type="checkbox" id="optStrict"> strict (drift behind clicks fails too)</label>
+  </div>
+  <div class="row"><button class="primary" id="startTour">Start the tour ▶</button></div>
+  <div id="tourNotice" class="notice hidden"></div>
+</section>
+<section class="card">
+  <h2><span class="ic">📡</span>Now</h2>
+  <div id="nowIdle" class="idle"><span class="big">💤</span><span id="nowIdleText">Nothing running. Start a tour and watch it walk your app here.</span></div>
+  <div id="nowRun" class="hidden">
+    <div class="row"><span class="pill info" id="phase"></span><span class="muted" id="count"></span></div>
+    <div class="bar"><i id="barFill"></i></div>
+    <div class="muted" id="page"></div>
+    <div class="line hidden" id="lastLine"></div>
+    <div class="row muted" id="beat"></div>
+  </div>
+</section>
+</div>
+<section class="card">
+  <h2><span class="ic">🏁</span>Last result</h2>
+  <div id="resultEmpty" class="idle"><span class="big">🗺️</span><span>No finished tour yet — the first one draws the map everything else is compared with.</span></div>
+  <div id="result" class="hidden">
+    <div class="row"><span class="mood" id="mood"></span><span id="resultHead"></span></div>
+    <div class="stats" id="stats"></div>
+    <div class="muted" id="resultCounts"></div>
+    <div class="row"><a id="reportLink" target="_blank" rel="noopener">Open the full report →</a></div>
+  </div>
+  <h2 style="margin-top:18px"><span class="ic">📈</span>History</h2>
+  <div class="strip" id="strip"></div>
+  <ul id="history"></ul>
+</section>
+<section class="card">
+  <h2><span class="ic">🔐</span>Secrets</h2>
+  <p class="muted">Listed by name only — a value is never shown here. You can type one in once, to store it in <span id="store"></span>; it goes nowhere else, and <code>.ia-qa/config.json</code> is not changed. A variable set in your shell still wins, so CI is unaffected. Secrets kept in AWS are not checked from this page — that would call AWS.</p>
+  <ul id="secrets"></ul>
+  <div class="row"><button id="checkSecrets">🔎 Check they resolve</button></div>
+  <div id="storeForm">
+    <div class="row">
+      <input type="text" id="secretName" maxlength="128" placeholder="Name, e.g. APP_PASSWORD" autocomplete="off" spellcheck="false">
+      <input id="secretValue" type="password" placeholder="Value" autocomplete="new-password" spellcheck="false">
+      <button id="storeSecret">💾 Store on this machine</button>
+    </div>
+  </div>
+  <p class="muted hidden" id="noStore">This machine has no credential store — export the variable in the shell that starts the console, or use <code id="setCmd"></code> where one exists.</p>
+  <div class="notice hidden" id="secretNotice"></div>
+</section>
+<footer>🏠 Local only · 127.0.0.1 · nothing on this page is sent anywhere · it stops by itself when you close the tab</footer>
+</main>
+<script>
+(() => {
+  const TOKEN = ${JSON.stringify(token)};
+  const q = (id) => document.getElementById(id);
+  const api = (p, body) => fetch(p + (p.includes('?') ? '&' : '?') + 't=' + TOKEN, body === undefined
+    ? { headers: { 'x-iaqa-token': TOKEN } }
+    : { method: 'POST', headers: { 'content-type': 'application/json', 'x-iaqa-token': TOKEN }, body: JSON.stringify(body) });
+  const el = (tag, text, cls) => { const e = document.createElement(tag); if (text != null) e.textContent = String(text); if (cls) e.className = cls; return e; };
+  const show = (id, on) => q(id).classList.toggle('hidden', !on);
+  const note = (id, text, tone) => { const n = q(id); n.textContent = text; n.className = 'notice' + (tone ? ' ' + tone : ''); n.classList.toggle('hidden', !text); };
+  const ago = (iso) => { const s = Math.max(0, Math.round((Date.now() - Date.parse(iso)) / 1000)); return s < 60 ? s + 's ago' : Math.floor(s / 60) + 'm' + String(s % 60).padStart(2, '0') + 's ago'; };
+  const span = (ms) => { const s = Math.round(ms / 1000); return s < 60 ? s + 's' : Math.floor(s / 60) + 'm' + String(s % 60).padStart(2, '0') + 's'; };
+  const MOOD = { clean: ['ok', '✅', 'Clean'], look: ['warn', '👀', 'Worth a look'], broken: ['bad', '🔥', 'Broken'], baseline: ['info', '📸', 'Baseline established'], 'no-answer': ['warn', '🤷', 'Could not answer'] };
+  const hue = (name) => { let h = 0; for (const c of name) h = (h * 31 + c.charCodeAt(0)) % 360; return h; };
+  const avatar = (name) => { const a = el('span', name.slice(0, 1).toUpperCase(), 'avatar'); a.style.background = 'linear-gradient(135deg,hsl(' + hue(name) + ' 80% 55%),hsl(' + ((hue(name) + 50) % 360) + ' 75% 50%))'; return a; };
+  const hour = new Date().getHours();
+  q('hello').textContent = (hour < 12 ? 'Good morning 👋' : hour < 18 ? 'Good afternoon 👋' : 'Good evening 👋') + ' Your QA pal walks your app and tells you what moved.';
+  let state = null;
+  let wasRunning = false;
+  function confetti() {
+    if (matchMedia('(prefers-reduced-motion: reduce)').matches) return;
+    const box = q('confetti'); const colors = ['#f97316', '#ec4899', '#8b5cf6', '#10b981', '#f59e0b'];
+    for (let i = 0; i < 90; i++) {
+      const p = el('i'); p.style.left = Math.random() * 100 + 'vw'; p.style.background = colors[i % colors.length];
+      p.style.animationDelay = Math.random() * 0.6 + 's'; p.style.animationDuration = 2 + Math.random() * 1.5 + 's';
+      box.appendChild(p);
+    }
+    setTimeout(() => { box.textContent = ''; }, 4500);
+  }
+  function renderPersonas(p) {
+    const list = q('personas'); list.textContent = '';
+    const people = (p.personas || []);
+    if (people.length === 0) list.appendChild(el('li', 'No named users yet — the tour runs with the single session, if there is one.', 'muted'));
+    for (const person of people) {
+      const li = el('li');
+      li.appendChild(avatar(person.name));
+      li.appendChild(el('strong', person.name));
+      li.appendChild(el('span', person.ready ? 'session saved' : 'never logged in', 'pill ' + (person.ready ? 'ok' : 'warn')));
+      const check = el('button', 'Check'); check.onclick = () => checkPersona(person.name, li);
+      const relog = el('button', person.ready ? 'Log in again' : 'Log in'); relog.onclick = () => startLogin(person.name);
+      li.append(check, relog);
+      list.appendChild(li);
+    }
+    const sel = q('tourPersona'); const keep = sel.value; sel.textContent = '';
+    if (people.length > 1) sel.appendChild(el('option', '— choose a user —')).value = '';
+    else sel.appendChild(el('option', people.length === 1 ? people[0].name : 'the single session')).value = people.length === 1 ? people[0].name : '';
+    if (people.length > 1) for (const person of people) sel.appendChild(el('option', person.name)).value = person.name;
+    if ([...sel.options].some((o) => o.value === keep)) sel.value = keep;
+  }
+  function renderRun(run) {
+    const running = run && run.status === 'running';
+    show('nowIdle', !running); show('nowRun', running);
+    q('liveDot').className = 'dot' + (running ? ' live' : ''); q('liveWord').textContent = running ? 'Tour running' : 'Idle';
+    q('startTour').disabled = !!running || !(state && state.project.setUp);
+    if (!running) { if (run && run.status === 'interrupted') q('nowIdleText').textContent = 'The last tour stopped before finishing (interrupted).'; return; }
+    const p = run.progress || {};
+    q('phase').textContent = p.phase || 'starting';
+    q('count').textContent = p.total ? (p.done || 0) + ' of ' + p.total + ' pages' : '';
+    q('barFill').style.width = p.total ? Math.round(((p.done || 0) / p.total) * 100) + '%' : '8%';
+    q('page').textContent = p.page ? '🚶 On ' + p.page : '';
+    show('lastLine', !!p.line); q('lastLine').textContent = p.line || '';
+    const quiet = run.updatedAt ? (Date.now() - Date.parse(run.updatedAt)) / 1000 : 0;
+    q('beat').textContent = 'Running ' + span(Date.now() - Date.parse(run.startedAt)) + ' · last heartbeat ' + ago(run.updatedAt) + (quiet > 90 ? ' — nothing heard for a while; it may be stuck on one long step' : '');
+  }
+  function stat(n, label, tone) { const s = el('div', null, 'stat ' + (tone || '')); s.appendChild(el('b', n)); s.appendChild(el('span', label)); return s; }
+  function renderResult(s) {
+    show('resultEmpty', !s); show('result', !!s);
+    if (!s) return;
+    const [tone, icon, word] = MOOD[s.mood] || ['info', '•', s.mood];
+    q('mood').className = 'mood ' + tone; q('mood').textContent = icon + ' ' + word;
+    q('resultHead').textContent = (s.refused ? 'Refused: ' + s.refused.split('\\n')[0] : s.mode + ' tour') + (s.persona ? ' · as ' + s.persona : '');
+    const box = q('stats'); box.textContent = '';
+    box.appendChild(stat(s.underContract + ' of ' + s.configured, 'pages under contract', 'info'));
+    const t = s.totals;
+    if (t) { box.appendChild(stat(t.ok, 'ok', 'ok')); box.appendChild(stat(t.lost, 'lost', t.lost ? 'bad' : '')); box.appendChild(stat(t.ambiguous, 'ambiguous', t.ambiguous ? 'warn' : '')); box.appendChild(stat(t.rebound, 'rebound', t.rebound ? 'bad' : ''));
+      // A row the verdict does not fail is still a row: a relabel that passed is shown, never folded into "ok".
+      for (const [k, tone] of [['renamed', 'info'], ['healable', 'warn'], ['added', '']]) if (t[k]) box.appendChild(stat(t[k], k, tone)); }
+    if (s.notMapped) box.appendChild(stat(s.notMapped, 'not mapped', 'warn'));
+    q('resultCounts').textContent = '⏱ took ' + span(s.durationMs);
+    q('reportLink').href = '/report?t=' + TOKEN;
+  }
+  function renderHistory(h) {
+    const list = q('history'); list.textContent = ''; const strip = q('strip'); strip.textContent = '';
+    if (!h.length) { list.appendChild(el('li', 'Nothing yet — every finished tour lands here.', 'muted')); return; }
+    for (const e of h) { const [tone, icon, word] = MOOD[e.mood] || ['info', '•', e.mood]; const d = el('i', null, tone); d.title = icon + ' ' + word + ' · ' + new Date(e.at).toLocaleString(); strip.appendChild(d); }
+    for (const e of h.slice().reverse().slice(0, 8)) {
+      const [tone, icon, word] = MOOD[e.mood] || ['info', '•', e.mood];
+      const li = el('li');
+      li.appendChild(el('span', icon + ' ' + word, 'pill ' + tone));
+      li.appendChild(el('span', new Date(e.at).toLocaleString()));
+      li.appendChild(el('span', e.underContract + ' of ' + e.configured + ' pages' + (e.persona ? ' · as ' + e.persona : ''), 'muted'));
+      list.appendChild(li);
+    }
+  }
+  function renderLogin(job) {
+    if (!job) { note('loginBox', ''); return; }
+    if (job.status === 'waiting') {
+      const box = q('loginBox'); box.className = 'notice'; box.textContent = '🪟 A browser window opened for ' + job.persona + '. Log in there — it is saved by itself the moment the app opens. ';
+      const done = el('button', 'I have logged in'); done.onclick = () => api('/api/persona/login/done', {});
+      box.appendChild(done);
+    } else note('loginBox', job.message || '', job.status === 'done' ? 'ok' : 'bad');
+  }
+  async function refresh() {
+    try {
+      state = await (await api('/api/state')).json();
+      const p = state.project;
+      q('where').textContent = p.setUp ? '🌐 ' + p.baseUrl + ' · ' + p.pages + ' pages' + (p.baseline ? '' : ' · no baseline yet') : 'This folder is not set up yet — run ia-qa-pal setup here.';
+      if (p.setUp) renderPersonas(p);
+      const running = !!(state.run && state.run.status === 'running');
+      renderRun(state.run); renderResult(state.summary); renderHistory(state.history || []); renderLogin(state.login);
+      // Only a tour that compared something and came back clean. A baseline measured nothing.
+      if (wasRunning && !running && state.summary && state.summary.mood === 'clean') confetti();
+      wasRunning = running;
+    } catch { q('where').textContent = 'The console stopped — start it again with ia-qa-pal ui.'; }
+  }
+  async function checkPersona(name, li) {
+    const r = await (await api('/api/persona/check', { persona: name })).json();
+    const old = li.querySelector('.verdict'); if (old) old.remove();
+    li.appendChild(el('span', (r.holds ? '✅ ' : '⚠️ ') + r.headline, 'verdict ' + (r.holds ? 'muted' : '')));
+  }
+  async function startLogin(name) {
+    const r = await api('/api/persona/login', { persona: name });
+    if (!r.ok) note('loginBox', (await r.json()).reason, 'bad'); else refresh();
+  }
+  q('addPersona').onclick = () => { const n = q('newPersona').value.trim(); if (n) { startLogin(n); q('newPersona').value = ''; } };
+  q('startTour').onclick = async () => {
+    note('tourNotice', '');
+    const body = { persona: q('tourPersona').value || undefined, suite: q('optSuite').checked, strict: q('optStrict').checked };
+    const r = await api('/api/tour', body); const out = await r.json();
+    if (out.started) note('tourNotice', '🚀 Started. Follow it on the right — you can close this tab, the tour keeps going.', 'ok');
+    else note('tourNotice', out.reason || 'Not started.', out.ask === 'persona' ? '' : 'bad');
+    refresh();
+  };
+  q('checkSecrets').onclick = async () => {
+    const r = await (await api('/api/secrets/check', {})).json();
+    const list = q('secrets'); list.textContent = '';
+    for (const c of r.checks) {
+      const li = el('li'); li.appendChild(el('strong', c.name)); li.appendChild(el('span', c.source, 'muted'));
+      li.appendChild(el('span', c.resolves === null ? 'not checked' : c.resolves ? (c.from === 'store' ? 'resolves · stored on this machine' : 'resolves') : 'missing', 'pill ' + (c.resolves === null ? 'info' : c.resolves ? 'ok' : 'bad')));
+      if (c.why) li.appendChild(el('span', c.why, 'muted'));
+      list.appendChild(li);
+    }
+    if (!r.checks.length) list.appendChild(el('li', 'No secret is referenced in .ia-qa/config.json.', 'muted'));
+  };
+  q('storeSecret').onclick = async () => {
+    const name = q('secretName').value.trim(); const value = q('secretValue').value;
+    // The field is emptied before the answer arrives: the value lives in this page only for the one request.
+    q('secretValue').value = '';
+    const out = await (await api('/api/secrets/set', { name, value })).json();
+    note('secretNotice', out.stored ? '🔒 "' + out.name + '" stored on this machine. A reference to that name now resolves, unless your shell sets the variable itself.' : (out.reason || 'Not stored.'), out.stored ? 'ok' : 'bad');
+  };
+  (async () => {
+    const s = await (await api('/api/secrets')).json();
+    q('setCmd').textContent = s.set; q('store').textContent = s.store;
+    const list = q('secrets');
+    show('storeForm', s.canStore); show('noStore', !s.canStore);
+    for (const ref of s.references) {
+      const li = el('li'); li.appendChild(el('strong', ref.name)); li.appendChild(el('span', ref.source + ' · ' + ref.key, 'muted'));
+      if (s.canStore && (ref.source === 'env' || ref.source === 'keychain')) {
+        const b = el('button', 'Set a value'); b.onclick = () => { q('secretName').value = ref.key; q('secretValue').focus(); }; li.appendChild(b);
+      }
+      list.appendChild(li);
+    }
+    if (!s.references.length) list.appendChild(el('li', 'No secret is referenced in .ia-qa/config.json.', 'muted'));
+  })();
+  refresh();
+  setInterval(refresh, 2000);
+  setInterval(() => api('/api/ping').catch(() => {}), 15000);
+  addEventListener('pagehide', () => navigator.sendBeacon && navigator.sendBeacon('/api/bye?t=' + TOKEN));
+})();
+</script>
+</body></html>`;
+}
+//# sourceMappingURL=page.js.map

package/dist/ui/page.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"page.js","sourceRoot":"","sources":["../../src/ui/page.ts"],"names":[],"mappings":";;AAcA,8CAuVC;AArWD;;;;;;;;;;;;;GAaG;AACH,SAAgB,iBAAiB,CAAC,KAAa;IAC7C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA0JS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eA2LxB,CAAC;AAChB,CAAC"}

package/dist/ui/server.d.ts ADDED Viewed

@@ -0,0 +1,100 @@
+import { probeSession, performLogin, storeKind, writeSecret, readSecret, type SecureServer } from '@ia-qa/self-healing';
+/**
+ * `ia-qa-pal ui` — launch a tour, follow it live, see what it found, manage who it runs as.
+ *
+ * The terminal is where a tour used to live, and that is where it broke for the people the
+ * package is for: a run that took fifteen minutes and said nothing, a login that stopped on a
+ * question, a report that ended on a command to copy. This console is the same four verbs —
+ * tour, status, report, login — for somebody who does not live in a terminal.
+ *
+ * **It has no authority of its own.** Every rule that makes a local console safe — loopback
+ * only, a per-process token, Host pinning, the CSP, the idle watchdog — comes from
+ * `startSecureServer`, the same function `ia-qa-heal ui` uses, so the two cannot drift apart
+ * on the part that must not. A tour is started by `startBackground` with a fixed argv, exactly
+ * as `ia-qa-pal tour --background` and the MCP start one: nothing from a request reaches a
+ * command line except a persona name, and that is held to the filename rule first.
+ *
+ * **Three things it deliberately does not do**, each a rule inherited rather than invented:
+ *  - It never SHOWS a secret value, and never writes one anywhere but this machine's OS
+ *    credential store. A value can be typed in once, to be stored — the same act as
+ *    `ia-qa-heal secret set <NAME>` — and the answer is "stored" or why not: never the value,
+ *    never its length, never logged. `.ia-qa/config.json` is never edited: an `env`
+ *    reference is answered by a stored value of the same name when the shell leaves it unset
+ *    (heal's `resolveSecret`), so CI, which sets the variable, is unchanged.
+ *  - It never checks an `aws-ssm` secret by itself: that is a call to AWS, and a flow that
+ *    leaves the machine is announced and asked for, never made on page load.
+ *  - It never picks a user. With several personas and none chosen, a tour is refused and the
+ *    page asks — the same door `map`, the tour and the MCP use.
+ */
+export interface PalUiOptions {
+    dir: string;
+    port?: number;
+    keepAlive?: boolean;
+    /** The pal CLI a background tour is spawned from. Default: this package's own. */
+    cliEntry?: string;
+    /** Injected so tests exercise the routes without a browser. */
+    login?: typeof performLogin;
+    probe?: typeof probeSession;
+    /** Injected so tests never write to the real credential store. */
+    store?: {
+        write: typeof writeSecret;
+        read: typeof readSecret;
+        kind: typeof storeKind;
+    };
+}
+interface LoginJob {
+    persona: string;
+    status: 'waiting' | 'done' | 'failed';
+    message?: string;
+    startedAt: string;
+    confirm: () => void;
+}
+/** What the page polls. Never the report itself — it can be large, and the page asks for it once. */
+export declare function consoleState(dir: string, job: LoginJob | null): Record<string, unknown>;
+/**
+ * Secrets, by name, with where each one lives — and nothing that could carry a value.
+ *
+ * The config's references (`secrets` in `.ia-qa/config.json`) plus the names in this machine's
+ * credential store. Both are names already: this function has nothing to leak even by mistake.
+ */
+export declare function consoleSecrets(dir: string): Record<string, unknown>;
+/**
+ * Does each referenced secret resolve? Yes, no, or deliberately not checked — never the value.
+ *
+ * `env` is presence in this console's own environment, which is the one a tour it starts
+ * inherits. `keychain` is a lookup in this machine's store, answered as a boolean. `aws-ssm`
+ * is **not checked**: resolving it is a call to AWS, and this package announces and asks for
+ * anything that leaves the machine instead of doing it because a page loaded.
+ */
+export declare function checkSecrets(dir: string): Array<{
+    name: string;
+    source: string;
+    resolves: boolean | null;
+    from?: string;
+    why?: string;
+}>;
+/** A name a store entry may carry: the shape of an environment variable, so one name serves both. */
+export declare const SECRET_NAME: RegExp;
+export type SetSecretAnswer = {
+    status: number;
+    body: {
+        stored: boolean;
+        name?: string;
+        reason?: string;
+    };
+};
+/**
+ * Store one value in this machine's credential store — and answer without it.
+ *
+ * Every answer is built from the NAME and a fixed reason; the value is never interpolated into
+ * one, never returned, never measured back. The write is read back before "stored" is said,
+ * the same rule `ia-qa-heal secret set` follows: a store that accepted and returns something
+ * else is a failure, not a success.
+ */
+export declare function setSecret(body: Record<string, unknown>, store: {
+    write: typeof writeSecret;
+    read: typeof readSecret;
+    kind: typeof storeKind;
+}): SetSecretAnswer;
+export declare function startPalUi(opts: PalUiOptions): Promise<SecureServer>;
+export {};