@ia-qa/self-healing 1.6.16 → 1.7.0

package/skills/ia-qa-heal/SKILL.md

@@ -50,14 +50,18 @@ exists only in a state nothing captured (behind a tab, a modal, a mode toggle).
 |---|---|
 | "my tests broke — fix them" | `run` (capture during their suite → diff → confirm → fix → re-run to verify) |
 | "did anything drift?" | `diff` → PASS/FIX/BLOCK (the CI gate) |
+| "the suite already ran with `IAQA_CAPTURE=1`" | `diff` — **on its own**. It picks up `.capture/` and never opens a browser. Do *not* re-run `run`, and never `map` (that re-captures from scratch, without the session the suite had) |
+| "their suite takes 20 min and `run` runs it twice" | `run --no-verify` — the second run is the post-fix verification, and it is optional. Say what they lose: the exit code then reflects the diff, not a re-proved green suite |
 | "day one, no baseline — is my suite still valid?" | `audit` |
 | "is the app I mapped even sound?" | `check` (dead links · unnamed elements · name collisions · orphan pages) |
-| "which pages am I *not* covering?" | `discover` (`--sitemap` / `--crawl`; suggests only) |
+| "which pages am I *not* covering?" | `discover` (`--sitemap` / `--crawl`; suggests only). Behind a login `--sitemap` sees nothing — `--crawl` is the one that works, and it reuses the session |
 | "give me the app's structure" | `graph --format mermaid\|svg\|json\|markdown` |
 | "apply the rewrites" | `fix` — `--dry-run` first, always |
 | "what do my tests actually use?" | `ingest` |
+| "their Page Objects are CSS — the diff says nothing is referenced" | `ingest` **then** `map`. The bindings in `mapping/_resolved/` are what connect their `.btn-primary` to the contract's `#pay-now`; without `usage.json` there are none, and every row reads `not referenced by your tests` |
 | "is this getting better or worse?" | `history` (`--json`) — the trend no single run can reconstruct |
 | "gate my pipeline on it" | `diff --junit <file>` — every major CI charts the trend natively |
+| `map` says "login wall" / the app is behind SSO | if a storageState already exists (most authenticated Playwright suites write one in `globalSetup`): `--session <file>`, `IAQA_SESSION`, or `"session"` in config.json — no second login. Otherwise tell the human to run `ia-qa-heal login` — **you cannot do it** (§4.12) |
 | "let me look at it / decide myself" | tell the human to run `ia-qa-heal ui` — **do not run it yourself** (§4.8) |
 | first-time setup | write `.ia-qa/config.json` directly — `init` is a TTY wizard and **will refuse in your shell** |
 
@@ -127,6 +131,26 @@ clicking the wrong thing), or a name-drift finding that is not attributable.
    invents a trend out of a capture artifact. `history --json` and the `heal_history` MCP tool
    both hand you that exclusion — pass it on rather than presenting the series as complete.
 
+12. **Never try to log a suite in yourself.** When `map` reports a login wall it prints the whole
+   remedy: a filled-in `auth` block when the form is readable, and the fact that a form fill
+   cannot pass SSO with MFA, a consent screen or a magic link. Read past the first line before
+   concluding anything. For everything a form cannot answer there is exactly one step, and it
+   belongs to the human: `ia-qa-heal login` opens a visible browser, they log in once, and the
+   session is reused by `map`. It refuses without a TTY and under CI — that refusal is aimed at
+   you. Never ask for their password, never put a credential in `config.json` (it holds `secrets`
+   *references* to env/SSM, never values), and never commit `.ia-qa/session.json` — it is a live
+   session, gitignored on creation. For CI, the reproducible paths are `auth` and capture-during-
+   run (`IAQA_CAPTURE=1` + `testCommand`), never a saved session.
+
+13. **Never rewrite a selector whose binding did not simply break.** `diff` reports four
+   outcomes for the strings a suite writes, and only one — the element is still there,
+   the string no longer reaches it — is repaired. A string that now reaches a *different*
+   element is the worst finding in the tool: the test **passes** and acts on the wrong
+   thing. Rewriting it would cement that. Neither is a selector matching several
+   elements, or one whose element is gone. And a selector that matches something the
+   contract does not hold (a row, a cell, a container) is **not** a finding — it is most
+   of a real Page Object, and it is proof the selector works.
+
 ## 5. What leaves the machine
 
 Nothing, except: requests to the user's **own** `baseUrl` (`check`'s link half, `discover --crawl`