@ihyeon/flow-qa 0.1.3 → 0.2.1

package/dist/src/ui/server.js

@@ -14,6 +14,7 @@ import { EvidenceError, readEvidence } from "./evidence.js";
 import { buildPlanningPrompt, planFlow, PlannerError } from "../planner.js";
 import { renderMarkdown } from "../report.js";
 import { configSchema, idSchema, modelSchema, suiteSchema, targetSchema } from "../schema.js";
+import { targetFingerprint } from "../targets.js";
 import { CONFIG_FILE, sha256 } from "../workspace.js";
 const MAX_BODY = 256 * 1024;
 const MAX_FLOW = 128 * 1024;
@@ -28,7 +29,10 @@ const RUN_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
 const FILE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,159}$/;
 const reportEnvelope = z.object({
     schemaVersion: z.literal('flow-qa/report-1'), runId: z.string().regex(RUN_ID), suiteId: idSchema,
-    suiteHash: z.string(), target: z.object({ name: z.string(), url: z.string() }),
+    suiteHash: z.string(), target: z.union([
+        z.object({ name: z.string(), url: z.string() }),
+        z.object({ name: z.string(), kind: z.literal('mobile'), platform: z.enum(['ios', 'android']), bundleId: z.string(), device: z.string() }),
+    ]),
     startedAt: z.string(), finishedAt: z.string(), status: z.enum(['passed', 'failed', 'blocked', 'error', 'interrupted']),
     cases: z.array(z.object({ id: z.string(), title: z.string(), status: z.enum(['passed', 'failed', 'flaky', 'blocked', 'skipped', 'error']),
         expected: z.array(z.string()), attempts: z.array(z.unknown()), reason: z.string().optional() }).passthrough()),
@@ -66,7 +70,8 @@ const SCHEMA_FIELDS = new Set([
     'suite', 'schemaVersion', 'id', 'title', 'source', 'file', 'sha256', 'requirements', 'cases',
     'requirementIds', 'preconditions', 'questions', 'steps', 'type', 'path', 'instruction',
     'locator', 'by', 'value', 'name', 'visible', 'expected', 'match', 'flow', 'role', 'url',
-    'description', 'baseURL', 'model', 'apiKeyEnv', 'clear', 'targetName', 'targetURL', 'suiteHash',
+    'description', 'baseURL', 'model', 'apiKeyEnv', 'clear', 'targetName', 'targetURL', 'targetFingerprint', 'suiteHash',
+    'kind', 'platform', 'bundleId', 'device', 'direction',
 ]);
 const KNOWN_SCHEMA_MESSAGES = new Map([
     ['IDs must be unique.', 'IDs must be unique.'],
@@ -108,7 +113,8 @@ function plannerFailure(error) {
     }
     if (error.code === 'invalid-suite') {
         const allowedMessages = new Set(['A JSON object response is required.', 'A runnable case needs an expected-result assertion.',
-            'Check requirement links, duplicate IDs, and assertions.', 'Check required values, types, and limits in the case schema.']);
+            'Check requirement links, duplicate IDs, and assertions.', 'Check required values, types, and limits in the case schema.',
+            'The suite platform must match the selected planning platform.']);
         const allowedPaths = new Set([...SCHEMA_FIELDS, 'response', 'suite', '?']);
         const issues = error.issues?.slice(0, 8).map((issue) => ({
             path: issue.path.split('.').slice(0, 8).every((part) => allowedPaths.has(part) || /^(?:0|[1-9][0-9]?)$/.test(part)) ? issue.path : 'suite',
@@ -439,7 +445,7 @@ export async function startUIServer(options) {
                 const settings = await config();
                 const history = await runs();
                 sendJSON(response, 200, { csrfToken: token,
-                    targets: Object.entries(settings.targets).map(([name, target]) => ({ name, ...target })),
+                    targets: Object.entries(settings.targets).map(([name, target]) => ({ name, ...target, targetFingerprint: targetFingerprint(target) })),
                     models: { planner: modelState(settings.planner), agent: modelState(settings.agent) },
                     runtime: { browserInstalled: await browserInstalled(), browserInstallCommand: BROWSER_INSTALL_COMMAND },
                     suites: await suites(), runs: history,
@@ -522,10 +528,10 @@ export async function startUIServer(options) {
             throw new HTTPError(403, 'Invalid request token.');
         const body = await bodyJSON(request);
         if (url.pathname === '/api/prompt') {
-            const { flow } = parse(z.object({ flow: z.string().min(1) }).strict(), body);
+            const { flow, platform } = parse(z.object({ flow: z.string().min(1), platform: z.enum(['web', 'mobile']).optional() }).strict(), body);
             if (Buffer.byteLength(flow) > MAX_FLOW)
                 throw new HTTPError(413, 'The flow is too large.');
-            sendJSON(response, 200, { prompt: buildPlanningPrompt(flow) });
+            sendJSON(response, 200, { prompt: buildPlanningPrompt(flow, platform) });
             return;
         }
         if (url.pathname === '/api/stop') {
@@ -539,7 +545,7 @@ export async function startUIServer(options) {
         }
         if (url.pathname === '/api/plan') {
             const result = await mutation(async () => {
-                const { flow } = parse(z.object({ flow: z.string().min(1) }).strict(), body);
+                const { flow, platform } = parse(z.object({ flow: z.string().min(1), platform: z.enum(['web', 'mobile']).optional() }).strict(), body);
                 if (Buffer.byteLength(flow) > MAX_FLOW)
                     throw new HTTPError(413, 'The flow is too large.');
                 const settings = await config();
@@ -560,7 +566,7 @@ export async function startUIServer(options) {
                 timeout.unref();
                 try {
                     const result = await Promise.race([
-                        Promise.resolve().then(() => plan(flow, settings.planner, { signal: abort.signal })),
+                        Promise.resolve().then(() => plan(flow, settings.planner, { signal: abort.signal, platform })),
                         aborted,
                     ]);
                     if (abort.signal.aborted)
@@ -569,6 +575,8 @@ export async function startUIServer(options) {
                     if (!parsed.success)
                         throw new HTTPError(502, 'The model returned an invalid suite.', { category: 'invalid-suite' });
                     const planned = parsed.data;
+                    if ((planned.platform ?? 'web') !== (platform ?? 'web'))
+                        throw new HTTPError(502, 'The model returned cases for a different platform.', { category: 'invalid-suite' });
                     const { source: _modelSource, ...withoutSource } = planned;
                     const suite = suiteSchema.parse(withoutSource);
                     return { suite, script: compileSuite(suite) };
@@ -592,6 +600,25 @@ export async function startUIServer(options) {
             sendJSON(response, 200, result);
             return;
         }
+        if (url.pathname === '/api/import') {
+            const result = await mutation(async () => {
+                const { suite: inputSuite, flow } = parse(z.object({ suite: suiteSchema, flow: z.string().min(1).optional() }).strict(), body);
+                if (flow !== undefined && Buffer.byteLength(flow) > MAX_FLOW)
+                    throw new HTTPError(413, 'The flow is too large.');
+                sourceName(inputSuite);
+                if (inputSuite.source) {
+                    if (flow === undefined)
+                        invalid('Select the source Markdown together with the case JSON.');
+                    if (sha256(flow) !== inputSuite.source.sha256)
+                        throw new HTTPError(409, 'The selected Markdown does not match the case source.');
+                }
+                // Import prepares a review copy; saving later assigns its workspace source path.
+                const { source: _source, ...suite } = inputSuite;
+                return { suite, script: compileSuite(suite) };
+            });
+            sendJSON(response, 200, result);
+            return;
+        }
         if (url.pathname === '/api/compile') {
             const result = await mutation(async () => {
                 const { suite } = parse(z.object({ suite: suiteSchema }).strict(), body);
@@ -629,8 +656,11 @@ export async function startUIServer(options) {
         }
         if (url.pathname === '/api/targets') {
             await mutation(async () => {
-                const { name, url: targetURL, description } = parse(z.object({ name: idSchema, url: z.string(), description: z.string().optional() }).strict(), body);
-                const target = parse(targetSchema, { url: targetURL, ...(description === undefined ? {} : { description }) });
+                const { name, ...input } = parse(z.union([
+                    z.object({ name: idSchema, kind: z.literal('mobile'), platform: z.enum(['ios', 'android']), bundleId: z.string(), device: z.string(), description: z.string().optional() }).strict(),
+                    z.object({ name: idSchema, kind: z.literal('web').optional(), url: z.string(), description: z.string().optional() }).strict(),
+                ]), body);
+                const target = parse(targetSchema, input);
                 const settings = await config();
                 settings.targets[name] = target;
                 await updateConfig(settings);
@@ -658,18 +688,27 @@ export async function startUIServer(options) {
         if (url.pathname === '/api/run') {
             enterMutation();
             try {
-                const { suite: file, suiteHash, targetName, targetURL } = parse(z.object({
-                    suite: z.string(), suiteHash: z.string().regex(/^[a-f0-9]{64}$/), targetName: idSchema, targetURL: z.string(),
+                const { suite: file, suiteHash, targetName, targetURL, targetFingerprint: reviewedFingerprint } = parse(z.object({
+                    suite: z.string(), suiteHash: z.string().regex(/^[a-f0-9]{64}$/), targetName: idSchema,
+                    targetURL: z.string().optional(), targetFingerprint: z.string().regex(/^[a-f0-9]{64}$/).optional(),
                 }).strict(), body);
                 const selected = await getSuite(file, true);
                 if (selected.suiteHash !== suiteHash)
                     throw new HTTPError(409, 'The reviewed case file changed. Open it again to review.');
                 const { suite } = selected;
                 const settings = await config();
-                if (!settings.targets[targetName])
+                const target = settings.targets[targetName];
+                if (!target)
                     invalid('The selected target was not found.');
-                if (settings.targets[targetName].url !== targetURL) {
-                    throw new HTTPError(409, 'The selected target URL changed. Review it again.');
+                if ((suite.platform ?? 'web') !== (target.kind === 'mobile' ? 'mobile' : 'web')) {
+                    throw new HTTPError(409, 'The case platform and selected target do not match. Review them again.');
+                }
+                if (reviewedFingerprint !== undefined) {
+                    if (targetFingerprint(target) !== reviewedFingerprint)
+                        throw new HTTPError(409, 'The selected target changed. Review it again.');
+                }
+                else if (target.kind === 'mobile' || !targetURL || target.url !== targetURL) {
+                    throw new HTTPError(409, 'The selected target changed. Review it again.');
                 }
                 const operationId = randomUUID();
                 const abort = new AbortController();

package/docs/architecture.md

@@ -1,6 +1,6 @@
 # Architecture and verification boundaries
 
-The local CLI and loopback web UI share one workspace format, case schema, execution path, and report contract. Flow QA runs browser tests against a target URL; it does not need the target application's source code.
+The local CLI and loopback web UI share one workspace format, case schema, execution path, and report contract. Flow QA runs browser tests against a target URL and native tests against a user-configured iOS or Android app/device. It does not need the target application's source code. Mobile integration is available from version 0.2.0; see the [mobile guide](mobile.md).
 
 ```mermaid
 flowchart LR
@@ -8,7 +8,7 @@ flowchart LR
   B --> C[JSON case suite]
   C --> D[Schema and source-hash validation]
   D --> E[Compile allowed steps to e2e code]
-  E --> F[tester-army/e2e browser run]
+  E --> F[tester-army/e2e web or mobile run]
   F --> G[QA report with attempts and evidence]
   H[CLI / local UI] --> B
   H --> D
@@ -22,7 +22,9 @@ flowchart LR
 
 **Only a defined vocabulary compiles.** The schema checks requirement references, assertions, step types, and inputs. It does not execute arbitrary code or shell commands from model output. Cases with unresolved `questions`, or steps that need an unavailable agent model, are blocked. `preconditions` describe required state; they are not an automatic setup contract.
 
-**Source and evidence stay linked.** Planning records the source flow's SHA-256 hash in the suite. `validate`, `generate`, and `run` check it again and stop when the flow changed. Each execution writes a new directory with a suite snapshot, generated tests, raw engine output, and Markdown/JSON reports. Previous evidence is not reused as a current success. `compare` permits a direct comparison only for the same suite hash and target URL; it cannot establish that external data was unchanged.
+**Source and evidence stay linked.** Planning records the source flow's SHA-256 hash in the suite. `validate`, `generate`, and `run` check it again and stop when the flow changed. Each execution writes a new directory with a suite snapshot, generated tests, raw engine output, and Markdown/JSON reports. Previous evidence is not reused as a current success. `compare` permits a direct comparison only for the same suite hash and target identity (web URL or native platform/app/device); it cannot establish that external data was unchanged.
+
+**Targets can be configured after authoring.** A suite's optional platform distinguishes web from mobile. Omitted platform preserves legacy web suites and their hashes. Native app IDs and explicit device names belong to target settings, not generated code from the planner. UI execution checks a fingerprint of the reviewed target identity. Mobile runtime readiness is checked before device execution; configuration alone does not prove connectivity.
 
 **Blocked and failed mean different things.** An unreachable app or unresolved question is blocked; an assertion mismatch is failed. A pass after retry has its own status. Engine output is validated rather than treating missing results as passes. The report records observations, not a root-cause verdict on the product.
 
@@ -31,8 +33,8 @@ flowchart LR
 | Area | Flow QA provides | External implementation or prerequisite |
 | --- | --- | --- |
 | Planning | Prompt, model connection, JSON schema validation | User-selected OpenAI-compatible model |
-| Execution | Step compilation, target connection, orchestration, cancellation | [tester-army/e2e](https://github.com/tester-army/e2e), Chromium |
+| Execution | Step compilation, target connection, orchestration, cancellation | [tester-army/e2e](https://github.com/tester-army/e2e), Chromium for web or `@e2e-dev/mobile`/agent-device for native apps |
 | Results | A fresh report per run, status interpretation, evidence links | Raw runs and evidence from the engine |
 | UI | Local workflow screens and English/Korean language switch | [Hyeonse Design System](https://github.com/hyeonse-swing/hyeonse-design-system) tokens and preference utilities |
 
-The UI binds only to `127.0.0.1` and serves approved report evidence, not arbitrary raw logs or HTML/SVG. Local reports may still contain data from the tested app and should be reviewed before sharing. This release does not manage login sessions, cap model spending, schedule CI runs, or support mobile devices.
+The UI binds only to `127.0.0.1` and serves approved report evidence, not arbitrary raw logs or HTML/SVG. Local reports may still contain data from the tested app and should be reviewed before sharing. It does not manage login sessions, cap model spending, schedule CI runs, or provision mobile SDKs, devices, and application builds.

package/docs/mobile.md

@@ -0,0 +1,59 @@
+# User-configured iOS and Android targets
+
+Mobile targets require Flow QA `0.2.0` or later and Node.js 24.8 or later. The web demo remains a browser demo; it is not proof of a mobile run.
+
+## Write cases now, connect an app later
+
+Choose **Mobile** on the scenario screen, describe the flow, and generate or download a planning prompt. You do not need to register an app or device to author, validate, compile, or save cases. A mobile suite has `"platform": "mobile"`; existing suites without a platform remain web suites.
+
+With the installed CLI:
+
+```sh
+npm install -g @ihyeon/flow-qa@0.2.1
+flow-qa init ./my-qa
+# Write your mobile flow in my-qa/flows/my-flow.md first.
+flow-qa plan flows/my-flow.md --platform mobile --prompt-only --workspace ./my-qa
+```
+
+Use your chosen AI tool to produce JSON from the prompt, then review and save it under `my-qa/cases/`. Alternatively, configure a planner and omit `--prompt-only`. Neither option needs the target app's source code. Product behavior and accessible element names must still be supplied; unknown expectations remain questions.
+
+## Register an app when ready
+
+In **Connections**, select **iOS** or **Android**, then enter a target name, the installed app's bundle/package ID, and an explicit device name or ID. Register multiple targets to use one mobile suite on both platforms when their accessible labels and expected behavior agree. Use separate suites where the two apps behave differently.
+
+CLI examples below contain placeholders; replace them with your own app and devices:
+
+```sh
+flow-qa connect my-ios --platform ios --bundle-id com.example.app --device "QA iPhone" --workspace ./my-qa
+flow-qa connect my-android --platform android --bundle-id com.example.app --device emulator-5554 --workspace ./my-qa
+flow-qa run cases/my-flow.json --target my-ios --workspace ./my-qa
+flow-qa run cases/my-flow.json --target my-android --workspace ./my-qa
+```
+
+Saving a target only writes configuration. It does not contact a model, boot a device, install an app, or start a test. You can update a saved target by saving the same target name again. The UI checks the reviewed app, platform, and device before dispatching a run; changed settings require another review.
+
+For an iOS simulator, prepare Xcode, an installed simulator runtime, a booted simulator, and a simulator build of the app installed on it. For Android, prepare the Android SDK and a booted emulator or an authorized connected device with the app installed. Physical iOS devices additionally need pairing, Developer Mode, and signing of the upstream automation runner. Follow the [mobile engine's setup instructions](https://e2e.tester.army/docs/mobile#physical-devices) for device-specific requirements.
+
+Flow QA does not download SDKs, create or boot simulators, or install application builds. A missing or unavailable selected device blocks the run; a saved target is not evidence of a working device or app. For physical device IDs that the underlying engine resolves by name, the device name must be unique after case and whitespace normalization; ambiguous selection blocks the run. Chromium is only required for web targets.
+
+## Native steps
+
+| Step | Behavior |
+| --- | --- |
+| `launchApp` | Launch the app registered in the selected target |
+| `click` | Tap an accessible element |
+| `fill` | Enter text in an accessible input |
+| `back` | Use the engine's app back navigation |
+| `swipe` | Swipe the viewport `up`, `down`, `left`, or `right` |
+| `assertVisible`, `assertText` | Check accessible elements and their text |
+| `act`, `assertAgent` | Use the separately configured agent model for an action or judgment |
+
+The compiler launches the configured app at the start of each runnable case unless the first step is already `launchApp`. It does not clear app data or create login state. A launch is not a fresh account/session. The web-only `open` path and `assertUrl` steps are rejected in mobile suites, and native steps are rejected in web suites.
+
+Native `testId` locators use iOS accessibility identifiers or Android resource IDs. Accessibility exposure depends on the app framework. Fixed steps need no model; natural-language steps require a compatible tool/image-capable agent. A WebView's exposed native controls may be usable, but this path does not provide a browser DOM session or prove JavaScript bridge behavior.
+
+## Results and proof boundaries
+
+Mobile reports record platform, app ID, and device rather than a fabricated URL. They use the same case statuses, attempt details, and approved screenshot/text evidence handling as web reports. Comparing different apps, platforms, or configured devices does not produce a direct regression verdict.
+
+Configuration, compilation, mocked runtime tests, and browser UI tests establish the integration behavior. Successful iOS and Android execution still requires recorded results on the user's chosen devices and apps. Flow QA does not supply app-specific cases, accounts, build artifacts, or a device farm.

package/docs/releases.md

@@ -2,6 +2,24 @@
 
 The alpha entries below are historical release records. They document earlier package versions and checks.
 
+## 0.2.1: import case files from the UI
+
+Adds a file picker for a TC JSON file and its optional source Markdown. Import checks the suite and source hash before replacing the current draft, preserves unresolved review questions, and creates a separate copy when saved. Source text retains its line endings and trailing whitespace. This does not import error-to-test provenance metadata; original bundles remain separate. See [case file import](ui.md#import-existing-case-files).
+
+Locally verified on macOS with Node.js 24.14.1 on 2026-10-15: 92 tests, type checking, UI syntax and design-system audit, real Chromium import/save/retry checks in English and Korean, existing demo pass/failure/blocked classifications, and a fresh tarball install with three passing browser cases. No model calls or native-device runs were used for this patch.
+
+- Package: [`@ihyeon/flow-qa@0.2.1`](https://www.npmjs.com/package/@ihyeon/flow-qa/v/0.2.1)
+- Release: [GitHub 0.2.1](https://github.com/hyeonse-swing/flow-qa/releases/tag/v0.2.1)
+
+## 0.2.0: configurable mobile targets
+
+Adds native iOS/Android target settings, mobile case authoring before device setup, platform-aware compilation and execution, and app/device identity in review and reports. Users register an installed app and a prepared device when ready; no product-specific app is bundled. Existing web settings and suites remain readable. Node.js 24.8 or later is required by the mobile runtime. Actual native-device success requires a user-selected app and device. See [mobile setup and verification limits](mobile.md).
+
+Locally verified on macOS with Node.js 24.14.1 on 2026-10-12: 89 tests, type checking, UI syntax and design-system audit, package build and fresh tarball installation. Chromium smoke preserved web pass/failure/unavailable classifications and English/Korean UI behavior. The installed package can create a mobile prompt, validate and compile mobile cases before target setup, and save iOS/Android settings. Native generated code was type-checked against the installed SDK; device selection and blocking were tested with inventory fixtures. These checks did not execute a native app or call a model.
+
+- Package: [`@ihyeon/flow-qa@0.2.0`](https://www.npmjs.com/package/@ihyeon/flow-qa/v/0.2.0)
+- Release: [GitHub 0.2.0](https://github.com/hyeonse-swing/flow-qa/releases/tag/v0.2.0)
+
 ## Automated npm and GitHub releases
 
 A push to `main` publishes only when `package.json` changes to a new plain `X.Y.Z` version. Pull requests and pushes without a version change run verification without publishing. The package and lockfile versions must agree; the version must increase, and registry errors stop the release. Rerunning a successful publication skips the existing immutable npm version.

package/docs/ui.md

@@ -1,13 +1,13 @@
 # Flow QA local UI
 
-Use the target app's URL and a user flow to review cases, run them, and inspect results. The local example is a to-do app; the UI does not bundle an organization's product list, internal URLs, accounts, model catalog, work cases, or run history.
+Describe a user flow, review cases, and configure a target when ready to run. Web targets use a URL; native targets use an iOS/Android app ID and an explicit device. Mobile targets require version `0.2.0` or later. The local example is a to-do web app; the UI does not bundle an organization's product list, internal URLs, accounts, model catalog, work cases, or run history.
 
 ## Start
 
-Node.js 24 or later is required. Install Flow QA and start the local demo:
+Node.js 24.8 or later is required. Install Flow QA and start the web demo:
 
 ```sh
-npm install -g @ihyeon/flow-qa@0.1.3
+npm install -g @ihyeon/flow-qa@0.2.1
 flow-qa browser install
 flow-qa ui --demo
 ```
@@ -28,20 +28,28 @@ The UI starts in **English**, regardless of browser language. Switch to **한국
 
 ## Workflow
 
-1. **Connections:** Register a target name and URL. Planner and browser agent models have separate settings.
-2. **Scenario:** Describe the initial state, actions, screen elements, and expected results. If a planner is ready, ask it to create cases. Without a model, download the planning prompt and paste a JSON response from an AI you already use.
+1. **Scenario:** Choose Web or Mobile and describe the initial state, actions, screen elements, and expected results. No target is required yet. If a planner is ready, ask it to create cases. Without a model, download the planning prompt and paste a JSON response from an AI you already use.
+2. **Connections:** When ready, register a target name and web URL, or choose iOS/Android and enter an installed app's bundle/package ID and device. Planner and execution agent models have separate settings. Saving settings does not start an app or model request.
 3. **Review and save cases:** Expand each case to read preconditions, actions, expected results, and unresolved questions. Editing the JSON keeps the linked flow; if that source flow changes, design the cases again. Planning and running are separate actions. Editing inputs or connection settings alone does not call a model.
-4. **Run QA:** Review the saved case file, select a target, and check the review confirmation before running. If the file changes after review, reload and review it again. Fixed steps need no agent model. `act` and `assertAgent` require a compatible agent; missing models and unresolved questions are reported as blocked cases.
+4. **Run QA:** Review the saved case file, select a matching web/mobile target, and check the review confirmation before running. If the file or target settings change after review, reload and review them again. Fixed steps need no agent model. `act` and `assertAgent` require a compatible agent; missing models and unresolved questions are reported as blocked cases.
 5. **Case library and Run history:** Save cases as new files and load them again. Open run details to see each case, attempt, and evidence; download the Markdown or JSON report.
 
 The top bar shows planning, running, and stopping states, plus a cancel button. A late planning response cannot change the draft after cancellation. The UI does not estimate progress inside an individual browser action. If the server disconnects, reconnect; runs started in another tab also appear. Refreshing settings rereads targets and models, so save edits first.
 
 For each attempt, the report can open or download an approved screenshot or text evidence item. It serves only evidence linked to the report and marked as redacted or not needing redaction. It does not serve arbitrary files, raw run logs, HTML, or SVG. Markdown and JSON downloads summarize results but do not include evidence files. Keep the original run directory structure if you need relative evidence links in an offline Markdown report.
 
-**Connections** shows whether Chromium is installed. A model key marked ready means only that the named environment variable exists; it does not prove authentication or model compatibility. Case review shows runnable and pre-blocked counts. Login and target reachability are established only by an actual run.
+**Connections** shows whether Chromium is installed for web targets. Mobile execution requires a prepared device and installed app; Chromium readiness does not determine mobile readiness. See [mobile setup](mobile.md). A model key marked ready means only that the named environment variable exists; it does not prove authentication or model compatibility. Case review shows runnable and pre-blocked counts. Login and target reachability are established only by an actual run.
 
 To enter fresh JSON after changing a scenario, open the JSON editor in case review and choose **New JSON draft**. Existing saved files remain; validate and save the new JSON before reviewing it for a run.
 
+### Import existing case files
+
+From version `0.2.1`, select a `flow-qa/suite-1` JSON file and, when it declares a source, its Markdown file in case review, then choose **Import case files**. The two file controls let you select files from different folders. For an error-to-test export, select `cases/error-to-test.json` and `flows/error-to-test.md`. A JSON file without a source can be imported alone or with a Markdown file.
+
+Import validates the suite and checks the selected Markdown against its declared SHA-256 before replacing the draft. Cancelling or selecting invalid files preserves the current draft. The Markdown text, including line endings and trailing whitespace, is retained for saving. Markdown is limited to 128 KiB; the combined JSON request is limited to 256 KiB.
+
+This creates an unsaved review copy. Choose **Save cases separately**, review the cases, and confirm review before running. Unresolved questions remain blocked. Saving assigns a new workspace source path and hash; it does not overwrite the input files or import `provenance.json`. If you need error-to-test `verify` / `link-run` provenance, keep the original bundle and use its original suite instead of this saved copy.
+
 ## Display and language
 
 The UI uses role tokens and preference utilities from `@hyeonse/design-system`, pinned to GitHub commit `38978c6a86f422fc0e63e919f600bc2dd3451e5c`. Flow QA implements its own workflow layout, buttons, and fields with those tokens.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ihyeon/flow-qa",
-  "version": "0.1.3",
+  "version": "0.2.1",
   "license": "MIT",
   "author": "Hyeonse Im",
   "repository": {
@@ -38,7 +38,7 @@
   "description": "Turn user flows into repeatable tests and evidence-backed QA reports.",
   "type": "module",
   "engines": {
-    "node": ">=24"
+    "node": ">=24.8.0"
   },
   "bin": {
     "flow-qa": "./dist/bin/flow-qa.mjs"
@@ -61,8 +61,10 @@
   },
   "dependencies": {
     "@ai-sdk/openai-compatible": "3.0.53",
+    "@e2e-dev/mobile": "0.11.0",
     "@e2e-dev/web": "0.11.1",
     "@hyeonse/design-system": "https://codeload.github.com/hyeonse-swing/hyeonse-design-system/tar.gz/38978c6a86f422fc0e63e919f600bc2dd3451e5c",
+    "agent-device": "0.21.22",
     "ai": "7.0.107",
     "e2e": "0.16.0",
     "playwright": "1.63.0",