@jevitate/cli 0.10.0 → 0.12.0

package/skills/jevitate-demo/SKILL.md

@@ -13,7 +13,10 @@ something the app didn't do.
 - Demos and Journey replays run against a named environment from the committed
   `.jevitate/environments.json` (`jevitate init` writes an example with a `local` entry). Each
   entry has `baseUrl` (an origin), an optional `allow` list, `fixtures` and `hooks`. Mark a live
-  site with `"production": true`. `demo` refuses one (`E_DEMO_PRODUCTION_ENV`, exit 64).
+  site with `"production": true`. `demo` refuses one (`E_DEMO_PRODUCTION_ENV`, exit 64). Mark a
+  seeded, synthetic tenant with `"synthetic": true`: only a demo approved there ships masked media
+  (jz-mask-v1) to Journeeze with `catalog export` / `publish journeeze`. Set it only when the human
+  says the environment holds no real customer data.
 - The file never holds a secret or a session. Sessions and secret fields live in
   `~/.jevitate/targets.json`, keyed by the environment's origin, with `personas` for named
   sessions. Never write a session or password into the repo.

package/skills/jevitate-run-journey/SKILL.md

@@ -46,6 +46,10 @@ artifact; your job is to find the right one and run it with the right params.
 - Evidence: `--record-video` (listed as `videoPaths`), `--screenshots
   [screens|steps]` (`screenshotPaths` + an `index.md`), `--headed`/`--slow-mo <ms>`
   to watch it. `--viewport 375x812` / `--device "iPhone 13"` for mobile.
+- A step's `responseStatus` check waits up to 15 s for a request that was sent
+  but not yet answered (a cold start after a deploy); `--step-response-timeout
+  <ms>` (MCP `run_journey`'s `stepResponseTimeoutMs`) raises it for one run. A
+  late 2xx is an advisory `slowSteps` finding, not a failure.
 - For a narrated demo video or a step-by-step guide of a Journey, use
   `jevitate-demo` (`journey demo`, `journey annotate`).
 

package/skills/jevitate-test-campaign/SKILL.md

@@ -78,6 +78,15 @@ mission takes over on the live page:
 
 ```bash
 jevitate journey anchors <journey-id> --json   # the named states worth exploring from, with suggested probes
+jevitate journey anchors <journey-id> --suggest --json   # advisory: where the flow changes state (writes nothing)
+jevitate journey anchor add <journey-id> --name <name> --step <n|stepId> --json   # a DRAFT Journey only
+```
+
+Over MCP: `journey_anchors` (`suggest: true`), `journey_anchor_add`, `journey_anchor_remove`, and
+`lint_journey` with `fix: true` (stamps number-only anchors with their step id). Anchor edits refuse a
+promoted Journey: its approval binds to the content hash, so edit a draft and a person re-promotes it.
+
+```bash
 jevitate explore --from-journey <journey-id> --at-step <anchor|n> --param <k=v> --env <env> --strategy adversarial --storage-state <persona-file> --max-actions 60 --evidence-video --real --json
 ```
 
@@ -113,6 +122,10 @@ Flags such as `--allow-destructive`, `--paid`, `--invariants`, `--log-source`/`-
 `--evidence-video` on `campaign run` are forwarded to every mission; `--hook-timeout-ms` bounds the
 spec's hooks. An invalid spec is refused with every problem listed (exit 64). Shell `before`/`after` restore
 hooks in the spec run only with `--allow-shell-hooks`, and only when the human asked for them.
+Before any mission, a preflight checks every start URL is reachable, every session is signed in and
+no app call slips outside the allow list, and refuses with the problems listed. Fix them;
+`--skip-preflight` (MCP `run_campaign` `skipPreflight`) only when the human asks, and it is recorded
+on the report.
 
 ## 5. A small untargeted pass, plus non-journey attacks
 

package/skills/jevitate-verify-fix/SKILL.md

@@ -24,6 +24,11 @@ the evidence. No model decides any of these verdicts.
   target's session in `~/.jevitate/targets.json`. A finding recorded at a viewport or device
   replays at that emulation. `--viewport`/`--device` that differ are refused unless
   `--allow-emulation-override` is passed.
+- A finding replays under the allow list stored with its result. To prove an allow-list
+  config fix (e.g. `localhost` → `127.0.0.1`), pass `--allow <origin...>` or `--env <name>`
+  (that environment's CURRENT allow list), never both; MCP: `verify_fix`'s `env` only (an MCP caller never names origins).
+  The report then carries `allowlistOverride` (origins used, what was added and removed): say so
+  when you report the verdict.
 
 ## Evidence for a PR or an issue