@mindstudio-ai/remy 0.1.282 → 0.1.284

package/dist/automatedActions/buildFromInitialSpec.md

@@ -19,7 +19,7 @@ Then, build everything in one turn: tables, methods, interfaces, manifest update
 - First, run use `runScenario` to seed test data, then use `runMethod` to confirm important methods work.
 - If the app has a web frontend, check the browser logs to make sure there are no errors rendering it.
 - Use `runAutomatedBrowserTest` to smoke-test the main UI flow. The dev database is a disposable snapshot, so don't worry about being destructive. Fix any errors before finishing.
-- If there is a scenario that seeds the app with mock data, use it to present the app to the user with initial data seeded, so they can see and play with the real app. Let the user know they can reset the app using a scenario to empty it if they wish. Showing the user something they can play with immediately is important when it comes to landing a strong first impression.
+- If there is a scenario that seeds the app with mock data, use it to present the app to the user with initial data seeded, so they can see and play with the real app. Let the user know they can reset the app using a scenario to empty it if they wish. Showing the user something they can play with immediately is important when it comes to landing a strong first impression. For apps with auth, the preview opens on the app's sign-in screen by design — that's the front door working, not a bug. Don't try to pre-authenticate the user or route around it; tell them the sign-in helper auto-fills the test account (`remy@mindstudio.ai`, code `123456`), so they're in with one tap.
 
 ## When you are done
 

package/dist/headless.js

@@ -2709,8 +2709,8 @@ function formatSize(bytes) {
 }
 async function formatFile(dirPath, name, indent) {
   try {
-    const stat2 = await fs16.stat(path8.join(dirPath, name));
-    return `${indent}${name}${" ".repeat(Math.max(1, 30 - indent.length - name.length))}${formatSize(stat2.size)}`;
+    const stat3 = await fs16.stat(path8.join(dirPath, name));
+    return `${indent}${name}${" ".repeat(Math.max(1, 30 - indent.length - name.length))}${formatSize(stat3.size)}`;
   } catch {
     return `${indent}${name}`;
   }
@@ -2936,7 +2936,7 @@ var restartProcessTool = {
 var runScenarioTool = {
   definition: {
     name: "runScenario",
-    description: "Run a scenario to seed the dev database with test data. By default truncates all tables first, then executes the seed function and impersonates the scenario roles. Use skipTruncate to run the seed function against existing data without resetting. Blocks until complete. Scenario IDs are defined in mindstudio.json. If it fails, check .logs/tunnel.log or .logs/requests.ndjson for details. Return synchronously - no need to sleep before checking results.",
+    description: "Run a scenario to seed the dev database with test data. By default truncates all tables first, then executes the seed function and assigns the scenario's roles to the dev test user (a real user row; the roles persist on it until changed). Nobody gets signed in: the preview still shows the app's own sign-in, where the dev helper auto-fills the test account. Use skipTruncate to run the seed function against existing data without resetting. Blocks until complete. Scenario IDs are defined in mindstudio.json. If it fails, check .logs/tunnel.log or .logs/requests.ndjson for details. Returns synchronously - no need to sleep before checking results.",
     inputSchema: {
       type: "object",
       properties: {
@@ -2975,12 +2975,12 @@ var runMethodTool = {
         },
         userId: {
           type: "string",
-          description: `Optional. Run the method as a specific user. Pass "testUser" to auto-auth as the default test user (the sandbox handles user creation/lookup \u2014 no scenario setup needed); works for email-code, sms-code, and "Sign in with Remy" apps (for sign-in-with-remy apps it resolves to the developer's own delegated identity rather than the test user). Or pass a real user ID from scenario-seeded data for a specific user. Overrides session-level impersonation for this call only.`
+          description: `Optional. Run the method as a specific user. Pass "testUser" to auto-auth as the default test user (the sandbox handles user creation/lookup \u2014 no scenario setup needed); works for email-code, sms-code, and "Sign in with Remy" apps (for sign-in-with-remy apps it resolves to the developer's own delegated identity rather than the test user). Or pass a real user ID from scenario-seeded data for a specific user.`
         },
         roles: {
           type: "array",
           items: { type: "string" },
-          description: 'Optional. Role names for this request (e.g. ["admin"]). Combine with `userId` to test a specific role, or use alone to test role-gated logic without a full identity. Overrides session-level impersonation for this call only.'
+          description: 'Optional. Role names for this request (e.g. ["admin"]). For auth-enabled apps, roles without a userId run as the dev test user holding exactly these roles \u2014 a real user row, so `auth.userId` and `requireRole` behave like production. For apps without auth, roles attach to an anonymous call. Applies to this call only.'
         }
       },
       required: ["method"]
@@ -4505,7 +4505,7 @@ async function runBrowserAutomation(task, context, opts) {
       await sidecarRequest(
         "/set-viewport",
         { mode: "default" },
-        { timeout: 2e4 }
+        { timeout: 25e3 }
       );
     } catch {
     }
@@ -4524,7 +4524,7 @@ async function runBrowserAutomation(task, context, opts) {
                 auth: _input.auth,
                 path: _input.path
               },
-              { timeout: 15e3 }
+              { timeout: 2e4 }
             );
             return JSON.stringify(result2);
           } catch (err) {
@@ -5570,20 +5570,24 @@ __export(createWireframe_exports, {
   definition: () => definition10,
   execute: () => execute10
 });
-import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
+import { mkdir as mkdir2, stat as stat2, writeFile as writeFile2 } from "fs/promises";
 import { join as join2 } from "path";
 var log9 = createLogger("createWireframe");
 var WIREFRAMES_DIR = "src/.wireframes";
 var UPLOAD_TIMEOUT_MS2 = 3e4;
 var definition10 = {
   name: "createWireframe",
-  description: "Create a wireframe from self-contained HTML+CSS. Returns a markdown reference line \u2014 include that exact line in your response wherever the wireframe belongs, with your notes in the surrounding prose. To revise a wireframe, create a new one (read the old file first if you are iterating on it).",
+  description: "Create (or revise) a wireframe from self-contained HTML+CSS. The wireframe is saved to src/.wireframes/{slug}.html \u2014 reference it in your response and in specs as ![name](src/.wireframes/{slug}.html), with your notes in the surrounding prose. Calling again with the same slug overwrites the wireframe in place, so a revision keeps its path and existing references stay current.",
   inputSchema: {
     type: "object",
     properties: {
       name: {
         type: "string",
-        description: 'Short display name, e.g. "Feed Post Card". Becomes the caption and the filename slug.'
+        description: 'Short display name, e.g. "Feed Post Card". Becomes the caption.'
+      },
+      slug: {
+        type: "string",
+        description: 'Filename stem, lowercase kebab-case (e.g. "feed-post-card"). The wireframe lives at src/.wireframes/{slug}.html. Re-use a slug to revise that wireframe in place.'
       },
       description: {
         type: "string",
@@ -5594,20 +5598,24 @@ var definition10 = {
         description: "The complete HTML document (<html>\u2026</html>), self-contained vanilla HTML/CSS/JS. No frontmatter \u2014 it is added for you."
       }
     },
-    required: ["name", "description", "html"]
+    required: ["name", "slug", "description", "html"]
   }
 };
-function slugify(name) {
-  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40).replace(/-+$/, "") || "wireframe";
-}
+var SLUG_RE = /^[a-z0-9][a-z0-9-]{0,79}$/;
 function singleLine(value) {
   return value.replace(/\s+/g, " ").trim();
 }
-function validate(name, html) {
+function validate(name, slug, html) {
   const warnings = [];
   if (!name.trim()) {
     return { error: "Error: name is required.", warnings };
   }
+  if (!SLUG_RE.test(slug)) {
+    return {
+      error: 'Error: slug must be lowercase kebab-case ([a-z0-9-], starting with a letter or digit, \u2264 80 chars), e.g. "feed-post-card".',
+      warnings
+    };
+  }
   if (!html.trim()) {
     return { error: "Error: html is required.", warnings };
   }
@@ -5666,13 +5674,13 @@ async function execute10(input, onLog, context) {
     return "Error: createWireframe requires execution context";
   }
   const name = String(input.name ?? "");
+  const slug = String(input.slug ?? "");
   const description = String(input.description ?? "");
   const html = String(input.html ?? "");
-  const { error, warnings } = validate(name, html);
+  const { error, warnings } = validate(name, slug, html);
   if (error) {
     return error;
   }
-  const slug = `${slugify(name)}-${Math.random().toString(36).slice(2, 8)}`;
   const relPath = `${WIREFRAMES_DIR}/${slug}.html`;
   const content = [
     "---",
@@ -5683,6 +5691,10 @@ async function execute10(input, onLog, context) {
     ""
   ].join("\n");
   await mkdir2(join2(PROJECT_ROOT, WIREFRAMES_DIR), { recursive: true });
+  const existed = await stat2(join2(PROJECT_ROOT, relPath)).then(
+    () => true,
+    () => false
+  );
   await writeFile2(join2(PROJECT_ROOT, relPath), content, "utf8");
   onLog?.(`Wrote ${relPath}, mirroring for preview...`);
   const mirror = await uploadMirror(context, slug, content);
@@ -5690,7 +5702,7 @@ async function execute10(input, onLog, context) {
     log9.warn("Wireframe mirror upload failed", { slug, note: mirror.note });
   }
   const lines = [
-    `Created wireframe "${singleLine(name)}" at ${relPath}.`,
+    `${existed ? "Revised" : "Created"} wireframe "${singleLine(name)}" at ${relPath}.${existed ? " Existing references to this path now show the new version." : ""}`,
     `Reference it in your response and in specs with exactly: ![${singleLine(name)}](${relPath})`
   ];
   if (!mirror.ok) {

package/dist/index.js

@@ -3816,8 +3816,8 @@ function formatSize(bytes) {
 }
 async function formatFile(dirPath, name, indent) {
   try {
-    const stat2 = await fs15.stat(path8.join(dirPath, name));
-    return `${indent}${name}${" ".repeat(Math.max(1, 30 - indent.length - name.length))}${formatSize(stat2.size)}`;
+    const stat3 = await fs15.stat(path8.join(dirPath, name));
+    return `${indent}${name}${" ".repeat(Math.max(1, 30 - indent.length - name.length))}${formatSize(stat3.size)}`;
   } catch {
     return `${indent}${name}`;
   }
@@ -4089,7 +4089,7 @@ var init_runScenario = __esm({
     runScenarioTool = {
       definition: {
         name: "runScenario",
-        description: "Run a scenario to seed the dev database with test data. By default truncates all tables first, then executes the seed function and impersonates the scenario roles. Use skipTruncate to run the seed function against existing data without resetting. Blocks until complete. Scenario IDs are defined in mindstudio.json. If it fails, check .logs/tunnel.log or .logs/requests.ndjson for details. Return synchronously - no need to sleep before checking results.",
+        description: "Run a scenario to seed the dev database with test data. By default truncates all tables first, then executes the seed function and assigns the scenario's roles to the dev test user (a real user row; the roles persist on it until changed). Nobody gets signed in: the preview still shows the app's own sign-in, where the dev helper auto-fills the test account. Use skipTruncate to run the seed function against existing data without resetting. Blocks until complete. Scenario IDs are defined in mindstudio.json. If it fails, check .logs/tunnel.log or .logs/requests.ndjson for details. Returns synchronously - no need to sleep before checking results.",
         inputSchema: {
           type: "object",
           properties: {
@@ -4134,12 +4134,12 @@ var init_runMethod = __esm({
             },
             userId: {
               type: "string",
-              description: `Optional. Run the method as a specific user. Pass "testUser" to auto-auth as the default test user (the sandbox handles user creation/lookup \u2014 no scenario setup needed); works for email-code, sms-code, and "Sign in with Remy" apps (for sign-in-with-remy apps it resolves to the developer's own delegated identity rather than the test user). Or pass a real user ID from scenario-seeded data for a specific user. Overrides session-level impersonation for this call only.`
+              description: `Optional. Run the method as a specific user. Pass "testUser" to auto-auth as the default test user (the sandbox handles user creation/lookup \u2014 no scenario setup needed); works for email-code, sms-code, and "Sign in with Remy" apps (for sign-in-with-remy apps it resolves to the developer's own delegated identity rather than the test user). Or pass a real user ID from scenario-seeded data for a specific user.`
             },
             roles: {
               type: "array",
               items: { type: "string" },
-              description: 'Optional. Role names for this request (e.g. ["admin"]). Combine with `userId` to test a specific role, or use alone to test role-gated logic without a full identity. Overrides session-level impersonation for this call only.'
+              description: 'Optional. Role names for this request (e.g. ["admin"]). For auth-enabled apps, roles without a userId run as the dev test user holding exactly these roles \u2014 a real user row, so `auth.userId` and `requireRole` behave like production. For apps without auth, roles attach to an anonymous call. Applies to this call only.'
             }
           },
           required: ["method"]
@@ -5542,7 +5542,7 @@ async function runBrowserAutomation(task, context, opts) {
       await sidecarRequest(
         "/set-viewport",
         { mode: "default" },
-        { timeout: 2e4 }
+        { timeout: 25e3 }
       );
     } catch {
     }
@@ -5561,7 +5561,7 @@ async function runBrowserAutomation(task, context, opts) {
                 auth: _input.auth,
                 path: _input.path
               },
-              { timeout: 15e3 }
+              { timeout: 2e4 }
             );
             return JSON.stringify(result2);
           } catch (err) {
@@ -6752,19 +6752,22 @@ __export(createWireframe_exports, {
   definition: () => definition10,
   execute: () => execute10
 });
-import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
+import { mkdir as mkdir2, stat as stat2, writeFile as writeFile2 } from "fs/promises";
 import { join as join2 } from "path";
-function slugify(name) {
-  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40).replace(/-+$/, "") || "wireframe";
-}
 function singleLine(value) {
   return value.replace(/\s+/g, " ").trim();
 }
-function validate(name, html) {
+function validate(name, slug, html) {
   const warnings = [];
   if (!name.trim()) {
     return { error: "Error: name is required.", warnings };
   }
+  if (!SLUG_RE.test(slug)) {
+    return {
+      error: 'Error: slug must be lowercase kebab-case ([a-z0-9-], starting with a letter or digit, \u2264 80 chars), e.g. "feed-post-card".',
+      warnings
+    };
+  }
   if (!html.trim()) {
     return { error: "Error: html is required.", warnings };
   }
@@ -6823,13 +6826,13 @@ async function execute10(input, onLog, context) {
     return "Error: createWireframe requires execution context";
   }
   const name = String(input.name ?? "");
+  const slug = String(input.slug ?? "");
   const description = String(input.description ?? "");
   const html = String(input.html ?? "");
-  const { error, warnings } = validate(name, html);
+  const { error, warnings } = validate(name, slug, html);
   if (error) {
     return error;
   }
-  const slug = `${slugify(name)}-${Math.random().toString(36).slice(2, 8)}`;
   const relPath = `${WIREFRAMES_DIR}/${slug}.html`;
   const content = [
     "---",
@@ -6840,6 +6843,10 @@ async function execute10(input, onLog, context) {
     ""
   ].join("\n");
   await mkdir2(join2(PROJECT_ROOT, WIREFRAMES_DIR), { recursive: true });
+  const existed = await stat2(join2(PROJECT_ROOT, relPath)).then(
+    () => true,
+    () => false
+  );
   await writeFile2(join2(PROJECT_ROOT, relPath), content, "utf8");
   onLog?.(`Wrote ${relPath}, mirroring for preview...`);
   const mirror = await uploadMirror(context, slug, content);
@@ -6847,7 +6854,7 @@ async function execute10(input, onLog, context) {
     log10.warn("Wireframe mirror upload failed", { slug, note: mirror.note });
   }
   const lines = [
-    `Created wireframe "${singleLine(name)}" at ${relPath}.`,
+    `${existed ? "Revised" : "Created"} wireframe "${singleLine(name)}" at ${relPath}.${existed ? " Existing references to this path now show the new version." : ""}`,
     `Reference it in your response and in specs with exactly: ![${singleLine(name)}](${relPath})`
   ];
   if (!mirror.ok) {
@@ -6860,7 +6867,7 @@ async function execute10(input, onLog, context) {
   }
   return lines.join("\n");
 }
-var log10, WIREFRAMES_DIR, UPLOAD_TIMEOUT_MS2, definition10;
+var log10, WIREFRAMES_DIR, UPLOAD_TIMEOUT_MS2, definition10, SLUG_RE;
 var init_createWireframe = __esm({
   "src/subagents/designExpert/tools/createWireframe.ts"() {
     "use strict";
@@ -6871,13 +6878,17 @@ var init_createWireframe = __esm({
     UPLOAD_TIMEOUT_MS2 = 3e4;
     definition10 = {
       name: "createWireframe",
-      description: "Create a wireframe from self-contained HTML+CSS. Returns a markdown reference line \u2014 include that exact line in your response wherever the wireframe belongs, with your notes in the surrounding prose. To revise a wireframe, create a new one (read the old file first if you are iterating on it).",
+      description: "Create (or revise) a wireframe from self-contained HTML+CSS. The wireframe is saved to src/.wireframes/{slug}.html \u2014 reference it in your response and in specs as ![name](src/.wireframes/{slug}.html), with your notes in the surrounding prose. Calling again with the same slug overwrites the wireframe in place, so a revision keeps its path and existing references stay current.",
       inputSchema: {
         type: "object",
         properties: {
           name: {
             type: "string",
-            description: 'Short display name, e.g. "Feed Post Card". Becomes the caption and the filename slug.'
+            description: 'Short display name, e.g. "Feed Post Card". Becomes the caption.'
+          },
+          slug: {
+            type: "string",
+            description: 'Filename stem, lowercase kebab-case (e.g. "feed-post-card"). The wireframe lives at src/.wireframes/{slug}.html. Re-use a slug to revise that wireframe in place.'
           },
           description: {
             type: "string",
@@ -6888,9 +6899,10 @@ var init_createWireframe = __esm({
             description: "The complete HTML document (<html>\u2026</html>), self-contained vanilla HTML/CSS/JS. No frontmatter \u2014 it is added for you."
           }
         },
-        required: ["name", "description", "html"]
+        required: ["name", "slug", "description", "html"]
       }
     };
+    SLUG_RE = /^[a-z0-9][a-z0-9-]{0,79}$/;
   }
 });
 

package/dist/prompt/compiled/manifest.md

@@ -126,4 +126,4 @@
 | `description` | `string` | No | What state this scenario creates |
 | `path` | `string` | Yes | Path to the TypeScript file |
 | `export` | `string` | Yes | Named export (the async function) |
-| `roles` | `string[]` | Yes | Roles to impersonate after seeding |
+| `roles` | `string[]` | Yes | Roles assigned to the dev test user after seeding |

package/dist/prompt/skills/auth.md

@@ -430,7 +430,7 @@ Auth works the same in dev/preview as in production — real verification codes
 
 All other emails and phone numbers receive real codes. There is no dev-mode bypass, no fake code, and no way to skip verification. When testing auth flows in the preview, use one of the test bypasses above or a real email/phone.
 
-The `runMethod` tool's `userId: "testUser"` shortcut resolves to this same dev-bypass identity. The platform find-or-creates a real users-table row for it on first call and caches the row's UUID for the rest of the dev session. **`auth.userId` inside the method is that UUID — not the literal string `"testUser"`.** The user row already exists, so don't try to insert it. If you need the UUID to seed app-specific rows that reference it (profiles, preferences, foreign keys), read it from any method response or query the users table directly: `SELECT id FROM users WHERE email = 'remy@mindstudio.ai'` (or `phone = '+15555555555'` for SMS-auth apps).
+This test account is the dev's standing identity: the preview's sign-in helper auto-fills it, the editor's Roles column edits its roles, and a scenario's `roles` field assigns roles to it after seeding. The `runMethod` tool's `userId: "testUser"` shortcut resolves to this same dev-bypass identity (as does `roles` without a `userId`). The platform find-or-creates a real users-table row for it on first call and caches the row's UUID for the rest of the dev session. **`auth.userId` inside the method is that UUID — not the literal string `"testUser"`.** The user row already exists, so don't try to insert it. If you need the UUID to seed app-specific rows that reference it (profiles, preferences, foreign keys), read it from any method response or query the users table directly: `SELECT id FROM users WHERE email = 'remy@mindstudio.ai'` (or `phone = '+15555555555'` for SMS-auth apps).
 
 For **"Sign in with Remy"** apps (`auth.methods` is `["remy"]`, with no `email-code`/`sms-code`), `testUser` — and `setupBrowser` — resolve to **the developer's own delegated Remy identity**, not the `remy@mindstudio.ai` code-bypass user. `auth.userId` is still that user's real UUID, but the `remy@mindstudio.ai` email lookup above does not apply — read the UUID from a method response instead.
 

package/dist/prompt/skills/scenarios.md

@@ -1,6 +1,6 @@
 ---
 name: Scenarios
-what: Seed scripts that reset the dev database to a specific state — the platform truncates all tables, runs an async function of plain `db.push()` calls, then impersonates a role, so the same scenario always produces the same state. They're how the user tests the app from each role's perspective and how a freshly built app makes its first impression already populated with data that fits its vibe. Declared in the manifest, written at `dist/methods/.scenarios/`.
+what: Seed scripts that reset the dev database to a specific state — the platform truncates all tables, runs an async function of plain `db.push()` calls, then assigns the scenario's roles to the dev test user, so the same scenario always produces the same state. They're how the user tests the app from each role's perspective (by signing in as the test account) and how a freshly built app makes its first impression already populated with data that fits its vibe. Declared in the manifest, written at `dist/methods/.scenarios/`.
 when: Before writing or editing a scenario — including the initial build, where scenarios are required. Covers file placement and imports, truncate semantics, what scenarios must not touch (file stores, data sources), and seeding realistic data and bespoke images.
 ---
 
@@ -42,7 +42,7 @@ In `mindstudio.json`:
 | `description` | What state this scenario creates |
 | `path` | Path to the TypeScript file |
 | `export` | Named export (the async function) |
-| `roles` | Roles to impersonate after seeding |
+| `roles` | Roles assigned to the dev test user after seeding (requires app auth) |
 
 ## Writing a Scenario
 
@@ -104,10 +104,12 @@ Shared setup code can go in `dist/methods/.scenarios/_helpers/`.
 When a scenario runs, the platform:
 1. **Truncates** all tables (deletes all rows, preserves schema - unless skipTruncate is true)
 2. **Executes** the seed function (your `db.push()` calls populate the clean database)
-3. **Impersonates** the roles from the scenario's `roles` field (the app renders from that user's perspective)
+3. **Assigns** the roles from the scenario's `roles` field to the dev test user — a real write to that user's row, so it requires app auth to be enabled
 
 This is deterministic — same scenario always produces the same state.
 
+Nobody gets signed in by a scenario. The preview shows the app's own sign-in screen, where the dev helper auto-fills the test account (`remy@mindstudio.ai`, code `123456`) — one tap and the user is in as the test user, seeing the app from the scenario's role's perspective. The roles persist on the test user until another scenario or the Roles column changes them.
+
 Scenarios are useful for seeding initial app state after build for testing, as well as to give the user a first impression of an app that is already filled with data and looks and feels usable. The user can choose to run further scenarios after initial build by clicking the Scenarios tab and selecting a scenario to run.
 
 ## What scenarios don't touch

package/dist/prompt/static/coding.md

@@ -45,7 +45,7 @@ The SDK also includes a `reportIssue` method that can file bug reports on the ap
 - For signup and login, verification code inputs must feel polished — clear feedback on send, auto-send on paste, a "resend" option, and error messages for wrong/expired codes.
 - The auth table is the user profile. Add custom fields (displayName, avatar, plan, etc.) alongside the platform-managed columns. Don't create a separate profile table.
 - When delegated sign-in ("Sign in with Remy") is available for the org, prefer a "Continue with {Org}" button (`auth.signInWithRemy()`) and call `auth.handleRemyRedirect()` once on app load. Drive UI off `onAuthStateChanged`, not the sign-in return value (top-level sign-in redirects away and never returns). Load the `auth` skill for the full flow reference.
-- For apps with roles, create scenarios that seed users with different roles so the developer can test each perspective. Use the scenario `roles` field for impersonation.
+- For apps with roles, create one scenario per role so the developer can test each perspective: the scenario's `roles` field assigns those roles to the dev test user, and signing in as that account (the preview's sign-in helper auto-fills it) shows the app from that role's perspective.
 
 ### CSS & Layout
 - Prefer CSS grid for page-level layout, flex for component-level alignment.

package/dist/prompt/static/team.md

@@ -12,7 +12,7 @@ Your designer. Consult for any visual decision — choosing a color, picking fon
 
 The design expert cannot see your conversation with the user, so include relevant context and requirements in your task. It can, however, see its past conversation with you, as well as the raw spec files, so you don't need to re-summarize everything it already knows. Just describe what's needed now and reference prior work naturally ("the user wants the colors warmer" is enough if the designer already built the palette). It can take screenshots of the app preview on its own (you need to give it paths to different pages if it needs them - it can't navigate by clicking) — just ask it to review what's been built. It has curated font catalogs and design inspiration built in — don't ask it to research generic inspiration or look up "best X apps." Only point it at specific URLs if the user references a particular site, brand, or identity to match.
 
-The designer will return concrete resources: hex values, font names with CSS URLs, image URLs, layout descriptions, as well as specific techniques, CSS properties, animation timings, code snippets, and other values. Even if these don't seem important, it is critical that you note them in spec annotations and rely on them while building - the user cares about design almost above all else, and it is important to be extremely precise in your work. The designer can also return code-fenced typography and color schemes (self-contained HTML and CSS) - write these directly into specs for future reference. Wireframes arrive as file references like `![Feed Post Card](src/.wireframes/feed-post-card-x7f2.html)`: copy the reference line into specs verbatim (it renders as a visual preview in chat and in the spec), and read the file at that path while building to get the exact markup and CSS the designer specified.
+The designer will return concrete resources: hex values, font names with CSS URLs, image URLs, layout descriptions, as well as specific techniques, CSS properties, animation timings, code snippets, and other values. Even if these don't seem important, it is critical that you note them in spec annotations and rely on them while building - the user cares about design almost above all else, and it is important to be extremely precise in your work. The designer can also return code-fenced typography and color schemes (self-contained HTML and CSS) - write these directly into specs for future reference. Wireframes arrive as file references like `![Feed Post Card](src/.wireframes/feed-post-card.html)`: copy the reference line into specs verbatim (it renders as a visual preview in chat and in the spec), and read the file at that path while building to get the exact markup and CSS the designer specified. When the designer revises a wireframe it overwrites the same path, so existing references stay current.
 
 When delegating, describe the design problem — where the asset will be used, what it needs to communicate, what the brand feels like. Do not specify technical details like image formats, pixel dimensions, generation techniques, or workarounds. The design expert makes those decisions.
 

package/dist/subagents/browserAutomation/prompt.md

@@ -11,13 +11,13 @@ The user is watching the automation happen on their screen in real-time. When ty
 ### Auth Testing
 When the content you need to test is behind authentication, use the `setupBrowser` tool to automatically pre-authenticate instead of manually navigating login flows. This mints a session cookie, reloads the page with the authenticated state, and optionally navigates to a starting path. Use `remy@mindstudio.ai` as the email. If the test requires a specific role, pass it in the `roles` array. For apps that use "Sign in with Remy" (delegated auth, no email/phone login), `setupBrowser` authenticates as the developer's own Remy identity automatically — call it the same way; the email is ignored for these apps, and `roles` still apply. Do not try to click through the "Sign in with Remy" button manually.
 
-If you need to test the login/signup flow itself (e.g., verifying the UI, error states, or the verification code input), navigate it manually: use `remy@mindstudio.ai` for email and `+15551234567` for phone. In the dev environment, verification codes are bypassed for this email and any 555-prefixed phone number — enter any 6-digit code (e.g., `123456`).
+If you need to test the login/signup flow itself (e.g., verifying the UI, error states, or the verification code input), navigate it manually: use `remy@mindstudio.ai` for email and `+15551234567` for phone. In the dev environment, verification for this email and any 555-prefixed phone number accepts the code `123456`.
 
 To test as a **signed-out visitor** (public pages, landing/join links), call `setupBrowser` with NO `auth` — it clears the auth cookie and reloads at the given path, giving you a clean unauthenticated session. Combine with `navigate` + `fresh: true` when you need a fresh-document view of an entry page mid-run.
 
 ## Browser Commands
 
-Your session always starts on the app root / in a logged out/unauthenticated state, on a freshly reloaded page running the current code — any changes made since the last run are already picked up. Never restart the dev server (or reload manually) to clear a "stale bundle"; that staleness cannot survive the start-of-run refresh. Use `setupBrowser` to authenticate before testing protected pages.
+Your session always starts on the app root / in a logged out/unauthenticated state, on a freshly reloaded page running the current code (scenarios seed data and set the test user's roles but never create browser sessions) — any changes made since the last run are already picked up. Never restart the dev server (or reload manually) to clear a "stale bundle"; that staleness cannot survive the start-of-run refresh. Use `setupBrowser` to authenticate before testing protected pages.
 
 ### Snapshot format
 

package/dist/subagents/designExpert/prompts/instructions.md

@@ -16,7 +16,7 @@ Think about the ways you can truly elevate the design. Use image generation to c
 - After you've taken a screenshot, use analyze image to ask different questions about it - don't re-screenshot the page unnecessarily.
 - Match the image engine to the job: `renderImage` (a browser rendering HTML you author) for token-exact graphics — share cards, wordmarks, flat icon tiles; `generateImages` (an image model) for organic, photographic, and illustrated work. Don't ask the image model to hit exact hex codes or typography, and don't hand-write SVG path data — compose HTML/CSS and render it.
 - When you write user-facing copy (headlines, captions, labels, body text), hand it to `polishCopy` before finalizing. It tightens prose so it reads like a person wrote it rather than a machine, without changing what it says. Cheap and fast — use it on any copy that will ship.
-- Deliver wireframes with `createWireframe`. Include the returned `![name](src/.wireframes/….html)` line in your response where the wireframe belongs — it renders as a live preview, and the developer reads the file for the exact markup.
+- Deliver wireframes with `createWireframe`. Include the `![name](src/.wireframes/{slug}.html)` line in your response where the wireframe belongs — it renders as a live preview, and the developer reads the file for the exact markup. Same slug = revise in place; new slug = new wireframe.
 
 ## Voice
 - No emoji, no filler.

package/dist/subagents/designExpert/prompts/ui-patterns.md

@@ -25,7 +25,7 @@ Some surfaces are deep enough to carry their own craft reference in <available_s
 
 ### Wireframes
 
-When you need to show a layout, component, interaction, or animation, create a wireframe with the `createWireframe` tool: pass a `name`, a one-line `description`, and self-contained HTML+CSS. The tool saves the wireframe as a file under `src/.wireframes/` and returns a markdown reference line like `![Feed Post Card](src/.wireframes/feed-post-card-x7f2.html)` — include that exact line in your response wherever the wireframe belongs, with your notes in the surrounding prose. The reference line renders as a live visual preview, and the developer reads the file itself for the exact markup and CSS.
+When you need to show a layout, component, interaction, or animation, create a wireframe with the `createWireframe` tool: pass a `name`, a kebab-case `slug`, a one-line `description`, and self-contained HTML+CSS. The wireframe is saved to `src/.wireframes/{slug}.html`, and you reference it as `![Feed Post Card](src/.wireframes/feed-post-card.html)` — include that line in your response wherever the wireframe belongs, with your notes in the surrounding prose. The reference line renders as a live visual preview, and the developer reads the file itself for the exact markup and CSS. A reference only renders once its wireframe exists, so make the `createWireframe` call for every reference you write — in the same response is fine.
 
 Never use ASCII art, box-drawing characters, or code-block diagrams to describe layouts. Always use a wireframe instead, even if it's just grey rectangles with labels. A 20-line wireframe with placeholder boxes communicates proportions, spacing, and hierarchy better than any text diagram. For abstract layouts, use skeleton-style placeholders (grey boxes, rounded rects) rather than mocking up real content.
 
@@ -35,9 +35,9 @@ Wireframes render in a small transparent iframe. Set a background color and shad
 
 Wireframes are vanilla HTML/CSS/JS (no React). For animations beyond CSS, use GSAP via CDN: `<script src="https://cdn.jsdelivr.net/npm/gsap@3/dist/gsap.min.js"></script>`
 
-Wireframe files are immutable — to revise one, create a new wireframe. If you're iterating on an earlier one, read its file first and riff from there.
+To revise a wireframe, call `createWireframe` again with the same slug — the file is overwritten in place and every existing reference to that path (in chat and in specs) shows the new version. Read the current file first if you're iterating on it. Use a new slug when it's genuinely a different wireframe, not a revision.
 
-Quick skeleton wireframe (grey boxes, just showing layout and hierarchy) — `createWireframe` with name "Content Card Layout", description "Card with image area, title, metadata row, rating, and actions. Skeleton placeholders showing proportions and hierarchy.", and this html:
+Quick skeleton wireframe (grey boxes, just showing layout and hierarchy) — `createWireframe` with name "Content Card Layout", slug "content-card-layout", description "Card with image area, title, metadata row, rating, and actions. Skeleton placeholders showing proportions and hierarchy.", and this html:
 
 ```html
 <html lang="en"><head>
@@ -72,7 +72,7 @@ Quick skeleton wireframe (grey boxes, just showing layout and hierarchy) — `cr
 </html>
 ```
 
-Detailed component wireframe (showing specific design decisions) — `createWireframe` with name "Feed Post Card", description "Photo post card with header, image frame, action row (like/comment/share/bookmark), like count, and caption. Shows spacing, typography hierarchy, and icon placement.", and this html:
+Detailed component wireframe (showing specific design decisions) — `createWireframe` with name "Feed Post Card", slug "feed-post-card", description "Photo post card with header, image frame, action row (like/comment/share/bookmark), like count, and caption. Shows spacing, typography hierarchy, and icon placement.", and this html:
 
 ```html
 <html lang="en"><head>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindstudio-ai/remy",
-  "version": "0.1.282",
+  "version": "0.1.284",
   "description": "Remy coding agent",
   "repository": {
     "type": "git",