@qatonic_innovations/qaios 0.1.0

package/dist/migrations/0001_init.sql

@@ -0,0 +1,182 @@
+-- Initial schema for QAIOS v0.1.
+-- Source of truth: docs/internal/QAIOS_DataSchemas.md §3.
+-- Forward-only; no down-migrations in v0.x.
+
+PRAGMA journal_mode = WAL;
+PRAGMA foreign_keys = ON;
+
+-- ── workflows ──────────────────────────────────────────────────────
+CREATE TABLE workflows (
+  id              TEXT PRIMARY KEY,                    -- ULID
+  command         TEXT NOT NULL,
+  args_json       TEXT NOT NULL,                       -- JSON
+  state           TEXT NOT NULL,
+  mode            TEXT NOT NULL CHECK (mode IN ('LITE','FULL','TRUST')),
+  status          TEXT NOT NULL CHECK (status IN ('running','blocked','succeeded','failed','cancelled')),
+  blocked_reason  TEXT,
+  cost_tokens     INTEGER NOT NULL DEFAULT 0,
+  cost_usd_cents  INTEGER NOT NULL DEFAULT 0,
+  created_at      TEXT NOT NULL,
+  updated_at      TEXT NOT NULL,
+  finished_at     TEXT
+);
+
+CREATE INDEX idx_workflows_state      ON workflows(state);
+CREATE INDEX idx_workflows_status     ON workflows(status);
+CREATE INDEX idx_workflows_created_at ON workflows(created_at);
+
+-- ── audit_log (append-only, hash-chained) ──────────────────────────
+CREATE TABLE audit_log (
+  id               TEXT PRIMARY KEY,                   -- ULID
+  workflow_id      TEXT NOT NULL,
+  phase            TEXT NOT NULL,
+  skill_id         TEXT,
+  event            TEXT NOT NULL,
+  payload_json     TEXT NOT NULL,
+  model_call_json  TEXT,
+  prev_hash        TEXT NOT NULL,
+  hash             TEXT NOT NULL,
+  timestamp        TEXT NOT NULL,
+  actor            TEXT NOT NULL CHECK (actor IN ('agent','human','system')),
+  actor_id         TEXT,
+  FOREIGN KEY (workflow_id) REFERENCES workflows(id)
+);
+
+CREATE INDEX idx_audit_workflow  ON audit_log(workflow_id);
+CREATE INDEX idx_audit_event     ON audit_log(event);
+CREATE INDEX idx_audit_timestamp ON audit_log(timestamp);
+
+-- Block UPDATE / DELETE on audit_log via triggers (defense in depth)
+CREATE TRIGGER audit_log_no_update
+  BEFORE UPDATE ON audit_log
+  BEGIN
+    SELECT RAISE(ABORT, 'audit_log is append-only');
+  END;
+
+CREATE TRIGGER audit_log_no_delete
+  BEFORE DELETE ON audit_log
+  BEGIN
+    SELECT RAISE(ABORT, 'audit_log is append-only');
+  END;
+
+-- ── artifacts ──────────────────────────────────────────────────────
+CREATE TABLE artifacts (
+  id            TEXT PRIMARY KEY,
+  workflow_id   TEXT NOT NULL,
+  skill_id      TEXT NOT NULL,
+  type          TEXT NOT NULL,
+  path          TEXT NOT NULL,
+  content_hash  TEXT NOT NULL,
+  confidence    REAL NOT NULL CHECK (confidence >= 0 AND confidence <= 1),
+  created_at    TEXT NOT NULL,
+  FOREIGN KEY (workflow_id) REFERENCES workflows(id)
+);
+
+CREATE INDEX idx_artifacts_workflow ON artifacts(workflow_id);
+CREATE INDEX idx_artifacts_type     ON artifacts(type);
+
+-- ── runs ───────────────────────────────────────────────────────────
+CREATE TABLE runs (
+  id              TEXT PRIMARY KEY,
+  workflow_id     TEXT NOT NULL,
+  test_pattern    TEXT,
+  status          TEXT NOT NULL,
+  passed_count    INTEGER NOT NULL DEFAULT 0,
+  failed_count    INTEGER NOT NULL DEFAULT 0,
+  flaky_count     INTEGER NOT NULL DEFAULT 0,
+  skipped_count   INTEGER NOT NULL DEFAULT 0,
+  duration_ms     INTEGER NOT NULL DEFAULT 0,
+  artifacts_path  TEXT,
+  started_at      TEXT NOT NULL,
+  finished_at     TEXT,
+  FOREIGN KEY (workflow_id) REFERENCES workflows(id)
+);
+
+-- ── test_results (per-test rows within a run) ─────────────────────
+CREATE TABLE test_results (
+  id                   TEXT PRIMARY KEY,
+  run_id               TEXT NOT NULL,
+  test_name            TEXT NOT NULL,
+  test_file            TEXT NOT NULL,
+  status               TEXT NOT NULL,
+  duration_ms          INTEGER NOT NULL,
+  error_message        TEXT,
+  classification_json  TEXT,                            -- output of classify.result
+  FOREIGN KEY (run_id) REFERENCES runs(id)
+);
+
+CREATE INDEX idx_test_results_run    ON test_results(run_id);
+CREATE INDEX idx_test_results_status ON test_results(status);
+
+-- ── gates ──────────────────────────────────────────────────────────
+CREATE TABLE gates (
+  id                 TEXT PRIMARY KEY,
+  workflow_id        TEXT NOT NULL,
+  skill_id           TEXT NOT NULL,
+  gate_type          TEXT NOT NULL,
+  risk_level         TEXT NOT NULL,
+  confidence         REAL NOT NULL,
+  required_action    TEXT NOT NULL,
+  status             TEXT NOT NULL CHECK (status IN ('pending','approved','rejected','expired')),
+  payload_json       TEXT NOT NULL,
+  resolved_by        TEXT,
+  resolution_reason  TEXT,
+  created_at         TEXT NOT NULL,
+  resolved_at        TEXT
+);
+
+CREATE INDEX idx_gates_workflow ON gates(workflow_id);
+CREATE INDEX idx_gates_status   ON gates(status);
+
+-- ── mcp_servers ────────────────────────────────────────────────────
+CREATE TABLE mcp_servers (
+  name          TEXT PRIMARY KEY,
+  type          TEXT NOT NULL CHECK (type IN ('stdio','http','sse')),
+  command       TEXT,
+  url           TEXT,
+  args_json     TEXT,                                   -- JSON array
+  env_json      TEXT,                                   -- JSON object
+  enabled       INTEGER NOT NULL DEFAULT 1,             -- 0 or 1
+  installed_at  TEXT NOT NULL
+);
+
+-- ── visual_baselines ──────────────────────────────────────────────
+CREATE TABLE visual_baselines (
+  id            TEXT PRIMARY KEY,
+  snapshot_id   TEXT NOT NULL,
+  name          TEXT NOT NULL,
+  route         TEXT NOT NULL,
+  state         TEXT,
+  viewport      TEXT NOT NULL,
+  image_path    TEXT NOT NULL,
+  approved_at   TEXT NOT NULL,
+  approved_by   TEXT,
+  workflow_id   TEXT NOT NULL,
+  FOREIGN KEY (workflow_id) REFERENCES workflows(id)
+);
+
+CREATE INDEX idx_baselines_name ON visual_baselines(name, viewport);
+
+-- ── visual_diffs (pending review) ─────────────────────────────────
+CREATE TABLE visual_diffs (
+  id                   TEXT PRIMARY KEY,
+  workflow_id          TEXT NOT NULL,
+  baseline_id          TEXT NOT NULL,
+  current_image_path   TEXT NOT NULL,
+  diff_image_path      TEXT NOT NULL,
+  pixels_changed       INTEGER NOT NULL,
+  percentage_changed   REAL NOT NULL,
+  classification_json  TEXT,
+  status               TEXT NOT NULL CHECK (status IN ('pending','approved','rejected','auto_resolved')),
+  created_at           TEXT NOT NULL,
+  resolved_at          TEXT,
+  FOREIGN KEY (workflow_id) REFERENCES workflows(id),
+  FOREIGN KEY (baseline_id) REFERENCES visual_baselines(id)
+);
+
+-- ── config (key-value) ────────────────────────────────────────────
+CREATE TABLE config (
+  key         TEXT PRIMARY KEY,
+  value_json  TEXT NOT NULL,
+  updated_at  TEXT NOT NULL
+);

package/dist/migrations/0002_baselines_unique_and_workflow_lease.sql

@@ -0,0 +1,50 @@
+-- 0002 — enforce one baseline per (name, viewport).
+--
+-- The original schema had only a plain INDEX on (name, viewport), so the
+-- capture `--update` path (which INSERTs rather than upserts) could create
+-- duplicate baselines for the same name+viewport. findByNameViewport() then
+-- returned an arbitrary row, so a check could silently diff against a stale
+-- baseline. This migration removes existing duplicates (keeping the most
+-- recently approved row per name+viewport) and replaces the plain index with
+-- a UNIQUE one so duplicates can never be inserted again.
+
+-- 1. Delete older duplicate rows, keeping the one with the newest
+--    approved_at per (name, viewport). Ties broken by id (rowid is not
+--    used since the PK is a TEXT ULID, which is itself time-ordered).
+DELETE FROM visual_baselines
+WHERE id NOT IN (
+  SELECT keep_id FROM (
+    SELECT id AS keep_id
+    FROM visual_baselines b
+    WHERE NOT EXISTS (
+      SELECT 1 FROM visual_baselines other
+      WHERE other.name = b.name
+        AND other.viewport = b.viewport
+        AND (
+          other.approved_at > b.approved_at
+          OR (other.approved_at = b.approved_at AND other.id > b.id)
+        )
+    )
+  )
+);
+
+-- 2. Replace the non-unique index with a UNIQUE one.
+DROP INDEX IF EXISTS idx_baselines_name;
+CREATE UNIQUE INDEX idx_baselines_name_viewport_unique
+  ON visual_baselines(name, viewport);
+
+-- 3. Execution lease columns on workflows.
+--    A non-terminal workflow can currently be resumed (or double-run)
+--    concurrently — re-executing side effects (test runs, file writes,
+--    defect filing). These columns let the orchestrator claim an
+--    exclusive, time-bounded lease via an atomic conditional UPDATE so a
+--    second runner is refused while the first is live. NULL = unleased.
+ALTER TABLE workflows ADD COLUMN lease_owner TEXT;
+ALTER TABLE workflows ADD COLUMN lease_expires_at TEXT;
+
+-- 4. Persist the failing test's error STACK, not just its message.
+--    The Playwright report parser already extracts the stack, but the
+--    adapter dropped it — so classify.result (whose prompt relies on
+--    stack-trace cues to tell a broken locator from an environmental
+--    failure) never saw it. Add the column so it's stored and forwarded.
+ALTER TABLE test_results ADD COLUMN error_stack TEXT;

package/dist/visual/scripts/capture-screenshot.mjs

@@ -0,0 +1,69 @@
+#!/usr/bin/env node
+// capture-screenshot.mjs — Playwright headless screenshot capture for
+// W6-T2 (visual baselines). Runs in the user's project so it can
+// dynamic-import their installed `playwright` package.
+//
+// Reads inputs from env vars:
+//   QAIOS_SCREENSHOT_URL          — full URL to navigate to (required)
+//   QAIOS_SCREENSHOT_OUTPUT       — file path to write the PNG (required)
+//   QAIOS_SCREENSHOT_VIEWPORT_W   — viewport width (required, integer)
+//   QAIOS_SCREENSHOT_VIEWPORT_H   — viewport height (required, integer)
+//   QAIOS_SCREENSHOT_TIMEOUT_MS   — navigation timeout (default 15_000)
+//   QAIOS_SCREENSHOT_WAIT_UNTIL   — load|domcontentloaded|networkidle
+//                                   (default 'networkidle' — stable for
+//                                    visual diffs)
+//   QAIOS_SCREENSHOT_FULL_PAGE    — '1' for fullPage (default '1')
+//
+// Per BuildPlan W6-T2: page.screenshot({ animations: 'disabled' }) is
+// used unconditionally for stability — same input → same PNG → same SHA.
+
+import { writeFileSync } from 'node:fs';
+
+const url = process.env.QAIOS_SCREENSHOT_URL;
+const out = process.env.QAIOS_SCREENSHOT_OUTPUT;
+const w = Number.parseInt(process.env.QAIOS_SCREENSHOT_VIEWPORT_W ?? '', 10);
+const h = Number.parseInt(process.env.QAIOS_SCREENSHOT_VIEWPORT_H ?? '', 10);
+
+if (!url || !out || !Number.isFinite(w) || !Number.isFinite(h)) {
+  process.stderr.write(
+    'capture-screenshot: QAIOS_SCREENSHOT_URL/OUTPUT/VIEWPORT_W/VIEWPORT_H all required\n',
+  );
+  process.exit(2);
+}
+
+const timeoutMs = Number.parseInt(process.env.QAIOS_SCREENSHOT_TIMEOUT_MS ?? '15000', 10);
+const waitUntil = process.env.QAIOS_SCREENSHOT_WAIT_UNTIL ?? 'networkidle';
+const fullPage = process.env.QAIOS_SCREENSHOT_FULL_PAGE !== '0';
+
+let chromium;
+try {
+  ({ chromium } = await import('playwright'));
+} catch (err) {
+  process.stderr.write(
+    `capture-screenshot: failed to load 'playwright' from project — is it installed? ${err?.message ?? err}\n`,
+  );
+  process.exit(3);
+}
+
+const browser = await chromium.launch({ headless: true });
+try {
+  const context = await browser.newContext({
+    viewport: { width: w, height: h },
+    // Disable animations + reduce motion for screenshot stability.
+    reducedMotion: 'reduce',
+  });
+  const page = await context.newPage();
+  await page.goto(url, { timeout: timeoutMs, waitUntil });
+  const buffer = await page.screenshot({
+    type: 'png',
+    fullPage,
+    animations: 'disabled',
+    caret: 'hide',
+  });
+  writeFileSync(out, buffer);
+} catch (err) {
+  process.stderr.write(`capture-screenshot: ${err?.message ?? err}\n`);
+  process.exit(4);
+} finally {
+  await browser.close();
+}

package/package.json

@@ -0,0 +1,81 @@
+{
+  "name": "@qatonic_innovations/qaios",
+  "version": "0.1.0",
+  "type": "module",
+  "description": "AI QA engineer in your terminal — designs, writes, runs, heals, and explores tests for web UI and APIs with audit-grade traceability.",
+  "license": "MIT",
+  "homepage": "https://github.com/qatonic/qaios#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/qatonic/qaios.git",
+    "directory": "packages/cli"
+  },
+  "bugs": {
+    "url": "https://github.com/qatonic/qaios/issues"
+  },
+  "keywords": [
+    "qa",
+    "testing",
+    "playwright",
+    "ai",
+    "agent",
+    "anthropic",
+    "claude",
+    "mcp",
+    "cli",
+    "test-generation",
+    "test-automation",
+    "visual-regression",
+    "self-healing"
+  ],
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "bin": {
+    "qaios": "./dist/index.js"
+  },
+  "files": [
+    "dist",
+    "!dist/**/*.map",
+    "README.md",
+    "LICENSE"
+  ],
+  "dependencies": {
+    "@anthropic-ai/sdk": "^0.40.0",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "better-sqlite3": "^11.7.0",
+    "commander": "^12.1.0",
+    "ink": "^5.2.1",
+    "pino": "^9.5.0",
+    "pino-pretty": "^11.3.0",
+    "pixelmatch": "^7.2.0",
+    "pngjs": "^7.0.0",
+    "react": "^18.3.1",
+    "typescript": "^5.7.2",
+    "ulid": "^2.3.0",
+    "yaml": "^2.6.1",
+    "zod": "^3.23.8",
+    "zod-to-json-schema": "^3.24.0"
+  },
+  "devDependencies": {
+    "@types/better-sqlite3": "^7.6.12",
+    "@types/pixelmatch": "^5.2.6",
+    "@types/pngjs": "^6.0.5",
+    "@types/react": "^18.3.28",
+    "ink-testing-library": "^4.0.0",
+    "@qaios/runtime": "0.0.0",
+    "@qaios/skills": "0.0.0",
+    "@qaios/shared": "0.0.0"
+  },
+  "scripts": {
+    "build": "tsup && node scripts/copy-templates.mjs && node scripts/copy-runtime-assets.mjs",
+    "test": "vitest run",
+    "test:unit": "vitest run test/unit",
+    "test:integration": "vitest run test/integration --passWithNoTests",
+    "test:coverage": "vitest run --coverage",
+    "typecheck": "tsc --noEmit"
+  }
+}