@qatonic_innovations/qaios 0.5.1 → 0.5.3

package/README.md

@@ -1,6 +1,6 @@
 # QAIOS
 
-> **AI QA engineer in your terminal.** Designs, writes, runs, heals, and explores tests for web UI and APIs — with audit-grade traceability.
+> **AI QA engineer in your terminal.** Designs, writes, runs, heals, and explores tests for web UI and APIs — with tamper-evident local history.
 
 [![npm version](https://img.shields.io/npm/v/@qatonic_innovations/qaios.svg)](https://www.npmjs.com/package/@qatonic_innovations/qaios)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://github.com/qatonic/qaios/blob/main/LICENSE)
@@ -10,7 +10,7 @@ QAIOS acts like a QA engineer on your team. Point it at a feature description or
 
 **Mental model: Claude Code, but for QA work instead of feature coding.**
 
-> **Status: early alpha (v0.1).** Core flows — `init`, `doctor`, test design
+> **Status: pre-1.0 (v0.5.2 released).** Core flows — `init`, `doctor`, test design
 > & generation, Playwright execution, self-healing, accessibility, and the
 > audit log — work today. Expect rough edges and please
 > [report issues](https://github.com/qatonic/qaios/issues). After installing,
@@ -95,7 +95,7 @@ Generated:
   tests/auth/LoginPage.po.ts
   .qaios/specs/01JTZ1…/DesignSpec.json
 
-Cost: 11,403 tokens · $0.06 (3 of 15 LLM calls used)
+Cost: 11,403 tokens · $0.06 (3 of 20 LLM calls used)
 ```
 
 > **Gates:** on HIGH/CRITICAL-risk features QAIOS pauses for review. Approve interactively with `qaios review`, or pass `--yes` to auto-approve for a non-interactive run.
@@ -117,7 +117,7 @@ Cost: 11,403 tokens · $0.06 (3 of 15 LLM calls used)
 | `qaios review`                                       | Walk pending human-review gates and approve/reject; resumes the workflow.                                                   |
 | `qaios history [--verify]`                           | List workflows, inspect the audit log, and verify the hash chain.                                                           |
 | `qaios config get\|set\|show\|edit`                  | Read/write `.qaios/config.yaml` (schema-validated).                                                                         |
-| `qaios mcp list\|add\|remove\|enable\|disable\|test` | Manage MCP servers (GitHub, Jira, Slack, custom).                                                                           |
+| `qaios mcp list\|add\|remove\|enable\|disable\|test` | Manage stdio MCP servers (GitHub, Jira, custom).                                                                            |
 
 Run `qaios <command> --help` for the full option list of any command.
 
@@ -250,7 +250,7 @@ qaios config set mode TRUST
 
 ## Cost & privacy
 
-- Skills run on Claude Sonnet (Anthropic) or gpt-4o (OpenAI) per your `llm.provider`. A typical `qaios test` costs ~**$0.04–0.10**. Each workflow is capped (default `min(15 calls, $0.50)`, configurable) and aborts if exceeded.
+- Skills use Anthropic or OpenAI per `llm.provider`. Each workflow is capped at `min(20 calls, $1.00)` by default (configurable) and aborts if exceeded.
 - **Local-first.** No telemetry, no phone-home. The only outbound traffic is (a) LLM calls to your configured provider (Anthropic or OpenAI) with the prompts QAIOS builds, and (b) any MCP servers you configure. You bring your own API key; QAIOS does not proxy your requests. See [SECURITY.md](https://github.com/qatonic/qaios/blob/main/SECURITY.md) for exactly what's sent.
 
 ---
@@ -280,20 +280,18 @@ output for CI consumption.
 - [Commands Reference](https://github.com/qatonic/qaios/blob/main/docs/commands.md) — every CLI command
 - [Skills Reference](https://github.com/qatonic/qaios/blob/main/docs/skills-reference.md) — what each skill does
 - [MCP Servers](https://github.com/qatonic/qaios/blob/main/docs/mcp-servers.md) — adding integrations
+- [JSON Output](https://github.com/qatonic/qaios/blob/main/docs/json-output.md) — automation compatibility
+- [Compatibility Policy](https://github.com/qatonic/qaios/blob/main/docs/compatibility.md) — stability and deprecation
 - A runnable end-to-end example lives in [`examples/live-saucedemo`](https://github.com/qatonic/qaios/tree/main/examples/live-saucedemo).
 
 ---
 
 ## Status & roadmap
 
-**v0.1 (now):** Web UI + API + visual regression + self-healing + exploratory + accessibility, as an open-source CLI. Early — feedback wanted.
-
-- **v0.2** — optional cloud sync + web dashboard
-- **v0.5** — mobile testing
-- **v0.7** — performance + security testing
-- **v1.0** — database testing, stable public API
-
-The roadmap is gated on real-world validation, not a calendar.
+**v0.5.2 is released.** v0.5.3 focuses on truth and consistency before the
+trustworthy-alpha, agent-runtime, quality-intelligence, ecosystem, and stable-OS phases.
+The [active roadmap](https://github.com/qatonic/qaios/blob/main/QAIOS_PRODUCT_AND_ENGINEERING_ROADMAP.md)
+is validation-gated, not calendar-driven.
 
 ---
 

package/dist/index.js

@@ -4301,7 +4301,7 @@ function tempForTier(tier) {
 }
 var DEFAULT_LLM_TIMEOUT_MS = 24e4;
 var DEFAULT_MAX_OUTPUT_TOKENS = 16384;
-var MAX_OUTPUT_TOKENS_CEILING = 65536;
+var MAX_OUTPUT_TOKENS_CEILING = 21e3;
 function llmTimeoutMs() {
   const raw = process.env["QAIOS_LLM_TIMEOUT_MS"];
   if (raw === void 0) return DEFAULT_LLM_TIMEOUT_MS;
@@ -8404,7 +8404,7 @@ var McpClient = class {
     for (const s of opts.servers) {
       if (s.enabled !== false) this.registry.set(s.name, s);
     }
-    this.connectionFactory = opts.connectionFactory ?? defaultConnectionFactory;
+    this.connectionFactory = opts.connectionFactory ?? createDefaultConnectionFactory(opts.clientVersion ?? "0.0.0");
     if (opts.auditLogger !== void 0) this.auditLogger = opts.auditLogger;
     if (opts.workflowId !== void 0) this.workflowId = opts.workflowId;
     if (opts.skillId !== void 0) this.skillId = opts.skillId;
@@ -8555,11 +8555,14 @@ var McpClient = class {
     });
   }
 };
-var defaultConnectionFactory = async (config) => {
+function createDefaultConnectionFactory(clientVersion) {
+  return async (config) => connectDefault(config, clientVersion);
+}
+async function connectDefault(config, clientVersion) {
   if (config.type !== "stdio") {
     throw new McpError(
       "qaios.mcp.transport_not_supported",
-      `MCP transport "${config.type}" is not supported in v0.1 \u2014 only stdio is wired.`,
+      `MCP transport "${config.type}" is not supported by this release \u2014 only stdio is available.`,
       { serverName: config.name }
     );
   }
@@ -8584,7 +8587,7 @@ var defaultConnectionFactory = async (config) => {
     args: [...config.args],
     env: buildSubprocessEnv(resolved)
   });
-  const client = new Client({ name: "qaios", version: "0.1.0" }, { capabilities: {} });
+  const client = new Client({ name: "qaios", version: clientVersion }, { capabilities: {} });
   await client.connect(transport);
   return {
     name: config.name,
@@ -8618,7 +8621,7 @@ var defaultConnectionFactory = async (config) => {
       await client.close();
     }
   };
-};
+}
 function narrowContent(block) {
   if (typeof block !== "object" || block === null) return null;
   const b = block;
@@ -8766,14 +8769,54 @@ function runDoctor(opts = {}) {
   checks.push(checkConfig(qaiosDir, qaiosExists));
   checks.push(checkPlaywright(cwd));
   checks.push(checkAxeCore(cwd));
-  checks.push({
-    name: "MCP servers",
-    status: "skip",
-    detail: "wired up in W8-T1 (MCP client)"
-  });
+  checks.push(checkMcpServers(qaiosDir, qaiosExists));
   const exitCode = checks.some((c) => c.status === "fail") ? ExitCode.TOOL_ERROR : ExitCode.SUCCESS;
   return { exitCode, checks };
 }
+function checkMcpServers(qaiosDir, qaiosExists) {
+  const name = "MCP servers";
+  if (!qaiosExists) return { name, status: "skip", detail: "skipped (no .qaios/)" };
+  const dbPath = path15.join(qaiosDir, "workflows.db");
+  if (!existsSync(dbPath)) return { name, status: "skip", detail: "skipped (no workflows.db)" };
+  let storage;
+  try {
+    storage = Storage.open(dbPath, { skipMigrations: true });
+    const servers = new McpServersRepository(storage.db).list();
+    if (servers.length === 0) {
+      return { name, status: "ok", detail: "no servers configured" };
+    }
+    const unsupported = servers.filter((server) => server.type !== "stdio");
+    const invalidStdio = servers.filter(
+      (server) => server.type === "stdio" && !server.command?.trim()
+    );
+    if (unsupported.length > 0 || invalidStdio.length > 0) {
+      const details = [];
+      if (unsupported.length > 0) {
+        details.push(
+          `unsupported transport on ${unsupported.map((server) => server.name).join(", ")} (only stdio is available)`
+        );
+      }
+      if (invalidStdio.length > 0) {
+        details.push(`missing command on ${invalidStdio.map((server) => server.name).join(", ")}`);
+      }
+      return { name, status: "warn", detail: details.join("; ") };
+    }
+    const enabled = servers.filter((server) => server.enabled).length;
+    return {
+      name,
+      status: "ok",
+      detail: `${servers.length} configured (${enabled} enabled); local configuration valid`
+    };
+  } catch (err) {
+    return {
+      name,
+      status: "fail",
+      detail: `could not inspect MCP configuration: ${err.message}`
+    };
+  } finally {
+    storage?.close();
+  }
+}
 function checkConfig(qaiosDir, qaiosExists) {
   const name = "config.yaml";
   if (!qaiosExists) return { name, status: "skip", detail: "skipped (no .qaios/)" };
@@ -9197,8 +9240,8 @@ function scopeFooterApi(scope) {
 }
 var STATUS_OR_RESPONSE_PATTERN = /\b[1-5]\d\d\b|response\./i;
 var MIN_SCENARIOS_PER_ENDPOINT = 3;
-function endpointStepPattern(path20, method) {
-  const escaped = path20.split("/").map(
+function endpointStepPattern(path21, method) {
+  const escaped = path21.split("/").map(
     (seg) => /^\{.*\}$/.test(seg) ? "[^/\\s?#]+" : seg.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
   ).join("/");
   return new RegExp(`\\b${method}\\b[\\s\\S]*?${escaped}(?=$|[\\s?#])`, "i");
@@ -10244,12 +10287,13 @@ var WriteWebInput = z.object({
 });
 var WRITE_WEB_HTML_MAX_CHARS = 5e4;
 var HEADER_PLACEHOLDERS = {
+  version: "<qaios-version will be filled by runtime>",
   workflowId: "<ulid will be filled by runtime>",
   generatedAt: "<iso-8601 will be filled by runtime>",
   designSpecPath: "<workflow-id>"
 };
-function injectGeneratedFileHeader(contents, workflowId, generatedAtIso) {
-  return contents.split(HEADER_PLACEHOLDERS.workflowId).join(workflowId).split(HEADER_PLACEHOLDERS.generatedAt).join(generatedAtIso).split(HEADER_PLACEHOLDERS.designSpecPath).join(workflowId);
+function injectGeneratedFileHeader(contents, workflowId, generatedAtIso, qaiosVersion) {
+  return contents.split(HEADER_PLACEHOLDERS.version).join(qaiosVersion).split(HEADER_PLACEHOLDERS.workflowId).join(workflowId).split(HEADER_PLACEHOLDERS.generatedAt).join(generatedAtIso).split(HEADER_PLACEHOLDERS.designSpecPath).join(workflowId);
 }
 var IMPORT_ALLOW_LIST = ["@playwright/test"];
 var ASSERTION_RE = /\bexpect\s*\(/;
@@ -10353,7 +10397,7 @@ Output requirements:
 - Header comment on every generated file (emit literally; the runtime
   fills the placeholder tokens):
 
-// Generated by QAIOS v0.1.x (workflow: ${HEADER_PLACEHOLDERS.workflowId})
+// Generated by QAIOS v${HEADER_PLACEHOLDERS.version} (workflow: ${HEADER_PLACEHOLDERS.workflowId})
 // Generated at: ${HEADER_PLACEHOLDERS.generatedAt}
 // DesignSpec: .qaios/specs/${HEADER_PLACEHOLDERS.designSpecPath}/DesignSpec.json
 // Edit freely \u2014 QAIOS will preserve manual changes when re-generating.
@@ -10462,7 +10506,7 @@ Output requirements:
 - Header comment on every generated file (emit literally; the runtime
   fills the placeholder tokens):
 
-// Generated by QAIOS v0.1.x (workflow: ${HEADER_PLACEHOLDERS.workflowId})
+// Generated by QAIOS v${HEADER_PLACEHOLDERS.version} (workflow: ${HEADER_PLACEHOLDERS.workflowId})
 // Generated at: ${HEADER_PLACEHOLDERS.generatedAt}
 // DesignSpec: .qaios/specs/${HEADER_PLACEHOLDERS.designSpecPath}/DesignSpec.json
 // Edit freely \u2014 QAIOS will preserve manual changes when re-generating.
@@ -10554,6 +10598,16 @@ var skills = {
   "explore.charter": exploreCharterSkill,
   "audit.a11y": auditA11ySkill
 };
+var moduleDir = path15.dirname(fileURLToPath(import.meta.url));
+function getQaiosVersion() {
+  try {
+    const packagePath = path15.resolve(moduleDir, "..", "package.json");
+    const pkg = JSON.parse(readFileSync(packagePath, "utf-8"));
+    return pkg.version?.trim() || "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
 
 // src/llm.ts
 function resolveLlmClient(injected, llmConfig) {
@@ -10768,7 +10822,12 @@ async function runA11y(opts) {
       if (target !== "stdout" && mcpClient === void 0) {
         const repoMcp = new McpServersRepository(storage.db);
         const servers = repoMcp.list();
-        mcpClient = new McpClient({ servers, auditLogger, workflowId });
+        mcpClient = new McpClient({
+          servers,
+          auditLogger,
+          workflowId,
+          clientVersion: getQaiosVersion()
+        });
       }
       for (const issue of violations) {
         const filed = await fileIssueAsDefect({
@@ -11090,28 +11149,27 @@ async function runExplore(opts) {
     const sevCount = countBySeverity(findings);
     writeOut(`Session complete. Duration: ${formatDuration(exploreOutput.durationActual)}`);
     writeOut(
-      `Findings: ${findings.length}` + (findings.length > 0 ? ` (${sevSummary(sevCount)})` : "")
+      `Unverified hypotheses: ${findings.length}` + (findings.length > 0 ? ` (${sevSummary(sevCount)})` : "")
     );
     for (const f of findings) {
-      writeOut(`  ${GLYPH2.finding} [${f.severity.toUpperCase()}] ${f.title}`);
+      writeOut(`  ${GLYPH2.finding} [UNVERIFIED/${f.severity.toUpperCase()}] ${f.title}`);
     }
     writeOut("");
     let defectsFiled = 0;
-    if (opts.noDefects === true || findings.length === 0) {
+    const target = opts.defectTarget ?? config?.defects?.target ?? "stdout";
+    if (target !== "stdout" && findings.length > 0) {
+      writeOut(
+        `${GLYPH2.warn} External defect filing is disabled for unverified exploratory hypotheses. Reproduce the finding independently before filing it.`
+      );
+    } else if (opts.noDefects === true || findings.length === 0) {
       if (findings.length > 0 && opts.noDefects === true) {
         writeOut("Skipping defect filing (--no-defects).");
       }
     } else {
-      const target = opts.defectTarget ?? config?.defects?.target ?? "stdout";
       const repo = opts.defectRepo ?? config?.defects?.repo;
       const project = opts.defectProject ?? config?.defects?.project;
       writeOut(`Filing defects (target: ${target})...`);
-      let mcpClient = opts.mcpClient;
-      if (target !== "stdout" && mcpClient === void 0) {
-        const repoMcp = new McpServersRepository(storage.db);
-        const servers = repoMcp.list();
-        mcpClient = new McpClient({ servers, auditLogger, workflowId });
-      }
+      const mcpClient = opts.mcpClient;
       for (const f of findings) {
         const filed = await fileFindingAsDefect({
           finding: f,
@@ -11133,9 +11191,6 @@ async function runExplore(opts) {
           writeOut(`  ${GLYPH2.failed} ${f.title} \u2014 ${filed.error ?? "unknown failure"}`);
         }
       }
-      if (mcpClient !== void 0 && opts.mcpClient === void 0) {
-        await mcpClient.close();
-      }
     }
     finalize2("succeeded");
     return {
@@ -11143,6 +11198,7 @@ async function runExplore(opts) {
       workflowId,
       charter: exploreOutput.charter,
       findings,
+      findingsVerification: "unverified",
       defectsFiled
     };
   } finally {
@@ -12472,12 +12528,20 @@ function addServer(repo, opts, writeOut) {
       exitCode: ExitCode.USER_ERROR,
       error: {
         code: "qaios.mcp.no_command_or_url",
-        message: "qaios mcp add requires a <command-or-url> argument (a binary path for stdio, or a URL for http/sse)."
+        message: "qaios mcp add requires a <command> argument for a stdio server."
+      }
+    };
+  }
+  const type = opts.type ?? "stdio";
+  if (type !== "stdio" || /^https?:\/\//i.test(opts.commandOrUrl)) {
+    return {
+      exitCode: ExitCode.USER_ERROR,
+      error: {
+        code: "qaios.mcp.transport_not_supported",
+        message: "Only MCP stdio transport is supported in this release. HTTP and SSE registration are disabled until their runtime implementations and contract tests ship."
       }
     };
   }
-  const inferredType = /^https?:\/\//i.test(opts.commandOrUrl) ? "http" : "stdio";
-  const type = opts.type ?? inferredType;
   const env = { ...opts.env ?? {} };
   const secretKeys = Object.entries(env).filter(([, v]) => looksLikeSecret(v)).map(([k]) => k);
   if (secretKeys.length > 0) {
@@ -12496,7 +12560,7 @@ function addServer(repo, opts, writeOut) {
     env,
     enabled: opts.enabled !== false,
     installedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    ...type === "stdio" ? { command: opts.commandOrUrl } : { url: opts.commandOrUrl }
+    command: opts.commandOrUrl
   };
   const persisted = repo.upsert(config);
   writeOut(
@@ -12574,7 +12638,8 @@ async function testServer(repo, opts, writeOut) {
   const client = opts.mcpClient ?? new McpClient({
     // For `test` we always include the target server even if it's
     // disabled — the user explicitly asked us to test it.
-    servers: [{ ...config, enabled: true }]
+    servers: [{ ...config, enabled: true }],
+    clientVersion: getQaiosVersion()
   });
   const ownsClient = opts.mcpClient === void 0;
   const MCP_TEST_TIMEOUT_MS = 15e3;
@@ -14457,8 +14522,8 @@ ${epSummary}`;
     gateConfig.autoExpireOnTimeout = "auto_approve";
   }
   const costCap = {
-    maxCalls: config?.llm?.maxLlmCallsPerWorkflow ?? 15,
-    maxUsdCents: config?.llm?.costAlertThresholdUsdCents ?? 50
+    maxCalls: config?.llm?.maxLlmCallsPerWorkflow ?? 20,
+    maxUsdCents: config?.llm?.costAlertThresholdUsdCents ?? 100
   };
   const orchestrator = new Orchestrator({
     storage,
@@ -14536,7 +14601,8 @@ ${epSummary}`;
           const injected = injectGeneratedFileHeader(
             file.contents,
             result.workflowId,
-            generatedAtIso
+            generatedAtIso,
+            getQaiosVersion()
           );
           writeFileSync(absPath, injected);
           filesWritten.push(file.path);
@@ -14634,20 +14700,9 @@ Ran generated tests: ${runSummary.passedCount} passed, ${runSummary.failedCount}
 }
 
 // src/index.ts
-var __dirname2 = path15.dirname(fileURLToPath(import.meta.url));
-function readPackageVersion() {
-  for (const candidate of [path15.resolve(__dirname2, "..", "package.json")]) {
-    try {
-      const pkg = JSON.parse(readFileSync(candidate, "utf-8"));
-      if (pkg.version) return pkg.version;
-    } catch {
-    }
-  }
-  return "0.0.0";
-}
 function buildProgram() {
   const program = new Command();
-  program.name("qaios").description("AI QA engineer in your terminal").version(readPackageVersion(), "-V, --version", "print QAIOS version, exit 0").option("--workflow <id>", "explicitly set or resume a workflow ID").option("--mode <mode>", "override mode for this run (LITE | FULL | TRUST)").option("--non-interactive", "disable interactive prompts").option("--verbose", "log level: debug").option("--debug", "log level: trace").option("--quiet", "only errors to stderr; minimum stdout output").option("--json", "emit primary output as JSON (machine-readable)").option("--no-color", "disable ANSI color").showHelpAfterError();
+  program.name("qaios").description("AI QA engineer in your terminal").version(getQaiosVersion(), "-V, --version", "print QAIOS version, exit 0").option("--workflow <id>", "explicitly set or resume a workflow ID").option("--mode <mode>", "override mode for this run (LITE | FULL | TRUST)").option("--non-interactive", "disable interactive prompts").option("--verbose", "log level: debug").option("--debug", "log level: trace").option("--quiet", "only errors to stderr; minimum stdout output").option("--json", "emit primary output as JSON (machine-readable)").option("--no-color", "disable ANSI color").showHelpAfterError();
   program.command("init [path]").description("Bootstrap a project: create .qaios/, QAIOS.md, run migrations").option("--mode <mode>", "mode to write to config (LITE | FULL | TRUST)").option("--framework <name>", 'test framework (only "playwright" in v0.1)').option("--test-dir <path>", "relative path to test directory").option("--non-interactive", "skip prompts; use defaults").option("--force", "overwrite existing .qaios/").action((cwdArg, cmdOpts) => {
     const initOpts = {
       nonInteractive: Boolean(cmdOpts["nonInteractive"]),
@@ -14998,7 +15053,7 @@ function buildProgram() {
   mcpGroup.command("list").description("Show every registered MCP server").action((cmdOpts, command) => {
     void runMcpVerb("list", cmdOpts, command, {});
   });
-  mcpGroup.command("add <name> <command-or-url>").description("Register an MCP server (stdio command path or http/sse URL)").option("--type <type>", "transport: stdio | http | sse (inferred when omitted)").option(
+  mcpGroup.command("add <name> <command>").description("Register an MCP stdio server command").option("--type <type>", "transport: stdio (HTTP/SSE are not yet supported)", "stdio").option(
     "--arg <arg>",
     "stdio command-line arg (repeatable)",
     (v, prev = []) => [...prev, v]

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@qatonic_innovations/qaios",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "type": "module",
-  "description": "AI QA engineer in your terminal — designs, writes, runs, heals, and explores tests for web UI and APIs with audit-grade traceability.",
+  "description": "AI QA engineer in your terminal — designs, writes, runs, heals, and explores tests with tamper-evident local history.",
   "license": "MIT",
   "homepage": "https://github.com/qatonic/qaios#readme",
   "repository": {