@qatonic_innovations/qaios 0.5.2 → 0.6.0

package/README.md

@@ -1,6 +1,6 @@
 # QAIOS
 
-> **AI QA engineer in your terminal.** Designs, writes, runs, heals, and explores tests for web UI and APIs — with audit-grade traceability.
+> **AI QA engineer in your terminal.** Designs, writes, runs, heals, and explores tests for web UI and APIs — with tamper-evident local history.
 
 [![npm version](https://img.shields.io/npm/v/@qatonic_innovations/qaios.svg)](https://www.npmjs.com/package/@qatonic_innovations/qaios)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://github.com/qatonic/qaios/blob/main/LICENSE)
@@ -10,7 +10,7 @@ QAIOS acts like a QA engineer on your team. Point it at a feature description or
 
 **Mental model: Claude Code, but for QA work instead of feature coding.**
 
-> **Status: early alpha (v0.1).** Core flows — `init`, `doctor`, test design
+> **Status: pre-1.0** ([changelog](https://github.com/qatonic/qaios/blob/main/CHANGELOG.md)). Core flows — `init`, `doctor`, test design
 > & generation, Playwright execution, self-healing, accessibility, and the
 > audit log — work today. Expect rough edges and please
 > [report issues](https://github.com/qatonic/qaios/issues). After installing,
@@ -35,10 +35,11 @@ The published package is `@qatonic_innovations/qaios`; the installed **command i
 
 ### Requirements
 
-- **Node.js 22 LTS or newer.** QAIOS uses Node's **built-in** SQLite
-  (`node:sqlite`, stable in Node 22) for its local audit log — **no native
-  module to compile**, so `npm install` is just a download. (On Node < 22 the
-  built-in isn't available; upgrade Node.)
+- **Node.js 22.13 or newer.** QAIOS uses Node's **built-in** SQLite
+  (`node:sqlite`) for its local audit log — **no native module to compile**,
+  so `npm install` is just a download. `node:sqlite` loads without a flag from
+  Node 22.13; before that it isn't available, so upgrade Node. Node 22 still
+  labels it experimental; QAIOS hides that one warning.
 - An **LLM provider API key.** QAIOS uses **Anthropic** by default — get a key
   at [console.anthropic.com](https://console.anthropic.com/settings/keys) and
   export it:
@@ -63,7 +64,7 @@ The published package is `@qatonic_innovations/qaios`; the installed **command i
 
 QAIOS has **no native dependencies** — it uses Node's built-in SQLite — so
 install is friction-free. If `qaios init` reports a SQLite/`node:sqlite` error,
-your Node is too old: run `node -v` and upgrade to **Node 22 LTS or newer**.
+your Node is too old: run `node -v` and upgrade to **Node 22.13 or newer**.
 
 `qaios doctor` will tell you exactly which check failed and what to run.
 
@@ -95,7 +96,7 @@ Generated:
   tests/auth/LoginPage.po.ts
   .qaios/specs/01JTZ1…/DesignSpec.json
 
-Cost: 11,403 tokens · $0.06 (3 of 15 LLM calls used)
+Cost: 11,403 tokens · $0.06 (3 of 20 LLM calls used)
 ```
 
 > **Gates:** on HIGH/CRITICAL-risk features QAIOS pauses for review. Approve interactively with `qaios review`, or pass `--yes` to auto-approve for a non-interactive run.
@@ -107,17 +108,17 @@ Cost: 11,403 tokens · $0.06 (3 of 15 LLM calls used)
 | Command                                              | What it does                                                                                                                |
 | ---------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- |
 | `qaios init [path]`                                  | Bootstrap a project: create `.qaios/`, `QAIOS.md`, run migrations.                                                          |
-| `qaios doctor`                                       | Health-check your environment (Node, API key, Playwright, config). `--json` for CI.                                         |
+| `qaios doctor`                                       | Health-check your environment. Use `--deep` for read-only Chromium/MCP probes and `--json` for stable CI diagnostics.       |
 | `qaios test <description>`                           | Design + generate tests from natural language. `--type api` for OpenAPI. `--run` to execute. `--yes` to auto-approve gates. |
 | `qaios run [pattern]`                                | Execute Playwright tests, classify failures (real / flaky / locator drift), auto-heal locator breaks, file defects.         |
 | `qaios fix [target]`                                 | Self-heal a broken locator. `--last-failure` to target the most recent failure, `--auto` to apply, `--dry-run` to preview.  |
-| `qaios explore <url>`                                | Time-boxed exploratory session against a live URL. `--duration <seconds>`, `--focus "<hint>"`.                              |
+| `qaios explore <url>`                                | Charter + unverified hypotheses from one page snapshot (no browser session). `--focus`, `--file-hypotheses`.                |
 | `qaios a11y <url>`                                   | Deterministic axe-core accessibility scan + AI triage. `--wcag-level A\|AA\|AAA`. Exits 1 on real violations (CI-gateable). |
 | `qaios snapshot capture\|check\|review`              | Visual regression: capture baselines, diff, and triage AI-classified diffs.                                                 |
 | `qaios review`                                       | Walk pending human-review gates and approve/reject; resumes the workflow.                                                   |
 | `qaios history [--verify]`                           | List workflows, inspect the audit log, and verify the hash chain.                                                           |
 | `qaios config get\|set\|show\|edit`                  | Read/write `.qaios/config.yaml` (schema-validated).                                                                         |
-| `qaios mcp list\|add\|remove\|enable\|disable\|test` | Manage MCP servers (GitHub, Jira, Slack, custom).                                                                           |
+| `qaios mcp list\|add\|remove\|enable\|disable\|test` | Manage stdio MCP servers (GitHub, Jira, custom).                                                                            |
 
 Run `qaios <command> --help` for the full option list of any command.
 
@@ -136,7 +137,7 @@ qaios fix tests/auth/login.spec.ts --last-failure --dry-run
 # Accessibility scan, gate CI on real WCAG violations
 qaios a11y https://staging.myapp.com --wcag-level AA
 
-# Exploratory testing with a focus hint
+# Exploration charter + unverified hypotheses (no browser session)
 qaios explore https://staging.myapp.com --duration 900 --focus "checkout flow"
 
 # Visual regression
@@ -165,11 +166,13 @@ testing:
   framework: playwright
   testDir: tests
   testIdAttribute: data-testid # e.g. set to 'data-test' for some apps
+  # fixtures: tests/fixtures.ts # optional: your `base.extend(...)` test; generated specs use it
   locatorPreference: [data-testid, role, text]
 gates:
   autoExpireOnTimeout: abort # abort | auto_approve | auto_reject
 defects:
   target: stdout # stdout | github | jira
+  reproduceBeforeFiling: true # GitHub/Jira only get failures that fail again on a re-run
 ```
 
 `qaios config show` prints the resolved config; `qaios config set <key> <value>` validates against the schema before writing. **API keys are never written to config** — they come from environment variables.
@@ -189,18 +192,20 @@ llm:
 # OpenAI
 llm:
   provider: openai # reads OPENAI_API_KEY
-  model: gpt-4o # optional; default gpt-4o (try gpt-4o-mini for lower cost)
+  model: gpt-6.1-sol # optional; the default (try gpt-6-luna for lower cost)
 ```
 
 ```bash
 export OPENAI_API_KEY=sk-...
-qaios doctor   # confirms the configured provider's key is reachable
+qaios doctor   # confirms the provider accepts your key (add --offline to skip the call)
 ```
 
 The rest of QAIOS is provider-blind — every command (`test`, `run`, `fix`,
 `explore`, `a11y`, …) works identically on either. Structured output uses each
-provider's native guaranteed-schema mode (Anthropic forced tool-use / OpenAI
-strict function calling), so generated artifacts stay schema-valid. You can
+provider's native structured-output mode (a `submit` tool on Anthropic; strict
+function calling on OpenAI), and every answer is validated against the skill's
+schema, so generated artifacts stay schema-valid. GPT-5 and later models are
+called through OpenAI's Responses API; GPT-4 models through Chat Completions. You can
 override the key's env-var name with `llm.apiKeyEnv` if needed.
 
 #### Picking a model
@@ -209,21 +214,22 @@ override the key's env-var name with `llm.apiKeyEnv` if needed.
 that provider's API accepts works**, not just the defaults. When `llm.model` is
 omitted, QAIOS uses a sensible default per provider:
 
-| Provider    | Default             | Other examples you can set                        |
-| ----------- | ------------------- | ------------------------------------------------- |
-| `anthropic` | `claude-sonnet-4-6` | `claude-opus-4-7`, `claude-haiku-4-5-20251001`, … |
-| `openai`    | `gpt-4o`            | `gpt-4o-mini` (cheaper), `gpt-4.1`, …             |
+| Provider    | Default ($ per 1M tokens in / out) | Other examples you can set                                      |
+| ----------- | ---------------------------------- | --------------------------------------------------------------- |
+| `anthropic` | `claude-sonnet-5-5` ($2 / $10)     | `claude-opus-5-5` ($4 / $20), `claude-haiku-5-5` (cheapest), …  |
+| `openai`    | `gpt-6.1-sol` ($2 / $10)           | `gpt-6-astra` ($10 / $50), `gpt-6-luna` (cheapest), `gpt-4o`, … |
 
 ```yaml
 llm:
   provider: openai
-  model: gpt-4o-mini # any OpenAI model id
+  model: gpt-6-luna # any OpenAI model id
 ```
 
 Two things to know about non-default models:
 
 - **Cost tracking.** QAIOS knows exact pricing for a built-in set of models
-  (Sonnet/Opus/Haiku and gpt-4o/4o-mini/4.1/4.1-mini). A model **outside** that
+  (Claude Sonnet/Opus/Haiku/Fable 4.x-5.x; GPT-6 Sol/Astra/Luna and
+  gpt-4o/4o-mini/4.1/4.1-mini). A model **outside** that
   set still runs fine, but the USD figure in the audit log is approximate — it
   bills at a default rate and prints a one-time `no pricing for model …`
   warning. The per-workflow call/cost **cap still applies** regardless.
@@ -250,7 +256,7 @@ qaios config set mode TRUST
 
 ## Cost & privacy
 
-- Skills run on Claude Sonnet (Anthropic) or gpt-4o (OpenAI) per your `llm.provider`. A typical `qaios test` costs ~**$0.04–0.10**. Each workflow is capped (default `min(15 calls, $0.50)`, configurable) and aborts if exceeded.
+- Skills use Anthropic or OpenAI per `llm.provider`. Each workflow is capped at `min(20 calls, $1.00)` by default (configurable) and aborts if exceeded.
 - **Local-first.** No telemetry, no phone-home. The only outbound traffic is (a) LLM calls to your configured provider (Anthropic or OpenAI) with the prompts QAIOS builds, and (b) any MCP servers you configure. You bring your own API key; QAIOS does not proxy your requests. See [SECURITY.md](https://github.com/qatonic/qaios/blob/main/SECURITY.md) for exactly what's sent.
 
 ---
@@ -259,18 +265,18 @@ qaios config set mode TRUST
 
 Every command exits with a stable, documented code so you can gate pipelines:
 
-| Code  | Meaning                         | Example                                                                 |
-| ----- | ------------------------------- | ----------------------------------------------------------------------- |
-| `0`   | Success                         | tests generated; `doctor` all-green; `a11y` clean                       |
-| `1`   | User error / actionable failure | bad flag; `a11y` found real violations; `run` had failing tests         |
-| `2`   | Gate blocked (informational)    | a workflow paused for human review — run `qaios review` or pass `--yes` |
-| `3`   | Tool/dependency error           | Playwright or axe not installed; SQLite binding missing                 |
-| `4`   | LLM error                       | rate limit, timeout, or invalid API key                                 |
-| `5`   | Internal error                  | unexpected crash (re-run with `--debug` for a stack trace)              |
-| `130` | Cancelled                       | you pressed Ctrl+C                                                      |
+| Code  | Meaning                         | Example                                                                  |
+| ----- | ------------------------------- | ------------------------------------------------------------------------ |
+| `0`   | Success                         | tests generated; `doctor` all-green; `fix --dry-run` found a valid patch |
+| `1`   | User error / actionable failure | bad flag; `run` had failing tests; `fix` found no valid fix              |
+| `2`   | Gate blocked (informational)    | paused for human review — run `qaios review`, or `fix` without `--auto`  |
+| `3`   | Tool/dependency error           | Playwright or axe not installed; SQLite binding missing                  |
+| `4`   | LLM error                       | rate limit, timeout, or invalid API key                                  |
+| `5`   | Internal error                  | unexpected crash (re-run with `--debug` for a stack trace)               |
+| `130` | Cancelled                       | you pressed Ctrl+C                                                       |
 
-`qaios doctor --json` and `--json` on most commands emit machine-readable
-output for CI consumption.
+Every command supports protocol-v1 machine output: `--json` emits one terminal object,
+while `--jsonl` emits ordered events followed by one terminal object.
 
 ---
 
@@ -280,20 +286,20 @@ output for CI consumption.
 - [Commands Reference](https://github.com/qatonic/qaios/blob/main/docs/commands.md) — every CLI command
 - [Skills Reference](https://github.com/qatonic/qaios/blob/main/docs/skills-reference.md) — what each skill does
 - [MCP Servers](https://github.com/qatonic/qaios/blob/main/docs/mcp-servers.md) — adding integrations
+- [JSON Output](https://github.com/qatonic/qaios/blob/main/docs/json-output.md) — automation compatibility
+- [Compatibility Policy](https://github.com/qatonic/qaios/blob/main/docs/compatibility.md) — stability and deprecation
 - A runnable end-to-end example lives in [`examples/live-saucedemo`](https://github.com/qatonic/qaios/tree/main/examples/live-saucedemo).
 
 ---
 
 ## Status & roadmap
 
-**v0.1 (now):** Web UI + API + visual regression + self-healing + exploratory + accessibility, as an open-source CLI. Early — feedback wanted.
-
-- **v0.2** — optional cloud sync + web dashboard
-- **v0.5** — mobile testing
-- **v0.7** — performance + security testing
-- **v1.0** — database testing, stable public API
-
-The roadmap is gated on real-world validation, not a calendar.
+Releases and their changes are listed in the
+[changelog](https://github.com/qatonic/qaios/blob/main/CHANGELOG.md). Current work focuses on
+truth and consistency before the trustworthy-alpha, agent-runtime, quality-intelligence,
+ecosystem, and stable-OS phases.
+The [active roadmap](https://github.com/qatonic/qaios/blob/main/QAIOS_PRODUCT_AND_ENGINEERING_ROADMAP.md)
+is validation-gated, not calendar-driven.
 
 ---
 

package/dist/GateReview-MDXNA542.js

@@ -0,0 +1,127 @@
+#!/usr/bin/env node
+import { useApp, useInput, Box, Text } from 'ink';
+import { useState } from 'react';
+import { jsx, jsxs } from 'react/jsx-runtime';
+
+function dispatchGateKeypress(input, ctrl = false) {
+  const key = input.toLowerCase();
+  if (key === "q" || ctrl && key === "c") return { kind: "quit" };
+  if (key === "a") return { kind: "decide", action: "approve" };
+  if (key === "r") return { kind: "decide", action: "reject" };
+  if (key === "s") return { kind: "decide", action: "skip" };
+  return { kind: "ignore" };
+}
+function severityColor(level) {
+  switch (level) {
+    case "CRITICAL":
+      return "red";
+    case "HIGH":
+      return "yellow";
+    case "MEDIUM":
+      return "cyan";
+    default:
+      return "gray";
+  }
+}
+function GatePreview({ gate }) {
+  const payload = gate.payload;
+  const summaryLines = [];
+  if (gate.gateType === "design_review") {
+    if (payload["featureName"]) summaryLines.push(`feature: ${String(payload["featureName"])}`);
+    if (payload["suiteName"]) summaryLines.push(`suite: ${String(payload["suiteName"])}`);
+    if (payload["scenarioCount"])
+      summaryLines.push(`scenarios: ${String(payload["scenarioCount"])}`);
+  } else if (gate.gateType === "writing_review") {
+    if (payload["fileCount"]) summaryLines.push(`files: ${String(payload["fileCount"])}`);
+    if (payload["qaiosMdSuggestionCount"]) {
+      summaryLines.push(`review notes: ${String(payload["qaiosMdSuggestionCount"])}`);
+    }
+  } else if (gate.gateType === "healing_review") {
+    if (payload["file"]) summaryLines.push(`file: ${String(payload["file"])}`);
+    if (payload["oldLocator"]) summaryLines.push(`- ${String(payload["oldLocator"])}`);
+    if (payload["newLocator"]) summaryLines.push(`+ ${String(payload["newLocator"])}`);
+  } else if (gate.gateType === "visual_review") {
+    if (payload["target"]) summaryLines.push(`screenshot: ${String(payload["target"])}`);
+    if (payload["changed"]) summaryLines.push(`changed: ${String(payload["changed"])}`);
+    if (payload["verdict"]) summaryLines.push(`classifier: ${String(payload["verdict"])}`);
+    if (payload["currentImage"]) summaryLines.push(`new image: ${String(payload["currentImage"])}`);
+    if (payload["diffImage"]) summaryLines.push(`diff image: ${String(payload["diffImage"])}`);
+  }
+  return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", paddingLeft: 2, children: [
+    summaryLines.map((l) => /* @__PURE__ */ jsx(Text, { color: "white", children: l }, l)),
+    payload["reasoning"] !== void 0 && payload["reasoning"] !== null && String(payload["reasoning"]).length > 0 && /* @__PURE__ */ jsx(Box, { marginTop: 1, children: /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+      String(payload["reasoning"]).slice(0, 240),
+      String(payload["reasoning"]).length > 240 ? "\u2026" : ""
+    ] }) })
+  ] });
+}
+function GateReview(props) {
+  const { gates, onDecide, onExit } = props;
+  const [index, setIndex] = useState(0);
+  const { exit } = useApp();
+  const current = gates[index];
+  useInput((input, key) => {
+    if (current === void 0) return;
+    const intent = dispatchGateKeypress(input, key.ctrl);
+    if (intent.kind === "quit") {
+      onExit("quit");
+      exit();
+      return;
+    }
+    if (intent.kind === "decide") {
+      onDecide(current, intent.action);
+      next();
+    }
+  });
+  function next() {
+    if (index >= gates.length - 1) {
+      onExit("completed");
+      exit();
+      return;
+    }
+    setIndex(index + 1);
+  }
+  if (gates.length === 0) {
+    return /* @__PURE__ */ jsx(Box, { flexDirection: "column", children: /* @__PURE__ */ jsx(Text, { color: "green", children: "\u2713 No pending gates." }) });
+  }
+  if (current === void 0) {
+    return /* @__PURE__ */ jsx(Box, { flexDirection: "column", children: /* @__PURE__ */ jsxs(Text, { children: [
+      "Reviewing gates\u2026 (",
+      index + 1,
+      " of ",
+      gates.length,
+      ")"
+    ] }) });
+  }
+  return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsxs(Box, { children: [
+      /* @__PURE__ */ jsx(Text, { bold: true, children: "\u26A0 Review: " }),
+      /* @__PURE__ */ jsx(Text, { bold: true, color: severityColor(current.riskLevel), children: current.gateType }),
+      /* @__PURE__ */ jsxs(Text, { children: [
+        " ",
+        "(",
+        index + 1,
+        "/",
+        gates.length,
+        ")"
+      ] })
+    ] }),
+    /* @__PURE__ */ jsx(Box, { children: /* @__PURE__ */ jsxs(Text, { children: [
+      "Skill: ",
+      /* @__PURE__ */ jsx(Text, { bold: true, children: current.skillId }),
+      " \xB7 Risk:",
+      " ",
+      /* @__PURE__ */ jsx(Text, { color: severityColor(current.riskLevel), children: current.riskLevel }),
+      " \xB7 Confidence:",
+      " ",
+      current.confidence.toFixed(2),
+      " \xB7 Action: ",
+      /* @__PURE__ */ jsx(Text, { bold: true, children: current.requiredAction })
+    ] }) }),
+    /* @__PURE__ */ jsx(Box, { marginTop: 1, children: /* @__PURE__ */ jsx(Text, { children: "Preview:" }) }),
+    /* @__PURE__ */ jsx(GatePreview, { gate: current }),
+    /* @__PURE__ */ jsx(Box, { marginTop: 1, children: /* @__PURE__ */ jsx(Text, { dimColor: true, children: "[a]pprove \xB7 [r]eject \xB7 [s]kip \xB7 [q]uit" }) })
+  ] });
+}
+
+export { GateReview, dispatchGateKeypress };

package/dist/SnapshotReview-7TPWX62T.js

@@ -0,0 +1,137 @@
+#!/usr/bin/env node
+import { useApp, useInput, Box, Text } from 'ink';
+import { useState } from 'react';
+import { jsx, jsxs } from 'react/jsx-runtime';
+
+function dispatchKeypress(input) {
+  switch (input.toLowerCase()) {
+    case "a":
+      return { kind: "decide", action: "approve" };
+    case "r":
+      return { kind: "decide", action: "reject" };
+    case "s":
+      return { kind: "decide", action: "skip" };
+    case "q":
+      return { kind: "quit" };
+    default:
+      return { kind: "ignore" };
+  }
+}
+function formatPct(p) {
+  if (p >= 1) return `${p.toFixed(2)}%`;
+  if (p > 0) return `${p.toFixed(3)}%`;
+  return `0%`;
+}
+function ClassificationView({
+  classification
+}) {
+  if (classification === null) {
+    return /* @__PURE__ */ jsx(Text, { color: "gray", dimColor: true, children: "(unclassified \u2014 visual.diff was skipped or failed)" });
+  }
+  const color = classification.verdict === "regression" ? "red" : classification.verdict === "intentional" ? "green" : classification.verdict === "noise" ? "gray" : "yellow";
+  return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsxs(Text, { children: [
+      "Verdict:",
+      " ",
+      /* @__PURE__ */ jsx(Text, { color, bold: true, children: classification.verdict }),
+      " ",
+      "(confidence ",
+      classification.confidence.toFixed(2),
+      ")"
+    ] }),
+    /* @__PURE__ */ jsxs(Text, { children: [
+      "Suggested: ",
+      classification.suggestedAction
+    ] }),
+    /* @__PURE__ */ jsx(Box, { marginTop: 1, children: /* @__PURE__ */ jsx(Text, { wrap: "wrap", children: classification.reasoning }) }),
+    classification.affectedAreas.length > 0 ? /* @__PURE__ */ jsx(Box, { marginTop: 1, children: /* @__PURE__ */ jsxs(Text, { children: [
+      "Affected: ",
+      classification.affectedAreas.join(", ")
+    ] }) }) : null
+  ] });
+}
+function SnapshotReview({
+  items,
+  onDecide,
+  onExit
+}) {
+  const { exit } = useApp();
+  const [index, setIndex] = useState(0);
+  const [exited, setExited] = useState(false);
+  const finish = (reason) => {
+    if (exited) return;
+    setExited(true);
+    onExit(reason);
+    exit();
+  };
+  useInput((input) => {
+    if (exited || items.length === 0 || index >= items.length) return;
+    const intent = dispatchKeypress(input);
+    if (intent.kind === "ignore") return;
+    if (intent.kind === "quit") {
+      finish("quit");
+      return;
+    }
+    onDecide(items[index], intent.action);
+    const next = index + 1;
+    if (next >= items.length) finish("completed");
+    else setIndex(next);
+  });
+  if (items.length === 0) {
+    return /* @__PURE__ */ jsx(Box, { flexDirection: "column", children: /* @__PURE__ */ jsx(Text, { children: "(no pending visual diffs)" }) });
+  }
+  if (exited || index >= items.length) {
+    return /* @__PURE__ */ jsx(Box, { flexDirection: "column", children: /* @__PURE__ */ jsx(Text, { children: "Review complete." }) });
+  }
+  const current = items[index];
+  const total = items.length;
+  return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsxs(Box, { children: [
+      /* @__PURE__ */ jsx(Text, { bold: true, children: "QAIOS visual review" }),
+      /* @__PURE__ */ jsx(Text, { dimColor: true, children: `  (${index + 1} / ${total})` })
+    ] }),
+    /* @__PURE__ */ jsxs(Box, { marginTop: 1, flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs(Text, { children: [
+        /* @__PURE__ */ jsx(Text, { bold: true, children: current.baseline.name }),
+        /* @__PURE__ */ jsx(Text, { children: `@${current.baseline.viewport}` })
+      ] }),
+      /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+        "route: ",
+        current.baseline.route
+      ] }),
+      /* @__PURE__ */ jsxs(Text, { children: [
+        formatPct(current.diff.percentageChanged),
+        " pixels changed (",
+        current.diff.pixelsChanged,
+        " ",
+        "px)"
+      ] }),
+      /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+        "baseline: ",
+        current.baseline.imagePath
+      ] }),
+      /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+        "current: ",
+        current.diff.currentImagePath
+      ] }),
+      /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+        "diff: ",
+        current.diff.diffImagePath
+      ] })
+    ] }),
+    /* @__PURE__ */ jsx(Box, { marginTop: 1, flexDirection: "column", children: /* @__PURE__ */ jsx(ClassificationView, { classification: current.diff.classification ?? null }) }),
+    /* @__PURE__ */ jsx(Box, { marginTop: 1, children: /* @__PURE__ */ jsxs(Text, { children: [
+      "[",
+      /* @__PURE__ */ jsx(Text, { color: "green", children: "a" }),
+      "]pprove \u2192 update baseline \xB7 [",
+      /* @__PURE__ */ jsx(Text, { color: "red", children: "r" }),
+      "]eject \u2192 keep baseline \xB7 [",
+      /* @__PURE__ */ jsx(Text, { color: "yellow", children: "s" }),
+      "]kip \xB7 [",
+      /* @__PURE__ */ jsx(Text, { children: "q" }),
+      "]uit"
+    ] }) })
+  ] });
+}
+
+export { SnapshotReview, dispatchKeypress };

package/dist/a11y/scripts/axe-runner.mjs

@@ -78,6 +78,12 @@ try {
   const context = await browser.newContext();
   const page = await context.newPage();
   await page.goto(url, { timeout: timeoutMs, waitUntil });
+  // Single-page apps render after DOMContentLoaded (live test: an Angular shop
+  // scanned as an empty shell, 0 violations vs 27). Let the network settle,
+  // best effort and bounded.
+  if (waitUntil !== 'networkidle') {
+    await page.waitForLoadState('networkidle', { timeout: 5000 }).catch(() => {});
+  }
 
   const builder = new AxeBuilder({ page });
   if (tags.length > 0) builder.withTags(tags);
@@ -99,7 +105,8 @@ try {
     ...tag(results.incomplete, 'incomplete'),
   ];
 
-  writeFileSync(out, JSON.stringify({ url, findings }), 'utf-8');
+  // finalUrl: where navigation ended (a login redirect is reported, not hidden).
+  writeFileSync(out, JSON.stringify({ url, finalUrl: page.url(), findings }), 'utf-8');
 } catch (err) {
   process.stderr.write(`axe-runner: ${err?.message ?? err}\n`);
   process.exit(4);