@qatonic_innovations/qaios 0.5.3 → 0.6.1

package/README.md

@@ -10,7 +10,7 @@ QAIOS acts like a QA engineer on your team. Point it at a feature description or
 
 **Mental model: Claude Code, but for QA work instead of feature coding.**
 
-> **Status: pre-1.0 (v0.5.2 released).** Core flows — `init`, `doctor`, test design
+> **Status: pre-1.0** ([changelog](https://github.com/qatonic/qaios/blob/main/CHANGELOG.md)). Core flows — `init`, `doctor`, test design
 > & generation, Playwright execution, self-healing, accessibility, and the
 > audit log — work today. Expect rough edges and please
 > [report issues](https://github.com/qatonic/qaios/issues). After installing,
@@ -35,10 +35,11 @@ The published package is `@qatonic_innovations/qaios`; the installed **command i
 
 ### Requirements
 
-- **Node.js 22 LTS or newer.** QAIOS uses Node's **built-in** SQLite
-  (`node:sqlite`, stable in Node 22) for its local audit log — **no native
-  module to compile**, so `npm install` is just a download. (On Node < 22 the
-  built-in isn't available; upgrade Node.)
+- **Node.js 22.13 or newer.** QAIOS uses Node's **built-in** SQLite
+  (`node:sqlite`) for its local audit log — **no native module to compile**,
+  so `npm install` is just a download. `node:sqlite` loads without a flag from
+  Node 22.13; before that it isn't available, so upgrade Node. Node 22 still
+  labels it experimental; QAIOS hides that one warning.
 - An **LLM provider API key.** QAIOS uses **Anthropic** by default — get a key
   at [console.anthropic.com](https://console.anthropic.com/settings/keys) and
   export it:
@@ -63,7 +64,7 @@ The published package is `@qatonic_innovations/qaios`; the installed **command i
 
 QAIOS has **no native dependencies** — it uses Node's built-in SQLite — so
 install is friction-free. If `qaios init` reports a SQLite/`node:sqlite` error,
-your Node is too old: run `node -v` and upgrade to **Node 22 LTS or newer**.
+your Node is too old: run `node -v` and upgrade to **Node 22.13 or newer**.
 
 `qaios doctor` will tell you exactly which check failed and what to run.
 
@@ -107,11 +108,11 @@ Cost: 11,403 tokens · $0.06 (3 of 20 LLM calls used)
 | Command                                              | What it does                                                                                                                |
 | ---------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- |
 | `qaios init [path]`                                  | Bootstrap a project: create `.qaios/`, `QAIOS.md`, run migrations.                                                          |
-| `qaios doctor`                                       | Health-check your environment (Node, API key, Playwright, config). `--json` for CI.                                         |
+| `qaios doctor`                                       | Health-check your environment. Use `--deep` for read-only Chromium/MCP probes and `--json` for stable CI diagnostics.       |
 | `qaios test <description>`                           | Design + generate tests from natural language. `--type api` for OpenAPI. `--run` to execute. `--yes` to auto-approve gates. |
 | `qaios run [pattern]`                                | Execute Playwright tests, classify failures (real / flaky / locator drift), auto-heal locator breaks, file defects.         |
 | `qaios fix [target]`                                 | Self-heal a broken locator. `--last-failure` to target the most recent failure, `--auto` to apply, `--dry-run` to preview.  |
-| `qaios explore <url>`                                | Time-boxed exploratory session against a live URL. `--duration <seconds>`, `--focus "<hint>"`.                              |
+| `qaios explore <url>`                                | Charter + unverified hypotheses from one page snapshot (no browser session). `--focus`, `--file-hypotheses`.                |
 | `qaios a11y <url>`                                   | Deterministic axe-core accessibility scan + AI triage. `--wcag-level A\|AA\|AAA`. Exits 1 on real violations (CI-gateable). |
 | `qaios snapshot capture\|check\|review`              | Visual regression: capture baselines, diff, and triage AI-classified diffs.                                                 |
 | `qaios review`                                       | Walk pending human-review gates and approve/reject; resumes the workflow.                                                   |
@@ -136,7 +137,7 @@ qaios fix tests/auth/login.spec.ts --last-failure --dry-run
 # Accessibility scan, gate CI on real WCAG violations
 qaios a11y https://staging.myapp.com --wcag-level AA
 
-# Exploratory testing with a focus hint
+# Exploration charter + unverified hypotheses (no browser session)
 qaios explore https://staging.myapp.com --duration 900 --focus "checkout flow"
 
 # Visual regression
@@ -165,11 +166,13 @@ testing:
   framework: playwright
   testDir: tests
   testIdAttribute: data-testid # e.g. set to 'data-test' for some apps
+  # fixtures: tests/fixtures.ts # optional: your `base.extend(...)` test; generated specs use it
   locatorPreference: [data-testid, role, text]
 gates:
   autoExpireOnTimeout: abort # abort | auto_approve | auto_reject
 defects:
   target: stdout # stdout | github | jira
+  reproduceBeforeFiling: true # GitHub/Jira only get failures that fail again on a re-run
 ```
 
 `qaios config show` prints the resolved config; `qaios config set <key> <value>` validates against the schema before writing. **API keys are never written to config** — they come from environment variables.
@@ -189,18 +192,20 @@ llm:
 # OpenAI
 llm:
   provider: openai # reads OPENAI_API_KEY
-  model: gpt-4o # optional; default gpt-4o (try gpt-4o-mini for lower cost)
+  model: gpt-6.1-sol # optional; the default (try gpt-6-luna for lower cost)
 ```
 
 ```bash
 export OPENAI_API_KEY=sk-...
-qaios doctor   # confirms the configured provider's key is reachable
+qaios doctor   # confirms the provider accepts your key (add --offline to skip the call)
 ```
 
 The rest of QAIOS is provider-blind — every command (`test`, `run`, `fix`,
 `explore`, `a11y`, …) works identically on either. Structured output uses each
-provider's native guaranteed-schema mode (Anthropic forced tool-use / OpenAI
-strict function calling), so generated artifacts stay schema-valid. You can
+provider's native structured-output mode (a `submit` tool on Anthropic; strict
+function calling on OpenAI), and every answer is validated against the skill's
+schema, so generated artifacts stay schema-valid. GPT-5 and later models are
+called through OpenAI's Responses API; GPT-4 models through Chat Completions. You can
 override the key's env-var name with `llm.apiKeyEnv` if needed.
 
 #### Picking a model
@@ -209,21 +214,22 @@ override the key's env-var name with `llm.apiKeyEnv` if needed.
 that provider's API accepts works**, not just the defaults. When `llm.model` is
 omitted, QAIOS uses a sensible default per provider:
 
-| Provider    | Default             | Other examples you can set                        |
-| ----------- | ------------------- | ------------------------------------------------- |
-| `anthropic` | `claude-sonnet-4-6` | `claude-opus-4-7`, `claude-haiku-4-5-20251001`, … |
-| `openai`    | `gpt-4o`            | `gpt-4o-mini` (cheaper), `gpt-4.1`, …             |
+| Provider    | Default ($ per 1M tokens in / out) | Other examples you can set                                      |
+| ----------- | ---------------------------------- | --------------------------------------------------------------- |
+| `anthropic` | `claude-sonnet-5-5` ($2 / $10)     | `claude-opus-5-5` ($4 / $20), `claude-haiku-5-5` (cheapest), …  |
+| `openai`    | `gpt-6.1-sol` ($2 / $10)           | `gpt-6-astra` ($10 / $50), `gpt-6-luna` (cheapest), `gpt-4o`, … |
 
 ```yaml
 llm:
   provider: openai
-  model: gpt-4o-mini # any OpenAI model id
+  model: gpt-6-luna # any OpenAI model id
 ```
 
 Two things to know about non-default models:
 
 - **Cost tracking.** QAIOS knows exact pricing for a built-in set of models
-  (Sonnet/Opus/Haiku and gpt-4o/4o-mini/4.1/4.1-mini). A model **outside** that
+  (Claude Sonnet/Opus/Haiku/Fable 4.x-5.x; GPT-6 Sol/Astra/Luna and
+  gpt-4o/4o-mini/4.1/4.1-mini). A model **outside** that
   set still runs fine, but the USD figure in the audit log is approximate — it
   bills at a default rate and prints a one-time `no pricing for model …`
   warning. The per-workflow call/cost **cap still applies** regardless.
@@ -259,18 +265,18 @@ qaios config set mode TRUST
 
 Every command exits with a stable, documented code so you can gate pipelines:
 
-| Code  | Meaning                         | Example                                                                 |
-| ----- | ------------------------------- | ----------------------------------------------------------------------- |
-| `0`   | Success                         | tests generated; `doctor` all-green; `a11y` clean                       |
-| `1`   | User error / actionable failure | bad flag; `a11y` found real violations; `run` had failing tests         |
-| `2`   | Gate blocked (informational)    | a workflow paused for human review — run `qaios review` or pass `--yes` |
-| `3`   | Tool/dependency error           | Playwright or axe not installed; SQLite binding missing                 |
-| `4`   | LLM error                       | rate limit, timeout, or invalid API key                                 |
-| `5`   | Internal error                  | unexpected crash (re-run with `--debug` for a stack trace)              |
-| `130` | Cancelled                       | you pressed Ctrl+C                                                      |
+| Code  | Meaning                         | Example                                                                  |
+| ----- | ------------------------------- | ------------------------------------------------------------------------ |
+| `0`   | Success                         | tests generated; `doctor` all-green; `fix --dry-run` found a valid patch |
+| `1`   | User error / actionable failure | bad flag; `run` had failing tests; `fix` found no valid fix              |
+| `2`   | Gate blocked (informational)    | paused for human review — run `qaios review`, or `fix` without `--auto`  |
+| `3`   | Tool/dependency error           | Playwright or axe not installed; SQLite binding missing                  |
+| `4`   | LLM error                       | rate limit, timeout, or invalid API key                                  |
+| `5`   | Internal error                  | unexpected crash (re-run with `--debug` for a stack trace)               |
+| `130` | Cancelled                       | you pressed Ctrl+C                                                       |
 
-`qaios doctor --json` and `--json` on most commands emit machine-readable
-output for CI consumption.
+Every command supports protocol-v1 machine output: `--json` emits one terminal object,
+while `--jsonl` emits ordered events followed by one terminal object.
 
 ---
 
@@ -288,8 +294,10 @@ output for CI consumption.
 
 ## Status & roadmap
 
-**v0.5.2 is released.** v0.5.3 focuses on truth and consistency before the
-trustworthy-alpha, agent-runtime, quality-intelligence, ecosystem, and stable-OS phases.
+Releases and their changes are listed in the
+[changelog](https://github.com/qatonic/qaios/blob/main/CHANGELOG.md). Current work focuses on
+truth and consistency before the trustworthy-alpha, agent-runtime, quality-intelligence,
+ecosystem, and stable-OS phases.
 The [active roadmap](https://github.com/qatonic/qaios/blob/main/QAIOS_PRODUCT_AND_ENGINEERING_ROADMAP.md)
 is validation-gated, not calendar-driven.
 

package/dist/GateReview-MDXNA542.js

@@ -0,0 +1,127 @@
+#!/usr/bin/env node
+import { useApp, useInput, Box, Text } from 'ink';
+import { useState } from 'react';
+import { jsx, jsxs } from 'react/jsx-runtime';
+
+function dispatchGateKeypress(input, ctrl = false) {
+  const key = input.toLowerCase();
+  if (key === "q" || ctrl && key === "c") return { kind: "quit" };
+  if (key === "a") return { kind: "decide", action: "approve" };
+  if (key === "r") return { kind: "decide", action: "reject" };
+  if (key === "s") return { kind: "decide", action: "skip" };
+  return { kind: "ignore" };
+}
+function severityColor(level) {
+  switch (level) {
+    case "CRITICAL":
+      return "red";
+    case "HIGH":
+      return "yellow";
+    case "MEDIUM":
+      return "cyan";
+    default:
+      return "gray";
+  }
+}
+function GatePreview({ gate }) {
+  const payload = gate.payload;
+  const summaryLines = [];
+  if (gate.gateType === "design_review") {
+    if (payload["featureName"]) summaryLines.push(`feature: ${String(payload["featureName"])}`);
+    if (payload["suiteName"]) summaryLines.push(`suite: ${String(payload["suiteName"])}`);
+    if (payload["scenarioCount"])
+      summaryLines.push(`scenarios: ${String(payload["scenarioCount"])}`);
+  } else if (gate.gateType === "writing_review") {
+    if (payload["fileCount"]) summaryLines.push(`files: ${String(payload["fileCount"])}`);
+    if (payload["qaiosMdSuggestionCount"]) {
+      summaryLines.push(`review notes: ${String(payload["qaiosMdSuggestionCount"])}`);
+    }
+  } else if (gate.gateType === "healing_review") {
+    if (payload["file"]) summaryLines.push(`file: ${String(payload["file"])}`);
+    if (payload["oldLocator"]) summaryLines.push(`- ${String(payload["oldLocator"])}`);
+    if (payload["newLocator"]) summaryLines.push(`+ ${String(payload["newLocator"])}`);
+  } else if (gate.gateType === "visual_review") {
+    if (payload["target"]) summaryLines.push(`screenshot: ${String(payload["target"])}`);
+    if (payload["changed"]) summaryLines.push(`changed: ${String(payload["changed"])}`);
+    if (payload["verdict"]) summaryLines.push(`classifier: ${String(payload["verdict"])}`);
+    if (payload["currentImage"]) summaryLines.push(`new image: ${String(payload["currentImage"])}`);
+    if (payload["diffImage"]) summaryLines.push(`diff image: ${String(payload["diffImage"])}`);
+  }
+  return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", paddingLeft: 2, children: [
+    summaryLines.map((l) => /* @__PURE__ */ jsx(Text, { color: "white", children: l }, l)),
+    payload["reasoning"] !== void 0 && payload["reasoning"] !== null && String(payload["reasoning"]).length > 0 && /* @__PURE__ */ jsx(Box, { marginTop: 1, children: /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+      String(payload["reasoning"]).slice(0, 240),
+      String(payload["reasoning"]).length > 240 ? "\u2026" : ""
+    ] }) })
+  ] });
+}
+function GateReview(props) {
+  const { gates, onDecide, onExit } = props;
+  const [index, setIndex] = useState(0);
+  const { exit } = useApp();
+  const current = gates[index];
+  useInput((input, key) => {
+    if (current === void 0) return;
+    const intent = dispatchGateKeypress(input, key.ctrl);
+    if (intent.kind === "quit") {
+      onExit("quit");
+      exit();
+      return;
+    }
+    if (intent.kind === "decide") {
+      onDecide(current, intent.action);
+      next();
+    }
+  });
+  function next() {
+    if (index >= gates.length - 1) {
+      onExit("completed");
+      exit();
+      return;
+    }
+    setIndex(index + 1);
+  }
+  if (gates.length === 0) {
+    return /* @__PURE__ */ jsx(Box, { flexDirection: "column", children: /* @__PURE__ */ jsx(Text, { color: "green", children: "\u2713 No pending gates." }) });
+  }
+  if (current === void 0) {
+    return /* @__PURE__ */ jsx(Box, { flexDirection: "column", children: /* @__PURE__ */ jsxs(Text, { children: [
+      "Reviewing gates\u2026 (",
+      index + 1,
+      " of ",
+      gates.length,
+      ")"
+    ] }) });
+  }
+  return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsxs(Box, { children: [
+      /* @__PURE__ */ jsx(Text, { bold: true, children: "\u26A0 Review: " }),
+      /* @__PURE__ */ jsx(Text, { bold: true, color: severityColor(current.riskLevel), children: current.gateType }),
+      /* @__PURE__ */ jsxs(Text, { children: [
+        " ",
+        "(",
+        index + 1,
+        "/",
+        gates.length,
+        ")"
+      ] })
+    ] }),
+    /* @__PURE__ */ jsx(Box, { children: /* @__PURE__ */ jsxs(Text, { children: [
+      "Skill: ",
+      /* @__PURE__ */ jsx(Text, { bold: true, children: current.skillId }),
+      " \xB7 Risk:",
+      " ",
+      /* @__PURE__ */ jsx(Text, { color: severityColor(current.riskLevel), children: current.riskLevel }),
+      " \xB7 Confidence:",
+      " ",
+      current.confidence.toFixed(2),
+      " \xB7 Action: ",
+      /* @__PURE__ */ jsx(Text, { bold: true, children: current.requiredAction })
+    ] }) }),
+    /* @__PURE__ */ jsx(Box, { marginTop: 1, children: /* @__PURE__ */ jsx(Text, { children: "Preview:" }) }),
+    /* @__PURE__ */ jsx(GatePreview, { gate: current }),
+    /* @__PURE__ */ jsx(Box, { marginTop: 1, children: /* @__PURE__ */ jsx(Text, { dimColor: true, children: "[a]pprove \xB7 [r]eject \xB7 [s]kip \xB7 [q]uit" }) })
+  ] });
+}
+
+export { GateReview, dispatchGateKeypress };

package/dist/SnapshotReview-7TPWX62T.js

@@ -0,0 +1,137 @@
+#!/usr/bin/env node
+import { useApp, useInput, Box, Text } from 'ink';
+import { useState } from 'react';
+import { jsx, jsxs } from 'react/jsx-runtime';
+
+function dispatchKeypress(input) {
+  switch (input.toLowerCase()) {
+    case "a":
+      return { kind: "decide", action: "approve" };
+    case "r":
+      return { kind: "decide", action: "reject" };
+    case "s":
+      return { kind: "decide", action: "skip" };
+    case "q":
+      return { kind: "quit" };
+    default:
+      return { kind: "ignore" };
+  }
+}
+function formatPct(p) {
+  if (p >= 1) return `${p.toFixed(2)}%`;
+  if (p > 0) return `${p.toFixed(3)}%`;
+  return `0%`;
+}
+function ClassificationView({
+  classification
+}) {
+  if (classification === null) {
+    return /* @__PURE__ */ jsx(Text, { color: "gray", dimColor: true, children: "(unclassified \u2014 visual.diff was skipped or failed)" });
+  }
+  const color = classification.verdict === "regression" ? "red" : classification.verdict === "intentional" ? "green" : classification.verdict === "noise" ? "gray" : "yellow";
+  return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsxs(Text, { children: [
+      "Verdict:",
+      " ",
+      /* @__PURE__ */ jsx(Text, { color, bold: true, children: classification.verdict }),
+      " ",
+      "(confidence ",
+      classification.confidence.toFixed(2),
+      ")"
+    ] }),
+    /* @__PURE__ */ jsxs(Text, { children: [
+      "Suggested: ",
+      classification.suggestedAction
+    ] }),
+    /* @__PURE__ */ jsx(Box, { marginTop: 1, children: /* @__PURE__ */ jsx(Text, { wrap: "wrap", children: classification.reasoning }) }),
+    classification.affectedAreas.length > 0 ? /* @__PURE__ */ jsx(Box, { marginTop: 1, children: /* @__PURE__ */ jsxs(Text, { children: [
+      "Affected: ",
+      classification.affectedAreas.join(", ")
+    ] }) }) : null
+  ] });
+}
+function SnapshotReview({
+  items,
+  onDecide,
+  onExit
+}) {
+  const { exit } = useApp();
+  const [index, setIndex] = useState(0);
+  const [exited, setExited] = useState(false);
+  const finish = (reason) => {
+    if (exited) return;
+    setExited(true);
+    onExit(reason);
+    exit();
+  };
+  useInput((input) => {
+    if (exited || items.length === 0 || index >= items.length) return;
+    const intent = dispatchKeypress(input);
+    if (intent.kind === "ignore") return;
+    if (intent.kind === "quit") {
+      finish("quit");
+      return;
+    }
+    onDecide(items[index], intent.action);
+    const next = index + 1;
+    if (next >= items.length) finish("completed");
+    else setIndex(next);
+  });
+  if (items.length === 0) {
+    return /* @__PURE__ */ jsx(Box, { flexDirection: "column", children: /* @__PURE__ */ jsx(Text, { children: "(no pending visual diffs)" }) });
+  }
+  if (exited || index >= items.length) {
+    return /* @__PURE__ */ jsx(Box, { flexDirection: "column", children: /* @__PURE__ */ jsx(Text, { children: "Review complete." }) });
+  }
+  const current = items[index];
+  const total = items.length;
+  return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsxs(Box, { children: [
+      /* @__PURE__ */ jsx(Text, { bold: true, children: "QAIOS visual review" }),
+      /* @__PURE__ */ jsx(Text, { dimColor: true, children: `  (${index + 1} / ${total})` })
+    ] }),
+    /* @__PURE__ */ jsxs(Box, { marginTop: 1, flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs(Text, { children: [
+        /* @__PURE__ */ jsx(Text, { bold: true, children: current.baseline.name }),
+        /* @__PURE__ */ jsx(Text, { children: `@${current.baseline.viewport}` })
+      ] }),
+      /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+        "route: ",
+        current.baseline.route
+      ] }),
+      /* @__PURE__ */ jsxs(Text, { children: [
+        formatPct(current.diff.percentageChanged),
+        " pixels changed (",
+        current.diff.pixelsChanged,
+        " ",
+        "px)"
+      ] }),
+      /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+        "baseline: ",
+        current.baseline.imagePath
+      ] }),
+      /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+        "current: ",
+        current.diff.currentImagePath
+      ] }),
+      /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+        "diff: ",
+        current.diff.diffImagePath
+      ] })
+    ] }),
+    /* @__PURE__ */ jsx(Box, { marginTop: 1, flexDirection: "column", children: /* @__PURE__ */ jsx(ClassificationView, { classification: current.diff.classification ?? null }) }),
+    /* @__PURE__ */ jsx(Box, { marginTop: 1, children: /* @__PURE__ */ jsxs(Text, { children: [
+      "[",
+      /* @__PURE__ */ jsx(Text, { color: "green", children: "a" }),
+      "]pprove \u2192 update baseline \xB7 [",
+      /* @__PURE__ */ jsx(Text, { color: "red", children: "r" }),
+      "]eject \u2192 keep baseline \xB7 [",
+      /* @__PURE__ */ jsx(Text, { color: "yellow", children: "s" }),
+      "]kip \xB7 [",
+      /* @__PURE__ */ jsx(Text, { children: "q" }),
+      "]uit"
+    ] }) })
+  ] });
+}
+
+export { SnapshotReview, dispatchKeypress };

package/dist/a11y/scripts/axe-runner.mjs

@@ -78,6 +78,12 @@ try {
   const context = await browser.newContext();
   const page = await context.newPage();
   await page.goto(url, { timeout: timeoutMs, waitUntil });
+  // Single-page apps render after DOMContentLoaded (live test: an Angular shop
+  // scanned as an empty shell, 0 violations vs 27). Let the network settle,
+  // best effort and bounded.
+  if (waitUntil !== 'networkidle') {
+    await page.waitForLoadState('networkidle', { timeout: 5000 }).catch(() => {});
+  }
 
   const builder = new AxeBuilder({ page });
   if (tags.length > 0) builder.withTags(tags);
@@ -99,7 +105,8 @@ try {
     ...tag(results.incomplete, 'incomplete'),
   ];
 
-  writeFileSync(out, JSON.stringify({ url, findings }), 'utf-8');
+  // finalUrl: where navigation ended (a login redirect is reported, not hidden).
+  writeFileSync(out, JSON.stringify({ url, finalUrl: page.url(), findings }), 'utf-8');
 } catch (err) {
   process.stderr.write(`axe-runner: ${err?.message ?? err}\n`);
   process.exit(4);