@qulib/core 0.5.0 → 0.5.2

package/dist/cli/auth-login-resolve.js

@@ -29,7 +29,7 @@ export function parseCredentialsJsonString(json) {
     return out;
 }
 export function resolveFormLoginPath(baseUrl, authOptions, authPathId) {
-    const formPaths = (authOptions ?? []).filter((o) => o.type === 'form-login' && o.requirements.method === 'credentials');
+    const formPaths = (authOptions ?? []).filter((o) => (o.type === 'form-login' || o.type === 'form-multi') && o.requirements.method === 'credentials');
     if (formPaths.length === 0) {
         throw new Error(`No automatable form-login path detected on ${baseUrl}. Use \`qulib auth init\` for manual login.`);
     }

package/dist/cli/auth-login-run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-login-run.d.ts","sourceRoot":"","sources":["../../src/cli/auth-login-run.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAsB5D,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAEhE;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoIhB"}
+{"version":3,"file":"auth-login-run.d.ts","sourceRoot":"","sources":["../../src/cli/auth-login-run.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAsB5D,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAMhE;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoIhB"}

package/dist/cli/auth-login-run.js

@@ -16,7 +16,9 @@ function sleep(ms) {
     return new Promise((r) => setTimeout(r, ms));
 }
 export function authPathNeedsClickReveal(path) {
-    return path.type === 'form-login' && path.source === 'heuristic' && !builtInOAuthIds.has(path.id);
+    return ((path.type === 'form-login' || path.type === 'form-multi') &&
+        (path.source === 'heuristic' || path.source === 'user-local') &&
+        !builtInOAuthIds.has(path.id));
 }
 export async function runAutomatedAuthLogin(params) {
     const { chromium } = await import('@playwright/test');

package/dist/llm/context-builder.js

@@ -6,7 +6,7 @@ export function buildGapPrompt(gaps, limit) {
     })
         .slice(0, limit);
     const gapList = topGaps
-        .map((g, i) => `${i + 1}. [${g.severity}] ${g.category} at ${g.path}: ${g.reason}`)
+        .map((g) => `- id:${g.id} [${g.severity}] ${g.category} at ${g.path}: ${g.reason}`)
         .join('\n');
     return `You are a QA engineer. Given these quality gaps found in a web application, generate test scenarios.
 
@@ -28,6 +28,6 @@ Each item must match this exact shape:
   "recommendations": [
     { "adapter": "playwright|cypress-e2e|cypress-component|api|accessibility", "reason": "string", "confidence": "high|medium|low" }
   ],
-  "sourceGapIds": ["string"]
+  "sourceGapIds": ["<one or more gap ids from the list, copied exactly as id:xxxx>"]
 }`;
 }

package/dist/tools/auth/detect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"detect.d.ts","sourceRoot":"","sources":["../../../src/tools/auth/detect.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAY,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAIzE,MAAM,MAAM,yBAAyB,GACjC,cAAc,GACd,iBAAiB,GACjB,cAAc,GACd,cAAc,GACd,yBAAyB,GACzB,iBAAiB,GACjB,SAAS,CAAC;AAEd,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC7C,MAAM,EAAE,MAAM,CAAC;CAChB;AAsQD,wBAAgB,4BAA4B,CAAC,OAAO,EAAE;IACpD,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,mBAAmB,EAAE,OAAO,CAAC;CAC9B,GAAG,4BAA4B,CA6B/B;AAOD,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC,CAgD9C;AAED,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,MAAM,EACf,SAAS,SAAQ,GAChB,OAAO,CAAC;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAelD;AAED,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,SAAS,SAAQ,GAChB,OAAO,CAAC,4BAA4B,CAAC,CAyDvC;AAED,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EACX,SAAS,SAAQ,EACjB,QAAQ,CAAC,EAAE,mBAAmB,GAC7B,OAAO,CAAC,YAAY,CAAC,CAqJvB"}
+{"version":3,"file":"detect.d.ts","sourceRoot":"","sources":["../../../src/tools/auth/detect.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,EAAY,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAIzE,MAAM,MAAM,yBAAyB,GACjC,cAAc,GACd,iBAAiB,GACjB,cAAc,GACd,cAAc,GACd,yBAAyB,GACzB,iBAAiB,GACjB,SAAS,CAAC;AAEd,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC7C,MAAM,EAAE,MAAM,CAAC;CAChB;AAuRD,wBAAgB,4BAA4B,CAAC,OAAO,EAAE;IACpD,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,mBAAmB,EAAE,OAAO,CAAC;CAC9B,GAAG,4BAA4B,CA6B/B;AAOD,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC,CAgD9C;AAED,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,MAAM,EACf,SAAS,SAAQ,GAChB,OAAO,CAAC;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAelD;AAED,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,SAAS,SAAQ,GAChB,OAAO,CAAC,4BAA4B,CAAC,CAyDvC;AAED,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EACX,SAAS,SAAQ,EACjB,QAAQ,CAAC,EAAE,mBAAmB,GAC7B,OAAO,CAAC,YAAY,CAAC,CAqJvB"}

package/dist/tools/auth/detect.js

@@ -49,6 +49,9 @@ async function firstTextInputNameForLogin(page) {
 function debugAuth() {
     return process.env.QULIB_DEBUG === '1';
 }
+function isLoginishPath(pathname) {
+    return /login|sign[- ]?in|auth|sso|oauth|signin/i.test(pathname);
+}
 function slugify(label) {
     const s = label
         .toLowerCase()
@@ -151,7 +154,7 @@ function authPathsFromOauthButtons(oauthButtons, loginUrl) {
 }
 async function probeClickToRevealForms(page, loginUrl, alreadyMatchedTexts, timeoutMs, progress) {
     const out = [];
-    const buttons = page.locator('button');
+    const buttons = page.locator('button, [role="button"]');
     const n = await buttons.count();
     const seenLabels = new Set();
     const SUBMIT_RE = /^(sign in|log in|submit|continue|next|cancel|close)$/i;
@@ -169,6 +172,7 @@ async function probeClickToRevealForms(page, loginUrl, alreadyMatchedTexts, time
         seenLabels.add(label);
         candidateAttempts += 1;
         const originBefore = new URL(page.url()).origin;
+        const pathBefore = new URL(page.url()).pathname;
         if (debugAuth()) {
             progress?.debug(`detect_auth click-reveal try label="${label.slice(0, 80)}"`);
         }
@@ -207,8 +211,18 @@ async function probeClickToRevealForms(page, loginUrl, alreadyMatchedTexts, time
             await waitNetworkIdleBestEffort(page);
             continue;
         }
+        const afterUrl = new URL(page.url());
+        if (afterUrl.pathname !== pathBefore && !isLoginishPath(afterUrl.pathname)) {
+            if (debugAuth()) {
+                progress?.debug(`detect_auth click-reveal skip (CTA navigation to non-login path): ${afterUrl.pathname}`);
+            }
+            await page.goto(loginUrl, { timeout: timeoutMs, waitUntil: 'domcontentloaded' });
+            await waitNetworkIdleBestEffort(page);
+            continue;
+        }
+        await waitNetworkIdleBestEffort(page);
         try {
-            await page.locator('input[type="password"]:visible').first().waitFor({ state: 'visible', timeout: 2000 });
+            await page.locator('input[type="password"]:visible').first().waitFor({ state: 'visible', timeout: 5000 });
         }
         catch {
             await page.goto(loginUrl, { timeout: timeoutMs, waitUntil: 'domcontentloaded' });

package/dist/tools/auth/explore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"explore.d.ts","sourceRoot":"","sources":["../../../src/tools/auth/explore.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,eAAe,EAGrB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAiNzE,wBAAsB,WAAW,CAC/B,GAAG,EAAE,MAAM,EACX,SAAS,SAAQ,EACjB,QAAQ,CAAC,EAAE,mBAAmB,GAC7B,OAAO,CAAC,eAAe,CAAC,CAgL1B"}
+{"version":3,"file":"explore.d.ts","sourceRoot":"","sources":["../../../src/tools/auth/explore.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,eAAe,EAGrB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AA2PzE,wBAAsB,WAAW,CAC/B,GAAG,EAAE,MAAM,EACX,SAAS,SAAQ,EACjB,QAAQ,CAAC,EAAE,mBAAmB,GAC7B,OAAO,CAAC,eAAe,CAAC,CAiM1B"}

package/dist/tools/auth/explore.js

@@ -185,6 +185,43 @@ async function buildFormPaths(page) {
         },
     ];
 }
+async function probeUserLocalProviderClick(page, providerLabel, loginUrl, timeoutMs) {
+    const originBefore = new URL(page.url()).origin;
+    let clicked = false;
+    try {
+        await page.getByRole('button', { name: providerLabel, exact: true }).first().click({ timeout: 3000 });
+        clicked = true;
+    }
+    catch {
+        try {
+            const escaped = providerLabel.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+            await page
+                .locator('button, [role="button"]')
+                .filter({ hasText: new RegExp(`^\\s*${escaped}\\s*$`, 'i') })
+                .first()
+                .click({ timeout: 3000 });
+            clicked = true;
+        }
+        catch {
+            /* skip */
+        }
+    }
+    if (!clicked)
+        return [];
+    try {
+        await page.waitForLoadState('domcontentloaded', { timeout: 5000 });
+    }
+    catch { /* best-effort */ }
+    await waitNetworkIdleBestEffort(page);
+    if (new URL(page.url()).origin !== originBefore) {
+        await page.goto(loginUrl, { timeout: timeoutMs, waitUntil: 'domcontentloaded' });
+        return [];
+    }
+    const formPaths = await buildFormPaths(page);
+    await page.goto(loginUrl, { timeout: timeoutMs, waitUntil: 'domcontentloaded' });
+    await waitNetworkIdleBestEffort(page);
+    return formPaths;
+}
 export async function exploreAuth(url, timeoutMs = 20000, progress) {
     const browser = await launchBrowser();
     try {
@@ -246,6 +283,21 @@ export async function exploreAuth(url, timeoutMs = 20000, progress) {
                     continue;
                 }
                 consumed.add(id);
+                if (p.source === 'user-local') {
+                    const probed = await probeUserLocalProviderClick(page, p.label, finalUrl, timeoutMs);
+                    if (probed.length > 0) {
+                        for (const fp of probed) {
+                            authPaths.push({
+                                ...fp,
+                                id: p.id,
+                                label: p.label,
+                                source: 'user-local',
+                            });
+                            progress?.info(`explore_auth path id=${p.id} type=${fp.type} automatable=${fp.automatable} (user-local probe)`);
+                        }
+                        continue;
+                    }
+                }
                 authPaths.push({
                     id,
                     label: p.label,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qulib/core",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "Qulib — analyze deployed web apps for honest quality gaps (CLI + programmatic API)",
   "license": "MIT",
   "author": "Tapesh Nagarwal",
@@ -48,7 +48,7 @@
     "analyze": "tsx src/cli/index.ts analyze",
     "clean": "tsx src/cli/index.ts clean",
     "build": "tsc",
-    "test": "node --import tsx/esm --test src/llm/__tests__/cost-intelligence.test.ts src/tools/scoring/__tests__/gaps.test.ts src/tools/auth/__tests__/gaps.test.ts src/tools/auth/__tests__/detect.test.ts src/tools/scoring/__tests__/automation-maturity.test.ts src/harness/__tests__/state-manager.test.ts src/telemetry/__tests__/redact-url.test.ts src/cli/__tests__/auth-login.test.ts src/cli/__tests__/cli-version.test.ts src/__tests__/analyze.storage-state-invalid.test.ts src/__tests__/analyze.fixtures.test.ts",
+    "test": "node --import tsx/esm --test src/llm/__tests__/cost-intelligence.test.ts src/llm/__tests__/context-builder.test.ts src/tools/scoring/__tests__/gaps.test.ts src/tools/auth/__tests__/gaps.test.ts src/tools/auth/__tests__/detect.test.ts src/tools/scoring/__tests__/automation-maturity.test.ts src/harness/__tests__/state-manager.test.ts src/telemetry/__tests__/redact-url.test.ts src/cli/__tests__/auth-login.test.ts src/cli/__tests__/cli-version.test.ts src/__tests__/analyze.storage-state-invalid.test.ts src/__tests__/analyze.fixtures.test.ts",
     "test:integration": "node --import tsx/esm --test src/__tests__/analyze.integration.test.ts",
     "smoke": "tsx src/cli/index.ts analyze --url https://example.com --ephemeral",
     "cost-doctor": "tsx src/cli/index.ts cost doctor"