@roopesh.yadava/qa-pack 1.0.3 → 1.2.0

package/claude/skills/ui-test-figma/SKILL.md

@@ -3,7 +3,8 @@ name: ui-test-figma
 description: >
   Compares a live web application page against a Figma design to detect UI inconsistencies.
   Uses Playwright CLI for zero-token screenshots and targeted browser_evaluate for CSS — never
-  browser_snapshot. Figma MCP preferred; browser fallback automatic. OTP always 999999.
+  browser_snapshot. Figma MCP preferred; browser fallback automatic. Credentials and OTP
+  code come from .env (QA_USERNAME / QA_PASSWORD / QA_OTP_CODE).
   Can be called standalone or from manual-testing (Step 1 of Manual branch).
   Trigger: "compare with application", "ui test", "check design", "test this page against figma",
   "run ui check", or a Figma link with a comparison request.
@@ -30,7 +31,8 @@ Compares a live app page against a Figma design. Uses **Playwright CLI** for all
 
 ## Token Tracking
 
-Silent background task — follow the **Token Tracking** pattern in `SKILLS_CONTEXT.md`.
+Optional and silent — follow the **Token Tracking** pattern in `SKILLS_CONTEXT.md`
+(run its enablement check once at skill start; if disabled, skip every checkpoint silently).
 Never show tracking output to user. Checkpoints: `start` → `login` → `comparison` → `end + report + session`.
 Use `CARD_ID` if called from pipeline, else `"ui-test"`.
 
@@ -68,7 +70,9 @@ ls .playwright-session.json 2>/dev/null && echo "SESSION_EXISTS" || echo "NO_SES
 **If no session file:**
 Navigate to `BASE_URL` via `browser_navigate` and take a `browser_snapshot`.
 - **Dashboard/home page** → session active, skip to Step 1b.
-- **Login form** → ask for email, then password.
+- **Login form** → read `.env` for `QA_USERNAME` / `QA_PASSWORD` / `QA_OTP_CODE` (or use
+  values passed by the invoking skill). Only if still missing, ask for email + password
+  in one message. Never print the password.
 
 Once inputs collected: `"Got everything. Logging in and starting the comparison now..."`
 
@@ -100,7 +104,7 @@ Use `browser_snapshot` to read field selectors, then:
 
 **If OTP screen appears** (6-box PIN):
 7. `browser_click` first OTP box
-8. `browser_type(text: "999999")` — always this value, auto-advances
+8. `browser_type(text: QA_OTP_CODE)` — the code from `.env` (ask once if unset), auto-advances
 9. `browser_click` Verify button
 10. `browser_wait_for(state: "networkidle")`
 11. `browser_snapshot()` — confirm past OTP

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@roopesh.yadava/qa-pack",
-  "version": "1.0.3",
+  "version": "1.2.0",
   "description": "AI-powered QA agent skills for Claude Code — manual testing, BDD automation, accessibility, UI/Figma diff, bug reporting",
   "scripts": {
     "postinstall": "node bin/postinstall.js"

package/templates/.env.example

@@ -0,0 +1,22 @@
+# qa-pack — QA agent secrets & environment (gitignored — fill in the values)
+# All QA skills read this file once at startup. Values here take precedence over
+# anything stored in product context. NEVER commit the filled-in .env.
+
+# ── App under test ────────────────────────────────────────────────────────────
+QA_APP_URL=
+QA_LOGIN_URL=
+QA_USERNAME=
+QA_PASSWORD=
+# OTP code entered on the OTP screen when the app asks for one (leave empty if no OTP)
+QA_OTP_CODE=999999
+
+# ── Jira REST (only needed for screenshot attachments on bugs) ────────────────
+JIRA_BASE_URL=
+JIRA_EMAIL=
+JIRA_API_TOKEN=
+
+# ── Optional: token-usage tracking (developer machines only) ──────────────────
+# Point at a directory containing track_tokens.py + context_snapshot.py.
+# When unset or the scripts are missing, skills skip all tracking silently.
+# QA_TRACKING_DIR=
+# QA_TRACKING_MODEL=

package/templates/CLAUDE.md

@@ -1,6 +1,7 @@
 # QA Agent — Project Configuration
 
-<!-- Fill in the sections marked TODO before committing. -->
+<!-- Fill in the sections marked TODO before committing. This file is safe to commit —
+     secrets go in .env (gitignored), never here. -->
 
 ## Project
 
@@ -9,24 +10,28 @@
 - **Login URL**: `TODO: e.g. https://app.example.com/login` (or same as App URL)
 - **Environment**: `TODO: staging | dev | prod`
 - **Auth Method**: `TODO: form_login | SSO | token | none`
-- **OTP Required**: `TODO: yes (always use 999999) | no`
+- **OTP Required**: `TODO: yes | no` (the code itself goes in `.env` as `QA_OTP_CODE`)
 
-## Test credentials (dev/staging only — use env vars in CI)
+## Secrets
 
-- **Username**: `TODO`
-- **Password**: `TODO`
+Test credentials live in `.env` at the repo root (gitignored, seeded by qa-pack install):
+`QA_APP_URL`, `QA_LOGIN_URL`, `QA_USERNAME`, `QA_PASSWORD`, `QA_OTP_CODE`, plus
+`JIRA_BASE_URL` / `JIRA_EMAIL` / `JIRA_API_TOKEN` for bug screenshot attachments.
+**Never write credentials into this file or any committed file.**
 
 ---
 
 ## QA Skills available
 
-This project has the full QA agent skill pack installed. Invoke any skill from Claude Code:
+This project has the qa-pack skill set installed. The QA agent runs a structured flow:
+card ID → product context → only the missing questions → phase selection.
 
 | What you want | How to trigger |
 |---|---|
-| Full QA on a Jira card | `run qa PROJ-123` |
-| Manual testing only | `manual test PROJ-123` |
-| Write BDD automation | `automate PROJ-123` |
+| Start the QA agent on a card | `run qa PROJ-123` (then pick a phase) |
+| Phase 1 — manual testing | `manual test PROJ-123` |
+| Phase 2 — write automation (reuse-first) | `automate PROJ-123` |
+| Phase 3 — both (manual first, then automation) | `full QA PROJ-123` |
 | Accessibility audit | `accessibility test PROJ-123` |
 | UI vs Figma diff | `ui test PROJ-123` |
 | File a bug | `file a bug` |
@@ -35,7 +40,10 @@ This project has the full QA agent skill pack installed. Invoke any skill from C
 
 ## Conventions
 
-- Test files live in `test/` — feature files in `test/features/`, step definitions in `test/step-definations/`
-- BDD runner: CucumberJS with `cucumber.cjs` config
+- BDD runner: CucumberJS with `cucumber.cjs` config — the automation skill discovers
+  your feature/step/POM layout from this config and the existing tree (no fixed layout imposed)
+- The automation skill reuses existing Gherkin steps and step definitions first; new step
+  definitions require explicit approval and reuse % is tracked per run
 - Screenshots and reports go to `outputs/` (gitignored)
-- Product context (persistent QA memory) lives in `.claude/skills/qa-agent/product_context/{PROJECT_KEY}/context.md`
+- Product context (persistent QA memory, no secrets) lives in
+  `.claude/skills/qa-agent/product_context/{PRODUCT}/context.md`