@soleur/opencode 0.0.0-stage → 1.0.0

package/skills/ux-audit/scripts/bot-fixture.ts

@@ -0,0 +1,270 @@
+#!/usr/bin/env bun
+/**
+ * bot-fixture.ts — seed/reset the ux-audit bot's DB state.
+ *
+ * Scope: DB-only v1. KB file seeding deferred to #2351 (files live in GitHub
+ * workspace, not Supabase Storage).
+ *
+ * Usage: bun "${CLAUDE_PLUGIN_ROOT}/skills/ux-audit/scripts/bot-fixture.ts" <seed|reset>
+ *
+ * Env (from Doppler prd + prd_scheduled):
+ *   SUPABASE_URL                    prd
+ *   SUPABASE_SERVICE_ROLE_KEY       prd
+ *   UX_AUDIT_BOT_EMAIL              prd_scheduled
+ *
+ * CI-caller contract: any GitHub Actions job that invokes `seed` or
+ * `reset` MUST set job-level
+ *   concurrency:
+ *     group: bot-fixture-shared-state
+ *     cancel-in-progress: false
+ * so parallel workflows never race on the shared bot user. The existing
+ * consumer is .github/workflows/scheduled-ux-audit.yml — mirror that
+ * stanza in any new caller.
+ */
+
+const TC_VERSION = "1.0.0";
+
+// Error-body truncation bound for Supabase REST error surfaces. 200 chars
+// captures the PostgREST `{code, message}` envelope without dumping long
+// `details` enumerations into CI logs. Referenced by symbol at every
+// `res.text()` callsite below.
+const ERROR_BODY_MAX = 200;
+
+// Defense-in-depth allowlist. Matches the test-side guard in
+// `bot-fixture.test.ts` and rule `cq-destructive-prod-tests-allowlist`.
+// seed()/reset() DELETE+PATCH live prod rows; a misconfigured
+// UX_AUDIT_BOT_EMAIL would otherwise cascade onto a real user. Add new
+// synthetic emails here explicitly.
+const ALLOWED_BOT_EMAILS = new Set(["ux-audit-bot@jikigai.com"]);
+
+const FIXTURE_CONVERSATIONS = [
+  {
+    session_id: "ux-audit-fixture-conv-1",
+    domain_leader: "cmo",
+    messages: [
+      { role: "user" as const, content: "What's the highest-leverage thing I can do this week to grow?" },
+      { role: "assistant" as const, content: "Given your current stage, I'd focus on outbound to the 12 closest-fit prospects from last month's signups. Want me to draft the sequence?" },
+      { role: "user" as const, content: "Yes, draft it." },
+    ],
+  },
+  {
+    session_id: "ux-audit-fixture-conv-2",
+    domain_leader: "cto",
+    messages: [
+      { role: "user" as const, content: "Is our CI pipeline a bottleneck?" },
+      { role: "assistant" as const, content: "Looking at the last 50 runs, median is 6m 40s. The Eleventy build step is the longest single job. Want me to profile it?" },
+      { role: "user" as const, content: "Please do, and share the top 3 wins." },
+      { role: "assistant" as const, content: "Top wins: (1) cache node_modules between jobs, (2) parallelize lint + typecheck, (3) skip docs build on non-docs PRs." },
+    ],
+  },
+] as const;
+
+function env(key: string): string {
+  const v = process.env[key];
+  if (!v) throw new Error(`Missing env: ${key}`);
+  return v;
+}
+
+export async function sbFetch(
+  path: string,
+  init: RequestInit = {},
+): Promise<Response> {
+  const SUPABASE_URL = env("SUPABASE_URL");
+  const SERVICE_KEY = env("SUPABASE_SERVICE_ROLE_KEY");
+  return fetch(`${SUPABASE_URL}${path}`, {
+    ...init,
+    headers: {
+      apikey: SERVICE_KEY,
+      Authorization: `Bearer ${SERVICE_KEY}`,
+      "Content-Type": "application/json",
+      ...init.headers,
+    },
+  });
+}
+
+export async function sbDelete(path: string): Promise<void> {
+  const res = await sbFetch(path, { method: "DELETE" });
+  if (!res.ok) {
+    const body = (await res.text()).slice(0, ERROR_BODY_MAX);
+    throw new Error(`DELETE ${path} failed: ${res.status} ${body}`);
+  }
+}
+
+async function getBotUserId(): Promise<string> {
+  const email = env("UX_AUDIT_BOT_EMAIL");
+  if (!ALLOWED_BOT_EMAILS.has(email)) {
+    throw new Error(
+      `UX_AUDIT_BOT_EMAIL=${email} is not in the synthetic allowlist. ` +
+        `seed/reset would mutate a real user's data. Refusing to proceed. ` +
+        `See ALLOWED_BOT_EMAILS + rule cq-destructive-prod-tests-allowlist.`,
+    );
+  }
+  const res = await sbFetch(`/auth/v1/admin/users?per_page=1000`);
+  if (!res.ok) {
+    const body = (await res.text()).slice(0, ERROR_BODY_MAX);
+    throw new Error(`admin users GET failed: ${res.status} ${body}`);
+  }
+  const data = (await res.json()) as {
+    users: Array<{ id: string; email: string }>;
+  };
+  const bot = data.users.find((u) => u.email === email);
+  if (!bot) throw new Error(`bot user ${email} not found — run 1.1 first`);
+  return bot.id;
+}
+
+async function updateUserRow(
+  userId: string,
+  patch: Record<string, unknown>,
+): Promise<void> {
+  const res = await sbFetch(`/rest/v1/users?id=eq.${userId}`, {
+    method: "PATCH",
+    body: JSON.stringify(patch),
+  });
+  if (!res.ok) {
+    const body = (await res.text()).slice(0, ERROR_BODY_MAX);
+    throw new Error(`PATCH users failed: ${res.status} ${body}`);
+  }
+}
+
+async function upsertConversation(
+  userId: string,
+  sessionId: string,
+  domainLeader: string,
+): Promise<string> {
+  // Body intentionally omits `created_at`: PostgREST's
+  // resolution=merge-duplicates compiles to `ON CONFLICT ... DO UPDATE
+  // SET col = EXCLUDED.col` for every column in the body. Leaving
+  // `created_at` out preserves the original insert timestamp on re-seed.
+  // The non-partial unique index `uniq_conversations_user_id_session_id_total`
+  // (migration 035) is the arbiter — PostgREST cannot infer a partial unique
+  // index because it does not emit the index's WHERE predicate. With NULLS
+  // DISTINCT (Postgres default) multiple (user_id, NULL) rows coexist, so an
+  // empty sessionId would defeat merge-duplicates and silently insert a new
+  // row on every re-seed.
+  if (!sessionId) {
+    throw new Error(
+      `upsertConversation requires a non-empty sessionId (NULLs would bypass merge-duplicates and insert duplicate rows)`,
+    );
+  }
+  const res = await sbFetch(
+    `/rest/v1/conversations?on_conflict=user_id,session_id`,
+    {
+      method: "POST",
+      headers: {
+        Prefer: "return=representation,resolution=merge-duplicates",
+      },
+      body: JSON.stringify({
+        user_id: userId,
+        session_id: sessionId,
+        domain_leader: domainLeader,
+        status: "completed",
+      }),
+    },
+  );
+  if (!res.ok) {
+    const body = (await res.text()).slice(0, ERROR_BODY_MAX);
+    throw new Error(`POST conversations (upsert) failed: ${res.status} ${body}`);
+  }
+  const rows = (await res.json()) as Array<{ id: string }>;
+  if (!rows[0]) {
+    throw new Error(`POST conversations returned empty array — representation missing`);
+  }
+  return rows[0].id;
+}
+
+async function insertMessages(
+  conversationId: string,
+  messages: ReadonlyArray<{ role: "user" | "assistant"; content: string }>,
+): Promise<void> {
+  const res = await sbFetch(`/rest/v1/messages`, {
+    method: "POST",
+    body: JSON.stringify(
+      messages.map((m) => ({
+        conversation_id: conversationId,
+        role: m.role,
+        content: m.content,
+      })),
+    ),
+  });
+  if (!res.ok) {
+    const body = (await res.text()).slice(0, ERROR_BODY_MAX);
+    throw new Error(`POST messages failed: ${res.status} ${body}`);
+  }
+}
+
+export async function seed(): Promise<void> {
+  const botId = await getBotUserId();
+  console.log(`[seed] bot user id: ${botId}`);
+
+  await updateUserRow(botId, {
+    tc_accepted_version: TC_VERSION,
+    tc_accepted_at: new Date().toISOString(),
+    onboarding_completed_at: new Date().toISOString(),
+    subscription_status: "active",
+    stripe_customer_id: "cus_ux_audit_fixture",
+    stripe_subscription_id: "sub_ux_audit_fixture",
+    current_period_end: new Date(Date.now() + 365 * 24 * 3600 * 1000).toISOString(),
+    cancel_at_period_end: false,
+  });
+  console.log("[seed] users row patched (tc + subscription + onboarding)");
+
+  for (const c of FIXTURE_CONVERSATIONS) {
+    const cid = await upsertConversation(botId, c.session_id, c.domain_leader);
+    // DELETE-then-INSERT keeps message count stable across re-seeds. Without
+    // this, upsert's merge-duplicates would re-insert and double the count
+    // (the messages table has no natural unique key we want to index).
+    // NOT atomic — two separate PostgREST calls. If the process dies between
+    // the DELETE and the INSERT, the conversation is left with zero messages.
+    // That is self-healing: the next `seed` run restores the full set.
+    // Acceptable for a fixture; do NOT wrap the pair in a misguided retry.
+    await sbDelete(`/rest/v1/messages?conversation_id=eq.${cid}`);
+    await insertMessages(cid, c.messages);
+    console.log(`[seed] conversation ${c.session_id} upserted (${cid}) with ${c.messages.length} messages`);
+  }
+
+  console.log("[seed] done");
+}
+
+export async function reset(): Promise<void> {
+  const botId = await getBotUserId();
+  console.log(`[reset] bot user id: ${botId}`);
+
+  const convRes = await sbFetch(
+    `/rest/v1/conversations?user_id=eq.${botId}&select=id`,
+  );
+  if (!convRes.ok) throw new Error(`conversations GET ${convRes.status}`);
+  const conversations = (await convRes.json()) as Array<{ id: string }>;
+
+  for (const c of conversations) {
+    await sbDelete(`/rest/v1/messages?conversation_id=eq.${c.id}`);
+  }
+  if (conversations.length > 0) {
+    await sbDelete(`/rest/v1/conversations?user_id=eq.${botId}`);
+  }
+  console.log(`[reset] deleted ${conversations.length} conversations + messages`);
+
+  await updateUserRow(botId, {
+    tc_accepted_version: null,
+    tc_accepted_at: null,
+    onboarding_completed_at: null,
+    subscription_status: "none",
+    stripe_customer_id: null,
+    stripe_subscription_id: null,
+    current_period_end: null,
+    cancel_at_period_end: false,
+  });
+  console.log("[reset] users row cleared");
+  console.log("[reset] done");
+}
+
+if (import.meta.main) {
+  const cmd = process.argv[2];
+  if (cmd === "seed") {
+    await seed();
+  } else if (cmd === "reset") {
+    await reset();
+  } else {
+    console.error("Usage: bun bot-fixture.ts <seed|reset>");
+    process.exit(2);
+  }
+}

package/skills/ux-audit/scripts/bot-signin.ts

@@ -0,0 +1,135 @@
+#!/usr/bin/env bun
+/**
+ * bot-signin.ts — signs in as the ux-audit bot and writes a Playwright-compatible
+ * storageState JSON containing the Supabase SSR auth cookie.
+ *
+ * Usage: bun "${CLAUDE_PLUGIN_ROOT}/skills/ux-audit/scripts/bot-signin.ts"
+ *
+ * Env:
+ *   SUPABASE_URL                    prd
+ *   NEXT_PUBLIC_SUPABASE_ANON_KEY   prd
+ *   NEXT_PUBLIC_APP_URL             prd                (domain for the cookie)
+ *   UX_AUDIT_BOT_EMAIL              prd_scheduled
+ *   UX_AUDIT_BOT_PASSWORD           prd_scheduled
+ *   UX_AUDIT_STORAGE_STATE          (optional)         output path override
+ *
+ * Default output path: $GITHUB_WORKSPACE/tmp/ux-audit/storage-state.json
+ *                      or ./tmp/ux-audit/storage-state.json when run locally.
+ * Pattern source: apps/web-platform/e2e/global-setup.ts
+ */
+
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+
+function env(key: string): string {
+  const v = process.env[key];
+  if (!v) throw new Error(`Missing env: ${key}`);
+  return v;
+}
+
+export function projectRef(supabaseUrl: string): string {
+  const m = supabaseUrl.match(/^https:\/\/([^.]+)\.supabase\.co/);
+  if (!m) throw new Error(`Cannot derive project ref from SUPABASE_URL=${supabaseUrl}`);
+  return m[1];
+}
+
+export function cookieDomain(siteUrl: string): string {
+  const u = new URL(siteUrl);
+  return u.hostname;
+}
+
+function defaultStoragePath(): string {
+  const workspace = process.env.GITHUB_WORKSPACE ?? process.cwd();
+  return resolve(workspace, "tmp/ux-audit/storage-state.json");
+}
+
+export interface Session {
+  access_token: string;
+  refresh_token: string;
+  expires_in: number;
+  expires_at: number;
+  token_type: string;
+  user: unknown;
+}
+
+function isSession(x: unknown): x is Session {
+  if (typeof x !== "object" || x === null) return false;
+  const s = x as Record<string, unknown>;
+  return (
+    typeof s.access_token === "string" &&
+    typeof s.refresh_token === "string" &&
+    typeof s.expires_at === "number" &&
+    typeof s.token_type === "string"
+  );
+}
+
+export async function signIn(): Promise<Session> {
+  const supabaseUrl = env("SUPABASE_URL");
+  const anonKey = env("NEXT_PUBLIC_SUPABASE_ANON_KEY");
+  const email = env("UX_AUDIT_BOT_EMAIL");
+  const password = env("UX_AUDIT_BOT_PASSWORD");
+
+  const res = await fetch(`${supabaseUrl}/auth/v1/token?grant_type=password`, {
+    method: "POST",
+    headers: {
+      apikey: anonKey,
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify({ email, password }),
+  });
+
+  const body = await res.json();
+  if (!res.ok) {
+    const msg = (body as { error_description?: string; msg?: string }).error_description
+      ?? (body as { msg?: string }).msg
+      ?? `http ${res.status}`;
+    throw new Error(`signin failed: invalid credentials (${msg})`);
+  }
+  if (!isSession(body)) {
+    throw new Error(
+      `signin returned malformed session (missing access_token, refresh_token, expires_at, or token_type)`,
+    );
+  }
+  return body;
+}
+
+export function writeStorageState(
+  session: Session,
+  outPath: string,
+  supabaseUrl: string,
+  siteUrl: string,
+): void {
+  const ref = projectRef(supabaseUrl);
+  const domain = cookieDomain(siteUrl);
+  const cookieName = `sb-${ref}-auth-token`;
+
+  const storageState = {
+    cookies: [
+      {
+        name: cookieName,
+        value: JSON.stringify(session),
+        domain,
+        path: "/",
+        expires: session.expires_at,
+        httpOnly: false,
+        secure: true,
+        sameSite: "Lax" as const,
+      },
+    ],
+    origins: [],
+  };
+
+  mkdirSync(dirname(outPath), { recursive: true, mode: 0o700 });
+  writeFileSync(outPath, JSON.stringify(storageState, null, 2), { mode: 0o600 });
+  console.log(`[signin] wrote storageState to ${outPath} (cookie ${cookieName} for ${domain})`);
+}
+
+async function main() {
+  const session = await signIn();
+  const outPath = process.env.UX_AUDIT_STORAGE_STATE ?? defaultStoragePath();
+  writeStorageState(session, outPath, env("SUPABASE_URL"), env("NEXT_PUBLIC_APP_URL"));
+}
+
+if (import.meta.main) {
+  await main();
+}

package/skills/ux-audit/scripts/dedup-hash.ts

@@ -0,0 +1,46 @@
+/**
+ * dedup-hash.ts — canonical finding-hash computation.
+ *
+ * Hash format: sha256(utf8("{route}|{selector}|{category}")).
+ * Embedded in issue bodies as `<!-- ux-audit-hash: <64-hex> -->` so the skill
+ * can dedupe via a single `gh issue list --search "ux-audit-hash: <hash>"` call
+ * (TR3 in the plan).
+ */
+
+import { createHash } from "node:crypto";
+
+/**
+ * Canonical category list. Drift-guarded by `category-drift.test.ts`
+ * (see `plugins/soleur/test/ux-audit/category-drift.test.ts`). Any
+ * edit here requires updating SKILL.md §"Constants", ux-design-lead.md
+ * §"5-category rubric" + `category` field rule, and the
+ * `properties.category.enum` in
+ * `plugins/soleur/skills/ux-audit/references/finding.schema.json`.
+ */
+export const FINDING_CATEGORIES = [
+  "real-estate",
+  "ia",
+  "consistency",
+  "responsive",
+  "comprehension",
+  "anti-slop",
+] as const;
+
+export type FindingCategory = (typeof FINDING_CATEGORIES)[number];
+
+export interface Finding {
+  route: string;
+  selector: string;
+  category: FindingCategory;
+}
+
+export function computeFindingHash(f: Finding): string {
+  if (!FINDING_CATEGORIES.includes(f.category as FindingCategory)) {
+    throw new Error(
+      `invalid category "${f.category}" — expected one of: ${FINDING_CATEGORIES.join(", ")}`,
+    );
+  }
+  const selector = f.selector === "" ? "*" : f.selector;
+  const canonical = `${f.route}|${selector}|${f.category}`;
+  return createHash("sha256").update(canonical, "utf8").digest("hex");
+}