@sun-asterisk/sungen 2.7.0-beta.0 → 3.0.0-beta.71

package/src/orchestrator/templates/specs-test-data.ts

@@ -54,6 +54,15 @@ export class TestDataLoader {
     }
     return String(current);
   }
+
+  /**
+   * Set a value at runtime (used by captured-variable steps:
+   * `User remember [X] text as {{var}}`). Stored at top level so a later
+   * `{{var}}` reference resolves via get().
+   */
+  set(key: string, value: string): void {
+    this.data[key] = value;
+  }
 }
 
 function loadYamlSync(filePath: string): Record<string, any> | null {

package/src/tools/figma/figma-auth.ts

@@ -6,7 +6,9 @@
  *
  * Safeguards enforced on every save AND every assertSafeToUse call:
  *   1. .env must appear in .gitignore (abort if not).
- *   2. No tracked file may contain "FIGMA_PAT=" (git grep scan).
+ *   2. No tracked file may contain an assigned token value (FIGMA_PAT=<token>).
+ *      The scan matches a token-shaped value, not bare mentions of the key in
+ *      code or docs (those are not secrets).
  */
 
 import * as fs from 'fs';
@@ -17,6 +19,14 @@ const PAT_KEY = 'FIGMA_PAT';
 const ENV_FILE = '.env';
 const GITIGNORE_FILE = '.gitignore';
 
+// A real leak is an assigned token value (`FIGMA_PAT=<token>`), not a bare
+// mention of the key name in code or documentation. Figma PATs are long
+// (~40+ chars), so we only flag an assignment whose value looks like an actual
+// token: at least 16 non-space characters after `=` (an optional quote allowed).
+// This is an ERE pattern for `git grep -E`; it deliberately does NOT match this
+// file's own comments or template literals (`${PAT_KEY}=...`).
+const PAT_VALUE_PATTERN = `${PAT_KEY}=['"]?[^[:space:]]{16,}`;
+
 // ---------------------------------------------------------------------------
 // Internal helpers
 // ---------------------------------------------------------------------------
@@ -57,11 +67,11 @@ function isEnvIgnored(cwd: string): boolean {
 }
 
 /**
- * Run `git grep -l "FIGMA_PAT="` in cwd.
+ * Scan tracked files for an assigned Figma token value (not bare key mentions).
  * Returns list of matching tracked file paths (empty = safe).
  */
 async function findTrackedFilesWithPat(cwd: string): Promise<string[]> {
-  const result = await execFileNoThrow('git', ['grep', '-l', `${PAT_KEY}=`], cwd);
+  const result = await execFileNoThrow('git', ['grep', '-lE', PAT_VALUE_PATTERN], cwd);
   if (result.status === 0 && result.stdout.trim()) {
     return result.stdout.trim().split('\n').filter(Boolean);
   }
@@ -105,13 +115,13 @@ export async function savePat(cwd: string, token: string): Promise<void> {
     );
   }
 
-  // Safeguard 2: no tracked file may contain FIGMA_PAT=
+  // Safeguard 2: no tracked file may contain an assigned token value
   const leakedFiles = await findTrackedFilesWithPat(cwd);
   if (leakedFiles.length > 0) {
     throw new Error(
-      `Refusing to save FIGMA_PAT: token key found in tracked file(s):\n` +
+      `Refusing to save FIGMA_PAT: a token value appears in tracked file(s):\n` +
         leakedFiles.map((f) => `  ${f}`).join('\n') +
-        `\n\nRemove FIGMA_PAT from those files, commit the removal, then re-run.\n`,
+        `\n\nRemove the token from those files, commit the removal, then re-run.\n`,
     );
   }
 
@@ -145,7 +155,8 @@ export function clearPat(cwd: string): void {
 
 /**
  * Run tracked-file scan on every Figma CLI / skill invocation.
- * Aborts with actionable message if FIGMA_PAT= is found in any tracked file.
+ * Aborts with an actionable message if an assigned token value is found in any
+ * tracked file (bare mentions of the key name are ignored).
  *
  * @throws Error with remediation instructions on safeguard failure.
  */
@@ -153,9 +164,9 @@ export async function assertSafeToUse(cwd: string): Promise<void> {
   const leakedFiles = await findTrackedFilesWithPat(cwd);
   if (leakedFiles.length > 0) {
     throw new Error(
-      `Security check failed: FIGMA_PAT found in tracked file(s):\n` +
+      `Security check failed: a Figma token value appears in tracked file(s):\n` +
         leakedFiles.map((f) => `  ${f}`).join('\n') +
-        `\n\nRemove FIGMA_PAT from those files and commit the removal before using Figma commands.\n`,
+        `\n\nRemove the token from those files and commit the removal before using Figma commands.\n`,
     );
   }
 }

package/dist/orchestrator/templates/ai-instructions/claude-skill-capture-figma.md

@@ -1,142 +0,0 @@
----
-name: sungen-capture-figma
-description: 'Fetch design context + PNG from a Figma frame URL via Figma Dev Mode MCP. Auto-loaded by create-test when user picks Figma as the visual source.'
-user-invocable: false
----
-
-## Purpose
-
-Pull **structured design data** (layout, typography, colors, component tree, design tokens) and a **PNG screenshot** from a Figma frame URL, so `sungen-tc-generation` can author Gherkin + test-data before a live domain exists.
-
-Use this when the project is pre-launch, or when Figma is the source of truth and the live build lags the design.
-
----
-
-## Prerequisites
-
-- **Figma MCP server** (`https://mcp.figma.com/mcp`, HTTP transport) connected in the user's `.mcp.json` — `sungen init` scaffolds this automatically. On first use, Claude Code opens a browser for Figma OAuth. Official tools: `get_design_context`, `get_variable_defs`, `get_screenshot`.
-- Figma account signed in with access to the file. **Dev/Full seats** get per-minute rate limits; **Starter/View seats** get monthly tool-call limits.
-- A Figma URL with both **fileKey** and **nodeId** in it.
-
-If the MCP is not connected, **do not fail silently** — tell the user:
-> "Figma MCP not detected. Run `sungen init` to scaffold the config, or manually add `figma` with `url: https://mcp.figma.com/mcp` to `.mcp.json`. Then sign in when Claude Code prompts."
-
-Then stop.
-
----
-
-## Steps
-
-### 1. Resolve Figma URL
-
-Prefer in this order:
-
-1. `Figma URL` field in `qa/screens/<screen>/requirements/spec.md` (Overview section)
-2. If empty or missing → `AskUserQuestion`: *"Paste the Figma frame URL"* (free text)
-
-Accept any of these URL shapes:
-
-```
-https://www.figma.com/file/<fileKey>/<title>?node-id=<nodeId>
-https://www.figma.com/design/<fileKey>/<title>?node-id=<nodeId>
-https://www.figma.com/proto/<fileKey>/<title>?node-id=<nodeId>
-```
-
-Parse:
-- `fileKey` = the segment after `/file/`, `/design/`, or `/proto/`
-- `nodeId` = the `node-id` query param (may use `-` or `:` — pass through as-is; MCP accepts both)
-
-If `node-id` is missing, ask the user to select a frame in Figma and copy the **frame URL** specifically (not the file root URL).
-
-### 2. Fetch design context
-
-Call **both** in parallel:
-
-```
-get_design_context({ fileKey, nodeId })
-get_variable_defs({ fileKey, nodeId })
-```
-
-`get_design_context` returns layout, typography, color values, component structure, spacing.
-`get_variable_defs` returns named design tokens (color/spacing/typography variables).
-
-### 3. Fetch screenshot
-
-```
-get_screenshot({ fileKey, nodeId })
-```
-
-Save the returned PNG to:
-
-```
-qa/screens/<screen>/requirements/ui/figma-<sanitized-nodeId>.png
-```
-
-Sanitize `nodeId` for filesystem: replace `:` and `-` with `_`. Example: `42-15` → `figma-42_15.png`.
-
-### 4. Write metadata dump
-
-Combine the design context + variables into a Markdown summary at:
-
-```
-qa/screens/<screen>/requirements/ui/figma-meta.md
-```
-
-Format:
-
-```markdown
-# Figma Capture — <nodeId>
-
-**Source:** <full Figma URL>
-**Captured:** <ISO date>
-
-## Components
-<hierarchical list of component names + variants from get_design_context>
-
-## Typography
-<font families, sizes, weights, line heights>
-
-## Colors
-<color tokens + raw hex values>
-
-## Spacing & Layout
-<spacing tokens, auto-layout specs>
-
-## Text Content
-<visible text strings from the frame — used by tc-generation to populate test-data>
-```
-
-This file is consumed by `sungen-tc-generation` as a secondary source alongside `spec.md`.
-
-### 5. Report back
-
-Output a short summary to the user:
-
-> Captured Figma frame `<nodeId>`:
-> - Components: N
-> - Text strings: M
-> - Design tokens: K
-> - Screenshot: `qa/screens/<screen>/requirements/ui/figma-<nodeId>.png`
-> - Metadata: `requirements/ui/figma-meta.md`
-
-Then hand back to the calling command.
-
----
-
-## Error handling
-
-| Error | Action |
-|---|---|
-| MCP tool not available | Print setup instructions, stop, do not fall back silently |
-| `fileKey` missing from URL | Ask user to paste a valid frame URL |
-| `nodeId` missing from URL | Ask user to right-click a frame in Figma → *Copy link to selection* |
-| `get_design_context` 403 | Ask user to check Dev Mode seat on that file |
-| `get_screenshot` returns no image | Continue with metadata only; warn user no PNG was captured |
-
----
-
-## What this skill does NOT do
-
-- Does not generate Gherkin (that's `sungen-tc-generation`)
-- Does not write `selectors.yaml` (that's `/sungen:run-test`)
-- Does not validate the design against live UI (future skill: `sungen-capture-live` can be run afterwards for cross-check)

package/dist/orchestrator/templates/ai-instructions/claude-skill-capture-live.md

@@ -1,112 +0,0 @@
----
-name: sungen-capture-live
-description: 'Capture a live running page via Playwright MCP — snapshot + screenshot for visual context. Auto-loaded by create-test when user picks Live page scan.'
-user-invocable: false
----
-
-## Purpose
-
-Navigate a running application, take **one accessibility snapshot** and **one screenshot**, and save them as visual context for test generation. Use when the app is live (dev, staging, or production with read-only access) and you want the tests grounded in the actual rendered UI.
-
-This skill handles auth gracefully: if the page redirects to login, it asks the user to sign in manually rather than injecting cookies.
-
----
-
-## Prerequisites
-
-- Playwright MCP connected.
-- Dev/staging server reachable (or a public URL).
-- `playwright.config.ts` exists at the project root (for `baseURL` fallback).
-
----
-
-## Steps
-
-### 1. Resolve target URL
-
-Resolve in this order:
-
-1. `Live URL` field in `qa/screens/<screen>/requirements/spec.md` (Overview section)
-2. `baseURL` from `playwright.config.ts` + `URL Path` from `spec.md`
-3. If neither works → `AskUserQuestion`: *"Paste the full URL for the page to scan"*
-
-### 2. Navigate
-
-`browser_navigate` to the resolved URL.
-
-### 3. Handle auth redirect
-
-If the page redirects to a login route (URL contains `/login`, `/signin`, `/auth`, or the page title/content indicates a login screen):
-
-1. Tell the user which login URL they landed on.
-2. `AskUserQuestion`:
-   - **I'll log in manually** — wait for user confirmation, then re-navigate to the target URL
-   - **Skip live scan** — tell caller to invoke `sungen-capture-local` instead
-   - **Cancel**
-3. **Never** inject cookies or localStorage via `browser_evaluate` or `browser_run_code`. Auth belongs to the user.
-
-### 4. Snapshot
-
-Take **ONE** `browser_snapshot`. This accessibility tree is the primary AI context — it contains roles, names, text, and structure that the tc-generation skill uses to identify sections and fields.
-
-### 5. Screenshot (optional but recommended)
-
-Take **ONE** `browser_take_screenshot` with `fullPage: true`. Save to:
-
-```
-qa/screens/<screen>/requirements/ui/live-<timestamp>.png
-```
-
-Where `<timestamp>` is `YYYYMMDD-HHMM` in local time (e.g. `live-20260421-1430.png`).
-
-This gives users a visual record they can reference later without re-scanning.
-
-### 6a. Verify unauthenticated redirect target (flow capture only)
-
-When capturing for a **flow** that includes security scenarios (e.g., "unauthenticated user cannot access X"):
-
-1. Open a **fresh incognito/unauthenticated** browser context (no storage state).
-2. `browser_navigate` to the protected route (e.g., `/dashboard`).
-3. Record the **actual redirect URL** — do NOT assume it goes to `/login`. The app may redirect to `/register`, `/`, or any other route.
-4. Report the redirect target to the caller: *"Unauthenticated access to `/dashboard` redirects to `/register`"*.
-5. The caller must use the **actual redirect URL** in Gherkin assertions (e.g., `Then User is on [Register] page`), never an assumed one.
-
-Skip this step if the flow has no security scenarios or the user explicitly says to skip.
-
-### 6. Detect discrepancies vs spec
-
-If `spec.md` exists, briefly cross-check the snapshot against spec sections:
-
-- Fields listed in spec but not in snapshot → flag as *missing in UI*
-- Elements visible in snapshot but not in spec → flag as *missing in spec*
-
-Report findings but **do not** auto-edit `spec.md` — let the user decide.
-
-### 7. Report back
-
-> Captured live page `<URL>`:
-> - Snapshot: <N> interactive elements detected
-> - Screenshot: `requirements/ui/live-<timestamp>.png`
-> - Discrepancies vs spec: <count, or "none">
-
-Hand back to the calling command.
-
----
-
-## What this skill does NOT do
-
-- Does not run tests
-- Does not generate `selectors.yaml` (that's `/sungen:run-test`)
-- Does not inject auth state (user logs in manually)
-- Does not crawl — scans **exactly one** page per invocation
-- Does not generate Gherkin — that's `sungen-tc-generation`
-
----
-
-## Relationship to other capture skills
-
-- `sungen-capture-figma` — design source of truth (pre-launch)
-- `sungen-capture-local` — any image the user dropped in `requirements/ui/`
-- `sungen-capture-live` — this skill, verifies/supplements against the running app
-
-All three write to `requirements/ui/` and report back to the caller. They are mutually exclusive per create-test run, but a user can run create-test multiple times with different sources to layer context.

package/dist/orchestrator/templates/ai-instructions/claude-skill-capture-local.md

@@ -1,73 +0,0 @@
----
-name: sungen-capture-local
-description: 'Load existing UI assets (screenshots, Figma exports, hand-drawn mockups) from requirements/ui/. Auto-loaded by create-test when user picks UI images as the visual source.'
-user-invocable: false
----
-
-## Purpose
-
-Use **pre-existing images** in `qa/screens/<screen>/requirements/ui/` as visual context for test generation. No network, no MCP, no live site required — works for any design tool (Figma export, Sketch, Penpot, Zeplin, hand-drawn, screenshots of a staging env).
-
-This is the **baseline fallback**: if live domain is down and Figma MCP isn't configured, this always works as long as the user drops images in the folder.
-
----
-
-## Steps
-
-### 1. List available images
-
-Glob `qa/screens/<screen>/requirements/ui/*.{png,jpg,jpeg,webp,gif}` and report count + filenames.
-
-Filter out metadata files (e.g. `figma-meta.md` written by `sungen-capture-figma`) — those are read by `tc-generation` separately, not treated as images here.
-
-### 2. Handle empty folder
-
-If no images found:
-
-1. Tell the user the folder is empty, with the full path so they can navigate there in Finder.
-2. `AskUserQuestion`:
-   - **I'll drop images now** — wait for user to confirm, then re-glob
-   - **Switch to Figma URL** — tell caller to invoke `sungen-capture-figma` instead
-   - **Switch to live page scan** — tell caller to invoke `sungen-capture-live` instead
-   - **Cancel** — abort create-test
-3. If user picks "drop images now", wait for their confirmation message (e.g. "done") then re-run step 1.
-
-### 3. Read images for context
-
-Use the `Read` tool on each image file — Claude Code can read PNG/JPG/WebP directly as visual context.
-
-For large sets (>10 images), ask the user which are primary and which are states/variants, to avoid loading too much visual context at once.
-
-### 4. Summarize
-
-Output a short summary:
-
-> Loaded N image(s) from `qa/screens/<screen>/requirements/ui/`:
-> - `<filename-1>` — <one-line description of what's visible>
-> - `<filename-2>` — <one-line description>
-> ...
-
-Hand back to the calling command.
-
----
-
-## File naming hints for users
-
-When this skill reports back, nudge users toward consistent filenames so future runs are self-documenting:
-
-- `<section>-default.png` — baseline state of a section
-- `<section>-error.png` — error state
-- `<section>-loading.png` — loading state
-- `<section>-empty.png` — empty state
-- `full-page.png` / `viewport.png` — whole screen (auto-generated by `sungen add --capture`)
-
-Don't enforce — just suggest if filenames are ambiguous.
-
----
-
-## What this skill does NOT do
-
-- Does not download images from external URLs
-- Does not generate images (no AI image generation)
-- Does not modify existing images (no crop/resize)
-- Does not generate Gherkin — that's `sungen-tc-generation`

package/dist/orchestrator/templates/ai-instructions/github-skill-sungen-capture-figma.md

@@ -1,142 +0,0 @@
----
-name: sungen-capture-figma
-description: 'Fetch design context + PNG from a Figma frame URL via Figma Dev Mode MCP. Auto-loaded by create-test when user picks Figma as the visual source.'
-user-invocable: false
----
-
-## Purpose
-
-Pull **structured design data** (layout, typography, colors, component tree, design tokens) and a **PNG screenshot** from a Figma frame URL, so `sungen-tc-generation` can author Gherkin + test-data before a live domain exists.
-
-Use this when the project is pre-launch, or when Figma is the source of truth and the live build lags the design.
-
----
-
-## Prerequisites
-
-- **Figma MCP server** (`https://mcp.figma.com/mcp`, HTTP transport) connected in `.vscode/mcp.json` — `sungen init` scaffolds this automatically. On first use, VS Code / Copilot opens a browser for Figma OAuth. Official tools: `get_design_context`, `get_variable_defs`, `get_screenshot`.
-- Figma account signed in with access to the file. **Dev/Full seats** get per-minute rate limits; **Starter/View seats** get monthly tool-call limits.
-- A Figma URL with both **fileKey** and **nodeId** in it.
-
-If the MCP is not connected, **do not fail silently** — tell the user:
-> "Figma MCP not detected. Run `sungen init` to scaffold the config, or manually add `figma` with `url: https://mcp.figma.com/mcp` to `.vscode/mcp.json`. Then sign in when VS Code prompts."
-
-Then stop.
-
----
-
-## Steps
-
-### 1. Resolve Figma URL
-
-Prefer in this order:
-
-1. `Figma URL` field in `qa/screens/<screen>/requirements/spec.md` (Overview section)
-2. If empty or missing → ask the user: *"Paste the Figma frame URL"*
-
-Accept any of these URL shapes:
-
-```
-https://www.figma.com/file/<fileKey>/<title>?node-id=<nodeId>
-https://www.figma.com/design/<fileKey>/<title>?node-id=<nodeId>
-https://www.figma.com/proto/<fileKey>/<title>?node-id=<nodeId>
-```
-
-Parse:
-- `fileKey` = the segment after `/file/`, `/design/`, or `/proto/`
-- `nodeId` = the `node-id` query param (may use `-` or `:` — pass through as-is; MCP accepts both)
-
-If `node-id` is missing, ask the user to select a frame in Figma and copy the **frame URL** specifically (not the file root URL).
-
-### 2. Fetch design context
-
-Call **both** in parallel:
-
-```
-get_design_context({ fileKey, nodeId })
-get_variable_defs({ fileKey, nodeId })
-```
-
-`get_design_context` returns layout, typography, color values, component structure, spacing.
-`get_variable_defs` returns named design tokens (color/spacing/typography variables).
-
-### 3. Fetch screenshot
-
-```
-get_screenshot({ fileKey, nodeId })
-```
-
-Save the returned PNG to:
-
-```
-qa/screens/<screen>/requirements/ui/figma-<sanitized-nodeId>.png
-```
-
-Sanitize `nodeId` for filesystem: replace `:` and `-` with `_`. Example: `42-15` → `figma-42_15.png`.
-
-### 4. Write metadata dump
-
-Combine the design context + variables into a Markdown summary at:
-
-```
-qa/screens/<screen>/requirements/ui/figma-meta.md
-```
-
-Format:
-
-```markdown
-# Figma Capture — <nodeId>
-
-**Source:** <full Figma URL>
-**Captured:** <ISO date>
-
-## Components
-<hierarchical list of component names + variants from get_design_context>
-
-## Typography
-<font families, sizes, weights, line heights>
-
-## Colors
-<color tokens + raw hex values>
-
-## Spacing & Layout
-<spacing tokens, auto-layout specs>
-
-## Text Content
-<visible text strings from the frame — used by tc-generation to populate test-data>
-```
-
-This file is consumed by `sungen-tc-generation` as a secondary source alongside `spec.md`.
-
-### 5. Report back
-
-Output a short summary to the user:
-
-> Captured Figma frame `<nodeId>`:
-> - Components: N
-> - Text strings: M
-> - Design tokens: K
-> - Screenshot: `qa/screens/<screen>/requirements/ui/figma-<nodeId>.png`
-> - Metadata: `requirements/ui/figma-meta.md`
-
-Then hand back to the calling command.
-
----
-
-## Error handling
-
-| Error | Action |
-|---|---|
-| MCP tool not available | Print setup instructions, stop, do not fall back silently |
-| `fileKey` missing from URL | Ask user to paste a valid frame URL |
-| `nodeId` missing from URL | Ask user to right-click a frame in Figma → *Copy link to selection* |
-| `get_design_context` 403 | Ask user to check Dev Mode seat on that file |
-| `get_screenshot` returns no image | Continue with metadata only; warn user no PNG was captured |
-
----
-
-## What this skill does NOT do
-
-- Does not generate Gherkin (that's `sungen-tc-generation`)
-- Does not write `selectors.yaml` (that's `/sungen-run-test`)
-- Does not validate the design against live UI (future skill: `sungen-capture-live` can be run afterwards for cross-check)

package/dist/orchestrator/templates/ai-instructions/github-skill-sungen-capture-live.md

@@ -1,112 +0,0 @@
----
-name: sungen-capture-live
-description: 'Capture a live running page via Playwright MCP — snapshot + screenshot for visual context. Auto-loaded by create-test when user picks Live page scan.'
-user-invocable: false
----
-
-## Purpose
-
-Navigate a running application, take **one accessibility snapshot** and **one screenshot**, and save them as visual context for test generation. Use when the app is live (dev, staging, or production with read-only access) and you want the tests grounded in the actual rendered UI.
-
-This skill handles auth gracefully: if the page redirects to login, it asks the user to sign in manually rather than injecting cookies.
-
----
-
-## Prerequisites
-
-- Playwright MCP connected.
-- Dev/staging server reachable (or a public URL).
-- `playwright.config.ts` exists at the project root (for `baseURL` fallback).
-
----
-
-## Steps
-
-### 1. Resolve target URL
-
-Resolve in this order:
-
-1. `Live URL` field in `qa/screens/<screen>/requirements/spec.md` (Overview section)
-2. `baseURL` from `playwright.config.ts` + `URL Path` from `spec.md`
-3. If neither works → ask the user: *"Paste the full URL for the page to scan"*
-
-### 2. Navigate
-
-`browser_navigate` to the resolved URL.
-
-### 3. Handle auth redirect
-
-If the page redirects to a login route (URL contains `/login`, `/signin`, `/auth`, or the page title/content indicates a login screen):
-
-1. Tell the user which login URL they landed on.
-2. Ask the user:
-   - **1) I'll log in manually** — wait for user confirmation, then re-navigate to the target URL
-   - **2) Skip live scan** — tell caller to invoke `sungen-capture-local` instead
-   - **3) Cancel**
-3. **Never** inject cookies or localStorage via `browser_evaluate` or `browser_run_code`. Auth belongs to the user.
-
-### 4. Snapshot
-
-Take **ONE** `browser_snapshot`. This accessibility tree is the primary AI context — it contains roles, names, text, and structure that the tc-generation skill uses to identify sections and fields.
-
-### 5. Screenshot (optional but recommended)
-
-Take **ONE** `browser_take_screenshot` with `fullPage: true`. Save to:
-
-```
-qa/screens/<screen>/requirements/ui/live-<timestamp>.png
-```
-
-Where `<timestamp>` is `YYYYMMDD-HHMM` in local time (e.g. `live-20260421-1430.png`).
-
-This gives users a visual record they can reference later without re-scanning.
-
-### 6a. Verify unauthenticated redirect target (flow capture only)
-
-When capturing for a **flow** that includes security scenarios (e.g., "unauthenticated user cannot access X"):
-
-1. Open a **fresh incognito/unauthenticated** browser context (no storage state).
-2. `browser_navigate` to the protected route (e.g., `/dashboard`).
-3. Record the **actual redirect URL** — do NOT assume it goes to `/login`. The app may redirect to `/register`, `/`, or any other route.
-4. Report the redirect target to the caller: *"Unauthenticated access to `/dashboard` redirects to `/register`"*.
-5. The caller must use the **actual redirect URL** in Gherkin assertions (e.g., `Then User is on [Register] page`), never an assumed one.
-
-Skip this step if the flow has no security scenarios or the user explicitly says to skip.
-
-### 6. Detect discrepancies vs spec
-
-If `spec.md` exists, briefly cross-check the snapshot against spec sections:
-
-- Fields listed in spec but not in snapshot → flag as *missing in UI*
-- Elements visible in snapshot but not in spec → flag as *missing in spec*
-
-Report findings but **do not** auto-edit `spec.md` — let the user decide.
-
-### 7. Report back
-
-> Captured live page `<URL>`:
-> - Snapshot: <N> interactive elements detected
-> - Screenshot: `requirements/ui/live-<timestamp>.png`
-> - Discrepancies vs spec: <count, or "none">
-
-Hand back to the calling command.
-
----
-
-## What this skill does NOT do
-
-- Does not run tests
-- Does not generate `selectors.yaml` (that's `/sungen-run-test`)
-- Does not inject auth state (user logs in manually)
-- Does not crawl — scans **exactly one** page per invocation
-- Does not generate Gherkin — that's `sungen-tc-generation`
-
----
-
-## Relationship to other capture skills
-
-- `sungen-capture-figma` — design source of truth (pre-launch)
-- `sungen-capture-local` — any image the user dropped in `requirements/ui/`
-- `sungen-capture-live` — this skill, verifies/supplements against the running app
-
-All three write to `requirements/ui/` and report back to the caller. They are mutually exclusive per create-test run, but a user can run create-test multiple times with different sources to layer context.