@validate.qa/runner 1.0.18 → 1.0.19

package/dist/cli.js

@@ -62040,7 +62040,7 @@ var require_mobile_explorer = __commonJS({
       }
       sections.push("");
       if (mode === "survey") {
-        sections.push("**Mission:** Map every reachable screen. For each new screen: mobile_snapshot -> capture_screen -> record_transition. Do NOT submit forms or mutate data. Call finish_exploration when no new screens remain.");
+        sections.push(`**Mission:** Map every reachable screen. For each new screen: mobile_snapshot -> capture_screen -> record_transition. Get PAST the entry gate into the app's real main content \u2014 the login/landing screens are the ENTRANCE, not the app. If test credentials are provided (see the Test Credentials section), SIGN IN with them FIRST and map the authenticated app; that is the real product surface. Use a guest/demo/skip entry (e.g. "See Demo Profile", "Continue as guest") ONLY as a fallback when no credentials are available or login cannot be completed \u2014 demo mode is a limited sandbox, not the authenticated app. Do NOT submit forms with junk data or mutate real data. Call finish_exploration ONLY when every reachable screen \u2014 including the authenticated content \u2014 has been captured and no unvisited frontier screens remain.`);
       } else {
         sections.push("**Mission:** Use the focus features like a real user. Tap, type, submit, and observe outcomes. After a meaningful flow, call record_journey. Call finish_exploration when the flows are covered.");
       }
@@ -62098,7 +62098,14 @@ var require_mobile_explorer = __commonJS({
 This app has stored login credentials under these keys:
 ${keyList}
 
-When you reach a login / sign-in screen, LOG IN so you can map and test the authenticated app \u2014 this OVERRIDES the "do not submit forms" rule for the login form ONLY. Fill each credential field with \`mobile_fill_credential\`: pass the field ref and the KEY (e.g. \`{ ref: "e5", credentialKey: "TEST_USER_EMAIL" }\`). The runner substitutes the real value on the device; you never see, log, or echo it.
+LOG IN FIRST \u2014 before broad exploration. The authenticated app is the real product surface; a survey that only maps the logged-out/demo screens has missed most of the app. This OVERRIDES the "do not submit forms" rule for the login form ONLY. The login sequence is:
+1. Reach the email/password sign-in form (tap "Sign in with Email" / "Login" from the landing screen if needed).
+2. Fill the email field: \`mobile_fill_credential({ ref, credentialKey: "TEST_USER_EMAIL" })\`. Fill the password field: \`mobile_fill_credential({ ref, credentialKey: "TEST_USER_PASSWORD" })\`. The runner substitutes the real value on the device; you never see, log, or echo it.
+3. TAP THE SUBMIT BUTTON (e.g. "Sign In", "Log In", "Continue"). Filling the fields does NOT log you in \u2014 you MUST tap submit.
+4. VERIFY you are actually signed in: re-snapshot and confirm an authenticated signal appeared (a home/feed/dashboard with real content, an account/profile tab, a "Sign out" option, or your user identity). If you are still on the login form, the login failed \u2014 check for an error, re-enter, and submit again (up to 2 attempts).
+5. Only AFTER you have confirmed you are signed in, map the authenticated app.
+
+PREFER real login over any "demo"/"guest"/"skip" entry: those give a limited sandbox, NOT the authenticated app. Use them only if login is impossible.
 
 SECURITY RULES:
 - NEVER call \`mobile_type\` with an email, password, or token value \u2014 the runner will REJECT the call and you lose an iteration. Use \`mobile_fill_credential\` for every credential field.
@@ -62405,6 +62412,8 @@ ${existingScreens.slice(0, 100).map((s) => `- ${s.screenId}${s.name ? ` "${s.nam
       let summary = "";
       let truncated = false;
       let truncatedReason;
+      let finishRedirects = 0;
+      const MAX_FINISH_REDIRECTS = 2;
       try {
         try {
           const seed = await driver.snapshot();
@@ -62534,6 +62543,20 @@ ${statePacket}` }
               continue;
             }
             if (toolName === "finish_exploration") {
+              const frontier = mode === "survey" ? state2.getFrontier() : [];
+              const budgetRemainingPct = (maxIterations - iteration) / maxIterations;
+              if (frontier.length > 0 && budgetRemainingPct >= 0.2 && finishRedirects < MAX_FINISH_REDIRECTS) {
+                finishRedirects++;
+                const targets = frontier.slice(0, 6).join(", ");
+                log2(`
+finish_exploration bounced (${finishRedirects}/${MAX_FINISH_REDIRECTS}): ${frontier.length} frontier screen(s) still unvisited, ${Math.round(budgetRemainingPct * 100)}% budget left.`);
+                pushResult({
+                  acknowledged: false,
+                  keepExploring: true,
+                  reason: `Not done yet \u2014 ${frontier.length} screen(s) were seen via transitions but never visited, and ${Math.round(budgetRemainingPct * 100)}% of the iteration budget remains. A survey must map EVERY reachable screen. Navigate into the unvisited screens (e.g. ${targets}), snapshot + capture_screen each, then call finish_exploration only once no unvisited screens remain. If a screen is genuinely unreachable (needs credentials you don't have, or leaves the app), note that and move to the next one.`
+                });
+                continue;
+              }
               explorationComplete = true;
               summary = String(toolArgs.summary ?? "");
               log2(`
@@ -62752,6 +62775,14 @@ Exploration complete: ${summary}`);
             ...actionResult.error ? { error: actionResult.error } : {},
             // Report only the KEY that was filled — never the value.
             filledCredentialKey: key,
+            // Code-level reinforcement of the login sequence: filling a field does
+            // NOT submit the form. The observed failure was fill-without-submit —
+            // the model filled email+password then wandered off (into demo content)
+            // without ever tapping Sign In, so it never reached the authenticated
+            // app. This nudge fires on every credential fill so the model is
+            // reminded to complete + verify the login rather than treating the fill
+            // as "logged in".
+            nextStep: "Credential filled \u2014 this does NOT log you in. Once all credential fields are filled, tap the submit button (Sign In / Log In / Continue), then re-snapshot and confirm an authenticated screen (home/feed/account/Sign out) appeared before exploring further.",
             screenId,
             observation,
             ...absorbed.externalBlocked ? { blockedExternalApp: true, externalApp: absorbed.externalOwner } : {},
@@ -328429,7 +328460,7 @@ var require_package4 = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.18",
+      version: "1.0.19",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"

package/dist/cli.mjs

@@ -62045,7 +62045,7 @@ var require_mobile_explorer = __commonJS({
       }
       sections.push("");
       if (mode === "survey") {
-        sections.push("**Mission:** Map every reachable screen. For each new screen: mobile_snapshot -> capture_screen -> record_transition. Do NOT submit forms or mutate data. Call finish_exploration when no new screens remain.");
+        sections.push(`**Mission:** Map every reachable screen. For each new screen: mobile_snapshot -> capture_screen -> record_transition. Get PAST the entry gate into the app's real main content \u2014 the login/landing screens are the ENTRANCE, not the app. If test credentials are provided (see the Test Credentials section), SIGN IN with them FIRST and map the authenticated app; that is the real product surface. Use a guest/demo/skip entry (e.g. "See Demo Profile", "Continue as guest") ONLY as a fallback when no credentials are available or login cannot be completed \u2014 demo mode is a limited sandbox, not the authenticated app. Do NOT submit forms with junk data or mutate real data. Call finish_exploration ONLY when every reachable screen \u2014 including the authenticated content \u2014 has been captured and no unvisited frontier screens remain.`);
       } else {
         sections.push("**Mission:** Use the focus features like a real user. Tap, type, submit, and observe outcomes. After a meaningful flow, call record_journey. Call finish_exploration when the flows are covered.");
       }
@@ -62103,7 +62103,14 @@ var require_mobile_explorer = __commonJS({
 This app has stored login credentials under these keys:
 ${keyList}
 
-When you reach a login / sign-in screen, LOG IN so you can map and test the authenticated app \u2014 this OVERRIDES the "do not submit forms" rule for the login form ONLY. Fill each credential field with \`mobile_fill_credential\`: pass the field ref and the KEY (e.g. \`{ ref: "e5", credentialKey: "TEST_USER_EMAIL" }\`). The runner substitutes the real value on the device; you never see, log, or echo it.
+LOG IN FIRST \u2014 before broad exploration. The authenticated app is the real product surface; a survey that only maps the logged-out/demo screens has missed most of the app. This OVERRIDES the "do not submit forms" rule for the login form ONLY. The login sequence is:
+1. Reach the email/password sign-in form (tap "Sign in with Email" / "Login" from the landing screen if needed).
+2. Fill the email field: \`mobile_fill_credential({ ref, credentialKey: "TEST_USER_EMAIL" })\`. Fill the password field: \`mobile_fill_credential({ ref, credentialKey: "TEST_USER_PASSWORD" })\`. The runner substitutes the real value on the device; you never see, log, or echo it.
+3. TAP THE SUBMIT BUTTON (e.g. "Sign In", "Log In", "Continue"). Filling the fields does NOT log you in \u2014 you MUST tap submit.
+4. VERIFY you are actually signed in: re-snapshot and confirm an authenticated signal appeared (a home/feed/dashboard with real content, an account/profile tab, a "Sign out" option, or your user identity). If you are still on the login form, the login failed \u2014 check for an error, re-enter, and submit again (up to 2 attempts).
+5. Only AFTER you have confirmed you are signed in, map the authenticated app.
+
+PREFER real login over any "demo"/"guest"/"skip" entry: those give a limited sandbox, NOT the authenticated app. Use them only if login is impossible.
 
 SECURITY RULES:
 - NEVER call \`mobile_type\` with an email, password, or token value \u2014 the runner will REJECT the call and you lose an iteration. Use \`mobile_fill_credential\` for every credential field.
@@ -62410,6 +62417,8 @@ ${existingScreens.slice(0, 100).map((s) => `- ${s.screenId}${s.name ? ` "${s.nam
       let summary = "";
       let truncated = false;
       let truncatedReason;
+      let finishRedirects = 0;
+      const MAX_FINISH_REDIRECTS = 2;
       try {
         try {
           const seed = await driver.snapshot();
@@ -62539,6 +62548,20 @@ ${statePacket}` }
               continue;
             }
             if (toolName === "finish_exploration") {
+              const frontier = mode === "survey" ? state2.getFrontier() : [];
+              const budgetRemainingPct = (maxIterations - iteration) / maxIterations;
+              if (frontier.length > 0 && budgetRemainingPct >= 0.2 && finishRedirects < MAX_FINISH_REDIRECTS) {
+                finishRedirects++;
+                const targets = frontier.slice(0, 6).join(", ");
+                log2(`
+finish_exploration bounced (${finishRedirects}/${MAX_FINISH_REDIRECTS}): ${frontier.length} frontier screen(s) still unvisited, ${Math.round(budgetRemainingPct * 100)}% budget left.`);
+                pushResult({
+                  acknowledged: false,
+                  keepExploring: true,
+                  reason: `Not done yet \u2014 ${frontier.length} screen(s) were seen via transitions but never visited, and ${Math.round(budgetRemainingPct * 100)}% of the iteration budget remains. A survey must map EVERY reachable screen. Navigate into the unvisited screens (e.g. ${targets}), snapshot + capture_screen each, then call finish_exploration only once no unvisited screens remain. If a screen is genuinely unreachable (needs credentials you don't have, or leaves the app), note that and move to the next one.`
+                });
+                continue;
+              }
               explorationComplete = true;
               summary = String(toolArgs.summary ?? "");
               log2(`
@@ -62757,6 +62780,14 @@ Exploration complete: ${summary}`);
             ...actionResult.error ? { error: actionResult.error } : {},
             // Report only the KEY that was filled — never the value.
             filledCredentialKey: key,
+            // Code-level reinforcement of the login sequence: filling a field does
+            // NOT submit the form. The observed failure was fill-without-submit —
+            // the model filled email+password then wandered off (into demo content)
+            // without ever tapping Sign In, so it never reached the authenticated
+            // app. This nudge fires on every credential fill so the model is
+            // reminded to complete + verify the login rather than treating the fill
+            // as "logged in".
+            nextStep: "Credential filled \u2014 this does NOT log you in. Once all credential fields are filled, tap the submit button (Sign In / Log In / Continue), then re-snapshot and confirm an authenticated screen (home/feed/account/Sign out) appeared before exploring further.",
             screenId,
             observation,
             ...absorbed.externalBlocked ? { blockedExternalApp: true, externalApp: absorbed.externalOwner } : {},
@@ -328434,7 +328465,7 @@ var require_package4 = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.18",
+      version: "1.0.19",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@validate.qa/runner",
-  "version": "1.0.18",
+  "version": "1.0.19",
   "description": "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
   "bin": {
     "validate-runner": "dist/cli.js"