@velaro/cli 1.4.53 → 1.4.55

package/lib/kb-screenshot.js

@@ -31,8 +31,10 @@ const execFileAsync = promisify(execFile);
 const REPO_ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', '..');
 
 const APP_URLS = {
-  admin:     process.env.ADMIN_UI_URL || 'https://admin-staging.velaro.com',
-  messaging: process.env.MSG_UI_URL   || 'https://messaging-staging.velaro.com',
+  admin:       process.env.ADMIN_UI_URL       || 'https://admin-staging.velaro.com',
+  messaging:   process.env.MSG_UI_URL         || 'https://messaging-staging.velaro.com',
+  // v10 (livefluence). Console-staging, never prod -- same "staging only" rule as admin/messaging.
+  livefluence: process.env.LIVEFLUENCE_UI_URL || 'https://console-staging.velaro.com',
 };
 
 // Key Vault fallback for credentials — used only when neither E2E_USER_* nor TEST_USER_*
@@ -41,6 +43,14 @@ const KV_NAME          = process.env.KB_SCREENSHOT_KV_NAME          || 'velaro-e
 const KV_EMAIL_SECRET  = process.env.KB_SCREENSHOT_KV_EMAIL_SECRET  || 'claude-test-agent-staging1032-email';
 const KV_PASSWORD_SECRET = process.env.KB_SCREENSHOT_KV_PASSWORD_SECRET || 'claude-test-agent-staging1032-password';
 
+// v10 (livefluence) console-staging uses a DIFFERENT test account than admin/messaging's
+// default above -- confirmed live 2026-09-18 (memory: project_test_agent_reset_and_transfer_test_gaps_2026-09-15).
+// Never silently reuse the admin/messaging KV secret names for v10; they resolve to a
+// different account that has no guarantee of being provisioned on site 1032's v10 side.
+const LIVEFLUENCE_KV_NAME            = process.env.LIVEFLUENCE_KB_SCREENSHOT_KV_NAME            || 'velaro-eastus-stg-kv';
+const LIVEFLUENCE_KV_USERNAME_SECRET = process.env.LIVEFLUENCE_KB_SCREENSHOT_KV_USERNAME_SECRET || 'claude-test-agent-staging1032-username';
+const LIVEFLUENCE_KV_PASSWORD_SECRET = process.env.LIVEFLUENCE_KB_SCREENSHOT_KV_PASSWORD_SECRET || 'claude-test-agent-staging1032-password';
+
 /**
  * Pulls the email/password pair from Azure Key Vault via DefaultAzureCredential.
  * Locally this picks up the operator's own `az login` session automatically — no
@@ -49,16 +59,16 @@ const KV_PASSWORD_SECRET = process.env.KB_SCREENSHOT_KV_PASSWORD_SECRET || 'clau
  * identity) to authenticate — out of scope here since this CLI command is
  * operator-run today, not a CI step.
  */
-async function loadCredentialsFromKeyVault() {
+async function loadCredentialsFromKeyVault(vaultName, emailSecretName, passwordSecretName) {
   const { SecretClient } = await import('@azure/keyvault-secrets');
   const { DefaultAzureCredential } = await import('@azure/identity');
 
-  const vaultUrl = `https://${KV_NAME}.vault.azure.net`;
+  const vaultUrl = `https://${vaultName}.vault.azure.net`;
   const client = new SecretClient(vaultUrl, new DefaultAzureCredential());
 
   const [emailSecret, passwordSecret] = await Promise.all([
-    client.getSecret(KV_EMAIL_SECRET),
-    client.getSecret(KV_PASSWORD_SECRET),
+    client.getSecret(emailSecretName),
+    client.getSecret(passwordSecretName),
   ]);
 
   return { email: emailSecret.value, password: passwordSecret.value };
@@ -78,15 +88,34 @@ async function loadPlaywright() {
 
 /**
  * Logs into the given app on staging using the same form-fill steps as
- * e2e/tests/auth.setup.ts, navigates to `route`, and screenshots to `outputPath`.
+ * e2e/tests/auth.setup.ts, navigates to `route`, optionally clicks a selector,
+ * and screenshots to `outputPath`.
+ *
+ * @param {object} [opts]
+ * @param {string} [opts.click] Selector (any Playwright engine — CSS, `text=`, `role=`) to
+ *   click after the route loads, before capturing. Needed to reach anything not visible on
+ *   initial page load — an export menu, a "..." row action, a modal trigger.
+ * @param {boolean} [opts.popup] The click in `opts.click` opens a NEW browser window/tab
+ *   (`window.open`, `target="_blank"`) rather than something in the current page — e.g. a
+ *   per-transcript "Export" action. Without this, `page.screenshot()` still captures the
+ *   ORIGINAL page (usually just the button that was clicked), because Playwright never
+ *   automatically follows focus to a new window. Root cause of the 2026-09-18 KB gap: the
+ *   transcript-export screenshot needed this and the tool had no way to follow the popup.
  */
-export async function loginAndScreenshot(app, route, outputPath) {
+export async function loginAndScreenshot(app, route, outputPath, opts = {}) {
+  const baseUrl = APP_URLS[app];
+  if (!baseUrl) throw new Error(`Unknown app "${app}" — expected "admin", "messaging", or "livefluence".`);
+
+  const isLivefluence = app === 'livefluence';
+
   let email    = process.env.E2E_USER_EMAIL    || process.env.TEST_USER_EMAIL;
   let password = process.env.E2E_USER_PASSWORD || process.env.TEST_USER_PASSWORD;
 
   if (!email || !password) {
     try {
-      const kvCreds = await loadCredentialsFromKeyVault();
+      const kvCreds = isLivefluence
+        ? await loadCredentialsFromKeyVault(LIVEFLUENCE_KV_NAME, LIVEFLUENCE_KV_USERNAME_SECRET, LIVEFLUENCE_KV_PASSWORD_SECRET)
+        : await loadCredentialsFromKeyVault(KV_NAME, KV_EMAIL_SECRET, KV_PASSWORD_SECRET);
       email = kvCreds.email;
       password = kvCreds.password;
     } catch (err) {
@@ -99,16 +128,16 @@ export async function loginAndScreenshot(app, route, outputPath) {
   }
 
   if (!email || !password) {
+    const [vault, userSecret, passSecret] = isLivefluence
+      ? [LIVEFLUENCE_KV_NAME, LIVEFLUENCE_KV_USERNAME_SECRET, LIVEFLUENCE_KV_PASSWORD_SECRET]
+      : [KV_NAME, KV_EMAIL_SECRET, KV_PASSWORD_SECRET];
     throw new Error(
       'E2E_USER_EMAIL/E2E_USER_PASSWORD (or TEST_USER_EMAIL/TEST_USER_PASSWORD) must be set, ' +
-      `and Key Vault (${KV_NAME}) did not return usable values for secrets ` +
-      `"${KV_EMAIL_SECRET}"/"${KV_PASSWORD_SECRET}".`
+      `and Key Vault (${vault}) did not return usable values for secrets ` +
+      `"${userSecret}"/"${passSecret}".`
     );
   }
 
-  const baseUrl = APP_URLS[app];
-  if (!baseUrl) throw new Error(`Unknown app "${app}" — expected "admin" or "messaging".`);
-
   const { chromium } = await loadPlaywright();
   const browser = await chromium.launch();
 
@@ -116,30 +145,52 @@ export async function loginAndScreenshot(app, route, outputPath) {
     const context = await browser.newContext();
     const page = await context.newPage();
 
-    // ── Login (adapted from e2e/tests/auth.setup.ts) ──────────────────────────
-    // Role/label based selectors, not type-attribute selectors — the CIAM login page's
-    // markup does not reliably render the email field as a literal input[type="email"]
-    // or the submit controls as input[type="submit"] (found 2026-08-01 in auth.setup.ts,
-    // confirmed again 2026-08-13 against live admin-staging while verifying the Key
-    // Vault credential fallback below: the email step is input[name="username"]
-    // type="text", and both submit controls are <button type="submit">). Role/label
-    // selectors track the accessible page contract instead of an implementation detail
-    // that can change under us.
-    await page.goto(baseUrl);
-    await page.waitForURL(/login\.velaro\.com/, { timeout: 30_000 });
-
-    await page.getByRole('textbox', { name: /email/i }).fill(email);
-    await page.getByRole('button', { name: /next|sign in/i }).click();
-
-    await page.getByLabel(/password/i).fill(password);
-    await page.getByRole('button', { name: /sign in|next/i }).click();
-
-    // Handle "Stay signed in?" prompt — not always shown.
-    try {
-      await page.getByRole('button', { name: /yes|no|stay signed in/i }).first().click({ timeout: 5_000 });
-    } catch { /* prompt not shown — proceed */ }
-
-    await page.waitForURL(/velaro\.com/, { timeout: 30_000 });
+    if (isLivefluence) {
+      // ── v10 login (Client.ConsoleNew's own /Account/Login form, no CIAM redirect) ──
+      // Direct email+password form on the same host -- confirmed live 2026-09-18 via
+      // interactive login at app.velaro.com/Account/Login. Unlike admin/messaging, there
+      // is no login.velaro.com hop and no "stay signed in" prompt to handle.
+      await page.goto(new URL('/Account/Login', baseUrl).toString());
+      // The field's accessible label/placeholder is literally "Username" (an email
+      // address is entered into it, but it is NOT labeled "Email") -- confirmed live
+      // 2026-09-18 against the real login form; an /email/i selector silently matched
+      // nothing and the fill() was a no-op, which the old broad waitForURL(/velaro\.com/)
+      // masked because that regex also matches the login page's own URL.
+      await page.getByPlaceholder(/username/i).fill(email);
+      await page.getByPlaceholder(/password/i).fill(password);
+      // Exact match -- "Sign in with SSO" also matches a loose /sign in/i regex and sits
+      // right next to the real submit button (confirmed live 2026-09-18, strict-mode
+      // violation on first test run).
+      await page.getByRole('button', { name: 'Sign In', exact: true }).click();
+      // Must NOT match the login page's own URL -- wait for the post-login redirect away
+      // from /Account/Login specifically, not just "somewhere on velaro.com".
+      await page.waitForURL((url) => !url.pathname.toLowerCase().includes('/account/login'), { timeout: 30_000 });
+    } else {
+      // ── Login (adapted from e2e/tests/auth.setup.ts) ──────────────────────────
+      // Role/label based selectors, not type-attribute selectors — the CIAM login page's
+      // markup does not reliably render the email field as a literal input[type="email"]
+      // or the submit controls as input[type="submit"] (found 2026-08-01 in auth.setup.ts,
+      // confirmed again 2026-08-13 against live admin-staging while verifying the Key
+      // Vault credential fallback below: the email step is input[name="username"]
+      // type="text", and both submit controls are <button type="submit">). Role/label
+      // selectors track the accessible page contract instead of an implementation detail
+      // that can change under us.
+      await page.goto(baseUrl);
+      await page.waitForURL(/login\.velaro\.com/, { timeout: 30_000 });
+
+      await page.getByRole('textbox', { name: /email/i }).fill(email);
+      await page.getByRole('button', { name: /next|sign in/i }).click();
+
+      await page.getByLabel(/password/i).fill(password);
+      await page.getByRole('button', { name: /sign in|next/i }).click();
+
+      // Handle "Stay signed in?" prompt — not always shown.
+      try {
+        await page.getByRole('button', { name: /yes|no|stay signed in/i }).first().click({ timeout: 5_000 });
+      } catch { /* prompt not shown — proceed */ }
+
+      await page.waitForURL(/velaro\.com/, { timeout: 30_000 });
+    }
 
     // ── Navigate + capture ──────────────────────────────────────────────────
     const target = new URL(route, baseUrl).toString();
@@ -149,7 +200,28 @@ export async function loginAndScreenshot(app, route, outputPath) {
       // capture just because the network never goes fully idle.
     });
 
-    await page.screenshot({ path: outputPath, fullPage: true });
+    let captureTarget = page;
+
+    if (opts.click) {
+      if (opts.popup) {
+        // context.waitForEvent('page') must be armed BEFORE the click, not after — the
+        // popup can open (and even finish loading) before an await on the click resolves.
+        const [popup] = await Promise.all([
+          context.waitForEvent('page', { timeout: 15_000 }),
+          page.click(opts.click),
+        ]);
+        await popup.waitForLoadState('networkidle', { timeout: 30_000 }).catch(() => {});
+        captureTarget = popup;
+      } else {
+        await page.click(opts.click);
+        // Give in-page content (a modal, an inline export panel) a moment to render —
+        // there's no popup "page" event to wait on for same-page UI.
+        await page.waitForLoadState('networkidle', { timeout: 15_000 }).catch(() => {});
+      }
+    }
+
+    await captureTarget.screenshot({ path: outputPath, fullPage: true });
+    if (captureTarget !== page) await captureTarget.close();
   } finally {
     await browser.close();
   }
@@ -259,21 +331,26 @@ export function escapeAttr(s) {
 
 /**
  * @param {object} opts
- * @param {"admin"|"messaging"} opts.app
+ * @param {"admin"|"messaging"|"livefluence"} opts.app
  * @param {string} opts.route
  * @param {number} opts.articleId
  * @param {string} [opts.heading]
  * @param {{x:number,y:number,label?:string}[]} [opts.annotations]
+ * @param {string} [opts.click] Selector to click after the route loads, before capturing.
+ * @param {boolean} [opts.popup] The click opens a new browser window — capture that
+ *   window's content instead of the original page's. See loginAndScreenshot() for why
+ *   this is required (a popup is invisible to a plain page.screenshot() otherwise).
  * @param {{token:string, apiBase:string}} [opts.auth] Explicit auth override for callers
  *   that don't use the CLI's stored login config (e.g. mcp/server.js, which authenticates
  *   via VELARO_MCP_KEY/VELARO_JWT env vars). CLI usage omits this and falls back to
  *   getCredentials() (the normal `velaro login` flow).
  * @returns {Promise<{articleId:number, imageUrl:string, insertedAfterHeading:boolean}>}
  */
-export async function captureKbScreenshot({ app, route, articleId, heading, annotations, auth }) {
-  if (!app || !APP_URLS[app]) throw new Error('app must be "admin" or "messaging"');
+export async function captureKbScreenshot({ app, route, articleId, heading, annotations, click, popup, auth }) {
+  if (!app || !APP_URLS[app]) throw new Error('app must be "admin", "messaging", or "livefluence"');
   if (!route) throw new Error('route is required');
   if (!articleId) throw new Error('articleId is required');
+  if (popup && !click) throw new Error('--popup requires --click (nothing to click that would open one)');
 
   const rawPath = join(tmpdir(), `kb-screenshot-${articleId}-${Date.now()}.png`);
   let polishedPath = rawPath;
@@ -283,7 +360,7 @@ export async function captureKbScreenshot({ app, route, articleId, heading, anno
       ? { velaroToken: auth.token, adminApiBase: auth.apiBase }
       : await getCredentials();
 
-    await loginAndScreenshot(app, route, rawPath);
+    await loginAndScreenshot(app, route, rawPath, { click, popup });
     polishedPath = await polishScreenshot(rawPath, annotations);
     const imageUrl = await uploadImage(polishedPath, creds);
 

package/lib/mcp-key.test.js

@@ -0,0 +1,17 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { normalizeMcpKeysResponse } from './commands/mcp-key.js';
+
+test('MCP key list reads the current API response shape', () => {
+  const keys = [{ id: 1, label: 'Staff', keyPrefix: 'vel_live_example' }];
+  assert.deepEqual(normalizeMcpKeysResponse({ keys, monthlyLimit: 100 }), keys);
+});
+
+test('MCP key list accepts the legacy array response', () => {
+  const keys = [{ id: 2, label: 'Legacy' }];
+  assert.deepEqual(normalizeMcpKeysResponse(keys), keys);
+});
+
+test('MCP key list rejects an unexpected response instead of reporting no keys', () => {
+  assert.throws(() => normalizeMcpKeysResponse({ error: 'unavailable' }), /Unexpected MCP API key list response/);
+});