@verirun/cli 0.2.3 → 0.2.5

package/README.md

@@ -147,6 +147,20 @@ what you recorded is what runs.
 into a field and close the browser without clicking or tabbing away, that last
 value is not recorded. Tab out before closing.
 
+**Dialogs.** Answer `alert` / `confirm` / `prompt` boxes in the recording
+browser as you normally would. Codegen notes *that* a step opened one but not
+which button you pressed, so after you close the browser `record` asks, per such
+step, `[O]K / [c]ancel` (Enter = OK; without a terminal every answer is OK). The
+answer is saved on the step and `run` replays it:
+
+```json
+{ "index": 4, "action": "click", "selector": "…", "dialog": { "action": "dismiss" } }
+```
+
+`action` is `accept` (OK) or `dismiss` (Cancel). For a `prompt()`, add
+`"promptText": "…"` — without it, accepting submits the prompt's default value.
+Every dialog the step opens gets the same answer.
+
 **Nothing recorded.** If you close the browser without doing anything, nothing
 is saved and the command says so.
 
@@ -217,6 +231,7 @@ and writes `.verirun/runs/<name>-<timestamp>/logs.json`.
 | `--user-data-dir <dir>` | Replay in a persistent profile directory, so it runs already logged in. The profile must not be open in another browser. |
 | `--cdp <url>` | Attach to a browser already running with remote debugging and drive it. See below. |
 | `--user <id>` | Keep only log entries whose message or raw payload contains this string, case-insensitive — e.g. a user's email. Overrides `config.userFilter`. Recorded in `logs.json` as `"filter": { "user": … }`; `entries` and the per-source counts are post-filter. If everything is filtered out, `run` warns. |
+| `--dialog <answer>` | How to answer a browser dialog opened by a step with no saved `dialog` answer: `accept` (OK, the default) or `dismiss` (Cancel). A step's own `dialog` always wins. |
 
 **Where the user filter runs.** For **Supabase** it goes into the log query's
 `WHERE` (matched against the rendered message and the JSON of `metadata`), so
@@ -263,6 +278,11 @@ frontmost.
   whatever logs already landed are still written, and the exit code is non-zero.
 - Popups and newly opened tabs become the active target as they open. A workflow
   that drives several tabs at once is not supported yet.
+- Browser dialogs (`alert`, `confirm`, `prompt`, `beforeunload`) are answered
+  automatically: with the step's saved `dialog` if it has one, otherwise with
+  `--dialog` (default `accept`). Each one is printed under its step and listed
+  in `logs.json` `dialogs`. With `--cdp`, only tabs the run itself drives or
+  opens are touched.
 
 ### Sequencing
 
@@ -282,6 +302,9 @@ warned about and contributes no entries.
   "window": { "startedAt": "2026-08-31T13:01:50.998Z", "endedAt": "2026-08-31T13:01:51.499Z" },
   "steps": { "total": 12, "replayed": 12 },
   "filter": { "user": "ada@example.com" },
+  "dialogs": [
+    { "step": 7, "type": "confirm", "message": "Delete this item?", "action": "accept", "at": "2026-08-31T13:01:51.102Z" }
+  ],
   "sources": [{ "id": "vercel", "name": "Vercel", "entries": 8 }],
   "entries": [
     {
@@ -300,6 +323,10 @@ warned about and contributes no entries.
   (the step index) and the file carries a top-level `error` string.
 - `filter` is present only when `--user` / `config.userFilter` was in effect;
   `entries` and every `sources[].entries` count are then post-filter.
+- `dialogs` lists every browser dialog the replay answered, in order: the
+  `step` running when it opened, its `type` and `message`, the prompt's
+  `defaultValue` (prompts only), the `action` taken, and the `promptText`
+  submitted to an accepted prompt. Empty when none opened.
 - `entries` merges every source, sorted by `timestamp`. `stream` is the
   sub-stream within a source (`lambda`, `edge`, `postgres_logs`, …). `raw` is
   the provider's untouched payload (for Supabase that now includes the row's
@@ -422,11 +449,25 @@ element that gets you there:
 $ verirun map --bfs /account --depth 2
 page:/account
   └─ nav "verirun" → page:/
-  └─ effect "revoke" [if !(tokens.length === 0)] → effect:POST ?
+  └─ effect "revoke" [if window.confirm("Revoke this terminal's access? …")] → effect:POST ?
+     opens confirm "Revoke this terminal's access? …" — the answer decides what the click does
     └─ nav "Log in" → page:/login
 # frontier at depth 2: page:/login, page:/signup
 ```
 
+**Browser dialogs.** An element whose handler calls the native `alert()`,
+`confirm()` or `prompt()` (bare, or on `window` / `globalThis`; a locally
+imported `confirm` is a custom modal, not a dialog) carries
+`dialogs: [{ type, message, messageStatic, gates, … }]` in `--json`. `gates` is
+true when the handler reads the answer, so OK and Cancel lead to different
+outcomes. An early `if (!window.confirm(…)) return;` also shows up as the
+`guardSource` of every backend call after it, which is how you see that Cancel
+skips the `POST`. The per-page summary counts the elements that open a dialog,
+`--bfs` prints each one under its edge, and `coverage.md` lists them all. A
+workflow step that clicks one answers it with its `dialog` field (see
+[`verirun run`](#verirun-run-name)); `workflow check` warns when that field is
+missing (see below).
+
 **Limits, honestly.** It is static analysis: a target computed at runtime shows
 as `unresolved`, an endpoint passed through a variable as `?`, and Supabase
 `.auth.*` / `.storage.*` calls are not yet classified as effects. `--reach`
@@ -451,6 +492,15 @@ verirun workflow check login --json     # machine-readable findings
 verirun workflow check ./some/file.json
 ```
 
+If `verirun map --report` has saved `.verirun/map/interaction-tree.json`,
+`check` also warns about a step that clicks an element the graph says opens a
+browser dialog but has no `dialog` answer. Replay would press OK, which is
+usually what you want, but when the handler reads the answer, Cancel is a
+different path and should be chosen on purpose. Matching is by exact selector, so it catches
+workflows written from `map --json`. A selector that elements *without* a dialog
+also match (a bare `role=button`) is skipped rather than guessed at. Re-run
+`map --report` when the app changes; the saved graph goes stale.
+
 Static only: it never opens a browser, so it cannot tell you whether a selector
 matches the live page. Only `verirun run` can. Non-zero exit if anything is an
 error.
@@ -477,7 +527,9 @@ an agent — to write `.verirun/workflows/<name>.json` directly:
 Actions and required `params`: `navigate` (`url`, absolute), `click` /
 `dblclick`, `fill` (`text`), `press` (`key`), `check` / `uncheck`, `select`
 (`values`), `setInputFiles` (`files`). Everything but `navigate` needs a
-`selector`, which is handed to `page.locator()` verbatim.
+`selector`, which is handed to `page.locator()` verbatim. A step that opens a
+browser dialog can carry `"dialog": { "action": "accept" | "dismiss",
+"promptText"?: "…" }`; without it `run` accepts.
 
 A recorded workflow is ground truth; a written one is a guess until `run`
 confirms it. Don't overwrite a recording with a generated file — use a new name.
@@ -495,17 +547,25 @@ workflows, recent runs.
 ```bash
 verirun agent > .verirun/AGENT.md      # save it as context for your agent
 verirun agent --json                   # machine-readable form
-verirun agent --skill --install        # .claude/skills/verirun/SKILL.md
+verirun agent --skill --install         # .claude/skills/verirun/SKILL.md
+verirun agent --skill --install cursor  # .cursor/rules/verirun.mdc
+verirun agent --skill --install all     # both
 ```
 
-`--skill` emits the same knowledge as a **Claude Code skill** — YAML frontmatter
-with a `description` that tells Claude when to load it, then a shorter body
-aimed at deciding *which* command to reach for. With `--install` it writes
-`.claude/skills/verirun/SKILL.md` in the repo, and Claude Code loads it on its
-own whenever a task looks like app testing. Re-run it after upgrading verirun;
-the file is generated, not hand-maintained.
+`--skill` emits the same knowledge as an agent skill — frontmatter with a
+`description` that tells the agent when to load it, then a shorter body aimed at
+deciding *which* command to reach for. `--install` writes it where the agent
+looks:
+
+| Target | File | Loaded |
+|---|---|---|
+| `claude` (default) | `.claude/skills/verirun/SKILL.md` | automatically, when a task looks like app testing |
+| `cursor` | `.cursor/rules/verirun.mdc` | when the task matches its description (an agent-requested rule, not always-on) |
+| `all` | both | |
 
-Paste the output into `CLAUDE.md`, `.cursorrules`, an `AGENTS.md`, or pipe it
+Re-run it after upgrading verirun; the file is generated, not hand-maintained.
+
+For any other agent, paste the output into `CLAUDE.md`, an `AGENTS.md`, or pipe it
 straight into a prompt. No account needed. The agent then knows to run
 `verirun run <name>`, read exit code + `.verirun/runs/<name>-<newest>/logs.json`,
 and act on `status` / `error` / `entries` without you explaining the tool.
@@ -655,6 +715,54 @@ run this often.
 
 ## Changelog
 
+### 0.2.5
+
+- **`verirun run` answers browser dialogs instead of cancelling them.** With no
+  handler, Playwright dismissed every `alert` / `confirm` / `prompt`, so each
+  `confirm()` in a workflow came back as Cancel and the action it guarded
+  quietly never happened. Replay now answers each one: with the step's saved
+  `dialog` (`accept` / `dismiss`, plus `promptText` for a prompt), otherwise
+  with the new `--dialog accept|dismiss` (default `accept`). Each dialog is
+  printed under its step and listed in `logs.json` under `dialogs`. With
+  `--cdp`, only the tabs the run drives are touched.
+- **`verirun record` asks which button you pressed.** Playwright's recorder notes
+  that a step opened a dialog but not the answer, so after you close the
+  browser `record` asks `[O]K / [c]ancel` for each such step and saves it on the
+  step.
+- **`verirun map` shows the dialogs an element opens.** `--json` carries a
+  `dialogs` list per element (`type`, `message`, and `gates` when the handler
+  reads the answer). An early `if (!window.confirm(…)) return;` now shows up as
+  the `guardSource` of the backend calls after it, so you can see that Cancel
+  skips them. The summary counts them, `--bfs` prints them under their edge,
+  and `coverage.md` lists them.
+- **`verirun workflow check` validates the `dialog` field.** After `map
+  --report`, it also warns about a step that clicks a dialog-opening element
+  without saying OK or Cancel.
+
+### 0.2.4
+
+- **`verirun map` reads the import aliases your project actually declares.**
+  Only `"@/*": ["./src/*"]` was understood before; a `paths` entry resolved
+  against `baseUrl` (`"@/*": ["*"]`) or inherited through `extends` — the two
+  shapes `create-next-app` and most monorepos emit — silently produced no
+  aliases at all. Every `@/…` import then resolved to nothing, so the child
+  components a page renders were never analysed and each page was reported as
+  empty: pages listed, zero elements, zero effects, zero edges, no warning.
+- **An unresolvable import alias now says so, and says what to do.** `map`
+  prints the exact `--alias` flag to re-run with, instead of quietly reporting
+  an app it could not read as an app with nothing in it. A scoped npm package
+  is not mistaken for a broken alias.
+- **`verirun agent --skill --install` now installs for Cursor too.** `--install
+  cursor` writes `.cursor/rules/verirun.mdc` as an agent-requested rule, `--install
+  all` writes that and the Claude Code skill; a bare `--install` still means Claude
+  Code.
+- **`verirun record --url` checks the URL is up before opening a browser.** A
+  dev server that is not running produced a raw Node stack trace from
+  Playwright's child process, followed by a message blaming the `jsonl` codegen
+  target — pointing at the wrong thing entirely. It now stops with
+  `Nothing is listening at http://localhost:3000`. The message for a codegen
+  exit that genuinely recorded nothing no longer leads with the `jsonl` theory.
+
 ### 0.2.3
 
 - **`verirun whoami` shows this machine's fingerprint**, in the same 24-character