@vizzly-testing/cli 0.37.0 → 0.38.1

package/dist/server/routers/auth.js

@@ -3,9 +3,10 @@
  * Handles authentication endpoints (device flow login, logout, status)
  */
 
+import { buildTokens, normalizeDeviceFlowResponse } from '../../auth/core.js';
 import * as output from '../../utils/output.js';
 import { parseJsonBody } from '../middleware/json-parser.js';
-import { sendError, sendServiceUnavailable, sendSuccess } from '../middleware/response.js';
+import { sendError, sendJson, sendServiceUnavailable, sendSuccess } from '../middleware/response.js';
 
 /**
  * Create auth router
@@ -50,22 +51,20 @@ export function createAuthRouter({
     // Initiate device flow login
     if (req.method === 'POST' && pathname === '/api/auth/login') {
       try {
-        const deviceFlow = await authService.initiateDeviceFlow();
-
-        // Transform snake_case to camelCase for frontend
-        const response = {
-          deviceCode: deviceFlow.device_code,
-          userCode: deviceFlow.user_code,
-          verificationUri: deviceFlow.verification_uri,
-          verificationUriComplete: deviceFlow.verification_uri_complete,
-          expiresIn: deviceFlow.expires_in,
+        let deviceFlow = await authService.initiateDeviceFlow();
+        let flow = normalizeDeviceFlowResponse(deviceFlow);
+        sendSuccess(res, {
+          deviceCode: flow.deviceCode,
+          userCode: flow.userCode,
+          verificationUri: flow.verificationUri,
+          verificationUriComplete: flow.urlWithCode,
+          expiresIn: deviceFlow.expires_in ?? deviceFlow.expiresIn,
           interval: deviceFlow.interval
-        };
-        sendSuccess(res, response);
+        });
         return true;
       } catch (error) {
         output.error('Error initiating device flow:', error);
-        sendError(res, 500, error.message);
+        sendAuthError(res, error);
         return true;
       }
     }
@@ -81,45 +80,25 @@ export function createAuthRouter({
           sendError(res, 400, 'deviceCode is required');
           return true;
         }
-        let result;
-        try {
-          result = await authService.pollDeviceAuthorization(deviceCode);
-        } catch (error) {
-          // Handle "Authorization pending" as a valid response
-          if (error.message?.includes('Authorization pending')) {
-            sendSuccess(res, {
-              status: 'pending'
-            });
-            return true;
-          }
-          throw error;
-        }
-
-        // Check if authorization is complete by looking for tokens
-        if (result.tokens?.accessToken) {
-          const tokensData = result.tokens;
-          const tokenExpiresIn = tokensData.expiresIn || tokensData.expires_in;
-          const tokenExpiresAt = tokenExpiresIn ? new Date(Date.now() + tokenExpiresIn * 1000).toISOString() : result.expires_at || result.expiresAt;
-          const tokens = {
-            accessToken: tokensData.accessToken || tokensData.access_token,
-            refreshToken: tokensData.refreshToken || tokensData.refresh_token,
-            expiresAt: tokenExpiresAt,
-            user: result.user
-          };
+        let result = await authService.pollDeviceAuthorization(deviceCode);
+        if (result.tokens?.accessToken || result.tokens?.access_token) {
+          let tokens = buildTokens(result);
           await authService.completeDeviceFlow(tokens);
           sendSuccess(res, {
             status: 'complete',
             user: result.user
           });
-        } else {
+        } else if (['pending', 'expired', 'denied', 'invalid'].includes(result.status)) {
           sendSuccess(res, {
-            status: 'pending'
+            status: result.status
           });
+        } else {
+          throw new Error('Unexpected response from authorization server');
         }
         return true;
       } catch (error) {
         output.error('Error polling device authorization:', error);
-        sendError(res, 500, error.message);
+        sendAuthError(res, error);
         return true;
       }
     }
@@ -135,10 +114,21 @@ export function createAuthRouter({
         return true;
       } catch (error) {
         output.error('Error logging out:', error);
-        sendError(res, 500, error.message);
+        sendAuthError(res, error);
         return true;
       }
     }
     return false;
   };
+}
+function sendAuthError(res, error) {
+  let retryAfter = error.context?.retryAfter;
+  if (retryAfter) res.setHeader('Retry-After', String(retryAfter));
+  sendJson(res, error.context?.status || 500, {
+    error: error.message,
+    code: error.context?.serverCode || error.code,
+    ...(retryAfter ? {
+      retryAfter
+    } : {})
+  });
 }

package/dist/test-runner/core.js

@@ -64,6 +64,8 @@ export function buildApiBuildPayload(options, comparisonConfig = null) {
     environment: options.environment || 'test',
     commit_sha: options.commit,
     commit_message: options.message,
+    commit_author_name: options.commitAuthorName,
+    commit_author_email: options.commitAuthorEmail,
     github_pull_request_number: options.pullRequestNumber,
     parallel_id: options.parallelId
   };

package/dist/types/index.d.ts

@@ -165,6 +165,8 @@ export interface UploadOptions {
   branch?: string;
   commit?: string;
   message?: string;
+  commitAuthorName?: string;
+  commitAuthorEmail?: string;
   environment?: string;
   threshold?: number;
   minClusterSize?: number;
@@ -517,6 +519,8 @@ export interface BuildOptions {
   commit_sha?: string;
   message?: string;
   commit_message?: string;
+  commitAuthorName?: string;
+  commitAuthorEmail?: string;
   environment?: string;
   threshold?: number;
   eager?: boolean;

package/dist/uploader/core.js

@@ -154,6 +154,8 @@ export function buildBuildInfo(options, defaultBranch = 'main') {
     branch: options.branch || defaultBranch || 'main',
     commit_sha: options.commit,
     commit_message: options.message,
+    commit_author_name: options.commitAuthorName,
+    commit_author_email: options.commitAuthorEmail,
     environment: options.environment || 'production',
     threshold: options.threshold,
     github_pull_request_number: options.pullRequestNumber,

package/dist/utils/browser.js

@@ -52,7 +52,13 @@ export async function openBrowser(url) {
         args = [url];
         break;
     }
-    execFile(command, args, error => {
+
+    // Some launchers stay in the foreground. Bound the attempt so login and
+    // other CLI workflows can continue using the displayed URL.
+    execFile(command, args, {
+      timeout: 5000,
+      killSignal: 'SIGKILL'
+    }, error => {
       if (error) {
         // Browser opening failed, but don't throw - user can manually open
         resolve(false);

package/dist/utils/ci-env.js

@@ -156,13 +156,23 @@ export function getCommit() {
 }
 
 /**
- * Get the commit message from CI environment variables
+ * Get the commit message from CI environment variables.
+ *
+ * For GitHub Actions pull_request events, the checkout is a synthetic merge
+ * commit whose message is "Merge <sha> into <sha>", so the PR title from the
+ * event payload is used instead.
+ *
  * @returns {string|null} Commit message or null if not available
  */
 export function getCommitMessage() {
-  return process.env.VIZZLY_COMMIT_MESSAGE ||
-  // Vizzly override
-  process.env.CI_COMMIT_MESSAGE ||
+  if (process.env.VIZZLY_COMMIT_MESSAGE) {
+    return process.env.VIZZLY_COMMIT_MESSAGE;
+  }
+  if (process.env.GITHUB_ACTIONS) {
+    let title = getGitHubEvent().pull_request?.title;
+    if (title) return title;
+  }
+  return process.env.CI_COMMIT_MESSAGE ||
   // GitLab CI
   process.env.TRAVIS_COMMIT_MESSAGE ||
   // Travis CI
@@ -176,6 +186,35 @@ export function getCommitMessage() {
   // Generic
   null;
 }
+
+/**
+ * Parse a "Name <email>" author string (GitLab's CI_COMMIT_AUTHOR format)
+ * @param {string|undefined} value - Author string
+ * @returns {{ name: string|null, email: string|null }}
+ */
+function parseAuthorString(value) {
+  let match = value?.match(/^(.*?)\s*<([^>]*)>\s*$/);
+  if (!match) return {
+    name: value?.trim() || null,
+    email: null
+  };
+  return {
+    name: match[1] || null,
+    email: match[2] || null
+  };
+}
+
+/**
+ * Get the commit author from CI environment variables
+ * @returns {{ name: string|null, email: string|null }} Author name and email
+ */
+export function getCommitAuthor() {
+  let gitlab = parseAuthorString(process.env.CI_COMMIT_AUTHOR);
+  return {
+    name: process.env.VIZZLY_COMMIT_AUTHOR_NAME || gitlab.name || null,
+    email: process.env.VIZZLY_COMMIT_AUTHOR_EMAIL || gitlab.email || null
+  };
+}
 function parsePullRequestNumber(value) {
   if (!/^\d+$/.test(value)) {
     return null;

package/dist/utils/git.js

@@ -1,6 +1,6 @@
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
-import { getBranch as getCIBranch, getCommit as getCICommit, getCommitMessage as getCICommitMessage, getPullRequestNumber } from './ci-env.js';
+import { getBranch as getCIBranch, getCommit as getCICommit, getCommitAuthor as getCICommitAuthor, getCommitMessage as getCICommitMessage, getPullRequestNumber } from './ci-env.js';
 let execFileAsync = promisify(execFile);
 async function runGit(args, cwd = process.cwd()) {
   let {
@@ -124,8 +124,48 @@ export async function detectCommitMessage(override = null, cwd = process.cwd())
   let ciCommitMessage = getCICommitMessage();
   if (ciCommitMessage) return ciCommitMessage;
 
-  // Fallback to regular git log
-  return await getCommitMessage(cwd);
+  // Fallback to git, reading the same commit reported as commit_sha
+  return await readCommit('%B', cwd);
+}
+
+/**
+ * Read a formatted field from the detected build commit.
+ *
+ * Uses detectCommit() so CI checkouts (e.g. GitHub's synthetic PR merge
+ * commit) describe the PR head rather than HEAD. Falls back to HEAD when that
+ * commit is not in local history (shallow clones).
+ *
+ * @param {string} format - git log --format string
+ * @param {string} cwd - Working directory
+ * @returns {Promise<string|null>} Formatted output or null
+ */
+async function readCommit(format, cwd = process.cwd()) {
+  let sha = await detectCommit(null, cwd);
+  let refs = /^[0-9a-f]{4,64}$/i.test(sha || '') ? [sha, 'HEAD'] : ['HEAD'];
+  for (let ref of refs) {
+    try {
+      return await runGit(['log', '-1', `--format=${format}`, ref], cwd);
+    } catch {
+      // Commit not available locally, try the next ref
+    }
+  }
+  return null;
+}
+
+/**
+ * Detect commit author with environment variable support, falling back to git
+ * @param {string} cwd - Working directory
+ * @returns {Promise<{ name: string|null, email: string|null }>}
+ */
+export async function detectCommitAuthor(cwd = process.cwd()) {
+  let author = getCICommitAuthor();
+  if (author.name && author.email) return author;
+  let stdout = await readCommit('%an%x00%ae', cwd);
+  let [gitName, gitEmail] = stdout ? stdout.split('\0') : [];
+  return {
+    name: author.name || gitName || null,
+    email: author.email || gitEmail || null
+  };
 }
 
 /**
@@ -206,9 +246,9 @@ export async function detectCommit(override = null, cwd = process.cwd()) {
  */
 export async function generateBuildNameWithGit(override = null, cwd = process.cwd()) {
   if (override) return override;
-  let branch = await getCurrentBranch(cwd);
-  let shortSha = await getCurrentCommitSha(cwd);
-  if (branch && shortSha) {
+  let branch = await detectBranch(null, cwd);
+  let shortSha = await detectCommit(null, cwd);
+  if (branch && branch !== 'unknown' && shortSha) {
     let shortCommit = shortSha.substring(0, 7);
     return `${branch}-${shortCommit}`;
   }

package/dist/utils/login-poll-wait.js

@@ -0,0 +1,50 @@
+import { setTimeout as delay } from 'node:timers/promises';
+
+/** Wait for the next check, with optional terminal input and a live countdown. */
+export async function waitForLoginPoll({
+  milliseconds,
+  manualAllowed = true,
+  earliestCheckAt = 0,
+  stdin = process.stdin,
+  now = Date.now,
+  sleep = delay,
+  onTick
+}) {
+  if (!stdin.isTTY) {
+    onTick(milliseconds, false);
+    await sleep(milliseconds);
+    return;
+  }
+  let deadline = now() + milliseconds;
+  let requested = false;
+  let timer;
+  let wasFlowing = stdin.readableFlowing === true;
+  let onData = data => {
+    if (manualAllowed && /[\r\n]/.test(data.toString())) {
+      requested = true;
+      timer?.abort();
+    }
+  };
+  if (manualAllowed) {
+    stdin.on('data', onData);
+    stdin.resume();
+  }
+  try {
+    while (true) {
+      let remaining = Math.min(deadline, requested ? earliestCheckAt : deadline) - now();
+      if (remaining <= 0) return;
+      onTick(remaining, manualAllowed && !requested);
+      timer = new AbortController();
+      try {
+        await sleep(Math.min(remaining, 1000), undefined, {
+          signal: timer.signal
+        });
+      } catch (error) {
+        if (!timer.signal.aborted) throw error;
+      }
+    }
+  } finally {
+    stdin.removeListener('data', onData);
+    if (manualAllowed && !wasFlowing) stdin.pause();
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizzly-testing/cli",
-  "version": "0.37.0",
+  "version": "0.38.1",
   "description": "Visual regression testing from your terminal",
   "keywords": [
     "llm-context",
@@ -87,24 +87,24 @@
     "fix": "pnpm run format && pnpm run lint:fix"
   },
   "engines": {
-    "node": ">=22.0.0"
+    "node": "^22.18.0 || >=24.0.0"
   },
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@vizzly-testing/bear-den": "0.1.4",
+    "@vizzly-testing/bear-den": "0.1.6",
     "@vizzly-testing/honeydiff": "^0.17.0",
-    "ansis": "^4.2.0",
+    "ansis": "^4.4.0",
     "commander": "^15.0.0",
-    "cosmiconfig": "^9.0.0",
-    "dotenv": "^17.2.1",
-    "form-data": "^4.0.0",
-    "glob": "^13.0.0",
-    "react": "^19.1.1",
-    "react-dom": "^19.1.1",
-    "zod": "^4.1.12"
+    "cosmiconfig": "^10.0.1",
+    "dotenv": "^17.4.2",
+    "form-data": "^4.0.6",
+    "glob": "^13.0.6",
+    "react": "^19.3.0",
+    "react-dom": "^19.3.0",
+    "zod": "^4.6.5"
   },
   "tsd": {
     "directory": "test-d",
@@ -117,29 +117,29 @@
     }
   },
   "devDependencies": {
-    "@babel/cli": "^8.0.1",
-    "@babel/core": "^8.0.1",
-    "@babel/preset-env": "^8.0.2",
+    "@babel/cli": "^8.0.6",
+    "@babel/core": "^8.0.6",
+    "@babel/preset-env": "^8.0.6",
     "@babel/preset-react": "^8.0.1",
     "@babel/preset-typescript": "^8.0.1",
-    "@biomejs/biome": "^2.5.10",
+    "@biomejs/biome": "^2.5.15",
     "@heroicons/react": "^2.2.0",
-    "@modelcontextprotocol/sdk": "^1.0.4",
-    "@playwright/test": "^1.55.1",
-    "@tailwindcss/postcss": "^4.1.13",
-    "@tanstack/react-query": "^5.90.11",
-    "@types/node": "^26.0.0",
-    "@vitejs/plugin-react": "^6.0.1",
-    "autoprefixer": "^10.4.21",
+    "@modelcontextprotocol/sdk": "^1.31.0",
+    "@playwright/test": "^1.63.0",
+    "@tailwindcss/postcss": "^4.3.3",
+    "@tanstack/react-query": "^5.104.0",
+    "@types/node": "^26.6.3",
+    "@vitejs/plugin-react": "^6.1.2",
+    "autoprefixer": "^10.6.1",
     "babel-plugin-react-compiler": "^1.0.0",
     "babel-plugin-transform-remove-console": "^6.9.4",
-    "postcss": "^8.5.6",
-    "rimraf": "^6.0.1",
-    "tailwindcss": "^4.1.13",
+    "postcss": "^8.5.29",
+    "rimraf": "^6.1.3",
+    "tailwindcss": "^4.3.3",
     "tsd": "^0.33.0",
     "tui-driver": "github:vizzly-testing/tui-driver",
     "typescript": "^7.0.2",
-    "vite": "^8.2.2",
-    "wouter": "^3.7.1"
+    "vite": "^8.3.1",
+    "wouter": "^3.11.1"
   }
 }

package/skills/vizzly/references/cli-context.md

@@ -86,6 +86,31 @@ vizzly tdd stop --json
 `tdd run` and `tdd start` are alternatives. Stop only a daemon started for the
 current task.
 
+## Review A Local TDD Run
+
+After `tdd run` exits, inspect captures directly from `.vizzly`. These
+commands don't need a running TDD daemon or cloud credentials:
+
+```bash
+vizzly tdd screenshots list --page 1 --page-size 20
+vizzly tdd screenshots latest
+vizzly tdd screenshots show <comparison-id>
+```
+
+`latest` prints the current screenshot path for the most recent capture. Use
+`list` to find a comparison ID when you need a specific screenshot or browser
+variant. During UI iteration, inspect the current image first; request
+`--image diff` or `--image all` when comparison diagnostics help answer the
+question. Open the printed image paths with the available image viewer.
+
+`accept` replaces one local baseline and updates that report entry. Use it only
+when the task explicitly authorizes accepting a baseline; don't accept a change
+just to make a diff disappear:
+
+```bash
+vizzly tdd screenshots accept <comparison-id>
+```
+
 When a cloud build is in scope:
 
 ```bash