create-backlist 10.0.5 → 10.0.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-backlist",
-  "version": "10.0.5",
+  "version": "10.0.7",
   "description": "An advanced, multi-language backend generator based on frontend analysis. Smart Freemium SaaS CLI with Live QA.",
   "type": "module",
   "bin": {

package/src/qa/qa-engine.js

@@ -13,6 +13,7 @@ import path             from 'node:path';
 import os               from 'node:os';
 import { performance }  from 'node:perf_hooks';
 import { EventEmitter } from 'node:events';
+import readline         from 'node:readline';
 
 import { SmartCrawler }        from './browser/crawler.js';
 import { BrowserInteractor }   from './browser/interactions.js';
@@ -28,43 +29,64 @@ import { JSONReporter }        from './reporters/json.js';
 import { AIClassifier }        from './utils/ai-classifier.js';
 
 // ── Constants ─────────────────────────────────────────────────────────────
-export const VERSION      = '12.0.0';
-export const QA_DIR       = path.join(process.cwd(), '.backlist', 'qa');
-export const REPORT_DIR   = path.join(QA_DIR, 'reports');
-export const HISTORY_FILE = path.join(QA_DIR, 'history.json');
+export const VERSION        = '12.0.0';
+export const QA_DIR         = path.join(process.cwd(), '.backlist', 'qa');
+export const REPORT_DIR     = path.join(QA_DIR, 'reports');
+export const HISTORY_FILE   = path.join(QA_DIR, 'history.json');
 export const SCREENSHOT_DIR = path.join(REPORT_DIR, 'screenshots');
 
 // ── Utilities ─────────────────────────────────────────────────────────────
-export function timestamp()     { return new Date().toISOString(); }
-export function shortId()       { return Math.random().toString(36).slice(2, 9); }
-export function sleep(ms)       { return new Promise(r => setTimeout(r, ms)); }
+export function timestamp()        { return new Date().toISOString(); }
+export function shortId()          { return Math.random().toString(36).slice(2, 9); }
+export function sleep(ms)          { return new Promise(r => setTimeout(r, ms)); }
 export function formatDuration(ms) {
   if (ms < 1000) return `${Math.round(ms)}ms`;
   return `${(ms / 1000).toFixed(2)}s`;
 }
 export function formatBytes(b) {
-  if (!b || b < 0) return '0B';
-  if (b < 1024)        return `${b}B`;
-  if (b < 1024 * 1024) return `${(b / 1024).toFixed(1)}KB`;
+  if (!b || b < 0)      return '0B';
+  if (b < 1024)          return `${b}B`;
+  if (b < 1024 * 1024)   return `${(b / 1024).toFixed(1)}KB`;
   return `${(b / 1024 / 1024).toFixed(1)}MB`;
 }
 
+// ── Ask yes/no in terminal without async-inside-Promise issue ─────────────
+function askQuestion(question) {
+  return new Promise((resolve) => {
+    const rl = readline.createInterface({
+      input : process.stdin,
+      output: process.stdout,
+    });
+    // Auto-resolve after 10s if no input
+    const timer = setTimeout(() => {
+      rl.close();
+      resolve(false);
+    }, 10_000);
+
+    rl.question(question, (answer) => {
+      clearTimeout(timer);
+      rl.close();
+      resolve(answer.toLowerCase().trim() === 'y');
+    });
+  });
+}
+
 // ── QA Session ────────────────────────────────────────────────────────────
 export class QASession {
   id;
   startedAt;
-  urls = {};
-  results    = [];  // real test results only
-  bugs       = [];  // real detected bugs only
-  screenshots = []; // real screenshots
+  urls          = {};
+  results       = [];
+  bugs          = [];
+  screenshots   = [];
   consoleErrors = [];
-  networkLog  = [];
-  apiLog      = [];
-  routeMap    = [];
-  perfMetrics = {};
-  secFindings = [];
-  a11yResults = [];
-  seoResults  = [];
+  networkLog    = [];
+  apiLog        = [];
+  routeMap      = [];
+  perfMetrics   = {};
+  secFindings   = [];
+  a11yResults   = [];
+  seoResults    = [];
 
   constructor(urls) {
     this.id        = `QA-${shortId()}`;
@@ -72,9 +94,7 @@ export class QASession {
     this.urls      = urls;
   }
 
-  addResult(result) {
-    this.results.push(result);
-  }
+  addResult(result) { this.results.push(result); }
 
   addBug(bug) {
     this.bugs.push({ ...bug, id: `BUG-${shortId()}`, createdAt: timestamp() });
@@ -111,110 +131,91 @@ export class QAEngine extends EventEmitter {
 
   constructor(session, options = {}) {
     super();
-    this.#session      = session;
-    this.#terminal     = new TerminalDashboard(session);
+    this.#session       = session;
+    this.#terminal      = new TerminalDashboard(session);
     this.#screenshotter = new ScreenshotCapture(SCREENSHOT_DIR);
     this.#aiClassifier  = new AIClassifier();
   }
 
-  // Replace the init() method in QAEngine class
-
-async init() {
-  // Dynamic import Playwright — optional
-  let playwright = null;
-  try {
-    playwright = await import('playwright');
-  } catch {
-    // Will use HTTP fallback throughout
-  }
-
-  // Always import installer — handles all browser detection
-  const { getBrowserLaunchOptions, ensureBrowser } = await import('./browser/installer.js');
-
-  // Check browser availability once — share result
-  const launchOpts = await getBrowserLaunchOptions();
-
-  if (!launchOpts.available) {
-    console.log(chalk.yellow('\n  ⚠  Playwright browser not found.'));
-    console.log(chalk.gray('  The QA engine will run in HTTP-only mode.'));
-    console.log(chalk.gray('  Browser-based tests (JS errors, screenshots, a11y'));
-    console.log(chalk.gray('  via axe-core, real Web Vitals) will be skipped.\n'));
-    console.log(chalk.dim('  To enable full browser testing:'));
-    console.log(chalk.white('    npx playwright install chromium\n'));
-
-    // Offer to install now
-    const shouldInstall = await new Promise(resolve => {
-      const rl = (await import('node:readline')).createInterface({
-        input : process.stdin,
-        output: process.stdout,
-      });
-      rl.question(chalk.cyan('  Install Playwright browser now? (y/N): '), ans => {
-        rl.close();
-        resolve(ans.toLowerCase() === 'y');
-      });
-      // Auto-timeout after 10s
-      setTimeout(() => { rl.close(); resolve(false); }, 10_000);
-    });
+  // ── FIX: init() — no await inside non-async callbacks ─────────────────
+  async init() {
+    // Dynamic import Playwright — optional dependency
+    let playwright = null;
+    try {
+      playwright = await import('playwright');
+    } catch {
+      // Will use HTTP fallback throughout — playwright is optional
+    }
 
-    if (shouldInstall) {
-      const { installPlaywrightBrowsers } = await import('./browser/installer.js');
-      const result = await installPlaywrightBrowsers();
-      if (!result.success) {
-        console.log(chalk.yellow('  Auto-install failed. Continuing in HTTP-only mode.\n'));
+    // Resolve browser launch options (handles all detection logic)
+    const { getBrowserLaunchOptions, installPlaywrightBrowsers } = await import('./browser/installer.js');
+    const launchOpts = await getBrowserLaunchOptions();
+
+    if (!launchOpts.available) {
+      console.log(chalk.yellow('\n  ⚠  Playwright browser not found.'));
+      console.log(chalk.gray('  The QA engine will run in HTTP-only mode.'));
+      console.log(chalk.gray('  Browser-based tests (JS errors, screenshots, real Web Vitals)'));
+      console.log(chalk.gray('  will be skipped. All HTTP-based tests will still run.\n'));
+      console.log(chalk.dim('  To enable full browser testing:'));
+      console.log(chalk.white('    npx playwright install chromium\n'));
+
+      // ── FIX: use the extracted askQuestion() helper — no await in Promise ──
+      const shouldInstall = await askQuestion(
+        chalk.cyan('  Install Playwright browser now? (y/N): ')
+      );
+
+      if (shouldInstall) {
+        const result = await installPlaywrightBrowsers();
+        if (!result.success) {
+          console.log(chalk.yellow('  Auto-install failed. Continuing in HTTP-only mode.\n'));
+        }
       }
+    } else {
+      const exeName = launchOpts.executablePath?.split(/[/\\]/).pop() ?? 'chromium';
+      console.log(chalk.gray(`  ✓ Browser ready (${launchOpts.source}: ${exeName})`));
     }
-  } else {
-    console.log(chalk.gray(`  ✓ Browser ready (${launchOpts.source}: ${launchOpts.executablePath?.split(/[/\\]/).pop()})`));
-  }
 
-  this.#crawler      = new SmartCrawler(playwright);
-  this.#interactor   = new BrowserInteractor(playwright, this.#session);
-  this.#apiValidator = new RealAPIValidator(this.#session);
-  this.#security     = new SecurityScanner(this.#session);
-  this.#performance  = new PerformanceProfiler(this.#session);
-  this.#a11y         = new AccessibilityChecker(playwright, this.#session);
-  this.#seo          = new SEOScanner(this.#session);
-  this.#screenshotter = new ScreenshotCapture(SCREENSHOT_DIR);
-  this.#aiClassifier  = new AIClassifier();
-
-  await this.#interactor.launch();
-  await this.#screenshotter.init();
-}
+    // Initialise all subsystems
+    this.#crawler       = new SmartCrawler(playwright);
+    this.#interactor    = new BrowserInteractor(playwright, this.#session);
+    this.#apiValidator  = new RealAPIValidator(this.#session);
+    this.#security      = new SecurityScanner(this.#session);
+    this.#performance   = new PerformanceProfiler(this.#session);
+    this.#a11y          = new AccessibilityChecker(playwright, this.#session);
+    this.#seo           = new SEOScanner(this.#session);
+    this.#screenshotter = new ScreenshotCapture(SCREENSHOT_DIR);
+    this.#aiClassifier  = new AIClassifier();
+
+    await this.#interactor.launch();
+    await this.#screenshotter.init();
+  }
 
   async run() {
     this.#terminal.start();
     this.emit('session:start', this.#session);
 
     try {
-      // Phase 1 — Discovery
       this.#terminal.setPhase('🔍 Phase 1: Route Discovery & Crawling');
       await this.#phaseDiscovery();
 
-      // Phase 2 — API Validation
       this.#terminal.setPhase('📡 Phase 2: Real API Validation');
       await this.#phaseAPIValidation();
 
-      // Phase 3 — Browser Interactions
       this.#terminal.setPhase('🖱️  Phase 3: Browser Interaction Testing');
       await this.#phaseBrowserInteractions();
 
-      // Phase 4 — Security Scan
       this.#terminal.setPhase('🛡️  Phase 4: Security Deep Scan');
       await this.#phaseSecurityScan();
 
-      // Phase 5 — Performance
       this.#terminal.setPhase('⚡ Phase 5: Performance Profiling');
       await this.#phasePerformance();
 
-      // Phase 6 — Accessibility
       this.#terminal.setPhase('♿ Phase 6: Accessibility Testing');
       await this.#phaseAccessibility();
 
-      // Phase 7 — SEO
       this.#terminal.setPhase('🔎 Phase 7: SEO Validation');
       await this.#phaseSEO();
 
-      // Phase 8 — AI Bug Classification
       this.#terminal.setPhase('🤖 Phase 8: AI Bug Classification');
       await this.#phaseAIClassification();
 
@@ -229,6 +230,36 @@ async init() {
     return this.#session;
   }
 
+  // Run a single named phase (used by manual QA)
+  async runPhase(name) {
+    this.#terminal.start();
+    try {
+      switch (name) {
+        case 'full-url':
+          await this.#phaseDiscovery();
+          await this.#phaseAPIValidation();
+          await this.#phaseBrowserInteractions();
+          await this.#phaseSecurityScan();
+          await this.#phasePerformance();
+          await this.#phaseAccessibility();
+          await this.#phaseSEO();
+          await this.#phaseAIClassification();
+          break;
+        case 'security':    await this.#phaseSecurityScan();    break;
+        case 'perf':        await this.#phasePerformance();     break;
+        case 'a11y':        await this.#phaseAccessibility();   break;
+        case 'seo':         await this.#phaseSEO();             break;
+        case 'api':         await this.#phaseAPIValidation();   break;
+        default:
+          await this.run();
+      }
+    } finally {
+      this.#terminal.stop();
+      await this.#interactor.close().catch(() => {});
+    }
+    return this.#session;
+  }
+
   abort() {
     this.#aborted = true;
     this.#terminal.stop();
@@ -242,9 +273,9 @@ async init() {
       this.#terminal.log(`Crawling ${label}: ${url}`);
 
       const routes = await this.#crawler.crawl(url, {
-        maxPages   : 60,
-        maxDepth   : 4,
-        onRoute    : (route) => {
+        maxPages: 60,
+        maxDepth: 4,
+        onRoute : (route) => {
           this.#session.routeMap.push(route);
           this.#terminal.log(`  Found: ${route.url} (${route.type})`);
         },
@@ -258,17 +289,16 @@ async init() {
         message : routes.length > 0
           ? `Discovered ${routes.length} routes`
           : 'No routes discovered — site may be unreachable',
-        data    : { routeCount: routes.length, routes },
-        url,
-        label,
+        data    : { routeCount: routes.length },
+        url, label,
       });
     }
   }
 
-  // ── Phase 2: Real API Validation ───────────────────────────────────────
+  // ── Phase 2: API Validation ────────────────────────────────────────────
   async #phaseAPIValidation() {
     const apiRoutes = this.#session.routeMap.filter(r =>
-      r.type === 'api' || r.url.includes('/api/')
+      r.type === 'api' || r.url?.includes('/api/')
     );
 
     this.#terminal.log(`Validating ${apiRoutes.length} API endpoints...`);
@@ -287,11 +317,11 @@ async init() {
         status  : result.pass ? 'PASS' : 'FAIL',
         message : result.message,
         data    : {
-          statusCode : result.statusCode,
+          statusCode  : result.statusCode,
           responseTime: result.responseTime,
-          contentType: result.contentType,
-          body       : result.body?.slice(0, 500),
-          headers    : result.headers,
+          contentType : result.contentType,
+          body        : result.body?.slice(0, 500),
+          headers     : result.headers,
         },
         url     : route.url,
         duration: result.responseTime,
@@ -308,7 +338,6 @@ async init() {
       }
     }
 
-    // Detect APIs from network traffic
     const discoveredAPIs = await this.#apiValidator.discoverFromNetworkLog(
       this.#session.networkLog
     );
@@ -338,7 +367,6 @@ async init() {
         },
       });
 
-      // Real screenshot on failure
       if (!result.pass || result.consoleErrors.length > 0) {
         const screenshot = await this.#screenshotter.capture(
           result.page,
@@ -346,7 +374,11 @@ async init() {
         );
         if (screenshot) {
           result.screenshotPath = screenshot;
-          this.#session.screenshots.push({ url: route.url, path: screenshot, reason: result.failReason });
+          this.#session.screenshots.push({
+            url   : route.url,
+            path  : screenshot,
+            reason: result.failReason,
+          });
         }
       }
 
@@ -354,26 +386,27 @@ async init() {
         name    : `Page: ${route.url}`,
         type    : 'browser',
         category: 'interaction',
-        status  : result.pass ? (result.consoleErrors.length > 0 ? 'FLAKY' : 'PASS') : 'FAIL',
+        status  : result.pass
+          ? (result.consoleErrors.length > 0 ? 'FLAKY' : 'PASS')
+          : 'FAIL',
         message : result.message,
         data    : {
-          loadTime      : result.loadTime,
-          consoleErrors : result.consoleErrors,
-          networkErrors : result.networkErrors,
+          loadTime          : result.loadTime,
+          consoleErrors     : result.consoleErrors,
+          networkErrors     : result.networkErrors,
           interactedElements: result.interactedElements,
-          screenshotPath: result.screenshotPath,
-          jsErrors      : result.jsErrors,
-          resourcesFailed: result.resourcesFailed,
-          renderTime    : result.renderTime,
-          domContentLoaded: result.domContentLoaded,
+          screenshotPath    : result.screenshotPath,
+          jsErrors          : result.jsErrors,
+          resourcesFailed   : result.resourcesFailed,
+          renderTime        : result.renderTime,
+          domContentLoaded  : result.domContentLoaded,
         },
-        url     : route.url,
-        duration: result.loadTime,
+        url          : route.url,
+        duration     : result.loadTime,
         screenshotPath: result.screenshotPath,
       });
 
-      // Real console errors → bugs
-      for (const err of result.consoleErrors) {
+      for (const err of (result.consoleErrors || [])) {
         this.#session.addBug({
           title      : `JS Error: ${err.text?.slice(0, 80)}`,
           severity   : err.type === 'error' ? 'P1' : 'P2',
@@ -384,8 +417,7 @@ async init() {
         });
       }
 
-      // Real network failures → bugs
-      for (const nErr of result.networkErrors) {
+      for (const nErr of (result.networkErrors || [])) {
         this.#session.addBug({
           title      : `Network Failure: ${nErr.url}`,
           severity   : 'P2',
@@ -396,12 +428,10 @@ async init() {
         });
       }
 
-      // Test forms on the page
-      if (result.forms && result.forms.length > 0) {
+      if (result.forms?.length > 0) {
         await this.#testForms(route.url, result.forms, result.page);
       }
 
-      // Test auth flows
       if (this.#isAuthPage(route.url)) {
         await this.#testAuthFlow(route.url, result.page);
       }
@@ -424,19 +454,18 @@ async init() {
           status  : finding.pass ? 'PASS' : 'FAIL',
           message : finding.detail,
           data    : finding.evidence,
-          url,
-          label,
+          url, label,
           severity: finding.severity,
         });
 
         if (!finding.pass && (finding.severity === 'P0' || finding.severity === 'P1')) {
           this.#session.addBug({
-            title      : `Security: ${finding.check}`,
-            severity   : finding.severity,
-            type       : 'security',
-            description: finding.detail,
+            title         : `Security: ${finding.check}`,
+            severity      : finding.severity,
+            type          : 'security',
+            description   : finding.detail,
             url,
-            evidence   : finding.evidence,
+            evidence      : finding.evidence,
             recommendation: finding.recommendation,
           });
         }
@@ -452,20 +481,18 @@ async init() {
       const metrics = await this.#performance.profile(url);
       this.#session.perfMetrics[label] = metrics;
 
-      // Core Web Vitals as real test results
       const vitals = [
-        { name: 'LCP',  value: metrics.lcp,  threshold: 2500,  unit: 'ms' },
-        { name: 'FID',  value: metrics.fid,  threshold: 100,   unit: 'ms' },
-        { name: 'CLS',  value: metrics.cls,  threshold: 0.1,   unit: ''   },
-        { name: 'FCP',  value: metrics.fcp,  threshold: 1800,  unit: 'ms' },
-        { name: 'TTFB', value: metrics.ttfb, threshold: 800,   unit: 'ms' },
-        { name: 'TTI',  value: metrics.tti,  threshold: 3800,  unit: 'ms' },
-        { name: 'TBT',  value: metrics.tbt,  threshold: 200,   unit: 'ms' },
+        { name: 'LCP',  value: metrics.lcp,  threshold: 2500, unit: 'ms' },
+        { name: 'FID',  value: metrics.fid,  threshold: 100,  unit: 'ms' },
+        { name: 'CLS',  value: metrics.cls,  threshold: 0.1,  unit: ''   },
+        { name: 'FCP',  value: metrics.fcp,  threshold: 1800, unit: 'ms' },
+        { name: 'TTFB', value: metrics.ttfb, threshold: 800,  unit: 'ms' },
+        { name: 'TBT',  value: metrics.tbt,  threshold: 200,  unit: 'ms' },
       ];
 
       for (const vital of vitals) {
-        const pass = vital.value !== null && vital.value <= vital.threshold;
-        const na   = vital.value === null;
+        const na   = vital.value === null || vital.value === undefined;
+        const pass = !na && vital.value <= vital.threshold;
 
         this.#addResult({
           name    : `[${label}] ${vital.name} — Core Web Vital`,
@@ -473,38 +500,35 @@ async init() {
           category: 'web-vitals',
           status  : na ? 'SKIP' : (pass ? 'PASS' : 'FAIL'),
           message : na
-            ? `${vital.name} not measurable`
-            : `${vital.name}: ${vital.value}${vital.unit} (threshold: ${vital.threshold}${vital.unit})`,
-          data    : { value: vital.value, threshold: vital.threshold, unit: vital.unit },
-          url,
-          label,
+            ? `${vital.name} not measurable (HTTP-only mode)`
+            : `${vital.name}: ${vital.value}${vital.unit} (threshold: ≤${vital.threshold}${vital.unit})`,
+          data    : { value: vital.value, threshold: vital.threshold },
+          url, label,
           duration: vital.value,
         });
 
         if (!na && !pass) {
           this.#session.addBug({
-            title      : `Poor ${vital.name}: ${vital.value}${vital.unit} (>${vital.threshold}${vital.unit})`,
-            severity   : vital.name === 'LCP' || vital.name === 'CLS' ? 'P1' : 'P2',
-            type       : 'performance',
-            description: `${vital.name} exceeds threshold on ${label}`,
+            title         : `Poor ${vital.name}: ${vital.value}${vital.unit} (>${vital.threshold}${vital.unit})`,
+            severity      : (vital.name === 'LCP' || vital.name === 'CLS') ? 'P1' : 'P2',
+            type          : 'performance',
+            description   : `${vital.name} exceeds threshold on ${label}`,
             url,
-            evidence   : { value: vital.value, threshold: vital.threshold },
+            evidence      : { value: vital.value, threshold: vital.threshold },
             recommendation: `Optimize ${vital.name} — see https://web.dev/vitals`,
           });
         }
       }
 
-      // Real resource analysis
       for (const resource of (metrics.slowResources || [])) {
         this.#addResult({
-          name    : `[${label}] Slow resource: ${resource.url.split('/').pop()}`,
+          name    : `[${label}] Slow resource: ${resource.url?.split('/').pop()}`,
           type    : 'performance',
           category: 'resource',
           status  : 'FAIL',
           message : `${resource.url} took ${resource.duration}ms (${formatBytes(resource.size)})`,
           data    : resource,
-          url,
-          label,
+          url, label,
           duration: resource.duration,
         });
       }
@@ -524,7 +548,7 @@ async init() {
       const result = await this.#a11y.check(route.url);
       this.#session.a11yResults.push({ url: route.url, ...result });
 
-      for (const violation of result.violations) {
+      for (const violation of (result.violations || [])) {
         this.#addResult({
           name    : `A11y [${violation.impact}]: ${violation.description}`,
           type    : 'accessibility',
@@ -545,18 +569,17 @@ async init() {
 
         if (violation.impact === 'critical' || violation.impact === 'serious') {
           this.#session.addBug({
-            title      : `A11y: ${violation.description}`,
-            severity   : violation.impact === 'critical' ? 'P0' : 'P1',
-            type       : 'accessibility',
-            description: `${violation.nodes} element(s): ${violation.help}`,
-            url        : route.url,
-            evidence   : violation.affectedNodes,
+            title         : `A11y: ${violation.description}`,
+            severity      : violation.impact === 'critical' ? 'P0' : 'P1',
+            type          : 'accessibility',
+            description   : `${violation.nodes} element(s): ${violation.help}`,
+            url           : route.url,
+            evidence      : violation.affectedNodes,
             recommendation: violation.helpUrl,
           });
         }
       }
 
-      // Passes also recorded as real results
       for (const pass of (result.passes || []).slice(0, 5)) {
         this.#addResult({
           name    : `A11y Pass: ${pass.description}`,
@@ -584,7 +607,7 @@ async init() {
       const result = await this.#seo.scan(route.url);
       this.#session.seoResults.push({ url: route.url, ...result });
 
-      for (const check of result.checks) {
+      for (const check of (result.checks || [])) {
         this.#addResult({
           name    : `SEO: ${check.name} — ${new URL(route.url).pathname}`,
           type    : 'seo',
@@ -598,11 +621,11 @@ async init() {
 
         if (!check.pass && (check.severity === 'P0' || check.severity === 'P1')) {
           this.#session.addBug({
-            title      : `SEO: ${check.name}`,
-            severity   : check.severity,
-            type       : 'seo',
-            description: check.detail,
-            url        : route.url,
+            title         : `SEO: ${check.name}`,
+            severity      : check.severity,
+            type          : 'seo',
+            description   : check.detail,
+            url           : route.url,
             recommendation: check.recommendation,
           });
         }
@@ -616,16 +639,16 @@ async init() {
 
     for (const bug of this.#session.bugs) {
       const classification = await this.#aiClassifier.classify(bug, this.#session);
-      bug.aiSeverity     = classification.severity;
-      bug.aiCategory     = classification.category;
+      bug.aiSeverity       = classification.severity;
+      bug.aiCategory       = classification.category;
       bug.aiRecommendation = classification.recommendation;
-      bug.aiConfidence   = classification.confidence;
+      bug.aiConfidence     = classification.confidence;
     }
 
-    // Sort bugs by AI-determined severity
     this.#session.bugs.sort((a, b) => {
       const order = { P0: 0, P1: 1, P2: 2, P3: 3 };
-      return (order[a.aiSeverity || a.severity] || 3) - (order[b.aiSeverity || b.severity] || 3);
+      return (order[a.aiSeverity || a.severity] || 3)
+           - (order[b.aiSeverity || b.severity] || 3);
     });
   }
 
@@ -673,9 +696,9 @@ async init() {
 
     const result = await this.#interactor.testAuthFlow(page, url, {
       testCredentials: [
-        { username: 'test@example.com',  password: 'wrong-password-test', expectFail: true },
-        { username: 'invalid@test.com',  password: 'wrong123',            expectFail: true },
-        { username: '',                  password: '',                    expectFail: true },
+        { username: 'test@example.com', password: 'wrong-password-test', expectFail: true },
+        { username: 'invalid@test.com', password: 'wrong123',            expectFail: true },
+        { username: '',                 password: '',                    expectFail: true },
       ],
     });
 
@@ -706,7 +729,6 @@ async init() {
     return /\/(login|signin|auth|register|signup)/i.test(url);
   }
 
-  // ── Add real result ────────────────────────────────────────────────────
   #addResult(result) {
     const r = {
       id       : shortId(),
@@ -721,9 +743,9 @@ async init() {
   }
 }
 
-// ─────────────────────────────────────────────────────────────────────────
+// ═══════════════════════════════════════════════════════════════════════════
 //  Public API — exported functions
-// ─────────────────────────────────────────────────────────────────────────
+// ═══════════════════════════════════════════════════════════════════════════
 
 export async function initQASystem() {
   await fs.ensureDir(QA_DIR);
@@ -738,12 +760,12 @@ export async function saveSession(session) {
   const history = await loadHistory();
   const summary = session.getSummary();
   history.runs.unshift({
-    id       : session.id,
-    startedAt: session.startedAt,
-    urls     : session.urls,
+    id             : session.id,
+    startedAt      : session.startedAt,
+    urls           : session.urls,
     summary,
-    version  : VERSION,
-    bugCount : session.bugs.length,
+    version        : VERSION,
+    bugCount       : session.bugs.length,
     screenshotCount: session.screenshots.length,
   });
   if (history.runs.length > 100) history.runs = history.runs.slice(0, 100);
@@ -774,11 +796,8 @@ export async function runUrlQA({ localUrl, stagingUrl, prodUrl, options = {} } =
   await engine.run();
   await saveSession(session);
 
-  const htmlReporter = new HTMLReporter(session);
-  const jsonReporter = new JSONReporter(session);
-
-  const htmlPath = await htmlReporter.generate(REPORT_DIR);
-  const jsonPath = await jsonReporter.generate(REPORT_DIR);
+  const htmlPath = await new HTMLReporter(session).generate(REPORT_DIR);
+  const jsonPath = await new JSONReporter(session).generate(REPORT_DIR);
 
   return { session, htmlPath, jsonPath };
 }
@@ -832,12 +851,12 @@ export async function runManualQA() {
   const action = await p.select({
     message: 'Manual QA — what to run?',
     options: [
-      { value: 'full-url',  label: '🌐 Full URL-Based Real Scan', hint: 'Browser + API + Security + Perf + SEO + A11y' },
-      { value: 'security',  label: '🛡️  Security Only',           hint: 'Real HTTP security header + vuln scan'         },
-      { value: 'perf',      label: '⚡ Performance Only',          hint: 'Real Core Web Vitals measurement'             },
-      { value: 'a11y',      label: '♿ Accessibility Only',        hint: 'Real axe-core WCAG scan'                      },
-      { value: 'seo',       label: '🔎 SEO Only',                  hint: 'Real meta, og, robots, sitemap scan'          },
-      { value: 'api',       label: '📡 API Only',                  hint: 'Real endpoint probe + contract validation'    },
+      { value: 'full-url', label: '🌐 Full URL-Based Real Scan', hint: 'Browser + API + Security + Perf + SEO + A11y' },
+      { value: 'security', label: '🛡️  Security Only',           hint: 'Real HTTP security header + vuln scan'        },
+      { value: 'perf',     label: '⚡ Performance Only',          hint: 'Real Core Web Vitals measurement'            },
+      { value: 'a11y',     label: '♿ Accessibility Only',        hint: 'Real axe-core WCAG scan'                     },
+      { value: 'seo',      label: '🔎 SEO Only',                  hint: 'Real meta, og, robots, sitemap scan'         },
+      { value: 'api',      label: '📡 API Only',                  hint: 'Real endpoint probe + contract validation'   },
     ],
   });
   if (p.isCancel(action)) { p.cancel('Cancelled.'); return; }
@@ -861,8 +880,6 @@ export async function runManualQA() {
   const session = new QASession(urls);
   const engine  = new QAEngine(session);
   await engine.init();
-
-  // Only run selected phases
   await engine.runPhase(action);
 
   await saveSession(session);
@@ -881,8 +898,8 @@ export async function autoRunPostGeneration(options = {}) {
   console.log('');
 
   const url = await p.text({
-    message    : 'Server URL to validate:',
-    placeholder: 'http://localhost:3000',
+    message     : 'Server URL to validate:',
+    placeholder : 'http://localhost:3000',
     defaultValue: 'http://localhost:3000',
   });
   if (p.isCancel(url)) { p.cancel('Cancelled.'); return; }
@@ -907,7 +924,8 @@ export async function viewQAHistory() {
 
   for (const run of history.runs.slice(0, 15)) {
     const rate   = run.summary?.passRate ?? '–';
-    const color  = Number(rate) >= 90 ? chalk.green : Number(rate) >= 70 ? chalk.yellow : chalk.red;
+    const color  = Number(rate) >= 90 ? chalk.green
+                 : Number(rate) >= 70 ? chalk.yellow : chalk.red;
     const bugs   = run.bugCount ?? 0;
     const shots  = run.screenshotCount ?? 0;
     const urlStr = Object.values(run.urls || {}).filter(Boolean).join(', ');
@@ -939,7 +957,6 @@ export async function viewQAHistory() {
   const reportPath = path.join(REPORT_DIR, `${chosen.toLowerCase()}.html`);
   if (await fs.pathExists(reportPath)) {
     console.log(chalk.green(`  📄 Report: ${reportPath}`));
-    // Open in browser if possible
     try {
       const { exec } = await import('node:child_process');
       const cmd = process.platform === 'darwin' ? 'open'