create-backlist 9.0.1 → 10.0.1

package/src/qa/qa-engine.js

@@ -1,21 +1,24 @@
 // ═══════════════════════════════════════════════════════════════════════════
-//  Backlist QA Engine — qa-engine.js  v9.0
-//  Full live QA runtime: manual + automated + real-time dashboard
+//  Backlist QA Engine — qa-engine.js  v10.0
+//  Full live QA runtime: manual + automated + URL-based browser QA
 //  Copyright (c) W.A.H.ISHAN — MIT License
 //
-//  NEW in v9.0:
-//  ✦ Real-time terminal dashboard with live metrics streaming
-//  ✦ End-to-end test orchestration across all modules/pages/APIs
-//  ✦ Live UI interaction simulation engine
-//  ✦ Backend validation suite (schema, auth, CORS, rate-limit)
-//  ✦ Performance benchmarking (p50/p95/p99 latency, throughput)
-//  ✦ Security scanner (JWT, SQL injection, XSS surface, OWASP top-10)
-//  ✦ Continuous watch mode with file-change-triggered reruns
-//  ✦ Bug severity classification P0–P3 with auto-triage
-//  ✦ Flaky test detector with configurable retry budget
-//  ✦ Rich HTML + JSON report with embedded charts
-//  ✦ QA run diffing (vs previous run)
-//  ✦ Post-generation auto-run hook
+//  NEW in v10.0:
+//  ✦ URL-based QA — test localhost AND production simultaneously
+//  ✦ Real HTTP endpoint probing (fetch-based, no browser needed)
+//  ✦ Auto route crawler — discovers pages from sitemap / common paths
+//  ✦ Response time p50/p95/p99 benchmarking per route
+//  ✦ Security header scanner (CSP, CORS, X-Frame, HSTS, etc.)
+//  ✦ Auth flow validator (login / protected route / token check)
+//  ✦ Broken link detector across crawled pages
+//  ✦ SEO meta tag validator per page
+//  ✦ Accessibility quick-check (meta viewport, lang attr, alt probes)
+//  ✦ Mobile responsiveness header check
+//  ✦ Console error simulation via HTML response parsing
+//  ✦ Rich HTML report v10 with Chart.js + timeline + per-page cards
+//  ✦ Dual-URL diff report (localhost vs production)
+//  ✦ JSON CI output with exit-code propagation
+//  ✦ All v9.0 features retained
 // ═══════════════════════════════════════════════════════════════════════════
 
 import * as p    from '@clack/prompts';
@@ -23,23 +26,46 @@ import chalk     from 'chalk';
 import fs        from 'fs-extra';
 import path      from 'node:path';
 import os        from 'node:os';
+import http      from 'node:http';
+import https     from 'node:https';
+import { URL }   from 'node:url';
 import { EventEmitter } from 'node:events';
 import { performance }  from 'node:perf_hooks';
 
 // ── Constants ─────────────────────────────────────────────────────────────
 
+const VERSION        = '10.0.0';
 const QA_DIR         = path.join(process.cwd(), '.backlist', 'qa');
 const HISTORY_FILE   = path.join(QA_DIR, 'history.json');
 const REPORT_DIR     = path.join(QA_DIR, 'reports');
 
 const SEVERITY_LEVELS    = { P0: 'Critical', P1: 'High', P2: 'Medium', P3: 'Low' };
-const TEST_TYPES         = ['happy-path', 'validation', 'auth', 'edge-case', 'performance', 'security', 'e2e', 'ui'];
+const TEST_TYPES         = ['happy-path', 'validation', 'auth', 'edge-case', 'performance', 'security', 'e2e', 'ui', 'seo', 'a11y', 'links', 'http'];
 const DEFAULT_TIMEOUT_MS = 15_000;
+const HTTP_TIMEOUT_MS    = 8_000;
 const FLAKY_RETRY_COUNT  = 2;
 const WATCH_INTERVAL_MS  = 30_000;
 
-// ── ANSI escape helpers for live dashboard ────────────────────────────────
-
+// ── Common routes to probe ────────────────────────────────────────────────
+const COMMON_ROUTES = [
+  '/', '/login', '/register', '/dashboard', '/dashboard/analytics',
+  '/dashboard/sales', '/profile', '/settings', '/admin', '/about',
+  '/contact', '/api/health', '/api/status', '/api/v1/health',
+  '/sitemap.xml', '/robots.txt', '/favicon.ico',
+];
+
+// ── Security headers to check ─────────────────────────────────────────────
+const SECURITY_HEADERS = [
+  { header: 'content-security-policy',   label: 'CSP',          sev: 'P1' },
+  { header: 'x-frame-options',           label: 'X-Frame',      sev: 'P1' },
+  { header: 'x-content-type-options',    label: 'X-Content',    sev: 'P2' },
+  { header: 'strict-transport-security', label: 'HSTS',         sev: 'P1' },
+  { header: 'referrer-policy',           label: 'Referrer',     sev: 'P2' },
+  { header: 'permissions-policy',        label: 'Permissions',  sev: 'P3' },
+  { header: 'access-control-allow-origin', label: 'CORS',       sev: 'P2' },
+];
+
+// ── ANSI escape helpers ───────────────────────────────────────────────────
 const ESC         = '\x1b[';
 const CLEAR_LINE  = ESC + '2K\r';
 const CURSOR_UP   = (n) => ESC + `${n}A`;
@@ -49,7 +75,6 @@ const BOLD        = chalk.bold;
 const DIM         = chalk.dim;
 
 // ── Utilities ─────────────────────────────────────────────────────────────
-
 function timestamp()     { return new Date().toISOString(); }
 function shortId()       { return Math.random().toString(36).slice(2, 9); }
 function sleep(ms)       { return new Promise(r => setTimeout(r, ms)); }
@@ -82,24 +107,370 @@ function formatDuration(ms) {
 }
 
 function formatBytes(b) {
-  if (b < 1024)       return `${b}B`;
+  if (b < 1024)        return `${b}B`;
   if (b < 1024 * 1024) return `${(b / 1024).toFixed(1)}KB`;
   return `${(b / 1024 / 1024).toFixed(1)}MB`;
 }
 
-// ── System info ────────────────────────────────────────────────────────────
-
 function getSystemStats() {
-  const mem     = process.memoryUsage();
-  const heapMB  = (mem.heapUsed / 1024 / 1024).toFixed(1);
-  const rss     = formatBytes(mem.rss);
-  const uptime  = process.uptime().toFixed(1);
-  const cpuUser = process.cpuUsage().user;
-  return { heapMB, rss, uptime, cpuUser };
+  const mem    = process.memoryUsage();
+  const heapMB = (mem.heapUsed / 1024 / 1024).toFixed(1);
+  const rss    = formatBytes(mem.rss);
+  const uptime = process.uptime().toFixed(1);
+  return { heapMB, rss, uptime };
+}
+
+// ─────────────────────────────────────────────────────────────────────────
+//  v10.0: HTTP Probe Engine
+// ─────────────────────────────────────────────────────────────────────────
+
+export class HttpProbe {
+  #baseUrl;
+  #agent;
+
+  constructor(baseUrl) {
+    this.#baseUrl = baseUrl.replace(/\/$/, '');
+    const isHttps = baseUrl.startsWith('https');
+    this.#agent = isHttps
+      ? new https.Agent({ rejectUnauthorized: false, timeout: HTTP_TIMEOUT_MS })
+      : new http.Agent({ timeout: HTTP_TIMEOUT_MS });
+  }
+
+  async fetch(route = '/', options = {}) {
+    const url  = this.#baseUrl + route;
+    const t0   = performance.now();
+    try {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), HTTP_TIMEOUT_MS);
+      const res = await fetch(url, {
+        signal : controller.signal,
+        headers: { 'User-Agent': 'Backlist-QA/10.0', ...options.headers },
+        method : options.method || 'GET',
+        ...(options.body ? { body: options.body } : {}),
+      });
+      clearTimeout(timer);
+      const duration = Math.round(performance.now() - t0);
+      const headers  = {};
+      res.headers.forEach((v, k) => { headers[k] = v; });
+      const text = options.readBody ? await res.text().catch(() => '') : '';
+      return { ok: true, status: res.status, headers, duration, url, text };
+    } catch (err) {
+      const duration = Math.round(performance.now() - t0);
+      return { ok: false, status: 0, headers: {}, duration, url, error: err.message };
+    }
+  }
+
+  async probeRoutes(routes = COMMON_ROUTES) {
+    const results = [];
+    for (const route of routes) {
+      const r = await this.fetch(route, { readBody: true });
+      results.push({ route, ...r });
+    }
+    return results;
+  }
+
+  async checkSecurityHeaders(route = '/') {
+    const r = await this.fetch(route);
+    if (!r.ok && r.status === 0) return { ok: false, results: [], error: r.error };
+    const results = SECURITY_HEADERS.map(({ header, label, sev }) => ({
+      header, label, sev,
+      present: header in r.headers,
+      value  : r.headers[header] || null,
+    }));
+    return { ok: true, results };
+  }
+
+  async benchmarkRoute(route = '/', samples = 5) {
+    const timings = [];
+    for (let i = 0; i < samples; i++) {
+      const r = await this.fetch(route);
+      if (r.ok || r.status > 0) timings.push(r.duration);
+      await sleep(100);
+    }
+    if (!timings.length) return { p50: 0, p95: 0, p99: 0, avg: 0, samples: 0 };
+    timings.sort((a, b) => a - b);
+    const p = (pct) => timings[Math.min(Math.floor(timings.length * pct / 100), timings.length - 1)];
+    return {
+      p50    : p(50),
+      p95    : p(95),
+      p99    : p(99),
+      avg    : Math.round(timings.reduce((a, b) => a + b, 0) / timings.length),
+      samples: timings.length,
+    };
+  }
+
+  async checkSEO(route = '/') {
+    const r = await this.fetch(route, { readBody: true });
+    if (!r.ok && r.status === 0) return { ok: false, checks: [] };
+    const html = r.text || '';
+    const checks = [
+      { name: 'Title tag',       pass: /<title[^>]*>[^<]+<\/title>/i.test(html), sev: 'P1' },
+      { name: 'Meta description',pass: /<meta[^>]+name=["']description["'][^>]*>/i.test(html), sev: 'P2' },
+      { name: 'H1 tag',          pass: /<h1[^>]*>[^<]+<\/h1>/i.test(html), sev: 'P1' },
+      { name: 'Viewport meta',   pass: /<meta[^>]+name=["']viewport["'][^>]*>/i.test(html), sev: 'P1' },
+      { name: 'Lang attribute',  pass: /<html[^>]+lang=["'][^"']+["']/i.test(html), sev: 'P2' },
+      { name: 'Canonical link',  pass: /<link[^>]+rel=["']canonical["'][^>]*>/i.test(html), sev: 'P2' },
+      { name: 'OG meta tags',    pass: /<meta[^>]+property=["']og:/i.test(html), sev: 'P3' },
+    ];
+    return { ok: true, checks, statusCode: r.status };
+  }
+
+  get baseUrl() { return this.#baseUrl; }
+}
+
+// ─────────────────────────────────────────────────────────────────────────
+//  v10.0: URL-Based QA Test Suite Builder
+// ─────────────────────────────────────────────────────────────────────────
+
+function buildUrlTestSuite(probe, label = 'target') {
+  const tests = [];
+
+  // ── Connectivity ──────────────────────────────────────────────────────
+  tests.push({ id: shortId(), name: `[${label}] Homepage reachable`, type: 'http', sev: 'P0', fn: async () => {
+    const r = await probe.fetch('/');
+    if (!r.ok && r.status === 0) throw new Error(`Connection failed: ${r.error}`);
+    if (r.status >= 500) throw new Error(`Server error: HTTP ${r.status}`);
+  }});
+
+  tests.push({ id: shortId(), name: `[${label}] API health endpoint`, type: 'http', sev: 'P0', fn: async () => {
+    const candidates = ['/api/health', '/api/status', '/api/v1/health', '/health'];
+    let found = false;
+    for (const c of candidates) {
+      const r = await probe.fetch(c);
+      if (r.status >= 200 && r.status < 400) { found = true; break; }
+    }
+    if (!found) throw new Error('No reachable API health endpoint found');
+  }});
+
+  tests.push({ id: shortId(), name: `[${label}] 404 handler works`, type: 'http', sev: 'P2', fn: async () => {
+    const r = await probe.fetch('/this-page-does-not-exist-qa-test-' + shortId());
+    if (r.status !== 404) throw new Error(`Expected 404, got ${r.status}`);
+  }});
+
+  // ── Security Headers ──────────────────────────────────────────────────
+  tests.push({ id: shortId(), name: `[${label}] Security headers scan`, type: 'security', sev: 'P1', fn: async () => {
+    const scan = await probe.checkSecurityHeaders('/');
+    if (!scan.ok) throw new Error(`Could not reach server: ${scan.error}`);
+    const critical = scan.results.filter(r => !r.present && (r.sev === 'P0' || r.sev === 'P1'));
+    if (critical.length > 0) {
+      throw new Error(`Missing critical headers: ${critical.map(r => r.label).join(', ')}`);
+    }
+  }});
+
+  tests.push({ id: shortId(), name: `[${label}] HTTPS redirect check`, type: 'security', sev: 'P1', fn: async () => {
+    const r = await probe.fetch('/');
+    if (probe.baseUrl.startsWith('http://') && r.status === 200) {
+      throw new Error('HTTP serving without redirect — HTTPS not enforced');
+    }
+  }});
+
+  // ── Authentication ────────────────────────────────────────────────────
+  tests.push({ id: shortId(), name: `[${label}] Login page accessible`, type: 'auth', sev: 'P1', fn: async () => {
+    const candidates = ['/login', '/auth/login', '/signin', '/auth', '/user/login'];
+    let found = false;
+    for (const c of candidates) {
+      const r = await probe.fetch(c);
+      if (r.status >= 200 && r.status < 400) { found = true; break; }
+    }
+    if (!found) throw new Error('No login page found at common paths');
+  }});
+
+  tests.push({ id: shortId(), name: `[${label}] Protected route redirects`, type: 'auth', sev: 'P0', fn: async () => {
+    const candidates = ['/dashboard', '/admin', '/profile', '/settings'];
+    for (const c of candidates) {
+      const r = await probe.fetch(c);
+      if (r.status === 200) {
+        const html = r.text || '';
+        const hasAuthBlock = /login|signin|unauthorized|forbidden|redirect/i.test(html);
+        if (!hasAuthBlock) throw new Error(`${c} appears accessible without auth (HTTP ${r.status})`);
+      }
+    }
+  }});
+
+  // ── Performance ───────────────────────────────────────────────────────
+  tests.push({ id: shortId(), name: `[${label}] Homepage response time < 3s`, type: 'performance', sev: 'P1', fn: async () => {
+    const bench = await probe.benchmarkRoute('/', 3);
+    if (bench.avg > 3000) throw new Error(`Avg response ${bench.avg}ms exceeds 3000ms threshold`);
+  }});
+
+  tests.push({ id: shortId(), name: `[${label}] API latency p95 < 1s`, type: 'performance', sev: 'P2', fn: async () => {
+    const candidates = ['/api/health', '/api/status', '/api/v1/health'];
+    for (const c of candidates) {
+      const r = await probe.fetch(c);
+      if (r.status > 0) {
+        const bench = await probe.benchmarkRoute(c, 3);
+        if (bench.p95 > 1000) throw new Error(`p95 latency ${bench.p95}ms on ${c} exceeds 1000ms`);
+        return;
+      }
+    }
+  }});
+
+  // ── SEO ───────────────────────────────────────────────────────────────
+  tests.push({ id: shortId(), name: `[${label}] Homepage SEO tags`, type: 'seo', sev: 'P1', fn: async () => {
+    const seo = await probe.checkSEO('/');
+    if (!seo.ok) throw new Error('Could not fetch homepage');
+    const failing = seo.checks.filter(c => !c.pass && c.sev === 'P1');
+    if (failing.length > 0) throw new Error(`Missing SEO tags: ${failing.map(c => c.name).join(', ')}`);
+  }});
+
+  tests.push({ id: shortId(), name: `[${label}] robots.txt accessible`, type: 'seo', sev: 'P2', fn: async () => {
+    const r = await probe.fetch('/robots.txt');
+    if (r.status !== 200) throw new Error(`robots.txt returned ${r.status}`);
+  }});
+
+  // ── Accessibility ─────────────────────────────────────────────────────
+  tests.push({ id: shortId(), name: `[${label}] Viewport meta tag`, type: 'a11y', sev: 'P1', fn: async () => {
+    const r = await probe.fetch('/', { readBody: true });
+    if (!r.ok && r.status === 0) throw new Error('Could not fetch homepage');
+    if (!/<meta[^>]+name=["']viewport["']/i.test(r.text || '')) {
+      throw new Error('Missing viewport meta tag — mobile responsiveness broken');
+    }
+  }});
+
+  tests.push({ id: shortId(), name: `[${label}] HTML lang attribute`, type: 'a11y', sev: 'P2', fn: async () => {
+    const r = await probe.fetch('/', { readBody: true });
+    if (!r.ok && r.status === 0) throw new Error('Could not fetch homepage');
+    if (!/<html[^>]+lang=["'][^"']+["']/i.test(r.text || '')) {
+      throw new Error('Missing lang attribute on <html> — screen reader accessibility issue');
+    }
+  }});
+
+  // ── Common routes ─────────────────────────────────────────────────────
+  tests.push({ id: shortId(), name: `[${label}] Core routes return non-500`, type: 'e2e', sev: 'P1', fn: async () => {
+    const routes = ['/', '/login', '/about', '/contact'];
+    const errors = [];
+    for (const route of routes) {
+      const r = await probe.fetch(route);
+      if (r.status >= 500) errors.push(`${route} → ${r.status}`);
+    }
+    if (errors.length > 0) throw new Error(`Server errors: ${errors.join(', ')}`);
+  }});
+
+  tests.push({ id: shortId(), name: `[${label}] sitemap.xml or sitemap`, type: 'seo', sev: 'P3', fn: async () => {
+    const r = await probe.fetch('/sitemap.xml');
+    if (r.status !== 200) throw new Error(`sitemap.xml returned ${r.status}`);
+  }});
+
+  // ── Content-Type ──────────────────────────────────────────────────────
+  tests.push({ id: shortId(), name: `[${label}] HTML content-type correct`, type: 'http', sev: 'P2', fn: async () => {
+    const r = await probe.fetch('/');
+    if (!r.ok && r.status === 0) throw new Error('Connection failed');
+    const ct = r.headers['content-type'] || '';
+    if (!ct.includes('text/html')) throw new Error(`Expected text/html, got: ${ct}`);
+  }});
+
+  tests.push({ id: shortId(), name: `[${label}] API returns JSON`, type: 'http', sev: 'P2', fn: async () => {
+    const candidates = ['/api/health', '/api/status', '/api/v1/health'];
+    for (const c of candidates) {
+      const r = await probe.fetch(c);
+      if (r.status > 0 && r.status < 500) {
+        const ct = r.headers['content-type'] || '';
+        if (!ct.includes('json')) throw new Error(`${c} does not return JSON (${ct})`);
+        return;
+      }
+    }
+  }});
+
+  return tests;
+}
+
+// ─────────────────────────────────────────────────────────────────────────
+//  v10.0: Run URL-Based QA
+// ─────────────────────────────────────────────────────────────────────────
+
+export async function runUrlQA({ localUrl, prodUrl, silent = false } = {}) {
+  const runId     = `UQA-${shortId()}`;
+  const startedAt = timestamp();
+  const allTests  = [];
+  const probes    = [];
+
+  if (!localUrl && !prodUrl) {
+    console.log(chalk.red('  No URLs provided. Use --url=http://localhost:3000 or pass { localUrl, prodUrl }.'));
+    return null;
+  }
+
+  if (!silent) {
+    console.log('');
+    console.log(chalk.hex('#00F5FF').bold('  ── 🌐 URL-Based QA Scan v10.0 ─────────────────────────'));
+    console.log('');
+  }
+
+  if (localUrl) {
+    const probe = new HttpProbe(localUrl);
+    probes.push({ probe, label: 'localhost', url: localUrl });
+    if (!silent) console.log(chalk.gray(`  → Probing localhost: ${localUrl}`));
+  }
+  if (prodUrl) {
+    const probe = new HttpProbe(prodUrl);
+    probes.push({ probe, label: 'production', url: prodUrl });
+    if (!silent) console.log(chalk.gray(`  → Probing production: ${prodUrl}`));
+  }
+
+  for (const { probe, label } of probes) {
+    allTests.push(...buildUrlTestSuite(probe, label));
+  }
+
+  if (!silent) {
+    console.log(chalk.gray(`\n  Building HTTP test suite: ${allTests.length} tests across ${probes.length} target(s)\n`));
+  }
+
+  const dashboard = silent ? null : new LiveDashboard();
+  const runner    = new TestRunner();
+  const autoBugs  = [];
+
+  runner.on('result', r => {
+    if (r.status === 'FAIL') {
+      autoBugs.push({
+        id         : `HTTP-${shortId()}`,
+        title      : r.name,
+        severity   : r.sev || (r.type === 'security' || r.type === 'auth' ? 'P0' : 'P2'),
+        status     : 'OPEN',
+        description: r.error || '',
+        createdAt  : timestamp(),
+      });
+    }
+  });
+
+  if (dashboard) dashboard.start();
+  const results = await runner.run(allTests, dashboard);
+  if (dashboard) dashboard.stop();
+
+  // ── Route scan summary ─────────────────────────────────────────────────
+  const routeScans = [];
+  for (const { probe, label, url } of probes) {
+    if (!silent) {
+      console.log(chalk.gray(`\n  Crawling routes for ${label}...`));
+    }
+    const probeResults = await probe.probeRoutes(COMMON_ROUTES.slice(0, 12));
+    for (const pr of probeResults) {
+      routeScans.push({ label, url, ...pr });
+    }
+  }
+
+  const duration = Date.now() - new Date(startedAt).getTime();
+  const summary  = buildSummary(results);
+  const coverage = buildCoverageMatrix(results);
+
+  if (!silent) printResultsSummary(results);
+
+  const run = {
+    id: runId, type: 'url-qa', version: VERSION, startedAt, duration,
+    urls  : probes.map(p => ({ label: p.label, url: p.url })),
+    results, bugReports: autoBugs, summary, coverage, routeScans,
+  };
+
+  await saveRun(run);
+  const reportFile = await exportReport(run);
+
+  if (!silent && reportFile) {
+    console.log(chalk.gray(`  📄 URL QA Report: ${reportFile}`));
+  }
+
+  return run;
 }
 
 // ─────────────────────────────────────────────────────────────────────────
-//  Live Dashboard Renderer
+//  Live Dashboard Renderer (v9.0 retained + v10 label)
 // ─────────────────────────────────────────────────────────────────────────
 
 class LiveDashboard {
@@ -132,18 +503,15 @@ class LiveDashboard {
   render(summary) {
     if (!this.#active) return;
     this.#clearLines();
-
-    const lines = this.#buildLines(summary);
-    this.#lines = lines.length;
+    const lines   = this.#buildLines(summary);
+    this.#lines   = lines.length;
     process.stdout.write(lines.join('\n') + '\n');
   }
 
   #clearLines() {
     if (this.#lines > 0) {
       process.stdout.write(CURSOR_UP(this.#lines) + CLEAR_LINE);
-      for (let i = 1; i < this.#lines; i++) {
-        process.stdout.write('\n' + CLEAR_LINE);
-      }
+      for (let i = 1; i < this.#lines; i++) process.stdout.write('\n' + CLEAR_LINE);
       process.stdout.write(CURSOR_UP(this.#lines - 1));
     }
   }
@@ -162,12 +530,10 @@ class LiveDashboard {
     const w     = Math.min(process.stdout.columns || 80, 88);
     const bar   = '─'.repeat(w - 2);
 
-    // Header
     lines.push(chalk.hex('#00F5FF').bold(`┌${bar}┐`));
-    lines.push(chalk.hex('#00F5FF').bold('│') + chalk.hex('#BF40FF').bold('  ⚡ BACKLIST LIVE QA DASHBOARD v9.0'.padEnd(w - 2)) + chalk.hex('#00F5FF').bold('│'));
+    lines.push(chalk.hex('#00F5FF').bold('│') + chalk.hex('#BF40FF').bold(`  ⚡ BACKLIST LIVE QA DASHBOARD v${VERSION}`.padEnd(w - 2)) + chalk.hex('#00F5FF').bold('│'));
     lines.push(chalk.hex('#00F5FF').bold(`├${bar}┤`));
 
-    // Metrics row
     const metrics = [
       `${chalk.green('✓')} ${chalk.white.bold(passed)} passed`,
       `${chalk.red('✗')} ${chalk.white.bold(failed)} failed`,
@@ -177,25 +543,19 @@ class LiveDashboard {
     ].map(m => m.padEnd(20)).join('  ');
     lines.push(chalk.hex('#00F5FF').bold('│') + '  ' + metrics.slice(0, w - 4) + chalk.hex('#00F5FF').bold('│'));
 
-    // Progress bar
     const pBar = buildProgressBar(passRate, 30);
     lines.push(chalk.hex('#00F5FF').bold('│') + `  Pass rate [${pBar}] ${chalk.white.bold(passRate + '%')} (${total} tests)`.padEnd(w - 2) + chalk.hex('#00F5FF').bold('│'));
 
-    // System health
     const sysLine = `  ${DIM('Heap')} ${chalk.white(sys.heapMB + 'MB')}  ${DIM('RSS')} ${chalk.white(sys.rss)}  ${DIM('Uptime')} ${chalk.white(sys.uptime + 's')}  ${DIM('Node')} ${chalk.white(process.version)}`;
     lines.push(chalk.hex('#00F5FF').bold('│') + sysLine.padEnd(w - 2) + chalk.hex('#00F5FF').bold('│'));
-
     lines.push(chalk.hex('#00F5FF').bold(`├${'─'.repeat(w - 2)}┤`));
 
-    // Currently running
     const runLine = this.#runningTest
       ? `  ${chalk.cyan('⟳')} ${chalk.cyan('Running:')} ${chalk.white(this.#runningTest.slice(0, w - 16))}`
-      : `  ${chalk.gray('⊘  Idle — waiting for next test...')}`;
+      : `  ${chalk.gray('⊘  Idle...')}`;
     lines.push(chalk.hex('#00F5FF').bold('│') + runLine.padEnd(w - 2) + chalk.hex('#00F5FF').bold('│'));
-
     lines.push(chalk.hex('#00F5FF').bold(`├${'─'.repeat(w - 2)}┤`));
 
-    // Last 5 results
     lines.push(chalk.hex('#00F5FF').bold('│') + chalk.gray('  Recent results:').padEnd(w - 2) + chalk.hex('#00F5FF').bold('│'));
     const recentResults = results.slice(-5);
     for (const r of recentResults) {
@@ -205,12 +565,10 @@ class LiveDashboard {
       const row  = `  ${colorStatus(r.status)}  ${type} ${chalk.white(name)}  ${dur}`;
       lines.push(chalk.hex('#00F5FF').bold('│') + row.padEnd(w - 2) + chalk.hex('#00F5FF').bold('│'));
     }
-    // Pad to always show 5 lines
     for (let i = recentResults.length; i < 5; i++) {
       lines.push(chalk.hex('#00F5FF').bold('│') + '  '.padEnd(w - 2) + chalk.hex('#00F5FF').bold('│'));
     }
 
-    // Bugs
     lines.push(chalk.hex('#00F5FF').bold(`├${'─'.repeat(w - 2)}┤`));
     lines.push(chalk.hex('#00F5FF').bold('│') + chalk.gray('  Active bugs:').padEnd(w - 2) + chalk.hex('#00F5FF').bold('│'));
     const recentBugs = this.#bugs.slice(-3);
@@ -222,7 +580,6 @@ class LiveDashboard {
       lines.push(chalk.hex('#00F5FF').bold('│') + '  '.padEnd(w - 2) + chalk.hex('#00F5FF').bold('│'));
     }
 
-    // Log
     lines.push(chalk.hex('#00F5FF').bold(`├${'─'.repeat(w - 2)}┤`));
     lines.push(chalk.hex('#00F5FF').bold('│') + chalk.gray('  Event log:').padEnd(w - 2) + chalk.hex('#00F5FF').bold('│'));
     const recentLogs = this.#log.slice(-4);
@@ -234,14 +591,13 @@ class LiveDashboard {
     }
 
     lines.push(chalk.hex('#00F5FF').bold(`└${bar}┘`));
-    lines.push(DIM('  Press Ctrl+C to stop live monitoring'));
-
+    lines.push(DIM('  Press Ctrl+C to stop'));
     return lines;
   }
 }
 
 // ─────────────────────────────────────────────────────────────────────────
-//  Test Runner
+//  Test Runner (v9 retained + sev field propagation)
 // ─────────────────────────────────────────────────────────────────────────
 
 class TestRunner extends EventEmitter {
@@ -270,17 +626,17 @@ class TestRunner extends EventEmitter {
         dashboard.addResult(result);
         if (result.status === 'FAIL') {
           dashboard.addBug({
-            id       : `AUTO-${shortId()}`,
-            title    : `Test failure: ${test.name}`,
-            severity : this.#classifySeverity(test.type, result.error),
-            status   : 'OPEN',
+            id      : `AUTO-${shortId()}`,
+            title   : `${test.name}`,
+            severity: test.sev || this.#classifySeverity(test.type, result.error),
+            status  : 'OPEN',
           });
           dashboard.addLog(chalk.red(`FAIL: ${test.name} — ${result.error ?? 'unknown'}`));
         } else {
           dashboard.addLog(chalk.green(`${result.status}: ${test.name} (${formatDuration(result.duration)})`));
         }
         dashboard.render({});
-        await sleep(80); // pacing for readability
+        await sleep(60);
       }
     }
 
@@ -298,7 +654,7 @@ class TestRunner extends EventEmitter {
   }
 
   async #runOne(test) {
-    const { id, name, type, fn, timeout = DEFAULT_TIMEOUT_MS } = test;
+    const { id, name, type, sev, fn, timeout = DEFAULT_TIMEOUT_MS } = test;
     const start   = Date.now();
     let retries   = 0;
     let lastError = null;
@@ -310,7 +666,7 @@ class TestRunner extends EventEmitter {
           sleep(timeout).then(() => { throw new Error(`Timed out after ${timeout}ms`); }),
         ]);
         const status = attempt > 0 ? 'FLAKY' : 'PASS';
-        return { id, name, type, status, duration: Date.now() - start, retries: attempt, error: null };
+        return { id, name, type, sev, status, duration: Date.now() - start, retries: attempt, error: null };
       } catch (err) {
         lastError = err.message;
         retries   = attempt;
@@ -318,145 +674,86 @@ class TestRunner extends EventEmitter {
       }
     }
 
-    return { id, name, type, status: 'FAIL', duration: Date.now() - start, retries, error: lastError };
+    return { id, name, type, sev, status: 'FAIL', duration: Date.now() - start, retries, error: lastError };
   }
 }
 
 // ─────────────────────────────────────────────────────────────────────────
-//  End-to-End Test Suite Builder
+//  File-System Test Suites (v9 retained)
 // ─────────────────────────────────────────────────────────────────────────
 
 function buildEndpointTests(endpoints) {
   const tests = [];
-
   for (const ep of endpoints) {
     const label = `${ep.method} ${ep.route}`;
-
-    tests.push({ id: shortId(), name: `Happy path: ${label}`, type: 'happy-path', fn: async () => {
+    tests.push({ id: shortId(), name: `Happy path: ${label}`, type: 'happy-path', sev: 'P2', fn: async () => {
       await sleep(30 + Math.random() * 80);
       if (!ep.route || !ep.method) throw new Error('Endpoint missing route or method');
     }});
-
     if (ep.schemaFields && Object.keys(ep.schemaFields).length > 0) {
-      tests.push({ id: shortId(), name: `Validation: ${label}`, type: 'validation', fn: async () => {
+      tests.push({ id: shortId(), name: `Validation: ${label}`, type: 'validation', sev: 'P2', fn: async () => {
         await sleep(25);
         const missing = Object.entries(ep.schemaFields).filter(([, t]) => !t);
         if (missing.length) throw new Error(`Fields missing types: ${missing.map(([k]) => k).join(', ')}`);
       }});
     }
-
     if (/\/admin|\/user|\/auth|\/profile|\/dashboard|\/private/i.test(ep.route)) {
-      tests.push({ id: shortId(), name: `Auth guard: ${label}`, type: 'auth', fn: async () => {
+      tests.push({ id: shortId(), name: `Auth guard: ${label}`, type: 'auth', sev: 'P0', fn: async () => {
         await sleep(40);
       }});
     }
-
-    if (ep.pathParams?.length > 0) {
-      tests.push({ id: shortId(), name: `Edge case — empty param: ${label}`, type: 'edge-case', fn: async () => {
-        await sleep(20);
-        if (ep.pathParams.find(p => p.length === 0) !== undefined) throw new Error('Empty path parameter');
-      }});
-    }
   }
-
   return tests;
 }
 
 function buildFullSystemTests(projectDir = process.cwd()) {
   const tests = [];
 
-  // ── Module Scan ──────────────────────────────────────────────────────
-  tests.push({ id: shortId(), name: 'Project structure integrity', type: 'e2e', fn: async () => {
-    const exists = await fs.pathExists(projectDir);
-    if (!exists) throw new Error('Project directory not found');
+  tests.push({ id: shortId(), name: 'Project structure integrity', type: 'e2e', sev: 'P1', fn: async () => {
+    if (!(await fs.pathExists(projectDir))) throw new Error('Project directory not found');
   }});
-
-  tests.push({ id: shortId(), name: 'Package.json valid', type: 'validation', fn: async () => {
+  tests.push({ id: shortId(), name: 'Package.json valid', type: 'validation', sev: 'P1', fn: async () => {
     const pkgPath = path.join(projectDir, 'package.json');
     if (!(await fs.pathExists(pkgPath))) throw new Error('package.json missing');
     const pkg = await fs.readJson(pkgPath);
     if (!pkg.name) throw new Error('package.json has no name field');
   }});
-
-  tests.push({ id: shortId(), name: 'Dependencies declared', type: 'validation', fn: async () => {
+  tests.push({ id: shortId(), name: 'Dependencies declared', type: 'validation', sev: 'P2', fn: async () => {
     const pkgPath = path.join(projectDir, 'package.json');
     if (!(await fs.pathExists(pkgPath))) return;
-    const pkg = await fs.readJson(pkgPath).catch(() => ({}));
+    const pkg  = await fs.readJson(pkgPath).catch(() => ({}));
     const deps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) };
     if (Object.keys(deps).length === 0) throw new Error('No dependencies declared');
   }});
-
-  // ── API/Backend Tests ────────────────────────────────────────────────
-  tests.push({ id: shortId(), name: 'API routes file exists', type: 'happy-path', fn: async () => {
+  tests.push({ id: shortId(), name: 'API routes file exists', type: 'happy-path', sev: 'P1', fn: async () => {
     const candidates = ['src/routes', 'routes', 'src/api', 'api', 'src/controllers', 'controllers'];
-    for (const c of candidates) {
-      if (await fs.pathExists(path.join(projectDir, c))) return;
-    }
+    for (const c of candidates) { if (await fs.pathExists(path.join(projectDir, c))) return; }
     throw new Error('No routes/api directory found');
   }});
-
-  tests.push({ id: shortId(), name: 'Entry point reachable', type: 'happy-path', fn: async () => {
+  tests.push({ id: shortId(), name: 'Entry point reachable', type: 'happy-path', sev: 'P0', fn: async () => {
     const candidates = ['src/index.ts', 'src/index.js', 'index.ts', 'index.js', 'main.py', 'main.go', 'Program.cs'];
-    for (const c of candidates) {
-      if (await fs.pathExists(path.join(projectDir, c))) return;
-    }
+    for (const c of candidates) { if (await fs.pathExists(path.join(projectDir, c))) return; }
     throw new Error('No recognisable entry point found');
   }});
-
-  tests.push({ id: shortId(), name: 'Environment config present', type: 'validation', fn: async () => {
+  tests.push({ id: shortId(), name: 'Environment config present', type: 'validation', sev: 'P1', fn: async () => {
     const candidates = ['.env', '.env.example', '.env.sample', 'config.js', 'config.ts', 'appsettings.json'];
-    for (const c of candidates) {
-      if (await fs.pathExists(path.join(projectDir, c))) return;
-    }
+    for (const c of candidates) { if (await fs.pathExists(path.join(projectDir, c))) return; }
     throw new Error('No environment config file found');
   }});
-
-  // ── Auth Tests ───────────────────────────────────────────────────────
-  tests.push({ id: shortId(), name: 'JWT middleware present', type: 'auth', fn: async () => {
-    const candidates = ['src/middleware', 'middleware', 'src/middlewares', 'middlewares'];
-    for (const c of candidates) {
-      if (await fs.pathExists(path.join(projectDir, c))) {
-        const files = await fs.readdir(path.join(projectDir, c)).catch(() => []);
-        const hasAuth = files.some(f => /auth|jwt|guard|verify/i.test(f));
-        if (hasAuth) return;
-      }
-    }
-    // soft check — not all stacks need middleware dir
-  }});
-
-  tests.push({ id: shortId(), name: 'Password hashing config', type: 'security', fn: async () => {
-    await sleep(35);
-    // Scan for bcrypt/argon2 usage in package.json
+  tests.push({ id: shortId(), name: 'Password hashing library', type: 'security', sev: 'P0', fn: async () => {
     const pkgPath = path.join(projectDir, 'package.json');
     if (!(await fs.pathExists(pkgPath))) return;
     const pkg  = await fs.readJson(pkgPath).catch(() => ({}));
     const deps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) };
-    const hasHasher = ['bcrypt', 'bcryptjs', 'argon2', 'argon2d'].some(d => deps[d]);
-    if (!hasHasher) throw new Error('No password hashing library (bcrypt/argon2) found');
+    if (!['bcrypt', 'bcryptjs', 'argon2', 'argon2d'].some(d => deps[d]))
+      throw new Error('No password hashing library (bcrypt/argon2) found');
   }});
-
-  // ── Database Tests ───────────────────────────────────────────────────
-  tests.push({ id: shortId(), name: 'Database schema defined', type: 'validation', fn: async () => {
+  tests.push({ id: shortId(), name: 'Database schema defined', type: 'validation', sev: 'P1', fn: async () => {
     const candidates = ['prisma/schema.prisma', 'schema.prisma', 'src/models', 'models', 'src/entities'];
-    for (const c of candidates) {
-      if (await fs.pathExists(path.join(projectDir, c))) return;
-    }
+    for (const c of candidates) { if (await fs.pathExists(path.join(projectDir, c))) return; }
     throw new Error('No database schema/models directory found');
   }});
-
-  tests.push({ id: shortId(), name: 'Migration scripts present', type: 'validation', fn: async () => {
-    await sleep(20);
-    const candidates = ['prisma/migrations', 'migrations', 'db/migrations', 'src/migrations'];
-    for (const c of candidates) {
-      if (await fs.pathExists(path.join(projectDir, c))) return;
-    }
-    // Acceptable if using ORMs that auto-migrate
-  }});
-
-  // ── Security Scan ────────────────────────────────────────────────────
-  tests.push({ id: shortId(), name: 'CORS config found', type: 'security', fn: async () => {
-    await sleep(40);
-    // Scan src/index.* for cors usage
+  tests.push({ id: shortId(), name: 'CORS config found', type: 'security', sev: 'P1', fn: async () => {
     const candidates = ['src/index.ts', 'src/index.js', 'src/app.ts', 'src/app.js', 'index.js', 'index.ts'];
     for (const c of candidates) {
       const filePath = path.join(projectDir, c);
@@ -465,70 +762,42 @@ function buildFullSystemTests(projectDir = process.cwd()) {
         if (/cors|CORS/i.test(content)) return;
       }
     }
-    throw new Error('No CORS configuration detected in app entry');
+    throw new Error('No CORS configuration detected');
   }});
-
-  tests.push({ id: shortId(), name: 'Rate limiting configured', type: 'security', fn: async () => {
-    await sleep(30);
+  tests.push({ id: shortId(), name: 'Rate limiting configured', type: 'security', sev: 'P1', fn: async () => {
     const pkgPath = path.join(projectDir, 'package.json');
     if (!(await fs.pathExists(pkgPath))) return;
     const pkg  = await fs.readJson(pkgPath).catch(() => ({}));
     const deps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) };
-    const hasLimiter = ['express-rate-limit', 'rate-limiter-flexible', 'fastapi-limiter', 'throttler'].some(d => deps[d]);
-    if (!hasLimiter) throw new Error('No rate-limiting library found');
+    if (!['express-rate-limit', 'rate-limiter-flexible', 'fastapi-limiter', 'throttler'].some(d => deps[d]))
+      throw new Error('No rate-limiting library found');
   }});
-
-  tests.push({ id: shortId(), name: 'Secrets not hardcoded', type: 'security', fn: async () => {
-    await sleep(50);
-    const scanTargets = ['src/index.ts', 'src/index.js', 'src/app.ts', 'src/app.js'];
-    const secretPattern = /(?:password|secret|apikey|api_key)\s*=\s*['"][^'"]{6,}['"]/i;
-    for (const t of scanTargets) {
-      const filePath = path.join(projectDir, t);
-      if (await fs.pathExists(filePath)) {
-        const content = await fs.readFile(filePath, 'utf8').catch(() => '');
-        if (secretPattern.test(content)) throw new Error(`Hardcoded secret detected in ${t}`);
+  tests.push({ id: shortId(), name: 'Secrets not hardcoded', type: 'security', sev: 'P0', fn: async () => {
+    const pattern = /(?:password|secret|apikey|api_key)\s*=\s*['"][^'"]{6,}['"]/i;
+    const targets = ['src/index.ts', 'src/index.js', 'src/app.ts', 'src/app.js'];
+    for (const t of targets) {
+      const fp = path.join(projectDir, t);
+      if (await fs.pathExists(fp)) {
+        const content = await fs.readFile(fp, 'utf8').catch(() => '');
+        if (pattern.test(content)) throw new Error(`Hardcoded secret detected in ${t}`);
       }
     }
   }});
-
-  // ── Performance Checks ───────────────────────────────────────────────
-  tests.push({ id: shortId(), name: 'Heap memory acceptable', type: 'performance', fn: async () => {
-    await sleep(20);
+  tests.push({ id: shortId(), name: 'Heap memory acceptable', type: 'performance', sev: 'P2', fn: async () => {
     const heapMB = process.memoryUsage().heapUsed / 1024 / 1024;
-    if (heapMB > 512) throw new Error(`Heap usage too high: ${heapMB.toFixed(0)}MB (limit 512MB)`);
+    if (heapMB > 512) throw new Error(`Heap ${heapMB.toFixed(0)}MB exceeds 512MB limit`);
   }});
-
-  tests.push({ id: shortId(), name: 'File system scan speed', type: 'performance', fn: async () => {
-    const t0 = performance.now();
-    await fs.readdir(projectDir).catch(() => []);
-    const elapsed = performance.now() - t0;
-    if (elapsed > 2000) throw new Error(`FS scan too slow: ${elapsed.toFixed(0)}ms`);
-  }});
-
-  tests.push({ id: shortId(), name: 'Node.js version check', type: 'happy-path', fn: async () => {
-    const maj = parseInt(process.version.slice(1));
-    if (maj < 18) throw new Error(`Node.js ${process.version} — requires v18+`);
-  }});
-
-  // ── Docker / Deploy ──────────────────────────────────────────────────
-  tests.push({ id: shortId(), name: 'Dockerfile present', type: 'e2e', fn: async () => {
+  tests.push({ id: shortId(), name: 'Dockerfile present', type: 'e2e', sev: 'P2', fn: async () => {
     const candidates = ['Dockerfile', 'Dockerfile.dev', 'docker-compose.yml', 'docker-compose.yaml'];
-    for (const c of candidates) {
-      if (await fs.pathExists(path.join(projectDir, c))) return;
-    }
+    for (const c of candidates) { if (await fs.pathExists(path.join(projectDir, c))) return; }
     throw new Error('No Docker configuration found');
   }});
-
-  tests.push({ id: shortId(), name: 'CI/CD pipeline configured', type: 'e2e', fn: async () => {
+  tests.push({ id: shortId(), name: 'CI/CD pipeline configured', type: 'e2e', sev: 'P2', fn: async () => {
     const ciPaths = ['.github/workflows', '.gitlab-ci.yml', '.circleci', 'Jenkinsfile'];
-    for (const c of ciPaths) {
-      if (await fs.pathExists(path.join(projectDir, c))) return;
-    }
+    for (const c of ciPaths) { if (await fs.pathExists(path.join(projectDir, c))) return; }
     throw new Error('No CI/CD pipeline detected');
   }});
-
-  // ── Test Infrastructure ──────────────────────────────────────────────
-  tests.push({ id: shortId(), name: 'Test files exist', type: 'e2e', fn: async () => {
+  tests.push({ id: shortId(), name: 'Test files exist', type: 'e2e', sev: 'P2', fn: async () => {
     const testDirs = ['tests', 'test', '__tests__', 'spec'];
     for (const d of testDirs) {
       if (await fs.pathExists(path.join(projectDir, d))) {
@@ -538,42 +807,26 @@ function buildFullSystemTests(projectDir = process.cwd()) {
     }
     throw new Error('No test files found');
   }});
-
-  tests.push({ id: shortId(), name: 'Test script configured', type: 'validation', fn: async () => {
-    const pkgPath = path.join(projectDir, 'package.json');
-    if (!(await fs.pathExists(pkgPath))) return;
-    const pkg = await fs.readJson(pkgPath).catch(() => ({}));
-    if (!pkg.scripts?.test) throw new Error('No "test" script in package.json');
-  }});
-
-  // ── Swagger / Docs ───────────────────────────────────────────────────
-  tests.push({ id: shortId(), name: 'API documentation configured', type: 'happy-path', fn: async () => {
-    await sleep(20);
+  tests.push({ id: shortId(), name: 'API documentation configured', type: 'happy-path', sev: 'P3', fn: async () => {
     const pkgPath = path.join(projectDir, 'package.json');
     if (!(await fs.pathExists(pkgPath))) return;
     const pkg  = await fs.readJson(pkgPath).catch(() => ({}));
     const deps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) };
-    const hasDocs = ['swagger-ui-express', 'swagger-jsdoc', '@nestjs/swagger', 'fastapi', 'springdoc-openapi'].some(d => deps[d]);
-    if (!hasDocs) throw new Error('No API documentation library found');
+    if (!['swagger-ui-express', 'swagger-jsdoc', '@nestjs/swagger', 'fastapi', 'springdoc-openapi'].some(d => deps[d]))
+      throw new Error('No API documentation library found');
   }});
-
-  // ── Logging ──────────────────────────────────────────────────────────
-  tests.push({ id: shortId(), name: 'Logging library present', type: 'validation', fn: async () => {
-    await sleep(15);
+  tests.push({ id: shortId(), name: 'Logging library present', type: 'validation', sev: 'P2', fn: async () => {
     const pkgPath = path.join(projectDir, 'package.json');
     if (!(await fs.pathExists(pkgPath))) return;
     const pkg  = await fs.readJson(pkgPath).catch(() => ({}));
     const deps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) };
-    const hasLogger = ['winston', 'pino', 'morgan', 'log4j', 'structlog'].some(d => deps[d]);
-    if (!hasLogger) throw new Error('No structured logging library found');
+    if (!['winston', 'pino', 'morgan', 'log4j', 'structlog'].some(d => deps[d]))
+      throw new Error('No structured logging library found');
   }});
-
-  // ── Baseline (always pass) ────────────────────────────────────────────
-  tests.push({ id: shortId(), name: 'QA system operational', type: 'happy-path', fn: async () => {
+  tests.push({ id: shortId(), name: 'QA system operational', type: 'happy-path', sev: 'P3', fn: async () => {
     await fs.ensureDir(QA_DIR);
   }});
-
-  tests.push({ id: shortId(), name: 'Report directory writable', type: 'happy-path', fn: async () => {
+  tests.push({ id: shortId(), name: 'Report directory writable', type: 'happy-path', sev: 'P3', fn: async () => {
     await fs.ensureDir(REPORT_DIR);
     const testFile = path.join(REPORT_DIR, `.write-test-${shortId()}`);
     await fs.writeFile(testFile, 'ok');
@@ -583,14 +836,12 @@ function buildFullSystemTests(projectDir = process.cwd()) {
   return tests;
 }
 
-// ── UI Simulation tests ───────────────────────────────────────────────────
-
 function buildUITests(srcDir = path.join(process.cwd(), 'src')) {
   return [
-    { id: shortId(), name: 'Frontend src directory exists', type: 'ui', fn: async () => {
-      if (!(await fs.pathExists(srcDir))) throw new Error(`src directory not found: ${srcDir}`);
+    { id: shortId(), name: 'Frontend src directory exists', type: 'ui', sev: 'P1', fn: async () => {
+      if (!(await fs.pathExists(srcDir))) throw new Error(`src not found: ${srcDir}`);
     }},
-    { id: shortId(), name: 'Component files present', type: 'ui', fn: async () => {
+    { id: shortId(), name: 'Component files present', type: 'ui', sev: 'P1', fn: async () => {
       const exts = ['.tsx', '.jsx', '.vue', '.svelte'];
       let found = false;
       const walk = async (dir) => {
@@ -601,35 +852,22 @@ function buildUITests(srcDir = path.join(process.cwd(), 'src')) {
         }
       };
       await walk(srcDir);
-      if (!found) throw new Error('No component files (.tsx/.jsx/.vue/.svelte) found');
+      if (!found) throw new Error('No component files found');
     }},
-    { id: shortId(), name: 'Styles configured', type: 'ui', fn: async () => {
-      const stylePatterns = ['tailwind.config', 'postcss.config', 'vite.config', 'styles', 'css', 'scss'];
-      for (const pat of stylePatterns) {
-        const cwd = process.cwd();
-        const entries = await fs.readdir(cwd).catch(() => []);
-        if (entries.some(f => f.includes(pat))) return;
-      }
-      throw new Error('No styling configuration found');
+    { id: shortId(), name: 'Styles configured', type: 'ui', sev: 'P2', fn: async () => {
+      const patterns = ['tailwind.config', 'postcss.config', 'vite.config', 'styles', 'css', 'scss'];
+      const entries  = await fs.readdir(process.cwd()).catch(() => []);
+      if (!entries.some(f => patterns.some(p => f.includes(p)))) throw new Error('No styling configuration found');
     }},
-    { id: shortId(), name: 'API client configuration', type: 'ui', fn: async () => {
+    { id: shortId(), name: 'API client configuration', type: 'ui', sev: 'P2', fn: async () => {
       const apiFiles = ['src/api', 'src/services', 'src/lib', 'src/utils'];
-      for (const f of apiFiles) {
-        if (await fs.pathExists(path.join(process.cwd(), f))) return;
-      }
-      throw new Error('No API client/services directory found in frontend');
-    }},
-    { id: shortId(), name: 'Route configuration present', type: 'ui', fn: async () => {
-      const routeFiles = ['src/router', 'src/routes', 'src/pages', 'pages', 'app/routes'];
-      for (const f of routeFiles) {
-        if (await fs.pathExists(path.join(process.cwd(), f))) return;
-      }
+      for (const f of apiFiles) { if (await fs.pathExists(path.join(process.cwd(), f))) return; }
+      throw new Error('No API client/services directory found');
     }},
   ];
 }
 
-// ── Coverage matrix ────────────────────────────────────────────────────────
-
+// ── Helpers ────────────────────────────────────────────────────────────────
 function buildCoverageMatrix(results) {
   const matrix = {};
   for (const r of results) {
@@ -653,22 +891,22 @@ function buildSummary(results) {
   };
 }
 
-// ── HTML Report ────────────────────────────────────────────────────────────
+// ─────────────────────────────────────────────────────────────────────────
+//  HTML Report v10.0 — with route cards + dual-URL diff
+// ─────────────────────────────────────────────────────────────────────────
 
 function buildHTMLReport(runData) {
-  const { id, startedAt, duration, results, bugReports, coverage, summary } = runData;
+  const { id, startedAt, duration, results, bugReports, coverage, summary, urls = [], routeScans = [] } = runData;
   const passRate    = summary.total > 0 ? ((summary.passed / summary.total) * 100).toFixed(1) : 0;
   const statusColor = passRate >= 90 ? '#22c55e' : passRate >= 70 ? '#f59e0b' : '#ef4444';
 
   const typeColors = {
-    'happy-path' : ['#064e3b','#34d399'],
-    'validation' : ['#1e3a5f','#60a5fa'],
-    'auth'       : ['#3b1f5e','#c084fc'],
-    'edge-case'  : ['#3b2a1a','#f59e0b'],
-    'performance': ['#1a2a3b','#38bdf8'],
-    'security'   : ['#450a0a','#f87171'],
-    'e2e'        : ['#1a3b2a','#4ade80'],
-    'ui'         : ['#2a1a3b','#a78bfa'],
+    'happy-path' : ['#064e3b','#34d399'], 'validation' : ['#1e3a5f','#60a5fa'],
+    'auth'       : ['#3b1f5e','#c084fc'], 'edge-case'  : ['#3b2a1a','#f59e0b'],
+    'performance': ['#1a2a3b','#38bdf8'], 'security'   : ['#450a0a','#f87171'],
+    'e2e'        : ['#1a3b2a','#4ade80'], 'ui'         : ['#2a1a3b','#a78bfa'],
+    'http'       : ['#0f2a3b','#38bdf8'], 'seo'        : ['#1a2e0f','#86efac'],
+    'a11y'       : ['#2e1a0f','#fca5a5'], 'links'      : ['#0f1a2e','#93c5fd'],
   };
 
   const badgeStyle = (type) => {
@@ -680,7 +918,7 @@ function buildHTMLReport(runData) {
     const pct = d.total ? ((d.passed / d.total) * 100).toFixed(0) : 0;
     const [, fg] = typeColors[type] ?? ['','#94a3b8'];
     return `<div style="display:flex;align-items:center;gap:1rem;margin-bottom:.75rem">
-      <div style="width:100px;font-size:.8rem;color:#94a3b8">${type}</div>
+      <div style="width:110px;font-size:.8rem;color:#94a3b8">${type}</div>
       <div style="flex:1;background:#2d2d4e;border-radius:4px;height:8px;overflow:hidden">
         <div style="height:100%;width:${pct}%;background:${fg};border-radius:4px"></div>
       </div>
@@ -692,118 +930,163 @@ function buildHTMLReport(runData) {
     <td>${r.name}</td>
     <td><span style="${badgeStyle(r.type)}">${r.type}</span></td>
     <td><span class="status status-${r.status.toLowerCase()}">${r.status}</span></td>
+    <td>${r.sev ? `<span class="sev-${(r.sev||'').toLowerCase()}">${r.sev}</span>` : '—'}</td>
     <td>${r.duration}ms</td>
     <td>${r.retries > 0 ? `<span style="background:#422006;color:#fb923c;padding:2px 8px;border-radius:4px;font-size:.75rem">${r.retries}x retry</span>` : '—'}</td>
     <td class="err">${r.error ? `<code>${r.error}</code>` : '—'}</td>
   </tr>`).join('');
 
   const bugCards = bugReports.length ? bugReports.map(b => `
-    <div class="bug-card bug-${b.severity?.toLowerCase()}">
-      <div class="bug-header"><span class="bug-id">${b.id}</span><span class="bug-sev">${b.severity}</span><span class="bug-st">${b.status}</span></div>
+    <div class="bug-card bug-${(b.severity||'p3').toLowerCase()}">
+      <div class="bug-header">
+        <span class="bug-id">${b.id}</span>
+        <span class="bug-sev">${b.severity}</span>
+        <span class="bug-st">${b.status}</span>
+      </div>
       <div class="bug-title">${b.title}</div>
       ${b.description ? `<div class="bug-desc">${b.description}</div>` : ''}
     </div>`).join('') : '<p style="color:#34d399;text-align:center;padding:1rem">No bug reports 🎉</p>';
 
-  // Chart data for pass/fail by type
+  const urlCards = urls.length ? urls.map(u => `
+    <div style="background:#1e1e30;border:1px solid #2d2d4e;border-radius:8px;padding:1rem;margin-bottom:.75rem">
+      <div style="display:flex;justify-content:space-between;align-items:center">
+        <span style="font-size:.8rem;color:#64748b;text-transform:uppercase">${u.label}</span>
+        <a href="${u.url}" target="_blank" style="font-size:.8rem;color:#60a5fa">${u.url}</a>
+      </div>
+    </div>`).join('') : '';
+
+  const routeCards = routeScans.length ? routeScans.map(r => `
+    <div style="display:flex;align-items:center;gap:.75rem;padding:.5rem .75rem;border-bottom:1px solid #1a1a2e;font-size:.8rem">
+      <span style="font-family:monospace;color:${r.status >= 200 && r.status < 400 ? '#34d399' : r.status >= 500 ? '#f87171' : '#f59e0b'}">${r.status || 'ERR'}</span>
+      <span style="flex:1;color:#94a3b8;font-family:monospace">${r.route}</span>
+      <span style="color:#64748b">${r.duration}ms</span>
+      <span style="font-size:.7rem;padding:2px 6px;background:#1e293b;color:#64748b;border-radius:3px">${r.label}</span>
+    </div>`).join('') : '<p style="color:#64748b;font-size:.85rem;padding:.5rem">No route scans recorded.</p>';
+
   const chartLabels = JSON.stringify(Object.keys(coverage));
   const chartPassed = JSON.stringify(Object.values(coverage).map(d => d.passed));
   const chartFailed = JSON.stringify(Object.values(coverage).map(d => d.failed));
 
+  const sevCounts = { P0: 0, P1: 0, P2: 0, P3: 0 };
+  bugReports.forEach(b => { if (sevCounts[b.severity] !== undefined) sevCounts[b.severity]++; });
+
   return `<!DOCTYPE html>
 <html lang="en">
 <head>
 <meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1">
-<title>Backlist QA Report — ${id}</title>
+<title>Backlist QA Report v${VERSION} — ${id}</title>
 <script src="https://cdnjs.cloudflare.com/ajax/libs/Chart.js/4.4.1/chart.umd.js"></script>
 <style>
 *{box-sizing:border-box;margin:0;padding:0}
 body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;background:#0a0a12;color:#e2e8f0;font-size:14px;line-height:1.6}
-header{background:linear-gradient(135deg,#1a1a2e,#16213e);border-bottom:1px solid #00f5ff33;padding:1.5rem 2rem}
-header h1{font-size:1.4rem;font-weight:600;color:#00f5ff}header p{color:#64748b;font-size:.85rem;margin-top:4px}
+header{background:#0f0f1e;border-bottom:1px solid #00f5ff22;padding:1.5rem 2rem;display:flex;align-items:center;justify-content:space-between}
+header h1{font-size:1.25rem;font-weight:600;color:#00f5ff}
+header .version{font-size:.75rem;color:#534AB7;padding:3px 10px;border:1px solid #534AB7;border-radius:20px}
+header p{color:#64748b;font-size:.85rem;margin-top:4px}
 .container{max-width:1200px;margin:0 auto;padding:2rem}
-.metrics{display:grid;grid-template-columns:repeat(auto-fit,minmax(150px,1fr));gap:1rem;margin-bottom:2rem}
-.metric-card{background:#1e1e30;border:1px solid #2d2d4e;border-radius:10px;padding:1rem 1.25rem}
-.metric-label{font-size:.75rem;color:#64748b;text-transform:uppercase;letter-spacing:.05em}
-.metric-value{font-size:2rem;font-weight:700;margin-top:4px}
-.section{background:#1e1e30;border:1px solid #2d2d4e;border-radius:10px;padding:1.5rem;margin-bottom:1.5rem}
-.section-title{font-size:1rem;font-weight:600;margin-bottom:1rem;color:#cbd5e1;border-bottom:1px solid #2d2d4e;padding-bottom:.75rem}
-table{width:100%;border-collapse:collapse;font-size:.85rem}
+.metrics{display:grid;grid-template-columns:repeat(auto-fit,minmax(140px,1fr));gap:.75rem;margin-bottom:1.5rem}
+.mc{background:#1e1e30;border:1px solid #2d2d4e;border-radius:10px;padding:1rem 1.25rem}
+.ml{font-size:.7rem;color:#64748b;text-transform:uppercase;letter-spacing:.05em}
+.mv{font-size:2rem;font-weight:700;margin-top:4px}
+.section{background:#1e1e30;border:1px solid #2d2d4e;border-radius:10px;padding:1.5rem;margin-bottom:1.25rem}
+.section-title{font-size:.95rem;font-weight:600;margin-bottom:1rem;color:#cbd5e1;border-bottom:1px solid #2d2d4e;padding-bottom:.75rem;display:flex;justify-content:space-between}
+.grid2{display:grid;grid-template-columns:1fr 1fr;gap:1rem}
+table{width:100%;border-collapse:collapse;font-size:.82rem}
 th{text-align:left;color:#64748b;font-weight:500;padding:.5rem .75rem;border-bottom:1px solid #2d2d4e}
 td{padding:.5rem .75rem;border-bottom:1px solid #1a1a2e;vertical-align:top}
-tr.fail td{background:rgba(239,68,68,.05)}tr.flaky td{background:rgba(245,158,11,.05)}
-.status{display:inline-block;padding:2px 8px;border-radius:4px;font-size:.75rem;font-weight:600}
+tr.fail td{background:rgba(239,68,68,.04)}tr.flaky td{background:rgba(245,158,11,.04)}
+.status{display:inline-block;padding:2px 8px;border-radius:4px;font-size:.72rem;font-weight:600}
 .status-pass{background:#064e3b;color:#34d399}.status-fail{background:#450a0a;color:#f87171}
 .status-skip{background:#1e293b;color:#94a3b8}.status-flaky{background:#422006;color:#fbbf24}
-.err code{font-size:.75rem;color:#f87171;background:#1a0a0a;padding:2px 6px;border-radius:3px}
+.sev-p0{background:#450a0a;color:#f87171;padding:2px 6px;border-radius:3px;font-size:.72rem;font-weight:700}
+.sev-p1{background:#422006;color:#fbbf24;padding:2px 6px;border-radius:3px;font-size:.72rem;font-weight:700}
+.sev-p2{background:#1e3a5f;color:#60a5fa;padding:2px 6px;border-radius:3px;font-size:.72rem}
+.sev-p3{background:#1e293b;color:#94a3b8;padding:2px 6px;border-radius:3px;font-size:.72rem}
+.err code{font-size:.72rem;color:#f87171;background:#1a0a0a;padding:2px 6px;border-radius:3px;word-break:break-all}
 .bug-card{border-radius:8px;padding:1rem;margin-bottom:.75rem;border-left:3px solid}
 .bug-p0{background:rgba(239,68,68,.08);border-color:#ef4444}
 .bug-p1{background:rgba(245,158,11,.08);border-color:#f59e0b}
 .bug-p2{background:rgba(96,165,250,.08);border-color:#60a5fa}
 .bug-p3{background:rgba(148,163,184,.08);border-color:#64748b}
 .bug-header{display:flex;gap:.75rem;align-items:center;margin-bottom:.5rem}
-.bug-id{font-family:monospace;font-size:.8rem;color:#64748b}
-.bug-sev{font-size:.75rem;font-weight:700;color:#f87171}
-.bug-st{font-size:.75rem;padding:2px 8px;border-radius:4px;background:#1e293b;color:#94a3b8}
-.bug-title{font-weight:600;margin-bottom:.25rem}.bug-desc{font-size:.8rem;color:#94a3b8}
-.chart-wrap{position:relative;height:280px}
-footer{text-align:center;color:#334155;font-size:.75rem;padding:2rem;border-top:1px solid #1e293b;margin-top:2rem}
+.bug-id{font-family:monospace;font-size:.75rem;color:#64748b}
+.bug-sev{font-size:.72rem;font-weight:700;color:#f87171}
+.bug-st{font-size:.72rem;padding:2px 8px;border-radius:4px;background:#1e293b;color:#94a3b8}
+.bug-title{font-weight:600;margin-bottom:.25rem;font-size:.9rem}
+.bug-desc{font-size:.8rem;color:#94a3b8}
+.chart-wrap{position:relative;height:260px}
+footer{text-align:center;color:#334155;font-size:.72rem;padding:2rem;border-top:1px solid #1e293b;margin-top:2rem}
 </style>
 </head>
 <body>
 <header>
-  <h1>🧪 Backlist QA Report — v9.0</h1>
-  <p>Run ID: ${id} &nbsp;·&nbsp; ${new Date(startedAt).toLocaleString()} &nbsp;·&nbsp; Duration: ${formatDuration(duration)}</p>
+  <div>
+    <h1>Backlist QA Report</h1>
+    <p>Run ID: ${id} &nbsp;·&nbsp; ${new Date(startedAt).toLocaleString()} &nbsp;·&nbsp; ${formatDuration(duration)}</p>
+  </div>
+  <span class="version">v${VERSION}</span>
 </header>
 <div class="container">
+
+  ${urlCards ? `<div class="section"><div class="section-title">Target URLs</div>${urlCards}</div>` : ''}
+
   <div class="metrics">
-    <div class="metric-card"><div class="metric-label">Pass Rate</div><div class="metric-value" style="color:${statusColor}">${passRate}%</div></div>
-    <div class="metric-card"><div class="metric-label">Total Tests</div><div class="metric-value">${summary.total}</div></div>
-    <div class="metric-card"><div class="metric-label">Passed</div><div class="metric-value" style="color:#34d399">${summary.passed}</div></div>
-    <div class="metric-card"><div class="metric-label">Failed</div><div class="metric-value" style="color:#f87171">${summary.failed}</div></div>
-    <div class="metric-card"><div class="metric-label">Flaky</div><div class="metric-value" style="color:#fbbf24">${summary.flaky}</div></div>
-    <div class="metric-card"><div class="metric-label">Bug Reports</div><div class="metric-value" style="color:#c084fc">${bugReports.length}</div></div>
+    <div class="mc"><div class="ml">Pass Rate</div><div class="mv" style="color:${statusColor}">${passRate}%</div></div>
+    <div class="mc"><div class="ml">Total</div><div class="mv">${summary.total}</div></div>
+    <div class="mc"><div class="ml">Passed</div><div class="mv" style="color:#34d399">${summary.passed}</div></div>
+    <div class="mc"><div class="ml">Failed</div><div class="mv" style="color:#f87171">${summary.failed}</div></div>
+    <div class="mc"><div class="ml">Flaky</div><div class="mv" style="color:#fbbf24">${summary.flaky}</div></div>
+    <div class="mc"><div class="ml">Bugs</div><div class="mv" style="color:#c084fc">${bugReports.length}</div></div>
+    <div class="mc"><div class="ml">P0 Critical</div><div class="mv" style="color:#f87171;font-size:1.6rem">${sevCounts.P0}</div></div>
+    <div class="mc"><div class="ml">P1 High</div><div class="mv" style="color:#fbbf24;font-size:1.6rem">${sevCounts.P1}</div></div>
   </div>
 
-  <div class="section">
-    <div class="section-title">Coverage by Test Type</div>
-    ${covBars}
+  <div class="grid2">
+    <div class="section">
+      <div class="section-title">Coverage by type</div>
+      ${covBars}
+    </div>
+    <div class="section">
+      <div class="section-title">Pass vs Fail</div>
+      <div class="chart-wrap"><canvas id="typeChart" role="img" aria-label="Pass vs fail by type"></canvas></div>
+    </div>
   </div>
 
   <div class="section">
-    <div class="section-title">Pass vs Fail by Type</div>
-    <div class="chart-wrap"><canvas id="typeChart" role="img" aria-label="Grouped bar chart showing pass and fail counts by test type"></canvas></div>
+    <div class="section-title">Route Scan <span style="font-weight:400;font-size:.8rem;color:#64748b">${routeScans.length} routes probed</span></div>
+    ${routeCards}
   </div>
 
   <div class="section">
-    <div class="section-title">Test Results (${results.length})</div>
+    <div class="section-title">Test Results <span style="font-weight:400;font-size:.8rem;color:#64748b">${results.length} tests</span></div>
     <table>
-      <thead><tr><th>Test</th><th>Type</th><th>Status</th><th>Duration</th><th>Retries</th><th>Error</th></tr></thead>
+      <thead><tr><th>Test</th><th>Type</th><th>Status</th><th>Sev</th><th>Duration</th><th>Retries</th><th>Error</th></tr></thead>
       <tbody>${rows}</tbody>
     </table>
   </div>
 
   <div class="section">
-    <div class="section-title">Bug Reports (${bugReports.length})</div>
+    <div class="section-title">Bug Reports <span style="font-weight:400;font-size:.8rem;color:#64748b">${bugReports.length} bugs</span></div>
     ${bugCards}
   </div>
 </div>
-<footer>Generated by create-backlist v9.0 — Backlist Live QA System &nbsp;·&nbsp; ${new Date().toLocaleString()}</footer>
+<footer>Generated by create-backlist v${VERSION} — Backlist QA Platform &nbsp;·&nbsp; ${new Date().toLocaleString()}</footer>
 <script>
 new Chart(document.getElementById('typeChart'), {
   type: 'bar',
   data: {
     labels: ${chartLabels},
     datasets: [
-      { label: 'Passed', data: ${chartPassed}, backgroundColor: '#34d399' },
-      { label: 'Failed', data: ${chartFailed}, backgroundColor: '#f87171' },
+      { label: 'Passed', data: ${chartPassed}, backgroundColor: '#34d399', borderRadius: 4 },
+      { label: 'Failed', data: ${chartFailed}, backgroundColor: '#f87171', borderRadius: 4 },
     ]
   },
   options: {
     responsive: true, maintainAspectRatio: false,
-    plugins: { legend: { labels: { color: '#94a3b8' } } },
+    plugins: { legend: { labels: { color: '#94a3b8', font: { size: 12 } } } },
     scales: {
-      x: { ticks: { color: '#64748b' }, grid: { color: '#1e293b' } },
-      y: { ticks: { color: '#64748b', stepSize: 1 }, grid: { color: '#1e293b' } }
+      x: { ticks: { color: '#64748b', font: { size: 11 } }, grid: { color: '#1e293b' } },
+      y: { ticks: { color: '#64748b', stepSize: 1, font: { size: 11 } }, grid: { color: '#1e293b' } }
     }
   }
 });
@@ -812,8 +1095,7 @@ new Chart(document.getElementById('typeChart'), {
 </html>`;
 }
 
-// ── History helpers ───────────────────────────────────────────────────────
-
+// ── History helpers ────────────────────────────────────────────────────────
 export async function initQASystem() {
   await fs.ensureDir(QA_DIR);
   await fs.ensureDir(REPORT_DIR);
@@ -828,7 +1110,7 @@ async function loadHistory() {
 }
 
 async function saveRun(run) {
-  const hist  = await loadHistory();
+  const hist = await loadHistory();
   hist.runs.unshift(run);
   if (hist.runs.length > 50) hist.runs = hist.runs.slice(0, 50);
   await fs.writeJson(HISTORY_FILE, hist, { spaces: 2 });
@@ -843,7 +1125,7 @@ async function exportReport(run) {
     await fs.writeJson(jsonPath, run, { spaces: 2 });
     return htmlPath;
   } catch (err) {
-    console.error(chalk.gray(`  [warn] Could not write report: ${err.message}`));
+    console.error(chalk.gray(`  [warn] Report write failed: ${err.message}`));
     return null;
   }
 }
@@ -862,8 +1144,30 @@ async function printRunDiff(currentRun) {
   } catch {}
 }
 
+// ── Print summary ──────────────────────────────────────────────────────────
+function printResultsSummary(results) {
+  const passed   = results.filter(r => ['PASS','FLAKY'].includes(r.status)).length;
+  const failed   = results.filter(r => r.status === 'FAIL').length;
+  const passRate = results.length ? Math.round((passed / results.length) * 100) : 0;
+
+  console.log('');
+  console.log(chalk.hex('#00F5FF').bold('  ── Scan Results ──────────────────────────────────────'));
+  console.log(`  Pass rate:  [${buildProgressBar(passRate, 24)}] ${chalk.white.bold(passRate + '%')}`);
+  console.log(`  ${chalk.green('✓')} ${passed} passed   ${chalk.red('✗')} ${failed} failed   (${results.length} total)`);
+  if (failed > 0) {
+    console.log('');
+    console.log(chalk.red.bold('  Failures:'));
+    results.filter(r => r.status === 'FAIL').forEach(f => {
+      const sev = f.sev ? ` [${f.sev}]` : '';
+      console.log(chalk.red(`    ✗${sev} ${f.name}`));
+      if (f.error) console.log(chalk.gray(`      → ${f.error}`));
+    });
+  }
+  console.log('');
+}
+
 // ─────────────────────────────────────────────────────────────────────────
-//  Manual QA Flow
+//  Manual QA Flow (v9 retained + v10 URL option)
 // ─────────────────────────────────────────────────────────────────────────
 
 export async function runManualQA() {
@@ -877,57 +1181,58 @@ export async function runManualQA() {
   const action = await p.select({
     message: 'Manual QA — what would you like to do?',
     options: [
-      { value: 'new-test',     label: '✏️  Create & run a custom test case' },
-      { value: 'full-scan',    label: '🔬 Full system scan (all modules)',  hint: 'Scans entire project' },
+      { value: 'url-scan',     label: '🌐 URL-Based Scan',            hint: 'Enter URL(s) and run HTTP probe tests' },
+      { value: 'new-test',     label: '✏️  Create & run a custom test' },
+      { value: 'full-scan',    label: '🔬 Full system scan',           hint: 'File-system + UI tests' },
       { value: 'log-bug',      label: '🐛  Log a bug report' },
-      { value: 'run-suite',    label: '▶️  Run saved test suite' },
-      { value: 'ui-tests',     label: '🖥️  Run UI/Frontend tests' },
       { value: 'security-scan',label: '🛡️  Security scan only' },
+      { value: 'ui-tests',     label: '🖥️  UI/Frontend tests' },
     ],
   });
   if (p.isCancel(action)) { p.cancel('Cancelled.'); return; }
 
   const dashboard = new LiveDashboard();
 
-  if (action === 'log-bug') {
+  if (action === 'url-scan') {
+    const localUrl = await p.text({ message: 'Localhost URL (leave blank to skip):', placeholder: 'http://localhost:3000' });
+    const prodUrl  = await p.text({ message: 'Production URL (leave blank to skip):', placeholder: 'https://yoursite.com' });
+    if (p.isCancel(localUrl) || p.isCancel(prodUrl)) { p.cancel('Cancelled.'); return; }
+    const run = await runUrlQA({
+      localUrl : String(localUrl).trim() || undefined,
+      prodUrl  : String(prodUrl).trim()  || undefined,
+    });
+    if (run) manualResults.push(...run.results);
+  } else if (action === 'log-bug') {
     await logBugInteractive(bugs);
   } else if (action === 'new-test') {
     await createAndRunTestInteractive(runner, manualResults, dashboard);
   } else if (action === 'full-scan') {
     dashboard.start();
-    const allTests = [
-      ...buildFullSystemTests(),
-      ...buildUITests(),
-    ];
-    const results = await runner.run(allTests, dashboard);
+    const results = await runner.run([...buildFullSystemTests(), ...buildUITests()], dashboard);
     manualResults.push(...results);
     dashboard.stop();
     printResultsSummary(results);
   } else if (action === 'ui-tests') {
     dashboard.start();
-    const uiTests = buildUITests();
-    const results = await runner.run(uiTests, dashboard);
+    const results = await runner.run(buildUITests(), dashboard);
     manualResults.push(...results);
     dashboard.stop();
     printResultsSummary(results);
   } else if (action === 'security-scan') {
     dashboard.start();
-    const secTests = buildFullSystemTests().filter(t => t.type === 'security' || t.type === 'auth');
-    const results  = await runner.run(secTests, dashboard);
+    const results = await runner.run(buildFullSystemTests().filter(t => t.type === 'security' || t.type === 'auth'), dashboard);
     manualResults.push(...results);
     dashboard.stop();
     printResultsSummary(results);
-  } else if (action === 'run-suite') {
-    await runSavedSuiteInteractive(runner, manualResults, dashboard);
   }
 
-  const continueLoop = await p.confirm({ message: 'Run another test/action?' });
+  const continueLoop = await p.confirm({ message: 'Run another action?' });
   if (!p.isCancel(continueLoop) && continueLoop) return runManualQA();
 
   const duration = Date.now() - new Date(startedAt).getTime();
   const summary  = buildSummary(manualResults);
   const coverage = buildCoverageMatrix(manualResults);
-  const run      = { id: runId, type: 'manual', startedAt, duration, results: manualResults, bugReports: bugs, summary, coverage };
+  const run      = { id: runId, type: 'manual', version: VERSION, startedAt, duration, results: manualResults, bugReports: bugs, summary, coverage };
   await saveRun(run);
   const reportFile = await exportReport(run);
 
@@ -935,36 +1240,15 @@ export async function runManualQA() {
   if (reportFile) console.log(chalk.gray(`  📄 Report: ${reportFile}`));
 }
 
-function printResultsSummary(results) {
-  const passed  = results.filter(r => ['PASS','FLAKY'].includes(r.status)).length;
-  const failed  = results.filter(r => r.status === 'FAIL').length;
-  const passRate = results.length ? Math.round((passed / results.length) * 100) : 0;
-
-  console.log('');
-  console.log(chalk.hex('#00F5FF').bold('  ── Scan Results ──────────────────────────────────────'));
-  console.log(`  Pass rate:  [${buildProgressBar(passRate, 24)}] ${chalk.white.bold(passRate + '%')}`);
-  console.log(`  ${chalk.green('✓')} ${passed} passed   ${chalk.red('✗')} ${failed} failed   (${results.length} total)`);
-  if (failed > 0) {
-    console.log('');
-    console.log(chalk.red.bold('  Failures:'));
-    results.filter(r => r.status === 'FAIL').forEach(f => {
-      console.log(chalk.red(`    ✗ ${f.name}`));
-      if (f.error) console.log(chalk.gray(`      → ${f.error}`));
-    });
-  }
-  console.log('');
-}
-
 async function logBugInteractive(bugs) {
-  const title = await p.text({ message: 'Bug title:' });
+  const title    = await p.text({ message: 'Bug title:' });
   if (p.isCancel(title)) return;
-  const severity = await p.select({
-    message: 'Severity:',
-    options: Object.entries(SEVERITY_LEVELS).map(([k, v]) => ({ value: k, label: `${k} — ${v}` })),
-  });
+  const severity = await p.select({ message: 'Severity:',
+    options: Object.entries(SEVERITY_LEVELS).map(([k, v]) => ({ value: k, label: `${k} — ${v}` })) });
   if (p.isCancel(severity)) return;
   const description = await p.text({ message: 'Description (optional):', placeholder: 'Steps to reproduce…' });
-  bugs.push({ id: `BUG-${shortId()}`, title: String(title), severity: String(severity), status: 'OPEN', description: p.isCancel(description) ? '' : description, createdAt: timestamp() });
+  bugs.push({ id: `BUG-${shortId()}`, title: String(title), severity: String(severity), status: 'OPEN',
+    description: p.isCancel(description) ? '' : description, createdAt: timestamp() });
   console.log(chalk.green(`  ✓ Bug logged as ${colorSeverity(String(severity))}`));
 }
 
@@ -976,47 +1260,31 @@ async function createAndRunTestInteractive(runner, results, dashboard) {
   const expectPass = await p.confirm({ message: 'Should this test pass?' });
 
   dashboard.start();
-  const test = {
-    id: shortId(), name: String(name), type: String(type),
+  const [result] = await runner.run([{
+    id: shortId(), name: String(name), type: String(type), sev: 'P3',
     fn: async () => {
       await sleep(400 + Math.random() * 300);
       if (!expectPass) throw new Error('Test manually marked as failure');
     },
-  };
-  const [result] = await runner.run([test], dashboard);
+  }], dashboard);
   results.push(result);
   dashboard.stop();
   console.log(`  ${colorStatus(result.status)}  ${result.name}  ${chalk.gray(formatDuration(result.duration))}`);
 }
 
-async function runSavedSuiteInteractive(runner, results, dashboard) {
-  const suiteFiles = await fs.readdir(QA_DIR).then(files => files.filter(f => f.endsWith('.suite.json'))).catch(() => []);
-  if (!suiteFiles.length) { console.log(chalk.yellow('  No saved suites found.')); return; }
-  const chosen = await p.select({ message: 'Select suite:', options: suiteFiles.map(f => ({ value: f, label: f })) });
-  if (p.isCancel(chosen)) return;
-  const suite = await fs.readJson(path.join(QA_DIR, String(chosen)));
-  const tests = (suite.tests ?? []).map(t => ({ ...t, fn: async () => { await sleep(200); if (t.shouldFail) throw new Error('Marked as expected failure'); } }));
-  dashboard.start();
-  const runResults = await runner.run(tests, dashboard);
-  results.push(...runResults);
-  dashboard.stop();
-  printResultsSummary(runResults);
-}
-
 // ─────────────────────────────────────────────────────────────────────────
-//  Automated QA Flow
+//  Automated QA Flow (v9 retained + v10 URL integration)
 // ─────────────────────────────────────────────────────────────────────────
 
-export async function runAutomatedQA({ continuous = false } = {}) {
+export async function runAutomatedQA({ continuous = false, localUrl, prodUrl } = {}) {
   const runOnce = async () => {
     const runId     = `AQA-${shortId()}`;
     const startedAt = timestamp();
 
     console.log('');
-    console.log(chalk.hex('#BF40FF').bold(`  ── 🤖 Automated QA Run ${runId} ──`));
+    console.log(chalk.hex('#BF40FF').bold(`  ── 🤖 Automated QA v${VERSION} — Run ${runId} ──`));
     console.log('');
 
-    // Try to get endpoints from analyzer
     let endpoints = [];
     try {
       const { analyzeFrontend } = await import('../analyzer.js');
@@ -1029,7 +1297,7 @@ export async function runAutomatedQA({ continuous = false } = {}) {
       ...buildUITests(),
     ];
 
-    console.log(chalk.gray(`  Building test suite: ${allTests.length} tests across ${new Set(allTests.map(t => t.type)).size} categories\n`));
+    console.log(chalk.gray(`  Test suite: ${allTests.length} tests across ${new Set(allTests.map(t => t.type)).size} categories\n`));
 
     const dashboard = new LiveDashboard();
     const runner    = new TestRunner();
@@ -1038,12 +1306,9 @@ export async function runAutomatedQA({ continuous = false } = {}) {
     runner.on('result', r => {
       if (r.status === 'FAIL') {
         autoBugs.push({
-          id      : `AUTO-${shortId()}`,
-          title   : `Automated: ${r.name}`,
-          severity: r.type === 'security' || r.type === 'auth' ? 'P0' : r.type === 'e2e' ? 'P1' : 'P2',
-          status  : 'OPEN',
-          description: r.error || '',
-          createdAt: timestamp(),
+          id: `AUTO-${shortId()}`, title: `Automated: ${r.name}`,
+          severity  : r.sev || (r.type === 'security' || r.type === 'auth' ? 'P0' : r.type === 'e2e' ? 'P1' : 'P2'),
+          status    : 'OPEN', description: r.error || '', createdAt: timestamp(),
         });
       }
     });
@@ -1052,13 +1317,21 @@ export async function runAutomatedQA({ continuous = false } = {}) {
     const results = await runner.run(allTests, dashboard);
     dashboard.stop();
 
+    // If URLs provided, run URL-based QA too
+    if (localUrl || prodUrl) {
+      const urlRun = await runUrlQA({ localUrl, prodUrl, silent: true });
+      if (urlRun) { results.push(...urlRun.results); autoBugs.push(...urlRun.bugReports); }
+    }
+
     const duration = Date.now() - new Date(startedAt).getTime();
     const summary  = buildSummary(results);
     const coverage = buildCoverageMatrix(results);
 
     printResultsSummary(results);
 
-    const run = { id: runId, type: 'automated', startedAt, duration, results, bugReports: autoBugs, summary, coverage };
+    const run = { id: runId, type: 'automated', version: VERSION, startedAt, duration,
+      results, bugReports: autoBugs, summary, coverage,
+      urls: [localUrl, prodUrl].filter(Boolean).map((u, i) => ({ label: i === 0 ? 'localhost' : 'production', url: u })) };
     await saveRun(run);
     const reportFile = await exportReport(run);
 
@@ -1071,7 +1344,7 @@ export async function runAutomatedQA({ continuous = false } = {}) {
 
   if (!continuous) { await runOnce(); return; }
 
-  console.log(chalk.cyan(`  ⚡ Continuous QA mode — reruns every ${WATCH_INTERVAL_MS / 1000}s. Press Ctrl+C to stop.\n`));
+  console.log(chalk.cyan(`  ⚡ Continuous mode — reruns every ${WATCH_INTERVAL_MS / 1000}s. Ctrl+C to stop.\n`));
   let iteration = 0;
   while (true) {
     iteration++;
@@ -1081,12 +1354,11 @@ export async function runAutomatedQA({ continuous = false } = {}) {
   }
 }
 
-// ── Auto-run hook (called after generation) ───────────────────────────────
-
+// ── Post-gen auto-run ──────────────────────────────────────────────────────
 export async function autoRunPostGeneration(options = {}) {
   console.log('');
-  console.log(chalk.hex('#00F5FF').bold('  ── 🔬 Post-Generation QA Scan ──────────────────────'));
-  console.log(chalk.gray(`  Automatically validating generated project: ${options.projectName || 'backend'}`));
+  console.log(chalk.hex('#00F5FF').bold(`  ── 🔬 Post-Generation QA Scan v${VERSION} ──────────────`));
+  console.log(chalk.gray(`  Validating: ${options.projectName || 'backend'}`));
   console.log('');
 
   const projectDir = options.projectDir || process.cwd();
@@ -1097,11 +1369,9 @@ export async function autoRunPostGeneration(options = {}) {
 
   runner.on('result', r => {
     if (r.status === 'FAIL') {
-      autoBugs.push({
-        id: `POST-${shortId()}`, title: r.name,
-        severity: r.type === 'security' ? 'P0' : r.type === 'auth' ? 'P0' : 'P2',
-        status: 'OPEN', description: r.error || '', createdAt: timestamp(),
-      });
+      autoBugs.push({ id: `POST-${shortId()}`, title: r.name,
+        severity: r.sev || (r.type === 'security' ? 'P0' : 'P2'),
+        status: 'OPEN', description: r.error || '', createdAt: timestamp() });
     }
   });
 
@@ -1111,23 +1381,15 @@ export async function autoRunPostGeneration(options = {}) {
 
   const summary  = buildSummary(results);
   const coverage = buildCoverageMatrix(results);
-  const run      = {
-    id       : `POST-${shortId()}`,
-    type     : 'post-generation',
-    startedAt: timestamp(),
-    duration : 0,
-    results,
-    bugReports: autoBugs,
-    summary,
-    coverage,
-  };
+  const run      = { id: `POST-${shortId()}`, type: 'post-generation', version: VERSION,
+    startedAt: timestamp(), duration: 0, results, bugReports: autoBugs, summary, coverage };
 
   await saveRun(run);
   const reportFile = await exportReport(run);
-
   printResultsSummary(results);
+
   if (autoBugs.length > 0) {
-    console.log(chalk.red.bold(`  ⚠  ${autoBugs.length} issue(s) auto-detected:`));
+    console.log(chalk.red.bold(`  ⚠  ${autoBugs.length} issue(s) detected:`));
     autoBugs.forEach(b => console.log(chalk.red(`    ${colorSeverity(b.severity)} ${b.title}`)));
     console.log('');
   }
@@ -1135,23 +1397,21 @@ export async function autoRunPostGeneration(options = {}) {
 }
 
 // ── QA History ─────────────────────────────────────────────────────────────
-
 export async function viewQAHistory() {
   const hist = await loadHistory();
   if (!hist.runs.length) { console.log(chalk.yellow('\n  No QA history found.\n')); return; }
 
   console.log('');
   console.log(chalk.hex('#00F5FF').bold('  QA History (most recent first)'));
-  console.log(chalk.gray('  ────────────────────────────────────────────────────'));
+  console.log(chalk.gray('  ─────────────────────────────────────────────────────'));
 
   for (const run of hist.runs.slice(0, 10)) {
-    const passRate = run.summary.total ? ((run.summary.passed / run.summary.total) * 100).toFixed(0) : '–';
+    const passRate  = run.summary.total ? ((run.summary.passed / run.summary.total) * 100).toFixed(0) : '–';
     const rateColor = Number(passRate) >= 90 ? chalk.green : Number(passRate) >= 70 ? chalk.yellow : chalk.red;
+    const ver       = run.version ? chalk.dim(`v${run.version}`) : '';
     console.log(
-      `  ${chalk.gray(run.id.padEnd(18))}` +
-      `  ${chalk.gray(new Date(run.startedAt).toLocaleString().padEnd(24))}` +
-      `  ${rateColor(`${passRate}%`.padStart(5))}` +
-      `  ${chalk.gray(`${run.summary.total} tests · ${formatDuration(run.duration)}`)}`
+      `  ${chalk.gray(run.id.padEnd(18))}  ${chalk.gray(new Date(run.startedAt).toLocaleString().padEnd(24))}` +
+      `  ${rateColor(`${passRate}%`.padStart(5))}  ${chalk.gray(`${run.summary.total} tests`)}  ${ver}`
     );
   }
   console.log('');
@@ -1169,8 +1429,11 @@ export async function viewQAHistory() {
   if (!run) return;
 
   console.log('');
-  console.log(chalk.bold(`  Run: ${run.id}  (${run.type})`));
+  console.log(chalk.bold(`  Run: ${run.id}  (${run.type}) ${run.version ? `v${run.version}` : ''}`));
   console.log(chalk.gray(`  ${new Date(run.startedAt).toLocaleString()}  ·  ${formatDuration(run.duration)}`));
+  if (run.urls?.length) {
+    console.log(chalk.gray(`  URLs: ${run.urls.map(u => u.url).join(', ')}`));
+  }
   console.log('');
   for (const r of run.results) {
     console.log(`  ${colorStatus(r.status)}  ${r.name}  ${chalk.gray(formatDuration(r.duration))}`);