jourilo 0.1.0 → 1.0.1

package/plugin/skills/jourilo/SKILL.md

@@ -73,11 +73,11 @@ Tell the user which stage you are in. If they asked for one thing (e.g. "just ac
 6. **Prioritize** — Group by root cause, not by symptom. Order: blocked journeys and critical/serious defects on key
    journeys → serious accessibility defects → performance on key pages → conversion hypotheses.
 7. **Fix (repository mode, with permission)** — `jourilo optimize <run> --repo <path>` previews deterministic fixes
-   as diffs; apply with `--apply` after the user agrees (a git checkpoint is created). For other defects, use each
+   as diffs; apply with `--apply` after the user agrees (one reversible change; its id is printed). For other defects, use each
    finding's `sources` candidates, read the code, make the minimal edit yourself, and explain it with a diff.
    Run the project's own lint/tests after editing.
 8. **Verify** — `jourilo verify <baseline-run>`; rerun journeys. Report fixed / new / persisting with evidence. If
-   something regressed, fix it or `jourilo rollback <checkpoint> --yes` (with permission).
+   something regressed, fix it or `jourilo rollback <id> --yes` (with permission; it never overwrites later edits).
 9. **Report** — Give the report path (`.jourilo/runs/<id>/report.html`), a short prioritized summary, the
    limitations of the run, and next steps. Offer `jourilo experiment plan --finding <id>` for hypotheses.
 

package/plugin/skills/jourilo/references/cli.md

@@ -45,8 +45,11 @@ Options:
   --brand SLUG         Markilo brand to check design consistency against (default: master brand)
   --ignore-robots      Ignore robots.txt (only for sites you own or are authorized to test)
   --allow-private      Allow private-network hosts (10.x, 192.168.x, ...)
-  --no-forms           Do not submit forms (by default, forms on local hosts are submitted empty to test validation)
-  --allow-submit       Allow submitting forms on non-local hosts (authorized test environments only)
+  --no-forms           Skip the form validation probe
+                       (by default, on local hosts, an empty submission is simulated: nothing that sends data
+                       leaves the browser, so no database is written; server-side feedback is reported as untested)
+  --allow-submit       Really send empty submissions to test server-side validation, on local or other hosts
+                       (disposable/test environments you are authorized to use only; never to delete/payment URLs)
   --sarif              Also write report.sarif for code scanning
   --fail-on SEVERITY   Exit 1 if a defect at or above this severity exists (CI gate)
 ```
@@ -76,8 +79,11 @@ Options:
   --brand SLUG         Markilo brand to check design consistency against (default: master brand)
   --ignore-robots      Ignore robots.txt (only for sites you own or are authorized to test)
   --allow-private      Allow private-network hosts (10.x, 192.168.x, ...)
-  --no-forms           Do not submit forms (by default, forms on local hosts are submitted empty to test validation)
-  --allow-submit       Allow submitting forms on non-local hosts (authorized test environments only)
+  --no-forms           Skip the form validation probe
+                       (by default, on local hosts, an empty submission is simulated: nothing that sends data
+                       leaves the browser, so no database is written; server-side feedback is reported as untested)
+  --allow-submit       Really send empty submissions to test server-side validation, on local or other hosts
+                       (disposable/test environments you are authorized to use only; never to delete/payment URLs)
   --sarif              Also write report.sarif for code scanning
   --fail-on SEVERITY   Exit 1 if a defect at or above this severity exists (CI gate)
 ```
@@ -107,8 +113,11 @@ Options:
   --brand SLUG         Markilo brand to check design consistency against (default: master brand)
   --ignore-robots      Ignore robots.txt (only for sites you own or are authorized to test)
   --allow-private      Allow private-network hosts (10.x, 192.168.x, ...)
-  --no-forms           Do not submit forms (by default, forms on local hosts are submitted empty to test validation)
-  --allow-submit       Allow submitting forms on non-local hosts (authorized test environments only)
+  --no-forms           Skip the form validation probe
+                       (by default, on local hosts, an empty submission is simulated: nothing that sends data
+                       leaves the browser, so no database is written; server-side feedback is reported as untested)
+  --allow-submit       Really send empty submissions to test server-side validation, on local or other hosts
+                       (disposable/test environments you are authorized to use only; never to delete/payment URLs)
   --sarif              Also write report.sarif for code scanning
   --fail-on SEVERITY   Exit 1 if a defect at or above this severity exists (CI gate)
 ```
@@ -135,13 +144,18 @@ Run options:
   --var key=value        Test data for {{key}} placeholders (also JOURILO_VAR_KEY env vars)
   --allow-submit         Allow form submission on non-local hosts (authorized test environments only)
   --allow-destructive    Allow irreversible/payment actions — local hosts with sandbox data only
+  --allow-origin ORIGIN  Let the page navigate to another origin you are authorized to test (e.g. a test IdP)
   --trace                Record a Playwright trace per journey (contains typed values; keep private)
   --auth FILE            Playwright storage state for signed-in journeys
   --save-auth FILE       After a passing sign-in journey (exactly one), save its session for --auth (test accounts only)
+  --repeat N             Run each journey N times (max 10); mixed outcomes are reported as flaky
   --fail-on-failure      Exit 1 when a journey fails
 
 Safety: payment, purchase, delete and cancel actions are never performed on non-local hosts; form submission
-on non-local hosts needs --allow-submit. Blocked steps are reported, not skipped silently.
+on non-local hosts needs --allow-submit. The policy is checked twice: on the element about to be clicked or
+pressed (its name, link target, form action and identifiers — icon-only buttons included), and on every request
+the page then sends (form posts, DELETE, requests to delete/cancel/payment endpoints, navigation to other
+origins). Blocked steps are reported, not skipped silently.
 ```
 
 ## Experiment
@@ -167,7 +181,7 @@ Jourilo never invents traffic, conversions or effects: every number comes from y
 
 ### `jourilo optimize`
 
-Plan (and with --apply, make) minimal source fixes for located findings; shows diffs, checkpoints first.
+Plan (and with --apply, make) minimal source fixes for located findings; shows diffs, writes one reversible change.
 
 ```
 jourilo optimize [run=latest] --repo <path> [--rule id ...] [--apply]
@@ -175,8 +189,11 @@ jourilo optimize [run=latest] --repo <path> [--rule id ...] [--apply]
 
 ```
 Deterministic fixers (others are reported with source candidates for a person or agent to fix):
-  axe/html-has-lang, jourilo/missing-viewport-meta, jourilo/input-purpose, jourilo/focus-visible, jourilo/paste-blocked
-Without --apply nothing is written. With --apply, a git checkpoint is created first (jourilo rollback undoes it).
+  axe/html-has-lang, jourilo/missing-viewport-meta, jourilo/input-purpose, jourilo/focus-visible, jourilo/paste-blocked,
+  jourilo/unsized-images, jourilo/placeholder-label
+Without --apply nothing is written. With --apply, all files are written as one change: each file must be unchanged
+since the plan, writes are atomic, an interrupted apply is undone, and `jourilo rollback <id>` restores the files
+(git is not required).
 Afterwards run `jourilo verify <run>` to repeat the audit and compare.
 ```
 
@@ -198,10 +215,19 @@ jourilo checkpoint [--repo .] [--note text] | checkpoint diff [id=latest]
 
 ### `jourilo rollback`
 
-Restore tracked files to a checkpoint (requires --yes). Untracked files created since are listed, not deleted.
+Undo an applied fix (or restore a checkpoint) without overwriting later edits; requires --yes. The rollback can itself be undone.
 
 ```
-jourilo rollback <checkpoint-id|latest> --yes [--repo .]
+jourilo rollback <id|latest> --yes [--repo .] [--file path ...] [--force]
+```
+
+```
+For a change made by `optimize --apply` (or a previous rollback), a file is restored only while it still
+holds exactly what Jourilo wrote. A file edited afterwards is reported as a conflict and left alone; --force restores
+it anyway after saving the current bytes under .jourilo/checkpoints/<id>/conflicts/.
+For a checkpoint made with `jourilo checkpoint`, every tracked file changed since then is restored (everything you
+or an agent changed in the meantime); the current bytes are kept, and the printed id undoes the rollback.
+Untracked files created after a checkpoint are listed, never deleted.
 ```
 
 ## Results

package/plugin/skills/optimize/SKILL.md

@@ -15,10 +15,13 @@ Toolchain: `node "${CLAUDE_PLUGIN_ROOT}/dist/jourilo.mjs" <command> … --json`
 1. Make sure there is a baseline run with `--repo` (`jourilo audit <url|dir> --repo <path>`).
 2. `jourilo optimize <run> --repo <path> --json` previews deterministic fixes as diffs and lists the other defects
    with `sources` (file, line, reason, confidence). Show the user the plan.
-3. With the user's OK: `jourilo optimize <run> --repo <path> --apply` (creates a checkpoint). For the remaining
+3. With the user's OK: `jourilo optimize <run> --repo <path> --apply` (writes all files as one change and prints its
+   id; `jourilo rollback <id>` undoes it, file by file, and never overwrites edits made afterwards).
+   Before editing files yourself, run `jourilo checkpoint --repo <path>` so your edits can be rolled back too. For the remaining
    defects, read each candidate source, confirm it is really the cause, and make the smallest maintainable edit
    (reuse the project's components and tokens; keep brand and behavior). Show diffs. Do not touch unrelated code.
 4. Run the project's own lint/type-check/tests.
 5. `jourilo verify <baseline-run> --json` and rerun affected journeys. Report fixed / new / persisting. If a fix
-   did not work or regressed something, say so and iterate, or offer `jourilo rollback <checkpoint> --yes`.
+   did not work or regressed something, say so and iterate, or offer `jourilo rollback <id> --yes` (show the
+   user the preview without `--yes` first; it lists conflicts with edits made after the change).
 6. Do not commit unless the user asks.