jourilo 0.1.0 → 1.1.0

package/plugin/skills/accessibility/SKILL.md

@@ -18,3 +18,4 @@ Toolchain: `node "${CLAUDE_PLUGIN_ROOT}/dist/jourilo.mjs" <command> … --json`
 3. Be explicit that automated checks cover only part of WCAG 2.2: list the `needs-review` items and the criteria
    in `limitations` that require a person (e.g. 1.3.3, 2.5.7, 3.2.6, 3.3.7, 3.3.8 beyond paste, screen-reader
    announcements). Never call a site "WCAG compliant" from an automated run.
+4. Answer in the short format of `${CLAUDE_PLUGIN_ROOT}/skills/jourilo/SKILL.md` → Answer format (80–150 words, report path, one next step). Name criteria by number (e.g. 1.4.3) in the priorities.

package/plugin/skills/audit/SKILL.md

@@ -18,6 +18,6 @@ Toolchain: `node "${CLAUDE_PLUGIN_ROOT}/dist/jourilo.mjs" <command> … --json`
    Useful options: `--pages N`, `--viewports desktop,mobile,reflow`, `--throttle`, `--url /path` (exact pages).
 3. Read `summary`, `findings` and `limitations`. Open the screenshots behind the most severe findings with Read
    and confirm they show what the finding says. If a finding looks wrong, say so — do not repeat it blindly.
-4. Answer with: the 3–7 most important problems grouped by root cause (severity, page, viewport, evidence, likely
-   source file), conversion hypotheses kept separate as untested ideas, what could not be checked (limitations,
-   manual review items), and the report path. Offer fixes (`/jourilo:optimize`) or journeys (`/jourilo:journeys`).
+4. Answer in the short format of `${CLAUDE_PLUGIN_ROOT}/skills/jourilo/SKILL.md` → Answer format (80–150 words, report path, one next step).
+   Group by root cause, keep conversion hypotheses apart from defects, and name the biggest limitation in one line.
+   Offer fixes (`/jourilo:optimize`) or journeys (`/jourilo:journeys`) as the next step.

package/plugin/skills/compare/SKILL.md

@@ -15,3 +15,4 @@ Toolchain: `node "${CLAUDE_PLUGIN_ROOT}/dist/jourilo.mjs" <command> … --json`
 1. `jourilo runs --json` to find run ids if needed, then `jourilo compare <baseline> [head] --json`.
 2. Report fixed, new (regressions first) and persisting findings with pages and severities, and metric deltas.
    Single lab visits are noisy: treat small metric changes as noise unless repeated runs agree.
+3. Answer in the short format of `${CLAUDE_PLUGIN_ROOT}/skills/jourilo/SKILL.md` → Answer format (80–150 words, report path, one next step). Lead with regressions, then fixed and still-present counts; the report's Before / after tab shows them.

package/plugin/skills/conversion/SKILL.md

@@ -20,3 +20,4 @@ Toolchain: `node "${CLAUDE_PLUGIN_ROOT}/dist/jourilo.mjs" <command> … --json`
 3. Present: (a) usability defects blocking the funnel — fix first; (b) hypotheses ranked by how directly they sit on
    the key journey, each with the metric that would test it. No predicted lifts, ever.
 4. Offer `jourilo experiment plan --finding <id>` (ask for the baseline rate and daily traffic; do not guess them).
+5. Answer in the short format of `${CLAUDE_PLUGIN_ROOT}/skills/jourilo/SKILL.md` → Answer format (80–150 words, report path, one next step).

package/plugin/skills/jourilo/SKILL.md

@@ -73,16 +73,37 @@ Tell the user which stage you are in. If they asked for one thing (e.g. "just ac
 6. **Prioritize** — Group by root cause, not by symptom. Order: blocked journeys and critical/serious defects on key
    journeys → serious accessibility defects → performance on key pages → conversion hypotheses.
 7. **Fix (repository mode, with permission)** — `jourilo optimize <run> --repo <path>` previews deterministic fixes
-   as diffs; apply with `--apply` after the user agrees (a git checkpoint is created). For other defects, use each
+   as diffs; apply with `--apply` after the user agrees (one reversible change; its id is printed). For other defects, use each
    finding's `sources` candidates, read the code, make the minimal edit yourself, and explain it with a diff.
    Run the project's own lint/tests after editing.
 8. **Verify** — `jourilo verify <baseline-run>`; rerun journeys. Report fixed / new / persisting with evidence. If
-   something regressed, fix it or `jourilo rollback <checkpoint> --yes` (with permission).
-9. **Report** — Give the report path (`.jourilo/runs/<id>/report.html`), a short prioritized summary, the
-   limitations of the run, and next steps. Offer `jourilo experiment plan --finding <id>` for hypotheses.
-
-## Good answers look like
-
-- "Signup fails on mobile: the submit button is covered by the cookie banner (journey `signup-signup`, step 9,
-  screenshot …). Cause: `CookieBanner.tsx:12` sets `position: fixed` with no inset. Fix: … Verified: journey passes."
-- Not: "Your site has some accessibility issues and could convert better."
+   something regressed, fix it or `jourilo rollback <id> --yes` (with permission; it never overwrites later edits).
+9. **Report** — Answer in the short format below. Offer `jourilo experiment plan --finding <id>` for hypotheses.
+
+## Answer format
+
+The evidence lives in the report; the chat answer is a short brief of **80–150 words** in the user's language,
+unless they ask for more. Never paste the finding list into chat.
+
+1. **Target** — the project or website and what ran (pages × viewports, journeys).
+2. **Blocked and broken** — blocked journeys first, then the key verified defects (page, severity, evidence).
+3. **Three priorities** — numbered, one per root cause (file:line when known), not per symptom.
+4. **Fixes** — how many are automatic (`jourilo optimize` previews them), agent-assisted, or need a person;
+   conversion hypotheses are experiment briefs, never fixes or promised lifts.
+5. **Report** — the real `report.html` path from the command's JSON (`reports.html` / `report`), and how to open it
+   (`open <path>` on macOS, `xdg-open` on Linux, `start` on Windows, or any browser). It works offline, in English
+   or Turkish, light or dark, and turns selected findings into a repair prompt.
+6. **Next** — one recommended action, as an offer.
+
+Example (about 90 words):
+
+> **acme.dev** — 7 pages × desktop/mobile, 4 journeys.
+> **Blocked:** signup fails on mobile: the submit button sits under the cookie banner (journey `signup`, step 9).
+> 25 verified defects (1 critical) from 19 root causes.
+> **Priorities:** 1) covered submit button (`CookieBanner.tsx:12`); 2) hero image without alt text (critical);
+> 3) focus outline removed in `style.css:14` (6 pages).
+> **Fixes:** 7 automatic, 11 agent-assisted, 1 needs a person; 6 conversion ideas are experiment briefs.
+> **Report:** `.jourilo/runs/20261101-144012-5d4952/report.html` — `open` it in a browser.
+> **Next:** shall I preview the automatic fixes?
+
+Not: "Your site has some accessibility issues and could convert better."

package/plugin/skills/jourilo/references/cli.md

@@ -45,8 +45,11 @@ Options:
   --brand SLUG         Markilo brand to check design consistency against (default: master brand)
   --ignore-robots      Ignore robots.txt (only for sites you own or are authorized to test)
   --allow-private      Allow private-network hosts (10.x, 192.168.x, ...)
-  --no-forms           Do not submit forms (by default, forms on local hosts are submitted empty to test validation)
-  --allow-submit       Allow submitting forms on non-local hosts (authorized test environments only)
+  --no-forms           Skip the form validation probe
+                       (by default, on local hosts, an empty submission is simulated: nothing that sends data
+                       leaves the browser, so no database is written; server-side feedback is reported as untested)
+  --allow-submit       Really send empty submissions to test server-side validation, on local or other hosts
+                       (disposable/test environments you are authorized to use only; never to delete/payment URLs)
   --sarif              Also write report.sarif for code scanning
   --fail-on SEVERITY   Exit 1 if a defect at or above this severity exists (CI gate)
 ```
@@ -76,8 +79,11 @@ Options:
   --brand SLUG         Markilo brand to check design consistency against (default: master brand)
   --ignore-robots      Ignore robots.txt (only for sites you own or are authorized to test)
   --allow-private      Allow private-network hosts (10.x, 192.168.x, ...)
-  --no-forms           Do not submit forms (by default, forms on local hosts are submitted empty to test validation)
-  --allow-submit       Allow submitting forms on non-local hosts (authorized test environments only)
+  --no-forms           Skip the form validation probe
+                       (by default, on local hosts, an empty submission is simulated: nothing that sends data
+                       leaves the browser, so no database is written; server-side feedback is reported as untested)
+  --allow-submit       Really send empty submissions to test server-side validation, on local or other hosts
+                       (disposable/test environments you are authorized to use only; never to delete/payment URLs)
   --sarif              Also write report.sarif for code scanning
   --fail-on SEVERITY   Exit 1 if a defect at or above this severity exists (CI gate)
 ```
@@ -107,8 +113,11 @@ Options:
   --brand SLUG         Markilo brand to check design consistency against (default: master brand)
   --ignore-robots      Ignore robots.txt (only for sites you own or are authorized to test)
   --allow-private      Allow private-network hosts (10.x, 192.168.x, ...)
-  --no-forms           Do not submit forms (by default, forms on local hosts are submitted empty to test validation)
-  --allow-submit       Allow submitting forms on non-local hosts (authorized test environments only)
+  --no-forms           Skip the form validation probe
+                       (by default, on local hosts, an empty submission is simulated: nothing that sends data
+                       leaves the browser, so no database is written; server-side feedback is reported as untested)
+  --allow-submit       Really send empty submissions to test server-side validation, on local or other hosts
+                       (disposable/test environments you are authorized to use only; never to delete/payment URLs)
   --sarif              Also write report.sarif for code scanning
   --fail-on SEVERITY   Exit 1 if a defect at or above this severity exists (CI gate)
 ```
@@ -135,13 +144,18 @@ Run options:
   --var key=value        Test data for {{key}} placeholders (also JOURILO_VAR_KEY env vars)
   --allow-submit         Allow form submission on non-local hosts (authorized test environments only)
   --allow-destructive    Allow irreversible/payment actions — local hosts with sandbox data only
+  --allow-origin ORIGIN  Let the page navigate to another origin you are authorized to test (e.g. a test IdP)
   --trace                Record a Playwright trace per journey (contains typed values; keep private)
   --auth FILE            Playwright storage state for signed-in journeys
   --save-auth FILE       After a passing sign-in journey (exactly one), save its session for --auth (test accounts only)
+  --repeat N             Run each journey N times (max 10); mixed outcomes are reported as flaky
   --fail-on-failure      Exit 1 when a journey fails
 
 Safety: payment, purchase, delete and cancel actions are never performed on non-local hosts; form submission
-on non-local hosts needs --allow-submit. Blocked steps are reported, not skipped silently.
+on non-local hosts needs --allow-submit. The policy is checked twice: on the element about to be clicked or
+pressed (its name, link target, form action and identifiers — icon-only buttons included), and on every request
+the page then sends (form posts, DELETE, requests to delete/cancel/payment endpoints, navigation to other
+origins). Blocked steps are reported, not skipped silently.
 ```
 
 ## Experiment
@@ -167,7 +181,7 @@ Jourilo never invents traffic, conversions or effects: every number comes from y
 
 ### `jourilo optimize`
 
-Plan (and with --apply, make) minimal source fixes for located findings; shows diffs, checkpoints first.
+Plan (and with --apply, make) minimal source fixes for located findings; shows diffs, writes one reversible change.
 
 ```
 jourilo optimize [run=latest] --repo <path> [--rule id ...] [--apply]
@@ -175,8 +189,11 @@ jourilo optimize [run=latest] --repo <path> [--rule id ...] [--apply]
 
 ```
 Deterministic fixers (others are reported with source candidates for a person or agent to fix):
-  axe/html-has-lang, jourilo/missing-viewport-meta, jourilo/input-purpose, jourilo/focus-visible, jourilo/paste-blocked
-Without --apply nothing is written. With --apply, a git checkpoint is created first (jourilo rollback undoes it).
+  axe/html-has-lang, jourilo/missing-viewport-meta, jourilo/input-purpose, jourilo/focus-visible, jourilo/paste-blocked,
+  jourilo/unsized-images, jourilo/placeholder-label
+Without --apply nothing is written. With --apply, all files are written as one change: each file must be unchanged
+since the plan, writes are atomic, an interrupted apply is undone, and `jourilo rollback <id>` restores the files
+(git is not required).
 Afterwards run `jourilo verify <run>` to repeat the audit and compare.
 ```
 
@@ -198,10 +215,19 @@ jourilo checkpoint [--repo .] [--note text] | checkpoint diff [id=latest]
 
 ### `jourilo rollback`
 
-Restore tracked files to a checkpoint (requires --yes). Untracked files created since are listed, not deleted.
+Undo an applied fix (or restore a checkpoint) without overwriting later edits; requires --yes. The rollback can itself be undone.
 
 ```
-jourilo rollback <checkpoint-id|latest> --yes [--repo .]
+jourilo rollback <id|latest> --yes [--repo .] [--file path ...] [--force]
+```
+
+```
+For a change made by `optimize --apply` (or a previous rollback), a file is restored only while it still
+holds exactly what Jourilo wrote. A file edited afterwards is reported as a conflict and left alone; --force restores
+it anyway after saving the current bytes under .jourilo/checkpoints/<id>/conflicts/.
+For a checkpoint made with `jourilo checkpoint`, every tracked file changed since then is restored (everything you
+or an agent changed in the meantime); the current bytes are kept, and the printed id undoes the rollback.
+Untracked files created after a checkpoint are listed, never deleted.
 ```
 
 ## Results

package/plugin/skills/journeys/SKILL.md

@@ -22,3 +22,4 @@ Toolchain: `node "${CLAUDE_PLUGIN_ROOT}/dist/jourilo.mjs" <command> … --json`
    `--allow-destructive` and explicit consent. A blocked step is a result: report it, do not work around it.
 4. For failures, open the failing step's screenshot (Read), explain where and why the user gets stuck, and point to
    the likely cause. Signed-in journeys need a Playwright storage-state file from the user (`--auth`).
+5. Answer in the short format of `${CLAUDE_PLUGIN_ROOT}/skills/jourilo/SKILL.md` → Answer format (80–150 words, report path, one next step). Blocked journeys come first, with the step where people get stuck.

package/plugin/skills/optimize/SKILL.md

@@ -15,10 +15,14 @@ Toolchain: `node "${CLAUDE_PLUGIN_ROOT}/dist/jourilo.mjs" <command> … --json`
 1. Make sure there is a baseline run with `--repo` (`jourilo audit <url|dir> --repo <path>`).
 2. `jourilo optimize <run> --repo <path> --json` previews deterministic fixes as diffs and lists the other defects
    with `sources` (file, line, reason, confidence). Show the user the plan.
-3. With the user's OK: `jourilo optimize <run> --repo <path> --apply` (creates a checkpoint). For the remaining
+3. With the user's OK: `jourilo optimize <run> --repo <path> --apply` (writes all files as one change and prints its
+   id; `jourilo rollback <id>` undoes it, file by file, and never overwrites edits made afterwards).
+   Before editing files yourself, run `jourilo checkpoint --repo <path>` so your edits can be rolled back too. For the remaining
    defects, read each candidate source, confirm it is really the cause, and make the smallest maintainable edit
    (reuse the project's components and tokens; keep brand and behavior). Show diffs. Do not touch unrelated code.
 4. Run the project's own lint/type-check/tests.
 5. `jourilo verify <baseline-run> --json` and rerun affected journeys. Report fixed / new / persisting. If a fix
-   did not work or regressed something, say so and iterate, or offer `jourilo rollback <checkpoint> --yes`.
+   did not work or regressed something, say so and iterate, or offer `jourilo rollback <id> --yes` (show the
+   user the preview without `--yes` first; it lists conflicts with edits made after the change).
 6. Do not commit unless the user asks.
+7. Answer in the short format of `${CLAUDE_PLUGIN_ROOT}/skills/jourilo/SKILL.md` → Answer format (80–150 words, report path, one next step). Say what was verified as fixed, what is new and what still needs a person.

package/plugin/skills/report/SKILL.md

@@ -14,5 +14,6 @@ Toolchain: `node "${CLAUDE_PLUGIN_ROOT}/dist/jourilo.mjs" <command> … --json`
 
 1. `jourilo report [run] --format html|md|sarif|json --json` (default latest run, HTML). `--baseline <run>` adds a
    before/after section.
-2. Give the file path. For stakeholders, summarize in plain language: what blocks people, what to fix first, what is
-   a hypothesis to test, and what was not checked. For developers, link findings to source files.
+2. Answer in the short format of `${CLAUDE_PLUGIN_ROOT}/skills/jourilo/SKILL.md` → Answer format (80–150 words, report path, one next step). For stakeholders, use plain language; for developers, name source files.
+   In the report, findings or root-cause groups can be selected and turned into a repair prompt (copy or download
+   as Markdown) for a coding agent; the report itself never runs anything.