qaify-playwright-reporter 0.3.1 → 0.4.0

package/README.md

@@ -78,15 +78,21 @@ Catatan:
 
 Untuk aplikasi yang repo FE dan BE-nya terpisah dan belum memasang Playwright, Qaify bisa mengaudit keduanya dari satu **repo runner**. Repo FE dan BE tidak diubah sama sekali.
 
-1. Buat repo kosong (mis. `qaify-runner`), lalu jalankan `npx qaify-playwright-reporter init-runner` di dalamnya. Perintah ini menulis `.github/workflows/qaify-audit.yml`.
+1. Pilih repo runner: repo kosong (mis. `qaify-runner`) atau repo aplikasinya sendiri. Jalankan `npx qaify-playwright-reporter init-runner` di dalamnya. Perintah ini menulis `.github/workflows/qaify-audit.yml`.
 2. Pasang GitHub App Qaify di repo runner, repo FE, dan repo BE.
-3. Di repo runner, isi secret `QA_FACTORY_TOKEN` (token reporter repo runner), variable `QA_FACTORY_URL`, dan secret `CLAUDE_CODE_OAUTH_TOKEN`.
+3. Di repo runner, isi secret `QA_FACTORY_TOKEN` (token reporter repo runner), dan variable `QA_FACTORY_URL`. Secret `CLAUDE_CODE_OAUTH_TOKEN` bersifat opsional.
+
+   - Tanpa secret itu, audit berjalan **tanpa AI** (`qaify audit-static`): build, test, `composer audit` / `npm audit`, route GET publik BE, dan smoke test Playwright FE (desktop + mobile, dengan screenshot).
+   - Dengan secret itu, Claude yang mengaudit. Hasilnya lebih dalam, termasuk logika bisnis dan kontrak API.
+   - Mode bisa dipaksa lewat variable `QA_FACTORY_AUDIT_MODE` (`static` / `claude`).
 4. Di Qaify → **Aplikasi**, tambahkan aplikasi (repo FE, BE, runner), lalu klik **Audit sekarang**.
 
 Alur di workflow:
 
 ```bash
 qaify audit-context --audit <id> --dir "$WORK"   # clone apps/fe + apps/be, lalu cabut token clone
+qaify audit-static --dir "$WORK" --out claude.json   # mode static: tanpa AI
+# atau mode claude:
 qaify audit-schema --out schema.json --instructions instructions.txt
 claude -p …                                      # Bash + Playwright MCP: jalankan BE/FE, jelajahi UI, tulis temuan
 qaify audit-submit --audit <id> --results claude.json --evidence "$WORK/evidence" --context "$WORK/context.json"

package/dist/audit-static.d.ts

@@ -0,0 +1,104 @@
+import type { AuditFinding } from './audit.js';
+/** usage.model untuk audit tanpa AI; dipakai backend/PDF untuk menampilkan mode audit. */
+export declare const STATIC_MODEL = "qaify-static";
+export interface ShellResult {
+    code: number;
+    output: string;
+}
+export interface Shell {
+    run(cmd: string, opts: {
+        cwd: string;
+        timeoutMs: number;
+        env?: NodeJS.ProcessEnv;
+    }): Promise<ShellResult>;
+    /** Proses latar (server dev); kembalian menghentikannya. */
+    background(cmd: string, opts: {
+        cwd: string;
+        logFile: string;
+        env?: NodeJS.ProcessEnv;
+    }): () => void;
+}
+/** Subset Playwright yang dipakai smoke test (playwright-core di runner, palsu di test). */
+export interface BrowserLike {
+    newContext(opts: {
+        viewport: {
+            width: number;
+            height: number;
+        };
+    }): Promise<ContextLike>;
+    close(): Promise<void>;
+}
+export interface ContextLike {
+    newPage(): Promise<PageLike>;
+    close(): Promise<void>;
+}
+export interface PageLike {
+    on(event: 'console' | 'pageerror' | 'response', fn: (arg: any) => void): void;
+    goto(url: string, opts: {
+        waitUntil: 'networkidle';
+        timeout: number;
+    }): Promise<unknown>;
+    url(): string;
+    evaluate(expression: string): Promise<unknown>;
+    screenshot(opts: {
+        path: string;
+    }): Promise<unknown>;
+    locator(selector: string): {
+        count(): Promise<number>;
+        first(): {
+            fill(value: string): Promise<void>;
+            press(key: string): Promise<void>;
+        };
+    };
+    waitForLoadState(state: 'networkidle', opts: {
+        timeout: number;
+    }): Promise<void>;
+}
+export interface StaticDeps {
+    shell: Shell;
+    fetch: typeof fetch;
+    /** null = playwright-core tidak tersedia; smoke FE dilewati. */
+    launch: () => Promise<BrowserLike | null>;
+    log: (msg: string) => void;
+}
+export interface StaticAudit {
+    summary: Record<'fe' | 'be', {
+        score: number;
+        verdict: string;
+        booted: boolean;
+        notes: string;
+    }>;
+    findings: AuditFinding[];
+}
+/** Folder kerja hasil audit-context: apps/fe, apps/be, context.json, evidence/. */
+export declare function auditStatic(dir: string, deps: StaticDeps): Promise<StaticAudit>;
+/** Bentuk keluaran `claude -p --output-format json` agar parseAuditOutput / audit-submit tidak berubah. */
+export declare function toAuditOutput(audit: StaticAudit, durationMs: number): string;
+/** Jelajah link same-origin (BFS) di desktop, lalu ulangi halaman yang sama di mobile. */
+export declare function smokeUi(browser: BrowserLike, baseUrl: string, evidenceDir: string, login: Login | null, log?: (msg: string) => void): Promise<{
+    findings: AuditFinding[];
+    pages: number;
+    loggedIn: boolean;
+}>;
+/** Test gagal / error dari laporan JUnit PHPUnit / Pest. */
+export declare function parseJunit(xml: string, root?: string): AuditFinding[];
+/** `composer audit --format=json` → satu temuan per advisory. */
+export declare function parseComposerAudit(output: string): AuditFinding[];
+/** `npm audit --json` (npm 7+) → satu temuan per paket berseverity high/critical. */
+export declare function parseNpmAudit(output: string): AuditFinding[];
+/** URI route GET tanpa parameter dan tanpa middleware autentikasi dari `route:list --json`. */
+export declare function pickSmokeRoutes(output: string): string[];
+export declare function scoreRepo(findings: AuditFinding[], booted: boolean): number;
+export interface Login {
+    email: string;
+    password: string;
+}
+/** Akun login dari catatan aplikasi, mis. "Login admin@pos.test / password". */
+export declare function parseLogin(instructions: string): Login | null;
+/** Variabel VITE_* berisi URL http diarahkan ke BE lokal; path (mis. /api) dipertahankan. */
+export declare function localApiEnv(example: string): string;
+/** Ganti / tambah KEY=VALUE di isi file .env. */
+export declare function setEnv(content: string, values: Record<string, string>): string;
+export declare const defaultShell: Shell;
+/** playwright-core dipasang global di runner bersama qaify; Google Chrome sudah ada di ubuntu-latest. */
+export declare function defaultLaunch(): Promise<BrowserLike | null>;

package/dist/audit-static.js

@@ -0,0 +1,597 @@
+// Audit aplikasi tanpa AI (qaify audit-static): pemeriksaan deterministik di repo runner bila
+// CLAUDE_CODE_OAUTH_TOKEN kosong. Hasilnya berbentuk sama dengan keluaran `claude -p`, jadi audit-submit,
+// backend, dan UI tidak berubah. Temuan lebih dangkal dari mode Claude: tidak ada analisis logika bisnis
+// atau kontrak API dari membaca kode.
+//   BE (Laravel): composer install, migrate --seed, php artisan test, composer audit, smoke route GET publik.
+//   FE (Node): npm ci, npm run build, npm audit, smoke Playwright (desktop + mobile) dengan screenshot.
+import { spawn } from 'node:child_process';
+import { mkdir, readFile, stat, writeFile } from 'node:fs/promises';
+import { openSync } from 'node:fs';
+import { join } from 'node:path';
+/** usage.model untuk audit tanpa AI; dipakai backend/PDF untuk menampilkan mode audit. */
+export const STATIC_MODEL = 'qaify-static';
+const MAX_FINDINGS = 40;
+const MAX_SMOKE_PAGES = 15;
+const MAX_SMOKE_ROUTES = 40;
+const BE_URL = 'http://127.0.0.1:8000';
+const FE_URL = 'http://127.0.0.1:5173';
+const VIEWPORTS = [
+    { name: 'desktop', width: 1366, height: 768 },
+    { name: 'mobile', width: 390, height: 844 },
+];
+const SEVERITY_ORDER = ['critical', 'high', 'medium', 'low'];
+const PENALTY = { critical: 25, high: 10, medium: 4, low: 1 };
+const MIN = 60_000;
+/** Folder kerja hasil audit-context: apps/fe, apps/be, context.json, evidence/. */
+export async function auditStatic(dir, deps) {
+    await mkdir(join(dir, '.qaify'), { recursive: true });
+    await mkdir(join(dir, 'evidence'), { recursive: true });
+    const context = await readFile(join(dir, 'context.json'), 'utf8').then(JSON.parse, () => ({}));
+    const login = parseLogin(String(context?.project?.instructions ?? ''));
+    const be = await auditBe(join(dir, 'apps', 'be'), dir, deps);
+    let fe;
+    try {
+        fe = await auditFe(join(dir, 'apps', 'fe'), dir, deps, login);
+    }
+    finally {
+        be.stop();
+    }
+    const findings = [...be.result.findings, ...fe.findings].sort(bySeverity).slice(0, MAX_FINDINGS);
+    return {
+        summary: { be: summarize('BE', be.result), fe: summarize('FE', fe) },
+        findings,
+    };
+}
+/** Bentuk keluaran `claude -p --output-format json` agar parseAuditOutput / audit-submit tidak berubah. */
+export function toAuditOutput(audit, durationMs) {
+    return JSON.stringify({
+        type: 'result',
+        subtype: 'success',
+        duration_ms: durationMs,
+        structured_output: audit,
+        usage: { input_tokens: 0, output_tokens: 0 },
+        modelUsage: { [STATIC_MODEL]: { outputTokens: 0 } },
+    });
+}
+// ---------------------------------------------------------------- BE
+async function auditBe(root, dir, deps) {
+    const result = { findings: [], booted: false, notes: [] };
+    const none = { result, stop: () => { } };
+    const { shell, log } = deps;
+    if (!(await exists(root))) {
+        result.notes.push('Repo BE tidak ada di folder kerja.');
+        return none;
+    }
+    if (await exists(join(root, 'composer.lock'))) {
+        log('qa-factory: [be] composer audit');
+        const audit = await shell.run('composer audit --locked --format=json --no-interaction', { cwd: root, timeoutMs: 3 * MIN });
+        result.findings.push(...parseComposerAudit(audit.output));
+        result.notes.push('composer audit dijalankan.');
+    }
+    if (!(await exists(join(root, 'artisan')))) {
+        result.notes.push('Bukan proyek Laravel (artisan tidak ada): BE tidak dijalankan.');
+        return none;
+    }
+    // .env ke database service runner (MySQL, atau PostgreSQL bila .env.example memakai pgsql)
+    const example = await readFile(join(root, '.env.example'), 'utf8').catch(() => '');
+    const pgsql = /^DB_CONNECTION=pgsql/m.test(example);
+    await writeFile(join(root, '.env'), setEnv(example, {
+        APP_ENV: 'local',
+        APP_DEBUG: 'true',
+        APP_URL: BE_URL,
+        DB_CONNECTION: pgsql ? 'pgsql' : 'mysql',
+        DB_HOST: '127.0.0.1',
+        DB_PORT: pgsql ? '5432' : '3306',
+        DB_DATABASE: 'app',
+        DB_USERNAME: pgsql ? 'postgres' : 'root',
+        DB_PASSWORD: pgsql ? 'postgres' : 'root',
+    }));
+    log('qa-factory: [be] composer install');
+    const install = await shell.run('composer install --no-interaction --no-progress --prefer-dist', { cwd: root, timeoutMs: 10 * MIN });
+    if (install.code !== 0) {
+        result.findings.push(bootFailure('be', 'composer install gagal', 'Dependensi BE tidak bisa dipasang.', install.output, 'composer.json'));
+        result.notes.push('composer install gagal: BE tidak dijalankan.');
+        return none;
+    }
+    log('qa-factory: [be] migrate --seed');
+    const migrate = await shell.run('php artisan key:generate --force --no-interaction && php artisan migrate --seed --force --no-interaction', {
+        cwd: root,
+        timeoutMs: 5 * MIN,
+    });
+    const migrated = migrate.code === 0;
+    if (!migrated) {
+        result.findings.push(bootFailure('be', 'Migrasi / seed database gagal', 'php artisan migrate --seed gagal di database kosong.', migrate.output, 'database/migrations'));
+    }
+    if (await exists(join(root, 'tests'))) {
+        log('qa-factory: [be] php artisan test');
+        const junit = join(dir, '.qaify', 'be-junit.xml');
+        const test = await shell.run(`php artisan test --log-junit "${junit}"`, { cwd: root, timeoutMs: 15 * MIN });
+        const xml = await readFile(junit, 'utf8').catch(() => '');
+        const failures = parseJunit(xml, root);
+        result.findings.push(...failures);
+        if (!xml && test.code !== 0) {
+            result.findings.push({
+                repo: 'be',
+                area: 'error_handling',
+                severity: 'medium',
+                title: 'Test BE tidak bisa dijalankan',
+                description: 'php artisan test berhenti sebelum menghasilkan laporan.',
+                evidence: { response: tail(test.output) },
+                suggestion: 'Jalankan php artisan test secara lokal dan perbaiki konfigurasi test (phpunit.xml, database test).',
+            });
+        }
+        result.notes.push(xml ? `php artisan test: ${failures.length} test gagal.` : 'php artisan test tidak menghasilkan laporan.');
+    }
+    else {
+        result.notes.push('Folder tests tidak ada: test BE dilewati.');
+    }
+    log('qa-factory: [be] php artisan serve');
+    const stop = shell.background(`php artisan serve --host=127.0.0.1 --port=8000`, { cwd: root, logFile: join(dir, '.qaify', 'be-serve.log') });
+    if (!(await waitHttp(BE_URL, 30_000, deps.fetch))) {
+        result.findings.push(bootFailure('be', 'Server BE tidak bisa dijalankan', 'php artisan serve tidak merespons dalam 30 detik.', await readFile(join(dir, '.qaify', 'be-serve.log'), 'utf8').catch(() => '')));
+        return { result, stop };
+    }
+    result.booted = migrated;
+    const routes = await shell.run('php artisan route:list --json --no-interaction', { cwd: root, timeoutMs: MIN });
+    const smoke = pickSmokeRoutes(routes.output);
+    for (const uri of smoke) {
+        const url = `${BE_URL}/${uri.replace(/^\//, '')}`;
+        const res = await deps.fetch(url, { headers: { Accept: 'application/json' }, signal: AbortSignal.timeout(10_000) }).catch(() => null);
+        if (res && res.status >= 500) {
+            result.findings.push({
+                repo: 'be',
+                area: 'error_handling',
+                severity: 'high',
+                title: `GET /${uri} membalas ${res.status}`,
+                description: `Route publik GET /${uri} membalas ${res.status} pada database hasil seed.`,
+                evidence: { request: `GET ${url}`, response: tail(await res.text().catch(() => ''), 2000) },
+                suggestion: 'Cek laravel.log untuk exception di route ini dan tangani kasus data kosong / parameter yang hilang.',
+            });
+        }
+    }
+    result.notes.push(`Smoke API: ${smoke.length} route GET publik dipanggil.`);
+    return { result, stop };
+}
+// ---------------------------------------------------------------- FE
+async function auditFe(root, dir, deps, login) {
+    const result = { findings: [], booted: false, notes: [] };
+    const { shell, log } = deps;
+    const pkg = await readFile(join(root, 'package.json'), 'utf8').then(JSON.parse, () => null);
+    if (!pkg) {
+        result.notes.push('package.json tidak ada: FE tidak dijalankan.');
+        return result;
+    }
+    const scripts = pkg.scripts ?? {};
+    const hasLock = await exists(join(root, 'package-lock.json'));
+    if (hasLock) {
+        log('qa-factory: [fe] npm audit');
+        const audit = await shell.run('npm audit --omit=dev --json --package-lock-only', { cwd: root, timeoutMs: 3 * MIN });
+        result.findings.push(...parseNpmAudit(audit.output));
+        result.notes.push('npm audit dijalankan.');
+    }
+    log('qa-factory: [fe] npm install');
+    const install = await shell.run(hasLock ? 'npm ci --no-audit --no-fund' : 'npm install --no-audit --no-fund', { cwd: root, timeoutMs: 10 * MIN });
+    if (install.code !== 0) {
+        result.findings.push(bootFailure('fe', 'Instalasi dependensi FE gagal', 'npm ci / npm install gagal.', install.output, 'package.json'));
+        result.notes.push('Instalasi dependensi gagal: FE tidak dijalankan.');
+        return result;
+    }
+    // API diarahkan ke BE lokal: setiap VITE_* berisi URL http di .env.example
+    const example = (await readFile(join(root, '.env.example'), 'utf8').catch(() => '')) || (await readFile(join(root, '.env'), 'utf8').catch(() => ''));
+    await writeFile(join(root, '.env.local'), localApiEnv(example));
+    if (scripts.build) {
+        log('qa-factory: [fe] npm run build');
+        const build = await shell.run('npm run build', { cwd: root, timeoutMs: 10 * MIN });
+        if (build.code !== 0) {
+            result.findings.push({
+                repo: 'fe',
+                area: 'ui',
+                severity: 'critical',
+                title: 'Build FE gagal',
+                description: 'npm run build gagal; aplikasi tidak bisa di-deploy dari commit ini.',
+                evidence: { response: tail(build.output) },
+                suggestion: 'Perbaiki error build / type-check pada log di atas.',
+            });
+        }
+        result.notes.push(build.code === 0 ? 'Build berhasil.' : 'Build gagal.');
+    }
+    if (!scripts.dev) {
+        result.notes.push('Script dev tidak ada: smoke test UI dilewati.');
+        return result;
+    }
+    log('qa-factory: [fe] npm run dev');
+    const stop = shell.background('npm run dev -- --host 127.0.0.1 --port 5173 --strictPort', { cwd: root, logFile: join(dir, '.qaify', 'fe-dev.log') });
+    try {
+        if (!(await waitHttp(FE_URL, 60_000, deps.fetch))) {
+            result.findings.push(bootFailure('fe', 'Dev server FE tidak bisa dijalankan', 'npm run dev tidak merespons dalam 60 detik.', await readFile(join(dir, '.qaify', 'fe-dev.log'), 'utf8').catch(() => '')));
+            return result;
+        }
+        result.booted = true;
+        const browser = await deps.launch().catch(() => null);
+        if (!browser) {
+            result.notes.push('Playwright tidak tersedia: smoke test UI dilewati.');
+            return result;
+        }
+        try {
+            const smoke = await smokeUi(browser, FE_URL, join(dir, 'evidence'), login, log);
+            result.findings.push(...smoke.findings);
+            result.notes.push(`Smoke UI: ${smoke.pages} halaman di desktop & mobile${login ? (smoke.loggedIn ? ', login berhasil' : ', login gagal') : ''}.`);
+        }
+        finally {
+            await browser.close().catch(() => { });
+        }
+    }
+    finally {
+        stop();
+    }
+    return result;
+}
+/** Jelajah link same-origin (BFS) di desktop, lalu ulangi halaman yang sama di mobile. */
+export async function smokeUi(browser, baseUrl, evidenceDir, login, log = () => { }) {
+    const origin = new URL(baseUrl).origin;
+    const issues = [];
+    const screenshots = new Map();
+    let paths = [];
+    let loggedIn = false;
+    for (const viewport of VIEWPORTS) {
+        const context = await browser.newContext({ viewport: { width: viewport.width, height: viewport.height } });
+        try {
+            const page = await context.newPage();
+            let current = '/';
+            const push = (issue) => issues.push({ ...issue, path: current, viewport: viewport.name });
+            // "Failed to load resource" sudah tercatat lewat response (atau aset seperti favicon yang tidak penting)
+            page.on('console', (m) => m.type() === 'error' && !/^Failed to load resource/.test(String(m.text())) && push({ kind: 'script', message: String(m.text()) }));
+            page.on('pageerror', (e) => push({ kind: 'script', message: String(e?.message ?? e) }));
+            page.on('response', (r) => {
+                const type = r.request().resourceType();
+                if ((type === 'xhr' || type === 'fetch') && r.status() >= 400) {
+                    push({ kind: 'response', status: r.status(), message: `${r.request().method()} ${stripOrigin(r.url(), origin)} → ${r.status()}` });
+                }
+            });
+            const visit = async (path) => {
+                current = path;
+                try {
+                    const res = (await page.goto(origin + path, { waitUntil: 'networkidle', timeout: 20_000 }));
+                    const status = res?.status?.() ?? 200;
+                    if (status >= 400) {
+                        push({ kind: 'navigation', message: `Halaman membalas ${status}.` });
+                        return false;
+                    }
+                    return true;
+                }
+                catch (e) {
+                    push({ kind: 'navigation', message: `Halaman gagal dimuat: ${e.message.split('\n')[0]}` });
+                    return false;
+                }
+            };
+            await visit('/');
+            if (login && (await page.locator('input[type=password]').count()) > 0) {
+                await page.locator('input[type=email], input[name*=email i], input[name*=user i], input[type=text]').first().fill(login.email).catch(() => { });
+                const password = page.locator('input[type=password]').first();
+                await password.fill(login.password).catch(() => { });
+                await password.press('Enter').catch(() => { });
+                await page.waitForLoadState('networkidle', { timeout: 15_000 }).catch(() => { });
+                loggedIn = (await page.locator('input[type=password]').count()) === 0;
+            }
+            const queue = viewport.name === 'desktop' ? [pathOf(page.url(), origin) ?? '/'] : [...paths];
+            const seen = new Set();
+            while (queue.length && seen.size < MAX_SMOKE_PAGES) {
+                const path = queue.shift();
+                if (seen.has(path))
+                    continue;
+                seen.add(path);
+                const before = issues.length;
+                if (!(await visit(path)))
+                    continue;
+                const overflow = await page.evaluate('document.documentElement.scrollWidth > window.innerWidth + 1').catch(() => false);
+                if (overflow)
+                    push({ kind: 'overflow', message: 'Konten meluap horizontal (muncul scroll ke samping).' });
+                if (viewport.name === 'desktop') {
+                    const links = (await page.evaluate('[...document.querySelectorAll("a[href]")].map((a) => a.href)').catch(() => []));
+                    for (const href of Array.isArray(links) ? links : []) {
+                        const next = pathOf(String(href), origin);
+                        if (next && !seen.has(next) && !/log-?out|sign-?out|keluar/i.test(next))
+                            queue.push(next);
+                    }
+                }
+                if (issues.length > before) {
+                    const file = `fe-${viewport.name}-${slug(path)}.png`;
+                    await page
+                        .screenshot({ path: join(evidenceDir, file) })
+                        .then(() => screenshots.set(`${viewport.name} ${path}`, `evidence/${file}`))
+                        .catch(() => { });
+                }
+            }
+            if (viewport.name === 'desktop')
+                paths = [...seen];
+            log(`qa-factory: [fe] smoke ${viewport.name}: ${seen.size} halaman`);
+        }
+        finally {
+            await context.close().catch(() => { });
+        }
+    }
+    return { findings: issuesToFindings(issues, screenshots), pages: paths.length, loggedIn };
+}
+/** Satu temuan per (jenis, halaman); pesan sama di beberapa viewport digabung. */
+function issuesToFindings(issues, screenshots) {
+    const groups = new Map();
+    for (const issue of issues) {
+        const key = `${issue.kind === 'response' && (issue.status ?? 0) >= 500 ? 'response5xx' : issue.kind} ${issue.path}`;
+        groups.set(key, [...(groups.get(key) ?? []), issue]);
+    }
+    return [...groups.values()].map((group) => {
+        const first = group[0];
+        const viewports = [...new Set(group.map((i) => i.viewport))];
+        const messages = [...new Set(group.map((i) => i.message))];
+        const screenshot = viewports.map((v) => screenshots.get(`${v} ${first.path}`)).find(Boolean);
+        const where = `${first.path} (${viewports.join(', ')})`;
+        const base = { repo: 'fe', evidence: screenshot ? { screenshot } : undefined };
+        const list = messages.slice(0, 5).map((m) => `- ${m}`).join('\n') + (messages.length > 5 ? `\n- … ${messages.length - 5} lainnya` : '');
+        switch (first.kind) {
+            case 'script':
+                return { ...base, area: 'error_handling', severity: 'high', title: `Error JavaScript di ${first.path}`, description: `Error console / JavaScript di ${where}:\n${list}`, suggestion: 'Buka halaman ini dengan DevTools dan perbaiki error yang tercatat.' };
+            case 'response':
+                return {
+                    ...base,
+                    area: 'api_contract',
+                    severity: (first.status ?? 0) >= 500 ? 'high' : 'medium',
+                    title: `Request API gagal di ${first.path}`,
+                    description: `Request XHR/fetch gagal saat membuka ${where}:\n${list}`,
+                    suggestion: 'Cocokkan endpoint, parameter, dan otorisasi yang dipanggil FE dengan route BE.',
+                };
+            case 'overflow':
+                return { ...base, area: 'ui', severity: 'medium', title: `Tampilan meluap horizontal di ${first.path}`, description: `Lebar konten melebihi layar di ${where}.`, suggestion: 'Bungkus tabel/elemen lebar dengan overflow-x-auto atau buat layout responsif.' };
+            default:
+                return { ...base, area: 'error_handling', severity: 'high', title: `Halaman ${first.path} gagal dimuat`, description: `${where}:\n${list}`, suggestion: 'Pastikan route FE ada dan tidak menunggu request yang menggantung.' };
+        }
+    });
+}
+// ---------------------------------------------------------------- parser & helper (diuji terpisah)
+/** Test gagal / error dari laporan JUnit PHPUnit / Pest. */
+export function parseJunit(xml, root = '') {
+    const findings = [];
+    for (const match of xml.matchAll(/<testcase\b([^>]*?)(?:\/>|>([\s\S]*?)<\/testcase>)/g)) {
+        const body = match[2] ?? '';
+        const failure = /<(failure|error)\b[^>]*?(?:\/>|>([\s\S]*?)<\/\1>)/.exec(body);
+        if (!failure)
+            continue;
+        const attrs = attributes(match[1] ?? '');
+        const name = attrs.name ?? 'test';
+        const cls = attrs.class ?? attrs.classname ?? '';
+        const file = attrs.file ? relativeTo(attrs.file, root) : undefined;
+        const message = decode(failure[2] ?? '').trim();
+        findings.push({
+            repo: 'be',
+            area: 'business_logic',
+            severity: 'high',
+            title: `Test gagal: ${cls ? `${cls.split(/[\\.]/).pop()}::` : ''}${name}`.slice(0, 120),
+            description: message.slice(0, 4000) || 'Test gagal tanpa pesan.',
+            file,
+            line: attrs.line ? Number(attrs.line) : undefined,
+            suggestion: 'Jalankan test ini secara lokal; perbaiki kode atau perbarui test bila perilakunya memang berubah.',
+        });
+    }
+    return findings;
+}
+/** `composer audit --format=json` → satu temuan per advisory. */
+export function parseComposerAudit(output) {
+    const data = parseJsonLoose(output);
+    const advisories = data?.advisories && typeof data.advisories === 'object' ? data.advisories : {};
+    const findings = [];
+    for (const [pkg, list] of Object.entries(advisories)) {
+        for (const advisory of Array.isArray(list) ? list : Object.values(list ?? {})) {
+            const severity = SEVERITY_ORDER.includes(advisory?.severity) ? advisory.severity : 'high';
+            findings.push({
+                repo: 'be',
+                area: 'security',
+                severity,
+                title: `${pkg}: ${advisory?.title ?? 'kerentanan diketahui'}`.slice(0, 120),
+                description: [advisory?.title, advisory?.cve && `CVE: ${advisory.cve}`, advisory?.affectedVersions && `Versi terdampak: ${advisory.affectedVersions}`, advisory?.link]
+                    .filter(Boolean)
+                    .join('\n'),
+                file: 'composer.lock',
+                suggestion: `composer update ${pkg} ke versi yang sudah diperbaiki.`,
+            });
+        }
+    }
+    return findings;
+}
+/** `npm audit --json` (npm 7+) → satu temuan per paket berseverity high/critical. */
+export function parseNpmAudit(output) {
+    const data = parseJsonLoose(output);
+    const findings = [];
+    for (const [name, vuln] of Object.entries((data?.vulnerabilities ?? {}))) {
+        if (vuln?.severity !== 'high' && vuln?.severity !== 'critical')
+            continue;
+        const advisories = (Array.isArray(vuln.via) ? vuln.via : []).filter((v) => v && typeof v === 'object');
+        const fix = vuln.fixAvailable;
+        findings.push({
+            repo: 'fe',
+            area: 'security',
+            severity: vuln.severity,
+            title: `${name}: ${advisories[0]?.title ?? 'kerentanan diketahui'}`.slice(0, 120),
+            description: [
+                ...advisories.slice(0, 3).map((a) => `${a.title}${a.url ? ` (${a.url})` : ''}`),
+                vuln.range && `Versi terdampak: ${vuln.range}`,
+                vuln.isDirect ? 'Dependensi langsung.' : 'Dependensi tidak langsung.',
+            ]
+                .filter(Boolean)
+                .join('\n'),
+            file: 'package-lock.json',
+            suggestion: fix && typeof fix === 'object' ? `Perbarui ${fix.name} ke ${fix.version}${fix.isSemVerMajor ? ' (major)' : ''}.` : fix ? 'Jalankan npm audit fix.' : 'Belum ada versi perbaikan; pertimbangkan mengganti paket.',
+        });
+    }
+    return findings;
+}
+/** URI route GET tanpa parameter dan tanpa middleware autentikasi dari `route:list --json`. */
+export function pickSmokeRoutes(output) {
+    const routes = parseJsonLoose(output);
+    if (!Array.isArray(routes))
+        return [];
+    const uris = routes
+        .filter((r) => String(r?.method ?? '').split('|').includes('GET'))
+        .filter((r) => typeof r?.uri === 'string' && !r.uri.includes('{') && !/^(_|telescope|horizon|pulse|livewire|sanctum|storage)/.test(r.uri))
+        .filter((r) => !(Array.isArray(r?.middleware) ? r.middleware : []).some((m) => /^(auth|verified|signed|can:|password\.confirm)/.test(String(m).split('\\').pop() ?? '') || /Authenticate/.test(String(m))))
+        .map((r) => String(r.uri));
+    return [...new Set(uris)].slice(0, MAX_SMOKE_ROUTES);
+}
+export function scoreRepo(findings, booted) {
+    const score = Math.max(0, 100 - findings.reduce((sum, f) => sum + (PENALTY[f.severity] ?? 0), 0));
+    return booted ? score : Math.min(score, 40);
+}
+/** Akun login dari catatan aplikasi, mis. "Login admin@pos.test / password". */
+export function parseLogin(instructions) {
+    const match = /([\w.+-]+@[\w-]+(?:\.[\w-]+)+)\s*\/\s*(\S+)/.exec(instructions);
+    return match ? { email: match[1], password: match[2] } : null;
+}
+/** Variabel VITE_* berisi URL http diarahkan ke BE lokal; path (mis. /api) dipertahankan. */
+export function localApiEnv(example) {
+    const lines = [];
+    for (const match of example.matchAll(/^(VITE_[A-Z0-9_]+)=["']?(https?:\/\/[^"'\s]*)["']?\s*$/gm)) {
+        const path = new URL(match[2]).pathname.replace(/\/$/, '');
+        lines.push(`${match[1]}=${BE_URL}${path}`);
+    }
+    return lines.join('\n') + (lines.length ? '\n' : '');
+}
+/** Ganti / tambah KEY=VALUE di isi file .env. */
+export function setEnv(content, values) {
+    let out = content;
+    for (const [key, value] of Object.entries(values)) {
+        const line = `${key}=${value}`;
+        const pattern = new RegExp(`^#?\\s*${key}=.*$`, 'm');
+        out = pattern.test(out) ? out.replace(pattern, line) : `${out.replace(/\n?$/, '\n')}${line}\n`;
+    }
+    return out;
+}
+function summarize(label, result) {
+    const score = scoreRepo(result.findings, result.booted);
+    return {
+        score,
+        verdict: !result.booted ? `${label} gagal dijalankan` : score >= 80 ? `${label} sesuai` : `${label} perlu perbaikan`,
+        booted: result.booted,
+        notes: ['Audit tanpa AI.', ...result.notes].join(' '),
+    };
+}
+function bootFailure(repo, title, description, output, file) {
+    return {
+        repo,
+        area: 'error_handling',
+        severity: 'critical',
+        title,
+        description,
+        file,
+        evidence: { response: tail(output) },
+        suggestion: 'Ikuti log di bukti; pastikan aplikasi bisa dipasang dan dijalankan dari README di lingkungan bersih.',
+    };
+}
+const bySeverity = (a, b) => SEVERITY_ORDER.indexOf(a.severity) - SEVERITY_ORDER.indexOf(b.severity);
+const tail = (text, max = 4000) => (text.length > max ? `…${text.slice(-max)}` : text);
+const exists = (path) => stat(path).then(() => true, () => false);
+function pathOf(href, origin) {
+    try {
+        const url = new URL(href, origin);
+        return url.origin === origin ? url.pathname + url.search : null;
+    }
+    catch {
+        return null;
+    }
+}
+const stripOrigin = (url, origin) => (url.startsWith(origin) ? url.slice(origin.length) : url);
+const slug = (path) => path.replace(/[^a-z0-9]+/gi, '-').replace(/^-|-$/g, '').slice(0, 60) || 'root';
+function attributes(raw) {
+    return Object.fromEntries([...raw.matchAll(/([\w:-]+)="([^"]*)"/g)].map((m) => [m[1], decode(m[2])]));
+}
+const decode = (text) => text
+    .replace(/<!\[CDATA\[([\s\S]*?)\]\]>/g, '$1')
+    .replace(/&lt;/g, '<')
+    .replace(/&gt;/g, '>')
+    .replace(/&quot;/g, '"')
+    .replace(/&#0?39;|&apos;/g, "'")
+    .replace(/&#10;/g, '\n')
+    .replace(/&amp;/g, '&');
+function relativeTo(file, root) {
+    const normalized = file.replace(/\\/g, '/');
+    const base = root.replace(/\\/g, '/').replace(/\/$/, '');
+    return base && normalized.startsWith(`${base}/`) ? normalized.slice(base.length + 1) : normalized.replace(/^.*?\/(tests|app|src)\//, '$1/');
+}
+/** Keluaran composer/npm kadang diawali peringatan; ambil dari karakter JSON pertama. */
+function parseJsonLoose(output) {
+    const start = output.search(/[[{]/);
+    if (start < 0)
+        return null;
+    try {
+        return JSON.parse(output.slice(start));
+    }
+    catch {
+        return null;
+    }
+}
+async function waitHttp(url, timeoutMs, doFetch) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        const ok = await doFetch(url, { signal: AbortSignal.timeout(5_000) }).then(() => true, () => false);
+        if (ok)
+            return true;
+        await new Promise((resolve) => setTimeout(resolve, 1_000));
+    }
+    return false;
+}
+// ---------------------------------------------------------------- implementasi nyata (runner Ubuntu)
+export const defaultShell = {
+    run(cmd, { cwd, timeoutMs, env }) {
+        return new Promise((resolve) => {
+            const child = spawn('bash', ['-c', cmd], { cwd, env: { ...process.env, CI: 'true', ...env }, detached: true });
+            let output = '';
+            const collect = (chunk) => {
+                output = (output + chunk.toString()).slice(-200_000);
+            };
+            child.stdout.on('data', collect);
+            child.stderr.on('data', collect);
+            const timer = setTimeout(() => {
+                output += `\n[qaify] dihentikan setelah ${Math.round(timeoutMs / 1000)} detik`;
+                killGroup(child.pid);
+            }, timeoutMs);
+            child.on('error', (e) => {
+                clearTimeout(timer);
+                resolve({ code: 127, output: `${output}\n${e.message}` });
+            });
+            child.on('close', (code) => {
+                clearTimeout(timer);
+                resolve({ code: code ?? 1, output });
+            });
+        });
+    },
+    background(cmd, { cwd, logFile, env }) {
+        const fd = openSync(logFile, 'a');
+        const child = spawn('bash', ['-c', cmd], { cwd, env: { ...process.env, CI: 'true', ...env }, detached: true, stdio: ['ignore', fd, fd] });
+        child.unref();
+        return () => killGroup(child.pid);
+    },
+};
+function killGroup(pid) {
+    if (!pid)
+        return;
+    try {
+        process.kill(-pid, 'SIGKILL');
+    }
+    catch {
+        try {
+            process.kill(pid, 'SIGKILL');
+        }
+        catch {
+            // sudah berhenti
+        }
+    }
+}
+/** playwright-core dipasang global di runner bersama qaify; Google Chrome sudah ada di ubuntu-latest. */
+export async function defaultLaunch() {
+    const name = 'playwright-core';
+    try {
+        const { chromium } = await import(name);
+        return (await chromium.launch({ channel: 'chrome', headless: true }));
+    }
+    catch (e) {
+        console.log(`qa-factory: playwright-core tidak bisa dipakai (${e.message.split('\n')[0]})`);
+        return null;
+    }
+}

package/dist/audit.js

@@ -196,10 +196,10 @@ export async function auditSubmit(client, auditId, claudeOutput, evidenceDir, co
     const base = `/api/ingest/audits/${encodeURIComponent(auditId)}`;
     const parsed = parseAuditOutput(claudeOutput);
     if (!parsed) {
-        log('qa-factory: Claude tidak menghasilkan hasil audit terstruktur');
+        log('qa-factory: auditor tidak menghasilkan hasil audit terstruktur');
         return client.post(`${base}/results`, {
             status: 'failed',
-            error: 'Claude tidak menghasilkan hasil audit. Cek secret CLAUDE_CODE_OAUTH_TOKEN, kuota langganan, atau log step "Audit dengan Claude Code" di repo runner.',
+            error: 'Auditor tidak menghasilkan hasil audit. Cek log step "Audit tanpa AI (Playwright)" atau "Audit dengan Claude Code" di repo runner; untuk mode Claude, cek juga secret CLAUDE_CODE_OAUTH_TOKEN dan kuota langganan.',
             commits,
         });
     }

package/dist/cli.js

@@ -11,11 +11,13 @@
 //   qaify init-runner [--force]              tulis qaify-audit.yml
 //   qaify audit-context --audit <id> --dir <folder kerja>
 //   qaify audit-schema --out schema.json --instructions instructions.txt  |  --prompt
+//   qaify audit-static --dir <folder kerja> --out claude.json   (tanpa AI: build/test/audit + smoke Playwright)
 //   qaify audit-submit --audit <id> --results claude.json --evidence <folder> --context context.json
 import { appendFile, readFile, writeFile } from 'node:fs/promises';
 import { INSTRUCTIONS, RESULT_SCHEMA } from './ai.js';
 import { aiQueue, aiSubmit, analyze, CONCLUSIONS, parseArgs } from './analyze.js';
 import { AUDIT_INSTRUCTIONS, AUDIT_PROMPT, AUDIT_SCHEMA, auditContext, auditSubmit, readCommits } from './audit.js';
+import { auditStatic, defaultLaunch, defaultShell, toAuditOutput } from './audit-static.js';
 import { createClient, describeProblem, MISSING_CONFIG, runFromEnv, warn } from './client.js';
 import { init, initRunner, NEXT_STEPS, RUNNER_NEXT_STEPS } from './init.js';
 import { check } from './check.js';
@@ -29,6 +31,7 @@ const USAGE = `Pemakaian:
   qaify init-runner [--force]
   qaify audit-context --audit <id> --dir <folder>
   qaify audit-schema (--out <file-schema> [--instructions <file>] | --prompt)
+  qaify audit-static --dir <folder> --out <file>
   qaify audit-submit --audit <id> --results <file> --evidence <folder> --context <file>`;
 const args = parseArgs(process.argv.slice(2));
 const client = createClient();
@@ -132,6 +135,18 @@ switch (args.command) {
             await writeFile(args.instructions, AUDIT_INSTRUCTIONS);
         break;
     }
+    // hanya membaca folder kerja; tidak memakai QA_FACTORY_TOKEN
+    case 'audit-static': {
+        if (!args.dir || !args.out) {
+            usage();
+            break;
+        }
+        const started = Date.now();
+        const audit = await auditStatic(args.dir, { shell: defaultShell, fetch, launch: defaultLaunch, log: console.log });
+        await writeFile(args.out, toAuditOutput(audit, Date.now() - started));
+        console.log(`qa-factory: audit tanpa AI selesai, ${audit.findings.length} temuan (FE ${audit.summary.fe.score}, BE ${audit.summary.be.score})`);
+        break;
+    }
     case 'audit-submit': {
         if (!args.audit || !args.results || !args.evidence) {
             usage();
@@ -141,7 +156,7 @@ switch (args.command) {
             warn(`${MISSING_CONFIG} (audit-submit dilewati)`);
             break;
         }
-        // file tidak ada (Claude dilewati / gagal) → audit ditandai gagal
+        // file tidak ada (auditor dilewati / gagal) → audit ditandai gagal
         const output = await readFile(args.results, 'utf8').catch(() => '');
         const commits = args.context ? await readCommits(args.context) : {};
         await auditSubmit(client, args.audit, output, args.evidence, commits);

package/dist/init.d.ts

@@ -5,7 +5,7 @@ export declare const SMOKE_PATH: string;
 export declare const RUNNER_WORKFLOW_PATH: string;
 export declare const REPORTER_SNIPPET = "reporter: [['list'], ['qaify-playwright-reporter']],\nuse: { trace: 'retain-on-failure', video: 'retain-on-failure', screenshot: 'only-on-failure' },";
 export declare const NEXT_STEPS = "Langkah berikutnya:\n  1. GitHub \u2192 Settings \u2192 Secrets and variables \u2192 Actions:\n       secret   QA_FACTORY_TOKEN         (Pengaturan \u2192 Token Reporter di QA Factory)\n       variable QA_FACTORY_URL           (URL API QA Factory, tab Variables)\n       secret   CLAUDE_CODE_OAUTH_TOKEN  (opsional: `claude setup-token`, analisis AI dengan langganan Claude Anda)\n  2. Cek lokal (opsional): npx playwright install chromium && npx playwright test\n  3. Commit file di atas lalu push.";
-export declare const RUNNER_NEXT_STEPS = "Langkah berikutnya (repo runner audit):\n  1. Pasang GitHub App Qaify di repo runner ini dan di repo FE + BE yang akan diaudit.\n  2. Qaify \u2192 Pengaturan \u2192 Token Reporter: buat token untuk repo runner ini.\n  3. GitHub \u2192 Settings \u2192 Secrets and variables \u2192 Actions:\n       secret   QA_FACTORY_TOKEN         (token dari langkah 2)\n       variable QA_FACTORY_URL           (URL API Qaify, tab Variables)\n       secret   CLAUDE_CODE_OAUTH_TOKEN  (`claude setup-token`, langganan Claude Pro/Max Anda)\n  4. Commit .github/workflows/qaify-audit.yml ke default branch lalu push.\n  5. Qaify \u2192 Aplikasi \u2192 Tambah aplikasi: pilih repo FE, BE, dan runner ini, lalu klik \"Audit sekarang\".";
+export declare const RUNNER_NEXT_STEPS = "Langkah berikutnya (repo runner audit):\n  1. Pasang GitHub App Qaify di repo runner ini dan di repo FE + BE yang akan diaudit.\n  2. Qaify \u2192 Pengaturan \u2192 Token Reporter: buat token untuk repo runner ini.\n  3. GitHub \u2192 Settings \u2192 Secrets and variables \u2192 Actions:\n       secret   QA_FACTORY_TOKEN         (token dari langkah 2)\n       variable QA_FACTORY_URL           (URL API Qaify, tab Variables)\n       secret   CLAUDE_CODE_OAUTH_TOKEN  (opsional: audit dengan Claude, `claude setup-token`; tanpa ini audit berjalan tanpa AI)\n  4. Commit .github/workflows/qaify-audit.yml ke default branch lalu push.\n  5. Qaify \u2192 Aplikasi \u2192 Tambah aplikasi: pilih repo FE, BE, dan runner ini, lalu klik \"Audit sekarang\".";
 export interface InitAction {
     kind: 'created' | 'skipped' | 'hint';
     path?: string;

package/dist/init.js

@@ -25,7 +25,7 @@ export const RUNNER_NEXT_STEPS = `Langkah berikutnya (repo runner audit):
   3. GitHub → Settings → Secrets and variables → Actions:
        secret   QA_FACTORY_TOKEN         (token dari langkah 2)
        variable QA_FACTORY_URL           (URL API Qaify, tab Variables)
-       secret   CLAUDE_CODE_OAUTH_TOKEN  (\`claude setup-token\`, langganan Claude Pro/Max Anda)
+       secret   CLAUDE_CODE_OAUTH_TOKEN  (opsional: audit dengan Claude, \`claude setup-token\`; tanpa ini audit berjalan tanpa AI)
   4. Commit .github/workflows/qaify-audit.yml ke default branch lalu push.
   5. Qaify → Aplikasi → Tambah aplikasi: pilih repo FE, BE, dan runner ini, lalu klik "Audit sekarang".`;
 const exists = (path) => access(path).then(() => true, () => false);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qaify-playwright-reporter",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Reporter Playwright untuk QA Factory (Qaify): kirim hasil test dan artefak ke /api/ingest, tanpa pernah menggagalkan test.",
   "license": "MIT",
   "author": "ahmdkenz",

package/templates/qaify-audit.yml

@@ -3,11 +3,14 @@
 # Butuh di repo runner ini (Settings → Secrets and variables → Actions):
 #   secret   QA_FACTORY_TOKEN         token reporter repo runner (Pengaturan → Token Reporter)
 #   variable QA_FACTORY_URL           URL API Qaify
-#   secret   CLAUDE_CODE_OAUTH_TOKEN  langganan Claude Pro/Max Anda (`claude setup-token`)
+#   secret   CLAUDE_CODE_OAUTH_TOKEN  opsional: audit dengan Claude (langganan Claude Pro/Max Anda, `claude setup-token`)
+#   variable QA_FACTORY_AUDIT_MODE    opsional, `static` atau `claude` (default: claude bila secret di atas ada)
 #   variable QA_FACTORY_AI_MODEL      opsional, default sonnet
 #   variable QA_FACTORY_MCP_VERSION   opsional, versi @playwright/mcp (default latest)
 # GitHub App Qaify harus terpasang di repo ini dan di repo FE + BE. Nama file harus tetap qaify-audit.yml.
-# Satu audit = satu sesi Claude yang panjang; kuota langganan dipakai bersama pemakaian pribadi.
+# Mode static (tanpa AI): build, test, composer/npm audit, dan smoke test Playwright; cepat, tanpa kuota AI,
+# tetapi tanpa analisis logika bisnis / kontrak API dari kode.
+# Mode claude: satu sesi Claude yang panjang; kuota langganan dipakai bersama pemakaian pribadi.
 name: Qaify audit
 run-name: audit ${{ inputs.audit_id }}
 on:
@@ -41,7 +44,7 @@ jobs:
         options: --health-cmd="pg_isready -U postgres" --health-interval=10s --health-timeout=5s --health-retries=10
     # context runner tidak tersedia di env level job; WORK diisi lewat GITHUB_ENV di step pertama
     env:
-      HAS_CLAUDE: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN != '' }}
+      AUDIT_MODE: ${{ vars.QA_FACTORY_AUDIT_MODE || (secrets.CLAUDE_CODE_OAUTH_TOKEN != '' && 'claude' || 'static') }}
     steps:
       - name: Siapkan direktori kerja
         run: echo "WORK=$RUNNER_TEMP/qaify" >> "$GITHUB_ENV"
@@ -54,10 +57,12 @@ jobs:
           extensions: mbstring, intl, bcmath, gd, zip, pdo_mysql, pdo_pgsql
           tools: composer
 
-      - name: Pasang Qaify CLI & Claude Code
-        run: npm install -g qaify-playwright-reporter@0.3 @anthropic-ai/claude-code
+      - name: Pasang Qaify CLI
+        run: |
+          npm install -g qaify-playwright-reporter@0.4 playwright-core@1
+          if [ "$AUDIT_MODE" = claude ]; then npm install -g @anthropic-ai/claude-code; fi
 
-      # token clone sekali pakai (read-only, hanya repo FE + BE) dicabut sebelum Claude berjalan
+      # token clone sekali pakai (read-only, hanya repo FE + BE) dicabut sebelum auditor berjalan
       - name: Ambil konteks & clone repo FE + BE
         id: ctx
         env:
@@ -65,8 +70,15 @@ jobs:
           QA_FACTORY_TOKEN: ${{ secrets.QA_FACTORY_TOKEN }}
         run: qaify audit-context --audit "${{ inputs.audit_id }}" --dir "$WORK"
 
+      # tanpa secret apa pun: kode aplikasi (composer/npm script) berjalan di step ini
+      - name: Audit tanpa AI (Playwright)
+        if: steps.ctx.outputs.ok == 'true' && env.AUDIT_MODE == 'static'
+        continue-on-error: true
+        timeout-minutes: 45
+        run: qaify audit-static --dir "$WORK" --out "$WORK/.qaify/claude.json"
+
       - name: Siapkan instruksi & Playwright MCP
-        if: steps.ctx.outputs.ok == 'true'
+        if: steps.ctx.outputs.ok == 'true' && env.AUDIT_MODE == 'claude'
         run: |
           mkdir -p "$WORK/.qaify"
           qaify audit-schema --out "$WORK/.qaify/schema.json" --instructions "$WORK/.qaify/instructions.txt"
@@ -77,7 +89,7 @@ jobs:
 
       # hanya CLAUDE_CODE_OAUTH_TOKEN yang tersedia di step ini; QA_FACTORY_TOKEN tidak
       - name: Audit dengan Claude Code (Claude Pro/Max)
-        if: steps.ctx.outputs.ok == 'true' && env.HAS_CLAUDE == 'true'
+        if: steps.ctx.outputs.ok == 'true' && env.AUDIT_MODE == 'claude'
         continue-on-error: true
         timeout-minutes: 45
         working-directory: ${{ runner.temp }}/qaify
@@ -94,7 +106,7 @@ jobs:
             --output-format json --json-schema "$(cat .qaify/schema.json)" \
             > .qaify/claude.json
 
-      # selalu jalan: tanpa hasil Claude, audit ditandai gagal beserta penyebab yang mungkin
+      # selalu jalan: tanpa hasil auditor, audit ditandai gagal beserta penyebab yang mungkin
       - name: Kirim hasil audit
         if: always() && steps.ctx.outputs.ok == 'true'
         env: