qaify-playwright-reporter 0.3.1 → 0.4.1

package/dist/audit-static.js

@@ -0,0 +1,994 @@
+// Audit aplikasi tanpa AI (qaify audit-static): pemeriksaan deterministik di repo runner bila
+// CLAUDE_CODE_OAUTH_TOKEN kosong. Hasilnya berbentuk sama dengan keluaran `claude -p`, jadi audit-submit,
+// backend, dan UI tidak berubah. Temuan lebih dangkal dari mode Claude: tidak ada analisis logika bisnis
+// atau kontrak API dari membaca kode.
+//   BE (Laravel): composer install, migrate --seed, php artisan test, composer audit, smoke route GET publik.
+//   FE (Node): npm ci, npm run build, npm audit, smoke Playwright (desktop + mobile) dengan screenshot setiap halaman,
+//   plus foto bertanda (kotak merah di elemen bermasalah / banner pesan error) untuk setiap masalah.
+// Temuan smoke diberi berkas sumber bila bisa ditebak: route FE → komponen halaman, route BE → method controller;
+// request FE yang gagal juga dipetakan ke controller BE, dan route BE yang error ke halaman FE pemanggilnya.
+import { spawn } from 'node:child_process';
+import { mkdir, readdir, readFile, stat, writeFile } from 'node:fs/promises';
+import { openSync } from 'node:fs';
+import { dirname, join, relative } from 'node:path';
+/** usage.model untuk audit tanpa AI; dipakai backend/PDF untuk menampilkan mode audit. */
+export const STATIC_MODEL = 'qaify-static';
+const MAX_FINDINGS = 40;
+const MAX_SMOKE_PAGES = 15;
+const MAX_SMOKE_ROUTES = 40;
+/** Foto bertanda per halaman per viewport (satu per jenis masalah). */
+const MAX_ISSUE_SHOTS = 3;
+const BE_URL = 'http://127.0.0.1:8000';
+const FE_URL = 'http://127.0.0.1:5173';
+const VIEWPORTS = [
+    { name: 'desktop', width: 1366, height: 768 },
+    { name: 'mobile', width: 390, height: 844 },
+];
+const SEVERITY_ORDER = ['critical', 'high', 'medium', 'low'];
+const PENALTY = { critical: 25, high: 10, medium: 4, low: 1 };
+const MIN = 60_000;
+/** Folder kerja hasil audit-context: apps/fe, apps/be, context.json, evidence/. */
+export async function auditStatic(dir, deps) {
+    await mkdir(join(dir, '.qaify'), { recursive: true });
+    await mkdir(join(dir, 'evidence'), { recursive: true });
+    const context = await readFile(join(dir, 'context.json'), 'utf8').then(JSON.parse, () => ({}));
+    const login = parseLogin(String(context?.project?.instructions ?? ''));
+    const beRoot = join(dir, 'apps', 'be');
+    const feRoot = join(dir, 'apps', 'fe');
+    const be = await auditBe(beRoot, dir, deps);
+    const api = be.routes
+        ? async (method, path) => {
+            const action = matchRoute(be.routes, method, path);
+            return action ? controllerLocation(beRoot, action) : null;
+        }
+        : undefined;
+    let fe;
+    try {
+        fe = await auditFe(feRoot, dir, deps, login, api);
+    }
+    finally {
+        be.stop();
+    }
+    await linkCallers(be.failed, fe, feRoot);
+    const findings = [...be.result.findings, ...fe.findings].sort(bySeverity).slice(0, MAX_FINDINGS);
+    return {
+        summary: { be: summarize('BE', be.result), fe: summarize('FE', fe) },
+        findings,
+        pages: fe.pages ?? [],
+    };
+}
+/** Bentuk keluaran `claude -p --output-format json` agar parseAuditOutput / audit-submit tidak berubah. */
+export function toAuditOutput(audit, durationMs) {
+    return JSON.stringify({
+        type: 'result',
+        subtype: 'success',
+        duration_ms: durationMs,
+        structured_output: audit,
+        usage: { input_tokens: 0, output_tokens: 0 },
+        modelUsage: { [STATIC_MODEL]: { outputTokens: 0 } },
+    });
+}
+/**
+ * Route BE yang error saat smoke API → halaman FE yang memanggilnya: halaman jadi `page`, komponennya masuk
+ * related_files, dan foto halaman itu jadi bukti agar temuan BE juga tampak di laporan.
+ */
+async function linkCallers(failed, fe, feRoot) {
+    for (const { finding, uri } of failed) {
+        const callers = [...(fe.calls ?? [])].filter(([, calls]) => calls.has(`GET /${uri.replace(/^\//, '')}`)).map(([path]) => path);
+        if (!callers.length)
+            continue;
+        finding.page = { path: callers[0], viewport: 'desktop' };
+        finding.description += `\nDipanggil FE di: ${callers.slice(0, 5).join(', ')}.`;
+        const related = [];
+        for (const path of callers.slice(0, 3)) {
+            const location = await resolveRouteFile(feRoot, path).catch(() => null);
+            if (location && !related.some((r) => r.file === location.file))
+                related.push({ repo: 'fe', ...location, role: 'page' });
+        }
+        if (related.length)
+            finding.related_files = related;
+        const shots = (fe.pages ?? [])
+            .filter((p) => p.path === callers[0] && p.screenshot)
+            .map((p) => ({ path: p.screenshot, viewport: p.viewport, caption: `Halaman FE ${p.path} yang memanggil endpoint ini` }));
+        if (shots.length)
+            finding.evidence = { ...finding.evidence, screenshot: shots[0].path, screenshots: shots };
+    }
+}
+async function auditBe(root, dir, deps) {
+    const result = { findings: [], booted: false, notes: [] };
+    const none = { result, stop: () => { }, routes: '', failed: [] };
+    const { shell, log } = deps;
+    if (!(await exists(root))) {
+        result.notes.push('Repo BE tidak ada di folder kerja.');
+        return none;
+    }
+    if (await exists(join(root, 'composer.lock'))) {
+        log('qa-factory: [be] composer audit');
+        const audit = await shell.run('composer audit --locked --format=json --no-interaction', { cwd: root, timeoutMs: 3 * MIN });
+        result.findings.push(...parseComposerAudit(audit.output));
+        result.notes.push('composer audit dijalankan.');
+    }
+    if (!(await exists(join(root, 'artisan')))) {
+        result.notes.push('Bukan proyek Laravel (artisan tidak ada): BE tidak dijalankan.');
+        return none;
+    }
+    // .env ke database service runner (MySQL, atau PostgreSQL bila .env.example memakai pgsql)
+    const example = await readFile(join(root, '.env.example'), 'utf8').catch(() => '');
+    const pgsql = /^DB_CONNECTION=pgsql/m.test(example);
+    await writeFile(join(root, '.env'), setEnv(example, {
+        APP_ENV: 'local',
+        APP_DEBUG: 'true',
+        APP_URL: BE_URL,
+        DB_CONNECTION: pgsql ? 'pgsql' : 'mysql',
+        DB_HOST: '127.0.0.1',
+        DB_PORT: pgsql ? '5432' : '3306',
+        DB_DATABASE: 'app',
+        DB_USERNAME: pgsql ? 'postgres' : 'root',
+        DB_PASSWORD: pgsql ? 'postgres' : 'root',
+    }));
+    log('qa-factory: [be] composer install');
+    const install = await shell.run('composer install --no-interaction --no-progress --prefer-dist', { cwd: root, timeoutMs: 10 * MIN });
+    if (install.code !== 0) {
+        result.findings.push(bootFailure('be', 'composer install gagal', 'Dependensi BE tidak bisa dipasang.', install.output, 'composer.json'));
+        result.notes.push('composer install gagal: BE tidak dijalankan.');
+        return none;
+    }
+    log('qa-factory: [be] migrate --seed');
+    const migrate = await shell.run('php artisan key:generate --force --no-interaction && php artisan migrate --seed --force --no-interaction', {
+        cwd: root,
+        timeoutMs: 5 * MIN,
+    });
+    const migrated = migrate.code === 0;
+    if (!migrated) {
+        result.findings.push(bootFailure('be', 'Migrasi / seed database gagal', 'php artisan migrate --seed gagal di database kosong.', migrate.output, 'database/migrations'));
+    }
+    if (await exists(join(root, 'tests'))) {
+        log('qa-factory: [be] php artisan test');
+        const junit = join(dir, '.qaify', 'be-junit.xml');
+        const test = await shell.run(`php artisan test --log-junit "${junit}"`, { cwd: root, timeoutMs: 15 * MIN });
+        const xml = await readFile(junit, 'utf8').catch(() => '');
+        const failures = parseJunit(xml, root);
+        result.findings.push(...failures);
+        if (!xml && test.code !== 0) {
+            result.findings.push({
+                repo: 'be',
+                area: 'error_handling',
+                severity: 'medium',
+                title: 'Test BE tidak bisa dijalankan',
+                description: 'php artisan test berhenti sebelum menghasilkan laporan.',
+                evidence: { response: tail(test.output) },
+                suggestion: 'Jalankan php artisan test secara lokal dan perbaiki konfigurasi test (phpunit.xml, database test).',
+            });
+        }
+        result.notes.push(xml ? `php artisan test: ${failures.length} test gagal.` : 'php artisan test tidak menghasilkan laporan.');
+    }
+    else {
+        result.notes.push('Folder tests tidak ada: test BE dilewati.');
+    }
+    log('qa-factory: [be] php artisan serve');
+    const stop = shell.background(`php artisan serve --host=127.0.0.1 --port=8000`, { cwd: root, logFile: join(dir, '.qaify', 'be-serve.log') });
+    if (!(await waitHttp(BE_URL, 30_000, deps.fetch))) {
+        result.findings.push(bootFailure('be', 'Server BE tidak bisa dijalankan', 'php artisan serve tidak merespons dalam 30 detik.', await readFile(join(dir, '.qaify', 'be-serve.log'), 'utf8').catch(() => '')));
+        return { ...none, stop };
+    }
+    result.booted = migrated;
+    const routes = await shell.run('php artisan route:list --json --no-interaction', { cwd: root, timeoutMs: MIN });
+    const smoke = pickSmokeRoutes(routes.output);
+    const actions = routeActions(routes.output);
+    const failed = [];
+    for (const uri of smoke) {
+        const url = `${BE_URL}/${uri.replace(/^\//, '')}`;
+        const res = await deps.fetch(url, { headers: { Accept: 'application/json' }, signal: AbortSignal.timeout(10_000) }).catch(() => null);
+        if (res && res.status >= 500) {
+            const action = actions.get(uri);
+            const location = action ? await controllerLocation(root, action) : null;
+            const finding = {
+                repo: 'be',
+                area: 'error_handling',
+                severity: 'high',
+                title: `GET /${uri} membalas ${res.status}`,
+                description: `Route publik GET /${uri}${action ? ` (${action})` : ''} membalas ${res.status} pada database hasil seed.`,
+                ...location,
+                evidence: { request: `GET ${url}`, response: tail(await res.text().catch(() => ''), 2000) },
+                suggestion: 'Cek laravel.log untuk exception di route ini dan tangani kasus data kosong / parameter yang hilang.',
+            };
+            result.findings.push(finding);
+            failed.push({ finding, uri });
+        }
+    }
+    result.notes.push(`Smoke API: ${smoke.length} route GET publik dipanggil.`);
+    return { result, stop, routes: routes.code === 0 ? routes.output : '', failed };
+}
+// ---------------------------------------------------------------- FE
+async function auditFe(root, dir, deps, login, api) {
+    const result = { findings: [], booted: false, notes: [] };
+    const { shell, log } = deps;
+    const pkg = await readFile(join(root, 'package.json'), 'utf8').then(JSON.parse, () => null);
+    if (!pkg) {
+        result.notes.push('package.json tidak ada: FE tidak dijalankan.');
+        return result;
+    }
+    const scripts = pkg.scripts ?? {};
+    const hasLock = await exists(join(root, 'package-lock.json'));
+    if (hasLock) {
+        log('qa-factory: [fe] npm audit');
+        const audit = await shell.run('npm audit --omit=dev --json --package-lock-only', { cwd: root, timeoutMs: 3 * MIN });
+        result.findings.push(...parseNpmAudit(audit.output));
+        result.notes.push('npm audit dijalankan.');
+    }
+    log('qa-factory: [fe] npm install');
+    let install = await shell.run(hasLock ? 'npm ci --no-audit --no-fund' : 'npm install --no-audit --no-fund', { cwd: root, timeoutMs: 10 * MIN });
+    // npm ci gagal umumnya karena package-lock.json tidak sinkron: tetap coba jalankan FE dengan npm install
+    if (install.code !== 0 && hasLock) {
+        const ci = install;
+        log('qa-factory: [fe] npm ci gagal, mencoba npm install');
+        install = await shell.run('npm install --no-audit --no-fund', { cwd: root, timeoutMs: 10 * MIN });
+        if (install.code === 0) {
+            result.findings.push({
+                repo: 'fe',
+                area: 'error_handling',
+                severity: 'medium',
+                title: 'npm ci gagal: package-lock.json tidak sinkron',
+                description: 'npm ci gagal sehingga build CI/deploy yang memakai lockfile bisa gagal; audit dilanjutkan dengan npm install.',
+                file: 'package-lock.json',
+                evidence: { response: tail(ci.output) },
+                suggestion: 'Jalankan npm install secara lokal lalu commit package-lock.json yang diperbarui.',
+            });
+        }
+    }
+    if (install.code !== 0) {
+        result.findings.push(bootFailure('fe', 'Instalasi dependensi FE gagal', 'npm ci / npm install gagal.', install.output, 'package.json'));
+        result.notes.push('Instalasi dependensi gagal: FE tidak dijalankan.');
+        return result;
+    }
+    // API diarahkan ke BE lokal: setiap VITE_* berisi URL http di .env.example
+    const example = (await readFile(join(root, '.env.example'), 'utf8').catch(() => '')) || (await readFile(join(root, '.env'), 'utf8').catch(() => ''));
+    await writeFile(join(root, '.env.local'), localApiEnv(example));
+    if (scripts.build) {
+        log('qa-factory: [fe] npm run build');
+        const build = await shell.run('npm run build', { cwd: root, timeoutMs: 10 * MIN });
+        if (build.code !== 0) {
+            result.findings.push({
+                repo: 'fe',
+                area: 'ui',
+                severity: 'critical',
+                title: 'Build FE gagal',
+                description: 'npm run build gagal; aplikasi tidak bisa di-deploy dari commit ini.',
+                evidence: { response: tail(build.output) },
+                suggestion: 'Perbaiki error build / type-check pada log di atas.',
+            });
+        }
+        result.notes.push(build.code === 0 ? 'Build berhasil.' : 'Build gagal.');
+    }
+    if (!scripts.dev) {
+        result.notes.push('Script dev tidak ada: smoke test UI dilewati.');
+        return result;
+    }
+    log('qa-factory: [fe] npm run dev');
+    const stop = shell.background('npm run dev -- --host 127.0.0.1 --port 5173 --strictPort', { cwd: root, logFile: join(dir, '.qaify', 'fe-dev.log') });
+    try {
+        if (!(await waitHttp(FE_URL, 60_000, deps.fetch))) {
+            result.findings.push(bootFailure('fe', 'Dev server FE tidak bisa dijalankan', 'npm run dev tidak merespons dalam 60 detik.', await readFile(join(dir, '.qaify', 'fe-dev.log'), 'utf8').catch(() => '')));
+            return result;
+        }
+        result.booted = true;
+        const browser = await deps.launch().catch(() => null);
+        if (!browser) {
+            result.notes.push('Playwright tidak tersedia: smoke test UI dilewati.');
+            return result;
+        }
+        try {
+            const smoke = await smokeUi(browser, FE_URL, join(dir, 'evidence'), login, log, (path) => resolveRouteFile(root, path), api);
+            result.findings.push(...smoke.findings);
+            result.pages = smoke.visited;
+            result.calls = smoke.calls;
+            result.notes.push(`Smoke UI: ${smoke.pages} halaman di desktop & mobile${login ? (smoke.loggedIn ? ', login berhasil' : ', login gagal') : ''}.`);
+        }
+        finally {
+            await browser.close().catch(() => { });
+        }
+    }
+    finally {
+        stop();
+    }
+    return result;
+}
+const ASSET_TYPES = new Set(['image', 'script', 'stylesheet', 'font']);
+/** Label kotak merah dan keterangan foto bertanda per jenis masalah. */
+const MARK = {
+    script: { label: 'error', caption: 'Banner merah: error JavaScript yang tercatat' },
+    response: { label: 'API', caption: 'Banner merah: request API yang gagal' },
+    asset: { label: 'aset', caption: 'Banner merah: aset yang gagal dimuat' },
+    overflow: { label: 'meluap', caption: 'Kotak merah: elemen yang melewati lebar layar' },
+    image: { label: 'gambar rusak', caption: 'Kotak merah: gambar yang tidak tampil' },
+    covered: { label: 'tertutup', caption: 'Kotak merah: tombol/tautan yang tertutup elemen lain' },
+    navigation: { label: 'halaman', caption: 'Banner merah: halaman gagal dimuat' },
+};
+/** Satu temuan per (jenis, halaman); API 5xx dipisah dari 4xx karena severity-nya berbeda. */
+const groupKind = (issue) => (issue.kind === 'response' && (issue.status ?? 0) >= 500 ? 'response5xx' : issue.kind);
+/**
+ * Masalah tata letak per elemen di halaman yang sedang terbuka (koordinat dokumen):
+ * - overflow: elemen terluar yang melewati tepi kanan layar (induknya masih muat, tidak di dalam kontainer scroll);
+ * - image: <img> yang gagal dimuat;
+ * - covered: tombol/tautan/input di layar yang titik tengahnya tertutup elemen lain (dikelompokkan per penutup).
+ */
+const LAYOUT_PROBE = `(() => {
+  const W = window.innerWidth, H = window.innerHeight, out = []
+  const name = (el) => el.id ? '#' + el.id : el.tagName.toLowerCase() + [...el.classList].slice(0, 2).map((c) => '.' + c).join('')
+  const box = (r) => ({ x: Math.round(r.left + scrollX), y: Math.round(r.top + scrollY), width: Math.round(r.width), height: Math.round(r.height) })
+  const shown = (el, r) => r.width > 0 && r.height > 0 && getComputedStyle(el).visibility !== 'hidden'
+  const scrolls = (el) => { for (let p = el.parentElement; p && p !== document.body; p = p.parentElement) if (/hidden|auto|scroll|clip/.test(getComputedStyle(p).overflowX)) return true; return false }
+  if (document.documentElement.scrollWidth > W + 1) {
+    let n = 0
+    for (const el of document.body.querySelectorAll('*')) {
+      const r = el.getBoundingClientRect()
+      if (r.right <= W + 1 || el.parentElement.getBoundingClientRect().right > W + 1 || !shown(el, r) || scrolls(el)) continue
+      out.push({ kind: 'overflow', selector: name(el), rect: box(r), message: name(el) + ' melewati lebar layar (' + Math.round(r.right) + 'px > ' + W + 'px).' })
+      if (++n >= 3) break
+    }
+    if (!n) out.push({ kind: 'overflow', message: 'Konten meluap horizontal (muncul scroll ke samping).' })
+  }
+  let images = 0
+  for (const img of document.images) {
+    const r = img.getBoundingClientRect()
+    if (!img.complete || img.naturalWidth > 0 || !img.getAttribute('src') || !shown(img, r)) continue
+    out.push({ kind: 'image', selector: name(img), rect: box(r), message: 'Gambar tidak tampil: ' + img.getAttribute('src').slice(0, 200) })
+    if (++images >= 3) break
+  }
+  const covers = new Map()
+  for (const el of document.querySelectorAll('button:not([disabled]), a[href], input:not([type=hidden]):not([disabled]), select, textarea')) {
+    const r = el.getBoundingClientRect()
+    if (!shown(el, r) || r.top < 0 || r.left < 0 || r.bottom > H || r.right > W) continue
+    const hit = document.elementFromPoint(r.left + r.width / 2, r.top + r.height / 2)
+    if (!hit || el.contains(hit) || hit.contains(el) || [...(el.labels || [])].some((l) => l.contains(hit))) continue
+    const c = covers.get(hit) || { el, r, count: 0 }
+    c.count++
+    covers.set(hit, c)
+  }
+  for (const [hit, c] of [...covers].slice(0, 3)) {
+    out.push({ kind: 'covered', selector: name(c.el), rect: box(c.r), message: name(hit) + ' menutupi ' + (c.count > 1 ? c.count + ' tombol/tautan, mis. ' : '') + name(c.el) + ' sehingga tidak bisa diklik.' })
+  }
+  return out
+})()`;
+/** Pasang kotak merah + label di elemen bermasalah, atau banner pesan error, lalu gulir ke tandanya. */
+function annotate(boxes, banner) {
+    const scrollY = boxes.length ? Math.max(0, Math.min(...boxes.map((b) => b.y)) - 120) : 0;
+    return `((d) => {
+  document.getElementById('__qaify')?.remove()
+  const root = document.createElement('div')
+  root.id = '__qaify'
+  root.style.cssText = 'position:absolute;left:0;top:0;width:0;height:0;z-index:2147483647;pointer-events:none;font:600 12px/1.4 system-ui,sans-serif'
+  for (const b of d.boxes) {
+    const el = document.createElement('div')
+    el.style.cssText = 'position:absolute;box-sizing:border-box;border:3px solid #e11d48;background:rgba(225,29,72,.08);border-radius:4px;left:' + (b.x - 4) + 'px;top:' + (b.y - 4) + 'px;width:' + (b.width + 8) + 'px;height:' + (b.height + 8) + 'px'
+    const tag = document.createElement('div')
+    tag.textContent = b.label
+    tag.style.cssText = 'position:absolute;left:-3px;bottom:100%;margin-bottom:2px;background:#e11d48;color:#fff;padding:1px 6px;border-radius:3px;white-space:nowrap'
+    el.appendChild(tag)
+    root.appendChild(el)
+  }
+  if (d.banner.length) {
+    const el = document.createElement('div')
+    el.style.cssText = 'position:fixed;left:8px;right:8px;top:8px;background:#7f1d1d;color:#fff;padding:8px 10px;border-radius:6px;box-shadow:0 4px 12px rgba(0,0,0,.3);font:12px/1.45 ui-monospace,monospace;white-space:pre-wrap;word-break:break-word'
+    el.textContent = 'Qaify · ' + d.banner.join('\\n')
+    root.appendChild(el)
+  }
+  document.body.appendChild(root)
+  window.scrollTo(0, d.scrollY)
+})(${JSON.stringify({ boxes, banner, scrollY })})`;
+}
+const CLEAR_MARKS = `document.getElementById('__qaify')?.remove(); window.scrollTo(0, 0)`;
+/** Urutan jenis masalah yang difoto bertanda bila melewati batas: tata letak dulu (hanya terlihat dari foto). */
+const SHOT_ORDER = ['overflow', 'covered', 'image', 'script', 'response5xx', 'response', 'asset'];
+/** Foto bertanda untuk masalah halaman ini: satu foto per jenis masalah, maksimal MAX_ISSUE_SHOTS. */
+async function shootIssues(page, found, evidenceDir, prefix) {
+    const groups = new Map();
+    for (const issue of found)
+        if (issue.kind !== 'navigation')
+            groups.set(groupKind(issue), [...(groups.get(groupKind(issue)) ?? []), issue]);
+    const ordered = [...groups].sort(([a], [b]) => SHOT_ORDER.indexOf(a) - SHOT_ORDER.indexOf(b));
+    for (const [kind, group] of ordered.slice(0, MAX_ISSUE_SHOTS)) {
+        const boxes = group
+            .filter((i) => i.rect)
+            .slice(0, 3)
+            .map((i) => ({ ...i.rect, label: `${MARK[i.kind].label}: ${i.selector ?? ''}`.slice(0, 60) }));
+        const banner = boxes.length ? [] : [...new Set(group.map((i) => i.message.slice(0, 300)))].slice(0, 4);
+        const file = `${prefix}-${kind}.png`;
+        const ok = await page
+            .evaluate(annotate(boxes, banner))
+            .then(() => page.screenshot({ path: join(evidenceDir, file) }))
+            .then(() => true, () => false);
+        await page.evaluate(CLEAR_MARKS).catch(() => { });
+        if (ok)
+            for (const issue of group)
+                issue.shot = `evidence/${file}`;
+    }
+}
+/**
+ * Jelajah link same-origin (BFS) di desktop, lalu ulangi halaman yang sama di mobile.
+ * Setiap halaman difoto polos (galeri laporan); setiap jenis masalah difoto lagi dengan tanda (kotak merah di elemen,
+ * atau banner pesan error) sebagai bukti temuannya.
+ * locate: route → berkas sumber halaman (best effort) untuk kolom file temuan dan galeri.
+ * api: request XHR/fetch yang gagal → controller BE (related_files).
+ */
+export async function smokeUi(browser, baseUrl, evidenceDir, login, log = () => { }, locate = async () => null, api = async () => null) {
+    const origin = new URL(baseUrl).origin;
+    const issues = [];
+    const screenshots = new Map();
+    const visited = [];
+    const calls = new Map();
+    let paths = [];
+    let loggedIn = false;
+    for (const viewport of VIEWPORTS) {
+        const context = await browser.newContext({ viewport: { width: viewport.width, height: viewport.height } });
+        try {
+            const page = await context.newPage();
+            let current = '/';
+            const push = (issue) => issues.push({ ...issue, path: current, viewport: viewport.name });
+            // "Failed to load resource" sudah tercatat lewat response (atau aset seperti favicon yang tidak penting)
+            page.on('console', (m) => m.type() === 'error' && !/^Failed to load resource/.test(String(m.text())) && push({ kind: 'script', message: String(m.text()) }));
+            page.on('pageerror', (e) => push({ kind: 'script', message: String(e?.message ?? e) }));
+            page.on('response', (r) => {
+                const type = r.request().resourceType();
+                const url = String(r.url());
+                if (type === 'xhr' || type === 'fetch') {
+                    const method = String(r.request().method());
+                    const endpoint = pathnameOf(url) ?? undefined;
+                    if (endpoint)
+                        calls.set(current, (calls.get(current) ?? new Set()).add(`${method} ${endpoint}`));
+                    if (r.status() >= 400)
+                        push({ kind: 'response', status: r.status(), method, endpoint, message: `${method} ${stripOrigin(url, origin)} → ${r.status()}` });
+                }
+                else if (ASSET_TYPES.has(type) && r.status() >= 400 && !/favicon/i.test(url)) {
+                    push({ kind: 'asset', status: r.status(), message: `${type} ${stripOrigin(url, origin)} → ${r.status()}` });
+                }
+            });
+            // request yang putus (BE mati, CORS, DNS); ERR_ABORTED = dibatalkan karena pindah halaman
+            page.on('requestfailed', (req) => {
+                const error = String(req.failure?.()?.errorText ?? 'gagal');
+                if (/ERR_ABORTED/.test(error))
+                    return;
+                const type = req.resourceType();
+                const url = String(req.url());
+                if (type === 'xhr' || type === 'fetch') {
+                    const method = String(req.method());
+                    push({ kind: 'response', method, endpoint: pathnameOf(url) ?? undefined, message: `${method} ${stripOrigin(url, origin)} → ${error}` });
+                }
+                else if (ASSET_TYPES.has(type) && !/favicon/i.test(url)) {
+                    push({ kind: 'asset', message: `${type} ${stripOrigin(url, origin)} → ${error}` });
+                }
+            });
+            /** Status HTTP halaman; undefined = gagal dimuat. */
+            const visit = async (path) => {
+                current = path;
+                try {
+                    const res = (await page.goto(origin + path, { waitUntil: 'networkidle', timeout: 20_000 }));
+                    const status = res?.status?.() ?? 200;
+                    if (status >= 400)
+                        push({ kind: 'navigation', message: `Halaman membalas ${status}.` });
+                    return status;
+                }
+                catch (e) {
+                    push({ kind: 'navigation', message: `Halaman gagal dimuat: ${e.message.split('\n')[0]}` });
+                    return undefined;
+                }
+            };
+            await visit('/');
+            if (login && (await page.locator('input[type=password]').count()) > 0) {
+                await page.locator('input[type=email], input[name*=email i], input[name*=user i], input[type=text]').first().fill(login.email).catch(() => { });
+                const password = page.locator('input[type=password]').first();
+                await password.fill(login.password).catch(() => { });
+                await password.press('Enter').catch(() => { });
+                await page.waitForLoadState('networkidle', { timeout: 15_000 }).catch(() => { });
+                loggedIn = (await page.locator('input[type=password]').count()) === 0;
+            }
+            const queue = viewport.name === 'desktop' ? [pathOf(page.url(), origin) ?? '/'] : [...paths];
+            const seen = new Set();
+            while (queue.length && seen.size < MAX_SMOKE_PAGES) {
+                const path = queue.shift();
+                if (seen.has(path))
+                    continue;
+                seen.add(path);
+                const before = issues.length;
+                const status = await visit(path);
+                if (status !== undefined && status < 400) {
+                    const layout = await page.evaluate(LAYOUT_PROBE).catch(() => []);
+                    for (const item of Array.isArray(layout) ? layout : []) {
+                        if (item?.kind in MARK)
+                            push({ kind: item.kind, message: String(item.message), selector: item.selector, rect: item.rect });
+                    }
+                    if (viewport.name === 'desktop') {
+                        const links = (await page.evaluate('[...document.querySelectorAll("a[href]")].map((a) => a.href)').catch(() => []));
+                        for (const href of Array.isArray(links) ? links : []) {
+                            const next = pathOf(String(href), origin);
+                            if (next && !seen.has(next) && !/log-?out|sign-?out|keluar/i.test(next))
+                                queue.push(next);
+                        }
+                    }
+                }
+                const file = `fe-${viewport.name}-${slug(path)}.png`;
+                const shot = await page
+                    .screenshot({ path: join(evidenceDir, file) })
+                    .then(() => `evidence/${file}`)
+                    .catch(() => undefined);
+                if (shot)
+                    screenshots.set(`${viewport.name} ${path}`, shot);
+                visited.push({ path, viewport: viewport.name, status, issues: issues.length - before, screenshot: shot });
+                // foto polos dulu (galeri), baru foto bertanda; error async yang datang belakangan tetap memakai foto polos
+                await shootIssues(page, issues.slice(before), evidenceDir, `fe-${viewport.name}-${slug(path)}`);
+            }
+            if (viewport.name === 'desktop')
+                paths = [...seen];
+            log(`qa-factory: [fe] smoke ${viewport.name}: ${seen.size} halaman`);
+        }
+        finally {
+            await context.close().catch(() => { });
+        }
+    }
+    // berkas komponen untuk semua halaman (galeri), bukan hanya yang bermasalah
+    const locations = new Map();
+    for (const path of new Set([...visited.map((p) => p.path), ...issues.map((i) => i.path)]))
+        locations.set(path, await locate(path).catch(() => null));
+    for (const page of visited)
+        Object.assign(page, locations.get(page.path) ?? {});
+    const apis = new Map();
+    for (const issue of issues) {
+        const key = `${issue.method} ${issue.endpoint}`;
+        if (issue.kind === 'response' && issue.method && issue.endpoint && !apis.has(key))
+            apis.set(key, await api(issue.method, issue.endpoint).catch(() => null));
+    }
+    return { findings: issuesToFindings(issues, screenshots, locations, apis), pages: paths.length, loggedIn, visited, calls };
+}
+/**
+ * Satu temuan per (jenis, halaman); pesan sama di beberapa viewport digabung.
+ * Bukti: satu foto per viewport, foto bertanda bila ada, foto polos halaman bila tidak.
+ */
+function issuesToFindings(issues, screenshots, locations, apis) {
+    const groups = new Map();
+    for (const issue of issues) {
+        const key = `${groupKind(issue)} ${issue.path}`;
+        groups.set(key, [...(groups.get(key) ?? []), issue]);
+    }
+    return [...groups.values()].map((group) => {
+        const first = group[0];
+        const viewports = [...new Set(group.map((i) => i.viewport))];
+        const messages = [...new Set(group.map((i) => i.message))];
+        const shots = viewports.flatMap((v) => {
+            const marked = group.find((i) => i.viewport === v && i.shot)?.shot;
+            const path = marked ?? screenshots.get(`${v} ${first.path}`);
+            return path ? [{ path, viewport: v, caption: marked ? MARK[first.kind].caption : `Tampilan halaman ${first.path}` }] : [];
+        });
+        const related = [];
+        for (const issue of group) {
+            const location = apis.get(`${issue.method} ${issue.endpoint}`);
+            if (location && !related.some((r) => r.file === location.file))
+                related.push({ repo: 'be', ...location, role: 'controller' });
+        }
+        const where = `${first.path} (${viewports.join(', ')})`;
+        const base = {
+            repo: 'fe',
+            ...locations.get(first.path),
+            page: { path: first.path, viewport: viewports[0] },
+            ...(related.length ? { related_files: related.slice(0, 5) } : {}),
+            evidence: shots.length ? { screenshot: shots[0].path, screenshots: shots } : undefined,
+        };
+        const list = messages.slice(0, 5).map((m) => `- ${m}`).join('\n') + (messages.length > 5 ? `\n- … ${messages.length - 5} lainnya` : '');
+        switch (first.kind) {
+            case 'script':
+                return { ...base, area: 'error_handling', severity: 'high', title: `Error JavaScript di ${first.path}`, description: `Error console / JavaScript di ${where}:\n${list}`, suggestion: 'Buka halaman ini dengan DevTools dan perbaiki error yang tercatat.' };
+            case 'response':
+                return {
+                    ...base,
+                    area: 'api_contract',
+                    severity: (first.status ?? 0) >= 500 ? 'high' : 'medium',
+                    title: `Request API gagal di ${first.path}`,
+                    description: `Request XHR/fetch gagal saat membuka ${where}:\n${list}${related.length ? `\nDilayani BE di: ${related.map((r) => `${r.file}${r.line ? `:${r.line}` : ''}`).join(', ')}.` : ''}`,
+                    suggestion: 'Cocokkan endpoint, parameter, dan otorisasi yang dipanggil FE dengan route BE.',
+                };
+            case 'asset':
+                return { ...base, area: 'ui', severity: 'medium', title: `Aset gagal dimuat di ${first.path}`, description: `Gambar/script/CSS/font gagal dimuat di ${where}:\n${list}`, suggestion: 'Periksa path aset, base URL build, dan berkas yang belum ikut ter-deploy.' };
+            case 'overflow':
+                return { ...base, area: 'ui', severity: 'medium', title: `Tampilan meluap horizontal di ${first.path}`, description: `Lebar konten melebihi layar di ${where}:\n${list}`, suggestion: 'Bungkus tabel/elemen lebar dengan overflow-x-auto atau buat layout responsif.' };
+            case 'image':
+                return { ...base, area: 'ui', severity: 'low', title: `Gambar tidak tampil di ${first.path}`, description: `Gambar gagal dimuat di ${where}:\n${list}`, suggestion: 'Periksa URL gambar dan sediakan gambar pengganti bila data kosong.' };
+            case 'covered':
+                return { ...base, area: 'ui', severity: 'medium', title: `Tombol/tautan tertutup elemen lain di ${first.path}`, description: `Kontrol tidak bisa diklik karena tertutup di ${where}:\n${list}`, suggestion: 'Periksa z-index, position fixed/absolute, dan overlay yang tidak tertutup.' };
+            default:
+                return { ...base, area: 'error_handling', severity: 'high', title: `Halaman ${first.path} gagal dimuat`, description: `${where}:\n${list}`, suggestion: 'Pastikan route FE ada dan tidak menunggu request yang menggantung.' };
+        }
+    });
+}
+// ---------------------------------------------------------------- parser & helper (diuji terpisah)
+/** Test gagal / error dari laporan JUnit PHPUnit / Pest. */
+export function parseJunit(xml, root = '') {
+    const findings = [];
+    for (const match of xml.matchAll(/<testcase\b([^>]*?)(?:\/>|>([\s\S]*?)<\/testcase>)/g)) {
+        const body = match[2] ?? '';
+        const failure = /<(failure|error)\b[^>]*?(?:\/>|>([\s\S]*?)<\/\1>)/.exec(body);
+        if (!failure)
+            continue;
+        const attrs = attributes(match[1] ?? '');
+        const name = attrs.name ?? 'test';
+        const cls = attrs.class ?? attrs.classname ?? '';
+        const file = attrs.file ? relativeTo(attrs.file, root) : undefined;
+        const message = decode(failure[2] ?? '').trim();
+        findings.push({
+            repo: 'be',
+            area: 'business_logic',
+            severity: 'high',
+            title: `Test gagal: ${cls ? `${cls.split(/[\\.]/).pop()}::` : ''}${name}`.slice(0, 120),
+            description: message.slice(0, 4000) || 'Test gagal tanpa pesan.',
+            file,
+            line: attrs.line ? Number(attrs.line) : undefined,
+            suggestion: 'Jalankan test ini secara lokal; perbaiki kode atau perbarui test bila perilakunya memang berubah.',
+        });
+    }
+    return findings;
+}
+/** `composer audit --format=json` → satu temuan per advisory. */
+export function parseComposerAudit(output) {
+    const data = parseJsonLoose(output);
+    const advisories = data?.advisories && typeof data.advisories === 'object' ? data.advisories : {};
+    const findings = [];
+    for (const [pkg, list] of Object.entries(advisories)) {
+        for (const advisory of Array.isArray(list) ? list : Object.values(list ?? {})) {
+            const severity = SEVERITY_ORDER.includes(advisory?.severity) ? advisory.severity : 'high';
+            findings.push({
+                repo: 'be',
+                area: 'security',
+                severity,
+                title: `${pkg}: ${advisory?.title ?? 'kerentanan diketahui'}`.slice(0, 120),
+                description: [advisory?.title, advisory?.cve && `CVE: ${advisory.cve}`, advisory?.affectedVersions && `Versi terdampak: ${advisory.affectedVersions}`, advisory?.link]
+                    .filter(Boolean)
+                    .join('\n'),
+                file: 'composer.lock',
+                suggestion: `composer update ${pkg} ke versi yang sudah diperbaiki.`,
+            });
+        }
+    }
+    return findings;
+}
+/** `npm audit --json` (npm 7+) → satu temuan per paket berseverity high/critical. */
+export function parseNpmAudit(output) {
+    const data = parseJsonLoose(output);
+    const findings = [];
+    for (const [name, vuln] of Object.entries((data?.vulnerabilities ?? {}))) {
+        if (vuln?.severity !== 'high' && vuln?.severity !== 'critical')
+            continue;
+        const advisories = (Array.isArray(vuln.via) ? vuln.via : []).filter((v) => v && typeof v === 'object');
+        const fix = vuln.fixAvailable;
+        findings.push({
+            repo: 'fe',
+            area: 'security',
+            severity: vuln.severity,
+            title: `${name}: ${advisories[0]?.title ?? 'kerentanan diketahui'}`.slice(0, 120),
+            description: [
+                ...advisories.slice(0, 3).map((a) => `${a.title}${a.url ? ` (${a.url})` : ''}`),
+                vuln.range && `Versi terdampak: ${vuln.range}`,
+                vuln.isDirect ? 'Dependensi langsung.' : 'Dependensi tidak langsung.',
+            ]
+                .filter(Boolean)
+                .join('\n'),
+            file: 'package-lock.json',
+            suggestion: fix && typeof fix === 'object' ? `Perbarui ${fix.name} ke ${fix.version}${fix.isSemVerMajor ? ' (major)' : ''}.` : fix ? 'Jalankan npm audit fix.' : 'Belum ada versi perbaikan; pertimbangkan mengganti paket.',
+        });
+    }
+    return findings;
+}
+/** URI route GET tanpa parameter dan tanpa middleware autentikasi dari `route:list --json`. */
+export function pickSmokeRoutes(output) {
+    const routes = parseJsonLoose(output);
+    if (!Array.isArray(routes))
+        return [];
+    const uris = routes
+        .filter((r) => String(r?.method ?? '').split('|').includes('GET'))
+        .filter((r) => typeof r?.uri === 'string' && !r.uri.includes('{') && !/^(_|telescope|horizon|pulse|livewire|sanctum|storage)/.test(r.uri))
+        .filter((r) => !(Array.isArray(r?.middleware) ? r.middleware : []).some((m) => /^(auth|verified|signed|can:|password\.confirm)/.test(String(m).split('\\').pop() ?? '') || /Authenticate/.test(String(m))))
+        .map((r) => String(r.uri));
+    return [...new Set(uris)].slice(0, MAX_SMOKE_ROUTES);
+}
+/** URI → action (mis. App\Http\Controllers\ProdukController@index) dari `route:list --json`. */
+export function routeActions(output) {
+    const routes = parseJsonLoose(output);
+    const actions = new Map();
+    for (const r of Array.isArray(routes) ? routes : []) {
+        if (typeof r?.uri === 'string' && typeof r?.action === 'string' && r.action !== 'Closure' && !actions.has(r.uri))
+            actions.set(r.uri, r.action);
+    }
+    return actions;
+}
+/**
+ * Request FE (method + path, mis. GET /api/produk/12) → action route BE dari `route:list --json`.
+ * {param} cocok dengan satu segmen, {param?} opsional; bila beberapa cocok, route dengan segmen statis terbanyak menang.
+ */
+export function matchRoute(output, method, path) {
+    const routes = parseJsonLoose(output);
+    const target = path.split(/[?#]/)[0].replace(/^\/+|\/+$/g, '');
+    let best = null;
+    for (const r of Array.isArray(routes) ? routes : []) {
+        if (typeof r?.uri !== 'string' || typeof r?.action !== 'string' || r.action === 'Closure')
+            continue;
+        if (!String(r.method ?? '').split('|').includes(method.toUpperCase()))
+            continue;
+        const segments = r.uri.replace(/^\/+|\/+$/g, '').split('/').filter(Boolean);
+        const pattern = segments
+            .map((s, i) => {
+            const sep = i ? '/' : '';
+            if (/^\{\w+\?\}$/.test(s))
+                return `(?:${sep}[^/]+)?`;
+            return sep + (/^\{\w+\}$/.test(s) ? '[^/]+' : s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'));
+        })
+            .join('');
+        if (!new RegExp(`^${pattern}$`).test(target))
+            continue;
+        const score = segments.filter((s) => !s.startsWith('{')).length;
+        if (score > (best?.score ?? -1))
+            best = { action: r.action, score };
+    }
+    return best?.action ?? null;
+}
+/** Action controller → berkas (PSR-4 App\ → app/) + baris method-nya; controller invokable → __invoke. */
+export async function controllerLocation(root, action) {
+    const [cls, method = '__invoke'] = action.split('@');
+    if (!cls?.startsWith('App\\'))
+        return null;
+    const file = `app/${cls.slice(4).replace(/\\/g, '/')}.php`;
+    const source = await readFile(join(root, file), 'utf8').catch(() => null);
+    if (source === null)
+        return null;
+    const index = source.search(new RegExp(`function\\s+${method.replace(/\W/g, '')}\\s*\\(`));
+    return index < 0 ? { file } : { file, line: lineAt(source, index) };
+}
+const ROUTE_FILE = /(^|\/)(router|routes?)(\/|\.[jt]sx?$)|(^|\/)App\.(vue|[jt]sx)$/i;
+const SOURCE_EXT = ['.vue', '.tsx', '.ts', '.jsx', '.js'];
+/**
+ * Path halaman FE → komponen yang merender (best effort, tanpa menjalankan kode):
+ * 1. definisi route Vue Router / React Router (`path: '/produk'`, `path="/produk"`, termasuk :param dan child relatif)
+ *    → komponen dari import('…') / import X from '…' di dekatnya, atau baris definisi route bila komponen tak ketemu;
+ * 2. routing berbasis berkas (pages/, app/ ala Nuxt / Next).
+ */
+export async function resolveRouteFile(root, path) {
+    const segments = path.split(/[?#]/)[0].split('/').filter(Boolean);
+    const files = (await listSources(join(root, 'src'), 4)).filter((f) => ROUTE_FILE.test(relative(root, f).replace(/\\/g, '/')));
+    let best = null;
+    for (const file of files) {
+        const source = await readFile(file, 'utf8').catch(() => '');
+        for (const m of source.matchAll(/\bpath\s*[:=]\s*\{?\s*(['"`])([^'"`]*)\1/g)) {
+            const score = routeScore(m[2], segments);
+            if (score > (best?.score ?? 0))
+                best = { file, source, index: m.index, score };
+        }
+    }
+    if (best) {
+        const component = await componentNear(root, best.file, best.source, best.index);
+        return component ?? { file: relative(root, best.file).replace(/\\/g, '/'), line: lineAt(best.source, best.index) };
+    }
+    for (const dir of ['src/pages', 'pages', 'src/app', 'app']) {
+        const base = join(root, dir, ...segments);
+        for (const candidate of SOURCE_EXT.flatMap((ext) => [`${base}${ext}`, join(base, `index${ext}`), join(base, `page${ext}`)])) {
+            if (await exists(candidate))
+                return { file: relative(root, candidate).replace(/\\/g, '/') };
+        }
+    }
+    return null;
+}
+/** Kecocokan pola route dengan segmen path: 0 = tidak cocok; pola absolut penuh > child relatif; segmen statis > :param. */
+function routeScore(pattern, segments) {
+    if (/[*(]/.test(pattern))
+        return 0;
+    const parts = pattern.split('/').filter(Boolean);
+    const absolute = pattern.startsWith('/');
+    if (!parts.length)
+        return absolute && !segments.length ? 100 : 0;
+    if (parts.length > segments.length || (absolute && parts.length !== segments.length))
+        return 0;
+    const tail = segments.slice(segments.length - parts.length);
+    if (!parts.every((p, i) => p.startsWith(':') || p === tail[i]))
+        return 0;
+    return (absolute ? 50 : 0) + parts.length * 2 + parts.filter((p) => !p.startsWith(':')).length;
+}
+/** Komponen route di definisi yang sama: dari awal objek `{` / elemen `<Route` sampai definisi path berikutnya. */
+async function componentNear(root, file, source, index) {
+    const next = source.slice(index + 4).search(/\bpath\s*[:=]/);
+    const start = Math.max(0, source.lastIndexOf('{', index), source.lastIndexOf('<', index));
+    const block = source.slice(start, index + 4 + (next < 0 ? 600 : Math.min(next, 600)));
+    let spec = /import\(\s*(?:\/\*[\s\S]*?\*\/\s*)?['"]([^'"]+)['"]\s*\)/.exec(block)?.[1];
+    if (!spec) {
+        const name = /\b(?:component|Component|element)\s*[:=]\s*\{?\s*<?\s*([A-Z]\w*)/.exec(block)?.[1];
+        if (name)
+            spec = new RegExp(`import\\s+${name}\\s+from\\s+['"]([^'"]+)['"]`).exec(source)?.[1];
+    }
+    if (!spec || !(spec.startsWith('.') || spec.startsWith('@/') || spec.startsWith('~/')))
+        return null;
+    const base = spec.startsWith('.') ? join(dirname(file), spec) : join(root, 'src', spec.slice(2));
+    for (const candidate of [base, ...SOURCE_EXT.map((ext) => base + ext), ...SOURCE_EXT.map((ext) => join(base, `index${ext}`))]) {
+        if (await stat(candidate).then((s) => s.isFile(), () => false))
+            return { file: relative(root, candidate).replace(/\\/g, '/') };
+    }
+    return null;
+}
+async function listSources(dir, depth) {
+    if (depth < 0)
+        return [];
+    const entries = await readdir(dir, { withFileTypes: true }).catch(() => []);
+    const out = [];
+    for (const entry of entries) {
+        if (entry.name === 'node_modules' || entry.name.startsWith('.'))
+            continue;
+        const full = join(dir, entry.name);
+        if (entry.isDirectory())
+            out.push(...(await listSources(full, depth - 1)));
+        else if (SOURCE_EXT.some((ext) => entry.name.endsWith(ext)))
+            out.push(full);
+    }
+    return out;
+}
+const lineAt = (source, index) => source.slice(0, index).split('\n').length;
+export function scoreRepo(findings, booted) {
+    const score = Math.max(0, 100 - findings.reduce((sum, f) => sum + (PENALTY[f.severity] ?? 0), 0));
+    return booted ? score : Math.min(score, 40);
+}
+/** Akun login dari catatan aplikasi, mis. "Login admin@pos.test / password". */
+export function parseLogin(instructions) {
+    const match = /([\w.+-]+@[\w-]+(?:\.[\w-]+)+)\s*\/\s*(\S+)/.exec(instructions);
+    return match ? { email: match[1], password: match[2] } : null;
+}
+/** Variabel VITE_* berisi URL http diarahkan ke BE lokal; path (mis. /api) dipertahankan. */
+export function localApiEnv(example) {
+    const lines = [];
+    for (const match of example.matchAll(/^(VITE_[A-Z0-9_]+)=["']?(https?:\/\/[^"'\s]*)["']?\s*$/gm)) {
+        const path = new URL(match[2]).pathname.replace(/\/$/, '');
+        lines.push(`${match[1]}=${BE_URL}${path}`);
+    }
+    return lines.join('\n') + (lines.length ? '\n' : '');
+}
+/** Ganti / tambah KEY=VALUE di isi file .env. */
+export function setEnv(content, values) {
+    let out = content;
+    for (const [key, value] of Object.entries(values)) {
+        const line = `${key}=${value}`;
+        const pattern = new RegExp(`^#?\\s*${key}=.*$`, 'm');
+        out = pattern.test(out) ? out.replace(pattern, line) : `${out.replace(/\n?$/, '\n')}${line}\n`;
+    }
+    return out;
+}
+function summarize(label, result) {
+    const score = scoreRepo(result.findings, result.booted);
+    return {
+        score,
+        verdict: !result.booted ? `${label} gagal dijalankan` : score >= 80 ? `${label} sesuai` : `${label} perlu perbaikan`,
+        booted: result.booted,
+        notes: ['Audit tanpa AI.', ...result.notes].join(' '),
+    };
+}
+function bootFailure(repo, title, description, output, file) {
+    return {
+        repo,
+        area: 'error_handling',
+        severity: 'critical',
+        title,
+        description,
+        file,
+        evidence: { response: tail(output) },
+        suggestion: 'Ikuti log di bukti; pastikan aplikasi bisa dipasang dan dijalankan dari README di lingkungan bersih.',
+    };
+}
+const bySeverity = (a, b) => SEVERITY_ORDER.indexOf(a.severity) - SEVERITY_ORDER.indexOf(b.severity);
+const tail = (text, max = 4000) => (text.length > max ? `…${text.slice(-max)}` : text);
+const exists = (path) => stat(path).then(() => true, () => false);
+function pathOf(href, origin) {
+    try {
+        const url = new URL(href, origin);
+        return url.origin === origin ? url.pathname + url.search : null;
+    }
+    catch {
+        return null;
+    }
+}
+function pathnameOf(url) {
+    try {
+        return new URL(url).pathname;
+    }
+    catch {
+        return null;
+    }
+}
+const stripOrigin = (url, origin) => (url.startsWith(origin) ? url.slice(origin.length) : url);
+const slug = (path) => path.replace(/[^a-z0-9]+/gi, '-').replace(/^-|-$/g, '').slice(0, 60) || 'root';
+function attributes(raw) {
+    return Object.fromEntries([...raw.matchAll(/([\w:-]+)="([^"]*)"/g)].map((m) => [m[1], decode(m[2])]));
+}
+const decode = (text) => text
+    .replace(/<!\[CDATA\[([\s\S]*?)\]\]>/g, '$1')
+    .replace(/&lt;/g, '<')
+    .replace(/&gt;/g, '>')
+    .replace(/&quot;/g, '"')
+    .replace(/&#0?39;|&apos;/g, "'")
+    .replace(/&#10;/g, '\n')
+    .replace(/&amp;/g, '&');
+function relativeTo(file, root) {
+    const normalized = file.replace(/\\/g, '/');
+    const base = root.replace(/\\/g, '/').replace(/\/$/, '');
+    return base && normalized.startsWith(`${base}/`) ? normalized.slice(base.length + 1) : normalized.replace(/^.*?\/(tests|app|src)\//, '$1/');
+}
+/** Keluaran composer/npm kadang diawali peringatan; ambil dari karakter JSON pertama. */
+function parseJsonLoose(output) {
+    const start = output.search(/[[{]/);
+    if (start < 0)
+        return null;
+    try {
+        return JSON.parse(output.slice(start));
+    }
+    catch {
+        return null;
+    }
+}
+async function waitHttp(url, timeoutMs, doFetch) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        const ok = await doFetch(url, { signal: AbortSignal.timeout(5_000) }).then(() => true, () => false);
+        if (ok)
+            return true;
+        await new Promise((resolve) => setTimeout(resolve, 1_000));
+    }
+    return false;
+}
+// ---------------------------------------------------------------- implementasi nyata (runner Ubuntu)
+export const defaultShell = {
+    run(cmd, { cwd, timeoutMs, env }) {
+        return new Promise((resolve) => {
+            const child = spawn('bash', ['-c', cmd], { cwd, env: { ...process.env, CI: 'true', ...env }, detached: true });
+            let output = '';
+            const collect = (chunk) => {
+                output = (output + chunk.toString()).slice(-200_000);
+            };
+            child.stdout.on('data', collect);
+            child.stderr.on('data', collect);
+            const timer = setTimeout(() => {
+                output += `\n[qaify] dihentikan setelah ${Math.round(timeoutMs / 1000)} detik`;
+                killGroup(child.pid);
+            }, timeoutMs);
+            child.on('error', (e) => {
+                clearTimeout(timer);
+                resolve({ code: 127, output: `${output}\n${e.message}` });
+            });
+            child.on('close', (code) => {
+                clearTimeout(timer);
+                resolve({ code: code ?? 1, output });
+            });
+        });
+    },
+    background(cmd, { cwd, logFile, env }) {
+        const fd = openSync(logFile, 'a');
+        const child = spawn('bash', ['-c', cmd], { cwd, env: { ...process.env, CI: 'true', ...env }, detached: true, stdio: ['ignore', fd, fd] });
+        child.unref();
+        return () => killGroup(child.pid);
+    },
+};
+function killGroup(pid) {
+    if (!pid)
+        return;
+    try {
+        process.kill(-pid, 'SIGKILL');
+    }
+    catch {
+        try {
+            process.kill(pid, 'SIGKILL');
+        }
+        catch {
+            // sudah berhenti
+        }
+    }
+}
+/** playwright-core dipasang global di runner bersama qaify; Google Chrome sudah ada di ubuntu-latest. */
+export async function defaultLaunch() {
+    const name = 'playwright-core';
+    try {
+        const { chromium } = await import(name);
+        return (await chromium.launch({ channel: 'chrome', headless: true }));
+    }
+    catch (e) {
+        console.log(`qa-factory: playwright-core tidak bisa dipakai (${e.message.split('\n')[0]})`);
+        return null;
+    }
+}