qaify-playwright-reporter 0.7.0 → 0.9.0

package/dist/audit-static.d.ts

@@ -82,6 +82,13 @@ export interface SourceLocation {
 export declare function auditStatic(dir: string, deps: StaticDeps): Promise<StaticAudit>;
 /** Bentuk keluaran `claude -p --output-format json` agar parseAuditOutput / audit-submit tidak berubah. */
 export declare function toAuditOutput(audit: StaticAudit, durationMs: number): string;
+/** Advisory composer audit / npm audit (berkas lockfile). */
+export declare const isAdvisory: (f: AuditFinding) => boolean;
+/**
+ * Urut severity; di severity yang sama temuan dari menjalankan aplikasi didahulukan sebelum advisory dependensi
+ * (sort stabil), dan advisory dibatasi MAX_ADVISORIES agar tidak memenuhi MAX_FINDINGS.
+ */
+export declare function selectFindings(all: AuditFinding[]): AuditFinding[];
 /**
  * Jelajah link same-origin (BFS) di desktop, lalu ulangi halaman yang sama di mobile.
  * Setiap halaman difoto polos (galeri laporan); setiap jenis masalah difoto lagi dengan tanda (kotak merah di elemen,
@@ -98,14 +105,10 @@ export declare function smokeUi(browser: BrowserLike, baseUrl: string, evidenceD
 }>;
 /** Test gagal / error dari laporan JUnit PHPUnit / Pest. */
 export declare function parseJunit(xml: string, root?: string): AuditFinding[];
-/** `composer audit --format=json` → satu temuan per advisory. */
+/** `composer audit --format=json` → satu temuan per paket (advisory duplikat digabung, severity terparah). */
 export declare function parseComposerAudit(output: string): AuditFinding[];
 /** `npm audit --json` (npm 7+) → satu temuan per paket berseverity high/critical. */
 export declare function parseNpmAudit(output: string): AuditFinding[];
-/** URI route GET tanpa parameter dan tanpa middleware autentikasi dari `route:list --json`. */
-export declare function pickSmokeRoutes(output: string): string[];
-/** URI → action (mis. App\Http\Controllers\ProdukController@index) dari `route:list --json`. */
-export declare function routeActions(output: string): Map<string, string>;
 /**
  * Request FE (method + path, mis. GET /api/produk/12) → action route BE dari `route:list --json`.
  * {param} cocok dengan satu segmen, {param?} opsional; bila beberapa cocok, route dengan segmen statis terbanyak menang.
@@ -120,17 +123,23 @@ export declare function controllerLocation(root: string, action: string): Promis
  * 2. routing berbasis berkas (pages/, app/ ala Nuxt / Next).
  */
 export declare function resolveRouteFile(root: string, path: string): Promise<SourceLocation | null>;
+export declare function listSources(dir: string, depth: number): Promise<string[]>;
+export declare const lineAt: (source: string, index: number) => number;
+/** 100 dikurangi penalti severity; penalti advisory dependensi dibatasi MAX_ADVISORY_PENALTY. */
 export declare function scoreRepo(findings: AuditFinding[], booted: boolean): number;
 export interface Login {
     email: string;
     password: string;
 }
-/** Akun login dari catatan aplikasi, mis. "Login admin@pos.test / password". */
+/** Akun login pertama dari catatan aplikasi, mis. "Login admin@pos.test / password" (smoke UI). */
 export declare function parseLogin(instructions: string): Login | null;
 /** Variabel VITE_* berisi URL http diarahkan ke BE lokal; path (mis. /api) dipertahankan. */
 export declare function localApiEnv(example: string): string;
 /** Ganti / tambah KEY=VALUE di isi file .env. */
 export declare function setEnv(content: string, values: Record<string, string>): string;
+export declare const tail: (text: string, max?: number) => string;
+/** Keluaran composer/npm kadang diawali peringatan; ambil dari karakter JSON pertama. */
+export declare function parseJsonLoose(output: string): any;
 export declare const defaultShell: Shell;
 /** playwright-core dipasang global di runner bersama qaify; Google Chrome sudah ada di ubuntu-latest. */
 export declare function defaultLaunch(): Promise<BrowserLike | null>;

package/dist/audit-static.js

@@ -1,21 +1,27 @@
 // Audit aplikasi tanpa AI (qaify audit-static): pemeriksaan deterministik di repo runner bila
 // CLAUDE_CODE_OAUTH_TOKEN kosong. Hasilnya berbentuk sama dengan keluaran `claude -p`, jadi audit-submit,
-// backend, dan UI tidak berubah. Temuan lebih dangkal dari mode Claude: tidak ada analisis logika bisnis
-// atau kontrak API dari membaca kode.
-//   BE (Laravel): composer install, migrate --seed, php artisan test, composer audit, smoke route GET publik.
+// backend, dan UI tidak berubah. Temuan lebih dangkal dari mode Claude: aturan bisnis tidak ditebak dari kode,
+// hanya gejalanya yang diuji lewat HTTP (audit-api.ts).
+//   BE (Laravel): composer install, migrate --seed, php artisan test, composer audit, smoke API (dengan login bila ada
+//   akun), uji validasi POST/PUT/PATCH, uji otorisasi.
 //   FE (Node): npm ci, npm run build, npm audit, smoke Playwright (desktop + mobile) dengan screenshot setiap halaman,
-//   plus foto bertanda (kotak merah di elemen bermasalah / banner pesan error) untuk setiap masalah.
+//   plus foto bertanda (kotak merah di elemen bermasalah / banner pesan error) untuk setiap masalah, dan cek kontrak
+//   pemanggilan API di kode FE terhadap route BE.
 // Temuan smoke diberi berkas sumber bila bisa ditebak: route FE → komponen halaman, route BE → method controller;
 // request FE yang gagal juga dipetakan ke controller BE, dan route BE yang error ke halaman FE pemanggilnya.
 import { spawn } from 'node:child_process';
 import { mkdir, readdir, readFile, stat, writeFile } from 'node:fs/promises';
 import { openSync } from 'node:fs';
 import { dirname, join, relative } from 'node:path';
+import { checkAuthorization, checkContract, checkValidation, openApi, parseLogins, parseRoutes, smokeApi } from './audit-api.js';
 /** usage.model untuk audit tanpa AI; dipakai backend/PDF untuk menampilkan mode audit. */
 export const STATIC_MODEL = 'qaify-static';
 const MAX_FINDINGS = 40;
+/** Advisory composer/npm audit yang masuk laporan, agar tidak menyingkirkan temuan dari menjalankan aplikasi. */
+const MAX_ADVISORIES = 10;
+/** Batas total penalti skor dari advisory dependensi. */
+const MAX_ADVISORY_PENALTY = 30;
 const MAX_SMOKE_PAGES = 15;
-const MAX_SMOKE_ROUTES = 40;
 /** Foto bertanda per halaman per viewport (satu per jenis masalah). */
 const MAX_ISSUE_SHOTS = 3;
 const BE_URL = 'http://127.0.0.1:8000';
@@ -32,25 +38,49 @@ export async function auditStatic(dir, deps) {
     await mkdir(join(dir, '.qaify'), { recursive: true });
     await mkdir(join(dir, 'evidence'), { recursive: true });
     const context = await readFile(join(dir, 'context.json'), 'utf8').then(JSON.parse, () => ({}));
-    const login = parseLogin(String(context?.project?.instructions ?? ''));
+    const accounts = parseLogins(String(context?.project?.instructions ?? ''));
+    const login = accounts[0] ? { email: accounts[0].email, password: accounts[0].password } : null;
     const beRoot = join(dir, 'apps', 'be');
     const feRoot = join(dir, 'apps', 'fe');
     const be = await auditBe(beRoot, dir, deps);
+    const routes = parseRoutes(be.routes);
     const api = be.routes
         ? async (method, path) => {
             const action = matchRoute(be.routes, method, path);
             return action ? controllerLocation(beRoot, action) : null;
         }
         : undefined;
+    let probe = null;
+    let failed = [];
+    if (be.running) {
+        deps.log('qa-factory: [be] smoke API');
+        const opened = await openApi(routes, accounts, { base: BE_URL, fetch: deps.fetch, root: beRoot });
+        probe = opened.probe;
+        const smoke = await smokeApi(probe);
+        be.result.findings.push(...smoke.findings);
+        be.result.notes.push(...opened.notes, ...smoke.notes);
+        failed = smoke.failed;
+    }
     let fe;
     try {
         fe = await auditFe(feRoot, dir, deps, login, api);
+        // mengubah data: setelah smoke FE agar halaman FE tidak melihat data uji
+        if (probe) {
+            deps.log('qa-factory: [be] uji validasi & otorisasi');
+            for (const check of [await checkValidation(probe), await checkAuthorization(probe, beRoot)]) {
+                be.result.findings.push(...check.findings);
+                be.result.notes.push(...check.notes);
+            }
+        }
     }
     finally {
         be.stop();
     }
-    await linkCallers(be.failed, fe, feRoot);
-    const findings = [...be.result.findings, ...fe.findings].sort(bySeverity).slice(0, MAX_FINDINGS);
+    const contract = await checkContract(feRoot, beRoot, routes);
+    fe.findings.push(...contract.findings);
+    fe.notes.push(...contract.notes);
+    await linkCallers(failed, fe, feRoot);
+    const findings = selectFindings([...be.result.findings, ...fe.findings]);
     return {
         summary: { be: summarize('BE', be.result), fe: summarize('FE', fe) },
         findings,
@@ -68,6 +98,16 @@ export function toAuditOutput(audit, durationMs) {
         modelUsage: { [STATIC_MODEL]: { outputTokens: 0 } },
     });
 }
+/** Advisory composer audit / npm audit (berkas lockfile). */
+export const isAdvisory = (f) => f.area === 'security' && (f.file === 'composer.lock' || f.file === 'package-lock.json');
+/**
+ * Urut severity; di severity yang sama temuan dari menjalankan aplikasi didahulukan sebelum advisory dependensi
+ * (sort stabil), dan advisory dibatasi MAX_ADVISORIES agar tidak memenuhi MAX_FINDINGS.
+ */
+export function selectFindings(all) {
+    const advisories = all.filter(isAdvisory).sort(bySeverity).slice(0, MAX_ADVISORIES);
+    return [...all.filter((f) => !isAdvisory(f)), ...advisories].sort(bySeverity).slice(0, MAX_FINDINGS);
+}
 /**
  * Route BE yang error saat smoke API → halaman FE yang memanggilnya: halaman jadi `page`, komponennya masuk
  * related_files, dan foto halaman itu jadi bukti agar temuan BE juga tampak di laporan.
@@ -96,7 +136,7 @@ async function linkCallers(failed, fe, feRoot) {
 }
 async function auditBe(root, dir, deps) {
     const result = { findings: [], booted: false, notes: [] };
-    const none = { result, stop: () => { }, routes: '', failed: [] };
+    const none = { result, stop: () => { }, routes: '', running: false };
     const { shell, log } = deps;
     if (!(await exists(root))) {
         result.notes.push('Repo BE tidak ada di folder kerja.');
@@ -173,31 +213,7 @@ async function auditBe(root, dir, deps) {
     }
     result.booted = migrated;
     const routes = await shell.run('php artisan route:list --json --no-interaction', { cwd: root, timeoutMs: MIN });
-    const smoke = pickSmokeRoutes(routes.output);
-    const actions = routeActions(routes.output);
-    const failed = [];
-    for (const uri of smoke) {
-        const url = `${BE_URL}/${uri.replace(/^\//, '')}`;
-        const res = await deps.fetch(url, { headers: { Accept: 'application/json' }, signal: AbortSignal.timeout(10_000) }).catch(() => null);
-        if (res && res.status >= 500) {
-            const action = actions.get(uri);
-            const location = action ? await controllerLocation(root, action) : null;
-            const finding = {
-                repo: 'be',
-                area: 'error_handling',
-                severity: 'high',
-                title: `GET /${uri} membalas ${res.status}`,
-                description: `Route publik GET /${uri}${action ? ` (${action})` : ''} membalas ${res.status} pada database hasil seed.`,
-                ...location,
-                evidence: { request: `GET ${url}`, response: tail(await res.text().catch(() => ''), 2000) },
-                suggestion: 'Cek laravel.log untuk exception di route ini dan tangani kasus data kosong / parameter yang hilang.',
-            };
-            result.findings.push(finding);
-            failed.push({ finding, uri });
-        }
-    }
-    result.notes.push(`Smoke API: ${smoke.length} route GET publik dipanggil.`);
-    return { result, stop, routes: routes.code === 0 ? routes.output : '', failed };
+    return { result, stop, routes: routes.code === 0 ? routes.output : '', running: true };
 }
 // ---------------------------------------------------------------- FE
 async function auditFe(root, dir, deps, login, api) {
@@ -625,26 +641,50 @@ export function parseJunit(xml, root = '') {
     }
     return findings;
 }
-/** `composer audit --format=json` → satu temuan per advisory. */
+/** "guzzlehttp/psr7: Host confusion" → "Host confusion" (judul advisory sering sudah diawali nama paket). */
+const stripPackage = (pkg, title) => title.replace(new RegExp(`^${pkg.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*:\\s*`, 'i'), '');
+/** Advisory sama (CVE sama, atau judul sama setelah kata nama paket dibuang) digabung; severity tak dikenal → medium. */
+function dedupeAdvisories(pkg, list) {
+    const words = new Set(pkg.toLowerCase().split(/[^a-z0-9]+/).filter(Boolean));
+    const out = [];
+    for (const raw of list) {
+        const title = stripPackage(pkg, String(raw?.title ?? 'kerentanan diketahui'));
+        const cve = typeof raw?.cve === 'string' && raw.cve ? raw.cve : null;
+        const severity = SEVERITY_ORDER.includes(raw?.severity) ? String(raw.severity) : 'medium';
+        const key = title.toLowerCase().split(/[^a-z0-9]+/).filter((w) => w && !words.has(w)).join(' ');
+        const same = out.find((a) => (cve && a.cve === cve) || a.key === key);
+        if (same) {
+            if (rank(severity) < rank(same.severity))
+                same.severity = severity;
+            same.cve ??= cve;
+            continue;
+        }
+        out.push({ title, cve, severity, affectedVersions: raw?.affectedVersions, link: raw?.link, key });
+    }
+    return out;
+}
+const rank = (severity) => SEVERITY_ORDER.indexOf(severity);
+/** `composer audit --format=json` → satu temuan per paket (advisory duplikat digabung, severity terparah). */
 export function parseComposerAudit(output) {
     const data = parseJsonLoose(output);
     const advisories = data?.advisories && typeof data.advisories === 'object' ? data.advisories : {};
     const findings = [];
     for (const [pkg, list] of Object.entries(advisories)) {
-        for (const advisory of Array.isArray(list) ? list : Object.values(list ?? {})) {
-            const severity = SEVERITY_ORDER.includes(advisory?.severity) ? advisory.severity : 'high';
-            findings.push({
-                repo: 'be',
-                area: 'security',
-                severity,
-                title: `${pkg}: ${advisory?.title ?? 'kerentanan diketahui'}`.slice(0, 120),
-                description: [advisory?.title, advisory?.cve && `CVE: ${advisory.cve}`, advisory?.affectedVersions && `Versi terdampak: ${advisory.affectedVersions}`, advisory?.link]
-                    .filter(Boolean)
-                    .join('\n'),
-                file: 'composer.lock',
-                suggestion: `composer update ${pkg} ke versi yang sudah diperbaiki.`,
-            });
-        }
+        const unique = dedupeAdvisories(pkg, Array.isArray(list) ? list : Object.values(list ?? {}));
+        if (!unique.length)
+            continue;
+        const worst = [...unique].sort((a, b) => rank(a.severity) - rank(b.severity))[0];
+        findings.push({
+            repo: 'be',
+            area: 'security',
+            severity: worst.severity,
+            title: (unique.length > 1 ? `${pkg}: ${unique.length} kerentanan — ${worst.title}` : `${pkg}: ${worst.title}`).slice(0, 120),
+            description: unique
+                .map((a) => `- [${a.severity}] ${a.title}${a.cve ? ` (${a.cve})` : ''}${a.affectedVersions ? ` · versi terdampak ${a.affectedVersions}` : ''}${a.link ? ` · ${a.link}` : ''}`)
+                .join('\n'),
+            file: 'composer.lock',
+            suggestion: `composer update ${pkg} --with-all-dependencies ke versi yang sudah diperbaiki.`,
+        });
     }
     return findings;
 }
@@ -661,7 +701,7 @@ export function parseNpmAudit(output) {
             repo: 'fe',
             area: 'security',
             severity: vuln.severity,
-            title: `${name}: ${advisories[0]?.title ?? 'kerentanan diketahui'}`.slice(0, 120),
+            title: `${name}: ${stripPackage(name, advisories[0]?.title ?? 'kerentanan diketahui')}`.slice(0, 120),
             description: [
                 ...advisories.slice(0, 3).map((a) => `${a.title}${a.url ? ` (${a.url})` : ''}`),
                 vuln.range && `Versi terdampak: ${vuln.range}`,
@@ -675,28 +715,6 @@ export function parseNpmAudit(output) {
     }
     return findings;
 }
-/** URI route GET tanpa parameter dan tanpa middleware autentikasi dari `route:list --json`. */
-export function pickSmokeRoutes(output) {
-    const routes = parseJsonLoose(output);
-    if (!Array.isArray(routes))
-        return [];
-    const uris = routes
-        .filter((r) => String(r?.method ?? '').split('|').includes('GET'))
-        .filter((r) => typeof r?.uri === 'string' && !r.uri.includes('{') && !/^(_|telescope|horizon|pulse|livewire|sanctum|storage)/.test(r.uri))
-        .filter((r) => !(Array.isArray(r?.middleware) ? r.middleware : []).some((m) => /^(auth|verified|signed|can:|password\.confirm)/.test(String(m).split('\\').pop() ?? '') || /Authenticate/.test(String(m))))
-        .map((r) => String(r.uri));
-    return [...new Set(uris)].slice(0, MAX_SMOKE_ROUTES);
-}
-/** URI → action (mis. App\Http\Controllers\ProdukController@index) dari `route:list --json`. */
-export function routeActions(output) {
-    const routes = parseJsonLoose(output);
-    const actions = new Map();
-    for (const r of Array.isArray(routes) ? routes : []) {
-        if (typeof r?.uri === 'string' && typeof r?.action === 'string' && r.action !== 'Closure' && !actions.has(r.uri))
-            actions.set(r.uri, r.action);
-    }
-    return actions;
-}
 /**
  * Request FE (method + path, mis. GET /api/produk/12) → action route BE dari `route:list --json`.
  * {param} cocok dengan satu segmen, {param?} opsional; bila beberapa cocok, route dengan segmen statis terbanyak menang.
@@ -807,7 +825,7 @@ async function componentNear(root, file, source, index) {
     }
     return null;
 }
-async function listSources(dir, depth) {
+export async function listSources(dir, depth) {
     if (depth < 0)
         return [];
     const entries = await readdir(dir, { withFileTypes: true }).catch(() => []);
@@ -823,15 +841,18 @@ async function listSources(dir, depth) {
     }
     return out;
 }
-const lineAt = (source, index) => source.slice(0, index).split('\n').length;
+export const lineAt = (source, index) => source.slice(0, index).split('\n').length;
+/** 100 dikurangi penalti severity; penalti advisory dependensi dibatasi MAX_ADVISORY_PENALTY. */
 export function scoreRepo(findings, booted) {
-    const score = Math.max(0, 100 - findings.reduce((sum, f) => sum + (PENALTY[f.severity] ?? 0), 0));
+    const penalty = (list) => list.reduce((sum, f) => sum + (PENALTY[f.severity] ?? 0), 0);
+    const advisories = findings.filter(isAdvisory);
+    const score = Math.max(0, 100 - penalty(findings.filter((f) => !isAdvisory(f))) - Math.min(MAX_ADVISORY_PENALTY, penalty(advisories)));
     return booted ? score : Math.min(score, 40);
 }
-/** Akun login dari catatan aplikasi, mis. "Login admin@pos.test / password". */
+/** Akun login pertama dari catatan aplikasi, mis. "Login admin@pos.test / password" (smoke UI). */
 export function parseLogin(instructions) {
-    const match = /([\w.+-]+@[\w-]+(?:\.[\w-]+)+)\s*\/\s*(\S+)/.exec(instructions);
-    return match ? { email: match[1], password: match[2] } : null;
+    const account = parseLogins(instructions)[0];
+    return account ? { email: account.email, password: account.password } : null;
 }
 /** Variabel VITE_* berisi URL http diarahkan ke BE lokal; path (mis. /api) dipertahankan. */
 export function localApiEnv(example) {
@@ -874,7 +895,7 @@ function bootFailure(repo, title, description, output, file) {
     };
 }
 const bySeverity = (a, b) => SEVERITY_ORDER.indexOf(a.severity) - SEVERITY_ORDER.indexOf(b.severity);
-const tail = (text, max = 4000) => (text.length > max ? `…${text.slice(-max)}` : text);
+export const tail = (text, max = 4000) => (text.length > max ? `…${text.slice(-max)}` : text);
 const exists = (path) => stat(path).then(() => true, () => false);
 function pathOf(href, origin) {
     try {
@@ -912,7 +933,7 @@ function relativeTo(file, root) {
     return base && normalized.startsWith(`${base}/`) ? normalized.slice(base.length + 1) : normalized.replace(/^.*?\/(tests|app|src)\//, '$1/');
 }
 /** Keluaran composer/npm kadang diawali peringatan; ambil dari karakter JSON pertama. */
-function parseJsonLoose(output) {
+export function parseJsonLoose(output) {
     const start = output.search(/[[{]/);
     if (start < 0)
         return null;

package/dist/audit.d.ts

@@ -279,9 +279,13 @@ export declare const defaultExec: Exec;
 export interface AuditContextResult {
     ok: boolean;
     commits: Record<string, string>;
+    /** auditor pilihan Qaify (static / claude); undefined = backend lama, workflow memilih sendiri */
+    mode?: AuditMode;
     /** alasan gagal; juga ditulis ke context-error.txt agar audit-submit bisa melaporkannya */
     error?: string;
 }
+export declare const AUDIT_MODES: readonly ["static", "claude"];
+export type AuditMode = (typeof AUDIT_MODES)[number];
 /**
  * GET /api/ingest/audits/{id}/context → clone apps/<role> → cabut token.
  * Token hanya lewat header git dari environment (tidak pernah di argumen, URL remote, atau disk)

package/dist/audit.js

@@ -174,6 +174,7 @@ export function parseAuditOutput(raw) {
 const execFileAsync = promisify(execFile);
 export const defaultExec = async (file, args, env) => (await execFileAsync(file, args, { env: { ...process.env, ...env }, maxBuffer: 10 * 1024 * 1024 })).stdout;
 const branchOf = (repo) => repo.branch || repo.default_branch;
+export const AUDIT_MODES = ['static', 'claude'];
 const CONTEXT_ERROR_FILE = 'context-error.txt';
 /**
  * GET /api/ingest/audits/{id}/context → clone apps/<role> → cabut token.
@@ -214,12 +215,14 @@ export async function auditContext(client, auditId, dir, opts = {}) {
         return contextFailed(dir, `Clone repo gagal: ${detail}`, commits);
     }
     await revoke(repos, opts.fetch);
+    const mode = AUDIT_MODES.includes(ctx.mode) ? ctx.mode : undefined;
     await writeFile(join(dir, 'context.json'), JSON.stringify({
         audit_id: ctx.audit_id,
+        mode: mode ?? null,
         project: ctx.project,
         repos: repos.map((r) => ({ role: r.role, full_name: r.full_name, branch: branchOf(r), commit: commits[r.role] ?? null })),
     }, null, 2));
-    return { ok: true, commits };
+    return { ok: true, commits, mode };
 }
 /** Peringatan (annotation di ringkasan run) + context-error.txt untuk audit-submit. */
 async function contextFailed(dir, error, commits) {

package/dist/cli.js

@@ -16,6 +16,7 @@
 // Perbaikan temuan audit (qaify-fix.yml di repo runner):
 //   qaify fix-context --fix <id> --dir <folder kerja>          (job fix: clone repo target, prompt Claude)
 //   qaify fix-schema --out schema.json --instructions instructions.txt
+//   qaify fix-deps --dir <folder kerja>                        (job fix, mode deps: update lockfile tanpa Claude)
 //   qaify fix-diff --dir <folder kerja> --out <folder artefak>  (job fix: perubahan Claude → changes.patch)
 //   qaify fix-submit --fix <id> --results claude.json --patch changes.patch --dir <folder kosong>  (job submit)
 // Auto-fix test yang gagal (auto-fix.yml di repo yang diuji, dibuat `qaify init`); fix-diff dipakai bersama:
@@ -29,7 +30,7 @@ import { aiQueue, aiSubmit, analyze, CONCLUSIONS, parseArgs } from './analyze.js
 import { AUDIT_INSTRUCTIONS, AUDIT_PROMPT, AUDIT_SCHEMA, auditContext, auditSubmit, readCommits, readContextError } from './audit.js';
 import { auditStatic, defaultLaunch, defaultShell, toAuditOutput } from './audit-static.js';
 import { createClient, describeProblem, MISSING_CONFIG, runFromEnv, warn } from './client.js';
-import { FIX_INSTRUCTIONS, FIX_SCHEMA, fixContext, fixDiff, fixSubmit, TEST_FIX_INSTRUCTIONS, writeOutputs } from './fix.js';
+import { FIX_INSTRUCTIONS, FIX_SCHEMA, fixContext, fixDeps, fixDiff, fixSubmit, TEST_FIX_INSTRUCTIONS, writeOutputs } from './fix.js';
 import { init, initRunner, NEXT_STEPS, RUNNER_NEXT_STEPS } from './init.js';
 import { check } from './check.js';
 const USAGE = `Pemakaian:
@@ -46,6 +47,7 @@ const USAGE = `Pemakaian:
   qaify audit-submit --audit <id> --results <file> --evidence <folder> --context <file>
   qaify fix-context --fix <id> --dir <folder>
   qaify fix-schema --out <file-schema> [--instructions <file>]
+  qaify fix-deps --dir <folder>
   qaify fix-diff --dir <folder> --out <folder>
   qaify fix-submit --fix <id> --results <file> --patch <file> --dir <folder>
   qaify autofix-context --fix <id> --dir <folder>
@@ -137,8 +139,9 @@ switch (args.command) {
             // step merah: tanpa ini auditor & kirim hasil dilewati diam-diam dan audit macet "running"
             process.exitCode = 1;
         }
+        // mode kosong = backend lama: workflow memilih dari variable / secret
         if (process.env.GITHUB_OUTPUT)
-            await appendFile(process.env.GITHUB_OUTPUT, `ok=${result.ok}\n`);
+            await appendFile(process.env.GITHUB_OUTPUT, `ok=${result.ok}\nmode=${('mode' in result && result.mode) || ''}\n`);
         break;
     }
     case 'audit-schema': {
@@ -194,13 +197,27 @@ switch (args.command) {
         }
         const result = client.enabled
             ? await fixContext(client, args.fix, args.dir, { kind: fixKind(args.command), githubRunId: run.github_run_id || undefined })
-            : (warn(MISSING_CONFIG), { ok: false, model: null });
+            : (warn(MISSING_CONFIG), { ok: false, model: null, mode: 'claude' });
         if (!result.ok) {
             const problem = describeProblem(client);
             if (problem)
                 warn(problem);
         }
-        await writeOutputs({ ok: String(result.ok), model: result.model ?? '' });
+        await writeOutputs({ ok: String(result.ok), model: result.model ?? '', mode: result.mode });
+        break;
+    }
+    // job fix, tanpa token dan tanpa Claude: update advisory dependensi di lockfile
+    case 'fix-deps': {
+        if (!args.dir) {
+            usage();
+            break;
+        }
+        const result = await fixDeps(args.dir).catch((e) => {
+            warn(`update dependensi gagal: ${e.message.split('\n')[0]}`);
+            return null;
+        });
+        if (result)
+            console.log(`qa-factory: ${result.fixed ? 'dependensi diperbarui' : `dependensi tidak diperbarui: ${result.reason ?? result.summary}`}`);
         break;
     }
     case 'fix-schema':

package/dist/fix.d.ts

@@ -1,6 +1,8 @@
 import { type Exec } from './audit.js';
 import type { IngestClient } from './client.js';
 import { type ClaudeUsage } from './usage.js';
+/** "Model" perbaikan advisory dependensi tanpa AI; cermin config qafactory.audit_fix.deps_model. */
+export declare const DEPS_MODEL = "qaify-deps";
 export declare const FIX_SCHEMA: {
     readonly type: "object";
     readonly properties: {
@@ -59,6 +61,12 @@ interface FixContext {
         max_files: number;
         max_changed_lines: number;
     };
+    /** Advisory dependensi: diperbaiki fix-deps tanpa Claude. Backend lama tidak mengirimnya. */
+    deps?: DepsTarget | null;
+}
+export interface DepsTarget {
+    package: string;
+    manager: 'composer' | 'npm';
 }
 /** Prompt `claude -p`: temuan + batas + percobaan sebelumnya. Detail cara kerja di FIX_INSTRUCTIONS. */
 export declare function fixPrompt(ctx: Omit<FixContext, 'repo'> & {
@@ -108,6 +116,8 @@ export declare function testFixPrompt(ctx: Omit<TestFixContext, 'repo'> & {
 export interface FixContextResult {
     ok: boolean;
     model: string | null;
+    /** deps = langkah Claude dilewati, fix-deps yang memperbaiki. */
+    mode: 'claude' | 'deps';
 }
 /**
  * GET {base}/{id}/context → clone repo di commit sumber (yang diaudit / run yang gagal) ke <dir>/repo → cabut token
@@ -120,9 +130,22 @@ export declare function fixContext(client: IngestClient, fixId: string, dir: str
     fetch?: typeof fetch;
     log?: (msg: string) => void;
 }): Promise<FixContextResult>;
+/**
+ * Advisory dependensi tanpa AI: update paket di lockfile saja (tanpa install / script), cek ulang dengan audit, lalu
+ * tulis hasilnya ke <dir>/.qaify/claude.json dalam bentuk keluaran `claude -p` (model qaify-deps, token 0) agar
+ * fix-diff / fix-submit tidak berubah. npm: npm update dulu, npm audit fix bila paket masih rentan.
+ */
+export declare function fixDeps(dir: string, exec?: Exec): Promise<{
+    fixed: boolean;
+    summary: string;
+    reason?: string;
+}>;
+/** Masih ada advisory untuk paket ini? npm: hanya high / critical (sama dengan temuan audit-static). */
+export declare function stillVulnerable(output: string, manager: 'composer' | 'npm', pkg: string): boolean;
 /**
  * Perubahan Claude di <dir>/repo → <out>/changes.patch (git diff --binary). Lockfile & .env yang ikut berubah saat
- * menjalankan aplikasi dibuang dari patch. Job ini tidak memegang token, jadi aman menjalankan git di repo hasil Claude.
+ * menjalankan aplikasi dibuang dari patch, kecuali lockfile pada mode deps (.qaify/deps.json) yang memang hasilnya.
+ * Job ini tidak memegang token, jadi aman menjalankan git di repo hasil Claude.
  */
 export declare function fixDiff(dir: string, out: string, exec?: Exec): Promise<{
     files: string[];
@@ -135,6 +158,7 @@ export interface PatchStats {
     paths: string[];
     /** Header diff yang tidak bisa dibaca: patch ditolak, bukan dilewati diam-diam. */
     unreadable: number;
+    /** Baris +/- di luar lockfile (lockfile hasil update paket wajar besar, tidak dihitung ke batas). */
     changedLines: number;
 }
 /** Berkas dan jumlah baris +/- dari unified diff git (path ber-escape git dibungkus tanda kutip). */