qatools-cli 1.1.3 → 1.1.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qatools-cli",
-  "version": "1.1.3",
+  "version": "1.1.5",
   "description": "CLI for QA Tools — requirements, epics, sprints, sessions, App Context sync, project agenda. The companion to qa-tools.com.",
   "bin": {
     "qatools": "./qatools.js"

package/qatools.js

@@ -903,6 +903,14 @@ program
         next: `qatools requirement-update -i <id> --status approved  (or refine AC first)`,
       });
     }
+    if (data.agenda.accessModelMissing) {
+      sections.push({
+        icon: "⚪",
+        title: "No access model defined for this project",
+        items: ["  • Who can sign in? Which roles exist? What's protected? How is data isolated?"],
+        next: `qatools access show  (shows a minimal example)  →  qatools access set -f model.json`,
+      });
+    }
 
     if (sections.length === 0) {
       console.log("  ✓ Nothing on the agenda. The project is in a clean state.\n");
@@ -1370,6 +1378,116 @@ program
     process.exit(0);
   });
 
+// access subcommands grouped under 'access'
+const accessCmd = program
+  .command("access")
+  .description("Manage the project's Access Model (who-can-do-what, structured)");
+
+accessCmd
+  .command("show")
+  .description("Show the access model for the project")
+  .option("--project <id>", "Target project ID (overrides default)")
+  .option("-o, --output <path>", "Save to JSON file")
+  .option("--json", "Output JSON to stdout")
+  .option("-e, --email <email>", "Login email")
+  .option("-p, --password <password>", "Login password")
+  .action(async (options) => {
+    await authenticate(options);
+    const creds = getCredentials();
+    const projectId = options.project || creds?.projectId;
+    if (!projectId) { console.error("No project configured. Run: qatools setup, or pass --project <id>"); process.exit(1); }
+    const getModel = httpsCallable(functions, "getAccessModel");
+    let result;
+    try { result = await getModel({ projectId }); }
+    catch (e) { console.error("Failed:", e.message); process.exit(1); }
+    const model = result.data.accessModel;
+    if (!model) {
+      console.log(`No access model defined for this project.`);
+      console.log(`Define one by writing a JSON file and running: qatools access set -f model.json`);
+      console.log(``);
+      console.log(`Minimal shape:`);
+      console.log(JSON.stringify({
+        authMethods: [{ key: "google", description: "Google OAuth", primary: true }],
+        roles: [{ key: "owner", description: "Project owner with full control" }],
+        resources: [{ key: "project", description: "Project metadata", ownedBy: "project", permissions: [{ role: "owner", actions: ["read","create","update","delete"] }] }],
+        isolationRules: [{ scope: "project", description: "Data scoped by projectId field", enforcedBy: ["firestore.rules", "checkProjectAccess()"] }],
+      }, null, 2));
+      process.exit(0);
+    }
+    if (options.output) {
+      fs.writeFileSync(path.resolve(options.output), JSON.stringify(model, null, 2));
+      console.log(`Saved to ${options.output}`);
+      process.exit(0);
+    }
+    if (options.json) {
+      console.log(JSON.stringify(model, null, 2));
+      process.exit(0);
+    }
+    // Pretty text output
+    console.log(``);
+    console.log(`Access Model — project ${projectId}`);
+    console.log(``);
+    if (model.authMethods?.length) {
+      console.log(`AUTH METHODS`);
+      for (const a of model.authMethods) console.log(`  ${a.primary ? "*" : " "} ${a.key.padEnd(15)} ${a.description}`);
+      console.log(``);
+    }
+    if (model.roles?.length) {
+      console.log(`ROLES`);
+      for (const r of model.roles) {
+        const inh = r.inherits?.length ? ` (inherits: ${r.inherits.join(", ")})` : "";
+        console.log(`  ${r.key.padEnd(15)} ${r.description}${inh}`);
+      }
+      console.log(``);
+    }
+    if (model.resources?.length) {
+      console.log(`RESOURCES`);
+      for (const r of model.resources) {
+        const coll = r.collection ? ` [${r.collection}]` : "";
+        console.log(`  ${r.key}${coll} — owned by ${r.ownedBy}`);
+        console.log(`    ${r.description}`);
+        for (const p of (r.permissions || [])) {
+          const cond = p.condition ? ` (${p.condition})` : "";
+          console.log(`      ${p.role.padEnd(15)} ${p.actions.join(",")}${cond}`);
+        }
+      }
+      console.log(``);
+    }
+    if (model.isolationRules?.length) {
+      console.log(`ISOLATION RULES`);
+      for (const i of model.isolationRules) {
+        console.log(`  [${i.scope}] ${i.description}`);
+        if (i.enforcedBy?.length) console.log(`    enforced by: ${i.enforcedBy.join(", ")}`);
+      }
+      console.log(``);
+    }
+    process.exit(0);
+  });
+
+accessCmd
+  .command("set")
+  .description("Upload (replace) the entire access model from a JSON file")
+  .requiredOption("-f, --file <path>", "Path to access model JSON")
+  .option("--project <id>", "Target project ID (overrides default)")
+  .option("-e, --email <email>", "Login email")
+  .option("-p, --password <password>", "Login password")
+  .action(async (options) => {
+    await authenticate(options);
+    const creds = getCredentials();
+    const projectId = options.project || creds?.projectId;
+    if (!projectId) { console.error("No project configured. Run: qatools setup, or pass --project <id>"); process.exit(1); }
+    const model = JSON.parse(fs.readFileSync(path.resolve(options.file), "utf8"));
+    const saveModel = httpsCallable(functions, "saveAccessModel");
+    try {
+      const result = await saveModel({ projectId, model });
+      console.log(`Access model saved (${result.data.id}) — project ${projectId}`);
+    } catch (e) {
+      console.error("Failed:", e.message);
+      process.exit(1);
+    }
+    process.exit(0);
+  });
+
 program
   .command("epics")
   .description("List epics for the project")
@@ -1514,6 +1632,83 @@ program
 
     // 2. Write skills files
     const skills = {
+      "qa-purpose.md": `---
+description: Read this BEFORE anything else. The purpose of qa-tools and what it expects from you as AI.
+---
+
+# Why qa-tools exists
+
+qa-tools exists for one reason: to let anyone build production-quality apps with AI that follow their own rules — as if they had built it themselves, just faster.
+
+Not "demo quality, fast". Not "good enough, fast". **The user's own quality bar, faster.**
+
+## What this means for you (the AI)
+
+You are not a coding assistant. You are a substitute. The user is delegating
+construction of their app to you, and they expect what comes back to be what
+they would have built themselves if they had infinite time.
+
+That standard rules out:
+- Guessing when verification is possible
+- "Looks right" without numbers
+- "User will test it" handoffs of responsibility
+- Shortcuts the user themselves wouldn't take
+- Pattern-matched code from training data when the project has its own rules
+
+## The chain
+
+\`\`\`
+App Context (the user's rules: design, security, AI rules, constraints)
+        ↓
+Epics (capabilities the user wants)
+        ↓
+Requirements (Given/When/Then — the user's spec, testable)
+        ↓
+Code (you build, must trace to requirement)
+        ↓
+Tests (generated from REQUIREMENTS, not from code)
+        ↓
+Backlog (signals when chain breaks: AVV / GAP / DEF / IMP)
+        ↓
+Fix (against the requirement, with --evidence)
+        ↓
+Requirement marked tested
+\`\`\`
+
+Every link is enforceable. The CLI refuses status changes without evidence.
+The skills refuse vague claims. The model refuses circular fixes (backlog →
+backlog without going through requirements).
+
+## Your starting move
+
+Before doing ANYTHING in this project:
+1. Run \`qatools context\` — read the App Context. This is the user's rule book.
+2. Run \`qatools epics\` — see what capabilities exist.
+3. Run \`qatools next\` — see what's actually on the agenda.
+
+If App Context is empty, the project hasn't been set up yet. Help the user
+draft one before building anything else. **Without App Context you have no
+basis for being a substitute** — you're just guessing what their rules are.
+
+## When you're tempted to skip the chain
+
+You will be tempted. The user will be impatient. The bug will look obvious.
+You will think "I'll just fix it and they can verify".
+
+That is exactly the failure mode qa-tools was built to prevent. The substitute
+that "just fixes things" is the substitute that drifts away from what the
+user actually wanted, one shortcut at a time.
+
+When you feel that temptation, stop. Ask: would the user themselves skip this
+step if they were doing it manually? If no, you can't either.
+
+## Cross-reference
+
+- qa-loop.md — the mechanics of the loop
+- qa-evidence-first.md — the core principle (cite, don't guess)
+- qa-numerical-verification.md — for algorithmic bugs
+- qa-developer.md — implementation guidance
+`,
       "qa-loop.md": `---
 description: Overview of the QA-Tools delivery loop — from requirement to verified release. Read this first.
 ---
@@ -1535,6 +1730,22 @@ Requirement → Build → Test → Backlog → Fix → Verify
 5. **AI analyzes and fixes** — AI identifies root cause: is it the code or the requirement? Fixes code or suggests requirement adjustment.
 6. **Retest verifies** — The loop closes only when the requirement is verified.
 
+## What this means for you (the AI)
+
+Each arrow in the loop is a rule on what you can and cannot do:
+
+**Requirement → Build** means: you don't build until there's an approved requirement. Period. If the user asks you to fix something without a requirement, your first response is "can you formulate what the system should do as a requirement?" — not "sure, I'll fix it".
+
+**Build → Test** means: the code is not done until there's a test that verifies it meets the requirement. "I compiled it" is not done. "I ran the file and it didn't crash" is not done.
+
+**Test → Backlog** means: when the test fails, that's a signal to you that either the requirement or the code is wrong. You don't guess which — you investigate. The backlog item is the *observation*, not the diagnosis.
+
+**Backlog → Fix** means: the fix comes from the requirement, not from the backlog item. The backlog item is the symptom. The requirement is what you build against. If you fix the symptom without going back to the requirement, you're patching, not building.
+
+**Fix → Verify** means: you don't mark tested without --evidence. The CLI refuses status changes without it. That's not bureaucracy — it's the line between claiming and verifying. If you cannot articulate the verification, you have not verified.
+
+If any of these feels like friction, that is the system working as intended. The friction is what keeps the chain unbroken.
+
 ## CLI quick reference
 
 \`\`\`bash
@@ -1946,7 +2157,8 @@ If the verification fails: do NOT mark tested. Go back to step 1, find the discr
     for (const [filename, content] of Object.entries(skills)) {
       fs.writeFileSync(path.join(skillsDir, filename), content);
     }
-    console.log("  ✓ qa-loop.md (start here)");
+    console.log("  ✓ qa-purpose.md (READ FIRST)");
+    console.log("  ✓ qa-loop.md");
     console.log("  ✓ qa-requirement-analyst.md");
     console.log("  ✓ qa-developer.md");
     console.log("  ✓ qa-test-generator.md");
@@ -1997,23 +2209,32 @@ If the verification fails: do NOT mark tested. Go back to step 1, find the discr
     const qaSection = `
 ## QA-Tools Integration
 
+This project uses qa-tools (https://qa-tools.com) for requirement-driven AI development. The purpose: build production-quality apps with AI that follow your own rules — as if you built it yourself, just faster. The AI is the builder; you are the requirements author and reviewer.
+
+**Read \`.claude/skills/qa-purpose.md\` before doing anything in this project.** It explains what qa-tools expects from the AI: not a coding assistant, a substitute for the developer.
+
 \`\`\`bash
 export QATOOLS_API_KEY=${apiKey || "<din-nyckel>"}
 \`\`\`
 
-### Kommandon
-- \`qatools requirements\` — lista krav
-- \`qatools backlog\` — lista backlog
-- \`qatools pending\` — väntande testsessioner
-- \`qatools read-session -s <id>\` — läs session
-- \`qatools upload-analysis -s <id> -f analysis.json\` — ladda upp analys
-- \`qatools requirement-create -f file.json\` — skapa krav
-- \`qatools template-upload -f file.json\` — ladda upp testprotokoll
-- \`qatools backlog-create -d "..." -t task\` — skapa ärende
-- \`qatools backlog-update -i <id> --status resolved\` — uppdatera
-
-### Roller (skills)
-Se \`.claude/skills/\` för instruktioner per roll.
+### Commands
+- \`qatools context\` — read the project's rule book (App Context)
+- \`qatools epics\` — list capabilities
+- \`qatools next\` — what's on the agenda right now
+- \`qatools requirements\` — list requirements
+- \`qatools backlog\` — list backlog signals
+- \`qatools pending\` — test sessions awaiting analysis
+- \`qatools read-session -s <id>\` — read session details
+- \`qatools upload-analysis -s <id> -f analysis.json\` — upload analysis
+- \`qatools requirement-create -f file.json\` — create requirements
+- \`qatools requirement-update -i <id> --status tested --evidence "..."\` — mark verified (evidence required)
+- \`qatools template-upload -f file.json\` — upload test template
+- \`qatools backlog-create -d "..." -t bug\` — create backlog item
+- \`qatools backlog-update -i <id> --status resolved --evidence "..."\` — mark resolved (evidence required)
+- \`qatools access show\` — view access model
+
+### Skills
+See \`.claude/skills/\` for role-specific instructions. Start with \`qa-purpose.md\`.
 `;
 
     if (fs.existsSync(claudeMdPath)) {
@@ -2029,8 +2250,41 @@ Se \`.claude/skills/\` för instruktioner per roll.
       console.log("\n✓ Created CLAUDE.md with QA-Tools section");
     }
 
-    console.log("\n🎉 QA-Tools initialized! Claude is ready.");
-    if (!apiKey) console.log("\n⚠ No API key set. Add it to CLAUDE.md: export QATOOLS_API_KEY=<key>");
+    // 5. Final purpose-first banner — check App Context state and tell the AI/user what to do
+    let contextStateMessage = "";
+    try {
+      const creds = getCredentials();
+      if (creds?.projectId) {
+        const getCtx = httpsCallable(functions, "getAppContext");
+        const ctxResult = await getCtx({ projectId: creds.projectId });
+        const ctx = ctxResult.data.appContext;
+        if (!ctx || (!ctx.purpose && !(ctx.stack || []).length && !(ctx.aiRules || []).length)) {
+          contextStateMessage = "\n⚠ App Context is empty for this project.\n   Without it, the AI has no basis for substituting for you.\n   First step: open https://qa-tools.com and define App Context (purpose, stack, conventions, AI rules)\n   or upload a JSON via: qatools context-set -f context.json\n";
+        } else {
+          const lastSync = ctx.updatedAt?._seconds ? new Date(ctx.updatedAt._seconds * 1000).toISOString().split('T')[0] : 'unknown';
+          contextStateMessage = `\n✓ App Context loaded (last updated: ${lastSync})\n`;
+        }
+      }
+    } catch (e) {
+      // Best-effort — don't block init on this check
+    }
+
+    console.log(`
+🎉 QA-Tools initialized!
+
+⚠ READ THIS FIRST: .claude/skills/qa-purpose.md
+
+   qa-tools exists to let anyone build production-quality apps with AI
+   that follow their own rules — as if you built it yourself, just faster.
+   The AI is not an assistant. It is a substitute for the developer.
+   Read qa-purpose.md before doing anything else in this project.
+${contextStateMessage}
+Next steps for the AI in this project:
+  1. qatools context     — read the project's rule book
+  2. qatools epics       — see what capabilities exist
+  3. qatools next        — see what's on the agenda
+`);
+    if (!apiKey) console.log("⚠ No API key set. Add it to CLAUDE.md: export QATOOLS_API_KEY=<key>\n");
     process.exit(0);
   });