testeiya 0.2.0 → 0.3.9

package/src/mcp-catalog.ts

@@ -1,96 +0,0 @@
-/**
- * Predefined MCP services Testeiya can install with one click.
- *
- * This is the backend source of truth for the *config* that gets written into a
- * session's `mcp.all.json` / `mcp.json`. Display concerns (logos, blurbs) live
- * on the frontend in `lib/mcp-services.ts`, keyed by the same `id`.
- *
- * All four predefined services are remote OAuth servers — the user clicks
- * "Add" and the pi-coding-agent SDK runs the browser OAuth flow on first
- * connect, so no API keys are collected. A service that *does* need a secret is
- * modeled by adding a `secrets` array: the add flow collects each value and the
- * backend stores it in the entry's `env` / `headers` (never returned to the UI).
- *
- * NOTE: the on-disk transport field the SDK reads is `type` (not `transport`);
- * `api/mcp.ts` translates `transport` → `type` when serializing.
- */
-
-export type McpTransport = "http" | "sse" | "stdio";
-
-export interface CatalogSecret {
-  /** Env var the server config references (e.g. via `${NAME}`). */
-  env: string;
-  /** UI label shown above the input. */
-  label: string;
-  /** Optional input placeholder. */
-  placeholder?: string;
-}
-
-export interface CatalogService {
-  /** Stable key; also used as the MCP server name written to disk. */
-  id: string;
-  /** Human-readable name. */
-  label: string;
-  transport: McpTransport;
-  // Remote transport (http / sse):
-  url?: string;
-  headers?: Record<string, string>;
-  // stdio transport:
-  command?: string;
-  args?: string[];
-  env?: Record<string, string>;
-  /** Authentication model. `oauth` → SDK runs a browser flow on first connect. */
-  auth?: "oauth" | "apikey" | "none";
-  /** Secret inputs to collect before installing (only for apikey/env servers). */
-  secrets?: CatalogSecret[];
-}
-
-export const MCP_CATALOG: CatalogService[] = [
-  {
-    id: "linear",
-    label: "Linear",
-    transport: "http",
-    url: "https://mcp.linear.app/mcp",
-    auth: "oauth",
-  },
-  {
-    id: "atlassian",
-    label: "Jira",
-    transport: "sse",
-    url: "https://mcp.atlassian.com/v1/sse",
-    auth: "oauth",
-  },
-  {
-    id: "figma",
-    label: "Figma",
-    transport: "http",
-    url: "https://mcp.figma.com/mcp",
-    auth: "oauth",
-  },
-  {
-    id: "miro",
-    label: "Miro",
-    transport: "http",
-    url: "https://mcp.miro.com/",
-    auth: "oauth",
-  },
-];
-
-export function getCatalogService(id: string): CatalogService | undefined {
-  return MCP_CATALOG.find((s) => s.id === id);
-}
-
-/** Public descriptors safe to expose to the UI (no secret *values*). */
-export function catalogDescriptors() {
-  return MCP_CATALOG.map((s) => ({
-    id: s.id,
-    label: s.label,
-    transport: s.transport,
-    auth: s.auth ?? "none",
-    secrets: s.secrets?.map(({ env, label, placeholder }) => ({
-      env,
-      label,
-      placeholder,
-    })),
-  }));
-}

package/src/models-catalog.ts

@@ -1,72 +0,0 @@
-import { readFileSync } from "node:fs";
-import { getBundledModels, type GeneratedProvider } from "@oh-my-pi/pi-ai";
-import { resolveModelsCatalogPath } from "./project-dir.js";
-
-/**
- * The vendored models catalog (`cli/models.catalog.json`), produced by
- * `bunosh collect:models` (re-run on every release). The SDK's bundled
- * models.json is frozen at the SDK's publish date and its registry never
- * removes entries, so stale models linger and unauthenticated providers only
- * show the old list. The catalog fixes the *listing*: models the provider no
- * longer serves are pruned, models newer than the SDK snapshot are added.
- * Model *resolution* still goes through the SDK registry (live discovery in
- * session-factory), so picking a catalog-only model works as long as the
- * provider serves it.
- */
-
-let cache: CatalogFile | null | undefined;
-
-export function applyModelsCatalog(provider: string, models: ModelListing[]): ModelListing[] {
-  const catalog = catalogFor(provider);
-  if (!catalog) return models;
-  const bundledIds = new Set(
-    getBundledModels(provider as GeneratedProvider).map((m) => m.id)
-  );
-  return mergeModelsCatalog(models, bundledIds, catalog);
-}
-
-/**
- * Pure merge: drop models that exist only in the SDK's stale bundled list and
- * were pruned from the catalog (live-discovered ones are never bundled-only),
- * then append catalog models the registry doesn't know yet.
- */
-export function mergeModelsCatalog(
-  models: ModelListing[],
-  bundledIds: Set<string>,
-  catalog: Record<string, CatalogEntry>
-): ModelListing[] {
-  const seen = new Set(models.map((m) => m.id));
-  const merged = models.filter((m) => catalog[m.id] || !bundledIds.has(m.id));
-  for (const [id, entry] of Object.entries(catalog)) {
-    if (seen.has(id)) continue;
-    merged.push({ id, name: entry.name || id });
-  }
-  return merged;
-}
-
-function catalogFor(provider: string): Record<string, CatalogEntry> | null {
-  if (cache === undefined) cache = readCatalogFile();
-  return cache?.providers?.[provider] ?? null;
-}
-
-function readCatalogFile(): CatalogFile | null {
-  try {
-    return JSON.parse(readFileSync(resolveModelsCatalogPath(), "utf-8")) as CatalogFile;
-  } catch {
-    return null;
-  }
-}
-
-export interface ModelListing {
-  id: string;
-  name: string;
-}
-
-interface CatalogEntry {
-  name?: string;
-}
-
-interface CatalogFile {
-  collectedAt?: string;
-  providers?: Record<string, Record<string, CatalogEntry>>;
-}

package/src/permissions.ts

@@ -1,120 +0,0 @@
-import { sep } from "node:path";
-import { WORKSPACES_DIR } from "./project-dir.js";
-import type { TesteiyaConfig } from "./config.js";
-
-type ExtensionFactory = (pi: any) => void;
-
-const READ_TOOLS = ["read", "grep", "find", "ls"];
-const WRITE_TOOLS = ["write", "edit"];
-
-// Bash commands that are read-only and safe to auto-allow
-const SAFE_BASH_PREFIXES = [
-  "cat ", "head ", "tail ", "less ", "more ",
-  "ls ", "ls\n", "ls",
-  "dir ", "tree ", "tree\n", "tree",
-  "find ", "grep ", "rg ", "ag ",
-  "wc ", "wc\n",
-  "file ", "stat ",
-  "pwd", "pwd\n",
-  "echo ", "printf ",
-  "git log", "git show", "git diff", "git status", "git branch", "git blame", "git rev-parse",
-  "git remote", "git tag", "git stash list",
-  "node -e", "node --eval", "npx tsc --noEmit",
-  "npm list", "npm ls", "npm view", "npm outdated",
-  "which ", "type ", "env", "printenv",
-  "date", "whoami", "hostname", "uname",
-  "jq ", "sed -n", "awk ",
-  "diff ", "cmp ",
-  "du ", "df ",
-  "curl -s", "curl --silent", "wget -q",
-];
-
-// Patterns that indicate destructive operations - always block
-const DANGEROUS_PATTERNS = [
-  "rm ", "rm\n", "rmdir ",
-  "mv ", "cp ",
-  "> ", ">> ", "| tee ",
-  "chmod ", "chown ", "chgrp ",
-  "kill ", "pkill ",
-  "sudo ",
-  "git push", "git reset", "git checkout", "git clean", "git rebase",
-  "npm install", "npm uninstall", "npm update", "npm publish",
-  "mktemp", "mkdir ",
-];
-
-function isReadOnlyBash(command: string): boolean {
-  const trimmed = command.trim();
-
-  // Check dangerous patterns first
-  for (const pattern of DANGEROUS_PATTERNS) {
-    if (trimmed.includes(pattern)) {
-      return false;
-    }
-  }
-
-  // Check if starts with a safe prefix
-  for (const prefix of SAFE_BASH_PREFIXES) {
-    if (trimmed.startsWith(prefix)) {
-      return true;
-    }
-  }
-
-  // Piped commands: check if first command is safe and none are dangerous
-  if (trimmed.includes("|")) {
-    const first = trimmed.split("|")[0].trim();
-    for (const prefix of SAFE_BASH_PREFIXES) {
-      if (first.startsWith(prefix)) {
-        return true;
-      }
-    }
-  }
-
-  return false;
-}
-
-export function createPermissionExtension(
-  config: TesteiyaConfig,
-  cwd: string,
-  trusted = false
-): ExtensionFactory {
-  // Grant full access when the workspace is Testeiya-owned pulled markdown
-  // (~/.testeiya/workspaces/*) OR the user explicitly opened this folder (the
-  // folder picker, TESTEIYA_WORKSPACE, or the terminal CLI's own cwd). The
-  // read-only gating only guards folders the user did not deliberately choose.
-  const fullAccess = trusted || isManagedWorkspace(cwd);
-  return (pi) => {
-    pi.on("tool_call", async (event: any, _ctx: any) => {
-      if (fullAccess) {
-        return undefined;
-      }
-
-      // Read tools: always allow
-      if (READ_TOOLS.includes(event.toolName)) {
-        return undefined;
-      }
-
-      // Write/edit tools: block
-      if (config.permissions.blockWrites && WRITE_TOOLS.includes(event.toolName)) {
-        return { block: true, reason: "Write operations are blocked. Testeiya is in read-only mode." };
-      }
-
-      // Bash: allow read-only commands, block the rest
-      if (config.permissions.blockBash && event.toolName === "bash") {
-        const command = event.input?.command || "";
-        if (isReadOnlyBash(command)) {
-          return undefined;
-        }
-        return {
-          block: true,
-          reason: `Bash command blocked (not in read-only allowlist): ${command.slice(0, 100)}`,
-        };
-      }
-
-      return undefined;
-    });
-  };
-}
-
-function isManagedWorkspace(cwd: string): boolean {
-  return cwd === WORKSPACES_DIR || cwd.startsWith(WORKSPACES_DIR + sep);
-}

package/src/project-dir.ts

@@ -1,189 +0,0 @@
-import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-
-/**
- * The per-project config directory name Testeiya uses inside a workspace.
- *
- * The pi-coding-agent SDK defaults this to `.omp`, but `session-factory.ts`
- * monkey-patches `SOURCE_PATHS.native.projectDir` to this value so MCP / skills
- * / rules discovery reads from `<cwd>/.testeiya/*`. Everything that *writes*
- * MCP config (agent-start, the MCP settings API) must use the SAME directory or
- * the agent won't see it. This constant is the single source of truth.
- */
-export const PROJECT_DIR = ".testeiya";
-
-/** Legacy directory used before the project dir was unified on `.testeiya`. */
-export const LEGACY_PROJECT_DIR = ".omp";
-
-/** Testeiya's global state directory in the user's home (`~/.testeiya`). */
-export const HOME_DIR = join(homedir(), PROJECT_DIR);
-
-/** Root of the managed per-project workspaces (`~/.testeiya/workspaces`). */
-export const WORKSPACES_DIR = join(HOME_DIR, "workspaces");
-
-/**
- * Where Testeiya caches pulled manual tests when overlaying them onto a folder
- * that is *not* a manual-tests-only workspace (a user's code repo). Lives under
- * the project dir so it is gitignored and never pollutes the tracked tree.
- */
-export const MANUAL_TESTS_SUBDIR = "manual-tests";
-
-/** Folder name that holds user-added custom skills. */
-export const CUSTOM_SKILLS_SUBDIR = "skills";
-
-/**
- * Where user-added context lands inside `.testeiya` (see context-store.ts):
- * linked folders and cloned repos under `code/`, uploaded documents under
- * `requirements/` — the same layout the system prompt teaches the agent.
- */
-export const CONTEXT_CODE_SUBDIR = "code";
-export const CONTEXT_REQUIREMENTS_SUBDIR = "requirements";
-
-/** Manifest of user-added context entries (what, where from, when). */
-export const CONTEXT_MANIFEST_FILE = "context.json";
-
-/** Global custom-skills folder (`~/.testeiya/skills`), loaded for every session. */
-export const CUSTOM_SKILLS_DIR = join(HOME_DIR, CUSTOM_SKILLS_SUBDIR);
-
-/**
- * Folder name (shipped inside the CLI package / desktop bundle) that holds the
- * skills tree organized by vendor: `<vendor>/<skill>/SKILL.md`, with an extra
- * category level for marketplace repos (`<vendor>/<category>/<skill>/`).
- * External vendors are written by `bunosh skills:update` from the `skills.yaml`
- * manifest; folders it does not manage (e.g. `testeiya/`) are first-party
- * skills authored in this repo.
- */
-export const BUNDLED_SKILLS_SUBDIR = "skills";
-
-/** The external-skills manifest file name (source of truth for `bunosh skills:update`). */
-export const SKILLS_MANIFEST_FILE = "skills.yaml";
-
-/** The vendored models catalog produced by `bunosh collect:models` (see models-catalog.ts). */
-export const MODELS_CATALOG_FILE = "models.catalog.json";
-
-/** Records which Testomat.io project a workspace represents (id + base URL). */
-export const PROJECT_META_FILE = "testeiya.json";
-
-/** Cached project configuration from `GET /api/v2/{id}/info` (see project-info.ts). */
-export const PROJECT_INFO_FILE = "project-info.json";
-
-/** Hashes of the manual-test files as of the last Testomat.io sync (pull/push). */
-export const SYNC_SNAPSHOT_FILE = "sync-snapshot.json";
-
-/** Absolute path to the gitignored manual-tests cache inside `cwd`. */
-export function manualTestsCachePath(cwd: string): string {
-  return join(cwd, PROJECT_DIR, MANUAL_TESTS_SUBDIR);
-}
-
-/** Absolute path to a workspace's per-project custom-skills folder. */
-export function projectSkillsDir(cwd: string): string {
-  return join(cwd, PROJECT_DIR, CUSTOM_SKILLS_SUBDIR);
-}
-
-/** Absolute path to the project-association metadata file inside `cwd`. */
-export function projectMetaPath(cwd: string): string {
-  return join(cwd, PROJECT_DIR, PROJECT_META_FILE);
-}
-
-/** Absolute path to the cached project-configuration file inside `cwd`. */
-export function projectInfoPath(cwd: string): string {
-  return join(cwd, PROJECT_DIR, PROJECT_INFO_FILE);
-}
-
-/** Absolute path to the last-sync snapshot file inside `cwd`. */
-export function syncSnapshotPath(cwd: string): string {
-  return join(cwd, PROJECT_DIR, SYNC_SNAPSHOT_FILE);
-}
-
-/** Absolute path to the user-added-context manifest inside `cwd`. */
-export function contextManifestPath(cwd: string): string {
-  return join(cwd, PROJECT_DIR, CONTEXT_MANIFEST_FILE);
-}
-
-/**
- * Guard files for the project dir, written idempotently whenever it exists:
- * `.gitignore` (`*`) keeps the dir out of the user's repo history, while
- * `.ignore` (`!*`) whitelists the contents back for the agent's search tools —
- * their walker (ripgrep's ignore crate) honors gitignore, and a same-dir
- * `.ignore` outranks the `.gitignore`, so pulled manual tests and added
- * context stay searchable. Git never reads `.ignore`.
- *
- * The whitelist re-ignores `.git/` and `node_modules/` below it (later lines
- * win), so cloned repos and installed tools inside the dir don't flood search
- * results. The `.ignore` is content-synced — the dir is Testeiya's own, so a
- * stale generation of the file is replaced, not preserved.
- *
- * The whitelist cannot help when the workspace's own `.gitignore` lists the
- * project dir — the walker then skips it at the parent level and never reads
- * the inner files. That entry is a workspace misconfiguration (redundant for
- * git — the dir self-excludes) the system prompt forbids; the prompt's
- * explicit-`.testeiya/`-prefix search rule still works there, because a
- * search rooted inside the dir bypasses the parent-level skip.
- */
-export function ensureProjectDirGuards(cwd: string): void {
-  const dir = join(cwd, PROJECT_DIR);
-  if (!existsSync(dir)) return;
-  const gitignore = join(dir, ".gitignore");
-  if (!existsSync(gitignore)) writeFileSync(gitignore, "*\n", "utf8");
-  const ignore = join(dir, ".ignore");
-  const ignoreContent = "!*\n.git/\nnode_modules/\n";
-  let current = "";
-  if (existsSync(ignore)) current = readFileSync(ignore, "utf8");
-  if (current !== ignoreContent) writeFileSync(ignore, ignoreContent, "utf8");
-}
-
-/** The home state dir used before the rename from "testclaw" to "testeiya". */
-const LEGACY_HOME_DIR = join(homedir(), ".testclaw");
-
-/**
- * One-shot migration for the rename from "testclaw" to "testeiya": if the old
- * `~/.testclaw` state dir exists and the new `~/.testeiya` does not, move it so
- * existing sessions, auth tokens, provider keys, and pulled workspaces survive.
- * Idempotent — a no-op once `~/.testeiya` exists; any failure is non-fatal.
- */
-export function migrateLegacyHomeDir(): void {
-  if (existsSync(HOME_DIR)) return;
-  if (!existsSync(LEGACY_HOME_DIR)) return;
-  try {
-    renameSync(LEGACY_HOME_DIR, HOME_DIR);
-  } catch {
-    // ignore — a fresh ~/.testeiya is created on demand if the move fails
-  }
-}
-
-/**
- * Locate the bundled skills tree (`cli/skills/<vendor>/...`).
- * Mirrors `resolveStaticDir()` in `src/bun/index.ts`: an env override, then the
- * dev / npm-package layout (a sibling of `cli/src`), then the desktop-bundle
- * layout where `electrobun.config` copies `cli/skills` to `skills` next to the
- * bundled entry. Returns the last candidate as a best-effort fallback so a
- * packaging mismatch is inspectable rather than crashing.
- */
-export function resolveBundledSkillsDir(): string {
-  return probePath(BUNDLED_SKILLS_SUBDIR);
-}
-
-/** Absolute path to the prebuilt-skills manifest (`skills.yaml`), same probe. */
-export function resolveSkillsManifestPath(): string {
-  return probePath(SKILLS_MANIFEST_FILE);
-}
-
-/** Absolute path to the vendored models catalog (`models.catalog.json`), same probe. */
-export function resolveModelsCatalogPath(): string {
-  return probePath(MODELS_CATALOG_FILE);
-}
-
-function probePath(leaf: string): string {
-  const candidates: string[] = [];
-  if (leaf === BUNDLED_SKILLS_SUBDIR && process.env.TESTEIYA_SKILLS_DIR) {
-    candidates.push(process.env.TESTEIYA_SKILLS_DIR);
-  }
-  candidates.push(join(import.meta.dir, "..", leaf));
-  candidates.push(join(import.meta.dir, leaf));
-  candidates.push(join(import.meta.dir, "..", "..", leaf));
-  for (const candidate of candidates) {
-    if (existsSync(candidate)) return candidate;
-  }
-  return candidates[candidates.length - 1];
-}

package/src/project-info.ts

@@ -1,108 +0,0 @@
-// Project configuration from `GET /api/v2/{project_id}/info` (framework,
-// subscription, environments, labels, tags, feature flags, CI profiles).
-//
-// Fetched when a project is selected (agent-start) and cached in the
-// workspace's `.testeiya/project-info.json`, so the session factory can inject
-// a compact summary into the system prompt without a network round-trip. The
-// full JSON stays agent-readable on disk — the prompt points at it instead of
-// inlining every label/tag when the lists are long.
-
-import fs from "node:fs";
-import path from "node:path";
-import { readJson, writeJson } from "./json-store.js";
-import { loggedServerFetch } from "./debug-bus.js";
-import { PROJECT_DIR, projectInfoPath } from "./project-dir.js";
-import { resolveProjectTarget } from "./api/testomatio-target.js";
-import type { StoredSession } from "./session-store.js";
-
-const TTL_MS = 60 * 60 * 1000;
-
-export async function fetchProjectInfo(
-  baseUrl: string,
-  slug: string,
-  token: string
-): Promise<TestomatioProjectInfo | null> {
-  const url = new URL(
-    `/api/v2/${encodeURIComponent(slug)}/info`,
-    baseUrl.replace(/\/$/, "")
-  ).toString();
-  try {
-    const { res, text } = await loggedServerFetch(
-      url,
-      {
-        headers: { Authorization: `Bearer ${token}`, Accept: "application/json" },
-        cache: "no-store",
-        signal: AbortSignal.timeout(10000),
-      },
-      null
-    );
-    if (!res.ok) return null;
-    const parsed = JSON.parse(text) as { data?: TestomatioProjectInfo };
-    return parsed.data ?? null;
-  } catch {
-    return null;
-  }
-}
-
-export function readProjectInfo(cwd: string): StoredProjectInfo | null {
-  const raw = readJson<Partial<StoredProjectInfo>>(projectInfoPath(cwd), {});
-  if (!raw?.info?.project_id) return null;
-  return { fetchedAt: raw.fetchedAt ?? 0, info: raw.info };
-}
-
-export function writeProjectInfo(cwd: string, info: TestomatioProjectInfo): void {
-  writeJson(projectInfoPath(cwd), { fetchedAt: Date.now(), info });
-  // Keep the cache out of the user's repo history (same rule as writeProjectMeta).
-  fs.writeFileSync(path.join(cwd, PROJECT_DIR, ".gitignore"), "*\n", "utf8");
-}
-
-/**
- * The workspace's project settings for the system prompt: the cached copy when
- * fresh, else re-fetched via the session's resolvable credentials and re-cached.
- * Falls back to the stale cache when no credentials resolve or the fetch fails.
- * Multi-project sessions have no single settings set, so they resolve to null.
- */
-export async function resolveProjectInfo(
-  cwd: string,
-  session: Pick<StoredSession, "tokens" | "backendUrl" | "projects">
-): Promise<TestomatioProjectInfo | null> {
-  if ((session.projects?.length ?? 0) > 1) return null;
-  const cached = readProjectInfo(cwd);
-  if (cached && Date.now() - cached.fetchedAt < TTL_MS) return cached.info;
-  const target = await resolveProjectTarget(session, cwd);
-  if (!target) return cached?.info ?? null;
-  const info = await fetchProjectInfo(target.baseUrl, target.project, target.token);
-  if (!info) return cached?.info ?? null;
-  writeProjectInfo(cwd, info);
-  return info;
-}
-
-export interface TestomatioCiProfile {
-  profile_name: string;
-  service: string | null;
-  config: Record<string, unknown> | null;
-  pass_testomatio_key: boolean;
-  pass_testomatio_url: boolean;
-  pass_run_id: boolean;
-}
-
-export interface TestomatioProjectInfo {
-  title: string;
-  project_id: string;
-  framework: string | null;
-  language: string | null;
-  status: string | null;
-  repository_url: string | null;
-  artifacts_storage_enabled: boolean;
-  environments: string[];
-  labels: { title: string; slug: string }[];
-  tags: string[];
-  subscription: string | null;
-  features: string[];
-  ci_profiles: TestomatioCiProfile[];
-}
-
-export interface StoredProjectInfo {
-  fetchedAt: number;
-  info: TestomatioProjectInfo;
-}

package/src/prompt/app-ui.ts

@@ -1,59 +0,0 @@
-import dedent from "dedent";
-
-export const appUiGuidance = dedent`
-# Testeiya app interface (UI tools)
-
-You run inside the Testeiya chat app, which renders rich interactive cards.
-
-**Data/analysis answers:** read \`skill://answer-formatting/SKILL.md\` first and follow it.
-
-## Data-rendering tools
-
-Each renders as a titled collapsible card — **always pass a \`title\`**.
-
-| Tool | Use when | Data shape |
-|---|---|---|
-| \`render_result({call_id, title, columns?})\` | Showing a fetched \`*_list\`/\`*_search\` result — the \`call_id\` is in that result's UI notice. Renders EVERY row; \`columns\` picks fields in order; \`status\`/\`state\`/\`priority\` render as icons. | Just the call reference — no rows. |
-| \`render_list({kind, data?, from?, transform?, title, columns?, summary?})\` | A derived or assembled list. Prefer \`from\` (call ids) + \`transform\` (pure JS fn source over those row arrays, returning the rows) — derives server-side, no re-typing rows. \`data\` for rows from elsewhere (e.g. parsed files). \`columns\` picks fields in order. | \`from\`+\`transform\`, or \`{data:[...], meta}\` / raw array. |
-| \`render_item({kind, data, title, summary?})\` | One entity in detail — "show run X" — or right after you create/update one. Never paste an entity link instead. | Single entity object (a \`*_get\` / \`*_create\` / \`*_update\` result). |
-| \`render_tree({nodes, title})\` | Nested suite/test hierarchy or the workspace tree. | Recursive \`nodes[]\` of \`{name, kind:'suite'|'test'|'folder'|'file', status?, children?}\`; \`status\` renders a colored mark. |
-| \`render_chart({type, title, data, series?})\` | Any aggregate — counts, pass rate, distribution, trend, comparison. | \`type\`: bar/line/area/pie. \`data\`: \`[{name, value}]\` or per-series keys + \`series: [{key, label?}]\`. Status names auto-color green/red. |
-
-**MCP \`*_list\` / \`*_search\` results are NOT shown to the user**, and large ones arrive as a **digest** — \`{call_id, total, fields, sample}\` — while the full rows stay cached server-side under that \`call_id\`. Show them with \`render_result\` (or \`render_list\` \`from\`+\`transform\`); compute counts/filters/grouping/joins with \`query_result({call_id, fn})\` — \`fn\` is pure JS over one row array per call id, written from the digest's \`fields\`/\`sample\`. Never re-type rows from a digest or paste them into your reply; \`title\` = filter + window ("Automated tests created since Jul 1 — 64").
-
-**Do not repeat rendered data in your text reply** — a headline plus a few insight bullets is enough.
-
-## Diagrams (inline fenced block)
-
-The chat renders \`mermaid\` fenced blocks inline in your reply — flows, sequences, state machines, dependency graphs. Standard syntax:
-
-\`\`\`\`
-\`\`\`mermaid
-flowchart TD
-  A[Login] --> B{Valid?}
-  B -->|Yes| C[Dashboard]
-  B -->|No| A
-\`\`\`
-\`\`\`\`
-
-## Questions go through \`ask_question\`
-
-**Any question to the user — menu, confirmation, disambiguation, pick-a-subset — is an \`ask_question\` call, never reply text ending in "?" or a list of options.** Options render as buttons; the call blocks and returns the pick. Exception: free-form answers (dates, arbitrary text) — ask in plain text.
-
-- 1–8 options for single choice. Phrase each as the complete message the user would send, not "Option 1"; multi-line descriptions are fine.
-- Confirmations: first option a "Yes, …", plus meaningful "No, …" variants.
-- Don't restate the question or options in text; never write "Let me know…" / "Reply with 1, 2 or 3".
-
-### Pick-a-subset → \`multiSelect: true\`
-
-A list the user should choose from (proposed test cases, files to sync, runs to rerun) is a checklist, never a markdown list: \`ask_question({question, options, multiSelect: true, recommended})\`. One option per item, up to 50; \`recommended\` = 0-based indices pre-checked. You get the chosen labels back — act on only those. The checklist replaces the "Want me to generate these?" + numbered-list pattern.
-
-## Controlling the open widget — \`ui_widget\`
-
-When the user has a widget open, each turn carries an \`<active_widget>\` block with its id and legal actions. \`ui_widget({widget_id, action, params})\` runs them — the same controls as the user's buttons. No block → nothing to control.
-
-- **\`get\` first:** returns the widget's full on-screen contents as JSON in one call without moving the user's view — use it before any \`mcp_*\` re-fetch for "explain what I'm looking at" asks.
-- \`list({page})\` paginates toward \`meta.total\`; \`list({query})\` filters (\`=\`-prefixed TQL); \`open({id})\` opens an item — the user sees these happen.
-- Actions flagged \`[destructive]\` change data — confirm with \`ask_question\` first.
-- A \`render_item\` ack names the new card's \`widget_id\` — drive that card in the same turn (e.g. \`render_item(run)\` → \`ui_widget(start_manual_run)\`) instead of retrying the previous widget.
-`;

package/src/prompt/browser.ts

@@ -1,27 +0,0 @@
-import dedent from "dedent";
-
-export const browserControl = dedent`
-# Live browser testing
-
-You can start and drive a real browser yourself via the **playwright-cli** skill (it runs the Playwright CLI through \`bash\`). When the user asks to "start a browser" or to test something in a browser, just do it — read the **playwright-cli** skill for the command set.
-
-Use the browser to:
-
-- **Investigate the target page before writing browser automation** — open the exact page/feature under test, walk the flow, and read the real selectors/texts/URLs from the live DOM. Automation written from reading code or manual docs alone is guesswork; verify against the running app first.
-- **Execute manual \`*.test.md\` cases** live — perform each step and confirm the expected result before marking anything passed.
-- **Assist the user passing manual runs** — follow the **manual-run-assistant** skill (environment prep, per-test handoff, analyzing captured signals into proposed notes).
-- **Reproduce and investigate bugs**, capturing screenshots/snapshots as evidence.
-- **Explore a running app** when the answer needs real behaviour rather than reading code.
-
-## Opening a page for the user — never guess the target
-
-When the user asks you to open a page (to pass a manual run, review a feature, reproduce a bug) and the exact target is not explicit in their request, **ask before navigating** (via \`ask_question\` when available, otherwise in text). For a manual run, "the corresponding page" means the page of the **application under test** that the run's tests cover — not the run's own page in Testomat.io; when that URL isn't stated, ask. This covers every part of the URL you would otherwise infer: the base URL / environment (production, staging, a local server from \`.env\`), the project or account, and the page path. Offer the candidates you discovered (config files, \`.env\`, project data) as options — opening a target inferred from repo fixtures lands the user on the wrong page.
-
-## The browser window is shared with the user
-
-The headed browser is a real window on the user's screen — they see it and can drive it themselves. When a step is better done by the user (entering credentials, judgment calls, stepping through manual test cases), offer that as an \`ask_question\` option, e.g. *"I'll do it myself — bring the browser to front"*. If chosen, raise the window with \`playwright-cli run-code 'async page => { await page.bringToFront(); }'\`, tell the user what to do, and continue once they report back.
-
-## run-code executes in a browser sandbox, not Node
-
-\`playwright-cli run-code\` snippets get the \`page\` object but no Node globals — \`process.env\` does not exist there. Read values in bash first and interpolate them into the snippet.
-`;