Addresses whole-branch review's minor findings:
- Unknown CLI arguments now echo only the flag name, not its value, so a
mistyped flag (e.g. --pasword=secret) can't leak a credential into the
error output.
- README now notes that failed runs retain a screenshot/trace under
test-results/ (gitignored, may contain the username but not the masked
password), and points at the UNVERIFIED post-composer selectors as the
first thing to check during real home-network verification.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Implements run.sh with argument parsing (--username, --password, --subreddit,
--title, --body, optional --headed), environment variable mapping to Task 2's
env contract, Playwright invocation with proper exit-code capture via set +e,
and result file output to stdout.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Addresses reviewer's minor findings on the prior fix commit: makes the
screenshot-verified/unverified boundary explicit in code comments so it
travels with the file rather than living only in commit messages, and
removes redundant .click() calls before .fill() (fill() already focuses).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Live verification against a real Reddit login page (from this dev
sandbox) showed:
- The actual submit button has no [type="submit"] attribute; its
accessible name is "Log In" — switched to getByRole with that name.
- Username/password fields are better targeted via their visible
labels (getByLabel) than brittle name= attribute selectors.
- A cookie-consent dialog can overlay the form and intercept clicks;
it's now dismissed via "Reject Optional Cookies" before filling in.
- This sandbox's network is flagged by Reddit's bot detection with a
"blocked by network security" interstitial before the login form
even loads — this is unrelated to credentials and unrelated to the
target account (confirmed reachable fine from a residential
network/browser). Added explicit detection for this state so it
reports a clear, distinguishable error instead of a generic
CAPTCHA/2FA guess. Full live end-to-end verification (successful
login + post creation) must be run from a network Reddit does not
block, e.g. the mini PC this app actually runs on.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The outer catch's overwrite guard checked `!outcome.error`, but outcome.error
is always truthy (even the default placeholder string), so an exception
occurring outside the two explicitly-guarded blocks (e.g. a .fill()/.click()
timeout) would leave the generic "Test did not complete" message instead of
the real error. Replaced with an explicit outcomeFinalized sentinel that is
set exactly where outcome is deliberately finalized (missing env var, login
timeout, post-submission timeout, success), so any other exception correctly
falls through to the catch-all branch with its real message.
