Save this content to: .claude/skills/site-audit/SKILL.md

# Site Audit Skill

You will browse the entire Pushword site (public pages and admin) using dev-browser, identify bugs, and propose fixes. Sub-agents keep the main context window clean.

## Step 1: Detect base URL

If `$ARGUMENTS` is provided and non-empty, use it as the base URL.

Otherwise, run `symfony server:list` from `packages/dev-app/` to find the running local server URL. If no server is running, tell the user to start one with `composer dev` (from the repo root) and stop.

Store the base URL (e.g. `http://127.0.0.1:8000`) for use in all subsequent steps.

## Step 2: Login once

Read `.claude/skills/ui-debug/SKILL.md` first — it documents the sandbox constraints and
the **two-step** login form. Then run a dev-browser script to authenticate as admin and
create a reusable page named `admin-session`:

```bash
dev-browser --browser agent-dedicated --timeout 90 <<'EOF'
const page = await browser.getPage("admin-session");
await page.setViewportSize({ width: 1280, height: 800 });

await page.goto("BASE_URL/login", { waitUntil: "domcontentloaded" });
await page.fill('#inputEmail', '[email protected]');
await page.click('button[type="submit"]');
await page.waitForLoadState('domcontentloaded');   // -> /login?step=password

await page.fill('#inputPassword', 'p@ssword');
await page.click('button[type="submit"]');
await page.waitForLoadState('domcontentloaded');   // -> /admin/page

console.log(await saveScreenshot(await page.screenshot(), "audit-login.png"));
EOF
```

Replace `BASE_URL` with the actual base URL. Verify the login succeeded by reading the screenshot.

## Step 3: Run sub-agents sequentially

Launch 4 sub-agents **one at a time** (sequential, NOT parallel) using the Agent tool with `subagent_type: general-purpose`. Each sub-agent reuses the `admin-session` page, so it must run every script with `dev-browser --browser agent-dedicated` too: named pages belong to one browser.

**IMPORTANT for all sub-agents:**
- All test data created must use the prefix `__audit_test_` so it's identifiable
- Each sub-agent must **clean up after itself** (delete any test records it created)
- Save screenshots with `saveScreenshot(await page.screenshot(), "audit-public-homepage.png")` — it writes to `~/.dev-browser/tmp/` and returns the path
- Report findings as a list with severity: `CRITICAL`, `HIGH`, `MEDIUM`, `LOW`, `INFO`
- Use `page.snapshotForAI()` to discover page elements when selectors are unknown
- Use `page.waitForLoadState('domcontentloaded')` after every navigation

### Sub-agent A: Public Pages

Prompt the sub-agent with:

> You have access to a dev-browser instance. Use the existing `admin-session` page OR create a new `public-session` page for public browsing.
>
> Base URL: {BASE_URL}
>
> Browse all public pages and check for issues:
> 1. Homepage - loads correctly, no console errors, layout intact
> 2. Sitemap.xml - valid XML, contains expected URLs
> 3. RSS/Atom feed - valid, has entries
> 4. robots.txt - present and reasonable
> 5. Follow 5-10 internal links from homepage - all return 200, no broken links
> 6. Test mobile viewport (375x812) on homepage and one inner page - no horizontal overflow
> 7. Click all navigation items - verify they work
> 8. If search is present, test it with a query
>
> Save screenshots named `audit-public-*.png` via `saveScreenshot()`. Report all issues found with severity levels.

### Sub-agent B: Auth Flow

> You have access to a dev-browser instance. Create a new page `auth-session` for this test.
>
> Base URL: {BASE_URL}
>
> Test the authentication flow:
> 1. Go to login page, submit with wrong credentials (`[email protected]` / `wrong`) - verify error message appears
> 2. If forgot-password link exists, click it and test the form (submit with `[email protected]`)
> 3. Login with correct credentials (`[email protected]` / `p@ssword`) - verify redirect to admin
> 4. Click logout - verify redirect to public site or login page
> 5. Login again to restore session for subsequent agents
>
> Save screenshots named `audit-auth-*.png` via `saveScreenshot()`. Report all issues found with severity levels.

### Sub-agent C: Admin Pages CRUD

> You have access to a dev-browser instance. Use the existing `admin-session` page (already logged in).
>
> Base URL: {BASE_URL}
>
> Test admin CRUD operations:
> 1. **List pages** - Navigate to admin page list, verify it loads, check pagination if present
> 2. **Create page** - Click "Create Page", fill form with title `__audit_test_page`, slug `__audit-test-page`, set a body, submit. Verify success flash message.
> 3. **Edit page** - Find the created page in list, click edit, change the title to `__audit_test_page_edited`, save. Verify changes persisted.
> 4. **Inline edit** - If inline-editable fields exist (weight, tags), test them
> 5. **View page** - Visit the public URL of the test page, verify it renders
> 6. **Delete page** - Delete the `__audit_test_page_edited` page. Verify it's removed from the list.
> 7. **Redirections** - If a redirections section exists in admin, navigate to it and verify it loads
> 8. **Cheatsheet** - If a cheatsheet/help section exists, verify it loads
>
> IMPORTANT: Clean up - ensure the test page is deleted before finishing.
>
> Save screenshots named `audit-admin-crud-*.png` via `saveScreenshot()`. Report all issues found with severity levels.

### Sub-agent D: Admin Media & Users

> You have access to a dev-browser instance. Use the existing `admin-session` page (already logged in).
>
> Base URL: {BASE_URL}
>
> Test media and user management:
> 1. **List media** - Navigate to media list, verify it loads
> 2. **Upload media** - If upload is available, test uploading a small test image. Name it `__audit_test_media`. Verify it appears in the list.
> 3. **Edit media** - Edit the uploaded media metadata if possible, save
> 4. **Delete media** - Delete the test media, verify removal
> 5. **List users** - Navigate to user list, verify it loads
> 6. **Create user** - Create a test user with email `[email protected]`, verify success
> 7. **Edit user** - Edit the test user, verify changes save
> 8. **Delete user** - Delete the test user, verify removal
> 9. **Multi-upload** - If a multi-upload feature exists, test it
>
> IMPORTANT: Clean up - ensure all test records (__audit_test_*) are deleted before finishing.
>
> Save screenshots named `audit-admin-media-*.png` via `saveScreenshot()`. Report all issues found with severity levels.

## Step 4: Aggregate findings

After all 4 sub-agents complete, combine their reports into a single structured bug report:

```
## Site Audit Report

### CRITICAL
- [description] (screenshot: `~/.dev-browser/tmp/audit-*.png`)

### HIGH
- ...

### MEDIUM
- ...

### LOW
- ...

### INFO
- ...
```

If no bugs are found, report that the site passed the audit.

## Step 5: Propose fix plan

For each bug found:
1. Identify the likely source file(s) using Grep/Glob to search the codebase
2. Describe the root cause
3. Suggest a specific fix (code change or configuration)

Present fixes grouped by severity, highest first.