Supercheck Platform Features

Supercheck platform features

flowchart TD
  USER --> CLI[CLI and monitoring as code]
  USER --> WEB[Web app]
  WEB --> PLAY[Playground]
  WEB --> REQ[Requirements]
  WEB --> STATUS[Status pages]
  WEB --> AI[AI test repair]
  RUN[Executions] --> SSE[Realtime events]
  TAG[Tags] --> REQ
  TAG --> TEST[Test and monitor resources]

CLI

• Source: cli; package: @supercheck/cli; binary: supercheck; license: AGPL-3.0-only; supported Node runtime begins at 20 unless package metadata changes.
• Config is declarative monitoring-as-code. Config loading validates schema and rejects embedded live/test/trigger token patterns, including legacy trigger formats.
• Secret variable values become environment references; file variables are excluded from generated config and use supported multipart/dashboard paths.
• Authentication storage must use the platform-appropriate protected location and never print tokens.
• Preserve interactive and non-interactive behavior for login, init, validate, diff, deploy, pull, destroy, doctor, health, jobs, tests, monitors, alerts, runs, tags, variables, notifications, and upgrade commands.
• AI SRE CLI contracts are incident list/get/timeline/resolve, sre triage/investigate/ask/brief, and read-only service list/get/health/dependencies. Use /api/sre/* routes with unified CLI-token/session authentication; never call browser-only server actions from the CLI.
• Keep AI SRE tenant scope and RBAC server-side: incident reads need sre_incident:view, resolution needs sre_incident:update, investigations need both incident and investigation investigate, service reads need sre_service:view, and live connector tools additionally need sre_connector:investigate.
• Treat deep investigation as asynchronous HTTP 202 acceptance. Do not describe it as streaming; stream Copilot chat and evidence briefs only. In JSON mode emit NDJSON for streams, enforce bounded event buffers and idle timeout, support Ctrl-C, and never retry side-effecting POST requests after uncertain completion.
• Require confirmation and a non-empty audited comment for incident resolution; --force is the automation escape hatch. Do not add runbook execution or private-agent startup until versioned server protocols, authorization, approvals, and operational safety contracts exist.
• Notification provider JSON uses --payload (--data alias); retain legacy --config compatibility and reject multiple simultaneous payload options.
• Human output goes to readable terminal streams; --json output must remain machine-parseable without progress/noise on stdout.
• Subprocess signal termination and command failures return nonzero status. Retry only idempotent network requests.
• Reusable CI distinguishes a job trigger key from the CLI token required for polling/waiting. Bind workflow inputs through environment variables/quoted arrays, not shell interpolation.
• Verify with typecheck, lint, all Jest suites, build, and npm pack --dry-run; inspect packaged files and executable entrypoint.

Realtime SSE

• Authenticate and authorize private subscriptions before opening streams; bind each stream to the permitted tenant/resource/run.
• Use dedicated blocking Redis connections where QueueEvents is involved.
• Emit typed, bounded events and heartbeats; preserve event ordering/identity expected by clients.
• Close subscriptions, timers, listeners, and Redis resources on abort, completion, timeout, navigation, and errors.
• Reconnection/resubscription must not leak other resources or create duplicate UI state.

Requirements

• Requirements are traceability and coverage objects. They are never executed and do not own an independent pass/fail state.
• Coverage is derived from linked test executions and must remain explainable.
• Requirement, document, test, and tag links are tenant-scoped and protected against cross-project IDOR.
• Browser requirements follow the recorder-first authoring path where applicable.
• AI requirement processing uses sanitized bounded content and validated structured output.