[zwanski-start]

Closes #170

What changed

• Prompt templates (coding_prompt, testing_prompt, auto_improve_prompt): screenshot instructions now use playwright-cli screenshot --filename=.autoforge/validation/<name>.png. They also tell the agent never to save screenshots anywhere else in the project and never to commit them.
• autoforge_paths.py: validation/ added to the generated .autoforge/.gitignore. New helper get_validation_dir().
• prompts.py:
  • scaffold_project_prompts creates .autoforge/validation/.
  • New migration step v1 → v2 (CURRENT_MIGRATION_VERSION = 2). It refreshes .autoforge/.gitignore, creates the directory, and rewrites the default screenshot wording in existing projects' copied coding_prompt.md / testing_prompt.md.
  • v0 projects go through v1 then v2, because the v1 replacement blocks contain the same default wording.
• CLAUDE.md: .autoforge/validation/ documented in the generated-project structure.

Verification

• ruff check, mypy on the changed modules, test_security.py, and the pytest suites (test_client, test_dependency_resolver, test_rate_limit_utils) all pass.
• Migration: I built a project from the old (master) templates, set it to migration version 1, and ran migrate_project_to_current. Both prompts came out byte-identical to the new templates, .autoforge/.gitignore contained validation/, and the directory was created. A second run was a no-op.
• Scaffold: a fresh scaffold creates .autoforge/validation/. In a git repo, a file placed there does not appear in git status.
• Path handling: I checked that playwright-cli screenshot --filename=.autoforge/validation/x.png writes the file relative to the cwd, and creates the directory if it is missing.
• No UI changes, so there was nothing to check in the browser.

Assumptions

• The migration only matches the exact default template wording. Prompts that users have customized are left alone rather than rewritten heuristically.
• Snapshots (playwright-cli snapshot) still go to .playwright-cli/. They are element-ref lookups rather than validation evidence, and that directory is already gitignored.
• auto_improve_prompt is not copied into projects (it is loaded from the template), so it needs no migration.

🤖 Generated with Claude Code

[zwanski-start]

🔍 QA report: ✅ Passed

Tester: Barbara (cubefarm agent, in a fresh session) · Round: 1 · Author: Ada

Agents are now told to save screenshots under .autoforge/validation/, which is gitignored and documented. A new migration step (version 1 to 2) brings existing projects onto the new prompt wording. I tested that migration on version 0 and version 1 projects: the prompts came out byte-identical to the new templates, the gitignore and folder were added, a second run did nothing, and customized prompts were left alone. Running the real playwright-cli screenshot --filename command wrote the file into the gitignored folder, and ruff, mypy (no new errors) and the unit tests are clean.

	Check	Details
✅	Templates point screenshots at .autoforge/validation/	coding_prompt, testing_prompt and auto_improve_prompt now use --filename=.autoforge/validation/.png and tell the agent never to save screenshots elsewhere or commit them. Snapshots still go to .playwright-cli/, which is already gitignored.
✅	Validation folder is gitignored	_GITIGNORE_CONTENT now contains validation/. In a git-initialized freshly scaffolded project, a file placed in .autoforge/validation/ did not appear in git status.
✅	Fresh scaffold creates the folder	scaffold_project_prompts creates .autoforge/validation/ and sets .migration_version to 2.
✅	Migration from version 1 to 2	Project scaffolded with master's code and set to version 1. After migrate_project_to_current, coding_prompt.md and testing_prompt.md were byte-identical to the new templates, .gitignore contained validation/, the folder existed and the version was 2. A second run returned [].
✅	Migration from version 0 (prompts in old root prompts/ folder)	Ran through version 1 and then 2. Both prompts were byte-identical to the new templates.
✅	Customized prompts left alone	A custom coding_prompt.md was unchanged; only the default testing_prompt.md was rewritten.
✅	Real playwright-cli --filename behaviour	playwright-cli screenshot --filename=.autoforge/validation/feature-1-a.png created the missing folder and wrote the PNG relative to the working folder, and git did not list it. The agent runs inside the project folder (client.py:478).
✅	Windows line endings	Checked in code, not run on Windows: Path.read_text uses universal newlines, so prompts with Windows line endings still match the \n replacement strings.
✅	Backend boots	uvicorn on 127.0.0.1:5443: /api/health, /api/projects and /api/settings return 200; an unknown project returns 404. Server stopped afterwards.
⏭️	UI in a real browser	The PR changes no UI code, so I did not test in a browser.
⏭️	Unit tests for the new migration step	There are none. Manual testing covered it; not blocking.

🧪 Commands run

Command	Result
ruff check .	All checks passed
mypy . (PR compared with origin/master)	No errors in changed files; the same 24 errors as master plus 1 from the local venv/ folder in this worktree (setup artifact)
python test_security.py	ALL TESTS PASSED
python -m pytest test_client.py test_dependency_resolver.py test_rate_limit_utils.py	55 passed
python -m pytest test_security_integration.py test_devserver_security.py test_ws_security.py	21 failed, 76 passed: identical on origin/master, so already failing on master, not caused by this PR
python scratchpad/mig.py (migration and scaffold probe script)	Version 0, version 1 and customized-prompt cases behave as expected; second run does nothing
playwright-cli screenshot --filename=.autoforge/validation/feature-1-a.png	PNG written into the folder, which was created; git did not list it
uvicorn server.main:app --port 5443 + curl	200 for health, projects and settings; 404 for an unknown project

No browser screenshots were taken in this round.

_{Posted by cubefarm · merges automatically once GitHub's checks pass}