{"actions":{"bootstrapAndRun":{"effect":"installs rote if missing, inspects, prepares, and asks before running","href":"https://play.modiqo.ai/install?play=lgoyal6/shipped-page-audit@0.1.0","method":"GET","rel":"https://rote.dev/rels/bootstrap-and-run","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"inspect":{"command":"rote play inspect https://play.modiqo.ai/lgoyal6/shipped-page-audit@0.1.0","effect":"read-only"},"installCliOnly":{"effect":"installs the rote CLI, nothing else","href":"https://play.modiqo.ai/install","method":"GET","rel":"https://rote.dev/rels/install-cli","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"run":{"command":"rote play run https://play.modiqo.ai/lgoyal6/shipped-page-audit@0.1.0","effect":"executes the play locally after consent","headless":{"approvalAssertion":"--yes","approvalRequiredBeforeInvocation":true,"commandTemplate":"rote play run https://play.modiqo.ai/lgoyal6/shipped-page-audit@0.1.0 <name=value...> --yes","stdinPolicy":"never pipe input to automate the interactive Ready selector"},"requiresConsent":true}},"description":"Answers one question about a page you have already deployed: what does it hand a visitor that it should not? Source code tells you what was written; only a real page load tells you what shipped, and the two differ for a dozen ordinary reasons - a build flag, a CDN, an edge rule, a header set on a proxy nobody reads. A real browser loads the URL, and the audit then reads what a visitor actually receives. Six things: the security response headers that are genuinely present, reporting what is missing AND what is present but permissive, because a Content-Security-Policy carrying unsafe-inline, unsafe-eval or a wildcard source reads as protection in a review and is not; the cookies set on the response, flagged for a missing Secure, a session-shaped name with no HttpOnly, SameSite=None, or a Domain widened to the whole registrable domain, with the cookie value never read and never printed; source maps reachable from production, which is the finding that matters most, because a sourceMappingURL whose target answers","distribution":{"digest":"sha256:30abfe019e5edff4a159129036b99a9e98d53e4671e4a5207cca88968a878102","mediaType":"application/vnd.modiqo.rote-flow","size":22068,"verifiedBy":"rote verifies the downloaded archive against this digest before it runs"},"effects":{"credentialsProvidedBy":"runner","credentialsRemainLocal":true,"declaredWrites":[],"publisherReceivesCredentials":false},"id":"https://play.modiqo.ai/lgoyal6/shipped-page-audit@0.1.0","inputPolicy":{"optionalWithDefault":"show_default_and_accept_override","optionalWithoutDefault":"omit_unless_supplied","required":"ask","secrets":"collect_locally_outside_conversation"},"links":{"docs":"https://rote.dev","page":"https://play.modiqo.ai/lgoyal6/shipped-page-audit@0.1.0","protocol":"https://play.modiqo.ai/.well-known/rote","self":"https://play.modiqo.ai/lgoyal6/shipped-page-audit@0.1.0.json"},"name":"shipped-page-audit","owner":{"kind":"user","slug":"lgoyal6"},"parameters":[{"description":"The deployed page to load and audit. http or https only, and never one carrying credentials in its userinfo.","example":"https://example.com","input":{"allowCustom":true,"choices":[],"label":"Url"},"name":"url","required":true,"type":"string"},{"default":"25","description":"How many of the page's external scripts to retrieve and examine for a source map and for credential shapes. 1 to 200.","example":"10","input":{"allowCustom":true,"choices":[],"label":"Max scripts"},"name":"max_scripts","required":false,"type":"string"},{"default":"20","description":"Per-request timeout in seconds for each read-only GET the audit makes.","example":"20","input":{"allowCustom":true,"choices":[],"label":"Http timeout s"},"name":"http_timeout_s","required":false,"type":"string"}],"preparation":[{"action":{"command":"rote play inspect https://play.modiqo.ai/lgoyal6/shipped-page-audit@0.1.0 --json","effect":"read-only"},"step":1,"type":"inspect_local_readiness"},{"references":["/parameters"],"step":2,"type":"collect_parameters"},{"references":["/parameters","/requirements","/effects"],"step":3,"type":"review"},{"consentBoundary":"the user approves the exact play and parameter values","references":["/parameters","/requirements","/effects"],"step":4,"type":"obtain_run_consent"},{"action":{"command":"rote play run https://play.modiqo.ai/lgoyal6/shipped-page-audit@0.1.0","headlessCommandTemplate":"rote play run https://play.modiqo.ai/lgoyal6/shipped-page-audit@0.1.0 <name=value...> --yes"},"preservesAcquisitionBoundaries":["adapter_selection","oauth_dcr","google_discovery","static_token_setup","runtime_security_checks"],"requiresConsent":true,"step":5,"type":"run"}],"producedBy":{"roteVersion":"0.79.0"},"publishedAt":"2026-09-04T02:30:19.327227+00:00","reference":"lgoyal6/shipped-page-audit@0.1.0","requirements":{"adapters":[],"browser":{"dependencies":[],"runtime":true,"signIn":false},"localTools":["deno","node","@playwright/mcp","bash","python3","env"],"roteCli":{"minimumVersion":"0.62.0"},"sessions":false},"resolution":"pinned","schema":"rote.play.v1","stats":{"downloads":2,"installs":0},"steps":{"count":7,"names":["analyze","open_page","page_errors","page_forms","page_links","preflight","settle"]},"title":"shipped-page-audit","type":"play","version":"0.1.0","visibility":"public"}