Flags Reference

jevitate explore takes one flag set for all six modes (--strategy goal | exploratory | adversarial | coverage | usability, plus --feature <name>). Some flags only mean something in some modes: a few are refused elsewhere (exit 64), the rest are accepted and do nothing. This page names them. Every flag of every command, with its description, is in the generated docs/cli.md.

Target & scope

* A goal with no --success is a find-out goal: it ends with an answer grounded in text the run saw, and is read-only unless you pass --allow-writes. A goal with no --success that asks for a change still never performs a destructive write without --allow-writes or --allow-destructive. Coverage and exploratory runs stay on the start URL's route by default.

Start inside a Journey

--from-journey <id> --at-step <n|anchor|all|anchors> replays a promoted Journey's prefix and starts the mission on the live page, instead of --url. With it, --feature, --url, --repeat, --persona, --personas and --actor are refused (exit 64). --at-step all|anchors runs each stop in a fresh session restored by --fixtures (any strategy here) and splits --max-actions evenly. A single --at-step <anchor|n> also takes --fixtures, --before and --after (hooks need --allow-shell-hooks) with any strategy; it runs as a one-stop campaign. See Journeys.

Success checks

On a usability run, --success checks decide whether the job was done, exactly as on a goal run. Every other mode refuses them rather than silently ignoring them.

Authenticated apps & secrets

--secret only redacts a value; it is never typed. --secret-field and --totp bind a login or MFA field to an environment variable that code types (or, with a cmd: source and --allow-secret-cmd, to the output of a command run when the field is typed; operator-only, never an MCP argument); under any other strategy they are refused (exit 64). --fixture is a local file for an upload control; --fixtures (and --before/--after hooks, with --allow-shell-hooks) seed and reset app state around a goal run and every replay. --fixture-identity <name>=<storageState> binds a named identity a fixture step authenticates as (mint an invite as the owner, run the mission cold). --type-fixture types a file's exact text into a matching field, line breaks kept.

Conversational pages

Bounds

A page that settles before any control renders gets up to 3 s of grace (never past the render ceiling) before it is judged blank, so lazy and code-split routes are not blocked; a very short --stall-timeout can fire on such a step. --max-actions caps executed mutations and navigations only. A wait or scroll decision never increments it; only --max-decisions and the built-in no-progress detector bound a run that keeps deciding to wait.

Adversarial thresholds (adversarial only, not coverage)

Despite the name, --min-control-coverage and --no-require-form-submit only decide whether an adversarial run that found nothing counts as clean. --strategy coverage does not read them.

Scope region and navigation guard (0.14.0)

--scope-region <descriptor> (repeatable, the --success descriptor syntax) measures and hunts only the controls inside a page region; declare a region instead of lowering --min-control-coverage. Other strategies, a bad descriptor, or one beside an anchor region are refused (E_EXPLORE_ARGS, exit 64). --block-off-allowlist-navigation answers an off-allowlist page navigation 204 before it loads and treats it as a departure (server redirects still pass; the HTTP cache is off); it applies to mission runs only.

Oracles

--check-overflow covers horizontal overflow and vertical clipping (text cut off by a fixed-height box or above the page top); both are on by default below a 1024px viewport, and --ignore-overflow <selector> excludes intentional cases. The log flags match backend-log lines to the exact request by trace or correlation id, and --log-scope keeps only matching lines when runs share one log. --log-triage needs at least one --log-source (else exit 64) and keeps only the log lines related to each defect in defects[].relatedLogs; Jev scores them with --real, code keeps the window's error and warning lines with --fake-ai. --action-deltas (opt-in) records what each action changed, with a code verdict per action (no-change, relevant-change, inconclusive): goal runs use it for no-progress and a persistence re-check after writes; other strategies keep it as evidence. It costs about 50–110 ms per action on a small page.

Usability review

--probe-guards opts in to clicking each destructive control once, fail-safe (every write and destructive-looking request is aborted), to check it asks first; without it those claims are unverifiable. --product <file> (default .jevitate/product.json) is the product facts the review checks prices, trials and next steps against. See Usability Review.

Watch, record and capture

Headless by default. --headed without a display is refused (exit 64); use --record-video. --no-overlay only matters with --headed. See Demos & Environments.

Issue filing

Every run writes redacted issue drafts; only goal and adversarial runs file them, and with --evidence-video only after their media is linked.

Emulation

--viewport and --device are mutually exclusive. --geolocation <lat>,<lng>[,<accuracy m>] places the browser at a fixed position, with the permission granted to the allowed origins only. The emulation is recorded on the Recording, so verify-fix and regressions replay at the same size.

Gateways & output

--real and --fake-ai together are refused (exit 64). Adversarial and feature missions plan in code: --feature needs no gateway, and on adversarial --fake-ai only replaces advisory calls (nothing it reports depends on them). Without --json every strategy prints a human summary; with it, the one-line {v, ok, data} envelope.

Every strategy

These apply to every mode (see docs/cli.md for each one's exact semantics):

--api-prefix · --settle-ignore · --long-poll-ms · --ignore-no-progress   (timing & settle)
--deny · --paid · --allow-destructive · --read-rpc · --dialogs dismiss|accept  (click, write and dialog safety)
--repeat / --min-agreement · --persona name=storageState · --personas     (repeat-and-vote, persona matrix)
--browser-executable · --browser-channel · --browser-arg                  (which Chromium)
--extension <dir>                                                         (load an unpacked browser extension)
--max-browsers · --max-browser-memory · --ignore-host-load                (resource governance)

See the dev-server recipe for the timing and settle flags.

Other commands: environments, demo mode and capture

Never headed: mission run, load run and source run. See Demos & Environments.

What --app-class does and does not control

--app-class is read in one place: the usability analyzer's calibration. It tells the rubric what kind of app this is (consumer, admin, internal, …) so heuristics are judged sensibly for that context. It is not a persona: the live usability review calibrates against a default "first-time user", and only the offline jevitate ux takes a usability --persona. explore --persona name=storageState is something else again: it runs the same mission once per signed-in session and diffs them for RBAC candidates. Under every strategy other than usability, --app-class is accepted and ignored. See Usability Review.