@ait-co/devtools 0.1.117 → 0.1.119

package/dist/cli-RhzASQef.js

@@ -0,0 +1,1057 @@
+#!/usr/bin/env node
+import { parseArgs } from "node:util";
+import * as fs from "node:fs/promises";
+import { glob, mkdir, writeFile } from "node:fs/promises";
+import * as path$1 from "node:path";
+import path, { isAbsolute, resolve } from "node:path";
+import { accessSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+//#region src/test-runner/discover.ts
+/**
+* Test-file discovery shared by the `devtools-test` CLI and the `run_tests`
+* MCP tool, so both expand glob patterns with identical semantics.
+*
+* Uses Node's built-in `fs/promises` `glob` (Node 22+) — no extra dependency,
+* which keeps the MCP daemon install graph lean (a plain glob lib would land in
+* the `npx … devtools-mcp` path for no benefit).
+*
+* Pure Node IO only (`node:fs/promises` + `node:path`) — react-free, so it is
+* safe to import from the MCP daemon graph.
+*/
+/**
+* Expands `patterns` (globs or plain paths) into a sorted, de-duplicated list of
+* ABSOLUTE test file paths, resolved relative to `cwd`.
+*
+* A plain (non-glob) path passes through when it matches a real file; a glob
+* expands against `cwd`. Absolute matches are kept as-is; relative matches are
+* resolved against `cwd`. `bundleTestFile` requires an absolute path, so the
+* absolute output feeds it directly.
+*
+* @param patterns Glob patterns or file paths (e.g. `['src/**\/*.ait.test.ts']`).
+* @param cwd      Base directory for relative patterns/results.
+* @returns Sorted, de-duplicated absolute file paths. Empty when nothing matches.
+*/
+async function discoverTestFiles(patterns, cwd) {
+	const out = /* @__PURE__ */ new Set();
+	for await (const match of glob(patterns, { cwd })) out.add(isAbsolute(match) ? match : resolve(cwd, match));
+	return [...out].sort();
+}
+//#endregion
+//#region src/test-runner/relay-factory.ts
+/**
+* Builds a {@link RelayConnectionFactory} that opens a standalone env3 relay
+* connection.
+*
+* `open()` performs the full attach lifecycle and BLOCKS for tens of seconds (up
+* to `timeoutMs`) while a human scans the rendered QR with their phone — there
+* is no way around the manual scan for env3. It resolves with the live
+* `CdpConnection` once a matching page attaches; `close()` tears the relay
+* family down.
+*
+* The factory holds the booted relay family in a closure so `close()` can stop
+* it. A second `open()` on the same factory boots a fresh family (the previous
+* one should have been `close()`d first).
+*/
+function createRelayConnectionFactory(opts) {
+	const projectRoot = opts.projectRoot ?? process.cwd();
+	const timeoutMs = opts.timeoutMs ?? 6e5;
+	const headless = opts.headless === true;
+	let family;
+	return {
+		async open() {
+			const { prepareAttach, renderAndMaybeWait } = await import("./attach-orchestrator-qFEMBUwb.js");
+			const { injectDebugIndicator, injectGlobals } = await import("./cell-BPWZUm_X.js");
+			const { loadRelaySecretReadOnly } = await import("./relay-secret-store-CFc9n0OA.js");
+			const { bootRelayFamily, buildRelayVerifyAuth } = await import("./debug-server-C_5ag9jj.js");
+			await loadRelaySecretReadOnly({ projectRoot });
+			const booted = await bootRelayFamily({ verifyAuth: buildRelayVerifyAuth() });
+			family = booted;
+			const attachDeps = {
+				getTunnelStatus: booted.getTunnelStatus ?? (() => ({
+					up: false,
+					wssUrl: null
+				})),
+				getTotpSecret: () => process.env.AIT_DEBUG_TOTP_SECRET,
+				qrHttpServer: void 0,
+				onAttachUrlBuilt: void 0,
+				canOpenBrowser: () => !headless
+			};
+			const prep = await prepareAttach(attachDeps, "relay-dev", { scheme_url: opts.schemeUrl }, booted.connection);
+			if (!prep.ok) {
+				booted.stop();
+				family = void 0;
+				throw new Error("createRelayConnectionFactory: attach preparation failed — check the scheme_url and that the relay tunnel is up");
+			}
+			const waitResult = await renderAndMaybeWait(attachDeps, prep, true, timeoutMs, booted.connection);
+			if (waitResult.isError) {
+				booted.stop();
+				family = void 0;
+				const timeoutSec = Math.round(timeoutMs / 1e3);
+				throw new Error(`createRelayConnectionFactory: attach timed out after ${timeoutSec}s — phone did not scan the QR within the timeout`);
+			}
+			const qrChunks = waitResult.content.filter((c) => c.type === "text").map((c) => c.text);
+			opts.onQrContent(qrChunks);
+			await injectDebugIndicator(booted.connection);
+			if (opts.cell !== void 0) await injectGlobals(booted.connection, { __AIT_CELL__: opts.cell });
+			await booted.connection.enableDomains();
+			return booted.connection;
+		},
+		async close(_connection) {
+			family?.stop();
+			family = void 0;
+		}
+	};
+}
+//#endregion
+//#region src/test-runner/bundle.ts
+/**
+* esbuild-based bundler for user test files.
+*
+* Bundles a single test file into a self-contained IIFE string that can be
+* injected into a WebView via `Runtime.evaluate`. The bundle includes the
+* test runtime (`runtime.ts`), which provides `describe/it/test/expect` and
+* the `runTestModule(factory)` entry point.
+*
+* ## How the wiring works
+*
+* The bundle exposes two exports on `globalThis.__testBundle`:
+*   - `runTestModule` — the runtime's entry function.
+*   - `__userFactory`  — an async function whose body is the user's top-level
+*     test registration code (describe/it/test calls).
+*
+* The Node-side RPC (`rpc.ts`) calls:
+*   `globalThis.__testBundle.runTestModule(globalThis.__testBundle.__userFactory)`
+*
+* `runTestModule` then installs `describe/it/test/expect` as globals, invokes
+* the factory (which registers all tests), runs them, and returns a `RunReport`.
+*
+* ## Why a factory wrapper is needed
+*
+* Naively adding the runtime to `entryPoints` and bundling the user file would
+* fail for two reasons:
+*   1. `describe/it/test/expect` from the runtime are module-local in the IIFE
+*      scope. The user's top-level `describe(...)` calls expect them as globals —
+*      they are not globals until `runTestModule` installs them.
+*   2. Even with globals pre-installed, the user file runs at IIFE-evaluation
+*      time, before the RPC layer calls `runTestModule` to reset state and start
+*      the test clock.
+*
+* The factory approach solves both: the user's registration code is deferred
+* into a function that `runTestModule` calls AFTER installing the globals.
+*
+* ## Factory extraction algorithm
+*
+* The `userFactoryPlugin` reads the user file and splits lines into:
+*   - **top-level**: `import …` and re-export lines — kept at module scope
+*     (the only valid position for static `import` in ESM).
+*   - **body**: all other statements — moved into the body of the exported
+*     `__userFactory` async function.
+*
+* esbuild processes the re-generated module, following each static import
+* through the normal dependency graph (including the SDK-redirect plugin).
+*
+* ## SDK redirect
+*
+* Imports of `@apps-in-toss/web-framework` (and sub-paths) are intercepted via
+* the `sdkRedirectPlugin` and replaced with a virtual `window.__sdk` proxy that
+* `src/in-app/auto.ts` installs at runtime. This works for both 2.x and 3.x SDK.
+*
+* SECRET-HANDLING: the returned bundle code is caller-managed; never log it.
+*/
+/** The SDK package name that mini-app test code imports from. */
+const SDK_PACKAGE = "@apps-in-toss/web-framework";
+/**
+* Names the runtime installs as globals before invoking the user factory.
+* The `vitest` virtual module re-exports each as a lazy getter that reads from
+* `globalThis` at access time. Keep in sync with the globals installed in
+* `runtime.ts#runTestModule`.
+*/
+const VITEST_GLOBAL_NAMES = [
+	"describe",
+	"it",
+	"test",
+	"expect",
+	"beforeAll",
+	"afterAll",
+	"beforeEach",
+	"afterEach",
+	"vi"
+];
+/**
+* Matches the bare SDK package and any sub-path import
+* (`@apps-in-toss/web-framework`, `@apps-in-toss/web-framework/foo`).
+* Built from {@link SDK_PACKAGE} so the package name has a single source.
+*/
+const SDK_IMPORT_FILTER = new RegExp(`^${SDK_PACKAGE.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}`);
+/**
+* esbuild plugin that intercepts SDK imports and redirects them to the
+* `window.__sdk` proxy that `src/in-app/auto.ts` installs at runtime.
+*
+* Strategy: for every import of `@apps-in-toss/web-framework` (or sub-paths),
+* esbuild resolves it to a virtual module that re-exports all named exports
+* via `window.__sdk[name]`. This avoids bundling the real SDK (which may not
+* be available in the test environment) while still making named imports work.
+*
+* If `window.__sdk` is absent (non-dog-food build), every access throws a
+* descriptive error rather than returning `undefined` silently.
+*/
+function sdkRedirectPlugin() {
+	return {
+		name: "sdk-redirect",
+		setup(build) {
+			build.onResolve({ filter: SDK_IMPORT_FILTER }, (args) => ({
+				path: args.path,
+				namespace: "sdk-redirect"
+			}));
+			build.onLoad({
+				filter: /.*/,
+				namespace: "sdk-redirect"
+			}, () => ({
+				contents: `
+var __proxy = (typeof window !== 'undefined' && window.__sdk)
+  ? window.__sdk
+  : new Proxy({}, {
+      get: function(_t, p) {
+        throw new Error('window.__sdk is not installed — run in a dog-food build. Missing: ' + String(p));
+      }
+    });
+module.exports = __proxy;
+`,
+				loader: "js"
+			}));
+		}
+	};
+}
+/**
+* esbuild plugin that intercepts `import … from 'vitest'` and replaces it with
+* a virtual module that delegates every named import to `globalThis` at ACCESS
+* time (not at bundle-evaluation time).
+*
+* The runtime installs `describe/it/test/expect/beforeAll/afterAll/beforeEach/
+* afterEach/vi` as globals inside `runTestModule`, which runs AFTER the bundle
+* IIFE is evaluated. A value-copy redirect (`export var describe =
+* globalThis.describe`) would therefore capture `undefined` at evaluation time
+* and the user's `describe(...)` calls would be no-ops — registering zero tests.
+*
+* The fix defers the lookup to call time using per-name **getter** exports.
+* We emit a CommonJS module that:
+*   1. sets `__esModule = true` so esbuild's `__toESM` interop maps each named
+*      import directly to a property access on the module (NOT wrapped under a
+*      `default` shim — which is what happens for a bare Proxy whose own-keys
+*      are empty, leaving every named import `undefined`);
+*   2. defines each global name as a getter that reads `globalThis[name]` on
+*      every access. So `import { describe } from 'vitest'` compiles to
+*      `import_vitest.describe`, whose getter returns the real `describe` only
+*      when the factory calls it — after `runTestModule` installs the globals.
+*
+* A plain `module.exports = new Proxy(...)` does NOT work here: esbuild routes
+* the virtual module through `__toESM`, which enumerates own-keys (none on an
+* empty Proxy target) and therefore exposes zero named exports. Explicit getter
+* properties give `__toESM` real keys to map while keeping access lazy.
+*/
+function vitestRedirectPlugin() {
+	return {
+		name: "vitest-redirect",
+		setup(build) {
+			build.onResolve({ filter: /^vitest$/ }, () => ({
+				path: "vitest",
+				namespace: "vitest-redirect"
+			}));
+			build.onLoad({
+				filter: /^vitest$/,
+				namespace: "vitest-redirect"
+			}, () => {
+				return {
+					contents: `Object.defineProperty(exports, '__esModule', { value: true });\n${VITEST_GLOBAL_NAMES.map((name) => `Object.defineProperty(exports, ${JSON.stringify(name)}, { enumerable: true, get: function() { return globalThis[${JSON.stringify(name)}]; } });`).join("\n")}\n`,
+					loader: "js"
+				};
+			});
+		}
+	};
+}
+/**
+* esbuild plugin that transforms the user test file into a module that exports
+* an async `__userFactory` function. The factory defers the user's top-level
+* test registration code (describe/it/test calls) so it only runs when
+* `runTestModule(__userFactory)` explicitly invokes it — AFTER the runtime has
+* installed describe/it/test/expect as globals.
+*
+* Algorithm:
+*   - Import declarations and re-export statements are kept at module top-level
+*     (the only valid ESM position for static `import`). A statement that spans
+*     multiple lines — e.g. a named import with one member per line:
+*       import {
+*         appLogin,
+*         getAnonymousKey,
+*       } from '@apps-in-toss/web-framework';
+*     is tracked as a single block: every line from the opening `import {` /
+*     `export {` through the closing `from '…'` (or side-effect `'…'`) line is
+*     kept together at top-level. This prevents the member lines and the
+*     closing `} from '…'` line from leaking into the factory body, which would
+*     leave an unterminated `import {` at module scope (the #678 env3 failure:
+*     esbuild threw `Expected "as" but found "{"` on multi-line SDK imports).
+*   - All other lines (describe/it/test calls, local declarations, etc.) are
+*     moved into the body of the exported async factory function.
+*
+* This preserves SDK import resolution (the sdk-redirect plugin processes
+* top-level imports normally) while deferring test registration to the factory.
+*/
+function userFactoryPlugin(absPath) {
+	const NAMESPACE = "user-test-factory";
+	return {
+		name: "user-test-factory",
+		setup(build) {
+			build.onResolve({ filter: /^user-test-factory$/ }, () => ({
+				path: absPath,
+				namespace: NAMESPACE
+			}));
+			build.onLoad({
+				filter: /.*/,
+				namespace: NAMESPACE
+			}, async (args) => {
+				const lines = (await fs.readFile(args.path, "utf8")).split("\n");
+				const topLevelLines = [];
+				const bodyLines = [];
+				const EXPORT_DECLARATION_RE = /^(export\s+)(default\s+|async\s+function\s+|function\s+|class\s+|const\s+|let\s+|var\s+)/;
+				const isImportStart = (trimmed) => trimmed.startsWith("import ") || trimmed.startsWith("import{") || trimmed.startsWith("import'") || trimmed.startsWith("import\"");
+				const endsStatement = (trimmed) => /['"]\s*;?\s*$/.test(trimmed.replace(/\/\/.*$/, "").trimEnd());
+				let inImportBlock = false;
+				for (const line of lines) {
+					const trimmed = line.trimStart();
+					const indent = line.slice(0, line.length - trimmed.length);
+					if (inImportBlock) {
+						topLevelLines.push(line);
+						if (endsStatement(trimmed)) inImportBlock = false;
+						continue;
+					}
+					if (isImportStart(trimmed)) {
+						topLevelLines.push(line);
+						if (!endsStatement(trimmed)) inImportBlock = true;
+					} else if (trimmed.startsWith("export ")) if (trimmed.match(EXPORT_DECLARATION_RE)) bodyLines.push(indent + trimmed.slice(7));
+					else {
+						topLevelLines.push(line);
+						if (/\bfrom\b/.test(trimmed) ? !endsStatement(trimmed) : trimmed.endsWith("{")) inImportBlock = true;
+					}
+					else bodyLines.push(line);
+				}
+				return {
+					contents: [
+						...topLevelLines,
+						"",
+						"// biome-ignore lint: generated factory wrapper",
+						"export default async function __userFactory(): Promise<void> {",
+						...bodyLines.map((l) => `  ${l}`),
+						"}"
+					].join("\n"),
+					loader: "ts",
+					resolveDir: path$1.dirname(absPath)
+				};
+			});
+		}
+	};
+}
+/**
+* Returns the absolute filesystem path to the test-runner runtime module
+* (dist/test-runner/runtime.js — a fully self-contained page-side bundle).
+*
+* Rolldown code-splitting duplicates this bundling logic into shared chunks
+* emitted at ARBITRARY dist depths: the `devtools-test` CLI pulls it from
+* dist/test-runner/bundle.js (dir = dist/test-runner/), while the `devtools-mcp`
+* daemon (dist/mcp/cli.js) pulls it through a ROOT chunk
+* (dist/debug-server-<hash>.js, dir = dist/). A fixed `..`-hop candidate list
+* is therefore wrong from at least one chunk — the live #697 regression.
+*
+* This resolves WITHOUT assuming chunk depth: from `import.meta.url`'s dir it
+* probes the co-located `runtime.js` and the nested `test-runner/runtime.js`,
+* then ascends one directory at a time (bounded) repeating both probes. The
+* nested probe catches dist/test-runner/runtime.js from the dist/ root level no
+* matter which depth the chunk was hoisted to (root, dist/mcp/, or a future
+* relocation). The build always emits dist/test-runner/runtime.js (tsdown entry
+* `'test-runner/runtime'`; guarded by scripts/check-test-runner-dist.sh).
+*
+* An ABSOLUTE path is returned deliberately: esbuild loads it as a literal file
+* read, bypassing Node module resolution entirely, so this works identically in
+* the npx-daemon context (its own dist tree) and the consumer-CLI context
+* (the mini-app's installed @ait-co/devtools dist) — neither needs the package
+* to be node-resolvable from the caller.
+*/
+function getRuntimePath() {
+	const startDir = path$1.dirname(fileURLToPath(import.meta.url));
+	const RELATIVE_PROBES = [
+		["runtime.js"],
+		["test-runner", "runtime.js"],
+		["runtime.ts"],
+		["test-runner", "runtime.ts"]
+	];
+	let dir = startDir;
+	for (let i = 0; i < 12; i++) {
+		for (const segs of RELATIVE_PROBES) {
+			const candidate = path$1.join(dir, ...segs);
+			try {
+				accessSync(candidate);
+				return candidate;
+			} catch {}
+		}
+		const parent = path$1.dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return path$1.join(startDir, "runtime.js");
+}
+/**
+* Bundles `absPath` into a single IIFE string suitable for `Runtime.evaluate`.
+*
+* The IIFE installs `window.__testBundle` (or the custom `globalName`) with:
+*   - `runTestModule` — the runtime entry (from `runtime.ts`).
+*   - `__userFactory` — an async function wrapping the user's test registration
+*     code so it runs AFTER `runTestModule` installs the globals.
+*
+* Callers (rpc.ts) invoke:
+*   `globalThis.__testBundle.runTestModule(globalThis.__testBundle.__userFactory)`
+*
+* @param absPath - Absolute path to the user test file.
+* @param opts    - Optional bundling overrides.
+*/
+async function bundleTestFile(absPath, opts) {
+	const globalName = opts?.globalName ?? "__testBundle";
+	const extraExternals = opts?.extraExternals ?? [];
+	const esbuild = await import("esbuild");
+	const runtimePath = getRuntimePath();
+	const wrapperContent = [
+		`import { runTestModule } from ${JSON.stringify(runtimePath)};`,
+		`import __userFactory from "user-test-factory";`,
+		`export { runTestModule, __userFactory };`
+	].join("\n");
+	const result = await esbuild.build({
+		stdin: {
+			contents: wrapperContent,
+			loader: "ts",
+			resolveDir: path$1.dirname(absPath)
+		},
+		bundle: true,
+		format: "iife",
+		globalName,
+		platform: "browser",
+		target: "es2022",
+		write: false,
+		plugins: [
+			userFactoryPlugin(absPath),
+			vitestRedirectPlugin(),
+			sdkRedirectPlugin()
+		],
+		external: extraExternals,
+		treeShaking: true,
+		footer: { js: `globalThis[${JSON.stringify(globalName)}] = ${globalName};` }
+	});
+	const warnings = result.warnings.map((w) => `${path$1.relative(process.cwd(), w.location?.file ?? "")}:${w.location?.line ?? "?"}: ${w.text}`);
+	const outputFile = result.outputFiles?.[0];
+	if (!outputFile) throw new Error("bundleTestFile: esbuild produced no output — check entryPoints");
+	return {
+		code: outputFile.text,
+		warnings
+	};
+}
+//#endregion
+//#region src/test-runner/capture.ts
+/** The exact console-line prefix sdk-example's `flushCapture` emits. */
+const CAPTURE_PREFIX = "__AIT_CAPTURE__ ";
+/**
+* Parses raw console line texts into {@link AitCaptureLine}s.
+*
+* Filtering rules (each independently drops a line — never throws):
+*   - the line text must `startsWith(CAPTURE_PREFIX)` exactly (allowlist);
+*   - there must be a non-empty category token (up to the next space);
+*   - the remaining payload must be valid JSON (`JSON.parse` succeeds).
+*
+* Lines that fail any rule (wss/scheme noise, truncated, broken JSON) are
+* silently discarded — capture harvesting is best-effort and must never fail a
+* run or leak a malformed/secret-bearing line.
+*
+* @param raw - Console line objects (only `.text` is read).
+* @returns The captured lines, in input order.
+*/
+function parseCaptureLines(raw) {
+	const out = [];
+	for (const { text } of raw) {
+		if (!text.startsWith(CAPTURE_PREFIX)) continue;
+		const body = text.slice(16);
+		const spaceIdx = body.indexOf(" ");
+		if (spaceIdx === -1) continue;
+		const category = body.slice(0, spaceIdx);
+		const json = body.slice(spaceIdx + 1);
+		if (category === "" || json === "") continue;
+		try {
+			JSON.parse(json);
+		} catch {
+			continue;
+		}
+		out.push({
+			category,
+			json
+		});
+	}
+	return out;
+}
+//#endregion
+//#region src/test-runner/rpc.ts
+/** Maximum milliseconds to wait for a single evaluate round-trip. */
+const DEFAULT_TIMEOUT_MS = 3e4;
+/**
+* Wraps bundle code in a self-executing IIFE that:
+*   1. Evaluates the bundle (registering describe/it/test).
+*   2. Calls `__testBundle.runTestModule(...)` — the entry the runtime exports.
+*   3. Returns a JSON-serialised `RunReport` string.
+*
+* The double-serialisation (RunReport → JSON string → returnByValue string)
+* is intentional: CDP `returnByValue` reliably transports strings; deeply
+* nested objects can lose fidelity across the Chii relay.
+*
+* SECRET-HANDLING: `bundleCode` MUST NOT be logged by callers.
+*/
+function buildRunTestsExpression(bundleCode) {
+	return `(async () => {  try { ${bundleCode} } catch(e) {    return JSON.stringify({ok:false,error:'bundle-eval: ' + String(e && e.message || e)});  }  if (typeof globalThis.__testBundle !== 'object' || typeof globalThis.__testBundle.runTestModule !== 'function' || typeof globalThis.__testBundle.__userFactory !== 'function') {    return JSON.stringify({ok:false,error:'bundle-missing-export: __testBundle.runTestModule or __userFactory is not a function'});  }  try {    const report = await globalThis.__testBundle.runTestModule(globalThis.__testBundle.__userFactory);    return JSON.stringify({ok:true,value:report});  } catch(e) {    return JSON.stringify({ok:false,error:'test-run: ' + String(e && e.message || e)});  }})()`;
+}
+/**
+* Parses the raw CDP `returnByValue` result from a `buildRunTestsExpression`
+* evaluate call into a typed `RpcRunResult`.
+*
+* Throws only on parse failure — an `ok:false` envelope is a normal result.
+*
+* SECRET-HANDLING: `rawValue` is not included in error messages.
+*/
+function parseRunTestsResult(rawValue) {
+	if (typeof rawValue !== "string") throw new Error(`rpc.parseRunTestsResult: unexpected return type "${typeof rawValue}" — expected JSON string`);
+	let parsed;
+	try {
+		parsed = JSON.parse(rawValue);
+	} catch {
+		throw new Error("rpc.parseRunTestsResult: bridge returned non-JSON string");
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error("rpc.parseRunTestsResult: parsed result is not an object");
+	const obj = parsed;
+	if (obj.ok === true) return {
+		ok: true,
+		report: obj.value
+	};
+	if (obj.ok === false) return {
+		ok: false,
+		error: typeof obj.error === "string" ? obj.error : String(obj.error)
+	};
+	throw new Error("rpc.parseRunTestsResult: result missing \"ok\" field");
+}
+/**
+* Injects `bundleCode` into the attached page and awaits test execution.
+*
+* Uses `Runtime.evaluate` with `awaitPromise: true` to wait for the
+* async IIFE to settle.  The 30-second CDP command timeout covers even
+* long-running test suites; split into smaller files if you hit it.
+*
+* @param connection   - Active CDP connection (relay or local).
+* @param bundleCode   - IIFE bundle string from `bundleTestFile`.
+* @param timeoutMs    - Override the default 30 s timeout.
+*
+* SECRET-HANDLING: `bundleCode` and the raw CDP result value are never logged.
+*/
+async function injectAndRunBundle(connection, bundleCode, timeoutMs = DEFAULT_TIMEOUT_MS) {
+	const expression = buildRunTestsExpression(bundleCode);
+	const timeoutPromise = new Promise((_, reject) => setTimeout(() => reject(/* @__PURE__ */ new Error(`rpc: evaluate timed out after ${timeoutMs}ms`)), timeoutMs));
+	const evalPromise = connection.send("Runtime.evaluate", {
+		expression,
+		returnByValue: true,
+		awaitPromise: true
+	});
+	const cdpResult = await Promise.race([evalPromise, timeoutPromise]);
+	if (cdpResult.exceptionDetails) {
+		const msg = cdpResult.exceptionDetails.exception?.description ?? cdpResult.exceptionDetails.text ?? "Runtime.evaluate threw an exception";
+		throw new Error(`rpc.injectAndRunBundle: ${msg}`);
+	}
+	return parseRunTestsResult(cdpResult.result.value);
+}
+//#endregion
+//#region src/test-runner/relay-worker.ts
+/**
+* Runs all `files` sequentially over the given CDP `connection`.
+*
+* For each file:
+*   1. Bundle with esbuild (includes SDK shim + runtime).
+*   2. Inject into the attached page via `Runtime.evaluate`.
+*   3. Await the `RunReport` JSON response.
+*   4. Accumulate results.
+*
+* Returns a `RelayRunReport` with per-file results and flattened totals.
+*
+* This function does NOT open or manage the relay connection — the caller
+* is responsible for attaching and closing it.
+*
+* TODO (#645): implement the Vitest `PoolRunnerInitializer` interface here
+* so that `runTestFilesOverRelay` can be used as a Vitest pool entry.
+*
+* @param connection - Active CDP connection (relay or local kind).
+* @param files      - Absolute paths to test files, run in order.
+* @param opts       - Optional per-run overrides.
+*/
+async function runTestFilesOverRelay(connection, files, opts) {
+	const wallStart = Date.now();
+	const startedAt = new Date(wallStart).toISOString();
+	const fileResults = [];
+	let domainsEnabled = false;
+	try {
+		await connection.enableDomains();
+		domainsEnabled = true;
+	} catch (e) {
+		process.stderr.write(`relay-worker: enableDomains() failed before run — console capture may be empty (${e instanceof Error ? e.message : String(e)})\n`);
+	}
+	const collectCaptures = opts?.collectCaptures === true;
+	const liveConsole = [];
+	let unsubscribeConsole;
+	if (collectCaptures && domainsEnabled) unsubscribeConsole = connection.on("Runtime.consoleAPICalled", (event) => {
+		liveConsole.push(event);
+	});
+	try {
+		for (const file of files) {
+			let fileEntry;
+			try {
+				const { code } = await bundleTestFile(file, opts?.bundleOptions);
+				const rpcResult = await injectAndRunBundle(connection, code, opts?.timeoutMs);
+				if (rpcResult.ok) fileEntry = {
+					file,
+					result: rpcResult.report
+				};
+				else fileEntry = {
+					file,
+					result: { error: rpcResult.error }
+				};
+			} catch (e) {
+				fileEntry = {
+					file,
+					result: { error: e instanceof Error ? e.message : String(e) }
+				};
+			}
+			fileResults.push(fileEntry);
+		}
+	} finally {
+		unsubscribeConsole?.();
+	}
+	const captures = collectCaptures ? parseCaptureLines(liveConsole.map((e) => ({ text: renderConsoleLineText(e) }))) : [];
+	const totals = fileResults.reduce((acc, { result }) => {
+		if ("error" in result) {
+			acc.failed += 1;
+			acc.total += 1;
+		} else {
+			acc.passed += result.passed;
+			acc.failed += result.failed;
+			acc.skipped += result.skipped;
+			acc.total += result.passed + result.failed + result.skipped;
+		}
+		return acc;
+	}, {
+		passed: 0,
+		failed: 0,
+		skipped: 0,
+		total: 0
+	});
+	return {
+		startedAt,
+		duration: Date.now() - wallStart,
+		files: fileResults,
+		totals,
+		captures
+	};
+}
+/**
+* Renders one `Runtime.consoleAPICalled` event to a single line of text, the
+* same way `tools.ts#normalizeConsoleMessage` does (args rendered + space-
+* joined). Inlined here (≈8 lines) so this module avoids importing `tools.ts`,
+* which would drag the heavy MCP/Node graph (server-lock, parent-watcher, …)
+* onto the test-runner entry.
+*
+* SECRET-HANDLING: this only stringifies console args; the caller's
+* allowlist-prefix parser then discards everything that is not a genuine
+* `__AIT_CAPTURE__` line.
+*/
+function renderConsoleLineText(event) {
+	return event.args.map((arg) => {
+		if (arg.value !== void 0) {
+			if (typeof arg.value === "string") return arg.value;
+			try {
+				return JSON.stringify(arg.value);
+			} catch {
+				return String(arg.value);
+			}
+		}
+		if (arg.description !== void 0) return arg.description;
+		if (arg.className !== void 0) return arg.className;
+		return arg.subtype ?? arg.type;
+	}).join(" ");
+}
+//#endregion
+//#region src/test-runner/report.ts
+/**
+* Runner-agnostic report serialisation for env3 test runs (devtools#696).
+*
+* Both env3 execution paths — the Vitest custom pool (`pool.ts`) and the
+* standalone `devtools-test` CLI (`cli.ts`) — call the same core
+* `runTestFilesOverRelay` and so produce the same {@link RelayRunReport}. This
+* module is the single, runner-neutral place that turns that in-memory report
+* into a stable on-disk artifact so a 2.x run and a 3.0 run can be diffed
+* cell-by-cell after the fact.
+*
+* The serialised schema is deliberately MINIMAL and secret-free:
+*
+*   - file paths are stored RELATIVE to `projectRoot` (no absolute `/Users/...`
+*     leakage — see {@link RunnerAgnosticReport.files});
+*   - the cell metadata (sdkLine/platform) is baked INTO the body, not only the
+*     filename, so a moved artifact never loses its provenance;
+*   - NO relay wss / scheme / TOTP / relayUrl fields exist in the schema at all
+*     (enforced by the type + this comment) — error strings are the matcher
+*     message only, inherited from rpc.ts which already strips expression/value.
+*
+* react-free — depends only on the type-level `RelayRunReport` and `node:fs` /
+* `node:path`. Safe to bundle without pulling the chii/cloudflared graph.
+*/
+/**
+* Converts an absolute (or already-relative) file path to a projectRoot-relative
+* one. `path.relative` returns `''` when the paths are equal — guard that to the
+* basename so the field is never empty.
+*
+* SECRET-HANDLING: this is the single choke point that strips absolute project
+* paths from the artifact.
+*/
+function relativise(projectRoot, file) {
+	const rel = path.relative(projectRoot, file);
+	if (rel === "" || rel.startsWith("..") || path.isAbsolute(rel)) return path.basename(file);
+	return rel;
+}
+/**
+* Serialises a {@link RelayRunReport} into the runner-agnostic, secret-free
+* on-disk shape. Pure — no IO; testable with a plain report + meta.
+*
+* @param report - The core relay run report.
+* @param meta   - Cell axes + projectRoot (projectRoot is consumed, not stored).
+*/
+function serializeRelayReport(report, meta) {
+	return {
+		cell: {
+			sdkLine: meta.sdkLine,
+			platform: meta.platform
+		},
+		startedAt: report.startedAt,
+		duration: report.duration,
+		totals: report.totals,
+		files: report.files.map((f) => {
+			const file = relativise(meta.projectRoot, f.file);
+			if ("error" in f.result) return {
+				file,
+				error: f.result.error
+			};
+			return {
+				file,
+				duration: f.result.duration,
+				passed: f.result.passed,
+				failed: f.result.failed,
+				skipped: f.result.skipped,
+				tests: f.result.tests
+			};
+		})
+	};
+}
+/**
+* Writes the serialised report to `<dir>/<sdkLine>.<platform>.json`, creating
+* `dir` if needed. Returns the absolute path written.
+*
+* The cell-suffixed filename keeps 2.x and 3.0 (and per-platform) runs as
+* distinct artifacts in the same directory; the same cell metadata is also baked
+* into the body so a renamed/moved file still carries its provenance.
+*
+* SECRET-HANDLING: the written body contains no relay/secret fields (the schema
+* has none). `dir`/`projectRoot` are local filesystem paths, never logged here.
+*
+* @param report - The core relay run report.
+* @param dir    - Output directory (created recursively if missing).
+* @param meta   - Cell axes + projectRoot.
+* @returns The absolute path of the written file.
+*/
+async function writeReportArtifact(report, dir, meta) {
+	const serialised = serializeRelayReport(report, meta);
+	await mkdir(dir, { recursive: true });
+	const outFile = path.join(dir, `${meta.sdkLine}.${meta.platform}.json`);
+	await writeFile(outFile, `${JSON.stringify(serialised, null, 2)}\n`, "utf8");
+	return outFile;
+}
+/**
+* Writes harvested `__AIT_CAPTURE__` lines to per-category files under `dir`,
+* named `<category>.<sdkLine>.<platform>.json` — the SAME convention
+* sdk-example's env1 `flushCapture` uses on the filesystem, so env1 and env3
+* capture artifacts line up for diffing.
+*
+* Each line's `json` payload is an opaque JSON array of capture records. Lines
+* sharing a category are concatenated into one array, in harvest order.
+*
+* SECRET-HANDLING: only allowlist-prefixed capture lines reach here (the parser
+* dropped wss/scheme noise); the `json` payload is written verbatim but is a
+* capture record array, not a relay/secret.
+*
+* @param captures - Parsed capture lines (from `RelayRunReport.captures`).
+* @param dir      - Output directory (created recursively if missing).
+* @param cell     - Cell axes for the filename suffix.
+* @returns The absolute paths written (one per category), in category order.
+*/
+async function writeCaptureArtifacts(captures, dir, cell) {
+	if (captures.length === 0) return [];
+	const byCategory = /* @__PURE__ */ new Map();
+	for (const { category, json } of captures) {
+		let merged = byCategory.get(category);
+		if (!merged) {
+			merged = [];
+			byCategory.set(category, merged);
+		}
+		const parsed = JSON.parse(json);
+		if (Array.isArray(parsed)) merged.push(...parsed);
+		else merged.push(parsed);
+	}
+	await mkdir(dir, { recursive: true });
+	const written = [];
+	for (const [category, records] of byCategory) {
+		const outFile = path.join(dir, `${category}.${cell.sdkLine}.${cell.platform}.json`);
+		await writeFile(outFile, `${JSON.stringify(records, null, 2)}\n`, "utf8");
+		written.push(outFile);
+	}
+	return written;
+}
+//#endregion
+//#region src/test-runner/cli.ts
+/**
+* `devtools-test` CLI.
+*
+* Shares test-file discovery with the `run_tests` MCP tool (`discoverTestFiles`)
+* and exposes `runWithConnection` — the pure run core that bundles, injects, and
+* collects each file over a CDP connection. The CLI's `main()` performs a
+* standalone relay attach (boot relay → QR → phone scan → cell inject → run).
+*
+* NOTE: no shebang in this source file — the tsdown entry's `banner` option
+* injects `#!/usr/bin/env node` into the compiled output (same pattern as
+* `src/mcp/cli.ts`).
+*/
+const USAGE = `
+devtools-test — run mini-app tests on a real device WebView over the CDP relay
+
+USAGE
+  devtools-test <glob> [<glob> ...] [options]
+
+OPTIONS
+  --scheme-url <url>      intoss-private:// URL from \`ait deploy --scheme-only\`
+                          (required for standalone relay attach / env3)
+  --timeout <ms>          Per-file evaluate timeout in ms (default: 30000)
+  --cell-sdk-line <line>  SDK line to inject as __AIT_CELL__.sdkLine (2.x|3.x)
+  --cell-platform <plat>  Platform to inject as __AIT_CELL__.platform
+                          (mock|ios|android, default: AIT_CELL_PLATFORM env)
+  --report-dir <dir>      Persist a runner-agnostic report + captures to <dir>
+                          (report: <sdkLine>.<platform>.json; captures:
+                          <dir>/.ait-capture/<category>.<sdkLine>.<platform>.json).
+                          Omitted = nothing saved. Enables console capture.
+  --no-qr-stdout          Suppress the QR/attach block on stdout (auto-on for
+                          non-interactive stdout / CI / AIT_NO_QR_STDOUT)
+  --headless              Disable browser auto-open (text QR only)
+  --project-root <dir>    Project root for .ait_relay secret lookup
+                          (default: current working directory)
+  --help, -h              Show this help message
+
+DESCRIPTION
+  Boots a Chii relay + cloudflared tunnel, renders a QR code, waits for a real
+  device to scan and attach, injects the cell globals (__AIT_CELL__), bundles
+  each matched test file with esbuild (SDK imports redirected to window.__sdk),
+  injects the bundle into the attached WebView via Runtime.evaluate, and prints
+  a summary.
+
+  With --report-dir, also harvests __AIT_CAPTURE__ console lines and writes a
+  runner-agnostic report + per-category capture files so 2.x↔3.0 runs can be
+  compared offline.
+
+  The test files run against the live relay connection started by this process;
+  no separate MCP daemon is required.
+
+EXAMPLE
+  devtools-test 'src/**/*.ait.test.ts' \\
+    --scheme-url "intoss-private://..." \\
+    --cell-sdk-line 3.x \\
+    --cell-platform ios \\
+    --report-dir .ait-report \\
+    --timeout 60000
+
+`.trimStart();
+/**
+* Runs `files` over `connection` and returns the aggregate report.
+* This pure function is the testable core of the CLI (and is what the
+* `run_tests` MCP tool calls against the daemon's attached connection); it is
+* separate from `main()` so tests can call it without spawning a subprocess.
+*/
+async function runWithConnection(connection, files, opts) {
+	const report = await runTestFilesOverRelay(connection, files, opts);
+	if (opts?.printSummary) {
+		const { totals } = report;
+		process.stdout.write(`\ndevtools-test: ${totals.passed} passed, ${totals.failed} failed, ${totals.skipped} skipped (${report.duration}ms)\n`);
+	}
+	return report;
+}
+/**
+* Decides whether to suppress the QR/attach block on stdout.
+*
+* Suppress when EITHER the user passed `--no-qr-stdout`, OR stdout is not a TTY
+* / `CI` is set / `AIT_NO_QR_STDOUT` is set (non-interactive — a captured stdout
+* must not leak the relay wss + TOTP `at=` code that the QR block encodes). The
+* suppression is whole-chunk: `attachUrl` AND `relayUrl` ride in the same block.
+*
+* Exported for unit testing.
+*/
+function shouldSuppressQr(noQrFlag) {
+	return noQrFlag || !process.stdout.isTTY || process.env.CI !== void 0 || process.env.AIT_NO_QR_STDOUT !== void 0;
+}
+/**
+* CLI entry point.
+*
+* Performs a standalone relay attach → run lifecycle, sharing the attach
+* assembly with the Vitest pool via `createRelayConnectionFactory` (single
+* source — no drift):
+*
+* 1. Parse args: globs, --timeout, --cell-sdk-line, --cell-platform,
+*    --scheme-url (required for env3), --report-dir, --no-qr-stdout,
+*    --headless, --project-root.
+* 2. Discover test files; exit 1 if none.
+* 3. factory.open() — boot relay → render QR (suppressed on non-interactive
+*    stdout) → wait for phone → inject cell → enableDomains. Returns the conn.
+* 4. runWithConnection(conn, files, { timeoutMs, collectCaptures, printSummary }).
+* 5. With --report-dir: write the runner-agnostic report + capture files.
+* 6. factory.close(); process.exitCode = failed > 0 ? 1 : 0.
+*
+* The CLI is not a daemon — no lock, router, SSE, or tools_list is needed.
+* Attach timeout exits with code 1; test failures exit with code 1.
+*
+* SECRET-HANDLING: scheme_url / relay wssUrl / TOTP codes are never written to
+* stdout/stderr directly. The QR block (which encodes the TOTP `at=` code) is
+* printed only when stdout is interactive AND not suppressed.
+*/
+async function main(argv = process.argv.slice(2)) {
+	let parsed;
+	try {
+		parsed = parseArgs({
+			args: argv,
+			options: {
+				help: {
+					type: "boolean",
+					short: "h"
+				},
+				timeout: { type: "string" },
+				"scheme-url": { type: "string" },
+				"cell-sdk-line": { type: "string" },
+				"cell-platform": { type: "string" },
+				"report-dir": { type: "string" },
+				"no-qr-stdout": { type: "boolean" },
+				headless: { type: "boolean" },
+				"project-root": { type: "string" }
+			},
+			allowPositionals: true
+		});
+	} catch (e) {
+		process.stderr.write(`devtools-test: ${e instanceof Error ? e.message : String(e)}\n`);
+		process.exitCode = 1;
+		return;
+	}
+	if (parsed.values.help || argv.length === 0) {
+		process.stdout.write(USAGE);
+		return;
+	}
+	const vals = parsed.values;
+	const rawTimeout = typeof vals.timeout === "string" ? vals.timeout : void 0;
+	const timeoutMs = rawTimeout !== void 0 ? parseInt(rawTimeout, 10) : 3e4;
+	if (Number.isNaN(timeoutMs) || timeoutMs <= 0) {
+		process.stderr.write(`devtools-test: --timeout must be a positive integer\n`);
+		process.exitCode = 1;
+		return;
+	}
+	const schemeUrl = typeof vals["scheme-url"] === "string" ? vals["scheme-url"] : "";
+	if (schemeUrl === "") {
+		process.stderr.write("devtools-test: --scheme-url is required for standalone relay attach.\n  Pass the intoss-private:// URL from `ait deploy --scheme-only`.\n");
+		process.exitCode = 1;
+		return;
+	}
+	const headless = vals.headless === true;
+	const projectRoot = typeof vals["project-root"] === "string" ? vals["project-root"] : process.cwd();
+	const reportDir = typeof vals["report-dir"] === "string" ? vals["report-dir"] : void 0;
+	const suppressQr = shouldSuppressQr(vals["no-qr-stdout"] === true);
+	const cellSdkLine = typeof vals["cell-sdk-line"] === "string" ? vals["cell-sdk-line"] : void 0;
+	const cellPlatform = typeof vals["cell-platform"] === "string" ? vals["cell-platform"] : process.env.AIT_CELL_PLATFORM;
+	const hasCell = cellSdkLine !== void 0 || cellPlatform !== void 0;
+	const cell = {
+		sdkLine: cellSdkLine ?? "2.x",
+		platform: cellPlatform ?? "mock"
+	};
+	const globs = parsed.positionals;
+	if (globs.length === 0) {
+		process.stderr.write(`devtools-test: at least one glob pattern is required\n`);
+		process.stdout.write(USAGE);
+		process.exitCode = 1;
+		return;
+	}
+	const files = await discoverTestFiles(globs, process.cwd());
+	if (files.length === 0) {
+		process.stderr.write(`devtools-test: no test files matched ${globs.join(", ")}\n`);
+		process.exitCode = 1;
+		return;
+	}
+	process.stderr.write(`devtools-test: found ${files.length} test file(s)\n`);
+	if (hasCell) process.stderr.write(`devtools-test: injecting __AIT_CELL__ = ${JSON.stringify(cell)}\n`);
+	const factory = createRelayConnectionFactory({
+		schemeUrl,
+		projectRoot,
+		timeoutMs,
+		headless,
+		cell: hasCell ? cell : void 0,
+		onQrContent: (chunks) => {
+			if (suppressQr) {
+				process.stdout.write("QR suppressed (non-interactive)\n");
+				return;
+			}
+			for (const chunk of chunks) process.stdout.write(`${chunk}\n`);
+		}
+	});
+	let connection;
+	try {
+		connection = await factory.open();
+	} catch (e) {
+		process.stderr.write(`devtools-test: ${e instanceof Error ? e.message : String(e)}\n`);
+		process.exitCode = 1;
+		return;
+	}
+	let exitCode = 0;
+	try {
+		const report = await runWithConnection(connection, files, {
+			timeoutMs,
+			printSummary: true,
+			collectCaptures: reportDir !== void 0
+		});
+		if (reportDir !== void 0) try {
+			const reportPath = await writeReportArtifact(report, reportDir, {
+				sdkLine: cell.sdkLine,
+				platform: cell.platform,
+				projectRoot
+			});
+			process.stderr.write(`devtools-test: wrote report ${reportPath}\n`);
+			const capturePaths = await writeCaptureArtifacts(report.captures, `${reportDir}/.ait-capture`, cell);
+			if (capturePaths.length > 0) process.stderr.write(`devtools-test: wrote ${capturePaths.length} capture file(s)\n`);
+		} catch (e) {
+			process.stderr.write(`devtools-test: failed to write report artifacts: ${e instanceof Error ? e.message : String(e)}\n`);
+		}
+		exitCode = report.totals.failed > 0 ? 1 : 0;
+	} finally {
+		await factory.close(connection);
+		process.exitCode = exitCode;
+	}
+}
+if (import.meta.url === new URL(process.argv[1], "file://").href) main().catch((e) => {
+	process.stderr.write(`devtools-test: unexpected error: ${e instanceof Error ? e.message : String(e)}\n`);
+	process.exitCode = 1;
+});
+//#endregion
+export { runWithConnection as n, shouldSuppressQr as r, main as t };
+
+//# sourceMappingURL=cli-RhzASQef.js.map