@ait-co/devtools 0.1.127 → 0.1.129

package/dist/{debug-server-BzzNkETg.js → relay-worker-Bt0QYKQH.js}

@@ -1,17 +1,10 @@
-#!/usr/bin/env node
-import { n as buildRelayVerifyAuth, r as generateTotp, t as assertRelayAuthConfigured } from "./totp-DvOYkYim.js";
-import "./test-runner/bin.js";
-import { a as startTunnelHealthProbe, i as startQuickTunnel, n as makeTunnelStatus, o as logError, r as printAttachBanner, s as logInfo, t as generateAttachToken } from "./attach-orchestrator-CpE0dMew.js";
-import "./cell-CX92lDI0.js";
-import "./qr-http-server-s1iW_5VQ.js";
-import "./relay-secret-store-CFc9n0OA.js";
-import { createRequire } from "node:module";
-import "@modelcontextprotocol/sdk/server/index.js";
-import "@modelcontextprotocol/sdk/server/stdio.js";
-import "@modelcontextprotocol/sdk/types.js";
+import { r as generateTotp } from "./totp-DfekTBk3.js";
+import { n as logInfo } from "./log-CUik_tHp.js";
+import { bundleTestFile } from "./test-runner/bundle.js";
+import { parseCaptureLines } from "./test-runner/capture.js";
+import { injectAndRunBundle } from "./test-runner/rpc.js";
 import { EventEmitter } from "node:events";
-import { WebSocket, WebSocketServer } from "ws";
-import { createServer } from "node:http";
+import { WebSocket } from "ws";
 //#region src/shared/relay-auth-close.ts
 /**
 * Shared constants for the relay's named TOTP-auth rejection (issue #478).
@@ -75,6 +68,25 @@ const RELAY_AUTH_REJECT_REASON = "totp-rejected";
 */
 /** Max events retained per domain ring buffer. */
 const DEFAULT_BUFFER_SIZE = 500;
+/**
+* Substrings that mark a "relay websocket is dead" class error, as produced by
+* `handleDisconnect('relay WebSocket 연결이 끊겼습니다')` (ws close handler) and
+* the fail-fast `sendCommand` rejection (`relay에 연결되어 있지 않습니다 (...)`).
+*
+* Exported so callers outside this module (e.g. `test-runner/relay-worker.ts`)
+* can detect the same error class without hardcoding a fragile full-sentence
+* match — mirrors the `EVALUATE_TIMEOUT_MARKER` precedent in
+* `test-runner/relay-worker.ts`. Kept in sync with `classifyToolError`'s
+* `relayDisconnectError` branch in `mcp/errors.ts`.
+*/
+const RELAY_DISCONNECT_MARKERS = ["relay WebSocket", "relay에 연결되어 있지 않습니다"];
+/**
+* Returns true when `message` matches the relay-websocket-dead error class
+* (socket closed, socket errored, or fail-fast "not connected" rejection).
+*/
+function isRelayDisconnectMessage(message) {
+	return RELAY_DISCONNECT_MARKERS.some((marker) => message.includes(marker));
+}
 function isObject(value) {
 	return typeof value === "object" && value !== null;
 }
@@ -557,368 +569,222 @@ var ChiiCdpConnection = class {
 	}
 };
 //#endregion
-//#region src/mcp/chii-relay.ts
+//#region src/test-runner/relay-worker.ts
 /**
-* Boots the local Chii relay server.
-*
-* Chii (liriliri/chii) is a chobitsu-based CDP relay that lets non-Chrome
-* WebViews (iOS WKWebView / Android WebView — i.e. the Toss app) expose CDP.
-* The relay accepts a `target` websocket from the phone's injected `target.js`
-* and `client` websockets from CDP frontends (our MCP connection).
-*
-* Node-only: `chii` pulls in Koa + ws. Never bundled into the browser/in-app
-* entries.
-*
-* TOTP auth (relay-side, authoritative gate):
-*   When `verifyAuth` is provided, this module gates both inbound surfaces:
-*
-*   - HTTP 'request': a listener registered BEFORE `chii.start({server})`.
-*     Node's `http.Server` calls listeners in registration order; the first
-*     to call `res.end()` wins. Invalid auth → 401 + CORS header + a tiny
-*     JSON body (`{"error":"totp-rejected"}`) so a cross-origin script
-*     `fetch()` probe can READ the status (issue #478). Valid auth → return
-*     without side-effect (chii's Koa handler serves it).
-*
-*   - WS 'upgrade': after `chii.start()` has registered chii's own upgrade
-*     listener, we take over the upgrade chain (remove chii's listeners,
-*     re-dispatch manually). Invalid auth → accept-then-close: complete the
-*     handshake via a `noServer` WebSocketServer, then immediately close
-*     with code 4401 reason 'totp-rejected' (issue #478). A raw 401 +
-*     `socket.destroy()` only ever surfaced as close code 1006 in the
-*     browser — indistinguishable from a tunnel failure, which left the
-*     env-2 phone UI silent. The explicit dispatch (not listener ordering)
-*     is what keeps chii away from rejected sockets: accept-then-close
-*     leaves the socket alive, so an order-based early-return would let
-*     chii's later listener complete a SECOND handshake on the same socket
-*     — an auth bypass. Valid auth → forward to chii's captured listeners.
+* Sentinel string embedded in the error message by `injectAndRunBundle` when
+* the per-file evaluate race hits the timeout. Used by the retry guard so only
+* genuine timeouts get a second attempt — not bundle errors or parse failures.
 *
-* TOTP code transports (issue #466) — two equivalent ways to carry the code:
-*   1. Query param `at=<code>` — used by the daemon-side `/client` connection
-*      (`chii-connection.ts` appends it; it holds the secret).
-*   2. Path prefix `/at/<code>/…` — used by the phone-side target. Chii's
-*      stock `target.js` derives its WS endpoint from the script `src`
-*      (`scriptEl.src.replace('target.js','')`), so the only way for the
-*      phone to carry a code is to embed it in the script URL path. The
-*      in-app attach injects `https://<host>/at/<code>/target.js`; both the
-*      script fetch and the derived `wss://<host>/at/<code>/target/<id>` WS
-*      dial then carry the prefix. The listeners below rewrite the prefix
-*      into the query form (`rewriteAtPathPrefix`) and MUTATE `req.url`
-*      before chii's own handlers (registered later) parse it — chii only
-*      ever sees the stripped URL.
-*
-* Threat model: "URL leak" — someone obtains the tunnel URL (Slack paste, QR
-*   screenshot, shoulder-surfing) but does not have the shared TOTP secret.
-*   Rotating 6-digit code makes the URL stale after 30 s.
-*   A determined attacker who extracts the secret from the dogfood bundle can
-*   still compute valid codes; that is out of scope (see umbrella CLAUDE.md §4).
-*
-* SECRET-HANDLING: The secret value and computed TOTP codes MUST NOT appear
-*   in any log, error message, or process output. `verifyAuth` is a black-box
-*   predicate from the caller's perspective; this module only forwards pass/fail.
+* Exported for unit tests that assert the retry path is taken.
 */
-const require = createRequire(import.meta.url);
+const EVALUATE_TIMEOUT_MARKER = "rpc: evaluate timed out after";
 /**
-* WS keepalive ping interval (ms).
+* Runs all `files` sequentially over the given CDP `connection`.
 *
-* Cloudflare proxied connections are dropped after ~100 s of no traffic.
-* 45 s comfortably fits inside that window and lets both the phone-target leg
-* and the daemon-client leg survive idle CDP sessions.
-*/
-const DEFAULT_KEEPALIVE_INTERVAL_MS = 45e3;
-/**
-* Loads chii's internal WebSocketServer class and returns it together with a
-* flag indicating whether the real class was found.
+* For each file:
+*   1. Bundle with esbuild (includes SDK shim + runtime).
+*   2. Inject into the attached page via `Runtime.evaluate`.
+*   3. Await the `RunReport` JSON response.
+*   4. Accumulate results.
 *
-* Returns `null` if the internal path is not resolvable (future chii release
-* changes the layout) — callers skip keepalive gracefully.
-*/
-function tryLoadChiiWssClass() {
-	try {
-		const mod = require("chii/server/lib/WebSocketServer");
-		if (typeof mod === "function") return mod;
-	} catch {}
-	return null;
-}
-/**
-* Calls `chii.start()` and returns the chii `WebSocketServer` instance that
-* was constructed during the call.
+* Returns a `RelayRunReport` with per-file results and flattened totals.
 *
-* How: `chii/server/index.js`'s `start()` creates `new WebSocketServer()`
-* where `WebSocketServer` is captured from `require('./lib/WebSocketServer')`
-* at module load time. The class reference is stable, so we can temporarily
-* patch `ChiiWssClass.prototype.start` — which runs *on the instance* —
-* to record `this` before the original `start` runs.
+* This function does NOT open or manage the relay connection — the caller
+* is responsible for attaching and closing it.
 *
-* The patch is installed before `chii.start()` and removed (via `finally`)
-* immediately after, so concurrent `startChiiRelay` calls nest correctly: each
-* call's patch overrides the previous in the prototype chain for the duration
-* of its own `chii.start()` call, restoring the prior descriptor on exit.
+* TODO (#645): implement the Vitest `PoolRunnerInitializer` interface here
+* so that `runTestFilesOverRelay` can be used as a Vitest pool entry.
 *
-* If `ChiiWssClass` is null (internal path changed in a future chii release),
-* `chii.start()` runs unpatched and the function returns null — callers skip
-* keepalive gracefully without affecting relay correctness.
+* @param connection - Active CDP connection (relay or local kind).
+* @param files      - Absolute paths to test files, run in order.
+* @param opts       - Optional per-run overrides.
 */
-async function startChiiWithCapture(chii, startOptions, ChiiWssClass) {
-	if (ChiiWssClass === null) {
-		await chii.start(startOptions);
-		return null;
-	}
-	let captured = null;
-	const proto = ChiiWssClass.prototype;
-	const originalStart = proto.start;
-	proto.start = function(server) {
-		captured = this;
-		return originalStart.call(this, server);
-	};
+async function runTestFilesOverRelay(connection, files, opts) {
+	const wallStart = Date.now();
+	const startedAt = new Date(wallStart).toISOString();
+	const fileResults = [];
+	let domainsEnabled = false;
 	try {
-		await chii.start(startOptions);
-	} finally {
-		proto.start = originalStart;
+		await connection.enableDomains();
+		domainsEnabled = true;
+	} catch (e) {
+		process.stderr.write(`relay-worker: enableDomains() failed before run — console capture may be empty (${e instanceof Error ? e.message : String(e)})\n`);
 	}
-	return captured;
-}
-function loadChiiServer() {
-	const mod = require("chii");
-	if (typeof mod === "object" && mod !== null && "start" in mod && typeof mod.start === "function") return mod;
-	throw new Error("chii server module did not expose start()");
-}
-/**
-* Rewrites a `/at/<code>/…` path-prefixed request URL into the equivalent
-* query-based form, e.g.:
-*
-*   `/at/123456/target.js`        → `/target.js?at=123456`
-*   `/at/123456/target/x?url=u`   → `/target/x?url=u&at=123456`
-*   `/at/123456/`                 → `/?at=123456`
-*
-* Returns `null` when the URL does not carry the prefix (including an empty
-* code segment) — callers fall back to the unmodified URL and the existing
-* query-based auth path.
-*
-* Pure string surgery — this function knows nothing about secrets or code
-* validity; verification stays inside the caller-provided `verifyAuth`
-* predicate (which parses the query). The raw path segment is appended
-* verbatim to the query: both path segments and query values are
-* percent-decoded exactly once by their consumers, so no re-encoding is
-* needed (TOTP codes are 6 digits and never percent-encoded in practice).
-*/
-function rewriteAtPathPrefix(rawUrl) {
-	const match = /^\/at\/([^/?]+)(\/[^?]*)?(\?.*)?$/.exec(rawUrl);
-	if (match === null) return null;
-	const code = match[1];
-	const path = match[2] === void 0 || match[2] === "" ? "/" : match[2];
-	const query = match[3] ?? "";
-	return `${path}${query}${query === "" ? "?" : "&"}at=${code}`;
-}
-/**
-* Starts the Chii relay and resolves once listening.
-*
-* Default port is 0 (OS-assigned). With port 0 the OS picks a free ephemeral
-* port on every start, so a stale cloudflared orphan holding any particular
-* port cannot cause EADDRINUSE. The resolved `ChiiRelay.port` and `baseUrl`
-* always reflect the actual bound port.
-*
-* chii.start() is called with `server` (our pre-created httpServer) BEFORE
-* httpServer.listen(). This is intentional: chii attaches its Koa handler and
-* WS upgrade listener to the server object, but the actual TCP bind is
-* performed by our httpServer.listen() call below. The `port`/`domain` values
-* passed to chii.start() are used for display/banner purposes inside chii and
-* do not affect which port the server binds. The connection path (clients
-* connecting to `relay.baseUrl`) always uses the post-listen confirmed port.
-*/
-async function startChiiRelay(options = {}) {
-	const requestedPort = options.port ?? 0;
-	const host = options.host ?? "127.0.0.1";
-	const { verifyAuth, onAuthReject } = options;
-	const keepaliveIntervalMs = options.keepaliveIntervalMs !== void 0 ? options.keepaliveIntervalMs : DEFAULT_KEEPALIVE_INTERVAL_MS;
-	const httpServer = createServer();
-	const notifyAuthReject = (kind) => {
-		if (onAuthReject === void 0) return;
+	const collectCaptures = opts?.collectCaptures === true;
+	const liveConsole = [];
+	let unsubscribeConsole;
+	if (collectCaptures && domainsEnabled) unsubscribeConsole = connection.on("Runtime.consoleAPICalled", (event) => {
+		liveConsole.push(event);
+	});
+	let pendingReconnectCheck = false;
+	/**
+	* Attempts one `enableDomains()` reconnect. Logs the attempt and outcome to
+	* stderr. Never throws — a failed reconnect just means the caller proceeds
+	* as today (each remaining file / the retry will fail-fast on the still-dead
+	* socket).
+	*
+	* `context` selects the fixed log literal: 'next-file' for the between-files
+	* case (a file's FINAL result was a WS-dead-class error — the primary #731
+	* scenario), 'retry-precheck' for the defensive reconnect before retrying a
+	* timed-out file (cheap no-op via `enableDomains()`'s idempotency when the
+	* socket never actually died).
+	*
+	* SECRET-HANDLING: fixed literals only — no relay wss URL, TOTP code, or
+	* tunnel host.
+	*/
+	const attemptReconnect = async (context) => {
+		process.stderr.write(context === "next-file" ? "relay-worker: relay connection lost — attempting reconnect before next file\n" : "relay-worker: evaluate timed out — attempting reconnect before retry\n");
 		try {
-			onAuthReject({ kind });
-		} catch {}
+			await connection.enableDomains();
+			process.stderr.write("relay-worker: reconnect succeeded\n");
+		} catch (e) {
+			process.stderr.write(`relay-worker: reconnect failed (${e instanceof Error ? e.message : String(e)}) — continuing, remaining files may fail\n`);
+		}
 	};
-	if (verifyAuth) httpServer.on("request", (req, res) => {
-		const rewritten = rewriteAtPathPrefix(req.url ?? "");
-		if (rewritten !== null) {
-			req.url = rewritten;
-			if (!verifyAuth(req)) {
-				res.statusCode = 401;
-				res.setHeader("Access-Control-Allow-Origin", "*");
-				res.setHeader("Content-Type", "application/json");
-				res.end(JSON.stringify({ error: RELAY_AUTH_REJECT_REASON }));
-				notifyAuthReject("http-request");
+	try {
+		for (const file of files) {
+			if (pendingReconnectCheck) {
+				await attemptReconnect("next-file");
+				pendingReconnectCheck = false;
 			}
-			return;
-		}
-		const pathname = (req.url ?? "").split("?")[0];
-		if (pathname === "/targets" || pathname === "/targets/") {
-			if (!verifyAuth(req)) {
-				res.statusCode = 401;
-				res.setHeader("Access-Control-Allow-Origin", "*");
-				res.setHeader("Content-Type", "application/json");
-				res.end(JSON.stringify({ error: RELAY_AUTH_REJECT_REASON }));
-				notifyAuthReject("http-request");
-				return;
+			let fileEntry;
+			try {
+				const { code } = await bundleTestFile(file, opts?.bundleOptions);
+				/**
+				* Runs one evaluate attempt and returns a FileResult, or `null` when the
+				* result is a genuine timeout and the caller should retry.
+				*
+				* We need to distinguish:
+				*   - `rpcResult.ok = false` + timeout error → retry candidate (`return null`)
+				*   - `rpcResult.ok = false` + other error   → final error, no retry
+				*   - `injectAndRunBundle` throws             → CDP exceptionDetails OR a
+				*     relay-disconnect rejection from `connection.send()` (page engine
+				*     threw, or the ws died mid-evaluate); treated as a final
+				*     (non-retryable) error either way.
+				*
+				* The Promise.race timeout in rpc.ts RETURNS `{ok:false, error: '…'}` (it
+				* does NOT throw/reject).  Only genuine CDP `exceptionDetails` (or a dead
+				* `connection.send()`) cause a throw. This distinction is what makes the
+				* EVALUATE_TIMEOUT_MARKER gate below reachable — the timeout result
+				* surfaces as `rpcResult.ok=false` with the marker string, not as a
+				* caught exception.
+				*/
+				const attempt = async () => {
+					let rpcResult;
+					try {
+						rpcResult = await injectAndRunBundle(connection, code, opts?.timeoutMs);
+					} catch (e) {
+						return {
+							file,
+							result: { error: e instanceof Error ? e.message : String(e) }
+						};
+					}
+					if (rpcResult.ok) return {
+						file,
+						result: rpcResult.report
+					};
+					if (rpcResult.error.includes("rpc: evaluate timed out after")) return null;
+					return {
+						file,
+						result: { error: rpcResult.error }
+					};
+				};
+				const firstResult = await attempt();
+				if (firstResult !== null) fileEntry = firstResult;
+				else {
+					await attemptReconnect("retry-precheck");
+					process.stderr.write(`relay-worker: evaluate timed out for ${file} — retrying once\n`);
+					const retryResult = await attempt();
+					if (retryResult !== null) fileEntry = retryResult;
+					else fileEntry = {
+						file,
+						result: { error: `${EVALUATE_TIMEOUT_MARKER} ${opts?.timeoutMs ?? 6e4}ms (after retry)` }
+					};
+				}
+			} catch (e) {
+				fileEntry = {
+					file,
+					result: { error: e instanceof Error ? e.message : String(e) }
+				};
 			}
-			return;
+			if ("error" in fileEntry.result && isRelayDisconnectMessage(fileEntry.result.error)) pendingReconnectCheck = true;
+			fileResults.push(fileEntry);
 		}
-	});
-	const chiiWssClass = keepaliveIntervalMs > 0 ? tryLoadChiiWssClass() : null;
-	const capturedChiiWss = await startChiiWithCapture(loadChiiServer(), {
-		server: httpServer,
-		domain: `${host}:${requestedPort}`,
-		port: requestedPort
-	}, chiiWssClass);
-	if (verifyAuth) {
-		const chiiUpgradeListeners = httpServer.listeners("upgrade");
-		httpServer.removeAllListeners("upgrade");
-		const rejectWss = new WebSocketServer({ noServer: true });
-		httpServer.on("upgrade", (req, socket, head) => {
-			const rewritten = rewriteAtPathPrefix(req.url ?? "");
-			if (rewritten !== null) req.url = rewritten;
-			if (!verifyAuth(req)) {
-				rejectWss.handleUpgrade(req, socket, head, (ws) => {
-					ws.close(RELAY_AUTH_REJECT_CLOSE_CODE, RELAY_AUTH_REJECT_REASON);
-				});
-				notifyAuthReject("ws-upgrade");
-				return;
-			}
-			for (const listener of chiiUpgradeListeners) listener(req, socket, head);
-		});
+	} finally {
+		unsubscribeConsole?.();
 	}
-	const actualPort = await new Promise((resolve, reject) => {
-		httpServer.once("error", reject);
-		httpServer.listen(requestedPort, host, () => {
-			httpServer.off("error", reject);
-			resolve(httpServer.address().port);
-		});
+	const captures = collectCaptures ? parseCaptureLines(liveConsole.map((e) => ({ text: renderConsoleLineText(e) }))) : [];
+	const totals = fileResults.reduce((acc, { result }) => {
+		if ("error" in result) {
+			acc.failed += 1;
+			acc.total += 1;
+		} else {
+			acc.passed += result.passed;
+			acc.failed += result.failed;
+			acc.skipped += result.skipped;
+			acc.total += result.passed + result.failed + result.skipped;
+		}
+		return acc;
+	}, {
+		passed: 0,
+		failed: 0,
+		skipped: 0,
+		total: 0
 	});
-	let keepaliveHandle = null;
-	if (keepaliveIntervalMs > 0 && capturedChiiWss !== null) {
-		const chiiWss = capturedChiiWss;
-		keepaliveHandle = setInterval(() => {
-			for (const client of chiiWss._wss.clients) if (client.readyState === 1) client.ping();
-		}, keepaliveIntervalMs);
-	}
 	return {
-		port: actualPort,
-		baseUrl: `http://${host}:${actualPort}`,
-		close: () => new Promise((resolve) => {
-			if (keepaliveHandle !== null) {
-				clearInterval(keepaliveHandle);
-				keepaliveHandle = null;
-			}
-			httpServer.close(() => resolve());
-		})
+		startedAt,
+		duration: Date.now() - wallStart,
+		files: fileResults,
+		totals,
+		captures
 	};
 }
-//#endregion
-//#region src/mcp/debug-server.ts
 /**
-* Factory that constructs a `ChiiCdpConnection` for the given relay base URL.
-*
-* Introduced as a named seam so PR-2 (dual-connection, #348) can defer
-* construction to first-activation time by moving or replacing this call. Since
-* #396 every family (relay included) is constructed lazily on its first
-* `start_debug`, so this is always called from the lazy boot path.
-*
-* The relay base URL is only available after `startChiiRelay()` resolves, so
-* the factory is called right after that point (same as before this refactor).
+* Renders one `Runtime.consoleAPICalled` event to a single line of text, the
+* same way `tools.ts#normalizeConsoleMessage` does (args rendered + space-
+* joined). Inlined here (≈8 lines) so this module avoids importing `tools.ts`,
+* which would drag the heavy MCP/Node graph (server-lock, parent-watcher, …)
+* onto the test-runner entry.
+*
+* SECRET-HANDLING: this only stringifies console args; the caller's
+* allowlist-prefix parser then discards everything that is not a genuine
+* `__AIT_CAPTURE__` line.
 */
-function createRelayConnection(relayBaseUrl) {
-	return new ChiiCdpConnection({
-		relayBaseUrl,
-		totpSecret: process.env.AIT_DEBUG_TOTP_SECRET
-	});
+function renderConsoleLineText(event) {
+	return event.args.map((arg) => {
+		if (arg.value !== void 0) {
+			if (typeof arg.value === "string") return arg.value;
+			try {
+				return JSON.stringify(arg.value);
+			} catch {
+				return String(arg.value);
+			}
+		}
+		if (arg.description !== void 0) return arg.description;
+		if (arg.className !== void 0) return arg.className;
+		return arg.subtype ?? arg.type;
+	}).join(" ");
 }
 /**
-* Boots the relay family (issues #348, #356): starts the Chii relay on an
-* OS-assigned port (with optional TOTP gate), opens a cloudflared quick tunnel
-* to the relay's confirmed port in the background, prints the attach banner,
-* and arms the tunnel health probe. Returns a {@link BootedFamily} whose
-* `getTunnelStatus()` reflects the live tunnel (it flips up once the background
-* tunnel resolves and follows reissues).
-*
-* Booted lazily via the dual router's `bootLazyFor('relay-intoss')` callback
-* (symmetry with {@link bootLocalFamily}), at most once on the first
-* `start_debug({ mode: 'relay-staging' })` (all-lazy, #396 — every relay boot now
-* flows through `switchMode` after the project-local secret load). `relay-live`
-* removed (#665).
-*
-* The relay base URL is only known after `startChiiRelay()` resolves, so the
-* `ChiiCdpConnection` (via {@link createRelayConnection}) is constructed inside
-* this function, after the relay port is confirmed.
-*
-* SECRET-HANDLING: the TOTP secret rides only inside `verifyAuth`; the wssUrl
-* (relay host) is never logged here directly.
+* Flattens all test results from a `RelayRunReport` into a single array.
+* Files that errored during bundle/inject produce a synthetic failed entry.
 */
-async function bootRelayFamily(options = {}) {
-	assertRelayAuthConfigured();
-	const relayPort = options.relayPort ?? 0;
-	const totpEnabled = options.verifyAuth !== void 0;
-	const relay = await startChiiRelay({
-		port: relayPort,
-		verifyAuth: options.verifyAuth,
-		onAuthReject: options.onAuthReject
+function flattenResults(report) {
+	const out = [];
+	for (const { file, result } of report.files) if ("error" in result) out.push({
+		file,
+		name: `<bundle/inject error>`,
+		status: "fail",
+		duration: 0,
+		error: result.error
 	});
-	logInfo("server.start", {
-		port: relay.port,
-		totpEnabled
+	else for (const t of result.tests) out.push({
+		...t,
+		file
 	});
-	let tunnel = null;
-	let tunnelStatus = makeTunnelStatus(false, null);
-	let tunnelProbe = null;
-	generateAttachToken();
-	startQuickTunnel(relay.port).then((t) => {
-		tunnel = t;
-		tunnelStatus = makeTunnelStatus(true, t.wssUrl);
-		options.onWssUrl?.(t.wssUrl);
-		if (t.childPid !== void 0) options.onTunnelChildPid?.(t.childPid);
-		logInfo("tunnel.up", { totpEnabled });
-		tunnelProbe = startTunnelHealthProbe(t, relay.port, {
-			onReissue: (newTunnel) => {
-				tunnel = newTunnel;
-				tunnelStatus = makeTunnelStatus(true, newTunnel.wssUrl, null, 0);
-				options.onWssUrl?.(newTunnel.wssUrl);
-				if (newTunnel.childPid !== void 0) options.onTunnelChildPid?.(newTunnel.childPid);
-				printAttachBanner({
-					wssUrl: newTunnel.wssUrl,
-					totpEnabled
-				}).then(() => {
-					logInfo("tunnel.up", {
-						totpEnabled,
-						reissued: true
-					});
-				});
-			},
-			onPermanentDrop: (droppedAt) => {
-				tunnelStatus = makeTunnelStatus(false, null, droppedAt, 3);
-				logError("tunnel.down", { msg: `tunnel permanently dropped (${droppedAt}). Restart: npx @ait-co/devtools devtools-mcp` });
-				options.onTunnelDown?.();
-			}
-		});
-		return printAttachBanner({
-			wssUrl: t.wssUrl,
-			totpEnabled
-		});
-	}, (err) => {
-		logError("tunnel.down", { msg: `Failed to open cloudflared quick tunnel: ${err instanceof Error ? err.message : String(err)}. The relay is up locally; attach over the public URL is unavailable until the tunnel starts.` });
-	});
-	const connection = createRelayConnection(relay.baseUrl);
-	return {
-		connection,
-		relayOrigin: "intoss-webview",
-		relayHttpUrl: relay.baseUrl,
-		getTunnelStatus: () => tunnelStatus,
-		stop() {
-			tunnelProbe?.stop();
-			tunnel?.stop();
-			connection.close();
-			relay.close();
-		}
-	};
+	return out;
 }
 //#endregion
-export { bootRelayFamily, buildRelayVerifyAuth };
+export { RELAY_AUTH_REJECT_CLOSE_CODE as a, ChiiCdpConnection as i, flattenResults as n, RELAY_AUTH_REJECT_REASON as o, runTestFilesOverRelay as r, EVALUATE_TIMEOUT_MARKER as t };
 
-//# sourceMappingURL=debug-server-BzzNkETg.js.map
+//# sourceMappingURL=relay-worker-Bt0QYKQH.js.map