@asrunjs/asrun 0.0.0-stage → 0.5.2

package/dist/scripts/ui-build.js

@@ -0,0 +1,7 @@
+import { buildUi } from '../lib/ui-build.js';
+const status = buildUi();
+if (status === null) {
+    console.error('No front-end toolchain here: the web UI can only be built in the framework repository.');
+    process.exit(1);
+}
+process.exit(status);

package/dist/scripts/ui-dev.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/scripts/ui-dev.js

@@ -0,0 +1,3 @@
+// Vite dev server plus the API in watch mode.
+await import('../ui/dev.js');
+export {};

package/dist/scripts/ui.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/scripts/ui.js

@@ -0,0 +1,13 @@
+import { buildUi, uiIsBuilt } from '../lib/ui-build.js';
+// An installed package ships the built app; the framework repository builds it (or refreshes it with `asrun ui --build`).
+if (!uiIsBuilt() || process.argv.includes('--build')) {
+    const status = buildUi();
+    if (status === null) {
+        console.error('This asrun installation has no built web UI. Reinstall it: "pnpm add -D @asrunjs/asrun".');
+        process.exit(1);
+    }
+    if (status !== 0)
+        process.exit(status);
+}
+// Serves the built app and the API on one port (see ui/server/index.ts).
+await import('../ui/server/index.js');

package/dist/ui/dev.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/ui/dev.js

@@ -0,0 +1,36 @@
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { commandScript } from '../lib/node-cli.js';
+import { FRAMEWORK_ROOT, ROOT } from '../lib/paths.js';
+const webPort = process.env.ASRUN_UI_WEB_PORT ?? '5173';
+const tools = [
+    {
+        name: 'tsx',
+        script: commandScript('tsx'),
+        args: ['watch', path.join(FRAMEWORK_ROOT, 'ui', 'server', 'index.ts')],
+        env: { ...process.env, ASRUN_UI_DEV_ORIGIN: `http://127.0.0.1:${webPort}` },
+    },
+    {
+        name: 'vite',
+        script: commandScript('vite'),
+        args: ['--config', path.join(FRAMEWORK_ROOT, 'ui', 'web', 'vite.config.ts')],
+        env: process.env,
+    },
+];
+const children = [];
+const stop = () => children.forEach((child) => child.kill('SIGTERM'));
+process.on('SIGINT', stop);
+process.on('SIGTERM', stop);
+for (const tool of tools) {
+    const child = spawn(process.execPath, [tool.script, ...tool.args], { cwd: ROOT, stdio: 'inherit', env: tool.env });
+    children.push(child);
+    child.on('error', (error) => {
+        console.error(`Failed to start ${tool.name}: ${error.message}`);
+        stop();
+        process.exit(1);
+    });
+    child.on('exit', (code) => {
+        stop();
+        process.exit(code ?? 0);
+    });
+}

package/dist/ui/server/actions.d.ts

@@ -0,0 +1,95 @@
+import { z } from 'zod';
+import type { RunPlan } from '../shared/types.js';
+import { type JobSpec } from './jobs.js';
+export declare const startJobSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    action: z.ZodLiteral<"signin">;
+    profile: z.ZodString;
+    env: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    action: z.ZodLiteral<"visit">;
+    profile: z.ZodString;
+    env: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    action: z.ZodLiteral<"ai">;
+    tool: z.ZodEnum<{
+        claude: "claude";
+        opencode: "opencode";
+    }>;
+    command: z.ZodEnum<{
+        "explore-case": "explore-case";
+        "gen-spec": "gen-spec";
+        "heal-spec": "heal-spec";
+    }>;
+    caseId: z.ZodString;
+    env: z.ZodString;
+    force: z.ZodOptional<z.ZodBoolean>;
+    attended: z.ZodOptional<z.ZodBoolean>;
+    thinking: z.ZodOptional<z.ZodBoolean>;
+    model: z.ZodOptional<z.ZodString>;
+    profiles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    hints: z.ZodOptional<z.ZodString>;
+    report: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    action: z.ZodLiteral<"continue">;
+    jobId: z.ZodString;
+    reply: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    action: z.ZodLiteral<"make-cases">;
+    tool: z.ZodEnum<{
+        claude: "claude";
+        opencode: "opencode";
+    }>;
+    memo: z.ZodString;
+    model: z.ZodOptional<z.ZodString>;
+    thinking: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>, z.ZodObject<{
+    action: z.ZodLiteral<"run">;
+    env: z.ZodString;
+    profiles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    suites: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    grep: z.ZodOptional<z.ZodString>;
+    stepText: z.ZodOptional<z.ZodBoolean>;
+    readOnly: z.ZodOptional<z.ZodBoolean>;
+    updateBaselines: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    confirmWritesIn: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>], "action">;
+export declare const previewSchema: z.ZodObject<{
+    env: z.ZodString;
+    profiles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    suites: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    grep: z.ZodOptional<z.ZodString>;
+    readOnly: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare class ActionError extends Error {
+}
+/** The same filters the run will use, so the preview and the real run select the same cases. */
+export declare function runFilters(request: {
+    env: string;
+    profiles?: string[];
+    tags?: string[];
+    suites?: string[];
+    grep?: string;
+    readOnly?: boolean;
+}): {
+    env: string;
+    profiles: string[] | null;
+    suites: string[];
+    grep: string | undefined;
+    readOnly: boolean;
+};
+/** What a run would do: the cases that write data and whether the user has to confirm them first. */
+export declare function previewRun(request: z.infer<typeof previewSchema>): {
+    env: string;
+    needsConfirmation: boolean;
+    writeCases: import("../../lib/write-gate.js").WriteCase[];
+    skippedWriteCases: import("../../lib/write-gate.js").WriteCase[];
+};
+/** The cases a run with these filters would execute, for the Run page. A failure of the list is reported, not thrown. */
+export declare function planRunCases(request: z.infer<typeof previewSchema>): Promise<RunPlan>;
+/**
+ * The only way to run something: a fixed list of actions that map to the repo's own scripts.
+ * Every value that ends up in argv is checked against profiles.yaml or the cases first.
+ */
+export declare function buildJobSpec(request: z.infer<typeof startJobSchema>): JobSpec;

package/dist/ui/server/actions.js

@@ -0,0 +1,365 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { z } from 'zod';
+import { listEnvs, listProfiles, loadProfiles } from '../../lib/profiles.js';
+import { listSuites } from '../../lib/cases.js';
+import { findWriteCases, isProtectedEnv, planRun } from '../../lib/write-gate.js';
+import { scriptArgs } from '../../lib/node-cli.js';
+import { ROOT } from '../../lib/paths.js';
+import { findContinuation } from '../shared/jobs.js';
+import { jobs } from './jobs.js';
+import { verifyProfiles } from './profiles.js';
+import { isValidCaseId, listCaseIds } from './cases.js';
+import { snapshotDirPath, specFilePath } from '../../lib/case-ops.js';
+import { AI_COMMANDS, AI_COMMAND_WRITES, AI_TOOLS, continueCommandLine, continueInvocation, headlessCommandLine, headlessInvocation, HINTS_DIR, HINTS_MAX_CHARS, makeCaseCommandLine, makeCaseInvocation, MEMO_DIR, MEMO_MAX_CHARS, REPLY_DIR, REPLY_MAX_CHARS, } from '../shared/ai-commands.js';
+const REPORTS_DIR = path.join(ROOT, 'reports');
+const REPORT_ID = /^\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}(-[a-z0-9]+(-[a-z0-9]+)*)?$/;
+const newSessionId = (tool) => tool === 'claude' ? crypto.randomUUID() : `ses_${crypto.randomBytes(12).toString('hex')}`;
+export const startJobSchema = z.discriminatedUnion('action', [
+    z.object({ action: z.literal('signin'), profile: z.string().min(1), env: z.string().min(1) }),
+    z.object({ action: z.literal('visit'), profile: z.string().min(1), env: z.string().min(1) }),
+    z.object({
+        action: z.literal('ai'),
+        tool: z.enum(AI_TOOLS),
+        command: z.enum(AI_COMMANDS),
+        caseId: z.string().min(1).max(200),
+        env: z.string().min(1),
+        force: z.boolean().optional(),
+        attended: z.boolean().optional(),
+        thinking: z.boolean().optional(),
+        model: z.string().min(1).max(200).optional(),
+        profiles: z.array(z.string().min(1)).optional(),
+        hints: z.string().max(HINTS_MAX_CHARS).optional(),
+        report: z.string().min(1).max(100).optional(),
+    }),
+    z.object({
+        action: z.literal('continue'),
+        jobId: z.string().min(1).max(40),
+        reply: z.string().trim().min(1).max(REPLY_MAX_CHARS),
+    }),
+    z.object({
+        action: z.literal('make-cases'),
+        tool: z.enum(AI_TOOLS),
+        memo: z.string().max(MEMO_MAX_CHARS),
+        model: z.string().min(1).max(200).optional(),
+        thinking: z.boolean().optional(),
+    }),
+    z.object({
+        action: z.literal('run'),
+        env: z.string().min(1),
+        profiles: z.array(z.string().min(1)).optional(),
+        tags: z.array(z.string().min(1)).optional(),
+        suites: z.array(z.string().min(1)).optional(),
+        grep: z.string().max(200).optional(),
+        stepText: z.boolean().optional(),
+        readOnly: z.boolean().optional(),
+        updateBaselines: z.array(z.string().min(1).max(200)).max(200).optional(),
+        confirmWritesIn: z.string().optional(),
+    }),
+]);
+export const previewSchema = z.object({
+    env: z.string().min(1),
+    profiles: z.array(z.string().min(1)).optional(),
+    tags: z.array(z.string().min(1)).optional(),
+    suites: z.array(z.string().min(1)).optional(),
+    grep: z.string().max(200).optional(),
+    readOnly: z.boolean().optional(),
+});
+export class ActionError extends Error {
+}
+/** The same filters the run will use, so the preview and the real run select the same cases. */
+export function runFilters(request) {
+    const known = loadProfiles();
+    const knownIds = known.map((profile) => profile.id);
+    const profilesInEnv = listProfiles(request.env, known);
+    const candidates = request.tags && request.tags.length > 0
+        ? profilesInEnv.filter((profile) => profile.tags.some((tag) => request.tags.includes(tag)))
+        : profilesInEnv;
+    const available = candidates.map((profile) => profile.id);
+    const selected = request.profiles ?? available;
+    if (selected.some((id) => !knownIds.includes(id) || !available.includes(id))) {
+        throw new ActionError(`Unknown profile for "${request.env}".`);
+    }
+    return {
+        env: request.env,
+        profiles: selected.length < available.length ? selected : null,
+        suites: request.suites ?? [],
+        grep: request.grep,
+        readOnly: request.readOnly ?? false,
+    };
+}
+/** What a run would do: the cases that write data and whether the user has to confirm them first. */
+export function previewRun(request) {
+    if (!listEnvs().includes(request.env))
+        throw new ActionError(`Unknown environment "${request.env}".`);
+    const { writing, skipped } = request.readOnly ? { writing: [], skipped: [] } : findWriteCases(runFilters(request));
+    return {
+        env: request.env,
+        needsConfirmation: writing.length > 0 && isProtectedEnv(request.env),
+        writeCases: writing,
+        skippedWriteCases: skipped,
+    };
+}
+const countBaselines = (caseId) => {
+    const dir = snapshotDirPath(caseId);
+    return fs.existsSync(dir) ? fs.readdirSync(dir).filter((name) => name.toLowerCase().endsWith('.png')).length : 0;
+};
+/** The cases a run with these filters would execute, for the Run page. A failure of the list is reported, not thrown. */
+export async function planRunCases(request) {
+    if (!listEnvs().includes(request.env))
+        throw new ActionError(`Unknown environment "${request.env}".`);
+    try {
+        const cases = (await planRun(runFilters(request))).map((item) => ({ ...item, baselineCount: countBaselines(item.id) }));
+        const running = cases.filter((item) => item.skip === null);
+        return {
+            env: request.env,
+            error: null,
+            totalCases: running.length,
+            totalTests: running.reduce((sum, item) => sum + item.profiles.length, 0),
+            cases,
+        };
+    }
+    catch (error) {
+        if (error instanceof ActionError)
+            throw error;
+        return { env: request.env, error: error.message, totalCases: 0, totalTests: 0, cases: [] };
+    }
+}
+const authLock = (profileId) => `auth:${profileId}`;
+/**
+ * The only way to run something: a fixed list of actions that map to the repo's own scripts.
+ * Every value that ends up in argv is checked against profiles.yaml or the cases first.
+ */
+export function buildJobSpec(request) {
+    const knownProfiles = loadProfiles();
+    const knownProfileIds = knownProfiles.map((profile) => profile.id);
+    const knownEnvs = listEnvs(knownProfiles);
+    const checkProfile = (profileId, env) => {
+        if (!knownProfileIds.includes(profileId))
+            throw new ActionError(`Unknown profile "${profileId}".`);
+        if (!knownEnvs.includes(env))
+            throw new ActionError(`Unknown environment "${env}".`);
+        const profile = knownProfiles.find((candidate) => candidate.id === profileId);
+        if (profile?.env !== env) {
+            throw new ActionError(`Profile "${profileId}" belongs to ${profile?.env ?? 'another environment'}, not "${env}".`);
+        }
+    };
+    const allLocks = () => knownProfiles.map((profile) => authLock(profile.id));
+    if (request.action === 'signin') {
+        checkProfile(request.profile, request.env);
+        return {
+            kind: 'signin',
+            profile: request.profile,
+            env: request.env,
+            command: `pnpm signin ${request.profile}`,
+            file: process.execPath,
+            args: [...scriptArgs('login.ts'), request.profile],
+            locks: [authLock(request.profile)],
+            acceptsInput: true,
+            onFinish: () => void verifyProfiles({ ids: [request.profile] }),
+        };
+    }
+    if (request.action === 'visit') {
+        checkProfile(request.profile, request.env);
+        // Where a login lands is a profile setting (its own home page), not something the UI knows.
+        const startPath = knownProfiles.find((profile) => profile.id === request.profile)?.startPath ?? '';
+        // Only reads the saved session when it starts, so it does not take the auth lock
+        // (that would block test runs for as long as the window stays open).
+        return {
+            kind: 'visit',
+            profile: request.profile,
+            env: request.env,
+            command: ['pnpm explore', request.profile, startPath].filter(Boolean).join(' '),
+            file: process.execPath,
+            args: [...scriptArgs('explore.ts'), request.profile, ...(startPath ? [startPath] : [])],
+            locks: [`visit:${request.profile}`],
+            acceptsInput: false,
+        };
+    }
+    // An AI run on a case, a first turn or a continuation: the same permissions and locks either way.
+    // Generating and healing write the spec and the case values and run the tests, so they must not overlap with a run.
+    // Reviewing only edits the case file and looks at pages, so it takes just the case lock.
+    const aiSpec = (tool, command, caseId, env, sessionId, run, model, thinking) => ({
+        kind: 'ai',
+        env,
+        ...run,
+        locks: [`ai:${caseId}`, ...(AI_COMMAND_WRITES[command] === 'files' ? ['run', ...allLocks()] : [])],
+        acceptsInput: false,
+        stream: tool,
+        ai: { tool, command, caseId, env, sessionId, ...(model && { model }), ...(thinking && { thinking }) },
+    });
+    if (request.action === 'ai') {
+        if (!isValidCaseId(request.caseId) || !listCaseIds().includes(request.caseId)) {
+            throw new ActionError(`Unknown case "${request.caseId}".`);
+        }
+        // The environment is part of the prompt, so it is checked like every other value that reaches argv.
+        // Every command opens real pages, so there is always one and no default.
+        if (!knownEnvs.includes(request.env))
+            throw new ActionError(`Unknown environment "${request.env}".`);
+        // The server picks the conversation id, so the run can be continued after the agent asked its questions.
+        if (request.force && request.command !== 'gen-spec') {
+            throw new ActionError('Only gen-spec can overwrite an existing spec.');
+        }
+        // The agent leaves an existing spec alone unless told to overwrite it, so the user is asked first (the UI shows
+        // a dialog); refusing here saves a run that would do nothing.
+        if (request.command === 'gen-spec' && !request.force && fs.existsSync(specFilePath(request.caseId))) {
+            throw new ActionError(`A spec already exists for "${request.caseId}". Choose overwrite to regenerate it.`);
+        }
+        if (request.attended && request.command !== 'explore-case') {
+            throw new ActionError('Only explore-case can be attended.');
+        }
+        if ((request.profiles || request.hints !== undefined || request.report) && request.command !== 'heal-spec') {
+            throw new ActionError('Only heal-spec takes profiles, hints and a report.');
+        }
+        const profilesInEnv = listProfiles(request.env, knownProfiles).map((profile) => profile.id);
+        if (request.profiles?.some((id) => !profilesInEnv.includes(id))) {
+            throw new ActionError(`Unknown profile for "${request.env}".`);
+        }
+        if (request.profiles?.length === 0)
+            throw new ActionError('Choose at least one profile to heal.');
+        if (request.report !== undefined && !(REPORT_ID.test(request.report) && fs.existsSync(path.join(REPORTS_DIR, request.report, 'summary.json')))) {
+            throw new ActionError(`Unknown report "${request.report}".`);
+        }
+        // The clues are stored as a file so the agent reads them verbatim; the path is generated here, never taken from the browser.
+        let hintsPath;
+        if (request.hints !== undefined && request.hints.trim() !== '') {
+            hintsPath = `${HINTS_DIR}/${new Date().toISOString().replace(/[:.]/g, '-')}-${crypto.randomBytes(3).toString('hex')}.md`;
+            fs.mkdirSync(path.join(ROOT, HINTS_DIR), { recursive: true });
+            fs.writeFileSync(path.join(ROOT, hintsPath), request.hints.trim() + '\n');
+        }
+        const options = {
+            env: request.env,
+            model: request.model,
+            thinking: request.thinking,
+            force: request.force,
+            attended: request.attended,
+            // Naming every profile is the same as leaving it out: the agent then takes all that are logged in.
+            profiles: request.profiles && request.profiles.length < profilesInEnv.length ? request.profiles : undefined,
+            hints: hintsPath,
+            report: request.report,
+        };
+        const session = { id: newSessionId(request.tool), resume: false };
+        const { file, args } = headlessInvocation(request.tool, request.command, request.caseId, options, session);
+        return aiSpec(request.tool, request.command, request.caseId, request.env, session.id, {
+            command: headlessCommandLine(request.tool, request.command, request.caseId, options, session),
+            file,
+            args,
+        }, request.model, request.thinking);
+    }
+    if (request.action === 'continue') {
+        const earlier = jobs.get(request.jobId);
+        const ai = earlier?.spec.ai;
+        if (!earlier || !ai)
+            throw new ActionError('Unknown job, or it was not an AI run on a case.');
+        if (earlier.info.status !== 'succeeded' || earlier.info.resultState !== 'needs-input') {
+            throw new ActionError('Only a run that finished with RESULT: needs-input can be continued.');
+        }
+        if (findContinuation(jobs.list(), earlier.info.id)) {
+            throw new ActionError('This run was already continued. Continue the newer run instead.');
+        }
+        if (!listCaseIds().includes(ai.caseId))
+            throw new ActionError(`The case "${ai.caseId}" no longer exists.`);
+        // The answers are stored as a file so the agent reads them verbatim; a line break or a quote in them cannot
+        // break the command line of the agent CLI.
+        const replyPath = `${REPLY_DIR}/${new Date().toISOString().replace(/[:.]/g, '-')}-${crypto.randomBytes(3).toString('hex')}.md`;
+        fs.mkdirSync(path.join(ROOT, REPLY_DIR), { recursive: true });
+        fs.writeFileSync(path.join(ROOT, replyPath), request.reply.trim() + '\n');
+        // The next turn keeps how the first one was told to run (model and reasoning), so the log stays the same.
+        const { file, args } = continueInvocation(ai.tool, ai.command, replyPath, ai.sessionId, ai.model, ai.thinking);
+        return aiSpec(ai.tool, ai.command, ai.caseId, ai.env, ai.sessionId, {
+            command: continueCommandLine(ai.tool, ai.command, replyPath, ai.sessionId, ai.model, ai.thinking),
+            file,
+            args,
+            continuesJobId: earlier.info.id,
+        }, ai.model, ai.thinking);
+    }
+    if (request.action === 'make-cases') {
+        if (request.memo.trim() === '')
+            throw new ActionError('The memo is empty.');
+        // The memo is stored as a file so the agent reads it verbatim; the path is generated here, never taken from the browser.
+        const memoPath = `${MEMO_DIR}/${new Date().toISOString().replace(/[:.]/g, '-')}-${crypto.randomBytes(3).toString('hex')}.md`;
+        fs.mkdirSync(path.join(ROOT, MEMO_DIR), { recursive: true });
+        fs.writeFileSync(path.join(ROOT, memoPath), request.memo);
+        const { file, args } = makeCaseInvocation(request.tool, memoPath, request.model, request.thinking);
+        return {
+            kind: 'ai',
+            command: makeCaseCommandLine(request.tool, memoPath, request.model, request.thinking),
+            file,
+            args,
+            locks: ['ai:make-cases'],
+            acceptsInput: false,
+            stream: request.tool,
+        };
+    }
+    if (!knownEnvs.includes(request.env))
+        throw new ActionError(`Unknown environment "${request.env}".`);
+    const flags = ['--env', request.env];
+    const profilesInEnv = listProfiles(request.env, knownProfiles);
+    const profilesAvailable = (request.tags && request.tags.length > 0
+        ? profilesInEnv.filter((profile) => profile.tags.some((tag) => request.tags.includes(tag)))
+        : profilesInEnv).map((profile) => profile.id);
+    if (request.profiles) {
+        const unknown = request.profiles.filter((id) => !knownProfileIds.includes(id));
+        if (unknown.length > 0)
+            throw new ActionError(`Unknown profile(s): ${unknown.join(', ')}`);
+        const noEnv = request.profiles.filter((id) => !profilesAvailable.includes(id));
+        if (noEnv.length > 0)
+            throw new ActionError(`No "${request.env}" environment (or tag) for: ${noEnv.join(', ')}`);
+        if (request.profiles.length === 0)
+            throw new ActionError('Select at least one profile.');
+        if (request.profiles.length < profilesAvailable.length) {
+            flags.push('--profile', request.profiles.join(','));
+        }
+    }
+    if (request.tags && request.tags.length > 0)
+        flags.push('--tag', request.tags.join(','));
+    const suites = request.suites ?? [];
+    if (suites.length > 0) {
+        const known = listSuites();
+        const unknown = suites.filter((name) => !known.includes(name));
+        if (unknown.length > 0)
+            throw new ActionError(`Unknown suite: ${unknown.join(', ')}`);
+        flags.push('--suite', suites.join(','));
+    }
+    if (request.readOnly)
+        flags.push('--read-only');
+    const updateBaselines = [...new Set(request.updateBaselines ?? [])];
+    if (updateBaselines.length > 0) {
+        const known = listCaseIds();
+        const unknown = updateBaselines.filter((id) => !isValidCaseId(id) || !known.includes(id) || !fs.existsSync(specFilePath(id)));
+        if (unknown.length > 0)
+            throw new ActionError(`Cannot update the baselines of: ${unknown.join(', ')} (no such case with a spec).`);
+        flags.push('--update-baselines', updateBaselines.join(','));
+    }
+    // Decided here, from the case documents, not from anything the browser says. The confirmation only counts
+    // when it names this exact environment; otherwise the run is refused and the page asks the user.
+    if (!request.readOnly && isProtectedEnv(request.env)) {
+        const writeCases = findWriteCases(runFilters(request)).writing;
+        if (writeCases.length > 0) {
+            if (request.confirmWritesIn !== request.env) {
+                throw new ActionError(`${writeCases.length} case(s) write data in ${request.env.toUpperCase()}: confirm them, or run read-only.`);
+            }
+            flags.push(`--allow-writes=${request.env}`);
+        }
+    }
+    if (request.grep)
+        flags.push(`--grep=${request.grep}`);
+    if (request.stepText)
+        flags.push('--step-text');
+    // The folder of the report is chosen here, so the job can link to it while the run is still going.
+    const reportId = `${new Date().toISOString().replace(/[:.]/g, '-').slice(0, 19)}-${request.env}`;
+    const displayFlags = flags.map((flag) => (/^[\w@=,.:/-]+$/.test(flag) ? flag : JSON.stringify(flag)));
+    return {
+        kind: 'run',
+        env: request.env,
+        command: ['pnpm asrun', ...displayFlags].join(' '),
+        file: process.execPath,
+        args: [...scriptArgs('run.ts'), ...flags, '--report-id', reportId],
+        reportId,
+        locks: ['run', ...allLocks()],
+        acceptsInput: false,
+        ...(updateBaselines.length > 0 && { baselineCases: updateBaselines }),
+        onFinish: () => void verifyProfiles({ env: request.env }),
+    };
+}

package/dist/ui/server/ai-models.d.ts

@@ -0,0 +1,3 @@
+import type { AiTool } from '../shared/ai-commands.js';
+import type { AiModelsResponse } from '../shared/types.js';
+export declare function listAiModels(tool: AiTool, refresh?: boolean): Promise<AiModelsResponse>;