@automatify-au/cli 0.1.16 → 0.1.17

package/dist/automatify.cjs

@@ -2894,8 +2894,8 @@ var require_utils = __commonJS({
       var result = transform[inputType][outputType](input);
       return result;
     };
-    exports2.resolve = function(path16) {
-      var parts = path16.split("/");
+    exports2.resolve = function(path17) {
+      var parts = path17.split("/");
       var result = [];
       for (var index = 0; index < parts.length; index++) {
         var part = parts[index];
@@ -8748,18 +8748,18 @@ var require_object = __commonJS({
       var object = new ZipObject(name, zipObjectContent, o);
       this.files[name] = object;
     };
-    var parentFolder = function(path16) {
-      if (path16.slice(-1) === "/") {
-        path16 = path16.substring(0, path16.length - 1);
+    var parentFolder = function(path17) {
+      if (path17.slice(-1) === "/") {
+        path17 = path17.substring(0, path17.length - 1);
       }
-      var lastSlash = path16.lastIndexOf("/");
-      return lastSlash > 0 ? path16.substring(0, lastSlash) : "";
+      var lastSlash = path17.lastIndexOf("/");
+      return lastSlash > 0 ? path17.substring(0, lastSlash) : "";
     };
-    var forceTrailingSlash = function(path16) {
-      if (path16.slice(-1) !== "/") {
-        path16 += "/";
+    var forceTrailingSlash = function(path17) {
+      if (path17.slice(-1) !== "/") {
+        path17 += "/";
       }
-      return path16;
+      return path17;
     };
     var folderAdd = function(name, createFolders) {
       createFolders = typeof createFolders !== "undefined" ? createFolders : defaults.createFolders;
@@ -10720,8 +10720,8 @@ function toJsonLine(data) {
 }
 
 // src/auto.ts
-var import_node_fs4 = require("node:fs");
-var import_node_path5 = __toESM(require("node:path"), 1);
+var import_node_fs5 = require("node:fs");
+var import_node_path6 = __toESM(require("node:path"), 1);
 
 // ../../packages/shared-types/dist/entitlements.js
 var UNLIMITED_ACTIVE_USERS = Number.MAX_SAFE_INTEGER;
@@ -10764,12 +10764,19 @@ var Priority;
 })(Priority || (Priority = {}));
 
 // src/config.ts
-var import_node_fs = require("node:fs");
-var import_node_path = __toESM(require("node:path"), 1);
+var import_node_fs2 = require("node:fs");
+var import_node_path2 = __toESM(require("node:path"), 1);
 
 // src/secureStore.ts
 var import_node_child_process = require("node:child_process");
+var import_node_crypto = require("node:crypto");
+var import_node_fs = require("node:fs");
+var import_node_path = __toESM(require("node:path"), 1);
 var KEYCHAIN_SERVICE = "automatify-testops-cli";
+var LINUX_SECURE_STORE_ENV = "TESTOPS_LINUX_SECURE_STORE";
+var LINUX_PROTECTED_PREFIX = "linux-aes-gcm-v1";
+var LINUX_JIRA_ACCOUNT_SUFFIX = ":jiraApiToken";
+var LINUX_KEY_FILENAME = ".testops-cli.key";
 function errorText(error) {
   return error instanceof Error && error.message ? error.message : "unknown secure-storage error";
 }
@@ -10809,11 +10816,85 @@ function macOSKeychainWriteInput(account, value) {
     quoteSecurityInteractiveArg(value)
   ].join(" ") + "\n";
 }
+function linuxSecureStoreEnabled() {
+  return process.env[LINUX_SECURE_STORE_ENV]?.trim() === "1";
+}
+function isLinuxProtectedValue(value) {
+  return Boolean(value?.startsWith(`${LINUX_PROTECTED_PREFIX}.`));
+}
+function linuxConfigPathForAccount(account) {
+  const normalized = account.endsWith(LINUX_JIRA_ACCOUNT_SUFFIX) ? account.slice(0, -LINUX_JIRA_ACCOUNT_SUFFIX.length) : account;
+  return import_node_path.default.resolve(normalized);
+}
+function linuxKeyPathForAccount(account) {
+  return import_node_path.default.join(import_node_path.default.dirname(linuxConfigPathForAccount(account)), LINUX_KEY_FILENAME);
+}
+function readLinuxKey(keyPath) {
+  const key = (0, import_node_fs.readFileSync)(keyPath);
+  if (key.length !== 32) {
+    throw new Error(`Linux secure-store key at ${keyPath} must be exactly 32 bytes.`);
+  }
+  return key;
+}
+function readOrCreateLinuxKey(keyPath) {
+  const directory = import_node_path.default.dirname(keyPath);
+  (0, import_node_fs.mkdirSync)(directory, { recursive: true, mode: 448 });
+  (0, import_node_fs.chmodSync)(directory, 448);
+  if ((0, import_node_fs.existsSync)(keyPath)) {
+    (0, import_node_fs.chmodSync)(keyPath, 384);
+    return readLinuxKey(keyPath);
+  }
+  const key = (0, import_node_crypto.randomBytes)(32);
+  try {
+    (0, import_node_fs.writeFileSync)(keyPath, key, { flag: "wx", mode: 384 });
+  } catch (error) {
+    if (error.code !== "EEXIST") {
+      throw error;
+    }
+  }
+  (0, import_node_fs.chmodSync)(keyPath, 384);
+  return readLinuxKey(keyPath);
+}
+function protectLinuxSecret(account, value) {
+  const keyPath = linuxKeyPathForAccount(account);
+  const key = readOrCreateLinuxKey(keyPath);
+  const iv = (0, import_node_crypto.randomBytes)(12);
+  const cipher = (0, import_node_crypto.createCipheriv)("aes-256-gcm", key, iv);
+  const ciphertext = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  const encodedKeyPath = Buffer.from(keyPath, "utf8").toString("base64url");
+  return [
+    LINUX_PROTECTED_PREFIX,
+    encodedKeyPath,
+    iv.toString("base64url"),
+    tag.toString("base64url"),
+    ciphertext.toString("base64url")
+  ].join(".");
+}
+function unprotectLinuxSecret(protectedValue) {
+  const parts = protectedValue.split(".");
+  if (parts.length !== 5 || parts[0] !== LINUX_PROTECTED_PREFIX) {
+    throw new Error("Unsupported Linux secure-store payload.");
+  }
+  const [, encodedKeyPath, encodedIv, encodedTag, encodedCiphertext] = parts;
+  const keyPath = Buffer.from(encodedKeyPath, "base64url").toString("utf8");
+  const key = readLinuxKey(keyPath);
+  const decipher = (0, import_node_crypto.createDecipheriv)("aes-256-gcm", key, Buffer.from(encodedIv, "base64url"));
+  decipher.setAuthTag(Buffer.from(encodedTag, "base64url"));
+  const plaintext = Buffer.concat([decipher.update(Buffer.from(encodedCiphertext, "base64url")), decipher.final()]);
+  return plaintext.toString("utf8");
+}
 function readSecureSecret(locator, deps = {}) {
   const platform = deps.platform ?? process.platform;
   const run = deps.execFileSync ?? import_node_child_process.execFileSync;
   if (platform === "darwin") {
     if (!locator.account) {
+      if (isLinuxProtectedValue(locator.protectedValue)) {
+        return {
+          status: "error",
+          message: "This config contains a Linux encrypted local-store value, but it is being read on macOS. Re-store the secret on this machine."
+        };
+      }
       return locator.protectedValue ? {
         status: "error",
         message: "This config contains a Windows DPAPI value, but it is being read on macOS. Re-store the secret on this machine."
@@ -10836,6 +10917,12 @@ function readSecureSecret(locator, deps = {}) {
     }
   }
   if (platform === "win32") {
+    if (isLinuxProtectedValue(locator.protectedValue)) {
+      return {
+        status: "error",
+        message: "This config contains a Linux encrypted local-store value, but it is being read on Windows. Re-store the secret for the current Windows user."
+      };
+    }
     if (!locator.protectedValue) {
       return locator.account ? {
         status: "error",
@@ -10855,14 +10942,40 @@ function readSecureSecret(locator, deps = {}) {
     } catch (error) {
       return {
         status: "error",
-        message: `Unable to decrypt the Windows DPAPI value for the current user: ${errorText(error)}. Re-store the secret.`
+        message: `Unable to decrypt the Windows DPAPI value for the current user: ${errorText(error)}. Re-store the secret for the current Windows user.`
+      };
+    }
+  }
+  if (platform === "linux" && linuxSecureStoreEnabled()) {
+    if (locator.account && !locator.protectedValue) {
+      return {
+        status: "error",
+        message: "This config references a macOS Keychain secret, but it is being read on Linux. Re-store the secret on this machine."
+      };
+    }
+    if (!locator.protectedValue) {
+      return { status: "missing" };
+    }
+    if (!isLinuxProtectedValue(locator.protectedValue)) {
+      return {
+        status: "error",
+        message: "This config contains a foreign protected value that cannot be decrypted by the Linux local store. Re-store the secret on this machine."
+      };
+    }
+    try {
+      const value = unprotectLinuxSecret(locator.protectedValue);
+      return value ? { status: "available", value, source: "secure-store" } : { status: "error", message: "Linux encrypted local store returned an empty value. Re-store the secret." };
+    } catch (error) {
+      return {
+        status: "error",
+        message: `Unable to decrypt the Linux encrypted local-store value: ${errorText(error)} Re-store the secret.`
       };
     }
   }
   if (locator.account || locator.protectedValue) {
     return {
       status: "error",
-      message: "This config contains local secure-store metadata, but local secure storage is supported only on macOS and Windows. Use an environment variable on Linux/CI."
+      message: "This config contains local secure-store metadata, but local secure storage is disabled on Linux/CI. Use environment variables or explicitly enable TESTOPS_LINUX_SECURE_STORE=1 on a trusted persistent Linux host."
     };
   }
   return { status: "missing" };
@@ -10898,8 +11011,15 @@ function writeSecureSecret(account, value, deps = {}) {
     }
     return { source: "secure-store", protectedValue };
   }
+  if (platform === "linux" && linuxSecureStoreEnabled()) {
+    try {
+      return { source: "secure-store", protectedValue: protectLinuxSecret(account, value) };
+    } catch {
+      throw new Error("Unable to store the secret in the Linux encrypted local store.");
+    }
+  }
   throw new Error(
-    "Secure local secret storage is supported on macOS and Windows only. On Linux/CI, keep secrets in environment variables."
+    "Secure local secret storage is supported on macOS and Windows. On trusted persistent Linux hosts, set TESTOPS_LINUX_SECURE_STORE=1; otherwise keep secrets in environment variables."
   );
 }
 function deleteSecureSecret(locator, deps = {}) {
@@ -10924,6 +11044,9 @@ function deleteSecureSecret(locator, deps = {}) {
   if (platform === "win32") {
     return locator.protectedValue ? { status: "deleted" } : { status: "missing" };
   }
+  if (platform === "linux") {
+    return locator.account || locator.protectedValue ? { status: "deleted" } : { status: "missing" };
+  }
   return locator.account || locator.protectedValue ? { status: "deleted" } : { status: "missing" };
 }
 
@@ -10972,11 +11095,11 @@ function firstStringValue(...values) {
   return "";
 }
 function readConfigFile(configPath) {
-  if (!(0, import_node_fs.existsSync)(configPath)) {
+  if (!(0, import_node_fs2.existsSync)(configPath)) {
     return {};
   }
   try {
-    const raw = (0, import_node_fs.readFileSync)(configPath, "utf8");
+    const raw = (0, import_node_fs2.readFileSync)(configPath, "utf8");
     const parsed = JSON.parse(raw);
     return typeof parsed === "object" && parsed !== null ? parsed : {};
   } catch {
@@ -10984,11 +11107,11 @@ function readConfigFile(configPath) {
   }
 }
 function readConfigFileForMutation(configPath) {
-  if (!(0, import_node_fs.existsSync)(configPath)) {
+  if (!(0, import_node_fs2.existsSync)(configPath)) {
     return { file: {} };
   }
   try {
-    const raw = (0, import_node_fs.readFileSync)(configPath, "utf8");
+    const raw = (0, import_node_fs2.readFileSync)(configPath, "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
       return {
@@ -11005,10 +11128,10 @@ function readConfigFileForMutation(configPath) {
   }
 }
 function writeConfigFile(configPath, file) {
-  (0, import_node_fs.writeFileSync)(configPath, `${JSON.stringify(file, null, 2)}
+  (0, import_node_fs2.writeFileSync)(configPath, `${JSON.stringify(file, null, 2)}
 `, "utf8");
   if (process.platform !== "win32") {
-    (0, import_node_fs.chmodSync)(configPath, 384);
+    (0, import_node_fs2.chmodSync)(configPath, 384);
   }
 }
 function normalizeBaseUrl(value) {
@@ -11021,10 +11144,10 @@ function readAuthMode(input) {
   return input === "api-token" ? "api-token" : "none";
 }
 function defaultKeychainAccount(configPath) {
-  return import_node_path.default.resolve(configPath);
+  return import_node_path2.default.resolve(configPath);
 }
 function defaultJiraApiTokenKeychainAccount(configPath) {
-  return `${import_node_path.default.resolve(configPath)}:jiraApiToken`;
+  return `${import_node_path2.default.resolve(configPath)}:jiraApiToken`;
 }
 function valueFromPrecedence(key, flagValue, envValue, fileValue, fallback = "") {
   if (flagValue) {
@@ -11101,9 +11224,9 @@ function clearSecretFields(file, key) {
 }
 function resolveCliConfig(args, env = process.env, cwd = process.cwd()) {
   const { flags, unknownFlags } = parseFlags(args);
-  const configPathFlag = flags["--config"] ? import_node_path.default.resolve(cwd, flags["--config"]) : "";
+  const configPathFlag = flags["--config"] ? import_node_path2.default.resolve(cwd, flags["--config"]) : "";
   const configPathEnv = toStringValue(env.TESTOPS_CONFIG_PATH);
-  const configPath = configPathFlag || (configPathEnv ? import_node_path.default.resolve(cwd, configPathEnv) : import_node_path.default.resolve(cwd, DEFAULT_CONFIG_FILENAME));
+  const configPath = configPathFlag || (configPathEnv ? import_node_path2.default.resolve(cwd, configPathEnv) : import_node_path2.default.resolve(cwd, DEFAULT_CONFIG_FILENAME));
   const configPathSource = configPathFlag ? "flag" : configPathEnv ? "env" : "default";
   const file = readConfigFile(configPath);
   const baseUrlResolved = valueFromPrecedence(
@@ -11194,7 +11317,7 @@ function resolveCliConfig(args, env = process.env, cwd = process.cwd()) {
   if (unknownFlags.length > 0) {
     warnings.push(`Ignored unknown config flags: ${unknownFlags.join(", ")}`);
   }
-  if (!(0, import_node_fs.existsSync)(configPath) && sources.configPath !== "default") {
+  if (!(0, import_node_fs2.existsSync)(configPath) && sources.configPath !== "default") {
     warnings.push(`Config file not found at ${configPath}; using env/flags/defaults.`);
   }
   return { values: config, sources, warnings, errors };
@@ -11458,7 +11581,7 @@ function createConfigHandler(env = process.env, cwd = process.cwd()) {
       const [key, ...valueParts] = stripConfigPathArgs(subArgs);
       const normalizedKey = normalizeConfigSetKey(key ?? "");
       const readValueFromStdin = (normalizedKey === "forgeAuthToken" || normalizedKey === "jiraApiToken") && valueParts.length === 1 && valueParts[0] === "--stdin";
-      const value = readValueFromStdin ? (0, import_node_fs.readFileSync)(0, "utf8").trim() : valueParts.join(" ").trim();
+      const value = readValueFromStdin ? (0, import_node_fs2.readFileSync)(0, "utf8").trim() : valueParts.join(" ").trim();
       if (!key || !value) {
         return {
           exitCode: ExitCode.UsageError,
@@ -11773,7 +11896,7 @@ function diagExecutionNoWork() {
 }
 
 // src/autoDiscover.ts
-var import_node_path2 = __toESM(require("node:path"), 1);
+var import_node_path3 = __toESM(require("node:path"), 1);
 var RESULT_FOLDER_NAMES = /* @__PURE__ */ new Set([
   "results",
   "result",
@@ -11785,7 +11908,7 @@ var RESULT_FOLDER_NAMES = /* @__PURE__ */ new Set([
   "failsafe-reports"
 ]);
 function toPosix2(value) {
-  return value.split(import_node_path2.default.sep).join("/");
+  return value.split(import_node_path3.default.sep).join("/");
 }
 function isJUnitXmlArtifact(filePath) {
   const normalized = toPosix2(filePath);
@@ -11879,8 +12002,8 @@ function discoverFeatureFiles(scannedFiles) {
 }
 
 // src/autoMapping.ts
-var import_node_fs2 = require("node:fs");
-var import_node_path3 = __toESM(require("node:path"), 1);
+var import_node_fs3 = require("node:fs");
+var import_node_path4 = __toESM(require("node:path"), 1);
 var ISSUE_KEY_REGEX = /\b[A-Z][A-Z0-9]+-\d+\b/g;
 function normalizeName(value) {
   return value.trim().toLowerCase();
@@ -11890,10 +12013,10 @@ function extractIssueKeysFromText(text) {
   return [...new Set(found)].sort((a, b) => a.localeCompare(b));
 }
 function parseFeatureFile(featureAbsolutePath) {
-  if (!(0, import_node_fs2.existsSync)(featureAbsolutePath)) {
+  if (!(0, import_node_fs3.existsSync)(featureAbsolutePath)) {
     return { names: [], issueKeys: [] };
   }
-  const raw = (0, import_node_fs2.readFileSync)(featureAbsolutePath, "utf8");
+  const raw = (0, import_node_fs3.readFileSync)(featureAbsolutePath, "utf8");
   const lines = raw.split(/\r?\n/);
   const names = /* @__PURE__ */ new Set();
   const issueKeys = new Set(extractIssueKeysFromText(raw));
@@ -11951,7 +12074,7 @@ function buildMappingPreview(input) {
   const localNamesSet = /* @__PURE__ */ new Set();
   const issueCandidatesSet = /* @__PURE__ */ new Set();
   for (const featurePath of input.featurePaths) {
-    const absolutePath = import_node_path3.default.join(input.rootPath, featurePath);
+    const absolutePath = import_node_path4.default.join(input.rootPath, featurePath);
     const parsed = parseFeatureFile(absolutePath);
     for (const name of parsed.names) {
       localNamesSet.add(name);
@@ -12000,8 +12123,8 @@ function buildMappingPreview(input) {
 }
 
 // src/autoScanner.ts
-var import_node_fs3 = require("node:fs");
-var import_node_path4 = __toESM(require("node:path"), 1);
+var import_node_fs4 = require("node:fs");
+var import_node_path5 = __toESM(require("node:path"), 1);
 var DEFAULT_MAX_DEPTH = 5;
 var DEFAULT_EXCLUDED_DIRECTORIES = /* @__PURE__ */ new Set([
   ".cache",
@@ -12016,7 +12139,7 @@ var DEFAULT_EXCLUDED_DIRECTORIES = /* @__PURE__ */ new Set([
   "node_modules"
 ]);
 function normalizeRelativePath(value) {
-  return value.split(import_node_path4.default.sep).join("/");
+  return value.split(import_node_path5.default.sep).join("/");
 }
 function normalizePatterns(values) {
   if (!values) {
@@ -12070,16 +12193,16 @@ function scanProjectFiles(options) {
   const includePatterns = normalizePatterns(options.includePatterns);
   const excludePatterns = normalizePatterns(options.excludePatterns);
   const maxDepth = safeMaxDepth(options.maxDepth);
-  const rootPath = import_node_path4.default.resolve(options.rootPath);
+  const rootPath = import_node_path5.default.resolve(options.rootPath);
   const scannedFiles = [];
   const visit = (absoluteDirectory, depth) => {
     if (depth > maxDepth) {
       return;
     }
-    const entries = (0, import_node_fs3.readdirSync)(absoluteDirectory, { withFileTypes: true }).slice().sort((a, b) => a.name.localeCompare(b.name));
+    const entries = (0, import_node_fs4.readdirSync)(absoluteDirectory, { withFileTypes: true }).slice().sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
-      const absoluteEntryPath = import_node_path4.default.join(absoluteDirectory, entry.name);
-      const relativeEntryPath = normalizeRelativePath(import_node_path4.default.relative(rootPath, absoluteEntryPath));
+      const absoluteEntryPath = import_node_path5.default.join(absoluteDirectory, entry.name);
+      const relativeEntryPath = normalizeRelativePath(import_node_path5.default.relative(rootPath, absoluteEntryPath));
       if (!relativeEntryPath) {
         continue;
       }
@@ -12181,10 +12304,10 @@ function resolveRoot(rootFlag, cwd) {
   if (!rootFlag.trim()) {
     return cwd;
   }
-  return import_node_path5.default.resolve(cwd, rootFlag);
+  return import_node_path6.default.resolve(cwd, rootFlag);
 }
 function countScenariosInFeatureFile(featurePath) {
-  const lines = (0, import_node_fs4.readFileSync)(featurePath, "utf8").split(/\r?\n/).map((line) => line.trim().toLowerCase());
+  const lines = (0, import_node_fs5.readFileSync)(featurePath, "utf8").split(/\r?\n/).map((line) => line.trim().toLowerCase());
   let count = 0;
   for (const line of lines) {
     if (line.startsWith("scenario:") || line.startsWith("scenario outline:")) {
@@ -12196,8 +12319,8 @@ function countScenariosInFeatureFile(featurePath) {
 function buildScenarioStats(rootPath, featurePaths) {
   let scenarios = 0;
   for (const relativePath of featurePaths) {
-    const absolutePath = import_node_path5.default.join(rootPath, relativePath);
-    if (!(0, import_node_fs4.existsSync)(absolutePath)) {
+    const absolutePath = import_node_path6.default.join(rootPath, relativePath);
+    if (!(0, import_node_fs5.existsSync)(absolutePath)) {
       continue;
     }
     scenarios += countScenariosInFeatureFile(absolutePath);
@@ -12237,7 +12360,7 @@ function deriveFeatureNameFromGherkin(gherkin, fallbackPath) {
       return match[1].trim();
     }
   }
-  return import_node_path5.default.basename(fallbackPath, import_node_path5.default.extname(fallbackPath));
+  return import_node_path6.default.basename(fallbackPath, import_node_path6.default.extname(fallbackPath));
 }
 function mapStepStatus(status) {
   const normalized = status.trim().toLowerCase();
@@ -12253,13 +12376,13 @@ function mapStepStatus(status) {
   return StepResult.Blocked;
 }
 function parseCucumberRunsFromArtifact(rootPath, artifactPath) {
-  const absolutePath = import_node_path5.default.join(rootPath, artifactPath);
-  if (!(0, import_node_fs4.existsSync)(absolutePath)) {
+  const absolutePath = import_node_path6.default.join(rootPath, artifactPath);
+  if (!(0, import_node_fs5.existsSync)(absolutePath)) {
     return [];
   }
   let parsed;
   try {
-    parsed = JSON.parse((0, import_node_fs4.readFileSync)(absolutePath, "utf8"));
+    parsed = JSON.parse((0, import_node_fs5.readFileSync)(absolutePath, "utf8"));
   } catch {
     return [];
   }
@@ -12354,15 +12477,15 @@ async function executeUploadFlow(input) {
   const diagnostics = [];
   const orderedFeatures = [...input.featurePaths].sort((a, b) => a.localeCompare(b));
   for (const featurePath of orderedFeatures) {
-    const absolutePath = import_node_path5.default.join(input.rootPath, featurePath);
-    if (!(0, import_node_fs4.existsSync)(absolutePath)) {
+    const absolutePath = import_node_path6.default.join(input.rootPath, featurePath);
+    if (!(0, import_node_fs5.existsSync)(absolutePath)) {
       featureFailed += 1;
       const diagnostic = diagUploadFeatureFailure(featurePath, "missing feature file");
       errors.push(diagnostic.message);
       diagnostics.push(diagnostic);
       continue;
     }
-    const gherkin = (0, import_node_fs4.readFileSync)(absolutePath, "utf8");
+    const gherkin = (0, import_node_fs5.readFileSync)(absolutePath, "utf8");
     const name = deriveFeatureNameFromGherkin(gherkin, featurePath);
     const payload = {
       context: {
@@ -12701,7 +12824,7 @@ function createAutoHandler(deps = {}) {
         stderr: ["ERROR: --output must be either 'plain' or 'json'."]
       };
     }
-    if (!(0, import_node_fs4.existsSync)(rootPath)) {
+    if (!(0, import_node_fs5.existsSync)(rootPath)) {
       return {
         exitCode: ExitCode.ValidationError,
         stderr: [`ERROR: Root path does not exist: ${rootPath}`]
@@ -12804,8 +12927,8 @@ function createAutoHandler(deps = {}) {
 }
 
 // src/allure.ts
-var import_node_path10 = __toESM(require("node:path"), 1);
-var import_node_fs9 = require("node:fs");
+var import_node_path11 = __toESM(require("node:path"), 1);
+var import_node_fs10 = require("node:fs");
 
 // ../../packages/jira-client/dist/adf.js
 function paragraph(text = "") {
@@ -12851,8 +12974,8 @@ function buildAllureEvidenceCommentAdf(input) {
 }
 
 // ../../packages/jira-client/dist/jiraClient.js
-var import_node_fs5 = require("node:fs");
-var import_node_path6 = __toESM(require("node:path"), 1);
+var import_node_fs6 = require("node:fs");
+var import_node_path7 = __toESM(require("node:path"), 1);
 function normalizeSite(site) {
   return site.trim().replace(/\/+$/, "");
 }
@@ -12865,10 +12988,10 @@ async function readError(response) {
 }
 async function uploadIssueAttachment(params) {
   const site = normalizeSite(params.site);
-  const filename = import_node_path6.default.basename(params.filePath);
-  const fileStat = (0, import_node_fs5.statSync)(params.filePath);
+  const filename = import_node_path7.default.basename(params.filePath);
+  const fileStat = (0, import_node_fs6.statSync)(params.filePath);
   const body = new FormData();
-  const fileBuffer = (0, import_node_fs5.readFileSync)(params.filePath);
+  const fileBuffer = (0, import_node_fs6.readFileSync)(params.filePath);
   body.append("file", new Blob([new Uint8Array(fileBuffer)], { type: "application/zip" }), filename);
   const response = await fetch(`${site}/rest/api/3/issue/${encodeURIComponent(params.issueKey)}/attachments`, {
     method: "POST",
@@ -12937,7 +13060,7 @@ async function downloadIssueAttachment(params) {
     throw new Error(`Jira attachment download failed: ${await readError(response)}`);
   }
   const bytes = new Uint8Array(await response.arrayBuffer());
-  (0, import_node_fs5.writeFileSync)(params.outputPath, bytes);
+  (0, import_node_fs6.writeFileSync)(params.outputPath, bytes);
   return {
     filename: params.attachment.filename,
     id: params.attachment.id,
@@ -12977,8 +13100,8 @@ async function addIssueComment(params) {
 }
 
 // ../../packages/allure-core/dist/parseAllureZip.js
-var import_node_fs6 = require("node:fs");
-var import_node_path7 = __toESM(require("node:path"), 1);
+var import_node_fs7 = require("node:fs");
+var import_node_path8 = __toESM(require("node:path"), 1);
 var import_jszip = __toESM(require_lib3(), 1);
 var SUMMARY_PATH_SUFFIX = "/widgets/summary.json";
 var MISSING_SUMMARY_ERROR = "Could not find widgets/summary.json. Please upload a generated Allure HTML report ZIP, not raw allure-results.";
@@ -13006,13 +13129,13 @@ function parseCounts(summary) {
   };
 }
 async function parseAllureReportZip(zipPath) {
-  if (!(0, import_node_fs6.existsSync)(zipPath)) {
+  if (!(0, import_node_fs7.existsSync)(zipPath)) {
     throw new Error(`Allure report ZIP not found: ${zipPath}`);
   }
-  if (import_node_path7.default.extname(zipPath).toLowerCase() !== ".zip") {
+  if (import_node_path8.default.extname(zipPath).toLowerCase() !== ".zip") {
     throw new Error("Allure report must be a .zip file.");
   }
-  const zip = await import_jszip.default.loadAsync((0, import_node_fs6.readFileSync)(zipPath));
+  const zip = await import_jszip.default.loadAsync((0, import_node_fs7.readFileSync)(zipPath));
   const filePaths = Object.keys(zip.files).filter((entryPath) => !zip.files[entryPath]?.dir);
   const summaryPath = findSummaryPath(filePaths);
   if (!summaryPath) {
@@ -13039,8 +13162,8 @@ async function parseAllureReportZip(zipPath) {
 }
 
 // ../../packages/allure-core/dist/extractAllureZip.js
-var import_node_fs7 = require("node:fs");
-var import_node_path8 = __toESM(require("node:path"), 1);
+var import_node_fs8 = require("node:fs");
+var import_node_path9 = __toESM(require("node:path"), 1);
 var import_jszip2 = __toESM(require_lib3(), 1);
 var INDEX_HTML = "index.html";
 var MISSING_INDEX_ERROR = "Could not find index.html. Please provide a generated Allure HTML report ZIP, not raw allure-results.";
@@ -13048,41 +13171,41 @@ function findIndexEntry(paths) {
   return paths.find((entryPath) => entryPath === INDEX_HTML) ?? paths.find((entryPath) => entryPath === `allure-report/${INDEX_HTML}`) ?? paths.find((entryPath) => entryPath.endsWith(`/${INDEX_HTML}`));
 }
 function ensureInsideRoot(rootDir, candidate) {
-  const resolved = import_node_path8.default.resolve(rootDir, candidate);
-  const rootWithSep = rootDir.endsWith(import_node_path8.default.sep) ? rootDir : rootDir + import_node_path8.default.sep;
+  const resolved = import_node_path9.default.resolve(rootDir, candidate);
+  const rootWithSep = rootDir.endsWith(import_node_path9.default.sep) ? rootDir : rootDir + import_node_path9.default.sep;
   if (resolved !== rootDir && !resolved.startsWith(rootWithSep)) {
     throw new Error(`Refusing to write zip entry outside extract directory: ${candidate}`);
   }
   return resolved;
 }
 async function extractAllureReportZip(zipPath, extractDir) {
-  if (!(0, import_node_fs7.existsSync)(zipPath)) {
+  if (!(0, import_node_fs8.existsSync)(zipPath)) {
     throw new Error(`Allure report ZIP not found: ${zipPath}`);
   }
-  if (import_node_path8.default.extname(zipPath).toLowerCase() !== ".zip") {
+  if (import_node_path9.default.extname(zipPath).toLowerCase() !== ".zip") {
     throw new Error("Allure report must be a .zip file.");
   }
-  const zip = await import_jszip2.default.loadAsync((0, import_node_fs7.readFileSync)(zipPath));
+  const zip = await import_jszip2.default.loadAsync((0, import_node_fs8.readFileSync)(zipPath));
   const entries = Object.entries(zip.files);
   const filePaths = entries.filter(([, file]) => !file.dir).map(([entryPath]) => entryPath);
   const indexEntry = findIndexEntry(filePaths);
   if (!indexEntry) {
     throw new Error(MISSING_INDEX_ERROR);
   }
-  const resolvedExtract = import_node_path8.default.resolve(extractDir);
-  (0, import_node_fs7.mkdirSync)(resolvedExtract, { recursive: true });
+  const resolvedExtract = import_node_path9.default.resolve(extractDir);
+  (0, import_node_fs8.mkdirSync)(resolvedExtract, { recursive: true });
   for (const [entryPath, file] of entries) {
     const target = ensureInsideRoot(resolvedExtract, entryPath);
     if (file.dir) {
-      (0, import_node_fs7.mkdirSync)(target, { recursive: true });
+      (0, import_node_fs8.mkdirSync)(target, { recursive: true });
       continue;
     }
-    (0, import_node_fs7.mkdirSync)(import_node_path8.default.dirname(target), { recursive: true });
+    (0, import_node_fs8.mkdirSync)(import_node_path9.default.dirname(target), { recursive: true });
     const buffer = await file.async("nodebuffer");
-    (0, import_node_fs7.writeFileSync)(target, buffer);
+    (0, import_node_fs8.writeFileSync)(target, buffer);
   }
-  const indexAbsolute = import_node_path8.default.join(resolvedExtract, indexEntry);
-  const rootDir = import_node_path8.default.dirname(indexAbsolute);
+  const indexAbsolute = import_node_path9.default.join(resolvedExtract, indexEntry);
+  const rootDir = import_node_path9.default.dirname(indexAbsolute);
   return {
     zipPath,
     extractDir: resolvedExtract,
@@ -13095,11 +13218,11 @@ async function extractAllureReportZip(zipPath, extractDir) {
 var import_jszip3 = __toESM(require_lib3(), 1);
 
 // src/allureOpen.ts
-var import_node_fs8 = require("node:fs");
+var import_node_fs9 = require("node:fs");
 var import_promises = require("node:fs/promises");
 var import_node_http = __toESM(require("node:http"), 1);
 var import_node_os = require("node:os");
-var import_node_path9 = __toESM(require("node:path"), 1);
+var import_node_path10 = __toESM(require("node:path"), 1);
 var import_node_child_process2 = require("node:child_process");
 function parseArgs2(args) {
   const positionals = [];
@@ -13168,7 +13291,7 @@ var MIME_TYPES = {
   ".txt": "text/plain; charset=utf-8"
 };
 function contentTypeFor(filePath) {
-  return MIME_TYPES[import_node_path9.default.extname(filePath).toLowerCase()] ?? "application/octet-stream";
+  return MIME_TYPES[import_node_path10.default.extname(filePath).toLowerCase()] ?? "application/octet-stream";
 }
 function resolveRequestedPath(rootDir, urlPath) {
   let decoded;
@@ -13177,10 +13300,10 @@ function resolveRequestedPath(rootDir, urlPath) {
   } catch {
     return void 0;
   }
-  const normalized = import_node_path9.default.normalize(decoded);
+  const normalized = import_node_path10.default.normalize(decoded);
   const trimmed = normalized.replace(/^[/\\]+/, "");
-  const candidate = import_node_path9.default.resolve(rootDir, trimmed);
-  const rootWithSep = rootDir.endsWith(import_node_path9.default.sep) ? rootDir : rootDir + import_node_path9.default.sep;
+  const candidate = import_node_path10.default.resolve(rootDir, trimmed);
+  const rootWithSep = rootDir.endsWith(import_node_path10.default.sep) ? rootDir : rootDir + import_node_path10.default.sep;
   if (candidate !== rootDir && !candidate.startsWith(rootWithSep)) {
     return void 0;
   }
@@ -13202,16 +13325,16 @@ function createStaticServerStarter() {
       }
       let target = resolved;
       try {
-        const stat = (0, import_node_fs8.statSync)(target);
+        const stat = (0, import_node_fs9.statSync)(target);
         if (stat.isDirectory()) {
-          target = import_node_path9.default.join(target, "index.html");
+          target = import_node_path10.default.join(target, "index.html");
         }
       } catch {
         res.statusCode = 404;
         res.end("Not Found");
         return;
       }
-      if (!(0, import_node_fs8.existsSync)(target)) {
+      if (!(0, import_node_fs9.existsSync)(target)) {
         res.statusCode = 404;
         res.end("Not Found");
         return;
@@ -13222,7 +13345,7 @@ function createStaticServerStarter() {
         res.end();
         return;
       }
-      const stream = (0, import_node_fs8.createReadStream)(target);
+      const stream = (0, import_node_fs9.createReadStream)(target);
       stream.on("error", () => {
         res.statusCode = 500;
         res.end("Internal Server Error");
@@ -13327,7 +13450,7 @@ function createAllureOpenHandler(deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const parseZip = deps.parseAllureReportZip ?? parseAllureReportZip;
   const extractZip = deps.extractAllureReportZip ?? extractAllureReportZip;
-  const createTempDir = deps.createTempDir ?? (() => (0, import_promises.mkdtemp)(import_node_path9.default.join((0, import_node_os.tmpdir)(), "automatify-allure-open-")));
+  const createTempDir = deps.createTempDir ?? (() => (0, import_promises.mkdtemp)(import_node_path10.default.join((0, import_node_os.tmpdir)(), "automatify-allure-open-")));
   const startServer = deps.startServer ?? createStaticServerStarter();
   const openInBrowser = deps.openInBrowser ?? createOsBrowserOpener();
   const waitForShutdown = deps.waitForShutdown ?? waitForProcessSignals;
@@ -13362,7 +13485,7 @@ function createAllureOpenHandler(deps = {}) {
       };
     }
     const host = parsed.flags["--host"] ?? "127.0.0.1";
-    const zipPath = import_node_path9.default.resolve(cwd, zipPathInput);
+    const zipPath = import_node_path10.default.resolve(cwd, zipPathInput);
     let summary;
     try {
       summary = await parseZip(zipPath);
@@ -13372,9 +13495,9 @@ function createAllureOpenHandler(deps = {}) {
         stderr: [`ERROR: ${normalizeError(error)}`]
       };
     }
-    const extractDirRaw = userExtractDir ? import_node_path9.default.resolve(cwd, userExtractDir) : await createTempDir();
+    const extractDirRaw = userExtractDir ? import_node_path10.default.resolve(cwd, userExtractDir) : await createTempDir();
     if (dryRun) {
-      const indexPath = import_node_path9.default.join(extractDirRaw, "index.html");
+      const indexPath = import_node_path10.default.join(extractDirRaw, "index.html");
       if (useJson) {
         return {
           exitCode: ExitCode.Success,
@@ -13739,8 +13862,8 @@ function createAllureHandler(deps = {}) {
           attachmentId: parsed.flags["--attachment-id"],
           filename: parsed.flags["--filename"]
         });
-        const outputDir = import_node_path10.default.resolve(cwd, parsed.flags["--output-dir"] ?? ".");
-        const outputPath = import_node_path10.default.join(outputDir, selected.filename);
+        const outputDir = import_node_path11.default.resolve(cwd, parsed.flags["--output-dir"] ?? ".");
+        const outputPath = import_node_path11.default.join(outputDir, selected.filename);
         if (dryRun) {
           if (useJson) {
             return {
@@ -13765,8 +13888,8 @@ function createAllureHandler(deps = {}) {
             ]
           };
         }
-        (0, import_node_fs9.mkdirSync)(outputDir, { recursive: true });
-        if ((0, import_node_fs9.existsSync)(outputPath) && !force) {
+        (0, import_node_fs10.mkdirSync)(outputDir, { recursive: true });
+        if ((0, import_node_fs10.existsSync)(outputPath) && !force) {
           return {
             exitCode: ExitCode.ValidationError,
             stderr: [`ERROR: Output file already exists: ${outputPath}. Pass --force to overwrite.`]
@@ -13815,8 +13938,8 @@ function createAllureHandler(deps = {}) {
       };
     }
     const resolved = resolveJiraConfig(parsed, env, cwd);
-    const zipPath = import_node_path10.default.resolve(cwd, zipPathInput);
-    const attachmentFilename = import_node_path10.default.basename(zipPath);
+    const zipPath = import_node_path11.default.resolve(cwd, zipPathInput);
+    const attachmentFilename = import_node_path11.default.basename(zipPath);
     if (!resolved.config) {
       return {
         exitCode: ExitCode.ValidationError,
@@ -13914,7 +14037,7 @@ function createAllureHandler(deps = {}) {
 }
 
 // src/auth.ts
-var import_node_fs10 = require("node:fs");
+var import_node_fs11 = require("node:fs");
 function parseAuthArgs(args, allowLoginFlags) {
   const configArgs = [];
   const unknown = [];
@@ -13980,7 +14103,7 @@ function sourceLabel(source) {
     case "keychain":
       return "macOS Keychain";
     case "secure-store":
-      return "Windows DPAPI";
+      return "local secure store";
     case "env":
       return "environment";
     case "file":
@@ -14059,12 +14182,13 @@ function createLoginResponse(args, env, cwd, readStdin, platform, context) {
       ]
     };
   }
-  if (parsed.tokenStdin && platform !== "darwin" && platform !== "win32") {
+  const linuxSecureStoreEnabled2 = platform === "linux" && env.TESTOPS_LINUX_SECURE_STORE?.trim() === "1";
+  if (parsed.tokenStdin && platform !== "darwin" && platform !== "win32" && !linuxSecureStoreEnabled2) {
     return {
       exitCode: ExitCode.UsageError,
       stderr: [
-        "Local secure secret storage is supported only on macOS and Windows.",
-        "On Linux/CI, set JIRA_API_TOKEN in the environment and run auth login without --token-stdin."
+        "Local secure secret storage is enabled by default only on macOS and Windows.",
+        "On Linux/CI, either set TESTOPS_LINUX_SECURE_STORE=1 on a trusted persistent host or keep JIRA_API_TOKEN in the environment and run auth login without --token-stdin."
       ]
     };
   }
@@ -14091,7 +14215,7 @@ function createLoginResponse(args, env, cwd, readStdin, platform, context) {
     }
     completed.push(step.label);
   }
-  const tokenSource = stdinToken ? platform === "darwin" ? "macOS Keychain" : "Windows DPAPI" : sourceLabel(
+  const tokenSource = stdinToken ? platform === "darwin" ? "macOS Keychain" : platform === "win32" ? "Windows DPAPI" : "Linux encrypted local store" : sourceLabel(
     current.sources.jiraApiToken === "default" && env.JIRA_API_TOKEN ? "env" : current.sources.jiraApiToken
   );
   return {
@@ -14140,7 +14264,7 @@ function createLogoutResponse(args, env, cwd, context) {
 function createAuthHandler(deps = {}) {
   const env = deps.env ?? process.env;
   const cwd = deps.cwd ?? process.cwd();
-  const readStdin = deps.readStdin ?? (() => (0, import_node_fs10.readFileSync)(0, "utf8"));
+  const readStdin = deps.readStdin ?? (() => (0, import_node_fs11.readFileSync)(0, "utf8"));
   const platform = deps.platform ?? process.platform;
   return (request, context) => {
     const [subcommand, ...args] = request.args;
@@ -14161,8 +14285,8 @@ function createAuthHandler(deps = {}) {
 }
 
 // src/bdd.ts
-var import_node_fs11 = require("node:fs");
-var import_node_path11 = __toESM(require("node:path"), 1);
+var import_node_fs12 = require("node:fs");
+var import_node_path12 = __toESM(require("node:path"), 1);
 var import_yazl = __toESM(require_yazl(), 1);
 
 // src/forgeClient.ts
@@ -14466,7 +14590,7 @@ function parseScenarioFeatureFile(raw, filePath) {
   }
   const scenarioTag = tags.map((tag) => tag.match(SCENARIO_METADATA_PATTERN)).find((match) => Boolean(match));
   const scenarioKeyFromTag = scenarioTag?.[1]?.trim().toUpperCase() ?? "";
-  const fileKeyMatch = import_node_path11.default.basename(filePath ?? "").match(/^(SC-\d+)\.feature$/i);
+  const fileKeyMatch = import_node_path12.default.basename(filePath ?? "").match(/^(SC-\d+)\.feature$/i);
   const scenarioKeyFromFile = fileKeyMatch?.[1]?.trim().toUpperCase() ?? "";
   const scenarioKey = scenarioKeyFromTag || scenarioKeyFromFile;
   if (scenarioKeyFromTag && scenarioKeyFromFile && scenarioKeyFromTag !== scenarioKeyFromFile) {
@@ -14586,7 +14710,7 @@ function toJsonExportManifestItems(items) {
 async function defaultCreateZipArchive(archivePath, entries) {
   await new Promise((resolve, reject) => {
     const zip = new import_yazl.ZipFile();
-    const output = zip.outputStream.pipe((0, import_node_fs11.createWriteStream)(archivePath));
+    const output = zip.outputStream.pipe((0, import_node_fs12.createWriteStream)(archivePath));
     output.on("close", () => resolve());
     output.on("error", reject);
     zip.outputStream.on("error", reject);
@@ -14616,10 +14740,10 @@ function missingProjectResponse() {
 function createBddHandler(deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const env = deps.env ?? process.env;
-  const mkdir = deps.mkdir ?? ((targetPath, options) => (0, import_node_fs11.mkdirSync)(targetPath, options));
-  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs11.readFileSync)(filePath, "utf8"));
-  const readDir = deps.readDir ?? ((dirPath) => (0, import_node_fs11.readdirSync)(dirPath));
-  const writeFile = deps.writeFile ?? ((filePath, content) => (0, import_node_fs11.writeFileSync)(filePath, content, "utf8"));
+  const mkdir = deps.mkdir ?? ((targetPath, options) => (0, import_node_fs12.mkdirSync)(targetPath, options));
+  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs12.readFileSync)(filePath, "utf8"));
+  const readDir = deps.readDir ?? ((dirPath) => (0, import_node_fs12.readdirSync)(dirPath));
+  const writeFile = deps.writeFile ?? ((filePath, content) => (0, import_node_fs12.writeFileSync)(filePath, content, "utf8"));
   const createZipArchive = deps.createZipArchive ?? defaultCreateZipArchive;
   return async (request, context) => {
     const [subcommand, ...restArgs] = request.args;
@@ -14663,7 +14787,7 @@ function createBddHandler(deps = {}) {
           stderr: ["ERROR: Missing required --output-dir for testops bdd features export."]
         };
       }
-      const outputDir = import_node_path11.default.resolve(cwd, outputDirFlag);
+      const outputDir = import_node_path12.default.resolve(cwd, outputDirFlag);
       try {
         const result = await context.invokeForgeContract("listBddFeatures", {
           context: {
@@ -14701,7 +14825,7 @@ function createBddHandler(deps = {}) {
 `
         }));
         for (let index = 0; index < features.length; index += 1) {
-          writeFile(import_node_path11.default.join(outputDir, fileNames[index]), exportEntries[index].content);
+          writeFile(import_node_path12.default.join(outputDir, fileNames[index]), exportEntries[index].content);
         }
         const manifest = {
           action: "bdd-features-export",
@@ -14714,7 +14838,7 @@ function createBddHandler(deps = {}) {
         };
         const manifestContent = `${JSON.stringify(manifest, null, 2)}
 `;
-        writeFile(import_node_path11.default.join(outputDir, "manifest.json"), manifestContent);
+        writeFile(import_node_path12.default.join(outputDir, "manifest.json"), manifestContent);
         const archivePath = `${outputDir}.zip`;
         if (zipRequested) {
           await createZipArchive(archivePath, [
@@ -14784,7 +14908,7 @@ function createBddHandler(deps = {}) {
               stderr: ["ERROR: Missing required --output-dir for testops bdd scenarios export."]
             };
           }
-          const outputDir = import_node_path11.default.resolve(cwd, outputDirFlag);
+          const outputDir = import_node_path12.default.resolve(cwd, outputDirFlag);
           const zipRequested = parsed.boolFlags.has("--zip");
           try {
             const scenariosResult = await context.invokeForgeContract("listBddScenarios", {
@@ -14821,7 +14945,7 @@ function createBddHandler(deps = {}) {
               const fileName = scenarioToExportFileName(scenario);
               const fileContent = `${scenarioToFeatureLines(scenario).join("\n")}
 `;
-              writeFile(import_node_path11.default.join(outputDir, fileName), fileContent);
+              writeFile(import_node_path12.default.join(outputDir, fileName), fileContent);
               return {
                 scenario,
                 fileName,
@@ -14847,7 +14971,7 @@ function createBddHandler(deps = {}) {
             };
             const manifestContent = `${JSON.stringify(manifest, null, 2)}
 `;
-            writeFile(import_node_path11.default.join(outputDir, "manifest.json"), manifestContent);
+            writeFile(import_node_path12.default.join(outputDir, "manifest.json"), manifestContent);
             const archivePath = `${outputDir}.zip`;
             if (zipRequested) {
               await createZipArchive(archivePath, [
@@ -14895,8 +15019,8 @@ function createBddHandler(deps = {}) {
           }
         }
         if (nested === "import") {
-          const sourceFile = parsed.flags["--file"] ? import_node_path11.default.resolve(cwd, parsed.flags["--file"]) : "";
-          const inputDir = parsed.flags["--input-dir"] ? import_node_path11.default.resolve(cwd, parsed.flags["--input-dir"]) : "";
+          const sourceFile = parsed.flags["--file"] ? import_node_path12.default.resolve(cwd, parsed.flags["--file"]) : "";
+          const inputDir = parsed.flags["--input-dir"] ? import_node_path12.default.resolve(cwd, parsed.flags["--input-dir"]) : "";
           const dryRun = parsed.boolFlags.has("--dry-run");
           if (!sourceFile && !inputDir) {
             return {
@@ -14905,7 +15029,7 @@ function createBddHandler(deps = {}) {
             };
           }
           try {
-            const scenarioFiles = sourceFile ? [sourceFile] : readDir(inputDir).filter((entry) => entry.toLowerCase().endsWith(".feature")).map((entry) => import_node_path11.default.join(inputDir, entry)).sort((left, right) => left.localeCompare(right));
+            const scenarioFiles = sourceFile ? [sourceFile] : readDir(inputDir).filter((entry) => entry.toLowerCase().endsWith(".feature")).map((entry) => import_node_path12.default.join(inputDir, entry)).sort((left, right) => left.localeCompare(right));
             if (scenarioFiles.length === 0) {
               return {
                 exitCode: ExitCode.ValidationError,
@@ -15954,8 +16078,8 @@ function createDoctorHandler(deps = {}) {
 }
 
 // src/ingestFeature.ts
-var import_node_fs12 = require("node:fs");
-var import_node_path12 = __toESM(require("node:path"), 1);
+var import_node_fs13 = require("node:fs");
+var import_node_path13 = __toESM(require("node:path"), 1);
 var CONFIG_FLAGS6 = /* @__PURE__ */ new Set([
   "--config",
   "--base-url",
@@ -16041,8 +16165,8 @@ function normalizeError5(error) {
   return "Unknown ingest error.";
 }
 function createIngestFeatureHandler(deps = {}) {
-  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs12.readFileSync)(filePath, "utf8"));
-  const readStdin = deps.readStdin ?? (() => (0, import_node_fs12.readFileSync)(0, "utf8"));
+  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs13.readFileSync)(filePath, "utf8"));
+  const readStdin = deps.readStdin ?? (() => (0, import_node_fs13.readFileSync)(0, "utf8"));
   const cwd = deps.cwd ?? process.cwd();
   const env = deps.env ?? process.env;
   return async (request, context) => {
@@ -16052,7 +16176,7 @@ function createIngestFeatureHandler(deps = {}) {
     const config = resolveCliConfig(configArgs, env, cwd);
     const projectKey = config.values.projectKey;
     const issueKey = config.values.issueKey;
-    const sourceFile = parsed.flags["--file"] ? import_node_path12.default.resolve(cwd, parsed.flags["--file"]) : "";
+    const sourceFile = parsed.flags["--file"] ? import_node_path13.default.resolve(cwd, parsed.flags["--file"]) : "";
     const useStdin = parsed.boolFlags.has("--stdin");
     const useJson = parsed.boolFlags.has("--json");
     const sourceCount = Number(Boolean(sourceFile)) + Number(useStdin);
@@ -16671,8 +16795,8 @@ function createProfilesHandler(deps = {}) {
 }
 
 // src/runUpload.ts
-var import_node_fs13 = require("node:fs");
-var import_node_path13 = __toESM(require("node:path"), 1);
+var import_node_fs14 = require("node:fs");
+var import_node_path14 = __toESM(require("node:path"), 1);
 var STEP_RESULTS = [
   StepResult.Passed,
   StepResult.Failed,
@@ -16813,8 +16937,8 @@ function summarizeRunResult(result) {
   return lines;
 }
 function createRunUploadHandler(deps = {}) {
-  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs13.readFileSync)(filePath, "utf8"));
-  const readStdin = deps.readStdin ?? (() => (0, import_node_fs13.readFileSync)(0, "utf8"));
+  const readFile = deps.readFile ?? ((filePath) => (0, import_node_fs14.readFileSync)(filePath, "utf8"));
+  const readStdin = deps.readStdin ?? (() => (0, import_node_fs14.readFileSync)(0, "utf8"));
   const cwd = deps.cwd ?? process.cwd();
   const env = deps.env ?? process.env;
   return async (request, context) => {
@@ -16825,7 +16949,7 @@ function createRunUploadHandler(deps = {}) {
     const projectKey = config.values.projectKey;
     const issueKey = config.values.issueKey;
     const testCaseKey = parsed.flags["--test-case-key"]?.trim().toUpperCase() ?? "";
-    const sourceFile = parsed.flags["--file"] ? import_node_path13.default.resolve(cwd, parsed.flags["--file"]) : "";
+    const sourceFile = parsed.flags["--file"] ? import_node_path14.default.resolve(cwd, parsed.flags["--file"]) : "";
     const useStdin = parsed.boolFlags.has("--stdin");
     const useJson = parsed.boolFlags.has("--json");
     const sourceCount = Number(Boolean(sourceFile)) + Number(useStdin);
@@ -17159,16 +17283,16 @@ function createRunsHandler(deps = {}) {
 }
 
 // src/setup.ts
-var import_node_fs15 = require("node:fs");
-var import_node_path15 = __toESM(require("node:path"), 1);
+var import_node_fs16 = require("node:fs");
+var import_node_path16 = __toESM(require("node:path"), 1);
 
 // src/githubSetupProvider.ts
 var import_node_child_process4 = require("node:child_process");
 
 // src/setupPlan.ts
-var import_node_crypto = require("node:crypto");
-var import_node_fs14 = require("node:fs");
-var import_node_path14 = __toESM(require("node:path"), 1);
+var import_node_crypto2 = require("node:crypto");
+var import_node_fs15 = require("node:fs");
+var import_node_path15 = __toESM(require("node:path"), 1);
 var SETUP_PLAN_SCHEMA_VERSION = "automatify.testops.setup/v1";
 var SETUP_PLAN_KIND = "AutomatifyTestOpsSetupPlan";
 var ACTIONS = [
@@ -17192,7 +17316,7 @@ var ACTIONS = [
   }
 ];
 function sha256(value) {
-  return (0, import_node_crypto.createHash)("sha256").update(value, "utf8").digest("hex");
+  return (0, import_node_crypto2.createHash)("sha256").update(value, "utf8").digest("hex");
 }
 function sortJsonValue(value) {
   if (Array.isArray(value)) {
@@ -17237,8 +17361,8 @@ function normalizeRepoPart(value, field) {
   return normalized;
 }
 function normalizeWorkflowPath(value) {
-  const normalized = import_node_path14.default.posix.normalize(requireNonEmpty(value, "workflow path").replaceAll("\\", "/"));
-  if (import_node_path14.default.posix.isAbsolute(normalized) || normalized.startsWith("../") || !normalized.startsWith(".github/workflows/") || !/\.ya?ml$/i.test(normalized)) {
+  const normalized = import_node_path15.default.posix.normalize(requireNonEmpty(value, "workflow path").replaceAll("\\", "/"));
+  if (import_node_path15.default.posix.isAbsolute(normalized) || normalized.startsWith("../") || !normalized.startsWith(".github/workflows/") || !/\.ya?ml$/i.test(normalized)) {
     throw new Error("workflow path must be a relative .github/workflows/*.yml or *.yaml path without '..'.");
   }
   return normalized;
@@ -17263,7 +17387,7 @@ function buildGitHubSetupPlan(input) {
   if (endpointSecretName === tokenSecretName) {
     throw new Error("callback endpoint and auth token secret names must be different.");
   }
-  const workflowContent = (0, import_node_fs14.readFileSync)(input.workflowSourcePath, "utf8");
+  const workflowContent = (0, import_node_fs15.readFileSync)(input.workflowSourcePath, "utf8");
   if (!workflowContent.trim()) {
     throw new Error("workflow source file is empty.");
   }
@@ -17296,7 +17420,7 @@ function buildGitHubSetupPlan(input) {
       workflowId,
       workflowFile: {
         path: workflowPath,
-        sourcePath: import_node_path14.default.resolve(input.workflowSourcePath),
+        sourcePath: import_node_path15.default.resolve(input.workflowSourcePath),
         sha256: sha256(workflowContent)
       },
       requiredSecrets: [
@@ -17897,8 +18021,8 @@ var AzureDevOpsSetupProvider = class {
 };
 
 // src/azureDevOpsSetupPlan.ts
-var import_node_crypto2 = require("node:crypto");
-var digest = (v) => `sha256:${(0, import_node_crypto2.createHash)("sha256").update(JSON.stringify(v)).digest("hex")}`;
+var import_node_crypto3 = require("node:crypto");
+var digest = (v) => `sha256:${(0, import_node_crypto3.createHash)("sha256").update(JSON.stringify(v)).digest("hex")}`;
 var required = (value, field) => {
   const result = value.trim();
   if (!result) throw new Error(`${field} is required.`);
@@ -18206,10 +18330,10 @@ function errorCodeForError(error, fallback) {
   return error instanceof SetupCommandError ? error.cliCode : fallback;
 }
 function loadPlan(planPath, cwd) {
-  const absolute = import_node_path15.default.resolve(cwd, planPath);
+  const absolute = import_node_path16.default.resolve(cwd, planPath);
   let parsed;
   try {
-    parsed = JSON.parse((0, import_node_fs15.readFileSync)(absolute, "utf8"));
+    parsed = JSON.parse((0, import_node_fs16.readFileSync)(absolute, "utf8"));
   } catch (error) {
     throw new SetupCommandError(
       "PLAN_READ_ERROR",
@@ -18434,9 +18558,9 @@ function rollbackFor(plan, actionId) {
   return plan.rollback.find((item) => item.actionId === actionId)?.strategy ?? "Review the plan rollback section.";
 }
 function resolveWorkflowTarget(plan, repoRoot) {
-  const resolvedRoot = import_node_path15.default.resolve(repoRoot);
-  const target = import_node_path15.default.resolve(resolvedRoot, plan.github.workflowFile.path);
-  if (target !== resolvedRoot && !target.startsWith(`${resolvedRoot}${import_node_path15.default.sep}`)) {
+  const resolvedRoot = import_node_path16.default.resolve(repoRoot);
+  const target = import_node_path16.default.resolve(resolvedRoot, plan.github.workflowFile.path);
+  if (target !== resolvedRoot && !target.startsWith(`${resolvedRoot}${import_node_path16.default.sep}`)) {
     throw new SetupCommandError(
       "WORKFLOW_PATH_ERROR",
       "Workflow target escapes the approved repository root.",
@@ -18448,7 +18572,7 @@ function resolveWorkflowTarget(plan, repoRoot) {
 function applyWorkflowFile(plan, repoRoot, dryRun) {
   const action = plan.actions.find((item) => item.scope === "workflow-file");
   const target = resolveWorkflowTarget(plan, repoRoot);
-  const sourceContent = (0, import_node_fs15.readFileSync)(plan.github.workflowFile.sourcePath, "utf8");
+  const sourceContent = (0, import_node_fs16.readFileSync)(plan.github.workflowFile.sourcePath, "utf8");
   if (hashSetupContent(sourceContent) !== plan.github.workflowFile.sha256) {
     throw new SetupCommandError(
       "WORKFLOW_SOURCE_CHANGED",
@@ -18456,8 +18580,8 @@ function applyWorkflowFile(plan, repoRoot, dryRun) {
       ExitCode.ValidationError
     );
   }
-  const existed = (0, import_node_fs15.existsSync)(target);
-  const previousContent = existed ? (0, import_node_fs15.readFileSync)(target, "utf8") : void 0;
+  const existed = (0, import_node_fs16.existsSync)(target);
+  const previousContent = existed ? (0, import_node_fs16.readFileSync)(target, "utf8") : void 0;
   const matches = previousContent !== void 0 && hashSetupContent(previousContent) === plan.github.workflowFile.sha256;
   if (matches) {
     return {
@@ -18469,8 +18593,8 @@ function applyWorkflowFile(plan, repoRoot, dryRun) {
     };
   }
   if (!dryRun) {
-    (0, import_node_fs15.mkdirSync)(import_node_path15.default.dirname(target), { recursive: true });
-    (0, import_node_fs15.writeFileSync)(target, sourceContent, { encoding: "utf8", mode: 420 });
+    (0, import_node_fs16.mkdirSync)(import_node_path16.default.dirname(target), { recursive: true });
+    (0, import_node_fs16.writeFileSync)(target, sourceContent, { encoding: "utf8", mode: 420 });
   }
   return {
     id: action.id,
@@ -18640,14 +18764,14 @@ async function inspectPlan(plan, repoRoot, secrets, context, deps) {
   const checks = [];
   let forgeTransportFailure = false;
   const target = resolveWorkflowTarget(plan, repoRoot);
-  if (!(0, import_node_fs15.existsSync)(target)) {
+  if (!(0, import_node_fs16.existsSync)(target)) {
     checks.push({
       id: "workflow-local",
       status: "fail",
       message: `Local workflow file ${plan.github.workflowFile.path} does not exist.`
     });
   } else {
-    const localHash = hashSetupContent((0, import_node_fs15.readFileSync)(target, "utf8"));
+    const localHash = hashSetupContent((0, import_node_fs16.readFileSync)(target, "utf8"));
     checks.push({
       id: "workflow-local",
       status: localHash === plan.github.workflowFile.sha256 ? "pass" : "fail",
@@ -18783,7 +18907,7 @@ function planCommand(args, deps) {
       ref: parsed.flags["--ref"] ?? "main",
       workflowId: parsed.flags["--workflow-id"] ?? "scenario-dispatch.yml",
       workflowPath: parsed.flags["--workflow-path"] ?? ".github/workflows/scenario-dispatch.yml",
-      workflowSourcePath: import_node_path15.default.resolve(deps.cwd, parsed.flags["--workflow-source"] ?? ""),
+      workflowSourcePath: import_node_path16.default.resolve(deps.cwd, parsed.flags["--workflow-source"] ?? ""),
       profileLabel: parsed.flags["--profile-label"] ?? "GitHub Actions",
       enabled: !parsed.boolFlags.has("--disabled"),
       setProjectDefault: parsed.boolFlags.has("--set-default"),
@@ -18823,7 +18947,7 @@ async function applyCommand(args, context, deps) {
       return await applyAzureCommand(plan, parsed, context, deps, secrets);
     }
     const scopes = approvedScopes(plan, parsed, dryRun);
-    const repoRoot = import_node_path15.default.resolve(deps.cwd, parsed.flags["--repo-root"] ?? ".");
+    const repoRoot = import_node_path16.default.resolve(deps.cwd, parsed.flags["--repo-root"] ?? ".");
     const rotateSecrets = parsed.boolFlags.has("--rotate-secrets");
     const rotateProviderToken = parsed.boolFlags.has("--rotate-provider-token");
     const state = await prepareState(plan, scopes, secrets, context, deps, dryRun, rotateSecrets, rotateProviderToken);
@@ -19115,7 +19239,7 @@ async function doctorCommand(args, context, deps) {
         exitCode
       );
     }
-    const repoRoot = import_node_path15.default.resolve(deps.cwd, parsed.flags["--repo-root"] ?? ".");
+    const repoRoot = import_node_path16.default.resolve(deps.cwd, parsed.flags["--repo-root"] ?? ".");
     const summary = await inspectPlan(plan, repoRoot, secrets, context, deps);
     return jsonResponse(summary, summary.exitCode);
   } catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automatify-au/cli",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "description": "Forge-first CLI for Automatify Jira TestOps",
   "type": "module",
   "bin": {