@glubean/cli 0.8.3 → 0.9.0

package/dist/commands/run.js

@@ -1,14 +1,15 @@
 import { bootstrap, evaluateThresholds, MetricCollector, ProjectRunner, buildRunContext, } from "@glubean/runner";
+import { buildOnlySelectorsFromFlags, deriveRerunSelectors } from "../lib/only-selectors.js";
 import { basename, dirname, isAbsolute, relative, resolve } from "node:path";
 import { randomUUID } from "node:crypto";
 import { stat, readdir, readFile, writeFile, mkdir, rm } from "node:fs/promises";
 import { glob } from "node:fs/promises";
 import { CONFIG_DEFAULTS, mergeRunOptions, toSharedRunConfig } from "../lib/config.js";
 import { loadProjectEnv } from "@glubean/runner";
-import { resolveEnvFileName } from "../lib/active_env.js";
+import { resolveEnvFileName, SensitiveActiveEnvError } from "../lib/active_env.js";
 import { shouldSkipTest } from "../lib/skip.js";
 import { extractContractCases, extractFromSource } from "@glubean/scanner/static";
-import { buildSuffixes, classifyByStem, extractContractFromFile, findTemplateMatch, GLUBEAN_KINDS, loadProjectOverlays, matchesTemplateFilter, } from "@glubean/scanner";
+import { buildSuffixes, classifyByStem, extractContractFromFile, findTemplateMatch, findTemplateMatches, GLUBEAN_KINDS, loadProjectOverlays, matchesTemplateFilter, } from "@glubean/scanner";
 import { applyEnvTemplating } from "@glubean/runner";
 // ANSI color codes for pretty output
 const colors = {
@@ -519,8 +520,8 @@ export async function runCommand(target, options = {}) {
     const interactive = capabilityProfile.browser;
     const traceCollector = [];
     console.log(`\n${colors.bold}${colors.blue}🧪 Glubean Test Runner${colors.reset}\n`);
-    const testFiles = await resolveTestFiles(target);
-    const isMultiFile = testFiles.length > 1;
+    let testFiles = await resolveTestFiles(target);
+    let isMultiFile = testFiles.length > 1;
     // Single string view of target for serialization / display paths
     // (result.json, junit, traces). Multi-suite passes an array; join with
     // ", " so downstream consumers still see a printable target field.
@@ -544,6 +545,59 @@ export async function runCommand(target, options = {}) {
     }
     const startDir = testFiles[0].substring(0, testFiles[0].lastIndexOf("/"));
     const { rootDir } = await findProjectConfig(startDir);
+    // ── B2 M3 — `{id, rowIndex}` "only" selectors ────────────────────────────
+    // Validate the --only-id / --row / --rerun-failed combo up front (single
+    // gate), then resolve the active selector set. `--rerun-failed` reads the
+    // previous run and narrows discovery to the files that failed; `--only-id` /
+    // `--row` narrow `testsToRun` below by template-matching concrete ids against
+    // static `.each` template ids. Either way the precise per-row filter runs in
+    // the harness subprocess via the GLUBEAN_RUNNER_ONLY_SELECTORS env channel.
+    let onlySelectors = [];
+    const selectorFlags = buildOnlySelectorsFromFlags({
+        onlyId: options.onlyId,
+        row: options.row,
+        rerunFailed: options.rerunFailed,
+    });
+    if (!selectorFlags.ok) {
+        console.error(`\n${colors.red}❌ ${selectorFlags.error}${colors.reset}\n`);
+        process.exit(1);
+    }
+    if (options.rerunFailed) {
+        const lastRunPath = resolve(rootDir, ".glubean", "last-run.result.json");
+        let lastRun;
+        try {
+            lastRun = JSON.parse(await readFile(lastRunPath, "utf-8"));
+        }
+        catch {
+            console.error(`\n${colors.red}❌ No previous run found. Run \`glubean run\` first.${colors.reset}\n` +
+                `${colors.dim}--rerun-failed reads ${lastRunPath}.${colors.reset}\n`);
+            process.exit(1);
+        }
+        const { selectors, files } = deriveRerunSelectors({ tests: lastRun.tests ?? [] });
+        if (selectors.length === 0) {
+            console.log(`\n${colors.green}✓ Last run had no failures — nothing to rerun.${colors.reset}\n`);
+            process.exit(0);
+        }
+        // Narrow discovery to the files that contained a failure. `files` were
+        // written relative to rootDir (resultPayload.tests.filePath) — rootDir is the
+        // stable basis (the dir holding .glubean/), so rerun resolves correctly even
+        // when invoked from a different cwd than the original run. Resolve both sides
+        // to absolute for an exact match against the discovered testFiles.
+        const failedFilesAbs = new Set(files.map((f) => resolve(rootDir, f)));
+        testFiles = testFiles.filter((f) => failedFilesAbs.has(resolve(f)));
+        isMultiFile = testFiles.length > 1;
+        if (testFiles.length === 0) {
+            console.error(`\n${colors.red}❌ --rerun-failed: none of the ${failedFilesAbs.size} failed file(s) ` +
+                `from the last run are in the current target.${colors.reset}\n`);
+            process.exit(1);
+        }
+        onlySelectors = selectors;
+        console.log(`${colors.dim}--rerun-failed: ${selectors.length} failed test(s) across ` +
+            `${testFiles.length} file(s)${colors.reset}\n`);
+    }
+    else {
+        onlySelectors = selectorFlags.selectors;
+    }
     // Config consolidation (docs/06 P2): the legacy package.json `glubean`
     // flat-shape is no longer read. Profile runs get run/redaction/thresholds
     // from the resolved plan (threaded via `options`); non-profile target runs
@@ -573,10 +627,27 @@ export async function runCommand(target, options = {}) {
         console.log(`${colors.dim}Log file: ${logPath}${colors.reset}`);
     }
     // Resolve env file: --env-file flag > .glubean/active-env > config default > .env
+    // GLU-88: resolveEnvFileName throws SensitiveActiveEnvError instead of
+    // silently returning a prod-like active-env file — surface it as a clear,
+    // actionable CLI error rather than let it propagate as an unhandled
+    // rejection.
     const userSpecifiedEnvFile = !!options.envFile;
-    const envFileName = userSpecifiedEnvFile
-        ? effectiveRun.envFile
-        : await resolveEnvFileName(rootDir);
+    let envFileName;
+    if (userSpecifiedEnvFile) {
+        envFileName = effectiveRun.envFile;
+    }
+    else {
+        try {
+            envFileName = await resolveEnvFileName(rootDir);
+        }
+        catch (err) {
+            if (err instanceof SensitiveActiveEnvError) {
+                console.error(`\n${colors.red}Error: ${err.message}${colors.reset}\n`);
+                process.exit(1);
+            }
+            throw err;
+        }
+    }
     const envPath = resolve(rootDir, envFileName);
     if (userSpecifiedEnvFile) {
         try {
@@ -797,7 +868,7 @@ export async function runCommand(target, options = {}) {
     }
     const hasTags = options.tags && options.tags.length > 0;
     const hasExcludeTags = options.excludeTags && options.excludeTags.length > 0;
-    const testsToRun = allFileTests.filter((ft) => {
+    let testsToRun = allFileTests.filter((ft) => {
         const tc = ft.test;
         if (tc.meta.skip)
             return false;
@@ -811,6 +882,45 @@ export async function runCommand(target, options = {}) {
             return false;
         return true;
     });
+    // B2 M3 — narrow testsToRun to the selected ids. Selector ids are CONCRETE
+    // (e.g. `user-0`); a `.each` export appears in discovery under its TEMPLATE id
+    // (e.g. `user-$index`). Template-match each selector id against the discovered
+    // template ids so concrete selectors reach the right export — the harness then
+    // applies the precise per-row filter at runtime.
+    //
+    // This runs for `--rerun-failed` too (GLU-67 follow-up): `--rerun-failed`
+    // narrows DISCOVERY to the failed FILES above, but a failed file can also hold
+    // PASSED tests. Without narrowing testsToRun here as well, those passed tests
+    // reach the capability-skip pass below and emit spurious `⊘ skipped` rows that
+    // aren't part of the rerun set (the harness `matchOnly` still filters them at
+    // runtime, but only after the CLI has already printed the noise). Narrowing here
+    // makes the rerun path's ordering match the `--only-id` path: filter to the
+    // selected ids FIRST, then capability-skip only what remains.
+    //
+    // keep-all-matches (GLU-67 follow-up): `findTemplateMatches` (plural) keeps
+    // EVERY export a selector id matches — a bare id shared by two files, or two
+    // overlapping `.each` templates, all run — instead of `findTemplateMatch`'s
+    // silent first-match-wins drop.
+    if (onlySelectors.length > 0) {
+        const selectorIds = Array.from(new Set(onlySelectors.map((s) => (typeof s === "string" ? s : s.id))));
+        const indexed = testsToRun.map((ft) => ({ id: ft.test.meta.id, ft }));
+        const kept = new Set();
+        for (const selId of selectorIds) {
+            for (const match of findTemplateMatches(indexed, selId))
+                kept.add(match.ft);
+        }
+        testsToRun = testsToRun.filter((ft) => kept.has(ft));
+        if (testsToRun.length === 0) {
+            // In rerun mode the ids come from the last run's failed set, not a
+            // `--only-id` flag — report accordingly (e.g. a failed test was renamed
+            // or removed since the recorded run).
+            console.error(options.rerunFailed
+                ? `\n${colors.red}❌ --rerun-failed: none of the last run's failed test ids ` +
+                    `(${selectorIds.join(", ")}) still exist in the target files.${colors.reset}\n`
+                : `\n${colors.red}❌ No tests match --only-id ${selectorIds.join(", ")}${colors.reset}\n`);
+            process.exit(1);
+        }
+    }
     if (testsToRun.length === 0) {
         if (options.filter || hasTags) {
             const parts = [];
@@ -952,6 +1062,15 @@ export async function runCommand(target, options = {}) {
         delete process.env["GLUBEAN_RUNNER_BOOTSTRAP_INPUT_MAP"];
         delete process.env["GLUBEAN_RUNNER_FORCE_STANDALONE_IDS"];
     }
+    // B2 M3 — hand the resolved selector set to the harness subprocess (it applies
+    // the precise per-row filter at runtime). Clear it otherwise so a stale value
+    // never leaks across in-process invocations (parity with the input maps above).
+    if (onlySelectors.length > 0) {
+        process.env["GLUBEAN_RUNNER_ONLY_SELECTORS"] = JSON.stringify(onlySelectors);
+    }
+    else {
+        delete process.env["GLUBEAN_RUNNER_ONLY_SELECTORS"];
+    }
     if (options.pick) {
         process.env.GLUBEAN_PICK = options.pick;
         console.log(`${colors.dim}  pick: ${options.pick}${colors.reset}`);
@@ -1024,6 +1143,8 @@ export async function runCommand(target, options = {}) {
     let currentTestItems;
     let testId = "";
     let testName = "";
+    let testRowIndex = undefined;
+    let testEach = undefined;
     let testItem = null;
     let startTime = Date.now();
     let testEvents = [];
@@ -1089,6 +1210,8 @@ export async function runCommand(target, options = {}) {
             success: skippedClean ? true : finalSuccess,
             durationMs: duration,
             groupId: testItem?.meta.groupId,
+            rowIndex: testRowIndex,
+            each: testEach,
         });
         addLogEntry("result", skippedClean ? "SKIPPED" : finalSuccess ? "PASSED" : "FAILED", {
             duration,
@@ -1406,6 +1529,14 @@ export async function runCommand(target, options = {}) {
                             (currentTestItems ? findFileTestByRuntimeId(currentTestItems, event.id) : undefined);
                         testId = event.id;
                         testName = entry?.test.meta.name || event.name || event.id;
+                        // rowIndex (B2 M3): the runtime start event is authoritative for the
+                        // per-row `.each` index (static discovery only sees the template id,
+                        // so it carries no rowIndex). undefined for non-each tests.
+                        testRowIndex = event.rowIndex;
+                        // each (B3 T3): same reasoning — the runtime start event is
+                        // authoritative for row-identity provenance (idTemplate/rowKey/
+                        // stable). undefined for non-each tests.
+                        testEach = event.each;
                         testItem = entry?.test || null;
                         startTime = Date.now();
                         testEvents = [];
@@ -1871,6 +2002,18 @@ export async function runCommand(target, options = {}) {
             success: r.success,
             durationMs: r.durationMs,
             events: r.events,
+            // B2 M3 — persist rowIndex + filePath so `--rerun-failed` can reconstruct
+            // the failed `{id, rowIndex}` selector set and narrow to the failed files.
+            // filePath is relative to rootDir (the stable .glubean/ basis), NOT cwd, so
+            // rerun resolves correctly when run from a different working directory.
+            ...(r.rowIndex !== undefined && { rowIndex: r.rowIndex }),
+            // B3 T3 (`run-evidence-identity-model.md` §7/§14) — persist row-identity
+            // provenance (idTemplate/rowKey/stable) on each test entry, so the
+            // uploaded run blob (`result.tests[].each`) self-describes row identity
+            // without depending on a projection join. Undefined for non-each tests
+            // (backward compatible: old runs / old CLI builds simply omit the field).
+            ...(r.each !== undefined && { each: r.each }),
+            filePath: relative(rootDir, r.filePath),
         })),
         ...(thresholdSummary && { thresholds: thresholdSummary }),
         ...(options.meta && Object.keys(options.meta).length > 0 && { customMetadata: options.meta }),
@@ -1924,29 +2067,30 @@ export async function runCommand(target, options = {}) {
         }
     }
     // ── Screenshot paths ──────────────────────────────────────────────────
-    {
-        const screenshotPaths = [];
-        for (const run of collectedRuns) {
-            for (const event of run.events) {
-                if (event.type !== "event")
-                    continue;
-                const ev = event.data;
-                if (ev.type === "browser:screenshot" && typeof ev.data?.path === "string") {
-                    screenshotPaths.push(resolve(rootDir, ev.data.path));
-                }
+    // This run's exact screenshot files, pulled from the `browser:screenshot`
+    // event stream. Doubles as the upload whitelist below so `--upload` attaches
+    // only THIS run's screenshots, not every file in the shared dir (ART1).
+    const screenshotPaths = [];
+    for (const run of collectedRuns) {
+        for (const event of run.events) {
+            if (event.type !== "event")
+                continue;
+            const ev = event.data;
+            if (ev.type === "browser:screenshot" && typeof ev.data?.path === "string") {
+                screenshotPaths.push(resolve(rootDir, ev.data.path));
             }
         }
-        if (screenshotPaths.length > 0) {
-            for (const p of screenshotPaths) {
-                console.log(`${colors.dim}Screenshot: ${colors.reset}${p}`);
-            }
-            console.log();
+    }
+    if (screenshotPaths.length > 0) {
+        for (const p of screenshotPaths) {
+            console.log(`${colors.dim}Screenshot: ${colors.reset}${p}`);
         }
+        console.log();
     }
     // ── Cloud upload ────────────────────────────────────────────────────────
     if (options.upload) {
         const { resolveToken, resolveProjectId, resolveApiUrl } = await import("../lib/auth.js");
-        const { uploadToCloud } = await import("../lib/upload.js");
+        const { uploadToCloud, removeUploadedScreenshots } = await import("../lib/upload.js");
         const authOpts = {
             token: options.token,
             project: options.project,
@@ -2096,7 +2240,27 @@ export async function runCommand(target, options = {}) {
                     targetId,
                     envFile: effectiveRun.envFile,
                     rootDir,
+                    // Upload only THIS run's screenshots (whitelist), not the whole
+                    // shared `.glubean/screenshots` dir which accumulates prior runs.
+                    screenshotPaths,
                 });
+                // ART1-B — the shared screenshots dir only ever grows, so once the
+                // Cloud confirmed it received this run's screenshots, delete the local
+                // copies. Deletes ONLY uploadedFiles ∩ screenshotPaths (both server-
+                // confirmed and provably this run's), realpath-contained to
+                // `.glubean/screenshots`, and only while the on-disk file still has
+                // its upload-time stat identity (re-checked just before each unlink)
+                // — a failed/partial upload keeps its files, and a concurrently
+                // recreated path is kept.
+                if (!options.keepLocal &&
+                    uploadReceipt.artifactUpload.status === "uploaded" &&
+                    uploadReceipt.artifactUpload.uploadedFiles?.length &&
+                    screenshotPaths.length > 0) {
+                    const { removed } = await removeUploadedScreenshots(rootDir, screenshotPaths, uploadReceipt.artifactUpload.uploadedFiles);
+                    if (removed > 0) {
+                        console.log(`${colors.dim}Cleaned up ${removed} uploaded screenshot(s) from .glubean/screenshots (use --keep-local to keep them)${colors.reset}`);
+                    }
+                }
                 if (options.uploadReceiptJson) {
                     const receiptPath = resolveOutputPath(options.uploadReceiptJson, process.cwd());
                     await mkdir(dirname(receiptPath), { recursive: true });