@hasna/testers 0.0.33 → 0.0.35

package/dist/server/index.js

@@ -4036,6 +4036,56 @@ var init_zod = __esm(() => {
 });
 
 // src/types/index.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stringValue(value) {
+  return typeof value === "string" && value.trim() ? value : undefined;
+}
+function numberValue(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+}
+function stringMap(value) {
+  if (!isRecord(value))
+    return;
+  const entries = Object.entries(value).filter((entry) => typeof entry[1] === "string");
+  return entries.length > 0 ? Object.fromEntries(entries) : undefined;
+}
+function cleanupValue(value) {
+  if (value === "delete" || value === "stop" || value === "keep")
+    return value;
+  return;
+}
+function workflowExecutionFromValue(value) {
+  const input = isRecord(value) ? value : {};
+  const rawTarget = stringValue(input["target"]) ?? "local";
+  if (rawTarget === "local") {
+    const timeoutMs2 = numberValue(input["timeoutMs"]);
+    return timeoutMs2 === undefined ? { target: "local" } : { target: "local", timeoutMs: timeoutMs2 };
+  }
+  if (rawTarget !== "sandbox" && rawTarget !== "connector:e2b") {
+    throw new Error(`Unsupported workflow execution target: ${rawTarget}`);
+  }
+  const provider = rawTarget === "connector:e2b" ? "e2b" : stringValue(input["provider"]) ?? stringValue(input["connector"]);
+  const sandboxImage = stringValue(input["sandboxImage"]) ?? stringValue(input["sandboxTemplate"]);
+  const sandboxRemoteDir = stringValue(input["sandboxRemoteDir"]);
+  const sandboxCleanup = cleanupValue(input["sandboxCleanup"]);
+  const setupCommand = stringValue(input["setupCommand"]);
+  const packageSpec = stringValue(input["packageSpec"]);
+  const timeoutMs = numberValue(input["timeoutMs"]);
+  const env = stringMap(input["env"]);
+  return {
+    target: "sandbox",
+    ...provider ? { provider } : {},
+    ...sandboxImage ? { sandboxImage } : {},
+    ...sandboxRemoteDir ? { sandboxRemoteDir } : {},
+    ...sandboxCleanup ? { sandboxCleanup } : {},
+    ...setupCommand ? { setupCommand } : {},
+    ...packageSpec ? { packageSpec } : {},
+    ...timeoutMs !== undefined ? { timeoutMs } : {},
+    ...env ? { env } : {}
+  };
+}
 function workflowFromRow(row) {
   return {
     id: row.id,
@@ -4045,7 +4095,7 @@ function workflowFromRow(row) {
     scenarioFilter: JSON.parse(row.scenario_filter || "{}"),
     personaIds: JSON.parse(row.persona_ids || "[]"),
     goal: row.goal ? JSON.parse(row.goal) : null,
-    execution: JSON.parse(row.execution || '{"target":"local"}'),
+    execution: workflowExecutionFromValue(JSON.parse(row.execution || '{"target":"local"}')),
     settings: JSON.parse(row.settings || "{}"),
     enabled: row.enabled === 1,
     createdAt: row.created_at,
@@ -15811,7 +15861,6 @@ async function executeTool(page, screenshotter, toolName, toolInput, context) {
         const assertionType = toolInput.assertion_type;
         const selector = toolInput.selector;
         const expected = toolInput.expected;
-        const sessionId = context.sessionId ?? "default";
         switch (assertionType) {
           case "element_exists": {
             if (!selector)
@@ -15876,7 +15925,6 @@ async function executeTool(page, screenshotter, toolName, toolInput, context) {
       case "browser_intercept": {
         const action = toolInput.action;
         const pattern = toolInput.pattern;
-        const interceptAction = toolInput.intercept_action;
         const statusCode = toolInput.status_code;
         const body = toolInput.body;
         const sessionId = context.sessionId ?? "default";
@@ -15953,7 +16001,28 @@ ${JSON.stringify(har, null, 2)}` };
       }
       case "browser_a11y": {
         const level = toolInput.level ?? "AA";
-        const snapshot = await page.accessibility.snapshot();
+        const snapshot = await page.evaluate(() => {
+          function readRole(el) {
+            return el.getAttribute("role") ?? el.tagName.toLowerCase();
+          }
+          function readName(el) {
+            const labelledBy = el.getAttribute("aria-labelledby");
+            if (labelledBy) {
+              const labelledText = labelledBy.split(/\s+/).map((id) => document.getElementById(id)?.textContent?.trim()).filter(Boolean).join(" ");
+              if (labelledText)
+                return labelledText;
+            }
+            return el.getAttribute("aria-label") ?? el.getAttribute("alt") ?? el.textContent?.trim() ?? "";
+          }
+          function walk(el) {
+            return {
+              role: readRole(el),
+              name: readName(el),
+              children: Array.from(el.children).map((child) => walk(child))
+            };
+          }
+          return document.body ? walk(document.body) : null;
+        });
         if (!snapshot)
           return { result: "Error: could not capture accessibility tree" };
         const issues = [];
@@ -15995,6 +16064,38 @@ ${filtered.join(`
     return { result: `Error executing ${toolName}: ${message}` };
   }
 }
+function resolveStartUrl(baseUrl, targetPath) {
+  try {
+    return new URL(targetPath, baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`).toString();
+  } catch {
+    return `${baseUrl.replace(/\/+$/, "")}/${targetPath.replace(/^\/+/, "")}`;
+  }
+}
+function buildScenarioUserMessage(scenario, baseUrl) {
+  const userParts = [
+    `**Scenario:** ${scenario.name}`,
+    `**Description:** ${scenario.description}`
+  ];
+  if (baseUrl) {
+    const normalizedBaseUrl = baseUrl.replace(/\/+$/, "");
+    userParts.push(`**Base URL:** ${normalizedBaseUrl}`);
+    if (scenario.targetPath) {
+      userParts.push(`**Start URL:** ${resolveStartUrl(normalizedBaseUrl, scenario.targetPath)}`);
+    }
+    userParts.push("**Navigation Boundary:** Treat the Base URL as the application under test. Resolve relative paths and in-app navigation against this origin. Do not navigate to another host unless a step explicitly includes an absolute external URL.");
+  }
+  if (scenario.targetPath) {
+    userParts.push(`**Target Path:** ${scenario.targetPath}`);
+  }
+  if (scenario.steps.length > 0) {
+    userParts.push("**Steps:**");
+    for (let i = 0;i < scenario.steps.length; i++) {
+      userParts.push(`${i + 1}. ${scenario.steps[i]}`);
+    }
+  }
+  return userParts.join(`
+`);
+}
 async function runAgentLoop(options) {
   const {
     client,
@@ -16004,6 +16105,7 @@ async function runAgentLoop(options) {
     model,
     runId,
     sessionId,
+    baseUrl,
     maxTurns = 30,
     onStep,
     persona,
@@ -16051,21 +16153,7 @@ Instructions: ${persona.instructions}` : "",
     "- Verify both positive and negative states"
   ].join(`
 `) + personaSection;
-  const userParts = [
-    `**Scenario:** ${scenario.name}`,
-    `**Description:** ${scenario.description}`
-  ];
-  if (scenario.targetPath) {
-    userParts.push(`**Target Path:** ${scenario.targetPath}`);
-  }
-  if (scenario.steps.length > 0) {
-    userParts.push("**Steps:**");
-    for (let i = 0;i < scenario.steps.length; i++) {
-      userParts.push(`${i + 1}. ${scenario.steps[i]}`);
-    }
-  }
-  const userMessage = userParts.join(`
-`);
+  const userMessage = buildScenarioUserMessage(scenario, baseUrl);
   const screenshots = [];
   let tokensUsed = 0;
   let stepNumber = 0;
@@ -16128,7 +16216,7 @@ Instructions: ${persona.instructions}` : "",
         if (onStep) {
           onStep({ type: "tool_call", toolName: toolBlock.name, toolInput, stepNumber });
         }
-        const execResult = await executeTool(page, screenshotter, toolBlock.name, toolInput, { runId, scenarioSlug, stepNumber, sessionId, a11y });
+        const execResult = await executeTool(page, screenshotter, toolBlock.name, toolInput, { runId, scenarioSlug, stepNumber, sessionId: sessionId ?? runId, a11y });
         if (onStep) {
           onStep({ type: "tool_result", toolName: toolBlock.name, toolResult: execResult.result, stepNumber });
         }
@@ -46800,11 +46888,11 @@ var init_scan_issues = __esm(() => {
 
 // src/server/index.ts
 import { existsSync as existsSync10 } from "fs";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/testers",
-  version: "0.0.33",
+  version: "0.0.35",
   description: "AI-powered QA testing CLI \u2014 spawns cheap AI agents to test web apps with headless browsers",
   type: "module",
   main: "dist/index.js",
@@ -46828,10 +46916,10 @@ var package_default = {
   ],
   scripts: {
     build: "bun run build:dashboard && bun run build:cli && bun run build:mcp && bun run build:server && bun run build:lib && bun run build:types",
-    "build:cli": "bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external @modelcontextprotocol/sdk --external @anthropic-ai/sdk --external playwright --external @hasna/browser",
-    "build:mcp": "bun build src/mcp/index.ts --outdir dist/mcp --target bun --external @modelcontextprotocol/sdk --external @anthropic-ai/sdk --external playwright --external @hasna/browser",
-    "build:server": "bun build src/server/index.ts --outdir dist/server --target bun --external @anthropic-ai/sdk --external playwright --external @hasna/browser",
-    "build:lib": "bun build src/index.ts --outdir dist --target bun --external playwright --external @anthropic-ai/sdk --external @modelcontextprotocol/sdk --external @hasna/browser",
+    "build:cli": "bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external @modelcontextprotocol/sdk --external @anthropic-ai/sdk --external playwright --external @hasna/browser --external @hasna/sandboxes",
+    "build:mcp": "bun build src/mcp/index.ts --outdir dist/mcp --target bun --external @modelcontextprotocol/sdk --external @anthropic-ai/sdk --external playwright --external @hasna/browser --external @hasna/sandboxes",
+    "build:server": "bun build src/server/index.ts --outdir dist/server --target bun --external @anthropic-ai/sdk --external playwright --external @hasna/browser --external @hasna/sandboxes",
+    "build:lib": "bun build src/index.ts --outdir dist --target bun --external playwright --external @anthropic-ai/sdk --external @modelcontextprotocol/sdk --external @hasna/browser --external @hasna/sandboxes",
     "build:types": "NODE_OPTIONS='--max-old-space-size=8192' tsc --emitDeclarationOnly --outDir dist --skipLibCheck || true",
     "build:dashboard": "cd dashboard && bun run build",
     "build:ext": "cd extension && bun run build",
@@ -46845,10 +46933,11 @@ var package_default = {
   },
   dependencies: {
     "@anthropic-ai/sdk": "^0.52.0",
-    "@hasna/browser": "^0.4.5",
+    "@hasna/browser": "^0.4.12",
     "@hasna/cloud": "^0.1.24",
     "@hasna/contacts": "^0.6.8",
     "@hasna/projects": "^0.1.42",
+    "@hasna/sandboxes": "^0.1.27",
     "@modelcontextprotocol/sdk": "^1.12.1",
     ai: "^6.0.175",
     chalk: "^5.4.1",
@@ -49002,12 +49091,345 @@ async function notifyRunToConversations(run, results, options) {
   } catch {}
 }
 
+// src/lib/a11y-audit.ts
+async function runA11yAudit(page, options = {}) {
+  const { level = "AA", rules, exclude = [] } = options;
+  await page.addScriptTag({ url: "https://cdnjs.cloudflare.com/ajax/libs/axe-core/4.9.1/axe.min.js" });
+  const config = {
+    runOnly: {
+      type: level === "AAA" ? "standard" : "tag",
+      values: level === "AAA" ? undefined : [level, "best-practice"]
+    }
+  };
+  if (rules && rules.length > 0) {
+    config.rules = Object.fromEntries(rules.map((r) => [r, { enabled: true }]));
+  }
+  if (exclude.length > 0) {
+    config.exclude = exclude;
+  }
+  const result = await page.evaluate(async (auditConfig) => {
+    const axeResult = await window.axe.run(auditConfig);
+    return axeResult;
+  }, config);
+  const violations = (result.violations ?? []).map((v) => ({
+    id: v.id,
+    impact: v.impact,
+    description: v.description,
+    help: v.help,
+    helpUrl: v.helpUrl,
+    nodes: (v.nodes ?? []).map((n) => ({
+      html: n.html,
+      target: n.target,
+      failureSummary: n.failureSummary
+    }))
+  }));
+  const passes = (result.passes ?? []).map((p) => ({
+    id: p.id,
+    description: p.description
+  }));
+  const incomplete = (result.incomplete ?? []).map((i) => ({
+    id: i.id,
+    description: i.description,
+    impact: i.impact
+  }));
+  const criticalCount = violations.filter((v) => v.impact === "critical").length;
+  const seriousCount = violations.filter((v) => v.impact === "serious").length;
+  const moderateCount = violations.filter((v) => v.impact === "moderate").length;
+  const minorCount = violations.filter((v) => v.impact === "minor").length;
+  return {
+    violations,
+    passes,
+    incomplete,
+    url: page.url(),
+    timestamp: new Date().toISOString(),
+    totalViolations: violations.length,
+    criticalCount,
+    seriousCount,
+    moderateCount,
+    minorCount
+  };
+}
+
+// src/lib/assertions.ts
+async function evaluateAssertions(page, assertions, context = {}) {
+  const results = [];
+  for (const assertion of assertions) {
+    try {
+      const result = await evaluateOne(page, assertion, context);
+      results.push(result);
+    } catch (err) {
+      results.push({
+        assertion,
+        passed: false,
+        actual: "",
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  return results;
+}
+async function evaluateOne(page, assertion, context) {
+  switch (assertion.type) {
+    case "visible": {
+      const visible = await page.locator(assertion.selector).isVisible();
+      return {
+        assertion,
+        passed: visible,
+        actual: String(visible)
+      };
+    }
+    case "not_visible": {
+      const visible = await page.locator(assertion.selector).isVisible();
+      return {
+        assertion,
+        passed: !visible,
+        actual: String(visible)
+      };
+    }
+    case "text_contains": {
+      const text = await page.locator(assertion.selector).textContent() ?? "";
+      const expected = String(assertion.expected ?? "");
+      return {
+        assertion,
+        passed: text.includes(expected),
+        actual: text
+      };
+    }
+    case "text_equals": {
+      const text = await page.locator(assertion.selector).textContent() ?? "";
+      const expected = String(assertion.expected ?? "");
+      return {
+        assertion,
+        passed: text.trim() === expected.trim(),
+        actual: text
+      };
+    }
+    case "element_count": {
+      const count = await page.locator(assertion.selector).count();
+      const expected = Number(assertion.expected ?? 0);
+      return {
+        assertion,
+        passed: count === expected,
+        actual: String(count)
+      };
+    }
+    case "no_console_errors": {
+      if (context.consoleErrors !== undefined) {
+        const errors2 = context.consoleErrors.filter(Boolean);
+        return {
+          assertion,
+          passed: errors2.length === 0,
+          actual: errors2.length === 0 ? "No console errors captured" : errors2.slice(0, 3).join(" | ")
+        };
+      }
+      const errorElements = await page.locator('[role="alert"], .error, .error-message, [data-testid="error"]').count();
+      return {
+        assertion,
+        passed: errorElements === 0,
+        actual: `${errorElements} error element(s) found`
+      };
+    }
+    case "no_a11y_violations": {
+      try {
+        const auditResult = await runA11yAudit(page);
+        const hasIssues = auditResult.violations.length > 0;
+        return {
+          assertion,
+          passed: !hasIssues,
+          actual: hasIssues ? `${auditResult.totalViolations} violation(s): ${auditResult.violations.map((v) => v.id).join(", ")}` : "No accessibility violations found"
+        };
+      } catch (err) {
+        return {
+          assertion,
+          passed: false,
+          actual: "",
+          error: err instanceof Error ? err.message : String(err)
+        };
+      }
+    }
+    case "url_contains": {
+      const url = page.url();
+      const expected = String(assertion.expected ?? "");
+      return {
+        assertion,
+        passed: url.includes(expected),
+        actual: url
+      };
+    }
+    case "title_contains": {
+      const title = await page.title();
+      const expected = String(assertion.expected ?? "");
+      return {
+        assertion,
+        passed: title.includes(expected),
+        actual: title
+      };
+    }
+    case "cookie_exists": {
+      const cookieName = assertion.expected;
+      const cookies = await page.context().cookies();
+      const found = cookies.some((c) => c.name === cookieName);
+      return {
+        assertion,
+        passed: found,
+        actual: found ? `Cookie "${cookieName}" exists` : `Cookie "${cookieName}" not found`
+      };
+    }
+    case "cookie_not_exists": {
+      const cookieName = assertion.expected;
+      const cookies = await page.context().cookies();
+      const found = cookies.some((c) => c.name === cookieName);
+      return {
+        assertion,
+        passed: !found,
+        actual: found ? `Cookie "${cookieName}" found (unexpected)` : `Cookie "${cookieName}" does not exist`
+      };
+    }
+    case "cookie_value": {
+      const [cookieName, expectedValue] = assertion.expected.split("=", 2);
+      const cookies = await page.context().cookies();
+      const cookie = cookies.find((c) => c.name === cookieName);
+      const actualValue = cookie?.value ?? "";
+      return {
+        assertion,
+        passed: actualValue === expectedValue,
+        actual: cookie ? `${cookieName}=${actualValue}` : `Cookie "${cookieName}" not found`
+      };
+    }
+    case "local_storage_exists": {
+      const key = assertion.expected;
+      const value = await page.evaluate((k) => localStorage.getItem(k), key);
+      return {
+        assertion,
+        passed: value !== null,
+        actual: value !== null ? `Key "${key}" exists with value "${value}"` : `Key "${key}" not found in localStorage`
+      };
+    }
+    case "local_storage_not_exists": {
+      const key = assertion.expected;
+      const value = await page.evaluate((k) => localStorage.getItem(k), key);
+      return {
+        assertion,
+        passed: value === null,
+        actual: value !== null ? `Key "${key}" exists (unexpected)` : `Key "${key}" does not exist in localStorage`
+      };
+    }
+    case "local_storage_value": {
+      const [lsKey, expectedValue] = assertion.expected.split("=", 2);
+      const value = await page.evaluate((k) => localStorage.getItem(k), lsKey ?? "");
+      return {
+        assertion,
+        passed: value === expectedValue,
+        actual: value !== null ? `${lsKey}=${value}` : `Key "${lsKey}" not found in localStorage`
+      };
+    }
+    case "session_storage_value": {
+      const [ssKey, expectedValue] = assertion.expected.split("=", 2);
+      const value = await page.evaluate((k) => sessionStorage.getItem(k), ssKey ?? "");
+      return {
+        assertion,
+        passed: value === expectedValue,
+        actual: value !== null ? `${ssKey}=${value}` : `Key "${ssKey}" not found in sessionStorage`
+      };
+    }
+    case "session_storage_not_exists": {
+      const key = assertion.expected;
+      const value = await page.evaluate((k) => sessionStorage.getItem(k), key);
+      return {
+        assertion,
+        passed: value === null,
+        actual: value !== null ? `Key "${key}" exists (unexpected)` : `Key "${key}" does not exist in sessionStorage`
+      };
+    }
+    default: {
+      return {
+        assertion,
+        passed: false,
+        actual: "",
+        error: `Unknown assertion type: ${assertion.type}`
+      };
+    }
+  }
+}
+function allAssertionsPassed(results) {
+  return results.every((r) => r.passed);
+}
+function formatAssertionResults(results) {
+  if (results.length === 0)
+    return "No assertions.";
+  const lines = [];
+  for (const r of results) {
+    const icon = r.passed ? "PASS" : "FAIL";
+    const desc = r.assertion.description || `${r.assertion.type}${r.assertion.selector ? ` ${r.assertion.selector}` : ""}`;
+    let line = `  [${icon}] ${desc}`;
+    if (!r.passed) {
+      line += ` (actual: ${r.actual})`;
+      if (r.error)
+        line += ` \u2014 ${r.error}`;
+    }
+    lines.push(line);
+  }
+  const passed = results.filter((r) => r.passed).length;
+  lines.push(`
+  ${passed}/${results.length} assertions passed.`);
+  return lines.join(`
+`);
+}
+
 // src/lib/runner.ts
 var eventHandler = null;
 function emit(event) {
   if (eventHandler)
     eventHandler(event);
 }
+function assertionDescription(result) {
+  return result.assertion.description || `${result.assertion.type}${result.assertion.selector ? ` ${result.assertion.selector}` : ""}`;
+}
+function summarizeAssertionResult(result) {
+  const description = assertionDescription(result);
+  if (result.passed)
+    return description;
+  const suffix = result.error ? `; ${result.error}` : "";
+  return `${description} (actual: ${result.actual}${suffix})`;
+}
+async function applyStructuredAssertionsToResult(input) {
+  const assertions = input.scenario.assertions ?? [];
+  if (assertions.length === 0) {
+    return {
+      status: input.status,
+      reasoning: input.reasoning,
+      assertionsPassed: [],
+      assertionsFailed: [],
+      assertionResults: []
+    };
+  }
+  const results = await evaluateAssertions(input.page, assertions, {
+    consoleErrors: input.consoleErrors
+  });
+  const assertionsPassed = results.filter((r) => r.passed).map(summarizeAssertionResult);
+  const assertionsFailed = results.filter((r) => !r.passed).map(summarizeAssertionResult);
+  const assertionResults = results.map((result) => ({
+    type: result.assertion.type,
+    description: assertionDescription(result),
+    passed: result.passed,
+    actual: result.actual,
+    ...result.error ? { error: result.error } : {}
+  }));
+  const assertionsOk = allAssertionsPassed(results);
+  const status = assertionsOk || input.status !== "passed" ? input.status : "failed";
+  const assertionHeading = assertionsOk ? "Structured assertions passed:" : "Structured assertions failed:";
+  const reasoningParts = [input.reasoning, `${assertionHeading}
+${formatAssertionResults(results)}`].map((part) => part.trim()).filter(Boolean);
+  return {
+    status,
+    reasoning: reasoningParts.join(`
+
+`),
+    assertionsPassed,
+    assertionsFailed,
+    assertionResults
+  };
+}
 function withTimeout(promise, ms, label) {
   return new Promise((resolve, reject) => {
     const warningAt = Math.floor(ms * 0.8);
@@ -49178,6 +49600,7 @@ async function runSingleScenario(scenario, runId, options) {
       model,
       runId,
       sessionId: result.id,
+      baseUrl: options.url,
       maxTurns: effectiveOptions.minimal ? 10 : 30,
       a11y: effectiveOptions.a11y,
       persona: persona ? {
@@ -49260,27 +49683,46 @@ async function runSingleScenario(scenario, runId, options) {
     closeSession(result.id);
     const lightpandaNote = options.engine === "lightpanda" ? " (Running with Lightpanda \u2014 no screenshots)" : options.engine === "bun" ? " (Running with Bun.WebView \u2014 native, ~11x faster)" : "";
     const networkMeta = networkErrors.length > 0 ? { networkErrors: networkErrors.slice(0, 20) } : {};
-    let updatedResult = updateResult(result.id, {
+    const baseReasoning = agentResult.reasoning ? agentResult.reasoning + lightpandaNote : lightpandaNote || "";
+    const assertionOutcome = await applyStructuredAssertionsToResult({
+      page,
+      scenario,
+      consoleErrors,
       status: agentResult.status,
-      reasoning: agentResult.reasoning ? agentResult.reasoning + lightpandaNote : lightpandaNote || undefined,
+      reasoning: baseReasoning
+    });
+    const structuredAssertionMeta = assertionOutcome.assertionResults.length > 0 ? {
+      structuredAssertions: {
+        passed: assertionOutcome.assertionsPassed,
+        failed: assertionOutcome.assertionsFailed,
+        results: assertionOutcome.assertionResults
+      }
+    } : {};
+    let updatedResult = updateResult(result.id, {
+      status: assertionOutcome.status,
+      reasoning: assertionOutcome.reasoning || undefined,
       stepsCompleted: agentResult.stepsCompleted,
       durationMs: Date.now() - new Date(result.createdAt).getTime(),
       tokensUsed: agentResult.tokensUsed,
       costCents: estimateCost(model, agentResult.tokensUsed),
-      metadata: { consoleLogs, ...networkErrors.length > 0 ? networkMeta : {} }
+      metadata: {
+        consoleLogs,
+        ...networkErrors.length > 0 ? networkMeta : {},
+        ...structuredAssertionMeta
+      }
     });
-    if (agentResult.status === "failed" || agentResult.status === "error") {
-      const failureAnalysis = analyzeFailure(null, agentResult.reasoning ?? null);
+    if (assertionOutcome.status === "failed" || assertionOutcome.status === "error") {
+      const failureAnalysis = analyzeFailure(null, assertionOutcome.reasoning ?? null);
       if (failureAnalysis) {
         updatedResult = updateResult(result.id, { failureAnalysis });
       }
     }
-    if (agentResult.status === "passed") {
+    if (assertionOutcome.status === "passed") {
       try {
         updateScenarioPassedCache(scenario.id, options.url);
       } catch {}
     }
-    const eventType = agentResult.status === "passed" ? "scenario:pass" : "scenario:fail";
+    const eventType = assertionOutcome.status === "passed" ? "scenario:pass" : "scenario:fail";
     emit({ type: eventType, scenarioId: scenario.id, scenarioName: scenario.name, resultId: result.id, runId });
     return updatedResult;
   } catch (error) {
@@ -49305,7 +49747,8 @@ async function runSingleScenario(scenario, runId, options) {
   } finally {
     if (harPath) {
       try {
-        updateResult(result.id, { metadata: { harPath } });
+        const existing = getResult(result.id);
+        updateResult(result.id, { metadata: { ...existing?.metadata ?? {}, harPath } });
       } catch {}
     }
     if (browser) {
@@ -49477,22 +49920,31 @@ async function runBatch(scenarios, options) {
   }
   return { run: finalRun, results };
 }
-async function runByFilter(options) {
-  let scenarios;
+function findScenarioInList(scenarios, id) {
+  return scenarios.find((scenario) => scenario.id === id || scenario.shortId === id || scenario.id.startsWith(id)) ?? null;
+}
+function resolveScenariosForRun(options) {
   if (options.scenarioIds && options.scenarioIds.length > 0) {
-    const all = listScenarios({ projectId: options.projectId });
-    scenarios = all.filter((s) => options.scenarioIds.includes(s.id) || options.scenarioIds.includes(s.shortId));
-    if (scenarios.length === 0 && options.projectId) {
-      const global2 = listScenarios({});
-      scenarios = global2.filter((s) => options.scenarioIds.includes(s.id) || options.scenarioIds.includes(s.shortId));
+    const scoped = listScenarios({ projectId: options.projectId });
+    const resolved = [];
+    const seen = new Set;
+    for (const id of options.scenarioIds) {
+      const scenario = findScenarioInList(scoped, id) ?? getScenario(id);
+      if (scenario && !seen.has(scenario.id)) {
+        resolved.push(scenario);
+        seen.add(scenario.id);
+      }
     }
-  } else {
-    scenarios = listScenarios({
-      projectId: options.projectId,
-      tags: options.tags,
-      priority: options.priority
-    });
+    return resolved;
   }
+  return listScenarios({
+    projectId: options.projectId,
+    tags: options.tags,
+    priority: options.priority
+  });
+}
+async function runByFilter(options) {
+  const scenarios = resolveScenariosForRun(options);
   if (scenarios.length === 0) {
     const config = loadConfig();
     const model = resolveModel(options.model ?? config.defaultModel);
@@ -50656,18 +51108,7 @@ function normalizeFilter(input) {
   };
 }
 function normalizeExecution(input) {
-  const target = input?.target ?? "local";
-  if (target === "connector:e2b") {
-    return {
-      target,
-      connector: input?.connector ?? "e2b",
-      operation: input?.operation ?? "run",
-      sandboxTemplate: input?.sandboxTemplate,
-      timeoutMs: input?.timeoutMs,
-      env: input?.env
-    };
-  }
-  return { ...DEFAULT_EXECUTION, timeoutMs: input?.timeoutMs };
+  return input ? workflowExecutionFromValue(input) : DEFAULT_EXECUTION;
 }
 function createTestingWorkflow(input) {
   const db2 = getDatabase();
@@ -50766,6 +51207,10 @@ function db2() {
 }
 
 // src/lib/workflow-runner.ts
+init_database();
+import { mkdtempSync, rmSync, writeFileSync as writeFileSync3 } from "fs";
+import { tmpdir } from "os";
+import { join as join13 } from "path";
 function buildWorkflowRunPlan(workflow, options) {
   const runOptions = {
     url: options.url,
@@ -50782,10 +51227,10 @@ function buildWorkflowRunPlan(workflow, options) {
   return {
     workflow,
     runOptions,
-    connectorCommand: workflow.execution.target === "connector:e2b" ? buildConnectorCommand(workflow.execution, runOptions) : null
+    sandbox: workflow.execution.target === "sandbox" ? buildSandboxPlan(workflow, workflow.execution, runOptions) : null
   };
 }
-async function runTestingWorkflow(workflowId, options) {
+async function runTestingWorkflow(workflowId, options, dependencies = {}) {
   const workflow = getTestingWorkflow(workflowId);
   if (!workflow)
     throw new Error(`Testing workflow not found: ${workflowId}`);
@@ -50795,13 +51240,25 @@ async function runTestingWorkflow(workflowId, options) {
   const plan = buildWorkflowRunPlan(workflow, options);
   if (options.dryRun)
     return { run: null, results: [], plan };
-  if (workflow.execution.target === "connector:e2b") {
-    const connectorResult = await runViaConnector(plan);
-    return { run: null, results: [], plan, connectorResult };
+  if (workflow.execution.target === "sandbox") {
+    const sandboxResult = await runViaSandbox(plan, dependencies);
+    return { run: null, results: [], plan, sandboxResult };
   }
-  const { run, results } = await runByFilter(plan.runOptions);
+  const runLocal = dependencies.runByFilter ?? runByFilter;
+  const { run, results } = await runLocal(plan.runOptions);
   return { run, results, plan };
 }
+function createWorkflowDatabaseBundle(workflow, plan) {
+  if (!plan.sandbox)
+    throw new Error(`Workflow is not configured for sandbox execution: ${workflow.name}`);
+  const localDir = mkdtempSync(join13(tmpdir(), `testers-workflow-${workflow.id.slice(0, 8)}-`));
+  writeFileSync3(join13(localDir, "testers.db"), getDatabase().serialize());
+  return {
+    localDir,
+    remoteDir: plan.sandbox.stateRemoteDir,
+    cleanup: () => rmSync(localDir, { recursive: true, force: true })
+  };
+}
 function validatePersonaIds(workflow) {
   for (const personaId of workflow.personaIds) {
     if (!getPersona(personaId)) {
@@ -50809,46 +51266,109 @@ function validatePersonaIds(workflow) {
     }
   }
 }
-function buildConnectorCommand(execution, runOptions) {
-  const connector = execution.connector ?? "e2b";
-  const operation = execution.operation ?? "run";
-  const payload = JSON.stringify({
-    operation,
-    template: execution.sandboxTemplate,
+function buildSandboxPlan(workflow, execution, runOptions) {
+  const remoteDir = execution.sandboxRemoteDir ?? `/tmp/testers-workflow-${workflow.id.slice(0, 8)}`;
+  const stateRemoteDir = `${remoteDir.replace(/\/+$/, "")}/.testers-state`;
+  return {
+    provider: execution.provider,
+    image: execution.sandboxImage,
+    name: `testers-${workflow.id.slice(0, 8)}`,
+    remoteDir,
+    stateRemoteDir,
+    cleanup: execution.sandboxCleanup ?? "delete",
     timeoutMs: execution.timeoutMs,
-    env: execution.env ?? {},
-    command: [
-      "bunx",
-      "@hasna/testers",
-      "run",
-      runOptions.url,
-      ...runOptions.scenarioIds?.length ? ["--scenario", runOptions.scenarioIds.join(",")] : [],
-      ...runOptions.tags?.length ? runOptions.tags.flatMap((tag) => ["--tag", tag]) : [],
-      ...runOptions.priority ? ["--priority", runOptions.priority] : [],
-      ...runOptions.projectId ? ["--project", runOptions.projectId] : [],
-      ...runOptions.model ? ["--model", runOptions.model] : [],
-      "--json"
-    ]
-  });
-  return ["connectors", "run", connector, operation, payload];
+    env: execution.env,
+    command: buildSandboxCommand({
+      runOptions,
+      remoteDir,
+      dbPath: `${stateRemoteDir}/testers.db`,
+      setupCommand: execution.setupCommand,
+      packageSpec: execution.packageSpec ?? "@hasna/testers"
+    })
+  };
 }
-async function runViaConnector(plan) {
-  if (!plan.connectorCommand)
-    throw new Error("Workflow does not have a connector command");
-  const proc = Bun.spawn(plan.connectorCommand, {
-    stdout: "pipe",
-    stderr: "pipe",
-    env: process.env
-  });
-  const [stdout, stderr, exitCode] = await Promise.all([
-    new Response(proc.stdout).text(),
-    new Response(proc.stderr).text(),
-    proc.exited
-  ]);
-  if (exitCode !== 0) {
-    throw new Error(`Connector execution failed (${exitCode}): ${stderr || stdout}`);
+function buildSandboxCommand(input) {
+  const args = [
+    "bunx",
+    input.packageSpec,
+    "run",
+    input.runOptions.url,
+    ...input.runOptions.scenarioIds?.length ? ["--scenario", input.runOptions.scenarioIds.join(",")] : [],
+    ...input.runOptions.tags?.length ? input.runOptions.tags.flatMap((tag) => ["--tag", tag]) : [],
+    ...input.runOptions.priority ? ["--priority", input.runOptions.priority] : [],
+    ...input.runOptions.projectId ? ["--project", input.runOptions.projectId] : [],
+    ...input.runOptions.model ? ["--model", input.runOptions.model] : [],
+    ...input.runOptions.headed ? ["--headed"] : [],
+    ...input.runOptions.parallel ? ["--parallel", String(input.runOptions.parallel)] : [],
+    ...input.runOptions.timeout ? ["--timeout", String(input.runOptions.timeout)] : [],
+    ...input.runOptions.personaIds?.length ? ["--persona", input.runOptions.personaIds.join(",")] : [],
+    "--no-auto-generate",
+    "--json"
+  ];
+  return [
+    "set -euo pipefail",
+    `mkdir -p ${shellQuote(input.remoteDir)}`,
+    `cd ${shellQuote(input.remoteDir)}`,
+    input.setupCommand,
+    `HASNA_TESTERS_DB_PATH=${shellQuote(input.dbPath)} ${args.map(shellQuote).join(" ")}`
+  ].filter(Boolean).join(`
+`);
+}
+async function runViaSandbox(plan, dependencies) {
+  if (!plan.sandbox)
+    throw new Error("Workflow does not have a sandbox plan");
+  const sandboxes = await resolveSandboxesRuntime(dependencies);
+  const createBundle = dependencies.createDatabaseBundle ?? createWorkflowDatabaseBundle;
+  const bundle = createBundle(plan.workflow, plan);
+  try {
+    const raw = await sandboxes.runCommandInSandbox({
+      command: plan.sandbox.command,
+      provider: plan.sandbox.provider,
+      name: plan.sandbox.name,
+      image: plan.sandbox.image,
+      sandboxTimeout: plan.sandbox.timeoutMs,
+      commandTimeoutMs: plan.sandbox.timeoutMs,
+      projectId: plan.workflow.projectId ?? undefined,
+      config: {
+        source: "testers",
+        workflowId: plan.workflow.id,
+        workflowName: plan.workflow.name
+      },
+      sandboxEnvVars: plan.sandbox.env,
+      cleanup: plan.sandbox.cleanup,
+      upload: {
+        localDir: bundle.localDir,
+        remoteDir: bundle.remoteDir
+      }
+    });
+    const exitCode = raw.result.exit_code ?? raw.result.exitCode ?? 0;
+    const stdout = raw.result.stdout ?? "";
+    const stderr = raw.result.stderr ?? "";
+    if (exitCode !== 0) {
+      throw new Error(`Sandbox workflow execution failed (${exitCode}): ${stderr || stdout}`);
+    }
+    return {
+      sandboxId: raw.sandbox.id,
+      sessionId: raw.session.id,
+      exitCode,
+      stdout,
+      stderr,
+      cleanup: raw.cleanup
+    };
+  } finally {
+    bundle.cleanup?.();
   }
-  return stdout.trim();
+}
+async function resolveSandboxesRuntime(dependencies) {
+  if (dependencies.sandboxes)
+    return dependencies.sandboxes;
+  if (dependencies.createSandboxesSDK)
+    return dependencies.createSandboxesSDK();
+  const mod = await import("@hasna/sandboxes");
+  return mod.createSandboxesSDK();
+}
+function shellQuote(value) {
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
 }
 
 // src/lib/workflow-agent.ts
@@ -51200,10 +51720,16 @@ var WorkflowFilterSchema = exports_external.object({
   priority: exports_external.enum(["low", "medium", "high", "critical"]).optional()
 }).optional();
 var WorkflowExecutionSchema = exports_external.object({
-  target: exports_external.enum(["local", "connector:e2b"]).default("local"),
+  target: exports_external.enum(["local", "sandbox", "connector:e2b"]).default("local"),
   connector: exports_external.string().optional(),
   operation: exports_external.string().optional(),
+  provider: exports_external.string().optional(),
+  sandboxImage: exports_external.string().optional(),
+  sandboxRemoteDir: exports_external.string().optional(),
+  sandboxCleanup: exports_external.enum(["delete", "stop", "keep"]).optional(),
   sandboxTemplate: exports_external.string().optional(),
+  setupCommand: exports_external.string().optional(),
+  packageSpec: exports_external.string().optional(),
   timeoutMs: exports_external.number().int().positive().optional(),
   env: exports_external.record(exports_external.string()).optional()
 }).optional();
@@ -51285,7 +51811,7 @@ async function handleRequest(req) {
   if (pathname === "/api/status" && method === "GET") {
     const config2 = loadConfig();
     getDatabase();
-    const dbPath = process.env["HASNA_TESTERS_DB_PATH"] ?? process.env["TESTERS_DB_PATH"] ?? join13(getTestersDir(), "testers.db");
+    const dbPath = process.env["HASNA_TESTERS_DB_PATH"] ?? process.env["TESTERS_DB_PATH"] ?? join14(getTestersDir(), "testers.db");
     const scenarios = listScenarios();
     const runs = listRuns();
     return jsonResponse({
@@ -52015,7 +52541,7 @@ async function handleRequest(req) {
     return jsonResponse({ routes, apiRoutes, totalCovered: coverageMap.size });
   }
   if (!pathname.startsWith("/api")) {
-    const dashboardDir = join13(import.meta.dir, "..", "..", "dashboard", "dist");
+    const dashboardDir = join14(import.meta.dir, "..", "..", "dashboard", "dist");
     if (!existsSync10(dashboardDir)) {
       return new Response(`<!DOCTYPE html>
 <html>
@@ -52034,7 +52560,7 @@ async function handleRequest(req) {
         }
       });
     }
-    const filePath = join13(dashboardDir, pathname === "/" ? "index.html" : pathname);
+    const filePath = join14(dashboardDir, pathname === "/" ? "index.html" : pathname);
     if (existsSync10(filePath)) {
       const file2 = Bun.file(filePath);
       return new Response(file2, {
@@ -52044,7 +52570,7 @@ async function handleRequest(req) {
         }
       });
     }
-    const indexPath = join13(dashboardDir, "index.html");
+    const indexPath = join14(dashboardDir, "index.html");
     if (existsSync10(indexPath)) {
       const file2 = Bun.file(indexPath);
       return new Response(file2, {