@hasna/testers 0.0.45 → 0.0.47

package/dist/cli/index.js

@@ -2142,6 +2142,12 @@ function workflowExecutionFromValue(value) {
   const sandboxSyncStrategy = syncStrategyValue(input["sandboxSyncStrategy"]);
   const setupCommand = stringValue(input["setupCommand"]);
   const packageSpec = stringValue(input["packageSpec"]);
+  const appSourceDir = stringValue(input["appSourceDir"]);
+  const appRemoteDir = stringValue(input["appRemoteDir"]);
+  const appStartCommand = stringValue(input["appStartCommand"]);
+  const appUrl = stringValue(input["appUrl"]);
+  const appWaitUrl = stringValue(input["appWaitUrl"]);
+  const appWaitTimeoutMs = numberValue(input["appWaitTimeoutMs"]);
   const timeoutMs = numberValue(input["timeoutMs"]);
   const env = stringMap(input["env"]);
   return {
@@ -2153,6 +2159,12 @@ function workflowExecutionFromValue(value) {
     ...sandboxSyncStrategy ? { sandboxSyncStrategy } : {},
     ...setupCommand ? { setupCommand } : {},
     ...packageSpec ? { packageSpec } : {},
+    ...appSourceDir ? { appSourceDir } : {},
+    ...appRemoteDir ? { appRemoteDir } : {},
+    ...appStartCommand ? { appStartCommand } : {},
+    ...appUrl ? { appUrl } : {},
+    ...appWaitUrl ? { appWaitUrl } : {},
+    ...appWaitTimeoutMs !== undefined ? { appWaitTimeoutMs } : {},
     ...timeoutMs !== undefined ? { timeoutMs } : {},
     ...env ? { env } : {}
   };
@@ -27027,9 +27039,10 @@ var init_workflows = __esm(() => {
 });
 
 // src/lib/workflow-runner.ts
-import { mkdtempSync, rmSync, writeFileSync as writeFileSync4 } from "fs";
+import { spawnSync } from "child_process";
+import { existsSync as existsSync14, mkdirSync as mkdirSync11, mkdtempSync, rmSync, statSync } from "fs";
 import { tmpdir } from "os";
-import { join as join16 } from "path";
+import { join as join16, posix as pathPosix } from "path";
 function buildWorkflowRunPlan(workflow, options) {
   const runOptions = {
     url: options.url,
@@ -27071,10 +27084,16 @@ function createWorkflowDatabaseBundle(workflow, plan) {
   if (!plan.sandbox)
     throw new Error(`Workflow is not configured for sandbox execution: ${workflow.name}`);
   const localDir = mkdtempSync(join16(tmpdir(), `testers-workflow-${workflow.id.slice(0, 8)}-`));
-  writeFileSync4(join16(localDir, "testers.db"), getDatabase().serialize());
+  const stateDir = join16(localDir, ".testers-state");
+  mkdirSync11(stateDir, { recursive: true });
+  writeDatabaseSnapshot(join16(stateDir, "testers.db"));
+  if (plan.sandbox.appSourceDir && plan.sandbox.appRemoteDir) {
+    const relativeAppDir = relativeRemotePath(plan.sandbox.remoteDir, plan.sandbox.appRemoteDir);
+    copyAppSource(plan.sandbox.appSourceDir, join16(localDir, relativeAppDir));
+  }
   return {
     localDir,
-    remoteDir: plan.sandbox.stateRemoteDir,
+    remoteDir: plan.sandbox.remoteDir,
     cleanup: () => rmSync(localDir, { recursive: true, force: true })
   };
 }
@@ -27085,15 +27104,63 @@ function validatePersonaIds(workflow) {
     }
   }
 }
+function relativeRemotePath(remoteDir, remoteChildDir) {
+  if (!remoteChildDir.startsWith("/")) {
+    const relative3 = remoteChildDir.replace(/^\/+/, "").replace(/\/+$/, "");
+    if (!relative3 || relative3 === ".") {
+      throw new Error("Sandbox app remote directory must be a child directory, not the workflow root");
+    }
+    return relative3;
+  }
+  const base = remoteDir.replace(/\/+$/, "") || "/";
+  const child = remoteChildDir.replace(/\/+$/, "") || "/";
+  const relative2 = pathPosix.relative(base, child);
+  if (!relative2 || relative2 === "." || relative2.startsWith("..") || pathPosix.isAbsolute(relative2)) {
+    throw new Error(`Sandbox app remote directory must be inside the workflow remote directory (${remoteDir}): ${remoteChildDir}`);
+  }
+  return relative2;
+}
+function copyAppSource(sourceDir, targetDir) {
+  if (!existsSync14(sourceDir) || !statSync(sourceDir).isDirectory()) {
+    throw new Error(`Sandbox app source directory does not exist or is not a directory: ${sourceDir}`);
+  }
+  mkdirSync11(targetDir, { recursive: true });
+  const result = spawnSync("rsync", [
+    "-a",
+    "--delete",
+    ...APP_SOURCE_EXCLUDES.flatMap((item) => ["--exclude", item]),
+    `${sourceDir.replace(/\/+$/, "")}/`,
+    `${targetDir.replace(/\/+$/, "")}/`
+  ], { encoding: "utf8" });
+  if (result.error) {
+    throw new Error(`Failed to rsync sandbox app source: ${result.error.message}`);
+  }
+  if (result.status !== 0) {
+    throw new Error(`Failed to rsync sandbox app source (${result.status}): ${result.stderr.trim()}`);
+  }
+}
+function writeDatabaseSnapshot(targetPath) {
+  getDatabase().exec(`VACUUM INTO ${sqlString(targetPath)}`);
+}
+function sqlString(value) {
+  return `'${value.replaceAll("'", "''")}'`;
+}
 function buildSandboxPlan(workflow, execution, runOptions) {
   const remoteDir = execution.sandboxRemoteDir ?? `/tmp/testers-workflow-${workflow.id.slice(0, 8)}`;
   const stateRemoteDir = `${remoteDir.replace(/\/+$/, "")}/.testers-state`;
+  const appRemoteDir = execution.appSourceDir ? execution.appRemoteDir ?? `${remoteDir.replace(/\/+$/, "")}/app` : execution.appRemoteDir;
   return {
     provider: execution.provider,
     image: execution.sandboxImage,
     name: `testers-${workflow.id.slice(0, 8)}`,
     remoteDir,
     stateRemoteDir,
+    ...execution.appSourceDir ? { appSourceDir: execution.appSourceDir } : {},
+    ...appRemoteDir ? { appRemoteDir } : {},
+    ...execution.appStartCommand ? { appStartCommand: execution.appStartCommand } : {},
+    ...execution.appUrl ? { appUrl: execution.appUrl } : {},
+    ...execution.appWaitUrl ? { appWaitUrl: execution.appWaitUrl } : {},
+    ...execution.appWaitTimeoutMs !== undefined ? { appWaitTimeoutMs: execution.appWaitTimeoutMs } : {},
     cleanup: execution.sandboxCleanup ?? "delete",
     syncStrategy: execution.sandboxSyncStrategy ?? "rsync",
     timeoutMs: execution.timeoutMs,
@@ -27101,6 +27168,12 @@ function buildSandboxPlan(workflow, execution, runOptions) {
     command: buildSandboxCommand({
       runOptions,
       remoteDir,
+      stateRemoteDir,
+      appRemoteDir,
+      appStartCommand: execution.appStartCommand,
+      appUrl: execution.appUrl,
+      appWaitUrl: execution.appWaitUrl,
+      appWaitTimeoutMs: execution.appWaitTimeoutMs,
       dbPath: `${stateRemoteDir}/testers.db`,
       setupCommand: execution.setupCommand,
       packageSpec: execution.packageSpec ?? "@hasna/testers"
@@ -27108,11 +27181,12 @@ function buildSandboxPlan(workflow, execution, runOptions) {
   };
 }
 function buildSandboxCommand(input) {
+  const targetUrl = input.appUrl ?? input.runOptions.url;
   const args = [
     "bunx",
     input.packageSpec,
     "run",
-    input.runOptions.url,
+    targetUrl,
     ...input.runOptions.scenarioIds?.length ? ["--scenario", input.runOptions.scenarioIds.join(",")] : [],
     ...input.runOptions.tags?.length ? input.runOptions.tags.flatMap((tag) => ["--tag", tag]) : [],
     ...input.runOptions.priority ? ["--priority", input.runOptions.priority] : [],
@@ -27128,12 +27202,46 @@ function buildSandboxCommand(input) {
   return [
     "set -euo pipefail",
     `mkdir -p ${shellQuote(input.remoteDir)}`,
-    `cd ${shellQuote(input.remoteDir)}`,
+    `mkdir -p ${shellQuote(input.stateRemoteDir)}`,
+    input.appRemoteDir ? `mkdir -p ${shellQuote(input.appRemoteDir)}` : undefined,
+    `cd ${shellQuote(input.appRemoteDir ?? input.remoteDir)}`,
     input.setupCommand,
+    buildAppStartCommand(input),
     `HASNA_TESTERS_DB_PATH=${shellQuote(input.dbPath)} ${args.map(shellQuote).join(" ")}`
   ].filter(Boolean).join(`
 `);
 }
+function buildAppStartCommand(input) {
+  if (!input.appStartCommand)
+    return;
+  const waitUrl = input.appWaitUrl ?? input.appUrl ?? input.runOptions.url;
+  const waitTimeoutMs = input.appWaitTimeoutMs ?? 120000;
+  return [
+    `( ${input.appStartCommand} ) > ${shellQuote(`${input.stateRemoteDir}/app.log`)} 2>&1 &`,
+    "APP_PID=$!",
+    `echo "$APP_PID" > ${shellQuote(`${input.stateRemoteDir}/app.pid`)}`,
+    `trap 'kill "$APP_PID" 2>/dev/null || true' EXIT`,
+    waitUrl ? buildWaitForUrlCommand(waitUrl, waitTimeoutMs) : undefined
+  ].filter(Boolean).join(`
+`);
+}
+function buildWaitForUrlCommand(url, timeoutMs) {
+  const script = `
+const url = ${JSON.stringify(url)};
+const timeoutMs = ${JSON.stringify(timeoutMs)};
+const deadline = Date.now() + timeoutMs;
+while (Date.now() <= deadline) {
+  try {
+    const response = await fetch(url);
+    if (response.status >= 200 && response.status < 500) process.exit(0);
+  } catch {}
+  await new Promise((resolve) => setTimeout(resolve, 1000));
+}
+console.error(\`Timed out waiting for \${url} after \${timeoutMs}ms\`);
+process.exit(1);
+`.trim();
+  return `bun -e ${shellQuote(script)}`;
+}
 async function runViaSandbox(plan, dependencies) {
   if (!plan.sandbox)
     throw new Error("Workflow does not have a sandbox plan");
@@ -27154,7 +27262,7 @@ async function runViaSandbox(plan, dependencies) {
         workflowId: plan.workflow.id,
         workflowName: plan.workflow.name
       },
-      sandboxEnvVars: plan.sandbox.env,
+      sandboxEnvVars: resolveSandboxEnv(plan.sandbox.env),
       cleanup: plan.sandbox.cleanup,
       upload: {
         localDir: bundle.localDir,
@@ -27180,6 +27288,19 @@ async function runViaSandbox(plan, dependencies) {
     bundle.cleanup?.();
   }
 }
+function resolveSandboxEnv(env) {
+  if (!env || Object.keys(env).length === 0)
+    return;
+  const resolved = {};
+  for (const [key, value] of Object.entries(env)) {
+    const resolvedValue = resolveCredential(value);
+    if (resolvedValue === null) {
+      throw new Error(`Missing sandbox env value for ${key}`);
+    }
+    resolved[key] = resolvedValue;
+  }
+  return resolved;
+}
 async function resolveSandboxesRuntime(dependencies) {
   if (dependencies.sandboxes)
     return dependencies.sandboxes;
@@ -27191,11 +27312,23 @@ async function resolveSandboxesRuntime(dependencies) {
 function shellQuote(value) {
   return `'${value.replaceAll("'", `'"'"'`)}'`;
 }
+var APP_SOURCE_EXCLUDES;
 var init_workflow_runner = __esm(() => {
   init_database();
   init_workflows();
   init_personas();
   init_runner();
+  init_secrets_resolver();
+  APP_SOURCE_EXCLUDES = [
+    "node_modules",
+    ".git",
+    "dist",
+    ".next",
+    ".turbo",
+    ".cache",
+    ".venv",
+    "__pycache__"
+  ];
 });
 
 // src/lib/ci.ts
@@ -27760,9 +27893,9 @@ import { webcrypto as crypto2 } from "crypto";
 import { existsSync as existsSync42, writeFileSync as writeFileSync32, readFileSync as readFileSync22, mkdirSync as mkdirSync32 } from "fs";
 import { join as join42 } from "path";
 import { Database as Database4 } from "bun:sqlite";
-import { existsSync as existsSync16, mkdirSync as mkdirSync13 } from "fs";
+import { existsSync as existsSync17, mkdirSync as mkdirSync14 } from "fs";
 import { dirname as dirname4, join as join19, resolve as resolve2 } from "path";
-import { existsSync as existsSync22, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync22, writeFileSync as writeFileSync6 } from "fs";
 import { join as join22 } from "path";
 import { execSync as execSync3, execFileSync } from "child_process";
 import { existsSync as existsSync32, readFileSync as readFileSync7, writeFileSync as writeFileSync22, mkdirSync as mkdirSync22 } from "fs";
@@ -27774,7 +27907,7 @@ import * as zlib from "zlib";
 import { Readable } from "stream";
 import { Writable } from "stream";
 import { createHash as createHash22 } from "crypto";
-import { mkdirSync as mkdirSync4, statSync as statSync2, writeFileSync as writeFileSync42 } from "fs";
+import { mkdirSync as mkdirSync4, statSync as statSync3, writeFileSync as writeFileSync42 } from "fs";
 import { dirname as dirname42, join as join62, relative as relative3 } from "path";
 import { readdir, readFile as readFile2 } from "fs/promises";
 import { existsSync as existsSync62, readdirSync as readdirSync5, readFileSync as readFileSync42, statSync as statSync22 } from "fs";
@@ -27942,8 +28075,8 @@ function ensureDir2(filePath) {
   if (filePath === ":memory:")
     return;
   const dir = dirname4(resolve2(filePath));
-  if (!existsSync16(dir)) {
-    mkdirSync13(dir, { recursive: true });
+  if (!existsSync17(dir)) {
+    mkdirSync14(dir, { recursive: true });
   }
 }
 function getDatabase2(path) {
@@ -27981,7 +28114,7 @@ function gitInit(project) {
   execSync3("git init", { cwd: path, stdio: "pipe" });
   const gitignorePath = join22(path, ".gitignore");
   if (!existsSync22(gitignorePath)) {
-    writeFileSync7(gitignorePath, GITIGNORE_TEMPLATE, "utf-8");
+    writeFileSync6(gitignorePath, GITIGNORE_TEMPLATE, "utf-8");
   }
   const projectJson = {
     id,
@@ -27990,7 +28123,7 @@ function gitInit(project) {
     created_at: project.created_at,
     integrations: project.integrations ?? {}
   };
-  writeFileSync7(join22(path, ".project.json"), JSON.stringify(projectJson, null, 2) + `
+  writeFileSync6(join22(path, ".project.json"), JSON.stringify(projectJson, null, 2) + `
 `, "utf-8");
   execSync3("git add .gitignore .project.json", { cwd: path, stdio: "pipe" });
   execSync3(`git commit -m "chore: init project ${name}"`, {
@@ -29302,7 +29435,7 @@ async function collectLocalFiles(rootPath) {
       if (entry.isDirectory()) {
         await walk(fullPath);
       } else if (entry.isFile()) {
-        const stat = statSync2(fullPath);
+        const stat = statSync3(fullPath);
         if (stat.size > MAX_FILE_SIZE)
           continue;
         const relPath = relative3(rootPath, fullPath);
@@ -94346,7 +94479,7 @@ import chalk6 from "chalk";
 // package.json
 var package_default = {
   name: "@hasna/testers",
-  version: "0.0.45",
+  version: "0.0.47",
   description: "AI-powered QA testing CLI \u2014 spawns cheap AI agents to test web apps with headless browsers",
   type: "module",
   main: "dist/index.js",
@@ -94445,7 +94578,7 @@ init_todos_connector();
 init_browser();
 import { render, Box, Text, useInput, useApp } from "ink";
 import React, { useState } from "react";
-import { readFileSync as readFileSync10, readdirSync as readdirSync6, writeFileSync as writeFileSync8 } from "fs";
+import { readFileSync as readFileSync10, readdirSync as readdirSync6, writeFileSync as writeFileSync7 } from "fs";
 import { createInterface } from "readline";
 import { join as join20, resolve as resolve4 } from "path";
 
@@ -96533,18 +96666,18 @@ init_ci();
 init_assertions();
 init_paths();
 init_sessions();
-import { existsSync as existsSync17, mkdirSync as mkdirSync14 } from "fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync15 } from "fs";
 
 // src/lib/repo-discovery.ts
 init_paths();
-import { existsSync as existsSync14, readFileSync as readFileSync6, readdirSync as readdirSync3, statSync, writeFileSync as writeFileSync5, mkdirSync as mkdirSync11, unlinkSync } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync6, readdirSync as readdirSync3, statSync as statSync2, writeFileSync as writeFileSync4, mkdirSync as mkdirSync12, unlinkSync } from "fs";
 import { createHash } from "crypto";
 import { join as join17, resolve, relative as relative2 } from "path";
 function getCacheDir() {
   const testersDir = getTestersDir();
   const cacheDir = join17(testersDir, "repo-index");
-  if (!existsSync14(cacheDir)) {
-    mkdirSync11(cacheDir, { recursive: true });
+  if (!existsSync15(cacheDir)) {
+    mkdirSync12(cacheDir, { recursive: true });
   }
   return cacheDir;
 }
@@ -96557,10 +96690,10 @@ function getCachePath(repoPath) {
 function isCacheStale(cached, repoPath) {
   for (const spec of cached.specs) {
     const fullPath = join17(repoPath, spec.file);
-    if (!existsSync14(fullPath))
+    if (!existsSync15(fullPath))
       return true;
     try {
-      const stat = statSync(fullPath);
+      const stat = statSync2(fullPath);
       if (stat.mtimeMs !== spec.mtimeMs)
         return true;
     } catch {
@@ -96569,10 +96702,10 @@ function isCacheStale(cached, repoPath) {
   }
   if (cached.configPath) {
     const configFullPath = join17(repoPath, cached.configPath);
-    if (!existsSync14(configFullPath))
+    if (!existsSync15(configFullPath))
       return true;
     try {
-      statSync(configFullPath);
+      statSync2(configFullPath);
       const age = Date.now() - new Date(cached.snapshotAt).getTime();
       if (age > 3600000)
         return true;
@@ -96584,7 +96717,7 @@ function isCacheStale(cached, repoPath) {
 }
 function loadCache(repoPath) {
   const cachePath = getCachePath(repoPath);
-  if (!existsSync14(cachePath))
+  if (!existsSync15(cachePath))
     return null;
   try {
     const raw = JSON.parse(readFileSync6(cachePath, "utf-8"));
@@ -96595,14 +96728,14 @@ function loadCache(repoPath) {
 }
 function saveCache(snapshot) {
   const cachePath = getCachePath(snapshot.repoPath);
-  writeFileSync5(cachePath, JSON.stringify(snapshot, null, 2), "utf-8");
+  writeFileSync4(cachePath, JSON.stringify(snapshot, null, 2), "utf-8");
 }
 function detectPackageManager(repoPath) {
   const result = {
-    npm: existsSync14(join17(repoPath, "package-lock.json")),
-    yarn: existsSync14(join17(repoPath, "yarn.lock")),
-    pnpm: existsSync14(join17(repoPath, "pnpm-lock.yaml")),
-    bun: existsSync14(join17(repoPath, "bun.lockb")) || existsSync14(join17(repoPath, "bun.lock")),
+    npm: existsSync15(join17(repoPath, "package-lock.json")),
+    yarn: existsSync15(join17(repoPath, "yarn.lock")),
+    pnpm: existsSync15(join17(repoPath, "pnpm-lock.yaml")),
+    bun: existsSync15(join17(repoPath, "bun.lockb")) || existsSync15(join17(repoPath, "bun.lock")),
     preferred: "npm"
   };
   if (result.bun)
@@ -96617,7 +96750,7 @@ function detectPackageManager(repoPath) {
 }
 function detectDevScripts(repoPath) {
   const pkgPath = join17(repoPath, "package.json");
-  if (!existsSync14(pkgPath)) {
+  if (!existsSync15(pkgPath)) {
     return { dev: null, test: null, seed: null, build: null };
   }
   let scripts;
@@ -96643,7 +96776,7 @@ function findPlaywrightConfig(repoPath) {
     "playwright-ct.config.js"
   ];
   for (const name of candidates) {
-    if (existsSync14(join17(repoPath, name)))
+    if (existsSync15(join17(repoPath, name)))
       return name;
   }
   return null;
@@ -96702,7 +96835,7 @@ function findSpecFiles(repoPath, globPatterns) {
     const dirsToSearch = ["", ".", "tests", "e2e", "test", "__tests__", "specs", "src"];
     for (const dir of dirsToSearch) {
       const searchDir = dir ? join17(repoPath, dir) : repoPath;
-      if (!existsSync14(searchDir))
+      if (!existsSync15(searchDir))
         continue;
       try {
         const files = walkDir(searchDir);
@@ -96714,7 +96847,7 @@ function findSpecFiles(repoPath, globPatterns) {
             seen.add(relativePath);
             const content = readFileSync6(file, "utf-8");
             const contentHash = createHash("sha256").update(content).digest("hex").slice(0, 16);
-            const stat = statSync(file);
+            const stat = statSync2(file);
             specs.push({
               file: relativePath,
               fromGlob: pattern,
@@ -96754,7 +96887,7 @@ function matchesGlob(filePath, pattern) {
 }
 function detectSuggestedUrl(repoPath) {
   const pkgPath = join17(repoPath, "package.json");
-  if (!existsSync14(pkgPath))
+  if (!existsSync15(pkgPath))
     return null;
   try {
     const pkg = JSON.parse(readFileSync6(pkgPath, "utf-8"));
@@ -96774,10 +96907,10 @@ function detectSuggestedUrl(repoPath) {
 }
 function checkPlaywrightBrowserInstalled(repoPath) {
   const cacheDir = join17(repoPath, "node_modules", ".cache", "ms-playwright");
-  if (existsSync14(cacheDir))
+  if (existsSync15(cacheDir))
     return true;
   const globalCache = join17(repoPath, ".cache", "ms-playwright");
-  if (existsSync14(globalCache))
+  if (existsSync15(globalCache))
     return true;
   return false;
 }
@@ -96817,7 +96950,7 @@ function discoverRepo(opts) {
   const specs = findSpecFiles(repoPath, globPatterns);
   const packageManager = detectPackageManager(repoPath);
   const devScripts = detectDevScripts(repoPath);
-  const playwrightInstalled = existsSync14(join17(repoPath, "node_modules", "playwright")) || existsSync14(join17(repoPath, "node_modules", "@playwright", "test"));
+  const playwrightInstalled = existsSync15(join17(repoPath, "node_modules", "playwright")) || existsSync15(join17(repoPath, "node_modules", "@playwright", "test"));
   const browsersInstalled = checkPlaywrightBrowserInstalled(repoPath);
   const configExists = configPath !== null;
   const specsFound = specs.length > 0;
@@ -96876,11 +97009,11 @@ function discoverRepo(opts) {
 }
 function clearDiscoveryCache(repoPath) {
   const cacheDir = getCacheDir();
-  if (!existsSync14(cacheDir))
+  if (!existsSync15(cacheDir))
     return;
   if (repoPath) {
     const cachePath = getCachePath(repoPath);
-    if (existsSync14(cachePath)) {
+    if (existsSync15(cachePath)) {
       unlinkSync(cachePath);
     }
   } else {
@@ -96893,7 +97026,7 @@ function clearDiscoveryCache(repoPath) {
 }
 function getDiscoveryCacheInfo(repoPath) {
   const cachePath = getCachePath(repoPath);
-  if (!existsSync14(cachePath))
+  if (!existsSync15(cachePath))
     return null;
   const cached = loadCache(repoPath);
   if (!cached)
@@ -96910,11 +97043,11 @@ init_runs();
 init_database();
 init_paths();
 import { execSync as execSync2 } from "child_process";
-import { existsSync as existsSync15, mkdirSync as mkdirSync12, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync13, writeFileSync as writeFileSync5 } from "fs";
 import { join as join18 } from "path";
 function resolvePlaywrightCmd(repoPath) {
   const localPw = join18(repoPath, "node_modules", ".bin", "playwright");
-  if (existsSync15(localPw)) {
+  if (existsSync16(localPw)) {
     return [localPw, "test"];
   }
   return ["npx", "playwright", "test"];
@@ -97110,9 +97243,9 @@ async function runRepoTests(opts) {
     const resultRecord = { id: resultId };
     if (result.stdout || result.stderr) {
       const reportersDir = join18(getTestersDir(), "repo-run-output");
-      mkdirSync12(reportersDir, { recursive: true });
+      mkdirSync13(reportersDir, { recursive: true });
       const outputFile = join18(reportersDir, `${resultRecord.id}.log`);
-      writeFileSync6(outputFile, `=== stdout ===
+      writeFileSync5(outputFile, `=== stdout ===
 ${result.stdout}
 
 === stderr ===
@@ -97246,6 +97379,29 @@ function validateStoredAssertion(value) {
   }
   return describeStoredAssertion(value);
 }
+function envCredentialRef(value) {
+  const trimmed = value?.trim();
+  if (!trimmed)
+    return;
+  return trimmed.startsWith("$") ? trimmed : `$${trimmed}`;
+}
+function parseSandboxEnv(values) {
+  if (!values?.length)
+    return;
+  const env = {};
+  for (const value of values) {
+    const trimmed = value.trim();
+    if (!trimmed)
+      continue;
+    const separator = trimmed.indexOf("=");
+    const key = separator >= 0 ? trimmed.slice(0, separator).trim() : trimmed;
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
+      throw new Error(`Invalid sandbox env var name: ${key || value}`);
+    }
+    env[key] = separator >= 0 ? trimmed.slice(separator + 1) : `$${key}`;
+  }
+  return Object.keys(env).length > 0 ? env : undefined;
+}
 function AddForm({ onComplete }) {
   const { exit } = useApp();
   const [state, setState] = useState({
@@ -97519,7 +97675,7 @@ program2.command("prod-debug <target>").description("Create a safe production de
   }, config2.prodDebug);
   const output = opts.json ? JSON.stringify(plan, null, 2) : formatProdDebugPlan(plan);
   if (opts.output) {
-    writeFileSync8(resolve4(opts.output), output + `
+    writeFileSync7(resolve4(opts.output), output + `
 `);
   } else {
     log(output);
@@ -97529,7 +97685,7 @@ var CONFIG_DIR5 = getTestersDir();
 var CONFIG_PATH4 = join20(CONFIG_DIR5, "config.json");
 function getActiveProject() {
   try {
-    if (existsSync17(CONFIG_PATH4)) {
+    if (existsSync18(CONFIG_PATH4)) {
       const raw = JSON.parse(readFileSync10(CONFIG_PATH4, "utf-8"));
       return raw.activeProject ?? undefined;
     }
@@ -97550,12 +97706,12 @@ program2.command("add [name]").alias("create").description("Create a new test sc
 }, []).option("-t, --tag <tag>", "Tag (repeatable)", (val, acc) => {
   acc.push(val);
   return acc;
-}, []).option("-p, --priority <level>", "Priority level", "medium").option("-m, --model <model>", "AI model to use").option("--path <path>", "Target path on the URL").option("--auth", "Requires authentication", false).option("--timeout <ms>", "Timeout in milliseconds").option("--project <id>", "Project ID").option("--template <name>", "Seed scenarios from a template (auth, crud, forms, nav, a11y)").option("--assert <assertion>", "Structured assertion (repeatable). Formats: selector:<sel> visible, text:<sel> contains:<text>, no-console-errors, url:contains:<path>, title:contains:<text>, count:<sel> eq:<n>", (val, acc) => {
+}, []).option("-p, --priority <level>", "Priority level", "medium").option("-m, --model <model>", "AI model to use").option("--path <path>", "Target path on the URL").option("--auth", "Requires authentication", false).option("--auth-preset <name>", "Attach email/password/loginPath from a named auth preset").option("--timeout <ms>", "Timeout in milliseconds").option("--project <id>", "Project ID").option("--template <name>", "Seed scenarios from a template (auth, crud, forms, nav, a11y)").option("--assert <assertion>", "Structured assertion (repeatable). Formats: selector:<sel> visible, text:<sel> contains:<text>, no-console-errors, url:contains:<path>, title:contains:<text>, count:<sel> eq:<n>", (val, acc) => {
   acc.push(val);
   return acc;
 }, []).action(async (name21, opts) => {
   try {
-    const hasFlags = opts.description || opts.steps?.length || opts.tag?.length || opts.model || opts.path || opts.auth || opts.timeout || opts.template || opts.assert?.length;
+    const hasFlags = opts.description || opts.steps?.length || opts.tag?.length || opts.model || opts.path || opts.auth || opts.authPreset || opts.timeout || opts.template || opts.assert?.length;
     if (!name21 && !hasFlags) {
       const projectId2 = resolveProject2(opts.project);
       await runInteractiveAdd(projectId2);
@@ -97580,6 +97736,11 @@ program2.command("add [name]").alias("create").description("Create a new test sc
     }
     const assertions = opts.assert.map(parseAssertionString);
     const projectId = resolveProject2(opts.project);
+    const authPreset = opts.authPreset ? getAuthPreset(opts.authPreset) : null;
+    if (opts.authPreset && !authPreset) {
+      logError(chalk6.red(`Auth preset not found: ${opts.authPreset}`));
+      process.exit(1);
+    }
     const scenario = createScenario({
       name: name21,
       description: opts.description || name21,
@@ -97588,7 +97749,12 @@ program2.command("add [name]").alias("create").description("Create a new test sc
       priority: opts.priority,
       model: opts.model,
       targetPath: opts.path,
-      requiresAuth: opts.auth,
+      requiresAuth: opts.auth || Boolean(authPreset),
+      authConfig: authPreset ? {
+        email: authPreset.email,
+        password: authPreset.password,
+        loginPath: authPreset.loginPath
+      } : undefined,
       timeoutMs: opts.timeout ? parseInt(opts.timeout, 10) : undefined,
       assertions: assertions.length > 0 ? assertions : undefined,
       projectId
@@ -98083,7 +98249,7 @@ program2.command("run [url] [description]").alias("test").description("Run test
       if (opts.json || opts.output) {
         const jsonOutput = formatJSON(run3, results2);
         if (opts.output) {
-          writeFileSync8(opts.output, jsonOutput, "utf-8");
+          writeFileSync7(opts.output, jsonOutput, "utf-8");
           log(chalk6.green(`Results written to ${opts.output}`));
         }
         if (opts.json) {
@@ -98192,7 +98358,7 @@ program2.command("run [url] [description]").alias("test").description("Run test
     if (opts.json || opts.output) {
       const jsonOutput = formatJSON(run2, results);
       if (opts.output) {
-        writeFileSync8(opts.output, jsonOutput, "utf-8");
+        writeFileSync7(opts.output, jsonOutput, "utf-8");
         log(chalk6.green(`Results written to ${opts.output}`));
       }
       if (opts.json) {
@@ -98445,13 +98611,13 @@ program2.command("export [format]").description("Export scenarios as JSON (defau
     if (fmt === "json") {
       const outputPath = opts.output ?? "testers-export.json";
       const data = JSON.stringify(scenarios, null, 2);
-      writeFileSync8(outputPath, data, "utf-8");
+      writeFileSync7(outputPath, data, "utf-8");
       log(chalk6.green(`Exported ${scenarios.length} scenario(s) to ${resolve4(outputPath)}`));
       return;
     }
     const outputDir = opts.output ?? ".";
-    if (!existsSync17(outputDir)) {
-      mkdirSync14(outputDir, { recursive: true });
+    if (!existsSync18(outputDir)) {
+      mkdirSync15(outputDir, { recursive: true });
     }
     for (const s2 of scenarios) {
       const lines = [];
@@ -98479,7 +98645,7 @@ program2.command("export [format]").description("Export scenarios as JSON (defau
       }
       const safeFilename = s2.name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 80);
       const filePath = join20(outputDir, `${s2.shortId}-${safeFilename}.md`);
-      writeFileSync8(filePath, lines.join(`
+      writeFileSync7(filePath, lines.join(`
 `), "utf-8");
       log(chalk6.dim(`  ${s2.shortId}: ${s2.name} \u2192 ${filePath}`));
     }
@@ -98653,17 +98819,17 @@ projectCmd.command("export-open <id>").description("Register a testers project i
 projectCmd.command("use <name>").description("Set active project (find or create)").option("--json", "Output as JSON", false).action((name21, opts) => {
   try {
     const project = ensureProject(name21, process.cwd());
-    if (!existsSync17(CONFIG_DIR5)) {
-      mkdirSync14(CONFIG_DIR5, { recursive: true });
+    if (!existsSync18(CONFIG_DIR5)) {
+      mkdirSync15(CONFIG_DIR5, { recursive: true });
     }
     let config2 = {};
-    if (existsSync17(CONFIG_PATH4)) {
+    if (existsSync18(CONFIG_PATH4)) {
       try {
         config2 = JSON.parse(readFileSync10(CONFIG_PATH4, "utf-8"));
       } catch {}
     }
     config2.activeProject = project.id;
-    writeFileSync8(CONFIG_PATH4, JSON.stringify(config2, null, 2), "utf-8");
+    writeFileSync7(CONFIG_PATH4, JSON.stringify(config2, null, 2), "utf-8");
     if (opts.json) {
       log(JSON.stringify({ activeProject: project.id, project }, null, 2));
       return;
@@ -99272,10 +99438,10 @@ program2.command("ci [provider]").description("Print or write a CI workflow (def
   if (opts.output) {
     const outPath = resolve4(opts.output);
     const outDir = outPath.replace(/\/[^/]*$/, "");
-    if (outDir && !existsSync17(outDir)) {
-      mkdirSync14(outDir, { recursive: true });
+    if (outDir && !existsSync18(outDir)) {
+      mkdirSync15(outDir, { recursive: true });
     }
-    writeFileSync8(outPath, workflow, "utf-8");
+    writeFileSync7(outPath, workflow, "utf-8");
     log(chalk6.green(`Workflow written to ${outPath}`));
     return;
   }
@@ -99307,11 +99473,11 @@ program2.command("init").description("Initialize a new testing project").option(
     }
     if (opts.ci === "github") {
       const workflowDir = join20(process.cwd(), ".github", "workflows");
-      if (!existsSync17(workflowDir)) {
-        mkdirSync14(workflowDir, { recursive: true });
+      if (!existsSync18(workflowDir)) {
+        mkdirSync15(workflowDir, { recursive: true });
       }
       const workflowPath = join20(workflowDir, "testers.yml");
-      writeFileSync8(workflowPath, generateGitHubActionsWorkflow(), "utf-8");
+      writeFileSync7(workflowPath, generateGitHubActionsWorkflow(), "utf-8");
       log(`  CI:         ${chalk6.green("GitHub Actions workflow written to .github/workflows/testers.yml")}`);
     } else if (opts.ci) {
       log(chalk6.yellow(`  Unknown CI provider: ${opts.ci}. Supported: github`));
@@ -99504,7 +99670,7 @@ program2.command("quick-qa <url>").alias("quick-check").description("Run a fast
       wcagLevel
     });
     if (opts.output) {
-      writeFileSync8(resolve4(opts.output), JSON.stringify(result, null, 2));
+      writeFileSync7(resolve4(opts.output), JSON.stringify(result, null, 2));
     }
     if (opts.json) {
       log(JSON.stringify(result, null, 2));
@@ -99555,7 +99721,7 @@ program2.command("report [run-id]").description("Generate HTML test report or co
         format
       });
       if (opts.output && opts.output !== "report.html") {
-        writeFileSync8(opts.output, content, "utf-8");
+        writeFileSync7(opts.output, content, "utf-8");
         const absPath2 = resolve4(opts.output);
         log(chalk6.green(`Compliance report written to ${absPath2}`));
       } else {
@@ -99569,7 +99735,7 @@ program2.command("report [run-id]").description("Generate HTML test report or co
     } else {
       html = generateHtmlReport(runId);
     }
-    writeFileSync8(opts.output, html, "utf-8");
+    writeFileSync7(opts.output, html, "utf-8");
     const absPath = resolve4(opts.output);
     log(chalk6.green(`Report generated: ${absPath}`));
     if (opts.open) {
@@ -99582,12 +99748,22 @@ program2.command("report [run-id]").description("Generate HTML test report or co
   }
 });
 var authCmd = program2.command("auth").description("Manage auth presets");
-authCmd.command("add <name>").description("Create an auth preset").requiredOption("--email <email>", "Login email").requiredOption("--password <password>", "Login password").option("--login-path <path>", "Login page path", "/login").action((name21, opts) => {
+authCmd.command("add <name>").description("Create an auth preset").option("--email <email>", "Login email or credential reference").option("--password <password>", "Login password or credential reference").option("--email-env <name>", "Environment variable name for the login email").option("--password-env <name>", "Environment variable name for the login password").option("--login-path <path>", "Login page path", "/login").action((name21, opts) => {
   try {
+    const email3 = opts.email ?? envCredentialRef(opts.emailEnv);
+    const password = opts.password ?? envCredentialRef(opts.passwordEnv);
+    if (!email3) {
+      logError(chalk6.red("Error: provide --email or --email-env"));
+      process.exit(1);
+    }
+    if (!password) {
+      logError(chalk6.red("Error: provide --password or --password-env"));
+      process.exit(1);
+    }
     const preset = createAuthPreset({
       name: name21,
-      email: opts.email,
-      password: opts.password,
+      email: email3,
+      password,
       loginPath: opts.loginPath
     });
     log(chalk6.green(`Created auth preset ${chalk6.bold(preset.name)} (${preset.email})`));
@@ -100849,7 +101025,10 @@ workflowCmd.command("create <name>").description("Save a reusable testing workfl
 }, []).option("--priority <level>", "Scenario priority").option("--persona <ids>", "Comma-separated persona IDs").option("--goal <prompt>", "Goal prompt for the agentic testing loop").option("--success <criteria>", "Success criteria (repeatable)", (val, acc) => {
   acc.push(val);
   return acc;
-}, []).option("--max-iterations <n>", "Goal-loop iteration cap", "10").option("--target <target>", "Execution target: local or sandbox", "local").option("--sandbox-provider <provider>", "Sandbox provider: e2b, daytona, or modal").option("--sandbox-image <image>", "Sandbox image/template").option("--sandbox-remote-dir <path>", "Remote working directory for sandbox runs").option("--sandbox-cleanup <mode>", "Sandbox cleanup mode: delete, stop, or keep", "delete").option("--sandbox-sync <strategy>", "Sandbox upload sync strategy: rsync or archive", "rsync").option("--sandbox-setup-command <command>", "Shell command to run before testers in the sandbox").option("--sandbox-package <spec>", "Package spec to execute in the sandbox", "@hasna/testers").option("--e2b-template <name>", "Legacy alias for --sandbox-image").option("--timeout <ms>", "Workflow timeout").option("--json", "Output as JSON", false).action((name21, opts) => {
+}, []).option("--max-iterations <n>", "Goal-loop iteration cap", "10").option("--target <target>", "Execution target: local or sandbox", "local").option("--sandbox-provider <provider>", "Sandbox provider: e2b, daytona, or modal").option("--sandbox-image <image>", "Sandbox image/template").option("--sandbox-remote-dir <path>", "Remote working directory for sandbox runs").option("--sandbox-cleanup <mode>", "Sandbox cleanup mode: delete, stop, or keep", "delete").option("--sandbox-sync <strategy>", "Sandbox upload sync strategy: rsync or archive", "rsync").option("--sandbox-setup-command <command>", "Shell command to run before testers in the sandbox").option("--sandbox-package <spec>", "Package spec to execute in the sandbox", "@hasna/testers").option("--sandbox-env <assignment>", "Sandbox env var; KEY forwards host KEY, KEY=value stores value (repeatable)", (val, acc) => {
+  acc.push(val);
+  return acc;
+}, []).option("--sandbox-app-source <path>", "Local app source directory to upload into the sandbox").option("--sandbox-app-remote-dir <path>", "Remote app directory inside the sandbox (default: <sandbox-remote-dir>/app)").option("--sandbox-app-start-command <command>", "Shell command to start the app before testers runs").option("--sandbox-app-url <url>", "URL testers should target inside the sandbox after the app starts").option("--sandbox-app-wait-url <url>", "URL to poll before starting testers (defaults to --sandbox-app-url)").option("--sandbox-app-wait-timeout <ms>", "App readiness wait timeout in milliseconds").option("--e2b-template <name>", "Legacy alias for --sandbox-image").option("--timeout <ms>", "Workflow timeout").option("--json", "Output as JSON", false).action((name21, opts) => {
   try {
     const workflow = createTestingWorkflow({
       name: name21,
@@ -100875,6 +101054,13 @@ workflowCmd.command("create <name>").description("Save a reusable testing workfl
         sandboxSyncStrategy: opts.sandboxSync,
         setupCommand: opts.sandboxSetupCommand,
         packageSpec: opts.sandboxPackage,
+        env: parseSandboxEnv(opts.sandboxEnv),
+        appSourceDir: opts.sandboxAppSource,
+        appRemoteDir: opts.sandboxAppRemoteDir,
+        appStartCommand: opts.sandboxAppStartCommand,
+        appUrl: opts.sandboxAppUrl,
+        appWaitUrl: opts.sandboxAppWaitUrl,
+        appWaitTimeoutMs: opts.sandboxAppWaitTimeout ? parseInt(opts.sandboxAppWaitTimeout, 10) : undefined,
         timeoutMs: opts.timeout ? parseInt(opts.timeout, 10) : undefined
       }
     });