@hasna/testers 0.0.45 → 0.0.47

package/dist/mcp/index.js

@@ -52,7 +52,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/testers",
-    version: "0.0.45",
+    version: "0.0.47",
     description: "AI-powered QA testing CLI \u2014 spawns cheap AI agents to test web apps with headless browsers",
     type: "module",
     main: "dist/index.js",
@@ -14178,6 +14178,12 @@ function workflowExecutionFromValue(value) {
   const sandboxSyncStrategy = syncStrategyValue(input["sandboxSyncStrategy"]);
   const setupCommand = stringValue(input["setupCommand"]);
   const packageSpec = stringValue(input["packageSpec"]);
+  const appSourceDir = stringValue(input["appSourceDir"]);
+  const appRemoteDir = stringValue(input["appRemoteDir"]);
+  const appStartCommand = stringValue(input["appStartCommand"]);
+  const appUrl = stringValue(input["appUrl"]);
+  const appWaitUrl = stringValue(input["appWaitUrl"]);
+  const appWaitTimeoutMs = numberValue(input["appWaitTimeoutMs"]);
   const timeoutMs = numberValue(input["timeoutMs"]);
   const env = stringMap(input["env"]);
   return {
@@ -14189,6 +14195,12 @@ function workflowExecutionFromValue(value) {
     ...sandboxSyncStrategy ? { sandboxSyncStrategy } : {},
     ...setupCommand ? { setupCommand } : {},
     ...packageSpec ? { packageSpec } : {},
+    ...appSourceDir ? { appSourceDir } : {},
+    ...appRemoteDir ? { appRemoteDir } : {},
+    ...appStartCommand ? { appStartCommand } : {},
+    ...appUrl ? { appUrl } : {},
+    ...appWaitUrl ? { appWaitUrl } : {},
+    ...appWaitTimeoutMs !== undefined ? { appWaitTimeoutMs } : {},
     ...timeoutMs !== undefined ? { timeoutMs } : {},
     ...env ? { env } : {}
   };
@@ -23488,9 +23500,10 @@ var init_workflows = __esm(() => {
 });
 
 // src/lib/workflow-runner.ts
-import { mkdtempSync, rmSync, writeFileSync as writeFileSync3 } from "fs";
+import { spawnSync } from "child_process";
+import { existsSync as existsSync11, mkdirSync as mkdirSync9, mkdtempSync, rmSync, statSync } from "fs";
 import { tmpdir } from "os";
-import { join as join14 } from "path";
+import { join as join14, posix as pathPosix } from "path";
 function buildWorkflowRunPlan(workflow, options) {
   const runOptions = {
     url: options.url,
@@ -23532,10 +23545,16 @@ function createWorkflowDatabaseBundle(workflow, plan) {
   if (!plan.sandbox)
     throw new Error(`Workflow is not configured for sandbox execution: ${workflow.name}`);
   const localDir = mkdtempSync(join14(tmpdir(), `testers-workflow-${workflow.id.slice(0, 8)}-`));
-  writeFileSync3(join14(localDir, "testers.db"), getDatabase().serialize());
+  const stateDir = join14(localDir, ".testers-state");
+  mkdirSync9(stateDir, { recursive: true });
+  writeDatabaseSnapshot(join14(stateDir, "testers.db"));
+  if (plan.sandbox.appSourceDir && plan.sandbox.appRemoteDir) {
+    const relativeAppDir = relativeRemotePath(plan.sandbox.remoteDir, plan.sandbox.appRemoteDir);
+    copyAppSource(plan.sandbox.appSourceDir, join14(localDir, relativeAppDir));
+  }
   return {
     localDir,
-    remoteDir: plan.sandbox.stateRemoteDir,
+    remoteDir: plan.sandbox.remoteDir,
     cleanup: () => rmSync(localDir, { recursive: true, force: true })
   };
 }
@@ -23546,15 +23565,63 @@ function validatePersonaIds(workflow) {
     }
   }
 }
+function relativeRemotePath(remoteDir, remoteChildDir) {
+  if (!remoteChildDir.startsWith("/")) {
+    const relative3 = remoteChildDir.replace(/^\/+/, "").replace(/\/+$/, "");
+    if (!relative3 || relative3 === ".") {
+      throw new Error("Sandbox app remote directory must be a child directory, not the workflow root");
+    }
+    return relative3;
+  }
+  const base = remoteDir.replace(/\/+$/, "") || "/";
+  const child = remoteChildDir.replace(/\/+$/, "") || "/";
+  const relative2 = pathPosix.relative(base, child);
+  if (!relative2 || relative2 === "." || relative2.startsWith("..") || pathPosix.isAbsolute(relative2)) {
+    throw new Error(`Sandbox app remote directory must be inside the workflow remote directory (${remoteDir}): ${remoteChildDir}`);
+  }
+  return relative2;
+}
+function copyAppSource(sourceDir, targetDir) {
+  if (!existsSync11(sourceDir) || !statSync(sourceDir).isDirectory()) {
+    throw new Error(`Sandbox app source directory does not exist or is not a directory: ${sourceDir}`);
+  }
+  mkdirSync9(targetDir, { recursive: true });
+  const result = spawnSync("rsync", [
+    "-a",
+    "--delete",
+    ...APP_SOURCE_EXCLUDES.flatMap((item) => ["--exclude", item]),
+    `${sourceDir.replace(/\/+$/, "")}/`,
+    `${targetDir.replace(/\/+$/, "")}/`
+  ], { encoding: "utf8" });
+  if (result.error) {
+    throw new Error(`Failed to rsync sandbox app source: ${result.error.message}`);
+  }
+  if (result.status !== 0) {
+    throw new Error(`Failed to rsync sandbox app source (${result.status}): ${result.stderr.trim()}`);
+  }
+}
+function writeDatabaseSnapshot(targetPath) {
+  getDatabase().exec(`VACUUM INTO ${sqlString(targetPath)}`);
+}
+function sqlString(value) {
+  return `'${value.replaceAll("'", "''")}'`;
+}
 function buildSandboxPlan(workflow, execution, runOptions) {
   const remoteDir = execution.sandboxRemoteDir ?? `/tmp/testers-workflow-${workflow.id.slice(0, 8)}`;
   const stateRemoteDir = `${remoteDir.replace(/\/+$/, "")}/.testers-state`;
+  const appRemoteDir = execution.appSourceDir ? execution.appRemoteDir ?? `${remoteDir.replace(/\/+$/, "")}/app` : execution.appRemoteDir;
   return {
     provider: execution.provider,
     image: execution.sandboxImage,
     name: `testers-${workflow.id.slice(0, 8)}`,
     remoteDir,
     stateRemoteDir,
+    ...execution.appSourceDir ? { appSourceDir: execution.appSourceDir } : {},
+    ...appRemoteDir ? { appRemoteDir } : {},
+    ...execution.appStartCommand ? { appStartCommand: execution.appStartCommand } : {},
+    ...execution.appUrl ? { appUrl: execution.appUrl } : {},
+    ...execution.appWaitUrl ? { appWaitUrl: execution.appWaitUrl } : {},
+    ...execution.appWaitTimeoutMs !== undefined ? { appWaitTimeoutMs: execution.appWaitTimeoutMs } : {},
     cleanup: execution.sandboxCleanup ?? "delete",
     syncStrategy: execution.sandboxSyncStrategy ?? "rsync",
     timeoutMs: execution.timeoutMs,
@@ -23562,6 +23629,12 @@ function buildSandboxPlan(workflow, execution, runOptions) {
     command: buildSandboxCommand({
       runOptions,
       remoteDir,
+      stateRemoteDir,
+      appRemoteDir,
+      appStartCommand: execution.appStartCommand,
+      appUrl: execution.appUrl,
+      appWaitUrl: execution.appWaitUrl,
+      appWaitTimeoutMs: execution.appWaitTimeoutMs,
       dbPath: `${stateRemoteDir}/testers.db`,
       setupCommand: execution.setupCommand,
       packageSpec: execution.packageSpec ?? "@hasna/testers"
@@ -23569,11 +23642,12 @@ function buildSandboxPlan(workflow, execution, runOptions) {
   };
 }
 function buildSandboxCommand(input) {
+  const targetUrl = input.appUrl ?? input.runOptions.url;
   const args = [
     "bunx",
     input.packageSpec,
     "run",
-    input.runOptions.url,
+    targetUrl,
     ...input.runOptions.scenarioIds?.length ? ["--scenario", input.runOptions.scenarioIds.join(",")] : [],
     ...input.runOptions.tags?.length ? input.runOptions.tags.flatMap((tag) => ["--tag", tag]) : [],
     ...input.runOptions.priority ? ["--priority", input.runOptions.priority] : [],
@@ -23589,12 +23663,46 @@ function buildSandboxCommand(input) {
   return [
     "set -euo pipefail",
     `mkdir -p ${shellQuote(input.remoteDir)}`,
-    `cd ${shellQuote(input.remoteDir)}`,
+    `mkdir -p ${shellQuote(input.stateRemoteDir)}`,
+    input.appRemoteDir ? `mkdir -p ${shellQuote(input.appRemoteDir)}` : undefined,
+    `cd ${shellQuote(input.appRemoteDir ?? input.remoteDir)}`,
     input.setupCommand,
+    buildAppStartCommand(input),
     `HASNA_TESTERS_DB_PATH=${shellQuote(input.dbPath)} ${args.map(shellQuote).join(" ")}`
   ].filter(Boolean).join(`
 `);
 }
+function buildAppStartCommand(input) {
+  if (!input.appStartCommand)
+    return;
+  const waitUrl = input.appWaitUrl ?? input.appUrl ?? input.runOptions.url;
+  const waitTimeoutMs = input.appWaitTimeoutMs ?? 120000;
+  return [
+    `( ${input.appStartCommand} ) > ${shellQuote(`${input.stateRemoteDir}/app.log`)} 2>&1 &`,
+    "APP_PID=$!",
+    `echo "$APP_PID" > ${shellQuote(`${input.stateRemoteDir}/app.pid`)}`,
+    `trap 'kill "$APP_PID" 2>/dev/null || true' EXIT`,
+    waitUrl ? buildWaitForUrlCommand(waitUrl, waitTimeoutMs) : undefined
+  ].filter(Boolean).join(`
+`);
+}
+function buildWaitForUrlCommand(url, timeoutMs) {
+  const script = `
+const url = ${JSON.stringify(url)};
+const timeoutMs = ${JSON.stringify(timeoutMs)};
+const deadline = Date.now() + timeoutMs;
+while (Date.now() <= deadline) {
+  try {
+    const response = await fetch(url);
+    if (response.status >= 200 && response.status < 500) process.exit(0);
+  } catch {}
+  await new Promise((resolve) => setTimeout(resolve, 1000));
+}
+console.error(\`Timed out waiting for \${url} after \${timeoutMs}ms\`);
+process.exit(1);
+`.trim();
+  return `bun -e ${shellQuote(script)}`;
+}
 async function runViaSandbox(plan, dependencies) {
   if (!plan.sandbox)
     throw new Error("Workflow does not have a sandbox plan");
@@ -23615,7 +23723,7 @@ async function runViaSandbox(plan, dependencies) {
         workflowId: plan.workflow.id,
         workflowName: plan.workflow.name
       },
-      sandboxEnvVars: plan.sandbox.env,
+      sandboxEnvVars: resolveSandboxEnv(plan.sandbox.env),
       cleanup: plan.sandbox.cleanup,
       upload: {
         localDir: bundle.localDir,
@@ -23641,6 +23749,19 @@ async function runViaSandbox(plan, dependencies) {
     bundle.cleanup?.();
   }
 }
+function resolveSandboxEnv(env2) {
+  if (!env2 || Object.keys(env2).length === 0)
+    return;
+  const resolved = {};
+  for (const [key, value] of Object.entries(env2)) {
+    const resolvedValue = resolveCredential(value);
+    if (resolvedValue === null) {
+      throw new Error(`Missing sandbox env value for ${key}`);
+    }
+    resolved[key] = resolvedValue;
+  }
+  return resolved;
+}
 async function resolveSandboxesRuntime(dependencies) {
   if (dependencies.sandboxes)
     return dependencies.sandboxes;
@@ -23652,11 +23773,23 @@ async function resolveSandboxesRuntime(dependencies) {
 function shellQuote(value) {
   return `'${value.replaceAll("'", `'"'"'`)}'`;
 }
+var APP_SOURCE_EXCLUDES;
 var init_workflow_runner = __esm(() => {
   init_database();
   init_workflows();
   init_personas();
   init_runner();
+  init_secrets_resolver();
+  APP_SOURCE_EXCLUDES = [
+    "node_modules",
+    ".git",
+    "dist",
+    ".next",
+    ".turbo",
+    ".cache",
+    ".venv",
+    "__pycache__"
+  ];
 });
 
 // node_modules/@ai-sdk/provider/dist/index.mjs
@@ -53711,10 +53844,10 @@ import { exec } from "child_process";
 import { promisify } from "util";
 import { readFileSync as readFileSync3 } from "fs";
 import { webcrypto as crypto2 } from "crypto";
-import { existsSync as existsSync42, writeFileSync as writeFileSync32, readFileSync as readFileSync22, mkdirSync as mkdirSync32 } from "fs";
+import { existsSync as existsSync42, writeFileSync as writeFileSync3, readFileSync as readFileSync22, mkdirSync as mkdirSync32 } from "fs";
 import { join as join42 } from "path";
 import { Database as Database4 } from "bun:sqlite";
-import { existsSync as existsSync11, mkdirSync as mkdirSync9 } from "fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync10 } from "fs";
 import { dirname as dirname4, join as join15, resolve as resolve2 } from "path";
 import { existsSync as existsSync22, writeFileSync as writeFileSync4 } from "fs";
 import { join as join22 } from "path";
@@ -53728,10 +53861,10 @@ import * as zlib from "zlib";
 import { Readable } from "stream";
 import { Writable } from "stream";
 import { createHash as createHash2 } from "crypto";
-import { mkdirSync as mkdirSync4, statSync, writeFileSync as writeFileSync42 } from "fs";
+import { mkdirSync as mkdirSync4, statSync as statSync2, writeFileSync as writeFileSync42 } from "fs";
 import { dirname as dirname42, join as join62, relative as relative2 } from "path";
 import { readdir, readFile as readFile2 } from "fs/promises";
-import { existsSync as existsSync62, readdirSync as readdirSync3, readFileSync as readFileSync42, statSync as statSync2 } from "fs";
+import { existsSync as existsSync62, readdirSync as readdirSync3, readFileSync as readFileSync42, statSync as statSync22 } from "fs";
 import { basename, join as join72, resolve as resolve22 } from "path";
 import { execFileSync as execFileSync2 } from "child_process";
 import { existsSync as existsSync72, readFileSync as readFileSync5, writeFileSync as writeFileSync5, mkdirSync as mkdirSync52 } from "fs";
@@ -53896,8 +54029,8 @@ function ensureDir2(filePath) {
   if (filePath === ":memory:")
     return;
   const dir = dirname4(resolve2(filePath));
-  if (!existsSync11(dir)) {
-    mkdirSync9(dir, { recursive: true });
+  if (!existsSync12(dir)) {
+    mkdirSync10(dir, { recursive: true });
   }
 }
 function getDatabase2(path) {
@@ -54178,7 +54311,7 @@ function setIntegrations(id, integrations, db2) {
     const jsonPath = join42(project.path, ".project.json");
     if (existsSync42(jsonPath)) {
       const existing = JSON.parse(readFileSync22(jsonPath, "utf-8"));
-      writeFileSync32(jsonPath, JSON.stringify({ ...existing, integrations: merged }, null, 2) + `
+      writeFileSync3(jsonPath, JSON.stringify({ ...existing, integrations: merged }, null, 2) + `
 `, "utf-8");
     }
   } catch {}
@@ -55256,7 +55389,7 @@ async function collectLocalFiles(rootPath) {
       if (entry.isDirectory()) {
         await walk(fullPath);
       } else if (entry.isFile()) {
-        const stat = statSync(fullPath);
+        const stat = statSync2(fullPath);
         if (stat.size > MAX_FILE_SIZE)
           continue;
         const relPath = relative2(rootPath, fullPath);
@@ -55421,7 +55554,7 @@ async function importProject(projectPath, options = {}) {
   if (!existsSync62(absPath)) {
     return { error: `Path does not exist: ${absPath}` };
   }
-  const stat = statSync2(absPath);
+  const stat = statSync22(absPath);
   if (!stat.isDirectory()) {
     return { error: `Not a directory: ${absPath}` };
   }

package/dist/server/index.js

@@ -4078,6 +4078,12 @@ function workflowExecutionFromValue(value) {
   const sandboxSyncStrategy = syncStrategyValue(input["sandboxSyncStrategy"]);
   const setupCommand = stringValue(input["setupCommand"]);
   const packageSpec = stringValue(input["packageSpec"]);
+  const appSourceDir = stringValue(input["appSourceDir"]);
+  const appRemoteDir = stringValue(input["appRemoteDir"]);
+  const appStartCommand = stringValue(input["appStartCommand"]);
+  const appUrl = stringValue(input["appUrl"]);
+  const appWaitUrl = stringValue(input["appWaitUrl"]);
+  const appWaitTimeoutMs = numberValue(input["appWaitTimeoutMs"]);
   const timeoutMs = numberValue(input["timeoutMs"]);
   const env = stringMap(input["env"]);
   return {
@@ -4089,6 +4095,12 @@ function workflowExecutionFromValue(value) {
     ...sandboxSyncStrategy ? { sandboxSyncStrategy } : {},
     ...setupCommand ? { setupCommand } : {},
     ...packageSpec ? { packageSpec } : {},
+    ...appSourceDir ? { appSourceDir } : {},
+    ...appRemoteDir ? { appRemoteDir } : {},
+    ...appStartCommand ? { appStartCommand } : {},
+    ...appUrl ? { appUrl } : {},
+    ...appWaitUrl ? { appWaitUrl } : {},
+    ...appWaitTimeoutMs !== undefined ? { appWaitTimeoutMs } : {},
     ...timeoutMs !== undefined ? { timeoutMs } : {},
     ...env ? { env } : {}
   };
@@ -46920,12 +46932,12 @@ var init_scan_issues = __esm(() => {
 });
 
 // src/server/index.ts
-import { existsSync as existsSync10 } from "fs";
+import { existsSync as existsSync11 } from "fs";
 import { join as join14 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/testers",
-  version: "0.0.45",
+  version: "0.0.47",
   description: "AI-powered QA testing CLI \u2014 spawns cheap AI agents to test web apps with headless browsers",
   type: "module",
   main: "dist/index.js",
@@ -51316,9 +51328,20 @@ function db2() {
 
 // src/lib/workflow-runner.ts
 init_database();
-import { mkdtempSync, rmSync, writeFileSync as writeFileSync3 } from "fs";
+import { spawnSync } from "child_process";
+import { existsSync as existsSync10, mkdirSync as mkdirSync7, mkdtempSync, rmSync, statSync } from "fs";
 import { tmpdir } from "os";
-import { join as join13 } from "path";
+import { join as join13, posix as pathPosix } from "path";
+var APP_SOURCE_EXCLUDES = [
+  "node_modules",
+  ".git",
+  "dist",
+  ".next",
+  ".turbo",
+  ".cache",
+  ".venv",
+  "__pycache__"
+];
 function buildWorkflowRunPlan(workflow, options) {
   const runOptions = {
     url: options.url,
@@ -51360,10 +51383,16 @@ function createWorkflowDatabaseBundle(workflow, plan) {
   if (!plan.sandbox)
     throw new Error(`Workflow is not configured for sandbox execution: ${workflow.name}`);
   const localDir = mkdtempSync(join13(tmpdir(), `testers-workflow-${workflow.id.slice(0, 8)}-`));
-  writeFileSync3(join13(localDir, "testers.db"), getDatabase().serialize());
+  const stateDir = join13(localDir, ".testers-state");
+  mkdirSync7(stateDir, { recursive: true });
+  writeDatabaseSnapshot(join13(stateDir, "testers.db"));
+  if (plan.sandbox.appSourceDir && plan.sandbox.appRemoteDir) {
+    const relativeAppDir = relativeRemotePath(plan.sandbox.remoteDir, plan.sandbox.appRemoteDir);
+    copyAppSource(plan.sandbox.appSourceDir, join13(localDir, relativeAppDir));
+  }
   return {
     localDir,
-    remoteDir: plan.sandbox.stateRemoteDir,
+    remoteDir: plan.sandbox.remoteDir,
     cleanup: () => rmSync(localDir, { recursive: true, force: true })
   };
 }
@@ -51374,15 +51403,63 @@ function validatePersonaIds(workflow) {
     }
   }
 }
+function relativeRemotePath(remoteDir, remoteChildDir) {
+  if (!remoteChildDir.startsWith("/")) {
+    const relative3 = remoteChildDir.replace(/^\/+/, "").replace(/\/+$/, "");
+    if (!relative3 || relative3 === ".") {
+      throw new Error("Sandbox app remote directory must be a child directory, not the workflow root");
+    }
+    return relative3;
+  }
+  const base = remoteDir.replace(/\/+$/, "") || "/";
+  const child = remoteChildDir.replace(/\/+$/, "") || "/";
+  const relative2 = pathPosix.relative(base, child);
+  if (!relative2 || relative2 === "." || relative2.startsWith("..") || pathPosix.isAbsolute(relative2)) {
+    throw new Error(`Sandbox app remote directory must be inside the workflow remote directory (${remoteDir}): ${remoteChildDir}`);
+  }
+  return relative2;
+}
+function copyAppSource(sourceDir, targetDir) {
+  if (!existsSync10(sourceDir) || !statSync(sourceDir).isDirectory()) {
+    throw new Error(`Sandbox app source directory does not exist or is not a directory: ${sourceDir}`);
+  }
+  mkdirSync7(targetDir, { recursive: true });
+  const result = spawnSync("rsync", [
+    "-a",
+    "--delete",
+    ...APP_SOURCE_EXCLUDES.flatMap((item) => ["--exclude", item]),
+    `${sourceDir.replace(/\/+$/, "")}/`,
+    `${targetDir.replace(/\/+$/, "")}/`
+  ], { encoding: "utf8" });
+  if (result.error) {
+    throw new Error(`Failed to rsync sandbox app source: ${result.error.message}`);
+  }
+  if (result.status !== 0) {
+    throw new Error(`Failed to rsync sandbox app source (${result.status}): ${result.stderr.trim()}`);
+  }
+}
+function writeDatabaseSnapshot(targetPath) {
+  getDatabase().exec(`VACUUM INTO ${sqlString(targetPath)}`);
+}
+function sqlString(value) {
+  return `'${value.replaceAll("'", "''")}'`;
+}
 function buildSandboxPlan(workflow, execution, runOptions) {
   const remoteDir = execution.sandboxRemoteDir ?? `/tmp/testers-workflow-${workflow.id.slice(0, 8)}`;
   const stateRemoteDir = `${remoteDir.replace(/\/+$/, "")}/.testers-state`;
+  const appRemoteDir = execution.appSourceDir ? execution.appRemoteDir ?? `${remoteDir.replace(/\/+$/, "")}/app` : execution.appRemoteDir;
   return {
     provider: execution.provider,
     image: execution.sandboxImage,
     name: `testers-${workflow.id.slice(0, 8)}`,
     remoteDir,
     stateRemoteDir,
+    ...execution.appSourceDir ? { appSourceDir: execution.appSourceDir } : {},
+    ...appRemoteDir ? { appRemoteDir } : {},
+    ...execution.appStartCommand ? { appStartCommand: execution.appStartCommand } : {},
+    ...execution.appUrl ? { appUrl: execution.appUrl } : {},
+    ...execution.appWaitUrl ? { appWaitUrl: execution.appWaitUrl } : {},
+    ...execution.appWaitTimeoutMs !== undefined ? { appWaitTimeoutMs: execution.appWaitTimeoutMs } : {},
     cleanup: execution.sandboxCleanup ?? "delete",
     syncStrategy: execution.sandboxSyncStrategy ?? "rsync",
     timeoutMs: execution.timeoutMs,
@@ -51390,6 +51467,12 @@ function buildSandboxPlan(workflow, execution, runOptions) {
     command: buildSandboxCommand({
       runOptions,
       remoteDir,
+      stateRemoteDir,
+      appRemoteDir,
+      appStartCommand: execution.appStartCommand,
+      appUrl: execution.appUrl,
+      appWaitUrl: execution.appWaitUrl,
+      appWaitTimeoutMs: execution.appWaitTimeoutMs,
       dbPath: `${stateRemoteDir}/testers.db`,
       setupCommand: execution.setupCommand,
       packageSpec: execution.packageSpec ?? "@hasna/testers"
@@ -51397,11 +51480,12 @@ function buildSandboxPlan(workflow, execution, runOptions) {
   };
 }
 function buildSandboxCommand(input) {
+  const targetUrl = input.appUrl ?? input.runOptions.url;
   const args = [
     "bunx",
     input.packageSpec,
     "run",
-    input.runOptions.url,
+    targetUrl,
     ...input.runOptions.scenarioIds?.length ? ["--scenario", input.runOptions.scenarioIds.join(",")] : [],
     ...input.runOptions.tags?.length ? input.runOptions.tags.flatMap((tag) => ["--tag", tag]) : [],
     ...input.runOptions.priority ? ["--priority", input.runOptions.priority] : [],
@@ -51417,12 +51501,46 @@ function buildSandboxCommand(input) {
   return [
     "set -euo pipefail",
     `mkdir -p ${shellQuote(input.remoteDir)}`,
-    `cd ${shellQuote(input.remoteDir)}`,
+    `mkdir -p ${shellQuote(input.stateRemoteDir)}`,
+    input.appRemoteDir ? `mkdir -p ${shellQuote(input.appRemoteDir)}` : undefined,
+    `cd ${shellQuote(input.appRemoteDir ?? input.remoteDir)}`,
     input.setupCommand,
+    buildAppStartCommand(input),
     `HASNA_TESTERS_DB_PATH=${shellQuote(input.dbPath)} ${args.map(shellQuote).join(" ")}`
   ].filter(Boolean).join(`
 `);
 }
+function buildAppStartCommand(input) {
+  if (!input.appStartCommand)
+    return;
+  const waitUrl = input.appWaitUrl ?? input.appUrl ?? input.runOptions.url;
+  const waitTimeoutMs = input.appWaitTimeoutMs ?? 120000;
+  return [
+    `( ${input.appStartCommand} ) > ${shellQuote(`${input.stateRemoteDir}/app.log`)} 2>&1 &`,
+    "APP_PID=$!",
+    `echo "$APP_PID" > ${shellQuote(`${input.stateRemoteDir}/app.pid`)}`,
+    `trap 'kill "$APP_PID" 2>/dev/null || true' EXIT`,
+    waitUrl ? buildWaitForUrlCommand(waitUrl, waitTimeoutMs) : undefined
+  ].filter(Boolean).join(`
+`);
+}
+function buildWaitForUrlCommand(url, timeoutMs) {
+  const script = `
+const url = ${JSON.stringify(url)};
+const timeoutMs = ${JSON.stringify(timeoutMs)};
+const deadline = Date.now() + timeoutMs;
+while (Date.now() <= deadline) {
+  try {
+    const response = await fetch(url);
+    if (response.status >= 200 && response.status < 500) process.exit(0);
+  } catch {}
+  await new Promise((resolve) => setTimeout(resolve, 1000));
+}
+console.error(\`Timed out waiting for \${url} after \${timeoutMs}ms\`);
+process.exit(1);
+`.trim();
+  return `bun -e ${shellQuote(script)}`;
+}
 async function runViaSandbox(plan, dependencies) {
   if (!plan.sandbox)
     throw new Error("Workflow does not have a sandbox plan");
@@ -51443,7 +51561,7 @@ async function runViaSandbox(plan, dependencies) {
         workflowId: plan.workflow.id,
         workflowName: plan.workflow.name
       },
-      sandboxEnvVars: plan.sandbox.env,
+      sandboxEnvVars: resolveSandboxEnv(plan.sandbox.env),
       cleanup: plan.sandbox.cleanup,
       upload: {
         localDir: bundle.localDir,
@@ -51469,6 +51587,19 @@ async function runViaSandbox(plan, dependencies) {
     bundle.cleanup?.();
   }
 }
+function resolveSandboxEnv(env) {
+  if (!env || Object.keys(env).length === 0)
+    return;
+  const resolved = {};
+  for (const [key, value] of Object.entries(env)) {
+    const resolvedValue = resolveCredential(value);
+    if (resolvedValue === null) {
+      throw new Error(`Missing sandbox env value for ${key}`);
+    }
+    resolved[key] = resolvedValue;
+  }
+  return resolved;
+}
 async function resolveSandboxesRuntime(dependencies) {
   if (dependencies.sandboxes)
     return dependencies.sandboxes;
@@ -52203,7 +52334,7 @@ async function handleRequest(req) {
     const screenshot = getScreenshot(id);
     if (!screenshot)
       return errorResponse("Screenshot not found", 404);
-    if (!existsSync10(screenshot.filePath)) {
+    if (!existsSync11(screenshot.filePath)) {
       return errorResponse("Screenshot file not found on disk", 404);
     }
     const file2 = Bun.file(screenshot.filePath);
@@ -52652,7 +52783,7 @@ async function handleRequest(req) {
   }
   if (!pathname.startsWith("/api")) {
     const dashboardDir = join14(import.meta.dir, "..", "..", "dashboard", "dist");
-    if (!existsSync10(dashboardDir)) {
+    if (!existsSync11(dashboardDir)) {
       return new Response(`<!DOCTYPE html>
 <html>
 <head><title>Open Testers</title></head>
@@ -52671,7 +52802,7 @@ async function handleRequest(req) {
       });
     }
     const filePath = join14(dashboardDir, pathname === "/" ? "index.html" : pathname);
-    if (existsSync10(filePath)) {
+    if (existsSync11(filePath)) {
       const file2 = Bun.file(filePath);
       return new Response(file2, {
         headers: {
@@ -52681,7 +52812,7 @@ async function handleRequest(req) {
       });
     }
     const indexPath = join14(dashboardDir, "index.html");
-    if (existsSync10(indexPath)) {
+    if (existsSync11(indexPath)) {
       const file2 = Bun.file(indexPath);
       return new Response(file2, {
         headers: {

package/dist/types/index.d.ts

@@ -397,6 +397,12 @@ export interface WorkflowExecutionConfig {
     sandboxSyncStrategy?: WorkflowSandboxSyncStrategy;
     setupCommand?: string;
     packageSpec?: string;
+    appSourceDir?: string;
+    appRemoteDir?: string;
+    appStartCommand?: string;
+    appUrl?: string;
+    appWaitUrl?: string;
+    appWaitTimeoutMs?: number;
     timeoutMs?: number;
     env?: Record<string, string>;
 }
@@ -412,6 +418,12 @@ export interface WorkflowExecutionInput {
     sandboxSyncStrategy?: WorkflowSandboxSyncStrategy;
     setupCommand?: string;
     packageSpec?: string;
+    appSourceDir?: string;
+    appRemoteDir?: string;
+    appStartCommand?: string;
+    appUrl?: string;
+    appWaitUrl?: string;
+    appWaitTimeoutMs?: number;
     timeoutMs?: number;
     env?: Record<string, string>;
 }