@hasna/testers 0.0.46 → 0.0.48

package/dist/cli/index.js

@@ -27025,12 +27025,60 @@ function listTestingWorkflows(filter) {
   const rows = db2.query(`SELECT * FROM testing_workflows${where} ORDER BY created_at DESC`).all(...params);
   return rows.map(workflowFromRow);
 }
+function updateTestingWorkflow(id, input) {
+  const existing = getTestingWorkflow(id);
+  if (!existing)
+    throw new Error(`Testing workflow not found: ${id}`);
+  const fields = [];
+  const values = [];
+  if (input.name !== undefined) {
+    fields.push("name = ?");
+    values.push(input.name);
+  }
+  if (input.description !== undefined) {
+    fields.push("description = ?");
+    values.push(input.description);
+  }
+  if (input.scenarioFilter !== undefined) {
+    fields.push("scenario_filter = ?");
+    values.push(JSON.stringify(normalizeFilter(input.scenarioFilter)));
+  }
+  if (input.personaIds !== undefined) {
+    fields.push("persona_ids = ?");
+    values.push(JSON.stringify(input.personaIds));
+  }
+  if (input.goal !== undefined) {
+    fields.push("goal = ?");
+    values.push(JSON.stringify(normalizeGoal(input.goal)));
+  }
+  if (input.execution !== undefined) {
+    fields.push("execution = ?");
+    values.push(JSON.stringify(normalizeExecution(input.execution)));
+  }
+  if (input.settings !== undefined) {
+    fields.push("settings = ?");
+    values.push(JSON.stringify(input.settings));
+  }
+  if (input.enabled !== undefined) {
+    fields.push("enabled = ?");
+    values.push(input.enabled ? 1 : 0);
+  }
+  if (fields.length === 0)
+    return existing;
+  fields.push("updated_at = ?");
+  values.push(now(), existing.id);
+  db2().query(`UPDATE testing_workflows SET ${fields.join(", ")} WHERE id = ?`).run(...values);
+  return getTestingWorkflow(existing.id);
+}
 function deleteTestingWorkflow(id) {
   const existing = getTestingWorkflow(id);
   if (!existing)
     return false;
   return getDatabase().query("DELETE FROM testing_workflows WHERE id = ?").run(existing.id).changes > 0;
 }
+function db2() {
+  return getDatabase();
+}
 var DEFAULT_EXECUTION;
 var init_workflows = __esm(() => {
   init_types();
@@ -27262,7 +27310,7 @@ async function runViaSandbox(plan, dependencies) {
         workflowId: plan.workflow.id,
         workflowName: plan.workflow.name
       },
-      sandboxEnvVars: plan.sandbox.env,
+      sandboxEnvVars: resolveSandboxEnv(plan.sandbox.env),
       cleanup: plan.sandbox.cleanup,
       upload: {
         localDir: bundle.localDir,
@@ -27288,6 +27336,26 @@ async function runViaSandbox(plan, dependencies) {
     bundle.cleanup?.();
   }
 }
+function resolveSandboxEnv(env) {
+  if (!env || Object.keys(env).length === 0)
+    return;
+  const resolved = {};
+  for (const [key, value] of Object.entries(env)) {
+    if (value.startsWith("$?")) {
+      const optionalName = value.slice(2).trim();
+      const optionalValue = optionalName ? process.env[optionalName] : undefined;
+      if (optionalValue !== undefined)
+        resolved[key] = optionalValue;
+      continue;
+    }
+    const resolvedValue = resolveCredential(value);
+    if (resolvedValue === null) {
+      throw new Error(`Missing sandbox env value for ${key}`);
+    }
+    resolved[key] = resolvedValue;
+  }
+  return resolved;
+}
 async function resolveSandboxesRuntime(dependencies) {
   if (dependencies.sandboxes)
     return dependencies.sandboxes;
@@ -27305,6 +27373,7 @@ var init_workflow_runner = __esm(() => {
   init_workflows();
   init_personas();
   init_runner();
+  init_secrets_resolver();
   APP_SOURCE_EXCLUDES = [
     "node_modules",
     ".git",
@@ -27312,6 +27381,8 @@ var init_workflow_runner = __esm(() => {
     ".next",
     ".turbo",
     ".cache",
+    ".env",
+    ".env.*",
     ".venv",
     "__pycache__"
   ];
@@ -27465,46 +27536,46 @@ __export(exports_sessions, {
   countSessions: () => countSessions
 });
 function createSession(input) {
-  const db2 = getDatabase();
+  const db3 = getDatabase();
   const id = input.sessionId ?? uuid();
   const timestamp = now();
-  db2.query(`
+  db3.query(`
     INSERT INTO sessions (id, tab_id, url, title, entries, entry_count, error_count, console_count, nav_count, status, start_time, end_time, created_at)
     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
   `).run(id, input.tabId, input.url ?? null, input.title ?? null, input.entries, input.entryCount, input.errorCount ?? 0, input.consoleCount ?? 0, input.navCount ?? 0, input.status, input.startTime, input.endTime ?? null, timestamp);
   return getSession(id);
 }
 function getSession(id) {
-  const db2 = getDatabase();
-  let row = db2.query("SELECT * FROM sessions WHERE id = ?").get(id);
+  const db3 = getDatabase();
+  let row = db3.query("SELECT * FROM sessions WHERE id = ?").get(id);
   if (row)
     return sessionFromRow(row);
   const fullId = resolvePartialId("sessions", id);
   if (fullId) {
-    row = db2.query("SELECT * FROM sessions WHERE id = ?").get(fullId);
+    row = db3.query("SELECT * FROM sessions WHERE id = ?").get(fullId);
     if (row)
       return sessionFromRow(row);
   }
   return null;
 }
 function listSessions(limit = 50, offset = 0) {
-  const db2 = getDatabase();
-  const rows = db2.query("SELECT * FROM sessions ORDER BY created_at DESC LIMIT ? OFFSET ?").all(limit, offset);
+  const db3 = getDatabase();
+  const rows = db3.query("SELECT * FROM sessions ORDER BY created_at DESC LIMIT ? OFFSET ?").all(limit, offset);
   return rows.map(sessionFromRow);
 }
 function deleteSession(id) {
-  const db2 = getDatabase();
-  const result = db2.query("DELETE FROM sessions WHERE id = ?").run(id);
+  const db3 = getDatabase();
+  const result = db3.query("DELETE FROM sessions WHERE id = ?").run(id);
   return result.changes > 0;
 }
 function searchSessions(query, limit = 20) {
-  const db2 = getDatabase();
-  const rows = db2.query("SELECT * FROM sessions WHERE url LIKE ? OR title LIKE ? ORDER BY created_at DESC LIMIT ?").all(`%${query}%`, `%${query}%`, limit);
+  const db3 = getDatabase();
+  const rows = db3.query("SELECT * FROM sessions WHERE url LIKE ? OR title LIKE ? ORDER BY created_at DESC LIMIT ?").all(`%${query}%`, `%${query}%`, limit);
   return rows.map(sessionFromRow);
 }
 function countSessions() {
-  const db2 = getDatabase();
-  const row = db2.query("SELECT COUNT(*) as count FROM sessions").get();
+  const db3 = getDatabase();
+  const row = db3.query("SELECT COUNT(*) as count FROM sessions").get();
   return row.count;
 }
 function sessionFromRow(row) {
@@ -28032,8 +28103,8 @@ function customRandom(alphabet, defaultSize, getRandom) {
 function customAlphabet(alphabet, size = 21) {
   return customRandom(alphabet, size, random);
 }
-function runMigrations(db2) {
-  db2.run(`
+function runMigrations(db3) {
+  db3.run(`
     CREATE TABLE IF NOT EXISTS _migrations (
       id INTEGER PRIMARY KEY,
       applied_at TEXT NOT NULL DEFAULT (datetime('now'))
@@ -28041,9 +28112,9 @@ function runMigrations(db2) {
   `);
   for (let i = 0;i < MIGRATIONS2.length; i++) {
     const migrationId = i + 1;
-    const exists = db2.query("SELECT id FROM _migrations WHERE id = ?").get(migrationId);
+    const exists = db3.query("SELECT id FROM _migrations WHERE id = ?").get(migrationId);
     if (!exists) {
-      db2.run(MIGRATIONS2[i]);
+      db3.run(MIGRATIONS2[i]);
     }
   }
 }
@@ -28068,11 +28139,11 @@ function ensureDir2(filePath) {
 function getDatabase2(path) {
   if (path) {
     ensureDir2(path);
-    const db2 = new Database4(path);
-    db2.run("PRAGMA journal_mode=WAL");
-    db2.run("PRAGMA foreign_keys=ON");
-    runMigrations(db2);
-    return db2;
+    const db3 = new Database4(path);
+    db3.run("PRAGMA journal_mode=WAL");
+    db3.run("PRAGMA foreign_keys=ON");
+    runMigrations(db3);
+    return db3;
   }
   if (!_db) {
     const dbPath = getDbPath2();
@@ -28140,8 +28211,8 @@ function rowToWorkdir(row) {
 function getMachineId() {
   return process.env["HOSTNAME"] || hostname();
 }
-function addWorkdir(input, db2) {
-  const d = db2 || getDatabase2();
+function addWorkdir(input, db3) {
+  const d = db3 || getDatabase2();
   const project = getProject2(input.project_id, d);
   if (!project)
     throw new ProjectNotFoundError(input.project_id);
@@ -28158,18 +28229,18 @@ function addWorkdir(input, db2) {
      ON CONFLICT(project_id, path) DO UPDATE SET label = excluded.label, machine_id = excluded.machine_id`, [id, input.project_id, input.path, machineId, input.label ?? "main", isPrimary, ts]);
   return getWorkdir(input.project_id, input.path, d);
 }
-function getWorkdir(projectId, path, db2) {
-  const d = db2 || getDatabase2();
+function getWorkdir(projectId, path, db3) {
+  const d = db3 || getDatabase2();
   const row = d.query("SELECT * FROM project_workdirs WHERE project_id = ? AND path = ?").get(projectId, path);
   return row ? rowToWorkdir(row) : null;
 }
-function listWorkdirs(projectId, db2) {
-  const d = db2 || getDatabase2();
+function listWorkdirs(projectId, db3) {
+  const d = db3 || getDatabase2();
   const rows = d.query("SELECT * FROM project_workdirs WHERE project_id = ? ORDER BY is_primary DESC, created_at ASC").all(projectId);
   return rows.map(rowToWorkdir);
 }
-function removeWorkdir(projectId, path, db2) {
-  const d = db2 || getDatabase2();
+function removeWorkdir(projectId, path, db3) {
+  const d = db3 || getDatabase2();
   d.run("DELETE FROM project_workdirs WHERE project_id = ? AND path = ?", [projectId, path]);
 }
 function generateProjectId() {
@@ -28187,11 +28258,11 @@ function scaffoldProject(path) {
     mkdirSync32(join42(path, dir), { recursive: true });
   }
 }
-function ensureUniqueSlug(base, db2, excludeId) {
+function ensureUniqueSlug(base, db3, excludeId) {
   let candidate = base;
   let suffix = 1;
   while (true) {
-    const row = db2.query("SELECT id FROM projects WHERE slug = ?").get(candidate);
+    const row = db3.query("SELECT id FROM projects WHERE slug = ?").get(candidate);
     if (!row || row.id === excludeId)
       return candidate;
     suffix++;
@@ -28207,8 +28278,8 @@ function rowToProject(row) {
     last_opened_at: row.last_opened_at ?? null
   };
 }
-function createProject2(input, db2) {
-  const d = db2 || getDatabase2();
+function createProject2(input, db3) {
+  const d = db3 || getDatabase2();
   const id = generateProjectId();
   const ts = now2();
   const baseSlug = input.slug || slugify2(input.name);
@@ -28243,23 +28314,23 @@ function createProject2(input, db2) {
   }
   return getProject2(id, d);
 }
-function getProject2(id, db2) {
-  const d = db2 || getDatabase2();
+function getProject2(id, db3) {
+  const d = db3 || getDatabase2();
   const row = d.query("SELECT * FROM projects WHERE id = ?").get(id);
   return row ? rowToProject(row) : null;
 }
-function getProjectBySlug(slug, db2) {
-  const d = db2 || getDatabase2();
+function getProjectBySlug(slug, db3) {
+  const d = db3 || getDatabase2();
   const row = d.query("SELECT * FROM projects WHERE slug = ?").get(slug);
   return row ? rowToProject(row) : null;
 }
-function getProjectByPath2(path, db2) {
-  const d = db2 || getDatabase2();
+function getProjectByPath2(path, db3) {
+  const d = db3 || getDatabase2();
   const row = d.query("SELECT * FROM projects WHERE path = ?").get(path);
   return row ? rowToProject(row) : null;
 }
-function listProjects2(filter = {}, db2) {
-  const d = db2 || getDatabase2();
+function listProjects2(filter = {}, db3) {
+  const d = db3 || getDatabase2();
   const conditions = [];
   const params = [];
   if (filter.status) {
@@ -28278,8 +28349,8 @@ function listProjects2(filter = {}, db2) {
   }
   return rows.map(rowToProject);
 }
-function updateProject(id, input, db2) {
-  const d = db2 || getDatabase2();
+function updateProject(id, input, db3) {
+  const d = db3 || getDatabase2();
   const project = getProject2(id, d);
   if (!project)
     throw new ProjectNotFoundError(id);
@@ -28328,8 +28399,8 @@ function updateProject(id, input, db2) {
   d.run(`UPDATE projects SET ${sets.join(", ")} WHERE id = ?`, params);
   return getProject2(id, d);
 }
-function setIntegrations(id, integrations, db2) {
-  const d = db2 || getDatabase2();
+function setIntegrations(id, integrations, db3) {
+  const d = db3 || getDatabase2();
   const project = getProject2(id, d);
   if (!project)
     throw new ProjectNotFoundError(id);
@@ -28349,16 +28420,16 @@ function setIntegrations(id, integrations, db2) {
   } catch {}
   return getProject2(id, d);
 }
-function archiveProject(id, db2) {
-  const d = db2 || getDatabase2();
+function archiveProject(id, db3) {
+  const d = db3 || getDatabase2();
   const project = getProject2(id, d);
   if (!project)
     throw new ProjectNotFoundError(id);
   d.run("UPDATE projects SET status = 'archived', updated_at = ? WHERE id = ?", [now2(), id]);
   return getProject2(id, d);
 }
-function unarchiveProject(id, db2) {
-  const d = db2 || getDatabase2();
+function unarchiveProject(id, db3) {
+  const d = db3 || getDatabase2();
   const project = getProject2(id, d);
   if (!project)
     throw new ProjectNotFoundError(id);
@@ -28375,8 +28446,8 @@ function levenshtein(a, b) {
       dp[i][j] = a[i - 1] === b[j - 1] ? dp[i - 1][j - 1] : 1 + Math.min(dp[i - 1][j], dp[i][j - 1], dp[i - 1][j - 1]);
   return dp[m][n];
 }
-function resolveProject(idOrSlug, db2) {
-  const d = db2 || getDatabase2();
+function resolveProject(idOrSlug, db3) {
+  const d = db3 || getDatabase2();
   let project = getProject2(idOrSlug, d);
   if (project)
     return project;
@@ -28399,22 +28470,22 @@ function resolveProject(idOrSlug, db2) {
 function syncRowToLog(row) {
   return { ...row, direction: row.direction, status: row.status };
 }
-function startSyncLog(projectId, direction, db2) {
-  const d = db2 || getDatabase2();
+function startSyncLog(projectId, direction, db3) {
+  const d = db3 || getDatabase2();
   const id = uuid2();
   const ts = now2();
   d.run("INSERT INTO sync_log (id, project_id, direction, status, started_at) VALUES (?, ?, ?, 'running', ?)", [id, projectId, direction, ts]);
   return d.query("SELECT * FROM sync_log WHERE id = ?").get(id);
 }
-function completeSyncLog(id, result, db2) {
-  const d = db2 || getDatabase2();
+function completeSyncLog(id, result, db3) {
+  const d = db3 || getDatabase2();
   const status = result.error ? "failed" : "completed";
   d.run("UPDATE sync_log SET status = ?, files_synced = ?, bytes = ?, error = ?, completed_at = ? WHERE id = ?", [status, result.files_synced ?? 0, result.bytes ?? 0, result.error ?? null, now2(), id]);
   const row = d.query("SELECT * FROM sync_log WHERE id = ?").get(id);
   return syncRowToLog(row);
 }
-function listSyncLogs(projectId, limit = 20, db2) {
-  const d = db2 || getDatabase2();
+function listSyncLogs(projectId, limit = 20, db3) {
+  const d = db3 || getDatabase2();
   const rows = d.query("SELECT * FROM sync_log WHERE project_id = ? ORDER BY started_at DESC LIMIT ?").all(projectId, limit);
   return rows.map(syncRowToLog);
 }
@@ -58782,7 +58853,7 @@ function buildPeriod(days) {
   return { periodStart, periodEnd };
 }
 async function collectComplianceData(options) {
-  const db2 = getDatabase();
+  const db3 = getDatabase();
   const runsInPeriod = listRuns({
     projectId: options.projectId,
     limit: 1e4
@@ -58797,13 +58868,13 @@ async function collectComplianceData(options) {
     scanConditions.push("project_id = ?");
     scanParams.push(options.projectId);
   }
-  const scanIssues = db2.query(`SELECT type, severity FROM scan_issues WHERE ${scanConditions.join(" AND ")}`).all(...scanParams);
+  const scanIssues = db3.query(`SELECT type, severity FROM scan_issues WHERE ${scanConditions.join(" AND ")}`).all(...scanParams);
   const injectionProbesRun = scanIssues.filter((i2) => i2.type === "injection" || i2.type === "sql_injection" || i2.type === "xss").length;
   const injectionVulnsFound = scanIssues.filter((i2) => (i2.type === "injection" || i2.type === "xss") && (i2.severity === "high" || i2.severity === "critical")).length;
   const piiLeaksDetected = scanIssues.filter((i2) => i2.type === "pii" || i2.type === "pii_leak").length;
   let goldenAnswerDriftEvents = 0;
   try {
-    const driftRows = db2.query(`SELECT COUNT(*) as count FROM golden_check_results WHERE drift_detected = 1 AND created_at >= ? AND created_at <= ?`).get(options.periodStart, options.periodEnd);
+    const driftRows = db3.query(`SELECT COUNT(*) as count FROM golden_check_results WHERE drift_detected = 1 AND created_at >= ? AND created_at <= ?`).get(options.periodStart, options.periodEnd);
     goldenAnswerDriftEvents = driftRows?.count ?? 0;
   } catch {
     goldenAnswerDriftEvents = 0;
@@ -58815,7 +58886,7 @@ async function collectComplianceData(options) {
   let flakyScenarioCount = 0;
   if (runIds.length > 0) {
     const placeholders = runIds.map(() => "?").join(", ");
-    const evalResults = db2.query(`SELECT r.status, r.metadata FROM results r
+    const evalResults = db3.query(`SELECT r.status, r.metadata FROM results r
          JOIN scenarios s ON r.scenario_id = s.id
          WHERE r.run_id IN (${placeholders}) AND s.scenario_type = 'eval'`).all(...runIds);
     evalScenariosRun = evalResults.length;
@@ -58828,9 +58899,9 @@ async function collectComplianceData(options) {
         totalEvalScore += er.status === "passed" ? 1 : 0;
       }
     }
-    const a11yRows = db2.query(`SELECT COUNT(*) as count FROM scan_issues WHERE type = 'a11y' AND severity = 'critical' AND first_seen_at >= ? AND first_seen_at <= ?`).get(options.periodStart, options.periodEnd);
+    const a11yRows = db3.query(`SELECT COUNT(*) as count FROM scan_issues WHERE type = 'a11y' AND severity = 'critical' AND first_seen_at >= ? AND first_seen_at <= ?`).get(options.periodStart, options.periodEnd);
     a11yViolationsCritical = a11yRows?.count ?? 0;
-    const flakyRows = db2.query(`SELECT COUNT(DISTINCT scenario_id) as count FROM results WHERE run_id IN (${placeholders}) AND status = 'flaky'`).get(...runIds);
+    const flakyRows = db3.query(`SELECT COUNT(DISTINCT scenario_id) as count FROM results WHERE run_id IN (${placeholders}) AND status = 'flaky'`).get(...runIds);
     flakyScenarioCount = flakyRows?.count ?? 0;
   }
   const averageEvalScore = evalScenariosRun > 0 ? totalEvalScore / evalScenariosRun : 1;
@@ -59649,49 +59720,49 @@ __export(exports_agents, {
   getAgent: () => getAgent
 });
 function registerAgent(input) {
-  const db2 = getDatabase();
-  const existing = db2.query("SELECT * FROM agents WHERE name = ?").get(input.name);
+  const db3 = getDatabase();
+  const existing = db3.query("SELECT * FROM agents WHERE name = ?").get(input.name);
   if (existing) {
-    db2.query("UPDATE agents SET last_seen_at = ? WHERE id = ?").run(now(), existing.id);
+    db3.query("UPDATE agents SET last_seen_at = ? WHERE id = ?").run(now(), existing.id);
     return getAgent(existing.id);
   }
   const id = uuid();
   const timestamp = now();
-  db2.query(`
+  db3.query(`
     INSERT INTO agents (id, name, description, role, metadata, created_at, last_seen_at)
     VALUES (?, ?, ?, ?, '{}', ?, ?)
   `).run(id, input.name, input.description ?? null, input.role ?? null, timestamp, timestamp);
   return getAgent(id);
 }
 function getAgent(id) {
-  const db2 = getDatabase();
-  const row = db2.query("SELECT * FROM agents WHERE id = ?").get(id);
+  const db3 = getDatabase();
+  const row = db3.query("SELECT * FROM agents WHERE id = ?").get(id);
   return row ? agentFromRow(row) : null;
 }
 function getAgentByName(name) {
-  const db2 = getDatabase();
-  const row = db2.query("SELECT * FROM agents WHERE name = ?").get(name);
+  const db3 = getDatabase();
+  const row = db3.query("SELECT * FROM agents WHERE name = ?").get(name);
   return row ? agentFromRow(row) : null;
 }
 function listAgents() {
-  const db2 = getDatabase();
-  const rows = db2.query("SELECT * FROM agents ORDER BY created_at DESC").all();
+  const db3 = getDatabase();
+  const rows = db3.query("SELECT * FROM agents ORDER BY created_at DESC").all();
   return rows.map(agentFromRow);
 }
 function heartbeatAgent(id) {
-  const db2 = getDatabase();
-  const affected = db2.query("UPDATE agents SET last_seen_at = ? WHERE id = ?").run(now(), id);
+  const db3 = getDatabase();
+  const affected = db3.query("UPDATE agents SET last_seen_at = ? WHERE id = ?").run(now(), id);
   if (affected.changes === 0)
     return null;
   return getAgent(id);
 }
 function setAgentFocus(id, scenarioId) {
-  const db2 = getDatabase();
+  const db3 = getDatabase();
   const agent = getAgent(id);
   if (!agent)
     return null;
   const metadata = { ...agent.metadata ?? {}, focus: scenarioId };
-  db2.query("UPDATE agents SET metadata = ?, last_seen_at = ? WHERE id = ?").run(JSON.stringify(metadata), now(), id);
+  db3.query("UPDATE agents SET metadata = ?, last_seen_at = ? WHERE id = ?").run(JSON.stringify(metadata), now(), id);
   return getAgent(id);
 }
 var init_agents = __esm(() => {
@@ -94075,28 +94146,28 @@ function checkResultFromRow(row) {
   };
 }
 function createGoldenAnswer(input) {
-  const db2 = getDatabase();
+  const db3 = getDatabase();
   const id = uuid();
   const short_id = shortUuid();
   const timestamp = now();
-  db2.query(`
+  db3.query(`
     INSERT INTO golden_answers (id, short_id, project_id, question, golden_answer, constraints, endpoint, judge_model, enabled, created_at, updated_at)
     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
   `).run(id, short_id, input.projectId ?? null, input.question, input.goldenAnswer, JSON.stringify(input.constraints ?? []), input.endpoint, input.judgeModel ?? null, input.enabled === false ? 0 : 1, timestamp, timestamp);
   return getGoldenAnswer(id);
 }
 function getGoldenAnswer(id) {
-  const db2 = getDatabase();
-  let row = db2.query("SELECT * FROM golden_answers WHERE id = ?").get(id);
+  const db3 = getDatabase();
+  let row = db3.query("SELECT * FROM golden_answers WHERE id = ?").get(id);
   if (row)
     return goldenFromRow(row);
-  row = db2.query("SELECT * FROM golden_answers WHERE short_id = ?").get(id);
+  row = db3.query("SELECT * FROM golden_answers WHERE short_id = ?").get(id);
   if (row)
     return goldenFromRow(row);
   return null;
 }
 function listGoldenAnswers(filter2) {
-  const db2 = getDatabase();
+  const db3 = getDatabase();
   const conditions = [];
   const params = [];
   if (filter2?.projectId) {
@@ -94112,11 +94183,11 @@ function listGoldenAnswers(filter2) {
     sql += " WHERE " + conditions.join(" AND ");
   }
   sql += " ORDER BY created_at DESC";
-  const rows = db2.query(sql).all(...params);
+  const rows = db3.query(sql).all(...params);
   return rows.map(goldenFromRow);
 }
 function updateGoldenAnswer(id, input) {
-  const db2 = getDatabase();
+  const db3 = getDatabase();
   const timestamp = now();
   const sets = ["updated_at = ?"];
   const params = [timestamp];
@@ -94145,26 +94216,26 @@ function updateGoldenAnswer(id, input) {
     params.push(input.enabled ? 1 : 0);
   }
   params.push(id);
-  db2.query(`UPDATE golden_answers SET ${sets.join(", ")} WHERE id = ? OR short_id = ?`).run(...params, id);
+  db3.query(`UPDATE golden_answers SET ${sets.join(", ")} WHERE id = ? OR short_id = ?`).run(...params, id);
   return getGoldenAnswer(id);
 }
 function deleteGoldenAnswer(id) {
-  const db2 = getDatabase();
-  const result = db2.query("DELETE FROM golden_answers WHERE id = ? OR short_id = ?").run(id, id);
+  const db3 = getDatabase();
+  const result = db3.query("DELETE FROM golden_answers WHERE id = ? OR short_id = ?").run(id, id);
   return (result.changes ?? 0) > 0;
 }
 function createGoldenCheckResult(input) {
-  const db2 = getDatabase();
+  const db3 = getDatabase();
   const id = uuid();
   const timestamp = now();
-  db2.query(`
+  db3.query(`
     INSERT INTO golden_check_results (id, golden_id, response, similarity_score, passed, drift_detected, judge_model, provider, created_at)
     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
   `).run(id, input.goldenId, input.response, input.similarityScore ?? null, input.passed ? 1 : 0, input.driftDetected ? 1 : 0, input.judgeModel ?? null, input.provider ?? null, timestamp);
   return listGoldenCheckResults(input.goldenId, { limit: 1 })[0];
 }
 function listGoldenCheckResults(goldenId, options) {
-  const db2 = getDatabase();
+  const db3 = getDatabase();
   const params = [goldenId];
   let sql = "SELECT * FROM golden_check_results WHERE golden_id = ?";
   if (options?.since) {
@@ -94176,7 +94247,7 @@ function listGoldenCheckResults(goldenId, options) {
     sql += " LIMIT ?";
     params.push(options.limit);
   }
-  const rows = db2.query(sql).all(...params);
+  const rows = db3.query(sql).all(...params);
   return rows.map(checkResultFromRow);
 }
 function getLatestGoldenCheckResult(goldenId) {
@@ -94465,7 +94536,7 @@ import chalk6 from "chalk";
 // package.json
 var package_default = {
   name: "@hasna/testers",
-  version: "0.0.46",
+  version: "0.0.48",
   description: "AI-powered QA testing CLI \u2014 spawns cheap AI agents to test web apps with headless browsers",
   type: "module",
   main: "dist/index.js",
@@ -96599,51 +96670,51 @@ function fromRow3(row) {
   };
 }
 function createEnvironment(input) {
-  const db2 = getDatabase();
+  const db3 = getDatabase();
   const id = uuid();
   const timestamp = now();
   const meta = JSON.stringify({ variables: input.variables ?? {} });
-  db2.query(`
+  db3.query(`
     INSERT INTO environments (id, name, url, auth_preset_name, project_id, is_default, metadata, created_at)
     VALUES (?, ?, ?, ?, ?, ?, ?, ?)
   `).run(id, input.name, input.url, input.authPresetName ?? null, input.projectId ?? null, input.isDefault ? 1 : 0, meta, timestamp);
   return getEnvironmentById(id);
 }
 function getEnvironmentById(id) {
-  const db2 = getDatabase();
-  const row = db2.query("SELECT * FROM environments WHERE id = ?").get(id);
+  const db3 = getDatabase();
+  const row = db3.query("SELECT * FROM environments WHERE id = ?").get(id);
   return row ? fromRow3(row) : null;
 }
 function getEnvironment(name) {
-  const db2 = getDatabase();
-  const row = db2.query("SELECT * FROM environments WHERE name = ?").get(name);
+  const db3 = getDatabase();
+  const row = db3.query("SELECT * FROM environments WHERE name = ?").get(name);
   return row ? fromRow3(row) : null;
 }
 function listEnvironments(projectId) {
-  const db2 = getDatabase();
+  const db3 = getDatabase();
   if (projectId) {
-    const rows2 = db2.query("SELECT * FROM environments WHERE project_id = ? ORDER BY is_default DESC, created_at DESC").all(projectId);
+    const rows2 = db3.query("SELECT * FROM environments WHERE project_id = ? ORDER BY is_default DESC, created_at DESC").all(projectId);
     return rows2.map(fromRow3);
   }
-  const rows = db2.query("SELECT * FROM environments ORDER BY is_default DESC, created_at DESC").all();
+  const rows = db3.query("SELECT * FROM environments ORDER BY is_default DESC, created_at DESC").all();
   return rows.map(fromRow3);
 }
 function deleteEnvironment(name) {
-  const db2 = getDatabase();
-  const result = db2.query("DELETE FROM environments WHERE name = ?").run(name);
+  const db3 = getDatabase();
+  const result = db3.query("DELETE FROM environments WHERE name = ?").run(name);
   return result.changes > 0;
 }
 function setDefaultEnvironment(name) {
-  const db2 = getDatabase();
-  db2.exec("UPDATE environments SET is_default = 0");
-  const result = db2.query("UPDATE environments SET is_default = 1 WHERE name = ?").run(name);
+  const db3 = getDatabase();
+  db3.exec("UPDATE environments SET is_default = 0");
+  const result = db3.query("UPDATE environments SET is_default = 1 WHERE name = ?").run(name);
   if (result.changes === 0) {
     throw new Error(`Environment not found: ${name}`);
   }
 }
 function getDefaultEnvironment() {
-  const db2 = getDatabase();
-  const row = db2.query("SELECT * FROM environments WHERE is_default = 1 LIMIT 1").get();
+  const db3 = getDatabase();
+  const row = db3.query("SELECT * FROM environments WHERE is_default = 1 LIMIT 1").get();
   return row ? fromRow3(row) : null;
 }
 
@@ -97210,12 +97281,12 @@ async function runRepoTests(opts) {
     specResults.push(result);
     const resultId = uuid();
     const timestamp = now();
-    const db2 = getDatabase();
-    db2.exec("PRAGMA foreign_keys = OFF");
+    const db3 = getDatabase();
+    db3.exec("PRAGMA foreign_keys = OFF");
     try {
       const reasoning = result.status === "passed" ? "All tests passed" : (result.error ?? "").slice(0, 500) || null;
       const errorStr = result.status !== "passed" ? result.error ?? null : null;
-      db2.query(`
+      db3.query(`
         INSERT INTO results (id, run_id, scenario_id, status, reasoning, error, steps_completed, steps_total, duration_ms, model, tokens_used, cost_cents, metadata, created_at, persona_id, persona_name)
         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0, 0, ?, ?, NULL, NULL)
       `).run(resultId, run.id, "__repo__", result.status, reasoning, errorStr, result.testResults.filter((t) => t.status === "passed").length, result.testResults.length || 1, result.durationMs, "repo-native", JSON.stringify({
@@ -97224,7 +97295,7 @@ async function runRepoTests(opts) {
         testResults: result.testResults
       }), timestamp);
     } finally {
-      db2.exec("PRAGMA foreign_keys = ON");
+      db3.exec("PRAGMA foreign_keys = ON");
     }
     const resultRecord = { id: resultId };
     if (result.stdout || result.stderr) {
@@ -97365,6 +97436,39 @@ function validateStoredAssertion(value) {
   }
   return describeStoredAssertion(value);
 }
+function envCredentialRef(value) {
+  const trimmed = value?.trim();
+  if (!trimmed)
+    return;
+  return trimmed.startsWith("$") ? trimmed : `$${trimmed}`;
+}
+function assertEnvVarName(key, rawValue) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
+    throw new Error(`Invalid sandbox env var name: ${key || rawValue}`);
+  }
+}
+function parseSandboxEnv(values, optionalValues = []) {
+  if (!values?.length && !optionalValues?.length)
+    return;
+  const env = {};
+  for (const value of values ?? []) {
+    const trimmed = value.trim();
+    if (!trimmed)
+      continue;
+    const separator = trimmed.indexOf("=");
+    const key = separator >= 0 ? trimmed.slice(0, separator).trim() : trimmed;
+    assertEnvVarName(key, value);
+    env[key] = separator >= 0 ? trimmed.slice(separator + 1) : `$${key}`;
+  }
+  for (const value of optionalValues ?? []) {
+    const key = value.trim();
+    if (!key)
+      continue;
+    assertEnvVarName(key, value);
+    env[key] = `$?${key}`;
+  }
+  return Object.keys(env).length > 0 ? env : undefined;
+}
 function AddForm({ onComplete }) {
   const { exit } = useApp();
   const [state, setState] = useState({
@@ -97669,12 +97773,12 @@ program2.command("add [name]").alias("create").description("Create a new test sc
 }, []).option("-t, --tag <tag>", "Tag (repeatable)", (val, acc) => {
   acc.push(val);
   return acc;
-}, []).option("-p, --priority <level>", "Priority level", "medium").option("-m, --model <model>", "AI model to use").option("--path <path>", "Target path on the URL").option("--auth", "Requires authentication", false).option("--timeout <ms>", "Timeout in milliseconds").option("--project <id>", "Project ID").option("--template <name>", "Seed scenarios from a template (auth, crud, forms, nav, a11y)").option("--assert <assertion>", "Structured assertion (repeatable). Formats: selector:<sel> visible, text:<sel> contains:<text>, no-console-errors, url:contains:<path>, title:contains:<text>, count:<sel> eq:<n>", (val, acc) => {
+}, []).option("-p, --priority <level>", "Priority level", "medium").option("-m, --model <model>", "AI model to use").option("--path <path>", "Target path on the URL").option("--auth", "Requires authentication", false).option("--auth-preset <name>", "Attach email/password/loginPath from a named auth preset").option("--timeout <ms>", "Timeout in milliseconds").option("--project <id>", "Project ID").option("--template <name>", "Seed scenarios from a template (auth, crud, forms, nav, a11y)").option("--assert <assertion>", "Structured assertion (repeatable). Formats: selector:<sel> visible, text:<sel> contains:<text>, no-console-errors, url:contains:<path>, title:contains:<text>, count:<sel> eq:<n>", (val, acc) => {
   acc.push(val);
   return acc;
 }, []).action(async (name21, opts) => {
   try {
-    const hasFlags = opts.description || opts.steps?.length || opts.tag?.length || opts.model || opts.path || opts.auth || opts.timeout || opts.template || opts.assert?.length;
+    const hasFlags = opts.description || opts.steps?.length || opts.tag?.length || opts.model || opts.path || opts.auth || opts.authPreset || opts.timeout || opts.template || opts.assert?.length;
     if (!name21 && !hasFlags) {
       const projectId2 = resolveProject2(opts.project);
       await runInteractiveAdd(projectId2);
@@ -97699,6 +97803,11 @@ program2.command("add [name]").alias("create").description("Create a new test sc
     }
     const assertions = opts.assert.map(parseAssertionString);
     const projectId = resolveProject2(opts.project);
+    const authPreset = opts.authPreset ? getAuthPreset(opts.authPreset) : null;
+    if (opts.authPreset && !authPreset) {
+      logError(chalk6.red(`Auth preset not found: ${opts.authPreset}`));
+      process.exit(1);
+    }
     const scenario = createScenario({
       name: name21,
       description: opts.description || name21,
@@ -97707,7 +97816,12 @@ program2.command("add [name]").alias("create").description("Create a new test sc
       priority: opts.priority,
       model: opts.model,
       targetPath: opts.path,
-      requiresAuth: opts.auth,
+      requiresAuth: opts.auth || Boolean(authPreset),
+      authConfig: authPreset ? {
+        email: authPreset.email,
+        password: authPreset.password,
+        loginPath: authPreset.loginPath
+      } : undefined,
       timeoutMs: opts.timeout ? parseInt(opts.timeout, 10) : undefined,
       assertions: assertions.length > 0 ? assertions : undefined,
       projectId
@@ -99701,12 +99815,22 @@ program2.command("report [run-id]").description("Generate HTML test report or co
   }
 });
 var authCmd = program2.command("auth").description("Manage auth presets");
-authCmd.command("add <name>").description("Create an auth preset").requiredOption("--email <email>", "Login email").requiredOption("--password <password>", "Login password").option("--login-path <path>", "Login page path", "/login").action((name21, opts) => {
+authCmd.command("add <name>").description("Create an auth preset").option("--email <email>", "Login email or credential reference").option("--password <password>", "Login password or credential reference").option("--email-env <name>", "Environment variable name for the login email").option("--password-env <name>", "Environment variable name for the login password").option("--login-path <path>", "Login page path", "/login").action((name21, opts) => {
   try {
+    const email3 = opts.email ?? envCredentialRef(opts.emailEnv);
+    const password = opts.password ?? envCredentialRef(opts.passwordEnv);
+    if (!email3) {
+      logError(chalk6.red("Error: provide --email or --email-env"));
+      process.exit(1);
+    }
+    if (!password) {
+      logError(chalk6.red("Error: provide --password or --password-env"));
+      process.exit(1);
+    }
     const preset = createAuthPreset({
       name: name21,
-      email: opts.email,
-      password: opts.password,
+      email: email3,
+      password,
       loginPath: opts.loginPath
     });
     log(chalk6.green(`Created auth preset ${chalk6.bold(preset.name)} (${preset.email})`));
@@ -100501,8 +100625,8 @@ program2.command("doctor").description("Check system setup and configuration").a
   const dbPath = join20(getTestersDir(), "testers.db");
   try {
     const { Database: Database5 } = await import("bun:sqlite");
-    const db2 = new Database5(dbPath, { create: true });
-    db2.close();
+    const db3 = new Database5(dbPath, { create: true });
+    db3.close();
     log(chalk6.green("\u2713") + ` Database accessible: ${dbPath}`);
   } catch (err) {
     log(chalk6.red("\u2717") + ` Database not accessible at ${dbPath}: ${err instanceof Error ? err.message : String(err)}`);
@@ -100968,7 +101092,13 @@ workflowCmd.command("create <name>").description("Save a reusable testing workfl
 }, []).option("--priority <level>", "Scenario priority").option("--persona <ids>", "Comma-separated persona IDs").option("--goal <prompt>", "Goal prompt for the agentic testing loop").option("--success <criteria>", "Success criteria (repeatable)", (val, acc) => {
   acc.push(val);
   return acc;
-}, []).option("--max-iterations <n>", "Goal-loop iteration cap", "10").option("--target <target>", "Execution target: local or sandbox", "local").option("--sandbox-provider <provider>", "Sandbox provider: e2b, daytona, or modal").option("--sandbox-image <image>", "Sandbox image/template").option("--sandbox-remote-dir <path>", "Remote working directory for sandbox runs").option("--sandbox-cleanup <mode>", "Sandbox cleanup mode: delete, stop, or keep", "delete").option("--sandbox-sync <strategy>", "Sandbox upload sync strategy: rsync or archive", "rsync").option("--sandbox-setup-command <command>", "Shell command to run before testers in the sandbox").option("--sandbox-package <spec>", "Package spec to execute in the sandbox", "@hasna/testers").option("--sandbox-app-source <path>", "Local app source directory to upload into the sandbox").option("--sandbox-app-remote-dir <path>", "Remote app directory inside the sandbox (default: <sandbox-remote-dir>/app)").option("--sandbox-app-start-command <command>", "Shell command to start the app before testers runs").option("--sandbox-app-url <url>", "URL testers should target inside the sandbox after the app starts").option("--sandbox-app-wait-url <url>", "URL to poll before starting testers (defaults to --sandbox-app-url)").option("--sandbox-app-wait-timeout <ms>", "App readiness wait timeout in milliseconds").option("--e2b-template <name>", "Legacy alias for --sandbox-image").option("--timeout <ms>", "Workflow timeout").option("--json", "Output as JSON", false).action((name21, opts) => {
+}, []).option("--max-iterations <n>", "Goal-loop iteration cap", "10").option("--target <target>", "Execution target: local or sandbox", "local").option("--sandbox-provider <provider>", "Sandbox provider: e2b, daytona, or modal").option("--sandbox-image <image>", "Sandbox image/template").option("--sandbox-remote-dir <path>", "Remote working directory for sandbox runs").option("--sandbox-cleanup <mode>", "Sandbox cleanup mode: delete, stop, or keep", "delete").option("--sandbox-sync <strategy>", "Sandbox upload sync strategy: rsync or archive", "rsync").option("--sandbox-setup-command <command>", "Shell command to run before testers in the sandbox").option("--sandbox-package <spec>", "Package spec to execute in the sandbox", "@hasna/testers").option("--sandbox-env <assignment>", "Sandbox env var; KEY forwards host KEY, KEY=value stores value (repeatable)", (val, acc) => {
+  acc.push(val);
+  return acc;
+}, []).option("--sandbox-env-optional <name>", "Optional sandbox env var; forwards host NAME only when set (repeatable)", (val, acc) => {
+  acc.push(val);
+  return acc;
+}, []).option("--sandbox-app-source <path>", "Local app source directory to upload into the sandbox").option("--sandbox-app-remote-dir <path>", "Remote app directory inside the sandbox (default: <sandbox-remote-dir>/app)").option("--sandbox-app-start-command <command>", "Shell command to start the app before testers runs").option("--sandbox-app-url <url>", "URL testers should target inside the sandbox after the app starts").option("--sandbox-app-wait-url <url>", "URL to poll before starting testers (defaults to --sandbox-app-url)").option("--sandbox-app-wait-timeout <ms>", "App readiness wait timeout in milliseconds").option("--e2b-template <name>", "Legacy alias for --sandbox-image").option("--timeout <ms>", "Workflow timeout").option("--json", "Output as JSON", false).action((name21, opts) => {
   try {
     const workflow = createTestingWorkflow({
       name: name21,
@@ -100994,6 +101124,7 @@ workflowCmd.command("create <name>").description("Save a reusable testing workfl
         sandboxSyncStrategy: opts.sandboxSync,
         setupCommand: opts.sandboxSetupCommand,
         packageSpec: opts.sandboxPackage,
+        env: parseSandboxEnv(opts.sandboxEnv, opts.sandboxEnvOptional),
         appSourceDir: opts.sandboxAppSource,
         appRemoteDir: opts.sandboxAppRemoteDir,
         appStartCommand: opts.sandboxAppStartCommand,
@@ -101012,6 +101143,36 @@ workflowCmd.command("create <name>").description("Save a reusable testing workfl
     process.exit(1);
   }
 });
+workflowCmd.command("update <id>").description("Update a saved testing workflow").option("--sandbox-env <assignment>", "Sandbox env var; KEY forwards host KEY, KEY=value stores value (repeatable)", (val, acc) => {
+  acc.push(val);
+  return acc;
+}, []).option("--sandbox-env-optional <name>", "Optional sandbox env var; forwards host NAME only when set (repeatable)", (val, acc) => {
+  acc.push(val);
+  return acc;
+}, []).option("--clear-sandbox-env", "Replace existing sandbox env vars instead of merging", false).option("--json", "Output as JSON", false).action((id, opts) => {
+  try {
+    const workflow = getTestingWorkflow(id);
+    if (!workflow) {
+      logError(chalk6.red(`Workflow not found: ${id}`));
+      process.exit(1);
+    }
+    const envPatch = parseSandboxEnv(opts.sandboxEnv, opts.sandboxEnvOptional);
+    const execution = {
+      ...workflow.execution,
+      env: opts.clearSandboxEnv ? envPatch : { ...workflow.execution.env ?? {}, ...envPatch ?? {} }
+    };
+    if (Object.keys(execution.env ?? {}).length === 0)
+      delete execution.env;
+    const updated = updateTestingWorkflow(workflow.id, { execution });
+    if (opts.json)
+      log(JSON.stringify(updated, null, 2));
+    else
+      log(chalk6.green(`Workflow updated: ${chalk6.bold(updated.id.slice(0, 8))} \u2014 ${updated.name}`));
+  } catch (error40) {
+    logError(chalk6.red(`Error: ${error40 instanceof Error ? error40.message : String(error40)}`));
+    process.exit(1);
+  }
+});
 workflowCmd.command("list").description("List saved testing workflows").option("--project <id>", "Project ID").option("--all", "Include disabled workflows", false).option("--json", "Output as JSON", false).action((opts) => {
   const workflows = listTestingWorkflows({
     projectId: opts.project ? resolveProject2(opts.project) : undefined,

package/dist/index.js

@@ -17223,6 +17223,8 @@ var APP_SOURCE_EXCLUDES = [
   ".next",
   ".turbo",
   ".cache",
+  ".env",
+  ".env.*",
   ".venv",
   "__pycache__"
 ];
@@ -17445,7 +17447,7 @@ async function runViaSandbox(plan, dependencies) {
         workflowId: plan.workflow.id,
         workflowName: plan.workflow.name
       },
-      sandboxEnvVars: plan.sandbox.env,
+      sandboxEnvVars: resolveSandboxEnv(plan.sandbox.env),
       cleanup: plan.sandbox.cleanup,
       upload: {
         localDir: bundle.localDir,
@@ -17471,6 +17473,26 @@ async function runViaSandbox(plan, dependencies) {
     bundle.cleanup?.();
   }
 }
+function resolveSandboxEnv(env2) {
+  if (!env2 || Object.keys(env2).length === 0)
+    return;
+  const resolved = {};
+  for (const [key, value] of Object.entries(env2)) {
+    if (value.startsWith("$?")) {
+      const optionalName = value.slice(2).trim();
+      const optionalValue = optionalName ? process.env[optionalName] : undefined;
+      if (optionalValue !== undefined)
+        resolved[key] = optionalValue;
+      continue;
+    }
+    const resolvedValue = resolveCredential(value);
+    if (resolvedValue === null) {
+      throw new Error(`Missing sandbox env value for ${key}`);
+    }
+    resolved[key] = resolvedValue;
+  }
+  return resolved;
+}
 async function resolveSandboxesRuntime(dependencies) {
   if (dependencies.sandboxes)
     return dependencies.sandboxes;

package/dist/lib/workflow-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-runner.d.ts","sourceRoot":"","sources":["../../src/lib/workflow-runner.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,KAAK,EACV,MAAM,EACN,GAAG,EACH,eAAe,EAEf,sBAAsB,EACtB,2BAA2B,EAC5B,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,sBAAsB,CAAC;IAChC,YAAY,EAAE,2BAA2B,CAAC;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,eAAe,CAAC;IAC1B,UAAU,EAAE,UAAU,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACxF,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,8BAA8B;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,UAAU,oBAAoB;IAC5B,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACxB,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACxB,MAAM,EAAE;QACN,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,wBAAwB;IACvC,mBAAmB,CAAC,KAAK,EAAE;QACzB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACxC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,MAAM,EAAE;YACN,QAAQ,EAAE,MAAM,CAAC;YACjB,SAAS,EAAE,MAAM,CAAC;YAClB,YAAY,CAAC,EAAE,2BAA2B,CAAC;SAC5C,CAAC;QACF,OAAO,CAAC,EAAE,sBAAsB,CAAC;QACjC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;QAClC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;KACnC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,0BAA0B;IACzC,WAAW,CAAC,EAAE,OAAO,WAAW,CAAC;IACjC,SAAS,CAAC,EAAE,wBAAwB,CAAC;IACrC,kBAAkB,CAAC,EAAE,MAAM,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACxF,oBAAoB,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,KAAK,sBAAsB,CAAC;CACrG;AAaD,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,kBAAkB,GAAG,eAAe,CAqB5G;AAED,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,kBAAkB,EAC3B,YAAY,GAAE,0BAA+B,GAC5C,OAAO,CAAC;IACT,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,eAAe,CAAC;IACtB,aAAa,CAAC,EAAE,8BAA8B,CAAC;CAChD,CAAC,CAiBD;AAED,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,eAAe,EACzB,IAAI,EAAE,eAAe,GACpB,sBAAsB,CAiBxB"}
+{"version":3,"file":"workflow-runner.d.ts","sourceRoot":"","sources":["../../src/lib/workflow-runner.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,KAAK,EACV,MAAM,EACN,GAAG,EACH,eAAe,EAEf,sBAAsB,EACtB,2BAA2B,EAC5B,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,sBAAsB,CAAC;IAChC,YAAY,EAAE,2BAA2B,CAAC;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,eAAe,CAAC;IAC1B,UAAU,EAAE,UAAU,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACxF,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,8BAA8B;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,UAAU,oBAAoB;IAC5B,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACxB,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACxB,MAAM,EAAE;QACN,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,wBAAwB;IACvC,mBAAmB,CAAC,KAAK,EAAE;QACzB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACxC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,MAAM,EAAE;YACN,QAAQ,EAAE,MAAM,CAAC;YACjB,SAAS,EAAE,MAAM,CAAC;YAClB,YAAY,CAAC,EAAE,2BAA2B,CAAC;SAC5C,CAAC;QACF,OAAO,CAAC,EAAE,sBAAsB,CAAC;QACjC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;QAClC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;KACnC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,0BAA0B;IACzC,WAAW,CAAC,EAAE,OAAO,WAAW,CAAC;IACjC,SAAS,CAAC,EAAE,wBAAwB,CAAC;IACrC,kBAAkB,CAAC,EAAE,MAAM,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACxF,oBAAoB,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,KAAK,sBAAsB,CAAC;CACrG;AAeD,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,kBAAkB,GAAG,eAAe,CAqB5G;AAED,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,kBAAkB,EAC3B,YAAY,GAAE,0BAA+B,GAC5C,OAAO,CAAC;IACT,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,eAAe,CAAC;IACtB,aAAa,CAAC,EAAE,8BAA8B,CAAC;CAChD,CAAC,CAiBD;AAED,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,eAAe,EACzB,IAAI,EAAE,eAAe,GACpB,sBAAsB,CAiBxB"}

package/dist/mcp/index.js

@@ -52,7 +52,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/testers",
-    version: "0.0.46",
+    version: "0.0.48",
     description: "AI-powered QA testing CLI \u2014 spawns cheap AI agents to test web apps with headless browsers",
     type: "module",
     main: "dist/index.js",
@@ -23723,7 +23723,7 @@ async function runViaSandbox(plan, dependencies) {
         workflowId: plan.workflow.id,
         workflowName: plan.workflow.name
       },
-      sandboxEnvVars: plan.sandbox.env,
+      sandboxEnvVars: resolveSandboxEnv(plan.sandbox.env),
       cleanup: plan.sandbox.cleanup,
       upload: {
         localDir: bundle.localDir,
@@ -23749,6 +23749,26 @@ async function runViaSandbox(plan, dependencies) {
     bundle.cleanup?.();
   }
 }
+function resolveSandboxEnv(env2) {
+  if (!env2 || Object.keys(env2).length === 0)
+    return;
+  const resolved = {};
+  for (const [key, value] of Object.entries(env2)) {
+    if (value.startsWith("$?")) {
+      const optionalName = value.slice(2).trim();
+      const optionalValue = optionalName ? process.env[optionalName] : undefined;
+      if (optionalValue !== undefined)
+        resolved[key] = optionalValue;
+      continue;
+    }
+    const resolvedValue = resolveCredential(value);
+    if (resolvedValue === null) {
+      throw new Error(`Missing sandbox env value for ${key}`);
+    }
+    resolved[key] = resolvedValue;
+  }
+  return resolved;
+}
 async function resolveSandboxesRuntime(dependencies) {
   if (dependencies.sandboxes)
     return dependencies.sandboxes;
@@ -23766,6 +23786,7 @@ var init_workflow_runner = __esm(() => {
   init_workflows();
   init_personas();
   init_runner();
+  init_secrets_resolver();
   APP_SOURCE_EXCLUDES = [
     "node_modules",
     ".git",
@@ -23773,6 +23794,8 @@ var init_workflow_runner = __esm(() => {
     ".next",
     ".turbo",
     ".cache",
+    ".env",
+    ".env.*",
     ".venv",
     "__pycache__"
   ];

package/dist/server/index.js

@@ -46937,7 +46937,7 @@ import { join as join14 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/testers",
-  version: "0.0.46",
+  version: "0.0.48",
   description: "AI-powered QA testing CLI \u2014 spawns cheap AI agents to test web apps with headless browsers",
   type: "module",
   main: "dist/index.js",
@@ -51339,6 +51339,8 @@ var APP_SOURCE_EXCLUDES = [
   ".next",
   ".turbo",
   ".cache",
+  ".env",
+  ".env.*",
   ".venv",
   "__pycache__"
 ];
@@ -51561,7 +51563,7 @@ async function runViaSandbox(plan, dependencies) {
         workflowId: plan.workflow.id,
         workflowName: plan.workflow.name
       },
-      sandboxEnvVars: plan.sandbox.env,
+      sandboxEnvVars: resolveSandboxEnv(plan.sandbox.env),
       cleanup: plan.sandbox.cleanup,
       upload: {
         localDir: bundle.localDir,
@@ -51587,6 +51589,26 @@ async function runViaSandbox(plan, dependencies) {
     bundle.cleanup?.();
   }
 }
+function resolveSandboxEnv(env) {
+  if (!env || Object.keys(env).length === 0)
+    return;
+  const resolved = {};
+  for (const [key, value] of Object.entries(env)) {
+    if (value.startsWith("$?")) {
+      const optionalName = value.slice(2).trim();
+      const optionalValue = optionalName ? process.env[optionalName] : undefined;
+      if (optionalValue !== undefined)
+        resolved[key] = optionalValue;
+      continue;
+    }
+    const resolvedValue = resolveCredential(value);
+    if (resolvedValue === null) {
+      throw new Error(`Missing sandbox env value for ${key}`);
+    }
+    resolved[key] = resolvedValue;
+  }
+  return resolved;
+}
 async function resolveSandboxesRuntime(dependencies) {
   if (dependencies.sandboxes)
     return dependencies.sandboxes;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/testers",
-  "version": "0.0.46",
+  "version": "0.0.48",
   "description": "AI-powered QA testing CLI — spawns cheap AI agents to test web apps with headless browsers",
   "type": "module",
   "main": "dist/index.js",