@hasna/testers 0.0.50 → 0.0.52

package/README.md

@@ -41,7 +41,7 @@ testers workflow fanout --project alumia --workers 6 --url https://preview.examp
 testers workflow fanout wf_abc,wf_def wf_xyz --workers 12 --url https://preview.example.com --json
 ```
 
-`--workers` is bounded to 1-12 concurrent sandboxes. Use `--dry-run` to inspect the remote commands and upload plans without spawning sandboxes.
+`--workers` is bounded to 1-12 concurrent sandboxes. Fanout preflights provider credentials, required sandbox environment references, `rsync`, and app source directories before launching workers. Use `--dry-run` to inspect the remote commands, upload plans, and preflight checks without spawning sandboxes.
 
 ### Common Flags
 

package/dist/cli/index.js

@@ -12394,6 +12394,18 @@ __export(exports_scenarios, {
   createScenario: () => createScenario,
   countScenarios: () => countScenarios
 });
+function stableJson(value) {
+  if (value === undefined)
+    return "";
+  if (value === null)
+    return "null";
+  if (Array.isArray(value))
+    return `[${value.map(stableJson).join(",")}]`;
+  if (typeof value === "object") {
+    return `{${Object.entries(value).filter(([, val]) => val !== undefined).sort(([a], [b]) => a.localeCompare(b)).map(([key, val]) => `${JSON.stringify(key)}:${stableJson(val)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
 function nextShortId(projectId) {
   const db2 = getDatabase();
   if (projectId) {
@@ -12653,9 +12665,12 @@ function upsertScenario(input) {
   }
   const existingSteps = JSON.parse(existing.steps);
   const existingTags = JSON.parse(existing.tags);
+  const existingMetadata = existing.metadata ? JSON.parse(existing.metadata) : undefined;
+  const existingAssertions = JSON.parse(existing.assertions || "[]");
+  const existingParameters = existing.parameters ? JSON.parse(existing.parameters) : undefined;
   const newSteps = input.steps ?? [];
   const newTags = input.tags ?? [];
-  const isIdentical = existing.description === (input.description ?? "") && existingSteps.length === newSteps.length && existingSteps.every((s, i) => s === newSteps[i]) && existingTags.length === newTags.length && existingTags.every((t, i) => t === newTags[i]) && existing.priority === (input.priority ?? "medium");
+  const isIdentical = existing.description === (input.description ?? "") && existingSteps.length === newSteps.length && existingSteps.every((s, i) => s === newSteps[i]) && existingTags.length === newTags.length && existingTags.every((t, i) => t === newTags[i]) && existing.priority === (input.priority ?? "medium") && existing.target_path === (input.targetPath ?? null) && Boolean(existing.requires_auth) === Boolean(input.requiresAuth) && stableJson(existingMetadata) === stableJson(input.metadata) && stableJson(existingAssertions) === stableJson(input.assertions ?? []) && stableJson(existingParameters) === stableJson(input.parameters);
   if (isIdentical) {
     return { scenario: scenarioFromRow(existing), action: "deduped" };
   }
@@ -12705,6 +12720,10 @@ function upsertScenario(input) {
     sets.push("assertions = ?");
     params.push(JSON.stringify(input.assertions));
   }
+  if (input.parameters !== undefined) {
+    sets.push("parameters = ?");
+    params.push(JSON.stringify(input.parameters));
+  }
   sets.push("version = ?", "updated_at = ?");
   params.push(existing.version + 1, now());
   params.push(existing.id);
@@ -13057,6 +13076,159 @@ var init_screenshots = __esm(() => {
   init_database();
 });
 
+// src/lib/route-fixtures.ts
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function envNameForParam(prefix, param) {
+  return `${prefix}_${param.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[^A-Za-z0-9]+/g, "_").toUpperCase()}`;
+}
+function readString(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+function resolveReference(value, env) {
+  if (value.startsWith("$?"))
+    return env[value.slice(2)]?.trim() || undefined;
+  if (value.startsWith("$"))
+    return env[value.slice(1)]?.trim() || undefined;
+  return value;
+}
+function scenarioFixtureValue(params, name, env) {
+  if (!params)
+    return;
+  const routeFixtures = isRecord2(params["routeFixtures"]) ? params["routeFixtures"] : {};
+  const raw = readString(routeFixtures[name]) ?? readString(params[name]);
+  return raw ? resolveReference(raw, env) : undefined;
+}
+function envFixtureValue(name, env) {
+  const candidates = [
+    envNameForParam("TESTERS_ROUTE", name),
+    envNameForParam("TESTERS_FIXTURE", name),
+    envNameForParam("ALUMIA_FIXTURE", name),
+    ...PARAM_ENV_CANDIDATES[name] ?? []
+  ];
+  for (const candidate of candidates) {
+    const value = env[candidate]?.trim();
+    if (value)
+      return value;
+  }
+  return;
+}
+function defaultFixtureValue(name) {
+  if (name === "orgSlug")
+    return "test-org";
+  if (name.toLowerCase().endsWith("slug")) {
+    return `test-${name.replace(/Slug$/i, "").replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase() || "slug"}`;
+  }
+  if (name === "id" || name.toLowerCase().endsWith("id"))
+    return DEFAULT_UUID;
+  if (name.toLowerCase().includes("token"))
+    return "test-token";
+  return `test-${name.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase()}`;
+}
+function routeParamsFromPath(path) {
+  if (!path)
+    return [];
+  const params = new Set;
+  for (const match of path.matchAll(/:([A-Za-z0-9_]+)(?:\*\??)?/g)) {
+    if (match[1])
+      params.add(match[1]);
+  }
+  return [...params];
+}
+function defaultRouteFixturesForParams(params) {
+  return Object.fromEntries(params.map((param) => [param, defaultFixtureValue(param)]));
+}
+function resolveRouteFixtures(scenario, env = process.env) {
+  const metadataParams = Array.isArray(scenario.metadata?.["fixtureParams"]) ? scenario.metadata["fixtureParams"].filter((value) => typeof value === "string") : [];
+  const params = [...new Set([...metadataParams, ...routeParamsFromPath(scenario.targetPath)])];
+  const values = {};
+  const sources = {};
+  const synthetic = [];
+  for (const param of params) {
+    const scenarioValue = scenarioFixtureValue(scenario.parameters, param, env);
+    if (scenarioValue) {
+      values[param] = scenarioValue;
+      sources[param] = "scenario";
+      continue;
+    }
+    const envValue = envFixtureValue(param, env);
+    if (envValue) {
+      values[param] = envValue;
+      sources[param] = "env";
+      continue;
+    }
+    values[param] = defaultFixtureValue(param);
+    sources[param] = "default";
+    synthetic.push(param);
+  }
+  const resolvedPath = scenario.targetPath ? resolveRoutePath(scenario.targetPath, values) : null;
+  return {
+    originalPath: scenario.targetPath,
+    resolvedPath,
+    params,
+    values,
+    sources,
+    synthetic
+  };
+}
+function resolveRoutePath(path, values) {
+  return path.replace(/\/:([A-Za-z0-9_]+)\*\?/g, (_match, name) => {
+    const value = values[name];
+    return value ? `/${encodeRouteFixture(value, true)}` : "";
+  }).replace(/:([A-Za-z0-9_]+)\*/g, (_match, name) => encodeRouteFixture(values[name] ?? defaultFixtureValue(name), true)).replace(/:([A-Za-z0-9_]+)/g, (_match, name) => encodeRouteFixture(values[name] ?? defaultFixtureValue(name), false));
+}
+function encodeRouteFixture(value, allowSlash) {
+  if (allowSlash)
+    return value.split("/").filter(Boolean).map(encodeURIComponent).join("/");
+  return encodeURIComponent(value);
+}
+function materializeScenarioRoute(scenario, env = process.env) {
+  const resolution = resolveRouteFixtures(scenario, env);
+  if (!resolution.resolvedPath || resolution.resolvedPath === scenario.targetPath) {
+    return { scenario, resolution };
+  }
+  const steps = scenario.steps.map((step) => {
+    let next = step;
+    for (const [name, value] of Object.entries(resolution.values)) {
+      next = next.replaceAll(`:${name}`, value).replaceAll(`[${name}]`, value).replaceAll(`{${name}}`, value);
+    }
+    return next.replaceAll(scenario.targetPath ?? "", resolution.resolvedPath ?? "");
+  });
+  return {
+    scenario: {
+      ...scenario,
+      targetPath: resolution.resolvedPath,
+      steps,
+      metadata: {
+        ...scenario.metadata ?? {},
+        routeFixtureResolution: resolution
+      }
+    },
+    resolution
+  };
+}
+function resolveStartUrl(baseUrl, targetPath) {
+  try {
+    return new URL(targetPath, baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`).toString();
+  } catch {
+    return `${baseUrl.replace(/\/+$/, "")}/${targetPath.replace(/^\/+/, "")}`;
+  }
+}
+var DEFAULT_UUID = "00000000-0000-4000-8000-000000000000", PARAM_ENV_CANDIDATES;
+var init_route_fixtures = __esm(() => {
+  PARAM_ENV_CANDIDATES = {
+    orgSlug: ["TESTERS_ORG_SLUG", "SMOKE_ORG_SLUG", "ORG_SLUG"],
+    orgId: ["TESTERS_ORG_ID", "SMOKE_ORG_ID", "ORG_ID"],
+    projectSlug: ["TESTERS_PROJECT_SLUG", "SMOKE_PROJECT_SLUG", "PROJECT_SLUG"],
+    projectId: ["TESTERS_PROJECT_ID", "SMOKE_PROJECT_ID", "PROJECT_ID"],
+    workspaceId: ["TESTERS_WORKSPACE_ID", "SMOKE_WORKSPACE_ID", "WORKSPACE_ID"],
+    agentId: ["TESTERS_AGENT_ID", "SMOKE_AGENT_ID", "AGENT_ID"],
+    sessionId: ["TESTERS_SESSION_ID", "SMOKE_SESSION_ID", "SESSION_ID"],
+    userId: ["TESTERS_USER_ID", "SMOKE_USER_ID", "USER_ID"]
+  };
+});
+
 // src/lib/browser-lightpanda.ts
 var exports_browser_lightpanda = {};
 __export(exports_browser_lightpanda, {
@@ -14777,33 +14949,35 @@ ${filtered.join(`
     return { result: `Error executing ${toolName}: ${message}` };
   }
 }
-function resolveStartUrl(baseUrl, targetPath) {
-  try {
-    return new URL(targetPath, baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`).toString();
-  } catch {
-    return `${baseUrl.replace(/\/+$/, "")}/${targetPath.replace(/^\/+/, "")}`;
-  }
-}
 function buildScenarioUserMessage(scenario, baseUrl) {
+  const { scenario: materializedScenario, resolution } = materializeScenarioRoute(scenario);
   const userParts = [
-    `**Scenario:** ${scenario.name}`,
-    `**Description:** ${scenario.description}`
+    `**Scenario:** ${materializedScenario.name}`,
+    `**Description:** ${materializedScenario.description}`
   ];
   if (baseUrl) {
     const normalizedBaseUrl = baseUrl.replace(/\/+$/, "");
     userParts.push(`**Base URL:** ${normalizedBaseUrl}`);
-    if (scenario.targetPath) {
-      userParts.push(`**Start URL:** ${resolveStartUrl(normalizedBaseUrl, scenario.targetPath)}`);
+    if (materializedScenario.targetPath) {
+      userParts.push(`**Start URL:** ${resolveStartUrl(normalizedBaseUrl, materializedScenario.targetPath)}`);
     }
     userParts.push("**Navigation Boundary:** Treat the Base URL as the application under test. Resolve relative paths and in-app navigation against this origin. Do not navigate to another host unless a step explicitly includes an absolute external URL.");
   }
-  if (scenario.targetPath) {
-    userParts.push(`**Target Path:** ${scenario.targetPath}`);
+  if (materializedScenario.targetPath) {
+    userParts.push(`**Target Path:** ${materializedScenario.targetPath}`);
   }
-  if (scenario.steps.length > 0) {
+  if (resolution.params.length > 0) {
+    userParts.push("**Route Fixtures:**");
+    for (const param of resolution.params) {
+      const source = resolution.sources[param];
+      const synthetic = source === "default" ? " synthetic" : "";
+      userParts.push(`- :${param} = ${resolution.values[param]} (${source}${synthetic})`);
+    }
+  }
+  if (materializedScenario.steps.length > 0) {
     userParts.push("**Steps:**");
-    for (let i = 0;i < scenario.steps.length; i++) {
-      userParts.push(`${i + 1}. ${scenario.steps[i]}`);
+    for (let i = 0;i < materializedScenario.steps.length; i++) {
+      userParts.push(`${i + 1}. ${materializedScenario.steps[i]}`);
     }
   }
   return userParts.join(`
@@ -15101,6 +15275,7 @@ function createClientForModel(model, apiKey) {
 var activeHARs, activeCoverage, BROWSER_TOOLS;
 var init_ai_client = __esm(() => {
   init_types();
+  init_route_fixtures();
   activeHARs = new Map;
   activeCoverage = new Map;
   BROWSER_TOOLS = [
@@ -18321,9 +18496,10 @@ function withTimeout(promise, ms, label) {
   });
 }
 async function runSingleScenario(scenario, runId, options) {
-  const scenarioType = scenario.scenarioType ?? "browser";
+  const { scenario: materializedScenario, resolution: routeFixtureResolution } = materializeScenarioRoute(scenario);
+  const scenarioType = materializedScenario.scenarioType ?? "browser";
   if (scenarioType === "eval") {
-    return runEvalScenario(scenario, { runId, baseUrl: options.url });
+    return runEvalScenario(materializedScenario, { runId, baseUrl: options.url });
   }
   const config = loadConfig();
   if (options.selfHeal !== undefined)
@@ -18364,7 +18540,7 @@ async function runSingleScenario(scenario, runId, options) {
     runId,
     scenarioId: scenario.id,
     model,
-    stepsTotal: scenario.steps.length || 10,
+    stepsTotal: materializedScenario.steps.length || 10,
     personaId: persona?.id ?? null,
     personaName: persona?.name ?? null
   });
@@ -18400,12 +18576,12 @@ async function runSingleScenario(scenario, runId, options) {
         engine: effectiveOptions.engine
       });
     }
-    const targetUrl = scenario.targetPath ? `${options.url.replace(/\/$/, "")}${scenario.targetPath}` : options.url;
-    const scenarioTimeout = scenario.timeoutMs ?? options.timeout ?? config.browser.timeout ?? 60000;
+    const targetUrl = materializedScenario.targetPath ? resolveStartUrl(options.url.replace(/\/$/, ""), materializedScenario.targetPath) : options.url;
+    const scenarioTimeout = materializedScenario.timeoutMs ?? options.timeout ?? config.browser.timeout ?? 60000;
     registerSession({
       resultId: result.id,
       runId,
-      scenarioId: scenario.id,
+      scenarioId: materializedScenario.id,
       engine: effectiveOptions.engine ?? "playwright",
       startUrl: targetUrl
     });
@@ -18459,7 +18635,7 @@ async function runSingleScenario(scenario, runId, options) {
     const agentResult = await withTimeout(runAgentLoop({
       client,
       page,
-      scenario,
+      scenario: materializedScenario,
       screenshotter,
       model,
       runId,
@@ -18550,7 +18726,7 @@ async function runSingleScenario(scenario, runId, options) {
     const baseReasoning = agentResult.reasoning ? agentResult.reasoning + lightpandaNote : lightpandaNote || "";
     const assertionOutcome = await applyStructuredAssertionsToResult({
       page,
-      scenario,
+      scenario: materializedScenario,
       consoleErrors,
       status: agentResult.status,
       reasoning: baseReasoning
@@ -18571,6 +18747,7 @@ async function runSingleScenario(scenario, runId, options) {
       costCents: estimateCost(model, agentResult.tokensUsed),
       metadata: {
         consoleLogs,
+        ...routeFixtureResolution.params.length > 0 ? { routeFixtureResolution } : {},
         ...networkErrors.length > 0 ? networkMeta : {},
         ...structuredAssertionMeta
       }
@@ -18920,6 +19097,7 @@ var init_runner = __esm(() => {
   init_browser();
   init_screenshotter();
   init_ai_client();
+  init_route_fixtures();
   init_config2();
   init_persona_auth();
   init_session_tracker();
@@ -59225,6 +59403,10 @@ function scenarioInputForNextRoute(item, projectId) {
       actionCount: item.actions.length,
       groups: item.groups
     },
+    parameters: item.fixtureParams.length > 0 ? {
+      routeFixtures: defaultRouteFixturesForParams(item.fixtureParams),
+      routeFixtureParams: item.fixtureParams
+    } : undefined,
     projectId
   };
 }
@@ -59627,6 +59809,7 @@ var ROUTE_FILE_NAMES, WALK_EXCLUDES, SAFE_PAGE_ASSERTIONS, IMPORT_SCAN_LIMIT = 4
 var init_next_route_inventory = __esm(() => {
   init_scenarios();
   init_workflows();
+  init_route_fixtures();
   ROUTE_FILE_NAMES = new Set([
     "page.tsx",
     "page.ts",
@@ -60280,8 +60463,11 @@ var exports_workflow_fanout = {};
 __export(exports_workflow_fanout, {
   runWorkflowFanout: () => runWorkflowFanout,
   resolveWorkflowFanoutSelection: () => resolveWorkflowFanoutSelection,
-  normalizeFanoutWorkerCount: () => normalizeFanoutWorkerCount
+  normalizeFanoutWorkerCount: () => normalizeFanoutWorkerCount,
+  checkWorkflowFanoutReadiness: () => checkWorkflowFanoutReadiness
 });
+import { spawnSync as spawnSync2 } from "child_process";
+import { existsSync as existsSync19, statSync as statSync5 } from "fs";
 function splitWorkflowIds(ids) {
   return (ids ?? []).flatMap((item) => item.split(",")).map((item) => item.trim()).filter(Boolean);
 }
@@ -60314,6 +60500,89 @@ function resolveWorkflowFanoutSelection(options) {
   }
   return filtered;
 }
+async function checkWorkflowFanoutReadiness(workflows, dependencies = {}) {
+  const checks = [];
+  const env = dependencies.env ?? process.env;
+  for (const [provider, providerWorkflows] of groupWorkflowsByProvider(workflows)) {
+    const envKey = PROVIDER_ENV_KEYS[provider];
+    if (!envKey) {
+      checks.push({
+        name: `provider:${provider}`,
+        ok: true,
+        required: false,
+        message: `No built-in credential preflight for sandbox provider "${provider}"`,
+        workflows: providerWorkflows.map((workflow) => workflow.name)
+      });
+      continue;
+    }
+    const apiKey = await resolveProviderApiKey(provider, env, dependencies.providerApiKeyResolver);
+    checks.push({
+      name: `provider:${provider}`,
+      ok: Boolean(apiKey),
+      required: true,
+      message: apiKey ? `Sandbox provider "${provider}" credential is available` : `Missing sandbox provider credential for "${provider}". Set ${envKey} or configure providers.${provider}.api_key with sandboxes config`,
+      workflows: providerWorkflows.map((workflow) => workflow.name),
+      details: { provider, envKey }
+    });
+  }
+  const needsRsync = workflows.filter((workflow) => (workflow.execution.sandboxSyncStrategy ?? "rsync") === "rsync" || Boolean(workflow.execution.appSourceDir));
+  if (needsRsync.length > 0) {
+    const commandExists = dependencies.commandExists ?? defaultCommandExists;
+    const rsyncOk = commandExists("rsync");
+    checks.push({
+      name: "tool:rsync",
+      ok: rsyncOk,
+      required: true,
+      message: rsyncOk ? "rsync is available for sandbox uploads and app source bundling" : "Missing rsync. Install rsync or use --sandbox-sync archive for workflows without app source bundling",
+      workflows: needsRsync.map((workflow) => workflow.name)
+    });
+  }
+  const missingAppSources = workflows.filter((workflow) => workflow.execution.appSourceDir).filter((workflow) => {
+    const sourceDir = workflow.execution.appSourceDir;
+    return !existsSync19(sourceDir) || !statSync5(sourceDir).isDirectory();
+  });
+  if (missingAppSources.length > 0) {
+    checks.push({
+      name: "app-source",
+      ok: false,
+      required: true,
+      message: "One or more workflow app source directories are missing or are not directories",
+      workflows: missingAppSources.map((workflow) => workflow.name),
+      details: {
+        sources: missingAppSources.map((workflow) => ({
+          workflowId: workflow.id,
+          workflowName: workflow.name,
+          appSourceDir: workflow.execution.appSourceDir
+        }))
+      }
+    });
+  }
+  const { requiredMissing, optionalMissing } = collectMissingSandboxEnvRefs(workflows, env, dependencies.credentialResolver);
+  if (requiredMissing.length > 0) {
+    checks.push({
+      name: "env:required",
+      ok: false,
+      required: true,
+      message: "One or more required sandbox environment references could not be resolved",
+      workflows: [...new Set(requiredMissing.map((item) => item.workflowName))],
+      details: { missing: requiredMissing }
+    });
+  }
+  if (optionalMissing.length > 0) {
+    checks.push({
+      name: "env:optional",
+      ok: false,
+      required: false,
+      message: "One or more optional sandbox environment references are not set and will be omitted",
+      workflows: [...new Set(optionalMissing.map((item) => item.workflowName))],
+      details: { missing: optionalMissing }
+    });
+  }
+  return {
+    ok: checks.every((check) => check.ok || !check.required),
+    checks
+  };
+}
 async function mapWithConcurrency(items, limit, worker) {
   const output = new Array(items.length);
   let next = 0;
@@ -60329,7 +60598,38 @@ async function mapWithConcurrency(items, limit, worker) {
 async function runWorkflowFanout(options, dependencies = {}) {
   const workers = normalizeFanoutWorkerCount(options.workers);
   const workflows = resolveWorkflowFanoutSelection(options);
-  const { runTestingWorkflow: runOne = runTestingWorkflow, ...workflowDependencies } = dependencies;
+  const {
+    runTestingWorkflow: runOne = runTestingWorkflow,
+    preflight: preflightOverride,
+    providerApiKeyResolver,
+    commandExists,
+    credentialResolver,
+    env,
+    ...workflowDependencies
+  } = dependencies;
+  const preflight = preflightOverride ? await preflightOverride(workflows) : await checkWorkflowFanoutReadiness(workflows, {
+    providerApiKeyResolver,
+    commandExists,
+    credentialResolver,
+    env
+  });
+  if (!options.dryRun && !preflight.ok) {
+    const error = `Preflight failed: ${summarizePreflightFailures(preflight)}`;
+    return {
+      status: "failed",
+      workers,
+      total: workflows.length,
+      passed: 0,
+      failed: workflows.length,
+      preflight,
+      items: workflows.map((workflow) => ({
+        workflowId: workflow.id,
+        workflowName: workflow.name,
+        status: "failed",
+        error
+      }))
+    };
+  }
   const items = await mapWithConcurrency(workflows, workers, async (workflow) => {
     try {
       const output = await runOne(workflow.id, {
@@ -60376,12 +60676,81 @@ async function runWorkflowFanout(options, dependencies = {}) {
     total: items.length,
     passed,
     failed,
-    items
+    items,
+    preflight
   };
 }
+function groupWorkflowsByProvider(workflows) {
+  const byProvider = new Map;
+  for (const workflow of workflows) {
+    const provider = workflow.execution.provider ?? "e2b";
+    byProvider.set(provider, [...byProvider.get(provider) ?? [], workflow]);
+  }
+  return byProvider;
+}
+async function resolveProviderApiKey(provider, env, resolver) {
+  if (resolver)
+    return resolver(provider, env);
+  const envKey = PROVIDER_ENV_KEYS[provider];
+  if (envKey && env[envKey])
+    return env[envKey];
+  try {
+    const mod = await import("@hasna/sandboxes");
+    if (provider === "e2b" || provider === "daytona" || provider === "modal") {
+      return mod.getProviderApiKey?.(provider);
+    }
+  } catch {}
+  return;
+}
+function defaultCommandExists(command) {
+  const result = spawnSync2(command, ["--version"], { encoding: "utf8" });
+  return !result.error && result.status === 0;
+}
+function collectMissingSandboxEnvRefs(workflows, env, credentialResolver) {
+  const requiredMissing = [];
+  const optionalMissing = [];
+  for (const workflow of workflows) {
+    for (const [key, value] of Object.entries(workflow.execution.env ?? {})) {
+      if (value.startsWith("$?")) {
+        const name = value.slice(2).trim();
+        if (name && env[name] === undefined) {
+          optionalMissing.push({ workflowId: workflow.id, workflowName: workflow.name, key, reference: value });
+        }
+        continue;
+      }
+      if (!isResolvableEnvReference(value))
+        continue;
+      if (resolveSandboxEnvReference(value, env, credentialResolver) === null) {
+        requiredMissing.push({ workflowId: workflow.id, workflowName: workflow.name, key, reference: value });
+      }
+    }
+  }
+  return { requiredMissing, optionalMissing };
+}
+function isResolvableEnvReference(value) {
+  return value.startsWith("$") || value.startsWith("@secrets:");
+}
+function resolveSandboxEnvReference(value, env, credentialResolver) {
+  if (value.startsWith("$")) {
+    const varName = value.slice(1).trim();
+    return varName ? env[varName] ?? null : null;
+  }
+  return (credentialResolver ?? resolveCredential)(value);
+}
+function summarizePreflightFailures(preflight) {
+  const requiredFailures = preflight.checks.filter((check) => !check.ok && check.required);
+  return requiredFailures.length > 0 ? requiredFailures.map((check) => check.message).join("; ") : "required checks did not pass";
+}
+var PROVIDER_ENV_KEYS;
 var init_workflow_fanout = __esm(() => {
   init_workflows();
   init_workflow_runner();
+  init_secrets_resolver();
+  PROVIDER_ENV_KEYS = {
+    e2b: "E2B_API_KEY",
+    daytona: "DAYTONA_API_KEY",
+    modal: "MODAL_TOKEN_ID"
+  };
 });
 
 // node_modules/@ai-sdk/provider/dist/index.mjs
@@ -95041,7 +95410,7 @@ import chalk6 from "chalk";
 // package.json
 var package_default = {
   name: "@hasna/testers",
-  version: "0.0.50",
+  version: "0.0.52",
   description: "AI-powered QA testing CLI \u2014 spawns cheap AI agents to test web apps with headless browsers",
   type: "module",
   main: "dist/index.js",
@@ -97228,7 +97597,7 @@ init_ci();
 init_assertions();
 init_paths();
 init_sessions();
-import { existsSync as existsSync19, mkdirSync as mkdirSync15 } from "fs";
+import { existsSync as existsSync20, mkdirSync as mkdirSync15 } from "fs";
 
 // src/lib/repo-discovery.ts
 init_paths();
@@ -98257,7 +98626,7 @@ var CONFIG_DIR5 = getTestersDir();
 var CONFIG_PATH4 = join21(CONFIG_DIR5, "config.json");
 function getActiveProject() {
   try {
-    if (existsSync19(CONFIG_PATH4)) {
+    if (existsSync20(CONFIG_PATH4)) {
       const raw = JSON.parse(readFileSync11(CONFIG_PATH4, "utf-8"));
       return raw.activeProject ?? undefined;
     }
@@ -99188,7 +99557,7 @@ program2.command("export [format]").description("Export scenarios as JSON (defau
       return;
     }
     const outputDir = opts.output ?? ".";
-    if (!existsSync19(outputDir)) {
+    if (!existsSync20(outputDir)) {
       mkdirSync15(outputDir, { recursive: true });
     }
     for (const s2 of scenarios) {
@@ -99391,11 +99760,11 @@ projectCmd.command("export-open <id>").description("Register a testers project i
 projectCmd.command("use <name>").description("Set active project (find or create)").option("--json", "Output as JSON", false).action((name21, opts) => {
   try {
     const project = ensureProject(name21, process.cwd());
-    if (!existsSync19(CONFIG_DIR5)) {
+    if (!existsSync20(CONFIG_DIR5)) {
       mkdirSync15(CONFIG_DIR5, { recursive: true });
     }
     let config2 = {};
-    if (existsSync19(CONFIG_PATH4)) {
+    if (existsSync20(CONFIG_PATH4)) {
       try {
         config2 = JSON.parse(readFileSync11(CONFIG_PATH4, "utf-8"));
       } catch {}
@@ -100010,7 +100379,7 @@ program2.command("ci [provider]").description("Print or write a CI workflow (def
   if (opts.output) {
     const outPath = resolve5(opts.output);
     const outDir = outPath.replace(/\/[^/]*$/, "");
-    if (outDir && !existsSync19(outDir)) {
+    if (outDir && !existsSync20(outDir)) {
       mkdirSync15(outDir, { recursive: true });
     }
     writeFileSync7(outPath, workflow, "utf-8");
@@ -100045,7 +100414,7 @@ program2.command("init").description("Initialize a new testing project").option(
     }
     if (opts.ci === "github") {
       const workflowDir = join21(process.cwd(), ".github", "workflows");
-      if (!existsSync19(workflowDir)) {
+      if (!existsSync20(workflowDir)) {
         mkdirSync15(workflowDir, { recursive: true });
       }
       const workflowPath = join21(workflowDir, "testers.yml");
@@ -101821,6 +102190,19 @@ workflowCmd.command("fanout [ids...]").description("Run multiple saved sandbox w
     if (opts.json || opts.dryRun) {
       log(JSON.stringify(result, null, 2));
     } else {
+      const preflightChecks = result.preflight?.checks ?? [];
+      const failedRequiredChecks = preflightChecks.filter((check2) => !check2.ok && check2.required);
+      const warnings = preflightChecks.filter((check2) => !check2.ok && !check2.required);
+      if (failedRequiredChecks.length > 0 || warnings.length > 0) {
+        const label = failedRequiredChecks.length > 0 ? chalk6.red("failed") : chalk6.yellow("warnings");
+        log(chalk6.bold(`Preflight ${label}:`));
+        for (const check2 of failedRequiredChecks) {
+          log(`  ${chalk6.red("failed")}  ${check2.message}`);
+        }
+        for (const check2 of warnings) {
+          log(`  ${chalk6.yellow("warning")} ${check2.message}`);
+        }
+      }
       const status = result.status === "passed" ? chalk6.green("passed") : chalk6.red("failed");
       log(chalk6.bold(`Sandbox workflow fanout ${status}: ${result.passed}/${result.total} passed with ${result.workers} worker(s)`));
       for (const item of result.items) {

package/dist/db/scenarios.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scenarios.d.ts","sourceRoot":"","sources":["../../src/db/scenarios.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,QAAQ,EAEb,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EAGpB,MAAM,mBAAmB,CAAC;AA6B3B,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,QAAQ,CA+BnE;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAmBvD;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAIrE;AAED,wBAAgB,aAAa,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,QAAQ,EAAE,CAoFjE;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,GAAG,QAAQ,CAwFhG;AAED,wBAAgB,cAAc,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,MAAM,CA8B9D;AAED,MAAM,WAAW,aAAc,SAAQ,QAAQ;IAC7C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,EAAE,CAmBhE;AAED,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAIvE;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAOlD;AAED,MAAM,MAAM,oBAAoB,GAAG;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAA;CAAE,CAAC;AAErG;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,oBAAoB,CAuDlG"}
+{"version":3,"file":"scenarios.d.ts","sourceRoot":"","sources":["../../src/db/scenarios.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,QAAQ,EAEb,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EAGpB,MAAM,mBAAmB,CAAC;AA2C3B,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,QAAQ,CA+BnE;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAmBvD;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAIrE;AAED,wBAAgB,aAAa,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,QAAQ,EAAE,CAoFjE;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,GAAG,QAAQ,CAwFhG;AAED,wBAAgB,cAAc,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,MAAM,CA8B9D;AAED,MAAM,WAAW,aAAc,SAAQ,QAAQ;IAC7C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,EAAE,CAmBhE;AAED,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAIvE;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAOlD;AAED,MAAM,MAAM,oBAAoB,GAAG;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAA;CAAE,CAAC;AAErG;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,oBAAoB,CAgElG"}