@sdods/cli 0.3.2 → 0.5.2

package/dist/commands/project.js

@@ -1,13 +1,17 @@
-import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { stringify as toYaml } from 'yaml';
+import { spawnSync } from 'node:child_process';
+import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, relative, resolve } from 'node:path';
+import { parseDocument, stringify as toYaml } from 'yaml';
 import { BrowserSchema, LayerSchema, ProjectConfigSchema, SlugSchema } from '@sdods/contracts';
-import { SdodsError, PROJECT_FILE } from '@sdods/core';
+import { ProjectRegistry, SdodsError, PROJECT_FILE } from '@sdods/core';
 import { createContext } from '../context.js';
-import { collect, json, ok, table } from '../ui.js';
+import { collect, json, ok, out, table } from '../ui.js';
 import { projectTemplateFiles } from '../templates/project.js';
 export function registerProjectCommands(program) {
-    const project = program.command('project').description('Create and list SDODS projects');
+    const project = program
+        .command('project')
+        .description('Create, import, list and delete SDODS projects');
     project
         .command('list')
         .description('List projects discovered under projects/')
@@ -51,6 +55,7 @@ export function registerProjectCommands(program) {
         .command('create <slug>')
         .description('Scaffold a project: yaml, envs, fixtures, an auth stub, a page object, health features and data')
         .option('--name <name>', 'display name')
+        .option('--description <text>', 'one-line description')
         .option('--layers <list>', 'comma list of ui,api,hybrid,recorded', collect, [])
         .option('--browsers <list>', 'comma list of browsers', collect, [])
         .option('--ui-url <url>', 'UI base URL for the first environment', 'http://localhost:3000')
@@ -73,6 +78,7 @@ export function registerProjectCommands(program) {
         const config = ProjectConfigSchema.parse({
             slug,
             name: opts.name ?? slug.replace(/-/g, ' ').replace(/\b\w/g, (c) => c.toUpperCase()),
+            ...(opts.description ? { description: opts.description } : {}),
             layers,
             browsers,
             testIdAttribute: opts.testId,
@@ -104,12 +110,126 @@ export function registerProjectCommands(program) {
             console.log(`  ${f}`);
         console.log(`\nNext: sdods run -p ${slug} -e ${opts.env} -l api`);
     });
+    project
+        .command('delete <slug>')
+        .description('Move a project out of projects/ into .sdods/trash so it can be restored by hand')
+        .option('--yes', 'confirm the delete (required: there is no interactive prompt)')
+        .option('--purge', 'delete the directory outright instead of trashing it')
+        .action((slug, opts, cmd) => {
+        const ctx = createContext(cmd);
+        const entry = requireProject(ctx, slug);
+        if (!opts.yes) {
+            throw new SdodsError('CONFIG_INVALID', `Refusing to ${opts.purge ? 'purge' : 'delete'} "${slug}" without confirmation.`, {
+                hint: `Re-run with --yes. The project directory is ${entry.root}.`,
+                exitCode: 2,
+            });
+        }
+        if (opts.purge) {
+            rmSync(entry.root, { recursive: true, force: true });
+            if (ctx.opts.json)
+                return json({ slug, from: entry.root, to: null, purged: true });
+            ok(`Purged project ${slug} (${entry.root})`);
+            return;
+        }
+        const to = join(trashDir(ctx.rootDir), `${slug}-${timestamp()}`);
+        mkdirSync(join(to, '..'), { recursive: true });
+        move(entry.root, to);
+        if (ctx.opts.json)
+            return json({ slug, from: entry.root, to, purged: false });
+        ok(`Deleted project ${slug}`);
+        out(`  moved to ${to}`);
+        out(`  restore with: mv ${JSON.stringify(to)} ${JSON.stringify(entry.root)}`);
+    });
+    project
+        .command('import <source>')
+        .description('Register an existing SDODS project from a directory, a .zip archive or a git repository')
+        .option('--slug <slug>', 'import under a different slug (use on a collision)')
+        .option('--workspace <slug>', 'workspace to re-home the project into')
+        .option('--force', 'overwrite an existing project with the same slug')
+        .option('--dry-run', 'validate and report what would be imported, without writing')
+        .action(async (source, opts, cmd) => {
+        const ctx = createContext(cmd);
+        const staged = await stageSource(source);
+        try {
+            const srcDir = findProjectDir(staged.dir, source);
+            const config = readProjectConfig(srcDir);
+            const slug = opts.slug ? SlugSchema.parse(opts.slug) : config.slug;
+            const workspace = opts.workspace
+                ? SlugSchema.parse(opts.workspace)
+                : ctx.registry.workspaceFile.defaultWorkspace;
+            assertWorkspaceDeclared(ctx, workspace);
+            const target = join(ctx.registry.projectsDir, slug);
+            const collides = existsSync(join(target, PROJECT_FILE));
+            if (collides && !opts.force) {
+                throw new SdodsError('CONFIG_INVALID', `Project "${slug}" already exists at ${target}.`, {
+                    hint: 'Pass --slug <other> to import alongside it, or --force to overwrite.',
+                    exitCode: 2,
+                });
+            }
+            const report = {
+                slug,
+                name: config.name,
+                description: config.description ?? null,
+                layers: config.layers,
+                browsers: config.browsers,
+                envs: config.envs.available,
+                workspace,
+                organization: ctx.registry.workspaceFile.organization.slug,
+                source: staged.kind,
+                files: countFiles(srcDir),
+                root: target,
+                collides,
+            };
+            if (opts.dryRun) {
+                if (ctx.opts.json)
+                    return json({ ...report, dryRun: true });
+                ok(`Would import ${slug} (${report.files} files) into ${target}`);
+                out(`  layers ${report.layers.join(',')} · envs ${report.envs.join(',')}`);
+                return;
+            }
+            // Roll back wholesale on failure: a half-copied project with a bad workspace makes
+            // `discover` throw for *every* project, not just this one.
+            const backup = collides ? join(trashDir(ctx.rootDir), `${slug}-${timestamp()}`) : null;
+            if (backup) {
+                mkdirSync(join(backup, '..'), { recursive: true });
+                move(target, backup);
+            }
+            try {
+                cpSync(srcDir, target, { recursive: true, filter: importFilter(srcDir) });
+                rehome(join(target, PROJECT_FILE), {
+                    slug,
+                    workspace,
+                    organization: ctx.registry.workspaceFile.organization.slug,
+                });
+                // Prove the whole registry still loads before we claim success.
+                ProjectRegistry.discover(ctx.rootDir);
+            }
+            catch (e) {
+                rmSync(target, { recursive: true, force: true });
+                if (backup)
+                    move(backup, target);
+                throw e;
+            }
+            if (ctx.opts.json)
+                return json(report);
+            ok(`Imported project ${slug} into ${target}`);
+            out(`  ${report.files} files · layers ${report.layers.join(',')}`);
+            out(`  re-homed to organization ${report.organization} / workspace ${workspace}`);
+            if (backup)
+                out(`  the project it replaced was moved to ${backup}`);
+            out(`\nNext: sdods lint -p ${slug}`);
+        }
+        finally {
+            staged.cleanup();
+        }
+    });
 }
 /** Keep the generated yaml readable: drop defaults the schema fills in. */
 function minimalYaml(config) {
     return {
         slug: config.slug,
         name: config.name,
+        ...(config.description ? { description: config.description } : {}),
         layers: config.layers,
         browsers: config.browsers,
         testIdAttribute: config.testIdAttribute,
@@ -130,4 +250,200 @@ function minimalYaml(config) {
         retries: { ci: 2, local: 0 },
     };
 }
+function requireProject(ctx, slug) {
+    if (!ctx.registry.has(slug)) {
+        const known = ctx.registry.entriesList().map((e) => e.slug);
+        throw new SdodsError('PROJECT_NOT_FOUND', `No project "${slug}" under ${ctx.registry.projectsDir}.`, {
+            hint: known.length
+                ? `Known projects: ${known.join(', ')}.`
+                : 'This workspace has no projects.',
+        });
+    }
+    return ctx.registry.entry(slug);
+}
+/**
+ * Trash lives outside `projectsDir` on purpose: `ProjectRegistry.discover` walks every directory
+ * there looking for a project file, so a trash folder nested inside it would keep resurfacing.
+ * `.sdods/` is already gitignored and already holds run artifacts.
+ */
+function trashDir(rootDir) {
+    return join(rootDir, '.sdods', 'trash');
+}
+function timestamp() {
+    return new Date()
+        .toISOString()
+        .replace(/[-:]/g, '')
+        .replace(/\.\d+Z$/, 'Z');
+}
+/** rename, falling back to copy+remove when the two paths live on different filesystems. */
+function move(from, to) {
+    try {
+        renameSync(from, to);
+    }
+    catch (e) {
+        if (e.code !== 'EXDEV')
+            throw e;
+        cpSync(from, to, { recursive: true });
+        rmSync(from, { recursive: true, force: true });
+    }
+}
+const EXCLUDED = /(^|\/)(\.auth|node_modules|\.features-gen|\.git)(\/|$)/;
+/** `.env.example` is the scaffold's own template, not a secret; every generated project has one. */
+const SECRET_ENV = /(^|\/)\.env(\.(?!example)[^/]*)?$/;
+function importFilter(srcDir) {
+    return (p) => {
+        const rel = relative(srcDir, p).replace(/\\/g, '/');
+        if (!rel)
+            return true;
+        return !EXCLUDED.test(rel) && !SECRET_ENV.test(rel);
+    };
+}
+function countFiles(dir) {
+    const keep = importFilter(dir);
+    let n = 0;
+    const walk = (d) => {
+        for (const name of readdirSync(d)) {
+            const abs = join(d, name);
+            if (!keep(abs))
+                continue;
+            if (statSync(abs).isDirectory())
+                walk(abs);
+            else
+                n++;
+        }
+    };
+    walk(dir);
+    return n;
+}
+function sourceKind(source) {
+    if (/^(https?|git|ssh):\/\//.test(source) || /^git@/.test(source) || source.endsWith('.git'))
+        return 'git';
+    if (/\.zip$/i.test(source))
+        return 'zip';
+    return 'directory';
+}
+/** Materialise the source into a directory we can read, cloning or extracting when needed. */
+async function stageSource(source) {
+    const kind = sourceKind(source);
+    if (kind === 'directory') {
+        const dir = resolve(source);
+        if (!existsSync(dir) || !statSync(dir).isDirectory())
+            throw new SdodsError('CONFIG_NOT_FOUND', `No such directory: ${dir}.`, {
+                hint: 'Pass a project directory, a .zip archive or a git URL.',
+            });
+        return { kind, dir, cleanup: () => { } };
+    }
+    const temp = mkdtempSync(join(tmpdir(), 'sdods-import-'));
+    const cleanup = () => rmSync(temp, { recursive: true, force: true });
+    try {
+        if (kind === 'git') {
+            run('git', ['clone', '--depth', '1', source, temp], {
+                missing: 'git is not on PATH, so a git URL cannot be cloned.',
+                hint: 'Clone it yourself and import the directory instead.',
+            });
+        }
+        else {
+            const zip = resolve(source);
+            if (!existsSync(zip))
+                throw new SdodsError('CONFIG_NOT_FOUND', `No such archive: ${zip}.`, {});
+            extractZip(zip, temp);
+        }
+        return { kind, dir: temp, cleanup };
+    }
+    catch (e) {
+        cleanup();
+        throw e;
+    }
+}
+/**
+ * No zip dependency: bsdtar (macOS, Windows 10+) reads zip archives directly, and `unzip` covers
+ * the Linux distros where tar is GNU tar and cannot.
+ */
+function extractZip(zip, into) {
+    const viaTar = spawnSync('tar', ['-xf', zip, '-C', into], { stdio: 'ignore' });
+    if (viaTar.status === 0)
+        return;
+    const viaUnzip = spawnSync('unzip', ['-q', zip, '-d', into], { stdio: 'ignore' });
+    if (viaUnzip.status === 0)
+        return;
+    throw new SdodsError('NOT_SUPPORTED', `Could not extract ${zip}.`, {
+        hint: 'Neither `tar -xf` nor `unzip` could read it. Extract it yourself and import the directory.',
+    });
+}
+function run(cmd, args, msg) {
+    const res = spawnSync(cmd, args, { stdio: 'ignore' });
+    if (res.error && res.error.code === 'ENOENT')
+        throw new SdodsError('NOT_SUPPORTED', msg.missing, { hint: msg.hint });
+    if (res.status !== 0)
+        throw new SdodsError('CONFIG_INVALID', `${cmd} ${args[0]} failed (exit ${res.status}).`, {
+            hint: msg.hint,
+        });
+}
+/**
+ * Accept either a project directory or a repository that contains one, so importing a colleague's
+ * checkout works without asking them where the yaml is.
+ */
+function findProjectDir(dir, source) {
+    if (existsSync(join(dir, PROJECT_FILE)))
+        return dir;
+    const nested = [];
+    const scan = (d, depth) => {
+        for (const name of readdirSync(d)) {
+            const abs = join(d, name);
+            if (!statSync(abs).isDirectory() || EXCLUDED.test(name))
+                continue;
+            if (existsSync(join(abs, PROJECT_FILE)))
+                nested.push(abs);
+            else if (depth > 0)
+                scan(abs, depth - 1);
+        }
+    };
+    scan(dir, 1);
+    if (nested.length === 1)
+        return nested[0];
+    if (nested.length > 1) {
+        throw new SdodsError('CONFIG_INVALID', `${source} contains ${nested.length} projects.`, {
+            hint: `Import them one at a time: ${nested.map((d) => relative(dir, d)).join(', ')}.`,
+            exitCode: 2,
+        });
+    }
+    throw new SdodsError('CONFIG_NOT_FOUND', `No ${PROJECT_FILE} found in ${source}.`, {
+        hint: `Expected it at the root, or one level down (as in projects/<slug>/${PROJECT_FILE}).`,
+    });
+}
+function readProjectConfig(dir) {
+    const file = join(dir, PROJECT_FILE);
+    const doc = parseDocument(readFileSync(file, 'utf8'));
+    const parsed = ProjectConfigSchema.safeParse(doc.toJS());
+    if (!parsed.success) {
+        throw new SdodsError('CONFIG_INVALID', `${file} is not a valid SDODS project.`, {
+            hint: parsed.error.issues
+                .slice(0, 3)
+                .map((i) => `${i.path.join('.') || '(root)'}: ${i.message}`)
+                .join('; '),
+            exitCode: 2,
+        });
+    }
+    return parsed.data;
+}
+function assertWorkspaceDeclared(ctx, workspace) {
+    const declared = ctx.registry.workspaceFile.workspaces.map((w) => w.slug);
+    if (declared.includes(workspace))
+        return;
+    throw new SdodsError('CONFIG_INVALID', `Workspace "${workspace}" is not declared in the workspace file.`, {
+        hint: `Declared workspaces: ${declared.join(', ')}. Importing into an undeclared workspace would make every project fail to load.`,
+        exitCode: 2,
+    });
+}
+/**
+ * Re-home the imported yaml, comment-preserving. Without this the project keeps the organization
+ * and workspace of wherever it came from, and `discover` then rejects the *whole* registry.
+ */
+function rehome(file, to) {
+    const doc = parseDocument(readFileSync(file, 'utf8'));
+    doc.set('slug', to.slug);
+    doc.set('organization', to.organization);
+    doc.set('workspace', to.workspace);
+    writeFileSync(file, doc.toString({ lineWidth: 100 }));
+}
 //# sourceMappingURL=project.js.map

package/dist/commands/run.d.ts

@@ -11,6 +11,8 @@ export interface RunFlags {
     workers?: number;
     shard?: string;
     retries?: number;
+    trace?: string;
+    video?: string;
     grep?: string;
     feature?: string;
     since?: string;
@@ -36,6 +38,8 @@ export interface RunFlags {
     device?: string;
     reporterMode?: string;
     trigger?: string;
+    allowEmpty?: boolean;
+    notify?: boolean;
 }
 export declare function register(program: Command): void;
 export declare function runCommand(flags: RunFlags, cmd: Command): Promise<number>;

package/dist/commands/run.js

@@ -1,19 +1,36 @@
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { join, relative, resolve as resolvePath } from 'node:path';
+import { existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { isAbsolute, join, relative, resolve as resolvePath } from 'node:path';
 import { execa } from 'execa';
 import pc from 'picocolors';
-import { newRunId, runFiles, } from '@sdods/contracts';
-import { SdodsError, CLI_OVERRIDES_ENV, VERSION, formatFindings, lintProject, listGeneratedProjects, moduleByName, moduleDir, normalizeTagExpr, serializeCliOverrides, } from '@sdods/core';
+import { RecordingModeSchema, newRunId, runFiles, } from '@sdods/contracts';
+import { SdodsError, CLI_OVERRIDES_ENV, VERSION, formatFindings, lintProject, listGeneratedProjects, moduleByName, moduleDir, normalizeTagExpr, parseTagExpr, redactRunTraces, serializeCliOverrides, setupTierOf, } from '@sdods/core';
 import { analyzeChangeImpact } from '@sdods/mcp';
 import { createContext } from '../context.js';
-import { collect, json, out, parseIntFlag, warn } from '../ui.js';
+import { browserStatuses } from './browsers.js';
+import { maybeNotify, notifyRun } from '../notify.js';
+import { installedPlaywrightVersion, stepResultsWarning } from '../runner-compat.js';
+import { collect, json, out, parseIntFlag, table, warn } from '../ui.js';
+const RECORDING_MODES = RecordingModeSchema.options.join(' | ');
+/** `--trace`/`--video` take Playwright's modes; refuse anything else before specs are generated. */
+function recordingMode(flag, value) {
+    if (value === undefined)
+        return undefined;
+    const parsed = RecordingModeSchema.safeParse(value);
+    if (!parsed.success) {
+        throw new SdodsError('CONFIG_INVALID', `--${flag} "${value}" is not a Playwright ${flag} mode.`, {
+            hint: `Use one of: ${RECORDING_MODES}.`,
+            exitCode: 2,
+        });
+    }
+    return parsed.data;
+}
 function addRunOptions(cmd) {
     return cmd
         .option('-p, --project <slug>', 'project slug (default: the only project, else required)')
         .option('-e, --env <name>', 'environment name')
         .option('-t, --tags <expr>', 'Cucumber tag expression, e.g. "@smoke and not @mock" (comma list = OR)')
         .option('-l, --layer <layer>', 'ui | api | hybrid | recorded (repeatable)', collect, [])
-        .option('-b, --browser <name>', 'chromium | firefox | webkit | mobile-chrome | mobile-safari (repeatable)', collect, [])
+        .option('-b, --browser <name>', 'chromium | edge | firefox | webkit | mobile-chrome | mobile-safari (repeatable)', collect, [])
         .option('-m, --module <name>', 'restrict to a module (repeatable)', collect, [])
         .option('--process <name>', 'run a named process (recipe) from the project or workspace')
         .option('--project-matrix', 'run every browser declared in the project yaml')
@@ -22,6 +39,8 @@ function addRunOptions(cmd) {
         .option('-w, --workers <n>', 'parallel workers', parseIntFlag('workers'))
         .option('--shard <i/n>', 'shard, e.g. 1/3')
         .option('--retries <n>', 'retries per test', parseIntFlag('retries'))
+        .option('--trace <mode>', `Playwright trace: ${RECORDING_MODES} (default: evidence.trace)`)
+        .option('--video <mode>', `Playwright video: ${RECORDING_MODES} (default: evidence.video)`)
         .option('--grep <pattern>', 'filter tests by title (regular expression)')
         .option('--feature <path>', 'only this feature file (relative to features/)')
         .option('--since <range>', 'only features impacted by a git range, e.g. main..HEAD (test-impact analysis)')
@@ -45,7 +64,9 @@ function addRunOptions(cmd) {
         .option('--timeout <ms>', 'per-test timeout override', parseIntFlag('timeout'))
         .option('--reporter <name>', 'reporter override (repeatable, name=outputFile)', collect, [])
         .option('--reporter-mode <mode>', 'default | server | quiet')
-        .option('--trigger <kind>', 'cli | ui | ci | agent | mcp | schedule', 'cli');
+        .option('--trigger <kind>', 'cli | ui | ci | agent | mcp | schedule', 'cli')
+        .option('--allow-empty', 'exit 0 when the selection matches no scenario (by default that is exit 2)')
+        .option('--no-notify', 'do not publish the run to enabled integrations (GitHub, Jira) after it finishes');
 }
 export function register(program) {
     const run = addRunOptions(program
@@ -67,6 +88,13 @@ export async function runCommand(flags, cmd) {
     const proc = flags.process ? ctx.registry.processOf(entry.slug, flags.process) : undefined;
     const envName = flags.env ?? proc?.env;
     const tags = normalizeTagExpr(flags.tags ?? proc?.tags);
+    // Fail on a malformed expression here, as a config error, rather than inside bddgen.
+    if (tags)
+        parseTagExpr(tags);
+    // Same for the setup tier the runner config will generate (`setup.tags`, or the process's own).
+    const setup = setupTierOf(projectCfg, proc);
+    if (setup)
+        parseTagExpr(setup.tags);
     const layers = (flags.layer.length ? flags.layer : (proc?.layers ?? []));
     const browsers = (flags.projectMatrix
         ? projectCfg.browsers
@@ -84,6 +112,8 @@ export async function runCommand(flags, cmd) {
         warn('Recording HAR fixtures runs with a single worker so shared files keep every request.');
     }
     const failOnFlaky = flags.failOnFlaky ?? proc?.failOnFlaky ?? false;
+    const trace = recordingMode('trace', flags.trace);
+    const video = recordingMode('video', flags.video);
     for (const l of layers) {
         if (!projectCfg.layers.includes(l)) {
             throw new SdodsError('CONFIG_INVALID', `Layer "${l}" is not enabled for project ${entry.slug} (layers: ${projectCfg.layers.join(', ')}).`, { exitCode: 2 });
@@ -96,6 +126,29 @@ export async function runCommand(flags, cmd) {
     }
     for (const m of modules)
         moduleByName(projectCfg, m);
+    // Stop before generating specs when a CHANNEL browser is missing. Playwright's own error for a
+    // missing engine is already actionable ("Run npx playwright install"), but for a channel it
+    // reports a name the user never typed and no way forward — and unlike an engine, the fix is a
+    // system install rather than a download.
+    //
+    // Deliberately narrow. Selecting a browser is not the same as using one: `--project-matrix -l api`
+    // fills `browsers` from the project yaml for a run that never opens a browser, so checking every
+    // selected browser here would fail runs that would have worked.
+    const usesBrowser = !layers.length || layers.some((l) => l !== 'api');
+    const missing = usesBrowser
+        ? (await browserStatuses(browsers)).filter((s) => s.channel && !s.installed)
+        : [];
+    if (missing.length) {
+        const names = missing.map((s) => s.name);
+        throw new SdodsError('NOT_SUPPORTED', `${names.join(', ')} ${names.length > 1 ? 'are' : 'is'} not installed.`, {
+            hint: `Run \`sdods browsers install ${names.map((n) => `-b ${n}`).join(' ')}\`. ` +
+                `${names.length > 1 ? 'They are system browsers' : 'It is a system browser'}: Playwright runs the vendor installer rather than downloading a build.`,
+            exitCode: 2,
+        });
+    }
+    const stepResults = stepResultsWarning(installedPlaywrightVersion(ctx.rootDir));
+    if (stepResults)
+        warn(stepResults);
     const runId = flags.runId ?? newRunId();
     const cli = {
         env: envName,
@@ -108,9 +161,14 @@ export async function runCommand(flags, cmd) {
         harMode: harMode,
         offline: flags.strict && harMode === 'replay' ? true : undefined,
         updateSnapshots: flags.updateSnapshots,
+        trace,
+        video,
     };
     const cfg = ctx.registry.resolve(entry.slug, envName, cli);
     const runDir = cfg.runtime.runDir;
+    const featureRel = flags.feature
+        ? projectFeaturePath(cfg.project.root, ctx.rootDir, flags.feature)
+        : undefined;
     mkdirSync(runDir, { recursive: true });
     const manifest = {
         runId,
@@ -159,6 +217,7 @@ export async function runCommand(flags, cmd) {
         reporters: flags.reporter.length ? flags.reporter : undefined,
         reporterMode: flags.reporterMode ??
             (ctx.opts.quiet ? 'quiet' : 'default'),
+        process: proc?.name,
     };
     const childEnv = {
         ...process.env,
@@ -252,8 +311,8 @@ export async function runCommand(flags, cmd) {
         filters.push(`\\.sdods/generated/${escapeRe(runId)}/${escapeRe(entry.slug)}/[^/]+/${escapeRe(rel)}/`);
     }
     const featureFilter = (rel) => escapeRe(rel.replace(/^features\//, '').replace(/\.feature$/, '')) + '\\.feature\\.spec';
-    if (flags.feature)
-        filters.push(featureFilter(flags.feature));
+    if (featureRel)
+        filters.push(featureFilter(featureRel));
     // --since <range>: run only what the change could have broken.
     //
     // `analyzeChangeImpact` has existed for a while and was reachable only
@@ -283,8 +342,12 @@ export async function runCommand(flags, cmd) {
     args.splice(4, 0, ...filters);
     if (flags.list) {
         out(pc.bold('Run targets:'));
-        for (const p of runnerProjects)
+        for (const p of runnerProjects) {
+            // Playwright runs the setup companion as a dependency; list it so the targets match the tests.
+            if (setup && p.layer !== 'recorded')
+                out(`  ${p.name}--setup`);
             out(`  ${p.name}`);
+        }
         const listed = await execa('npx', args, {
             cwd: ctx.rootDir,
             env: childEnv,
@@ -315,6 +378,16 @@ export async function runCommand(flags, cmd) {
     manifest.finishedAt = new Date().toISOString();
     manifest.exitCode = exitCode;
     writeManifest();
+    // Traces carry the session of the account that ran each test (cookies, Authorization headers,
+    // localStorage/IndexedDB tokens). Redact every copy before anything reads the run directory:
+    // ingest, integrations, and the CI step that uploads it as an artifact (#101).
+    if (cfg.project.evidence.redactTraces !== false) {
+        const redaction = redactRunTraces(runDir);
+        if (redaction.files.length)
+            out(pc.dim(`traces: redacted ${redaction.values} credential value(s) in ${redaction.files.length} file(s)`));
+        for (const e of redaction.errors)
+            warn(`trace redaction failed for ${relative(ctx.rootDir, e.file)}: ${e.error}`);
+    }
     const summary = readSummary(runDir, runId, exitCode, Date.now() - started);
     if (summary)
         writeFileSync(join(runDir, runFiles.summary), JSON.stringify(summary, null, 2));
@@ -340,20 +413,88 @@ export async function runCommand(flags, cmd) {
             warn(`ingest skipped: ${e.message}`);
         }
     }
-    if (summary && summary.totals.total === 0)
-        warn(`No scenarios matched the selection${tags ? ` (tags: ${tags})` : ''}.`);
+    // Zero scenarios with exit 0 is indistinguishable from a green run, so a typo in --tags or
+    // --feature used to keep CI passing while testing nothing. One shard of several can
+    // legitimately receive nothing, and --allow-empty opts out explicitly.
+    let finalExit = exitCode;
+    if (summary && summary.totals.total === 0) {
+        const emptyShard = (cfg.runtime.shard?.total ?? 1) > 1;
+        const message = `No scenarios matched the selection${tags ? ` (tags: ${tags})` : ''}${featureRel ? ` (feature: ${featureRel})` : ''}.`;
+        warn(message);
+        if (exitCode === 0 && !flags.allowEmpty && !emptyShard) {
+            finalExit = 2;
+            warn('Nothing was run, so this is not a pass. Pass --allow-empty if an empty run is expected.');
+            manifest.exitCode = finalExit;
+            writeManifest();
+        }
+    }
+    // Enabled integrations (check runs, PR comment, issues) act on the run here, the same way
+    // `sdods integrations notify --run-id` does. Failures are reported and never change the exit code.
+    const notify = await maybeNotify({
+        flags,
+        integrations: projectCfg.integrations,
+        totals: summary?.totals,
+        exitCode,
+        shardTotal: cfg.runtime.shard?.total,
+        warn,
+        notify: () => notifyRun({
+            rootDir: ctx.rootDir,
+            registry: ctx.registry,
+            artifactsRoot: cfg.runtime.artifactsDir,
+            runId,
+            projectSlug: entry.slug,
+        }),
+    });
+    if (!ctx.opts.json && notify.ran && notify.actions.length) {
+        out('');
+        out(pc.bold('integrations'));
+        table(notify.actions.map((a) => ({
+            provider: a.provider,
+            action: a.kind,
+            target: a.target ?? '',
+            url: a.url ?? '',
+            detail: a.detail ?? '',
+        })));
+    }
+    else if (!ctx.opts.json && !notify.ran && notify.reason !== 'no integration enabled') {
+        // an enabled integration that did not act must say so: silence is what #81 was about
+        out(pc.dim(`integrations: not notified (${notify.reason})`));
+    }
     if (ctx.opts.json) {
-        json({ runId, runDir, exitCode, summary, manifest });
+        json({ runId, runDir, exitCode: finalExit, summary, manifest, notify });
     }
     else {
         const t = summary?.totals;
         out('');
-        out(`${exitCode === 0 ? pc.green('✔ passed') : exitCode === 130 ? pc.yellow('■ cancelled') : pc.red('✖ failed')}  ${t ? `${t.passed} passed, ${t.failed} failed, ${t.skipped} skipped, ${t.flaky} flaky` : ''}  ${pc.dim(`(${Math.round((Date.now() - started) / 1000)}s)`)}`);
+        out(`${finalExit === 0 ? pc.green('✔ passed') : finalExit === 130 ? pc.yellow('■ cancelled') : finalExit === 2 ? pc.yellow('■ nothing ran') : pc.red('✖ failed')}  ${t ? `${t.passed} passed, ${t.failed} failed, ${t.skipped} skipped, ${t.flaky} flaky` : ''}  ${pc.dim(`(${Math.round((Date.now() - started) / 1000)}s)`)}`);
         out(pc.dim(`artifacts:   ${runDir}`));
         out(pc.dim(`html report: ${join(runDir, runFiles.htmlReport, 'index.html')}`));
         out(pc.dim(`dashboard:   ${join(runDir, runFiles.dashboard, 'index.html')}`));
     }
-    return exitCode;
+    return finalExit;
+}
+/**
+ * `--feature` accepts a path relative to features/, to the project, to the repo, or absolute. It is
+ * turned into one relative to the project, and must exist: a mistyped path used to select nothing
+ * and pass.
+ */
+function projectFeaturePath(projectRoot, repoRoot, input) {
+    const candidates = isAbsolute(input)
+        ? [input]
+        : [
+            join(projectRoot, 'features', input),
+            join(projectRoot, input),
+            resolvePath(repoRoot, input),
+            resolvePath(process.cwd(), input),
+        ];
+    const found = candidates.find((c) => existsSync(c) && statSync(c).isFile());
+    const rel = found ? relative(projectRoot, found).replace(/\\/g, '/') : undefined;
+    if (!found || !rel || rel.startsWith('..') || !rel.startsWith('features/'))
+        throw new SdodsError('CONFIG_NOT_FOUND', `Feature file not found in this project: ${input}`, {
+            hint: `Give a path under ${relative(repoRoot, join(projectRoot, 'features')) || 'features'}/, e.g. --feature auth/login.feature.`,
+            exitCode: 2,
+        });
+    return rel;
 }
 function escapeRe(s) {
     return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');