npm - agent-device-lab - Versions diffs - 0.0.0-stage → 0.3.0 - Mend

agent-device-lab 0.0.0-stage → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (54) hide show

package/LICENSE +202 -0
package/NOTICE +10 -0
package/README.md +142 -2
package/assets/dashboard/app.css +238 -0
package/assets/dashboard/app.js +976 -0
package/assets/dashboard/index.html +120 -0
package/bin/agentlab.js +8 -0
package/dist/cli/ci.js +443 -0
package/dist/cli/flow.js +127 -0
package/dist/cli/main.js +855 -0
package/dist/cli/signals.js +38 -0
package/dist/core/action-log.js +125 -0
package/dist/core/auth.js +175 -0
package/dist/core/bundle.js +432 -0
package/dist/core/checks.js +137 -0
package/dist/core/ci.js +389 -0
package/dist/core/commands.js +366 -0
package/dist/core/control.js +217 -0
package/dist/core/detectors.js +392 -0
package/dist/core/devices.js +83 -0
package/dist/core/doctor.js +203 -0
package/dist/core/explore-safety.js +110 -0
package/dist/core/extract.js +1445 -0
package/dist/core/feed.js +493 -0
package/dist/core/findings.js +179 -0
package/dist/core/format.js +311 -0
package/dist/core/init.js +607 -0
package/dist/core/lab.js +1979 -0
package/dist/core/migrate.js +35 -0
package/dist/core/observation.js +161 -0
package/dist/core/ownership.js +142 -0
package/dist/core/process-group.js +206 -0
package/dist/core/process-identity.js +56 -0
package/dist/core/profile.js +816 -0
package/dist/core/project-runner.js +359 -0
package/dist/core/replay.js +303 -0
package/dist/core/reproduction.js +36 -0
package/dist/core/scan-policy.js +156 -0
package/dist/core/scan-report.js +145 -0
package/dist/core/scan.js +455 -0
package/dist/core/schema.js +39 -0
package/dist/core/services.js +134 -0
package/dist/core/steps.js +80 -0
package/dist/core/sweep.js +138 -0
package/dist/core/trace-sanitize.js +641 -0
package/dist/core/url-redact.js +25 -0
package/dist/core/versions.js +29 -0
package/dist/core/zip.js +264 -0
package/dist/daemon/main.js +160 -0
package/dist/daemon/state.js +93 -0
package/dist/dashboard/open.js +25 -0
package/dist/dashboard/server.js +366 -0
package/dist/mcp/server.js +89 -0
package/package.json +58 -4

package/assets/dashboard/index.html ADDED Viewed

@@ -0,0 +1,120 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="referrer" content="no-referrer">
+<title>Agent Device Lab</title>
+<link rel="stylesheet" href="/app.css">
+<script src="/app.js" defer></script>
+</head>
+<body>
+<header class="top">
+  <div class="brand">Agent Device Lab</div>
+  <span id="state" class="pill" data-state="idle">connecting</span>
+  <span id="session" class="muted mono"></span>
+  <span class="grow"></span>
+  <span id="conn" class="conn" data-conn="connecting">connecting…</span>
+</header>
+<section class="status" id="status" aria-label="Session status">
+  <div><span class="k">Project</span><span id="s-project">–</span></div>
+  <div><span class="k">Device</span><span id="s-device">–</span></div>
+  <div class="wide"><span class="k">URL</span><span id="s-url" class="mono">–</span></div>
+  <div><span class="k">Console errors</span><span id="s-console" class="num">0</span></div>
+  <div><span class="k">Failed requests</span><span id="s-failed" class="num">0</span></div>
+  <div><span class="k">Findings</span><span id="s-findings" class="num">0</span></div>
+  <div class="wide"><span class="k">Server</span><span id="s-server">–</span></div>
+</section>
+<section id="supervision" class="supervision" aria-label="Session supervision" hidden>
+  <div class="sup-main">
+    <span id="ctl-badge" class="mode-badge" role="status" data-mode="agent">Agent in control</span>
+    <span id="ctl-detail" class="muted small"></span>
+    <div id="ctl-buttons" class="ctl-buttons" role="group" aria-label="Supervision controls">
+      <button type="button" id="ctl-pause" data-op="pause" aria-pressed="false" aria-disabled="true">Pause after this action</button>
+      <button type="button" id="ctl-pause-next" data-op="pause-next" aria-disabled="true">Pause before next action</button>
+      <button type="button" id="ctl-resume" data-op="resume" aria-disabled="true">Resume</button>
+      <button type="button" id="ctl-takeover" data-op="takeover" aria-pressed="false" aria-disabled="true">Take over</button>
+      <button type="button" id="ctl-return" data-op="return" aria-disabled="true">Return control to agent</button>
+      <button type="button" id="ctl-stop" data-op="stop" class="danger" aria-disabled="true">Stop run</button>
+      <button type="button" id="ctl-emergency-stop" data-op="emergency-stop" class="danger strong" aria-disabled="true">Emergency stop</button>
+    </div>
+  </div>
+  <div id="ctl-error" class="ctl-error" role="alert" hidden></div>
+</section>
+<p id="ctl-viewonly" class="viewonly small muted" hidden>view-only link: controls need the URL from `agentlab ui`</p>
+<div id="notice" class="notice" hidden></div>
+<section id="start-error" class="start-error" hidden aria-live="polite"></section>
+<section id="scan" class="panel scan" hidden aria-label="Stateful scan">
+  <h2>Scan <span id="scan-caption" class="muted small"></span></h2>
+  <div id="scan-verdict" class="scan-verdict"></div>
+  <div class="scan-matrix-wrap"><table id="scan-matrix" class="scan-matrix"></table></div>
+  <div id="scan-run" class="scan-run" hidden></div>
+</section>
+<main class="grid">
+  <section class="panel viewport-panel" aria-label="Live viewport">
+    <h2>Viewport <span id="vp-caption" class="muted small"></span></h2>
+    <p id="vp-now" class="vp-now" role="status"></p>
+    <div class="device" id="device">
+      <img id="viewport" alt="Live view of the device viewport">
+      <div id="vp-empty" class="vp-empty">No frames yet</div>
+    </div>
+    <section id="human-panel" class="human-panel" hidden aria-label="Take over the browser">
+      <p class="human-banner"><strong>You have control of the browser.</strong> The agent is waiting. Your actions are recorded as descriptions only (no typed text).<span id="human-headed" hidden> You can also use the browser window directly.</span></p>
+      <p class="small muted">Click the viewport to tap; scroll over it to scroll.</p>
+      <form id="human-form" class="human-form" autocomplete="off">
+        <label class="small" for="human-text">Type into the focused field</label>
+        <div class="human-row">
+          <input id="human-text" type="text" autocomplete="off" autocapitalize="off" spellcheck="false" maxlength="500">
+          <button type="submit" id="human-type">Type</button>
+        </div>
+        <label class="small"><input type="checkbox" id="human-hide"> Hide what I type on this screen</label>
+      </form>
+      <div class="human-keys" role="group" aria-label="Keys">
+        <button type="button" data-key="Enter">Enter</button>
+        <button type="button" data-key="Tab">Tab</button>
+        <button type="button" data-key="Shift+Tab">Shift+Tab</button>
+        <button type="button" data-key="Escape">Escape</button>
+        <button type="button" data-key="Backspace">Backspace</button>
+        <button type="button" data-key="ArrowUp" aria-label="Arrow up">&uarr;</button>
+        <button type="button" data-key="ArrowDown" aria-label="Arrow down">&darr;</button>
+        <button type="button" data-key="ArrowLeft" aria-label="Arrow left">&larr;</button>
+        <button type="button" data-key="ArrowRight" aria-label="Arrow right">&rarr;</button>
+      </div>
+    </section>
+    <section id="sweep" class="sweep" hidden aria-label="Responsive sweep">
+      <h2>Sweep <span id="sweep-caption" class="muted small"></span></h2>
+      <ul id="sweep-devices" class="sweep-devices"></ul>
+    </section>
+  </section>
+  <section class="panel timeline-panel" aria-label="Action timeline">
+    <h2>Timeline <span id="tl-count" class="muted small"></span></h2>
+    <ol id="timeline" class="timeline"></ol>
+    <details class="serverlog">
+      <summary>Server output <span id="log-count" class="muted small"></span></summary>
+      <pre id="serverlog"></pre>
+    </details>
+  </section>
+  <section class="panel findings-panel" aria-label="Findings">
+    <h2>Findings</h2>
+    <div id="device-filter" class="chips" role="group" aria-label="Filter findings by device"></div>
+    <div id="confidence-filter" class="chips" role="group" aria-label="Filter findings by confidence" hidden></div>
+    <div id="scenario-filter" class="chips" role="group" aria-label="Filter findings by scenario" hidden></div>
+    <div id="group-row" class="chips" hidden><button id="group-toggle" type="button" aria-pressed="false">Group by problem</button></div>
+    <div id="run-filter" class="run-filter small" hidden></div>
+    <ul id="findings" class="findings"><li class="muted empty">None recorded</li></ul>
+    <details id="suppressed" class="suppressed" hidden>
+      <summary id="suppressed-summary"></summary>
+      <ul id="suppressed-list" class="findings"></ul>
+    </details>
+    <article id="finding-detail" class="finding-detail" hidden></article>
+  </section>
+</main>
+</body>
+</html>

package/bin/agentlab.js ADDED Viewed

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+// Checked before loading anything else, so an old Node.js gets a clear message rather than a syntax error.
+const [major] = process.versions.node.split('.').map(Number);
+if (major < 22) {
+  process.stderr.write(`agentlab needs Node.js 22 or newer; this is ${process.versions.node}.\n`);
+  process.exit(1);
+}
+await import('../dist/cli/main.js');

package/dist/cli/ci.js ADDED Viewed

@@ -0,0 +1,443 @@
+import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { basename, dirname, join, relative, resolve, sep } from 'node:path';
+import { chromium } from 'playwright';
+import { AUTH_STATE_ENV, authStateFromEnv, authStateSecrets, savedStateProblem } from '../core/auth.js';
+import { envSecrets, leakedSecrets, redactTree } from '../core/bundle.js';
+import { CI_FILES, CI_SCHEMA, EXIT, applySuppressions, collectFindings, evaluateCi, formatCiText, frameRefs, groupForCi, parseCiResult, renderCi, resolveCi, withFrames, } from '../core/ci.js';
+import { redactSecrets } from '../core/feed.js';
+import { formatError } from '../core/format.js';
+import { Lab } from '../core/lab.js';
+import { loadProfile } from '../core/profile.js';
+import { evaluatePolicy, groupFindings } from '../core/scan-policy.js';
+import { scanReportHtml } from '../core/scan-report.js';
+import { scanSummary } from '../core/scan.js';
+import { isSecretStep } from '../core/steps.js';
+import { LabError } from '../core/schema.js';
+import { CONTRACT_VERSIONS, productVersion } from '../core/versions.js';
+import { runFlowDetailed } from './flow.js';
+import { holdIfTerminating, onTermination } from './signals.js';
+const MAX_FRAMES = 200;
+const never = () => new Promise(() => undefined);
+/** Every problem with what was asked for, before anything starts. Read-only: no project command runs. */
+async function validate(inv) {
+    const checks = [];
+    const problems = [];
+    const check = (name, ok, detail) => { checks.push({ name, ok, detail }); if (!ok)
+        problems.push(`${name}: ${detail}`); };
+    let profile;
+    try {
+        profile = await loadProfile(inv.project);
+    }
+    catch (err) {
+        const e = LabError.from(err);
+        // A JSON parser's own message quotes the file's text; say only what is wrong.
+        const message = e.code === 'invalid_profile' ? e.message.replace(/^(Cannot read [^:]+): [\s\S]*$/, '$1: the file is missing or not valid JSON') : e.message;
+        check('profile', false, redactSecrets(message));
+        return { checks, problems };
+    }
+    check('profile', true, `${profile.name}: ${profile.profilePath} (schemaVersion ${profile.schemaVersion}, ${profile.services.length} service${profile.services.length === 1 ? '' : 's'})`);
+    const { selections: sel, problems: selection } = resolveCi(profile, inv);
+    for (const p of selection)
+        check('selection', false, p);
+    if (!selection.length)
+        check('selection', true, `${sel.flows.length} flow(s), ${sel.routes.length} route(s), ${sel.scenarios.length} scenario(s)`);
+    const exe = chromium.executablePath();
+    check('browser', existsSync(exe), existsSync(exe) ? 'Chromium is installed' : 'Chromium is not installed (run `agentlab install-browser`, with --with-deps on a bare CI image)');
+    for (const s of profile.services) {
+        const missing = s.requiredEnv.filter((n) => !process.env[n]);
+        check(`environment for service "${s.name}"`, !missing.length, missing.length ? `required variable${missing.length === 1 ? '' : 's'} not set: ${missing.join(', ')}` : s.requiredEnv.length ? `${s.requiredEnv.join(', ')} set` : 'nothing required');
+    }
+    for (const f of sel.flows) {
+        const file = resolve(profile.root, f);
+        let detail;
+        if (!existsSync(file))
+            detail = 'the file does not exist';
+        else {
+            try {
+                const flow = JSON.parse(readFileSync(file, 'utf8'));
+                if (typeof flow.name !== 'string' || !Array.isArray(flow.steps))
+                    detail = 'needs a "name" and a "steps" list';
+            }
+            catch {
+                detail = 'is not valid JSON';
+            }
+        }
+        check(`flow ${f}`, !detail, detail ?? 'found and parsed');
+    }
+    let authState;
+    if (sel.auth === 'saved') {
+        const problem = savedStateProblem(profile.auth, profile.root);
+        check('auth (saved)', !problem, problem ?? 'a usable saved sign-in state exists');
+    }
+    else if (sel.auth === 'env') {
+        const value = process.env[AUTH_STATE_ENV];
+        if (!value)
+            check('auth (env)', false, `${AUTH_STATE_ENV} is not set`);
+        else {
+            try {
+                authState = authStateFromEnv(value);
+                check('auth (env)', true, `${AUTH_STATE_ENV} holds ${authState.cookies.length} cookie(s) and ${authState.origins.length} origin(s) of storage`);
+            }
+            catch (err) {
+                check('auth (env)', false, LabError.from(err).message);
+            }
+        }
+    }
+    return { profile, sel, ...(authState ? { authState } : {}), checks, problems };
+}
+function printChecks(checks, problems, json) {
+    if (json)
+        process.stdout.write(JSON.stringify({ ok: !problems.length, checks, problems }, null, 2) + '\n');
+    else {
+        for (const c of checks)
+            process.stdout.write(`${c.ok ? 'ok  ' : 'FAIL'} ${c.name}: ${c.detail}\n`);
+        process.stdout.write(problems.length ? `${problems.length} problem${problems.length === 1 ? '' : 's'}: the run would not start (exit 2)\n` : 'valid: `agentlab test` can run\n');
+    }
+}
+// ---------- files ----------
+function ensureDir(dir) {
+    const fresh = !existsSync(dir);
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    if (fresh)
+        chmodSync(dir, 0o700);
+}
+function put(file, data) {
+    ensureDir(dirname(file));
+    writeFileSync(file, data, { mode: 0o600 });
+    chmodSync(file, 0o600);
+}
+/** Copy the evidence frames (JPEGs inside the lab's run directories only) into `<out>/<sub>/`; returns source → relative path. */
+function copyFrames(sources, out, sub, roots) {
+    const map = new Map();
+    const real = roots.flatMap((r) => { try {
+        return [realpathSync(r)];
+    }
+    catch {
+        return [];
+    } });
+    for (const src of sources) {
+        if (map.size >= MAX_FRAMES)
+            break;
+        try {
+            const file = realpathSync(src);
+            if (!/\.jpe?g$/i.test(file) || !real.some((r) => file.startsWith(r + sep)) || !statSync(file).isFile())
+                continue;
+            const name = `${String(map.size + 1).padStart(3, '0')}-${basename(file)}`;
+            ensureDir(join(out, sub));
+            copyFileSync(file, join(out, sub, name));
+            chmodSync(join(out, sub, name), 0o600);
+            map.set(src, `${sub}/${name}`);
+        }
+        catch { /* a frame that cannot be copied is left out */ }
+    }
+    return map;
+}
+export async function runCi(inv) {
+    // Registered first: a signal during validation must exit with its own code, not die with the default action.
+    let onSignal = async () => undefined;
+    const removeSignals = onTermination((signal) => onSignal(signal), { stateDir: inv.stateDir });
+    const t0 = Date.now();
+    const startedAt = new Date(t0).toISOString();
+    const v = await validate(inv);
+    if (inv.validateOnly) {
+        printChecks(v.checks, v.problems, inv.json);
+        process.exit(v.problems.length ? EXIT.couldNotRun : 0);
+    }
+    const { profile, sel } = v;
+    const out = resolve(sel?.out ?? './agentlab-results');
+    const state = { flows: [], sweeps: [], labs: [], bundles: [], traces: [], auth: 'fresh' };
+    // Redaction set: the project's secret environment, the sign-in state's values and every lab's own secrets.
+    const base = new Set(profile ? envSecrets(profile) : []);
+    if (v.authState)
+        for (const s of authStateSecrets(v.authState))
+            base.add(s);
+    // Values a flow or scenario types into secret-looking fields are known before the browser is: they never print.
+    const seeded = [
+        ...(profile?.scan.scenarios.flatMap((sc) => [...sc.steps, ...sc.cleanup]) ?? []),
+        ...(sel?.flows ?? []).flatMap((f) => { try {
+            return JSON.parse(readFileSync(resolve(profile.root, f), 'utf8')).steps ?? [];
+        }
+        catch {
+            return [];
+        } }),
+    ];
+    for (const st of seeded)
+        if (typeof st.value === 'string' && st.value.length >= 4 && isSecretStep(st))
+            base.add(st.value);
+    const envState = process.env[AUTH_STATE_ENV]?.trim();
+    if (envState && envState.length >= 6)
+        base.add(envState);
+    const secretsNow = () => [...new Set([...base, ...state.labs.flatMap((l) => l.secretValues())])].filter((s) => s.length >= 4).sort((a, b) => b.length - a.length);
+    const say = (text) => { (inv.json ? process.stderr : process.stdout).write(redactTree(text, secretsNow())); };
+    const note = (text) => { process.stderr.write(redactTree(`agentlab: ${text}\n`, secretsNow())); };
+    if (!profile || !sel || v.problems.length) {
+        const reasons = v.problems.map((p) => redactTree(p, secretsNow()));
+        process.stderr.write(`agentlab: cannot run:\n${reasons.map((r) => `  - ${r}`).join('\n')}\n`);
+        if (profile && sel) {
+            try {
+                await writeOutputs({ inv, profile, sel, state, out, t0, startedAt, secretsNow, override: { exitCode: EXIT.couldNotRun, reason: `could not run: ${reasons.join('; ')}` }, quiet: true });
+            }
+            catch { /* the message above is the result */ }
+        }
+        process.exit(EXIT.couldNotRun);
+    }
+    // Start from a clean artifacts directory: only the names this command writes are removed.
+    for (const name of ['ci-result.json', 'summary.txt', 'report.html', 'junit.xml', 'frames', 'scan', 'bundles', 'traces'])
+        rmSync(join(out, name), { recursive: true, force: true });
+    ensureDir(out);
+    const finish = (override) => writeOutputs({ inv, profile, sel, state, out, t0, startedAt, secretsNow, ...(override ? { override } : {}) });
+    const abort = async (kind, text, exitCode) => {
+        if (state.aborted)
+            return;
+        state.aborted = { kind, text };
+        await Promise.allSettled(state.labs.map((l) => l.close(text)));
+        try {
+            await finish({ exitCode, reason: text });
+        }
+        catch (err) {
+            process.stderr.write(`agentlab: ${LabError.from(err).message}\n`);
+        }
+    };
+    onSignal = (signal) => abort('cancelled', `cancelled by ${signal}`, { SIGHUP: 129, SIGINT: 130, SIGTERM: 143 }[signal] ?? 1);
+    const seconds = Math.round(sel.timeoutMs / 100) / 10;
+    const timer = setTimeout(() => { void abort('timeout', `timed out after ${seconds}s`, EXIT.timedOut).finally(() => process.exit(EXIT.timedOut)); }, sel.timeoutMs);
+    const bundlesDir = join(out, 'bundles');
+    const traceOn = sel.trace !== 'off';
+    const startAuth = { auth: sel.auth === 'saved' ? 'saved' : 'fresh', ...(v.authState ? { authState: v.authState } : {}) };
+    const failWith = (err) => {
+        const e = LabError.from(err).toJSON();
+        const tail = Array.isArray(e.details?.logTail) ? `\nserver log tail:\n${e.details.logTail.slice(-10).map((l) => `  ${redactSecrets(String(l))}`).join('\n')}` : '';
+        state.problem = `${formatError({ ...e, details: undefined }).split('\n').slice(0, 2).join(' ')}${tail}`;
+    };
+    const bundleTrace = (t) => typeof t === 'string' ? t : `dropped: ${t.dropped}`;
+    note('starting');
+    try {
+        // 1. Flows, each in its own session.
+        for (const file of sel.flows) {
+            if (state.aborted)
+                await never();
+            note(`flow ${file}`);
+            let bundleDir;
+            const outcome = await runFlowDetailed(resolve(profile.root, file), {
+                headed: inv.headed, json: false, stateDir: inv.stateDir, write: say, project: profile.root, ...startAuth, trace: traceOn,
+                onLab: (l) => { state.labs.push(l); },
+                beforeClose: async (l, o) => {
+                    state.auth = l.status().session?.auth ?? state.auth;
+                    if (o.failure) {
+                        const b = await l.bundle({ reason: o.reason ?? 'flow failed', failure: o.failure, dir: bundlesDir });
+                        bundleDir = `bundles/${b.id}`;
+                        state.bundles.push({ id: b.id, dir: bundleDir, for: `flow ${basename(file)}`, trace: bundleTrace(b.trace) });
+                    }
+                    else if (sel.trace === 'always') {
+                        const dest = join(out, 'traces', `flow-${state.flows.length + 1}.zip`);
+                        const saved = await l.saveTrace(dest);
+                        state.traces.push('path' in saved ? { name: `flow ${basename(file)}`, file: relative(out, dest) } : { name: `flow ${basename(file)}`, dropped: saved.dropped });
+                    }
+                },
+            });
+            if (state.aborted)
+                await never();
+            if (outcome.startError) {
+                const e = outcome.startError;
+                failWith(new LabError(e.code, e.message, { ...(e.hint ? { hint: e.hint } : {}), ...(e.details ? { details: e.details } : {}) }));
+                state.problem = `flow ${file} could not start: ${state.problem}`;
+                state.flows.push({ name: outcome.name, file, passed: false, steps: outcome.steps, completed: 0, ms: outcome.elapsedMs, failedStep: { index: 0, label: 'start', kind: 'start', text: 'the session could not start' } });
+                break;
+            }
+            state.flows.push({
+                name: outcome.name, file, passed: outcome.passed, steps: outcome.steps, completed: outcome.completed, ms: outcome.elapsedMs,
+                ...(outcome.failedStep ? { failedStep: outcome.failedStep } : {}), ...(bundleDir ? { bundle: bundleDir } : {}),
+            });
+        }
+        // 2. One session for the sweeps and the scan.
+        if (!state.problem && (sel.routes.length || sel.scenarios.length)) {
+            const lab = new Lab({ stateDir: inv.stateDir });
+            state.labs.push(lab);
+            try {
+                const started = await lab.start({ project: profile.root, headed: inv.headed, ...startAuth, ...(traceOn ? { trace: true } : {}) });
+                state.chromium = started.session.browser.version;
+                state.auth = started.session.auth ?? 'fresh';
+                for (const route of sel.routes) {
+                    if (state.aborted)
+                        await never();
+                    note(`sweep ${route}`);
+                    state.sweeps.push(await lab.sweep({ route, devices: sel.sweepDevices }));
+                }
+                if (sel.scenarios.length) {
+                    if (state.aborted)
+                        await never();
+                    note(`scan ${sel.scenarios.length} scenario(s)`);
+                    state.scan = await lab.scan({ scenarios: sel.scenarios, ...(sel.devices ? { devices: sel.devices } : {}) });
+                }
+                if (state.aborted)
+                    await never();
+                const now = assemble(profile, sel, state);
+                if (now.verdict.failingFindings.length) {
+                    const failing = now.findings.filter((f) => now.verdict.failingFindings.includes(f.id));
+                    const b = await lab.bundle({
+                        reason: `${failing.length} finding(s) failed the CI policy: ${failing.map((f) => f.id).join(', ')}`,
+                        failure: { kind: 'findings', fingerprints: [...new Set(failing.map((f) => f.fingerprint))] }, dir: bundlesDir,
+                    });
+                    state.bundles.push({ id: b.id, dir: `bundles/${b.id}`, for: 'findings of the sweeps and scan', trace: bundleTrace(b.trace) });
+                }
+                else if (sel.trace === 'always') {
+                    const dest = join(out, 'traces', 'session.zip');
+                    const saved = await lab.saveTrace(dest);
+                    state.traces.push('path' in saved ? { name: 'sweeps and scan', file: relative(out, dest) } : { name: 'sweeps and scan', dropped: saved.dropped });
+                }
+            }
+            catch (err) {
+                if (state.aborted)
+                    await never();
+                failWith(err);
+            }
+            finally {
+                if (!state.aborted)
+                    await lab.close('ci finished');
+            }
+        }
+    }
+    catch (err) {
+        if (state.aborted)
+            await never();
+        failWith(err);
+    }
+    finally {
+        // Whatever happened, no lab is left holding a browser or a service (an abort closes them itself).
+        if (!state.aborted)
+            await Promise.allSettled(state.labs.map((l) => l.close('ci finished')));
+    }
+    if (state.aborted)
+        await never();
+    clearTimeout(timer);
+    removeSignals();
+    let code;
+    try {
+        code = await finish(state.problem ? { exitCode: EXIT.couldNotRun, reason: `could not run: ${state.problem}` } : undefined);
+    }
+    catch (err) {
+        process.stderr.write(`agentlab: ${redactTree(LabError.from(err).message, secretsNow())}\n`);
+        code = EXIT.couldNotRun;
+    }
+    await holdIfTerminating();
+    process.exit(code);
+}
+/** The findings of the sweeps and the scan with the project's suppressions applied, their groups and the verdict. */
+function assemble(profile, sel, state) {
+    const sweeps = state.sweeps.map((s) => ({
+        id: s.id, route: s.route, ms: s.ms,
+        devices: s.devices.map((d) => ({ device: d.device, width: d.width, status: d.status, ...(d.error ? { error: d.error.message } : {}), findings: d.findings, ms: d.ms })),
+    }));
+    const raw = collectFindings(state.sweeps, state.scan);
+    const devices = [...new Set([...state.sweeps.flatMap((s) => s.devices.map((d) => d.device)), ...(state.scan?.runs.map((r) => r.device) ?? [])])];
+    const { findings, statuses } = applySuppressions(raw, profile, { scenarios: sel.scenarios, devices });
+    const groups = groupForCi(findings);
+    const verdict = evaluateCi({ flows: state.flows, sweeps, scanRuns: state.scan?.runs ?? [], findings, groups, sel });
+    return { sweeps, findings, statuses, groups, verdict };
+}
+/**
+ * Build the result, copy evidence per policy, redact every output, verify that no secret survived, and only then
+ * write. Returns the exit code. Throws (writing no result files) when a secret would remain.
+ */
+async function writeOutputs(o) {
+    const { inv, profile, sel, state, out } = o;
+    const a = assemble(profile, sel, state);
+    const aborted = state.aborted;
+    let verdict = a.verdict;
+    if (o.override) {
+        verdict = { ...a.verdict, result: 'error', exitCode: o.override.exitCode, reasons: [o.override.reason, ...(a.verdict.result === 'fail' ? a.verdict.reasons : [])] };
+    }
+    const roots = state.labs.flatMap((l) => { const d = l.status().session?.runDir; return d ? [d] : []; });
+    const wantFrames = sel.evidence === 'always' || (sel.evidence === 'on-failure' && verdict.result !== 'pass');
+    // Evidence frames, then the scan's own report with its frames beside it.
+    const frames = wantFrames ? copyFrames(frameRefs(a.findings), out, 'frames', roots) : new Map();
+    let scanForFiles;
+    if (state.scan) {
+        const ids = new Set(state.scan.findings.map((f) => f.id));
+        const scanFindings = a.findings.filter((f) => ids.has(f.id));
+        const ciPolicy = evaluatePolicy(scanFindings, state.scan.runs, { failOn: sel.failOn, failOnErrors: sel.scenarioErrors === 'fail', failOnHeuristic: sel.failOnHeuristic });
+        scanForFiles = {
+            ...state.scan, findings: scanFindings, groups: groupFindings(scanFindings), suppressions: a.statuses,
+            verdict: { ...ciPolicy, result: state.scan.interrupted ? 'incomplete' : ciPolicy.result },
+        };
+    }
+    const scanFrames = wantFrames && scanForFiles ? copyFrames(frameRefs(scanForFiles.findings), out, 'scan/frames', roots) : new Map();
+    const artifacts = [{ path: CI_FILES.json, kind: 'result (JSON)' }];
+    if (sel.formats.includes('text'))
+        artifacts.push({ path: CI_FILES.text, kind: 'summary' });
+    if (sel.formats.includes('html'))
+        artifacts.push({ path: CI_FILES.html, kind: 'report' });
+    if (sel.formats.includes('junit'))
+        artifacts.push({ path: CI_FILES.junit, kind: 'JUnit XML' });
+    if (scanForFiles)
+        artifacts.push({ path: 'scan/report.html', kind: 'the scan\'s own report' }, { path: 'scan/result.json', kind: 'the scan\'s full result' });
+    if (frames.size)
+        artifacts.push({ path: 'frames/', kind: `${frames.size} evidence frame(s)` });
+    const scanSummaryJson = scanForFiles ? { ...scanSummary(scanForFiles, 200), reports: { html: 'scan/report.html', json: 'scan/result.json' } } : undefined;
+    const result = {
+        schema: CI_SCHEMA, version: CONTRACT_VERSIONS.report, product: { name: 'agentlab', version: productVersion() }, startedAt: o.startedAt, ms: Date.now() - o.t0,
+        command: inv.command, project: { name: profile.name }, selections: sel,
+        environment: { node: process.version, platform: process.platform, arch: process.arch, ...(state.chromium ? { chromium: state.chromium } : {}), ci: Boolean(process.env.CI), auth: state.auth },
+        flows: state.flows, sweeps: a.sweeps, ...(scanSummaryJson ? { scan: scanSummaryJson } : {}),
+        findings: withFrames(a.findings, frames), groups: a.groups, suppressions: a.statuses, verdict,
+        ...(aborted?.kind === 'timeout' ? { timedOut: true } : {}), ...(aborted?.kind === 'cancelled' ? { cancelled: aborted.text } : {}),
+        bundles: state.bundles, traces: state.traces, artifacts,
+    };
+    const secrets = o.secretsNow();
+    const safe = redactTree(result, secrets);
+    const outputs = new Map();
+    outputs.set(CI_FILES.json, renderCi(safe, 'json', out));
+    for (const f of sel.formats)
+        if (f !== 'json')
+            outputs.set(CI_FILES[f], renderCi(safe, f, out));
+    if (scanForFiles) {
+        const rel = new Map([...scanFrames].map(([k, v]) => [k, v.replace(/^scan\//, '')]));
+        const abs = new Map([...scanFrames].map(([k, v]) => [k, join(out, v)]));
+        const stripStateFrames = (r) => ({ ...r, runs: r.runs.map((run) => ({ ...run, states: run.states.map(({ frame: _frame, ...s }) => s) })) });
+        const forHtml = redactTree({ ...stripStateFrames(scanForFiles), findings: withFrames(scanForFiles.findings, abs), reports: { html: join(out, 'scan', 'report.html'), json: join(out, 'scan', 'result.json') } }, secrets);
+        const forJson = redactTree({ ...stripStateFrames(scanForFiles), findings: withFrames(scanForFiles.findings, rel), reports: { html: 'report.html', json: 'result.json' } }, secrets);
+        outputs.set('scan/report.html', scanReportHtml(forHtml, join(out, 'scan')));
+        outputs.set('scan/result.json', JSON.stringify(forJson, null, 2) + '\n');
+    }
+    // Fail closed: nothing is written when a known secret value is still in any output.
+    const text = formatCiText(safe);
+    const leaked = Math.max(leakedSecrets(text, secrets), ...[...outputs.values()].map((t) => leakedSecrets(t, secrets)));
+    if (leaked) {
+        throw new LabError('bundle_unsafe', `An output still contained ${leaked} secret value(s) after redaction; no result files were written`, { hint: 'This is a bug in agentlab: report it without attaching the run.' });
+    }
+    for (const [name, content] of outputs)
+        put(join(out, name), content);
+    if (!o.quiet) {
+        process.stdout.write(inv.json ? JSON.stringify(safe, null, 2) + '\n' : `${text}results: ${shownPath(out)}${sep}\n`);
+    }
+    return verdict.exitCode;
+}
+const shownPath = (p) => { const r = relative(process.cwd(), p); return r.startsWith('..') ? p : r || '.'; };
+// ---------- report ----------
+/** `agentlab report <out-dir|ci-result.json> [--format text|json|html|junit] [--out <file>]`: re-render a saved result. No browser. */
+export function runReport(target, format, outFile) {
+    const fail = (message) => { process.stderr.write(`agentlab: ${message}\n`); process.exit(EXIT.couldNotRun); };
+    if (!target)
+        return fail('report needs a results directory or a ci-result.json');
+    const f = format ?? 'text';
+    if (!['text', 'json', 'html', 'junit'].includes(f))
+        return fail('--format must be text, json, html or junit');
+    const path = resolve(target);
+    const file = existsSync(path) && statSync(path).isDirectory() ? join(path, CI_FILES.json) : path;
+    if (!existsSync(file))
+        return fail(`no CI result at ${file}`);
+    let result;
+    try {
+        result = parseCiResult(JSON.parse(readFileSync(file, 'utf8')));
+    }
+    catch (err) {
+        return fail(err instanceof SyntaxError ? `${file} is not valid JSON` : LabError.from(err).message);
+    }
+    const text = renderCi(result, f, dirname(file));
+    if (outFile)
+        put(resolve(outFile), text);
+    else
+        process.stdout.write(text);
+    process.exit(0);
+}
+//# sourceMappingURL=ci.js.map