badgr-cli 1.0.48 → 1.1.0

package/tests/launch-command-argv.test.js

@@ -0,0 +1,93 @@
+/**
+ * badgr launch — the task must reach the agent as a real argument array
+ * (opts.cmdArgv), never a shell string. Covers the exact tricky-task list
+ * from the "fix multi-word tasks permanently" spec: spaces, apostrophes,
+ * embedded quotes, `--`, Unicode, and shell metacharacters must all survive
+ * as exactly one array element, since there's no shell in this path at all.
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+vi.mock('../src/credentials.js', () => ({
+  getCredential: vi.fn(() => 'stored-credential'),
+  setCredential: vi.fn(),
+  PROVIDER_ENV_KEYS: { anthropic: 'ANTHROPIC_API_KEY', openai: 'OPENAI_API_KEY' },
+}));
+
+const runCommandMock = vi.fn();
+vi.mock('../src/commands/run.js', async (importOriginal) => {
+  const actual = await importOriginal();
+  return { ...actual, runCommand: (...args) => runCommandMock(...args) };
+});
+
+const { launchCommand } = await import('../src/commands/launch.js');
+
+const chalk = { red: s => s, dim: s => s, green: s => s, bold: s => s, yellow: s => s, cyan: s => s };
+const config = { apiKey: 'test-key', baseUrl: 'https://example.test/v1' };
+
+const TRICKY_TASKS = [
+  'Fix the checkout bug',
+  "Fix John's checkout bug",
+  'Fix "checkout" validation',
+  'Fix checkout -- do not modify billing',
+  'Fix café checkout',
+  'Fix $(echo dangerous)',
+  'Fix checkout; rm -rf something',
+];
+
+beforeEach(() => {
+  process.exitCode = undefined;
+  vi.spyOn(console, 'log').mockImplementation(() => {});
+  vi.spyOn(console, 'error').mockImplementation(() => {});
+  runCommandMock.mockClear();
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+  process.exitCode = undefined;
+});
+
+describe('badgr launch <agent> "<task>" — task transport', () => {
+  for (const task of TRICKY_TASKS) {
+    it(`claude: passes ${JSON.stringify(task)} through as one argv element, not a shell string`, async () => {
+      await launchCommand(config, ['claude', task], chalk);
+
+      expect(runCommandMock).toHaveBeenCalledTimes(1);
+      const [, , , opts] = runCommandMock.mock.calls[0];
+      expect(opts.cmdArgv).toEqual(['claude', '-p', task]);
+    });
+
+    it(`codex: passes ${JSON.stringify(task)} through as one argv element, not a shell string`, async () => {
+      await launchCommand(config, ['codex', task], chalk);
+
+      const [, , , opts] = runCommandMock.mock.calls[0];
+      expect(opts.cmdArgv).toEqual(['badgr-codex-run', task]);
+    });
+
+    it(`cline: passes ${JSON.stringify(task)} through as one argv element, not a shell string`, async () => {
+      await launchCommand(config, ['cline', task], chalk);
+
+      const [, , , opts] = runCommandMock.mock.calls[0];
+      expect(opts.cmdArgv).toEqual(['badgr-cline-run', task]);
+    });
+  }
+
+  it('single-word tasks continue working', async () => {
+    await launchCommand(config, ['claude', 'hello'], chalk);
+    const [, , , opts] = runCommandMock.mock.calls[0];
+    expect(opts.cmdArgv).toEqual(['claude', '-p', 'hello']);
+  });
+
+  it('explicit `-- <command>` form passes the real array through, not a joined string', async () => {
+    await launchCommand(config, ['.', '--', 'codex', 'exec', 'Fix the checkout bug'], chalk);
+
+    expect(runCommandMock).toHaveBeenCalledTimes(1);
+    const [, , , opts] = runCommandMock.mock.calls[0];
+    expect(opts.cmdArgv).toEqual(['codex', 'exec', 'Fix the checkout bug']);
+  });
+
+  it('playwright (no natural-language task) still launches via an argv array', async () => {
+    await launchCommand(config, ['playwright'], chalk);
+    const [, , , opts] = runCommandMock.mock.calls[0];
+    expect(opts.cmdArgv).toEqual(['npx', 'playwright', 'test', '--reporter=line,html', '--trace=retain-on-failure']);
+  });
+});

package/tests/launch-readiness.test.js

@@ -67,6 +67,7 @@ function makeTerminatedDep(overrides = {}) {
     started_at:    STARTED,
     stopped_at:    NOW,
     status:        'stopped',
+    teardown_ok:   'ok',
     ...overrides,
   };
 }

package/tests/launch.test.js

@@ -0,0 +1,440 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+const credentialStore = {};
+vi.mock('../src/credentials.js', () => ({
+  getCredential: vi.fn(provider => credentialStore[provider] ?? null),
+  setCredential: vi.fn((provider, value) => { credentialStore[provider] = value; }),
+  PROVIDER_ENV_KEYS: { anthropic: 'ANTHROPIC_API_KEY', openai: 'OPENAI_API_KEY' },
+}));
+
+const mockPassword = vi.fn();
+vi.mock('@inquirer/prompts', () => ({ password: (...args) => mockPassword(...args) }));
+
+const { launchCommand, DEFAULT_LAUNCH_MAX_COST } = await import('../src/commands/launch.js');
+
+const chalk = { red: s => s, dim: s => s, green: s => s, bold: s => s, yellow: s => s, cyan: s => s };
+const config = { apiKey: 'test-key', baseUrl: 'https://example.test/v1' };
+
+describe('launchCommand', () => {
+  let originalStdinTTY;
+  let originalStdoutTTY;
+
+  beforeEach(() => {
+    process.exitCode = undefined;
+    vi.spyOn(console, 'log').mockImplementation(() => {});
+    vi.spyOn(console, 'error').mockImplementation(() => {});
+    for (const k of Object.keys(credentialStore)) delete credentialStore[k];
+    mockPassword.mockReset();
+    originalStdinTTY = process.stdin.isTTY;
+    originalStdoutTTY = process.stdout.isTTY;
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+    process.exitCode = undefined;
+    process.stdin.isTTY = originalStdinTTY;
+    process.stdout.isTTY = originalStdoutTTY;
+  });
+
+  it('requires an agent, task, or source', async () => {
+    await launchCommand(config, [], chalk);
+    expect(process.exitCode).toBe(1);
+  });
+
+  describe('cline — Badgr-native, no credential required', () => {
+    it('resolves image and command with no connect step', async () => {
+      await launchCommand(config, ['cline', '--dry-run', 'Fix the checkout bug'], chalk);
+      expect(process.exitCode).toBeUndefined();
+      const logged = console.log.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(logged).toContain("badgr-cline-run Fix the checkout bug");
+      expect(logged).toContain('ghcr.io/michaelmanly/badgr-agent-cline:latest');
+      expect(logged).not.toContain('Env:');
+    });
+
+    it('requires a task', async () => {
+      await launchCommand(config, ['cline'], chalk);
+      expect(process.exitCode).toBe(1);
+    });
+  });
+
+  describe('claude — bring-your-own Anthropic', () => {
+    it('requires a connected credential', async () => {
+      await launchCommand(config, ['claude', 'Fix the checkout bug'], chalk);
+      expect(process.exitCode).toBe(1);
+      const logged = console.error.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(logged).toContain('badgr connect anthropic');
+    });
+
+    it('resolves image, command, and injects the stored credential once connected', async () => {
+      credentialStore.anthropic = 'sk-ant-fake';
+      await launchCommand(config, ['claude', '--dry-run', 'Fix the checkout bug'], chalk);
+      expect(process.exitCode).toBeUndefined();
+      const logged = console.log.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(logged).toContain("claude -p Fix the checkout bug");
+      expect(logged).toContain('ghcr.io/michaelmanly/badgr-agent-claude:latest');
+    });
+
+    it('never prints the credential value — Env line is redacted', async () => {
+      credentialStore.anthropic = 'sk-ant-super-secret';
+      await launchCommand(config, ['claude', '--dry-run', 'Fix the checkout bug'], chalk);
+      const logged = console.log.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(logged).not.toContain('sk-ant-super-secret');
+      expect(logged).toContain('ANTHROPIC_API_KEY=<redacted>');
+    });
+
+    it('an explicit --env wins over a stored credential for the same key (no duplicate, no override)', async () => {
+      credentialStore.anthropic = 'sk-ant-stored';
+      await launchCommand(config, [
+        'claude', '--dry-run', '--env', 'ANTHROPIC_API_KEY=sk-ant-explicit', 'Fix the checkout bug',
+      ], chalk);
+      expect(process.exitCode).toBeUndefined();
+      const logged = console.log.mock.calls.map(c => c.join(' ')).join('\n');
+      expect((logged.match(/ANTHROPIC_API_KEY=/g) || []).length).toBe(1);
+    });
+
+    it('an already-set --env credential skips the connect requirement', async () => {
+      await launchCommand(config, [
+        'claude', '--dry-run', '--env', 'ANTHROPIC_API_KEY=sk-ant-from-env', 'Fix the checkout bug',
+      ], chalk);
+      expect(process.exitCode).toBeUndefined();
+    });
+
+    it('requires a task', async () => {
+      credentialStore.anthropic = 'sk-ant-fake';
+      await launchCommand(config, ['claude'], chalk);
+      expect(process.exitCode).toBe(1);
+    });
+  });
+
+  describe('codex — bring-your-own OpenAI', () => {
+    it('requires a connected credential', async () => {
+      await launchCommand(config, ['codex', 'Write tests'], chalk);
+      expect(process.exitCode).toBe(1);
+      const logged = console.error.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(logged).toContain('badgr connect openai');
+    });
+
+    it('resolves image and command once connected', async () => {
+      credentialStore.openai = 'sk-fake';
+      await launchCommand(config, ['codex', '--dry-run', 'Write tests'], chalk);
+      expect(process.exitCode).toBeUndefined();
+      const logged = console.log.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(logged).toContain("badgr-codex-run Write tests");
+      expect(logged).toContain('ghcr.io/michaelmanly/badgr-agent-codex:latest');
+    });
+  });
+
+  describe('inline credential prompt — interactive terminal, missing credential', () => {
+    beforeEach(() => {
+      process.stdin.isTTY = true;
+      process.stdout.isTTY = true;
+    });
+
+    it('prompts for the key, stores it, and continues the same launch — no separate badgr connect + rerun needed', async () => {
+      mockPassword.mockResolvedValue('sk-ant-typed-inline');
+      await launchCommand(config, ['claude', '--dry-run', 'Fix the checkout bug'], chalk);
+      expect(process.exitCode).toBeUndefined();
+      expect(mockPassword).toHaveBeenCalledTimes(1);
+      expect(credentialStore.anthropic).toBe('sk-ant-typed-inline');
+      const logged = console.log.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(logged).toContain("claude -p Fix the checkout bug");
+      expect(logged).not.toContain('sk-ant-typed-inline'); // redacted, not just stored
+    });
+
+    it('same inline prompt for codex/OpenAI', async () => {
+      mockPassword.mockResolvedValue('sk-openai-typed-inline');
+      await launchCommand(config, ['codex', '--dry-run', 'Write tests'], chalk);
+      expect(process.exitCode).toBeUndefined();
+      expect(credentialStore.openai).toBe('sk-openai-typed-inline');
+    });
+
+    it('fails cleanly if the user cancels the prompt (Ctrl+C) instead of hanging', async () => {
+      mockPassword.mockRejectedValue(new Error('User force closed the prompt'));
+      await launchCommand(config, ['claude', '--dry-run', 'Fix the checkout bug'], chalk);
+      expect(process.exitCode).toBe(1);
+      expect(credentialStore.anthropic).toBeUndefined();
+    });
+
+    it('fails cleanly on an empty key instead of storing it', async () => {
+      mockPassword.mockResolvedValue('   ');
+      await launchCommand(config, ['claude', '--dry-run', 'Fix the checkout bug'], chalk);
+      expect(process.exitCode).toBe(1);
+      expect(credentialStore.anthropic).toBeUndefined();
+    });
+
+    it('does not prompt at all once a credential is already stored', async () => {
+      credentialStore.anthropic = 'sk-ant-already-stored';
+      await launchCommand(config, ['claude', '--dry-run', 'Fix the checkout bug'], chalk);
+      expect(mockPassword).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('playwright — no credential, task is a display label only', () => {
+    it('resolves image and the default test command with no task given', async () => {
+      await launchCommand(config, ['playwright', '--dry-run'], chalk);
+      expect(process.exitCode).toBeUndefined();
+      const logged = console.log.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(logged).toContain('npx playwright test --reporter=line,html --trace=retain-on-failure');
+      expect(logged).toContain('ghcr.io/michaelmanly/badgr-agent-playwright:latest');
+      // The only env Badgr sets automatically is the stable HTML report dir
+      // (makes report output deterministic) — no credentials involved.
+      expect(logged).toContain('PLAYWRIGHT_HTML_OUTPUT_DIR=playwright-report');
+    });
+
+    it('accepts a task string but does not change the command it runs', async () => {
+      await launchCommand(config, ['playwright', '--dry-run', 'Test the checkout flow'], chalk);
+      expect(process.exitCode).toBeUndefined();
+      const logged = console.log.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(logged).toContain('npx playwright test');
+      expect(logged).not.toContain('Test the checkout flow --');
+    });
+
+    it('automatically declares playwright-report/test-results as artifacts', async () => {
+      await launchCommand(config, ['playwright', '--dry-run'], chalk);
+      const logged = console.log.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(logged).toContain('Artifacts:');
+      expect(logged).toContain('playwright-report, test-results');
+    });
+
+    it('an explicit --artifacts overrides the automatic default instead of merging with it', async () => {
+      await launchCommand(config, ['playwright', '--dry-run', '--artifacts', 'custom-report'], chalk);
+      const logged = console.log.mock.calls.map(c => c.join(' ')).join('\n');
+      const artifactsLine = logged.split('\n').find(l => l.includes('Artifacts:'));
+      expect(logged).toContain('custom-report');
+      expect(artifactsLine).not.toContain('playwright-report');
+    });
+
+    it('never requires badgr connect', async () => {
+      await launchCommand(config, ['playwright', '--dry-run'], chalk);
+      expect(process.exitCode).toBeUndefined();
+    });
+
+    it('applies the default max-cost like the other shorthand workloads', async () => {
+      await launchCommand(config, ['playwright', '--dry-run'], chalk);
+      const logged = console.log.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(logged).toMatch(new RegExp(`Max cost:\\s*\\$${DEFAULT_LAUNCH_MAX_COST}\\b`));
+    });
+  });
+
+  describe('VM class — deterministic workload → size default, --size override', () => {
+    it('defaults cline/claude/codex to the small VM class', async () => {
+      await launchCommand(config, ['cline', '--dry-run', 'Fix the checkout bug'], chalk);
+      const logged = console.log.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(logged).toContain('VM class:');
+      expect(logged).toContain('small (2 vCPU, 4 GB RAM)');
+    });
+
+    it('defaults playwright to the browser VM class', async () => {
+      await launchCommand(config, ['playwright', '--dry-run'], chalk);
+      const logged = console.log.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(logged).toContain('browser (4 vCPU, 8 GB RAM)');
+    });
+
+    it('--size overrides the default for an agent workload', async () => {
+      credentialStore.anthropic = 'sk-ant-fake';
+      await launchCommand(config, ['claude', '--dry-run', '--size', 'medium', 'Run the full suite'], chalk);
+      const logged = console.log.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(logged).toContain('medium (4 vCPU, 8 GB RAM)');
+    });
+
+    it('--size overrides the default for playwright', async () => {
+      await launchCommand(config, ['playwright', '--dry-run', '--size', 'medium'], chalk);
+      const logged = console.log.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(logged).toContain('medium (4 vCPU, 8 GB RAM)');
+      expect(logged).not.toContain('browser (');
+    });
+
+    it('rejects an unknown --size value', async () => {
+      await launchCommand(config, ['cline', '--dry-run', '--size', 'huge', 'Fix the checkout bug'], chalk);
+      expect(process.exitCode).toBe(1);
+      const logged = console.error.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(logged).toContain('Unknown --size "huge"');
+    });
+
+    it('defaults the explicit form to the small VM class too', async () => {
+      await launchCommand(config, ['.', '--max-cost', '1', '--dry-run', '--', 'npm', 'test'], chalk);
+      const logged = console.log.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(logged).toContain('small (2 vCPU, 4 GB RAM)');
+    });
+  });
+
+  describe('task-text safety — flags must never be reinterpreted from the task', () => {
+    it('a flag-shaped word inside the task reaches the agent unchanged', async () => {
+      await launchCommand(config, ['cline', '--dry-run', 'Fix', 'the', '--output', 'bug'], chalk);
+      expect(process.exitCode).toBeUndefined();
+      const logged = console.log.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(logged).toContain("badgr-cline-run Fix the --output bug");
+      expect(logged).not.toContain('Output:');
+    });
+
+    it('$vars, backticks, double quotes, and newlines in the task are preserved verbatim (no embedded single quote — see entrypoint.py tests for the full shlex round-trip including one)', async () => {
+      const task = 'Fix the bug with $DANGER and `whoami` and "double" and\nnewline';
+      await launchCommand(config, ['cline', '--dry-run', task], chalk);
+      expect(process.exitCode).toBeUndefined();
+      const logged = console.log.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(logged).toContain(task);
+    });
+
+    it('warns (non-blocking) when a flag-named token appears after the task instead of before it, without disabling a --dry-run that was already recognized', async () => {
+      await launchCommand(config, ['cline', '--dry-run', 'Fix checkout', '--max-cost', '5'], chalk);
+      expect(process.exitCode).toBeUndefined();
+      const errLogged = console.error.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(errLogged).toContain('appears inside the task text');
+      const out = console.log.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(out).toContain("badgr-cline-run Fix checkout --max-cost 5");
+      // The --max-cost that got swallowed into the task must NOT apply as the real cap.
+      expect(out).toMatch(new RegExp(`Max cost:\\s*\\$${DEFAULT_LAUNCH_MAX_COST}\\b`));
+    });
+
+    it('flags placed before the task are parsed normally, not swallowed', async () => {
+      await launchCommand(config, ['cline', '--max-cost', '9', '--dry-run', 'Fix checkout'], chalk);
+      expect(process.exitCode).toBeUndefined();
+      const logged = console.log.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(logged).toContain("badgr-cline-run Fix checkout");
+      expect(logged).toMatch(/Max cost:\s*\$9/);
+    });
+  });
+
+  describe('rejects --gpu (CPU-only)', () => {
+    it('for the agent shorthand', async () => {
+      await launchCommand(config, ['cline', '--gpu', 'A100', 'Fix checkout'], chalk);
+      expect(process.exitCode).toBe(1);
+    });
+
+    it('for the explicit form', async () => {
+      await launchCommand(config, ['.', '--gpu', 'A100', '--', 'npm', 'test'], chalk);
+      expect(process.exitCode).toBe(1);
+    });
+  });
+
+  describe('default max-cost', () => {
+    it('applies the $2 default and annotates it as a default', async () => {
+      await launchCommand(config, ['cline', '--dry-run', 'Fix checkout'], chalk);
+      const logged = console.log.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(logged).toMatch(new RegExp(`Max cost:\\s*\\$${DEFAULT_LAUNCH_MAX_COST}\\b`));
+      expect(logged).toContain('default — use --max-cost N to override');
+    });
+
+    it('an explicit --max-cost overrides the default', async () => {
+      await launchCommand(config, ['cline', '--dry-run', '--max-cost', '9', 'Fix checkout'], chalk);
+      const logged = console.log.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(logged).toMatch(/Max cost:\s*\$9/);
+      expect(logged).not.toContain('default —');
+    });
+  });
+
+  describe('explicit form — badgr launch <source> -- <command> (advanced escape hatch)', () => {
+    it('rejects an empty command after --', async () => {
+      await launchCommand(config, ['.', '--'], chalk);
+      expect(process.exitCode).toBe(1);
+    });
+
+    it('rejects both -- <command> and --cmd together', async () => {
+      await launchCommand(config, ['.', '--cmd', 'python x.py', '--', 'npm', 'test'], chalk);
+      expect(process.exitCode).toBe(1);
+    });
+
+    it('requires a command via -- or --cmd', async () => {
+      await launchCommand(config, ['https://github.com/user/repo'], chalk);
+      expect(process.exitCode).toBe(1);
+    });
+
+    it('accepts -- passthrough and forwards a CPU dry run for an arbitrary command', async () => {
+      await launchCommand(config, ['.', '--dry-run', '--max-cost', '1', '--', 'npm', 'test'], chalk);
+      expect(process.exitCode).toBeUndefined();
+      const logged = console.log.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(logged).toContain('Compute:');
+      expect(logged).toContain('CPU VM');
+      expect(logged).toContain('npm test');
+    });
+
+    it('accepts a quoted --cmd form', async () => {
+      await launchCommand(config, ['.', '--dry-run', '--cmd', 'python eval.py'], chalk);
+      expect(process.exitCode).toBeUndefined();
+      const logged = console.log.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(logged).toContain('python eval.py');
+    });
+
+    it('forwards repeated --artifacts paths through to the dry-run banner', async () => {
+      await launchCommand(config, [
+        '.', '--dry-run', '--max-cost', '1',
+        '--artifacts', 'playwright-report', '--artifacts', 'test-results',
+        '--', 'npx', 'playwright', 'test',
+      ], chalk);
+      expect(process.exitCode).toBeUndefined();
+      const logged = console.log.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(logged).toContain('Artifacts:');
+      expect(logged).toContain('playwright-report, test-results');
+    });
+
+    it('warns when --env carries a secret-shaped key (shell history exposure) and redacts its value', async () => {
+      await launchCommand(config, [
+        '.', '--dry-run', '--max-cost', '1',
+        '--env', 'ANTHROPIC_API_KEY=sk-ant-fake',
+        '--', 'npm', 'test',
+      ], chalk);
+      expect(process.exitCode).toBeUndefined();
+      const logged = console.log.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(logged).toContain('ANTHROPIC_API_KEY=<redacted>');
+      expect(logged).not.toContain('sk-ant-fake');
+      expect(logged).toContain('shell history');
+    });
+
+    it('accepts a GitHub URL as the source', async () => {
+      await launchCommand(config, ['https://github.com/user/repo', '--dry-run', '--max-cost', '1', '--', 'python', 'narrgo.py'], chalk);
+      expect(process.exitCode).toBeUndefined();
+      const logged = console.log.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(logged).toContain('https://github.com/user/repo');
+    });
+
+    it('rejects unexpected extra positional arguments after the source', async () => {
+      await launchCommand(config, ['.', 'extra-arg', '--dry-run', '--max-cost', '1', '--', 'npm', 'test'], chalk);
+      expect(process.exitCode).toBe(1);
+      const logged = console.error.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(logged).toContain('extra-arg');
+    });
+
+    it('forwards --image, --region, and --max-runtime through to the dry-run banner', async () => {
+      await launchCommand(config, [
+        '.', '--dry-run', '--max-cost', '1',
+        '--image', 'ghcr.io/aibadgr/custom:latest', '--region', 'eu', '--max-runtime', '30',
+        '--', 'npm', 'test',
+      ], chalk);
+      expect(process.exitCode).toBeUndefined();
+      const logged = console.log.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(logged).toContain('ghcr.io/aibadgr/custom:latest');
+      expect(logged).toContain('30min');
+    });
+
+    it('--no-detach is accepted without erroring on a dry run', async () => {
+      await launchCommand(config, ['.', '--dry-run', '--max-cost', '1', '--no-detach', '--', 'npm', 'test'], chalk);
+      expect(process.exitCode).toBeUndefined();
+    });
+
+    it('applies the default max-cost when not specified', async () => {
+      await launchCommand(config, ['.', '--dry-run', '--', 'npm', 'test'], chalk);
+      expect(process.exitCode).toBeUndefined();
+      const logged = console.log.mock.calls.map(c => c.join(' ')).join('\n');
+      expect(logged).toMatch(new RegExp(`Max cost:\\s*\\$${DEFAULT_LAUNCH_MAX_COST}\\b`));
+    });
+
+    describe('flag order — everything after -- is passthrough, not parsed', () => {
+      it('a flag placed AFTER -- is swallowed into the command, not applied as a Badgr flag', async () => {
+        await launchCommand(config, ['.', '--dry-run', '--', 'npm', 'test', '--max-cost', '1'], chalk);
+        expect(process.exitCode).toBeUndefined();
+        const logged = console.log.mock.calls.map(c => c.join(' ')).join('\n');
+        expect(logged).toContain('npm test --max-cost 1');
+        expect(logged).not.toMatch(/Max cost:\s*\$1\b/);
+      });
+
+      it('the same flag placed BEFORE -- is correctly applied as the spend cap', async () => {
+        await launchCommand(config, ['.', '--max-cost', '1', '--dry-run', '--', 'npm', 'test'], chalk);
+        expect(process.exitCode).toBeUndefined();
+        const logged = console.log.mock.calls.map(c => c.join(' ')).join('\n');
+        expect(logged).toContain('npm test');
+        expect(logged).not.toContain('npm test --max-cost 1');
+        expect(logged).toMatch(/Max cost:\s*\$1\b/);
+      });
+    });
+  });
+});