ccqa 0.3.3 → 0.3.5

package/dist/bin/ccqa.mjs

@@ -4,7 +4,7 @@ import { Command } from "commander";
 import { accessSync, readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { access, mkdir, mkdtemp, readFile, readdir, rm, stat, unlink, writeFile } from "node:fs/promises";
-import { dirname, join, resolve } from "node:path";
+import { delimiter, dirname, join, resolve } from "node:path";
 import { query } from "@anthropic-ai/claude-agent-sdk";
 import matter from "gray-matter";
 import { spawn } from "node:child_process";
@@ -706,10 +706,10 @@ function bundledVitestConfigPath() {
 }
 //#endregion
 //#region src/runtime/spawn-vitest.ts
-const require = createRequire(import.meta.url);
+const require$1 = createRequire(import.meta.url);
 function resolveVitestBin() {
-	const pkgPath = require.resolve("vitest/package.json");
-	const pkg = require(pkgPath);
+	const pkgPath = require$1.resolve("vitest/package.json");
+	const pkg = require$1(pkgPath);
 	const binRel = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.vitest;
 	if (!binRel) throw new Error(`vitest package.json has no bin entry (resolved at ${pkgPath})`);
 	return resolve(dirname(pkgPath), binRel);
@@ -761,6 +761,88 @@ function waitExit(child) {
 	});
 }
 //#endregion
+//#region src/runtime/agent-browser-bin.ts
+const require = createRequire(import.meta.url);
+/**
+* Resolves the directory containing the `agent-browser` shim that npm/pnpm
+* exposes on PATH for the peer-installed package. Used by `ccqa trace` to
+* prepend this directory to PATH so the Claude subprocess can invoke
+* `agent-browser ...` without requiring a global install.
+*
+* Returns null if agent-browser cannot be resolved (peer not installed).
+*/
+function resolveAgentBrowserBinDir() {
+	let pkgJsonPath;
+	try {
+		pkgJsonPath = require.resolve("agent-browser/package.json");
+	} catch {
+		return null;
+	}
+	return join(dirname(pkgJsonPath), "node_modules", ".bin");
+}
+/**
+* Returns a PATH string with the agent-browser shim directory prepended,
+* so `agent-browser ...` resolves without a global install. Falls back to
+* the original PATH when the package can't be resolved.
+*/
+function pathWithAgentBrowserShim(currentPath) {
+	const path = currentPath ?? "";
+	const dir = resolveAgentBrowserBinDir();
+	if (!dir) return path;
+	if (path.split(delimiter).includes(dir)) return path;
+	return dir + delimiter + path;
+}
+//#endregion
+//#region src/runtime/env-vars.ts
+const ENV_VAR_RE = /\$\{([A-Z_][A-Z0-9_]*)\}|\$([A-Z_][A-Z0-9_]*)/g;
+/**
+* Returns true if the value contains at least one `$VAR` or `${VAR}` reference.
+*/
+function hasEnvRef(value) {
+	ENV_VAR_RE.lastIndex = 0;
+	return ENV_VAR_RE.test(value);
+}
+/**
+* Resolve every `$VAR` / `${VAR}` reference against the current process env.
+*
+* Missing variables expand to the empty string, mirroring `sh` behaviour.
+* Throwing would force ccqa to be invoked with every var set even for
+* unused setups, which is more user-hostile than letting the test fail
+* downstream with a clearer message ("login form rejected: empty password").
+*/
+function resolveEnvRefs(value) {
+	return value.replace(ENV_VAR_RE, (_, braced, plain) => {
+		const name = braced ?? plain ?? "";
+		return process.env[name] ?? "";
+	});
+}
+/**
+* Embed `$VAR` / `${VAR}` as a JS template-literal expression that reads
+* `process.env.VAR ?? ""` at runtime. Used by `ccqa generate` so the test
+* script never bakes in the secret value.
+*
+* Returns a JavaScript string-literal expression (template literal when env
+* refs are present, plain string literal otherwise).
+*
+* Examples:
+*   "${PASSWORD}"             -> '`${process.env.PASSWORD ?? ""}`'
+*   "user-${SUFFIX}@x.com"    -> '`user-${process.env.SUFFIX ?? ""}@x.com`'
+*   "literal value"           -> '"literal value"'
+*/
+function envRefsToJsExpression(value) {
+	if (!hasEnvRef(value)) return JSON.stringify(value);
+	const escaped = value.replace(/\\/g, "\\\\").replace(/`/g, "\\`").replace(/\$\{/g, (match, offset, source) => {
+		ENV_VAR_RE.lastIndex = 0;
+		let m;
+		while ((m = ENV_VAR_RE.exec(source)) !== null) if (m.index === offset) return "${";
+		return "\\${";
+	});
+	ENV_VAR_RE.lastIndex = 0;
+	return `\`${escaped.replace(ENV_VAR_RE, (_, braced, plain) => {
+		return `\${process.env.${braced ?? plain ?? ""} ?? ""}`;
+	})}\``;
+}
+//#endregion
 //#region src/cli/trace.ts
 const traceCommand = new Command("trace").argument("<feature/spec>", "Spec to trace (e.g. tasks/create-and-complete)").description("Run agent-browser, verify assertions, and record structured actions").action(async (specPath) => {
 	const { featureName, specName } = parseSpecPath(specPath);
@@ -801,7 +883,10 @@ async function runTrace(featureName, specName) {
 			"Grep",
 			"Glob"
 		],
-		env: { AGENT_BROWSER_SESSION: sessionName },
+		env: {
+			AGENT_BROWSER_SESSION: sessionName,
+			PATH: pathWithAgentBrowserShim(process.env["PATH"])
+		},
 		onAbAction: (abAction) => {
 			const action = parseAbAction(abAction);
 			if (action) traceActions.push(action);
@@ -857,7 +942,7 @@ async function runSetups(setups, sessionName) {
 		let script = await readFile(scriptPath, "utf-8").catch(() => {
 			throw new Error(`Setup test script not found: ${scriptPath}. Run \`ccqa generate-setup ${ref.name}\` first.`);
 		});
-		for (const [key, value] of Object.entries(ref.params ?? {})) script = script.replaceAll(`{{${key}}}`, value);
+		for (const [key, value] of Object.entries(ref.params ?? {})) script = script.replaceAll(`{{${key}}}`, resolveEnvRefs(value));
 		script = script.replace(/process\.env\.AGENT_BROWSER_SESSION\s*=\s*`.+`;/, `process.env.AGENT_BROWSER_SESSION = ${JSON.stringify(sessionName)};`);
 		const tmpPath = join(getSetupDir(ref.name), `_run.spec.ts`);
 		await writeFile(tmpPath, script, "utf-8");
@@ -1214,24 +1299,50 @@ async function loadSetupScripts(setups) {
 	return result;
 }
 /**
-* Extract the test body (lines inside the first test() block) from a setup test script.
+* Extract the test body (statements inside the test callback) from a setup
+* test script.
+*
+* Locates the first arrow callback (`=> {`) after a top-level `test(` call
+* and returns the text between the matching `{` and `}`. Handles both
+* single-line and multi-line `test(...)` formatting (the latter is what
+* prettier produces).
+*
+* Brace tracking is naive (string/regex/comment literals are not parsed
+* specially), but setup test scripts are themselves generated by ccqa and
+* follow a fixed shape, so this is sufficient in practice.
 */
 function extractTestBody(script) {
-	const lines = script.split("\n");
-	const startIdx = lines.findIndex((l) => /^\s*test\(/.test(l));
-	if (startIdx === -1) return "";
-	const bodyLines = [];
-	for (let i = startIdx + 1; i < lines.length; i++) {
-		if (/^\s*\}[\s,);]/.test(lines[i])) break;
-		bodyLines.push(lines[i]);
+	const testCallMatch = /\btest\s*\(/.exec(script);
+	if (!testCallMatch) return "";
+	const arrowIdx = script.indexOf("=> {", testCallMatch.index);
+	if (arrowIdx === -1) return "";
+	const bodyStart = arrowIdx + 4;
+	let depth = 1;
+	let i = bodyStart;
+	for (; i < script.length; i++) {
+		const ch = script[i];
+		if (ch === "{") depth++;
+		else if (ch === "}") {
+			depth--;
+			if (depth === 0) break;
+		}
 	}
-	return bodyLines.join("\n");
+	if (depth !== 0) return "";
+	return script.slice(bodyStart, i).replace(/^\n/, "").replace(/\n\s*$/, "");
 }
 function replacePlaceholders(body, params) {
 	let result = body;
-	for (const [key, value] of Object.entries(params)) result = result.replaceAll(`{{${key}}}`, value);
+	for (const [key, value] of Object.entries(params)) if (hasEnvRef(value)) {
+		const expr = envRefsToJsExpression(value);
+		const re = new RegExp(`(["'])\\{\\{${escapeRegExp(key)}\\}\\}\\1`, "g");
+		result = result.replace(re, expr);
+		result = result.replaceAll(`{{${key}}}`, value);
+	} else result = result.replaceAll(`{{${key}}}`, value);
 	return result;
 }
+function escapeRegExp(s) {
+	return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 async function autoFixWithLLM$1(script, failureLog) {
 	try {
 		const { result, isError } = await invokeClaudeStreaming({
@@ -1469,6 +1580,7 @@ async function runTraceSetup(name) {
 	await ensureCcqaDir();
 	const spec = parseSetupSpec(await readSetupSpecFile(name));
 	const resolvedSpec = replacePlaceholdersWithDummies(spec);
+	const secretsToScrub = buildSecretsToScrub(spec);
 	meta("setup", spec.title);
 	meta("steps", spec.steps.length);
 	if (spec.placeholders) meta("placeholders", Object.keys(spec.placeholders).join(", "));
@@ -1489,8 +1601,12 @@ async function runTraceSetup(name) {
 			"Grep",
 			"Glob"
 		],
+		env: {
+			PATH: pathWithAgentBrowserShim(process.env["PATH"]),
+			ANTHROPIC_API_KEY: ""
+		},
 		onAbAction: (abAction) => {
-			const action = parseAbAction(abAction);
+			const action = parseAbAction(scrubSecrets(abAction, secretsToScrub));
 			if (action) traceActions.push(action);
 		},
 		onAbActionFailed: () => {
@@ -1512,7 +1628,7 @@ async function runTraceSetup(name) {
 						if (routeStep.status === "FAILED") overallStatus = "failed";
 					}
 				} else if (trimmed.startsWith("AB_ACTION|snapshot|") || trimmed.startsWith("AB_ACTION|assert|")) {
-					const action = parseAbAction(trimmed);
+					const action = parseAbAction(scrubSecrets(trimmed, secretsToScrub));
 					if (action) traceActions.push(action);
 				}
 			}
@@ -1538,7 +1654,7 @@ function replacePlaceholdersWithDummies(spec) {
 	const dummies = spec.placeholders;
 	const resolve = (text) => {
 		let result = text;
-		for (const [key, def] of Object.entries(dummies)) result = result.replaceAll(`{{${key}}}`, def.dummy);
+		for (const [key, def] of Object.entries(dummies)) result = result.replaceAll(`{{${key}}}`, resolveEnvRefs(def.dummy));
 		return result;
 	};
 	return {
@@ -1550,6 +1666,38 @@ function replacePlaceholdersWithDummies(spec) {
 		}))
 	};
 }
+/**
+* Build the substitution map used to scrub real secret values out of
+* recorded actions before they are written to actions.json.
+*
+* For each placeholder whose dummy contains env refs, store
+*   <resolved-value> -> <original ${VAR} string>
+* so that an `ab fill ... <secret>` line records the placeholder string
+* instead of the secret. Empty resolved values are skipped — they would
+* otherwise replace incidental empty strings in the recorded actions.
+*/
+function buildSecretsToScrub(spec) {
+	const map = /* @__PURE__ */ new Map();
+	if (!spec.placeholders) return map;
+	const dummies = spec.placeholders;
+	for (const def of Object.values(dummies)) {
+		if (!hasEnvRef(def.dummy)) continue;
+		const resolved = resolveEnvRefs(def.dummy);
+		if (!resolved) continue;
+		map.set(resolved, def.dummy);
+	}
+	return map;
+}
+/** Replace every occurrence of a recorded secret with its `${VAR}` placeholder. */
+function scrubSecrets(line, secrets) {
+	if (secrets.size === 0) return line;
+	let result = line;
+	for (const [secret, placeholder] of secrets) {
+		if (!result.includes(secret)) continue;
+		result = result.split(secret).join(placeholder);
+	}
+	return result;
+}
 //#endregion
 //#region src/cli/generate-setup.ts
 const generateSetupCommand = new Command("generate-setup").argument("<name>", "Setup name to generate (e.g. login)").description("Clean up, validate, and templatize setup actions").option("--max-retries <n>", "Maximum number of auto-fix retries", "3").option("--from-dummy", "Resume from existing test.dummy.spec.ts (after manual fix)").action(async (name, opts) => {
@@ -1578,7 +1726,7 @@ async function runGenerateSetup(name, maxRetries, fromDummy) {
 		meta("saved", dummyPath);
 	}
 	blank();
-	let { exitCode, output, currentScript } = await runVitest(dummyPath);
+	let { exitCode, output, currentScript } = await runVitestResolved(dummyPath);
 	if (exitCode !== 0) {
 		for (let attempt = 1; attempt <= maxRetries; attempt++) {
 			info(`auto-fix attempt ${attempt}/${maxRetries}...`);
@@ -1591,7 +1739,7 @@ async function runGenerateSetup(name, maxRetries, fromDummy) {
 			await writeFile(dummyPath, fixed, "utf-8");
 			meta("saved", dummyPath);
 			blank();
-			({exitCode, output, currentScript} = await runVitest(dummyPath));
+			({exitCode, output, currentScript} = await runVitestResolved(dummyPath));
 			if (exitCode === 0) break;
 		}
 		if (exitCode !== 0) {
@@ -1662,6 +1810,36 @@ async function runVitest(scriptPath) {
 		currentScript
 	};
 }
+/**
+* Run vitest on `test.dummy.spec.ts`, but transparently expand any `${VAR}`
+* env refs to real values for the duration of the run. The original file is
+* preserved unchanged so subsequent reverse-replace still sees the env-ref
+* literals. Auto-fix edits the original file (via writeFile in callers), so
+* we always re-read it before each invocation.
+*/
+async function runVitestResolved(scriptPath) {
+	const original = await readFile(scriptPath, "utf8");
+	if (!hasEnvRef(original)) return runVitest(scriptPath);
+	const tmpPath = scriptPath.replace(/\.ts$/, ".__resolved.spec.ts");
+	await writeFile(tmpPath, resolveEnvRefs(original), "utf-8");
+	try {
+		const { exitCode, stdout, stderr } = await spawnVitestCaptured([
+			"run",
+			"--config",
+			bundledVitestConfigPath(),
+			tmpPath
+		]);
+		process.stdout.write(stdout);
+		if (stderr) process.stderr.write(stderr);
+		return {
+			exitCode,
+			output: stdout + stderr,
+			currentScript: original
+		};
+	} finally {
+		await unlink(tmpPath).catch(() => {});
+	}
+}
 async function cleanupActions(actions) {
 	try {
 		const { result, isError } = await invokeClaudeStreaming({

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccqa",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "type": "module",
   "description": "Browser test recorder powered by Claude Code and agent-browser",
   "repository": {

package/dist/runtime/test-helpers.mjs

@@ -2,7 +2,31 @@ import { createRequire } from "node:module";
 import { spawnSync } from "node:child_process";
 //#region src/runtime/test-helpers.ts
 const AB = createRequire(import.meta.url).resolve("agent-browser/bin/agent-browser.js");
-function spawnAB(args) {
+const EAGAIN_PATTERN = /Resource temporarily unavailable|os error 35/i;
+const EAGAIN_TOTAL_BUDGET_MS = 3e4;
+const EAGAIN_BACKOFF_MS = [
+	100,
+	200,
+	300,
+	500,
+	700,
+	1e3,
+	1500,
+	2e3,
+	2500,
+	3e3,
+	3e3,
+	3e3,
+	3e3,
+	3e3,
+	3e3
+];
+const POST_OPEN_SETTLE_MS = 600;
+function sleepSync(ms) {
+	const buf = new SharedArrayBuffer(4);
+	Atomics.wait(new Int32Array(buf), 0, 0, ms);
+}
+function spawnABOnce(args) {
 	const result = spawnSync(AB, args, { stdio: "pipe" });
 	return {
 		status: result.status,
@@ -10,6 +34,21 @@ function spawnAB(args) {
 		stderr: result.stderr?.toString() ?? ""
 	};
 }
+function spawnAB(args) {
+	let result = spawnABOnce(args);
+	let elapsed = 0;
+	let attempt = 0;
+	while (result.status !== 0 && elapsed < EAGAIN_TOTAL_BUDGET_MS) {
+		const combined = `${result.stdout}\n${result.stderr}`;
+		if (!EAGAIN_PATTERN.test(combined)) return result;
+		const wait = EAGAIN_BACKOFF_MS[attempt] ?? 3e3;
+		sleepSync(wait);
+		elapsed += wait;
+		attempt++;
+		result = spawnABOnce(args);
+	}
+	return result;
+}
 function logStep(action, args) {
 	const pretty = args.map((a) => typeof a === "string" ? a : JSON.stringify(a)).join("  ");
 	process.stdout.write(`  ▶ ${action.padEnd(14)} ${pretty}\n`);
@@ -25,6 +64,7 @@ function ab(...args) {
 	logStep(command, rest);
 	const result = spawnAB(args);
 	if (result.status !== 0) fail(`agent-browser ${command} failed (exit ${result.status})`, result);
+	if (command === "open") sleepSync(POST_OPEN_SETTLE_MS);
 }
 /** Wait for element/text with an explicit timeout so long-running async ops don't hang. */
 function abWait(selector, timeoutMs = 18e4) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccqa",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "type": "module",
   "description": "Browser test recorder powered by Claude Code and agent-browser",
   "repository": {