ccqa 0.3.4 → 0.3.5

package/dist/bin/ccqa.mjs

@@ -793,6 +793,56 @@ function pathWithAgentBrowserShim(currentPath) {
 	return dir + delimiter + path;
 }
 //#endregion
+//#region src/runtime/env-vars.ts
+const ENV_VAR_RE = /\$\{([A-Z_][A-Z0-9_]*)\}|\$([A-Z_][A-Z0-9_]*)/g;
+/**
+* Returns true if the value contains at least one `$VAR` or `${VAR}` reference.
+*/
+function hasEnvRef(value) {
+	ENV_VAR_RE.lastIndex = 0;
+	return ENV_VAR_RE.test(value);
+}
+/**
+* Resolve every `$VAR` / `${VAR}` reference against the current process env.
+*
+* Missing variables expand to the empty string, mirroring `sh` behaviour.
+* Throwing would force ccqa to be invoked with every var set even for
+* unused setups, which is more user-hostile than letting the test fail
+* downstream with a clearer message ("login form rejected: empty password").
+*/
+function resolveEnvRefs(value) {
+	return value.replace(ENV_VAR_RE, (_, braced, plain) => {
+		const name = braced ?? plain ?? "";
+		return process.env[name] ?? "";
+	});
+}
+/**
+* Embed `$VAR` / `${VAR}` as a JS template-literal expression that reads
+* `process.env.VAR ?? ""` at runtime. Used by `ccqa generate` so the test
+* script never bakes in the secret value.
+*
+* Returns a JavaScript string-literal expression (template literal when env
+* refs are present, plain string literal otherwise).
+*
+* Examples:
+*   "${PASSWORD}"             -> '`${process.env.PASSWORD ?? ""}`'
+*   "user-${SUFFIX}@x.com"    -> '`user-${process.env.SUFFIX ?? ""}@x.com`'
+*   "literal value"           -> '"literal value"'
+*/
+function envRefsToJsExpression(value) {
+	if (!hasEnvRef(value)) return JSON.stringify(value);
+	const escaped = value.replace(/\\/g, "\\\\").replace(/`/g, "\\`").replace(/\$\{/g, (match, offset, source) => {
+		ENV_VAR_RE.lastIndex = 0;
+		let m;
+		while ((m = ENV_VAR_RE.exec(source)) !== null) if (m.index === offset) return "${";
+		return "\\${";
+	});
+	ENV_VAR_RE.lastIndex = 0;
+	return `\`${escaped.replace(ENV_VAR_RE, (_, braced, plain) => {
+		return `\${process.env.${braced ?? plain ?? ""} ?? ""}`;
+	})}\``;
+}
+//#endregion
 //#region src/cli/trace.ts
 const traceCommand = new Command("trace").argument("<feature/spec>", "Spec to trace (e.g. tasks/create-and-complete)").description("Run agent-browser, verify assertions, and record structured actions").action(async (specPath) => {
 	const { featureName, specName } = parseSpecPath(specPath);
@@ -892,7 +942,7 @@ async function runSetups(setups, sessionName) {
 		let script = await readFile(scriptPath, "utf-8").catch(() => {
 			throw new Error(`Setup test script not found: ${scriptPath}. Run \`ccqa generate-setup ${ref.name}\` first.`);
 		});
-		for (const [key, value] of Object.entries(ref.params ?? {})) script = script.replaceAll(`{{${key}}}`, value);
+		for (const [key, value] of Object.entries(ref.params ?? {})) script = script.replaceAll(`{{${key}}}`, resolveEnvRefs(value));
 		script = script.replace(/process\.env\.AGENT_BROWSER_SESSION\s*=\s*`.+`;/, `process.env.AGENT_BROWSER_SESSION = ${JSON.stringify(sessionName)};`);
 		const tmpPath = join(getSetupDir(ref.name), `_run.spec.ts`);
 		await writeFile(tmpPath, script, "utf-8");
@@ -1282,9 +1332,17 @@ function extractTestBody(script) {
 }
 function replacePlaceholders(body, params) {
 	let result = body;
-	for (const [key, value] of Object.entries(params)) result = result.replaceAll(`{{${key}}}`, value);
+	for (const [key, value] of Object.entries(params)) if (hasEnvRef(value)) {
+		const expr = envRefsToJsExpression(value);
+		const re = new RegExp(`(["'])\\{\\{${escapeRegExp(key)}\\}\\}\\1`, "g");
+		result = result.replace(re, expr);
+		result = result.replaceAll(`{{${key}}}`, value);
+	} else result = result.replaceAll(`{{${key}}}`, value);
 	return result;
 }
+function escapeRegExp(s) {
+	return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 async function autoFixWithLLM$1(script, failureLog) {
 	try {
 		const { result, isError } = await invokeClaudeStreaming({
@@ -1522,6 +1580,7 @@ async function runTraceSetup(name) {
 	await ensureCcqaDir();
 	const spec = parseSetupSpec(await readSetupSpecFile(name));
 	const resolvedSpec = replacePlaceholdersWithDummies(spec);
+	const secretsToScrub = buildSecretsToScrub(spec);
 	meta("setup", spec.title);
 	meta("steps", spec.steps.length);
 	if (spec.placeholders) meta("placeholders", Object.keys(spec.placeholders).join(", "));
@@ -1542,8 +1601,12 @@ async function runTraceSetup(name) {
 			"Grep",
 			"Glob"
 		],
+		env: {
+			PATH: pathWithAgentBrowserShim(process.env["PATH"]),
+			ANTHROPIC_API_KEY: ""
+		},
 		onAbAction: (abAction) => {
-			const action = parseAbAction(abAction);
+			const action = parseAbAction(scrubSecrets(abAction, secretsToScrub));
 			if (action) traceActions.push(action);
 		},
 		onAbActionFailed: () => {
@@ -1565,7 +1628,7 @@ async function runTraceSetup(name) {
 						if (routeStep.status === "FAILED") overallStatus = "failed";
 					}
 				} else if (trimmed.startsWith("AB_ACTION|snapshot|") || trimmed.startsWith("AB_ACTION|assert|")) {
-					const action = parseAbAction(trimmed);
+					const action = parseAbAction(scrubSecrets(trimmed, secretsToScrub));
 					if (action) traceActions.push(action);
 				}
 			}
@@ -1591,7 +1654,7 @@ function replacePlaceholdersWithDummies(spec) {
 	const dummies = spec.placeholders;
 	const resolve = (text) => {
 		let result = text;
-		for (const [key, def] of Object.entries(dummies)) result = result.replaceAll(`{{${key}}}`, def.dummy);
+		for (const [key, def] of Object.entries(dummies)) result = result.replaceAll(`{{${key}}}`, resolveEnvRefs(def.dummy));
 		return result;
 	};
 	return {
@@ -1603,6 +1666,38 @@ function replacePlaceholdersWithDummies(spec) {
 		}))
 	};
 }
+/**
+* Build the substitution map used to scrub real secret values out of
+* recorded actions before they are written to actions.json.
+*
+* For each placeholder whose dummy contains env refs, store
+*   <resolved-value> -> <original ${VAR} string>
+* so that an `ab fill ... <secret>` line records the placeholder string
+* instead of the secret. Empty resolved values are skipped — they would
+* otherwise replace incidental empty strings in the recorded actions.
+*/
+function buildSecretsToScrub(spec) {
+	const map = /* @__PURE__ */ new Map();
+	if (!spec.placeholders) return map;
+	const dummies = spec.placeholders;
+	for (const def of Object.values(dummies)) {
+		if (!hasEnvRef(def.dummy)) continue;
+		const resolved = resolveEnvRefs(def.dummy);
+		if (!resolved) continue;
+		map.set(resolved, def.dummy);
+	}
+	return map;
+}
+/** Replace every occurrence of a recorded secret with its `${VAR}` placeholder. */
+function scrubSecrets(line, secrets) {
+	if (secrets.size === 0) return line;
+	let result = line;
+	for (const [secret, placeholder] of secrets) {
+		if (!result.includes(secret)) continue;
+		result = result.split(secret).join(placeholder);
+	}
+	return result;
+}
 //#endregion
 //#region src/cli/generate-setup.ts
 const generateSetupCommand = new Command("generate-setup").argument("<name>", "Setup name to generate (e.g. login)").description("Clean up, validate, and templatize setup actions").option("--max-retries <n>", "Maximum number of auto-fix retries", "3").option("--from-dummy", "Resume from existing test.dummy.spec.ts (after manual fix)").action(async (name, opts) => {
@@ -1631,7 +1726,7 @@ async function runGenerateSetup(name, maxRetries, fromDummy) {
 		meta("saved", dummyPath);
 	}
 	blank();
-	let { exitCode, output, currentScript } = await runVitest(dummyPath);
+	let { exitCode, output, currentScript } = await runVitestResolved(dummyPath);
 	if (exitCode !== 0) {
 		for (let attempt = 1; attempt <= maxRetries; attempt++) {
 			info(`auto-fix attempt ${attempt}/${maxRetries}...`);
@@ -1644,7 +1739,7 @@ async function runGenerateSetup(name, maxRetries, fromDummy) {
 			await writeFile(dummyPath, fixed, "utf-8");
 			meta("saved", dummyPath);
 			blank();
-			({exitCode, output, currentScript} = await runVitest(dummyPath));
+			({exitCode, output, currentScript} = await runVitestResolved(dummyPath));
 			if (exitCode === 0) break;
 		}
 		if (exitCode !== 0) {
@@ -1715,6 +1810,36 @@ async function runVitest(scriptPath) {
 		currentScript
 	};
 }
+/**
+* Run vitest on `test.dummy.spec.ts`, but transparently expand any `${VAR}`
+* env refs to real values for the duration of the run. The original file is
+* preserved unchanged so subsequent reverse-replace still sees the env-ref
+* literals. Auto-fix edits the original file (via writeFile in callers), so
+* we always re-read it before each invocation.
+*/
+async function runVitestResolved(scriptPath) {
+	const original = await readFile(scriptPath, "utf8");
+	if (!hasEnvRef(original)) return runVitest(scriptPath);
+	const tmpPath = scriptPath.replace(/\.ts$/, ".__resolved.spec.ts");
+	await writeFile(tmpPath, resolveEnvRefs(original), "utf-8");
+	try {
+		const { exitCode, stdout, stderr } = await spawnVitestCaptured([
+			"run",
+			"--config",
+			bundledVitestConfigPath(),
+			tmpPath
+		]);
+		process.stdout.write(stdout);
+		if (stderr) process.stderr.write(stderr);
+		return {
+			exitCode,
+			output: stdout + stderr,
+			currentScript: original
+		};
+	} finally {
+		await unlink(tmpPath).catch(() => {});
+	}
+}
 async function cleanupActions(actions) {
 	try {
 		const { result, isError } = await invokeClaudeStreaming({

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccqa",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "type": "module",
   "description": "Browser test recorder powered by Claude Code and agent-browser",
   "repository": {

package/dist/runtime/test-helpers.mjs

@@ -3,12 +3,25 @@ import { spawnSync } from "node:child_process";
 //#region src/runtime/test-helpers.ts
 const AB = createRequire(import.meta.url).resolve("agent-browser/bin/agent-browser.js");
 const EAGAIN_PATTERN = /Resource temporarily unavailable|os error 35/i;
-const EAGAIN_RETRIES = 3;
+const EAGAIN_TOTAL_BUDGET_MS = 3e4;
 const EAGAIN_BACKOFF_MS = [
+	100,
 	200,
+	300,
 	500,
-	1e3
+	700,
+	1e3,
+	1500,
+	2e3,
+	2500,
+	3e3,
+	3e3,
+	3e3,
+	3e3,
+	3e3,
+	3e3
 ];
+const POST_OPEN_SETTLE_MS = 600;
 function sleepSync(ms) {
 	const buf = new SharedArrayBuffer(4);
 	Atomics.wait(new Int32Array(buf), 0, 0, ms);
@@ -23,11 +36,15 @@ function spawnABOnce(args) {
 }
 function spawnAB(args) {
 	let result = spawnABOnce(args);
-	for (let attempt = 0; attempt < EAGAIN_RETRIES; attempt++) {
-		if (result.status === 0) return result;
+	let elapsed = 0;
+	let attempt = 0;
+	while (result.status !== 0 && elapsed < EAGAIN_TOTAL_BUDGET_MS) {
 		const combined = `${result.stdout}\n${result.stderr}`;
 		if (!EAGAIN_PATTERN.test(combined)) return result;
-		sleepSync(EAGAIN_BACKOFF_MS[attempt] ?? 1e3);
+		const wait = EAGAIN_BACKOFF_MS[attempt] ?? 3e3;
+		sleepSync(wait);
+		elapsed += wait;
+		attempt++;
 		result = spawnABOnce(args);
 	}
 	return result;
@@ -47,6 +64,7 @@ function ab(...args) {
 	logStep(command, rest);
 	const result = spawnAB(args);
 	if (result.status !== 0) fail(`agent-browser ${command} failed (exit ${result.status})`, result);
+	if (command === "open") sleepSync(POST_OPEN_SETTLE_MS);
 }
 /** Wait for element/text with an explicit timeout so long-running async ops don't hang. */
 function abWait(selector, timeoutMs = 18e4) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccqa",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "type": "module",
   "description": "Browser test recorder powered by Claude Code and agent-browser",
   "repository": {