jetic-cli 0.1.9 → 0.2.0

package/dist/index.js

@@ -268088,6 +268088,13 @@ var require_workflow_simulator = __commonJS({
             const colonIdx = expr.indexOf(":");
             const scope = expr.slice(0, colonIdx);
             const key = expr.slice(colonIdx + 1);
+            if (scope === "human") {
+              const envVal = process.env[`JETIC_HUMAN_${key.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`];
+              if (envVal !== void 0 && envVal !== "") {
+                replacements.push({ placeholder: match[0], resolved: envVal });
+                continue;
+              }
+            }
             const mem = new memory_1.JeticMemory({ scope });
             const memVal = await mem.get(key);
             replacements.push({ placeholder: match[0], resolved: memVal != null ? String(memVal) : "" });
@@ -269477,8 +269484,8 @@ var require_workflow_authoring_tools = __commonJS({
       method: zod_1.z.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"]).describe("HTTP method"),
       path: zod_1.z.string().min(1).describe("Route path; :params resolve from body/memory (NOT from {{templates}} \u2014 those only work in body/inject)"),
       description: zod_1.z.string().optional().describe("What this step does"),
-      body: zod_1.z.record(zod_1.z.any()).optional().describe("Request payload. Values support {{faker.*}}, {{scope:key}} and {{workflow:key}} templates"),
-      inject: zod_1.z.record(zod_1.z.string()).optional().describe('Memory/header injection: "header:Name" or "body:field" (or bare header name) -> "scope:key" or "{{template}}"'),
+      body: zod_1.z.record(zod_1.z.any()).optional().describe("Request payload. Values support {{faker.*}}, {{scope:key}}, {{workflow:key}} and {{human:key}} templates (human pauses for interactive input at runtime)"),
+      inject: zod_1.z.record(zod_1.z.string()).optional().describe('Memory/header injection: "header:Name" or "body:field" (or bare header name) -> "scope:key" or "{{template}}" ({{human:key}} supported)'),
       capture: zod_1.z.record(zod_1.z.string()).optional().describe('Save RESPONSE fields to memory: "scope:key" -> "dot.path.in.response"'),
       captureInput: zod_1.z.record(zod_1.z.string()).optional().describe('Save REQUEST body fields to memory BEFORE sending: "scope:key" -> "bodyField"'),
       expectStatus: zod_1.z.number().int().positive().optional().describe("Expected HTTP status (default 200; any 2xx passes when expecting 2xx)")
@@ -269584,6 +269591,7 @@ var require_workflow_authoring_tools = __commonJS({
       }
       const seenNames = /* @__PURE__ */ new Set();
       const defined = /* @__PURE__ */ new Set();
+      const humanKeys = /* @__PURE__ */ new Set();
       wf.steps.forEach((rawStep, i) => {
         const stepNo = i + 1;
         const sName = typeof rawStep?.name === "string" ? rawStep.name : void 0;
@@ -269685,6 +269693,11 @@ var require_workflow_authoring_tools = __commonJS({
             err(errors, stepNo, sName, "BAD_TEMPLATE", `"{{${ref}}}" has an empty key.`, "Use {{scope:key}} with a real key.");
             continue;
           }
+          if (scope === "human") {
+            if (key)
+              humanKeys.add(key);
+            continue;
+          }
           const full = `${scope}:${key}`;
           if (!defined.has(full) && !persistedMemory.has(full)) {
             err(errors, stepNo, sName, "UNDEFINED_MEMORY_REF", `"{{${ref}}}" in step ${stepNo} is never captured by an earlier step and is not in memory.json \u2014 it resolves to "".`, `Capture "${full}" in an earlier step (capture/captureInput), or seed it first.`);
@@ -269732,15 +269745,16 @@ var require_workflow_authoring_tools = __commonJS({
           }
         }
       });
-      return toReport(errors, warnings);
+      return toReport(errors, warnings, humanKeys);
     }
-    function toReport(errors, warnings) {
+    function toReport(errors, warnings, humanKeys) {
       return {
         valid: errors.length === 0,
         errorsCount: errors.length,
         warningsCount: warnings.length,
         errors,
-        warnings
+        warnings,
+        humanKeys: [...humanKeys || []].sort()
       };
     }
     function slugifyWorkflowName(name) {
@@ -269897,6 +269911,7 @@ var require_workflow_authoring_tools = __commonJS({
           slug,
           filePath,
           stepsCount: def.steps.length,
+          needsHuman: report.humanKeys,
           validation: { ...report, warnings }
         };
       }
@@ -269911,6 +269926,10 @@ var require_workflow_authoring_tools = __commonJS({
         slug,
         filePath,
         stepsCount: def.steps.length,
+        needsHuman: report.humanKeys,
+        ...report.humanKeys.length > 0 ? {
+          humanNote: `Steps need interactive human input for: ${report.humanKeys.map((k) => `{{human:${k}}}`).join(", ")}. Runners pause for it (CLI terminal prompt / dashboard dialog); pre-seed with ${report.humanKeys.map((k) => `JETIC_HUMAN_${k.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`).join(", ")} env or human: memory. Tell the user.`
+        } : {},
         validation: { ...report, warnings },
         next: `Run it with jetic_simulate_workflow { "workflow": "${slug}" }.`
       };
@@ -269948,7 +269967,7 @@ var require_workflow_authoring_tools = __commonJS({
 ` + report.errors.map((e) => `- [step ${e.stepIndex ?? "-"}] ${e.message} Fix: ${e.fix}`).join("\n"));
       }
       if (args.validateOnly === true) {
-        return { success: true, action: "validated", saved: false, slug: resolved.slug, filePath: resolved.filePath, stepsCount: def.steps.length, validation: report };
+        return { success: true, action: "validated", saved: false, slug: resolved.slug, filePath: resolved.filePath, stepsCount: def.steps.length, needsHuman: report.humanKeys, validation: report };
       }
       writeWorkflowFile(resolved.filePath, def);
       return {
@@ -269957,6 +269976,7 @@ var require_workflow_authoring_tools = __commonJS({
         slug: resolved.slug,
         filePath: resolved.filePath,
         stepsCount: def.steps.length,
+        needsHuman: report.humanKeys,
         validation: report,
         next: `Run it with jetic_simulate_workflow { "workflow": "${resolved.slug}" }.`
       };
@@ -269981,6 +270001,229 @@ var require_workflow_authoring_tools = __commonJS({
   }
 });
 
+// ../../packages/mcp-server/dist/tools/project-tools.js
+var require_project_tools = __commonJS({
+  "../../packages/mcp-server/dist/tools/project-tools.js"(exports2) {
+    "use strict";
+    init_cjs_shims();
+    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __setModuleDefault = exports2 && exports2.__setModuleDefault || (Object.create ? (function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    }) : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports2 && exports2.__importStar || /* @__PURE__ */ (function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    })();
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.scanProjectSchema = exports2.initProjectSchema = void 0;
+    exports2.handleInitProject = handleInitProject;
+    exports2.handleScanProject = handleScanProject;
+    var zod_1 = require("zod");
+    var fs4 = __importStar(require("fs"));
+    var path7 = __importStar(require("path"));
+    var types_1 = require_types();
+    var model_1 = require_dist2();
+    exports2.initProjectSchema = zod_1.z.object({
+      projectPath: zod_1.z.string().optional().describe("Path to the project root to initialize (defaults to JETIC_PROJECT_PATH / cwd)"),
+      projectName: zod_1.z.string().optional().describe("Project name (default: directory basename)"),
+      language: zod_1.z.string().optional().describe('Primary language (default: "typescript" when tsconfig.json exists, else omitted)'),
+      framework: zod_1.z.string().optional().describe('Framework (default: "express" when express is a dependency, else omitted)'),
+      environmentName: zod_1.z.string().optional().describe('First environment name (default "local")'),
+      baseUrl: zod_1.z.string().optional().describe('First environment base URL (default "http://localhost:3000")'),
+      overwrite: zod_1.z.boolean().optional().describe("Replace an existing .jetic/model.json (default false \u2014 never clobber silently)")
+    });
+    function detectStack(projectRoot) {
+      let hasExpress = false;
+      let hasPackageJson = false;
+      try {
+        const pkgPath = path7.join(projectRoot, "package.json");
+        if (fs4.existsSync(pkgPath)) {
+          hasPackageJson = true;
+          const pkg = JSON.parse(fs4.readFileSync(pkgPath, "utf-8"));
+          const deps = { ...pkg.dependencies || {}, ...pkg.devDependencies || {}, ...pkg.peerDependencies || {} };
+          hasExpress = "express" in deps;
+        }
+      } catch {
+      }
+      return { hasPackageJson, hasExpress, hasTsConfig: fs4.existsSync(path7.join(projectRoot, "tsconfig.json")) };
+    }
+    function handleInitProject(args) {
+      const filePath = (0, types_1.resolveModelPath)(args.projectPath);
+      const projectRoot = (0, types_1.projectRootOfModel)(filePath);
+      const overwrite = args.overwrite === true;
+      if (fs4.existsSync(filePath) && !overwrite) {
+        const { model: model2 } = (0, types_1.loadModel)(args.projectPath);
+        return {
+          success: false,
+          action: "already-initialized",
+          filePath,
+          modelExists: true,
+          endpointsCount: model2.endpoints?.length || 0,
+          message: `Model already exists at ${filePath} \u2014 nothing was overwritten. Continue with step 2 (jetic_scan for Express, or jetic_add_endpoint per endpoint).`,
+          next: "If this is an Express+TypeScript project, run jetic_scan next. Otherwise read the code and add endpoints with jetic_add_endpoint, then jetic_verify_model."
+        };
+      }
+      const stack = detectStack(projectRoot);
+      const model = {
+        version: model_1.CURRENT_MODEL_VERSION,
+        generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        project: {
+          name: args.projectName || path7.basename(projectRoot) || "jetic-project",
+          ...args.language || (stack.hasTsConfig ? "typescript" : void 0) ? { language: args.language || "typescript" } : {},
+          ...args.framework || (stack.hasExpress ? "express" : void 0) ? { framework: args.framework || "express" } : {}
+        },
+        environments: [
+          { name: args.environmentName || "local", baseUrl: args.baseUrl || "http://localhost:3000" }
+        ],
+        securitySchemes: {},
+        resources: [],
+        endpoints: [],
+        dependencies: [],
+        workflows: [],
+        stateMachines: []
+      };
+      (0, types_1.saveModel)(filePath, model);
+      fs4.mkdirSync(path7.join(path7.dirname(filePath), "workflows"), { recursive: true });
+      const configPath = path7.join(path7.dirname(filePath), "config.json");
+      if (!fs4.existsSync(configPath)) {
+        fs4.writeFileSync(configPath, JSON.stringify({}, null, 2), "utf-8");
+      }
+      const scanRecommended = stack.hasExpress && stack.hasTsConfig;
+      return {
+        success: true,
+        action: overwrite ? "overwritten" : "created",
+        filePath,
+        project: model.project,
+        detected: stack,
+        scanRecommended,
+        next: scanRecommended ? "Step 2: this looks like an Express+TypeScript project \u2014 run jetic_scan next to auto-fill model.json (no AI key needed), then refine with jetic_add_endpoint and jetic_verify_model." : "Step 2: no auto-scan applies here \u2014 read the backend code and add each endpoint with jetic_add_endpoint (middleware, security, parameters, responses), then jetic_verify_model until clean. Step 3 (only on request): author workflows with jetic_validate_workflow \u2192 jetic_create_workflow \u2192 jetic_simulate_workflow."
+      };
+    }
+    exports2.scanProjectSchema = zod_1.z.object({
+      projectPath: zod_1.z.string().optional().describe("Path to the Express project root (must contain tsconfig.json). Defaults to JETIC_PROJECT_PATH / cwd."),
+      mode: zod_1.z.enum(["merge", "overwrite"]).optional().describe("merge (default): upsert scanned routes, keep hand-added endpoints. overwrite: replace the whole endpoints array.")
+    });
+    async function quietly(fn) {
+      const origStdoutWrite = process.stdout.write.bind(process.stdout);
+      const origLog = console.log;
+      const origInfo = console.info;
+      const origDebug = console.debug?.bind(console);
+      const noop = () => {
+      };
+      process.stdout.write = noop;
+      console.log = noop;
+      console.info = noop;
+      if (console.debug)
+        console.debug = noop;
+      try {
+        return await fn();
+      } finally {
+        process.stdout.write = origStdoutWrite;
+        console.log = origLog;
+        console.info = origInfo;
+        if (origDebug)
+          console.debug = origDebug;
+      }
+    }
+    async function handleScanProject(args) {
+      const filePath = (0, types_1.resolveModelPath)(args.projectPath);
+      const projectRoot = (0, types_1.projectRootOfModel)(filePath);
+      const mode = args.mode || "merge";
+      if (!fs4.existsSync(path7.join(projectRoot, "tsconfig.json"))) {
+        throw new Error(`Cannot scan ${projectRoot}: no tsconfig.json found. jetic_scan only supports Express+TypeScript projects. For any other stack, read the code and model each endpoint with jetic_add_endpoint instead.`);
+      }
+      const { ExpressScanner: ExpressScanner2 } = await Promise.resolve().then(() => __importStar(require_dist3()));
+      const config = {
+        projectRoot,
+        jeticDir: path7.dirname(filePath)
+        // No `ai` key on purpose: static discovery only, no provider, no keys.
+      };
+      let scanned;
+      try {
+        scanned = await quietly(() => new ExpressScanner2(config).scan());
+      } catch (err) {
+        throw new Error(`Scan failed for ${projectRoot}: ${err?.message || err}. If this is not an Express+TypeScript codebase, model endpoints manually with jetic_add_endpoint.`);
+      }
+      const { model: existing, exists } = (0, types_1.loadModel)(args.projectPath);
+      let added = 0;
+      let updated = 0;
+      let preserved = 0;
+      if (!exists || mode === "overwrite") {
+        if (mode === "overwrite" && exists)
+          preserved = 0;
+        existing.endpoints = scanned.endpoints;
+        added = scanned.endpoints.length;
+        if (!existing.environments || existing.environments.length === 0) {
+          existing.environments = scanned.environments;
+        }
+      } else {
+        const index = /* @__PURE__ */ new Map();
+        existing.endpoints.forEach((e, i) => index.set(`${e.method.toUpperCase()} ${e.path}`, i));
+        for (const s of scanned.endpoints) {
+          const key = `${s.method.toUpperCase()} ${s.path}`;
+          const at = index.get(key);
+          if (at === void 0) {
+            existing.endpoints.push(s);
+            added++;
+          } else {
+            existing.endpoints[at] = s;
+            updated++;
+          }
+        }
+        preserved = existing.endpoints.length - added - updated;
+        if (!existing.environments || existing.environments.length === 0) {
+          existing.environments = scanned.environments;
+        }
+      }
+      if (!existing.project?.framework && scanned.project?.framework) {
+        existing.project = { ...scanned.project, ...existing.project };
+      }
+      (0, types_1.saveModel)(filePath, existing);
+      const total = existing.endpoints.length;
+      return {
+        success: true,
+        action: "scanned",
+        filePath,
+        mode,
+        stats: { scanned: scanned.endpoints.length, added, updated, preserved, total },
+        ...scanned.endpoints.length === 0 ? {
+          warning: "Static scan found 0 endpoints. Check that Express routes live under this project root (custom entry points or routers may need manual modeling with jetic_add_endpoint)."
+        } : {},
+        next: total === 0 ? "No endpoints yet \u2014 model them manually with jetic_add_endpoint, then jetic_verify_model." : `Next: refine with jetic_add_endpoint / jetic_update_endpoint (AI enrichment is skipped in scans \u2014 add constraints, examples, ownership by hand), then jetic_verify_model until clean. Step 3 (only on request): workflows via jetic_validate_workflow \u2192 jetic_create_workflow \u2192 jetic_simulate_workflow.`
+      };
+    }
+  }
+});
+
 // ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/zod-compat.js
 var require_zod_compat = __commonJS({
   "../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/zod-compat.js"(exports2) {
@@ -284050,6 +284293,7 @@ var require_server3 = __commonJS({
     var environment_tools_1 = require_environment_tools();
     var workflow_tools_1 = require_workflow_tools();
     var workflow_authoring_tools_1 = require_workflow_authoring_tools();
+    var project_tools_1 = require_project_tools();
     exports2.JETIC_MCP_SERVER_NAME = "jetic-mcp-server";
     function getJeticMcpVersion() {
       try {
@@ -284062,14 +284306,12 @@ var require_server3 = __commonJS({
       return "0.1.0";
     }
     exports2.JETIC_MCP_INSTRUCTIONS = [
-      "Jetic MCP manages API behavioral models stored in `.jetic/model.json`.",
-      "Suggested workflow for AI agents:",
-      "1. Start with `jetic_read_model` (summaryOnly=true) to learn the project layout.",
-      "2. Use `jetic_list_endpoints` / `jetic_get_endpoint` before changing anything.",
-      "3. Mutating tools (`jetic_add_endpoint`, `jetic_update_endpoint`, `jetic_delete_endpoint`, `jetic_manage_environment`) write to disk \u2014 confirm intent with the user first when the change is destructive (delete/overwrite).",
-      "4. After edits, run `jetic_verify_model` and fix reported errors.",
-      "5. Use `jetic_test_endpoint` / `jetic_simulate_workflow` only against a running server (local/staging); pass `baseUrl` to override the stored environment URL.",
-      "Authoring workflows: NEVER hand-write workflow files blind. Build the steps, then run `jetic_validate_workflow` with the inline definition (dry run), fix reported errors, save with `jetic_create_workflow`, and finally execute with `jetic_simulate_workflow`. Chain steps with capture/captureInput (producer) + inject or {{workflow:key}} templates (consumer).",
+      "Jetic MCP manages API behavioral models in `.jetic/`. Work in this structured order:",
+      "1. INITIALIZE: if there is no `.jetic/model.json` (read tools report modelExists:false), call `jetic_init` first. It scaffolds the folder + model and tells you whether auto-scan applies. Never invent a model file by hand.",
+      "2. MODEL: Express+TypeScript project with tsconfig.json \u2192 run `jetic_scan` (static, keyless) to fill model.json, then refine with `jetic_add_endpoint` / `jetic_update_endpoint`. Any other stack \u2014 or scan gaps \u2014 read the code and model each endpoint yourself with `jetic_add_endpoint` (full fidelity: middleware chains, security, constraints, pagination, produces/consumes). Run `jetic_verify_model` until clean.",
+      "3. SIMULATE (only when the user asks): author workflows with `jetic_validate_workflow` (dry run) \u2192 `jetic_create_workflow` \u2192 `jetic_simulate_workflow`. Chain steps with capture/captureInput (producer) + inject or {{workflow:key}} templates (consumer). Use {{human:key}} ONLY for values unknowable beforehand (OTP codes, real secrets) \u2014 runners pause for interactive input and the create response lists them under needsHuman so you can warn the user.",
+      "No AI-provider setup is needed for any of this: never ask for OpenRouter/OpenAI keys and never use `jetic config ai`.",
+      "Mutating tools (`jetic_add_endpoint`, `jetic_update_endpoint`, `jetic_delete_endpoint`, `jetic_manage_environment`, workflow create/update) write to disk \u2014 confirm intent with the user first when the change is destructive (delete/overwrite).",
       "Project resolution: every tool accepts an optional `projectPath`. If omitted, the server uses the `JETIC_PROJECT_PATH` environment variable, falling back to its own working directory. Set one of them to the project root so the server edits the right `.jetic/model.json`."
     ].join("\n");
     var READ_ONLY = {
@@ -284130,10 +284372,12 @@ var require_server3 = __commonJS({
       register("jetic_list_workflows", "List workflows", "Lists multi-step integration test workflows from .jetic/workflows/*.json, .jetic/workflow.json, or embedded model.json workflows.", workflow_tools_1.listWorkflowsSchema.shape, READ_ONLY, workflow_tools_1.handleListWorkflows);
       register("jetic_simulate_workflow", "Simulate workflow", "Executes a full end-to-end multi-step workflow simulation with dynamic memory capture, header injection, and schema validation against the live server.", workflow_tools_1.simulateWorkflowSchema.shape, READ_LIVE, workflow_tools_1.handleSimulateWorkflow);
       register("jetic_simulate", "Simulate workflow (alias)", "Alias of jetic_simulate_workflow: runs a multi-step user-journey workflow against the live server. Prefer jetic_simulate_workflow in new prompts.", workflow_tools_1.simulateWorkflowSchema.shape, READ_LIVE, workflow_tools_1.handleSimulateWorkflow);
-      register("jetic_validate_workflow", "Validate workflow", "Deep-validates a workflow WITHOUT saving or running it: step structure, endpoint cross-checks against model.json, and memory data-flow analysis (every {{scope:key}} must be captured by an earlier step). Accepts a saved workflow reference or an inline definition for pre-save dry runs.", workflow_authoring_tools_1.validateWorkflowSchema.shape, READ_ONLY, workflow_authoring_tools_1.handleValidateWorkflow);
+      register("jetic_validate_workflow", "Validate workflow", "Deep-validates a workflow WITHOUT saving or running it: step structure, endpoint cross-checks against model.json, and memory data-flow analysis (every {{scope:key}} except {{human:key}} must be captured by an earlier step). Accepts a saved workflow reference or an inline definition for pre-save dry runs.", workflow_authoring_tools_1.validateWorkflowSchema.shape, READ_ONLY, workflow_authoring_tools_1.handleValidateWorkflow);
       register("jetic_create_workflow", "Create workflow", "Creates a .jetic/workflows/<slug>.json workflow from ordered steps with capture/inject memory chaining. Refuses to save when validation errors exist (error messages say exactly how to fix); use validateOnly for a dry run. Can also migrate an embedded model.json workflow via fromModelWorkflow.", workflow_authoring_tools_1.createWorkflowSchema.shape, WRITES_MODEL, workflow_authoring_tools_1.handleCreateWorkflow);
       register("jetic_update_workflow", "Update workflow", "Updates a saved file workflow: rename, description/environment, full steps replacement, or appendSteps. Validates before writing and refuses to save on errors.", workflow_authoring_tools_1.updateWorkflowSchema.shape, WRITES_MODEL, workflow_authoring_tools_1.handleUpdateWorkflow);
       register("jetic_delete_workflow", "Delete workflow", "Deletes a saved .jetic/workflows/*.json workflow file by slug, name, or path. Destructive: confirm with the user before calling. Cannot delete model.json-embedded workflows.", workflow_authoring_tools_1.deleteWorkflowSchema.shape, DESTRUCTIVE, workflow_authoring_tools_1.handleDeleteWorkflow);
+      register("jetic_init", "Initialize Jetic project", "Step 1 of the structured order: scaffolds .jetic/model.json (+ workflows/, config.json) for repos that have none. Refuses to clobber an existing model (pass overwrite:true to replace). Reports whether auto-scan applies (Express+TypeScript) and what to do next.", project_tools_1.initProjectSchema.shape, WRITES_MODEL, project_tools_1.handleInitProject);
+      register("jetic_scan", "Scan Express project", "Step 2a for Express+TypeScript projects (requires tsconfig.json): static AST scan that fills model.json with routes, middleware, and auth heuristics. Keyless \u2014 no AI provider involved. Default merge upserts scanned routes and keeps hand-added endpoints; overwrite replaces all endpoints. Fails with guidance for non-Express stacks (model those manually).", project_tools_1.scanProjectSchema.shape, WRITES_MODEL, project_tools_1.handleScanProject);
       return server;
     }
     async function runMcpServer2() {
@@ -284200,6 +284444,7 @@ var require_dist7 = __commonJS({
     __exportStar(require_environment_tools(), exports2);
     __exportStar(require_workflow_tools(), exports2);
     __exportStar(require_workflow_authoring_tools(), exports2);
+    __exportStar(require_project_tools(), exports2);
     __exportStar(require_server3(), exports2);
     __exportStar(require_serial_transport(), exports2);
     var fs4 = __importStar(require("fs"));
@@ -284663,9 +284908,15 @@ Use EXACTLY these placeholders in body/inject values:
   {{faker.commerce.productName}}   product name
   {{faker.phone.number}}           phone number
   {{workflow:KEY}}                 value captured from a previous step
+  {{human:KEY}}                    ask the human at runtime (interactive prompt, waits for input).
+                                   Use ONLY for values unknowable beforehand (OTP/2FA codes,
+                                   CAPTCHAs, real personal secrets). First entry is saved to
+                                   human:KEY memory; JETIC_HUMAN_KEY env var skips the prompt.
 
-\u2501\u2501\u2501 FIELD RULES \u2501\u2501\u2501
+ \u2501\u2501\u2501 FIELD RULES \u2501\u2501\u2501
 "body"         \u2014 request body. Use {{faker.*}} for generated fields, {{workflow:KEY}} for previously captured values.
+                 Use {{human:KEY}} SPARINGLY and only when no other source exists (OTP codes, real secrets) \u2014
+                 it pauses execution waiting for a person to type a value.
 
 "captureInput" \u2014 save RESOLVED body field values to memory BEFORE the HTTP call.
                Only for faker-generated fields you need to re-use in later steps.
@@ -284716,7 +284967,7 @@ all [requiresAuth] endpoints inject Authorization, captures wired correctly betw
     method: import_zod.z.string().describe("HTTP method in uppercase: GET, POST, PUT, PATCH, DELETE"),
     path: import_zod.z.string().describe("Exact endpoint path, e.g. /api/auth/login"),
     description: import_zod.z.string().optional().describe("One sentence describing what this step does"),
-    body: import_zod.z.record(import_zod.z.string(), import_zod.z.any()).optional().describe("Request body. Use {{faker.X}} for generated values, {{workflow:KEY}} for captured values"),
+    body: import_zod.z.record(import_zod.z.string(), import_zod.z.any()).optional().describe("Request body. Use {{faker.X}} for generated values, {{workflow:KEY}} for captured values, {{human:KEY}} only for OTP/secret values a person must type at runtime"),
     captureInput: import_zod.z.record(import_zod.z.string(), import_zod.z.string()).optional().describe('Save resolved request body fields to memory BEFORE the HTTP call. Format: { "workflow:KEY": "bodyFieldName" }'),
     capture: import_zod.z.record(import_zod.z.string(), import_zod.z.string()).optional().describe('Save response body fields to memory AFTER success. Format: { "workflow:KEY": "dot.path" }'),
     inject: import_zod.z.record(import_zod.z.string(), import_zod.z.string()).optional().describe('Inject memory values into headers/body. Use "header:Authorization" for Bearer auth'),
@@ -284748,12 +284999,12 @@ function deepGet(obj, dotPath) {
   }
   return current;
 }
-async function resolveConditionRef(ref) {
-  return ref.replace(/\{\{([^}]+)\}\}/g, () => "").trim() === ref.trim() ? ref : await resolveTemplateString(ref);
+async function resolveConditionRef(ref, context = "condition") {
+  return ref.replace(/\{\{([^}]+)\}\}/g, () => "").trim() === ref.trim() ? ref : await resolveTemplateString(ref, context);
 }
-async function evalConditionRule(rule) {
-  const left = await resolveConditionRef(rule.left);
-  const right = rule.right !== void 0 ? await resolveConditionRef(rule.right) : void 0;
+async function evalConditionRule(rule, context = "condition") {
+  const left = await resolveConditionRef(rule.left, context);
+  const right = rule.right !== void 0 ? await resolveConditionRef(rule.right, context) : void 0;
   const op = rule.operator;
   switch (op) {
     case "equals":
@@ -284788,14 +285039,14 @@ async function evalConditionRule(rule) {
       return false;
   }
 }
-async function evaluateStepCondition(condition) {
+async function evaluateStepCondition(condition, context = "condition") {
   const { rules } = condition;
   const ruleList = rules.all ?? rules.any ?? [];
   const isAnd = !!rules.all;
   if (ruleList.length === 0) return { passed: true, reason: "No rules defined" };
   const results = [];
   for (const rule of ruleList) {
-    results.push({ rule, ok: await evalConditionRule(rule) });
+    results.push({ rule, ok: await evalConditionRule(rule, context) });
   }
   const passed = isAnd ? results.every((r) => r.ok) : results.some((r) => r.ok);
   const failing = results.filter((r) => !r.ok);
@@ -284804,12 +285055,89 @@ async function evaluateStepCondition(condition) {
   ).join(", ")}`;
   return { passed, reason };
 }
-async function resolveTemplateString(value) {
+function envKeyForHuman(key) {
+  return `JETIC_HUMAN_${key.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`;
+}
+var HumanInputError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "HumanInputError";
+  }
+};
+function isSecretHumanKey(key) {
+  return /pass|secret|token|pwd|private|credential/i.test(key);
+}
+async function promptLine(question) {
+  const readline3 = await new Function("modulePath", "return import(modulePath)")("node:readline/promises");
+  const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return await rl.question(question);
+  } finally {
+    rl.close();
+  }
+}
+async function promptSecret(question) {
+  const readline3 = await new Function("modulePath", "return import(modulePath)")("node:readline");
+  return new Promise((resolve2) => {
+    const rl = readline3.createInterface({ input: process.stdin, output: process.stdout, terminal: true });
+    process.stdout.write(question);
+    const w = rl;
+    const orig = w._writeToOutput.bind(rl);
+    w._writeToOutput = (s) => {
+      if (s === "\n" || s === "\r\n" || s === "\r") orig(s);
+      else w.output.write("*".repeat(s.length));
+    };
+    rl.question("", (answer) => {
+      w._writeToOutput = orig;
+      process.stdout.write("\n");
+      rl.close();
+      resolve2(answer);
+    });
+  });
+}
+async function askHuman(key, context) {
+  const envName = envKeyForHuman(key);
+  const fromEnv = process.env[envName];
+  if (fromEnv !== void 0 && fromEnv !== "") return fromEnv;
+  const mem = new import_memory2.JeticMemory({ scope: "human" });
+  const cached = await mem.get(key);
+  if (cached !== null && cached !== void 0 && String(cached) !== "") {
+    console.log(`  ${c.dim}\u21B3 using saved human value for "${key}" (jetic memory set human:${key} \u2026 to change)${c.reset}`);
+    return String(cached);
+  }
+  if (!process.stdin.isTTY) {
+    throw new HumanInputError(
+      `Workflow needs human input for "{{human:${key}}}"${context ? ` (${context})` : ""} but the terminal is not interactive. Pre-seed it with: jetic memory set human:${key} <value>  \u2014 or export ${envName}=<value>`
+    );
+  }
+  console.log(`
+  ${c.yellow}${c.bold}\u25C9 Human input required${c.reset}${context ? `  ${c.dim}${context}${c.reset}` : ""}`);
+  const question = `  ${c.cyan}Enter value for "${key}":${c.reset} `;
+  const value = isSecretHumanKey(key) ? await promptSecret(question) : await promptLine(question);
+  if (value !== "") {
+    await mem.set(key, value);
+    console.log(`  ${c.dim}\u21B3 saved to human:${key} memory (reused automatically next time)${c.reset}
+`);
+  } else {
+    console.log(`  ${c.dim}\u21B3 empty value accepted for "${key}" (not saved)${c.reset}
+`);
+  }
+  return value;
+}
+async function resolveTemplateString(value, context) {
   const templateRe = /\{\{([^}]+)\}\}/g;
   let match;
   const replacements = [];
   while ((match = templateRe.exec(value)) !== null) {
     const expr = match[1].trim();
+    if (!expr.startsWith("faker.")) {
+      const colonIdx = expr.indexOf(":");
+      if (colonIdx > 0 && expr.slice(0, colonIdx) === "human") {
+        const key = expr.slice(colonIdx + 1);
+        replacements.push({ placeholder: match[0], resolved: await askHuman(key, context) });
+        continue;
+      }
+    }
     if (expr.includes(":") && !expr.startsWith("faker.")) {
       const colonIdx = expr.indexOf(":");
       const scope = expr.slice(0, colonIdx);
@@ -284839,21 +285167,21 @@ async function resolveTemplateString(value) {
   }
   return result;
 }
-async function resolveBodyTemplates(body) {
+async function resolveBodyTemplates(body, context) {
   const resolved = {};
   for (const [key, value] of Object.entries(body)) {
-    resolved[key] = typeof value === "string" ? await resolveTemplateString(value) : value;
+    resolved[key] = typeof value === "string" ? await resolveTemplateString(value, context) : value;
   }
   return resolved;
 }
-async function resolveInjections(inject, memory, allMemory) {
+async function resolveInjections(inject, memory, allMemory, context) {
   const headers = {};
   const body = {};
   if (!inject) return { headers, body };
   for (const [target, memKeyOrTemplate] of Object.entries(inject)) {
     let strValue;
     if (memKeyOrTemplate.includes("{{")) {
-      strValue = await resolveTemplateString(memKeyOrTemplate);
+      strValue = await resolveTemplateString(memKeyOrTemplate, context);
     } else {
       const [scope, key] = memKeyOrTemplate.includes(":") ? memKeyOrTemplate.split(":", 2) : ["workflow", memKeyOrTemplate];
       const scopedMemory = new import_memory2.JeticMemory({ scope });
@@ -284906,8 +285234,9 @@ async function resolvePathParams(urlPath, body) {
 async function executeStep(step, baseUrl, defaultBody) {
   const startTime = Date.now();
   const memory = new import_memory2.JeticMemory({ scope: "workflow" });
-  const { headers, body: injectedBody } = await resolveInjections(step.inject, memory, memory);
-  const resolvedStepBody = await resolveBodyTemplates(step.body || {});
+  const stepLabel = step.name || `${step.method} ${step.path}`;
+  const { headers, body: injectedBody } = await resolveInjections(step.inject, memory, memory, stepLabel);
+  const resolvedStepBody = await resolveBodyTemplates(step.body || {}, stepLabel);
   const requestBody = { ...defaultBody, ...injectedBody, ...resolvedStepBody };
   const inputCaptured = await captureInputToMemory(step.captureInput, requestBody);
   const resolvedPath = await resolvePathParams(step.path, requestBody);
@@ -285251,71 +285580,86 @@ var simulateWorkflowCommand = new import_commander6.Command("workflow").descript
     const stepLabel = `${c.dim}${i + 1}/${workflow.steps.length}${c.reset}  ${getMethodColor(step.method)}${step.method}${c.reset} ${step.path}`;
     const spinner = new Spinner();
     spinner.start(`${stepLabel}  ${c.dim}${step.name}${c.reset}...`);
-    const result = await executeStep(step, baseUrl, {});
-    if (step.condition) {
-      const condResult = await evaluateStepCondition(step.condition);
-      result.conditionResult = condResult;
-      if (!condResult.passed) {
-        const { onFail, switchToWorkflow } = step.condition;
-        results.push(result);
-        const icon2 = result.passed ? TICK : CROSS;
-        spinner.stop(`  ${icon2} ${stepLabel}  ${formatStatus(result.status)}  ${c.dim}${result.durationMs}ms${c.reset}`);
-        renderStepResult(result, i, workflow.steps.length);
-        if (onFail === "abort") {
-          console.log(`  ${c.red}${c.bold}\u26A0 Condition failed \u2014 aborting workflow.${c.reset}
+    let result;
+    try {
+      result = await executeStep(step, baseUrl, {});
+      if (step.condition) {
+        const condResult = await evaluateStepCondition(step.condition, `condition of step "${step.name || step.path}"`);
+        result.conditionResult = condResult;
+        if (!condResult.passed) {
+          const { onFail, switchToWorkflow } = step.condition;
+          results.push(result);
+          const icon2 = result.passed ? TICK : CROSS;
+          spinner.stop(`  ${icon2} ${stepLabel}  ${formatStatus(result.status)}  ${c.dim}${result.durationMs}ms${c.reset}`);
+          renderStepResult(result, i, workflow.steps.length);
+          if (onFail === "abort") {
+            console.log(`  ${c.red}${c.bold}\u26A0 Condition failed \u2014 aborting workflow.${c.reset}
 `);
-          stopOnFailure = true;
-          break;
-        } else if (onFail === "continue") {
-          console.log(`  ${c.yellow}\u2298 Condition failed \u2014 skipping remaining steps.${c.reset}
+            stopOnFailure = true;
+            break;
+          } else if (onFail === "continue") {
+            console.log(`  ${c.yellow}\u2298 Condition failed \u2014 skipping remaining steps.${c.reset}
 `);
-          stopOnFailure = true;
-          break;
-        } else if (onFail === "switch" && switchToWorkflow) {
-          console.log(`  ${ARROW} Condition failed \u2014 switching to workflow: ${c.bold}${switchToWorkflow}${c.reset}
+            stopOnFailure = true;
+            break;
+          } else if (onFail === "switch" && switchToWorkflow) {
+            console.log(`  ${ARROW} Condition failed \u2014 switching to workflow: ${c.bold}${switchToWorkflow}${c.reset}
 `);
-          const switchPath = path3.join(workflowsDir, `${switchToWorkflow}.json`);
-          if (fs.existsSync(switchPath)) {
-            try {
-              const switchedWorkflow = JSON.parse(fs.readFileSync(switchPath, "utf-8"));
-              console.log(`  ${TICK} Loaded switch workflow: ${c.bold}${switchedWorkflow.name}${c.reset}
+            const switchPath = path3.join(workflowsDir, `${switchToWorkflow}.json`);
+            if (fs.existsSync(switchPath)) {
+              try {
+                const switchedWorkflow = JSON.parse(fs.readFileSync(switchPath, "utf-8"));
+                console.log(`  ${TICK} Loaded switch workflow: ${c.bold}${switchedWorkflow.name}${c.reset}
 `);
-              renderWorkflowHeader(switchedWorkflow);
-              console.log(`  ${c.magenta}\u{1F680}${c.reset} Executing sub-workflow...
+                renderWorkflowHeader(switchedWorkflow);
+                console.log(`  ${c.magenta}\u{1F680}${c.reset} Executing sub-workflow...
+`);
+                for (let si = 0; si < switchedWorkflow.steps.length; si++) {
+                  const switchStep = switchedWorkflow.steps[si];
+                  const switchLabel = `${c.dim}${si + 1}/${switchedWorkflow.steps.length}${c.reset}  ${getMethodColor(switchStep.method)}${switchStep.method}${c.reset} ${switchStep.path}`;
+                  const switchSpinner = new Spinner();
+                  switchSpinner.start(`${switchLabel}  ${c.dim}${switchStep.name}${c.reset}...`);
+                  const switchResult = await executeStep(switchStep, baseUrl, {});
+                  if (switchStep.condition) {
+                    switchResult.conditionResult = await evaluateStepCondition(
+                      switchStep.condition,
+                      `condition of step "${switchStep.name || switchStep.path}"`
+                    );
+                  }
+                  results.push(switchResult);
+                  const switchIcon = switchResult.passed ? TICK : CROSS;
+                  switchSpinner.stop(`  ${switchIcon} ${switchLabel}  ${formatStatus(switchResult.status)}  ${c.dim}${switchResult.durationMs}ms${c.reset}`);
+                  renderStepResult(switchResult, si, switchedWorkflow.steps.length);
+                }
+              } catch (e) {
+                console.log(`  ${c.red}\u2717 Failed to load switch workflow: ${e.message}${c.reset}
 `);
-              for (let si = 0; si < switchedWorkflow.steps.length; si++) {
-                const switchStep = switchedWorkflow.steps[si];
-                const switchLabel = `${c.dim}${si + 1}/${switchedWorkflow.steps.length}${c.reset}  ${getMethodColor(switchStep.method)}${switchStep.method}${c.reset} ${switchStep.path}`;
-                const switchSpinner = new Spinner();
-                switchSpinner.start(`${switchLabel}  ${c.dim}${switchStep.name}${c.reset}...`);
-                const switchResult = await executeStep(switchStep, baseUrl, {});
-                if (switchStep.condition) {
-                  switchResult.conditionResult = await evaluateStepCondition(switchStep.condition);
-                }
-                results.push(switchResult);
-                const switchIcon = switchResult.passed ? TICK : CROSS;
-                switchSpinner.stop(`  ${switchIcon} ${switchLabel}  ${formatStatus(switchResult.status)}  ${c.dim}${switchResult.durationMs}ms${c.reset}`);
-                renderStepResult(switchResult, si, switchedWorkflow.steps.length);
               }
-            } catch (e) {
-              console.log(`  ${c.red}\u2717 Failed to load switch workflow: ${e.message}${c.reset}
+            } else {
+              console.log(`  ${c.yellow}\u26A0 Switch workflow not found: ${switchPath}${c.reset}
 `);
             }
-          } else {
-            console.log(`  ${c.yellow}\u26A0 Switch workflow not found: ${switchPath}${c.reset}
-`);
-          }
-          if (step.condition.returnOnComplete) {
-            console.log(`  ${c.green}\u21A9 Sub-workflow complete. Returning to main workflow...${c.reset}
+            if (step.condition.returnOnComplete) {
+              console.log(`  ${c.green}\u21A9 Sub-workflow complete. Returning to main workflow...${c.reset}
 `);
-            continue;
-          } else {
-            stopOnFailure = true;
-            break;
+              continue;
+            } else {
+              stopOnFailure = true;
+              break;
+            }
           }
+          continue;
         }
-        continue;
       }
+    } catch (err) {
+      if (err instanceof HumanInputError || err?.name === "HumanInputError") {
+        spinner.stop(`  ${c.red}\u2717${c.reset} ${stepLabel}  ${c.dim}needs human input${c.reset}`);
+        console.error(`
+  ${c.red}${err.message}${c.reset}
+`);
+        process.exit(1);
+      }
+      throw err;
     }
     results.push(result);
     const icon = result.passed ? TICK : CROSS;
@@ -286228,8 +286572,29 @@ Output valid JSON only.
       res.status(500).json({ error: err.message });
     }
   });
+  const humanInputWaiters = /* @__PURE__ */ new Map();
+  const HUMAN_INPUT_TIMEOUT_MS = 10 * 60 * 1e3;
+  class HumanInputAbort extends Error {
+    constructor(key, reason) {
+      super(`Human input for "{{human:${key}}}" ${reason}`);
+      this.name = "HumanInputAbort";
+    }
+  }
+  app.post("/api/workflows/human-input", (req, res) => {
+    const { runId, key, value } = req.body;
+    if (!runId || !key) {
+      return res.status(400).json({ error: "runId and key are required" });
+    }
+    const waiter = humanInputWaiters.get(runId);
+    if (!waiter || waiter.key !== key) {
+      return res.status(404).json({ error: "no pending human input for this run/key (answered, timed out, or run ended)" });
+    }
+    humanInputWaiters.delete(runId);
+    waiter.resolve(typeof value === "string" ? value : null);
+    res.json({ ok: true });
+  });
   app.post("/api/workflows/run", async (req, res) => {
-    const { file } = req.body;
+    const { file, humanInputs: preseededHuman } = req.body;
     if (!file) {
       return res.status(400).json({ error: "file is required" });
     }
@@ -286270,10 +286635,46 @@ Output valid JSON only.
       }
     }
     if (!baseUrl) baseUrl = "http://localhost:4000";
-    send("start", { name: workflow.name, totalSteps: workflow.steps.length, baseUrl });
+    const runId = `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+    const runHumanCache = new Map(Object.entries(preseededHuman ?? {}));
+    const HUMAN_KEY_RE = /\{\{\s*human:([^}]+?)\s*\}\}/g;
+    const collectHumanRefs = () => {
+      const keys = /* @__PURE__ */ new Set();
+      for (const step of workflow.steps || []) {
+        for (const hay of [step?.path, JSON.stringify(step?.body ?? {}), JSON.stringify(step?.inject ?? {}), JSON.stringify(step?.condition ?? {})]) {
+          if (!hay) continue;
+          HUMAN_KEY_RE.lastIndex = 0;
+          let m;
+          while ((m = HUMAN_KEY_RE.exec(hay)) !== null) {
+            const k = (m[1] || "").trim();
+            if (k) keys.add(k);
+          }
+        }
+      }
+      return [...keys];
+    };
+    const humanEnvName = (key) => `JETIC_HUMAN_${key.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`;
+    const humanSource = async (key) => {
+      if (runHumanCache.has(key)) return "run";
+      if (process.env[humanEnvName(key)]) return "env";
+      try {
+        const v = await new Mem({ scope: "human" }).get(key);
+        if (v != null && String(v) !== "") return "memory";
+      } catch {
+      }
+      return "prompt";
+    };
+    const neededHuman = [];
+    for (const k of collectHumanRefs()) neededHuman.push({ key: k, source: await humanSource(k) });
+    send("start", { name: workflow.name, totalSteps: workflow.steps.length, baseUrl, runId, humanKeys: neededHuman });
     let aborted = false;
     req.on("close", () => {
       aborted = true;
+      const waiter = humanInputWaiters.get(runId);
+      if (waiter) {
+        humanInputWaiters.delete(runId);
+        waiter.resolve(null);
+      }
     });
     function deepGet2(obj, dotPath) {
       return dotPath.replace(/\[(\d+)\]/g, ".$1").split(".").reduce((o, k) => o?.[k], obj);
@@ -286293,42 +286694,101 @@ Output valid JSON only.
         return _;
       });
     }
-    async function resolveMemoryTemplates(value) {
+    async function resolveMemoryTemplates(value, stepIndex = -1, stepName = "") {
       const matches = [...value.matchAll(/\{\{([^}]+)\}\}/g)];
       let result = value;
       for (const [placeholder, expr] of matches.map((m) => [m[0], m[1].trim()])) {
         if (expr.includes(":") && !expr.startsWith("faker.")) {
           const [scope, key] = expr.split(":", 2);
-          const mem = new Mem({ scope });
-          const val = await mem.get(key);
-          result = result.replace(placeholder, val != null ? String(val) : "");
+          const val = await resolveMemValue(scope, key, stepIndex, stepName);
+          result = result.replace(placeholder, val);
         }
       }
       return result;
     }
-    async function resolveStr(v) {
+    async function resolveStr(v, stepIndex = -1, stepName = "") {
       let s = await resolveTemplate(v);
-      s = await resolveMemoryTemplates(s);
+      s = await resolveMemoryTemplates(s, stepIndex, stepName);
       return s;
     }
-    async function executeStep2(step) {
+    async function resolveValueRecursive(val, stepIndex = -1, stepName = "") {
+      if (typeof val === "string") {
+        return await resolveStr(val, stepIndex, stepName);
+      }
+      if (Array.isArray(val)) {
+        const res2 = [];
+        for (const item of val) {
+          res2.push(await resolveValueRecursive(item, stepIndex, stepName));
+        }
+        return res2;
+      }
+      if (val && typeof val === "object" && val.constructor === Object) {
+        const res2 = {};
+        for (const [k, v] of Object.entries(val)) {
+          res2[k] = await resolveValueRecursive(v, stepIndex, stepName);
+        }
+        return res2;
+      }
+      return val;
+    }
+    async function resolveMemValue(scope, key, stepIndex, stepName) {
+      if (scope !== "human") {
+        const mem2 = new Mem({ scope });
+        const val = await mem2.get(key);
+        return val != null ? String(val) : "";
+      }
+      if (runHumanCache.has(key)) {
+        send("human_resolved", { index: stepIndex, key, source: "run" });
+        return runHumanCache.get(key);
+      }
+      const envVal = process.env[humanEnvName(key)];
+      if (envVal !== void 0 && envVal !== "") {
+        send("human_resolved", { index: stepIndex, key, source: "env" });
+        return envVal;
+      }
+      const mem = new Mem({ scope: "human" });
+      const answer = await waitForHumanInput(runId, key, stepIndex, stepName, send);
+      if (answer === null) {
+        throw new HumanInputAbort(key, aborted ? "was cancelled" : "timed out after 10 minutes");
+      }
+      await mem.set(key, answer);
+      send("human_resolved", { index: stepIndex, key, source: "prompt" });
+      return answer;
+    }
+    function waitForHumanInput(forRunId, key, stepIndex, stepName, sendFn) {
+      return new Promise((resolve2) => {
+        const timer = setTimeout(() => {
+          if (humanInputWaiters.get(forRunId)?.key === key) {
+            humanInputWaiters.delete(forRunId);
+            resolve2(null);
+          }
+        }, HUMAN_INPUT_TIMEOUT_MS);
+        humanInputWaiters.set(forRunId, {
+          key,
+          stepIndex,
+          resolve: (value) => {
+            clearTimeout(timer);
+            resolve2(value);
+          }
+        });
+        sendFn("human_input_required", { runId: forRunId, key, stepIndex, stepName });
+      });
+    }
+    async function executeStep2(step, stepIndex) {
       const startTime = Date.now();
+      const stepName = step.name || `${step.method} ${step.path}`;
       const headers = { "Content-Type": "application/json" };
       const bodyExtra = {};
       for (const [target, memKeyOrTpl] of Object.entries(step.inject ?? {})) {
-        const strVal = memKeyOrTpl.includes("{{") ? await resolveStr(memKeyOrTpl) : await (async () => {
+        const strVal = memKeyOrTpl.includes("{{") ? await resolveStr(memKeyOrTpl, stepIndex, stepName) : await (async () => {
           const [scope, key] = memKeyOrTpl.includes(":") ? memKeyOrTpl.split(":", 2) : ["workflow", memKeyOrTpl];
-          const val = await new Mem({ scope }).get(key);
-          return val != null ? String(val) : "";
+          return resolveMemValue(scope, key, stepIndex, stepName);
         })();
         if (!strVal) continue;
         if (target.startsWith("body:")) bodyExtra[target.slice(5)] = strVal;
         else headers[target.startsWith("header:") ? target.slice(7) : target] = strVal;
       }
-      const resolvedBody = {};
-      for (const [k, v] of Object.entries(step.body ?? {})) {
-        resolvedBody[k] = typeof v === "string" ? await resolveStr(v) : v;
-      }
+      const resolvedBody = await resolveValueRecursive(step.body ?? {}, stepIndex, stepName);
       const requestBody = { ...bodyExtra, ...resolvedBody };
       for (const [memKey, bodyField] of Object.entries(step.captureInput ?? {})) {
         const val = requestBody[bodyField];
@@ -286341,7 +286801,7 @@ Output valid JSON only.
         /:([a-zA-Z_][a-zA-Z0-9_]*)/g,
         (_, p) => requestBody[p] !== void 0 ? String(requestBody[p]) : `:${p}`
       );
-      resolvedPath = await resolveStr(resolvedPath);
+      resolvedPath = await resolveStr(resolvedPath, stepIndex, stepName);
       const finalUrl = `${baseUrl.replace(/\/$/, "")}${resolvedPath}`;
       const expectedStatus = step.expectStatus ?? 200;
       try {
@@ -286384,22 +286844,20 @@ Output valid JSON only.
     }
     let passed = 0;
     let failed = 0;
-    async function resolveCondRef(ref) {
+    async function resolveCondRef(ref, stepIndex, stepName) {
       const matches = [...ref.matchAll(/\{\{([^}]+)\}\}/g)];
       let result = ref;
       for (const [placeholder, expr] of matches.map((m) => [m[0], m[1].trim()])) {
         if (expr.includes(":") && !expr.startsWith("faker.")) {
           const [scope, key] = expr.split(":", 2);
-          const mem = new Mem({ scope });
-          const val = await mem.get(key);
-          result = result.replace(placeholder, val != null ? String(val) : "");
+          result = result.replace(placeholder, await resolveMemValue(scope, key, stepIndex, stepName));
         }
       }
       return result;
     }
-    async function evalCondRule(rule) {
-      const left = await resolveCondRef(rule.left);
-      const right = rule.right !== void 0 ? await resolveCondRef(rule.right) : void 0;
+    async function evalCondRule(rule, stepIndex, stepName) {
+      const left = await resolveCondRef(rule.left, stepIndex, stepName);
+      const right = rule.right !== void 0 ? await resolveCondRef(rule.right, stepIndex, stepName) : void 0;
       switch (rule.operator) {
         case "equals":
           return left === right;
@@ -286433,12 +286891,12 @@ Output valid JSON only.
           return false;
       }
     }
-    async function evalCondition(condition) {
+    async function evalCondition(condition, stepIndex, stepName) {
       const rules = condition.rules?.all ?? condition.rules?.any ?? [];
       const isAnd = !!condition.rules?.all;
       if (rules.length === 0) return { passed: true, reason: "No rules" };
       const results = [];
-      for (const rule of rules) results.push({ rule, ok: await evalCondRule(rule) });
+      for (const rule of rules) results.push({ rule, ok: await evalCondRule(rule, stepIndex, stepName) });
       const passed2 = isAnd ? results.every((r) => r.ok) : results.some((r) => r.ok);
       const failing = results.filter((r) => !r.ok);
       const reason = passed2 ? `All conditions met (${isAnd ? "AND" : "OR"})` : `Failed: ${failing.map((r) => `${r.rule.left} ${r.rule.operator}${r.rule.right !== void 0 ? " " + r.rule.right : ""}`).join(", ")}`;
@@ -286448,7 +286906,17 @@ Output valid JSON only.
       if (aborted) break;
       const step = workflow.steps[i];
       send("step_start", { index: i, step: { name: step.name, method: step.method, path: step.path } });
-      const result = await executeStep2(step);
+      let result;
+      try {
+        result = await executeStep2(step, i);
+      } catch (err) {
+        if (err instanceof HumanInputAbort || err?.name === "HumanInputAbort") {
+          send("aborted", { index: i, reason: err.message });
+          res.end();
+          return;
+        }
+        throw err;
+      }
       if (result.passed) passed++;
       else failed++;
       send("step_result", {
@@ -286463,7 +286931,7 @@ Output valid JSON only.
         error: result.error
       });
       if (step.condition && !aborted) {
-        const condResult = await evalCondition(step.condition);
+        const condResult = await evalCondition(step.condition, i, step.name || `${step.method} ${step.path}`);
         send("condition_result", {
           index: i,
           passed: condResult.passed,
@@ -286608,29 +287076,34 @@ Output valid JSON only.
     }
   });
   try {
-    let dashboardDistPath = import_path.default.join(__dirname, "dashboard");
-    if (!import_fs.default.existsSync(dashboardDistPath)) {
-      dashboardDistPath = import_path.default.join(__dirname, "..", "dashboard");
+    let dashboardDistPath = null;
+    try {
+      const dashboardPackagePath = require.resolve("@jetic/dashboard/package.json");
+      const workspaceDist = import_path.default.join(import_path.default.dirname(dashboardPackagePath), "dist");
+      if (import_fs.default.existsSync(workspaceDist)) dashboardDistPath = workspaceDist;
+    } catch {
     }
-    if (!import_fs.default.existsSync(dashboardDistPath)) {
-      try {
-        const dashboardPackagePath = require.resolve("@jetic/dashboard/package.json");
-        dashboardDistPath = import_path.default.join(import_path.default.dirname(dashboardPackagePath), "dist");
-      } catch {
-      }
+    if (!dashboardDistPath) {
+      const bundled = import_path.default.join(__dirname, "dashboard");
+      if (import_fs.default.existsSync(bundled)) dashboardDistPath = bundled;
     }
-    if (!import_fs.default.existsSync(dashboardDistPath)) {
-      console.warn(`Dashboard build not found at ${dashboardDistPath}. Please build the dashboard first.`);
+    if (!dashboardDistPath) {
+      const sibling = import_path.default.join(__dirname, "..", "dashboard");
+      if (import_fs.default.existsSync(sibling)) dashboardDistPath = sibling;
+    }
+    if (!dashboardDistPath) {
+      console.warn("Dashboard build not found. Build it with: pnpm --filter @jetic/dashboard run build");
+    } else {
+      app.use(import_express.default.static(dashboardDistPath));
+      app.get("*", (_req, res) => {
+        const indexPath = import_path.default.join(dashboardDistPath, "index.html");
+        if (import_fs.default.existsSync(indexPath)) {
+          res.sendFile(indexPath);
+        } else {
+          res.status(404).send("Dashboard not built yet.");
+        }
+      });
     }
-    app.use(import_express.default.static(dashboardDistPath));
-    app.get("*", (_req, res) => {
-      const indexPath = import_path.default.join(dashboardDistPath, "index.html");
-      if (import_fs.default.existsSync(indexPath)) {
-        res.sendFile(indexPath);
-      } else {
-        res.status(404).send("Dashboard not built yet.");
-      }
-    });
   } catch (e) {
     console.error("Could not find dashboard static files. Ensure it is built.", e);
   }
@@ -286801,7 +287274,7 @@ var mcpCommand = new import_commander10.Command("mcp").description("Launch Model
 
 // src/index.ts
 var program = new import_commander11.Command();
-program.name("jetic").description("AI-Native API Behavior Testing").version("0.1.8");
+program.name("jetic").description("AI-Native API Behavior Testing").version("0.1.9");
 program.addCommand(initCommand);
 program.addCommand(scanCommand);
 program.addCommand(inspectCommand);