peachsim 0.1.629 → 0.1.631

package/cli/commands/setup.ts

@@ -17,6 +17,7 @@ import {
 } from '../../src/home-paths'
 import { rnxRuntime } from '../../src/runtime-delivery'
 import { findDesktopCompanion } from '../desktop-companion'
+import { canPromptForPrivacyChoice } from '../privacy'
 import { confirm, select } from '../prompt'
 import {
   applyRepositorySetup,
@@ -342,11 +343,12 @@ async function decidePrivacy(
 ): Promise<boolean> {
   if (options.productAnalytics !== undefined) return options.productAnalytics
   if (current.configured) return current.productAnalytics
-  if (options.yes || options.ci || !process.stdin.isTTY) return false
+  if (options.yes || options.ci || !canPromptForPrivacyChoice()) return false
   printPromptBlock('Private by default', [
-    'Diagnostics stay off unless you opt in.',
-    'Reports can contain package compatibility or an error class.',
-    'They never contain your code or app data.',
+    'Diagnostics stay off unless you opt in, including CI, pipes and agent runs. DO_NOT_TRACK overrides opt-in.',
+    'Reports include CLI/runtime versions, OS/arch, command name and a random install ID.',
+    'They include package incompatibilities, error classes and first-line error/warning messages (300 characters, paths redacted).',
+    'Reports exclude arguments, stacks, app source and structured app data.',
   ])
   return confirm('Share bounded diagnostics to improve peach?', false)
 }

package/cli/commands/skills.ts

@@ -286,37 +286,6 @@ function linkSkill(skill: SkillInfo, targetDir: string, force: boolean): LinkRes
   return 'conflict'
 }
 
-// quiet, conflict-safe (re)install of all bundled skills into the agent stores
-// that already exist on this machine. wired into the CLI build so building or
-// updating the CLI re-establishes the symlinks idempotently — never forces, so
-// it can't clobber a skill the user customized, and never creates a store for
-// an agent that isn't set up here. silent on success.
-export function refreshInstalledSkills() {
-  const skills = listSkills()
-  if (skills.length === 0) return
-  for (const target of defaultAgentTargets()) {
-    const skillsDir = path.resolve(target.dir)
-    // only touch agents already present (~/.claude, ~/.codex) — don't seed a
-    // store on a CI runner or a machine that doesn't use that agent.
-    if (!fs.existsSync(path.dirname(skillsDir))) continue
-    try {
-      fs.mkdirSync(skillsDir, { recursive: true })
-    } catch {
-      continue
-    }
-    try {
-      removeLegacyBundledSkills(skillsDir)
-    } catch {}
-    for (const skill of skills) {
-      try {
-        linkSkill(skill, skillsDir, false)
-      } catch {
-        // best-effort: a single bad store must not fail the build
-      }
-    }
-  }
-}
-
 const LEGACY_BUNDLED_SKILL_DIRS = [
   'sootsim-setup',
   'sootsim-debug',

package/cli/commands/telemetry.ts

@@ -2,8 +2,7 @@
 // product analytics preference shown by guided setup and Settings.
 //
 // this is the process-wide preference; `DO_NOT_TRACK=1` still forces opt-out
-// for a single run regardless of what's stored (honored by isOptedOut in
-// telemetry.ts, the same cross-tool signal npm/turbo/supabase use).
+// for a single run regardless of stored consent, including CI and agents.
 
 import {
   configFilePath,
@@ -16,7 +15,13 @@ function printStatus(): void {
   const preferences = readPrivacyPreferences()
   const enabled = preferences.configured && preferences.productAnalytics
   console.log(`  bounded diagnostics are ${enabled ? 'ON' : 'OFF'}`)
-  console.log('  permitted fields: package name/version/unsupported API or error class')
+  console.log('  fields: CLI/runtime versions, OS/arch, command name, random install ID')
+  console.log(
+    '  diagnostics: package name/version/unsupported API; error class and first-line error/warning messages (300 characters, paths redacted)',
+  )
+  console.log(
+    '  explicit opt-in also applies in CI, pipes and agent runs; DO_NOT_TRACK wins',
+  )
   console.log(`  config: ${configFilePath()}`)
   const doNotTrack = process.env.DO_NOT_TRACK
   if (doNotTrack === '1' || doNotTrack === 'true') {

package/cli/commands/test.ts

@@ -455,6 +455,24 @@ function collectFlowHelperPaths(flowAbsPath: string): string[] {
   return helpers
 }
 
+// a synthesized workspace config that selects exactly one flow. bun's glob
+// (node:fs.globSync, which the planner reads) treats * ? [ ] { } as special
+// and has no backslash escape, so each is wrapped in a one-character class; a
+// leading `!` would negate the pattern, so it is anchored under ./.
+function selectionConfig(entryKey: string): string {
+  if (entryKey.includes('\\')) {
+    throw new Error(
+      `cloud test cannot select a flow whose path contains a backslash: ${entryKey}`,
+    )
+  }
+  const escaped = entryKey.replace(/[*?[\]{}]/g, (char) => `[${char}]`)
+  const glob = escaped.startsWith('!') ? `./${escaped}` : escaped
+  return (
+    '# synthesized by peach test --cloud: run exactly the submitted entry flow.\n' +
+    `flows:\n  - ${JSON.stringify(glob)}\n`
+  )
+}
+
 function collectTestFiles(
   targetPath: string,
   ignoredPath: string | null,
@@ -522,17 +540,14 @@ function collectTestFiles(
       // the recorder runs an unpacked multi-file upload as a workspace,
       // whose default glob only sees top-level flows: a nested entry would
       // lose to a top-level helper. pin a config that selects the entry.
-      if (!keys.some((key) => /^config\.ya?ml$/.test(basename(key)))) {
+      if (!keys.some((key) => /^config\.ya?ml$/.test(key))) {
         if (Object.keys(files).length >= RNX_CLOUD_TEST_FILES_MAX_COUNT) {
           throw new Error(
             `cloud test suites may contain at most ${RNX_CLOUD_TEST_FILES_MAX_COUNT} files`,
           )
         }
         const entryKey = keys[0] as string
-        const glob = entryKey.replace(/[\\*?[\]{}()!+@]/g, '\\$&')
-        files['config.yaml'] =
-          '# synthesized by peach test --cloud: run exactly the submitted entry flow.\n' +
-          `flows:\n  - ${JSON.stringify(glob)}\n`
+        files['config.yaml'] = selectionConfig(entryKey)
       }
     }
     for (const configName of [
@@ -682,11 +697,16 @@ export async function runCloudTest(
     return 1
   }
 
-  const targetPath = resolve(process.cwd(), target)
+  let targetPath = resolve(process.cwd(), target)
   if (!existsSync(targetPath)) {
     console.error(`  error: test target not found: ${target}`)
     return 1
   }
+  // a file literally named config.yaml names a workspace, not a flow: local
+  // dispatch runs its directory, so hosted planning does too.
+  if (statSync(targetPath).isFile() && /^config\.ya?ml$/.test(basename(targetPath))) {
+    targetPath = dirname(targetPath)
+  }
 
   if (!app) {
     console.error(
@@ -798,21 +818,135 @@ export async function runCloudTest(
     app.includes('/api/preview/share/bundle')
       ? null
       : resolve(process.cwd(), app)
-  const testFiles = collectTestFiles(collectionPath, localBundlePath)
-  if (Object.keys(testFiles).length === 0) {
-    console.error(`  error: no test files found at ${target}`)
-    return 1
+
+  // one hosted job per Maestro flow. a suite whose total executor time passes
+  // the 45 minute per-job cap still completes when every flow stays under it,
+  // so a directory target uploads the whole original file set (flows and
+  // helpers byte-identical) plus a synthesized config selecting one flow per
+  // job. tag selection resolves here, before any submission, exactly as a
+  // local workspace run resolves it: the CLI planner reads the workspace
+  // config, applies CLI include/exclude overrides, and the selected flows are
+  // the jobs. the jobs run one at a time because live sidecars can share
+  // mutable backend state. detox suites and explicit single flows keep their
+  // existing one-job whole-suite path.
+  const jobs: Array<{
+    label: string | null
+    testFiles: Record<string, string>
+    testArgs: string[] | null
+  }> = []
+  const hasConfig = forwarded.some(
+    (arg) => arg === '--config' || arg.startsWith('--config='),
+  )
+  const maestroConfig = hasConfig && isMaestroConfigValue(config)
+  const maestroTarget = (() => {
+    if (hasConfig && !maestroConfig) return false
+    if (!statSync(targetPath).isDirectory()) {
+      return /\.ya?ml$/.test(extname(targetPath))
+    }
+    return (
+      readdirSync(targetPath).some((name) => /\.ya?ml$/.test(name)) ||
+      ['.maestro', 'maestro'].includes(basename(targetPath))
+    )
+  })()
+  if (maestroTarget) {
+    // maestro has no test-name or test-path selection; the cloud selector
+    // vocabulary is shared with detox, so a jest selector here is refused
+    // before submission rather than silently dropped from the hosted job.
+    const unsupported = (cloudTestArgs ?? []).filter((arg) => {
+      const eq = arg.indexOf('=')
+      const head = eq > 0 ? arg.slice(0, eq) : arg
+      return ['-t', '--testNamePattern', '--testPathPattern', '--grep'].includes(head)
+    })
+    if (unsupported.length > 0) {
+      for (const arg of unsupported) {
+        const eq = arg.indexOf('=')
+        const head = eq > 0 ? arg.slice(0, eq) : arg
+        console.error(
+          `  error: ${head} selects detox/jest tests and does not apply to a maestro target`,
+        )
+      }
+      return 1
+    }
+  }
+  if (maestroTarget && statSync(targetPath).isDirectory()) {
+    const { collectFlowFiles, splitTagList } = await import('./maestro')
+    const tagFlag = (name: string): string[] | null => {
+      let values: string[] | null = null
+      for (let i = 0; i < forwarded.length; i++) {
+        const arg = forwarded[i]
+        const eq = arg.indexOf('=')
+        const head = eq > 0 ? arg.slice(0, eq) : arg
+        if (head !== name) continue
+        const inline = eq > 0 ? arg.slice(eq + 1) : null
+        const next = forwarded[i + 1]
+        const value = inline ?? (next !== undefined && !next.startsWith('-') ? next : '')
+        if (inline === null && next !== undefined && !next.startsWith('-')) i += 1
+        if (values === null) values = []
+        values.push(...splitTagList(value))
+      }
+      return values
+    }
+    const includeTags = tagFlag('--include-tags')
+    const excludeTags = tagFlag('--exclude-tags')
+    let flows: string[]
+    try {
+      flows = collectFlowFiles(targetPath, {
+        configPath: config ? resolve(process.cwd(), config) : undefined,
+        includeTags,
+        excludeTags,
+      })
+    } catch (err) {
+      console.error(`  error: ${err instanceof Error ? err.message : String(err)}`)
+      return 1
+    }
+    if (flows.length === 0) {
+      console.error(
+        includeTags !== null || excludeTags !== null
+          ? `  error: no flows in ${target} match the requested tags`
+          : `  error: no *.yaml or *.yml files found in ${target}`,
+      )
+      return 1
+    }
+    const baseFiles = collectTestFiles(targetPath, localBundlePath)
+    for (const flow of flows) {
+      const entryKey = relative(targetPath, flow).split(sep).join('/')
+      let generated: string
+      try {
+        generated = selectionConfig(entryKey)
+      } catch (err) {
+        console.error(`  error: ${err instanceof Error ? err.message : String(err)}`)
+        return 1
+      }
+      // the recorder selects the root workspace config. nested config.yaml
+      // files may be runFlow helpers and must keep their original bytes.
+      const testFiles = { ...baseFiles, 'config.yaml': generated }
+      jobs.push({ label: entryKey, testFiles, testArgs: null })
+    }
+    console.log(
+      `  cloud test: ${jobs.length} flow${jobs.length === 1 ? '' : 's'}, one hosted job each`,
+    )
+  } else {
+    const testFiles = collectTestFiles(collectionPath, localBundlePath)
+    if (Object.keys(testFiles).length === 0) {
+      console.error(`  error: no test files found at ${target}`)
+      return 1
+    }
+    jobs.push({ label: null, testFiles, testArgs: cloudTestArgs })
   }
 
-  // the tunnel stays open from submit until the job reaches a terminal
-  // state; tearing it down early strands the recorder mid-run.
+  // the tunnel stays open from the first submit until every job reaches a
+  // terminal state; tearing it down early strands the recorder mid-run.
   if (liveDevStack && liveSidecarPorts) {
     try {
       const published = await publishLiveDevStack({
         devPort: liveDevStack.port,
         sidecarPorts: liveSidecarPorts,
       })
-      tunnelTargetUrl = published.targetUrl
+      const appUrl = new URL(app)
+      const targetUrl = new URL(published.targetUrl)
+      targetUrl.pathname = appUrl.pathname
+      targetUrl.search = appUrl.search
+      tunnelTargetUrl = targetUrl.href
       tunnelHostHeader = published.hostHeader
       tunnelJobToken = published.jobToken
       tunnelSidecarPorts = published.sidecarPorts.join(',') || undefined
@@ -824,150 +958,229 @@ export async function runCloudTest(
     }
   }
 
-  const submitPayload: Record<string, unknown> = {
-    kind: 'test',
-    testFiles,
+  // a signal stops the run: it lets a submission already in flight finish, so
+  // an accepted job is never orphaned, cancels the job currently relying on
+  // this process's tunnel, and only then lets the tunnel close. the listener
+  // is installed once for the whole invocation and removed on the way out; a
+  // second signal waits for that cancellation instead of closing the tunnel
+  // while a delete is still pending.
+  const tunnelDependent = closeTunnel !== null
+  let interrupted = false
+  let wake: (() => void) | null = null
+  const onSignal = () => {
+    if (interrupted) {
+      console.error('  already stopping: waiting for the current job to cancel')
+      return
+    }
+    interrupted = true
+    console.error('\n  interrupted: stopping after the current job')
+    wake?.()
+  }
+  if (tunnelDependent) {
+    process.on('SIGINT', onSignal)
+    process.on('SIGTERM', onSignal)
   }
-  if (bundleUrl) submitPayload.bundleUrl = bundleUrl
-  if (bundle) submitPayload.bundle = bundle
-  if (bundleShareId) submitPayload.bundleShareId = bundleShareId
-  if (tunnelTargetUrl) submitPayload.targetUrl = tunnelTargetUrl
-  if (tunnelHostHeader) submitPayload.hostHeader = tunnelHostHeader
-  if (tunnelJobToken) submitPayload.jobToken = tunnelJobToken
-  if (tunnelSidecarPorts) submitPayload.sidecarPorts = tunnelSidecarPorts
-  if (owner) submitPayload.owner = owner
-  if (repo) submitPayload.repo = repo
-  if (cloudTestArgs) submitPayload.testArgs = cloudTestArgs
 
-  try {
-    const endpoint = `${origin.replace(/\/$/, '')}/api/sootsim/runner/jobs`
-    let response: Response
-    try {
-      response = await fetch(endpoint, {
-        method: 'POST',
-        headers: {
-          'content-type': 'application/json',
-          authorization: authHeaderValue(auth),
-        },
-        body: JSON.stringify(submitPayload),
-      })
-    } catch (err) {
-      console.error(
-        `  error: could not connect to ${endpoint}: ${err instanceof Error ? err.message : String(err)}`,
-      )
-      return 1
-    }
+  // a sleep the signal handler can cut short, so an interrupt is noticed while
+  // a job poll is waiting instead of after the whole interval.
+  const waitForPoll = (ms: number) =>
+    new Promise<void>((resolvePoll) => {
+      const timer = setTimeout(() => {
+        wake = null
+        resolvePoll()
+      }, ms)
+      wake = () => {
+        clearTimeout(timer)
+        wake = null
+        resolvePoll()
+      }
+    })
 
-    if (!response.ok) {
-      const body = await response.text()
-      let message = body
-      try {
-        const json = JSON.parse(body)
-        if (json.message) message = json.message
-      } catch {}
-      console.error(
-        `  error: cloud test submission failed (${response.status}): ${message}`,
-      )
-      return 1
-    }
+  const submitIdentity: Record<string, unknown> = {}
+  if (bundleUrl) submitIdentity.bundleUrl = bundleUrl
+  if (bundle) submitIdentity.bundle = bundle
+  if (bundleShareId) submitIdentity.bundleShareId = bundleShareId
+  if (tunnelTargetUrl) submitIdentity.targetUrl = tunnelTargetUrl
+  if (tunnelHostHeader) submitIdentity.hostHeader = tunnelHostHeader
+  if (tunnelJobToken) submitIdentity.jobToken = tunnelJobToken
+  if (tunnelSidecarPorts) submitIdentity.sidecarPorts = tunnelSidecarPorts
+  if (owner) submitIdentity.owner = owner
+  if (repo) submitIdentity.repo = repo
 
-    const { id } = (await response.json()) as { id: string }
-    console.log(`  cloud test job submitted: ${id}`)
-    // a job whose app this process serves over its tunnel cannot finish once
-    // the process exits, so an interrupt cancels it rather than leaving it to
-    // fail flow by flow while it bills.
-    if (closeTunnel) {
-      const cancelOnSignal = () => {
-        console.error(`\n  interrupted: cancelling ${id}`)
-        void cancelCloudTest(id, origin).finally(() => {
-          closeTunnel?.()
-          process.exit(130)
-        })
+  const summary: Array<{ label: string; passed: boolean }> = []
+  let worstExit = 0
+  try {
+    for (const [index, job] of jobs.entries()) {
+      const submitPayload: Record<string, unknown> = {
+        kind: 'test',
+        testFiles: job.testFiles,
+        ...submitIdentity,
       }
-      process.once('SIGINT', cancelOnSignal)
-      process.once('SIGTERM', cancelOnSignal)
-    }
-
-    const pollUrl = `${origin.replace(/\/$/, '')}/api/sootsim/runner/jobs?id=${encodeURIComponent(id)}`
-    const startedAt = Date.now()
+      if (job.testArgs) submitPayload.testArgs = job.testArgs
 
-    while (Date.now() - startedAt < timeoutMs) {
-      await new Promise((resolve) => setTimeout(resolve, pollIntervalMs))
-      let pollRes: Response
+      const endpoint = `${origin.replace(/\/$/, '')}/api/sootsim/runner/jobs`
+      let response: Response
       try {
-        pollRes = await fetch(pollUrl, {
-          headers: { authorization: authHeaderValue(auth) },
+        response = await fetch(endpoint, {
+          method: 'POST',
+          headers: {
+            'content-type': 'application/json',
+            authorization: authHeaderValue(auth),
+          },
+          body: JSON.stringify(submitPayload),
         })
       } catch (err) {
-        console.warn(
-          `  warn: error polling job: ${err instanceof Error ? err.message : String(err)}`,
+        // a transport failure is not a flow failure: stop submitting further
+        // jobs and report. jobs that already ran keep their collected results.
+        console.error(
+          `  error: could not connect to ${endpoint}: ${err instanceof Error ? err.message : String(err)}`,
         )
-        continue
+        if (interrupted) break
+        return 1
       }
-      if (!pollRes.ok) {
-        console.warn(`  warn: polling error: HTTP ${pollRes.status}`)
-        continue
+
+      if (!response.ok) {
+        const body = await response.text()
+        let message = body
+        try {
+          const json = JSON.parse(body)
+          if (json.message) message = json.message
+        } catch {}
+        console.error(
+          `  error: cloud test submission failed (${response.status}): ${message}`,
+        )
+        if (interrupted) break
+        return 1
       }
-      const job = (await pollRes.json()) as {
-        id: string
-        status: string
-        result?: {
-          previewId?: string | null
-          previewUrl?: string | null
-          runId?: string | null
-          flows?: Array<{
-            flow?: string | null
-            previewId?: string | null
-            previewUrl?: string | null
-            runId?: string | null
-          }> | null
-          exitCode?: number | null
-          failureReason?: string | null
-        } | null
+
+      const { id } = (await response.json()) as { id: string }
+      console.log(
+        jobs.length > 1
+          ? `  cloud test job ${index + 1}/${jobs.length} (${job.label}) submitted: ${id}`
+          : `  cloud test job submitted: ${id}`,
+      )
+      if (interrupted) {
+        // the signal arrived while the POST was in flight: the server accepted
+        // the job, so cancel it before the tunnel closes.
+        if (tunnelDependent) await cancelCloudTest(id, origin)
+        break
       }
 
-      if (
-        job.status === 'done' ||
-        job.status === 'failed' ||
-        job.status === 'expired' ||
-        job.status === 'cancelled'
-      ) {
-        const result = job.result
-        // a job the recorder failed after a passing suite (missing recording or
-        // registration) is still a failed run.
-        const exitCode =
-          job.status === 'done' ? (result?.exitCode ?? 0) : result?.exitCode || 1
-        console.log(`  status:    ${job.status}`)
-        console.log(`  exit code: ${exitCode}`)
-        if (result?.previewUrl) {
-          console.log(`  preview:   ${result.previewUrl}`)
-        } else if (result?.previewId) {
-          console.log(
-            `  preview:   ${origin.replace(/\/$/, '')}/preview/${result.previewId}`,
+      const pollUrl = `${origin.replace(/\/$/, '')}/api/sootsim/runner/jobs?id=${encodeURIComponent(id)}`
+      const startedAt = Date.now()
+      let exitCode: number | null = null
+
+      // every flow keeps the job's own budget; a wait that expires cancels
+      // the job before the tunnel closes, and later flows are not submitted.
+      while (!interrupted && Date.now() - startedAt < timeoutMs) {
+        await waitForPoll(pollIntervalMs)
+        if (interrupted) break
+        let pollRes: Response
+        try {
+          pollRes = await fetch(pollUrl, {
+            headers: { authorization: authHeaderValue(auth) },
+          })
+        } catch (err) {
+          console.warn(
+            `  warn: error polling job: ${err instanceof Error ? err.message : String(err)}`,
           )
+          continue
+        }
+        if (interrupted) break
+        if (!pollRes.ok) {
+          console.warn(`  warn: polling error: HTTP ${pollRes.status}`)
+          continue
         }
-        if (result?.runId) {
-          console.log(`  run:       ${result.runId}`)
+        const jobState = (await pollRes.json()) as {
+          id: string
+          status: string
+          result?: {
+            previewId?: string | null
+            previewUrl?: string | null
+            runId?: string | null
+            flows?: Array<{
+              flow?: string | null
+              previewId?: string | null
+              previewUrl?: string | null
+              runId?: string | null
+            }> | null
+            exitCode?: number | null
+            failureReason?: string | null
+          } | null
         }
-        if (result?.flows && result.flows.length > 1) {
-          result.flows.forEach((flow, index) => {
+
+        if (
+          jobState.status === 'done' ||
+          jobState.status === 'failed' ||
+          jobState.status === 'expired' ||
+          jobState.status === 'cancelled'
+        ) {
+          const result = jobState.result
+          // a job the recorder failed after a passing suite (missing recording or
+          // registration) is still a failed run.
+          exitCode =
+            jobState.status === 'done' ? (result?.exitCode ?? 0) : result?.exitCode || 1
+          console.log(`  status:    ${jobState.status}`)
+          console.log(`  exit code: ${exitCode}`)
+          if (result?.previewUrl) {
+            console.log(`  preview:   ${result.previewUrl}`)
+          } else if (result?.previewId) {
             console.log(
-              `  flow ${index + 1}:    ${flow.flow ?? '(unknown flow)'} preview=${flow.previewUrl ?? flow.previewId ?? 'none'} run=${flow.runId ?? 'none'}`,
+              `  preview:   ${origin.replace(/\/$/, '')}/preview/${result.previewId}`,
             )
-          })
-        }
-        if (result?.failureReason) {
-          console.error(`  failure:   ${result.failureReason}`)
+          }
+          if (result?.runId) {
+            console.log(`  run:       ${result.runId}`)
+          }
+          if (result?.flows && (result.flows.length > 1 || jobs.length > 1)) {
+            result.flows.forEach((flow, flowIndex) => {
+              console.log(
+                `  flow ${flowIndex + 1}:    ${flow.flow ?? job.label ?? '(unknown flow)'} preview=${flow.previewUrl ?? flow.previewId ?? 'none'} run=${flow.runId ?? 'none'}`,
+              )
+            })
+          }
+          if (result?.failureReason) {
+            console.error(`  failure:   ${result.failureReason}`)
+          }
+          break
         }
-        return exitCode
       }
-    }
 
-    console.error(
-      `  error: cloud test timed out after ${timeoutMs < 1000 ? `${timeoutMs}ms` : `${timeoutMs / 1000}s`}`,
-    )
-    return 1
+      if (exitCode === null) {
+        // the wait ended without a terminal state: the budget ran out or a
+        // signal asked to stop. a tunnel-dependent job is cancelled before
+        // the tunnel closes instead of failing flow by flow while it bills.
+        if (tunnelDependent) await cancelCloudTest(id, origin)
+        if (interrupted) break
+        console.error(
+          `  error: cloud test timed out after ${timeoutMs < 1000 ? `${timeoutMs}ms` : `${timeoutMs / 1000}s`}`,
+        )
+        return 1
+      }
+
+      summary.push({ label: job.label ?? id, passed: exitCode === 0 })
+      if (exitCode !== 0 && worstExit === 0) worstExit = exitCode
+      if (interrupted) break
+    }
+    if (interrupted) return 130
+    return worstExit
   } finally {
+    if (tunnelDependent) {
+      process.off('SIGINT', onSignal)
+      process.off('SIGTERM', onSignal)
+    }
+    if (jobs.length > 1 && summary.length > 0) {
+      console.log('\n  cloud test summary:')
+      for (const entry of summary) {
+        console.log(`    ${entry.passed ? 'pass' : 'fail'}  ${entry.label}`)
+      }
+      const passed = summary.filter((entry) => entry.passed).length
+      const stopped =
+        summary.length < jobs.length
+          ? ` (stopped after ${summary.length} of ${jobs.length})`
+          : ''
+      console.log(`    ${passed}/${summary.length} flows passed${stopped}`)
+    }
     closeTunnel?.()
   }
 }