qa360 2.1.5 → 2.1.7

package/dist/commands/ai.d.ts

@@ -30,6 +30,8 @@ export declare function aiGenerateCommand(prompt: string, options?: {
     provider?: string;
     type?: string;
     json?: boolean;
+    pack?: boolean;
+    output?: string;
 }): Promise<void>;
 /**
  * Show AI configuration

package/dist/commands/ai.js

@@ -236,6 +236,11 @@ export async function aiBenchmarkCommand(options = {}) {
 export async function aiGenerateCommand(prompt, options = {}) {
     let spinner;
     try {
+        // Use pack generation if --pack flag is set
+        if (options.pack) {
+            await generatePackCommand(prompt, options);
+            return;
+        }
         const systemPrompt = buildSystemPrompt(options.type || 'api');
         const provider = options.provider
             ? await createLLMProvider({ preferred: options.provider })
@@ -289,10 +294,61 @@ export async function aiGenerateCommand(prompt, options = {}) {
             console.error(chalk.red('\nAnthropic Error:'), error.message);
         }
         else {
-            console.error(chalk.red('Error:'), error instanceof Error ? error.message : String(error));
+            const errMsg = error instanceof Error ? error.message : String(error);
+            console.error(chalk.red('Error:'), errMsg);
         }
     }
 }
+/**
+ * Generate a QA360 pack YAML using AI
+ */
+async function generatePackCommand(prompt, options = {}) {
+    const spinner = ora('Generating QA360 pack...').start();
+    try {
+        const systemPrompt = buildPackSystemPrompt();
+        const provider = options.provider
+            ? await createLLMProvider({ preferred: options.provider })
+            : await createBest();
+        const providerType = provider.getProviderType();
+        const enhancedPrompt = `Generate a QA360 v2 pack YAML for: ${prompt}
+
+Important: Return ONLY valid YAML starting with "version: 2". No code blocks, no explanations, just the YAML.`;
+        const response = await provider.generate({
+            prompt: enhancedPrompt,
+            systemPrompt,
+            maxTokens: 4096,
+            temperature: 0.3, // Lower temperature for more structured output
+        });
+        spinner.succeed(`Generated pack using ${chalk.cyan(providerType)}!\n`);
+        // Extract YAML from response (remove code blocks if present)
+        let yamlContent = response.content;
+        // Remove markdown code blocks
+        yamlContent = yamlContent.replace(/```yaml\n?/g, '').replace(/```\n?/g, '');
+        // Remove leading/trailing whitespace
+        yamlContent = yamlContent.trim();
+        // Determine output path
+        const outputPath = options.output || './qa360-pack.yml';
+        // Save the pack
+        const { writeFileSync } = await import('fs');
+        writeFileSync(outputPath, yamlContent, 'utf-8');
+        console.log(chalk.bold('Generated QA360 Pack:\n'));
+        console.log(chalk.gray('─'.repeat(70)));
+        console.log(yamlContent);
+        console.log(chalk.gray('─'.repeat(70)));
+        console.log(chalk.green(`\n✓ Pack saved to: ${outputPath}`));
+        console.log(chalk.gray(`\n[INFO] Tokens: ${response.usage.totalTokens} (${response.usage.promptTokens} in + ${response.usage.completionTokens} out)`));
+        console.log(chalk.gray(`[INFO] Provider: ${providerType} (${response.model})\n`));
+        // Show usage instructions
+        console.log(chalk.yellow('Next steps:'));
+        console.log(chalk.gray(`  1. Review the pack: cat ${outputPath}`));
+        console.log(chalk.gray(`  2. Run tests: qa360 run ${outputPath}`));
+        console.log(chalk.gray(`  3. Or validate: qa360 pack validate ${outputPath}\n`));
+    }
+    catch (error) {
+        spinner.fail('Pack generation failed');
+        console.error(chalk.red('Error:'), error instanceof Error ? error.message : String(error));
+    }
+}
 /**
  * Show AI configuration
  */
@@ -436,6 +492,53 @@ For accessibility tests:
     };
     return typePrompts[type] || typePrompts.api;
 }
+/**
+ * Build system prompt for QA360 pack YAML generation
+ */
+function buildPackSystemPrompt() {
+    return `You are a QA360 pack YAML generator. Generate VALID QA360 v2 pack YAML files.
+
+QA360 Pack v2 Structure:
+\`\`\`yaml
+version: 2
+name: test-pack-name
+description: Test pack description
+gates:
+  gate-name:
+    adapter: playwright-api|playwright-ui|k6-perf
+    enabled: true
+    config:
+      baseUrl: "https://example.com"
+      # API adapter: use "smoke" array with "METHOD path -> status" format
+      smoke:
+        - "GET /api/health -> 200"
+        - "POST /api/users -> 201"
+      # UI adapter: use "scenario" array or "pages" array
+      scenario:
+        - action: navigate
+          url: /login
+        - action: fill
+          selector: "#email"
+          value: "test@example.com"
+        - action: click
+          selector: "button[type='submit']"
+    options:
+      timeout: 10000
+budgets:
+  a11y_min: 70
+  perf_p95_ms: 3000
+\`\`\`
+
+Rules:
+1. ALWAYS start with "version: 2"
+2. Use "adapter:" not "type:"
+3. For API tests: use adapter: playwright-api with smoke: array
+4. For UI tests: use adapter: playwright-ui with scenario: array or pages: array
+5. Smoke format: "METHOD path -> status" (e.g., "GET /users -> 200")
+6. Scenario actions: navigate, fill, click, waitForSelector, assertText, assertVisible
+7. Return ONLY the YAML, no markdown code blocks, no explanations
+8. Make sure YAML is valid and properly indented`;
+}
 /**
  * Create AI commands
  */
@@ -486,6 +589,8 @@ export function createAICommands() {
         .option('-P, --provider <provider>', 'Use specific provider (deepseek, ollama, openai, anthropic)')
         .option('-t, --type <type>', 'Test type (api, ui, perf, a11y)', 'api')
         .option('--json', 'Output as JSON')
+        .option('--pack', 'Generate a QA360 pack YAML (instead of test code)')
+        .option('-o, --output <path>', 'Output file path (for --pack: ./qa360-pack.yml)')
         .action(async (prompt, options) => {
         try {
             await aiGenerateCommand(prompt, options);

package/dist/commands/init.js

@@ -530,9 +530,25 @@ export async function initCommand(options = {}) {
     try {
         console.log(chalk.bold.cyan('\n🚀 QA360 Pack Generator (v2)\n'));
         // Determine output file
-        const outputFile = options.output
-            ? resolve(options.output)
-            : join(process.cwd(), 'qa360.yml');
+        let outputFile;
+        if (options.output) {
+            const resolved = resolve(options.output);
+            // Check if it's a directory or if it doesn't have an extension
+            if (options.output.endsWith('/') || !options.output.includes('.')) {
+                // It's a directory path, create the file inside it
+                mkdirSync(resolved, { recursive: true });
+                outputFile = join(resolved, 'qa360.yml');
+            }
+            else {
+                // It's a file path, ensure parent directory exists
+                const dir = resolve(resolved, '..');
+                mkdirSync(dir, { recursive: true });
+                outputFile = resolved;
+            }
+        }
+        else {
+            outputFile = join(process.cwd(), 'qa360.yml');
+        }
         // Check if file exists
         if (existsSync(outputFile) && !options.force) {
             const overwrite = await inquirer.prompt([

package/dist/core/ai/anthropic-provider.js

@@ -36,6 +36,9 @@ export class AnthropicProvider {
         }
         // Try a minimal API call
         try {
+            // Use timeout with AbortController for compatibility
+            const controller = new AbortController();
+            const timeoutId = setTimeout(() => controller.abort(), 5000);
             const response = await fetch(`${this.baseURL}/v1/messages`, {
                 method: 'POST',
                 headers: {
@@ -43,13 +46,14 @@ export class AnthropicProvider {
                     'anthropic-version': this.version,
                     'content-type': 'application/json',
                 },
-                signal: AbortSignal.timeout(5000),
+                signal: controller.signal,
                 body: JSON.stringify({
                     model: this.defaultModel,
                     max_tokens: 1,
                     messages: [{ role: 'user', content: 'Hi' }]
                 })
             });
+            clearTimeout(timeoutId);
             // Anthropic may return 400 for malformed request but still be available
             // We consider it available if we get any response (not a network error)
             return response.status !== 401 && response.status !== 403;
@@ -65,46 +69,54 @@ export class AnthropicProvider {
             });
         }
         const messages = this.buildMessages(request);
-        const response = await fetch(`${this.baseURL}/v1/messages`, {
-            method: 'POST',
-            headers: {
-                'x-api-key': this.apiKey,
-                'anthropic-version': this.version,
-                'content-type': 'application/json',
-            },
-            signal: AbortSignal.timeout(this.timeout),
-            body: JSON.stringify({
-                model: this.defaultModel,
-                messages,
-                system: request.systemPrompt,
-                temperature: request.temperature ?? 0.7,
-                max_tokens: request.maxTokens ?? 4096,
-            })
-        });
-        if (!response.ok) {
-            const error = await response.text().catch(() => 'Unknown error');
-            throw new AnthropicError(`Anthropic request failed: ${response.status} ${error}`, {
-                status: response.status,
-                response: error
+        // Use timeout with AbortController for compatibility
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => controller.abort(), this.timeout);
+        try {
+            const response = await fetch(`${this.baseURL}/v1/messages`, {
+                method: 'POST',
+                headers: {
+                    'x-api-key': this.apiKey,
+                    'anthropic-version': this.version,
+                    'content-type': 'application/json',
+                },
+                signal: controller.signal,
+                body: JSON.stringify({
+                    model: this.defaultModel,
+                    messages,
+                    system: request.systemPrompt,
+                    temperature: request.temperature ?? 0.7,
+                    max_tokens: request.maxTokens ?? 4096,
+                })
             });
+            if (!response.ok) {
+                const error = await response.text().catch(() => 'Unknown error');
+                throw new AnthropicError(`Anthropic request failed: ${response.status} ${error}`, {
+                    status: response.status,
+                    response: error
+                });
+            }
+            const data = await response.json();
+            if (data.error) {
+                throw new AnthropicError(`Anthropic API error: ${data.error.message}`, {
+                    type: data.error.type
+                });
+            }
+            const content = this.extractContent(data.content);
+            return {
+                content,
+                usage: {
+                    promptTokens: data.usage?.input_tokens || 0,
+                    completionTokens: data.usage?.output_tokens || 0,
+                    totalTokens: (data.usage?.input_tokens || 0) + (data.usage?.output_tokens || 0),
+                },
+                model: data.model,
+                finishReason: data.stop_reason === 'end_turn' ? 'stop' : 'length'
+            };
         }
-        const data = await response.json();
-        if (data.error) {
-            throw new AnthropicError(`Anthropic API error: ${data.error.message}`, {
-                type: data.error.type
-            });
+        finally {
+            clearTimeout(timeoutId);
         }
-        const content = this.extractContent(data.content);
-        return {
-            content,
-            usage: {
-                promptTokens: data.usage?.input_tokens || 0,
-                completionTokens: data.usage?.output_tokens || 0,
-                totalTokens: (data.usage?.input_tokens || 0) + (data.usage?.output_tokens || 0),
-            },
-            model: data.model,
-            finishReason: data.stop_reason === 'end_turn' ? 'stop' : 'length'
-        };
     }
     async *stream(request) {
         if (!this.apiKey) {

package/dist/core/ai/deepseek-provider.js

@@ -48,13 +48,17 @@ export class DeepSeekProvider {
         }
         // Try a minimal API call
         try {
+            // Use timeout with AbortController for compatibility
+            const controller = new AbortController();
+            const timeoutId = setTimeout(() => controller.abort(), 5000);
             const response = await fetch(`${this.baseURL}/v1/models`, {
                 method: 'GET',
                 headers: {
                     'Authorization': `Bearer ${this.apiKey}`,
                 },
-                signal: AbortSignal.timeout(5000),
+                signal: controller.signal,
             });
+            clearTimeout(timeoutId);
             return response.ok;
         }
         catch {
@@ -69,42 +73,50 @@ export class DeepSeekProvider {
             });
         }
         const messages = this.buildMessages(request);
-        const response = await fetch(`${this.baseURL}/v1/chat/completions`, {
-            method: 'POST',
-            headers: {
-                'Authorization': `Bearer ${this.apiKey}`,
-                'Content-Type': 'application/json',
-            },
-            signal: AbortSignal.timeout(this.timeout),
-            body: JSON.stringify({
-                model: this.defaultModel,
-                messages,
-                temperature: request.temperature ?? 0.7,
-                max_tokens: request.maxTokens ?? 4096,
-            })
-        });
-        if (!response.ok) {
-            const errorText = await response.text().catch(() => 'Unknown error');
-            throw new DeepSeekError(`DeepSeek request failed: ${response.status} ${errorText}`, {
-                status: response.status,
-                response: errorText
+        // Use timeout with AbortController for compatibility
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => controller.abort(), this.timeout);
+        try {
+            const response = await fetch(`${this.baseURL}/v1/chat/completions`, {
+                method: 'POST',
+                headers: {
+                    'Authorization': `Bearer ${this.apiKey}`,
+                    'Content-Type': 'application/json',
+                },
+                signal: controller.signal,
+                body: JSON.stringify({
+                    model: this.defaultModel,
+                    messages,
+                    temperature: request.temperature ?? 0.7,
+                    max_tokens: request.maxTokens ?? 4096,
+                })
             });
+            if (!response.ok) {
+                const errorText = await response.text().catch(() => 'Unknown error');
+                throw new DeepSeekError(`DeepSeek request failed: ${response.status} ${errorText}`, {
+                    status: response.status,
+                    response: errorText
+                });
+            }
+            const data = await response.json();
+            const choice = data.choices?.[0];
+            if (!choice) {
+                throw new DeepSeekError('No choices returned from DeepSeek');
+            }
+            return {
+                content: choice.message.content,
+                usage: {
+                    promptTokens: data.usage?.prompt_tokens || 0,
+                    completionTokens: data.usage?.completion_tokens || 0,
+                    totalTokens: data.usage?.total_tokens || 0,
+                },
+                model: data.model,
+                finishReason: choice.finish_reason === 'stop' ? 'stop' : 'length'
+            };
         }
-        const data = await response.json();
-        const choice = data.choices?.[0];
-        if (!choice) {
-            throw new DeepSeekError('No choices returned from DeepSeek');
+        finally {
+            clearTimeout(timeoutId);
         }
-        return {
-            content: choice.message.content,
-            usage: {
-                promptTokens: data.usage?.prompt_tokens || 0,
-                completionTokens: data.usage?.completion_tokens || 0,
-                totalTokens: data.usage?.total_tokens || 0,
-            },
-            model: data.model,
-            finishReason: choice.finish_reason === 'stop' ? 'stop' : 'length'
-        };
     }
     async *stream(request) {
         if (!this.apiKey) {

package/dist/core/ai/ollama-provider.js

@@ -32,9 +32,13 @@ export class OllamaProvider {
     }
     async isAvailable() {
         try {
+            // Use timeout with AbortSignal - wrap for compatibility
+            const controller = new AbortController();
+            const timeoutId = setTimeout(() => controller.abort(), 5000);
             const response = await fetch(`${this.baseUrl}/api/tags`, {
-                signal: AbortSignal.timeout(5000),
+                signal: controller.signal,
             });
+            clearTimeout(timeoutId);
             return response.ok;
         }
         catch {
@@ -43,37 +47,45 @@ export class OllamaProvider {
     }
     async generate(request) {
         const fullPrompt = this.buildFullPrompt(request);
-        const response = await fetch(`${this.baseUrl}/api/generate`, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            signal: AbortSignal.timeout(this.timeout),
-            body: JSON.stringify({
+        // Use timeout with AbortController for compatibility
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => controller.abort(), this.timeout);
+        try {
+            const response = await fetch(`${this.baseUrl}/api/generate`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                signal: controller.signal,
+                body: JSON.stringify({
+                    model: this.defaultModel,
+                    prompt: fullPrompt,
+                    stream: false,
+                    options: {
+                        temperature: request.temperature ?? 0.7,
+                        num_predict: request.maxTokens ?? 4096,
+                    }
+                })
+            });
+            if (!response.ok) {
+                throw new OllamaError(`Ollama request failed: ${response.status} ${response.statusText}`, { response: await response.text().catch(() => 'Unknown error') });
+            }
+            const data = await response.json();
+            if (data.error) {
+                throw new OllamaError(data.error);
+            }
+            return {
+                content: data.response,
+                usage: {
+                    promptTokens: data.prompt_eval_count || 0,
+                    completionTokens: data.eval_count || 0,
+                    totalTokens: (data.prompt_eval_count || 0) + (data.eval_count || 0),
+                },
                 model: this.defaultModel,
-                prompt: fullPrompt,
-                stream: false,
-                options: {
-                    temperature: request.temperature ?? 0.7,
-                    num_predict: request.maxTokens ?? 4096,
-                }
-            })
-        });
-        if (!response.ok) {
-            throw new OllamaError(`Ollama request failed: ${response.status} ${response.statusText}`, { response: await response.text().catch(() => 'Unknown error') });
+                finishReason: data.done_reason || 'stop',
+            };
         }
-        const data = await response.json();
-        if (data.error) {
-            throw new OllamaError(data.error);
+        finally {
+            clearTimeout(timeoutId);
         }
-        return {
-            content: data.response,
-            usage: {
-                promptTokens: data.prompt_eval_count || 0,
-                completionTokens: data.eval_count || 0,
-                totalTokens: (data.prompt_eval_count || 0) + (data.eval_count || 0),
-            },
-            model: this.defaultModel,
-            finishReason: data.done_reason || 'stop',
-        };
     }
     async *stream(request) {
         const fullPrompt = this.buildFullPrompt(request);

package/dist/core/ai/openai-provider.js

@@ -36,13 +36,17 @@ export class OpenAIProvider {
         }
         // Try a minimal API call
         try {
+            // Use timeout with AbortController for compatibility
+            const controller = new AbortController();
+            const timeoutId = setTimeout(() => controller.abort(), 5000);
             const response = await fetch(`${this.baseURL}/models`, {
                 method: 'GET',
                 headers: {
                     'Authorization': `Bearer ${this.apiKey}`,
                 },
-                signal: AbortSignal.timeout(5000),
+                signal: controller.signal,
             });
+            clearTimeout(timeoutId);
             return response.ok;
         }
         catch {
@@ -56,42 +60,50 @@ export class OpenAIProvider {
             });
         }
         const messages = this.buildMessages(request);
-        const response = await fetch(`${this.baseURL}/chat/completions`, {
-            method: 'POST',
-            headers: {
-                'Authorization': `Bearer ${this.apiKey}`,
-                'Content-Type': 'application/json',
-            },
-            signal: AbortSignal.timeout(this.timeout),
-            body: JSON.stringify({
-                model: this.defaultModel,
-                messages,
-                temperature: request.temperature ?? 0.7,
-                max_tokens: request.maxTokens ?? 4096,
-            })
-        });
-        if (!response.ok) {
-            const error = await response.text().catch(() => 'Unknown error');
-            throw new OpenAIError(`OpenAI request failed: ${response.status} ${error}`, {
-                status: response.status,
-                response: error
+        // Use timeout with AbortController for compatibility
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => controller.abort(), this.timeout);
+        try {
+            const response = await fetch(`${this.baseURL}/chat/completions`, {
+                method: 'POST',
+                headers: {
+                    'Authorization': `Bearer ${this.apiKey}`,
+                    'Content-Type': 'application/json',
+                },
+                signal: controller.signal,
+                body: JSON.stringify({
+                    model: this.defaultModel,
+                    messages,
+                    temperature: request.temperature ?? 0.7,
+                    max_tokens: request.maxTokens ?? 4096,
+                })
             });
+            if (!response.ok) {
+                const error = await response.text().catch(() => 'Unknown error');
+                throw new OpenAIError(`OpenAI request failed: ${response.status} ${error}`, {
+                    status: response.status,
+                    response: error
+                });
+            }
+            const data = await response.json();
+            const choice = data.choices?.[0];
+            if (!choice) {
+                throw new OpenAIError('No choices returned from OpenAI');
+            }
+            return {
+                content: choice.message.content,
+                usage: {
+                    promptTokens: data.usage?.prompt_tokens || 0,
+                    completionTokens: data.usage?.completion_tokens || 0,
+                    totalTokens: data.usage?.total_tokens || 0,
+                },
+                model: data.model,
+                finishReason: choice.finish_reason === 'stop' ? 'stop' : 'length'
+            };
         }
-        const data = await response.json();
-        const choice = data.choices?.[0];
-        if (!choice) {
-            throw new OpenAIError('No choices returned from OpenAI');
+        finally {
+            clearTimeout(timeoutId);
         }
-        return {
-            content: choice.message.content,
-            usage: {
-                promptTokens: data.usage?.prompt_tokens || 0,
-                completionTokens: data.usage?.completion_tokens || 0,
-                totalTokens: data.usage?.total_tokens || 0,
-            },
-            model: data.model,
-            finishReason: choice.finish_reason === 'stop' ? 'stop' : 'length'
-        };
     }
     async *stream(request) {
         if (!this.apiKey) {

package/dist/core/pack-v2/loader.d.ts

@@ -2,6 +2,7 @@
  * QA360 Pack v2 Loader
  *
  * Loads and parses pack.yml v2 files from the filesystem.
+ * Supports environment variable substitution with ${VAR} and ${VAR:-default} syntax.
  */
 import { PackConfigV2, PackValidationResultV2, ValidationError } from '../types/pack-v2.js';
 export interface PackLoadResult {

package/dist/core/pack-v2/loader.js

@@ -2,12 +2,41 @@
  * QA360 Pack v2 Loader
  *
  * Loads and parses pack.yml v2 files from the filesystem.
+ * Supports environment variable substitution with ${VAR} and ${VAR:-default} syntax.
  */
 import { readFileSync, existsSync } from 'fs';
 import { resolve } from 'path';
 import * as yaml from 'js-yaml';
 import { PackValidatorV2 } from './validator.js';
 import { PackMigrator } from './migrator.js';
+/**
+ * Substitute environment variables in a string
+ * Supports ${VAR} and ${VAR:-default} syntax
+ */
+function substituteEnvVars(str) {
+    return str.replace(/\$\{([^}:]+)(:-([^}]*))?\}/g, (match, varName, _, defaultValue) => {
+        return process.env[varName] ?? defaultValue ?? match;
+    });
+}
+/**
+ * Recursively substitute environment variables in an object
+ */
+function substituteEnvVarsRecursive(obj) {
+    if (typeof obj === 'string') {
+        return substituteEnvVars(obj);
+    }
+    if (Array.isArray(obj)) {
+        return obj.map(substituteEnvVarsRecursive);
+    }
+    if (obj !== null && typeof obj === 'object') {
+        const result = {};
+        for (const [key, value] of Object.entries(obj)) {
+            result[key] = substituteEnvVarsRecursive(value);
+        }
+        return result;
+    }
+    return obj;
+}
 export class PackLoaderV2 {
     cache = new Map();
     /**
@@ -30,16 +59,18 @@ export class PackLoaderV2 {
             const content = readFileSync(resolvedPath, 'utf-8');
             // Parse YAML
             const parsed = yaml.load(content);
+            // Substitute environment variables
+            const substituted = substituteEnvVarsRecursive(parsed);
             // Detect version
             const migrator = new PackMigrator();
-            const detectedVersion = migrator.detectVersion(parsed);
+            const detectedVersion = migrator.detectVersion(substituted);
             // Set format
             const format = detectedVersion === 1 ? 'v1' : detectedVersion === 2 ? 'v2' : 'unknown';
             // For v1 without migration
             if (detectedVersion === 1 && options?.migrate === false) {
                 return {
                     success: true,
-                    pack: parsed,
+                    pack: substituted,
                     format: 'v1',
                     migrated: false,
                     sourcePath: resolvedPath
@@ -51,10 +82,10 @@ export class PackLoaderV2 {
             let migrationWarnings = [];
             if (detectedVersion === 1) {
                 // Check for legacy format before migrating
-                if (migrator.isLegacyFormat(parsed)) {
+                if (migrator.isLegacyFormat(substituted)) {
                     return {
                         success: false,
-                        error: new Error(`Legacy pack format detected (version ${parsed.version || '0.9.x'}). ` +
+                        error: new Error(`Legacy pack format detected (version ${substituted.version || '0.9.x'}). ` +
                             `This format is no longer supported.\n\n` +
                             `To fix this:\n` +
                             `  1. Delete the old pack file: ${resolvedPath}\n` +
@@ -65,7 +96,7 @@ export class PackLoaderV2 {
                     };
                 }
                 // Migrate v1 to v2
-                const migrationResult = migrator.migrate(parsed);
+                const migrationResult = migrator.migrate(substituted);
                 if (!migrationResult.success) {
                     return {
                         success: false,
@@ -80,14 +111,14 @@ export class PackLoaderV2 {
                 migrationWarnings = migrationResult.warnings;
             }
             else if (detectedVersion === 2) {
-                pack = parsed;
+                pack = substituted;
             }
             else {
                 // Check for legacy format and provide helpful error
-                if (migrator.isLegacyFormat(parsed)) {
+                if (migrator.isLegacyFormat(substituted)) {
                     return {
                         success: false,
-                        error: new Error(`Legacy pack format detected (version ${parsed.version || '0.9.x'}). ` +
+                        error: new Error(`Legacy pack format detected (version ${substituted.version || '0.9.x'}). ` +
                             `This format is no longer supported.\n\n` +
                             `To fix this:\n` +
                             `  1. Delete the old pack file: ${resolvedPath}\n` +
@@ -99,7 +130,7 @@ export class PackLoaderV2 {
                 }
                 return {
                     success: false,
-                    error: new Error(`Unknown pack format. Version: ${parsed.version}`),
+                    error: new Error(`Unknown pack format. Version: ${substituted.version}`),
                     sourcePath: resolvedPath,
                     format: 'unknown'
                 };
@@ -189,13 +220,15 @@ export class PackLoaderV2 {
     async loadFromString(yamlContent, options) {
         try {
             const parsed = yaml.load(yamlContent);
+            // Substitute environment variables
+            const substituted = substituteEnvVarsRecursive(parsed);
             // Detect version and migrate if needed
             const migrator = new PackMigrator();
-            const detectedVersion = migrator.detectVersion(parsed);
+            const detectedVersion = migrator.detectVersion(substituted);
             let pack;
             let migrated = false;
             if (detectedVersion === 1) {
-                const migrationResult = migrator.migrate(parsed);
+                const migrationResult = migrator.migrate(substituted);
                 if (!migrationResult.success) {
                     return {
                         success: false,
@@ -206,12 +239,12 @@ export class PackLoaderV2 {
                 migrated = true;
             }
             else if (detectedVersion === 2) {
-                pack = parsed;
+                pack = substituted;
             }
             else {
                 return {
                     success: false,
-                    error: new Error(`Unknown pack format. Version: ${parsed.version}`)
+                    error: new Error(`Unknown pack format. Version: ${substituted.version}`)
                 };
             }
             // Validate if requested

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qa360",
-  "version": "2.1.5",
+  "version": "2.1.7",
   "description": "QA360 Proof CLI - Quality as Cryptographic Proof",
   "type": "module",
   "main": "dist/index.js",