skopix 2.0.0

package/cli/commands/dashboard.js

@@ -0,0 +1,3524 @@
+import chalk from 'chalk';
+import http from 'http';
+import path from 'path';
+import fs from 'fs-extra';
+import yaml from 'yaml';
+import { spawn } from 'child_process';
+import { fileURLToPath } from 'url';
+import open from 'open';
+import os from 'os';
+import crypto from 'crypto';
+import { loadIssueStore, saveIssueStore } from '../../core/tracker.js';
+
+// Team mode imports - loaded lazily (only used when SKOPIX_TEAM_MODE=true)
+let teamMode = null; // populated below if team mode is active
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const SAVED_TESTS_FILE = '_saved.suite.yaml';
+
+export async function dashboardCommand(options) {
+  const port = parseInt(options.port) || 9000;
+  const host = options.host || process.env.SKOPIX_HOST || '127.0.0.1';
+  const reportsDir = path.resolve(options.dir || './skopix-reports');
+  const webRoot = path.resolve(__dirname, '..', '..', 'web');
+  const suitesDir = path.resolve(process.cwd());
+  const suiteRunsDir = path.join(reportsDir, '.suite-runs');
+
+  await fs.ensureDir(reportsDir);
+  await fs.ensureDir(suiteRunsDir);
+  const activeRuns = new Map();
+  const activeRecordings = new Map();
+
+  // ── AGENT REGISTRY ────────────────────────────────────────────────────────
+  // Tracks connected skopix agents (teammates' machines that do browser work)
+  const agents = new Map(); // agentId -> { id, name, machine, userId, ws, status, currentJob, connectedAt }
+
+  function getAvailableAgents() {
+    return [...agents.values()].filter(a => a.status === 'idle' && a.ws.readyState === 1);
+  }
+
+  function getLeastBusyAgent(preferUserId) {
+    const available = getAvailableAgents();
+    if (!available.length) return null;
+    // Prefer the agent belonging to the requesting user
+    const mine = available.find(a => a.userId === preferUserId);
+    if (mine) return mine;
+    return available[0];
+  }
+
+  const agentSseListeners = new Set(); // SSE clients listening for agent updates
+
+  function broadcastAgentList() {
+    const list = [...agents.values()].map(a => ({
+      id: a.id, name: a.name, machine: a.machine, userId: a.userId,
+      status: a.status, currentJob: a.currentJob || null, connectedAt: a.connectedAt,
+    }));
+    agentSseListeners.forEach(fn => { try { fn(list); } catch {} });
+  }
+
+  function sendToAgent(agent, msg) {
+    try { agent.ws.send(JSON.stringify(msg)); return true; } catch { return false; }
+  }
+
+  // ─── TEAM MODE INIT (opt-in via env var or flag) ────────────────────────
+  // Single-user mode (default): skip all DB/auth setup, behave exactly as before.
+  // Team mode: initialise SQLite, enable /setup wizard and /api/auth routes.
+  const isTeamMode = options.team === true || process.env.SKOPIX_TEAM_MODE === 'true' || process.env.SKOPIX_TEAM_MODE === '1';
+  if (isTeamMode) {
+    try {
+      const dbModule = await import('../../core/db.js');
+      const authModule = await import('../../core/auth.js');
+      await dbModule.initDb();
+      teamMode = { db: dbModule, auth: authModule };
+      console.log(chalk.cyan('  ◆ Team mode enabled'));
+    } catch (err) {
+      console.error(chalk.red('  ✖ Failed to enable team mode: ') + err.message);
+      console.error(chalk.dim('  Falling back to single-user mode'));
+      teamMode = null;
+    }
+  }
+
+  const server = http.createServer(async (req, res) => {
+    try {
+      const url = new URL(req.url, `http://localhost:${port}`);
+      const pathname = url.pathname;
+      const method = req.method;
+
+      res.setHeader('Access-Control-Allow-Origin', '*');
+      res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
+      res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+
+      if (method === 'OPTIONS') { res.writeHead(204); res.end(); return; }
+
+      // ─── TEAM MODE: SETUP WIZARD ───────────────────────────────────────
+      // Only active when team mode is on. In single-user mode these routes
+      // simply don't match and execution falls through to existing logic.
+      if (teamMode) {
+        // Status endpoint - tells the frontend if setup is needed
+        if (pathname === '/api/team/status' && method === 'GET') {
+          sendJSON(res, 200, {
+            teamMode: true,
+            needsSetup: !teamMode.db.hasAnyAdmin(),
+          });
+          return;
+        }
+
+        // First-run setup: creates the initial admin
+        if (pathname === '/api/setup' && method === 'POST') {
+          if (teamMode.db.hasAnyAdmin()) {
+            sendJSON(res, 403, { error: 'Setup already complete' });
+            return;
+          }
+          try {
+            const body = await readBody(req);
+            const { email, name, password } = JSON.parse(body);
+            if (!teamMode.auth.isValidEmail(email)) {
+              sendJSON(res, 400, { error: 'Invalid email address' });
+              return;
+            }
+            if (!name || typeof name !== 'string' || name.trim().length === 0) {
+              sendJSON(res, 400, { error: 'Name is required' });
+              return;
+            }
+            if (typeof password !== 'string' || password.length < 8) {
+              sendJSON(res, 400, { error: 'Password must be at least 8 characters' });
+              return;
+            }
+            const passwordHash = await teamMode.auth.hashPassword(password);
+            const userId = teamMode.auth.generateUserId();
+            const user = teamMode.db.createUser({
+              id: userId,
+              email: email.trim().toLowerCase(),
+              name: name.trim(),
+              passwordHash,
+              role: 'admin',
+            });
+            teamMode.db.logAudit({
+              userId: user.id,
+              action: 'user.created',
+              targetType: 'user',
+              targetId: user.id,
+              metadata: { role: 'admin', via: 'setup-wizard' },
+            });
+            sendJSON(res, 200, {
+              ok: true,
+              user: { id: user.id, email: user.email, name: user.name, role: user.role },
+            });
+          } catch (err) {
+            sendJSON(res, 500, { error: err.message });
+          }
+          return;
+        }
+
+        // ─── AUTH: LOGIN ─────────────────────────────────────────────────
+        if (pathname === '/api/auth/login' && method === 'POST') {
+          try {
+            const body = await readBody(req);
+            const { email, password } = JSON.parse(body);
+            if (typeof email !== 'string' || typeof password !== 'string') {
+              sendJSON(res, 400, { error: 'Email and password are required' });
+              return;
+            }
+            const user = teamMode.db.getUserByEmail(email.trim().toLowerCase());
+            // Use generic error to avoid leaking which emails are registered
+            const fail = () => sendJSON(res, 401, { error: 'Invalid email or password' });
+            if (!user) { fail(); return; }
+            if (user.status !== 'active') {
+              sendJSON(res, 403, { error: 'Account is disabled. Contact your admin.' });
+              return;
+            }
+            const ok = await teamMode.auth.verifyPassword(password, user.password_hash);
+            if (!ok) { fail(); return; }
+
+            // Create session
+            const token = teamMode.auth.generateSessionToken();
+            const expiresAt = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000).toISOString(); // 30 days
+            teamMode.db.createWebSession({
+              token,
+              userId: user.id,
+              expiresAt,
+              ipAddress: req.socket.remoteAddress,
+              userAgent: req.headers['user-agent'] || null,
+            });
+            teamMode.db.updateUserLastLogin(user.id);
+            teamMode.db.logAudit({
+              userId: user.id,
+              action: 'user.login',
+              targetType: 'user',
+              targetId: user.id,
+            });
+
+            // Set HTTP-only cookie
+            // Note: SameSite=Lax allows the cookie to flow on same-site navigations.
+            // We don't set Secure unless the request was HTTPS (so localhost still works).
+            const isHttps = req.headers['x-forwarded-proto'] === 'https' || req.connection.encrypted === true;
+            const cookieAttrs = [
+              `skopix_session=${token}`,
+              'Path=/',
+              'HttpOnly',
+              'SameSite=Lax',
+              `Max-Age=${30 * 24 * 60 * 60}`,
+              ...(isHttps ? ['Secure'] : []),
+            ];
+            res.setHeader('Set-Cookie', cookieAttrs.join('; '));
+            sendJSON(res, 200, {
+              ok: true,
+              user: { id: user.id, email: user.email, name: user.name, role: user.role },
+            });
+          } catch (err) {
+            sendJSON(res, 500, { error: err.message });
+          }
+          return;
+        }
+
+        // ─── AUTH: LOGOUT ────────────────────────────────────────────────
+        if (pathname === '/api/auth/logout' && method === 'POST') {
+          const token = parseCookie(req.headers.cookie || '', 'skopix_session');
+          if (token) {
+            const session = teamMode.db.getWebSession(token);
+            if (session) {
+              teamMode.db.logAudit({
+                userId: session.user_id,
+                action: 'user.logout',
+                targetType: 'user',
+                targetId: session.user_id,
+              });
+            }
+            teamMode.db.deleteWebSession(token);
+          }
+          // Clear the cookie
+          res.setHeader('Set-Cookie', 'skopix_session=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0');
+          sendJSON(res, 200, { ok: true });
+          return;
+        }
+
+        // ─── AUTH: ME (whoami) ───────────────────────────────────────────
+        if (pathname === '/api/auth/me' && method === 'GET') {
+          const token = parseCookie(req.headers.cookie || '', 'skopix_session');
+          if (!token) {
+            sendJSON(res, 401, { error: 'Not authenticated' });
+            return;
+          }
+          const session = teamMode.db.getWebSession(token);
+          if (!session) {
+            // Token invalid or expired - clear cookie too
+            res.setHeader('Set-Cookie', 'skopix_session=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0');
+            sendJSON(res, 401, { error: 'Session expired' });
+            return;
+          }
+          const user = teamMode.db.getUserById(session.user_id);
+          if (!user || user.status !== 'active') {
+            teamMode.db.deleteWebSession(token);
+            res.setHeader('Set-Cookie', 'skopix_session=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0');
+            sendJSON(res, 401, { error: 'Account no longer active' });
+            return;
+          }
+          // Refresh last_used_at so active sessions don't expire prematurely
+          teamMode.db.touchWebSession(token);
+          sendJSON(res, 200, {
+            user: { id: user.id, email: user.email, name: user.name, role: user.role },
+          });
+          return;
+        }
+      }
+
+      // ─── AUTH GATE (team mode only) ────────────────────────────────────
+      // In team mode, every non-public route requires a valid session.
+      // Public routes (login, setup, status, static pages) are allowed through.
+      // In single-user mode this check is skipped entirely.
+      let currentUser = null;
+      if (teamMode) {
+        const resolved = resolveCurrentUser(req, teamMode);
+        if (resolved) currentUser = resolved.user;
+
+        // Special: the /app/ dashboard requires auth at the server level.
+        // If not authenticated, redirect to /login so the user never sees the dashboard.
+        // (The JS-level check is still there as a defence-in-depth fallback.)
+        const isAppPage = (pathname === '/app' || pathname === '/app/' || pathname === '/app/index.html');
+        if (isAppPage && !currentUser) {
+          res.writeHead(302, { Location: '/login' });
+          res.end();
+          return;
+        }
+
+        // For protected API routes (everything not in the public whitelist), 401.
+        if (!isPublicPath(pathname) && !currentUser) {
+          sendJSON(res, 401, { error: 'Authentication required' });
+          return;
+        }
+
+        // ─── ROLE-BASED WRITE BLOCK (viewers are read-only) ──────────────
+        // Block any write method for viewers. The few endpoints that viewers
+        // legitimately need to call (logout, change own password, etc) are
+        // explicitly whitelisted below.
+        if (currentUser && currentUser.role === 'viewer') {
+          const isWriteMethod = method === 'POST' || method === 'PUT' || method === 'PATCH' || method === 'DELETE';
+          // Allowed writes for viewers - things they need for basic account use
+          const viewerAllowedWrites = (
+            pathname === '/api/auth/logout' || // can log themselves out
+            pathname === '/api/user/password' || // can change own password
+            pathname.startsWith('/api/user/secrets') // can manage own API keys
+          );
+          if (isWriteMethod && !viewerAllowedWrites) {
+            sendJSON(res, 403, { error: 'Your role is read-only. Ask an admin to upgrade you to Editor to make changes.' });
+            return;
+          }
+        }
+      }
+
+      // ─── TEAM MODE: USERS & INVITES (admin only) ───────────────────────
+      // All these endpoints require admin role. currentUser is set by the auth gate above.
+      if (teamMode) {
+        // List all users
+        if (pathname === '/api/users' && method === 'GET') {
+          if (!currentUser || !teamMode.auth.canManageUsers(currentUser.role)) {
+            sendJSON(res, 403, { error: 'Admin access required' });
+            return;
+          }
+          // Defence in depth: sanitise output (never expose password_hash)
+          const users = teamMode.db.listUsers().map(u => ({
+            id: u.id, email: u.email, name: u.name,
+            role: u.role, status: u.status,
+            created_at: u.created_at, last_login_at: u.last_login_at,
+          }));
+          sendJSON(res, 200, users);
+          return;
+        }
+
+        // Update a user (change role or status)
+        if (pathname.match(/^\/api\/users\/[^/]+$/) && method === 'PATCH') {
+          if (!currentUser || !teamMode.auth.canManageUsers(currentUser.role)) {
+            sendJSON(res, 403, { error: 'Admin access required' });
+            return;
+          }
+          const userId = pathname.split('/')[3];
+          try {
+            const body = await readBody(req);
+            const { role, status } = JSON.parse(body);
+
+            const target = teamMode.db.getUserById(userId);
+            if (!target) { sendJSON(res, 404, { error: 'User not found' }); return; }
+
+            // Safety: can't downgrade your own role
+            if (role && target.id === currentUser.id && role !== currentUser.role) {
+              sendJSON(res, 400, { error: "You can't change your own role. Ask another admin." });
+              return;
+            }
+            // Safety: can't disable yourself
+            if (status === 'disabled' && target.id === currentUser.id) {
+              sendJSON(res, 400, { error: "You can't disable your own account." });
+              return;
+            }
+            // Safety: can't demote/disable the last active admin
+            if ((role && role !== 'admin' && target.role === 'admin') ||
+                (status === 'disabled' && target.role === 'admin')) {
+              if (teamMode.db.countAdmins() <= 1) {
+                sendJSON(res, 400, { error: 'Cannot remove the last admin. Promote someone else first.' });
+                return;
+              }
+            }
+
+            let updated = target;
+            if (role && teamMode.auth.isValidRole(role)) {
+              updated = teamMode.db.updateUserRole(userId, role);
+              teamMode.db.logAudit({
+                userId: currentUser.id, action: 'user.role_changed',
+                targetType: 'user', targetId: userId,
+                metadata: { from: target.role, to: role },
+              });
+            }
+            if (status && (status === 'active' || status === 'disabled')) {
+              updated = teamMode.db.updateUserStatus(userId, status);
+              teamMode.db.logAudit({
+                userId: currentUser.id, action: status === 'disabled' ? 'user.disabled' : 'user.enabled',
+                targetType: 'user', targetId: userId,
+              });
+              // If disabling, kill all their sessions
+              if (status === 'disabled') {
+                teamMode.db.getDb().prepare('DELETE FROM web_sessions WHERE user_id = ?').run(userId);
+              }
+            }
+            sendJSON(res, 200, { id: updated.id, email: updated.email, name: updated.name, role: updated.role, status: updated.status });
+          } catch (err) {
+            sendJSON(res, 500, { error: err.message });
+          }
+          return;
+        }
+
+        // Delete a user
+        if (pathname.match(/^\/api\/users\/[^/]+$/) && method === 'DELETE') {
+          if (!currentUser || !teamMode.auth.canManageUsers(currentUser.role)) {
+            sendJSON(res, 403, { error: 'Admin access required' });
+            return;
+          }
+          const userId = pathname.split('/')[3];
+          const target = teamMode.db.getUserById(userId);
+          if (!target) { sendJSON(res, 404, { error: 'User not found' }); return; }
+
+          // Safety rails
+          if (target.id === currentUser.id) {
+            sendJSON(res, 400, { error: "You can't remove yourself. Ask another admin." });
+            return;
+          }
+          if (target.role === 'admin' && teamMode.db.countAdmins() <= 1) {
+            sendJSON(res, 400, { error: 'Cannot remove the last admin.' });
+            return;
+          }
+          teamMode.db.deleteUser(userId);
+          teamMode.db.logAudit({
+            userId: currentUser.id, action: 'user.deleted',
+            targetType: 'user', targetId: userId,
+            metadata: { email: target.email, name: target.name },
+          });
+          sendJSON(res, 200, { deleted: true });
+          return;
+        }
+
+        // List pending invites
+        if (pathname === '/api/invites' && method === 'GET') {
+          if (!currentUser || !teamMode.auth.canManageUsers(currentUser.role)) {
+            sendJSON(res, 403, { error: 'Admin access required' });
+            return;
+          }
+          // Prune expired first so the list is clean
+          teamMode.db.pruneExpiredInvites();
+          sendJSON(res, 200, teamMode.db.listInvites());
+          return;
+        }
+
+        // Create an invite
+        if (pathname === '/api/invites' && method === 'POST') {
+          if (!currentUser || !teamMode.auth.canManageUsers(currentUser.role)) {
+            sendJSON(res, 403, { error: 'Admin access required' });
+            return;
+          }
+          try {
+            const body = await readBody(req);
+            const { email, role } = JSON.parse(body);
+            const trimmedEmail = (email || '').trim().toLowerCase();
+            if (!teamMode.auth.isValidEmail(trimmedEmail)) {
+              sendJSON(res, 400, { error: 'Invalid email address' });
+              return;
+            }
+            if (!teamMode.auth.isValidRole(role)) {
+              sendJSON(res, 400, { error: 'Invalid role. Choose admin, editor, or viewer.' });
+              return;
+            }
+            // Reject if a user already exists with this email
+            if (teamMode.db.getUserByEmail(trimmedEmail)) {
+              sendJSON(res, 400, { error: 'A user with that email already exists.' });
+              return;
+            }
+            const token = teamMode.auth.generateInviteToken();
+            const expiresAt = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000).toISOString(); // 7 days
+            const invite = teamMode.db.createInvite({
+              token, email: trimmedEmail, role, invitedBy: currentUser.id, expiresAt,
+            });
+            teamMode.db.logAudit({
+              userId: currentUser.id, action: 'invite.created',
+              targetType: 'invite', targetId: token,
+              metadata: { email: trimmedEmail, role },
+            });
+            sendJSON(res, 200, {
+              token: invite.token, email: invite.email, role: invite.role, expiresAt: invite.expires_at,
+            });
+          } catch (err) {
+            sendJSON(res, 500, { error: err.message });
+          }
+          return;
+        }
+
+        // Revoke an invite
+        if (pathname.match(/^\/api\/invites\/[^/]+$/) && method === 'DELETE') {
+          if (!currentUser || !teamMode.auth.canManageUsers(currentUser.role)) {
+            sendJSON(res, 403, { error: 'Admin access required' });
+            return;
+          }
+          const token = pathname.split('/')[3];
+          const deleted = teamMode.db.deleteInvite(token);
+          if (deleted) {
+            teamMode.db.logAudit({
+              userId: currentUser.id, action: 'invite.revoked',
+              targetType: 'invite', targetId: token,
+            });
+          }
+          sendJSON(res, 200, { deleted });
+          return;
+        }
+
+        // ─── AUDIT LOG (admin only) ──────────────────────────────────────
+        if (pathname === '/api/audit-log' && method === 'GET') {
+          if (!currentUser || !teamMode.auth.canManageUsers(currentUser.role)) {
+            sendJSON(res, 403, { error: 'Admin access required' });
+            return;
+          }
+          const url = new URL(req.url, `http://localhost:${port}`);
+          const filters = {
+            userId: url.searchParams.get('userId') || undefined,
+            action: url.searchParams.get('action') || undefined,
+            since: url.searchParams.get('since') || undefined,
+            limit: parseInt(url.searchParams.get('limit') || '100'),
+          };
+          sendJSON(res, 200, teamMode.db.listAuditLog(filters));
+          return;
+        }
+
+        // ─── ACTIVE SESSIONS (admin only) ────────────────────────────────
+        if (pathname === '/api/sessions/active' && method === 'GET') {
+          if (!currentUser || !teamMode.auth.canManageUsers(currentUser.role)) {
+            sendJSON(res, 403, { error: 'Admin access required' });
+            return;
+          }
+          const sessions = teamMode.db.listActiveSessions().map(s => ({
+            // Hash the token before sending so the actual session cookie isn't leaked
+            // even to admins. We only need the token to revoke - keep a short id instead.
+            shortId: s.token.slice(0, 8) + '...' + s.token.slice(-4),
+            tokenHash: crypto.createHash('sha256').update(s.token).digest('hex').slice(0, 16),
+            userId: s.userId, userName: s.userName, userEmail: s.userEmail, userRole: s.userRole,
+            createdAt: s.createdAt, expiresAt: s.expiresAt, lastUsedAt: s.lastUsedAt,
+            ipAddress: s.ipAddress, userAgent: s.userAgent,
+            isCurrent: s.userId === currentUser.id,
+          }));
+          sendJSON(res, 200, sessions);
+          return;
+        }
+
+        // Force logout: revoke all sessions for a user (admin only)
+        if (pathname.match(/^\/api\/users\/[^/]+\/sessions$/) && method === 'DELETE') {
+          if (!currentUser || !teamMode.auth.canManageUsers(currentUser.role)) {
+            sendJSON(res, 403, { error: 'Admin access required' });
+            return;
+          }
+          const userId = pathname.split('/')[3];
+          const target = teamMode.db.getUserById(userId);
+          if (!target) { sendJSON(res, 404, { error: 'User not found' }); return; }
+          if (target.id === currentUser.id) {
+            sendJSON(res, 400, { error: "You can't force-logout yourself. Use the logout button instead." });
+            return;
+          }
+          const revoked = teamMode.db.revokeAllUserSessions(userId);
+          teamMode.db.logAudit({
+            userId: currentUser.id, action: 'user.sessions_revoked',
+            targetType: 'user', targetId: userId,
+            metadata: { sessionsRevoked: revoked },
+          });
+          sendJSON(res, 200, { ok: true, revoked });
+          return;
+        }
+
+        // ─── ADMIN-GENERATED PASSWORD RESET LINK ─────────────────────────
+        if (pathname.match(/^\/api\/users\/[^/]+\/reset-password$/) && method === 'POST') {
+          if (!currentUser || !teamMode.auth.canManageUsers(currentUser.role)) {
+            sendJSON(res, 403, { error: 'Admin access required' });
+            return;
+          }
+          const userId = pathname.split('/')[3];
+          const target = teamMode.db.getUserById(userId);
+          if (!target) { sendJSON(res, 404, { error: 'User not found' }); return; }
+          const token = teamMode.auth.generateInviteToken();
+          const expiresAt = new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString(); // 24h
+          teamMode.db.createPasswordReset({ token, userId, expiresAt });
+          teamMode.db.logAudit({
+            userId: currentUser.id, action: 'user.reset_generated',
+            targetType: 'user', targetId: userId,
+            metadata: { email: target.email },
+          });
+          sendJSON(res, 200, { token, expiresAt });
+          return;
+        }
+
+        // ─── PUBLIC INVITE ENDPOINTS (no auth needed) ──────────────────
+        // Get invite details (for the accept page to show context)
+        if (pathname.match(/^\/api\/invites\/[^/]+$/) && method === 'GET') {
+          const token = pathname.split('/')[3];
+          const invite = teamMode.db.getInvite(token);
+          if (!invite) { sendJSON(res, 404, { error: 'Invalid or expired invite' }); return; }
+          if (new Date(invite.expires_at) < new Date()) {
+            sendJSON(res, 410, { error: 'This invite has expired' });
+            return;
+          }
+          if (invite.accepted_at) {
+            sendJSON(res, 410, { error: 'This invite has already been used' });
+            return;
+          }
+          const inviter = teamMode.db.getUserById(invite.invited_by);
+          sendJSON(res, 200, {
+            email: invite.email,
+            role: invite.role,
+            invitedByName: inviter?.name || 'an admin',
+            expiresAt: invite.expires_at,
+          });
+          return;
+        }
+
+        // Accept an invite + create the account
+        if (pathname.match(/^\/api\/invites\/[^/]+\/accept$/) && method === 'POST') {
+          const token = pathname.split('/')[3];
+          const invite = teamMode.db.getInvite(token);
+          if (!invite) { sendJSON(res, 404, { error: 'Invalid invite' }); return; }
+          if (new Date(invite.expires_at) < new Date()) {
+            sendJSON(res, 410, { error: 'This invite has expired' });
+            return;
+          }
+          if (invite.accepted_at) {
+            sendJSON(res, 410, { error: 'This invite has already been used' });
+            return;
+          }
+          try {
+            const body = await readBody(req);
+            const { name, password } = JSON.parse(body);
+            if (!name || typeof name !== 'string' || name.trim().length === 0) {
+              sendJSON(res, 400, { error: 'Name is required' });
+              return;
+            }
+            if (typeof password !== 'string' || password.length < 8) {
+              sendJSON(res, 400, { error: 'Password must be at least 8 characters' });
+              return;
+            }
+            // Double-check email isn't taken (in case admin manually created since invite)
+            if (teamMode.db.getUserByEmail(invite.email)) {
+              sendJSON(res, 400, { error: 'A user with that email already exists' });
+              return;
+            }
+            const passwordHash = await teamMode.auth.hashPassword(password);
+            const userId = teamMode.auth.generateUserId();
+            const user = teamMode.db.createUser({
+              id: userId,
+              email: invite.email,
+              name: name.trim(),
+              passwordHash,
+              role: invite.role,
+            });
+            teamMode.db.markInviteAccepted(token);
+            teamMode.db.logAudit({
+              userId: user.id, action: 'user.created',
+              targetType: 'user', targetId: user.id,
+              metadata: { role: invite.role, via: 'invite', invitedBy: invite.invited_by },
+            });
+
+            // Auto-login: create session + cookie
+            const sessionToken = teamMode.auth.generateSessionToken();
+            const sessionExpires = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000).toISOString();
+            teamMode.db.createWebSession({
+              token: sessionToken,
+              userId: user.id,
+              expiresAt: sessionExpires,
+              ipAddress: req.socket.remoteAddress,
+              userAgent: req.headers['user-agent'] || null,
+            });
+            teamMode.db.updateUserLastLogin(user.id);
+
+            const isHttps = req.headers['x-forwarded-proto'] === 'https' || req.connection.encrypted === true;
+            const cookieAttrs = [
+              `skopix_session=${sessionToken}`,
+              'Path=/', 'HttpOnly', 'SameSite=Lax',
+              `Max-Age=${30 * 24 * 60 * 60}`,
+              ...(isHttps ? ['Secure'] : []),
+            ];
+            res.setHeader('Set-Cookie', cookieAttrs.join('; '));
+            sendJSON(res, 200, {
+              ok: true,
+              user: { id: user.id, email: user.email, name: user.name, role: user.role },
+            });
+          } catch (err) {
+            sendJSON(res, 500, { error: err.message });
+          }
+          return;
+        }
+
+        // GET password reset details (public)
+        if (pathname.match(/^\/api\/password-reset\/[^/]+$/) && method === 'GET') {
+          const token = pathname.split('/')[3];
+          const reset = teamMode.db.getPasswordReset(token);
+          if (!reset) { sendJSON(res, 404, { error: 'Invalid or expired link' }); return; }
+          const user = teamMode.db.getUserById(reset.user_id);
+          if (!user) { sendJSON(res, 404, { error: 'User no longer exists' }); return; }
+          sendJSON(res, 200, {
+            email: user.email,
+            name: user.name,
+            expiresAt: reset.expires_at,
+          });
+          return;
+        }
+
+        // Use password reset link (public)
+        if (pathname.match(/^\/api\/password-reset\/[^/]+$/) && method === 'POST') {
+          const token = pathname.split('/')[3];
+          const reset = teamMode.db.getPasswordReset(token);
+          if (!reset) { sendJSON(res, 404, { error: 'Invalid or expired link' }); return; }
+          try {
+            const body = await readBody(req);
+            const { newPassword } = JSON.parse(body);
+            if (typeof newPassword !== 'string' || newPassword.length < 8) {
+              sendJSON(res, 400, { error: 'Password must be at least 8 characters' });
+              return;
+            }
+            const user = teamMode.db.getUserById(reset.user_id);
+            if (!user) { sendJSON(res, 404, { error: 'User no longer exists' }); return; }
+            const newHash = await teamMode.auth.hashPassword(newPassword);
+            teamMode.db.updateUserPassword(user.id, newHash);
+            teamMode.db.markPasswordResetUsed(token);
+            // Revoke all existing sessions so old logins force a re-login
+            teamMode.db.revokeAllUserSessions(user.id);
+            teamMode.db.logAudit({
+              userId: user.id, action: 'user.password_reset',
+              targetType: 'user', targetId: user.id,
+              metadata: { via: 'admin-link' },
+            });
+            sendJSON(res, 200, { ok: true });
+          } catch (err) {
+            sendJSON(res, 500, { error: err.message });
+          }
+          return;
+        }
+
+        // ─── USER SECRETS (per-user encrypted tokens) ────────────────────
+        // List secret keys this user has set (returns keys only, never values).
+        if (pathname === '/api/user/secrets' && method === 'GET') {
+          if (!currentUser) { sendJSON(res, 401, { error: 'Auth required' }); return; }
+          const keys = teamMode.db.getUserSecretKeys(currentUser.id);
+          sendJSON(res, 200, keys);
+          return;
+        }
+
+        // Set a single secret. Body: { value: '...' }. Empty value = delete.
+        if (pathname.match(/^\/api\/user\/secrets\/[A-Z_]+$/) && method === 'PUT') {
+          if (!currentUser) { sendJSON(res, 401, { error: 'Auth required' }); return; }
+          // Note: viewers ARE allowed to set their own secrets (they manage their own account).
+          // The viewer write-block above is overridden here because this endpoint only affects the user themselves.
+          const key = pathname.split('/').pop();
+          if (!teamMode.auth.isValidSecretKey(key)) {
+            const extraAllowedKeys = ['SKOPIX_PROVIDER', 'OLLAMA_BASE_URL', 'OLLAMA_MODEL', 'OLLAMA_HOST'];
+            if (!teamMode.auth.USER_SECRET_KEYS.includes(key) && !extraAllowedKeys.includes(key)) {
+              sendJSON(res, 400, { error: 'Unknown secret key. Allowed: ' + [...teamMode.auth.USER_SECRET_KEYS, ...extraAllowedKeys].join(', ') }); return;
+            }
+            return;
+          }
+          try {
+            const body = await readBody(req);
+            const { value } = JSON.parse(body);
+            if (typeof value !== 'string') { sendJSON(res, 400, { error: 'Value must be a string' }); return; }
+
+            // Empty string = delete the secret
+            if (value.trim() === '') {
+              teamMode.db.deleteUserSecret(currentUser.id, key);
+              teamMode.db.logAudit({
+                userId: currentUser.id, action: 'user.secret_deleted',
+                targetType: 'user_secret', targetId: key,
+              });
+              sendJSON(res, 200, { ok: true, deleted: true });
+              return;
+            }
+
+            // Encrypt and store
+            const encrypted = teamMode.auth.encryptSecret(value);
+            teamMode.db.setUserSecret(currentUser.id, key, encrypted);
+            teamMode.db.logAudit({
+              userId: currentUser.id, action: 'user.secret_set',
+              targetType: 'user_secret', targetId: key,
+            });
+            sendJSON(res, 200, { ok: true, key });
+          } catch (err) {
+            sendJSON(res, 500, { error: err.message });
+          }
+          return;
+        }
+
+        // Delete a single secret explicitly.
+        if (pathname.match(/^\/api\/user\/secrets\/[A-Z_]+$/) && method === 'DELETE') {
+          if (!currentUser) { sendJSON(res, 401, { error: 'Auth required' }); return; }
+          const key = pathname.split('/').pop();
+          if (!teamMode.auth.isValidSecretKey(key)) {
+            sendJSON(res, 400, { error: 'Unknown secret key' });
+            return;
+          }
+          teamMode.db.deleteUserSecret(currentUser.id, key);
+          teamMode.db.logAudit({
+            userId: currentUser.id, action: 'user.secret_deleted',
+            targetType: 'user_secret', targetId: key,
+          });
+          sendJSON(res, 200, { ok: true });
+          return;
+        }
+
+        // ─── CHANGE OWN PASSWORD ─────────────────────────────────────────
+        if (pathname === '/api/user/password' && method === 'POST') {
+          if (!currentUser) { sendJSON(res, 401, { error: 'Auth required' }); return; }
+          try {
+            const body = await readBody(req);
+            const { currentPassword, newPassword } = JSON.parse(body);
+            if (typeof currentPassword !== 'string' || typeof newPassword !== 'string') {
+              sendJSON(res, 400, { error: 'currentPassword and newPassword are required' });
+              return;
+            }
+            if (newPassword.length < 8) {
+              sendJSON(res, 400, { error: 'New password must be at least 8 characters' });
+              return;
+            }
+            // Verify current password
+            const fresh = teamMode.db.getUserById(currentUser.id);
+            const ok = await teamMode.auth.verifyPassword(currentPassword, fresh.password_hash);
+            if (!ok) {
+              sendJSON(res, 401, { error: 'Current password is incorrect' });
+              return;
+            }
+            const newHash = await teamMode.auth.hashPassword(newPassword);
+            teamMode.db.updateUserPassword(currentUser.id, newHash);
+            teamMode.db.logAudit({
+              userId: currentUser.id, action: 'user.password_changed',
+              targetType: 'user', targetId: currentUser.id,
+            });
+            sendJSON(res, 200, { ok: true });
+          } catch (err) {
+            sendJSON(res, 500, { error: err.message });
+          }
+          return;
+        }
+      }
+
+      // ─── SESSIONS ──────────────────────────────────────────────────────
+      if (pathname === '/api/sessions' && method === 'GET') {
+        sendJSON(res, 200, await listSessions(reportsDir));
+        return;
+      }
+      if (pathname === '/api/stats' && method === 'GET') {
+        const sessions = await listSessions(reportsDir);
+        sendJSON(res, 200, computeStats(sessions));
+        return;
+      }
+      if (pathname.startsWith('/api/session/') && method === 'GET') {
+        const id = pathname.split('/')[3];
+        const data = await getSession(reportsDir, id);
+        if (!data) sendJSON(res, 404, { error: 'Not found' });
+        else sendJSON(res, 200, data);
+        return;
+      }
+      if (pathname.startsWith('/api/session/') && method === 'DELETE') {
+        const id = pathname.split('/')[3];
+        await deleteSession(reportsDir, id);
+        sendJSON(res, 200, { deleted: true });
+        return;
+      }
+      if (pathname === '/api/sessions' && method === 'DELETE') {
+        // Delete all sessions
+        await deleteAllSessions(reportsDir);
+        sendJSON(res, 200, { deleted: true });
+        return;
+      }
+      if (pathname === '/api/config' && method === 'GET') {
+        sendJSON(res, 200, await getConfig());
+        return;
+      }
+
+      // ─── RUN ───────────────────────────────────────────────────────────
+      // ─── RECORDER ENDPOINTS ──────────────────────────────────────────────────
+      // POST /api/agent/auth — agents call this to identify themselves by email/password
+      // Returns { userId, name } so the agent can register with the correct userId
+      // Uses same secret key as header auth (already validated above)
+      if (pathname === '/api/agent/auth' && method === 'POST') {
+        if (!teamMode) { sendJSON(res, 200, { userId: null, name: 'local' }); return; }
+        const body = await readBody(req);
+        let agentAuthBody = {};
+        try { agentAuthBody = JSON.parse(body); } catch {}
+        const { email, password } = agentAuthBody;
+        if (!email || !password) { sendJSON(res, 400, { error: 'email and password required' }); return; }
+        const user = teamMode.db.getUserByEmail(email.trim().toLowerCase());
+        if (!user) { sendJSON(res, 401, { error: 'Invalid credentials' }); return; }
+        const ok = await teamMode.auth.verifyPassword(password, user.password_hash);
+        if (!ok) { sendJSON(res, 401, { error: 'Invalid credentials' }); return; }
+        sendJSON(res, 200, { userId: user.id, name: user.name, email: user.email });
+        return;
+      }
+
+      // GET /api/agents — list connected agents
+      if (pathname === '/api/agents' && method === 'GET') {
+        const list = [...agents.values()].map(a => ({
+          id: a.id, name: a.name, machine: a.machine, userId: a.userId,
+          status: a.status, currentJob: a.currentJob || null, connectedAt: a.connectedAt,
+        }));
+        sendJSON(res, 200, list);
+        return;
+      }
+
+      // GET /api/agents/stream — SSE stream for live agent status updates
+      if (pathname === '/api/agents/stream' && method === 'GET') {
+        res.writeHead(200, { 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-cache', 'Connection': 'keep-alive', 'Access-Control-Allow-Origin': '*' });
+        // Send current list immediately
+        const currentList = [...agents.values()].map(a => ({ id: a.id, name: a.name, machine: a.machine, userId: a.userId, status: a.status, currentJob: a.currentJob || null, connectedAt: a.connectedAt }));
+        try { res.write('data: ' + JSON.stringify(currentList) + '\n\n'); } catch {}
+        const fn = (list) => { try { res.write('data: ' + JSON.stringify(list) + '\n\n'); } catch {} };
+        agentSseListeners.add(fn);
+        req.on('close', () => agentSseListeners.delete(fn));
+        return;
+      }
+
+      if (pathname === '/api/record/start' && method === 'POST') {
+        const body = await readBody(req);
+        const config = JSON.parse(body);
+        if (!config.url) { sendJSON(res, 400, { error: 'url is required' }); return; }
+
+        // In team mode, dispatch to an agent if available
+        const userId = currentUser?.id || null;
+        const agent = teamMode ? getLeastBusyAgent(userId) : null;
+
+        if (teamMode && !agent) {
+          sendJSON(res, 503, { error: 'No agent connected. Run "skopix agent --server ' + (req.headers.host || 'localhost:9000') + '" on your machine first.' });
+          return;
+        }
+
+        const recordingId = Math.random().toString(36).slice(2, 10);
+        const screenshotDir = path.join(reportsDir, '_recordings', recordingId);
+        await fs.ensureDir(screenshotDir);
+        const recording = { id: recordingId, url: config.url, status: 'recording', steps: [], output: [], listeners: [], screenshotDir, process: null };
+        activeRecordings.set(recordingId, recording);
+
+        if (agent) {
+          // Dispatch to agent — agent will open browser on teammate's machine
+          agent.status = 'recording';
+          agent.currentJob = { type: 'record', recordingId, url: config.url };
+          broadcastAgentList();
+          sendToAgent(agent, { type: 'record', recordingId, url: config.url, screenshotDir });
+          sendJSON(res, 200, { recordingId, agent: { id: agent.id, name: agent.name } });
+          return;
+        }
+        activeRecordings.set(recordingId, recording);
+        const broadcast = (line) => { recording.output.push(line); recording.listeners.forEach(l => l(line)); };
+        const recorderPath = path.resolve(__dirname, '..', '..', 'core', 'recorder.js');
+        const child = spawn('node', [recorderPath, config.url, recordingId, screenshotDir], { cwd: process.cwd(), env: { ...process.env }, stdio: ['pipe', 'pipe', 'pipe'] });
+        recording.process = child;
+        child.stdout.on('data', (chunk) => {
+          chunk.toString().split('\n').filter(Boolean).forEach(line => {
+            try {
+              const msg = JSON.parse(line);
+              broadcast(msg);
+              if (msg.type === 'step') recording.steps.push(msg.step);
+              else if (msg.type === 'done') { recording.steps = msg.steps; recording.status = 'stopped'; broadcast({ type: 'stopped' }); }
+            } catch {}
+          });
+        });
+        let stderrBuf = '';
+        child.stderr.on('data', (chunk) => {
+          const txt = chunk.toString();
+          process.stderr.write('[recorder] ' + txt);
+          stderrBuf += txt;
+          broadcast({ type: 'error', message: txt.trim().slice(0, 300) });
+        });
+        child.on('error', (err) => { broadcast({ type: 'error', message: 'Failed to start: ' + err.message }); recording.status = 'stopped'; });
+        child.on('close', (code) => {
+          if (recording.status === 'recording') recording.status = 'stopped';
+          broadcast({ type: 'stopped' });
+          setTimeout(() => activeRecordings.delete(recordingId), 300000);
+        });
+        sendJSON(res, 200, { recordingId });
+        return;
+      }
+
+      if (pathname.match(/^\/api\/record\/[^/]+\/stop$/) && method === 'POST') {
+        const recordingId = pathname.split('/')[3];
+        const recording = activeRecordings.get(recordingId);
+        if (!recording) { sendJSON(res, 404, { error: 'Recording not found' }); return; }
+        try { if (recording.process && recording.process.stdin) recording.process.stdin.write('stop\n'); } catch {}
+        await new Promise(resolve => {
+          if (recording.status === 'stopped') return resolve();
+          const timeout = setTimeout(resolve, 5000);
+          const check = setInterval(() => { if (recording.status === 'stopped') { clearInterval(check); clearTimeout(timeout); resolve(); } }, 200);
+        });
+        sendJSON(res, 200, { steps: recording.steps });
+        return;
+      }
+
+      if (pathname.match(/^\/api\/record\/[^/]+\/stream$/) && method === 'GET') {
+        const recordingId = pathname.split('/')[3];
+        const recording = activeRecordings.get(recordingId);
+        if (!recording) { sendJSON(res, 404, { error: 'Recording not found' }); return; }
+        res.writeHead(200, { 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-cache', 'Connection': 'keep-alive', 'Access-Control-Allow-Origin': '*' });
+        recording.output.forEach(msg => res.write('data: ' + JSON.stringify(msg) + '\n\n'));
+        if (recording.status === 'stopped') { res.write('data: ' + JSON.stringify({ type: 'stopped' }) + '\n\n'); res.end(); return; }
+        let streamEnded = false;
+        const listener = (msg) => {
+          if (streamEnded) return;
+          try { res.write('data: ' + JSON.stringify(msg) + '\n\n'); } catch {}
+          if (msg.type === 'stopped' || msg.type === 'done') { streamEnded = true; try { res.end(); } catch {} }
+        };
+        recording.listeners.push(listener);
+        req.on('close', () => { streamEnded = true; recording.listeners = recording.listeners.filter(l => l !== listener); });
+        return;
+      }
+
+      if (pathname === '/api/record/process' && method === 'POST') {
+        const body = await readBody(req);
+        const { steps, testName, url, provider } = JSON.parse(body);
+        if (!steps || !steps.length) { sendJSON(res, 400, { error: 'steps are required' }); return; }
+        try {
+          const { processRecording } = await import('../../core/llm.js');
+          const userEnv = await resolveUserSecretsEnv(currentUser && currentUser.id, teamMode);
+          Object.assign(process.env, userEnv || {});
+          const result = await processRecording({ steps, testName, url, provider: provider || 'gemini' });
+          sendJSON(res, 200, result);
+        } catch (err) { sendJSON(res, 500, { error: err.message }); }
+        return;
+      }
+
+      if (pathname === '/api/record/save' && method === 'POST') {
+        const body = await readBody(req);
+        const { scope, name, url, steps, playwrightJs, playwrightTs, tags } = JSON.parse(body);
+        if (!name) { sendJSON(res, 400, { error: 'name is required' }); return; }
+        try {
+          const testData = { name, type: 'recorded', url: url || '', steps: steps || [], playwrightJs: playwrightJs || '', playwrightTs: playwrightTs || '', tags: tags || [] };
+          const result = await createTest(suitesDir, scope || 'saved', testData);
+          if (teamMode && currentUser) { teamMode.db.logAudit({ userId: currentUser.id, action: 'test.created', targetType: 'test', targetId: result.id, metadata: { scope: scope || 'saved', type: 'recorded' } }); }
+          sendJSON(res, 200, result);
+        } catch (err) { sendJSON(res, 400, { error: err.message }); }
+        return;
+      }
+
+      // GET /api/reusable-tests - list all tests marked as reusable (for setup dropdown)
+      if (pathname === '/api/reusable-tests' && method === 'GET') {
+        const all = await listAllTests(suitesDir);
+        const reusable = all.filter(t => t.reusable && t.type === 'recorded');
+        sendJSON(res, 200, reusable.map(t => ({ id: t.id, name: t.name, scope: t.scope, stepCount: (t.steps||[]).length })));
+        return;
+      }
+
+      // POST /api/test/:scope/:id/record-from/:stepIndex
+      // Replays steps 0..stepIndex-1 in a real browser, then starts recording.
+      // Returns { sessionId } for streaming replay progress, then switches to
+      // a recordingId for the recording phase.
+      if (pathname.match(/^\/api\/test\/[^/]+\/[^/]+\/record-from\/\d+$/) && method === 'POST') {
+        const parts = pathname.split('/');
+        const scope = decodeURIComponent(parts[3]);
+        const testId = decodeURIComponent(parts[4]);
+        const stepIndex = parseInt(parts[6], 10);
+        const test = await getTest(suitesDir, scope, testId);
+        if (!test) { sendJSON(res, 404, { error: 'Test not found' }); return; }
+        if (!test.steps || !test.steps.length) { sendJSON(res, 400, { error: 'No steps to replay' }); return; }
+
+        // Load setup test if this test has one — must run first to get app into right state
+        let setupStepsForDebug = [];
+        if (test.setup) {
+          try {
+            const all = await listAllTests(suitesDir);
+            const setupRef = all.find(t => t.id === test.setup || t.name === test.setup);
+            if (setupRef) {
+              const setupTest = await getTest(suitesDir, setupRef.scope, setupRef.id);
+              if (setupTest && setupTest.steps) {
+                setupStepsForDebug = setupTest.steps;
+                process.stderr.write('[debug] loaded setup "' + setupRef.name + '" with ' + setupStepsForDebug.length + ' steps\n');
+              }
+            }
+          } catch (e) { process.stderr.write('[debug] setup load error: ' + e.message + '\n'); }
+        }
+
+        // Steps to replay: setup steps first, then main test steps 0..stepIndex-1
+        const replaySteps = [...setupStepsForDebug, ...test.steps.slice(0, stepIndex)];
+        process.stderr.write('[debug] record-from stepIndex=' + stepIndex + ' setupSteps=' + setupStepsForDebug.length + ' testSteps=' + test.steps.slice(0, stepIndex).length + ' total=' + replaySteps.length + '\n');
+        const userEnv = await resolveUserSecretsEnv(currentUser && currentUser.id, teamMode);
+        const env = { ...process.env, ...(userEnv || {}) };
+
+        // We run this as a special replay that opens a HEADED browser,
+        // replays the steps, then keeps the browser open and starts recording.
+        const runId = Math.random().toString(36).slice(2, 10);
+        const recordingId = Math.random().toString(36).slice(2, 10);
+        const run = { id: runId, type: 'debug-replay', status: 'running', output: [], listeners: [] };
+        activeRuns.set(runId, run);
+        const recording = { id: recordingId, url: test.url, status: 'waiting', steps: [], output: [], listeners: [], screenshotDir: path.join(reportsDir, '_recordings', recordingId), process: null };
+        activeRecordings.set(recordingId, recording);
+
+        const broadcast = (line) => { run.output.push(line); run.listeners.forEach(l => l(line)); };
+        const broadcastRec = (line) => { recording.output.push(line); recording.listeners.forEach(l => l(line)); };
+
+        // Start the debug session asynchronously
+        (async () => {
+          const sessionDir = path.join(reportsDir, runId);
+          await fs.ensureDir(sessionDir);
+          await fs.ensureDir(recording.screenshotDir);
+
+          broadcast({ type: 'stdout', text: '' });
+          broadcast({ type: 'stdout', text: '  Replaying ' + replaySteps.length + ' steps to reach debug point' + (setupStepsForDebug.length > 0 ? ' (including ' + setupStepsForDebug.length + ' setup steps)' : '') + '...' });
+          broadcast({ type: 'stdout', text: '━'.repeat(60) });
+
+          let chromiumBrowser = null;
+          let page = null;
+          let ctx = null;
+
+          try {
+            const { chromium } = await import('playwright');
+
+            // Always headed — user needs to see and interact with the browser
+            chromiumBrowser = await chromium.launch({
+              headless: false,
+              args: ['--no-sandbox', '--disable-blink-features=AutomationControlled', '--allow-insecure-localhost'],
+            });
+
+            ctx = await chromiumBrowser.newContext({
+              viewport: { width: 1280, height: 800 },
+            });
+            page = await ctx.newPage();
+
+            if (test.url) {
+              await page.goto(test.url, { waitUntil: 'domcontentloaded', timeout: 30000 });
+              await page.waitForTimeout(1000);
+            }
+
+            broadcast({ type: 'stdout', text: '  Replaying ' + replaySteps.length + ' steps...' });
+
+            // Replay each step up to the debug point
+            let stepNum = 0;
+            let browserClosed = false;
+
+            for (const step of replaySteps) {
+              if (browserClosed) break;
+              stepNum++;
+              const sel = sanitiseSelector(step.stableSelector || step.selector);
+              const desc = step.description || (step.action + ' ' + (sel || ''));
+              broadcast({ type: 'stdout', text: '  [' + stepNum + '/' + replaySteps.length + '] ' + step.action.toUpperCase() + ' — ' + desc });
+
+              try {
+                if (step.action === 'navigate') {
+                  let navUrl = step.url || step.value;
+                  if (test.url && navUrl && navUrl.startsWith('http')) {
+                    try { const ro = new URL(navUrl).origin; const to = new URL(test.url).origin; if (ro !== to) navUrl = navUrl.replace(ro, to); } catch {}
+                  }
+                  if (page.url() !== navUrl) {
+                    try { await page.goto(navUrl, { waitUntil: 'domcontentloaded', timeout: 15000 }); await page.waitForTimeout(800); }
+                    catch { /* hash nav ok */ }
+                  }
+                } else if (step.action === 'click') {
+                  await page.waitForTimeout(200);
+                  let clicked = false;
+                  const selectors = [step.stableSelector, step.selector].filter(Boolean);
+                  if (!clicked && (step.elementX || step.clickX)) {
+                    const tx = step.elementX||step.clickX, ty = step.elementY||step.clickY;
+                    for (const s of selectors) {
+                      if (clicked) break;
+                      try {
+                        const count = await page.locator(s).count();
+                        if (count > 1) {
+                          let bi = 0, bd = Infinity;
+                          for (let i = 0; i < count; i++) { try { const box = await page.locator(s).nth(i).boundingBox({timeout:2000}); if(!box) continue; const d=Math.sqrt(Math.pow(box.x+box.width/2-tx,2)+Math.pow(box.y+box.height/2-ty,2)); if(d<bd){bd=d;bi=i;} } catch {} }
+                          await page.locator(s).nth(bi).click({timeout:5000}); clicked=true;
+                        } else if (count===1) { await page.locator(s).first().waitFor({state:'visible',timeout:3000}); await page.locator(s).first().click({timeout:5000}); clicked=true; }
+                      } catch {}
+                    }
+                  }
+                  if (!clicked) { for (const s of selectors) { if(clicked) break; try { await page.locator(s).first().click({timeout:5000}); clicked=true; } catch {} } }
+                  if (!clicked) { for (const s of selectors) { if(clicked) break; try { await page.locator(s).first().click({force:true,timeout:5000}); clicked=true; } catch {} } }
+                  if (!clicked && step.element) { const tag=(step.element.tag||'').toLowerCase(); if(['i','svg','path','span'].includes(tag)) { for(const s of selectors){if(clicked)break;try{await page.locator(s).first().locator('xpath=ancestor-or-self::*[self::a or self::button or @role="button"][1]').first().click({timeout:5000});clicked=true;}catch{}} } }
+                  if (!clicked) throw new Error('Could not click element. Tried: ' + selectors.join(', '));
+                  else await page.waitForTimeout(400);
+                } else if (step.action === 'type') {
+                  await page.locator(sel).first().click({timeout:5000});
+                  await page.locator(sel).first().fill('');
+                  await page.locator(sel).first().pressSequentially(step.value||'', {delay:50});
+                  await page.locator(sel).first().evaluate(el => { el.dispatchEvent(new Event('blur',{bubbles:true})); el.dispatchEvent(new Event('change',{bubbles:true})); el.dispatchEvent(new Event('focusout',{bubbles:true})); });
+                  await page.waitForTimeout(300);
+                } else if (step.action === 'check') {
+                  let alreadyCorrect = false;
+                  try { const cur = await page.locator(sel).first().isChecked({timeout:2000}); if(cur===step.checked) alreadyCorrect=true; } catch {}
+                  if (!alreadyCorrect) { await page.locator(sel).first().click({timeout:10000}); await page.waitForTimeout(400); }
+                } else if (step.action === 'scroll') {
+                  if (step.isWindow||step.selector==='window') await page.evaluate(({x,y})=>window.scrollTo({left:x,top:y,behavior:'smooth'}),{x:step.scrollX||0,y:step.scrollY||0});
+                  else await page.evaluate(({s,x,y})=>{const el=document.querySelector(s);if(el)el.scrollTo({left:x,top:y,behavior:'smooth'})},{s:sel,x:step.scrollX||0,y:step.scrollY||0});
+                  await page.waitForTimeout(500);
+                }
+                broadcast({ type: 'stdout', text: '    ✓ Done' });
+              } catch (err) {
+                const msg = err.message || '';
+                if (msg.includes('closed') || msg.includes('destroyed') || msg.includes('detached') || msg.includes('crashed')) {
+                  browserClosed = true;
+                  broadcast({ type: 'stdout', text: '    ✖ Browser closed — stopping replay early' });
+                  process.stderr.write('[debug] browser closed at step ' + stepNum + ': ' + msg + '\n');
+                } else {
+                  broadcast({ type: 'stdout', text: '    ⚠ Step ' + stepNum + ' skipped: ' + msg.slice(0, 100) });
+                }
+              }
+            }
+
+            broadcast({ type: 'stdout', text: '' });
+            broadcast({ type: 'stdout', text: '━'.repeat(60) });
+            broadcast({ type: 'stdout', text: '  ✔ Reached step ' + (stepIndex + 1) + ' — browser is ready' });
+            broadcast({ type: 'stdout', text: '  Now recording. Use the browser, then click Stop.' });
+            broadcast({ type: 'stdout', text: '━'.repeat(60) });
+
+            // Inject the recorder BEFORE sending done — once done fires the
+            // SSE stream closes and we can't broadcast anymore
+            recording.status = 'recording';
+            process.stderr.write('[debug] injecting recorder into browser\n');
+
+            // Expose capture function on the existing context
+            await ctx.exposeFunction('__skopixCapture', async (actionData) => {
+              if (recording.status !== 'recording') return;
+              if (actionData.action === 'stop') {
+                await stopDebugRecording(recording, ctx, chromiumBrowser, broadcastRec);
+                return;
+              }
+              // Capture step
+              const id = 'step-' + String(recording.steps.length + 1).padStart(3, '0') + '-dbg';
+              const recStep = { id, action: actionData.action, assertType: actionData.assertType||null, attribute: actionData.attribute||null, selector: actionData.selector||(actionData.element?actionData.element.selector:null), element: actionData.element||null, value: actionData.value||null, isPassword: actionData.isPassword||false, label: actionData.label||null, clickX: actionData.clickX||null, clickY: actionData.clickY||null, elementX: actionData.elementX||null, elementY: actionData.elementY||null, description: actionData.description||null, url: page.url(), timestamp: Date.now(), stableSelector: null };
+              recording.steps.push(recStep);
+              broadcastRec({ type: 'step', step: recStep });
+              // Update toolbar count
+              try { await page.evaluate(n => { if(window.__skopixUpdateCount) window.__skopixUpdateCount(n); }, recording.steps.length); } catch {}
+              // Screenshot
+              setTimeout(async () => { try { const sp = path.join(recording.screenshotDir, id+'.png'); await page.screenshot({path:sp,fullPage:false}).catch(()=>{}); recStep.screenshotPath=sp; broadcastRec({type:'screenshot',stepId:id,path:sp}); } catch {} }, 400);
+            });
+
+            // Add the recorder init script to the existing pages
+            await ctx.addInitScript(() => {
+              if (window.__skopixRecording) return;
+              window.__skopixRecording = true;
+              // (full recorder init script injected below)
+            });
+
+            // Inject the toolbar and listeners into the current page
+            await page.evaluate(() => {
+              if (window.__skopixRecording) return;
+              window.__skopixRecording = true;
+
+              function getSelector(el) {
+                if (!el || el === document.body) return 'body';
+                const testAttrs = ['data-testid','data-test','pi-test-identifier','data-cy','data-qa'];
+                for (const attr of testAttrs) { const val = el.getAttribute(attr); if (val) return '['+attr+'="'+val+'"]'; }
+                if (el.id && !/^\d/.test(el.id)) return '#'+el.id;
+                const al = el.getAttribute('aria-label');
+                if (al && ['button','a','input'].includes(el.tagName.toLowerCase())) return el.tagName.toLowerCase()+'[aria-label="'+al+'"]';
+                if (el.name && el.tagName==='INPUT') return 'input[name="'+el.name+'"]';
+                const parts=[]; let cur=el,depth=0;
+                while(cur&&cur!==document.body&&depth<4){let seg=cur.tagName.toLowerCase();if(cur.id&&!/^\d/.test(cur.id)){parts.unshift('#'+cur.id);break;}const sib=Array.from(cur.parentElement?cur.parentElement.children:[]).filter(c=>c.tagName===cur.tagName);if(sib.length>1)seg+=':nth-of-type('+(sib.indexOf(cur)+1)+')';parts.unshift(seg);cur=cur.parentElement;depth++;}
+                return parts.join(' > ');
+              }
+              function getElementInfo(el) { return {tag:el.tagName.toLowerCase(),id:el.id||null,name:el.name||null,type:el.type||null,text:(el.innerText||el.value||el.placeholder||el.getAttribute('aria-label')||'').trim().slice(0,80),selector:getSelector(el),classes:el.className?el.className.toString().trim().slice(0,100):null}; }
+
+              document.addEventListener('click', function(e) {
+                if(e.target&&e.target.closest){if(e.target.closest('#__skopix_toolbar'))return;if(e.target.closest('#__skopix_popover'))return;}
+                if(window.__skopixPickMode)return;
+                const el=e.target;
+                if(!el||el===document.body||el===document.documentElement)return;
+                const rect=el.getBoundingClientRect();
+                const isCheckable=el.type==='checkbox'||el.type==='radio';
+                let checkTarget=null;
+                if(!isCheckable&&el.tagName==='LABEL'&&el.htmlFor)checkTarget=document.getElementById(el.htmlFor);
+                if(!isCheckable&&el.tagName==='LABEL'&&!el.htmlFor)checkTarget=el.querySelector('input[type="checkbox"],input[type="radio"]');
+                const actualCheckable=isCheckable?el:checkTarget;
+                if(actualCheckable&&(actualCheckable.type==='checkbox'||actualCheckable.type==='radio')){
+                  window.__skopixCapture&&window.__skopixCapture({action:'check',checked:actualCheckable.checked,element:getElementInfo(actualCheckable),clickX:Math.round(e.clientX),clickY:Math.round(e.clientY),elementX:Math.round(rect.left+rect.width/2),elementY:Math.round(rect.top+rect.height/2)});
+                } else {
+                  window.__skopixCapture&&window.__skopixCapture({action:'click',element:getElementInfo(el),clickX:Math.round(e.clientX),clickY:Math.round(e.clientY),elementX:Math.round(rect.left+rect.width/2),elementY:Math.round(rect.top+rect.height/2)});
+                }
+              }, true);
+
+              let typeTimer=null,lastInputEl=null;
+              document.addEventListener('input', function(e) {
+                const el=e.target;
+                if(!el||!['INPUT','TEXTAREA'].includes(el.tagName))return;
+                if(el.type==='checkbox'||el.type==='radio')return;
+                if(el.closest&&(el.closest('#__skopix_toolbar')||el.closest('#__skopix_popover')))return;
+                lastInputEl=el;clearTimeout(typeTimer);
+                typeTimer=setTimeout(()=>{if(!lastInputEl)return;window.__skopixCapture&&window.__skopixCapture({action:'type',element:getElementInfo(lastInputEl),value:lastInputEl.value,isPassword:lastInputEl.type==='password'});lastInputEl=null;},600);
+              },true);
+
+              document.addEventListener('change', function(e) {
+                const el=e.target;if(!el||el.tagName!=='SELECT')return;if(el.closest&&(el.closest('#__skopix_toolbar')||el.closest('#__skopix_popover')))return;
+                const sel=el.options[el.selectedIndex];window.__skopixCapture&&window.__skopixCapture({action:'select',element:getElementInfo(el),value:el.value,label:sel?sel.text:el.value});
+              },true);
+
+              let scrollTimer=null;
+              document.addEventListener('scroll', function(e) {
+                const el=e.target;if(el&&el.closest&&(el.closest('#__skopix_toolbar')||el.closest('#__skopix_popover')))return;
+                clearTimeout(scrollTimer);scrollTimer=setTimeout(()=>{
+                  const isWin=el===document||el===document.documentElement||el===document.body;
+                  const sx=isWin?window.scrollX:el.scrollLeft,sy=isWin?window.scrollY:el.scrollTop;
+                  if(Math.abs(sy)<50&&Math.abs(sx)<50)return;
+                  window.__skopixCapture&&window.__skopixCapture({action:'scroll',selector:isWin?'window':getSelector(el),scrollX:Math.round(sx),scrollY:Math.round(sy),isWindow:isWin,element:isWin?null:getElementInfo(el)});
+                },400);
+              },true);
+
+              // Toolbar - full version with Assert button
+              const tb=document.createElement('div');
+              tb.id='__skopix_toolbar';
+              tb.style.cssText='position:fixed;bottom:20px;right:20px;z-index:2147483647;background:#0f1117;border:2px solid #f59e0b;border-radius:10px;padding:10px 14px;display:flex;align-items:center;gap:10px;font-family:monospace;font-size:12px;color:#e5e7eb;box-shadow:0 4px 24px rgba(0,0,0,0.6);user-select:none';
+              tb.innerHTML='<span style="color:#f59e0b;font-size:14px;animation:skopix_pulse 1s infinite">●</span>'
+                +'<span style="color:#9ca3af">Debug recording</span>'
+                +'<span id="__skopix_count" style="color:#22d3ee;font-weight:700;min-width:20px;text-align:center">0</span>'
+                +'<span style="color:#4b5563">steps</span>'
+                +'<button id="__skopix_assert_btn" style="background:#1e3a5f;border:1px solid #2563eb;color:#60a5fa;border-radius:6px;padding:4px 10px;cursor:pointer;font-size:11px;font-family:monospace">+ Assert</button>'
+                +'<button id="__skopix_stop_btn" style="background:#3f0d0d;border:1px solid #dc2626;color:#f87171;border-radius:6px;padding:4px 10px;cursor:pointer;font-size:11px;font-family:monospace">■ Stop</button>';
+              const sty=document.createElement('style');sty.textContent='@keyframes skopix_pulse{0%,100%{opacity:1}50%{opacity:0.3}}';document.head.appendChild(sty);
+              document.body.appendChild(tb);
+              tb.querySelector('#__skopix_stop_btn').addEventListener('click',e=>{e.stopPropagation();window.__skopixCapture&&window.__skopixCapture({action:'stop'});});
+              window.__skopixUpdateCount=n=>{const el=document.getElementById('__skopix_count');if(el)el.textContent=n;};
+
+              // Assert button - full picker mode with popover
+              tb.querySelector('#__skopix_assert_btn').addEventListener('click', function(e) {
+                e.stopPropagation();
+                startPickMode();
+              });
+
+              let pickerOverlay=null;
+              function startPickMode() {
+                window.__skopixPickMode=true;
+                document.body.style.cursor='crosshair';
+                const tb2=document.getElementById('__skopix_toolbar');if(tb2)tb2.style.opacity='0.5';
+                const hint=document.createElement('div');hint.id='__skopix_hint';
+                hint.style.cssText='position:fixed;top:20px;left:50%;transform:translateX(-50%);z-index:2147483647;background:#1e3a5f;border:1px solid #2563eb;color:#60a5fa;padding:8px 18px;border-radius:8px;font-family:monospace;font-size:13px;pointer-events:none';
+                hint.textContent='Click any element to add an assertion — Esc to cancel';
+                document.body.appendChild(hint);
+                pickerOverlay=document.createElement('div');
+                pickerOverlay.style.cssText='position:fixed;top:0;left:0;width:100%;height:100%;z-index:2147483646;pointer-events:auto;cursor:crosshair';
+                document.body.appendChild(pickerOverlay);
+                const hl=document.createElement('div');
+                hl.style.cssText='position:fixed;pointer-events:none;z-index:2147483645;background:rgba(37,99,235,0.15);border:2px solid #2563eb;border-radius:3px;transition:all 0.1s;display:none';
+                document.body.appendChild(hl);
+                pickerOverlay.addEventListener('mousemove',function(e2){pickerOverlay.style.pointerEvents='none';const el=document.elementFromPoint(e2.clientX,e2.clientY);pickerOverlay.style.pointerEvents='auto';if(!el||el===document.body||el.id==='__skopix_toolbar'){hl.style.display='none';return;}const r=el.getBoundingClientRect();hl.style.display='block';hl.style.top=r.top+'px';hl.style.left=r.left+'px';hl.style.width=r.width+'px';hl.style.height=r.height+'px';});
+                pickerOverlay.addEventListener('click',function(e2){e2.preventDefault();e2.stopPropagation();pickerOverlay.style.pointerEvents='none';const el=document.elementFromPoint(e2.clientX,e2.clientY);pickerOverlay.style.pointerEvents='auto';if(!el||el===document.body){stopPickMode(hl);return;}stopPickMode(hl);showAssertionPopover(el,hl);});
+                document.addEventListener('keydown',function escH(e2){if(e2.key==='Escape'){stopPickMode(hl);document.removeEventListener('keydown',escH);}});
+              }
+
+              function stopPickMode(hl) {
+                window.__skopixPickMode=false;document.body.style.cursor='';
+                if(pickerOverlay){pickerOverlay.remove();pickerOverlay=null;}
+                const hint=document.getElementById('__skopix_hint');if(hint)hint.remove();
+                const tb2=document.getElementById('__skopix_toolbar');if(tb2)tb2.style.opacity='1';
+                if(hl)hl.style.display='none';
+              }
+
+              function showAssertionPopover(el, hl) {
+                const existing=document.getElementById('__skopix_popover');if(existing)existing.remove();
+                function getSelector2(el2){
+                  if(!el2||el2===document.body)return'body';
+                  const testAttrs=['data-testid','data-test','pi-test-identifier','data-cy','data-qa'];
+                  for(const a of testAttrs){const v=el2.getAttribute(a);if(v)return'['+a+'="'+v+'"]';}
+                  if(el2.id&&!/^\d/.test(el2.id))return'#'+el2.id;
+                  const al=el2.getAttribute('aria-label');if(al&&['button','a','input'].includes(el2.tagName.toLowerCase()))return el2.tagName.toLowerCase()+'[aria-label="'+al+'"]';
+                  if(el2.name&&el2.tagName==='INPUT')return'input[name="'+el2.name+'"]';
+                  const parts=[];let cur=el2,d=0;while(cur&&cur!==document.body&&d<4){let seg=cur.tagName.toLowerCase();if(cur.id&&!/^\d/.test(cur.id)){parts.unshift('#'+cur.id);break;}const sib=Array.from(cur.parentElement?cur.parentElement.children:[]).filter(c=>c.tagName===cur.tagName);if(sib.length>1)seg+=':nth-of-type('+(sib.indexOf(cur)+1)+')';parts.unshift(seg);cur=cur.parentElement;d++;}
+                  return parts.join(' > ');
+                }
+                const sel=getSelector2(el);
+                const currentText=(el.innerText||el.textContent||'').trim().slice(0,100);
+                const rect=el.getBoundingClientRect();
+                let sugType='visible',sugVal='';
+                if(currentText&&currentText.length>0&&currentText.length<80){sugType='text_contains';sugVal=currentText.replace(/\s+/g,' ').trim();}
+                const rows=el.querySelectorAll('tr:not(thead tr),li').length;
+                if(['table','tbody','ul','ol'].includes(el.tagName.toLowerCase())||rows>1){sugType='element_count';sugVal=String(rows);}
+                if(hl){hl.style.background='rgba(34,197,94,0.15)';hl.style.borderColor='#22c55e';hl.style.display='block';hl.style.top=rect.top+'px';hl.style.left=rect.left+'px';hl.style.width=rect.width+'px';hl.style.height=rect.height+'px';}
+                const popover=document.createElement('div');popover.id='__skopix_popover';
+                const topPos=rect.bottom+8+280>window.innerHeight?Math.max(8,rect.top-280-8):rect.bottom+8;
+                const leftPos=Math.min(rect.left,window.innerWidth-360);
+                popover.style.cssText='position:fixed;z-index:2147483647;top:'+topPos+'px;left:'+leftPos+'px;width:350px;background:#0f1117;border:1px solid #2563eb;border-radius:10px;padding:16px;font-family:monospace;font-size:12px;color:#e5e7eb;box-shadow:0 8px 32px rgba(0,0,0,0.7)';
+                popover.innerHTML='<div style="color:#60a5fa;font-size:11px;letter-spacing:0.1em;margin-bottom:12px">ADD ASSERTION</div>'
+                  +'<div style="margin-bottom:10px"><div style="color:#9ca3af;font-size:10px;margin-bottom:4px">SELECTED ELEMENT</div><div style="background:#1a1d2e;padding:6px 10px;border-radius:6px;color:#22d3ee;font-size:11px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap" title="'+sel+'">'+sel+'</div>'+(currentText?'<div style="color:#6b7280;font-size:10px;margin-top:3px">Current text: "'+currentText.slice(0,50)+'"</div>':'')+'</div>'
+                  +'<div style="margin-bottom:10px"><div style="color:#9ca3af;font-size:10px;margin-bottom:4px">TYPE</div><select id="__skopix_assert_type" style="width:100%;background:#1a1d2e;border:1px solid #374151;color:#e5e7eb;padding:6px 8px;border-radius:6px;font-family:monospace;font-size:12px"><option value="visible"'+(sugType==="visible"?" selected":"")+'>Element is visible</option><option value="text_contains"'+(sugType==="text_contains"?" selected":"")+'>Text contains</option><option value="text_equals">Text equals</option><option value="url_contains">URL contains</option><option value="element_count"'+(sugType==="element_count"?" selected":"")+'>Element count</option><option value="attribute_contains"'+(sugType==="attribute_contains"?" selected":"")+'>Attribute contains (title, alt...)</option></select></div>'
+                  +'<div id="__skopix_attr_row" style="margin-bottom:10px;display:none"><div style="color:#9ca3af;font-size:10px;margin-bottom:4px">ATTRIBUTE NAME</div><input id="__skopix_assert_attr" type="text" value="title" placeholder="e.g. title, alt, aria-label" style="width:100%;box-sizing:border-box;background:#1a1d2e;border:1px solid #374151;color:#e5e7eb;padding:6px 8px;border-radius:6px;font-family:monospace;font-size:12px"></div>'
+                  +'<div id="__skopix_value_row" style="margin-bottom:10px;'+(sugType==="visible"?"display:none":"")+'"><div style="color:#9ca3af;font-size:10px;margin-bottom:4px" id="__skopix_val_lbl">EXPECTED VALUE</div><input id="__skopix_assert_value" type="text" value="'+sugVal.replace(/"/g,"&quot;")+'" style="width:100%;box-sizing:border-box;background:#1a1d2e;border:1px solid #374151;color:#e5e7eb;padding:6px 8px;border-radius:6px;font-family:monospace;font-size:12px"></div>'
+                  +'<div style="margin-bottom:14px"><div style="color:#9ca3af;font-size:10px;margin-bottom:4px">DESCRIPTION (optional)</div><input id="__skopix_assert_desc" type="text" placeholder="e.g. Chart is visible after save" style="width:100%;box-sizing:border-box;background:#1a1d2e;border:1px solid #374151;color:#e5e7eb;padding:6px 8px;border-radius:6px;font-family:monospace;font-size:12px"></div>'
+                  +'<div style="display:flex;gap:8px;justify-content:flex-end"><button id="__skopix_cancel_btn" style="background:transparent;border:1px solid #374151;color:#9ca3af;border-radius:6px;padding:6px 14px;cursor:pointer;font-family:monospace;font-size:12px">Cancel</button><button id="__skopix_add_btn" style="background:#1e3a5f;border:1px solid #2563eb;color:#60a5fa;border-radius:6px;padding:6px 14px;cursor:pointer;font-family:monospace;font-size:12px;font-weight:700">Add ✓</button></div>';
+                document.body.appendChild(popover);
+                const typeSelect=popover.querySelector('#__skopix_assert_type');
+                const valRow=popover.querySelector('#__skopix_value_row');
+                const valLabel=popover.querySelector('#__skopix_val_lbl');
+                const valInput=popover.querySelector('#__skopix_assert_value');
+                typeSelect.addEventListener('change',function(){const t=typeSelect.value;valRow.style.display=t==='visible'?'none':'';const attrRow=document.getElementById('__skopix_attr_row');if(attrRow)attrRow.style.display=t==='attribute_contains'?'block':'none';if(t==='element_count')valLabel.textContent='EXPECTED COUNT';else if(t==='url_contains')valLabel.textContent='URL MUST CONTAIN';else if(t==='attribute_contains')valLabel.textContent='ATTRIBUTE VALUE MUST CONTAIN';else valLabel.textContent='EXPECTED VALUE';});
+                popover.querySelector('#__skopix_cancel_btn').addEventListener('click',function(e2){e2.stopPropagation();if(hl)hl.style.display='none';popover.remove();});
+                popover.querySelector('#__skopix_add_btn').addEventListener('click',function(e2){
+                  e2.stopPropagation();
+                  const assertType=typeSelect.value;
+                  const value=valInput.value.trim();
+                  const description=popover.querySelector('#__skopix_assert_desc').value.trim();
+                  if(assertType!=='visible'&&assertType!=='url_contains'&&!value){valInput.style.borderColor='#dc2626';return;}
+                  const attrInput=document.getElementById('__skopix_assert_attr');
+                  window.__skopixCapture&&window.__skopixCapture({action:'assert',assertType,selector:assertType==='url_contains'?null:sel,value:value||null,attribute:assertType==='attribute_contains'?(attrInput?attrInput.value.trim()||'title':'title'):null,description:description||null,element:assertType==='url_contains'?null:{tag:el.tagName.toLowerCase(),text:currentText}});
+                  if(hl)hl.style.display='none';popover.remove();
+                  const ab=document.getElementById('__skopix_assert_btn');
+                  if(ab){const orig=ab.style.cssText;ab.textContent='\u2713 Added';ab.style.background='#14532d';ab.style.borderColor='#22c55e';ab.style.color='#4ade80';setTimeout(()=>{ab.textContent='+ Assert';ab.style.cssText=orig;},1500);}
+                });
+                setTimeout(()=>{if(valRow.style.display!=='none')valInput.focus();},50);
+              }
+            });
+
+            // Now safe to send done — injection is complete, no more broadcasts needed
+            // Frontend will close the replay SSE and open the recording SSE
+            broadcast({ type: 'done', exitCode: 0, status: 'passed', recordingId });
+            process.stderr.write('[debug] recorder injected, done sent, awaiting user actions\n');
+
+          } catch (err) {
+            broadcast({ type: 'stdout', text: '✖ Debug replay error: ' + err.message });
+            broadcast({ type: 'done', exitCode: 1, status: 'failed' });
+            recording.status = 'stopped';
+            broadcastRec({ type: 'stopped' });
+            if (chromiumBrowser) try { await chromiumBrowser.close(); } catch {}
+          }
+        })().catch(err => {
+          process.stderr.write('[debug session crash] ' + err.message + '\n' + (err.stack||'') + '\n');
+          try { broadcast({ type: 'stdout', text: '\u2716 Debug session crashed: ' + err.message }); } catch {}
+          try { broadcast({ type: 'done', exitCode: 1, status: 'failed' }); } catch {}
+          recording.status = 'stopped';
+          try { broadcastRec({ type: 'stopped' }); } catch {}
+        });
+
+        sendJSON(res, 200, { runId, recordingId });
+        return;
+      }
+
+      if (pathname.match(/^\/api\/test\/[^/]+\/[^/]+\/replay$/) && method === 'POST') {
+        const parts = pathname.split('/');
+        const scope = decodeURIComponent(parts[3]);
+        const testId = decodeURIComponent(parts[4]);
+        const test = await getTest(suitesDir, scope, testId);
+        if (!test) { sendJSON(res, 404, { error: 'Test not found' }); return; }
+        if (!test.steps || !test.steps.length) { sendJSON(res, 400, { error: 'No recorded steps to replay' }); return; }
+        // Resolve credentials — substitute real passwords into password steps
+        if (test.credentials) {
+          const creds = await resolveCredentials(test.credentials);
+          if (creds) {
+            test.steps = test.steps.map(s => {
+              if (s.action === 'type' && s.isPassword && creds.password) {
+                return { ...s, value: creds.password };
+              }
+              if (s.action === 'type' && !s.isPassword && creds.username && (s.element && (s.element.name === 'username' || s.element.type === 'text' && s.element.name))) {
+                return s; // keep recorded username as-is, credential username is optional override
+              }
+              return s;
+            });
+          }
+        }
+        // Load setup test if referenced
+        let setupTest = null;
+        if (test.setup) {
+          const all = await listAllTests(suitesDir);
+          const setupRef = all.find(t => t.id === test.setup || t.name === test.setup);
+          if (setupRef) setupTest = await getTest(suitesDir, setupRef.scope, setupRef.id);
+        }
+        const userEnv = await resolveUserSecretsEnv(currentUser && currentUser.id, teamMode);
+
+        // In team mode, dispatch to least busy agent
+        const replayAgent = teamMode ? getLeastBusyAgent(currentUser?.id) : null;
+        if (teamMode && !replayAgent) {
+          sendJSON(res, 503, { error: 'No agent connected. Run "skopix agent --server ' + (req.headers.host || 'localhost:9000') + '" on your machine to run replays.' });
+          return;
+        }
+
+        if (replayAgent) {
+          const runId = Math.random().toString(36).slice(2, 10);
+          const run = { id: runId, type: 'replay', status: 'running', output: [], listeners: [], sessionId: runId };
+          activeRuns.set(runId, run);
+          replayAgent.status = 'replaying';
+          replayAgent.currentJob = { type: 'replay', runId, testName: test.name };
+          broadcastAgentList();
+          sendToAgent(replayAgent, { type: 'replay', runId, test, setupTest, env: userEnv || {} });
+          sendJSON(res, 200, { runId, agent: { id: replayAgent.id, name: replayAgent.name } });
+          return;
+        }
+
+        const runId = startReplay(test, setupTest, activeRuns, reportsDir, currentUser, { ...process.env, ...(userEnv || {}) });
+        sendJSON(res, 200, { runId });
+        return;
+      }
+
+      if (pathname === '/api/run' && method === 'POST') {
+        const body = await readBody(req);
+        const config = JSON.parse(body);
+        const userEnv = await resolveUserSecretsEnv(currentUser?.id, teamMode);
+        const runId = startRun(config, activeRuns, reportsDir, currentUser, userEnv);
+        sendJSON(res, 200, { runId });
+        return;
+      }
+      if (pathname.startsWith('/api/stream/') && method === 'GET') {
+        const runId = pathname.split('/')[3];
+        streamRun(req, res, runId, activeRuns);
+        return;
+      }
+      if (pathname.startsWith('/api/report/') && method === 'GET') {
+        const id = pathname.split('/')[3];
+        const reportPath = path.join(reportsDir, id, 'report.html');
+        if (await fs.pathExists(reportPath)) {
+          // Instead of trying to open a local file (breaks in Docker), redirect to
+          // the HTTP-served report route which works everywhere.
+          res.writeHead(302, { Location: '/report/' + id + '/' });
+          res.end();
+        } else sendJSON(res, 404, { error: 'Not found' });
+        return;
+      }
+
+      // Serve report HTML and its assets over HTTP.
+      // Works in Docker (no local file access needed) and on bare-metal installs.
+      // Route: /report/:sessionId/         -> serves report.html
+      //        /report/:sessionId/<asset>  -> serves screenshots/videos/etc
+      if (pathname.startsWith('/report/') && method === 'GET') {
+        const parts = pathname.split('/').filter(Boolean); // ['report', id, ...rest]
+        const id = parts[1];
+        if (!id) { sendJSON(res, 404, { error: 'Not found' }); return; }
+        // Remaining path after /report/:id/ - defaults to report.html
+        const assetPath = parts.slice(2).join('/') || 'report.html';
+        // Prevent path traversal
+        const safeAsset = path.normalize(assetPath).replace(/^(\.\.\/|\/)+/, '');
+        const filePath = path.join(reportsDir, id, safeAsset);
+        if (!await fs.pathExists(filePath)) { sendJSON(res, 404, { error: 'Not found' }); return; }
+        // Serve the file with appropriate Content-Type
+        const ext = path.extname(filePath).toLowerCase();
+        const mime = {
+          '.html': 'text/html; charset=utf-8',
+          '.css': 'text/css',
+          '.js': 'application/javascript',
+          '.json': 'application/json',
+          '.png': 'image/png',
+          '.jpg': 'image/jpeg',
+          '.jpeg': 'image/jpeg',
+          '.webm': 'video/webm',
+          '.mp4': 'video/mp4',
+          '.svg': 'image/svg+xml',
+          '.woff2': 'font/woff2',
+          '.woff': 'font/woff',
+        }[ext] || 'application/octet-stream';
+        const stat = await fs.stat(filePath);
+        res.writeHead(200, { 'Content-Type': mime, 'Content-Length': stat.size });
+        const stream = fs.createReadStream(filePath);
+        stream.pipe(res);
+        return;
+      }
+
+      // ─── ALL TESTS (universal view) ─────────────────────────────────────
+      if (pathname === '/api/tests' && method === 'GET') {
+        sendJSON(res, 200, await listAllTests(suitesDir));
+        return;
+      }
+
+      // /api/test/<scope>/<testId>  - get/update/delete a specific test
+      // Scope is either "saved" or a suite filename
+      if (pathname.match(/^\/api\/test\/[^/]+\/[^/]+$/) && method === 'GET') {
+        const parts = pathname.split('/');
+        const scope = decodeURIComponent(parts[3]);
+        const testId = decodeURIComponent(parts[4]);
+        const test = await getTest(suitesDir, scope, testId);
+        if (!test) sendJSON(res, 404, { error: 'Not found' });
+        else sendJSON(res, 200, test);
+        return;
+      }
+      if (pathname.match(/^\/api\/test\/[^/]+\/[^/]+$/) && method === 'PUT') {
+        const parts = pathname.split('/');
+        const scope = decodeURIComponent(parts[3]);
+        const testId = decodeURIComponent(parts[4]);
+        const body = await readBody(req);
+        const data = JSON.parse(body);
+        try {
+          const result = await updateTest(suitesDir, scope, testId, data);
+          sendJSON(res, 200, result);
+        } catch (err) {
+          sendJSON(res, 400, { error: err.message });
+        }
+        return;
+      }
+      if (pathname.match(/^\/api\/test\/[^/]+\/[^/]+$/) && method === 'DELETE') {
+        const parts = pathname.split('/');
+        const scope = decodeURIComponent(parts[3]);
+        const testId = decodeURIComponent(parts[4]);
+        await deleteTest(suitesDir, scope, testId);
+        sendJSON(res, 200, { deleted: true });
+        return;
+      }
+
+      // /api/test - create a new test in a scope
+      if (pathname === '/api/test' && method === 'POST') {
+        const body = await readBody(req);
+        const data = JSON.parse(body); // { scope, test }
+        try {
+          const result = await createTest(suitesDir, data.scope, data.test);
+          sendJSON(res, 200, result);
+        } catch (err) {
+          sendJSON(res, 400, { error: err.message });
+        }
+        return;
+      }
+
+      // /api/test/<scope>/<testId>/duplicate - create a copy in the same scope
+      if (pathname.match(/^\/api\/test\/[^/]+\/[^/]+\/duplicate$/) && method === 'POST') {
+        const parts = pathname.split('/');
+        const scope = decodeURIComponent(parts[3]);
+        const testId = decodeURIComponent(parts[4]);
+        try {
+          const result = await duplicateTest(suitesDir, scope, testId);
+          if (!result) { sendJSON(res, 404, { error: 'Test not found' }); return; }
+          // Audit log entry if in team mode
+          if (teamMode && currentUser) {
+            teamMode.db.logAudit({
+              userId: currentUser.id, action: 'test.duplicated',
+              targetType: 'test', targetId: result.id,
+              metadata: { scope, sourceTestId: testId, newName: result.name },
+            });
+          }
+          sendJSON(res, 200, result);
+        } catch (err) {
+          sendJSON(res, 400, { error: err.message });
+        }
+        return;
+      }
+
+      // /api/test/<scope>/<testId>/move  - move to different scope
+      if (pathname.match(/^\/api\/test\/[^/]+\/[^/]+\/move$/) && method === 'POST') {
+        const parts = pathname.split('/');
+        const fromScope = decodeURIComponent(parts[3]);
+        const testId = decodeURIComponent(parts[4]);
+        const body = await readBody(req);
+        const { toScope } = JSON.parse(body);
+        try {
+          const result = await moveTest(suitesDir, fromScope, testId, toScope);
+          sendJSON(res, 200, result);
+        } catch (err) {
+          sendJSON(res, 400, { error: err.message });
+        }
+        return;
+      }
+
+      // /api/test/<scope>/<testId>/run  - run a single test by reference
+      if (pathname.match(/^\/api\/test\/[^/]+\/[^/]+\/run$/) && method === 'POST') {
+        const parts = pathname.split('/');
+        const scope = decodeURIComponent(parts[3]);
+        const testId = decodeURIComponent(parts[4]);
+        const test = await getTest(suitesDir, scope, testId);
+        if (!test) { sendJSON(res, 404, { error: 'Not found' }); return; }
+        process.stderr.write('[run] test=' + testId + ' type=' + test.type + ' steps=' + (test.steps||[]).length + ' url=' + test.url + '\n');
+        const userEnv = await resolveUserSecretsEnv(currentUser?.id, teamMode);
+
+        // Recorded tests use the replay engine
+        if (test.type === 'recorded' || (test.steps && test.steps.length)) {
+          if (!test.steps || !test.steps.length) { sendJSON(res, 400, { error: 'No recorded steps' }); return; }
+          let setupTest = null;
+          if (test.setup) {
+            const all = await listAllTests(suitesDir);
+            const ref = all.find(t => t.id === test.setup || t.name === test.setup);
+            if (ref) setupTest = await getTest(suitesDir, ref.scope, ref.id);
+          }
+          if (test.credentials) {
+            const creds = await resolveCredentials(test.credentials);
+            if (creds) test.steps = test.steps.map(s => s.action === 'type' && s.isPassword && creds.password ? { ...s, value: creds.password } : s);
+          }
+          const runId = startReplay(test, setupTest, activeRuns, reportsDir, currentUser, { ...process.env, ...(userEnv || {}) });
+          sendJSON(res, 200, { runId });
+          return;
+        }
+
+        // Goal-based tests
+        const config = {
+          url: test.url,
+          goal: test.goal,
+          maxSteps: test.maxSteps,
+          credentials: test.credentials,
+          provider: test.provider,
+          model: test.model,
+          github: !!test.github,
+          jira: !!test.jira,
+          linear: !!test.linear,
+          headless: !!test.headless,
+          testName: test.name,
+        };
+        const runId = startRun(config, activeRuns, reportsDir, currentUser, userEnv);
+        sendJSON(res, 200, { runId });
+        return;
+      }
+
+      // ─── SUITES ────────────────────────────────────────────────────────
+      if (pathname === '/api/suites' && method === 'GET') {
+        sendJSON(res, 200, await listSuites(suitesDir));
+        return;
+      }
+      if (pathname === '/api/suites' && method === 'POST') {
+        const body = await readBody(req);
+        const data = JSON.parse(body);
+        const result = await saveSuite(suitesDir, data);
+        sendJSON(res, 200, result);
+        return;
+      }
+      if (pathname.match(/^\/api\/suite\/[^/]+\/duplicate$/) && method === 'POST') {
+        const name = decodeURIComponent(pathname.split('/')[3]);
+        const result = await duplicateSuite(suitesDir, name);
+        sendJSON(res, 200, result);
+        return;
+      }
+      if (pathname.match(/^\/api\/suite\/[^/]+\/run$/) && method === 'POST') {
+        const name = decodeURIComponent(pathname.split('/')[3]);
+        const userEnv = await resolveUserSecretsEnv(currentUser?.id, teamMode);
+        const result = await startSuiteRun(suitesDir, name, activeRuns, suiteRunsDir, reportsDir, currentUser, userEnv, { getLeastBusyAgent, sendToAgent, broadcastAgentList });
+        if (!result) sendJSON(res, 404, { error: 'Not found' });
+        else sendJSON(res, 200, result);
+        return;
+      }
+      if (pathname.match(/^\/api\/suite\/[^/]+$/) && method === 'GET') {
+        const name = decodeURIComponent(pathname.split('/')[3]);
+        const suite = await getSuite(suitesDir, name);
+        if (!suite) sendJSON(res, 404, { error: 'Not found' });
+        else sendJSON(res, 200, suite);
+        return;
+      }
+      if (pathname.match(/^\/api\/suite\/[^/]+$/) && method === 'PUT') {
+        const name = decodeURIComponent(pathname.split('/')[3]);
+        const body = await readBody(req);
+        const data = JSON.parse(body);
+        const result = await updateSuite(suitesDir, name, data);
+        sendJSON(res, 200, result);
+        return;
+      }
+      if (pathname.match(/^\/api\/suite\/[^/]+$/) && method === 'DELETE') {
+        const name = decodeURIComponent(pathname.split('/')[3]);
+        await deleteSuite(suitesDir, name);
+        sendJSON(res, 200, { deleted: true });
+        return;
+      }
+
+      // ─── ISSUES ────────────────────────────────────────────────────────
+      if (pathname === '/api/issues' && method === 'GET') {
+        const store = await loadIssueStore();
+        sendJSON(res, 200, store.issues || []);
+        return;
+      }
+      if (pathname === '/api/issues/sync' && method === 'POST') {
+        // Sync all open issues' status from their trackers
+        const result = await syncIssuesStatus();
+        sendJSON(res, 200, result);
+        return;
+      }
+      if (pathname.match(/^\/api\/issues\/[^/]+$/) && method === 'PATCH') {
+        // Manual status update: { status: 'open' | 'resolved' }
+        const id = decodeURIComponent(pathname.split('/')[3]);
+        const body = await readBody(req);
+        const data = JSON.parse(body);
+        const store = await loadIssueStore();
+        const issue = store.issues.find(i => i.fingerprint + ':' + i.tracker === id);
+        if (!issue) { sendJSON(res, 404, { error: 'Not found' }); return; }
+        if (data.status) issue.status = data.status;
+        await saveIssueStore(store);
+        sendJSON(res, 200, issue);
+        return;
+      }
+      if (pathname.match(/^\/api\/issues\/[^/]+$/) && method === 'DELETE') {
+        const id = decodeURIComponent(pathname.split('/')[3]);
+        const url = new URL(req.url, `http://localhost:${port}`);
+        const closeRemote = url.searchParams.get('closeRemote') === 'true';
+        const store = await loadIssueStore();
+        const issue = store.issues.find(i => (i.fingerprint + ':' + i.tracker) === id);
+        let remoteResult = null;
+        if (issue && closeRemote) {
+          try {
+            await closeRemoteIssue(issue);
+            remoteResult = 'closed';
+          } catch (err) {
+            remoteResult = 'failed: ' + err.message;
+          }
+        }
+        store.issues = store.issues.filter(i => (i.fingerprint + ':' + i.tracker) !== id);
+        await saveIssueStore(store);
+        sendJSON(res, 200, { deleted: true, remoteResult });
+        return;
+      }
+
+      // ─── CREDENTIALS ───────────────────────────────────────────────────
+      if (pathname === '/api/credentials' && method === 'GET') {
+        sendJSON(res, 200, await listCredentials());
+        return;
+      }
+      if (pathname === '/api/credentials' && method === 'POST') {
+        const body = await readBody(req);
+        const data = JSON.parse(body);
+        try {
+          await saveCredentialSet(data.name, data.values);
+          sendJSON(res, 200, { saved: true });
+        } catch (err) {
+          sendJSON(res, 400, { error: err.message });
+        }
+        return;
+      }
+      if (pathname.match(/^\/api\/credentials\/[^/]+$/) && method === 'GET') {
+        const name = decodeURIComponent(pathname.split('/')[3]);
+        const values = await getCredentialSet(name);
+        if (!values) sendJSON(res, 404, { error: 'Not found' });
+        else sendJSON(res, 200, { name, values });
+        return;
+      }
+      if (pathname.match(/^\/api\/credentials\/[^/]+$/) && method === 'PUT') {
+        const name = decodeURIComponent(pathname.split('/')[3]);
+        const body = await readBody(req);
+        const data = JSON.parse(body);
+        try {
+          await saveCredentialSet(data.name || name, data.values, name);
+          sendJSON(res, 200, { saved: true });
+        } catch (err) {
+          sendJSON(res, 400, { error: err.message });
+        }
+        return;
+      }
+      if (pathname.match(/^\/api\/credentials\/[^/]+$/) && method === 'DELETE') {
+        const name = decodeURIComponent(pathname.split('/')[3]);
+        await deleteCredentialSet(name);
+        sendJSON(res, 200, { deleted: true });
+        return;
+      }
+
+      // ─── SUITE RUNS ────────────────────────────────────────────────────
+      if (pathname === '/api/suite-runs' && method === 'GET') {
+        sendJSON(res, 200, await listSuiteRuns(suiteRunsDir, reportsDir));
+        return;
+      }
+      if (pathname.startsWith('/api/suite-run/') && method === 'GET') {
+        const id = pathname.split('/')[3];
+        const data = await getSuiteRun(suiteRunsDir, reportsDir, id);
+        if (!data) sendJSON(res, 404, { error: 'Not found' });
+        else sendJSON(res, 200, data);
+        return;
+      }
+      if (pathname.startsWith('/api/suite-run/') && method === 'DELETE') {
+        const id = pathname.split('/')[3];
+        const url = new URL(req.url, `http://localhost:${port}`);
+        const cascade = url.searchParams.get('cascade') === 'true';
+        await deleteSuiteRun(suiteRunsDir, reportsDir, id, cascade);
+        sendJSON(res, 200, { deleted: true });
+        return;
+      }
+      if (pathname === '/api/suite-runs' && method === 'DELETE') {
+        await deleteAllSuiteRuns(suiteRunsDir);
+        sendJSON(res, 200, { deleted: true });
+        return;
+      }
+
+      // ─── STATIC FILES ──────────────────────────────────────────────────
+      let filePath;
+      if (pathname === '/' || pathname === '/index.html') filePath = path.join(webRoot, 'index.html');
+      else if (pathname === '/app' || pathname === '/app/' || pathname === '/app/index.html') filePath = path.join(webRoot, 'app', 'index.html');
+      else if (pathname === '/setup' || pathname === '/setup/' || pathname === '/setup.html') filePath = path.join(webRoot, 'setup.html');
+      else if (pathname === '/login' || pathname === '/login/' || pathname === '/login.html') filePath = path.join(webRoot, 'login.html');
+      else if (pathname.startsWith('/invite/')) filePath = path.join(webRoot, 'invite.html');
+      else if (pathname.startsWith('/reset/')) filePath = path.join(webRoot, 'reset.html');
+      else if (pathname.startsWith('/reports/')) filePath = path.join(reportsDir, pathname.replace('/reports/', ''));
+      else filePath = path.join(webRoot, pathname);
+
+      if (filePath && await fs.pathExists(filePath)) {
+        const stat = await fs.stat(filePath);
+        if (stat.isFile()) {
+          const ext = path.extname(filePath);
+          const ct = {
+            '.html':'text/html','.css':'text/css','.js':'application/javascript',
+            '.json':'application/json','.png':'image/png','.jpg':'image/jpeg',
+            '.webm':'video/webm','.svg':'image/svg+xml',
+          }[ext] || 'application/octet-stream';
+          res.writeHead(200, { 'Content-Type': ct });
+          fs.createReadStream(filePath).pipe(res);
+          return;
+        }
+      }
+
+      res.writeHead(404);
+      res.end('Not found');
+    } catch (err) {
+      console.error('Server error:', err);
+      sendJSON(res, 500, { error: err.message });
+    }
+  });
+
+  // ── WEBSOCKET AGENT SERVER ──────────────────────────────────────────────
+  // Handles agent connections using raw HTTP upgrade (no ws package needed)
+  // Protocol: newline-delimited JSON over a persistent TCP connection
+  server.on('upgrade', (req, socket, head) => {
+    const url = req.url || '';
+    if (!url.startsWith('/agent')) { socket.destroy(); return; }
+
+    // Verify secret key
+    const expectedKey = process.env.SKOPIX_SECRET_KEY || '';
+    const auth = req.headers['x-skopix-key'] || '';
+    if (!expectedKey || auth !== expectedKey) {
+      socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n');
+      socket.destroy();
+      return;
+    }
+
+    // WebSocket handshake
+    const wsKey = req.headers['sec-websocket-key'];
+    if (!wsKey) { socket.write('HTTP/1.1 400 Bad Request\r\n\r\n'); socket.destroy(); return; }
+    const accept = crypto.createHash('sha1').update(wsKey + '258EAFA5-E914-47DA-95CA-C5AB0DC85B11').digest('base64');
+    socket.write('HTTP/1.1 101 Switching Protocols\r\nUpgrade: websocket\r\nConnection: Upgrade\r\nSec-WebSocket-Accept: ' + accept + '\r\n\r\n');
+
+    // Create minimal WS wrapper
+    const ws = createWsWrapper(socket);
+
+    ws.on('message', (raw) => {
+      let msg;
+      try { msg = JSON.parse(raw); } catch { return; }
+
+      if (msg.type === 'register') {
+        const agentId = msg.agentId || crypto.randomUUID();
+        const agent = { id: agentId, name: msg.name || msg.machine, machine: msg.machine, userId: msg.userId || null, ws, status: 'idle', currentJob: null, connectedAt: Date.now() };
+        agents.set(agentId, agent);
+        ws.agentId = agentId;
+        ws.send(JSON.stringify({ type: 'registered', agentId }));
+        console.log(chalk.cyan('[agent]') + ' Connected: ' + agent.name + ' (' + agent.machine + ')');
+        broadcastAgentList();
+        return;
+      }
+
+      const agent = ws.agentId ? agents.get(ws.agentId) : null;
+      if (!agent) return;
+
+      if (msg.type === 'jobUpdate') {
+        // Agent streaming step output back to server
+        const run = msg.runId ? activeRuns.get(msg.runId) : null;
+        if (run) {
+          run.output.push(msg.data);
+          run.listeners.forEach(l => { try { l(msg.data); } catch {} });
+          if (msg.data.type === 'done') {
+            run.status = msg.data.status || 'done';
+            agent.status = 'idle';
+            agent.currentJob = null;
+            broadcastAgentList();
+          }
+        }
+      } else if (msg.type === 'recordingUpdate') {
+        // Agent streaming recording events back
+        const rec = msg.recordingId ? activeRecordings.get(msg.recordingId) : null;
+        if (rec) {
+          rec.output.push(msg.data);
+          rec.listeners.forEach(l => { try { l(msg.data); } catch {} });
+          if (msg.data.type === 'step') rec.steps.push(msg.data.step);
+          if (msg.data.type === 'done' || msg.data.type === 'stopped') {
+            if (msg.data.steps) rec.steps = msg.data.steps;
+            rec.status = 'stopped';
+            agent.status = 'idle';
+            agent.currentJob = null;
+            broadcastAgentList();
+          }
+        }
+      }
+    });
+
+    ws.on('close', () => {
+      if (ws.agentId) {
+        const agent = agents.get(ws.agentId);
+        if (agent) console.log(chalk.yellow('[agent]') + ' Disconnected: ' + agent.name);
+        agents.delete(ws.agentId);
+        broadcastAgentList();
+      }
+    });
+  });
+
+  // Minimal WebSocket frame encoder/decoder for Node streams
+  function createWsWrapper(socket) {
+    const emitter = new (class WsEmitter {
+      constructor() { this._events = {}; this.readyState = 1; }
+      on(ev, fn) { (this._events[ev] = this._events[ev] || []).push(fn); return this; }
+      emit(ev, ...args) { (this._events[ev] || []).forEach(fn => fn(...args)); }
+      send(data) {
+        const buf = Buffer.from(data);
+        const len = buf.length;
+        let header;
+        if (len < 126) { header = Buffer.alloc(2); header[0] = 0x81; header[1] = len; }
+        else if (len < 65536) { header = Buffer.alloc(4); header[0] = 0x81; header[1] = 126; header.writeUInt16BE(len, 2); }
+        else { header = Buffer.alloc(10); header[0] = 0x81; header[1] = 127; header.writeBigUInt64BE(BigInt(len), 2); }
+        try { socket.write(Buffer.concat([header, buf])); } catch {}
+      }
+    })();
+    emitter.readyState = 1;
+    emitter.send = (data) => {
+      const buf = Buffer.from(data);
+      const len = buf.length;
+      let header;
+      if (len < 126) { header = Buffer.alloc(2); header[0] = 0x81; header[1] = len; }
+      else if (len < 65536) { header = Buffer.alloc(4); header[0] = 0x81; header[1] = 126; header.writeUInt16BE(len, 2); }
+      else { header = Buffer.alloc(10); header[0] = 0x81; header[1] = 127; header.writeBigUInt64BE(BigInt(len), 2); }
+      socket.write(Buffer.concat([header, buf]));
+    };
+    let buf = Buffer.alloc(0);
+    socket.on('data', (chunk) => {
+      buf = Buffer.concat([buf, chunk]);
+      while (buf.length >= 2) {
+        const masked = (buf[1] & 0x80) !== 0;
+        let payloadLen = buf[1] & 0x7f;
+        let offset = 2;
+        if (payloadLen === 126) { if (buf.length < 4) break; payloadLen = buf.readUInt16BE(2); offset = 4; }
+        else if (payloadLen === 127) { if (buf.length < 10) break; payloadLen = Number(buf.readBigUInt64BE(2)); offset = 10; }
+        if (masked) offset += 4;
+        if (buf.length < offset + payloadLen) break;
+        let payload = buf.slice(offset, offset + payloadLen);
+        if (masked) { const mask = buf.slice(offset - 4, offset); payload = Buffer.from(payload.map((b, i) => b ^ mask[i % 4])); }
+        const opcode = buf[0] & 0x0f;
+        if (opcode === 8) { emitter.readyState = 3; emitter.emit('close'); socket.end(); }
+        else if (opcode === 1 || opcode === 2) emitter.emit('message', payload.toString());
+        buf = buf.slice(offset + payloadLen);
+      }
+    });
+    socket.on('close', () => { emitter.readyState = 3; emitter.emit('close'); });
+    socket.on('error', () => { emitter.readyState = 3; emitter.emit('close'); });
+    return emitter;
+  }
+
+  server.listen(port, host, () => {
+    const displayHost = (host === '0.0.0.0' || host === '::') ? 'localhost' : host;
+    console.log(chalk.cyan('━'.repeat(60)));
+    console.log(chalk.white.bold('  Skopix Dashboard'));
+    console.log(chalk.cyan('━'.repeat(60)));
+    console.log();
+    console.log(chalk.green('  ✓ ') + 'Server: ' + chalk.cyan(`http://${displayHost}:${port}`));
+    if (host === '0.0.0.0' || host === '::') {
+      console.log(chalk.green('  ✓ ') + 'Listening on all interfaces (team mode bind)');
+    }
+    console.log(chalk.green('  ✓ ') + 'Reports: ' + chalk.cyan(reportsDir));
+    console.log(chalk.green('  ✓ ') + 'Suites: ' + chalk.cyan(suitesDir));
+    if (teamMode) {
+      console.log(chalk.green('  ✓ ') + 'Mode: ' + chalk.cyan('team (multi-user)'));
+      console.log(chalk.green('  ✓ ') + 'Database: ' + chalk.cyan(teamMode.db.getDbPath()));
+      if (!teamMode.db.hasAnyAdmin()) {
+        console.log();
+        console.log(chalk.yellow('  ⚠ Setup required: visit ') + chalk.cyan(`http://${displayHost}:${port}/setup`) + chalk.yellow(' to create the first admin'));
+      }
+    } else {
+      console.log(chalk.green('  ✓ ') + 'Mode: ' + chalk.cyan('single-user'));
+    }
+    console.log();
+    console.log(chalk.dim('  Press Ctrl+C to stop'));
+    console.log();
+    if (!options.noOpen) {
+      const openPath = (teamMode && !teamMode.db.hasAnyAdmin()) ? '/setup' : '/app/';
+      open(`http://${displayHost}:${port}${openPath}`).catch(() => {});
+    }
+  });
+
+  process.on('SIGINT', () => { console.log(chalk.yellow('\n  Stopping...')); server.close(); process.exit(0); });
+}
+
+// ─── HELPERS ──────────────────────────────────────────────────────────────────
+function sendJSON(res, status, data) {
+  res.writeHead(status, { 'Content-Type': 'application/json' });
+  res.end(JSON.stringify(data));
+}
+
+// Parse a single cookie value out of a Cookie header string.
+// Returns null if not found. Safe against malformed input.
+function parseCookie(cookieHeader, name) {
+  if (!cookieHeader || typeof cookieHeader !== 'string') return null;
+  const parts = cookieHeader.split(';');
+  for (const part of parts) {
+    const trimmed = part.trim();
+    const eqIdx = trimmed.indexOf('=');
+    if (eqIdx === -1) continue;
+    const key = trimmed.slice(0, eqIdx);
+    const value = trimmed.slice(eqIdx + 1);
+    if (key === name) return decodeURIComponent(value);
+  }
+  return null;
+}
+
+// Resolve the request to a user via the session cookie.
+// Returns: { user } if valid session and active user, null otherwise.
+// Pass `tm` (the teamMode object) so this works without globals.
+function resolveCurrentUser(req, tm) {
+  if (!tm) return null;
+  const token = parseCookie(req.headers.cookie || '', 'skopix_session');
+  if (!token) return null;
+  const session = tm.db.getWebSession(token);
+  if (!session) return null;
+  const user = tm.db.getUserById(session.user_id);
+  if (!user || user.status !== 'active') return null;
+  // Touch the session so active users don't expire prematurely
+  tm.db.touchWebSession(token);
+  return { user, sessionToken: token };
+}
+
+// Decide whether a request path should bypass auth in team mode.
+// Public paths: setup wizard, login flow, status check, static assets.
+// Everything else (incl. /app/ JS-loaded API calls) requires a session.
+function isPublicPath(pathname) {
+  // API routes that don't require auth
+  const publicApis = new Set([
+    '/api/team/status',
+    '/api/setup',
+    '/api/auth/login',
+    '/api/auth/logout',
+    '/api/auth/me', // returns 401 itself, doesn't need to be blocked here
+    '/api/agent/auth', // agents authenticate with secret key, not session cookie
+  ]);
+  if (publicApis.has(pathname)) return true;
+  // Public invite endpoints: GET invite details + accept invite (no auth needed)
+  // /api/invites/<token> GET, /api/invites/<token>/accept POST
+  if (pathname.match(/^\/api\/invites\/[^/]+$/)) return true;
+  if (pathname.match(/^\/api\/invites\/[^/]+\/accept$/)) return true;
+  // Password reset (admin-generated link, used by the recipient who isn't logged in)
+  if (pathname.match(/^\/api\/password-reset\/[^/]+$/)) return true;
+  // Static pages everyone can fetch (the JS inside enforces auth)
+  if (pathname === '/' || pathname === '/index.html') return true;
+  if (pathname === '/login' || pathname === '/login/' || pathname === '/login.html') return true;
+  if (pathname === '/setup' || pathname === '/setup/' || pathname === '/setup.html') return true;
+  // Accept invite page - public
+  if (pathname.startsWith('/invite/')) return true;
+  if (pathname.startsWith('/reset/')) return true;
+  // /app/ is NOT in the public list - handled specially in the auth gate (redirects to /login if no session).
+  // Static assets used by the pages above (fonts, css, images served from web/)
+  // Anything outside /api/ that's a static file should be allowed.
+  if (!pathname.startsWith('/api/')) return true;
+  return false;
+}
+function readBody(req) {
+  return new Promise((resolve, reject) => {
+    let body = '';
+    req.on('data', c => body += c);
+    req.on('end', () => resolve(body));
+    req.on('error', reject);
+  });
+}
+
+function slugify(s) {
+  return String(s || '').toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
+}
+
+function testIdFromName(name) {
+  return slugify(name) || 'test-' + Math.random().toString(36).slice(2, 8);
+}
+
+// ─── SESSIONS ─────────────────────────────────────────────────────────────────
+async function listSessions(reportsDir) {
+  if (!await fs.pathExists(reportsDir)) return [];
+  const entries = await fs.readdir(reportsDir);
+  const sessions = [];
+  for (const entry of entries) {
+    if (entry.startsWith('.')) continue;
+    const sessionPath = path.join(reportsDir, entry);
+    const stat = await fs.stat(sessionPath);
+    if (!stat.isDirectory()) continue;
+    const jsonPath = path.join(sessionPath, 'report.json');
+    if (await fs.pathExists(jsonPath)) {
+      try {
+        const data = await fs.readJson(jsonPath);
+        const status = data.goalAchieved ? 'passed' : data.stuck ? 'stuck' : 'failed';
+        // Read run attribution if present (team mode)
+        let runBy = null;
+        const runByPath = path.join(sessionPath, 'runBy.json');
+        if (await fs.pathExists(runByPath)) {
+          try { runBy = await fs.readJson(runByPath); } catch {}
+        }
+        sessions.push({
+          id: data.sessionId || entry, status,
+          url: data.url, goal: data.goal,
+          steps: data.steps?.length || 0,
+          issues: data.issues?.length || 0,
+          duration: formatDuration(data.duration || 0),
+          durationMs: data.duration || 0,
+          when: relativeTime(stat.mtime),
+          mtime: stat.mtime.toISOString(),
+          model: data.model, provider: data.provider,
+          runBy, // null in single-user mode or when no attribution recorded
+        });
+      } catch {}
+    }
+  }
+  sessions.sort((a, b) => new Date(b.mtime) - new Date(a.mtime));
+  return sessions;
+}
+async function getSession(reportsDir, id) {
+  const jsonPath = path.join(reportsDir, id, 'report.json');
+  if (!await fs.pathExists(jsonPath)) return null;
+  try {
+    const data = await fs.readJson(jsonPath);
+    // Attach runBy if present
+    const runByPath = path.join(reportsDir, id, 'runBy.json');
+    if (await fs.pathExists(runByPath)) {
+      try { data.runBy = await fs.readJson(runByPath); } catch {}
+    }
+    return data;
+  } catch { return null; }
+}
+function computeStats(sessions) {
+  const total = sessions.length;
+  const passed = sessions.filter(s => s.status === 'passed').length;
+  const failed = sessions.filter(s => s.status === 'failed').length;
+  const stuck = sessions.filter(s => s.status === 'stuck').length;
+  const passRate = total > 0 ? Math.round((passed / total) * 100) : 0;
+  const totalIssues = sessions.reduce((sum, s) => sum + (s.issues || 0), 0);
+  const avgMs = total > 0 ? sessions.reduce((sum, s) => sum + (s.durationMs || 0), 0) / total : 0;
+  const weekAgo = Date.now() - 7 * 24 * 60 * 60 * 1000;
+  const thisWeek = sessions.filter(s => new Date(s.mtime).getTime() > weekAgo).length;
+  return { total, passed, failed, stuck, passRate, totalIssues, avgDuration: formatDuration(avgMs), avgDurationMs: avgMs, thisWeek };
+}
+async function getConfig() {
+  const envPath = path.resolve(process.cwd(), '.skopix.env');
+  if (!await fs.pathExists(envPath)) return [];
+  const content = await fs.readFile(envPath, 'utf-8');
+  const config = [];
+  for (const line of content.split('\n')) {
+    const t = line.trim();
+    if (!t || t.startsWith('#')) continue;
+    const eq = t.indexOf('=');
+    if (eq === -1) continue;
+    const key = t.slice(0, eq).trim();
+    const value = t.slice(eq + 1).trim();
+    const isSecret = key.includes('KEY') || key.includes('TOKEN') || key.includes('PASSWORD');
+    config.push({ key, value: isSecret ? value.slice(0, 6) + '••••••••••••••' : value, isSecret });
+  }
+  return config;
+}
+
+// ─── SUITES ───────────────────────────────────────────────────────────────────
+async function listSuites(suitesDir) {
+  const files = await fs.readdir(suitesDir);
+  const suiteFiles = files.filter(f => (f.endsWith('.suite.yaml') || f.endsWith('.suite.yml')) && f !== SAVED_TESTS_FILE);
+  const suites = [];
+  for (const file of suiteFiles) {
+    try {
+      const content = await fs.readFile(path.join(suitesDir, file), 'utf-8');
+      const data = yaml.parse(content);
+      const stat = await fs.stat(path.join(suitesDir, file));
+      suites.push({
+        filename: file,
+        name: data.name || file,
+        description: data.description || '',
+        testCount: data.tests?.length || 0,
+        defaults: data.defaults || {},
+        tags: collectTags(data.tests),
+        modified: stat.mtime.toISOString(),
+        modifiedRelative: relativeTime(stat.mtime),
+      });
+    } catch {}
+  }
+  return suites;
+}
+function collectTags(tests) {
+  if (!tests) return [];
+  const set = new Set();
+  tests.forEach(t => (t.tags || []).forEach(tag => set.add(tag)));
+  return Array.from(set);
+}
+async function getSuite(suitesDir, filename) {
+  const filePath = path.join(suitesDir, filename);
+  if (!await fs.pathExists(filePath)) return null;
+  try {
+    const content = await fs.readFile(filePath, 'utf-8');
+    return { filename, ...yaml.parse(content) };
+  } catch { return null; }
+}
+function suiteFileName(name) { return slugify(name) + '.suite.yaml'; }
+async function saveSuite(suitesDir, data) {
+  const filename = suiteFileName(data.name || 'untitled');
+  const filePath = path.join(suitesDir, filename);
+  const suite = {
+    name: data.name || 'Untitled Suite',
+    description: data.description || '',
+    defaults: data.defaults || {},
+    waitBetweenTests: data.waitBetweenTests || 2000,
+    tests: data.tests || [],
+  };
+  if (data.parallel && data.parallel > 1) suite.parallel = data.parallel;
+  await fs.writeFile(filePath, yaml.stringify(suite));
+  return { filename, ...suite };
+}
+async function updateSuite(suitesDir, filename, data) {
+  const filePath = path.join(suitesDir, filename);
+  const suite = {
+    name: data.name || 'Untitled Suite',
+    description: data.description || '',
+    defaults: data.defaults || {},
+    waitBetweenTests: data.waitBetweenTests || 2000,
+    tests: data.tests || [],
+  };
+  if (data.parallel && data.parallel > 1) suite.parallel = data.parallel;
+  await fs.writeFile(filePath, yaml.stringify(suite));
+  return { filename, ...suite };
+}
+async function duplicateSuite(suitesDir, filename) {
+  const filePath = path.join(suitesDir, filename);
+  if (!await fs.pathExists(filePath)) return null;
+  const content = await fs.readFile(filePath, 'utf-8');
+  const data = yaml.parse(content);
+  data.name = (data.name || 'Suite') + ' (copy)';
+  return await saveSuite(suitesDir, data);
+}
+async function deleteSuite(suitesDir, filename) {
+  const filePath = path.join(suitesDir, filename);
+  if (await fs.pathExists(filePath)) await fs.remove(filePath);
+}
+
+// ─── TESTS (across all scopes) ────────────────────────────────────────────────
+function scopeToFilename(scope) {
+  if (scope === 'saved') return SAVED_TESTS_FILE;
+  return scope; // already a filename like "smoke.suite.yaml"
+}
+function filenameToScope(filename) {
+  if (filename === SAVED_TESTS_FILE) return 'saved';
+  return filename;
+}
+
+async function readSuiteFile(suitesDir, filename) {
+  const filePath = path.join(suitesDir, filename);
+  if (!await fs.pathExists(filePath)) return null;
+  try {
+    const content = await fs.readFile(filePath, 'utf-8');
+    return yaml.parse(content);
+  } catch { return null; }
+}
+async function writeSuiteFile(suitesDir, filename, data) {
+  const filePath = path.join(suitesDir, filename);
+  await fs.writeFile(filePath, yaml.stringify(data));
+}
+async function ensureSavedTestsFile(suitesDir) {
+  const fp = path.join(suitesDir, SAVED_TESTS_FILE);
+  if (!await fs.pathExists(fp)) {
+    await fs.writeFile(fp, yaml.stringify({
+      name: 'Saved Tests',
+      description: 'Standalone tests not in any suite',
+      tests: [],
+    }));
+  }
+}
+
+async function listAllTests(suitesDir) {
+  const files = await fs.readdir(suitesDir);
+  const suiteFiles = files.filter(f => f.endsWith('.suite.yaml') || f.endsWith('.suite.yml'));
+  const allTests = [];
+
+  for (const file of suiteFiles) {
+    const data = await readSuiteFile(suitesDir, file);
+    if (!data) continue;
+    const scope = filenameToScope(file);
+    const scopeName = file === SAVED_TESTS_FILE ? 'Saved tests' : (data.name || file);
+
+    for (const test of (data.tests || [])) {
+      // Skip cross-reference entries — these are tests from another scope
+      // that were added to this suite via the picker. They're stored with
+      // a `scope` field pointing to their real home (e.g. 'saved').
+      // They'll appear under their actual scope — no need to show them here too.
+      if (test.scope && test.scope !== scope) continue;
+
+      const id = test.id || testIdFromName(test.name);
+      allTests.push({
+        id,
+        scope,
+        scopeName,
+        scopeIsSaved: scope === 'saved',
+        name: test.name || 'Untitled',
+        type: test.type || 'goal',
+        url: test.url,
+        goal: test.goal,
+        steps: test.steps || [],
+        playwrightJs: test.playwrightJs || '',
+        playwrightTs: test.playwrightTs || '',
+        reusable: test.reusable || false,
+        setup: test.setup || null,
+        maxSteps: test.maxSteps,
+        tags: test.tags || [],
+        provider: test.provider,
+        model: test.model,
+        credentials: test.credentials || '',
+      });
+    }
+  }
+  return allTests;
+}
+
+async function getTest(suitesDir, scope, testId) {
+  const filename = scopeToFilename(scope);
+  const data = await readSuiteFile(suitesDir, filename);
+  if (!data || !data.tests) return null;
+  const test = data.tests.find(t => (t.id || testIdFromName(t.name)) === testId);
+  if (!test) return null;
+  // If this is a cross-reference (test lives in another scope), load from there
+  if (test.scope && test.scope !== scope) {
+    return getTest(suitesDir, test.scope, test.id || testIdFromName(test.name));
+  }
+  return { ...test, id: test.id || testIdFromName(test.name), scope };
+}
+
+async function createTest(suitesDir, scope, testData) {
+  const filename = scopeToFilename(scope);
+  if (scope === 'saved') await ensureSavedTestsFile(suitesDir);
+  const data = await readSuiteFile(suitesDir, filename);
+  if (!data) throw new Error('Scope not found: ' + scope);
+
+  data.tests = data.tests || [];
+
+  const id = testIdFromName(testData.name);
+
+  // Check uniqueness within scope
+  if (data.tests.some(t => (t.id || testIdFromName(t.name)) === id)) {
+    throw new Error(`A test named "${testData.name}" already exists in this scope`);
+  }
+
+  const newTest = { id, ...cleanTest(testData) };
+  data.tests.push(newTest);
+  await writeSuiteFile(suitesDir, filename, data);
+  return { ...newTest, scope };
+}
+
+async function updateTest(suitesDir, scope, testId, testData) {
+  const filename = scopeToFilename(scope);
+  const data = await readSuiteFile(suitesDir, filename);
+  if (!data || !data.tests) throw new Error('Test not found');
+
+  const idx = data.tests.findIndex(t => (t.id || testIdFromName(t.name)) === testId);
+  if (idx === -1) throw new Error('Test not found');
+
+  // If renaming, check the new name doesn't collide with a different test
+  const newId = testIdFromName(testData.name);
+  if (newId !== testId && data.tests.some((t, i) => i !== idx && (t.id || testIdFromName(t.name)) === newId)) {
+    throw new Error(`A test named "${testData.name}" already exists in this scope`);
+  }
+
+  const existing = data.tests[idx];
+  const merged = { ...existing, ...testData };
+  data.tests[idx] = { id: newId, ...cleanTest(merged) };
+  await writeSuiteFile(suitesDir, filename, data);
+  return { ...data.tests[idx], scope };
+}
+
+async function deleteTest(suitesDir, scope, testId) {
+  const filename = scopeToFilename(scope);
+  const data = await readSuiteFile(suitesDir, filename);
+  if (!data || !data.tests) return;
+  data.tests = data.tests.filter(t => (t.id || testIdFromName(t.name)) !== testId);
+  await writeSuiteFile(suitesDir, filename, data);
+}
+
+async function duplicateTest(suitesDir, scope, testId) {
+  const test = await getTest(suitesDir, scope, testId);
+  if (!test) return null;
+
+  // Strip the id and scope from the source test, copy everything else
+  const { scope: _scope, id: _id, ...testData } = test;
+
+  // Build a unique copy name: "Login test" -> "Login test (copy)", "Login test (copy 2)", etc.
+  const filename = scopeToFilename(scope);
+  const data = await readSuiteFile(suitesDir, filename);
+  const existingNames = new Set((data?.tests || []).map(t => t.name));
+  const baseName = (testData.name || 'Test').replace(/\s*\(copy(?:\s+\d+)?\)\s*$/i, '');
+  let newName = baseName + ' (copy)';
+  let copyNum = 2;
+  while (existingNames.has(newName)) {
+    newName = baseName + ' (copy ' + copyNum + ')';
+    copyNum++;
+  }
+  testData.name = newName;
+
+  return await createTest(suitesDir, scope, testData);
+}
+
+async function moveTest(suitesDir, fromScope, testId, toScope) {
+  if (fromScope === toScope) return { moved: false };
+  const test = await getTest(suitesDir, fromScope, testId);
+  if (!test) throw new Error('Test not found');
+
+  // Strip the scope from test before adding
+  const { scope: _omit, id: _id, ...testData } = test;
+
+  // Will throw if duplicate name in target scope
+  const created = await createTest(suitesDir, toScope, testData);
+  await deleteTest(suitesDir, fromScope, testId);
+  return { moved: true, newScope: toScope, test: created };
+}
+
+function cleanTest(t) {
+  const out = { name: t.name };
+  if (t.goal) out.goal = t.goal;
+  if (t.type) out.type = t.type;
+  if (t.steps) out.steps = t.steps;
+  if (t.playwrightJs) out.playwrightJs = t.playwrightJs;
+  if (t.playwrightTs) out.playwrightTs = t.playwrightTs;
+  if (t.reusable) out.reusable = true;
+  if (t.setup) out.setup = t.setup;
+  if (t.url) out.url = t.url;
+  if (t.maxSteps) out.maxSteps = t.maxSteps;
+  if (t.tags && t.tags.length > 0) out.tags = t.tags;
+  if (t.provider) out.provider = t.provider;
+  if (t.model) out.model = t.model;
+  if (t.credentials) out.credentials = t.credentials;
+  if (t.github) out.github = true;
+  if (t.jira) out.jira = true;
+  if (t.linear) out.linear = true;
+  if (t.headless) out.headless = true;
+  return out;
+}
+
+// ─── SUITE RUNS ───────────────────────────────────────────────────────────────
+async function listSuiteRuns(suiteRunsDir, reportsDir) {
+  if (!await fs.pathExists(suiteRunsDir)) return [];
+  const files = await fs.readdir(suiteRunsDir);
+  const runs = [];
+  for (const file of files) {
+    if (!file.endsWith('.json')) continue;
+    try {
+      const data = await fs.readJson(path.join(suiteRunsDir, file));
+      const stat = await fs.stat(path.join(suiteRunsDir, file));
+      runs.push({
+        ...data,
+        when: relativeTime(stat.mtime),
+        mtime: stat.mtime.toISOString(),
+      });
+    } catch {}
+  }
+  runs.sort((a, b) => new Date(b.mtime) - new Date(a.mtime));
+  return runs;
+}
+
+async function getSuiteRun(suiteRunsDir, reportsDir, id) {
+  const filePath = path.join(suiteRunsDir, id + '.json');
+  if (!await fs.pathExists(filePath)) return null;
+  const data = await fs.readJson(filePath);
+
+  // Resolve session details for each test
+  const enrichedResults = [];
+  for (const result of (data.results || [])) {
+    if (result.sessionId) {
+      const session = await getSession(reportsDir, result.sessionId);
+      if (session) {
+        const status = session.goalAchieved !== undefined ? (session.goalAchieved ? 'passed' : session.stuck ? 'stuck' : 'failed') : (result.status || 'unknown');
+        enrichedResults.push({
+          ...result,
+          status,
+          duration: formatDuration(session.duration || 0),
+          steps: session.steps?.length || 0,
+          issues: session.issues?.length || 0,
+          hasReport: true,
+        });
+        continue;
+      }
+    }
+    // Session not on this server (ran on agent machine) — use stored result
+    enrichedResults.push({ ...result, hasReport: false });
+  }
+  return { ...data, results: enrichedResults };
+}
+
+async function startSuiteRun(suitesDir, filename, activeRuns, suiteRunsDir, reportsDir, currentUser, userEnv, agentHelpers = {}) {
+  const { getLeastBusyAgent = () => null, sendToAgent = () => {}, broadcastAgentList = () => {} } = agentHelpers;
+  const runBy = currentUser ? {
+    id: currentUser.id, name: currentUser.name,
+    email: currentUser.email, role: currentUser.role,
+  } : null;
+  const suite = await getSuite(suitesDir, filename);
+  if (!suite || !suite.tests || suite.tests.length === 0) return null;
+
+  const runId = Math.random().toString(36).slice(2, 10);
+  const startedAt = new Date().toISOString();
+  const run = {
+    id: runId, type: 'suite',
+    suiteName: suite.name, suiteFilename: filename,
+    status: 'running', output: [], listeners: [],
+    sessionIds: [], testResults: [], startedAt,
+  };
+  activeRuns.set(runId, run);
+
+  const broadcast = (line) => {
+    run.output.push(line);
+    run.listeners.forEach(l => l(line));
+  };
+
+  (async () => {
+    // Determine concurrency: from suite.parallel (default 1 for backwards compat)
+    const parallel = Math.max(1, Math.min(5, suite.parallel || suite.defaults?.parallel || 1));
+    const isParallel = parallel > 1;
+
+    broadcast({ type: 'stdout', text: `\n━━━ Suite: ${suite.name} ━━━` });
+    broadcast({ type: 'stdout', text: `${suite.tests.length} test(s) to run${isParallel ? ` (running ${parallel} in parallel)` : ''}\n` });
+
+    let completedCount = 0;
+    let runningCount = 0;
+
+    // Pre-resolve test configs (skip invalid ones up front)
+    const testTasks = suite.tests.map((test, i) => ({
+      index: i,
+      test,
+      config: {
+        url: test.url || suite.defaults?.url,
+        goal: test.goal,
+        credentials: test.credentials || suite.defaults?.credentials,
+        maxSteps: test.maxSteps || suite.defaults?.maxSteps || 20,
+        provider: test.provider || suite.defaults?.provider || 'gemini',
+        model: test.model || suite.defaults?.model,
+        github: test.github !== undefined ? test.github : suite.defaults?.github,
+        jira: test.jira !== undefined ? test.jira : suite.defaults?.jira,
+        linear: test.linear !== undefined ? test.linear : suite.defaults?.linear,
+        headless: test.headless !== undefined ? test.headless : suite.defaults?.headless,
+        testName: test.name,
+        suiteName: suite.name,
+      },
+    }));
+
+    // Build a per-test broadcast that tags lines with [T<n>] in parallel mode
+    const taggedBroadcast = (workerNum) => (line) => {
+      if (isParallel && (line.type === 'stdout' || line.type === 'stderr')) {
+        broadcast({ ...line, text: `[T${workerNum}] ${line.text}` });
+      } else if (line.type === 'sessionId') {
+        // Pass session IDs through directly so the dashboard can pick them up
+        broadcast(line);
+      } else if (line.type !== 'done' && line.type !== 'suiteProgress') {
+        // Non-stdout (e.g. status updates) we just pass along
+        broadcast(line);
+      }
+    };
+
+    // Execute a single test task
+    const runOne = async (task, workerNum) => {
+      const t = task.test;
+      runningCount++;
+      broadcast({ type: 'suiteProgress', current: completedCount + 1, total: suite.tests.length, testName: t.name, runningCount });
+      const header = `\n━━━ Test ${task.index + 1}/${suite.tests.length}${isParallel ? ` [worker T${workerNum}]` : ''}: ${t.name} ━━━`;
+      broadcast({ type: 'stdout', text: header });
+
+      // Recorded tests — run via startReplay
+      // May need to look up full test data if suite only stored id/name/scope
+      let fullTest = t;
+      if (t.type === 'recorded' || (!t.goal && (t.id || t.scope))) {
+        try {
+          const scope = t.scope || 'saved';
+          const testId = t.id || testIdFromName(t.name);
+          const loaded = await getTest(suitesDir, scope, testId);
+          if (loaded) fullTest = { ...loaded, ...t }; // merge, test fields take priority
+        } catch {}
+      }
+
+      if (fullTest.type === 'recorded' || (fullTest.steps && fullTest.steps.length)) {
+        if (!fullTest.steps || !fullTest.steps.length) {
+          broadcast({ type: 'stdout', text: `[SKIP] Recorded test "${fullTest.name}" has no steps` });
+          run.testResults.push({ name: fullTest.name, testId: fullTest.id || testIdFromName(fullTest.name), status: 'skipped' });
+          runningCount--; completedCount++; return;
+        }
+        // Load setup if referenced
+        let setupTest = null;
+        if (fullTest.setup) {
+          try {
+            const all = await listAllTests(suitesDir);
+            const ref = all.find(x => x.id === fullTest.setup || x.name === fullTest.setup);
+            if (ref) setupTest = await getTest(suitesDir, ref.scope, ref.id);
+          } catch {}
+        }
+        // Resolve credentials
+        if (fullTest.credentials) {
+          const creds = await resolveCredentials(fullTest.credentials);
+          if (creds) {
+            fullTest.steps = fullTest.steps.map(s => s.action === 'type' && s.isPassword && creds.password ? { ...s, value: creds.password } : s);
+          }
+        }
+        // Dispatch to agent if available, otherwise run locally
+        const suiteAgent = getLeastBusyAgent(runBy?.id);
+        let replayRunId;
+
+        if (suiteAgent) {
+          // Run on agent machine
+          replayRunId = Math.random().toString(36).slice(2, 10);
+          const agentRun = { id: replayRunId, type: 'replay', status: 'running', output: [], listeners: [], sessionId: replayRunId };
+          activeRuns.set(replayRunId, agentRun);
+          suiteAgent.status = 'replaying';
+          suiteAgent.currentJob = { type: 'replay', runId: replayRunId, testName: fullTest.name };
+          broadcastAgentList();
+          sendToAgent(suiteAgent, { type: 'replay', runId: replayRunId, test: fullTest, setupTest, env: userEnv || {} });
+          broadcast({ type: 'stdout', text: `  → Dispatched to agent: ${suiteAgent.name}` });
+        } else {
+          // Run locally
+          replayRunId = startReplay(fullTest, setupTest, activeRuns, reportsDir, { id: runBy?.id, name: runBy?.name, email: runBy?.email, role: runBy?.role }, userEnv);
+        }
+        // Wait for replay to complete
+        await new Promise(resolve => {
+          const replayRun = activeRuns.get(replayRunId);
+          if (!replayRun) { resolve(); return; }
+          if (replayRun.status !== 'running') { resolve(); return; }
+          const check = setInterval(() => {
+            const r = activeRuns.get(replayRunId);
+            if (!r || r.status !== 'running') { clearInterval(check); resolve(); }
+          }, 500);
+        });
+        const replayRun = activeRuns.get(replayRunId);
+        const passed = replayRun ? replayRun.status === 'passed' : false;
+        const sessionId = replayRun ? replayRun.sessionId : null;
+        if (sessionId) { run.sessionIds.push(sessionId); broadcast({ type: 'sessionId', sessionId }); }
+        broadcast({ type: 'stdout', text: `\n  Result: ${passed ? 'PASSED ✓' : 'FAILED ✗'}` });
+        run.testResults.push({ name: fullTest.name, testId: fullTest.id || testIdFromName(fullTest.name), status: passed ? 'passed' : 'failed', sessionId });
+        runningCount--; completedCount++;
+        return;
+      }
+
+      // Goal-based tests (legacy)
+      if (!task.config.url || !task.config.goal) {
+        broadcast({ type: 'stdout', text: `[SKIP] Test "${t.name}" has no url or goal` });
+        run.testResults.push({ name: t.name, testId: t.id || testIdFromName(t.name), status: 'skipped' });
+        runningCount--;
+        completedCount++;
+        return;
+      }
+
+      const result = await runSingleTestSync(task.config, isParallel ? taggedBroadcast(workerNum) : broadcast, userEnv, reportsDir, runBy);
+      run.testResults.push({
+        name: t.name,
+        testId: t.id || testIdFromName(t.name),
+        status: result.status,
+        sessionId: result.sessionId,
+      });
+      if (result.sessionId) run.sessionIds.push(result.sessionId);
+      runningCount--;
+      completedCount++;
+      broadcast({ type: 'suiteProgress', current: completedCount, total: suite.tests.length, testName: t.name, runningCount });
+    };
+
+    // Pool execution: keep up to N workers busy at all times
+    let nextIdx = 0;
+    const workers = [];
+    for (let w = 1; w <= parallel; w++) {
+      workers.push((async () => {
+        while (nextIdx < testTasks.length) {
+          const task = testTasks[nextIdx++];
+          await runOne(task, w);
+          // Wait between tests on this worker (sequential or parallel)
+          if (nextIdx < testTasks.length) {
+            const wait = suite.waitBetweenTests || (isParallel ? 500 : 2000);
+            await new Promise(r => setTimeout(r, wait));
+          }
+        }
+      })());
+    }
+    await Promise.all(workers);
+
+    const passed = run.testResults.filter(r => r.status === 'passed').length;
+    const failed = run.testResults.filter(r => r.status !== 'passed' && r.status !== 'skipped').length;
+    run.status = failed === 0 ? 'passed' : 'failed';
+
+    // Persist the suite run record
+    const record = {
+      id: runId,
+      suiteName: suite.name,
+      suiteFilename: filename,
+      startedAt,
+      finishedAt: new Date().toISOString(),
+      status: run.status,
+      passed,
+      failed,
+      total: run.testResults.length,
+      results: run.testResults,
+    };
+    try {
+      await fs.writeJson(path.join(suiteRunsDir, runId + '.json'), record, { spaces: 2 });
+    } catch (err) {
+      console.error('Failed to write suite run record:', err);
+    }
+
+    broadcast({ type: 'stdout', text: '\n━━━ Suite Complete ━━━' });
+    broadcast({ type: 'stdout', text: `${passed} passed, ${failed} failed of ${run.testResults.length}` });
+    broadcast({ type: 'done', status: run.status, results: run.testResults, suiteRunId: runId });
+
+    setTimeout(() => activeRuns.delete(runId), 60000);
+  })();
+
+  return { runId };
+}
+
+async function resolveCredsToFile(credRef) {
+  if (!credRef) return null;
+  // Already a file path? use as-is
+  if (credRef.includes('/') || credRef.endsWith('.yaml') || credRef.endsWith('.yml')) {
+    if (await fs.pathExists(credRef)) return credRef;
+  }
+  // Look up by name in vault, write to temp file
+  const data = await loadCredentialsFile();
+  if (!data[credRef]) return null;
+  const tmpPath = path.join(os.tmpdir(), `skopix-creds-${Date.now()}-${Math.random().toString(36).slice(2,6)}.yaml`);
+  // CLI expects format:
+  //   credentials:
+  //     - label: "Main account"
+  //       fields:
+  //         username: ...
+  //         password: ...
+  const fileFormat = {
+    credentials: [
+      { label: credRef, fields: data[credRef] }
+    ]
+  };
+  await fs.writeFile(tmpPath, yaml.stringify(fileFormat));
+  // Cleanup after 60s
+  setTimeout(() => fs.remove(tmpPath).catch(() => {}), 60000);
+  return tmpPath;
+}
+
+function runSingleTestSync(config, broadcast, userEnv, reportsDir, runBy) {
+  return new Promise(async (resolve) => {
+    const args = ['run', '--url', config.url, '--goal', config.goal];
+    const credsFile = await resolveCredsToFile(config.credentials);
+    if (credsFile) args.push('--credentials', credsFile);
+    if (config.maxSteps) args.push('--max-steps', String(config.maxSteps));
+    if (config.provider) args.push('--provider', config.provider);
+    if (config.model) args.push('--model', config.model);
+    if (config.github) args.push('--github');
+    if (config.jira) args.push('--jira');
+    if (config.linear) args.push('--linear');
+    if (config.headless) args.push('--headless');
+    if (config.testName) args.push('--test-name', config.testName);
+    if (config.suiteName) args.push('--suite-name', config.suiteName);
+
+    const cliPath = path.resolve(__dirname, '..', 'index.js');
+    const childEnv = { ...process.env, ...(userEnv || {}) };
+    const child = spawn('node', [cliPath, ...args], { cwd: process.cwd(), env: childEnv });
+    let sessionId = null;
+
+    child.stdout.on('data', (chunk) => {
+      const text = chunk.toString();
+      text.split('\n').forEach(line => { if (line.length > 0) broadcast({ type: 'stdout', text: line }); });
+      const m = text.match(/Session:\s+([a-f0-9]{8})/);
+      if (m && !sessionId) {
+        sessionId = m[1];
+        // Persist run attribution (for suite tests, mirrors what startRun does for single tests)
+        if (runBy && reportsDir) {
+          const sessionDir = path.join(reportsDir, sessionId);
+          fs.ensureDir(sessionDir).then(() => {
+            return fs.writeJson(path.join(sessionDir, 'runBy.json'), runBy, { spaces: 2 });
+          }).catch(() => {});
+        }
+      }
+    });
+    child.stderr.on('data', (chunk) => {
+      chunk.toString().split('\n').forEach(line => { if (line.length > 0) broadcast({ type: 'stderr', text: line }); });
+    });
+    child.on('close', (code) => resolve({ status: code === 0 ? 'passed' : 'failed', sessionId }));
+    child.on('error', (err) => {
+      broadcast({ type: 'stderr', text: 'Error: ' + err.message });
+      resolve({ status: 'error', sessionId });
+    });
+  });
+}
+
+// ─── SELECTOR SANITISER ──────────────────────────────────────────────────────
+// Fixes dynamic selectors at replay time — e.g. Panintelligence appends runtime
+// IDs to pi-test-identifier values: "ChartColumn.sort.desc.885249556"
+// We strip the trailing number and use *= (contains) instead of = (exact).
+function sanitiseSelector(sel) {
+  if (!sel) return sel;
+  // Match [attr="value.12345678"] where value ends in a dot + 5+ digits
+  return sel.replace(/\[([a-zA-Z_-]+)="([^"]+\.\d{5,})"\]/g, (match, attr, val) => {
+    // Strip the trailing .NUMBER from the value
+    const stable = val.replace(/\.\d{5,}$/, '');
+    return '[' + attr + '*="' + stable + '"]';
+  });
+}
+
+// ─── REPLAY ENGINE ───────────────────────────────────────────────────────────
+// Executes recorded steps deterministically. setupTest runs first in the same
+// browser session, then the main test steps continue.
+// Called when user clicks Stop in the debug recording browser
+async function stopDebugRecording(recording, ctx, browser, broadcastRec) {
+  recording.status = 'stopped';
+  try { await ctx.close(); } catch {}
+  try { await browser.close(); } catch {}
+  broadcastRec({ type: 'done', steps: recording.steps });
+  broadcastRec({ type: 'stopped' });
+}
+
+function startReplay(test, setupTest, activeRuns, reportsDir, currentUser, env) {
+  const runId = Math.random().toString(36).slice(2, 10);
+  const run = { id: runId, type: 'replay', status: 'running', output: [], listeners: [], sessionId: runId };
+  activeRuns.set(runId, run);
+  const broadcast = (line) => { run.output.push(line); run.listeners.forEach(l => l(line)); };
+  const runBy = currentUser ? { id: currentUser.id, name: currentUser.name, email: currentUser.email, role: currentUser.role } : null;
+
+  (async () => {
+    const sessionDir = path.join(reportsDir, runId);
+    await fs.ensureDir(sessionDir);
+    if (runBy) await fs.writeJson(path.join(sessionDir, 'runBy.json'), runBy, { spaces: 2 }).catch(() => {});
+
+    const startedAt = Date.now();
+    broadcast({ type: 'stdout', text: '' });
+    broadcast({ type: 'stdout', text: '  AI-powered QA agent. Tests your app like a human would.' });
+    broadcast({ type: 'stdout', text: '' });
+    broadcast({ type: 'stdout', text: '\u2501'.repeat(60) });
+    broadcast({ type: 'sessionId', sessionId: runId });
+    broadcast({ type: 'stdout', text: '  Session: ' + runId });
+    broadcast({ type: 'stdout', text: '  Target:  ' + (test.url || '') });
+    broadcast({ type: 'stdout', text: '  Test:    ' + test.name });
+    if (setupTest) broadcast({ type: 'stdout', text: '  Setup:   ' + setupTest.name + ' (' + (setupTest.steps||[]).length + ' steps)' });
+    const totalSteps = (setupTest ? (setupTest.steps||[]).length : 0) + test.steps.length;
+    broadcast({ type: 'stdout', text: '  Mode:    Recorded replay (' + totalSteps + ' steps)' });
+    broadcast({ type: 'stdout', text: '\u2501'.repeat(60) });
+
+    let passed = true;
+    let stepNum = 0;
+    let failReason = '';
+    let chromiumBrowser = null;
+
+    // Helper that executes a list of steps on a page
+    async function executeSteps(steps, page, label) {
+      for (const step of steps) {
+        stepNum++;
+        const sel = sanitiseSelector(step.stableSelector || step.selector);
+        const desc = step.description || (step.action + ' ' + (sel || ''));
+        broadcast({ type: 'stdout', text: '' });
+        broadcast({ type: 'stdout', text: '  [' + stepNum + '/' + totalSteps + '] ' + step.action.toUpperCase() + ' \u2014 ' + (label ? '[' + label + '] ' : '') + desc });
+
+        try {
+          if (step.action === 'assert') {
+            const assertSel = sanitiseSelector(step.stableSelector || step.selector);
+            switch (step.assertType) {
+              case 'visible':
+                await page.locator(assertSel).first().waitFor({ state: 'visible', timeout: 10000 });
+                broadcast({ type: 'stdout', text: '    \u2713 Visible: ' + assertSel });
+                break;
+              case 'text_contains': {
+                const txt = await page.locator(assertSel).first().textContent({ timeout: 10000 });
+                if (!txt || !txt.includes(step.value || '')) throw new Error('Expected to contain "' + step.value + '" but got "' + (txt||'').slice(0,50) + '"');
+                broadcast({ type: 'stdout', text: '    \u2713 Text contains "' + step.value + '"' });
+                break;
+              }
+              case 'text_equals': {
+                const txt = await page.locator(assertSel).first().textContent({ timeout: 10000 });
+                if ((txt||'').trim() !== (step.value||'').trim()) throw new Error('Expected "' + step.value + '" but got "' + (txt||'').slice(0,50) + '"');
+                broadcast({ type: 'stdout', text: '    \u2713 Text equals "' + step.value + '"' });
+                break;
+              }
+              case 'url_contains':
+                if (!page.url().includes(step.value||'')) throw new Error('URL "' + page.url() + '" does not contain "' + step.value + '"');
+                broadcast({ type: 'stdout', text: '    \u2713 URL contains "' + step.value + '"' });
+                break;
+
+              case 'attribute_contains': {
+                const attrName = step.attribute || 'title';
+                const attrVal = await page.locator(assertSel).first().getAttribute(attrName, { timeout: 10000 });
+                if (!attrVal || !attrVal.includes(step.value || '')) throw new Error('Attribute ' + attrName + ' "' + (attrVal||'').slice(0,80) + '" does not contain "' + step.value + '"');
+                broadcast({ type: 'stdout', text: '    \u2713 ' + attrName + ' contains "' + step.value + '"' });
+                break;
+              }
+              case 'element_count': {
+                const count = await page.locator(assertSel).count();
+                if (count !== parseInt(step.value||'0',10)) throw new Error('Expected ' + step.value + ' elements but found ' + count);
+                broadcast({ type: 'stdout', text: '    \u2713 Count = ' + count });
+                break;
+              }
+              default:
+                broadcast({ type: 'stdout', text: '    \u26a0 Unknown assertion: ' + step.assertType + ' (skipped)' });
+            }
+
+          } else if (step.action === 'navigate') {
+            let navUrl = step.url || step.value;
+            if (test.url && navUrl && navUrl.startsWith('http')) {
+              try {
+                const recOrigin = new URL(navUrl).origin;
+                const tgtOrigin = new URL(test.url).origin;
+                if (recOrigin !== tgtOrigin) { navUrl = navUrl.replace(recOrigin, tgtOrigin); broadcast({ type: 'stdout', text: '    (rebased URL)' }); }
+              } catch {}
+            }
+            if (page.url() === navUrl) { broadcast({ type: 'stdout', text: '    \u2713 Already at URL (skipped)' }); }
+            else {
+              try { await page.goto(navUrl, { waitUntil: 'domcontentloaded', timeout: 15000 }); await page.waitForTimeout(800); broadcast({ type: 'stdout', text: '    \u2713 Navigated' }); }
+              catch { if (page.url().includes((navUrl.split('#')[1]||navUrl).slice(0,20))) { broadcast({ type: 'stdout', text: '    \u2713 Navigated (hash route)' }); } else throw new Error('Navigation failed to ' + navUrl); }
+            }
+
+          } else if (step.action === 'click') {
+            await page.waitForTimeout(300);
+            let clicked = false;
+            const selectors = [];
+            if (step.stableSelector && step.stableSelector !== step.selector) selectors.push(step.stableSelector);
+            if (step.selector) selectors.push(step.selector);
+            if (!clicked && (step.elementX || step.clickX)) {
+              const targetX = step.elementX || step.clickX, targetY = step.elementY || step.clickY;
+              for (const s of selectors) {
+                if (clicked) break;
+                try {
+                  const count = await page.locator(s).count();
+                  if (count > 1) {
+                    let bestIdx = 0, bestDist = Infinity;
+                    for (let i = 0; i < count; i++) { try { const box = await page.locator(s).nth(i).boundingBox({ timeout: 2000 }); if (!box) continue; const d = Math.sqrt(Math.pow(box.x+box.width/2-targetX,2)+Math.pow(box.y+box.height/2-targetY,2)); if (d < bestDist) { bestDist = d; bestIdx = i; } } catch {} }
+                    await page.locator(s).nth(bestIdx).click({ timeout: 5000 });
+                    if (count > 1) broadcast({ type: 'stdout', text: '    (matched element ' + (bestIdx+1) + ' of ' + count + ' by position)' });
+                    clicked = true;
+                  } else if (count === 1) { await page.locator(s).first().waitFor({ state: 'visible', timeout: 3000 }); await page.locator(s).first().click({ timeout: 5000 }); clicked = true; }
+                } catch {}
+              }
+            }
+            if (!clicked) { for (const s of selectors) { if (clicked) break; try { await page.locator(s).first().waitFor({ state: 'visible', timeout: 3000 }); await page.locator(s).first().click({ timeout: 5000 }); clicked = true; } catch {} } }
+            if (!clicked) { for (const s of selectors) { if (clicked) break; try { await page.locator(s).first().click({ force: true, timeout: 5000 }); clicked = true; } catch {} } }
+            if (!clicked && step.element) { const tag = (step.element.tag||'').toLowerCase(); if (['i','svg','path','span','img'].includes(tag)) { for (const s of selectors) { if (clicked) break; try { await page.locator(s).first().locator('xpath=ancestor-or-self::*[self::a or self::button or @role="button"][1]').first().click({ timeout: 5000 }); clicked = true; } catch {} } } }
+            if (!clicked && step.element && step.element.text && step.element.text.length > 1) { try { await page.locator('*:has-text("' + step.element.text.replace(/"/g, '\\"') + '")').first().click({ timeout: 5000 }); clicked = true; } catch {} }
+            if (!clicked) throw new Error('Could not click element. Tried: ' + selectors.join(', '));
+            const descLower = (step.description||'').toLowerCase(), selLower = selectors.join(' ').toLowerCase();
+            const isSave = descLower.includes('save')||descLower.includes('submit')||selLower.includes('fa-save')||selLower.includes('fa-floppy');
+            await page.waitForTimeout(isSave ? 2000 : 500);
+            broadcast({ type: 'stdout', text: '    \u2713 Clicked' + (isSave?' (waited for save)':'') });
+
+          } else if (step.action === 'check') {
+            const checkSel = sanitiseSelector(step.stableSelector || step.selector);
+            // Use click() rather than check() — fires the real click event Angular needs.
+            // Verify current state first to avoid double-toggling.
+            let alreadyCorrect = false;
+            try {
+              const isCurrentlyChecked = await page.locator(checkSel).first().isChecked({ timeout: 2000 });
+              if (isCurrentlyChecked === step.checked) alreadyCorrect = true;
+            } catch {}
+            if (!alreadyCorrect) {
+              await page.locator(checkSel).first().click({ timeout: 10000 });
+              await page.waitForTimeout(400);
+            }
+            broadcast({ type: 'stdout', text: '    \u2713 ' + (step.checked ? 'Checked' : 'Unchecked') });
+
+          } else if (step.action === 'type') {
+            const typeLocator = page.locator(sel).first();
+            await typeLocator.click({ timeout: 10000 });
+            await typeLocator.fill('');
+            await typeLocator.pressSequentially(step.value || '', { delay: 50 });
+            await typeLocator.evaluate(el => { el.dispatchEvent(new Event('blur',{bubbles:true})); el.dispatchEvent(new Event('change',{bubbles:true})); el.dispatchEvent(new Event('focusout',{bubbles:true})); });
+            await page.waitForTimeout(400);
+            broadcast({ type: 'stdout', text: '    \u2713 Typed' + (step.isPassword?' [password hidden]':' "' + (step.value||'').slice(0,30) + '"') });
+
+          } else if (step.action === 'select') {
+            await page.locator(sel).first().selectOption(step.value || '', { timeout: 10000 });
+            broadcast({ type: 'stdout', text: '    \u2713 Selected "' + (step.label||step.value||'') + '"' });
+
+          } else if (step.action === 'scroll') {
+            if (step.isWindow || step.selector === 'window') { await page.evaluate(({x,y}) => window.scrollTo({left:x,top:y,behavior:'smooth'}), {x:step.scrollX||0,y:step.scrollY||0}); }
+            else { await page.evaluate(({sel,x,y}) => { const el = document.querySelector(sel); if(el) el.scrollTo({left:x,top:y,behavior:'smooth'}); }, {sel,x:step.scrollX||0,y:step.scrollY||0}); }
+            await page.waitForTimeout(600);
+            broadcast({ type: 'stdout', text: '    \u2713 Scrolled to (' + (step.scrollX||0) + ', ' + (step.scrollY||0) + ')' });
+
+          } else {
+            broadcast({ type: 'stdout', text: '    \u26a0 Unknown action: ' + step.action + ' (skipped)' });
+          }
+
+          if (wantReport) {
+            const screenshotPath = path.join(sessionDir, 'step-' + String(stepNum).padStart(3, '0') + '.png');
+            await page.screenshot({ path: screenshotPath }).catch(() => {});
+          }
+
+        } catch (stepErr) {
+          broadcast({ type: 'stdout', text: '    \u2716 FAILED: ' + stepErr.message });
+          failReason = stepErr.message;
+          passed = false;
+          return false; // signal caller to stop
+        }
+      }
+      return true; // all steps passed
+    }
+
+    try {
+      const { chromium } = await import('playwright');
+      const fsSync = await import('fs');
+      const inDocker = fsSync.existsSync('/.dockerenv');
+
+      chromiumBrowser = await chromium.launch({
+        headless: inDocker || test.headless || false,
+        args: ['--no-sandbox', '--disable-blink-features=AutomationControlled', '--allow-insecure-localhost'],
+      });
+
+      const wantReport = test.generateReport !== false;
+
+      const ctx = await chromiumBrowser.newContext({
+        viewport: { width: 1280, height: 800 },
+        ...(wantReport ? { recordVideo: { dir: sessionDir, size: { width: 1280, height: 800 } } } : {}),
+      });
+      const page = await ctx.newPage();
+
+      // Navigate to start URL
+      if (test.url) {
+        broadcast({ type: 'stdout', text: '- Navigating to ' + test.url + '...' });
+        await page.goto(test.url, { waitUntil: 'domcontentloaded', timeout: 30000 });
+        broadcast({ type: 'stdout', text: '\u2714 Loaded: ' + test.url });
+      }
+
+      const assertionCount = [...(setupTest ? setupTest.steps : []), ...test.steps].filter(s => s.action === 'assert').length;
+      broadcast({ type: 'stdout', text: '\u25c6 Replaying ' + totalSteps + ' steps' + (assertionCount ? ' (' + assertionCount + ' assertions)' : '') });
+
+      // Run setup steps first
+      if (setupTest && setupTest.steps && setupTest.steps.length) {
+        broadcast({ type: 'stdout', text: '' });
+        broadcast({ type: 'stdout', text: '  ─── SETUP: ' + setupTest.name + ' ───' });
+        const ok = await executeSteps(setupTest.steps, page, 'setup');
+        if (!ok) { await ctx.close(); throw new Error('Setup failed: ' + failReason); }
+        broadcast({ type: 'stdout', text: '' });
+        broadcast({ type: 'stdout', text: '  \u2714 Setup complete — continuing with test steps' });
+      }
+
+      // Run main test steps
+      if (setupTest) { broadcast({ type: 'stdout', text: '' }); broadcast({ type: 'stdout', text: '  ─── TEST: ' + test.name + ' ───' }); }
+      await executeSteps(test.steps, page, null);
+
+      // Get video path after close
+      try {
+        const videoPath = await page.video().path();
+        if (videoPath) {
+          const videoName = 'replay' + path.extname(videoPath);
+          await fs.move(videoPath, path.join(sessionDir, videoName), { overwrite: true }).catch(() => {});
+          run.videoName = videoName;
+        }
+      } catch {}
+
+      await ctx.close();
+    } catch (err) {
+      if (!failReason) { broadcast({ type: 'stdout', text: '\u2716 Replay error: ' + err.message }); failReason = err.message; passed = false; }
+    } finally {
+      if (chromiumBrowser) try { await chromiumBrowser.close(); } catch {}
+    }
+
+    broadcast({ type: 'stdout', text: '' });
+    broadcast({ type: 'stdout', text: '\u2501'.repeat(60) });
+    broadcast({ type: 'stdout', text: '  Status: ' + (passed ? 'PASSED \u2713' : 'FAILED \u2717') });
+    if (!passed && failReason) broadcast({ type: 'stdout', text: '  Reason: ' + failReason });
+    broadcast({ type: 'stdout', text: '  Steps:  ' + stepNum + ' / ' + totalSteps });
+    broadcast({ type: 'stdout', text: '\u2501'.repeat(60) });
+
+    // Write report.json
+    const allSteps = [...(setupTest ? (setupTest.steps||[]) : []), ...(test.steps||[])];
+    await fs.writeJson(path.join(sessionDir, 'report.json'), { sessionId: runId, goalAchieved: passed, stuck: false, url: test.url||'', goal: test.name + ' (recorded replay)', steps: allSteps.slice(0, stepNum), issues: [], duration: Date.now()-startedAt, model: 'recorded', provider: 'replay', type: 'replay', generateReport: wantReport, videoPath: run.videoName ? path.join(sessionDir, run.videoName) : null }, { spaces: 2 }).catch(() => {});
+
+    // Write report.html
+    const assertionSteps = allSteps.filter(s => s.action === 'assert');
+    const duration = ((Date.now() - startedAt) / 1000).toFixed(1);
+    const stepRows = allSteps.slice(0, stepNum).map((s, i) => {
+      const desc = (s.description || (s.action + ' ' + (s.stableSelector || s.selector || ''))).replace(/</g,'&lt;').replace(/>/g,'&gt;');
+      const screenshotFile = 'step-' + String(i+1).padStart(3,'0') + '.png';
+      const isAssert = s.action === 'assert';
+      const isFailed = !passed && i === stepNum - 1;
+      const isSetup = setupTest && i < (setupTest.steps||[]).length;
+      if (isAssert) {
+        const ad = (s.description || ((s.assertType||'assert') + (s.selector?' on '+s.selector.slice(0,40):'') + (s.value?' = "'+s.value+'"':''))).replace(/</g,'&lt;').replace(/>/g,'&gt;');
+        return '<div class="step assert-step"><div class="step-num">'+String(i+1).padStart(2,'0')+'</div><div class="step-body"><div class="step-action assert-action">✓ '+(s.assertType||'assert')+'</div><div class="step-desc">'+ad+'</div></div></div>';
+      }
+      const actionColors = {click:'#22d3ee',type:'#a78bfa',navigate:'#fb923c',scroll:'#6b7280',check:'#34d399',select:'#f472b6'};
+      const actionIcons = {click:'↗',type:'⌨',navigate:'→',scroll:'↕',check:'☑',select:'▼'};
+      const color = actionColors[s.action]||'#9ca3af';
+      const icon = actionIcons[s.action]||'·';
+      const setupBadge = isSetup ? '<span style="font-size:9px;color:#f59e0b;background:rgba(245,158,11,0.1);border:1px solid rgba(245,158,11,0.2);border-radius:3px;padding:1px 5px;margin-left:6px">SETUP</span>' : '';
+      return '<div class="step'+(isFailed?' step-failed':'')+'" onclick="toggleScreenshot(this)">'
+        + '<div class="step-num">'+String(i+1).padStart(2,'0')+'</div>'
+        + '<div class="step-thumb"><img src="'+screenshotFile+'" onerror="this.closest(\'.step-thumb\').style.display=\'none\'" loading="lazy"></div>'
+        + '<div class="step-body"><div class="step-action" style="color:'+color+'">'+icon+' '+s.action+setupBadge+'</div><div class="step-desc">'+desc+'</div></div>'
+        + (isFailed?'<div class="step-fail-badge">✗ FAILED</div>':'')
+        + '<div class="step-screenshot" style="display:none"><img src="'+screenshotFile+'" onerror="this.style.display=\'none\'"></div>'
+        + '</div>';
+    }).join('');
+    const videoSection = run.videoName ? '<div class="video-panel"><div class="panel-label">SESSION VIDEO</div><video controls src="'+run.videoName+'"></video><div class="video-hint">Click any step to view screenshot</div></div>' : '<div class="video-panel no-video"><div class="panel-label">NO VIDEO</div></div>';
+    const reportHtml = `<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Skopix — ${test.name}</title><style>*,*::before,*::after{box-sizing:border-box;margin:0;padding:0}:root{--bg:#0a0c12;--surface:#111318;--surface2:#1a1d28;--border:#1e2235;--text:#e2e8f0;--muted:#64748b;--cyan:#22d3ee;--green:#22c55e;--red:#ef4444;--mono:'Fira Code','Consolas',monospace}body{background:var(--bg);color:var(--text);font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;min-height:100vh}.header{background:var(--surface);border-bottom:1px solid var(--border);padding:16px 24px;display:flex;align-items:center;gap:16px;flex-wrap:wrap;position:sticky;top:0;z-index:100}.header-logo{font-family:var(--mono);font-size:12px;font-weight:700;color:var(--cyan);letter-spacing:0.1em}.header-title{font-size:15px;font-weight:700;color:var(--text);flex:1;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}.status-badge{display:inline-flex;align-items:center;gap:6px;padding:4px 12px;border-radius:20px;font-size:11px;font-weight:700;font-family:var(--mono);white-space:nowrap}.passed{background:rgba(34,197,94,0.12);color:var(--green);border:1px solid rgba(34,197,94,0.25)}.failed{background:rgba(239,68,68,0.12);color:var(--red);border:1px solid rgba(239,68,68,0.25)}.stats-row{display:flex;background:var(--surface);border-bottom:1px solid var(--border)}.stat{flex:1;padding:12px 16px;text-align:center;border-right:1px solid var(--border)}.stat:last-child{border-right:none}.stat-value{font-family:var(--mono);font-size:20px;font-weight:700;color:var(--cyan)}.stat-label{font-size:9px;color:var(--muted);letter-spacing:0.1em;margin-top:2px;text-transform:uppercase}.layout{display:grid;grid-template-columns:380px 1fr;min-height:calc(100vh - 100px)}@media(max-width:860px){.layout{grid-template-columns:1fr}}.video-panel{background:#000;border-right:1px solid var(--border);position:sticky;top:100px;height:calc(100vh - 100px);display:flex;flex-direction:column}.panel-label{padding:8px 14px;font-family:var(--mono);font-size:10px;letter-spacing:0.12em;color:var(--muted);background:var(--surface2);border-bottom:1px solid var(--border);flex-shrink:0}.video-panel video{width:100%;flex:1;min-height:0;background:#000;display:block}.video-hint{padding:7px 14px;font-size:11px;color:var(--muted);text-align:center;background:var(--surface2);border-top:1px solid var(--border);flex-shrink:0}.no-video{justify-content:center;align-items:center;color:var(--muted);font-size:13px}.steps-panel{overflow-y:auto}.steps-header{padding:10px 16px;font-family:var(--mono);font-size:10px;letter-spacing:0.1em;color:var(--muted);background:var(--surface2);border-bottom:1px solid var(--border);position:sticky;top:0;z-index:10}.step{display:grid;grid-template-columns:28px 52px 1fr auto;align-items:center;gap:10px;padding:9px 14px;border-bottom:1px solid var(--border);cursor:pointer;transition:background 0.1s}.step:hover{background:var(--surface2)}.step-failed{border-left:3px solid var(--red);background:rgba(239,68,68,0.04)}.step-failed:hover{background:rgba(239,68,68,0.08)}.assert-step{display:grid;grid-template-columns:28px 1fr;align-items:center;gap:10px;padding:9px 14px 9px 17px;border-bottom:1px solid var(--border);border-left:3px solid rgba(34,197,94,0.35);background:rgba(34,197,94,0.03)}.step-num{font-family:var(--mono);font-size:10px;color:var(--muted);text-align:right}.step-thumb{width:52px;height:34px;border-radius:3px;overflow:hidden;background:var(--surface2);flex-shrink:0}.step-thumb img{width:100%;height:100%;object-fit:cover;object-position:top;display:block}.step-body{min-width:0}.step-action{font-family:var(--mono);font-size:10px;font-weight:600;letter-spacing:0.05em}.assert-action{color:#4ade80;font-family:var(--mono);font-size:10px;font-weight:600}.step-desc{font-size:12px;color:var(--text);margin-top:2px;white-space:nowrap;overflow:hidden;text-overflow:ellipsis;max-width:100%}.step-fail-badge{font-family:var(--mono);font-size:10px;font-weight:700;color:var(--red);white-space:nowrap}.step-screenshot{grid-column:1/-1;padding:8px 0 4px}.step-screenshot img{width:100%;border-radius:5px;border:1px solid var(--border);display:block}</style></head><body>
+<div class="header"><div class="header-logo">SKOPIX</div><div class="header-title">${test.name}${setupTest?' <span style="font-size:11px;color:#f59e0b;font-weight:400">via '+setupTest.name+'</span>':''}</div><div class="status-badge ${passed?'passed':'failed'}">${passed?'✓ PASSED':'✗ FAILED'}</div></div>
+<div class="stats-row"><div class="stat"><div class="stat-value">${stepNum}</div><div class="stat-label">Steps</div></div><div class="stat"><div class="stat-value">${assertionSteps.length}</div><div class="stat-label">Assertions</div></div><div class="stat"><div class="stat-value">${duration}s</div><div class="stat-label">Duration</div></div><div class="stat"><div class="stat-value" style="font-size:11px;padding-top:6px">${test.url||''}</div><div class="stat-label">URL</div></div></div>
+<div class="layout">${videoSection}<div class="steps-panel"><div class="steps-header">STEPS (${stepNum} / ${totalSteps})${setupTest?' — amber = setup steps':''} — click to expand screenshot</div>${stepRows}</div></div>
+<script>function toggleScreenshot(row){const ss=row.querySelector('.step-screenshot');if(!ss)return;const isOpen=ss.style.display!=='none';document.querySelectorAll('.step-screenshot').forEach(el=>el.style.display='none');document.querySelectorAll('.step').forEach(el=>el.style.background='');if(!isOpen){ss.style.display='block';row.style.background='var(--surface2)';ss.scrollIntoView({behavior:'smooth',block:'nearest'});}}</script>
+</body></html>`;
+    await fs.writeFile(path.join(sessionDir, 'report.html'), reportHtml).catch(() => {});
+
+    run.status = passed ? 'passed' : 'failed';
+    broadcast({ type: 'done', exitCode: passed ? 0 : 1, status: run.status });
+    setTimeout(() => activeRuns.delete(runId), 60000);
+  })();
+
+  return runId;
+}
+
+function startRun(config, activeRuns, reportsDir, currentUser, userEnv) {
+  const runId = Math.random().toString(36).slice(2, 10);
+  const run = { id: runId, type: 'single', status: 'running', output: [], listeners: [], sessionId: null };
+  activeRuns.set(runId, run);
+
+  // Build the env for the child process. User-specific secrets (if any) override
+  // workspace defaults from .skopix.env which the child loads via dotenv.
+  // process.env wins over .skopix.env (dotenv doesn't overwrite existing vars),
+  // and userEnv wins over process.env (last spread wins).
+  const childEnv = { ...process.env, ...(userEnv || {}) };
+
+  const broadcast = (line) => { run.output.push(line); run.listeners.forEach(l => l(line)); };
+
+  // Run attribution - records who triggered this run.
+  // Written as a small companion file alongside the session.
+  const runBy = currentUser ? {
+    id: currentUser.id,
+    name: currentUser.name,
+    email: currentUser.email,
+    role: currentUser.role,
+  } : null;
+
+  // Async credential resolve - kick off the spawn after we have the creds file
+  (async () => {
+    const args = ['run', '--url', config.url, '--goal', config.goal];
+    const credsFile = await resolveCredsToFile(config.credentials);
+    if (credsFile) args.push('--credentials', credsFile);
+  if (config.maxSteps) args.push('--max-steps', String(config.maxSteps));
+  if (config.provider) args.push('--provider', config.provider);
+  if (config.model) args.push('--model', config.model);
+  if (config.headless) args.push('--headless');
+  if (config.github) args.push('--github');
+  if (config.jira) args.push('--jira');
+  if (config.linear) args.push('--linear');
+  if (config.testName) args.push('--test-name', config.testName);
+  if (config.suiteName) args.push('--suite-name', config.suiteName);
+
+    const cliPath = path.resolve(__dirname, '..', 'index.js');
+    const child = spawn('node', [cliPath, ...args], { cwd: process.cwd(), env: childEnv });
+
+    child.stdout.on('data', (chunk) => {
+      const text = chunk.toString();
+      text.split('\n').forEach(line => { if (line.length > 0) broadcast({ type: 'stdout', text: line }); });
+      const m = text.match(/Session:\s+([a-f0-9]{8})/);
+      if (m && !run.sessionId) {
+        run.sessionId = m[1];
+        broadcast({ type: 'sessionId', sessionId: m[1] });
+        // Persist run attribution
+        if (runBy && reportsDir) {
+          const sessionDir = path.join(reportsDir, run.sessionId);
+          fs.ensureDir(sessionDir).then(() => {
+            return fs.writeJson(path.join(sessionDir, 'runBy.json'), runBy, { spaces: 2 });
+          }).catch(() => {});
+        }
+      }
+    });
+    child.stderr.on('data', (chunk) => {
+      chunk.toString().split('\n').forEach(line => { if (line.length > 0) broadcast({ type: 'stderr', text: line }); });
+    });
+    child.on('close', (code) => {
+      run.status = code === 0 ? 'passed' : 'failed';
+      broadcast({ type: 'done', exitCode: code, status: run.status });
+      setTimeout(() => activeRuns.delete(runId), 60000);
+    });
+    child.on('error', (err) => { broadcast({ type: 'error', error: err.message }); run.status = 'error'; });
+  })();
+
+  return runId;
+}
+
+function streamRun(req, res, runId, activeRuns) {
+  const run = activeRuns.get(runId);
+  if (!run) { sendJSON(res, 404, { error: 'Run not found' }); return; }
+  res.writeHead(200, {
+    'Content-Type': 'text/event-stream',
+    'Cache-Control': 'no-cache',
+    'Connection': 'keep-alive',
+    'Access-Control-Allow-Origin': '*',
+  });
+  run.output.forEach(line => res.write(`data: ${JSON.stringify(line)}\n\n`));
+  if (run.status !== 'running') {
+    res.write(`data: ${JSON.stringify({ type: 'done', status: run.status })}\n\n`);
+    res.end();
+    return;
+  }
+  const listener = (line) => {
+    if (res.writableEnded) return;
+    try { res.write(`data: ${JSON.stringify(line)}\n\n`); } catch {}
+    if (line.type === 'done') { try { res.end(); } catch {} }
+  };
+  run.listeners.push(listener);
+  req.on('close', () => { run.listeners = run.listeners.filter(l => l !== listener); });
+}
+
+function formatDuration(ms) {
+  if (!ms || ms < 1000) return `${ms || 0}ms`;
+  if (ms < 60000) return `${(ms / 1000).toFixed(1)}s`;
+  const m = Math.floor(ms / 60000);
+  const s = Math.round((ms % 60000) / 1000);
+  return `${m}m ${s}s`;
+}
+function relativeTime(date) {
+  const now = Date.now();
+  const then = new Date(date).getTime();
+  const diff = (now - then) / 1000;
+  if (diff < 60) return 'just now';
+  if (diff < 3600) return `${Math.floor(diff / 60)} mins ago`;
+  if (diff < 86400) return `${Math.floor(diff / 3600)}h ago`;
+  if (diff < 604800) return `${Math.floor(diff / 86400)}d ago`;
+  return new Date(date).toLocaleDateString();
+}
+
+
+// ─── CREDENTIALS ──────────────────────────────────────────────────────────────
+const CREDENTIALS_PATH = path.join(os.homedir(), '.skopix', 'credentials.yaml');
+
+async function loadCredentialsFile() {
+  try {
+    if (!await fs.pathExists(CREDENTIALS_PATH)) return {};
+    const content = await fs.readFile(CREDENTIALS_PATH, 'utf-8');
+    return yaml.parse(content) || {};
+  } catch (err) {
+    console.error('Failed to read credentials file:', err);
+    return {};
+  }
+}
+
+async function writeCredentialsFile(data) {
+  await fs.ensureDir(path.dirname(CREDENTIALS_PATH));
+  await fs.writeFile(CREDENTIALS_PATH, yaml.stringify(data));
+  // Set restrictive permissions on Unix
+  try { await fs.chmod(CREDENTIALS_PATH, 0o600); } catch {}
+}
+
+async function listCredentials() {
+  const data = await loadCredentialsFile();
+  // Return masked - just names + key list, never values
+  return Object.entries(data).map(([name, values]) => ({
+    name,
+    keys: Object.keys(values || {}),
+    keyCount: Object.keys(values || {}).length,
+  }));
+}
+
+async function getCredentialSet(name) {
+  const data = await loadCredentialsFile();
+  if (!data[name]) return null;
+  // Mask values: return key + length-aware mask
+  const masked = {};
+  for (const [k, v] of Object.entries(data[name])) {
+    masked[k] = String(v).slice(0, 2) + '••••••••';
+  }
+  return masked;
+}
+
+async function saveCredentialSet(name, values, oldName) {
+  if (!name || !name.trim()) throw new Error('Credential set name is required');
+  if (!values || typeof values !== 'object') throw new Error('Values must be an object');
+  const cleanName = name.trim();
+  // Reject names with whitespace or weird chars - keep keys clean
+  if (!/^[a-z0-9_-]+$/i.test(cleanName)) throw new Error('Name can only contain letters, numbers, dashes and underscores');
+
+  const data = await loadCredentialsFile();
+  if (oldName && oldName !== cleanName) {
+    // Renaming - remove old entry
+    delete data[oldName];
+  }
+  // Filter out empty keys/values - merge with existing if values are placeholder masks
+  const existing = data[cleanName] || {};
+  const cleaned = {};
+  for (const [k, v] of Object.entries(values)) {
+    if (!k || !k.trim()) continue;
+    const trimKey = k.trim();
+    // If value looks like a mask (contains ••), keep the existing value
+    if (typeof v === 'string' && v.includes('•') && existing[trimKey]) {
+      cleaned[trimKey] = existing[trimKey];
+    } else {
+      cleaned[trimKey] = v;
+    }
+  }
+  data[cleanName] = cleaned;
+  await writeCredentialsFile(data);
+}
+
+async function deleteCredentialSet(name) {
+  const data = await loadCredentialsFile();
+  delete data[name];
+  await writeCredentialsFile(data);
+}
+
+// Resolve a credential reference to actual values (used during test execution)
+async function resolveCredentials(ref) {
+  if (!ref) return null;
+  // If it's a path that exists as a file, treat as old-style yaml file
+  if (ref.includes('/') || ref.endsWith('.yaml') || ref.endsWith('.yml')) {
+    if (await fs.pathExists(ref)) {
+      try {
+        const content = await fs.readFile(ref, 'utf-8');
+        return yaml.parse(content);
+      } catch { return null; }
+    }
+  }
+  // Otherwise look up by name in the vault
+  const data = await loadCredentialsFile();
+  return data[ref] || null;
+}
+
+
+async function deleteSession(reportsDir, id) {
+  const sessionPath = path.join(reportsDir, id);
+  if (await fs.pathExists(sessionPath)) {
+    await fs.remove(sessionPath);
+  }
+}
+
+async function deleteAllSessions(reportsDir) {
+  if (!await fs.pathExists(reportsDir)) return;
+  const entries = await fs.readdir(reportsDir);
+  for (const entry of entries) {
+    if (entry.startsWith('.')) continue; // preserve .suite-runs/
+    const p = path.join(reportsDir, entry);
+    const stat = await fs.stat(p);
+    if (stat.isDirectory()) await fs.remove(p);
+  }
+}
+
+async function deleteSuiteRun(suiteRunsDir, reportsDir, id, cascade) {
+  const filePath = path.join(suiteRunsDir, id + '.json');
+  let sessionIds = [];
+  if (cascade && await fs.pathExists(filePath)) {
+    try {
+      const data = await fs.readJson(filePath);
+      sessionIds = (data.results || []).map(r => r.sessionId).filter(Boolean);
+    } catch {}
+  }
+  if (await fs.pathExists(filePath)) await fs.remove(filePath);
+  if (cascade) {
+    for (const sid of sessionIds) {
+      await deleteSession(reportsDir, sid);
+    }
+  }
+}
+
+async function deleteAllSuiteRuns(suiteRunsDir) {
+  if (!await fs.pathExists(suiteRunsDir)) return;
+  const files = await fs.readdir(suiteRunsDir);
+  for (const f of files) {
+    if (f.endsWith('.json')) await fs.remove(path.join(suiteRunsDir, f));
+  }
+}
+
+
+async function closeRemoteIssue(issue) {
+  const axios = (await import('axios')).default;
+  const dotenv = (await import('dotenv')).default;
+  dotenv.config({ path: path.resolve(process.cwd(), '.skopix.env') });
+  dotenv.config();
+
+  if (issue.tracker === 'github') {
+    const { GITHUB_TOKEN, GITHUB_REPO } = process.env;
+    if (!GITHUB_TOKEN || !GITHUB_REPO) throw new Error('GitHub env vars not set');
+    await axios.patch(
+      `https://api.github.com/repos/${GITHUB_REPO}/issues/${issue.trackerRef}`,
+      { state: 'closed', state_reason: 'completed' },
+      { headers: { Authorization: `token ${GITHUB_TOKEN}`, Accept: 'application/vnd.github.v3+json' } }
+    );
+  } else if (issue.tracker === 'jira') {
+    const { JIRA_BASE_URL, JIRA_EMAIL, JIRA_API_TOKEN } = process.env;
+    if (!JIRA_BASE_URL) throw new Error('Jira env vars not set');
+    // Jira needs a transition - find the "Done" transition for this issue
+    const transRes = await axios.get(
+      `${JIRA_BASE_URL}/rest/api/3/issue/${issue.trackerRef}/transitions`,
+      { auth: { username: JIRA_EMAIL, password: JIRA_API_TOKEN } }
+    );
+    const doneTransition = (transRes.data.transitions || []).find(t =>
+      t.to?.statusCategory?.key === 'done' || /done|closed|resolved/i.test(t.name)
+    );
+    if (!doneTransition) throw new Error('No done transition available');
+    await axios.post(
+      `${JIRA_BASE_URL}/rest/api/3/issue/${issue.trackerRef}/transitions`,
+      { transition: { id: doneTransition.id } },
+      { auth: { username: JIRA_EMAIL, password: JIRA_API_TOKEN } }
+    );
+  } else if (issue.tracker === 'linear') {
+    const { LINEAR_API_KEY, LINEAR_TEAM_ID } = process.env;
+    if (!LINEAR_API_KEY) throw new Error('Linear env vars not set');
+    // Find a completed state on this team
+    const stateQuery = `query States($teamId: String!) { team(id: $teamId) { states { nodes { id type } } } }`;
+    const stateRes = await axios.post(
+      'https://api.linear.app/graphql',
+      { query: stateQuery, variables: { teamId: LINEAR_TEAM_ID } },
+      { headers: { Authorization: LINEAR_API_KEY } }
+    );
+    const states = stateRes.data.data?.team?.states?.nodes || [];
+    const doneState = states.find(s => s.type === 'completed');
+    if (!doneState) throw new Error('No completed state available');
+    const updateQuery = `mutation UpdateIssue($id: String!, $stateId: String!) { issueUpdate(id: $id, input: { stateId: $stateId }) { success } }`;
+    await axios.post(
+      'https://api.linear.app/graphql',
+      { query: updateQuery, variables: { id: issue.trackerRef, stateId: doneState.id } },
+      { headers: { Authorization: LINEAR_API_KEY } }
+    );
+  } else {
+    throw new Error('Unknown tracker: ' + issue.tracker);
+  }
+}
+
+// Build an env-var dictionary from a user's stored secrets (team mode only).
+// Returns {} in single-user mode or if user has no secrets.
+// GOOGLE_API_KEY <- GEMINI_API_KEY, ANTHROPIC_API_KEY <- CLAUDE_API_KEY (provide both aliases).
+async function resolveUserSecretsEnv(userId, teamMode) {
+  if (!teamMode || !userId) return {};
+  const keys = teamMode.db.getUserSecretKeys(userId);
+  if (!keys.length) return {};
+  const env = {};
+  for (const { key } of keys) {
+    const encrypted = teamMode.db.getUserSecret(userId, key);
+    if (!encrypted) continue;
+    try {
+      const value = teamMode.auth.decryptSecret(encrypted);
+      env[key] = value;
+      // Provide common aliases so users don't have to set both
+      if (key === 'GEMINI_API_KEY' && !env.GOOGLE_API_KEY) env.GOOGLE_API_KEY = value;
+      if (key === 'GOOGLE_API_KEY' && !env.GEMINI_API_KEY) env.GEMINI_API_KEY = value;
+      if (key === 'CLAUDE_API_KEY' && !env.ANTHROPIC_API_KEY) env.ANTHROPIC_API_KEY = value;
+      if (key === 'ANTHROPIC_API_KEY' && !env.CLAUDE_API_KEY) env.CLAUDE_API_KEY = value;
+    } catch (err) {
+      // Decryption failed - log and skip. Could happen if SKOPIX_SECRET_KEY changed since the value was encrypted.
+      console.error(`Failed to decrypt secret ${key} for user ${userId}: ${err.message}`);
+    }
+  }
+  return env;
+}
+
+async function syncIssuesStatus() {
+  const axios = (await import('axios')).default;
+  const dotenv = (await import('dotenv')).default;
+  dotenv.config({ path: path.resolve(process.cwd(), '.skopix.env') });
+  dotenv.config();
+
+  const store = await loadIssueStore();
+  let updated = 0;
+  let failed = 0;
+
+  for (const issue of store.issues) {
+    if (issue.status !== 'open') continue;
+    try {
+      let liveStatus = null;
+      if (issue.tracker === 'github') {
+        const { GITHUB_TOKEN, GITHUB_REPO } = process.env;
+        if (!GITHUB_TOKEN || !GITHUB_REPO) continue;
+        const r = await axios.get(
+          `https://api.github.com/repos/${GITHUB_REPO}/issues/${issue.trackerRef}`,
+          { headers: { Authorization: `token ${GITHUB_TOKEN}`, Accept: 'application/vnd.github.v3+json' } }
+        );
+        liveStatus = r.data.state === 'closed' ? 'resolved' : 'open';
+      } else if (issue.tracker === 'jira') {
+        const { JIRA_BASE_URL, JIRA_EMAIL, JIRA_API_TOKEN } = process.env;
+        if (!JIRA_BASE_URL) continue;
+        const r = await axios.get(
+          `${JIRA_BASE_URL}/rest/api/3/issue/${issue.trackerRef}?fields=status`,
+          { auth: { username: JIRA_EMAIL, password: JIRA_API_TOKEN } }
+        );
+        const cat = r.data.fields?.status?.statusCategory?.key;
+        liveStatus = cat === 'done' ? 'resolved' : 'open';
+      } else if (issue.tracker === 'linear') {
+        const { LINEAR_API_KEY } = process.env;
+        if (!LINEAR_API_KEY) continue;
+        const query = `query GetIssue($id: String!) { issue(id: $id) { state { type } } }`;
+        const r = await axios.post(
+          'https://api.linear.app/graphql',
+          { query, variables: { id: issue.trackerRef } },
+          { headers: { Authorization: LINEAR_API_KEY } }
+        );
+        const t = r.data.data?.issue?.state?.type;
+        liveStatus = (t === 'completed' || t === 'canceled') ? 'resolved' : 'open';
+      }
+      if (liveStatus && liveStatus !== issue.status) {
+        issue.status = liveStatus;
+        updated++;
+      }
+    } catch {
+      failed++;
+    }
+  }
+
+  await saveIssueStore(store);
+  return { updated, failed, total: store.issues.length };
+}