Add --fail-fast: cancel the remaining runs at the first final failure

.serena/.gitignore

@@ -0,0 +1,2 @@
+/cache
+/project.local.yml

.serena/project.yml

@@ -0,0 +1,185 @@
+# the name by which the project can be referenced within Serena/when chatting with the LLM.
+project_name: "testingbotctl"
+
+# the encoding used by text files in the project
+# For a list of possible encodings, see https://docs.python.org/3.11/library/codecs.html#standard-encodings
+encoding: "utf-8"
+
+# optional shell command to run before the language backend (LSP or JetBrains) is initialised.
+# the command runs in the project root directory and is only executed if the project is trusted
+# (see trusted_project_path_patterns in the global configuration).
+# serena waits for the command to exit: a non-zero exit code is logged as an error but does not
+# abort activation. a per-project timeout (activation_command_timeout, default 180s) is the safety
+# backstop for non-terminating commands; on expiry the process is killed and activation continues.
+# example: activation_command: "npx nx run-many -t build"
+activation_command:
+
+# maximum time in seconds to wait for activation_command to complete before killing it (default 180s).
+# must be a positive number.
+activation_command_timeout: 180.0
+
+# line ending convention to use when writing source files.
+# Possible values: unset (use global setting), "lf", "crlf", or "native" (platform default)
+# This does not affect Serena's own files (e.g. memories and configuration files), which always use native line endings.
+line_ending:
+
+# The language backend to use for this project.
+# If not set, the global setting from serena_config.yml is used.
+# Valid values: LSP, JetBrains
+# Note: the backend is fixed at startup. If a project with a different backend
+# is activated post-init, an error will be returned.
+language_backend:
+
+# whether to use project's .gitignore files to ignore files
+ignore_all_files_in_gitignore: true
+
+# advanced configuration option allowing to configure language server-specific options.
+# Maps the language key to the options.
+# The settings are considered only if the project is trusted (see global configuration to define trusted projects).
+# See https://oraios.github.io/serena/02-usage/050_configuration.html#language-server-specific-settings
+ls_specific_settings: {}
+
+# list of workspace folder paths (LSP backend only).
+# These folders will be used to build up Serena's symbol index.
+# Paths must be within the project root and should thus be relative to the project root.
+# Furthermore, the paths should not be filtered by ignore settings.
+# Default setting: The entire project root folder (".") is considered.
+# In (large) monorepos, this can be used to index only subfolders of the project root, e.g.
+#   ls_workspace_folders:
+#     - "./subproject1"
+#     - "./subproject2"
+ls_workspace_folders:
+- "."
+
+# list of additional workspace folder paths for cross-package reference support.
+# Paths can be absolute or relative to the project root.
+# Each folder is registered as an LSP workspace folder, enabling language servers to discover
+# symbols and references across package boundaries, but these folders are not indexed by Serena,
+# i.e. the respective symbols will not be found using Serena's symbol search tools.
+# Example:
+#   additional_workspace_folders:
+#     - ../sibling-package
+#     - ../shared-lib
+ls_additional_workspace_folders: []
+
+# list of additional paths to ignore in this project.
+# Same syntax as gitignore, so you can use * and **.
+# Important: quote patterns that start with `*`, otherwise YAML treats them as aliases.
+# Example:
+#   ignored_paths:
+#     - "examples/**"
+#     - ".worktrees/**"
+#     - "**/bin/**"
+#     - "**/obj/**"
+# Note: global ignored_paths from serena_config.yml are also applied additively.
+ignored_paths: []
+
+# whether the project is in read-only mode
+# If set to true, all editing tools will be disabled and attempts to use them will result in an error
+# Added on 2025-04-18
+read_only: false
+
+# list of tool names to exclude.
+# This extends the existing exclusions (e.g. from the global configuration)
+# Find the list of tools here: https://oraios.github.io/serena/01-about/035_tools.html
+excluded_tools: []
+
+# list of tools to include that would otherwise be disabled (particularly optional tools that are disabled by default).
+# This extends the existing inclusions (e.g. from the global configuration).
+# Find the list of tools here: https://oraios.github.io/serena/01-about/035_tools.html
+included_optional_tools: []
+
+# fixed set of tools to use as the base tool set (if non-empty), replacing Serena's default set of tools.
+# This cannot be combined with non-empty excluded_tools or included_optional_tools.
+# Find the list of tools here: https://oraios.github.io/serena/01-about/035_tools.html
+fixed_tools: []
+
+# list of mode names that are to be activated by default, overriding the setting in the global configuration.
+# The full set of modes to be activated is base_modes (from global config) + default_modes + added_modes.
+# If the setting is undefined/empty, the default_modes from the global configuration (serena_config.yml) apply.
+# Otherwise, this overrides the setting from the global configuration (serena_config.yml).
+# Therefore, you can set this to [] if you do not want the default modes defined in the global config to apply
+# for this project.
+# This setting can, in turn, be overridden by CLI parameters (--mode).
+# See https://oraios.github.io/serena/02-usage/050_configuration.html#modes
+default_modes:
+
+# list of mode names to be activated additionally for this project, e.g. ["query-projects"]
+# The full set of modes to be activated is base_modes (from global config) + default_modes + added_modes.
+# See https://oraios.github.io/serena/02-usage/050_configuration.html#modes
+added_modes:
+
+# initial prompt for the project. It will always be given to the LLM upon activating the project
+# (contrary to the memories, which are loaded on demand).
+initial_prompt: ""
+
+# time budget (seconds) per tool call for the retrieval of additional symbol information
+# such as docstrings or parameter information.
+# This overrides the corresponding setting in the global configuration; see the documentation there.
+# If null or missing, use the setting from the global configuration.
+symbol_info_budget:
+
+# list of regex patterns which, when matched, mark a memory entry as read‑only.
+# Extends the list from the global configuration, merging the two lists.
+read_only_memory_patterns: []
+
+# list of regex patterns for memories to completely ignore.
+# Matching memories will not appear in list_memories or activate_project output
+# and cannot be accessed via read_memory or write_memory.
+# To access ignored memory files, use the read_file tool on the raw file path.
+# Extends the list from the global configuration, merging the two lists.
+# Example: ["_archive/.*", "_episodes/.*"]
+ignored_memory_patterns: []
+
+# list of language servers to start when using the LSP backend; choose from:
+#   ada                    al                     angular                ansible                bash
+#   bsl                    clojure                cpp                    cpp_ccls               crystal
+#   csharp                 csharp_omnisharp       cue                    dart                   deno
+#   elixir                 elm                    erlang                 fortran                fsharp
+#   gdscript               gleam                  go                     groovy                 haskell
+#   haxe                   hlsl                   html                   java                   json
+#   julia                  julia_fatou            kotlin                 latex                  lean4
+#   lua                    luau                   markdown               matlab                 msl
+#   nextflow               nix                    ocaml                  pascal                 perl
+#   php                    php_phpactor           php_phpantom           powershell             python
+#   python_basedpyright    python_jedi            python_pyrefly         python_ty              qml
+#   r                      rego                   ruby                   ruby_solargraph        rust
+#   scala                  scss                   solidity               svelte                 swift
+#   systemverilog          terraform              toml                   typescript             typescript_vts
+#   vue                    wolfram                yaml                   zig
+#   (This list may be outdated; generated with scripts/print_language_list.py;
+#   For the current list, see values of the LanguageServerId enum here:
+#   https://github.com/oraios/serena/blob/main/src/solidlsp/ls_config.py)
+# For some languages, there are several alternative language servers, e.g. csharp_omnisharp, ruby_solargraph.)
+# Note:
+#   - For C, use cpp
+#   - For JavaScript, use typescript
+#   - For Angular projects, use angular (subsumes typescript+html; requires `npm install` in the project root)
+#   - For Svelte projects, use svelte (subsumes typescript/javascript for .svelte projects; requires npm)
+#   - For Deno projects, use deno (serves the same .ts/.js files as typescript; requires the deno CLI on PATH)
+#   - For SCSS / Sass / plain CSS, use scss (some-sass-language-server handles all three)
+#   - For Free Pascal/Lazarus, use pascal
+#   - External Python adapters may add further registered IDs; install the adapter package first
+#     and then use its ID here, for example: example
+# Special requirements:
+#   Some language servers require additional setup/installations.
+#   See here for details: https://oraios.github.io/serena/01-about/020_programming-languages.html#language-servers
+# When using multiple language servers, the first language server that supports a given file will be used for that file.
+# The first language server is the default language and the respective language server will be used as a fallback.
+# Note that when using the JetBrains backend, language servers are not used and this list is correspondingly ignored.
+language_servers:
+- typescript
+
+# list of APIs (facades or facade methods, e.g. "lsp" or "lsp.get_diagnostics_for_symbol") to include in the REPL
+# that would otherwise be disabled (particularly optional methods, which are disabled by default).
+# This extends the existing inclusions (e.g. from the global configuration).
+included_apis: []
+
+# list of APIs (facades or facade methods, e.g. "lsp" or "lsp.find_symbol") to exclude from the REPL.
+# This extends the existing exclusions (e.g. from the global configuration).
+excluded_apis: []
+
+# The interface through which the agent (LLM) accesses Serena's functionality (overrides the global setting).
+# Valid values: tools, REPL (see the global configuration for details); leave empty to use the global setting.
+# Note: the interface is fixed at startup. If a project is activated post-init, its setting is not applied.
+agent_interface:

CHANGELOG.md

@@ -12,6 +12,7 @@ All notable changes to `@testingbot/cli` are documented here. Releases are publi
 - `testingbot espresso` and `testingbot xcuitest` take the same CI/CD metadata as `maestro`: `--branch`, `--pr-url`, `-m/--metadata` and the CI environment detection, through one shared code path.
 - `--retry <count>`, `--download-artifacts [all|failed]` and `--artifacts-output-dir` for `testingbot espresso` and `testingbot xcuitest`. A retried run is started again on the uploaded app; the last attempt decides the exit code, the `--report` and the artifacts. Artifacts (video, logs, screenshots) are zipped with a folder per run, like `maestro`.
 - `--timeout <minutes>` for `testingbot maestro`, `espresso` and `xcuitest`: how long to wait for results, counted from when the tests start and shared by every `--retry` attempt. Default 60.
+- `--fail-fast` for `testingbot maestro`, `espresso` and `xcuitest`: at the first failure that will not be retried, the runs still queued or running are cancelled. The command waits for them to stop, then reports as usual and fails with exit code 2.
 
 ### Changed
 

CLAUDE.md

@@ -0,0 +1,52 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Build and Development Commands
+
+```bash
+npm run build        # Compile TypeScript to dist/
+npm run start        # Run the compiled CLI
+npm test             # Run all tests with Jest
+npm run lint         # Run Prettier and ESLint
+npm run format       # Auto-format code with Prettier
+```
+
+Run a single test file:
+```bash
+npx jest tests/cli.test.ts
+```
+
+Run tests matching a pattern:
+```bash
+npx jest --testNamePattern="espresso"
+```
+
+## Architecture
+
+This is a TypeScript CLI tool for running mobile tests (Espresso, XCUITest, Maestro) on TestingBot's cloud infrastructure.
+
+### Core Structure
+
+- `src/index.ts` - Entry point, invokes the CLI parser
+- `src/cli.ts` - Command definitions using Commander.js. Defines three commands: `espresso`, `maestro`, `xcuitest`
+- `src/auth.ts` - Reads credentials from `~/.testingbot` file (format: `username:accessKey`)
+- `src/providers/` - Test framework implementations (Espresso, XCUITest, Maestro). Each provider handles validation, app upload, test app upload, and test execution via TestingBot API
+- `src/models/` - Data classes for options and credentials
+
+### Provider Pattern
+
+Each provider (Espresso, XCUITest, Maestro) follows the same pattern:
+1. Validate options (check required files exist)
+2. Upload main app to TestingBot API
+3. Upload test app
+4. Trigger test run
+
+API base URLs:
+- Espresso: `https://api.testingbot.com/v1/app-automate/espresso`
+- XCUITest: `https://api.testingbot.com/v1/app-automate/xcuitest`
+- Maestro: `https://api.testingbot.com/v1/app-automate/maestro`
+
+### Testing
+
+Tests use Jest with ts-jest. Provider classes and auth are mocked in CLI tests to test command parsing logic. Provider tests mock axios and fs to test upload/validation logic without network calls.

HANDOVER_maestro_secret_env.md

@@ -0,0 +1,34 @@
+# Handover: `--secret-env` for `testingbot maestro`
+
+Written 2026-10-23. CLI slice of a cross-repo change; the full picture, API contract and the
+web/node work are in `~/projects/web/MAESTRO_SECRET_ENV_HANDOVER.md`. Do the CLI part last or
+behind the API (the API must accept `maestroOptions.secretEnv` first, otherwise the values would be
+stored in plain text like `env` today).
+
+## Why
+
+A prospect found that values passed with `-e KEY=VALUE` are returned verbatim by
+`GET /v1/app-automate/maestro/<projectId>` under `options.env` and embedded in the JUnit report.
+VERIFIED on `main` (ee59411, 1.4.1):
+- `src/cli.ts:658` declares `-e, --env <KEY=VALUE>`; `:878-884` parses into `args.env`.
+- `src/models/maestro_options.ts:393-394` emits `opts.env`; `src/providers/maestro.ts:2304-2311`
+  (sync) and `:435-480` (async) send it as `maestroOptions`.
+- `--debug` prints the whole API response, including `options.env` (`src/providers/maestro.ts:2393`).
+- `--json` output has no `options` (`src/utils/json_output.ts` `JsonRunResult`), so nothing to do there.
+- README `:128` documents `-e`; `:206` shows `-e API_KEY=secret` as an example.
+
+## What to build
+
+1. `--secret-env <KEY=VALUE>` (repeatable), same parsing as `-e`, emitted as
+   `maestroOptions.secretEnv` (object). Reject a key given to both `-e` and `--secret-env`.
+2. Never print secret values: mask them in `--debug` output (replace values of `secretEnv`, and of
+   `env` keys that also appear in `secretEnv`, with `***`), and make sure the request body is not
+   logged elsewhere (grep `logger.debug` in `src/providers/maestro.ts`).
+3. README: document `--secret-env`, change the `:206` example to use it for `API_KEY`, and say
+   plainly that `-e` values are visible in the run options and reports.
+4. CHANGELOG entry; bump minor.
+5. Tests: wherever `getMaestroOptions` is covered (look for `maestro_options` tests), add cases for
+   `secretEnv` emission and the duplicate-key rejection.
+
+Guardrail: an existing untracked handover in this repo (`HANDOVER_maestro_tag_filter_bug.md`)
+describes an unrelated uncommitted fix; do not mix the two.