Testlane 0.7.0-beta.2 — verification preview

Testlane 0.7.0-beta.2 is an opt-in browser-verification preview. npm latest remains 0.6.0; this preview is distributed as a GitHub prerelease tarball.

Describe the feature to your coding agent, use the bundled Testlane Verify skill to write app-specific Playwright checks, then run the reviewed plan and inspect local evidence and cleanup results. Testlane supplies approved sandbox sign-in; your checks decide what passes.

This patch fixes Windows startup failures with deeply nested output paths. Playwright starts from the app project, and Git commit/diff capture is explicitly disabled so its CI metadata probe does not prevent cases from starting.

The attached evidence binds the hosted tarball to the exact locally tested bytes. A preserved Codex-authored five-case suite passed, caught both 4199-versus-4200 defects under a controller replay, and passed after correction with unchanged tests. All 15 case cleanups completed. Synthetic local GitHub CI checks, hosted CI and controller replays retain their separate scopes.

Earlier Claude trials remained incomplete after permission denials. Full Claude workflow acceptance and general client certification are not established.

Use dedicated sandbox accounts and a local shared filesystem. Session files are live credentials: deleting one does not revoke the app session. App-authored tests are trusted code; review their assertions, cleanup and private screenshots.

Install the preview:

npm install --save-dev --save-exact https://github.com/testlane-dev/testlane/releases/download/v0.7.0-beta.2/testlane-cli-0.7.0-beta.2.tgz

Preview quickstart · Changelog · Stable npm package

Testlane 0.7.0-beta.1 — agent-authored browser verification

Testlane 0.7.0-beta.1 packages the opt-in testlane-verify skill and authenticated verification harness with the local credential broker. Your coding agent reads the feature brief and app code, writes app-specific Playwright tests, and uses Testlane sessions to run them. The package contains no embedded model or hosted test service.

New in this preview:

• verify init creates a draft suite and copies the fixture/helper without replacing existing tests or changing accounts, profiles or stored credentials.
• verify run binds the plan, spec and helper hashes to actual case outcomes and cleanup. Missing, skipped, duplicated, retried, expected-failure or caught failed assertions cannot produce passing acceptance. Passing cases need an observed Playwright expect; counts cannot prove the quality of the business oracle.
• verify report renders a private local HTML summary. Failed mapped cases can identify a line and column in the hashed spec without retaining raw error messages or values.
• Screenshots require explicit local opt-in. Traces, videos and automatic screenshots remain off.

The attached tarball was prepared by the tagged release workflow. macOS release validation and the Linux Secret Service consumer's nine checks passed. The exact hosted bytes also match the Windows installed-package candidate: its preserved independently authored suite failed on a generated 4199-cent defect, then passed at 4200 with the same plan/spec/config/helper. Both runs verified owned-record cleanup; the installed CLI's alias, init, draft refusal and overwrite protection checks passed. See the attached source/run binding and Windows summary for exact hashes and limits. The merged-main CI run also passed.

Use the installed preview quickstart, existing-app setup and changelog. Install the reviewed tarball into the app project with its pinned Playwright dependency. npm publication is separate; stable latest remains 0.6.0, and any npm preview is intended for next.

This is a pre-1.0 beta. Use approved sandbox/test accounts and existing client permissions. App-authored test code is trusted local code, not a security sandbox. Assertions determine business correctness. Session files are live credentials; deleting a file does not revoke the app session. Local reports/screenshots can contain app data and should stay private unless reviewed. One generated-app proof does not establish complete workflow coverage, all-client compatibility or independent security assurance.

Testlane 0.6.0

Testlane is a local credential broker for coding agents working with sandbox and test apps. A human approves a dedicated account and stores its password in the OS store. The broker applies policy, signs in and records issuance. Your application checks decide whether the resulting behavior is correct.

Install

npm install --save-dev --save-exact @testlane/cli@0.6.0
npx --no-install testlane --version

Requires Node.js 22 or newer. Start with the existing-app quickstart. See source, npm, the changelog and the migration guide.

Breaking changes

• Generic account identifiers use account.identifier in profiles and overrides, {{identifier}} in request templates, and account set --identifier in the human CLI. Migrate configuration and programmatic callers together. Old field and flag aliases are not provided.
• The application-specific fixed adapter and compatibility defaults have been removed. Use dependent-token with explicit mappings owned by the consuming application. Keep integration-specific configuration private.
• Public examples use an independent fictional API contract. Review their assumptions before adapting them to an existing app.

The secret-store envelope and profile-name keys are unchanged. A configuration-only migration does not require re-seeding when the origin, environment and profile name stay the same. Review account overrides before upgrading; changing origin or environment still requires a human to store the secret again. Unknown configuration keys and strategies are refused.

Included workflows

• Passive testlane doctor diagnostics and an explicit sign-in diagnostic through doctor --check <profile>.
• Local MCP session_file delivery: a file path and cleanup ID that a client sharing the filesystem can use with Playwright, followed by release_session_file.
• An existing-app quickstart and app-owned browser/API assertions for identity, protected pages and permissions.
• Loopback workflow templates for a smoke check and a disposable-record writer/reader check, including cleanup.

These capabilities are carried forward; they are not all new in 0.6.0. The package provides CLI, MCP and localhost HTTP interfaces. It does not include a dashboard.

Release verification

This release is built from commit 0c63ffcf647d1cacc2f922bb1a56682dd0db3781. Main CI passed all 16 jobs. The tag-triggered candidate run passed macOS validation and Linux consumer proof.

The exact hosted tarball passed nine consumer checks on Linux Secret Service and nine on Windows DPAPI, using generated local reference apps and accounts. A scoped Claude Code 2.1.268 run completed list_profiles, check, session_file and release_session_file, with all 22 acceptance checks passing. This covers that four-tool sequence; full client-driven browser workflows and Codex acceptance remain unverified.

The anonymous npm download matches the reviewed hosted tarball byte for byte. The attached registry proof records an isolated install, offline CLI checks and registry-signature verification. Publication used human npm 2FA; no npm CI provenance is claimed.

Tarball: testlane-cli-0.6.0.tgz · 394,673 bytes · 203 files.

SHA-256:

5a40413076528f7fa346023a4f1ac00e16233816b6a522549a06026de61f9675

See the attached manifest, original Linux proof, Windows proof, scoped client proof, main-CI summary, registry proof and aggregate verification report.

Testlane is pre-1.0 and intended for dedicated sandbox/test credentials. Session files and cookies are live credentials. File delivery requires shared local filesystem access; it does not isolate processes running as the same OS user. Release the file after loading it and close the browser context when finished. Deleting a file does not revoke the app's session. Forced termination can leave files behind. Application-specific assertions establish identity, access and cleanup; the broker does not establish application correctness by itself.

Apache-2.0. No independent security audit.