# Local Wetech Managed Tool simulation

Run the current Managed Tool source in the pinned Playwright Docker image before
publishing a new immutable package:

```bash
npm run simulate:wetech-managed-tool
```

The default input is a five-minute `vector(1)` query for Wetech `SaaS01`. Pass
`--args /absolute/path/to/args.json` to supply another bounded Tool `args`
object. Credentials and TOTP are read from the existing mode-`0600` local
Wetech files and passed to Docker by environment-variable name, never embedded
in the image or command arguments.

The private `~/.config/wetech-op-grafana/auth.json` Dashboard section must use
separate password profiles (the values below are placeholders):

```json
{
  "dashboard": {
    "username": "monitor",
    "passwords": {
      "asia_saas": "<Asia SaaS Dashboard password>",
      "default": "<default Dashboard password>"
    }
  }
}
```

The simulator maps each profile to its matching Managed Tool secret. The Tool's
`clusters.json` selects the profile: Asia `SaaS01`/`SaaS02` use `asia_saas`,
while `yk-qfxt` uses `default`. Region matters; SaaS clusters in other regions
can use `default`. The old single `dashboard.password` field is not a fallback.
Missing profiles fail before Provider execution and report only secret names.

The simulator keeps its browser state at
`~/.cache/wetech-op-grafana/managed-tool-local/storage-state.json`, also mode
`0600`, so repeated runs reuse a successful login. Set
`WETECH_LOCAL_STATE_DIR` and `WETECH_LOCAL_COOKIE_CACHE` when testing a target
that should not share the default SaaS01 state.

This exercises the exact `index.mjs`, stdin payload, browser version, login
flow, Grafana API, and compact Provider result. It replaces Drive9 with a local
file and does not simulate Agent9 authorization, audit, E2B lifecycle, or the
restricted-host network policy. A local success is therefore a pre-release
gate, not post-deployment verification.