@bugmole/cli 0.5.0 → 0.6.0

package/src/runtime/pipeline.ts

@@ -22,7 +22,10 @@ import path from "node:path";
 import YAML from "yaml";
 import { createProjectObjectStore } from "../storage/create-object-store.js";
 import { projectPrefix } from "../storage/keys.js";
-import { MAX_TASK_ATTEMPTS } from "../registry/task-scheduling.js";
+import { testCaseResultsKey } from "../storage/test-case-results.js";
+import { IN_REVIEW, MAX_TASK_ATTEMPTS } from "../registry/task-scheduling.js";
+import { suggestedRoleNames, usableRoleNames, type RoleRecord } from "../registry/roles.js";
+import { readSpecRoles } from "./project-roles.js";
 import { driverForPlatform } from "./planner.js";
 
 export type PipelineStage = "explore" | "roles" | "audit" | "testcases" | "plan" | "run";
@@ -50,8 +53,10 @@ export type PipelineTask = {
 export type PipelineInputs = {
   projectId: string;
   journeys: PipelineJourney[];
-  /** Actor names defined in roles.yaml. */
+  /** Confirmed roles: the only actors a flow may be planned for. */
   knownActors: string[];
+  /** Roles Bugmole suggested that still wait for a person to confirm or reject. */
+  suggestedActors?: string[];
   /** Journey ids that already have a written test-case set. */
   caseSetJourneyIds: string[];
   /** Journey ids that already have an App Audit artifact. */
@@ -168,7 +173,7 @@ function activeTask(tasks: PipelineTask[]): PipelineTask | undefined {
  */
 export function derivePipelineState(inputs: PipelineInputs): PipelineState {
   const {
-    projectId, journeys, knownActors, caseSetJourneyIds,
+    projectId, journeys, knownActors, suggestedActors = [], caseSetJourneyIds,
     plannedJourneyIds, tasks, hardStopCategories, recordedBlockerCategories,
   } = inputs;
 
@@ -237,8 +242,8 @@ export function derivePipelineState(inputs: PipelineInputs): PipelineState {
       stage: "roles",
       satisfied: missingActors.length === 0,
       detail: missingActors.length
-        ? `undefined actor${missingActors.length === 1 ? "" : "s"}: ${missingActors.join(", ")}`
-        : "every flow actor is defined",
+        ? `unconfirmed role${missingActors.length === 1 ? "" : "s"}: ${missingActors.join(", ")}`
+        : "every flow actor is a confirmed role",
     },
     {
       // The audit inventories each screen's controls and runs the component
@@ -331,6 +336,33 @@ export function derivePipelineState(inputs: PipelineInputs): PipelineState {
     };
   }
 
+  // Finished work waiting for a person is not in flight, but the next stage
+  // would build on it before anyone looked. Wait for the review instead.
+  const inReview = tasks.filter((task) => task.status === IN_REVIEW);
+  if (inReview.length) {
+    const first = inReview[0];
+    return {
+      status: "paused",
+      reason: `${inReview.length} task${inReview.length === 1 ? " is" : "s are"} waiting for your review — `
+        + `accept or send back "${first.title ?? first.idempotencyKey ?? "the task"}" on the Agent Tasks board.`,
+      stages,
+      orphanedArtifacts,
+    };
+  }
+
+  // A flow's actor that Bugmole suggested but nobody has confirmed yet is a
+  // question for a person, not work for an agent: queueing the roles stage
+  // again would only re-suggest it.
+  const awaitingDecision = missingActors.filter((actor) => suggestedActors.includes(actor));
+  if (awaitingDecision.length && awaitingDecision.length === missingActors.length) {
+    return {
+      status: "paused",
+      reason: `confirm or reject the suggested role${awaitingDecision.length === 1 ? "" : "s"} ${awaitingDecision.join(", ")} on the Roles page (Manage → Roles). Only confirmed roles are planned for.`,
+      stages,
+      orphanedArtifacts,
+    };
+  }
+
   // Only one stage runs at a time; the worker already serialises task
   // execution, and queueing ahead would just create work that races.
   const inFlight = activeTask(tasks);
@@ -438,13 +470,14 @@ function buildNextTask(
     return {
       stage,
       taskType: "code",
-      title: "Define the actors the discovered flows use",
+      title: "Suggest the roles the discovered flows use",
       description: [
-        `The discovered flows use actors that roles.yaml does not define: ${context.missingActors.join(", ")}.`,
-        "Planning refuses an undefined actor, so the pipeline cannot proceed until this is reconciled.",
-        "Inspect the application's real roles and either add the missing actor to spec/roles.yaml with",
-        "accurate permissions, or update the flow to use an existing role that genuinely matches.",
-        "Do not invent permissions to make the check pass.",
+        `The discovered flows use actors that are not confirmed roles: ${context.missingActors.join(", ")}.`,
+        "Planning only uses roles a person confirmed, so the pipeline cannot proceed until this is reconciled.",
+        "Inspect the application's real roles (sign-in walls, role-gated routes and menus) and either suggest",
+        "the missing role with bugmole_role_propose (with the evidence that points at it) so a person can",
+        "confirm, rename or reject it, or update the flow to use a confirmed role that genuinely matches.",
+        "You cannot confirm a role yourself. Do not invent permissions to make the check pass.",
       ].join(" "),
       idempotencyKey: pipelineIdempotencyKey(projectId, stage),
     };
@@ -521,12 +554,14 @@ function readYaml(filePath: string): any {
   }
 }
 
-/** Actor names defined in roles.yaml, which the planner validates against. */
-export function knownActors(specDir: string): string[] {
-  const roles = readYaml(path.join(specDir, "roles.yaml"));
-  return Array.isArray(roles?.roles)
-    ? roles.roles.map((role: any) => role?.name).filter((name: unknown): name is string => typeof name === "string")
-    : [];
+/** Confirmed roles, which the planner validates against: roles.yaml, overridden by the registry's decisions. */
+export function knownActors(specDir: string, registryRoles: RoleRecord[] = []): string[] {
+  return usableRoleNames(readSpecRoles(specDir), registryRoles);
+}
+
+/** Roles still waiting for a person's decision. */
+export function suggestedActors(specDir: string, registryRoles: RoleRecord[] = []): string[] {
+  return suggestedRoleNames(readSpecRoles(specDir), registryRoles);
 }
 
 /**
@@ -569,7 +604,7 @@ async function listJourneyIdsWithVerdicts(cfg: any, projectId: string): Promise<
             ? caseSet.cases.map((item: any) => item?.caseId).filter((id: unknown) => typeof id === "string")
             : [];
           if (!journeyId || caseIds.length === 0) return null;
-          const resultKey = `${projectPrefix(projectId)}/test-case-results/${caseSet.caseSetId}.json`;
+          const resultKey = testCaseResultsKey(projectId, caseSet.caseSetId);
           const results = JSON.parse(await store(cfg).getText(resultKey));
           // A verdict recorded against a superseded revision is not evidence
           // about the cases as they stand now, matching how the dashboard
@@ -706,6 +741,8 @@ export async function loadPipelineInputs(
   registry?: {
     runs?: Array<{ journeyId?: string; status?: string }>;
     plans?: Array<{ planId: string; journeyId?: string }>;
+    /** The registry's role decisions, which override roles.yaml. */
+    roles?: RoleRecord[];
   },
 ): Promise<PipelineInputs> {
   const projectId = cfg.project?.id ?? "default";
@@ -727,7 +764,8 @@ export async function loadPipelineInputs(
   return {
     projectId,
     journeys,
-    knownActors: knownActors(specDir),
+    knownActors: knownActors(specDir, registry?.roles ?? []),
+    suggestedActors: suggestedActors(specDir, registry?.roles ?? []),
     caseSetJourneyIds,
     auditedJourneyIds,
     plannedJourneyIds: plannedJourneyIds(specDir, journeys.map((journey) => journey.id)),
@@ -758,6 +796,7 @@ type ReconcileClient = {
   }): Promise<unknown>;
   listRuns?(): Promise<{ runs: any[] }>;
   listPlans?(): Promise<{ plans: any[] }>;
+  listRoles?(): Promise<{ roles: Array<{ name: string; status: RoleRecord["status"] }> }>;
   createRun?(input: {
     planId: string;
     idempotencyKey: string;
@@ -799,14 +838,16 @@ export async function publishPipelineState(cfg: any, state: PipelineState): Prom
 }
 
 export async function reconcilePipeline(cfg: any, client: ReconcileClient): Promise<ReconcileResult> {
-  const [listed, runs, plans] = await Promise.all([
+  const [listed, runs, plans, roles] = await Promise.all([
     client.listTasks(),
     client.listRuns?.().catch(() => ({ runs: [] })) ?? Promise.resolve({ runs: [] }),
     client.listPlans?.().catch(() => ({ plans: [] })) ?? Promise.resolve({ plans: [] }),
+    client.listRoles?.().catch(() => ({ roles: [] })) ?? Promise.resolve({ roles: [] }),
   ]);
   const inputs = await loadPipelineInputs(cfg, listed.tasks ?? [], {
     runs: runs.runs ?? [],
     plans: plans.plans ?? [],
+    roles: (roles.roles ?? []).map((role) => ({ name: role.name, status: role.status })),
   });
   const state = derivePipelineState(inputs);
   // Published on every pass so the dashboard reflects the live position,

package/src/runtime/planner.test.ts

@@ -1,6 +1,7 @@
 import assert from "node:assert/strict";
 import test from "node:test";
-import { driverForPlatform } from "./planner.js";
+import { driverForPlatform, journeyFlow } from "./planner.js";
+import { parseMaestroStyleFlow } from "./flow-language.js";
 
 test("a web plan is never pinned to the mobile driver", () => {
   // bugmole.config defaults execution.driver to "maestro" while the plan
@@ -35,3 +36,25 @@ test("an unknown platform is treated as web rather than defaulting to mobile", (
   // first place: the driver that cannot run without a device file.
   assert.equal(driverForPlatform(undefined, "desktop"), "playwright");
 });
+
+test("a journey becomes a flow that opens its first screen and follows each transition", () => {
+  const flow = journeyFlow(
+    { id: "sign-up", name: "Sign up", startNodeId: "screen:/", nodeIds: ["screen:/", "screen:/signup", "screen:/projects/:id"], edgeIds: ["a", "b"] },
+    [
+      { id: "screen:/", route: "/" },
+      { id: "screen:/signup", route: "/signup" },
+      { id: "screen:/projects/:id", route: "/projects/:id" },
+    ],
+    [
+      { id: "a", from: "screen:/", to: "screen:/signup" },
+      { id: "b", from: "screen:/signup", to: "screen:/projects/:id", label: "Create account" },
+    ],
+  );
+  assert.ok(flow);
+  const parsed = parseMaestroStyleFlow(flow, "http://localhost:3000");
+  assert.deepEqual(parsed.steps.map((step) => step.type), ["launchApp", "assertLayout", "openLink", "assertLayout", "tapOn", "assertLayout"]);
+});
+
+test("a journey with no openable screen has no flow", () => {
+  assert.equal(journeyFlow({ id: "x", nodeIds: ["n"] }, [{ id: "n", route: "/projects/:id" }], []), null);
+});

package/src/runtime/planner.ts

@@ -5,6 +5,7 @@ import { createProjectObjectStore } from "../storage/create-object-store.js";
 import { projectPrefix } from "../storage/keys.js";
 import { ControlPlaneClient } from "../registry/control-plane-client.js";
 import { nextJourneyTask } from "./journey-editor.js";
+import { projectActorProblem, projectRoles, rolesClient } from "./project-roles.js";
 
 /** Drivers that can actually operate each kind of target. */
 const DRIVERS_BY_PLATFORM: Record<string, string[]> = {
@@ -36,6 +37,8 @@ interface PlanOptions {
   journeyId: string;
   actor: string;
   revision?: number;
+  /** Where the registry's role decisions come from; null skips the registry. Defaults to this machine's API key. */
+  rolesClient?: Pick<ControlPlaneClient, "listRoles"> | null;
 }
 
 interface PlanResult {
@@ -82,17 +85,10 @@ export async function plan(cfg: any, options: PlanOptions): Promise<PlanResult>
         nextSteps: ["Select an existing journey or record the selected journey before planning."],
       };
     }
-    if (selectedJourney.stability !== "stable" || selectedJourney.linkedToGraph !== true) {
-      return {
-        status: "error",
-        error: `Journey "${journeyId}" is not stabilized. Execute and adjust the canonical flow until it is stable before planning.`,
-        nextSteps: [
-          `Run the canonical flow "${journeyId}"`,
-          "Adjust the flow for any failures and rerun it",
-          "Mark the verified run as the stabilized canonical flow",
-        ],
-      };
-    }
+    // A draft journey can be planned: running its plan is how it becomes
+    // stable (bugmole_journey_stabilize takes that run's ID). Requiring
+    // "stable" first left no way to make the run that proves it.
+    const isStable = selectedJourney.stability === "stable" && selectedJourney.linkedToGraph === true;
     const flowState = nextJourneyTask(cfg, journeyId);
     if (flowState.status === "actionable") {
       return {
@@ -123,17 +119,18 @@ export async function plan(cfg: any, options: PlanOptions): Promise<PlanResult>
         nextSteps: ["Create roles.yaml from the guided testing workflow, then retry planning."],
       };
     }
-    const roles = YAML.parse(fs.readFileSync(rolesPath, "utf-8"));
-    const knownActors = Array.isArray(roles?.roles)
-      ? roles.roles.map((role: any) => role?.name).filter((name: unknown): name is string => typeof name === "string")
-      : [];
-    if (!knownActors.includes(actor)) {
+    // Only a role a person confirmed may be planned for: Bugmole suggests
+    // roles, people decide them (src/registry/roles.ts, docs/public/roles.md).
+    const roles = await projectRoles(cfg, options.rolesClient === undefined ? rolesClient(cfg) : options.rolesClient);
+    const actorIssue = projectActorProblem(roles, actor);
+    if (actorIssue) {
       return {
         status: "error",
-        error: `Actor "${actor}" is not defined in roles.yaml.`,
+        error: actorIssue,
         nextSteps: [
-          `Read roles.yaml and choose one of: ${knownActors.join(", ") || "(none defined)"}`,
-          "Retry planning with a defined actor",
+          `Plan with a confirmed role: ${roles.usable.join(", ") || "(none confirmed yet)"}`,
+          ...(roles.suggested.length ? [`Ask a person to confirm or reject the suggested roles on the dashboard's Roles page: ${roles.suggested.join(", ")}`] : []),
+          "If the journey really needs a new role, suggest it with bugmole_role_propose and wait for a person to confirm it",
         ],
       };
     }
@@ -169,6 +166,25 @@ export async function plan(cfg: any, options: PlanOptions): Promise<PlanResult>
     const steps = graphSteps;
     const planId = journeyId.replace(/[^a-z0-9._-]/gi, "_").toLowerCase();
     const planPath = path.join(plansDir, `${planId}.flow.yaml`);
+    const platform = cfg.project?.platform || "web";
+    // Without a flow a plan has nothing to run. On the web, write one from
+    // the journey itself: open its first screen, then follow each recorded
+    // transition, checking every screen it reaches.
+    const configuredFlow: string | undefined = cfg.execution?.maestro?.flow || undefined;
+    let generatedFlow: string | null = null;
+    if (!configuredFlow && platform === "web") {
+      const reference = `flows/journeys/${planId}.yaml`;
+      if (fs.existsSync(path.join(specDir, reference))) {
+        generatedFlow = reference;
+      } else {
+        const content = journeyFlow(selectedJourney, discoveredNodes, discoveredEdges);
+        if (content) {
+          generatedFlow = reference;
+          fs.mkdirSync(path.join(specDir, "flows", "journeys"), { recursive: true });
+          fs.writeFileSync(path.join(specDir, reference), content, "utf-8");
+        }
+      }
+    }
 
     const plan = {
       version: 2,
@@ -176,14 +192,14 @@ export async function plan(cfg: any, options: PlanOptions): Promise<PlanResult>
       name: `Journey: ${journeyId}`,
       description: `Generated plan for journey ${journeyId} with actor ${actor}`,
       driver: driverForPlatform(cfg.execution?.driver, cfg.project?.platform || "web"),
-      platform: cfg.project?.platform || "web",
+      platform,
       target: {
         base_url: cfg.project?.base_url || cfg.execution?.playwright?.base_url,
         app_id: cfg.project?.app_id,
         device_id: cfg.project?.device_id,
         serial: cfg.project?.serial,
       },
-      flow: cfg.execution?.maestro?.flow || null,
+      flow: configuredFlow || generatedFlow,
       recovery: {
         enabled: cfg.execution?.recovery?.enabled === true,
         max_attempts: cfg.execution?.recovery?.max_attempts ?? 1,
@@ -200,7 +216,7 @@ export async function plan(cfg: any, options: PlanOptions): Promise<PlanResult>
               actor: actor,
               goal: `Complete journey: ${journeyId}`,
               capabilities_required: [],
-              preconditions: ["Test tenant / sandbox is active", "Actor account exists"],
+              preconditions: [`Signed in as ${actor}, or signed out if that's who the journey is for`],
               steps,
             },
           ],
@@ -263,7 +279,13 @@ export async function plan(cfg: any, options: PlanOptions): Promise<PlanResult>
       status: "success",
       planId: planId,
       planPath: `plans/${planId}.flow.yaml`,
-      message: `Plan created at ${planPath}. Review and customize as needed.${apiKey && registryUrl ? " Published to the dashboard." : ""}`,
+      ...(plan.flow ? { flow: plan.flow } : {}),
+      message: `Plan created at ${planPath}${generatedFlow ? `, with its flow at ${path.join(specDir, generatedFlow)}` : ""}.`
+        + (plan.flow ? "" : " It has no flow to run yet: set execution.maestro.flow, or record the journey's screens with their routes and plan again.")
+        + (apiKey && registryUrl ? " Published to the dashboard." : ""),
+      nextSteps: isStable
+        ? [`Run it: bugmole_run with planId ${planId}`]
+        : [`Run it: bugmole_run with planId ${planId}`, `When that run passes, call bugmole_journey_stabilize with journeyId ${journeyId} and the run's ID`],
     };
   } catch (error: any) {
     return {
@@ -272,3 +294,46 @@ export async function plan(cfg: any, options: PlanOptions): Promise<PlanResult>
     };
   }
 }
+
+/**
+ * A web flow that walks a journey: open the first screen, then follow each
+ * transition in order, tapping its label when it has one and opening the
+ * next screen's route otherwise. Null when there is nothing to open.
+ */
+export function journeyFlow(
+  journey: { id: string; name?: string; startNodeId?: string; nodeIds?: string[]; edgeIds?: string[] },
+  nodes: Array<{ id: string; route?: string; title?: string }>,
+  edges: Array<{ id: string; from: string; to: string; label?: string }>,
+): string | null {
+  const byId = new Map(nodes.map((node) => [node.id, node]));
+  const opens = (route?: string) => typeof route === "string" && route.startsWith("/") && !/[:\[*]/.test(route);
+  const quote = (text: string) => JSON.stringify(text);
+  const startId = journey.startNodeId || journey.nodeIds?.[0];
+  const start = startId ? byId.get(startId) : undefined;
+  const steps: string[] = ["- launchApp"];
+  if (start && opens(start.route) && start.route !== "/") steps.push(`- openLink: ${quote(start.route!)}`);
+  else if (!start || !opens(start.route)) {
+    const first = (journey.nodeIds ?? []).map((id) => byId.get(id)).find((node) => opens(node?.route));
+    if (!first) return null;
+    if (first.route !== "/") steps.push(`- openLink: ${quote(first.route!)}`);
+  }
+  steps.push("- assertLayout");
+  const journeyEdges = (journey.edgeIds ?? []).map((id) => edges.find((edge) => edge.id === id)).filter((edge): edge is NonNullable<typeof edge> => Boolean(edge));
+  for (const edge of journeyEdges) {
+    const target = byId.get(edge.to);
+    const label = typeof edge.label === "string" ? edge.label.trim() : "";
+    if (label && label.length <= 80 && !/^(navigate|dom|link)[:-]/i.test(label)) steps.push(`- tapOn: ${quote(label)}`);
+    else if (opens(target?.route)) steps.push(`- openLink: ${quote(target!.route!)}`);
+    else continue;
+    steps.push("- assertLayout");
+  }
+  return [
+    `# Written by bugmole_plan from journey ${journey.id}. Edit it freely:`,
+    "# the plan runs this file, and planning again won't overwrite your changes",
+    "# unless you delete it.",
+    `name: ${quote(journey.name || journey.id)}`,
+    "---",
+    ...steps,
+    "",
+  ].join("\n");
+}

package/src/runtime/playwright-driver.test.ts

@@ -97,7 +97,7 @@ test("a worker without Playwright's ffmpeg loses the video, not the run", () =>
 import http from "node:http";
 import type { AddressInfo } from "node:net";
 import { chromium } from "playwright";
-import { brokenStatus, checkLayout, checkLinks } from "./playwright-driver.js";
+import { brokenStatus, checkLayout, checkLinks, hideFocusedFieldText } from "./playwright-driver.js";
 
 async function browserOrSkip(t: { skip: (m: string) => void }) {
   try {
@@ -152,7 +152,10 @@ test("assertLinks reports links that don't answer, and doesn't count robots bein
   assert.equal(brokenStatus(403, false), false);
   assert.equal(brokenStatus(429, false), false);
   assert.equal(brokenStatus(410, false), true);
-  assert.equal(brokenStatus(503, false), true);
+  assert.equal(brokenStatus(503, false), false);
+  assert.equal(brokenStatus(504, false), false);
+  assert.equal(brokenStatus(500, false), true);
+  assert.equal(brokenStatus(503, true), true);
   const browser = await browserOrSkip(t);
   if (!browser) return;
   const unsafeHits: string[] = [];
@@ -236,3 +239,19 @@ test("assertClickable scrolls to a button below the fold, but still fails one th
   }
 });
 
+
+test("a secret typed into a plain text field is invisible on screen but keeps its value", async (t) => {
+  const browser = await browserOrSkip(t);
+  if (!browser) return;
+  try {
+    const page = await browser.newPage();
+    await page.setContent(`<input id="token" type="text" style="color:#111">`);
+    await page.focus("#token");
+    await hideFocusedFieldText(page);
+    await page.keyboard.type("s3cr3t-value");
+    assert.equal(await page.inputValue("#token"), "s3cr3t-value");
+    assert.equal(await page.evaluate(`getComputedStyle(document.getElementById("token")).color`), "rgba(0, 0, 0, 0)");
+  } finally {
+    await browser.close();
+  }
+});

package/src/runtime/playwright-driver.ts

@@ -20,11 +20,13 @@ import {
   describeStepLabel,
   isPatternText,
   parseMaestroStyleFlow,
+  referencedSecretNames,
   resolveFlowUrl,
   type FlowStep,
   type ParsedFlow,
 } from "./flow-language.js";
 import { analyzeFailure, rawFlowSteps, type FailureContext } from "./failure-analysis.js";
+import { redactSecrets } from "./secret-redaction.js";
 import { createTempEmailInbox, deleteTempEmailInbox, extractFirstLink, waitForTempEmailMessage, type TempEmailInbox } from "../integrations/temp-email.js";
 
 export { parseMaestroStyleFlow } from "./flow-language.js";
@@ -363,9 +365,30 @@ export function isUnsafeLink(href: string, text: string): boolean {
 /** Answers that mean a link is broken, not that the site turned a robot away. */
 export function brokenStatus(status: number, sameSite: boolean): boolean {
   if (sameSite) return status >= 400;
+  // 502-504 from someone else's site is their gateway having a bad moment
+  // (GitHub answers 504 to bots now and then), not a link the page got wrong.
+  if (status >= 502 && status <= 504) return false;
   return status === 404 || status === 410 || status >= 500;
 }
 
+/**
+ * Makes the focused field's text invisible on screen (screenshots, video)
+ * without changing its value. Password fields are already masked.
+ */
+export async function hideFocusedFieldText(page: Page): Promise<void> {
+  await page.evaluate(`(() => {
+    const field = document.activeElement;
+    if (!field || field === document.body) return;
+    field.setAttribute("data-bugmole-secret", "");
+    if (!document.getElementById("bugmole-secret-style")) {
+      const style = document.createElement("style");
+      style.id = "bugmole-secret-style";
+      style.textContent = "[data-bugmole-secret]{color:transparent!important;-webkit-text-fill-color:transparent!important;text-shadow:none!important;caret-color:currentColor}";
+      (document.head || document.documentElement).appendChild(style);
+    }
+  })()`).catch(() => undefined);
+}
+
 /** Requests every link on the page (same-site only unless `external`). Returns the broken ones. */
 export async function checkLinks(page: Page, external: boolean, limit = 80): Promise<string[]> {
   const origin = new URL(page.url()).origin;
@@ -388,6 +411,11 @@ export async function checkLinks(page: Page, external: boolean, limit = 80): Pro
         let response = await request.head(url, { timeout: 10_000, maxRedirects: 5, failOnStatusCode: false });
         // Plenty of servers answer HEAD badly; a GET is what a visitor sends.
         if (response.status() >= 400) response = await request.get(url, { timeout: 10_000, maxRedirects: 5, failOnStatusCode: false });
+        // A server error can be a blip: ask once more before calling it broken.
+        if (response.status() >= 500) {
+          await new Promise((resolve) => setTimeout(resolve, 1_500));
+          response = await request.get(url, { timeout: 10_000, maxRedirects: 5, failOnStatusCode: false });
+        }
         if (brokenStatus(response.status(), sameSite)) broken.push(`${url} (${response.status()})`);
       } catch (error) {
         if (sameSite) broken.push(`${url} (no answer: ${error instanceof Error ? error.message.split("\n")[0] : String(error)})`);
@@ -502,6 +530,8 @@ export class PlaywrightDriver implements AppDriver {
     const videoDir = path.join(artifactsDir, "video");
     await fs.mkdir(videoDir, { recursive: true });
     const log: string[] = [];
+    const typesSecret = referencedSecretNames(flowContent).length > 0;
+    if (typesSecret) log.push("This flow types a secret, so no Playwright trace is recorded.");
     const steps: DriverStepResult[] = [];
     const pageErrors: string[] = [];
     const consoleErrors: string[] = [];
@@ -519,7 +549,7 @@ export class PlaywrightDriver implements AppDriver {
 
     const writeLog = async () => {
       const logPath = path.join(artifactsDir, "playwright.log");
-      await fs.writeFile(logPath, log.join("\n"), "utf8").catch(() => undefined);
+      await fs.writeFile(logPath, redactSecrets(log.join("\n")), "utf8").catch(() => undefined);
       return logPath;
     };
     const stopTrace = async (): Promise<string | undefined> => {
@@ -549,6 +579,7 @@ export class PlaywrightDriver implements AppDriver {
         };
       }
       const storageState = context.sessionStatePath && (await fileExists(context.sessionStatePath)) ? context.sessionStatePath : undefined;
+      if (storageState && !typesSecret) log.push("This flow starts signed in, so no Playwright trace is recorded (it would hold the session cookies).");
       // Record at the page's real size; Playwright's default shrinks to 800px.
       const videoSize = flow.viewport ?? emulation.options.viewport ?? { width: 1280, height: 720 };
       const contextOptions = {
@@ -561,7 +592,11 @@ export class PlaywrightDriver implements AppDriver {
           withVideo ? { ...contextOptions, recordVideo: { dir: videoDir, size: videoSize } } : contextOptions,
         );
         // The trace is the step-by-step record a person opens to debug a run.
-        await opened.tracing.start({ screenshots: true, snapshots: true }).catch(() => undefined);
+        // It records every typed character and field value, so a flow that
+        // types a secret gets no trace: redaction can't reach inside it.
+        // A flow that starts signed in has the session cookies in every
+        // request it records, so it gets no trace either.
+        if (!typesSecret && !storageState) await opened.tracing.start({ screenshots: true, snapshots: true }).catch(() => undefined);
         return opened;
       };
       browserContext = await openContext(true);
@@ -597,7 +632,7 @@ export class PlaywrightDriver implements AppDriver {
       };
 
       const runStep = async (rawStep: FlowStep): Promise<void> => {
-        const step = interpolateStep(rawStep, flowContext);
+        const step = interpolateStep(rawStep, flowContext, { env: { ...process.env, ...context.environment } });
         switch (step.type) {
           case "launchApp":
             await page.goto(flow.url, { waitUntil: "load" });
@@ -622,6 +657,9 @@ export class PlaywrightDriver implements AppDriver {
             return;
           }
           case "inputText":
+            // A secret typed into a plain text field would show in every
+            // screenshot and the video. Hide that field's text before typing.
+            if (rawStep.type === "inputText" && referencedSecretNames(rawStep.text).length) await hideFocusedFieldText(page);
             await page.keyboard.type(step.text);
             return;
           case "eraseText":
@@ -726,7 +764,11 @@ export class PlaywrightDriver implements AppDriver {
       }
 
       const finalScreenshot = await capture("playwright-final");
-      if (context.sessionStatePath) await browserContext.storageState({ path: context.sessionStatePath });
+      if (context.sessionStatePath) {
+        // The session file holds the app's cookies: readable by this user only.
+        await browserContext.storageState({ path: context.sessionStatePath });
+        await fs.chmod(context.sessionStatePath, 0o600).catch(() => undefined);
+      }
       const tracePath = await stopTrace();
       const logPath = await writeLog();
       const videoPath = await page.video()?.path();
@@ -760,7 +802,7 @@ export class PlaywrightDriver implements AppDriver {
         steps,
       };
     } catch (error) {
-      const message = error instanceof Error ? error.message : "Playwright flow failed.";
+      const message = redactSecrets(error instanceof Error ? error.message : "Playwright flow failed.");
       log.push(`ERROR: ${message}`);
       // The step whose action threw failed; steps after it never ran and must
       // not be reported as either passed or failed.
@@ -797,12 +839,12 @@ export class PlaywrightDriver implements AppDriver {
             invalidFields: snapshot?.invalidFields ?? [],
           };
           const contextPath = path.join(artifactsDir, "failure-context.json");
-          await fs.writeFile(contextPath, `${JSON.stringify(failureContext, null, 2)}\n`, "utf8");
+          await fs.writeFile(contextPath, `${redactSecrets(JSON.stringify(failureContext, null, 2))}\n`, "utf8");
           artifacts.push({ path: contextPath, contentType: "application/json", name: "failure-context.json" });
           try {
             const analysis = analyzeFailure(flow.steps, rawFlowSteps(flowContent), failureContext);
             const analysisPath = path.join(artifactsDir, "analysis.json");
-            await fs.writeFile(analysisPath, `${JSON.stringify(analysis, null, 2)}\n`, "utf8");
+            await fs.writeFile(analysisPath, `${redactSecrets(JSON.stringify(analysis, null, 2))}\n`, "utf8");
             artifacts.push({ path: analysisPath, contentType: "application/json", name: "analysis.json" });
             log.push(`ANALYSIS: ${analysis.title}`);
           } catch (analysisError) {