@bugmole/cli 0.5.0 → 0.6.0

package/src/runtime/secret-driver.ts

@@ -0,0 +1,77 @@
+// Gives a flow the secrets it types, from wherever the project keeps them
+// (see secret-sources.ts), for exactly as long as the flow runs: each value is
+// read, attached to that flow's driver context as BUGMOLE_FLOW_SECRET_<NAME>,
+// and registered for redaction. Keeping resolved values off process.env makes
+// concurrent browser/device targets safe.
+
+import fs from "node:fs/promises";
+import type { AppDriver, DriverContext, DriverResult } from "./driver.js";
+import { FLOW_SECRET_ENV_PREFIX, referencedSecretNames } from "./flow-language.js";
+import { redactSecrets, registerSecretValue } from "./secret-redaction.js";
+import { defaultLocalReference, describeReference, resolveSecret, SOURCE_LABEL, type SecretDeps, type SecretReference } from "./secret-sources.js";
+
+export type FlowSecretOptions = {
+  map: Record<string, SecretReference>;
+  projectId: string;
+  deps?: SecretDeps;
+  /**
+   * Look in this machine's secure store for names the map doesn't list (default
+   * true). Off on a cloud runner, which has none: the driver reports
+   * the missing secret itself.
+   */
+  localFallback?: boolean;
+};
+
+function blocked(message: string): DriverResult {
+  return { status: "blocked", message, artifacts: [], failureCode: "secret_unavailable", recoverable: false };
+}
+
+/**
+ * Wraps a driver so each flow gets the secrets it references. A name already
+ * set in the process environment (BUGMOLE_FLOW_SECRET_<NAME>, or a Bugmole
+ * Cloud runner's released secrets) is used as is; resolved names are carried
+ * in the individual DriverContext.
+ */
+export function withFlowSecrets(driver: AppDriver, options: FlowSecretOptions): AppDriver {
+  return {
+    id: driver.id,
+    supports: (platform) => driver.supports(platform),
+    async run(context: DriverContext): Promise<DriverResult> {
+      let content: string;
+      try {
+        content = await fs.readFile(context.flowPath, "utf8");
+      } catch {
+        return driver.run(context);
+      }
+      const env = options.deps?.env ?? process.env;
+      const needed = referencedSecretNames(content).filter((name) => !env[`${FLOW_SECRET_ENV_PREFIX}${name}`]);
+      if (!needed.length) return driver.run(context);
+
+      const values: Record<string, string> = {};
+      for (const name of needed) {
+        const mapped = options.map[name];
+        if (!mapped && options.localFallback === false) continue;
+        const reference = mapped ?? defaultLocalReference(options.projectId, name);
+        try {
+          values[name] = await resolveSecret(reference, options.deps);
+        } catch (error) {
+          const reason = error instanceof Error ? error.message : String(error);
+          return blocked(
+            `The flow types {{secret.${name}}}, but ${SOURCE_LABEL[reference.kind]} (${describeReference(reference)}) couldn't supply it: ${redactSecrets(reason)}.`
+            + (reference.kind === "local" ? ` Store it with: bugmole secrets set ${name}` : ""),
+          );
+        }
+      }
+
+      // Keep resolved values on this flow's context instead of mutating the
+      // process environment. Browser/device matrices run flows concurrently;
+      // global variables would let one target remove another target's secret.
+      const environment = { ...(context.environment ?? {}) };
+      for (const [name, value] of Object.entries(values)) {
+        environment[`${FLOW_SECRET_ENV_PREFIX}${name}`] = value;
+        registerSecretValue(value);
+      }
+      return driver.run({ ...context, environment });
+    },
+  };
+}

package/src/runtime/secret-redaction.ts

@@ -0,0 +1,69 @@
+// Keeps flow secrets out of everything a run leaves behind. Every secret value
+// a worker types (or is handed by the registry for a cloud run) is remembered
+// here for the life of the process, and logs, step results, manifests,
+// uploads and registry updates pass through redactSecrets before they leave.
+
+/** What a secret value is replaced with. */
+export const REDACTED = "[secret]";
+
+/**
+ * Values shorter than this are not redacted: replacing every "1" or "ok" in a
+ * log would destroy it. A secret that short is not a real password anyway.
+ */
+export const MIN_REDACTED_LENGTH = 4;
+
+const values = new Set<string>();
+
+/** Remembers a secret value so it is redacted from then on. */
+export function registerSecretValue(value: string | undefined | null): void {
+  if (typeof value !== "string" || value.length < MIN_REDACTED_LENGTH) return;
+  values.add(value);
+}
+
+/** Forgets every remembered value; for tests and for a runner finishing its job. */
+export function forgetSecretValues(): void {
+  values.clear();
+}
+
+/** Whether any secret value is currently remembered. */
+export function hasSecretValues(): boolean {
+  return values.size > 0;
+}
+
+/** The forms a value can take in text: as typed, JSON-escaped, and URL-encoded. */
+function variants(value: string): string[] {
+  const forms = new Set([value, JSON.stringify(value).slice(1, -1), encodeURIComponent(value)]);
+  return [...forms].filter((form) => form.length >= MIN_REDACTED_LENGTH);
+}
+
+/** Replaces every remembered secret value in `text` with "[secret]". */
+export function redactSecrets(text: string): string {
+  if (values.size === 0 || !text) return text;
+  // Longest first, so a secret that contains another is replaced whole.
+  const forms = [...values].flatMap(variants).sort((a, b) => b.length - a.length);
+  let result = text;
+  for (const form of forms) {
+    if (result.includes(form)) result = result.split(form).join(REDACTED);
+  }
+  return result;
+}
+
+const TEXT_TYPES = /^(text\/|application\/(json|x-ndjson|xml|yaml|x-yaml|javascript)|[^;]*\+json)/i;
+
+/** Whether an upload of this content type is text that could carry a secret. */
+export function isTextContentType(contentType: string | undefined): boolean {
+  return Boolean(contentType && TEXT_TYPES.test(contentType.trim()));
+}
+
+/**
+ * Redacts an upload body when it is text. Binary evidence (screenshots,
+ * video, trace archives) is passed through unchanged.
+ */
+export function redactBody(body: string | Uint8Array, contentType?: string): string | Uint8Array {
+  if (values.size === 0) return body;
+  if (typeof body === "string") return redactSecrets(body);
+  if (!isTextContentType(contentType)) return body;
+  const text = new TextDecoder().decode(body);
+  const redacted = redactSecrets(text);
+  return redacted === text ? body : new TextEncoder().encode(redacted);
+}

package/src/runtime/secret-sources.test.ts

@@ -0,0 +1,442 @@
+import assert from "node:assert/strict";
+import { generateKeyPairSync } from "node:crypto";
+import fs from "node:fs/promises";
+import http from "node:http";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { chromium } from "playwright";
+import { deleteLocal, parseSecretReference, resolveSecret, secretMap, secretStatuses, writeLocal, type SecretDeps } from "./secret-sources.js";
+import { openLocalVault, resetLocalVault, type LocalVaultLike } from "./local-vault.js";
+import { BYOK_HEADER, byokCopy } from "../../scripts/sync-byok.mjs";
+import { withFlowSecrets } from "./secret-driver.js";
+import { resolveVaultReferences, missingSecretsMessage } from "./cloud-secrets.js";
+import { runSecretsCommand } from "./secrets-cli.js";
+import { registerSecretValue, redactSecrets, forgetSecretValues } from "./secret-redaction.js";
+import type { AppDriver, DriverContext } from "./driver.js";
+
+test("the vendored resolver is the synced copy, and references parse through it", async () => {
+  const copy = await fs.readFile(byokCopy, "utf8");
+  assert.ok(copy.startsWith(BYOK_HEADER), "run node scripts/sync-byok.mjs");
+  assert.deepEqual(parseSecretReference("awssm://us-east-1/qa/app#password"), { kind: "aws", region: "us-east-1", secretId: "qa/app", field: "password" });
+  assert.equal(parseSecretReference("arcana://acme/pw"), null, "only sources the CLI reads by itself");
+});
+
+test("the config's map keeps references and never echoes a pasted value", () => {
+  const { map, problems } = secretMap({ secrets: { APP_PASSWORD: "keychain://bugmole:acme/APP_PASSWORD", LEAKED: "correct horse battery staple", "bad-name": "env://X" } });
+  assert.deepEqual(Object.keys(map), ["APP_PASSWORD"]);
+  assert.equal(problems.length, 2);
+  assert.ok(problems.every((problem) => !problem.includes("correct horse")));
+  assert.deepEqual(secretMap({}).map, {});
+  assert.deepEqual(secretMap({ secrets: ["x"] }).problems, ["secrets must map each name to a reference"]);
+});
+
+test("reads AWS Secrets Manager with a signed GetSecretValue, and one field of a JSON secret", async () => {
+  const calls: Array<{ url: string; init: RequestInit }> = [];
+  const deps: SecretDeps = {
+    env: { AWS_ACCESS_KEY_ID: "AKIDEXAMPLE", AWS_SECRET_ACCESS_KEY: "secret-key" },
+    fetch: (async (url: string, init: RequestInit) => {
+      calls.push({ url, init });
+      return new Response(JSON.stringify({ SecretString: JSON.stringify({ password: "s3cr3t-pw", user: "qa" }) }), { status: 200 });
+    }) as typeof fetch,
+  };
+  assert.equal(await resolveSecret(parseSecretReference("awssm://us-east-1/qa/app#password")!, deps), "s3cr3t-pw");
+  assert.equal(calls[0].url, "https://secretsmanager.us-east-1.amazonaws.com/");
+  const headers = calls[0].init.headers as Record<string, string>;
+  assert.equal(headers["x-amz-target"], "secretsmanager.GetSecretValue");
+  assert.match(headers.authorization, /^AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE\/\d{8}\/us-east-1\/secretsmanager\/aws4_request/);
+  assert.equal(calls[0].init.body, JSON.stringify({ SecretId: "qa/app" }));
+  await assert.rejects(resolveSecret(parseSecretReference("awssm://us-east-1/qa/app#nope")!, deps), /no text field "nope"/);
+  await assert.rejects(
+    resolveSecret(parseSecretReference("awssm://us-east-1/qa/app")!, { env: {}, allowCli: false }),
+    /No AWS credentials/,
+  );
+});
+
+test("reads Google Secret Manager with gcloud's token, or a service account key", async () => {
+  const urls: string[] = [];
+  const fetchStub = (async (url: string, init?: RequestInit) => {
+    urls.push(url);
+    if (url.includes("oauth2")) {
+      assert.match(String(init?.body), /grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&assertion=/);
+      return new Response(JSON.stringify({ access_token: "sa-token" }), { status: 200 });
+    }
+    const token = new Headers(init?.headers).get("authorization");
+    return new Response(JSON.stringify({ payload: { data: Buffer.from(`value-for:${token}`).toString("base64") } }), { status: 200 });
+  }) as typeof fetch;
+  const reference = parseSecretReference("gcpsm://projects/acme/secrets/qa")!;
+  assert.equal(await resolveSecret(reference, { env: {}, fetch: fetchStub, exec: async () => "gcloud-token\n" }), "value-for:Bearer gcloud-token");
+  assert.equal(urls[0], "https://secretmanager.googleapis.com/v1/projects/acme/secrets/qa/versions/latest:access");
+
+  const { privateKey } = generateKeyPairSync("rsa", { modulusLength: 2048 });
+  const key = JSON.stringify({ client_email: "qa@acme.iam.gserviceaccount.com", private_key: privateKey.export({ type: "pkcs8", format: "pem" }) });
+  assert.equal(await resolveSecret(reference, { env: { VAULT_GCP_SERVICE_ACCOUNT_KEY: key }, googleKeyVariable: "VAULT_GCP_SERVICE_ACCOUNT_KEY", fetch: fetchStub }), "value-for:Bearer sa-token");
+});
+
+/** An in-memory stand-in for this machine's vault. */
+function memoryVault(initial: Record<string, string> = {}): LocalVaultLike & { entries: Map<string, string> } {
+  const entries = new Map(Object.entries(initial));
+  return {
+    entries,
+    get: (name) => entries.get(name) ?? null,
+    set: (name, value) => { entries.set(name, value); },
+    delete: (name) => entries.delete(name),
+    has: (name) => entries.has(name),
+    list: () => [...entries.keys()].sort(),
+  };
+}
+
+test("the local secure store: the vault per project, or the OS keychain where there's no vault", async () => {
+  const vault = memoryVault();
+  const reference = parseSecretReference("local://PIN", "acme")!;
+  assert.deepEqual(reference, { kind: "local", project: "acme", name: "PIN" });
+  assert.equal(await writeLocal(reference as Extract<typeof reference, { kind: "local" }>, "4321", { localVault: vault }), "vault");
+  assert.deepEqual([...vault.entries.keys()], ["acme/PIN"]);
+  assert.equal(await resolveSecret(reference, { localVault: vault }), "4321");
+  await assert.rejects(resolveSecret(parseSecretReference("local://OTHER", "acme")!, { localVault: vault }), /OTHER isn't in this machine's secure store/);
+
+  // No vault installed: the keychain, with the value on stdin, never in arguments.
+  const calls: Array<{ args: string[]; input?: string }> = [];
+  const keychain: SecretDeps = { localVault: null, platform: "darwin", exec: async (_file, args, options) => { calls.push({ args, input: options?.input }); return "pw\n"; } };
+  assert.equal(await writeLocal({ kind: "local", project: "acme", name: "PIN" }, 'p"w\\1', keychain), "keychain");
+  assert.deepEqual(calls[0].args, ["-i"]);
+  assert.equal(calls[0].input, 'add-generic-password -U -s "bugmole:acme" -a "PIN" -l "Bugmole PIN" -w "p\\"w\\\\1"\n');
+  assert.equal(await resolveSecret({ kind: "local", project: "acme", name: "PIN" }, keychain), "pw");
+  assert.equal(await deleteLocal({ kind: "local", project: "acme", name: "PIN" }, { localVault: vault }), true);
+});
+
+test("the real secure store, where this machine has one (the vault package and a credential store)", async (t) => {
+  const dataDir = await fs.mkdtemp(path.join(os.tmpdir(), "bugmole-vault-"));
+  resetLocalVault();
+  try {
+    const env = { ...process.env, BUGMOLE_DATA_DIR: dataDir };
+    const vault = await openLocalVault(env);
+    if (!vault) {
+      t.skip("no vault package or credential store on this machine");
+      return;
+    }
+    const reference = { kind: "local" as const, project: "bugmole-test", name: `PW_${process.pid}` };
+    assert.equal(await writeLocal(reference, "real-vault-value", { env }), "vault");
+    assert.equal(await resolveSecret(reference, { env }), "real-vault-value");
+    const onDisk = await fs.readFile(path.join(dataDir, "vault", "vault.json"), "utf8");
+    assert.ok(!onDisk.includes("real-vault-value"));
+    assert.equal(await deleteLocal(reference, { env }), true);
+  } finally {
+    resetLocalVault();
+    await fs.rm(dataDir, { recursive: true, force: true });
+  }
+});
+
+test("status says where each secret comes from without reading any value", async () => {
+  const read: string[][] = [];
+  const statuses = await secretStatuses(
+    ["APP_PASSWORD", "PIN", "LOCAL", "TOKEN", "GONE"],
+    {
+      APP_PASSWORD: parseSecretReference("awssm://us-east-1/qa/app")!,
+      TOKEN: parseSecretReference("env://CI_TOKEN")!,
+      GONE: parseSecretReference("gcpsm://projects/a/secrets/b")!,
+    },
+    "acme",
+    {
+      env: { BUGMOLE_FLOW_SECRET_PIN: "1234" },
+      localVault: memoryVault({ "acme/LOCAL": "x" }),
+      platform: "darwin",
+      exec: async (file, args) => {
+        read.push([file, ...args]);
+        if (args.includes("-w") || args.includes("print-access-token") || file === "aws") throw new Error("must not read a value");
+        if (file === "gcloud") return "";
+        if (args.includes("LOCAL")) return "attributes";
+        throw new Error("missing");
+      },
+    },
+  );
+  const byName = Object.fromEntries(statuses.map((status) => [status.name, status]));
+  assert.equal(byName.APP_PASSWORD.source, "aws");
+  assert.equal(byName.PIN.ready, true);
+  assert.equal(byName.LOCAL.source, "local");
+  assert.equal(byName.LOCAL.ready, true);
+  assert.equal(byName.TOKEN.ready, false);
+  assert.equal(byName.GONE.ready, false);
+  assert.ok(!read.some((call) => call.includes("-w")));
+});
+
+const flowContext = async (flow: string) => {
+  const directory = await fs.mkdtemp(path.join(os.tmpdir(), "bugmole-secret-flow-"));
+  const flowPath = path.join(directory, "flow.yaml");
+  await fs.writeFile(flowPath, flow);
+  const context: DriverContext = { runId: "r", projectId: "acme", journeyId: "j", flowPath, platform: "web", target: {}, timeoutMs: 5000, artifactsDir: directory };
+  return { directory, context };
+};
+
+const recordingDriver = (seen: Array<Record<string, string | undefined>>, env: Record<string, string | undefined>): AppDriver => ({
+  id: "playwright",
+  supports: () => true,
+  async run(context) {
+    const runEnv = { ...env, ...(context.environment ?? {}) };
+    seen.push({ PW: runEnv.BUGMOLE_FLOW_SECRET_PW, PIN: runEnv.BUGMOLE_FLOW_SECRET_PIN });
+    return { status: "passed", message: "ok", artifacts: [] };
+  },
+});
+
+test("a flow gets its secrets for the run only, and a missing one blocks it with the reason", async () => {
+  const { directory, context } = await flowContext('url: https://a.test\n---\n- inputText: "{{secret.PW}}"\n- inputText: "{{secret.PIN}}"\n');
+  try {
+    const env: Record<string, string | undefined> = { CI_PIN: "4321", BUGMOLE_FLOW_SECRET_PW: "already-set" };
+    const seen: Array<Record<string, string | undefined>> = [];
+    const wrapped = withFlowSecrets(recordingDriver(seen, env), { map: { PIN: parseSecretReference("env://CI_PIN")! }, projectId: "acme", deps: { env } });
+    assert.equal((await wrapped.run(context)).status, "passed");
+    assert.deepEqual(seen, [{ PW: "already-set", PIN: "4321" }]);
+    assert.equal(env.BUGMOLE_FLOW_SECRET_PIN, undefined, "taken out after the run");
+    assert.equal(redactSecrets("typed 4321"), "typed [secret]");
+    forgetSecretValues();
+
+    delete env.CI_PIN;
+    const missing = await wrapped.run(context);
+    assert.equal(missing.status, "blocked");
+    assert.equal(missing.failureCode, "secret_unavailable");
+    assert.match(missing.message, /\{\{secret\.PIN\}\}.*an environment variable \(env:\/\/CI_PIN\)/);
+
+    // On a cloud runner an unlisted name isn't looked for in a keychain; the driver reports it.
+    delete env.BUGMOLE_FLOW_SECRET_PW;
+    const cloud = withFlowSecrets(recordingDriver(seen, env), { map: {}, projectId: "acme", deps: { env }, localFallback: false });
+    assert.equal((await cloud.run(context)).status, "passed");
+  } finally {
+    await fs.rm(directory, { recursive: true, force: true });
+  }
+});
+
+test("parallel flow runs keep resolved secrets on their own driver context", async () => {
+  const { directory, context } = await flowContext('url: https://a.test\n---\n- inputText: "{{secret.PIN}}"\n');
+  try {
+    const seen: Array<string | undefined> = [];
+    const driver: AppDriver = {
+      id: "playwright",
+      supports: () => true,
+      async run(runContext) {
+        await new Promise((resolve) => setTimeout(resolve, 10));
+        seen.push(runContext.environment?.BUGMOLE_FLOW_SECRET_PIN);
+        return { status: "passed", message: "ok", artifacts: [] };
+      },
+    };
+    const env: Record<string, string | undefined> = { CI_PIN: "4321" };
+    const wrapped = withFlowSecrets(driver, {
+      map: { PIN: parseSecretReference("env://CI_PIN")! },
+      projectId: "acme",
+      deps: { env },
+    });
+    await Promise.all([wrapped.run(context), wrapped.run({ ...context, runId: "second" })]);
+    assert.deepEqual(seen, ["4321", "4321"]);
+    assert.equal(env.BUGMOLE_FLOW_SECRET_PIN, undefined);
+  } finally {
+    await fs.rm(directory, { recursive: true, force: true });
+  }
+});
+
+test("end to end: a flow typing one secret from the environment and one resolved from a vault gets both", async (t) => {
+  try {
+    await fs.access(chromium.executablePath());
+  } catch {
+    t.skip("Chromium is not installed");
+    return;
+  }
+  const typed: string[] = [];
+  const server = http.createServer((request, response) => {
+    if (request.method === "POST") {
+      let body = "";
+      request.on("data", (chunk) => { body += chunk; });
+      request.on("end", () => {
+        const form = new URLSearchParams(body);
+        typed.push(`${form.get("email")}|${form.get("password")}`);
+        response.writeHead(200, { "content-type": "text/html" });
+        response.end("<h1>Welcome back</h1>");
+      });
+      return;
+    }
+    response.writeHead(200, { "content-type": "text/html" });
+    response.end('<form method="post"><label>Email <input name="email"></label><label>Password <input name="password" type="password"></label><button>Sign in</button></form>');
+  });
+  await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const directory = await fs.mkdtemp(path.join(os.tmpdir(), "bugmole-mixed-secrets-"));
+  // As in CI or on a cloud runner: one secret is already in the environment.
+  process.env.BUGMOLE_FLOW_SECRET_MIXED_EMAIL = "qa@example.com";
+  try {
+    const baseUrl = `http://127.0.0.1:${(server.address() as { port: number }).port}/`;
+    const flowPath = path.join(directory, "sign-in.yaml");
+    await fs.writeFile(flowPath, `url: ${baseUrl}\n---\n- launchApp\n- tapOn: "Email"\n- inputText: "{{secret.MIXED_EMAIL}}"\n- tapOn: "Password"\n- inputText: "{{secret.MIXED_PASSWORD}}"\n- tapOn: "Sign in"\n- assertVisible: "Welcome back"\n`);
+    const { PlaywrightDriver } = await import("./playwright-driver.js");
+    const wrapped = withFlowSecrets(new PlaywrightDriver({ headless: true }), {
+      map: {},
+      projectId: "acme",
+      deps: { localVault: memoryVault({ "acme/MIXED_PASSWORD": "from-the-store" }) },
+    });
+    const result = await wrapped.run({
+      runId: "mixed", projectId: "acme", journeyId: "sign-in", flowPath, platform: "web", target: {}, timeoutMs: 30_000,
+      artifactsDir: path.join(directory, "artifacts"),
+    });
+    assert.equal(result.status, "passed", result.message);
+    assert.deepEqual(typed, ["qa@example.com|from-the-store"]);
+  } finally {
+    delete process.env.BUGMOLE_FLOW_SECRET_MIXED_EMAIL;
+    server.close();
+    await fs.rm(directory, { recursive: true, force: true });
+    forgetSecretValues();
+  }
+});
+
+test("end to end: a sign-in flow types a password from this machine's secure store, and the value is gone afterwards", async (t) => {
+  try {
+    await fs.access(chromium.executablePath());
+  } catch {
+    t.skip("Chromium is not installed");
+    return;
+  }
+  const typed: string[] = [];
+  const server = http.createServer((request, response) => {
+    if (request.method === "POST") {
+      let body = "";
+      request.on("data", (chunk) => { body += chunk; });
+      request.on("end", () => {
+        typed.push(new URLSearchParams(body).get("password") ?? "");
+        response.writeHead(200, { "content-type": "text/html" });
+        response.end("<h1>Welcome back</h1>");
+      });
+      return;
+    }
+    response.writeHead(200, { "content-type": "text/html" });
+    response.end('<form method="post"><label>Password <input name="password" type="password"></label><button>Sign in</button></form>');
+  });
+  await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const directory = await fs.mkdtemp(path.join(os.tmpdir(), "bugmole-secret-e2e-"));
+  try {
+    const baseUrl = `http://127.0.0.1:${(server.address() as { port: number }).port}/`;
+    const flowPath = path.join(directory, "sign-in.yaml");
+    await fs.writeFile(flowPath, `url: ${baseUrl}\n---\n- launchApp\n- tapOn: "Password"\n- inputText: "{{secret.APP_PASSWORD}}"\n- tapOn: "Sign in"\n- assertVisible: "Welcome back"\n`);
+    const { PlaywrightDriver } = await import("./playwright-driver.js");
+    // `bugmole secrets set APP_PASSWORD` put the value in this machine's store.
+    const store: SecretDeps = { localVault: memoryVault({ "acme/APP_PASSWORD": "kept-in-keychain" }) };
+    const wrapped = withFlowSecrets(new PlaywrightDriver({ headless: true }), { map: {}, projectId: "acme", deps: store });
+    const result = await wrapped.run({
+      runId: "e2e", projectId: "acme", journeyId: "sign-in", flowPath, platform: "web", target: {}, timeoutMs: 30_000,
+      artifactsDir: path.join(directory, "artifacts"), sessionStatePath: path.join(directory, "session.json"),
+    });
+    assert.equal(result.status, "passed", result.message);
+    assert.deepEqual(typed, ["kept-in-keychain"]);
+    assert.equal(process.env.BUGMOLE_FLOW_SECRET_APP_PASSWORD, undefined, "taken out after the flow");
+    assert.ok(!JSON.stringify(result).includes("kept-in-keychain"), "never in the result");
+    await fs.access(path.join(directory, "session.json"));
+  } finally {
+    server.close();
+    await fs.rm(directory, { recursive: true, force: true });
+    forgetSecretValues();
+  }
+});
+
+test("Bugmole Cloud reads gcpsm:// and awssm:// values by trusting a Bugmole identity token, never a stored key", async () => {
+  const provider = "projects/123/locations/global/workloadIdentityPools/bugmole/providers/bugmole";
+  const audiences: string[] = [];
+  const calls: string[] = [];
+  const identityToken = async (audience: string) => { audiences.push(audience); return `bugmole-jwt-for-${audience}`; };
+  const fetchStub = (async (url: string, init?: RequestInit) => {
+    calls.push(url);
+    if (url === "https://sts.googleapis.com/v1/token") {
+      const body = JSON.parse(String(init?.body));
+      assert.equal(body.subjectToken, `bugmole-jwt-for-//iam.googleapis.com/${provider}`);
+      assert.equal(body.audience, `//iam.googleapis.com/${provider}`);
+      return new Response(JSON.stringify({ access_token: "federated-google-token" }), { status: 200 });
+    }
+    if (url.startsWith("https://iamcredentials.googleapis.com/")) {
+      assert.equal(new Headers(init?.headers).get("authorization"), "Bearer federated-google-token");
+      return new Response(JSON.stringify({ accessToken: "service-account-token" }), { status: 200 });
+    }
+    if (url.startsWith("https://secretmanager.googleapis.com/")) {
+      const auth = new Headers(init?.headers).get("authorization");
+      return new Response(JSON.stringify({ payload: { data: Buffer.from(`google-value:${auth}`).toString("base64") } }), { status: 200 });
+    }
+    if (url === "https://sts.amazonaws.com/") {
+      const form = new URLSearchParams(String(init?.body));
+      assert.equal(form.get("Action"), "AssumeRoleWithWebIdentity");
+      assert.equal(form.get("WebIdentityToken"), "bugmole-jwt-for-sts.amazonaws.com");
+      assert.equal(form.get("RoleArn"), "arn:aws:iam::123456789012:role/bugmole-reader");
+      return new Response("<AssumeRoleWithWebIdentityResponse><Credentials><AccessKeyId>ASIATEMP</AccessKeyId><SecretAccessKey>temp-secret</SecretAccessKey><SessionToken>temp-session</SessionToken></Credentials></AssumeRoleWithWebIdentityResponse>", { status: 200 });
+    }
+    if (url.startsWith("https://secretsmanager.")) {
+      assert.match((init?.headers as Record<string, string>).authorization, /Credential=ASIATEMP\//);
+      assert.equal((init?.headers as Record<string, string>)["x-amz-security-token"], "temp-session");
+      return new Response(JSON.stringify({ SecretString: "aws-value" }), { status: 200 });
+    }
+    throw new Error(`unexpected ${url}`);
+  }) as typeof fetch;
+
+  const resolved = await resolveVaultReferences({
+    available: true,
+    unreadable: [],
+    secrets: {
+      APP_PASSWORD: "gcpsm://projects/acme/secrets/qa",
+      ADMIN_TOKEN: "gcpsm://projects/acme/secrets/admin",
+      API_KEY: "awssm://us-east-1/qa/app",
+      PLAIN: "typed-as-is",
+      PIN: "local://PIN",
+      VAULT_GCP_WORKLOAD_PROVIDER: provider,
+      VAULT_AWS_ROLE_ARN: "arn:aws:iam::123456789012:role/bugmole-reader",
+    },
+  }, { fetch: fetchStub, identityToken, sessionName: "bugmole-run-1" });
+  assert.deepEqual(resolved.secrets, {
+    PLAIN: "typed-as-is",
+    APP_PASSWORD: "google-value:Bearer federated-google-token",
+    ADMIN_TOKEN: "google-value:Bearer federated-google-token",
+    API_KEY: "aws-value",
+  });
+  assert.deepEqual(audiences, [`//iam.googleapis.com/${provider}`, "sts.amazonaws.com"], "one sign-in per cloud, shared by its secrets");
+  assert.match(resolved.vaultErrors!.PIN, /only be read on your own machine/);
+  assert.equal(redactSecrets("token federated-google-token"), "token [secret]");
+  forgetSecretValues();
+
+  // A named service account is impersonated with the federated token.
+  const impersonated = await resolveVaultReferences({
+    available: true, unreadable: [],
+    secrets: { APP_PASSWORD: "gcpsm://projects/acme/secrets/qa", VAULT_GCP_WORKLOAD_PROVIDER: provider, VAULT_GCP_SERVICE_ACCOUNT: "reader@acme.iam.gserviceaccount.com" },
+  }, { fetch: fetchStub, identityToken });
+  assert.equal(impersonated.secrets.APP_PASSWORD, "google-value:Bearer service-account-token");
+
+  // Stored keys aren't a way in; the message says what to set instead.
+  const keyed = await resolveVaultReferences({
+    available: true, unreadable: [],
+    secrets: { APP_PASSWORD: "gcpsm://projects/acme/secrets/qa", API_KEY: "awssm://us-east-1/qa/app", VAULT_GCP_SERVICE_ACCOUNT_KEY: "{}", VAULT_AWS_ACCESS_KEY_ID: "AKID", VAULT_AWS_SECRET_ACCESS_KEY: "x" },
+  }, { fetch: fetchStub, identityToken });
+  assert.match(keyed.vaultErrors!.APP_PASSWORD, /Set VAULT_GCP_WORKLOAD_PROVIDER .*a stored service account key isn't used/);
+  assert.match(keyed.vaultErrors!.API_KEY, /Set VAULT_AWS_ROLE_ARN .*stored access keys aren't used/);
+  assert.match(missingSecretsMessage('- inputText: "{{secret.APP_PASSWORD}}"', keyed)!, /APP_PASSWORD couldn't be read from your vault/);
+  forgetSecretValues();
+});
+
+test("`bugmole secrets set` stores a piped value for this project and never prints it", async () => {
+  const directory = await fs.mkdtemp(path.join(os.tmpdir(), "bugmole-secrets-cli-"));
+  try {
+    await fs.mkdir(path.join(directory, "spec", "flows"), { recursive: true });
+    await fs.writeFile(path.join(directory, "spec", "flows", "sign-in.yaml"), '- inputText: "{{secret.APP_PASSWORD}}"\n');
+    const vault = memoryVault();
+    const deps: SecretDeps = { env: {}, localVault: vault };
+    const output: string[] = [];
+    const sink = { write: (text: string) => { output.push(text); return true; } } as unknown as NodeJS.WriteStream;
+    const stdin = Object.assign((async function* () { yield Buffer.from("piped-pw\n"); })(), { isTTY: false }) as unknown as NodeJS.ReadStream;
+    const cfg = { project: { id: "acme" }, runtime: { spec_dir: "./spec" }, secrets: { TOKEN: "env://CI_TOKEN" } };
+    const code = await runSecretsCommand(cfg, ["node", "bugmole", "secrets", "set", "APP_PASSWORD"], { workspaceRoot: directory, stdin, stdout: sink, stderr: sink, deps });
+    assert.equal(code, 0);
+    assert.deepEqual([...vault.entries], [["acme/APP_PASSWORD", "piped-pw"]]);
+    assert.ok(!output.join("").includes("piped-pw"));
+    assert.equal(await runSecretsCommand(cfg, ["secrets", "set", "TOKEN"], { workspaceRoot: directory, stdout: sink, stderr: sink, deps }), 1, "a name mapped to another source is changed there");
+
+    output.length = 0;
+    await runSecretsCommand(cfg, ["secrets"], { workspaceRoot: directory, stdout: sink, stderr: sink, deps });
+    assert.match(output.join(""), /✓ APP_PASSWORD {2}this machine's secure store {2}local:\/\/APP_PASSWORD/);
+    assert.match(output.join(""), /✗ TOKEN {2}an environment variable/);
+  } finally {
+    await fs.rm(directory, { recursive: true, force: true });
+  }
+});
+
+test("values the redactor knows never leave in a result", () => {
+  registerSecretValue("hunter22");
+  assert.equal(redactSecrets("Typed hunter22 into Password"), "Typed [secret] into Password");
+  forgetSecretValues();
+});