@guanlin4924/devflow-pi 0.1.94 → 0.1.95

package/plugins/devflow-quality/runtime/playwright/runner.spec.mjs

@@ -0,0 +1,1308 @@
+// plugins/devflow-quality/runtime/playwright/src/runner.spec.ts
+import path4 from "node:path";
+import { fileURLToPath } from "node:url";
+import { test } from "@playwright/test";
+
+// plugins/devflow-quality/runtime/playwright/src/execute.ts
+import crypto from "node:crypto";
+import fs2 from "node:fs";
+import path3 from "node:path";
+
+// plugins/devflow-quality/runtime/playwright/src/schema-validate.ts
+var SUPPORTED = new Set([
+  "$schema",
+  "$id",
+  "$defs",
+  "$ref",
+  "title",
+  "description",
+  "type",
+  "const",
+  "enum",
+  "pattern",
+  "minLength",
+  "maxLength",
+  "minimum",
+  "maximum",
+  "properties",
+  "patternProperties",
+  "additionalProperties",
+  "required",
+  "minProperties",
+  "maxProperties",
+  "items",
+  "minItems",
+  "maxItems",
+  "uniqueItems",
+  "oneOf",
+  "anyOf"
+]);
+function typeOf(value) {
+  if (value === null)
+    return "null";
+  if (Array.isArray(value))
+    return "array";
+  if (typeof value === "number")
+    return Number.isInteger(value) ? "integer" : "number";
+  return typeof value;
+}
+function typeMatches(value, type) {
+  const actual = typeOf(value);
+  if (type === "number")
+    return actual === "number" || actual === "integer";
+  return actual === type;
+}
+function deepEqual(a, b) {
+  if (a === b)
+    return true;
+  if (typeof a !== typeof b || a === null || b === null)
+    return false;
+  if (Array.isArray(a)) {
+    if (!Array.isArray(b) || a.length !== b.length)
+      return false;
+    return a.every((item, i) => deepEqual(item, b[i]));
+  }
+  if (typeof a === "object") {
+    if (Array.isArray(b))
+      return false;
+    const ak = Object.keys(a).sort();
+    const bk = Object.keys(b).sort();
+    if (!deepEqual(ak, bk))
+      return false;
+    return ak.every((k) => deepEqual(a[k], b[k]));
+  }
+  return false;
+}
+var regexCache = new Map;
+function regex(pattern) {
+  let re = regexCache.get(pattern);
+  if (!re) {
+    re = new RegExp(pattern, "u");
+    regexCache.set(pattern, re);
+  }
+  return re;
+}
+
+class SchemaValidator {
+  root;
+  constructor(root) {
+    this.root = root;
+  }
+  validate(value) {
+    const errors = [];
+    this.check(this.root, value, "", errors);
+    return errors;
+  }
+  resolveRef(ref) {
+    if (!ref.startsWith("#/"))
+      throw new Error(`unsupported $ref ${ref}`);
+    let node = this.root;
+    for (const part of ref.slice(2).split("/")) {
+      node = node?.[part.replace(/~1/g, "/").replace(/~0/g, "~")];
+    }
+    if (node === undefined)
+      throw new Error(`unresolved $ref ${ref}`);
+    return node;
+  }
+  check(schema, value, at, errors) {
+    if (schema === true)
+      return;
+    if (schema === false) {
+      errors.push({ path: at, message: "not allowed" });
+      return;
+    }
+    for (const key of Object.keys(schema)) {
+      if (!SUPPORTED.has(key)) {
+        errors.push({ path: at, message: `schema keyword ${key} unsupported by runtime validator` });
+        return;
+      }
+    }
+    const s = schema;
+    if (s.$ref) {
+      this.check(this.resolveRef(s.$ref), value, at, errors);
+    }
+    if (s.type !== undefined) {
+      const types = Array.isArray(s.type) ? s.type : [s.type];
+      if (!types.some((t) => typeMatches(value, t))) {
+        errors.push({ path: at, message: `expected ${types.join("|")}, got ${typeOf(value)}` });
+        return;
+      }
+    }
+    if ("const" in s && !deepEqual(value, s.const))
+      errors.push({ path: at, message: `must equal ${JSON.stringify(s.const)}` });
+    if (s.enum && !s.enum.some((e) => deepEqual(e, value))) {
+      errors.push({ path: at, message: `must be one of ${JSON.stringify(s.enum)}` });
+    }
+    if (typeof value === "string") {
+      const length = [...value].length;
+      if (s.minLength !== undefined && length < s.minLength)
+        errors.push({ path: at, message: `shorter than ${s.minLength}` });
+      if (s.maxLength !== undefined && length > s.maxLength)
+        errors.push({ path: at, message: `longer than ${s.maxLength}` });
+      if (s.pattern !== undefined && !regex(s.pattern).test(value))
+        errors.push({ path: at, message: `does not match ${s.pattern}` });
+    }
+    if (typeof value === "number") {
+      if (s.minimum !== undefined && value < s.minimum)
+        errors.push({ path: at, message: `below minimum ${s.minimum}` });
+      if (s.maximum !== undefined && value > s.maximum)
+        errors.push({ path: at, message: `above maximum ${s.maximum}` });
+    }
+    if (Array.isArray(value)) {
+      if (s.minItems !== undefined && value.length < s.minItems)
+        errors.push({ path: at, message: `fewer than ${s.minItems} items` });
+      if (s.maxItems !== undefined && value.length > s.maxItems)
+        errors.push({ path: at, message: `more than ${s.maxItems} items` });
+      if (s.uniqueItems) {
+        for (let i = 0;i < value.length; i++) {
+          for (let j = i + 1;j < value.length; j++) {
+            if (deepEqual(value[i], value[j]))
+              errors.push({ path: at, message: "items not unique" });
+          }
+        }
+      }
+      if (s.items !== undefined)
+        value.forEach((item, i) => this.check(s.items, item, `${at}/${i}`, errors));
+    }
+    if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+      const obj = value;
+      const keys = Object.keys(obj);
+      if (s.minProperties !== undefined && keys.length < s.minProperties)
+        errors.push({ path: at, message: `fewer than ${s.minProperties} properties` });
+      if (s.maxProperties !== undefined && keys.length > s.maxProperties)
+        errors.push({ path: at, message: `more than ${s.maxProperties} properties` });
+      for (const req of s.required ?? [])
+        if (!(req in obj))
+          errors.push({ path: at, message: `missing required ${req}` });
+      for (const key of keys) {
+        let matched = false;
+        if (s.properties && Object.prototype.hasOwnProperty.call(s.properties, key)) {
+          matched = true;
+          this.check(s.properties[key], obj[key], `${at}/${key}`, errors);
+        }
+        for (const [pattern, sub] of Object.entries(s.patternProperties ?? {})) {
+          if (regex(pattern).test(key)) {
+            matched = true;
+            this.check(sub, obj[key], `${at}/${key}`, errors);
+          }
+        }
+        if (!matched && s.additionalProperties !== undefined) {
+          this.check(s.additionalProperties, obj[key], `${at}/${key}`, errors);
+        }
+      }
+    }
+    if (s.oneOf) {
+      const passing = s.oneOf.filter((sub) => this.probe(sub, value));
+      if (passing.length !== 1)
+        errors.push({ path: at, message: `must match exactly one alternative (matched ${passing.length})` });
+    }
+    if (s.anyOf && !s.anyOf.some((sub) => this.probe(sub, value))) {
+      errors.push({ path: at, message: "must match at least one alternative" });
+    }
+  }
+  probe(schema, value) {
+    const errors = [];
+    this.check(schema, value, "", errors);
+    return errors.length === 0;
+  }
+}
+
+// plugins/devflow-quality/runtime/playwright/src/dsl.ts
+var UI_ACTIONS = new Set([
+  "goto",
+  "click",
+  "fill",
+  "select",
+  "check",
+  "uncheck",
+  "wait_for",
+  "assert_visible",
+  "assert_text",
+  "assert_url",
+  "screenshot"
+]);
+var API_ACTIONS = new Set(["request"]);
+var BUILTIN_VARIABLES = new Set(["execution_id", "namespace"]);
+var VAR_REF = /\$\{([^}]*)\}/g;
+var VAR_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,63}$/;
+function collectRefs(value, out = new Set) {
+  if (typeof value === "string") {
+    for (const m of value.matchAll(VAR_REF))
+      out.add(m[1]);
+  } else if (Array.isArray(value)) {
+    value.forEach((v) => collectRefs(v, out));
+  } else if (value && typeof value === "object") {
+    Object.values(value).forEach((v) => collectRefs(v, out));
+  }
+  return out;
+}
+function validateDsl(dsl, schema) {
+  const issues = new SchemaValidator(schema).validate(dsl);
+  if (issues.length)
+    return issues;
+  return semanticIssues(dsl);
+}
+function semanticIssues(dsl) {
+  const issues = [];
+  const phases = [
+    ["data/setup", dsl.data.setup],
+    ["steps", dsl.steps],
+    ["data/cleanup", dsl.data.cleanup]
+  ];
+  const ids = new Set;
+  const screenshotNames = new Set;
+  const defined = new Set([...BUILTIN_VARIABLES, ...Object.keys(dsl.variables)]);
+  for (const name of Object.keys(dsl.variables)) {
+    if (BUILTIN_VARIABLES.has(name))
+      issues.push({ path: `/variables/${name}`, message: "shadows a built-in variable" });
+  }
+  for (const [name, variable] of Object.entries(dsl.variables)) {
+    const refs = collectRefs(variable.value);
+    if (refs.size)
+      issues.push({ path: `/variables/${name}`, message: "variable values must be literals" });
+  }
+  for (const ref of collectRefs(dsl.data.namespace)) {
+    if (ref !== "execution_id")
+      issues.push({ path: "/data/namespace", message: `namespace may only reference \${execution_id}, got \${${ref}}` });
+  }
+  for (const [base, steps] of phases) {
+    steps.forEach((step, index) => {
+      const at = `/${base}/${index}`;
+      if (ids.has(step.id))
+        issues.push({ path: `${at}/id`, message: `duplicate step id ${step.id}` });
+      ids.add(step.id);
+      const allowed = step.driver === "api" ? API_ACTIONS : UI_ACTIONS;
+      if (!allowed.has(step.action))
+        issues.push({ path: `${at}/action`, message: `unknown action ${step.action}` });
+      for (const ref of collectRefs(step)) {
+        if (!VAR_NAME.test(ref))
+          issues.push({ path: at, message: `malformed variable reference \${${ref}}` });
+        else if (!defined.has(ref))
+          issues.push({ path: at, message: `variable \${${ref}} is not defined before use` });
+      }
+      if (step.action === "screenshot") {
+        const file = String(step.name ?? step.id);
+        if (screenshotNames.has(file))
+          issues.push({ path: at, message: `duplicate screenshot name ${file}` });
+        screenshotNames.add(file);
+      }
+      if (step.driver === "api") {
+        const assertions = step.assertions ?? [];
+        assertions.forEach((a, i) => {
+          const needsValue = a.op !== "exists" && a.op !== "not_exists";
+          if (needsValue && !("value" in a))
+            issues.push({ path: `${at}/assertions/${i}`, message: `op ${a.op} requires value` });
+          if (!needsValue && "value" in a)
+            issues.push({ path: `${at}/assertions/${i}`, message: `op ${a.op} takes no value` });
+        });
+        const method = String(step.method);
+        if (step.retry && (method === "POST" || method === "PATCH") && step.idempotent !== true) {
+          issues.push({ path: `${at}/retry`, message: `${method} retry requires idempotent=true` });
+        }
+        for (const name of Object.keys(step.extract ?? {})) {
+          if (BUILTIN_VARIABLES.has(name) || name in dsl.variables) {
+            issues.push({ path: `${at}/extract/${name}`, message: "extract may not overwrite a declared or built-in variable" });
+          }
+          defined.add(name);
+        }
+      }
+    });
+  }
+  return issues;
+}
+
+class UnsetVariableError extends Error {
+  variable;
+  constructor(variable) {
+    super(`variable \${${variable}} has no value`);
+    this.variable = variable;
+  }
+}
+function interpolate(text, vars) {
+  return text.replace(VAR_REF, (_, name) => {
+    if (!vars.has(name))
+      throw new UnsetVariableError(name);
+    const v = vars.get(name);
+    return typeof v === "string" ? v : JSON.stringify(v);
+  });
+}
+function interpolateDeep(value, vars) {
+  if (typeof value === "string") {
+    const whole = /^\$\{([A-Za-z_][A-Za-z0-9_]{0,63})\}$/.exec(value);
+    if (whole) {
+      if (!vars.has(whole[1]))
+        throw new UnsetVariableError(whole[1]);
+      return vars.get(whole[1]);
+    }
+    return interpolate(value, vars);
+  }
+  if (Array.isArray(value))
+    return value.map((v) => interpolateDeep(v, vars));
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, interpolateDeep(v, vars)]));
+  }
+  return value;
+}
+function jsonPointer(doc, pointer) {
+  if (pointer === "")
+    return { found: true, value: doc };
+  let node = doc;
+  for (const raw of pointer.slice(1).split("/")) {
+    const token = raw.replace(/~1/g, "/").replace(/~0/g, "~");
+    if (Array.isArray(node)) {
+      if (!/^(0|[1-9][0-9]*)$/.test(token) || Number(token) >= node.length)
+        return { found: false };
+      node = node[Number(token)];
+    } else if (node && typeof node === "object" && Object.prototype.hasOwnProperty.call(node, token)) {
+      node = node[token];
+    } else {
+      return { found: false };
+    }
+  }
+  return { found: true, value: node };
+}
+
+// plugins/devflow-quality/runtime/playwright/src/network.ts
+var SUBRESOURCE_POLICIES = new Set(["same-site-plus-declared", "declared-only"]);
+var IMPLICIT_SCHEMES = new Set(["data:", "blob:", "about:"]);
+
+class ProfileError extends Error {
+  code = "environment_profile_invalid";
+}
+function normalizeOrigin(value, field) {
+  let u;
+  try {
+    u = new URL(value);
+  } catch {
+    throw new ProfileError(`${field}: not an absolute URL: ${value}`);
+  }
+  if (u.protocol !== "http:" && u.protocol !== "https:")
+    throw new ProfileError(`${field}: only http(s) origins allowed: ${value}`);
+  return u.origin;
+}
+function buildPolicy(profile) {
+  if (!profile || typeof profile !== "object")
+    throw new ProfileError("profile must be a JSON object");
+  if (typeof profile.base_url !== "string")
+    throw new ProfileError("base_url is required");
+  const listOf = (value, field) => {
+    if (value === undefined)
+      return [];
+    if (!Array.isArray(value) || value.some((v) => typeof v !== "string"))
+      throw new ProfileError(`${field} must be an array of strings`);
+    return value;
+  };
+  const navigation = new Set(listOf(profile.navigation_origins, "navigation_origins").map((o) => normalizeOrigin(o, "navigation_origins")));
+  const api = new Set(listOf(profile.api_origins, "api_origins").map((o) => normalizeOrigin(o, "api_origins")));
+  if (navigation.size === 0)
+    throw new ProfileError("navigation_origins must not be empty");
+  const policy = profile.subresources?.policy ?? "same-site-plus-declared";
+  if (!SUBRESOURCE_POLICIES.has(policy))
+    throw new ProfileError(`unknown subresources.policy ${policy}`);
+  const subresourceOrigins = new Set(listOf(profile.subresources?.allowed_origins, "subresources.allowed_origins").map((o) => normalizeOrigin(o, "subresources.allowed_origins")));
+  const baseUrl = new URL(profile.base_url).toString();
+  if (!navigation.has(new URL(baseUrl).origin))
+    throw new ProfileError("base_url origin must be listed in navigation_origins");
+  const apiBaseUrl = profile.api_base_url ? new URL(profile.api_base_url).toString() : baseUrl;
+  return { baseUrl, apiBaseUrl, navigation, api, subresourcePolicy: policy, subresourceOrigins };
+}
+function sameSite(a, b) {
+  if (a.protocol !== b.protocol)
+    return false;
+  const ha = a.hostname;
+  const hb = b.hostname;
+  return ha === hb || ha.endsWith(`.${hb}`) || hb.endsWith(`.${ha}`);
+}
+function isAllowed(policy, rawUrl, kind) {
+  let u;
+  try {
+    u = new URL(rawUrl);
+  } catch {
+    return false;
+  }
+  if (IMPLICIT_SCHEMES.has(u.protocol))
+    return kind === "subresource";
+  if (kind === "navigation")
+    return policy.navigation.has(u.origin);
+  if (kind === "api")
+    return policy.api.has(u.origin);
+  if (policy.navigation.has(u.origin) || policy.api.has(u.origin) || policy.subresourceOrigins.has(u.origin))
+    return true;
+  if (policy.subresourcePolicy === "same-site-plus-declared") {
+    for (const origin of policy.navigation)
+      if (sameSite(u, new URL(origin)))
+        return true;
+  }
+  return false;
+}
+function isTopLevelNavigation(request) {
+  try {
+    return request.isNavigationRequest() && request.frame().parentFrame() === null;
+  } catch {
+    return false;
+  }
+}
+
+class NetworkRecorder {
+  redactor;
+  entries = [];
+  violations = [];
+  starts = new WeakMap;
+  constructor(redactor) {
+    this.redactor = redactor;
+  }
+  api(entry) {
+    this.entries.push({ source: "api", ...entry, url: this.redactor.url(entry.url) });
+  }
+  violation(url, kind) {
+    this.violations.push({ url: this.redactor.url(url), kind, at: Date.now() });
+  }
+  async install(context, policy) {
+    await context.route("**/*", async (route) => {
+      const request = route.request();
+      const topLevel = isTopLevelNavigation(request);
+      const kind = topLevel ? "navigation" : "subresource";
+      if (isAllowed(policy, request.url(), kind)) {
+        await route.continue();
+        return;
+      }
+      this.violation(request.url(), kind);
+      this.entries.push({
+        source: "page",
+        method: request.method(),
+        url: this.redactor.url(request.url()),
+        status: null,
+        duration_ms: null,
+        blocked: true,
+        resource_type: request.resourceType()
+      });
+      await route.abort("blockedbyclient");
+    });
+    context.on("request", (request) => {
+      this.starts.set(request, Date.now());
+      if (request.redirectedFrom()) {
+        const topLevel = isTopLevelNavigation(request);
+        const kind = topLevel ? "navigation" : "subresource";
+        if (!isAllowed(policy, request.url(), kind))
+          this.violation(request.url(), topLevel ? "navigation" : kind);
+      }
+    });
+    const finish = async (request, failure) => {
+      const started = this.starts.get(request);
+      if (failure === "net::ERR_BLOCKED_BY_CLIENT")
+        return;
+      let status = null;
+      try {
+        status = (await request.response())?.status() ?? null;
+      } catch {
+        status = null;
+      }
+      this.entries.push({
+        source: "page",
+        method: request.method(),
+        url: this.redactor.url(request.url()),
+        status,
+        duration_ms: started ? Date.now() - started : null,
+        blocked: false,
+        resource_type: request.resourceType(),
+        ...failure ? { failure: this.redactor.text(failure) } : {}
+      });
+    };
+    context.on("requestfinished", (request) => void finish(request));
+    context.on("requestfailed", (request) => void finish(request, request.failure()?.errorText ?? "failed"));
+  }
+}
+
+// plugins/devflow-quality/runtime/playwright/src/step.ts
+var DEFAULT_UI_TIMEOUT_MS = 1e4;
+var DEFAULT_NAVIGATION_TIMEOUT_MS = 30000;
+var DEFAULT_API_TIMEOUT_MS = 30000;
+
+class StepFailure extends Error {
+  status;
+  code;
+  details;
+  constructor(status, code, message, details = {}) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.details = details;
+  }
+}
+function isTimeoutError(err) {
+  return err instanceof Error && (err.name === "TimeoutError" || /Timeout \d+ms exceeded/.test(err.message));
+}
+var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+// plugins/devflow-quality/runtime/playwright/src/api.ts
+var REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+var MAX_REDIRECT_HOPS = 5;
+function resolveApiUrl(raw, ctx) {
+  const url = interpolate(raw, ctx.vars);
+  if (url.startsWith("/"))
+    return new URL(url, ctx.policy.apiBaseUrl).toString();
+  try {
+    return new URL(url).toString();
+  } catch {
+    throw new StepFailure("blocked", "invalid_url", `api url must be absolute or start with '/': ${ctx.redactor.text(url)}`);
+  }
+}
+function assertOrigin(url, ctx) {
+  if (!isAllowed(ctx.policy, url, "api")) {
+    ctx.recorder.violation(url, "api");
+    throw new StepFailure("blocked", "network_policy_denied", `api origin not allowed by environment profile: ${ctx.redactor.url(url)}`, {
+      url: ctx.redactor.url(url)
+    });
+  }
+}
+async function send(ctx, method, url, headers, params, body, timeout) {
+  let currentMethod = method;
+  let currentUrl = url;
+  let currentBody = body;
+  let currentParams = params;
+  for (let hop = 0;; hop++) {
+    assertOrigin(currentUrl, ctx);
+    const started = Date.now();
+    let response;
+    try {
+      response = await ctx.request.fetch(currentUrl, {
+        method: currentMethod,
+        headers,
+        params: currentParams,
+        data: currentBody,
+        maxRedirects: 0,
+        failOnStatusCode: false,
+        timeout
+      });
+    } catch (err) {
+      ctx.recorder.api({ method: currentMethod, url: currentUrl, status: null, duration_ms: Date.now() - started, blocked: false, failure: ctx.redactor.error(err) });
+      throw err;
+    }
+    ctx.recorder.api({ method: currentMethod, url: response.url(), status: response.status(), duration_ms: Date.now() - started, blocked: false });
+    const location = response.headers()["location"];
+    if (!REDIRECT_STATUSES.has(response.status()) || !location)
+      return { response, url: response.url() };
+    if (hop + 1 > MAX_REDIRECT_HOPS) {
+      throw new StepFailure("failed", "too_many_redirects", `more than ${MAX_REDIRECT_HOPS} redirects`);
+    }
+    currentUrl = new URL(location, response.url()).toString();
+    currentParams = undefined;
+    const status = response.status();
+    if (status === 303 || (status === 301 || status === 302) && currentMethod !== "GET") {
+      currentMethod = "GET";
+      currentBody = undefined;
+    }
+    await response.dispose();
+  }
+}
+function describeActual(value) {
+  return value.found ? value.value : "<absent>";
+}
+function evaluateAssertion(op, found, expected) {
+  switch (op) {
+    case "exists":
+      return found.found;
+    case "not_exists":
+      return !found.found;
+    case "equals":
+      return found.found && deepEqual(found.value, expected);
+    case "not_equals":
+      return found.found && !deepEqual(found.value, expected);
+    case "contains":
+      if (!found.found)
+        return false;
+      if (typeof found.value === "string" && typeof expected === "string")
+        return found.value.includes(expected);
+      if (Array.isArray(found.value))
+        return found.value.some((item) => deepEqual(item, expected));
+      return false;
+    default:
+      return false;
+  }
+}
+async function executeApi(step, ctx) {
+  const details = {};
+  const method = String(step.method);
+  const timeout = step.timeout_ms ?? DEFAULT_API_TIMEOUT_MS;
+  const url = resolveApiUrl(String(step.url), ctx);
+  details.url = ctx.redactor.url(url);
+  const headers = {};
+  for (const [name, value] of Object.entries(step.headers ?? {})) {
+    headers[name] = interpolate(value, ctx.vars);
+  }
+  const params = step.query ? interpolateDeep(step.query, ctx.vars) : undefined;
+  let body;
+  if ("json" in step) {
+    body = JSON.stringify(interpolateDeep(step.json, ctx.vars));
+    if (!Object.keys(headers).some((h) => h.toLowerCase() === "content-type"))
+      headers["content-type"] = "application/json";
+  }
+  const retry = step.retry;
+  const maxAttempts = retry?.max_attempts ?? 1;
+  const retryOn = new Set(retry?.on ?? []);
+  let hop;
+  for (let attempt = 1;; attempt++) {
+    let condition = null;
+    let lastError = null;
+    try {
+      hop = await send(ctx, method, url, headers, params, body, timeout);
+      if (hop.response.status() === 429)
+        condition = "rate_limited";
+    } catch (err) {
+      if (err instanceof StepFailure)
+        throw new StepFailure(err.status, err.code, err.message, { ...details, ...err.details });
+      condition = isTimeoutError(err) ? "timeout" : "connection_error";
+      lastError = err;
+    }
+    if (condition && retryOn.has(condition) && attempt < maxAttempts) {
+      await sleep(200 * attempt);
+      continue;
+    }
+    if (lastError) {
+      throw new StepFailure("blocked", condition === "timeout" ? "api_timeout" : "api_connection_error", ctx.redactor.error(lastError), details);
+    }
+    break;
+  }
+  const response = hop.response;
+  const status = response.status();
+  details.http_status = status;
+  details.url = ctx.redactor.url(hop.url);
+  const text = await response.text();
+  let json = undefined;
+  let parsed = false;
+  try {
+    json = JSON.parse(text);
+    parsed = true;
+  } catch {
+    parsed = false;
+  }
+  const expectStatus = step.expect_status;
+  if (expectStatus !== undefined ? status !== expectStatus : status < 200 || status > 299) {
+    details.assertion = { match: "status", expected: expectStatus ?? "2xx", actual: status };
+    throw new StepFailure("failed", "http_status_mismatch", `unexpected HTTP status ${status}`, details);
+  }
+  const assertions = step.assertions ?? [];
+  for (const assertion of assertions) {
+    const expected = "value" in assertion ? interpolateDeep(assertion.value, ctx.vars) : undefined;
+    const found = parsed ? jsonPointer(json, assertion.pointer) : { found: false };
+    details.assertion = {
+      match: `${assertion.op} ${assertion.pointer}`,
+      expected: ctx.redactor.value(expected ?? null),
+      actual: ctx.redactor.value(describeActual(found))
+    };
+    if (!parsed)
+      throw new StepFailure("failed", "response_not_json", "response body is not JSON", details);
+    if (!evaluateAssertion(assertion.op, found, expected)) {
+      throw new StepFailure("failed", "assertion_failed", `assertion ${assertion.op} ${assertion.pointer} failed`, details);
+    }
+  }
+  for (const [name, spec] of Object.entries(step.extract ?? {})) {
+    const found = parsed ? jsonPointer(json, spec.pointer) : { found: false };
+    if (!found.found) {
+      throw new StepFailure("failed", "extract_missing", `extract ${name}: pointer ${spec.pointer} not found`, details);
+    }
+    if (spec.sensitive)
+      ctx.redactor.add(found.value);
+    ctx.vars.set(name, found.value);
+  }
+  return details;
+}
+
+// plugins/devflow-quality/runtime/playwright/src/ui.ts
+import path from "node:path";
+import fs from "node:fs";
+var POLL_MS = 100;
+function buildLocator(page, target, ctx) {
+  const text = (key) => interpolate(String(target[key]), ctx.vars);
+  const exact = target.exact === true;
+  const q = (s) => `'${ctx.redactor.text(s).replace(/'/g, "\\'")}'`;
+  const exactSuffix = exact ? ", { exact: true }" : "";
+  if ("testid" in target)
+    return { locator: page.getByTestId(text("testid")), description: `getByTestId(${q(text("testid"))})` };
+  if ("role" in target) {
+    const name = text("name");
+    return {
+      locator: page.getByRole(target.role, { name, exact }),
+      description: `getByRole('${String(target.role)}', { name: ${q(name)}${exact ? ", exact: true" : ""} })`
+    };
+  }
+  if ("label" in target)
+    return { locator: page.getByLabel(text("label"), { exact }), description: `getByLabel(${q(text("label"))}${exactSuffix})` };
+  if ("placeholder" in target) {
+    return { locator: page.getByPlaceholder(text("placeholder"), { exact }), description: `getByPlaceholder(${q(text("placeholder"))}${exactSuffix})` };
+  }
+  if ("text" in target)
+    return { locator: page.getByText(text("text"), { exact }), description: `getByText(${q(text("text"))}${exactSuffix})` };
+  if ("css" in target)
+    return { locator: page.locator(text("css")), description: `locator(${q(text("css"))})` };
+  throw new StepFailure("blocked", "invalid_target", "target has no supported locator form");
+}
+async function resolveStrict(locator, description, deadline) {
+  let count = 0;
+  for (;; ) {
+    count = await locator.count();
+    if (count > 0 || Date.now() >= deadline)
+      break;
+    await sleep(POLL_MS);
+  }
+  if (count === 0) {
+    throw new StepFailure("failed", "element_not_found", `no element matches ${description}`, { locator: description, match_count: 0 });
+  }
+  if (count > 1) {
+    throw new StepFailure("failed", "strict_locator_violation", `${count} elements match ${description}; strict locators require exactly one`, {
+      locator: description,
+      match_count: count
+    });
+  }
+  return count;
+}
+var remaining = (deadline) => Math.max(1, deadline - Date.now());
+function resolveNavigationUrl(raw, ctx) {
+  const url = interpolate(raw, ctx.vars);
+  if (url.startsWith("/"))
+    return new URL(url, ctx.policy.baseUrl).toString();
+  try {
+    return new URL(url).toString();
+  } catch {
+    throw new StepFailure("blocked", "invalid_url", `goto url must be absolute or start with '/': ${ctx.redactor.text(url)}`);
+  }
+}
+function normalizeText(value, normalizeWhitespace, caseSensitive) {
+  let out = normalizeWhitespace ? value.replace(/\s+/g, " ").trim() : value;
+  if (!caseSensitive)
+    out = out.toLowerCase();
+  return out;
+}
+function textMatches(actual, expected, match) {
+  return match === "exact" ? actual === expected : actual.includes(expected);
+}
+async function executeUi(step, ctx) {
+  const page = ctx.page;
+  const defaultTimeout = step.action === "goto" ? DEFAULT_NAVIGATION_TIMEOUT_MS : DEFAULT_UI_TIMEOUT_MS;
+  const timeout = step.timeout_ms ?? defaultTimeout;
+  const deadline = Date.now() + timeout;
+  const details = {};
+  let locator = null;
+  if (step.target) {
+    const built = buildLocator(page, step.target, ctx);
+    locator = built.locator;
+    details.locator = built.description;
+  }
+  const withDetails = (err) => {
+    if (err instanceof StepFailure)
+      throw new StepFailure(err.status, err.code, err.message, { ...details, ...err.details });
+    if (isTimeoutError(err))
+      throw new StepFailure("failed", "timeout", ctx.redactor.error(err), details);
+    if (err instanceof Error && /strict mode violation/i.test(err.message)) {
+      throw new StepFailure("failed", "strict_locator_violation", ctx.redactor.error(err), details);
+    }
+    throw new StepFailure("failed", "step_error", ctx.redactor.error(err), details);
+  };
+  try {
+    switch (step.action) {
+      case "goto": {
+        const url = resolveNavigationUrl(String(step.url), ctx);
+        details.url = ctx.redactor.url(url);
+        const response = await page.goto(url, { timeout, waitUntil: "load" });
+        details.http_status = response?.status() ?? null;
+        if (response && response.status() >= 400) {
+          throw new StepFailure("failed", "navigation_http_error", `navigation returned HTTP ${response.status()}`);
+        }
+        break;
+      }
+      case "click":
+        details.match_count = await resolveStrict(locator, details.locator, deadline);
+        await locator.click({ timeout: remaining(deadline) });
+        break;
+      case "fill":
+        details.match_count = await resolveStrict(locator, details.locator, deadline);
+        await locator.fill(interpolate(String(step.value), ctx.vars), { timeout: remaining(deadline) });
+        break;
+      case "select": {
+        details.match_count = await resolveStrict(locator, details.locator, deadline);
+        const value = Array.isArray(step.value) ? step.value.map((v) => interpolate(v, ctx.vars)) : interpolate(String(step.value), ctx.vars);
+        const selected = await locator.selectOption(value, { timeout: remaining(deadline) });
+        const wanted = Array.isArray(value) ? value.length : 1;
+        if (selected.length !== wanted) {
+          throw new StepFailure("failed", "select_mismatch", `selected ${selected.length} option(s), expected ${wanted}`);
+        }
+        break;
+      }
+      case "check":
+        details.match_count = await resolveStrict(locator, details.locator, deadline);
+        await locator.check({ timeout: remaining(deadline) });
+        break;
+      case "uncheck":
+        details.match_count = await resolveStrict(locator, details.locator, deadline);
+        await locator.uncheck({ timeout: remaining(deadline) });
+        break;
+      case "wait_for": {
+        const state = step.state;
+        if (state === "visible" || state === "attached") {
+          details.match_count = await resolveStrict(locator, details.locator, deadline);
+        }
+        await locator.waitFor({ state, timeout: remaining(deadline) });
+        if (details.match_count === undefined)
+          details.match_count = await locator.count();
+        break;
+      }
+      case "assert_visible":
+        details.match_count = await resolveStrict(locator, details.locator, deadline);
+        try {
+          await locator.waitFor({ state: "visible", timeout: remaining(deadline) });
+        } catch (err) {
+          if (isTimeoutError(err))
+            throw new StepFailure("failed", "assertion_failed", `${details.locator} is not visible`);
+          throw err;
+        }
+        break;
+      case "assert_text": {
+        details.match_count = await resolveStrict(locator, details.locator, deadline);
+        const normalizeWhitespace = step.normalize_whitespace !== false;
+        const caseSensitive = step.case_sensitive !== false;
+        const match = String(step.match);
+        const expectedRaw = interpolate(String(step.expected), ctx.vars);
+        const expected = normalizeText(expectedRaw, normalizeWhitespace, caseSensitive);
+        let actualRaw = "";
+        for (;; ) {
+          actualRaw = await locator.innerText({ timeout: Math.max(remaining(deadline), 1000) });
+          if (textMatches(normalizeText(actualRaw, normalizeWhitespace, caseSensitive), expected, match))
+            break;
+          if (Date.now() >= deadline) {
+            details.assertion = { match, expected: ctx.redactor.text(expectedRaw), actual: ctx.redactor.text(actualRaw) };
+            throw new StepFailure("failed", "assertion_failed", `text ${match} assertion failed`);
+          }
+          await sleep(POLL_MS);
+        }
+        details.assertion = { match, expected: ctx.redactor.text(expectedRaw), actual: ctx.redactor.text(actualRaw) };
+        break;
+      }
+      case "assert_url": {
+        const match = String(step.match);
+        const raw = interpolate(String(step.expected), ctx.vars);
+        const expected = raw.startsWith("/") && match === "exact" ? new URL(raw, ctx.policy.baseUrl).toString() : raw;
+        let actual = page.url();
+        while (!textMatches(actual, expected, match)) {
+          if (Date.now() >= deadline) {
+            details.assertion = { match, expected: ctx.redactor.url(expected), actual: ctx.redactor.url(actual) };
+            throw new StepFailure("failed", "assertion_failed", `url ${match} assertion failed`);
+          }
+          await sleep(POLL_MS);
+          actual = page.url();
+        }
+        details.url = ctx.redactor.url(actual);
+        details.assertion = { match, expected: ctx.redactor.url(expected), actual: ctx.redactor.url(actual) };
+        break;
+      }
+      case "screenshot": {
+        const file = `${String(step.name ?? step.id)}.png`;
+        if (!/^[A-Za-z0-9_-]{1,64}\.png$/.test(file))
+          throw new StepFailure("blocked", "invalid_screenshot_name", "invalid screenshot name");
+        const dir = path.join(ctx.artifactDir, "screenshots");
+        fs.mkdirSync(dir, { recursive: true, mode: 448 });
+        const target = path.join(dir, file);
+        await page.screenshot({ path: target, fullPage: step.full_page === true, timeout: remaining(deadline) });
+        ctx.artifactFiles.push({ path: path.relative(ctx.runDir, target), kind: "screenshot" });
+        break;
+      }
+      default:
+        throw new StepFailure("blocked", "unknown_action", `unknown ui action ${step.action}`);
+    }
+  } catch (err) {
+    withDetails(err);
+  }
+  return details;
+}
+
+// plugins/devflow-quality/runtime/playwright/src/data.ts
+function baseResult(step, phase) {
+  return {
+    id: step.id,
+    phase,
+    action: step.action,
+    status: "skipped",
+    duration_ms: 0,
+    locator: null,
+    match_count: null,
+    url: null,
+    http_status: null,
+    assertion: null,
+    covers: step.covers ?? {},
+    error: null,
+    error_code: null
+  };
+}
+async function runStep(step, phase, ctx) {
+  const result = baseResult(step, phase);
+  const started = Date.now();
+  const violationsBefore = ctx.recorder.violations.filter((v) => v.kind === "navigation").length;
+  try {
+    const details = step.driver === "api" ? await executeApi(step, ctx) : await executeUi(step, ctx);
+    Object.assign(result, details);
+    result.status = "passed";
+  } catch (err) {
+    if (err instanceof StepFailure) {
+      Object.assign(result, err.details);
+      result.status = err.status;
+      result.error_code = err.code;
+      result.error = ctx.redactor.text(err.message);
+    } else if (err instanceof UnsetVariableError) {
+      result.status = "failed";
+      result.error_code = "variable_unset";
+      result.error = err.message;
+    } else {
+      result.status = "failed";
+      result.error_code = "step_error";
+      result.error = ctx.redactor.error(err);
+    }
+  }
+  const violationsAfter = ctx.recorder.violations.filter((v) => v.kind === "navigation").length;
+  if (violationsAfter > violationsBefore && result.status !== "blocked") {
+    result.status = "blocked";
+    result.error_code = "network_policy_denied";
+    result.error = result.error ?? "top-level navigation to an origin not declared in navigation_origins was blocked";
+  }
+  result.duration_ms = Date.now() - started;
+  return result;
+}
+async function runPhase(steps, phase, ctx) {
+  const results = [];
+  let status = "passed";
+  let errorCode = null;
+  for (const step of steps) {
+    if (status !== "passed") {
+      results.push(baseResult(step, phase));
+      continue;
+    }
+    const result = await runStep(step, phase, ctx);
+    results.push(result);
+    if (result.status === "failed" || result.status === "blocked") {
+      status = result.status;
+      errorCode = result.error_code ?? null;
+    }
+  }
+  return { status, error_code: errorCode, results };
+}
+async function runCleanup(steps, ctx) {
+  if (steps.length === 0)
+    return { summary: { status: "skipped", errors: [] }, results: [] };
+  const results = [];
+  const errors = [];
+  for (const step of steps) {
+    const result = await runStep(step, "cleanup", ctx);
+    results.push(result);
+    if (result.status !== "passed")
+      errors.push(`${step.id}: ${result.error_code ?? "error"}: ${result.error ?? ""}`.trim());
+  }
+  return { summary: { status: errors.length ? "failed" : "passed", errors }, results };
+}
+function synthesize(setup, main, cleanup) {
+  if (setup.status !== "passed")
+    return { status: "blocked", error_code: "setup_failed" };
+  const m = main;
+  if (m.status === "failed")
+    return { status: "failed", error_code: m.error_code };
+  if (m.status === "blocked")
+    return { status: "blocked", error_code: m.error_code };
+  if (cleanup.status === "failed")
+    return { status: "blocked", error_code: "cleanup_error" };
+  return { status: "passed", error_code: null };
+}
+
+// plugins/devflow-quality/runtime/playwright/src/env.ts
+import path2 from "node:path";
+var NAMES = {
+  dslFile: "DEVFLOW_DSL_FILE",
+  dslSha256: "DEVFLOW_DSL_SHA256",
+  tcId: "DEVFLOW_TC_ID",
+  tcSha256: "DEVFLOW_TC_SHA256",
+  executionId: "DEVFLOW_EXECUTION_ID",
+  nonce: "DEVFLOW_EXECUTION_NONCE",
+  resultFile: "DEVFLOW_RESULT_FILE",
+  artifactDir: "DEVFLOW_ARTIFACT_DIR",
+  environmentFile: "DEVFLOW_ENVIRONMENT_FILE"
+};
+
+class EnvError extends Error {
+  code;
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+  }
+}
+function rawEnv(env = process.env) {
+  const out = {};
+  for (const [key, name] of Object.entries(NAMES)) {
+    const value = env[name];
+    if (typeof value === "string" && value.length > 0)
+      out[key] = value;
+  }
+  return out;
+}
+function readRuntimeEnv(env = process.env) {
+  const raw = rawEnv(env);
+  const missing = Object.entries(NAMES).filter(([key]) => !raw[key]).map(([, name]) => name);
+  if (missing.length)
+    throw new EnvError(`missing reserved environment variables: ${missing.join(", ")}`, "runtime_env_missing");
+  const r = raw;
+  for (const key of ["dslFile", "resultFile", "artifactDir", "environmentFile"]) {
+    if (!path2.isAbsolute(r[key]))
+      throw new EnvError(`${NAMES[key]} must be an absolute path`, "runtime_env_invalid");
+  }
+  if (!/^[0-9a-f]{64}$/.test(r.dslSha256))
+    throw new EnvError("DEVFLOW_DSL_SHA256 must be 64 lowercase hex", "runtime_env_invalid");
+  if (!/^[0-9a-f]{64}$/.test(r.tcSha256))
+    throw new EnvError("DEVFLOW_TC_SHA256 must be 64 lowercase hex", "runtime_env_invalid");
+  if (path2.basename(r.resultFile) !== "result.json")
+    throw new EnvError("DEVFLOW_RESULT_FILE must be <run_dir>/result.json", "runtime_env_invalid");
+  const runDir = path2.dirname(path2.resolve(r.resultFile));
+  if (path2.resolve(r.artifactDir) !== path2.join(runDir, "artifacts")) {
+    throw new EnvError("DEVFLOW_ARTIFACT_DIR must be <run_dir>/artifacts next to DEVFLOW_RESULT_FILE", "runtime_env_invalid");
+  }
+  return { ...r, runDir };
+}
+
+// plugins/devflow-quality/runtime/playwright/src/redact.ts
+var REDACTED = "***";
+var SENSITIVE_KEY = /(pass(word|wd)?|secret|token|auth|session|cookie|api[-_]?key|signature|sig|credential|private)/i;
+var MAX_ERROR_LENGTH = 2000;
+var ANSI = /\u001b\[[0-9;]*[A-Za-z]/g;
+
+class Redactor {
+  values = [];
+  add(value) {
+    if (value === undefined || value === null)
+      return;
+    const text = typeof value === "string" ? value : JSON.stringify(value);
+    if (!text)
+      return;
+    if (!this.values.includes(text)) {
+      this.values.push(text);
+      this.values.sort((a, b) => b.length - a.length);
+    }
+    for (const encoded of [encodeURIComponent(text), new URLSearchParams({ v: text }).toString().slice(2)]) {
+      if (encoded !== text && !this.values.includes(encoded))
+        this.values.push(encoded);
+    }
+    this.values.sort((a, b) => b.length - a.length);
+  }
+  list() {
+    return [...this.values];
+  }
+  text(input) {
+    let out = input;
+    for (const v of this.values)
+      out = out.split(v).join(REDACTED);
+    return out;
+  }
+  url(input) {
+    let masked = input;
+    try {
+      const u = new URL(input);
+      if (u.username || u.password) {
+        u.username = u.username ? REDACTED : "";
+        u.password = u.password ? REDACTED : "";
+      }
+      for (const key of [...u.searchParams.keys()]) {
+        if (SENSITIVE_KEY.test(key))
+          u.searchParams.set(key, REDACTED);
+      }
+      masked = u.toString();
+    } catch {}
+    return this.text(masked);
+  }
+  value(input) {
+    if (typeof input === "string")
+      return this.text(input);
+    if (Array.isArray(input))
+      return input.map((v) => this.value(v));
+    if (input && typeof input === "object") {
+      return Object.fromEntries(Object.entries(input).map(([k, v]) => [k, SENSITIVE_KEY.test(k) ? REDACTED : this.value(v)]));
+    }
+    if (input !== undefined && input !== null && this.values.includes(String(input)))
+      return REDACTED;
+    return input;
+  }
+  error(err) {
+    const raw = err instanceof Error ? err.message : String(err);
+    const text = this.text(raw.replace(ANSI, ""));
+    return text.length > MAX_ERROR_LENGTH ? `${text.slice(0, MAX_ERROR_LENGTH)}…` : text;
+  }
+}
+
+// plugins/devflow-quality/runtime/playwright/src/version.ts
+var RUNTIME_VERSION = "0.1.0";
+var RESULT_ORIGIN = "devflow_playwright_runtime";
+var RESULT_SCHEMA_VERSION = 1;
+var DSL_SCHEMA_FILE = "devflow-test-dsl-v1.schema.json";
+var RESULT_ATTACHMENT = "devflow-runtime-result";
+
+// plugins/devflow-quality/runtime/playwright/src/execute.ts
+var now = () => new Date().toISOString();
+function outcome(partial, redactor) {
+  return {
+    error_code: null,
+    dsl_sha256: null,
+    finished_at: now(),
+    steps: [],
+    cleanup: { status: "skipped", errors: [] },
+    artifact_files: [],
+    ...partial,
+    redact_values: redactor.list()
+  };
+}
+function secretValues(profile, redactor) {
+  const map = new Map;
+  for (const [key, envName] of Object.entries(profile?.secret_env ?? {})) {
+    const value = typeof envName === "string" ? process.env[envName] : undefined;
+    if (value)
+      redactor.add(value);
+    map.set(key, value);
+  }
+  return map;
+}
+async function executeRun(page, runtimeDir) {
+  const startedAt = now();
+  const redactor = new Redactor;
+  let env;
+  try {
+    env = readRuntimeEnv();
+  } catch (err) {
+    const code = err instanceof EnvError ? err.code : "runtime_env_invalid";
+    return outcome({ status: "invalid", error_code: code, started_at: startedAt }, redactor);
+  }
+  let profile = null;
+  let profileError = null;
+  try {
+    profile = JSON.parse(fs2.readFileSync(env.environmentFile, "utf8"));
+  } catch {
+    profileError = "environment_profile_unreadable";
+  }
+  const secrets = secretValues(profile, redactor);
+  let bytes;
+  try {
+    bytes = fs2.readFileSync(env.dslFile);
+  } catch {
+    return outcome({ status: "invalid", error_code: "dsl_unreadable", started_at: startedAt }, redactor);
+  }
+  const dslSha = crypto.createHash("sha256").update(bytes).digest("hex");
+  if (dslSha !== env.dslSha256) {
+    return outcome({ status: "invalid", error_code: "dsl_sha256_mismatch", dsl_sha256: dslSha, started_at: startedAt }, redactor);
+  }
+  let dsl;
+  try {
+    dsl = JSON.parse(bytes.toString("utf8"));
+  } catch {
+    return outcome({ status: "invalid", error_code: "dsl_not_json", dsl_sha256: dslSha, started_at: startedAt }, redactor);
+  }
+  const allSteps = [...dsl?.data?.setup ?? [], ...dsl?.steps ?? [], ...dsl?.data?.cleanup ?? []];
+  const unknown = Array.isArray(allSteps) && allSteps.some((s) => {
+    const set = s?.driver === "api" ? API_ACTIONS : s?.driver === "ui" ? UI_ACTIONS : null;
+    return !set || !set.has(s?.action);
+  });
+  if (unknown)
+    return outcome({ status: "invalid", error_code: "dsl_unknown_action", dsl_sha256: dslSha, started_at: startedAt }, redactor);
+  let schema;
+  try {
+    schema = JSON.parse(fs2.readFileSync(path3.join(runtimeDir, DSL_SCHEMA_FILE), "utf8"));
+  } catch {
+    return outcome({ status: "blocked", error_code: "runtime_schema_unavailable", dsl_sha256: dslSha, started_at: startedAt }, redactor);
+  }
+  const issues = validateDsl(dsl, schema);
+  if (issues.length) {
+    console.error(`devflow runtime: DSL invalid: ${issues.slice(0, 5).map((i) => `${i.path} ${i.message}`).join("; ")}`);
+    return outcome({ status: "invalid", error_code: "dsl_invalid", dsl_sha256: dslSha, started_at: startedAt }, redactor);
+  }
+  if (dsl.tc_id !== env.tcId || dsl.tc_sha256 !== env.tcSha256) {
+    return outcome({ status: "invalid", error_code: "dsl_identity_mismatch", dsl_sha256: dslSha, started_at: startedAt }, redactor);
+  }
+  if (profileError)
+    return outcome({ status: "blocked", error_code: profileError, dsl_sha256: dslSha, started_at: startedAt }, redactor);
+  let policy;
+  try {
+    policy = buildPolicy(profile);
+  } catch (err) {
+    const code = err instanceof ProfileError ? err.code : "environment_profile_invalid";
+    console.error(`devflow runtime: ${redactor.error(err)}`);
+    return outcome({ status: "blocked", error_code: code, dsl_sha256: dslSha, started_at: startedAt }, redactor);
+  }
+  const vars = new Map;
+  for (const [name, variable] of Object.entries(dsl.variables)) {
+    if ("secret" in variable && variable.secret !== undefined) {
+      const value = secrets.get(variable.secret);
+      if (!value) {
+        console.error(`devflow runtime: secret ${variable.secret} is not declared in secret_env or its environment variable is unset`);
+        return outcome({ status: "blocked", error_code: "secret_unavailable", dsl_sha256: dslSha, started_at: startedAt }, redactor);
+      }
+      vars.set(name, value);
+    } else {
+      if (variable.sensitive)
+        redactor.add(variable.value);
+      vars.set(name, variable.value);
+    }
+  }
+  vars.set("execution_id", env.executionId);
+  vars.set("namespace", interpolate(dsl.data.namespace, new Map([["execution_id", env.executionId]])));
+  fs2.mkdirSync(env.artifactDir, { recursive: true, mode: 448 });
+  const context = page.context();
+  const recorder = new NetworkRecorder(redactor);
+  await recorder.install(context, policy);
+  const ctx = {
+    page,
+    context,
+    request: context.request,
+    vars,
+    redactor,
+    policy,
+    recorder,
+    artifactDir: env.artifactDir,
+    runDir: env.runDir,
+    artifactFiles: []
+  };
+  const setup = await runPhase(dsl.data.setup, "setup", ctx);
+  let main = null;
+  if (setup.status === "passed") {
+    main = await runPhase(dsl.steps, "main", ctx);
+  }
+  const cleanup = await runCleanup(dsl.data.cleanup, ctx);
+  const verdict = synthesize(setup, main, cleanup.summary);
+  const mainResults = main?.results ?? dsl.steps.map((s) => ({
+    id: s.id,
+    phase: "main",
+    action: s.action,
+    status: "skipped",
+    duration_ms: 0,
+    locator: null,
+    match_count: null,
+    url: null,
+    http_status: null,
+    assertion: null,
+    covers: s.covers ?? {},
+    error: null
+  }));
+  const networkDir = path3.join(env.artifactDir, "network");
+  fs2.mkdirSync(networkDir, { recursive: true, mode: 448 });
+  const networkFile = path3.join(networkDir, "summary.json");
+  const summary = { entries: recorder.entries, violations: recorder.violations };
+  fs2.writeFileSync(networkFile, redactor.text(JSON.stringify(summary, null, 2)), { mode: 384 });
+  ctx.artifactFiles.push({ path: path3.relative(env.runDir, networkFile), kind: "network" });
+  return outcome({
+    status: verdict.status,
+    error_code: verdict.error_code,
+    dsl_sha256: dslSha,
+    started_at: startedAt,
+    steps: [...setup.results, ...mainResults, ...cleanup.results],
+    cleanup: cleanup.summary,
+    artifact_files: ctx.artifactFiles
+  }, redactor);
+}
+
+// plugins/devflow-quality/runtime/playwright/src/runner.spec.ts
+var runtimeDir = path4.dirname(fileURLToPath(import.meta.url));
+test("devflow-runtime", async ({ page }, testInfo) => {
+  const outcome2 = await executeRun(page, runtimeDir);
+  await testInfo.attach(RESULT_ATTACHMENT, { body: JSON.stringify(outcome2), contentType: "application/json" });
+  if (outcome2.status !== "passed") {
+    throw new Error(`devflow runtime status=${outcome2.status} error_code=${outcome2.error_code ?? "none"}`);
+  }
+});