@guanlin4924/devflow-pi 0.1.98 → 0.1.99

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/acceptance_test_runner.py

@@ -766,10 +766,15 @@ def validate_results(root: Path, feature: str, today: date | None = None) -> dic
         errors.append("acceptance-test results are pinned to a stale TC suite")
     expected = set(validation.get("tc_ids", []))
     result_entries = results.get("results") if isinstance(results.get("results"), list) else []
+    if any(not isinstance(item, dict) or not isinstance(item.get("tc_id"), str) for item in result_entries):
+        errors.append("acceptance-test result entries must be objects with a string tc_id")
     actual = {item.get("tc_id") for item in result_entries if isinstance(item, dict) and isinstance(item.get("tc_id"), str)}
     if actual != expected:
         errors.append("acceptance-test results do not cover exactly the frozen TC suite")
-    failed = sorted(item.get("tc_id", "<unknown>") for item in result_entries if not isinstance(item, dict) or item.get("status") != "passed")
+    failed = sorted(
+        item["tc_id"] if isinstance(item, dict) and isinstance(item.get("tc_id"), str) else "<unknown>"
+        for item in result_entries if not isinstance(item, dict) or item.get("status") != "passed"
+    )
     if failed:
         errors.append(f"frozen TC cases not passed: {', '.join(failed)}")
     if suite is not None and isinstance(bindings, dict):

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/business_claim_validate.py

@@ -8,6 +8,8 @@ import subprocess
 from pathlib import Path
 from typing import Any
 
+from business_traceability import confirmed_requirement_ids
+
 
 def load_yaml(path: Path) -> Any:
     try:
@@ -36,7 +38,7 @@ def main() -> int:
     errors = []
     warnings = []
     actions = {item.get("id") for item in business.get("actions", []) if isinstance(item, dict)}
-    requirements = {item.get("id") for item in traceability.get("requirements", []) if isinstance(item, dict) and item.get("status") in {"confirmed", "approved"}} if isinstance(traceability, dict) else set()
+    requirements = confirmed_requirement_ids(traceability)
     values = claims.get("claims") if isinstance(claims, dict) else claims
     if not isinstance(values, list):
         errors.append({"code": "BUSINESS_CLAIM_SCHEMA_INVALID", "path": "claims", "message": "claims must be an array"})

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/business_cross_model_check.py

@@ -8,6 +8,8 @@ import subprocess
 from pathlib import Path
 from typing import Any
 
+from business_traceability import confirmed_requirement_ids
+
 
 def read_json(path: Path) -> Any:
     return json.loads(path.read_text(encoding="utf-8"))
@@ -41,7 +43,7 @@ def main() -> int:
         requirements = set()
         if args.traceability:
             traceability = read_json(args.traceability)
-            requirements = {item.get("id") for item in traceability.get("requirements", []) if isinstance(item, dict) and item.get("status") in {"confirmed", "approved"}}
+            requirements = confirmed_requirement_ids(traceability)
         if args.wireframe:
             wireframe = read_json(args.wireframe)
             for screen in wireframe.get("screens", []):

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/business_traceability.py

@@ -0,0 +1,31 @@
+"""Read confirmed requirement references from Core graph views and legacy lists."""
+from __future__ import annotations
+
+from typing import Any
+
+
+def confirmed_requirement_ids(traceability: Any) -> set[str]:
+    if not isinstance(traceability, dict):
+        return set()
+    meta = traceability.get("view_meta", {})
+    if isinstance(meta, dict) and (meta.get("state") == "stale" or meta.get("needs_recheck") is True):
+        return set()
+    stale_ids = {
+        entry.get("node_id") if isinstance(entry, dict) else entry
+        for entry in traceability.get("stale", [])
+        if isinstance(entry, (dict, str))
+    }
+    # The graph's typed nodes are authoritative when present; a legacy list
+    # must not override their confirmation state or introduce other node kinds.
+    graph_view = "nodes" in traceability
+    items = traceability.get("nodes" if graph_view else "requirements", [])
+    if not isinstance(items, list):
+        return set()
+    return {
+        item["id"] for item in items
+        if isinstance(item, dict)
+        and isinstance(item.get("id"), str)
+        and (not graph_view or item.get("kind") == "requirement")
+        and item.get("status") in {"confirmed", "approved"}
+        and item["id"] not in stale_ids
+    }

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/dsl_v1.py

@@ -255,11 +255,14 @@ def semantic_errors(dsl: dict[str, Any]) -> list[str]:
     for name, spec in variables.items():
         if name in BUILTIN_VARIABLES:
             errors.append(f"$.variables.{name} redefines a built-in variable")
+        if isinstance(spec.get("value"), str) and VARIABLE_REF_RE.search(spec["value"]):
+            errors.append(f"$.variables.{name} variable values must be literals")
         if "secret" in spec or spec.get("sensitive") is True:
             sensitive.add(name)
-    known = set(variables) | {"execution_id"}
-    _references(dsl["data"]["namespace"], "$.data.namespace", known, errors)
-    known.add("namespace")
+    # Runtime initializes namespace with execution_id only; declared values are
+    # literals, not expressions evaluated against other variables.
+    _references(dsl["data"]["namespace"], "$.data.namespace", {"execution_id"}, errors)
+    known = set(variables) | BUILTIN_VARIABLES
     seen_ids: dict[str, str] = {}
     for _phase, path, step in all_steps(dsl):
         step_id = step["id"]

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/environment_profile.py

@@ -8,6 +8,7 @@ from __future__ import annotations
 
 import argparse
 import hashlib
+import ipaddress
 import json
 import re
 from pathlib import Path
@@ -35,7 +36,15 @@ def profile_path(root: Path, name: str) -> Path:
 
 
 def origin_of(url: str) -> str | None:
-    parts = urlsplit(url)
+    try:
+        parts = urlsplit(url)
+        # urlsplit validates ports lazily; older Python versions also accept
+        # malformed bracketed IPv6 hosts that the browser rejects.
+        _ = parts.port
+        if parts.hostname and ":" in parts.hostname:
+            ipaddress.IPv6Address(parts.hostname)
+    except ValueError:
+        return None
     if parts.scheme not in {"http", "https"} or not parts.hostname or parts.username or parts.password:
         return None
     origin = f"{parts.scheme}://{parts.netloc}"
@@ -48,7 +57,7 @@ def _origins(value: Any, label: str, errors: list[str], required: bool) -> list[
         return []
     origins: list[str] = []
     for index, item in enumerate(value):
-        if not isinstance(item, str) or not ORIGIN_RE.fullmatch(item):
+        if not isinstance(item, str) or not ORIGIN_RE.fullmatch(item) or origin_of(item) is None:
             errors.append(f"{label}[{index}] must be an exact http(s) origin without path, wildcard, or credentials")
         elif item in origins:
             errors.append(f"{label}[{index}] duplicates {item}")

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/parallel_run.rb

@@ -75,7 +75,7 @@ module ParallelRun
     match && match[1]
   end
 
-  def attach_state_ref(root, state_path, run_id, expected_revision)
+  def prepare_state_ref(root, state_path, run_id, expected_revision)
     absolute, = DevflowControlIO.resolve_control_path(root, state_path, :state)
     original = File.read(absolute)
     front = state_front_matter(original)
@@ -90,6 +90,11 @@ module ParallelRun
     state["parallel_run_ref"] = run_id
     state["revision"] = actual + 1
     body = original.sub(/\A---\n.*?\n---\n/m, "---\n#{state.to_yaml.sub(/\A---\n/, "")}---\n")
+    [absolute, body, state]
+  end
+
+  def attach_state_ref(root, state_path, run_id, expected_revision)
+    absolute, body, state = prepare_state_ref(root, state_path, run_id, expected_revision)
     DevflowControlIO.atomic_write(absolute, body)
     state
   end
@@ -131,11 +136,13 @@ module ParallelRun
         "created_at" => Time.now.utc.iso8601,
         "branches" => branch_records,
       }
-      write(root, feature, record)
-      updated_state = attach_state_ref(root, state_path, run_id, state_revision)
+      # Validate the STATE CAS and reference before persisting scheduler state.
+      # A rejected prepare must not leave a run that blocks a corrected retry.
+      absolute, body, updated_state = prepare_state_ref(root, state_path, run_id, state_revision)
       record["bound_state_revision"] = Integer(updated_state.fetch("revision"))
       record["branches"].each { |branch| branch["expected_state_revision"] = record["bound_state_revision"] }
       write(root, feature, record)
+      DevflowControlIO.atomic_write(absolute, body)
       { "ok" => true, "run" => record }
     ensure
       DevflowControlIO.release_lock(lock)
@@ -185,12 +192,14 @@ module ParallelRun
 
       previous_id = branch["branch_id"]
       branch["history"] ||= []
-      branch["history"] << branch.slice("branch_id", "attempt", "branch_revision", "status", "task_id", "evidence_path")
+      branch["history"] << branch.slice("branch_id", "attempt", "branch_revision", "status", "task_id", "evidence_path", "output_fingerprint", "error")
       branch["attempt"] = Integer(branch.fetch("attempt", 0)) + 1
       branch["branch_revision"] = 0
       branch["previous_branch_id"] = previous_id
       branch["status"] = "pending"
-      branch.delete("error")
+      # Task ownership and evidence belong to the previous attempt. Keeping
+      # them on a pending retry makes inspect expose stale execution results.
+      %w[task_id evidence_path output_fingerprint error].each { |key| branch.delete(key) }
       record["status"] = "running"
       record["run_revision"] = Integer(record.fetch("run_revision", 0)) + 1
       record["updated_at"] = Time.now.utc.iso8601

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/session_rollover.rb

@@ -107,9 +107,14 @@ def previous_step_payload(root, state)
   outputs = paths.each_with_object([]) do |raw_path, result|
     relative = render.call(raw_path)
     absolute = File.expand_path(relative, root)
-    next unless absolute.start_with?("#{File.realpath(root)}#{File::SEPARATOR}") && File.exist?(absolute) && File.lstat(absolute).file?
-
-    result << { "path" => relative, "sha256" => Digest::SHA256.hexdigest(File.binread(absolute)) }
+    # Keep required paths even when their files disappeared before prepare.
+    # Otherwise startup_preflight cannot distinguish missing evidence from a
+    # previous step that had no output obligations at all.
+    output = { "path" => relative, "sha256" => nil }
+    if absolute.start_with?("#{File.realpath(root)}#{File::SEPARATOR}") && File.exist?(absolute) && File.lstat(absolute).file? && File.realpath(absolute).start_with?("#{File.realpath(root)}#{File::SEPARATOR}")
+      output["sha256"] = Digest::SHA256.hexdigest(File.binread(absolute))
+    end
+    result << output
   end
   { "id" => step_id, "label" => step["label"].to_s, "outputs" => outputs }
 rescue StandardError
@@ -156,7 +161,8 @@ result = catch(:transition_done) do
       # is safe only when it belongs to this exact STATE revision and its
       # content hash still verifies.
       expected_state_revision = rollover["expected_state_revision"]
-      if expected_state_revision == revision || (expected_state_revision.is_a?(Integer) && expected_state_revision + 1 == revision)
+      prepared_revision = rollover.fetch("prepared_state_revision", expected_state_revision.is_a?(Integer) ? expected_state_revision + 1 : nil)
+      if expected_state_revision == revision || prepared_revision == revision
         existing_path, = DevflowControlIO.resolve_control_path(root, rollover["handoff_path"], :handoff)
         if File.exist?(existing_path) && Digest::SHA256.hexdigest(File.binread(existing_path)) == rollover["handoff_sha256"]
           result = { "ok" => true, "written" => false, "reused" => true, "rollover" => rollover, "revision" => revision }
@@ -216,7 +222,7 @@ result = catch(:transition_done) do
       state["rollover"] = {
         "id" => rollover_id, "status" => "prepared", "handoff_path" => relative_path,
         "handoff_sha256" => digest, "source_session_id" => options[:source_session_id],
-        "target_session_id" => nil, "expected_state_revision" => revision,
+        "target_session_id" => nil, "expected_state_revision" => revision, "prepared_state_revision" => revision + 1,
         "prepared_at" => iso_now, "claimed_at" => nil
       }
       state["revision"] = revision + 1
@@ -284,6 +290,7 @@ result = catch(:transition_done) do
       throw :transition_done, result
     end
     if options[:write]
+      rollover["prepared_state_revision"] = revision + 1
       rollover["status"] = "prepared"; rollover["target_session_id"] = nil; rollover["claimed_at"] = nil; rollover.delete("lease_expires_at"); rollover.delete("last_renewed_at")
       state["rollover"] = rollover; state["revision"] = revision + 1; write_state(state_path, state, raw); rebase_parallel_run(root, state, lock)
     end

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/startup_preflight.py

@@ -125,6 +125,14 @@ def startup_preflight(root: Path, feature: str, step: str,
                 except ValueError:
                     exists = False
                 input_facts.append({"path": rendered, "required": required, "exists": exists})
+                # Input readiness is independent of whether the caller supplied
+                # a frozen contract. Keep the derived contract view exempt, as
+                # review_preflight does, and avoid duplicating its diagnostics.
+                if (required and not exists
+                        and rendered != ".devflow/planning/execution-contract.md"
+                        and not any(issue.get("code") == "MISSING_INPUT_FACT"
+                                    and issue.get("path") == rendered for issue in issues)):
+                    issues.append({"code": "MISSING_INPUT_FACT", "path": rendered})
             facts["inputs"] = input_facts
             facts["outputs"] = [
                 render_path(item["path"], feature, phase)

package/plugins/devflow-intel/extensions/devflow-intel.ts

@@ -9,6 +9,14 @@ type ProcessResult = { ok: boolean; exitCode: number; stdout: string; stderr: st
 
 function resolveSkillRoot(cwd: string): string {
   const moduleDirectory = path.dirname(fileURLToPath(import.meta.url));
+  if (process.env.DEVFLOW_RUNTIME_MODE === "embedded") {
+    const pluginRoot = path.resolve(process.env.DEVFLOW_PLUGIN_ROOT || path.resolve(moduleDirectory, "../.."));
+    const packaged = path.join(pluginRoot, "devflow-intel", "skills");
+    if (!existsSync(path.join(packaged, "workflow-code-index/scripts/code_index.py"))) {
+      throw new Error("Embedded Devflow Pi intel skills are missing");
+    }
+    return packaged;
+  }
   const candidates = [
     process.env.DEVFLOW_KIT_ROOT,
     path.join(cwd, ".skills"),
@@ -57,12 +65,24 @@ async function run(command: string[], cwd: string): Promise<ProcessResult> {
   return { ok: exitCode === 0, exitCode, stdout: stdout.trim(), stderr: stderr.trim() };
 }
 
+const SYMBOL_ACTIONS = new Set(["query", "relations", "impact", "query-plan"]);
+
+/** A successful query with no matches prints nothing; say so instead of "Process exited with 0". */
+function emptyOutputMessage(result: ProcessResult, action: unknown): string {
+  if (!result.ok) return `命令执行失败，没有输出任何信息（退出码 ${result.exitCode}）。`;
+  if (SYMBOL_ACTIONS.has(String(action))) {
+    return "代码索引中没有匹配的结果。符号名多为英文类名、函数名或文件路径：请换用英文标识符再查，或用 action=search-content 按源码文本检索。";
+  }
+  if (action === "search-content") return "源码中没有找到匹配的文本。";
+  return "命令执行成功，但没有返回任何结果。";
+}
+
 function render(result: ProcessResult, details: Record<string, unknown>) {
   return {
     content: [
       {
         type: "text" as const,
-        text: result.stdout || result.stderr || `Process exited with ${result.exitCode}`,
+        text: result.stdout || result.stderr || emptyOutputMessage(result, details.action),
       },
     ],
     details: { ...details, exitCode: result.exitCode, stderr: result.stderr || undefined },
@@ -186,13 +206,15 @@ export default function devflowIntel(pi: ExtensionAPI) {
     parameters: z.object({ args: z.array(z.string()).default([]) }),
     approval: "exec",
     async execute(_id, params, _signal, _onUpdate, ctx) {
-      const skillRoot = resolveSkillRoot(ctx.cwd);
+      const projectRoot = resolveProjectRoot(ctx.cwd);
+      const skillRoot = resolveSkillRoot(projectRoot);
       const script = path.join(
         skillRoot,
         "workflow-context-sync/scripts/context_sync_cursor.py",
       );
-      return render(await run(["python3", script, ...params.args], ctx.cwd), {
+      return render(await run(["python3", script, ...params.args], projectRoot), {
         action: "context-cursor",
+        projectRoot,
       });
     },
   });

package/plugins/devflow-quality/runtime/playwright/explore-host.mjs

@@ -1,3 +1,32 @@
+// plugins/devflow-quality/runtime/playwright/src/text-match.ts
+function normalizeText(value, normalizeWhitespace, caseSensitive) {
+  let out = normalizeWhitespace ? value.replace(/\s+/g, " ").trim() : value;
+  if (!caseSensitive)
+    out = out.toLowerCase();
+  return out;
+}
+function textMatches(actual, expected, match) {
+  return match === "exact" ? actual === expected : actual.includes(expected);
+}
+
+// plugins/devflow-quality/runtime/playwright/src/explore/request-tracker.ts
+class RequestTracker {
+  pending = new Set;
+  started = (request) => {
+    if (["fetch", "xhr", "document"].includes(request.resourceType()))
+      this.pending.add(request);
+  };
+  finished = (request) => {
+    this.pending.delete(request);
+  };
+  get size() {
+    return this.pending.size;
+  }
+  clear() {
+    this.pending.clear();
+  }
+}
+
 // plugins/devflow-quality/runtime/playwright/src/explore/host.ts
 import readline from "node:readline";
 import fs2 from "node:fs";
@@ -565,7 +594,7 @@ class Recorder {
     this.feature = feature;
     this.environmentProfile = environmentProfile;
     this.startUrl = startUrl;
-    const initial = new URL(startUrl);
+    const initial = new URL(redactor.url(startUrl));
     this.steps.push({ action: "goto", url: `${initial.pathname}${initial.search}${initial.hash}` });
   }
   async unique(locator) {
@@ -706,7 +735,17 @@ class Recorder {
       exploration: { environment_profile: this.environmentProfile, start_url: this.redactor.url(this.startUrl), recorded_steps: steps.length, needs_manual: manual, review_items, steps: metadata }
     };
     const output = path.join(root, fileName);
-    const serialized = this.redactor.text(JSON.stringify(draft, null, 2));
+    const redactLiterals = (value) => {
+      if (typeof value === "string")
+        return this.redactor.text(value);
+      if (Array.isArray(value))
+        return value.map(redactLiterals);
+      if (value && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, redactLiterals(item)]));
+      }
+      return value;
+    };
+    const serialized = JSON.stringify(redactLiterals(draft), null, 2);
     await fs.writeFile(output, `${serialized}
 `, { mode: 384 });
     return { path: output, manual, review_items };
@@ -723,31 +762,18 @@ var redactor = null;
 var profileMemory = null;
 var idleTimer = null;
 var totalTimer = null;
-var inFlightRequests = 0;
-var requestStarted = null;
-var requestFinished = null;
+var requests = new RequestTracker;
 function installRequestCounter(currentContext) {
-  inFlightRequests = 0;
-  requestStarted = (request) => {
-    if (["fetch", "xhr", "document"].includes(request.resourceType()))
-      inFlightRequests++;
-  };
-  requestFinished = () => {
-    inFlightRequests = Math.max(0, inFlightRequests - 1);
-  };
-  currentContext.on("request", requestStarted);
-  currentContext.on("requestfinished", requestFinished);
-  currentContext.on("requestfailed", requestFinished);
+  requests.clear();
+  currentContext.on("request", requests.started);
+  currentContext.on("requestfinished", requests.finished);
+  currentContext.on("requestfailed", requests.finished);
 }
 function removeRequestCounter() {
-  if (context && requestStarted && requestFinished) {
-    context.off("request", requestStarted);
-    context.off("requestfinished", requestFinished);
-    context.off("requestfailed", requestFinished);
-  }
-  requestStarted = null;
-  requestFinished = null;
-  inFlightRequests = 0;
+  context?.off("request", requests.started);
+  context?.off("requestfinished", requests.finished);
+  context?.off("requestfailed", requests.finished);
+  requests.clear();
 }
 function reply(id, result) {
   process.stdout.write(`${JSON.stringify({ id, ok: true, result })}
@@ -805,7 +831,7 @@ async function settle(currentPage) {
   let quietSince = 0;
   let previousSnapshot = null;
   while (Date.now() < deadline) {
-    if (inFlightRequests === 0) {
+    if (requests.size === 0) {
       if (!quietSince)
         quietSince = Date.now();
       if (Date.now() - quietSince >= 500) {
@@ -922,24 +948,25 @@ async function doAssert(request) {
   const match = request.params?.match === "contains" ? "contains" : "exact";
   const normalizeWhitespace = request.params?.normalize_whitespace !== false;
   const caseSensitive = request.params?.case_sensitive !== false;
+  const matchesText = (actual, expected2) => textMatches(normalizeText(actual, normalizeWhitespace, caseSensitive), normalizeText(expected2, normalizeWhitespace, caseSensitive), match);
   if (kind === "visible") {
     if (!await locator.isVisible())
       throw Object.assign(new Error("element is not visible"), { code: "assertion_failed" });
   } else if (kind === "value") {
     const actual = await locator.inputValue();
     expected = String(requested ?? actual);
-    if (actual !== expected)
+    if (!matchesText(actual, expected))
       throw Object.assign(new Error(`value assertion failed: expected ${current.redactor.text(expected)}`), { code: "assertion_failed" });
   } else if (kind === "text") {
     const actual = await locator.innerText();
     expected = String(requested ?? actual.trim());
-    const matches = match === "contains" ? actual.includes(expected) : actual.trim() === expected;
+    const matches = matchesText(actual, expected);
     if (!matches)
       throw Object.assign(new Error(`text assertion failed: expected ${current.redactor.text(expected)}`), { code: "assertion_failed" });
   } else if (kind === "each_text") {
     const actual = await locator.allInnerTexts();
     expected = typeof requested === "string" ? requested : actual[0]?.trim() ?? "";
-    const matches = actual.every((item) => match === "contains" ? item.includes(expected) : item.trim() === expected);
+    const matches = actual.length > 0 && actual.every((item) => matchesText(item, expected));
     if (!matches)
       throw Object.assign(new Error("each_text assertion failed"), { code: "assertion_failed" });
   } else {

package/plugins/devflow-quality/runtime/playwright/runner.spec.mjs

@@ -227,6 +227,7 @@ var API_ACTIONS = new Set(["request"]);
 var BUILTIN_VARIABLES = new Set(["execution_id", "namespace"]);
 var VAR_REF = /\$\{([^}]*)\}/g;
 var VAR_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,63}$/;
+var SECRET_HEADERS = new Set(["authorization", "proxy-authorization", "cookie", "x-api-key", "x-auth-token"]);
 var FRAGILE_CSS = [
   /el-table_\d+(?:_column_\d+)?/,
   /:nth-(?:last-)?(?:child|of-type)\(/,
@@ -245,6 +246,15 @@ function collectRefs(value, out = new Set) {
   }
   return out;
 }
+function unterminatedRefs(value, at, issues) {
+  if (typeof value === "string") {
+    if (value.replace(VAR_REF, "").includes("${"))
+      issues.push({ path: at, message: "unterminated variable reference" });
+  } else if (value && typeof value === "object") {
+    for (const [key, child] of Object.entries(value))
+      unterminatedRefs(child, `${at}/${key}`, issues);
+  }
+}
 function validateDsl(dsl, schema) {
   const issues = new SchemaValidator(schema).validate(dsl);
   if (issues.length)
@@ -261,6 +271,7 @@ function semanticIssues(dsl) {
   const ids = new Set;
   const screenshotNames = new Set;
   const defined = new Set([...BUILTIN_VARIABLES, ...Object.keys(dsl.variables)]);
+  const sensitive = new Set(Object.entries(dsl.variables).filter(([, variable]) => variable.secret !== undefined || variable.sensitive === true).map(([name]) => name));
   for (const name of Object.keys(dsl.variables)) {
     if (BUILTIN_VARIABLES.has(name))
       issues.push({ path: `/variables/${name}`, message: "shadows a built-in variable" });
@@ -270,6 +281,7 @@ function semanticIssues(dsl) {
     if (refs.size)
       issues.push({ path: `/variables/${name}`, message: "variable values must be literals" });
   }
+  unterminatedRefs(dsl.data.namespace, "/data/namespace", issues);
   for (const ref of collectRefs(dsl.data.namespace)) {
     if (ref !== "execution_id")
       issues.push({ path: "/data/namespace", message: `namespace may only reference \${execution_id}, got \${${ref}}` });
@@ -283,6 +295,8 @@ function semanticIssues(dsl) {
       const allowed = step.driver === "api" ? API_ACTIONS : UI_ACTIONS;
       if (!allowed.has(step.action))
         issues.push({ path: `${at}/action`, message: `unknown action ${step.action}` });
+      const payload = Object.fromEntries(Object.entries(step).filter(([key]) => !["id", "driver", "action", "covers", "extract", "assertions", "retry"].includes(key)));
+      unterminatedRefs(payload, at, issues);
       for (const ref of collectRefs(step)) {
         if (!VAR_NAME.test(ref))
           issues.push({ path: at, message: `malformed variable reference \${${ref}}` });
@@ -298,6 +312,7 @@ function semanticIssues(dsl) {
       if (step.driver === "api") {
         const assertions = step.assertions ?? [];
         assertions.forEach((a, i) => {
+          unterminatedRefs(a.value, `${at}/assertions/${i}/value`, issues);
           const needsValue = a.op !== "exists" && a.op !== "not_exists";
           if (needsValue && !("value" in a))
             issues.push({ path: `${at}/assertions/${i}`, message: `op ${a.op} requires value` });
@@ -308,11 +323,21 @@ function semanticIssues(dsl) {
         if (step.retry && (method === "POST" || method === "PATCH") && step.idempotent !== true) {
           issues.push({ path: `${at}/retry`, message: `${method} retry requires idempotent=true` });
         }
-        for (const name of Object.keys(step.extract ?? {})) {
-          if (BUILTIN_VARIABLES.has(name) || name in dsl.variables) {
-            issues.push({ path: `${at}/extract/${name}`, message: "extract may not overwrite a declared or built-in variable" });
+        for (const [header, value] of Object.entries(step.headers ?? {})) {
+          if (!SECRET_HEADERS.has(header.toLowerCase()))
+            continue;
+          const refs = collectRefs(value);
+          if (!refs.size || [...refs].some((name) => !sensitive.has(name))) {
+            issues.push({ path: `${at}/headers/${header}`, message: "must be built only from secret or sensitive variables" });
+          }
+        }
+        for (const [name, spec] of Object.entries(step.extract ?? {})) {
+          if (defined.has(name)) {
+            issues.push({ path: `${at}/extract/${name}`, message: "extract may not overwrite an existing variable" });
           }
           defined.add(name);
+          if (spec.sensitive === true || spec.header !== undefined && spec.sensitive !== false)
+            sensitive.add(name);
         }
       } else if (step.target && typeof step.target === "object") {
         semanticTargetIssues(step.target, `${at}/target`, issues, step.action);
@@ -769,6 +794,17 @@ async function executeApi(step, ctx) {
   return details;
 }
 
+// plugins/devflow-quality/runtime/playwright/src/text-match.ts
+function normalizeText(value, normalizeWhitespace, caseSensitive) {
+  let out = normalizeWhitespace ? value.replace(/\s+/g, " ").trim() : value;
+  if (!caseSensitive)
+    out = out.toLowerCase();
+  return out;
+}
+function textMatches(actual, expected, match) {
+  return match === "exact" ? actual === expected : actual.includes(expected);
+}
+
 // plugins/devflow-quality/runtime/playwright/src/ui.ts
 import path from "node:path";
 import fs from "node:fs";
@@ -995,15 +1031,6 @@ function resolveNavigationUrl(raw, ctx) {
     throw new StepFailure("blocked", "invalid_url", `goto url must be absolute or start with '/': ${ctx.redactor.text(url)}`);
   }
 }
-function normalizeText(value, normalizeWhitespace, caseSensitive) {
-  let out = normalizeWhitespace ? value.replace(/\s+/g, " ").trim() : value;
-  if (!caseSensitive)
-    out = out.toLowerCase();
-  return out;
-}
-function textMatches(actual, expected, match) {
-  return match === "exact" ? actual === expected : actual.includes(expected);
-}
 async function executeUi(step, ctx) {
   const page = ctx.page;
   const defaultTimeout = step.action === "goto" ? DEFAULT_NAVIGATION_TIMEOUT_MS : DEFAULT_UI_TIMEOUT_MS;
@@ -1477,8 +1504,8 @@ async function executeRun(page, runtimeDir) {
   } catch {
     return outcome({ status: "invalid", error_code: "dsl_not_json", dsl_sha256: dslSha, started_at: startedAt }, redactor);
   }
-  const allSteps = [...dsl?.data?.setup ?? [], ...dsl?.steps ?? [], ...dsl?.data?.cleanup ?? []];
-  const unknown = Array.isArray(allSteps) && allSteps.some((s) => {
+  const allSteps = [dsl?.data?.setup, dsl?.steps, dsl?.data?.cleanup].flatMap((steps) => Array.isArray(steps) ? steps : []);
+  const unknown = allSteps.some((s) => {
     const set = s?.driver === "api" ? API_ACTIONS : s?.driver === "ui" ? UI_ACTIONS : null;
     return !set || !set.has(s?.action);
   });

package/plugins/devflow-quality/runtime/playwright/runtime-manifest.json

@@ -3,10 +3,10 @@
   "runtime_version": "0.1.0",
   "playwright_version": "1.63.0",
   "files": {
-    "runner.spec.mjs": "abf0c5c9aff43b4f233de4c44db0946001c970758ef63ab861fad1d125c1a6fc",
+    "runner.spec.mjs": "25910031e9d9b413843a19c2ac5496b2109546e40283bb68dd9aa2ac9b97b743",
     "playwright.config.mjs": "301c0b97e229f83e6934994718b11b93a1da5d46ec606cfd11a8292e9d622b02",
     "reporter.mjs": "5c91d68c50a93603f583cf82345d427bcd9ce9a7cfb78fd6d0989abddbd55275",
-    "explore-host.mjs": "035ea37f40cef7399e7038537f3f03d42baffe9d2db32d9bf8add25b0d81118e",
+    "explore-host.mjs": "686474bcbe9af1151849e4e25266d60e01e8a49162511c49e071c5ec60a65979",
     "devflow-test-dsl-v1.schema.json": "df07e55507697a70df214ae820403b530b04aeb04a12d0aa85715bf5e528e194"
   }
 }

package/src/constants.ts

@@ -1,5 +1,5 @@
 export const PRODUCT_NAME = "Devflow Pi";
-export const PRODUCT_VERSION = "0.1.98";
+export const PRODUCT_VERSION = "0.1.99";
 export const PROJECT_SCHEMA_VERSION = 1;
 export const OMP_RUNTIME_VERSION = "17.2.7";