@piwitests/reporter 0.21.0 → 0.22.0

package/dist/cli/index.js

@@ -26,7 +26,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 // src/cli/gate.ts
 var fs = __toESM(require("fs"));
 
-// ../packages/core/src/gate.ts
+// ../core/src/gate.ts
 function formatGateResult(result) {
   const { facts } = result;
   const lines = [

package/dist/global-setup-module.js

@@ -222,6 +222,32 @@ var HttpClient = class {
     this.serverUrl = serverUrl;
     this.logger = logger;
     this.timeout = timeout;
+    this.warnIfInsecureTransport();
+  }
+  /**
+   * Warn once when the dashboard URL is plaintext `http://` to a non-loopback
+   * host. The reporter sends the API key as a Bearer token — and uploads
+   * captured test data, including request URLs whose query strings the server
+   * only strips after receipt — over this connection, so a non-TLS remote
+   * endpoint exposes the key and payloads on the wire. Loopback (localhost /
+   * 127.0.0.1 / ::1) is exempt: that traffic never leaves the machine. This
+   * warns rather than refuses so internal HTTP deployments (e.g. behind a VPN)
+   * still work, but the exposure is no longer silent.
+   */
+  warnIfInsecureTransport() {
+    let url;
+    try {
+      url = new import_node_url.URL(this.serverUrl);
+    } catch {
+      return;
+    }
+    if (url.protocol !== "http:") return;
+    const host = url.hostname.toLowerCase();
+    const isLoopback = host === "localhost" || host.endsWith(".localhost") || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+    if (isLoopback) return;
+    this.logger.warn(
+      `Dashboard URL ${this.serverUrl} uses plaintext http:// \u2014 the API key and captured test data are transmitted unencrypted. Use https:// for any non-local server.`
+    );
   }
   /** Base URL of the Piwi Dashboard server this client talks to (used to print run links). */
   get baseUrl() {

package/dist/index.js

@@ -245,6 +245,32 @@ var HttpClient = class {
     this.serverUrl = serverUrl;
     this.logger = logger;
     this.timeout = timeout;
+    this.warnIfInsecureTransport();
+  }
+  /**
+   * Warn once when the dashboard URL is plaintext `http://` to a non-loopback
+   * host. The reporter sends the API key as a Bearer token — and uploads
+   * captured test data, including request URLs whose query strings the server
+   * only strips after receipt — over this connection, so a non-TLS remote
+   * endpoint exposes the key and payloads on the wire. Loopback (localhost /
+   * 127.0.0.1 / ::1) is exempt: that traffic never leaves the machine. This
+   * warns rather than refuses so internal HTTP deployments (e.g. behind a VPN)
+   * still work, but the exposure is no longer silent.
+   */
+  warnIfInsecureTransport() {
+    let url;
+    try {
+      url = new import_node_url.URL(this.serverUrl);
+    } catch {
+      return;
+    }
+    if (url.protocol !== "http:") return;
+    const host = url.hostname.toLowerCase();
+    const isLoopback = host === "localhost" || host.endsWith(".localhost") || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+    if (isLoopback) return;
+    this.logger.warn(
+      `Dashboard URL ${this.serverUrl} uses plaintext http:// \u2014 the API key and captured test data are transmitted unencrypted. Use https:// for any non-local server.`
+    );
   }
   /** Base URL of the Piwi Dashboard server this client talks to (used to print run links). */
   get baseUrl() {
@@ -1572,7 +1598,7 @@ var StreamManager = class {
   }
 };
 
-// ../packages/core/src/step-analysis.ts
+// ../core/src/step-analysis.ts
 function categorizeStep(title, pwCategory) {
   if (!title) return "other";
   if (pwCategory === "hook" || pwCategory === "fixture") return pwCategory;
@@ -2016,7 +2042,7 @@ function wrapConfig(config, piwiOptions) {
   };
 }
 
-// ../packages/core/src/status-classify.ts
+// ../core/src/status-classify.ts
 function mergeAnnotations(test, result) {
   const out = [];
   const seen = /* @__PURE__ */ new Set();
@@ -2036,7 +2062,7 @@ function classifyStatus(rawStatus, annotations) {
   return intentional ? "skipped" : "didnotrun";
 }
 
-// ../packages/core/src/test-meta.ts
+// ../core/src/test-meta.ts
 var PIWI_ANNOTATION_PREFIX = "piwi:";
 var TEST_PRIORITIES = ["critical", "high", "medium", "low"];
 var MAX_TEST_TAGS = 20;
@@ -2123,7 +2149,7 @@ function collectTestMetadata(annotations) {
 // src/internal/collect/error-text.ts
 var path12 = __toESM(require("path"));
 
-// ../packages/core/src/error-text.ts
+// ../core/src/error-text.ts
 function joinErrorMessages(errors) {
   if (!errors || errors.length === 0) return null;
   const seen = /* @__PURE__ */ new Set();
@@ -2766,7 +2792,7 @@ var PiwiDashboardReporter = class {
 // src/internal/capture/capture-fixtures.ts
 var import_node_zlib = require("zlib");
 
-// ../packages/picker-dom/src/probe.ts
+// ../picker-dom/src/probe.ts
 function probeElementAttrs(el, arg) {
   const { keep, tagRoles, inputRoles, roleSources, includeStructural, includeLabelText } = arg;
   const attrMap = {};
@@ -3052,7 +3078,7 @@ function probeElementAttrs(el, arg) {
   };
 }
 
-// ../packages/picker-dom/src/overlay-element.ts
+// ../picker-dom/src/overlay-element.ts
 function installPickerOverlay(arg) {
   const g = globalThis;
   const doc = g.document;
@@ -3329,7 +3355,7 @@ function installPickerOverlay(arg) {
   }
 }
 
-// ../packages/picker-dom/src/overlay-anchors.ts
+// ../picker-dom/src/overlay-anchors.ts
 function showAnchorPicker(arg) {
   const g = globalThis;
   const doc = g.document;
@@ -3592,7 +3618,7 @@ function showAnchorPicker(arg) {
   doc.body.appendChild(panel);
 }
 
-// ../packages/picker-dom/src/overlay-confirm.ts
+// ../picker-dom/src/overlay-confirm.ts
 function showPickerChoices(arg) {
   const g = globalThis;
   const doc = g.document;
@@ -3675,7 +3701,7 @@ function showPickerChoices(arg) {
   doc.body.appendChild(wrap);
 }
 
-// ../packages/core/src/locator-generation.ts
+// ../core/src/locator-generation.ts
 var TAG_TO_ROLE = {
   a: "link",
   button: "button",
@@ -4026,7 +4052,7 @@ function approximateAccessibleName(attrs) {
   return null;
 }
 
-// ../packages/picker-dom/src/anchor-alternatives.ts
+// ../picker-dom/src/anchor-alternatives.ts
 var escStr = (s) => s.replaceAll("\\", "\\\\").replaceAll("'", "\\'");
 var cssIdSelector = (id) => /^[A-Za-z_][A-Za-z0-9_-]*$/.test(id) ? `#${id}` : `[id="${id.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"]`;
 var ANCHOR_KIND_SCORES = { testid: 80, id: 74, labeledRole: 68, role: 62 };
@@ -4105,7 +4131,7 @@ function mergeCandidates(base, extra) {
 // src/internal/capture/locator-healing.ts
 var path15 = __toESM(require("path"));
 
-// ../packages/core/src/locator-fingerprint.ts
+// ../core/src/locator-fingerprint.ts
 var PRESENT_SIMILARITY = 0.8;
 var MATCH_SIMILARITY = 0.2;
 function parseAriaCandidates(ariaSnapshot) {
@@ -4171,7 +4197,7 @@ function matchRenamedElement(fp, candidates) {
   return null;
 }
 
-// ../packages/core/src/locator-methods.ts
+// ../core/src/locator-methods.ts
 var LOCATOR_BUILDER_METHODS = [
   "getByRole",
   "getByTestId",

package/dist/internal/capture/capture-fixtures.js

@@ -41,7 +41,7 @@ __export(capture_fixtures_exports, {
 module.exports = __toCommonJS(capture_fixtures_exports);
 var import_node_zlib = require("zlib");
 
-// ../packages/picker-dom/src/probe.ts
+// ../picker-dom/src/probe.ts
 function probeElementAttrs(el, arg) {
   const { keep, tagRoles, inputRoles, roleSources, includeStructural, includeLabelText } = arg;
   const attrMap = {};
@@ -327,7 +327,7 @@ function probeElementAttrs(el, arg) {
   };
 }
 
-// ../packages/picker-dom/src/overlay-element.ts
+// ../picker-dom/src/overlay-element.ts
 function installPickerOverlay(arg) {
   const g = globalThis;
   const doc = g.document;
@@ -604,7 +604,7 @@ function installPickerOverlay(arg) {
   }
 }
 
-// ../packages/picker-dom/src/overlay-anchors.ts
+// ../picker-dom/src/overlay-anchors.ts
 function showAnchorPicker(arg) {
   const g = globalThis;
   const doc = g.document;
@@ -867,7 +867,7 @@ function showAnchorPicker(arg) {
   doc.body.appendChild(panel);
 }
 
-// ../packages/picker-dom/src/overlay-confirm.ts
+// ../picker-dom/src/overlay-confirm.ts
 function showPickerChoices(arg) {
   const g = globalThis;
   const doc = g.document;
@@ -950,7 +950,7 @@ function showPickerChoices(arg) {
   doc.body.appendChild(wrap);
 }
 
-// ../packages/core/src/locator-generation.ts
+// ../core/src/locator-generation.ts
 var TAG_TO_ROLE = {
   a: "link",
   button: "button",
@@ -1301,7 +1301,7 @@ function approximateAccessibleName(attrs) {
   return null;
 }
 
-// ../packages/picker-dom/src/anchor-alternatives.ts
+// ../picker-dom/src/anchor-alternatives.ts
 var escStr = (s) => s.replaceAll("\\", "\\\\").replaceAll("'", "\\'");
 var cssIdSelector = (id) => /^[A-Za-z_][A-Za-z0-9_-]*$/.test(id) ? `#${id}` : `[id="${id.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"]`;
 var ANCHOR_KIND_SCORES = { testid: 80, id: 74, labeledRole: 68, role: 62 };
@@ -1380,7 +1380,7 @@ function mergeCandidates(base, extra) {
 // src/internal/capture/locator-healing.ts
 var path = __toESM(require("path"));
 
-// ../packages/core/src/locator-fingerprint.ts
+// ../core/src/locator-fingerprint.ts
 var PRESENT_SIMILARITY = 0.8;
 var MATCH_SIMILARITY = 0.2;
 function parseAriaCandidates(ariaSnapshot) {
@@ -1446,7 +1446,7 @@ function matchRenamedElement(fp, candidates) {
   return null;
 }
 
-// ../packages/core/src/locator-methods.ts
+// ../core/src/locator-methods.ts
 var LOCATOR_BUILDER_METHODS = [
   "getByRole",
   "getByTestId",

package/dist/internal/capture/locator-healing.js

@@ -54,7 +54,7 @@ __export(locator_healing_exports, {
 module.exports = __toCommonJS(locator_healing_exports);
 var path = __toESM(require("path"));
 
-// ../packages/core/src/locator-fingerprint.ts
+// ../core/src/locator-fingerprint.ts
 var PRESENT_SIMILARITY = 0.8;
 var MATCH_SIMILARITY = 0.2;
 function parseAriaCandidates(ariaSnapshot) {
@@ -120,7 +120,7 @@ function matchRenamedElement(fp, candidates) {
   return null;
 }
 
-// ../packages/core/src/locator-methods.ts
+// ../core/src/locator-methods.ts
 var LOCATOR_BUILDER_METHODS = [
   "getByRole",
   "getByTestId",
@@ -132,7 +132,7 @@ var LOCATOR_BUILDER_METHODS = [
   "locator"
 ];
 
-// ../packages/core/src/locator-generation.ts
+// ../core/src/locator-generation.ts
 var TAG_TO_ROLE = {
   a: "link",
   button: "button",

package/dist/internal/capture/pick-on-failure.js

@@ -43,7 +43,7 @@ __export(pick_on_failure_exports, {
 module.exports = __toCommonJS(pick_on_failure_exports);
 var path2 = __toESM(require("path"));
 
-// ../packages/picker-dom/src/overlay-element.ts
+// ../picker-dom/src/overlay-element.ts
 function installPickerOverlay(arg) {
   const g = globalThis;
   const doc = g.document;
@@ -320,7 +320,7 @@ function installPickerOverlay(arg) {
   }
 }
 
-// ../packages/picker-dom/src/overlay-anchors.ts
+// ../picker-dom/src/overlay-anchors.ts
 function showAnchorPicker(arg) {
   const g = globalThis;
   const doc = g.document;
@@ -583,7 +583,7 @@ function showAnchorPicker(arg) {
   doc.body.appendChild(panel);
 }
 
-// ../packages/picker-dom/src/overlay-confirm.ts
+// ../picker-dom/src/overlay-confirm.ts
 function showPickerChoices(arg) {
   const g = globalThis;
   const doc = g.document;
@@ -666,7 +666,7 @@ function showPickerChoices(arg) {
   doc.body.appendChild(wrap);
 }
 
-// ../packages/core/src/locator-generation.ts
+// ../core/src/locator-generation.ts
 var TAG_TO_ROLE = {
   a: "link",
   button: "button",
@@ -1002,7 +1002,7 @@ function approximateAccessibleName(attrs) {
   return null;
 }
 
-// ../packages/picker-dom/src/anchor-alternatives.ts
+// ../picker-dom/src/anchor-alternatives.ts
 var escStr = (s) => s.replaceAll("\\", "\\\\").replaceAll("'", "\\'");
 var cssIdSelector = (id) => /^[A-Za-z_][A-Za-z0-9_-]*$/.test(id) ? `#${id}` : `[id="${id.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"]`;
 var ANCHOR_KIND_SCORES = { testid: 80, id: 74, labeledRole: 68, role: 62 };
@@ -1081,7 +1081,7 @@ function mergeCandidates(base, extra) {
 // src/internal/capture/locator-healing.ts
 var path = __toESM(require("path"));
 
-// ../packages/core/src/locator-methods.ts
+// ../core/src/locator-methods.ts
 var LOCATOR_BUILDER_METHODS = [
   "getByRole",
   "getByTestId",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piwitests/reporter",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "description": "Playwright reporter that streams results, traces and HTML reports to a Piwi Dashboard instance",
   "url": "https://github.com/PiwiTests/platform",
   "homepage": "https://piwitests.github.io",

package/templates/skills/investigate-failure/SKILL.md

@@ -27,7 +27,7 @@ Prefer the **Piwi MCP server** if it is connected to this agent (tools named `li
 
 7. **Verify.** Re-run the affected spec(s): `npx playwright test <file>`. Confirm they pass and the new run is green in the dashboard (`get_run_insights` compares against the last green run: regressions cleared, nothing new broken).
 
-8. **Close the loop (optional).** With reporter/admin access, `set_cluster_status` marks the cluster resolved with a note so it drops off the triage queue.
+8. **Close the loop (optional).** With packages/reporter/admin access, `set_cluster_status` marks the cluster resolved with a note so it drops off the triage queue.
 
 ## Guardrails