@skyramp/mcp 0.4.4 → 0.5.0-rc.10

package/node_modules/playwright/lib/mcp/skyramp/dataSafetySession.js

@@ -0,0 +1,372 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var dataSafetySession_exports = {};
+__export(dataSafetySession_exports, {
+  DataSafetySession: () => DataSafetySession,
+  assertNoNetworkPolicyCollision: () => assertNoNetworkPolicyCollision
+});
+module.exports = __toCommonJS(dataSafetySession_exports);
+var import_utilsBundle = require("playwright-core/lib/utilsBundle");
+var import_dataSafetyGuard = require("./dataSafetyGuard");
+const traceDebug = (0, import_utilsBundle.debug)("pw:mcp:trace");
+function originalRequestHeaders(req) {
+  let first = req;
+  for (let prev = first.redirectedFrom(); prev; prev = prev.redirectedFrom())
+    first = prev;
+  return first.headers();
+}
+function assertNoNetworkPolicyCollision(network, guardActive) {
+  if (guardActive && (network?.allowedOrigins?.length || network?.blockedOrigins?.length))
+    throw new Error("data safety guard cannot compose with network.allowedOrigins/blockedOrigins yet \u2014 the create-capture path cannot fall back");
+}
+class DataSafetySession {
+  constructor(_guard, _requestProvenance) {
+    this._guard = _guard;
+    this._requestProvenance = _requestProvenance;
+    // response.text() reads in flight from the 'response' listener below —
+    // export/teardown/ledgerJson must settle these first or a POST that just
+    // barely raced past export can be missed entirely (dropped promise). Keyed
+    // by the promise, valued by the request URL — settleBodyReads needs to
+    // name WHICH create(s) are still in flight when it times out, not just
+    // how many.
+    this._pendingBodyReads = /* @__PURE__ */ new Map();
+    // Requests whose create-response body was captured synchronously in the
+    // route handler (route.fetch -> fulfill) — the 'response' listener must not
+    // record them a second time. WeakSet: entries die with their requests.
+    this._routeCapturedRequests = /* @__PURE__ */ new WeakSet();
+    // Each redirect hop is a separate Request. Preserve the original POST's
+    // snapshot even when later hops or response bodies arrive in another phase.
+    // Request-start snapshot of action provenance + the request's own
+    // resourceType, keyed by Request so every later observation of the same
+    // request (route capture, deferred read, redirect hop) reads one value.
+    this._contextByRequest = /* @__PURE__ */ new WeakMap();
+  }
+  static {
+    /**
+     * Bounds _captureCreateAtRoute's route.fetch — overridable in tests (same
+     * pattern as settleTimeoutMs) so a synthetic never-responding POST route
+     * doesn't have to eat the full production timeout.
+     */
+    this.routeFetchTimeoutMs = 3e4;
+  }
+  get guard() {
+    return this._guard;
+  }
+  /** Whether the guard would actually do anything — mode 'strict' or 'readonly', or offLimits configured even in mode 'off'. */
+  get active() {
+    return this._guard.config.mode !== "off" || this._guard.config.offLimits.length > 0;
+  }
+  get hasLiveContext() {
+    return !!this._activeBrowserContext;
+  }
+  /** The live BrowserContext, when there is one — teardown's own request context, and a hook for tests that drive the page directly. */
+  get browserContext() {
+    return this._activeBrowserContext;
+  }
+  /** Track a newly-created BrowserContext as "live" until it closes. Called by install(); also usable on its own. */
+  noteContext(browserContext) {
+    this._activeBrowserContext = browserContext;
+    browserContext.on("close", () => {
+      if (this._activeBrowserContext === browserContext)
+        this._activeBrowserContext = void 0;
+    });
+  }
+  /**
+   * Wire the guard into a live BrowserContext: route interception (classify
+   * + route-time create-body capture), the response listener (redirect
+   * detection + deferred create-body reads), and the WebSocket blocker.
+   * Always tracks the context (noteContext) even when the guard is inert —
+   * teardown/prepareExport still need to know whether a context is live.
+   */
+  async install(browserContext) {
+    this.noteContext(browserContext);
+    if (!this.active)
+      return;
+    this._guard.flush();
+    browserContext.on("request", (req) => {
+      if (req.method().toUpperCase() === "POST" && this._guard.config.mode === "strict")
+        this._contextForRequest(req);
+    });
+    await browserContext.route("**", async (route) => {
+      const req = route.request();
+      const verdict = this._guard.classify(req.method(), req.url(), req.postData());
+      if (verdict === "ALLOW") {
+        if (this._guard.shouldCaptureCreateBody(req.method(), req.url())) {
+          const capture = this._captureCreateAtRoute(route);
+          this._pendingBodyReads.set(capture, req.url());
+          capture.finally(() => this._pendingBodyReads.delete(capture));
+          return capture;
+        }
+        return route.fallback();
+      }
+      const rule = (0, import_dataSafetyGuard.blockReason)(verdict, this._guard.config.mode);
+      this._guard.recordBlock({ url: req.url(), method: req.method(), verdict, rule });
+      traceDebug(`data safety blocked ${req.method()} ${req.url()} (${verdict})`);
+      return route.abort("blockedbyclient");
+    });
+    browserContext.on("response", (response) => {
+      const req = response.request();
+      const status = response.status();
+      if (req.method().toUpperCase() !== "POST")
+        this._guard.noteEntityResponse(req.method(), req.url(), status);
+      if (status >= 300 && status < 400) {
+        this._guard.noteRedirect(req.method(), req.url(), status, response.headers()["location"] ?? null);
+        if (req.method().toUpperCase() === "POST" && this._guard.config.mode === "strict" && !this._routeCapturedRequests.has(req))
+          this._guard.recordResponse(req.method(), req.url(), status, response.headers()["location"] ?? null, null, response.headers()["content-type"] ?? null, this._contextForRequest(req), originalRequestHeaders(req));
+        return;
+      }
+      if (req.method().toUpperCase() !== "POST" || this._guard.config.mode !== "strict")
+        return;
+      if (this._routeCapturedRequests.has(req))
+        return;
+      const context = this._contextForRequest(req);
+      const requestHeaders = originalRequestHeaders(req);
+      const bodyRead = response.text().then((body) => {
+        this._guard.recordResponse(req.method(), req.url(), status, response.headers()["location"] ?? null, body, response.headers()["content-type"] ?? null, context, requestHeaders);
+      }).catch(() => {
+        this._guard.recordResponse(req.method(), req.url(), status, response.headers()["location"] ?? null, null, response.headers()["content-type"] ?? null, context, requestHeaders);
+      });
+      this._pendingBodyReads.set(bodyRead, req.url());
+      bodyRead.finally(() => this._pendingBodyReads.delete(bodyRead));
+    });
+    const mode = this._guard.config.mode;
+    if (mode !== "off") {
+      await browserContext.routeWebSocket("**", (ws) => {
+        this._guard.recordBlock({ url: ws.url(), method: "WEBSOCKET", verdict: "BLOCK_FOREIGN_MUTATION", rule: `websocket blocked (mode=${mode})` });
+        traceDebug(`data safety blocked websocket ${ws.url()}`);
+        void ws.close({ code: 1008, reason: `blocked by data safety (mode=${mode})` });
+      });
+    } else {
+      const offLimits = (0, import_dataSafetyGuard.compileOffLimits)(this._guard.config.offLimits);
+      await browserContext.routeWebSocket((url) => offLimits(url.toString()), (ws) => {
+        this._guard.recordBlock({ url: ws.url(), method: "WEBSOCKET", verdict: "BLOCK_DENYLISTED", rule: (0, import_dataSafetyGuard.blockReason)("BLOCK_DENYLISTED", mode) });
+        traceDebug(`data safety blocked off-limits websocket ${ws.url()}`);
+        void ws.close({ code: 1008, reason: "blocked by data safety (off-limits)" });
+      });
+    }
+  }
+  /**
+   * The create-request context for `req`, fixed on first sight. A redirect
+   * hop is a distinct Request object in Playwright, but it is the SAME
+   * create from the page's point of view — so a hop inherits the original
+   * request's whole context (action provenance AND resourceType) rather
+   * than re-snapshotting either.
+   */
+  _contextForRequest(req) {
+    let context = this._contextByRequest.get(req);
+    if (!context) {
+      const redirectedFrom = req.redirectedFrom();
+      context = redirectedFrom ? this._contextForRequest(redirectedFrom) : { ...this._requestProvenance(), resourceType: req.resourceType() };
+      this._contextByRequest.set(req, context);
+    }
+    return context;
+  }
+  /**
+   * Fetch a strict-mode ledgerable create ourselves, record its body, then
+   * hand the buffered response to the page (route.fetch → fulfill). Never
+   * rejects — the route always gets an answer.
+   *
+   * Failure handling is asymmetric on purpose: once route.fetch has been
+   * issued, the server may have processed the create even when the fetch
+   * errors (e.g. a timeout mid-response), so falling back to
+   * route.continue() could SEND THE CREATE TWICE. Abort instead (the app
+   * sees an ordinary network failure) and record the attempt in the
+   * unparsed-create audit (status 0 = never completed) so the export still
+   * surfaces it.
+   */
+  async _captureCreateAtRoute(route) {
+    const req = route.request();
+    const context = this._contextForRequest(req);
+    let fetched;
+    const TIMED_OUT = Symbol("data-safety-route-fetch-timeout");
+    let timer;
+    try {
+      const timeout = new Promise((resolve) => {
+        timer = setTimeout(() => resolve(TIMED_OUT), DataSafetySession.routeFetchTimeoutMs);
+        timer.unref?.();
+      });
+      const result = await Promise.race([route.fetch({ maxRedirects: 0 }), timeout]);
+      if (result === TIMED_OUT) {
+        this._guard.recordUnparsedCreate(req.url(), 0, void 0, "capture-timeout");
+        traceDebug(`data safety: route.fetch timed out for ${req.url()} after ${DataSafetySession.routeFetchTimeoutMs}ms \u2014 aborting (strict mode cannot record SSE/long-poll-over-POST endpoints)`);
+        await route.abort("timedout").catch((e) => traceDebug(`data safety: route.abort failed for ${req.url()}: ${e}`));
+        return;
+      }
+      fetched = result;
+    } catch (e) {
+      this._guard.recordUnparsedCreate(req.url(), 0, void 0, "capture-failed");
+      traceDebug(`data safety: route.fetch failed for ${req.url()} \u2014 aborting to avoid a double send: ${e}`);
+      await route.abort("failed").catch((abortError) => traceDebug(`data safety: route.abort failed for ${req.url()}: ${abortError}`));
+      return;
+    } finally {
+      if (timer)
+        clearTimeout(timer);
+    }
+    let body = null;
+    try {
+      body = await fetched.text();
+    } catch {
+    }
+    this._guard.recordResponse("POST", req.url(), fetched.status(), fetched.headers()["location"] ?? null, body, fetched.headers()["content-type"] ?? null, context, originalRequestHeaders(req));
+    this._routeCapturedRequests.add(req);
+    await route.fulfill({ response: fetched }).catch((e) => traceDebug(`data safety: route.fulfill failed for ${req.url()}: ${e}`));
+  }
+  static {
+    /**
+     * Overridable in tests (module/class-level, not a constructor param —
+     * every call site shares one session-lifetime timeout) so a synthetic
+     * "never responds" capture doesn't have to eat the full production
+     * timeout in every test that needs to exercise the timeout path.
+     */
+    this.settleTimeoutMs = 5e3;
+  }
+  /**
+   * Wait out every in-flight response.text() read the 'response' listener
+   * (and route-time capture) kicked off, so a POST create that's still
+   * arriving isn't dropped from the ledger by a teardown/export that started
+   * a beat too soon. Bounded (unref'd, so it can never hold the process
+   * open) — a read that never settles must not hang export forever.
+   *
+   * Reports whether it gave up on a timeout rather than everything actually
+   * settling, and how many captures were still pending at that point — a
+   * caller that silently treated a timeout the same as "all settled" could
+   * report a clean export while a create was still in flight (may not even
+   * have reached the server yet, or just landed with nothing recording it
+   * anywhere). Each still-pending URL is also recorded into the guard's own
+   * unparsed-create audit (rule 'capture-pending') so the record exists even
+   * if this call's caller does nothing further with the return value.
+   */
+  async settleBodyReads() {
+    if (!this._pendingBodyReads.size)
+      return { timedOut: false, unsettled: 0 };
+    let timer;
+    let timedOut = false;
+    const timeout = new Promise((resolve) => {
+      timer = setTimeout(() => {
+        timedOut = true;
+        resolve();
+      }, DataSafetySession.settleTimeoutMs);
+      timer.unref?.();
+    });
+    await Promise.race([Promise.allSettled([...this._pendingBodyReads.keys()]).then(() => {
+    }), timeout]);
+    if (timer)
+      clearTimeout(timer);
+    if (!timedOut)
+      return { timedOut: false, unsettled: 0 };
+    const stillPending = [...this._pendingBodyReads.values()];
+    for (const url of stillPending)
+      this._guard.recordUnparsedCreate(url, 0, void 0, "capture-pending");
+    return { timedOut: true, unsettled: stillPending.length };
+  }
+  /**
+   * Settle in-flight creates, tear down what is pending, and repeat until
+   * both the ledger and the in-flight reads are quiet. A single teardown()
+   * call snapshots the entries before its first await, so a create that
+   * starts during a DELETE (a page action, an autosave, or the delete
+   * handler itself) is only visible to a later pass, and only after its
+   * response is settled. Bounded so a target that creates a new entity on
+   * every DELETE cannot hang export: whatever is still pending after the
+   * last pass is reported as a leftover by the caller. The context is read
+   * again each pass because it can close during a DELETE.
+   *
+   * A pass in which every DELETE timed out is not retried: against a hung
+   * target a retry only spends the caller's time bound on the same entries.
+   *
+   * stopOnTimeout: export stops at a settle timeout (the context stays
+   * alive, so a retry can still tear down); the abnormal-end path keeps
+   * tearing down what is ledgered, because nothing runs after it.
+   */
+  async _settleAndTeardown(stopOnTimeout) {
+    const MAX_TEARDOWN_PASSES = 3;
+    let result = { deleted: [], leftovers: [] };
+    let timedOut = false;
+    let onlyDeleteTimeouts = false;
+    for (let pass = 0; ; pass++) {
+      if (!timedOut)
+        timedOut = (await this.settleBodyReads()).timedOut;
+      if (timedOut && stopOnTimeout || !this._guard.pendingTeardownCount)
+        return { timedOut, contextClosed: false, result };
+      const context = this._activeBrowserContext;
+      if (!context)
+        return { timedOut, contextClosed: true, result };
+      if (pass === MAX_TEARDOWN_PASSES || onlyDeleteTimeouts)
+        return { timedOut, contextClosed: false, result };
+      result = await this._guard.teardown(context.request);
+      onlyDeleteTimeouts = !result.deleted.length && result.leftovers.length > 0 && result.leftovers.every((l) => l.timedOut);
+    }
+  }
+  /**
+   * The skyramp_export_zip gate: settle in-flight reads and run strict
+   * teardown while the browser context (and its session auth) is still
+   * alive, then decide whether export can proceed. The ledger is only ever
+   * non-empty in strict mode (recordResponse gates on it), so the pending
+   * checks below already imply strict.
+   */
+  async prepareExport() {
+    const { timedOut, contextClosed, result } = await this._settleAndTeardown(true);
+    if (timedOut) {
+      const urls = [...this._pendingBodyReads.values()];
+      const manifest2 = (0, import_dataSafetyGuard.renderCappedList)(
+        urls.map((u) => `- ${u}`),
+        "in-flight create(s) still being captured when the settle timeout elapsed \u2014 see dataSafetyLedger.json."
+      );
+      return { kind: "capture-pending", urls, manifest: manifest2 };
+    }
+    const pending = this._guard.ledger.filter((e) => !e.tornDown);
+    if (!pending.length)
+      return { kind: "clean" };
+    if (contextClosed) {
+      const manifest2 = (0, import_dataSafetyGuard.renderCappedList)(
+        pending.map((e) => `- ${e.entityUrl} (id ${e.id})`),
+        "unverified entities \u2014 see dataSafetyLedger.json."
+      );
+      return { kind: "context-closed", pending, manifest: manifest2 };
+    }
+    const attempted = new Map(result.leftovers.map((l) => [l.entry, l]));
+    const leftovers = pending.map((entry) => attempted.get(entry) ?? { entry, status: "error", error: "teardown pass limit reached \u2014 entity ledgered too late to be attempted" });
+    const manifest = (0, import_dataSafetyGuard.renderCappedList)(
+      leftovers.map((l) => `- ${l.entry.entityUrl} (id ${l.entry.id}) \u2014 DELETE ${l.entry.deleteEndpoint} \u2192 ${l.status}${l.error ? ` (${l.error})` : ""}`),
+      "left-behind entities \u2014 see dataSafetyLedger.json."
+    );
+    return { kind: "leftovers", leftovers, manifest };
+  }
+  /**
+   * The abnormal-end (client disconnected without calling skyramp_export_zip)
+   * best-effort variant: settle reads, then attempt teardown if there's
+   * anything to tear down, but never throw and never block on a context
+   * that's already gone (best-effort — the caller preserves the ledger
+   * regardless of the outcome here).
+   */
+  async settleAndTeardownBestEffort() {
+    try {
+      const { timedOut } = await this._settleAndTeardown(false);
+      return { teardownClean: !timedOut && this._guard.pendingTeardownCount === 0 };
+    } catch (e) {
+      process.stderr.write(`[skyramp] Data safety: session-end teardown failed: ${String(e)}
+`);
+      return { teardownClean: false };
+    }
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DataSafetySession,
+  assertNoNetworkPolicyCollision
+});

package/node_modules/playwright/lib/mcp/skyramp/exportTool.js

@@ -30,7 +30,9 @@ var exportTool_exports = {};
 __export(exportTool_exports, {
   createExportZipHandler: () => createExportZipHandler,
   exportZipMcpTool: () => exportZipMcpTool,
-  exportZipSchema: () => exportZipSchema
+  exportZipSchema: () => exportZipSchema,
+  resolveSourceActions: () => resolveSourceActions,
+  validateResourceProvenance: () => validateResourceProvenance
 });
 module.exports = __toCommonJS(exportTool_exports);
 var import_path = __toESM(require("path"));
@@ -38,6 +40,7 @@ var import_fs = __toESM(require("fs"));
 var import_mcpBundle = require("playwright-core/lib/mcpBundle");
 var import_skyRampExport = require("../test/skyRampExport");
 var import_tool = require("../sdk/tool");
+var import_dataSafetyGuard = require("./dataSafetyGuard");
 const exportZipSchema = {
   name: "skyramp_export_zip",
   title: "Export Skyramp zip",
@@ -47,18 +50,91 @@ const exportZipSchema = {
     "BEFORE calling this tool, output a <thinking> block that: (1) lists every user-requested step and confirms it was completed, (2) confirms no step was skipped or hallucinated.",
     "Only call this tool when all interactions are fully complete. Do NOT ask the user for confirmation \u2014 call it automatically.",
     "Only the last complete attempt is exported \u2014 retries from the start URL are deduplicated automatically.",
-    "Do NOT reuse zip files from previous sessions \u2014 always record fresh."
+    "Do NOT reuse zip files from previous sessions \u2014 always record fresh.",
+    "If the recording created records, call skyramp_finish_test_setup between the setup steps and the scenario steps; export refuses without it.",
+    "If export refuses because a create request may have reached the server but could not be recorded, tell the user which requests and that they may have left records behind; only then retry with acknowledgeUnverifiedCreates: true."
   ].join(" "),
   inputSchema: import_mcpBundle.z.object({
-    outputPath: import_mcpBundle.z.string().describe("Absolute path where the zip should be written, e.g. /path/to/box_notes.zip. Use the same directory and base name as the test file, replacing .spec.ts with .zip.")
+    outputPath: import_mcpBundle.z.string().describe("Absolute path where the zip should be written, e.g. /path/to/box_notes.zip. Use the same directory and base name as the test file, replacing .spec.ts with .zip."),
+    acknowledgeUnverifiedCreates: import_mcpBundle.z.boolean().optional().describe("Set to true only after a refused export named create requests that could not be recorded, and you told the user they may have left records behind.")
   }),
   type: "readOnly"
 };
+function serializedActions(actions, entries, jsonl) {
+  return (jsonl ?? (0, import_skyRampExport.buildJsonlContent)([...actions], "chromium", "", void 0, void 0, entries).jsonl).trim().split("\n").slice(1).map((line) => JSON.parse(line));
+}
+function actionNumber(actionId) {
+  const match = /^action-(\d+)$/.exec(actionId);
+  return match ? Number(match[1]) : NaN;
+}
+function resolveSourceActions(actions, entries, passiveActionIds, jsonl) {
+  const changes = /* @__PURE__ */ new Map();
+  if (!entries.some((entry) => entry.sourceActionId))
+    return changes;
+  const serialized = serializedActions(actions, entries, jsonl);
+  const phases = new Map(serialized.map((action) => [action.actionId, action.phase]));
+  for (const entry of entries) {
+    const source = entry.sourceActionId;
+    if (!source || phases.has(source) && (entry.phase !== "scenario" || phases.get(source) === "scenario"))
+      continue;
+    if (entry.phase === "scenario" && !passiveActionIds.has(source))
+      continue;
+    const before = actionNumber(source);
+    let nearest;
+    for (const action of serialized) {
+      if (action.actionId && action.phase === entry.phase && actionNumber(action.actionId) < before && (!nearest || actionNumber(action.actionId) > actionNumber(nearest)))
+        nearest = action.actionId;
+    }
+    if (entry.phase === "scenario" && !nearest)
+      continue;
+    changes.set(entry, nearest);
+  }
+  return changes;
+}
+function validateResourceProvenance(actions, entries, setupCompleted, jsonl) {
+  if (!entries.length)
+    return { ok: true };
+  if (!setupCompleted)
+    return { ok: false, message: "Created resources were recorded before skyramp_finish_test_setup marked the scenario boundary." };
+  const invalidEntry = entries.find((entry) => entry.phase !== "setup" && entry.phase !== "scenario");
+  if (invalidEntry)
+    return { ok: false, message: `Created resource ${invalidEntry.entityUrl} has no valid recording phase.` };
+  for (const entry of entries) {
+    const missing = [
+      entry.idSource !== "responseBody" && entry.idSource !== "locationHeader" ? "idSource" : null,
+      typeof entry.resourceType !== "string" || !entry.resourceType ? "resourceType" : null,
+      typeof entry.responseStatus !== "number" ? "responseStatus" : null
+    ].filter((field) => field !== null);
+    if (missing.length)
+      return { ok: false, message: `Created resource ${entry.entityUrl} has no valid id-source record (${missing.join(", ")}). Re-record with the current @skyramp/playwright recorder \u2014 test generation needs these fields to recover the id at runtime.` };
+  }
+  const invalidAction = actions.find((action) => !action.actionId || action.phase !== "setup" && action.phase !== "scenario");
+  if (invalidAction)
+    return { ok: false, message: `Recorded action ${invalidAction.toolName} has no valid provenance.` };
+  const serialized = serializedActions(actions, entries, jsonl);
+  const phases = new Map(serialized.map((action) => [action.actionId, action.phase]));
+  const unresolved = entries.find((entry) => entry.phase === "scenario" ? !entry.sourceActionId || phases.get(entry.sourceActionId) !== "scenario" : entry.sourceActionId && !phases.has(entry.sourceActionId));
+  if (unresolved)
+    return { ok: false, message: `Created resource ${unresolved.entityUrl} has no valid source action in serialized JSONL: ${unresolved.sourceActionId ?? "(none)"}. The record was created by a step the recording cannot replay; re-record the scenario so the record is created by a recorded action.` };
+  return { ok: true };
+}
 function summarizeDropped(dropped) {
   const counts = /* @__PURE__ */ new Map();
   for (const d of dropped)
     counts.set(d.toolName, (counts.get(d.toolName) ?? 0) + 1);
-  return [...counts.entries()].map(([tool, n]) => n > 1 ? `${tool} \xD7${n}` : tool).join(", ");
+  const lines = [...counts.entries()].map(([tool, n]) => n > 1 ? `${tool} \xD7${n}` : tool);
+  return (0, import_dataSafetyGuard.renderCappedList)(lines, "dropped action type(s)");
+}
+function summarizeUnparsedCreates(records) {
+  const lines = records.map((r) => {
+    const countSuffix = r.count && r.count > 1 ? ` (\xD7${r.count})` : "";
+    const ruleSuffix = r.rule ? ` [${r.rule}]` : "";
+    return `- POST ${r.url} \u2192 ${r.status}${countSuffix}${ruleSuffix}`;
+  });
+  return (0, import_dataSafetyGuard.renderCappedList)(lines, "unparsed create(s)");
+}
+function totalUnparsedCount(records) {
+  return records.reduce((sum, r) => sum + (r.count ?? 1), 0);
 }
 function createExportZipHandler(ctx) {
   return async (params) => {
@@ -88,8 +164,19 @@ Requested path: ${outputZip}` }],
         counter++;
       outputZip = `${base}_${counter}${ext}`;
     }
-    const { jsonl: jsonlContent, actionCount, skipped, simplified } = (0, import_skyRampExport.buildJsonlContent)(ctx.trackedActions, "chromium", ctx.harPath);
-    await (0, import_skyRampExport.writeSkyrampZip)(outputZip, jsonlContent, ctx.harPath);
+    const ledger = ctx.dataSafety ? JSON.parse(ctx.dataSafety.ledgerJson) : void 0;
+    const { jsonl: jsonlContent, actionCount, skipped, simplified } = (0, import_skyRampExport.buildJsonlContent)(ctx.trackedActions, "chromium", ctx.harPath, void 0, void 0, ledger?.entries);
+    const provenance = validateResourceProvenance(ctx.trackedActions, ledger?.entries ?? [], ledger?.setupCompleted === true, jsonlContent);
+    if (!provenance.ok)
+      return { content: [{ type: "text", text: `### Error
+${provenance.message}
+The recording was NOT exported.` }], isError: true };
+    await (0, import_skyRampExport.writeSkyrampZip)(
+      outputZip,
+      jsonlContent,
+      ctx.harPath,
+      ctx.dataSafety ? [{ name: "dataSafetyLedger.json", content: ctx.dataSafety.ledgerJson }] : void 0
+    );
     const skippedNote = skipped.length ? `
 Skipped (not exportable): ${[...new Set(skipped)].join(", ")}` : "";
     const simplifiedNote = simplified.length ? `
@@ -97,6 +184,10 @@ Exported with a simplified locator (a part the trace format cannot carry was dro
     const dropped = ctx.droppedActions ?? [];
     const droppedNote = dropped.length ? `
 Failed & dropped (not recorded): ${summarizeDropped(dropped)}` : "";
+    const unparsed = ctx.dataSafety?.unparsedCreates ?? [];
+    const unparsedNote = unparsed.length ? `
+Data safety: ${totalUnparsedCount(unparsed)} response(s) returned 2xx/3xx to a POST but no entity id could be identified \u2014 entities may have been created that teardown could not delete. See dataSafetyLedger.json (unparsedCreates).
+${summarizeUnparsedCreates(unparsed)}` : "";
     return {
       content: [{
         type: "text",
@@ -104,7 +195,7 @@ Failed & dropped (not recorded): ${summarizeDropped(dropped)}` : "";
 Skyramp zip written to ${outputZip}
 
 Contains:
-- skyramp_playwright.txt (${actionCount} actions)${skippedNote}${simplifiedNote}${droppedNote}`
+- skyramp_playwright.txt (${actionCount} actions)${skippedNote}${simplifiedNote}${droppedNote}${unparsedNote}`
       }]
     };
   };
@@ -116,5 +207,7 @@ function exportZipMcpTool() {
 0 && (module.exports = {
   createExportZipHandler,
   exportZipMcpTool,
-  exportZipSchema
+  exportZipSchema,
+  resolveSourceActions,
+  validateResourceProvenance
 });

package/node_modules/playwright/lib/mcp/skyramp/finishTestSetupTool.js

@@ -0,0 +1,45 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var finishTestSetupTool_exports = {};
+__export(finishTestSetupTool_exports, {
+  finishTestSetupMcpTool: () => finishTestSetupMcpTool,
+  finishTestSetupSchema: () => finishTestSetupSchema
+});
+module.exports = __toCommonJS(finishTestSetupTool_exports);
+var import_mcpBundle = require("playwright-core/lib/mcpBundle");
+var import_tool = require("../sdk/tool");
+const finishTestSetupSchema = {
+  name: "skyramp_finish_test_setup",
+  title: "Finish test setup",
+  description: [
+    "Marks all subsequent browser actions and created resources as part of the test scenario.",
+    "Call it once, after the setup steps (sign-in, creating the records the test needs) and before the first scenario step.",
+    "When data safety is strict and the recording created any record, skyramp_export_zip refuses to export until this tool was called."
+  ].join(" "),
+  inputSchema: import_mcpBundle.z.object({}),
+  type: "readOnly"
+};
+function finishTestSetupMcpTool() {
+  return (0, import_tool.toMcpTool)(finishTestSetupSchema);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  finishTestSetupMcpTool,
+  finishTestSetupSchema
+});

package/node_modules/playwright/lib/mcp/skyramp/index.js

@@ -19,28 +19,44 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var skyramp_exports = {};
 __export(skyramp_exports, {
   ARGS_ONLY_TOOLS: () => import_types.ARGS_ONLY_TOOLS,
+  DataSafetyGuard: () => import_dataSafetyGuard.DataSafetyGuard,
   TraceRecordingBackend: () => import_traceRecordingBackend.TraceRecordingBackend,
   actionsFromPath: () => import_skyRampImport.actionsFromPath,
   buildJsonlContent: () => import_skyRampExport.buildJsonlContent,
+  compileOffLimits: () => import_dataSafetyGuard.compileOffLimits,
+  finishTestSetupMcpTool: () => import_finishTestSetupTool.finishTestSetupMcpTool,
+  finishTestSetupSchema: () => import_finishTestSetupTool.finishTestSetupSchema,
   loadTraceMcpTool: () => import_loadTraceTool.loadTraceMcpTool,
   loadTraceSchema: () => import_loadTraceTool.loadTraceSchema,
+  matchesOffLimits: () => import_dataSafetyGuard.matchesOffLimits,
+  parseDataSafetyConfig: () => import_dataSafetyGuard.parseDataSafetyConfig,
   parseJsonl: () => import_skyRampImport.parseJsonl,
+  renderCappedList: () => import_dataSafetyGuard.renderCappedList,
   writeSkyrampZip: () => import_skyRampExport.writeSkyrampZip
 });
 module.exports = __toCommonJS(skyramp_exports);
 var import_traceRecordingBackend = require("./traceRecordingBackend");
+var import_dataSafetyGuard = require("./dataSafetyGuard");
 var import_types = require("./types");
 var import_skyRampExport = require("../test/skyRampExport");
 var import_loadTraceTool = require("./loadTraceTool");
 var import_skyRampImport = require("./skyRampImport");
+var import_finishTestSetupTool = require("./finishTestSetupTool");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ARGS_ONLY_TOOLS,
+  DataSafetyGuard,
   TraceRecordingBackend,
   actionsFromPath,
   buildJsonlContent,
+  compileOffLimits,
+  finishTestSetupMcpTool,
+  finishTestSetupSchema,
   loadTraceMcpTool,
   loadTraceSchema,
+  matchesOffLimits,
+  parseDataSafetyConfig,
   parseJsonl,
+  renderCappedList,
   writeSkyrampZip
 });