@solidxai/core 0.1.13-beta.5 → 0.1.13-beta.6

package/src/services/chatter-message.service.ts

@@ -5,7 +5,7 @@ import { InjectEntityManager } from '@nestjs/typeorm';
 import { Brackets, EntityManager, EntityMetadata, In } from 'typeorm';
 
 import { classify } from '@angular-devkit/core/src/utils/strings';
-import { CHATTER_MESSAGE_STATUS, CHATTER_MESSAGE_SUBTYPE, CHATTER_MESSAGE_TYPE } from 'src/constants/chatter-message.constants';
+import { CHATTER_MESSAGE_STATUS, CHATTER_MESSAGE_SUBTYPE, CHATTER_MESSAGE_TYPE, CHATTER_MESSAGE_USER_FIELDS } from 'src/constants/chatter-message.constants';
 import { ERROR_MESSAGES } from 'src/constants/error-messages';
 import { PostChatterMessageDto } from 'src/dtos/post-chatter-message.dto';
 import { UpdateChatterNoteMessageDto } from 'src/dtos/update-chatter-note-message.dto';
@@ -18,6 +18,7 @@ import { FieldMetadataRepository } from 'src/repository/field-metadata.repositor
 import { MediaRepository } from 'src/repository/media.repository';
 import { ModelMetadataRepository } from 'src/repository/model-metadata.repository';
 import { CRUDService } from 'src/services/crud.service';
+import { BasicFilterDto } from '../dtos/basic-filters.dto';
 import { MediaStorageProviderType } from '../dtos/create-media-storage-provider-metadata.dto';
 import { ChatterMessageDetails } from '../entities/chatter-message-details.entity';
 import { ChatterMessage } from '../entities/chatter-message.entity';
@@ -102,6 +103,44 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
         chatterMessage.updatedBy = resolvedUserId;
     }
 
+    /**
+     * Reduce a message's hydrated `user` relation to CHATTER_MESSAGE_USER_FIELDS.
+     *
+     * `getChatterMessages` restricts the columns in the query itself, which is preferable.
+     * The generic CRUD paths below build their query from find-options and hand `populate`
+     * straight to TypeORM, so they are trimmed after the fact instead. (`createdBy` /
+     * `updatedBy` need nothing here - CRUDService.handlePopulateUserIdFields already selects
+     * only USER_SUMMARY_FIELDS when a caller populates them.)
+     */
+    private trimMessageUser<M extends ChatterMessage>(message: M): M {
+        if (message?.user) {
+            message.user = this.toUserSummary(message.user) as User;
+        }
+        return message;
+    }
+
+    private trimMessageUsers(messages: ChatterMessage[] | undefined) {
+        messages?.forEach(message => this.trimMessageUser(message));
+    }
+
+    /**
+     * `GET /chatter-message?populate[]=user` would otherwise be a way around the column
+     * allowlist applied by getChatterMessages.
+     */
+    async find(basicFilterDto: BasicFilterDto, solidRequestContext: any = {}): Promise<any> {
+        const result = await super.find(basicFilterDto, solidRequestContext);
+        this.trimMessageUsers(result?.records);
+        // A grouped find (populateGroup) nests its entities one level deeper.
+        for (const groupRecord of result?.groupRecords ?? []) {
+            this.trimMessageUsers(groupRecord?.groupData?.records);
+        }
+        return result;
+    }
+
+    async findOne(id: number, query: any = {}, solidRequestContext: any = {}) {
+        return this.trimMessageUser(await super.findOne(id, query, solidRequestContext));
+    }
+
     private isEditableCustomNoteMessage(message: ChatterMessage): boolean {
         if (message.messageType !== CHATTER_MESSAGE_TYPE.CUSTOM) {
             return false;
@@ -332,7 +371,8 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
 
         await this.publishChatterMentionNotifications(savedMessage, model);
 
-        return savedMessage;
+        // The `user` relation was loaded for the ownership check above; don't return all of it.
+        return this.trimMessageUser(savedMessage);
     }
 
     async postMessage(postDto: PostChatterMessageDto, files: Express.Multer.File[] = []) {
@@ -917,16 +957,25 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
             qb.where(orConditions.join(' OR '), parameters);
         }));
 
-        const relations = ['chatterMessageDetails', 'user'];
+        const relations = ['chatterMessageDetails'];
         if (populate && populate.length > 0) {
             const normalizedPopulate = this.crudHelperService.normalize(populate);
-            relations.push(...normalizedPopulate.filter(rel => !relations.includes(rel)));
+            // SECURITY: 'user' is joined below with an explicit column allowlist. A client-supplied
+            // populate[]=user must not be able to turn it back into a full-entity join (the chatter
+            // panel does send exactly that).
+            relations.push(...normalizedPopulate.filter(rel => rel !== 'user' && !relations.includes(rel)));
         }
 
         relations.forEach(relation => {
             qb.leftJoinAndSelect(`entity.${relation}`, relation);
         });
 
+        // Only the author's id and display name leave this endpoint - see CHATTER_MESSAGE_USER_FIELDS.
+        // This join must stay before applyFilters below: it lets filters[user][fullName] reuse this
+        // alias instead of adding a second join of its own.
+        qb.leftJoin('entity.user', 'user');
+        qb.addSelect(CHATTER_MESSAGE_USER_FIELDS.map(field => `user.${field}`));
+
         if (filters) {
             qb.andWhere(new Brackets(whereQb => {
                 this.crudHelperService.applyFilters(whereQb, filters, 'entity', qb);
@@ -940,6 +989,13 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
         const [entities, count] = await qb.getManyAndCount();
         this.logHeapUsed('getChatterMessages-entitiesLoaded');
 
+        // The join above only selects the allowlisted columns, but TypeORM still hydrates the
+        // author with `new User()`, which leaves every initialiser-backed property (active,
+        // forcePasswordChange, ...) sitting on the instance holding its default rather than a
+        // value read from the database. Replace it with a plain object of exactly the
+        // allowlisted keys so the response cannot report fabricated defaults as data.
+        this.trimMessageUsers(entities);
+
         // Convert date strings in message details to ISO format for consistent handling on the frontend
         const DATE_FIELD_TYPES = ['date', 'datetime', 'time'];
         for (const entity of entities) {

package/src/services/crud.service.ts

@@ -7,6 +7,7 @@ import { SolidBaseRepository } from "../repository/solid-base.repository";
 import { SettingService } from "./setting.service";
 import { ERROR_MESSAGES } from "src/constants/error-messages";
 import { SUCCESS_MESSAGES } from "src/constants/success-messages";
+import { USER_SUMMARY_FIELDS } from "src/constants/user.constants";
 import { EntityManager, FindOptionsWhere, In, IsNull, Not, QueryFailedError, SelectQueryBuilder } from "typeorm";
 import { QueryDeepPartialEntity } from "typeorm/query-builder/QueryPartialEntity";
 import { BasicFilterDto } from "../dtos/basic-filters.dto";
@@ -573,6 +574,29 @@ private async prepareManyToManyAuditSnapshot(entity: T,id: number,modelSingularN
         return this.crudHelperService.pagedResponse(offset, limit, count, entities);
     }
 
+    /**
+     * Reduce a user to USER_SUMMARY_FIELDS as a plain object.
+     *
+     * Returning the hydrated entity is not good enough. A partially selected `User` is still
+     * built with `new User()`, so every property that has a TypeScript field initializer
+     * (`active`, `forcePasswordChange`, `lastLoginProvider`, `failedLoginAttempts`,
+     * `isAllowedToGenerateApiKeys`) is present on the instance holding its *default* rather
+     * than the value in the database - `active: true` for a user who may well be inactive.
+     * Serialization does not help: those defaults are real own properties. Copying the
+     * allowlist into a fresh object is what guarantees the response contains only columns
+     * actually read from the database.
+     */
+    protected toUserSummary(user: unknown): Partial<User> | null {
+        if (!user) {
+            return null;
+        }
+        const summary: Partial<User> = {};
+        for (const field of USER_SUMMARY_FIELDS) {
+            summary[field] = user[field] as never;
+        }
+        return summary;
+    }
+
     // entities is an array of T
     // T can contain createdBy and updatedBy fields
     // We need to populate the createdBy and updatedBy fields with the User entity
@@ -584,9 +608,15 @@ private async prepareManyToManyAuditSnapshot(entity: T,id: number,modelSingularN
                 if (userId) {
                     const user = await userRepository.findOne({
                         where: { id: userId },
+                        // SECURITY: a populated createdBy/updatedBy is only ever displayed as
+                        // "who did this", so it must not ship the author's email, mobile, role
+                        // assignments or API keys - let alone the credential columns, which
+                        // survive here whenever User is subclassed (class-transformer resolves
+                        // @Exclude() per class and does not inherit it).
+                        select: USER_SUMMARY_FIELDS as unknown as (keyof User)[],
                     });
                     // @ts-ignore
-                    entity[userFieldPath] = user;
+                    entity[userFieldPath] = this.toUserSummary(user);
                 }
             }
         }

package/src/services/settings/default-settings-provider.service.ts

@@ -1474,6 +1474,28 @@ const getSolidCoreSettings = (isProd: boolean) =>
       value: process.env.COMMON_META_WHATSAPP_APP_SECRET,
       level: SettingLevel.SystemEnv,
     },
+    {
+      moduleName: "solid-core",
+      key: "uiTestDefaultTimeoutMs",
+      value: 30000,
+      level: SettingLevel.SystemAdminEditable,
+      label: "UI Test Default Timeout (ms)",
+      group: "testing-settings",
+      sortOrder: 10,
+      controlType: "numeric",
+      helpText: "How long UI test steps wait for an element before failing. Raise this if tests time out on slow screens. Overridden by the --ui-timeout-ms flag and by a per-step timeoutMs.",
+    },
+    {
+      moduleName: "solid-core",
+      key: "uiTestNavigationTimeoutMs",
+      value: 30000,
+      level: SettingLevel.SystemAdminEditable,
+      label: "UI Test Navigation Timeout (ms)",
+      group: "testing-settings",
+      sortOrder: 20,
+      controlType: "numeric",
+      helpText: "How long the ui.goto step waits for a page to load before failing. Falls back to the UI test default timeout.",
+    },
   ] as const satisfies SettingDefinition[];
 
 // 2.

package/src/testing/README.md

@@ -75,6 +75,48 @@ General step fields:
 - `timeoutMs` (optional): per-step timeout override
 - `spec` (optional): used by `test.spec` to identify the spec
 
+## Timeouts
+There are two independent timeout layers. They are easy to confuse, so note which one you want:
+
+**1. Engine timeouts** — `scenario.timeoutMs` and the top-level `step.timeoutMs`.
+These wrap execution in a `Promise.race` (`core/timeout.ts`). They are a hard upper bound
+on wall-clock time and do **not** cancel the underlying browser call, so the failure message
+only tells you the scenario or op that overran.
+
+**2. UI (Playwright) timeouts** — the run-wide default plus per-step `with.timeoutMs`.
+This is what governs how long `ui.expectVisible`, `ui.click`, `ui.fill` etc. wait for a
+selector. Playwright cancels the operation itself, so the error names the selector and the
+state it was waiting for. **If your UI steps are timing out, this is the knob to turn.**
+
+Resolution order for UI steps: `with.timeoutMs` → `--ui-timeout-ms` → `UI_TIMEOUT_MS` →
+`uiTestDefaultTimeoutMs` setting → `30000`.
+`ui.goto` uses the navigation timeout instead: `with.timeoutMs` → `--ui-navigation-timeout-ms`
+→ `UI_NAVIGATION_TIMEOUT_MS` → `uiTestNavigationTimeoutMs` setting → the resolved UI timeout.
+
+Raise the default for a whole run:
+```bash
+solid test run --module <module-name> --ui-timeout-ms 60000
+# or
+UI_TIMEOUT_MS=60000 solid test run --module <module-name>
+```
+
+Or set the installation-wide default under **Settings → Testing Settings** in the admin UI
+(`uiTestDefaultTimeoutMs` / `uiTestNavigationTimeoutMs`). Those rows are created by `solid seed`;
+until then the built-in `30000` applies. Flags and env vars still win, so CI keeps per-run control.
+
+Or bump only the one slow step, leaving the rest of the suite strict:
+```json
+{
+  "then": {
+    "op": "ui.expectVisible",
+    "with": { "selector": "#report-grid", "timeoutMs": 90000 }
+  }
+}
+```
+
+Caution: a scenario-level `timeoutMs` lower than the UI timeout will fire first and mask the
+more useful Playwright error. Keep `defaults.timeoutMs` above your UI timeout.
+
 ## Interpolation
 Available tokens:
 - `${env:NAME}` (environment variables)
@@ -198,6 +240,7 @@ Description: Navigates the browser to a URL.
 
 Options in `with`:
 - `url` (required)
+- `timeoutMs` (optional, overrides the run-wide UI navigation timeout)
 
 ### **Op: `ui.expectUrl`**
 Description: Asserts the current page URL.
@@ -212,6 +255,7 @@ Description: Fills an input or editable element.
 Options in `with`:
 - `selector` (required)
 - `value` (required)
+- `timeoutMs` (optional, overrides the run-wide UI timeout)
 
 ### **Op: `ui.select`**
 Description: Selects an option in a select element.
@@ -219,12 +263,14 @@ Description: Selects an option in a select element.
 Options in `with`:
 - `selector` (required)
 - `value` (required)
+- `timeoutMs` (optional, overrides the run-wide UI timeout)
 
 ### **Op: `ui.click`**
 Description: Clicks an element located by selector.
 
 Options in `with`:
 - `selector` (required)
+- `timeoutMs` (optional, overrides the run-wide UI timeout)
 
 ### **Op: `ui.press`**
 Description: Presses a keyboard key on a focused element.
@@ -232,6 +278,7 @@ Description: Presses a keyboard key on a focused element.
 Options in `with`:
 - `selector` (required)
 - `key` (required)
+- `timeoutMs` (optional, overrides the run-wide UI timeout)
 
 ### **Op: `ui.waitForManual`**
 Description: Pauses a headed Playwright run so a human can interact with the live browser, then resumes when Enter is pressed in the terminal.
@@ -242,7 +289,7 @@ Options in `with`:
 - `waitForSelector` (optional, waits for a visible selector after resume)
 - `waitForUrlEquals` (optional, waits until the current URL exactly matches)
 - `waitForUrlContains` (optional, waits until the current URL contains a substring)
-- `timeoutMs` (optional, timeout for post-resume waits)
+- `timeoutMs` (optional, timeout for post-resume waits; defaults to the run-wide UI timeout)
 - `bringToFront` (optional, defaults to `true`)
 
 Notes:
@@ -269,6 +316,7 @@ Description: Waits for an element to be visible.
 
 Options in `with`:
 - `selector` (required)
+- `timeoutMs` (optional, overrides the run-wide UI timeout)
 
 ### **Op: `ui.expectText`**
 Description: Asserts the text content of an element.
@@ -277,6 +325,7 @@ Options in `with`:
 - `selector` (required)
 - `equals` (optional)
 - `contains` (optional)
+- `timeoutMs` (optional, overrides the run-wide UI timeout)
 
 ### **Op: `assert.equals`**
 Description: Asserts strict equality between two values.
@@ -388,7 +437,12 @@ await runFromMetadata({
   includeTags: ["smoke"],
   defaults: { timeoutMs: 30_000, retries: 1 },
   api: { baseUrl: "https://api.example.com" },
-  ui: { baseUrl: "https://app.example.com", headless: true }
+  ui: {
+    baseUrl: "https://app.example.com",
+    headless: true,
+    defaultTimeoutMs: 30_000,
+    navigationTimeoutMs: 45_000
+  }
 });
 ```
 
@@ -409,6 +463,14 @@ Lightweight existing-database workflow:
 
 For human-assisted OTP or third-party verification flows, use `ui.waitForManual` in a headed run so the browser remains interactive while the scenario is paused.
 
+Common `test run` flags (all pass through solidctl unchanged):
+- `--ui-base-url <url>` / `--api-base-url <url>`
+- `--headless [true|false]`
+- `--ui-timeout-ms <number>` — default wait for every UI step (see [Timeouts](#timeouts))
+- `--ui-navigation-timeout-ms <number>` — default wait for `ui.goto`
+- `--timeout-ms <number>` / `--retries <number>` — scenario-level guard and retry count
+- `--scenario-ids <ids>` / `--include-tags <tags>` / `--skip-scenario-ids <ids>`
+
 ## Add A New Step (SOP)
 1. Create a new `*.step.ts` in the right domain folder.
 2. Implement a `registerXSteps(registry)` function and `registry.register("op.name", handler)`.

package/src/testing/adapters/ui/playwright-adapter.ts

@@ -6,9 +6,13 @@ function isAbsoluteUrl(url: string): boolean {
   return /^https?:\/\//i.test(url);
 }
 
+export const DEFAULT_UI_TIMEOUT_MS = 30_000;
+
 export class PlaywrightAdapter {
   private readonly baseUrl?: string;
   private readonly headless: boolean;
+  private readonly defaultTimeoutMs: number;
+  private readonly navigationTimeoutMs: number;
   private browser?: Browser;
   private context?: BrowserContext;
   public page?: Page;
@@ -16,16 +20,37 @@ export class PlaywrightAdapter {
   constructor(opts?: PlaywrightAdapterOptions) {
     this.baseUrl = opts?.baseUrl;
     this.headless = opts?.headless ?? true;
+    this.defaultTimeoutMs = opts?.defaultTimeoutMs ?? DEFAULT_UI_TIMEOUT_MS;
+    this.navigationTimeoutMs =
+      opts?.navigationTimeoutMs ?? this.defaultTimeoutMs;
   }
 
   isHeadless(): boolean {
     return this.headless;
   }
 
+  /**
+   * Resolves the timeout for a single Playwright call: an explicit per-step
+   * value wins, otherwise the run-wide default applies.
+   */
+  resolveTimeout(stepTimeoutMs?: number): number {
+    return typeof stepTimeoutMs === 'number' && Number.isFinite(stepTimeoutMs)
+      ? stepTimeoutMs
+      : this.defaultTimeoutMs;
+  }
+
+  resolveNavigationTimeout(stepTimeoutMs?: number): number {
+    return typeof stepTimeoutMs === 'number' && Number.isFinite(stepTimeoutMs)
+      ? stepTimeoutMs
+      : this.navigationTimeoutMs;
+  }
+
   async start(): Promise<void> {
     const { chromium } = await import('playwright');
     this.browser = await chromium.launch({ headless: this.headless });
     this.context = await this.browser.newContext();
+    this.context.setDefaultTimeout(this.defaultTimeoutMs);
+    this.context.setDefaultNavigationTimeout(this.navigationTimeoutMs);
     this.page = await this.context.newPage();
   }
 

package/src/testing/adapters/ui/ui.types.ts

@@ -1,4 +1,6 @@
 export interface PlaywrightAdapterOptions {
   headless?: boolean;
   baseUrl?: string;
+  defaultTimeoutMs?: number;
+  navigationTimeoutMs?: number;
 }

package/src/testing/steps/ui/actions.step.ts

@@ -2,8 +2,8 @@ import type { TestContext } from "../../contracts/runtime-context.types";
 import type { OpStep } from "../../contracts/testing-metadata.types";
 import { StepRegistry } from "../../core/step-registry";
 
-type ClickInput = { selector: string };
-type PressInput = { selector: string; key: string };
+type ClickInput = { selector: string; timeoutMs?: number };
+type PressInput = { selector: string; key: string; timeoutMs?: number };
 
 function requirePage(ctx: TestContext, op: string) {
   if (!ctx.ui || !ctx.ui.page) {
@@ -19,7 +19,9 @@ export function registerActionSteps(registry: StepRegistry): void {
     if (!input.selector) {
       throw new Error('Missing "selector" in step.with for op "ui.click"');
     }
-    await page.click(input.selector);
+    await page.click(input.selector, {
+      timeout: ctx.ui?.resolveTimeout(input.timeoutMs),
+    });
   });
 
   registry.register("ui.press", async (ctx: TestContext, step: OpStep) => {
@@ -31,6 +33,8 @@ export function registerActionSteps(registry: StepRegistry): void {
     if (!input.key) {
       throw new Error('Missing "key" in step.with for op "ui.press"');
     }
-    await page.press(input.selector, input.key);
+    await page.press(input.selector, input.key, {
+      timeout: ctx.ui?.resolveTimeout(input.timeoutMs),
+    });
   });
 }

package/src/testing/steps/ui/assertions.step.ts

@@ -2,8 +2,13 @@ import type { TestContext } from "../../contracts/runtime-context.types";
 import type { OpStep } from "../../contracts/testing-metadata.types";
 import { StepRegistry } from "../../core/step-registry";
 
-type VisibleInput = { selector: string };
-type ExpectTextInput = { selector: string; equals?: string; contains?: string };
+type VisibleInput = { selector: string; timeoutMs?: number };
+type ExpectTextInput = {
+  selector: string;
+  equals?: string;
+  contains?: string;
+  timeoutMs?: number;
+};
 
 function requirePage(ctx: TestContext, op: string) {
   if (!ctx.ui || !ctx.ui.page) {
@@ -19,7 +24,10 @@ export function registerAssertionSteps(registry: StepRegistry): void {
     if (!input.selector) {
       throw new Error('Missing "selector" in step.with for op "ui.expectVisible"');
     }
-    await page.waitForSelector(input.selector, { state: "visible" });
+    await page.waitForSelector(input.selector, {
+      state: "visible",
+      timeout: ctx.ui?.resolveTimeout(input.timeoutMs),
+    });
   });
 
   registry.register("ui.expectHidden", async (ctx: TestContext, step: OpStep) => {
@@ -28,7 +36,10 @@ export function registerAssertionSteps(registry: StepRegistry): void {
     if (!input.selector) {
       throw new Error('Missing "selector" in step.with for op "ui.expectHidden"');
     }
-    await page.waitForSelector(input.selector, { state: "hidden" });
+    await page.waitForSelector(input.selector, {
+      state: "hidden",
+      timeout: ctx.ui?.resolveTimeout(input.timeoutMs),
+    });
   });
 
   registry.register("ui.expectText", async (ctx: TestContext, step: OpStep) => {
@@ -38,7 +49,9 @@ export function registerAssertionSteps(registry: StepRegistry): void {
       throw new Error('Missing "selector" in step.with for op "ui.expectText"');
     }
 
-    const text = await page.locator(input.selector).innerText();
+    const text = await page
+      .locator(input.selector)
+      .innerText({ timeout: ctx.ui?.resolveTimeout(input.timeoutMs) });
     if (input.equals !== undefined) {
       if (text !== input.equals) {
         throw new Error(

package/src/testing/steps/ui/form.step.ts

@@ -4,9 +4,13 @@ import type { TestContext } from "../../contracts/runtime-context.types";
 import type { OpStep } from "../../contracts/testing-metadata.types";
 import { StepRegistry } from "../../core/step-registry";
 
-type FillInput = { selector: string; value: string };
-type SelectInput = { selector: string; value: string };
-type UploadFileInput = { selector: string; filePath: string | string[] };
+type FillInput = { selector: string; value: string; timeoutMs?: number };
+type SelectInput = { selector: string; value: string; timeoutMs?: number };
+type UploadFileInput = {
+  selector: string;
+  filePath: string | string[];
+  timeoutMs?: number;
+};
 
 function requirePage(ctx: TestContext, op: string) {
   if (!ctx.ui || !ctx.ui.page) {
@@ -25,7 +29,9 @@ export function registerFormSteps(registry: StepRegistry): void {
     if (input.value === undefined) {
       throw new Error('Missing "value" in step.with for op "ui.fill"');
     }
-    await page.fill(input.selector, String(input.value));
+    await page.fill(input.selector, String(input.value), {
+      timeout: ctx.ui?.resolveTimeout(input.timeoutMs),
+    });
   });
 
   registry.register("ui.select", async (ctx: TestContext, step: OpStep) => {
@@ -37,7 +43,9 @@ export function registerFormSteps(registry: StepRegistry): void {
     if (input.value === undefined) {
       throw new Error('Missing "value" in step.with for op "ui.select"');
     }
-    await page.selectOption(input.selector, String(input.value));
+    await page.selectOption(input.selector, String(input.value), {
+      timeout: ctx.ui?.resolveTimeout(input.timeoutMs),
+    });
   });
 
   registry.register("ui.uploadFile", async (ctx: TestContext, step: OpStep) => {
@@ -53,6 +61,8 @@ export function registerFormSteps(registry: StepRegistry): void {
     const resolved = Array.isArray(input.filePath)
       ? input.filePath.map((p) => path.resolve(cwd, String(p)))
       : path.resolve(cwd, String(input.filePath));
-    await page.setInputFiles(input.selector, resolved);
+    await page.setInputFiles(input.selector, resolved, {
+      timeout: ctx.ui?.resolveTimeout(input.timeoutMs),
+    });
   });
 }

package/src/testing/steps/ui/manual.step.ts

@@ -28,7 +28,7 @@ export function registerManualSteps(registry: StepRegistry): void {
     const inputConfig = (step.with ?? {}) as WaitForManualInput;
     const message = inputConfig.message?.trim() || "Manual interaction required.";
     const prompt = inputConfig.prompt?.trim() || "Press Enter to continue...";
-    const timeoutMs = inputConfig.timeoutMs;
+    const timeoutMs = ctx.ui?.resolveTimeout(inputConfig.timeoutMs);
     const bringToFront = inputConfig.bringToFront ?? true;
 
     if (ctx.ui?.isHeadless()) {

package/src/testing/steps/ui/navigation.step.ts

@@ -2,7 +2,7 @@ import type { TestContext } from "../../contracts/runtime-context.types";
 import type { OpStep } from "../../contracts/testing-metadata.types";
 import { StepRegistry } from "../../core/step-registry";
 
-type GotoInput = { url: string };
+type GotoInput = { url: string; timeoutMs?: number };
 type ExpectUrlInput = { equals?: string; contains?: string };
 
 function requirePage(ctx: TestContext, op: string) {
@@ -20,7 +20,9 @@ export function registerNavigationSteps(registry: StepRegistry): void {
       throw new Error('Missing "url" in step.with for op "ui.goto"');
     }
     const url = ctx.ui?.resolveUrl(input.url) ?? input.url;
-    await page.goto(url);
+    await page.goto(url, {
+      timeout: ctx.ui?.resolveNavigationTimeout(input.timeoutMs),
+    });
   });
 
   registry.register("ui.expectUrl", async (ctx: TestContext, step: OpStep) => {