@sun-asterisk/sungen 3.2.18 → 3.2.20

package/dist/orchestrator/templates/specs-url-assert.ts

@@ -0,0 +1,134 @@
+/* eslint-disable */
+/**
+ * Sungen URL assertion helper — auto-generated into specs/url-assert.ts. DO NOT EDIT.
+ *
+ * Every Then-side URL assertion (`see [X] page`, `is on [X] page`) compiles to one call here.
+ *
+ * Why a helper and not an inline predicate. The predicate used to be emitted inline into every
+ * spec, so each correction to what "the URL matches" MEANS was a breaking change for every
+ * generated suite in the field: regenerate everything, re-review every newly-red test. Behind a
+ * helper the same correction ships as a runtime patch. The generator's job shrinks to what it
+ * alone knows — the pathname pattern — and the semantics live in one readable place.
+ *
+ * Why a predicate and not two assertions. The shape before this one was
+ *   await expect(page).toHaveURL(/\/vi\/search/);      // unanchored: passes on /vi/search-x
+ *   expect(page.url()).toContain('<query>');           // synchronous, one-shot: never retries
+ * — two half-checks, neither anchored, and nothing ever compared pathname and query together.
+ * `toHaveURL(predicate)` is web-first (it retries like any other assertion), receives a parsed
+ * URL, and needs no regex escaping of runtime values, which is what forced the split.
+ */
+
+export interface UrlExpectation {
+  /**
+   * Anchored pathname pattern, compiled by the generator from the page selector's `value`
+   * (`:id` segments already wildcarded). Anchored against `u.pathname` ONLY: pathname never
+   * carries the query, so `^…$` is exact there — the same source that was unsafe to anchor
+   * against a full URL.
+   */
+  pathname: RegExp;
+  /**
+   * The `with {{v}}` value, raw from test-data: '?q=1' · '/vi/search?q=1' · '#tab' · ''.
+   * `undefined` means the step declared nothing, which is itself an assertion — see below.
+   */
+  declared?: string;
+  /** The test-data key behind `declared`, so a failure can name what an author must go fix. */
+  dataRef?: string;
+}
+
+/**
+ * Join a page's URL with the `with {{v}}` value for a NAVIGATION step
+ * (`Given User is on [X] page with {{v}}`).
+ *
+ * Why this is not a plain `base + path + value`. It used to be, and an author writing the value as a
+ * whole relative URL — the habit the assertion side already had to accommodate — navigated to
+ * `/vi/search/vi/search?q=1`: the page's own path, twice. The Then side then asserted the real path
+ * correctly, so the scenario could never go green.
+ *
+ * `base` (the configured baseURL, possibly '') and `path` (the page selector's value) arrive
+ * SEPARATELY so a value that carries its own rooted path replaces the page's path without also
+ * discarding a path prefix baked into the baseURL — a deployment under `https://host/tenant-a`
+ * would otherwise navigate to the wrong tenant, and only when a `with {{v}}` was present, which is
+ * exactly the kind of inconsistency nobody would think to look for.
+ *
+ * What it deliberately does NOT do is sanitize. A test may legitimately drive a MALFORMED query to
+ * prove the app rejects it (issue #464), so anything that is not a duplicated path is appended
+ * verbatim: no encoding, no normalising, no reordering.
+ */
+export function joinPath(base: string, path: string, declared?: string | null): string {
+  if (declared === undefined || declared === null || declared === '') return base + path;
+  const value = String(declared);
+  // A query/fragment appends — the overwhelmingly common shape, and the only one #464 needs.
+  if (value.startsWith('?') || value.startsWith('#')) return base + path + value;
+  // An absolute URL replaces everything: the author pasted a full address.
+  if (/^[a-z]+:\/\//i.test(value)) return value;
+  // A rooted path carries its own path, so it replaces the PAGE's path while everything the
+  // baseURL contributed — scheme, host, and any path prefix — is kept.
+  if (value.startsWith('/')) return base + value;
+  // Anything else is raw input the test wants appended as-is.
+  return base + path + value;
+}
+
+/**
+ * `u.pathname` is percent-encoded; a regex built from a selector's literal `value` is not, so a
+ * non-ASCII route (`/読取結果一覧`) could never match. Decoding can throw on a lone `%`, in which
+ * case the raw form is all there is.
+ */
+function decodedPath(pathname: string): string {
+  try {
+    return decodeURIComponent(pathname);
+  } catch {
+    return pathname;
+  }
+}
+
+/**
+ * Build the predicate for `expect(page).toHaveURL(...)`.
+ *
+ * Query semantics are deliberately asymmetric:
+ *   no `with {{v}}`  → the URL must carry NO query. A bare page means a bare page, so
+ *                      `/vi/search` does not pass on `/vi/search?x=1`.
+ *   `with {{v}}`     → every declared param must match; extra params are tolerated, so a
+ *                      tracking/UTM param the test never cared about cannot turn it red.
+ *                      A declared fragment is asserted too; a declared value carrying no query
+ *                      at all constrains the path only (the compiler warns: SG-W014).
+ */
+export function urlMatches({ pathname, declared, dataRef }: UrlExpectation): (u: URL) => boolean {
+  return (u: URL): boolean => {
+    if (!pathname.test(u.pathname) && !pathname.test(decodedPath(u.pathname))) return false;
+
+    // `dataRef`, not `declared`, decides which rule applies. Both "the step declared nothing" and
+    // "the step declared {{v}} but the key resolved to nothing at runtime" arrive here as
+    // undefined, and they mean opposite things: the first is a real assertion (a bare page must be
+    // bare), the second is broken test-data. Only the generator knows which, and it says so by
+    // emitting `dataRef` exactly when the step carried a `with {{v}}`.
+    if (!dataRef) return u.search === '';
+
+    // Silence is the whole bug class this assertion exists to kill, so an unusable declared value
+    // is an ERROR, not a quiet verdict. Returning false would read as "the app is wrong"; these
+    // throws say "your test-data is wrong, and here is the key". An empty value used to parse to
+    // an empty param list, and `[].every()` is vacuously TRUE — it passed on any query at all.
+    if (declared === undefined || declared === null) {
+      throw new Error(`url assertion: test-data key "${dataRef}" is missing — nothing to assert`);
+    }
+    if (String(declared).trim() === '') {
+      throw new Error(`url assertion: test-data key "${dataRef}" is empty — nothing to assert`);
+    }
+
+    // Parsing against the live pathname as base lets ONE expression handle every shape an author
+    // writes: '?q=1' (query only), '/vi/search?q=1' (a whole relative URL — its path is ignored,
+    // the page selector already owns the path), and '#tab' (fragment only). The predecessor
+    // regex-stripped the prefix instead, which silently turned a value with NO query
+    // ('/vi/search') into a bogus param NAME — an assertion that could never be satisfied.
+    const d = new URL(String(declared), 'http://sungen.invalid' + u.pathname);
+
+    // getAll, not get: a multi-select filter (?tag=a&tag=b) is the exact case this assertion is
+    // for, and `get()` returns only the first value — so the correct URL failed. Comparing as a
+    // subset per key keeps this consistent with "extra params are tolerated", and makes param
+    // order meaningless, which is what a URL actually means.
+    const queryOk = [...d.searchParams].every(([k, v]) => u.searchParams.getAll(k).includes(v));
+
+    // Only assert a fragment the author actually declared.
+    const hashOk = !d.hash || d.hash === u.hash;
+    return queryOk && hashOk;
+  };
+}

package/dist/orchestrator/test-data-guide.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"test-data-guide.d.ts","sourceRoot":"","sources":["../../src/orchestrator/test-data-guide.ts"],"names":[],"mappings":"AAaA,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAgBvD;AAuGD;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAoB1D"}
+{"version":3,"file":"test-data-guide.d.ts","sourceRoot":"","sources":["../../src/orchestrator/test-data-guide.ts"],"names":[],"mappings":"AAaA,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAgBvD;AA2GD;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAoB1D"}

package/dist/orchestrator/test-data-guide.js

@@ -163,6 +163,10 @@ const ENV_QA_EXAMPLE = `# Secret test data referenced as \${QA_*} in qa/**/test-
 # Per-environment overrides: .env.qa.<env> + run with SUNGEN_ENV=<env>.
 #
 # QA_ADMIN_PASSWORD=
+#
+# Web baseURL for this environment — overrides the static value in
+# playwright.config.ts (declare per env: .env.qa.dev, .env.qa.uat, ...).
+# SUNGEN_BASE_URL=
 `;
 /**
  * Idempotently create qa/TEST-DATA-GUIDE.md and .env.qa.example, and make sure

package/dist/orchestrator/test-data-guide.js.map

@@ -1 +1 @@
-{"version":3,"file":"test-data-guide.js","sourceRoot":"","sources":["../../src/orchestrator/test-data-guide.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcA,wCAgBC;AA2GD,4DAoBC;AA7JD;;;;;;;;;GASG;AACH,uCAAyB;AACzB,2CAA6B;AAE7B,oEAAoE;AACpE,SAAgB,cAAc,CAAC,QAAgB;IAC7C,OAAO;QACL,KAAK,QAAQ,+DAA+D;QAC5E,+EAA+E;QAC/E,sBAAsB;QACtB,2EAA2E;QAC3E,4EAA4E;QAC5E,wEAAwE;QACxE,iCAAiC;QACjC,8EAA8E;QAC9E,yEAAyE;QACzE,8EAA8E;QAC9E,0EAA0E;QAC1E,+EAA+E;QAC/E,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4FhB,CAAC;AAEF,MAAM,cAAc,GAAG;;;;;CAKtB,CAAC;AAEF;;;GAGG;AACH,SAAgB,wBAAwB,CAAC,GAAW;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAC7D,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACrE,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACnD,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACvF,6EAA6E;QAC7E,oEAAoE;QACpE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1F,EAAE,CAAC,cAAc,CAAC,aAAa,EAAE,iFAAiF,CAAC,CAAC;QACtH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,+EAA+E,EAAE,OAAO,CAAC,CAAC;IAC5H,CAAC;AACH,CAAC"}
+{"version":3,"file":"test-data-guide.js","sourceRoot":"","sources":["../../src/orchestrator/test-data-guide.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcA,wCAgBC;AA+GD,4DAoBC;AAjKD;;;;;;;;;GASG;AACH,uCAAyB;AACzB,2CAA6B;AAE7B,oEAAoE;AACpE,SAAgB,cAAc,CAAC,QAAgB;IAC7C,OAAO;QACL,KAAK,QAAQ,+DAA+D;QAC5E,+EAA+E;QAC/E,sBAAsB;QACtB,2EAA2E;QAC3E,4EAA4E;QAC5E,wEAAwE;QACxE,iCAAiC;QACjC,8EAA8E;QAC9E,yEAAyE;QACzE,8EAA8E;QAC9E,0EAA0E;QAC1E,+EAA+E;QAC/E,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4FhB,CAAC;AAEF,MAAM,cAAc,GAAG;;;;;;;;;CAStB,CAAC;AAEF;;;GAGG;AACH,SAAgB,wBAAwB,CAAC,GAAW;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAC7D,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACrE,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACnD,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACvF,6EAA6E;QAC7E,oEAAoE;QACpE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1F,EAAE,CAAC,cAAc,CAAC,aAAa,EAAE,iFAAiF,CAAC,CAAC;QACtH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,+EAA+E,EAAE,OAAO,CAAC,CAAC;IAC5H,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sun-asterisk/sungen",
-  "version": "3.2.18",
+  "version": "3.2.20",
   "description": "Deterministic E2E Test Compiler - Gherkin + Selectors → Playwright tests",
   "main": "src/index.ts",
   "types": "src/index.ts",
@@ -39,8 +39,8 @@
     "@babel/types": "^7.28.5",
     "@cucumber/gherkin": "^37.0.0",
     "@cucumber/messages": "^31.0.0",
-    "@sungen/driver-data-factory": "3.2.18",
-    "@sungen/driver-ui": "3.2.18",
+    "@sungen/driver-data-factory": "3.2.20",
+    "@sungen/driver-ui": "3.2.20",
     "chalk": "^5.6.2",
     "commander": "^14.0.2",
     "dotenv": "^17.2.3",

package/src/capabilities/discover.ts

@@ -27,7 +27,10 @@ import { LOCAL_DRIVERS, registerCoreCapability } from './builtins';
  * move to their packages (R5.5/R5.6) they join this list and leave `LOCAL_DRIVERS`; eventually this
  * becomes a scan of installed `@sungen/driver-*` packages (R5.7).
  */
-const EXTERNAL_DRIVERS = ['@sungen/driver-ui', '@sungen/driver-db', '@sungen/driver-api', '@sungen/driver-mobile', '@sungen/driver-data-factory'];
+// driver-mock appended at the END: ordering = registration = composition (tie-breaks
+// between equal-priority patterns follow registration order) — inserting mid-list
+// shifts them and shows up as golden diffs.
+const EXTERNAL_DRIVERS = ['@sungen/driver-ui', '@sungen/driver-db', '@sungen/driver-api', '@sungen/driver-mobile', '@sungen/driver-data-factory', '@sungen/driver-mock'];
 
 /**
  * Bundled (non-opt-in) drivers: shipped as a core dependency (`drivers.yaml` `bundled: true`), so the

package/src/cli/commands/add.ts

@@ -1,6 +1,7 @@
 import { Command } from 'commander';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { featureFilesFor } from '../../harness/unit-paths';
 
 export function registerAddCommand(program: Command): void {
   program
@@ -27,8 +28,9 @@ export function registerAddCommand(program: Command): void {
         // When --figma is set on an existing screen, skip scaffolding and
         // just refresh Figma-derived files (spec_figma.md, ui/*.png).
         const screenDir = path.join(process.cwd(), 'qa', 'screens', options.screen);
-        const featureFile = path.join(screenDir, 'features', `${options.screen}.feature`);
-        const screenAlreadyExists = fs.existsSync(featureFile);
+        // ANY `.feature` means the screen exists — its file may be named after the --path
+        // segment or be a `--feature` sub-feature, not `<screen>.feature`.
+        const screenAlreadyExists = featureFilesFor(screenDir, options.screen).some((f) => fs.existsSync(f));
 
         if (!(options.figma && screenAlreadyExists)) {
           const { ScreenManager } = require('../../orchestrator/screen-manager');

package/src/cli/commands/dashboard.ts

@@ -12,6 +12,7 @@ import * as path from 'path';
 import * as fs from 'fs';
 import { execSync } from 'child_process';
 import { EnvironmentInfo } from '../../exporters/types';
+import { resolveWebBaseUrl } from '../../exporters/env-qa';
 import {
   buildDashboardSnapshot,
   DashboardTarget,
@@ -42,11 +43,14 @@ function getEnvironment(cwd: string): EnvironmentInfo {
   const configPath = path.join(cwd, 'playwright.config.ts');
   if (fs.existsSync(configPath)) {
     const c = fs.readFileSync(configPath, 'utf-8');
-    const baseMatch = c.match(/baseURL:\s*['"]([^'"]+)['"]/);
+    // Both config shapes: legacy literal and env-aware resolveBaseUrl('x') wrapper.
+    const baseMatch = c.match(/baseURL:\s*(?:resolveBaseUrl\(\s*)?['"]([^'"]+)['"]/);
     if (baseMatch) baseURL = baseMatch[1];
     const projMatch = c.match(/name:\s*['"]([^'"]+)['"]/);
     if (projMatch) projectName = projMatch[1];
   }
+  // Same SUNGEN_BASE_URL override as delivery — the two surfaces must agree.
+  baseURL = resolveWebBaseUrl(cwd, baseURL);
 
   let executor = process.env.CI_USER || process.env.USER || '';
   try {
@@ -61,6 +65,7 @@ interface DashboardOptions {
   noHistory?: boolean;
   open?: boolean;
   maxHistory?: string;
+  env?: string;
 }
 
 export function registerDashboardCommand(program: Command): void {
@@ -71,9 +76,13 @@ export function registerDashboardCommand(program: Command): void {
     .option('--no-history', 'Do not persist this run under qa/dashboard/history/')
     .option('--max-history <n>', `Limit snapshots included in dashboard stats (default: ${DEFAULT_MAX_HISTORY}). Older files are kept on disk.`)
     .option('--open', 'Open the rendered HTML in the default browser when done')
+    .option('--env <env>', 'Build the dashboard for one environment/locale (sets SUNGEN_ENV): picks that env\'s result files, and Trends/Compare only see history snapshots of the same env')
     .action(async (names: string[], options: DashboardOptions) => {
       try {
         const cwd = process.cwd();
+        // Same convention as run-test/delivery: SUNGEN_ENV drives result-file
+        // resolution, locale pairing, and (new) history scoping downstream.
+        if (options.env) process.env.SUNGEN_ENV = options.env;
 
         // 1. Scope detection
         let targets: DashboardTarget[];

package/src/cli/commands/delivery.ts

@@ -24,7 +24,9 @@ import {
 import { renderXlsxMultiSheet, writeXlsx, buildApiDetailRows, addApiDetailSheet } from '../../exporters/xlsx-exporter';
 import { loadApiCatalog } from '../../exporters/api-catalog-loader';
 import { resolveApiEnvironment } from '../../exporters/api-environment';
+import { resolveWebBaseUrl } from '../../exporters/env-qa';
 import { resolvePlatformAppId } from '../../exporters/mobile-app-id';
+import { scanTestDataSecrets } from '../../harness/secret-scan';
 import { EnvironmentInfo, PreflightCheck, ScreenSummary, TestCaseRow, ApiCatalogEntry } from '../../exporters/types';
 import { mapFilePath } from '../../exporters/matrix/map-loader';
 import {
@@ -343,11 +345,16 @@ function getEnvironment(cwd: string): EnvironmentInfo {
   const configPath = path.join(cwd, 'playwright.config.ts');
   if (fs.existsSync(configPath)) {
     const c = fs.readFileSync(configPath, 'utf-8');
-    const baseMatch = c.match(/baseURL:\s*['"]([^'"]+)['"]/);
+    // Both config shapes: the legacy literal `baseURL: 'x'` and the env-aware
+    // `baseURL: resolveBaseUrl('x')` (the quoted value is the static fallback).
+    const baseMatch = c.match(/baseURL:\s*(?:resolveBaseUrl\(\s*)?['"]([^'"]+)['"]/);
     if (baseMatch) baseURL = baseMatch[1];
     const projMatch = c.match(/name:\s*['"]([^'"]+)['"]/);
     if (projMatch) projectName = projMatch[1];
   }
+  // SUNGEN_BASE_URL (shell > .env.qa.<SUNGEN_ENV> > .env.qa) overrides the static
+  // value — the Test Environment column must show the host the run actually hit.
+  baseURL = resolveWebBaseUrl(cwd, baseURL);
 
   let executor = process.env.CI_USER || process.env.USER || '';
   try {
@@ -894,6 +901,17 @@ export function registerDeliveryCommand(program: Command): void {
           }
         }
 
+        // Security S0 — warn (never block) if test-data looks to hold a real secret.
+        // Deliverables are COMMITTED files; delivery is the last stop before a
+        // hardcoded credential lands in one. Same scan `generate` runs.
+        const scanDirs = [...new Set(toExport.map((t) => qaDir(cwd, t)))];
+        const secretHits = scanDirs.flatMap((d) => scanTestDataSecrets(d));
+        if (secretHits.length) {
+          log(`\n⚠️  Possible secret(s) in committed test-data (review — do NOT commit real credentials):`);
+          for (const h of secretHits.slice(0, 10)) log(`   ${h.file}:${h.line} — ${h.reason}`);
+          log(`   Move real secrets to an env overlay / CI secret; keep test-data placeholders only.\n`);
+        }
+
         // 3. Export
         const legacy = options.legacy || options.full;
         if (!legacy) {

package/src/cli/commands/generate.ts

@@ -208,11 +208,19 @@ export function registerGenerateCommand(program: Command): void {
         }
 
         // Security S0 — warn (never block) if test-data looks to hold a real secret.
+        // Scoped to the unit being generated: --area used to fall through to the
+        // enumerate-everything branch, so `generate --area X` printed OTHER units'
+        // secret-scan and dead-data lint findings under X's run (field report: one
+        // unit's "service_url is dead data" warning repeated on all 10 API units).
         const scanDirs: string[] = [];
         if (screenName) scanDirs.push(path.join(process.cwd(), 'qa', 'screens', screenName));
         else if (flowName) scanDirs.push(path.join(process.cwd(), 'qa', 'flows', flowName));
+        else if (apiName) scanDirs.push(path.join(process.cwd(), 'qa', 'api', apiName));
         else {
-          for (const base of ['screens', 'flows']) {
+          // qa/api units are yaml sinks too (apis.yaml headers, mock bodies once shared);
+          // api/flows nests one level deeper. A file entry in the list is harmless —
+          // scanTestDataSecrets only reads known subdirs of each entry.
+          for (const base of ['screens', 'flows', 'api', path.join('api', 'flows')]) {
             const d = path.join(process.cwd(), 'qa', base);
             if (fs.existsSync(d)) for (const n of fs.readdirSync(d)) scanDirs.push(path.join(d, n));
           }

package/src/dashboard/html-renderer.ts

@@ -48,8 +48,14 @@ export function buildPayload(
   historyLimit?: number,
 ): DashboardPayload {
   const all = readHistory(cwd, historyLimit);
-  // Exclude `current` from history if it's been written there already.
-  const history = all.filter((s) => s.runId !== current.runId);
+  // Exclude `current` from history if it's been written there already, and keep
+  // ONLY snapshots of the SAME environment: qa/dashboard/history/ accumulates
+  // dev/uat/stg runs side by side, and blending them gave Trends one mixed
+  // pass-rate line and let Compare diff across environments. Legacy snapshots
+  // without the field count as base runs ('').
+  const currentEnv = current.environment?.sungenEnv || '';
+  const history = all.filter((s) =>
+    s.runId !== current.runId && (s.environment?.sungenEnv || '') === currentEnv);
   return { current, history };
 }
 

package/src/dashboard/snapshot-builder.ts

@@ -541,6 +541,9 @@ function collectEnvironment(cwd: string, env: EnvironmentInfo) {
     sungenVersion: getPackageVersion(),
     gitBranch,
     gitSha,
+    // Which environment this snapshot belongs to — dev/uat/stg runs must never
+    // blend into one trend line ('' = base run).
+    sungenEnv: process.env.SUNGEN_ENV || '',
   };
 }
 

package/src/dashboard/types.ts

@@ -23,6 +23,10 @@ export interface SnapshotEnvironment {
   sungenVersion: string;
   gitBranch?: string;
   gitSha?: string;
+  /** SUNGEN_ENV the snapshot was built under ('' = base run, absent on legacy
+   *  snapshots). Trends/Compare must never mix runs of different environments,
+   *  so the payload builder filters history by this field. */
+  sungenEnv?: string;
 }
 
 export interface AggregateSummary {

package/src/exporters/api-environment.ts

@@ -19,6 +19,9 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { parse as parseYaml } from 'yaml';
 import { ApiCatalogEntry } from './types';
+// .env.qa reading (runtime-precedence, local map) moved to ./env-qa so the web
+// baseURL resolver shares the exact same rules.
+import { buildEnvMap } from './env-qa';
 
 interface ApiDatasourceConf {
   kind?: string;
@@ -26,26 +29,6 @@ interface ApiDatasourceConf {
   baseUrl?: string;
 }
 
-/** Read KEY=value lines from one dotenv-style file (quotes stripped, comments ignored). */
-function readEnvFile(file: string, into: Record<string, string>): void {
-  if (!fs.existsSync(file)) return;
-  for (const line of fs.readFileSync(file, 'utf8').split('\n')) {
-    const m = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*?)\s*$/);
-    if (m && into[m[1]] === undefined) into[m[1]] = m[2].replace(/^["']|["']$/g, '');
-  }
-}
-
-/** Shell env > .env.qa.<SUNGEN_ENV> > .env.qa — same precedence as the runtime's
- *  loadEnvQa, but built as a LOCAL map (the exporter must not mutate process.env). */
-function buildEnvMap(cwd: string): Record<string, string> {
-  const map: Record<string, string> = {};
-  for (const name of [`.env.qa.${process.env.SUNGEN_ENV || ''}`, '.env.qa']) {
-    if (!name.endsWith('.')) readEnvFile(path.join(cwd, name), map);
-  }
-  for (const [k, v] of Object.entries(process.env)) if (v !== undefined) map[k] = v;
-  return map;
-}
-
 function loadDatasources(cwd: string): Record<string, ApiDatasourceConf> {
   const file = [path.join(cwd, 'datasources.yaml'), path.join(cwd, 'qa', 'datasources.yaml')]
     .find((f) => fs.existsSync(f));

package/src/exporters/api-testcase-formatter.ts

@@ -295,7 +295,7 @@ function formatBodyFile(bodyFile: unknown, args: Record<string, string>, localiz
  * test-data keys — catches variants like confirmPassword / new_password /
  * password_confirmation / access_token / client_secret / otp / passcode.
  */
-const SENSITIVE_NAME = /pass(word|code)?|passwd|pwd|secret|token|otp|api[-_]?key|apikey|credential|authorization/i;
+export const SENSITIVE_NAME = /pass(word|code)?|passwd|pwd|secret|token|otp|api[-_]?key|apikey|credential|authorization/i;
 function isSensitiveField(key: string): boolean {
   return SENSITIVE_NAME.test(key);
 }
@@ -319,7 +319,13 @@ export function collectSecretValues(testData: Record<string, string>): string[]
 export function redactSecrets(text: string, secrets: string[]): string {
   if (secrets.length === 0 || !text) return text;
   let out = text;
-  for (const s of secrets) out = out.split(s).join('***');
+  for (const s of secrets) {
+    // Floor lives HERE, not only in the collectors: an empty string would split('')
+    // and interleave `***` between every character; a 1-2 char value masks
+    // coincidental text. Callers building their own denylist must not bypass it.
+    if (!s || s.length < 3) continue;
+    out = out.split(s).join('***');
+  }
   return out;
 }
 

package/src/exporters/csv-exporter.ts

@@ -15,7 +15,7 @@ import {
   mapVpToCategory2,
   splitVpAndName,
 } from './feature-parser';
-import { formatFeatureSteps, formatPrecondition, keepActor, stripActor } from './step-formatter';
+import { formatPrecondition, groupExpectedByAnchor, keepActor, stripActor } from './step-formatter';
 import { formatTestData, substituteTestDataVars } from './test-data-resolver';
 import {
   formatExecutedDate,
@@ -26,6 +26,7 @@ import { ApiCatalogEntry, EnvironmentInfo, PlaywrightResult, ScreenSummary, Test
 import { collectSecretValues, formatApiExpected, formatApiRequest, hasApiCalls, redactSecrets } from './api-testcase-formatter';
 import { SelectorKeyMap, substituteSelectorKeysInStep } from './selector-key-resolver';
 import { formatVariantRow, resolveResultVariants } from './result-variants';
+import { collectQaEnvSecretDenylist, warnIfRedactionIncomplete } from './qa-env-secret-denylist';
 
 export interface BuildCsvInput {
   screen: string;
@@ -65,6 +66,10 @@ export interface BuildCsvInput {
 export function buildTestCaseRows(input: BuildCsvInput): TestCaseRow[] {
   const rows: TestCaseRow[] = [];
   let fallbackIndex = 1;
+  // Runtime failure messages embed RESOLVED ${QA_*} credentials (Expected:/Received:
+  // carry the substituted value) and are lifted into the committed Note column below —
+  // build the value denylist once per unit so every Note gets scrubbed.
+  const qaEnvSecrets = collectQaEnvSecretDenylist(input.testData);
 
   for (const m of input.merged) {
     // Data-driven (@cases): expand to one CSV row per executed dataset input (Playwright titles
@@ -83,9 +88,9 @@ export function buildTestCaseRows(input: BuildCsvInput): TestCaseRow[] {
     const testcaseType = extractTestcaseType(m.feature.tags);
     const authRole = extractAuthRole(m.feature.tags);
 
-    // Pre-condition is auth-only. Steps section = Background + @extend base
-    // (entire) + own pre-Then. Expected = own's Then-onwards only.
-    const precondition = formatPrecondition(authRole);
+    // Pre-condition = auth line + feature Background steps (kept out of Steps
+    // so the numbering matches the .feature scenario). Steps section = @extend
+    // base (entire) + own pre-Then. Expected = own's Then-onwards only.
     const localize = (text: string): string => {
       // 1. resolve [Reference] selector keys → their label/value; 2. resolve {{var}} test-data
       //    placeholders → concrete values, so Steps / Expected results show what QA actually verifies
@@ -98,13 +103,29 @@ export function buildTestCaseRows(input: BuildCsvInput): TestCaseRow[] {
     };
     const formatStep = (s: { text: string; bucket: 'given' | 'when' | 'then' }) =>
       localize(s.bucket === 'given' ? keepActor(s.text) : stripActor(s.text));
-    const stepLines    = m.resolvedSteps.map(formatStep).filter(Boolean);
-    const expectedLines = m.resolvedExpected.map(formatStep).filter(Boolean);
+    const precondition = formatPrecondition(
+      authRole,
+      (m.resolvedBackgroundSteps ?? []).map(formatStep).filter(Boolean)
+    );
+    const stepLines = m.resolvedSteps.map(formatStep).filter(Boolean);
+    // Scenarios whose assertions verify different moments render Expected as
+    // "— after step N" groups (shared rule in groupExpectedByAnchor); the
+    // common all-after-last-step shape keeps the plain checklist.
+    const { lines: expectedLines, grouped } = groupExpectedByAnchor(
+      m.resolvedExpected
+        .map((s) => ({ text: formatStep(s), anchorStep: s.anchorStep }))
+        .filter((e) => e.text),
+      m.resolvedAnchorActionCount ?? 0
+    );
+    // When group headers reference step numbers, the Steps cell must show
+    // them — number even a single line.
     let steps =
       stepLines.length === 0 ? '' :
-      stepLines.length === 1 ? stepLines[0] :
+      stepLines.length === 1 && !grouped ? stepLines[0] :
       stepLines.map((l, i) => `${i + 1}. ${l}`).join('\n');
+    // Grouped cells carry their own per-group numbering — join verbatim.
     let expectedResults =
+      grouped ? expectedLines.join('\n') :
       expectedLines.length === 0 ? '' :
       expectedLines.length === 1 ? expectedLines[0] :
       expectedLines.map((l, i) => `${i + 1}. ${l}`).join('\n');
@@ -138,6 +159,19 @@ export function buildTestCaseRows(input: BuildCsvInput): TestCaseRow[] {
     const variantRow = formatVariantRow(variant, '\n');
     if (variantRow) testData = testData ? `${testData}\n${variantRow}` : variantRow;
 
+    // Runtime-secret pass over EVERY kind's content cells (screen/flow included, not
+    // only api): a sensitive ${QA_*} VALUE that reached cell content — a hardcoded
+    // copy in test-data, a @cases dataset row, a locale substitution — is erased.
+    // Value-based only: fake demo values ("password123"), error-message strings
+    // ("Password is required") and element names ([Password]) never match and stay
+    // readable. The key-name-based pass above stays API-only by design — applied to
+    // screen cells it would mangle exactly those strings.
+    if (qaEnvSecrets.values.length > 0) {
+      steps = redactSecrets(steps, qaEnvSecrets.values);
+      expectedResults = redactSecrets(expectedResults, qaEnvSecrets.values);
+      testData = redactSecrets(testData, qaEnvSecrets.values);
+    }
+
     // Status for this (possibly per-input) row — resolved into `variant` above.
     const result: PlaywrightResult | undefined = variant.result;
 
@@ -156,7 +190,7 @@ export function buildTestCaseRows(input: BuildCsvInput): TestCaseRow[] {
       // first, those already-passed/failed rows were mislabelled N/A ("not compiled").
       testResult = statusToTestResult(result.status);
       executedDate = formatExecutedDate(result.startTime);
-      note = formatNote(result, expectedResults);
+      note = redactSecrets(formatNote(result, expectedResults), qaEnvSecrets.values);
       environment = formatEnv(input.env.baseURL, input.featurePath, result.projectName || input.env.projectName);
       executor = input.env.executor;
     } else if (!m.spec) {
@@ -202,6 +236,11 @@ export function buildTestCaseRows(input: BuildCsvInput): TestCaseRow[] {
    }
   }
 
+  // A sensitive ${QA_*} ref that resolved to nothing here can still appear RESOLVED in
+  // failure text (the run may have happened in another shell, e.g. CI artifacts exported
+  // locally) — never export silently unredacted.
+  warnIfRedactionIncomplete(qaEnvSecrets, rows.some((r) => r.testResult === 'Failed'), input.screen);
+
   return rows;
 }
 

package/src/exporters/env-qa.ts

@@ -0,0 +1,41 @@
+/**
+ * .env.qa readers shared by the CLI surfaces (delivery, dashboard, screen capture)
+ * — the same precedence the RUNTIME uses (specs-test-data / specs-api loadEnvQa):
+ *
+ *   shell env  >  .env.qa.<SUNGEN_ENV>  >  .env.qa
+ *
+ * Built as a LOCAL map: unlike the runtime's loadEnvQa, the CLI must never
+ * mutate process.env (it keeps running after the lookup).
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+
+/** Read KEY=value lines from one dotenv-style file (quotes stripped, comments ignored). */
+export function readEnvFile(file: string, into: Record<string, string>): void {
+  if (!fs.existsSync(file)) return;
+  for (const line of fs.readFileSync(file, 'utf8').split('\n')) {
+    const m = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*?)\s*$/);
+    if (m && into[m[1]] === undefined) into[m[1]] = m[2].replace(/^["']|["']$/g, '');
+  }
+}
+
+/** Merged env view for a project dir, with the runtime's precedence. */
+export function buildEnvMap(cwd: string): Record<string, string> {
+  const map: Record<string, string> = {};
+  for (const name of [`.env.qa.${process.env.SUNGEN_ENV || ''}`, '.env.qa']) {
+    if (!name.endsWith('.')) readEnvFile(path.join(cwd, name), map);
+  }
+  for (const [k, v] of Object.entries(process.env)) if (v !== undefined) map[k] = v;
+  return map;
+}
+
+/**
+ * The web baseURL a run under the CURRENT SUNGEN_ENV actually uses.
+ * `SUNGEN_BASE_URL` (shell > .env.qa.<SUNGEN_ENV> > .env.qa) overrides the static
+ * value written in playwright.config.ts — mirroring the scaffolded config's own
+ * resolveBaseUrl(), so the Test Environment column and screenshot capture report
+ * the host the tests really hit.
+ */
+export function resolveWebBaseUrl(cwd: string, staticBaseUrl: string): string {
+  return buildEnvMap(cwd).SUNGEN_BASE_URL || staticBaseUrl;
+}