@testsmith/api-spector 0.2.4 → 0.2.5

package/out/main/chunks/{request-collection-DIsjTggj.js → request-collection-CElFJzre.js}

@@ -254,13 +254,15 @@ class AssertionError extends Error {
   }
 }
 function buildAt(ctx, testResults, consoleOutput) {
-  const { envVars, collectionVars, globals: globals2, localVars } = ctx;
+  const { envVars, collectionVars, globals: globals2, localVars, piiMaskPatterns = [] } = ctx;
+  const isSensitiveKey = (key) => piiMaskPatterns.some((p) => key.toLowerCase().includes(p.toLowerCase()));
   function makeVarScope(store, scopeName) {
     return {
       get: (key) => store[key] ?? null,
       set: (key, value) => {
         store[key] = String(value);
-        consoleOutput.push(`[set] ${scopeName}.${key} = ${JSON.stringify(String(value))}`);
+        const display = isSensitiveKey(key) ? '"[REDACTED]"' : JSON.stringify(String(value));
+        consoleOutput.push(`[set] ${scopeName}.${key} = ${display}`);
       },
       clear: (key) => {
         delete store[key];
@@ -383,7 +385,8 @@ async function runScript(code, ctx, timeoutMs = 5e3) {
     collectionVars: collectionCopy,
     globals: globalsCopy,
     localVars: localVarsCopy,
-    response: ctx.response
+    response: ctx.response,
+    piiMaskPatterns: ctx.piiMaskPatterns
   };
   const sp = buildAt(scriptCtx, testResults, consoleOutput);
   const captureConsole = {
@@ -602,6 +605,40 @@ function buildSchemaTestResults(schemaText, body) {
     error: err.message ?? "Schema violation"
   }));
 }
+function buildProtocolFaultTests(bodyMode, body) {
+  if (!body) return [];
+  if (bodyMode === "soap") {
+    const isFault = /<(?:[\w-]+:)?Fault(?:\s|>)/i.test(body);
+    if (isFault) {
+      const reason = /<(?:[\w-]+:)?(?:faultstring|Text)[^>]*>([\s\S]*?)<\/(?:[\w-]+:)?(?:faultstring|Text)>/i.exec(body);
+      return [{
+        name: "[soap] response is not a Fault",
+        passed: false,
+        error: reason?.[1]?.trim() ?? "SOAP Fault returned"
+      }];
+    }
+    return [{ name: "[soap] response is not a Fault", passed: true }];
+  }
+  if (bodyMode === "graphql") {
+    let parsed;
+    try {
+      parsed = JSON.parse(body);
+    } catch {
+      return [];
+    }
+    const errors = parsed?.errors;
+    if (Array.isArray(errors) && errors.length > 0) {
+      const first = errors[0];
+      return [{
+        name: "[graphql] response has no errors",
+        passed: false,
+        error: first?.message ?? "GraphQL response contained an `errors` array"
+      }];
+    }
+    return [{ name: "[graphql] response has no errors", passed: true }];
+  }
+  return [];
+}
 async function buildDispatcher(proxy, tls) {
   const connectOpts = {};
   let hasTls = false;
@@ -697,6 +734,7 @@ function registerRequestHandler(ipc) {
       vars = authBuilder.mergeVars(updatedEnvVars, updatedCollectionVars, updatedGlobals, localVars, dynamicVars);
     }
     let response;
+    let scriptResponse;
     let sentRequest = { method: req.method, url: "", headers: {} };
     const resolvedUrl = authBuilder.buildUrl(req.url, req.params, vars);
     const secretValues = /* @__PURE__ */ new Set();
@@ -840,6 +878,14 @@ function registerRequestHandler(ipc) {
         bodySize: Buffer.byteLength(responseBody, "utf8"),
         durationMs
       };
+      scriptResponse = {
+        status: fetchResp.status,
+        statusText: fetchResp.statusText,
+        headers: rawResponseHeaders,
+        body: responseBody,
+        bodySize: Buffer.byteLength(responseBody, "utf8"),
+        durationMs
+      };
     } catch (err) {
       const diagnostic = formatRequestError(err, {
         requestId: req.id,
@@ -858,8 +904,9 @@ function registerRequestHandler(ipc) {
         durationMs: Date.now() - start,
         error: diagnostic
       };
+      scriptResponse = response;
     }
-    const schemaTestResults = !response.error ? buildSchemaTestResults(req.schema, response.body) : [];
+    const schemaTestResults = !response.error ? buildSchemaTestResults(req.schema, scriptResponse.body) : [];
     let postTestResults = [];
     let postConsole = [];
     let postError;
@@ -869,7 +916,9 @@ function registerRequestHandler(ipc) {
         collectionVars: { ...updatedCollectionVars },
         globals: { ...updatedGlobals },
         localVars: { ...localVars },
-        response
+        // Pass the *unmasked* response so the script can extract real values
+        // (tokens, ids, …). The displayed `response` keeps the redacted copy.
+        response: scriptResponse
       });
       postTestResults = result.testResults;
       postConsole = result.consoleOutput;
@@ -916,22 +965,57 @@ function registerRequestHandler(ipc) {
     };
   });
 }
-function collectTagged(folder, requests, collectionVars, filterTags, parentPath = [], isRoot = true) {
-  const results = [];
-  const scopePath = isRoot ? parentPath : [...parentPath, folder.name];
-  for (const reqId of folder.requestIds) {
-    const req = requests[reqId];
-    if (!req || req.hookType || req.disabled) continue;
+function makeHook(req, collectionVars, hookType, scopeId, scopeAncestors, scopePath, mainRequestId) {
+  return { request: req, collectionVars, isHook: true, hookType, scopeId, scopeAncestors, scopePath, mainRequestId };
+}
+function buildFolderPlan(folder, requests, collectionVars, filterTags, scopeId, ancestorIds, parentPath, wrappers, isRoot) {
+  const result = [];
+  const scopePath = isRoot ? [] : [...parentPath, folder.name];
+  const folderReqs = folder.requestIds.map((id) => requests[id]).filter((r) => r && !r.disabled);
+  const beforeAllHooks = folderReqs.filter((r) => r.hookType === "beforeAll");
+  const beforeHooks = folderReqs.filter((r) => r.hookType === "before");
+  const afterHooks = folderReqs.filter((r) => r.hookType === "after");
+  const afterAllHooks = folderReqs.filter((r) => r.hookType === "afterAll");
+  const regularReqs = folderReqs.filter((r) => !r.hookType);
+  const myWrapper = { scopeId, ancestors: ancestorIds, scopePath, before: beforeHooks, after: afterHooks };
+  const allWrappers = [...wrappers, myWrapper];
+  for (const req of beforeAllHooks) {
+    result.push(makeHook(req, collectionVars, "beforeAll", scopeId, ancestorIds, scopePath));
+  }
+  for (const req of regularReqs) {
     const tags = req.meta?.tags ?? [];
     if (filterTags.length > 0 && !filterTags.some((t) => tags.includes(t))) continue;
-    results.push({ request: req, collectionVars, scopePath });
+    for (const w of allWrappers) {
+      for (const hookReq of w.before) {
+        result.push(makeHook(hookReq, collectionVars, "before", w.scopeId, w.ancestors, w.scopePath, req.id));
+      }
+    }
+    result.push({ request: req, collectionVars, scopeId, scopeAncestors: ancestorIds, scopePath });
+    for (const w of [...allWrappers].reverse()) {
+      for (const hookReq of w.after) {
+        result.push(makeHook(hookReq, collectionVars, "after", w.scopeId, w.ancestors, w.scopePath, req.id));
+      }
+    }
   }
   for (const sub of folder.folders) {
     const folderTags = sub.tags ?? [];
-    const effectiveTags = filterTags.length === 0 ? filterTags : folderTags.some((t) => filterTags.includes(t)) ? [] : filterTags;
-    results.push(...collectTagged(sub, requests, collectionVars, effectiveTags, scopePath, false));
+    const effectiveFilter = filterTags.length === 0 ? filterTags : folderTags.some((t) => filterTags.includes(t)) ? [] : filterTags;
+    result.push(...buildFolderPlan(
+      sub,
+      requests,
+      collectionVars,
+      effectiveFilter,
+      sub.id,
+      [...ancestorIds, scopeId],
+      scopePath,
+      allWrappers,
+      false
+    ));
   }
-  return results;
+  for (const req of afterAllHooks) {
+    result.push(makeHook(req, collectionVars, "afterAll", scopeId, ancestorIds, scopePath));
+  }
+  return result;
 }
 function folderPathTo(root, requestId) {
   if (root.requestIds.includes(requestId)) return [root];
@@ -979,9 +1063,26 @@ function resolveInheritedAuthAndHeaders(requestId, collection) {
   }
   return { auth: inheritedAuth, headers: inheritedHeaders };
 }
+function buildRunPlan(collection, folderId, filterTags) {
+  const collectionVars = collection.collectionVariables ?? {};
+  {
+    return buildFolderPlan(
+      collection.rootFolder,
+      collection.requests,
+      collectionVars,
+      filterTags,
+      collection.rootFolder.id,
+      [],
+      [],
+      [],
+      true
+    );
+  }
+}
 exports.buildDispatcher = buildDispatcher;
+exports.buildProtocolFaultTests = buildProtocolFaultTests;
+exports.buildRunPlan = buildRunPlan;
 exports.buildSchemaTestResults = buildSchemaTestResults;
-exports.collectTagged = collectTagged;
 exports.getAllApplicableHooks = getAllApplicableHooks;
 exports.getGlobals = getGlobals;
 exports.loadGlobals = loadGlobals;

package/out/main/index.js

@@ -25,7 +25,7 @@ const electron = require("electron");
 const path = require("path");
 const fs = require("fs");
 const promises = require("fs/promises");
-const requestCollection = require("./chunks/request-collection-DIsjTggj.js");
+const requestCollection = require("./chunks/request-collection-CElFJzre.js");
 const authBuilder = require("./chunks/auth-builder-B7-LgcGr.js");
 const uuid = require("uuid");
 const jsYaml = require("js-yaml");
@@ -3292,7 +3292,8 @@ async function executeOne(req, collectionVars, envVars, globals, localVars, disp
       envVars: { ...envVars },
       collectionVars: { ...collectionVars },
       globals: { ...globals },
-      localVars: {}
+      localVars: {},
+      piiMaskPatterns
     });
     preScriptError = r.error;
     localVars = r.updatedLocalVars;
@@ -3330,6 +3331,25 @@ async function executeOne(req, collectionVars, envVars, globals, localVars, disp
     } else if (req.body.mode === "raw" && req.body.raw) {
       body = authBuilder.interpolate(req.body.raw, vars);
       if (!headers.has("content-type")) headers.set("Content-Type", req.body.rawContentType ?? "text/plain");
+    } else if (req.body.mode === "graphql" && req.body.graphql) {
+      const gql = req.body.graphql;
+      const gqlBody = { query: authBuilder.interpolate(gql.query, vars) };
+      const rawVars = gql.variables?.trim();
+      if (rawVars) {
+        try {
+          gqlBody.variables = JSON.parse(authBuilder.interpolate(rawVars, vars));
+        } catch {
+        }
+      }
+      if (gql.operationName?.trim()) gqlBody.operationName = gql.operationName.trim();
+      body = JSON.stringify(gqlBody);
+      if (!headers.has("content-type")) headers.set("Content-Type", "application/json");
+    } else if (req.body.mode === "soap" && req.body.soap) {
+      body = authBuilder.interpolate(req.body.soap.envelope, vars);
+      if (!headers.has("content-type")) headers.set("Content-Type", "text/xml; charset=utf-8");
+      if (req.body.soap.soapAction && !headers.has("soapaction")) {
+        headers.set("SOAPAction", req.body.soap.soapAction);
+      }
     }
     const methodHasBody = !["GET", "HEAD"].includes(req.method);
     const doFetch = (h) => undici.fetch(resolvedUrl, {
@@ -3361,16 +3381,17 @@ async function executeOne(req, collectionVars, envVars, globals, localVars, disp
     });
     const maskedBody = requestCollection.maskPii(responseBody, piiMaskPatterns);
     const maskedHeaders = requestCollection.maskHeaders(rawRespHeaders, piiMaskPatterns);
-    const response = {
+    const scriptResponse = {
       status: fetchResp.status,
       statusText: fetchResp.statusText,
-      headers: maskedHeaders,
-      body: maskedBody,
+      headers: rawRespHeaders,
+      body: responseBody,
       bodySize: Buffer.byteLength(responseBody, "utf8"),
       durationMs
     };
     const schemaTestResults = requestCollection.buildSchemaTestResults(req.schema, responseBody);
-    let testResults = [...schemaTestResults];
+    const protocolFaultTests = requestCollection.buildProtocolFaultTests(req.body.mode, responseBody);
+    let testResults = [...schemaTestResults, ...protocolFaultTests];
     let consoleOutput = [];
     let postScriptError;
     if (req.postRequestScript?.trim()) {
@@ -3379,9 +3400,10 @@ async function executeOne(req, collectionVars, envVars, globals, localVars, disp
         collectionVars: updatedCollectionVars,
         globals: updatedGlobals,
         localVars,
-        response
+        response: scriptResponse,
+        piiMaskPatterns
       });
-      testResults = [...schemaTestResults, ...r.testResults];
+      testResults = [...schemaTestResults, ...protocolFaultTests, ...r.testResults];
       consoleOutput = r.consoleOutput;
       postScriptError = r.error;
       updatedEnvVars = r.updatedEnvVars;
@@ -3394,7 +3416,7 @@ async function executeOne(req, collectionVars, envVars, globals, localVars, disp
     const allPassed = testResults.every((t) => t.passed);
     const httpFailed = fetchResp.status >= 400;
     const hasTests = testResults.length > 0;
-    const status = postScriptError ? "error" : hasTests ? allPassed ? "passed" : "failed" : httpFailed ? "failed" : "skipped";
+    const status = postScriptError ? "error" : hasTests ? allPassed ? "passed" : "failed" : httpFailed ? "failed" : "passed";
     if (httpFailed && testResults.length === 0) {
       testResults = [
         ...testResults,

package/out/main/runner.js

@@ -4,7 +4,7 @@ const promises = require("fs/promises");
 const path = require("path");
 const undici = require("undici");
 const authBuilder = require("./chunks/auth-builder-B7-LgcGr.js");
-const requestCollection = require("./chunks/request-collection-DIsjTggj.js");
+const requestCollection = require("./chunks/request-collection-CElFJzre.js");
 require("crypto");
 require("dayjs");
 require("vm");
@@ -403,7 +403,7 @@ async function loadEnvironments(workspace, dir) {
   }
   return envs;
 }
-async function executeRequest(req, collectionVars, envVars, globals, localVars, verbose, tls) {
+async function executeRequest(req, collectionVars, envVars, globals, localVars, verbose, tls, piiMaskPatterns = []) {
   if (!req.headers) req.headers = [];
   if (!req.params) req.params = [];
   if (!req.body) req.body = { mode: "none" };
@@ -426,7 +426,8 @@ async function executeRequest(req, collectionVars, envVars, globals, localVars,
       envVars: { ...envVars },
       collectionVars: { ...collectionVars },
       globals: { ...globals },
-      localVars: { ...localVars }
+      localVars: { ...localVars },
+      piiMaskPatterns
     });
     preScriptError = r.error;
     localVars = r.updatedLocalVars;
@@ -474,6 +475,12 @@ async function executeRequest(req, collectionVars, envVars, globals, localVars,
       if (gql.operationName?.trim()) gqlBody.operationName = gql.operationName.trim();
       body = JSON.stringify(gqlBody);
       if (!headers.has("content-type")) headers.set("Content-Type", "application/json");
+    } else if (req.body.mode === "soap" && req.body.soap) {
+      body = authBuilder.interpolate(req.body.soap.envelope, vars);
+      if (!headers.has("content-type")) headers.set("Content-Type", "text/xml; charset=utf-8");
+      if (req.body.soap.soapAction && !headers.has("soapaction")) {
+        headers.set("SOAPAction", req.body.soap.soapAction);
+      }
     }
     const dispatcher = await requestCollection.buildDispatcher(void 0, tls);
     const fetchResp = await undici.fetch(resolvedUrl, {
@@ -496,7 +503,8 @@ async function executeRequest(req, collectionVars, envVars, globals, localVars,
       bodySize: Buffer.byteLength(responseBody, "utf8"),
       durationMs
     };
-    let testResults = [];
+    const protocolFaultTests = requestCollection.buildProtocolFaultTests(req.body.mode, responseBody);
+    let testResults = [...protocolFaultTests];
     let consoleOutput = [];
     let postScriptError;
     if (req.postRequestScript?.trim()) {
@@ -505,9 +513,10 @@ async function executeRequest(req, collectionVars, envVars, globals, localVars,
         collectionVars: updatedCollectionVars,
         globals: updatedGlobals,
         localVars,
-        response
+        response,
+        piiMaskPatterns
       });
-      testResults = r.testResults;
+      testResults = [...protocolFaultTests, ...r.testResults];
       consoleOutput = r.consoleOutput;
       postScriptError = r.error;
       updatedEnvVars = r.updatedEnvVars;
@@ -521,7 +530,7 @@ async function executeRequest(req, collectionVars, envVars, globals, localVars,
     const allPassed = testResults.every((t) => t.passed);
     const httpFailed = fetchResp.status >= 400;
     const hasTests = testResults.length > 0;
-    const status = postScriptError ? "error" : hasTests ? allPassed ? "passed" : "failed" : httpFailed ? "failed" : "skipped";
+    const status = postScriptError ? "error" : hasTests ? allPassed ? "passed" : "failed" : httpFailed ? "failed" : "passed";
     if (httpFailed && testResults.length === 0) {
       testResults = [
         ...testResults,
@@ -575,7 +584,8 @@ function printResult(r, verbose) {
   const http = r.httpStatus ? color(` ${r.httpStatus}`, r.httpStatus < 400 ? C.green : C.red) : "";
   const dur = r.durationMs !== void 0 ? color(` ${r.durationMs}ms`, C.gray) : "";
   const method = color(r.method.padEnd(7), C.cyan);
-  console.log(`  ${icon}  ${method}  ${r.name}${http}${dur}`);
+  const hookTag = r.isHook && r.hookType ? color(` [${r.hookType.toUpperCase()}]`, C.yellow) : "";
+  console.log(`  ${icon}  ${method}  ${r.name}${hookTag}${http}${dur}`);
   if (verbose) console.log(color(`       ${r.resolvedUrl}`, C.gray));
   if (r.testResults?.length) {
     for (const t of r.testResults) {
@@ -622,8 +632,9 @@ async function main() {
   if (envName && !env) {
     console.warn(color(`Warning: environment "${envName}" not found. Running without environment.`, C.yellow));
   }
+  const version = `v${"0.2.5"}`;
   console.log("");
-  console.log(color("  API Test Runner", C.bold, C.white));
+  console.log(color("  API Test Runner" + (version ? ` ${version}` : ""), C.bold, C.white));
   console.log(color(`  Workspace:   ${wsPath}`, C.gray));
   console.log(color(`  Environment: ${env?.name ?? "(none)"}`, C.gray));
   if (filterTags.length) console.log(color(`  Tags:        ${filterTags.join(", ")}`, C.gray));
@@ -635,16 +646,21 @@ async function main() {
     for (const secret of secretValuesToMask) out = out.split(secret).join("***");
     return out;
   }
+  const DEFAULT_PII_PATTERNS = ["authorization", "password", "token", "secret", "api-key", "x-api-key"];
+  const piiPatterns = workspace.settings?.piiMaskPatterns ?? DEFAULT_PII_PATTERNS;
   function maskResult(r) {
     return {
       ...r,
       sentRequest: r.sentRequest ? {
-        headers: Object.fromEntries(Object.entries(r.sentRequest.headers).map(([k, v]) => [k, redact(v)])),
-        body: r.sentRequest.body != null ? redact(r.sentRequest.body) : void 0
+        headers: Object.fromEntries(
+          Object.entries(requestCollection.maskHeaders(r.sentRequest.headers, piiPatterns)).map(([k, v]) => [k, redact(v)])
+        ),
+        body: r.sentRequest.body != null ? redact(requestCollection.maskPii(r.sentRequest.body, piiPatterns)) : void 0
       } : void 0,
       receivedResponse: r.receivedResponse ? {
         ...r.receivedResponse,
-        body: redact(r.receivedResponse.body)
+        headers: requestCollection.maskHeaders(r.receivedResponse.headers, piiPatterns),
+        body: redact(requestCollection.maskPii(r.receivedResponse.body, piiPatterns))
       } : void 0
     };
   }
@@ -655,7 +671,7 @@ async function main() {
   let firstColName;
   for (const col of collections) {
     if (colName && col.name.toLowerCase() !== colName.toLowerCase()) continue;
-    const items = requestCollection.collectTagged(col.rootFolder, col.requests, col.collectionVariables ?? {}, filterTags);
+    const items = requestCollection.buildRunPlan(col, null, filterTags);
     if (items.length === 0) continue;
     if (!firstColName) firstColName = col.name;
     let runEnvVars = await authBuilder.buildEnvVars(env);
@@ -678,21 +694,74 @@ async function main() {
     }
     let bailed = false;
     let lastPrintedScope = null;
+    const failedScopes = /* @__PURE__ */ new Set();
+    const skipRequests = /* @__PURE__ */ new Set();
     for (const item of items) {
-      const { result, updatedEnvVars, updatedCollectionVars, updatedGlobals, updatedLocalVars } = await executeRequest(
-        item.request,
-        { ...item.collectionVars, ...runCollectionVars },
-        runEnvVars,
-        runGlobals,
-        { ...runLocalVars },
-        verbose,
-        effectiveTls
-      );
-      runEnvVars = updatedEnvVars;
-      runCollectionVars = updatedCollectionVars;
-      runGlobals = updatedGlobals;
-      runLocalVars = updatedLocalVars;
-      result.scopePath = item.scopePath;
+      const { isHook, hookType, scopeId, scopeAncestors, mainRequestId } = item;
+      let skipReason;
+      if (isHook) {
+        if (hookType === "beforeAll") {
+          if ((scopeAncestors ?? []).some((id) => failedScopes.has(id))) {
+            skipReason = "Skipped — outer scope hook failed";
+          }
+        } else if (hookType === "before") {
+          const allScopes = [...scopeAncestors ?? [], scopeId].filter(Boolean);
+          if (allScopes.some((id) => failedScopes.has(id))) {
+            skipReason = "Skipped — scope hook failed";
+          } else if (mainRequestId && skipRequests.has(mainRequestId)) {
+            skipReason = "Skipped — before hook failed";
+          }
+        }
+      } else {
+        const allScopes = [...scopeAncestors ?? [], scopeId].filter(Boolean);
+        if (allScopes.some((id) => failedScopes.has(id))) {
+          skipReason = "Skipped — beforeAll hook failed";
+        } else if (skipRequests.has(item.request.id)) {
+          skipReason = "Skipped — before hook failed";
+        }
+      }
+      let result;
+      if (skipReason) {
+        result = {
+          requestId: item.request.id,
+          name: item.request.name,
+          method: item.request.method,
+          resolvedUrl: item.request.url,
+          status: "failed",
+          error: skipReason,
+          isHook,
+          hookType,
+          scopeId,
+          scopePath: item.scopePath
+        };
+      } else {
+        const out = await executeRequest(
+          item.request,
+          { ...item.collectionVars, ...runCollectionVars },
+          runEnvVars,
+          runGlobals,
+          { ...runLocalVars },
+          verbose,
+          effectiveTls,
+          piiPatterns
+        );
+        result = out.result;
+        runEnvVars = out.updatedEnvVars;
+        runCollectionVars = out.updatedCollectionVars;
+        runGlobals = out.updatedGlobals;
+        runLocalVars = out.updatedLocalVars;
+        result.isHook = isHook;
+        result.hookType = hookType;
+        result.scopeId = scopeId;
+        result.scopePath = item.scopePath;
+        if (result.status === "failed" || result.status === "error") {
+          if (isHook && hookType === "beforeAll" && scopeId) {
+            failedScopes.add(scopeId);
+          } else if (isHook && hookType === "before" && mainRequestId) {
+            skipRequests.add(mainRequestId);
+          }
+        }
+      }
       const scopeKey = (item.scopePath ?? []).join(" / ");
       if (scopeKey !== lastPrintedScope) {
         if (scopeKey) console.log(color(`    ${scopeKey}`, C.gray, C.bold));

package/out/renderer/assets/{index-BC1srylp.js → index-Cp3zkfSB.js}

@@ -14123,19 +14123,32 @@ const useStore = create()(
     }),
     // ── Apply script results back to store ────────────────────────────────────
     applyScriptUpdates: (result) => set2((s) => {
+      const isMaskSentinel = (v) => v === "[REDACTED]" || v === "[*****]";
+      const safeFilter = (m) => {
+        const out = {};
+        for (const [k, v] of Object.entries(m)) {
+          if (!isMaskSentinel(v)) out[k] = v;
+          else console.warn(`applyScriptUpdates: refusing to persist mask sentinel into "${k}"`);
+        }
+        return out;
+      };
+      const safeColVars = safeFilter(result.updatedCollectionVars);
+      const safeEnvVars = safeFilter(result.updatedEnvVars);
+      const safeGlobals = safeFilter(result.updatedGlobals);
+      const safeLocalVars = safeFilter(result.updatedLocalVars);
       const activeColId = s.activeCollectionId;
       if (activeColId && s.collections[activeColId]) {
         const col = s.collections[activeColId].data;
         col.collectionVariables = {
           ...col.collectionVariables ?? {},
-          ...result.updatedCollectionVars
+          ...safeColVars
         };
         s.collections[activeColId].dirty = true;
       }
       const activeEnvId = s.activeEnvironmentId;
       if (activeEnvId && s.environments[activeEnvId]) {
         const env = s.environments[activeEnvId].data;
-        for (const [key, value] of Object.entries(result.updatedEnvVars)) {
+        for (const [key, value] of Object.entries(safeEnvVars)) {
           const existing = env.variables.find((v) => v.key === key);
           if (existing && !existing.secret) {
             existing.value = value;
@@ -14144,8 +14157,8 @@ const useStore = create()(
           }
         }
       }
-      s.globals = { ...s.globals, ...result.updatedGlobals };
-      s.sessionVars = { ...s.sessionVars, ...result.updatedLocalVars };
+      s.globals = { ...s.globals, ...safeGlobals };
+      s.sessionVars = { ...s.sessionVars, ...safeLocalVars };
     }),
     // ── Theme & zoom ──────────────────────────────────────────────────────────
     // Persisted in workspace.settings when a workspace is open; otherwise
@@ -70968,7 +70981,7 @@ function App() {
       /* @__PURE__ */ jsxRuntimeExports.jsx("span", { style: { color: "#6aa3c8" }, children: "Spector" }),
       /* @__PURE__ */ jsxRuntimeExports.jsxs("span", { className: "ml-2 text-[10px] font-normal opacity-50", children: [
         "v",
-        "0.2.4"
+        "0.2.5"
       ] }),
       /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "mx-2 opacity-30", children: "·" }),
       /* @__PURE__ */ jsxRuntimeExports.jsx(

package/out/renderer/index.html

@@ -5,7 +5,7 @@
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
   <title>API Spector</title>
-  <script type="module" crossorigin src="./assets/index-BC1srylp.js"></script>
+  <script type="module" crossorigin src="./assets/index-Cp3zkfSB.js"></script>
   <link rel="stylesheet" crossorigin href="./assets/index-DfkLUeA1.css">
 </head>
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@testsmith/api-spector",
   "productName": "API Spector",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "Local-first API testing tool to inspect, test and mock APIs",
   "repository": {
     "type": "git",