@testsmith/api-spector 0.2.4 → 0.2.6

package/bin/cli.js

@@ -63,7 +63,48 @@ if (!command) {
 
 // ui: spawn electron with the app dir
 if (command.runner === 'electron') {
-  const electron = require('electron')
+  // `require('electron')` throws if electron's postinstall didn't download
+  // the platform binary (common behind corporate proxies on Windows: the
+  // npm install completes but the GitHub Releases download is blocked).
+  // The raw stack trace is intimidating; turn it into actionable steps.
+  let electron
+  try {
+    electron = require('electron')
+  } catch (err) {
+    const msg = err && err.message ? err.message : String(err)
+    const looksLikeBinaryMissing = /Electron failed to install correctly|Cannot find module 'electron'/i.test(msg)
+    console.error('')
+    console.error('  API Spector — failed to launch the UI.')
+    console.error('')
+    if (looksLikeBinaryMissing) {
+      const installDir = path.dirname(__dirname)
+      console.error('  Electron is installed, but its platform binary is missing — the')
+      console.error('  download during `npm install` did not complete (often a proxy or')
+      console.error('  firewall blocking github.com / electronjs.org).')
+      console.error('')
+      console.error('  Fix options (try in order):')
+      console.error('')
+      console.error('    1. Reinstall and force the postinstall script to run:')
+      console.error('         npm install -g @testsmith/api-spector --force')
+      console.error('')
+      console.error('    2. Behind a proxy? Set npm + electron mirrors and reinstall:')
+      console.error('         npm config set proxy http://your-proxy:port')
+      console.error('         npm config set https-proxy http://your-proxy:port')
+      console.error('         set ELECTRON_MIRROR=https://npmmirror.com/mirrors/electron/')
+      console.error('         npm install -g @testsmith/api-spector --force')
+      console.error('')
+      console.error('    3. Re-run electron\'s postinstall manually:')
+      console.error(`         cd "${path.join(installDir, 'node_modules', 'electron')}"`)
+      console.error('         node install.js')
+      console.error('')
+      console.error('  CLI subcommands (run / mock / record / contract / wsdl) do not')
+      console.error('  need the UI binary and should work even while this is broken.')
+    } else {
+      console.error(`  ${msg}`)
+    }
+    console.error('')
+    process.exit(1)
+  }
   const appDir = path.join(__dirname, '..')
   // Forward the user's cwd so the main process can decide whether to open a
   // workspace in this folder, or fall through to the welcome screen. Without

package/out/main/chunks/{request-collection-DIsjTggj.js → request-collection-CElFJzre.js}

@@ -254,13 +254,15 @@ class AssertionError extends Error {
   }
 }
 function buildAt(ctx, testResults, consoleOutput) {
-  const { envVars, collectionVars, globals: globals2, localVars } = ctx;
+  const { envVars, collectionVars, globals: globals2, localVars, piiMaskPatterns = [] } = ctx;
+  const isSensitiveKey = (key) => piiMaskPatterns.some((p) => key.toLowerCase().includes(p.toLowerCase()));
   function makeVarScope(store, scopeName) {
     return {
       get: (key) => store[key] ?? null,
       set: (key, value) => {
         store[key] = String(value);
-        consoleOutput.push(`[set] ${scopeName}.${key} = ${JSON.stringify(String(value))}`);
+        const display = isSensitiveKey(key) ? '"[REDACTED]"' : JSON.stringify(String(value));
+        consoleOutput.push(`[set] ${scopeName}.${key} = ${display}`);
       },
       clear: (key) => {
         delete store[key];
@@ -383,7 +385,8 @@ async function runScript(code, ctx, timeoutMs = 5e3) {
     collectionVars: collectionCopy,
     globals: globalsCopy,
     localVars: localVarsCopy,
-    response: ctx.response
+    response: ctx.response,
+    piiMaskPatterns: ctx.piiMaskPatterns
   };
   const sp = buildAt(scriptCtx, testResults, consoleOutput);
   const captureConsole = {
@@ -602,6 +605,40 @@ function buildSchemaTestResults(schemaText, body) {
     error: err.message ?? "Schema violation"
   }));
 }
+function buildProtocolFaultTests(bodyMode, body) {
+  if (!body) return [];
+  if (bodyMode === "soap") {
+    const isFault = /<(?:[\w-]+:)?Fault(?:\s|>)/i.test(body);
+    if (isFault) {
+      const reason = /<(?:[\w-]+:)?(?:faultstring|Text)[^>]*>([\s\S]*?)<\/(?:[\w-]+:)?(?:faultstring|Text)>/i.exec(body);
+      return [{
+        name: "[soap] response is not a Fault",
+        passed: false,
+        error: reason?.[1]?.trim() ?? "SOAP Fault returned"
+      }];
+    }
+    return [{ name: "[soap] response is not a Fault", passed: true }];
+  }
+  if (bodyMode === "graphql") {
+    let parsed;
+    try {
+      parsed = JSON.parse(body);
+    } catch {
+      return [];
+    }
+    const errors = parsed?.errors;
+    if (Array.isArray(errors) && errors.length > 0) {
+      const first = errors[0];
+      return [{
+        name: "[graphql] response has no errors",
+        passed: false,
+        error: first?.message ?? "GraphQL response contained an `errors` array"
+      }];
+    }
+    return [{ name: "[graphql] response has no errors", passed: true }];
+  }
+  return [];
+}
 async function buildDispatcher(proxy, tls) {
   const connectOpts = {};
   let hasTls = false;
@@ -697,6 +734,7 @@ function registerRequestHandler(ipc) {
       vars = authBuilder.mergeVars(updatedEnvVars, updatedCollectionVars, updatedGlobals, localVars, dynamicVars);
     }
     let response;
+    let scriptResponse;
     let sentRequest = { method: req.method, url: "", headers: {} };
     const resolvedUrl = authBuilder.buildUrl(req.url, req.params, vars);
     const secretValues = /* @__PURE__ */ new Set();
@@ -840,6 +878,14 @@ function registerRequestHandler(ipc) {
         bodySize: Buffer.byteLength(responseBody, "utf8"),
         durationMs
       };
+      scriptResponse = {
+        status: fetchResp.status,
+        statusText: fetchResp.statusText,
+        headers: rawResponseHeaders,
+        body: responseBody,
+        bodySize: Buffer.byteLength(responseBody, "utf8"),
+        durationMs
+      };
     } catch (err) {
       const diagnostic = formatRequestError(err, {
         requestId: req.id,
@@ -858,8 +904,9 @@ function registerRequestHandler(ipc) {
         durationMs: Date.now() - start,
         error: diagnostic
       };
+      scriptResponse = response;
     }
-    const schemaTestResults = !response.error ? buildSchemaTestResults(req.schema, response.body) : [];
+    const schemaTestResults = !response.error ? buildSchemaTestResults(req.schema, scriptResponse.body) : [];
     let postTestResults = [];
     let postConsole = [];
     let postError;
@@ -869,7 +916,9 @@ function registerRequestHandler(ipc) {
         collectionVars: { ...updatedCollectionVars },
         globals: { ...updatedGlobals },
         localVars: { ...localVars },
-        response
+        // Pass the *unmasked* response so the script can extract real values
+        // (tokens, ids, …). The displayed `response` keeps the redacted copy.
+        response: scriptResponse
       });
       postTestResults = result.testResults;
       postConsole = result.consoleOutput;
@@ -916,22 +965,57 @@ function registerRequestHandler(ipc) {
     };
   });
 }
-function collectTagged(folder, requests, collectionVars, filterTags, parentPath = [], isRoot = true) {
-  const results = [];
-  const scopePath = isRoot ? parentPath : [...parentPath, folder.name];
-  for (const reqId of folder.requestIds) {
-    const req = requests[reqId];
-    if (!req || req.hookType || req.disabled) continue;
+function makeHook(req, collectionVars, hookType, scopeId, scopeAncestors, scopePath, mainRequestId) {
+  return { request: req, collectionVars, isHook: true, hookType, scopeId, scopeAncestors, scopePath, mainRequestId };
+}
+function buildFolderPlan(folder, requests, collectionVars, filterTags, scopeId, ancestorIds, parentPath, wrappers, isRoot) {
+  const result = [];
+  const scopePath = isRoot ? [] : [...parentPath, folder.name];
+  const folderReqs = folder.requestIds.map((id) => requests[id]).filter((r) => r && !r.disabled);
+  const beforeAllHooks = folderReqs.filter((r) => r.hookType === "beforeAll");
+  const beforeHooks = folderReqs.filter((r) => r.hookType === "before");
+  const afterHooks = folderReqs.filter((r) => r.hookType === "after");
+  const afterAllHooks = folderReqs.filter((r) => r.hookType === "afterAll");
+  const regularReqs = folderReqs.filter((r) => !r.hookType);
+  const myWrapper = { scopeId, ancestors: ancestorIds, scopePath, before: beforeHooks, after: afterHooks };
+  const allWrappers = [...wrappers, myWrapper];
+  for (const req of beforeAllHooks) {
+    result.push(makeHook(req, collectionVars, "beforeAll", scopeId, ancestorIds, scopePath));
+  }
+  for (const req of regularReqs) {
     const tags = req.meta?.tags ?? [];
     if (filterTags.length > 0 && !filterTags.some((t) => tags.includes(t))) continue;
-    results.push({ request: req, collectionVars, scopePath });
+    for (const w of allWrappers) {
+      for (const hookReq of w.before) {
+        result.push(makeHook(hookReq, collectionVars, "before", w.scopeId, w.ancestors, w.scopePath, req.id));
+      }
+    }
+    result.push({ request: req, collectionVars, scopeId, scopeAncestors: ancestorIds, scopePath });
+    for (const w of [...allWrappers].reverse()) {
+      for (const hookReq of w.after) {
+        result.push(makeHook(hookReq, collectionVars, "after", w.scopeId, w.ancestors, w.scopePath, req.id));
+      }
+    }
   }
   for (const sub of folder.folders) {
     const folderTags = sub.tags ?? [];
-    const effectiveTags = filterTags.length === 0 ? filterTags : folderTags.some((t) => filterTags.includes(t)) ? [] : filterTags;
-    results.push(...collectTagged(sub, requests, collectionVars, effectiveTags, scopePath, false));
+    const effectiveFilter = filterTags.length === 0 ? filterTags : folderTags.some((t) => filterTags.includes(t)) ? [] : filterTags;
+    result.push(...buildFolderPlan(
+      sub,
+      requests,
+      collectionVars,
+      effectiveFilter,
+      sub.id,
+      [...ancestorIds, scopeId],
+      scopePath,
+      allWrappers,
+      false
+    ));
   }
-  return results;
+  for (const req of afterAllHooks) {
+    result.push(makeHook(req, collectionVars, "afterAll", scopeId, ancestorIds, scopePath));
+  }
+  return result;
 }
 function folderPathTo(root, requestId) {
   if (root.requestIds.includes(requestId)) return [root];
@@ -979,9 +1063,26 @@ function resolveInheritedAuthAndHeaders(requestId, collection) {
   }
   return { auth: inheritedAuth, headers: inheritedHeaders };
 }
+function buildRunPlan(collection, folderId, filterTags) {
+  const collectionVars = collection.collectionVariables ?? {};
+  {
+    return buildFolderPlan(
+      collection.rootFolder,
+      collection.requests,
+      collectionVars,
+      filterTags,
+      collection.rootFolder.id,
+      [],
+      [],
+      [],
+      true
+    );
+  }
+}
 exports.buildDispatcher = buildDispatcher;
+exports.buildProtocolFaultTests = buildProtocolFaultTests;
+exports.buildRunPlan = buildRunPlan;
 exports.buildSchemaTestResults = buildSchemaTestResults;
-exports.collectTagged = collectTagged;
 exports.getAllApplicableHooks = getAllApplicableHooks;
 exports.getGlobals = getGlobals;
 exports.loadGlobals = loadGlobals;

package/out/main/index.js

@@ -25,7 +25,7 @@ const electron = require("electron");
 const path = require("path");
 const fs = require("fs");
 const promises = require("fs/promises");
-const requestCollection = require("./chunks/request-collection-DIsjTggj.js");
+const requestCollection = require("./chunks/request-collection-CElFJzre.js");
 const authBuilder = require("./chunks/auth-builder-B7-LgcGr.js");
 const uuid = require("uuid");
 const jsYaml = require("js-yaml");
@@ -1494,7 +1494,7 @@ function buildTestSuite(collection, environment, nameMap) {
   processFolder(collection.rootFolder);
   return lines.join("\n");
 }
-function renderTree$5(paths) {
+function renderTree$6(paths) {
   const root = {};
   for (const p of [...paths].sort()) {
     let cur = root;
@@ -1513,8 +1513,8 @@ function renderTree$5(paths) {
   }
   return [".", ...render(root)].join("\n");
 }
-function buildReadme$5(collectionName, filePaths) {
-  const tree = renderTree$5(filePaths);
+function buildReadme$6(collectionName, filePaths) {
+  const tree = renderTree$6(filePaths);
   return `# ${collectionName} — API Tests (Robot Framework)
 
 ## Project structure
@@ -1553,7 +1553,7 @@ function generateRobotFramework(collection, environment) {
   ];
   const allPaths = ["requirements.txt", ...contentFiles.map((f) => f.path)];
   return [
-    { path: "README.md", content: buildReadme$5(collection.name, allPaths) },
+    { path: "README.md", content: buildReadme$6(collection.name, allPaths) },
     { path: "requirements.txt", content: "robotframework\nrobotframework-requests\n" },
     ...contentFiles
   ];
@@ -1859,7 +1859,7 @@ function buildPackageJson$3(collectionName) {
     }
   }, null, 2) + "\n";
 }
-function renderTree$4(paths) {
+function renderTree$5(paths) {
   const root = {};
   for (const p of [...paths].sort()) {
     let cur = root;
@@ -1878,8 +1878,8 @@ function renderTree$4(paths) {
   }
   return [".", ...render(root)].join("\n");
 }
-function buildReadme$4(collectionName, filePaths) {
-  const tree = renderTree$4([...filePaths, ".env.local"]);
+function buildReadme$5(collectionName, filePaths) {
+  const tree = renderTree$5([...filePaths, ".env.local"]);
   return `# ${collectionName} — API Tests (Playwright TypeScript)
 
 ## Project structure
@@ -1914,7 +1914,7 @@ function generatePlaywright(collection, environment) {
   files.unshift(
     { path: "package.json", content: buildPackageJson$3(collection.name) },
     { path: "playwright.config.ts", content: buildPlaywrightConfig$1(environment) },
-    { path: "README.md", content: buildReadme$4(collection.name, scaffoldPaths) }
+    { path: "README.md", content: buildReadme$5(collection.name, scaffoldPaths) }
   );
   return files;
 }
@@ -2203,7 +2203,7 @@ function buildPackageJson$2(collectionName) {
     }
   }, null, 2) + "\n";
 }
-function renderTree$3(paths) {
+function renderTree$4(paths) {
   const root = {};
   for (const p of [...paths].sort()) {
     let cur = root;
@@ -2222,8 +2222,8 @@ function renderTree$3(paths) {
   }
   return [".", ...render(root)].join("\n");
 }
-function buildReadme$3(collectionName, filePaths) {
-  const tree = renderTree$3([...filePaths, ".env.local"]);
+function buildReadme$4(collectionName, filePaths) {
+  const tree = renderTree$4([...filePaths, ".env.local"]);
   return `# ${collectionName} — API Tests (Playwright JavaScript)
 
 ## Project structure
@@ -2258,7 +2258,7 @@ function generatePlaywrightJs(collection, environment) {
   files.unshift(
     { path: "package.json", content: buildPackageJson$2(collection.name) },
     { path: "playwright.config.js", content: buildPlaywrightConfig(environment) },
-    { path: "README.md", content: buildReadme$3(collection.name, scaffoldPaths) }
+    { path: "README.md", content: buildReadme$4(collection.name, scaffoldPaths) }
   );
   return files;
 }
@@ -2486,7 +2486,7 @@ function buildTsConfig() {
     exclude: ["node_modules", "dist"]
   }, null, 2) + "\n";
 }
-function renderTree$2(paths) {
+function renderTree$3(paths) {
   const root = {};
   for (const p of [...paths].sort()) {
     let cur = root;
@@ -2505,8 +2505,8 @@ function renderTree$2(paths) {
   }
   return [".", ...render(root)].join("\n");
 }
-function buildReadme$2(collectionName, filePaths) {
-  const tree = renderTree$2([...filePaths, ".env.local"]);
+function buildReadme$3(collectionName, filePaths) {
+  const tree = renderTree$3([...filePaths, ".env.local"]);
   return `# ${collectionName} — API Tests (Supertest + Jest TypeScript)
 
 ## Project structure
@@ -2551,7 +2551,7 @@ function generateSupertestTs(collection, environment) {
   files.unshift(
     { path: "package.json", content: buildPackageJson$1(collection.name) },
     { path: "tsconfig.json", content: buildTsConfig() },
-    { path: "README.md", content: buildReadme$2(collection.name, scaffoldPaths) }
+    { path: "README.md", content: buildReadme$3(collection.name, scaffoldPaths) }
   );
   return files;
 }
@@ -2755,7 +2755,7 @@ function buildPackageJson(collectionName) {
     }
   }, null, 2) + "\n";
 }
-function renderTree$1(paths) {
+function renderTree$2(paths) {
   const root = {};
   for (const p of [...paths].sort()) {
     let cur = root;
@@ -2774,8 +2774,8 @@ function renderTree$1(paths) {
   }
   return [".", ...render(root)].join("\n");
 }
-function buildReadme$1(collectionName, filePaths) {
-  const tree = renderTree$1([...filePaths, ".env.local"]);
+function buildReadme$2(collectionName, filePaths) {
+  const tree = renderTree$2([...filePaths, ".env.local"]);
   return `# ${collectionName} — API Tests (Supertest + Jest JavaScript)
 
 ## Project structure
@@ -2819,11 +2819,11 @@ function generateSupertestJs(collection, environment) {
   const scaffoldPaths = ["package.json", ...files.map((f) => f.path)];
   files.unshift(
     { path: "package.json", content: buildPackageJson(collection.name) },
-    { path: "README.md", content: buildReadme$1(collection.name, scaffoldPaths) }
+    { path: "README.md", content: buildReadme$2(collection.name, scaffoldPaths) }
   );
   return files;
 }
-function javaClass(name) {
+function javaClass$1(name) {
   return name.replace(/[^\w\s]/g, " ").split(/\s+/).filter(Boolean).map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join("");
 }
 function javaMethod(name) {
@@ -2854,7 +2854,7 @@ function interpolateJava(value, sharedVars = /* @__PURE__ */ new Set()) {
     return `" + System.getenv("${envKey}") + "`;
   }) + '"';
 }
-function buildPom(collectionName) {
+function buildPom$1(collectionName) {
   const artifact = collectionName.replace(/\W+/g, "-").toLowerCase();
   return `<?xml version="1.0" encoding="UTF-8"?>
 <project xmlns="http://maven.apache.org/POM/4.0.0"
@@ -2966,7 +2966,7 @@ public class BaseTest {
 }
 function buildTestClass(folderName, folder, collection) {
   const requests = collection.requests;
-  const className = javaClass(folderName) + "Test";
+  const className = javaClass$1(folderName) + "Test";
   const methods = [];
   const hooks = requestCollection.getAllApplicableHooks(folder.id, collection);
   const beforeAllH = hooks.beforeAll;
@@ -3122,7 +3122,7 @@ ${methods.join("\n\n")}
 }
 `;
 }
-function renderTree(paths) {
+function renderTree$1(paths) {
   const root = {};
   for (const p of [...paths].sort()) {
     let cur = root;
@@ -3141,8 +3141,8 @@ function renderTree(paths) {
   }
   return [".", ...render(root)].join("\n");
 }
-function buildReadme(collectionName, filePaths) {
-  const tree = renderTree(filePaths);
+function buildReadme$1(collectionName, filePaths) {
+  const tree = renderTree$1(filePaths);
   return `# ${collectionName} — API Tests (REST Assured + JUnit 5)
 
 ## Project structure
@@ -3166,12 +3166,12 @@ BASE_URL=https://api.example.com mvn test
 }
 function generateRestAssured(collection, environment) {
   const files = [
-    { path: "pom.xml", content: buildPom(collection.name) },
+    { path: "pom.xml", content: buildPom$1(collection.name) },
     { path: "src/test/java/com/example/api/BaseTest.java", content: buildBaseTest(environment) }
   ];
   function processFolder(folder, name) {
     if (folder.requestIds.length > 0) {
-      const className = javaClass(name) + "Test";
+      const className = javaClass$1(name) + "Test";
       files.push({
         path: `src/test/java/com/example/api/${className}.java`,
         content: buildTestClass(name, folder, collection)
@@ -3187,6 +3187,442 @@ function generateRestAssured(collection, environment) {
   for (const sub of collection.rootFolder.folders) {
     processFolder(sub, sub.name);
   }
+  files.unshift({ path: "README.md", content: buildReadme$1(collection.name, files.map((f) => f.path)) });
+  return files;
+}
+function javaClass(name) {
+  return name.replace(/[^\w\s]/g, " ").split(/\s+/).filter(Boolean).map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join("");
+}
+function jsVar(name) {
+  const parts = name.replace(/[^a-zA-Z0-9]+/g, " ").split(/\s+/).filter(Boolean).map((p) => p.toLowerCase());
+  if (parts.length === 0) return "_";
+  return parts[0] + parts.slice(1).map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join("");
+}
+function featureFileName(name) {
+  const slug2 = name.replace(/[^\w\s-]/g, "").trim().replace(/\s+/g, "-").toLowerCase();
+  return slug2 || "tests";
+}
+function configKey(envKey) {
+  return jsVar(envKey);
+}
+function escSingle(s) {
+  return s.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+}
+function interpolateKarate(value) {
+  if (!value.includes("{{")) return `'${escSingle(value)}'`;
+  const parts = [];
+  let last = 0;
+  const re = /\{\{([^}]+)\}\}/g;
+  let m;
+  while (m = re.exec(value)) {
+    if (m.index > last) parts.push(`'${escSingle(value.slice(last, m.index))}'`);
+    parts.push(configKey(m[1].trim()));
+    last = m.index + m[0].length;
+  }
+  if (last < value.length) parts.push(`'${escSingle(value.slice(last))}'`);
+  return parts.length === 1 ? parts[0] : parts.join(" + ");
+}
+function urlSteps(url) {
+  const leadingVar = url.match(/^\{\{([^}]+)\}\}(.*)$/);
+  if (leadingVar) {
+    const baseVar = configKey(leadingVar[1].trim());
+    const rest2 = leadingVar[2].replace(/^\//, "");
+    const steps2 = [[`url ${baseVar}`]];
+    if (rest2) steps2.push([`path ${interpolateKarate(rest2)}`]);
+    return steps2;
+  }
+  if (/^https?:\/\//i.test(url)) {
+    return [[`url ${interpolateKarate(url)}`]];
+  }
+  const rest = url.replace(/^\//, "");
+  const steps = [[`url baseUrl`]];
+  if (rest) steps.push([`path ${interpolateKarate(rest)}`]);
+  return steps;
+}
+function buildPom(collectionName) {
+  const artifact = collectionName.replace(/\W+/g, "-").toLowerCase();
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
+             http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+
+  <groupId>com.example.api</groupId>
+  <artifactId>${artifact}-karate</artifactId>
+  <version>1.0.0-SNAPSHOT</version>
+  <packaging>jar</packaging>
+
+  <properties>
+    <java.version>17</java.version>
+    <maven.compiler.source>\${java.version}</maven.compiler.source>
+    <maven.compiler.target>\${java.version}</maven.compiler.target>
+    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+    <karate.version>1.5.0</karate.version>
+    <junit.version>5.10.2</junit.version>
+  </properties>
+
+  <dependencies>
+    <dependency>
+      <groupId>io.karatelabs</groupId>
+      <artifactId>karate-junit5</artifactId>
+      <version>\${karate.version}</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.junit.jupiter</groupId>
+      <artifactId>junit-jupiter</artifactId>
+      <version>\${junit.version}</version>
+      <scope>test</scope>
+    </dependency>
+  </dependencies>
+
+  <build>
+    <plugins>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-surefire-plugin</artifactId>
+        <version>3.2.5</version>
+      </plugin>
+    </plugins>
+  </build>
+</project>
+`;
+}
+function buildKarateConfig(environment) {
+  const baseUrl = environment?.variables.find(
+    (v) => ["base_url", "baseurl", "base-url"].includes(v.key.toLowerCase()) && !v.secret
+  )?.value ?? "http://localhost:8080";
+  const lines = [];
+  lines.push(`function fn() {`);
+  lines.push(`  var env = karate.env || 'dev';`);
+  lines.push(`  karate.log('karate env:', env);`);
+  lines.push(``);
+  lines.push(`  var config = {`);
+  lines.push(`    baseUrl: '${escSingle(baseUrl)}'`);
+  const otherVars = (environment?.variables ?? []).filter((v) => {
+    const k = v.key.toLowerCase();
+    return v.enabled && !["base_url", "baseurl", "base-url"].includes(k);
+  });
+  for (const v of otherVars) {
+    const key = configKey(v.key);
+    const def = v.secret ? "''" : `'${escSingle(v.value ?? "")}'`;
+    lines.push(`,`);
+    lines.push(`    ${key}: ${def}`);
+  }
+  lines.push(`  };`);
+  lines.push(``);
+  lines.push(`  // Allow each variable to be overridden via a process env var of the same`);
+  lines.push(`  // SHOUTY_SNAKE_CASE name (e.g. AUTH_TOKEN populates config.authToken).`);
+  lines.push(`  function envOverride(name, key) {`);
+  lines.push(`    var v = java.lang.System.getenv(name);`);
+  lines.push(`    if (v) config[key] = v;`);
+  lines.push(`  }`);
+  lines.push(`  envOverride('BASE_URL', 'baseUrl');`);
+  for (const v of otherVars) {
+    lines.push(`  envOverride('${v.key}', '${configKey(v.key)}');`);
+  }
+  lines.push(``);
+  lines.push(`  return config;`);
+  lines.push(`}`);
+  return lines.join("\n") + "\n";
+}
+function buildRunner(collectionName) {
+  const className = javaClass(collectionName) + "Runner";
+  return `package karate;
+
+import com.intuit.karate.junit5.Karate;
+
+/**
+ * JUnit 5 entry point — runs every .feature in the \`karate\` package
+ * (this folder). Override the active env at run time with:
+ *
+ *   mvn test -Dkarate.env=staging
+ */
+public class ${className} {
+
+    @Karate.Test
+    Karate all() {
+        return Karate.run().relativeTo(getClass());
+    }
+}
+`;
+}
+function buildBackground(folderId, collection) {
+  const hooks = requestCollection.getAllApplicableHooks(folderId, collection);
+  const lines = [];
+  const defined = /* @__PURE__ */ new Set();
+  for (const h of [...hooks.beforeAll, ...hooks.before]) {
+    const method = h.method.toLowerCase();
+    const declared = new Set((h.headers ?? []).filter((x) => x.enabled && x.key).map((x) => x.key.toLowerCase()));
+    const has = (n) => declared.has(n.toLowerCase());
+    lines.push(`  # ${h.name}`);
+    for (const block of urlSteps(h.url)) {
+      lines.push(`  * ${block[0]}`);
+      for (let i = 1; i < block.length; i++) lines.push(block[i]);
+    }
+    for (const x of (h.headers ?? []).filter((x2) => x2.enabled && x2.key)) {
+      lines.push(`  * header ${x.key} = ${interpolateKarate(x.value)}`);
+    }
+    if (h.body.mode !== "none" && !["get", "head"].includes(method)) {
+      for (const block of bodySteps(h.body, has)) {
+        lines.push(`  * ${block[0]}`);
+        for (let i = 1; i < block.length; i++) lines.push(block[i]);
+      }
+    }
+    lines.push(`  * method ${method}`);
+    const parsed = parsePostScript(h.postRequestScript);
+    for (const e of parsed.extractions) {
+      const jp = accessorToJsonPath(e.accessor).replace(/^json\.?/, "");
+      const expr = jp ? `response.${jp}` : "response";
+      const name = configKey(e.varName);
+      defined.add(name);
+      lines.push(`  * def ${name} = ${expr}`);
+    }
+  }
+  return { lines, defined };
+}
+function bodyDocstring(json) {
+  const expanded = json.replace(/\{\{([^}]+)\}\}/g, (_, k) => `#(${configKey(k.trim())})`);
+  let pretty = expanded.trim();
+  try {
+    pretty = JSON.stringify(JSON.parse(expanded), null, 2);
+  } catch {
+  }
+  const out = ['    """'];
+  for (const l of pretty.split("\n")) out.push(`    ${l}`);
+  out.push('    """');
+  return out;
+}
+function rawDocstring(text) {
+  const expanded = text.replace(/\{\{([^}]+)\}\}/g, (_, k) => `#(${configKey(k.trim())})`);
+  const out = ['    """'];
+  for (const l of expanded.replace(/\r\n/g, "\n").split("\n")) out.push(`    ${l}`);
+  out.push('    """');
+  return out;
+}
+function bodySteps(body, alreadyHasHeader) {
+  if (body.mode === "json" && body.json) {
+    return [[`request`, ...bodyDocstring(body.json)]];
+  }
+  if (body.mode === "soap" && body.soap?.envelope) {
+    const out = [];
+    if (body.soap.soapAction && !alreadyHasHeader("soapaction")) {
+      out.push([`header SOAPAction = '"${escSingle(body.soap.soapAction)}"'`]);
+    }
+    if (!alreadyHasHeader("content-type")) {
+      out.push([`header Content-Type = 'text/xml; charset=utf-8'`]);
+    }
+    out.push([`request`, ...rawDocstring(body.soap.envelope)]);
+    return out;
+  }
+  if (body.mode === "raw" && body.raw) {
+    const out = [];
+    if (body.rawContentType && !alreadyHasHeader("content-type")) {
+      out.push([`header Content-Type = '${escSingle(body.rawContentType)}'`]);
+    }
+    out.push([`request`, ...rawDocstring(body.raw)]);
+    return out;
+  }
+  if (body.mode === "graphql" && body.graphql) {
+    const env = { query: body.graphql.query };
+    if (body.graphql.variables?.trim()) {
+      try {
+        env.variables = JSON.parse(body.graphql.variables);
+      } catch {
+      }
+    }
+    if (body.graphql.operationName?.trim()) env.operationName = body.graphql.operationName.trim();
+    return [[`request`, ...bodyDocstring(JSON.stringify(env))]];
+  }
+  return [];
+}
+function buildFeature(folderName, folder, collection) {
+  const requests = collection.requests;
+  const bg = buildBackground(folder.id, collection);
+  const scenarios = [];
+  const usedTags = /* @__PURE__ */ new Set();
+  for (const reqId of folder.requestIds) {
+    const req = requests[reqId];
+    if (!req || req.disabled || req.hookType) continue;
+    let tag = featureFileName(req.name);
+    if (usedTags.has(tag)) {
+      let i = 2;
+      while (usedTags.has(`${tag}-${i}`)) i++;
+      tag = `${tag}-${i}`;
+    }
+    usedTags.add(tag);
+    const inherited = requestCollection.resolveInheritedAuthAndHeaders(reqId, collection);
+    const effectiveAuth = req.auth.type !== "none" ? req.auth : inherited.auth ?? req.auth;
+    const allHeaders = [...inherited.headers.filter((h) => h.enabled && h.key), ...req.headers.filter((h) => h.enabled && h.key)];
+    const enabledParams = req.params.filter((p) => p.enabled && p.key);
+    const method = req.method.toLowerCase();
+    const hasBody = req.body.mode !== "none" && !["get", "head"].includes(method);
+    const lines = [];
+    lines.push(`@${tag}`);
+    lines.push(`Scenario: ${req.name}`);
+    const setup = [...urlSteps(req.url)];
+    if (effectiveAuth.type === "bearer") {
+      const token = effectiveAuth.token ?? "";
+      if (token.includes("{{")) {
+        const single = token.match(/^\{\{([^}]+)\}\}$/);
+        if (single) {
+          setup.push([`header Authorization = 'Bearer ' + ${configKey(single[1].trim())}`]);
+        } else {
+          setup.push([`header Authorization = 'Bearer ' + ${interpolateKarate(token)}`]);
+        }
+      } else if (effectiveAuth.tokenSecretRef) {
+        setup.push([`header Authorization = 'Bearer ' + ${configKey(effectiveAuth.tokenSecretRef)}`]);
+      } else if (token) {
+        setup.push([`header Authorization = 'Bearer ${escSingle(token)}'`]);
+      }
+    } else if (effectiveAuth.type === "basic") {
+      const user = effectiveAuth.username ?? "";
+      const pass = effectiveAuth.password ?? "";
+      setup.push([`configure headers = ({ Authorization: 'Basic ' + java.util.Base64.getEncoder().encodeToString((${interpolateKarate(user)} + ':' + ${interpolateKarate(pass)}).getBytes()) })`]);
+    }
+    for (const h of allHeaders) {
+      setup.push([`header ${h.key} = ${interpolateKarate(h.value)}`]);
+    }
+    for (const p of enabledParams) {
+      setup.push([`param ${p.key} = ${interpolateKarate(p.value)}`]);
+    }
+    if (hasBody) {
+      const declared = new Set(allHeaders.map((h) => h.key.toLowerCase()));
+      const has = (n) => declared.has(n.toLowerCase());
+      for (const block of bodySteps(req.body, has)) setup.push(block);
+    }
+    setup.forEach((step, i) => {
+      const kw = i === 0 ? "Given" : "And";
+      lines.push(`  ${kw} ${step[0]}`);
+      for (let j = 1; j < step.length; j++) lines.push(step[j]);
+    });
+    lines.push(`  When method ${method}`);
+    const asserts = [];
+    const parsed = parsePostScript(req.postRequestScript);
+    let statusEmitted = false;
+    if (parsed.assertions.length > 0) {
+      for (const a of parsed.assertions) {
+        const jp = accessorToJsonPath(a.accessor).replace(/^json\.?/, "");
+        const target = jp ? `response.${jp}` : "response";
+        switch (a.kind) {
+          case "status":
+            asserts.push(`status ${a.expected ?? 200}`);
+            statusEmitted = true;
+            break;
+          case "equals":
+            asserts.push(`match ${target} == ${a.expected}`);
+            break;
+          case "contains":
+            asserts.push(`match ${target} contains ${a.expected}`);
+            break;
+          case "exists":
+            asserts.push(`match ${target} != null`);
+            break;
+          case "type": {
+            const t = (a.expected ?? "").replace(/"/g, "");
+            const fuzzy = ["string", "number", "boolean", "array", "object"].includes(t) ? `'#${t}'` : `'#notnull'`;
+            asserts.push(`match ${target} == ${fuzzy}`);
+            break;
+          }
+          case "above":
+            asserts.push(`match ${target} > ${a.expected ?? 0}`);
+            break;
+        }
+      }
+    }
+    if (!statusEmitted) asserts.unshift(`status 200`);
+    asserts.forEach((step, i) => {
+      const kw = i === 0 ? "Then" : "And";
+      lines.push(`  ${kw} ${step}`);
+    });
+    scenarios.push(lines.join("\n"));
+  }
+  const bgBlock = bg.lines.length > 0 ? `
+Background:
+${bg.lines.join("\n")}
+` : "";
+  return `Feature: ${folderName}
+${bgBlock}
+${scenarios.join("\n\n")}
+`;
+}
+function renderTree(paths) {
+  const root = {};
+  for (const p of [...paths].sort()) {
+    let cur = root;
+    for (const part of p.split("/")) {
+      cur = cur[part] ??= {};
+    }
+  }
+  function render(node, prefix = "") {
+    const entries = Object.entries(node);
+    return entries.flatMap(([name, children], i) => {
+      const last = i === entries.length - 1;
+      const lines = [`${prefix}${last ? "└── " : "├── "}${name}`];
+      if (Object.keys(children).length) lines.push(...render(children, prefix + (last ? "    " : "│   ")));
+      return lines;
+    });
+  }
+  return [".", ...render(root)].join("\n");
+}
+function buildReadme(collectionName, filePaths) {
+  const tree = renderTree(filePaths);
+  return `# ${collectionName} — API Tests (Karate + JUnit 5)
+
+Karate is a BDD-flavoured API test framework that uses Gherkin feature files
+(no glue code) — see https://docs.karatelabs.io for the full reference.
+
+## Project structure
+
+\`\`\`
+${tree}
+\`\`\`
+
+## Setup
+
+Requires Java 17+ and Maven 3.8+.
+
+\`\`\`sh
+# Run all features
+mvn test
+
+# Switch environment (read by karate-config.js)
+mvn test -Dkarate.env=staging
+
+# Override individual values
+BASE_URL=https://api.example.com AUTH_TOKEN=eyJ... mvn test
+
+# Filter by tag
+mvn test "-Dkarate.options=--tags @get-users"
+\`\`\`
+`;
+}
+function generateKarate(collection, environment) {
+  const files = [
+    { path: "pom.xml", content: buildPom(collection.name) },
+    { path: "src/test/resources/karate-config.js", content: buildKarateConfig(environment) },
+    {
+      path: `src/test/java/karate/${javaClass(collection.name)}Runner.java`,
+      content: buildRunner(collection.name)
+    }
+  ];
+  function processFolder(folder, name) {
+    if (folder.requestIds.some((id) => {
+      const r = collection.requests[id];
+      return r && !r.disabled && !r.hookType;
+    })) {
+      files.push({
+        path: `src/test/resources/karate/${featureFileName(name)}.feature`,
+        content: buildFeature(name, folder, collection)
+      });
+    }
+    for (const sub of folder.folders) processFolder(sub, sub.name);
+  }
+  if (collection.rootFolder.requestIds.length > 0) {
+    processFolder(collection.rootFolder, collection.name);
+  }
+  for (const sub of collection.rootFolder.folders) processFolder(sub, sub.name);
   files.unshift({ path: "README.md", content: buildReadme(collection.name, files.map((f) => f.path)) });
   return files;
 }
@@ -3206,6 +3642,8 @@ function registerGenerateHandlers(ipc) {
         return generateSupertestJs(collection, environment);
       case "rest_assured":
         return generateRestAssured(collection, environment);
+      case "karate":
+        return generateKarate(collection, environment);
       default:
         throw new Error(`Unknown target: ${target}`);
     }
@@ -3292,7 +3730,8 @@ async function executeOne(req, collectionVars, envVars, globals, localVars, disp
       envVars: { ...envVars },
       collectionVars: { ...collectionVars },
       globals: { ...globals },
-      localVars: {}
+      localVars: {},
+      piiMaskPatterns
     });
     preScriptError = r.error;
     localVars = r.updatedLocalVars;
@@ -3330,6 +3769,25 @@ async function executeOne(req, collectionVars, envVars, globals, localVars, disp
     } else if (req.body.mode === "raw" && req.body.raw) {
       body = authBuilder.interpolate(req.body.raw, vars);
       if (!headers.has("content-type")) headers.set("Content-Type", req.body.rawContentType ?? "text/plain");
+    } else if (req.body.mode === "graphql" && req.body.graphql) {
+      const gql = req.body.graphql;
+      const gqlBody = { query: authBuilder.interpolate(gql.query, vars) };
+      const rawVars = gql.variables?.trim();
+      if (rawVars) {
+        try {
+          gqlBody.variables = JSON.parse(authBuilder.interpolate(rawVars, vars));
+        } catch {
+        }
+      }
+      if (gql.operationName?.trim()) gqlBody.operationName = gql.operationName.trim();
+      body = JSON.stringify(gqlBody);
+      if (!headers.has("content-type")) headers.set("Content-Type", "application/json");
+    } else if (req.body.mode === "soap" && req.body.soap) {
+      body = authBuilder.interpolate(req.body.soap.envelope, vars);
+      if (!headers.has("content-type")) headers.set("Content-Type", "text/xml; charset=utf-8");
+      if (req.body.soap.soapAction && !headers.has("soapaction")) {
+        headers.set("SOAPAction", req.body.soap.soapAction);
+      }
     }
     const methodHasBody = !["GET", "HEAD"].includes(req.method);
     const doFetch = (h) => undici.fetch(resolvedUrl, {
@@ -3361,16 +3819,17 @@ async function executeOne(req, collectionVars, envVars, globals, localVars, disp
     });
     const maskedBody = requestCollection.maskPii(responseBody, piiMaskPatterns);
     const maskedHeaders = requestCollection.maskHeaders(rawRespHeaders, piiMaskPatterns);
-    const response = {
+    const scriptResponse = {
       status: fetchResp.status,
       statusText: fetchResp.statusText,
-      headers: maskedHeaders,
-      body: maskedBody,
+      headers: rawRespHeaders,
+      body: responseBody,
       bodySize: Buffer.byteLength(responseBody, "utf8"),
       durationMs
     };
     const schemaTestResults = requestCollection.buildSchemaTestResults(req.schema, responseBody);
-    let testResults = [...schemaTestResults];
+    const protocolFaultTests = requestCollection.buildProtocolFaultTests(req.body.mode, responseBody);
+    let testResults = [...schemaTestResults, ...protocolFaultTests];
     let consoleOutput = [];
     let postScriptError;
     if (req.postRequestScript?.trim()) {
@@ -3379,9 +3838,10 @@ async function executeOne(req, collectionVars, envVars, globals, localVars, disp
         collectionVars: updatedCollectionVars,
         globals: updatedGlobals,
         localVars,
-        response
+        response: scriptResponse,
+        piiMaskPatterns
       });
-      testResults = [...schemaTestResults, ...r.testResults];
+      testResults = [...schemaTestResults, ...protocolFaultTests, ...r.testResults];
       consoleOutput = r.consoleOutput;
       postScriptError = r.error;
       updatedEnvVars = r.updatedEnvVars;
@@ -3394,7 +3854,7 @@ async function executeOne(req, collectionVars, envVars, globals, localVars, disp
     const allPassed = testResults.every((t) => t.passed);
     const httpFailed = fetchResp.status >= 400;
     const hasTests = testResults.length > 0;
-    const status = postScriptError ? "error" : hasTests ? allPassed ? "passed" : "failed" : httpFailed ? "failed" : "skipped";
+    const status = postScriptError ? "error" : hasTests ? allPassed ? "passed" : "failed" : httpFailed ? "failed" : "passed";
     if (httpFailed && testResults.length === 0) {
       testResults = [
         ...testResults,
@@ -4136,10 +4596,17 @@ function registerContractHandlers(ipc) {
     await snapshots.deleteSnapshot(dir, relPath);
   });
 }
+const GIT_BLOCK_TIMEOUT_MS = 6e4;
 function git() {
   const dir = getWorkspaceDir();
   if (!dir) throw new Error("No workspace open");
-  return simpleGit.simpleGit(dir);
+  return simpleGit.simpleGit(dir, { timeout: { block: GIT_BLOCK_TIMEOUT_MS } }).env({
+    ...process.env,
+    GIT_TERMINAL_PROMPT: "0",
+    GIT_ASKPASS: "echo",
+    SSH_ASKPASS: "echo",
+    GCM_INTERACTIVE: "Never"
+  });
 }
 function registerGitHandlers(ipc) {
   ipc.handle("git:isRepo", async () => {

package/out/main/runner.js

@@ -4,7 +4,7 @@ const promises = require("fs/promises");
 const path = require("path");
 const undici = require("undici");
 const authBuilder = require("./chunks/auth-builder-B7-LgcGr.js");
-const requestCollection = require("./chunks/request-collection-DIsjTggj.js");
+const requestCollection = require("./chunks/request-collection-CElFJzre.js");
 require("crypto");
 require("dayjs");
 require("vm");
@@ -403,7 +403,7 @@ async function loadEnvironments(workspace, dir) {
   }
   return envs;
 }
-async function executeRequest(req, collectionVars, envVars, globals, localVars, verbose, tls) {
+async function executeRequest(req, collectionVars, envVars, globals, localVars, verbose, tls, piiMaskPatterns = []) {
   if (!req.headers) req.headers = [];
   if (!req.params) req.params = [];
   if (!req.body) req.body = { mode: "none" };
@@ -426,7 +426,8 @@ async function executeRequest(req, collectionVars, envVars, globals, localVars,
       envVars: { ...envVars },
       collectionVars: { ...collectionVars },
       globals: { ...globals },
-      localVars: { ...localVars }
+      localVars: { ...localVars },
+      piiMaskPatterns
     });
     preScriptError = r.error;
     localVars = r.updatedLocalVars;
@@ -474,6 +475,12 @@ async function executeRequest(req, collectionVars, envVars, globals, localVars,
       if (gql.operationName?.trim()) gqlBody.operationName = gql.operationName.trim();
       body = JSON.stringify(gqlBody);
       if (!headers.has("content-type")) headers.set("Content-Type", "application/json");
+    } else if (req.body.mode === "soap" && req.body.soap) {
+      body = authBuilder.interpolate(req.body.soap.envelope, vars);
+      if (!headers.has("content-type")) headers.set("Content-Type", "text/xml; charset=utf-8");
+      if (req.body.soap.soapAction && !headers.has("soapaction")) {
+        headers.set("SOAPAction", req.body.soap.soapAction);
+      }
     }
     const dispatcher = await requestCollection.buildDispatcher(void 0, tls);
     const fetchResp = await undici.fetch(resolvedUrl, {
@@ -496,7 +503,8 @@ async function executeRequest(req, collectionVars, envVars, globals, localVars,
       bodySize: Buffer.byteLength(responseBody, "utf8"),
       durationMs
     };
-    let testResults = [];
+    const protocolFaultTests = requestCollection.buildProtocolFaultTests(req.body.mode, responseBody);
+    let testResults = [...protocolFaultTests];
     let consoleOutput = [];
     let postScriptError;
     if (req.postRequestScript?.trim()) {
@@ -505,9 +513,10 @@ async function executeRequest(req, collectionVars, envVars, globals, localVars,
         collectionVars: updatedCollectionVars,
         globals: updatedGlobals,
         localVars,
-        response
+        response,
+        piiMaskPatterns
       });
-      testResults = r.testResults;
+      testResults = [...protocolFaultTests, ...r.testResults];
       consoleOutput = r.consoleOutput;
       postScriptError = r.error;
       updatedEnvVars = r.updatedEnvVars;
@@ -521,7 +530,7 @@ async function executeRequest(req, collectionVars, envVars, globals, localVars,
     const allPassed = testResults.every((t) => t.passed);
     const httpFailed = fetchResp.status >= 400;
     const hasTests = testResults.length > 0;
-    const status = postScriptError ? "error" : hasTests ? allPassed ? "passed" : "failed" : httpFailed ? "failed" : "skipped";
+    const status = postScriptError ? "error" : hasTests ? allPassed ? "passed" : "failed" : httpFailed ? "failed" : "passed";
     if (httpFailed && testResults.length === 0) {
       testResults = [
         ...testResults,
@@ -575,7 +584,8 @@ function printResult(r, verbose) {
   const http = r.httpStatus ? color(` ${r.httpStatus}`, r.httpStatus < 400 ? C.green : C.red) : "";
   const dur = r.durationMs !== void 0 ? color(` ${r.durationMs}ms`, C.gray) : "";
   const method = color(r.method.padEnd(7), C.cyan);
-  console.log(`  ${icon}  ${method}  ${r.name}${http}${dur}`);
+  const hookTag = r.isHook && r.hookType ? color(` [${r.hookType.toUpperCase()}]`, C.yellow) : "";
+  console.log(`  ${icon}  ${method}  ${r.name}${hookTag}${http}${dur}`);
   if (verbose) console.log(color(`       ${r.resolvedUrl}`, C.gray));
   if (r.testResults?.length) {
     for (const t of r.testResults) {
@@ -622,8 +632,9 @@ async function main() {
   if (envName && !env) {
     console.warn(color(`Warning: environment "${envName}" not found. Running without environment.`, C.yellow));
   }
+  const version = `v${"0.2.6"}`;
   console.log("");
-  console.log(color("  API Test Runner", C.bold, C.white));
+  console.log(color("  API Test Runner" + (version ? ` ${version}` : ""), C.bold, C.white));
   console.log(color(`  Workspace:   ${wsPath}`, C.gray));
   console.log(color(`  Environment: ${env?.name ?? "(none)"}`, C.gray));
   if (filterTags.length) console.log(color(`  Tags:        ${filterTags.join(", ")}`, C.gray));
@@ -635,16 +646,21 @@ async function main() {
     for (const secret of secretValuesToMask) out = out.split(secret).join("***");
     return out;
   }
+  const DEFAULT_PII_PATTERNS = ["authorization", "password", "token", "secret", "api-key", "x-api-key"];
+  const piiPatterns = workspace.settings?.piiMaskPatterns ?? DEFAULT_PII_PATTERNS;
   function maskResult(r) {
     return {
       ...r,
       sentRequest: r.sentRequest ? {
-        headers: Object.fromEntries(Object.entries(r.sentRequest.headers).map(([k, v]) => [k, redact(v)])),
-        body: r.sentRequest.body != null ? redact(r.sentRequest.body) : void 0
+        headers: Object.fromEntries(
+          Object.entries(requestCollection.maskHeaders(r.sentRequest.headers, piiPatterns)).map(([k, v]) => [k, redact(v)])
+        ),
+        body: r.sentRequest.body != null ? redact(requestCollection.maskPii(r.sentRequest.body, piiPatterns)) : void 0
       } : void 0,
       receivedResponse: r.receivedResponse ? {
         ...r.receivedResponse,
-        body: redact(r.receivedResponse.body)
+        headers: requestCollection.maskHeaders(r.receivedResponse.headers, piiPatterns),
+        body: redact(requestCollection.maskPii(r.receivedResponse.body, piiPatterns))
       } : void 0
     };
   }
@@ -655,7 +671,7 @@ async function main() {
   let firstColName;
   for (const col of collections) {
     if (colName && col.name.toLowerCase() !== colName.toLowerCase()) continue;
-    const items = requestCollection.collectTagged(col.rootFolder, col.requests, col.collectionVariables ?? {}, filterTags);
+    const items = requestCollection.buildRunPlan(col, null, filterTags);
     if (items.length === 0) continue;
     if (!firstColName) firstColName = col.name;
     let runEnvVars = await authBuilder.buildEnvVars(env);
@@ -678,21 +694,74 @@ async function main() {
     }
     let bailed = false;
     let lastPrintedScope = null;
+    const failedScopes = /* @__PURE__ */ new Set();
+    const skipRequests = /* @__PURE__ */ new Set();
     for (const item of items) {
-      const { result, updatedEnvVars, updatedCollectionVars, updatedGlobals, updatedLocalVars } = await executeRequest(
-        item.request,
-        { ...item.collectionVars, ...runCollectionVars },
-        runEnvVars,
-        runGlobals,
-        { ...runLocalVars },
-        verbose,
-        effectiveTls
-      );
-      runEnvVars = updatedEnvVars;
-      runCollectionVars = updatedCollectionVars;
-      runGlobals = updatedGlobals;
-      runLocalVars = updatedLocalVars;
-      result.scopePath = item.scopePath;
+      const { isHook, hookType, scopeId, scopeAncestors, mainRequestId } = item;
+      let skipReason;
+      if (isHook) {
+        if (hookType === "beforeAll") {
+          if ((scopeAncestors ?? []).some((id) => failedScopes.has(id))) {
+            skipReason = "Skipped — outer scope hook failed";
+          }
+        } else if (hookType === "before") {
+          const allScopes = [...scopeAncestors ?? [], scopeId].filter(Boolean);
+          if (allScopes.some((id) => failedScopes.has(id))) {
+            skipReason = "Skipped — scope hook failed";
+          } else if (mainRequestId && skipRequests.has(mainRequestId)) {
+            skipReason = "Skipped — before hook failed";
+          }
+        }
+      } else {
+        const allScopes = [...scopeAncestors ?? [], scopeId].filter(Boolean);
+        if (allScopes.some((id) => failedScopes.has(id))) {
+          skipReason = "Skipped — beforeAll hook failed";
+        } else if (skipRequests.has(item.request.id)) {
+          skipReason = "Skipped — before hook failed";
+        }
+      }
+      let result;
+      if (skipReason) {
+        result = {
+          requestId: item.request.id,
+          name: item.request.name,
+          method: item.request.method,
+          resolvedUrl: item.request.url,
+          status: "failed",
+          error: skipReason,
+          isHook,
+          hookType,
+          scopeId,
+          scopePath: item.scopePath
+        };
+      } else {
+        const out = await executeRequest(
+          item.request,
+          { ...item.collectionVars, ...runCollectionVars },
+          runEnvVars,
+          runGlobals,
+          { ...runLocalVars },
+          verbose,
+          effectiveTls,
+          piiPatterns
+        );
+        result = out.result;
+        runEnvVars = out.updatedEnvVars;
+        runCollectionVars = out.updatedCollectionVars;
+        runGlobals = out.updatedGlobals;
+        runLocalVars = out.updatedLocalVars;
+        result.isHook = isHook;
+        result.hookType = hookType;
+        result.scopeId = scopeId;
+        result.scopePath = item.scopePath;
+        if (result.status === "failed" || result.status === "error") {
+          if (isHook && hookType === "beforeAll" && scopeId) {
+            failedScopes.add(scopeId);
+          } else if (isHook && hookType === "before" && mainRequestId) {
+            skipRequests.add(mainRequestId);
+          }
+        }
+      }
       const scopeKey = (item.scopePath ?? []).join(" / ");
       if (scopeKey !== lastPrintedScope) {
         if (scopeKey) console.log(color(`    ${scopeKey}`, C.gray, C.bold));

package/out/renderer/assets/{index-BC1srylp.js → index-jdRfbs9b.js}

@@ -14123,19 +14123,32 @@ const useStore = create()(
     }),
     // ── Apply script results back to store ────────────────────────────────────
     applyScriptUpdates: (result) => set2((s) => {
+      const isMaskSentinel = (v) => v === "[REDACTED]" || v === "[*****]";
+      const safeFilter = (m) => {
+        const out = {};
+        for (const [k, v] of Object.entries(m)) {
+          if (!isMaskSentinel(v)) out[k] = v;
+          else console.warn(`applyScriptUpdates: refusing to persist mask sentinel into "${k}"`);
+        }
+        return out;
+      };
+      const safeColVars = safeFilter(result.updatedCollectionVars);
+      const safeEnvVars = safeFilter(result.updatedEnvVars);
+      const safeGlobals = safeFilter(result.updatedGlobals);
+      const safeLocalVars = safeFilter(result.updatedLocalVars);
       const activeColId = s.activeCollectionId;
       if (activeColId && s.collections[activeColId]) {
         const col = s.collections[activeColId].data;
         col.collectionVariables = {
           ...col.collectionVariables ?? {},
-          ...result.updatedCollectionVars
+          ...safeColVars
         };
         s.collections[activeColId].dirty = true;
       }
       const activeEnvId = s.activeEnvironmentId;
       if (activeEnvId && s.environments[activeEnvId]) {
         const env = s.environments[activeEnvId].data;
-        for (const [key, value] of Object.entries(result.updatedEnvVars)) {
+        for (const [key, value] of Object.entries(safeEnvVars)) {
           const existing = env.variables.find((v) => v.key === key);
           if (existing && !existing.secret) {
             existing.value = value;
@@ -14144,8 +14157,8 @@ const useStore = create()(
           }
         }
       }
-      s.globals = { ...s.globals, ...result.updatedGlobals };
-      s.sessionVars = { ...s.sessionVars, ...result.updatedLocalVars };
+      s.globals = { ...s.globals, ...safeGlobals };
+      s.sessionVars = { ...s.sessionVars, ...safeLocalVars };
     }),
     // ── Theme & zoom ──────────────────────────────────────────────────────────
     // Persisted in workspace.settings when a workspace is open; otherwise
@@ -64963,7 +64976,8 @@ const TARGETS = [
   { id: "playwright_js", label: "Playwright JS", description: "JavaScript page-object API classes + spec files" },
   { id: "supertest_ts", label: "Supertest TS", description: "Jest + Supertest TypeScript tests" },
   { id: "supertest_js", label: "Supertest JS", description: "Jest + Supertest JavaScript tests" },
-  { id: "rest_assured", label: "REST Assured", description: "Java + JUnit 5 + Maven pom.xml" }
+  { id: "rest_assured", label: "REST Assured", description: "Java + JUnit 5 + Maven pom.xml" },
+  { id: "karate", label: "Karate", description: "Karate feature files + JUnit 5 runner + Maven" }
 ];
 function GeneratorPanel() {
   const setShowGeneratorPanel = useStore((s) => s.setShowGeneratorPanel);
@@ -70968,7 +70982,7 @@ function App() {
       /* @__PURE__ */ jsxRuntimeExports.jsx("span", { style: { color: "#6aa3c8" }, children: "Spector" }),
       /* @__PURE__ */ jsxRuntimeExports.jsxs("span", { className: "ml-2 text-[10px] font-normal opacity-50", children: [
         "v",
-        "0.2.4"
+        "0.2.6"
       ] }),
       /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "mx-2 opacity-30", children: "·" }),
       /* @__PURE__ */ jsxRuntimeExports.jsx(

package/out/renderer/index.html

@@ -5,7 +5,7 @@
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
   <title>API Spector</title>
-  <script type="module" crossorigin src="./assets/index-BC1srylp.js"></script>
+  <script type="module" crossorigin src="./assets/index-jdRfbs9b.js"></script>
   <link rel="stylesheet" crossorigin href="./assets/index-DfkLUeA1.css">
 </head>
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@testsmith/api-spector",
   "productName": "API Spector",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "Local-first API testing tool to inspect, test and mock APIs",
   "repository": {
     "type": "git",