@vostride/agent-qa-dashboard 0.1.14 → 0.1.16

package/dist/server/index.d.cts

@@ -1,4 +1,4 @@
-export { f as createRouter, r as readJsonBody, s as startServer } from '../index-BL7OautO.cjs';
+export { f as createRouter, r as readJsonBody, s as startServer } from '../index-ygQLgXzT.cjs';
 import 'node:http';
 import '@vostride/agent-qa-core';
 import '@vostride/agent-qa-mcp';

package/dist/server/index.d.ts

@@ -1,4 +1,4 @@
-export { f as createRouter, r as readJsonBody, s as startServer } from '../index-BL7OautO.js';
+export { f as createRouter, r as readJsonBody, s as startServer } from '../index-ygQLgXzT.js';
 import 'node:http';
 import '@vostride/agent-qa-core';
 import '@vostride/agent-qa-mcp';

package/dist/server/index.js

@@ -1572,7 +1572,7 @@ function readJsonBody(req, maxBytes = DEFAULT_MAX_BYTES) {
 }
 
 // src/server/routes.ts
-import { buildAnalyticsEvent, buildInternalRunAttributes, captureAnalytics, mergeRunAttributes, readAuth, writeAuth, removeAuth, getAgentQaVersion, getProviderOptions, getLLMAuthProviderPlugin, listLLMAuthProviderPlugins, ModelConfigSchema, NamedLLMConfigSchema, WorkspaceSchema, ServicesSchema, RegistrySchema, UseSchema, MobileAppStateSchema, hashStepInstruction, TimeoutConfigSchema, CacheConfigSchema, HealingConfigSchema, PlannerConfigSchema, LoggingConfigSchema, LogCaptureConfigSchema, AccessibilityConfigSchema, DashboardConfigSchema, McpConfigSchema, RecordingConfigSchema, BrowserConfigSchema, AnalyticsSchema, AgentQaConfigSchema as AgentQaConfigSchema3, TestDefinitionSchema, SuiteDefinitionSchema, parseEnvFile, serializeEnvFile, runHookInSandbox, RUNTIME_IMAGE_MAP, SecretStore, SecretRedactor, validateUserRunAttributes, discoverWorkspaceFiles as discoverWorkspaceFiles4, isWorkspacePathMatch, resolveAnalyticsStandardProperties, resolveMemoryRoot as resolveMemoryRoot2, resolveWorkspaceFileTarget as resolveWorkspaceFileTarget2 } from "@vostride/agent-qa-core";
+import { AuthStateNameSchema, buildAnalyticsEvent, buildInternalRunAttributes, captureAnalytics, mergeRunAttributes, readAuth, writeAuth, removeAuth, getAgentQaVersion, getProviderOptions, getLLMAuthProviderPlugin, listAuthStateMetadata, listLLMAuthProviderPlugins, ModelConfigSchema, NamedLLMConfigSchema, WorkspaceSchema, ServicesSchema, RegistrySchema, UseSchema, MobileAppStateSchema, hashStepInstruction, TimeoutConfigSchema, CacheConfigSchema, HealingConfigSchema, PlannerConfigSchema, LoggingConfigSchema, LogCaptureConfigSchema, AccessibilityConfigSchema, DashboardConfigSchema, McpConfigSchema, RecordingConfigSchema, BrowserConfigSchema, AnalyticsSchema, AgentQaConfigSchema as AgentQaConfigSchema3, TestDefinitionSchema, SuiteDefinitionSchema, parseEnvFile, serializeEnvFile, runHookInSandbox, RUNTIME_IMAGE_MAP, SecretStore, SecretRedactor, redactAuthStateValue, validateUserRunAttributes, discoverWorkspaceFiles as discoverWorkspaceFiles4, isWorkspacePathMatch, resolveAnalyticsStandardProperties, resolveMemoryRoot as resolveMemoryRoot2, resolveWorkspaceFileTarget as resolveWorkspaceFileTarget2 } from "@vostride/agent-qa-core";
 import { parse as parseYaml5 } from "yaml";
 var LLM_PROVIDER_MODES = /* @__PURE__ */ new Set([
   "openai-compatible",
@@ -1862,6 +1862,41 @@ function cors(res) {
 function isPlainRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
+function getConfiguredAuthStateDir(config) {
+  const services = isPlainRecord(config.services) ? config.services : void 0;
+  const authState = services && isPlainRecord(services.authState) ? services.authState : void 0;
+  return typeof authState?.dir === "string" ? authState.dir : void 0;
+}
+function getSessionTargetNameForAuthState(session) {
+  if (!session || typeof session.getState !== "function") return "selected target";
+  try {
+    const state = session.getState();
+    if (isPlainRecord(state) && typeof state.targetName === "string" && state.targetName.trim().length > 0) {
+      return state.targetName.trim();
+    }
+  } catch {
+  }
+  return "selected target";
+}
+function buildAuthStateSaveErrorMessage(stateName, targetName, error) {
+  const raw = error instanceof Error ? error.message : String(error);
+  if (/already exists/i.test(raw)) {
+    return {
+      status: 409,
+      message: `Auth state "${stateName}" for target "${targetName}" already exists. Use replace=true to replace it.`
+    };
+  }
+  if (/web Live Mode|not ready|executing|busy/i.test(raw)) {
+    return {
+      status: 409,
+      message: `Could not save auth state "${stateName}" for target "${targetName}".`
+    };
+  }
+  return {
+    status: 500,
+    message: `Could not save auth state "${stateName}" for target "${targetName}".`
+  };
+}
 function isDashboardProductEventName(value) {
   return typeof value === "string" && DASHBOARD_PRODUCT_EVENT_NAME_SET.has(value);
 }
@@ -2261,7 +2296,7 @@ function sanitizeSecretsFileMetadata(value) {
   };
 }
 function sanitizeArtifactPayloadForResponse(payload) {
-  const sanitized = sanitizeSecretTemplates(payload);
+  const sanitized = redactAuthStateValue(sanitizeSecretTemplates(payload));
   if (!isRecord(sanitized)) return payload;
   const config = sanitized.config;
   if (!isRecord(config) || !("secretsFile" in config)) return sanitized;
@@ -2280,6 +2315,9 @@ function sanitizeArtifactForResponse(artifact) {
     payload: sanitizeArtifactPayloadForResponse(artifact.payload)
   };
 }
+function sanitizeAuthStateForResponse(value) {
+  return redactAuthStateValue(value);
+}
 async function normalizeDashboardWorkspacePath(filePath, workspacePaths, kind, requireExisting = true) {
   if (!workspacePaths) {
     throw new Error("Workspace path resolution is required for dashboard-triggered runs");
@@ -2504,6 +2542,28 @@ function createRouter(dbOrDeps, artifactsDir) {
     }
     const url = parseUrl(req);
     const path = url.pathname;
+    if (path === "/api/auth-states" && req.method === "GET") {
+      if (!configManager || !deps.configPath) {
+        json(res, { error: "Auth-state metadata not available" }, 503);
+        return;
+      }
+      ;
+      (async () => {
+        try {
+          const config = await configManager.read();
+          const targetName = url.searchParams.get("target") ?? void 0;
+          const authStates = await listAuthStateMetadata({
+            configDir: dirname4(resolve3(deps.configPath)),
+            authStateDir: getConfiguredAuthStateDir(config),
+            targetName
+          });
+          json(res, { authStates });
+        } catch {
+          json(res, { error: "Could not list auth states." }, 500);
+        }
+      })();
+      return;
+    }
     if (path === "/api/analytics/events" && req.method === "POST") {
       readJsonBody(req).then((body) => {
         if (!isPlainRecord(body) || !isDashboardProductEventName(body.name) || Object.prototype.hasOwnProperty.call(body, "properties") && body.properties !== void 0 && !isPlainRecord(body.properties)) {
@@ -2617,7 +2677,7 @@ function createRouter(dbOrDeps, artifactsDir) {
         return;
       }
       const bundle = db.getRunArtifactBundle(runId);
-      json(res, {
+      json(res, sanitizeAuthStateForResponse({
         run,
         artifact: sanitizeArtifactForResponse(bundle.artifact),
         children: bundle.children.map((child) => ({
@@ -2625,7 +2685,7 @@ function createRouter(dbOrDeps, artifactsDir) {
           artifact: sanitizeArtifactForResponse(child.artifact)
         })),
         missingSections: getArtifactMissingSections(bundle.artifact)
-      });
+      }));
       return;
     }
     if (path.startsWith("/api/runs/") && path.endsWith("/accessibility") && req.method === "GET") {
@@ -2651,7 +2711,7 @@ function createRouter(dbOrDeps, artifactsDir) {
       const stepOrder = parseInt(stepOrderStr, 10);
       const trace = db.getReasoningTrace(runId, stepOrder);
       if (trace) {
-        json(res, { trace });
+        json(res, sanitizeAuthStateForResponse({ trace }));
         return;
       }
       const steps = db.getSteps(runId);
@@ -2660,7 +2720,7 @@ function createRouter(dbOrDeps, artifactsDir) {
         notFound(res, "Step not found");
         return;
       }
-      json(res, {
+      json(res, sanitizeAuthStateForResponse({
         trace: {
           id: null,
           stepId: step.id,
@@ -2681,7 +2741,7 @@ function createRouter(dbOrDeps, artifactsDir) {
           screenStateAfter: null,
           createdAt: step.createdAt
         }
-      });
+      }));
       return;
     }
     if (path.startsWith("/api/runs/") && path.endsWith("/execution-logs") && req.method === "GET") {
@@ -2701,11 +2761,11 @@ function createRouter(dbOrDeps, artifactsDir) {
         for (const rid of allRunIds) {
           allLogs.push(...db.getExecutionLogs({ runId: rid, stepId, type }));
         }
-        json(res, { logs: allLogs });
+        json(res, sanitizeAuthStateForResponse({ logs: allLogs }));
         return;
       }
       const logs = db.getExecutionLogs({ runId: id, stepId, type });
-      json(res, { logs });
+      json(res, sanitizeAuthStateForResponse({ logs }));
       return;
     }
     if (path.startsWith("/api/runs/") && path.endsWith("/logs") && req.method === "GET") {
@@ -2722,7 +2782,7 @@ function createRouter(dbOrDeps, artifactsDir) {
       const limit = url.searchParams.has("limit") ? parseInt(url.searchParams.get("limit"), 10) : 500;
       const offset = url.searchParams.has("offset") ? parseInt(url.searchParams.get("offset"), 10) : 0;
       const logs = db.getLogs({ runId: id, stepId, level, source, limit, offset });
-      json(res, { logs, total: logs.length });
+      json(res, sanitizeAuthStateForResponse({ logs, total: logs.length }));
       return;
     }
     if (path.startsWith("/api/runs/") && path.endsWith("/steps") && req.method === "GET") {
@@ -2734,7 +2794,7 @@ function createRouter(dbOrDeps, artifactsDir) {
         return;
       }
       const steps = db.getSteps(id);
-      json(res, { steps });
+      json(res, sanitizeAuthStateForResponse({ steps }));
       return;
     }
     if (path.startsWith("/api/runs/") && path.endsWith("/cancel") && req.method === "POST") {
@@ -2808,9 +2868,9 @@ function createRouter(dbOrDeps, artifactsDir) {
       const attempts = db.getRunsByParent(id);
       if (run.suiteId && !run.parentRunId) {
         const tests = db.getRunsByParent(id);
-        json(res, { run, steps, attempts, tests });
+        json(res, sanitizeAuthStateForResponse({ run, steps, attempts, tests }));
       } else {
-        json(res, { run, steps, attempts });
+        json(res, sanitizeAuthStateForResponse({ run, steps, attempts }));
       }
       return;
     }
@@ -4423,7 +4483,7 @@ data: ${JSON.stringify(event)}
           const networkLogs = summarizeHookNetworkLogs(
             result.networkLogs
           );
-          json(res, {
+          json(res, sanitizeAuthStateForResponse({
             success: result.success,
             status: result.success ? "passed" : "failed",
             executedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -4441,9 +4501,9 @@ data: ${JSON.stringify(event)}
               networkLogsAvailable: networkLogs.length > 0,
               networkLogs
             }
-          });
+          }));
         } catch (err) {
-          json(res, { error: err instanceof Error ? err.message : "Failed to run hook" }, 500);
+          json(res, sanitizeAuthStateForResponse({ error: err instanceof Error ? err.message : "Failed to run hook" }), 500);
         }
       }).catch(() => json(res, { error: "Invalid request body" }, 400));
       return;
@@ -4692,6 +4752,45 @@ data: ${JSON.stringify(event)}
       })();
       return;
     }
+    const liveEditorAuthStateMatch = path.match(/^\/api\/live-editor\/sessions\/([^/]+)\/auth-state$/);
+    if (liveEditorAuthStateMatch && req.method === "POST") {
+      if (!sessionManager) {
+        json(res, { error: "Live editor not available" }, 503);
+        return;
+      }
+      ;
+      (async () => {
+        let stateName = "";
+        let session;
+        try {
+          const body = await readJsonBody(req);
+          const parsedName = AuthStateNameSchema.safeParse(typeof body?.name === "string" ? body.name : "");
+          if (!parsedName.success) {
+            json(res, { error: "Auth state name must be a lowercase slug." }, 400);
+            return;
+          }
+          stateName = parsedName.data;
+          session = sessionManager.getSession(decodeURIComponent(liveEditorAuthStateMatch[1]));
+          if (!session) {
+            notFound(res, "Session not found");
+            return;
+          }
+          if (typeof session.captureWebAuthState !== "function") {
+            json(res, {
+              error: `Could not save auth state "${stateName}" for target "${getSessionTargetNameForAuthState(session)}".`
+            }, 500);
+            return;
+          }
+          const authState = await session.captureWebAuthState(stateName, { replace: body?.replace === true });
+          json(res, { authState });
+        } catch (err) {
+          const targetName = getSessionTargetNameForAuthState(session);
+          const response = buildAuthStateSaveErrorMessage(stateName || "unknown", targetName, err);
+          json(res, { error: response.message }, response.status);
+        }
+      })();
+      return;
+    }
     if (path === "/api/live-editor/sessions" && req.method === "POST") {
       if (!sessionManager) {
         json(res, { error: "Live editor not available" }, 503);
@@ -5899,7 +5998,9 @@ import { randomUUID as randomUUID3 } from "crypto";
 
 // src/live-editor/live-session.ts
 import { randomUUID as randomUUID2 } from "crypto";
+import { dirname as dirname8, resolve as resolvePath } from "path";
 import {
+  AUTH_STATE_SCHEMA_VERSION,
   executeStep,
   createModel,
   getProviderOptions as getProviderOptions2,
@@ -5913,8 +6014,11 @@ import {
   runHooks,
   runHookInSandbox as runHookInSandbox2,
   MobileSetupError as MobileSetupError2,
-  redactSecretValue,
-  resolveSecretTemplatesInValue
+  readAuthStateMetadata,
+  redactAuthStateValue as redactAuthStateValue2,
+  resolveAuthStatePaths,
+  resolveSecretTemplatesInValue,
+  writeAuthStateFiles
 } from "@vostride/agent-qa-core";
 
 // src/live-editor/mobile-bootstrap.ts
@@ -6069,6 +6173,26 @@ function coerceRunJSResult(value) {
   }
   return JSON.stringify(value);
 }
+function getWebStorageStateContext(adapter) {
+  if (!adapter || !("getPage" in adapter)) return null;
+  const page = adapter.getPage?.();
+  if (!page || typeof page !== "object") return null;
+  const contextFactory = page.context;
+  if (typeof contextFactory !== "function") return null;
+  const context = contextFactory.call(page);
+  if (!context || typeof context !== "object") return null;
+  const storageState = context.storageState;
+  if (typeof storageState !== "function") return null;
+  return context;
+}
+function getConfiguredAuthStateDir2(config) {
+  const services = config.services;
+  if (!services || typeof services !== "object") return void 0;
+  const authState = services.authState;
+  if (!authState || typeof authState !== "object") return void 0;
+  const dir = authState.dir;
+  return typeof dir === "string" ? dir : void 0;
+}
 function toLiveSubActionData(result) {
   return result.trace?.subActions?.map((subAction) => ({
     index: subAction.index,
@@ -6146,6 +6270,7 @@ var LiveSession = class {
   previousSteps = [];
   currentStep = null;
   platform = "web";
+  targetName = null;
   currentUrl = null;
   executing = false;
   idleTimer = null;
@@ -6183,7 +6308,7 @@ var LiveSession = class {
     this.pendingMessages.push(message);
   }
   redact(value) {
-    return redactSecretValue(value, this.secretRedactor);
+    return redactAuthStateValue2(value, { secretRedactor: this.secretRedactor });
   }
   resolveSecrets(value) {
     return resolveSecretTemplatesInValue(value, this.secretStore);
@@ -6413,6 +6538,7 @@ var LiveSession = class {
   }
   async initialize(config) {
     this.platform = config.platform;
+    this.targetName = typeof config.targetName === "string" && config.targetName.trim().length > 0 ? config.targetName.trim() : null;
     this._modelName = config.llmConfig.model ?? "unknown";
     this.variableStore = new VariableStore();
     this.secretStore = config.secretStore;
@@ -6903,6 +7029,62 @@ ${errorLines.join("\n")}`;
       this.messageSink = originalSink;
     }
   }
+  async captureWebAuthState(name, options = {}) {
+    if (this.platform !== "web") {
+      throw new Error("Auth-state capture is only available for web Live Mode sessions.");
+    }
+    if (!this.readyForInteraction || !this.adapter) {
+      throw new Error(this.terminalError ?? "Live session is not ready for auth-state capture.");
+    }
+    if (this.adapter.platform !== "web") {
+      throw new Error("Auth-state capture is only available for web Live Mode sessions.");
+    }
+    if (this.executing) {
+      throw new Error("Cannot save auth state while the Live Mode session is executing.");
+    }
+    if (!this.targetName) {
+      throw new Error("Cannot save auth state because this Live Mode session has no configured target.");
+    }
+    if (!this.deps.configManager || !this.deps.configPath) {
+      throw new Error("Cannot save auth state because workspace config is unavailable.");
+    }
+    const context = getWebStorageStateContext(this.adapter);
+    if (!context) {
+      throw new Error("Cannot save auth state because the active browser context is unavailable.");
+    }
+    const config = await this.deps.configManager.read();
+    const authStateDir = getConfiguredAuthStateDir2(config);
+    const paths = resolveAuthStatePaths({
+      configDir: dirname8(resolvePath(this.deps.configPath)),
+      authStateDir,
+      targetName: this.targetName,
+      stateName: name,
+      target: { platform: "web" }
+    });
+    let existing = null;
+    try {
+      existing = await readAuthStateMetadata(paths);
+    } catch {
+      existing = null;
+    }
+    if (existing && options.replace !== true) {
+      throw new Error(`Auth state "${paths.stateName}" for target "${paths.targetName}" already exists. Use replace=true to replace it.`);
+    }
+    const payload = await context.storageState({ indexedDB: true });
+    const metadata = {
+      version: AUTH_STATE_SCHEMA_VERSION,
+      kind: "web",
+      target: paths.targetName,
+      name: paths.stateName,
+      capturedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    try {
+      await writeAuthStateFiles(paths, { payload, metadata });
+    } catch {
+      throw new Error(`Could not save auth state "${paths.stateName}" for target "${paths.targetName}".`);
+    }
+    return metadata;
+  }
   cancelStep() {
     this.abortController?.abort();
   }
@@ -6963,6 +7145,7 @@ ${errorLines.join("\n")}`;
     return {
       sessionId: this.sessionId,
       platform: this.adapter?.platform ?? this.platform,
+      targetName: this.targetName,
       status: this.status === "terminated" ? "idle" : this.status === "executing" ? "executing" : this.status,
       currentStep: this.currentStep,
       currentUrl: this.currentUrl,