blastproof 0.14.0 → 0.15.0

package/README.md

@@ -145,6 +145,8 @@ The agent is **forbidden from inventing values** — one it types must come from
 
 The rule used to live only in the prompt, and a prompt instructs rather than enforces. Run against a real model, `fill the note field` did not fail — the agent made a value up, filled it, and the step **passed**, producing "This is a test note." on two runs and "This is a new note" on a third. A test going green over a value nobody wrote, differing between runs, is worse than a failure.
 
+A placeholder counts as a source **only when the step names that variable**. `fill the password field with {{env.TEST_PASSWORD}}` works; `fill the password field` does not become valid because the agent supplies `{{env.SOMETHING}}` itself. An agent cannot know the name of a variable nobody showed it, so one it produces is a guess — and a guessed variable would put a live credential into a field your test never pointed one at, in output that cannot redact a secret it was never told about.
+
 Two limits worth knowing. A value the page shows in one format and the field wants in another — `1234` in the step, `1,234.00` in the box — is refused, and the fix is to write the value the way it is typed. And a very short value (`3`) appears somewhere in almost any page, so it will pass; this closes fabricated content, not every fabricated character.
 
 `run` also warns about it first — the same rule caught earlier, from the test file, on every path, before launching a browser or asking for a key:

package/dist/cli.js

@@ -509,7 +509,10 @@ async function performAction(page, action, ctx) {
 var COMMIT_ACTIONS = /* @__PURE__ */ new Set(["click", "press"]);
 var COMMIT_KEYS = /* @__PURE__ */ new Set(["Enter", "NumpadEnter", " ", "Space", "Spacebar"]);
 var SOURCED_VALUE_ACTIONS = /* @__PURE__ */ new Set(["fill", "select"]);
-var ENV_PLACEHOLDER2 = /^\s*\{\{env\.[A-Za-z_][A-Za-z0-9_]*\}\}\s*$/;
+function referencesOnlyNamedVars(value, step) {
+  const named = new Set(referencedEnvVars(step));
+  return referencedEnvVars(value).every((name) => named.has(name));
+}
 function normalise(text) {
   return text.replace(/\s+/g, " ").trim().toLowerCase();
 }
@@ -545,7 +548,16 @@ var StepRecovery = class {
    * step — which is also the whole of the "does not cross steps" rule.
    */
   readable;
+  /**
+   * The step exactly as written, for deciding which `{{env.*}}` variables it
+   * names (design env-placeholder-must-be-named, D3). Kept alongside the
+   * normalised copy rather than derived from it: `readable` is lowercased, and
+   * environment variable names are case-sensitive, so `TOKEN` and `token` must
+   * stay distinguishable in the one place that decides which secret gets typed.
+   */
+  step;
   constructor(step) {
+    this.step = step;
     this.readable = [normalise(step)];
   }
   /**
@@ -614,7 +626,11 @@ var StepRecovery = class {
     if (!SOURCED_VALUE_ACTIONS.has(action.action)) return void 0;
     const value = action.value;
     if (!value) return void 0;
-    if (ENV_PLACEHOLDER2.test(value)) return void 0;
+    if (!referencesOnlyNamedVars(value, this.step)) {
+      const named = referencedEnvVars(this.step);
+      return `refused: the value "${value}" was NOT typed, because this step does not reference that {{env.*}} variable. ${named.length > 0 ? `This step references ${named.map((n) => `{{env.${n}}}`).join(", ")}.` : "This step references no environment variable."} A placeholder is a source only when the step names it \u2014 otherwise the test never asked for that secret to be typed here. Use a value this step supplies, or fail the step and say it supplies none.`;
+    }
+    if (referencedEnvVars(value).length > 0) return void 0;
     const needle = normalise(value);
     if (needle === "") return void 0;
     if (this.readable.some((source) => source.includes(needle))) return void 0;
@@ -2990,7 +3006,7 @@ function parsePositiveNumber(flag) {
   };
 }
 var program = new Command();
-program.name("blastproof").description("Open-source AI testing agent: plain-English YAML tests executed agentically on a real browser.").version("0.14.0");
+program.name("blastproof").description("Open-source AI testing agent: plain-English YAML tests executed agentically on a real browser.").version("0.15.0");
 program.command("init").description("Scaffold .blastproof/ (config, tests, sample tests) in the current directory").action(async () => {
   try {
     const result = await initProject(process.cwd());