blastproof 0.7.0 → 0.8.0

package/README.md

@@ -113,7 +113,7 @@ jobs:
 
       - run: npm start &          # however your app boots
 
-      - uses: hamc/blastproof@v0.7.0
+      - uses: hamc/blastproof@v0.8.0
         with:
           version: '0.6.0'        # pin both when this gates merges
           api-key: ${{ secrets.ANTHROPIC_API_KEY }}
@@ -241,7 +241,9 @@ The key itself is never read from a `BLASTPROOF_*` variable — you name *which*
 
 The application under test is not trusted input: its page content reaches the model, so a page that controls its own accessible text can try to influence the agent. Two things constrain that.
 
-**The agent cannot leave your application.** `navigate` is bounded by `base_url`'s origin; an app spanning hosts declares them in `allowed_origins:`. This is enforced by comparison, not by asking the model nicely.
+**The agent cannot leave your application.** The boundary is `base_url`'s origin plus whatever `allowed_origins:` declares, and it constrains where the page **is**, not only where an action asked to go. A `navigate` outside it is refused before the request; a page that ends up outside it any other way — a redirect, a link to another host, a script setting the location — fails the step, and its content is never sent to the model. Enforced by comparison, not by asking the model nicely.
+
+If your application legitimately spans hosts (an identity provider, a hosted payment step), declare them. A suite that was quietly walking onto a foreign page will now fail and name the origin to add.
 
 **Your secrets stay out of prompts.** `{{env.*}}` placeholders survive intact and are substituted at the moment of typing. Every value your tests or auth recipe reference is redacted from everything else crossing into a prompt — page snapshots included — in literal and percent-encoded form. Redaction matches known values, so treat it as a strong default rather than a guarantee against a hostile app.
 

package/dist/cli.js

@@ -336,14 +336,33 @@ var ActionError = class extends Error {
     this.name = "ActionError";
   }
 };
-function assertAllowedOrigin(url, ctx) {
-  const allowed = /* @__PURE__ */ new Set([new URL(ctx.baseUrl).origin]);
-  for (const origin of ctx.allowedOrigins ?? []) {
+var BLANK_PAGE = "about:blank";
+function allowedOriginsFor(baseUrl, allowedOrigins) {
+  const allowed = /* @__PURE__ */ new Set([new URL(baseUrl).origin]);
+  for (const origin of allowedOrigins ?? []) {
     allowed.add(new URL(origin).origin);
   }
-  if (!allowed.has(url.origin)) {
+  return allowed;
+}
+function isOriginAllowed(url, allowed) {
+  if (url === BLANK_PAGE) return true;
+  let origin;
+  try {
+    origin = new URL(url).origin;
+  } catch {
+    return false;
+  }
+  if (origin === "null") return false;
+  return allowed.has(origin);
+}
+function describeBoundary(allowed) {
+  return [...allowed].join(" or ");
+}
+function assertAllowedOrigin(url, ctx) {
+  const allowed = allowedOriginsFor(ctx.baseUrl, ctx.allowedOrigins);
+  if (!isOriginAllowed(url.toString(), allowed)) {
     throw new ActionError(
-      `Refusing to navigate outside the application: ${url.origin} is not ${[...allowed].join(" or ")}. Add it to allowed_origins in .blastproof/config.yaml if the app legitimately spans hosts.`
+      `Refusing to navigate outside the application: ${url.origin} is not ${describeBoundary(allowed)}. Add it to allowed_origins in .blastproof/config.yaml if the app legitimately spans hosts.`
     );
   }
 }
@@ -548,6 +567,7 @@ async function executeTest(page, test, options) {
     onEvent({ type: "action", index, action: maskedAction, result: mask(result) });
   };
   let failure;
+  const boundary = allowedOriginsFor(baseUrl, allowedOrigins);
   await page.goto(new URL(baseUrl).toString());
   for (let index = 0; index < allSteps.length; index++) {
     const { step, setup } = allSteps[index];
@@ -564,6 +584,11 @@ async function executeTest(page, test, options) {
           throw new StepFailure(`step exceeded ${maxIterationsPerStep} actions without completing`);
         }
         await waitForSettled(page);
+        if (!isOriginAllowed(page.url(), boundary)) {
+          throw new StepFailure(
+            `The page left the application: ${page.url()} is outside ${describeBoundary(boundary)}. Add it to allowed_origins in .blastproof/config.yaml if the app legitimately spans hosts.`
+          );
+        }
         const snap = await takeSnapshot(page);
         let action;
         try {
@@ -2635,7 +2660,7 @@ function parsePositiveNumber(flag) {
   };
 }
 var program = new Command();
-program.name("blastproof").description("Open-source AI testing agent: plain-English YAML tests executed agentically on a real browser.").version("0.7.0");
+program.name("blastproof").description("Open-source AI testing agent: plain-English YAML tests executed agentically on a real browser.").version("0.8.0");
 program.command("init").description("Scaffold .blastproof/ (config, tests, sample tests) in the current directory").action(async () => {
   try {
     const result = await initProject(process.cwd());