ccqa 1.53.0 → 1.54.0

package/dist/bin/ccqa.mjs

@@ -31531,18 +31531,21 @@ z.object({
 //#endregion
 //#region src/hub/api/auth.ts
 /**
-* Constant-time comparison against the hub's bearer token, so response
-* timing can't be used to guess the token character-by-character. Accepts
-* the token either as an `Authorization: Bearer <token>` header or, for
-* read-only GET endpoints only (the artifacts download is a browser `<a>` that can't
-* carry a header), a `?token=` query parameter — see docs/hub-api.md for
-* the security tradeoff that accepts.
+* Reads the token from `Authorization: Bearer <token>`, or — on GET only —
+* from `?token=`. A query token leaks through `Referer`, history and proxy
+* logs, so it is accepted only where a browser `<a>` can't send a header;
+* see docs/hub-api.md.
 */
 function extractToken(req, url) {
 	const header = req.headers.authorization;
 	if (header?.startsWith("Bearer ")) return header.slice(7);
+	if (req.method !== "GET") return null;
 	return url.searchParams.get("token");
 }
+/**
+* Constant-time comparison against the hub's bearer token, so response
+* timing can't be used to guess the token character-by-character.
+*/
 function isValidToken(provided, expected) {
 	if (provided === null) return false;
 	const a = Buffer.from(provided);

package/dist/hub-client/index.d.cts

@@ -35,9 +35,9 @@ declare const RunSchema: z.ZodObject<{
     running: "running";
   }>;
   kind: z.ZodDefault<z.ZodEnum<{
+    record: "record";
     run: "run";
     drift: "drift";
-    record: "record";
   }>>;
   drift: z.ZodDefault<z.ZodNullable<z.ZodObject<{
     specs: z.ZodNumber;
@@ -831,9 +831,9 @@ type ReportSpecResult = z.infer<typeof ReportSpecResultSchema>;
 declare const RunReportDataSchema: z.ZodObject<{
   schemaVersion: z.ZodLiteral<1>;
   kind: z.ZodDefault<z.ZodEnum<{
+    record: "record";
     run: "run";
     drift: "drift";
-    record: "record";
   }>>;
   createdAt: z.ZodString;
   runId: z.ZodNullable<z.ZodString>;

package/dist/hub-client/index.d.mts

@@ -35,9 +35,9 @@ declare const RunSchema: z.ZodObject<{
     running: "running";
   }>;
   kind: z.ZodDefault<z.ZodEnum<{
+    record: "record";
     run: "run";
     drift: "drift";
-    record: "record";
   }>>;
   drift: z.ZodDefault<z.ZodNullable<z.ZodObject<{
     specs: z.ZodNumber;
@@ -831,9 +831,9 @@ type ReportSpecResult = z.infer<typeof ReportSpecResultSchema>;
 declare const RunReportDataSchema: z.ZodObject<{
   schemaVersion: z.ZodLiteral<1>;
   kind: z.ZodDefault<z.ZodEnum<{
+    record: "record";
     run: "run";
     drift: "drift";
-    record: "record";
   }>>;
   createdAt: z.ZodString;
   runId: z.ZodNullable<z.ZodString>;

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccqa",
-  "version": "1.53.0",
+  "version": "1.54.0",
   "type": "module",
   "description": "Browser test recorder powered by Claude Code and agent-browser",
   "repository": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccqa",
-  "version": "1.53.0",
+  "version": "1.54.0",
   "type": "module",
   "description": "Browser test recorder powered by Claude Code and agent-browser",
   "repository": {