flowstride 1.0.19 → 1.0.20-rc.6

package/dist/cli/commands/run.js

@@ -34,6 +34,9 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runAction = runAction;
+const projectPaths_1 = require("../../utils/projectPaths");
+const config_1 = require("../../ci/config");
+const runtime_1 = require("../../ci/runtime");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const dotenv = __importStar(require("dotenv"));
@@ -51,7 +54,7 @@ const api_proxy_1 = require("../../sdk/api_proxy");
 async function runAction(targetPath, options) {
     const root = process.cwd();
     const profileEnvPath = options.env
-        ? path.resolve(root, `.env.${options.env}`)
+        ? (0, projectPaths_1.projectPath)(root, `.env.${options.env}`)
         : null;
     const defaultEnvPath = path.resolve(root, ".env");
     if (profileEnvPath) {
@@ -69,12 +72,8 @@ async function runAction(targetPath, options) {
             console.log(`[Environment]: Loaded default .env file`);
         }
     }
-    const isCI = !!(process.env.CI ||
-        process.env.GITHUB_ACTIONS ||
-        process.env.GITLAB_CI ||
-        process.env.CIRCLECI ||
-        process.env.JENKINS_URL ||
-        process.env.FLOWSTRIDE_API_KEY);
+    const config = (0, config_1.loadNativeConfig)(root, options);
+    const isCI = !!config.ci;
     if (isCI) {
         console.log("\n[CI/CD]: Environment detected. Engaging Smart Automation Behaviors...");
     }
@@ -84,39 +83,13 @@ async function runAction(targetPath, options) {
         process.exit(1);
     }
     console.log(`\n[Flowstride]: Starting execution suite at "${resolvedPath}"...`);
-    const configPath = path.resolve(root, "flowstride.config.json");
-    let localConfig = {};
-    if (fs.existsSync(configPath)) {
-        try {
-            const fileContent = fs.readFileSync(configPath, "utf-8");
-            localConfig = JSON.parse(fileContent);
-            console.log(`[Config]: Loaded project configuration from flowstride.config.json`);
-        }
-        catch (e) {
-            console.warn(`[Warning]: Could not parse flowstride.config.json: ${e.message}`);
-        }
-    }
-    const config = {
-        headless: isCI
-            ? true
-            : options.headed
-                ? false
-                : (localConfig.headless ?? true),
-        timeout: localConfig.timeout ?? 30000,
-        bail: options.bail ?? localConfig.bail ?? false,
-        baseUrl: process.env.BASE_URL ?? localConfig.baseUrl,
-        defaultDialogBehavior: isCI
-            ? "dismiss"
-            : (localConfig.defaultDialogBehavior ?? "dismiss"),
-        pluginsDir: localConfig.pluginsDir,
-    };
     if (isCI) {
         console.log(`   > Headless Mode: ${config.headless ? "Forced ON" : "OFF"}`);
         console.log(`   > Dialog Protection: ${(config.defaultDialogBehavior || "dismiss").toUpperCase()}`);
         console.log(`   > Artifact Auto-Staging: ENABLED\n`);
     }
-    let workerCount = options.workers ? parseInt(options.workers, 10) : 1;
-    if (isNaN(workerCount) || workerCount < 1) {
+    let workerCount = options.workers ? Number(options.workers) : 1;
+    if (!Number.isSafeInteger(workerCount) || workerCount < 1) {
         console.error(`\n[Error]: Invalid worker count "${options.workers}". Must be an integer greater than 0.`);
         process.exit(1);
     }
@@ -126,6 +99,8 @@ async function runAction(targetPath, options) {
         console.log(`[Warning]: Auto-capping to ${maxSafeWorkers} workers to prevent system thrashing and crashes.\n`);
         workerCount = maxSafeWorkers;
     }
+    if (config.manifest?.maxWorkers !== undefined && config.manifest.maxWorkers !== 'unlimited')
+        workerCount = Math.min(workerCount, config.manifest.maxWorkers);
     const web = new playwright_1.WebAdapter(config);
     const api = new undici_1.ApiAdapter(config);
     const store = new temporary_store_1.TemporaryStore();
@@ -144,6 +119,8 @@ async function runAction(targetPath, options) {
         try {
             const proWorkerModule = await import((0, url_1.pathToFileURL)(proWorkerPath).href);
             const proOrchModule = await import((0, url_1.pathToFileURL)(proOrchPath).href);
+            if (config.ci && proOrchModule.FlowOrchestrator.nativeCIProtocol !== 1)
+                throw new Error('Installed Pro engine does not support native CI protocol 1; install the matching Pro candidate.');
             ActiveFlowWorker = proWorkerModule.FlowWorker;
             ActiveFlowOrchestrator = proOrchModule.FlowOrchestrator;
             engineMode = "Enterprise (Pro)";
@@ -155,6 +132,11 @@ async function runAction(targetPath, options) {
     console.log(`\n[Engine]: Booting Flowstride in ${engineMode} mode...`);
     const worker = new ActiveFlowWorker(config, web, api, store, sessions, pluginManager);
     const orchestrator = new ActiveFlowOrchestrator(worker, workerCount, config);
+    if (isCI) {
+        const result = await (0, runtime_1.runNativeCI)(worker, orchestrator, resolvedPath, config, engineMode);
+        console.log(`[Flowstride]: ${result.status}; reports: ${config.artifactsDir}`);
+        process.exit(result.status === 'passed' ? 0 : result.status === 'interrupted' ? 130 : 1);
+    }
     try {
         await orchestrator.start(resolvedPath);
         console.log("\n[Flowstride]: Execution suite completed successfully.");

package/dist/cli/index.js

@@ -37,29 +37,38 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+const cloud_1 = require("../utils/cloud");
+const cloudSession_1 = require("./utils/cloudSession");
+const config_1 = require("../ci/config");
+const init_1 = require("../ci/init");
 const commander_1 = require("commander");
 const run_1 = require("./commands/run");
 const report_1 = require("./commands/report");
-const init_1 = require("./commands/init");
+const init_2 = require("./commands/init");
 const open_1 = require("./commands/open");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
-const child_process_1 = require("child_process");
+const proInstaller_1 = require("./utils/proInstaller");
 const prompts_1 = require("@inquirer/prompts");
 const chalk_1 = __importDefault(require("chalk"));
 const ora_1 = __importDefault(require("ora"));
 const program = new commander_1.Command();
-const API_BASE = process.env.FLOWSTRIDE_API_URL || "https://cloud.flowstride.io";
+program.hook('preAction', (_program, command) => {
+    if (['login', 'status', 'run', 'update'].includes(command.name())) {
+        API_BASE = (0, cloudSession_1.loadCloudEnvironment)(process.cwd(), command.opts().env);
+    }
+});
+let API_BASE = (0, cloud_1.cloudApiBase)(process.env);
 program
     .name("flowstride")
     .description("Flowstride: The Enterprise Flow-First Automation CLI")
-    .version("1.0.19");
+    .version("1.0.20-rc.6");
 program
     .command("init")
     .description("Initialise a new Flowstride workspace in the current directory")
     .action(async () => {
-    await (0, init_1.initAction)();
+    await (0, init_2.initAction)();
 });
 program
     .command("login")
@@ -99,6 +108,7 @@ program
         console.error(chalk_1.default.red("✖ Error: A valid Developer Token is required."));
         process.exit(1);
     }
+    console.log(`[Cloud]: ${API_BASE}; login credential source: ${process.env.FLOWSTRIDE_TOKEN ? 'FLOWSTRIDE_TOKEN (environment)' : options.token ? '--token option' : 'interactive prompt'}`);
     const deviceName = os.hostname();
     const spinner = (0, ora_1.default)("Authenticating with Cloud...").start();
     try {
@@ -112,10 +122,11 @@ program
         });
         const data = await response.json();
         if (!response.ok) {
-            spinner.fail(chalk_1.default.red(`Authentication Failed: ${data.error || "Invalid token or network error"}`));
+            spinner.fail(chalk_1.default.red(`Authentication Failed: ${(0, cloud_1.cloudFailure)({ response: { status: response.status, data } }, [token.trim()]).message}`));
             process.exit(1);
         }
         spinner.succeed(chalk_1.default.green("Authentication Successful!"));
+        console.log((0, cloudSession_1.tokenExpiryDescription)(data));
         const configDir = options.global
             ? path.join(os.homedir(), ".flowstride")
             : path.join(process.cwd(), ".flowstride");
@@ -144,42 +155,14 @@ program
                 }
                 if (installPro) {
                     const installSpinner = (0, ora_1.default)("Downloading Enterprise Engine via secure proxy...").start();
-                    const tarballPath = path.join(process.cwd(), "flowstride-pro.tgz");
                     try {
-                        const tarballResponse = await fetch(`${API_BASE}/api/workspace/download-pro`, {
-                            method: "GET",
-                            headers: { Authorization: `Bearer ${token.trim()}` },
-                        });
-                        if (!tarballResponse.ok) {
-                            throw new Error(`Secure proxy rejected request: ${tarballResponse.statusText}`);
-                        }
-                        const buffer = await tarballResponse.arrayBuffer();
-                        fs.writeFileSync(tarballPath, Buffer.from(buffer));
-                        installSpinner.text = "Wiring up Enterprise dependencies...";
-                        installSpinner.color = "cyan";
-                        // Let npm natively handle the extraction and binary symlinking
-                        (0, child_process_1.execSync)(`npm install "${tarballPath}" --no-save`, {
-                            cwd: process.cwd(),
-                            stdio: "ignore",
-                        });
+                        await (0, proInstaller_1.installProEngine)(API_BASE, token.trim());
                         installSpinner.succeed(chalk_1.default.green("Enterprise Engine installed successfully!"));
                     }
-                    catch (installError) {
-                        installSpinner.stop();
-                        console.error(chalk_1.default.bgRed.white("\n[RAW SYSTEM ERROR]:"), installError);
-                        console.log(chalk_1.default.red("\n✖ Failed to install the Enterprise Engine. Please check your internet connection or verify your project configuration."));
-                        if (fs.existsSync(nodeModulesPath)) {
-                            fs.rmSync(nodeModulesPath, { recursive: true, force: true });
-                        }
-                        console.log(chalk_1.default.yellow("⚠️ Reverting login: Enterprise Engine is required to sync."));
-                        if (fs.existsSync(credentialsPath))
-                            fs.unlinkSync(credentialsPath);
-                        process.exit(1);
-                    }
-                    finally {
-                        if (fs.existsSync(tarballPath)) {
-                            fs.unlinkSync(tarballPath);
-                        }
+                    catch (error) {
+                        installSpinner.fail(error instanceof Error ? error.message : "Enterprise installation failed");
+                        console.log(chalk_1.default.yellow("Credentials remain available. You can retry installation; runs can fall back to the Open Source engine."));
+                        process.exitCode = 1;
                     }
                 }
                 else {
@@ -194,7 +177,7 @@ program
         console.log(chalk_1.default.bold.green(`\n✅ Machine synchronized with Flowstride Enterprise.`));
     }
     catch (error) {
-        spinner.fail(chalk_1.default.red(`Network Error: Could not connect to cloud.flowstride.io`));
+        spinner.fail(chalk_1.default.red((0, cloud_1.cloudFailure)(error, [token.trim()]).message));
         process.exit(1);
     }
 });
@@ -202,7 +185,8 @@ program
     .command("status")
     .description("Display the current Flowstride CLI authentication and engine tier")
     .action(async () => {
-    let token = process.env.FLOWSTRIDE_TOKEN || null;
+    console.log((0, cloudSession_1.cloudSessionDescription)(API_BASE));
+    let token = process.env.FLOWSTRIDE_TOKEN?.trim() || null;
     const localCredentialsPath = path.join(process.cwd(), ".flowstride", "credentials.json");
     const globalCredentialsPath = path.join(os.homedir(), ".flowstride", "credentials.json");
     let activeCredentialsPath = localCredentialsPath; // Default for cleanup
@@ -211,7 +195,7 @@ program
             activeCredentialsPath = localCredentialsPath;
             try {
                 const credentials = JSON.parse(fs.readFileSync(localCredentialsPath, "utf8"));
-                token = credentials.machineToken;
+                token = credentials.machineToken?.trim() || null;
             }
             catch (err) { }
         }
@@ -219,7 +203,7 @@ program
             activeCredentialsPath = globalCredentialsPath;
             try {
                 const credentials = JSON.parse(fs.readFileSync(globalCredentialsPath, "utf8"));
-                token = credentials.machineToken;
+                token = credentials.machineToken?.trim() || null;
             }
             catch (err) { }
         }
@@ -241,9 +225,10 @@ program
             method: "GET",
             headers: { Authorization: `Bearer ${token}` },
         });
-        if (response.status === 401) {
-            console.log(chalk_1.default.red("🔴 AUTH EXPIRED: Your device session was revoked or expired."));
-            if (fs.existsSync(activeCredentialsPath))
+        if (response.status === 401 || response.status === 403) {
+            const failureData = await response.json().catch(() => ({}));
+            console.log(chalk_1.default.red((0, cloud_1.cloudFailure)({ response: { status: response.status, data: failureData } }, [token]).message));
+            if (response.status === 401 && !process.env.FLOWSTRIDE_TOKEN && fs.existsSync(activeCredentialsPath))
                 fs.unlinkSync(activeCredentialsPath);
         }
         else if (response.ok) {
@@ -271,12 +256,19 @@ program
     .option("--headed", "Run browser in headed mode")
     .option("--headless", "Run browser in headless mode")
     .option("--workers <number>", "Number of parallel workers to spawn (Pro feature)")
+    .option('--ci', 'Run without a dashboard and write CI reports')
+    .option('--device <profile>', 'desktop, phone, or landscape')
+    .option('--config <file>', 'Path to the Flowstride configuration')
+    .option('--env <name>', 'Environment profile')
     .action(async (targetPath, options) => {
     if (typeof targetPath === "object") {
         options = targetPath;
         targetPath = undefined;
     }
-    let token = process.env.FLOWSTRIDE_TOKEN || null;
+    if (options.ci)
+        process.env.FLOWSTRIDE_NATIVE_CI = '1';
+    console.log((0, cloudSession_1.cloudSessionDescription)(API_BASE));
+    let token = process.env.FLOWSTRIDE_TOKEN?.trim() || null;
     let forceOS = false;
     const localCredentialsPath = path.join(process.cwd(), ".flowstride", "credentials.json");
     const globalCredentialsPath = path.join(os.homedir(), ".flowstride", "credentials.json");
@@ -286,7 +278,7 @@ program
             activeCredentialsPath = localCredentialsPath;
             try {
                 const credentials = JSON.parse(fs.readFileSync(localCredentialsPath, "utf8"));
-                token = credentials.machineToken;
+                token = credentials.machineToken?.trim() || null;
             }
             catch (err) { }
         }
@@ -294,7 +286,7 @@ program
             activeCredentialsPath = globalCredentialsPath;
             try {
                 const credentials = JSON.parse(fs.readFileSync(globalCredentialsPath, "utf8"));
-                token = credentials.machineToken;
+                token = credentials.machineToken?.trim() || null;
             }
             catch (err) { }
         }
@@ -317,15 +309,29 @@ program
                 method: "GET",
                 headers: { Authorization: `Bearer ${token}` },
             });
-            if (response.status === 401) {
-                console.log(chalk_1.default.red("🔴 AUTH EXPIRED: Your device session was revoked or expired."));
-                if (fs.existsSync(activeCredentialsPath))
+            if (response.status === 401 || response.status === 403) {
+                const failureData = await response.json().catch(() => ({}));
+                console.log(chalk_1.default.red((0, cloud_1.cloudFailure)({ response: { status: response.status, data: failureData } }, [token]).message));
+                if (response.status === 401 && !process.env.FLOWSTRIDE_TOKEN && fs.existsSync(activeCredentialsPath))
                     fs.unlinkSync(activeCredentialsPath);
                 forceOS = true;
             }
             else if (response.ok) {
                 const data = await response.json();
                 const tier = data.tier.toUpperCase();
+                if ((0, config_1.loadNativeConfig)(process.cwd(), options).ci && fs.existsSync(nodeModulesPath)) {
+                    const workspaceResponse = await fetch(`${API_BASE}/api/workspace/status`, {
+                        headers: { Authorization: `Bearer ${token}` },
+                    });
+                    if (!workspaceResponse.ok)
+                        forceOS = await handleOfflinePrompt();
+                    else {
+                        const workspaceData = await workspaceResponse.json();
+                        options.manifest = workspaceData.manifest;
+                        options.workspaceId = workspaceData.workspace?._id;
+                        options.isCloudSyncActive = true;
+                    }
+                }
                 if (tier === "PERSONAL") {
                     console.log(chalk_1.default.yellow(`🟡 [OS]: [${data.workspaceName}] (Tier: PERSONAL)`));
                 }
@@ -344,7 +350,7 @@ program
     if (options.headed) {
         options.headless = false;
     }
-    const resolvedTargetPath = targetPath ? targetPath : "./flows";
+    const resolvedTargetPath = targetPath || (0, config_1.loadNativeConfig)(process.cwd(), options).testDir;
     const strictUiFlowsDir = path.resolve(process.cwd(), resolvedTargetPath);
     if (!fs.existsSync(strictUiFlowsDir)) {
         console.error(`\n[ERROR]: Could not find ${strictUiFlowsDir}.`);
@@ -352,11 +358,17 @@ program
         process.exit(1);
     }
     options.forceOS = forceOS;
+    if (!forceOS && token) {
+        options.machineToken = token;
+        const file = fs.existsSync(localCredentialsPath) ? localCredentialsPath : globalCredentialsPath;
+        if (!options.workspaceId && fs.existsSync(file))
+            options.workspaceId = JSON.parse(fs.readFileSync(file, 'utf8')).workspaceId;
+    }
     await (0, run_1.runAction)(strictUiFlowsDir, options);
 });
 async function handleOfflinePrompt() {
     console.log(chalk_1.default.yellow("🛜 OFFLINE: Unable to reach Flowstride Cloud. Enterprise Sync paused."));
-    if (process.env.CI || process.env.FLOWSTRIDE_TOKEN) {
+    if (process.env.CI || process.env.FLOWSTRIDE_NATIVE_CI || process.env.FLOWSTRIDE_TOKEN) {
         console.log(chalk_1.default.yellow("⚠️ CI/CD Environment: Automatically falling back to OS Engine."));
         return true;
     }
@@ -381,4 +393,16 @@ program
     .action(async () => {
     await (0, open_1.openAction)();
 });
+program.command('install')
+    .description('Install Chromium matching this Flowstride engine')
+    .option('--with-deps', 'Install operating-system browser dependencies')
+    .action((options) => {
+    const { execFileSync } = require('node:child_process');
+    execFileSync(process.execPath, [path.join(path.dirname(require.resolve('playwright/package.json')), 'cli.js'), 'install', ...(options.withDeps ? ['--with-deps'] : []), 'chromium'], { stdio: 'inherit', env: { ...process.env, PLAYWRIGHT_SKIP_BROWSER_GC: '1' } });
+});
+program.command('ci')
+    .description('Set up native Flowstride CI')
+    .command('init <provider>')
+    .description('Generate a GitHub Actions workflow without overwriting existing files')
+    .action((provider) => (0, init_1.initCI)(provider));
 program.parse(process.argv);

package/dist/cli/manual_server/workspace_server.js

@@ -37,6 +37,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.startManualWorkspaceServer = startManualWorkspaceServer;
+const projectPaths_1 = require("../../utils/projectPaths");
+const security_1 = require("../../manual/security");
 const http = __importStar(require("http"));
 const path = __importStar(require("path"));
 const fs = __importStar(require("fs"));
@@ -49,12 +51,12 @@ async function startManualWorkspaceServer() {
         console.error(chalk_1.default.red(`\n❌ Error: UI build bundle not found at ${uiDistPath}. Please build the UI first.`));
         process.exit(1);
     }
-    const manualFlowsDir = path.join(process.cwd(), "manual_flows");
-    const templatesDir = path.join(manualFlowsDir, "templates");
-    const runsDir = path.join(manualFlowsDir, "runs");
-    const mediaDir = path.join(manualFlowsDir, "media");
-    const defectMediaDir = path.join(manualFlowsDir, "defect_media");
-    const workspaceStateFile = path.join(manualFlowsDir, ".workspace_state.json");
+    const manualFlowsDir = (0, projectPaths_1.projectPath)(process.cwd(), path.join(process.cwd(), "manual_flows"));
+    const templatesDir = (0, projectPaths_1.projectPath)(process.cwd(), path.join(manualFlowsDir, "templates"));
+    const runsDir = (0, projectPaths_1.projectPath)(process.cwd(), path.join(manualFlowsDir, "runs"));
+    const mediaDir = (0, projectPaths_1.projectPath)(process.cwd(), path.join(manualFlowsDir, "media"));
+    const defectMediaDir = (0, projectPaths_1.projectPath)(process.cwd(), path.join(manualFlowsDir, "defect_media"));
+    const workspaceStateFile = (0, projectPaths_1.projectPath)(process.cwd(), path.join(manualFlowsDir, ".workspace_state.json"));
     if (!fs.existsSync(templatesDir))
         fs.mkdirSync(templatesDir, { recursive: true });
     if (!fs.existsSync(runsDir))
@@ -92,7 +94,7 @@ async function startManualWorkspaceServer() {
                 return res.end(JSON.stringify({ error: "Invalid or missing file extension." }));
             }
             const safeFilename = `media_${Date.now()}_${Math.random().toString(36).substring(2, 9)}${ext.toLowerCase()}`;
-            const filePath = path.join(mediaDir, safeFilename);
+            const filePath = (0, projectPaths_1.projectPath)(process.cwd(), path.join(mediaDir, safeFilename));
             const MAX_SIZE = 104857600;
             let uploadedSize = 0;
             let isAborted = false;
@@ -141,7 +143,7 @@ async function startManualWorkspaceServer() {
                 }
                 const rawFilename = targetPath.replace("/media/", "");
                 const safeFilename = path.basename(rawFilename);
-                const filePath = path.join(mediaDir, safeFilename);
+                const filePath = (0, projectPaths_1.projectPath)(process.cwd(), path.join(mediaDir, safeFilename));
                 if (!fs.existsSync(filePath)) {
                     res.writeHead(404, { "Content-Type": "application/json" });
                     return res.end(JSON.stringify({ error: "Media file not found in vault" }));
@@ -166,7 +168,7 @@ async function startManualWorkspaceServer() {
         if (req.method === "GET" && pathname.startsWith("/media/")) {
             const filename = pathname.replace("/media/", "");
             const safeFilename = path.basename(filename);
-            const filePath = path.join(mediaDir, safeFilename);
+            const filePath = (0, projectPaths_1.projectPath)(process.cwd(), path.join(mediaDir, safeFilename));
             if (!fs.existsSync(filePath)) {
                 res.writeHead(404);
                 return res.end("Media not found");
@@ -213,7 +215,7 @@ async function startManualWorkspaceServer() {
                 return res.end(JSON.stringify({ error: "Invalid or missing file extension." }));
             }
             const safeFilename = `defect_${Date.now()}_${Math.random().toString(36).substring(2, 9)}${ext.toLowerCase()}`;
-            const filePath = path.join(defectMediaDir, safeFilename);
+            const filePath = (0, projectPaths_1.projectPath)(process.cwd(), path.join(defectMediaDir, safeFilename));
             const MAX_SIZE = 41943040; // Capped at 40MB
             let uploadedSize = 0;
             let isAborted = false;
@@ -263,7 +265,7 @@ async function startManualWorkspaceServer() {
                 }
                 const rawFilename = targetPath.replace("/defect_media/", "");
                 const safeFilename = path.basename(rawFilename);
-                const filePath = path.join(defectMediaDir, safeFilename);
+                const filePath = (0, projectPaths_1.projectPath)(process.cwd(), path.join(defectMediaDir, safeFilename));
                 if (fs.existsSync(filePath)) {
                     fs.unlinkSync(filePath);
                     console.log(chalk_1.default.yellow(`\n[Local Cache Cleared]: Asset securely removed from manual_flows/defect_media/${safeFilename}`));
@@ -286,7 +288,7 @@ async function startManualWorkspaceServer() {
         if (req.method === "GET" && pathname.startsWith("/defect_media/")) {
             const filename = pathname.replace("/defect_media/", "");
             const safeFilename = path.basename(filename);
-            const filePath = path.join(defectMediaDir, safeFilename);
+            const filePath = (0, projectPaths_1.projectPath)(process.cwd(), path.join(defectMediaDir, safeFilename));
             if (!fs.existsSync(filePath)) {
                 res.writeHead(404);
                 return res.end("Defect media not found");
@@ -326,13 +328,17 @@ async function startManualWorkspaceServer() {
         // CORE SYSTEM ROUTES
         // ============================================================================
         if (req.method === "POST" && pathname === "/api/save-design") {
-            let body = "";
-            req.on("data", (chunk) => {
-                body += chunk.toString();
-            });
-            req.on("end", () => {
+            let payload;
+            try {
+                payload = await (0, security_1.readManualPayload)(req);
+            }
+            catch (error) {
+                res.writeHead(error instanceof security_1.ManualInputError ? error.status : 400, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: error instanceof security_1.ManualInputError ? error.message : 'Invalid manual payload' }));
+                return;
+            }
+            const savePayload = async () => {
                 try {
-                    const payload = JSON.parse(body);
                     const rawFilename = payload.filename || `New Flow.json`;
                     const canvasData = payload.canvasData;
                     if (!canvasData) {
@@ -343,7 +349,7 @@ async function startManualWorkspaceServer() {
                     if (!safeFilename.endsWith(".json")) {
                         safeFilename += ".json";
                     }
-                    const filePath = path.join(templatesDir, safeFilename);
+                    const filePath = (0, projectPaths_1.projectPath)(process.cwd(), path.join(templatesDir, safeFilename));
                     fs.writeFileSync(filePath, JSON.stringify(canvasData, null, 2), "utf-8");
                     console.log(chalk_1.default.green(`\n[Saved]: Template securely vaulted to manual_flows/templates/${safeFilename}`));
                     res.writeHead(200, { "Content-Type": "application/json" });
@@ -360,7 +366,8 @@ async function startManualWorkspaceServer() {
                         error: "Internal server error while saving template.",
                     }));
                 }
-            });
+            };
+            await savePayload();
             return;
         }
         if (req.method === "GET" && pathname === "/api/templates") {
@@ -398,7 +405,7 @@ async function startManualWorkspaceServer() {
                         error: "Forbidden: Only JSON configuration files can be loaded",
                     }));
                 }
-                const filePath = path.join(templatesDir, safeFilename);
+                const filePath = (0, projectPaths_1.projectPath)(process.cwd(), path.join(templatesDir, safeFilename));
                 if (!fs.existsSync(filePath)) {
                     res.writeHead(404, { "Content-Type": "application/json" });
                     return res.end(JSON.stringify({ error: "Template file not found" }));
@@ -430,7 +437,7 @@ async function startManualWorkspaceServer() {
                         error: "Forbidden: Only JSON configuration files can be deleted",
                     }));
                 }
-                const filePath = path.join(templatesDir, safeFilename);
+                const filePath = (0, projectPaths_1.projectPath)(process.cwd(), path.join(templatesDir, safeFilename));
                 if (!fs.existsSync(filePath)) {
                     res.writeHead(404, { "Content-Type": "application/json" });
                     return res.end(JSON.stringify({ error: "Template file not found" }));
@@ -453,13 +460,17 @@ async function startManualWorkspaceServer() {
             return;
         }
         if (req.method === "POST" && pathname === "/api/save-run") {
-            let body = "";
-            req.on("data", (chunk) => {
-                body += chunk.toString();
-            });
-            req.on("end", async () => {
+            let payload;
+            try {
+                payload = await (0, security_1.readManualPayload)(req);
+            }
+            catch (error) {
+                res.writeHead(error instanceof security_1.ManualInputError ? error.status : 400, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: error instanceof security_1.ManualInputError ? error.message : 'Invalid manual payload' }));
+                return;
+            }
+            const savePayload = async () => {
                 try {
-                    const payload = JSON.parse(body);
                     const rawFilename = payload.filename || `Execution_Run_${Date.now()}.json`;
                     const canvasData = payload.canvasData;
                     if (!canvasData) {
@@ -469,7 +480,7 @@ async function startManualWorkspaceServer() {
                     const now = new Date();
                     const dayFolder = `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, "0")}-${String(now.getDate()).padStart(2, "0")}`;
                     const timeFolder = `${String(now.getHours()).padStart(2, "0")}-${String(now.getMinutes()).padStart(2, "0")}-${String(now.getSeconds()).padStart(2, "0")}`;
-                    const runTargetDir = path.join(runsDir, dayFolder, timeFolder);
+                    const runTargetDir = (0, projectPaths_1.projectPath)(process.cwd(), path.join(runsDir, dayFolder, timeFolder));
                     if (!fs.existsSync(runTargetDir)) {
                         fs.mkdirSync(runTargetDir, { recursive: true });
                     }
@@ -477,7 +488,7 @@ async function startManualWorkspaceServer() {
                     if (!safeFilename.endsWith(".json")) {
                         safeFilename += ".json";
                     }
-                    const filePath = path.join(runTargetDir, safeFilename);
+                    const filePath = (0, projectPaths_1.projectPath)(process.cwd(), path.join(runTargetDir, safeFilename));
                     fs.writeFileSync(filePath, JSON.stringify(canvasData, null, 2), "utf-8");
                     const relativePath = path
                         .join(dayFolder, timeFolder, safeFilename)
@@ -498,7 +509,8 @@ async function startManualWorkspaceServer() {
                         error: "Internal server error while saving run.",
                     }));
                 }
-            });
+            };
+            await savePayload();
             return;
         }
         if (req.method === "GET" && pathname === "/api/runs") {
@@ -589,7 +601,7 @@ async function startManualWorkspaceServer() {
                     res.writeHead(403, { "Content-Type": "application/json" });
                     return res.end(JSON.stringify({ error: "Forbidden: Invalid file path" }));
                 }
-                const filePath = path.join(runsDir, targetFilename);
+                const filePath = (0, projectPaths_1.projectPath)(process.cwd(), path.join(runsDir, targetFilename));
                 const resolvedPath = path.resolve(filePath);
                 const resolvedRunsDir = path.resolve(runsDir);
                 if (!resolvedPath.startsWith(resolvedRunsDir) ||

package/dist/cli/utils/cloudSession.d.ts

@@ -0,0 +1,7 @@
+/** Resolve .env before authentication, using the same precedence as execution. */
+export declare function loadCloudEnvironment(root: string, profile?: string): string;
+export declare function cloudSessionDescription(apiBase: string): string;
+export declare function tokenExpiryDescription(data: {
+    tokenExpiresAt?: string;
+    tokenScope?: string;
+}): string;

package/dist/cli/utils/cloudSession.js

@@ -0,0 +1,37 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadCloudEnvironment = loadCloudEnvironment;
+exports.cloudSessionDescription = cloudSessionDescription;
+exports.tokenExpiryDescription = tokenExpiryDescription;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_os_1 = __importDefault(require("node:os"));
+const dotenv_1 = __importDefault(require("dotenv"));
+const cloud_1 = require("../../utils/cloud");
+/** Resolve .env before authentication, using the same precedence as execution. */
+function loadCloudEnvironment(root, profile) {
+    if (profile && !/^[a-zA-Z0-9_-]+$/.test(profile))
+        throw new Error('Invalid environment profile name.');
+    const files = profile ? [`.env.${profile}`, '.env'] : ['.env'];
+    for (const file of files) {
+        const filename = node_path_1.default.join(root, file);
+        if (node_fs_1.default.existsSync(filename))
+            dotenv_1.default.config({ path: filename, quiet: true });
+    }
+    return (0, cloud_1.cloudApiBase)(process.env);
+}
+function cloudSessionDescription(apiBase) {
+    const source = process.env.FLOWSTRIDE_TOKEN ? 'FLOWSTRIDE_TOKEN (environment)'
+        : node_fs_1.default.existsSync(node_path_1.default.join(process.cwd(), '.flowstride', 'credentials.json')) ? 'project credentials'
+            : node_fs_1.default.existsSync(node_path_1.default.join(node_os_1.default.homedir(), '.flowstride', 'credentials.json')) ? 'global credentials' : 'no saved credentials';
+    return `[Cloud]: ${apiBase}; credential source: ${source}`;
+}
+function tokenExpiryDescription(data) {
+    const expiry = data.tokenExpiresAt ? new Date(data.tokenExpiresAt) : null;
+    const label = expiry && Number.isFinite(expiry.getTime()) ? expiry.toISOString() : 'unavailable from this Cloud server';
+    const scope = ['execution', 'admin', 'readonly'].includes(data.tokenScope || '') ? `; scope: ${data.tokenScope}` : '';
+    return `[Cloud]: Token expiry (UTC): ${label}${scope}. Logging in with the same key does not renew it.`;
+}

package/dist/cli/utils/proInstaller.d.ts

@@ -0,0 +1,5 @@
+export declare function validateProArchive(buffer: Buffer): Promise<string>;
+export declare function installProEngine(apiBase: string, token: string, root?: string): Promise<{
+    version: string;
+    sha256: string;
+}>;