flowstride 1.0.19 → 1.0.20-rc.6

package/dist/manual/security.d.ts

@@ -0,0 +1,183 @@
+import { z } from "zod";
+export declare function sanitizeManualHtml(value: unknown): string;
+export declare const manualRunSchema: z.ZodObject<{
+    name: z.ZodString;
+    status: z.ZodEnum<{
+        PASS: "PASS";
+        FAIL: "FAIL";
+        INCOMPLETE: "INCOMPLETE";
+        "NO STEPS": "NO STEPS";
+    }>;
+    metrics: z.ZodObject<{
+        total: z.ZodNumber;
+        passed: z.ZodNumber;
+        failed: z.ZodNumber;
+        pending: z.ZodNumber;
+    }, z.core.$strip>;
+    canvasData: z.ZodObject<{
+        nodes: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            id: z.ZodNumber;
+            title: z.ZodOptional<z.ZodString>;
+            visual_step: z.ZodOptional<z.ZodString>;
+            description: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+            steps: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+            expected_result: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+            references: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+            defect_report: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+            defect_media: z.ZodOptional<z.ZodString>;
+            assigned_to: z.ZodOptional<z.ZodString>;
+            priority: z.ZodOptional<z.ZodString>;
+            x: z.ZodOptional<z.ZodNumber>;
+            y: z.ZodOptional<z.ZodNumber>;
+            width: z.ZodOptional<z.ZodNumber>;
+            height: z.ZodOptional<z.ZodNumber>;
+            is_active: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$loose>>>;
+        groups: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            id: z.ZodNumber;
+            title: z.ZodOptional<z.ZodString>;
+            x: z.ZodOptional<z.ZodNumber>;
+            y: z.ZodOptional<z.ZodNumber>;
+            width: z.ZodOptional<z.ZodNumber>;
+            height: z.ZodOptional<z.ZodNumber>;
+            is_active: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$loose>>>;
+        texts: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            id: z.ZodNumber;
+            content: z.ZodOptional<z.ZodString>;
+            x: z.ZodOptional<z.ZodNumber>;
+            y: z.ZodOptional<z.ZodNumber>;
+            width: z.ZodOptional<z.ZodNumber>;
+            height: z.ZodOptional<z.ZodNumber>;
+            is_active: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$loose>>>;
+        connections: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            id: z.ZodNumber;
+        }, z.core.$loose>>>;
+        executionReport: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            status: z.ZodEnum<{
+                fail: "fail";
+                passed: "passed";
+                failed: "failed";
+                skipped: "skipped";
+                success: "success";
+                Pending: "Pending";
+                Current: "Current";
+                Passed: "Passed";
+                Failed: "Failed";
+                Blocked: "Blocked";
+                Skipped: "Skipped";
+                Pass: "Pass";
+                Fail: "Fail";
+                Success: "Success";
+                pass: "pass";
+                pending: "pending";
+                blocked: "blocked";
+            }>;
+            group_title: z.ZodOptional<z.ZodString>;
+            id: z.ZodNumber;
+            title: z.ZodOptional<z.ZodString>;
+            visual_step: z.ZodOptional<z.ZodString>;
+            description: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+            steps: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+            expected_result: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+            references: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+            defect_report: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+            defect_media: z.ZodOptional<z.ZodString>;
+            assigned_to: z.ZodOptional<z.ZodString>;
+            priority: z.ZodOptional<z.ZodString>;
+            x: z.ZodOptional<z.ZodNumber>;
+            y: z.ZodOptional<z.ZodNumber>;
+            width: z.ZodOptional<z.ZodNumber>;
+            height: z.ZodOptional<z.ZodNumber>;
+            is_active: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$loose>>>;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$loose>;
+}, z.core.$strip>;
+export declare function sanitizeStoredCanvas(value: unknown): Record<string, unknown>;
+export declare const manualCanvasSchema: z.ZodObject<{
+    nodes: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodNumber;
+        title: z.ZodOptional<z.ZodString>;
+        visual_step: z.ZodOptional<z.ZodString>;
+        description: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+        steps: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+        expected_result: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+        references: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+        defect_report: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+        defect_media: z.ZodOptional<z.ZodString>;
+        assigned_to: z.ZodOptional<z.ZodString>;
+        priority: z.ZodOptional<z.ZodString>;
+        x: z.ZodOptional<z.ZodNumber>;
+        y: z.ZodOptional<z.ZodNumber>;
+        width: z.ZodOptional<z.ZodNumber>;
+        height: z.ZodOptional<z.ZodNumber>;
+        is_active: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>>>;
+    groups: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodNumber;
+        title: z.ZodOptional<z.ZodString>;
+        x: z.ZodOptional<z.ZodNumber>;
+        y: z.ZodOptional<z.ZodNumber>;
+        width: z.ZodOptional<z.ZodNumber>;
+        height: z.ZodOptional<z.ZodNumber>;
+        is_active: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>>>;
+    texts: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodNumber;
+        content: z.ZodOptional<z.ZodString>;
+        x: z.ZodOptional<z.ZodNumber>;
+        y: z.ZodOptional<z.ZodNumber>;
+        width: z.ZodOptional<z.ZodNumber>;
+        height: z.ZodOptional<z.ZodNumber>;
+        is_active: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>>>;
+    connections: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodNumber;
+    }, z.core.$loose>>>;
+    executionReport: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        status: z.ZodEnum<{
+            fail: "fail";
+            passed: "passed";
+            failed: "failed";
+            skipped: "skipped";
+            success: "success";
+            Pending: "Pending";
+            Current: "Current";
+            Passed: "Passed";
+            Failed: "Failed";
+            Blocked: "Blocked";
+            Skipped: "Skipped";
+            Pass: "Pass";
+            Fail: "Fail";
+            Success: "Success";
+            pass: "pass";
+            pending: "pending";
+            blocked: "blocked";
+        }>;
+        group_title: z.ZodOptional<z.ZodString>;
+        id: z.ZodNumber;
+        title: z.ZodOptional<z.ZodString>;
+        visual_step: z.ZodOptional<z.ZodString>;
+        description: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+        steps: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+        expected_result: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+        references: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+        defect_report: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+        defect_media: z.ZodOptional<z.ZodString>;
+        assigned_to: z.ZodOptional<z.ZodString>;
+        priority: z.ZodOptional<z.ZodString>;
+        x: z.ZodOptional<z.ZodNumber>;
+        y: z.ZodOptional<z.ZodNumber>;
+        width: z.ZodOptional<z.ZodNumber>;
+        height: z.ZodOptional<z.ZodNumber>;
+        is_active: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>>>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$loose>;
+export declare class ManualInputError extends Error {
+    status: number;
+    constructor(status: number, message: string);
+}
+export declare function readManualPayload(req: import("http").IncomingMessage): Promise<any>;

package/dist/manual/security.js

@@ -0,0 +1,106 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ManualInputError = exports.manualCanvasSchema = exports.manualRunSchema = void 0;
+exports.sanitizeManualHtml = sanitizeManualHtml;
+exports.sanitizeStoredCanvas = sanitizeStoredCanvas;
+exports.readManualPayload = readManualPayload;
+const sanitize_html_1 = __importDefault(require("sanitize-html"));
+const zod_1 = require("zod");
+const MANUAL_HTML_TAGS = ["b", "i", "em", "strong", "a", "ul", "ol", "li", "br", "div", "p", "font"];
+function sanitizeManualHtml(value) {
+    return (0, sanitize_html_1.default)(typeof value === "string" ? value : "", {
+        allowedTags: MANUAL_HTML_TAGS,
+        allowedAttributes: { a: ["href", "target", "rel"], font: ["size"] },
+        allowedSchemes: ["http", "https", "mailto"], allowProtocolRelative: false,
+        transformTags: { a: (tagName, attribs) => ({ tagName, attribs: {
+                    ...attribs, target: attribs.target === "_blank" ? "_blank" : "_self", rel: "noopener noreferrer",
+                } }) },
+    });
+}
+const label = zod_1.z.string().max(2000);
+const rich = zod_1.z.string().max(100000).transform(sanitizeManualHtml);
+const numeric = zod_1.z.number().finite();
+const media = zod_1.z.string().max(8192).refine(value => !value || /^(https?:\/\/|\/(?!\/))[^\s\\]*$/i.test(value), "Invalid media URL");
+const nodeFields = {
+    id: zod_1.z.number().int().nonnegative(), title: label.optional(), visual_step: label.optional(),
+    description: rich.optional(), steps: rich.optional(), expected_result: rich.optional(), references: rich.optional(),
+    defect_report: rich.optional(), defect_media: media.optional(), assigned_to: label.optional(), priority: label.optional(),
+    x: numeric.optional(), y: numeric.optional(), width: numeric.optional(), height: numeric.optional(), is_active: zod_1.z.boolean().optional(),
+};
+const node = zod_1.z.looseObject(nodeFields);
+const step = zod_1.z.looseObject({ ...nodeFields, status: zod_1.z.enum(["Pending", "Current", "Passed", "Failed", "Blocked", "Skipped", "Pass", "Fail", "Success", "passed", "failed", "pass", "fail", "success", "pending", "skipped", "blocked"]), group_title: label.optional() });
+const group = zod_1.z.looseObject({ id: zod_1.z.number().int().nonnegative(), title: label.optional(), x: numeric.optional(), y: numeric.optional(), width: numeric.optional(), height: numeric.optional(), is_active: zod_1.z.boolean().optional() });
+const text = zod_1.z.looseObject({ id: zod_1.z.number().int().nonnegative(), content: label.optional(), x: numeric.optional(), y: numeric.optional(), width: numeric.optional(), height: numeric.optional(), is_active: zod_1.z.boolean().optional() });
+const connection = zod_1.z.looseObject({ id: zod_1.z.number().int().nonnegative() });
+exports.manualRunSchema = zod_1.z.object({
+    name: zod_1.z.string().trim().min(1).max(255),
+    status: zod_1.z.enum(["PASS", "FAIL", "INCOMPLETE", "NO STEPS"]),
+    metrics: zod_1.z.object({ total: zod_1.z.number().int().nonnegative(), passed: zod_1.z.number().int().nonnegative(), failed: zod_1.z.number().int().nonnegative(), pending: zod_1.z.number().int().nonnegative() }).refine(m => m.total === m.passed + m.failed + m.pending, "Inconsistent metrics"),
+    canvasData: zod_1.z.looseObject({ nodes: zod_1.z.array(node).max(10000).default([]), groups: zod_1.z.array(group).max(10000).default([]), texts: zod_1.z.array(text).max(10000).default([]), connections: zod_1.z.array(connection).max(20000).default([]), executionReport: zod_1.z.array(step).max(10000).default([]), metadata: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).optional() }),
+});
+// Sanitize older records without trusting their original ingestion path.
+function sanitizeStoredCanvas(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return {};
+    const canvas = { ...value };
+    for (const key of ["nodes", "executionReport"]) {
+        if (!Array.isArray(canvas[key])) {
+            canvas[key] = [];
+            continue;
+        }
+        canvas[key] = canvas[key].filter(item => item && typeof item === "object").map(item => {
+            const result = { ...item };
+            for (const field of ["description", "steps", "expected_result", "references", "defect_report"]) {
+                if (field in result)
+                    result[field] = sanitizeManualHtml(result[field]);
+            }
+            return result;
+        });
+    }
+    return canvas;
+}
+exports.manualCanvasSchema = exports.manualRunSchema.shape.canvasData;
+class ManualInputError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+exports.ManualInputError = ManualInputError;
+async function readManualPayload(req) {
+    const limit = 2 * 1024 * 1024;
+    const length = req.headers["content-length"];
+    if (length && (!/^\d+$/.test(length) || !Number.isSafeInteger(Number(length))))
+        throw new ManualInputError(400, "Invalid request length");
+    if (length && Number(length) > limit)
+        throw new ManualInputError(413, "Manual payload exceeds 2 MiB");
+    const buffer = Buffer.allocUnsafe(length ? Number(length) : limit);
+    let bytes = 0;
+    for await (const chunk of req.iterator({ destroyOnReturn: false })) {
+        bytes += chunk.length;
+        if (bytes > limit || (length && bytes > Number(length))) {
+            req.resume();
+            throw new ManualInputError(413, "Manual payload exceeds allowed size");
+        }
+        buffer.set(chunk, bytes - chunk.length);
+    }
+    if (length && bytes !== Number(length))
+        throw new ManualInputError(400, "Request length mismatch");
+    let payload;
+    try {
+        payload = JSON.parse(buffer.subarray(0, bytes).toString("utf8"));
+    }
+    catch {
+        throw new ManualInputError(400, "Invalid manual JSON");
+    }
+    if (!payload || typeof payload !== "object" || Array.isArray(payload))
+        throw new ManualInputError(400, "Invalid manual payload");
+    const canvas = exports.manualCanvasSchema.safeParse(payload.canvasData);
+    if (!canvas.success)
+        throw new ManualInputError(400, "Invalid manual canvas");
+    return { ...payload, canvasData: canvas.data };
+}

package/dist/runner/data_generators.d.ts

@@ -3,6 +3,7 @@ export declare class DataGenerators {
     private runIdContext;
     private workerIdContext;
     constructor(runId?: string, workerId?: string);
+    sensitiveValues(): string[];
     resolve(template: string): string;
     private pickRandom;
     uuid: () => `${string}-${string}-${string}-${string}-${string}`;

package/dist/runner/data_generators.js

@@ -19,6 +19,9 @@ class DataGenerators {
         this.runIdContext = runId;
         this.workerIdContext = workerId;
     }
+    sensitiveValues() {
+        return [...this.memoryBank.entries()].filter(([key]) => /password|passcode|token|otp|pin|secret/i.test(key)).map(([, value]) => value);
+    }
     resolve(template) {
         if (!template || typeof template !== "string")
             return template;

package/dist/runner/dom_stripper.js

@@ -44,6 +44,9 @@ class DOMStripper {
                         el.removeAttribute("src");
                     }
                 });
+                clone.querySelectorAll('input').forEach(input => input.removeAttribute('value'));
+                clone.querySelectorAll('textarea').forEach(input => { input.textContent = '[REDACTED]'; });
+                clone.querySelectorAll('[contenteditable]').forEach(input => { input.textContent = '[REDACTED]'; });
                 let rawHtml = clone.outerHTML;
                 rawHtml = rawHtml.replace(/[\n\r\t]+/g, " ");
                 rawHtml = rawHtml.replace(/\s{2,}/g, " ");

package/dist/runner/flow_orchestrator.d.ts

@@ -4,6 +4,8 @@ export declare class FlowOrchestrator {
     private worker;
     private workerCount;
     private config?;
+    static readonly nativeCIProtocol = 1;
+    readonly nativeEventProtocol = 1;
     private wss;
     private httpServer;
     private globalTestScenarios;
@@ -13,6 +15,8 @@ export declare class FlowOrchestrator {
     constructor(worker: FlowWorker, workerCount?: number, config?: FlowstrideConfig | undefined);
     private forwardToDashboard;
     private executeTestRun;
-    start(targetPath: string): Promise<void>;
+    start(targetPath: string): Promise<boolean>;
+    abort(): void;
+    close(): Promise<void>;
     private handleExportPdfRequest;
 }

package/dist/runner/flow_orchestrator.js

@@ -37,6 +37,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FlowOrchestrator = void 0;
+const localDashboard_1 = require("../security/localDashboard");
+const projectPaths_1 = require("../utils/projectPaths");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const http = __importStar(require("http"));
@@ -48,6 +50,8 @@ class FlowOrchestrator {
     worker;
     workerCount;
     config;
+    static nativeCIProtocol = 1;
+    nativeEventProtocol = 1;
     wss = null;
     httpServer = null;
     globalTestScenarios = [];
@@ -64,6 +68,7 @@ class FlowOrchestrator {
         });
     }
     forwardToDashboard(type, payload) {
+        this.config?.onRunEvent?.({ type, payload });
         if (this.wss) {
             this.wss.clients.forEach((client) => {
                 if (client.readyState === 1)
@@ -73,17 +78,9 @@ class FlowOrchestrator {
     }
     async executeTestRun(targetPath) {
         this.forwardToDashboard("SUITE_START", {});
-        let filesToProcess = [];
-        const stats = fs.statSync(targetPath);
-        if (stats.isDirectory()) {
-            filesToProcess = fs
-                .readdirSync(targetPath)
-                .filter((f) => f.endsWith(".flow"))
-                .map((f) => path.join(targetPath, f));
-        }
-        else {
-            filesToProcess = [targetPath];
-        }
+        const filesToProcess = (0, projectPaths_1.discoverFlows)(targetPath);
+        if (this.config)
+            this.config.flowRoot = fs.statSync(targetPath).isDirectory() ? targetPath : path.dirname(targetPath);
         this.globalTestScenarios = [];
         this.stepStatusRegistry.clear();
         if (this.workerCount > 1) {
@@ -103,12 +100,21 @@ class FlowOrchestrator {
         this.worker.on("worker_event", listener);
         await this.worker.runBatch(filesToProcess);
         this.worker.off("worker_event", listener);
-        this.forwardToDashboard("RUN_COMPLETE", { status: "success" });
+        const passed = ![...this.stepStatusRegistry.values()].some(status => ['failed', 'running', 'not_tested'].includes(status));
+        this.forwardToDashboard("RUN_COMPLETE", { status: passed ? 'success' : 'failed' });
+        return passed;
     }
     async start(targetPath) {
         try {
+            if (this.config?.ci)
+                return await this.executeTestRun(targetPath);
             this.httpServer = http.createServer((req, res) => {
-                res.setHeader("Access-Control-Allow-Origin", "*");
+                if (!(0, localDashboard_1.isLocalDashboardRequest)(req.headers.host, req.headers.origin)) {
+                    res.writeHead(403);
+                    res.end('Forbidden');
+                    return;
+                }
+                res.setHeader('Cross-Origin-Resource-Policy', 'same-origin');
                 if (req.url && req.url.startsWith("/videos/")) {
                     let urlObj;
                     try {
@@ -221,7 +227,7 @@ class FlowOrchestrator {
                 console.error(chalk_1.default.red(`\n[Error]: Failed to start local server: ${e.message}`));
                 process.exit(1);
             });
-            this.wss = new ws_1.WebSocketServer({ server: this.httpServer });
+            this.wss = new ws_1.WebSocketServer({ server: this.httpServer, verifyClient: (info) => Boolean(info.origin) && (0, localDashboard_1.isLocalDashboardRequest)(info.req.headers.host, info.origin) });
             this.wss.on("connection", (ws) => {
                 if (this.disconnectTimer) {
                     clearTimeout(this.disconnectTimer);
@@ -277,7 +283,7 @@ class FlowOrchestrator {
                 });
             });
             return new Promise((resolve, reject) => {
-                this.httpServer.listen(0, async () => {
+                this.httpServer.listen(0, '127.0.0.1', async () => {
                     try {
                         const address = this.httpServer?.address();
                         const port = typeof address === "object" && address !== null
@@ -304,8 +310,8 @@ class FlowOrchestrator {
                         else {
                             console.log(chalk_1.default.gray("[Dashboard]: Headless mode active. Bypassing UI auto-launch..."));
                         }
-                        await this.executeTestRun(targetPath);
-                        resolve(undefined);
+                        const result = await this.executeTestRun(targetPath);
+                        resolve(result);
                     }
                     catch (err) {
                         reject(err);
@@ -317,11 +323,20 @@ class FlowOrchestrator {
             throw e;
         }
     }
+    abort() {
+        this.worker.abort();
+    }
+    async close() {
+        if (this.disconnectTimer)
+            clearTimeout(this.disconnectTimer);
+        this.wss?.clients.forEach(client => client.terminate());
+        this.wss?.close();
+        this.httpServer?.close();
+    }
     async handleExportPdfRequest(testScenariosFromUI) {
         try {
-            const spinner = (0, ora_1.default)(chalk_1.default.blue("Compiling high-fidelity PDF report...")).start();
+            const spinner = (0, ora_1.default)(chalk_1.default.blue("Compiling high fidelity PDF report...")).start();
             const pdfPath = await this.pdfGenerator.generateTestcasePdf(testScenariosFromUI);
-            // Convert the saved PDF to base64 to trigger the native browser download UI
             const pdfBuffer = fs.readFileSync(pdfPath);
             const base64Data = pdfBuffer.toString("base64");
             this.forwardToDashboard("EXPORT_PDF_RES", { base64: base64Data });

package/dist/runner/flow_worker.d.ts

@@ -21,6 +21,7 @@ export declare class FlowWorker extends EventEmitter {
     private pluginManager?;
     private isSilent;
     private isAborted;
+    private bailTriggered;
     private isDebugHalted;
     private currentStepContext;
     private currentFileName;