flowstride 1.0.20-rc.2 → 1.0.20-rc.6

package/NATIVE_CI.md

@@ -2,8 +2,7 @@
 
 This candidate adds native CI and game APIs to both engines. Managed Cloud
 execution remains retired. Existing npm OSS / private Pro archive distribution
-and fallback remain supported. Naija Throne's current runner is unchanged;
-its migration is a separate acceptance step. Native CI uses protocol 1.
+and fallback remain supported. Consumer project migrations are managed separately. Native CI uses protocol 1.
 The public CLI selects compatible Pro engines or logs the reason and falls back
 to OSS. Older Pro CLIs may own the npm binary and do not understand the new
 commands; install both candidates when testing the Pro path.
@@ -19,9 +18,9 @@ currently hosted Cloud download still serves the existing release; this local
 candidate does not change that endpoint or its archive.
 
 ```sh
-npm install --save-dev /absolute/path/flowstride-1.0.20-rc.2.tgz
+npm install --save-dev /absolute/path/flowstride-1.0.20-rc.6.tgz
 # Optional: install the local matching Pro candidate after project dependencies.
-npm install --no-save /absolute/path/flowstride-pro-1.0.15-rc.1.tgz
+npm install --no-save /absolute/path/flowstride-pro-1.0.15-rc.5.tgz
 npx --no-install flowstride install
 npx --no-install flowstride run --ci
 ```
@@ -55,8 +54,9 @@ SIGINT/SIGTERM produce interrupted results. The run owns its optional local
 server and refuses an already-serving readiness URL.
 
 Cloud reporting is off by default in native CI. `cloudSync: true` explicitly
-allows existing authenticated reporting; its existing server-side security and
-storage limitations still apply. Normal interactive reporting and the restored
+allows existing authenticated reporting; matching Cloud deployment and configured media storage are required. Reporting and
+video status are written separately in the summary and `.flowstride/cloud-sync.json`;
+a reporting failure does not turn a passed test into a failed test. Normal interactive reporting and the restored
 Cloud URL overrides remain separate from retired managed execution.
 
 `npx flowstride ci init github` generates a workflow explicitly, never during
@@ -122,34 +122,58 @@ three.module.js and three.core.js. OSS CLI handoff tests use
 
 Run the real archive install/handoff harness against both candidates, including
 missing/broken Pro and revoked-token fallback. Validate GitHub's Linux execution,
-real licensed download and Naija Throne migration after local acceptance.
+real licensed download after local acceptance.
 No push, npm publication, Cloud archive replacement or Naija Throne migration
 is performed by building these candidates.
 
-## Candidate acceptance automation
-
-The repository's `Native CI acceptance` workflow tests Node 22 and 24 on Linux.
-It uses a checksum-pinned archive in `.github/fixtures`, checks its compiled engine
-against a fresh build, checks referenced dashboard assets, then installs that exact
-archive in a clean consumer. It exercises native browser installation, passing and
-deliberately failing game execution, media, server cleanup and workflow preservation.
-It also runs the native source suite, including delayed uploads and cancellation.
-The Pro archive belongs only in the private Pro repository.
-
-These jobs do not publish npm packages, replace the hosted Pro archive, deploy
-Cloud, or migrate application repositories. Native Cloud reporting stays opt-in.
-Qualification covers Chromium and emulated desktop/phone/landscape profiles.
-Physical Android/iOS devices, Safari/Firefox and other game engines are outside
-this candidate's verified support scope. Real Cloud licensing, reporting and
-video storage require a separate live acceptance run.
-
-## OSS npm preview release
-
-OSS `1.0.20-rc.2` requires Node.js 22.12.0+. Publish the verified archive under
-`next`; install with `npm install --save-dev flowstride@next` after publication.
-Use the release archive and checksum rather than rebuilding from a dirty checkout.
-The matching local Pro candidate remains `1.0.15-rc.1`; hosted Pro remains
-`1.0.14`. Complete authentication before reinstalling the local Pro candidate.
-The unchanged dashboard bundle is reused from the previously qualified rc.1
-archive; the engine is rebuilt from this source. The release input manifest
-records both that archive's checksum and the merged base commit.
+## Combined candidate behavior
+
+Node.js 22.12 or newer is required. Flow discovery is recursive; `.first.flow`
+files run before ordinary files. Reports identify nested flows by their relative
+paths, and same-named videos receive distinct filenames. A failed scenario skips
+its remaining steps and continues to later scenarios. `--bail` stops later work;
+Pro executes bail runs sequentially. `only.Scenario:` selects that file's focus
+scenario and report planning uses the same selection.
+
+Configuration, plugin, environment, upload, vault and output paths must stay
+inside the project, including resolved symlinks. Move shared fixtures into the
+project rather than referring to external files. `FLOWSTRIDE_API_URL` takes
+precedence over `NEXTJS_WEBHOOK_URL`; the legacy completion suffix is normalized.
+Managed runner commands remain retired.
+
+Logs redact credential fields, known generated secrets and signed capabilities.
+Redaction cannot guarantee removal of arbitrary application data or visible
+secrets in screenshots/videos. Review artifact access and test data accordingly.
+
+The Pro installer rejects unsafe or incomplete archives, downloads above 32 MiB,
+and checksum mismatches. Older Cloud servers without checksum headers remain
+compatible and emit a warning; `FLOWSTRIDE_PRO_SHA256` can pin an expected digest.
+On failed npm installation the previous Pro directory and CLI launchers are
+restored. This is not a transaction over every project dependency npm may alter;
+use a disposable project for candidate acceptance.
+
+## Dashboard tab history
+
+Completed test tabs restore that file's last captured step by default. Selecting
+an earlier step remembers its history cursor separately for each file. A sidebar
+step also selects the owning tab. Return to Live applies only to the selected
+file, and a new suite/rerun clears old cursors and screens. Runner console and
+network panels show the selected file's records; the full Logs view retains
+suite-wide history. Flows/steps without screenshots show an explicit empty
+state rather than another flow's screen.
+
+Run `npm run test:dashboard:unit` for the Zustand store/history unit tests and
+`npm run test:dashboard` for those tests plus the real Chromium dashboard
+regression. The browser regression runs real local browser flows, then replays
+their worker events over WebSocket into the built dashboard. It also supplies
+explicit API-only/background-event fixtures. No live Cloud is required.
+
+### Local cURL debugging
+
+The interactive local dashboard keeps its cURL preview [REDACTED]. Copy raw cURL
+uses the original request held separately in local memory, including its headers
+and body. Other log fields stay redacted. Native CI and Cloud reporting continue redacting cURL and
+credentials. Raw cURL is not restored for already-redacted historical runs.
+The interactive runner binds to 127.0.0.1 and restricts HTTP Host/Origin and
+WebSocket Origin to its own loopback address and port. Raw commands remain in
+local debugger memory and IPC; they are not written to CI or Cloud reports.

package/README.md

@@ -6,34 +6,6 @@ Flowstride OS combines the human-readable structure of Behavior-Driven Developme
 
 [Documentation](https://docs.flowstride.io/)
 
-## Native CI and game testing preview — 1.0.20-rc.2
-
-This is an opt-in preview intended for the npm `next` tag. The default stable
-release remains available through `latest`. After the preview is published:
-
-```sh
-npm install --save-dev flowstride@next
-npx --no-install flowstride install
-npx --no-install flowstride run --ci
-```
-
-Node.js 22.12.0+ is required; acceptance covers the minimum version and current
-Node.js 22/24 on Linux, plus Node.js 24 on macOS. The preview adds native CI
-exit codes, JSON/JUnit reports, videos/screenshots, device profiles, explicit
-GitHub workflow generation, and supported canvas/Three.js testing APIs.
-See [native CI setup](NATIVE_CI.md) and [release notes](RELEASE_NOTES.md).
-
-For this preview, use OSS alone or manually install the matching private Pro
-`1.0.15-rc.1` candidate after project dependencies. Normal Cloud login still
-serves Pro `1.0.14`; signing in afterward can replace the preview's Pro package,
-and that older CLI does not support the new native commands. Cloud reporting
-and video-storage defects remain open. Native CI keeps Cloud reporting off by
-default. Managed Cloud execution remains retired.
-
-This release qualifies Chromium desktop and emulated phone/landscape profiles
-and browser-game fixtures. It does not establish physical-phone, Safari,
-Firefox, other game-engine, or complete application-game coverage.
-
 ---
 
 ## Why Flowstride?
@@ -49,7 +21,7 @@ Traditional E2E frameworks force you to choose between highly technical code (wh
 
 ## Installation & Quick Start
 
-Flowstride requires Node.js 22.12.0 or higher. Use a current patched Node.js 22 or 24 release.
+Flowstride requires Node.js 18 or higher.
 
 **1. Install globally (or as a dev dependency in your project):**
 
@@ -99,20 +71,41 @@ npx flowstride login
 
 ---
 
-## Execution data and Cloud integration
+## Privacy & Data Security
+
+Flowstride is designed with a **zero-trust, local-first architecture**. Whether you are testing internal microservices, staging environments, or production APIs, your sensitive data, PHI, and credentials remain strictly on your infrastructure.
+
+### Open Source Core: 100% Local Isolation
+
+The Open Source version of Flowstride operates entirely as an ephemeral, local execution engine.
+
+- **Air-Gapped Execution:** Flowstride does not "phone home." The OS runner executes strictly on your local machine or within your private CI/CD pipeline. There is no external Flowstride database storing your test payloads or network logs.
+
+- **Ephemeral Memory:** Flowstride is inherently stateless. API request headers, response bodies, and DOM snapshots exist only in Node.js RAM during execution. The millisecond the execution process terminates, all memory is wiped.
+
+- **The DevTools Analogy:** Our network interception works natively within Playwright's browser context routing. It is fundamentally identical to opening the Chrome DevTools "Network" tab locally. We do not act as an external Man-In-The-Middle (MITM) proxy.
+
+- **Opt-In Local State:** Artifacts saved to disk—such as execution videos (`.flowstride/mock-cloud/`) or explicitly persisted browser states (`.flowstride/sessions/`)—are written strictly to your local file system to mirror the functionality of tools like Postman. _(Note: We strongly recommend adding `.flowstride/` to your `.gitignore` to prevent accidental credential commits)._
+
+### Flowstride Enterprise: Secure Cloud Telemetry
+
+For teams using Flowstride Enterprise to aggregate multi-flow metrics, we maintain a strict metadata-only boundary.
+
+- **Metadata, Not Payloads:** When cloud sync is active, Flowstride routes only execution metadata to your team's dashboard (e.g., Workspace ID, execution duration, total steps, and pass/fail tallies). **Zero bytes** of request headers, bearer tokens, or JSON bodies are ever transmitted to Flowstride Cloud.
+
+- **Deep Debugging Stays Local:** The rich, interactive visual dashboard, including the JSON explorer and API Replay tools, runs on a dynamic, locally bound port on your machine. You get the UI of a modern cloud app with the security of a local binary.
+
+### CI/CD Leak Protection & Terminal Hygiene
+
+Standard testing frameworks do dump failing API requests, and response bodies directly into the terminal so developers can debug them. In a CI/CD environment, this is a massive security liability, as those secrets are permanently burned into plaintext Jenkins, GitHub Actions, or GitLab CI logs.
+
+Flowstride completely neutralizes this threat by architecturally separating execution output from diagnostic telemetry:
 
-Tests run on your machine or CI runner. Native CI writes reports, screenshots,
-videos and attachments to the configured local artifact directory. Interactive
-API diagnostics are available in the local dashboard. These outputs can contain
-application data or credentials; automatic redaction is not guaranteed.
+1. **Clean Standard Output (`stdout`):** Flowstride's terminal output only displays high-level, human-readable BDD execution steps (e.g., `✔ Given "User lands on home page"` or `✖ Action Failed`). No JSON request bodies, `cURL` strings, or bearer tokens are ever printed to the terminal console.
 
-Cloud login/licensing, FlowMail OTP retrieval and explicitly enabled Cloud
-reporting contact their configured services. Native CI leaves Cloud reporting
-off unless `cloudSync: true` is explicitly configured. Existing Cloud reporting
-and storage limitations remain documented in the preview release notes.
+2. **WebSocket Isolation:** All sensitive raw network data (payloads, headers, and responses) is emitted _exclusively_ over a secure, ephemeral WebSocket connection directly to the developer's local UI dashboard.
 
-Use test credentials, keep runtime state and artifacts out of source control,
-and choose CI artifact access and retention appropriate to the test data.
+3. **Total Evaporation:** Because CI/CD runners only capture `stdout` text and do not connect to local WebSockets, your highly sensitive diagnostic data simply evaporates the moment the pipeline execution ends. Your pipeline logs remain 100% free of plaintext secrets.
 
 ---
 

package/dist/adapters/web/playwright.js

@@ -37,6 +37,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.WebAdapter = void 0;
+const projectPaths_1 = require("../../utils/projectPaths");
 const playwright_1 = require("playwright");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
@@ -81,7 +82,7 @@ class WebAdapter {
             ...(this.config.ci ? { handleSIGINT: false, handleSIGTERM: false } : {}),
             args: launchArgs,
         });
-        const videoDir = path.join(process.cwd(), ".flowstride", "videos");
+        const videoDir = (0, projectPaths_1.projectPath)(process.cwd(), path.join('.flowstride', 'videos'));
         if (!fs.existsSync(videoDir))
             fs.mkdirSync(videoDir, { recursive: true });
         const profile = this.config.device === 'phone' || this.config.device === 'landscape'
@@ -125,7 +126,7 @@ class WebAdapter {
         };
     }
     async injectAudio(filePath) {
-        const absolutePath = path.resolve(process.cwd(), filePath);
+        const absolutePath = (0, projectPaths_1.projectPath)(process.cwd(), filePath);
         if (!fs.existsSync(absolutePath)) {
             throw new Error(`Audio file not found at: ${absolutePath}`);
         }
@@ -274,7 +275,8 @@ class WebAdapter {
         });
     }
     synthesizeCurl(method, url, headers, postData) {
-        let curl = `curl -X ${method.toUpperCase()} '${url}'`;
+        const safeUrl = url.replace(/'/g, "'\\''");
+        let curl = `curl -X ${method.toUpperCase()} '${safeUrl}'`;
         for (const [key, value] of Object.entries(headers)) {
             if (key.startsWith(":"))
                 continue;
@@ -614,7 +616,7 @@ class WebAdapter {
         const targetLoc = await this.checkAmbiguity(loc, selector);
         await targetLoc.waitFor({ state: "visible" });
         await targetLoc.scrollIntoViewIfNeeded();
-        const absolutePath = path.resolve(process.cwd(), filePath);
+        const absolutePath = (0, projectPaths_1.projectPath)(process.cwd(), filePath);
         if (!fs.existsSync(absolutePath)) {
             throw new Error(`File Upload Error: Could not find the file at "${absolutePath}". Please ensure the file exists in your project directory.`);
         }

package/dist/ci/config.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isCIEnvironment = isCIEnvironment;
 exports.loadNativeConfig = loadNativeConfig;
+const projectPaths_1 = require("../utils/projectPaths");
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 function isCIEnvironment() {
@@ -12,7 +13,7 @@ function isCIEnvironment() {
         .some(key => !!process.env[key] && process.env[key] !== 'false' && process.env[key] !== '0');
 }
 function loadNativeConfig(root, options) {
-    const file = node_path_1.default.join(root, options.config || 'flowstride.config.json');
+    const file = (0, projectPaths_1.projectPath)(root, options.config || 'flowstride.config.json');
     let input = {};
     if (node_fs_1.default.existsSync(file)) {
         input = JSON.parse(node_fs_1.default.readFileSync(file, 'utf8'));
@@ -21,8 +22,8 @@ function loadNativeConfig(root, options) {
     }
     else if (options.config)
         throw new Error(`Configuration not found: ${file}`);
-    const config = { ...input, timeout: input.timeout ?? 30000, headless: input.headless ?? true,
-        ci: !!options.ci || isCIEnvironment(), device: options.device ?? input.device ?? 'desktop',
+    const config = { ...input, projectRoot: node_path_1.default.resolve(root), timeout: input.timeout ?? 30000, headless: input.headless ?? true,
+        ci: !!options.ci || isCIEnvironment(), bail: options.bail || input.bail || false, device: options.device ?? input.device ?? 'desktop',
         artifactsDir: input.artifactsDir ?? 'flowstride-artifacts', testDir: input.testDir ?? 'flows',
         defaultDialogBehavior: input.defaultDialogBehavior ?? 'dismiss',
         recordVideo: input.recordVideo ?? true, browserErrors: input.browserErrors ?? 'fail',
@@ -50,7 +51,7 @@ function loadNativeConfig(root, options) {
             continue;
         if (typeof config[key] !== 'string' || !config[key].trim())
             throw new Error(`${key} must be a nonempty path.`);
-        const resolved = node_path_1.default.resolve(root, config[key]);
+        const resolved = (0, projectPaths_1.projectPath)(root, config[key]);
         const relative = node_path_1.default.relative(root, resolved);
         if ((key === 'artifactsDir' && !relative) || relative === '..' || relative.startsWith(`..${node_path_1.default.sep}`) || node_path_1.default.isAbsolute(relative))
             throw new Error(`${key} must be a directory inside the project.`);
@@ -67,7 +68,7 @@ function loadNativeConfig(root, options) {
             throw new Error('webServer readiness URL must use local HTTP(S).');
         if (server.timeout !== undefined && (!Number.isSafeInteger(server.timeout) || server.timeout < 1))
             throw new Error('webServer.timeout must be positive.');
-        server.cwd = node_path_1.default.resolve(root, server.cwd || '.');
+        server.cwd = (0, projectPaths_1.projectPath)(root, server.cwd || '.');
         const relative = node_path_1.default.relative(root, server.cwd);
         if (relative === '..' || relative.startsWith(`..${node_path_1.default.sep}`) || node_path_1.default.isAbsolute(relative))
             throw new Error('webServer.cwd must be inside the project.');

package/dist/ci/runtime.js

@@ -4,19 +4,15 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runNativeCI = runNativeCI;
+const node_crypto_1 = require("node:crypto");
+const projectPaths_1 = require("../utils/projectPaths");
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const node_child_process_1 = require("node:child_process");
 const promises_1 = require("node:timers/promises");
 const lexer_1 = require("../parser/lexer");
 const parser_1 = require("../parser/parser");
-function listFlows(target) {
-    const stat = node_fs_1.default.statSync(target);
-    if (stat.isFile())
-        return target.endsWith('.flow') ? [target] : [];
-    return node_fs_1.default.readdirSync(target).filter(name => name.endsWith('.flow')).sort().map(name => node_path_1.default.join(target, name));
-}
-function safeName(name) { return name.replace(/[^a-zA-Z0-9_.-]/g, '_').slice(0, 150); }
+function safeName(name) { return name.replace(/[^a-zA-Z0-9_.-]/g, '_').slice(0, 120) + '-' + (0, node_crypto_1.createHash)('sha256').update(name).digest('hex').slice(0, 12); }
 function xml(value) { return String(value).replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '').replace(/[<>&"']/g, char => ({ '<': '&lt;', '>': '&gt;', '&': '&amp;', '"': '&quot;', "'": '&apos;' }[char])); }
 async function runNativeCI(worker, orchestrator, target, config, engine) {
     const started = Date.now();
@@ -27,6 +23,8 @@ async function runNativeCI(worker, orchestrator, target, config, engine) {
     const steps = new Map();
     const completed = new Set();
     const errors = [];
+    const planned = new Map();
+    let bailed = false;
     let expected = 0;
     let files = [];
     let server;
@@ -36,6 +34,8 @@ async function runNativeCI(worker, orchestrator, target, config, engine) {
         if (!data?.payload)
             return;
         const p = data.payload;
+        if (data.type === 'BAIL')
+            bailed = true;
         if (data.type === 'LOG_EVENT' && p.status === 'error') {
             const active = [...steps.values()].reverse().find(step => step.fileName === p.fileName && step.status === 'running');
             if (active)
@@ -56,6 +56,8 @@ async function runNativeCI(worker, orchestrator, target, config, engine) {
             errors.push(`${p.fileName}: ${p.error || 'Execution failed'}`);
         if (data.type === 'BROWSER_ERROR' && config.browserErrors !== 'record')
             errors.push(`Browser: ${p.message}`);
+        if (data.type === 'CLOUD_SYNC')
+            config.cloudSyncResult = p;
         if (data.type === 'WORKER_ERROR')
             errors.push(p.message || 'Worker failed');
     };
@@ -67,11 +69,18 @@ async function runNativeCI(worker, orchestrator, target, config, engine) {
     process.on('SIGINT', interrupt);
     process.on('SIGTERM', interrupt);
     try {
-        files = listFlows(target);
+        files = (0, projectPaths_1.discoverFlows)(target, config.projectRoot || process.cwd());
+        config.flowRoot = node_fs_1.default.statSync(target).isDirectory() ? target : node_path_1.default.dirname(target);
         if (!files.length)
             throw new Error('No .flow tests found.');
         for (const file of files) {
-            const features = new parser_1.Parser(new lexer_1.Lexer(node_fs_1.default.readFileSync(file, 'utf8')).tokenise()).parse();
+            const features = (0, projectPaths_1.selectedFeatures)(new parser_1.Parser(new lexer_1.Lexer(node_fs_1.default.readFileSync(file, 'utf8')).tokenise()).parse());
+            for (const feature of features)
+                for (const scenario of feature.scenarios)
+                    for (const step of scenario.steps) {
+                        const fileName = (0, projectPaths_1.flowIdentity)(file, config.flowRoot);
+                        planned.set(`${fileName}:${step.id}`, { id: step.id, description: step.blockDescription, command: step.action, fileName, status: 'skipped', reason: 'bail' });
+                    }
             expected += features.reduce((n, feature) => n + feature.scenarios.reduce((m, scenario) => m + scenario.steps.length, 0), 0);
         }
         if (!expected)
@@ -150,26 +159,30 @@ async function runNativeCI(worker, orchestrator, target, config, engine) {
     }
     if (interrupted)
         errors.push('Run interrupted.');
+    if (bailed)
+        for (const [key, step] of planned)
+            if (!steps.has(key))
+                steps.set(key, step);
     const results = [...steps.values()];
     const terminal = results.filter(step => ['passed', 'failed', 'skipped', 'not_tested'].includes(step.status));
     const incomplete = Math.max(0, expected - terminal.length);
     for (const file of files)
-        if (!completed.has(node_path_1.default.basename(file)))
-            errors.push(`Incomplete file: ${node_path_1.default.basename(file)}`);
+        if (!bailed && !completed.has((0, projectPaths_1.flowIdentity)(file, config.flowRoot)))
+            errors.push(`Incomplete file: ${(0, projectPaths_1.flowIdentity)(file, config.flowRoot)}`);
     if (results.some(step => !['passed', 'failed', 'skipped', 'not_tested'].includes(step.status)))
         errors.push('Unfinished test steps.');
     if (terminal.length > expected)
         errors.push('Engine produced an unexpected step count.');
     const metrics = { total: expected, passed: results.filter(s => s.status === 'passed').length,
         failed: results.filter(s => s.status === 'failed').length, skipped: results.filter(s => ['skipped', 'not_tested'].includes(s.status)).length, incomplete };
-    const result = { protocol: 1, engine, status: interrupted ? 'interrupted' : errors.length || metrics.failed || incomplete ? 'failed' : 'passed',
-        duration: Date.now() - started, artifactsDir: directory, files: files.map(file => node_path_1.default.basename(file)), steps: results, errors, metrics };
+    const result = { cloudSync: config.cloudSyncResult, protocol: 1, engine, status: interrupted ? 'interrupted' : errors.length || metrics.failed || incomplete ? 'failed' : 'passed',
+        duration: Date.now() - started, artifactsDir: directory, files: files.map(file => (0, projectPaths_1.flowIdentity)(file, config.flowRoot)), steps: results, errors, metrics };
     // Existing workers finalize videos into these locations. Copy only run files,
     // never the project directory or credentials.
     if (config.recordVideo !== false)
         for (const file of files) {
             for (const folder of ['artifacts', 'mock-cloud']) {
-                const video = node_path_1.default.join(process.cwd(), '.flowstride', folder, node_path_1.default.basename(file, '.flow') + '.webm');
+                const video = node_path_1.default.join(process.cwd(), '.flowstride', folder, (0, projectPaths_1.videoFileName)((0, projectPaths_1.flowIdentity)(file, config.flowRoot)));
                 if (node_fs_1.default.existsSync(video) && node_fs_1.default.statSync(video).mtimeMs >= started) {
                     node_fs_1.default.copyFileSync(video, node_path_1.default.join(directory, node_path_1.default.basename(video)));
                     break;

package/dist/cli/commands/run.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runAction = runAction;
+const projectPaths_1 = require("../../utils/projectPaths");
 const config_1 = require("../../ci/config");
 const runtime_1 = require("../../ci/runtime");
 const fs = __importStar(require("fs"));
@@ -53,7 +54,7 @@ const api_proxy_1 = require("../../sdk/api_proxy");
 async function runAction(targetPath, options) {
     const root = process.cwd();
     const profileEnvPath = options.env
-        ? path.resolve(root, `.env.${options.env}`)
+        ? (0, projectPaths_1.projectPath)(root, `.env.${options.env}`)
         : null;
     const defaultEnvPath = path.resolve(root, ".env");
     if (profileEnvPath) {

package/dist/cli/index.js

@@ -37,6 +37,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+const cloud_1 = require("../utils/cloud");
+const cloudSession_1 = require("./utils/cloudSession");
 const config_1 = require("../ci/config");
 const init_1 = require("../ci/init");
 const commander_1 = require("commander");
@@ -47,16 +49,21 @@ const open_1 = require("./commands/open");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
-const child_process_1 = require("child_process");
+const proInstaller_1 = require("./utils/proInstaller");
 const prompts_1 = require("@inquirer/prompts");
 const chalk_1 = __importDefault(require("chalk"));
 const ora_1 = __importDefault(require("ora"));
 const program = new commander_1.Command();
-const API_BASE = process.env.FLOWSTRIDE_API_URL || "https://cloud.flowstride.io";
+program.hook('preAction', (_program, command) => {
+    if (['login', 'status', 'run', 'update'].includes(command.name())) {
+        API_BASE = (0, cloudSession_1.loadCloudEnvironment)(process.cwd(), command.opts().env);
+    }
+});
+let API_BASE = (0, cloud_1.cloudApiBase)(process.env);
 program
     .name("flowstride")
     .description("Flowstride: The Enterprise Flow-First Automation CLI")
-    .version("1.0.20-rc.2");
+    .version("1.0.20-rc.6");
 program
     .command("init")
     .description("Initialise a new Flowstride workspace in the current directory")
@@ -101,6 +108,7 @@ program
         console.error(chalk_1.default.red("✖ Error: A valid Developer Token is required."));
         process.exit(1);
     }
+    console.log(`[Cloud]: ${API_BASE}; login credential source: ${process.env.FLOWSTRIDE_TOKEN ? 'FLOWSTRIDE_TOKEN (environment)' : options.token ? '--token option' : 'interactive prompt'}`);
     const deviceName = os.hostname();
     const spinner = (0, ora_1.default)("Authenticating with Cloud...").start();
     try {
@@ -114,10 +122,11 @@ program
         });
         const data = await response.json();
         if (!response.ok) {
-            spinner.fail(chalk_1.default.red(`Authentication Failed: ${data.error || "Invalid token or network error"}`));
+            spinner.fail(chalk_1.default.red(`Authentication Failed: ${(0, cloud_1.cloudFailure)({ response: { status: response.status, data } }, [token.trim()]).message}`));
             process.exit(1);
         }
         spinner.succeed(chalk_1.default.green("Authentication Successful!"));
+        console.log((0, cloudSession_1.tokenExpiryDescription)(data));
         const configDir = options.global
             ? path.join(os.homedir(), ".flowstride")
             : path.join(process.cwd(), ".flowstride");
@@ -146,42 +155,14 @@ program
                 }
                 if (installPro) {
                     const installSpinner = (0, ora_1.default)("Downloading Enterprise Engine via secure proxy...").start();
-                    const tarballPath = path.join(process.cwd(), "flowstride-pro.tgz");
                     try {
-                        const tarballResponse = await fetch(`${API_BASE}/api/workspace/download-pro`, {
-                            method: "GET",
-                            headers: { Authorization: `Bearer ${token.trim()}` },
-                        });
-                        if (!tarballResponse.ok) {
-                            throw new Error(`Secure proxy rejected request: ${tarballResponse.statusText}`);
-                        }
-                        const buffer = await tarballResponse.arrayBuffer();
-                        fs.writeFileSync(tarballPath, Buffer.from(buffer));
-                        installSpinner.text = "Wiring up Enterprise dependencies...";
-                        installSpinner.color = "cyan";
-                        // Let npm natively handle the extraction and binary symlinking
-                        (0, child_process_1.execSync)(`npm install "${tarballPath}" --no-save`, {
-                            cwd: process.cwd(),
-                            stdio: "ignore",
-                        });
+                        await (0, proInstaller_1.installProEngine)(API_BASE, token.trim());
                         installSpinner.succeed(chalk_1.default.green("Enterprise Engine installed successfully!"));
                     }
-                    catch (installError) {
-                        installSpinner.stop();
-                        console.error(chalk_1.default.bgRed.white("\n[RAW SYSTEM ERROR]:"), installError);
-                        console.log(chalk_1.default.red("\n✖ Failed to install the Enterprise Engine. Please check your internet connection or verify your project configuration."));
-                        if (fs.existsSync(nodeModulesPath)) {
-                            fs.rmSync(nodeModulesPath, { recursive: true, force: true });
-                        }
-                        console.log(chalk_1.default.yellow("⚠️ Reverting login: Enterprise Engine is required to sync."));
-                        if (fs.existsSync(credentialsPath))
-                            fs.unlinkSync(credentialsPath);
-                        process.exit(1);
-                    }
-                    finally {
-                        if (fs.existsSync(tarballPath)) {
-                            fs.unlinkSync(tarballPath);
-                        }
+                    catch (error) {
+                        installSpinner.fail(error instanceof Error ? error.message : "Enterprise installation failed");
+                        console.log(chalk_1.default.yellow("Credentials remain available. You can retry installation; runs can fall back to the Open Source engine."));
+                        process.exitCode = 1;
                     }
                 }
                 else {
@@ -196,7 +177,7 @@ program
         console.log(chalk_1.default.bold.green(`\n✅ Machine synchronized with Flowstride Enterprise.`));
     }
     catch (error) {
-        spinner.fail(chalk_1.default.red(`Network Error: Could not connect to cloud.flowstride.io`));
+        spinner.fail(chalk_1.default.red((0, cloud_1.cloudFailure)(error, [token.trim()]).message));
         process.exit(1);
     }
 });
@@ -204,7 +185,8 @@ program
     .command("status")
     .description("Display the current Flowstride CLI authentication and engine tier")
     .action(async () => {
-    let token = process.env.FLOWSTRIDE_TOKEN || null;
+    console.log((0, cloudSession_1.cloudSessionDescription)(API_BASE));
+    let token = process.env.FLOWSTRIDE_TOKEN?.trim() || null;
     const localCredentialsPath = path.join(process.cwd(), ".flowstride", "credentials.json");
     const globalCredentialsPath = path.join(os.homedir(), ".flowstride", "credentials.json");
     let activeCredentialsPath = localCredentialsPath; // Default for cleanup
@@ -213,7 +195,7 @@ program
             activeCredentialsPath = localCredentialsPath;
             try {
                 const credentials = JSON.parse(fs.readFileSync(localCredentialsPath, "utf8"));
-                token = credentials.machineToken;
+                token = credentials.machineToken?.trim() || null;
             }
             catch (err) { }
         }
@@ -221,7 +203,7 @@ program
             activeCredentialsPath = globalCredentialsPath;
             try {
                 const credentials = JSON.parse(fs.readFileSync(globalCredentialsPath, "utf8"));
-                token = credentials.machineToken;
+                token = credentials.machineToken?.trim() || null;
             }
             catch (err) { }
         }
@@ -243,9 +225,10 @@ program
             method: "GET",
             headers: { Authorization: `Bearer ${token}` },
         });
-        if (response.status === 401) {
-            console.log(chalk_1.default.red("🔴 AUTH EXPIRED: Your device session was revoked or expired."));
-            if (fs.existsSync(activeCredentialsPath))
+        if (response.status === 401 || response.status === 403) {
+            const failureData = await response.json().catch(() => ({}));
+            console.log(chalk_1.default.red((0, cloud_1.cloudFailure)({ response: { status: response.status, data: failureData } }, [token]).message));
+            if (response.status === 401 && !process.env.FLOWSTRIDE_TOKEN && fs.existsSync(activeCredentialsPath))
                 fs.unlinkSync(activeCredentialsPath);
         }
         else if (response.ok) {
@@ -284,7 +267,8 @@ program
     }
     if (options.ci)
         process.env.FLOWSTRIDE_NATIVE_CI = '1';
-    let token = process.env.FLOWSTRIDE_TOKEN || null;
+    console.log((0, cloudSession_1.cloudSessionDescription)(API_BASE));
+    let token = process.env.FLOWSTRIDE_TOKEN?.trim() || null;
     let forceOS = false;
     const localCredentialsPath = path.join(process.cwd(), ".flowstride", "credentials.json");
     const globalCredentialsPath = path.join(os.homedir(), ".flowstride", "credentials.json");
@@ -294,7 +278,7 @@ program
             activeCredentialsPath = localCredentialsPath;
             try {
                 const credentials = JSON.parse(fs.readFileSync(localCredentialsPath, "utf8"));
-                token = credentials.machineToken;
+                token = credentials.machineToken?.trim() || null;
             }
             catch (err) { }
         }
@@ -302,7 +286,7 @@ program
             activeCredentialsPath = globalCredentialsPath;
             try {
                 const credentials = JSON.parse(fs.readFileSync(globalCredentialsPath, "utf8"));
-                token = credentials.machineToken;
+                token = credentials.machineToken?.trim() || null;
             }
             catch (err) { }
         }
@@ -325,9 +309,10 @@ program
                 method: "GET",
                 headers: { Authorization: `Bearer ${token}` },
             });
-            if (response.status === 401) {
-                console.log(chalk_1.default.red("🔴 AUTH EXPIRED: Your device session was revoked or expired."));
-                if (fs.existsSync(activeCredentialsPath))
+            if (response.status === 401 || response.status === 403) {
+                const failureData = await response.json().catch(() => ({}));
+                console.log(chalk_1.default.red((0, cloud_1.cloudFailure)({ response: { status: response.status, data: failureData } }, [token]).message));
+                if (response.status === 401 && !process.env.FLOWSTRIDE_TOKEN && fs.existsSync(activeCredentialsPath))
                     fs.unlinkSync(activeCredentialsPath);
                 forceOS = true;
             }