flowstride 1.0.20-rc.2 → 1.0.20

package/dist/manual/security.js

@@ -0,0 +1,106 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ManualInputError = exports.manualCanvasSchema = exports.manualRunSchema = void 0;
+exports.sanitizeManualHtml = sanitizeManualHtml;
+exports.sanitizeStoredCanvas = sanitizeStoredCanvas;
+exports.readManualPayload = readManualPayload;
+const sanitize_html_1 = __importDefault(require("sanitize-html"));
+const zod_1 = require("zod");
+const MANUAL_HTML_TAGS = ["b", "i", "em", "strong", "a", "ul", "ol", "li", "br", "div", "p", "font"];
+function sanitizeManualHtml(value) {
+    return (0, sanitize_html_1.default)(typeof value === "string" ? value : "", {
+        allowedTags: MANUAL_HTML_TAGS,
+        allowedAttributes: { a: ["href", "target", "rel"], font: ["size"] },
+        allowedSchemes: ["http", "https", "mailto"], allowProtocolRelative: false,
+        transformTags: { a: (tagName, attribs) => ({ tagName, attribs: {
+                    ...attribs, target: attribs.target === "_blank" ? "_blank" : "_self", rel: "noopener noreferrer",
+                } }) },
+    });
+}
+const label = zod_1.z.string().max(2000);
+const rich = zod_1.z.string().max(100000).transform(sanitizeManualHtml);
+const numeric = zod_1.z.number().finite();
+const media = zod_1.z.string().max(8192).refine(value => !value || /^(https?:\/\/|\/(?!\/))[^\s\\]*$/i.test(value), "Invalid media URL");
+const nodeFields = {
+    id: zod_1.z.number().int().nonnegative(), title: label.optional(), visual_step: label.optional(),
+    description: rich.optional(), steps: rich.optional(), expected_result: rich.optional(), references: rich.optional(),
+    defect_report: rich.optional(), defect_media: media.optional(), assigned_to: label.optional(), priority: label.optional(),
+    x: numeric.optional(), y: numeric.optional(), width: numeric.optional(), height: numeric.optional(), is_active: zod_1.z.boolean().optional(),
+};
+const node = zod_1.z.looseObject(nodeFields);
+const step = zod_1.z.looseObject({ ...nodeFields, status: zod_1.z.enum(["Pending", "Current", "Passed", "Failed", "Blocked", "Skipped", "Pass", "Fail", "Success", "passed", "failed", "pass", "fail", "success", "pending", "skipped", "blocked"]), group_title: label.optional() });
+const group = zod_1.z.looseObject({ id: zod_1.z.number().int().nonnegative(), title: label.optional(), x: numeric.optional(), y: numeric.optional(), width: numeric.optional(), height: numeric.optional(), is_active: zod_1.z.boolean().optional() });
+const text = zod_1.z.looseObject({ id: zod_1.z.number().int().nonnegative(), content: label.optional(), x: numeric.optional(), y: numeric.optional(), width: numeric.optional(), height: numeric.optional(), is_active: zod_1.z.boolean().optional() });
+const connection = zod_1.z.looseObject({ id: zod_1.z.number().int().nonnegative() });
+exports.manualRunSchema = zod_1.z.object({
+    name: zod_1.z.string().trim().min(1).max(255),
+    status: zod_1.z.enum(["PASS", "FAIL", "INCOMPLETE", "NO STEPS"]),
+    metrics: zod_1.z.object({ total: zod_1.z.number().int().nonnegative(), passed: zod_1.z.number().int().nonnegative(), failed: zod_1.z.number().int().nonnegative(), pending: zod_1.z.number().int().nonnegative() }).refine(m => m.total === m.passed + m.failed + m.pending, "Inconsistent metrics"),
+    canvasData: zod_1.z.looseObject({ nodes: zod_1.z.array(node).max(10000).default([]), groups: zod_1.z.array(group).max(10000).default([]), texts: zod_1.z.array(text).max(10000).default([]), connections: zod_1.z.array(connection).max(20000).default([]), executionReport: zod_1.z.array(step).max(10000).default([]), metadata: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).optional() }),
+});
+// Sanitize older records without trusting their original ingestion path.
+function sanitizeStoredCanvas(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return {};
+    const canvas = { ...value };
+    for (const key of ["nodes", "executionReport"]) {
+        if (!Array.isArray(canvas[key])) {
+            canvas[key] = [];
+            continue;
+        }
+        canvas[key] = canvas[key].filter(item => item && typeof item === "object").map(item => {
+            const result = { ...item };
+            for (const field of ["description", "steps", "expected_result", "references", "defect_report"]) {
+                if (field in result)
+                    result[field] = sanitizeManualHtml(result[field]);
+            }
+            return result;
+        });
+    }
+    return canvas;
+}
+exports.manualCanvasSchema = exports.manualRunSchema.shape.canvasData;
+class ManualInputError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+exports.ManualInputError = ManualInputError;
+async function readManualPayload(req) {
+    const limit = 2 * 1024 * 1024;
+    const length = req.headers["content-length"];
+    if (length && (!/^\d+$/.test(length) || !Number.isSafeInteger(Number(length))))
+        throw new ManualInputError(400, "Invalid request length");
+    if (length && Number(length) > limit)
+        throw new ManualInputError(413, "Manual payload exceeds 2 MiB");
+    const buffer = Buffer.allocUnsafe(length ? Number(length) : limit);
+    let bytes = 0;
+    for await (const chunk of req.iterator({ destroyOnReturn: false })) {
+        bytes += chunk.length;
+        if (bytes > limit || (length && bytes > Number(length))) {
+            req.resume();
+            throw new ManualInputError(413, "Manual payload exceeds allowed size");
+        }
+        buffer.set(chunk, bytes - chunk.length);
+    }
+    if (length && bytes !== Number(length))
+        throw new ManualInputError(400, "Request length mismatch");
+    let payload;
+    try {
+        payload = JSON.parse(buffer.subarray(0, bytes).toString("utf8"));
+    }
+    catch {
+        throw new ManualInputError(400, "Invalid manual JSON");
+    }
+    if (!payload || typeof payload !== "object" || Array.isArray(payload))
+        throw new ManualInputError(400, "Invalid manual payload");
+    const canvas = exports.manualCanvasSchema.safeParse(payload.canvasData);
+    if (!canvas.success)
+        throw new ManualInputError(400, "Invalid manual canvas");
+    return { ...payload, canvasData: canvas.data };
+}

package/dist/runner/data_generators.d.ts

@@ -3,6 +3,7 @@ export declare class DataGenerators {
     private runIdContext;
     private workerIdContext;
     constructor(runId?: string, workerId?: string);
+    sensitiveValues(): string[];
     resolve(template: string): string;
     private pickRandom;
     uuid: () => `${string}-${string}-${string}-${string}-${string}`;

package/dist/runner/data_generators.js

@@ -19,6 +19,9 @@ class DataGenerators {
         this.runIdContext = runId;
         this.workerIdContext = workerId;
     }
+    sensitiveValues() {
+        return [...this.memoryBank.entries()].filter(([key]) => /password|passcode|token|otp|pin|secret/i.test(key)).map(([, value]) => value);
+    }
     resolve(template) {
         if (!template || typeof template !== "string")
             return template;

package/dist/runner/dom_stripper.js

@@ -44,6 +44,9 @@ class DOMStripper {
                         el.removeAttribute("src");
                     }
                 });
+                clone.querySelectorAll('input').forEach(input => input.removeAttribute('value'));
+                clone.querySelectorAll('textarea').forEach(input => { input.textContent = '[REDACTED]'; });
+                clone.querySelectorAll('[contenteditable]').forEach(input => { input.textContent = '[REDACTED]'; });
                 let rawHtml = clone.outerHTML;
                 rawHtml = rawHtml.replace(/[\n\r\t]+/g, " ");
                 rawHtml = rawHtml.replace(/\s{2,}/g, " ");

package/dist/runner/flow_orchestrator.js

@@ -37,6 +37,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FlowOrchestrator = void 0;
+const localDashboard_1 = require("../security/localDashboard");
+const projectPaths_1 = require("../utils/projectPaths");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const http = __importStar(require("http"));
@@ -76,25 +78,9 @@ class FlowOrchestrator {
     }
     async executeTestRun(targetPath) {
         this.forwardToDashboard("SUITE_START", {});
-        let filesToProcess = [];
-        const stats = fs.statSync(targetPath);
-        if (stats.isDirectory()) {
-            const allFlowFiles = fs
-                .readdirSync(targetPath)
-                .filter((f) => f.endsWith(".flow"));
-            const priorityQueue = allFlowFiles
-                .filter((f) => f.endsWith(".first.flow"))
-                .sort()
-                .map((f) => path.join(targetPath, f));
-            const standardQueue = allFlowFiles
-                .filter((f) => !f.endsWith(".first.flow"))
-                .sort()
-                .map((f) => path.join(targetPath, f));
-            filesToProcess = [...priorityQueue, ...standardQueue];
-        }
-        else {
-            filesToProcess = [targetPath];
-        }
+        const filesToProcess = (0, projectPaths_1.discoverFlows)(targetPath);
+        if (this.config)
+            this.config.flowRoot = fs.statSync(targetPath).isDirectory() ? targetPath : path.dirname(targetPath);
         this.globalTestScenarios = [];
         this.stepStatusRegistry.clear();
         if (this.workerCount > 1) {
@@ -123,7 +109,12 @@ class FlowOrchestrator {
             if (this.config?.ci)
                 return await this.executeTestRun(targetPath);
             this.httpServer = http.createServer((req, res) => {
-                res.setHeader("Access-Control-Allow-Origin", "*");
+                if (!(0, localDashboard_1.isLocalDashboardRequest)(req.headers.host, req.headers.origin)) {
+                    res.writeHead(403);
+                    res.end('Forbidden');
+                    return;
+                }
+                res.setHeader('Cross-Origin-Resource-Policy', 'same-origin');
                 if (req.url && req.url.startsWith("/videos/")) {
                     let urlObj;
                     try {
@@ -236,7 +227,7 @@ class FlowOrchestrator {
                 console.error(chalk_1.default.red(`\n[Error]: Failed to start local server: ${e.message}`));
                 process.exit(1);
             });
-            this.wss = new ws_1.WebSocketServer({ server: this.httpServer });
+            this.wss = new ws_1.WebSocketServer({ server: this.httpServer, verifyClient: (info) => Boolean(info.origin) && (0, localDashboard_1.isLocalDashboardRequest)(info.req.headers.host, info.origin) });
             this.wss.on("connection", (ws) => {
                 if (this.disconnectTimer) {
                     clearTimeout(this.disconnectTimer);
@@ -292,7 +283,7 @@ class FlowOrchestrator {
                 });
             });
             return new Promise((resolve, reject) => {
-                this.httpServer.listen(0, async () => {
+                this.httpServer.listen(0, '127.0.0.1', async () => {
                     try {
                         const address = this.httpServer?.address();
                         const port = typeof address === "object" && address !== null

package/dist/runner/flow_worker.d.ts

@@ -21,6 +21,7 @@ export declare class FlowWorker extends EventEmitter {
     private pluginManager?;
     private isSilent;
     private isAborted;
+    private bailTriggered;
     private isDebugHalted;
     private currentStepContext;
     private currentFileName;

package/dist/runner/flow_worker.js

@@ -37,6 +37,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FlowWorker = void 0;
+const deadline_1 = require("../ci/deadline");
+const replayRequest_1 = require("../utils/replayRequest");
+const projectPaths_1 = require("../utils/projectPaths");
+const redaction_1 = require("../security/redaction");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const chalk_1 = __importDefault(require("chalk"));
@@ -55,6 +59,7 @@ class FlowWorker extends events_1.EventEmitter {
     pluginManager;
     isSilent = process.env.FLOWSTRIDE_PARALLEL === "true";
     isAborted = false;
+    bailTriggered = false;
     isDebugHalted = false;
     currentStepContext = "Initializing...";
     currentFileName = "System";
@@ -76,7 +81,8 @@ class FlowWorker extends events_1.EventEmitter {
         this.pluginManager = pluginManager;
     }
     broadcast(type, payload) {
-        this.emit("worker_event", { type, payload });
+        const secrets = [this.config.machineToken || '', ...(this.dataGen?.sensitiveValues?.() || []), ...Object.entries(process.env).filter(([key]) => /password|token|secret|api.?key/i.test(key)).map(([, value]) => String(value)), ...Object.entries(this.localVariables).filter(([key]) => /password|passcode|token|secret|otp|api.?key/i.test(key)).map(([, value]) => String(value))];
+        this.emit('worker_event', { type, payload: (0, redaction_1.redactWorkerPayload)(type, payload, secrets, this.config.ci === false) });
     }
     emitLog(type, status, summary, details, customId, overrideFileName) {
         const id = customId || Math.random().toString(36).substr(2, 9);
@@ -278,6 +284,7 @@ class FlowWorker extends events_1.EventEmitter {
             url: cleanUrl,
             requestHeaders: formattedHeaders,
             requestBody: parsedReqBody,
+            rawReplayRequest: { method: method.toUpperCase(), url: cleanUrl, headers: formattedHeaders, body: rawBodyString },
             responseStatus: state.status,
             responseHeaders: state.headers,
             responseBody: state.body,
@@ -300,33 +307,11 @@ class FlowWorker extends events_1.EventEmitter {
         });
     }
     async handleReplayRequest(payload) {
+        const requestId = typeof payload?.requestId === 'string' ? payload.requestId : undefined;
         try {
-            let parsedHeaders = undefined;
-            let parsedBody = undefined;
-            try {
-                if (payload.headers)
-                    parsedHeaders = JSON.parse(payload.headers);
-            }
-            catch (e) { }
-            try {
-                if (payload.body)
-                    parsedBody = JSON.parse(payload.body);
-            }
-            catch (e) {
-                parsedBody = payload.body;
-            }
-            const fetchOptions = {
-                method: payload.method,
-                headers: parsedHeaders,
-            };
-            if (parsedBody && payload.method !== "GET" && payload.method !== "HEAD") {
-                fetchOptions.body =
-                    typeof parsedBody === "string"
-                        ? parsedBody
-                        : JSON.stringify(parsedBody);
-            }
-            const response = await fetch(payload.url, fetchOptions);
-            const status = response.status;
+            const { url, options } = (0, replayRequest_1.buildReplayRequest)(payload);
+            options.signal = AbortSignal.timeout(this.config.timeout || 30000);
+            const response = await fetch(url, options);
             const text = await response.text();
             let responseBody;
             try {
@@ -335,17 +320,18 @@ class FlowWorker extends events_1.EventEmitter {
             catch {
                 responseBody = text;
             }
-            this.broadcast("REPLAY_RES", {
-                status,
-                responseBody,
+            this.broadcast('REPLAY_RES', {
+                status: response.status, responseBody, error: null, requestId,
                 fileName: this.currentFileName,
             });
         }
         catch (error) {
-            this.broadcast("REPLAY_RES", {
-                status: 500,
-                responseBody: { error: error.message },
-                fileName: this.currentFileName,
+            const code = error instanceof replayRequest_1.ReplayRequestError ? 'REPLAY_INVALID_REQUEST'
+                : error?.name === 'TimeoutError' ? 'REPLAY_TIMEOUT' : 'REPLAY_NETWORK_ERROR';
+            const message = (0, redaction_1.redactText)(String(error?.message || 'Replay request failed'), [this.config.machineToken || '']);
+            this.broadcast('REPLAY_RES', {
+                status: null, error: code, requestId,
+                responseBody: { error: message, code }, fileName: this.currentFileName,
             });
         }
     }
@@ -362,6 +348,7 @@ class FlowWorker extends events_1.EventEmitter {
         }
         this.activeAudioPath = undefined;
         this.isAborted = false;
+        this.bailTriggered = false;
         this.isDebugHalted = false;
         const sigintHandler = async () => {
             if (this.config.ci) {
@@ -387,7 +374,7 @@ class FlowWorker extends events_1.EventEmitter {
                 const audioMatch = content.match(/(?:flow\.)?injectAudio\s+["']([^"']+)["']/i);
                 if (audioMatch && audioMatch[1]) {
                     const rawPath = audioMatch[1];
-                    const absolutePath = path.resolve(process.cwd(), rawPath);
+                    const absolutePath = (0, projectPaths_1.projectPath)(process.cwd(), rawPath);
                     if (!fs.existsSync(absolutePath)) {
                         throw new Error(`Pre-launch initialization failed: Audio file not found at ${absolutePath}`);
                     }
@@ -396,11 +383,11 @@ class FlowWorker extends events_1.EventEmitter {
                 }
             }
             for (const filePath of filesToProcess) {
-                if (this.isAborted || this.isDebugHalted)
+                if (this.isAborted || this.isDebugHalted || this.bailTriggered)
                     break;
                 const fileStartTime = Date.now();
                 try {
-                    const fileName = path.basename(filePath);
+                    const fileName = (0, projectPaths_1.flowIdentity)(filePath, this.config.flowRoot);
                     this.currentFileName = fileName;
                     this.config.testFile = fileName;
                     this.localVariables = {};
@@ -451,14 +438,14 @@ class FlowWorker extends events_1.EventEmitter {
                         });
                     }
                     for (const f of features) {
-                        if (this.isAborted || this.isDebugHalted)
+                        if (this.isAborted || this.isDebugHalted || this.bailTriggered)
                             break;
                         if (f.scenarios.length === 0)
                             continue;
                         if (!this.isSilent)
                             console.log(chalk_1.default.magenta.bold(`  Feature: ${f.name}`));
                         for (const s of f.scenarios) {
-                            if (this.isAborted || this.isDebugHalted)
+                            if (this.isAborted || this.isDebugHalted || this.bailTriggered)
                                 break;
                             if (!this.isSilent)
                                 console.log(chalk_1.default.cyan(`    Scenario: ${s.name}`));
@@ -467,7 +454,7 @@ class FlowWorker extends events_1.EventEmitter {
                                 fileName: this.currentFileName,
                             });
                             await this.runScenario(s, f.declarations);
-                            if (this.isDebugHalted)
+                            if (this.isDebugHalted || this.bailTriggered)
                                 break;
                             await this.web
                                 .getPage()
@@ -488,7 +475,7 @@ class FlowWorker extends events_1.EventEmitter {
                     if (!this.config.ci)
                         await new Promise((resolve) => setTimeout(resolve, 2000));
                     try {
-                        const baseName = this.currentFileName.replace(".flow", "");
+                        const baseName = (0, projectPaths_1.videoFileName)(this.currentFileName).replace(/\.webm$/, '');
                         const mockCloudDir = path.join(process.cwd(), ".flowstride", "mock-cloud");
                         if (!fs.existsSync(mockCloudDir))
                             fs.mkdirSync(mockCloudDir, { recursive: true });
@@ -511,7 +498,7 @@ class FlowWorker extends events_1.EventEmitter {
                     if (!this.isSilent)
                         console.error(chalk_1.default.red(`\n[Execution]: Failed processing ${this.currentFileName}: ${e.message}`));
                     try {
-                        const baseName = this.currentFileName.replace(".flow", "");
+                        const baseName = (0, projectPaths_1.videoFileName)(this.currentFileName).replace(/\.webm$/, '');
                         const mockCloudDir = path.join(process.cwd(), ".flowstride", "mock-cloud");
                         if (!fs.existsSync(mockCloudDir))
                             fs.mkdirSync(mockCloudDir, { recursive: true });
@@ -544,7 +531,7 @@ class FlowWorker extends events_1.EventEmitter {
                 try {
                     const directory = path.join(process.cwd(), '.flowstride', 'artifacts');
                     fs.mkdirSync(directory, { recursive: true });
-                    await this.web.shutdown(path.join(directory, this.currentFileName.replace(/\.flow$/, '') + '.webm'));
+                    await this.web.shutdown(path.join(directory, (0, projectPaths_1.videoFileName)(this.currentFileName)));
                 }
                 catch (error) {
                     this.broadcast('WORKER_ERROR', { message: error.message });
@@ -554,6 +541,7 @@ class FlowWorker extends events_1.EventEmitter {
         }
     }
     async runScenario(scenario, globalDeclarations = []) {
+        let hasScenarioFailed = false;
         for (const step of scenario.steps) {
             if (this.isAborted)
                 break;
@@ -565,6 +553,11 @@ class FlowWorker extends events_1.EventEmitter {
             step.payload = this.resolveTemplateData(step.payload);
             this.currentStepContext = `${blockName} ${blockDesc}`;
             const isOpt = step.payload?.optional;
+            if (hasScenarioFailed) {
+                this.broadcast('STEP_ADD', { id: step.id, type: blockName, description: blockDesc, command: step.action, status: 'not_tested', fileName: this.currentFileName });
+                this.broadcast('STEP_UPDATE', { id: step.id, status: 'not_tested', fileName: this.currentFileName });
+                continue;
+            }
             const mockSpinner = {
                 text: "",
                 start() {
@@ -693,7 +686,11 @@ class FlowWorker extends events_1.EventEmitter {
                     screenshot: stepContext.screenshot,
                     fileName: this.currentFileName,
                 });
-                throw e;
+                hasScenarioFailed = true;
+                if (this.config.bail && !this.bailTriggered) {
+                    this.bailTriggered = true;
+                    this.broadcast('BAIL', { fileName: this.currentFileName, id: step.id });
+                }
             }
         }
     }
@@ -857,6 +854,7 @@ class FlowWorker extends events_1.EventEmitter {
                         localStorage: stateToSave.localStorage || {},
                         sessionStorage: stateToSave.sessionStorage || {},
                         fallbackDomain,
+                        storageOrigin: stateToSave.storageOrigin,
                     };
                     if (payload.isGlobal) {
                         FlowWorker.globalBrowserSessions[payload.name] = hybridState;
@@ -905,7 +903,7 @@ class FlowWorker extends events_1.EventEmitter {
                     }
                     if (!loadedState)
                         throw new Error(`State Error: The session "${payload.name}" does not exist in memory or on disk.`);
-                    await this.web.injectStorage(loadedState.cookies, loadedState.localStorage, loadedState.fallbackDomain);
+                    await this.web.injectStorage(loadedState.cookies, loadedState.localStorage, loadedState.fallbackDomain, loadedState.sessionStorage, loadedState.storageOrigin);
                 }
                 break;
             case "open":
@@ -1155,6 +1153,27 @@ class FlowWorker extends events_1.EventEmitter {
                     await this.web.expectText(payload.selector, payload.fuzzy, payload.elementType);
                 else if (expectType === "value")
                     await this.web.expectValue(payload.selector, payload.text, payload.elementType);
+                else if (expectType === "attribute") {
+                    const deadline = Date.now() + this.config.timeout;
+                    let actual = null;
+                    const failure = () => `Attribute assertion failed: ${payload.attribute} on ${payload.selector}. Expected ${payload.fuzzy ? 'to contain ' : ''}${JSON.stringify(payload.text)}, received ${JSON.stringify(actual)}.`;
+                    while (true) {
+                        const remaining = deadline - Date.now();
+                        if (remaining <= 0)
+                            throw new Error(failure());
+                        try {
+                            actual = await (0, deadline_1.withDeadline)(this.web.getAttribute(payload.selector, payload.attribute, payload.elementType), remaining);
+                        }
+                        catch (error) {
+                            throw new Error(`${failure()}\n${error instanceof Error ? error.message : String(error)}`, { cause: error });
+                        }
+                        if (actual !== null && (payload.fuzzy ? actual.includes(payload.text) : actual === payload.text))
+                            break;
+                        if (Date.now() >= deadline)
+                            throw new Error(failure());
+                        await new Promise(resolve => setTimeout(resolve, Math.max(0, Math.min(50, deadline - Date.now()))));
+                    }
+                }
                 else if (expectType === "transcript")
                     await this.web.expectTranscript(payload.text);
                 break;
@@ -1189,12 +1208,14 @@ class FlowWorker extends events_1.EventEmitter {
             const sharedId = Math.random().toString(36).substr(2, 9);
             const urlObj = new URL(request.url());
             const endpointName = urlObj.pathname.split("/").pop() || urlObj.pathname;
-            const curlString = this.web.synthesizeCurl(request.method(), request.url(), request.headers(), rawPostData);
+            const requestHeaders = await request.allHeaders().catch(() => request.headers());
+            const curlString = this.web.synthesizeCurl(request.method(), request.url(), requestHeaders, rawPostData);
             this.emitLog("REST", response.status() < 400 ? "success" : "error", `${request.method()} ${endpointName}`, {
                 method: request.method(),
                 url: request.url(),
-                requestHeaders: request.headers(),
+                requestHeaders: requestHeaders,
                 requestBody: requestBody,
+                rawReplayRequest: { method: request.method(), url: request.url(), headers: requestHeaders, body: rawPostData },
                 responseStatus: response.status(),
                 responseHeaders: response.headers(),
                 responseBody: responseBody,

package/dist/runner/persistent_vault.js

@@ -34,13 +34,14 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PersistentVault = void 0;
+const projectPaths_1 = require("../utils/projectPaths");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 class PersistentVault {
     vaultPath;
     data = {};
     constructor(projectRoot = process.cwd()) {
-        this.vaultPath = path.join(projectRoot, ".flowstride", "vault.json");
+        this.vaultPath = (0, projectPaths_1.projectPath)(projectRoot, path.join(projectRoot, ".flowstride", "vault.json"));
         this.initialiseVault();
     }
     initialiseVault() {

package/dist/runner/plugin_manager.js

@@ -37,6 +37,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PluginManager = void 0;
+const projectPaths_1 = require("../utils/projectPaths");
 const deadline_1 = require("../ci/deadline");
 const node_fs_1 = __importDefault(require("node:fs"));
 const sdk_1 = require("../game/sdk");
@@ -82,6 +83,7 @@ class PluginManager {
             const pluginsPath = this.config.pluginsDir || path.join(process.cwd(), "plugins");
             fullPath = path.resolve(pluginsPath, `${pluginFile}.ts`);
         }
+        fullPath = (0, projectPaths_1.projectPath)(process.cwd(), fullPath);
         try {
             let module;
             if (fullPath.endsWith(".ts")) {
@@ -110,7 +112,7 @@ class PluginManager {
                             throw new Error('Attachment name must be a simple filename.');
                         const directory = this.config.artifactsDir || path.resolve('flowstride-artifacts');
                         node_fs_1.default.mkdirSync(directory, { recursive: true });
-                        const prefix = this.config.testFile ? this.config.testFile.replace(/[^a-zA-Z0-9_.-]/g, '_') + '-' : '';
+                        const prefix = (0, projectPaths_1.artifactPrefix)(this.config.testFile);
                         const file = path.join(directory, prefix + name);
                         node_fs_1.default.writeFileSync(file, data);
                         return file;

package/dist/security/localDashboard.d.ts

@@ -0,0 +1,2 @@
+/** Reject remote hosts and browser origins before exposing local debugger data. */
+export declare function isLocalDashboardRequest(host?: string, origin?: string): boolean;

package/dist/security/localDashboard.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isLocalDashboardRequest = isLocalDashboardRequest;
+/** Reject remote hosts and browser origins before exposing local debugger data. */
+function isLocalDashboardRequest(host, origin) {
+    if (!host)
+        return false;
+    try {
+        const target = new URL(`http://${host}`);
+        if (!['localhost', '127.0.0.1', '[::1]'].includes(target.hostname) || !target.port || target.username || target.password || target.pathname !== '/' || target.search || target.hash)
+            return false;
+        if (origin !== undefined) {
+            const source = new URL(origin);
+            if (source.origin !== target.origin || source.pathname !== '/' || source.search || source.hash || source.username || source.password)
+                return false;
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/security/redaction.d.ts

@@ -0,0 +1,4 @@
+export declare function redactText(input: string, secrets?: string[]): string;
+export declare function redactPayload(value: any, secrets?: string[], depth?: number): any;
+/** Raw network commands belong only to the local interactive debugger. */
+export declare function redactWorkerPayload(type: string, payload: any, secrets: string[], localDebug?: boolean): any;

package/dist/security/redaction.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactText = redactText;
+exports.redactPayload = redactPayload;
+exports.redactWorkerPayload = redactWorkerPayload;
+const sensitive = /password|passcode|secret|token|authorization|cookie|api.?key|master.?key|otp|email|curlString|rawReplayRequest|strippedDom/i;
+function redactText(input, secrets = []) {
+    let value = String(input);
+    for (const secret of secrets.filter(s => typeof s === 'string' && s.length >= 4).sort((a, b) => b.length - a.length))
+        value = value.split(secret).join('[REDACTED]');
+    value = value.replace(/\bBearer\s+[^\s"'<>]+/gi, 'Bearer [REDACTED]')
+        .replace(/\beyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\b/g, '[REDACTED]')
+        .replace(/(["']?(?:password|passcode|secret|token|otp|authorization|cookie|api[_-]?key|master[_-]?key)["']?\s*[:=]\s*)(["']?)[^\s,;"'<>}]+\2/gi, '$1[REDACTED]')
+        .replace(/([?&](?:ticket|token|signature|x-amz-[^=&#]+)=)[^&#\s]+/gi, '$1[REDACTED]');
+    return value;
+}
+function redactPayload(value, secrets = [], depth = 0) {
+    if (depth > 12)
+        return '[omitted]';
+    if (typeof value === 'string') {
+        if (/^data:image\//.test(value))
+            return value;
+        const trimmed = value.trim();
+        if (trimmed.startsWith('{') || trimmed.startsWith('[')) {
+            try {
+                return JSON.stringify(redactPayload(JSON.parse(value), secrets, depth + 1));
+            }
+            catch { }
+        }
+        return redactText(value, secrets);
+    }
+    if (Array.isArray(value))
+        return value.map(item => redactPayload(item, secrets, depth + 1));
+    if (!value || typeof value !== 'object')
+        return value;
+    if (Buffer.isBuffer(value))
+        return '[binary]';
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, sensitive.test(key) ? '[REDACTED]' : redactPayload(item, secrets, depth + 1)]));
+}
+/** Raw network commands belong only to the local interactive debugger. */
+function redactWorkerPayload(type, payload, secrets, localDebug = false) {
+    const result = redactPayload(payload, secrets);
+    if (!localDebug || !payload || !result)
+        return result;
+    if (type === 'LOG_EVENT' && ['REST', 'GRAPHQL'].includes(payload.type) && typeof payload.details?.curlString === 'string') {
+        result.details.rawCurlString = payload.details.curlString;
+        if (payload.details.rawReplayRequest)
+            result.details.rawReplayRequest = payload.details.rawReplayRequest;
+    }
+    return result;
+}

package/dist/sessions/manager.js

@@ -35,7 +35,7 @@ class SessionManager {
         data.lastUsedAt = Date.now();
         this.vault.save(`session_${name}`, data);
         this.activeSession = data;
-        await this.web.injectStorage(data.cookies, data.localStorage);
+        await this.web.injectStorage(data.cookies, data.localStorage, undefined, data.sessionStorage, data.storageOrigin);
         const definition = this.definitions.get(name);
         if (definition?.inject?.api) {
             const { headerName, template } = definition.inject.api;
@@ -64,6 +64,8 @@ class SessionManager {
             tokens: this.activeSession?.tokens || {},
             cookies: state.cookies,
             localStorage: state.localStorage,
+            sessionStorage: state.sessionStorage,
+            storageOrigin: state.storageOrigin,
             createdAt: Date.now(),
             lastUsedAt: Date.now(),
             persist,