flowstride 1.0.20-rc.2 → 1.0.20

package/dist/types/index.d.ts

@@ -1,5 +1,12 @@
 export interface FlowstrideConfig {
     ci?: boolean;
+    flowRoot?: string;
+    projectRoot?: string;
+    cloudSyncResult?: {
+        reporting: string;
+        video: string;
+        error?: unknown;
+    };
     device?: 'desktop' | 'phone' | 'landscape';
     viewport?: {
         width: number;
@@ -46,6 +53,8 @@ export interface SessionData {
     tokens: Record<string, any>;
     cookies?: any[];
     localStorage?: Record<string, string>;
+    sessionStorage?: Record<string, string>;
+    storageOrigin?: string;
     createdAt: number;
     lastUsedAt: number;
     persist: boolean;

package/dist/utils/cloud.d.ts

@@ -0,0 +1,6 @@
+export declare function cloudApiBase(env?: Record<string, string | undefined>): string;
+export declare function cloudFailure(error: any, secrets?: string[]): {
+    status: number | undefined;
+    code: string | undefined;
+    message: string;
+};

package/dist/utils/cloud.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cloudApiBase = cloudApiBase;
+exports.cloudFailure = cloudFailure;
+const redaction_1 = require("../security/redaction");
+function cloudApiBase(env = process.env) {
+    const value = env.FLOWSTRIDE_API_URL || env.NEXTJS_WEBHOOK_URL || 'https://cloud.flowstride.io';
+    const url = new URL(value);
+    if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.search || url.hash)
+        throw new Error('Cloud URL must be an HTTP(S) URL without credentials or query parameters.');
+    const pathname = url.pathname.replace(/\/api\/cloud\/execution-complete\/?$/, '').replace(/\/+$/, '');
+    return url.origin + pathname;
+}
+function cloudFailure(error, secrets = []) {
+    const status = Number(error?.response?.status) || undefined;
+    const code = typeof error?.response?.data?.code === 'string' ? error.response.data.code.slice(0, 80) : typeof error?.code === 'string' ? error.code.slice(0, 80) : undefined;
+    const authenticationMessages = {
+        TOKEN_EXPIRED: 'This developer token has expired. Generate a replacement; logging in with the same key does not renew it.',
+        TOKEN_REVOKED: 'This developer token has been revoked. Use a replacement token.',
+        TOKEN_INVALID: 'Cloud did not recognize a valid developer token. Check the credential source and Cloud URL.',
+        TOKEN_REQUIRED: 'Cloud requires a Bearer developer token.',
+        TOKEN_SCOPE_DENIED: 'This token requires execution or admin scope for CLI runs.',
+    };
+    const message = (status === 401 || status === 403) && code && authenticationMessages[code] ? authenticationMessages[code]
+        : status === 401 ? 'Cloud rejected authentication. Check the selected token and Cloud URL; this response does not confirm expiration.'
+            : status === 403 ? 'Workspace permission or feature policy rejected this request.'
+                : status === 413 ? 'The Cloud/proxy upload limit was exceeded; evidence remains local.'
+                    : status === 429 ? 'The Cloud request rate limit was reached.'
+                        : status && status >= 500 ? 'Cloud service failed; evidence remains local.'
+                            : status === 400 ? 'Cloud rejected the report schema; verify matching CLI and Cloud releases.'
+                                : 'Cloud could not be reached; verify the configured URL and network connection.';
+    return { status, code: code ? (0, redaction_1.redactText)(code, secrets) : undefined, message };
+}

package/dist/utils/projectPaths.d.ts

@@ -0,0 +1,11 @@
+export declare function projectPath(root: string, target: string): string;
+export declare function discoverFlows(target: string, projectRoot?: string): string[];
+export declare function flowIdentity(file: string, root?: string): string;
+export declare function videoFileName(identity: string): string;
+export declare function selectedFeatures<T extends {
+    scenarios: {
+        isOnly?: boolean;
+        steps: unknown[];
+    }[];
+}>(features: T[]): T[];
+export declare function artifactPrefix(identity?: string): string;

package/dist/utils/projectPaths.js

@@ -0,0 +1,90 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.projectPath = projectPath;
+exports.discoverFlows = discoverFlows;
+exports.flowIdentity = flowIdentity;
+exports.videoFileName = videoFileName;
+exports.selectedFeatures = selectedFeatures;
+exports.artifactPrefix = artifactPrefix;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_crypto_1 = require("node:crypto");
+function projectPath(root, target) {
+    root = node_path_1.default.resolve(root);
+    target = node_path_1.default.resolve(root, target);
+    const inside = (base, value) => {
+        const relative = node_path_1.default.relative(base, value);
+        return relative !== '..' && !relative.startsWith(`..${node_path_1.default.sep}`) && !node_path_1.default.isAbsolute(relative);
+    };
+    if (!inside(root, target))
+        throw new Error(`Path must remain inside the project: ${target}`);
+    const realRoot = node_fs_1.default.realpathSync(root);
+    let parent = target;
+    const suffix = [];
+    while (true) {
+        try {
+            node_fs_1.default.lstatSync(parent);
+            break;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+            suffix.unshift(node_path_1.default.basename(parent));
+            const next = node_path_1.default.dirname(parent);
+            if (next === parent)
+                throw error;
+            parent = next;
+        }
+    }
+    const real = node_path_1.default.join(node_fs_1.default.realpathSync(parent), ...suffix);
+    if (!inside(realRoot, real))
+        throw new Error(`Symlink escapes the project: ${target}`);
+    return target;
+}
+function discoverFlows(target, projectRoot = process.cwd()) {
+    const files = [];
+    const visited = new Set();
+    const visit = (item) => {
+        item = projectPath(projectRoot, item);
+        const real = node_fs_1.default.realpathSync(item);
+        if (visited.has(real))
+            return;
+        visited.add(real);
+        const stat = node_fs_1.default.statSync(item);
+        if (stat.isFile()) {
+            if (item.endsWith('.flow'))
+                files.push(item);
+            return;
+        }
+        if (!stat.isDirectory())
+            return;
+        for (const entry of node_fs_1.default.readdirSync(item, { withFileTypes: true }).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0)) {
+            if (['node_modules', '.git', '.flowstride', 'flowstride-artifacts'].includes(entry.name))
+                continue;
+            visit(node_path_1.default.join(item, entry.name));
+        }
+    };
+    visit(target);
+    return files.sort((a, b) => Number(!a.endsWith('.first.flow')) - Number(!b.endsWith('.first.flow')) || (a < b ? -1 : a > b ? 1 : 0));
+}
+function flowIdentity(file, root) { return (root ? node_path_1.default.relative(root, file) : node_path_1.default.basename(file)).split(node_path_1.default.sep).join('/'); }
+function videoFileName(identity) {
+    if (!identity.includes('/') && identity.length < 180 && !identity.includes('%'))
+        return identity.replace(/\.flow$/, '') + '.webm';
+    const base = node_path_1.default.posix.basename(identity, '.flow').replace(/[^a-zA-Z0-9_.-]/g, '_').slice(0, 60);
+    return `${base}-${(0, node_crypto_1.createHash)('sha256').update(identity).digest('hex').slice(0, 16)}.webm`;
+}
+function selectedFeatures(features) {
+    if (!features.some(f => f.scenarios.some(s => s.isOnly)))
+        return features;
+    return features.map(f => ({ ...f, scenarios: f.scenarios.filter(s => s.isOnly) }));
+}
+function artifactPrefix(identity) {
+    if (!identity)
+        return '';
+    const safe = identity.replace(/[^a-zA-Z0-9_.-]/g, '_').slice(0, 100);
+    return safe + (identity.includes('/') || identity.length > 100 ? '-' + (0, node_crypto_1.createHash)('sha256').update(identity).digest('hex').slice(0, 12) : '') + '-';
+}

package/dist/utils/replayRequest.d.ts

@@ -0,0 +1,8 @@
+export declare class ReplayRequestError extends Error {
+    constructor(message: string);
+}
+/** Browser protocol metadata is not a portable set of Fetch request headers. */
+export declare function buildReplayRequest(payload: any): {
+    url: string;
+    options: RequestInit;
+};

package/dist/utils/replayRequest.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ReplayRequestError = void 0;
+exports.buildReplayRequest = buildReplayRequest;
+class ReplayRequestError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ReplayRequestError';
+    }
+}
+exports.ReplayRequestError = ReplayRequestError;
+/** Browser protocol metadata is not a portable set of Fetch request headers. */
+function buildReplayRequest(payload) {
+    let url;
+    try {
+        url = new URL(payload?.url);
+        if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password)
+            throw new Error();
+    }
+    catch {
+        throw new ReplayRequestError('Replay URL must use HTTP or HTTPS without embedded credentials.');
+    }
+    const method = typeof payload?.method === 'string' ? payload.method.toUpperCase() : 'GET';
+    if (!/^[!#$%&'*+.^_`|~0-9A-Z-]+$/.test(method) || ['CONNECT', 'TRACE', 'TRACK'].includes(method)) {
+        throw new ReplayRequestError('Replay method is not supported.');
+    }
+    let supplied = payload?.headers;
+    if (typeof supplied === 'string') {
+        try {
+            supplied = supplied.trim() ? JSON.parse(supplied) : {};
+        }
+        catch {
+            throw new ReplayRequestError('Replay headers must be a valid JSON object.');
+        }
+    }
+    if (supplied === undefined)
+        supplied = {};
+    if (!supplied || typeof supplied !== 'object' || Array.isArray(supplied)) {
+        throw new ReplayRequestError('Replay headers must be a JSON object of string values.');
+    }
+    // Fetch owns the destination, framing and supported compression. Recompute
+    // Content-Length after edits and remove all Connection-nominated fields too.
+    const excluded = new Set([
+        'host', 'content-length', 'accept-encoding', 'connection', 'keep-alive',
+        'proxy-connection', 'proxy-authenticate', 'proxy-authorization', 'te',
+        'trailer', 'transfer-encoding', 'upgrade', 'expect',
+    ]);
+    for (const [name, value] of Object.entries(supplied)) {
+        if (name.toLowerCase() === 'connection' && typeof value === 'string') {
+            for (const field of value.split(','))
+                excluded.add(field.trim().toLowerCase());
+        }
+    }
+    const headers = new Headers();
+    for (const [name, value] of Object.entries(supplied)) {
+        if (name.startsWith(':') || excluded.has(name.toLowerCase()))
+            continue;
+        if (typeof value !== 'string')
+            throw new ReplayRequestError('Replay header values must be strings.');
+        try {
+            headers.append(name, value);
+        }
+        catch {
+            throw new ReplayRequestError('Replay headers contain an invalid name or value.');
+        }
+    }
+    const options = { method, headers };
+    if (!['GET', 'HEAD'].includes(method) && payload?.body !== undefined && payload.body !== null) {
+        try {
+            options.body = typeof payload.body === 'string' ? payload.body : JSON.stringify(payload.body);
+        }
+        catch {
+            throw new ReplayRequestError('Replay body cannot be serialized.');
+        }
+    }
+    return { url: url.href, options };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowstride",
-  "version": "1.0.20-rc.2",
+  "version": "1.0.20",
   "description": "An opensource flowfirst test automation framework",
   "workspaces": [
     "packages/flowstride_report"
@@ -11,8 +11,7 @@
     "dist",
     "src/ui/dist",
     "NATIVE_CI.md",
-    "examples/native-game",
-    "RELEASE_NOTES.md"
+    "examples/native-game"
   ],
   "bin": {
     "flowstride": "dist/cli/index.js"
@@ -20,9 +19,18 @@
   "scripts": {
     "build": "tsc",
     "flowstride": "node ./dist/cli/index.js",
-    "test": "echo 'Test script to be configured'",
-    "prepublishOnly": "npm run build",
-    "test:native": "node --test --test-concurrency=1 tests/native/*.test.cjs"
+    "test": "npm run test:native && npm run test:manual-security && npm run test:dashboard",
+    "prepublishOnly": "npm run build:candidate && npm run verify:candidate",
+    "test:native": "node --test --test-concurrency=1 tests/native/*.test.cjs",
+    "test:manual-security": "node --test tests/manual-security.test.cjs",
+    "build:candidate": "node scripts/build-candidate.cjs",
+    "verify:candidate": "node scripts/verify-candidate.cjs",
+    "test:dashboard:unit": "node --test tests/dashboard/store.test.cjs",
+    "test:dashboard": "node --test --test-concurrency=1 tests/dashboard/*.test.cjs",
+    "test:unit": "node --test tests/native/core.test.cjs tests/native/combined.test.cjs tests/native/curl.test.cjs tests/native/upload.test.cjs tests/dashboard/store.test.cjs tests/native/replay.test.cjs tests/dashboard/replay.test.cjs tests/native/assertions-sessions.test.cjs",
+    "test:security": "node --test tests/manual-security.test.cjs tests/native/curl.test.cjs tests/native/combined.test.cjs tests/native/replay.test.cjs tests/native/assertions-sessions.test.cjs",
+    "test:replay": "node --test tests/native/replay.test.cjs tests/dashboard/replay.test.cjs tests/dashboard/curl.browser.test.cjs",
+    "test:assertions-sessions": "node --test --test-concurrency=1 tests/native/assertions-sessions*.test.cjs"
   },
   "keywords": [
     "automation",
@@ -37,7 +45,7 @@
   },
   "dependencies": {
     "@inquirer/prompts": "^7.10.1",
-    "axios": "^1.18.0",
+    "axios": "^1.20.0",
     "chalk": "^4.1.2",
     "commander": "^11.0.0",
     "dotenv": "^17.4.2",
@@ -46,22 +54,23 @@
     "playwright": "1.59.1",
     "playwright-extra": "^4.3.6",
     "puppeteer-extra-plugin-stealth": "^2.11.2",
-    "tar": "^7.5.16",
+    "tar": "^7.5.22",
     "ts-node": "^10.9.2",
-    "undici": "^7.25.0",
-    "ws": "^8.20.1"
+    "undici": "^7.30.1",
+    "ws": "^8.22.0",
+    "sanitize-html": "2.18.1",
+    "zod": "4.4.3"
   },
   "devDependencies": {
     "@types/node": "^25.9.1",
     "@types/ws": "^8.18.1",
-    "typescript": "^5.9.3"
+    "typescript": "^5.9.3",
+    "@types/sanitize-html": "2.16.2"
   },
   "optionalDependencies": {
     "@rolldown/binding-darwin-arm64": "^0.15.1"
   },
   "publishConfig": {
-    "tag": "next",
-    "access": "public",
-    "registry": "https://registry.npmjs.org"
+    "tag": "latest"
   }
 }