flowproof 0.23.8__tar.gz → 0.23.9__tar.gz

{flowproof-0.23.8 → flowproof-0.23.9}/Cargo.lock

@@ -930,7 +930,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-adapters"
-version = "0.23.8"
+version = "0.23.9"
 dependencies = [
  "anyhow",
  "flowproof-driver",
@@ -949,7 +949,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-agent"
-version = "0.23.8"
+version = "0.23.9"
 dependencies = [
  "chrono",
  "flowproof-driver",
@@ -967,7 +967,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-cli"
-version = "0.23.8"
+version = "0.23.9"
 dependencies = [
  "ab_glyph",
  "chrono",
@@ -988,11 +988,12 @@ dependencies = [
  "sha2 0.10.9",
  "tiny_http",
  "ureq",
+ "uuid",
 ]
 
 [[package]]
 name = "flowproof-driver"
-version = "0.23.8"
+version = "0.23.9"
 dependencies = [
  "calamine",
  "flowproof-trace",
@@ -1008,7 +1009,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-python"
-version = "0.23.8"
+version = "0.23.9"
 dependencies = [
  "flowproof-agent",
  "flowproof-cli",
@@ -1020,7 +1021,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-replay"
-version = "0.23.8"
+version = "0.23.9"
 dependencies = [
  "chrono",
  "flowproof-agent",
@@ -1034,7 +1035,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-trace"
-version = "0.23.8"
+version = "0.23.9"
 dependencies = [
  "jsonschema",
  "regex",

{flowproof-0.23.8 → flowproof-0.23.9}/Cargo.toml

@@ -22,7 +22,7 @@ members = ["crates/flowproof-driver", "crates/flowproof-trace", "crates/flowproo
 exclude = ["spike/windows-containment"]
 
 [workspace.package]
-version = "0.23.8"
+version = "0.23.9"
 edition = "2021"
 license = "Apache-2.0"
 repository = "https://github.com/automators-com/flowproof"

{flowproof-0.23.8 → flowproof-0.23.9}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: flowproof
-Version: 0.23.8
-Classifier: Development Status :: 3 - Alpha
+Version: 0.23.9
+Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Rust
@@ -61,7 +61,7 @@ The wheel bundles the Rust engine; no separate install. Targets: `web`
 (SAP GUI Scripting), `vision` (pixels-only for Citrix/RDP), and `api`
 (no UI — HTTP/SQL assertion flows, any OS).
 
-**Status: alpha, in active development.** Record→replay,
+**Status: beta, in active development.** Record→replay,
 model-grounded authoring, healing with reviewable diffs, suites, run
 recordings, and the MCP server all work and are tested in CI.
 

{flowproof-0.23.8 → flowproof-0.23.9}/README.md

@@ -43,7 +43,7 @@ The wheel bundles the Rust engine; no separate install. Targets: `web`
 (SAP GUI Scripting), `vision` (pixels-only for Citrix/RDP), and `api`
 (no UI — HTTP/SQL assertion flows, any OS).
 
-**Status: alpha, in active development.** Record→replay,
+**Status: beta, in active development.** Record→replay,
 model-grounded authoring, healing with reviewable diffs, suites, run
 recordings, and the MCP server all work and are tested in CI.
 

{flowproof-0.23.8 → flowproof-0.23.9}/crates/flowproof-adapters/src/web.rs

@@ -12,7 +12,7 @@ use std::time::Duration;
 use flowproof_driver::{
     AppDriver, DriverError, KeyMod, PixelRect, ScrollTo, UiaSelector, WebSession,
 };
-use headless_chrome::browser::tab::{ModifierKey, Tab};
+use headless_chrome::browser::tab::{ModifierKey, NoElementFound, Tab};
 use headless_chrome::protocol::cdp::Target::CreateTarget;
 use headless_chrome::protocol::cdp::{Accessibility, Emulation, Input, Network, Page, DOM};
 use headless_chrome::types::Bounds;
@@ -5522,9 +5522,14 @@ impl AppDriver for WebAppDriver {
 
     fn password_rects(&mut self) -> Result<Vec<PixelRect>, DriverError> {
         let tab = self.tab()?;
-        let fields = tab
-            .find_elements("input[type=password]")
-            .map_err(|e| web_err("finding password fields", e))?;
+        // A page with no password input is the ordinary case and has nothing
+        // to mask; headless_chrome's find_elements reports an empty match as
+        // an error, so only genuine CDP failures may abort the resolution.
+        let fields = match tab.find_elements("input[type=password]") {
+            Ok(fields) => fields,
+            Err(e) if e.downcast_ref::<NoElementFound>().is_some() => Vec::new(),
+            Err(e) => return Err(web_err("finding password fields", e)),
+        };
         let mut rects = Vec::new();
         for field in fields {
             // Hidden wizard pages still contain password inputs, but have no

{flowproof-0.23.8 → flowproof-0.23.9}/crates/flowproof-adapters/tests/password_recording_e2e.rs

@@ -1,12 +1,8 @@
 //! Hidden password fields must not discard otherwise safe screenshots.
 use flowproof_driver::{AppDriver, UiaSelector};
-#[test]
-fn hidden_password_inputs_do_not_drop_frames_and_visible_passwords_stay_masked() {
-    if std::env::var("FLOWPROOF_E2E").as_deref() != Ok("1") {
-        return;
-    }
-    let _guard = flowproof_adapters::SharedBrowserGuard::new();
-    let html = r#"<html><body><input type='password' value='visible-secret' style='width:200px;height:40px'><section id='later' style='display:none'><input type='password' value='hidden-secret'></section><button id='reveal' onclick="document.getElementById('later').style.display='block'">Reveal</button></body></html>"#;
+
+/// Serve a static page on its own loopback port and return the port.
+fn serve(html: &'static str) -> u16 {
     let listener = std::net::TcpListener::bind("127.0.0.1:0").expect("fixture listener");
     let port = listener.local_addr().expect("fixture address").port();
     std::thread::spawn(move || {
@@ -17,6 +13,10 @@ fn hidden_password_inputs_do_not_drop_frames_and_visible_passwords_stay_masked()
             let _ = write!(stream, "HTTP/1.1 200 OK\r\nContent-Type: text/html\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{}", html.len(), html);
         }
     });
+    port
+}
+
+fn launch(port: u16) -> flowproof_adapters::WebAppDriver {
     let mut driver = flowproof_adapters::WebAppDriver::new().expect("Chrome launches");
     driver
         .launch(
@@ -25,6 +25,18 @@ fn hidden_password_inputs_do_not_drop_frames_and_visible_passwords_stay_masked()
             std::time::Duration::from_secs(30),
         )
         .expect("fixture loads");
+    driver
+}
+
+#[test]
+fn hidden_password_inputs_do_not_drop_frames_and_visible_passwords_stay_masked() {
+    if std::env::var("FLOWPROOF_E2E").as_deref() != Ok("1") {
+        return;
+    }
+    let _guard = flowproof_adapters::SharedBrowserGuard::new();
+    let html = r#"<html><body><input type='password' value='visible-secret' style='width:200px;height:40px'><section id='later' style='display:none'><input type='password' value='hidden-secret'></section><button id='reveal' onclick="document.getElementById('later').style.display='block'">Reveal</button></body></html>"#;
+    let port = serve(html);
+    let mut driver = launch(port);
 
     let rects = flowproof_driver::redact::resolve_rects(&mut driver, &[])
         .expect("hidden inputs are safe to skip");
@@ -51,3 +63,20 @@ fn hidden_password_inputs_do_not_drop_frames_and_visible_passwords_stay_masked()
         2
     );
 }
+
+#[test]
+fn pages_without_password_inputs_resolve_to_no_masks() {
+    if std::env::var("FLOWPROOF_E2E").as_deref() != Ok("1") {
+        return;
+    }
+    let _guard = flowproof_adapters::SharedBrowserGuard::new();
+    // No password input anywhere: the common case must resolve to no masks,
+    // not fail the resolve (which would drop every recorded frame).
+    let port = serve(r#"<html><body><div>nothing sensitive</div></body></html>"#);
+    let mut driver = launch(port);
+    assert_eq!(
+        flowproof_driver::redact::resolve_rects(&mut driver, &[])
+            .expect("password-less pages resolve their masks"),
+        Vec::new()
+    );
+}

{flowproof-0.23.8 → flowproof-0.23.9}/crates/flowproof-agent/src/recorder.rs

@@ -112,19 +112,6 @@ pub enum RecordError {
     MissingUrl,
     #[error("app 'vision' requires a `window:` field in the spec (title of the window to drive)")]
     MissingWindow,
-    /// A surface named an identity nothing can act as yet. `login:` parses
-    /// and validates on a surface entry — it is the shape a same-system
-    /// two-user case wants — but no surface stages its credentials, so
-    /// recording it would drive whatever session was already open while the
-    /// spec says otherwise. That is the exact confusion `login:` exists to
-    /// prevent, so it is refused by name rather than run as somebody else.
-    #[error(
-        "surface `{0}` declares `login:`, but no surface logs itself in yet — recording it \
-         would drive whatever SAP session is already open, as whoever opened it. Until the \
-         engine lands, put each identity on its own single-surface `app: sap` flow with a \
-         `login:` block and chain the case with `exports:`"
-    )]
-    SurfaceLogin(String),
     #[error("element for step '{intent}' not found: [{selector}]")]
     ElementNotFound { intent: String, selector: String },
     /// `expected` and `actual` are complete phrases, not bare values: the
@@ -417,6 +404,8 @@ fn selectors_for(app: &str, target: &Target, label: Option<&str>) -> Vec<Selecto
             vec![Selector {
                 tier: SelectorTier::TextAnchor,
                 provenance: match app {
+                    "api" => flowproof_trace::format::Adapter::Api,
+                    "agent" => flowproof_trace::format::Adapter::Agent,
                     "web" => flowproof_trace::format::Adapter::Web,
                     "sap" => flowproof_trace::format::Adapter::SapCom,
                     "vision" => flowproof_trace::format::Adapter::Vision,
@@ -1262,12 +1251,7 @@ fn surface_app_info(surface: &crate::spec::SurfaceSpec) -> AppInfo {
         // A web surface's launch/emulation shape travels with the surface,
         // so record and every replay stage it before THIS surface launches.
         browser: surface.browser.clone(),
-        // Deliberately not `surface.login`: no surface logs itself in yet,
-        // so a recording never acted as that user, and a header that named
-        // one would be claiming evidence the run does not have. Record
-        // refuses such a flow by name (`RecordError::SurfaceLogin`), so
-        // this arm is only ever reached by a surface with no `login:`.
-        login_user: None,
+        login_user: surface.login.as_ref().map(|login| login.user.clone()),
         version: None,
     }
 }
@@ -1282,14 +1266,11 @@ pub fn surface_targets(
     spec.apps
         .iter()
         .map(|(name, surface)| {
-            // The one surface shape that parses but cannot be driven: an
-            // identity nothing stages. Refused here, at the launch seam
-            // both `record` and `heal` pass through, so no trace is ever
-            // written claiming a user the run never was.
-            if surface.login.is_some() {
-                return Err(RecordError::SurfaceLogin(name.clone()));
-            }
             let target = match surface.app.id() {
+                "api" | "agent" => flowproof_driver::AppTarget {
+                    command: String::new(),
+                    window_name: String::new(),
+                },
                 "web" => {
                     let url = surface.url.as_deref().ok_or(RecordError::MissingUrl)?;
                     let url = flowproof_trace::secret::resolve_refs(url)?;
@@ -2747,6 +2728,11 @@ pub fn record_with_reuse_and_options<D: AppDriver, C: ModelClient>(
     if let Some(login) = &spec.login {
         driver.stage_credentials(login.resolved()?)?;
     }
+    for (name, surface) in &spec.apps {
+        if let Some(login) = &surface.login {
+            driver.stage_surface_credentials(name, login.resolved()?)?;
+        }
+    }
     if !spec.mock.is_empty() {
         driver.stage_mocks(spec.mock.iter().map(web_mock_from_rule).collect())?;
     }
@@ -2923,6 +2909,28 @@ pub fn record_with_reuse_and_options<D: AppDriver, C: ModelClient>(
                     }
                 }
                 current_surface = Some(block.surface.clone());
+                if spec.apps[&block.surface].app.id() == "agent" {
+                    let raw_steps = serde_json::to_value(&block.steps).map_err(|e| {
+                        RecordError::Driver(flowproof_driver::DriverError::Uia(e.to_string()))
+                    })?;
+                    let cassette = driver.agent_segment(&raw_steps, None, &captures)?;
+                    steps.push(flowproof_trace::Step {
+                        id: format!("s{:04}", steps.len() + 1),
+                        intent: format!("Run agent {}", block.surface),
+                        surface: current_surface.clone(),
+                        action: Action::AgentRun(flowproof_trace::format::AgentRunParams {
+                            steps: raw_steps,
+                            cassette,
+                        }),
+                        selectors: Vec::new(),
+                        sync: flowproof_trace::format::Sync {
+                            pre: Vec::new(),
+                            post: Vec::new(),
+                        },
+                        artifacts: Default::default(),
+                    });
+                    continue;
+                }
                 for (i, inner) in block.steps.iter().enumerate() {
                     queue.insert(i, (inner.clone(), 0));
                 }
@@ -6698,30 +6706,20 @@ steps:
         );
     }
 
-    /// `login:` on a surface parses and validates — it is the shape a
-    /// same-system two-user case wants — but nothing stages a surface's
-    /// credentials yet. Launching anyway would drive whatever session was
-    /// already open while the spec names somebody else, so the launch seam
-    /// refuses by name and no trace is written claiming that identity.
     #[test]
-    fn a_surface_that_names_a_login_refuses_to_launch() {
-        let spec = FlowSpec::parse(
-            "name: Two users\napps:\n  \
-             clerk: {app: sap, connection: TS3, login: {user: obeva, password: pw}}\n  \
-             portal: {app: web, url: 'http://x'}\nsteps:\n  - in: clerk\n    \
-             steps: [Go to /nVA01]\n  - in: portal\n    steps: [Click \"Search\"]\n",
-        )
-        .expect("spec parses — the refusal is at launch, not at parse");
-        let err = surface_targets(&spec).expect_err("a surface login cannot launch");
-        let message = err.to_string();
-        assert!(
-            message.contains("clerk") && message.contains("logs itself in"),
-            "the refusal names the surface and the gap: {message}"
-        );
-        assert!(
-            message.contains("exports:"),
-            "and names the shape that does work today: {message}"
+    fn surface_login_targets_and_header_keep_identity_without_password() {
+        let spec = FlowSpec::parse("name: users\napps:\n  clerk: {app: sap, connection: TS3, login: {user: clerk, password: secret}}\nsteps:\n  - in: clerk\n    steps: [Go to /nVA01]\n").expect("valid login test fixture");
+        assert_eq!(
+            surface_targets(&spec).expect("valid login test fixture")[0]
+                .1
+                .command,
+            "TS3"
         );
+        let info = surface_app_info(&spec.apps["clerk"]);
+        assert_eq!(info.login_user.as_deref(), Some("clerk"));
+        assert!(!serde_json::to_string(&info)
+            .expect("valid login test fixture")
+            .contains("secret"));
     }
 
     /// The counterpart: surfaces without `login:` still launch, so the

{flowproof-0.23.8 → flowproof-0.23.9}/crates/flowproof-agent/src/spec.rs

@@ -119,10 +119,7 @@ pub struct SurfaceSpec {
     /// For sap surfaces: who this surface logs in as, exactly as on a
     /// single-surface flow. This is the shape a same-system two-user case
     /// wants — one flow, `clerk` and `approver` surfaces, one identity each.
-    /// It parses and validates today, but the multi-surface driver does not
-    /// log a surface in yet (docs/multi-surface.md), so the same case is a
-    /// suite of single-surface flows chained with `exports:`, one `login:`
-    /// each, until it does.
+    /// Staged separately for each surface before its first activation.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub login: Option<LoginSpec>,
     /// For web surfaces: launch/emulation config (viewport, user-agent,
@@ -138,6 +135,14 @@ pub struct SurfaceSpec {
     /// sized with `browser: viewport`, not a window.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub window: Option<WindowSpec>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub agent: Option<AgentSpec>,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub tools: Vec<ToolMock>,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub mcp: Vec<McpServerSpec>,
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub strict: bool,
 }
 
 /// Who a SAP flow logs in as. Every value may carry `${VAR}` references,
@@ -1090,6 +1095,29 @@ impl FlowSpec {
     /// it goes. (`assert_screenshot` needs no rule here: the recorder
     /// qualifies each baseline with its surface, so a `gui` baseline can
     /// never be compared against a `portal` frame.)
+    /// Agent execution uses the existing single-agent contract per block.
+    pub fn surface_flow(&self, name: &str, steps: Vec<SpecStep>) -> Result<Self, SpecError> {
+        let surface = self
+            .apps
+            .get(name)
+            .ok_or_else(|| SpecError::Surfaces(format!("Unknown surface {name}")))?;
+        let mut flow = self.clone();
+        flow.apps.clear();
+        flow.app = surface.app.clone();
+        flow.url = surface.url.clone();
+        flow.connection = surface.connection.clone();
+        flow.browser = surface.browser.clone();
+        flow.window = surface.window.clone();
+        flow.login = surface.login.clone();
+        flow.agent = surface.agent.clone();
+        flow.tools = surface.tools.clone();
+        flow.mcp = surface.mcp.clone();
+        flow.strict = surface.strict;
+        flow.steps = steps;
+        flow.exports.clear();
+        Ok(flow)
+    }
+
     fn validate_surfaces(&self) -> Result<(), SpecError> {
         let bad = |m: String| Err(SpecError::Surfaces(m));
         let multi = !self.apps.is_empty();
@@ -1130,21 +1158,19 @@ impl FlowSpec {
                 return bad(format!("surface `{name}` names no app"));
             }
             let id = surface.app.id();
-            match id {
-                "agent" => {
-                    return bad(format!(
-                        "surface `{name}`: `agent` is a model boundary, not a UI surface — \
-                         chain an `app: agent` flow in the suite instead (docs/multi-surface.md \
-                         defers the in-flow agent seam deliberately)"
-                    ))
-                }
-                "api" => {
-                    return bad(format!(
-                        "surface `{name}`: an `api` surface has nothing to drive — \
-                         `assert_api` runs fine inside any `in:` block"
-                    ))
-                }
-                _ => {}
+            self.surface_flow(
+                name,
+                if id == "agent" {
+                    vec![SpecStep::Prompt {
+                        prompt: "validate configuration".into(),
+                    }]
+                } else {
+                    Vec::new()
+                },
+            )?
+            .validate_agent()?;
+            if matches!(id, "agent" | "api") && surface.window.is_some() {
+                return bad(format!("surface `{name}` has no window"));
             }
             if id == "web" && surface.url.is_none() {
                 return bad(format!("web surface `{name}` needs `url:`"));
@@ -1227,6 +1253,39 @@ impl FlowSpec {
                     declared()
                 ));
             }
+            self.surface_flow(&block.surface, block.steps.clone())?
+                .validate_agent()?;
+            if self.apps[&block.surface].app.id() == "agent"
+                && block.steps.iter().any(|s| {
+                    !matches!(
+                        s,
+                        SpecStep::Prompt { .. }
+                            | SpecStep::Conversation { .. }
+                            | SpecStep::Assert { .. }
+                            | SpecStep::AssertToolCall { .. }
+                            | SpecStep::AssertNoToolCall { .. }
+                            | SpecStep::AssertNoEgress
+                            | SpecStep::AssertNoSideEffect { .. }
+                            | SpecStep::AssertNoSecretLeak { .. }
+                    )
+                })
+            {
+                return bad(format!(
+                    "Agent surface {} accepts prompts, scripted conversations and agent assertions",
+                    block.surface
+                ));
+            }
+            if self.apps[&block.surface].app.id() == "api"
+                && block
+                    .steps
+                    .iter()
+                    .any(|s| !matches!(s, SpecStep::AssertApi { .. } | SpecStep::AssertSql { .. }))
+            {
+                return bad(format!(
+                    "API surface {} accepts assert_api and assert_sql steps",
+                    block.surface
+                ));
+            }
             if block.steps.is_empty() {
                 return bad(format!("`in: {}` has no steps", block.surface));
             }
@@ -1280,7 +1339,7 @@ impl FlowSpec {
         if self.agent.is_some() || !self.tools.is_empty() || !self.mcp.is_empty() || self.strict {
             return bad(
                 "`agent:`, `tools:`, `mcp:` and `strict:` belong to an `app: agent` flow \
-                 — an agent is a model boundary, not a surface"
+                 — put them inside its `apps:` entry"
                     .into(),
             );
         }
@@ -4360,8 +4419,11 @@ steps:
     /// Each refused surface kind names its reason and its alternative —
     /// a vocabulary that parses but cannot run would be a trap.
     #[test]
-    fn non_ui_surface_kinds_are_refused_by_name() {
-        for (kind, expect) in [("agent", "model boundary"), ("api", "nothing to drive")] {
+    fn invalid_non_ui_surface_configuration_is_refused_by_name() {
+        for (kind, expect) in [
+            ("agent", "needs an `agent:` block"),
+            ("api", "accepts assert_api"),
+        ] {
             let err = spec(&format!(
                 "name: n\napps:\n  s: {{app: {kind}}}\nsteps:\n  - in: s\n    steps: [Press Enter]\n"
             ))

{flowproof-0.23.8 → flowproof-0.23.9}/crates/flowproof-cli/Cargo.toml

@@ -16,6 +16,7 @@ name = "flowproof"
 path = "src/main.rs"
 
 [dependencies]
+uuid = { workspace = true, features = ["v4"] }
 chrono = { workspace = true }
 clap = { workspace = true }
 # Cross-platform Ctrl-C handling for the long-lived `capture` listener, so a

{flowproof-0.23.8 → flowproof-0.23.9}/crates/flowproof-cli/src/agent_flow.rs

@@ -4201,6 +4201,91 @@ mod tests {
         assert!(!out.exists());
     }
 
+    #[test]
+    fn mixed_api_agent_pipeline_records_and_replays_in_order() {
+        let _guard = INTERACTIVE_ENV_LOCK
+            .lock()
+            .unwrap_or_else(|e| e.into_inner());
+        let dir = ConversationTestDir::new();
+        let agent = write_fake_interactive_agent();
+        let (url, handle) = spawn_fake_upstream(vec!["hello"]);
+        let listener = std::net::TcpListener::bind("127.0.0.1:0").expect("mixed pipeline fixture");
+        let api_url = format!(
+            "http://{}",
+            listener.local_addr().expect("mixed pipeline fixture")
+        );
+        let server = std::thread::spawn(move || {
+            use std::io::{Read, Write};
+            for _ in 0..4 {
+                let (mut socket, _) = listener.accept().expect("mixed pipeline fixture");
+                let mut request = [0; 8192];
+                let read = socket.read(&mut request).expect("read request");
+                assert!(read > 0);
+                socket
+                    .write_all(
+                        b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\nConnection: close\r\n\r\nOK",
+                    )
+                    .expect("mixed pipeline fixture");
+            }
+        });
+        std::env::set_var("FLOWPROOF_AGENT_UPSTREAM", url);
+        let spec = FlowSpec::parse(&format!("name: mixed\napps:\n  api:\n    app: api\n  assistant:\n    app: agent\n    agent:\n      command: python3 \"{}\"\nsteps:\n  - in: api\n    steps:\n      - assert_api:\n          request: GET {api_url}\n  - in: assistant\n    steps:\n      - prompt: hi\n      - assert: reply contains hello\n  - in: api\n    steps:\n      - assert_api:\n          request: GET {api_url}\n", agent.display())).expect("mixed pipeline fixture");
+        let path = dir.path().join("mixed.trace.jsonl");
+        let mut driver = crate::record_driver(&spec).expect("mixed pipeline fixture");
+        let result = flowproof_agent::recorder::record_with_author(
+            &spec,
+            &mut driver,
+            &path,
+            flowproof_agent::recorder::Author::Rules,
+        );
+        std::env::remove_var("FLOWPROOF_AGENT_UPSTREAM");
+        result.expect("record mixed flow");
+        handle.join().expect("mixed pipeline fixture");
+        let (header, steps) = flowproof_replay::load_trace(&path).expect("mixed pipeline fixture");
+        assert_eq!(
+            steps
+                .iter()
+                .map(|s| s.surface.as_deref())
+                .collect::<Vec<_>>(),
+            vec![Some("api"), Some("assistant"), Some("api")]
+        );
+        assert!(matches!(
+            steps[1].action,
+            flowproof_trace::format::Action::AgentRun(_)
+        ));
+        let mut driver = crate::replay_driver(&header, &spec).expect("mixed pipeline fixture");
+        let (report, _) =
+            flowproof_replay::run_trace(&path, &mut driver).expect("mixed pipeline fixture");
+        assert!(report.passed, "{report:?}");
+        server.join().expect("mixed pipeline fixture");
+    }
+
+    #[test]
+    fn agent_surface_records_and_replays_without_upstream() {
+        use flowproof_driver::AppDriver;
+        let _guard = INTERACTIVE_ENV_LOCK
+            .lock()
+            .unwrap_or_else(|e| e.into_inner());
+        let agent = write_fake_interactive_agent();
+        let (url, handle) = spawn_fake_upstream(vec!["hello"]);
+        std::env::set_var("FLOWPROOF_AGENT_UPSTREAM", url);
+        let spec = FlowSpec::parse(&format!("name: mixed\napps:\n  assistant:\n    app: agent\n    agent:\n      command: python3 \"{}\"\n  api:\n    app: api\nsteps:\n  - in: assistant\n    steps:\n      - prompt: hi\n      - assert: reply contains hello\n  - in: api\n    steps:\n      - assert_api:\n          request: GET http://localhost/health\n", agent.display())).expect("mixed spec");
+        let captures = [("greeting".into(), "hi".into())].into_iter().collect();
+        let steps = serde_json::json!([{"prompt":"${captured.greeting}"}, {"assert":"reply contains hello"}]);
+        let mut driver = crate::agent_surface::AgentSurface::new(spec, "assistant".into());
+        let cassette = driver.agent_segment(&steps, None, &captures);
+        std::env::remove_var("FLOWPROOF_AGENT_UPSTREAM");
+        handle.join().expect("upstream completed");
+        let cassette = cassette.expect("record agent segment");
+        driver
+            .agent_segment(&steps, Some(&cassette), &captures)
+            .expect("offline replay");
+        let bad = serde_json::json!([{"prompt":"hi"}, {"assert":"reply contains WRONG"}]);
+        assert!(driver
+            .agent_segment(&bad, Some(&cassette), &captures)
+            .is_err());
+    }
+
     #[test]
     fn scripted_conversation_records_delivery_metadata_and_replays() {
         let _guard = INTERACTIVE_ENV_LOCK