Capture release-bound browser readiness evidence

[cvsz]

Summary

• capture ZChat browser evidence with locked Playwright/Chromium on the deployed staging origin
• require /health/live to report the exact immutable release SHA
• sanitize HAR headers, cookies, query strings, request bodies, and response bodies before artifact upload
• replace stale base64 browser secrets in Phase 6 and final readiness workflows with release-bound artifacts
• pin newly introduced artifact actions and test workflow/security invariants

Verification

• pnpm test
• pnpm lint
• pnpm typecheck
• ECC pre-commit and pre-push checks

[ecc-tools]

ECC bundle files are already tracked in this repository. Skipping generation of another bundle PR.

[gemini-code-assist]

Code Review

This pull request adds a script to capture and sanitize browser evidence from a deployed release using Playwright, along with corresponding tests and dependency updates. The review feedback identifies a security vulnerability where raw, unsanitized HAR files containing sensitive credentials are temporarily written to the shared /tmp directory. It is recommended to write these temporary files inside the securely configured outputDir instead to prevent unauthorized local access.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

Security Vulnerability: Insecure Temporary File in Shared Directory (CWE-377 / CWE-276)

Writing the raw, unsanitized HAR file directly to /tmp poses a high security risk. On Unix-like systems, /tmp is a shared directory. Playwright's recordHar creates files with default permissions (subject to the system umask, typically 0o644 or 0o664), making them readable by any local user or process on the machine.

Since the raw HAR file contains highly sensitive credentials—such as the Cloudflare Access client secret (STAGING_CF_ACCESS_CLIENT_SECRET), session cookies, and authorization headers—before they are sanitized, any local attacker could read these secrets during the window of time the script is running.

Solution

Since outputDir is already created with secure 0o700 permissions (owner-only access) on line 88, we should write the temporary raw HAR file inside outputDir instead of /tmp. This ensures that the file is fully protected by the parent directory's restricted permissions and cannot be accessed by other users, completely mitigating the vulnerability.

Suggested change

	const rawHarPath = `/tmp/zchat-browser-${process.pid}.har`;
	const rawHarPath = outputDir + "/.raw-zchat-browser-" + process.pid + ".har";

References

1. The repository style guide states that z-platform is a security-first platform. Writing sensitive raw credentials to a world-readable temporary file in /tmp violates this security-first design goal. ^(link)