Vendor OpenClaw source as Adolf fork baseline

Adolf is a fork/vendored clone of github.com/openclaw/openclaw (v2026.6.11),
free to diverge. Tree copied sans upstream .git; upstream remote added for
future syncs. Node pinned to 24 (.nvmrc); engines already require >=22.19.
Preserves docs/ARCHITECTURE.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LeqyaxJF2nbRXJtae2kNB2

extensions/qa-lab/web/src/assets.d.ts

@@ -0,0 +1,2 @@
+// Qa Lab type declarations define plugin contracts.
+declare module "*.css";

extensions/qa-lab/web/src/capture-saved-view.test.ts

@@ -0,0 +1,106 @@
+// Qa Lab tests cover capture saved view plugin behavior.
+import { describe, expect, it } from "vitest";
+import { normalizeCaptureSavedView, normalizeCaptureSavedViews } from "./capture-saved-view.js";
+
+describe("capture saved views", () => {
+  it("drops non-object and nameless saved views", () => {
+    expect(normalizeCaptureSavedView(null)).toBeNull();
+    expect(normalizeCaptureSavedView({ id: "view-1" })).toBeNull();
+    expect(normalizeCaptureSavedViews([{ id: "view-1" }, "bad", null])).toEqual([]);
+  });
+
+  it("keeps valid saved view fields", () => {
+    expect(
+      normalizeCaptureSavedView({
+        id: "view-1",
+        name: "Errors",
+        sessionIds: ["session-a"],
+        kindFilter: ["request"],
+        providerFilter: ["openai"],
+        hostFilter: ["api.example.test"],
+        searchText: "timeout",
+        headerMode: "all",
+        viewMode: "timeline",
+        groupMode: "flow",
+        timelineLaneMode: "provider",
+        timelineLaneSort: "severity",
+        timelineZoom: 200,
+        timelineSparklineMode: "lane-relative",
+        errorsOnly: true,
+        detailPlacement: "bottom",
+        payloadLayout: "raw",
+        payloadExtent: "full",
+      }),
+    ).toEqual({
+      id: "view-1",
+      name: "Errors",
+      sessionIds: ["session-a"],
+      kindFilter: ["request"],
+      providerFilter: ["openai"],
+      hostFilter: ["api.example.test"],
+      searchText: "timeout",
+      headerMode: "all",
+      viewMode: "timeline",
+      groupMode: "flow",
+      timelineLaneMode: "provider",
+      timelineLaneSort: "severity",
+      timelineZoom: 200,
+      timelineSparklineMode: "lane-relative",
+      errorsOnly: true,
+      detailPlacement: "bottom",
+      payloadLayout: "raw",
+      payloadExtent: "full",
+    });
+  });
+
+  it("falls back invalid enum and scalar fields to safe defaults", () => {
+    expect(
+      normalizeCaptureSavedView({
+        id: "view-1",
+        name: "Corrupt",
+        sessionIds: ["session-a", 42, "  "],
+        kindFilter: "request",
+        providerFilter: ["openai"],
+        hostFilter: null,
+        searchText: 123,
+        headerMode: "everything",
+        viewMode: "grid",
+        groupMode: "cards",
+        timelineLaneMode: "host",
+        timelineLaneSort: "random",
+        timelineZoom: 999,
+        timelineSparklineMode: "global",
+        errorsOnly: "yes",
+        detailPlacement: "left",
+        payloadLayout: "html",
+        payloadExtent: "all",
+      }),
+    ).toMatchObject({
+      sessionIds: ["session-a"],
+      kindFilter: [],
+      providerFilter: ["openai"],
+      hostFilter: [],
+      searchText: "",
+      headerMode: "key",
+      viewMode: "list",
+      groupMode: "none",
+      timelineLaneMode: "domain",
+      timelineLaneSort: "most-events",
+      timelineZoom: 100,
+      timelineSparklineMode: "session-relative",
+      errorsOnly: false,
+      detailPlacement: "right",
+      payloadLayout: null,
+      payloadExtent: "preview",
+    });
+  });
+
+  it("caps loaded saved views to the UI limit", () => {
+    const views = Array.from({ length: 20 }, (_, index) => ({
+      id: `view-${index}`,
+      name: `View ${index}`,
+    }));
+
+    expect(normalizeCaptureSavedViews(views)).toHaveLength(12);
+  });
+});

extensions/qa-lab/web/src/capture-saved-view.ts

@@ -0,0 +1,124 @@
+// Qa Lab plugin module implements capture saved view behavior.
+import type { CaptureSavedView } from "./ui-render.js";
+
+const MAX_SAVED_VIEWS = 12;
+const MAX_FILTER_ITEMS = 64;
+const MAX_FILTER_VALUE_LENGTH = 256;
+const MAX_NAME_LENGTH = 80;
+const MAX_SEARCH_TEXT_LENGTH = 500;
+
+const headerModes = new Set<CaptureSavedView["headerMode"]>(["key", "all", "hidden"]);
+const viewModes = new Set<CaptureSavedView["viewMode"]>(["list", "timeline"]);
+const groupModes = new Set<CaptureSavedView["groupMode"]>(["none", "flow", "host-path", "burst"]);
+const timelineLaneModes = new Set<CaptureSavedView["timelineLaneMode"]>([
+  "domain",
+  "provider",
+  "flow",
+]);
+const timelineLaneSorts = new Set<CaptureSavedView["timelineLaneSort"]>([
+  "most-events",
+  "most-errors",
+  "severity",
+  "alphabetical",
+]);
+const timelineZooms = new Set<CaptureSavedView["timelineZoom"]>([75, 100, 150, 200, 300]);
+const timelineSparklineModes = new Set<CaptureSavedView["timelineSparklineMode"]>([
+  "session-relative",
+  "lane-relative",
+]);
+const detailPlacements = new Set<CaptureSavedView["detailPlacement"]>(["right", "bottom"]);
+const payloadLayouts = new Set<NonNullable<CaptureSavedView["payloadLayout"]>>([
+  "formatted",
+  "raw",
+]);
+const payloadExtents = new Set<CaptureSavedView["payloadExtent"]>(["preview", "full"]);
+
+function readString(value: unknown, maxLength: number): string | null {
+  if (typeof value !== "string") {
+    return null;
+  }
+  const trimmed = value.trim();
+  return trimmed ? trimmed.slice(0, maxLength) : null;
+}
+
+function readStringArray(value: unknown): string[] {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return value
+    .filter((item): item is string => typeof item === "string")
+    .map((item) => item.trim().slice(0, MAX_FILTER_VALUE_LENGTH))
+    .filter(Boolean)
+    .slice(0, MAX_FILTER_ITEMS);
+}
+
+function readEnum<T extends string>(value: unknown, allowed: Set<T>, fallback: T): T {
+  return typeof value === "string" && allowed.has(value as T) ? (value as T) : fallback;
+}
+
+function readNullableEnum<T extends string>(value: unknown, allowed: Set<T>): T | null {
+  return typeof value === "string" && allowed.has(value as T) ? (value as T) : null;
+}
+
+function readTimelineZoom(value: unknown): CaptureSavedView["timelineZoom"] {
+  return typeof value === "number" && timelineZooms.has(value as CaptureSavedView["timelineZoom"])
+    ? (value as CaptureSavedView["timelineZoom"])
+    : 100;
+}
+
+export function normalizeCaptureSavedView(value: unknown): CaptureSavedView | null {
+  const record =
+    typeof value === "object" && value !== null ? (value as Record<string, unknown>) : null;
+  if (!record) {
+    return null;
+  }
+  const id = readString(record.id, MAX_FILTER_VALUE_LENGTH);
+  const name = readString(record.name, MAX_NAME_LENGTH);
+  if (!id || !name) {
+    return null;
+  }
+  return {
+    id,
+    name,
+    sessionIds: readStringArray(record.sessionIds),
+    kindFilter: readStringArray(record.kindFilter),
+    providerFilter: readStringArray(record.providerFilter),
+    hostFilter: readStringArray(record.hostFilter),
+    searchText:
+      typeof record.searchText === "string"
+        ? record.searchText.slice(0, MAX_SEARCH_TEXT_LENGTH)
+        : "",
+    headerMode: readEnum(record.headerMode, headerModes, "key"),
+    viewMode: readEnum(record.viewMode, viewModes, "list"),
+    groupMode: readEnum(record.groupMode, groupModes, "none"),
+    timelineLaneMode: readEnum(record.timelineLaneMode, timelineLaneModes, "domain"),
+    timelineLaneSort: readEnum(record.timelineLaneSort, timelineLaneSorts, "most-events"),
+    timelineZoom: readTimelineZoom(record.timelineZoom),
+    timelineSparklineMode: readEnum(
+      record.timelineSparklineMode,
+      timelineSparklineModes,
+      "session-relative",
+    ),
+    errorsOnly: record.errorsOnly === true,
+    detailPlacement: readEnum(record.detailPlacement, detailPlacements, "right"),
+    payloadLayout: readNullableEnum(record.payloadLayout, payloadLayouts),
+    payloadExtent: readEnum(record.payloadExtent, payloadExtents, "preview"),
+  };
+}
+
+export function normalizeCaptureSavedViews(value: unknown): CaptureSavedView[] {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  const views: CaptureSavedView[] = [];
+  for (const item of value) {
+    const view = normalizeCaptureSavedView(item);
+    if (view) {
+      views.push(view);
+    }
+    if (views.length >= MAX_SAVED_VIEWS) {
+      break;
+    }
+  }
+  return views;
+}

extensions/qa-lab/web/src/errors.ts

@@ -0,0 +1,34 @@
+// Qa Lab plugin module implements errors behavior.
+export function formatErrorMessage(err: unknown): string {
+  if (err instanceof Error) {
+    let formatted = err.message || err.name || "Error";
+    let cause: unknown = err.cause;
+    const seen = new Set<unknown>([err]);
+    while (cause && !seen.has(cause)) {
+      seen.add(cause);
+      if (cause instanceof Error) {
+        if (cause.message) {
+          formatted += ` | ${cause.message}`;
+        }
+        cause = cause.cause;
+        continue;
+      }
+      if (typeof cause === "string") {
+        formatted += ` | ${cause}`;
+      }
+      break;
+    }
+    return formatted;
+  }
+  if (typeof err === "string") {
+    return err;
+  }
+  if (typeof err === "number" || typeof err === "boolean" || typeof err === "bigint") {
+    return String(err);
+  }
+  try {
+    return JSON.stringify(err);
+  } catch {
+    return Object.prototype.toString.call(err);
+  }
+}

extensions/qa-lab/web/src/main.ts

@@ -0,0 +1,11 @@
+// Qa Lab plugin module implements main behavior.
+import "./styles.css";
+import { createQaLabApp } from "./app.js";
+
+const root = document.querySelector<HTMLDivElement>("#app");
+
+if (!root) {
+  throw new Error("QA Lab app root missing");
+}
+
+void createQaLabApp(root);

extensions/qa-lab/web/src/ui-render.test.ts

@@ -0,0 +1,413 @@
+// Qa Lab UI render tests cover evidence gallery affordances.
+import { describe, expect, it } from "vitest";
+import { renderQaLabUi, type UiState } from "./ui-render.js";
+
+function evidenceState(overrides: Partial<UiState> = {}): UiState {
+  return {
+    activeTab: "evidence",
+    bootstrap: null,
+    busy: false,
+    captureCollapsedLaneIds: [],
+    captureControlsExpanded: true,
+    captureCoverage: null,
+    captureDetailPlacement: "right",
+    captureDetailSplitDragging: false,
+    captureDetailSplitPct: 35,
+    captureDetailView: "overview",
+    captureErrorsOnly: false,
+    captureEvents: [],
+    captureFlowDetailLayout: null,
+    captureGroupMode: "none",
+    captureHeaderMode: "key",
+    captureHostFilter: [],
+    captureKindFilter: [],
+    capturePayloadDetailLayout: null,
+    capturePayloadEventFilter: "",
+    capturePayloadEventSort: "stream",
+    capturePayloadExtent: "preview",
+    capturePinnedLaneIds: [],
+    capturePreferredDetailView: null,
+    captureProviderFilter: [],
+    captureQueryPreset: "none",
+    captureQueryRows: [],
+    captureSavedViews: [],
+    captureSearchText: "",
+    captureSelectedSessionsExpanded: true,
+    captureSessions: [],
+    captureStartupStatus: null,
+    captureSummaryExpanded: true,
+    captureTimelineBrushAnchorPct: null,
+    captureTimelineBrushCurrentPct: null,
+    captureTimelineFocusSelectedFlow: false,
+    captureTimelineFocusedLaneMode: "all",
+    captureTimelineFocusedLaneThreshold: "any",
+    captureTimelineLaneMode: "domain",
+    captureTimelineLaneSearch: "",
+    captureTimelineLaneSort: "most-events",
+    captureTimelinePreviousLaneSort: null,
+    captureTimelineSparklineMode: "session-relative",
+    captureTimelineWindowEndPct: null,
+    captureTimelineWindowStartPct: null,
+    captureTimelineZoom: 100,
+    captureViewMode: "list",
+    composer: {
+      conversationId: "",
+      conversationKind: "direct",
+      senderId: "",
+      senderName: "",
+      text: "",
+    },
+    error: null,
+    evidence: null,
+    evidenceArtifactFilter: "all",
+    evidenceError: null,
+    evidenceLoading: false,
+    evidencePathDraft: "",
+    evidenceSearchText: "",
+    evidenceStatusFilter: "all",
+    latestReport: null,
+    runnerDraft: null,
+    runnerDraftDirty: false,
+    scenarioRun: null,
+    selectedCaptureEventKey: null,
+    selectedCaptureSessionIds: [],
+    selectedConversationId: null,
+    selectedEvidenceEntryId: null,
+    selectedScenarioId: null,
+    selectedThreadId: null,
+    sidebarCollapsed: false,
+    sidebarPanel: "scenarios",
+    snapshot: null,
+    theme: "light",
+    ...overrides,
+  };
+}
+
+describe("QA Lab UI evidence render", () => {
+  it("renders capture startup commands without personal home paths", () => {
+    const html = renderQaLabUi(evidenceState({ activeTab: "capture" }));
+
+    expect(html).toContain("$HOME/.openclaw/debug-proxy/certs/root-ca.pem");
+    expect(html).not.toContain("/Users/");
+  });
+
+  it("maps blocked and skipped evidence statuses to styled tones", () => {
+    const html = renderQaLabUi(
+      evidenceState({
+        evidence: {
+          counts: { blocked: 1, fail: 0, pass: 0, skipped: 1 },
+          entries: [
+            {
+              artifacts: [],
+              coverage: [{ id: "qa.blocked", role: "primary" }],
+              failureReason: "Environment unavailable",
+              id: "qa-lab.blocked",
+              kind: "script-test",
+              sourcePath: "scripts/blocked.ts",
+              status: "blocked",
+              title: "Blocked evidence",
+            },
+            {
+              artifacts: [],
+              coverage: [{ id: "qa.skipped", role: "primary" }],
+              failureReason: null,
+              id: "qa-lab.skipped",
+              kind: "vitest-test",
+              sourcePath: "extensions/qa-lab/src/skipped.test.ts",
+              status: "skipped",
+              title: "Skipped evidence",
+            },
+          ],
+          evidenceMode: "full",
+          evidencePath: ".artifacts/qa-e2e/suite/qa-evidence.json",
+          generatedAt: "2026-06-17T12:00:00.000Z",
+          producerContext: null,
+          profile: null,
+          schemaVersion: 2,
+        },
+        selectedEvidenceEntryId: "qa-lab.blocked",
+      }),
+    );
+
+    expect(html).toContain("badge-pending");
+    expect(html).toContain("badge-skip");
+    expect(html).toContain("scenario-item-dot-pending");
+    expect(html).toContain("scenario-item-dot-skip");
+    expect(html).not.toContain("badge-blocked");
+    expect(html).not.toContain("badge-skipped");
+    expect(html).not.toContain("scenario-item-dot-blocked");
+  });
+
+  it("links executed UX Matrix cells to evidence entries and leaves proof gaps unlinked", () => {
+    const html = renderQaLabUi(
+      evidenceState({
+        evidence: {
+          counts: { blocked: 0, fail: 0, pass: 1, skipped: 0 },
+          entries: [
+            {
+              artifacts: [
+                {
+                  error: null,
+                  exists: true,
+                  href: "/api/evidence/artifact?artifactPath=screenshot.png",
+                  kind: "screenshot",
+                  mediaKind: "image",
+                  path: "screenshot.png",
+                  preview: null,
+                  source: "ux-matrix:web-ui:first-run",
+                },
+                {
+                  error: null,
+                  exists: true,
+                  href: "/api/evidence/artifact?artifactPath=recording.gif",
+                  kind: "motion-preview-gif",
+                  mediaKind: "image",
+                  path: "recording.gif",
+                  preview: null,
+                  source: "ux-matrix:web-ui:first-run",
+                },
+                {
+                  error: null,
+                  exists: true,
+                  href: "/api/evidence/artifact?artifactPath=recording.webm",
+                  kind: "video",
+                  mediaKind: "video",
+                  path: "recording.webm",
+                  preview: null,
+                  source: "ux-matrix:web-ui:first-run",
+                },
+              ],
+              coverage: [{ id: "ui.control", role: "primary" }],
+              failureReason: null,
+              id: "ux-matrix.web-ui.first-run",
+              kind: "ux-matrix-cell",
+              sourcePath: "scripts/ux-matrix/dashboard.ts",
+              status: "pass",
+              title: "UX Matrix: web-ui / first-run",
+            },
+          ],
+          evidenceMode: "full",
+          evidencePath: ".artifacts/qa-e2e/suite/qa-evidence.json",
+          generatedAt: "2026-06-17T12:00:00.000Z",
+          producerContext: {
+            commands: null,
+            kind: "ux-matrix",
+            manifest: {
+              href: "/api/evidence/artifact?artifactPath=manifest.json",
+              path: "manifest.json",
+              preview: null,
+              runId: "run-1",
+              runStatus: "pass",
+            },
+            matrix: {
+              cells: [
+                {
+                  artifactKinds: ["screenshot"],
+                  artifactPaths: ["screenshot.png"],
+                  coverageIds: ["ui.control"],
+                  runner: {
+                    availability: "local",
+                    command: "pnpm openclaw qa suite --scenario ux-matrix-evidence-dashboard",
+                    lane: "web-ui-playwright",
+                    workflow: ".github/workflows/ux-matrix-qa.yml#ux-matrix-local",
+                  },
+                  stage: "first-run",
+                  status: "pass",
+                  surface: "web-ui",
+                  testId: "ux-matrix.web-ui.first-run",
+                  title: "UX Matrix: web-ui / first-run",
+                },
+                {
+                  artifactKinds: [],
+                  artifactPaths: [],
+                  coverageIds: ["cli.entrypoint"],
+                  runner: {
+                    availability: "local",
+                    command: "pnpm openclaw qa suite --scenario ux-matrix-evidence-dashboard",
+                    lane: "cli-status",
+                    workflow: ".github/workflows/ux-matrix-qa.yml#ux-matrix-local",
+                  },
+                  stage: "first-run",
+                  status: "proof-gap",
+                  surface: "cli",
+                  testId: null,
+                  title: null,
+                },
+              ],
+              counts: { pass: 1, "proof-gap": 1 },
+              path: "matrix.json",
+              stages: ["first-run"],
+              surfaces: ["cli", "web-ui"],
+            },
+            preflight: { adbDevices: null, memory: null },
+            releaseLedger: null,
+            rootPath: ".artifacts/qa-e2e/suite/script/ux-matrix-evidence-dashboard/run-1",
+            scorecard: null,
+          },
+          profile: null,
+          schemaVersion: 2,
+        },
+        selectedEvidenceEntryId: "ux-matrix.web-ui.first-run",
+      }),
+    );
+
+    expect(html).toContain('data-evidence-entry-id="ux-matrix.web-ui.first-run"');
+    expect(html).toContain("evidence-matrix-cell-proof-gap");
+    expect(html).toContain("not executed in this run");
+    expect(html).toContain("Coverage: cli.entrypoint");
+    expect(html).toContain("Runner: cli-status");
+    expect(html).toContain("Open media artifact");
+    expect(html).toContain("Open video artifact");
+    expect(html).not.toContain('src="/api/evidence/artifact?artifactPath=recording.gif"');
+    expect(html).not.toContain("<video controls");
+    expect(html).not.toContain('data-evidence-entry-id="null"');
+  });
+
+  it("redacts secret-like capture payload fields in raw previews", () => {
+    const payload =
+      '{"message":"visible context","message":"duplicate context","completion_tokens":100,"cookies":["session=abc"],"apiToken":"secret-token","tokenValue":"token-value-secret","authTokens":["auth-token-secret"],"tokens":{"refresh":"refresh-token-secret"},"AWS_SECRET_ACCESS_KEY":"aws-secret","secretAccessKey":"access-secret","x-goog-api-key":"goog-secret","nested":{"password":"secret-password"}}';
+    const html = renderQaLabUi(
+      evidenceState({
+        activeTab: "capture",
+        captureDetailView: "payload",
+        capturePayloadDetailLayout: "raw",
+        captureEvents: [
+          {
+            contentType: "application/json",
+            dataText: payload,
+            direction: "outbound",
+            flowId: "flow-1",
+            host: "api.example.test",
+            id: 1,
+            kind: "request",
+            method: "POST",
+            path: "/v1/messages",
+            payloadPreview: payload,
+            protocol: "https",
+            provider: "mock",
+            ts: 1,
+          },
+        ],
+        selectedCaptureEventKey: "1:flow-1:1:request",
+      }),
+    );
+
+    expect(html).toContain("visible context");
+    expect(html).toContain("duplicate context");
+    expect(html).toContain("completion_tokens");
+    expect(html).toContain("100");
+    expect(html).toContain("apiToken");
+    expect(html).toContain("nested");
+    expect(html).toContain("[redacted]");
+    expect(html).not.toContain("session=abc");
+    expect(html).not.toContain("secret-token");
+    expect(html).not.toContain("token-value-secret");
+    expect(html).not.toContain("auth-token-secret");
+    expect(html).not.toContain("refresh-token-secret");
+    expect(html).not.toContain("aws-secret");
+    expect(html).not.toContain("access-secret");
+    expect(html).not.toContain("goog-secret");
+    expect(html).not.toContain("secret-password");
+  });
+
+  it("redacts secret-like fields when captured JSON previews are truncated", () => {
+    const payload =
+      '{"apiToken":"secret-token","nested":{"password":"secret-password"},"message":"visible context"';
+    for (const capturePayloadDetailLayout of ["raw", "formatted"] as const) {
+      const html = renderQaLabUi(
+        evidenceState({
+          activeTab: "capture",
+          captureDetailView: "payload",
+          capturePayloadDetailLayout,
+          captureEvents: [
+            {
+              contentType: "application/json",
+              dataText: payload,
+              direction: "outbound",
+              flowId: "flow-1",
+              host: "api.example.test",
+              id: 1,
+              kind: "request",
+              method: "POST",
+              path: "/v1/messages",
+              payloadPreview: payload,
+              protocol: "https",
+              provider: "mock",
+              ts: 1,
+            },
+          ],
+          selectedCaptureEventKey: "1:flow-1:1:request",
+        }),
+      );
+
+      expect(html).toContain("visible context");
+      expect(html).toContain("[redacted]");
+      expect(html).not.toContain("secret-token");
+      expect(html).not.toContain("secret-password");
+    }
+  });
+
+  it("redacts secret-like SSE data fields in formatted payloads", () => {
+    const payload = 'event: message\ndata: {"apiToken":"secret-token","message":"visible"}';
+    const html = renderQaLabUi(
+      evidenceState({
+        activeTab: "capture",
+        captureDetailView: "payload",
+        capturePayloadDetailLayout: "formatted",
+        captureEvents: [
+          {
+            contentType: "text/event-stream",
+            dataText: payload,
+            direction: "inbound",
+            flowId: "flow-1",
+            host: "api.example.test",
+            id: 1,
+            kind: "response",
+            path: "/v1/messages",
+            payloadPreview: payload,
+            protocol: "https",
+            provider: "mock",
+            ts: 1,
+          },
+        ],
+        selectedCaptureEventKey: "1:flow-1:1:response",
+      }),
+    );
+
+    expect(html).toContain("visible");
+    expect(html).toContain("[redacted]");
+    expect(html).not.toContain("secret-token");
+  });
+
+  it("redacts secret-like fields when capture cuts inside a JSON value", () => {
+    const payload = '{"apiToken":"secret-token';
+    const html = renderQaLabUi(
+      evidenceState({
+        activeTab: "capture",
+        captureDetailView: "payload",
+        capturePayloadDetailLayout: "raw",
+        captureEvents: [
+          {
+            contentType: "application/json",
+            dataText: payload,
+            direction: "outbound",
+            flowId: "flow-1",
+            host: "api.example.test",
+            id: 1,
+            kind: "request",
+            method: "POST",
+            path: "/v1/messages",
+            payloadPreview: payload,
+            protocol: "https",
+            provider: "mock",
+            ts: 1,
+          },
+        ],
+        selectedCaptureEventKey: "1:flow-1:1:request",
+      }),
+    );
+
+    expect(html).toContain("[redacted]");
+    expect(html).not.toContain("secret-token");
+  });
+});