GeezerVison

The reporter that sends TestRunStarted/TestRunFinished runs on the BrowserStack machine from its own install of this package, which has the prod collector hard-coded. Against any other collector (staging environments) those events never arrive, so TestHub keeps nameless test cases and Accessibility collapses every test in a spec into one. Make API_URL overridable via BROWSERSTACK_TEST_OBSERVABILITY_API_URL and forward the launching cli's effective collector in system_env_vars, the same channel BS_TESTOPS_JWT already uses. Prod behaviour is unchanged.

Jira: A11Y-13909

Co-Authored-By: Claude Fable 5.1 <[email protected]>

On staging the collector the cli talks to is a private ingress the BrowserStack machine cannot reach, while the machine-facing public ingress is a different host. BROWSERSTACK_TEST_OBSERVABILITY_REMOTE_API_URL, when set, is what gets forwarded to the machine; otherwise the cli's own collector is forwarded as before. Read at call time so the tests need no module reloads.

Jira: A11Y-13909

Co-Authored-By: Claude Fable 5.1 <[email protected]>

… tests

Review feedback on #1210. Collector requests carry BS_TESTOPS_JWT, so an http:// override would send it in cleartext: reject such a value instead of falling back to the default collector. The assignment moves out of the try block in setSystemEnvs because that block swallows errors, which would have turned the rejection into a silent fallback. Tests now clear both URL variables before each case and restore the originals after.

Jira: A11Y-13909

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

Request urls are built as `${API_URL}/${path}`, so an override carrying a query or fragment would swallow the endpoint path and the upload would hit / instead. Parse with URL, require an https protocol and a hostname, reject search and hash, and trim a trailing slash so paths are not doubled.

Jira: A11Y-13909

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

A bare trailing ? or # leaves URL.search and URL.hash empty, so the value passed validation and the appended endpoint became a query or fragment; return origin + pathname with no trailing separator instead. The override can also carry credentials and callers log the error, so the messages no longer echo the value.

Jira: A11Y-13909

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

setSystemEnvs tests only prove the url is handed to the remote machine. These load the helper with the override set and a stubbed axios, and assert nodeRequest builds its request url from it, with the default covered when nothing is set.

Jira: A11Y-13909

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

constants.js is loaded through bin/helpers/utils.js, which every command loads, so validating at module load meant a bad BROWSERSTACK_TEST_OBSERVABILITY_API_URL crashed init, info, stop and the reporter on the machine at startup, outside any handler. API_URL becomes apiUrl(), read when a request is built; nodeRequest rejects rather than throws, since its executor is async and a throw there would never reach the returned promise. validateCollectorUrls() runs at runs.js:136, before TestHubHandler.launchBuild, so a bad value fails before a build exists. Comments in constants.js trimmed to the one that earns its place.

Jira: A11Y-13909

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

remoteReporterApiUrl() short-circuits past apiUrl() when the remote override is set, so a malformed general override went unchecked until the first request. validateCollectorUrls() now calls both, with a test for the short-circuit case.

Jira: A11Y-13909

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

… test real

Two findings from the SDK PR review:

Setting only BROWSERSTACK_TEST_OBSERVABILITY_REMOTE_API_URL leaves this process
on its built-in collector while the machine reports to another one, so the build
and its test events can land in two places with nothing detecting it. That split
is correct in the Jenkins flow, where the built-in default has been pointed at
the same environment, and wrong anywhere else - which the code cannot tell apart,
so this warns rather than rejects.

The third case in collectorUrl.js promised that loading the module never throws
on a bad value, but proxyquire's noPreserveCache clears only the proxied module
and its stubs, and the url is resolved in constants.js. That stayed a cache hit,
so hoisting the resolution to module scope would not have turned the test red -
verified by doing exactly that, which now fails. The loader drops constants.js
and the test asserts the load explicitly.

Env var names move into constants.js so the validator and the resolvers share
one spelling.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

…v key

Second round of SDK PR review findings.

The warning added in the last commit interpolated the raw env value, which
contradicts the rule the validator states a few lines up: a collector url can
carry credentials and callers log it. It now logs the normalized accessor,
whose origin has already dropped any userinfo. The validator also rejects a
url carrying a username or password outright, so the stripping is explicit
rather than a silent side effect of normalization.

setSystemEnvs still spelled the forwarded key as a literal while every other
reference used the imported constant, so a rename could have split the
producer from the consumer - the exact failure this PR exists to prevent.

Tests: the no-override path (what every build takes) now has a case, and so
does the userinfo rejection.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

httpsOverride normalizes to origin + pathname, so the path survives and can
carry a token. The warning now names the host, which is the part that answers
the question it asks - whether the two collectors are the same environment -
and a test pins that a path in the value never reaches the log.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>