0.6.5 - Open-source posture tooling & hardened web recorder

🇫🇷 Release « posture open source outillée ». Le source est désormais public (CyrilM29/robotframework-sapfx) et les bibliothèques s'installent depuis PyPI (pip install robotframework-sapfx) ; l'export public est outillé et fail-closed (scan anti-fuite bloquant), la publication PyPI passe par Trusted Publishing (aucun token stocké). Côté produit : le recorder web masque les champs sensibles (paiement, OTP) dès la capture, son export redémarre sur l'URL de départ de l'enregistrement, et les deux recorders portent l'identité aicabra. Dézippez, install.cmd, c'est prêt.

What's new

Open-source posture, tooled

• The full source tree is public on CyrilM29/robotframework-sapfx, and the libraries install from PyPI: pip install robotframework-sapfx (libraries only; this ZIP remains the one full install with recorders, agents and MCP wiring).
• scripts/export_public_tree.py is the export-per-release tool behind the posture: git archive + fail-closed transforms (every pattern must match an exact count) + a blocking byte-level leak scan, binaries included. The PyPI publication runs through a Trusted Publishing workflow (OIDC, pypi environment, no stored token), guarded tag == version.
• The project presentation video (3 min 20) ships in the public repo and is linked from the READMEs (GitHub and PyPI).

Web recorder: sensitive fields masked at capture time (extension 0.9.0 → 0.9.2)

• sensitiveMask extends the password-only masking to payment and OTP fields (autocomplete tokens cc-number/cc-csc/cc-exp*/one-time-code/current-password/new-password, plus deliberately narrow name/id/aria-label patterns) → <SECRET> placeholder. Real values never reach the recorded flow, sessionStorage or the exports; every masked field keeps its fallback xpath line. Locked by an offline E2E test.
• Honest clipboard fallback: copy() falls back to a temporary-textarea execCommand('copy') when navigator.clipboard is missing (non-secure http origins, the typical intranet WebGUI host) or rejects, and the button reports the fallback's REAL result. Storage and download failures now surface instead of silently losing data.
• Exports bootstrap on the recording START url (caught by a live probe: record login → dashboard, then export; the old export replayed from the wrong page). Remembered at the first rec, consumed by suites and documents, cleared by clear, round-trip safe. Live-validated end-to-end.

Recorder identity and movable windows

• The web recorder panel carries the aicabra medallion (28 px data-URI baked into the bundle: no network request, silent hide under a strict img-src CSP) and advertises its drag affordance; the desktop recorder GUI gains an aicabra banner that doubles as a second drag handle, useful when the native title bar sits off-screen above a full-screen SAP GUI.

Proof numbers: 1009 unit tests · 93 % coverage · 17/17 live scenarios. UI5 1.60 → 2.0-nightly compatibility unchanged; rf-mcp pin stays at 0.35.0.

Attachment: sapfx-pack-0.6.5-win.zip : self-contained Windows deployment pack (both wheels, business resources, recorders + MV3 extension, sample suites, maintenance scripts, test agents + sapfx skill). Install: unzip, then install.cmd (options -WithMcp, -WithBrowsers). This ZIP was tested from a fresh extraction before publication: sidecar + 68 internal SHA-256 OK, install.cmd -WithMcp clean through cmd.exe (imports OK, Robot Framework 7.4.2, rf-mcp plugins OK), 27/27 sample-suite dry-run, sapfx-mcp overlay announcing itself. SHA-256: 68cf9040f08ef73131ce02fb24a5c6ca01b7f81528dd9b6317072b087c88b538.

Ops note: after updating the libraries, restart the rf-mcp server : the process freezes the imported library class and instance (field note in the repo).