HTML report, payload snapshots and test source locations

[stromcom]

Changes since v0.4.0

HTML report — --output-html=FILE

vendor/bin/http-smoke staging --output-html=build/smoke.html

One self-contained file: no CDN, no assets, no server. Open it in a browser or
publish it as a CI artefact. It embeds the canonical JSON and renders it
client-side:

• summary cards + pass/fail/skip ratio bar, environment / duration / concurrency meta,
• groups with per-group tallies; failed tests are expanded by default,
• per-test detail: method, URL, HTTP code, duration, attempts (total time incl. retries),
  all failure messages verbatim, skip reasons,
• chain context for session tests — every preceding step of the session
  (method, status, label, URL, duration) with the failing step highlighted,
• filters: full-text search (label / URL / failure message / payload / path),
  status, group, definition file, retried-only, sessions-only, plus
  expand/collapse all and “show payloads”.

Dark mode follows the OS setting. Test details render lazily on first open, so
large suites stay fast. The layout lives in
src/Reporting/templates/report.html — HtmlReporter only injects the JSON, so
the same template can later back a standalone viewer for any report.json.

Payload snapshots — what actually went over the wire

Each test now carries the request as sent and the response as received:
headers (including the implicit Content-Type), query parameters, body in its
wire encoding, plus a ready-to-run cURL reproduction in the HTML report.
JSON bodies are pretty-printed for display.

Request owns the encoding (encodedBody(), effectiveHeaders(),
bodyEncoding()) and CurlMultiClient uses those same methods — a report cannot
drift from what was really sent.

Secrets: Authorization, Proxy-Authorization, Cookie, Set-Cookie,
X-Api-Key, X-Auth-Token, X-Csrf-Token are replaced with «redacted»,
bodies are truncated at 16 kB (original size reported) and non-UTF-8 bodies are
reported as size only. Both the JSON and HTML artefacts now contain request and
response bodies — treat them accordingly in CI.

vendor/bin/http-smoke prod --output-html=report.html --no-payloads
vendor/bin/http-smoke prod --output-html=report.html --payload-limit=65536

$config->includePayloads = false;
$config->payloadMaxBytes = 65536;
$config->redactedHeaders = ['authorization', 'x-tenant-secret'];

Markdown and GitHub step-summary reports are unaffected — they build their JSON
with payloads off.

Test source locations — find the failing test instantly

Every test records the definition file and line of its get() / post() / …
call (Definition\SourceLocation, captured from the backtrace at build time):

• HTML report: …/api/users.php:24 badge in the test row, a “Defined in” block
  in the detail, and a filter by definition file,
• console: a dim at tests/SmokeHttp/api/users.php:24 line under each failure,
• Markdown / GitHub summary: `file:line` in the failure details,
• JSON: tests[].source with file (relative to meta.base_path),
  absolute_path and line.

JSON report schema v3

JsonReporter::SCHEMA_VERSION is now 3:

• meta.base_path — project root, used to shorten source paths,
• meta.payloads — whether payloads are included in this artefact,
• tests[].source — definition file + line,
• tests[].request / tests[].response — payload snapshots (null when
  payloads are off, for skipped tests, or when no request was sent).

Consumers of v2 keep working for every previously existing field — v3 only adds
keys.

New CLI flags

--output-html=FILE      Write standalone HTML report to file
--no-payloads           Omit request/response payloads from JSON + HTML reports
--payload-limit=BYTES   Truncate each payload body (default: 16384)

New config options (smoke.config.php)

$config->htmlOutputPath  = __DIR__ . '/build/smoke.html';
$config->includePayloads = true;
$config->payloadMaxBytes = 16384;
$config->redactedHeaders = ['authorization', 'cookie', '…'];