- Resolve CLI and module-local fixtures from modules/ paths - Keep root admin assets reachable from nested package tests
- Move remaining beach packages and embedded admin assets\n- Rewrite framework, example, build, and gate paths
- Reject non-loopback bind/upstream, cap bodies, isolate concurrent sessions and refuse traversal - Scrub JWT, inv_ tokens, cookies, client secrets and OAuth codes out of fixtures - CLI discovery and replay errors exit nonzero without printing secrets Co-authored-by: Cursor <cursoragent@cursor.com>