Skip to content
Kyku

HAR record and replay

Kyku can record Hetzner (and other requestJson) HTTP to a HAR file, strip tokens, and replay the same sequence in unit and BDD CI.

This is not an auto-re-record loop and does not cover every provider. One Hetzner VPC lifecycle fixture is checked in.

Environment variables

Section titled “Environment variables”
Variable Meaning
KYKU_RECORD=1 Record every requestJson call to KYKU_HAR_FILE
KYKU_REPLAY=1 Serve responses from KYKU_HAR_FILE; no network
KYKU_HAR_FILE Path to the HAR file (default kyku.har in the working directory)

KYKU_RECORD and KYKU_REPLAY cannot both be set.

Do not rename KYKU_* env vars. Recording uses KYKU_* only.

Record

Section titled “Record”
Terminal window
# Live Hetzner (human; writes a sanitized fixture)
HCLOUD_TOKEN=… bun run packages/hetzner/scripts/record-vpc-lifecycle.ts


# Same sequence against an in-memory mock (no token)
bun run packages/hetzner/scripts/record-vpc-lifecycle.ts

Authorization, Auth-API-Token, cookies, and JSON fields whose names look like secrets are replaced with [REDACTED] before the file is written.

Replay

Section titled “Replay”

CI installs the harness in replay mode against packages/hetzner/test/fixtures/vpc-lifecycle.har. Tests call VpcManager with a dummy token; fetch is never used.

If the next real request does not match the next recorded entry, replay throws HarReplayError and prints:

HAR replay diverged at request 3:
  expected: POST https://api.hetzner.cloud/v1/networks
  actual:   GET https://api.hetzner.cloud/v1/networks/424242

Token guard

Section titled “Token guard”

bun run check:har walks **/*.har and fails if a Bearer token, unsanitized Authorization header, or a configured HCLOUD_TOKEN / DIGITALOCEAN_TOKEN value is present. CI runs this on every PR.