[Daniel Flores (dnlflores)]

Overview of Problem

EntryPointPageObject.initializeBrowser already reads AUTH_USERNAME/AUTH_PASSWORD from the environment for HTTP Basic auth. That's not usable when the site under test needs the Authorization header free for its own auth — which is exactly QA Wolf's internal test gym's situation (TITAN-5366): it moved from HTTP Basic auth to a custom X-Gym-Auth header specifically so its own apps can use Authorization.

Overview of Changes

• optionalExtraHttpHeaderFromEnv() mirrors optionalHttpCredentialsFromEnv()'s pattern: reads EXTRA_HTTP_HEADER_NAME/EXTRA_HTTP_HEADER_VALUE, both required (same all-or-nothing rule, for the same reason — an empty header sent preemptively can break navigation on sites that don't expect it)
• applied via extraHTTPHeaders, which launch() already forwards verbatim to Playwright's native context option — no new interception machinery
• merges with, rather than replaces, a flow's own extraHTTPHeaders; the flow's own header of the same name wins over the env one (explicit caller intent over ambient config)
• deliberately generic naming — this package is public and used outside QA Wolf, so nothing gym-specific belongs in its source. The caller decides what header name/value to send; QA Wolf's own gym tooling would set EXTRA_HTTP_HEADER_NAME=X-Gym-Auth.

Testing

4 new cases: neither env var set (no-op), both set, merges with a flow's own headers, flow's own header of the same name wins. All 48 tests in the repo pass (npx jest), npx tsc clean, eslint/prettier clean.

Follow-up (not in this PR)

Once published, the QA Wolf gym tooling (qawolf/platform#36197) would bump its pinned @qawolf/pom version and set EXTRA_HTTP_HEADER_NAME/EXTRA_HTTP_HEADER_VALUE in the seeded workspace's environment, closing the one surface that PR couldn't reach (this package is installed from npm into the seeded workspace, not part of that repo).

[Daniel Flores (dnlflores)]

Closing in favor of a more central fix in qawolf/platform instead.

Turns out EntryPointPageObject's own launch import (@qawolf/flows/web) resolves, via dependency injection, to platform's own packages/playwright/src/launch/launch.ts for a real Tester run. Adding the same env-gated extra-header support directly there covers @qawolf/pom-based flow code and raw/from-scratch flow code that skips pom entirely (a real gap this PR alone would've left) — in one place, without needing a change to this repo or a version bump here at all.

See qawolf/platform#36197 for the actual fix. No action needed on this package; reverting the version bump isn't necessary since nothing here changed functionally, but flagging in case anyone's watching releases.