@ait-co/devtools 0.1.136 → 0.1.137

package/dist/test-runner/relay-factory.js

@@ -29,7 +29,7 @@ function createRelayConnectionFactory(opts) {
 			const { prepareAttach, renderAndMaybeWait, mintAttachUrl } = await import("../attach-orchestrator-Cjdhir2U.js");
 			const { injectDebugIndicator, injectGlobals } = await import("../cell-D1y4shoV.js");
 			const { loadRelaySecretReadOnly } = await import("../relay-secret-store-BcVrWwTq.js");
-			const { bootRelayFamily, buildRelayVerifyAuth } = await import("../debug-server-BZtH2Z5b.js");
+			const { bootRelayFamily, buildRelayVerifyAuth } = await import("../debug-server-CBK7dn8O.js");
 			await loadRelaySecretReadOnly({ projectRoot });
 			let resolveTunnelUp;
 			const tunnelReady = new Promise((resolve) => {
@@ -117,6 +117,7 @@ function createRelayConnectionFactory(opts) {
 			}
 			await injectDebugIndicator(booted.connection);
 			if (opts.cell !== void 0) await injectGlobals(booted.connection, { __AIT_CELL__: opts.cell });
+			if (opts.stubBlocking === true) await injectGlobals(booted.connection, { __AIT_STUB_BLOCKING__: true });
 			return booted.connection;
 		},
 		onSessionPhase(next) {

package/dist/test-runner/relay-factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"relay-factory.js","names":[],"sources":["../../src/test-runner/relay-factory.ts"],"sourcesContent":["/**\n * Relay connection factory for the Vitest custom pool (devtools#696).\n *\n * The Vitest pool (`pool.ts`) takes a {@link RelayConnectionFactory} that knows\n * how to `open()` a live CDP relay connection (boot relay → QR → phone scan →\n * cell inject → enableDomains) and `close()` it. Before this module that exact\n * assembly lived only inside the `devtools-test` CLI's `main()`; the standalone\n * CLI and the Vitest pool would otherwise each hand-roll it and drift.\n *\n * This is the single source of that assembly. `cli.ts` is refactored to call\n * `createRelayConnectionFactory(...).open()`, and `definePhoneVitestConfig`\n * (config.ts) exposes it so a downstream `vitest.config.ts` can wire the pool:\n *\n *   import { createRelayConnectionFactory } from '@ait-co/devtools/test-runner';\n *   const connection = createRelayConnectionFactory({\n *     schemeUrl,\n *     cell,\n *     // REQUIRED — own the stdout decision (the chunks carry the relay wss +\n *     // TOTP code). Suppress on non-interactive stdout; print otherwise.\n *     onQrContent: (chunks) => {\n *       if (!process.stdout.isTTY) return;\n *       for (const c of chunks) process.stdout.write(`${c}\\n`);\n *     },\n *   });\n *   export default defineConfig({ test: definePhoneVitestConfig({ connection }) });\n *\n * The heavy boot graph (chii relay, cloudflared, ws, debug-server) is pulled via\n * DYNAMIC import inside `open()` — so merely importing this module (or the\n * `@ait-co/devtools/test-runner` barrel) does NOT statically drag that graph in.\n *\n * SECRET-HANDLING: relay wss URLs, scheme URLs, and the TOTP secret/code are\n * never logged. `open()` reads the project-local `.ait_relay` secret read-only\n * (never mints) and the minted TOTP code rides only inside the QR `at=` param.\n *\n * Node-only. react-free (CdpConnection + lazily-imported MCP boot helpers only).\n */\n\nimport type { AttachDeps, AttachUrlParts } from '../mcp/attach-orchestrator.js';\nimport type { CdpConnection } from '../mcp/cdp-connection.js';\nimport type { DashboardState, QrHttpServer } from '../mcp/qr-http-server.js';\nimport type { RelayConnectionFactory } from './pool.js';\n\n// NOTE: every value import below is a DYNAMIC import inside `open()`. This module\n// keeps ONLY type-level static imports so that re-exporting it from the\n// `@ait-co/devtools/test-runner` barrel (config.ts) does NOT statically drag the\n// heavy MCP graph (cell.ts → attach-orchestrator.ts → tools.ts → server-lock,\n// plus chii/cloudflared via debug-server) onto that Node-config entry.\n\n/** Options for {@link createRelayConnectionFactory}. */\nexport interface RelayConnectionFactoryOptions {\n  /**\n   * intoss-private:// scheme URL from `ait deploy --scheme-only` (env3). The\n   * phone cold-loads the candidate bundle this URL points at. SECRET-HANDLING:\n   * never logged.\n   */\n  schemeUrl: string;\n  /**\n   * Project root for the `.ait_relay` secret lookup (read-only). Defaults to\n   * `process.cwd()`.\n   */\n  projectRoot?: string;\n  /**\n   * Attach wait timeout in ms — how long `open()` waits for the phone to scan\n   * the QR and attach. Omitted (the default) means **wait indefinitely** —\n   * the runner stays up until the user stops it (Ctrl-C/SIGTERM). QR-scan\n   * wait is a human-paced action; there is no sound default bound for it\n   * (devtools#735). Pass an explicit value to opt into a bounded wait (CI/\n   * headless callers — `--attach-timeout` on the CLI). (The per-file evaluate\n   * timeout is separate, passed via the pool's `run` options.)\n   */\n  timeoutMs?: number;\n  /** Disable browser auto-open of the QR dashboard (text QR only). */\n  headless?: boolean;\n  /**\n   * Cell axes injected as `__AIT_CELL__` before the first test bundle runs, so\n   * sdk-example's capture picks up the correct sdkLine/platform. Optional — when\n   * omitted no cell is injected. The values are not secrets.\n   */\n  cell?: { sdkLine: string; platform: string };\n  /**\n   * Overrides the dashboard HTTP server's bind base port (devtools#752).\n   * Threaded straight through to `startQrHttpServer`'s `dashboardPort`\n   * option — see that option's doc for the increment-on-EADDRINUSE scan\n   * behaviour and the `AIT_DEBUG_HTTP_PORT` env fallback. Omitted means\n   * `startQrHttpServer` resolves its own default (env → fixed default).\n   */\n  dashboardPort?: number;\n  /**\n   * Receives the QR/attach render content (text chunks) from\n   * `renderAndMaybeWait`, so the caller decides whether to print them — e.g.\n   * suppress on non-interactive stdout.\n   *\n   * REQUIRED (not optional) on purpose: these chunks contain the QR payload\n   * (which encodes the relay wss + TOTP `at=` code) and the attach JSON block.\n   * Making the hook mandatory means the factory never falls back to printing\n   * them itself — a downstream `vitest.config.ts` consumer that wires this via\n   * the `@ait-co/devtools/test-runner` barrel is forced to make an explicit\n   * stdout decision rather than silently leaking the secret-bearing block.\n   *\n   * SECRET-HANDLING: when a non-interactive caller is detected the hook MUST\n   * suppress the WHOLE chunk (not just `attachUrl`), since `relayUrl` rides in\n   * the same block.\n   */\n  onQrContent: (textChunks: string[]) => void;\n}\n\n/**\n * Builds a {@link RelayConnectionFactory} that opens a standalone env3 relay\n * connection.\n *\n * `open()` performs the full attach lifecycle and BLOCKS while a human scans\n * the rendered QR with their phone — there is no way around the manual scan\n * for env3. By default the wait is UNBOUNDED (`opts.timeoutMs` omitted): the\n * runner stays up until the user stops it (Ctrl-C/SIGTERM), since QR-scan is\n * a human-paced action with no sound default bound (devtools#735). Passing an\n * explicit `timeoutMs` opts into the old bounded behavior (CI/headless\n * callers). It resolves with the live `CdpConnection` once a matching page\n * attaches; `close()` tears the relay family down.\n *\n * The factory holds the booted relay family in a closure so `close()` can stop\n * it. A second `open()` on the same factory boots a fresh family (the previous\n * one should have been `close()`d first).\n */\nexport function createRelayConnectionFactory(\n  opts: RelayConnectionFactoryOptions,\n): RelayConnectionFactory {\n  const projectRoot = opts.projectRoot ?? process.cwd();\n  // Undefined/absent → Infinity (wait forever). An explicit finite value opts\n  // into the old bounded behavior. Number.isFinite guards downstream\n  // (renderAndMaybeWait / waitForFirstTarget) treat Infinity as \"no timer\".\n  const timeoutMs = opts.timeoutMs ?? Number.POSITIVE_INFINITY;\n  const headless = opts.headless === true;\n\n  // Captured so close() can stop the family that open() booted.\n  let family: { connection: CdpConnection; stop(): void } | undefined;\n  // QR HTTP server — started during open() when not headless, closed in close().\n  let qrServer: QrHttpServer | undefined;\n  // Session-phase state (#730) — drives the dashboard's `phase` field so the\n  // CLI's run start/complete and final teardown push an immediate SSE update\n  // instead of the dashboard just going dark when the process exits.\n  let phase: DashboardState['phase'] = 'active';\n  // Manual-blocking prompt state (devtools#741) — drives the dashboard's\n  // `manualPrompt` field. `null` outside a manual step.\n  let manualPrompt: DashboardState['manualPrompt'] = null;\n\n  return {\n    async open(): Promise<CdpConnection> {\n      // Dynamic imports: keep the chii/cloudflared/debug-server graph OFF the\n      // static import graph of this module (and the test-runner config barrel).\n      const { prepareAttach, renderAndMaybeWait, mintAttachUrl } = await import(\n        '../mcp/attach-orchestrator.js'\n      );\n      const { injectDebugIndicator, injectGlobals } = await import('./cell.js');\n      const { loadRelaySecretReadOnly } = await import('../mcp/relay-secret-store.js');\n      const { bootRelayFamily, buildRelayVerifyAuth } = await import('../mcp/debug-server.js');\n\n      // Load the project-local .ait_relay secret into AIT_DEBUG_TOTP_SECRET\n      // BEFORE booting the relay so assertRelayAuthConfigured()/buildRelayVerifyAuth()\n      // at the boot site see it. Read-only — never mints. SECRET-HANDLING: the\n      // value is never logged here.\n      await loadRelaySecretReadOnly({ projectRoot });\n\n      // PRIMARY FIX (devtools#714): bootRelayFamily starts the cloudflared tunnel\n      // as a background promise and returns immediately with tunnel.up === false.\n      // We must NOT call prepareAttach until the tunnel is up — it fails fast when\n      // tunnel.up is false (attach-orchestrator.ts tunnel-down guard).\n      //\n      // Wire onWssUrl (mirroring the MCP daemon path in debug-server.ts) to:\n      //   1. resolve a caller-held tunnel-ready promise so open() can await it, and\n      //   2. re-push dashboard SSE on late tunnel-up events (notifyStateChange).\n      //\n      // SECRET-HANDLING: onWssUrl receives the relay wss URL — never log it.\n      let resolveTunnelUp!: () => void;\n      const tunnelReady = new Promise<void>((resolve) => {\n        resolveTunnelUp = resolve;\n      });\n\n      const booted = await bootRelayFamily({\n        verifyAuth: buildRelayVerifyAuth(),\n        onWssUrl: () => {\n          // Resolve the tunnel-ready gate so the prepareAttach call below is\n          // unblocked. qrServer may not be set yet at call time (it's started\n          // after bootRelayFamily), so we use optional chaining — if the tunnel\n          // happens to come up after qrServer is started, notifyStateChange pushes\n          // the freshly minted attachUrl to any waiting dashboard SSE clients.\n          // SECRET-HANDLING: wssUrl is NOT forwarded here — the value travels only\n          // inside the closure via getTunnelStatus().wssUrl (used by mintAttachUrl).\n          resolveTunnelUp();\n          qrServer?.notifyStateChange();\n        },\n        // #730: parity with the MCP daemon path (debug-server.ts's onTunnelDown\n        // wiring) — without this, a permanent tunnel drop during a standalone\n        // CLI run left the dashboard showing a dead-but-scannable QR until the\n        // watchdog (up to ~210s) finally fired.\n        onTunnelDown: () => {\n          qrServer?.notifyStateChange();\n        },\n      });\n      family = booted;\n\n      // If the tunnel is already up (extremely fast boot or test double), resolve\n      // immediately so we don't stall on a promise that will never fire.\n      if (booted.getTunnelStatus?.().up) {\n        resolveTunnelUp();\n      }\n\n      // Track the last-captured attach parts so getDashboardState can mint a\n      // fresh attach URL on every dashboard request/SSE push (fresh TOTP at=).\n      // SECRET-HANDLING: parts contain the relay wss + scheme URL — never logged.\n      let lastAttachParts: AttachUrlParts | undefined;\n\n      // Assemble AttachDeps. We set qrHttpServer and onAttachUrlBuilt below\n      // (before prepareAttach) after optionally starting the web-QR server.\n      const attachDeps: AttachDeps = {\n        getTunnelStatus: booted.getTunnelStatus ?? (() => ({ up: false, wssUrl: null })),\n        getTotpSecret: () => process.env.AIT_DEBUG_TOTP_SECRET,\n        qrHttpServer: undefined, // filled in below if web-QR server started\n        onAttachUrlBuilt: undefined, // filled in below\n        canOpenBrowser: () => !headless,\n      };\n\n      // Web-QR server: reuse the same loopback HTTP dashboard that the MCP\n      // start_attach path uses (src/mcp/qr-http-server.ts). This makes the QR\n      // scannable even when stdout is non-interactive (Claude Code `!` / CI),\n      // because the browser is opened by URL — not via captured stdout.\n      //\n      // Headless decision: we start the server even in --headless mode so the\n      // printed stderr URL can be opened manually. The existing\n      // canOpenBrowser: () => !headless gate inside renderAndMaybeWait prevents\n      // the auto-open; headless users see only the stderr URL.\n      //\n      // On failure we fall back gracefully to the text-QR path — do NOT crash.\n      // SECRET-HANDLING: only http://127.0.0.1:<port>/ (no secrets) goes to stderr.\n      try {\n        const { startQrHttpServer } = await import('../mcp/qr-http-server.js');\n\n        const getDashboardState = (): DashboardState => ({\n          tunnel: attachDeps.getTunnelStatus(),\n          pages: null, // CLI/pool: no page-list introspection needed\n          attachUrl: lastAttachParts ? mintAttachUrl(attachDeps, lastAttachParts) : null,\n          mode: 'relay-dev' as const,\n          phase, // #730 — CLI-only 'running'/'complete' transitions via onSessionPhase\n          manualPrompt, // #741 — CLI-only --manual-blocking transitions via onManualPrompt\n        });\n\n        qrServer = await startQrHttpServer(getDashboardState, {\n          dashboardPort: opts.dashboardPort,\n        });\n\n        // Wire the QR server into attachDeps BEFORE prepareAttach is called so\n        // renderAndMaybeWait sees it and takes Path 2/3 (web-QR) instead of Path 4.\n        attachDeps.qrHttpServer = qrServer;\n\n        // Capture attach parts via onAttachUrlBuilt so getDashboardState can\n        // mint a fresh URL (fresh TOTP at= code) on every dashboard render.\n        attachDeps.onAttachUrlBuilt = (parts: AttachUrlParts) => {\n          lastAttachParts = parts;\n          qrServer?.notifyStateChange();\n        };\n\n        // Print the loopback dashboard URL to stderr — it carries no secrets\n        // (TOTP codes and relay wss live only in the in-memory HTTP response).\n        process.stderr.write(`devtools-test: QR dashboard: http://127.0.0.1:${qrServer.port}/\\n`);\n      } catch {\n        // startQrHttpServer failed (e.g. port conflict, import error). Fall back\n        // to the existing text-QR path by leaving qrHttpServer: undefined.\n        // qrServer remains undefined; close() handles that with optional chaining.\n      }\n\n      // PRIMARY FIX (devtools#714): await tunnel readiness before calling\n      // prepareAttach. Race: a 15 s timeout is generous — cloudflared typically\n      // comes up in < 5 s. On timeout we still call prepareAttach; it will hit\n      // the tunnel-down guard and throw a secret-free error (same as before,\n      // but now with a clear diagnostic instead of a silent WAITING freeze).\n      //\n      // Implementation: Promise.race against a 15 000 ms timeout signal. We do\n      // NOT use a timer-based early-exit because the existing code already\n      // surface-fails on tunnel-down inside prepareAttach with a secret-free\n      // message. The timeout here is purely a \"give the tunnel a fair chance\"\n      // gate — not a correctness boundary.\n      const TUNNEL_BOOT_TIMEOUT_MS = 15_000;\n      await Promise.race([\n        tunnelReady,\n        new Promise<void>((resolve) => setTimeout(resolve, TUNNEL_BOOT_TIMEOUT_MS)),\n      ]);\n\n      const prep = await prepareAttach(\n        attachDeps,\n        'relay-dev',\n        { scheme_url: opts.schemeUrl },\n        booted.connection,\n      );\n      if (!prep.ok) {\n        booted.stop();\n        family = undefined;\n        // SECONDARY FIX (devtools#714): close the QR server on the failure path\n        // so the loopback port listener does not leak. The normal-exit path is\n        // handled by close(); this mirrors that cleanup for the error path.\n        await qrServer?.close();\n        qrServer = undefined;\n        // SECRET-HANDLING: do NOT surface `prep.error.content` in the thrown\n        // message. Some prep error paths build their text from attach\n        // components, and the CLI catch writes `e.message` to stderr — embedding\n        // that text risks leaking the scheme/relay wss URL. The detailed\n        // diagnostic is the daemon/dashboard's job; the factory throws a\n        // secret-free message only.\n        throw new Error(\n          'createRelayConnectionFactory: attach preparation failed — check the scheme_url and that the relay tunnel is up',\n        );\n      }\n\n      // Render the QR + wait for the phone to attach. SECRET-HANDLING: this\n      // function never logs scheme/wss/TOTP values.\n      const waitResult = await renderAndMaybeWait(\n        attachDeps,\n        prep,\n        true,\n        timeoutMs,\n        booted.connection,\n      );\n      if (waitResult.isError) {\n        booted.stop();\n        family = undefined;\n        // SECONDARY FIX (devtools#714): close the QR server on the timeout path\n        // (mirrors the prep.ok failure path above).\n        await qrServer?.close();\n        qrServer = undefined;\n        // SECRET-HANDLING (BLOCKER fix): `waitResult.content` is the timeout\n        // result built from `buildTimeoutError(baseText, ...)`, and `baseText`\n        // is `JSON.stringify({ attachUrl, relayUrl, ... })` — `attachUrl` carries\n        // the TOTP `at=` code and `relayUrl` is the relay `wss://` URL. The CLI\n        // catch writes `e.message` to stderr, so extracting that text here would\n        // leak the relay wss + TOTP code on every timeout. Throw a secret-free\n        // message with only the timeout duration.\n        const timeoutSec = Math.round(timeoutMs / 1000);\n        throw new Error(\n          `createRelayConnectionFactory: attach timed out after ${timeoutSec}s — phone did not scan the QR within the timeout`,\n        );\n      }\n\n      // Surface the QR/attach render content to the caller, which owns the\n      // stdout decision (suppress on non-interactive stdout). There is no\n      // fallback that prints here itself: `onQrContent` is a required option so\n      // the secret-bearing block (attachUrl TOTP + relayUrl wss) can never be\n      // emitted without an explicit caller decision. SECRET-HANDLING.\n      const qrChunks = waitResult.content\n        .filter((c): c is { type: 'text'; text: string } => c.type === 'text')\n        .map((c) => c.text);\n      opts.onQrContent(qrChunks);\n\n      // PAGE-READY GATE (devtools#720, fix (a)+(b)):\n      //\n      // FIX (a) — ORDER: enableDomains() MUST run before injectDebugIndicator()\n      // and injectGlobals(). Both inject calls use Runtime.evaluate via\n      // sendCommand(), which guards with `if (!this.ws) reject(\"Call\n      // enableDomains() first\")`.  With the old ordering (inject → inject →\n      // enableDomains) injectDebugIndicator's throw was swallowed by cell.ts\n      // try/catch but injectGlobals (no try/catch) propagated fatally — when\n      // --cell was set open() hard-threw before enableDomains ever ran and the\n      // CLI exited with 0 files executed.\n      //\n      // FIX (b) — BOUNDED RETRY: the window between waitForFirstTarget (non-\n      // empty /targets) and enableDomains (page-level WS open) is where a\n      // Cloudflare edge idle-drop can disconnect the phone.  enableDomains()\n      // calls refreshTargets() internally; if the target list is empty at that\n      // point it throws \"No mini-app page attached\".  We absorb up to\n      // PAGE_READY_RETRIES transient failures by waiting briefly and retrying\n      // the refreshTargets+enableDomains sequence.  enableDomains() is\n      // idempotent (concurrent callers share the in-flight promise), so retries\n      // are safe.  Only after all retries fail do we surface a secret-free\n      // error.  This is the CLI equivalent of the MCP daemon's soft-fail\n      // cushion in relay-worker.ts.\n      //\n      // Neither fix touches chii-connection.ts or the MCP daemon path.\n      const PAGE_READY_RETRIES = 3;\n      const PAGE_READY_RETRY_DELAY_MS = 1_500;\n\n      let lastEnableError: Error | undefined;\n      for (let attempt = 1; attempt <= PAGE_READY_RETRIES; attempt++) {\n        try {\n          // FIX (a): enableDomains first — opens the page-level CDP websocket.\n          await booted.connection.enableDomains();\n          lastEnableError = undefined;\n          break;\n        } catch (err) {\n          lastEnableError = err instanceof Error ? err : new Error(String(err));\n          if (attempt < PAGE_READY_RETRIES) {\n            // FIX (b): brief pause then re-poll /targets before retrying\n            // enableDomains. Use a non-leaking approach: wait, then fall\n            // through to the next loop iteration.\n            await new Promise<void>((resolve) => setTimeout(resolve, PAGE_READY_RETRY_DELAY_MS));\n          }\n        }\n      }\n\n      if (lastEnableError !== undefined) {\n        booted.stop();\n        family = undefined;\n        await qrServer?.close();\n        qrServer = undefined;\n        // SECRET-HANDLING: message contains only a duration + attempt count.\n        // No relay wss URL, scheme URL, or TOTP code is included.\n        throw new Error(\n          `createRelayConnectionFactory: page did not become ready after ${PAGE_READY_RETRIES} attempts (${Math.round((PAGE_READY_RETRIES * PAGE_READY_RETRY_DELAY_MS) / 1000)}s) — the mini-app page may have disconnected before enableDomains() could open the CDP websocket`,\n        );\n      }\n\n      // FIX (a): inject AFTER enableDomains so the page-level CDP websocket is\n      // open and sendCommand() will not hit the ws===null guard.\n\n      // Show the on-phone \"Debugger Connected\" badge. injectDebugIndicator\n      // swallows its own errors (cell.ts try/catch), so a badge failure is\n      // non-fatal — test execution proceeds regardless.\n      await injectDebugIndicator(booted.connection);\n\n      // Inject the cell globals before any test bundle runs (session-global).\n      // injectGlobals() does NOT swallow errors — a genuine type/eval failure\n      // here surfaces clearly instead of silently skipping cell injection.\n      if (opts.cell !== undefined) {\n        await injectGlobals(booted.connection, { __AIT_CELL__: opts.cell });\n      }\n\n      return booted.connection;\n    },\n\n    // #730: drives the dashboard's `phase` field so the CLI's run start/end\n    // push an immediate SSE update instead of the dashboard just going dark.\n    onSessionPhase(next: 'running' | 'complete'): void {\n      phase = next;\n      qrServer?.notifyStateChange();\n    },\n\n    // #741: drives the dashboard's `manualPrompt` field for --manual-blocking\n    // — the CLI calls this immediately before injecting each manual file\n    // (prompt set) and once more with `null` after the last one (prompt\n    // cleared). Push is immediate (not waited on for ack) — v1 does not block\n    // on dashboard acknowledgment, only on the file's own (long) evaluate.\n    onManualPrompt(next: { file: string; index: number; total: number } | null): void {\n      manualPrompt = next;\n      qrServer?.notifyStateChange();\n    },\n\n    async close(connection: CdpConnection): Promise<void> {\n      // #730: flip the on-phone badge to disconnected AND push the terminal\n      // dashboard frame BEFORE tearing anything down, so neither surface goes\n      // dark without explanation when the CLI exits (dog-food gaps #1 + #2).\n      // Both are best-effort over the still-open channels — the ordering\n      // (before family.stop()/qrServer.close()) is load-bearing:\n      //   - qrServer.notifyStateChange() writes synchronously to the still-open\n      //     SSE sockets, so the 'complete' frame is on the wire before the HTTP\n      //     server is closed below.\n      //   - injectDebugIndicator runs over the still-open CDP channel, so the\n      //     phone actually receives the disconnected-state update before the\n      //     relay/tunnel are torn down.\n      if (phase !== 'complete') {\n        phase = 'complete';\n        qrServer?.notifyStateChange();\n      }\n      try {\n        const { injectDebugIndicator } = await import('./cell.js');\n        await injectDebugIndicator(connection, { state: 'disconnected' });\n      } catch {\n        // Channel may already be down (e.g. attach never completed) — non-fatal,\n        // the badge is informational UI only.\n      }\n      // family.stop() is synchronous best-effort: closes the CDP connection and\n      // shuts down the relay + cloudflared child.\n      family?.stop();\n      family = undefined;\n      // Close the web-QR HTTP server if one was started during open().\n      // close() is idempotent via optional chaining + reassignment to undefined.\n      await qrServer?.close();\n      qrServer = undefined;\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AA2HA,SAAgB,6BACd,MACwB;CACxB,MAAM,cAAc,KAAK,eAAe,QAAQ,KAAK;CAIrD,MAAM,YAAY,KAAK,aAAa,OAAO;CAC3C,MAAM,WAAW,KAAK,aAAa;CAGnC,IAAI;CAEJ,IAAI;CAIJ,IAAI,QAAiC;CAGrC,IAAI,eAA+C;AAEnD,QAAO;EACL,MAAM,OAA+B;GAGnC,MAAM,EAAE,eAAe,oBAAoB,kBAAkB,MAAM,OACjE;GAEF,MAAM,EAAE,sBAAsB,kBAAkB,MAAM,OAAO;GAC7D,MAAM,EAAE,4BAA4B,MAAM,OAAO;GACjD,MAAM,EAAE,iBAAiB,yBAAyB,MAAM,OAAO;AAM/D,SAAM,wBAAwB,EAAE,aAAa,CAAC;GAY9C,IAAI;GACJ,MAAM,cAAc,IAAI,SAAe,YAAY;AACjD,sBAAkB;KAClB;GAEF,MAAM,SAAS,MAAM,gBAAgB;IACnC,YAAY,sBAAsB;IAClC,gBAAgB;AAQd,sBAAiB;AACjB,eAAU,mBAAmB;;IAM/B,oBAAoB;AAClB,eAAU,mBAAmB;;IAEhC,CAAC;AACF,YAAS;AAIT,OAAI,OAAO,mBAAmB,CAAC,GAC7B,kBAAiB;GAMnB,IAAI;GAIJ,MAAM,aAAyB;IAC7B,iBAAiB,OAAO,2BAA2B;KAAE,IAAI;KAAO,QAAQ;KAAM;IAC9E,qBAAqB,QAAQ,IAAI;IACjC,cAAc,KAAA;IACd,kBAAkB,KAAA;IAClB,sBAAsB,CAAC;IACxB;AAcD,OAAI;IACF,MAAM,EAAE,sBAAsB,MAAM,OAAO;IAE3C,MAAM,2BAA2C;KAC/C,QAAQ,WAAW,iBAAiB;KACpC,OAAO;KACP,WAAW,kBAAkB,cAAc,YAAY,gBAAgB,GAAG;KAC1E,MAAM;KACN;KACA;KACD;AAED,eAAW,MAAM,kBAAkB,mBAAmB,EACpD,eAAe,KAAK,eACrB,CAAC;AAIF,eAAW,eAAe;AAI1B,eAAW,oBAAoB,UAA0B;AACvD,uBAAkB;AAClB,eAAU,mBAAmB;;AAK/B,YAAQ,OAAO,MAAM,iDAAiD,SAAS,KAAK,KAAK;WACnF;GAiBR,MAAM,yBAAyB;AAC/B,SAAM,QAAQ,KAAK,CACjB,aACA,IAAI,SAAe,YAAY,WAAW,SAAS,uBAAuB,CAAC,CAC5E,CAAC;GAEF,MAAM,OAAO,MAAM,cACjB,YACA,aACA,EAAE,YAAY,KAAK,WAAW,EAC9B,OAAO,WACR;AACD,OAAI,CAAC,KAAK,IAAI;AACZ,WAAO,MAAM;AACb,aAAS,KAAA;AAIT,UAAM,UAAU,OAAO;AACvB,eAAW,KAAA;AAOX,UAAM,IAAI,MACR,iHACD;;GAKH,MAAM,aAAa,MAAM,mBACvB,YACA,MACA,MACA,WACA,OAAO,WACR;AACD,OAAI,WAAW,SAAS;AACtB,WAAO,MAAM;AACb,aAAS,KAAA;AAGT,UAAM,UAAU,OAAO;AACvB,eAAW,KAAA;IAQX,MAAM,aAAa,KAAK,MAAM,YAAY,IAAK;AAC/C,UAAM,IAAI,MACR,wDAAwD,WAAW,kDACpE;;GAQH,MAAM,WAAW,WAAW,QACzB,QAAQ,MAA2C,EAAE,SAAS,OAAO,CACrE,KAAK,MAAM,EAAE,KAAK;AACrB,QAAK,YAAY,SAAS;GA0B1B,MAAM,qBAAqB;GAC3B,MAAM,4BAA4B;GAElC,IAAI;AACJ,QAAK,IAAI,UAAU,GAAG,WAAW,oBAAoB,UACnD,KAAI;AAEF,UAAM,OAAO,WAAW,eAAe;AACvC,sBAAkB,KAAA;AAClB;YACO,KAAK;AACZ,sBAAkB,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,IAAI,CAAC;AACrE,QAAI,UAAU,mBAIZ,OAAM,IAAI,SAAe,YAAY,WAAW,SAAS,0BAA0B,CAAC;;AAK1F,OAAI,oBAAoB,KAAA,GAAW;AACjC,WAAO,MAAM;AACb,aAAS,KAAA;AACT,UAAM,UAAU,OAAO;AACvB,eAAW,KAAA;AAGX,UAAM,IAAI,MACR,iEAAiE,mBAAmB,aAAa,KAAK,MAAO,qBAAqB,4BAA6B,IAAK,CAAC,kGACtK;;AASH,SAAM,qBAAqB,OAAO,WAAW;AAK7C,OAAI,KAAK,SAAS,KAAA,EAChB,OAAM,cAAc,OAAO,YAAY,EAAE,cAAc,KAAK,MAAM,CAAC;AAGrE,UAAO,OAAO;;EAKhB,eAAe,MAAoC;AACjD,WAAQ;AACR,aAAU,mBAAmB;;EAQ/B,eAAe,MAAmE;AAChF,kBAAe;AACf,aAAU,mBAAmB;;EAG/B,MAAM,MAAM,YAA0C;AAYpD,OAAI,UAAU,YAAY;AACxB,YAAQ;AACR,cAAU,mBAAmB;;AAE/B,OAAI;IACF,MAAM,EAAE,yBAAyB,MAAM,OAAO;AAC9C,UAAM,qBAAqB,YAAY,EAAE,OAAO,gBAAgB,CAAC;WAC3D;AAMR,WAAQ,MAAM;AACd,YAAS,KAAA;AAGT,SAAM,UAAU,OAAO;AACvB,cAAW,KAAA;;EAEd"}
+{"version":3,"file":"relay-factory.js","names":[],"sources":["../../src/test-runner/relay-factory.ts"],"sourcesContent":["/**\n * Relay connection factory for the Vitest custom pool (devtools#696).\n *\n * The Vitest pool (`pool.ts`) takes a {@link RelayConnectionFactory} that knows\n * how to `open()` a live CDP relay connection (boot relay → QR → phone scan →\n * cell inject → enableDomains) and `close()` it. Before this module that exact\n * assembly lived only inside the `devtools-test` CLI's `main()`; the standalone\n * CLI and the Vitest pool would otherwise each hand-roll it and drift.\n *\n * This is the single source of that assembly. `cli.ts` is refactored to call\n * `createRelayConnectionFactory(...).open()`, and `definePhoneVitestConfig`\n * (config.ts) exposes it so a downstream `vitest.config.ts` can wire the pool:\n *\n *   import { createRelayConnectionFactory } from '@ait-co/devtools/test-runner';\n *   const connection = createRelayConnectionFactory({\n *     schemeUrl,\n *     cell,\n *     // REQUIRED — own the stdout decision (the chunks carry the relay wss +\n *     // TOTP code). Suppress on non-interactive stdout; print otherwise.\n *     onQrContent: (chunks) => {\n *       if (!process.stdout.isTTY) return;\n *       for (const c of chunks) process.stdout.write(`${c}\\n`);\n *     },\n *   });\n *   export default defineConfig({ test: definePhoneVitestConfig({ connection }) });\n *\n * The heavy boot graph (chii relay, cloudflared, ws, debug-server) is pulled via\n * DYNAMIC import inside `open()` — so merely importing this module (or the\n * `@ait-co/devtools/test-runner` barrel) does NOT statically drag that graph in.\n *\n * SECRET-HANDLING: relay wss URLs, scheme URLs, and the TOTP secret/code are\n * never logged. `open()` reads the project-local `.ait_relay` secret read-only\n * (never mints) and the minted TOTP code rides only inside the QR `at=` param.\n *\n * Node-only. react-free (CdpConnection + lazily-imported MCP boot helpers only).\n */\n\nimport type { AttachDeps, AttachUrlParts } from '../mcp/attach-orchestrator.js';\nimport type { CdpConnection } from '../mcp/cdp-connection.js';\nimport type { DashboardState, QrHttpServer } from '../mcp/qr-http-server.js';\nimport type { RelayConnectionFactory } from './pool.js';\n\n// NOTE: every value import below is a DYNAMIC import inside `open()`. This module\n// keeps ONLY type-level static imports so that re-exporting it from the\n// `@ait-co/devtools/test-runner` barrel (config.ts) does NOT statically drag the\n// heavy MCP graph (cell.ts → attach-orchestrator.ts → tools.ts → server-lock,\n// plus chii/cloudflared via debug-server) onto that Node-config entry.\n\n/** Options for {@link createRelayConnectionFactory}. */\nexport interface RelayConnectionFactoryOptions {\n  /**\n   * intoss-private:// scheme URL from `ait deploy --scheme-only` (env3). The\n   * phone cold-loads the candidate bundle this URL points at. SECRET-HANDLING:\n   * never logged.\n   */\n  schemeUrl: string;\n  /**\n   * Project root for the `.ait_relay` secret lookup (read-only). Defaults to\n   * `process.cwd()`.\n   */\n  projectRoot?: string;\n  /**\n   * Attach wait timeout in ms — how long `open()` waits for the phone to scan\n   * the QR and attach. Omitted (the default) means **wait indefinitely** —\n   * the runner stays up until the user stops it (Ctrl-C/SIGTERM). QR-scan\n   * wait is a human-paced action; there is no sound default bound for it\n   * (devtools#735). Pass an explicit value to opt into a bounded wait (CI/\n   * headless callers — `--attach-timeout` on the CLI). (The per-file evaluate\n   * timeout is separate, passed via the pool's `run` options.)\n   */\n  timeoutMs?: number;\n  /** Disable browser auto-open of the QR dashboard (text QR only). */\n  headless?: boolean;\n  /**\n   * Cell axes injected as `__AIT_CELL__` before the first test bundle runs, so\n   * sdk-example's capture picks up the correct sdkLine/platform. Optional — when\n   * omitted no cell is injected. The values are not secrets.\n   */\n  cell?: { sdkLine: string; platform: string };\n  /**\n   * When `true`, injects `__AIT_STUB_BLOCKING__ = true` before the first test\n   * bundle runs (devtools#740, DT-2) — `bundle.ts`'s sdk-redirect module reads\n   * this flag via `isStubBlockingEnabled()` and answers the blocking-UI APIs\n   * in `bridge-stub.ts`'s `STUB_REGISTRY` from fixtures instead of forwarding\n   * them to native. Optional — omitted/false means no flag is injected, which\n   * is byte-for-byte the pre-#740 behavior (the sdk-redirect module treats\n   * absence the same as `false`). Not a secret.\n   */\n  stubBlocking?: boolean;\n  /**\n   * Overrides the dashboard HTTP server's bind base port (devtools#752).\n   * Threaded straight through to `startQrHttpServer`'s `dashboardPort`\n   * option — see that option's doc for the increment-on-EADDRINUSE scan\n   * behaviour and the `AIT_DEBUG_HTTP_PORT` env fallback. Omitted means\n   * `startQrHttpServer` resolves its own default (env → fixed default).\n   */\n  dashboardPort?: number;\n  /**\n   * Receives the QR/attach render content (text chunks) from\n   * `renderAndMaybeWait`, so the caller decides whether to print them — e.g.\n   * suppress on non-interactive stdout.\n   *\n   * REQUIRED (not optional) on purpose: these chunks contain the QR payload\n   * (which encodes the relay wss + TOTP `at=` code) and the attach JSON block.\n   * Making the hook mandatory means the factory never falls back to printing\n   * them itself — a downstream `vitest.config.ts` consumer that wires this via\n   * the `@ait-co/devtools/test-runner` barrel is forced to make an explicit\n   * stdout decision rather than silently leaking the secret-bearing block.\n   *\n   * SECRET-HANDLING: when a non-interactive caller is detected the hook MUST\n   * suppress the WHOLE chunk (not just `attachUrl`), since `relayUrl` rides in\n   * the same block.\n   */\n  onQrContent: (textChunks: string[]) => void;\n}\n\n/**\n * Builds a {@link RelayConnectionFactory} that opens a standalone env3 relay\n * connection.\n *\n * `open()` performs the full attach lifecycle and BLOCKS while a human scans\n * the rendered QR with their phone — there is no way around the manual scan\n * for env3. By default the wait is UNBOUNDED (`opts.timeoutMs` omitted): the\n * runner stays up until the user stops it (Ctrl-C/SIGTERM), since QR-scan is\n * a human-paced action with no sound default bound (devtools#735). Passing an\n * explicit `timeoutMs` opts into the old bounded behavior (CI/headless\n * callers). It resolves with the live `CdpConnection` once a matching page\n * attaches; `close()` tears the relay family down.\n *\n * The factory holds the booted relay family in a closure so `close()` can stop\n * it. A second `open()` on the same factory boots a fresh family (the previous\n * one should have been `close()`d first).\n */\nexport function createRelayConnectionFactory(\n  opts: RelayConnectionFactoryOptions,\n): RelayConnectionFactory {\n  const projectRoot = opts.projectRoot ?? process.cwd();\n  // Undefined/absent → Infinity (wait forever). An explicit finite value opts\n  // into the old bounded behavior. Number.isFinite guards downstream\n  // (renderAndMaybeWait / waitForFirstTarget) treat Infinity as \"no timer\".\n  const timeoutMs = opts.timeoutMs ?? Number.POSITIVE_INFINITY;\n  const headless = opts.headless === true;\n\n  // Captured so close() can stop the family that open() booted.\n  let family: { connection: CdpConnection; stop(): void } | undefined;\n  // QR HTTP server — started during open() when not headless, closed in close().\n  let qrServer: QrHttpServer | undefined;\n  // Session-phase state (#730) — drives the dashboard's `phase` field so the\n  // CLI's run start/complete and final teardown push an immediate SSE update\n  // instead of the dashboard just going dark when the process exits.\n  let phase: DashboardState['phase'] = 'active';\n  // Manual-blocking prompt state (devtools#741) — drives the dashboard's\n  // `manualPrompt` field. `null` outside a manual step.\n  let manualPrompt: DashboardState['manualPrompt'] = null;\n\n  return {\n    async open(): Promise<CdpConnection> {\n      // Dynamic imports: keep the chii/cloudflared/debug-server graph OFF the\n      // static import graph of this module (and the test-runner config barrel).\n      const { prepareAttach, renderAndMaybeWait, mintAttachUrl } = await import(\n        '../mcp/attach-orchestrator.js'\n      );\n      const { injectDebugIndicator, injectGlobals } = await import('./cell.js');\n      const { loadRelaySecretReadOnly } = await import('../mcp/relay-secret-store.js');\n      const { bootRelayFamily, buildRelayVerifyAuth } = await import('../mcp/debug-server.js');\n\n      // Load the project-local .ait_relay secret into AIT_DEBUG_TOTP_SECRET\n      // BEFORE booting the relay so assertRelayAuthConfigured()/buildRelayVerifyAuth()\n      // at the boot site see it. Read-only — never mints. SECRET-HANDLING: the\n      // value is never logged here.\n      await loadRelaySecretReadOnly({ projectRoot });\n\n      // PRIMARY FIX (devtools#714): bootRelayFamily starts the cloudflared tunnel\n      // as a background promise and returns immediately with tunnel.up === false.\n      // We must NOT call prepareAttach until the tunnel is up — it fails fast when\n      // tunnel.up is false (attach-orchestrator.ts tunnel-down guard).\n      //\n      // Wire onWssUrl (mirroring the MCP daemon path in debug-server.ts) to:\n      //   1. resolve a caller-held tunnel-ready promise so open() can await it, and\n      //   2. re-push dashboard SSE on late tunnel-up events (notifyStateChange).\n      //\n      // SECRET-HANDLING: onWssUrl receives the relay wss URL — never log it.\n      let resolveTunnelUp!: () => void;\n      const tunnelReady = new Promise<void>((resolve) => {\n        resolveTunnelUp = resolve;\n      });\n\n      const booted = await bootRelayFamily({\n        verifyAuth: buildRelayVerifyAuth(),\n        onWssUrl: () => {\n          // Resolve the tunnel-ready gate so the prepareAttach call below is\n          // unblocked. qrServer may not be set yet at call time (it's started\n          // after bootRelayFamily), so we use optional chaining — if the tunnel\n          // happens to come up after qrServer is started, notifyStateChange pushes\n          // the freshly minted attachUrl to any waiting dashboard SSE clients.\n          // SECRET-HANDLING: wssUrl is NOT forwarded here — the value travels only\n          // inside the closure via getTunnelStatus().wssUrl (used by mintAttachUrl).\n          resolveTunnelUp();\n          qrServer?.notifyStateChange();\n        },\n        // #730: parity with the MCP daemon path (debug-server.ts's onTunnelDown\n        // wiring) — without this, a permanent tunnel drop during a standalone\n        // CLI run left the dashboard showing a dead-but-scannable QR until the\n        // watchdog (up to ~210s) finally fired.\n        onTunnelDown: () => {\n          qrServer?.notifyStateChange();\n        },\n      });\n      family = booted;\n\n      // If the tunnel is already up (extremely fast boot or test double), resolve\n      // immediately so we don't stall on a promise that will never fire.\n      if (booted.getTunnelStatus?.().up) {\n        resolveTunnelUp();\n      }\n\n      // Track the last-captured attach parts so getDashboardState can mint a\n      // fresh attach URL on every dashboard request/SSE push (fresh TOTP at=).\n      // SECRET-HANDLING: parts contain the relay wss + scheme URL — never logged.\n      let lastAttachParts: AttachUrlParts | undefined;\n\n      // Assemble AttachDeps. We set qrHttpServer and onAttachUrlBuilt below\n      // (before prepareAttach) after optionally starting the web-QR server.\n      const attachDeps: AttachDeps = {\n        getTunnelStatus: booted.getTunnelStatus ?? (() => ({ up: false, wssUrl: null })),\n        getTotpSecret: () => process.env.AIT_DEBUG_TOTP_SECRET,\n        qrHttpServer: undefined, // filled in below if web-QR server started\n        onAttachUrlBuilt: undefined, // filled in below\n        canOpenBrowser: () => !headless,\n      };\n\n      // Web-QR server: reuse the same loopback HTTP dashboard that the MCP\n      // start_attach path uses (src/mcp/qr-http-server.ts). This makes the QR\n      // scannable even when stdout is non-interactive (Claude Code `!` / CI),\n      // because the browser is opened by URL — not via captured stdout.\n      //\n      // Headless decision: we start the server even in --headless mode so the\n      // printed stderr URL can be opened manually. The existing\n      // canOpenBrowser: () => !headless gate inside renderAndMaybeWait prevents\n      // the auto-open; headless users see only the stderr URL.\n      //\n      // On failure we fall back gracefully to the text-QR path — do NOT crash.\n      // SECRET-HANDLING: only http://127.0.0.1:<port>/ (no secrets) goes to stderr.\n      try {\n        const { startQrHttpServer } = await import('../mcp/qr-http-server.js');\n\n        const getDashboardState = (): DashboardState => ({\n          tunnel: attachDeps.getTunnelStatus(),\n          pages: null, // CLI/pool: no page-list introspection needed\n          attachUrl: lastAttachParts ? mintAttachUrl(attachDeps, lastAttachParts) : null,\n          mode: 'relay-dev' as const,\n          phase, // #730 — CLI-only 'running'/'complete' transitions via onSessionPhase\n          manualPrompt, // #741 — CLI-only --manual-blocking transitions via onManualPrompt\n        });\n\n        qrServer = await startQrHttpServer(getDashboardState, {\n          dashboardPort: opts.dashboardPort,\n        });\n\n        // Wire the QR server into attachDeps BEFORE prepareAttach is called so\n        // renderAndMaybeWait sees it and takes Path 2/3 (web-QR) instead of Path 4.\n        attachDeps.qrHttpServer = qrServer;\n\n        // Capture attach parts via onAttachUrlBuilt so getDashboardState can\n        // mint a fresh URL (fresh TOTP at= code) on every dashboard render.\n        attachDeps.onAttachUrlBuilt = (parts: AttachUrlParts) => {\n          lastAttachParts = parts;\n          qrServer?.notifyStateChange();\n        };\n\n        // Print the loopback dashboard URL to stderr — it carries no secrets\n        // (TOTP codes and relay wss live only in the in-memory HTTP response).\n        process.stderr.write(`devtools-test: QR dashboard: http://127.0.0.1:${qrServer.port}/\\n`);\n      } catch {\n        // startQrHttpServer failed (e.g. port conflict, import error). Fall back\n        // to the existing text-QR path by leaving qrHttpServer: undefined.\n        // qrServer remains undefined; close() handles that with optional chaining.\n      }\n\n      // PRIMARY FIX (devtools#714): await tunnel readiness before calling\n      // prepareAttach. Race: a 15 s timeout is generous — cloudflared typically\n      // comes up in < 5 s. On timeout we still call prepareAttach; it will hit\n      // the tunnel-down guard and throw a secret-free error (same as before,\n      // but now with a clear diagnostic instead of a silent WAITING freeze).\n      //\n      // Implementation: Promise.race against a 15 000 ms timeout signal. We do\n      // NOT use a timer-based early-exit because the existing code already\n      // surface-fails on tunnel-down inside prepareAttach with a secret-free\n      // message. The timeout here is purely a \"give the tunnel a fair chance\"\n      // gate — not a correctness boundary.\n      const TUNNEL_BOOT_TIMEOUT_MS = 15_000;\n      await Promise.race([\n        tunnelReady,\n        new Promise<void>((resolve) => setTimeout(resolve, TUNNEL_BOOT_TIMEOUT_MS)),\n      ]);\n\n      const prep = await prepareAttach(\n        attachDeps,\n        'relay-dev',\n        { scheme_url: opts.schemeUrl },\n        booted.connection,\n      );\n      if (!prep.ok) {\n        booted.stop();\n        family = undefined;\n        // SECONDARY FIX (devtools#714): close the QR server on the failure path\n        // so the loopback port listener does not leak. The normal-exit path is\n        // handled by close(); this mirrors that cleanup for the error path.\n        await qrServer?.close();\n        qrServer = undefined;\n        // SECRET-HANDLING: do NOT surface `prep.error.content` in the thrown\n        // message. Some prep error paths build their text from attach\n        // components, and the CLI catch writes `e.message` to stderr — embedding\n        // that text risks leaking the scheme/relay wss URL. The detailed\n        // diagnostic is the daemon/dashboard's job; the factory throws a\n        // secret-free message only.\n        throw new Error(\n          'createRelayConnectionFactory: attach preparation failed — check the scheme_url and that the relay tunnel is up',\n        );\n      }\n\n      // Render the QR + wait for the phone to attach. SECRET-HANDLING: this\n      // function never logs scheme/wss/TOTP values.\n      const waitResult = await renderAndMaybeWait(\n        attachDeps,\n        prep,\n        true,\n        timeoutMs,\n        booted.connection,\n      );\n      if (waitResult.isError) {\n        booted.stop();\n        family = undefined;\n        // SECONDARY FIX (devtools#714): close the QR server on the timeout path\n        // (mirrors the prep.ok failure path above).\n        await qrServer?.close();\n        qrServer = undefined;\n        // SECRET-HANDLING (BLOCKER fix): `waitResult.content` is the timeout\n        // result built from `buildTimeoutError(baseText, ...)`, and `baseText`\n        // is `JSON.stringify({ attachUrl, relayUrl, ... })` — `attachUrl` carries\n        // the TOTP `at=` code and `relayUrl` is the relay `wss://` URL. The CLI\n        // catch writes `e.message` to stderr, so extracting that text here would\n        // leak the relay wss + TOTP code on every timeout. Throw a secret-free\n        // message with only the timeout duration.\n        const timeoutSec = Math.round(timeoutMs / 1000);\n        throw new Error(\n          `createRelayConnectionFactory: attach timed out after ${timeoutSec}s — phone did not scan the QR within the timeout`,\n        );\n      }\n\n      // Surface the QR/attach render content to the caller, which owns the\n      // stdout decision (suppress on non-interactive stdout). There is no\n      // fallback that prints here itself: `onQrContent` is a required option so\n      // the secret-bearing block (attachUrl TOTP + relayUrl wss) can never be\n      // emitted without an explicit caller decision. SECRET-HANDLING.\n      const qrChunks = waitResult.content\n        .filter((c): c is { type: 'text'; text: string } => c.type === 'text')\n        .map((c) => c.text);\n      opts.onQrContent(qrChunks);\n\n      // PAGE-READY GATE (devtools#720, fix (a)+(b)):\n      //\n      // FIX (a) — ORDER: enableDomains() MUST run before injectDebugIndicator()\n      // and injectGlobals(). Both inject calls use Runtime.evaluate via\n      // sendCommand(), which guards with `if (!this.ws) reject(\"Call\n      // enableDomains() first\")`.  With the old ordering (inject → inject →\n      // enableDomains) injectDebugIndicator's throw was swallowed by cell.ts\n      // try/catch but injectGlobals (no try/catch) propagated fatally — when\n      // --cell was set open() hard-threw before enableDomains ever ran and the\n      // CLI exited with 0 files executed.\n      //\n      // FIX (b) — BOUNDED RETRY: the window between waitForFirstTarget (non-\n      // empty /targets) and enableDomains (page-level WS open) is where a\n      // Cloudflare edge idle-drop can disconnect the phone.  enableDomains()\n      // calls refreshTargets() internally; if the target list is empty at that\n      // point it throws \"No mini-app page attached\".  We absorb up to\n      // PAGE_READY_RETRIES transient failures by waiting briefly and retrying\n      // the refreshTargets+enableDomains sequence.  enableDomains() is\n      // idempotent (concurrent callers share the in-flight promise), so retries\n      // are safe.  Only after all retries fail do we surface a secret-free\n      // error.  This is the CLI equivalent of the MCP daemon's soft-fail\n      // cushion in relay-worker.ts.\n      //\n      // Neither fix touches chii-connection.ts or the MCP daemon path.\n      const PAGE_READY_RETRIES = 3;\n      const PAGE_READY_RETRY_DELAY_MS = 1_500;\n\n      let lastEnableError: Error | undefined;\n      for (let attempt = 1; attempt <= PAGE_READY_RETRIES; attempt++) {\n        try {\n          // FIX (a): enableDomains first — opens the page-level CDP websocket.\n          await booted.connection.enableDomains();\n          lastEnableError = undefined;\n          break;\n        } catch (err) {\n          lastEnableError = err instanceof Error ? err : new Error(String(err));\n          if (attempt < PAGE_READY_RETRIES) {\n            // FIX (b): brief pause then re-poll /targets before retrying\n            // enableDomains. Use a non-leaking approach: wait, then fall\n            // through to the next loop iteration.\n            await new Promise<void>((resolve) => setTimeout(resolve, PAGE_READY_RETRY_DELAY_MS));\n          }\n        }\n      }\n\n      if (lastEnableError !== undefined) {\n        booted.stop();\n        family = undefined;\n        await qrServer?.close();\n        qrServer = undefined;\n        // SECRET-HANDLING: message contains only a duration + attempt count.\n        // No relay wss URL, scheme URL, or TOTP code is included.\n        throw new Error(\n          `createRelayConnectionFactory: page did not become ready after ${PAGE_READY_RETRIES} attempts (${Math.round((PAGE_READY_RETRIES * PAGE_READY_RETRY_DELAY_MS) / 1000)}s) — the mini-app page may have disconnected before enableDomains() could open the CDP websocket`,\n        );\n      }\n\n      // FIX (a): inject AFTER enableDomains so the page-level CDP websocket is\n      // open and sendCommand() will not hit the ws===null guard.\n\n      // Show the on-phone \"Debugger Connected\" badge. injectDebugIndicator\n      // swallows its own errors (cell.ts try/catch), so a badge failure is\n      // non-fatal — test execution proceeds regardless.\n      await injectDebugIndicator(booted.connection);\n\n      // Inject the cell globals before any test bundle runs (session-global).\n      // injectGlobals() does NOT swallow errors — a genuine type/eval failure\n      // here surfaces clearly instead of silently skipping cell injection.\n      if (opts.cell !== undefined) {\n        await injectGlobals(booted.connection, { __AIT_CELL__: opts.cell });\n      }\n\n      // devtools#740 (DT-2): inject the bridge-stub gate before any test\n      // bundle runs, session-global like __AIT_CELL__ above. Only injected\n      // when explicitly requested — omitted/false means the sdk-redirect\n      // module's `isStubBlockingEnabled()` reads `undefined`, which is\n      // treated identically to `false` (zero-diff-when-off).\n      if (opts.stubBlocking === true) {\n        await injectGlobals(booted.connection, { __AIT_STUB_BLOCKING__: true });\n      }\n\n      return booted.connection;\n    },\n\n    // #730: drives the dashboard's `phase` field so the CLI's run start/end\n    // push an immediate SSE update instead of the dashboard just going dark.\n    onSessionPhase(next: 'running' | 'complete'): void {\n      phase = next;\n      qrServer?.notifyStateChange();\n    },\n\n    // #741: drives the dashboard's `manualPrompt` field for --manual-blocking\n    // — the CLI calls this immediately before injecting each manual file\n    // (prompt set) and once more with `null` after the last one (prompt\n    // cleared). Push is immediate (not waited on for ack) — v1 does not block\n    // on dashboard acknowledgment, only on the file's own (long) evaluate.\n    onManualPrompt(next: { file: string; index: number; total: number } | null): void {\n      manualPrompt = next;\n      qrServer?.notifyStateChange();\n    },\n\n    async close(connection: CdpConnection): Promise<void> {\n      // #730: flip the on-phone badge to disconnected AND push the terminal\n      // dashboard frame BEFORE tearing anything down, so neither surface goes\n      // dark without explanation when the CLI exits (dog-food gaps #1 + #2).\n      // Both are best-effort over the still-open channels — the ordering\n      // (before family.stop()/qrServer.close()) is load-bearing:\n      //   - qrServer.notifyStateChange() writes synchronously to the still-open\n      //     SSE sockets, so the 'complete' frame is on the wire before the HTTP\n      //     server is closed below.\n      //   - injectDebugIndicator runs over the still-open CDP channel, so the\n      //     phone actually receives the disconnected-state update before the\n      //     relay/tunnel are torn down.\n      if (phase !== 'complete') {\n        phase = 'complete';\n        qrServer?.notifyStateChange();\n      }\n      try {\n        const { injectDebugIndicator } = await import('./cell.js');\n        await injectDebugIndicator(connection, { state: 'disconnected' });\n      } catch {\n        // Channel may already be down (e.g. attach never completed) — non-fatal,\n        // the badge is informational UI only.\n      }\n      // family.stop() is synchronous best-effort: closes the CDP connection and\n      // shuts down the relay + cloudflared child.\n      family?.stop();\n      family = undefined;\n      // Close the web-QR HTTP server if one was started during open().\n      // close() is idempotent via optional chaining + reassignment to undefined.\n      await qrServer?.close();\n      qrServer = undefined;\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAqIA,SAAgB,6BACd,MACwB;CACxB,MAAM,cAAc,KAAK,eAAe,QAAQ,KAAK;CAIrD,MAAM,YAAY,KAAK,aAAa,OAAO;CAC3C,MAAM,WAAW,KAAK,aAAa;CAGnC,IAAI;CAEJ,IAAI;CAIJ,IAAI,QAAiC;CAGrC,IAAI,eAA+C;AAEnD,QAAO;EACL,MAAM,OAA+B;GAGnC,MAAM,EAAE,eAAe,oBAAoB,kBAAkB,MAAM,OACjE;GAEF,MAAM,EAAE,sBAAsB,kBAAkB,MAAM,OAAO;GAC7D,MAAM,EAAE,4BAA4B,MAAM,OAAO;GACjD,MAAM,EAAE,iBAAiB,yBAAyB,MAAM,OAAO;AAM/D,SAAM,wBAAwB,EAAE,aAAa,CAAC;GAY9C,IAAI;GACJ,MAAM,cAAc,IAAI,SAAe,YAAY;AACjD,sBAAkB;KAClB;GAEF,MAAM,SAAS,MAAM,gBAAgB;IACnC,YAAY,sBAAsB;IAClC,gBAAgB;AAQd,sBAAiB;AACjB,eAAU,mBAAmB;;IAM/B,oBAAoB;AAClB,eAAU,mBAAmB;;IAEhC,CAAC;AACF,YAAS;AAIT,OAAI,OAAO,mBAAmB,CAAC,GAC7B,kBAAiB;GAMnB,IAAI;GAIJ,MAAM,aAAyB;IAC7B,iBAAiB,OAAO,2BAA2B;KAAE,IAAI;KAAO,QAAQ;KAAM;IAC9E,qBAAqB,QAAQ,IAAI;IACjC,cAAc,KAAA;IACd,kBAAkB,KAAA;IAClB,sBAAsB,CAAC;IACxB;AAcD,OAAI;IACF,MAAM,EAAE,sBAAsB,MAAM,OAAO;IAE3C,MAAM,2BAA2C;KAC/C,QAAQ,WAAW,iBAAiB;KACpC,OAAO;KACP,WAAW,kBAAkB,cAAc,YAAY,gBAAgB,GAAG;KAC1E,MAAM;KACN;KACA;KACD;AAED,eAAW,MAAM,kBAAkB,mBAAmB,EACpD,eAAe,KAAK,eACrB,CAAC;AAIF,eAAW,eAAe;AAI1B,eAAW,oBAAoB,UAA0B;AACvD,uBAAkB;AAClB,eAAU,mBAAmB;;AAK/B,YAAQ,OAAO,MAAM,iDAAiD,SAAS,KAAK,KAAK;WACnF;GAiBR,MAAM,yBAAyB;AAC/B,SAAM,QAAQ,KAAK,CACjB,aACA,IAAI,SAAe,YAAY,WAAW,SAAS,uBAAuB,CAAC,CAC5E,CAAC;GAEF,MAAM,OAAO,MAAM,cACjB,YACA,aACA,EAAE,YAAY,KAAK,WAAW,EAC9B,OAAO,WACR;AACD,OAAI,CAAC,KAAK,IAAI;AACZ,WAAO,MAAM;AACb,aAAS,KAAA;AAIT,UAAM,UAAU,OAAO;AACvB,eAAW,KAAA;AAOX,UAAM,IAAI,MACR,iHACD;;GAKH,MAAM,aAAa,MAAM,mBACvB,YACA,MACA,MACA,WACA,OAAO,WACR;AACD,OAAI,WAAW,SAAS;AACtB,WAAO,MAAM;AACb,aAAS,KAAA;AAGT,UAAM,UAAU,OAAO;AACvB,eAAW,KAAA;IAQX,MAAM,aAAa,KAAK,MAAM,YAAY,IAAK;AAC/C,UAAM,IAAI,MACR,wDAAwD,WAAW,kDACpE;;GAQH,MAAM,WAAW,WAAW,QACzB,QAAQ,MAA2C,EAAE,SAAS,OAAO,CACrE,KAAK,MAAM,EAAE,KAAK;AACrB,QAAK,YAAY,SAAS;GA0B1B,MAAM,qBAAqB;GAC3B,MAAM,4BAA4B;GAElC,IAAI;AACJ,QAAK,IAAI,UAAU,GAAG,WAAW,oBAAoB,UACnD,KAAI;AAEF,UAAM,OAAO,WAAW,eAAe;AACvC,sBAAkB,KAAA;AAClB;YACO,KAAK;AACZ,sBAAkB,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,IAAI,CAAC;AACrE,QAAI,UAAU,mBAIZ,OAAM,IAAI,SAAe,YAAY,WAAW,SAAS,0BAA0B,CAAC;;AAK1F,OAAI,oBAAoB,KAAA,GAAW;AACjC,WAAO,MAAM;AACb,aAAS,KAAA;AACT,UAAM,UAAU,OAAO;AACvB,eAAW,KAAA;AAGX,UAAM,IAAI,MACR,iEAAiE,mBAAmB,aAAa,KAAK,MAAO,qBAAqB,4BAA6B,IAAK,CAAC,kGACtK;;AASH,SAAM,qBAAqB,OAAO,WAAW;AAK7C,OAAI,KAAK,SAAS,KAAA,EAChB,OAAM,cAAc,OAAO,YAAY,EAAE,cAAc,KAAK,MAAM,CAAC;AAQrE,OAAI,KAAK,iBAAiB,KACxB,OAAM,cAAc,OAAO,YAAY,EAAE,uBAAuB,MAAM,CAAC;AAGzE,UAAO,OAAO;;EAKhB,eAAe,MAAoC;AACjD,WAAQ;AACR,aAAU,mBAAmB;;EAQ/B,eAAe,MAAmE;AAChF,kBAAe;AACf,aAAU,mBAAmB;;EAG/B,MAAM,MAAM,YAA0C;AAYpD,OAAI,UAAU,YAAY;AACxB,YAAQ;AACR,cAAU,mBAAmB;;AAE/B,OAAI;IACF,MAAM,EAAE,yBAAyB,MAAM,OAAO;AAC9C,UAAM,qBAAqB,YAAY,EAAE,OAAO,gBAAgB,CAAC;WAC3D;AAMR,WAAQ,MAAM;AACd,YAAS,KAAA;AAGT,SAAM,UAAU,OAAO;AACvB,cAAW,KAAA;;EAEd"}

package/dist/test-runner/relay-worker.d.ts

@@ -1,2 +1,2 @@
-import { a as RelayRunReport, i as RelayRunOptions, n as FileResult, o as flattenResults, r as MANUAL_FILE_TIMEOUT_MS, s as runTestFilesOverRelay, t as EVALUATE_TIMEOUT_MARKER } from "../relay-worker-Dw3aIzIK.js";
+import { a as RelayRunReport, i as RelayRunOptions, n as FileResult, o as flattenResults, r as MANUAL_FILE_TIMEOUT_MS, s as runTestFilesOverRelay, t as EVALUATE_TIMEOUT_MARKER } from "../relay-worker-DJnZkXza.js";
 export { EVALUATE_TIMEOUT_MARKER, FileResult, MANUAL_FILE_TIMEOUT_MS, RelayRunOptions, RelayRunReport, flattenResults, runTestFilesOverRelay };

package/dist/test-runner/relay-worker.js

@@ -1,2 +1,2 @@
-import { i as runTestFilesOverRelay, n as MANUAL_FILE_TIMEOUT_MS, r as flattenResults, t as EVALUATE_TIMEOUT_MARKER } from "../relay-worker-UK0nBfDX.js";
+import { i as runTestFilesOverRelay, n as MANUAL_FILE_TIMEOUT_MS, r as flattenResults, t as EVALUATE_TIMEOUT_MARKER } from "../relay-worker-6fy1eaIo.js";
 export { EVALUATE_TIMEOUT_MARKER, MANUAL_FILE_TIMEOUT_MS, flattenResults, runTestFilesOverRelay };

package/dist/test-runner/report.d.ts

@@ -1,6 +1,6 @@
 import { t as AitCaptureLine } from "../capture-ltuV0gZa.js";
 import { r as TestResult } from "../runtime-DfHHZms2.js";
-import { a as RelayRunReport } from "../relay-worker-Dw3aIzIK.js";
+import { a as RelayRunReport } from "../relay-worker-DJnZkXza.js";
 
 //#region src/test-runner/report.d.ts
 /** The cell axes a report is stamped with — the test-matrix coordinates. */
@@ -34,13 +34,18 @@ interface RunnerAgnosticFileReport {
   /** Per-test results, when the file ran. Error strings are matcher messages only. */
   tests?: TestResult[];
   /**
-   * Present + `'manual'` only when this file ran under `--manual-blocking`
-   * (devtools#741) — human-attended, real native envelopes. Absent (never
-   * `false`) for unattended files: absence-means-unattended is the contract,
-   * mirroring `FileResult.mode` in relay-worker.ts. A manual-stamped record
-   * must never be diffed against an unattended one as if equivalent.
+   * Present only when this file ran under `--manual-blocking` or
+   * `--stub-blocking`. Absent (never `false`) for unattended files:
+   * absence-means-unattended is the contract, mirroring `FileResult.mode` in
+   * relay-worker.ts.
+   *
+   *   - `'manual'`  — devtools#741, human-attended, real native envelopes.
+   *   - `'stubbed'` — devtools#740 (DT-2), unattended, blocking-UI calls
+   *     answered from fixtures. A manual/stubbed-stamped record must never be
+   *     diffed against an unattended (or each other's) baseline as if
+   *     equivalent.
    */
-  mode?: 'manual';
+  mode?: 'manual' | 'stubbed';
 }
 /**
  * The runner-neutral, secret-free report written to disk. There are
@@ -48,10 +53,20 @@ interface RunnerAgnosticFileReport {
  * load-bearing (SECRET-HANDLING) and must not be "completed" by a future edit.
  */
 interface RunnerAgnosticReport {
-  /** Cell axes this run belongs to — baked into the body for portability. */
+  /**
+   * Cell axes this run belongs to — baked into the body for portability.
+   * `bridgeStub` is present + `true` ONLY on the artifact written for
+   * stub-blocking files (devtools#740, DT-2) — see `writeReportArtifact`'s
+   * doc for why this is a SEPARATE `.stubbed.json` artifact rather than a
+   * flag inside the standard/`.manual.json` report. Absent (never `false`)
+   * on every other artifact — this is the mandatory HYBRID-cell provenance
+   * stamp the issue calls for: a stubbed run must never be silently mixed
+   * into the real-device baseline report.
+   */
   cell: {
     sdkLine: string;
     platform: string;
+    bridgeStub?: true;
   };
   /** ISO timestamp of when the run started (from the core report). */
   startedAt: string;
@@ -93,11 +108,21 @@ declare function serializeRelayReport(report: RelayRunReport, meta: ReportCellMe
  * `<dir>/<sdkLine>.<platform>.manual.json` artifact instead of the standard
  * one — the standard `<sdkLine>.<platform>.json` filename is reserved for the
  * regular (unattended) files only, so a manual run's presence never mutates
- * what the unattended-baseline filename means. If ALL files in the run are
- * regular, only the standard artifact is written (today's behavior,
- * unchanged). If a run mixes both (regular files + `--manual-blocking`
- * scheduled last), BOTH artifacts are written — the manual one ALONGSIDE, not
- * replacing, the standard one.
+ * what the unattended-baseline filename means.
+ *
+ * Stub-blocking provenance (devtools#740, DT-2): `mode: 'stubbed'` files are
+ * written to a THIRD, separate `<dir>/<sdkLine>.<platform>.stubbed.json`
+ * artifact — never merged into the standard file (it is unattended, like the
+ * standard file, so a naive filename split could conflate the two) and never
+ * merged into `.manual.json` (it did NOT have a human present). Its body is
+ * ALSO stamped `cell.bridgeStub: true` — the mandatory HYBRID-cell provenance
+ * from the issue: a stubbed result must never be silently mixed into the
+ * real-device baseline report.
+ *
+ * If ALL files in the run are regular, only the standard artifact is written
+ * (today's behavior, unchanged). Any combination of the three modes present
+ * in a single run writes ONLY the corresponding artifacts — each is additive,
+ * never replacing another.
  *
  * SECRET-HANDLING: the written body contains no relay/secret fields (the schema
  * has none). `dir`/`projectRoot` are local filesystem paths, never logged here.
@@ -106,8 +131,9 @@ declare function serializeRelayReport(report: RelayRunReport, meta: ReportCellMe
  * @param dir    - Output directory (created recursively if missing).
  * @param meta   - Cell axes + projectRoot.
  * @returns The absolute path(s) written, in order: standard first (if any
- *   regular files ran), then manual (if any manual files ran). At least one
- *   path is always returned when `report.files` is non-empty.
+ *   regular files ran), then manual (if any manual files ran), then stubbed
+ *   (if any stubbed files ran). At least one path is always returned when
+ *   `report.files` is non-empty.
  */
 declare function writeReportArtifact(report: RelayRunReport, dir: string, meta: ReportCellMeta): Promise<string[]>;
 /**

package/dist/test-runner/report.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"report.d.ts","names":[],"sources":["../../src/test-runner/report.ts"],"mappings":";;;;;;UA+BiB,cAAA;EAqCX;EAnCJ,OAAA;EA2CmC;EAzCnC,QAAA;EAiDQ;;;;;EA3CR,WAAA;AAAA;;UAIe,wBAAA;EAqCf;;;;;EA/BA,IAAA;EA0Cc;EAxCd,KAAA;EAwCiC;EAtCjC,QAAA;EACA,MAAA;EACA,MAAA;EACA,OAAA;EAgEQ;EA9DR,KAAA,GAAQ,UAAA;EAgEP;;;;;;;EAxDD,IAAA;AAAA;;AAkHF;;;;UA1GiB,oBAAA;EA8Gd;EA5GD,IAAA;IAAQ,OAAA;IAAiB,QAAA;EAAA;EA0GzB;EAxGA,SAAA;EAyGA;EAvGA,QAAA;EAwGQ;EAtGR,MAAA,EAAQ,cAAA;EA2JY;EAzJpB,KAAA,EAAO,wBAAA;;;;;;;EAOP,SAAA;IAAc,WAAA,EAAa,MAAA;EAAA;AAAA;;;;;;;;iBA4Bb,oBAAA,CACd,MAAA,EAAQ,cAAA,EACR,IAAA,EAAM,cAAA,GACL,oBAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0DmB,mBAAA,CACpB,MAAA,EAAQ,cAAA,EACR,GAAA,UACA,IAAA,EAAM,cAAA,GACL,OAAA;;;;;;;;;;;;;;;;;;;iBAqDmB,qBAAA,CACpB,QAAA,EAAU,aAAA,CAAc,cAAA,GACxB,GAAA,UACA,IAAA;EAAQ,OAAA;EAAiB,QAAA;AAAA,IACxB,OAAA"}
+{"version":3,"file":"report.d.ts","names":[],"sources":["../../src/test-runner/report.ts"],"mappings":";;;;;;UA+BiB,cAAA;EA0CX;EAxCJ,OAAA;EAgDmC;EA9CnC,QAAA;EA+DQ;;;;;EAzDR,WAAA;AAAA;;UAIe,wBAAA;EAiDf;;;;;EA3CA,IAAA;EAwDA;EAtDA,KAAA;EAsD2B;EApD3B,QAAA;EACA,MAAA;EACA,MAAA;EACA,OAAA;;EAEA,KAAA,GAAQ,UAAA;EA6EF;;;;;;;;;;;AAuER;EAvIE,IAAA;AAAA;;;;;;UAQe,oBAAA;EAgIf;;;;;;;AA2EF;;;EAhME,IAAA;IAAQ,OAAA;IAAiB,QAAA;IAAkB,UAAA;EAAA;EAiMjC;EA/LV,SAAA;EA+LA;EA7LA,QAAA;EA+LQ;EA7LR,MAAA,EAAQ,cAAA;EA6LR;EA3LA,KAAA,EAAO,wBAAA;EA4LC;;;;;;EArLR,SAAA;IAAc,WAAA,EAAa,MAAA;EAAA;AAAA;;;;;;;;iBA4Bb,oBAAA,CACd,MAAA,EAAQ,cAAA,EACR,IAAA,EAAM,cAAA,GACL,oBAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsEmB,mBAAA,CACpB,MAAA,EAAQ,cAAA,EACR,GAAA,UACA,IAAA,EAAM,cAAA,GACL,OAAA;;;;;;;;;;;;;;;;;;;iBAwEmB,qBAAA,CACpB,QAAA,EAAU,aAAA,CAAc,cAAA,GACxB,GAAA,UACA,IAAA;EAAQ,OAAA;EAAiB,QAAA;AAAA,IACxB,OAAA"}

package/dist/test-runner/report.js

@@ -56,7 +56,7 @@ function serializeRelayReport(report, meta) {
 		...report.preflight ? { preflight: report.preflight } : {},
 		files: report.files.map((f) => {
 			const file = relativise(meta.projectRoot, f.file);
-			const modeField = f.mode === "manual" ? { mode: "manual" } : {};
+			const modeField = f.mode === "manual" || f.mode === "stubbed" ? { mode: f.mode } : {};
 			if ("error" in f.result) return {
 				file,
 				error: f.result.error,
@@ -88,11 +88,21 @@ function serializeRelayReport(report, meta) {
 * `<dir>/<sdkLine>.<platform>.manual.json` artifact instead of the standard
 * one — the standard `<sdkLine>.<platform>.json` filename is reserved for the
 * regular (unattended) files only, so a manual run's presence never mutates
-* what the unattended-baseline filename means. If ALL files in the run are
-* regular, only the standard artifact is written (today's behavior,
-* unchanged). If a run mixes both (regular files + `--manual-blocking`
-* scheduled last), BOTH artifacts are written — the manual one ALONGSIDE, not
-* replacing, the standard one.
+* what the unattended-baseline filename means.
+*
+* Stub-blocking provenance (devtools#740, DT-2): `mode: 'stubbed'` files are
+* written to a THIRD, separate `<dir>/<sdkLine>.<platform>.stubbed.json`
+* artifact — never merged into the standard file (it is unattended, like the
+* standard file, so a naive filename split could conflate the two) and never
+* merged into `.manual.json` (it did NOT have a human present). Its body is
+* ALSO stamped `cell.bridgeStub: true` — the mandatory HYBRID-cell provenance
+* from the issue: a stubbed result must never be silently mixed into the
+* real-device baseline report.
+*
+* If ALL files in the run are regular, only the standard artifact is written
+* (today's behavior, unchanged). Any combination of the three modes present
+* in a single run writes ONLY the corresponding artifacts — each is additive,
+* never replacing another.
 *
 * SECRET-HANDLING: the written body contains no relay/secret fields (the schema
 * has none). `dir`/`projectRoot` are local filesystem paths, never logged here.
@@ -101,14 +111,16 @@ function serializeRelayReport(report, meta) {
 * @param dir    - Output directory (created recursively if missing).
 * @param meta   - Cell axes + projectRoot.
 * @returns The absolute path(s) written, in order: standard first (if any
-*   regular files ran), then manual (if any manual files ran). At least one
-*   path is always returned when `report.files` is non-empty.
+*   regular files ran), then manual (if any manual files ran), then stubbed
+*   (if any stubbed files ran). At least one path is always returned when
+*   `report.files` is non-empty.
 */
 async function writeReportArtifact(report, dir, meta) {
 	const serialised = serializeRelayReport(report, meta);
 	await mkdir(dir, { recursive: true });
-	const regularFiles = serialised.files.filter((f) => f.mode !== "manual");
+	const regularFiles = serialised.files.filter((f) => f.mode === void 0);
 	const manualFiles = serialised.files.filter((f) => f.mode === "manual");
+	const stubbedFiles = serialised.files.filter((f) => f.mode === "stubbed");
 	const written = [];
 	if (regularFiles.length > 0 || serialised.files.length === 0) {
 		const outFile = path.join(dir, `${meta.sdkLine}.${meta.platform}.json`);
@@ -126,6 +138,18 @@ async function writeReportArtifact(report, dir, meta) {
 		}, null, 2)}\n`, "utf8");
 		written.push(manualOutFile);
 	}
+	if (stubbedFiles.length > 0) {
+		const stubbedOutFile = path.join(dir, `${meta.sdkLine}.${meta.platform}.stubbed.json`);
+		await writeFile(stubbedOutFile, `${JSON.stringify({
+			...serialised,
+			cell: {
+				...serialised.cell,
+				bridgeStub: true
+			},
+			files: stubbedFiles
+		}, null, 2)}\n`, "utf8");
+		written.push(stubbedOutFile);
+	}
 	return written;
 }
 /**

package/dist/test-runner/report.js.map

@@ -1 +1 @@
-{"version":3,"file":"report.js","names":[],"sources":["../../src/test-runner/report.ts"],"sourcesContent":["/**\n * Runner-agnostic report serialisation for env3 test runs (devtools#696).\n *\n * Both env3 execution paths — the Vitest custom pool (`pool.ts`) and the\n * standalone `devtools-test` CLI (`cli.ts`) — call the same core\n * `runTestFilesOverRelay` and so produce the same {@link RelayRunReport}. This\n * module is the single, runner-neutral place that turns that in-memory report\n * into a stable on-disk artifact so a 2.x run and a 3.0 run can be diffed\n * cell-by-cell after the fact.\n *\n * The serialised schema is deliberately MINIMAL and secret-free:\n *\n *   - file paths are stored RELATIVE to `projectRoot` (no absolute `/Users/...`\n *     leakage — see {@link RunnerAgnosticReport.files});\n *   - the cell metadata (sdkLine/platform) is baked INTO the body, not only the\n *     filename, so a moved artifact never loses its provenance;\n *   - NO relay wss / scheme / TOTP / relayUrl fields exist in the schema at all\n *     (enforced by the type + this comment) — error strings are the matcher\n *     message only, inherited from rpc.ts which already strips expression/value.\n *\n * react-free — depends only on the type-level `RelayRunReport` and `node:fs` /\n * `node:path`. Safe to bundle without pulling the chii/cloudflared graph.\n */\n\nimport { mkdir, writeFile } from 'node:fs/promises';\nimport path from 'node:path';\nimport type { AitCaptureLine } from './capture.js';\nimport type { RelayRunReport } from './relay-worker.js';\nimport type { TestResult } from './runtime.js';\n\n/** The cell axes a report is stamped with — the test-matrix coordinates. */\nexport interface ReportCellMeta {\n  /** SDK line under test (e.g. `'2.x'` / `'3.x'`). */\n  sdkLine: string;\n  /** Platform under test (e.g. `'ios'` / `'android'` / `'mock'`). */\n  platform: string;\n  /**\n   * Project root the run was launched from. Used ONLY to relativise file paths\n   * out of the serialised report — never stored in the output. SECRET-HANDLING:\n   * absolute project paths must not leak into artifacts.\n   */\n  projectRoot: string;\n}\n\n/** Per-file slice of a {@link RunnerAgnosticReport}. */\nexport interface RunnerAgnosticFileReport {\n  /**\n   * Test file path, RELATIVE to `projectRoot`. Never absolute — `path.relative`\n   * strips the machine-specific prefix so the artifact is portable and leaks no\n   * local filesystem layout.\n   */\n  file: string;\n  /** Whole-file bundle/inject error (matcher message only), when the file failed. */\n  error?: string;\n  /** In-page run duration (ms) for this file, when it ran. */\n  duration?: number;\n  passed?: number;\n  failed?: number;\n  skipped?: number;\n  /** Per-test results, when the file ran. Error strings are matcher messages only. */\n  tests?: TestResult[];\n  /**\n   * Present + `'manual'` only when this file ran under `--manual-blocking`\n   * (devtools#741) — human-attended, real native envelopes. Absent (never\n   * `false`) for unattended files: absence-means-unattended is the contract,\n   * mirroring `FileResult.mode` in relay-worker.ts. A manual-stamped record\n   * must never be diffed against an unattended one as if equivalent.\n   */\n  mode?: 'manual';\n}\n\n/**\n * The runner-neutral, secret-free report written to disk. There are\n * intentionally NO wss/scheme/TOTP/relayUrl fields on this type — the absence is\n * load-bearing (SECRET-HANDLING) and must not be \"completed\" by a future edit.\n */\nexport interface RunnerAgnosticReport {\n  /** Cell axes this run belongs to — baked into the body for portability. */\n  cell: { sdkLine: string; platform: string };\n  /** ISO timestamp of when the run started (from the core report). */\n  startedAt: string;\n  /** Total wall-clock ms (bundling + sequential injection). */\n  duration: number;\n  /** Flattened totals across all files. */\n  totals: RelayRunReport['totals'];\n  /** Per-file results with projectRoot-relative paths. */\n  files: RunnerAgnosticFileReport[];\n  /**\n   * Permission-state preflight result (devtools#739), mirrored verbatim from\n   * `RelayRunReport.preflight` — see that field's docblock. Absent when the\n   * preflight did not complete (non-fatal; the run still succeeds). No\n   * secrets — permission-state strings only.\n   */\n  preflight?: { permissions: Record<string, string> };\n}\n\n/**\n * Converts an absolute (or already-relative) file path to a projectRoot-relative\n * one. `path.relative` returns `''` when the paths are equal — guard that to the\n * basename so the field is never empty.\n *\n * SECRET-HANDLING: this is the single choke point that strips absolute project\n * paths from the artifact.\n */\nfunction relativise(projectRoot: string, file: string): string {\n  const rel = path.relative(projectRoot, file);\n  if (rel === '' || rel.startsWith('..') || path.isAbsolute(rel)) {\n    // Outside the project root (or equal) — fall back to the basename rather\n    // than emitting an absolute or `../../..` traversal path.\n    return path.basename(file);\n  }\n  return rel;\n}\n\n/**\n * Serialises a {@link RelayRunReport} into the runner-agnostic, secret-free\n * on-disk shape. Pure — no IO; testable with a plain report + meta.\n *\n * @param report - The core relay run report.\n * @param meta   - Cell axes + projectRoot (projectRoot is consumed, not stored).\n */\nexport function serializeRelayReport(\n  report: RelayRunReport,\n  meta: ReportCellMeta,\n): RunnerAgnosticReport {\n  return {\n    cell: { sdkLine: meta.sdkLine, platform: meta.platform },\n    startedAt: report.startedAt,\n    duration: report.duration,\n    totals: report.totals,\n    ...(report.preflight ? { preflight: report.preflight } : {}),\n    files: report.files.map((f): RunnerAgnosticFileReport => {\n      const file = relativise(meta.projectRoot, f.file);\n      const modeField = f.mode === 'manual' ? ({ mode: 'manual' } as const) : {};\n      if ('error' in f.result) {\n        // Matcher/inject error message only — rpc.ts already stripped the\n        // expression/value upstream.\n        return { file, error: f.result.error, ...modeField };\n      }\n      return {\n        file,\n        duration: f.result.duration,\n        passed: f.result.passed,\n        failed: f.result.failed,\n        skipped: f.result.skipped,\n        tests: f.result.tests,\n        ...modeField,\n      };\n    }),\n  };\n}\n\n/**\n * Writes the serialised report to `<dir>/<sdkLine>.<platform>.json`, creating\n * `dir` if needed. Returns the absolute path(s) written.\n *\n * The cell-suffixed filename keeps 2.x and 3.0 (and per-platform) runs as\n * distinct artifacts in the same directory; the same cell metadata is also baked\n * into the body so a renamed/moved file still carries its provenance.\n *\n * Manual-run provenance (devtools#741): when `report.files` contains ANY\n * `mode: 'manual'` entry (i.e. this run included `--manual-blocking` files),\n * the manual-tagged files are written to a SEPARATE\n * `<dir>/<sdkLine>.<platform>.manual.json` artifact instead of the standard\n * one — the standard `<sdkLine>.<platform>.json` filename is reserved for the\n * regular (unattended) files only, so a manual run's presence never mutates\n * what the unattended-baseline filename means. If ALL files in the run are\n * regular, only the standard artifact is written (today's behavior,\n * unchanged). If a run mixes both (regular files + `--manual-blocking`\n * scheduled last), BOTH artifacts are written — the manual one ALONGSIDE, not\n * replacing, the standard one.\n *\n * SECRET-HANDLING: the written body contains no relay/secret fields (the schema\n * has none). `dir`/`projectRoot` are local filesystem paths, never logged here.\n *\n * @param report - The core relay run report.\n * @param dir    - Output directory (created recursively if missing).\n * @param meta   - Cell axes + projectRoot.\n * @returns The absolute path(s) written, in order: standard first (if any\n *   regular files ran), then manual (if any manual files ran). At least one\n *   path is always returned when `report.files` is non-empty.\n */\nexport async function writeReportArtifact(\n  report: RelayRunReport,\n  dir: string,\n  meta: ReportCellMeta,\n): Promise<string[]> {\n  const serialised = serializeRelayReport(report, meta);\n  await mkdir(dir, { recursive: true });\n\n  const regularFiles = serialised.files.filter((f) => f.mode !== 'manual');\n  const manualFiles = serialised.files.filter((f) => f.mode === 'manual');\n\n  const written: string[] = [];\n\n  // Standard artifact: written whenever there are regular files, OR when the\n  // whole run is empty (preserves the pre-#741 \"always write one file\"\n  // behavior for a run with zero files, e.g. an empty glob match).\n  if (regularFiles.length > 0 || serialised.files.length === 0) {\n    const outFile = path.join(dir, `${meta.sdkLine}.${meta.platform}.json`);\n    await writeFile(\n      outFile,\n      `${JSON.stringify({ ...serialised, files: regularFiles }, null, 2)}\\n`,\n      'utf8',\n    );\n    written.push(outFile);\n  }\n\n  if (manualFiles.length > 0) {\n    const manualOutFile = path.join(dir, `${meta.sdkLine}.${meta.platform}.manual.json`);\n    await writeFile(\n      manualOutFile,\n      `${JSON.stringify({ ...serialised, files: manualFiles }, null, 2)}\\n`,\n      'utf8',\n    );\n    written.push(manualOutFile);\n  }\n\n  return written;\n}\n\n/**\n * Writes harvested `__AIT_CAPTURE__` lines to per-category files under `dir`,\n * named `<category>.<sdkLine>.<platform>.json` — the SAME convention\n * sdk-example's env1 `flushCapture` uses on the filesystem, so env1 and env3\n * capture artifacts line up for diffing.\n *\n * Each line's `json` payload is an opaque JSON array of capture records. Lines\n * sharing a category are concatenated into one array, in harvest order.\n *\n * SECRET-HANDLING: only allowlist-prefixed capture lines reach here (the parser\n * dropped wss/scheme noise); the `json` payload is written verbatim but is a\n * capture record array, not a relay/secret.\n *\n * @param captures - Parsed capture lines (from `RelayRunReport.captures`).\n * @param dir      - Output directory (created recursively if missing).\n * @param cell     - Cell axes for the filename suffix.\n * @returns The absolute paths written (one per category), in category order.\n */\nexport async function writeCaptureArtifacts(\n  captures: ReadonlyArray<AitCaptureLine>,\n  dir: string,\n  cell: { sdkLine: string; platform: string },\n): Promise<string[]> {\n  if (captures.length === 0) return [];\n\n  // Group payloads by category, preserving harvest order. Each payload is an\n  // opaque JSON array string; concatenate parsed arrays under the same category.\n  const byCategory = new Map<string, unknown[]>();\n  for (const { category, json } of captures) {\n    let merged = byCategory.get(category);\n    if (!merged) {\n      merged = [];\n      byCategory.set(category, merged);\n    }\n    // The parser already validated `json` parses; an array payload is expected.\n    const parsed = JSON.parse(json) as unknown;\n    if (Array.isArray(parsed)) {\n      merged.push(...parsed);\n    } else {\n      merged.push(parsed);\n    }\n  }\n\n  await mkdir(dir, { recursive: true });\n  const written: string[] = [];\n  for (const [category, records] of byCategory) {\n    const outFile = path.join(dir, `${category}.${cell.sdkLine}.${cell.platform}.json`);\n    await writeFile(outFile, `${JSON.stringify(records, null, 2)}\\n`, 'utf8');\n    written.push(outFile);\n  }\n  return written;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwGA,SAAS,WAAW,aAAqB,MAAsB;CAC7D,MAAM,MAAM,KAAK,SAAS,aAAa,KAAK;AAC5C,KAAI,QAAQ,MAAM,IAAI,WAAW,KAAK,IAAI,KAAK,WAAW,IAAI,CAG5D,QAAO,KAAK,SAAS,KAAK;AAE5B,QAAO;;;;;;;;;AAUT,SAAgB,qBACd,QACA,MACsB;AACtB,QAAO;EACL,MAAM;GAAE,SAAS,KAAK;GAAS,UAAU,KAAK;GAAU;EACxD,WAAW,OAAO;EAClB,UAAU,OAAO;EACjB,QAAQ,OAAO;EACf,GAAI,OAAO,YAAY,EAAE,WAAW,OAAO,WAAW,GAAG,EAAE;EAC3D,OAAO,OAAO,MAAM,KAAK,MAAgC;GACvD,MAAM,OAAO,WAAW,KAAK,aAAa,EAAE,KAAK;GACjD,MAAM,YAAY,EAAE,SAAS,WAAY,EAAE,MAAM,UAAU,GAAa,EAAE;AAC1E,OAAI,WAAW,EAAE,OAGf,QAAO;IAAE;IAAM,OAAO,EAAE,OAAO;IAAO,GAAG;IAAW;AAEtD,UAAO;IACL;IACA,UAAU,EAAE,OAAO;IACnB,QAAQ,EAAE,OAAO;IACjB,QAAQ,EAAE,OAAO;IACjB,SAAS,EAAE,OAAO;IAClB,OAAO,EAAE,OAAO;IAChB,GAAG;IACJ;IACD;EACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiCH,eAAsB,oBACpB,QACA,KACA,MACmB;CACnB,MAAM,aAAa,qBAAqB,QAAQ,KAAK;AACrD,OAAM,MAAM,KAAK,EAAE,WAAW,MAAM,CAAC;CAErC,MAAM,eAAe,WAAW,MAAM,QAAQ,MAAM,EAAE,SAAS,SAAS;CACxE,MAAM,cAAc,WAAW,MAAM,QAAQ,MAAM,EAAE,SAAS,SAAS;CAEvE,MAAM,UAAoB,EAAE;AAK5B,KAAI,aAAa,SAAS,KAAK,WAAW,MAAM,WAAW,GAAG;EAC5D,MAAM,UAAU,KAAK,KAAK,KAAK,GAAG,KAAK,QAAQ,GAAG,KAAK,SAAS,OAAO;AACvE,QAAM,UACJ,SACA,GAAG,KAAK,UAAU;GAAE,GAAG;GAAY,OAAO;GAAc,EAAE,MAAM,EAAE,CAAC,KACnE,OACD;AACD,UAAQ,KAAK,QAAQ;;AAGvB,KAAI,YAAY,SAAS,GAAG;EAC1B,MAAM,gBAAgB,KAAK,KAAK,KAAK,GAAG,KAAK,QAAQ,GAAG,KAAK,SAAS,cAAc;AACpF,QAAM,UACJ,eACA,GAAG,KAAK,UAAU;GAAE,GAAG;GAAY,OAAO;GAAa,EAAE,MAAM,EAAE,CAAC,KAClE,OACD;AACD,UAAQ,KAAK,cAAc;;AAG7B,QAAO;;;;;;;;;;;;;;;;;;;;AAqBT,eAAsB,sBACpB,UACA,KACA,MACmB;AACnB,KAAI,SAAS,WAAW,EAAG,QAAO,EAAE;CAIpC,MAAM,6BAAa,IAAI,KAAwB;AAC/C,MAAK,MAAM,EAAE,UAAU,UAAU,UAAU;EACzC,IAAI,SAAS,WAAW,IAAI,SAAS;AACrC,MAAI,CAAC,QAAQ;AACX,YAAS,EAAE;AACX,cAAW,IAAI,UAAU,OAAO;;EAGlC,MAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,MAAI,MAAM,QAAQ,OAAO,CACvB,QAAO,KAAK,GAAG,OAAO;MAEtB,QAAO,KAAK,OAAO;;AAIvB,OAAM,MAAM,KAAK,EAAE,WAAW,MAAM,CAAC;CACrC,MAAM,UAAoB,EAAE;AAC5B,MAAK,MAAM,CAAC,UAAU,YAAY,YAAY;EAC5C,MAAM,UAAU,KAAK,KAAK,KAAK,GAAG,SAAS,GAAG,KAAK,QAAQ,GAAG,KAAK,SAAS,OAAO;AACnF,QAAM,UAAU,SAAS,GAAG,KAAK,UAAU,SAAS,MAAM,EAAE,CAAC,KAAK,OAAO;AACzE,UAAQ,KAAK,QAAQ;;AAEvB,QAAO"}
+{"version":3,"file":"report.js","names":[],"sources":["../../src/test-runner/report.ts"],"sourcesContent":["/**\n * Runner-agnostic report serialisation for env3 test runs (devtools#696).\n *\n * Both env3 execution paths — the Vitest custom pool (`pool.ts`) and the\n * standalone `devtools-test` CLI (`cli.ts`) — call the same core\n * `runTestFilesOverRelay` and so produce the same {@link RelayRunReport}. This\n * module is the single, runner-neutral place that turns that in-memory report\n * into a stable on-disk artifact so a 2.x run and a 3.0 run can be diffed\n * cell-by-cell after the fact.\n *\n * The serialised schema is deliberately MINIMAL and secret-free:\n *\n *   - file paths are stored RELATIVE to `projectRoot` (no absolute `/Users/...`\n *     leakage — see {@link RunnerAgnosticReport.files});\n *   - the cell metadata (sdkLine/platform) is baked INTO the body, not only the\n *     filename, so a moved artifact never loses its provenance;\n *   - NO relay wss / scheme / TOTP / relayUrl fields exist in the schema at all\n *     (enforced by the type + this comment) — error strings are the matcher\n *     message only, inherited from rpc.ts which already strips expression/value.\n *\n * react-free — depends only on the type-level `RelayRunReport` and `node:fs` /\n * `node:path`. Safe to bundle without pulling the chii/cloudflared graph.\n */\n\nimport { mkdir, writeFile } from 'node:fs/promises';\nimport path from 'node:path';\nimport type { AitCaptureLine } from './capture.js';\nimport type { RelayRunReport } from './relay-worker.js';\nimport type { TestResult } from './runtime.js';\n\n/** The cell axes a report is stamped with — the test-matrix coordinates. */\nexport interface ReportCellMeta {\n  /** SDK line under test (e.g. `'2.x'` / `'3.x'`). */\n  sdkLine: string;\n  /** Platform under test (e.g. `'ios'` / `'android'` / `'mock'`). */\n  platform: string;\n  /**\n   * Project root the run was launched from. Used ONLY to relativise file paths\n   * out of the serialised report — never stored in the output. SECRET-HANDLING:\n   * absolute project paths must not leak into artifacts.\n   */\n  projectRoot: string;\n}\n\n/** Per-file slice of a {@link RunnerAgnosticReport}. */\nexport interface RunnerAgnosticFileReport {\n  /**\n   * Test file path, RELATIVE to `projectRoot`. Never absolute — `path.relative`\n   * strips the machine-specific prefix so the artifact is portable and leaks no\n   * local filesystem layout.\n   */\n  file: string;\n  /** Whole-file bundle/inject error (matcher message only), when the file failed. */\n  error?: string;\n  /** In-page run duration (ms) for this file, when it ran. */\n  duration?: number;\n  passed?: number;\n  failed?: number;\n  skipped?: number;\n  /** Per-test results, when the file ran. Error strings are matcher messages only. */\n  tests?: TestResult[];\n  /**\n   * Present only when this file ran under `--manual-blocking` or\n   * `--stub-blocking`. Absent (never `false`) for unattended files:\n   * absence-means-unattended is the contract, mirroring `FileResult.mode` in\n   * relay-worker.ts.\n   *\n   *   - `'manual'`  — devtools#741, human-attended, real native envelopes.\n   *   - `'stubbed'` — devtools#740 (DT-2), unattended, blocking-UI calls\n   *     answered from fixtures. A manual/stubbed-stamped record must never be\n   *     diffed against an unattended (or each other's) baseline as if\n   *     equivalent.\n   */\n  mode?: 'manual' | 'stubbed';\n}\n\n/**\n * The runner-neutral, secret-free report written to disk. There are\n * intentionally NO wss/scheme/TOTP/relayUrl fields on this type — the absence is\n * load-bearing (SECRET-HANDLING) and must not be \"completed\" by a future edit.\n */\nexport interface RunnerAgnosticReport {\n  /**\n   * Cell axes this run belongs to — baked into the body for portability.\n   * `bridgeStub` is present + `true` ONLY on the artifact written for\n   * stub-blocking files (devtools#740, DT-2) — see `writeReportArtifact`'s\n   * doc for why this is a SEPARATE `.stubbed.json` artifact rather than a\n   * flag inside the standard/`.manual.json` report. Absent (never `false`)\n   * on every other artifact — this is the mandatory HYBRID-cell provenance\n   * stamp the issue calls for: a stubbed run must never be silently mixed\n   * into the real-device baseline report.\n   */\n  cell: { sdkLine: string; platform: string; bridgeStub?: true };\n  /** ISO timestamp of when the run started (from the core report). */\n  startedAt: string;\n  /** Total wall-clock ms (bundling + sequential injection). */\n  duration: number;\n  /** Flattened totals across all files. */\n  totals: RelayRunReport['totals'];\n  /** Per-file results with projectRoot-relative paths. */\n  files: RunnerAgnosticFileReport[];\n  /**\n   * Permission-state preflight result (devtools#739), mirrored verbatim from\n   * `RelayRunReport.preflight` — see that field's docblock. Absent when the\n   * preflight did not complete (non-fatal; the run still succeeds). No\n   * secrets — permission-state strings only.\n   */\n  preflight?: { permissions: Record<string, string> };\n}\n\n/**\n * Converts an absolute (or already-relative) file path to a projectRoot-relative\n * one. `path.relative` returns `''` when the paths are equal — guard that to the\n * basename so the field is never empty.\n *\n * SECRET-HANDLING: this is the single choke point that strips absolute project\n * paths from the artifact.\n */\nfunction relativise(projectRoot: string, file: string): string {\n  const rel = path.relative(projectRoot, file);\n  if (rel === '' || rel.startsWith('..') || path.isAbsolute(rel)) {\n    // Outside the project root (or equal) — fall back to the basename rather\n    // than emitting an absolute or `../../..` traversal path.\n    return path.basename(file);\n  }\n  return rel;\n}\n\n/**\n * Serialises a {@link RelayRunReport} into the runner-agnostic, secret-free\n * on-disk shape. Pure — no IO; testable with a plain report + meta.\n *\n * @param report - The core relay run report.\n * @param meta   - Cell axes + projectRoot (projectRoot is consumed, not stored).\n */\nexport function serializeRelayReport(\n  report: RelayRunReport,\n  meta: ReportCellMeta,\n): RunnerAgnosticReport {\n  return {\n    cell: { sdkLine: meta.sdkLine, platform: meta.platform },\n    startedAt: report.startedAt,\n    duration: report.duration,\n    totals: report.totals,\n    ...(report.preflight ? { preflight: report.preflight } : {}),\n    files: report.files.map((f): RunnerAgnosticFileReport => {\n      const file = relativise(meta.projectRoot, f.file);\n      const modeField =\n        f.mode === 'manual' || f.mode === 'stubbed' ? ({ mode: f.mode } as const) : {};\n      if ('error' in f.result) {\n        // Matcher/inject error message only — rpc.ts already stripped the\n        // expression/value upstream.\n        return { file, error: f.result.error, ...modeField };\n      }\n      return {\n        file,\n        duration: f.result.duration,\n        passed: f.result.passed,\n        failed: f.result.failed,\n        skipped: f.result.skipped,\n        tests: f.result.tests,\n        ...modeField,\n      };\n    }),\n  };\n}\n\n/**\n * Writes the serialised report to `<dir>/<sdkLine>.<platform>.json`, creating\n * `dir` if needed. Returns the absolute path(s) written.\n *\n * The cell-suffixed filename keeps 2.x and 3.0 (and per-platform) runs as\n * distinct artifacts in the same directory; the same cell metadata is also baked\n * into the body so a renamed/moved file still carries its provenance.\n *\n * Manual-run provenance (devtools#741): when `report.files` contains ANY\n * `mode: 'manual'` entry (i.e. this run included `--manual-blocking` files),\n * the manual-tagged files are written to a SEPARATE\n * `<dir>/<sdkLine>.<platform>.manual.json` artifact instead of the standard\n * one — the standard `<sdkLine>.<platform>.json` filename is reserved for the\n * regular (unattended) files only, so a manual run's presence never mutates\n * what the unattended-baseline filename means.\n *\n * Stub-blocking provenance (devtools#740, DT-2): `mode: 'stubbed'` files are\n * written to a THIRD, separate `<dir>/<sdkLine>.<platform>.stubbed.json`\n * artifact — never merged into the standard file (it is unattended, like the\n * standard file, so a naive filename split could conflate the two) and never\n * merged into `.manual.json` (it did NOT have a human present). Its body is\n * ALSO stamped `cell.bridgeStub: true` — the mandatory HYBRID-cell provenance\n * from the issue: a stubbed result must never be silently mixed into the\n * real-device baseline report.\n *\n * If ALL files in the run are regular, only the standard artifact is written\n * (today's behavior, unchanged). Any combination of the three modes present\n * in a single run writes ONLY the corresponding artifacts — each is additive,\n * never replacing another.\n *\n * SECRET-HANDLING: the written body contains no relay/secret fields (the schema\n * has none). `dir`/`projectRoot` are local filesystem paths, never logged here.\n *\n * @param report - The core relay run report.\n * @param dir    - Output directory (created recursively if missing).\n * @param meta   - Cell axes + projectRoot.\n * @returns The absolute path(s) written, in order: standard first (if any\n *   regular files ran), then manual (if any manual files ran), then stubbed\n *   (if any stubbed files ran). At least one path is always returned when\n *   `report.files` is non-empty.\n */\nexport async function writeReportArtifact(\n  report: RelayRunReport,\n  dir: string,\n  meta: ReportCellMeta,\n): Promise<string[]> {\n  const serialised = serializeRelayReport(report, meta);\n  await mkdir(dir, { recursive: true });\n\n  const regularFiles = serialised.files.filter((f) => f.mode === undefined);\n  const manualFiles = serialised.files.filter((f) => f.mode === 'manual');\n  const stubbedFiles = serialised.files.filter((f) => f.mode === 'stubbed');\n\n  const written: string[] = [];\n\n  // Standard artifact: written whenever there are regular files, OR when the\n  // whole run is empty (preserves the pre-#741 \"always write one file\"\n  // behavior for a run with zero files, e.g. an empty glob match).\n  if (regularFiles.length > 0 || serialised.files.length === 0) {\n    const outFile = path.join(dir, `${meta.sdkLine}.${meta.platform}.json`);\n    await writeFile(\n      outFile,\n      `${JSON.stringify({ ...serialised, files: regularFiles }, null, 2)}\\n`,\n      'utf8',\n    );\n    written.push(outFile);\n  }\n\n  if (manualFiles.length > 0) {\n    const manualOutFile = path.join(dir, `${meta.sdkLine}.${meta.platform}.manual.json`);\n    await writeFile(\n      manualOutFile,\n      `${JSON.stringify({ ...serialised, files: manualFiles }, null, 2)}\\n`,\n      'utf8',\n    );\n    written.push(manualOutFile);\n  }\n\n  if (stubbedFiles.length > 0) {\n    const stubbedOutFile = path.join(dir, `${meta.sdkLine}.${meta.platform}.stubbed.json`);\n    await writeFile(\n      stubbedOutFile,\n      `${JSON.stringify(\n        {\n          ...serialised,\n          cell: { ...serialised.cell, bridgeStub: true as const },\n          files: stubbedFiles,\n        },\n        null,\n        2,\n      )}\\n`,\n      'utf8',\n    );\n    written.push(stubbedOutFile);\n  }\n\n  return written;\n}\n\n/**\n * Writes harvested `__AIT_CAPTURE__` lines to per-category files under `dir`,\n * named `<category>.<sdkLine>.<platform>.json` — the SAME convention\n * sdk-example's env1 `flushCapture` uses on the filesystem, so env1 and env3\n * capture artifacts line up for diffing.\n *\n * Each line's `json` payload is an opaque JSON array of capture records. Lines\n * sharing a category are concatenated into one array, in harvest order.\n *\n * SECRET-HANDLING: only allowlist-prefixed capture lines reach here (the parser\n * dropped wss/scheme noise); the `json` payload is written verbatim but is a\n * capture record array, not a relay/secret.\n *\n * @param captures - Parsed capture lines (from `RelayRunReport.captures`).\n * @param dir      - Output directory (created recursively if missing).\n * @param cell     - Cell axes for the filename suffix.\n * @returns The absolute paths written (one per category), in category order.\n */\nexport async function writeCaptureArtifacts(\n  captures: ReadonlyArray<AitCaptureLine>,\n  dir: string,\n  cell: { sdkLine: string; platform: string },\n): Promise<string[]> {\n  if (captures.length === 0) return [];\n\n  // Group payloads by category, preserving harvest order. Each payload is an\n  // opaque JSON array string; concatenate parsed arrays under the same category.\n  const byCategory = new Map<string, unknown[]>();\n  for (const { category, json } of captures) {\n    let merged = byCategory.get(category);\n    if (!merged) {\n      merged = [];\n      byCategory.set(category, merged);\n    }\n    // The parser already validated `json` parses; an array payload is expected.\n    const parsed = JSON.parse(json) as unknown;\n    if (Array.isArray(parsed)) {\n      merged.push(...parsed);\n    } else {\n      merged.push(parsed);\n    }\n  }\n\n  await mkdir(dir, { recursive: true });\n  const written: string[] = [];\n  for (const [category, records] of byCategory) {\n    const outFile = path.join(dir, `${category}.${cell.sdkLine}.${cell.platform}.json`);\n    await writeFile(outFile, `${JSON.stringify(records, null, 2)}\\n`, 'utf8');\n    written.push(outFile);\n  }\n  return written;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsHA,SAAS,WAAW,aAAqB,MAAsB;CAC7D,MAAM,MAAM,KAAK,SAAS,aAAa,KAAK;AAC5C,KAAI,QAAQ,MAAM,IAAI,WAAW,KAAK,IAAI,KAAK,WAAW,IAAI,CAG5D,QAAO,KAAK,SAAS,KAAK;AAE5B,QAAO;;;;;;;;;AAUT,SAAgB,qBACd,QACA,MACsB;AACtB,QAAO;EACL,MAAM;GAAE,SAAS,KAAK;GAAS,UAAU,KAAK;GAAU;EACxD,WAAW,OAAO;EAClB,UAAU,OAAO;EACjB,QAAQ,OAAO;EACf,GAAI,OAAO,YAAY,EAAE,WAAW,OAAO,WAAW,GAAG,EAAE;EAC3D,OAAO,OAAO,MAAM,KAAK,MAAgC;GACvD,MAAM,OAAO,WAAW,KAAK,aAAa,EAAE,KAAK;GACjD,MAAM,YACJ,EAAE,SAAS,YAAY,EAAE,SAAS,YAAa,EAAE,MAAM,EAAE,MAAM,GAAa,EAAE;AAChF,OAAI,WAAW,EAAE,OAGf,QAAO;IAAE;IAAM,OAAO,EAAE,OAAO;IAAO,GAAG;IAAW;AAEtD,UAAO;IACL;IACA,UAAU,EAAE,OAAO;IACnB,QAAQ,EAAE,OAAO;IACjB,QAAQ,EAAE,OAAO;IACjB,SAAS,EAAE,OAAO;IAClB,OAAO,EAAE,OAAO;IAChB,GAAG;IACJ;IACD;EACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4CH,eAAsB,oBACpB,QACA,KACA,MACmB;CACnB,MAAM,aAAa,qBAAqB,QAAQ,KAAK;AACrD,OAAM,MAAM,KAAK,EAAE,WAAW,MAAM,CAAC;CAErC,MAAM,eAAe,WAAW,MAAM,QAAQ,MAAM,EAAE,SAAS,KAAA,EAAU;CACzE,MAAM,cAAc,WAAW,MAAM,QAAQ,MAAM,EAAE,SAAS,SAAS;CACvE,MAAM,eAAe,WAAW,MAAM,QAAQ,MAAM,EAAE,SAAS,UAAU;CAEzE,MAAM,UAAoB,EAAE;AAK5B,KAAI,aAAa,SAAS,KAAK,WAAW,MAAM,WAAW,GAAG;EAC5D,MAAM,UAAU,KAAK,KAAK,KAAK,GAAG,KAAK,QAAQ,GAAG,KAAK,SAAS,OAAO;AACvE,QAAM,UACJ,SACA,GAAG,KAAK,UAAU;GAAE,GAAG;GAAY,OAAO;GAAc,EAAE,MAAM,EAAE,CAAC,KACnE,OACD;AACD,UAAQ,KAAK,QAAQ;;AAGvB,KAAI,YAAY,SAAS,GAAG;EAC1B,MAAM,gBAAgB,KAAK,KAAK,KAAK,GAAG,KAAK,QAAQ,GAAG,KAAK,SAAS,cAAc;AACpF,QAAM,UACJ,eACA,GAAG,KAAK,UAAU;GAAE,GAAG;GAAY,OAAO;GAAa,EAAE,MAAM,EAAE,CAAC,KAClE,OACD;AACD,UAAQ,KAAK,cAAc;;AAG7B,KAAI,aAAa,SAAS,GAAG;EAC3B,MAAM,iBAAiB,KAAK,KAAK,KAAK,GAAG,KAAK,QAAQ,GAAG,KAAK,SAAS,eAAe;AACtF,QAAM,UACJ,gBACA,GAAG,KAAK,UACN;GACE,GAAG;GACH,MAAM;IAAE,GAAG,WAAW;IAAM,YAAY;IAAe;GACvD,OAAO;GACR,EACD,MACA,EACD,CAAC,KACF,OACD;AACD,UAAQ,KAAK,eAAe;;AAG9B,QAAO;;;;;;;;;;;;;;;;;;;;AAqBT,eAAsB,sBACpB,UACA,KACA,MACmB;AACnB,KAAI,SAAS,WAAW,EAAG,QAAO,EAAE;CAIpC,MAAM,6BAAa,IAAI,KAAwB;AAC/C,MAAK,MAAM,EAAE,UAAU,UAAU,UAAU;EACzC,IAAI,SAAS,WAAW,IAAI,SAAS;AACrC,MAAI,CAAC,QAAQ;AACX,YAAS,EAAE;AACX,cAAW,IAAI,UAAU,OAAO;;EAGlC,MAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,MAAI,MAAM,QAAQ,OAAO,CACvB,QAAO,KAAK,GAAG,OAAO;MAEtB,QAAO,KAAK,OAAO;;AAIvB,OAAM,MAAM,KAAK,EAAE,WAAW,MAAM,CAAC;CACrC,MAAM,UAAoB,EAAE;AAC5B,MAAK,MAAM,CAAC,UAAU,YAAY,YAAY;EAC5C,MAAM,UAAU,KAAK,KAAK,KAAK,GAAG,SAAS,GAAG,KAAK,QAAQ,GAAG,KAAK,SAAS,OAAO;AACnF,QAAM,UAAU,SAAS,GAAG,KAAK,UAAU,SAAS,MAAM,EAAE,CAAC,KAAK,OAAO;AACzE,UAAQ,KAAK,QAAQ;;AAEvB,QAAO"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ait-co/devtools",
-  "version": "0.1.136",
+  "version": "0.1.137",
   "description": "Development tools for Apps in Toss mini-apps — mock SDK, floating devtools panel, and universal bundler plugin",
   "type": "module",
   "engines": {