@qawolf/cli 1.37.0 → 1.39.0

package/dist/runner-sdk.js

@@ -7111,6 +7111,11 @@ var makeRequestFileDownloadContract = (ids) => {
     readUrl: string2().describe('Fetch the file\'s bytes from here, for example `curl -o journeys.csv "<readUrl>"`. Write it to a file and read that file, rather than printing the contents, so a large file costs one line of output instead of all of it.')
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not change, overwrite or delete the stored file.",
+      openWorldHint: "Access is limited to QA Wolf team storage; the caller cannot supply an arbitrary external destination.",
+      readOnlyHint: "Returns an expiring read URL for an existing file in the authorized workspace storage."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -7137,6 +7142,11 @@ var makeRequestFileUploadContract = (ids) => {
     uploadUrl: string2().describe(`Send the file's bytes here with a single HTTP PUT carrying the returned contentType, for example \`curl -H 'Content-Type: application/octet-stream' --upload-file "journeys.csv" "<uploadUrl>"\`. Upload the bytes from the shell rather than through this API, so a large file never has to be written out as text.`)
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Using the returned upload URL with an existing file name replaces that stored file.",
+      openWorldHint: "The upload target is QA Wolf team storage, not an arbitrary external service or recipient.",
+      readOnlyHint: "Returns an expiring upload URL that permits writing a file to the authorized workspace storage."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: false,
@@ -7252,6 +7262,11 @@ var makeCreateRunContract = (ids) => {
     tracking: _enum(["registered", "failed", "not-requested"]).describe('Whether the conversation named by aiTaskId or chatSessionId will receive run status updates: "registered" when it will, "failed" when the run was created but the registration failed, "not-requested" when neither id was given or the AI task has no conversation to notify.')
   }, { urlFieldDescription: "Absolute URL of the run page." });
   return {
+    annotationJustifications: {
+      destructiveHint: "Test code can overwrite or delete application data.",
+      openWorldHint: "Test execution can submit forms or change the application under test and its connected services.",
+      readOnlyHint: "Creates a run and enqueues execution of selected flows."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -7265,6 +7280,77 @@ var makeCreateRunContract = (ids) => {
   };
 };
 
+// node_modules/@qawolf/api-contracts/dist/v1/run/listScreenshotComparisons.js
+var maxListedScreenshotAttempts = 20;
+var makeListScreenshotComparisonsContract = (ids) => {
+  const input = object({
+    flowIds: array(ids.flow).min(1).max(100).refine((flowIds) => new Set(flowIds).size === flowIds.length, "flowIds must be unique").optional().describe("Only list the comparisons of these flows. Each flow must have a result in the run. Omit to list every failed flow of the run."),
+    runId: ids.run
+  });
+  const imageUrl = (image) => url().describe(`Signed URL of the full-size ${image} PNG. It stops working at expiresAt.`);
+  const previewUrl = (image) => url().optional().describe(`Signed URL of a JPEG copy of the ${image} image, scaled down so its long edge is at most 1568 pixels. ` + "Fetch this one to look at the image: it is small enough to view inline, while the full-size PNG can be too large. " + "It stops working at expiresAt. Absent when QA Wolf could not make the copy, for example because the full-size image is gone.");
+  const passedEnvironment = object({
+    environmentId: ids.environment,
+    lastPassedAt: exports_iso.datetime().describe("When the latest passing comparison in this environment ran.")
+  });
+  const passingElsewhere = discriminatedUnion("status", [
+    object({
+      status: literal("not-tracked").describe("QA Wolf does not record screenshot comparisons for this workspace, so it cannot tell.")
+    }),
+    object({
+      environments: array(passedEnvironment).describe("Other environments where the current baseline passed this screenshot in the last 14 days, most recent first. " + "Empty when it passed nowhere else, or when the baseline no longer exists."),
+      status: literal("tracked")
+    })
+  ]).describe("Whether the current baseline still passes in other environments. " + "A baseline that passes elsewhere points to a difference in this environment rather than an outdated baseline.");
+  const comparison = object({
+    actualPreviewUrl: previewUrl("actual"),
+    actualUrl: imageUrl("actual (the screenshot the flow took)"),
+    attemptCompletedAt: exports_iso.datetime().describe("When the run attempt that made the comparison finished."),
+    baselineStatus: _enum([
+      "unchanged",
+      "accepted",
+      "changed-since-run",
+      "deleted",
+      "unknown"
+    ]).describe('How the current baseline relates to the expected image this comparison used. "unchanged": the baseline is still the expected image. ' + `"accepted": the baseline is now this comparison's actual screenshot, because someone accepted it, so a reattempt should pass. ` + '"changed-since-run": someone replaced the baseline with another image after this run, so rerun the flow before deciding anything. ' + '"deleted": the baseline no longer exists, and the next run will save its screenshot as the new baseline. ' + `"unknown": the run's copy of the expected image is gone, so QA Wolf cannot compare.`),
+    comparisonId: string2().describe("Identifies this comparison: the run attempt id and the position of the comparison in that attempt."),
+    diffPreviewUrl: previewUrl("diff"),
+    diffUrl: imageUrl("diff (the pixels that differ are highlighted)"),
+    expectedPreviewUrl: previewUrl("expected"),
+    expectedUrl: imageUrl("expected (the baseline as it was when the flow ran)"),
+    filePath: string2().optional().describe("The flow file that made the comparison."),
+    flowId: ids.flow,
+    lineNumber: number2().int().optional().describe("The line of filePath that made the comparison."),
+    name: string2().describe("The screenshot name the flow passed to toHaveScreenshot. The baseline is stored as _screenshots_/<name>.png in team storage."),
+    passingElsewhere,
+    runAttemptId: string2(),
+    similarity: number2().describe("How much of the actual image matches the expected image, in percent."),
+    sizeMismatch: boolean2().describe("The actual and expected images have different dimensions. That fails the comparison whatever the pixels show, and similarity reads 0.")
+  });
+  const output = object({
+    comparisons: array(comparison).describe(`Each screenshot comparison that failed its flow, from the ${maxListedScreenshotAttempts} most recent failed attempts of the selected flows, oldest attempt first.`),
+    expiresAt: exports_iso.datetime().describe("When the image URLs stop working. Call run.listScreenshotComparisons again for fresh ones after it."),
+    truncated: boolean2().describe(`True when the selected flows have more than ${maxListedScreenshotAttempts} failed attempts. Only the ${maxListedScreenshotAttempts} most recent are listed, and the older attempts cannot be listed.`)
+  });
+  return {
+    annotationJustifications: {
+      destructiveHint: "Does not change baselines, results or the run.",
+      openWorldHint: "Reads recorded QA Wolf screenshots without changing the application under test.",
+      readOnlyHint: "Creates missing JPEG previews of the compared images and keeps them in team storage."
+    },
+    annotations: {
+      destructiveHint: false,
+      openWorldHint: false,
+      readOnlyHint: false
+    },
+    description: "List the screenshot comparisons that failed a run's flows, with the expected, actual and diff images of each. " + "Only comparisons that caused a failure are listed: a screenshot that differs within tolerance, or that differs on a line that did not fail, is left out. " + "Each comparison tells whether its baseline changed since the run and whether the baseline still passes in other environments. " + "The image URLs expire after a few minutes; fetch the preview URLs to look at the images. " + "The first call for an image makes its missing JPEG preview and keeps it in team storage, so later calls reuse it.",
+    input,
+    kind: "read",
+    name: "run.listScreenshotComparisons",
+    output
+  };
+};
+
 // node_modules/@qawolf/api-contracts/dist/v1/runner/actionSequence.js
 var maxActionsPerRequest = 10;
 var screenshotModes = ["none", "final", "each"];
@@ -7448,6 +7534,11 @@ var makeInspectOnRunnerContract = (ids) => {
     })
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not edit test code or application data, although the activity refresh can extend billed runtime.",
+      openWorldHint: "Inspects the private runner session without submitting application actions.",
+      readOnlyHint: "Retrieves browser inspection data and refreshes activity, which can cancel an inactivity shutdown."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -7613,6 +7704,11 @@ var makeInspectMobileOnRunnerContract = (ids) => {
     ])
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not change application data, edit tests, or stop the runner.",
+      openWorldHint: "Inspects the existing QA Wolf mobile runner without submitting application actions or contacting arbitrary services.",
+      readOnlyHint: "Reads mobile session status, contexts, page source, or elements without refreshing the runner's inactivity timer."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -7789,6 +7885,11 @@ var makePerformActionOnRunnerContract = (ids) => {
     failure
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Actions can submit irreversible transactions or delete existing data, so uncertain outcomes must be inspected before retrying.",
+      openWorldHint: "Clicks, typing and navigation can submit external forms or change application state.",
+      readOnlyHint: "Performs a browser or device action and can start a browser when needed."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -7840,6 +7941,7 @@ var failedStepSchema = discriminatedUnion("failureReason", [
     failureReason: _enum([
       ...screenFailureReasons,
       "action-not-supported-on-mobile",
+      "action-not-supported-on-browser",
       outOfTimeFailureReason
     ]),
     index: actionIndexSchema,
@@ -7854,6 +7956,7 @@ var sequenceFailureReasons = [
   "action-failed",
   ...screenFailureReasons,
   "action-not-supported-on-mobile",
+  "action-not-supported-on-browser",
   outOfTimeFailureReason,
   unconfirmedFailureReason,
   runnerUnreachableFailureReason
@@ -7862,11 +7965,11 @@ var sequenceFailureReasons = [
 // node_modules/@qawolf/api-contracts/dist/v1/runner/performActions.js
 var actionsDescription = `The actions to perform, in order, each exactly what \`runner.performAction\` takes: coordinates are whole pixels on the runner's virtual desktop, in the same space as \`runner.takeScreenshot\`, and the shapes follow the computer-use vocabulary. At most ${maxActionsPerRequest} per request. For when the next several steps are already known — click a field, type into it, press Enter — and one look at the screen at the end is enough. They run back to back on the runner, with no pause between them: put in one request only steps whose targets are all on the screen you last saw and are not moved by the steps before them, and when a step changes the page — a submit, a navigation, opening a menu — make it the last one and read the frame.`;
 var screenshotModeDescription = "`final`, the default, answers with one screenshot in `imageJpegBase64`: the screen after the last action, or, after a stop, as it stands. `each` puts a screenshot after every action on its entry in `results`, for when each step must be checked; every frame is a full image, so keep such sequences short. `none` sends no screenshot.";
-var stopOnFailureDescription = "`true`, the default, leaves the remaining actions unperformed once one fails. `false` carries on past an action that reached the runner and did not take effect (`action-failed`, `action-not-supported-on-mobile`), so use it only for actions that do not depend on each other: a `type` after a `click` that failed goes to whatever has focus. A runner that cannot be reached, a screen that cannot serve, or running out of time ends the sequence either way.";
+var stopOnFailureDescription = "`true`, the default, leaves the remaining actions unperformed once one fails. `false` carries on past an action that reached the runner and did not take effect (`action-failed`, `action-not-supported-on-mobile`, `action-not-supported-on-browser`), so use it only for actions that do not depend on each other: a `type` after a `click` that failed goes to whatever has focus. A runner that cannot be reached, a screen that cannot serve, or running out of time ends the sequence either way.";
 var finalImageDescription = "Present with `screenshotMode: final` when the runner still answered: the screen after the last action performed, or, after a stop, as it stands.";
 var makePerformActionsOnRunnerContract = (ids) => {
   const input = object({
-    actions: array(browserActionSchema).min(1).max(maxActionsPerRequest).describe(actionsDescription),
+    actions: array(runnerActionSchema).min(1).max(maxActionsPerRequest).describe(actionsDescription),
     id: runnerIdSchema.describe("Id of the runner to act on."),
     screenshotMode: _enum(screenshotModes).optional().describe(screenshotModeDescription),
     stopOnFailure: boolean2().optional().describe(stopOnFailureDescription),
@@ -7891,12 +7994,17 @@ var makePerformActionsOnRunnerContract = (ids) => {
     })
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Actions can submit irreversible transactions or delete existing data, so uncertain outcomes must be inspected before retrying.",
+      openWorldHint: "Clicks, typing and navigation can submit external forms or change application state.",
+      readOnlyHint: "Performs a sequence of browser or device actions on a runner."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
       readOnlyHint: false
     },
-    description: "Perform a sequence of raw browser actions on an interactive runner in one request, one after another, and answer with what happened to each. A `success` means every action took effect. A `failure` names the first action that did not (`failedIndex`, `failureReason`), the last one that did (`lastCompletedIndex`), and whether actions were left unperformed (`stoppedEarly`); `results` has one entry per action reached, in order. Read `effect` on an entry before sending its action again: `performed` means the runner did it; `not-performed` means the runner answered that it did not take effect, though a `navigate` that timed out may still be loading; `unknown` means the runner stopped answering with the action in flight (`runner-unreachable`), or its screen went quiet mid-action (`action-unconfirmed`), and it may have taken effect — a click that submitted a form, say — so take a screenshot instead of repeating it. A sequence gets about a minute to start its actions; an action it did not reach in time is `out-of-time`, nothing after it was attempted, and the rest can go in a new request. Everything `runner.performAction` says about a runner that has never run anything, a mobile runner, and the `screen-needs-a-run`, `screen-not-ready`, `runner-has-no-screen` and `action-not-supported-on-mobile` reasons holds for each action here.",
+    description: "Perform a sequence of raw actions on an interactive runner in one request, one after another, and answer with what happened to each. A `success` means every action took effect. A `failure` names the first action that did not (`failedIndex`, `failureReason`), the last one that did (`lastCompletedIndex`), and whether actions were left unperformed (`stoppedEarly`); `results` has one entry per action reached, in order. Read `effect` on an entry before sending its action again: `performed` means the runner did it; `not-performed` means the runner answered that it did not take effect, though a `navigate` that timed out may still be loading; `unknown` means the runner stopped answering with the action in flight (`runner-unreachable`), or its screen went quiet mid-action (`action-unconfirmed`), and it may have taken effect — a click that submitted a form, say — so take a screenshot instead of repeating it. A sequence gets about a minute to start its actions; an action it did not reach in time is `out-of-time`, nothing after it was attempted, and the rest can go in a new request. Everything `runner.performAction` says about a runner that has never run anything, a mobile runner, and the `screen-needs-a-run`, `screen-not-ready`, `runner-has-no-screen`, `action-not-supported-on-mobile` and `action-not-supported-on-browser` reasons holds for each action here.",
     input,
     kind: "write",
     name: "runner.performActions",
@@ -7964,6 +8072,11 @@ var makeRecordOnRunnerContract = (ids) => {
     url: url()
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Starts or stops a video recording without changing the application under test.",
+      openWorldHint: "Controls recording on a QA Wolf runner without starting external work.",
+      readOnlyHint: "Starts or stops video recording and changes automatic capture settings."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -7991,6 +8104,11 @@ var makeRunnerRecordingsContract = (ids) => {
     }))
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not delete or change any recording.",
+      openWorldHint: "Reads QA Wolf workspace storage without changing the application under test.",
+      readOnlyHint: "Lists or retrieves a runner's finalized recordings."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -8221,6 +8339,11 @@ var makeCreateTriggerContract = (ids) => {
   ]).superRefine(checkTriggerConfiguration);
   const output = object({ trigger: makeTriggerResourceSchema(ids) });
   return {
+    annotationJustifications: {
+      destructiveHint: "Enables automatic execution of test code that may overwrite or delete application data.",
+      openWorldHint: "Triggered runs can change the application under test and update connected integrations.",
+      readOnlyHint: "Creates an active schedule or deployment trigger that can start test runs."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -8244,6 +8367,11 @@ var makeFindTriggersContract = (ids) => {
     triggers: array(makeTriggerResourceSchema(ids)).describe("The team's triggers, newest first.")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not modify or delete triggers or their runs.",
+      openWorldHint: "Reads private QA Wolf trigger records without changing external systems.",
+      readOnlyHint: "Lists trigger configuration in the authorized workspace without changing it."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -8262,6 +8390,11 @@ var makeGetTriggerContract = (ids) => {
   const input = object({ triggerId: ids.trigger });
   const output = object({ trigger: makeTriggerResourceSchema(ids) });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not modify or delete the trigger or its runs.",
+      openWorldHint: "Reads a private QA Wolf trigger without changing external systems.",
+      readOnlyHint: "Retrieves one authorized trigger and its configuration without changing it."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -8280,6 +8413,11 @@ var makePauseTriggerContract = (ids) => {
   const input = object({ triggerId: ids.trigger });
   const output = object({ trigger: makeTriggerResourceSchema(ids) });
   return {
+    annotationJustifications: {
+      destructiveHint: "Disables future automatic execution for the selected trigger until it is resumed.",
+      openWorldHint: "Changes private QA Wolf scheduling state without starting external work.",
+      readOnlyHint: "Pauses an existing trigger so it stops starting new work."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: false,
@@ -8296,6 +8434,11 @@ var makeResumeTriggerContract = (ids) => {
   const input = object({ triggerId: ids.trigger });
   const output = object({ trigger: makeTriggerResourceSchema(ids) });
   return {
+    annotationJustifications: {
+      destructiveHint: "Enables automatic test execution that may overwrite or delete application data.",
+      openWorldHint: "Resumed execution can change the application under test and update connected integrations.",
+      readOnlyHint: "Reactivates a paused trigger so future matching schedules or deployments can start runs."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -8314,6 +8457,11 @@ var makeDeleteTriggerContract = (ids) => {
     triggerId: ids.trigger.describe("The id of the deleted trigger.")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Permanently deletes the selected trigger configuration.",
+      openWorldHint: "Removes private QA Wolf trigger configuration without starting external work.",
+      readOnlyHint: "Permanently removes a trigger while preserving runs it already created."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: false,
@@ -8350,6 +8498,11 @@ var makeUpdateTriggerContract = (ids) => {
   ]).superRefine(checkTriggerConfiguration);
   const output = object({ trigger: makeTriggerResourceSchema(ids) });
   return {
+    annotationJustifications: {
+      destructiveHint: "Overwrites trigger configuration and can enable tests that change or delete application data.",
+      openWorldHint: "The updated trigger can execute tests against external applications and update connected integrations.",
+      readOnlyHint: "Replaces an existing trigger configuration and can change future automatic runs."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -8391,6 +8544,11 @@ var makeAgentGetContract = (ids) => {
     urlFieldDescription: "Absolute URL of the live session in the QA Wolf app."
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not cancel work or edit tests and messages.",
+      openWorldHint: "Reads a QA Wolf session without posting to external services.",
+      readOnlyHint: "Retrieves session status, replies and the live link without sending work."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -8422,6 +8580,11 @@ var makeAgentSendContract = (ids) => {
     urlFieldDescription: "Absolute URL of the live session in the QA Wolf app."
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Delegated execution can overwrite test code or change and delete application data.",
+      openWorldHint: "Delegated work can submit application actions and publish code to connected repositories.",
+      readOnlyHint: "Creates or continues AI work that can implement, run and publish tests."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -8460,6 +8623,11 @@ var makeFindCodeHostIntegrationsContract = (ids) => {
     settingsUrl: url().describe("Absolute URL of the workspace's integrations settings page.")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not disconnect integrations or change repository access.",
+      openWorldHint: "Reads QA Wolf integration records without contacting or changing GitHub or GitLab.",
+      readOnlyHint: "Lists the workspace's stored code host integrations and settings link without modifying them."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -8492,6 +8660,11 @@ var makeListCodeHostRepositoriesContract = (ids) => {
     repositories: array(makeCodeHostRepositoryResourceSchema()).describe("The repositories the workspace's code host integrations cover, alphabetical by full name.")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not edit repositories, integration settings, or access permissions.",
+      openWorldHint: "Reads repositories already recorded for the workspace's integrations, without accessing arbitrary external repositories.",
+      readOnlyHint: "Lists repository metadata from the workspace's last code host sync without triggering a new sync."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -8535,6 +8708,11 @@ var makeFindDeploymentsContract = (ids) => {
     nextCursor: nextCursorSchema
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not modify deployments, environments, triggers, or runs.",
+      openWorldHint: "Reads QA Wolf deployment records without contacting deployment providers or starting tests.",
+      readOnlyHint: "Lists stored workspace deployments without reporting or changing their status."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -8609,6 +8787,11 @@ var makeListDeploymentTriggerEvaluationsContract = (ids) => {
     object({ state: literal("not-evaluated") }).describe("Triggers were never evaluated for this deployment. Only a deployment's first success report evaluates triggers, so a deployment that never reported success carries no verdicts.")
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not alter recorded verdicts, trigger configuration, or existing runs.",
+      openWorldHint: "Reads stored QA Wolf verdicts without starting tests or updating external services.",
+      readOnlyHint: "Retrieves the recorded trigger verdicts for one deployment without evaluating triggers again."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -8680,6 +8863,11 @@ var makeReportDeploymentStatusContract = (ids) => {
   }, { urlFieldDescription: "Absolute URL of the environment's runs page." });
   const output = object({ deployment });
   return {
+    annotationJustifications: {
+      destructiveHint: "Can replace deployment details and variable overrides, and trigger tests that overwrite or delete application data.",
+      openWorldHint: "Successful deployments can start tests against external applications and update connected integrations.",
+      readOnlyHint: "Creates or updates a deployment, can create an environment, and evaluates triggers on its first success report."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -8716,6 +8904,11 @@ var makeFindEmailsContract = (ids) => {
     nextCursor: nextCursorSchema
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not send, edit, or delete email messages.",
+      openWorldHint: "Reads the workspace's QA Wolf inbox records without contacting recipients or arbitrary mailboxes.",
+      readOnlyHint: "Searches stored workspace emails and returns matching message summaries."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -8737,6 +8930,11 @@ var makeGetEmailContract = (ids) => {
   });
   const output = makeEmailResourceSchema();
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not alter or delete the message or its attachments.",
+      openWorldHint: "Reads a stored workspace message without forwarding it or contacting external recipients.",
+      readOnlyHint: "Retrieves the content of an existing workspace email."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -8765,6 +8963,11 @@ var makeGetEmailAttachmentContract = (ids) => {
     type: string2().optional().describe("The MIME type.")
   }, { urlFieldDescription: emailUrlFieldDescription });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not modify or delete the email or attachment.",
+      openWorldHint: "Access is limited to attachments of authorized workspace emails, not arbitrary external files.",
+      readOnlyHint: "Reads one attachment from an existing workspace email and returns its content."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -8789,6 +8992,11 @@ var makeListEmailAddressesContract = (ids) => {
     nextCursor: nextCursorSchema
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not register, replace, or remove inbox addresses.",
+      openWorldHint: "Reads QA Wolf inbox configuration without contacting external mail services or recipients.",
+      readOnlyHint: "Lists the workspace's registered inbox addresses without changing them."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -8816,6 +9024,11 @@ var makeRegisterEmailAddressContract = (ids) => {
   });
   const output = makeEmailAddressResourceSchema();
   return {
+    annotationJustifications: {
+      destructiveHint: "Adds an address without replacing or deleting existing inbox addresses or emails.",
+      openWorldHint: "Adds a QA Wolf workspace inbox address without sending messages to external recipients.",
+      readOnlyHint: "Registers an additional inbox address for the workspace."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -8854,6 +9067,11 @@ var makeSendEmailContract = (ids) => {
     urlFieldDescription: emailUrlFieldDescription
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Sending an email is irreversible; recipients may act on it, and the tool cannot recall it.",
+      openWorldHint: "Delivers message content and attachments to caller-selected email recipients outside QA Wolf.",
+      readOnlyHint: "Sends an email from a workspace inbox and stores the sent message."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -8899,6 +9117,11 @@ var makeCreateEnvironmentContract = (ids) => {
   });
   const output = makeEnvironmentResourceSchema(ids);
   return {
+    annotationJustifications: {
+      destructiveHint: "Adds a new environment and branch rather than deleting or overwriting an existing one.",
+      openWorldHint: "Creates a branch in the connected Git provider rather than changing only QA Wolf records.",
+      readOnlyHint: "Creates a QA Wolf environment and its remote flow-code branch."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: true,
@@ -8923,6 +9146,11 @@ var makeDeleteEnvironmentVariableContract = (ids) => {
     name: string2().describe("The canonicalized name that was removed. Returned even when the environment had no such variable.")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Deletes an existing variable value, while an already-absent variable is left absent.",
+      openWorldHint: "Changes private test configuration without submitting it to an external application.",
+      readOnlyHint: "Removes a named environment variable from QA Wolf storage."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: false,
@@ -8950,6 +9178,11 @@ var makeFindEnvironmentsContract = (ids) => {
     nextCursor: nextCursorSchema
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not edit environments, variables or branches.",
+      openWorldHint: "Reads private QA Wolf environment metadata without publishing changes.",
+      readOnlyHint: "Lists workspace environments and their configuration summaries."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -8978,6 +9211,11 @@ var makeGetEnvironmentVariableContract = (ids) => {
     })).describe("The found variables, sorted by name.")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not replace or remove variable values.",
+      openWorldHint: "Reads private stored configuration without submitting it to an external application.",
+      readOnlyHint: "Retrieves decrypted values of named environment variables and reports missing names."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -8999,6 +9237,11 @@ var makeGetEnvironmentContract = (ids) => {
   });
   const output = makeEnvironmentResourceSchema(ids);
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not alter environment settings or concurrency limits.",
+      openWorldHint: "Reads QA Wolf environment state without updating the connected Git provider.",
+      readOnlyHint: "Retrieves an environment's configuration, run health and code-reconciliation state."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -9020,6 +9263,11 @@ var makeListEnvironmentVariableNamesContract = (ids) => {
     variableNames: array(string2()).describe("Names of the environment's variables, sorted alphabetically. Values are never returned.")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not alter variables or expose their stored values.",
+      openWorldHint: "Reads private configuration names without changing external systems.",
+      readOnlyHint: "Lists available environment variable names without retrieving their values."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -9043,6 +9291,11 @@ var makeSetEnvironmentVariableContract = (ids) => {
     name: string2().describe("The stored variable name after whitespace is replaced with underscores and letters are uppercased.")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Can overwrite an existing variable value, while an unchanged value is skipped.",
+      openWorldHint: "Changes stored QA Wolf configuration rather than submitting forms or publishing content.",
+      readOnlyHint: "Creates or replaces a named environment variable without returning its value."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: false,
@@ -9070,6 +9323,11 @@ var makeUpdateEnvironmentContract = (ids) => {
   });
   const output = makeEnvironmentResourceSchema(ids);
   return {
+    annotationJustifications: {
+      destructiveHint: "Can overwrite existing environment settings and affect future run capacity.",
+      openWorldHint: "Changes private environment settings without publishing code or contacting application users.",
+      readOnlyHint: "Updates an environment's name or run concurrency limit."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: false,
@@ -9097,6 +9355,11 @@ var makeCreateTagContract = (ids) => {
   });
   const output = makeTagResourceSchema();
   return {
+    annotationJustifications: {
+      destructiveHint: "Creates a tag without deleting existing tags or flow associations.",
+      openWorldHint: "Adds private QA Wolf metadata without publishing to an external application.",
+      readOnlyHint: "Creates a workspace tag for grouping and selecting flows."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -9130,6 +9393,11 @@ var makeAddTagToFlowsContract = (ids) => {
     })
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Adds associations without removing existing tags.",
+      openWorldHint: "Changes private flow-tag associations without running flows or publishing code.",
+      readOnlyHint: "Adds an existing tag to selected flows and skips flows already carrying it."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -9184,6 +9452,11 @@ var makeListFlowsContract = (ids) => {
     }))
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not change flow code, readiness or tags.",
+      openWorldHint: "Reads flow records without pushing code or executing application actions.",
+      readOnlyHint: "Lists flows at an environment's reconciled commit or on a selected AI task branch."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -9210,6 +9483,11 @@ var makeRemoveTagFromFlowsContract = (ids) => {
     })
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Deletes existing tag associations and skips flows that do not carry the tag.",
+      openWorldHint: "Changes private flow-tag associations without updating external services.",
+      readOnlyHint: "Removes a selected tag from specified flows."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: false,
@@ -9239,6 +9517,11 @@ var makeUpdateFlowContract = (ids) => {
     })
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Overwrites readiness and can deactivate a flow that was active.",
+      openWorldHint: "Changes private readiness state without itself executing the flow or publishing code.",
+      readOnlyHint: "Changes a flow between draft and active readiness."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: false,
@@ -9261,6 +9544,7 @@ var issuePrioritySchema = _enum([
   "urgent"
 ]);
 var issueStatusSchema = _enum([
+  "backlog",
   "pending",
   "inProgress",
   "paused",
@@ -9269,7 +9553,12 @@ var issueStatusSchema = _enum([
   "archived"
 ]);
 var publicIssueTypeSchema = _enum(["bug", "coverageRequest", "maintenance"]);
-var openIssueStatuses = ["pending", "inProgress", "paused"];
+var openIssueStatuses = [
+  "backlog",
+  "pending",
+  "inProgress",
+  "paused"
+];
 var makeIssueResourceSchema = (ids) => resource({
   coveredFlowIds: array(ids.flow).describe("The flows a coverage request covers. Always empty on bug and maintenance reports, whose flows are listed under reproductions."),
   createdAt: exports_coerce.date().describe("When the issue was created."),
@@ -9291,7 +9580,7 @@ var makeIssueResourceSchema = (ids) => resource({
 var makeFindIssuesContract = (ids) => {
   const input = object({
     ...makePaginationInputFields({ defaultLimit: 20, maxLimit: 100 }),
-    statuses: array(issueStatusSchema).min(1).default([...openIssueStatuses]).describe("Issue statuses to include. Defaults to pending, in-progress, and paused issues."),
+    statuses: array(issueStatusSchema).min(1).default([...openIssueStatuses]).describe("Issue statuses to include. Defaults to backlog, pending, in-progress, and paused issues."),
     type: publicIssueTypeSchema.describe("The issue type to include: bug report, maintenance report, or coverage request."),
     workspaceId: ids.workspace.optional().describe("The workspace whose issues to list. Required when authenticating with an organization or user API key.")
   });
@@ -9300,6 +9589,11 @@ var makeFindIssuesContract = (ids) => {
     nextCursor: nextCursorSchema
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not edit issue details, statuses or coverage associations.",
+      openWorldHint: "Reads QA Wolf issue records without publishing updates to linked trackers.",
+      readOnlyHint: "Lists workspace bug reports, maintenance reports or coverage requests."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -9320,6 +9614,11 @@ var makeGetIssueContract = (ids) => {
     issue: makeIssueResourceSchema(ids)
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not modify or remove the issue.",
+      openWorldHint: "Reads the QA Wolf issue without changing linked external systems.",
+      readOnlyHint: "Retrieves one issue and its associated details."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -9337,11 +9636,22 @@ var makeGetIssueContract = (ids) => {
 var investigationFindingStateDescription = 'What the investigation concluded about the cause. Known values: "investigating", "fixed", "fix-proposed", "reported", "report-proposed", "flake", "question" and "dismissed". New values can appear.';
 var makeInvestigationFindingSchema = (ids) => object({
   actual: string2().optional(),
-  commitHash: string2().optional(),
+  commitHash: string2().optional().describe("The commit of a commit fix. Same as `fix.commitHash`."),
   decidedBy: _enum(["agent", "user"]).optional().describe("Who decided: the AI on its own, or a person who approved or dismissed it. Absent until someone decides."),
   disputeReason: string2().optional().describe("Why a person disputed what the AI did. Present on a proposal the AI made again after that dispute."),
   expected: string2().optional(),
   findingId: string2(),
+  fix: discriminatedUnion("type", [
+    object({
+      commitHash: string2().describe("The commit that changes the flow code."),
+      type: literal("commit")
+    }),
+    object({
+      baselineChangeId: string2().optional().describe('The baseline change that made the new screenshot the baseline, on a "fixed" finding. `run restoreScreenshotBaseline` undoes it.'),
+      comparisonId: string2().describe("The failed screenshot comparison whose new screenshot becomes the baseline, as `run listScreenshotComparisons` names it."),
+      type: literal("baseline")
+    })
+  ]).optional().describe('The fix of a "fixed" or "fix-proposed" finding: a commit to the flow code, or a new screenshot baseline.'),
   flowIds: array(ids.flow),
   headline: string2().optional(),
   issueId: ids.issue.optional(),
@@ -9352,8 +9662,9 @@ var makeInvestigationFindingSchema = (ids) => object({
     answers: array(object({
       description: string2().optional(),
       title: string2(),
-      value: string2().describe('What choosing this answer means. Known values: "apply", "dismiss", "report", "maintenance" and "bug". New values can appear.')
+      value: string2().describe('What choosing this answer means. Known values: "apply", "dismiss", "report", "maintenance", "bug" and "baseline". New values can appear.')
     })),
+    comparisonId: string2().optional().describe('The failed screenshot comparison a screenshot question is about, as `run listScreenshotComparisons` names it. Its answers are "bug" (the old screenshot is right), "maintenance" (both are right) and "baseline" (the new screenshot is right).'),
     text: string2()
   }).optional().describe("The question waiting for a person, with the answers offered."),
   response: object({
@@ -9373,12 +9684,22 @@ var makeInvestigationFindingSchema = (ids) => object({
 var makeGetInvestigationContract = (ids) => {
   const input = object({ runId: ids.run });
   const output = resource({
+    baselineChanges: _enum(["automatic", "needs-approval"]).describe('How the investigation can make a new screenshot the baseline. "automatic": it can accept a baseline on its own. ' + '"needs-approval": it proposes the baseline on a fix-proposed finding, and accepts it only after a person applies the proposal.'),
     findings: array(makeInvestigationFindingSchema(ids)),
     runId: ids.run,
     sessionId: ids.chatSession.optional().describe("The investigation session. Absent when the run has none."),
-    status: _enum(["investigating", "finished", "not-investigated"]).describe('Whether the investigation session is still working. "not-investigated" when the run has no investigation.')
+    status: _enum(["investigating", "finished", "not-investigated"]).describe('Whether the lead or any child investigator is still working. "not-investigated" when the run has no investigation.'),
+    subSessions: array(object({
+      sessionId: ids.chatSession,
+      status: agentSessionStatusSchema
+    })).optional().describe("All child investigators, including sessions not attached to findings yet. Send instructions to each sessionId with agent.send.")
   }, { urlFieldDescription: "The run in the QA Wolf app." });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not answer, dispute or change the investigation.",
+      openWorldHint: "Reads recorded QA Wolf findings without changing the application under test.",
+      readOnlyHint: "Retrieves an investigation's findings, open questions and pending answers."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -9407,6 +9728,11 @@ var makeAddFlowsToIssueContract = (ids) => {
     issue: makeIssueResourceSchema(ids)
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Adds coverage associations without removing existing ones.",
+      openWorldHint: "Changes private coverage associations without publishing an external issue update.",
+      readOnlyHint: "Adds existing flows to a coverage request's covered-flow set."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -9450,6 +9776,11 @@ var makeCreateIssueContract = (ids) => {
     issue: makeIssueResourceSchema(ids)
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Configured notifications can send irreversible messages even though the QA Wolf issue itself is new.",
+      openWorldHint: "Issue creation can send messages or synchronize records through connected communication and issue-tracking services.",
+      readOnlyHint: "Creates a bug or coverage request and can start configured issue notifications."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -9466,19 +9797,25 @@ var makeCreateIssueContract = (ids) => {
 // node_modules/@qawolf/api-contracts/dist/v1/issue/removeFlows.js
 var makeRemoveFlowsFromIssueContract = (ids) => {
   const input = object({
-    flowIds: array(ids.flow).min(1).max(300).refine((flowIds) => new Set(flowIds).size === flowIds.length, "flowIds must be unique").describe("The flows the coverage request no longer covers."),
+    environmentId: ids.environment.optional().describe("The environment whose bug or maintenance reproductions to remove. Required when a selected flow is linked in more than one environment."),
+    flowIds: array(ids.flow).min(1).max(300).refine((flowIds) => new Set(flowIds).size === flowIds.length, "flowIds must be unique").describe("The flows to remove from the issue."),
     issueId: ids.issue
   });
   const output = object({
     issue: makeIssueResourceSchema(ids)
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Deletes existing coverage associations while leaving already-unassociated flows unchanged.",
+      openWorldHint: "Changes private coverage associations without publishing to an external tracker.",
+      readOnlyHint: "Removes selected flows from a coverage request's covered-flow set."
+    },
     annotations: {
       destructiveHint: true,
-      openWorldHint: false,
+      openWorldHint: true,
       readOnlyHint: false
     },
-    description: "Remove flows from a coverage request owned by the caller's team. " + "Flows the request does not cover are left alone. " + "Bug and maintenance reports link to flows through the runs that reproduce them, so their flows cannot be set directly.",
+    description: "Remove flows from a coverage request or remove bug/maintenance reproductions in an environment. " + "Unlinked flows are left alone. Reports auto-close when no active reproductions remain and auto-close is enabled. " + "For reports, omit environmentId only when each selected flow is linked in at most one environment.",
     input,
     kind: "write",
     name: "issue.removeFlows",
@@ -9503,6 +9840,11 @@ var makeUpdateIssueContract = (ids) => {
     issue: makeIssueResourceSchema(ids)
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Can overwrite existing issue fields or send irreversible integration messages.",
+      openWorldHint: "Issue changes can update connected issue trackers and communication services.",
+      readOnlyHint: "Updates issue details, priority or status and can trigger integration updates."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -9579,6 +9921,11 @@ var makeFindLegacyTriggersContract = (ids) => {
     legacyTriggers: array(makeLegacyTriggerSchema(ids)).describe("The workspace's legacy triggers, by name.")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not pause, resume or change any trigger.",
+      openWorldHint: "Reads private QA Wolf trigger configuration without starting external work.",
+      readOnlyHint: "Lists a workspace's legacy per-environment triggers."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -9603,6 +9950,11 @@ var makeLifecycleShape = (ids) => ({
 var makePauseLegacyTriggerContract = (ids) => {
   const { input, output } = makeLifecycleShape(ids);
   return {
+    annotationJustifications: {
+      destructiveHint: "Disables future automatic execution for the legacy trigger and its pull request copies until it is resumed.",
+      openWorldHint: "Changes private QA Wolf scheduling state without starting external work.",
+      readOnlyHint: "Pauses an existing legacy trigger so it stops starting new work."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: false,
@@ -9618,6 +9970,11 @@ var makePauseLegacyTriggerContract = (ids) => {
 var makeResumeLegacyTriggerContract = (ids) => {
   const { input, output } = makeLifecycleShape(ids);
   return {
+    annotationJustifications: {
+      destructiveHint: "Enables automatic test execution that can overwrite or delete application data.",
+      openWorldHint: "Resumed execution can change the application under test and update connected integrations.",
+      readOnlyHint: "Reactivates a legacy trigger and its pull request copies so future schedules or deployments can start runs."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -9638,6 +9995,54 @@ var makeLegacyTriggerContracts = (ids) => ({
   resume: makeResumeLegacyTriggerContract(ids)
 });
 
+// node_modules/@qawolf/api-contracts/dist/v1/run/investigationSessionId.js
+var investigationSessionId = string2().trim().min(1).max(100).optional();
+
+// node_modules/@qawolf/api-contracts/dist/v1/run/acceptScreenshotBaseline.js
+var makeAcceptScreenshotBaselineContract = (ids) => {
+  const input = object({
+    chatSessionId: investigationSessionId.describe("The chat session of the investigation that accepts the baseline. A workspace or organization API key acts as an automation, so it must send the session that investigates the run. A person's call ignores it."),
+    comparisonId: string2().trim().min(1).max(100).describe("The failed screenshot comparison whose new screenshot becomes the baseline, as `run.listScreenshotComparisons` names it."),
+    runId: ids.run
+  });
+  const output = discriminatedUnion("outcome", [
+    object({
+      baselineChangeId: string2().describe("The baseline change. Record it on the fixed finding, and pass it to `run.restoreScreenshotBaseline` with this runId to put the old baseline back."),
+      name: string2().describe("The screenshot name whose baseline changed."),
+      outcome: literal("accepted").describe("The new screenshot is now the baseline. The old baseline is kept, so the change can be restored.")
+    }),
+    object({
+      outcome: literal("baseline-changed").describe("The baseline is no longer the one the run compared with: someone changed or deleted it since. Nothing changed. List the comparisons again to see the current baseline.")
+    }),
+    object({
+      outcome: literal("needs-approval").describe("Only a person can approve this change. Nothing changed. Propose the new baseline on a fix-proposed finding and wait for a person to apply it.")
+    }),
+    object({
+      outcome: literal("not-investigation-session").describe("An API key that is not a person's can change a baseline only as the investigation of the run, and chatSessionId is missing or is not the session that investigates the run. Nothing changed.")
+    }),
+    object({
+      outcome: literal("nothing-to-accept").describe("The comparison did not fail, or has no new screenshot to accept. Nothing changed.")
+    })
+  ]);
+  return {
+    annotationJustifications: {
+      destructiveHint: "Replaces the workspace's screenshot baseline, which changes what every later run compares with.",
+      openWorldHint: "Changes private QA Wolf baseline storage without starting external work.",
+      readOnlyHint: "Makes the new screenshot of a failed comparison the baseline."
+    },
+    annotations: {
+      destructiveHint: true,
+      openWorldHint: false,
+      readOnlyHint: false
+    },
+    description: "Make the new screenshot of a failed screenshot comparison the baseline, so later runs compare with it. " + "Use it only when the difference is an intended change of the app, not a bug, noise, or a page that was not ready. " + "Every later run of every environment of the workspace compares with the new baseline. " + "Refuses without changing anything when the baseline changed since the run.",
+    input,
+    kind: "write",
+    name: "run.acceptScreenshotBaseline",
+    output
+  };
+};
+
 // node_modules/@qawolf/api-contracts/dist/v1/run/diagnose.js
 var makeDiagnoseRunContract = (ids) => {
   const input = object({
@@ -9649,12 +10054,17 @@ var makeDiagnoseRunContract = (ids) => {
     issue: makeIssueResourceSchema(ids)
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Can replace a flow's existing diagnosis association and change externally reported run information.",
+      openWorldHint: "Recorded diagnosis changes can update run-related messages in configured external integrations.",
+      readOnlyHint: "Records failed flows as reproductions of a selected bug or maintenance issue."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
       readOnlyHint: false
     },
-    description: "Diagnose failed flows in a run as reproductions of a bug or maintenance report owned by the caller's team. " + "The issue's type selects the diagnosis. " + "Each flow must have failed in the run. " + "A flow that is already diagnosed moves to this issue. " + "The diagnosis appears on the run, and the reproduction appears under the issue's reproductions. " + "Coverage requests cannot be diagnosed; use issue.addFlows to cover flows instead.",
+    description: "Diagnose failed flows in a run as reproductions of a bug or maintenance report owned by the caller's team. " + "The issue's type selects the diagnosis. " + "Each flow must have failed in the run. " + "A flow that is already diagnosed in the run moves to this issue, and may stay linked to other open reports. " + "The diagnosis appears on the run, and the reproduction appears under the issue's reproductions. " + "Coverage requests cannot be diagnosed; use issue.addFlows to cover flows instead.",
     input,
     kind: "write",
     name: "run.diagnose",
@@ -9679,6 +10089,11 @@ var makeFindRunsContract = (ids) => {
     }, { urlFieldDescription: "Absolute URL of the run page." })).describe("The environment's runs, newest first. Per-flow results are available via run.get.")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not stop runs, overwrite results or change diagnoses.",
+      openWorldHint: "Reads private run records without executing application actions.",
+      readOnlyHint: "Lists recent environment runs without starting or retrying them."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -9692,6 +10107,22 @@ var makeFindRunsContract = (ids) => {
   };
 };
 
+// node_modules/@qawolf/api-contracts/dist/v1/run/flowFailure.js
+var makeFlowFailureSchema = (ids) => {
+  const diagnosis = object({
+    issueId: ids.issue,
+    type: _enum(["bug", "maintenance"])
+  }).optional().describe("QA Wolf's investigation verdict for the failure: `bug` means the " + "application is broken, `maintenance` means the test needed an " + "update and the failure does not indicate an application problem. " + "Absent until the investigation reaches a verdict, and absent when " + "the flow was opted out of investigation. Pass issueId to issue.get " + "for details.");
+  const optedOutOfInvestigation = object({
+    by: _enum(["user", "system"]).describe("Who stopped the investigation: `user` is a person, in the app or " + "with a user API key, or the workspace's automation user for a " + "team or organization API key, for example through " + "run.optOutOfInvestigation; `system` is QA Wolf, when the " + "investigation expired.")
+  }).optional().describe('Present when the failure was marked "do not investigate" (DNI): ' + "it will get no bug or maintenance verdict.");
+  return object({
+    diagnosis,
+    error: string2(),
+    optedOutOfInvestigation
+  });
+};
+
 // node_modules/@qawolf/api-contracts/dist/v1/run/get.js
 var makeGetRunContract = (ids) => {
   const flowStatus = _enum(publicRunStatusValues);
@@ -9724,6 +10155,7 @@ var makeGetRunContract = (ids) => {
     }),
     object({
       attemptId: ids.runAttempt.optional(),
+      canceledReason: string2().min(1).optional().describe("Why the attempt was canceled. userCanceled means a person stopped it; do not immediately retry that activity."),
       completedAt: exports_iso.datetime().optional(),
       kind: automatedKind,
       startedAt: exports_iso.datetime().optional(),
@@ -9739,16 +10171,9 @@ var makeGetRunContract = (ids) => {
   });
   const attempt = union([automatedAttempt, manualAttempt]);
   const attempts = array(attempt).optional().describe("The flow's finished execution attempts, oldest first, including " + "manual Wolf Browser attempts. Present once at least one attempt has " + "finished, so a flow that passed after retries also lists its failed " + "attempts. Artifact URLs appear only on automated attempts that " + "reached a verdict, stay valid for at least a day (call run.get " + "again for fresh ones), and can return 404 when the attempt did not " + "produce that artifact.");
-  const diagnosis = object({
-    issueId: ids.issue,
-    type: _enum(["bug", "maintenance"])
-  }).optional().describe("QA Wolf's investigation verdict for the failure: `bug` means the " + "application is broken, `maintenance` means the test needed an " + "update and the failure does not indicate an application problem. " + "Absent until the investigation reaches a verdict. Pass issueId to " + "issue.get for details.");
   const failedFlow = object({
     attempts,
-    failure: object({
-      diagnosis,
-      error: string2()
-    }),
+    failure: makeFlowFailureSchema(ids),
     flowId: ids.flow,
     name: string2(),
     status: literal("failed")
@@ -9767,6 +10192,11 @@ var makeGetRunContract = (ids) => {
     runId: ids.run.describe("The run this response describes. Treat it as canonical: it can differ from the id you asked for. A deploy notification returns a run id before the run exists, and if a second notification for the same commit is folded into an earlier run, that id resolves to the earlier run instead.")
   }, { urlFieldDescription: "Absolute URL of the run page." });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not retry, cancel or alter the run.",
+      openWorldHint: "Reads recorded QA Wolf results without changing the application under test.",
+      readOnlyHint: "Retrieves a run's status, per-flow results and result links."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -9844,6 +10274,11 @@ var makeGetRunAttemptArtifactsContract = (ids) => {
     })
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not retry, cancel or alter the run attempt.",
+      openWorldHint: "Reads recorded QA Wolf artifacts without changing the application under test.",
+      readOnlyHint: "Retrieves a finished attempt's metadata and signed artifact URLs."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -9857,6 +10292,35 @@ var makeGetRunAttemptArtifactsContract = (ids) => {
   };
 };
 
+// node_modules/@qawolf/api-contracts/dist/v1/run/optOutOfInvestigation.js
+var makeOptOutOfInvestigationRunContract = (ids) => {
+  const input = object({
+    flowIds: array(ids.flow).min(1).max(100).refine((flowIds) => new Set(flowIds).size === flowIds.length, "flowIds must be unique").describe("The failed flows to stop investigating. Every named flow must be " + "eligible or the whole request is rejected."),
+    runId: ids.run
+  });
+  const output = resource({
+    optedOutFlowIds: array(ids.flow).describe("The flows that no longer need investigation."),
+    runId: ids.run
+  }, { urlFieldDescription: "Absolute URL of the run page." });
+  return {
+    annotationJustifications: {
+      destructiveHint: "Ends the investigation of the selected failures and changes externally reported run information.",
+      openWorldHint: "Recorded opt-outs can update run-related messages in configured external integrations.",
+      readOnlyHint: "Records failed flows as needing no bug or maintenance report."
+    },
+    annotations: {
+      destructiveHint: true,
+      openWorldHint: true,
+      readOnlyHint: false
+    },
+    description: 'Mark failed flows in a run as "do not investigate" (DNI): the failures need no bug or maintenance report. ' + "Each flow must have failed in the run and still be under investigation. " + "A flow that already has a diagnosis cannot be opted out. " + "A team or organization key records the opt-out as the workspace's automation user. " + "To link a failure to a report instead, use run.diagnose.",
+    input,
+    kind: "write",
+    name: "run.optOutOfInvestigation",
+    output
+  };
+};
+
 // node_modules/@qawolf/api-contracts/dist/v1/run/reattempt.js
 var makeReattemptRunContract = (ids) => {
   const input = object({
@@ -9868,6 +10332,11 @@ var makeReattemptRunContract = (ids) => {
     runId: ids.run
   }, { urlFieldDescription: "Absolute URL of the run page." });
   return {
+    annotationJustifications: {
+      destructiveHint: "Repeated execution can overwrite or delete application data and creates additional billed work.",
+      openWorldHint: "New attempts execute against the application under test and can affect connected services.",
+      readOnlyHint: "Enqueues new attempts for eligible failed or canceled flows using the latest code."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -9881,6 +10350,50 @@ var makeReattemptRunContract = (ids) => {
   };
 };
 
+// node_modules/@qawolf/api-contracts/dist/v1/run/restoreScreenshotBaseline.js
+var makeRestoreScreenshotBaselineContract = (ids) => {
+  const input = object({
+    baselineChangeId: string2().trim().min(1).max(100).describe("The baseline change to undo, as `run.acceptScreenshotBaseline` returned it for this run."),
+    chatSessionId: investigationSessionId.describe("The chat session of the investigation that restores the baseline. A workspace or organization API key acts as an automation, so it must send the session that investigates the run. A person's call ignores it."),
+    runId: ids.run
+  });
+  const output = discriminatedUnion("outcome", [
+    object({
+      name: string2().describe("The screenshot name whose baseline changed."),
+      outcome: literal("restored").describe("The baseline the change replaced is the baseline again.")
+    }),
+    object({
+      outcome: literal("baseline-changed").describe("The baseline changed again after this change, so restoring it would undo someone else's change. Nothing changed.")
+    }),
+    object({
+      outcome: literal("needs-dispute").describe("Only a person can restore this change, unless a person disputed the finding that made it. Nothing changed.")
+    }),
+    object({
+      outcome: literal("not-investigation-session").describe("An API key that is not a person's can change a baseline only as the investigation of the run, and chatSessionId is missing or is not the session that investigates the run. Nothing changed.")
+    }),
+    object({
+      outcome: literal("nothing-to-restore").describe("The change was already restored, the name had no baseline before it, or the kept copy of the old baseline is missing or is not the baseline the change replaced. Nothing changed.")
+    })
+  ]);
+  return {
+    annotationJustifications: {
+      destructiveHint: "Replaces the current screenshot baseline with the one it replaced, which changes what every later run compares with.",
+      openWorldHint: "Changes private QA Wolf baseline storage without starting external work.",
+      readOnlyHint: "Puts back the screenshot baseline that an accepted comparison replaced."
+    },
+    annotations: {
+      destructiveHint: true,
+      openWorldHint: false,
+      readOnlyHint: false
+    },
+    description: "Undo a screenshot baseline change that accepted a failed comparison of the run: put back the baseline it replaced, so later runs compare with the old baseline again. " + "Use it when a person disputes a baseline the AI accepted. " + "Refuses without changing anything when the baseline changed again since.",
+    input,
+    kind: "write",
+    name: "run.restoreScreenshotBaseline",
+    output
+  };
+};
+
 // node_modules/@qawolf/api-contracts/dist/v1/run/stop.js
 var makeStopRunContract = (ids) => {
   const input = object({ runId: ids.run });
@@ -9889,6 +10402,11 @@ var makeStopRunContract = (ids) => {
     status: _enum(["accepted", "already-finished", "execution-not-found"]).describe('"accepted" means stopping was requested; poll run.get for the final result. "already-finished" means the run has already finished and its result is unchanged. "execution-not-found" means the run exists but no execution was found to stop; it may still be starting or may no longer be available. No stop request was accepted in that case.')
   }, { urlFieldDescription: "Absolute URL of the run page." });
   return {
+    annotationJustifications: {
+      destructiveHint: "Interrupts unfinished work, while finished results remain intact and repeated stop requests are supported.",
+      openWorldHint: "Run status changes can update messages or commit statuses in configured external integrations.",
+      readOnlyHint: "Requests asynchronous cancellation of a run, queued flows and automatic retries."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -9927,6 +10445,11 @@ var makeEvaluateSnippetOnRunnerContract = (ids) => {
     ])
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Code can overwrite or delete runner or application data, and a timeout does not prove execution stopped.",
+      openWorldHint: "Supplied code can submit application actions or contact and change external services.",
+      readOnlyHint: "Executes supplied code against the interactive runner's current session."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -9960,6 +10483,11 @@ var makeGetRunnerContract = (ids) => {
     })
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not stop the runner or change its execution.",
+      openWorldHint: "Reads private runner placement state without acting on external applications.",
+      readOnlyHint: "Checks whether a runner exists without starting it or refreshing its inactivity timer."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -10003,6 +10531,11 @@ var makeHighlightSelectorOnRunnerContract = (ids) => {
     })
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Only replaces or clears the inspection overlay rather than deleting application data.",
+      openWorldHint: "Draws a private inspection overlay without submitting an application form.",
+      readOnlyHint: "Changes the visual selector highlight on the runner's live page."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -10036,6 +10569,11 @@ var makeImportPackageOnRunnerContract = (ids) => {
     })
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Can replace existing dependencies or execute commands that overwrite or delete runner or application data.",
+      openWorldHint: "Installation can contact external services and execute commands that change third-party systems.",
+      readOnlyHint: "Installs caller-selected dependencies into a live runner and can execute commands with the runner's access."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -10065,9 +10603,14 @@ var makeLaunchRunnerContract = (ids) => {
     outcome: literal("success")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Starts billable resource consumption that cannot be undone by later termination.",
+      openWorldHint: "Allocates a private QA Wolf runner without itself navigating to an application or submitting forms.",
+      readOnlyHint: "Starts an interactive runner and allocates billed resources unless the requested runner is already running."
+    },
     annotations: {
       destructiveHint: true,
-      openWorldHint: false,
+      openWorldHint: true,
       readOnlyHint: false
     },
     description: "Launch an interactive runner on the caller's team under an id the caller chooses. Send `initialUrl` so its browser comes up on the page the work starts from, which saves a separate navigation and the browser's cold start. Launching the same id again returns the runner already running rather than starting a second one, and the same id with a different runnerName is refused. A runner is not permanent: it terminates on its own after a period of inactivity, and launching the same id after that starts and bills a new runner, so read `alreadyRunning` to tell which happened. A success means the runner is answering: the call waits for the pod it started to come up, so the very next call to the runner reaches it. If the pod does not come up in time the call fails instead, leaving the runner running, and launching the same id again attaches to it.",
@@ -10088,6 +10631,11 @@ var makeTerminateRunnerContract = (ids) => {
     wasRunning: boolean2().describe("False when no running runner had this id: it was already terminated, was never launched, or terminated on its own after inactivity. These are not distinguished, because the run system keeps no record of a runner once it is gone. Not an error, and a retry needs no special handling.")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Terminates running work and discards the live session, while an absent runner is left absent.",
+      openWorldHint: "Stops a private QA Wolf runner without itself publishing to third-party services.",
+      readOnlyHint: "Ends a selected interactive runner and the resources hosting it."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: false,
@@ -10111,6 +10659,11 @@ var makeListRunnersContract = (ids) => {
     runners: array(makeRunnerSchema()).describe("The runners running right now, in no particular order. Each entry carries the same fields a launch reports, so any of them can be addressed like a runner you launched yourself.")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not interrupt or terminate any listed runner.",
+      openWorldHint: "Reads private runner state without acting on third-party applications.",
+      readOnlyHint: "Lists running workspace runners without starting them or refreshing their inactivity timers."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -10145,6 +10698,11 @@ var makePromoteSnapshotOnRunnerContract = (ids) => {
     })
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Overwrites an existing baseline, while a missing source snapshot leaves it unchanged.",
+      openWorldHint: "Updates a stored test baseline rather than publishing to an external application.",
+      readOnlyHint: "Replaces a named image-diff baseline with a screenshot produced by the runner."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: false,
@@ -10170,6 +10728,11 @@ var makeReadRunnerJournalContract = (ids) => {
     makeRunnerFailureSchema([runnerUnreachableFailureReason])
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not erase journal entries or change run results, although the activity refresh can extend billed runtime.",
+      openWorldHint: "Reads private runner history without submitting actions to external applications.",
+      readOnlyHint: "Retrieves journal entries and refreshes activity, which can cancel an inactivity shutdown."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -10201,7 +10764,7 @@ var makeRunFlowOnRunnerContract = (ids) => {
     env: runEnvironmentSchema.optional().describe("Environment variables to make available to the run."),
     environmentId: ids.environmentRef.optional().describe("A QA Wolf environment whose variables the run is given, by id or alias. QA Wolf reads and decrypts them itself, so they never travel in the request and the count and length limits on `env` do not apply to them. Send this or `env`, not both."),
     files: runFilesSchema.describe("Every file the run needs keyed by its path — the flow file, everything it imports, package.json and tsconfig.json. A runner holds no copy of your project, so what runs is exactly what is sent here."),
-    flowId: ids.flow.optional().describe("The QA Wolf flow this run is for. The run then sees it as `QAWOLF_WORKFLOW_ID`, the same value a platform run of that flow sees, so fixtures named and cleaned up by it match across both. Omit it when the flow is not in QA Wolf yet, and the run has no `QAWOLF_WORKFLOW_ID`."),
+    flowId: ids.flow.optional().describe("The QA Wolf flow this run is for. The run then sees it as `QAWOLF_WORKFLOW_ID`, the same value a platform run of that flow sees, so fixtures named and cleaned up by it match across both. Omitted, the flow whose file is at `entryPointPath` on the named environment's flow-code branch stands in; a file not in QA Wolf yet, or a run given no environment, leaves the run with no `QAWOLF_WORKFLOW_ID`."),
     id: runnerIdSchema.describe("Id of the runner to run the flow on."),
     selection: runSelectionSchema.optional().describe("Run only these lines, inside the page the runner is already on, instead of running the whole flow from a fresh browser. Omit to run the whole entry point."),
     unchangedFiles: unchangedFilesSchema.optional().describe("Files this runner already holds from an earlier run, keyed by path with a hex SHA-256 of the content it should hold. Send this to make `files` only what changed. The runner refuses with `needs-full-sync` if it holds none of a referenced path, so it never runs something other than what was asked for. Omit it to send every file."),
@@ -10248,6 +10811,11 @@ var makeRunFlowOnRunnerContract = (ids) => {
     failure
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Test code can overwrite or delete application data, and uncertain acceptance must be checked before resubmission.",
+      openWorldHint: "Executed tests can submit forms and change the application under test or its connected services.",
+      readOnlyHint: "Submits test files for full-flow or selected-line execution on an interactive runner."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -10275,6 +10843,11 @@ var makeStopRunOnRunnerContract = (ids) => {
     makeRunnerFailureSchema([runnerUnreachableFailureReason])
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Stops unfinished work where it is, while an already-idle runner is left idle.",
+      openWorldHint: "Changes private execution state without itself posting external messages.",
+      readOnlyHint: "Interrupts current execution while leaving the runner available."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: false,
@@ -10305,6 +10878,11 @@ var makeTakeScreenshotOnRunnerContract = (ids) => {
     ])
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not change application data or stop execution, although the activity refresh can extend billed runtime.",
+      openWorldHint: "Reads the private runner display without submitting an external application action.",
+      readOnlyHint: "Captures the runner screen and refreshes activity, which can cancel an inactivity shutdown."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -10356,6 +10934,11 @@ var makeListSkillsContract = () => {
     skills: array(skillSummary).describe("Every skill the server serves, in catalog order.")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not change any skill or workspace data.",
+      openWorldHint: "Reads the QA Wolf skill catalog without calling external services.",
+      readOnlyHint: "Lists the QA Wolf skills with their names and descriptions."
+    },
     annotations: readOnlyAnnotations,
     description: "List the QA Wolf skills, each with its name and the description that says when to use it. A skill is the instructions a coding agent follows for one kind of QA Wolf work, such as onboarding an application, creating a flow, repairing a failing flow, or setting up triggers. Call this before any QA Wolf work, pick the skill whose description matches the request, and read it with skill.get.",
     input,
@@ -10374,6 +10957,11 @@ var makeGetSkillContract = () => {
     })).describe("The files the skill links to under its directory.")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not change any skill or workspace data.",
+      openWorldHint: "Reads the QA Wolf skill catalog without calling external services.",
+      readOnlyHint: "Retrieves one QA Wolf skill's instructions and reference files."
+    },
     annotations: readOnlyAnnotations,
     description: "Read a QA Wolf skill: the instructions a coding agent follows for one kind of QA Wolf work. The reply carries the skill's SKILL.md and every file under its references directory, so nothing else has to be fetched for it. Read the skill before starting the work it covers and follow it. A link in the reply of the form ../<skill>/SKILL.md names another skill, which this call reads by that name.",
     input,
@@ -10402,6 +10990,11 @@ var makeListTagsContract = (ids) => {
     })).describe("The team's tags, alphabetical by name.")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not create, rename or remove tags.",
+      openWorldHint: "Reads private tag metadata without changing connected services.",
+      readOnlyHint: "Lists existing workspace tags by name."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -10468,12 +11061,16 @@ var makeContractsV1 = (ids) => {
     },
     legacyTrigger: makeLegacyTriggerContracts(resolvedIds),
     run: {
+      acceptScreenshotBaseline: makeAcceptScreenshotBaselineContract(resolvedIds),
       create: makeCreateRunContract(resolvedIds),
       diagnose: makeDiagnoseRunContract(resolvedIds),
       find: makeFindRunsContract(resolvedIds),
       get: makeGetRunContract(resolvedIds),
       getAttemptArtifacts: makeGetRunAttemptArtifactsContract(resolvedIds),
+      listScreenshotComparisons: makeListScreenshotComparisonsContract(resolvedIds),
+      optOutOfInvestigation: makeOptOutOfInvestigationRunContract(resolvedIds),
       reattempt: makeReattemptRunContract(resolvedIds),
+      restoreScreenshotBaseline: makeRestoreScreenshotBaselineContract(resolvedIds),
       stop: makeStopRunContract(resolvedIds)
     },
     runner: makeRunnerContracts(resolvedIds),
@@ -15108,4 +15705,4 @@ export {
   createRunnerSdk
 };
 
-//# debugId=3EFB50CF5F60CF8264756E2164756E21
+//# debugId=ADFCE2FBF1F4DDA964756E2164756E21