@qawolf/cli 1.38.0 → 1.39.0

package/dist/cli.js

@@ -16749,6 +16749,11 @@ var makeRequestFileDownloadContract = (ids) => {
     readUrl: string2().describe('Fetch the file\'s bytes from here, for example `curl -o journeys.csv "<readUrl>"`. Write it to a file and read that file, rather than printing the contents, so a large file costs one line of output instead of all of it.')
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not change, overwrite or delete the stored file.",
+      openWorldHint: "Access is limited to QA Wolf team storage; the caller cannot supply an arbitrary external destination.",
+      readOnlyHint: "Returns an expiring read URL for an existing file in the authorized workspace storage."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -16775,6 +16780,11 @@ var makeRequestFileUploadContract = (ids) => {
     uploadUrl: string2().describe(`Send the file's bytes here with a single HTTP PUT carrying the returned contentType, for example \`curl -H 'Content-Type: application/octet-stream' --upload-file "journeys.csv" "<uploadUrl>"\`. Upload the bytes from the shell rather than through this API, so a large file never has to be written out as text.`)
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Using the returned upload URL with an existing file name replaces that stored file.",
+      openWorldHint: "The upload target is QA Wolf team storage, not an arbitrary external service or recipient.",
+      readOnlyHint: "Returns an expiring upload URL that permits writing a file to the authorized workspace storage."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: false,
@@ -16890,6 +16900,11 @@ var makeCreateRunContract = (ids) => {
     tracking: _enum(["registered", "failed", "not-requested"]).describe('Whether the conversation named by aiTaskId or chatSessionId will receive run status updates: "registered" when it will, "failed" when the run was created but the registration failed, "not-requested" when neither id was given or the AI task has no conversation to notify.')
   }, { urlFieldDescription: "Absolute URL of the run page." });
   return {
+    annotationJustifications: {
+      destructiveHint: "Test code can overwrite or delete application data.",
+      openWorldHint: "Test execution can submit forms or change the application under test and its connected services.",
+      readOnlyHint: "Creates a run and enqueues execution of selected flows."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -16956,6 +16971,11 @@ var makeListScreenshotComparisonsContract = (ids) => {
     truncated: boolean2().describe(`True when the selected flows have more than ${maxListedScreenshotAttempts} failed attempts. Only the ${maxListedScreenshotAttempts} most recent are listed, and the older attempts cannot be listed.`)
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not change baselines, results or the run.",
+      openWorldHint: "Reads recorded QA Wolf screenshots without changing the application under test.",
+      readOnlyHint: "Creates missing JPEG previews of the compared images and keeps them in team storage."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -17029,6 +17049,7 @@ var browserActionSchema = discriminatedUnion("type", [
     type: literal("type")
   })
 ]);
+
 // node_modules/@qawolf/api-contracts/dist/v1/runner/environment.js
 var reservedRunEnvironmentVariableName = "QAWOLF_TEAM_ID";
 function refusalForRunEnvironmentVariableName(name) {
@@ -17149,6 +17170,11 @@ var makeInspectOnRunnerContract = (ids) => {
     })
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not edit test code or application data, although the activity refresh can extend billed runtime.",
+      openWorldHint: "Inspects the private runner session without submitting application actions.",
+      readOnlyHint: "Retrieves browser inspection data and refreshes activity, which can cancel an inactivity shutdown."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -17313,6 +17339,11 @@ var makeInspectMobileOnRunnerContract = (ids) => {
     ])
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not change application data, edit tests, or stop the runner.",
+      openWorldHint: "Inspects the existing QA Wolf mobile runner without submitting application actions or contacting arbitrary services.",
+      readOnlyHint: "Reads mobile session status, contexts, page source, or elements without refreshing the runner's inactivity timer."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -17487,6 +17518,11 @@ var makePerformActionOnRunnerContract = (ids) => {
     failure
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Actions can submit irreversible transactions or delete existing data, so uncertain outcomes must be inspected before retrying.",
+      openWorldHint: "Clicks, typing and navigation can submit external forms or change application state.",
+      readOnlyHint: "Performs a browser or device action and can start a browser when needed."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -17538,6 +17574,7 @@ var failedStepSchema = discriminatedUnion("failureReason", [
     failureReason: _enum([
       ...screenFailureReasons,
       "action-not-supported-on-mobile",
+      "action-not-supported-on-browser",
       outOfTimeFailureReason
     ]),
     index: actionIndexSchema,
@@ -17552,6 +17589,7 @@ var sequenceFailureReasons = [
   "action-failed",
   ...screenFailureReasons,
   "action-not-supported-on-mobile",
+  "action-not-supported-on-browser",
   outOfTimeFailureReason,
   unconfirmedFailureReason,
   runnerUnreachableFailureReason
@@ -17560,11 +17598,11 @@ var sequenceFailureReasons = [
 // node_modules/@qawolf/api-contracts/dist/v1/runner/performActions.js
 var actionsDescription = `The actions to perform, in order, each exactly what \`runner.performAction\` takes: coordinates are whole pixels on the runner's virtual desktop, in the same space as \`runner.takeScreenshot\`, and the shapes follow the computer-use vocabulary. At most ${maxActionsPerRequest} per request. For when the next several steps are already known — click a field, type into it, press Enter — and one look at the screen at the end is enough. They run back to back on the runner, with no pause between them: put in one request only steps whose targets are all on the screen you last saw and are not moved by the steps before them, and when a step changes the page — a submit, a navigation, opening a menu — make it the last one and read the frame.`;
 var screenshotModeDescription = "`final`, the default, answers with one screenshot in `imageJpegBase64`: the screen after the last action, or, after a stop, as it stands. `each` puts a screenshot after every action on its entry in `results`, for when each step must be checked; every frame is a full image, so keep such sequences short. `none` sends no screenshot.";
-var stopOnFailureDescription = "`true`, the default, leaves the remaining actions unperformed once one fails. `false` carries on past an action that reached the runner and did not take effect (`action-failed`, `action-not-supported-on-mobile`), so use it only for actions that do not depend on each other: a `type` after a `click` that failed goes to whatever has focus. A runner that cannot be reached, a screen that cannot serve, or running out of time ends the sequence either way.";
+var stopOnFailureDescription = "`true`, the default, leaves the remaining actions unperformed once one fails. `false` carries on past an action that reached the runner and did not take effect (`action-failed`, `action-not-supported-on-mobile`, `action-not-supported-on-browser`), so use it only for actions that do not depend on each other: a `type` after a `click` that failed goes to whatever has focus. A runner that cannot be reached, a screen that cannot serve, or running out of time ends the sequence either way.";
 var finalImageDescription = "Present with `screenshotMode: final` when the runner still answered: the screen after the last action performed, or, after a stop, as it stands.";
 var makePerformActionsOnRunnerContract = (ids) => {
   const input = object({
-    actions: array(browserActionSchema).min(1).max(maxActionsPerRequest).describe(actionsDescription),
+    actions: array(runnerActionSchema).min(1).max(maxActionsPerRequest).describe(actionsDescription),
     id: runnerIdSchema.describe("Id of the runner to act on."),
     screenshotMode: _enum(screenshotModes).optional().describe(screenshotModeDescription),
     stopOnFailure: boolean2().optional().describe(stopOnFailureDescription),
@@ -17589,12 +17627,17 @@ var makePerformActionsOnRunnerContract = (ids) => {
     })
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Actions can submit irreversible transactions or delete existing data, so uncertain outcomes must be inspected before retrying.",
+      openWorldHint: "Clicks, typing and navigation can submit external forms or change application state.",
+      readOnlyHint: "Performs a sequence of browser or device actions on a runner."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
       readOnlyHint: false
     },
-    description: "Perform a sequence of raw browser actions on an interactive runner in one request, one after another, and answer with what happened to each. A `success` means every action took effect. A `failure` names the first action that did not (`failedIndex`, `failureReason`), the last one that did (`lastCompletedIndex`), and whether actions were left unperformed (`stoppedEarly`); `results` has one entry per action reached, in order. Read `effect` on an entry before sending its action again: `performed` means the runner did it; `not-performed` means the runner answered that it did not take effect, though a `navigate` that timed out may still be loading; `unknown` means the runner stopped answering with the action in flight (`runner-unreachable`), or its screen went quiet mid-action (`action-unconfirmed`), and it may have taken effect — a click that submitted a form, say — so take a screenshot instead of repeating it. A sequence gets about a minute to start its actions; an action it did not reach in time is `out-of-time`, nothing after it was attempted, and the rest can go in a new request. Everything `runner.performAction` says about a runner that has never run anything, a mobile runner, and the `screen-needs-a-run`, `screen-not-ready`, `runner-has-no-screen` and `action-not-supported-on-mobile` reasons holds for each action here.",
+    description: "Perform a sequence of raw actions on an interactive runner in one request, one after another, and answer with what happened to each. A `success` means every action took effect. A `failure` names the first action that did not (`failedIndex`, `failureReason`), the last one that did (`lastCompletedIndex`), and whether actions were left unperformed (`stoppedEarly`); `results` has one entry per action reached, in order. Read `effect` on an entry before sending its action again: `performed` means the runner did it; `not-performed` means the runner answered that it did not take effect, though a `navigate` that timed out may still be loading; `unknown` means the runner stopped answering with the action in flight (`runner-unreachable`), or its screen went quiet mid-action (`action-unconfirmed`), and it may have taken effect — a click that submitted a form, say — so take a screenshot instead of repeating it. A sequence gets about a minute to start its actions; an action it did not reach in time is `out-of-time`, nothing after it was attempted, and the rest can go in a new request. Everything `runner.performAction` says about a runner that has never run anything, a mobile runner, and the `screen-needs-a-run`, `screen-not-ready`, `runner-has-no-screen`, `action-not-supported-on-mobile` and `action-not-supported-on-browser` reasons holds for each action here.",
     input,
     kind: "write",
     name: "runner.performActions",
@@ -17662,6 +17705,11 @@ var makeRecordOnRunnerContract = (ids) => {
     url: url()
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Starts or stops a video recording without changing the application under test.",
+      openWorldHint: "Controls recording on a QA Wolf runner without starting external work.",
+      readOnlyHint: "Starts or stops video recording and changes automatic capture settings."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -17689,6 +17737,11 @@ var makeRunnerRecordingsContract = (ids) => {
     }))
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not delete or change any recording.",
+      openWorldHint: "Reads QA Wolf workspace storage without changing the application under test.",
+      readOnlyHint: "Lists or retrieves a runner's finalized recordings."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -17918,6 +17971,11 @@ var makeCreateTriggerContract = (ids) => {
   ]).superRefine(checkTriggerConfiguration);
   const output = object({ trigger: makeTriggerResourceSchema(ids) });
   return {
+    annotationJustifications: {
+      destructiveHint: "Enables automatic execution of test code that may overwrite or delete application data.",
+      openWorldHint: "Triggered runs can change the application under test and update connected integrations.",
+      readOnlyHint: "Creates an active schedule or deployment trigger that can start test runs."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -17941,6 +17999,11 @@ var makeFindTriggersContract = (ids) => {
     triggers: array(makeTriggerResourceSchema(ids)).describe("The team's triggers, newest first.")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not modify or delete triggers or their runs.",
+      openWorldHint: "Reads private QA Wolf trigger records without changing external systems.",
+      readOnlyHint: "Lists trigger configuration in the authorized workspace without changing it."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -17959,6 +18022,11 @@ var makeGetTriggerContract = (ids) => {
   const input = object({ triggerId: ids.trigger });
   const output = object({ trigger: makeTriggerResourceSchema(ids) });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not modify or delete the trigger or its runs.",
+      openWorldHint: "Reads a private QA Wolf trigger without changing external systems.",
+      readOnlyHint: "Retrieves one authorized trigger and its configuration without changing it."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -17977,6 +18045,11 @@ var makePauseTriggerContract = (ids) => {
   const input = object({ triggerId: ids.trigger });
   const output = object({ trigger: makeTriggerResourceSchema(ids) });
   return {
+    annotationJustifications: {
+      destructiveHint: "Disables future automatic execution for the selected trigger until it is resumed.",
+      openWorldHint: "Changes private QA Wolf scheduling state without starting external work.",
+      readOnlyHint: "Pauses an existing trigger so it stops starting new work."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: false,
@@ -17993,6 +18066,11 @@ var makeResumeTriggerContract = (ids) => {
   const input = object({ triggerId: ids.trigger });
   const output = object({ trigger: makeTriggerResourceSchema(ids) });
   return {
+    annotationJustifications: {
+      destructiveHint: "Enables automatic test execution that may overwrite or delete application data.",
+      openWorldHint: "Resumed execution can change the application under test and update connected integrations.",
+      readOnlyHint: "Reactivates a paused trigger so future matching schedules or deployments can start runs."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -18011,6 +18089,11 @@ var makeDeleteTriggerContract = (ids) => {
     triggerId: ids.trigger.describe("The id of the deleted trigger.")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Permanently deletes the selected trigger configuration.",
+      openWorldHint: "Removes private QA Wolf trigger configuration without starting external work.",
+      readOnlyHint: "Permanently removes a trigger while preserving runs it already created."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: false,
@@ -18047,6 +18130,11 @@ var makeUpdateTriggerContract = (ids) => {
   ]).superRefine(checkTriggerConfiguration);
   const output = object({ trigger: makeTriggerResourceSchema(ids) });
   return {
+    annotationJustifications: {
+      destructiveHint: "Overwrites trigger configuration and can enable tests that change or delete application data.",
+      openWorldHint: "The updated trigger can execute tests against external applications and update connected integrations.",
+      readOnlyHint: "Replaces an existing trigger configuration and can change future automatic runs."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -18088,6 +18176,11 @@ var makeAgentGetContract = (ids) => {
     urlFieldDescription: "Absolute URL of the live session in the QA Wolf app."
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not cancel work or edit tests and messages.",
+      openWorldHint: "Reads a QA Wolf session without posting to external services.",
+      readOnlyHint: "Retrieves session status, replies and the live link without sending work."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -18119,6 +18212,11 @@ var makeAgentSendContract = (ids) => {
     urlFieldDescription: "Absolute URL of the live session in the QA Wolf app."
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Delegated execution can overwrite test code or change and delete application data.",
+      openWorldHint: "Delegated work can submit application actions and publish code to connected repositories.",
+      readOnlyHint: "Creates or continues AI work that can implement, run and publish tests."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -18157,6 +18255,11 @@ var makeFindCodeHostIntegrationsContract = (ids) => {
     settingsUrl: url().describe("Absolute URL of the workspace's integrations settings page.")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not disconnect integrations or change repository access.",
+      openWorldHint: "Reads QA Wolf integration records without contacting or changing GitHub or GitLab.",
+      readOnlyHint: "Lists the workspace's stored code host integrations and settings link without modifying them."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -18189,6 +18292,11 @@ var makeListCodeHostRepositoriesContract = (ids) => {
     repositories: array(makeCodeHostRepositoryResourceSchema()).describe("The repositories the workspace's code host integrations cover, alphabetical by full name.")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not edit repositories, integration settings, or access permissions.",
+      openWorldHint: "Reads repositories already recorded for the workspace's integrations, without accessing arbitrary external repositories.",
+      readOnlyHint: "Lists repository metadata from the workspace's last code host sync without triggering a new sync."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -18232,6 +18340,11 @@ var makeFindDeploymentsContract = (ids) => {
     nextCursor: nextCursorSchema
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not modify deployments, environments, triggers, or runs.",
+      openWorldHint: "Reads QA Wolf deployment records without contacting deployment providers or starting tests.",
+      readOnlyHint: "Lists stored workspace deployments without reporting or changing their status."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -18306,6 +18419,11 @@ var makeListDeploymentTriggerEvaluationsContract = (ids) => {
     object({ state: literal("not-evaluated") }).describe("Triggers were never evaluated for this deployment. Only a deployment's first success report evaluates triggers, so a deployment that never reported success carries no verdicts.")
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not alter recorded verdicts, trigger configuration, or existing runs.",
+      openWorldHint: "Reads stored QA Wolf verdicts without starting tests or updating external services.",
+      readOnlyHint: "Retrieves the recorded trigger verdicts for one deployment without evaluating triggers again."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -18377,6 +18495,11 @@ var makeReportDeploymentStatusContract = (ids) => {
   }, { urlFieldDescription: "Absolute URL of the environment's runs page." });
   const output = object({ deployment });
   return {
+    annotationJustifications: {
+      destructiveHint: "Can replace deployment details and variable overrides, and trigger tests that overwrite or delete application data.",
+      openWorldHint: "Successful deployments can start tests against external applications and update connected integrations.",
+      readOnlyHint: "Creates or updates a deployment, can create an environment, and evaluates triggers on its first success report."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -18413,6 +18536,11 @@ var makeFindEmailsContract = (ids) => {
     nextCursor: nextCursorSchema
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not send, edit, or delete email messages.",
+      openWorldHint: "Reads the workspace's QA Wolf inbox records without contacting recipients or arbitrary mailboxes.",
+      readOnlyHint: "Searches stored workspace emails and returns matching message summaries."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -18434,6 +18562,11 @@ var makeGetEmailContract = (ids) => {
   });
   const output = makeEmailResourceSchema();
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not alter or delete the message or its attachments.",
+      openWorldHint: "Reads a stored workspace message without forwarding it or contacting external recipients.",
+      readOnlyHint: "Retrieves the content of an existing workspace email."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -18462,6 +18595,11 @@ var makeGetEmailAttachmentContract = (ids) => {
     type: string2().optional().describe("The MIME type.")
   }, { urlFieldDescription: emailUrlFieldDescription });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not modify or delete the email or attachment.",
+      openWorldHint: "Access is limited to attachments of authorized workspace emails, not arbitrary external files.",
+      readOnlyHint: "Reads one attachment from an existing workspace email and returns its content."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -18486,6 +18624,11 @@ var makeListEmailAddressesContract = (ids) => {
     nextCursor: nextCursorSchema
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not register, replace, or remove inbox addresses.",
+      openWorldHint: "Reads QA Wolf inbox configuration without contacting external mail services or recipients.",
+      readOnlyHint: "Lists the workspace's registered inbox addresses without changing them."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -18513,6 +18656,11 @@ var makeRegisterEmailAddressContract = (ids) => {
   });
   const output = makeEmailAddressResourceSchema();
   return {
+    annotationJustifications: {
+      destructiveHint: "Adds an address without replacing or deleting existing inbox addresses or emails.",
+      openWorldHint: "Adds a QA Wolf workspace inbox address without sending messages to external recipients.",
+      readOnlyHint: "Registers an additional inbox address for the workspace."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -18551,6 +18699,11 @@ var makeSendEmailContract = (ids) => {
     urlFieldDescription: emailUrlFieldDescription
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Sending an email is irreversible; recipients may act on it, and the tool cannot recall it.",
+      openWorldHint: "Delivers message content and attachments to caller-selected email recipients outside QA Wolf.",
+      readOnlyHint: "Sends an email from a workspace inbox and stores the sent message."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -18596,6 +18749,11 @@ var makeCreateEnvironmentContract = (ids) => {
   });
   const output = makeEnvironmentResourceSchema(ids);
   return {
+    annotationJustifications: {
+      destructiveHint: "Adds a new environment and branch rather than deleting or overwriting an existing one.",
+      openWorldHint: "Creates a branch in the connected Git provider rather than changing only QA Wolf records.",
+      readOnlyHint: "Creates a QA Wolf environment and its remote flow-code branch."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: true,
@@ -18620,6 +18778,11 @@ var makeDeleteEnvironmentVariableContract = (ids) => {
     name: string2().describe("The canonicalized name that was removed. Returned even when the environment had no such variable.")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Deletes an existing variable value, while an already-absent variable is left absent.",
+      openWorldHint: "Changes private test configuration without submitting it to an external application.",
+      readOnlyHint: "Removes a named environment variable from QA Wolf storage."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: false,
@@ -18647,6 +18810,11 @@ var makeFindEnvironmentsContract = (ids) => {
     nextCursor: nextCursorSchema
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not edit environments, variables or branches.",
+      openWorldHint: "Reads private QA Wolf environment metadata without publishing changes.",
+      readOnlyHint: "Lists workspace environments and their configuration summaries."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -18675,6 +18843,11 @@ var makeGetEnvironmentVariableContract = (ids) => {
     })).describe("The found variables, sorted by name.")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not replace or remove variable values.",
+      openWorldHint: "Reads private stored configuration without submitting it to an external application.",
+      readOnlyHint: "Retrieves decrypted values of named environment variables and reports missing names."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -18696,6 +18869,11 @@ var makeGetEnvironmentContract = (ids) => {
   });
   const output = makeEnvironmentResourceSchema(ids);
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not alter environment settings or concurrency limits.",
+      openWorldHint: "Reads QA Wolf environment state without updating the connected Git provider.",
+      readOnlyHint: "Retrieves an environment's configuration, run health and code-reconciliation state."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -18717,6 +18895,11 @@ var makeListEnvironmentVariableNamesContract = (ids) => {
     variableNames: array(string2()).describe("Names of the environment's variables, sorted alphabetically. Values are never returned.")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not alter variables or expose their stored values.",
+      openWorldHint: "Reads private configuration names without changing external systems.",
+      readOnlyHint: "Lists available environment variable names without retrieving their values."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -18740,6 +18923,11 @@ var makeSetEnvironmentVariableContract = (ids) => {
     name: string2().describe("The stored variable name after whitespace is replaced with underscores and letters are uppercased.")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Can overwrite an existing variable value, while an unchanged value is skipped.",
+      openWorldHint: "Changes stored QA Wolf configuration rather than submitting forms or publishing content.",
+      readOnlyHint: "Creates or replaces a named environment variable without returning its value."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: false,
@@ -18767,6 +18955,11 @@ var makeUpdateEnvironmentContract = (ids) => {
   });
   const output = makeEnvironmentResourceSchema(ids);
   return {
+    annotationJustifications: {
+      destructiveHint: "Can overwrite existing environment settings and affect future run capacity.",
+      openWorldHint: "Changes private environment settings without publishing code or contacting application users.",
+      readOnlyHint: "Updates an environment's name or run concurrency limit."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: false,
@@ -18794,6 +18987,11 @@ var makeCreateTagContract = (ids) => {
   });
   const output = makeTagResourceSchema();
   return {
+    annotationJustifications: {
+      destructiveHint: "Creates a tag without deleting existing tags or flow associations.",
+      openWorldHint: "Adds private QA Wolf metadata without publishing to an external application.",
+      readOnlyHint: "Creates a workspace tag for grouping and selecting flows."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -18827,6 +19025,11 @@ var makeAddTagToFlowsContract = (ids) => {
     })
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Adds associations without removing existing tags.",
+      openWorldHint: "Changes private flow-tag associations without running flows or publishing code.",
+      readOnlyHint: "Adds an existing tag to selected flows and skips flows already carrying it."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -18881,6 +19084,11 @@ var makeListFlowsContract = (ids) => {
     }))
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not change flow code, readiness or tags.",
+      openWorldHint: "Reads flow records without pushing code or executing application actions.",
+      readOnlyHint: "Lists flows at an environment's reconciled commit or on a selected AI task branch."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -18907,6 +19115,11 @@ var makeRemoveTagFromFlowsContract = (ids) => {
     })
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Deletes existing tag associations and skips flows that do not carry the tag.",
+      openWorldHint: "Changes private flow-tag associations without updating external services.",
+      readOnlyHint: "Removes a selected tag from specified flows."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: false,
@@ -18936,6 +19149,11 @@ var makeUpdateFlowContract = (ids) => {
     })
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Overwrites readiness and can deactivate a flow that was active.",
+      openWorldHint: "Changes private readiness state without itself executing the flow or publishing code.",
+      readOnlyHint: "Changes a flow between draft and active readiness."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: false,
@@ -18958,6 +19176,7 @@ var issuePrioritySchema = _enum([
   "urgent"
 ]);
 var issueStatusSchema = _enum([
+  "backlog",
   "pending",
   "inProgress",
   "paused",
@@ -18966,7 +19185,12 @@ var issueStatusSchema = _enum([
   "archived"
 ]);
 var publicIssueTypeSchema = _enum(["bug", "coverageRequest", "maintenance"]);
-var openIssueStatuses = ["pending", "inProgress", "paused"];
+var openIssueStatuses = [
+  "backlog",
+  "pending",
+  "inProgress",
+  "paused"
+];
 var makeIssueResourceSchema = (ids) => resource({
   coveredFlowIds: array(ids.flow).describe("The flows a coverage request covers. Always empty on bug and maintenance reports, whose flows are listed under reproductions."),
   createdAt: exports_coerce.date().describe("When the issue was created."),
@@ -18988,7 +19212,7 @@ var makeIssueResourceSchema = (ids) => resource({
 var makeFindIssuesContract = (ids) => {
   const input = object({
     ...makePaginationInputFields({ defaultLimit: 20, maxLimit: 100 }),
-    statuses: array(issueStatusSchema).min(1).default([...openIssueStatuses]).describe("Issue statuses to include. Defaults to pending, in-progress, and paused issues."),
+    statuses: array(issueStatusSchema).min(1).default([...openIssueStatuses]).describe("Issue statuses to include. Defaults to backlog, pending, in-progress, and paused issues."),
     type: publicIssueTypeSchema.describe("The issue type to include: bug report, maintenance report, or coverage request."),
     workspaceId: ids.workspace.optional().describe("The workspace whose issues to list. Required when authenticating with an organization or user API key.")
   });
@@ -18997,6 +19221,11 @@ var makeFindIssuesContract = (ids) => {
     nextCursor: nextCursorSchema
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not edit issue details, statuses or coverage associations.",
+      openWorldHint: "Reads QA Wolf issue records without publishing updates to linked trackers.",
+      readOnlyHint: "Lists workspace bug reports, maintenance reports or coverage requests."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -19017,6 +19246,11 @@ var makeGetIssueContract = (ids) => {
     issue: makeIssueResourceSchema(ids)
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not modify or remove the issue.",
+      openWorldHint: "Reads the QA Wolf issue without changing linked external systems.",
+      readOnlyHint: "Retrieves one issue and its associated details."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -19086,9 +19320,18 @@ var makeGetInvestigationContract = (ids) => {
     findings: array(makeInvestigationFindingSchema(ids)),
     runId: ids.run,
     sessionId: ids.chatSession.optional().describe("The investigation session. Absent when the run has none."),
-    status: _enum(["investigating", "finished", "not-investigated"]).describe('Whether the investigation session is still working. "not-investigated" when the run has no investigation.')
+    status: _enum(["investigating", "finished", "not-investigated"]).describe('Whether the lead or any child investigator is still working. "not-investigated" when the run has no investigation.'),
+    subSessions: array(object({
+      sessionId: ids.chatSession,
+      status: agentSessionStatusSchema
+    })).optional().describe("All child investigators, including sessions not attached to findings yet. Send instructions to each sessionId with agent.send.")
   }, { urlFieldDescription: "The run in the QA Wolf app." });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not answer, dispute or change the investigation.",
+      openWorldHint: "Reads recorded QA Wolf findings without changing the application under test.",
+      readOnlyHint: "Retrieves an investigation's findings, open questions and pending answers."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -19117,6 +19360,11 @@ var makeAddFlowsToIssueContract = (ids) => {
     issue: makeIssueResourceSchema(ids)
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Adds coverage associations without removing existing ones.",
+      openWorldHint: "Changes private coverage associations without publishing an external issue update.",
+      readOnlyHint: "Adds existing flows to a coverage request's covered-flow set."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -19160,6 +19408,11 @@ var makeCreateIssueContract = (ids) => {
     issue: makeIssueResourceSchema(ids)
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Configured notifications can send irreversible messages even though the QA Wolf issue itself is new.",
+      openWorldHint: "Issue creation can send messages or synchronize records through connected communication and issue-tracking services.",
+      readOnlyHint: "Creates a bug or coverage request and can start configured issue notifications."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -19184,6 +19437,11 @@ var makeRemoveFlowsFromIssueContract = (ids) => {
     issue: makeIssueResourceSchema(ids)
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Deletes existing coverage associations while leaving already-unassociated flows unchanged.",
+      openWorldHint: "Changes private coverage associations without publishing to an external tracker.",
+      readOnlyHint: "Removes selected flows from a coverage request's covered-flow set."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -19214,6 +19472,11 @@ var makeUpdateIssueContract = (ids) => {
     issue: makeIssueResourceSchema(ids)
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Can overwrite existing issue fields or send irreversible integration messages.",
+      openWorldHint: "Issue changes can update connected issue trackers and communication services.",
+      readOnlyHint: "Updates issue details, priority or status and can trigger integration updates."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -19290,6 +19553,11 @@ var makeFindLegacyTriggersContract = (ids) => {
     legacyTriggers: array(makeLegacyTriggerSchema(ids)).describe("The workspace's legacy triggers, by name.")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not pause, resume or change any trigger.",
+      openWorldHint: "Reads private QA Wolf trigger configuration without starting external work.",
+      readOnlyHint: "Lists a workspace's legacy per-environment triggers."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -19314,6 +19582,11 @@ var makeLifecycleShape = (ids) => ({
 var makePauseLegacyTriggerContract = (ids) => {
   const { input, output } = makeLifecycleShape(ids);
   return {
+    annotationJustifications: {
+      destructiveHint: "Disables future automatic execution for the legacy trigger and its pull request copies until it is resumed.",
+      openWorldHint: "Changes private QA Wolf scheduling state without starting external work.",
+      readOnlyHint: "Pauses an existing legacy trigger so it stops starting new work."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: false,
@@ -19329,6 +19602,11 @@ var makePauseLegacyTriggerContract = (ids) => {
 var makeResumeLegacyTriggerContract = (ids) => {
   const { input, output } = makeLifecycleShape(ids);
   return {
+    annotationJustifications: {
+      destructiveHint: "Enables automatic test execution that can overwrite or delete application data.",
+      openWorldHint: "Resumed execution can change the application under test and update connected integrations.",
+      readOnlyHint: "Reactivates a legacy trigger and its pull request copies so future schedules or deployments can start runs."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -19379,6 +19657,11 @@ var makeAcceptScreenshotBaselineContract = (ids) => {
     })
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Replaces the workspace's screenshot baseline, which changes what every later run compares with.",
+      openWorldHint: "Changes private QA Wolf baseline storage without starting external work.",
+      readOnlyHint: "Makes the new screenshot of a failed comparison the baseline."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: false,
@@ -19403,6 +19686,11 @@ var makeDiagnoseRunContract = (ids) => {
     issue: makeIssueResourceSchema(ids)
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Can replace a flow's existing diagnosis association and change externally reported run information.",
+      openWorldHint: "Recorded diagnosis changes can update run-related messages in configured external integrations.",
+      readOnlyHint: "Records failed flows as reproductions of a selected bug or maintenance issue."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -19433,6 +19721,11 @@ var makeFindRunsContract = (ids) => {
     }, { urlFieldDescription: "Absolute URL of the run page." })).describe("The environment's runs, newest first. Per-flow results are available via run.get.")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not stop runs, overwrite results or change diagnoses.",
+      openWorldHint: "Reads private run records without executing application actions.",
+      readOnlyHint: "Lists recent environment runs without starting or retrying them."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -19494,6 +19787,7 @@ var makeGetRunContract = (ids) => {
     }),
     object({
       attemptId: ids.runAttempt.optional(),
+      canceledReason: string2().min(1).optional().describe("Why the attempt was canceled. userCanceled means a person stopped it; do not immediately retry that activity."),
       completedAt: exports_iso.datetime().optional(),
       kind: automatedKind,
       startedAt: exports_iso.datetime().optional(),
@@ -19530,6 +19824,11 @@ var makeGetRunContract = (ids) => {
     runId: ids.run.describe("The run this response describes. Treat it as canonical: it can differ from the id you asked for. A deploy notification returns a run id before the run exists, and if a second notification for the same commit is folded into an earlier run, that id resolves to the earlier run instead.")
   }, { urlFieldDescription: "Absolute URL of the run page." });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not retry, cancel or alter the run.",
+      openWorldHint: "Reads recorded QA Wolf results without changing the application under test.",
+      readOnlyHint: "Retrieves a run's status, per-flow results and result links."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -19607,6 +19906,11 @@ var makeGetRunAttemptArtifactsContract = (ids) => {
     })
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not retry, cancel or alter the run attempt.",
+      openWorldHint: "Reads recorded QA Wolf artifacts without changing the application under test.",
+      readOnlyHint: "Retrieves a finished attempt's metadata and signed artifact URLs."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -19631,6 +19935,11 @@ var makeOptOutOfInvestigationRunContract = (ids) => {
     runId: ids.run
   }, { urlFieldDescription: "Absolute URL of the run page." });
   return {
+    annotationJustifications: {
+      destructiveHint: "Ends the investigation of the selected failures and changes externally reported run information.",
+      openWorldHint: "Recorded opt-outs can update run-related messages in configured external integrations.",
+      readOnlyHint: "Records failed flows as needing no bug or maintenance report."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -19655,6 +19964,11 @@ var makeReattemptRunContract = (ids) => {
     runId: ids.run
   }, { urlFieldDescription: "Absolute URL of the run page." });
   return {
+    annotationJustifications: {
+      destructiveHint: "Repeated execution can overwrite or delete application data and creates additional billed work.",
+      openWorldHint: "New attempts execute against the application under test and can affect connected services.",
+      readOnlyHint: "Enqueues new attempts for eligible failed or canceled flows using the latest code."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -19694,6 +20008,11 @@ var makeRestoreScreenshotBaselineContract = (ids) => {
     })
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Replaces the current screenshot baseline with the one it replaced, which changes what every later run compares with.",
+      openWorldHint: "Changes private QA Wolf baseline storage without starting external work.",
+      readOnlyHint: "Puts back the screenshot baseline that an accepted comparison replaced."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: false,
@@ -19715,6 +20034,11 @@ var makeStopRunContract = (ids) => {
     status: _enum(["accepted", "already-finished", "execution-not-found"]).describe('"accepted" means stopping was requested; poll run.get for the final result. "already-finished" means the run has already finished and its result is unchanged. "execution-not-found" means the run exists but no execution was found to stop; it may still be starting or may no longer be available. No stop request was accepted in that case.')
   }, { urlFieldDescription: "Absolute URL of the run page." });
   return {
+    annotationJustifications: {
+      destructiveHint: "Interrupts unfinished work, while finished results remain intact and repeated stop requests are supported.",
+      openWorldHint: "Run status changes can update messages or commit statuses in configured external integrations.",
+      readOnlyHint: "Requests asynchronous cancellation of a run, queued flows and automatic retries."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -19753,6 +20077,11 @@ var makeEvaluateSnippetOnRunnerContract = (ids) => {
     ])
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Code can overwrite or delete runner or application data, and a timeout does not prove execution stopped.",
+      openWorldHint: "Supplied code can submit application actions or contact and change external services.",
+      readOnlyHint: "Executes supplied code against the interactive runner's current session."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -19786,6 +20115,11 @@ var makeGetRunnerContract = (ids) => {
     })
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not stop the runner or change its execution.",
+      openWorldHint: "Reads private runner placement state without acting on external applications.",
+      readOnlyHint: "Checks whether a runner exists without starting it or refreshing its inactivity timer."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -19829,6 +20163,11 @@ var makeHighlightSelectorOnRunnerContract = (ids) => {
     })
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Only replaces or clears the inspection overlay rather than deleting application data.",
+      openWorldHint: "Draws a private inspection overlay without submitting an application form.",
+      readOnlyHint: "Changes the visual selector highlight on the runner's live page."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -19862,6 +20201,11 @@ var makeImportPackageOnRunnerContract = (ids) => {
     })
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Can replace existing dependencies or execute commands that overwrite or delete runner or application data.",
+      openWorldHint: "Installation can contact external services and execute commands that change third-party systems.",
+      readOnlyHint: "Installs caller-selected dependencies into a live runner and can execute commands with the runner's access."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -19891,9 +20235,14 @@ var makeLaunchRunnerContract = (ids) => {
     outcome: literal("success")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Starts billable resource consumption that cannot be undone by later termination.",
+      openWorldHint: "Allocates a private QA Wolf runner without itself navigating to an application or submitting forms.",
+      readOnlyHint: "Starts an interactive runner and allocates billed resources unless the requested runner is already running."
+    },
     annotations: {
       destructiveHint: true,
-      openWorldHint: false,
+      openWorldHint: true,
       readOnlyHint: false
     },
     description: "Launch an interactive runner on the caller's team under an id the caller chooses. Send `initialUrl` so its browser comes up on the page the work starts from, which saves a separate navigation and the browser's cold start. Launching the same id again returns the runner already running rather than starting a second one, and the same id with a different runnerName is refused. A runner is not permanent: it terminates on its own after a period of inactivity, and launching the same id after that starts and bills a new runner, so read `alreadyRunning` to tell which happened. A success means the runner is answering: the call waits for the pod it started to come up, so the very next call to the runner reaches it. If the pod does not come up in time the call fails instead, leaving the runner running, and launching the same id again attaches to it.",
@@ -19914,6 +20263,11 @@ var makeTerminateRunnerContract = (ids) => {
     wasRunning: boolean2().describe("False when no running runner had this id: it was already terminated, was never launched, or terminated on its own after inactivity. These are not distinguished, because the run system keeps no record of a runner once it is gone. Not an error, and a retry needs no special handling.")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Terminates running work and discards the live session, while an absent runner is left absent.",
+      openWorldHint: "Stops a private QA Wolf runner without itself publishing to third-party services.",
+      readOnlyHint: "Ends a selected interactive runner and the resources hosting it."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: false,
@@ -19937,6 +20291,11 @@ var makeListRunnersContract = (ids) => {
     runners: array(makeRunnerSchema()).describe("The runners running right now, in no particular order. Each entry carries the same fields a launch reports, so any of them can be addressed like a runner you launched yourself.")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not interrupt or terminate any listed runner.",
+      openWorldHint: "Reads private runner state without acting on third-party applications.",
+      readOnlyHint: "Lists running workspace runners without starting them or refreshing their inactivity timers."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -19971,6 +20330,11 @@ var makePromoteSnapshotOnRunnerContract = (ids) => {
     })
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Overwrites an existing baseline, while a missing source snapshot leaves it unchanged.",
+      openWorldHint: "Updates a stored test baseline rather than publishing to an external application.",
+      readOnlyHint: "Replaces a named image-diff baseline with a screenshot produced by the runner."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: false,
@@ -19996,6 +20360,11 @@ var makeReadRunnerJournalContract = (ids) => {
     makeRunnerFailureSchema([runnerUnreachableFailureReason])
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not erase journal entries or change run results, although the activity refresh can extend billed runtime.",
+      openWorldHint: "Reads private runner history without submitting actions to external applications.",
+      readOnlyHint: "Retrieves journal entries and refreshes activity, which can cancel an inactivity shutdown."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -20074,6 +20443,11 @@ var makeRunFlowOnRunnerContract = (ids) => {
     failure
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Test code can overwrite or delete application data, and uncertain acceptance must be checked before resubmission.",
+      openWorldHint: "Executed tests can submit forms and change the application under test or its connected services.",
+      readOnlyHint: "Submits test files for full-flow or selected-line execution on an interactive runner."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: true,
@@ -20101,6 +20475,11 @@ var makeStopRunOnRunnerContract = (ids) => {
     makeRunnerFailureSchema([runnerUnreachableFailureReason])
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Stops unfinished work where it is, while an already-idle runner is left idle.",
+      openWorldHint: "Changes private execution state without itself posting external messages.",
+      readOnlyHint: "Interrupts current execution while leaving the runner available."
+    },
     annotations: {
       destructiveHint: true,
       openWorldHint: false,
@@ -20131,6 +20510,11 @@ var makeTakeScreenshotOnRunnerContract = (ids) => {
     ])
   ]);
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not change application data or stop execution, although the activity refresh can extend billed runtime.",
+      openWorldHint: "Reads the private runner display without submitting an external application action.",
+      readOnlyHint: "Captures the runner screen and refreshes activity, which can cancel an inactivity shutdown."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -20182,6 +20566,11 @@ var makeListSkillsContract = () => {
     skills: array(skillSummary).describe("Every skill the server serves, in catalog order.")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not change any skill or workspace data.",
+      openWorldHint: "Reads the QA Wolf skill catalog without calling external services.",
+      readOnlyHint: "Lists the QA Wolf skills with their names and descriptions."
+    },
     annotations: readOnlyAnnotations,
     description: "List the QA Wolf skills, each with its name and the description that says when to use it. A skill is the instructions a coding agent follows for one kind of QA Wolf work, such as onboarding an application, creating a flow, repairing a failing flow, or setting up triggers. Call this before any QA Wolf work, pick the skill whose description matches the request, and read it with skill.get.",
     input,
@@ -20200,6 +20589,11 @@ var makeGetSkillContract = () => {
     })).describe("The files the skill links to under its directory.")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not change any skill or workspace data.",
+      openWorldHint: "Reads the QA Wolf skill catalog without calling external services.",
+      readOnlyHint: "Retrieves one QA Wolf skill's instructions and reference files."
+    },
     annotations: readOnlyAnnotations,
     description: "Read a QA Wolf skill: the instructions a coding agent follows for one kind of QA Wolf work. The reply carries the skill's SKILL.md and every file under its references directory, so nothing else has to be fetched for it. Read the skill before starting the work it covers and follow it. A link in the reply of the form ../<skill>/SKILL.md names another skill, which this call reads by that name.",
     input,
@@ -20228,6 +20622,11 @@ var makeListTagsContract = (ids) => {
     })).describe("The team's tags, alphabetical by name.")
   });
   return {
+    annotationJustifications: {
+      destructiveHint: "Does not create, rename or remove tags.",
+      openWorldHint: "Reads private tag metadata without changing connected services.",
+      readOnlyHint: "Lists existing workspace tags by name."
+    },
     annotations: {
       destructiveHint: false,
       openWorldHint: false,
@@ -22820,7 +23219,7 @@ function startUpdateCheck(deps) {
 // package.json
 var package_default = {
   name: "@qawolf/cli",
-  version: "1.38.0",
+  version: "1.39.0",
   description: "Run and manage QA Wolf flows from the terminal, CI, or an AI agent",
   keywords: [
     "automation",
@@ -22891,7 +23290,7 @@ var package_default = {
     "@clack/prompts": "1.5.1",
     "@napi-rs/keyring": "1.3.0",
     "@oxc-node/core": "0.1.0",
-    "@qawolf/api-contracts": "0.77.0",
+    "@qawolf/api-contracts": "0.81.0",
     "@qawolf/emails": "1.1.1",
     "@qawolf/flow-targets": "1.0.0",
     "@qawolf/flows": "0.1.4",
@@ -36239,6 +36638,11 @@ function describeReason(step) {
         exitCode: exitCodes.invalidArgs,
         why: "has no touchscreen equivalent on a mobile runner."
       };
+    case "action-not-supported-on-browser":
+      return {
+        exitCode: exitCodes.invalidArgs,
+        why: "is a touchscreen action, which only a mobile runner performs."
+      };
     case "screen-needs-a-run":
       return {
         exitCode: exitCodes.invalidArgs,
@@ -36476,19 +36880,13 @@ function buildRunnerAction(type, flags) {
   };
   return parseRunnerAction(candidate);
 }
-function parseWith(schema, candidate) {
-  const parsed = schema.safeParse(candidate);
+function parseRunnerAction(candidate) {
+  const parsed = runnerActionSchema.safeParse(candidate);
   if (!parsed.success) {
     return { error: prettifyError(parsed.error), ok: false };
   }
   return { action: parsed.data, ok: true };
 }
-function parseRunnerAction(candidate) {
-  return parseWith(runnerActionSchema, candidate);
-}
-function parseBrowserAction(candidate) {
-  return parseWith(browserActionSchema, candidate);
-}
 
 // src/domains/interactiveRunner/readActions.ts
 var stdinArgument = "-";
@@ -36508,7 +36906,7 @@ async function readActions(argument, deps) {
       ok: false
     };
   }
-  const built = parsed.items.map(parseBrowserAction);
+  const built = parsed.items.map(parseRunnerAction);
   const firstRefused = built.findIndex((action) => !action.ok);
   const refused = built[firstRefused];
   if (refused !== undefined && !refused.ok) {
@@ -37030,7 +37428,11 @@ Examples:
   $ qawolf runner actions '[{"type":"click","button":"left","x":480,"y":260},{"type":"type","text":"hello@example.com"},{"type":"keypress","keys":["Enter"]}]' --screenshot after-login.jpg
   $ echo '[{"type":"click","button":"left","x":1,"y":2},{"type":"type","text":"hi"}]' | qawolf runner actions -
   $ qawolf runner actions '[{"type":"click","button":"left","x":480,"y":260},{"type":"type","text":"hello"}]' --screenshot-mode each --screenshot step.jpg
-  $ qawolf runner actions '[{"type":"scroll","x":480,"y":260,"scroll_x":0,"scroll_y":600},{"type":"click","button":"left","x":120,"y":700}]' --continue-on-failure`;
+  $ qawolf runner actions '[{"type":"scroll","x":480,"y":260,"scroll_x":0,"scroll_y":600},{"type":"click","button":"left","x":120,"y":700}]' --continue-on-failure
+
+Mobile:
+  $ qawolf runner actions '[{"type":"tap","selector":"//*[@content-desc=\\"Email\\"]"},{"type":"type","text":"hello@example.com"},{"type":"tap","x":540,"y":1650}]' --screenshot after-login.jpg
+  $ qawolf runner actions '[{"type":"fill","selector":"name == \\"Postal code\\"","strategy":"ios-predicate","text":"94107"},{"type":"swipe","from":{"x":540,"y":1600},"to":{"x":540,"y":600}}]'`;
 function registerRunnerActionsCommand(runner, signals) {
   declareCommandKind(runner.command("actions <sequence>"), "write").description("Perform a sequence of up to ten raw actions on a runner's screen in one request, as a JSON array of the same actions `runner act` takes. Use - to read the array from stdin. Actions run back to back, so batch only steps whose targets are on the screen you last saw, and end the sequence at the step that changes the page. Each result carries an effect: performed, not-performed, or unknown when the runner stopped answering and the action may have landed").option("--continue-on-failure", "Carry on past an action that reached the runner and did not take effect; a runner that cannot be reached or a screen that cannot serve still ends the sequence").option("--runner <id>", runnerFlagDescription).option("--screenshot <path>", "Save a JPEG of the screen after the last action to this file. With --screenshot-mode each, one file per action, with the action's index before the extension. - writes the final frame to stdout and moves the confirmation to stderr").addOption(new Option2("--screenshot-mode <mode>", "Defaults to final when --screenshot is given, none otherwise").choices([...screenshotModes])).addHelpText("after", actionsExamples).action((sequence, opts, command) => withAuthContext(signals, (ctx) => handleRunnerActions(ctx, {
     actions: sequence,
@@ -39142,4 +39544,4 @@ createProgram({ signals }).parseAsync().catch(() => {
     process.exitCode = 1;
 }).finally(() => exitWhenIdle(typeof process.exitCode === "number" ? process.exitCode : 0));
 
-//# debugId=4535AB8728B9D01A64756E2164756E21
+//# debugId=1A1CE11EA6A4398C64756E2164756E21