@sun-asterisk/sungen 3.2.29 → 3.2.30

package/dist/orchestrator/templates/specs-url-assert.ts

@@ -2,7 +2,8 @@
 /**
  * Sungen URL assertion helper — auto-generated into specs/url-assert.ts. DO NOT EDIT.
  *
- * Every Then-side URL assertion (`see [X] page`, `is on [X] page`) compiles to one call here.
+ * Every URL step compiles to one call here: the Then-side assertions (`see [X] page`,
+ * `is on [X] page`) to `expectPage`, and `wait for [X] page` to `waitForPage`.
  *
  * Why a helper and not an inline predicate. The predicate used to be emitted inline into every
  * spec, so each correction to what "the URL matches" MEANS was a breaking change for every
@@ -28,6 +29,16 @@ export interface UrlExpectation {
    * against a full URL.
    */
   pathname: RegExp;
+  /**
+   * Anchored hostname pattern, emitted ONLY when the page selector's `value` is an ABSOLUTE URL
+   * (`https://app.example.com/reception/:id`) — a destination on a different host from the suite's
+   * baseURL. Absent means "whatever host we are on", which is what a relative page value says.
+   *
+   * It is a SEPARATE field rather than part of `pathname` because the two are read off different
+   * properties of the parsed URL: `u.hostname` never appears in `u.pathname`. One concatenated
+   * regex only worked while the match ran unanchored over the whole URL string (#677).
+   */
+  hostname?: RegExp;
   /**
    * The `with {{v}}` value, raw from test-data: '?q=1' · '/vi/search?q=1' · '#tab' · ''.
    * `undefined` means the step declared nothing, which is itself an assertion — see below.
@@ -83,6 +94,15 @@ function decodedPath(pathname: string): string {
   }
 }
 
+/**
+ * Is the URL at the expected LOCATION — right host, right path? The half every URL step shares.
+ * The Then-side assertion goes on to judge the query; the wait stops here (see `waitForPage`).
+ */
+function locationMatches(pathname: RegExp, hostname: RegExp | undefined, u: URL): boolean {
+  if (hostname && !hostname.test(u.hostname)) return false;
+  return pathname.test(u.pathname) || pathname.test(decodedPath(u.pathname));
+}
+
 /**
  * Build the predicate for `expect(page).toHaveURL(...)`.
  *
@@ -94,9 +114,9 @@ function decodedPath(pathname: string): string {
  *                      A declared fragment is asserted too; a declared value carrying no query
  *                      at all constrains the path only (the compiler warns: SG-W014).
  */
-export function urlMatches({ pathname, declared, dataRef }: UrlExpectation): (u: URL) => boolean {
+export function urlMatches({ pathname, hostname, declared, dataRef }: UrlExpectation): (u: URL) => boolean {
   return (u: URL): boolean => {
-    if (!pathname.test(u.pathname) && !pathname.test(decodedPath(u.pathname))) return false;
+    if (!locationMatches(pathname, hostname, u)) return false;
 
     // `dataRef`, not `declared`, decides which rule applies. Both "the step declared nothing" and
     // "the step declared {{v}} but the key resolved to nothing at runtime" arrive here as
@@ -135,38 +155,43 @@ export function urlMatches({ pathname, declared, dataRef }: UrlExpectation): (u:
   };
 }
 
+/** What `settleAndHold` needs of a page — Playwright's `Page` satisfies it; so does a test fake. */
+type SettleablePage = {
+  url(): string;
+  waitForLoadState(state: 'networkidle', opts?: { timeout?: number }): Promise<void>;
+};
+
+/** The two runtime knobs, shared by both URL steps. */
+interface SettleOpts { settleMs?: number; networkIdleMs?: number }
+
 /**
- * `toHaveURL` is a polling assertion: it passes on the FIRST sample that matches. A client-side
- * router pushes the destination URL before the route guard or the API has answered, so a user
- * with no permission is "on" `/items/detail` for a few hundred milliseconds — long enough for
- * the assertion to sample it, pass, and end the test green — and is then bounced to `/forbidden`
- * with no assertion left to see it. A real project shipped a permission matrix on that oracle;
- * the 403s were found by hand (#662).
+ * A URL that MATCHES is not a page the user is still on. A client-side router pushes the
+ * destination URL before the route guard or the API has answered, so a user with no permission is
+ * "on" `/items/detail` for a few hundred milliseconds — long enough for a polling assertion to
+ * sample it and pass, or for a `waitForURL` to resolve — and is then bounced to `/forbidden` with
+ * nothing left watching. A real project shipped a permission matrix on that oracle; the 403s were
+ * found by hand (#662).
  *
- * `expectPage` is the page oracle `see [X] page` compiles to now. Arriving is not enough: the URL
- * has to be STILL matching once the page has settled.
- *   1. arrive   — the same predicate `toHaveURL` always used;
- *   2. settle   — wait for network to go quiet (bounded: an app that polls forever must not hang
- *                 the test, so a timeout here is not a failure);
- *   3. hold     — sample the URL over a settle window; the moment it stops matching, fail and
- *                 NAME where it went, because that destination is the finding;
- *   4. re-assert — the arrival predicate, once more, on the settled page.
+ * So both URL steps go through this: having arrived,
+ *   1. settle    — wait for network to go quiet (bounded: an app that polls forever must not hang
+ *                  the test, so a timeout here is not a failure);
+ *   2. hold      — sample the URL over a settle window; the moment it stops matching, fail and
+ *                  NAME where it went, because that destination is the finding.
+ * The caller decides what arriving meant and what to do afterwards.
  *
  * `SUNGEN_URL_SETTLE_MS` (default 1000) is the hold window; `SUNGEN_URL_NETWORKIDLE_MS` (default
- * 3000) bounds step 2. Both are runtime knobs, so a slow environment is a config change, not a
+ * 3000) bounds step 1. Both are runtime knobs, so a slow environment is a config change, not a
  * regenerate.
  */
-export async function expectPage(
-  page: { url(): string; waitForLoadState(state: 'networkidle', opts?: { timeout?: number }): Promise<void> },
-  expectation: UrlExpectation,
-  opts: { settleMs?: number; networkIdleMs?: number; assertUrl?: (matches: (u: URL) => boolean) => Promise<void> } = {},
+async function settleAndHold(
+  page: SettleablePage,
+  matches: (u: URL) => boolean,
+  opts: SettleOpts,
+  label: string,
+  consequence: string,
 ): Promise<void> {
   const settleMs = opts.settleMs ?? Number(process.env.SUNGEN_URL_SETTLE_MS ?? 1000);
   const networkIdleMs = opts.networkIdleMs ?? Number(process.env.SUNGEN_URL_NETWORKIDLE_MS ?? 3000);
-  const matches = urlMatches(expectation);
-  const assertUrl = opts.assertUrl ?? (async (m: (u: URL) => boolean) => { await expect(page as unknown as Page).toHaveURL(m); });
-
-  await assertUrl(matches);
   const arrivedAt = page.url();
 
   await page.waitForLoadState('networkidle', { timeout: networkIdleMs }).catch(() => undefined);
@@ -176,13 +201,61 @@ export async function expectPage(
     const now = page.url();
     if (!matches(new URL(now))) {
       throw new Error(
-        `page assertion: reached ${arrivedAt} and then left for ${now} after ${Date.now() - started}ms — `
+        `${label}: reached ${arrivedAt} and then left for ${now} after ${Date.now() - started}ms — `
         + 'a route guard, an error boundary or a redirect moved the user away after the URL had already '
-        + 'matched. The page the test asserted is not the page the user ended on.',
+        + `matched. ${consequence}`,
       );
     }
     await new Promise((r) => setTimeout(r, 50));
   }
+}
+
+/**
+ * `expectPage` is the page oracle `see [X] page` / `is on [X] page` compile to. Arriving is not
+ * enough: the URL has to be STILL matching once the page has settled.
+ *   1. arrive    — the same predicate `toHaveURL` always used;
+ *   2. settle + hold — see `settleAndHold`;
+ *   3. re-assert — the arrival predicate, once more, on the settled page.
+ */
+export async function expectPage(
+  page: SettleablePage,
+  expectation: UrlExpectation,
+  opts: SettleOpts & { assertUrl?: (matches: (u: URL) => boolean) => Promise<void> } = {},
+): Promise<void> {
+  const matches = urlMatches(expectation);
+  const assertUrl = opts.assertUrl ?? (async (m: (u: URL) => boolean) => { await expect(page as unknown as Page).toHaveURL(m); });
 
   await assertUrl(matches);
+  await settleAndHold(page, matches, opts, 'page assertion',
+    'The page the test asserted is not the page the user ended on.');
+  await assertUrl(matches);
+}
+
+/**
+ * `waitForPage` is what `When User wait for [X] page` compiles to (#677).
+ *
+ * A bare `page.waitForURL(/…/)` resolves on the first URL sample that matches — the transient URL
+ * the router pushed before its guard decided. The wait then returned, and every step AFTER it ran
+ * against a page mid-redirect, so their failures pointed at the wrong thing. It was also the third
+ * hand-rolled copy of "does this URL match", drifting from the pair #662 consolidated here.
+ *
+ * Where this deliberately DIFFERS from `expectPage`: the query is not constrained. A Then-side page
+ * assertion is an oracle, so a bare page must be bare — `/vi/search` fails on `/vi/search?x=1`. A
+ * wait is not an oracle: `wait for [Results] page` after submitting a search legitimately lands on
+ * `/results?q=abc`, and reddening there would assert something the step never said. Prove the query
+ * with the `Then User see [Results] page with {{v}}` that follows.
+ */
+export async function waitForPage(
+  page: SettleablePage & { waitForURL(url: (u: URL) => boolean, opts?: { timeout?: number }): Promise<void> },
+  expectation: UrlExpectation,
+  opts: SettleOpts & { timeout?: number; waitUrl?: (matches: (u: URL) => boolean) => Promise<void> } = {},
+): Promise<void> {
+  const { pathname, hostname } = expectation;
+  const matches = (u: URL): boolean => locationMatches(pathname, hostname, u);
+  // Playwright's own navigation timeout governs the arrival; only the hold is sungen's.
+  const arrive = opts.waitUrl ?? (async (m: (u: URL) => boolean) => { await page.waitForURL(m, { timeout: opts.timeout }); });
+
+  await arrive(matches);
+  await settleAndHold(page, matches, opts, 'page wait',
+    'The steps after this wait would have run against a page the user is already being moved off.');
 }

package/dist/utils/selector-types.d.ts

@@ -1,7 +1,49 @@
 /**
  * Valid selector types used across scaffold generator, selector resolver, and validator.
  * Single source of truth — import this instead of hardcoding.
+ *
+ * The list is partitioned deliberately. A type is either a LOCATOR STRATEGY (the resolver's
+ * strategy switch turns it into a Playwright/WDIO locator) or a NON-STRATEGY declaration (the
+ * entry describes something other than how to find an element, and a reader downstream of the
+ * resolver consumes it). A type that is in neither set but is still accepted as valid is drift:
+ * it reaches the switch's `default:` and resolves as `getByPlaceholder('<whatever value held>')`,
+ * a selector that cannot match. `upload` sat in exactly that gap — valid, documented, and
+ * silently mis-resolved (issue #690).
+ *
+ * Keep the partition total. `tests/codegen/selector-type-dispatch.run.ts` fails if a new member
+ * of VALID_SELECTOR_TYPES is classified into neither half, or if a strategy type stops being
+ * dispatched and starts resolving as a placeholder.
  */
-export declare const VALID_SELECTOR_TYPES: readonly ["placeholder", "role", "testid", "label", "text", "page", "column", "locator", "id", "upload", "frame", "table", "accessibility-id", "xpath", "android-uiautomator", "ios-predicate", "css"];
+/**
+ * Types the resolver turns into a locator. Every member MUST be dispatched in
+ * `SelectorResolver.resolveFromEntry` — either by a `case` in its strategy switch or by an
+ * early return above it (`locator` and `upload` share one). The contract is on the RESOLVED
+ * STRATEGY, not on the syntax used to produce it.
+ */
+export declare const STRATEGY_SELECTOR_TYPES: readonly ["placeholder", "role", "testid", "label", "text", "locator", "id", "upload", "accessibility-id", "xpath", "android-uiautomator", "ios-predicate", "css"];
+/**
+ * Types that declare something OTHER than a locator strategy, so they have no `case` by design.
+ * Each is read after resolution via `ResolvedSelector.selectorType`, or by the pattern that owns
+ * the step, which reads the entry's fields directly:
+ *
+ *   page   — `value` is a URL path, not a locator. The page assertion reads `selectorType`
+ *            AFTER resolving (see StepMapper.checkPageStepFallback), so this type must
+ *            pass through the switch rather than throw.
+ *   table  — the table patterns read `columns` (StepMapper's column-index lookup), `rows` (the
+ *            row templates, backed by SG-W016) and `pagination` (the paginate step, #712) off
+ *            the entry. `pagination` was the NOTE that used to sit here: documented, plumbed,
+ *            and read by nothing — the same drift shape as #690, one level down. It has a
+ *            consumer now, and SG-W004 is the gate that makes the next such field fail a check
+ *            rather than wait to be grepped.
+ *   column — addressed through its table's `columns` map, never resolved standalone.
+ *   frame  — consumed by the frame-enter/exit steps, which need the raw iframe selector.
+ *
+ * Reaching the strategy switch is legitimate for these; the placeholder fallback there is inert
+ * because no consumer reads `strategy` for them.
+ */
+export declare const NON_STRATEGY_SELECTOR_TYPES: readonly ["page", "column", "frame", "table"];
+export declare const VALID_SELECTOR_TYPES: readonly ["placeholder", "role", "testid", "label", "text", "locator", "id", "upload", "accessibility-id", "xpath", "android-uiautomator", "ios-predicate", "css", "page", "column", "frame", "table"];
+export type StrategySelectorType = (typeof STRATEGY_SELECTOR_TYPES)[number];
+export type NonStrategySelectorType = (typeof NON_STRATEGY_SELECTOR_TYPES)[number];
 export type SelectorType = (typeof VALID_SELECTOR_TYPES)[number];
 //# sourceMappingURL=selector-types.d.ts.map

package/dist/utils/selector-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"selector-types.d.ts","sourceRoot":"","sources":["../../src/utils/selector-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,eAAO,MAAM,oBAAoB,wMAmBvB,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC"}
+{"version":3,"file":"selector-types.d.ts","sourceRoot":"","sources":["../../src/utils/selector-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,oKAe1B,CAAC;AAEX;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,2BAA2B,+CAK9B,CAAC;AAEX,eAAO,MAAM,oBAAoB,wMAGvB,CAAC;AAEX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAC5E,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,CAAC,CAAC;AACnF,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC"}

package/dist/utils/selector-types.js

@@ -1,23 +1,37 @@
 "use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.VALID_SELECTOR_TYPES = void 0;
 /**
  * Valid selector types used across scaffold generator, selector resolver, and validator.
  * Single source of truth — import this instead of hardcoding.
+ *
+ * The list is partitioned deliberately. A type is either a LOCATOR STRATEGY (the resolver's
+ * strategy switch turns it into a Playwright/WDIO locator) or a NON-STRATEGY declaration (the
+ * entry describes something other than how to find an element, and a reader downstream of the
+ * resolver consumes it). A type that is in neither set but is still accepted as valid is drift:
+ * it reaches the switch's `default:` and resolves as `getByPlaceholder('<whatever value held>')`,
+ * a selector that cannot match. `upload` sat in exactly that gap — valid, documented, and
+ * silently mis-resolved (issue #690).
+ *
+ * Keep the partition total. `tests/codegen/selector-type-dispatch.run.ts` fails if a new member
+ * of VALID_SELECTOR_TYPES is classified into neither half, or if a strategy type stops being
+ * dispatched and starts resolving as a placeholder.
  */
-exports.VALID_SELECTOR_TYPES = [
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VALID_SELECTOR_TYPES = exports.NON_STRATEGY_SELECTOR_TYPES = exports.STRATEGY_SELECTOR_TYPES = void 0;
+/**
+ * Types the resolver turns into a locator. Every member MUST be dispatched in
+ * `SelectorResolver.resolveFromEntry` — either by a `case` in its strategy switch or by an
+ * early return above it (`locator` and `upload` share one). The contract is on the RESOLVED
+ * STRATEGY, not on the syntax used to produce it.
+ */
+exports.STRATEGY_SELECTOR_TYPES = [
     'placeholder',
     'role',
     'testid',
     'label',
     'text',
-    'page',
-    'column',
     'locator',
     'id',
     'upload',
-    'frame',
-    'table',
     // === Mobile (Appium) strategies — resolved by the appium adapter (MOB-3) ===
     'accessibility-id', // cross-platform — Android content-desc / iOS accessibilityIdentifier
     'xpath', // cross-platform, last resort
@@ -25,4 +39,34 @@ exports.VALID_SELECTOR_TYPES = [
     'ios-predicate', // iOS only — NSPredicate strings
     'css', // hybrid WebView only — CSS inside a WEBVIEW context (after `switch to [X] frame`)
 ];
+/**
+ * Types that declare something OTHER than a locator strategy, so they have no `case` by design.
+ * Each is read after resolution via `ResolvedSelector.selectorType`, or by the pattern that owns
+ * the step, which reads the entry's fields directly:
+ *
+ *   page   — `value` is a URL path, not a locator. The page assertion reads `selectorType`
+ *            AFTER resolving (see StepMapper.checkPageStepFallback), so this type must
+ *            pass through the switch rather than throw.
+ *   table  — the table patterns read `columns` (StepMapper's column-index lookup), `rows` (the
+ *            row templates, backed by SG-W016) and `pagination` (the paginate step, #712) off
+ *            the entry. `pagination` was the NOTE that used to sit here: documented, plumbed,
+ *            and read by nothing — the same drift shape as #690, one level down. It has a
+ *            consumer now, and SG-W004 is the gate that makes the next such field fail a check
+ *            rather than wait to be grepped.
+ *   column — addressed through its table's `columns` map, never resolved standalone.
+ *   frame  — consumed by the frame-enter/exit steps, which need the raw iframe selector.
+ *
+ * Reaching the strategy switch is legitimate for these; the placeholder fallback there is inert
+ * because no consumer reads `strategy` for them.
+ */
+exports.NON_STRATEGY_SELECTOR_TYPES = [
+    'page',
+    'column',
+    'frame',
+    'table',
+];
+exports.VALID_SELECTOR_TYPES = [
+    ...exports.STRATEGY_SELECTOR_TYPES,
+    ...exports.NON_STRATEGY_SELECTOR_TYPES,
+];
 //# sourceMappingURL=selector-types.js.map

package/dist/utils/selector-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"selector-types.js","sourceRoot":"","sources":["../../src/utils/selector-types.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACU,QAAA,oBAAoB,GAAG;IAClC,aAAa;IACb,MAAM;IACN,QAAQ;IACR,OAAO;IACP,MAAM;IACN,MAAM;IACN,QAAQ;IACR,SAAS;IACT,IAAI;IACJ,QAAQ;IACR,OAAO;IACP,OAAO;IACP,8EAA8E;IAC9E,kBAAkB,EAAK,sEAAsE;IAC7F,OAAO,EAAgB,8BAA8B;IACrD,qBAAqB,EAAE,wCAAwC;IAC/D,eAAe,EAAQ,iCAAiC;IACxD,KAAK,EAAkB,mFAAmF;CAClG,CAAC"}
+{"version":3,"file":"selector-types.js","sourceRoot":"","sources":["../../src/utils/selector-types.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAEH;;;;;GAKG;AACU,QAAA,uBAAuB,GAAG;IACrC,aAAa;IACb,MAAM;IACN,QAAQ;IACR,OAAO;IACP,MAAM;IACN,SAAS;IACT,IAAI;IACJ,QAAQ;IACR,8EAA8E;IAC9E,kBAAkB,EAAK,sEAAsE;IAC7F,OAAO,EAAgB,8BAA8B;IACrD,qBAAqB,EAAE,wCAAwC;IAC/D,eAAe,EAAQ,iCAAiC;IACxD,KAAK,EAAkB,mFAAmF;CAClG,CAAC;AAEX;;;;;;;;;;;;;;;;;;;GAmBG;AACU,QAAA,2BAA2B,GAAG;IACzC,MAAM;IACN,QAAQ;IACR,OAAO;IACP,OAAO;CACC,CAAC;AAEE,QAAA,oBAAoB,GAAG;IAClC,GAAG,+BAAuB;IAC1B,GAAG,mCAA2B;CACtB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sun-asterisk/sungen",
-  "version": "3.2.29",
+  "version": "3.2.30",
   "description": "Deterministic E2E Test Compiler - Gherkin + Selectors → Playwright tests",
   "main": "src/index.ts",
   "types": "src/index.ts",
@@ -40,8 +40,8 @@
     "@babel/types": "^7.28.5",
     "@cucumber/gherkin": "^37.0.0",
     "@cucumber/messages": "^31.0.0",
-    "@sungen/driver-data-factory": "3.2.29",
-    "@sungen/driver-ui": "3.2.29",
+    "@sungen/driver-data-factory": "3.2.30",
+    "@sungen/driver-ui": "3.2.30",
     "chalk": "^5.6.2",
     "commander": "^14.0.2",
     "dotenv": "^17.2.3",

package/src/cli/commands/delivery.ts

@@ -39,6 +39,7 @@ import {
   hasReview,
 } from '../../exporters/matrix/export';
 import { MatrixFinding } from '../../exporters/matrix/types';
+import { formatTestOutcome, resultTotals } from '../../exporters/matrix/result-totals';
 
 const COLOR = {
   reset: '\x1b[0m',
@@ -703,7 +704,7 @@ async function exportMatrixTarget(
     return null;
   }
 
-  log(`${COLOR.bold}${paths.label}${COLOR.reset} — ${model.manifest.itemCount} delivery item(s), ${model.manifest.variantCount} coverage variant(s), state: ${model.manifest.approvalState}`);
+  log(`${COLOR.bold}${paths.label}${COLOR.reset} — ${model.manifest.itemCount} delivery item(s), ${model.manifest.variantCount} coverage variant(s), review: ${model.manifest.approvalState} (design), test outcome: ${formatTestOutcome(resultTotals(model.items))}`);
   {
     const mocked = model.items.flatMap((it) => it.variants.filter((v) => v.mocked));
     if (mocked.length > 0) {

package/src/cli/commands/generate.ts

@@ -238,8 +238,11 @@ export function registerGenerateCommand(program: Command): void {
         const advisorySensors = capabilityRegistry.sensors('advisory');
         const ddWarnings = scanDirs.flatMap((d) => advisorySensors.flatMap((s) => s.run({ dir: d, cwd })));
         if (ddWarnings.length) {
-          console.log(`\n⚠️  Data-driven lint (@cases / @query) — review:`);
-          for (const w of ddWarnings.slice(0, 20)) console.log(`   ${w.scenario ? w.scenario + ': ' : ''}${w.message}`);
+          console.log(`\n⚠️  Data-driven lint (@cases / @query / dead test-data) — advisory, review:`);
+          const verbose = !!program.opts().verbose;
+          const shown = verbose ? ddWarnings : ddWarnings.slice(0, 20);
+          for (const w of shown) console.log(`   ${w.scenario ? w.scenario + ': ' : ''}${w.message}`);
+          if (shown.length < ddWarnings.length) console.log(`   … and ${ddWarnings.length - shown.length} more (run with -v to list all)`);
         }
 
         const nextStep = platform === 'mobile' ? 'npm run test:mobile' : 'npx playwright test --ui';

package/src/cli/commands/inspect.ts

@@ -63,7 +63,7 @@ export function inspectProject(cwd: string): ProjectInspection {
     const perfPass = model.perf ? model.perf.pass : null;
 
     const reasons: string[] = [];
-    if (!approved) reasons.push('delivery map not approved');
+    if (!approved) reasons.push('delivery map not approved (design review state — not a test outcome)');
     if (!frozen) reasons.push('sources drifted since approval (not frozen — Gate E)');
     if (failed.length) reasons.push(`${failed.length} golden variant(s) FAILED`);
     if (pending.length) reasons.push(`${pending.length} golden variant(s) have no run result`);

package/src/cli/commands/results-merge.ts

@@ -9,6 +9,8 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { Command } from 'commander';
 import { mergeResultsReports, findGhostTitles } from '../../exporters/results-merge';
+import { detectReportRoot, sanitizeReportPaths } from '../../exporters/report-path-sanitizer';
+import { registerResultsSanitizeCommand } from './results-sanitize';
 import { resolveResultsPath } from '../../exporters/playwright-report-parser';
 import { parseSpecFile } from '../../exporters/spec-parser';
 
@@ -95,8 +97,12 @@ export function runResultsMerge(baseArg: string | undefined, newArg: string | un
     throw new Error('results merge: expected <base.json> <new.json>, or --screen <name> <new.json>.');
   }
 
-  const base = readReport(baseFile, 'base');
-  const fresh = readReport(newFile, 'new');
+  // Each report relativizes against ITS OWN root before the merge: `config` is copied from the base
+  // wholesale, so a base produced on another machine would otherwise carry that machine's paths
+  // into the merged file for good.
+  const sanitize = (doc: any): any => sanitizeReportPaths(doc, { root: detectReportRoot(doc) ?? cwd }).doc;
+  const base = sanitize(readReport(baseFile, 'base'));
+  const fresh = sanitize(readReport(newFile, 'new'));
   const { merged, replaced, added, kept } = mergeResultsReports(base, fresh);
 
   if (specTitles) {
@@ -136,6 +142,7 @@ export function registerResultsCommand(program: Command): void {
   const results = program
     .command('results')
     .description('Operate on per-target Playwright result files');
+  registerResultsSanitizeCommand(results);
 
   results
     .command('merge [base] [new]')

package/src/cli/commands/results-sanitize.ts

@@ -0,0 +1,98 @@
+/**
+ * `sungen results sanitize [files…]` — rewrite the operator's machine paths out of result/report JSON.
+ *
+ * Playwright's JSON reporter and sungen's own reports record absolute paths, and teams commit those
+ * files next to the spec (delivery reads them). The reporter registered in `playwright.config.ts`
+ * sanitizes a fresh run's report on exit; this command is the safety net that reaches every file a
+ * project already has — and every project whose config predates the reporter. Idempotent: a clean
+ * file is left untouched (no rewrite, no timestamp churn).
+ *
+ * Each report relativizes against ITS OWN root (`dirname(config.configFile)` when it carries one), so
+ * a file produced on another machine comes out right too; a report that does not say falls back to
+ * the working directory.
+ */
+import { Command } from 'commander';
+import * as fs from 'fs';
+import * as path from 'path';
+import fg from 'fast-glob';
+import { detectReportRoot, sanitizeReportPaths } from '../../exporters/report-path-sanitizer';
+
+/** Where a project keeps the JSON files that carry paths. */
+export const DEFAULT_REPORT_GLOBS = [
+  'specs/generated/**/*-test-result*.json',
+  'test-result.json',
+  '*-test-result*.json',
+  '.sungen/reports/*-script-check.json', // the one sungen report that records a path (`specPath`)
+];
+
+export interface SanitizedFile {
+  file: string;      // relative to cwd
+  rewritten: number; // string values changed (0 = already clean)
+}
+
+/** Sanitize the given files (or the project's default report locations). Returns one row per file. */
+export function runResultsSanitize(files: string[] | undefined, cwd: string = process.cwd()): SanitizedFile[] {
+  const targets = files && files.length
+    ? files.map((f) => path.resolve(cwd, f))
+    : fg.sync(DEFAULT_REPORT_GLOBS, { cwd, absolute: true, onlyFiles: true, dot: true });
+  const out: SanitizedFile[] = [];
+  for (const file of targets.sort()) {
+    const raw = fs.readFileSync(file, 'utf-8');
+    let doc: unknown;
+    try {
+      doc = JSON.parse(raw);
+    } catch (err) {
+      throw new Error(`results sanitize: ${path.relative(cwd, file)} is not JSON (${err instanceof Error ? err.message : String(err)})`);
+    }
+    // A report that does not describe its root belongs to the project it sits in — the nearest
+    // ancestor holding a playwright.config.ts or .sungen/ — not to wherever the command was run from
+    // (a monorepo root would otherwise turn `specs/generated/x/x.spec.ts` into a bare basename).
+    const root = detectReportRoot(doc) ?? nearestProjectRoot(path.dirname(file)) ?? cwd;
+    const { doc: clean, rewritten } = sanitizeReportPaths(doc, { root });
+    if (rewritten > 0) {
+      // Atomic write, same as `results merge`: a crash mid-write must never leave a truncated report.
+      const tmp = `${file}.tmp-${process.pid}`;
+      try {
+        fs.writeFileSync(tmp, JSON.stringify(clean, null, 2) + (raw.endsWith('\n') ? '\n' : ''));
+        fs.renameSync(tmp, file);
+      } catch (err) {
+        try { fs.rmSync(tmp, { force: true }); } catch { /* best-effort cleanup */ }
+        throw err;
+      }
+    }
+    out.push({ file: path.relative(cwd, file), rewritten });
+  }
+  return out;
+}
+
+export function registerResultsSanitizeCommand(results: Command): void {
+  results
+    .command('sanitize [files...]')
+    .description('Rewrite absolute machine paths in result/report JSON to project-relative ones (default: every *-test-result*.json under specs/generated and .sungen/reports/*.json)')
+    .action((files: string[]) => {
+      try {
+        const rows = runResultsSanitize(files.length ? files : undefined);
+        if (rows.length === 0) {
+          console.log('results sanitize: no report files found.');
+          return;
+        }
+        const changed = rows.filter((r) => r.rewritten > 0);
+        for (const r of changed) console.log(`✓ ${r.file} — ${r.rewritten} path(s) made project-relative`);
+        console.log(`results sanitize: ${changed.length} of ${rows.length} file(s) rewritten${changed.length === 0 ? ' (all already clean)' : ''}.`);
+      } catch (err) {
+        console.error(err instanceof Error ? err.message : String(err));
+        process.exitCode = 1;
+      }
+    });
+}
+
+/** Nearest ancestor directory that looks like a sungen/Playwright project root. */
+function nearestProjectRoot(from: string): string | undefined {
+  let dir = from;
+  for (;;) {
+    if (fs.existsSync(path.join(dir, 'playwright.config.ts')) || fs.existsSync(path.join(dir, '.sungen'))) return dir;
+    const parent = path.dirname(dir);
+    if (parent === dir) return undefined;
+    dir = parent;
+  }
+}

package/src/cli/commands/script-check.ts

@@ -3,6 +3,7 @@ import * as path from 'path';
 import * as fs from 'fs';
 import { runScriptCheck } from '../../harness/script-check';
 import { reportSlug } from '../../harness/unit-paths';
+import { sanitizeReportPaths } from '../../exporters/report-path-sanitizer';
 
 export function registerScriptCheckCommand(program: Command): void {
   program
@@ -23,7 +24,8 @@ export function registerScriptCheckCommand(program: Command): void {
         const dir = kind === 'screen' ? screen : kind === 'flow' ? flow : kind === 'api' ? api : null;
         if (!dir || !kind) throw new Error(`Not found: qa/screens|flows|api/${name}`);
 
-        const r = await runScriptCheck(dir, name, kind);
+        // The report is committed next to the spec — keep the operator's machine paths out of it.
+        const r = sanitizeReportPaths(await runScriptCheck(dir, name, kind), { root: process.cwd() }).doc;
 
         const outDir = path.join(process.cwd(), '.sungen', 'reports');
         fs.mkdirSync(outDir, { recursive: true });

package/src/cli/commands/update.ts

@@ -100,6 +100,9 @@ export function registerUpdateCommand(program: Command): void {
         const { AIRulesUpdater } = require('../../orchestrator/ai-rules-updater');
         const updater = new AIRulesUpdater(process.cwd());
         await updater.update(options.dryRun ?? false, { agents: resolveAssistants(options.assistant), force: options.force ?? false });
+        // playwright.config.ts is written once at init and never re-synced — patch the reporter in.
+        const { installReportSanitizeReporter } = require('../../orchestrator/report-sanitize-reporter-install');
+        installReportSanitizeReporter(process.cwd(), options.dryRun ?? false);
       } catch (error) {
         console.error('❌ Update failed:', error);
         process.exit(1);

package/src/exporters/api-testcase-formatter.ts

@@ -16,6 +16,7 @@
  */
 
 import { ApiCatalogEntry } from './types';
+import { SENSITIVE_NAME, isSensitiveKey } from './sensitive-key';
 
 /** A single `@api:<name>(k=v,…)` invocation parsed from a scenario's tags. */
 export interface ApiCall {
@@ -372,12 +373,6 @@ function formatBodyFile(bodyFile: unknown, args: Record<string, string>, localiz
   return `${p} (${spec.mimeType || 'application/octet-stream'})`;
 }
 
-/**
- * Credential name matcher (substring, not anchored) for both body-field keys and
- * test-data keys — catches variants like confirmPassword / new_password /
- * password_confirmation / access_token / client_secret / otp / passcode.
- */
-export const SENSITIVE_NAME = /pass(word|code)?|passwd|pwd|secret|token|otp|api[-_]?key|apikey|credential|authorization|signature/i;
 function isSensitiveField(key: string): boolean {
   return SENSITIVE_NAME.test(key);
 }
@@ -387,11 +382,14 @@ function isSensitiveField(key: string): boolean {
  * over the finished Steps/Expected cells, closing the paths key-based masking misses
  * (nested request bodies, query-string credentials, and the Expected assertion cell).
  * Values shorter than 3 chars are skipped to avoid masking trivial/coincidental text.
+ * Sensitivity is judged by the key segment that NAMES the value (see isSensitiveKey): the
+ * test-data map also carries per-index array leaves (`tokens.0.label`), and matching the
+ * whole key would redact every field under a list whose name happens to be a credential word.
  */
 export function collectSecretValues(testData: Record<string, string>): string[] {
   const secrets: string[] = [];
   for (const [k, v] of Object.entries(testData)) {
-    if (typeof v === 'string' && v.length >= 3 && SENSITIVE_NAME.test(k)) secrets.push(v);
+    if (typeof v === 'string' && v.length >= 3 && isSensitiveKey(k)) secrets.push(v);
   }
   // Longest-first so a longer secret is redacted before any shorter substring of it.
   return [...new Set(secrets)].sort((a, b) => b.length - a.length);

package/src/exporters/matrix/build.ts

@@ -18,6 +18,7 @@ import {
 } from '../feature-parser';
 import { getCasesDatasetRows, resolveResultVariants } from '../result-variants';
 import { renderDynamicTokens } from '../test-data-resolver';
+import { maskCredentialValue } from '../sensitive-key';
 import { classifyManualComments, renderAction, renderExpected, renderPrecondition, renderSetupInstruction, runtimeVarsOf } from './wording';
 import { scenarioFingerprint, combinedFingerprint, mapContentFingerprint } from './fingerprint';
 import {
@@ -100,12 +101,13 @@ function resolveDataPairs(
   if (row) {
     for (const [k, v] of Object.entries(row)) {
       if (k.startsWith('__') || k === 'case' || k === 'name' || k === 'label') continue;
-      pairs.push(`${k}: ${displayValue(String(v))}`);
+      pairs.push(`${k}: ${displayValue(maskCredentialValue(k, String(v)))}`);
     }
   }
   for (const v of vars) {
     const val = row && v in row ? undefined : testData?.[v]; // row columns already listed
-    if (val !== undefined) pairs.push(`${v}: ${displayValue(val)}`);
+    // Credential-named refs (`accounts.0.password`) render `***` — this column is read outside the run.
+    if (val !== undefined) pairs.push(`${v}: ${displayValue(maskCredentialValue(v, val))}`);
   }
   return pairs;
 }

package/src/exporters/matrix/render-coverage-sheet.ts

@@ -13,6 +13,7 @@ import * as ExcelJS from 'exceljs';
 import { renderReportHeaderBand } from '../xlsx-report-builder';
 import { variantState } from './build';
 import { MatrixModel, MapCategory } from './types';
+import { formatTestOutcome, resultTotals } from './result-totals';
 import { GAP_FILL, SOFT_BLUE, dataCell, headerCell, draftBanner } from './xlsx-cells';
 
 const CATEGORY_ORDER: MapCategory[] = ['normal', 'abnormal', 'security', 'nfr'];
@@ -151,7 +152,8 @@ export function addCoverageSheet(wb: ExcelJS.Workbook, model: MatrixModel, sunge
   const m = model.manifest;
   const manifestRows: Array<[string, string]> = [
     ['Unit', m.unit],
-    ['Approval state', m.approvalState],
+    ['Review state (design approval)', m.approvalState],
+    ['Test outcome', formatTestOutcome(resultTotals(model.items))],
     ['Delivery items', String(m.itemCount)],
     ['Coverage variants', String(m.variantCount)],
     ['Source fingerprint', m.sourceFingerprint],