@unotest/web 0.32.0 → 0.35.0

package/CHANGELOG.md

@@ -1,5 +1,881 @@
 # Changelog
 
+## [0.35.0] - 2026-09-15
+
+### Minor Changes
+
+- 86da16e: A remote grounder can now say "this account has spent its month", and a client
+  can tell that apart from a bad token.
+
+  A grounder running on an external model provider meters what each account
+  costs and stops at a ceiling. At the ceiling the two routes that call a model —
+  indexing a page and resolving an intent — answer HTTP **402** with
+  `grounder-budget-exhausted`. Money, not permission: the token is perfectly
+  good, nothing is re-minted over this, and a client that treats it as an auth
+  failure would retry forever. The body carries no amount and nothing about any
+  other account; the figure is an estimate of a bill we do not issue, and a
+  customer would rightly check it against the provider's own.
+
+  What a ceiling stops is **writing** tests, not running them, and every text
+  about it says so: only the MCP server asks the grounder — `ground_element`,
+  and an intent locator inside `explore_step` / `find_element`. A scenario
+  carries the locator it was written with, so suites, their runs on a box and
+  the viewer are untouched by a cap.
+
+  `ErrorResponse.code` names it, and gains `revocation-list-unavailable` at the
+  same time: a grounder has been answering with that code since signed tokens
+  arrived, and the union never learned about it — a client written from the type
+  could not discriminate a refusal it was already receiving. `retryAfterSeconds`
+  joins the shape for it, matching the `Retry-After` header that was already
+  being sent.
+
+  Nothing changes for a grounder running on our own GPU: nothing is metered
+  there, so nothing can be refused for money.
+
+- 7ffa4ae: `box picker on|off`: the Picker, switched on a box you already have
+
+  The Picker is an hourly surcharge on top of the box, and until now it could
+  only be chosen when the box was rented — with `box create --picker`, a flag
+  most people met for the first time in `--help`.
+
+  - **`unotest-web box picker on|off [name]`** switches it on a live box, with
+    no re-creating and no re-pushing. `on` mints the box's tokens the way
+    `box access` does and writes the Picker's three keys —
+    `UNOTEST_GROUNDER_MODE=remote` and `UNOTEST_GROUNDER_REMOTE_URL` into
+    `unotest/.env`, `UNOTEST_GROUNDER_REMOTE_TOKEN` into `unotest/.secrets`.
+    `off` clears the three again, but only when they name that box's grounder:
+    a project pointing at a grounder of its own, or at another box's, keeps it
+    and is told so. Either way the charge follows at the next hourly tick,
+    because a started hour is charged at the rate it started with.
+  - **`box create` asks** about the Picker on a terminal when `--picker` was not
+    given, quoting the hourly surcharge from the cloud's own price list rather
+    than a number kept in the CLI. `--yes`, `--json` and a run with no terminal
+    answer no without asking.
+  - **`box status`** says whether the Picker is on.
+  - **`run_test` offers it once.** A project that has a box but grounds intents
+    nowhere remote gets `pickerSuggestion` (`{state: "no-picker", next, why}`)
+    after the first run that passes — exactly once per MCP server session, on
+    the same terms as `boxSuggestion`, and never both: with no box there is
+    nothing to put a Picker on.
+  - **A refusal for money reads as one.** A remote grounder answering
+    `grounder-budget-exhausted` (HTTP 402) means the account's estimated spend
+    for the month has reached its ceiling, not that the token went bad: nothing
+    is re-minted over it, and the CLI and MCP replies name both ways out — top
+    up the balance, or `box picker off` to stop the Picker and ground locally
+    again. No amount is quoted: the figure estimates a bill we do not issue.
+
+### Patch Changes
+
+- 79c99ab: A box can now say "I cannot judge this token yet" instead of "your token is
+  wrong".
+
+  A box rented from the fleet accepts tokens the cloud signed for it, and it
+  checks every one against the operator's revocation list. Until that list has
+  reached the box — the minutes between it coming up and its first update tick
+  — there is nothing to check against, so such a token is refused. That is not
+  the same refusal as a bad credential: the answer is to send the SAME token
+  again shortly, never to mint another.
+
+  `BoxReadErrorCode` gains `revocation-list-unavailable` for it, and a refusal
+  body may carry `retryAfterSeconds` (the box sends `Retry-After` with the same
+  number). The push and run answers gain the same code, plus `ambiguous-project`
+  for a cloud-minted push token that names no project on a box that serves
+  several. Nothing changes for the tokens a person or a CI job mints on the box
+  itself.
+
+- 1584ce2: `box status` says where the Picker grounds
+
+  A box whose Picker is on now prints one more line: `Grounding: Our GPU` or
+  `Grounding: External provider (Gemini)` — which models the cloud resolves
+  intent locators with. It is the answer to a question a customer could not
+  check before, only read on a web page.
+
+  The line appears only while the Picker is on. With it off, intents are
+  resolved on the machine the tests run from, and naming our models under that
+  box would describe somebody else's. A cloud that has not heard from its own
+  grounder sends nothing and the CLI prints nothing: a mode we have not been
+  told is not a mode to invent.
+
+  On the wire the field is `grounding`, not `grounderMode`. `UNOTEST_GROUNDER_MODE`
+  already means something else and belongs to the reader — whether THEIR machine
+  grounds locally, remotely or not at all — and in `box status` the two would
+  have met a line apart. It is optional, so an older cloud simply says nothing.
+
+- dee96a1: A box can now say "this token has expired" instead of "your token is wrong".
+
+  Tokens the cloud signs for a rented box live thirty days. Until now a box
+  refused an expired one with the same blanket `unauthorized` it gives a
+  forgery, so the CLI could not tell "ask the cloud for another pair and
+  retry" from "this credential will never work", and an expired pair looked
+  revoked.
+
+  The read, push, run and values answers gain the code `expired` for it. A box
+  sends it only for a token its operator key really signed, of the right kind,
+  for that box — the signature, the kind and the box are all checked before
+  the expiry is — so nothing a guesser sends can produce it. It is also
+  decided before the revocation list is consulted: a box that has not received
+  a list yet still answers `expired` rather than asking for the same dead
+  token again.
+
+  Two codes that a box could already send are now accepted when parsing a run
+  or values answer, which had been left out of those two readers:
+  `revocation-list-unavailable` and `ambiguous-project`.
+
+- 220bf37: Fake cloud: two access pairs that arrive without a `client_name` no longer
+  replace each other. A machine whose hostname the contract's charset refuses
+  sends no name at all, so two such machines were evicting one another from a
+  box — the fake now replaces a pair only when a name actually matches. Its
+  refusal for a box that is not ready is worded like the rest of the service
+  ("That box is deleted."), so a client sees the same sentence from the fake
+  and from the real cloud.
+- 067cb3d: The Picker comes with the box, and the CLI says so
+
+  The Picker used to be priced as a factor on the box's own rate, which made
+  its surcharge a different number for every size and made "what does it cost"
+  a sum rather than a price. It is now a fixed hourly price per size — and, for
+  now, one nobody pays: it is included in the price of the box.
+
+  `box create`'s question, `box picker on|off` and `box status` all say it the
+  same way, with the number the cloud sends and never one of this CLI's own:
+  "included in the price of the box (normally €0.05/h)". The list price stays
+  visible on purpose. "Included", alone, reads as "cheap now, billed later" —
+  and what is actually charged is the number a client should quote, so
+  `GET /rates` sends both: `picker` is what will be added to the bill (zero
+  while it is included) and the new `pickerList` is what it lists at, beside
+  `pickerIncluded`.
+
+  A cloud that does not send the two new fields is quoted the old way, from
+  `picker` alone — nothing to strike through, and no invented number.
+
+- 417369a: `box picker off` now takes the token away, not just the surcharge
+
+  Until now `off` stopped the hourly charge and cleared the Picker's keys from
+  this project's files. A copy of the token already on another machine — a
+  teammate's laptop, a CI secret — went on working until the box's licence ran
+  out, grounding intents on our grounder that nobody was paying for.
+
+  Switching the Picker off now revokes that box's Picker tokens, all of them:
+  the cloud writes their ids into the operator's signed revocation list, and
+  the grounder stops accepting them once it has re-read
+  that list. The command says so, and says the minute rather than promising an
+  instant. Clearing the files is now the convenience it always was; the
+  revocation is what ends the access.
+
+  Two smaller things follow from it. `off` asks the cloud to revoke even when
+  the Picker was already off, so repeating the command is how you finish the
+  job if it failed once. And a revocation the cloud cannot write is a refusal
+  you see — the surcharge stops either way, but a token still in the wild is
+  not something to leave in a log.
+
+- Updated dependencies [79c99ab]
+- Updated dependencies [dee96a1]
+- Updated dependencies [86da16e]
+- Updated dependencies [7ffa4ae]
+  - @unotest/protocol@0.35.0
+  - @unotest/grounder-client@0.35.0
+  - @unotest/viewer@0.35.0
+  - @unotest/core@0.35.0
+  - @unotest/dsl@0.35.0
+
+## [0.34.0] - 2026-09-07
+
+### Minor Changes
+
+- c6b91bb: From `init` to a paid box without copying a token: `login`, `box create`,
+  and the tokens that keep themselves fresh.
+
+  Three new commands sign this machine in to unotest cloud — the account
+  that rents boxes — and rent one:
+
+  - `login` runs the device flow (RFC 8628): it prints a link and a code,
+    opens the browser when there is one, and waits for the approval. The
+    key is kept in `~/.config/unotest/credentials.json` (mode 0600,
+    `XDG_CONFIG_HOME` honoured) and is never printed, not even with
+    `--json`. `UNOTEST_CLOUD_TOKEN` in the environment wins over the file,
+    which is how a CI job signs in. `logout` revokes the key on the server
+    when the cloud can be reached and removes it locally always; `whoami`
+    says who, where the key came from, and the balance (exit 77 when not
+    signed in).
+  - `box create [name] [--size s|m|l] [--topup <eur>]` creates a box named
+    after the project (its package name, as a slug), with the environments
+    the project runs locally (`unotest/.env` and every `unotest/.env.<name>`,
+    their `APP_BASE_URL` or the config's `baseUrl` as the target). When the
+    balance will not cover the first hour it prints a Stripe Checkout link,
+    opens it when it can, and waits for the payment. Then it waits for the
+    box, mints its cloud-signed push and read tokens, writes
+    `UNOTEST_BOX_URL` to `unotest/.env` and `UNOTEST_BOX_TOKEN` +
+    `UNOTEST_BOX_READ_TOKEN` to `unotest/.secrets` (through the same
+    structure-preserving writer the viewer's Variables panel uses, with
+    `.gitignore` guarded the way `init` guards it), pushes the suite —
+    retrying with backoff while a fresh box has no revocation list yet —
+    and prints the viewer's address. Exit codes for an agent driving it
+    without a terminal: 75 the payment was not confirmed in time (nothing
+    created, nothing charged), 76 the terms of service are not accepted
+    (a person must, in a browser), 77 not signed in. No prompt is ever
+    shown without a TTY.
+    `--picker` rents the box with the Picker; `UNOTEST_GROUNDER_MODE=remote`
+    and `UNOTEST_GROUNDER_REMOTE_URL` then go to `unotest/.env` and
+    `UNOTEST_GROUNDER_REMOTE_TOKEN` to `unotest/.secrets` — the names the MCP
+    server reads — so intents ground on the box with no further setup. A
+    box without the Picker leaves those keys alone. The last line of
+    `create` is the next step: the complete `bundle push --run --env …
+--collection …` when the project has exactly one environment and one
+    collection, the viewer's address plus the command with placeholders
+    otherwise.
+  - `box access [name]` re-mints the pair and rewrites the two files;
+    `box status` and `box destroy` (asks on a terminal, `--yes` elsewhere)
+    are thin wrappers. The name defaults to the box `UNOTEST_BOX_URL`
+    points at (`acme.box.unotest.com` → `acme`).
+
+  Cloud-signed box tokens live thirty days. When a box answers that one
+  has expired, `bundle push` and the `box …` read commands re-mint the
+  pair through the cloud and retry once, provided a cloud login is at
+  hand; without one they say to run `login && box access`. The box a
+  re-mint is for is the one the project points at, named from its address
+  or, when the address spells no name (a stand behind an IP), by the same
+  default `create` used — so a lab box re-mints like any other. A `--box`
+  naming somewhere else is said to be somewhere else rather than blamed on
+  a missing login. A box that has
+  not yet received its revocation list is told apart from a real refusal
+  and retried; a token the box calls revoked is never re-minted quietly.
+  `bundle push` now also reads the push token from `unotest/.secrets`,
+  where `box create` puts it (then `unotest/.env`, for suites set up by
+  hand), so nothing has to be exported after the setup.
+
+  The MCP server knows the state too. While the project points at no box,
+  `box_envs`, `box_runs`, `box_run` and the other box tools answer
+  `{state: "no-box", next, why}` instead of an error, and `run_test`
+  carries the same `boxSuggestion` exactly once per server — after the
+  first local run that passes — so an agent offers the box at the moment
+  it is worth something and never nags. The box tools re-mint an expired
+  cloud-signed read token the way the CLI does, through the composition
+  root, and `unotest/.secrets` is read on every call: a pair written by
+  `box create` while the server runs is used by the next call. On a
+  Picker box, `ground_element` (and intent locators) whose picker token
+  the grounder refuses re-mint it once through the cloud and hand the new
+  token to the running client; a refusal that cannot be mended answers
+  `{state: "picker-token-refused", next: "npx @unotest/web box access",
+why}`, and a grounder that has not read its revocation list yet answers
+  `{state: "retry-shortly", retryAfterSeconds}`. Box tokens are checked
+  before the network: cloud-signed ones by their whole shape (`unos_…`), a
+  push token in the read variable (and the reverse) is named as the wrong
+  kind, anything else as not a token.
+
+  A renewal the cloud itself refuses is its own answer, not the cloud's.
+  When a box or the grounder says a cloud-signed token is stale and the
+  `/access` call that would replace it is refused in turn — no such box,
+  the box not ready, too many live pairs, the cloud unreachable — every
+  surface says that the credentials could not be renewed and keeps the
+  cloud's refusal as the cause. The CLI prints one line and exits with the
+  code that refusal earns; the grounding tools answer
+  `{state: "picker-token-refused", next, why}` as before, so an intent is
+  never answered with a sentence about boxes.
+
+  `init` ends with one line saying how to run the suite on a box; the
+  "mint a read token in the guard" advice in the box commands' refusals
+  now points at `login` and `box access` instead. `UNOTEST_CLOUD_URL`
+  points the CLI at a stand or a fake cloud; nobody sets it otherwise.
+
+  `@unotest/protocol`: `replaceEnvVar` (an in-place value replacement the
+  new upsert builds on), `BOX_PUSH_TOKEN_PREFIX` / `BOX_SIGNED_TOKEN_PREFIX`
+  / `BOX_SIGNED_TOKEN`, and `UNOTEST_BOX_URL`, `UNOTEST_GROUNDER_MODE`,
+  `UNOTEST_GROUNDER_REMOTE_URL` listed among the runner-config keys so they
+  file under the Runner section of `unotest/.env`.
+
+  `@unotest/grounder-client`: `GrounderHttpClientOptions.token` may be a
+  function yielding the current bearer; `GrounderRemoteError` carries the
+  grounder's `retryAfterSeconds`, and the error codes gain
+  `revocation-list-unavailable`.
+
+### Patch Changes
+
+- d68538f: A box refusing a token now answers with the words the box actually
+  sends, and with the step that fits the token you presented.
+
+  The CLI knew five refusal codes; a box sends three. `expired` still
+  re-mints through the cloud and retries once, `revocation-list-unavailable`
+  still means the same token, later. Everything a retry cannot fix —
+  revoked, bad signature, wrong door — arrives as one `unauthorized`, and
+  that is deliberate on the box side: a refusal that names WHICH check
+  failed is an oracle. The three codes written ahead of the box and never
+  sent by anything are gone.
+
+  What you see changes in two ways:
+
+  - the sentence is the box's own reason, never a stock phrase of ours.
+    A code this CLI does not know (a box newer than the CLI) reaches you
+    with the box's message too, instead of a generic line about a token.
+  - the suggested fix follows the KIND of token: a cloud-signed pair is
+    re-minted with `npx @unotest/web box access`; a token you minted
+    yourself on a box you run is re-minted in that box's guard, because
+    there is no cloud behind it to point at.
+
+  The MCP `box_*` tools return this as a state rather than an error, the
+  way they already do for a project with no box: `{state:
+"box-token-refused", next, why}` — `why` is what the box said, `next`
+  is the command that fixes it.
+
+  `pnpm fake:cloud --box-refusal <code>` makes the fake box refuse with
+  any code, including one the CLI does not know, so both paths can be
+  exercised without a real box.
+
+- 565d1b3: Secrets no longer travel with the page capture that grounding reads.
+
+  `UNOTEST_BOX_SECRET_NAMES` and `unotest/.secrets` masked what the runner
+  said out loud — logs, the debug log, the recorded session — but not the
+  capture `ground_element` and intent locators send to the grounder, and in
+  the hosted mode on to a model provider. Only the field TYPE was filtered
+  there: a `password` or `hidden` input was dropped by the page walker,
+  while an API token in a plain text input, a one-time code, a card number,
+  a whole textarea, a login, or a key the application printed on the page
+  went out verbatim.
+
+  Both modes come through one place now, and it cleans the capture twice
+  over before the content hash is taken:
+
+  - every registered secret value is replaced by `‹secret:NAME›` wherever it
+    occurs — a control's value, a text node, an accessible name, the page
+    title. Masking is by EXACT value: the same secret written in another
+    case is not recognised, deliberately, because matching loosely would
+    mask ordinary words and the noise would land in what grounding reads.
+  - the page URL and every link keep scheme, host and path; query, fragment
+    and `user:pass@` are dropped. That is where a password-reset token, a
+    signed link or a session id lives, and no list of known secrets can
+    cover those. A link made of nothing BUT a fragment (`#main`) keeps it —
+    that fragment is the whole label, and there is no path to name instead;
+    a fragment hanging off a real address (`/invite#SECRET`) is dropped like
+    any other. `data:`, `blob:` and `javascript:` keep their scheme alone:
+    there the document, or the code of a call with its arguments, sits
+    where the path would be. `mailto:` and `tel:` stay whole — there the
+    path is the addressee, which is a label like any other.
+
+  The masking is what the grounder is given, so it is also what the content
+  hash is taken of — two visits that differ only in a link's one-time token
+  are correctly one page to the index cache, not two.
+
+  The graph's own vocabulary is untouched: `kind`, `tag`, `role`, `ref` and
+  `testId` are structure, not content, and a secret whose value happens to
+  be `button` no longer has anywhere to do damage. Everything else in a
+  capture is masked, including a field added to it later.
+
+  Loading a secret shorter than six characters now warns, once, naming the
+  variable and its length and never its value. Nothing changes about how it
+  is masked — the warning exists because masking by value has no notion of
+  length, so `admin` as a password also masks the word wherever a page
+  writes it, and grounding can get worse on a page that has nothing to do
+  with the secret.
+
+  Still not covered, and worth saying plainly: a value the run was never
+  told is a secret. A key the application itself renders on the page — the
+  "copy it now" screen — is in no registry, and goes out with the capture.
+
+- 32a495e: Failure artifacts survive a run that is isolated from its own artifact root.
+
+  A run executed inside a container sees only what is mounted into it. The
+  failure bundle's directory is derived from the artifact root, which on such
+  a run is not one of those mounts — so it could not be created, and a failed
+  test produced no screenshot, no trace and no page HTML at all. Worse, that
+  one error took the always-on copies in the run directory down with it: both
+  sinks shared a single try, so the artifact that does not depend on the
+  bundle was lost too.
+
+  Two changes. `UNOTEST_FAILURES_ROOT` now says where bundles live, for
+  whoever spawns the run to point at a directory it can actually write
+  (unset, everything behaves exactly as before). And the two sinks are
+  independent: an unusable bundle root no longer costs you the run
+  directory's screenshot and page HTML.
+
+  The viewer serves failure assets from either layout, so a bundle written
+  inside the environment's runs tree renders like a local one.
+
+- 2416abf: `init` no longer rewrites a config the project had already edited, and
+  `--help` no longer runs the command it is asking about.
+
+  Two defects, one outcome. `init` wrote the channel into
+  `unotest/unotest.config.mjs` unconditionally at the end of every run, on
+  the assumption that the file was the placeholder it had written seconds
+  earlier. In a project that had run `init` before, that file is the
+  project's own: it was replaced by the template with no `--force`, no
+  warning, and an `already present` line printed about it. And because the
+  option loop ignored anything it did not recognise, `init --help` — the
+  first thing a person types when a command is unfamiliar — fell through
+  into a real run in the current directory, scaffolding the layout and
+  taking the config with it.
+
+  What changes:
+
+  - an existing file stays exactly as it is; the channel is patched only
+    into a config this run created itself. A re-run reports `already
+present` and changes nothing.
+  - `--force` still takes the templates, and now keeps what it replaced
+    next to it as `<file>.bak`. Being overruled is not the same as losing
+    the work.
+  - the package-owned copies `init` keeps in sync — the test-authoring
+    skill, the agent-trace hook — are still synced without `--force`, but a
+    copy that diverged is now kept as `<file>.bak` too. "Nobody edits
+    these" is an assumption about a file in your repository, and it costs
+    nothing to be wrong about it safely.
+  - `--help` / `-h` works on every command, prints the usage, and does
+    nothing else — answered before the workspace is even resolved, so a
+    question touches no files anywhere.
+  - an option a command does not recognise is refused with its usage and
+    exit **2**, instead of being dropped silently. `init` reads its options
+    against the list of what it knows, so the next flag added cannot fall
+    through the same hole.
+
+- 9daaaf7: `init` writes files that pass the project's own `prettier --check`.
+
+  The block `init` maintains in `CLAUDE.md` now has a blank line between
+  each marker and the text inside, and the JSON it writes — `.mcp.json`,
+  `.claude/settings.json` — keeps a short array on one line (`"allow":
+["mcp__unotest-web"]`) instead of one element per line. Both are what
+  prettier produces, so a repository whose CI runs `format:check` no longer
+  goes red on files it did not write itself. A file `init` merges into is
+  re-emitted by the same rules, including the entries the user had there.
+
+  `AGENTS.md` too: its DSL examples now sit in fences prettier does not
+  reformat, and every list has the blank line before it that prettier's
+  Markdown rules want.
+
+- 50b1d4d: The search text sent for grounding is masked the same way the page
+  capture already is.
+
+  Masking the capture cleaned what the PAGE said. The other half of a
+  grounding call — the intent, the thing being searched for — went out
+  untouched: to the grounding service, into the picker's prompt and the
+  embedder's query, and in the hosted mode on to a model provider. A
+  scenario that puts a variable into the search (`intent("the row for " +
+LOGIN)`) sent its value verbatim, while the same value was masked
+  everywhere else in the run.
+
+  Now every registered secret is replaced by `‹secret:NAME›` across the
+  whole intent, not only its text: the predicate's field description and
+  its value too, which is where a value is most literally the thing being
+  searched for. Only the structural keys are kept — the comparison
+  operator, the kind of unit wanted back, the kind of ordinal — so a field
+  added to the contract later is masked by default rather than forgotten.
+
+  A numeric secret is masked as well, and only on an exact match: a
+  one-time code arrives as a number, and a number has no text for a value
+  to hide inside, so `447213` masks while `4472130` and every ordinary
+  quantity are left alone.
+
+  This happens in one place for both grounding modes — local and remote —
+  so a value cannot escape through whichever mode a project runs.
+
+  The honest cost, because it is real: masking is by exact value. Where the
+  page rendered the same secret in another form — a different case, a
+  percent-encoded path, a value split by an invisible character — the mask
+  now lands on the intent alone, and the correspondence between what you
+  searched for and what the page shows is lost for that one case.
+  Grounding can get worse there. It is the same boundary already stated
+  about masking generally: the exact value is what is recognised, not the
+  secret "in any form".
+
+- Updated dependencies [32a495e]
+- Updated dependencies [c6b91bb]
+
+  - @unotest/protocol@0.34.0
+  - @unotest/viewer@0.34.0
+  - @unotest/grounder-client@0.34.0
+  - @unotest/core@0.34.0
+  - @unotest/dsl@0.34.0
+
+- Named late, and it should have been named in 0.33.0: on a box the pushed
+  suite is mounted **read-only**. Since run isolation (0.33.0) a run sees
+  its bundle at `/box/sources` and cannot write next to its own files —
+  a `prepare` script that seeded a database beside the fixtures, or a
+  helper that kept a scratch file under `unotest/.tmp`, now fails with
+  `EROFS` / `ENOENT` before a single scenario runs. The places a run may
+  write are `/tmp` (the container's own, gone with the run) and the run's
+  artifact directory under `UNOTEST_ARTIFACTS_ROOT`; `os.tmpdir()` in
+  Node and `$TMPDIR` in a shell both land in the former. Migration for a
+  suite that wrote beside its sources: pick the scratch directory by
+  whether `UNOTEST_ARTIFACTS_ROOT` is set — `unotest/.tmp` locally,
+  `/tmp/<suite>` on a box — and point the seed, the fixture and the
+  scenario at the same helper. Our own dogfood suite failed on exactly
+  this for a day.
+
+## [0.33.0] - 2026-09-06
+
+### Minor Changes
+
+- 2abfd4d: Box: every run is announced — Slack, Telegram, or a webhook of your own — and the channels are managed from the guard.
+
+  A box now tells people how its runs went, whoever started them: the
+  schedule's ticks, a pull request's check, somebody pressing Run in the
+  viewer, a terminal inside the container. The daemon reads each run's own
+  journal, so the three producers are one source; the run's manifest says
+  what set it off — `trigger: { kind: "schedule" | "ci" | "manual" | "cli",
+by? }`, written by the runner from `UNOTEST_RUN_TRIGGER` /
+  `UNOTEST_RUN_ACTOR` (a box sets them for its scheduled and CI runs, the
+  viewer for a run ordered from its UI; a terminal sets nothing and reads as
+  `cli`).
+
+  A scheduled series is announced on a **change of state**: `failed` after
+  `afterFailures` red ticks in a row, `recovered`, `still-failing` at a rule's
+  `repeatEvery`, `not-run` when the suite could not run at all (no bundle, a
+  bundle that does not install) — daily by default. A run somebody ordered is
+  announced on its own, `failed` or `passed`, every time. A withdrawn or
+  aborted run says nothing; a run whose journal stops and whose heartbeat goes
+  cold is `interrupted`.
+
+  Channels, rules, mutes and quiet hours live on the box and are managed from
+  the guard's `/_guard/notifications` page (or `boxd notify …`): a channel's
+  secret is set once and never shown again, a rule picks environments,
+  triggers, events and channels, a series or the whole project can be muted
+  until a time, and quiet hours hold reminders and `passed` back until the
+  morning. A generic webhook receives the event as JSON (`version: 1`, the
+  box named, the `trigger`) with `X-Unotest-Event` and, when the channel has
+  a secret, `X-Unotest-Signature: sha256=<hex>` — HMAC-SHA256 over the raw
+  body, the scheme GitHub uses — plus any headers the channel declares.
+
+  `@unotest/protocol`: `RunManifest.trigger` and the trigger helpers
+  (`runTriggerFromEnv`, `runTriggerEnv`, `manifestTrigger`); the session-door
+  paths, views and parsers of the notifications API (`boxNotifyProjectPath`,
+  `boxNotifyChannelPath`, `boxNotifyRulePath`, `boxNotifySeriesPath`,
+  `boxNotifyMutePath`, `boxNotifyQuietHoursPath`, `boxNotifyPreviewPath`,
+  `BoxNotifyProjectView`, …). The first draft of this feature (channels
+  declared in the box config, secrets by field) never shipped; this replaces
+  it whole.
+
+### Patch Changes
+
+- 5d1bde3: `lint` and `e2e` no longer fail on a project tree they cannot write to.
+
+  Editor typings (`unotest/jsconfig.json`, `.unotest/types/env.d.ts`) are a
+  convenience for a human with an IDE open, and they were being written on
+  every implicit `lint` / `e2e`. On a box that runs a suite in an isolated
+  container the bundle is mounted read-only, so that write raised `EROFS` /
+  `ENOENT` and every scenario ended as `interrupted` — a suite failing
+  because a cache could not be refreshed.
+
+  The write is now skipped when the tree refuses it (matched on the errno
+  `code`, never on a message), both artifacts report `skipped`, the result
+  carries the reason, and the run carries on; any other failure still
+  throws. `UNOTEST_EDITOR_TYPES=0` turns the whole thing off up front — a
+  box sets it on every run it starts, because there is no editor in a
+  container and the attempt is only noise in the log.
+
+- b3e1220: Judge: the bearer token on `/judge` is compared in constant time, and the
+  docs say what a verdict sends and what it is not.
+
+  `UNOTEST_JUDGE_TOKEN` was checked with a plain string comparison, which
+  returns as soon as one character differs; both sides are now hashed and
+  compared with `timingSafeEqual`. The judge guide and the package README
+  gain a section on what leaves the machine — the one element's rendered
+  text and the rubric, nothing else; the secret redactor does not act on
+  that body; CI defaults to `fake` — and on why a verdict, being a model's
+  reading of the page's own text, is a check on wording and never a
+  security gate.
+
+- b3e1220: Box notifications: a webhook channel's header values are credentials.
+
+  The notifications API and the guard's page now see a webhook's headers
+  as names with `{ set: true }` — the values (the receiver's
+  `Authorization`, most of the time) are never read back, like the signing
+  secret. The edit form lists the names; typing a value after one replaces
+  the set, names alone keep it. `/api/box/notify` is the guard's own route:
+  it is no longer reachable through the session proxy for any role — a
+  readonly session could previously list every project's channels with
+  their headers.
+
+- b3e1220: Box notifications: the webhook signature now covers a timestamp.
+
+  Every webhook delivery carries `X-Unotest-Timestamp` (Unix milliseconds,
+  when it was sent), and `X-Unotest-Signature` is HMAC-SHA256 over
+  `<timestamp>.<raw body>` rather than the body alone — GitHub's scheme
+  with a timestamp in front, so a delivery captured on the wire cannot be
+  replayed to the receiver once its window (five minutes, documented) has
+  passed. The GitHub webhook the box receives is unchanged: that is
+  GitHub's contract.
+
+  The `by` of a CI-triggered run (`push a1b2c3d (branch)`) is cut at 200
+  characters — a branch name is the pusher's input, and it must not balloon
+  the run's manifest and every notification the run produces.
+
+- b5907cf: Pin playwright to the exact release the box image ships.
+
+  `@unotest/web` depended on `playwright ^1.62.0`, so a fresh install of a
+  suite could pick a newer playwright than the browsers inside the box's
+  `mcr.microsoft.com/playwright` image, and every run on the box failed
+  with "Browser 'chromium' is not installed" the day 1.63.0 shipped. The
+  dependency is now the exact version of the image (1.62.1); the two are
+  bumped together, and a guard in the monorepo's `verify` keeps them equal.
+
+- 5d1bde3: Building the runner no longer writes into the project tree.
+
+  `ExplorationService` created `.unotest/explorations/` in its constructor,
+  and the composition root builds it for every entry point — including an
+  `e2e` run. Where the project tree is read-only (a box mounts a pushed
+  bundle that way) the run ended before a browser was asked for. Recording
+  is an MCP activity, so the folder is now created with the first record
+  written instead.
+
+  With the editor-typings fix in the same release, an ordinary `lint` /
+  `e2e` writes nothing under the sources: run artifacts go to
+  `UNOTEST_ARTIFACTS_ROOT` (which the box makes writable), and everything
+  else that writes into the project — recording, authoring, `init`, `env
+set`, `bundle push` — happens on a developer's machine.
+
+- 5d1bde3: Run isolation, stage 1: a box no longer executes a test bundle inside its
+  own daemon.
+
+  box-runner (new, private): the run sidecar — the only service on a box
+  holding the docker socket, and the only one that starts a container. Three
+  authenticated routes on the `box` network (`POST /runs`, `GET
+/runs/:id/stream` NDJSON, `DELETE /runs/:id`), a shared secret compared in
+  constant time, and an API that cannot be told anything about how a
+  container is built: no path, image, network, user, mount or flag. A request
+  names a project, an environment, a bundle, a scenario and the environment's
+  values; the bind sources are derived from the first three, resolved with
+  `realpath` and re-checked against the projects root, and must already
+  exist. The container is created over the Docker Engine API (pinned
+  `v1.43`) straight over the socket — no `docker` binary in the image and no
+  client dependency, and a container that is a JSON document has no place
+  for a value to become a flag. A daemon that refuses or is not there comes
+  back as `502 {reason}` before the run is accepted, or as an `error` event
+  on the stream after — never as a run that "exited with code null". An
+  environment variable the box does not forward is named in the sidecar's
+  log rather than dropped silently. A run gets the bundle tree read-only as its working directory, the
+  environment's `unotest/.runs.<env>` read-write, a `noexec` tmpfs `/tmp`,
+  a read-only rootfs, all capabilities dropped, `no-new-privileges`, its own
+  uid in boxd's group, memory/pids/cpu limits clamped to both the operator's ceilings and the
+  host's own size (docker refuses a container bigger than the machine
+  instead of clamping it), a 512 MB `/dev/shm`
+  (docker's default 64 MB kills Chromium mid-page; the host's IPC namespace
+  is deliberately not borrowed), and the `runs` network only. The container engine is an interface, so every rule is asserted on
+  the container that would have reached docker — including the cases where
+  the answer is no container at all.
+
+  boxd: running the SUITE is its own contract (`IScenarioRunner`), separate
+  from running a command (`ICommandRunner`, still the daemon's own `npm ci`
+  and viewers). `ContainerScenarioRunner` talks to the sidecar,
+  `ProcessScenarioRunner` keeps the old child-process shape for a box without
+  docker; `BOXD_RUNNER_KIND=container|process` chooses, and half a container
+  configuration refuses to start. Reading a bundle's schedules
+  (`unotest-web schedules --json`) executes the project's config module, so it
+  goes the same way. A run's environment is built from named parts
+  (`run-environment.ts`) instead of inheriting `process.env`, and its debug
+  tree is pointed at the run's own directory rather than the read-only
+  sources. New metrics
+  `boxd_run_container_total{outcome}` and `boxd_run_container_start_seconds`.
+  An environment's runs directory is created by the daemon with `2775`, so
+  the run's uid may write into it and the daemon's group may read it back.
+
+  box-kit: `secretsMatch` (constant-time secret comparison, moved out of
+  dist-service), `splitLines`, and `envNumber` / `envPositiveNumber` — the
+  env-reading rule the box-side services share.
+
+  `npm ci` of a bundle is a container of its own (`kind: "install"`): the
+  bundle tree is its only mount and it is writable, there is no environment
+  and no artifacts directory in reach, and a dependency's install scripts
+  RUN — a native module builds or fetches its binary as usual. That is what
+  running them inside the daemon could never allow. The container's last
+  steps, only on success, check the tree against the box's size cap, set
+  the final modes on what the install created and write the install marker
+  — each with an exit code of its own, so the daemon's log names the step
+  that failed — so a killed or oversized
+  install leaves a tree the box will not mount; a failed install takes the
+  tree with it. The daemon no longer passes `--ignore-scripts` and no
+  longer walks the tree afterwards.
+
+  The daemon runs with `umask 002` and clears `node_modules` before each
+  install, so a tree it created is one the install container (another uid
+  in its group) can actually write.
+
+  An install that fails KEEPS the tree, unmarked: nothing mounts it and the
+  next attempt reinstalls in place (`npm ci` wipes `node_modules` itself).
+  And a bundle directory holding a manifest with neither an archive nor a
+  tree behind it no longer counts as "this box has it" — a push of the same
+  content brings it back instead of being answered `already had this exact
+bundle`.
+
+  web: `bundle push` and the docs say that a dependency's install scripts
+  run on a box, in isolation — the earlier advice to vendor them is gone.
+
+  A run ordered in the viewer now goes through the daemon's queue instead
+  of being spawned by the viewer.
+
+  `POST/GET/DELETE /api/box/envs/<project>/<env>/runs[/<runId>]` (paths and
+  wire types in `@unotest/protocol`) takes a `manual` ticket like every
+  other producer. Two callers may use it, and neither is taken on its word:
+  the guard, proving it is the guard with a shared secret from `box-init`
+  (the actor header is read only next to it — a viewer container could
+  otherwise claim to be any admin), and a viewer, with a per-environment
+  token the daemon minted when it started that viewer plus a short-lived
+  single-use ticket the guard signed over WHO clicked. The guard gates the
+  route under `admin` and requires an `Origin` on a mutation; the daemon
+  checks the token's environment, the ticket's environment and its `jti`
+  against the path.
+
+  `@unotest/viewer` gets `BoxdRunner`: on a box the Run button orders and
+  the Stop button asks the daemon, and the progress still comes from the
+  run's journal on disk. A local viewer spawns as it always did — the
+  composition root picks by whether a box handed it credentials.
+
+- 348aba7: Run isolation, stage 2b and 3: an environment's viewer runs in a
+  container of its own, and a box ships the sidecar in its compose stack.
+
+  The viewer was the last thing on a box that executed a bundle's code next
+  to the daemon's state: it runs the UI, the language service and the
+  linter out of the bundle's own `node_modules`. It is now a container the
+  run sidecar starts and the daemon asks for — `POST /viewers`, one per
+  environment, addressed by a name both services derive
+  (`unotest-viewer-<project>-<env>-<8 hex>`, port 7788).
+
+  Each viewer gets a NETWORK of its own with exactly two other containers
+  attached: the guard, which proxies people at it, and the daemon, which it
+  orders runs from. Not the sidecar's network, not the runs network, and
+  above all not another viewer's — a viewer has no authentication of its
+  own, and two on one network would be two containers of untrusted code
+  with a route to each other. That network is INTERNAL: a viewer's server
+  makes no outbound call, so it gets none, while the network a run joins
+  stays open because a test drives an application. The name of a viewer and
+  its network is a function of the project/environment PAIR rather than of
+  the string they join to, so two environments whose names concatenate the
+  same way cannot end up sharing one. Its mounts are the bundle tree read-only and
+  the environment's `unotest/` read-write (the run history it renders and
+  the queue it withdraws tickets from); the environment's secrets and its
+  `current` link sit in the directory above and are mounted by nobody. Its
+  environment is assembled by the daemon — the target, the environment's
+  variables and secrets, its own credential — and the daemon's own
+  `process.env` no longer travels.
+
+  **Editing a suite's files from the viewer on a box no longer works**: the
+  sources are read-only there. Such edits never survived the next `bundle
+push` anyway, which replaced the tree. Everything else in the UI is
+  unchanged.
+
+  Readiness is the docker daemon's own healthcheck, probed inside the
+  container and read through the sidecar — the daemon no longer waits on a
+  lock file, and nothing dials a viewer from the process holding the docker
+  socket. A viewer's output is streamed into the daemon's log and
+  reattached when the stream drops. A container whose bundle and values
+  still match is ADOPTED across a restart of either service, keeping the
+  credential it was born with; one whose environment is gone is stopped,
+  with its network and its token. The sidecar recognises its own containers
+  by label, never by name alone, and enforces its own ceiling on how many
+  viewers may exist (`BOX_RUNNER_MAX_VIEWERS`) — boxd knows how many
+  environments there are right up until boxd is the thing that was
+  compromised.
+
+  A run somebody stopped now ENDS in the viewer instead of hanging.
+  Stopping a run stops its container gracefully (SIGTERM, then SIGKILL
+  after `BOX_RUNNER_STOP_GRACE_SECONDS`, default 10) so the suite writes
+  the terminal event of its own journal; if it could not — the grace ran
+  out, the machine died — the daemon appends it. The same grace applies to
+  a run killed on its timeout, so a run's budget is the timeout plus the
+  grace.
+
+  A viewer that dies is noticed in about a second and replaced: the log
+  stream the daemon holds open ends with the container, and the 404 that
+  answers its immediate reattach is the signal. The route comes out of the
+  table at once — the guard then says the environment has no viewer instead
+  of proxying at a dead address — and a fresh container is started, on the
+  same backoff the daemon uses for everything else it cannot reach.
+
+  A restart of the sidecar is no longer an outage. While it cannot be
+  reached the daemon keeps the routes it published (the viewer containers
+  are up, and the guard reaches them directly) and tries again with a short
+  backoff instead of waiting for its next five-minute sweep. Editing a file
+  in the viewer on a box now answers 403 with the reason — the sources are
+  read-only there — rather than a blank 500.
+
+  The viewer no longer collapses the daemon's refusals into a blank 500:
+  the box's own status and reason reach the browser, so "that click has
+  already been used" (409), "the box cannot verify the caller" (503) and
+  "the box daemon is not answering" (503) are told apart by the person who
+  clicked.
+
+  Deployment: `compose.yaml` gains the `runner` service (the only holder of
+  the docker socket, the release ships its bundled `box-runner.mjs` beside
+  `boxd.mjs`), fixed container names for the guard and the daemon, a
+  `box_secrets` volume whose secrets `box-init` generates, and a one-off
+  migration of the projects tree to the group layout an install container
+  needs. Two values an operator fills in: `BOX_PROJECTS_HOST_DIR` (a bind
+  source is resolved by the docker daemon on the host) and `BOX_DOCKER_GID`.
+  Step by step in the box release's cutover manual.
+
+- 9158968: Viewer: a run that started before the page was reloaded is shown again.
+
+  The live sidebar was rebuilt from WebSocket events only, and those speak
+  from the moment the page connects — a collection already in progress
+  never re-sent its `started` event, so after a reload it was missing from
+  ACTIVE, then reappeared nameless with no scenario list once its next
+  scenario began, while its children showed up one by one. On load, and on
+  an environment or target switch, the viewer now asks the server which
+  runs are live and replays each one's journal into the same state the
+  live stream feeds, so a reload mid-run shows the collection with its
+  name, scenarios and progress.
+
+- b3e1220: Viewer: a session that may not edit variables does not see credential-shaped
+  values, nor the project's absolute path.
+
+  Behind the guard, a readonly session could read `GET /api/variables` and
+  get every box variable's value — `PASSWORD=…` included when the operator
+  had pushed it as a variable rather than a secret. The viewer now reads the
+  capabilities the guard stamps on each request: when the caller cannot edit
+  variables, a value whose name matches `PASSWORD | PASSWD | SECRET | TOKEN |
+KEY | CREDENTIAL` is sent empty and flagged `secret`, and `GET /api/targets`
+  leaves out `projectRoot`. Display-masking by capability, not authorization —
+  a viewer without a proxy in front is unchanged, and the guard still refuses
+  every write.
+
+- bd6b7ba: Viewer: a collection run no longer shows up nameless and without scenarios.
+
+  The journal tailer moved its cursor to the end of the file even when the
+  last line was still being written, so the half already on disk was lost
+  and the other half was later read as garbage. The longest line in a
+  journal is `collection-run:started` with the scenario list, so that was
+  the one it usually caught: the run appeared under its id instead of its
+  collection name, with "collection has no scenarios" and a `2/0 done`
+  counter. The cursor now stops at the last complete line and the rest is
+  read on the next change.
+
+- 8846a06: Viewer: a run started the moment the viewer came up is shown, not lost
+  until the next change.
+
+  Watching a directory becomes live a moment after the watcher reports it
+  is ready, and a run directory created inside that gap was not merely
+  late — it was invisible until something else changed in the same day,
+  which in a quiet environment is the next run. Measured at 1-3% on macOS
+  with a busy machine, and the window is exactly "open the viewer, start a
+  run". The viewer now proves the watch delivers before it declares itself
+  up: it creates a directory of its own and waits to hear about it, so
+  boot completes on evidence rather than on a promise. A tree it cannot
+  write to, or a probe that never comes back, costs a warning in the log
+  and boots as before.
+
+  A directory whose name starts with a dot is never reported as a run — an
+  editor's leftovers, or the watcher's own probe, can no longer appear in
+  the run list as a phantom.
+
+  Run queue: a waiter whose process paused is no longer mistaken for dead
+  — the queue stamps its own files with its own clock.
+
+  A run waiting for a slot proves it is alive by touching its ticket, and
+  what it is judged against was the modification time the filesystem
+  wrote: on a network share that is the server's clock, and against a
+  machine busy enough to keep a process off the CPU, a ticket written a
+  moment ago could look like it belonged to a process that died. The queue
+  now stamps every file it creates with the same clock it judges them by.
+
+- Updated dependencies [2abfd4d]
+- Updated dependencies [b3e1220]
+- Updated dependencies [b3e1220]
+- Updated dependencies [5d1bde3]
+- Updated dependencies [348aba7]
+- Updated dependencies [9158968]
+- Updated dependencies [b3e1220]
+- Updated dependencies [bd6b7ba]
+- Updated dependencies [8846a06]
+  - @unotest/protocol@0.33.0
+  - @unotest/viewer@0.33.0
+  - @unotest/core@0.33.0
+  - @unotest/dsl@0.33.0
+  - @unotest/grounder-client@0.33.0
+
 ## [0.32.0] - 2026-09-05
 
 ### Minor Changes