@validate.qa/runner 1.0.100 → 1.0.101

package/dist/discovery-mcp-server.js

@@ -3027,7 +3027,7 @@ function unescapeQuotedBody(raw) {
   return raw.replace(/\\(['"`\\])/g, "$1");
 }
 function extractRoleNameValue(line) {
-  const m = line.match(new RegExp(`getByRole\\s*\\([^,]+,\\s*\\{[^}]*name\\s*:\\s*(?:${QUOTED_BODY}|\\/([^/]*?)\\/)`, "i"));
+  const m = line.match(new RegExp(`getByRole\\s*\\([^,]{1,200},\\s*\\{[^}]{0,200}?name\\s*:\\s*(?:${QUOTED_BODY}|\\/([^/]*?)\\/)`, "i"));
   if (!m)
     return null;
   const raw = m[1] ?? m[2] ?? m[3];
@@ -3735,6 +3735,8 @@ function stripCoverageComments(code) {
   let copyFrom = 0;
   let i = 0;
   let quote = null;
+  let prev = "";
+  let noRegexBefore = 0;
   while (i < code.length) {
     const ch = code[i];
     if (quote) {
@@ -3742,12 +3744,24 @@ function stripCoverageComments(code) {
         i += 2;
         continue;
       }
-      if (ch === quote || ch === "\n" && quote !== "`")
+      if (ch === quote || ch === "\n" && quote !== "`") {
         quote = null;
+        prev = ch === "\n" ? prev : ch;
+      }
       i++;
       continue;
     }
     const next = code[i + 1];
+    if (ch === "/" && next !== "*" && next !== "/" && i >= noRegexBefore && (prev === "" || REGEX_PRECEDER2.includes(prev))) {
+      const end = regexLiteralEnd3(code, i);
+      if (end > 0) {
+        i = end;
+        prev = "a";
+        continue;
+      }
+      const eol = code.indexOf("\n", i);
+      noRegexBefore = eol === -1 ? code.length : eol;
+    }
     if (ch === "/" && next === "*") {
       const end = code.indexOf("*/", i + 2);
       const stop = end === -1 ? code.length : end + 2;
@@ -3766,11 +3780,39 @@ function stripCoverageComments(code) {
     }
     if (ch === '"' || ch === "'" || ch === "`")
       quote = ch;
+    if (ch !== " " && ch !== "	" && ch !== "\n" && ch !== "\r")
+      prev = ch;
     i++;
   }
   out.push(code.slice(copyFrom));
   return out.join("");
 }
+function regexLiteralEnd3(code, start) {
+  let inClass = false;
+  for (let j = start + 1; j < code.length; j++) {
+    const c = code[j];
+    if (c === "\n")
+      return -1;
+    if (c === "\\") {
+      j++;
+      continue;
+    }
+    if (inClass) {
+      if (c === "]")
+        inClass = false;
+      continue;
+    }
+    if (c === "[")
+      inClass = true;
+    else if (c === "/") {
+      let k = j + 1;
+      while (k < code.length && isIdentChar(code[k]))
+        k++;
+      return k;
+    }
+  }
+  return -1;
+}
 function isIdentChar(ch) {
   if (!ch)
     return false;
@@ -4428,7 +4470,7 @@ function assessTitleCoverage(title, code) {
   const repeatedHit = [...repeated].some((term) => hay.includes(term));
   return { covered: hit >= needed || repeatedHit, missingTerms };
 }
-var COVERAGE_STOP_WORDS, MAX_ASSERTION_JOIN_CHARS, MAX_COVERAGE_LINE_CHARS, BLOCK_SCAFFOLD, cachedAssertionInput, cachedAssertionSource, LOCAL_BINDING, ASSERTED_STATUS_RE, MAX_RESOLVED_NAMES_PER_LINE, WORD_CHAR_RE, NOT_CONTAIN_TEXT_RE, PLACE_PHRASE_RE, PLACE_WORD_MIN_CHARS, PLACE_FUNCTION_WORDS, HIDDEN_STATE_TERMS, HIDDEN_ELEMENT_LINE_RE, HIDDEN_LINE_RE, MAX_SHOWN_EARLIER_LINES, SHOWN_EARLIER_LITERAL_RE, SHARED_PREFIX_MIN_CHARS, MAX_SHOWN_EARLIER_LITERALS, VALUE_SHAPE_RE, VALUE_SHAPE_ALL_RE, TITLE_TERM_MIN;
+var COVERAGE_STOP_WORDS, MAX_ASSERTION_JOIN_CHARS, MAX_COVERAGE_LINE_CHARS, REGEX_PRECEDER2, BLOCK_SCAFFOLD, cachedAssertionInput, cachedAssertionSource, LOCAL_BINDING, ASSERTED_STATUS_RE, MAX_RESOLVED_NAMES_PER_LINE, WORD_CHAR_RE, NOT_CONTAIN_TEXT_RE, PLACE_PHRASE_RE, PLACE_WORD_MIN_CHARS, PLACE_FUNCTION_WORDS, HIDDEN_STATE_TERMS, HIDDEN_ELEMENT_LINE_RE, HIDDEN_LINE_RE, MAX_SHOWN_EARLIER_LINES, SHOWN_EARLIER_LITERAL_RE, SHARED_PREFIX_MIN_CHARS, MAX_SHOWN_EARLIER_LITERALS, VALUE_SHAPE_RE, VALUE_SHAPE_ALL_RE, TITLE_TERM_MIN;
 var init_expected_outcome_coverage = __esm({
   "../shared/dist/expected-outcome-coverage.js"() {
     "use strict";
@@ -4465,6 +4507,7 @@ var init_expected_outcome_coverage = __esm({
     ]);
     MAX_ASSERTION_JOIN_CHARS = 8e3;
     MAX_COVERAGE_LINE_CHARS = 2e3;
+    REGEX_PRECEDER2 = "(,=:[!&|?{};+-*%<>~^";
     BLOCK_SCAFFOLD = /=>|\b(?:test|describe|it|beforeEach|afterEach|beforeAll|afterAll|function)\b/;
     cachedAssertionInput = null;
     cachedAssertionSource = { raw: "", normalized: "", bindings: /* @__PURE__ */ new Map(), bindingRefs: /* @__PURE__ */ new Map() };
@@ -4915,7 +4958,7 @@ function detectsErrorBannerAssertion(code) {
   const cleaned = stripCommentsAndLogs(stripLoginScaffolding(code));
   const lines = cleaned.split("\n");
   const candidates = [];
-  const positive = (stmt) => !NEGATED_ASSERT.test(stmt) && !ABSENCE_MATCHER.test(stmt);
+  const positive = (stmt) => !claimsAbsence(stmt);
   const statements = liveExpectStatements(cleaned).map((s) => s.stmt);
   for (const stmt of statements) {
     if (positive(stmt))
@@ -5044,6 +5087,12 @@ function detectsObservedFailureAsExpected(code) {
     return FAILURE_STATUS_ASSERT.some((re) => re.test(stmt)) || hasFailedListener && FAILED_LIST_ASSERT.test(stmt);
   });
 }
+function claimsAbsence(stmt) {
+  const negated = NEGATED_ASSERT_NOT.test(stmt);
+  const bare = negated ? stmt.replace(NOT_BEFORE_MATCHER, ".") : stmt;
+  const absenceMatcher = /\.toBeHidden\s*\(|\.toHaveCount\s*\(\s*0\s*\)/.test(bare) || VALUE_ABSENCE.test(bare) || OPTION_ABSENCE.test(bare);
+  return negated !== absenceMatcher;
+}
 function isVacuousErrorAbsence(stmt, presence) {
   if (!ABSENCE_MATCHER.test(stmt))
     return false;
@@ -5059,19 +5108,53 @@ function isChromeTarget(stmt) {
   return CHROME_LOCATOR.test(stmt) && !CONTENT_ROLE.test(stmt) && !/getByText\s*\(/.test(stmt);
 }
 function countsAsContentText(stmt) {
-  if (!TEXT_CONTENT_MATCHER.test(stmt))
+  if (!TEXT_CONTENT_MATCHER.test(stmt) || NEGATED_ASSERT.test(stmt))
     return false;
   if (isSymbolOnlyArgument(stmt, TEXT_CONTENT_MATCHER))
     return false;
-  if (!isChromeTarget(stmt))
+  return onContentTarget(stmt);
+}
+function onContentTarget(stmt) {
+  return !isChromeTarget(stmt) || /getByRole\s*\(\s*['"`]main['"`]/i.test(stmt);
+}
+function provesTextRemoved(stmt, presence) {
+  const m = stmt.match(NEGATED_TEXT);
+  if (!m || !onContentTarget(stmt))
+    return false;
+  const text = m[1] ?? m[2];
+  if (text === void 0)
     return true;
-  return /getByRole\s*\(\s*['"`]main['"`]/i.test(stmt);
+  if (!/[\p{L}\p{N}]/u.test(text))
+    return false;
+  return !ERROR_TEXT_WORDS.test(text) || presence().includes(text);
 }
 function isDataContentRole(stmt) {
   return CONTENT_ROLE.test(stmt) && !ANNOUNCE_ROLE.test(stmt);
 }
+function destructuresRequest(code) {
+  let readTo = -1;
+  for (const m of code.matchAll(ASYNC_DESTRUCTURE_OPEN)) {
+    const start = m.index + m[0].length;
+    if (start <= readTo)
+      continue;
+    let end = start;
+    while (end < code.length && code[end] !== "}" && code[end] !== ")")
+      end++;
+    readTo = end;
+    if (end === code.length)
+      return false;
+    if (code[end] !== "}" || !REQUEST_WORD.test(code.slice(start, end)))
+      continue;
+    let close = end + 1;
+    while (close < code.length && /\s/.test(code[close]))
+      close++;
+    if (code[close] === ")")
+      return true;
+  }
+  return false;
+}
 function isApiTest(code) {
-  const usesRequestFixture = /async\s*\(\s*\{[^})]*\brequest\b[^})]*\}\s*\)/.test(code) || /\brequest\.(get|post|put|patch|delete|head|fetch)\s*\(/.test(code);
+  const usesRequestFixture = destructuresRequest(code) || /\brequest\.(get|post|put|patch|delete|head|fetch)\s*\(/.test(code);
   if (!usesRequestFixture)
     return false;
   const drivesUi = /\bpage\.(getBy\w+|locator|click|fill|goto|waitForURL|reload)\s*\(/.test(code) || /\.(click|fill|check|uncheck|selectOption|pressSequentially)\s*\(/.test(code);
@@ -5330,6 +5413,9 @@ function hasOnlyConstantAssertions(code) {
   const { constant, real } = constantAssertions(code);
   return constant.length > 0 && real === 0;
 }
+function envValueKey(name) {
+  return `\0env:${name}`;
+}
 function enteredValues(stmts) {
   const values = /* @__PURE__ */ new Map();
   const navLines = [];
@@ -5338,24 +5424,55 @@ function enteredValues(stmts) {
       navLines.push(startLine);
     let m;
     ENTERED_VALUE.lastIndex = 0;
-    while (m = ENTERED_VALUE.exec(stmt)) {
-      const value = (m[1] ?? m[2] ?? m[3]).toLowerCase();
-      if (!values.has(value))
-        values.set(value, startLine);
-    }
+    const add = (value) => {
+      const lines = values.get(value);
+      if (!lines)
+        values.set(value, [startLine]);
+      else if (lines[lines.length - 1] !== startLine)
+        lines.push(startLine);
+    };
+    while (m = ENTERED_VALUE.exec(stmt))
+      add((m[1] ?? m[2] ?? m[3]).toLowerCase());
+    ENTERED_ENV.lastIndex = 0;
+    while (m = ENTERED_ENV.exec(stmt))
+      add(envValueKey(m[1] ?? m[2] ?? m[3] ?? m[4]));
   }
   return { values, navLines };
 }
-function isEnteredValueEcho(stmt, entered, startLine) {
+function countBelow(lines, line) {
+  let lo = 0;
+  let hi = lines.length;
+  while (lo < hi) {
+    const mid = lo + hi >> 1;
+    if (lines[mid] < line)
+      lo = mid + 1;
+    else
+      hi = mid;
+  }
+  return lo;
+}
+function enteredLinesOf(stmt, entered) {
   const m = stmt.match(/\.toHaveValue\s*\(\s*(['"`])((?:(?!\1).)+)\1/);
-  if (!m)
+  if (m)
+    return entered.values.get(m[2].toLowerCase());
+  const env = stmt.match(HAVE_VALUE_ENV);
+  return env ? entered.values.get(envValueKey(env[1] ?? env[2])) : void 0;
+}
+function typedSinceLastNav(stmt, entered, startLine, lines = enteredLinesOf(stmt, entered)) {
+  if (!lines || startLine === void 0)
     return false;
-  const enteredAt = entered.values.get(m[2].toLowerCase());
-  if (enteredAt === void 0)
+  const before = countBelow(lines, startLine);
+  if (before === 0)
     return false;
-  if (startLine === void 0)
+  return countBelow(entered.navLines, startLine) === countBelow(entered.navLines, lines[before - 1] + 1);
+}
+function isEnteredValueEcho(stmt, entered, startLine) {
+  const lines = enteredLinesOf(stmt, entered);
+  if (!lines)
+    return false;
+  if (startLine === void 0 || lines[0] >= startLine)
     return true;
-  return !entered.navLines.some((n) => n > enteredAt && n < startLine);
+  return typedSinceLastNav(stmt, entered, startLine, lines);
 }
 function isAnyValueMatcher(stmt) {
   if (/\.not\.toHaveValue\s*\(\s*(?:['"`]{2}|\/\^?\$?\/)/.test(stmt))
@@ -5445,6 +5562,43 @@ function hasAttributeTransition(stmts) {
       return true;
   return false;
 }
+function comparesWithItself(subject, tail) {
+  const m = SELF_COMPARE_MATCHER.exec(tail);
+  if (!m)
+    return false;
+  const args = balancedArguments(tail, m[0].length, MATCHER_ARGS_MAX);
+  if (args === null)
+    return false;
+  const squash2 = (x) => x.replace(/^\s*await\s+/, "").replace(/\s+/g, "");
+  const expected = squash2(args);
+  return expected === squash2(m[1] === "toHaveCount" ? `${subject}.count()` : subject);
+}
+function asPlainAssertion(s) {
+  const { stmt } = s;
+  if (COUNT_AT_LEAST_ZERO.test(stmt))
+    return [];
+  const subject = extractExpectSubject(stmt);
+  if (subject === null)
+    return [s];
+  const plain = subject.replace(/^await\s+/, "").trim();
+  const subjectAt = stmt.indexOf(subject, stmt.search(EXPECT_CALL_RE));
+  const tail = stmt.slice(subjectAt + subject.length).trimStart();
+  const as = (rewritten) => [{ ...s, stmt: rewritten }];
+  if (LOCATOR_EXPR.test(plain) && !LOCATOR_VALUE_READ.test(plain) && ALWAYS_TRUE_ON_OBJECT.test(tail))
+    return [];
+  if (DEFINED_VALUE_READ.test(plain) && ALWAYS_DEFINED.test(tail))
+    return [];
+  if (comparesWithItself(plain, tail))
+    return [];
+  const visible = /^(.+)\.\s*isVisible\s*\(\s*\)$/s.exec(plain);
+  if (visible && IS_VISIBLE_TRUE.test(tail))
+    return as(`await expect(${visible[1]}).toBeVisible();`);
+  if (/^page\s*\.\s*(?:url|title)\s*\(\s*\)$/.test(plain) && PAGE_VALUE_MATCHER.test(tail)) {
+    const matcher = plain.includes("url") ? "toHaveURL" : "toHaveTitle";
+    return as(`await expect(page)${tail.replace(/^\)\s*\.\s*\w+\s*\(/, `.${matcher}(`)}`);
+  }
+  return [s];
+}
 function creditsOutcomeAlways(stmt, entered, startLine) {
   if (!OUTCOME_ALWAYS.some((re) => re.test(stmt)))
     return false;
@@ -5518,6 +5672,8 @@ function classifyOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstM
       continue;
     if (isVacuousErrorAbsence(stmt, presence))
       continue;
+    if (COUNT_ONE.test(stmt) && quotedAssertedStrings(stmt).some((t) => clicked.has(t.toLowerCase())))
+      continue;
     if (creditsOutcomeAlways(stmt, entered, startLine))
       return { kind: "durable" };
     if (mutated && !NEGATED_ASSERT.test(stmt) && MESSAGE_SURFACE.test(stmt) && OUTCOME_TEXT.test(assertedText(stmt))) {
@@ -5527,12 +5683,15 @@ function classifyOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstM
       else
         return { kind: "durable" };
     }
-    if (STATE_MATCHER.test(stmt) && (persistence && startLine !== void 0 ? reopenedAfterSave(startLine, persistence, persistence.reloadCalls) : reloaded))
+    const retyped = typedSinceLastNav(stmt, entered, startLine);
+    if (!retyped && STATE_MATCHER.test(stmt) && (persistence && startLine !== void 0 ? reopenedAfterSave(startLine, persistence, persistence.reloadCalls) : reloaded))
       return { kind: "durable" };
-    if (provesStoredControlValue(stmt, startLine, persistence))
+    if (!retyped && provesStoredControlValue(stmt, startLine, persistence))
       return { kind: "durable" };
     if (countsAsContentText(stmt))
       return { kind: "durable" };
+    if (provesTextRemoved(stmt, presence))
+      return { kind: "durable" };
     if (mutated && VISIBILITY_MATCHER.test(stmt)) {
       const revealsText = GET_BY_TEXT.test(stmt) || HAS_TEXT_FILTER.test(stmt) || CONTENT_ROLE.test(stmt);
       if (revealsText && !isChromeTarget(stmt)) {
@@ -5599,7 +5758,7 @@ function detectOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstMut
 function validateAssertionStrength(code, opts = {}) {
   const body = stripLoginScaffolding(code);
   const lines = body.split("\n");
-  const stmts = liveExpectStatements(stripCoverageComments(body));
+  const stmts = liveExpectStatements(stripCoverageComments(body)).flatMap(asPlainAssertion);
   const base = (extra) => ({
     apiTest: false,
     interacted: false,
@@ -5805,7 +5964,7 @@ function validateAssertionStrength(code, opts = {}) {
     signals
   };
 }
-var ERROR_BANNER, OUTCOME_ALWAYS, FORM_INPUT, ANY_CLICK, NAV_LOCATOR, URL_PROOF, RELOAD, EXPECT_STMT, BLOCK_SCAFFOLD2, TEST_BLOCK_OPEN, LOCATOR_BINDING, EXPECT_OPEN, STATE_MATCHER, CHROME_LOCATOR, CONTENT_ROLE, GET_BY_TEXT, BARE_CONTAINER_ROLE, HAS_TEXT_FILTER, OUTCOME_TEXT, SUCCESS_NOTICE_TEXT, NOT_A_SUCCESS_NOTICE, ANNOUNCE_ROLE, MESSAGE_SURFACE, TEXT_CONTENT_MATCHER, VISIBILITY_MATCHER, ADDITIVE_AFFORDANCE, EXCLUDE_AFFORDANCE, EMPTY_STATE_TEXT, AUTH_START, AUTH_END, LOGIN_CALL_LINE, INBOX_START, INBOX_END, NEGATED_ASSERT, CONST_CHAIN_MAX_DEPTH, TYPED_INPUT, TITLE_LINE, FAILURE_STATUS_ASSERT, FAILED_LIST_ASSERT, ENDPOINT_DOWN, NAVIGATION_RESPONSE_VAR, DIRECT_REQUEST_VAR, CATCH_ALL_PATTERN, GUARD_HANDLER, ABSENCE_MATCHER, ERROR_TEXT_WORDS, TEXT_REGEX_ARG, ROLE_NAME_RE, INTERACT_VERB, ROLE_SIG_RE, TRANSIENT_CONTROL_ROLES, POLL_CALLBACK, CONSTANT_WORD, CONSTANT_GLUE_CHARS, WORD_CHAR, MATCHER_ARGS_MAX, MATCHER_OPEN, ENTERED_VALUE, PAGE_NAV, IN_FLIGHT_TEXT, FORM_CONTROL_LOCATOR, CONTROL_VALUE_MATCHER, COPY_CONTROL, COPIED_NOTICE, SEND_CONTROL, SEND_NOTICE, MARK_READ_CONTROL, APP_DATA_FIELD;
+var ERROR_BANNER, OUTCOME_ALWAYS, FORM_INPUT, ANY_CLICK, NAV_LOCATOR, URL_PROOF, RELOAD, EXPECT_STMT, BLOCK_SCAFFOLD2, TEST_BLOCK_OPEN, LOCATOR_BINDING, EXPECT_OPEN, STATE_MATCHER, CHROME_LOCATOR, CONTENT_ROLE, GET_BY_TEXT, BARE_CONTAINER_ROLE, HAS_TEXT_FILTER, OUTCOME_TEXT, SUCCESS_NOTICE_TEXT, NOT_A_SUCCESS_NOTICE, ANNOUNCE_ROLE, MESSAGE_SURFACE, TEXT_CONTENT_MATCHER, VISIBILITY_MATCHER, ADDITIVE_AFFORDANCE, EXCLUDE_AFFORDANCE, EMPTY_STATE_TEXT, AUTH_START, AUTH_END, LOGIN_CALL_LINE, INBOX_START, INBOX_END, NEGATED_ASSERT, NEGATED_ASSERT_NOT, CONST_CHAIN_MAX_DEPTH, TYPED_INPUT, TITLE_LINE, FAILURE_STATUS_ASSERT, FAILED_LIST_ASSERT, ENDPOINT_DOWN, NAVIGATION_RESPONSE_VAR, DIRECT_REQUEST_VAR, CATCH_ALL_PATTERN, GUARD_HANDLER, ABSENCE_MATCHER, VALUE_ABSENCE, OPTION_ABSENCE, NOT_BEFORE_MATCHER, ERROR_TEXT_WORDS, TEXT_REGEX_ARG, NEGATED_TEXT, ASYNC_DESTRUCTURE_OPEN, REQUEST_WORD, ROLE_NAME_RE, INTERACT_VERB, ROLE_SIG_RE, TRANSIENT_CONTROL_ROLES, POLL_CALLBACK, CONSTANT_WORD, CONSTANT_GLUE_CHARS, WORD_CHAR, MATCHER_ARGS_MAX, MATCHER_OPEN, ENTERED_VALUE, PAGE_NAV, ENV_READ, ENTERED_ENV, HAVE_VALUE_ENV, IN_FLIGHT_TEXT, LOCATOR_VALUE_READ, LOCATOR_EXPR, ALWAYS_TRUE_ON_OBJECT, COUNT_AT_LEAST_ZERO, DEFINED_VALUE_READ, ALWAYS_DEFINED, SELF_COMPARE_MATCHER, IS_VISIBLE_TRUE, PAGE_VALUE_MATCHER, COUNT_ONE, FORM_CONTROL_LOCATOR, CONTROL_VALUE_MATCHER, COPY_CONTROL, COPIED_NOTICE, SEND_CONTROL, SEND_NOTICE, MARK_READ_CONTROL, APP_DATA_FIELD;
 var init_assertion_strength = __esm({
   "../shared/dist/assertion-strength.js"() {
     "use strict";
@@ -5830,8 +5989,8 @@ var init_assertion_strength = __esm({
       // form field value
       /\.toMatch\s*\(/,
       // string/regex content match (e.g. textContent() vs /[2-9] selected/)
-      /\.toBeDisabled\s*\(/,
-      // a control became DISABLED — a gating/validation outcome
+      /(?<!\.not\s*)\.\s*toBeDisabled\s*\(/,
+      // a control became DISABLED — a gating/validation outcome (not.toBeDisabled is the toBeEnabled twin)
       /\.not\.toBeVisible\s*\(/,
       /\.toBeHidden\s*\(/
       // something the action removed/closed (disappearance proof)
@@ -5839,7 +5998,7 @@ var init_assertion_strength = __esm({
     FORM_INPUT = /\.(fill|selectOption|setInputFiles|check|uncheck|setChecked|pressSequentially)\s*\(|keyboard\.type\s*\(/;
     ANY_CLICK = /\.click\s*\(/;
     NAV_LOCATOR = /getByRole\s*\(\s*['"`](?:link|menuitem)['"`]/i;
-    URL_PROOF = /\.toHaveURL\s*\(|\.waitForURL\s*\(/;
+    URL_PROOF = /\.toHaveURL\s*\(|\.waitForURL\s*\(|\bexpect\s*\(\s*(?:await\s+)?page\s*\.\s*url\s*\(\s*\)\s*\)|\bexpect\s*\.\s*poll\s*\(\s*(?:async\s*)?\(\s*\)\s*=>\s*(?:\{\s*return\s+)?page\s*\.\s*url\s*\(\s*\)/;
     RELOAD = /\.reload\s*\(/;
     EXPECT_STMT = /\bexpect\s*[.(]/;
     BLOCK_SCAFFOLD2 = /=>|\b(?:test|describe|it|beforeEach|afterEach|beforeAll|afterAll|function)\b/;
@@ -5868,6 +6027,7 @@ var init_assertion_strength = __esm({
     INBOX_START = /^\s*\/\/\s*>>>\s*VALIDATE_QA_INBOX/;
     INBOX_END = /^\s*\/\/\s*<<<\s*VALIDATE_QA_INBOX/;
     NEGATED_ASSERT = /\.not\s*\.\s*to[A-Z]\w*|\.toBeHidden\s*\(/;
+    NEGATED_ASSERT_NOT = /\.not\s*\.\s*to[A-Z]/;
     CONST_CHAIN_MAX_DEPTH = 5;
     TYPED_INPUT = /\.(fill|type|pressSequentially|setInputFiles)\s*\(/;
     TITLE_LINE = /^\s*(?:test|describe)(?:\.\w+)?\s*\(/;
@@ -5883,8 +6043,14 @@ var init_assertion_strength = __esm({
     CATCH_ALL_PATTERN = /^(['"`])\*\*(?:\/\*)?\1$|^\/\.\*\/[a-z]*$/;
     GUARD_HANDLER = /\bMUTATING\.has\s*\(|blockedbyclient|Read-only guard/;
     ABSENCE_MATCHER = /\.not\.toBeVisible\s*\(|\.toBeHidden\s*\(|\.toHaveCount\s*\(\s*0\s*\)/;
+    VALUE_ABSENCE = /\.(?:count\s*\(\s*\)[\s)]{0,10}\.(?:(?:toBe|toEqual|toStrictEqual)\s*\(\s*0\s*\)|toBeLessThan\s*\(\s*1\s*\))|isVisible\s*\(\s*\)[\s)]{0,10}\.(?:(?:toBe|toEqual|toStrictEqual)\s*\(\s*false\s*\)|toBeFalsy\s*\()|isHidden\s*\(\s*\)[\s)]{0,10}\.(?:(?:toBe|toEqual|toStrictEqual)\s*\(\s*true\s*\)|toBeTruthy\s*\())/;
+    OPTION_ABSENCE = /\.(?:toBeVisible\s*\(\s*\{[^{}()]{0,200}\bvisible|toBeAttached\s*\(\s*\{[^{}()]{0,200}\battached)\s*:\s*false\b/;
+    NOT_BEFORE_MATCHER = /\.not\s*\.\s*(?=to[A-Z])/g;
     ERROR_TEXT_WORDS = /error|fail|wrong|try again|unable|could ?n.?t|can.?t|problem|invalid|unavailable/i;
     TEXT_REGEX_ARG = /(?:getByText|hasText|getByRole\([^)]{0,200}name)\s*[:(]\s*(\/(?:\\.|[^/\\\n])+\/[a-z]*)/;
+    NEGATED_TEXT = /\.not\s*\.\s*(?:toHaveText|toContainText)\s*\(\s*(?:['"`]([^'"`]*)['"`]|\/((?:\\.|[^/\\\n])+)\/)?/;
+    ASYNC_DESTRUCTURE_OPEN = /async\s*\(\s*\{/g;
+    REQUEST_WORD = /\brequest\b/;
     ROLE_NAME_RE = /getByRole\s*\(\s*['"`][a-z]+['"`]\s*,\s*\{[^}]*?name\s*:\s*(?:['"`]([^'"`]+)['"`]|\/([^/]+)\/)/gi;
     INTERACT_VERB = /\.(click|fill|check|uncheck|setChecked|selectOption|pressSequentially)\s*\(/;
     ROLE_SIG_RE = /getByRole\s*\(\s*['"`]([a-z]+)['"`]\s*,\s*\{[^}]*?name\s*:\s*(?:['"`]([^'"`]+)['"`]|\/([^/]+)\/)/gi;
@@ -5905,7 +6071,20 @@ var init_assertion_strength = __esm({
     MATCHER_OPEN = /\s*(?:\.\s*(?:not|resolves|rejects)\s*)*\.\s*[A-Za-z_$][\w$]*\s*\(/y;
     ENTERED_VALUE = /\.(?:fill|pressSequentially)\s*\(\s*['"`]([^'"`]+)['"`]|keyboard\.type\s*\(\s*['"`]([^'"`]+)['"`]|\.selectOption\s*\(\s*(?:\[\s*)?(?:\{\s*(?:label|value)\s*:\s*)?['"`]([^'"`]+)['"`]/g;
     PAGE_NAV = /\.(?:goto|reload)\s*\(/;
+    ENV_READ = String.raw`process\.env(?:(?:\?\.|\.)([A-Za-z_]\w*)|(?:\?\.)?\[\s*['"]([A-Za-z_]\w*)['"]\s*\])`;
+    ENTERED_ENV = new RegExp(String.raw`\.(?:fill|pressSequentially)\s*\(\s*${ENV_READ}|keyboard\.type\s*\(\s*${ENV_READ}`, "g");
+    HAVE_VALUE_ENV = new RegExp(String.raw`\.toHaveValue\s*\(\s*${ENV_READ}`);
     IN_FLIGHT_TEXT = /^(?:(?:sending|saving|loading|searching|checking|processing|submitting|preparing|updating|please wait|working|one moment)\b[^.]{0,40}\.{2,3}|\.{3}|…)$/i;
+    LOCATOR_VALUE_READ = /\.(?:count|textContent|innerText|innerHTML|inputValue|getAttribute|isVisible|isHidden|isChecked|isEnabled|isDisabled|isEditable|allTextContents|allInnerTexts|evaluate|evaluateAll|boundingBox|all)\s*\(/;
+    LOCATOR_EXPR = /^(?:this\.)?page\s*\.\s*(?:getBy\w+|locator)\s*\(/;
+    ALWAYS_TRUE_ON_OBJECT = /^\)\s*\.\s*(?:toBeTruthy|toBeDefined|not\s*\.\s*(?:toBeNull|toBeUndefined|toBeFalsy))\s*\(/;
+    COUNT_AT_LEAST_ZERO = /\.(?:count\s*\(\s*\)|length)[\s)]{0,10}\.(?:toBeGreaterThanOrEqual\s*\(\s*0\s*\)|toBeGreaterThan\s*\(\s*-\s*1\s*\))/;
+    DEFINED_VALUE_READ = /\.\s*(?:count|textContent|innerText|innerHTML|inputValue|getAttribute|title|url|isVisible|isHidden|isChecked|isEnabled|isDisabled|isEditable|allTextContents|allInnerTexts)\s*\([^()]*\)$/;
+    ALWAYS_DEFINED = /^\)\s*\.\s*(?:toBeDefined|not\s*\.\s*toBeUndefined)\s*\(/;
+    SELF_COMPARE_MATCHER = /^\)\s*\.\s*(toBe|toEqual|toStrictEqual|toHaveCount)\s*\(/;
+    IS_VISIBLE_TRUE = /^\)*\s*\.\s*(?:toBe\s*\(\s*true\s*\)|toBeTruthy\s*\(\s*\))/;
+    PAGE_VALUE_MATCHER = /^\)\s*\.\s*(?:toBe|toEqual|toStrictEqual|toMatch|toContain)\s*\(/;
+    COUNT_ONE = /\.\s*toHaveCount\s*\(\s*1\s*\)/;
     FORM_CONTROL_LOCATOR = /getByRole\s*\(\s*['"`](?:combobox|switch|checkbox|radio|textbox|searchbox|spinbutton|slider)['"`]|getByLabel\s*\(|getByPlaceholder\s*\(/;
     CONTROL_VALUE_MATCHER = /\.(?:toHaveValue|toHaveText|toContainText)\s*\(|\.toHaveAttribute\s*\(\s*['"`]aria-checked['"`]/;
     COPY_CONTROL = /\bcopy\b/i;
@@ -6114,7 +6293,7 @@ function reportedBugWhere() {
 function bugReviewStatus(status) {
   return status === "QUARANTINED" ? "confirmed" : "needs-review";
 }
-var USER_CANCELLED_RUN_ERROR, HEAL_PATCH_HELD_RUN_ERROR_PREFIX, RUNNER_INTERRUPT_ERROR_PREFIX, SERVER_INTERRUPT_ERROR_PREFIX, RUN_LOST_ERROR_PREFIX, RUN_INTERRUPTED_ERROR_PREFIXES, RUN_INTERRUPTION_RETRIED_MARKER, RUN_INTERRUPTION_NOT_RETRIED_MARKERS, BUG_ASSERTION_TAG, UNEXPECTED_PASS_ERROR_PREFIX, BUG_TEST_BROKEN_ERROR_PREFIX, BUG_TEST_BROKEN_REASON, EMAIL_NOT_RECEIVED_PREFIXES, ENVIRONMENTAL_ERROR_PREFIXES, ENVIRONMENTAL_ERROR_STORED_PREFIXES, BUG_SURFACE_SUPPRESSING_TAGS, QUARANTINE_CLOSE_TAGS, BUG_CANDIDATE_TAG, BUG_TEST_BROKEN_TAG;
+var USER_CANCELLED_RUN_ERROR, HEAL_PATCH_HELD_RUN_ERROR_PREFIX, RUNNER_INTERRUPT_ERROR_PREFIX, SERVER_INTERRUPT_ERROR_PREFIX, RUN_LOST_ERROR_PREFIX, RUN_INTERRUPTED_ERROR_PREFIXES, RUN_INTERRUPTION_RETRIED_MARKER, RUN_INTERRUPTION_NOT_RETRIED_MARKERS, BUG_ASSERTION_TAG, UNEXPECTED_PASS_ERROR_PREFIX, BUG_TEST_BROKEN_ERROR_PREFIX, BUG_TEST_BROKEN_REASON, TEST_DID_NOT_RUN_ERROR, EMAIL_NOT_RECEIVED_PREFIXES, ENVIRONMENTAL_ERROR_PREFIXES, ENVIRONMENTAL_ERROR_STORED_PREFIXES, BUG_SURFACE_SUPPRESSING_TAGS, QUARANTINE_CLOSE_TAGS, BUG_CANDIDATE_TAG, BUG_TEST_BROKEN_TAG;
 var init_run_classification = __esm({
   "../shared/dist/run-classification.js"() {
     "use strict";
@@ -6134,6 +6313,7 @@ var init_run_classification = __esm({
     UNEXPECTED_PASS_ERROR_PREFIX = "UNEXPECTED_PASS:";
     BUG_TEST_BROKEN_ERROR_PREFIX = "BUG_TEST_BROKEN:";
     BUG_TEST_BROKEN_REASON = "bug test broken (not a bug verdict)";
+    TEST_DID_NOT_RUN_ERROR = "Test did not run (a dependency failed or the run was interrupted)";
     EMAIL_NOT_RECEIVED_PREFIXES = [
       "VERIFICATION_EMAIL_NOT_RECEIVED:",
       "VERIFICATION_EMAIL_HAS_NO_CODE:",
@@ -8875,6 +9055,23 @@ var init_auth_block_detector = __esm({
   }
 });
 
+// ../shared/dist/auth-session-stamp.js
+function parseAuthSessionStamp(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const { shared, role, generation } = value;
+  if (shared !== true || role !== "producer" && role !== "follower")
+    return null;
+  return typeof generation === "string" && AUTH_SESSION_GENERATION_RE.test(generation) ? { shared: true, role, generation } : { shared: true, role };
+}
+var AUTH_SESSION_GENERATION_RE;
+var init_auth_session_stamp = __esm({
+  "../shared/dist/auth-session-stamp.js"() {
+    "use strict";
+    AUTH_SESSION_GENERATION_RE = /^[0-9a-z]{1,16}$/;
+  }
+});
+
 // ../shared/dist/auth-state-freshness.js
 function isCsrfTokenName(name) {
   return /csrf|xsrf|forgery|authenticity|requestverification/.test(name.toLowerCase());
@@ -10103,7 +10300,7 @@ var init_agentic_cli_runtime = __esm({
     GROK_CLI_DEFAULT_MODEL = "grok-4.7";
     GROK_CLI_DEFAULT_REASONING_EFFORT = "high";
     CLAUDE_CLI_DEFAULT_MODEL = "claude-sonnet-5-5";
-    CLAUDE_CLI_DEFAULT_EFFORT = "max";
+    CLAUDE_CLI_DEFAULT_EFFORT = "high";
     MUSE_CLI_DEFAULT_MODEL = "muse-spark-1.3-contributor";
     MUSE_CLI_DEFAULT_EFFORT = "high";
     CODEX_CLI_DEFAULT_MODEL = "gpt-6.1-sol";
@@ -10154,9 +10351,25 @@ function isOpenCodeGoModelId(id) {
 function hasOpenCodeGoPrefix(id) {
   return (id?.trim() ?? "").startsWith(OPENCODE_GO_PREFIX);
 }
+function hasOpenCodeGo2Prefix(id) {
+  return (id?.trim() ?? "").startsWith(OPENCODE_GO_2_PREFIX);
+}
 function openCodeGoWireModel(id) {
   const trimmed = id?.trim() ?? "";
-  return isOpenCodeGoModelId(trimmed) ? trimmed.slice(OPENCODE_GO_PREFIX.length) : null;
+  if (!isOpenCodeGoModelId(trimmed))
+    return null;
+  return trimmed.slice((hasOpenCodeGo2Prefix(trimmed) ? OPENCODE_GO_2_PREFIX : OPENCODE_GO_PREFIX).length);
+}
+function isZaiModelId(id) {
+  const trimmed = id?.trim() ?? "";
+  return ZAI_MODEL_PATTERN.test(trimmed) && !trimmed.includes("..");
+}
+function hasZaiPrefix(id) {
+  return (id?.trim() ?? "").startsWith(ZAI_PREFIX);
+}
+function zaiWireModel(id) {
+  const trimmed = id?.trim() ?? "";
+  return isZaiModelId(trimmed) ? trimmed.slice(ZAI_PREFIX.length) : null;
 }
 function isEngineId(value) {
   return CLI_ENGINE_MODEL_IDS.includes(value);
@@ -10254,7 +10467,7 @@ function museCliContributorMode(env = process.env) {
   const raw = (env.MUSE_CLI_CONTRIBUTOR_MODE ?? "").trim().toLowerCase();
   return raw === "off" || raw === "false" || raw === "0" || raw === "no" ? "off" : "on";
 }
-var CLI_ENGINE_MODEL_IDS, BROWSER_CLI_ENGINE_IDS, PIPELINE_STEPS, CLI_ENGINE_RULES, ENGINE_NAMES, OPENROUTER_PREFIX, OPENROUTER_MODEL_PATTERN, OPENCODE_GO_PREFIX, OPENCODE_GO_MODEL_PATTERN;
+var CLI_ENGINE_MODEL_IDS, BROWSER_CLI_ENGINE_IDS, PIPELINE_STEPS, CLI_ENGINE_RULES, ENGINE_NAMES, OPENROUTER_PREFIX, OPENROUTER_MODEL_PATTERN, OPENCODE_GO_PREFIX, OPENCODE_GO_2_PREFIX, OPENCODE_GO_MODEL_PATTERN, ZAI_PREFIX, ZAI_MODEL_PATTERN;
 var init_engine_spec = __esm({
   "../shared/dist/engine-spec.js"() {
     "use strict";
@@ -10313,7 +10526,10 @@ var init_engine_spec = __esm({
     OPENROUTER_PREFIX = "openrouter:";
     OPENROUTER_MODEL_PATTERN = /^openrouter:[a-z0-9][a-z0-9._-]{0,40}\/[A-Za-z0-9._:-]{1,100}$/;
     OPENCODE_GO_PREFIX = "opencode-go:";
-    OPENCODE_GO_MODEL_PATTERN = /^opencode-go:[a-z0-9][a-z0-9._-]{0,100}$/;
+    OPENCODE_GO_2_PREFIX = "opencode-go-2:";
+    OPENCODE_GO_MODEL_PATTERN = /^opencode-go(?:-2)?:[a-z0-9][a-z0-9._-]{0,100}$/;
+    ZAI_PREFIX = "zai:";
+    ZAI_MODEL_PATTERN = /^zai:glm-[a-z0-9][a-z0-9._-]{0,60}$/;
   }
 });
 
@@ -10598,6 +10814,8 @@ var init_api_model_catalog = __esm({
       authCaptureModel: "Login capture",
       plannerModel: "Scenario Planner",
       plannerGateModel: "Planner Gate",
+      pwAgentsHealerModel: "Test Healer (Playwright agents)",
+      pwAgentsReviewModel: "Plan Review (Playwright agents)",
       generationModel: "Code Generation",
       reviewModel: "Code Review",
       apiTestModel: "API Test Generator",
@@ -10622,11 +10840,6 @@ var init_api_model_catalog = __esm({
 });
 
 // ../shared/dist/provider-chains.js
-function isClaudeModel(id) {
-  if (/claude|anthropic/i.test(id))
-    return true;
-  return API_MODEL_CATALOG.some((m) => m.provider === "anthropic" && (m.id === id || m.apiModel === id));
-}
 function chainKey(modelId) {
   const id = canonicalModelId(modelId);
   if (!id)
@@ -10634,34 +10847,83 @@ function chainKey(modelId) {
   const entry = API_MODEL_CATALOG.find((m) => m.id === id || m.apiModel === id);
   return entry?.id ?? id;
 }
+function has(map, key) {
+  return Object.prototype.hasOwnProperty.call(map, key);
+}
 function providerChainFor(modelId) {
   const key = chainKey(modelId);
-  if (!key || isClaudeModel(key))
-    return [];
-  return Object.prototype.hasOwnProperty.call(PROVIDER_CHAINS, key) ? PROVIDER_CHAINS[key] : [];
+  return key && has(PROVIDER_CHAINS, key) ? PROVIDER_CHAINS[key] : [];
+}
+function providerChainLeadsFor(modelId) {
+  const key = chainKey(modelId);
+  return key && has(PROVIDER_CHAIN_LEADS, key) ? PROVIDER_CHAIN_LEADS[key] : [];
+}
+function allChains() {
+  return [...Object.entries(PROVIDER_CHAINS), ...Object.entries(PROVIDER_CHAIN_LEADS)];
 }
 function isProviderChainHopId(modelId) {
   const id = modelId ?? "";
-  return id !== "" && Object.values(PROVIDER_CHAINS).some((hops) => hops.includes(id));
+  return id !== "" && allChains().some(([, hops]) => hops.includes(id));
 }
 function providerChainPrimariesForHop(hopId) {
   const id = hopId ?? "";
   if (!id)
     return [];
-  return Object.entries(PROVIDER_CHAINS).filter(([, hops]) => hops.includes(id)).map(([primary]) => primary);
+  return allChains().filter(([, hops]) => hops.includes(id)).map(([primary]) => primary);
+}
+function providerChainHostOf(value, modelValue) {
+  if (value === modelValue)
+    return "own";
+  if (hasZaiPrefix(value))
+    return "zai";
+  if (hasOpenCodeGo2Prefix(value))
+    return "opencode-go-2";
+  if (hasOpenCodeGoPrefix(value))
+    return "opencode-go";
+  if (hasOpenRouterPrefix(value))
+    return "openrouter";
+  return "own";
+}
+function providerHostPlan(modelId) {
+  const key = chainKey(modelId);
+  if (!key)
+    return [];
+  const own = { host: hasOpenRouterPrefix(key) ? "openrouter" : "own", value: key };
+  const steps = [
+    ...providerChainLeadsFor(key).map((value) => ({ host: providerChainHostOf(value, key), value })),
+    own,
+    ...providerChainFor(key).map((value) => ({ host: providerChainHostOf(value, key), value }))
+  ];
+  const notOffered = Object.prototype.hasOwnProperty.call(PROVIDER_HOST_NOT_OFFERED, key) ? PROVIDER_HOST_NOT_OFFERED[key] : {};
+  for (const [host, reason] of Object.entries(notOffered)) {
+    const at = steps.findIndex((step) => step === own) + 1;
+    steps.splice(at, 0, { host, value: null, notOffered: reason });
+  }
+  return steps;
 }
-var PROVIDER_CHAINS;
+var PROVIDER_CHAINS, PROVIDER_CHAIN_LEADS, PROVIDER_HOST_NOT_OFFERED;
 var init_provider_chains = __esm({
   "../shared/dist/provider-chains.js"() {
     "use strict";
     init_api_model_catalog();
+    init_engine_spec();
     PROVIDER_CHAINS = {
-      "minimax-m3": ["openrouter:minimax/minimax-m3", "opencode-go:minimax-m3"],
-      "minimax-m3.1-flash": ["openrouter:minimax/minimax-m3.1-flash", "opencode-go:minimax-m3.1-flash"],
+      "minimax-m3": ["opencode-go:minimax-m3", "openrouter:minimax/minimax-m3"],
+      "minimax-m3.1-flash": ["opencode-go:minimax-m3.1-flash", "openrouter:minimax/minimax-m3.1-flash"],
       "muse-spark-1.3-contributor": ["openrouter:meta/muse-spark-1.3-contributor"],
-      "openrouter:z-ai/glm-5.3-flash": ["opencode-go:glm-5.3-flash"],
-      "openrouter:z-ai/glm-5.3": ["opencode-go:glm-5.3"],
-      "openrouter:z-ai/glm-5.2": ["opencode-go:glm-5.2"]
+      "claude-haiku-5-5": ["opencode-go:claude-haiku-5-5", "openrouter:anthropic/claude-haiku-5.5"],
+      "gemini-3.1-pro-preview": ["openrouter:google/gemini-3.1-pro-preview"],
+      "deepseek-flash": ["opencode-go-2:deepseek-v4.1-flash", "opencode-go:deepseek-v4.1-flash", "openrouter:deepseek/deepseek-v4.1-flash"],
+      "deepseek-v4-pro": ["opencode-go-2:deepseek-v4-pro", "opencode-go:deepseek-v4-pro", "openrouter:deepseek/deepseek-v4-pro"]
+    };
+    PROVIDER_CHAIN_LEADS = {
+      "openrouter:z-ai/glm-5.3-flash": ["zai:glm-5.3-flash", "opencode-go-2:glm-5.3-flash", "opencode-go:glm-5.3-flash"],
+      "openrouter:z-ai/glm-5.3": ["zai:glm-5.3", "opencode-go-2:glm-5.3", "opencode-go:glm-5.3"],
+      "openrouter:z-ai/glm-5.2": ["zai:glm-5.2", "opencode-go-2:glm-5.2", "opencode-go:glm-5.2"]
+    };
+    PROVIDER_HOST_NOT_OFFERED = {
+      "muse-spark-1.3-contributor": { "opencode-go": "OpenCode Go serves Muse only on its Responses API" },
+      "gemini-3.1-pro-preview": { "opencode-go": "OpenCode Go does not serve Gemini" }
     };
   }
 });
@@ -12620,7 +12882,7 @@ function stateLiteralsOf(line) {
   const out = [];
   for (const m of line.matchAll(STRING_LITERAL_RE)) {
     const text = m[1] ?? m[2] ?? m[3] ?? "";
-    if (text.includes("placeholder="))
+    if (PLACEHOLDER_ATTR_RE.test(text))
       continue;
     if (PLACEHOLDER_CALL_TAIL_RE.test(line.slice(Math.max(0, m.index - 40), m.index)))
       continue;
@@ -12716,7 +12978,7 @@ function formatReadinessPollAdvisory(findings) {
   const where = findings.length === 1 ? "One place" : `${findings.length} places`;
   return `${where} re-check a background state once and assert the finished state at once (${short(first.line, 90)} then ${short(first.assertion, 90)}). ${first.reason}`;
 }
-var READINESS_POLL_MAX_CODE_CHARS, MAX_LINE_CHARS, MAX_FINDINGS, ASSERTION_WINDOW_LINES, MAX_BLOCK_CHARS, MAX_HEAD_CHARS, STRING_LITERAL_RE, RECHECK_NAME_RE, RETRY_NAME_RE, PENDING_STATE_RE, LOCATOR_LINE_RE, CLICK_RE, RELOAD_RE, GOTO_RE, ACTION_RE, EXPECT_RE, NEGATED_RE, PENDING_ENDED_RE, POSITIVE_MATCHER_RE, ZERO_COUNT_RE, TEST_END_RE, TEST_START_RE, POLL_OPEN_RE, PLACEHOLDER_CALL_TAIL_RE, POLL_SHAPE;
+var READINESS_POLL_MAX_CODE_CHARS, MAX_LINE_CHARS, MAX_FINDINGS, ASSERTION_WINDOW_LINES, MAX_BLOCK_CHARS, MAX_HEAD_CHARS, STRING_LITERAL_RE, RECHECK_NAME_RE, RETRY_NAME_RE, PENDING_STATE_RE, LOCATOR_LINE_RE, CLICK_RE, RELOAD_RE, GOTO_RE, ACTION_RE, EXPECT_RE, NEGATED_RE, PENDING_ENDED_RE, POSITIVE_MATCHER_RE, ZERO_COUNT_RE, TEST_END_RE, TEST_START_RE, POLL_OPEN_RE, PLACEHOLDER_ATTR_RE, PLACEHOLDER_CALL_TAIL_RE, POLL_SHAPE;
 var init_readiness_poll = __esm({
   "../shared/dist/readiness-poll.js"() {
     "use strict";
@@ -12729,7 +12991,7 @@ var init_readiness_poll = __esm({
     STRING_LITERAL_RE = /'((?:\\.|[^'\\\n]){0,300})'|"((?:\\.|[^"\\\n]){0,300})"|`((?:\\.|[^`\\\n]){0,300})`/g;
     RECHECK_NAME_RE = /^\s{0,10}(?:check again|check (?:status|availability|now|for updates|progress)|re-?check(?: status)?|update status|see (?:latest|updates))\s{0,10}(?:\.\.\.|…)?\s{0,10}$/i;
     RETRY_NAME_RE = /^\s{0,10}(?:refresh(?: (?:status|list|page|results|now))?|reload(?: (?:page|results|list))?|try again|retry|load (?:again|latest))\s{0,10}(?:\.\.\.|…)?\s{0,10}$/i;
-    PENDING_STATE_RE = /\b(?:searching|checking|sending|pending|processing|queued|in progress|loading|generating|calculating|preparing|verifying|syncing|refreshing|not ready|please wait|waiting)\b|\b[a-z]{3,40}(?<!th)ing(?:\s{1,3}[a-z]{1,20}){0,2}\s{0,3}(?:\.\.\.|…)\s{0,10}$/i;
+    PENDING_STATE_RE = /\b(?:searching|checking|sending|pending|processing|queued|in progress|loading|generating|calculating|preparing|verifying|syncing|refreshing|not ready|please wait|waiting)\b|\b(?:saving|uploading|downloading|signing|logging|submitting|creating|updating|deleting|importing|exporting|publishing|connecting|redirecting|authenticating|installing|retrieving|fetching|analy[sz]ing|running|rendering|restarting|building|compiling|booting|provisioning|deploying|indexing|migrating|launching|initiali[sz]ing|optimi[sz]ing|converting|processing)(?:\s{1,3}[a-z]{1,20}){0,2}\s{0,3}(?:\.\.\.|…)\s{0,10}$|^\s{0,10}(?:starting|scanning|working|applying|finishing)(?:\s{1,3}[a-z]{1,20}){0,2}\s{0,3}(?:\.\.\.|…)\s{0,10}$|^\s{0,10}[a-z]{3,40}(?<!th)ing\s{0,3}(?:\.\.\.|…)\s{0,10}$/i;
     LOCATOR_LINE_RE = /\.(?:getBy[A-Z]\w{0,30}|locator|toHaveText|toContainText)\s{0,20}\(/;
     CLICK_RE = /\.(?:click|dblclick|tap)\s{0,20}\(/;
     RELOAD_RE = /\bpage\.reload\s{0,20}\(/;
@@ -12743,6 +13005,7 @@ var init_readiness_poll = __esm({
     TEST_END_RE = /^\s{0,20}\}\s{0,20}\)\s{0,20};?\s{0,20}$/;
     TEST_START_RE = /\btest(?:\.\w{1,20})?\s{0,20}\(/;
     POLL_OPEN_RE = /\bexpect(?:\.soft)?\s{0,20}\(\s{0,20}async\b|\bexpect\.poll\s{0,20}\(|\bfor\s{0,20}\(|\bwhile\s{0,20}\(|\bdo\s{0,20}\{/g;
+    PLACEHOLDER_ATTR_RE = /placeholder\s{0,4}[*^$~|]?=/;
     PLACEHOLDER_CALL_TAIL_RE = /getByPlaceholder\s{0,20}\(\s{0,20}$/;
     POLL_SHAPE = "await expect(async () => { await page.reload(); await expect(<the finished state>).toBeVisible({ timeout: 1500 }); }).toPass({ timeout: 20000 });";
   }
@@ -13144,6 +13407,15 @@ function computes(line) {
   const code = line.replace(STRING_RE, '""').replace(REGEX_LITERAL_RE, "$1RX").replace(LITERAL_ARITH_RE, "N");
   return COMPUTE_RE.test(code) || RELATIONAL_RE.test(line);
 }
+function identifiersIn(line) {
+  const code = line.replace(STRING_RE, '""').replace(REGEX_LITERAL_RE, "$1RX");
+  return [code, ...[...line.matchAll(TEMPLATE_EXPR_RE)].map((m) => m[1])].flatMap((part) => part.match(IDENTIFIER_RE) ?? []);
+}
+function addTyped(typed, value) {
+  const d = digitsOf(value);
+  if (/\d/.test(d))
+    typed.add(d);
+}
 function reasonFor4(kind, label, value) {
   const what = kind === "derived-value-shape-only" ? `The ${label} is checked only for its shape, so any amount passes, including a wrongly computed one.` : `The ${label} is checked against a number written into the test (${value}). That number was read off the page, so when the page computes it wrong the check still passes.`;
   return `${what} Instead, ${COMPUTE_SHAPE} If the number is not computed from other values (a list price, an id, a fixed fee), leave it as it is. Keep the existing checks.`;
@@ -13155,25 +13427,32 @@ function analyzeDerivedValues(rawCode) {
   for (const body of testBodies(rawCode)) {
     if (findings.length >= MAX_FINDINGS4)
       break;
-    if (body.some(computes))
-      continue;
     const typed = /* @__PURE__ */ new Set();
     const definitions = /* @__PURE__ */ new Map();
+    const computed = /* @__PURE__ */ new Set();
+    const usesComputed = (text) => identifiersIn(text).some((id) => computed.has(id));
     for (const line of body) {
       if (FILL_RE2.test(line) && !EXPECT_RE3.test(line)) {
-        for (const m of line.matchAll(/['"`]([^'"`\n]{0,40})['"`]/g)) {
-          const d = digitsOf(m[1]);
-          if (/\d/.test(d))
-            typed.add(d);
-        }
+        for (const m of line.matchAll(QUOTED_RE))
+          addTyped(typed, m[1]);
+        const arg = FILL_ARG_RE.exec(line)?.[1];
+        const literal = arg === void 0 ? null : LITERAL_VALUE_RE.exec(definitions.get(arg) ?? "");
+        const value = literal?.slice(1).find((v) => v !== void 0);
+        if (value !== void 0)
+          addTyped(typed, value);
       }
       const def = DEFINITION_RE.exec(line);
-      if (def)
+      if (def) {
         definitions.set(def[1], def[2]);
+        if (computes(def[2]) || usesComputed(def[2]))
+          computed.add(def[1]);
+      }
     }
     for (const line of body) {
       if (!EXPECT_RE3.test(line) || !VALUE_MATCHER_RE2.test(line) || /\.not\s{0,20}\./.test(line))
         continue;
+      if (computes(line) || usesComputed(line))
+        continue;
       const subject = EXPECT_SUBJECT_RE.exec(line)?.[1];
       const label = DERIVED_WORD_RE.exec(`${line} ${(subject && definitions.get(subject)) ?? ""}`)?.[0];
       if (!label)
@@ -13203,7 +13482,7 @@ function formatDerivedValueAdvisory(findings) {
   const where = findings.length === 1 ? "One computed value is" : `${findings.length} computed values are`;
   return `${where} checked against a copied number or only its shape (${short4(first.line, 90)}). ${first.reason}`;
 }
-var MAX_FINDINGS4, EXPECT_RE3, DERIVED_WORD_RE, VALUE_MATCHER_RE2, MONEY_TOKEN_RE, SHAPE_ARG_RE, FILL_RE2, EXPECT_MESSAGE_RE, STRING_RE, REGEX_LITERAL_RE, COMPUTE_RE, RELATIONAL_RE, DEFINITION_RE, EXPECT_SUBJECT_RE, LITERAL_ARITH_RE, COMPUTE_SHAPE;
+var MAX_FINDINGS4, EXPECT_RE3, DERIVED_WORD_RE, VALUE_MATCHER_RE2, MONEY_TOKEN_RE, SHAPE_ARG_RE, FILL_RE2, EXPECT_MESSAGE_RE, STRING_RE, REGEX_LITERAL_RE, COMPUTE_RE, RELATIONAL_RE, DEFINITION_RE, EXPECT_SUBJECT_RE, LITERAL_ARITH_RE, TEMPLATE_EXPR_RE, IDENTIFIER_RE, QUOTED_RE, FILL_ARG_RE, LITERAL_VALUE_RE, COMPUTE_SHAPE;
 var init_derived_value_check = __esm({
   "../shared/dist/derived-value-check.js"() {
     "use strict";
@@ -13223,6 +13502,11 @@ var init_derived_value_check = __esm({
     DEFINITION_RE = /\b(?:const|let)\s{1,10}([\w$]{1,60})\s{0,10}=\s{0,10}([^\n]{0,300})/;
     EXPECT_SUBJECT_RE = /\bexpect(?:\.soft)?\s{0,20}\(\s{0,20}([\w$]{1,60})/;
     LITERAL_ARITH_RE = /\b\d[\d_.]{0,15}(?:\s{0,5}[*/+-]\s{0,5}\d[\d_.]{0,15}){1,8}\b/g;
+    TEMPLATE_EXPR_RE = /\$\{([^{}\n]{0,200})\}/g;
+    IDENTIFIER_RE = /[A-Za-z_$][\w$]{0,60}/g;
+    QUOTED_RE = /['"`]([^'"`\n]{0,40})['"`]/g;
+    FILL_ARG_RE = /\.(?:fill|type|pressSequentially|selectOption)\s{0,20}\(\s{0,20}([A-Za-z_$][\w$]{0,60})\s{0,20}[,)]/;
+    LITERAL_VALUE_RE = /^\s{0,10}(?:'([^'\n]{0,40})'|"([^"\n]{0,40})"|`([^`$\n]{0,40})`|(\d[\d_,]{0,15}(?:\.\d{1,4})?))\s{0,10};?\s{0,10}$/;
     COMPUTE_SHAPE = "compute the expected value in the test from its inputs (the values the test typed, or each input read from the page) and compare: const toNumber = (s) => Number(s.replace(/[^\\d.-]/g, '')); const unit = toNumber(await <unit price locator>.innerText()); then expect(toNumber(await <shown value locator>.innerText())).toBeCloseTo(unit * quantity, 2); for several lines, read them all and sum them with reduce. For a comma-decimal price like \u20AC1.234,56, drop the dots and turn the comma into a point before Number, since the replace above would read it as 1.23456.";
   }
 });
@@ -15257,6 +15541,99 @@ function formatStaleAfterSubmitAdvisory(rawCode) {
   const more = described.length > 3 ? ` (+${described.length - 3} more)` : "";
   return `stale-after-submit: ${described.slice(0, 3).join("; ")}${more}; these pass before the request lands and still pass if the server rejects or ignores the save. Wait for the result instead: page.waitForResponse around the click, or assert something the submit creates (the new row, the confirmation message, a path with an end anchor such as /\\/orders\\/\\d+$/)`;
 }
+function regexLiteralEnd4(text, at) {
+  let inClass = false;
+  for (let i = at + 1; i < text.length; i++) {
+    const ch = text[i];
+    if (ch === "\n")
+      return -1;
+    if (ch === "\\") {
+      i++;
+      continue;
+    }
+    if (inClass) {
+      if (ch === "]")
+        inClass = false;
+      continue;
+    }
+    if (ch === "[") {
+      inClass = true;
+      continue;
+    }
+    if (ch === "/")
+      return i + 1;
+  }
+  return -1;
+}
+function startsWithRegexLiteral(text) {
+  const t = text.trimStart();
+  return t[0] === "/" && t[1] !== "/" && t[1] !== "*" && regexLiteralEnd4(t, 0) !== -1;
+}
+function afterFirstArg(args) {
+  let depth = 0;
+  let quote = null;
+  for (let i = 0; i < args.length; i++) {
+    const ch = args[i];
+    if (quote) {
+      if (ch === "\\") {
+        i++;
+        continue;
+      }
+      if (ch === quote)
+        quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") {
+      quote = ch;
+      continue;
+    }
+    if (ch === "(" || ch === "[" || ch === "{")
+      depth++;
+    else if (ch === ")" || ch === "]" || ch === "}")
+      depth--;
+    else if (ch === "," && depth === 0)
+      return args.slice(i + 1);
+  }
+  return "";
+}
+function analyzeRegexMatchers(rawCode) {
+  if (!rawCode || typeof rawCode !== "string")
+    return [];
+  const code = stripComments2(rawCode.slice(0, MAX_LINT_INPUT));
+  const out = [];
+  const re = /\bexpect(?:\.soft)?\s{0,20}\(/g;
+  let m;
+  let examined = 0;
+  let line = 1;
+  let lineAt2 = 0;
+  while ((m = re.exec(code)) !== null && examined++ < MAX_CALLS && out.length < MAX_REGEX_MATCHER_FINDINGS) {
+    const subj = readBalanced(code, m.index + m[0].length);
+    if (!subj)
+      continue;
+    const mm = /^\s{0,20}(\.\s{0,20}not)?\s{0,20}\.\s{0,20}(\w{1,40})\s{0,20}\(/.exec(code.slice(subj.end + 1, subj.end + 1 + 80));
+    if (!mm || !REGEX_EQUALITY_MATCHERS.has(mm[2]))
+      continue;
+    const args = readBalanced(code, subj.end + 1 + mm[0].length);
+    if (!args)
+      continue;
+    const expected = mm[2] === "toHaveJSProperty" ? afterFirstArg(args.text) : args.text;
+    if (!startsWithRegexLiteral(expected))
+      continue;
+    if (mm[2] !== "toHaveJSProperty" && mm[2] !== "toContain" && (startsWithRegexLiteral(subj.text) || /^new\s+RegExp\b/.test(subj.text.trim())))
+      continue;
+    for (let i = code.indexOf("\n", lineAt2); i !== -1 && i < m.index; i = code.indexOf("\n", i + 1)) {
+      line++;
+      lineAt2 = i + 1;
+    }
+    out.push({ line, matcher: mm[2], negated: mm[1] !== void 0 });
+  }
+  return out;
+}
+function formatRegexMatcherNote(findings) {
+  const lines = findings.map((f) => `Line ${f.line}: .${f.negated ? "not." : ""}${f.matcher}(\u2026 /regex/ \u2026) ${f.negated ? "always passes (a regex never equals the value), so it checks nothing" : "can never pass: this matcher compares by equality and a regex never equals a value"}.`);
+  return `${lines.join("\n")}
+A regex only works in toMatch, toHaveText, toContainText, toHaveValue and similar text matchers. For a DOM property read it first: expect(await loc.evaluate((n) => n.<prop>)).toMatch(/re/). Or give toHaveJSProperty the exact string (or boolean) the page shows. Keep every other line as-is.`;
+}
 function lintTestQuality(rawCode, opts = {}) {
   if (!rawCode || typeof rawCode !== "string")
     return [];
@@ -15264,6 +15641,10 @@ function lintTestQuality(rawCode, opts = {}) {
     return lintTestData(rawCode, { pageContacts: opts.pageContacts });
   if (opts.only === "test-data-blocking")
     return analyzeTestData(rawCode, { pageContacts: opts.pageContacts }).blocking;
+  if (opts.only === "regex-matcher") {
+    const found = analyzeRegexMatchers(rawCode);
+    return found.length > 0 ? [formatRegexMatcherNote(found)] : [];
+  }
   const warnings = [];
   if (rawCode.length > MAX_LINT_INPUT) {
     warnings.push(`The code is ${Math.round(rawCode.length / 1024)} KB; the quality lint checked only the first ${MAX_LINT_INPUT / 1e3} KB. Split it into smaller tests (one behaviour per test).`);
@@ -15538,7 +15919,7 @@ function specItemsFromTestPlans(testPlans) {
   }
   return [...new Set(out)].slice(0, 200);
 }
-var READ_ONLY_TAGS, PRODUCTION_READ_ONLY_GUARD_TEMPLATE, HOST_AGNOSTIC_URL_TEMPLATE, TEST_QUALITY_CONVENTIONS, NON_PROD_HOST_LABEL, NON_PROD_HOST_TOKEN, TRANSIENT_TEXT, STRING_LITERAL, FIRST_LITERAL, GET_BY_TEXT_LITERAL2, ROLE_NAME_LITERAL2, MAX_LINT_INPUT, MAX_BALANCED_SCAN, MAX_CALLS, MAX_SEEN_SCAN, ACTION_CALL, BY_NAME_LOCATOR, ACTION_AFTER, MAX_CONTACTS, MAX_SNAPSHOT_SCAN, PHONE_IN_TEXT, EMAIL_IN_TEXT, TEL_HREF, MAILTO_HREF, FIELD_LINE, INBOX_EMAIL_READ, MAIL_READ_CALL, RESERVED_EMAIL_TLD, PHONE_LABEL, NON_PHONE_NUMBER_LABEL, IDENTITY_LABEL, LOOKUP_LABEL, NON_NAME_SUFFIX_LABEL, DATE_LIKE, SIGNUP_ACTION_NAME, SIGNUP_SUBMIT_NAME, LOGIN_ACTION_NAME, SIGNUP_GOTO, LOGIN_GOTO, MINTED_INBOX_ALIAS, STAMP_EVAL, RECORDING_VALUE_PLACEHOLDERS, NEGATIVE_TEST_TITLE, NEGATIVE_SIGNUP_ASSERT, STORED_LOGIN_RE, CONFIRM_CLICK_RE, SAVE_UPDATE_RE, NOT_A_CONFIRM_RE, ENTITY_WORDS, CREATE_ENTITY_CLICK_RE, RESTORE_CLICK_RE, MAX_ACCOUNT_ACTIONS, MAX_TRY_BLOCKS, MAX_STATEMENT_LOOKBACK, MAX_FINDINGS5, MAX_TRY_BODY, AUTH_REGION_START, AUTH_REGION_END, INBOX_REGION_START, INBOX_REGION_END, ACCOUNT_ROUTE_RE, ENTITY_WORD_RES, PERSIST_CALL_RE, FILL_IDENT_ARG_RE, PERSIST_ARGS_RE, HOST_IN_URL_ARG, URL_WAIT_TOKEN, GLOB_ESCAPED, URL_WAIT_MAX_PATH, URL_WAIT_MAX_GLOB_STARS, UNREACHED_MAX_PATHS, UNREACHED_MATCH_BUDGET, STALE_TOKEN, RESULT_WAIT, WRITE_CALL_PRESENT, SUBMIT_CALL_PRESENT, TEST_CALL, VALUE_WRITE_CALLS, SUBMIT_CALLS, DISTINCT_PAGE_CALLS, OWN_CONTROL_MATCHERS, OUTCOME_CONTENT_MATCHERS, OUTCOME_STATE_MATCHERS, ANY_CONTENT_ARG, ROOT_SUBJECT, LITERAL_SUBJECT, MATCHER_AFTER_EXPECT, STALE_MAX_EVENTS, CHECKED, UNCHECKED, squash, NOT_JUDGED, STALE_REASON_TEXT, LIVE_WRITE_NAME, BUNDLED_CHECKS_BEFORE_WRITE, STOP, SYNONYMS, AREA_TOKENS;
+var READ_ONLY_TAGS, PRODUCTION_READ_ONLY_GUARD_TEMPLATE, HOST_AGNOSTIC_URL_TEMPLATE, TEST_QUALITY_CONVENTIONS, NON_PROD_HOST_LABEL, NON_PROD_HOST_TOKEN, TRANSIENT_TEXT, STRING_LITERAL, FIRST_LITERAL, GET_BY_TEXT_LITERAL2, ROLE_NAME_LITERAL2, MAX_LINT_INPUT, MAX_BALANCED_SCAN, MAX_CALLS, MAX_SEEN_SCAN, ACTION_CALL, BY_NAME_LOCATOR, ACTION_AFTER, MAX_CONTACTS, MAX_SNAPSHOT_SCAN, PHONE_IN_TEXT, EMAIL_IN_TEXT, TEL_HREF, MAILTO_HREF, FIELD_LINE, INBOX_EMAIL_READ, MAIL_READ_CALL, RESERVED_EMAIL_TLD, PHONE_LABEL, NON_PHONE_NUMBER_LABEL, IDENTITY_LABEL, LOOKUP_LABEL, NON_NAME_SUFFIX_LABEL, DATE_LIKE, SIGNUP_ACTION_NAME, SIGNUP_SUBMIT_NAME, LOGIN_ACTION_NAME, SIGNUP_GOTO, LOGIN_GOTO, MINTED_INBOX_ALIAS, STAMP_EVAL, RECORDING_VALUE_PLACEHOLDERS, NEGATIVE_TEST_TITLE, NEGATIVE_SIGNUP_ASSERT, STORED_LOGIN_RE, CONFIRM_CLICK_RE, SAVE_UPDATE_RE, NOT_A_CONFIRM_RE, ENTITY_WORDS, CREATE_ENTITY_CLICK_RE, RESTORE_CLICK_RE, MAX_ACCOUNT_ACTIONS, MAX_TRY_BLOCKS, MAX_STATEMENT_LOOKBACK, MAX_FINDINGS5, MAX_TRY_BODY, AUTH_REGION_START, AUTH_REGION_END, INBOX_REGION_START, INBOX_REGION_END, ACCOUNT_ROUTE_RE, ENTITY_WORD_RES, PERSIST_CALL_RE, FILL_IDENT_ARG_RE, PERSIST_ARGS_RE, HOST_IN_URL_ARG, URL_WAIT_TOKEN, GLOB_ESCAPED, URL_WAIT_MAX_PATH, URL_WAIT_MAX_GLOB_STARS, UNREACHED_MAX_PATHS, UNREACHED_MATCH_BUDGET, STALE_TOKEN, RESULT_WAIT, WRITE_CALL_PRESENT, SUBMIT_CALL_PRESENT, TEST_CALL, VALUE_WRITE_CALLS, SUBMIT_CALLS, DISTINCT_PAGE_CALLS, OWN_CONTROL_MATCHERS, OUTCOME_CONTENT_MATCHERS, OUTCOME_STATE_MATCHERS, ANY_CONTENT_ARG, ROOT_SUBJECT, LITERAL_SUBJECT, MATCHER_AFTER_EXPECT, STALE_MAX_EVENTS, CHECKED, UNCHECKED, squash, NOT_JUDGED, STALE_REASON_TEXT, LIVE_WRITE_NAME, BUNDLED_CHECKS_BEFORE_WRITE, MAX_REGEX_MATCHER_FINDINGS, REGEX_EQUALITY_MATCHERS, STOP, SYNONYMS, AREA_TOKENS;
 var init_test_authoring_quality = __esm({
   "../shared/dist/test-authoring-quality.js"() {
     "use strict";
@@ -15770,6 +16151,8 @@ var init_test_authoring_quality = __esm({
     };
     LIVE_WRITE_NAME = /\b(?:submit|place|book|reserve|confirm|pay|send|checkout|order|register|sign\s?up|create account)\b/i;
     BUNDLED_CHECKS_BEFORE_WRITE = 5;
+    MAX_REGEX_MATCHER_FINDINGS = 10;
+    REGEX_EQUALITY_MATCHERS = /* @__PURE__ */ new Set(["toBe", "toEqual", "toStrictEqual", "toContain", "toHaveJSProperty"]);
     STOP = /* @__PURE__ */ new Set([
       "a",
       "an",
@@ -15998,6 +16381,19 @@ var init_fence_runs = __esm({
   }
 });
 
+// ../shared/dist/trailing-slashes.js
+function stripTrailingSlashes(value) {
+  let end = value.length;
+  while (end > 0 && value.charCodeAt(end - 1) === 47)
+    end--;
+  return end === value.length ? value : value.slice(0, end);
+}
+var init_trailing_slashes = __esm({
+  "../shared/dist/trailing-slashes.js"() {
+    "use strict";
+  }
+});
+
 // ../shared/dist/survey-bug-signature.js
 function normalizeWords(text) {
   return text.toLowerCase().replace(UUID, " id ").replace(PREFIXED_ID, " id ").replace(HEX_RUN, (run) => /\d/.test(run) ? " id " : run).replace(NUMBER_RUN, " # ").replace(/[^\p{L}\p{N}#]+/gu, " ").replace(/\s+/g, " ").trim();
@@ -16008,7 +16404,7 @@ function normalizeBugPath(route) {
   if (hash >= 0 && path[hash + 1] !== "/")
     path = path.slice(0, hash);
   const segments = path.toLowerCase().split("/").map((segment) => /\d/.test(segment) ? ":id" : segment);
-  const joined = segments.join("/").replace(/\/+$/, "");
+  const joined = stripTrailingSlashes(segments.join("/"));
   return joined || (path.startsWith("/") ? "/" : "");
 }
 function isGenericConsoleMessage(message) {
@@ -16142,6 +16538,7 @@ var SIGNATURE_SOURCE_MAX_CHARS, UUID, PREFIXED_ID, HEX_RUN, NUMBER_RUN, GENERIC_
 var init_survey_bug_signature = __esm({
   "../shared/dist/survey-bug-signature.js"() {
     "use strict";
+    init_trailing_slashes();
     SIGNATURE_SOURCE_MAX_CHARS = 800;
     UUID = /\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/g;
     PREFIXED_ID = /\b[a-z]{1,8}[-_]\d+\b/g;
@@ -17422,9 +17819,9 @@ function lastLocatorLabels(chain) {
       if (t)
         labels.push(t[1]);
     }
-    const has = optionText(last.args, HAS_TEXT_OPTION_RE);
-    if (has !== null)
-      labels.push(has);
+    const has2 = optionText(last.args, HAS_TEXT_OPTION_RE);
+    if (has2 !== null)
+      labels.push(has2);
   }
   return labels.map((l) => l.replace(/^[\s^(?:]+/, "").trim());
 }
@@ -18181,14 +18578,17 @@ var init_promotion_quality_gate = __esm({
     SOURCE_RANK = { generator: 0, classifier: 0, healer: 1, human: 2 };
     strengthCheck = {
       id: "assertion-strength",
-      run({ code, strengthGate, flagContradictedAdditions }) {
+      run({ code, tags, strengthGate, flagContradictedAdditions }) {
         const verdict = validateAssertionStrength(code, { flagContradictedAdditions: flagContradictedAdditions === true });
         if (verdict.severity === "route-bug")
           return [{ check: "route-bug" }];
-        if (verdict.severity !== "block")
+        const authDowngrade = verdict.severity === "downgrade" && tags.some((t) => t.toLowerCase() === "@auth");
+        if (verdict.severity !== "block" && !authDowngrade)
           return [];
         const revealed = strengthGate?.severity === "none" && strengthGate.revealEvidence === "revealed" && strengthGate.source !== "heal";
-        return revealed ? [] : [{ check: "strength-block" }];
+        if (revealed)
+          return [];
+        return [{ check: authDowngrade ? "strength-downgrade-auth" : "strength-block" }];
       }
     };
     STRING_CONST = /\b(?:const|let|var)\s{1,20}([A-Za-z_$][\w$]{0,60})\s{0,20}=\s{0,20}(?:'([^'\\\n]{0,300})'|"([^"\\\n]{0,300})"|`([^`\\$\n]{0,300})`)\s{0,20}[;\n]/g;
@@ -18595,6 +18995,7 @@ __export(dist_exports, {
   AUDIO_CHUNK_DURATION_MS: () => AUDIO_CHUNK_DURATION_MS,
   AUTH_PATH_SIGNATURE: () => AUTH_PATH_SIGNATURE,
   AUTH_PROVIDER_HOST_SIGNATURES: () => AUTH_PROVIDER_HOST_SIGNATURES,
+  AUTH_SESSION_GENERATION_RE: () => AUTH_SESSION_GENERATION_RE,
   AUTH_STATE_EXPIRY_SKEW_MS: () => AUTH_STATE_EXPIRY_SKEW_MS,
   AUTH_TAG_COOKIE_STATE: () => AUTH_TAG_COOKIE_STATE,
   AUTH_TAG_LOGIN_BEARER: () => AUTH_TAG_LOGIN_BEARER,
@@ -18727,6 +19128,8 @@ __export(dist_exports, {
   LIVE_FRAME_STALE_MS: () => LIVE_FRAME_STALE_MS,
   LIVE_FRAME_UNFOCUSED_INTERVAL_MS: () => LIVE_FRAME_UNFOCUSED_INTERVAL_MS,
   LIVE_THUMBNAIL_MAX_BASE64_BYTES: () => LIVE_THUMBNAIL_MAX_BASE64_BYTES,
+  MAX_BALANCED_SCAN: () => MAX_BALANCED_SCAN,
+  MAX_CALLS: () => MAX_CALLS,
   MAX_CREDIT_TOPUP_CENTS: () => MAX_CREDIT_TOPUP_CENTS,
   MAX_DEEPLINK_LENGTH: () => MAX_DEEPLINK_LENGTH,
   MAX_EMAIL_ADDRESS_LENGTH: () => MAX_EMAIL_ADDRESS_LENGTH,
@@ -18771,6 +19174,7 @@ __export(dist_exports, {
   MUSE_ENGINE_DEFAULT_MODEL: () => MUSE_ENGINE_DEFAULT_MODEL,
   MUSE_ENGINE_MODELS: () => MUSE_ENGINE_MODELS,
   NOREPLY_EMAIL: () => NOREPLY_EMAIL,
+  OPENCODE_GO_2_PREFIX: () => OPENCODE_GO_2_PREFIX,
   OPENCODE_GO_MODEL_PATTERN: () => OPENCODE_GO_MODEL_PATTERN,
   OPENCODE_GO_PREFIX: () => OPENCODE_GO_PREFIX,
   OPENROUTER_MAX_CALL_COST_USD: () => OPENROUTER_MAX_CALL_COST_USD,
@@ -18806,6 +19210,8 @@ __export(dist_exports, {
   PROMOTION_GATE_MAX_CODE_CHARS: () => PROMOTION_GATE_MAX_CODE_CHARS,
   PROMOTION_QUALITY_CHECKS: () => PROMOTION_QUALITY_CHECKS,
   PROVIDER_CHAINS: () => PROVIDER_CHAINS,
+  PROVIDER_CHAIN_LEADS: () => PROVIDER_CHAIN_LEADS,
+  PROVIDER_HOST_NOT_OFFERED: () => PROVIDER_HOST_NOT_OFFERED,
   PUBLIC_PLANS: () => PUBLIC_PLANS,
   QUARANTINE_CLOSE_TAGS: () => QUARANTINE_CLOSE_TAGS,
   READINESS_POLL_MAX_CODE_CHARS: () => READINESS_POLL_MAX_CODE_CHARS,
@@ -18844,6 +19250,7 @@ __export(dist_exports, {
   SURVEY_NOTES_RENDER_MAX_CHARS: () => SURVEY_NOTES_RENDER_MAX_CHARS,
   SURVEY_NOTE_KEYS: () => SURVEY_NOTE_KEYS,
   SUSPICIOUS_PASS_TAG: () => SUSPICIOUS_PASS_TAG,
+  TEST_DID_NOT_RUN_ERROR: () => TEST_DID_NOT_RUN_ERROR,
   TEST_QUALITY_CONVENTIONS: () => TEST_QUALITY_CONVENTIONS,
   TEST_USER_ENV_KEYS: () => TEST_USER_ENV_KEYS,
   TEST_VARIABLE_SECRET_KEY_PATTERN: () => TEST_VARIABLE_SECRET_KEY_PATTERN,
@@ -18859,6 +19266,8 @@ __export(dist_exports, {
   VOICE_PREVIEW_SAMPLE: () => VOICE_PREVIEW_SAMPLE,
   WEB_PROXY_CHAIN_HEADER: () => WEB_PROXY_CHAIN_HEADER,
   WITHHELD_CREDENTIAL_TEXT: () => WITHHELD_CREDENTIAL_TEXT,
+  ZAI_MODEL_PATTERN: () => ZAI_MODEL_PATTERN,
+  ZAI_PREFIX: () => ZAI_PREFIX,
   accumulateStatements: () => accumulateStatements,
   adoptBrokerFailover: () => adoptBrokerFailover,
   aiCostToCreditCents: () => aiCostToCreditCents,
@@ -18867,6 +19276,7 @@ __export(dist_exports, {
   analyzeMobileSelectorQuality: () => analyzeMobileSelectorQuality,
   analyzePersistenceReread: () => analyzePersistenceReread,
   analyzeReadinessPolling: () => analyzeReadinessPolling,
+  analyzeRegexMatchers: () => analyzeRegexMatchers,
   analyzeSharedAccountUse: () => analyzeSharedAccountUse,
   analyzeStaleAfterSubmit: () => analyzeStaleAfterSubmit,
   analyzeTestData: () => analyzeTestData,
@@ -19030,6 +19440,7 @@ __export(dist_exports, {
   formatPersistenceRereadAdvisory: () => formatPersistenceRereadAdvisory,
   formatPoolBudgetLine: () => formatPoolBudgetLine,
   formatReadinessPollAdvisory: () => formatReadinessPollAdvisory,
+  formatRegexMatcherNote: () => formatRegexMatcherNote,
   formatStaleAfterSubmitAdvisory: () => formatStaleAfterSubmitAdvisory,
   formatSuspiciousExpectation: () => formatSuspiciousExpectation,
   formatUrlWaitAdvisory: () => formatUrlWaitAdvisory,
@@ -19068,12 +19479,14 @@ __export(dist_exports, {
   hasEncodedRequestBody: () => hasEncodedRequestBody,
   hasEngineSpecParts: () => hasEngineSpecParts,
   hasOnlyConstantAssertions: () => hasOnlyConstantAssertions,
+  hasOpenCodeGo2Prefix: () => hasOpenCodeGo2Prefix,
   hasOpenCodeGoPrefix: () => hasOpenCodeGoPrefix,
   hasOpenRouterPrefix: () => hasOpenRouterPrefix,
   hasPlatformLocator: () => hasPlatformLocator,
   hasReadOnlyMarker: () => hasReadOnlyMarker,
   hasSurveyNotes: () => hasSurveyNotes,
   hasTestFailContract: () => hasTestFailContract,
+  hasZaiPrefix: () => hasZaiPrefix,
   healMobileTestSteps: () => healMobileTestSteps,
   healthRunWhere: () => healthRunWhere,
   heldCodeRecord: () => heldCodeRecord,
@@ -19177,6 +19590,7 @@ __export(dist_exports, {
   isValidSttProvider: () => isValidSttProvider,
   isValidTtsModel: () => isValidTtsModel,
   isValidTtsVoiceId: () => isValidTtsVoiceId,
+  isZaiModelId: () => isZaiModelId,
   jsEscapedForms: () => jsEscapedForms,
   jsonStructureRefusalOf: () => jsonStructureRefusalOf,
   jsonStructureVerify: () => jsonStructureVerify,
@@ -19225,6 +19639,7 @@ __export(dist_exports, {
   parseApiCardModelUpdate: () => parseApiCardModelUpdate,
   parseAppTimezone: () => parseAppTimezone,
   parseAuditGroupScopeId: () => parseAuditGroupScopeId,
+  parseAuthSessionStamp: () => parseAuthSessionStamp,
   parseBoolFlag: () => parseBoolFlag,
   parseDbPoolSize: () => parseDbPoolSize,
   parseDeepgramListenResponse: () => parseDeepgramListenResponse,
@@ -19268,7 +19683,11 @@ __export(dist_exports, {
   profileKeyRoute: () => profileKeyRoute,
   projectAppHosts: () => projectAppHosts,
   providerChainFor: () => providerChainFor,
+  providerChainHostOf: () => providerChainHostOf,
+  providerChainLeadsFor: () => providerChainLeadsFor,
   providerChainPrimariesForHop: () => providerChainPrimariesForHop,
+  providerHostPlan: () => providerHostPlan,
+  readBalanced: () => readBalanced,
   readChatFailover: () => readChatFailover,
   readChatReasoningTokens: () => readChatReasoningTokens,
   readChatUsage: () => readChatUsage,
@@ -19351,6 +19770,7 @@ __export(dist_exports, {
   stripCoverageComments: () => stripCoverageComments,
   stripEnvironmentalPrefix: () => stripEnvironmentalPrefix,
   stripLoginScaffolding: () => stripLoginScaffolding,
+  stripTrailingSlashes: () => stripTrailingSlashes,
   strongerNeedsReviewSource: () => strongerNeedsReviewSource,
   sttModelsForProvider: () => sttModelsForProvider,
   summarizeHealth: () => summarizeHealth,
@@ -19378,7 +19798,8 @@ __export(dist_exports, {
   withReviewSource: () => withReviewSource,
   withoutNotChargedClaim: () => withoutNotChargedClaim,
   withoutServerOnlySpendFields: () => withoutServerOnlySpendFields,
-  withoutSurveyNotes: () => withoutSurveyNotes
+  withoutSurveyNotes: () => withoutSurveyNotes,
+  zaiWireModel: () => zaiWireModel
 });
 var init_dist = __esm({
   "../shared/dist/index.js"() {
@@ -19420,6 +19841,7 @@ var init_dist = __esm({
     init_admin_view_return_to();
     init_auth_plan();
     init_auth_block_detector();
+    init_auth_session_stamp();
     init_auth_state_freshness();
     init_skip_coverage_detector();
     init_feature_coverage();
@@ -19476,6 +19898,7 @@ var init_dist = __esm({
     init_promotion_quality_gate();
     init_regex_alternation();
     init_page_evidence();
+    init_trailing_slashes();
   }
 });
 
@@ -19911,6 +20334,7 @@ var require_route_manifest = __commonJS({
     exports2.renderRouteManifestChecklist = renderRouteManifestChecklist;
     exports2.renderRepoReadsChecklist = renderRepoReadsChecklist;
     exports2.buildRepoReadsRouteAllowlist = buildRepoReadsRouteAllowlist;
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var promises_1 = require("fs/promises");
     var node_path_1 = require("path");
     var untrusted_knowledge_js_1 = require_untrusted_knowledge();
@@ -19965,7 +20389,7 @@ var require_route_manifest = __commonJS({
     }
     function collapsePath(path) {
       const collapsed = path.replace(/\/{2,}/g, "/");
-      return collapsed.length > 1 ? collapsed.replace(/\/+$/, "") : collapsed;
+      return collapsed.length > 1 ? (0, shared_1.stripTrailingSlashes)(collapsed) : collapsed;
     }
     function normalizeManifestPath(raw) {
       const text = str(raw, 500);
@@ -20314,6 +20738,7 @@ var require_exploration_parser = __commonJS({
     exports2.normalizeRouteForFocusScope = normalizeRouteForFocusScope;
     exports2.routeIsWithinFocusAreas = routeIsWithinFocusAreas;
     exports2.detectRouteFromResponse = detectRouteFromResponse;
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     function extractCodeLines(toolResultContent) {
       const isPlaywrightLine = (l) => l.startsWith("await page.") || l.startsWith("await expect(");
       const codeSection = toolResultContent.match(/###\s*Ran Playwright code\s*\n([\s\S]*?)(?=\n###|\n$|$)/);
@@ -20607,7 +21032,7 @@ var require_exploration_parser = __commonJS({
       const decoded = raw.replace(/&amp;/g, "&").replace(/&#(\d+);/g, (_m, code) => String.fromCharCode(Number(code)));
       try {
         const url = new URL(decoded, "http://canonical.invalid");
-        url.pathname = url.pathname.replace(/\/+$/, "") || "/";
+        url.pathname = (0, shared_1.stripTrailingSlashes)(url.pathname) || "/";
         return normalizeRoute(url);
       } catch {
         return decoded;
@@ -20639,9 +21064,9 @@ var require_exploration_parser = __commonJS({
       const text = String(route ?? "").trim();
       const at = text.indexOf("#/");
       if (at < 0)
-        return text.startsWith("#") ? text.split("?")[0].toLowerCase().replace(/\/+$/, "") : null;
+        return text.startsWith("#") ? (0, shared_1.stripTrailingSlashes)(text.split("?")[0].toLowerCase()) : null;
       const hashPath = text.slice(at).split("?")[0].toLowerCase();
-      return hashPath.length > 2 ? hashPath.replace(/\/+$/, "") || "#/" : hashPath;
+      return hashPath.length > 2 ? (0, shared_1.stripTrailingSlashes)(hashPath) || "#/" : hashPath;
     }
     function routeIsWithinFocusAreas(route, focusAreas, otherRoutes) {
       if (!focusAreas || focusAreas.length === 0)
@@ -20898,8 +21323,11 @@ var require_survey_network_guard = __commonJS({
     exports2.maskedPath = maskedPath;
     exports2.bodyKeysOf = bodyKeysOf;
     exports2.graphqlDocumentIsQueryOnly = graphqlDocumentIsQueryOnly;
+    exports2.graphqlOperationRoots = graphqlOperationRoots;
     exports2.isTokenRefreshWrite = isTokenRefreshWrite;
     exports2.isSignInPathWrite = isSignInPathWrite;
+    exports2.graphqlUrlCarriesQuery = graphqlUrlCarriesQuery;
+    exports2.graphqlGetMayWrite = graphqlGetMayWrite;
     exports2.writeShapedGet = writeShapedGet;
     exports2.decideSurveyRequest = decideSurveyRequest;
     exports2.installSurveyNetworkGuard = installSurveyNetworkGuard;
@@ -21176,6 +21604,100 @@ var require_survey_network_guard = __commonJS({
       }
       return depth === 0 && parens === 0 && objects === 0 && sawOperation;
     }
+    function graphqlOperationRoots(text) {
+      const tokens2 = lexGraphql(text);
+      if (!tokens2)
+        return null;
+      const ops = [];
+      let depth = 0;
+      let parens = 0;
+      let objects = 0;
+      let defStart = true;
+      let kind = null;
+      let current = null;
+      let prev = "";
+      for (const tok of tokens2) {
+        const last = prev;
+        prev = tok;
+        if (tok === "(") {
+          parens++;
+          continue;
+        }
+        if (tok === ")") {
+          parens--;
+          if (parens < 0 || objects !== 0)
+            return null;
+          continue;
+        }
+        if (parens > 0) {
+          if (tok === "{")
+            objects++;
+          else if (tok === "}") {
+            objects--;
+            if (objects < 0)
+              return null;
+          }
+          continue;
+        }
+        if (tok === "{") {
+          if (depth === 0) {
+            if (defStart)
+              kind = "query";
+            else if (kind === null)
+              return null;
+            current = kind === "fragment" ? null : { kind, roots: [] };
+            if (current)
+              ops.push(current);
+            defStart = false;
+          }
+          depth++;
+          continue;
+        }
+        if (tok === "}") {
+          depth--;
+          if (depth < 0)
+            return null;
+          if (depth === 0) {
+            defStart = true;
+            kind = null;
+            current = null;
+          }
+          continue;
+        }
+        if (depth === 0) {
+          if (!/^[_A-Za-z]/.test(tok)) {
+            if (tok === "@")
+              continue;
+            return null;
+          }
+          if (defStart) {
+            if (tok !== "query" && tok !== "mutation" && tok !== "fragment")
+              return null;
+            kind = tok;
+            defStart = false;
+          }
+          continue;
+        }
+        if (depth > 1 || !current)
+          continue;
+        if (/^[_A-Za-z]/.test(tok)) {
+          if (last === "@")
+            continue;
+          if (last === ":") {
+            if (current.roots.length === 0)
+              return null;
+            current.roots[current.roots.length - 1] = tok;
+            continue;
+          }
+          current.roots.push(tok);
+          continue;
+        }
+        if (tok === ":" || tok === "@")
+          continue;
+        return null;
+      }
+      return depth === 0 && parens === 0 && objects === 0 ? ops : null;
+    }
     function isGraphqlQueryOnly(postData) {
       if (!postData || postData.length > MAX_BODY_CHARS)
         return false;
@@ -21213,6 +21735,34 @@ var require_survey_network_guard = __commonJS({
       "remove"
     ]);
     var NOT_A_SESSION_END = (segs) => !segs.some((seg) => SESSION_END_SEGMENTS.has(seg));
+    var DESTRUCTIVE_WORDS = /* @__PURE__ */ new Set([
+      "delete",
+      "remove",
+      "destroy",
+      "deactivate",
+      "terminate",
+      "purge",
+      "wipe",
+      "erase",
+      "cancel",
+      "close",
+      "revoke",
+      "unlink",
+      "disconnect"
+    ]);
+    var DESTRUCTIVE_PREFIXES = ["delete", "remove", "destroy", "deactivate", "terminate", "purge"];
+    function hasDestructiveSegment(rawSegs) {
+      return rawSegs.some((raw) => {
+        let seg = raw;
+        try {
+          seg = decodeURIComponent(raw);
+        } catch {
+        }
+        const words = seg.replace(/([a-z0-9])([A-Z])/g, "$1 $2").toLowerCase().split(/[^a-z0-9]+/);
+        return words.some((word) => DESTRUCTIVE_WORDS.has(word) || DESTRUCTIVE_PREFIXES.some((p) => word.startsWith(p)));
+      });
+    }
+    var rawPathSegments = (pathname) => pathname.split("/").map((seg) => seg.split(";")[0]).filter(Boolean);
     var pathSegments = (pathname) => pathname.toLowerCase().split("/").map((seg) => seg.split(";")[0]).filter(Boolean);
     function isTokenRefreshWrite(method, pathname, recentAction = false) {
       if (method.toUpperCase() !== "POST")
@@ -21229,6 +21779,8 @@ var require_survey_network_guard = __commonJS({
     var AUTH_PAGE_PATH_RE = /(?:^|\/)(?:log-?in|sign-?in|sign_in|auth|oauth2?|sso|callback)(?:\/|$)/;
     var SIGN_IN_SEGMENT_RE = /^(?:log-?in|sign-?in|sign_in)$/;
     var CALLBACK_ROOT_SEGMENTS = /* @__PURE__ */ new Set(["auth", "oauth", "oauth2", "sso"]);
+    var CALLBACK_PROTOCOL_SEGMENTS = /* @__PURE__ */ new Set(["oidc", "openid", "openid-connect", "openidconnect", "saml", "saml2", "oauth", "oauth2"]);
+    var API_VERSION_SEGMENT_RE = /^v[0-9]{1,3}$/;
     var PROVIDER_SEGMENT_RE = /^[a-z][a-z0-9_-]{0,39}$/;
     var NOT_A_PROVIDER_SEGMENTS = /* @__PURE__ */ new Set([
       "link",
@@ -21267,14 +21819,21 @@ var require_survey_network_guard = __commonJS({
       if (!NOT_A_SESSION_END(segs))
         return false;
       if (AUTH_END_PATH_RE.test(`/${segs.join("/")}`))
-        return true;
+        return !hasDestructiveSegment(rawPathSegments(pathname).slice(0, -1));
+      let top = segs[0] === "api" ? 1 : 0;
+      if (top < segs.length && API_VERSION_SEGMENT_RE.test(segs[top]))
+        top += 1;
+      const below = segs.length - top;
+      const isProvider = (seg) => PROVIDER_SEGMENT_RE.test(seg) && !NOT_A_PROVIDER_SEGMENTS.has(seg);
       const provider = segs[segs.length - 1];
-      const authRootAtTop = segs.length === 3 || segs[segs.length - 4] === "api" && (segs.length === 4 || segs[segs.length - 3] === "auth");
-      if (segs.length >= 3 && authRootAtTop && CALLBACK_ROOT_SEGMENTS.has(segs[segs.length - 3]) && PROVIDER_SEGMENT_RE.test(provider) && !NOT_A_PROVIDER_SEGMENTS.has(provider)) {
+      const authRootAtTop = below === 3 || segs[segs.length - 4] === "api" && segs[segs.length - 3] === "auth";
+      if (segs.length >= 3 && authRootAtTop && CALLBACK_ROOT_SEGMENTS.has(segs[segs.length - 3]) && isProvider(provider)) {
         const step = segs[segs.length - 2];
         if (step === "callback" || step === "signin")
           return true;
       }
+      if (below === 4 && CALLBACK_ROOT_SEGMENTS.has(segs[top]) && CALLBACK_PROTOCOL_SEGMENTS.has(segs[top + 1]) && isProvider(segs[top + 2]) && segs[top + 3] === "callback")
+        return true;
       if (segs.length < 2 || segs[segs.length - 1] !== "callback")
         return false;
       const parent = segs[segs.length - 2];
@@ -21301,7 +21860,7 @@ var require_survey_network_guard = __commonJS({
       try {
         const a = new URL(url);
         const b = new URL(appBaseUrl);
-        const path = (u) => u.pathname.replace(/\/+$/, "");
+        const path = (u) => (0, shared_1.stripTrailingSlashes)(u.pathname);
         return a.origin === b.origin && path(a) === path(b);
       } catch {
         return false;
@@ -21323,9 +21882,15 @@ var require_survey_network_guard = __commonJS({
       const bodyHash = (0, node_crypto_1.createHash)("sha256").update(req.postData ?? "").digest("hex").slice(0, 16);
       return `${record.method} ${url.hostname.toLowerCase()}${url.pathname} ${bodyHash}`;
     }
-    function isGraphqlGetWrite(url, s) {
-      const doc = url.searchParams.get("query");
-      return doc !== null && isGraphqlEndpoint(url, s) && !graphqlDocumentIsQueryOnly(doc);
+    function graphqlUrlCarriesQuery(params) {
+      return params.has("query");
+    }
+    function graphqlGetMayWrite(url, body) {
+      const docs = url.searchParams.getAll("query");
+      return docs.length > 0 && (typeof body === "string" && body.length > 0 || docs.some((doc) => !graphqlDocumentIsQueryOnly(doc)));
+    }
+    function isGraphqlGetWrite(url, s, body) {
+      return isGraphqlEndpoint(url, s) && graphqlGetMayWrite(url, body);
     }
     exports2.WRITE_VERBS = /* @__PURE__ */ new Set([
       "cancel",
@@ -21529,7 +22094,7 @@ var require_survey_network_guard = __commonJS({
       if (url.protocol !== "http:" && url.protocol !== "https:")
         return { action: "allow", rule: readMethod ? "read" : "non-http" };
       const appSite = isAppSite(url.hostname, s.appBaseUrl);
-      const graphqlGet = method === "GET" && isGraphqlGetWrite(url, s);
+      const graphqlGet = method === "GET" && isGraphqlGetWrite(url, s, req.postData);
       const inActionWindow = s.lastActionAt > 0 && s.now - s.lastActionAt <= ACTION_NAVIGATION_WINDOW_MS;
       const typedLoad = s.agentLoad === true && req.resourceType === "document";
       const writeShaped = method === "GET" && appSite && !graphqlGet && (inActionWindow || typedLoad) ? writeShapedGet(req.url, {
@@ -21563,7 +22128,7 @@ var require_survey_network_guard = __commonJS({
         return { action: "allow", rule: "extra-pattern", reason: extra.reason, record };
       if (graphqlGet)
         return { action: "block", rule: "app-write", record };
-      if (method === "POST" && isGraphqlEndpoint(url, s) && isGraphqlQueryOnly(req.postData))
+      if (method === "POST" && isGraphqlEndpoint(url, s) && !graphqlUrlCarriesQuery(url.searchParams) && isGraphqlQueryOnly(req.postData))
         return { action: "allow", rule: "graphql-query", record };
       const passive = s.lastNavigationAt > 0 && (s.lastActionAt === 0 || s.lastNavigationAt >= s.lastActionAt) && s.now - s.lastNavigationAt <= s.passiveWindowMs;
       const signature = learnableSignature(req, url, record, s);
@@ -21595,7 +22160,7 @@ var require_survey_network_guard = __commonJS({
         const re = new RegExp(pattern.source, pattern.flags.replace(/[gy]/g, ""));
         return { reason, test: (hostPath) => re.test(hostPath) };
       }
-      const p = pattern.trim().toLowerCase().replace(/\/+$/, "");
+      const p = (0, shared_1.stripTrailingSlashes)(pattern.trim().toLowerCase());
       if (p.includes("/"))
         return { reason, test: (hostPath) => hostPath.toLowerCase() === p || hostPath.toLowerCase().startsWith(`${p}/`) };
       return { reason, test: (hostPath) => {
@@ -22143,6 +22708,7 @@ var require_survey_repo_route_frontier = __commonJS({
     exports2.buildRepoRouteCandidates = buildRepoRouteCandidates;
     exports2.routeIdsHiddenFromChecklist = routeIdsHiddenFromChecklist;
     exports2.parseRepoRouteCoverage = parseRepoRouteCoverage;
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var route_manifest_js_1 = require_route_manifest();
     var survey_scope_js_1 = require_survey_scope();
     var repo_route_safety_js_1 = require_repo_route_safety();
@@ -22204,7 +22770,7 @@ var require_survey_repo_route_frontier = __commonJS({
         return route;
       try {
         const base = new URL(baseUrl);
-        return `${base.pathname.replace(/\/+$/, "") || "/"}${route}`;
+        return `${(0, shared_1.stripTrailingSlashes)(base.pathname) || "/"}${route}`;
       } catch {
         return `/${route}`;
       }
@@ -22435,7 +23001,7 @@ var require_survey_repo_route_frontier = __commonJS({
         try {
           const base = new URL(input.baseUrl);
           origin = base.origin;
-          basePathname = base.pathname.replace(/\/+$/, "") || "/";
+          basePathname = (0, shared_1.stripTrailingSlashes)(base.pathname) || "/";
         } catch {
           origin = null;
         }
@@ -22468,7 +23034,7 @@ var require_survey_repo_route_frontier = __commonJS({
           return null;
         if (parsed.origin !== this.appOrigin)
           return null;
-        const pathname = parsed.pathname.replace(/\/+$/, "") || "/";
+        const pathname = (0, shared_1.stripTrailingSlashes)(parsed.pathname) || "/";
         const key = manifestRouteKey(`${parsed.pathname}${parsed.search}${parsed.hash}`);
         if (!key)
           return null;
@@ -22933,6 +23499,7 @@ var require_repo_feature_verification = __commonJS({
     exports2.parseBrowserVerificationRequirement = parseBrowserVerificationRequirement;
     exports2.parseBrowserVerificationResult = parseBrowserVerificationResult;
     exports2.renderBrowserVerificationForPrompt = renderBrowserVerificationForPrompt;
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var survey_repo_route_frontier_js_1 = require_survey_repo_route_frontier();
     var ABSOLUTE_URL = /^[a-z][a-z0-9+.-]*:\/\//i;
     function originOf(url) {
@@ -22989,7 +23556,7 @@ var require_repo_feature_verification = __commonJS({
       before = before.split("?")[0];
       if (!before.startsWith("/"))
         return null;
-      return before.replace(/\/+$/, "");
+      return (0, shared_1.stripTrailingSlashes)(before);
     }
     function sameHashMount(route, entry) {
       const entryMount = hashMount(entry);
@@ -23045,7 +23612,7 @@ var require_repo_feature_verification = __commonJS({
     function compileEntryPattern(pattern) {
       const trimmed = String(pattern ?? "").trim();
       const hashAt = trimmed.indexOf("#/");
-      const raw = (hashAt >= 0 || trimmed.startsWith("#") ? trimmed.slice(Math.max(hashAt, 0)).split("?")[0] : trimmed.split(/[?#]/)[0]).replace(/\/+$/, "");
+      const raw = (0, shared_1.stripTrailingSlashes)(hashAt >= 0 || trimmed.startsWith("#") ? trimmed.slice(Math.max(hashAt, 0)).split("?")[0] : trimmed.split(/[?#]/)[0]);
       if (!isEntrySpelling(raw) || raw.length > 500)
         return null;
       let out = "";