@validate.qa/runner 1.0.100 → 1.0.101

package/dist/{chunk-II7QW7MZ.mjs → chunk-M3VZGHZQ.mjs}

@@ -1,13 +1,13 @@
 import {
   require_route_manifest
-} from "./chunk-WDXLAZ2J.mjs";
+} from "./chunk-CO5KHIVX.mjs";
 import {
   require_survey_network_guard
-} from "./chunk-GIIIVO2W.mjs";
+} from "./chunk-SN3PN4G4.mjs";
 import {
   dist_exports,
   init_dist
-} from "./chunk-MBKGTELT.mjs";
+} from "./chunk-IGXGSDE3.mjs";
 import {
   __commonJS,
   __toCommonJS
@@ -31,6 +31,7 @@ var require_exploration_parser = __commonJS({
     exports.normalizeRouteForFocusScope = normalizeRouteForFocusScope;
     exports.routeIsWithinFocusAreas = routeIsWithinFocusAreas;
     exports.detectRouteFromResponse = detectRouteFromResponse;
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     function extractCodeLines(toolResultContent) {
       const isPlaywrightLine = (l) => l.startsWith("await page.") || l.startsWith("await expect(");
       const codeSection = toolResultContent.match(/###\s*Ran Playwright code\s*\n([\s\S]*?)(?=\n###|\n$|$)/);
@@ -324,7 +325,7 @@ var require_exploration_parser = __commonJS({
       const decoded = raw.replace(/&/g, "&").replace(/&#(\d+);/g, (_m, code) => String.fromCharCode(Number(code)));
       try {
         const url = new URL(decoded, "http://canonical.invalid");
-        url.pathname = url.pathname.replace(/\/+$/, "") || "/";
+        url.pathname = (0, shared_1.stripTrailingSlashes)(url.pathname) || "/";
         return normalizeRoute(url);
       } catch {
         return decoded;
@@ -356,9 +357,9 @@ var require_exploration_parser = __commonJS({
       const text = String(route ?? "").trim();
       const at = text.indexOf("#/");
       if (at < 0)
-        return text.startsWith("#") ? text.split("?")[0].toLowerCase().replace(/\/+$/, "") : null;
+        return text.startsWith("#") ? (0, shared_1.stripTrailingSlashes)(text.split("?")[0].toLowerCase()) : null;
       const hashPath = text.slice(at).split("?")[0].toLowerCase();
-      return hashPath.length > 2 ? hashPath.replace(/\/+$/, "") || "#/" : hashPath;
+      return hashPath.length > 2 ? (0, shared_1.stripTrailingSlashes)(hashPath) || "#/" : hashPath;
     }
     function routeIsWithinFocusAreas(route, focusAreas, otherRoutes) {
       if (!focusAreas || focusAreas.length === 0)
@@ -839,6 +840,7 @@ var require_survey_repo_route_frontier = __commonJS({
     exports.buildRepoRouteCandidates = buildRepoRouteCandidates;
     exports.routeIdsHiddenFromChecklist = routeIdsHiddenFromChecklist;
     exports.parseRepoRouteCoverage = parseRepoRouteCoverage;
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var route_manifest_js_1 = require_route_manifest();
     var survey_scope_js_1 = require_survey_scope();
     var repo_route_safety_js_1 = require_repo_route_safety();
@@ -900,7 +902,7 @@ var require_survey_repo_route_frontier = __commonJS({
         return route;
       try {
         const base = new URL(baseUrl);
-        return `${base.pathname.replace(/\/+$/, "") || "/"}${route}`;
+        return `${(0, shared_1.stripTrailingSlashes)(base.pathname) || "/"}${route}`;
       } catch {
         return `/${route}`;
       }
@@ -1131,7 +1133,7 @@ var require_survey_repo_route_frontier = __commonJS({
         try {
           const base = new URL(input.baseUrl);
           origin = base.origin;
-          basePathname = base.pathname.replace(/\/+$/, "") || "/";
+          basePathname = (0, shared_1.stripTrailingSlashes)(base.pathname) || "/";
         } catch {
           origin = null;
         }
@@ -1164,7 +1166,7 @@ var require_survey_repo_route_frontier = __commonJS({
           return null;
         if (parsed.origin !== this.appOrigin)
           return null;
-        const pathname = parsed.pathname.replace(/\/+$/, "") || "/";
+        const pathname = (0, shared_1.stripTrailingSlashes)(parsed.pathname) || "/";
         const key = manifestRouteKey(`${parsed.pathname}${parsed.search}${parsed.hash}`);
         if (!key)
           return null;
@@ -1629,6 +1631,7 @@ var require_repo_feature_verification = __commonJS({
     exports.parseBrowserVerificationRequirement = parseBrowserVerificationRequirement;
     exports.parseBrowserVerificationResult = parseBrowserVerificationResult;
     exports.renderBrowserVerificationForPrompt = renderBrowserVerificationForPrompt;
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var survey_repo_route_frontier_js_1 = require_survey_repo_route_frontier();
     var ABSOLUTE_URL = /^[a-z][a-z0-9+.-]*:\/\//i;
     function originOf(url) {
@@ -1685,7 +1688,7 @@ var require_repo_feature_verification = __commonJS({
       before = before.split("?")[0];
       if (!before.startsWith("/"))
         return null;
-      return before.replace(/\/+$/, "");
+      return (0, shared_1.stripTrailingSlashes)(before);
     }
     function sameHashMount(route, entry) {
       const entryMount = hashMount(entry);
@@ -1741,7 +1744,7 @@ var require_repo_feature_verification = __commonJS({
     function compileEntryPattern(pattern) {
       const trimmed = String(pattern ?? "").trim();
       const hashAt = trimmed.indexOf("#/");
-      const raw = (hashAt >= 0 || trimmed.startsWith("#") ? trimmed.slice(Math.max(hashAt, 0)).split("?")[0] : trimmed.split(/[?#]/)[0]).replace(/\/+$/, "");
+      const raw = (0, shared_1.stripTrailingSlashes)(hashAt >= 0 || trimmed.startsWith("#") ? trimmed.slice(Math.max(hashAt, 0)).split("?")[0] : trimmed.split(/[?#]/)[0]);
       if (!isEntrySpelling(raw) || raw.length > 500)
         return null;
       let out = "";

package/dist/{chunk-GIIIVO2W.mjs → chunk-SN3PN4G4.mjs}

@@ -1,7 +1,7 @@
 import {
   dist_exports,
   init_dist
-} from "./chunk-MBKGTELT.mjs";
+} from "./chunk-IGXGSDE3.mjs";
 import {
   __commonJS,
   __require,
@@ -21,8 +21,11 @@ var require_survey_network_guard = __commonJS({
     exports.maskedPath = maskedPath;
     exports.bodyKeysOf = bodyKeysOf;
     exports.graphqlDocumentIsQueryOnly = graphqlDocumentIsQueryOnly;
+    exports.graphqlOperationRoots = graphqlOperationRoots;
     exports.isTokenRefreshWrite = isTokenRefreshWrite;
     exports.isSignInPathWrite = isSignInPathWrite;
+    exports.graphqlUrlCarriesQuery = graphqlUrlCarriesQuery;
+    exports.graphqlGetMayWrite = graphqlGetMayWrite;
     exports.writeShapedGet = writeShapedGet;
     exports.decideSurveyRequest = decideSurveyRequest;
     exports.installSurveyNetworkGuard = installSurveyNetworkGuard;
@@ -299,6 +302,100 @@ var require_survey_network_guard = __commonJS({
       }
       return depth === 0 && parens === 0 && objects === 0 && sawOperation;
     }
+    function graphqlOperationRoots(text) {
+      const tokens = lexGraphql(text);
+      if (!tokens)
+        return null;
+      const ops = [];
+      let depth = 0;
+      let parens = 0;
+      let objects = 0;
+      let defStart = true;
+      let kind = null;
+      let current = null;
+      let prev = "";
+      for (const tok of tokens) {
+        const last = prev;
+        prev = tok;
+        if (tok === "(") {
+          parens++;
+          continue;
+        }
+        if (tok === ")") {
+          parens--;
+          if (parens < 0 || objects !== 0)
+            return null;
+          continue;
+        }
+        if (parens > 0) {
+          if (tok === "{")
+            objects++;
+          else if (tok === "}") {
+            objects--;
+            if (objects < 0)
+              return null;
+          }
+          continue;
+        }
+        if (tok === "{") {
+          if (depth === 0) {
+            if (defStart)
+              kind = "query";
+            else if (kind === null)
+              return null;
+            current = kind === "fragment" ? null : { kind, roots: [] };
+            if (current)
+              ops.push(current);
+            defStart = false;
+          }
+          depth++;
+          continue;
+        }
+        if (tok === "}") {
+          depth--;
+          if (depth < 0)
+            return null;
+          if (depth === 0) {
+            defStart = true;
+            kind = null;
+            current = null;
+          }
+          continue;
+        }
+        if (depth === 0) {
+          if (!/^[_A-Za-z]/.test(tok)) {
+            if (tok === "@")
+              continue;
+            return null;
+          }
+          if (defStart) {
+            if (tok !== "query" && tok !== "mutation" && tok !== "fragment")
+              return null;
+            kind = tok;
+            defStart = false;
+          }
+          continue;
+        }
+        if (depth > 1 || !current)
+          continue;
+        if (/^[_A-Za-z]/.test(tok)) {
+          if (last === "@")
+            continue;
+          if (last === ":") {
+            if (current.roots.length === 0)
+              return null;
+            current.roots[current.roots.length - 1] = tok;
+            continue;
+          }
+          current.roots.push(tok);
+          continue;
+        }
+        if (tok === ":" || tok === "@")
+          continue;
+        return null;
+      }
+      return depth === 0 && parens === 0 && objects === 0 ? ops : null;
+    }
     function isGraphqlQueryOnly(postData) {
       if (!postData || postData.length > MAX_BODY_CHARS)
         return false;
@@ -336,6 +433,34 @@ var require_survey_network_guard = __commonJS({
       "remove"
     ]);
     var NOT_A_SESSION_END = (segs) => !segs.some((seg) => SESSION_END_SEGMENTS.has(seg));
+    var DESTRUCTIVE_WORDS = /* @__PURE__ */ new Set([
+      "delete",
+      "remove",
+      "destroy",
+      "deactivate",
+      "terminate",
+      "purge",
+      "wipe",
+      "erase",
+      "cancel",
+      "close",
+      "revoke",
+      "unlink",
+      "disconnect"
+    ]);
+    var DESTRUCTIVE_PREFIXES = ["delete", "remove", "destroy", "deactivate", "terminate", "purge"];
+    function hasDestructiveSegment(rawSegs) {
+      return rawSegs.some((raw) => {
+        let seg = raw;
+        try {
+          seg = decodeURIComponent(raw);
+        } catch {
+        }
+        const words = seg.replace(/([a-z0-9])([A-Z])/g, "$1 $2").toLowerCase().split(/[^a-z0-9]+/);
+        return words.some((word) => DESTRUCTIVE_WORDS.has(word) || DESTRUCTIVE_PREFIXES.some((p) => word.startsWith(p)));
+      });
+    }
+    var rawPathSegments = (pathname) => pathname.split("/").map((seg) => seg.split(";")[0]).filter(Boolean);
     var pathSegments = (pathname) => pathname.toLowerCase().split("/").map((seg) => seg.split(";")[0]).filter(Boolean);
     function isTokenRefreshWrite(method, pathname, recentAction = false) {
       if (method.toUpperCase() !== "POST")
@@ -352,6 +477,8 @@ var require_survey_network_guard = __commonJS({
     var AUTH_PAGE_PATH_RE = /(?:^|\/)(?:log-?in|sign-?in|sign_in|auth|oauth2?|sso|callback)(?:\/|$)/;
     var SIGN_IN_SEGMENT_RE = /^(?:log-?in|sign-?in|sign_in)$/;
     var CALLBACK_ROOT_SEGMENTS = /* @__PURE__ */ new Set(["auth", "oauth", "oauth2", "sso"]);
+    var CALLBACK_PROTOCOL_SEGMENTS = /* @__PURE__ */ new Set(["oidc", "openid", "openid-connect", "openidconnect", "saml", "saml2", "oauth", "oauth2"]);
+    var API_VERSION_SEGMENT_RE = /^v[0-9]{1,3}$/;
     var PROVIDER_SEGMENT_RE = /^[a-z][a-z0-9_-]{0,39}$/;
     var NOT_A_PROVIDER_SEGMENTS = /* @__PURE__ */ new Set([
       "link",
@@ -390,14 +517,21 @@ var require_survey_network_guard = __commonJS({
       if (!NOT_A_SESSION_END(segs))
         return false;
       if (AUTH_END_PATH_RE.test(`/${segs.join("/")}`))
-        return true;
+        return !hasDestructiveSegment(rawPathSegments(pathname).slice(0, -1));
+      let top = segs[0] === "api" ? 1 : 0;
+      if (top < segs.length && API_VERSION_SEGMENT_RE.test(segs[top]))
+        top += 1;
+      const below = segs.length - top;
+      const isProvider = (seg) => PROVIDER_SEGMENT_RE.test(seg) && !NOT_A_PROVIDER_SEGMENTS.has(seg);
       const provider = segs[segs.length - 1];
-      const authRootAtTop = segs.length === 3 || segs[segs.length - 4] === "api" && (segs.length === 4 || segs[segs.length - 3] === "auth");
-      if (segs.length >= 3 && authRootAtTop && CALLBACK_ROOT_SEGMENTS.has(segs[segs.length - 3]) && PROVIDER_SEGMENT_RE.test(provider) && !NOT_A_PROVIDER_SEGMENTS.has(provider)) {
+      const authRootAtTop = below === 3 || segs[segs.length - 4] === "api" && segs[segs.length - 3] === "auth";
+      if (segs.length >= 3 && authRootAtTop && CALLBACK_ROOT_SEGMENTS.has(segs[segs.length - 3]) && isProvider(provider)) {
         const step = segs[segs.length - 2];
         if (step === "callback" || step === "signin")
           return true;
       }
+      if (below === 4 && CALLBACK_ROOT_SEGMENTS.has(segs[top]) && CALLBACK_PROTOCOL_SEGMENTS.has(segs[top + 1]) && isProvider(segs[top + 2]) && segs[top + 3] === "callback")
+        return true;
       if (segs.length < 2 || segs[segs.length - 1] !== "callback")
         return false;
       const parent = segs[segs.length - 2];
@@ -424,7 +558,7 @@ var require_survey_network_guard = __commonJS({
       try {
         const a = new URL(url);
         const b = new URL(appBaseUrl);
-        const path = (u) => u.pathname.replace(/\/+$/, "");
+        const path = (u) => (0, shared_1.stripTrailingSlashes)(u.pathname);
         return a.origin === b.origin && path(a) === path(b);
       } catch {
         return false;
@@ -446,9 +580,15 @@ var require_survey_network_guard = __commonJS({
       const bodyHash = (0, node_crypto_1.createHash)("sha256").update(req.postData ?? "").digest("hex").slice(0, 16);
       return `${record.method} ${url.hostname.toLowerCase()}${url.pathname} ${bodyHash}`;
     }
-    function isGraphqlGetWrite(url, s) {
-      const doc = url.searchParams.get("query");
-      return doc !== null && isGraphqlEndpoint(url, s) && !graphqlDocumentIsQueryOnly(doc);
+    function graphqlUrlCarriesQuery(params) {
+      return params.has("query");
+    }
+    function graphqlGetMayWrite(url, body) {
+      const docs = url.searchParams.getAll("query");
+      return docs.length > 0 && (typeof body === "string" && body.length > 0 || docs.some((doc) => !graphqlDocumentIsQueryOnly(doc)));
+    }
+    function isGraphqlGetWrite(url, s, body) {
+      return isGraphqlEndpoint(url, s) && graphqlGetMayWrite(url, body);
     }
     exports.WRITE_VERBS = /* @__PURE__ */ new Set([
       "cancel",
@@ -652,7 +792,7 @@ var require_survey_network_guard = __commonJS({
       if (url.protocol !== "http:" && url.protocol !== "https:")
         return { action: "allow", rule: readMethod ? "read" : "non-http" };
       const appSite = isAppSite(url.hostname, s.appBaseUrl);
-      const graphqlGet = method === "GET" && isGraphqlGetWrite(url, s);
+      const graphqlGet = method === "GET" && isGraphqlGetWrite(url, s, req.postData);
       const inActionWindow = s.lastActionAt > 0 && s.now - s.lastActionAt <= ACTION_NAVIGATION_WINDOW_MS;
       const typedLoad = s.agentLoad === true && req.resourceType === "document";
       const writeShaped = method === "GET" && appSite && !graphqlGet && (inActionWindow || typedLoad) ? writeShapedGet(req.url, {
@@ -686,7 +826,7 @@ var require_survey_network_guard = __commonJS({
         return { action: "allow", rule: "extra-pattern", reason: extra.reason, record };
       if (graphqlGet)
         return { action: "block", rule: "app-write", record };
-      if (method === "POST" && isGraphqlEndpoint(url, s) && isGraphqlQueryOnly(req.postData))
+      if (method === "POST" && isGraphqlEndpoint(url, s) && !graphqlUrlCarriesQuery(url.searchParams) && isGraphqlQueryOnly(req.postData))
         return { action: "allow", rule: "graphql-query", record };
       const passive = s.lastNavigationAt > 0 && (s.lastActionAt === 0 || s.lastNavigationAt >= s.lastActionAt) && s.now - s.lastNavigationAt <= s.passiveWindowMs;
       const signature = learnableSignature(req, url, record, s);
@@ -718,7 +858,7 @@ var require_survey_network_guard = __commonJS({
         const re = new RegExp(pattern.source, pattern.flags.replace(/[gy]/g, ""));
         return { reason, test: (hostPath) => re.test(hostPath) };
       }
-      const p = pattern.trim().toLowerCase().replace(/\/+$/, "");
+      const p = (0, shared_1.stripTrailingSlashes)(pattern.trim().toLowerCase());
       if (p.includes("/"))
         return { reason, test: (hostPath) => hostPath.toLowerCase() === p || hostPath.toLowerCase().startsWith(`${p}/`) };
       return { reason, test: (hostPath) => {

package/dist/{chunk-6NIT2CCH.mjs → chunk-TPU42VH2.mjs}

@@ -2,11 +2,11 @@ import {
   require_google_signin,
   require_harness_init_script,
   require_test_inbox_broker
-} from "./chunk-MAO6ADAO.mjs";
+} from "./chunk-FQUH2PU2.mjs";
 import {
   dist_exports,
   init_dist
-} from "./chunk-MBKGTELT.mjs";
+} from "./chunk-IGXGSDE3.mjs";
 import {
   __commonJS,
   __require,
@@ -553,11 +553,13 @@ var require_proc_table = __commonJS({
   "../runner-core/dist/utils/proc-table.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
+    exports.PS_MAX_BUFFER = void 0;
     exports.isMissingBinaryError = isMissingBinaryError;
     exports.parseProcStat = parseProcStat;
     exports.readProcRssKb = readProcRssKb;
     exports.readProcTable = readProcTable;
     var node_fs_1 = __require("fs");
+    exports.PS_MAX_BUFFER = 32 * 1024 * 1024;
     var CLOCK_TICKS_PER_SECOND = 100;
     function isMissingBinaryError(error) {
       return error?.code === "ENOENT";
@@ -643,14 +645,13 @@ var require_kill_tree = __commonJS({
     var proc_table_js_1 = require_proc_table();
     var execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);
     var PS_TIMEOUT_MS = 2e3;
-    var PS_BUFFER = 1024 * 1024;
     async function listProcessRows(timeoutMs = PS_TIMEOUT_MS) {
       const controller = new AbortController();
       const timer = setTimeout(() => controller.abort(), timeoutMs);
       timer.unref?.();
       try {
         const { stdout } = await execFileAsync("ps", ["-A", "-o", "pid=,ppid=,command="], {
-          maxBuffer: PS_BUFFER,
+          maxBuffer: proc_table_js_1.PS_MAX_BUFFER,
           signal: controller.signal
         });
         const rows = [];
@@ -687,7 +688,7 @@ var require_kill_tree = __commonJS({
       timer.unref?.();
       try {
         const { stdout } = await execFileAsync("ps", ["-A", "-o", "pid=,ppid=,pgid=,stat="], {
-          maxBuffer: PS_BUFFER,
+          maxBuffer: proc_table_js_1.PS_MAX_BUFFER,
           signal: controller.signal
         });
         const tree = /* @__PURE__ */ new Map();
@@ -797,15 +798,15 @@ var require_kill_tree = __commonJS({
         const rows = await listProcessRows(timeoutMs);
         return new Set(rows.filter((row) => row.ppid === parentPid && commandRegex.test(row.command)).map((row) => row.pid));
       } catch {
-        return /* @__PURE__ */ new Set();
+        return null;
       }
     }
     var chromiumLaunchTail = Promise.resolve();
     async function launchWithChromiumRootPid(launch, options = {}) {
       const run = async () => {
-        const prior = await snapshotMatchingChildren(process.pid, options.commandRegex, options.timeoutMs).catch(() => /* @__PURE__ */ new Set());
+        const prior = await snapshotMatchingChildren(process.pid, options.commandRegex, options.timeoutMs).catch(() => null);
         const value = await launch();
-        const rootPid = await findNewChromiumChildPid(process.pid, prior, options).catch(() => null);
+        const rootPid = prior ? await findNewChromiumChildPid(process.pid, prior, options).catch(() => null) : null;
         return { value, rootPid };
       };
       const turn = chromiumLaunchTail.then(run);
@@ -5736,9 +5737,9 @@ export {
   require_survey_door_harvester,
   require_self_account_guard,
   require_test_user_identity_guard,
+  require_mcp_redaction_secrets,
   require_playwright_mcp_server,
   require_mcp_rooted_client,
-  require_mcp_redaction_secrets,
   require_proc_table,
   require_kill_tree,
   require_playwright_mcp_config,

package/dist/{chunk-MHFP3QXU.mjs → chunk-XZUUBMP3.mjs}

@@ -1,7 +1,7 @@
 import {
   require_test_inbox_broker,
   require_verification_inbox
-} from "./chunk-MAO6ADAO.mjs";
+} from "./chunk-FQUH2PU2.mjs";
 import {
   __commonJS,
   __require