@validate.qa/runner 1.0.102 → 1.0.104

package/dist/{chunk-CBVHPYVJ.mjs → chunk-OXDU6ARE.mjs}

@@ -1,7 +1,7 @@
 import {
   dist_exports,
   init_dist
-} from "./chunk-3JM6XTSZ.mjs";
+} from "./chunk-EKY6CN4Y.mjs";
 import {
   __commonJS,
   __esm,
@@ -67467,6 +67467,19 @@ var require_harness_init_script = __commonJS({
       const finishTransitions = opts.finishTransitions ?? (0, shared_1.parseBoolFlag)(process.env.HARNESS_FINISH_CSS_TRANSITIONS);
       const css = finishTransitions ? "*, *::before, *::after { animation-duration: 0s !important; animation-delay: 0s !important; }" : "*, *::before, *::after { transition-duration: 0s !important; animation-duration: 0s !important; transition-delay: 0s !important; animation-delay: 0s !important; }";
       return withHarnessSourceUrl(`(() => {
+  // An error the browser throws for the page's own value, passed through one of the wrappers below (a bad
+  // adoptedStyleSheets list, animate timing it refuses), is the app's: stock Playwright reports it as a page error.
+  // Thrown from our wrapper, its top frame would be this script, and the console evidence drops such an error as
+  // the runner's own. Our frames come out of its stack, so the app's call is the top frame, as without the harness.
+  // (Under Error.stackTraceLimit the stack then has one or two frames fewer than stock's; the top frame is right.)
+  const own = ${JSON.stringify(exports.HARNESS_INIT_SOURCE_URL)};
+  const appError = (e) => {
+    try {
+      const stack = e !== null && typeof e === 'object' ? e.stack : undefined;
+      if (typeof stack === 'string' && stack.includes(own)) e.stack = stack.split('\\n').filter((line) => !line.includes(own)).join('\\n');
+    } catch (x) {}
+    return e;
+  };
   // Layer 1: CSS transitions and animations - instant, not removed
   // (duration 0s preserves final state; 'none' would prevent keyframes from completing)
   // The rule goes in a constructed stylesheet on document.adoptedStyleSheets, which adds no node to the DOM:
@@ -67480,6 +67493,31 @@ var require_harness_init_script = __commonJS({
       sheet.replaceSync(${JSON.stringify(css)});
       document.adoptedStyleSheets = [...document.adoptedStyleSheets, sheet];
       adopted = true;
+      // A page that assigns the list without spreading it (document.adoptedStyleSheets = [mine]) would drop the
+      // harness sheet and bring animations back: keep it, last, on every assignment. A bad value (not iterable,
+      // or a list the browser refuses) goes to the browser, which throws its own error as the app's (appError).
+      try {
+        const desc = Object.getOwnPropertyDescriptor(Document.prototype, 'adoptedStyleSheets');
+        if (desc && desc.get && desc.set) {
+          Object.defineProperty(document, 'adoptedStyleSheets', {
+            configurable: true,
+            enumerable: desc.enumerable,
+            get() { return desc.get.call(document); },
+            set(value) {
+              try {
+                if (value === null || (typeof value !== 'object' && typeof value !== 'function') || typeof value[Symbol.iterator] !== 'function') {
+                  desc.set.call(document, value);
+                  return;
+                }
+                const list = [...value];
+                desc.set.call(document, list.includes(sheet) ? list : [...list, sheet]);
+              } catch (e) {
+                throw appError(e);
+              }
+            },
+          });
+        }
+      } catch (e) {}
     }
   } catch (e) {}
   if (!adopted) try {
@@ -67556,16 +67594,51 @@ ${finishTransitions ? `
 ` : ""}
   // Layer 2: Web Animations API - make instant instead of no-op
   // (preserves animation completion callbacks that app code may depend on)
+  // Timing the browser refuses (a negative, NaN or non-'auto' duration, a delay that is not finite) goes to the
+  // browser as the page wrote it: zeroed, it raised no TypeError, so a page error stock Playwright reports was hidden.
+  // Options that are not a plain object (an array, a class instance) keep what they inherit: the browser reads
+  // every timing member through the prototype chain, and an array's inherited fill() is a TypeError. A copy kept
+  // only own properties, so the error was hidden; a proxy overrides only duration and delay.
   try {
     const origAnimate = Element.prototype.animate;
+    const refused = (options) => {
+      try {
+        if (options === undefined || options === null) return false;
+        if (typeof options !== 'object' && typeof options !== 'function') return !(Number(options) >= 0);
+        const duration = options.duration;
+        if (duration !== undefined && duration !== 'auto' && !(typeof duration === 'number' && duration >= 0)) return true;
+        const delay = options.delay;
+        return delay !== undefined && !Number.isFinite(Number(delay));
+      } catch (e) {
+        return true;
+      }
+    };
+    const instant = (options) => {
+      try {
+        // Plain: its prototype is null or an Object.prototype (of any frame's realm), so it inherits no timing.
+        const proto = Object.getPrototypeOf(options);
+        if (proto !== null && Object.getPrototypeOf(proto) !== null && typeof Proxy === 'function') {
+          // The proxy's target is an empty object, not the options: a target with a read-only, non-configurable
+          // duration or delay (a frozen instance, Object.create with a descriptor) would make returning 0 a proxy
+          // invariant TypeError. Every other member is read from the options, the options as the receiver.
+          return new Proxy({}, { get: (_target, key) => (key === 'duration' || key === 'delay' ? 0 : Reflect.get(options, key)) });
+        }
+      } catch (e) {}
+      return Object.assign({}, options, { duration: 0, delay: 0 });
+    };
     if (typeof origAnimate === 'function') {
       Element.prototype.animate = function (keyframes, options) {
-        if (typeof options === 'object' && options !== null) {
-          options = Object.assign({}, options, { duration: 0, delay: 0 });
-        } else {
-          options = 0; // covers number, undefined, and any other type
+        try {
+          if (refused(options)) return origAnimate.call(this, keyframes, options);
+          if (typeof options === 'object' && options !== null) {
+            options = instant(options);
+          } else {
+            options = 0; // covers number, undefined, and any other type
+          }
+          return origAnimate.call(this, keyframes, options);
+        } catch (e) {
+          throw appError(e);
         }
-        return origAnimate.call(this, keyframes, options);
       };
     }
   } catch (e) {}
@@ -68004,7 +68077,13 @@ await expect(page).not.toHaveURL(/accounts\\.google\\.com/, { timeout: 60_000 })
 \`\`\`
 Never emit code that clicks, fills or asserts anything on accounts.google.com.`;
     }
-    function buildGoogleSignInTestGenSection(_opts) {
+    function buildGoogleSignInTestGenSection(_opts, ctx = {}) {
+      if (ctx.appLoginGiven) {
+        return `
+## SIGN-IN: USE THE TEST ACCOUNT
+This project gave a test account (the Browser Credentials / \`process.env.TEST_USER_*\` values). Sign in with it on the app's own email (or username) and password form, even when the app also offers Continue with Google. Do not click Continue with Google / Sign in with Google / Sign up with Google to sign in.
+Use Continue with Google only when this scenario's goal is the Google sign-in itself, or the app has no email/username and password sign-in at all. Then click that control on the app and wait until the browser is back on the app: \`await expect(page).not.toHaveURL(/accounts\\.google\\.com/, { timeout: 60_000 })\` (the runner completes Google's step). Never click, fill or assert anything on accounts.google.com, never type a password or code there.`;
+      }
       return `
 ## GOOGLE SIGN-IN (the runner completes Google's step)
 When this scenario uses Continue with Google / Sign in with Google / Sign up with Google:

package/dist/{chunk-AAUHXGDS.mjs → chunk-PUMRAFJS.mjs}

@@ -6225,7 +6225,7 @@ var require_repo_acquire = __commonJS({
       return mod && mod.__esModule ? mod : { "default": mod };
     };
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.ARCHIVE_TOO_LARGE_RE = exports.MAX_ZIP_TOTAL_BYTES = exports.MAX_ZIP_FILE_BYTES = exports.MAX_ZIP_ENTRIES = exports.MAX_ARCHIVE_BYTES = void 0;
+    exports.ARCHIVE_TOO_LARGE_RE = exports.REPO_TARBALL_LIMITS = exports.MAX_ZIP_TOTAL_BYTES = exports.MAX_ZIP_FILE_BYTES = exports.MAX_ZIP_ENTRIES = exports.MAX_ARCHIVE_BYTES = void 0;
     exports.acquireRepoForImport = acquireRepoForImport;
     exports.downloadArchiveCapped = downloadArchiveCapped;
     exports.formatArchiveCap = formatArchiveCap;
@@ -6251,6 +6251,7 @@ var require_repo_acquire = __commonJS({
     exports.MAX_ZIP_ENTRIES = 2e4;
     exports.MAX_ZIP_FILE_BYTES = 50 * 1024 * 1024;
     exports.MAX_ZIP_TOTAL_BYTES = 600 * 1024 * 1024;
+    exports.REPO_TARBALL_LIMITS = { maxEntries: 2e5, maxFileBytes: exports.MAX_ZIP_FILE_BYTES, maxTotalBytes: exports.MAX_ZIP_TOTAL_BYTES, oversizeFiles: "skip" };
     function envGithubTokenForImports() {
       const optedIn = ["1", "true", "yes", "on"].includes(String(process.env.RUNNER_IMPORT_ENV_GITHUB_TOKEN ?? "").trim().toLowerCase());
       if (!optedIn)
@@ -6294,7 +6295,14 @@ var require_repo_acquire = __commonJS({
           extractRoot,
           /* strip */
           1,
-          { subject: "repository archive", onUnavailable: "in-process", log, signal: spec.signal, tenantKey: spec.projectId }
+          {
+            subject: "repository archive",
+            onUnavailable: "in-process",
+            log,
+            signal: spec.signal,
+            tenantKey: spec.projectId,
+            limits: { ...exports.REPO_TARBALL_LIMITS }
+          }
         );
         await (0, promises_1.rm)(tarPath, { force: true }).catch(noop);
         log(`[repo-acquire] extracted github tarball (${archiveBytes} bytes)`);
@@ -6317,7 +6325,8 @@ var require_repo_acquire = __commonJS({
               log,
               signal: spec.signal,
               tenantKey: spec.projectId,
-              hint: "Check it is a valid .tar.gz, or upload it as a .zip."
+              hint: "Check it is a valid .tar.gz, or upload it as a .zip.",
+              limits: { ...exports.REPO_TARBALL_LIMITS }
             }
           );
         } else if (kind === "zip") {
@@ -6326,7 +6335,8 @@ var require_repo_acquire = __commonJS({
             log,
             signal: spec.signal,
             tenantKey: spec.projectId,
-            hint: "Check it is a valid .zip, or upload it as a .tar.gz."
+            hint: "Check it is a valid .zip, or upload it as a .tar.gz.",
+            oversizeFiles: exports.REPO_TARBALL_LIMITS.oversizeFiles
           });
         } else {
           await (0, promises_1.rm)(archivePath, { force: true }).catch(noop);
@@ -6536,7 +6546,7 @@ var require_repo_acquire = __commonJS({
           bad = new Error(`Tar entry path contains a NUL byte: ${JSON.stringify(shownPath)}`);
         } else if (typeof size !== "number" || !Number.isSafeInteger(size) || size < 0 || size > MAX_OCTAL_TAR_SIZE) {
           bad = new Error(`Tar entry has an invalid size field: ${shownPath}`);
-        } else if (size > limits.maxFileBytes) {
+        } else if (size > limits.maxFileBytes && limits.oversizeFiles !== "skip") {
           bad = new Error(`Tar entry too large: ${shownPath} (declared ${size} bytes > ${limits.maxFileBytes} cap)`);
         } else if ((declaredTotal += size) > limits.maxTotalBytes) {
           bad = new Error(`Tar total uncompressed size exceeds ${limits.maxTotalBytes} cap (tar-bomb guard)`);
@@ -6603,7 +6613,8 @@ var require_repo_acquire = __commonJS({
             return false;
           }
           const sz = Number(entry.size ?? 0);
-          if (sz > limits.maxFileBytes) {
+          const oversize = sz > limits.maxFileBytes;
+          if (oversize && limits.oversizeFiles !== "skip") {
             capError = new Error(`Tar entry too large: ${p} (declared ${sz} bytes > ${limits.maxFileBytes} cap)`);
             return false;
           }
@@ -6612,13 +6623,13 @@ var require_repo_acquire = __commonJS({
             capError = new Error(`Tar total uncompressed size exceeds ${limits.maxTotalBytes} cap (tar-bomb guard)`);
             return false;
           }
-          return true;
+          return !oversize;
         }
       }));
       if (capError)
         throw capError;
     }
-    async function extractZipSafely(buf, destDir, log = noop) {
+    async function extractZipSafely(buf, destDir, log = noop, options = {}) {
       const zip = new adm_zip_1.default(buf);
       const entries = zip.getEntries();
       if (entries.length > exports.MAX_ZIP_ENTRIES) {
@@ -6627,6 +6638,7 @@ var require_repo_acquire = __commonJS({
       const destResolved = (0, node_path_1.resolve)(destDir);
       let total = 0;
       let files = 0;
+      let skipped = 0;
       for (const entry of entries) {
         const name = entry.entryName;
         if (isUnsafeEntryName(name)) {
@@ -6641,12 +6653,18 @@ var require_repo_acquire = __commonJS({
           continue;
         }
         const declared = entry.header?.size ?? 0;
-        if (declared > exports.MAX_ZIP_FILE_BYTES) {
-          throw new Error(`Zip entry too large: ${name} (declared ${declared} bytes > ${exports.MAX_ZIP_FILE_BYTES} cap)`);
-        }
         if (total + declared > exports.MAX_ZIP_TOTAL_BYTES) {
           throw new Error(`Zip total uncompressed size exceeds ${exports.MAX_ZIP_TOTAL_BYTES} cap (zip-bomb guard)`);
         }
+        if (declared > exports.MAX_ZIP_FILE_BYTES && options.oversizeFiles !== "skip") {
+          throw new Error(`Zip entry too large: ${name} (declared ${declared} bytes > ${exports.MAX_ZIP_FILE_BYTES} cap)`);
+        }
+        if (declared > exports.MAX_ZIP_FILE_BYTES) {
+          total += declared;
+          skipped++;
+          log(`[repo-acquire] zip: skipped ${name} (declared ${declared} bytes > ${exports.MAX_ZIP_FILE_BYTES} per-file cap)`);
+          continue;
+        }
         const data = entry.getData();
         if (data.length > exports.MAX_ZIP_FILE_BYTES) {
           throw new Error(`Zip entry too large: ${name} (${data.length} bytes > ${exports.MAX_ZIP_FILE_BYTES} cap)`);
@@ -6659,7 +6677,7 @@ var require_repo_acquire = __commonJS({
         await (0, promises_1.writeFile)(target, data);
         files++;
       }
-      log(`[repo-acquire] zip extracted: ${files} file(s), ${total} bytes`);
+      log(`[repo-acquire] zip extracted: ${files} file(s), ${total} bytes${skipped ? `, ${skipped} oversize file(s) skipped` : ""}`);
     }
     async function normalizeRepoRoot(extractRoot) {
       let entries;
@@ -7162,7 +7180,13 @@ var require_tar_isolated = __commonJS({
     }
     async function extractZipIsolated(archivePath, destDir, options) {
       try {
-        await runTarJobIsolated({ op: "extract-zip", archivePath: (0, node_path_1.resolve)(archivePath), destDir: (0, node_path_1.resolve)(destDir) }, options.subject, options);
+        const job = {
+          op: "extract-zip",
+          archivePath: (0, node_path_1.resolve)(archivePath),
+          destDir: (0, node_path_1.resolve)(destDir),
+          ...options.oversizeFiles ? { oversizeFiles: options.oversizeFiles } : {}
+        };
+        await runTarJobIsolated(job, options.subject, options);
       } catch (err) {
         if (err instanceof TarIsolationUnavailableError)
           throw refuseUnavailable(err, options.subject, options.log);

package/dist/{chunk-4WLP3RWN.mjs → chunk-TGVKABFN.mjs}

@@ -1,10 +1,10 @@
 import {
   require_survey_network_guard
-} from "./chunk-E2RRAE27.mjs";
+} from "./chunk-UZ67UBXH.mjs";
 import {
   dist_exports,
   init_dist
-} from "./chunk-3JM6XTSZ.mjs";
+} from "./chunk-EKY6CN4Y.mjs";
 import {
   __commonJS,
   __require,
@@ -462,6 +462,13 @@ var require_run_write_guard = __commonJS({
     function currentRunSignInSecrets() {
       return policyScope.getStore()?.signInSecrets ?? [];
     }
+    function isSocketIoPollingPost(pathname, search) {
+      if (pathname !== "/socket.io" && pathname !== "/socket.io/")
+        return false;
+      const eio = search.getAll("EIO");
+      const transport = search.getAll("transport");
+      return eio.length === 1 && /^[0-9]{1,2}$/.test(eio[0]) && transport.length === 1 && transport[0] === "polling";
+    }
     var READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
     var MAX_BODY_CHARS = 262144;
     var MAX_SIGN_IN_LOG_LINES = 20;
@@ -1296,7 +1303,8 @@ var require_run_write_guard = __commonJS({
       const method = facts.method.toUpperCase();
       const host = url.hostname.toLowerCase().replace(/\.$/, "");
       const pathname = url.pathname;
-      if (READ_METHODS.has(method)) {
+      const queryRead = method === "QUERY" && !(0, survey_network_guard_js_1.queryMethodMayWrite)(url, facts.postData, isGraphqlPath(pathname));
+      if (READ_METHODS.has(method) || queryRead) {
         if (method === "GET" && isGraphqlPath(pathname) && (0, survey_network_guard_js_1.graphqlGetMayWrite)(url, facts.postData)) {
           return { action: "write", rule: "graphql-get-mutation", record: describe(facts, url, "graphql-get-mutation") };
         }
@@ -1351,6 +1359,8 @@ var require_run_write_guard = __commonJS({
         if (segs.length > 0 && SEARCH_LAST_SEGMENTS.has(segs[segs.length - 1]))
           return { action: "allow", rule: "search-post" };
       }
+      if (appSite && method === "POST" && isSocketIoPollingPost(pathname, url.searchParams))
+        return { action: "allow", rule: "realtime-poll" };
       if (hostIs(host, PAYMENT_HOSTS))
         return { action: "write", rule: "payment", record: describe(facts, url, "payment") };
       if (appSite)
@@ -2155,6 +2165,32 @@ var require_run_write_guard = __commonJS({
         return false;
       }
     }
+    function contextStartsOffline(context) {
+      try {
+        return context._options?.offline === true;
+      } catch {
+        return false;
+      }
+    }
+    function trackOffline(context) {
+      const state = { offline: contextStartsOffline(context) };
+      const original = context.setOffline;
+      if (typeof original === "function") {
+        Object.assign(context, {
+          setOffline: async (offline) => {
+            const before = state.offline;
+            state.offline = offline === true;
+            try {
+              await original.call(context, offline);
+            } catch (err) {
+              state.offline = before;
+              throw err;
+            }
+          }
+        });
+      }
+      return state;
+    }
     function hopRequestHeaders(pageHeaders, cookie) {
       const out = { accept: "*/*" };
       for (const [name, value] of Object.entries(pageHeaders)) {
@@ -2484,6 +2520,7 @@ var require_run_write_guard = __commonJS({
         return existing;
       const guard = new RunWriteGuard(policy, opts);
       countAppWebSocketMessages(context, guard);
+      const emulated = policy.mode === "block" ? trackOffline(context) : { offline: false };
       if (policy.mode === "observe") {
         context.on("request", (request) => {
           try {
@@ -2516,6 +2553,11 @@ var require_run_write_guard = __commonJS({
             }
           }
           if (decision.action === "allow" && !READ_METHODS.has(request.method().toUpperCase()) && checksRedirect(decision.rule, request.url(), guard.policy)) {
+            if (emulated.offline) {
+              await route.fallback().catch(() => {
+              });
+              return;
+            }
             await sendCheckingRedirect(route, guard, context);
             return;
           }

package/dist/{chunk-5DFBEL72.mjs → chunk-TS4OUJVT.mjs}

@@ -1,7 +1,7 @@
 import {
   require_test_inbox_broker,
   require_verification_inbox
-} from "./chunk-CBVHPYVJ.mjs";
+} from "./chunk-OXDU6ARE.mjs";
 import {
   __commonJS,
   __require

package/dist/{chunk-BXLEPT4M.mjs → chunk-UR7KDOTP.mjs}

@@ -1,13 +1,13 @@
 import {
   require_route_manifest
-} from "./chunk-PWFWMVZU.mjs";
+} from "./chunk-XXZZMG6Q.mjs";
 import {
   require_survey_network_guard
-} from "./chunk-E2RRAE27.mjs";
+} from "./chunk-UZ67UBXH.mjs";
 import {
   dist_exports,
   init_dist
-} from "./chunk-3JM6XTSZ.mjs";
+} from "./chunk-EKY6CN4Y.mjs";
 import {
   __commonJS,
   __toCommonJS
@@ -159,9 +159,10 @@ var require_exploration_parser = __commonJS({
         return false;
       return RECORD_TITLE_WITH_COMPANY.test(name);
     }
-    var TYPED_VALUE_CALL_RE = /\.(fill|type|pressSequentially|insertText)\(\s*(['"])(?:\\.|(?!\2)[^\\])*\2(\s*,\s*\{[^{}]*\})?\s*\)/g;
+    var TYPED_VALUE_CALL_RE = /\.(fill|type|pressSequentially|insertText)\(\s*(['"`])(?:\\.|(?!\2)[^\\])*\2(\s*,\s*\{[^{}]*\})?\s*\)/g;
+    var TWO_ARG_TYPED_VALUE_CALL_RE = /\.(fill|type)\(\s*((?:(['"`])(?:\\.|(?!\3)[^\\])*\3|[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*))\s*,\s*(['"`])(?:\\.|(?!\4)[^\\])*\4(\s*,\s*\{[^{}]*\})?\s*\)/g;
     function maskTypedValues(codeLine, mask) {
-      return codeLine.replace(TYPED_VALUE_CALL_RE, (_all, method, _quote, options) => `.${method}(${mask}${options ?? ""})`);
+      return codeLine.replace(TWO_ARG_TYPED_VALUE_CALL_RE, (_all, method, selector, _selQuote, _quote, options) => `.${method}(${selector}, ${mask}${options ?? ""})`).replace(TYPED_VALUE_CALL_RE, (_all, method, _quote, options) => `.${method}(${mask}${options ?? ""})`);
     }
     function sanitizePromptCodeLine(codeLine) {
       let sanitized = codeLine;
@@ -1903,8 +1904,9 @@ var require_repo_feature_verification = __commonJS({
       "the",
       "for"
     ]);
+    var UNSPACED_SCRIPT = /[\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Hangul}]/u;
     function rootCardTerms(featureName) {
-      const words = String(featureName ?? "").toLowerCase().split(/[^a-z0-9]+/).filter((w) => w.length >= 4 && !ROOT_GENERIC_WORDS.has(w));
+      const words = String(featureName ?? "").toLowerCase().split(/[^\p{L}\p{N}]+/u).filter((w) => [...w].length >= (UNSPACED_SCRIPT.test(w) ? 2 : 4) && !ROOT_GENERIC_WORDS.has(w));
       return [...new Set(words.map((w) => w.length > 4 && w.endsWith("s") ? w.slice(0, -1) : w))];
     }
     function textShowsAnyTerm(text, terms) {
@@ -1958,7 +1960,7 @@ var require_repo_feature_verification = __commonJS({
       return null;
     }
     function normalizeControlText(text) {
-      return text.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
+      return text.normalize("NFKD").replace(/(\p{Script=Latin})\p{M}+/gu, "$1").normalize("NFKC").toLowerCase().replace(/[^\p{L}\p{N}\p{M}]+/gu, " ").trim();
     }
     var SESSION_END_LABEL = /^(?:log|sign) ?(?:out|off)$/;
     var SESSION_END_SPELLINGS = ["log out", "logout", "log off", "logoff", "sign out", "signout", "sign off", "signoff"];
@@ -1971,13 +1973,35 @@ var require_repo_feature_verification = __commonJS({
         return [];
       return SESSION_END_LABEL.test(wanted) ? SESSION_END_SPELLINGS : [wanted];
     }
+    var SHORT_LABEL_CHARS = 2;
+    var WORD_SEGMENTER = new Intl.Segmenter(void 0, { granularity: "word" });
+    function wholeWordsSpell(text, wanted) {
+      const words = [];
+      for (const s of WORD_SEGMENTER.segment(text))
+        if (s.isWordLike)
+          words.push(s.segment);
+      for (let i = 0; i < words.length; i++) {
+        let run = "";
+        for (let j = i; j < words.length && run.length < wanted.length; j++) {
+          run += words[j];
+          if (run === wanted)
+            return true;
+        }
+      }
+      return false;
+    }
     function textNamesControl(text, label) {
       const spellings = controlSpellings(label);
       if (spellings.length === 0)
         return false;
       const haystack = normalizeControlText(text);
       const squeezed = haystack.replace(/ /g, "");
-      return spellings.some((w) => haystack.includes(w) || squeezed.includes(w.replace(/ /g, "")));
+      return spellings.some((w) => {
+        const bare = w.replace(/ /g, "");
+        if (!haystack.includes(w) && !squeezed.includes(bare))
+          return false;
+        return [...bare].length > SHORT_LABEL_CHARS || wholeWordsSpell(haystack, bare);
+      });
     }
     function pageShowsControl(page, label) {
       const text = capturedPageText(page);

package/dist/{chunk-E2RRAE27.mjs → chunk-UZ67UBXH.mjs}

@@ -1,7 +1,7 @@
 import {
   dist_exports,
   init_dist
-} from "./chunk-3JM6XTSZ.mjs";
+} from "./chunk-EKY6CN4Y.mjs";
 import {
   __commonJS,
   __require,
@@ -27,6 +27,7 @@ var require_survey_network_guard = __commonJS({
     exports.graphqlUrlCarriesQuery = graphqlUrlCarriesQuery;
     exports.graphqlUrlQueriesAreReads = graphqlUrlQueriesAreReads;
     exports.graphqlGetMayWrite = graphqlGetMayWrite;
+    exports.queryMethodMayWrite = queryMethodMayWrite;
     exports.writeShapedGet = writeShapedGet;
     exports.decideSurveyRequest = decideSurveyRequest;
     exports.installSurveyNetworkGuard = installSurveyNetworkGuard;
@@ -591,6 +592,12 @@ var require_survey_network_guard = __commonJS({
       const docs = url.searchParams.getAll("query");
       return docs.length > 0 && (typeof body === "string" && body.length > 0 || docs.some((doc) => !graphqlDocumentIsQueryOnly(doc)));
     }
+    function queryMethodMayWrite(url, body, graphqlEndpoint) {
+      if (graphqlEndpoint)
+        return true;
+      const operation = /\b(?:mutation|subscription)\b/i;
+      return typeof body === "string" && operation.test(body) || [...url.searchParams.values()].some((v) => operation.test(v));
+    }
     function isGraphqlGetWrite(url, s, body) {
       return isGraphqlEndpoint(url, s) && graphqlGetMayWrite(url, body);
     }
@@ -618,6 +625,7 @@ var require_survey_network_guard = __commonJS({
       "log-out"
     ]);
     exports.AMBIGUOUS_WRITE_VERBS = /* @__PURE__ */ new Set(["archive", "confirm", "disable"]);
+    var LABEL_PAGE_NOUNS = /* @__PURE__ */ new Set(["archive"]);
     var RESET_PAGE_WORDS = /* @__PURE__ */ new Set(["reset-password", "password-reset", "reset_password", "password_reset", "resetpassword", "forgot-password"]);
     var isTokenLikeSegment = (seg) => exports.ID_SEGMENT_RE.test(seg) || /^[A-Za-z0-9_-]{20,}$/.test(seg);
     var WRITE_SHAPED_STATIC_EXTENSIONS = [
@@ -763,6 +771,8 @@ var require_survey_network_guard = __commonJS({
       if (oneTimeToken)
         return { reason: "one-time-token" };
       const verb = opts.triggerLabel ? labelVerb(opts.triggerLabel) : void 0;
+      if (verb && LABEL_PAGE_NOUNS.has(verb) && last === verb && params.length === 0)
+        return null;
       return verb && !opts.ignoreVerbs?.has(verb) ? { reason: "label", verb } : null;
     }
     function writeShapedText(w) {
@@ -797,9 +807,10 @@ var require_survey_network_guard = __commonJS({
         return { action: "allow", rule: readMethod ? "read" : "non-http" };
       const appSite = isAppSite(url.hostname, s.appBaseUrl);
       const graphqlGet = method === "GET" && isGraphqlGetWrite(url, s, req.postData);
+      const queryRead = method === "QUERY" && !queryMethodMayWrite(url, req.postData, isGraphqlEndpoint(url, s));
       const inActionWindow = s.lastActionAt > 0 && s.now - s.lastActionAt <= ACTION_NAVIGATION_WINDOW_MS;
       const typedLoad = s.agentLoad === true && req.resourceType === "document";
-      const writeShaped = method === "GET" && appSite && !graphqlGet && (inActionWindow || typedLoad) ? writeShapedGet(req.url, {
+      const writeShaped = (method === "GET" || queryRead) && appSite && !graphqlGet && (inActionWindow || typedLoad) ? writeShapedGet(req.url, {
         appSites: appSitesOf(s.appBaseUrl),
         resourceType: req.resourceType ?? "",
         // A label says what a click opens: it only judges a page load, never the app's own fetches, and never a typed URL.
@@ -807,7 +818,7 @@ var require_survey_network_guard = __commonJS({
       }) : null;
       if (writeShaped)
         return decideWriteShapedGet(req, s, writeShaped);
-      if (readMethod && !graphqlGet)
+      if ((readMethod || queryRead) && !graphqlGet)
         return { action: "allow", rule: "read" };
       if (!appSite && ((0, shared_1.isAuthProviderHost)(url.hostname) || isTelemetryHost(url.hostname)))
         return { action: "allow", rule: "third-party" };

package/dist/{chunk-HJ6FKHMM.mjs → chunk-VWE3SQ2Z.mjs}

@@ -1,6 +1,6 @@
 import {
   require_route_manifest
-} from "./chunk-PWFWMVZU.mjs";
+} from "./chunk-XXZZMG6Q.mjs";
 import {
   __commonJS,
   __require

package/dist/{chunk-PWFWMVZU.mjs → chunk-XXZZMG6Q.mjs}

@@ -1,7 +1,7 @@
 import {
   dist_exports,
   init_dist
-} from "./chunk-3JM6XTSZ.mjs";
+} from "./chunk-EKY6CN4Y.mjs";
 import {
   __commonJS,
   __require,
@@ -133,6 +133,7 @@ var require_repo_brief = __commonJS({
     exports.briefSectionForFeature = briefSectionForFeature;
     exports.buildBriefRouteAllowlist = buildBriefRouteAllowlist;
     exports.buildBriefDoNotTestRoutes = buildBriefDoNotTestRoutes;
+    exports.briefJobRoute = briefJobRoute;
     exports.unopenedBriefJobs = unopenedBriefJobs;
     var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var model_json_document_js_1 = require_model_json_document();
@@ -391,14 +392,25 @@ ${scenarios}` : ""
       }
       return [...routes];
     }
-    function unopenedBriefJobs(brief, coveredText) {
+    var ENTRY_ROUTE_RE = /(?:^|[\s(])((?:\/|#\/)[^\s?,;()]*)/;
+    function briefJobRoute(job) {
+      const match = ENTRY_ROUTE_RE.exec(job.entry.trim());
+      if (!match)
+        return null;
+      const route = match[1].replace(/[.:]+$/, "");
+      return route === "#/" ? null : route || null;
+    }
+    function unopenedBriefJobs(brief, coveredText, isOpenedRoute) {
       const haystack = coveredText.toLowerCase();
       return brief.jobs.filter((job) => {
         if (job.doNotTest)
           return false;
         const name = job.name.toLowerCase();
         const entry = job.entry.toLowerCase();
-        return !haystack.includes(name) && !haystack.includes(entry);
+        if (haystack.includes(name) || haystack.includes(entry))
+          return false;
+        const route = isOpenedRoute ? briefJobRoute(job) : null;
+        return !(route && isOpenedRoute?.(route));
       });
     }
     exports.REPO_BRIEF_PROMPT = [