@validate.qa/runner 1.0.102 → 1.0.104

package/dist/cli.mjs

@@ -33,23 +33,23 @@ import {
   require_resource_governor,
   require_result_api_call_bodies,
   require_result_shed
-} from "./chunk-DN3O6EYT.mjs";
+} from "./chunk-MEE4DXRX.mjs";
 import {
   require_tar_isolated
-} from "./chunk-AAUHXGDS.mjs";
+} from "./chunk-PUMRAFJS.mjs";
 import "./chunk-EXRFHATN.mjs";
 import {
   require_browser_config,
   require_cloud_runner
-} from "./chunk-ZZYBRIBT.mjs";
-import "./chunk-BXLEPT4M.mjs";
-import "./chunk-5DFBEL72.mjs";
-import "./chunk-CBVHPYVJ.mjs";
-import "./chunk-HJ6FKHMM.mjs";
-import "./chunk-PWFWMVZU.mjs";
-import "./chunk-E2VEMBQQ.mjs";
-import "./chunk-4WLP3RWN.mjs";
-import "./chunk-E2RRAE27.mjs";
+} from "./chunk-EBWZ7NGU.mjs";
+import "./chunk-UR7KDOTP.mjs";
+import "./chunk-TS4OUJVT.mjs";
+import "./chunk-OXDU6ARE.mjs";
+import "./chunk-VWE3SQ2Z.mjs";
+import "./chunk-XXZZMG6Q.mjs";
+import "./chunk-6N4QCCEH.mjs";
+import "./chunk-TGVKABFN.mjs";
+import "./chunk-UZ67UBXH.mjs";
 import {
   LIVE_FRAME_IDLE_PUSH_INTERVAL_MS,
   MOBILE_COLD_BOOT_SETTLE_MS,
@@ -59,6 +59,7 @@ import {
   MOBILE_MJPEG_SETTINGS,
   MOBILE_POST_ACTION_SETTLE_MS,
   MOBILE_SCREENSHOT_INTERVAL_MS,
+  blockedRunLogLine,
   buildAppiumCode,
   clampMobileSwipeDistance,
   classifyErrorMessage,
@@ -77,6 +78,7 @@ import {
   isValidMobileAppId,
   mobilePlatformFromMedium,
   parseBoolFlag,
+  registrableDomain,
   repositoryCliLabel,
   resolveCrossOriginConfigOverride,
   resolveMobileStepValuePlaceholders,
@@ -84,7 +86,7 @@ import {
   stepAppliesToPlatform,
   stepsMissingPlatformLocators,
   stepsNeedingReviewForPlatform
-} from "./chunk-3JM6XTSZ.mjs";
+} from "./chunk-EKY6CN4Y.mjs";
 import {
   __commonJS,
   __require,
@@ -215,13 +217,41 @@ var require_tls_cert_probe = __commonJS({
         });
       });
     }
+    var MAX_SPEC_HOSTS = 3;
+    var SPEC_GOTO_HTTPS = /\.goto\(\s*['"`](https:\/\/[^\s/?#'"`\\$]{1,300})(?=[/?#'"`])/gi;
+    function httpsOrigin(raw) {
+      try {
+        const url = new URL(raw);
+        return url.protocol === "https:" && url.hostname ? `https://${url.host}/` : null;
+      } catch {
+        return null;
+      }
+    }
+    function specNavigationOrigins(specCode, baseUrl) {
+      const origins = [];
+      if (!specCode)
+        return origins;
+      const base = httpsOrigin(baseUrl);
+      for (const match of specCode.matchAll(SPEC_GOTO_HTTPS)) {
+        const origin = httpsOrigin(`${match[1]}/`);
+        if (!origin || origin === base || origins.includes(origin))
+          continue;
+        origins.push(origin);
+        if (origins.length === MAX_SPEC_HOSTS)
+          break;
+      }
+      return origins;
+    }
     function tlsCertFindingLine(finding) {
       return `\u26A0\uFE0F TLS certificate: ${finding.host} presented a certificate that strict TLS rejects (${finding.code}: ${finding.detail}). The run went ahead because test browsers ignore HTTPS errors, so this is not a failure. A visitor's browser may show a certificate warning: this check does not fetch a missing intermediate certificate and does not use the operating system's trust store (a private CA the visitor's machine trusts), so a browser can accept a certificate it rejects.`;
     }
     async function targetCertificateNote2(baseUrl, opts = {}) {
       try {
-        const finding = await probeTargetCertificate(baseUrl, opts);
-        return finding ? tlsCertFindingLine(finding) : null;
+        const { specCode, ...probeOpts } = opts;
+        const targets = [baseUrl, ...specNavigationOrigins(specCode, baseUrl)];
+        const findings = await Promise.all(targets.map((target) => probeTargetCertificate(target, probeOpts)));
+        const lines = findings.flatMap((finding) => finding ? [tlsCertFindingLine(finding)] : []);
+        return lines.length > 0 ? lines.join("\n") : null;
       } catch {
         return null;
       }
@@ -252,7 +282,7 @@ var require_package = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.102",
+      version: "1.0.104",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"
@@ -261,8 +291,9 @@ var require_package = __commonJS({
         build: "tsup",
         dev: "tsx src/cli.ts",
         lint: "eslint .",
-        test: "node --import tsx --test src/supervisor-child-argv.test.ts src/audit-scrub.test.ts src/retry-on-429.test.ts src/version-check.test.ts src/poll-interval.test.ts src/node-version-notice.test.ts src/services/auth-state.test.ts src/run-no-longer-active.test.ts src/mode-abort-no-verdict.test.ts src/discovery-render-type.test.ts src/batch-heal-no-start.test.ts src/heartbeat-active-runs.test.ts src/result-post-structure-413.test.ts src/result-shed-routes-413.test.ts src/result-post-retry.test.ts src/result-media-stale-epoch.test.ts src/run-write-guard-bundle.test.ts src/spec-driver-bundle.test.ts src/mcp-servers-bundle.test.ts src/codex-files-mcp-server-bundle.test.ts src/claim-nonce-not-logged.test.ts src/sign-in-capture.test.ts src/run-status-verdicts.test.ts src/sign-in-failure.test.ts src/mobile-ui-path-succeeded.test.ts src/supervisor-policy.test.ts src/login-check.test.ts src/heal-post-lost-ack.test.ts src/ui-heal-result-video.test.ts src/heal-log-stream-chunks.test.ts src/shutdown-claim-window.test.ts src/result-post-redeploy-budget.test.ts src/shutdown-signals.test.ts",
+        test: "node --import tsx --test src/supervisor-child-argv.test.ts src/audit-scrub.test.ts src/retry-on-429.test.ts src/version-check.test.ts src/runner-upgrade-exit.test.ts src/poll-interval.test.ts src/node-version-notice.test.ts src/services/auth-state.test.ts src/run-no-longer-active.test.ts src/mode-abort-no-verdict.test.ts src/discovery-render-type.test.ts src/batch-heal-no-start.test.ts src/heartbeat-active-runs.test.ts src/result-post-structure-413.test.ts src/result-shed-routes-413.test.ts src/result-post-retry.test.ts src/result-media-stale-epoch.test.ts src/run-write-guard-bundle.test.ts src/run-write-guard-bundle-skip.test.ts src/spec-driver-bundle.test.ts src/mcp-servers-bundle.test.ts src/codex-files-mcp-server-bundle.test.ts src/claim-nonce-not-logged.test.ts src/sign-in-capture.test.ts src/run-status-verdicts.test.ts src/sign-in-failure.test.ts src/mobile-ui-path-succeeded.test.ts src/supervisor-policy.test.ts src/login-check.test.ts src/config-permissions.test.ts src/heal-post-lost-ack.test.ts src/ui-heal-result-video.test.ts src/heal-log-stream-chunks.test.ts src/shutdown-claim-window.test.ts src/result-post-redeploy-budget.test.ts src/shutdown-signals.test.ts src/sign-in-detect.test.ts src/no-credentials-help.test.ts src/resolve-credentials.test.ts src/sign-in-url.test.ts src/status-check.test.ts src/status-exit-code.test.ts src/services/doctor-web.test.ts src/browser-pool-failure.test.ts src/login-check-wrong-server.test.ts src/login-wrong-server-cli.test.ts src/start-wrong-server-cli.test.ts src/plaintext-server-warning.test.ts",
         "test:mobile": "node --import tsx --test --test-concurrency=2 src/runner.mobile-ai-env.test.ts src/runner.mobile-heal-audit-wiring.test.ts src/mobile-device-queue.test.ts src/device-lease.test.ts src/runner-watchdog.test.ts src/result-payload-budget.test.ts src/result-media-upload.test.ts src/services/appium-*.test.ts src/services/*mobile*.test.ts src/services/mobile/*.test.ts",
+        "test:browser": "RUN_BROWSER_TESTS=1 PLAYWRIGHT_HEADLESS=true node --import tsx --test src/sign-in-prove.browser.ts",
         "smoke:installed": "node scripts/installed-run-smoke.mjs",
         "check:packed-mcp": "node scripts/packed-install-check.mjs",
         prepublishOnly: "npm run build"
@@ -426,22 +457,46 @@ var cwdEnvIgnored = loadCwdEnv({
 import { Command } from "commander";
 
 // src/config.ts
-import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync, unlinkSync } from "fs";
+import { chmodSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, renameSync, statSync, unlinkSync, writeFileSync } from "fs";
 import { join as join3 } from "path";
 import { homedir } from "os";
 var CONFIG_DIR = join3(homedir(), ".validate.qa");
 var CREDENTIALS_FILE = join3(CONFIG_DIR, "credentials.json");
-function ensureConfigDir() {
-  if (!existsSync2(CONFIG_DIR)) {
-    mkdirSync(CONFIG_DIR, { recursive: true, mode: 448 });
+function setMode(path, mode) {
+  try {
+    chmodSync(path, mode);
+  } catch {
   }
 }
+function ensureConfigDir() {
+  mkdirSync(CONFIG_DIR, { recursive: true, mode: 448 });
+  setMode(CONFIG_DIR, 448);
+}
 function saveCredentials(creds) {
   ensureConfigDir();
-  writeFileSync(CREDENTIALS_FILE, JSON.stringify(creds, null, 2), { mode: 384 });
+  const tmp = `${CREDENTIALS_FILE}.${process.pid}.tmp`;
+  try {
+    writeFileSync(tmp, JSON.stringify(creds, null, 2), { mode: 384 });
+    setMode(tmp, 384);
+    renameSync(tmp, CREDENTIALS_FILE);
+  } catch (err) {
+    try {
+      unlinkSync(tmp);
+    } catch {
+    }
+    throw err;
+  }
+}
+function tightenCredentialsMode() {
+  if (process.platform === "win32") return;
+  try {
+    if ((statSync(CREDENTIALS_FILE).mode & 63) !== 0) setMode(CREDENTIALS_FILE, 384);
+  } catch {
+  }
 }
 function loadCredentials() {
   if (!existsSync2(CREDENTIALS_FILE)) return null;
+  tightenCredentialsMode();
   try {
     const data = readFileSync2(CREDENTIALS_FILE, "utf-8");
     const parsed = JSON.parse(data);
@@ -473,9 +528,9 @@ var import_playwright_native = __toESM(require_playwright_native());
 var import_runner_core = __toESM(require_dist());
 
 // src/runner.ts
-var import_runner_core7 = __toESM(require_dist());
 var import_runner_core8 = __toESM(require_dist());
 var import_runner_core9 = __toESM(require_dist());
+var import_runner_core10 = __toESM(require_dist());
 var import_framework_import_runner = __toESM(require_framework_import_runner());
 var import_grok_repo_enrichment_runner = __toESM(require_grok_repo_enrichment_runner());
 var import_repo_brief_execution = __toESM(require_repo_brief_execution());
@@ -485,7 +540,7 @@ var import_playwright_signal_handlers = __toESM(require_playwright_signal_handle
 var import_cli_limit = __toESM(require_cli_limit());
 var import_fetch_cli_subscription = __toESM(require_fetch_cli_subscription());
 var import_codex_cli = __toESM(require_codex_cli());
-var import_runner_core10 = __toESM(require_dist());
+var import_runner_core11 = __toESM(require_dist());
 
 // src/services/regression-runner.ts
 var import_regression_runner = __toESM(require_regression_runner());
@@ -564,7 +619,7 @@ function authRefusalAction(input) {
 
 // src/version-check.ts
 var RUNNER_NPM_PACKAGE = "@validate.qa/runner";
-var NPM_LATEST_URL = `https://registry.npmjs.org/${encodeURIComponent(RUNNER_NPM_PACKAGE)}/latest`;
+var DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org/";
 var DEFAULT_TIMEOUT_MS = 8e3;
 function parseSemver(raw) {
   const cleaned = raw.trim().replace(/^v/i, "");
@@ -602,11 +657,41 @@ function shouldSkipVersionCheck() {
   }
   return null;
 }
+function npmConfigFromEnv(key, env) {
+  const want = `npm_config_${key}`.toLowerCase();
+  for (const [name, value] of Object.entries(env)) {
+    if (name.toLowerCase() === want && typeof value === "string" && value.trim() !== "") return value.trim();
+  }
+  return null;
+}
+function runnerRegistryUrl(env = process.env) {
+  const scope = RUNNER_NPM_PACKAGE.split("/")[0];
+  for (const raw of [npmConfigFromEnv(`${scope}:registry`, env), npmConfigFromEnv("registry", env)]) {
+    if (raw === null) continue;
+    let url;
+    try {
+      url = new URL(raw);
+    } catch {
+      continue;
+    }
+    if (url.protocol !== "https:" && url.protocol !== "http:") continue;
+    url.username = "";
+    url.password = "";
+    url.search = "";
+    url.hash = "";
+    if (!url.pathname.endsWith("/")) url.pathname += "/";
+    return url;
+  }
+  return new URL(DEFAULT_NPM_REGISTRY);
+}
+function runnerLatestUrl(env = process.env) {
+  return new URL(`${encodeURIComponent(RUNNER_NPM_PACKAGE)}/latest`, runnerRegistryUrl(env)).href;
+}
 async function fetchLatestRunnerVersion(timeoutMs = DEFAULT_TIMEOUT_MS, fetchImpl = fetch) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
-    const res = await fetchImpl(NPM_LATEST_URL, {
+    const res = await fetchImpl(runnerLatestUrl(), {
       headers: {
         Accept: "application/json",
         // Identify ourselves; helps npm operators + caching intermediaries.
@@ -634,7 +719,7 @@ async function checkRunnerVersion(currentVersion, opts = {}) {
       outdated: false,
       currentVersion,
       latestVersion: null,
-      skippedReason: "could not reach npm registry (or response was invalid)"
+      skippedReason: `could not reach npm registry ${runnerRegistryUrl().host} (or response was invalid)`
     };
   }
   if (!parseSemver(currentVersion) || !parseSemver(latestVersion)) {
@@ -672,6 +757,15 @@ function formatUpgradeInstructions(latestVersion) {
   ];
   return lines.join("\n");
 }
+function exitForUpgrade(latestVersion, installed, opts = {}) {
+  const log2 = opts.log ?? ((msg) => console.error(msg));
+  log2(formatUpgradeInstructions(latestVersion));
+  log2(`  Installed: ${installed}`);
+  log2(`  Required:  ${latestVersion} (or newer)`);
+  log2("");
+  const exit = opts.exitFn ?? ((code) => process.exit(code));
+  return exit(EXIT_TERMINAL);
+}
 async function enforceRunnerUpToDate(currentVersion, opts = {}) {
   const log2 = opts.log ?? ((msg) => console.error(msg));
   const result = await checkRunnerVersion(currentVersion, opts);
@@ -682,12 +776,7 @@ async function enforceRunnerUpToDate(currentVersion, opts = {}) {
     return result;
   }
   if (result.outdated && result.latestVersion) {
-    log2(formatUpgradeInstructions(result.latestVersion));
-    log2(`  Installed: ${result.currentVersion}`);
-    log2(`  Required:  ${result.latestVersion} (or newer)`);
-    log2("");
-    const exit = opts.exitFn ?? ((code) => process.exit(code));
-    exit(EXIT_TERMINAL);
+    exitForUpgrade(result.latestVersion, result.currentVersion, { exitFn: opts.exitFn, log: log2 });
   }
   return result;
 }
@@ -695,6 +784,19 @@ function upgradeAction(activeRuns) {
   return activeRuns > 0 ? "drain" : "exit";
 }
 
+// src/browser-pool-failure.ts
+var MISSING_EXECUTABLE2 = /Executable doesn't exist at /i;
+function browserPoolInitFailure(message, playwrightVersion) {
+  if (MISSING_EXECUTABLE2.test(message)) {
+    const pkg2 = playwrightVersion ? `playwright@${playwrightVersion}` : "playwright";
+    return {
+      exitCode: EXIT_TERMINAL,
+      advice: `Chromium is not installed for this runner. Install it, then run start again: npx ${pkg2} install chromium`
+    };
+  }
+  return { exitCode: 1, advice: "Discovery requires a browser pool. Fix the browser installation or set BROWSER_POOL_SIZE=0 to disable." };
+}
+
 // src/shutdown-signals.ts
 var REPEAT_SIGNAL_WINDOW_MS = 1e3;
 function installShutdownSignals(target, onShutdown, opts) {
@@ -6257,7 +6359,7 @@ async function harvestPlatformLocators(options) {
   let reachedOrder = null;
   let environmentalError;
   log2(`Cross-platform locator discovery \u2014 resolving ${platform3} locators for ${harvestSteps.length} steps`);
-  const session = await createMobileDiscoverySession({
+  const session2 = await createMobileDiscoverySession({
     appId: options.target.appId,
     platform: platform3,
     platformVersion: options.target.platformVersion,
@@ -6266,13 +6368,13 @@ async function harvestPlatformLocators(options) {
     launchMode: "LAUNCH_APP"
   });
   try {
-    options.onSessionReady?.(session.sessionId, session.deviceId, platform3);
-    await freshLaunchTargetApp(session.sessionId, platform3, options.target.appId, log2);
-    await dismissSystemUiAfterColdBoot(session.sessionId, platform3, log2);
+    options.onSessionReady?.(session2.sessionId, session2.deviceId, platform3);
+    await freshLaunchTargetApp(session2.sessionId, platform3, options.target.appId, log2);
+    await dismissSystemUiAfterColdBoot(session2.sessionId, platform3, log2);
     if (options.target.launchMode === "DEEP_LINK" && options.target.deeplink) {
-      await openDeepLink(session.sessionId, platform3, options.target.deeplink, options.target.appId);
+      await openDeepLink(session2.sessionId, platform3, options.target.deeplink, options.target.appId);
     }
-    await restoreTargetAppIfExternal(session.sessionId, { appId: options.target.appId, platform: platform3 }, log2, "harvest start", false);
+    await restoreTargetAppIfExternal(session2.sessionId, { appId: options.target.appId, platform: platform3 }, log2, "harvest start", false);
     for (const step of harvestSteps) {
       if (step.action === "launchApp") continue;
       if (!stepAppliesToPlatform(step, platform3)) continue;
@@ -6282,7 +6384,7 @@ async function harvestPlatformLocators(options) {
       if (!webViewCss && identityStrategies.length > 0 && step.target) {
         try {
           elementId = await findElement(
-            session.sessionId,
+            session2.sessionId,
             step.target,
             Math.max(DEFAULT_STEP_TIMEOUT_MS, WEBVIEW_HYDRATION_TIMEOUT_MS),
             {
@@ -6296,7 +6398,7 @@ async function harvestPlatformLocators(options) {
         }
       }
       if (elementId) {
-        const bundle = await readNativeElementBundle(session.sessionId, elementId, platform3);
+        const bundle = await readNativeElementBundle(session2.sessionId, elementId, platform3);
         if (bundle) {
           bundles[step.order] = bundle;
           log2(`  \u2713 Step ${step.order} (${step.action}) resolved on ${platform3}`);
@@ -6308,20 +6410,20 @@ async function harvestPlatformLocators(options) {
         divergentOrders.push(step.order);
         log2(`  \u26A0 Step ${step.order} (${step.action}) could not be resolved on ${platform3} \u2014 needs manual authoring`);
       }
-      const advanced = await driveHarvestStep(session.sessionId, step, elementId, platform3);
+      const advanced = await driveHarvestStep(session2.sessionId, step, elementId, platform3);
       if (!advanced && isStateAdvancingAction(step.action)) {
         log2(`  \u2717 Could not advance step ${step.order} (${step.action}) on ${platform3}; stopping harvest early`);
         break;
       }
       reachedOrder = step.order;
-      await restoreTargetAppIfExternal(session.sessionId, { appId: options.target.appId, platform: platform3 }, log2, `harvest step ${step.order}`, false);
+      await restoreTargetAppIfExternal(session2.sessionId, { appId: options.target.appId, platform: platform3 }, log2, `harvest step ${step.order}`, false);
     }
   } catch (err) {
     environmentalError = err instanceof Error ? err.message : String(err);
     log2(`  \u2717 Harvest aborted: ${environmentalError}`);
   } finally {
-    options.onSessionEnding?.(session.deviceId);
-    await session.stop().catch(() => {
+    options.onSessionEnding?.(session2.deviceId);
+    await session2.stop().catch(() => {
     });
   }
   return {
@@ -6329,8 +6431,8 @@ async function harvestPlatformLocators(options) {
     bundles,
     divergentOrders,
     reachedOrder,
-    deviceId: session.deviceId,
-    deviceName: session.deviceName,
+    deviceId: session2.deviceId,
+    deviceName: session2.deviceName,
     logs: logLines.join("\n"),
     ...environmentalError ? { environmentalError } : {}
   };
@@ -8593,6 +8695,7 @@ function readActiveBundleId2(result) {
 }
 
 // src/services/doctor.ts
+var import_runner_core7 = __toESM(require_dist());
 import { execSync } from "child_process";
 import { existsSync as existsSync3 } from "fs";
 import { platform as platform2 } from "os";
@@ -8623,7 +8726,10 @@ function computeDoctorReadiness(web, ios, android) {
   const webReady = web.every((check2) => check2.ok);
   const iosReady = ios.length > 0 && ios.every((check2) => check2.ok);
   const androidReady = android.length > 0 && android.every((check2) => check2.ok);
-  return { allPassed: webReady && (iosReady || androidReady), iosReady, androidReady };
+  return { allPassed: webReady && (iosReady || androidReady), webReady, iosReady, androidReady };
+}
+function doctorExitCode(report, opts = {}) {
+  return (opts.mobile ? report.allPassed : report.webReady) ? 0 : 1;
 }
 function run(cmd) {
   try {
@@ -8640,17 +8746,33 @@ function check(name, fn) {
     return { name, ok: false, detail: err instanceof Error ? err.message : "Unknown error" };
   }
 }
-function checkWeb() {
+function bundledPlaywrightVersion() {
+  try {
+    const pkg2 = __require("playwright/package.json");
+    return typeof pkg2.version === "string" && pkg2.version ? pkg2.version : null;
+  } catch {
+    return null;
+  }
+}
+var DEFAULT_WEB_DEPS = {
+  nodeVersion: process.version,
+  playwrightVersion: bundledPlaywrightVersion,
+  chromiumPath: import_runner_core7.getFullChromiumPath
+};
+function checkWeb(deps = DEFAULT_WEB_DEPS) {
   const results = [];
   results.push(check("Node.js", () => {
-    const version = process.version;
+    const version = deps.nodeVersion;
     const major = parseInt(version.slice(1).split(".")[0], 10);
     return { ok: major >= REQUIRED_NODE_MAJOR, detail: `${version}${major < REQUIRED_NODE_MAJOR ? ` (>= ${REQUIRED_NODE_MAJOR} required)` : ""}` };
   }));
-  results.push(check("Playwright", () => {
-    const version = run("npx playwright --version");
-    if (!version) return { ok: false, detail: "Not installed. Run: npm i -D playwright" };
-    return { ok: true, detail: version };
+  const playwrightVersion = deps.playwrightVersion();
+  results.push(check("Playwright", () => playwrightVersion ? { ok: true, detail: `${playwrightVersion} (bundled with the runner)` } : { ok: false, detail: "The runner's Playwright could not be read. Reinstall the runner: npx @validate.qa/runner@latest" }));
+  results.push(check("Chromium", () => {
+    const path = deps.chromiumPath();
+    if (path) return { ok: true, detail: path };
+    const pkg2 = playwrightVersion ? `playwright@${playwrightVersion}` : "playwright";
+    return { ok: false, detail: `Not installed for this runner. Run: npx ${pkg2} install chromium` };
   }));
   return results;
 }
@@ -8796,10 +8918,10 @@ function runDoctor() {
   const ios = checkIOS();
   const android = checkAndroid();
   const tunnel = checkTunnel();
-  const { allPassed } = computeDoctorReadiness(web, ios, android);
-  return { web, ios, android, tunnel, allPassed };
+  const { allPassed, webReady } = computeDoctorReadiness(web, ios, android);
+  return { web, ios, android, tunnel, allPassed, webReady };
 }
-function printDoctorReport(report) {
+function printDoctorReport(report, opts = {}) {
   console.log("");
   console.log(`${C.bold}${C.cyan}\u{1F3E5} validate.qa Doctor${C.reset}`);
   console.log(`${C.gray}${"\u2500".repeat(40)}${C.reset}`);
@@ -8818,12 +8940,15 @@ function printDoctorReport(report) {
   console.log("");
   if (report.allPassed) {
     console.log(`  ${C.green}\u2705 Web plus at least one mobile platform is ready${C.reset}`);
+  } else if (report.webReady && !opts.mobile) {
+    console.log(`  ${C.green}\u2705 Web testing is ready${C.reset}`);
+    console.log(`  ${C.gray}   No complete iOS or Android toolchain: needed only for mobile tests (check with: doctor --mobile)${C.reset}`);
   } else {
     const readiness = computeDoctorReadiness(report.web, report.ios, report.android);
     const webFailures = report.web.filter((check2) => !check2.ok).length;
     let reason;
     if (webFailures > 0) {
-      reason = `${webFailures} web prerequisite${webFailures === 1 ? "" : "s"} need attention`;
+      reason = `${webFailures} web prerequisite${webFailures === 1 ? " needs" : "s need"} attention`;
     } else if (!readiness.iosReady && !readiness.androidReady) {
       reason = "No complete iOS or Android toolchain is ready";
     } else {
@@ -9167,6 +9292,13 @@ function attachMobileDiscoveryNetworkContext(calls, result, appId) {
   }));
 }
 var runnerPackage = require_package();
+function bundledPlaywrightVersion2() {
+  try {
+    return __require("playwright-core/package.json").version;
+  } catch {
+    return void 0;
+  }
+}
 var MIRROR_RELAY_FRESH_MS = 3e3;
 var liveFrameWatchedByProject = /* @__PURE__ */ new Map();
 var liveFrameIdleProbeAt = /* @__PURE__ */ new Map();
@@ -9911,7 +10043,7 @@ function pruneCollectedPageForPost(page) {
   return out;
 }
 function discoveryRenderTypeFields(input) {
-  if (input.err instanceof import_runner_core7.UnsupportedRendererError) {
+  if (input.err instanceof import_runner_core8.UnsupportedRendererError) {
     return { detectedAppRenderType: input.err.renderType, appRenderDetectionSignals: input.err.signals };
   }
   return input.appRenderType ? { detectedAppRenderType: input.appRenderType } : {};
@@ -10092,8 +10224,8 @@ function toLiveBrowserMode(mode) {
 async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = () => {
 }, onMobileHealPending = () => {
 }, assignedDeviceId, mobileLeaseError, signal) {
-  if (signal && (0, import_runner_core9.currentRunAbortSignal)() !== signal) {
-    return (0, import_runner_core9.runWithAbortScope)({ signal, runId: run2.runId }, () => executeRun(run2, opts, headers, requestLiveBrowserHeartbeat, onMobileHealPending, assignedDeviceId, mobileLeaseError, signal));
+  if (signal && (0, import_runner_core10.currentRunAbortSignal)() !== signal) {
+    return (0, import_runner_core10.runWithAbortScope)({ signal, runId: run2.runId }, () => executeRun(run2, opts, headers, requestLiveBrowserHeartbeat, onMobileHealPending, assignedDeviceId, mobileLeaseError, signal));
   }
   const runMode = run2.mode ?? "run";
   const RUNNER_MODE = opts.runnerMode ?? "playwright-native";
@@ -10154,7 +10286,7 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
     ...nativeOptions,
     liveBrowserHandle,
     onLiveBrowserSnapshot: requestLiveBrowserHeartbeat,
-    signal: (0, import_runner_core9.linkRunAbort)(nativeOptions.signal) ?? signal
+    signal: (0, import_runner_core10.linkRunAbort)(nativeOptions.signal) ?? signal
   });
   const callbackContext = {
     runId: run2.runId,
@@ -10167,7 +10299,7 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
   };
   const startTime = Date.now();
   try {
-    (0, import_runner_core9.throwIfRunAborted)();
+    (0, import_runner_core10.throwIfRunAborted)();
     if (mobileLeaseError) {
       await postRunResult({
         status: "ERROR",
@@ -10203,7 +10335,7 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
           const requireCreds = authPlan.needsLoginCreds && !legacyHeaderBypass && !isHallucinationShape && !selfProvisioningRegisterTest;
           if (requireCreds && !run2.testVariables?.["TEST_USER_EMAIL"]?.trim()) {
             preflightError = "Pre-flight failed: Missing TEST_USER_EMAIL. Tests that log in (tagged @auth, @needs-auth, @auth-cookie-state, @auth-login-cookie, or @auth-login-bearer) or read TEST_USER_* in their code require login credentials.";
-          } else if (requireCreds && !run2.testVariables?.["TEST_USER_PASSWORD"]?.trim()) {
+          } else if (requireCreds && !(codeProvided && (0, import_inbox_stamp.codeSignsInWithoutPassword)(code)) && !run2.testVariables?.["TEST_USER_PASSWORD"]?.trim()) {
             preflightError = "Pre-flight failed: Missing TEST_USER_PASSWORD. Tests that log in (tagged @auth, @needs-auth, @auth-cookie-state, @auth-login-cookie, or @auth-login-bearer) or read TEST_USER_* in their code require login credentials.";
           }
         }
@@ -10225,7 +10357,7 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
       } else if (preflight.note) {
         log.info(preflight.note);
       }
-      tlsCertNote = (0, import_tls_cert_probe.targetCertificateNote)(run2.baseUrl);
+      tlsCertNote = (0, import_tls_cert_probe.targetCertificateNote)(run2.baseUrl, { specCode: run2.playwrightCode });
       void tlsCertNote.then((note) => {
         if (note) log.warn(note);
       });
@@ -10287,7 +10419,7 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
           releaseAuthLock2
         );
         const duration2 = Date.now() - startTime;
-        (0, import_runner_core9.throwIfRunAborted)();
+        (0, import_runner_core10.throwIfRunAborted)();
         await postRunResult({
           status: result2.passed ? "PASSED" : "FAILED",
           apiCalls: result2.apiCalls,
@@ -10332,10 +10464,10 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
           completionTokens: info.completionTokens,
           totalTokens: info.totalTokens,
           requestBody: { iteration: info.iteration, toolCalls: info.toolCalls, session: info.requestMessages?.[0] ?? null },
-          metadata: { phase: "heal", groupId: info.groupId, iteration: info.iteration, healMode: "batch", ...(0, import_runner_core9.cliAuditMetadata)(info) }
+          metadata: { phase: "heal", groupId: info.groupId, iteration: info.iteration, healMode: "batch", ...(0, import_runner_core10.cliAuditMetadata)(info) }
         });
       };
-      const batchResult = await (0, import_runner_core9.executeGrokPerBatchHeal)(tests, run2.baseUrl, {
+      const batchResult = await (0, import_runner_core10.executeGrokPerBatchHeal)(tests, run2.baseUrl, {
         onAICall: batchHealAudit,
         testVariables: run2.testVariables,
         runNativeTest: runNativeWithLiveBrowser,
@@ -10344,7 +10476,7 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
         saveRefreshedLogin: grokLogin?.saveRefreshed,
         engineSpec: run2.healerModel,
         // Returns HEAL_TIMEOUT: for the tests not reached instead of dying at the runner's batch-heal deadline.
-        deadlineAt: (0, import_runner_core7.batchHealDeadlineAt)(startTime),
+        deadlineAt: (0, import_runner_core8.batchHealDeadlineAt)(startTime),
         onLog: healLogStream.onLog,
         ...batchHealPartialHooks(opts.serverUrl, headers, run2.runId, run2.projectId || void 0, void 0, run2.claimEpoch)
       });
@@ -10354,7 +10486,7 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
       } catch (drainErr) {
         console.warn(`[batch-heal] audit flush failed: ${drainErr instanceof Error ? drainErr.message : String(drainErr)}`);
       }
-      (0, import_runner_core9.throwIfRunAborted)();
+      (0, import_runner_core10.throwIfRunAborted)();
       try {
         await postBatchHealResult(opts.serverUrl, headers, run2.runId, {
           perTest: batchResult.perTest,
@@ -10362,7 +10494,7 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
           logs: batchResult.logs,
           durationMs: batchResult.totalDurationMs
         }, RESULT_POST_BACKOFF_BASE_MS, run2.claimEpoch);
-        log.ok((0, import_runner_core9.batchHealCompleteLine)(batchResult.perTest, tests.length, batchResult.totalDurationMs));
+        log.ok((0, import_runner_core10.batchHealCompleteLine)(batchResult.perTest, tests.length, batchResult.totalDurationMs));
       } catch (err) {
         log.fail(`Failed to post batch heal result: ${err instanceof Error ? err.message : String(err)}`);
       }
@@ -10395,7 +10527,7 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
         }, run2.runId) : void 0;
         const apiHealStorageStatePath = apiHealAuthPaths ? (0, import_local_auth_state.getValidLocalAuthState)(apiHealAuthPaths.cachePath) : void 0;
         if (apiHealStorageStatePath) log.info("API heal verification is using saved auth state");
-        const apiHealAuthSession = (0, import_runner_core8.sharedAuthSessionStamp)(apiHealStorageStatePath, false, sharedAuthInjectEnabled());
+        const apiHealAuthSession = (0, import_runner_core9.sharedAuthSessionStamp)(apiHealStorageStatePath, false, sharedAuthInjectEnabled());
         const apiHealAuthPlan = authPlanFor(run2.tags, run2.playwrightCode);
         const stickyAppBugs = /* @__PURE__ */ new Map();
         const lastChangeByTitle = /* @__PURE__ */ new Map();
@@ -10512,10 +10644,10 @@ ${finalVerifyResult.logs ?? ""}`;
           }
           if (result3.verdict === "app_bug") {
             const duration4 = Date.now() - startTime;
-            const legacyCold = (0, import_runner_core8.apiHealColdSessionRelabel)("legacy", {
+            const legacyCold = (0, import_runner_core9.apiHealColdSessionRelabel)("legacy", {
               tags: run2.tags ?? [],
               authStateExpected: apiHealAuthPlan.needsCookieState,
-              authStateInjected: (0, import_runner_core8.storageStateDelivered)(apiHealStorageStatePath, finalVerifyResult),
+              authStateInjected: (0, import_runner_core9.storageStateDelivered)(apiHealStorageStatePath, finalVerifyResult),
               needsStandingHeaders: apiHealAuthPlan.needsStandingHeaders,
               standingHeadersInjected: !!finalVerifyResult?.authDelivery?.standingHeadersInjected,
               error: result3.bugDescription ?? null,
@@ -10588,10 +10720,14 @@ ${finalVerifyResult.logs ?? ""}`;
         const allAppBug = stepCount > 0 && enrichedSteps.every((s) => s.verdict === "app_bug");
         const hasFixFailed = enrichedSteps.some((s) => s.verdict === "fix_failed");
         const hasPass = enrichedSteps.some((s) => s.verdict === "pass");
-        const passed = stepCount > 0 ? finalVerifyResult?.passed === true && hasPass && !hasFixFailed && !allAppBug : finalVerifyResult?.passed === true;
+        const verifyPassed = stepCount > 0 ? finalVerifyResult?.passed === true && hasPass && !hasFixFailed && !allAppBug : finalVerifyResult?.passed === true;
+        const partialSkipError = verifyPassed ? (0, import_runner_core8.apiHealPartialSkipError)(enrichedSteps) : void 0;
+        const passed = verifyPassed && partialSkipError === void 0;
         let composedError;
         if (!passed) {
-          if (finalUnfixableReason) {
+          if (partialSkipError !== void 0) {
+            composedError = partialSkipError;
+          } else if (finalUnfixableReason) {
             composedError = `Unfixable after ${attemptsUsed} attempt(s): ${finalUnfixableReason}`;
           } else if (allAppBug || enrichedSteps.some((s) => s.verdict === "app_bug") && !hasFixFailed) {
             const bugs = enrichedSteps.filter((s) => s.verdict === "app_bug");
@@ -10603,11 +10739,21 @@ ${finalVerifyResult.logs ?? ""}`;
         let apiHealStatus = passed ? "PASSED" : "FAILED";
         let apiHealError = composedError;
         if (!passed) {
-          if (finalUnfixableReason?.startsWith(import_runner_core7.HEAL_AI_NO_ANSWER_ERROR_PREFIX) || (0, import_runner_core7.isHealAiQuotaError)(finalUnfixableReason)) {
+          if (finalUnfixableReason?.startsWith(import_runner_core8.HEAL_AI_NO_ANSWER_ERROR_PREFIX) || (0, import_runner_core8.isHealAiQuotaError)(finalUnfixableReason)) {
             apiHealStatus = "ERROR";
             apiHealError = finalUnfixableReason;
           } else if (isConfigLikeReason(classifyErrorMessage(composedError ?? null))) {
-            apiHealStatus = "ERROR";
+            const configIssueRefusal2 = (0, import_runner_core8.refuseConfigIssueOnAppServerError)({
+              error: composedError,
+              baseUrl: run2.apiBaseUrl ?? run2.baseUrl,
+              calls: (0, import_runner_core8.healResultCalls)({ stepResults: rawSteps })
+            });
+            if (configIssueRefusal2) {
+              apiHealError = configIssueRefusal2.error;
+              log.warn(`\u26A0 API-heal config-issue verdict refused: ${configIssueRefusal2.evidence}`);
+            } else {
+              apiHealStatus = "ERROR";
+            }
           } else {
             const rlDetection = (0, import_rate_limit_detector.detectRateLimitBlock)({
               testName: run2.testName ?? run2.testCaseId ?? void 0,
@@ -10641,10 +10787,10 @@ ${finalVerifyResult.logs ?? ""}`;
           }
         }
         if (apiHealStatus === "FAILED") {
-          const cold = (0, import_runner_core8.apiHealColdSessionRelabel)("verified", {
+          const cold = (0, import_runner_core9.apiHealColdSessionRelabel)("verified", {
             tags: run2.tags ?? [],
             authStateExpected: apiHealAuthPlan.needsCookieState,
-            authStateInjected: (0, import_runner_core8.storageStateDelivered)(apiHealStorageStatePath, finalVerifyResult),
+            authStateInjected: (0, import_runner_core9.storageStateDelivered)(apiHealStorageStatePath, finalVerifyResult),
             needsStandingHeaders: apiHealAuthPlan.needsStandingHeaders,
             standingHeadersInjected: !!finalVerifyResult?.authDelivery?.standingHeadersInjected,
             error: apiHealError ?? finalVerifyResult?.error,
@@ -10707,11 +10853,11 @@ ${finalVerifyResult.logs ?? ""}`;
           completionTokens: info.completionTokens,
           totalTokens: info.totalTokens,
           ...hasTurnDetails ? buildAuditTurnPayload(info, run2.testVariables) : { requestBody: { iteration: info.iteration, toolCalls: info.toolCalls } },
-          metadata: { groupId: info.groupId, iteration: info.iteration, testName: run2.testCaseId, ...(0, import_runner_core9.cliAuditMetadata)(info) }
+          metadata: { groupId: info.groupId, iteration: info.iteration, testName: run2.testCaseId, ...(0, import_runner_core10.cliAuditMetadata)(info) }
         });
       };
       const envOverride = (process.env.USE_GROK_PER_TEST_HEAL ?? "").trim().toLowerCase();
-      const useGrokHeal = envOverride === "true" ? true : envOverride === "false" ? false : (0, import_runner_core9.getAgenticEngine)(run2.healerModel) === "grok-build";
+      const useGrokHeal = envOverride === "true" ? true : envOverride === "false" ? false : (0, import_runner_core10.getAgenticEngine)(run2.healerModel) === "grok-build";
       const healOpts = {
         testName: run2.testName ?? run2.testCaseId ?? void 0,
         tags: run2.tags ?? [],
@@ -10734,19 +10880,19 @@ ${finalVerifyResult.logs ?? ""}`;
         // Whole-heal deadline: the runner's heal deadline minus a margin for the result
         // post (heal-deadline.ts). The healer stops both phases inside it and returns a
         // HEAL_TIMEOUT: result instead of dying as a reclaimed task.
-        deadlineAt: (0, import_runner_core7.healDeadlineAt)(startTime)
+        deadlineAt: (0, import_runner_core8.healDeadlineAt)(startTime)
       };
       if (useGrokHeal) {
         const source = envOverride === "true" ? "env USE_GROK_PER_TEST_HEAL=true" : `healerModel=${run2.healerModel ?? "null"}`;
         log.info(`Heal engine: GROK (${source})`);
       }
       const grokHealLogStream = useGrokHeal ? createHealLogStreamer(opts.serverUrl, headers, run2.runId) : null;
-      const httpFallback = run2.healerFallbackModel && (0, import_runner_core9.getAgenticEngine)(run2.healerFallbackModel) === "native" ? run2.healerFallbackModel : null;
+      const httpFallback = run2.healerFallbackModel && (0, import_runner_core10.getAgenticEngine)(run2.healerFallbackModel) === "native" ? run2.healerFallbackModel : null;
       let result2;
       if (useGrokHeal) {
         try {
           const grokLogin = await (0, import_fetch_cli_subscription.fetchCliSubscription)({ serverUrl: opts.serverUrl, runId: run2.runId, headers, cli: "grok-build", onLog: grokHealLogStream?.onLog });
-          result2 = await (0, import_runner_core9.executeGrokPerTestHeal)(run2.playwrightCode, run2.steps, run2.baseUrl, {
+          result2 = await (0, import_runner_core10.executeGrokPerTestHeal)(run2.playwrightCode, run2.steps, run2.baseUrl, {
             ...healOpts,
             subscriptionSecret: grokLogin?.value,
             saveRefreshedLogin: grokLogin?.saveRefreshed,
@@ -10790,17 +10936,20 @@ ${finalVerifyResult.logs ?? ""}`;
 [audit] ${drainErr instanceof Error ? drainErr.message : String(drainErr)}`;
         console.warn(`[runner]${auditDrainError}`);
       }
-      const isConfigIssue = !result2.passed && isConfigLikeReason(classifyErrorMessage(result2.error ?? null));
-      let healStatus = (0, import_runner_core7.healRunStatus)({ passed: result2.passed, error: result2.error, isConfigIssue });
-      let healError = result2.error;
-      const rateLimitRelabel = (0, import_runner_core8.uiHealRateLimitRelabel)({
+      const relabelSteps = result2.relabelEvidenceSteps ?? result2.stepResults;
+      const configIssueRefusal = result2.passed ? null : (0, import_runner_core8.refuseConfigIssueOnAppServerError)({ error: result2.error, baseUrl: run2.baseUrl, calls: (0, import_runner_core8.healResultCalls)(result2) });
+      if (configIssueRefusal) log.warn(`\u26A0 Heal config-issue verdict refused: ${configIssueRefusal.evidence}`);
+      const isConfigIssue = !result2.passed && !configIssueRefusal && isConfigLikeReason(classifyErrorMessage(result2.error ?? null));
+      let healStatus = (0, import_runner_core8.healRunStatus)({ passed: result2.passed, error: configIssueRefusal?.error ?? result2.error, isConfigIssue });
+      let healError = configIssueRefusal?.error ?? result2.error;
+      const rateLimitRelabel = (0, import_runner_core9.uiHealRateLimitRelabel)({
         passed: result2.passed,
         isConfigIssue,
         testName: run2.testName ?? run2.testCaseId ?? void 0,
         tags: run2.tags ?? [],
         error: result2.error,
         logs: result2.logs,
-        stepResults: result2.stepResults,
+        stepResults: relabelSteps,
         apiCalls: result2.apiCalls
       });
       if (rateLimitRelabel) {
@@ -10808,13 +10957,13 @@ ${finalVerifyResult.logs ?? ""}`;
         healError = rateLimitRelabel.error;
         log.warn(rateLimitRelabel.logLine);
       }
-      const loginRelabel = (0, import_runner_core8.uiHealLoginRelabel)({
+      const loginRelabel = (0, import_runner_core9.uiHealLoginRelabel)({
         status: healStatus,
         testName: run2.testName ?? run2.testCaseId ?? void 0,
         tags: run2.tags ?? [],
         error: healError,
         logs: result2.logs,
-        stepResults: result2.stepResults
+        stepResults: relabelSteps
       });
       if (loginRelabel) {
         healStatus = loginRelabel.status;
@@ -10883,7 +11032,7 @@ ${finalVerifyResult.logs ?? ""}`;
         signal
       });
       const overall = (0, import_regression_runner.regressionSuiteOverall)(result2);
-      (0, import_runner_core9.throwIfRunAborted)();
+      (0, import_runner_core10.throwIfRunAborted)();
       await postRegressionResult(opts.serverUrl, headers, run2.runId, {
         overall,
         logs: result2.logs,
@@ -10913,9 +11062,9 @@ ${finalVerifyResult.logs ?? ""}`;
         `${opts.serverUrl}/api/runner/runs/${run2.runId}/ai-audit-batch`,
         headers
       );
-      const suiteQuotaFallback = (0, import_runner_core7.createQuotaFallbackState)(run2.quotaFallbackModel);
+      const suiteQuotaFallback = (0, import_runner_core8.createQuotaFallbackState)(run2.quotaFallbackModel);
       for (const failedTest of failedTests) {
-        (0, import_runner_core9.throwIfRunAborted)();
+        (0, import_runner_core10.throwIfRunAborted)();
         const testStart = Date.now();
         log.info(`  Healing: ${failedTest.name ?? failedTest.testCaseId}`);
         const isApiTest = Array.isArray(failedTest.tags) && failedTest.tags.includes("@api");
@@ -10928,7 +11077,7 @@ ${finalVerifyResult.logs ?? ""}`;
               signal: AbortSignal.timeout(6e4)
             });
             const healBody = healRes.ok ? await healRes.json() : null;
-            if (healBody?.verdict === "unfixable" && (0, import_runner_core7.isHealAiQuotaError)(healBody.reason)) {
+            if (healBody?.verdict === "unfixable" && (0, import_runner_core8.isHealAiQuotaError)(healBody.reason)) {
               results.push({
                 testCaseId: failedTest.testCaseId,
                 status: "unfixable",
@@ -10948,15 +11097,16 @@ ${finalVerifyResult.logs ?? ""}`;
                 authStandingMode: failedTestPlan.standingHeadersMode,
                 validateContext: callbackContext
               });
+              const verdict = (0, import_runner_core8.apiHealVerifyVerdict)(verifyResult);
               results.push({
                 testCaseId: failedTest.testCaseId,
-                status: verifyResult.passed ? "fixed" : "unfixable",
-                error: verifyResult.error,
+                status: verdict.fixed ? "fixed" : "unfixable",
+                error: verdict.error,
                 diagnosis: "API test healed via server-side AI",
-                healedCode: verifyResult.passed ? healedCode : void 0,
+                healedCode: verdict.fixed ? healedCode : void 0,
                 duration: Date.now() - testStart
               });
-              if (verifyResult.passed) {
+              if (verdict.fixed) {
                 log.ok(`    Fixed: ${failedTest.name}`);
               } else {
                 log.fail(`    Could not fix: ${failedTest.name}`);
@@ -10993,12 +11143,12 @@ ${finalVerifyResult.logs ?? ""}`;
               completionTokens: info.completionTokens,
               totalTokens: info.totalTokens,
               ...hasTurnDetails ? buildAuditTurnPayload(info, run2.testVariables) : { requestBody: { iteration: info.iteration, toolCalls: info.toolCalls } },
-              metadata: { groupId: info.groupId, testCaseId: failedTest.testCaseId, ...(0, import_runner_core9.cliAuditMetadata)(info) }
+              metadata: { groupId: info.groupId, testCaseId: failedTest.testCaseId, ...(0, import_runner_core10.cliAuditMetadata)(info) }
             });
           };
           try {
             const envOverrideSuite = (process.env.USE_GROK_PER_TEST_HEAL ?? "").trim().toLowerCase();
-            const useGrokHealSuite = envOverrideSuite === "true" ? true : envOverrideSuite === "false" ? false : (0, import_runner_core9.getAgenticEngine)(run2.healerModel) === "grok-build";
+            const useGrokHealSuite = envOverrideSuite === "true" ? true : envOverrideSuite === "false" ? false : (0, import_runner_core10.getAgenticEngine)(run2.healerModel) === "grok-build";
             const suiteHealOpts = {
               testName: failedTest.name ?? failedTest.testCaseId,
               tags: failedTest.tags ?? [],
@@ -11020,12 +11170,12 @@ ${finalVerifyResult.logs ?? ""}`;
               liveBrowserHandle,
               runNativeTest: runNativeWithLiveBrowser
             };
-            const suiteHttpFallback = run2.healerFallbackModel && (0, import_runner_core9.getAgenticEngine)(run2.healerFallbackModel) === "native" ? run2.healerFallbackModel : null;
+            const suiteHttpFallback = run2.healerFallbackModel && (0, import_runner_core10.getAgenticEngine)(run2.healerFallbackModel) === "native" ? run2.healerFallbackModel : null;
             let healResult;
             if (useGrokHealSuite) {
               try {
                 const grokLogin = await (0, import_fetch_cli_subscription.fetchCliSubscription)({ serverUrl: opts.serverUrl, runId: run2.runId, headers, cli: "grok-build", onLog: log.warn });
-                healResult = await (0, import_runner_core9.executeGrokPerTestHeal)(
+                healResult = await (0, import_runner_core10.executeGrokPerTestHeal)(
                   failedTest.playwrightCode,
                   failedTest.steps ?? [],
                   run2.baseUrl,
@@ -11065,20 +11215,21 @@ ${finalVerifyResult.logs ?? ""}`;
               });
               log.ok(`    Fixed: ${failedTest.name}`);
             } else {
-              const quotaStopped = (0, import_runner_core7.isHealAiQuotaError)(healResult.error);
-              const timeoutStopped = (0, import_runner_core7.isHealTimeoutError)(healResult.error);
-              const isAppBug = !quotaStopped && !timeoutStopped && (0, import_runner_core7.isAppBugHealError)(healResult.error);
-              const isConfigIssue = isConfigLikeReason(classifyErrorMessage(healResult.error ?? null));
+              const quotaStopped = (0, import_runner_core8.isHealAiQuotaError)(healResult.error);
+              const infraStopped = (0, import_runner_core8.isHealInfraStopError)(healResult.error);
+              const isAppBug = !infraStopped && (0, import_runner_core8.isAppBugHealError)(healResult.error);
+              const configIssueRefusal = infraStopped ? null : (0, import_runner_core8.refuseConfigIssueOnAppServerError)({ error: healResult.error, baseUrl: run2.baseUrl, calls: (0, import_runner_core8.healResultCalls)(healResult) });
+              const isConfigIssue = !configIssueRefusal && isConfigLikeReason(classifyErrorMessage(healResult.error ?? null));
               const status = isAppBug ? "app-bug" : isConfigIssue ? "config-issue" : "unfixable";
-              const diagnosisMsg = isAppBug ? "Application error detected" : isConfigIssue ? "Configuration issue detected" : (quotaStopped || timeoutStopped) && healResult.error ? healResult.error : "Could not heal after AI attempts";
+              const diagnosisMsg = isAppBug ? "Application error detected" : isConfigIssue ? "Configuration issue detected" : configIssueRefusal ? configIssueRefusal.error : infraStopped && healResult.error ? healResult.error : "Could not heal after AI attempts";
               results.push({
                 testCaseId: failedTest.testCaseId,
                 status,
-                error: healResult.error,
+                error: configIssueRefusal?.error ?? healResult.error,
                 diagnosis: diagnosisMsg,
                 duration: Date.now() - testStart
               });
-              log[isAppBug || isConfigIssue || quotaStopped || timeoutStopped ? "warn" : "fail"](`    ${isAppBug ? "App bug" : isConfigIssue ? "Config issue" : quotaStopped ? "Not healed (AI provider quota)" : timeoutStopped ? "Not healed (heal time budget)" : "Could not fix"}: ${failedTest.name}`);
+              log[isAppBug || isConfigIssue || infraStopped ? "warn" : "fail"](`    ${isAppBug ? "App bug" : isConfigIssue ? "Config issue" : quotaStopped ? "Not healed (AI provider quota)" : infraStopped ? `Not healed (${healResult.error.slice(0, healResult.error.indexOf(":"))})` : configIssueRefusal ? `Could not fix (config-issue verdict refused: ${configIssueRefusal.evidence})` : "Could not fix"}: ${failedTest.name}`);
             }
           } catch (err) {
             results.push({
@@ -11091,7 +11242,7 @@ ${finalVerifyResult.logs ?? ""}`;
             log.fail(`    Heal crashed: ${failedTest.name}`);
           }
         }
-        (0, import_runner_core9.throwIfRunAborted)();
+        (0, import_runner_core10.throwIfRunAborted)();
         const lastResult = results[results.length - 1];
         if (lastResult) {
           fetch(`${opts.serverUrl}/api/runner/runs/${run2.runId}/live-suite-progress`, {
@@ -11120,7 +11271,7 @@ ${finalVerifyResult.logs ?? ""}`;
         auditDrainWarning = drainErr instanceof Error ? drainErr.message : String(drainErr);
         console.warn(`[runner] ${auditDrainWarning}`);
       }
-      (0, import_runner_core9.throwIfRunAborted)();
+      (0, import_runner_core10.throwIfRunAborted)();
       const liveRes = await postLiveSuiteResult(opts.serverUrl, headers, run2.runId, {
         overall,
         duration: totalDuration,
@@ -11295,7 +11446,7 @@ ${finalVerifyResult.logs ?? ""}`;
           }
           return await res.json();
         };
-        ctx.smsReserve = (0, import_runner_core9.createHttpSmsReserveTransport)({ serverUrl: opts.serverUrl, headers, runId: run2.runId });
+        ctx.smsReserve = (0, import_runner_core10.createHttpSmsReserveTransport)({ serverUrl: opts.serverUrl, headers, runId: run2.runId });
       }
       const canonicalBase = await (0, import_base_url_check.canonicalDiscoveryBaseUrl)(
         { runMode, baseUrl: ctx.baseUrl, native: ctx.medium === "IOS_NATIVE" || ctx.medium === "ANDROID_NATIVE" || run2.framework === "APPIUM" }
@@ -11357,7 +11508,7 @@ ${finalVerifyResult.logs ?? ""}`;
             ...info.exitReason ? { exitReason: info.exitReason } : {},
             // Engine cost, engine id, step, cache + reasoning tokens: same helper as the server's
             // Fargate path (execute-run.ts), so the two rows agree.
-            ...(0, import_runner_core9.cliAuditMetadata)(info),
+            ...(0, import_runner_core10.cliAuditMetadata)(info),
             ...ledgerAudit ? {
               ledger: ledgerAudit.entries,
               ledgerEntryCount: ledgerAudit.originalLength,
@@ -11392,12 +11543,12 @@ ${finalVerifyResult.logs ?? ""}`;
         }).catch(() => {
         });
       };
-      const onScreenshot = async (route2, base64, visual) => {
+      const onScreenshot = async (route2, base64, visual, capture) => {
         try {
           const resp = await fetch(`${opts.serverUrl}/api/runner/runs/${run2.runId}/page-screenshot`, {
             method: "POST",
             headers: { ...headers, "Content-Type": "application/json" },
-            body: JSON.stringify({ route: route2, base64, ...visual ? { visualName: visual.name } : {} }),
+            body: JSON.stringify({ route: route2, base64, ...visual ? { visualName: visual.name } : {}, ...capture?.stillLoading ? { stillLoading: true } : {} }),
             signal: AbortSignal.timeout(15e3)
           });
           if (!resp.ok) return null;
@@ -11666,7 +11817,7 @@ ${finalVerifyResult.logs ?? ""}`;
           requestLiveBrowserHeartbeat(true);
           mobileOnLog(`Mobile discovery (${ctx.mode}) \u2014 ${platform3} / ${mobileTarget.appId}`);
           setExecutorBusy(true);
-          let session = null;
+          let session2 = null;
           let capture = null;
           let discoveryTeardownStarted = false;
           try {
@@ -11687,7 +11838,7 @@ ${finalVerifyResult.logs ?? ""}`;
               discoverySessionTarget,
               onDeviceSelected ? { onDeviceSelected } : void 0
             );
-            session = await openDiscoverySession(
+            session2 = await openDiscoverySession(
               async (device) => {
                 discoverySessionTarget.assignedDeviceId = device.deviceId;
                 liveBrowserHandle.patch({ deviceId: device.deviceId, deviceName: device.name });
@@ -11708,18 +11859,18 @@ ${finalVerifyResult.logs ?? ""}`;
                 }
               }
             );
-            mobileOnLog(`Appium session created: ${session.sessionId} on device ${session.deviceId}`);
-            attachMirrorWithRelay(session.sessionId, platform3, session.deviceId);
+            mobileOnLog(`Appium session created: ${session2.sessionId} on device ${session2.deviceId}`);
+            attachMirrorWithRelay(session2.sessionId, platform3, session2.deviceId);
             const driver = new MobileBridgeDriver({
-              sessionId: session.sessionId,
+              sessionId: session2.sessionId,
               platform: platform3,
-              appId: session.appId,
-              deviceId: session.deviceId,
+              appId: session2.appId,
+              deviceId: session2.deviceId,
               // Deterministic-state authorization: Android emulators / iOS
               // simulators only (VALIDATEQA_MOBILE_APP_RESET overrides the
               // Android default) — a personal physical device must never have
               // its app data wiped.
-              allowAppReset: mobileTarget.resetPolicy !== "PRESERVE_APP_DATA" && shouldResetMobileAppData(platform3, session.deviceId),
+              allowAppReset: mobileTarget.resetPolicy !== "PRESERVE_APP_DATA" && shouldResetMobileAppData(platform3, session2.deviceId),
               // Dual-device discovery + long AI turns can lose WDA/UIA2 more than
               // once per run. One recovery was too tight — the next snapshot
               // failed as "no UI tree" after a single WDA death.
@@ -11728,13 +11879,13 @@ ${finalVerifyResult.logs ?? ""}`;
                 if (discoveryTeardownStarted) {
                   throw new Error("discovery teardown already started \u2014 not recreating the Appium session");
                 }
-                const lost = session;
+                const lost = session2;
                 mobileOnLog(
                   `[appium] discovery session lost (${cause.message}); recreating on the leased device`
                 );
                 if (lost) {
                   detachMirrorSession(lost.deviceId);
-                  session = null;
+                  session2 = null;
                   try {
                     await lost.stop();
                   } catch {
@@ -11748,7 +11899,7 @@ ${finalVerifyResult.logs ?? ""}`;
                   }
                   throw new Error("discovery teardown started during session recovery \u2014 replacement session closed");
                 }
-                session = replacement;
+                session2 = replacement;
                 attachMirrorWithRelay(replacement.sessionId, platform3, replacement.deviceId);
                 liveBrowserHandle.patch({
                   deviceId: replacement.deviceId,
@@ -11812,7 +11963,7 @@ ${finalVerifyResult.logs ?? ""}`;
                 const apiCalls = stopped;
                 const captureHealth = activeCapture.health();
                 if (discoveryResult) {
-                  discoveryResult.apiCalls = apiCalls.length ? attachMobileDiscoveryNetworkContext(apiCalls, discoveryResult, session?.appId ?? mobileTarget.appId) : void 0;
+                  discoveryResult.apiCalls = apiCalls.length ? attachMobileDiscoveryNetworkContext(apiCalls, discoveryResult, session2?.appId ?? mobileTarget.appId) : void 0;
                   const priorHealth = discoveryResult.healthObservations;
                   const healthObject = {
                     consoleErrors: priorHealth?.consoleErrors ?? [],
@@ -11827,9 +11978,9 @@ ${finalVerifyResult.logs ?? ""}`;
                 mobileOnLog(`[mobile-net] capture stop failed: ${capErr instanceof Error ? capErr.message : String(capErr)}`);
               }
             }
-            if (session) {
-              detachMirrorSession(session.deviceId);
-              const closing = session;
+            if (session2) {
+              detachMirrorSession(session2.deviceId);
+              const closing = session2;
               try {
                 const stopped = await timeboxed(closing.stop());
                 if (stopped === TEARDOWN_STEP_TIMEOUT) {
@@ -11902,7 +12053,7 @@ ${line}`)
             };
           } else if (ctx.frameworkImport?.kind === "app-map") {
             log.info("Building the app map.");
-            discoveryResult = await (0, import_runner_core9.runAppMapOnRunner)(ctx, { onLog: (line) => log.info(line) });
+            discoveryResult = await (0, import_runner_core10.runAppMapOnRunner)(ctx, { onLog: (line) => log.info(line) });
           } else if (ctx.frameworkImport?.kind === "repo-enrichment") {
             const frameworkImport = ctx.frameworkImport;
             const primaryCli = isRepositoryCli(frameworkImport.repoHuntCli) ? frameworkImport.repoHuntCli : "claude-code";
@@ -11927,7 +12078,7 @@ ${line}`)
               })
             });
           } else {
-            const runRepoImport = ctx.frameworkImport?.kind === "repo-analysis" ? import_runner_core9.runRepoAnalysisOnRunner : import_framework_import_runner.runFrameworkImportOnRunner;
+            const runRepoImport = ctx.frameworkImport?.kind === "repo-analysis" ? import_runner_core10.runRepoAnalysisOnRunner : import_framework_import_runner.runFrameworkImportOnRunner;
             discoveryResult = await runRepoImport(ctx, { onTestGenerated, acquireLoginBrowser, onAudit: discoveryAudit }, {
               archiveUrl: ctx.frameworkImport?.source === "upload" ? `${opts.serverUrl}/api/runner/runs/${run2.runId}/import-archive` : void 0,
               archiveAuthHeader: headers.Authorization,
@@ -11989,7 +12140,7 @@ ${line}`)
           }
           const resolveCliSubscription = (engine, logLine) => (0, import_fetch_cli_subscription.fetchCliSubscription)({ serverUrl: opts.serverUrl, runId: run2.runId, headers, cli: engine, onLog: logLine });
           const claimNonce = claimNonceFor(run2.runId);
-          savedSignIn = ["survey", "deep", "full"].includes(ctx.mode) && claimNonce && typeof run2.claimEpoch === "number" ? await (0, import_runner_core9.openSavedSignInSession)((0, import_runner_core9.createSavedSignInClient)({
+          savedSignIn = ["survey", "deep", "full"].includes(ctx.mode) && claimNonce && typeof run2.claimEpoch === "number" ? await (0, import_runner_core10.openSavedSignInSession)((0, import_runner_core10.createSavedSignInClient)({
             serverUrl: opts.serverUrl,
             runId: run2.runId,
             claimEpoch: run2.claimEpoch,
@@ -12009,7 +12160,7 @@ ${line}`)
           if (ctx.repoBrief) discoveryResult.repoBrief = ctx.repoBrief;
           if (ctx.repoRouteManifest) discoveryResult.repoRouteManifest = ctx.repoRouteManifest;
         }
-        discoveryResult = (0, import_runner_core9.redactDiscoveryCaptureNeedles)(discoveryResult, {
+        discoveryResult = (0, import_runner_core10.redactDiscoveryCaptureNeedles)(discoveryResult, {
           ...run2.testVariables,
           // The saved sign-in's values, with every one it rotated to during the run.
           ...savedSignIn?.loaded ? savedSignIn.secrets() : {}
@@ -12167,7 +12318,7 @@ ${line}`)
           completionTokens: info.completionTokens,
           totalTokens: info.totalTokens,
           ...hasTurnDetails ? buildAuditTurnPayload(info, run2.testVariables) : { requestBody: { iteration: info.iteration, toolCalls: info.toolCalls } },
-          metadata: { groupId: info.groupId, iteration: info.iteration, phase: "capture", featureName: ctx.featureName, ...(0, import_runner_core9.cliAuditMetadata)(info) }
+          metadata: { groupId: info.groupId, iteration: info.iteration, phase: "capture", featureName: ctx.featureName, ...(0, import_runner_core10.cliAuditMetadata)(info) }
         });
       };
       const logBuffer = [];
@@ -12384,7 +12535,7 @@ ${line}`)
                 completionTokens: info.completionTokens,
                 totalTokens: info.totalTokens,
                 ...hasTurnDetails ? buildAuditTurnPayload(info, run2.testVariables) : { requestBody: { iteration: info.iteration, toolCalls: info.toolCalls } },
-                metadata: { groupId: info.groupId, iteration: info.iteration, testName: run2.testCaseId, platform: "mobile", ...(0, import_runner_core9.cliAuditMetadata)(info) }
+                metadata: { groupId: info.groupId, iteration: info.iteration, testName: run2.testCaseId, platform: "mobile", ...(0, import_runner_core10.cliAuditMetadata)(info) }
               });
             },
             runLiveHeal: async (a) => {
@@ -12726,7 +12877,7 @@ ${result2.logs}`);
     if (storageStatePath) {
       log.info(`Using auth state for project ${projectId}`);
     }
-    const authSession = (0, import_runner_core8.sharedAuthSessionStamp)(storageStatePath, captureAuth, sharedAuthInjectEnabled());
+    const authSession = (0, import_runner_core9.sharedAuthSessionStamp)(storageStatePath, captureAuth, sharedAuthInjectEnabled());
     const runAuthPath = captureAuth ? authPaths?.capturePath : void 0;
     const result = await (async () => {
       try {
@@ -12785,16 +12936,17 @@ ${result2.logs}`);
       runStatus = "ERROR";
       log.warn(`\u26A0 CONFIG_ISSUE from native execution - posting ERROR (not FAILED) to skip heal/quarantine`);
     }
-    const authRelabel = (0, import_runner_core8.authReadinessRelabel)({
+    const authRelabel = (0, import_runner_core9.authReadinessRelabel)({
       status: runStatus,
       error: runError,
       testName: run2.testName ?? run2.testCaseId ?? void 0,
       tags: run2.tags ?? [],
+      code: run2.playwrightCode,
       logs: result.logs,
       stepResults: result.stepResults,
       apiCalls: result.apiCalls,
       authStateExpected,
-      authStateInjected: (0, import_runner_core8.storageStateDelivered)(storageStatePath, result),
+      authStateInjected: (0, import_runner_core9.storageStateDelivered)(storageStatePath, result),
       needsStandingHeaders: normalRunAuthPlan.needsStandingHeaders,
       standingHeadersInjected: !!result.authDelivery?.standingHeadersInjected
     });
@@ -12803,7 +12955,7 @@ ${result2.logs}`);
       runError = authRelabel.error;
       log.warn(authRelabel.logLine);
     }
-    (0, import_runner_core9.throwIfRunAborted)();
+    (0, import_runner_core10.throwIfRunAborted)();
     await postRunResult({
       status: runStatus,
       stepResults: result.stepResults,
@@ -12826,7 +12978,7 @@ ${result2.logs}`);
     if (result.passed) {
       log.ok(`PASSED  (${duration}ms)${result.suspiciousPass ? ` \u26A0 suspicious-pass (viewport ${Math.round(result.suspiciousPass.emptyRatio * 100)}% blank)` : ""}`);
     } else if (runStatus === "ERROR") {
-      log.warn(`BLOCKED (${duration}ms) - environmental block (rate-limit / config-issue), not counted as failure`);
+      log.warn(blockedRunLogLine(runError, duration));
     } else {
       log.fail(`FAILED  (${duration}ms)${result.error ? ` - ${result.error}` : ""}`);
       if (result.logs) {
@@ -12837,14 +12989,14 @@ ${result2.logs}`);
     }
   } catch (err) {
     if (err instanceof RunNoLongerActiveError) throw err;
-    const abortOutcome = (0, import_runner_core9.runAbortOutcome)(err, signal);
+    const abortOutcome = (0, import_runner_core10.runAbortOutcome)(err, signal);
     if (abortOutcome === "discard") {
-      throw new RunNoLongerActiveError((0, import_runner_core9.isSupersededRunAbort)(signal) ? `Run ${run2.runId} was superseded by a newer claim` : `Run ${run2.runId} was cancelled on the server`);
+      throw new RunNoLongerActiveError((0, import_runner_core10.isSupersededRunAbort)(signal) ? `Run ${run2.runId} was superseded by a newer claim` : `Run ${run2.runId} was cancelled on the server`);
     }
     if (abortOutcome === "interrupt") {
       await postRunResult({
         status: "ERROR",
-        error: import_runner_core9.RUNNER_SHUTDOWN_INTERRUPT_ERROR,
+        error: import_runner_core10.RUNNER_SHUTDOWN_INTERRUPT_ERROR,
         duration: Date.now() - startTime
       });
       throw err;
@@ -12961,13 +13113,6 @@ async function startRunner(opts) {
     6e4,
     envInt("VALIDATE_RUNNER_VERSION_CHECK_MS", 15 * 6e4)
   );
-  const exitForUpgrade = (latestVersion, installed) => {
-    console.error(formatUpgradeInstructions(latestVersion));
-    console.error(`  Installed: ${installed}`);
-    console.error(`  Required:  ${latestVersion} (or newer)`);
-    console.error("");
-    process.exit(1);
-  };
   let drainingForUpgrade = false;
   const deferUpgradeWhileBusy = () => {
     if (upgradeAction(activeRuns) === "exit") return false;
@@ -13048,9 +13193,11 @@ async function startRunner(opts) {
       await browserPool.init();
       log.ok(`Browser pool: ${poolSize} shared browsers ready`);
     } catch (err) {
-      log.fail(`Browser pool failed to init: ${err instanceof Error ? err.message : err}`);
-      log.fail("Discovery requires a browser pool. Fix the browser installation or set BROWSER_POOL_SIZE=0 to disable.");
-      process.exit(1);
+      const message = err instanceof Error ? err.message : String(err);
+      log.fail(`Browser pool failed to init: ${message}`);
+      const failure = browserPoolInitFailure(message, bundledPlaywrightVersion2());
+      log.fail(failure.advice);
+      process.exit(failure.exitCode);
     }
   }
   const SHUTDOWN_FINISH_MS = Math.max(0, envInt("RUNNER_SHUTDOWN_FINISH_MS", 5e3));
@@ -13322,7 +13469,7 @@ async function startRunner(opts) {
       }
     });
   };
-  const removeSupersededRunFetchFence = (0, import_runner_core9.installSupersededRunFetchFence)(serverUrl);
+  const removeSupersededRunFetchFence = (0, import_runner_core10.installSupersededRunFetchFence)(serverUrl);
   const heartbeat = setInterval(sendHeartbeat, 3e4);
   sendHeartbeat();
   let shuttingDown = false;
@@ -13334,7 +13481,7 @@ async function startRunner(opts) {
         headers: { ...headers, "Content-Type": "application/json" },
         body: JSON.stringify(withClaimEpoch({
           status: "ERROR",
-          error: import_runner_core9.RUNNER_SHUTDOWN_INTERRUPT_ERROR
+          error: import_runner_core10.RUNNER_SHUTDOWN_INTERRUPT_ERROR
         }, claimEpoch)),
         signal: AbortSignal.timeout(5e3)
       }));
@@ -13350,7 +13497,7 @@ async function startRunner(opts) {
     setTimeout(() => {
       console.error("Shutdown grace elapsed \u2014 forcing exit");
       process.exit(0);
-    }, (0, import_runner_core9.shutdownForceExitMs)(SHUTDOWN_FINISH_MS, SHUTDOWN_GRACE_MS)).unref();
+    }, (0, import_runner_core10.shutdownForceExitMs)(SHUTDOWN_FINISH_MS, SHUTDOWN_GRACE_MS)).unref();
     clearInterval(heartbeat);
     heartbeatKeepalive.stop();
     if (liveBrowserHeartbeatTimer) {
@@ -13368,7 +13515,7 @@ async function startRunner(opts) {
     if (claimPending) {
       await Promise.race([claimPending, new Promise((resolve3) => setTimeout(resolve3, SHUTDOWN_FINISH_MS))]);
     }
-    await (0, import_runner_core9.drainAbortedRuns)({
+    await (0, import_runner_core10.drainAbortedRuns)({
       finishMs: SHUTDOWN_FINISH_MS,
       graceMs: SHUTDOWN_GRACE_MS,
       inFlight: activeWebRuns,
@@ -13385,7 +13532,7 @@ async function startRunner(opts) {
       await stopAppiumServer();
     }
     await browserPool.shutdown();
-    await (0, import_runner_core10.closeLocalGoogleBroker)().catch(() => {
+    await (0, import_runner_core11.closeLocalGoogleBroker)().catch(() => {
     });
     removeSupersededRunFetchFence();
     log.info("Runner stopped.");
@@ -13449,7 +13596,7 @@ async function startRunner(opts) {
   const abortSupersededRun = (runId, status, serverEpoch) => {
     const controller = activeWebRuns.get(runId);
     const already = !controller || controller.signal.aborted;
-    if (controller) (0, import_runner_core9.abortRun)(controller, "superseded", runId);
+    if (controller) (0, import_runner_core10.abortRun)(controller, "superseded", runId);
     activeMobileRuns.get(runId)?.triggerAbort(`was superseded by a newer claim (epoch ${serverEpoch ?? "?"}, status ${status})`);
     if (!already) {
       log.warn(`Run ${runId} was superseded by a newer claim (server epoch ${serverEpoch ?? "?"}, ours ${claimedRunEpochs.get(runId) ?? "?"}) \u2014 stopping it; this runner posts nothing more for it.`);
@@ -13465,7 +13612,7 @@ async function startRunner(opts) {
     (runId, status) => {
       const controller = activeWebRuns.get(runId);
       const already = !controller || controller.signal.aborted;
-      if (controller) (0, import_runner_core9.abortRun)(controller, "cancelled", runId);
+      if (controller) (0, import_runner_core10.abortRun)(controller, "cancelled", runId);
       activeMobileRuns.get(runId)?.triggerAbort(`was cancelled server-side (status ${status})`);
       if (!already) log.warn(`Run ${runId} was cancelled server-side (status ${status}) \u2014 stopping it.`);
     }
@@ -13665,6 +13812,7 @@ async function startRunner(opts) {
             const applyRelease = () => {
               claimedRunEpochs.delete(run2.runId);
               claimNonces.delete(run2.runId);
+              if (activeWebRuns.get(run2.runId) === runAbort) activeWebRuns.delete(run2.runId);
               activeRuns--;
               decrementType(runMode);
               decrementProject(runProject);
@@ -13723,9 +13871,9 @@ async function startRunner(opts) {
               runWatchdog.start();
             }
             activeWebRuns.set(run2.runId, runAbort);
-            const runWritePolicy = (0, import_runner_core9.parseRunWritePolicy)(run2.runWritePolicy);
-            const runSignInSecrets = runWritePolicy ? (0, import_runner_core9.signInSecretsOf)({ ...run2.discoveryContext?.variableContext?.allTestVariables ?? {}, ...run2.testVariables ?? {} }) : [];
-            (0, import_runner_core9.withRunWritePolicyScope)(runWritePolicy, () => (0, import_runner_core10.withLocalGoogleScope)({ baseUrl: run2.baseUrl, runId: run2.runId }, () => executeRun(run2, opts, headers, requestLiveBrowserHeartbeat, (testCaseId) => {
+            const runWritePolicy = (0, import_runner_core10.parseRunWritePolicy)(run2.runWritePolicy);
+            const runSignInSecrets = runWritePolicy ? (0, import_runner_core10.signInSecretsOf)({ ...run2.discoveryContext?.variableContext?.allTestVariables ?? {}, ...run2.testVariables ?? {} }) : [];
+            (0, import_runner_core10.withRunWritePolicyScope)(runWritePolicy, () => (0, import_runner_core11.withLocalGoogleScope)({ baseUrl: run2.baseUrl, runId: run2.runId }, () => executeRun(run2, opts, headers, requestLiveBrowserHeartbeat, (testCaseId) => {
               if (mobilePlatform) {
                 mobileHealHold.set(testCaseId, { expiry: Date.now() + MOBILE_HEAL_HOLD_MS, platform: mobilePlatform });
               }
@@ -13733,11 +13881,11 @@ async function startRunner(opts) {
               runsCompleted++;
             }).catch((err) => {
               const abortReason = runAbort.signal.reason;
-              if ((0, import_runner_core9.isRunAbortError)(abortReason) && abortReason.reason === "shutdown") {
+              if ((0, import_runner_core10.isRunAbortError)(abortReason) && abortReason.reason === "shutdown") {
                 log.info(`Run ${run2.runId} was interrupted by runner shutdown.`);
                 return;
               }
-              if ((0, import_runner_core9.isSupersededRunAbort)(runAbort.signal)) {
+              if ((0, import_runner_core10.isSupersededRunAbort)(runAbort.signal)) {
                 log.info(`Run ${run2.runId} was superseded by a newer claim; this runner posted nothing more for it.`);
                 return;
               }
@@ -13749,7 +13897,7 @@ async function startRunner(opts) {
               log.warn(`Run ${run2.runId} crashed: ${msg}`);
             }).finally(() => {
               runSettled = true;
-              activeWebRuns.delete(run2.runId);
+              if (activeWebRuns.get(run2.runId) === runAbort) activeWebRuns.delete(run2.runId);
               if (runWatchdog) runWatchdog.settle();
               else applyRelease();
             });
@@ -13809,12 +13957,61 @@ async function startRunner(opts) {
   }
 }
 
+// src/resolve-credentials.ts
+function sameServer(a, b) {
+  const norm = (u) => u.trim().replace(/\/+$/, "").toLowerCase();
+  return norm(a) === norm(b);
+}
+function resolveCredentials(flags, env, saved) {
+  const rawServer = flags.server || env.SERVER_URL || saved?.serverUrl;
+  const serverUrl = rawServer?.replace(/\/+$/, "");
+  const savedApplies = saved !== null && serverUrl !== void 0 && sameServer(serverUrl, saved.serverUrl);
+  return {
+    savedLoginSkipped: saved !== null && !savedApplies,
+    authToken: flags.token || env.AUTH_TOKEN || (savedApplies ? saved.token : void 0),
+    serverUrl,
+    projectId: flags.project || env.PROJECT_ID || (savedApplies ? saved.projectId : void 0)
+  };
+}
+
 // src/login-check.ts
 var RUNNER_TOKEN_PREFIXES = ["urt_", "rt_"];
 function runnerTokenShapeProblem(token) {
   if (RUNNER_TOKEN_PREFIXES.some((prefix) => token.startsWith(prefix))) return null;
   return "This is not a runner token. Use the runner token (urt_...) from Project Settings \u2192 Local Runner; an API token (pat_...) or a login token cannot run tests.";
 }
+var SERVER_URL_HINT = "Use the server URL shown in Project Settings \u2192 Local Runner (the dashboard address is not always it).";
+function loginServerUrlProblem(serverUrl, label = "--server") {
+  let parsed = null;
+  try {
+    parsed = new URL(serverUrl);
+  } catch {
+    parsed = null;
+  }
+  if (parsed && (parsed.protocol === "https:" || parsed.protocol === "http:")) return null;
+  const guess = !parsed && serverUrl && !serverUrl.includes("://") ? ` (did you mean https://${serverUrl}?)` : "";
+  return `${label} needs a full address starting with https:// or http://, got '${serverUrl}'${guess}.`;
+}
+function sendsTokenInPlaintext(serverUrl) {
+  let url;
+  try {
+    url = new URL(serverUrl);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "http:") return false;
+  const host = url.hostname.toLowerCase();
+  const loopback = host === "localhost" || host.endsWith(".localhost") || host === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(host);
+  return !loopback;
+}
+async function isRunnerHealthAnswer(res) {
+  try {
+    const body = await res.json();
+    return typeof body === "object" && body !== null && !Array.isArray(body) && typeof body.status === "string";
+  } catch {
+    return false;
+  }
+}
 async function checkRunnerLogin(serverUrl, token, fetchImpl = fetch) {
   let res;
   try {
@@ -13822,17 +14019,388 @@ async function checkRunnerLogin(serverUrl, token, fetchImpl = fetch) {
   } catch {
     return { ok: false, message: `Could not reach ${serverUrl}` };
   }
-  if (res.ok) return { ok: true };
+  if (res.ok) {
+    if (await isRunnerHealthAnswer(res)) return { ok: true };
+    return { ok: false, wrongServer: true, message: `${serverUrl} is not a validate.qa server: it answered, but not as the runner API - credentials not saved. Check --server. ${SERVER_URL_HINT}` };
+  }
   if (res.status === 401 || res.status === 403) {
     return { ok: false, message: "Invalid token - check your runner token (it may be revoked, or belong to another project)" };
   }
+  if (res.status === 404 || res.status === 405) {
+    return { ok: false, wrongServer: true, message: `${serverUrl} is not a validate.qa server (HTTP ${res.status} for the runner API) - credentials not saved. Check --server. ${SERVER_URL_HINT}` };
+  }
   return { ok: false, message: `Server returned ${res.status} - credentials not saved, try again later` };
 }
+function startServerProblem(check2, serverUrl) {
+  if (check2.ok || !check2.wrongServer) return null;
+  return `${serverUrl} is not a validate.qa server: it has no runner API, so the runner would poll it forever. Check --server, SERVER_URL or the saved login. ${SERVER_URL_HINT}`;
+}
+var MAX_TOKEN_INPUT = 4096;
+async function resolveLoginToken(input) {
+  if (input.flag !== void 0 && input.flag !== "-") return { token: input.flag };
+  const raw = input.stdinIsTTY ? await input.promptHidden("Paste the runner token (urt_..., not shown) and press Enter: ") : await input.readPiped();
+  const token = raw.split(/\r?\n/).map((line) => line.trim()).find((line) => line.length > 0);
+  if (!token) {
+    return { error: "No runner token. Paste it at the prompt, pipe it on stdin, or pass --token <urt_...>." };
+  }
+  return { token };
+}
+function readPipedToken(stream, max = MAX_TOKEN_INPUT) {
+  return new Promise((resolve3, reject) => {
+    let text = "";
+    const cleanup = () => {
+      stream.removeListener("data", onData);
+      stream.removeListener("end", onEnd);
+      stream.removeListener("error", onError);
+    };
+    const onData = (chunk) => {
+      text += String(chunk);
+      if (text.length > max) {
+        cleanup();
+        stream.pause();
+        reject(new Error(`more than ${max} characters on stdin: that is not a runner token`));
+      }
+    };
+    const onEnd = () => {
+      cleanup();
+      resolve3(text);
+    };
+    const onError = (err) => {
+      cleanup();
+      reject(err);
+    };
+    stream.on("data", onData);
+    stream.on("end", onEnd);
+    stream.on("error", onError);
+    stream.resume();
+  });
+}
+function promptHidden(input, output, question) {
+  return new Promise((resolve3, reject) => {
+    const wasRaw = input.isRaw === true;
+    let line = "";
+    output.write(question);
+    input.setRawMode?.(true);
+    const finish = (err) => {
+      input.removeListener("data", onData);
+      input.setRawMode?.(wasRaw);
+      input.pause();
+      output.write("\n");
+      if (err) reject(err);
+      else resolve3(line);
+    };
+    const onData = (chunk) => {
+      for (const ch of String(chunk)) {
+        if (ch === "\r" || ch === "\n" || ch === "") {
+          finish();
+          return;
+        }
+        if (ch === "") {
+          finish(new Error("cancelled"));
+          return;
+        }
+        if (ch === "\x7F" || ch === "\b") {
+          line = line.slice(0, -1);
+          continue;
+        }
+        if (line.length >= MAX_TOKEN_INPUT) {
+          finish(new Error(`more than ${MAX_TOKEN_INPUT} characters: that is not a runner token`));
+          return;
+        }
+        line += ch;
+      }
+    };
+    input.on("data", onData);
+    input.resume();
+  });
+}
+
+// src/status-check.ts
+var SAVED = "saved credentials";
+function pick(flag, flagName, envValue, envName, savedValue) {
+  if (flag) return { value: flag, from: flagName };
+  if (envValue) return { value: envValue, from: envName };
+  if (savedValue) return { value: savedValue, from: SAVED };
+  return null;
+}
+function resolveStatusCredentials(opts, env, saved) {
+  const server2 = pick(opts.server, "--server", env.SERVER_URL, "SERVER_URL", saved?.serverUrl);
+  const norm = (u) => u.trim().replace(/\/+$/, "").toLowerCase();
+  const savedApplies = !!saved && !!server2 && norm(server2.value) === norm(saved.serverUrl);
+  const token = pick(opts.token, "--token", env.AUTH_TOKEN, "AUTH_TOKEN", savedApplies ? saved?.token : void 0);
+  const project = pick(opts.project, "--project", env.PROJECT_ID, "PROJECT_ID", savedApplies ? saved?.projectId : void 0);
+  if (!token && !server2) {
+    return { missing: "No saved credentials. Run: validate-runner login, or set AUTH_TOKEN and SERVER_URL (or pass --token and --server)" };
+  }
+  if (!token && saved?.token && !savedApplies) {
+    return { missing: `The saved login is for ${saved.serverUrl}, not ${server2?.value}. Run: validate-runner login --server <url>, or set AUTH_TOKEN (or pass --token)` };
+  }
+  if (!token) return { missing: "No runner token. Run: validate-runner login, or set AUTH_TOKEN (or pass --token)" };
+  if (!server2) return { missing: "No server URL. Run: validate-runner login --server <url>, or set SERVER_URL (or pass --server)" };
+  return {
+    serverUrl: server2.value.replace(/\/+$/, ""),
+    token: token.value,
+    ...project ? { projectId: project.value } : {},
+    from: { serverUrl: server2.from, token: token.from, ...project ? { projectId: project.from } : {} }
+  };
+}
+var STATUS_OK = 0;
+var STATUS_FAILED = 1;
+async function runStatusCheck(resolved, fetchImpl = fetch, out = console) {
+  if (!resolved || "missing" in resolved) {
+    out.error(resolved ? resolved.missing : "No saved credentials. Run: validate-runner login");
+    return STATUS_FAILED;
+  }
+  const saved = resolved;
+  const from = (source) => source ? `  (from ${source})` : "";
+  out.log(`Server:  ${saved.serverUrl}${from(saved.from?.serverUrl)}`);
+  out.log(`Project: ${saved.projectId || "(not set)"}${from(saved.projectId ? saved.from?.projectId : void 0)}`);
+  out.log(`Token:   ${saved.token.slice(0, 8)}...${saved.token.slice(-4)}${from(saved.from?.token)}`);
+  out.log("");
+  let res;
+  try {
+    res = await fetchImpl(`${saved.serverUrl}/api/runner/health`, {
+      headers: {
+        Authorization: `Bearer ${saved.token}`,
+        ...saved.projectId ? { "X-Project-Id": saved.projectId } : {}
+      }
+    });
+  } catch {
+    out.error("\u2717  Could not reach server");
+    return STATUS_FAILED;
+  }
+  if (res.status === 401 || res.status === 403) {
+    out.error(`\u2717  Server returned ${res.status}: invalid token - check your runner token (it may be revoked, or belong to another project). Run: validate-runner login`);
+    return STATUS_FAILED;
+  }
+  if (!res.ok) {
+    out.error(`\u2717  Server returned ${res.status}`);
+    return STATUS_FAILED;
+  }
+  let data = null;
+  try {
+    data = await res.json();
+  } catch {
+  }
+  if (!data || typeof data.status !== "string") {
+    out.error(`\u2717  Server returned ${res.status} but not a runner health answer - check the server URL`);
+    return STATUS_FAILED;
+  }
+  const runners = typeof data.runners === "number" ? data.runners : 0;
+  out.log(`\u2713  Server reachable - runner status: ${data.status} (${runners} runner(s) online)`);
+  return STATUS_OK;
+}
 
 // src/services/sign-in-capture.ts
 var import_browser_config3 = __toESM(require_browser_config());
 var import_google_local_signin = __toESM(require_google_local_signin());
 import { chromium } from "playwright";
+
+// src/services/sign-in-detect.ts
+init_dist();
+var SIGN_IN_PATH_SEGMENT = /^(log-?in|log_in|sign-?in|sign_in|sign-?on|sign_on|auth|authenticate|authorize|oauth2?|openid|sso|saml2?|cas|callback|sign-?up|sign_up|register|password|forgot(-password)?|reset(-password)?|verify|mfa|2fa|otp|challenge|consent|signin-oidc|wp-login)$/i;
+var SIGN_IN_PATH = /\/sessions?\/new(\/|$)/i;
+var SIGN_OUT_PATH_SEGMENT = /^(log-?out|log_out|sign-?out|sign_out|sign-?off|log-?off|end-?session)$/i;
+var SIGN_IN_QUERY = /(^|&)((action|mode|view|page|step)=(log-?in|sign-?in|sign_in|register|sign-?up|lostpassword|rp|resetpass)(&|$)|(login|signin)=(fail(ed|ure)?|error|invalid|denied|required|expired|true|1)?(&|$))/i;
+var SIGN_OUT_PATH = /\/sessions?\/destroy(\/|$)/i;
+var SIGN_OUT_QUERY = /(^|&)(action|mode)=(log-?out|sign-?out|log-?off)(&|$)/i;
+var SIGN_IN_HOST_LABEL = /^(auth|login|signin|sso|accounts?|id|identity|idp|oauth|secure-?login)$/i;
+var AUTH_NAME = /token|auth|session|sess|jwt|sid|refresh|credential|bearer|access|login|user|remember/i;
+var FLOW_COOKIE = /csrf|xsrf|callback-?url|redirect|return-?to|state|nonce|pkce|code[-_]?verifier/i;
+var NOT_A_SIGN_IN_COOKIE = /^(_ga.*|_gid|_gat.*|_gcl_.*|_fbp|_fbc|_hj.*|_clck|_clsk|ajs_.*|amplitude.*|mp_.*|_mkto_trk|hubspotutk|__hs.*|__stripe_.*|intercom-.*|optimizely.*|_dd_s|_uetsid|_uetvid|_tt_.*|_pin_unauth|_rdt_uuid|cookieconsent.*|cookie_?consent.*|OptanonConsent|OptanonAlertBoxClosed|euconsent.*|NEXT_LOCALE|locale|lang|theme|cf_clearance|__cf_bm|_cfuvid|__cflb|datadome|_abck|bm_sz|bm_sv|ak_bmsc|reese84|incap_ses_.*|visid_incap_.*|nlbi_.*|_px.*|akavpau_.*|csrftoken|_csrf|XSRF-TOKEN|csrf_token|__Host-csrf.*)$/i;
+function bareHost(domain) {
+  return domain.trim().toLowerCase().replace(/^\./, "").replace(/\.$/, "");
+}
+function onAppSite(hostOrDomain, target) {
+  const host = bareHost(hostOrDomain);
+  const app = target.hostname.toLowerCase();
+  if (!host) return false;
+  if (host === app) return true;
+  const site = registrableDomain(app);
+  return host === site || host.endsWith(`.${site}`);
+}
+function isSignInStep(pageUrl, target) {
+  let url;
+  try {
+    url = new URL(pageUrl);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+  if (!onAppSite(url.hostname, target)) return true;
+  const host = url.hostname.toLowerCase();
+  if (host !== target.hostname.toLowerCase() && SIGN_IN_HOST_LABEL.test(host.split(".")[0] ?? "")) return true;
+  if (SIGN_IN_QUERY.test(url.search.slice(1)) && !SIGN_OUT_QUERY.test(url.search.slice(1))) return true;
+  if (SIGN_IN_PATH.test(url.pathname)) return true;
+  return pathSegments(url).some((segment) => SIGN_IN_PATH_SEGMENT.test(segment));
+}
+function pathSegments(url) {
+  const hashPath = /^#!?\//.test(url.hash) ? url.hash.replace(/^#!?/, "").split(/[?#]/)[0] ?? "" : "";
+  return `${url.pathname}/${hashPath}`.split("/").map((segment) => segment.replace(/\.(php|html?|aspx?|jsp|cgi)$/i, ""));
+}
+function isSignOutPage(pageUrl) {
+  try {
+    const url = new URL(pageUrl);
+    if (SIGN_OUT_PATH.test(url.pathname) || SIGN_OUT_QUERY.test(url.search.slice(1))) return true;
+    return pathSegments(url).some((segment) => SIGN_OUT_PATH_SEGMENT.test(segment));
+  } catch {
+    return false;
+  }
+}
+function isSignOutRequest(request, target) {
+  if (/^(GET|HEAD|OPTIONS)$/i.test(request.method)) return false;
+  let url;
+  try {
+    url = new URL(request.url);
+  } catch {
+    return false;
+  }
+  if (!onAppSite(url.hostname, target)) return false;
+  if (isSignOutPage(url.toString())) return true;
+  return /^DELETE$/i.test(request.method) && /\/(session|sessions\/(current|me)|sign_?in|log_?in)\/?$/i.test(url.pathname);
+}
+function isHostedSignIn(url) {
+  const host = url.hostname.toLowerCase();
+  if (host === "identitytoolkit.googleapis.com") return /\/accounts:(signIn|signUp)/i.test(url.pathname);
+  if (host === "securetoken.googleapis.com") return /\/token$/i.test(url.pathname);
+  if (host.endsWith(".supabase.co")) return /^\/auth\/v1\/(token|signup|verify|otp|magiclink)(\/|$)/i.test(url.pathname);
+  return /^cognito-idp\.[a-z0-9-]+\.amazonaws\.com$/.test(host);
+}
+function isSignInSubmission(request, target) {
+  if (/^(GET|HEAD|OPTIONS)$/i.test(request.method)) return false;
+  if (!["document", "xhr", "fetch"].includes(request.resourceType)) return false;
+  let url;
+  let page;
+  try {
+    url = new URL(request.url);
+    page = new URL(request.pageUrl);
+  } catch {
+    return false;
+  }
+  if (isSignOutRequest(request, target)) return false;
+  const signInPath = /(^|[/._-])(log-?in|sign-?in|signin|sign_in|auth|oauth2?|token|session|sessions|password|otp|verify|mfa|2fa|challenge|identifier)([/._?-]|$)/i;
+  if (onAppSite(url.hostname, target) && signInPath.test(url.pathname)) return true;
+  if (onAppSite(page.hostname, target) && isHostedSignIn(url)) return true;
+  const firstParty = url.hostname === page.hostname || registrableDomain(url.hostname) === registrableDomain(page.hostname);
+  return firstParty && isSignInStep(request.pageUrl, target);
+}
+var LOGIN_PATH_SEGMENT = /^(log-?in|log_in|sign-?in|sign_in|signin-oidc|wp-login|sso|saml2?|oauth2?|authorize|authenticate|auth|passwordless|magic-?link)$/i;
+function isLoginStep(pageUrl, target) {
+  let url;
+  try {
+    url = new URL(pageUrl);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+  const host = url.hostname.toLowerCase();
+  if (host !== target.hostname.toLowerCase() && SIGN_IN_HOST_LABEL.test(host.split(".")[0] ?? "")) return true;
+  const query = url.search.slice(1);
+  if (SIGN_IN_QUERY.test(query) && !SIGN_OUT_QUERY.test(query)) return true;
+  if (SIGN_IN_PATH.test(url.pathname)) return true;
+  return pathSegments(url).some((segment) => LOGIN_PATH_SEGMENT.test(segment));
+}
+function isOnAppPastSignIn(pageUrl, target) {
+  let url;
+  try {
+    url = new URL(pageUrl);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+  return onAppSite(url.hostname, target) && !isSignInStep(pageUrl, target);
+}
+function cookieKey(cookie) {
+  return `${bareHost(cookie.domain)}\0${cookie.path ?? "/"}\0${cookie.name}`;
+}
+function originOnApp(origin, target) {
+  try {
+    return onAppSite(new URL(origin).hostname, target);
+  } catch {
+    return false;
+  }
+}
+function indexedDbEntries(databases) {
+  const out = /* @__PURE__ */ new Map();
+  for (const db of databases ?? []) {
+    if (!db || typeof db !== "object") continue;
+    const name = String(db.name ?? "");
+    out.set(name, JSON.stringify(db));
+  }
+  return out;
+}
+function gainedAppCredential(baseline, current, target) {
+  const before = new Map(baseline.cookies.map((cookie) => [cookieKey(cookie), cookie.value]));
+  for (const cookie of current.cookies) {
+    if (!cookie.value || !credentialCookie(cookie, target)) continue;
+    if (before.get(cookieKey(cookie)) !== cookie.value) return true;
+  }
+  const storageBefore = /* @__PURE__ */ new Map();
+  for (const origin of baseline.origins) {
+    for (const [kind, entries] of [["l", origin.localStorage], ["s", origin.sessionStorage ?? []]]) {
+      for (const entry of entries) storageBefore.set(`${origin.origin}\0${kind}\0${entry.name}`, entry.value);
+    }
+    for (const [name, value] of indexedDbEntries(origin.indexedDB)) storageBefore.set(`${origin.origin}\0i\0${name}`, value);
+  }
+  for (const origin of current.origins) {
+    if (!originOnApp(origin.origin, target)) continue;
+    for (const [kind, entries] of [["l", origin.localStorage], ["s", origin.sessionStorage ?? []]]) {
+      for (const entry of entries) {
+        if (!entry.value || !AUTH_NAME.test(entry.name) || FLOW_COOKIE.test(entry.name)) continue;
+        if (storageBefore.get(`${origin.origin}\0${kind}\0${entry.name}`) !== entry.value) return true;
+      }
+    }
+    for (const [name, value] of indexedDbEntries(origin.indexedDB)) {
+      if (!AUTH_NAME.test(name) && name !== "firebaseLocalStorageDb") continue;
+      if (storageBefore.get(`${origin.origin}\0i\0${name}`) !== value) return true;
+    }
+  }
+  return false;
+}
+var SESSION_NAME = /sess|session|sid|token|jwt|auth|refresh|remember|credential|bearer|^\.aspnetcore\.(cookies|identity)|^_\w+_key$/i;
+function credentialCookie(cookie, target) {
+  if (!onAppSite(cookie.domain, target) || NOT_A_SIGN_IN_COOKIE.test(cookie.name) || FLOW_COOKIE.test(cookie.name)) return false;
+  return Boolean(cookie.httpOnly) || AUTH_NAME.test(cookie.name);
+}
+var session = (cookie) => SESSION_NAME.test(cookie.name) && !NOT_A_SIGN_IN_COOKIE.test(cookie.name) && !FLOW_COOKIE.test(cookie.name);
+var authStorage = (entry) => AUTH_NAME.test(entry.name) && !FLOW_COOKIE.test(entry.name);
+var authDatabase = (db) => {
+  const name = String(db?.name ?? "");
+  return AUTH_NAME.test(name) || name === "firebaseLocalStorageDb";
+};
+function withoutCredentials(state2, target) {
+  return {
+    cookies: state2.cookies.filter((cookie) => onAppSite(cookie.domain, target) && !session(cookie)),
+    origins: state2.origins.filter((origin) => originOnApp(origin.origin, target)).map((origin) => ({
+      origin: origin.origin,
+      localStorage: origin.localStorage.filter((entry) => !authStorage(entry)),
+      ...origin.indexedDB ? { indexedDB: origin.indexedDB.filter((db) => !authDatabase(db)) } : {}
+    }))
+  };
+}
+function droppedCredentials(state2, target) {
+  const out = /* @__PURE__ */ new Set();
+  for (const cookie of state2.cookies) if (onAppSite(cookie.domain, target) && session(cookie)) out.add(`c\0${cookieKey(cookie)}\0${cookie.value}`);
+  for (const origin of state2.origins) {
+    if (!originOnApp(origin.origin, target)) continue;
+    for (const entry of origin.localStorage) if (authStorage(entry)) out.add(`l\0${origin.origin}\0${entry.name}\0${entry.value}`);
+    for (const db of origin.indexedDB ?? []) if (authDatabase(db)) out.add(`i\0${origin.origin}\0${JSON.stringify(db)}`);
+  }
+  return out;
+}
+function credentialsKeptAcrossSignIn(before, after, target) {
+  const kept = droppedCredentials(after, target);
+  return [...droppedCredentials(before, target)].every((item) => kept.has(item));
+}
+function looksSignedIn(observation, target) {
+  const urls = observation.openPageUrls.filter((url) => /^https?:/i.test(url));
+  if (urls.length === 0 || !observation.submitted) return false;
+  if (urls.some((url) => isSignInStep(url, target))) return false;
+  if (!urls.some((url) => isOnAppPastSignIn(url, target))) return false;
+  return gainedAppCredential(observation.baseline, observation.current, target);
+}
+
+// src/services/sign-in-capture.ts
 async function captureSignInInteractively(url, ready, opts = {}) {
   const target = new URL(url);
   let browser;
@@ -13841,47 +14409,316 @@ async function captureSignInInteractively(url, ready, opts = {}) {
   } catch {
     browser = await chromium.launch({ headless: false, ignoreDefaultArgs: ["--enable-automation"], args: [...import_google_local_signin.SIGN_IN_WINDOW_ARGS], env: (0, import_browser_config3.browserLaunchEnv)() });
   }
-  return captureFromBrowser(browser, target, ready, opts.timeoutMs ?? SIGN_IN_TIMEOUT_MS);
+  return captureFromBrowser(browser, target, ready, opts.timeoutMs ?? SIGN_IN_TIMEOUT_MS, opts);
 }
 var SIGN_IN_TIMEOUT_MS = 15 * 60 * 1e3;
-async function captureFromBrowser(browser, target, ready, timeoutMs) {
+var SIGN_IN_SNAPSHOT_INTERVAL_MS = 2e3;
+var PROVE_RETRY_MS = 1e4;
+var PROVE_DEADLINE_MS = 25e3;
+var CLOSE_PROVE_DEADLINE_MS = 3e4;
+async function readState(context, tabs = () => true, indexedDB = true) {
+  const state2 = await context.storageState({ indexedDB });
+  for (const open of context.pages()) {
+    let origin;
+    try {
+      if (!tabs(open.url())) continue;
+      origin = new URL(open.url()).origin;
+    } catch {
+      continue;
+    }
+    const entries = await open.evaluate(() => {
+      const out = [];
+      for (let i = 0; i < window.sessionStorage.length; i += 1) {
+        const name = window.sessionStorage.key(i);
+        if (name !== null) out.push({ name, value: window.sessionStorage.getItem(name) ?? "" });
+      }
+      return out;
+    }).catch(() => []);
+    if (entries.length === 0) continue;
+    const entry = state2.origins.find((candidate) => candidate.origin === origin);
+    if (entry) entry.sessionStorage = entries;
+    else state2.origins.push({ origin, localStorage: [], sessionStorage: entries });
+  }
+  return state2;
+}
+async function readEnv(context) {
+  const page0 = context.pages()[0];
+  return page0 ? await page0.evaluate(() => ({ ua: navigator.userAgent, locale: navigator.language, tz: Intl.DateTimeFormat().resolvedOptions().timeZone })) : { ua: "", locale: "", tz: "" };
+}
+function toCapture(state2, env) {
+  return { storageState: JSON.stringify(state2), userAgent: env?.ua ?? "", locale: env?.locale ?? "", timezoneId: env?.tz ?? "" };
+}
+function watchSignIn(context, target, opts = {}) {
+  const now = opts.now ?? Date.now;
+  let baseline;
+  let submitted = false;
+  let announced = false;
+  let last;
+  let beforeSubmit;
+  let lastDurable = false;
+  const durableCredential = (state2) => Boolean(baseline) && gainedAppCredential(
+    { cookies: baseline.cookies, origins: baseline.origins.map(({ sessionStorage: _s, ...rest }) => rest) },
+    { cookies: state2.cookies, origins: state2.origins.map(({ sessionStorage: _s, ...rest }) => rest) },
+    target
+  );
+  let env;
+  const indexedDbByOrigin = /* @__PURE__ */ new Map();
+  let inFlight;
+  let queued;
+  let stopped = false;
+  const prove = opts.proveSignedIn ?? proveSignedInHeadless;
+  const aborts = new AbortController();
+  let proving;
+  let proven;
+  let tried;
+  const openUrls = () => context.pages().filter((open) => !open.isClosed()).map((open) => open.url());
+  const signedOut = () => {
+    submitted = false;
+    last = void 0;
+    lastDurable = false;
+    proven = void 0;
+  };
+  const snapshot = async (full) => {
+    if (baseline && openUrls().some((url) => isSignInStep(url, target))) {
+      return;
+    }
+    const state2 = await readState(context, (url) => isOnAppPastSignIn(url, target), full);
+    if (full) {
+      for (const origin of state2.origins) if (origin.indexedDB) indexedDbByOrigin.set(origin.origin, origin.indexedDB);
+    } else {
+      for (const [origin, databases] of indexedDbByOrigin) {
+        const entry = state2.origins.find((candidate) => candidate.origin === origin);
+        if (entry) entry.indexedDB = databases;
+        else state2.origins.push({ origin, localStorage: [], indexedDB: databases });
+      }
+    }
+    if (!env) env = await readEnv(context).catch(() => void 0);
+    if (!baseline) {
+      baseline = state2;
+      beforeSubmit = state2;
+      return;
+    }
+    const openPageUrls = openUrls();
+    if (openPageUrls.some((url) => isSignOutPage(url))) signedOut();
+    if (last && lastDurable && !durableCredential(state2)) signedOut();
+    if (!submitted) beforeSubmit = state2;
+    if (looksSignedIn({ openPageUrls, submitted, baseline, current: state2 }, target)) {
+      const candidate = {
+        capture: toCapture(state2, env),
+        pageUrl: openPageUrls.find((url) => isOnAppPastSignIn(url, target)) ?? target.toString(),
+        ...beforeSubmit ? { signedOut: JSON.stringify(beforeSubmit) } : {}
+      };
+      last = candidate;
+      lastDurable = durableCredential(state2);
+      const key = `${candidate.pageUrl}\0${candidate.capture.storageState}`;
+      if (!announced && !proving && !stopped && !aborts.signal.aborted && tried?.key !== key && (!tried || now() - tried.at >= PROVE_RETRY_MS)) {
+        tried = { key, at: now() };
+        proving = prove(candidate.capture, candidate.pageUrl, target, { signal: aborts.signal, signedOut: candidate.signedOut }).catch(() => false).then((ok) => {
+          proving = void 0;
+          if (!ok || stopped || last === void 0) return;
+          proven = candidate;
+          if (!announced) {
+            announced = true;
+            opts.onLooksSignedIn?.();
+          }
+        });
+      }
+    }
+  };
+  const take = (full = true) => {
+    if (stopped) return;
+    if (inFlight) {
+      queued = queued === "full" || full ? "full" : "light";
+      return;
+    }
+    inFlight = snapshot(full).catch(() => {
+    }).finally(() => {
+      inFlight = void 0;
+      const next = queued;
+      queued = void 0;
+      if (next && !stopped) take(next === "full");
+    });
+  };
+  const watch = (page) => {
+    page.on("framenavigated", (frame) => {
+      if (frame !== page.mainFrame()) return;
+      if (isSignOutPage(page.url())) signedOut();
+      take();
+    });
+    page.on("load", () => take());
+  };
+  context.pages().forEach(watch);
+  context.on("page", watch);
+  context.on("request", (request) => {
+    try {
+      const frame = request.frame();
+      if (frame.parentFrame()) return;
+      const sent = { method: request.method(), resourceType: request.resourceType(), url: request.url(), pageUrl: frame.url() };
+      if (isSignOutRequest(sent, target)) signedOut();
+      else if (baseline && isSignInSubmission(sent, target)) submitted = true;
+    } catch {
+    }
+  });
+  const timer = setInterval(() => take(false), opts.snapshotIntervalMs ?? SIGN_IN_SNAPSHOT_INTERVAL_MS);
+  timer.unref?.();
+  take();
+  return {
+    take,
+    // Wait (briefly) for the read in flight and the one queued behind it, then for a proof in flight
+    // (the prover has its own time limits; stop() aborts it).
+    settle: async () => {
+      const deadline = now() + 5e3;
+      while (inFlight && now() < deadline) {
+        await Promise.race([inFlight, new Promise((resolve3) => setTimeout(resolve3, 250))]);
+      }
+      if (proving) await Promise.race([proving, new Promise((resolve3) => aborts.signal.aborted ? resolve3() : aborts.signal.addEventListener("abort", () => resolve3(), { once: true }))]);
+    },
+    stop: () => {
+      stopped = true;
+      clearInterval(timer);
+      aborts.abort();
+    },
+    // Ends a background proof (and starts none): the close path proves the last state itself.
+    abortProof: () => aborts.abort(),
+    lastSignedIn: () => last,
+    proven: () => proven
+  };
+}
+async function captureFromBrowser(browser, target, ready, timeoutMs, opts = {}) {
   let context;
+  let watcher;
   try {
     context = await browser.newContext({ viewport: null });
     const page = await context.newPage();
     await page.goto(target.toString(), { waitUntil: "domcontentloaded" });
-    await readyUnlessClosed(ready, whenWindowClosed(browser, context), timeoutMs);
-    const state2 = await context.storageState({ indexedDB: true });
-    for (const open of context.pages()) {
-      let origin;
+    watcher = watchSignIn(context, target, opts);
+    try {
+      await readyUnlessClosed(ready, whenWindowClosed(browser, context), timeoutMs);
+    } catch (error) {
+      const name = error instanceof Error ? error.name : "";
+      if (name !== "TargetClosedError" && name !== "SignInTimeoutError") throw error;
+      watcher.abortProof();
+      watcher.take();
+      await watcher.settle();
+      watcher.stop();
+      const saved = watcher.lastSignedIn();
+      const earlier = watcher.proven();
+      if (!saved) throw error;
+      const prove = opts.proveSignedIn ?? proveSignedInHeadless;
+      const pages = [.../* @__PURE__ */ new Set([saved.pageUrl, ...earlier ? [earlier.pageUrl] : []])];
+      const bound = new AbortController();
+      const timer = setTimeout(() => bound.abort(), opts.closeProveDeadlineMs ?? CLOSE_PROVE_DEADLINE_MS);
+      timer.unref?.();
       try {
-        origin = new URL(open.url()).origin;
-      } catch {
-        continue;
-      }
-      const entries = await open.evaluate(() => {
-        const out = [];
-        for (let i = 0; i < window.sessionStorage.length; i += 1) {
-          const name = window.sessionStorage.key(i);
-          if (name !== null) out.push({ name, value: window.sessionStorage.getItem(name) ?? "" });
+        for (const pageUrl of pages) {
+          if (bound.signal.aborted) break;
+          const ended = new Promise((resolve3) => bound.signal.addEventListener("abort", () => resolve3(false), { once: true }));
+          if (await Promise.race([prove(saved.capture, pageUrl, target, { signal: bound.signal, signedOut: saved.signedOut }).catch(() => false), ended])) {
+            return { ...saved.capture, savedWithoutEnter: true };
+          }
         }
-        return out;
-      }).catch(() => []);
-      if (entries.length === 0) continue;
-      const entry = state2.origins.find((candidate) => candidate.origin === origin);
-      if (entry) entry.sessionStorage = entries;
-      else state2.origins.push({ origin, localStorage: [], sessionStorage: entries });
-    }
-    const page0 = context.pages()[0];
-    const env = page0 ? await page0.evaluate(() => ({ ua: navigator.userAgent, locale: navigator.language, tz: Intl.DateTimeFormat().resolvedOptions().timeZone })) : { ua: "", locale: "", tz: "" };
-    return { storageState: JSON.stringify(state2), userAgent: env.ua, locale: env.locale, timezoneId: env.tz };
+      } finally {
+        clearTimeout(timer);
+      }
+      throw error;
+    }
+    watcher.stop();
+    await watcher.settle();
+    try {
+      return toCapture(await readState(context), await readEnv(context));
+    } catch (error) {
+      const saved = watcher.lastSignedIn();
+      if (saved) return saved.capture;
+      throw error;
+    }
   } finally {
+    watcher?.stop();
     await context?.close().catch(() => {
     });
     await browser.close().catch(() => {
     });
   }
 }
+function provenByProbe(signedIn, signedOut, target, anonymous) {
+  if (isSignInStep(signedIn.url, target) || signedIn.offersSignIn) return false;
+  const signedOutThere = (side) => isLoginStep(side.url, target) || side.offersSignIn;
+  return signedOutThere(signedOut) && (anonymous === void 0 || signedOutThere(anonymous));
+}
+var OFFERS_SIGN_IN = `(() => {
+  const shown = (el) => { const box = el.getBoundingClientRect(); return box.width > 0 && box.height > 0; };
+  if ([...document.querySelectorAll('input[type="password"]')].some(shown)) return true;
+  return [...document.querySelectorAll('a, button, [role="button"]')].some((el) => shown(el) && /^\\s*(log ?in|sign ?in|sign in with .+|continue with google)\\s*$/i.test(el.innerText || ''));
+})()`;
+var chromeChannelMissing = false;
+async function launchProver() {
+  if (!chromeChannelMissing) {
+    try {
+      return await chromium.launch({ headless: true, channel: "chrome", env: (0, import_browser_config3.browserLaunchEnv)() });
+    } catch {
+      chromeChannelMissing = true;
+    }
+  }
+  return chromium.launch({ headless: true, env: (0, import_browser_config3.browserLaunchEnv)() });
+}
+async function proveSignedInHeadless(capture, pageUrl, target, options = {}) {
+  const ended = new AbortController();
+  const end = () => ended.abort();
+  const timer = setTimeout(end, options.deadlineMs ?? PROVE_DEADLINE_MS);
+  timer.unref?.();
+  options.signal?.addEventListener("abort", end);
+  if (options.signal?.aborted) end();
+  const gone = new Promise((_resolve, reject) => {
+    if (ended.signal.aborted) reject(new Error("proof ended"));
+    else ended.signal.addEventListener("abort", () => reject(new Error("proof ended")), { once: true });
+  });
+  gone.catch(() => {
+  });
+  const live = (work) => Promise.race([work, gone]);
+  let launching;
+  try {
+    if (ended.signal.aborted) return false;
+    launching = (options.launch ?? launchProver)();
+    const browser = await live(launching);
+    const probe = async (storageState) => {
+      const context = await live(browser.newContext({ storageState, ...capture.userAgent ? { userAgent: capture.userAgent } : {} }));
+      try {
+        const page = await live(context.newPage());
+        await live(page.goto(pageUrl, { waitUntil: "domcontentloaded", timeout: 3e4 }));
+        await live(page.waitForLoadState("networkidle", { timeout: 5e3 }).catch(() => {
+        }));
+        const offersSignIn = await live(page.evaluate(OFFERS_SIGN_IN)) === true;
+        return { url: page.url(), offersSignIn };
+      } finally {
+        void context.close().catch(() => {
+        });
+      }
+    };
+    const forContext = (state2) => ({ cookies: state2.cookies, origins: state2.origins.map(({ origin, localStorage, indexedDB }) => ({ origin, localStorage, ...indexedDB ? { indexedDB } : {} })) });
+    const after = JSON.parse(capture.storageState);
+    const signedIn = await probe(forContext(after));
+    if (isSignInStep(signedIn.url, target) || signedIn.offersSignIn) return false;
+    const before = options.signedOut ? JSON.parse(options.signedOut) : { cookies: [], origins: [] };
+    const asIs = options.signedOut && !credentialsKeptAcrossSignIn(before, after, target) ? before : void 0;
+    const [signedOut, anonymous] = await Promise.all([
+      probe(forContext(withoutCredentials(before, target))),
+      asIs ? probe(forContext(asIs)) : Promise.resolve(void 0)
+    ]);
+    return provenByProbe(signedIn, signedOut, target, anonymous);
+  } catch {
+    return false;
+  } finally {
+    clearTimeout(timer);
+    options.signal?.removeEventListener("abort", end);
+    end();
+    if (launching) {
+      const browser = await Promise.race([launching.catch(() => void 0), new Promise((resolve3) => setTimeout(resolve3, 1e3))]);
+      if (browser) await Promise.race([browser.close().catch(() => {
+      }), new Promise((resolve3) => setTimeout(resolve3, 5e3))]);
+      else void launching.then((late) => late.close()).catch(() => {
+      });
+    }
+  }
+}
 function whenWindowClosed(browser, context) {
   return new Promise((resolve3) => {
     const watch = (page) => {
@@ -13940,7 +14777,22 @@ function closedTargetError() {
   error.name = "TargetClosedError";
   return error;
 }
+var LIVE_SIGN_IN_KEPT_NOTICE = "A sign-in is already saved for this project, and this one was not confirmed with Enter (the window was closed or timed out), so the saved one was kept and nothing was replaced. To replace it, run sign-in again and press Enter once you are signed in.";
 async function uploadSignInCapture(input) {
+  if (!input.capture.savedWithoutEnter) {
+    const sent = await postCapture(input, true);
+    return sent === "live_sign_in_exists" ? { ok: false, message: LIVE_SIGN_IN_KEPT_NOTICE } : sent;
+  }
+  const first = await postCapture(input, false);
+  if (first !== "live_sign_in_exists") return first;
+  if (!input.confirmReplace) return { ok: false, message: LIVE_SIGN_IN_KEPT_NOTICE };
+  if (!await input.confirmReplace().catch(() => false)) {
+    return { ok: true, kept: true, message: "Kept the sign-in already saved. The one from this window was not uploaded." };
+  }
+  const replaced = await postCapture(input, true);
+  return replaced === "live_sign_in_exists" ? { ok: false, message: LIVE_SIGN_IN_KEPT_NOTICE } : replaced;
+}
+async function postCapture(input, replace) {
   const doFetch = input.fetchImpl ?? fetch;
   try {
     const res = await doFetch(`${input.serverUrl.replace(/\/+$/, "")}/api/runner/saved-sign-in/capture`, {
@@ -13953,14 +14805,21 @@ async function uploadSignInCapture(input) {
         storageState: input.capture.storageState,
         userAgent: input.capture.userAgent,
         locale: input.capture.locale,
-        timezoneId: input.capture.timezoneId
+        timezoneId: input.capture.timezoneId,
+        // Only for a save without Enter: a save after Enter is sent exactly as before.
+        ...replace ? {} : { replaceExisting: false }
       }),
       signal: AbortSignal.timeout(6e4)
     });
     const body = await res.json().catch(() => ({}));
+    if (!replace && res.status === 409 && body.reason === "live_sign_in_exists") return "live_sign_in_exists";
     if (res.ok) return { ok: true, message: "Sign-in saved. Surveys and tests for this project will run signed in." };
     if (res.status === 403) return { ok: false, message: body.error ?? "Only project admins can save a sign-in." };
-    if (res.status === 422) return { ok: false, message: "The browser was not signed in to your app (nothing of the app was found). Sign in, then try again." };
+    if (res.status === 422) {
+      if (typeof body.error === "string" && body.error.trim()) return { ok: false, message: `The sign-in was not saved: ${body.error.trim()}.` };
+      return { ok: false, message: "The browser was not signed in to your app (nothing of the app was found). Sign in, then try again." };
+    }
+    if (res.status === 413) return { ok: false, message: "The sign-in is too large to save (the server takes up to 4 MB). Sign in with fewer tabs open, or clear unrelated site data, then try again." };
     return { ok: false, message: `Could not save the sign-in (HTTP ${res.status}${body.error ? `: ${body.error}` : ""}).` };
   } catch {
     return { ok: false, message: "Could not reach the validate.qa server to save the sign-in." };
@@ -14026,6 +14885,43 @@ function shownAddress(url) {
   return oneLine.replace(/^([a-z][a-z0-9+.-]*:\/\/)?\S*@/i, "$1");
 }
 
+// src/sign-in-url.ts
+var OPENABLE_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);
+var SIGN_IN_URL_HINT = "--url must be a full address starting with http:// or https://, e.g. https://app.example.com/login or http://localhost:3000.";
+function signInUrlProblem(raw) {
+  try {
+    const url = new URL(raw);
+    if (OPENABLE_PROTOCOLS.has(url.protocol) && url.hostname) return null;
+  } catch {
+  }
+  return SIGN_IN_URL_HINT;
+}
+
+// src/no-credentials-help.ts
+var RUNNER_TOKEN_SOURCE = "Project Settings \u2192 Local Runner \u2192 Generate Token (urt_...)";
+function noSignInCredentialsMessage() {
+  return [
+    "\u2717  No runner credentials on this machine yet.",
+    `   Get a runner token (urt_...) in validate.qa: ${RUNNER_TOKEN_SOURCE}.`,
+    "   Then either:",
+    "     \u2022 sign in in one go:  npx @validate.qa/runner sign-in --url <your-app> --token <urt_...> --server <url> --project <id>",
+    "     \u2022 or log in once (paste the token at its prompt, which keeps it out of shell history), then sign in:",
+    "         npx @validate.qa/runner login --server <url>"
+  ].join("\n");
+}
+function noStartTokenMessage() {
+  return [
+    "\u2717  No runner token.",
+    "",
+    "Steps:",
+    `  1. In validate.qa: ${RUNNER_TOKEN_SOURCE}`,
+    "  2. npx @validate.qa/runner login --server <url>   (the server URL printed above or from the dashboard;",
+    "     paste the token at its prompt, which keeps it out of shell history)",
+    "",
+    "   Or pass --token and --server flags to this start command."
+  ].join("\n");
+}
+
 // src/supervisor-child-argv.ts
 function stripRunnerTokenFromArgv(argv) {
   const out = [];
@@ -14064,23 +14960,48 @@ program.name("validate-runner").description("validate.qa local test runner - exe
 async function requireLatestRunner() {
   await enforceRunnerUpToDate(pkg.version);
 }
-program.command("login").description("Save runner credentials for future use").requiredOption("--token <token>", "Runner token (urt_... from validate.qa dashboard)").requiredOption("--server <url>", "validate.qa server URL").option("--project <id>", "Project ID (from dashboard URL)").action(async (opts) => {
+program.command("login").description("Save runner credentials for future use").option("--token <token>", "Runner token (urt_... from validate.qa dashboard). Leave it out to paste it at a prompt that does not show it, or pipe it on stdin: on the command line it lands in shell history").requiredOption("--server <url>", "validate.qa server URL").option("--project <id>", "Project ID (from dashboard URL)").action(async (opts) => {
   await requireLatestRunner();
   const serverUrl = opts.server.replace(/\/+$/, "");
-  const shapeProblem = runnerTokenShapeProblem(opts.token);
+  const urlProblem = loginServerUrlProblem(serverUrl);
+  if (urlProblem) {
+    console.error(`\u2717  ${urlProblem}`);
+    process.exit(1);
+  }
+  let resolved;
+  try {
+    resolved = await resolveLoginToken({
+      flag: opts.token,
+      stdinIsTTY: process.stdin.isTTY === true,
+      readPiped: () => readPipedToken(process.stdin),
+      promptHidden: (question) => promptHidden(process.stdin, process.stdout, question)
+    });
+  } catch (err) {
+    console.error(`\u2717  No runner token: ${err instanceof Error ? err.message : String(err)}`);
+    process.exit(1);
+  }
+  if ("error" in resolved) {
+    console.error(`\u2717  ${resolved.error}`);
+    process.exit(1);
+  }
+  const token = resolved.token;
+  const shapeProblem = runnerTokenShapeProblem(token);
   if (shapeProblem) {
     console.error(`\u2717  ${shapeProblem}`);
     process.exit(1);
   }
+  if (sendsTokenInPlaintext(serverUrl)) {
+    console.warn("\u26A0  WARNING: Server URL uses HTTP, not HTTPS. Runner token will be sent in plaintext.");
+  }
   console.log(`Testing connection to ${serverUrl}...`);
-  const check2 = await checkRunnerLogin(serverUrl, opts.token);
+  const check2 = await checkRunnerLogin(serverUrl, token);
   if (!check2.ok) {
     console.error(`\u2717  ${check2.message}`);
     process.exit(1);
   }
   console.log("\u2713  Connected successfully");
   saveCredentials({
-    token: opts.token,
+    token,
     serverUrl,
     projectId: opts.project
   });
@@ -14165,17 +15086,10 @@ program.command("start").description("Start the local test runner").option("--to
   }
   await requireLatestRunner();
   const saved = loadCredentials();
-  const authToken = opts.token || process.env.AUTH_TOKEN || saved?.token;
-  const serverUrl = (opts.server || process.env.SERVER_URL || saved?.serverUrl)?.replace(/\/+$/, "");
-  const projectId = opts.project || process.env.PROJECT_ID || saved?.projectId;
+  const { authToken, serverUrl, projectId, savedLoginSkipped } = resolveCredentials(opts, process.env, saved);
   if (!authToken) {
-    console.error("\u2717  No runner token.");
-    console.error("");
-    console.error("Steps:");
-    console.error("  1. In validate.qa UI: Project Settings \u2192 Local Runner \u2192 Generate Token (urt_...)");
-    console.error("  2. npx @validate.qa/runner login --token <urt_...> --server <the-server-url-printed-above-or-from-dashboard>");
-    console.error("");
-    console.error("   Or pass --token and --server flags to this start command.");
+    if (savedLoginSkipped) console.error(`\u2717  The saved login is for ${saved?.serverUrl}, not ${serverUrl}: its token is not sent to another server.`);
+    console.error(noStartTokenMessage());
     process.exit(EXIT_TERMINAL);
   }
   if (!serverUrl) {
@@ -14183,12 +15097,19 @@ program.command("start").description("Start the local test runner").option("--to
     console.error("   Or pass --server <url> to this command");
     process.exit(EXIT_TERMINAL);
   }
+  {
+    const urlProblem = loginServerUrlProblem(serverUrl, opts.server ? "--server" : "The server URL");
+    if (urlProblem) {
+      console.error(`\u2717  ${urlProblem}`);
+      process.exit(EXIT_TERMINAL);
+    }
+  }
   const isPersonalToken = authToken.startsWith("urt_");
   if (!projectId && !isPersonalToken) {
     console.error("\u2717  No project ID. Pass --project <id> or set PROJECT_ID env var");
     process.exit(EXIT_TERMINAL);
   }
-  if (serverUrl.startsWith("http://") && !serverUrl.includes("localhost") && !serverUrl.includes("127.0.0.1")) {
+  if (sendsTokenInPlaintext(serverUrl)) {
     console.warn("\u26A0  WARNING: Server URL uses HTTP, not HTTPS. Runner token will be sent in plaintext.");
     console.warn("   Consider using an HTTPS URL to protect credentials in transit.");
   }
@@ -14207,7 +15128,14 @@ program.command("start").description("Start the local test runner").option("--to
     console.warn("\u26A0  --tunnel has no effect without --mobile (the mobile bridge it exposes only starts with --mobile). Ignoring --tunnel.");
   }
   {
-    const { hasLocalGoogleLogin, GOOGLE_LOGIN_COMMAND } = await import("./dist-52M5RDZ6.mjs");
+    const serverProblem = startServerProblem(await checkRunnerLogin(serverUrl, authToken), serverUrl);
+    if (serverProblem) {
+      console.error(`\u2717  ${serverProblem}`);
+      process.exit(EXIT_TERMINAL);
+    }
+  }
+  {
+    const { hasLocalGoogleLogin, GOOGLE_LOGIN_COMMAND } = await import("./dist-BXHLIG5H.mjs");
     if (process.stdout.isTTY && !await hasLocalGoogleLogin()) {
       console.log(`Tip: for apps with "Continue with Google", sign in to Google once on this machine: ${GOOGLE_LOGIN_COMMAND}`);
     }
@@ -14237,7 +15165,7 @@ async function askLine(question) {
   }
 }
 program.command("google-login").description('Sign in to a TEST Google account once on this machine, for tests of apps with "Continue with Google"').option("--site <url...>", "The app address(es) this sign-in may be used for, e.g. https://app.example.com").option("--allow-file-storage", "Keep the sign-in in a plain file (only you can read it) when the system keychain is not available").option("--yes", "Confirm without asking that this is a dedicated test Google account").action(async (opts) => {
-  const { signInLocalGoogle, LOCAL_GOOGLE_WARNING, grantedSite, defaultStoreKind } = await import("./dist-52M5RDZ6.mjs");
+  const { signInLocalGoogle, LOCAL_GOOGLE_WARNING, grantedSite, defaultStoreKind } = await import("./dist-BXHLIG5H.mjs");
   console.log(LOCAL_GOOGLE_WARNING);
   if (!opts.yes) {
     const answer = await askLine('Is this a dedicated test Google account? Type "yes" to continue: ');
@@ -14272,7 +15200,7 @@ program.command("google-login").description('Sign in to a TEST Google account on
   }
 });
 program.command("google-allow-site <url>").description("Let the Google sign-in on this machine be used for one more app address").action(async (url) => {
-  const { allowLocalGoogleSites, grantedSite } = await import("./dist-52M5RDZ6.mjs");
+  const { allowLocalGoogleSites, grantedSite } = await import("./dist-BXHLIG5H.mjs");
   const site = grantedSite(url);
   if (!site) {
     console.error("\u2717  Not a web address: give it like https://app.example.com");
@@ -14286,17 +15214,26 @@ program.command("google-allow-site <url>").description("Let the Google sign-in o
   console.log(`\u2713  Tests on this machine may now use the Google sign-in for: ${sites.join(", ")}`);
 });
 program.command("google-logout").description("Forget the Google sign-in saved on this machine").action(async () => {
-  const { deleteLocalGoogleLogin } = await import("./dist-52M5RDZ6.mjs");
+  const { deleteLocalGoogleLogin } = await import("./dist-BXHLIG5H.mjs");
   await deleteLocalGoogleLogin();
   console.log("\u2713  Google sign-in removed from this machine");
 });
 program.command("sign-in").description("Sign in to your app once in a browser window; surveys and tests then run signed in").requiredOption("--url <url>", "Your app's sign-in page or home page").option("--token <token>", "Runner token (overrides saved credentials)").option("--server <url>", "validate.qa server URL (overrides saved credentials)").option("--project <id>", "Project ID (overrides saved credentials)").action(async (opts) => {
   const saved = loadCredentials();
-  const token = opts.token || process.env.AUTH_TOKEN || saved?.token;
-  const serverUrl = (opts.server || process.env.SERVER_URL || saved?.serverUrl)?.replace(/\/+$/, "");
-  const projectId = opts.project || process.env.PROJECT_ID || saved?.projectId;
+  const { authToken: token, serverUrl, projectId, savedLoginSkipped } = resolveCredentials(opts, process.env, saved);
   if (!token || !serverUrl) {
-    console.error("\u2717  No runner credentials. Run: npx @validate.qa/runner login --token <urt_...> --server <url>");
+    if (savedLoginSkipped) console.error(`\u2717  The saved login is for ${saved?.serverUrl}, not ${serverUrl}: pass --token for that server.`);
+    console.error(noSignInCredentialsMessage());
+    process.exit(1);
+  }
+  const serverUrlProblem = loginServerUrlProblem(serverUrl, opts.server ? "--server" : "The server URL");
+  if (serverUrlProblem) {
+    console.error(`\u2717  ${serverUrlProblem}`);
+    process.exit(1);
+  }
+  const urlProblem = signInUrlProblem(opts.url);
+  if (urlProblem) {
+    console.error(`\u2717  ${urlProblem}`);
     process.exit(1);
   }
   let appUrl;
@@ -14304,7 +15241,7 @@ program.command("sign-in").description("Sign in to your app once in a browser wi
   try {
     appUrl = new URL(opts.url);
     console.log(`Opening ${appUrl.origin} in a browser window.`);
-    console.log("Sign in to your app there with a test account. Then come back here and press Enter.");
+    console.log("Sign in to your app there with a test account. Then press Enter here, or just close the window.");
     capture = await captureSignInInteractively(appUrl.toString(), async (signal) => {
       const rl = createInterface({ input: process.stdin, output: process.stdout });
       try {
@@ -14315,6 +15252,9 @@ program.command("sign-in").description("Sign in to your app once in a browser wi
       } finally {
         rl.close();
       }
+    }, {
+      // Once: the prompt's line is still open, so the notice gets its own line.
+      onLooksSignedIn: () => process.stdout.write("\n\u2713 Looks like you're signed in. You can press Enter or just close the window.\n")
     });
   } catch (error) {
     const message = describeSignInFailure(error, opts.url);
@@ -14327,43 +15267,23 @@ program.command("sign-in").description("Sign in to your app once in a browser wi
     token,
     projectId,
     label: `Signed in on ${appUrl.hostname}`,
-    capture
+    capture,
+    // Asked only for a save without Enter that meets a saved sign-in; no terminal keeps the saved one.
+    ...process.stdin.isTTY ? {
+      confirmReplace: async () => /^y(es)?$/i.test(await askLine("A sign-in is already saved for this project. Replace it with the one from this window? [y/N] "))
+    } : {}
   });
-  console.log(result.ok ? `\u2713  ${result.message}` : `\u2717  ${result.message}`);
+  console.log(result.kept ? `\u2139  ${result.message}` : result.ok ? `\u2713  ${result.message}` : `\u2717  ${result.message}`);
   process.exit(result.ok ? 0 : 1);
 });
-program.command("status").description("Check connection to validate.qa server").action(async () => {
+program.command("status").description("Check connection to validate.qa server, with the credentials start would use").option("--token <token>", "Runner token (overrides AUTH_TOKEN and saved credentials)").option("--server <url>", "Server URL (overrides SERVER_URL and saved credentials)").option("--project <id>", "Project ID (overrides PROJECT_ID and saved credentials)").action(async (opts) => {
   await requireLatestRunner();
-  const saved = loadCredentials();
-  if (!saved) {
-    console.log("No saved credentials. Run: validate-runner login");
-    return;
-  }
-  console.log(`Server:  ${saved.serverUrl}`);
-  console.log(`Project: ${saved.projectId || "(not set)"}`);
-  console.log(`Token:   ${saved.token.slice(0, 8)}...${saved.token.slice(-4)}`);
-  console.log("");
-  try {
-    const res = await fetch(`${saved.serverUrl}/api/runner/health`, {
-      headers: {
-        Authorization: `Bearer ${saved.token}`,
-        ...saved.projectId ? { "X-Project-Id": saved.projectId } : {}
-      }
-    });
-    if (res.ok) {
-      const data = await res.json();
-      console.log(`\u2713  Server reachable - runner status: ${data.status} (${data.runners} runner(s) online)`);
-    } else {
-      console.log(`\u26A0  Server returned ${res.status}`);
-    }
-  } catch {
-    console.error("\u2717  Could not reach server");
-  }
+  process.exitCode = await runStatusCheck(resolveStatusCredentials(opts, process.env, loadCredentials()));
 });
-program.command("doctor").description("Check prerequisites for web and mobile testing").action(() => {
+program.command("doctor").description("Check prerequisites for web testing (and mobile testing with --mobile)").option("--mobile", "Also require a complete iOS or Android toolchain (exit 1 without one)").action((opts) => {
   const report = runDoctor();
-  printDoctorReport(report);
-  process.exit(report.allPassed ? 0 : 1);
+  printDoctorReport(report, { mobile: opts.mobile === true });
+  process.exit(doctorExitCode(report, { mobile: opts.mobile === true }));
 });
 program.command("setup-mobile").description("Install Appium and the iOS (XCUITest) + Android (UiAutomator2) drivers").action(async () => {
   const { spawn: spawn2 } = await import("child_process");