@validate.qa/runner 1.0.16 → 1.0.18

package/dist/cli.js

@@ -1023,6 +1023,10 @@ var require_mobile_source_parser = __commonJS({
       }
       return fnv1a(parts.join("\n"));
     }
+    var EDITABLE_CLASS_RE = /(EditText|AutoCompleteTextView|XCUIElementTypeTextField|XCUIElementTypeSecureTextField|XCUIElementTypeSearchField|XCUIElementTypeTextView)$/;
+    function isEditableElement(el) {
+      return EDITABLE_CLASS_RE.test(el.role.trim());
+    }
     function buildLocatorBundle(el, platform3) {
       const bundle = {
         xpath: el.xpath,
@@ -1032,7 +1036,7 @@ var require_mobile_source_parser = __commonJS({
         bundle.accessibilityId = el.accessibilityId;
       if (platform3 === "ANDROID" && el.resourceId)
         bundle.resourceId = el.resourceId;
-      if (el.text)
+      if (el.text && !isEditableElement(el))
         bundle.text = el.text;
       if (platform3 === "ANDROID" && el.accessibilityId)
         bundle.contentDesc = el.accessibilityId;
@@ -1043,7 +1047,7 @@ var require_mobile_source_parser = __commonJS({
         return el.accessibilityId;
       if (el.resourceId)
         return el.resourceId;
-      if (el.text)
+      if (el.text && !isEditableElement(el))
         return el.text;
       return el.xpath;
     }
@@ -1363,6 +1367,31 @@ function toInlineCommentText(value) {
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function isEditableMobileClassName(className) {
+  if (!className)
+    return false;
+  return /(EditText|AutoCompleteTextView|XCUIElementTypeTextField|XCUIElementTypeSecureTextField|XCUIElementTypeSearchField|XCUIElementTypeTextView)$/.test(className.trim());
+}
+function mobileCredentialPlaceholder(key) {
+  return `{{${key}}}`;
+}
+function resolveMobileStepValuePlaceholders(steps, variables) {
+  const missing = /* @__PURE__ */ new Set();
+  const vars = variables ?? {};
+  const resolved = steps.map((step) => {
+    if (typeof step.value !== "string" || !step.value.includes("{{"))
+      return step;
+    const value = step.value.replace(MOBILE_VALUE_PLACEHOLDER_RE, (token, key) => {
+      const substitute = vars[key];
+      if (typeof substitute === "string" && substitute.length > 0)
+        return substitute;
+      missing.add(key);
+      return token;
+    });
+    return value === step.value ? step : { ...step, value };
+  });
+  return { steps: resolved, missingKeys: [...missing] };
+}
 function readMobileMetadata(value) {
   if (!isPlainObject(value)) {
     return { screenName: "UnknownScreen" };
@@ -1404,7 +1433,11 @@ function buildStepTarget(metadata, selector) {
   const primary = nonEmpty(locatorBundle.accessibilityId) ?? nonEmpty(locatorBundle.resourceId) ?? trimmedSelector ?? nonEmpty(locatorBundle.xpath) ?? locatorBundle.xpath;
   const fallbackCandidates = [
     locatorBundle.resourceId,
-    locatorBundle.text,
+    // For editable fields the text attribute IS the currently-typed value — a
+    // self-invalidating locator that only matches while the recorded text is
+    // still in the field (and it can leak typed input into locators). Static
+    // elements keep their text fallback.
+    isEditableMobileClassName(locatorBundle.className) ? void 0 : locatorBundle.text,
     locatorBundle.contentDesc,
     locatorBundle.xpath,
     selector
@@ -1835,7 +1868,7 @@ function isRunnableStep(step) {
       return false;
   }
 }
-var STEP_ACTION_BY_ACTION_TYPE;
+var STEP_ACTION_BY_ACTION_TYPE, MOBILE_VALUE_PLACEHOLDER_RE;
 var init_mobile_test_generation = __esm({
   "../shared/dist/mobile-test-generation.js"() {
     "use strict";
@@ -1853,6 +1886,103 @@ var init_mobile_test_generation = __esm({
       ASSERT_VISIBLE: "assertVisible",
       ASSERT_TEXT: "assertText"
     };
+    MOBILE_VALUE_PLACEHOLDER_RE = /\{\{([A-Za-z0-9_]+)\}\}/g;
+  }
+});
+
+// ../shared/dist/mobile-cross-platform.js
+function isMobilePlatform(value) {
+  return value === "IOS" || value === "ANDROID";
+}
+function mediumForMobilePlatform(platform3) {
+  return platform3 === "IOS" ? "IOS_NATIVE" : "ANDROID_NATIVE";
+}
+function mobilePlatformFromMedium(medium) {
+  if (medium === "IOS_NATIVE")
+    return "IOS";
+  if (medium === "ANDROID_NATIVE")
+    return "ANDROID";
+  return null;
+}
+function otherMobilePlatform(platform3) {
+  return platform3 === "IOS" ? "ANDROID" : "IOS";
+}
+function platformTag(platform3) {
+  return platform3 === "IOS" ? "@ios" : "@android";
+}
+function resolvePlatformLocatorBundle(target, platform3) {
+  if (!target)
+    return void 0;
+  if (platform3) {
+    const overlay = target.platformLocators?.[platform3];
+    if (overlay)
+      return overlay;
+  }
+  return target.locatorBundle;
+}
+function hasPlatformLocator(target, platform3) {
+  return Boolean(target?.platformLocators?.[platform3]);
+}
+function hasCrossPlatformIdentity(bundle) {
+  if (!bundle)
+    return false;
+  return Boolean(bundle.text?.trim() || bundle.contentDesc?.trim() || bundle.accessibilityId?.trim());
+}
+function stepIsDivergentForPlatform(step, platform3) {
+  return Array.isArray(step.crossPlatformDivergent) && step.crossPlatformDivergent.includes(platform3);
+}
+function stepAppliesToPlatform(step, platform3) {
+  const platforms = step.platforms;
+  if (!platforms || platforms.length === 0)
+    return true;
+  if (!platform3)
+    return true;
+  return platforms.includes(platform3);
+}
+function stepsMissingPlatformLocators(steps, platform3) {
+  return steps.filter((step) => {
+    if (!LOCATOR_REQUIRING_ACTIONS.has(step.action))
+      return false;
+    if (!stepAppliesToPlatform(step, platform3))
+      return false;
+    if (hasPlatformLocator(step.target, platform3))
+      return false;
+    if (stepIsDivergentForPlatform(step, platform3))
+      return false;
+    return hasCrossPlatformIdentity(step.target?.locatorBundle);
+  });
+}
+function stepsNeedingReviewForPlatform(steps, platform3) {
+  return steps.filter((step) => {
+    if (!LOCATOR_REQUIRING_ACTIONS.has(step.action))
+      return false;
+    if (!stepAppliesToPlatform(step, platform3))
+      return false;
+    if (hasPlatformLocator(step.target, platform3))
+      return false;
+    if (stepIsDivergentForPlatform(step, platform3))
+      return true;
+    return !hasCrossPlatformIdentity(step.target?.locatorBundle);
+  });
+}
+function isTestReadyForPlatform(steps, authoringPlatform, runPlatform) {
+  if (runPlatform === authoringPlatform)
+    return true;
+  return stepsMissingPlatformLocators(steps, runPlatform).length === 0 && stepsNeedingReviewForPlatform(steps, runPlatform).length === 0;
+}
+var MOBILE_PLATFORMS, LOCATOR_REQUIRING_ACTIONS;
+var init_mobile_cross_platform = __esm({
+  "../shared/dist/mobile-cross-platform.js"() {
+    "use strict";
+    MOBILE_PLATFORMS = ["IOS", "ANDROID"];
+    LOCATOR_REQUIRING_ACTIONS = /* @__PURE__ */ new Set([
+      "tap",
+      "type",
+      "clear",
+      "waitForElement",
+      "assertVisible",
+      "assertText"
+    ]);
   }
 });
 
@@ -3534,6 +3664,7 @@ __export(dist_exports, {
   MOBILE_DEFAULT_SWIPE_DISTANCE: () => MOBILE_DEFAULT_SWIPE_DISTANCE,
   MOBILE_FOCUS_SETTLE_MS: () => MOBILE_FOCUS_SETTLE_MS,
   MOBILE_MAX_SWIPE_DISTANCE: () => MOBILE_MAX_SWIPE_DISTANCE,
+  MOBILE_PLATFORMS: () => MOBILE_PLATFORMS,
   MOBILE_SCREENSHOT_INTERVAL_MS: () => MOBILE_SCREENSHOT_INTERVAL_MS,
   MOBILE_SNAPSHOT_MAX_SIZE_BYTES: () => MOBILE_SNAPSHOT_MAX_SIZE_BYTES,
   MOBILE_STEP_TYPES: () => MOBILE_STEP_TYPES,
@@ -3587,6 +3718,8 @@ __export(dist_exports, {
   getPlanDefinition: () => getPlanDefinition,
   getPlanLabel: () => getPlanLabel,
   getTrialDaysRemaining: () => getTrialDaysRemaining,
+  hasCrossPlatformIdentity: () => hasCrossPlatformIdentity,
+  hasPlatformLocator: () => hasPlatformLocator,
   hostOfOrigin: () => hostOfOrigin,
   isAddonType: () => isAddonType,
   isApiTest: () => isApiTest,
@@ -3595,24 +3728,38 @@ __export(dist_exports, {
   isCountedFailure: () => isCountedFailure,
   isCreditPackAmountCents: () => isCreditPackAmountCents,
   isDbPricingPlan: () => isDbPricingPlan,
+  isEditableMobileClassName: () => isEditableMobileClassName,
   isEnvironmentalError: () => isEnvironmentalError,
+  isMobilePlatform: () => isMobilePlatform,
   isPricingPlan: () => isPricingPlan,
   isRunnableStep: () => isRunnableStep,
   isSafeDeepLink: () => isSafeDeepLink,
   isSameRegistrableDomainHost: () => isSameRegistrableDomainHost,
+  isTestReadyForPlatform: () => isTestReadyForPlatform,
   isTrialExpired: () => isTrialExpired,
   isUIVariant: () => isUIVariant,
   isValidMobileAppId: () => isValidMobileAppId,
+  mediumForMobilePlatform: () => mediumForMobilePlatform,
+  mobileCredentialPlaceholder: () => mobileCredentialPlaceholder,
+  mobilePlatformFromMedium: () => mobilePlatformFromMedium,
   normalizeControlName: () => normalizeControlName,
+  otherMobilePlatform: () => otherMobilePlatform,
   parenDepthDelta: () => parenDepthDelta,
   planHasBillingPortal: () => planHasBillingPortal,
   planRequiresCheckout: () => planRequiresCheckout,
+  platformTag: () => platformTag,
   registrableDomain: () => registrableDomain,
   resolveCrossOriginConfigOverride: () => resolveCrossOriginConfigOverride,
+  resolveMobileStepValuePlaceholders: () => resolveMobileStepValuePlaceholders,
+  resolvePlatformLocatorBundle: () => resolvePlatformLocatorBundle,
   safeOrigin: () => safeOrigin,
   sanitizeTestVariables: () => sanitizeTestVariables,
   selectorCandidatesForStep: () => selectorCandidatesForStep,
   selectorForValue: () => selectorForValue,
+  stepAppliesToPlatform: () => stepAppliesToPlatform,
+  stepIsDivergentForPlatform: () => stepIsDivergentForPlatform,
+  stepsMissingPlatformLocators: () => stepsMissingPlatformLocators,
+  stepsNeedingReviewForPlatform: () => stepsNeedingReviewForPlatform,
   stripEnvironmentalPrefix: () => stripEnvironmentalPrefix,
   stripLoginScaffolding: () => stripLoginScaffolding,
   summarizeHealth: () => summarizeHealth,
@@ -3626,6 +3773,7 @@ var init_dist = __esm({
     init_types();
     init_constants();
     init_mobile_test_generation();
+    init_mobile_cross_platform();
     init_mobile_deeplink();
     init_plans();
     init_audit_pricing();
@@ -65462,6 +65610,7 @@ Return ONLY one valid JSON object matching the schema below. Do NOT include <thi
 6. Do NOT merge screens into one feature just because they serve a similar broader goal. Treat areas as separate features when the evidence shows separate primary navigation destinations (e.g. separate tab-bar items or drawer links), separate screen families for distinct entities, or different CRUD entities/forms. Keep screens together when they share one navigational area and operate on the same entity (e.g. a list screen, its filter/sort sheet, and its detail screen all belong together).
 7. Feature descriptions MUST reference actual element labels / accessibility-ids from the evidence
 8. Do NOT create standalone features for generic error / empty screens (network-error, permission-denied). If a feature screen is broken or crashes, keep it in its intended feature and note the failure in the description.
+9. COVER EVERY SCREEN: every explored screen except generic error / permission screens MUST appear in exactly one feature group's routes. Do not leave screens ungrouped \u2014 a screen the explorer reached is part of SOME feature. Attach an ambiguous screen to its most closely related feature and note the ambiguity in that feature's description. Sign-in / sign-up / forgot-password screens form an "Authentication" group even when they were only reached via links from other screens.
 
 ## Output JSON Schema
 {
@@ -65669,7 +65818,8 @@ ${context.appBrief.slice(0, 500)}`);
       sections.push(`## App Under Test
 ${targetBits.length > 0 ? targetBits.join(" ") : "native mobile app"}`);
       if (context.featureName) {
-        sections.push(`## Feature: ${context.featureName}`);
+        sections.push(`## Feature: ${context.featureName}
+SCOPE: this is a feature-focused deep run. Plan scenarios ONLY for the "${context.featureName}" feature \u2014 its screens, forms, and flows. Screens belonging to other features are navigation context / prerequisites only; do NOT plan scenarios whose primary goal exercises another feature.`);
       }
       const orderedScreens = targetAppScreens(graph, context.appId).sort((a, b) => a.firstSeenIteration - b.firstSeenIteration);
       const includedScreenIds = new Set(orderedScreens.map((state2) => state2.screenId));
@@ -66054,10 +66204,12 @@ var require_mobile_generator = __commonJS({
   "../runner-core/dist/services/mobile/mobile-generator.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.collapseRetryCycles = collapseRetryCycles;
     exports2.runMobileGeneratePhase = runMobileGeneratePhase;
     var crypto_1 = require("crypto");
     var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var ai_provider_js_1 = require_ai_provider();
+    var credential_tools_js_1 = require_credential_tools();
     var ai_queue_js_1 = require_ai_queue();
     var ai_retry_js_1 = require_ai_retry();
     var mobile_source_parser_js_1 = require_mobile_source_parser();
@@ -66179,6 +66331,24 @@ var require_mobile_generator = __commonJS({
         }
       }
     };
+    var MOBILE_FILL_CREDENTIAL_TOOL = {
+      type: "function",
+      function: {
+        name: "mobile_fill_credential",
+        description: 'Fill a stored credential VALUE into a text field. ALWAYS use this instead of mobile_type for ANY email/password/token/auth field. Pass the field ref (eN) and the variable KEY (e.g. "TEST_USER_EMAIL"); the runner types the real value on the device and the generated test stores a {{KEY}} placeholder \u2014 you never see the secret. Available keys are listed in the Test Credentials section of the system prompt.',
+        parameters: {
+          type: "object",
+          properties: {
+            ref: { type: "string", description: 'Text-field element ref from the latest mobile_snapshot, e.g. "e5".' },
+            credentialKey: {
+              type: "string",
+              description: 'The credential variable name (e.g. "TEST_USER_EMAIL", "TEST_USER_PASSWORD"). Must be one of the keys listed in the Test Credentials section of the prompt.'
+            }
+          },
+          required: ["ref", "credentialKey"]
+        }
+      }
+    };
     var FINISH_GENERATE_TOOL = {
       type: "function",
       function: {
@@ -66200,6 +66370,7 @@ var require_mobile_generator = __commonJS({
       MOBILE_TAP_TOOL,
       MOBILE_TYPE_TOOL,
       MOBILE_CLEAR_TOOL,
+      MOBILE_FILL_CREDENTIAL_TOOL,
       MOBILE_SWIPE_TOOL,
       MOBILE_BACK_TOOL,
       MOBILE_RELAUNCH_TOOL,
@@ -66278,6 +66449,24 @@ var require_mobile_generator = __commonJS({
 - Finish promptly once the outcome is proven: the instant the expected outcome is visible, assert it and call finish_generate. Do not keep exploring after the goal is proven.
 
 Max iterations: ${MAX_SCENARIO_ITERATIONS}. You will be warned near the end.`;
+    }
+    function buildGenerateCredentialPromptBlock(secrets) {
+      const keys = Object.keys(secrets).filter((k) => secrets[k] && secrets[k].length > 0);
+      if (keys.length === 0)
+        return "";
+      const keyList = keys.map((k) => `- \`${k}\``).join("\n");
+      return `
+
+## Test Credentials (values are HIDDEN from you)
+This app has stored login credentials under these keys:
+${keyList}
+
+When a scenario needs a signed-in session or fills a login/sign-up form, fill each credential field with \`mobile_fill_credential\`: pass the field ref and the KEY (e.g. \`{ ref: "e5", credentialKey: "TEST_USER_EMAIL" }\`). The runner types the real value on the device and the generated test stores a \`{{KEY}}\` placeholder that replay resolves \u2014 you never see, log, or echo the secret.
+
+SECURITY RULES:
+- NEVER call \`mobile_type\` with a real email, password, or token value \u2014 the runner will REJECT the call and you lose an iteration. Use \`mobile_fill_credential\` for every credential field.
+- For validation scenarios (wrong password, empty submit) you MAY \`mobile_type\` synthetic invalid values like "wrong@example.com" / "badpassword" \u2014 those are not real credentials and are allowed.
+- NEVER put credential values in test names, descriptions, or assert texts.`;
     }
     function buildScenarioKickoff(scenario) {
       const stepLines = scenario.steps.map((step, i) => `  ${i + 1}. ${step.action}${step.target ? ` (target: ${step.target})` : ""}${step.hint ? ` [hint: ${step.hint}]` : ""}`).join("\n");
@@ -66348,7 +66537,7 @@ Start by calling mobile_snapshot, then execute the steps above \u2014 the minimu
       }
     }
     async function runScenarioLoop(args) {
-      const { scenario, driver, platform: platform3, maxIterations, agentModel, provider, aiClient, auditGroupId, onAICall, onScreenshot, targetAppId, log: log2 } = args;
+      const { scenario, driver, platform: platform3, maxIterations, agentModel, provider, aiClient, auditGroupId, onAICall, onScreenshot, targetAppId, credentials, log: log2 } = args;
       const actions = [];
       let assertCount = 0;
       let finish = null;
@@ -66465,7 +66654,7 @@ Start by calling mobile_snapshot, then execute the steps above \u2014 the minimu
       } catch (err) {
         log2(`  seed snapshot failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
       }
-      const systemPrompt = buildSystemPrompt(platform3, targetAppId);
+      const systemPrompt = buildSystemPrompt(platform3, targetAppId) + buildGenerateCredentialPromptBlock(credentials);
       const kickoff = buildScenarioKickoff(scenario);
       const recentExchanges = [];
       let iteration = 0;
@@ -66578,6 +66767,7 @@ ${statePacket}` },
               latest: getLatest,
               absorbObservation,
               resolveRef,
+              credentials,
               screenName: () => lastScreenName || "UnknownScreen",
               recordAction: (action) => {
                 actions.push(finalizeAction(action));
@@ -66599,7 +66789,7 @@ ${statePacket}` },
       return { actions, assertCount, finish, lastSnapshot: getLatest(), lastScreenName };
     }
     async function dispatchGenerateTool(args) {
-      const { toolName, toolArgs, driver, platform: platform3, latest, absorbObservation, resolveRef, screenName, recordAction, log: log2 } = args;
+      const { toolName, toolArgs, driver, platform: platform3, latest, absorbObservation, resolveRef, credentials, screenName, recordAction, log: log2 } = args;
       const unknownRef = (ref) => ({
         ok: false,
         error: `Unknown element ref "${String(ref)}". Call mobile_snapshot first; refs are only valid for the latest snapshot.`
@@ -66665,6 +66855,14 @@ ${statePacket}` },
           if (!element)
             return unknownRef(toolArgs.ref);
           const value = typeof toolArgs.value === "string" ? toolArgs.value : String(toolArgs.value ?? "");
+          for (const [key, secret] of Object.entries(credentials)) {
+            if (secret && secret.length >= 4 && value.includes(secret)) {
+              return {
+                ok: false,
+                error: `BLOCKED: mobile_type contained the stored credential value for "${key}". Use mobile_fill_credential({ ref, credentialKey: "${key}" }) instead of typing the credential directly.`
+              };
+            }
+          }
           const beforeScreenName = screenName();
           const result = await driver.type(value, element.bounds);
           const absorbed = await absorbObservation(result.source, result.screenSignal, latest()?.screen.windowSize ?? null, result.screenshot, "mobile_type");
@@ -66678,6 +66876,37 @@ ${statePacket}` },
           }
           return actionPayload(result, absorbed);
         }
+        // KEY-based credential fill: type the real value on-device, persist only a
+        // {{KEY}} placeholder in the recorded step (replay resolves it against the
+        // run's current test variables). The tool result echoes the KEY, never the
+        // value, so the secret cannot enter the transcript.
+        case "mobile_fill_credential": {
+          const key = typeof toolArgs.credentialKey === "string" ? toolArgs.credentialKey.trim() : "";
+          if (!key) {
+            return { ok: false, error: 'mobile_fill_credential: missing required "credentialKey".' };
+          }
+          const secret = credentials[key];
+          if (!secret) {
+            const available = Object.keys(credentials).filter((k) => credentials[k]).join(", ") || "(none configured)";
+            return { ok: false, error: `mobile_fill_credential: no credential configured for key "${key}". Available keys: ${available}` };
+          }
+          const element = resolveRef(toolArgs.ref);
+          if (!element)
+            return unknownRef(toolArgs.ref);
+          const beforeScreenName = screenName();
+          const result = await driver.type(secret, element.bounds);
+          const absorbed = await absorbObservation(result.source, result.screenSignal, latest()?.screen.windowSize ?? null, result.screenshot, "mobile_fill_credential");
+          if (shouldRecordAction(result, absorbed)) {
+            recordAction({
+              type: "TYPE",
+              value: (0, shared_1.mobileCredentialPlaceholder)(key),
+              selector: (0, mobile_source_parser_js_2.preferredLocator)(element),
+              metadata: metadataForElement(element, beforeScreenName, platform3)
+            });
+            log2(`  fill_credential: recorded {{${key}}} into ${labelForElement(element)}`);
+          }
+          return { ...actionPayload(result, absorbed), filledCredentialKey: key };
+        }
         case "mobile_clear": {
           const element = resolveRef(toolArgs.ref);
           if (!element)
@@ -66826,18 +67055,40 @@ ${statePacket}` },
       return labelled ?? elements.find((el) => !isAlwaysPresentContainer(el)) ?? elements[0];
     }
     var ALWAYS_PRESENT_CONTAINER_ROLES = /^(XCUIElementTypeApplication|XCUIElementTypeWindow)$/;
-    var ALWAYS_PRESENT_CONTAINER_RESOURCE_IDS = /* @__PURE__ */ new Set([
-      "android:id/content",
-      "android:id/decor",
-      "android:id/action_bar_root",
-      "android:id/statusBarBackground",
-      "android:id/navigationBarBackground"
+    var ALWAYS_PRESENT_CONTAINER_ID_NAMES = /* @__PURE__ */ new Set([
+      "content",
+      "decor",
+      "decor_content_parent",
+      "action_bar_root",
+      "statusBarBackground",
+      "navigationBarBackground",
+      // WebView hybrid apps (React/Vue/etc. rendered inside android.webkit.WebView)
+      // expose their framework ROOT container's DOM id as the element id — present on
+      // EVERY in-app screen, so the floor must not anchor to it (observed live on
+      // ThoughtStream: `main-content` produced a screen-agnostic assertion that then
+      // never matched via the text-contains fallback).
+      "main-content",
+      "root",
+      "app",
+      "app-root",
+      "__next",
+      "react-root",
+      "application"
     ]);
     function isAlwaysPresentContainer(element) {
       if (ALWAYS_PRESENT_CONTAINER_ROLES.test(element.role))
         return true;
       const resourceId = element.resourceId?.trim();
-      return !!resourceId && ALWAYS_PRESENT_CONTAINER_RESOURCE_IDS.has(resourceId);
+      if (resourceId) {
+        const slashIdx = resourceId.indexOf("/");
+        const localName = slashIdx >= 0 ? resourceId.slice(slashIdx + 1) : resourceId;
+        if (ALWAYS_PRESENT_CONTAINER_ID_NAMES.has(localName))
+          return true;
+      }
+      const accessibilityId = element.accessibilityId?.trim();
+      if (accessibilityId && ALWAYS_PRESENT_CONTAINER_ID_NAMES.has(accessibilityId))
+        return true;
+      return false;
     }
     function appendHybridFloor(actions, recording, platform3) {
       const anchor = pickLandingAnchor(recording.lastSnapshot);
@@ -66851,9 +67102,38 @@ ${statePacket}` },
       }));
       return true;
     }
+    function actionCycleKey(action) {
+      return `${action.type}|${action.selector}|${action.value ?? ""}`;
+    }
+    var MAX_RETRY_CYCLE_LENGTH = 8;
+    function collapseRetryCycles(actions) {
+      const out = [...actions];
+      let changed = true;
+      while (changed) {
+        changed = false;
+        const maxWindow = Math.min(MAX_RETRY_CYCLE_LENGTH, Math.floor(out.length / 2));
+        for (let window2 = maxWindow; window2 >= 2 && !changed; window2--) {
+          for (let i = 0; i + 2 * window2 <= out.length; i++) {
+            const first = out.slice(i, i + window2);
+            if (first.some((a) => a.type === "ASSERT_VISIBLE" || a.type === "ASSERT_TEXT"))
+              continue;
+            const second = out.slice(i + window2, i + 2 * window2);
+            if (!first.every((a, k) => actionCycleKey(a) === actionCycleKey(second[k])))
+              continue;
+            out.splice(i, window2);
+            changed = true;
+            break;
+          }
+        }
+      }
+      return out;
+    }
     function assembleTest(args) {
       const { scenario, recording, ctx, platform: platform3, log: log2 } = args;
-      const actions = [...recording.actions];
+      const actions = collapseRetryCycles(recording.actions);
+      if (actions.length < recording.actions.length) {
+        log2(`  collapsed ${recording.actions.length - actions.length} retry-cycle step(s) out of the recorded trace (${recording.actions.length} \u2192 ${actions.length}).`);
+      }
       const floorAppended = appendHybridFloor(actions, recording, platform3);
       if (floorAppended) {
         log2("  appended hybrid durable-outcome floor (landing-screen ASSERT_VISIBLE).");
@@ -66880,9 +67160,9 @@ ${statePacket}` },
       if (claimedVerified && !verified) {
         log2("  downgraded verified -> false: model claimed verified but called zero assert tools.");
       }
-      const platformTag = platform3 === "IOS" ? "@ios" : "@android";
+      const platformTag2 = platform3 === "IOS" ? "@ios" : "@android";
       const reviewTag = verified ? "@verified" : "@needs-review";
-      const tags = ["@discovered", "@mobile", platformTag, reviewTag];
+      const tags = ["@discovered", "@mobile", platformTag2, reviewTag];
       const test = {
         name: compiled.name,
         description: recording.finish?.description ?? compiled.description,
@@ -66892,6 +67172,12 @@ ${statePacket}` },
         playwrightCode: "",
         verified,
         tags,
+        // Per-test feature label → TestCase.suite. One deep run plans scenarios for
+        // MULTIPLE feature groups (the planner reuses survey feature names), so the
+        // run-level ctx.featureName fallback in /discovery-test would wrongly file
+        // every test under the deep-dived feature. The scenario's own group is the
+        // correct home; the runner forwards it as `suiteName`.
+        ...scenario.featureGroup?.trim() ? { suiteName: scenario.featureGroup.trim() } : {},
         // Carry the planner scenario identity so incremental/resume can match an
         // already-generated scenario reliably (scenarioRef.name === the plan's
         // scenario name). Without this the resume skip-set falls back to the
@@ -66909,7 +67195,27 @@ ${statePacket}` },
             startFromLanding: scenario.startFromLanding,
             targetPages: [...scenario.targetPages]
           },
-          evidence: { observedLocators: [], observedTransitions: [] }
+          evidence: { observedLocators: [], observedTransitions: [] },
+          // Assertion-strength marker for the server promote-seam
+          // (resolveStabilityTransition): an UNVERIFIED recording proves none of the
+          // scenario's outcomes — only the hybrid floor's landing-screen visibility —
+          // so a passing replay is vacuous. Hold it as DRAFT (@needs-review) for a
+          // human instead of letting the pass auto-promote it into the ACTIVE suite.
+          // Mirrors the recorder mobile path (server test-pipeline.ts @unverified).
+          ...verified ? {} : {
+            gateActivity: {
+              outcomeGate: {
+                requiredCount: scenario.expectedOutcomes.length,
+                uncoveredCount: scenario.expectedOutcomes.length
+              },
+              strengthGate: {
+                fired: false,
+                severity: "block",
+                blocked: true,
+                reason: "Mobile scenario finished unverified \u2014 the agent never proved the scenario outcome live, so the recording may not demonstrate the goal (e.g. a happy path that never completed). Review before promotion."
+              }
+            }
+          }
         }
       };
       return test;
@@ -66930,6 +67236,7 @@ ${statePacket}` },
       const aiClient = modelOverride ? (0, ai_provider_js_1.getMobileClientForModel)(modelOverride) : (0, ai_provider_js_1.getMobileAIClient)();
       const auditGroupId = `mobile-generate-${(0, crypto_1.randomUUID)().slice(0, 8)}`;
       const targetAppId = ctx.target?.appId?.trim() || void 0;
+      const { secrets: credentialSecrets } = (0, credential_tools_js_1.partitionTestVariables)(ctx.variableContext?.allTestVariables ?? ctx.variableContext?.publicTestVariables);
       const skipSet = new Set(skipScenarioNames ?? []);
       const scenarios = skipSet.size > 0 ? allScenarios.filter((s) => !skipSet.has(s.name)) : allScenarios;
       if (skipSet.size > 0) {
@@ -66958,6 +67265,7 @@ ${statePacket}` },
             onAICall,
             onScreenshot,
             targetAppId,
+            credentials: credentialSecrets,
             log: log2
           });
           consecutiveInfraFailures = 0;
@@ -313580,9 +313888,12 @@ Generation complete: ${tests.length} tests generated (${generateElapsed}s elapse
         });
         let featureInsight;
         if (mode === "deep" && ctx.featureName) {
+          const targetName = ctx.featureName.trim().toLowerCase();
+          const plannedGroup = (featureGroups ?? []).find((group) => group.name.trim().toLowerCase() === targetName);
+          const plannedDescription = plannedGroup?.description?.trim();
           featureInsight = {
             featureName: ctx.featureName,
-            description: `Mobile feature "${ctx.featureName}": ${explore.exploreStats.pagesDiscovered} screens explored, ${tests.length} tests generated.`
+            description: plannedDescription && plannedDescription.length > 0 ? plannedDescription : `Mobile feature "${ctx.featureName}": ${explore.exploreStats.pagesDiscovered} screens explored, ${tests.length} tests generated.`
           };
         }
         const duration = (Date.now() - startTime) / 1e3;
@@ -328118,7 +328429,7 @@ var require_package4 = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.16",
+      version: "1.0.18",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"
@@ -329659,6 +329970,7 @@ async function startMobileNetworkCapture(options) {
 
 // src/services/appium-executor.ts
 var DEFAULT_STEP_TIMEOUT_MS = 1e4;
+var VERIFICATION_ACTIONS = /* @__PURE__ */ new Set(["assertVisible", "assertText", "waitForElement"]);
 var WD_SESSION_CREATE_TIMEOUT_MS = 12e4;
 var WD_ACTION_TIMEOUT_MS = 3e4;
 var MAX_SESSION_CREATE_ATTEMPTS = 3;
@@ -329987,6 +330299,11 @@ function boundsFromStep(step) {
   }
   return null;
 }
+function boundsForRun(step, platform3, isCrossPlatform) {
+  if (isCrossPlatform) return null;
+  if (platform3 && hasPlatformLocator(step.target, platform3)) return null;
+  return boundsFromStep(step);
+}
 function locatorStrategyForValue(value) {
   const trimmed = value?.trim();
   if (!trimmed) {
@@ -330006,19 +330323,21 @@ function locatorStrategyForValue(value) {
     { using: "id", value: trimmed }
   ];
 }
-function buildLocatorStrategies(target) {
+function buildLocatorStrategies(target, platform3) {
   if (!target) return [];
   const strategies = [];
-  const bundle = target.locatorBundle;
+  const bundle = resolvePlatformLocatorBundle(target, platform3);
   if (bundle) {
     if (bundle.accessibilityId) strategies.push({ using: "accessibility id", value: bundle.accessibilityId });
     if (bundle.resourceId) strategies.push({ using: "id", value: bundle.resourceId });
     if (bundle.xpath) strategies.push({ using: "xpath", value: bundle.xpath });
     if (bundle.className) strategies.push({ using: "class name", value: bundle.className });
   }
-  strategies.push(...locatorStrategyForValue(target.primary));
-  for (const fallback of target.fallbacks ?? []) {
-    strategies.push(...locatorStrategyForValue(fallback));
+  if (!(platform3 && hasPlatformLocator(target, platform3))) {
+    strategies.push(...locatorStrategyForValue(target.primary));
+    for (const fallback of target.fallbacks ?? []) {
+      strategies.push(...locatorStrategyForValue(fallback));
+    }
   }
   return strategies.filter(
     (strategy, index, list) => list.findIndex((candidate) => candidate.using === strategy.using && candidate.value === strategy.value) === index
@@ -330044,10 +330363,10 @@ function isIdentityStrategy(strategy) {
   if (strategy.using === "xpath") return strategy.value.includes("@");
   return false;
 }
-function buildIdentityLocatorStrategies(target) {
+function buildIdentityLocatorStrategies(target, platform3) {
   if (!target) return [];
   const strategies = [];
-  const bundle = target.locatorBundle;
+  const bundle = resolvePlatformLocatorBundle(target, platform3);
   if (bundle) {
     if (bundle.accessibilityId) strategies.push({ using: "accessibility id", value: bundle.accessibilityId });
     if (bundle.resourceId) strategies.push({ using: "id", value: bundle.resourceId });
@@ -330057,9 +330376,11 @@ function buildIdentityLocatorStrategies(target) {
     }
     if (bundle.xpath && bundle.xpath.includes("@")) strategies.push({ using: "xpath", value: bundle.xpath });
   }
-  for (const value of [target.primary, ...target.fallbacks ?? []]) {
-    for (const strategy of locatorStrategyForValue(value)) {
-      if (isIdentityStrategy(strategy)) strategies.push(strategy);
+  if (!(platform3 && hasPlatformLocator(target, platform3))) {
+    for (const value of [target.primary, ...target.fallbacks ?? []]) {
+      for (const strategy of locatorStrategyForValue(value)) {
+        if (isIdentityStrategy(strategy)) strategies.push(strategy);
+      }
     }
   }
   return dedupeStrategies(strategies);
@@ -330072,7 +330393,7 @@ function readStepTimeout(step) {
   return void 0;
 }
 async function findElement(sessionId, target, timeoutMs = DEFAULT_STEP_TIMEOUT_MS, opts) {
-  const strategies = opts?.identityOnly ? buildIdentityLocatorStrategies(target) : buildLocatorStrategies(target);
+  const strategies = opts?.identityOnly ? buildIdentityLocatorStrategies(target, opts?.platform) : buildLocatorStrategies(target, opts?.platform);
   if (strategies.length === 0) {
     throw new Error(
       opts?.identityOnly ? "No identity locator (accessibility id / resource id / text) available for this step \u2014 cannot verify the screen" : "No locator strategies available for this step"
@@ -330174,18 +330495,18 @@ function shouldAbortAfterStepFailure(action) {
       return false;
   }
 }
-async function executeTap(sessionId, step) {
-  const bounds = boundsFromStep(step);
+async function executeTap(sessionId, step, platform3, isCrossPlatform = false) {
+  const bounds = boundsForRun(step, platform3, isCrossPlatform);
   if (step.target) {
     try {
-      const elementId = await findElement(sessionId, step.target, readStepTimeout(step));
+      const elementId = await findElement(sessionId, step.target, readStepTimeout(step), { platform: platform3 });
       await wdRequest(`/session/${sessionId}/element/${elementId}/click`, {
         method: "POST",
         body: "{}"
       });
       return;
     } catch (error2) {
-      if (isTransportError(error2) || !bounds || buildLocatorStrategies(step.target).length > 0) throw error2;
+      if (isTransportError(error2) || !bounds || buildLocatorStrategies(step.target, platform3).length > 0) throw error2;
     }
   }
   if (!bounds) {
@@ -330196,7 +330517,7 @@ async function executeTap(sessionId, step) {
 async function executeType(sessionId, step, context) {
   if (step.value === void 0 || step.value === null || step.value === "") return;
   const value = String(step.value);
-  const bounds = boundsFromStep(step);
+  const bounds = boundsForRun(step, context.platform, context.isCrossPlatform ?? false);
   let elementId = null;
   let lastInputError = null;
   let tappedBounds = false;
@@ -330213,12 +330534,12 @@ async function executeType(sessionId, step, context) {
   }
   if (step.target) {
     try {
-      elementId = await findElement(sessionId, step.target, readStepTimeout(step));
+      elementId = await findElement(sessionId, step.target, readStepTimeout(step), { platform: context.platform });
       lastInputError = await trySendElementValue(sessionId, elementId, value);
       if (!lastInputError) return;
       elementId = null;
     } catch (error2) {
-      if (isTransportError(error2) || !bounds || buildLocatorStrategies(step.target).length > 0) throw error2;
+      if (isTransportError(error2) || !bounds || buildLocatorStrategies(step.target, context.platform).length > 0) throw error2;
       lastInputError = error2;
     }
   }
@@ -330266,14 +330587,14 @@ async function executeType(sessionId, step, context) {
   }
   throw new Error(`TYPE step could not send text to the focused target${lastInputError instanceof Error ? `: ${lastInputError.message}` : ""}`);
 }
-async function executeClear(sessionId, step) {
-  const bounds = boundsFromStep(step);
+async function executeClear(sessionId, step, platform3, isCrossPlatform = false) {
+  const bounds = boundsForRun(step, platform3, isCrossPlatform);
   let elementId = null;
   if (step.target) {
     try {
-      elementId = await findElement(sessionId, step.target, readStepTimeout(step));
+      elementId = await findElement(sessionId, step.target, readStepTimeout(step), { platform: platform3 });
     } catch (error2) {
-      if (isTransportError(error2) || !bounds || buildLocatorStrategies(step.target).length > 0) throw error2;
+      if (isTransportError(error2) || !bounds || buildLocatorStrategies(step.target, platform3).length > 0) throw error2;
     }
   }
   if (!elementId && bounds) {
@@ -330342,20 +330663,20 @@ async function executeHome(sessionId, platform3) {
     body: JSON.stringify({ keycode: 3 })
   });
 }
-async function executeWaitForElement(sessionId, step) {
+async function executeWaitForElement(sessionId, step, platform3) {
   const timeout = readStepTimeout(step) ?? DEFAULT_STEP_TIMEOUT_MS;
-  await findElement(sessionId, step.target, timeout, { identityOnly: true });
+  await findElement(sessionId, step.target, timeout, { identityOnly: true, platform: platform3 });
 }
-async function executeAssertVisible(sessionId, step) {
-  const elementId = await findElement(sessionId, step.target, readStepTimeout(step), { identityOnly: true });
+async function executeAssertVisible(sessionId, step, platform3) {
+  const elementId = await findElement(sessionId, step.target, readStepTimeout(step), { identityOnly: true, platform: platform3 });
   const result = await wdRequest(`/session/${sessionId}/element/${elementId}/displayed`);
   if (!result?.value) {
     throw new Error(`Element found but not visible: ${step.target?.primary ?? "unknown"}`);
   }
 }
-async function executeAssertText(sessionId, step) {
+async function executeAssertText(sessionId, step, platform3) {
   if (!step.assertion) throw new Error("assertText step requires an assertion value");
-  const elementId = await findElement(sessionId, step.target, readStepTimeout(step), { identityOnly: true });
+  const elementId = await findElement(sessionId, step.target, readStepTimeout(step), { identityOnly: true, platform: platform3 });
   const result = await wdRequest(`/session/${sessionId}/element/${elementId}/text`);
   const actualText = typeof result?.value === "string" ? result.value : "";
   const textCandidates = await readElementTextCandidates(sessionId, elementId, actualText);
@@ -330386,6 +330707,10 @@ async function executeMobileTest(options) {
   const logLines = [];
   const log2 = (msg) => logLines.push(`[${(/* @__PURE__ */ new Date()).toISOString()}] ${msg}`);
   const startTime = Date.now();
+  const { steps: runSteps, missingKeys: missingVariableKeys } = resolveMobileStepValuePlaceholders(options.steps, options.testVariables);
+  if (missingVariableKeys.length > 0) {
+    log2(`\u26A0 Unresolved step-value placeholder(s): ${missingVariableKeys.map((k) => `{{${k}}}`).join(", ")} \u2014 no matching test variable configured for this project/run.`);
+  }
   const stepResults = [];
   const screenshots = [];
   let apiCalls = [];
@@ -330521,12 +330846,14 @@ async function executeMobileTest(options) {
     }
     await restoreTargetAppIfExternal(sessionId, options.target, log2, "session start", false);
     let entryDrift = false;
-    const entryStep = options.steps.find(
-      (s) => s.action !== "launchApp" && buildIdentityLocatorStrategies(s.target).length > 0
+    const runPlatform = options.target.platform;
+    const isCrossPlatform = options.target.authoringPlatform != null && options.target.authoringPlatform !== runPlatform;
+    const entryStep = runSteps.find(
+      (s) => s.action !== "launchApp" && stepAppliesToPlatform(s, runPlatform) && buildIdentityLocatorStrategies(s.target, runPlatform).length > 0
     );
     if (entryStep) {
       try {
-        await findElement(sessionId, entryStep.target, DEFAULT_STEP_TIMEOUT_MS, { identityOnly: true });
+        await findElement(sessionId, entryStep.target, DEFAULT_STEP_TIMEOUT_MS, { identityOnly: true, platform: runPlatform });
       } catch (err) {
         if (isTransportError(err)) throw err;
         entryDrift = true;
@@ -330538,8 +330865,14 @@ async function executeMobileTest(options) {
       }
     }
     let environmental = null;
-    for (const step of options.steps) {
+    for (const step of runSteps) {
       if (entryDrift) break;
+      if (!stepAppliesToPlatform(step, runPlatform)) {
+        log2(`Step ${step.order}: ${step.action} \u2014 skipped (not applicable to ${runPlatform})`);
+        stepResults.push({ stepOrder: step.order, status: "skipped", duration: 0 });
+        screenshots.push("");
+        continue;
+      }
       const stepStart = Date.now();
       log2(`Step ${step.order}: ${step.action} - ${step.description}`);
       let status = "passed";
@@ -330551,17 +330884,18 @@ async function executeMobileTest(options) {
             log2("  App launched (handled by session creation)");
             break;
           case "tap":
-            await executeTap(sessionId, step);
+            await executeTap(sessionId, step, runPlatform, isCrossPlatform);
             break;
           case "type":
             await executeType(sessionId, step, {
-              platform: options.target.platform,
+              platform: runPlatform,
               deviceId: selectedDevice.id,
-              log: log2
+              log: log2,
+              isCrossPlatform
             });
             break;
           case "clear":
-            await executeClear(sessionId, step);
+            await executeClear(sessionId, step, runPlatform, isCrossPlatform);
             break;
           case "swipe":
           case "scroll":
@@ -330571,16 +330905,16 @@ async function executeMobileTest(options) {
             await executeBack(sessionId);
             break;
           case "home":
-            await executeHome(sessionId, options.target.platform);
+            await executeHome(sessionId, runPlatform);
             break;
           case "waitForElement":
-            await executeWaitForElement(sessionId, step);
+            await executeWaitForElement(sessionId, step, runPlatform);
             break;
           case "assertVisible":
-            await executeAssertVisible(sessionId, step);
+            await executeAssertVisible(sessionId, step, runPlatform);
             break;
           case "assertText":
-            await executeAssertText(sessionId, step);
+            await executeAssertText(sessionId, step, runPlatform);
             break;
           default: {
             const _exhaustive = step.action;
@@ -330617,8 +330951,14 @@ async function executeMobileTest(options) {
         break;
       }
     }
-    const allPassed = !environmental && stepResults.length > 0 && stepResults.every((r) => r.status === "passed" || r.status === "skipped");
-    const firstError = environmental ?? (stepResults.find((r) => r.status === "failed")?.error ?? null);
+    const executedResults = stepResults.filter((r) => r.status !== "skipped");
+    const verifyOrders = new Set(
+      runSteps.filter((s) => VERIFICATION_ACTIONS.has(s.action)).map((s) => s.order)
+    );
+    const anyVerificationPassed = stepResults.some((r) => r.status === "passed" && verifyOrders.has(r.stepOrder));
+    const crossPlatformUnverified = isCrossPlatform && verifyOrders.size > 0 && !anyVerificationPassed;
+    const allPassed = !environmental && executedResults.length > 0 && !crossPlatformUnverified && stepResults.every((r) => r.status === "passed" || r.status === "skipped");
+    const firstError = environmental ?? (stepResults.find((r) => r.status === "failed")?.error ?? null) ?? (crossPlatformUnverified ? `Cross-platform run on ${runPlatform} verified no outcome \u2014 every assertion/wait step was skipped or unresolved. Author a ${runPlatform} assertion or resolve the divergence.` : null);
     await stopCapture();
     await stopRecording();
     return {
@@ -330752,6 +331092,188 @@ async function createMobileDiscoverySession(target, options) {
     }
   };
 }
+async function readElementAttribute(sessionId, elementId, name) {
+  try {
+    const result = await wdRequest(`/session/${sessionId}/element/${elementId}/attribute/${encodeURIComponent(name)}`);
+    const value = result?.value;
+    if (typeof value !== "string") return void 0;
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : void 0;
+  } catch (err) {
+    if (isTransportError(err)) throw err;
+    return void 0;
+  }
+}
+function harvestFallbackXpath(platform3, attrs) {
+  if (platform3 === "IOS") {
+    if (attrs.name) return `//*[@name=${xpathLiteral(attrs.name)}]`;
+    const text = attrs.label ?? attrs.value;
+    if (text) return identityTextXpath(text);
+    return "//*";
+  }
+  if (attrs.resourceId) return `//*[@resource-id=${xpathLiteral(attrs.resourceId)}]`;
+  if (attrs.text) return identityTextXpath(attrs.text);
+  if (attrs.contentDesc) return `//*[@content-desc=${xpathLiteral(attrs.contentDesc)}]`;
+  return "//*";
+}
+async function readNativeElementBundle(sessionId, elementId, platform3) {
+  const className = await readElementAttribute(sessionId, elementId, platform3 === "IOS" ? "type" : "class") ?? "";
+  if (platform3 === "IOS") {
+    const name = await readElementAttribute(sessionId, elementId, "name");
+    const label = await readElementAttribute(sessionId, elementId, "label");
+    const value = await readElementAttribute(sessionId, elementId, "value");
+    const text2 = label ?? value;
+    if (!name && !text2) return null;
+    const bundle2 = {
+      xpath: harvestFallbackXpath("IOS", { name, label, value }),
+      className
+    };
+    if (name) bundle2.accessibilityId = name;
+    if (text2) bundle2.text = text2;
+    return bundle2;
+  }
+  const resourceId = await readElementAttribute(sessionId, elementId, "resource-id");
+  const contentDesc = await readElementAttribute(sessionId, elementId, "content-desc") ?? await readElementAttribute(sessionId, elementId, "contentDescription");
+  const text = await readElementAttribute(sessionId, elementId, "text");
+  if (!resourceId && !contentDesc && !text) return null;
+  const bundle = {
+    xpath: harvestFallbackXpath("ANDROID", { text, contentDesc, resourceId }),
+    className
+  };
+  if (contentDesc) bundle.accessibilityId = contentDesc;
+  if (resourceId) bundle.resourceId = resourceId;
+  if (text) bundle.text = text;
+  if (contentDesc) bundle.contentDesc = contentDesc;
+  return bundle;
+}
+function isStateAdvancingAction(action) {
+  return action === "tap" || action === "type" || action === "clear" || action === "swipe" || action === "scroll" || action === "back" || action === "home";
+}
+function stepNeedsLocator(action) {
+  return action === "tap" || action === "type" || action === "clear" || action === "waitForElement" || action === "assertVisible" || action === "assertText";
+}
+async function driveHarvestStep(sessionId, step, elementId, platform3) {
+  switch (step.action) {
+    case "tap":
+      if (!elementId) return false;
+      await wdRequest(`/session/${sessionId}/element/${elementId}/click`, { method: "POST", body: "{}" });
+      return true;
+    case "type": {
+      if (step.value === void 0 || step.value === null || step.value === "") return true;
+      if (!elementId) return false;
+      await wdRequest(`/session/${sessionId}/element/${elementId}/click`, { method: "POST", body: "{}" });
+      await new Promise((resolve) => setTimeout(resolve, MOBILE_FOCUS_SETTLE_MS));
+      const err = await trySendElementValue(sessionId, elementId, String(step.value));
+      return !err;
+    }
+    case "clear":
+      if (!elementId) return false;
+      await wdRequest(`/session/${sessionId}/element/${elementId}/clear`, { method: "POST", body: "{}" });
+      return true;
+    case "swipe":
+    case "scroll":
+      await executeSwipe(sessionId, step);
+      return true;
+    case "back":
+      await executeBack(sessionId);
+      return true;
+    case "home":
+      await executeHome(sessionId, platform3);
+      return true;
+    case "launchApp":
+    case "waitForElement":
+    case "assertVisible":
+    case "assertText":
+      return true;
+  }
+}
+async function harvestPlatformLocators(options) {
+  const platform3 = options.target.platform;
+  const logLines = [];
+  const log2 = (msg) => {
+    logLines.push(`[${(/* @__PURE__ */ new Date()).toISOString()}] ${msg}`);
+  };
+  const { steps: harvestSteps, missingKeys: missingVariableKeys } = resolveMobileStepValuePlaceholders(options.steps, options.testVariables);
+  if (missingVariableKeys.length > 0) {
+    log2(`\u26A0 Unresolved step-value placeholder(s): ${missingVariableKeys.map((k) => `{{${k}}}`).join(", ")} \u2014 no matching test variable configured.`);
+  }
+  const bundles = {};
+  const divergentOrders = [];
+  let reachedOrder = null;
+  let environmentalError;
+  log2(`Cross-platform locator discovery \u2014 resolving ${platform3} locators for ${harvestSteps.length} steps`);
+  const session = await createMobileDiscoverySession({
+    appId: options.target.appId,
+    platform: platform3,
+    platformVersion: options.target.platformVersion,
+    recordedDeviceId: options.target.recordedDeviceId,
+    assignedDeviceId: options.target.assignedDeviceId,
+    launchMode: "LAUNCH_APP"
+  });
+  options.onSessionReady?.(session.sessionId, session.deviceId, platform3);
+  try {
+    await freshLaunchTargetApp(session.sessionId, platform3, options.target.appId, log2);
+    if (options.target.launchMode === "DEEP_LINK" && options.target.deeplink) {
+      try {
+        await openDeepLink(session.sessionId, platform3, options.target.deeplink, options.target.appId);
+      } catch (err) {
+        log2(`  Deep link failed (continuing): ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+    await restoreTargetAppIfExternal(session.sessionId, { appId: options.target.appId, platform: platform3 }, log2, "harvest start", false);
+    for (const step of harvestSteps) {
+      if (step.action === "launchApp") continue;
+      if (!stepAppliesToPlatform(step, platform3)) continue;
+      let elementId = null;
+      const identityStrategies = buildIdentityLocatorStrategies(step.target);
+      if (identityStrategies.length > 0 && step.target) {
+        try {
+          elementId = await findElement(session.sessionId, step.target, DEFAULT_STEP_TIMEOUT_MS, { identityOnly: true });
+        } catch (err) {
+          if (isTransportError(err)) throw err;
+          elementId = null;
+        }
+      }
+      if (elementId) {
+        const bundle = await readNativeElementBundle(session.sessionId, elementId, platform3);
+        if (bundle) {
+          bundles[step.order] = bundle;
+          log2(`  \u2713 Step ${step.order} (${step.action}) resolved on ${platform3}`);
+        } else {
+          divergentOrders.push(step.order);
+          log2(`  \u26A0 Step ${step.order} (${step.action}) resolved but has no durable identity \u2014 flagged divergent`);
+        }
+      } else if (stepNeedsLocator(step.action)) {
+        divergentOrders.push(step.order);
+        log2(`  \u26A0 Step ${step.order} (${step.action}) could not be resolved on ${platform3} \u2014 needs manual authoring`);
+      }
+      const advanced = await driveHarvestStep(session.sessionId, step, elementId, platform3);
+      if (!advanced && isStateAdvancingAction(step.action)) {
+        log2(`  \u2717 Could not advance step ${step.order} (${step.action}) on ${platform3}; stopping harvest early`);
+        break;
+      }
+      reachedOrder = step.order;
+      await restoreTargetAppIfExternal(session.sessionId, { appId: options.target.appId, platform: platform3 }, log2, `harvest step ${step.order}`, false);
+    }
+  } catch (err) {
+    environmentalError = err instanceof Error ? err.message : String(err);
+    log2(`  \u2717 Harvest aborted: ${environmentalError}`);
+  } finally {
+    options.onSessionEnding?.(session.deviceId);
+    await session.stop().catch(() => {
+    });
+  }
+  return {
+    platform: platform3,
+    bundles,
+    divergentOrders,
+    reachedOrder,
+    deviceId: session.deviceId,
+    deviceName: session.deviceName,
+    logs: logLines.join("\n"),
+    ...environmentalError ? { environmentalError } : {}
+  };
+}
 
 // src/mobile-device-queue.ts
 function isNativeMobileDiscoveryContext(ctx) {
@@ -330943,12 +331465,46 @@ async function tapAt(sessionPath, bounds) {
     throw new Error("TAP requires usable bounds (finite x/y)");
   }
 }
-async function typeText(sessionPath, value, bounds) {
+async function getElementRect(sessionPath, elementId) {
+  try {
+    const value = readValue(await appiumRequest(`${sessionPath}/element/${elementId}/rect`));
+    if (!value || typeof value !== "object") return null;
+    const r = value;
+    if (typeof r.x !== "number" || typeof r.y !== "number" || typeof r.width !== "number" || typeof r.height !== "number" || !Number.isFinite(r.x) || !Number.isFinite(r.y)) {
+      return null;
+    }
+    return { x: r.x, y: r.y, width: r.width, height: r.height };
+  } catch {
+    return null;
+  }
+}
+function rectMatchesIntendedBounds(rect, bounds) {
+  if (bounds.width <= 0 || bounds.height <= 0) return false;
+  const rectCenterX = rect.x + rect.width / 2;
+  const rectCenterY = rect.y + rect.height / 2;
+  const boundsCenterX = bounds.x + bounds.width / 2;
+  const boundsCenterY = bounds.y + bounds.height / 2;
+  const rectCenterInBounds = rectCenterX >= bounds.x && rectCenterX <= bounds.x + bounds.width && rectCenterY >= bounds.y && rectCenterY <= bounds.y + bounds.height;
+  const boundsCenterInRect = rect.width > 0 && rect.height > 0 && boundsCenterX >= rect.x && boundsCenterX <= rect.x + rect.width && boundsCenterY >= rect.y && boundsCenterY <= rect.y + rect.height;
+  return rectCenterInBounds || boundsCenterInRect;
+}
+async function resolveTypeTargetElementId(sessionPath, bounds) {
+  const box = bounds !== void 0 ? normaliseBounds(bounds) : null;
   let elementId = await getActiveElementId2(sessionPath);
+  if (elementId && box && box.width > 0 && box.height > 0) {
+    const rect = await getElementRect(sessionPath, elementId);
+    if (!rect || !rectMatchesIntendedBounds(rect, box)) {
+      elementId = null;
+    }
+  }
   if (!elementId && bounds !== void 0 && await tapBoundsCenter(sessionPath, bounds)) {
     await new Promise((resolve) => setTimeout(resolve, MOBILE_FOCUS_SETTLE_MS));
     elementId = await getActiveElementId2(sessionPath);
   }
+  return elementId;
+}
+async function typeText(sessionPath, value, bounds) {
+  const elementId = await resolveTypeTargetElementId(sessionPath, bounds);
   if (!elementId) {
     throw new Error("No focused element available for TYPE. Tap an input field first.");
   }
@@ -330958,11 +331514,7 @@ async function typeText(sessionPath, value, bounds) {
   });
 }
 async function clearField(sessionPath, bounds) {
-  let elementId = await getActiveElementId2(sessionPath);
-  if (!elementId && bounds !== void 0 && await tapBoundsCenter(sessionPath, bounds)) {
-    await new Promise((resolve) => setTimeout(resolve, MOBILE_FOCUS_SETTLE_MS));
-    elementId = await getActiveElementId2(sessionPath);
-  }
+  const elementId = await resolveTypeTargetElementId(sessionPath, bounds);
   if (!elementId) {
     throw new Error("No focused element available for CLEAR. Tap an input field first.");
   }
@@ -332712,6 +333264,7 @@ function scrubAuditMessages(messages, testVariables) {
   const secretValues = Object.values(testVariables).filter((v) => typeof v === "string" && v.length >= 4).sort((a, b) => b.length - a.length);
   if (secretValues.length === 0) return compacted;
   let json = JSON.stringify(compacted);
+  if (typeof json !== "string") return compacted;
   for (const val of secretValues) {
     const escaped = val.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     json = json.replace(new RegExp(escaped, "g"), "[REDACTED]");
@@ -334009,6 +334562,104 @@ ${finalVerifyResult.logs ?? ""}`;
         log.fail("ERROR - No discovery context");
         return;
       }
+      const locatorCtx = ctx;
+      if (locatorCtx.mode === "locator-discovery") {
+        const harvestTarget = locatorCtx.target;
+        const targetTestCaseId = locatorCtx.targetTestCaseId;
+        const platform3 = locatorCtx.platform ?? harvestTarget?.platform;
+        if (!platform3 || !harvestTarget?.appId || !targetTestCaseId) {
+          await postResult(opts.serverUrl, headers, run2.runId, {
+            status: "ERROR",
+            error: "CONFIG_ISSUE: locator-discovery run is missing platform/appId/targetTestCaseId."
+          });
+          log.fail("ERROR - malformed locator-discovery context");
+          return;
+        }
+        if (getBridgeState().hasActiveSession) {
+          await postResult(opts.serverUrl, headers, run2.runId, {
+            status: "ERROR",
+            error: "CONFIG_ISSUE: the shared mobile device is busy with an active recording session; retry once it ends."
+          });
+          log.fail("ERROR - device busy (recording) for locator discovery");
+          return;
+        }
+        const leasedName = assignedDeviceId ? getCachedDeviceSnapshot().find((d) => d.id === assignedDeviceId)?.name : void 0;
+        liveBrowserHandle.patch({
+          mode: "discovery",
+          testName: "Cross-platform locator discovery",
+          note: `${platform3} locator discovery`,
+          surface: "mobile",
+          mobilePlatform: platform3,
+          ...assignedDeviceId ? { deviceId: assignedDeviceId } : {},
+          ...leasedName ? { deviceName: leasedName } : {}
+        });
+        requestLiveBrowserHeartbeat(true);
+        log.info(`Cross-platform locator discovery \u2014 ${platform3} / ${harvestTarget.appId} for test ${targetTestCaseId}`);
+        setExecutorBusy(true);
+        try {
+          const harvest = await harvestPlatformLocators({
+            steps: locatorCtx.sourceSteps ?? [],
+            target: {
+              appId: harvestTarget.appId,
+              platform: platform3,
+              platformVersion: harvestTarget.platformVersion,
+              recordedDeviceId: harvestTarget.recordedDeviceId,
+              assignedDeviceId,
+              launchMode: harvestTarget.launchMode,
+              deeplink: harvestTarget.deeplink
+            },
+            onSessionReady: (sessionId, deviceId, sessionPlatform) => {
+              attachMirrorSession(sessionId, sessionPlatform, deviceId);
+              const name = getCachedDeviceSnapshot().find((d) => d.id === deviceId)?.name;
+              liveBrowserHandle.patch({ deviceId, ...name ? { deviceName: name } : {} });
+              requestLiveBrowserHeartbeat(true);
+            },
+            onSessionEnding: (deviceId) => {
+              detachMirrorSession(deviceId);
+            },
+            // Resolve {{KEY}} credential placeholders in guided-replay TYPE steps.
+            testVariables: run2.testVariables
+          });
+          let queuedRunId = null;
+          let resultPosted = false;
+          try {
+            const res = await fetch(`${opts.serverUrl}/api/runner/runs/${run2.runId}/locator-discovery-result`, {
+              method: "POST",
+              headers: { ...headers, "Content-Type": "application/json" },
+              body: JSON.stringify({
+                bundles: harvest.bundles,
+                divergentOrders: harvest.divergentOrders,
+                reachedOrder: harvest.reachedOrder,
+                logs: harvest.logs,
+                ...harvest.environmentalError ? { environmentalError: harvest.environmentalError } : {}
+              }),
+              signal: AbortSignal.timeout(3e4)
+            });
+            if (res.ok) {
+              resultPosted = true;
+              const data = await res.json().catch(() => null);
+              queuedRunId = data?.queuedRunId ?? null;
+            } else {
+              log.warn(`[locator-discovery] result POST returned ${res.status}`);
+            }
+          } catch (postErr) {
+            log.warn(`[locator-discovery] result POST failed: ${postErr instanceof Error ? postErr.message : String(postErr)}`);
+          }
+          const passed = resultPosted && !harvest.environmentalError && harvest.reachedOrder != null;
+          await postResult(opts.serverUrl, headers, run2.runId, {
+            status: passed ? "PASSED" : "ERROR",
+            error: !resultPosted ? "CONFIG_ISSUE: failed to persist harvested cross-platform locators (result POST did not succeed); retriable." : harvest.environmentalError ? `CONFIG_ISSUE: ${harvest.environmentalError}` : harvest.reachedOrder == null ? "CONFIG_ISSUE: locator discovery could not reach any step on the target platform." : void 0,
+            logs: harvest.logs,
+            duration: Date.now() - startTime
+          });
+          log[passed ? "ok" : "fail"](
+            `Locator discovery ${passed ? "complete" : "ended"} \u2014 ${Object.keys(harvest.bundles).length} overlays, ${harvest.divergentOrders.length} divergent${queuedRunId ? ` (queued run ${queuedRunId})` : ""}`
+          );
+        } finally {
+          setExecutorBusy(false);
+        }
+        return;
+      }
       log.info(`Discovery (${ctx.mode}) on ${ctx.baseUrl}`);
       const { push: pushAudit, drain: drainAudit } = createAuditFlusher(
         `${opts.serverUrl}/api/runner/runs/${run2.runId}/ai-audit-batch`,
@@ -334722,7 +335373,11 @@ ${finalVerifyResult.logs ?? ""}`;
               recordedDeviceId: target.recordedDeviceId,
               assignedDeviceId,
               launchMode: target.launchMode,
-              deeplink: target.deeplink
+              deeplink: target.deeplink,
+              // Authoring platform (test's session medium). When it differs from
+              // target.platform this is a cross-platform run: no blind coordinate
+              // taps on foreign geometry, and the run must verify an outcome.
+              authoringPlatform: mobilePlatformFromMedium(run2.authoringMedium) ?? void 0
             },
             // Stream this run to its OWN per-device dashboard tile (keyed by the
             // leased device id) so N parallel Appium runs each show a live mirror.
@@ -334732,7 +335387,11 @@ ${finalVerifyResult.logs ?? ""}`;
             },
             onSessionEnding: (deviceId) => {
               detachMirrorSession(deviceId);
-            }
+            },
+            // Resolve {{KEY}} credential placeholders (recorded by the mobile
+            // discovery generator instead of secret values) against this run's
+            // CURRENT test variables.
+            testVariables: run2.testVariables
           });
           attemptLogs.push(`--- Appium attempt ${attempt + 1}/${maxRetries + 1} ---
 ${result2.logs}`);