@validate.qa/runner 1.0.17 → 1.0.18

package/dist/cli.js

@@ -1023,6 +1023,10 @@ var require_mobile_source_parser = __commonJS({
       }
       return fnv1a(parts.join("\n"));
     }
+    var EDITABLE_CLASS_RE = /(EditText|AutoCompleteTextView|XCUIElementTypeTextField|XCUIElementTypeSecureTextField|XCUIElementTypeSearchField|XCUIElementTypeTextView)$/;
+    function isEditableElement(el) {
+      return EDITABLE_CLASS_RE.test(el.role.trim());
+    }
     function buildLocatorBundle(el, platform3) {
       const bundle = {
         xpath: el.xpath,
@@ -1032,7 +1036,7 @@ var require_mobile_source_parser = __commonJS({
         bundle.accessibilityId = el.accessibilityId;
       if (platform3 === "ANDROID" && el.resourceId)
         bundle.resourceId = el.resourceId;
-      if (el.text)
+      if (el.text && !isEditableElement(el))
         bundle.text = el.text;
       if (platform3 === "ANDROID" && el.accessibilityId)
         bundle.contentDesc = el.accessibilityId;
@@ -1043,7 +1047,7 @@ var require_mobile_source_parser = __commonJS({
         return el.accessibilityId;
       if (el.resourceId)
         return el.resourceId;
-      if (el.text)
+      if (el.text && !isEditableElement(el))
         return el.text;
       return el.xpath;
     }
@@ -1363,6 +1367,31 @@ function toInlineCommentText(value) {
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function isEditableMobileClassName(className) {
+  if (!className)
+    return false;
+  return /(EditText|AutoCompleteTextView|XCUIElementTypeTextField|XCUIElementTypeSecureTextField|XCUIElementTypeSearchField|XCUIElementTypeTextView)$/.test(className.trim());
+}
+function mobileCredentialPlaceholder(key) {
+  return `{{${key}}}`;
+}
+function resolveMobileStepValuePlaceholders(steps, variables) {
+  const missing = /* @__PURE__ */ new Set();
+  const vars = variables ?? {};
+  const resolved = steps.map((step) => {
+    if (typeof step.value !== "string" || !step.value.includes("{{"))
+      return step;
+    const value = step.value.replace(MOBILE_VALUE_PLACEHOLDER_RE, (token, key) => {
+      const substitute = vars[key];
+      if (typeof substitute === "string" && substitute.length > 0)
+        return substitute;
+      missing.add(key);
+      return token;
+    });
+    return value === step.value ? step : { ...step, value };
+  });
+  return { steps: resolved, missingKeys: [...missing] };
+}
 function readMobileMetadata(value) {
   if (!isPlainObject(value)) {
     return { screenName: "UnknownScreen" };
@@ -1404,7 +1433,11 @@ function buildStepTarget(metadata, selector) {
   const primary = nonEmpty(locatorBundle.accessibilityId) ?? nonEmpty(locatorBundle.resourceId) ?? trimmedSelector ?? nonEmpty(locatorBundle.xpath) ?? locatorBundle.xpath;
   const fallbackCandidates = [
     locatorBundle.resourceId,
-    locatorBundle.text,
+    // For editable fields the text attribute IS the currently-typed value — a
+    // self-invalidating locator that only matches while the recorded text is
+    // still in the field (and it can leak typed input into locators). Static
+    // elements keep their text fallback.
+    isEditableMobileClassName(locatorBundle.className) ? void 0 : locatorBundle.text,
     locatorBundle.contentDesc,
     locatorBundle.xpath,
     selector
@@ -1835,7 +1868,7 @@ function isRunnableStep(step) {
       return false;
   }
 }
-var STEP_ACTION_BY_ACTION_TYPE;
+var STEP_ACTION_BY_ACTION_TYPE, MOBILE_VALUE_PLACEHOLDER_RE;
 var init_mobile_test_generation = __esm({
   "../shared/dist/mobile-test-generation.js"() {
     "use strict";
@@ -1853,6 +1886,7 @@ var init_mobile_test_generation = __esm({
       ASSERT_VISIBLE: "assertVisible",
       ASSERT_TEXT: "assertText"
     };
+    MOBILE_VALUE_PLACEHOLDER_RE = /\{\{([A-Za-z0-9_]+)\}\}/g;
   }
 });
 
@@ -3694,6 +3728,7 @@ __export(dist_exports, {
   isCountedFailure: () => isCountedFailure,
   isCreditPackAmountCents: () => isCreditPackAmountCents,
   isDbPricingPlan: () => isDbPricingPlan,
+  isEditableMobileClassName: () => isEditableMobileClassName,
   isEnvironmentalError: () => isEnvironmentalError,
   isMobilePlatform: () => isMobilePlatform,
   isPricingPlan: () => isPricingPlan,
@@ -3705,6 +3740,7 @@ __export(dist_exports, {
   isUIVariant: () => isUIVariant,
   isValidMobileAppId: () => isValidMobileAppId,
   mediumForMobilePlatform: () => mediumForMobilePlatform,
+  mobileCredentialPlaceholder: () => mobileCredentialPlaceholder,
   mobilePlatformFromMedium: () => mobilePlatformFromMedium,
   normalizeControlName: () => normalizeControlName,
   otherMobilePlatform: () => otherMobilePlatform,
@@ -3714,6 +3750,7 @@ __export(dist_exports, {
   platformTag: () => platformTag,
   registrableDomain: () => registrableDomain,
   resolveCrossOriginConfigOverride: () => resolveCrossOriginConfigOverride,
+  resolveMobileStepValuePlaceholders: () => resolveMobileStepValuePlaceholders,
   resolvePlatformLocatorBundle: () => resolvePlatformLocatorBundle,
   safeOrigin: () => safeOrigin,
   sanitizeTestVariables: () => sanitizeTestVariables,
@@ -65573,6 +65610,7 @@ Return ONLY one valid JSON object matching the schema below. Do NOT include <thi
 6. Do NOT merge screens into one feature just because they serve a similar broader goal. Treat areas as separate features when the evidence shows separate primary navigation destinations (e.g. separate tab-bar items or drawer links), separate screen families for distinct entities, or different CRUD entities/forms. Keep screens together when they share one navigational area and operate on the same entity (e.g. a list screen, its filter/sort sheet, and its detail screen all belong together).
 7. Feature descriptions MUST reference actual element labels / accessibility-ids from the evidence
 8. Do NOT create standalone features for generic error / empty screens (network-error, permission-denied). If a feature screen is broken or crashes, keep it in its intended feature and note the failure in the description.
+9. COVER EVERY SCREEN: every explored screen except generic error / permission screens MUST appear in exactly one feature group's routes. Do not leave screens ungrouped \u2014 a screen the explorer reached is part of SOME feature. Attach an ambiguous screen to its most closely related feature and note the ambiguity in that feature's description. Sign-in / sign-up / forgot-password screens form an "Authentication" group even when they were only reached via links from other screens.
 
 ## Output JSON Schema
 {
@@ -65780,7 +65818,8 @@ ${context.appBrief.slice(0, 500)}`);
       sections.push(`## App Under Test
 ${targetBits.length > 0 ? targetBits.join(" ") : "native mobile app"}`);
       if (context.featureName) {
-        sections.push(`## Feature: ${context.featureName}`);
+        sections.push(`## Feature: ${context.featureName}
+SCOPE: this is a feature-focused deep run. Plan scenarios ONLY for the "${context.featureName}" feature \u2014 its screens, forms, and flows. Screens belonging to other features are navigation context / prerequisites only; do NOT plan scenarios whose primary goal exercises another feature.`);
       }
       const orderedScreens = targetAppScreens(graph, context.appId).sort((a, b) => a.firstSeenIteration - b.firstSeenIteration);
       const includedScreenIds = new Set(orderedScreens.map((state2) => state2.screenId));
@@ -66165,10 +66204,12 @@ var require_mobile_generator = __commonJS({
   "../runner-core/dist/services/mobile/mobile-generator.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.collapseRetryCycles = collapseRetryCycles;
     exports2.runMobileGeneratePhase = runMobileGeneratePhase;
     var crypto_1 = require("crypto");
     var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var ai_provider_js_1 = require_ai_provider();
+    var credential_tools_js_1 = require_credential_tools();
     var ai_queue_js_1 = require_ai_queue();
     var ai_retry_js_1 = require_ai_retry();
     var mobile_source_parser_js_1 = require_mobile_source_parser();
@@ -66290,6 +66331,24 @@ var require_mobile_generator = __commonJS({
         }
       }
     };
+    var MOBILE_FILL_CREDENTIAL_TOOL = {
+      type: "function",
+      function: {
+        name: "mobile_fill_credential",
+        description: 'Fill a stored credential VALUE into a text field. ALWAYS use this instead of mobile_type for ANY email/password/token/auth field. Pass the field ref (eN) and the variable KEY (e.g. "TEST_USER_EMAIL"); the runner types the real value on the device and the generated test stores a {{KEY}} placeholder \u2014 you never see the secret. Available keys are listed in the Test Credentials section of the system prompt.',
+        parameters: {
+          type: "object",
+          properties: {
+            ref: { type: "string", description: 'Text-field element ref from the latest mobile_snapshot, e.g. "e5".' },
+            credentialKey: {
+              type: "string",
+              description: 'The credential variable name (e.g. "TEST_USER_EMAIL", "TEST_USER_PASSWORD"). Must be one of the keys listed in the Test Credentials section of the prompt.'
+            }
+          },
+          required: ["ref", "credentialKey"]
+        }
+      }
+    };
     var FINISH_GENERATE_TOOL = {
       type: "function",
       function: {
@@ -66311,6 +66370,7 @@ var require_mobile_generator = __commonJS({
       MOBILE_TAP_TOOL,
       MOBILE_TYPE_TOOL,
       MOBILE_CLEAR_TOOL,
+      MOBILE_FILL_CREDENTIAL_TOOL,
       MOBILE_SWIPE_TOOL,
       MOBILE_BACK_TOOL,
       MOBILE_RELAUNCH_TOOL,
@@ -66389,6 +66449,24 @@ var require_mobile_generator = __commonJS({
 - Finish promptly once the outcome is proven: the instant the expected outcome is visible, assert it and call finish_generate. Do not keep exploring after the goal is proven.
 
 Max iterations: ${MAX_SCENARIO_ITERATIONS}. You will be warned near the end.`;
+    }
+    function buildGenerateCredentialPromptBlock(secrets) {
+      const keys = Object.keys(secrets).filter((k) => secrets[k] && secrets[k].length > 0);
+      if (keys.length === 0)
+        return "";
+      const keyList = keys.map((k) => `- \`${k}\``).join("\n");
+      return `
+
+## Test Credentials (values are HIDDEN from you)
+This app has stored login credentials under these keys:
+${keyList}
+
+When a scenario needs a signed-in session or fills a login/sign-up form, fill each credential field with \`mobile_fill_credential\`: pass the field ref and the KEY (e.g. \`{ ref: "e5", credentialKey: "TEST_USER_EMAIL" }\`). The runner types the real value on the device and the generated test stores a \`{{KEY}}\` placeholder that replay resolves \u2014 you never see, log, or echo the secret.
+
+SECURITY RULES:
+- NEVER call \`mobile_type\` with a real email, password, or token value \u2014 the runner will REJECT the call and you lose an iteration. Use \`mobile_fill_credential\` for every credential field.
+- For validation scenarios (wrong password, empty submit) you MAY \`mobile_type\` synthetic invalid values like "wrong@example.com" / "badpassword" \u2014 those are not real credentials and are allowed.
+- NEVER put credential values in test names, descriptions, or assert texts.`;
     }
     function buildScenarioKickoff(scenario) {
       const stepLines = scenario.steps.map((step, i) => `  ${i + 1}. ${step.action}${step.target ? ` (target: ${step.target})` : ""}${step.hint ? ` [hint: ${step.hint}]` : ""}`).join("\n");
@@ -66459,7 +66537,7 @@ Start by calling mobile_snapshot, then execute the steps above \u2014 the minimu
       }
     }
     async function runScenarioLoop(args) {
-      const { scenario, driver, platform: platform3, maxIterations, agentModel, provider, aiClient, auditGroupId, onAICall, onScreenshot, targetAppId, log: log2 } = args;
+      const { scenario, driver, platform: platform3, maxIterations, agentModel, provider, aiClient, auditGroupId, onAICall, onScreenshot, targetAppId, credentials, log: log2 } = args;
       const actions = [];
       let assertCount = 0;
       let finish = null;
@@ -66576,7 +66654,7 @@ Start by calling mobile_snapshot, then execute the steps above \u2014 the minimu
       } catch (err) {
         log2(`  seed snapshot failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
       }
-      const systemPrompt = buildSystemPrompt(platform3, targetAppId);
+      const systemPrompt = buildSystemPrompt(platform3, targetAppId) + buildGenerateCredentialPromptBlock(credentials);
       const kickoff = buildScenarioKickoff(scenario);
       const recentExchanges = [];
       let iteration = 0;
@@ -66689,6 +66767,7 @@ ${statePacket}` },
               latest: getLatest,
               absorbObservation,
               resolveRef,
+              credentials,
               screenName: () => lastScreenName || "UnknownScreen",
               recordAction: (action) => {
                 actions.push(finalizeAction(action));
@@ -66710,7 +66789,7 @@ ${statePacket}` },
       return { actions, assertCount, finish, lastSnapshot: getLatest(), lastScreenName };
     }
     async function dispatchGenerateTool(args) {
-      const { toolName, toolArgs, driver, platform: platform3, latest, absorbObservation, resolveRef, screenName, recordAction, log: log2 } = args;
+      const { toolName, toolArgs, driver, platform: platform3, latest, absorbObservation, resolveRef, credentials, screenName, recordAction, log: log2 } = args;
       const unknownRef = (ref) => ({
         ok: false,
         error: `Unknown element ref "${String(ref)}". Call mobile_snapshot first; refs are only valid for the latest snapshot.`
@@ -66776,6 +66855,14 @@ ${statePacket}` },
           if (!element)
             return unknownRef(toolArgs.ref);
           const value = typeof toolArgs.value === "string" ? toolArgs.value : String(toolArgs.value ?? "");
+          for (const [key, secret] of Object.entries(credentials)) {
+            if (secret && secret.length >= 4 && value.includes(secret)) {
+              return {
+                ok: false,
+                error: `BLOCKED: mobile_type contained the stored credential value for "${key}". Use mobile_fill_credential({ ref, credentialKey: "${key}" }) instead of typing the credential directly.`
+              };
+            }
+          }
           const beforeScreenName = screenName();
           const result = await driver.type(value, element.bounds);
           const absorbed = await absorbObservation(result.source, result.screenSignal, latest()?.screen.windowSize ?? null, result.screenshot, "mobile_type");
@@ -66789,6 +66876,37 @@ ${statePacket}` },
           }
           return actionPayload(result, absorbed);
         }
+        // KEY-based credential fill: type the real value on-device, persist only a
+        // {{KEY}} placeholder in the recorded step (replay resolves it against the
+        // run's current test variables). The tool result echoes the KEY, never the
+        // value, so the secret cannot enter the transcript.
+        case "mobile_fill_credential": {
+          const key = typeof toolArgs.credentialKey === "string" ? toolArgs.credentialKey.trim() : "";
+          if (!key) {
+            return { ok: false, error: 'mobile_fill_credential: missing required "credentialKey".' };
+          }
+          const secret = credentials[key];
+          if (!secret) {
+            const available = Object.keys(credentials).filter((k) => credentials[k]).join(", ") || "(none configured)";
+            return { ok: false, error: `mobile_fill_credential: no credential configured for key "${key}". Available keys: ${available}` };
+          }
+          const element = resolveRef(toolArgs.ref);
+          if (!element)
+            return unknownRef(toolArgs.ref);
+          const beforeScreenName = screenName();
+          const result = await driver.type(secret, element.bounds);
+          const absorbed = await absorbObservation(result.source, result.screenSignal, latest()?.screen.windowSize ?? null, result.screenshot, "mobile_fill_credential");
+          if (shouldRecordAction(result, absorbed)) {
+            recordAction({
+              type: "TYPE",
+              value: (0, shared_1.mobileCredentialPlaceholder)(key),
+              selector: (0, mobile_source_parser_js_2.preferredLocator)(element),
+              metadata: metadataForElement(element, beforeScreenName, platform3)
+            });
+            log2(`  fill_credential: recorded {{${key}}} into ${labelForElement(element)}`);
+          }
+          return { ...actionPayload(result, absorbed), filledCredentialKey: key };
+        }
         case "mobile_clear": {
           const element = resolveRef(toolArgs.ref);
           if (!element)
@@ -66937,18 +67055,40 @@ ${statePacket}` },
       return labelled ?? elements.find((el) => !isAlwaysPresentContainer(el)) ?? elements[0];
     }
     var ALWAYS_PRESENT_CONTAINER_ROLES = /^(XCUIElementTypeApplication|XCUIElementTypeWindow)$/;
-    var ALWAYS_PRESENT_CONTAINER_RESOURCE_IDS = /* @__PURE__ */ new Set([
-      "android:id/content",
-      "android:id/decor",
-      "android:id/action_bar_root",
-      "android:id/statusBarBackground",
-      "android:id/navigationBarBackground"
+    var ALWAYS_PRESENT_CONTAINER_ID_NAMES = /* @__PURE__ */ new Set([
+      "content",
+      "decor",
+      "decor_content_parent",
+      "action_bar_root",
+      "statusBarBackground",
+      "navigationBarBackground",
+      // WebView hybrid apps (React/Vue/etc. rendered inside android.webkit.WebView)
+      // expose their framework ROOT container's DOM id as the element id — present on
+      // EVERY in-app screen, so the floor must not anchor to it (observed live on
+      // ThoughtStream: `main-content` produced a screen-agnostic assertion that then
+      // never matched via the text-contains fallback).
+      "main-content",
+      "root",
+      "app",
+      "app-root",
+      "__next",
+      "react-root",
+      "application"
     ]);
     function isAlwaysPresentContainer(element) {
       if (ALWAYS_PRESENT_CONTAINER_ROLES.test(element.role))
         return true;
       const resourceId = element.resourceId?.trim();
-      return !!resourceId && ALWAYS_PRESENT_CONTAINER_RESOURCE_IDS.has(resourceId);
+      if (resourceId) {
+        const slashIdx = resourceId.indexOf("/");
+        const localName = slashIdx >= 0 ? resourceId.slice(slashIdx + 1) : resourceId;
+        if (ALWAYS_PRESENT_CONTAINER_ID_NAMES.has(localName))
+          return true;
+      }
+      const accessibilityId = element.accessibilityId?.trim();
+      if (accessibilityId && ALWAYS_PRESENT_CONTAINER_ID_NAMES.has(accessibilityId))
+        return true;
+      return false;
     }
     function appendHybridFloor(actions, recording, platform3) {
       const anchor = pickLandingAnchor(recording.lastSnapshot);
@@ -66962,9 +67102,38 @@ ${statePacket}` },
       }));
       return true;
     }
+    function actionCycleKey(action) {
+      return `${action.type}|${action.selector}|${action.value ?? ""}`;
+    }
+    var MAX_RETRY_CYCLE_LENGTH = 8;
+    function collapseRetryCycles(actions) {
+      const out = [...actions];
+      let changed = true;
+      while (changed) {
+        changed = false;
+        const maxWindow = Math.min(MAX_RETRY_CYCLE_LENGTH, Math.floor(out.length / 2));
+        for (let window2 = maxWindow; window2 >= 2 && !changed; window2--) {
+          for (let i = 0; i + 2 * window2 <= out.length; i++) {
+            const first = out.slice(i, i + window2);
+            if (first.some((a) => a.type === "ASSERT_VISIBLE" || a.type === "ASSERT_TEXT"))
+              continue;
+            const second = out.slice(i + window2, i + 2 * window2);
+            if (!first.every((a, k) => actionCycleKey(a) === actionCycleKey(second[k])))
+              continue;
+            out.splice(i, window2);
+            changed = true;
+            break;
+          }
+        }
+      }
+      return out;
+    }
     function assembleTest(args) {
       const { scenario, recording, ctx, platform: platform3, log: log2 } = args;
-      const actions = [...recording.actions];
+      const actions = collapseRetryCycles(recording.actions);
+      if (actions.length < recording.actions.length) {
+        log2(`  collapsed ${recording.actions.length - actions.length} retry-cycle step(s) out of the recorded trace (${recording.actions.length} \u2192 ${actions.length}).`);
+      }
       const floorAppended = appendHybridFloor(actions, recording, platform3);
       if (floorAppended) {
         log2("  appended hybrid durable-outcome floor (landing-screen ASSERT_VISIBLE).");
@@ -67003,6 +67172,12 @@ ${statePacket}` },
         playwrightCode: "",
         verified,
         tags,
+        // Per-test feature label → TestCase.suite. One deep run plans scenarios for
+        // MULTIPLE feature groups (the planner reuses survey feature names), so the
+        // run-level ctx.featureName fallback in /discovery-test would wrongly file
+        // every test under the deep-dived feature. The scenario's own group is the
+        // correct home; the runner forwards it as `suiteName`.
+        ...scenario.featureGroup?.trim() ? { suiteName: scenario.featureGroup.trim() } : {},
         // Carry the planner scenario identity so incremental/resume can match an
         // already-generated scenario reliably (scenarioRef.name === the plan's
         // scenario name). Without this the resume skip-set falls back to the
@@ -67020,7 +67195,27 @@ ${statePacket}` },
             startFromLanding: scenario.startFromLanding,
             targetPages: [...scenario.targetPages]
           },
-          evidence: { observedLocators: [], observedTransitions: [] }
+          evidence: { observedLocators: [], observedTransitions: [] },
+          // Assertion-strength marker for the server promote-seam
+          // (resolveStabilityTransition): an UNVERIFIED recording proves none of the
+          // scenario's outcomes — only the hybrid floor's landing-screen visibility —
+          // so a passing replay is vacuous. Hold it as DRAFT (@needs-review) for a
+          // human instead of letting the pass auto-promote it into the ACTIVE suite.
+          // Mirrors the recorder mobile path (server test-pipeline.ts @unverified).
+          ...verified ? {} : {
+            gateActivity: {
+              outcomeGate: {
+                requiredCount: scenario.expectedOutcomes.length,
+                uncoveredCount: scenario.expectedOutcomes.length
+              },
+              strengthGate: {
+                fired: false,
+                severity: "block",
+                blocked: true,
+                reason: "Mobile scenario finished unverified \u2014 the agent never proved the scenario outcome live, so the recording may not demonstrate the goal (e.g. a happy path that never completed). Review before promotion."
+              }
+            }
+          }
         }
       };
       return test;
@@ -67041,6 +67236,7 @@ ${statePacket}` },
       const aiClient = modelOverride ? (0, ai_provider_js_1.getMobileClientForModel)(modelOverride) : (0, ai_provider_js_1.getMobileAIClient)();
       const auditGroupId = `mobile-generate-${(0, crypto_1.randomUUID)().slice(0, 8)}`;
       const targetAppId = ctx.target?.appId?.trim() || void 0;
+      const { secrets: credentialSecrets } = (0, credential_tools_js_1.partitionTestVariables)(ctx.variableContext?.allTestVariables ?? ctx.variableContext?.publicTestVariables);
       const skipSet = new Set(skipScenarioNames ?? []);
       const scenarios = skipSet.size > 0 ? allScenarios.filter((s) => !skipSet.has(s.name)) : allScenarios;
       if (skipSet.size > 0) {
@@ -67069,6 +67265,7 @@ ${statePacket}` },
             onAICall,
             onScreenshot,
             targetAppId,
+            credentials: credentialSecrets,
             log: log2
           });
           consecutiveInfraFailures = 0;
@@ -313691,9 +313888,12 @@ Generation complete: ${tests.length} tests generated (${generateElapsed}s elapse
         });
         let featureInsight;
         if (mode === "deep" && ctx.featureName) {
+          const targetName = ctx.featureName.trim().toLowerCase();
+          const plannedGroup = (featureGroups ?? []).find((group) => group.name.trim().toLowerCase() === targetName);
+          const plannedDescription = plannedGroup?.description?.trim();
           featureInsight = {
             featureName: ctx.featureName,
-            description: `Mobile feature "${ctx.featureName}": ${explore.exploreStats.pagesDiscovered} screens explored, ${tests.length} tests generated.`
+            description: plannedDescription && plannedDescription.length > 0 ? plannedDescription : `Mobile feature "${ctx.featureName}": ${explore.exploreStats.pagesDiscovered} screens explored, ${tests.length} tests generated.`
           };
         }
         const duration = (Date.now() - startTime) / 1e3;
@@ -328229,7 +328429,7 @@ var require_package4 = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.17",
+      version: "1.0.18",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"
@@ -330507,6 +330707,10 @@ async function executeMobileTest(options) {
   const logLines = [];
   const log2 = (msg) => logLines.push(`[${(/* @__PURE__ */ new Date()).toISOString()}] ${msg}`);
   const startTime = Date.now();
+  const { steps: runSteps, missingKeys: missingVariableKeys } = resolveMobileStepValuePlaceholders(options.steps, options.testVariables);
+  if (missingVariableKeys.length > 0) {
+    log2(`\u26A0 Unresolved step-value placeholder(s): ${missingVariableKeys.map((k) => `{{${k}}}`).join(", ")} \u2014 no matching test variable configured for this project/run.`);
+  }
   const stepResults = [];
   const screenshots = [];
   let apiCalls = [];
@@ -330644,7 +330848,7 @@ async function executeMobileTest(options) {
     let entryDrift = false;
     const runPlatform = options.target.platform;
     const isCrossPlatform = options.target.authoringPlatform != null && options.target.authoringPlatform !== runPlatform;
-    const entryStep = options.steps.find(
+    const entryStep = runSteps.find(
       (s) => s.action !== "launchApp" && stepAppliesToPlatform(s, runPlatform) && buildIdentityLocatorStrategies(s.target, runPlatform).length > 0
     );
     if (entryStep) {
@@ -330661,7 +330865,7 @@ async function executeMobileTest(options) {
       }
     }
     let environmental = null;
-    for (const step of options.steps) {
+    for (const step of runSteps) {
       if (entryDrift) break;
       if (!stepAppliesToPlatform(step, runPlatform)) {
         log2(`Step ${step.order}: ${step.action} \u2014 skipped (not applicable to ${runPlatform})`);
@@ -330749,7 +330953,7 @@ async function executeMobileTest(options) {
     }
     const executedResults = stepResults.filter((r) => r.status !== "skipped");
     const verifyOrders = new Set(
-      options.steps.filter((s) => VERIFICATION_ACTIONS.has(s.action)).map((s) => s.order)
+      runSteps.filter((s) => VERIFICATION_ACTIONS.has(s.action)).map((s) => s.order)
     );
     const anyVerificationPassed = stepResults.some((r) => r.status === "passed" && verifyOrders.has(r.stepOrder));
     const crossPlatformUnverified = isCrossPlatform && verifyOrders.size > 0 && !anyVerificationPassed;
@@ -330989,11 +331193,15 @@ async function harvestPlatformLocators(options) {
   const log2 = (msg) => {
     logLines.push(`[${(/* @__PURE__ */ new Date()).toISOString()}] ${msg}`);
   };
+  const { steps: harvestSteps, missingKeys: missingVariableKeys } = resolveMobileStepValuePlaceholders(options.steps, options.testVariables);
+  if (missingVariableKeys.length > 0) {
+    log2(`\u26A0 Unresolved step-value placeholder(s): ${missingVariableKeys.map((k) => `{{${k}}}`).join(", ")} \u2014 no matching test variable configured.`);
+  }
   const bundles = {};
   const divergentOrders = [];
   let reachedOrder = null;
   let environmentalError;
-  log2(`Cross-platform locator discovery \u2014 resolving ${platform3} locators for ${options.steps.length} steps`);
+  log2(`Cross-platform locator discovery \u2014 resolving ${platform3} locators for ${harvestSteps.length} steps`);
   const session = await createMobileDiscoverySession({
     appId: options.target.appId,
     platform: platform3,
@@ -331013,7 +331221,7 @@ async function harvestPlatformLocators(options) {
       }
     }
     await restoreTargetAppIfExternal(session.sessionId, { appId: options.target.appId, platform: platform3 }, log2, "harvest start", false);
-    for (const step of options.steps) {
+    for (const step of harvestSteps) {
       if (step.action === "launchApp") continue;
       if (!stepAppliesToPlatform(step, platform3)) continue;
       let elementId = null;
@@ -331257,12 +331465,46 @@ async function tapAt(sessionPath, bounds) {
     throw new Error("TAP requires usable bounds (finite x/y)");
   }
 }
-async function typeText(sessionPath, value, bounds) {
+async function getElementRect(sessionPath, elementId) {
+  try {
+    const value = readValue(await appiumRequest(`${sessionPath}/element/${elementId}/rect`));
+    if (!value || typeof value !== "object") return null;
+    const r = value;
+    if (typeof r.x !== "number" || typeof r.y !== "number" || typeof r.width !== "number" || typeof r.height !== "number" || !Number.isFinite(r.x) || !Number.isFinite(r.y)) {
+      return null;
+    }
+    return { x: r.x, y: r.y, width: r.width, height: r.height };
+  } catch {
+    return null;
+  }
+}
+function rectMatchesIntendedBounds(rect, bounds) {
+  if (bounds.width <= 0 || bounds.height <= 0) return false;
+  const rectCenterX = rect.x + rect.width / 2;
+  const rectCenterY = rect.y + rect.height / 2;
+  const boundsCenterX = bounds.x + bounds.width / 2;
+  const boundsCenterY = bounds.y + bounds.height / 2;
+  const rectCenterInBounds = rectCenterX >= bounds.x && rectCenterX <= bounds.x + bounds.width && rectCenterY >= bounds.y && rectCenterY <= bounds.y + bounds.height;
+  const boundsCenterInRect = rect.width > 0 && rect.height > 0 && boundsCenterX >= rect.x && boundsCenterX <= rect.x + rect.width && boundsCenterY >= rect.y && boundsCenterY <= rect.y + rect.height;
+  return rectCenterInBounds || boundsCenterInRect;
+}
+async function resolveTypeTargetElementId(sessionPath, bounds) {
+  const box = bounds !== void 0 ? normaliseBounds(bounds) : null;
   let elementId = await getActiveElementId2(sessionPath);
+  if (elementId && box && box.width > 0 && box.height > 0) {
+    const rect = await getElementRect(sessionPath, elementId);
+    if (!rect || !rectMatchesIntendedBounds(rect, box)) {
+      elementId = null;
+    }
+  }
   if (!elementId && bounds !== void 0 && await tapBoundsCenter(sessionPath, bounds)) {
     await new Promise((resolve) => setTimeout(resolve, MOBILE_FOCUS_SETTLE_MS));
     elementId = await getActiveElementId2(sessionPath);
   }
+  return elementId;
+}
+async function typeText(sessionPath, value, bounds) {
+  const elementId = await resolveTypeTargetElementId(sessionPath, bounds);
   if (!elementId) {
     throw new Error("No focused element available for TYPE. Tap an input field first.");
   }
@@ -331272,11 +331514,7 @@ async function typeText(sessionPath, value, bounds) {
   });
 }
 async function clearField(sessionPath, bounds) {
-  let elementId = await getActiveElementId2(sessionPath);
-  if (!elementId && bounds !== void 0 && await tapBoundsCenter(sessionPath, bounds)) {
-    await new Promise((resolve) => setTimeout(resolve, MOBILE_FOCUS_SETTLE_MS));
-    elementId = await getActiveElementId2(sessionPath);
-  }
+  const elementId = await resolveTypeTargetElementId(sessionPath, bounds);
   if (!elementId) {
     throw new Error("No focused element available for CLEAR. Tap an input field first.");
   }
@@ -333026,6 +333264,7 @@ function scrubAuditMessages(messages, testVariables) {
   const secretValues = Object.values(testVariables).filter((v) => typeof v === "string" && v.length >= 4).sort((a, b) => b.length - a.length);
   if (secretValues.length === 0) return compacted;
   let json = JSON.stringify(compacted);
+  if (typeof json !== "string") return compacted;
   for (const val of secretValues) {
     const escaped = val.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     json = json.replace(new RegExp(escaped, "g"), "[REDACTED]");
@@ -334377,7 +334616,9 @@ ${finalVerifyResult.logs ?? ""}`;
             },
             onSessionEnding: (deviceId) => {
               detachMirrorSession(deviceId);
-            }
+            },
+            // Resolve {{KEY}} credential placeholders in guided-replay TYPE steps.
+            testVariables: run2.testVariables
           });
           let queuedRunId = null;
           let resultPosted = false;
@@ -335146,7 +335387,11 @@ ${finalVerifyResult.logs ?? ""}`;
             },
             onSessionEnding: (deviceId) => {
               detachMirrorSession(deviceId);
-            }
+            },
+            // Resolve {{KEY}} credential placeholders (recorded by the mobile
+            // discovery generator instead of secret values) against this run's
+            // CURRENT test variables.
+            testVariables: run2.testVariables
           });
           attemptLogs.push(`--- Appium attempt ${attempt + 1}/${maxRetries + 1} ---
 ${result2.logs}`);

package/dist/cli.mjs

@@ -1028,6 +1028,10 @@ var require_mobile_source_parser = __commonJS({
       }
       return fnv1a(parts.join("\n"));
     }
+    var EDITABLE_CLASS_RE = /(EditText|AutoCompleteTextView|XCUIElementTypeTextField|XCUIElementTypeSecureTextField|XCUIElementTypeSearchField|XCUIElementTypeTextView)$/;
+    function isEditableElement(el) {
+      return EDITABLE_CLASS_RE.test(el.role.trim());
+    }
     function buildLocatorBundle(el, platform3) {
       const bundle = {
         xpath: el.xpath,
@@ -1037,7 +1041,7 @@ var require_mobile_source_parser = __commonJS({
         bundle.accessibilityId = el.accessibilityId;
       if (platform3 === "ANDROID" && el.resourceId)
         bundle.resourceId = el.resourceId;
-      if (el.text)
+      if (el.text && !isEditableElement(el))
         bundle.text = el.text;
       if (platform3 === "ANDROID" && el.accessibilityId)
         bundle.contentDesc = el.accessibilityId;
@@ -1048,7 +1052,7 @@ var require_mobile_source_parser = __commonJS({
         return el.accessibilityId;
       if (el.resourceId)
         return el.resourceId;
-      if (el.text)
+      if (el.text && !isEditableElement(el))
         return el.text;
       return el.xpath;
     }
@@ -1368,6 +1372,31 @@ function toInlineCommentText(value) {
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function isEditableMobileClassName(className) {
+  if (!className)
+    return false;
+  return /(EditText|AutoCompleteTextView|XCUIElementTypeTextField|XCUIElementTypeSecureTextField|XCUIElementTypeSearchField|XCUIElementTypeTextView)$/.test(className.trim());
+}
+function mobileCredentialPlaceholder(key) {
+  return `{{${key}}}`;
+}
+function resolveMobileStepValuePlaceholders(steps, variables) {
+  const missing = /* @__PURE__ */ new Set();
+  const vars = variables ?? {};
+  const resolved = steps.map((step) => {
+    if (typeof step.value !== "string" || !step.value.includes("{{"))
+      return step;
+    const value = step.value.replace(MOBILE_VALUE_PLACEHOLDER_RE, (token, key) => {
+      const substitute = vars[key];
+      if (typeof substitute === "string" && substitute.length > 0)
+        return substitute;
+      missing.add(key);
+      return token;
+    });
+    return value === step.value ? step : { ...step, value };
+  });
+  return { steps: resolved, missingKeys: [...missing] };
+}
 function readMobileMetadata(value) {
   if (!isPlainObject(value)) {
     return { screenName: "UnknownScreen" };
@@ -1409,7 +1438,11 @@ function buildStepTarget(metadata, selector) {
   const primary = nonEmpty(locatorBundle.accessibilityId) ?? nonEmpty(locatorBundle.resourceId) ?? trimmedSelector ?? nonEmpty(locatorBundle.xpath) ?? locatorBundle.xpath;
   const fallbackCandidates = [
     locatorBundle.resourceId,
-    locatorBundle.text,
+    // For editable fields the text attribute IS the currently-typed value — a
+    // self-invalidating locator that only matches while the recorded text is
+    // still in the field (and it can leak typed input into locators). Static
+    // elements keep their text fallback.
+    isEditableMobileClassName(locatorBundle.className) ? void 0 : locatorBundle.text,
     locatorBundle.contentDesc,
     locatorBundle.xpath,
     selector
@@ -1840,7 +1873,7 @@ function isRunnableStep(step) {
       return false;
   }
 }
-var STEP_ACTION_BY_ACTION_TYPE;
+var STEP_ACTION_BY_ACTION_TYPE, MOBILE_VALUE_PLACEHOLDER_RE;
 var init_mobile_test_generation = __esm({
   "../shared/dist/mobile-test-generation.js"() {
     "use strict";
@@ -1858,6 +1891,7 @@ var init_mobile_test_generation = __esm({
       ASSERT_VISIBLE: "assertVisible",
       ASSERT_TEXT: "assertText"
     };
+    MOBILE_VALUE_PLACEHOLDER_RE = /\{\{([A-Za-z0-9_]+)\}\}/g;
   }
 });
 
@@ -3699,6 +3733,7 @@ __export(dist_exports, {
   isCountedFailure: () => isCountedFailure,
   isCreditPackAmountCents: () => isCreditPackAmountCents,
   isDbPricingPlan: () => isDbPricingPlan,
+  isEditableMobileClassName: () => isEditableMobileClassName,
   isEnvironmentalError: () => isEnvironmentalError,
   isMobilePlatform: () => isMobilePlatform,
   isPricingPlan: () => isPricingPlan,
@@ -3710,6 +3745,7 @@ __export(dist_exports, {
   isUIVariant: () => isUIVariant,
   isValidMobileAppId: () => isValidMobileAppId,
   mediumForMobilePlatform: () => mediumForMobilePlatform,
+  mobileCredentialPlaceholder: () => mobileCredentialPlaceholder,
   mobilePlatformFromMedium: () => mobilePlatformFromMedium,
   normalizeControlName: () => normalizeControlName,
   otherMobilePlatform: () => otherMobilePlatform,
@@ -3719,6 +3755,7 @@ __export(dist_exports, {
   platformTag: () => platformTag,
   registrableDomain: () => registrableDomain,
   resolveCrossOriginConfigOverride: () => resolveCrossOriginConfigOverride,
+  resolveMobileStepValuePlaceholders: () => resolveMobileStepValuePlaceholders,
   resolvePlatformLocatorBundle: () => resolvePlatformLocatorBundle,
   safeOrigin: () => safeOrigin,
   sanitizeTestVariables: () => sanitizeTestVariables,
@@ -65578,6 +65615,7 @@ Return ONLY one valid JSON object matching the schema below. Do NOT include <thi
 6. Do NOT merge screens into one feature just because they serve a similar broader goal. Treat areas as separate features when the evidence shows separate primary navigation destinations (e.g. separate tab-bar items or drawer links), separate screen families for distinct entities, or different CRUD entities/forms. Keep screens together when they share one navigational area and operate on the same entity (e.g. a list screen, its filter/sort sheet, and its detail screen all belong together).
 7. Feature descriptions MUST reference actual element labels / accessibility-ids from the evidence
 8. Do NOT create standalone features for generic error / empty screens (network-error, permission-denied). If a feature screen is broken or crashes, keep it in its intended feature and note the failure in the description.
+9. COVER EVERY SCREEN: every explored screen except generic error / permission screens MUST appear in exactly one feature group's routes. Do not leave screens ungrouped \u2014 a screen the explorer reached is part of SOME feature. Attach an ambiguous screen to its most closely related feature and note the ambiguity in that feature's description. Sign-in / sign-up / forgot-password screens form an "Authentication" group even when they were only reached via links from other screens.
 
 ## Output JSON Schema
 {
@@ -65785,7 +65823,8 @@ ${context.appBrief.slice(0, 500)}`);
       sections.push(`## App Under Test
 ${targetBits.length > 0 ? targetBits.join(" ") : "native mobile app"}`);
       if (context.featureName) {
-        sections.push(`## Feature: ${context.featureName}`);
+        sections.push(`## Feature: ${context.featureName}
+SCOPE: this is a feature-focused deep run. Plan scenarios ONLY for the "${context.featureName}" feature \u2014 its screens, forms, and flows. Screens belonging to other features are navigation context / prerequisites only; do NOT plan scenarios whose primary goal exercises another feature.`);
       }
       const orderedScreens = targetAppScreens(graph, context.appId).sort((a, b) => a.firstSeenIteration - b.firstSeenIteration);
       const includedScreenIds = new Set(orderedScreens.map((state2) => state2.screenId));
@@ -66170,10 +66209,12 @@ var require_mobile_generator = __commonJS({
   "../runner-core/dist/services/mobile/mobile-generator.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
+    exports.collapseRetryCycles = collapseRetryCycles;
     exports.runMobileGeneratePhase = runMobileGeneratePhase;
     var crypto_1 = __require("crypto");
     var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var ai_provider_js_1 = require_ai_provider();
+    var credential_tools_js_1 = require_credential_tools();
     var ai_queue_js_1 = require_ai_queue();
     var ai_retry_js_1 = require_ai_retry();
     var mobile_source_parser_js_1 = require_mobile_source_parser();
@@ -66295,6 +66336,24 @@ var require_mobile_generator = __commonJS({
         }
       }
     };
+    var MOBILE_FILL_CREDENTIAL_TOOL = {
+      type: "function",
+      function: {
+        name: "mobile_fill_credential",
+        description: 'Fill a stored credential VALUE into a text field. ALWAYS use this instead of mobile_type for ANY email/password/token/auth field. Pass the field ref (eN) and the variable KEY (e.g. "TEST_USER_EMAIL"); the runner types the real value on the device and the generated test stores a {{KEY}} placeholder \u2014 you never see the secret. Available keys are listed in the Test Credentials section of the system prompt.',
+        parameters: {
+          type: "object",
+          properties: {
+            ref: { type: "string", description: 'Text-field element ref from the latest mobile_snapshot, e.g. "e5".' },
+            credentialKey: {
+              type: "string",
+              description: 'The credential variable name (e.g. "TEST_USER_EMAIL", "TEST_USER_PASSWORD"). Must be one of the keys listed in the Test Credentials section of the prompt.'
+            }
+          },
+          required: ["ref", "credentialKey"]
+        }
+      }
+    };
     var FINISH_GENERATE_TOOL = {
       type: "function",
       function: {
@@ -66316,6 +66375,7 @@ var require_mobile_generator = __commonJS({
       MOBILE_TAP_TOOL,
       MOBILE_TYPE_TOOL,
       MOBILE_CLEAR_TOOL,
+      MOBILE_FILL_CREDENTIAL_TOOL,
       MOBILE_SWIPE_TOOL,
       MOBILE_BACK_TOOL,
       MOBILE_RELAUNCH_TOOL,
@@ -66394,6 +66454,24 @@ var require_mobile_generator = __commonJS({
 - Finish promptly once the outcome is proven: the instant the expected outcome is visible, assert it and call finish_generate. Do not keep exploring after the goal is proven.
 
 Max iterations: ${MAX_SCENARIO_ITERATIONS}. You will be warned near the end.`;
+    }
+    function buildGenerateCredentialPromptBlock(secrets) {
+      const keys = Object.keys(secrets).filter((k) => secrets[k] && secrets[k].length > 0);
+      if (keys.length === 0)
+        return "";
+      const keyList = keys.map((k) => `- \`${k}\``).join("\n");
+      return `
+
+## Test Credentials (values are HIDDEN from you)
+This app has stored login credentials under these keys:
+${keyList}
+
+When a scenario needs a signed-in session or fills a login/sign-up form, fill each credential field with \`mobile_fill_credential\`: pass the field ref and the KEY (e.g. \`{ ref: "e5", credentialKey: "TEST_USER_EMAIL" }\`). The runner types the real value on the device and the generated test stores a \`{{KEY}}\` placeholder that replay resolves \u2014 you never see, log, or echo the secret.
+
+SECURITY RULES:
+- NEVER call \`mobile_type\` with a real email, password, or token value \u2014 the runner will REJECT the call and you lose an iteration. Use \`mobile_fill_credential\` for every credential field.
+- For validation scenarios (wrong password, empty submit) you MAY \`mobile_type\` synthetic invalid values like "wrong@example.com" / "badpassword" \u2014 those are not real credentials and are allowed.
+- NEVER put credential values in test names, descriptions, or assert texts.`;
     }
     function buildScenarioKickoff(scenario) {
       const stepLines = scenario.steps.map((step, i) => `  ${i + 1}. ${step.action}${step.target ? ` (target: ${step.target})` : ""}${step.hint ? ` [hint: ${step.hint}]` : ""}`).join("\n");
@@ -66464,7 +66542,7 @@ Start by calling mobile_snapshot, then execute the steps above \u2014 the minimu
       }
     }
     async function runScenarioLoop(args) {
-      const { scenario, driver, platform: platform3, maxIterations, agentModel, provider, aiClient, auditGroupId, onAICall, onScreenshot, targetAppId, log: log2 } = args;
+      const { scenario, driver, platform: platform3, maxIterations, agentModel, provider, aiClient, auditGroupId, onAICall, onScreenshot, targetAppId, credentials, log: log2 } = args;
       const actions = [];
       let assertCount = 0;
       let finish = null;
@@ -66581,7 +66659,7 @@ Start by calling mobile_snapshot, then execute the steps above \u2014 the minimu
       } catch (err) {
         log2(`  seed snapshot failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
       }
-      const systemPrompt = buildSystemPrompt(platform3, targetAppId);
+      const systemPrompt = buildSystemPrompt(platform3, targetAppId) + buildGenerateCredentialPromptBlock(credentials);
       const kickoff = buildScenarioKickoff(scenario);
       const recentExchanges = [];
       let iteration = 0;
@@ -66694,6 +66772,7 @@ ${statePacket}` },
               latest: getLatest,
               absorbObservation,
               resolveRef,
+              credentials,
               screenName: () => lastScreenName || "UnknownScreen",
               recordAction: (action) => {
                 actions.push(finalizeAction(action));
@@ -66715,7 +66794,7 @@ ${statePacket}` },
       return { actions, assertCount, finish, lastSnapshot: getLatest(), lastScreenName };
     }
     async function dispatchGenerateTool(args) {
-      const { toolName, toolArgs, driver, platform: platform3, latest, absorbObservation, resolveRef, screenName, recordAction, log: log2 } = args;
+      const { toolName, toolArgs, driver, platform: platform3, latest, absorbObservation, resolveRef, credentials, screenName, recordAction, log: log2 } = args;
       const unknownRef = (ref) => ({
         ok: false,
         error: `Unknown element ref "${String(ref)}". Call mobile_snapshot first; refs are only valid for the latest snapshot.`
@@ -66781,6 +66860,14 @@ ${statePacket}` },
           if (!element)
             return unknownRef(toolArgs.ref);
           const value = typeof toolArgs.value === "string" ? toolArgs.value : String(toolArgs.value ?? "");
+          for (const [key, secret] of Object.entries(credentials)) {
+            if (secret && secret.length >= 4 && value.includes(secret)) {
+              return {
+                ok: false,
+                error: `BLOCKED: mobile_type contained the stored credential value for "${key}". Use mobile_fill_credential({ ref, credentialKey: "${key}" }) instead of typing the credential directly.`
+              };
+            }
+          }
           const beforeScreenName = screenName();
           const result = await driver.type(value, element.bounds);
           const absorbed = await absorbObservation(result.source, result.screenSignal, latest()?.screen.windowSize ?? null, result.screenshot, "mobile_type");
@@ -66794,6 +66881,37 @@ ${statePacket}` },
           }
           return actionPayload(result, absorbed);
         }
+        // KEY-based credential fill: type the real value on-device, persist only a
+        // {{KEY}} placeholder in the recorded step (replay resolves it against the
+        // run's current test variables). The tool result echoes the KEY, never the
+        // value, so the secret cannot enter the transcript.
+        case "mobile_fill_credential": {
+          const key = typeof toolArgs.credentialKey === "string" ? toolArgs.credentialKey.trim() : "";
+          if (!key) {
+            return { ok: false, error: 'mobile_fill_credential: missing required "credentialKey".' };
+          }
+          const secret = credentials[key];
+          if (!secret) {
+            const available = Object.keys(credentials).filter((k) => credentials[k]).join(", ") || "(none configured)";
+            return { ok: false, error: `mobile_fill_credential: no credential configured for key "${key}". Available keys: ${available}` };
+          }
+          const element = resolveRef(toolArgs.ref);
+          if (!element)
+            return unknownRef(toolArgs.ref);
+          const beforeScreenName = screenName();
+          const result = await driver.type(secret, element.bounds);
+          const absorbed = await absorbObservation(result.source, result.screenSignal, latest()?.screen.windowSize ?? null, result.screenshot, "mobile_fill_credential");
+          if (shouldRecordAction(result, absorbed)) {
+            recordAction({
+              type: "TYPE",
+              value: (0, shared_1.mobileCredentialPlaceholder)(key),
+              selector: (0, mobile_source_parser_js_2.preferredLocator)(element),
+              metadata: metadataForElement(element, beforeScreenName, platform3)
+            });
+            log2(`  fill_credential: recorded {{${key}}} into ${labelForElement(element)}`);
+          }
+          return { ...actionPayload(result, absorbed), filledCredentialKey: key };
+        }
         case "mobile_clear": {
           const element = resolveRef(toolArgs.ref);
           if (!element)
@@ -66942,18 +67060,40 @@ ${statePacket}` },
       return labelled ?? elements.find((el) => !isAlwaysPresentContainer(el)) ?? elements[0];
     }
     var ALWAYS_PRESENT_CONTAINER_ROLES = /^(XCUIElementTypeApplication|XCUIElementTypeWindow)$/;
-    var ALWAYS_PRESENT_CONTAINER_RESOURCE_IDS = /* @__PURE__ */ new Set([
-      "android:id/content",
-      "android:id/decor",
-      "android:id/action_bar_root",
-      "android:id/statusBarBackground",
-      "android:id/navigationBarBackground"
+    var ALWAYS_PRESENT_CONTAINER_ID_NAMES = /* @__PURE__ */ new Set([
+      "content",
+      "decor",
+      "decor_content_parent",
+      "action_bar_root",
+      "statusBarBackground",
+      "navigationBarBackground",
+      // WebView hybrid apps (React/Vue/etc. rendered inside android.webkit.WebView)
+      // expose their framework ROOT container's DOM id as the element id — present on
+      // EVERY in-app screen, so the floor must not anchor to it (observed live on
+      // ThoughtStream: `main-content` produced a screen-agnostic assertion that then
+      // never matched via the text-contains fallback).
+      "main-content",
+      "root",
+      "app",
+      "app-root",
+      "__next",
+      "react-root",
+      "application"
     ]);
     function isAlwaysPresentContainer(element) {
       if (ALWAYS_PRESENT_CONTAINER_ROLES.test(element.role))
         return true;
       const resourceId = element.resourceId?.trim();
-      return !!resourceId && ALWAYS_PRESENT_CONTAINER_RESOURCE_IDS.has(resourceId);
+      if (resourceId) {
+        const slashIdx = resourceId.indexOf("/");
+        const localName = slashIdx >= 0 ? resourceId.slice(slashIdx + 1) : resourceId;
+        if (ALWAYS_PRESENT_CONTAINER_ID_NAMES.has(localName))
+          return true;
+      }
+      const accessibilityId = element.accessibilityId?.trim();
+      if (accessibilityId && ALWAYS_PRESENT_CONTAINER_ID_NAMES.has(accessibilityId))
+        return true;
+      return false;
     }
     function appendHybridFloor(actions, recording, platform3) {
       const anchor = pickLandingAnchor(recording.lastSnapshot);
@@ -66967,9 +67107,38 @@ ${statePacket}` },
       }));
       return true;
     }
+    function actionCycleKey(action) {
+      return `${action.type}|${action.selector}|${action.value ?? ""}`;
+    }
+    var MAX_RETRY_CYCLE_LENGTH = 8;
+    function collapseRetryCycles(actions) {
+      const out = [...actions];
+      let changed = true;
+      while (changed) {
+        changed = false;
+        const maxWindow = Math.min(MAX_RETRY_CYCLE_LENGTH, Math.floor(out.length / 2));
+        for (let window2 = maxWindow; window2 >= 2 && !changed; window2--) {
+          for (let i = 0; i + 2 * window2 <= out.length; i++) {
+            const first = out.slice(i, i + window2);
+            if (first.some((a) => a.type === "ASSERT_VISIBLE" || a.type === "ASSERT_TEXT"))
+              continue;
+            const second = out.slice(i + window2, i + 2 * window2);
+            if (!first.every((a, k) => actionCycleKey(a) === actionCycleKey(second[k])))
+              continue;
+            out.splice(i, window2);
+            changed = true;
+            break;
+          }
+        }
+      }
+      return out;
+    }
     function assembleTest(args) {
       const { scenario, recording, ctx, platform: platform3, log: log2 } = args;
-      const actions = [...recording.actions];
+      const actions = collapseRetryCycles(recording.actions);
+      if (actions.length < recording.actions.length) {
+        log2(`  collapsed ${recording.actions.length - actions.length} retry-cycle step(s) out of the recorded trace (${recording.actions.length} \u2192 ${actions.length}).`);
+      }
       const floorAppended = appendHybridFloor(actions, recording, platform3);
       if (floorAppended) {
         log2("  appended hybrid durable-outcome floor (landing-screen ASSERT_VISIBLE).");
@@ -67008,6 +67177,12 @@ ${statePacket}` },
         playwrightCode: "",
         verified,
         tags,
+        // Per-test feature label → TestCase.suite. One deep run plans scenarios for
+        // MULTIPLE feature groups (the planner reuses survey feature names), so the
+        // run-level ctx.featureName fallback in /discovery-test would wrongly file
+        // every test under the deep-dived feature. The scenario's own group is the
+        // correct home; the runner forwards it as `suiteName`.
+        ...scenario.featureGroup?.trim() ? { suiteName: scenario.featureGroup.trim() } : {},
         // Carry the planner scenario identity so incremental/resume can match an
         // already-generated scenario reliably (scenarioRef.name === the plan's
         // scenario name). Without this the resume skip-set falls back to the
@@ -67025,7 +67200,27 @@ ${statePacket}` },
             startFromLanding: scenario.startFromLanding,
             targetPages: [...scenario.targetPages]
           },
-          evidence: { observedLocators: [], observedTransitions: [] }
+          evidence: { observedLocators: [], observedTransitions: [] },
+          // Assertion-strength marker for the server promote-seam
+          // (resolveStabilityTransition): an UNVERIFIED recording proves none of the
+          // scenario's outcomes — only the hybrid floor's landing-screen visibility —
+          // so a passing replay is vacuous. Hold it as DRAFT (@needs-review) for a
+          // human instead of letting the pass auto-promote it into the ACTIVE suite.
+          // Mirrors the recorder mobile path (server test-pipeline.ts @unverified).
+          ...verified ? {} : {
+            gateActivity: {
+              outcomeGate: {
+                requiredCount: scenario.expectedOutcomes.length,
+                uncoveredCount: scenario.expectedOutcomes.length
+              },
+              strengthGate: {
+                fired: false,
+                severity: "block",
+                blocked: true,
+                reason: "Mobile scenario finished unverified \u2014 the agent never proved the scenario outcome live, so the recording may not demonstrate the goal (e.g. a happy path that never completed). Review before promotion."
+              }
+            }
+          }
         }
       };
       return test;
@@ -67046,6 +67241,7 @@ ${statePacket}` },
       const aiClient = modelOverride ? (0, ai_provider_js_1.getMobileClientForModel)(modelOverride) : (0, ai_provider_js_1.getMobileAIClient)();
       const auditGroupId = `mobile-generate-${(0, crypto_1.randomUUID)().slice(0, 8)}`;
       const targetAppId = ctx.target?.appId?.trim() || void 0;
+      const { secrets: credentialSecrets } = (0, credential_tools_js_1.partitionTestVariables)(ctx.variableContext?.allTestVariables ?? ctx.variableContext?.publicTestVariables);
       const skipSet = new Set(skipScenarioNames ?? []);
       const scenarios = skipSet.size > 0 ? allScenarios.filter((s) => !skipSet.has(s.name)) : allScenarios;
       if (skipSet.size > 0) {
@@ -67074,6 +67270,7 @@ ${statePacket}` },
             onAICall,
             onScreenshot,
             targetAppId,
+            credentials: credentialSecrets,
             log: log2
           });
           consecutiveInfraFailures = 0;
@@ -313696,9 +313893,12 @@ Generation complete: ${tests.length} tests generated (${generateElapsed}s elapse
         });
         let featureInsight;
         if (mode === "deep" && ctx.featureName) {
+          const targetName = ctx.featureName.trim().toLowerCase();
+          const plannedGroup = (featureGroups ?? []).find((group) => group.name.trim().toLowerCase() === targetName);
+          const plannedDescription = plannedGroup?.description?.trim();
           featureInsight = {
             featureName: ctx.featureName,
-            description: `Mobile feature "${ctx.featureName}": ${explore.exploreStats.pagesDiscovered} screens explored, ${tests.length} tests generated.`
+            description: plannedDescription && plannedDescription.length > 0 ? plannedDescription : `Mobile feature "${ctx.featureName}": ${explore.exploreStats.pagesDiscovered} screens explored, ${tests.length} tests generated.`
           };
         }
         const duration = (Date.now() - startTime) / 1e3;
@@ -328234,7 +328434,7 @@ var require_package4 = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.17",
+      version: "1.0.18",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"
@@ -330515,6 +330715,10 @@ async function executeMobileTest(options) {
   const logLines = [];
   const log2 = (msg) => logLines.push(`[${(/* @__PURE__ */ new Date()).toISOString()}] ${msg}`);
   const startTime = Date.now();
+  const { steps: runSteps, missingKeys: missingVariableKeys } = resolveMobileStepValuePlaceholders(options.steps, options.testVariables);
+  if (missingVariableKeys.length > 0) {
+    log2(`\u26A0 Unresolved step-value placeholder(s): ${missingVariableKeys.map((k) => `{{${k}}}`).join(", ")} \u2014 no matching test variable configured for this project/run.`);
+  }
   const stepResults = [];
   const screenshots = [];
   let apiCalls = [];
@@ -330652,7 +330856,7 @@ async function executeMobileTest(options) {
     let entryDrift = false;
     const runPlatform = options.target.platform;
     const isCrossPlatform = options.target.authoringPlatform != null && options.target.authoringPlatform !== runPlatform;
-    const entryStep = options.steps.find(
+    const entryStep = runSteps.find(
       (s) => s.action !== "launchApp" && stepAppliesToPlatform(s, runPlatform) && buildIdentityLocatorStrategies(s.target, runPlatform).length > 0
     );
     if (entryStep) {
@@ -330669,7 +330873,7 @@ async function executeMobileTest(options) {
       }
     }
     let environmental = null;
-    for (const step of options.steps) {
+    for (const step of runSteps) {
       if (entryDrift) break;
       if (!stepAppliesToPlatform(step, runPlatform)) {
         log2(`Step ${step.order}: ${step.action} \u2014 skipped (not applicable to ${runPlatform})`);
@@ -330757,7 +330961,7 @@ async function executeMobileTest(options) {
     }
     const executedResults = stepResults.filter((r) => r.status !== "skipped");
     const verifyOrders = new Set(
-      options.steps.filter((s) => VERIFICATION_ACTIONS.has(s.action)).map((s) => s.order)
+      runSteps.filter((s) => VERIFICATION_ACTIONS.has(s.action)).map((s) => s.order)
     );
     const anyVerificationPassed = stepResults.some((r) => r.status === "passed" && verifyOrders.has(r.stepOrder));
     const crossPlatformUnverified = isCrossPlatform && verifyOrders.size > 0 && !anyVerificationPassed;
@@ -330997,11 +331201,15 @@ async function harvestPlatformLocators(options) {
   const log2 = (msg) => {
     logLines.push(`[${(/* @__PURE__ */ new Date()).toISOString()}] ${msg}`);
   };
+  const { steps: harvestSteps, missingKeys: missingVariableKeys } = resolveMobileStepValuePlaceholders(options.steps, options.testVariables);
+  if (missingVariableKeys.length > 0) {
+    log2(`\u26A0 Unresolved step-value placeholder(s): ${missingVariableKeys.map((k) => `{{${k}}}`).join(", ")} \u2014 no matching test variable configured.`);
+  }
   const bundles = {};
   const divergentOrders = [];
   let reachedOrder = null;
   let environmentalError;
-  log2(`Cross-platform locator discovery \u2014 resolving ${platform3} locators for ${options.steps.length} steps`);
+  log2(`Cross-platform locator discovery \u2014 resolving ${platform3} locators for ${harvestSteps.length} steps`);
   const session = await createMobileDiscoverySession({
     appId: options.target.appId,
     platform: platform3,
@@ -331021,7 +331229,7 @@ async function harvestPlatformLocators(options) {
       }
     }
     await restoreTargetAppIfExternal(session.sessionId, { appId: options.target.appId, platform: platform3 }, log2, "harvest start", false);
-    for (const step of options.steps) {
+    for (const step of harvestSteps) {
       if (step.action === "launchApp") continue;
       if (!stepAppliesToPlatform(step, platform3)) continue;
       let elementId = null;
@@ -331265,12 +331473,46 @@ async function tapAt(sessionPath, bounds) {
     throw new Error("TAP requires usable bounds (finite x/y)");
   }
 }
-async function typeText(sessionPath, value, bounds) {
+async function getElementRect(sessionPath, elementId) {
+  try {
+    const value = readValue(await appiumRequest(`${sessionPath}/element/${elementId}/rect`));
+    if (!value || typeof value !== "object") return null;
+    const r = value;
+    if (typeof r.x !== "number" || typeof r.y !== "number" || typeof r.width !== "number" || typeof r.height !== "number" || !Number.isFinite(r.x) || !Number.isFinite(r.y)) {
+      return null;
+    }
+    return { x: r.x, y: r.y, width: r.width, height: r.height };
+  } catch {
+    return null;
+  }
+}
+function rectMatchesIntendedBounds(rect, bounds) {
+  if (bounds.width <= 0 || bounds.height <= 0) return false;
+  const rectCenterX = rect.x + rect.width / 2;
+  const rectCenterY = rect.y + rect.height / 2;
+  const boundsCenterX = bounds.x + bounds.width / 2;
+  const boundsCenterY = bounds.y + bounds.height / 2;
+  const rectCenterInBounds = rectCenterX >= bounds.x && rectCenterX <= bounds.x + bounds.width && rectCenterY >= bounds.y && rectCenterY <= bounds.y + bounds.height;
+  const boundsCenterInRect = rect.width > 0 && rect.height > 0 && boundsCenterX >= rect.x && boundsCenterX <= rect.x + rect.width && boundsCenterY >= rect.y && boundsCenterY <= rect.y + rect.height;
+  return rectCenterInBounds || boundsCenterInRect;
+}
+async function resolveTypeTargetElementId(sessionPath, bounds) {
+  const box = bounds !== void 0 ? normaliseBounds(bounds) : null;
   let elementId = await getActiveElementId2(sessionPath);
+  if (elementId && box && box.width > 0 && box.height > 0) {
+    const rect = await getElementRect(sessionPath, elementId);
+    if (!rect || !rectMatchesIntendedBounds(rect, box)) {
+      elementId = null;
+    }
+  }
   if (!elementId && bounds !== void 0 && await tapBoundsCenter(sessionPath, bounds)) {
     await new Promise((resolve) => setTimeout(resolve, MOBILE_FOCUS_SETTLE_MS));
     elementId = await getActiveElementId2(sessionPath);
   }
+  return elementId;
+}
+async function typeText(sessionPath, value, bounds) {
+  const elementId = await resolveTypeTargetElementId(sessionPath, bounds);
   if (!elementId) {
     throw new Error("No focused element available for TYPE. Tap an input field first.");
   }
@@ -331280,11 +331522,7 @@ async function typeText(sessionPath, value, bounds) {
   });
 }
 async function clearField(sessionPath, bounds) {
-  let elementId = await getActiveElementId2(sessionPath);
-  if (!elementId && bounds !== void 0 && await tapBoundsCenter(sessionPath, bounds)) {
-    await new Promise((resolve) => setTimeout(resolve, MOBILE_FOCUS_SETTLE_MS));
-    elementId = await getActiveElementId2(sessionPath);
-  }
+  const elementId = await resolveTypeTargetElementId(sessionPath, bounds);
   if (!elementId) {
     throw new Error("No focused element available for CLEAR. Tap an input field first.");
   }
@@ -333034,6 +333272,7 @@ function scrubAuditMessages(messages, testVariables) {
   const secretValues = Object.values(testVariables).filter((v) => typeof v === "string" && v.length >= 4).sort((a, b) => b.length - a.length);
   if (secretValues.length === 0) return compacted;
   let json = JSON.stringify(compacted);
+  if (typeof json !== "string") return compacted;
   for (const val of secretValues) {
     const escaped = val.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     json = json.replace(new RegExp(escaped, "g"), "[REDACTED]");
@@ -334385,7 +334624,9 @@ ${finalVerifyResult.logs ?? ""}`;
             },
             onSessionEnding: (deviceId) => {
               detachMirrorSession(deviceId);
-            }
+            },
+            // Resolve {{KEY}} credential placeholders in guided-replay TYPE steps.
+            testVariables: run2.testVariables
           });
           let queuedRunId = null;
           let resultPosted = false;
@@ -335154,7 +335395,11 @@ ${finalVerifyResult.logs ?? ""}`;
             },
             onSessionEnding: (deviceId) => {
               detachMirrorSession(deviceId);
-            }
+            },
+            // Resolve {{KEY}} credential placeholders (recorded by the mobile
+            // discovery generator instead of secret values) against this run's
+            // CURRENT test variables.
+            testVariables: run2.testVariables
           });
           attemptLogs.push(`--- Appium attempt ${attempt + 1}/${maxRetries + 1} ---
 ${result2.logs}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@validate.qa/runner",
-  "version": "1.0.17",
+  "version": "1.0.18",
   "description": "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
   "bin": {
     "validate-runner": "dist/cli.js"