@validate.qa/runner 1.0.39 → 1.0.41

package/dist/cli.mjs

@@ -275,7 +275,8 @@ var require_ai_provider = __commonJS({
       { id: "claude-sonnet-4-6", label: "Claude Sonnet 4.6", provider: "anthropic", description: "Anthropic - fast & intelligent, 200k ctx", contextWindow: 2e5 },
       { id: "nvidia-nemotron-nano", label: "NVIDIA Nemotron Nano", provider: "nvidia", description: "NVIDIA NIM - Nemotron 30B Nano, reasoning model, 128k ctx", contextWindow: 128e3 },
       { id: "nvidia-kimi-k2.6", label: "NVIDIA Kimi K2.6", provider: "nvidia", description: "NVIDIA NIM - Moonshot Kimi K2.6, multimodal coding and agentic model, 256k ctx", contextWindow: 256e3 },
-      { id: "deepseek-v4-flash", label: "DeepSeek V4 Flash", provider: "deepseek", description: "DeepSeek - V4 Flash, OpenAI-compatible, 1M ctx", contextWindow: 1e6 }
+      { id: "deepseek-v4-flash", label: "DeepSeek V4 Flash", provider: "deepseek", description: "DeepSeek - V4 Flash, OpenAI-compatible, 1M ctx", contextWindow: 1e6 },
+      { id: "deepseek-v4-pro", label: "DeepSeek V4 Pro", provider: "deepseek", description: "DeepSeek - V4 Pro, higher-quality reasoning tier, OpenAI-compatible, 1M ctx", contextWindow: 1e6 }
     ];
     var PROVIDER_DEFAULT_MODEL = {
       openai: "gpt-4o",
@@ -335,7 +336,8 @@ var require_ai_provider = __commonJS({
       "claude-sonnet-4-6": { strong: "claude-sonnet-4-6", fast: "claude-sonnet-4-6", agent: "claude-sonnet-4-6" },
       "nvidia-nemotron-nano": { strong: "nvidia/nemotron-3-nano-30b-a3b", fast: "nvidia/nemotron-3-nano-30b-a3b", agent: "nvidia/nemotron-3-nano-30b-a3b" },
       "nvidia-kimi-k2.6": { strong: "moonshotai/kimi-k2.6", fast: "moonshotai/kimi-k2.6", agent: "moonshotai/kimi-k2.6" },
-      "deepseek-v4-flash": { strong: "deepseek-v4-flash", fast: "deepseek-v4-flash", agent: "deepseek-v4-flash" }
+      "deepseek-v4-flash": { strong: "deepseek-v4-flash", fast: "deepseek-v4-flash", agent: "deepseek-v4-flash" },
+      "deepseek-v4-pro": { strong: "deepseek-v4-pro", fast: "deepseek-v4-pro", agent: "deepseek-v4-pro" }
     };
     var _requestModelStorage = new async_hooks_1.AsyncLocalStorage();
     function withModelContext(modelId, fn) {
@@ -397,7 +399,7 @@ var require_ai_provider = __commonJS({
       if (modelId === "nvidia/nemotron-3-nano-30b-a3b") {
         return { chat_template_kwargs: { enable_thinking: false } };
       }
-      if (modelId === "deepseek-v4-flash") {
+      if (modelId === "deepseek-v4-flash" || modelId === "deepseek-v4-pro") {
         return { thinking: { type: "disabled" } };
       }
       return {};
@@ -1789,6 +1791,83 @@ var init_constants = __esm({
   }
 });
 
+// ../shared/dist/project-key.js
+function isValidProjectKey(key) {
+  return typeof key === "string" && PROJECT_KEY_PATTERN.test(key) && !RESERVED_PROJECT_KEYS.has(key);
+}
+function randomChar(rng) {
+  return KEY_ALPHABET[Math.floor(rng() * KEY_ALPHABET.length)] ?? "0";
+}
+function randomKey(length, rng) {
+  let out = "";
+  for (let i = 0; i < length; i++)
+    out += randomChar(rng);
+  return out;
+}
+function alnumLower(name) {
+  return (name ?? "").toLowerCase().replace(/[^a-z0-9]/g, "");
+}
+function deriveProjectKey(name, rng = Math.random) {
+  const base2 = alnumLower(name).slice(0, 3);
+  return base2.length >= PROJECT_KEY_MIN_LENGTH ? base2 : randomKey(3, rng);
+}
+function generateUniqueProjectKey(name, taken, rng = Math.random) {
+  const isFree = (k) => isValidProjectKey(k) && !taken.has(k);
+  const primary = deriveProjectKey(name, rng);
+  if (isFree(primary))
+    return primary;
+  const prefix2 = alnumLower(name).slice(0, 2);
+  for (const suffixLen of [1, 2]) {
+    for (let attempt = 0; attempt < 40; attempt++) {
+      const stem = prefix2.length >= 1 ? prefix2 : deriveProjectKey(name, rng).slice(0, 2);
+      const candidate = stem + randomKey(suffixLen, rng);
+      if (isFree(candidate))
+        return candidate;
+    }
+  }
+  for (let len = 4; len <= PROJECT_KEY_MAX_LENGTH; len++) {
+    for (let attempt = 0; attempt < 100; attempt++) {
+      const candidate = randomKey(len, rng);
+      if (isFree(candidate))
+        return candidate;
+    }
+  }
+  throw new Error("Unable to generate a unique project key");
+}
+var RESERVED_PROJECT_KEYS, PROJECT_KEY_MIN_LENGTH, PROJECT_KEY_MAX_LENGTH, PROJECT_KEY_PATTERN, KEY_ALPHABET;
+var init_project_key = __esm({
+  "../shared/dist/project-key.js"() {
+    "use strict";
+    RESERVED_PROJECT_KEYS = /* @__PURE__ */ new Set([
+      "tests",
+      "sessions",
+      "settings",
+      "reports",
+      "account",
+      "notifications",
+      "support",
+      "site-map",
+      "api-intelligence",
+      "selector-registry",
+      "project-knowledge",
+      "test-data",
+      "audit",
+      "validate-copilot",
+      "qa-copilot",
+      "insights",
+      "regression",
+      "reviews",
+      "admin",
+      "login",
+      "admin-view"
+    ]);
+    PROJECT_KEY_MIN_LENGTH = 2;
+    PROJECT_KEY_MAX_LENGTH = 12;
+    PROJECT_KEY_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,10}[a-z0-9])$/;
+    KEY_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
+  }
+});
+
 // ../shared/dist/mobile-deeplink.js
 function isSafeDeepLink(value) {
   if (typeof value !== "string")
@@ -3307,6 +3386,7 @@ var init_audit_pricing = __esm({
       "MiniMax-M2.7-highspeed": { input: 0.6, output: 2.4 },
       "MiniMax-M2": { input: 0.3, output: 1.2 },
       "deepseek-v4-flash": { input: 0.14, output: 0.28 },
+      "deepseek-v4-pro": { input: 0.42, output: 0.84 },
       // Whisper bills per-minute, not per-token (OpenAI + Groq)
       "whisper-1": null,
       "whisper-large-v3": null,
@@ -4977,6 +5057,10 @@ __export(dist_exports, {
   PLAN_DEFINITIONS: () => PLAN_DEFINITIONS,
   PLAN_ORDER: () => PLAN_ORDER,
   PLATFORM_ADMIN_EMAIL: () => PLATFORM_ADMIN_EMAIL,
+  PROJECT_KEY_MAX_LENGTH: () => PROJECT_KEY_MAX_LENGTH,
+  PROJECT_KEY_MIN_LENGTH: () => PROJECT_KEY_MIN_LENGTH,
+  PROJECT_KEY_PATTERN: () => PROJECT_KEY_PATTERN,
+  RESERVED_PROJECT_KEYS: () => RESERVED_PROJECT_KEYS,
   SELECTOR_PRIORITIES: () => SELECTOR_PRIORITIES,
   SHARED_PRICING_PLAN_MAP: () => SHARED_PRICING_PLAN_MAP,
   STT_MODEL_OPTIONS: () => STT_MODEL_OPTIONS,
@@ -5010,6 +5094,7 @@ __export(dist_exports, {
   controlSignature: () => controlSignature,
   countInnerTests: () => countInnerTests,
   decideHarPosted: () => decideHarPosted,
+  deriveProjectKey: () => deriveProjectKey,
   detectCrossOriginHtmlAsJson: () => detectCrossOriginHtmlAsJson,
   detectsErrorBannerAssertion: () => detectsErrorBannerAssertion,
   effectiveTestCount: () => effectiveTestCount,
@@ -5026,6 +5111,7 @@ __export(dist_exports, {
   formatLimit: () => formatLimit,
   fromDbPricingPlan: () => fromDbPricingPlan,
   generateMobileTestFromSession: () => generateMobileTestFromSession,
+  generateUniqueProjectKey: () => generateUniqueProjectKey,
   getDefaultPlanForTier: () => getDefaultPlanForTier,
   getDeploymentTierForPlan: () => getDeploymentTierForPlan,
   getPlanChangeType: () => getPlanChangeType,
@@ -5055,6 +5141,7 @@ __export(dist_exports, {
   isTrialExpired: () => isTrialExpired,
   isUIVariant: () => isUIVariant,
   isValidMobileAppId: () => isValidMobileAppId,
+  isValidProjectKey: () => isValidProjectKey,
   isValidSttProvider: () => isValidSttProvider,
   isValidTtsModel: () => isValidTtsModel,
   isValidTtsVoiceId: () => isValidTtsVoiceId,
@@ -5100,6 +5187,7 @@ var init_dist = __esm({
     "use strict";
     init_types();
     init_constants();
+    init_project_key();
     init_mobile_test_generation();
     init_mobile_step_healer();
     init_mobile_cross_platform();
@@ -5884,6 +5972,44 @@ var require_ai_queue = __commonJS({
   }
 });
 
+// ../runner-core/dist/services/mobile/mobile-session-keepalive.js
+var require_mobile_session_keepalive = __commonJS({
+  "../runner-core/dist/services/mobile/mobile-session-keepalive.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.MOBILE_KEEPALIVE_INTERVAL_MS = void 0;
+    exports.computeKeepAliveIntervalMs = computeKeepAliveIntervalMs;
+    exports.withMobileSessionKeepAlive = withMobileSessionKeepAlive;
+    function computeKeepAliveIntervalMs(keepaliveMsRaw, newCommandTimeoutSecondsRaw) {
+      const explicit = keepaliveMsRaw?.trim() ? Number(keepaliveMsRaw) : NaN;
+      if (Number.isFinite(explicit) && explicit >= 0)
+        return Math.floor(explicit);
+      const timeoutSeconds = Number(newCommandTimeoutSecondsRaw);
+      const reapWindowMs = Number.isFinite(timeoutSeconds) && timeoutSeconds > 0 ? Math.floor(timeoutSeconds) * 1e3 : 6e5;
+      return Math.min(12e4, Math.max(5e3, Math.floor(reapWindowMs / 3)));
+    }
+    exports.MOBILE_KEEPALIVE_INTERVAL_MS = computeKeepAliveIntervalMs(process.env.VALIDATEQA_MOBILE_KEEPALIVE_MS, process.env.VALIDATEQA_MOBILE_NEW_COMMAND_TIMEOUT);
+    async function withMobileSessionKeepAlive(driver, fn, intervalMs = exports.MOBILE_KEEPALIVE_INTERVAL_MS) {
+      if (intervalMs <= 0)
+        return fn();
+      const timer = setInterval(() => {
+        try {
+          const probe = driver.keepAlivePing ? driver.keepAlivePing() : driver.windowSize();
+          void probe.catch(() => {
+          });
+        } catch {
+        }
+      }, intervalMs);
+      timer.unref?.();
+      try {
+        return await fn();
+      } finally {
+        clearInterval(timer);
+      }
+    }
+  }
+});
+
 // ../runner-core/dist/services/mobile/mobile-observation.js
 var require_mobile_observation = __commonJS({
   "../runner-core/dist/services/mobile/mobile-observation.js"(exports) {
@@ -64617,6 +64743,7 @@ var require_mobile_explorer = __commonJS({
     var ai_provider_js_1 = require_ai_provider();
     var ai_queue_js_1 = require_ai_queue();
     var ai_retry_js_1 = require_ai_retry();
+    var mobile_session_keepalive_js_1 = require_mobile_session_keepalive();
     var mobile_source_parser_js_1 = require_mobile_source_parser();
     var mobile_observation_js_1 = require_mobile_observation();
     var mobile_exploration_state_js_1 = require_mobile_exploration_state();
@@ -66126,7 +66253,7 @@ ${statePacket}` }
           const requestMessageCount = messages.length;
           const requestMessages = messages.slice();
           const callStart = Date.now();
-          const response = await (0, ai_retry_js_1.resilientAICall)((signal, arm) => (0, ai_queue_js_1.queuedAICall)(() => {
+          const response = await (0, mobile_session_keepalive_js_1.withMobileSessionKeepAlive)(driver, () => (0, ai_retry_js_1.resilientAICall)((signal, arm) => (0, ai_queue_js_1.queuedAICall)(() => {
             arm();
             return aiClient.chat.completions.create({
               model: agentModel,
@@ -66139,7 +66266,7 @@ ${statePacket}` }
             label: `mobile-explore-iter-${iteration}`,
             deferTimeoutUntilArmed: true,
             onRetry: (attempt, reason, delayMs) => log2(`  \u26A0 mobile explore AI retry ${attempt} (${reason}) \u2014 waiting ${delayMs}ms`)
-          });
+          }));
           const iterDuration = Date.now() - callStart;
           if (!response?.choices?.[0]?.message) {
             throw new Error(`AI explore call returned no response (queue timeout or provider overload) at iteration ${iteration}`);
@@ -68218,6 +68345,7 @@ var require_discover_ai_planner = __commonJS({
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.SCENARIO_SYSTEM_PROMPT = void 0;
+    exports.getAIPlannerMaxTokens = getAIPlannerMaxTokens;
     exports.getSnapshotConfidence = getSnapshotConfidence;
     exports.compressSiteMap = compressSiteMap;
     exports.formatEvidenceForPlanner = formatEvidenceForPlanner;
@@ -68229,10 +68357,25 @@ var require_discover_ai_planner = __commonJS({
     var ai_retry_js_1 = require_ai_retry();
     var strip_json_fences_js_1 = require_strip_json_fences();
     var scenario_plan_validator_js_1 = require_scenario_plan_validator();
-    var DEFAULT_AI_PLANNER_MAX_TOKENS = 8192;
-    var MINIMAX_AI_PLANNER_MAX_TOKENS = 16384;
+    var GENEROUS_AI_PLANNER_MAX_TOKENS = 65536;
+    var CONSERVATIVE_AI_PLANNER_MAX_TOKENS = 16384;
     function getAIPlannerMaxTokens(modelId) {
-      return (0, ai_provider_js_1.getProviderForModel)(modelId) === "minimax" ? MINIMAX_AI_PLANNER_MAX_TOKENS : DEFAULT_AI_PLANNER_MAX_TOKENS;
+      switch ((0, ai_provider_js_1.getProviderForModel)(modelId)) {
+        case "deepseek":
+        // V4 output ceiling = 384K — verified safe
+        case "minimax":
+          return GENEROUS_AI_PLANNER_MAX_TOKENS;
+        case "xai":
+        // grok-build-0.1 ceiling unproven (Grok-Fast/3 = 16K) — DON'T risk a 400
+        case "openai":
+        // gpt-4o max output = 16384 → more would 400
+        case "anthropic":
+        // OpenAI-compat proxy — keep conservative
+        case "nvidia":
+        // NIM output limits vary — keep conservative
+        default:
+          return CONSERVATIVE_AI_PLANNER_MAX_TOKENS;
+      }
     }
     var discover_planner_js_1 = require_discover_planner();
     function getSnapshotConfidence(sourceKind) {
@@ -68784,7 +68927,7 @@ Return ONLY one valid JSON object matching the schema below. Do NOT include <thi
 4. **Multi-page journeys** - only when transitions were actually observed
 5. **Bug reports** - for observed 500 errors, crashes, or broken features
 6. **Steps are human-readable** - "Fill the email field", not "page.getByLabel('Email').fill()"
-7. **Expected outcomes are plain-English success criteria** - describe the user-visible product result, not the controls touched along the way. Steps already cover buttons, inputs, links, fields, headings, tabs, dialogs, and menus. Expected outcomes should say what the user can now do or rely on (record saved, message sent, search results filtered, validation explained, dashboard accessible). Include durable routes or exact copy only when they are the real product outcome; do NOT list "heading visible", "button visible", "search input visible", or similar element inventory unless that exact control is the behavior under test.
+7. **Expected outcomes are plain-English success criteria** - describe the user-visible product result, not the controls touched along the way. Steps already cover buttons, inputs, links, fields, headings, tabs, dialogs, and menus. Expected outcomes should say what the user can now do or rely on (record saved, message sent, search results filtered, validation explained, dashboard accessible). Include durable routes or exact copy only when they are the real product outcome; do NOT list "heading visible", "button visible", "search input visible", or similar element inventory unless that exact control is the behavior under test.  **Outcome-strength self-check (applies to EVERY scenario type):** before emitting a scenario, ask \u2014 would every expectedOutcome still pass if the primary action did nothing and only the page and its existing chrome rendered? If yes, it is too weak. Add at least one evidence-backed post-condition that would FAIL in that no-op case: specific result content or value, a created or removed entity, a changed count or status, persisted state after reload, handled validation copy, or a concrete session signal. A route alone suffices only when navigation or redirect is itself the behavior under test; a newly revealed control suffices only when revealing that control is the behavior under test. Never invent copy to satisfy this check \u2014 Rule 1 still governs what you may assert.
 8. **Auth-aware** - mark scenarios that need login. Use process.env.TEST_USER_EMAIL / PASSWORD
 9. **No duplicates** - check existing test names before adding
 10. **All tests start from the landing page** - every generated test navigates to \`/\` first and uses the app's own navigation (clicking links/buttons) to reach the target page. Steps must reflect this: say "Navigate to landing page and click Sign In" not "Navigate to /auth/login". Deep-linking to internal routes causes hydration failures in SPAs. \`targetPages\` lists the pages involved in the flow.
@@ -68836,7 +68979,7 @@ Return ONLY one valid JSON object matching the schema below. Do NOT include <thi
     **YOUR responsibility:**
     - Scenario \`name\`, \`type\`, \`goal\`, \`prerequisites\`
     - \`steps\` written as user-language intent ("create a new conversation", "click the Submit button to log in"), naming observed UI labels where they help describe intent
-    - \`expectedOutcomes\` citing observed durable labels per Rule 12 (asserting on stable signals is encouraged)
+    - \`expectedOutcomes\` expressing the evidence-backed product post-condition per Rule 7 (and Rule 11 for happy paths, plus Rule 12's concrete session signal for authentication happy paths); citing observed durable labels when asserting on stable signals is encouraged
 
     **NOT your responsibility:**
     - Exact Playwright selectors (\`getByRole(...)\`, \`getByText(...)\`, \`page.locator(...)\`, etc.) \u2014 live-generate picks locators against the live snapshot
@@ -68857,7 +69000,7 @@ Return ONLY one valid JSON object matching the schema below. Do NOT include <thi
     - GOOD specificity: "create a new conversation by sending a message to a connection established earlier in this scenario"
     - BAD specificity: "click the button labeled exactly 'Send' in the bottom-right of the chat"
 
-    Citing observed labels in \`expectedOutcomes\` (per Rule 12) is fine \u2014 that's asserting on stable product signals, not implementation specifics.
+    Citing observed labels in \`expectedOutcomes\` is fine \u2014 that's asserting on stable product signals, not implementation specifics.
 
 ## Coverage Strategy
 - For every form: at least 1 HAPPY_PATH (submit valid data AND verify durable result per rule 11) + 1 EDGE_CASE (empty/invalid submission)
@@ -69443,6 +69586,24 @@ Each entry is exactly one of:
     }
     async function runAIPlanner(siteMap, evidence, context, options) {
       const logs2 = [];
+      const failurePlan = (kind, reason, legacyFallback2) => {
+        const noFallback = context.mode === "survey" && process.env.DISCOVERY_PLANNER_NO_FALLBACK === "true";
+        if (noFallback) {
+          logs2.push(`Planner ${kind} \u2014 NO-FALLBACK: failing survey cleanly instead of fabricating slug features (${reason})`);
+          return {
+            scenarios: [],
+            featureGroups: [],
+            reasoning: "",
+            logs: logs2,
+            coverageGaps: [],
+            plannerFailed: true,
+            plannerFailureKind: kind,
+            fallbackReason: reason
+          };
+        }
+        return { ...legacyFallback2(), fallbackReason: reason };
+      };
+      let extraPlannerCallUsed = false;
       const compressed = compressSiteMap(siteMap);
       const agentModel = options.modelOverride ? (0, ai_provider_js_1.resolveModelForTask)(options.modelOverride, "agent") : (0, ai_provider_js_1.getModel)("agent");
       const plannerMaxTokens = getAIPlannerMaxTokens(agentModel);
@@ -69478,7 +69639,7 @@ Each entry is exactly one of:
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
         logs2.push(`AI planner failed after retries: ${message}`);
-        return { ...buildFallbackPlan(siteMap, evidence.recordedJourneys, context.mode, logs2, context.existingTestNames ?? [], context.focusAreas, context.testBudget), fallbackReason: (0, ai_retry_js_1.describeAIFailure)(err) };
+        return failurePlan("transport", (0, ai_retry_js_1.describeAIFailure)(err), () => buildFallbackPlan(siteMap, evidence.recordedJourneys, context.mode, logs2, context.existingTestNames ?? [], context.focusAreas, context.testBudget));
       }
       try {
         options.onAICall?.({
@@ -69497,20 +69658,104 @@ Each entry is exactly one of:
         });
       } catch {
       }
-      const raw = response?.choices?.[0]?.message?.content;
-      if (!raw) {
+      const choice = response?.choices?.[0];
+      const raw = choice?.message?.content;
+      const finishReason = (choice?.finish_reason ?? "").toString().toLowerCase();
+      const completionTokens = response.usage?.completion_tokens;
+      const TRUNCATION_FINISH = /* @__PURE__ */ new Set(["length", "max_tokens", "max_output_tokens", "token_limit"]);
+      const definitelyTruncated = TRUNCATION_FINISH.has(finishReason);
+      const atOrOverCap = completionTokens != null && completionTokens >= plannerMaxTokens;
+      const blocked = finishReason === "content_filter" || finishReason === "tool_calls";
+      const usage = response.usage;
+      logs2.push(`AI planner: ${usage?.prompt_tokens ?? "?"} input, ${usage?.completion_tokens ?? "?"} output tokens (finish=${finishReason || "?"})`);
+      const legacyFallback = () => buildFallbackPlan(siteMap, evidence.recordedJourneys, context.mode, logs2, context.existingTestNames ?? [], context.focusAreas, context.testBudget);
+      if (blocked) {
+        return failurePlan("blocked", "AI response was blocked (content_filter/tool_calls)", legacyFallback);
+      }
+      if (definitelyTruncated) {
+        return failurePlan("truncated", "AI planner output truncated at max_tokens (finish_reason=length)", legacyFallback);
+      }
+      const trimmed = raw?.trim();
+      if (!trimmed) {
         logs2.push("AI planner returned empty response");
-        return { ...buildFallbackPlan(siteMap, evidence.recordedJourneys, context.mode, logs2, context.existingTestNames ?? [], context.focusAreas, context.testBudget), fallbackReason: "AI returned an empty response" };
+        return atOrOverCap ? failurePlan("truncated", "AI planner output truncated at max_tokens (empty body at cap)", legacyFallback) : failurePlan("empty", "AI returned an empty response", legacyFallback);
       }
-      const usage = response.usage;
-      logs2.push(`AI planner: ${usage?.prompt_tokens ?? "?"} input, ${usage?.completion_tokens ?? "?"} output tokens`);
       let aiOutput;
       try {
-        aiOutput = JSON.parse((0, strip_json_fences_js_1.stripJsonFences)(raw));
+        aiOutput = JSON.parse((0, strip_json_fences_js_1.stripJsonFences)(trimmed));
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
         logs2.push(`AI planner returned invalid JSON: ${message}`);
-        return { ...buildFallbackPlan(siteMap, evidence.recordedJourneys, context.mode, logs2, context.existingTestNames ?? [], context.focusAreas, context.testBudget), fallbackReason: "AI returned unreadable output" };
+        if (atOrOverCap) {
+          logs2.push("AI planner output at/over the token cap and unparseable \u2014 treating as truncated (skipping repair)");
+          return failurePlan("truncated", "AI planner output truncated at max_tokens (unparseable at cap)", legacyFallback);
+        }
+        const repairPrompt = `Your previous response was not valid JSON (parser error: ${message}). Return ONLY the corrected JSON object \u2014 no prose, no markdown fences \u2014 matching the exact schema of your previous attempt.`;
+        const repairStart = Date.now();
+        let repairResponse = null;
+        try {
+          extraPlannerCallUsed = true;
+          repairResponse = await (0, ai_retry_js_1.resilientAICall)((signal, arm) => (0, ai_queue_js_1.queuedAICall)(() => {
+            arm();
+            return aiClient.chat.completions.create({
+              model: agentModel,
+              messages: [
+                ...messages,
+                { role: "assistant", content: raw },
+                { role: "user", content: repairPrompt }
+              ],
+              max_tokens: plannerMaxTokens,
+              temperature: 0.3,
+              ...(0, ai_provider_js_1.getJsonObjectResponseFormat)(agentModel),
+              ...(0, ai_provider_js_1.getNoThinkingRequestOptions)(agentModel)
+            }, { signal });
+          }), {
+            label: "ai-planner-repair",
+            deferTimeoutUntilArmed: true,
+            onRetry: (attempt, reason, delay) => logs2.push(`AI planner repair call failed (${reason}) \u2014 retry ${attempt} in ${Math.round(delay / 1e3)}s`)
+          });
+        } catch (repairErr) {
+          const repairMessage = repairErr instanceof Error ? repairErr.message : String(repairErr);
+          logs2.push(`AI planner repair failed (${repairMessage})`);
+        }
+        if (repairResponse) {
+          try {
+            options.onAICall?.({
+              iteration: 1,
+              groupId: `ai-planner-${context.projectId.slice(0, 8)}`,
+              callType: "discoveryAIPlannerRepair",
+              model: agentModel,
+              provider: (0, ai_provider_js_1.getProviderForModel)(agentModel),
+              durationMs: Date.now() - repairStart,
+              promptTokens: repairResponse.usage?.prompt_tokens,
+              completionTokens: repairResponse.usage?.completion_tokens,
+              totalTokens: repairResponse.usage?.total_tokens,
+              assistantMessage: repairResponse.choices[0]?.message?.content,
+              requestMessageCount: messages.length + 2,
+              requestMessages: [
+                ...messages,
+                { role: "assistant", content: raw },
+                { role: "user", content: repairPrompt }
+              ]
+            });
+          } catch {
+          }
+          const repairedRaw = repairResponse.choices[0]?.message?.content?.trim();
+          if (repairedRaw) {
+            try {
+              aiOutput = JSON.parse((0, strip_json_fences_js_1.stripJsonFences)(repairedRaw));
+            } catch (repairParseErr) {
+              const repairMessage = repairParseErr instanceof Error ? repairParseErr.message : String(repairParseErr);
+              logs2.push(`AI planner repair returned invalid JSON (${repairMessage})`);
+              return failurePlan("malformed", "AI returned unreadable output", legacyFallback);
+            }
+          } else {
+            logs2.push("AI planner repair returned empty response");
+            return failurePlan("malformed", "AI returned unreadable output", legacyFallback);
+          }
+        } else {
+          return failurePlan("malformed", "AI returned unreadable output", legacyFallback);
+        }
       }
       let { scenarios, featureGroups, warnings, coverageGaps } = validateAIPlannerOutput(aiOutput, siteMap, context.existingTestNames, context.testBudget, evidence.recordedJourneys, context.mode, context.focusAreas);
       logs2.push(`AI planner: ${scenarios.length} scenarios, ${featureGroups.length} feature groups (${warnings.length} warnings, ${coverageGaps.length} coverage gaps)`);
@@ -69520,7 +69765,7 @@ Each entry is exactly one of:
       let topLevelWarning;
       const totalV1 = scenarios.length + coverageGaps.length;
       const rejectionRateV1 = totalV1 > 0 ? coverageGaps.length / totalV1 : 0;
-      if (rejectionRateV1 > 0.5 && totalV1 >= 3) {
+      if (rejectionRateV1 > 0.5 && totalV1 >= 3 && !extraPlannerCallUsed) {
         logs2.push(`AI planner: ${Math.round(rejectionRateV1 * 100)}% rejection rate (${coverageGaps.length}/${totalV1}) \u2014 running self-correction retry`);
         const retryContext = [
           `Your previous emission produced ${coverageGaps.length} coverage gaps out of ${totalV1} scenarios (${Math.round(rejectionRateV1 * 100)}% rejection rate).`,
@@ -69539,6 +69784,7 @@ Each entry is exactly one of:
         const retryStart = Date.now();
         let retryResponse = null;
         try {
+          extraPlannerCallUsed = true;
           retryResponse = await (0, ai_retry_js_1.resilientAICall)((signal, arm) => (0, ai_queue_js_1.queuedAICall)(() => {
             arm();
             return aiClient.chat.completions.create({
@@ -69638,6 +69884,22 @@ Each entry is exactly one of:
         };
       }
       if (context.mode === "survey" && featureGroups.length === 0 && siteMap.pages.length > 0) {
+        const hasGroupWorthyEvidence = siteMap.pages.some((p) => (p.forms?.length ?? 0) > 0 || (p.elements?.length ?? 0) > 0);
+        const noFallback = process.env.DISCOVERY_PLANNER_NO_FALLBACK === "true";
+        if (noFallback && !hasGroupWorthyEvidence) {
+          return {
+            scenarios,
+            featureGroups: [],
+            reasoning: aiOutput.reasoning ?? "",
+            logs: logs2,
+            coverageGaps,
+            warning: topLevelWarning,
+            fallbackUsed: false
+          };
+        }
+        if (noFallback) {
+          return failurePlan("empty_groups", "AI produced no feature groups despite discovered content", () => buildFallbackPlan(siteMap, evidence.recordedJourneys, context.mode, logs2, context.existingTestNames ?? [], context.focusAreas, context.testBudget));
+        }
         logs2.push("Survey AI returned 0 feature groups - falling back to deterministic grouping");
         const fallback = buildFallbackPlan(siteMap, evidence.recordedJourneys, context.mode, logs2, context.existingTestNames ?? [], context.focusAreas, context.testBudget);
         return {
@@ -70848,6 +71110,7 @@ var require_mobile_generator = __commonJS({
     var ai_provider_js_1 = require_ai_provider();
     var ai_queue_js_1 = require_ai_queue();
     var ai_retry_js_1 = require_ai_retry();
+    var mobile_session_keepalive_js_1 = require_mobile_session_keepalive();
     var mobile_source_parser_js_1 = require_mobile_source_parser();
     var mobile_source_parser_js_2 = require_mobile_source_parser();
     var mobile_observation_js_1 = require_mobile_observation();
@@ -71755,14 +72018,14 @@ ${statePacket}`, redactionCredentials) },
         const requestMessageCount = messages.length;
         const requestMessages = messages.slice();
         const callStart = Date.now();
-        const response = await (0, ai_retry_js_1.resilientAICall)((signal, arm) => (0, ai_queue_js_1.queuedAICall)(() => {
+        const response = await (0, mobile_session_keepalive_js_1.withMobileSessionKeepAlive)(driver, () => (0, ai_retry_js_1.resilientAICall)((signal, arm) => (0, ai_queue_js_1.queuedAICall)(() => {
           arm();
           return aiClient.chat.completions.create({ model: agentModel, messages, tools: GENERATE_TOOLS, tool_choice: "auto", max_tokens: 8e3 }, { signal });
         }), {
           label: `mobile-generate-${scenario.name.slice(0, 24)}-iter-${iteration}`,
           deferTimeoutUntilArmed: true,
           onRetry: (attempt, reason, delayMs) => log2(`  \u26A0 mobile generate AI retry ${attempt} (${reason}) \u2014 waiting ${delayMs}ms`)
-        });
+        }));
         const iterDuration = Date.now() - callStart;
         if (!response?.choices?.[0]?.message) {
           throw new Error(`AI generate call returned no response at iteration ${iteration}`);
@@ -72374,6 +72637,21 @@ ${statePacket}`, redactionCredentials) },
             };
           }
           const metadata = metadataForElement(element, screenName(), platform3);
+          const expectedNeedle = expected.trim().toLowerCase();
+          const identityValues = [element.accessibilityId, element.resourceId].map((value) => value?.trim().toLowerCase()).filter((value) => Boolean(value));
+          const visibleText = (element.text ?? "").trim().toLowerCase();
+          const isSelfLabelAssertion = expectedNeedle.length > 0 && identityValues.includes(expectedNeedle) && !visibleText.includes(expectedNeedle);
+          if (isSelfLabelAssertion) {
+            recordAction({ type: "ASSERT_VISIBLE", selector: (0, mobile_source_parser_js_2.preferredLocator)(element), metadata });
+            log2(`  assert_text DOWNGRADED to assert_visible (tautological self-label "${expected}"): ${metadata.targetLabel}`);
+            return {
+              ok: true,
+              asserted: "visible",
+              downgraded: true,
+              note: `"${expected}" is the element's own accessibility identity, not product copy it displays \u2014 recorded a visibility assertion instead. To prove the outcome, assert text the screen SHOWS (an error message, a status label, a field value), not the control's own name.`,
+              target: metadata.targetLabel
+            };
+          }
           if (hasStableId(element)) {
             recordAction({ type: "ASSERT_TEXT", value: expected, selector: (0, mobile_source_parser_js_2.preferredLocator)(element), metadata });
             log2(`  assert_text: ${metadata.targetLabel} ~ "${expected}"`);
@@ -73067,7 +73345,13 @@ ${statePacket}`, redactionCredentials) },
       const strengthReason = coldResetUnavailable ? `Cold app-data reset unavailable${coldResetReason ? ` (${coldResetReason})` : ""} \u2014 generation may not match cold-boot replay. ${strengthVerdict.reason}` : !verified && recording.assertCount === 0 ? "Mobile scenario finished unverified \u2014 the agent never proved the scenario outcome live, so the recording may not demonstrate the goal (e.g. a happy path that never completed). Review before promotion." : strengthVerdict.reason;
       const test = {
         name: compiled.name,
-        description: recording.finish?.description ?? compiled.description,
+        // Description priority: the model's live finish description, then the
+        // planner's scenario goal (always a meaningful sentence describing what the
+        // test proves), then the generic compiled placeholder. Without the goal
+        // fallback a scenario whose finish_generate omitted a description shipped
+        // with the contentless "<platform> native flow generated from a recorded
+        // mobile session." string — see mobile-test-generation.ts's compiled default.
+        description: recording.finish?.description?.trim() || scenario.goal?.trim() || compiled.description,
         framework: "APPIUM",
         appiumCode: compiled.appiumCode,
         steps: compiled.steps,
@@ -73809,6 +74093,7 @@ var require_mobile_heal_loop = __commonJS({
     var mobile_heal_postprocess_js_1 = require_mobile_heal_postprocess();
     var mobile_observation_js_1 = require_mobile_observation();
     var selector_registry_context_js_1 = require_selector_registry_context();
+    var mobile_session_keepalive_js_1 = require_mobile_session_keepalive();
     exports.MOBILE_SCRIPT_HEAL_SYSTEM_PROMPT = `You are a QA engineer fixing a failing Appium (mobile UI automation) test. You receive: the test STEPS as JSON, the failure ERROR + step-level results, and the PAGE-SOURCE accessibility tree captured at the moment of failure (this tree is your 'screenshot'), plus optional known-good selector candidates from a registry.
 ## You MUST try to fix the steps
 Reason over steps + error + tree + registry and return working healed steps. Do NOT return needs_device unless you have genuinely exhausted that reasoning (and NEVER before your final attempt).
@@ -74700,6 +74985,19 @@ For a fix, return the COMPLETE steps array (not a diff). Use "observe" only to r
         };
       }
       const maxPasses = envInt2("MOBILE_HEAL_PHASE2_MAX_PASSES") ?? DEFAULT_PHASE2_MAX_PASSES;
+      const keepAlivePingable = {
+        ...typeof liveDriver.keepAlivePing === "function" ? { keepAlivePing: liveDriver.keepAlivePing.bind(liveDriver) } : {},
+        // WARNING: this fallback routes through snapshot(), which sits inside
+        // withSessionRecovery on the real driver — a failed tick could consume the
+        // bounded recovery budget, the exact bug keepAlivePing exists to avoid.
+        // Every current MobileLiveDriverLike provides keepAlivePing, so this only
+        // exists for structural compatibility; implement keepAlivePing on any new
+        // facade rather than relying on it.
+        windowSize: async () => {
+          await liveDriver.snapshot();
+          return null;
+        }
+      };
       let baseSteps = args.steps;
       let priorError = args.priorError ?? null;
       let bestSteps;
@@ -74734,10 +75032,10 @@ For a fix, return the COMPLETE steps array (not a diff). Use "observe" only to r
         ];
         let content;
         try {
-          const response = await (0, ai_retry_js_1.resilientAICall)((signal, arm) => (0, ai_queue_js_1.queuedAICall)(() => {
+          const response = await (0, mobile_session_keepalive_js_1.withMobileSessionKeepAlive)(keepAlivePingable, () => (0, ai_retry_js_1.resilientAICall)((signal, arm) => (0, ai_queue_js_1.queuedAICall)(() => {
             arm();
             return aiClient.chat.completions.create({ model, messages, max_tokens: 8e3, temperature: 0.1 }, { signal });
-          }), { label: `mobile-live-heal-pass-${pass}`, deferTimeoutUntilArmed: true });
+          }), { label: `mobile-live-heal-pass-${pass}`, deferTimeoutUntilArmed: true }));
           content = response?.choices?.[0]?.message?.content ?? "";
         } catch {
           continue;
@@ -75744,6 +76042,118 @@ var require_har_stream = __commonJS({
   }
 });
 
+// ../runner-core/dist/services/api-auth-headers.js
+var require_api_auth_headers = __commonJS({
+  "../runner-core/dist/services/api-auth-headers.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.parseApiAuthHeaders = parseApiAuthHeaders;
+    exports.resolveApiAuthHeaders = resolveApiAuthHeaders;
+    exports.isAppOriginRequest = isAppOriginRequest;
+    exports.buildOriginScopedApiFixtures = buildOriginScopedApiFixtures;
+    var HEADER_NAME_RE = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
+    function hasControlChar(v) {
+      for (let i = 0; i < v.length; i++) {
+        const code = v.charCodeAt(i);
+        if (code < 32 || code === 127)
+          return true;
+      }
+      return false;
+    }
+    function parseApiAuthHeaders(raw) {
+      if (!raw || typeof raw !== "string")
+        return void 0;
+      const trimmed = raw.trim();
+      if (!trimmed)
+        return void 0;
+      try {
+        const parsed = JSON.parse(trimmed);
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+          return void 0;
+        const headers = {};
+        for (const [k, v] of Object.entries(parsed)) {
+          if (typeof k === "string" && HEADER_NAME_RE.test(k) && typeof v === "string" && !hasControlChar(v)) {
+            headers[k] = v;
+          }
+        }
+        return Object.keys(headers).length > 0 ? headers : void 0;
+      } catch {
+        return void 0;
+      }
+    }
+    function resolveApiAuthHeaders(input) {
+      if (input.explicit)
+        return input.explicit;
+      if (!input.isApiTest)
+        return void 0;
+      return parseApiAuthHeaders(input.apiAuthHeadersVar);
+    }
+    function isAppOriginRequest(url, baseUrl) {
+      if (typeof url !== "string" || !baseUrl)
+        return false;
+      let appOrigin;
+      try {
+        appOrigin = new URL(baseUrl).origin;
+      } catch {
+        return false;
+      }
+      try {
+        return new URL(url, baseUrl).origin === appOrigin;
+      } catch {
+        return false;
+      }
+    }
+    function buildOriginScopedApiFixtures(headers, baseUrl) {
+      let appOrigin;
+      try {
+        appOrigin = baseUrl ? new URL(baseUrl).origin : null;
+      } catch {
+        appOrigin = null;
+      }
+      return `export * from '@playwright/test';
+import { test as base } from '@playwright/test';
+
+// Standing auth headers \u2014 attached ONLY to same-origin requests so the credential never leaks to
+// an off-origin host. Embedded at run time; this file lives in the ephemeral run dir.
+const STANDING_HEADERS = ${JSON.stringify(headers)};
+const APP_ORIGIN = ${JSON.stringify(appOrigin)};
+const BASE_URL = ${JSON.stringify(baseUrl)};
+const METHODS = ['get', 'post', 'put', 'patch', 'delete', 'head', 'fetch'];
+
+function sameOrigin(url) {
+  if (!APP_ORIGIN || typeof url !== 'string') return false;
+  try { return new URL(url, BASE_URL).origin === APP_ORIGIN; } catch { return false; }
+}
+
+export const test = base.extend({
+  request: async ({ request }, use) => {
+    const scoped = new Proxy(request, {
+      get(target, prop) {
+        const value = target[prop];
+        // HTTP verbs: wrap to add standing headers on same-origin requests only.
+        if (typeof prop === 'string' && METHODS.indexOf(prop) !== -1) {
+          const orig = value.bind(target);
+          return (url, options) => {
+            options = options || {};
+            return sameOrigin(url)
+              ? orig(url, { ...options, headers: { ...STANDING_HEADERS, ...(options.headers || {}) } })
+              : orig(url, options);
+          };
+        }
+        // Every other METHOD must run with 'this' bound to the REAL context \u2014 an APIRequestContext
+        // uses internal slots/private fields a Proxy can't forward, so calling with 'this'=proxy
+        // would throw. Non-function props pass through untouched.
+        return typeof value === 'function' ? value.bind(target) : value;
+      },
+    });
+    await use(scoped);
+  },
+});
+`;
+    }
+  }
+});
+
 // ../runner-core/dist/services/playwright-native.js
 var require_playwright_native = __commonJS({
   "../runner-core/dist/services/playwright-native.js"(exports) {
@@ -75786,7 +76196,7 @@ var require_playwright_native = __commonJS({
       };
     })();
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.scrubHarRequestBody = void 0;
+    exports.scrubHarRequestBody = exports.buildOriginScopedApiFixtures = exports.isAppOriginRequest = exports.resolveApiAuthHeaders = exports.parseApiAuthHeaders = void 0;
     exports.executeTestViaNativePlaywright = executeTestViaNativePlaywright2;
     exports.parseJsonResults = parseJsonResults2;
     exports.parseHarToApiSummary = parseHarToApiSummary;
@@ -75798,6 +76208,20 @@ var require_playwright_native = __commonJS({
     var spawn_with_tree_kill_js_1 = require_spawn_with_tree_kill();
     var api_call_redaction_js_1 = require_api_call_redaction();
     var har_stream_js_1 = require_har_stream();
+    var api_auth_headers_js_1 = require_api_auth_headers();
+    var api_auth_headers_js_2 = require_api_auth_headers();
+    Object.defineProperty(exports, "parseApiAuthHeaders", { enumerable: true, get: function() {
+      return api_auth_headers_js_2.parseApiAuthHeaders;
+    } });
+    Object.defineProperty(exports, "resolveApiAuthHeaders", { enumerable: true, get: function() {
+      return api_auth_headers_js_2.resolveApiAuthHeaders;
+    } });
+    Object.defineProperty(exports, "isAppOriginRequest", { enumerable: true, get: function() {
+      return api_auth_headers_js_2.isAppOriginRequest;
+    } });
+    Object.defineProperty(exports, "buildOriginScopedApiFixtures", { enumerable: true, get: function() {
+      return api_auth_headers_js_2.buildOriginScopedApiFixtures;
+    } });
     var api_call_redaction_js_2 = require_api_call_redaction();
     Object.defineProperty(exports, "scrubHarRequestBody", { enumerable: true, get: function() {
       return api_call_redaction_js_2.scrubHarRequestBody;
@@ -75807,7 +76231,7 @@ var require_playwright_native = __commonJS({
     var RUNS_DIR = process.env.RUNS_DIR || (0, path_1.join)(PACKAGE_DIR, ".qa-runs");
     var PW_CLI = __require.resolve("@playwright/test/cli");
     async function executeTestViaNativePlaywright2(options) {
-      const { playwrightCode, baseUrl, testName, testVariables, storageStatePath, validateContext, liveBrowserHandle, onLiveBrowserSnapshot } = options;
+      const { playwrightCode, baseUrl, testName, testVariables, storageStatePath, extraHttpHeaders, validateContext, liveBrowserHandle, onLiveBrowserSnapshot } = options;
       const logs2 = [];
       const screenshots = [];
       logs2.push(`\u{1F3AD} Native Playwright starting`);
@@ -75821,6 +76245,11 @@ var require_playwright_native = __commonJS({
         runDir = (0, path_1.join)(RUNS_DIR, (0, crypto_1.randomUUID)());
         await (0, promises_1.mkdir)(runDir, { recursive: true });
         const isApiTest2 = playwrightCode.includes("@api") || playwrightCode.includes("{ request }") && !playwrightCode.includes("{ page");
+        const resolvedExtraHeaders = (0, api_auth_headers_js_1.resolveApiAuthHeaders)({
+          explicit: extraHttpHeaders,
+          isApiTest: isApiTest2,
+          apiAuthHeadersVar: testVariables?.API_AUTH_HEADERS
+        });
         const cssDisableSetup = `
 const __qaLiveBrowserStateFile = process.env.VALIDATE_LIVE_BROWSER_STATE_PATH;
 let __qaLiveBrowserInterval: ReturnType<typeof setInterval> | null = null;
@@ -76014,8 +76443,17 @@ test.afterEach(async ({ page }, testInfo) => {
         if (!importMatch) {
           logs2.push("\u26A0 Could not find @playwright/test import - animation disabling NOT injected");
         }
-        const instrumentedCode = isApiTest2 ? playwrightCode : importMatch ? playwrightCode.replace(importMatch[0], importMatch[0] + cssDisableSetup) : playwrightCode;
+        const useScopedApiHeaders = isApiTest2 && !!resolvedExtraHeaders && !!importMatch && !!baseUrl;
+        let instrumentedCode;
+        if (isApiTest2) {
+          instrumentedCode = useScopedApiHeaders ? playwrightCode.replace(importMatch[0], importMatch[0].replace(/from\s+['"]@playwright\/test['"]/, "from './qa-api-fixtures'")) : playwrightCode;
+        } else {
+          instrumentedCode = importMatch ? playwrightCode.replace(importMatch[0], importMatch[0] + cssDisableSetup) : playwrightCode;
+        }
         await (0, promises_1.writeFile)((0, path_1.join)(runDir, "test.spec.ts"), instrumentedCode);
+        if (useScopedApiHeaders && resolvedExtraHeaders) {
+          await (0, promises_1.writeFile)((0, path_1.join)(runDir, "qa-api-fixtures.ts"), (0, api_auth_headers_js_1.buildOriginScopedApiFixtures)(resolvedExtraHeaders, baseUrl));
+        }
         const headless = process.env.PLAYWRIGHT_HEADLESS === "true" || process.env.NODE_ENV === "production" || IS_CLOUD2;
         logs2.push(`\u2699\uFE0F  Config: baseURL=${JSON.stringify(baseUrl)}, headless=${headless}${isApiTest2 ? ", API mode (no screenshot/video)" : ""}`);
         const absTestDir = runDir.replace(/\\/g, "/");
@@ -76029,6 +76467,7 @@ test.afterEach(async ({ page }, testInfo) => {
         const absHarPath = wantHar ? (0, path_1.join)(runDir, "session.har").replace(/\\/g, "/") : null;
         const recordHarLine = absHarPath ? `recordHar: { path: ${JSON.stringify(absHarPath)}, mode: 'full' },` : "";
         const storageStateLine = storageStatePath ? `storageState: ${JSON.stringify(storageStatePath.replace(/\\/g, "/"))},` : "";
+        const extraHeadersLine = resolvedExtraHeaders && !useScopedApiHeaders && Object.keys(resolvedExtraHeaders).length > 0 ? `extraHTTPHeaders: ${JSON.stringify(resolvedExtraHeaders)},` : "";
         const launchArgs = IS_CLOUD2 ? "args: ['--no-sandbox', '--disable-setuid-sandbox', '--disable-blink-features=AutomationControlled', '--disable-dev-shm-usage', '--disable-gpu', '--disable-software-rasterizer', '--no-zygote', '--disable-accelerated-2d-canvas', '--js-flags=--max-old-space-size=512']," : "args: ['--disable-blink-features=AutomationControlled'],";
         const config = `
 // Plain object export - no require('@playwright/test') needed.
@@ -76042,6 +76481,7 @@ module.exports = {
   use: {
     baseURL: ${JSON.stringify(baseUrl)},
     ${storageStateLine}
+    ${extraHeadersLine}
     browserName: 'chromium',
     headless: ${headless},
     screenshot: ${isApiTest2 ? "'off'" : "'on'"},
@@ -76083,6 +76523,7 @@ module.exports = {
           // code. Forwarded (not allowlisted) so it stays a per-run toggle; absent → inert.
           ...process.env.SHARED_AUTH_INJECT ? { SHARED_AUTH_INJECT: process.env.SHARED_AUTH_INJECT } : {}
         };
+        delete envWithIsolation.API_AUTH_HEADERS;
         logs2.push("\u{1F680} Spawning playwright test...");
         const stopLiveBrowserPolling = liveBrowserStatePath && liveBrowserHandle ? startLiveBrowserStatePolling(liveBrowserStatePath, liveBrowserHandle, onLiveBrowserSnapshot) : null;
         let playResult;
@@ -84189,6 +84630,7 @@ var require_discover_generator = __commonJS({
     var ai_provider_js_1 = require_ai_provider();
     var ai_queue_js_1 = require_ai_queue();
     var ai_retry_js_1 = require_ai_retry();
+    var discover_ai_planner_js_1 = require_discover_ai_planner();
     var snapshot_parser_js_1 = require_snapshot_parser();
     var scrub_credentials_js_1 = require_scrub_credentials();
     var exploration_parser_js_1 = require_exploration_parser();
@@ -84396,6 +84838,51 @@ var require_discover_generator = __commonJS({
       }
       return s.length;
     }
+    function lineParenDeficit(line) {
+      const stack = [];
+      let regexSkips = 0;
+      for (let i = 0; i < line.length; i++) {
+        const ch = line[i];
+        if (ch === "'" || ch === '"' || ch === "`") {
+          i = skipQuotedLiteral(line, i) - 1;
+          continue;
+        }
+        if (ch === "/" && line[i + 1] === "/") {
+          i = skipLineComment(line, i) - 1;
+          continue;
+        }
+        if (ch === "/" && line[i + 1] === "*") {
+          i = skipBlockComment(line, i) - 1;
+          continue;
+        }
+        if (ch === "/" && isRegexStart(line, i)) {
+          regexSkips++;
+          i = skipRegexLiteral(line, i) - 1;
+          continue;
+        }
+        if (ch === "(" || ch === "{" || ch === "[") {
+          stack.push(ch);
+          continue;
+        }
+        if (ch === ")" || ch === "}" || ch === "]") {
+          if (stack[stack.length - 1] !== CLOSE_TO_OPEN[ch])
+            return { deficit: 0, regexSkips };
+          stack.pop();
+        }
+      }
+      const deficit = stack.length > 0 && stack.every((open) => open === "(") ? stack.length : 0;
+      return { deficit, regexSkips };
+    }
+    function parsesAsAsyncStatement(line) {
+      try {
+        new Function(`return (async () => {
+${line}
+})`);
+        return true;
+      } catch {
+        return false;
+      }
+    }
     function closeUnclosedRegexLiterals(code) {
       const anchors = [
         { rx: /\b(?:waitForURL|toHaveURL)\(\//g, mode: "url" },
@@ -84434,12 +84921,33 @@ var require_discover_generator = __commonJS({
         const term = findRegexTerminator(code, slash, TERMINATORS[mode]);
         out.push(code.slice(cursor, slash));
         const raw = code.slice(slash + 1, term).replace(/\s+$/, "");
+        let closedLiteral;
         if (mode === "url") {
           const escaped = raw.replace(/(?<!\\)\//g, "\\/");
           const finalBody = escaped.startsWith("\\/") ? escaped : `\\/${escaped}`;
-          out.push(`/${finalBody}/`);
+          closedLiteral = `/${finalBody}/`;
         } else {
-          out.push(`/${raw}/`);
+          closedLiteral = `/${raw}/`;
+        }
+        out.push(closedLiteral);
+        if (code[term] === ")") {
+          const lineStart = code.lastIndexOf("\n", slash) + 1;
+          const nextNewline = code.indexOf("\n", term);
+          const lineEnd = nextNewline === -1 ? code.length : nextNewline;
+          const tail = code.slice(term, lineEnd);
+          const physicalLine = code.slice(lineStart, lineEnd);
+          const lineIsPlain = !physicalLine.includes("`") && !physicalLine.includes("/*") && !physicalLine.includes("*/");
+          const soleAnchorOnLine = !hits.some((h) => h.slash !== slash && h.slash >= lineStart && h.slash < lineEnd);
+          if (lineIsPlain && soleAnchorOnLine && /;\s*$/.test(tail)) {
+            const repairedLine = code.slice(lineStart, slash) + "/x/" + tail;
+            const { deficit, regexSkips } = lineParenDeficit(repairedLine);
+            if (deficit > 0 && deficit <= 3 && regexSkips === 1) {
+              const candidateLine = code.slice(lineStart, slash) + closedLiteral + ")".repeat(deficit) + tail;
+              if (parsesAsAsyncStatement(candidateLine)) {
+                out.push(")".repeat(deficit));
+              }
+            }
+          }
         }
         cursor = term;
       }
@@ -87140,7 +87648,15 @@ Do NOT add steps you did not execute. Do NOT skip steps from the recording.${led
                 tools: openaiTools,
                 tool_choice: "auto",
                 temperature: 0.2,
-                max_tokens: 8192
+                // Shared provider-aware output ceiling (same helper the survey planner uses):
+                // generous where the provider's max output is verified large (deepseek/minimax
+                // 65536), conservative elsewhere (16384). The old flat 8192 truncated large
+                // finish_generate emissions mid-JSON — the loop re-prompted on the parse error
+                // (line ~4744) and, for a test that genuinely needs >8192 output tokens, could
+                // never finish before the hard stop → zero tests for that scenario. It's a
+                // ceiling, not a target (calls finish at finish_reason:'stop' well under it), so
+                // this adds no per-call cost.
+                max_tokens: (0, discover_ai_planner_js_1.getAIPlannerMaxTokens)(agentModel)
               }, { signal });
             }), {
               label: `scenario-gen-iter-${iteration}`,
@@ -321751,6 +322267,7 @@ var require_mobile_discovery_agent = __commonJS({
     var mobile_exploration_state_js_1 = require_mobile_exploration_state();
     var mobile_discovery_auth_js_1 = require_mobile_discovery_auth();
     var mobile_driver_errors_js_1 = require_mobile_driver_errors();
+    var mobile_session_keepalive_js_1 = require_mobile_session_keepalive();
     var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var discover_planner_js_1 = require_discover_planner();
     function checkpointErrorMessage(err) {
@@ -322051,7 +322568,7 @@ Explore complete: ${explore.exploreStats.pagesDiscovered} screens, ${explore.exp
         const graph = state2.toScreenGraph();
         const screenMap = state2.buildInMemoryScreenMap();
         const testBudget = (0, discover_planner_js_1.computeTestBudget)(explore.exploreStats.pagesVisited, ctx.focusAreas);
-        const planResult = await runPlan({
+        const planResult = await (0, mobile_session_keepalive_js_1.withMobileSessionKeepAlive)(driver, () => runPlan({
           graph,
           mode,
           projectId: ctx.projectId,
@@ -322075,7 +322592,7 @@ Explore complete: ${explore.exploreStats.pagesDiscovered} screens, ${explore.exp
         }, {
           modelOverride: ctx.planModel ?? ctx.generateModel,
           onAICall
-        });
+        }));
         logs2.push(...planResult.logs);
         log2(`
 Plan: ${planResult.scenarios.length} scenarios, ${planResult.featureGroups.length} feature groups (budget: ${testBudget})`);
@@ -322933,6 +323450,7 @@ Health: ${surveyHealth.totalIssues} issue(s) - ${surveyHealth.consoleErrors.leng
           if (surveyAuthRecipe) {
             logs2.push(`Auth-prologue: captured + verified login recipe ${surveyAuthRecipe.recipeHash} during survey \u2014 persisting for reuse on later runs`);
           }
+          const plannerFailedError = planResult.plannerFailed ? `Survey planning failed (${planResult.plannerFailureKind ?? "unknown"}): ${planResult.fallbackReason ?? "planner did not produce a usable plan"}. Explore evidence was saved; re-run the survey to retry planning.` : void 0;
           return {
             observedOrigins: mergeObservedOrigins(exploreResult.observedOrigins, loginObservedOrigins),
             resolvedAppOrigin: surveyAuthRecipe?.appOrigin ?? void 0,
@@ -322948,7 +323466,8 @@ Health: ${surveyHealth.totalIssues} issue(s) - ${surveyHealth.consoleErrors.leng
             exploreTruncatedReason: exploreResult.truncatedReason,
             fallbackUsed: planResult.fallbackUsed ?? false,
             fallbackReason: planResult.fallbackReason,
-            featureGroups,
+            error: plannerFailedError,
+            featureGroups: plannerFailedError ? void 0 : featureGroups,
             apiCalls: discoveryApiCalls.length > 0 ? discoveryApiCalls : void 0,
             healthObservations: surveyHealth,
             exploreFinalMessages: exploreResult.finalMessages,
@@ -336806,7 +337325,7 @@ var require_package4 = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.39",
+      version: "1.0.41",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"
@@ -336815,7 +337334,7 @@ var require_package4 = __commonJS({
         build: "tsup",
         dev: "tsx src/cli.ts",
         test: "node --import tsx --test src/version-check.test.ts",
-        "test:mobile": "node --import tsx --test src/runner.mobile-ai-env.test.ts src/mobile-device-queue.test.ts src/device-lease.test.ts src/result-payload-budget.test.ts src/services/appium-*.test.ts src/services/*mobile*.test.ts src/services/mobile/*.test.ts",
+        "test:mobile": "node --import tsx --test --test-concurrency=2 src/runner.mobile-ai-env.test.ts src/mobile-device-queue.test.ts src/device-lease.test.ts src/result-payload-budget.test.ts src/services/appium-*.test.ts src/services/*mobile*.test.ts src/services/mobile/*.test.ts",
         prepublishOnly: "npm run build"
       },
       files: [
@@ -342966,6 +343485,17 @@ var MobileBridgeDriver = class {
       return size;
     });
   }
+  /**
+   * Recovery-free liveness probe for keep-alive ticks (mobile-session-keepalive).
+   * Deliberately NOT wrapped in withSessionRecovery: keep-alive ticks are
+   * fire-and-forget, so a failing probe must never consume the bounded recovery
+   * budget or relaunch the app from the background — a genuinely dead session
+   * surfaces (with its precise error) on the caller's next REAL command, which
+   * still runs the full recovery path.
+   */
+  async keepAlivePing() {
+    await this.assertSessionReachable();
+  }
   // ── Action result wrapper ──────────────────────────────
   /**
    * Run an action body, let the UI tree settle, then capture the post-action
@@ -345523,6 +346053,7 @@ ${finalVerifyResult.logs ?? ""}`;
           setExecutorBusy(true);
           let session = null;
           let capture = null;
+          let discoveryTeardownStarted = false;
           try {
             const discoverySessionTarget = {
               appId: mobileTarget.appId,
@@ -345574,6 +346105,9 @@ ${finalVerifyResult.logs ?? ""}`;
               allowAppReset: mobileTarget.resetPolicy !== "PRESERVE_APP_DATA" && shouldResetMobileAppData(platform3, session.deviceId),
               maxSessionRecoveries: 1,
               recoverSession: async (cause) => {
+                if (discoveryTeardownStarted) {
+                  throw new Error("discovery teardown already started \u2014 not recreating the Appium session");
+                }
                 const lost = session;
                 mobileOnLog(
                   `[appium] discovery session lost (${cause.message}); recreating once on the leased device`
@@ -345587,6 +346121,13 @@ ${finalVerifyResult.logs ?? ""}`;
                   }
                 }
                 const replacement = await openDiscoverySession();
+                if (discoveryTeardownStarted) {
+                  try {
+                    await replacement.stop();
+                  } catch {
+                  }
+                  throw new Error("discovery teardown started during session recovery \u2014 replacement session closed");
+                }
                 session = replacement;
                 attachMirrorSession(replacement.sessionId, platform3, replacement.deviceId);
                 liveBrowserHandle.patch({
@@ -345626,10 +346167,23 @@ ${finalVerifyResult.logs ?? ""}`;
               onPlanReady
             });
           } finally {
+            discoveryTeardownStarted = true;
+            const TEARDOWN_STEP_TIMEOUT = /* @__PURE__ */ Symbol("vqa-teardown-timeout");
+            const timeboxed = async (step) => Promise.race([
+              step,
+              new Promise((resolve2) => {
+                const t = setTimeout(() => resolve2(TEARDOWN_STEP_TIMEOUT), 45e3);
+                t.unref?.();
+              })
+            ]);
             const activeCapture = capture;
             if (activeCapture) {
               try {
-                const apiCalls = await activeCapture.stop();
+                const stopped = await timeboxed(activeCapture.stop());
+                if (stopped === TEARDOWN_STEP_TIMEOUT) {
+                  throw new Error("capture stop timed out after 45s \u2014 continuing teardown without apiCalls");
+                }
+                const apiCalls = stopped;
                 const captureHealth = activeCapture.health();
                 if (discoveryResult) {
                   discoveryResult.apiCalls = apiCalls.length ? attachMobileDiscoveryNetworkContext(apiCalls, discoveryResult, session?.appId ?? mobileTarget.appId) : void 0;
@@ -345649,8 +346203,12 @@ ${finalVerifyResult.logs ?? ""}`;
             }
             if (session) {
               detachMirrorSession(session.deviceId);
+              const closing = session;
               try {
-                await session.stop();
+                const stopped = await timeboxed(closing.stop());
+                if (stopped === TEARDOWN_STEP_TIMEOUT) {
+                  mobileOnLog(`[appium] session ${closing.sessionId} stop timed out after 45s \u2014 releasing device ${closing.deviceId} anyway; Appium may hold the session until newCommandTimeout reaps it`);
+                }
               } catch {
               }
             }
@@ -346088,7 +346646,13 @@ ${finalVerifyResult.logs ?? ""}`;
                   relaunch: async () => {
                     await currentDriver().relaunch();
                   },
-                  resetAppState: async () => target.resetPolicy === "PRESERVE_APP_DATA" ? false : currentDriver().resetAppState()
+                  resetAppState: async () => target.resetPolicy === "PRESERVE_APP_DATA" ? false : currentDriver().resetAppState(),
+                  // Recovery-free liveness probe so the loop's keep-alive can span
+                  // long AI waits without touching the driver's recovery machinery
+                  // (see mobile-session-keepalive.ts).
+                  keepAlivePing: async () => {
+                    await currentDriver().keepAlivePing();
+                  }
                 };
                 const runNativeWithSessionHandoff = async (verifyArgs) => {
                   await closeLiveSession();