@validate.qa/runner 1.0.42 → 1.0.43

package/dist/cli.js

@@ -1756,7 +1756,18 @@ var init_constants = __esm({
       "MINIMAX_API_KEY",
       "ANTHROPIC_API_KEY",
       "NVIDIA_API_KEY",
-      "DEEPSEEK_API_KEY"
+      "DEEPSEEK_API_KEY",
+      // Run-scoped callback capabilities. The parent runner injects these after
+      // sanitization; customer variables must never impersonate the control plane.
+      "AUTH_FILE",
+      "SHARED_AUTH_INJECT",
+      "VALIDATE_RUN_ID",
+      "VALIDATE_CLAIM_EPOCH",
+      "VALIDATE_AUTH_CONFIG_HASH",
+      "VALIDATE_TASK_ARN",
+      "VALIDATE_RUNNER_AUTH",
+      "VALIDATE_SERVER_URL",
+      "VALIDATE_LIVE_BROWSER_STATE_PATH"
     ]);
     SPAWNED_ENV_ALLOWLIST = /* @__PURE__ */ new Set([
       // Runtime essentials - Node.js and Playwright need these to function
@@ -5024,6 +5035,16 @@ var init_voice_config = __esm({
   }
 });
 
+// ../shared/dist/feature-flags.js
+function isSharedAuthInjectEnabled(value = process.env.SHARED_AUTH_INJECT) {
+  return value?.trim().toLowerCase() !== "false";
+}
+var init_feature_flags = __esm({
+  "../shared/dist/feature-flags.js"() {
+    "use strict";
+  }
+});
+
 // ../shared/dist/index.js
 var dist_exports = {};
 __export(dist_exports, {
@@ -5147,6 +5168,7 @@ __export(dist_exports, {
   isRunnableStep: () => isRunnableStep,
   isSafeDeepLink: () => isSafeDeepLink,
   isSameRegistrableDomainHost: () => isSameRegistrableDomainHost,
+  isSharedAuthInjectEnabled: () => isSharedAuthInjectEnabled,
   isSttModelForProvider: () => isSttModelForProvider,
   isTestReadyForPlatform: () => isTestReadyForPlatform,
   isTrialExpired: () => isTrialExpired,
@@ -5213,6 +5235,7 @@ var init_dist = __esm({
     init_test_counting();
     init_origin_domain();
     init_voice_config();
+    init_feature_flags();
   }
 });
 
@@ -10676,7 +10699,7 @@ var require_transport = __commonJS({
   "../../node_modules/pino/lib/transport.js"(exports2, module2) {
     "use strict";
     var { createRequire } = require("module");
-    var { existsSync: existsSync4 } = require("fs");
+    var { existsSync: existsSync3 } = require("fs");
     var getCallers = require_caller();
     var { join: join7, isAbsolute, sep } = require("path");
     var { fileURLToPath } = require("url");
@@ -10750,7 +10773,7 @@ var require_transport = __commonJS({
           return false;
         }
       }
-      return isAbsolute(path) && !existsSync4(path);
+      return isAbsolute(path) && !existsSync3(path);
     }
     function stripQuotes(value) {
       const first = value[0];
@@ -76165,6 +76188,126 @@ export const test = base.extend({
   }
 });
 
+// ../runner-core/dist/services/run-callback-proxy.js
+var require_run_callback_proxy = __commonJS({
+  "../runner-core/dist/services/run-callback-proxy.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.startRunCallbackProxy = startRunCallbackProxy;
+    var node_crypto_1 = require("crypto");
+    var node_http_1 = require("http");
+    var MAX_CALLBACK_BODY_BYTES = 5 * 1024 * 1024;
+    var CALLBACK_TIMEOUT_MS = 3e4;
+    function sendJson(res, status, body) {
+      const payload = JSON.stringify(body);
+      res.writeHead(status, {
+        "cache-control": "no-store",
+        "content-type": "application/json",
+        "content-length": Buffer.byteLength(payload)
+      });
+      res.end(payload);
+    }
+    async function readRequestBody(req) {
+      const chunks = [];
+      let total = 0;
+      for await (const chunk of req) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        total += buffer.length;
+        if (total > MAX_CALLBACK_BODY_BYTES)
+          throw new Error("callback body too large");
+        chunks.push(buffer);
+      }
+      return Buffer.concat(chunks);
+    }
+    async function startRunCallbackProxy(input) {
+      const upstream = new URL(input.serverUrl);
+      if (upstream.protocol !== "http:" && upstream.protocol !== "https:") {
+        throw new Error("callback server URL must use http or https");
+      }
+      const runPath = `/api/runner/runs/${encodeURIComponent(input.runId)}`;
+      const allowedPaths = /* @__PURE__ */ new Set([`${runPath}/credential`, `${runPath}/auth-state`]);
+      const token = (0, node_crypto_1.randomBytes)(32).toString("base64url");
+      const authHeader = `Bearer ${token}`;
+      const server3 = (0, node_http_1.createServer)(async (req, res) => {
+        try {
+          const requestUrl = new URL(req.url ?? "/", "http://127.0.0.1");
+          if (req.method !== "POST" || !allowedPaths.has(requestUrl.pathname) || requestUrl.search) {
+            sendJson(res, 404, { error: "Callback route not available" });
+            return;
+          }
+          if (req.headers.authorization !== authHeader) {
+            sendJson(res, 401, { error: "Invalid callback capability" });
+            return;
+          }
+          const body = await readRequestBody(req);
+          let parsedBody;
+          try {
+            const parsed = JSON.parse(body.toString("utf8"));
+            if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+              throw new Error("invalid body");
+            parsedBody = parsed;
+          } catch {
+            sendJson(res, 400, { error: "Callback body must be a JSON object" });
+            return;
+          }
+          const upstreamBody = JSON.stringify({
+            ...parsedBody,
+            ...input.taskArn ? { taskArn: input.taskArn } : {},
+            ...input.claimEpoch !== void 0 ? { claimEpoch: input.claimEpoch } : {},
+            ...input.authConfigHash ? { authConfigHash: input.authConfigHash } : {}
+          });
+          const destination = new URL(requestUrl.pathname, upstream);
+          const response = await fetch(destination, {
+            method: "POST",
+            headers: {
+              Authorization: input.upstreamAuthHeader,
+              "Content-Type": "application/json"
+            },
+            body: upstreamBody,
+            redirect: "error",
+            signal: AbortSignal.timeout(CALLBACK_TIMEOUT_MS)
+          });
+          const responseBody = Buffer.from(await response.arrayBuffer());
+          res.writeHead(response.status, {
+            "cache-control": "no-store",
+            "content-type": response.headers.get("content-type") ?? "application/json",
+            "content-length": responseBody.length
+          });
+          res.end(responseBody);
+        } catch (error2) {
+          const message = error2 instanceof Error && error2.message === "callback body too large" ? error2.message : "Callback forwarding failed";
+          sendJson(res, message === "callback body too large" ? 413 : 502, { error: message });
+        }
+      });
+      server3.on("clientError", (_error, socket) => socket.destroy());
+      await new Promise((resolve2, reject) => {
+        const onError = (error2) => reject(error2);
+        server3.once("error", onError);
+        server3.listen(0, "127.0.0.1", () => {
+          server3.off("error", onError);
+          resolve2();
+        });
+      });
+      const address = server3.address();
+      if (!address) {
+        server3.close();
+        throw new Error("callback proxy failed to bind");
+      }
+      let closed = false;
+      return {
+        serverUrl: `http://127.0.0.1:${address.port}`,
+        authHeader,
+        close: async () => {
+          if (closed)
+            return;
+          closed = true;
+          await new Promise((resolve2) => server3.close(() => resolve2()));
+        }
+      };
+    }
+  }
+});
+
 // ../runner-core/dist/services/playwright-native.js
 var require_playwright_native = __commonJS({
   "../runner-core/dist/services/playwright-native.js"(exports2) {
@@ -76209,6 +76352,7 @@ var require_playwright_native = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.scrubHarRequestBody = exports2.buildOriginScopedApiFixtures = exports2.isAppOriginRequest = exports2.resolveApiAuthHeaders = exports2.parseApiAuthHeaders = void 0;
     exports2.executeTestViaNativePlaywright = executeTestViaNativePlaywright2;
+    exports2.buildNativePlaywrightChildEnv = buildNativePlaywrightChildEnv;
     exports2.parseJsonResults = parseJsonResults2;
     exports2.parseHarToApiSummary = parseHarToApiSummary;
     var promises_1 = require("fs/promises");
@@ -76220,6 +76364,7 @@ var require_playwright_native = __commonJS({
     var api_call_redaction_js_1 = require_api_call_redaction();
     var har_stream_js_1 = require_har_stream();
     var api_auth_headers_js_1 = require_api_auth_headers();
+    var run_callback_proxy_js_1 = require_run_callback_proxy();
     var api_auth_headers_js_2 = require_api_auth_headers();
     Object.defineProperty(exports2, "parseApiAuthHeaders", { enumerable: true, get: function() {
       return api_auth_headers_js_2.parseApiAuthHeaders;
@@ -76242,7 +76387,7 @@ var require_playwright_native = __commonJS({
     var RUNS_DIR = process.env.RUNS_DIR || (0, path_1.join)(PACKAGE_DIR, ".qa-runs");
     var PW_CLI = require.resolve("@playwright/test/cli");
     async function executeTestViaNativePlaywright2(options) {
-      const { playwrightCode, baseUrl, testName, testVariables, storageStatePath, extraHttpHeaders, validateContext, liveBrowserHandle, onLiveBrowserSnapshot } = options;
+      const { playwrightCode, baseUrl, testName, testVariables, authStateCapturePath, storageStatePath, extraHttpHeaders, validateContext, liveBrowserHandle, onLiveBrowserSnapshot } = options;
       const logs2 = [];
       const screenshots = [];
       logs2.push(`\u{1F3AD} Native Playwright starting`);
@@ -76252,6 +76397,7 @@ var require_playwright_native = __commonJS({
         logs2.push("\u26A0\uFE0F WARNING: baseUrl is empty - test will likely fail with navigation errors");
       }
       let runDir = null;
+      let callbackProxy;
       try {
         runDir = (0, path_1.join)(RUNS_DIR, (0, crypto_1.randomUUID)());
         await (0, promises_1.mkdir)(runDir, { recursive: true });
@@ -76511,35 +76657,51 @@ module.exports = {
         const configPath = (0, path_1.join)(runDir, "playwright.config.js");
         await (0, promises_1.writeFile)(configPath, config);
         const isolation = await (0, chromium_isolation_js_1.createChromiumIsolation)(runDir);
-        const envWithIsolation = {
-          ...testVariables ?? {},
+        const processClaimEpoch = Number(process.env.CLAIM_EPOCH);
+        const callbackClaimEpoch = Number.isSafeInteger(validateContext?.claimEpoch) ? validateContext?.claimEpoch : Number.isSafeInteger(processClaimEpoch) && processClaimEpoch >= 0 ? processClaimEpoch : void 0;
+        if (validateContext?.runId && validateContext.serverUrl && validateContext.authHeader) {
+          try {
+            callbackProxy = await (0, run_callback_proxy_js_1.startRunCallbackProxy)({
+              runId: validateContext.runId,
+              serverUrl: validateContext.serverUrl,
+              upstreamAuthHeader: validateContext.authHeader,
+              taskArn: process.env.VALIDATE_TASK_ARN,
+              claimEpoch: callbackClaimEpoch,
+              authConfigHash: process.env.VALIDATE_AUTH_CONFIG_HASH
+            });
+          } catch (error3) {
+            logs2.push(`Callback proxy unavailable: ${error3 instanceof Error ? error3.message : String(error3)}`);
+          }
+        }
+        const childTestVariables = { ...testVariables ?? {} };
+        const trustedRuntimeEnv = {
           ...isolation.env,
-          // persistCredential() callback envs — set only when the runner supplied
-          // validateContext. Without these the helper inside the test no-ops with
-          // a warning, which is the correct behavior when the test is being run
-          // manually (outside the validate.qa harness).
-          ...validateContext?.runId ? { VALIDATE_RUN_ID: validateContext.runId } : {},
-          ...validateContext?.serverUrl ? { VALIDATE_SERVER_URL: validateContext.serverUrl } : {},
-          ...validateContext?.authHeader ? { VALIDATE_RUNNER_AUTH: validateContext.authHeader } : {},
+          // Generated callbacks receive only a random loopback capability. The global
+          // runner bearer token and real control-plane URL stay in the parent process.
+          ...callbackProxy && validateContext?.runId ? {
+            VALIDATE_RUN_ID: validateContext.runId,
+            ...callbackClaimEpoch !== void 0 ? { VALIDATE_CLAIM_EPOCH: String(callbackClaimEpoch) } : {},
+            VALIDATE_SERVER_URL: callbackProxy.serverUrl,
+            VALIDATE_RUNNER_AUTH: callbackProxy.authHeader
+          } : {},
           // Owning Fargate taskArn (a per-task constant set once at task boot in
           // execute-one.ts; absent on the local/Railway runner). Read from
           // process.env rather than validateContext since it's process-wide, not
           // per-run. Lets persistCredential() prove ownership to /credential.
           ...process.env.VALIDATE_TASK_ARN ? { VALIDATE_TASK_ARN: process.env.VALIDATE_TASK_ARN } : {},
+          ...authStateCapturePath ? { AUTH_FILE: authStateCapturePath } : {},
           ...liveBrowserStatePath ? { VALIDATE_LIVE_BROWSER_STATE_PATH: liveBrowserStatePath } : {},
-          // Shared-auth kill-switch (SHARED_AUTH_INJECT) must reach the child: the stamped
-          // __vqaLogin's early-publish POST is gated on it at RUNTIME. buildSandboxedEnv only
-          // copies an allowlist from process.env (SHARED_AUTH_INJECT is not on it), so without
-          // this forward the flag reads as undefined in the test and the early publish is dead
-          // code. Forwarded (not allowlisted) so it stays a per-run toggle; absent → inert.
+          // Preserve an explicit shared-auth kill-switch in the child. Unset defaults on in
+          // both parent and generated __vqaLogin code; "false" must still cross this process
+          // boundary to disable the early publish POST. It remains a per-run toggle.
           ...process.env.SHARED_AUTH_INJECT ? { SHARED_AUTH_INJECT: process.env.SHARED_AUTH_INJECT } : {}
         };
-        delete envWithIsolation.API_AUTH_HEADERS;
+        delete childTestVariables.API_AUTH_HEADERS;
         logs2.push("\u{1F680} Spawning playwright test...");
         const stopLiveBrowserPolling = liveBrowserStatePath && liveBrowserHandle ? startLiveBrowserStatePolling(liveBrowserStatePath, liveBrowserHandle, onLiveBrowserSnapshot) : null;
         let playResult;
         try {
-          playResult = await runPlaywright(configPath, envWithIsolation);
+          playResult = await runPlaywright(configPath, childTestVariables, trustedRuntimeEnv);
         } finally {
           await stopLiveBrowserPolling?.();
         }
@@ -76623,6 +76785,8 @@ ${passed ? "\u2705" : "\u274C"} Test ${passed ? "PASSED" : "FAILED"}${error2 ? `
           error: msg
         };
       } finally {
+        await callbackProxy?.close().catch(() => {
+        });
         if (runDir) {
           await (0, promises_1.rm)(runDir, { recursive: true, force: true }).catch(() => {
           });
@@ -76674,9 +76838,9 @@ ${passed ? "\u2705" : "\u274C"} Test ${passed ? "PASSED" : "FAILED"}${error2 ? `
         stopped = true;
       };
     }
-    function runPlaywright(configPath, extraEnv) {
+    function runPlaywright(configPath, testVariables, trustedRuntimeEnv) {
       return new Promise((resolvePromise) => {
-        const sandboxedEnv = (0, shared_1.buildSandboxedEnv)(process.env, extraEnv);
+        const sandboxedEnv = buildNativePlaywrightChildEnv(process.env, testVariables, trustedRuntimeEnv);
         const proc = (0, spawn_with_tree_kill_js_1.spawnDetachedGroup)(process.execPath, [PW_CLI, "test", "--config", configPath], {
           cwd: PACKAGE_DIR,
           env: sandboxedEnv,
@@ -76719,6 +76883,12 @@ ${passed ? "\u2705" : "\u274C"} Test ${passed ? "PASSED" : "FAILED"}${error2 ? `
         });
       });
     }
+    function buildNativePlaywrightChildEnv(processEnv, testVariables, trustedRuntimeEnv) {
+      return {
+        ...(0, shared_1.buildSandboxedEnv)(processEnv, testVariables),
+        ...trustedRuntimeEnv ?? {}
+      };
+    }
     async function collectScreenshots(dir, screenshots) {
       let entries;
       try {
@@ -80440,10 +80610,12 @@ var require_auth_recipe = __commonJS({
     exports2.upsertAuthBlock = upsertAuthBlock;
     exports2.buildHealAuthStamp = buildHealAuthStamp;
     var crypto_1 = require("crypto");
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var discovery_lint_flags_js_1 = require_discovery_lint_flags();
-    exports2.AUTH_MARKER_VERSION = "v1";
+    exports2.AUTH_MARKER_VERSION = "v3";
     var START_MARKER = `// >>> VALIDATE_QA_AUTH ${exports2.AUTH_MARKER_VERSION} \u2014 generated, do not edit >>>`;
     var END_MARKER = `// <<< VALIDATE_QA_AUTH ${exports2.AUTH_MARKER_VERSION} <<<`;
+    var SHARED_AUTH_RUNTIME_ENABLED = `!/^false$/i.test((process.env.SHARED_AUTH_INJECT ?? '').trim())`;
     var AUTH_REGION_RE = /\/\/ >>> VALIDATE_QA_AUTH[^\n]*\r?\n[\s\S]*?\/\/ <<< VALIDATE_QA_AUTH[^\n]*\r?\n?/g;
     function computeRecipeHash(input) {
       const canonical = JSON.stringify({
@@ -80521,16 +80693,18 @@ var require_auth_recipe = __commonJS({
       if (opts?.warmGuard) {
         const warmLanding = recipe.redirectRoute ?? (recipe.authProof.kind === "url" ? recipe.authProof.route : recipe.preNavRoute);
         const loginRoute = recipe.route ?? recipe.preNavRoute;
-        lines.push(`  await page.goto(${JSON.stringify(warmLanding)}, { waitUntil: 'domcontentloaded' }).catch(() => {});`);
+        lines.push(`  if (${SHARED_AUTH_RUNTIME_ENABLED}) {`);
+        lines.push(`    await page.goto(${JSON.stringify(warmLanding)}, { waitUntil: 'domcontentloaded' }).catch(() => {});`);
         if (recipe.authProof.kind === "url") {
           const pred = urlProofPredicateExpr(recipe.authProof.route);
-          lines.push(`  await page.waitForURL((u) => !(${pred})(u), { timeout: 2000 }).catch(() => {});`);
-          lines.push(`  if ((${pred})(new URL(page.url())) && !(await page.locator('input[type="password"]').first().isVisible().catch(() => false))) return;`);
+          lines.push(`    await page.waitForURL((u) => !(${pred})(u), { timeout: 2000 }).catch(() => {});`);
+          lines.push(`    if ((${pred})(new URL(page.url())) && !(await page.locator('input[type="password"]').first().isVisible().catch(() => false))) return;`);
         } else if (loginRoute) {
-          lines.push(`  if (await ${authProofLocator(recipe.authProof)}.isVisible().catch(() => false) && new URL(page.url()).pathname !== new URL(${JSON.stringify(loginRoute)}, page.url()).pathname) return;`);
+          lines.push(`    if (await ${authProofLocator(recipe.authProof)}.isVisible().catch(() => false) && new URL(page.url()).pathname !== new URL(${JSON.stringify(loginRoute)}, page.url()).pathname) return;`);
         } else {
-          lines.push(`  if (await ${authProofLocator(recipe.authProof)}.isVisible().catch(() => false)) return;`);
+          lines.push(`    if (await ${authProofLocator(recipe.authProof)}.isVisible().catch(() => false)) return;`);
         }
+        lines.push(`  }`);
       }
       lines.push(`  await page.goto(${JSON.stringify(recipe.preNavRoute)}, { waitUntil: 'domcontentloaded' });`);
       for (const cmd of recipe.preNavCmds)
@@ -80543,11 +80717,11 @@ var require_auth_recipe = __commonJS({
       lines.push(renderAuthUrlWaitLine(recipe.redirectRoute));
       lines.push(`  ${renderAuthProofAssertion(recipe.authProof)}`);
       if (opts?.warmGuard) {
-        lines.push(`  if (process.env.AUTH_FILE) await page.context().storageState({ path: process.env.AUTH_FILE });`);
-        lines.push(`  if (process.env.SHARED_AUTH_INJECT === 'true' && process.env.VALIDATE_TASK_ARN && process.env.VALIDATE_SERVER_URL && process.env.VALIDATE_RUN_ID) {`);
+        lines.push(`  if (${SHARED_AUTH_RUNTIME_ENABLED} && process.env.AUTH_FILE) await page.context().storageState({ path: process.env.AUTH_FILE });`);
+        lines.push(`  if (${SHARED_AUTH_RUNTIME_ENABLED} && process.env.VALIDATE_TASK_ARN && process.env.VALIDATE_CLAIM_EPOCH && process.env.VALIDATE_SERVER_URL && process.env.VALIDATE_RUN_ID) {`);
         lines.push(`    try {`);
         lines.push(`      const __vqaState = await page.context().storageState();`);
-        lines.push(`      await page.request.post(process.env.VALIDATE_SERVER_URL + '/api/runner/runs/' + process.env.VALIDATE_RUN_ID + '/auth-state', { headers: { Authorization: process.env.VALIDATE_RUNNER_AUTH || '' }, data: { storageState: JSON.stringify(__vqaState), taskArn: process.env.VALIDATE_TASK_ARN }, timeout: 10000 });`);
+        lines.push(`      await page.request.post(process.env.VALIDATE_SERVER_URL + '/api/runner/runs/' + process.env.VALIDATE_RUN_ID + '/auth-state', { headers: { Authorization: process.env.VALIDATE_RUNNER_AUTH || '' }, data: { storageState: JSON.stringify(__vqaState), taskArn: process.env.VALIDATE_TASK_ARN, claimEpoch: Number(process.env.VALIDATE_CLAIM_EPOCH) }, timeout: 10000 });`);
         lines.push(`    } catch {}`);
         lines.push(`  }`);
       }
@@ -80559,6 +80733,8 @@ var require_auth_recipe = __commonJS({
       "AUTH_FILE",
       "SHARED_AUTH_INJECT",
       "VALIDATE_RUN_ID",
+      "VALIDATE_CLAIM_EPOCH",
+      "VALIDATE_AUTH_CONFIG_HASH",
       "VALIDATE_TASK_ARN",
       "VALIDATE_RUNNER_AUTH",
       "VALIDATE_SERVER_URL"
@@ -80731,7 +80907,7 @@ ${tail}`;
         let result = stripAuthRegions(code);
         result = result.replace(/^[ \t]*await[ \t]+__vqaLogin[ \t]*\([ \t]*page[ \t]*\)[ \t]*;?[ \t]*\r?\n/gm, "");
         result = ensureExpectImported(result);
-        const warmGuard = process.env.SHARED_AUTH_INJECT === "true";
+        const warmGuard = (0, shared_1.isSharedAuthInjectEnabled)();
         result = insertAfterPwImport(result, renderAuthFn(ctx.recipe, { warmGuard }));
         result = ensureLoginCall(result);
         const n = countAuthRegions(result);
@@ -85861,9 +86037,9 @@ ${testOpen}`;
           basePath: options?.basePath
         });
         const leakedSensitiveKeys = findSensitiveLiteralLeaks(playwrightCode, options?.sensitiveEnvMap);
-        const authGuardStamped = !!options?.authRecipe && rawTags.includes("@needs-auth") && !rawTags.includes("@auth") && process.env.SHARED_AUTH_INJECT === "true";
-        const baseTags = ensureDiscoveredTag(Array.isArray(test.tags) ? test.tags : ["@discovered", "@regression"]);
-        const tags = authGuardStamped && !baseTags.includes("@auth-guarded") ? [...baseTags, "@auth-guarded"] : baseTags;
+        const authGuardStamped = !!options?.authRecipe && rawTags.includes("@needs-auth") && !rawTags.includes("@auth") && (0, shared_1.isSharedAuthInjectEnabled)() && /\/\/ >>> VALIDATE_QA_AUTH v\d+\b[\s\S]*?process\.env\.AUTH_FILE[\s\S]*?\/\/ <<< VALIDATE_QA_AUTH v\d+\b/.test(playwrightCode);
+        const baseTags = ensureDiscoveredTag(Array.isArray(test.tags) ? test.tags : ["@discovered", "@regression"]).filter((tag) => tag !== "@auth-guarded");
+        const tags = authGuardStamped ? [...baseTags, "@auth-guarded"] : baseTags;
         return {
           name: String(test.name || "Unnamed test").slice(0, 200),
           description: String(test.description || test.name || "").slice(0, 500),
@@ -99678,7 +99854,7 @@ ${lanes.join("\n")}
               return process.memoryUsage().heapUsed;
             },
             getFileSize(path) {
-              const stat = statSync2(path);
+              const stat = statSync(path);
               if (stat == null ? void 0 : stat.isFile()) {
                 return stat.size;
               }
@@ -99722,7 +99898,7 @@ ${lanes.join("\n")}
             }
           };
           return nodeSystem;
-          function statSync2(path) {
+          function statSync(path) {
             try {
               return _fs.statSync(path, statSyncOptions);
             } catch {
@@ -99781,7 +99957,7 @@ ${lanes.join("\n")}
               activeSession.post("Profiler.stop", (err, { profile }) => {
                 var _a;
                 if (!err) {
-                  if ((_a = statSync2(profilePath)) == null ? void 0 : _a.isDirectory()) {
+                  if ((_a = statSync(profilePath)) == null ? void 0 : _a.isDirectory()) {
                     profilePath = _path.join(profilePath, `${(/* @__PURE__ */ new Date()).toISOString().replace(/:/g, "-")}+P${process.pid}.cpuprofile`);
                   }
                   try {
@@ -99901,7 +100077,7 @@ ${lanes.join("\n")}
                 let stat;
                 if (typeof dirent === "string" || dirent.isSymbolicLink()) {
                   const name = combinePaths(path, entry);
-                  stat = statSync2(name);
+                  stat = statSync(name);
                   if (!stat) {
                     continue;
                   }
@@ -99925,7 +100101,7 @@ ${lanes.join("\n")}
             return matchFiles(path, extensions, excludes, includes, useCaseSensitiveFileNames2, process.cwd(), depth, getAccessibleFileSystemEntries, realpath);
           }
           function fileSystemEntryExists(path, entryKind) {
-            const stat = statSync2(path);
+            const stat = statSync(path);
             if (!stat) {
               return false;
             }
@@ -99967,7 +100143,7 @@ ${lanes.join("\n")}
           }
           function getModifiedTime3(path) {
             var _a;
-            return (_a = statSync2(path)) == null ? void 0 : _a.mtime;
+            return (_a = statSync(path)) == null ? void 0 : _a.mtime;
           }
           function setModifiedTime(path, time) {
             try {
@@ -308478,6 +308654,7 @@ var require_regression_runner = __commonJS({
     var chromium_isolation_js_1 = require_chromium_isolation();
     var browser_config_js_1 = require_browser_config();
     var spawn_with_tree_kill_js_1 = require_spawn_with_tree_kill();
+    var run_callback_proxy_js_1 = require_run_callback_proxy();
     var SUITE_SPAWN_TIMEOUT_MS = 85 * 60 * 1e3;
     var PACKAGE_DIR = (0, path_1.resolve)(__dirname, "..", "..");
     var RUNS_DIR = process.env.RUNS_DIR || (0, path_1.join)(PACKAGE_DIR, ".qa-runs");
@@ -308492,6 +308669,7 @@ var require_regression_runner = __commonJS({
       const tarPath = (0, path_1.join)(RUNS_DIR, `regression-${runId}.tar.gz`);
       const startTime = Date.now();
       let logs2 = "";
+      let callbackProxy;
       try {
         await (0, promises_1.mkdir)(extractDir, { recursive: true });
         const tarballUrl = `https://api.github.com/repos/${repoOwner}/${repoName}/tarball/${repoBranch}`;
@@ -308521,19 +308699,40 @@ var require_regression_runner = __commonJS({
         await (0, promises_1.writeFile)((0, path_1.join)(extractDir, ".env"), envContent, "utf-8");
         const jsonResultsPath = (0, path_1.join)(extractDir, "test-results", "results.json");
         const isolation = await (0, chromium_isolation_js_1.createChromiumIsolation)(extractDir);
+        const processClaimEpoch = Number(process.env.CLAIM_EPOCH);
+        const callbackClaimEpoch = Number.isSafeInteger(opts.claimEpoch) ? opts.claimEpoch : Number.isSafeInteger(processClaimEpoch) && processClaimEpoch >= 0 ? processClaimEpoch : void 0;
+        if (opts.validateServerUrl && opts.validateRunnerAuthHeader) {
+          try {
+            callbackProxy = await (0, run_callback_proxy_js_1.startRunCallbackProxy)({
+              runId,
+              serverUrl: opts.validateServerUrl,
+              upstreamAuthHeader: opts.validateRunnerAuthHeader,
+              taskArn: process.env.VALIDATE_TASK_ARN,
+              claimEpoch: callbackClaimEpoch,
+              authConfigHash: process.env.VALIDATE_AUTH_CONFIG_HASH
+            });
+          } catch (error2) {
+            logs2 += `Callback proxy unavailable: ${error2 instanceof Error ? error2.message : String(error2)}
+`;
+          }
+        }
         const runEnv = {
           ...(0, shared_1.buildSandboxedEnv)(process.env, testVariables),
           ...isolation.env,
           CI: "true",
           PLAYWRIGHT_JSON_OUTPUT_NAME: jsonResultsPath,
-          // Callback envs for tests/setup/credentials.ts → persistCredential.
-          // Tests that rotate a credential POST back to the server using these.
-          VALIDATE_RUN_ID: runId,
-          ...opts.validateServerUrl ? { VALIDATE_SERVER_URL: opts.validateServerUrl } : {},
-          ...opts.validateRunnerAuthHeader ? { VALIDATE_RUNNER_AUTH: opts.validateRunnerAuthHeader } : {},
+          // The suite receives a random run-scoped loopback callback, never the
+          // global runner bearer credential.
+          ...callbackProxy ? {
+            VALIDATE_RUN_ID: runId,
+            ...callbackClaimEpoch !== void 0 ? { VALIDATE_CLAIM_EPOCH: String(callbackClaimEpoch) } : {},
+            VALIDATE_SERVER_URL: callbackProxy.serverUrl,
+            VALIDATE_RUNNER_AUTH: callbackProxy.authHeader
+          } : {},
           // Owning Fargate taskArn (per-task constant; unset off-Fargate). Forwarded
           // so persistCredential() can prove ownership to the /credential fence.
-          ...process.env.VALIDATE_TASK_ARN ? { VALIDATE_TASK_ARN: process.env.VALIDATE_TASK_ARN } : {}
+          ...process.env.VALIDATE_TASK_ARN ? { VALIDATE_TASK_ARN: process.env.VALIDATE_TASK_ARN } : {},
+          ...process.env.SHARED_AUTH_INJECT ? { SHARED_AUTH_INJECT: process.env.SHARED_AUTH_INJECT } : {}
         };
         logs2 += `Running playwright --project=${opts.suiteProject ?? "suite"}...
 `;
@@ -308562,6 +308761,8 @@ var require_regression_runner = __commonJS({
           error: String(err)
         };
       } finally {
+        await callbackProxy?.close().catch(() => {
+        });
         (0, promises_1.rm)(extractDir, { recursive: true, force: true }).catch(() => {
         });
         await (0, browser_config_js_1.cleanupPlaywrightTempArtifacts)().catch(() => {
@@ -324805,6 +325006,455 @@ var require_resource_governor = __commonJS({
   }
 });
 
+// ../runner-core/dist/services/local-auth-state.js
+var require_local_auth_state = __commonJS({
+  "../runner-core/dist/services/local-auth-state.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.LOCAL_AUTH_STATE_LOCK_ABSOLUTE_STALE_MS = exports2.LOCAL_AUTH_STATE_LOCK_STALE_MS = exports2.LOCAL_AUTH_STATE_CLEANUP_INTERVAL_MS = exports2.LOCAL_AUTH_STATE_WAIT_MS = exports2.LOCAL_AUTH_STATE_MAX_AGE_MS = void 0;
+    exports2.shouldSkipWarmAuthSetup = shouldSkipWarmAuthSetup2;
+    exports2.shouldSkipDisabledAutomaticAuthSetup = shouldSkipDisabledAutomaticAuthSetup2;
+    exports2.localAuthStateFingerprint = localAuthStateFingerprint;
+    exports2.ensurePrivateDirectory = ensurePrivateDirectory2;
+    exports2.isValidStorageState = isValidStorageState;
+    exports2.isValidStorageStateJson = isValidStorageStateJson;
+    exports2.isValidLocalAuthStateFile = isValidLocalAuthStateFile;
+    exports2.cleanupLocalAuthStateFiles = cleanupLocalAuthStateFiles;
+    exports2.cleanupExpiredLocalAuthStateFiles = cleanupExpiredLocalAuthStateFiles2;
+    exports2.localAuthStatePaths = localAuthStatePaths2;
+    exports2.getValidLocalAuthState = getValidLocalAuthState2;
+    exports2.waitForValidLocalAuthState = waitForValidLocalAuthState;
+    exports2.waitForLocalAuthStateProducer = waitForLocalAuthStateProducer2;
+    exports2.promoteLocalAuthStateCapture = promoteLocalAuthStateCapture2;
+    exports2.discardLocalAuthStateCapture = discardLocalAuthStateCapture2;
+    exports2.acquireLocalAuthStateLock = acquireLocalAuthStateLock2;
+    exports2.localAuthStateFilename = localAuthStateFilename;
+    var node_fs_1 = require("fs");
+    var node_crypto_1 = require("crypto");
+    var node_path_1 = require("path");
+    var auth_recipe_js_1 = require_auth_recipe();
+    exports2.LOCAL_AUTH_STATE_MAX_AGE_MS = 60 * 60 * 1e3;
+    exports2.LOCAL_AUTH_STATE_WAIT_MS = 3 * 60 * 1e3;
+    exports2.LOCAL_AUTH_STATE_CLEANUP_INTERVAL_MS = 15 * 60 * 1e3;
+    exports2.LOCAL_AUTH_STATE_LOCK_STALE_MS = 2 * 60 * 1e3;
+    exports2.LOCAL_AUTH_STATE_LOCK_ABSOLUTE_STALE_MS = 30 * 60 * 1e3;
+    function shouldSkipWarmAuthSetup2(authForceRun, sharedAuthEnabled, cacheWarm) {
+      return sharedAuthEnabled && authForceRun !== true && cacheWarm;
+    }
+    function shouldSkipDisabledAutomaticAuthSetup2(authForceRun, authVerify, sharedAuthEnabled) {
+      return !sharedAuthEnabled && authForceRun !== true && authVerify !== true;
+    }
+    function normalizeOrigin(value) {
+      try {
+        return new URL(value).origin.toLowerCase();
+      } catch {
+        return value.trim().toLowerCase();
+      }
+    }
+    function normalizeAppUrl(value) {
+      try {
+        const url = new URL(value);
+        url.hash = "";
+        return `${url.origin.toLowerCase()}${url.pathname}${url.search}`;
+      } catch {
+        return value.trim();
+      }
+    }
+    function safeSegment(value, fallback) {
+      const safe = value.replace(/[^a-zA-Z0-9_-]/g, "_").slice(0, 120);
+      return safe || fallback;
+    }
+    function stableVariables(testVariables) {
+      return Object.entries(testVariables).filter(([key]) => !(0, auth_recipe_js_1.isReservedRunnerEnvVar)(key)).sort(([a], [b]) => a.localeCompare(b));
+    }
+    function localAuthStateFingerprint(input) {
+      const payload = JSON.stringify({
+        version: 1,
+        projectId: input.projectId,
+        serverOrigin: normalizeOrigin(input.serverUrl),
+        appUrl: normalizeAppUrl(input.baseUrl),
+        testVariables: stableVariables(input.testVariables)
+      });
+      const key = input.authToken || `validate-local-auth:${input.projectId}`;
+      return (0, node_crypto_1.createHmac)("sha256", key).update(payload).digest("hex").slice(0, 24);
+    }
+    function ensurePrivateDirectory2(dir) {
+      (0, node_fs_1.mkdirSync)(dir, { recursive: true, mode: 448 });
+      try {
+        (0, node_fs_1.chmodSync)(dir, 448);
+      } catch {
+      }
+    }
+    function removeFile(path) {
+      try {
+        (0, node_fs_1.unlinkSync)(path);
+      } catch {
+      }
+    }
+    function readLockOwner(path) {
+      try {
+        const parsed = JSON.parse((0, node_fs_1.readFileSync)(path, "utf8"));
+        return typeof parsed.token === "string" && parsed.token.length > 0 && Number.isSafeInteger(parsed.pid) && (parsed.pid ?? 0) > 0 ? { token: parsed.token, pid: parsed.pid } : void 0;
+      } catch {
+        return void 0;
+      }
+    }
+    function processIsAlive(pid) {
+      try {
+        process.kill(pid, 0);
+        return true;
+      } catch (error2) {
+        return error2.code === "EPERM";
+      }
+    }
+    function staleLockCanBeReaped(path, now, staleMs) {
+      try {
+        const ageMs = now - (0, node_fs_1.statSync)(path).mtimeMs;
+        if (ageMs < staleMs)
+          return false;
+        const owner = readLockOwner(path);
+        if (owner) {
+          if (!processIsAlive(owner.pid))
+            return true;
+          return ageMs >= Math.max(staleMs * 5, exports2.LOCAL_AUTH_STATE_LOCK_ABSOLUTE_STALE_MS);
+        }
+        return ageMs >= staleMs * 5;
+      } catch {
+        return false;
+      }
+    }
+    function isRecord(value) {
+      return !!value && typeof value === "object" && !Array.isArray(value);
+    }
+    function isValidStorageState(value) {
+      if (!isRecord(value))
+        return false;
+      const cookies = value.cookies;
+      const origins = value.origins;
+      if (!Array.isArray(cookies) || !Array.isArray(origins))
+        return false;
+      const cookiesValid = cookies.every((cookie) => {
+        if (!isRecord(cookie))
+          return false;
+        return typeof cookie.name === "string" && typeof cookie.value === "string" && typeof cookie.domain === "string" && typeof cookie.path === "string" && typeof cookie.expires === "number" && Number.isFinite(cookie.expires) && typeof cookie.httpOnly === "boolean" && typeof cookie.secure === "boolean" && (cookie.sameSite === "Strict" || cookie.sameSite === "Lax" || cookie.sameSite === "None");
+      });
+      if (!cookiesValid)
+        return false;
+      const originsValid = origins.every((origin) => {
+        if (!isRecord(origin) || typeof origin.origin !== "string" || !Array.isArray(origin.localStorage))
+          return false;
+        return origin.localStorage.every((entry) => isRecord(entry) && typeof entry.name === "string" && typeof entry.value === "string");
+      });
+      if (!originsValid)
+        return false;
+      return cookies.length > 0 || origins.some((origin) => origin.localStorage.length > 0);
+    }
+    function isValidStorageStateJson(value) {
+      try {
+        return isValidStorageState(JSON.parse(value));
+      } catch {
+        return false;
+      }
+    }
+    function isStorageStateShape(value) {
+      if (!value || typeof value !== "object")
+        return false;
+      return isValidStorageState(value);
+    }
+    function isValidLocalAuthStateFile(path) {
+      try {
+        return isStorageStateShape(JSON.parse((0, node_fs_1.readFileSync)(path, "utf8")));
+      } catch {
+        return false;
+      }
+    }
+    function cleanupLocalAuthStateFiles(runsDir, projectId, now = Date.now(), maxAgeMs = exports2.LOCAL_AUTH_STATE_MAX_AGE_MS) {
+      ensurePrivateDirectory2(runsDir);
+      const projectSegment = safeSegment(projectId, "default");
+      const legacyName = `auth-state-${projectSegment}.json`;
+      const prefix = `auth-state-${projectSegment}-`;
+      for (const name of (0, node_fs_1.readdirSync)(runsDir)) {
+        if (name === legacyName) {
+          removeFile((0, node_path_1.join)(runsDir, name));
+          continue;
+        }
+        if (!name.startsWith(prefix))
+          continue;
+        const path = (0, node_path_1.join)(runsDir, name);
+        try {
+          if (now - (0, node_fs_1.statSync)(path).mtimeMs >= maxAgeMs) {
+            if (!name.endsWith(".lock") || staleLockCanBeReaped(path, now, maxAgeMs))
+              removeFile(path);
+          }
+        } catch {
+        }
+      }
+    }
+    function cleanupExpiredLocalAuthStateFiles2(runsDir, now = Date.now(), maxAgeMs = exports2.LOCAL_AUTH_STATE_MAX_AGE_MS) {
+      ensurePrivateDirectory2(runsDir);
+      for (const name of (0, node_fs_1.readdirSync)(runsDir)) {
+        if (!name.startsWith("auth-state-"))
+          continue;
+        const path = (0, node_path_1.join)(runsDir, name);
+        try {
+          if (now - (0, node_fs_1.statSync)(path).mtimeMs >= maxAgeMs) {
+            if (!name.endsWith(".lock") || staleLockCanBeReaped(path, now, maxAgeMs))
+              removeFile(path);
+          }
+        } catch {
+        }
+      }
+    }
+    function localAuthStatePaths2(runsDir, input, runId) {
+      cleanupLocalAuthStateFiles(runsDir, input.projectId);
+      const projectSegment = safeSegment(input.projectId, "default");
+      const runSegment = safeSegment(runId, `${process.pid}`);
+      const fingerprint = localAuthStateFingerprint(input);
+      const cachePath = (0, node_path_1.join)(runsDir, `auth-state-${projectSegment}-${fingerprint}.json`);
+      return {
+        cachePath,
+        capturePath: `${cachePath}.capture-${runSegment}-${process.pid}.tmp`,
+        fingerprint,
+        lockKey: `${normalizeOrigin(input.serverUrl)}:${projectSegment}:${fingerprint}`,
+        lockPath: `${cachePath}.lock`
+      };
+    }
+    function getValidLocalAuthState2(path, now = Date.now(), maxAgeMs = exports2.LOCAL_AUTH_STATE_MAX_AGE_MS) {
+      if (!(0, node_fs_1.existsSync)(path))
+        return void 0;
+      try {
+        if (now - (0, node_fs_1.statSync)(path).mtimeMs >= maxAgeMs || !isValidLocalAuthStateFile(path)) {
+          removeFile(path);
+          return void 0;
+        }
+        return path;
+      } catch {
+        return void 0;
+      }
+    }
+    async function waitForValidLocalAuthState(path, timeoutMs = exports2.LOCAL_AUTH_STATE_WAIT_MS, pollMs = 100) {
+      const deadline = Date.now() + Math.max(0, timeoutMs);
+      do {
+        const valid = getValidLocalAuthState2(path);
+        if (valid)
+          return valid;
+        const remaining = deadline - Date.now();
+        if (remaining <= 0)
+          return void 0;
+        await new Promise((resolve2) => setTimeout(resolve2, Math.min(Math.max(10, pollMs), remaining)));
+      } while (true);
+    }
+    async function waitForLocalAuthStateProducer2(path, lockKey, startupGraceMs = 2e3, maxWaitMs = exports2.LOCAL_AUTH_STATE_WAIT_MS, pollMs = 100, lockPath) {
+      const startedAt = Date.now();
+      const producerIsActive = () => lockTails.has(lockKey) || !!lockPath && (0, node_fs_1.existsSync)(lockPath);
+      let sawProducer = producerIsActive();
+      do {
+        const valid = getValidLocalAuthState2(path);
+        if (valid)
+          return valid;
+        const producerActive = producerIsActive();
+        if (producerActive)
+          sawProducer = true;
+        const elapsed = Date.now() - startedAt;
+        if (sawProducer && !producerActive)
+          return void 0;
+        if (!sawProducer && elapsed >= Math.max(0, startupGraceMs))
+          return void 0;
+        if (elapsed >= Math.max(0, maxWaitMs))
+          return void 0;
+        await new Promise((resolve2) => setTimeout(resolve2, Math.max(10, pollMs)));
+      } while (true);
+    }
+    function promoteLocalAuthStateCapture2(capturePath, cachePath, replaceExisting = false, lease) {
+      if (lease && !lease.isOwner()) {
+        removeFile(capturePath);
+        return false;
+      }
+      if (!(0, node_fs_1.existsSync)(capturePath) || !isValidLocalAuthStateFile(capturePath)) {
+        removeFile(capturePath);
+        return false;
+      }
+      try {
+        (0, node_fs_1.chmodSync)(capturePath, 384);
+      } catch {
+      }
+      try {
+        if (lease && !lease.isOwner()) {
+          removeFile(capturePath);
+          return false;
+        }
+        if ((0, node_fs_1.existsSync)(cachePath)) {
+          if (!replaceExisting && isValidLocalAuthStateFile(cachePath)) {
+            removeFile(capturePath);
+            return true;
+          }
+          removeFile(cachePath);
+        }
+        if (lease && !lease.isOwner()) {
+          removeFile(capturePath);
+          return false;
+        }
+        (0, node_fs_1.renameSync)(capturePath, cachePath);
+        try {
+          (0, node_fs_1.chmodSync)(cachePath, 384);
+        } catch {
+        }
+        return true;
+      } catch {
+        const winnerIsValid = (0, node_fs_1.existsSync)(cachePath) && isValidLocalAuthStateFile(cachePath);
+        removeFile(capturePath);
+        return winnerIsValid;
+      }
+    }
+    function discardLocalAuthStateCapture2(capturePath) {
+      removeFile(capturePath);
+    }
+    var lockTails = /* @__PURE__ */ new Map();
+    function publishCompleteLockOwner(lockPath, owner, linkFile) {
+      const metadata = JSON.stringify(owner);
+      const tempPath = `${lockPath}.${owner.pid}.${owner.token}.tmp`;
+      let createdLock = false;
+      try {
+        (0, node_fs_1.writeFileSync)(tempPath, metadata, { flag: "wx", mode: 384 });
+        try {
+          linkFile(tempPath, lockPath);
+          createdLock = true;
+          return (0, node_fs_1.openSync)(lockPath, "r+");
+        } catch (error2) {
+          const code = error2.code;
+          if (!["EPERM", "EACCES", "EXDEV", "ENOSYS", "ENOTSUP", "EOPNOTSUPP"].includes(code ?? "")) {
+            throw error2;
+          }
+          let fd;
+          try {
+            fd = (0, node_fs_1.openSync)(lockPath, "wx+", 384);
+            createdLock = true;
+            (0, node_fs_1.writeFileSync)(fd, metadata, { encoding: "utf8" });
+            (0, node_fs_1.fsyncSync)(fd);
+            return fd;
+          } catch (fallbackError) {
+            if (fd !== void 0) {
+              try {
+                (0, node_fs_1.closeSync)(fd);
+              } catch {
+              }
+            }
+            if (createdLock)
+              removeFile(lockPath);
+            throw fallbackError;
+          }
+        }
+      } catch (error2) {
+        if (createdLock && readLockOwner(lockPath)?.token === owner.token)
+          removeFile(lockPath);
+        throw error2;
+      } finally {
+        removeFile(tempPath);
+      }
+    }
+    async function acquireExclusiveFileLock(lockPath, linkFile = node_fs_1.linkSync) {
+      ensurePrivateDirectory2((0, node_path_1.dirname)(lockPath));
+      const startedAt = Date.now();
+      while (true) {
+        try {
+          const ownerToken = (0, node_crypto_1.randomBytes)(24).toString("base64url");
+          const fd = publishCompleteLockOwner(lockPath, { token: ownerToken, pid: process.pid }, linkFile);
+          const ownsPath = () => {
+            try {
+              const owner = readLockOwner(lockPath);
+              return owner?.token === ownerToken && owner.pid === process.pid;
+            } catch {
+              return false;
+            }
+          };
+          const heartbeat = setInterval(() => {
+            try {
+              if (!ownsPath()) {
+                clearInterval(heartbeat);
+                return;
+              }
+              const now = /* @__PURE__ */ new Date();
+              (0, node_fs_1.futimesSync)(fd, now, now);
+            } catch {
+              clearInterval(heartbeat);
+            }
+          }, Math.max(1e3, Math.floor(exports2.LOCAL_AUTH_STATE_LOCK_STALE_MS / 3)));
+          heartbeat.unref();
+          let released = false;
+          const release = (() => {
+            if (released)
+              return;
+            released = true;
+            clearInterval(heartbeat);
+            try {
+              if (ownsPath())
+                removeFile(lockPath);
+            } catch {
+            }
+            try {
+              (0, node_fs_1.closeSync)(fd);
+            } catch {
+            }
+          });
+          release.isOwner = () => !released && ownsPath();
+          return release;
+        } catch (error2) {
+          const code = error2.code;
+          if (code !== "EEXIST")
+            throw error2;
+          try {
+            if (staleLockCanBeReaped(lockPath, Date.now(), exports2.LOCAL_AUTH_STATE_LOCK_STALE_MS)) {
+              removeFile(lockPath);
+              continue;
+            }
+          } catch {
+            continue;
+          }
+          if (Date.now() - startedAt >= exports2.LOCAL_AUTH_STATE_WAIT_MS) {
+            throw new Error(`Timed out waiting for auth-state lock: ${(0, node_path_1.basename)(lockPath)}`);
+          }
+          await new Promise((resolve2) => setTimeout(resolve2, 100));
+        }
+      }
+    }
+    async function acquireLocalAuthStateLock2(key, lockPath, linkFile = node_fs_1.linkSync) {
+      const previous = lockTails.get(key) ?? Promise.resolve();
+      let unlockCurrent;
+      const current = new Promise((resolve2) => {
+        unlockCurrent = resolve2;
+      });
+      const tail = previous.then(() => current);
+      lockTails.set(key, tail);
+      await previous;
+      let releaseFileLock;
+      try {
+        if (lockPath)
+          releaseFileLock = await acquireExclusiveFileLock(lockPath, linkFile);
+      } catch (error2) {
+        unlockCurrent();
+        if (lockTails.get(key) === tail)
+          lockTails.delete(key);
+        throw error2;
+      }
+      let released = false;
+      const release = (() => {
+        if (released)
+          return;
+        released = true;
+        releaseFileLock?.();
+        unlockCurrent();
+        if (lockTails.get(key) === tail)
+          lockTails.delete(key);
+      });
+      release.isOwner = () => !released && (releaseFileLock?.isOwner() ?? true);
+      return release;
+    }
+    function localAuthStateFilename(path) {
+      return (0, node_path_1.basename)(path);
+    }
+  }
+});
+
 // ../../node_modules/adm-zip/util/constants.js
 var require_constants5 = __commonJS({
   "../../node_modules/adm-zip/util/constants.js"(exports2, module2) {
@@ -325118,7 +325768,7 @@ var require_utils2 = __commonJS({
     module2.exports = Utils;
     Utils.prototype.makeDir = function(folder) {
       const self = this;
-      function mkdirSync5(fpath) {
+      function mkdirSync4(fpath) {
         let resolvedPath = fpath.split(self.sep)[0];
         fpath.split(self.sep).forEach(function(name) {
           if (!name || name.substr(-1, 1) === ":") return;
@@ -325136,7 +325786,7 @@ var require_utils2 = __commonJS({
           if (stat && stat.isFile()) throw Errors.FILE_IN_THE_WAY(`"${resolvedPath}"`);
         });
       }
-      mkdirSync5(folder);
+      mkdirSync4(folder);
     };
     Utils.prototype.writeFileTo = function(path, content, overwrite, attr) {
       const self = this;
@@ -337060,6 +337710,8 @@ var require_dist2 = __commonJS({
     __exportStar(require_discover_agent(), exports2);
     __exportStar(require_browser_pool(), exports2);
     __exportStar(require_resource_governor(), exports2);
+    __exportStar(require_local_auth_state(), exports2);
+    __exportStar(require_run_callback_proxy(), exports2);
     __exportStar(require_discover_explorer(), exports2);
     __exportStar(require_discover_feature_explorer(), exports2);
     __exportStar(require_discover_planner(), exports2);
@@ -337336,7 +337988,7 @@ var require_package4 = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.42",
+      version: "1.0.43",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"
@@ -337344,7 +337996,7 @@ var require_package4 = __commonJS({
       scripts: {
         build: "tsup",
         dev: "tsx src/cli.ts",
-        test: "node --import tsx --test src/version-check.test.ts",
+        test: "node --import tsx --test src/version-check.test.ts src/services/auth-state.test.ts",
         "test:mobile": "node --import tsx --test --test-concurrency=2 src/runner.mobile-ai-env.test.ts src/mobile-device-queue.test.ts src/device-lease.test.ts src/result-payload-budget.test.ts src/services/appium-*.test.ts src/services/*mobile*.test.ts src/services/mobile/*.test.ts",
         prepublishOnly: "npm run build"
       },
@@ -337423,7 +338075,6 @@ function getConfigDir() {
 }
 
 // src/runner.ts
-var import_fs5 = require("fs");
 var import_path4 = require("path");
 var import_os6 = require("os");
 var import_node_crypto2 = require("crypto");
@@ -337451,23 +338102,33 @@ var import_runner_core6 = __toESM(require_dist2());
 
 // src/runner.ts
 var import_runner_core11 = __toESM(require_dist2());
+var import_runner_core12 = __toESM(require_dist2());
 
 // src/services/auth-state.ts
+init_dist();
 var INLINE_LOGIN_TAG = "@inline-login";
 var GUARDED_LOGIN_TAG = "@auth-guarded";
 function sharedAuthInjectEnabled() {
-  return process.env.SHARED_AUTH_INJECT === "true";
+  return isSharedAuthInjectEnabled();
+}
+function hasGeneratedAuthGuard(playwrightCode) {
+  if (!playwrightCode) return false;
+  return /\/\/ >>> VALIDATE_QA_AUTH v\d+\b[\s\S]*?process\.env\.AUTH_FILE[\s\S]*?\/\/ <<< VALIDATE_QA_AUTH v\d+\b/.test(playwrightCode);
+}
+function shouldCaptureAuthState(tags, playwrightCode) {
+  return sharedAuthInjectEnabled() && Array.isArray(tags) && tags.includes("@needs-auth") && tags.includes(GUARDED_LOGIN_TAG) && !tags.includes("@auth") && hasGeneratedAuthGuard(playwrightCode);
 }
 function hasInlineLoginSteps(playwrightCode) {
   if (!playwrightCode) return false;
   return /process\.env\.TEST_USER_EMAIL!?/.test(playwrightCode) && /process\.env\.TEST_USER_PASSWORD!?/.test(playwrightCode);
 }
 function shouldUseAuthState(tags, playwrightCode) {
+  if (!sharedAuthInjectEnabled()) return false;
   if (!Array.isArray(tags)) return false;
   if (tags.includes("@auth")) return false;
   if (tags.includes("@api")) return true;
   if (!tags.includes("@needs-auth")) return false;
-  if (sharedAuthInjectEnabled() && tags.includes(GUARDED_LOGIN_TAG)) return true;
+  if (tags.includes(GUARDED_LOGIN_TAG) && hasGeneratedAuthGuard(playwrightCode)) return true;
   const isGeneratedVariant = tags.includes("@edge") || tags.includes("@bug");
   const hasLegacyInlineLogin = tags.includes("@discovered") && !isGeneratedVariant && hasInlineLoginSteps(playwrightCode);
   return !tags.includes(INLINE_LOGIN_TAG) && !hasLegacyInlineLogin;
@@ -344177,8 +344838,8 @@ function withMediaReferences(result, refs) {
 
 // src/runner.ts
 init_dist();
-var import_runner_core12 = __toESM(require_dist2());
 var import_runner_core13 = __toESM(require_dist2());
+var import_runner_core14 = __toESM(require_dist2());
 function fingerprintTest(test) {
   const code = test.framework === "APPIUM" ? [test.appiumCode ?? "", JSON.stringify(test.steps ?? [])].join("\n--steps--\n") : test.playwrightCode ?? "";
   return (0, import_node_crypto2.createHash)("sha256").update(test.name).update("\n--suite--\n").update(test.suiteName ?? "").update("\n--type--\n").update(test.testType ?? "").update("\n--framework--\n").update(test.framework ?? "").update("\n--code--\n").update(code).digest("hex").slice(0, 24);
@@ -344302,21 +344963,11 @@ var log = {
   warn: (msg) => console.log(`${C2.yellow}\u26A0${C2.reset}  ${msg}`),
   dim: (msg) => console.log(`${C2.gray}${msg}${C2.reset}`)
 };
-var AUTH_MAX_AGE_MS = 60 * 60 * 1e3;
 function getRunsDir() {
   const dir = process.env.RUNS_DIR || (0, import_path4.join)((0, import_os6.homedir)(), ".validate.qa", "runs");
-  if (!(0, import_fs5.existsSync)(dir)) (0, import_fs5.mkdirSync)(dir, { recursive: true });
+  (0, import_runner_core12.ensurePrivateDirectory)(dir);
   return dir;
 }
-function authStatePath(projectId) {
-  return (0, import_path4.join)(getRunsDir(), `auth-state-${projectId || "default"}.json`);
-}
-function getValidAuthState(projectId) {
-  const path = authStatePath(projectId);
-  if (!(0, import_fs5.existsSync)(path)) return void 0;
-  const age = Date.now() - (0, import_fs5.statSync)(path).mtimeMs;
-  return age < AUTH_MAX_AGE_MS ? path : void 0;
-}
 function buildHeaders(authToken, projectId) {
   return {
     "Content-Type": "application/json",
@@ -344365,7 +345016,13 @@ async function claimRun(serverUrl, headers, runId) {
   if (res.status === 429) return false;
   if (!res.ok) throw new Error(`Claim failed: ${res.status}`);
   const body = await res.json();
-  return body.claimed;
+  if (!body.claimed) {
+    throw new Error("Claim response did not confirm ownership");
+  }
+  if (typeof body.claimEpoch !== "number" || !Number.isSafeInteger(body.claimEpoch) || body.claimEpoch < 0) {
+    throw new Error("Claim response did not include a valid ownership epoch");
+  }
+  return body.claimEpoch;
 }
 async function postResult(serverUrl, headers, runId, result) {
   const MAX_ATTEMPTS = 3;
@@ -344533,12 +345190,12 @@ async function postCaptureResult(serverUrl, headers, runId, result) {
   });
   if (!res.ok) throw new Error(`Failed to post capture result: ${res.status}`);
 }
-async function postCredentialRotation(serverUrl, headers, runId, body) {
+async function postCredentialRotation(serverUrl, headers, runId, body, claimEpoch) {
   try {
     const res = await fetch(`${serverUrl}/api/runner/runs/${runId}/credential`, {
       method: "POST",
       headers,
-      body: JSON.stringify(body),
+      body: JSON.stringify({ ...body, ...claimEpoch !== void 0 ? { claimEpoch } : {} }),
       signal: AbortSignal.timeout(3e4)
     });
     if (!res.ok) {
@@ -344875,6 +345532,12 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
     liveBrowserHandle,
     onLiveBrowserSnapshot: requestLiveBrowserHeartbeat
   });
+  const callbackContext = {
+    runId: run2.runId,
+    serverUrl: opts.serverUrl,
+    authHeader: headers.Authorization,
+    claimEpoch: run2.claimEpoch
+  };
   const startTime = Date.now();
   try {
     if (mobileLeaseError) {
@@ -344904,7 +345567,7 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
         log.fail(`PRE-FLIGHT FAILED - ${preflightError}`);
         return;
       }
-      const preflight = await (0, import_runner_core12.resolveBaseUrlPreflight)(run2.baseUrl);
+      const preflight = await (0, import_runner_core13.resolveBaseUrlPreflight)(run2.baseUrl);
       if (preflight.error) {
         await postResult(opts.serverUrl, headers, run2.runId, { status: "ERROR", error: preflight.error });
         log.fail(`PRE-FLIGHT FAILED - ${preflight.error}`);
@@ -344921,31 +345584,72 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
         log.fail("ERROR - No auth setup code");
         return;
       }
-      const runAuthPath = authStatePath(run2.projectId || opts.projectId || "default");
-      log.info(`Auth setup: saving session state to ${runAuthPath}`);
-      const result2 = await runNativeWithLiveBrowser({
-        playwrightCode: run2.playwrightCode,
+      const sharedAuthEnabled = sharedAuthInjectEnabled();
+      if ((0, import_runner_core12.shouldSkipDisabledAutomaticAuthSetup)(run2.authForceRun, run2.authVerify, sharedAuthEnabled)) {
+        const duration2 = Date.now() - startTime;
+        await postResult(opts.serverUrl, headers, run2.runId, {
+          status: "PASSED",
+          logs: "Automatic auth prewarm skipped: shared session reuse is disabled.",
+          duration: duration2
+        });
+        log.info(`Auth prewarm skipped (${duration2}ms) - SHARED_AUTH_INJECT=false`);
+        return;
+      }
+      const authPaths2 = sharedAuthEnabled ? (0, import_runner_core12.localAuthStatePaths)(getRunsDir(), {
+        projectId: run2.projectId || opts.projectId || "default",
+        serverUrl: opts.serverUrl,
         baseUrl: run2.baseUrl,
-        testName: "auth-setup",
-        testVariables: { ...run2.testVariables, AUTH_FILE: runAuthPath },
-        validateContext: {
-          runId: run2.runId,
-          serverUrl: opts.serverUrl,
-          authHeader: headers.Authorization
+        testVariables: run2.testVariables,
+        authToken: opts.authToken
+      }, run2.runId) : void 0;
+      const releaseAuthLock2 = authPaths2 ? await (0, import_runner_core12.acquireLocalAuthStateLock)(authPaths2.lockKey, authPaths2.lockPath) : void 0;
+      try {
+        if (authPaths2 && (0, import_runner_core12.shouldSkipWarmAuthSetup)(
+          run2.authForceRun,
+          sharedAuthEnabled,
+          !!(0, import_runner_core12.getValidLocalAuthState)(authPaths2.cachePath)
+        )) {
+          const duration3 = Date.now() - startTime;
+          await postResult(opts.serverUrl, headers, run2.runId, {
+            status: "PASSED",
+            logs: "Auth setup skipped: the credential-bound local session is already warm.",
+            duration: duration3
+          });
+          log.ok(`Auth setup skipped (${duration3}ms) - local session already warm`);
+          return;
         }
-      });
-      const duration2 = Date.now() - startTime;
-      await postResult(opts.serverUrl, headers, run2.runId, {
-        status: result2.passed ? "PASSED" : "FAILED",
-        apiCalls: result2.apiCalls,
-        logs: result2.logs,
-        error: result2.error,
-        duration: duration2
-      });
-      log[result2.passed ? "ok" : "fail"](
-        `Auth setup ${result2.passed ? "PASSED" : "FAILED"} (${duration2}ms)${result2.error ? ` - ${result2.error}` : ""}`
-      );
-      return;
+        log.info(run2.authVerify ? "Auth verification: replaying the current login recipe" : sharedAuthEnabled ? "Auth setup: capturing a credential-bound local session" : "Auth setup: running login with shared session reuse disabled");
+        const capturePath = sharedAuthEnabled && !run2.authVerify ? authPaths2?.capturePath : void 0;
+        const result2 = await runNativeWithLiveBrowser({
+          playwrightCode: run2.playwrightCode,
+          baseUrl: run2.baseUrl,
+          testName: "auth-setup",
+          testVariables: run2.testVariables,
+          authStateCapturePath: capturePath,
+          validateContext: callbackContext
+        });
+        const captured = !!capturePath && !!authPaths2 && result2.passed && !result2.suspiciousPass && (0, import_runner_core12.promoteLocalAuthStateCapture)(
+          capturePath,
+          authPaths2.cachePath,
+          run2.authForceRun === true,
+          releaseAuthLock2
+        );
+        const duration2 = Date.now() - startTime;
+        await postResult(opts.serverUrl, headers, run2.runId, {
+          status: result2.passed ? "PASSED" : "FAILED",
+          apiCalls: result2.apiCalls,
+          logs: result2.logs,
+          error: result2.error,
+          duration: duration2
+        });
+        log[result2.passed ? "ok" : "fail"](
+          `Auth setup ${result2.passed ? "PASSED" : "FAILED"} (${duration2}ms)${captured ? " - session cached" : ""}${result2.error ? ` - ${result2.error}` : ""}`
+        );
+        return;
+      } finally {
+        if (authPaths2?.capturePath) (0, import_runner_core12.discardLocalAuthStateCapture)(authPaths2.capturePath);
+        releaseAuthLock2?.();
+      }
     }
     if (runMode === "batch-heal") {
       const tests = run2.batchHealTests ?? [];
@@ -344964,7 +345668,7 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
       const batchResult = await (0, import_runner_core10.executeGrokPerBatchHeal)(tests, run2.baseUrl, {
         testVariables: run2.testVariables,
         runNativeTest: runNativeWithLiveBrowser,
-        validateContext: { runId: run2.runId, serverUrl: opts.serverUrl, authHeader: headers.Authorization },
+        validateContext: callbackContext,
         onLog: healLogStream.onLog
       });
       await healLogStream.flushNow();
@@ -345000,6 +345704,15 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
         );
         const describeKind = isSerialDescribe ? "serial" : "non-serial";
         log.info(`API test heal - ${subTestCount} sub-test(s) [${describeKind}], ${failingSubTestCount} budgeted, ${MAX_API_HEAL_ATTEMPTS} attempts`);
+        const apiHealAuthPaths = shouldUseAuthState(run2.tags, run2.playwrightCode) ? (0, import_runner_core12.localAuthStatePaths)(getRunsDir(), {
+          projectId: run2.projectId || opts.projectId,
+          serverUrl: opts.serverUrl,
+          baseUrl: run2.baseUrl,
+          testVariables: run2.testVariables,
+          authToken: opts.authToken
+        }, run2.runId) : void 0;
+        const apiHealStorageStatePath = apiHealAuthPaths ? (0, import_runner_core12.getValidLocalAuthState)(apiHealAuthPaths.cachePath) : void 0;
+        if (apiHealStorageStatePath) log.info("API heal verification is using saved auth state");
         const stickyAppBugs = /* @__PURE__ */ new Map();
         const lastChangeByTitle = /* @__PURE__ */ new Map();
         let currentError = run2.lastFailureError ?? "Test failed";
@@ -345065,7 +345778,8 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
                 playwrightCode: lastHealedCode,
                 baseUrl: run2.baseUrl,
                 testVariables: run2.testVariables,
-                validateContext: { runId: run2.runId, serverUrl: opts.serverUrl, authHeader: headers.Authorization }
+                storageStatePath: apiHealStorageStatePath,
+                validateContext: callbackContext
               });
               if (finalVerifyResult.passed) {
                 log.ok(`  Attempt ${attempt} terminal verification PASSED (${bugCount} app_bug, ${passCount} pass)`);
@@ -345085,7 +345799,9 @@ ${finalVerifyResult.logs ?? ""}`;
             finalVerifyResult = await runNativeWithLiveBrowser({
               playwrightCode: lastHealedCode,
               baseUrl: run2.baseUrl,
-              testVariables: run2.testVariables
+              testVariables: run2.testVariables,
+              storageStatePath: apiHealStorageStatePath,
+              validateContext: callbackContext
             });
             const stepResults = finalVerifyResult.stepResults ?? [];
             const nonAppBugFails = stepResults.filter(
@@ -345135,7 +345851,8 @@ ${finalVerifyResult.logs ?? ""}`;
             playwrightCode: lastHealedCode,
             baseUrl: run2.baseUrl,
             testVariables: run2.testVariables,
-            validateContext: { runId: run2.runId, serverUrl: opts.serverUrl, authHeader: headers.Authorization }
+            storageStatePath: apiHealStorageStatePath,
+            validateContext: callbackContext
           });
           if (finalVerifyResult.passed) {
             log.ok(`  Attempt ${attempt} verification PASSED`);
@@ -345188,7 +345905,7 @@ ${finalVerifyResult.logs ?? ""}`;
           if (classifyErrorMessage(composedError ?? null) === "config_issue") {
             apiHealStatus = "ERROR";
           } else {
-            const rlDetection = (0, import_runner_core12.detectRateLimitBlock)({
+            const rlDetection = (0, import_runner_core13.detectRateLimitBlock)({
               testName: run2.testName ?? run2.testCaseId ?? void 0,
               tags: run2.tags ?? [],
               error: composedError ?? finalVerifyResult?.error ?? null,
@@ -345285,8 +346002,8 @@ ${finalVerifyResult.logs ?? ""}`;
         lastHealAttempt: run2.lastHealAttempt ?? null,
         lastHealedCode: run2.lastHealedCode ?? null,
         failureScreenshot: run2.failureScreenshot ?? null,
-        onCredentialUpdate: async (input) => postCredentialRotation(opts.serverUrl, headers, run2.runId, { ...input, actor: "ai-healer" }),
-        validateContext: { runId: run2.runId, serverUrl: opts.serverUrl, authHeader: headers.Authorization },
+        onCredentialUpdate: async (input) => postCredentialRotation(opts.serverUrl, headers, run2.runId, { ...input, actor: "ai-healer" }, run2.claimEpoch),
+        validateContext: callbackContext,
         liveBrowserHandle,
         runNativeTest: runNativeWithLiveBrowser
       };
@@ -345328,7 +346045,7 @@ ${finalVerifyResult.logs ?? ""}`;
       let healStatus = result2.passed ? "PASSED" : isConfigIssue ? "ERROR" : "FAILED";
       let healError = result2.error;
       if (!result2.passed && !isConfigIssue) {
-        const rlDetection = (0, import_runner_core12.detectRateLimitBlock)({
+        const rlDetection = (0, import_runner_core13.detectRateLimitBlock)({
           testName: run2.testName ?? run2.testCaseId ?? void 0,
           tags: run2.tags ?? [],
           error: result2.error,
@@ -345399,7 +346116,8 @@ ${finalVerifyResult.logs ?? ""}`;
         // Allow generated `persistCredential(...)` calls inside the suite to
         // POST back to the server with the runner's bearer token.
         validateServerUrl: opts.serverUrl,
-        validateRunnerAuthHeader: headers.Authorization
+        validateRunnerAuthHeader: headers.Authorization,
+        claimEpoch: run2.claimEpoch
       });
       const overall = result2.error && result2.testResults.length === 0 ? "ERROR" : result2.passed ? "PASSED" : "FAILED";
       const rr = await fetch(`${opts.serverUrl}/api/runner/runs/${run2.runId}/regression-result`, {
@@ -345454,7 +346172,7 @@ ${finalVerifyResult.logs ?? ""}`;
                 playwrightCode: healedCode,
                 baseUrl: run2.baseUrl,
                 testVariables: run2.testVariables,
-                validateContext: { runId: run2.runId, serverUrl: opts.serverUrl, authHeader: headers.Authorization }
+                validateContext: callbackContext
               });
               results.push({
                 testCaseId: failedTest.testCaseId,
@@ -345517,8 +346235,8 @@ ${finalVerifyResult.logs ?? ""}`;
               onAICall: healAudit,
               modelOverride: run2.healerModel,
               consecutiveFails: failedTest.consecutiveFails,
-              onCredentialUpdate: async (input) => postCredentialRotation(opts.serverUrl, headers, run2.runId, { ...input, actor: "ai-healer" }),
-              validateContext: { runId: run2.runId, serverUrl: opts.serverUrl, authHeader: headers.Authorization },
+              onCredentialUpdate: async (input) => postCredentialRotation(opts.serverUrl, headers, run2.runId, { ...input, actor: "ai-healer" }, run2.claimEpoch),
+              validateContext: callbackContext,
               liveBrowserHandle,
               runNativeTest: runNativeWithLiveBrowser
             };
@@ -345723,6 +346441,13 @@ ${finalVerifyResult.logs ?? ""}`;
         }
         return;
       }
+      ctx.onCredentialUpdate = async (input) => postCredentialRotation(
+        opts.serverUrl,
+        headers,
+        run2.runId,
+        { ...input, actor: "ai-explorer" },
+        run2.claimEpoch
+      );
       log.info(`Discovery (${ctx.mode}) on ${ctx.baseUrl}`);
       const { push: pushAudit, drain: drainAudit } = createAuditFlusher(
         `${opts.serverUrl}/api/runner/runs/${run2.runId}/ai-audit-batch`,
@@ -346425,7 +347150,7 @@ ${finalVerifyResult.logs ?? ""}`;
           featureDescription: ctx.featureDescription,
           featurePages: ctx.featurePages,
           appBrief: ctx.appBrief,
-          onCredentialUpdate: async (input) => postCredentialRotation(opts.serverUrl, headers, run2.runId, { ...input, actor: "ai-capture" })
+          onCredentialUpdate: async (input) => postCredentialRotation(opts.serverUrl, headers, run2.runId, { ...input, actor: "ai-capture" }, run2.claimEpoch)
         });
         if (logBuffer.length > 0) {
           postCaptureLog(opts.serverUrl, headers, run2.runId, ctx.jobId, truncateTextTail(logBuffer.join("\n"), DISCOVERY_LOG_POST_MAX_CHARS, "capture log"));
@@ -346670,7 +347395,7 @@ ${finalVerifyResult.logs ?? ""}`;
                   }
                   return verify;
                 };
-                return await (0, import_runner_core13.executeMobileLiveHeal)({
+                return await (0, import_runner_core14.executeMobileLiveHeal)({
                   steps: a.steps,
                   target: a.target,
                   testVariables: a.testVariables,
@@ -346687,7 +347412,7 @@ ${finalVerifyResult.logs ?? ""}`;
             }
           };
           log.info("\u{1FA7A} Mobile AI heal \u2014 Phase 1 (script) \u2192 Phase 2 (live device, lazy)...");
-          const heal = await (0, import_runner_core13.executeMobileTestWithHealing)(
+          const heal = await (0, import_runner_core14.executeMobileTestWithHealing)(
             mobileSteps,
             healTarget,
             {
@@ -346700,7 +347425,7 @@ ${finalVerifyResult.logs ?? ""}`;
             healerOptions
           );
           const finalRes = nativeVerify.last;
-          const outcome = (0, import_runner_core13.computeMobileHealOutcome)({
+          const outcome = (0, import_runner_core14.computeMobileHealOutcome)({
             heal,
             finalError: finalRes?.error ?? null,
             reproduceError,
@@ -346846,26 +347571,77 @@ ${result2.logs}`);
       }
       return;
     }
-    const storageStatePath = shouldUseAuthState(run2.tags, run2.playwrightCode) ? getValidAuthState(run2.projectId || opts.projectId) : void 0;
-    if (storageStatePath) {
-      log.info(`Using auth state for project ${run2.projectId || opts.projectId}`);
-    }
-    const result = await runNativeWithLiveBrowser({
-      playwrightCode: run2.playwrightCode,
+    const projectId = run2.projectId || opts.projectId;
+    const authStateExpected = shouldUseAuthState(run2.tags, run2.playwrightCode);
+    const captureAuth = shouldCaptureAuthState(run2.tags, run2.playwrightCode);
+    const authPaths = authStateExpected || captureAuth ? (0, import_runner_core12.localAuthStatePaths)(getRunsDir(), {
+      projectId,
+      serverUrl: opts.serverUrl,
       baseUrl: run2.baseUrl,
       testVariables: run2.testVariables,
-      storageStatePath,
-      validateContext: {
-        runId: run2.runId,
-        serverUrl: opts.serverUrl,
-        authHeader: headers.Authorization
+      authToken: opts.authToken
+    }, run2.runId) : void 0;
+    let releaseAuthLock;
+    let storageStatePath;
+    if (authPaths && authStateExpected) {
+      releaseAuthLock = await (0, import_runner_core12.acquireLocalAuthStateLock)(authPaths.lockKey, authPaths.lockPath);
+      storageStatePath = (0, import_runner_core12.getValidLocalAuthState)(authPaths.cachePath);
+      if (storageStatePath || !captureAuth) {
+        releaseAuthLock();
+        releaseAuthLock = void 0;
+      }
+      if (!storageStatePath && !captureAuth && sharedAuthInjectEnabled()) {
+        log.info(`Waiting for the auth producer to warm project ${projectId}`);
+        storageStatePath = await (0, import_runner_core12.waitForLocalAuthStateProducer)(
+          authPaths.cachePath,
+          authPaths.lockKey,
+          2e3,
+          void 0,
+          100,
+          authPaths.lockPath
+        );
       }
-    });
+    }
+    if (storageStatePath) {
+      log.info(`Using auth state for project ${projectId}`);
+    }
+    const runAuthPath = captureAuth ? authPaths?.capturePath : void 0;
+    const result = await (async () => {
+      try {
+        return await runNativeWithLiveBrowser({
+          playwrightCode: run2.playwrightCode,
+          baseUrl: run2.baseUrl,
+          testVariables: run2.testVariables,
+          authStateCapturePath: runAuthPath,
+          storageStatePath,
+          validateContext: callbackContext
+        });
+      } finally {
+        if (runAuthPath && authPaths) {
+          if ((0, import_runner_core12.getValidLocalAuthState)(runAuthPath)) {
+            const releasePromotionLock = releaseAuthLock ? void 0 : await (0, import_runner_core12.acquireLocalAuthStateLock)(authPaths.lockKey, authPaths.lockPath);
+            try {
+              const captured = (0, import_runner_core12.promoteLocalAuthStateCapture)(
+                runAuthPath,
+                authPaths.cachePath,
+                !!storageStatePath,
+                releaseAuthLock ?? releasePromotionLock
+              );
+              if (captured) log.info(`Captured auth state for project ${projectId}`);
+            } finally {
+              releasePromotionLock?.();
+            }
+          }
+          (0, import_runner_core12.discardLocalAuthStateCapture)(runAuthPath);
+        }
+        releaseAuthLock?.();
+      }
+    })();
     const duration = Date.now() - startTime;
     let runStatus = result.passed ? "PASSED" : "FAILED";
     let runError = result.error;
     if (!result.passed) {
-      const rlDetection = (0, import_runner_core12.detectRateLimitBlock)({
+      const rlDetection = (0, import_runner_core13.detectRateLimitBlock)({
         testName: run2.testName ?? run2.testCaseId ?? void 0,
         tags: run2.tags ?? [],
         error: result.error,
@@ -346926,6 +347702,12 @@ async function startRunner(opts) {
   process.env.AUTH_TOKEN = authToken;
   process.env.RUNNER_TOKEN = authToken;
   if (projectId) process.env.PROJECT_ID = projectId;
+  (0, import_runner_core12.cleanupExpiredLocalAuthStateFiles)(getRunsDir());
+  const authCleanupTimer = setInterval(
+    () => (0, import_runner_core12.cleanupExpiredLocalAuthStateFiles)(getRunsDir()),
+    import_runner_core12.LOCAL_AUTH_STATE_CLEANUP_INTERVAL_MS
+  );
+  authCleanupTimer.unref?.();
   const headers = buildHeaders(authToken, projectId);
   console.log("");
   console.log(`${C2.bold}${C2.cyan}validate.qa Local Runner${C2.reset}`);
@@ -347034,7 +347816,7 @@ async function startRunner(opts) {
     capture: envInt("MAX_CAPTURE", DEFAULT_TYPE_LIMITS.capture),
     run: envInt("MAX_RUN", DEFAULT_TYPE_LIMITS.run)
   };
-  const RESOURCE_GOVERNOR_OPTIONS = (0, import_runner_core12.createResourceGovernorOptions)({
+  const RESOURCE_GOVERNOR_OPTIONS = (0, import_runner_core13.createResourceGovernorOptions)({
     isCloud: IS_CLOUD,
     maxConcurrent: MAX_CONCURRENT,
     typeLimits: TYPE_LIMITS
@@ -347202,8 +347984,8 @@ async function startRunner(opts) {
         android: devices.some((d) => d.platform === "ANDROID" && d.isAvailable && d.state === "BOOTED")
       } : { web: true, ios: false, android: false };
       const bridge = enableMobile ? getBridgeState() : void 0;
-      const resourceStatus = (0, import_runner_core12.getResourceGovernorStatus)(RESOURCE_GOVERNOR_OPTIONS, Object.fromEntries(activeByType));
-      const processInventory = await (0, import_runner_core12.getBrowserProcessInventory)();
+      const resourceStatus = (0, import_runner_core13.getResourceGovernorStatus)(RESOURCE_GOVERNOR_OPTIONS, Object.fromEntries(activeByType));
+      const processInventory = await (0, import_runner_core13.getBrowserProcessInventory)();
       lastInventoryPids = new Set(processInventory.processes.map((p) => p.pid));
       lastInventoryKinds.clear();
       for (const p of processInventory.processes) lastInventoryKinds.set(p.pid, p.kind);
@@ -347233,7 +348015,7 @@ async function startRunner(opts) {
           resourceSnapshot: resourceStatus.snapshot,
           resourceGovernor: resourceStatus.governor,
           processInventory,
-          aiQueue: (0, import_runner_core12.getRunnerAIQueueStats)(),
+          aiQueue: (0, import_runner_core13.getRunnerAIQueueStats)(),
           liveBrowsers: import_runner_core11.liveBrowserRegistry.snapshotForHeartbeat(),
           // Pre-flight checks (ANDROID_HOME, Xcode, Appium drivers, adb, etc).
           // Cached & cheap — see getCachedDoctor above.
@@ -347344,7 +348126,7 @@ async function startRunner(opts) {
   let pidsWatchdogWarned = false;
   const pidsWatchdog = setInterval(() => {
     if (shuttingDown) return;
-    const snapshot = (0, import_runner_core12.getResourceSnapshot)();
+    const snapshot = (0, import_runner_core13.getResourceSnapshot)();
     const pct = snapshot.pidsPct;
     if (pct == null || !Number.isFinite(pct)) return;
     if (pct >= PIDS_RECYCLE_PCT) {
@@ -347384,7 +348166,7 @@ async function startRunner(opts) {
               log.dim(`  Deferred ${run2.runId} (project ${runProject} at capacity ${getActiveForProject(runProject)}/${projectLimit})`);
               continue;
             }
-            const admission = (0, import_runner_core12.evaluateRunAdmission)(RESOURCE_GOVERNOR_OPTIONS, {
+            const admission = (0, import_runner_core13.evaluateRunAdmission)(RESOURCE_GOVERNOR_OPTIONS, {
               mode: runMode,
               activeRuns,
               activeByType: Object.fromEntries(activeByType),
@@ -347462,9 +348244,9 @@ async function startRunner(opts) {
               leasedDeviceId = freeDeviceId;
               leasedDeviceIds.set(freeDeviceId, run2.runId);
             }
-            let claimed = false;
+            let claimEpoch = false;
             try {
-              claimed = await claimRun(serverUrl, headers, run2.runId);
+              claimEpoch = await claimRun(serverUrl, headers, run2.runId);
             } catch (err) {
               if (leasedDeviceId) {
                 leasedDeviceIds.delete(leasedDeviceId);
@@ -347472,7 +348254,7 @@ async function startRunner(opts) {
               }
               throw err;
             }
-            if (!claimed) {
+            if (claimEpoch === false) {
               log.dim(`  Skipped ${run2.runId} (already claimed)`);
               if (leasedDeviceId) {
                 leasedDeviceIds.delete(leasedDeviceId);
@@ -347480,6 +348262,7 @@ async function startRunner(opts) {
               }
               continue;
             }
+            run2.claimEpoch = claimEpoch;
             activeRuns++;
             incrementType(runMode);
             incrementProject(runProject);