@validate.qa/runner 1.0.42 → 1.0.44

package/dist/cli.mjs

@@ -1761,7 +1761,18 @@ var init_constants = __esm({
       "MINIMAX_API_KEY",
       "ANTHROPIC_API_KEY",
       "NVIDIA_API_KEY",
-      "DEEPSEEK_API_KEY"
+      "DEEPSEEK_API_KEY",
+      // Run-scoped callback capabilities. The parent runner injects these after
+      // sanitization; customer variables must never impersonate the control plane.
+      "AUTH_FILE",
+      "SHARED_AUTH_INJECT",
+      "VALIDATE_RUN_ID",
+      "VALIDATE_CLAIM_EPOCH",
+      "VALIDATE_AUTH_CONFIG_HASH",
+      "VALIDATE_TASK_ARN",
+      "VALIDATE_RUNNER_AUTH",
+      "VALIDATE_SERVER_URL",
+      "VALIDATE_LIVE_BROWSER_STATE_PATH"
     ]);
     SPAWNED_ENV_ALLOWLIST = /* @__PURE__ */ new Set([
       // Runtime essentials - Node.js and Playwright need these to function
@@ -4773,6 +4784,204 @@ var init_origin_domain = __esm({
   }
 });
 
+// ../shared/dist/auth-plan.js
+function hasInlineLoginSteps(playwrightCode) {
+  if (!playwrightCode)
+    return false;
+  return /process\.env\.TEST_USER_EMAIL!?/.test(playwrightCode) && /process\.env\.TEST_USER_PASSWORD!?/.test(playwrightCode);
+}
+function hasGeneratedAuthGuard(playwrightCode) {
+  if (!playwrightCode)
+    return false;
+  return /\/\/ >>> VALIDATE_QA_AUTH v\d+\b[\s\S]*?process\.env\.AUTH_FILE[\s\S]*?\/\/ <<< VALIDATE_QA_AUTH v\d+\b/.test(playwrightCode);
+}
+function legacyNeedsCookieState(tags, code, sharedAuthInjectEnabled2) {
+  if (tags.includes("@auth"))
+    return false;
+  if (tags.includes("@api"))
+    return true;
+  if (!tags.includes("@needs-auth"))
+    return false;
+  if (sharedAuthInjectEnabled2 && tags.includes("@auth-guarded") && hasGeneratedAuthGuard(code))
+    return true;
+  const isGeneratedVariant = tags.includes("@edge") || tags.includes("@bug");
+  const hasLegacyInlineLogin = tags.includes("@discovered") && !isGeneratedVariant && hasInlineLoginSteps(code);
+  return !tags.includes("@inline-login") && !hasLegacyInlineLogin;
+}
+function explicitAuthTypeTags(t) {
+  const found = /* @__PURE__ */ new Set();
+  for (const tag of t) {
+    if (AUTH_TYPE_TAGS.includes(tag))
+      found.add(tag);
+    else if (AUTH_TAG_ALIASES[tag])
+      found.add(AUTH_TAG_ALIASES[tag]);
+  }
+  return [...found];
+}
+function invalidPlan(configurationError) {
+  return {
+    version: 1,
+    source: "invalid",
+    acquisition: "unsupported",
+    presentation: "none",
+    needsCookieState: false,
+    needsStandingHeaders: false,
+    standingHeadersMode: "none",
+    needsLoginCreds: false,
+    requiredEnvKeys: [],
+    configurationError
+  };
+}
+function explicitPlan(authTypeTag2, acquisition, presentation, opts) {
+  return {
+    version: 1,
+    source: "explicit",
+    authTypeTag: authTypeTag2,
+    acquisition,
+    presentation,
+    needsCookieState: opts.cookie,
+    needsStandingHeaders: opts.standingMode === "required",
+    standingHeadersMode: opts.standingMode,
+    needsLoginCreds: TEST_USER_ENV_KEYS.every((k) => opts.requiredEnvKeys.includes(k)),
+    requiredEnvKeys: opts.requiredEnvKeys
+  };
+}
+function deriveAuthPlan(tags, code, opts) {
+  const t = Array.isArray(tags) ? tags : [];
+  const sharedFlag = opts?.sharedAuthInjectEnabled ?? false;
+  const isApi = t.includes("@api");
+  const explicit = isApi ? explicitAuthTypeTags(t) : [];
+  if (explicit.length > 0) {
+    if (t.includes("@auth")) {
+      return invalidPlan("@auth (self-login UI) cannot be combined with an explicit @api auth-type tag");
+    }
+    if (explicit.length > 1) {
+      return invalidPlan(`conflicting auth-type tags: ${explicit.join(", ")}`);
+    }
+    switch (explicit[0]) {
+      case AUTH_TAG_UNSUPPORTED:
+        return {
+          ...invalidPlan("auth scheme not yet drivable (e.g. HMAC / mTLS / provider-replay) \u2014 needs manual configuration")
+        };
+      case AUTH_TAG_NONE:
+        return explicitPlan(AUTH_TAG_NONE, "none", "none", { cookie: false, standingMode: "none", requiredEnvKeys: [] });
+      case AUTH_TAG_STANDING:
+        return explicitPlan(AUTH_TAG_STANDING, "standing-secret", "standing-header", { cookie: false, standingMode: "required", requiredEnvKeys: [API_AUTH_HEADERS_ENV_KEY] });
+      case AUTH_TAG_LOGIN_BEARER:
+        return explicitPlan(AUTH_TAG_LOGIN_BEARER, "request-login", "bearer", { cookie: false, standingMode: "none", requiredEnvKeys: [...TEST_USER_ENV_KEYS] });
+      case AUTH_TAG_LOGIN_COOKIE:
+        return explicitPlan(AUTH_TAG_LOGIN_COOKIE, "request-login", "cookie", { cookie: false, standingMode: "legacy-if-configured", requiredEnvKeys: [...TEST_USER_ENV_KEYS] });
+      case AUTH_TAG_COOKIE_STATE:
+        return explicitPlan(AUTH_TAG_COOKIE_STATE, "browser-bootstrap", "cookie", { cookie: true, standingMode: "legacy-if-configured", requiredEnvKeys: [...TEST_USER_ENV_KEYS] });
+    }
+  }
+  const cookie = legacyNeedsCookieState(t, code, sharedFlag);
+  const authedLegacy = t.includes("@auth") || t.includes("@needs-auth") || isApi;
+  return {
+    version: 1,
+    source: "legacy",
+    acquisition: cookie ? "browser-bootstrap" : authedLegacy ? "request-login" : "none",
+    presentation: authedLegacy ? "cookie" : "none",
+    needsCookieState: cookie,
+    needsStandingHeaders: false,
+    // A legacy bare-@api test keeps injecting standing headers IF the project configured them
+    // (preserving today's behavior) — but does not require them. Non-@api legacy tests never inject.
+    standingHeadersMode: isApi ? "legacy-if-configured" : "none",
+    needsLoginCreds: authedLegacy,
+    requiredEnvKeys: authedLegacy ? [...TEST_USER_ENV_KEYS] : []
+  };
+}
+function authTypeTag(tags) {
+  const t = Array.isArray(tags) ? tags : [];
+  const explicit = explicitAuthTypeTags(t);
+  return explicit.length === 1 ? explicit[0] : void 0;
+}
+var AUTH_TAG_COOKIE_STATE, AUTH_TAG_LOGIN_COOKIE, AUTH_TAG_LOGIN_BEARER, AUTH_TAG_STANDING, AUTH_TAG_NONE, AUTH_TAG_UNSUPPORTED, AUTH_TYPE_TAGS, AUTH_TAG_ALIASES, TEST_USER_ENV_KEYS, API_AUTH_HEADERS_ENV_KEY;
+var init_auth_plan = __esm({
+  "../shared/dist/auth-plan.js"() {
+    "use strict";
+    AUTH_TAG_COOKIE_STATE = "@auth-cookie-state";
+    AUTH_TAG_LOGIN_COOKIE = "@auth-login-cookie";
+    AUTH_TAG_LOGIN_BEARER = "@auth-login-bearer";
+    AUTH_TAG_STANDING = "@auth-standing";
+    AUTH_TAG_NONE = "@auth-none";
+    AUTH_TAG_UNSUPPORTED = "@auth-unsupported";
+    AUTH_TYPE_TAGS = [
+      AUTH_TAG_COOKIE_STATE,
+      AUTH_TAG_LOGIN_COOKIE,
+      AUTH_TAG_LOGIN_BEARER,
+      AUTH_TAG_STANDING,
+      AUTH_TAG_NONE,
+      AUTH_TAG_UNSUPPORTED
+    ];
+    AUTH_TAG_ALIASES = {
+      "@auth-cookie": AUTH_TAG_COOKIE_STATE,
+      "@auth-bearer": AUTH_TAG_LOGIN_BEARER,
+      "@auth-token": AUTH_TAG_LOGIN_BEARER,
+      "@auth-api-key": AUTH_TAG_STANDING,
+      "@auth-standing-header": AUTH_TAG_STANDING
+    };
+    TEST_USER_ENV_KEYS = ["TEST_USER_EMAIL", "TEST_USER_PASSWORD"];
+    API_AUTH_HEADERS_ENV_KEY = "API_AUTH_HEADERS";
+  }
+});
+
+// ../shared/dist/redact-needles.js
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function buildNeedleMatcher(needles) {
+  const usable = Array.from(new Set(needles.filter((n) => typeof n === "string" && n.length >= MIN_NEEDLE_LENGTH))).sort((a, b) => b.length - a.length);
+  if (usable.length === 0)
+    return null;
+  return new RegExp(usable.map(escapeRegExp).join("|"), "g");
+}
+function redactNeedlesText(text, matcher) {
+  if (!matcher || !text)
+    return text;
+  matcher.lastIndex = 0;
+  const out = text.replace(matcher, REDACTED);
+  return out === text ? text : out;
+}
+function redactNeedlesDeep(value, matcher) {
+  if (!matcher)
+    return value;
+  if (typeof value === "string") {
+    const scrubbed = redactNeedlesText(value, matcher);
+    return scrubbed === value ? value : scrubbed;
+  }
+  if (Array.isArray(value)) {
+    let changed = false;
+    const next = value.map((item) => {
+      const scrubbed = redactNeedlesDeep(item, matcher);
+      if (scrubbed !== item)
+        changed = true;
+      return scrubbed;
+    });
+    return changed ? next : value;
+  }
+  if (value !== null && typeof value === "object") {
+    let changed = false;
+    const next = {};
+    for (const [k, v] of Object.entries(value)) {
+      const scrubbed = redactNeedlesDeep(v, matcher);
+      if (scrubbed !== v)
+        changed = true;
+      next[k] = scrubbed;
+    }
+    return changed ? next : value;
+  }
+  return value;
+}
+var REDACTED, MIN_NEEDLE_LENGTH;
+var init_redact_needles = __esm({
+  "../shared/dist/redact-needles.js"() {
+    "use strict";
+    REDACTED = "[REDACTED]";
+    MIN_NEEDLE_LENGTH = 8;
+  }
+});
+
 // ../shared/dist/voice-config.js
 function normalizeTtsVoiceId(voiceId) {
   if (!voiceId)
@@ -5029,6 +5238,16 @@ var init_voice_config = __esm({
   }
 });
 
+// ../shared/dist/feature-flags.js
+function isSharedAuthInjectEnabled(value = process.env.SHARED_AUTH_INJECT) {
+  return value?.trim().toLowerCase() !== "false";
+}
+var init_feature_flags = __esm({
+  "../shared/dist/feature-flags.js"() {
+    "use strict";
+  }
+});
+
 // ../shared/dist/index.js
 var dist_exports = {};
 __export(dist_exports, {
@@ -5037,8 +5256,16 @@ __export(dist_exports, {
   ADDON_DEFINITIONS: () => ADDON_DEFINITIONS,
   ADMIN_EMAIL_LIMITS: () => ADMIN_EMAIL_LIMITS,
   AI_CREDIT_MARGIN: () => AI_CREDIT_MARGIN,
+  API_AUTH_HEADERS_ENV_KEY: () => API_AUTH_HEADERS_ENV_KEY,
   API_PREFIX: () => API_PREFIX,
   AUDIO_CHUNK_DURATION_MS: () => AUDIO_CHUNK_DURATION_MS,
+  AUTH_TAG_COOKIE_STATE: () => AUTH_TAG_COOKIE_STATE,
+  AUTH_TAG_LOGIN_BEARER: () => AUTH_TAG_LOGIN_BEARER,
+  AUTH_TAG_LOGIN_COOKIE: () => AUTH_TAG_LOGIN_COOKIE,
+  AUTH_TAG_NONE: () => AUTH_TAG_NONE,
+  AUTH_TAG_STANDING: () => AUTH_TAG_STANDING,
+  AUTH_TAG_UNSUPPORTED: () => AUTH_TAG_UNSUPPORTED,
+  AUTH_TYPE_TAGS: () => AUTH_TYPE_TAGS,
   COST_PER_M: () => COST_PER_M,
   CREDIT_PACKS_CENTS: () => CREDIT_PACKS_CENTS,
   CREDIT_PRICES_CENTS: () => CREDIT_PRICES_CENTS,
@@ -5081,6 +5308,7 @@ __export(dist_exports, {
   STT_MODEL_OPTIONS: () => STT_MODEL_OPTIONS,
   STT_PROVIDER_OPTIONS: () => STT_PROVIDER_OPTIONS,
   SUPPORT_EMAIL: () => SUPPORT_EMAIL,
+  TEST_USER_ENV_KEYS: () => TEST_USER_ENV_KEYS,
   TRANSIENT_CONTROL_ROLES: () => TRANSIENT_CONTROL_ROLES,
   TRIAL_DURATION_DAYS: () => TRIAL_DURATION_DAYS,
   TTS_MODEL_OPTIONS: () => TTS_MODEL_OPTIONS,
@@ -5090,10 +5318,12 @@ __export(dist_exports, {
   accumulateStatements: () => accumulateStatements,
   aiCostToCreditCents: () => aiCostToCreditCents,
   analyzeMobileSelectorQuality: () => analyzeMobileSelectorQuality,
+  authTypeTag: () => authTypeTag,
   bugFoundQuarantineWhere: () => bugFoundQuarantineWhere,
   buildAppiumCode: () => buildAppiumCode,
   buildLaunchStep: () => buildLaunchStep,
   buildMobileStep: () => buildMobileStep,
+  buildNeedleMatcher: () => buildNeedleMatcher,
   buildSandboxedEnv: () => buildSandboxedEnv,
   buildSanitizedAgentEnv: () => buildSanitizedAgentEnv,
   buildStepTarget: () => buildStepTarget,
@@ -5109,6 +5339,7 @@ __export(dist_exports, {
   controlSignature: () => controlSignature,
   countInnerTests: () => countInnerTests,
   decideHarPosted: () => decideHarPosted,
+  deriveAuthPlan: () => deriveAuthPlan,
   deriveProjectKey: () => deriveProjectKey,
   detectCrossOriginHtmlAsJson: () => detectCrossOriginHtmlAsJson,
   detectsErrorBannerAssertion: () => detectsErrorBannerAssertion,
@@ -5152,6 +5383,7 @@ __export(dist_exports, {
   isRunnableStep: () => isRunnableStep,
   isSafeDeepLink: () => isSafeDeepLink,
   isSameRegistrableDomainHost: () => isSameRegistrableDomainHost,
+  isSharedAuthInjectEnabled: () => isSharedAuthInjectEnabled,
   isSttModelForProvider: () => isSttModelForProvider,
   isTestReadyForPlatform: () => isTestReadyForPlatform,
   isTrialExpired: () => isTrialExpired,
@@ -5175,6 +5407,8 @@ __export(dist_exports, {
   planHasBillingPortal: () => planHasBillingPortal,
   planRequiresCheckout: () => planRequiresCheckout,
   platformTag: () => platformTag,
+  redactNeedlesDeep: () => redactNeedlesDeep,
+  redactNeedlesText: () => redactNeedlesText,
   registrableDomain: () => registrableDomain,
   resolveCrossOriginConfigOverride: () => resolveCrossOriginConfigOverride,
   resolveMobileStepValuePlaceholders: () => resolveMobileStepValuePlaceholders,
@@ -5217,7 +5451,10 @@ var init_dist = __esm({
     init_agent_env();
     init_test_counting();
     init_origin_domain();
+    init_auth_plan();
+    init_redact_needles();
     init_voice_config();
+    init_feature_flags();
   }
 });
 
@@ -10681,7 +10918,7 @@ var require_transport = __commonJS({
   "../../node_modules/pino/lib/transport.js"(exports, module) {
     "use strict";
     var { createRequire } = __require("module");
-    var { existsSync: existsSync4 } = __require("fs");
+    var { existsSync: existsSync3 } = __require("fs");
     var getCallers = require_caller();
     var { join: join7, isAbsolute, sep } = __require("path");
     var { fileURLToPath } = __require("url");
@@ -10755,7 +10992,7 @@ var require_transport = __commonJS({
           return false;
         }
       }
-      return isAbsolute(path) && !existsSync4(path);
+      return isAbsolute(path) && !existsSync3(path);
     }
     function stripQuotes(value) {
       const first = value[0];
@@ -52383,11 +52620,11 @@ var require_leac = __commonJS({
         if (r.str.length === 0) {
           throw new Error(`Rule #${i} ("${r.name}") has empty "str" property, which is not allowed.`);
         }
-        return new RegExp(escapeRegExp(r.str), "y");
+        return new RegExp(escapeRegExp2(r.str), "y");
       }
-      return new RegExp(escapeRegExp(r.name), "y");
+      return new RegExp(escapeRegExp2(r.name), "y");
     }
-    function escapeRegExp(str) {
+    function escapeRegExp2(str) {
       return str.replace(/[-[\]{}()*+!<=:?./\\^$|#\s,]/g, "\\$&");
     }
     function toSticky(re) {
@@ -68360,7 +68597,7 @@ var require_discover_ai_planner = __commonJS({
   "../runner-core/dist/services/discover-ai-planner.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.SCENARIO_SYSTEM_PROMPT = void 0;
+    exports.PLANNER_STRENGTHEN_GATE_PROMPT = exports.SCENARIO_SYSTEM_PROMPT = void 0;
     exports.getAIPlannerMaxTokens = getAIPlannerMaxTokens;
     exports.getSnapshotConfidence = getSnapshotConfidence;
     exports.compressSiteMap = compressSiteMap;
@@ -68943,7 +69180,7 @@ Return ONLY one valid JSON object matching the schema below. Do NOT include <thi
 4. **Multi-page journeys** - only when transitions were actually observed
 5. **Bug reports** - for observed 500 errors, crashes, or broken features
 6. **Steps are human-readable** - "Fill the email field", not "page.getByLabel('Email').fill()"
-7. **Expected outcomes are plain-English success criteria** - describe the user-visible product result, not the controls touched along the way. Steps already cover buttons, inputs, links, fields, headings, tabs, dialogs, and menus. Expected outcomes should say what the user can now do or rely on (record saved, message sent, search results filtered, validation explained, dashboard accessible). Include durable routes or exact copy only when they are the real product outcome; do NOT list "heading visible", "button visible", "search input visible", or similar element inventory unless that exact control is the behavior under test.  **Outcome-strength self-check (applies to EVERY scenario type):** before emitting a scenario, ask \u2014 would every expectedOutcome still pass if the primary action did nothing and only the page and its existing chrome rendered? If yes, it is too weak. Add at least one evidence-backed post-condition that would FAIL in that no-op case: specific result content or value, a created or removed entity, a changed count or status, persisted state after reload, handled validation copy, or a concrete session signal. A route alone suffices only when navigation or redirect is itself the behavior under test; a newly revealed control suffices only when revealing that control is the behavior under test. Never invent copy to satisfy this check \u2014 Rule 1 still governs what you may assert.
+7. **Expected outcomes are plain-English success criteria** - describe the user-visible product result, not the controls touched along the way. Steps already cover buttons, inputs, links, fields, headings, tabs, dialogs, and menus. Expected outcomes should say what the user can now do or rely on (record saved, message sent, search results filtered, validation explained, dashboard accessible). Include durable routes or exact copy only when they are the real product outcome; do NOT list "heading visible", "button visible", "search input visible", or similar element inventory unless that exact control is the behavior under test.  **Outcome-strength check (per outcome, applies to EVERY scenario type):** evaluate each expectedOutcome separately. Delete it if it would already be true immediately before the scenario's primary action \u2014 UNLESS navigation, redirect, or revealing that state is itself the behavior under test. Keep at least one evidence-backed discriminator that proves the primary behavior actually occurred: specific result content or value, a created or removed entity, a changed count or status, persisted state after reload, or handled validation copy. Every value, count-change, persistence, creation, or removal assertion MUST trace to an earlier evidence-backed step that establishes the baseline or exact target. If the evidence does not support such a step, drop the assertion; do not invent setup. **Silent-failure BUG_REPORT exception:** apply ONLY when evidence explicitly records an action as broken because its intended state change did not occur. It does NOT apply to expected validation, permission denial, unmet prerequisites, loading or rate-limit states, or any non-BUG scenario. Prove the unchanged state with an evidence-backed before/after discriminator tied to the attempted run-scoped target \u2014 not merely "no toast", "no redirect", or "the form is still visible". Never invent copy to satisfy this check \u2014 Rule 1 still governs what you may assert.
 8. **Auth-aware** - mark scenarios that need login. Use process.env.TEST_USER_EMAIL / PASSWORD
 9. **No duplicates** - check existing test names before adding
 10. **All tests start from the landing page** - every generated test navigates to \`/\` first and uses the app's own navigation (clicking links/buttons) to reach the target page. Steps must reflect this: say "Navigate to landing page and click Sign In" not "Navigate to /auth/login". Deep-linking to internal routes causes hydration failures in SPAs. \`targetPages\` lists the pages involved in the flow.
@@ -68956,7 +69193,7 @@ Return ONLY one valid JSON object matching the schema below. Do NOT include <thi
     Example - BAD happy path: \`["Navigate to /feature", "Click Create", "Verify dialog opens"]\` \u2192 only tests the trigger.
     Example - GOOD happy path (generic, async): \`["Navigate to landing and log in", "Navigate to the feature page", "Note the current count of items on the list", "Click the primary action button", "Fill required inputs and submit", "Wait for completion signal (up to 60s)", "Verify the item count increased by 1", "Open the newly created item", "Verify its content is non-empty and contains the input I provided"]\`
     Example - GOOD happy path (sync CRUD): \`["Navigate to landing and log in", "Navigate to the list page", "Click New", "Fill required fields", "Click Save", "Verify the new record appears in the list", "Click the record and verify its detail view shows the values I entered"]\`
-12. **Auth happy paths require concrete session proof.** A login/auth HAPPY_PATH is incomplete if it only proves "user reaches dashboard" or "authenticated page is visible." It MUST verify at least one durable signed-in signal that was observed in the evidence: user/account menu opens, Logout/Sign out is available, the observed display name/email/avatar/account item is present, authenticated navigation remains available after a reload, or another app-specific session control is usable. Prefer concrete observed labels from the evidence (for example "Logout", "Sign out", "Account", "Profile", or the user's own displayed name/email from evidence) over generic phrases like "personalized content." If the explorer only observed a redirect and no signed-in signal, keep the route outcome but mark the session-proof outcome reliability "low" and state what concrete signal was missing.
+12. **Auth happy paths require concrete session proof.** A login/auth HAPPY_PATH is incomplete if it only proves "user reaches dashboard" or "authenticated page is visible." It MUST verify at least one durable signed-in signal that was observed in the evidence: user/account menu opens, Logout/Sign out is available, the observed display name/email/avatar/account item is present, authenticated navigation remains available after a reload, or another app-specific session control is usable. Prefer concrete observed labels from the evidence (for example "Logout", "Sign out", "Account", "Profile", or the user's own displayed name/email from evidence) over generic phrases like "personalized content." If the explorer only observed a redirect and no concrete signed-in control, do NOT invent one or instruct the executor to "open the account/user menu" \u2014 assert only the exact observed redirect (plus any directly supported transition, e.g. the login form is no longer shown), treat the redirect and any observed transition as transition outcomes \u2014 not concrete session proof \u2014 assign each its evidence-supported reliability, and name the missing concrete signal as a coverage gap in reasoning. Never substitute a menu of generic alternatives ("such as Logout, Profile, or \u2026") for one evidenced signal in a step or expected outcome.
 13. **Independent execution contract.** Every scenario MUST pass when run alone, first, last, in random order, and in parallel against an environment with no relevant feature data except explicitly guaranteed immutable fixtures. A scenario that depends on a sibling scenario's side effects (e.g. "delete the conversation that another test created") is invalid. If two flows are inherently coupled, bundle them as a single USER_JOURNEY scenario.
 14. **Scenario-owned state.** If a scenario reads, searches, opens, updates, messages, cancels, or deletes an entity, that scenario MUST create or seed the entity in its own setup steps. "Use an existing record" / "the conversation in the demo account" / "the existing user named X" are forbidden phrasings \u2014 they assume mutable pre-existing app data. Carve-out: baseline observations (current count, list length, "the dashboard heading is visible") are allowed as prerequisite reads ONLY when the durable assertion targets a self-created entity. Phrase setup as: "Click New, fill required fields with run-scoped values, submit and verify the new record appears, THEN proceed to <feature under test>."
 15. **Run-scoped test data.** Generated entities MUST use unique, run-scoped identifiers \u2014 phrase as "test message <Date.now()>" or "QA-<unique id>" in steps. Subsequent assertions MUST target that unique identifier, not "the first item", "the latest message", "the last row", or any visible display name observed during exploration. Hardcoding any specific display name, username, email, conversation title, or other identifier observed in the explorer's snapshot is forbidden \u2014 that data is incidental, not a stable contract. The same identifiers will not exist (or will look different) when the test runs in a fresh environment or against a different account.
@@ -69019,6 +69256,9 @@ Return ONLY one valid JSON object matching the schema below. Do NOT include <thi
     Citing observed labels in \`expectedOutcomes\` is fine \u2014 that's asserting on stable product signals, not implementation specifics.
 
 ## Coverage Strategy
+**Coverage allocation \u2014 order matters.** The test budget is a ceiling, never a target. Before writing JSON, privately inventory each distinct behavior the evidence explicitly RECORDS: a SUCCESS, EMPTY_STATE, VALIDATION_ERROR, ERROR, BUG, an Explorer-Recorded Journey outcome, or an observed page/state transition. Assign each recorded behavior to exactly one scenario as its primary coverage owner \u2014 this does not prohibit repeating evidence-backed prerequisite setup and verification required by Rules 13\u201317. Bundle input variants that exercise the same purpose (e.g. two malformed-parameter cases that both return the same validation) into that one scenario. Use Page Intelligence only to make sure every described surface is reached \u2014 a merely listed control, route, provider, tab, or input does NOT by itself prove a behavior or earn its own scenario. Do NOT add an inferred scenario just to fill the budget. If a recorded behavior cannot be tested independently without unsupported mutable state, name it as a coverage gap (rule 17) rather than pretending it is self-contained. Treat a page/state transition as a distinct behavior only when navigation or revealing that state is itself the recorded product outcome; otherwise keep it as a step within the owning scenario \u2014 Page Intelligence creates no additional coverage obligation.
+
+Apply the per-surface minimums below only where the evidence actually supports them (evidence support includes Rule 1's trigger-only structural exception):
 - For every form: at least 1 HAPPY_PATH (submit valid data AND verify durable result per rule 11) + 1 EDGE_CASE (empty/invalid submission)
 - For auth flows: login happy path (verify the post-login route AND a concrete signed-in/session signal per rule 12) + validation (wrong password, empty fields)
 - For CRUD: each scenario MUST own the entity it operates on. Read/search/update/delete/cancel-on-existing/view-existing scenarios MUST include a create step earlier in the same scenario (or declare an immutable seed fixture by name). Never assume a record from prior runs or sibling tests exists. Splitting into atomic create/read/update/delete tests is fine ONLY when each test creates its own entity. When create/delete are tightly coupled (e.g. delete-only with no create flow elsewhere), bundle into a single USER_JOURNEY: create \u2192 verify \u2192 delete \u2192 verify removal.
@@ -69048,11 +69288,11 @@ Return ONLY one valid JSON object matching the schema below. Do NOT include <thi
         { "action": "Fill the email field with test credentials" },
         { "action": "Fill the password field with test credentials" },
         { "action": "Click the Sign In button" },
-        { "action": "Open the observed authenticated account or user menu" }
+        { "action": "After reaching the observed post-login page, reload it" }
       ],
       "expectedOutcomes": [
-        { "type": "url", "description": "User reaches /dashboard after signing in", "reliability": "high" },
-        { "type": "element-visible", "description": "The signed-in session is proven by an observed user/account signal such as Logout, Profile, or the user's displayed identity", "reliability": "high" }
+        { "type": "url", "description": "User reaches /dashboard after signing in and remains there after reload", "reliability": "high" },
+        { "type": "element-hidden", "description": "The login form does not return after reload", "reliability": "medium" }
       ],
       "targetPages": ["/auth/login", "/dashboard"],
       "prerequisites": []
@@ -69082,6 +69322,46 @@ Each entry is exactly one of:
 3 = medium (navigation, secondary features)
 4 = low (edge cases, cosmetic)
 5 = nice-to-have`;
+    exports.PLANNER_STRENGTHEN_GATE_PROMPT = `You are a senior QA lead performing ONE design-audit pass over a test PLAN another model wrote for a single web feature. The plan will be handed to a LIVE generator that opens the real app, follows each scenario's steps, observes the DOM, and writes the concrete assertions itself. Division of labor you MUST respect:
+- The PLAN owns the ORACLE: WHAT must be true for the behavior to be correct, stated in plain English.
+- The GENERATOR owns BINDING: locators and the exact runtime values it reads off the live page.
+Never write an expectation whose truth is decided by looking at the current app ("whatever the page shows"): that lets a live bug become the expected result. State the intended truth; the generator will bind it and report a mismatch if reality disagrees.
+
+You are given (1) the EXACT evidence the plan was based on \u2014 the ONLY ground truth; you may use it to know WHAT behaviors exist, but you must NEVER introduce a behavior, route, element, or effect not present in or directly implied by it \u2014 and (2) the PLAN as JSON. Return the complete corrected plan.
+
+## Rule 0 \u2014 REPAIR OR DROP, never merely describe (highest priority)
+Do NOT write a reasoning note about a fix you did not actually apply. Every change you claim must be present in the scenarios you output: if you say you strengthened an outcome, the new outcome text must be there; if you say you merged or removed a duplicate, NO surviving scenario may share the same primary action + outcome. If a defect cannot be repaired from the evidence, DROP the scenario or FLAG it \u2014 do not keep a known-weak scenario with an excuse. Flag-and-keep is forbidden.
+
+Your only legal moves per scenario are: KEEP unchanged \xB7 REWRITE using a grounded fact \xB7 DROP as unsupported/duplicate \xB7 FLAG as needs-more-evidence (low reliability, honest note). You may never FORCE-REWRITE by inventing an effect the evidence does not show (a visible Delete control does not tell you whether delete removes, archives, hides, or disables \u2014 do not assume).
+
+## Rule 1 \u2014 Classify each scenario, then require the matching oracle
+Identify the scenario's archetype and hold its expectedOutcomes to the right shape. An outcome is only valid if it would be FALSE under a plausible FAULT for that archetype:
+
+- CREATE/EDIT/DELETE (mutation): the scenario must control its own target \u2014 create the entity it acts on with a self-chosen unique identifier (create \u2192 act \u2192 verify), or declare a prerequisite that resolves it (a fixture or a stable immutable reference). Never depend on unspecified pre-existing/ambient rows ("delete the first row", "open an existing order"). Oracle = the owned entity's before\u2192after: it appears after create / reflects the edit / is absent after delete (verify by the unique identifier, ideally after reload), while an unrelated sentinel is unaffected. Plausible faults to defeat: no-op, wrong-target, duplicate, non-persistence-after-reload, over-broad delete.
+- LIST/READ/DETAIL: oracle = the returned content corresponds to what was requested (the opened item's identifier matches the one selected). No before\u2192after is required.
+- FILTER/SEARCH/SORT: oracle = a delta \u2014 a known in-scope item remains AND a known out-of-scope item disappears (or order changes as specified). "Matching items are shown" alone is a no-op (a broken filter that shows everything passes).
+- VALIDATION/NEGATIVE: oracle must distinguish "the action was correctly rejected by validation" from "nothing happened / a dead control". Prefer the grounded error signal the evidence recorded (exact message or the specific field marked invalid) plus the absence of the forbidden effect (no entity created). If no error signal was observed, keep it structural at low reliability and FLAG.
+- NAVIGATION/REDIRECT/AUTH-GUARD: the destination is a legitimate primary effect \u2014 assert the route AND one observed landing signal (heading/content) so a redirect to a broken page fails. Route-presence as an outcome on a NON-navigation scenario is padding \u2014 drop it.
+- TOGGLE/IDEMPOTENT: assert the changed attribute/state (e.g. pressed/checked/disabled), or for idempotent actions that no duplicate is created \u2014 not mere visibility.
+- EXTERNAL INTEGRATION: assert the outbound URL/payload contains the expected parameters (drawn from evidence), not a frozen full string.
+- STATIC CONTENT: presence/label oracle is acceptable; do not inflate it. Verify shared chrome (nav/footer) ONCE, not per page.
+- APP BUG: exactly one BUG_REPORT per distinct root cause; assert the observed defective effect. Console errors, thrown exceptions, and network status codes are NOT page text \u2014 assert the observable page effect (no toast / no redirect / form unchanged), or set the outcome type to the right probe.
+
+## Rule 2 \u2014 Exact values: judge by ORIGIN, not specificity
+- DROP as brittle: mutable ambient snapshots the test does not control \u2014 current counts ("8 cards"), seeded record names, other users' data, opaque IDs/slugs, phone numbers. Phrase these relationally ("the account's active business name", "the created item", "\u22651 result").
+- KEEP exact: values the SCENARIO itself introduced (a unique title it typed \u2014 assert it propagates), app-authored static strings (validation messages, headings, template copy, fixed error codes), and stable contract/derived facts (a contractual price, total = qty \xD7 unit price). These are real oracles, not brittleness.
+
+## Rule 3 \u2014 Do not build on flows the evidence shows are broken or unrepeatable
+If evidence flags a route/flow as broken, a precondition as unobtainable (e.g. a single-use token already consumed, an account locked out), or a mutation as irreversible/one-shot on a shared account, you MUST NOT emit happy-path scenarios that depend on that flow succeeding or repeating. Reconcile: drop the dependent happy path, or route it through an alternate path the evidence actually shows.
+
+## Rule 4 \u2014 Suite economy and completeness
+Budget is a ceiling, not a target. Merge scenarios that collide on (route + primary action + outcome-class). Do not enumerate one scenario per item across a long list when 1\u20133 representatives suffice. Reclaim freed budget to cover a DISTINCT behavior the evidence recorded that the plan left untested (swap, do not inflate). An action inferred only from a merely-listed control the evidence never showed exercised should be dropped and FLAGGED as a survey gap, not asserted.
+
+## Rule 5 \u2014 reliability is honest
+high = the effect and its trigger are both directly observed in evidence; medium = observed but partial/indirect; low = structural or inferred (must be FLAGGED). Never launder an unsupported claim by labelling it low \u2014 if it is invented, drop it.
+
+## Output
+Keep the exact JSON schema { "featureGroups":[...], "scenarios":[...], "reasoning":"..." }; each scenario keeps name, type, priority, variant, featureGroup, goal, steps[], expectedOutcomes[{type,description,reliability}], targetPages, prerequisites. In "reasoning", state ONLY changes you actually made (kept/rewritten/dropped/merged/flagged counts). Return ONLY the complete corrected JSON object \u2014 no markdown, no prose outside JSON.`;
     function coerceRawPrerequisites(raw) {
       if (!Array.isArray(raw))
         return [];
@@ -69865,6 +70145,95 @@ Each entry is exactly one of:
           }
         }
       }
+      const gateFlag = (process.env.PLANNER_STRENGTHEN_GATE || "").trim().toLowerCase();
+      const gateEnabled = gateFlag !== "false" && gateFlag !== "0";
+      if (gateEnabled && context.mode !== "survey" && !options.systemPromptOverride && !options.userPromptOverride && !extraPlannerCallUsed && scenarios.length > 0) {
+        const gateModel = options.gateModelOverride ? (0, ai_provider_js_1.resolveModelForTask)(options.gateModelOverride, "agent") : agentModel;
+        const gateClient = options.gateModelOverride ? (0, ai_provider_js_1.getRunnerClientForModel)(options.gateModelOverride) : aiClient;
+        const gateMaxTokens = getAIPlannerMaxTokens(gateModel);
+        const gatePlan = { featureGroups, scenarios, reasoning: aiOutput.reasoning ?? "" };
+        const gateUser = `EVIDENCE (ground truth):
+${userPrompt}
+
+=====
+
+PLAN TO AUDIT AND REPAIR (JSON):
+${JSON.stringify(gatePlan)}`;
+        const gateStart = Date.now();
+        let gateResponse = null;
+        try {
+          extraPlannerCallUsed = true;
+          gateResponse = await (0, ai_retry_js_1.resilientAICall)((signal, arm) => (0, ai_queue_js_1.queuedAICall)(() => {
+            arm();
+            return gateClient.chat.completions.create({
+              model: gateModel,
+              messages: [
+                { role: "system", content: exports.PLANNER_STRENGTHEN_GATE_PROMPT },
+                { role: "user", content: gateUser }
+              ],
+              max_tokens: gateMaxTokens,
+              temperature: 0.2,
+              ...(0, ai_provider_js_1.getJsonObjectResponseFormat)(gateModel),
+              ...(0, ai_provider_js_1.getNoThinkingRequestOptions)(gateModel)
+            }, { signal });
+          }), {
+            label: "ai-planner-strengthen-gate",
+            deferTimeoutUntilArmed: true,
+            onRetry: (attempt, reason, delay) => logs2.push(`AI planner strengthen-gate call failed (${reason}) \u2014 retry ${attempt} in ${Math.round(delay / 1e3)}s`)
+          });
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          logs2.push(`AI planner strengthen-gate failed (${message}) \u2014 keeping pre-gate result`);
+        }
+        if (gateResponse) {
+          try {
+            options.onAICall?.({
+              iteration: 1,
+              groupId: `ai-planner-${context.projectId.slice(0, 8)}`,
+              callType: "discoveryAIPlannerStrengthenGate",
+              model: gateModel,
+              provider: (0, ai_provider_js_1.getProviderForModel)(gateModel),
+              durationMs: Date.now() - gateStart,
+              promptTokens: gateResponse.usage?.prompt_tokens,
+              completionTokens: gateResponse.usage?.completion_tokens,
+              totalTokens: gateResponse.usage?.total_tokens,
+              assistantMessage: gateResponse.choices[0]?.message?.content,
+              requestMessageCount: 2
+            });
+          } catch {
+          }
+          const gateRaw = gateResponse.choices[0]?.message?.content?.trim();
+          if (gateRaw) {
+            let gateOut = null;
+            try {
+              gateOut = JSON.parse((0, strip_json_fences_js_1.stripJsonFences)(gateRaw));
+            } catch (err) {
+              const message = err instanceof Error ? err.message : String(err);
+              logs2.push(`AI planner strengthen-gate returned invalid JSON (${message}) \u2014 keeping pre-gate result`);
+            }
+            if (gateOut) {
+              try {
+                const vg = validateAIPlannerOutput(gateOut, siteMap, context.existingTestNames, context.testBudget, evidence.recordedJourneys, context.mode, context.focusAreas);
+                const preGateCount = scenarios.length;
+                const keepsCoverage = vg.scenarios.length >= Math.ceil(preGateCount * 0.5);
+                const noWorseGaps = vg.coverageGaps.length <= coverageGaps.length;
+                if (vg.scenarios.length > 0 && keepsCoverage && noWorseGaps) {
+                  logs2.push(`AI planner strengthen-gate [${gateModel}]: ${preGateCount}\u2192${vg.scenarios.length} scenarios, gaps ${coverageGaps.length}\u2192${vg.coverageGaps.length}; taking gated result`);
+                  scenarios = vg.scenarios;
+                  featureGroups = vg.featureGroups;
+                  warnings = [...warnings, ...vg.warnings];
+                  coverageGaps = vg.coverageGaps;
+                } else {
+                  logs2.push(`AI planner strengthen-gate rejected (scen ${preGateCount}\u2192${vg.scenarios.length}, gaps ${coverageGaps.length}\u2192${vg.coverageGaps.length}); keeping pre-gate result`);
+                }
+              } catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                logs2.push(`AI planner strengthen-gate validation threw (${message}) \u2014 keeping pre-gate result`);
+              }
+            }
+          }
+        }
+      }
       const totalFinal = scenarios.length + coverageGaps.length;
       const rejectionRateFinal = totalFinal > 0 ? coverageGaps.length / totalFinal : 0;
       if (rejectionRateFinal > 0.5 && totalFinal >= 3) {
@@ -73644,7 +74013,7 @@ var require_mobile_heal_postprocess = __commonJS({
       // OpenAI-style secret key
     ];
     var EMAIL_RE = /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g;
-    function escapeRegExp(value) {
+    function escapeRegExp2(value) {
       return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     }
     function collectSecretVars(testVariables, minLen, keyRe) {
@@ -73663,7 +74032,7 @@ var require_mobile_heal_postprocess = __commonJS({
         return text;
       let out = text;
       for (const { key, value } of collectSecretVars(testVariables, MIN_REDACT_LEN, REDACT_KEY_RE)) {
-        out = out.replace(new RegExp(escapeRegExp(value), "g"), `{{${key}}}`);
+        out = out.replace(new RegExp(escapeRegExp2(value), "g"), `{{${key}}}`);
       }
       for (const source of TOKEN_SOURCES) {
         out = out.replace(new RegExp(source, "g"), "[REDACTED]");
@@ -76063,7 +76432,7 @@ var require_api_auth_headers = __commonJS({
   "../runner-core/dist/services/api-auth-headers.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.parseApiAuthHeaders = parseApiAuthHeaders;
+    exports.parseApiAuthHeaders = parseApiAuthHeaders2;
     exports.resolveApiAuthHeaders = resolveApiAuthHeaders;
     exports.isAppOriginRequest = isAppOriginRequest;
     exports.buildOriginScopedApiFixtures = buildOriginScopedApiFixtures;
@@ -76076,7 +76445,7 @@ var require_api_auth_headers = __commonJS({
       }
       return false;
     }
-    function parseApiAuthHeaders(raw) {
+    function parseApiAuthHeaders2(raw) {
       if (!raw || typeof raw !== "string")
         return void 0;
       const trimmed = raw.trim();
@@ -76100,9 +76469,9 @@ var require_api_auth_headers = __commonJS({
     function resolveApiAuthHeaders(input) {
       if (input.explicit)
         return input.explicit;
-      if (!input.isApiTest)
+      if (input.standingHeadersMode === "none")
         return void 0;
-      return parseApiAuthHeaders(input.apiAuthHeadersVar);
+      return parseApiAuthHeaders2(input.apiAuthHeadersVar);
     }
     function isAppOriginRequest(url, baseUrl) {
       if (typeof url !== "string" || !baseUrl)
@@ -76170,6 +76539,126 @@ export const test = base.extend({
   }
 });
 
+// ../runner-core/dist/services/run-callback-proxy.js
+var require_run_callback_proxy = __commonJS({
+  "../runner-core/dist/services/run-callback-proxy.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.startRunCallbackProxy = startRunCallbackProxy;
+    var node_crypto_1 = __require("crypto");
+    var node_http_1 = __require("http");
+    var MAX_CALLBACK_BODY_BYTES = 5 * 1024 * 1024;
+    var CALLBACK_TIMEOUT_MS = 3e4;
+    function sendJson(res, status, body) {
+      const payload = JSON.stringify(body);
+      res.writeHead(status, {
+        "cache-control": "no-store",
+        "content-type": "application/json",
+        "content-length": Buffer.byteLength(payload)
+      });
+      res.end(payload);
+    }
+    async function readRequestBody(req) {
+      const chunks = [];
+      let total = 0;
+      for await (const chunk of req) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        total += buffer.length;
+        if (total > MAX_CALLBACK_BODY_BYTES)
+          throw new Error("callback body too large");
+        chunks.push(buffer);
+      }
+      return Buffer.concat(chunks);
+    }
+    async function startRunCallbackProxy(input) {
+      const upstream = new URL(input.serverUrl);
+      if (upstream.protocol !== "http:" && upstream.protocol !== "https:") {
+        throw new Error("callback server URL must use http or https");
+      }
+      const runPath = `/api/runner/runs/${encodeURIComponent(input.runId)}`;
+      const allowedPaths = /* @__PURE__ */ new Set([`${runPath}/credential`, `${runPath}/auth-state`]);
+      const token = (0, node_crypto_1.randomBytes)(32).toString("base64url");
+      const authHeader = `Bearer ${token}`;
+      const server3 = (0, node_http_1.createServer)(async (req, res) => {
+        try {
+          const requestUrl = new URL(req.url ?? "/", "http://127.0.0.1");
+          if (req.method !== "POST" || !allowedPaths.has(requestUrl.pathname) || requestUrl.search) {
+            sendJson(res, 404, { error: "Callback route not available" });
+            return;
+          }
+          if (req.headers.authorization !== authHeader) {
+            sendJson(res, 401, { error: "Invalid callback capability" });
+            return;
+          }
+          const body = await readRequestBody(req);
+          let parsedBody;
+          try {
+            const parsed = JSON.parse(body.toString("utf8"));
+            if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+              throw new Error("invalid body");
+            parsedBody = parsed;
+          } catch {
+            sendJson(res, 400, { error: "Callback body must be a JSON object" });
+            return;
+          }
+          const upstreamBody = JSON.stringify({
+            ...parsedBody,
+            ...input.taskArn ? { taskArn: input.taskArn } : {},
+            ...input.claimEpoch !== void 0 ? { claimEpoch: input.claimEpoch } : {},
+            ...input.authConfigHash ? { authConfigHash: input.authConfigHash } : {}
+          });
+          const destination = new URL(requestUrl.pathname, upstream);
+          const response = await fetch(destination, {
+            method: "POST",
+            headers: {
+              Authorization: input.upstreamAuthHeader,
+              "Content-Type": "application/json"
+            },
+            body: upstreamBody,
+            redirect: "error",
+            signal: AbortSignal.timeout(CALLBACK_TIMEOUT_MS)
+          });
+          const responseBody = Buffer.from(await response.arrayBuffer());
+          res.writeHead(response.status, {
+            "cache-control": "no-store",
+            "content-type": response.headers.get("content-type") ?? "application/json",
+            "content-length": responseBody.length
+          });
+          res.end(responseBody);
+        } catch (error2) {
+          const message = error2 instanceof Error && error2.message === "callback body too large" ? error2.message : "Callback forwarding failed";
+          sendJson(res, message === "callback body too large" ? 413 : 502, { error: message });
+        }
+      });
+      server3.on("clientError", (_error, socket) => socket.destroy());
+      await new Promise((resolve2, reject) => {
+        const onError = (error2) => reject(error2);
+        server3.once("error", onError);
+        server3.listen(0, "127.0.0.1", () => {
+          server3.off("error", onError);
+          resolve2();
+        });
+      });
+      const address = server3.address();
+      if (!address) {
+        server3.close();
+        throw new Error("callback proxy failed to bind");
+      }
+      let closed = false;
+      return {
+        serverUrl: `http://127.0.0.1:${address.port}`,
+        authHeader,
+        close: async () => {
+          if (closed)
+            return;
+          closed = true;
+          await new Promise((resolve2) => server3.close(() => resolve2()));
+        }
+      };
+    }
+  }
+});
+
 // ../runner-core/dist/services/playwright-native.js
 var require_playwright_native = __commonJS({
   "../runner-core/dist/services/playwright-native.js"(exports) {
@@ -76214,6 +76703,7 @@ var require_playwright_native = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.scrubHarRequestBody = exports.buildOriginScopedApiFixtures = exports.isAppOriginRequest = exports.resolveApiAuthHeaders = exports.parseApiAuthHeaders = void 0;
     exports.executeTestViaNativePlaywright = executeTestViaNativePlaywright2;
+    exports.buildNativePlaywrightChildEnv = buildNativePlaywrightChildEnv;
     exports.parseJsonResults = parseJsonResults2;
     exports.parseHarToApiSummary = parseHarToApiSummary;
     var promises_1 = __require("fs/promises");
@@ -76225,6 +76715,7 @@ var require_playwright_native = __commonJS({
     var api_call_redaction_js_1 = require_api_call_redaction();
     var har_stream_js_1 = require_har_stream();
     var api_auth_headers_js_1 = require_api_auth_headers();
+    var run_callback_proxy_js_1 = require_run_callback_proxy();
     var api_auth_headers_js_2 = require_api_auth_headers();
     Object.defineProperty(exports, "parseApiAuthHeaders", { enumerable: true, get: function() {
       return api_auth_headers_js_2.parseApiAuthHeaders;
@@ -76247,7 +76738,7 @@ var require_playwright_native = __commonJS({
     var RUNS_DIR = process.env.RUNS_DIR || (0, path_1.join)(PACKAGE_DIR, ".qa-runs");
     var PW_CLI = __require.resolve("@playwright/test/cli");
     async function executeTestViaNativePlaywright2(options) {
-      const { playwrightCode, baseUrl, testName, testVariables, storageStatePath, extraHttpHeaders, validateContext, liveBrowserHandle, onLiveBrowserSnapshot } = options;
+      const { playwrightCode, baseUrl, testName, testVariables, authStateCapturePath, storageStatePath, extraHttpHeaders, authStandingMode, validateContext, liveBrowserHandle, onLiveBrowserSnapshot } = options;
       const logs2 = [];
       const screenshots = [];
       logs2.push(`\u{1F3AD} Native Playwright starting`);
@@ -76257,15 +76748,19 @@ var require_playwright_native = __commonJS({
         logs2.push("\u26A0\uFE0F WARNING: baseUrl is empty - test will likely fail with navigation errors");
       }
       let runDir = null;
+      let standingNeedleMatcher = null;
+      let callbackProxy;
       try {
         runDir = (0, path_1.join)(RUNS_DIR, (0, crypto_1.randomUUID)());
         await (0, promises_1.mkdir)(runDir, { recursive: true });
         const isApiTest2 = playwrightCode.includes("@api") || playwrightCode.includes("{ request }") && !playwrightCode.includes("{ page");
+        const effectiveStandingMode = isApiTest2 ? authStandingMode ?? "legacy-if-configured" : "none";
         const resolvedExtraHeaders = (0, api_auth_headers_js_1.resolveApiAuthHeaders)({
           explicit: extraHttpHeaders,
-          isApiTest: isApiTest2,
+          standingHeadersMode: effectiveStandingMode,
           apiAuthHeadersVar: testVariables?.API_AUTH_HEADERS
         });
+        standingNeedleMatcher = (0, shared_1.buildNeedleMatcher)(resolvedExtraHeaders ? Object.values(resolvedExtraHeaders) : []);
         const cssDisableSetup = `
 const __qaLiveBrowserStateFile = process.env.VALIDATE_LIVE_BROWSER_STATE_PATH;
 let __qaLiveBrowserInterval: ReturnType<typeof setInterval> | null = null;
@@ -76460,6 +76955,18 @@ test.afterEach(async ({ page }, testInfo) => {
           logs2.push("\u26A0 Could not find @playwright/test import - animation disabling NOT injected");
         }
         const useScopedApiHeaders = isApiTest2 && !!resolvedExtraHeaders && !!importMatch && !!baseUrl;
+        const authDelivery = { standingHeadersConfigured: !!resolvedExtraHeaders, standingHeadersInjected: useScopedApiHeaders };
+        if (resolvedExtraHeaders && !useScopedApiHeaders) {
+          logs2.push("\u26A0 Standing API auth headers were configured but could not be installed origin-scoped \u2014 failing closed (no global fallback).");
+          return {
+            passed: false,
+            stepResults: [],
+            screenshots: [],
+            logs: logs2.join("\n"),
+            error: 'CONFIG_ISSUE: Standing API auth headers were configured but could not be installed origin-scoped (needs a rewritable `import { test } from "@playwright/test"` and BASE_URL); refusing to attach them globally to avoid an off-origin credential leak.',
+            authDelivery
+          };
+        }
         let instrumentedCode;
         if (isApiTest2) {
           instrumentedCode = useScopedApiHeaders ? playwrightCode.replace(importMatch[0], importMatch[0].replace(/from\s+['"]@playwright\/test['"]/, "from './qa-api-fixtures'")) : playwrightCode;
@@ -76483,7 +76990,7 @@ test.afterEach(async ({ page }, testInfo) => {
         const absHarPath = wantHar ? (0, path_1.join)(runDir, "session.har").replace(/\\/g, "/") : null;
         const recordHarLine = absHarPath ? `recordHar: { path: ${JSON.stringify(absHarPath)}, mode: 'full' },` : "";
         const storageStateLine = storageStatePath ? `storageState: ${JSON.stringify(storageStatePath.replace(/\\/g, "/"))},` : "";
-        const extraHeadersLine = resolvedExtraHeaders && !useScopedApiHeaders && Object.keys(resolvedExtraHeaders).length > 0 ? `extraHTTPHeaders: ${JSON.stringify(resolvedExtraHeaders)},` : "";
+        const extraHeadersLine = "";
         const launchArgs = IS_CLOUD2 ? "args: ['--no-sandbox', '--disable-setuid-sandbox', '--disable-blink-features=AutomationControlled', '--disable-dev-shm-usage', '--disable-gpu', '--disable-software-rasterizer', '--no-zygote', '--disable-accelerated-2d-canvas', '--js-flags=--max-old-space-size=512']," : "args: ['--disable-blink-features=AutomationControlled'],";
         const config = `
 // Plain object export - no require('@playwright/test') needed.
@@ -76516,35 +77023,51 @@ module.exports = {
         const configPath = (0, path_1.join)(runDir, "playwright.config.js");
         await (0, promises_1.writeFile)(configPath, config);
         const isolation = await (0, chromium_isolation_js_1.createChromiumIsolation)(runDir);
-        const envWithIsolation = {
-          ...testVariables ?? {},
+        const processClaimEpoch = Number(process.env.CLAIM_EPOCH);
+        const callbackClaimEpoch = Number.isSafeInteger(validateContext?.claimEpoch) ? validateContext?.claimEpoch : Number.isSafeInteger(processClaimEpoch) && processClaimEpoch >= 0 ? processClaimEpoch : void 0;
+        if (validateContext?.runId && validateContext.serverUrl && validateContext.authHeader) {
+          try {
+            callbackProxy = await (0, run_callback_proxy_js_1.startRunCallbackProxy)({
+              runId: validateContext.runId,
+              serverUrl: validateContext.serverUrl,
+              upstreamAuthHeader: validateContext.authHeader,
+              taskArn: process.env.VALIDATE_TASK_ARN,
+              claimEpoch: callbackClaimEpoch,
+              authConfigHash: process.env.VALIDATE_AUTH_CONFIG_HASH
+            });
+          } catch (error3) {
+            logs2.push(`Callback proxy unavailable: ${error3 instanceof Error ? error3.message : String(error3)}`);
+          }
+        }
+        const childTestVariables = { ...testVariables ?? {} };
+        const trustedRuntimeEnv = {
           ...isolation.env,
-          // persistCredential() callback envs — set only when the runner supplied
-          // validateContext. Without these the helper inside the test no-ops with
-          // a warning, which is the correct behavior when the test is being run
-          // manually (outside the validate.qa harness).
-          ...validateContext?.runId ? { VALIDATE_RUN_ID: validateContext.runId } : {},
-          ...validateContext?.serverUrl ? { VALIDATE_SERVER_URL: validateContext.serverUrl } : {},
-          ...validateContext?.authHeader ? { VALIDATE_RUNNER_AUTH: validateContext.authHeader } : {},
+          // Generated callbacks receive only a random loopback capability. The global
+          // runner bearer token and real control-plane URL stay in the parent process.
+          ...callbackProxy && validateContext?.runId ? {
+            VALIDATE_RUN_ID: validateContext.runId,
+            ...callbackClaimEpoch !== void 0 ? { VALIDATE_CLAIM_EPOCH: String(callbackClaimEpoch) } : {},
+            VALIDATE_SERVER_URL: callbackProxy.serverUrl,
+            VALIDATE_RUNNER_AUTH: callbackProxy.authHeader
+          } : {},
           // Owning Fargate taskArn (a per-task constant set once at task boot in
           // execute-one.ts; absent on the local/Railway runner). Read from
           // process.env rather than validateContext since it's process-wide, not
           // per-run. Lets persistCredential() prove ownership to /credential.
           ...process.env.VALIDATE_TASK_ARN ? { VALIDATE_TASK_ARN: process.env.VALIDATE_TASK_ARN } : {},
+          ...authStateCapturePath ? { AUTH_FILE: authStateCapturePath } : {},
           ...liveBrowserStatePath ? { VALIDATE_LIVE_BROWSER_STATE_PATH: liveBrowserStatePath } : {},
-          // Shared-auth kill-switch (SHARED_AUTH_INJECT) must reach the child: the stamped
-          // __vqaLogin's early-publish POST is gated on it at RUNTIME. buildSandboxedEnv only
-          // copies an allowlist from process.env (SHARED_AUTH_INJECT is not on it), so without
-          // this forward the flag reads as undefined in the test and the early publish is dead
-          // code. Forwarded (not allowlisted) so it stays a per-run toggle; absent → inert.
+          // Preserve an explicit shared-auth kill-switch in the child. Unset defaults on in
+          // both parent and generated __vqaLogin code; "false" must still cross this process
+          // boundary to disable the early publish POST. It remains a per-run toggle.
           ...process.env.SHARED_AUTH_INJECT ? { SHARED_AUTH_INJECT: process.env.SHARED_AUTH_INJECT } : {}
         };
-        delete envWithIsolation.API_AUTH_HEADERS;
+        delete childTestVariables.API_AUTH_HEADERS;
         logs2.push("\u{1F680} Spawning playwright test...");
         const stopLiveBrowserPolling = liveBrowserStatePath && liveBrowserHandle ? startLiveBrowserStatePolling(liveBrowserStatePath, liveBrowserHandle, onLiveBrowserSnapshot) : null;
         let playResult;
         try {
-          playResult = await runPlaywright(configPath, envWithIsolation);
+          playResult = await runPlaywright(configPath, childTestVariables, trustedRuntimeEnv);
         } finally {
           await stopLiveBrowserPolling?.();
         }
@@ -76605,7 +77128,7 @@ ${passed ? "\u2705" : "\u274C"} Test ${passed ? "PASSED" : "FAILED"}${error2 ? `
             logs2.push(`\u26A0 HAR parse skipped: ${msg.slice(0, 200)}`);
           }
         }
-        return {
+        const nativeResult = {
           passed,
           stepResults,
           screenshots,
@@ -76614,20 +77137,27 @@ ${passed ? "\u2705" : "\u274C"} Test ${passed ? "PASSED" : "FAILED"}${error2 ? `
           harApiCalls,
           logs: logs2.join("\n"),
           error: passed ? void 0 : error2,
-          suspiciousPass
+          suspiciousPass,
+          authDelivery
         };
+        if (!standingNeedleMatcher)
+          return nativeResult;
+        return (0, shared_1.redactNeedlesDeep)(nativeResult, standingNeedleMatcher);
       } catch (fatalErr) {
         const msg = fatalErr instanceof Error ? fatalErr.message : String(fatalErr);
         logs2.push(`
 \u{1F4A5} Fatal error: ${msg}`);
-        return {
+        const fatalResult = {
           passed: false,
           stepResults: [],
           screenshots,
           logs: logs2.join("\n"),
           error: msg
         };
+        return standingNeedleMatcher ? (0, shared_1.redactNeedlesDeep)(fatalResult, standingNeedleMatcher) : fatalResult;
       } finally {
+        await callbackProxy?.close().catch(() => {
+        });
         if (runDir) {
           await (0, promises_1.rm)(runDir, { recursive: true, force: true }).catch(() => {
           });
@@ -76679,9 +77209,9 @@ ${passed ? "\u2705" : "\u274C"} Test ${passed ? "PASSED" : "FAILED"}${error2 ? `
         stopped = true;
       };
     }
-    function runPlaywright(configPath, extraEnv) {
+    function runPlaywright(configPath, testVariables, trustedRuntimeEnv) {
       return new Promise((resolvePromise) => {
-        const sandboxedEnv = (0, shared_1.buildSandboxedEnv)(process.env, extraEnv);
+        const sandboxedEnv = buildNativePlaywrightChildEnv(process.env, testVariables, trustedRuntimeEnv);
         const proc = (0, spawn_with_tree_kill_js_1.spawnDetachedGroup)(process.execPath, [PW_CLI, "test", "--config", configPath], {
           cwd: PACKAGE_DIR,
           env: sandboxedEnv,
@@ -76724,6 +77254,12 @@ ${passed ? "\u2705" : "\u274C"} Test ${passed ? "PASSED" : "FAILED"}${error2 ? `
         });
       });
     }
+    function buildNativePlaywrightChildEnv(processEnv, testVariables, trustedRuntimeEnv) {
+      return {
+        ...(0, shared_1.buildSandboxedEnv)(processEnv, testVariables),
+        ...trustedRuntimeEnv ?? {}
+      };
+    }
     async function collectScreenshots(dir, screenshots) {
       let entries;
       try {
@@ -80445,10 +80981,12 @@ var require_auth_recipe = __commonJS({
     exports.upsertAuthBlock = upsertAuthBlock;
     exports.buildHealAuthStamp = buildHealAuthStamp;
     var crypto_1 = __require("crypto");
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var discovery_lint_flags_js_1 = require_discovery_lint_flags();
-    exports.AUTH_MARKER_VERSION = "v1";
+    exports.AUTH_MARKER_VERSION = "v3";
     var START_MARKER = `// >>> VALIDATE_QA_AUTH ${exports.AUTH_MARKER_VERSION} \u2014 generated, do not edit >>>`;
     var END_MARKER = `// <<< VALIDATE_QA_AUTH ${exports.AUTH_MARKER_VERSION} <<<`;
+    var SHARED_AUTH_RUNTIME_ENABLED = `!/^false$/i.test((process.env.SHARED_AUTH_INJECT ?? '').trim())`;
     var AUTH_REGION_RE = /\/\/ >>> VALIDATE_QA_AUTH[^\n]*\r?\n[\s\S]*?\/\/ <<< VALIDATE_QA_AUTH[^\n]*\r?\n?/g;
     function computeRecipeHash(input) {
       const canonical = JSON.stringify({
@@ -80526,16 +81064,18 @@ var require_auth_recipe = __commonJS({
       if (opts?.warmGuard) {
         const warmLanding = recipe.redirectRoute ?? (recipe.authProof.kind === "url" ? recipe.authProof.route : recipe.preNavRoute);
         const loginRoute = recipe.route ?? recipe.preNavRoute;
-        lines.push(`  await page.goto(${JSON.stringify(warmLanding)}, { waitUntil: 'domcontentloaded' }).catch(() => {});`);
+        lines.push(`  if (${SHARED_AUTH_RUNTIME_ENABLED}) {`);
+        lines.push(`    await page.goto(${JSON.stringify(warmLanding)}, { waitUntil: 'domcontentloaded' }).catch(() => {});`);
         if (recipe.authProof.kind === "url") {
           const pred = urlProofPredicateExpr(recipe.authProof.route);
-          lines.push(`  await page.waitForURL((u) => !(${pred})(u), { timeout: 2000 }).catch(() => {});`);
-          lines.push(`  if ((${pred})(new URL(page.url())) && !(await page.locator('input[type="password"]').first().isVisible().catch(() => false))) return;`);
+          lines.push(`    await page.waitForURL((u) => !(${pred})(u), { timeout: 2000 }).catch(() => {});`);
+          lines.push(`    if ((${pred})(new URL(page.url())) && !(await page.locator('input[type="password"]').first().isVisible().catch(() => false))) return;`);
         } else if (loginRoute) {
-          lines.push(`  if (await ${authProofLocator(recipe.authProof)}.isVisible().catch(() => false) && new URL(page.url()).pathname !== new URL(${JSON.stringify(loginRoute)}, page.url()).pathname) return;`);
+          lines.push(`    if (await ${authProofLocator(recipe.authProof)}.isVisible().catch(() => false) && new URL(page.url()).pathname !== new URL(${JSON.stringify(loginRoute)}, page.url()).pathname) return;`);
         } else {
-          lines.push(`  if (await ${authProofLocator(recipe.authProof)}.isVisible().catch(() => false)) return;`);
+          lines.push(`    if (await ${authProofLocator(recipe.authProof)}.isVisible().catch(() => false)) return;`);
         }
+        lines.push(`  }`);
       }
       lines.push(`  await page.goto(${JSON.stringify(recipe.preNavRoute)}, { waitUntil: 'domcontentloaded' });`);
       for (const cmd of recipe.preNavCmds)
@@ -80548,11 +81088,11 @@ var require_auth_recipe = __commonJS({
       lines.push(renderAuthUrlWaitLine(recipe.redirectRoute));
       lines.push(`  ${renderAuthProofAssertion(recipe.authProof)}`);
       if (opts?.warmGuard) {
-        lines.push(`  if (process.env.AUTH_FILE) await page.context().storageState({ path: process.env.AUTH_FILE });`);
-        lines.push(`  if (process.env.SHARED_AUTH_INJECT === 'true' && process.env.VALIDATE_TASK_ARN && process.env.VALIDATE_SERVER_URL && process.env.VALIDATE_RUN_ID) {`);
+        lines.push(`  if (${SHARED_AUTH_RUNTIME_ENABLED} && process.env.AUTH_FILE) await page.context().storageState({ path: process.env.AUTH_FILE });`);
+        lines.push(`  if (${SHARED_AUTH_RUNTIME_ENABLED} && process.env.VALIDATE_TASK_ARN && process.env.VALIDATE_CLAIM_EPOCH && process.env.VALIDATE_SERVER_URL && process.env.VALIDATE_RUN_ID) {`);
         lines.push(`    try {`);
         lines.push(`      const __vqaState = await page.context().storageState();`);
-        lines.push(`      await page.request.post(process.env.VALIDATE_SERVER_URL + '/api/runner/runs/' + process.env.VALIDATE_RUN_ID + '/auth-state', { headers: { Authorization: process.env.VALIDATE_RUNNER_AUTH || '' }, data: { storageState: JSON.stringify(__vqaState), taskArn: process.env.VALIDATE_TASK_ARN }, timeout: 10000 });`);
+        lines.push(`      await page.request.post(process.env.VALIDATE_SERVER_URL + '/api/runner/runs/' + process.env.VALIDATE_RUN_ID + '/auth-state', { headers: { Authorization: process.env.VALIDATE_RUNNER_AUTH || '' }, data: { storageState: JSON.stringify(__vqaState), taskArn: process.env.VALIDATE_TASK_ARN, claimEpoch: Number(process.env.VALIDATE_CLAIM_EPOCH) }, timeout: 10000 });`);
         lines.push(`    } catch {}`);
         lines.push(`  }`);
       }
@@ -80564,6 +81104,8 @@ var require_auth_recipe = __commonJS({
       "AUTH_FILE",
       "SHARED_AUTH_INJECT",
       "VALIDATE_RUN_ID",
+      "VALIDATE_CLAIM_EPOCH",
+      "VALIDATE_AUTH_CONFIG_HASH",
       "VALIDATE_TASK_ARN",
       "VALIDATE_RUNNER_AUTH",
       "VALIDATE_SERVER_URL"
@@ -80736,7 +81278,7 @@ ${tail}`;
         let result = stripAuthRegions(code);
         result = result.replace(/^[ \t]*await[ \t]+__vqaLogin[ \t]*\([ \t]*page[ \t]*\)[ \t]*;?[ \t]*\r?\n/gm, "");
         result = ensureExpectImported(result);
-        const warmGuard = process.env.SHARED_AUTH_INJECT === "true";
+        const warmGuard = (0, shared_1.isSharedAuthInjectEnabled)();
         result = insertAfterPwImport(result, renderAuthFn(ctx.recipe, { warmGuard }));
         result = ensureLoginCall(result);
         const n = countAuthRegions(result);
@@ -85716,7 +86258,7 @@ ${elementContext}${formContext}${observationContext}${interactionContext}${lowCo
       }
       return result;
     }
-    function escapeRegExp(value) {
+    function escapeRegExp2(value) {
       return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     }
     function buildSensitiveEnvReplacements(testVariables) {
@@ -85738,7 +86280,7 @@ ${elementContext}${formContext}${observationContext}${interactionContext}${lowCo
       for (const replacement of buildSensitiveEnvReplacements(testVariables)) {
         if (replacement.value.includes("\n") || replacement.value.includes("\r"))
           continue;
-        const literalPattern = new RegExp(`(['"\`])${escapeRegExp(replacement.value)}\\1`, "g");
+        const literalPattern = new RegExp(`(['"\`])${escapeRegExp2(replacement.value)}\\1`, "g");
         result = result.replace(literalPattern, replacement.envRef);
       }
       return result;
@@ -85866,9 +86408,9 @@ ${testOpen}`;
           basePath: options?.basePath
         });
         const leakedSensitiveKeys = findSensitiveLiteralLeaks(playwrightCode, options?.sensitiveEnvMap);
-        const authGuardStamped = !!options?.authRecipe && rawTags.includes("@needs-auth") && !rawTags.includes("@auth") && process.env.SHARED_AUTH_INJECT === "true";
-        const baseTags = ensureDiscoveredTag(Array.isArray(test.tags) ? test.tags : ["@discovered", "@regression"]);
-        const tags = authGuardStamped && !baseTags.includes("@auth-guarded") ? [...baseTags, "@auth-guarded"] : baseTags;
+        const authGuardStamped = !!options?.authRecipe && rawTags.includes("@needs-auth") && !rawTags.includes("@auth") && (0, shared_1.isSharedAuthInjectEnabled)() && /\/\/ >>> VALIDATE_QA_AUTH v\d+\b[\s\S]*?process\.env\.AUTH_FILE[\s\S]*?\/\/ <<< VALIDATE_QA_AUTH v\d+\b/.test(playwrightCode);
+        const baseTags = ensureDiscoveredTag(Array.isArray(test.tags) ? test.tags : ["@discovered", "@regression"]).filter((tag) => tag !== "@auth-guarded");
+        const tags = authGuardStamped ? [...baseTags, "@auth-guarded"] : baseTags;
         return {
           name: String(test.name || "Unnamed test").slice(0, 200),
           description: String(test.description || test.name || "").slice(0, 500),
@@ -99683,7 +100225,7 @@ ${lanes.join("\n")}
               return process.memoryUsage().heapUsed;
             },
             getFileSize(path) {
-              const stat = statSync2(path);
+              const stat = statSync(path);
               if (stat == null ? void 0 : stat.isFile()) {
                 return stat.size;
               }
@@ -99727,7 +100269,7 @@ ${lanes.join("\n")}
             }
           };
           return nodeSystem;
-          function statSync2(path) {
+          function statSync(path) {
             try {
               return _fs.statSync(path, statSyncOptions);
             } catch {
@@ -99786,7 +100328,7 @@ ${lanes.join("\n")}
               activeSession.post("Profiler.stop", (err, { profile }) => {
                 var _a;
                 if (!err) {
-                  if ((_a = statSync2(profilePath)) == null ? void 0 : _a.isDirectory()) {
+                  if ((_a = statSync(profilePath)) == null ? void 0 : _a.isDirectory()) {
                     profilePath = _path.join(profilePath, `${(/* @__PURE__ */ new Date()).toISOString().replace(/:/g, "-")}+P${process.pid}.cpuprofile`);
                   }
                   try {
@@ -99906,7 +100448,7 @@ ${lanes.join("\n")}
                 let stat;
                 if (typeof dirent === "string" || dirent.isSymbolicLink()) {
                   const name = combinePaths(path, entry);
-                  stat = statSync2(name);
+                  stat = statSync(name);
                   if (!stat) {
                     continue;
                   }
@@ -99930,7 +100472,7 @@ ${lanes.join("\n")}
             return matchFiles(path, extensions, excludes, includes, useCaseSensitiveFileNames2, process.cwd(), depth, getAccessibleFileSystemEntries, realpath);
           }
           function fileSystemEntryExists(path, entryKind) {
-            const stat = statSync2(path);
+            const stat = statSync(path);
             if (!stat) {
               return false;
             }
@@ -99972,7 +100514,7 @@ ${lanes.join("\n")}
           }
           function getModifiedTime3(path) {
             var _a;
-            return (_a = statSync2(path)) == null ? void 0 : _a.mtime;
+            return (_a = statSync(path)) == null ? void 0 : _a.mtime;
           }
           function setModifiedTime(path, time) {
             try {
@@ -254994,7 +255536,7 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
             }
           }
           return result;
-          function escapeRegExp(str) {
+          function escapeRegExp2(str) {
             return str.replace(/[-[\]/{}()*+?.\\^$|]/g, "\\$&");
           }
           function getTodoCommentsRegExp() {
@@ -255002,7 +255544,7 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
             const multiLineCommentStart = /(?:\/\*+\s*)/.source;
             const anyNumberOfSpacesAndAsterisksAtStartOfLine = /(?:^(?:\s|\*)*)/.source;
             const preamble = "(" + anyNumberOfSpacesAndAsterisksAtStartOfLine + "|" + singleLineCommentStart + "|" + multiLineCommentStart + ")";
-            const literals = "(?:" + map2(descriptors, (d) => "(" + escapeRegExp(d.text) + ")").join("|") + ")";
+            const literals = "(?:" + map2(descriptors, (d) => "(" + escapeRegExp2(d.text) + ")").join("|") + ")";
             const endOfLineOrEndOfComment = /(?:$|\*\/)/.source;
             const messageRemainder = /(?:.*?)/.source;
             const messagePortion = "(" + literals + messageRemainder + ")";
@@ -303262,7 +303804,7 @@ ${(verifyResult.logs ?? "").slice(0, 2e3)}`;
         confidence: "low"
       };
     }
-    function escapeRegExp(s) {
+    function escapeRegExp2(s) {
       return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     }
     function tryDeterministicStrictModeFix(code, error2) {
@@ -303285,10 +303827,10 @@ ${(verifyResult.logs ?? "").slice(0, 2e3)}`;
       const [, , role, , name, restOfOptions] = violated;
       if (/exact\s*:\s*true/.test(restOfOptions))
         return null;
-      const akaPattern = new RegExp(`aka\\s+getByRole\\(\\s*(['"\`])${escapeRegExp(role)}\\1\\s*,\\s*\\{[^}]*?name:\\s*(['"\`])${escapeRegExp(name)}\\2[^}]*?exact:\\s*true[^}]*\\}\\s*\\)`);
+      const akaPattern = new RegExp(`aka\\s+getByRole\\(\\s*(['"\`])${escapeRegExp2(role)}\\1\\s*,\\s*\\{[^}]*?name:\\s*(['"\`])${escapeRegExp2(name)}\\2[^}]*?exact:\\s*true[^}]*\\}\\s*\\)`);
       if (!akaPattern.test(error2))
         return null;
-      const codePattern = new RegExp(`(getByRole\\(\\s*(['"\`])${escapeRegExp(role)}\\2\\s*,\\s*\\{[^}]*?name:\\s*(['"\`])${escapeRegExp(name)}\\3)([^}]*\\})`, "g");
+      const codePattern = new RegExp(`(getByRole\\(\\s*(['"\`])${escapeRegExp2(role)}\\2\\s*,\\s*\\{[^}]*?name:\\s*(['"\`])${escapeRegExp2(name)}\\3)([^}]*\\})`, "g");
       let modified = false;
       const patched = code.replace(codePattern, (full, prefix, _q1, _q2, suffix) => {
         if (/exact\s*:\s*true/.test(suffix))
@@ -303305,11 +303847,11 @@ ${(verifyResult.logs ?? "").slice(0, 2e3)}`;
       const [, , text, optionsBlock] = violated;
       if (optionsBlock && /exact\s*:\s*true/.test(optionsBlock))
         return null;
-      const akaPattern = new RegExp(`aka\\s+getByText\\(\\s*(['"\`])${escapeRegExp(text)}\\1\\s*,\\s*\\{[^}]*?exact:\\s*true[^}]*\\}\\s*\\)`);
+      const akaPattern = new RegExp(`aka\\s+getByText\\(\\s*(['"\`])${escapeRegExp2(text)}\\1\\s*,\\s*\\{[^}]*?exact:\\s*true[^}]*\\}\\s*\\)`);
       if (!akaPattern.test(error2))
         return null;
-      const noOptsPattern = new RegExp(`getByText\\(\\s*(['"\`])${escapeRegExp(text)}\\1\\s*\\)`, "g");
-      const withOptsPattern = new RegExp(`(getByText\\(\\s*(['"\`])${escapeRegExp(text)}\\2\\s*,\\s*\\{)([^}]*\\})`, "g");
+      const noOptsPattern = new RegExp(`getByText\\(\\s*(['"\`])${escapeRegExp2(text)}\\1\\s*\\)`, "g");
+      const withOptsPattern = new RegExp(`(getByText\\(\\s*(['"\`])${escapeRegExp2(text)}\\2\\s*,\\s*\\{)([^}]*\\})`, "g");
       let modified = false;
       let patched = code.replace(noOptsPattern, (_full, q) => {
         modified = true;
@@ -308483,6 +309025,7 @@ var require_regression_runner = __commonJS({
     var chromium_isolation_js_1 = require_chromium_isolation();
     var browser_config_js_1 = require_browser_config();
     var spawn_with_tree_kill_js_1 = require_spawn_with_tree_kill();
+    var run_callback_proxy_js_1 = require_run_callback_proxy();
     var SUITE_SPAWN_TIMEOUT_MS = 85 * 60 * 1e3;
     var PACKAGE_DIR = (0, path_1.resolve)(__dirname, "..", "..");
     var RUNS_DIR = process.env.RUNS_DIR || (0, path_1.join)(PACKAGE_DIR, ".qa-runs");
@@ -308497,6 +309040,7 @@ var require_regression_runner = __commonJS({
       const tarPath = (0, path_1.join)(RUNS_DIR, `regression-${runId}.tar.gz`);
       const startTime = Date.now();
       let logs2 = "";
+      let callbackProxy;
       try {
         await (0, promises_1.mkdir)(extractDir, { recursive: true });
         const tarballUrl = `https://api.github.com/repos/${repoOwner}/${repoName}/tarball/${repoBranch}`;
@@ -308526,19 +309070,40 @@ var require_regression_runner = __commonJS({
         await (0, promises_1.writeFile)((0, path_1.join)(extractDir, ".env"), envContent, "utf-8");
         const jsonResultsPath = (0, path_1.join)(extractDir, "test-results", "results.json");
         const isolation = await (0, chromium_isolation_js_1.createChromiumIsolation)(extractDir);
+        const processClaimEpoch = Number(process.env.CLAIM_EPOCH);
+        const callbackClaimEpoch = Number.isSafeInteger(opts.claimEpoch) ? opts.claimEpoch : Number.isSafeInteger(processClaimEpoch) && processClaimEpoch >= 0 ? processClaimEpoch : void 0;
+        if (opts.validateServerUrl && opts.validateRunnerAuthHeader) {
+          try {
+            callbackProxy = await (0, run_callback_proxy_js_1.startRunCallbackProxy)({
+              runId,
+              serverUrl: opts.validateServerUrl,
+              upstreamAuthHeader: opts.validateRunnerAuthHeader,
+              taskArn: process.env.VALIDATE_TASK_ARN,
+              claimEpoch: callbackClaimEpoch,
+              authConfigHash: process.env.VALIDATE_AUTH_CONFIG_HASH
+            });
+          } catch (error2) {
+            logs2 += `Callback proxy unavailable: ${error2 instanceof Error ? error2.message : String(error2)}
+`;
+          }
+        }
         const runEnv = {
           ...(0, shared_1.buildSandboxedEnv)(process.env, testVariables),
           ...isolation.env,
           CI: "true",
           PLAYWRIGHT_JSON_OUTPUT_NAME: jsonResultsPath,
-          // Callback envs for tests/setup/credentials.ts → persistCredential.
-          // Tests that rotate a credential POST back to the server using these.
-          VALIDATE_RUN_ID: runId,
-          ...opts.validateServerUrl ? { VALIDATE_SERVER_URL: opts.validateServerUrl } : {},
-          ...opts.validateRunnerAuthHeader ? { VALIDATE_RUNNER_AUTH: opts.validateRunnerAuthHeader } : {},
+          // The suite receives a random run-scoped loopback callback, never the
+          // global runner bearer credential.
+          ...callbackProxy ? {
+            VALIDATE_RUN_ID: runId,
+            ...callbackClaimEpoch !== void 0 ? { VALIDATE_CLAIM_EPOCH: String(callbackClaimEpoch) } : {},
+            VALIDATE_SERVER_URL: callbackProxy.serverUrl,
+            VALIDATE_RUNNER_AUTH: callbackProxy.authHeader
+          } : {},
           // Owning Fargate taskArn (per-task constant; unset off-Fargate). Forwarded
           // so persistCredential() can prove ownership to the /credential fence.
-          ...process.env.VALIDATE_TASK_ARN ? { VALIDATE_TASK_ARN: process.env.VALIDATE_TASK_ARN } : {}
+          ...process.env.VALIDATE_TASK_ARN ? { VALIDATE_TASK_ARN: process.env.VALIDATE_TASK_ARN } : {},
+          ...process.env.SHARED_AUTH_INJECT ? { SHARED_AUTH_INJECT: process.env.SHARED_AUTH_INJECT } : {}
         };
         logs2 += `Running playwright --project=${opts.suiteProject ?? "suite"}...
 `;
@@ -308567,6 +309132,8 @@ var require_regression_runner = __commonJS({
           error: String(err)
         };
       } finally {
+        await callbackProxy?.close().catch(() => {
+        });
         (0, promises_1.rm)(extractDir, { recursive: true, force: true }).catch(() => {
         });
         await (0, browser_config_js_1.cleanupPlaywrightTempArtifacts)().catch(() => {
@@ -321241,9 +321808,9 @@ var require_tool_ledger = __commonJS({
       const ledgerPath = (0, node_path_1.join)(runDir, "discovery-events.jsonl");
       let checkpointIndex = 0;
       let headerWritten = false;
-      const escapeRegExp = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      const escapeRegExp2 = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
       const credentialScrubbers = Array.from(credentialEnvMap.entries()).filter(([, value]) => typeof value === "string" && value.length > 0).sort((a, b) => b[1].length - a[1].length).map(([envName, value]) => ({
-        re: new RegExp(escapeRegExp(value), "g"),
+        re: new RegExp(escapeRegExp2(value), "g"),
         replacement: `[REDACTED_${envName}]`
       }));
       const scrubCredentials = (text) => {
@@ -323403,6 +323970,7 @@ Explore complete: ${exploreResult.pagesDiscovered} pages, ${exploreResult.elemen
           testBudget
         }, {
           modelOverride: ctx.planModel ?? ctx.generateModel,
+          gateModelOverride: ctx.planGateModel,
           onAICall
         });
         logs2.push(...planResult.logs);
@@ -323981,6 +324549,7 @@ Plan (reused): ${resumeSavedScenarios.length} scenarios from the paused run.`);
             testBudget: featureTestBudget
           }, {
             modelOverride: ctx.planModel ?? ctx.generateModel,
+            gateModelOverride: ctx.planGateModel,
             onAICall
           });
           logs2.push(...planResult.logs);
@@ -324810,6 +325379,455 @@ var require_resource_governor = __commonJS({
   }
 });
 
+// ../runner-core/dist/services/local-auth-state.js
+var require_local_auth_state = __commonJS({
+  "../runner-core/dist/services/local-auth-state.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.LOCAL_AUTH_STATE_LOCK_ABSOLUTE_STALE_MS = exports.LOCAL_AUTH_STATE_LOCK_STALE_MS = exports.LOCAL_AUTH_STATE_CLEANUP_INTERVAL_MS = exports.LOCAL_AUTH_STATE_WAIT_MS = exports.LOCAL_AUTH_STATE_MAX_AGE_MS = void 0;
+    exports.shouldSkipWarmAuthSetup = shouldSkipWarmAuthSetup2;
+    exports.shouldSkipDisabledAutomaticAuthSetup = shouldSkipDisabledAutomaticAuthSetup2;
+    exports.localAuthStateFingerprint = localAuthStateFingerprint;
+    exports.ensurePrivateDirectory = ensurePrivateDirectory2;
+    exports.isValidStorageState = isValidStorageState;
+    exports.isValidStorageStateJson = isValidStorageStateJson;
+    exports.isValidLocalAuthStateFile = isValidLocalAuthStateFile;
+    exports.cleanupLocalAuthStateFiles = cleanupLocalAuthStateFiles;
+    exports.cleanupExpiredLocalAuthStateFiles = cleanupExpiredLocalAuthStateFiles2;
+    exports.localAuthStatePaths = localAuthStatePaths2;
+    exports.getValidLocalAuthState = getValidLocalAuthState2;
+    exports.waitForValidLocalAuthState = waitForValidLocalAuthState;
+    exports.waitForLocalAuthStateProducer = waitForLocalAuthStateProducer2;
+    exports.promoteLocalAuthStateCapture = promoteLocalAuthStateCapture2;
+    exports.discardLocalAuthStateCapture = discardLocalAuthStateCapture2;
+    exports.acquireLocalAuthStateLock = acquireLocalAuthStateLock2;
+    exports.localAuthStateFilename = localAuthStateFilename;
+    var node_fs_1 = __require("fs");
+    var node_crypto_1 = __require("crypto");
+    var node_path_1 = __require("path");
+    var auth_recipe_js_1 = require_auth_recipe();
+    exports.LOCAL_AUTH_STATE_MAX_AGE_MS = 60 * 60 * 1e3;
+    exports.LOCAL_AUTH_STATE_WAIT_MS = 3 * 60 * 1e3;
+    exports.LOCAL_AUTH_STATE_CLEANUP_INTERVAL_MS = 15 * 60 * 1e3;
+    exports.LOCAL_AUTH_STATE_LOCK_STALE_MS = 2 * 60 * 1e3;
+    exports.LOCAL_AUTH_STATE_LOCK_ABSOLUTE_STALE_MS = 30 * 60 * 1e3;
+    function shouldSkipWarmAuthSetup2(authForceRun, sharedAuthEnabled, cacheWarm) {
+      return sharedAuthEnabled && authForceRun !== true && cacheWarm;
+    }
+    function shouldSkipDisabledAutomaticAuthSetup2(authForceRun, authVerify, sharedAuthEnabled) {
+      return !sharedAuthEnabled && authForceRun !== true && authVerify !== true;
+    }
+    function normalizeOrigin(value) {
+      try {
+        return new URL(value).origin.toLowerCase();
+      } catch {
+        return value.trim().toLowerCase();
+      }
+    }
+    function normalizeAppUrl(value) {
+      try {
+        const url = new URL(value);
+        url.hash = "";
+        return `${url.origin.toLowerCase()}${url.pathname}${url.search}`;
+      } catch {
+        return value.trim();
+      }
+    }
+    function safeSegment(value, fallback) {
+      const safe = value.replace(/[^a-zA-Z0-9_-]/g, "_").slice(0, 120);
+      return safe || fallback;
+    }
+    function stableVariables(testVariables) {
+      return Object.entries(testVariables).filter(([key]) => !(0, auth_recipe_js_1.isReservedRunnerEnvVar)(key)).sort(([a], [b]) => a.localeCompare(b));
+    }
+    function localAuthStateFingerprint(input) {
+      const payload = JSON.stringify({
+        version: 1,
+        projectId: input.projectId,
+        serverOrigin: normalizeOrigin(input.serverUrl),
+        appUrl: normalizeAppUrl(input.baseUrl),
+        testVariables: stableVariables(input.testVariables)
+      });
+      const key = input.authToken || `validate-local-auth:${input.projectId}`;
+      return (0, node_crypto_1.createHmac)("sha256", key).update(payload).digest("hex").slice(0, 24);
+    }
+    function ensurePrivateDirectory2(dir) {
+      (0, node_fs_1.mkdirSync)(dir, { recursive: true, mode: 448 });
+      try {
+        (0, node_fs_1.chmodSync)(dir, 448);
+      } catch {
+      }
+    }
+    function removeFile(path) {
+      try {
+        (0, node_fs_1.unlinkSync)(path);
+      } catch {
+      }
+    }
+    function readLockOwner(path) {
+      try {
+        const parsed = JSON.parse((0, node_fs_1.readFileSync)(path, "utf8"));
+        return typeof parsed.token === "string" && parsed.token.length > 0 && Number.isSafeInteger(parsed.pid) && (parsed.pid ?? 0) > 0 ? { token: parsed.token, pid: parsed.pid } : void 0;
+      } catch {
+        return void 0;
+      }
+    }
+    function processIsAlive(pid) {
+      try {
+        process.kill(pid, 0);
+        return true;
+      } catch (error2) {
+        return error2.code === "EPERM";
+      }
+    }
+    function staleLockCanBeReaped(path, now, staleMs) {
+      try {
+        const ageMs = now - (0, node_fs_1.statSync)(path).mtimeMs;
+        if (ageMs < staleMs)
+          return false;
+        const owner = readLockOwner(path);
+        if (owner) {
+          if (!processIsAlive(owner.pid))
+            return true;
+          return ageMs >= Math.max(staleMs * 5, exports.LOCAL_AUTH_STATE_LOCK_ABSOLUTE_STALE_MS);
+        }
+        return ageMs >= staleMs * 5;
+      } catch {
+        return false;
+      }
+    }
+    function isRecord(value) {
+      return !!value && typeof value === "object" && !Array.isArray(value);
+    }
+    function isValidStorageState(value) {
+      if (!isRecord(value))
+        return false;
+      const cookies = value.cookies;
+      const origins = value.origins;
+      if (!Array.isArray(cookies) || !Array.isArray(origins))
+        return false;
+      const cookiesValid = cookies.every((cookie) => {
+        if (!isRecord(cookie))
+          return false;
+        return typeof cookie.name === "string" && typeof cookie.value === "string" && typeof cookie.domain === "string" && typeof cookie.path === "string" && typeof cookie.expires === "number" && Number.isFinite(cookie.expires) && typeof cookie.httpOnly === "boolean" && typeof cookie.secure === "boolean" && (cookie.sameSite === "Strict" || cookie.sameSite === "Lax" || cookie.sameSite === "None");
+      });
+      if (!cookiesValid)
+        return false;
+      const originsValid = origins.every((origin) => {
+        if (!isRecord(origin) || typeof origin.origin !== "string" || !Array.isArray(origin.localStorage))
+          return false;
+        return origin.localStorage.every((entry) => isRecord(entry) && typeof entry.name === "string" && typeof entry.value === "string");
+      });
+      if (!originsValid)
+        return false;
+      return cookies.length > 0 || origins.some((origin) => origin.localStorage.length > 0);
+    }
+    function isValidStorageStateJson(value) {
+      try {
+        return isValidStorageState(JSON.parse(value));
+      } catch {
+        return false;
+      }
+    }
+    function isStorageStateShape(value) {
+      if (!value || typeof value !== "object")
+        return false;
+      return isValidStorageState(value);
+    }
+    function isValidLocalAuthStateFile(path) {
+      try {
+        return isStorageStateShape(JSON.parse((0, node_fs_1.readFileSync)(path, "utf8")));
+      } catch {
+        return false;
+      }
+    }
+    function cleanupLocalAuthStateFiles(runsDir, projectId, now = Date.now(), maxAgeMs = exports.LOCAL_AUTH_STATE_MAX_AGE_MS) {
+      ensurePrivateDirectory2(runsDir);
+      const projectSegment = safeSegment(projectId, "default");
+      const legacyName = `auth-state-${projectSegment}.json`;
+      const prefix = `auth-state-${projectSegment}-`;
+      for (const name of (0, node_fs_1.readdirSync)(runsDir)) {
+        if (name === legacyName) {
+          removeFile((0, node_path_1.join)(runsDir, name));
+          continue;
+        }
+        if (!name.startsWith(prefix))
+          continue;
+        const path = (0, node_path_1.join)(runsDir, name);
+        try {
+          if (now - (0, node_fs_1.statSync)(path).mtimeMs >= maxAgeMs) {
+            if (!name.endsWith(".lock") || staleLockCanBeReaped(path, now, maxAgeMs))
+              removeFile(path);
+          }
+        } catch {
+        }
+      }
+    }
+    function cleanupExpiredLocalAuthStateFiles2(runsDir, now = Date.now(), maxAgeMs = exports.LOCAL_AUTH_STATE_MAX_AGE_MS) {
+      ensurePrivateDirectory2(runsDir);
+      for (const name of (0, node_fs_1.readdirSync)(runsDir)) {
+        if (!name.startsWith("auth-state-"))
+          continue;
+        const path = (0, node_path_1.join)(runsDir, name);
+        try {
+          if (now - (0, node_fs_1.statSync)(path).mtimeMs >= maxAgeMs) {
+            if (!name.endsWith(".lock") || staleLockCanBeReaped(path, now, maxAgeMs))
+              removeFile(path);
+          }
+        } catch {
+        }
+      }
+    }
+    function localAuthStatePaths2(runsDir, input, runId) {
+      cleanupLocalAuthStateFiles(runsDir, input.projectId);
+      const projectSegment = safeSegment(input.projectId, "default");
+      const runSegment = safeSegment(runId, `${process.pid}`);
+      const fingerprint = localAuthStateFingerprint(input);
+      const cachePath = (0, node_path_1.join)(runsDir, `auth-state-${projectSegment}-${fingerprint}.json`);
+      return {
+        cachePath,
+        capturePath: `${cachePath}.capture-${runSegment}-${process.pid}.tmp`,
+        fingerprint,
+        lockKey: `${normalizeOrigin(input.serverUrl)}:${projectSegment}:${fingerprint}`,
+        lockPath: `${cachePath}.lock`
+      };
+    }
+    function getValidLocalAuthState2(path, now = Date.now(), maxAgeMs = exports.LOCAL_AUTH_STATE_MAX_AGE_MS) {
+      if (!(0, node_fs_1.existsSync)(path))
+        return void 0;
+      try {
+        if (now - (0, node_fs_1.statSync)(path).mtimeMs >= maxAgeMs || !isValidLocalAuthStateFile(path)) {
+          removeFile(path);
+          return void 0;
+        }
+        return path;
+      } catch {
+        return void 0;
+      }
+    }
+    async function waitForValidLocalAuthState(path, timeoutMs = exports.LOCAL_AUTH_STATE_WAIT_MS, pollMs = 100) {
+      const deadline = Date.now() + Math.max(0, timeoutMs);
+      do {
+        const valid = getValidLocalAuthState2(path);
+        if (valid)
+          return valid;
+        const remaining = deadline - Date.now();
+        if (remaining <= 0)
+          return void 0;
+        await new Promise((resolve2) => setTimeout(resolve2, Math.min(Math.max(10, pollMs), remaining)));
+      } while (true);
+    }
+    async function waitForLocalAuthStateProducer2(path, lockKey, startupGraceMs = 2e3, maxWaitMs = exports.LOCAL_AUTH_STATE_WAIT_MS, pollMs = 100, lockPath) {
+      const startedAt = Date.now();
+      const producerIsActive = () => lockTails.has(lockKey) || !!lockPath && (0, node_fs_1.existsSync)(lockPath);
+      let sawProducer = producerIsActive();
+      do {
+        const valid = getValidLocalAuthState2(path);
+        if (valid)
+          return valid;
+        const producerActive = producerIsActive();
+        if (producerActive)
+          sawProducer = true;
+        const elapsed = Date.now() - startedAt;
+        if (sawProducer && !producerActive)
+          return void 0;
+        if (!sawProducer && elapsed >= Math.max(0, startupGraceMs))
+          return void 0;
+        if (elapsed >= Math.max(0, maxWaitMs))
+          return void 0;
+        await new Promise((resolve2) => setTimeout(resolve2, Math.max(10, pollMs)));
+      } while (true);
+    }
+    function promoteLocalAuthStateCapture2(capturePath, cachePath, replaceExisting = false, lease) {
+      if (lease && !lease.isOwner()) {
+        removeFile(capturePath);
+        return false;
+      }
+      if (!(0, node_fs_1.existsSync)(capturePath) || !isValidLocalAuthStateFile(capturePath)) {
+        removeFile(capturePath);
+        return false;
+      }
+      try {
+        (0, node_fs_1.chmodSync)(capturePath, 384);
+      } catch {
+      }
+      try {
+        if (lease && !lease.isOwner()) {
+          removeFile(capturePath);
+          return false;
+        }
+        if ((0, node_fs_1.existsSync)(cachePath)) {
+          if (!replaceExisting && isValidLocalAuthStateFile(cachePath)) {
+            removeFile(capturePath);
+            return true;
+          }
+          removeFile(cachePath);
+        }
+        if (lease && !lease.isOwner()) {
+          removeFile(capturePath);
+          return false;
+        }
+        (0, node_fs_1.renameSync)(capturePath, cachePath);
+        try {
+          (0, node_fs_1.chmodSync)(cachePath, 384);
+        } catch {
+        }
+        return true;
+      } catch {
+        const winnerIsValid = (0, node_fs_1.existsSync)(cachePath) && isValidLocalAuthStateFile(cachePath);
+        removeFile(capturePath);
+        return winnerIsValid;
+      }
+    }
+    function discardLocalAuthStateCapture2(capturePath) {
+      removeFile(capturePath);
+    }
+    var lockTails = /* @__PURE__ */ new Map();
+    function publishCompleteLockOwner(lockPath, owner, linkFile) {
+      const metadata = JSON.stringify(owner);
+      const tempPath = `${lockPath}.${owner.pid}.${owner.token}.tmp`;
+      let createdLock = false;
+      try {
+        (0, node_fs_1.writeFileSync)(tempPath, metadata, { flag: "wx", mode: 384 });
+        try {
+          linkFile(tempPath, lockPath);
+          createdLock = true;
+          return (0, node_fs_1.openSync)(lockPath, "r+");
+        } catch (error2) {
+          const code = error2.code;
+          if (!["EPERM", "EACCES", "EXDEV", "ENOSYS", "ENOTSUP", "EOPNOTSUPP"].includes(code ?? "")) {
+            throw error2;
+          }
+          let fd;
+          try {
+            fd = (0, node_fs_1.openSync)(lockPath, "wx+", 384);
+            createdLock = true;
+            (0, node_fs_1.writeFileSync)(fd, metadata, { encoding: "utf8" });
+            (0, node_fs_1.fsyncSync)(fd);
+            return fd;
+          } catch (fallbackError) {
+            if (fd !== void 0) {
+              try {
+                (0, node_fs_1.closeSync)(fd);
+              } catch {
+              }
+            }
+            if (createdLock)
+              removeFile(lockPath);
+            throw fallbackError;
+          }
+        }
+      } catch (error2) {
+        if (createdLock && readLockOwner(lockPath)?.token === owner.token)
+          removeFile(lockPath);
+        throw error2;
+      } finally {
+        removeFile(tempPath);
+      }
+    }
+    async function acquireExclusiveFileLock(lockPath, linkFile = node_fs_1.linkSync) {
+      ensurePrivateDirectory2((0, node_path_1.dirname)(lockPath));
+      const startedAt = Date.now();
+      while (true) {
+        try {
+          const ownerToken = (0, node_crypto_1.randomBytes)(24).toString("base64url");
+          const fd = publishCompleteLockOwner(lockPath, { token: ownerToken, pid: process.pid }, linkFile);
+          const ownsPath = () => {
+            try {
+              const owner = readLockOwner(lockPath);
+              return owner?.token === ownerToken && owner.pid === process.pid;
+            } catch {
+              return false;
+            }
+          };
+          const heartbeat = setInterval(() => {
+            try {
+              if (!ownsPath()) {
+                clearInterval(heartbeat);
+                return;
+              }
+              const now = /* @__PURE__ */ new Date();
+              (0, node_fs_1.futimesSync)(fd, now, now);
+            } catch {
+              clearInterval(heartbeat);
+            }
+          }, Math.max(1e3, Math.floor(exports.LOCAL_AUTH_STATE_LOCK_STALE_MS / 3)));
+          heartbeat.unref();
+          let released = false;
+          const release = (() => {
+            if (released)
+              return;
+            released = true;
+            clearInterval(heartbeat);
+            try {
+              if (ownsPath())
+                removeFile(lockPath);
+            } catch {
+            }
+            try {
+              (0, node_fs_1.closeSync)(fd);
+            } catch {
+            }
+          });
+          release.isOwner = () => !released && ownsPath();
+          return release;
+        } catch (error2) {
+          const code = error2.code;
+          if (code !== "EEXIST")
+            throw error2;
+          try {
+            if (staleLockCanBeReaped(lockPath, Date.now(), exports.LOCAL_AUTH_STATE_LOCK_STALE_MS)) {
+              removeFile(lockPath);
+              continue;
+            }
+          } catch {
+            continue;
+          }
+          if (Date.now() - startedAt >= exports.LOCAL_AUTH_STATE_WAIT_MS) {
+            throw new Error(`Timed out waiting for auth-state lock: ${(0, node_path_1.basename)(lockPath)}`);
+          }
+          await new Promise((resolve2) => setTimeout(resolve2, 100));
+        }
+      }
+    }
+    async function acquireLocalAuthStateLock2(key, lockPath, linkFile = node_fs_1.linkSync) {
+      const previous = lockTails.get(key) ?? Promise.resolve();
+      let unlockCurrent;
+      const current = new Promise((resolve2) => {
+        unlockCurrent = resolve2;
+      });
+      const tail = previous.then(() => current);
+      lockTails.set(key, tail);
+      await previous;
+      let releaseFileLock;
+      try {
+        if (lockPath)
+          releaseFileLock = await acquireExclusiveFileLock(lockPath, linkFile);
+      } catch (error2) {
+        unlockCurrent();
+        if (lockTails.get(key) === tail)
+          lockTails.delete(key);
+        throw error2;
+      }
+      let released = false;
+      const release = (() => {
+        if (released)
+          return;
+        released = true;
+        releaseFileLock?.();
+        unlockCurrent();
+        if (lockTails.get(key) === tail)
+          lockTails.delete(key);
+      });
+      release.isOwner = () => !released && (releaseFileLock?.isOwner() ?? true);
+      return release;
+    }
+    function localAuthStateFilename(path) {
+      return (0, node_path_1.basename)(path);
+    }
+  }
+});
+
 // ../../node_modules/adm-zip/util/constants.js
 var require_constants5 = __commonJS({
   "../../node_modules/adm-zip/util/constants.js"(exports, module) {
@@ -325123,7 +326141,7 @@ var require_utils2 = __commonJS({
     module.exports = Utils;
     Utils.prototype.makeDir = function(folder) {
       const self = this;
-      function mkdirSync5(fpath) {
+      function mkdirSync4(fpath) {
         let resolvedPath = fpath.split(self.sep)[0];
         fpath.split(self.sep).forEach(function(name) {
           if (!name || name.substr(-1, 1) === ":") return;
@@ -325141,7 +326159,7 @@ var require_utils2 = __commonJS({
           if (stat && stat.isFile()) throw Errors.FILE_IN_THE_WAY(`"${resolvedPath}"`);
         });
       }
-      mkdirSync5(folder);
+      mkdirSync4(folder);
     };
     Utils.prototype.writeFileTo = function(path, content, overwrite, attr) {
       const self = this;
@@ -337065,6 +338083,8 @@ var require_dist2 = __commonJS({
     __exportStar(require_discover_agent(), exports);
     __exportStar(require_browser_pool(), exports);
     __exportStar(require_resource_governor(), exports);
+    __exportStar(require_local_auth_state(), exports);
+    __exportStar(require_run_callback_proxy(), exports);
     __exportStar(require_discover_explorer(), exports);
     __exportStar(require_discover_feature_explorer(), exports);
     __exportStar(require_discover_planner(), exports);
@@ -337341,7 +338361,7 @@ var require_package4 = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.42",
+      version: "1.0.44",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"
@@ -337349,7 +338369,7 @@ var require_package4 = __commonJS({
       scripts: {
         build: "tsup",
         dev: "tsx src/cli.ts",
-        test: "node --import tsx --test src/version-check.test.ts",
+        test: "node --import tsx --test src/version-check.test.ts src/services/auth-state.test.ts",
         "test:mobile": "node --import tsx --test --test-concurrency=2 src/runner.mobile-ai-env.test.ts src/mobile-device-queue.test.ts src/device-lease.test.ts src/result-payload-budget.test.ts src/services/appium-*.test.ts src/services/*mobile*.test.ts src/services/mobile/*.test.ts",
         prepublishOnly: "npm run build"
       },
@@ -337428,7 +338448,6 @@ function getConfigDir() {
 }
 
 // src/runner.ts
-import { existsSync as existsSync3, statSync, mkdirSync as mkdirSync4 } from "fs";
 import { join as join6 } from "path";
 import { homedir as homedir3 } from "os";
 import { createHash } from "crypto";
@@ -337456,26 +338475,28 @@ var import_runner_core6 = __toESM(require_dist2());
 
 // src/runner.ts
 var import_runner_core11 = __toESM(require_dist2());
+var import_runner_core12 = __toESM(require_dist2());
 
 // src/services/auth-state.ts
-var INLINE_LOGIN_TAG = "@inline-login";
+init_dist();
 var GUARDED_LOGIN_TAG = "@auth-guarded";
 function sharedAuthInjectEnabled() {
-  return process.env.SHARED_AUTH_INJECT === "true";
+  return isSharedAuthInjectEnabled();
 }
-function hasInlineLoginSteps(playwrightCode) {
+function hasGeneratedAuthGuard2(playwrightCode) {
   if (!playwrightCode) return false;
-  return /process\.env\.TEST_USER_EMAIL!?/.test(playwrightCode) && /process\.env\.TEST_USER_PASSWORD!?/.test(playwrightCode);
+  return /\/\/ >>> VALIDATE_QA_AUTH v\d+\b[\s\S]*?process\.env\.AUTH_FILE[\s\S]*?\/\/ <<< VALIDATE_QA_AUTH v\d+\b/.test(playwrightCode);
+}
+function shouldCaptureAuthState(tags, playwrightCode) {
+  return sharedAuthInjectEnabled() && Array.isArray(tags) && tags.includes("@needs-auth") && tags.includes(GUARDED_LOGIN_TAG) && !tags.includes("@auth") && hasGeneratedAuthGuard2(playwrightCode);
 }
 function shouldUseAuthState(tags, playwrightCode) {
+  if (!sharedAuthInjectEnabled()) return false;
   if (!Array.isArray(tags)) return false;
-  if (tags.includes("@auth")) return false;
-  if (tags.includes("@api")) return true;
-  if (!tags.includes("@needs-auth")) return false;
-  if (sharedAuthInjectEnabled() && tags.includes(GUARDED_LOGIN_TAG)) return true;
-  const isGeneratedVariant = tags.includes("@edge") || tags.includes("@bug");
-  const hasLegacyInlineLogin = tags.includes("@discovered") && !isGeneratedVariant && hasInlineLoginSteps(playwrightCode);
-  return !tags.includes(INLINE_LOGIN_TAG) && !hasLegacyInlineLogin;
+  return authPlanFor(tags, playwrightCode).needsCookieState;
+}
+function authPlanFor(tags, playwrightCode) {
+  return deriveAuthPlan(tags, playwrightCode, { sharedAuthInjectEnabled: sharedAuthInjectEnabled() });
 }
 
 // src/version-check.ts
@@ -344185,8 +345206,8 @@ function withMediaReferences(result, refs) {
 
 // src/runner.ts
 init_dist();
-var import_runner_core12 = __toESM(require_dist2());
 var import_runner_core13 = __toESM(require_dist2());
+var import_runner_core14 = __toESM(require_dist2());
 function fingerprintTest(test) {
   const code = test.framework === "APPIUM" ? [test.appiumCode ?? "", JSON.stringify(test.steps ?? [])].join("\n--steps--\n") : test.playwrightCode ?? "";
   return createHash("sha256").update(test.name).update("\n--suite--\n").update(test.suiteName ?? "").update("\n--type--\n").update(test.testType ?? "").update("\n--framework--\n").update(test.framework ?? "").update("\n--code--\n").update(code).digest("hex").slice(0, 24);
@@ -344310,21 +345331,11 @@ var log = {
   warn: (msg) => console.log(`${C2.yellow}\u26A0${C2.reset}  ${msg}`),
   dim: (msg) => console.log(`${C2.gray}${msg}${C2.reset}`)
 };
-var AUTH_MAX_AGE_MS = 60 * 60 * 1e3;
 function getRunsDir() {
   const dir = process.env.RUNS_DIR || join6(homedir3(), ".validate.qa", "runs");
-  if (!existsSync3(dir)) mkdirSync4(dir, { recursive: true });
+  (0, import_runner_core12.ensurePrivateDirectory)(dir);
   return dir;
 }
-function authStatePath(projectId) {
-  return join6(getRunsDir(), `auth-state-${projectId || "default"}.json`);
-}
-function getValidAuthState(projectId) {
-  const path = authStatePath(projectId);
-  if (!existsSync3(path)) return void 0;
-  const age = Date.now() - statSync(path).mtimeMs;
-  return age < AUTH_MAX_AGE_MS ? path : void 0;
-}
 function buildHeaders(authToken, projectId) {
   return {
     "Content-Type": "application/json",
@@ -344373,7 +345384,13 @@ async function claimRun(serverUrl, headers, runId) {
   if (res.status === 429) return false;
   if (!res.ok) throw new Error(`Claim failed: ${res.status}`);
   const body = await res.json();
-  return body.claimed;
+  if (!body.claimed) {
+    throw new Error("Claim response did not confirm ownership");
+  }
+  if (typeof body.claimEpoch !== "number" || !Number.isSafeInteger(body.claimEpoch) || body.claimEpoch < 0) {
+    throw new Error("Claim response did not include a valid ownership epoch");
+  }
+  return body.claimEpoch;
 }
 async function postResult(serverUrl, headers, runId, result) {
   const MAX_ATTEMPTS = 3;
@@ -344541,12 +345558,12 @@ async function postCaptureResult(serverUrl, headers, runId, result) {
   });
   if (!res.ok) throw new Error(`Failed to post capture result: ${res.status}`);
 }
-async function postCredentialRotation(serverUrl, headers, runId, body) {
+async function postCredentialRotation(serverUrl, headers, runId, body, claimEpoch) {
   try {
     const res = await fetch(`${serverUrl}/api/runner/runs/${runId}/credential`, {
       method: "POST",
       headers,
-      body: JSON.stringify(body),
+      body: JSON.stringify({ ...body, ...claimEpoch !== void 0 ? { claimEpoch } : {} }),
       signal: AbortSignal.timeout(3e4)
     });
     if (!res.ok) {
@@ -344878,11 +345895,28 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
     requestLiveBrowserHeartbeat();
   }, 5e3);
   liveBrowserHeartbeatInterval.unref?.();
+  const authPlan = authPlanFor(run2.tags, run2.playwrightCode);
+  const runAuthCachePath = (0, import_runner_core12.localAuthStatePaths)(getRunsDir(), {
+    projectId: run2.projectId || opts.projectId || "default",
+    serverUrl: opts.serverUrl,
+    baseUrl: run2.baseUrl,
+    testVariables: run2.testVariables,
+    authToken: opts.authToken
+  }, run2.runId).cachePath;
+  const wrapperStorageStatePath = authPlan.needsCookieState && runMode !== "auth-setup" ? (0, import_runner_core12.getValidLocalAuthState)(runAuthCachePath) : void 0;
   const runNativeWithLiveBrowser = (nativeOptions) => (0, import_runner_core.executeTestViaNativePlaywright)({
+    authStandingMode: authPlan.standingHeadersMode,
+    storageStatePath: wrapperStorageStatePath,
     ...nativeOptions,
     liveBrowserHandle,
     onLiveBrowserSnapshot: requestLiveBrowserHeartbeat
   });
+  const callbackContext = {
+    runId: run2.runId,
+    serverUrl: opts.serverUrl,
+    authHeader: headers.Authorization,
+    claimEpoch: run2.claimEpoch
+  };
   const startTime = Date.now();
   try {
     if (mobileLeaseError) {
@@ -344900,11 +345934,24 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
       if (!run2.baseUrl) {
         preflightError = "Pre-flight failed: Missing BASE_URL. Configure it in Test Data \u2192 Test Variables.";
       } else {
-        const needsAuth = Array.isArray(run2.tags) && run2.tags.some((t) => t === "@auth" || t === "@needs-auth" || t === "@api");
-        if (needsAuth && !run2.testVariables?.["TEST_USER_EMAIL"]) {
-          preflightError = "Pre-flight failed: Missing TEST_USER_EMAIL. Tests tagged @auth, @needs-auth, or @api require login credentials.";
-        } else if (needsAuth && !run2.testVariables?.["TEST_USER_PASSWORD"]) {
-          preflightError = "Pre-flight failed: Missing TEST_USER_PASSWORD. Tests tagged @auth, @needs-auth, or @api require login credentials.";
+        const validStanding = (0, import_runner_core13.parseApiAuthHeaders)(run2.testVariables?.["API_AUTH_HEADERS"]) !== void 0;
+        if (authPlan.configurationError) {
+          preflightError = `Pre-flight failed: ${authPlan.configurationError}. Fix the test's auth-type tag before running.`;
+        } else if (authPlan.needsStandingHeaders && !validStanding) {
+          preflightError = "Pre-flight failed: This @auth-standing @api test requires a valid API_AUTH_HEADERS JSON object (header name \u2192 value).";
+        } else {
+          const legacyHeaderBypass = authPlan.source === "legacy" && authPlan.standingHeadersMode === "legacy-if-configured" && validStanding;
+          const code = run2.playwrightCode ?? "";
+          const codeProvided = code.trim().length > 0;
+          const codeUsesCreds = codeProvided && /TEST_USER_EMAIL|TEST_USER_PASSWORD|__vqaLogin/.test(code);
+          const tags = Array.isArray(run2.tags) ? run2.tags : [];
+          const isHallucinationShape = codeProvided && !codeUsesCreds && tags.includes("@inline-login") && !tags.includes("@api");
+          const requireCreds = authPlan.needsLoginCreds && !legacyHeaderBypass && !isHallucinationShape;
+          if (requireCreds && !run2.testVariables?.["TEST_USER_EMAIL"]?.trim()) {
+            preflightError = "Pre-flight failed: Missing TEST_USER_EMAIL. Tests that log in (tagged @auth, @needs-auth, @api, @auth-cookie-state, @auth-login-cookie, or @auth-login-bearer) require login credentials.";
+          } else if (requireCreds && !run2.testVariables?.["TEST_USER_PASSWORD"]?.trim()) {
+            preflightError = "Pre-flight failed: Missing TEST_USER_PASSWORD. Tests that log in (tagged @auth, @needs-auth, @api, @auth-cookie-state, @auth-login-cookie, or @auth-login-bearer) require login credentials.";
+          }
         }
       }
       if (preflightError) {
@@ -344912,7 +345959,7 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
         log.fail(`PRE-FLIGHT FAILED - ${preflightError}`);
         return;
       }
-      const preflight = await (0, import_runner_core12.resolveBaseUrlPreflight)(run2.baseUrl);
+      const preflight = await (0, import_runner_core13.resolveBaseUrlPreflight)(run2.baseUrl);
       if (preflight.error) {
         await postResult(opts.serverUrl, headers, run2.runId, { status: "ERROR", error: preflight.error });
         log.fail(`PRE-FLIGHT FAILED - ${preflight.error}`);
@@ -344929,31 +345976,72 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
         log.fail("ERROR - No auth setup code");
         return;
       }
-      const runAuthPath = authStatePath(run2.projectId || opts.projectId || "default");
-      log.info(`Auth setup: saving session state to ${runAuthPath}`);
-      const result2 = await runNativeWithLiveBrowser({
-        playwrightCode: run2.playwrightCode,
+      const sharedAuthEnabled = sharedAuthInjectEnabled();
+      if ((0, import_runner_core12.shouldSkipDisabledAutomaticAuthSetup)(run2.authForceRun, run2.authVerify, sharedAuthEnabled)) {
+        const duration2 = Date.now() - startTime;
+        await postResult(opts.serverUrl, headers, run2.runId, {
+          status: "PASSED",
+          logs: "Automatic auth prewarm skipped: shared session reuse is disabled.",
+          duration: duration2
+        });
+        log.info(`Auth prewarm skipped (${duration2}ms) - SHARED_AUTH_INJECT=false`);
+        return;
+      }
+      const authPaths2 = sharedAuthEnabled ? (0, import_runner_core12.localAuthStatePaths)(getRunsDir(), {
+        projectId: run2.projectId || opts.projectId || "default",
+        serverUrl: opts.serverUrl,
         baseUrl: run2.baseUrl,
-        testName: "auth-setup",
-        testVariables: { ...run2.testVariables, AUTH_FILE: runAuthPath },
-        validateContext: {
-          runId: run2.runId,
-          serverUrl: opts.serverUrl,
-          authHeader: headers.Authorization
+        testVariables: run2.testVariables,
+        authToken: opts.authToken
+      }, run2.runId) : void 0;
+      const releaseAuthLock2 = authPaths2 ? await (0, import_runner_core12.acquireLocalAuthStateLock)(authPaths2.lockKey, authPaths2.lockPath) : void 0;
+      try {
+        if (authPaths2 && (0, import_runner_core12.shouldSkipWarmAuthSetup)(
+          run2.authForceRun,
+          sharedAuthEnabled,
+          !!(0, import_runner_core12.getValidLocalAuthState)(authPaths2.cachePath)
+        )) {
+          const duration3 = Date.now() - startTime;
+          await postResult(opts.serverUrl, headers, run2.runId, {
+            status: "PASSED",
+            logs: "Auth setup skipped: the credential-bound local session is already warm.",
+            duration: duration3
+          });
+          log.ok(`Auth setup skipped (${duration3}ms) - local session already warm`);
+          return;
         }
-      });
-      const duration2 = Date.now() - startTime;
-      await postResult(opts.serverUrl, headers, run2.runId, {
-        status: result2.passed ? "PASSED" : "FAILED",
-        apiCalls: result2.apiCalls,
-        logs: result2.logs,
-        error: result2.error,
-        duration: duration2
-      });
-      log[result2.passed ? "ok" : "fail"](
-        `Auth setup ${result2.passed ? "PASSED" : "FAILED"} (${duration2}ms)${result2.error ? ` - ${result2.error}` : ""}`
-      );
-      return;
+        log.info(run2.authVerify ? "Auth verification: replaying the current login recipe" : sharedAuthEnabled ? "Auth setup: capturing a credential-bound local session" : "Auth setup: running login with shared session reuse disabled");
+        const capturePath = sharedAuthEnabled && !run2.authVerify ? authPaths2?.capturePath : void 0;
+        const result2 = await runNativeWithLiveBrowser({
+          playwrightCode: run2.playwrightCode,
+          baseUrl: run2.baseUrl,
+          testName: "auth-setup",
+          testVariables: run2.testVariables,
+          authStateCapturePath: capturePath,
+          validateContext: callbackContext
+        });
+        const captured = !!capturePath && !!authPaths2 && result2.passed && !result2.suspiciousPass && (0, import_runner_core12.promoteLocalAuthStateCapture)(
+          capturePath,
+          authPaths2.cachePath,
+          run2.authForceRun === true,
+          releaseAuthLock2
+        );
+        const duration2 = Date.now() - startTime;
+        await postResult(opts.serverUrl, headers, run2.runId, {
+          status: result2.passed ? "PASSED" : "FAILED",
+          apiCalls: result2.apiCalls,
+          logs: result2.logs,
+          error: result2.error,
+          duration: duration2
+        });
+        log[result2.passed ? "ok" : "fail"](
+          `Auth setup ${result2.passed ? "PASSED" : "FAILED"} (${duration2}ms)${captured ? " - session cached" : ""}${result2.error ? ` - ${result2.error}` : ""}`
+        );
+        return;
+      } finally {
+        if (authPaths2?.capturePath) (0, import_runner_core12.discardLocalAuthStateCapture)(authPaths2.capturePath);
+        releaseAuthLock2?.();
+      }
     }
     if (runMode === "batch-heal") {
       const tests = run2.batchHealTests ?? [];
@@ -344972,7 +346060,7 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
       const batchResult = await (0, import_runner_core10.executeGrokPerBatchHeal)(tests, run2.baseUrl, {
         testVariables: run2.testVariables,
         runNativeTest: runNativeWithLiveBrowser,
-        validateContext: { runId: run2.runId, serverUrl: opts.serverUrl, authHeader: headers.Authorization },
+        validateContext: callbackContext,
         onLog: healLogStream.onLog
       });
       await healLogStream.flushNow();
@@ -345008,6 +346096,15 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
         );
         const describeKind = isSerialDescribe ? "serial" : "non-serial";
         log.info(`API test heal - ${subTestCount} sub-test(s) [${describeKind}], ${failingSubTestCount} budgeted, ${MAX_API_HEAL_ATTEMPTS} attempts`);
+        const apiHealAuthPaths = shouldUseAuthState(run2.tags, run2.playwrightCode) ? (0, import_runner_core12.localAuthStatePaths)(getRunsDir(), {
+          projectId: run2.projectId || opts.projectId,
+          serverUrl: opts.serverUrl,
+          baseUrl: run2.baseUrl,
+          testVariables: run2.testVariables,
+          authToken: opts.authToken
+        }, run2.runId) : void 0;
+        const apiHealStorageStatePath = apiHealAuthPaths ? (0, import_runner_core12.getValidLocalAuthState)(apiHealAuthPaths.cachePath) : void 0;
+        if (apiHealStorageStatePath) log.info("API heal verification is using saved auth state");
         const stickyAppBugs = /* @__PURE__ */ new Map();
         const lastChangeByTitle = /* @__PURE__ */ new Map();
         let currentError = run2.lastFailureError ?? "Test failed";
@@ -345073,7 +346170,8 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
                 playwrightCode: lastHealedCode,
                 baseUrl: run2.baseUrl,
                 testVariables: run2.testVariables,
-                validateContext: { runId: run2.runId, serverUrl: opts.serverUrl, authHeader: headers.Authorization }
+                storageStatePath: apiHealStorageStatePath,
+                validateContext: callbackContext
               });
               if (finalVerifyResult.passed) {
                 log.ok(`  Attempt ${attempt} terminal verification PASSED (${bugCount} app_bug, ${passCount} pass)`);
@@ -345093,7 +346191,9 @@ ${finalVerifyResult.logs ?? ""}`;
             finalVerifyResult = await runNativeWithLiveBrowser({
               playwrightCode: lastHealedCode,
               baseUrl: run2.baseUrl,
-              testVariables: run2.testVariables
+              testVariables: run2.testVariables,
+              storageStatePath: apiHealStorageStatePath,
+              validateContext: callbackContext
             });
             const stepResults = finalVerifyResult.stepResults ?? [];
             const nonAppBugFails = stepResults.filter(
@@ -345143,7 +346243,8 @@ ${finalVerifyResult.logs ?? ""}`;
             playwrightCode: lastHealedCode,
             baseUrl: run2.baseUrl,
             testVariables: run2.testVariables,
-            validateContext: { runId: run2.runId, serverUrl: opts.serverUrl, authHeader: headers.Authorization }
+            storageStatePath: apiHealStorageStatePath,
+            validateContext: callbackContext
           });
           if (finalVerifyResult.passed) {
             log.ok(`  Attempt ${attempt} verification PASSED`);
@@ -345196,7 +346297,7 @@ ${finalVerifyResult.logs ?? ""}`;
           if (classifyErrorMessage(composedError ?? null) === "config_issue") {
             apiHealStatus = "ERROR";
           } else {
-            const rlDetection = (0, import_runner_core12.detectRateLimitBlock)({
+            const rlDetection = (0, import_runner_core13.detectRateLimitBlock)({
               testName: run2.testName ?? run2.testCaseId ?? void 0,
               tags: run2.tags ?? [],
               error: composedError ?? finalVerifyResult?.error ?? null,
@@ -345293,8 +346394,8 @@ ${finalVerifyResult.logs ?? ""}`;
         lastHealAttempt: run2.lastHealAttempt ?? null,
         lastHealedCode: run2.lastHealedCode ?? null,
         failureScreenshot: run2.failureScreenshot ?? null,
-        onCredentialUpdate: async (input) => postCredentialRotation(opts.serverUrl, headers, run2.runId, { ...input, actor: "ai-healer" }),
-        validateContext: { runId: run2.runId, serverUrl: opts.serverUrl, authHeader: headers.Authorization },
+        onCredentialUpdate: async (input) => postCredentialRotation(opts.serverUrl, headers, run2.runId, { ...input, actor: "ai-healer" }, run2.claimEpoch),
+        validateContext: callbackContext,
         liveBrowserHandle,
         runNativeTest: runNativeWithLiveBrowser
       };
@@ -345336,7 +346437,7 @@ ${finalVerifyResult.logs ?? ""}`;
       let healStatus = result2.passed ? "PASSED" : isConfigIssue ? "ERROR" : "FAILED";
       let healError = result2.error;
       if (!result2.passed && !isConfigIssue) {
-        const rlDetection = (0, import_runner_core12.detectRateLimitBlock)({
+        const rlDetection = (0, import_runner_core13.detectRateLimitBlock)({
           testName: run2.testName ?? run2.testCaseId ?? void 0,
           tags: run2.tags ?? [],
           error: result2.error,
@@ -345407,7 +346508,8 @@ ${finalVerifyResult.logs ?? ""}`;
         // Allow generated `persistCredential(...)` calls inside the suite to
         // POST back to the server with the runner's bearer token.
         validateServerUrl: opts.serverUrl,
-        validateRunnerAuthHeader: headers.Authorization
+        validateRunnerAuthHeader: headers.Authorization,
+        claimEpoch: run2.claimEpoch
       });
       const overall = result2.error && result2.testResults.length === 0 ? "ERROR" : result2.passed ? "PASSED" : "FAILED";
       const rr = await fetch(`${opts.serverUrl}/api/runner/runs/${run2.runId}/regression-result`, {
@@ -345458,11 +346560,14 @@ ${finalVerifyResult.logs ?? ""}`;
             });
             if (healRes.ok) {
               const { healedCode } = await healRes.json();
+              const failedTestPlan = authPlanFor(failedTest.tags, healedCode);
               const verifyResult = await runNativeWithLiveBrowser({
                 playwrightCode: healedCode,
                 baseUrl: run2.baseUrl,
                 testVariables: run2.testVariables,
-                validateContext: { runId: run2.runId, serverUrl: opts.serverUrl, authHeader: headers.Authorization }
+                storageStatePath: failedTestPlan.needsCookieState ? (0, import_runner_core12.getValidLocalAuthState)(runAuthCachePath) : void 0,
+                authStandingMode: failedTestPlan.standingHeadersMode,
+                validateContext: callbackContext
               });
               results.push({
                 testCaseId: failedTest.testCaseId,
@@ -345525,8 +346630,8 @@ ${finalVerifyResult.logs ?? ""}`;
               onAICall: healAudit,
               modelOverride: run2.healerModel,
               consecutiveFails: failedTest.consecutiveFails,
-              onCredentialUpdate: async (input) => postCredentialRotation(opts.serverUrl, headers, run2.runId, { ...input, actor: "ai-healer" }),
-              validateContext: { runId: run2.runId, serverUrl: opts.serverUrl, authHeader: headers.Authorization },
+              onCredentialUpdate: async (input) => postCredentialRotation(opts.serverUrl, headers, run2.runId, { ...input, actor: "ai-healer" }, run2.claimEpoch),
+              validateContext: callbackContext,
               liveBrowserHandle,
               runNativeTest: runNativeWithLiveBrowser
             };
@@ -345731,6 +346836,13 @@ ${finalVerifyResult.logs ?? ""}`;
         }
         return;
       }
+      ctx.onCredentialUpdate = async (input) => postCredentialRotation(
+        opts.serverUrl,
+        headers,
+        run2.runId,
+        { ...input, actor: "ai-explorer" },
+        run2.claimEpoch
+      );
       log.info(`Discovery (${ctx.mode}) on ${ctx.baseUrl}`);
       const { push: pushAudit, drain: drainAudit } = createAuditFlusher(
         `${opts.serverUrl}/api/runner/runs/${run2.runId}/ai-audit-batch`,
@@ -346433,7 +347545,7 @@ ${finalVerifyResult.logs ?? ""}`;
           featureDescription: ctx.featureDescription,
           featurePages: ctx.featurePages,
           appBrief: ctx.appBrief,
-          onCredentialUpdate: async (input) => postCredentialRotation(opts.serverUrl, headers, run2.runId, { ...input, actor: "ai-capture" })
+          onCredentialUpdate: async (input) => postCredentialRotation(opts.serverUrl, headers, run2.runId, { ...input, actor: "ai-capture" }, run2.claimEpoch)
         });
         if (logBuffer.length > 0) {
           postCaptureLog(opts.serverUrl, headers, run2.runId, ctx.jobId, truncateTextTail(logBuffer.join("\n"), DISCOVERY_LOG_POST_MAX_CHARS, "capture log"));
@@ -346678,7 +347790,7 @@ ${finalVerifyResult.logs ?? ""}`;
                   }
                   return verify;
                 };
-                return await (0, import_runner_core13.executeMobileLiveHeal)({
+                return await (0, import_runner_core14.executeMobileLiveHeal)({
                   steps: a.steps,
                   target: a.target,
                   testVariables: a.testVariables,
@@ -346695,7 +347807,7 @@ ${finalVerifyResult.logs ?? ""}`;
             }
           };
           log.info("\u{1FA7A} Mobile AI heal \u2014 Phase 1 (script) \u2192 Phase 2 (live device, lazy)...");
-          const heal = await (0, import_runner_core13.executeMobileTestWithHealing)(
+          const heal = await (0, import_runner_core14.executeMobileTestWithHealing)(
             mobileSteps,
             healTarget,
             {
@@ -346708,7 +347820,7 @@ ${finalVerifyResult.logs ?? ""}`;
             healerOptions
           );
           const finalRes = nativeVerify.last;
-          const outcome = (0, import_runner_core13.computeMobileHealOutcome)({
+          const outcome = (0, import_runner_core14.computeMobileHealOutcome)({
             heal,
             finalError: finalRes?.error ?? null,
             reproduceError,
@@ -346854,26 +347966,77 @@ ${result2.logs}`);
       }
       return;
     }
-    const storageStatePath = shouldUseAuthState(run2.tags, run2.playwrightCode) ? getValidAuthState(run2.projectId || opts.projectId) : void 0;
-    if (storageStatePath) {
-      log.info(`Using auth state for project ${run2.projectId || opts.projectId}`);
-    }
-    const result = await runNativeWithLiveBrowser({
-      playwrightCode: run2.playwrightCode,
+    const projectId = run2.projectId || opts.projectId;
+    const authStateExpected = shouldUseAuthState(run2.tags, run2.playwrightCode);
+    const captureAuth = shouldCaptureAuthState(run2.tags, run2.playwrightCode);
+    const authPaths = authStateExpected || captureAuth ? (0, import_runner_core12.localAuthStatePaths)(getRunsDir(), {
+      projectId,
+      serverUrl: opts.serverUrl,
       baseUrl: run2.baseUrl,
       testVariables: run2.testVariables,
-      storageStatePath,
-      validateContext: {
-        runId: run2.runId,
-        serverUrl: opts.serverUrl,
-        authHeader: headers.Authorization
+      authToken: opts.authToken
+    }, run2.runId) : void 0;
+    let releaseAuthLock;
+    let storageStatePath;
+    if (authPaths && authStateExpected) {
+      releaseAuthLock = await (0, import_runner_core12.acquireLocalAuthStateLock)(authPaths.lockKey, authPaths.lockPath);
+      storageStatePath = (0, import_runner_core12.getValidLocalAuthState)(authPaths.cachePath);
+      if (storageStatePath || !captureAuth) {
+        releaseAuthLock();
+        releaseAuthLock = void 0;
+      }
+      if (!storageStatePath && !captureAuth && sharedAuthInjectEnabled()) {
+        log.info(`Waiting for the auth producer to warm project ${projectId}`);
+        storageStatePath = await (0, import_runner_core12.waitForLocalAuthStateProducer)(
+          authPaths.cachePath,
+          authPaths.lockKey,
+          2e3,
+          void 0,
+          100,
+          authPaths.lockPath
+        );
       }
-    });
+    }
+    if (storageStatePath) {
+      log.info(`Using auth state for project ${projectId}`);
+    }
+    const runAuthPath = captureAuth ? authPaths?.capturePath : void 0;
+    const result = await (async () => {
+      try {
+        return await runNativeWithLiveBrowser({
+          playwrightCode: run2.playwrightCode,
+          baseUrl: run2.baseUrl,
+          testVariables: run2.testVariables,
+          authStateCapturePath: runAuthPath,
+          storageStatePath,
+          validateContext: callbackContext
+        });
+      } finally {
+        if (runAuthPath && authPaths) {
+          if ((0, import_runner_core12.getValidLocalAuthState)(runAuthPath)) {
+            const releasePromotionLock = releaseAuthLock ? void 0 : await (0, import_runner_core12.acquireLocalAuthStateLock)(authPaths.lockKey, authPaths.lockPath);
+            try {
+              const captured = (0, import_runner_core12.promoteLocalAuthStateCapture)(
+                runAuthPath,
+                authPaths.cachePath,
+                !!storageStatePath,
+                releaseAuthLock ?? releasePromotionLock
+              );
+              if (captured) log.info(`Captured auth state for project ${projectId}`);
+            } finally {
+              releasePromotionLock?.();
+            }
+          }
+          (0, import_runner_core12.discardLocalAuthStateCapture)(runAuthPath);
+        }
+        releaseAuthLock?.();
+      }
+    })();
     const duration = Date.now() - startTime;
     let runStatus = result.passed ? "PASSED" : "FAILED";
     let runError = result.error;
     if (!result.passed) {
-      const rlDetection = (0, import_runner_core12.detectRateLimitBlock)({
+      const rlDetection = (0, import_runner_core13.detectRateLimitBlock)({
         testName: run2.testName ?? run2.testCaseId ?? void 0,
         tags: run2.tags ?? [],
         error: result.error,
@@ -346887,6 +348050,10 @@ ${result2.logs}`);
         log.warn(`\u26A0 Rate-limit block detected - posting ERROR (not FAILED) to skip heal/quarantine`);
       }
     }
+    if (runStatus === "FAILED" && classifyErrorMessage(runError ?? null) === "config_issue") {
+      runStatus = "ERROR";
+      log.warn(`\u26A0 CONFIG_ISSUE from native execution - posting ERROR (not FAILED) to skip heal/quarantine`);
+    }
     await postResult(opts.serverUrl, headers, run2.runId, {
       status: runStatus,
       stepResults: result.stepResults,
@@ -346902,7 +348069,7 @@ ${result2.logs}`);
     if (result.passed) {
       log.ok(`PASSED  (${duration}ms)${result.suspiciousPass ? ` \u26A0 suspicious-pass (viewport ${Math.round(result.suspiciousPass.emptyRatio * 100)}% blank)` : ""}`);
     } else if (runStatus === "ERROR") {
-      log.warn(`BLOCKED (${duration}ms) - rate-limit detected, not counted as failure`);
+      log.warn(`BLOCKED (${duration}ms) - environmental block (rate-limit / config-issue), not counted as failure`);
     } else {
       log.fail(`FAILED  (${duration}ms)${result.error ? ` - ${result.error}` : ""}`);
       if (result.logs) {
@@ -346934,6 +348101,12 @@ async function startRunner(opts) {
   process.env.AUTH_TOKEN = authToken;
   process.env.RUNNER_TOKEN = authToken;
   if (projectId) process.env.PROJECT_ID = projectId;
+  (0, import_runner_core12.cleanupExpiredLocalAuthStateFiles)(getRunsDir());
+  const authCleanupTimer = setInterval(
+    () => (0, import_runner_core12.cleanupExpiredLocalAuthStateFiles)(getRunsDir()),
+    import_runner_core12.LOCAL_AUTH_STATE_CLEANUP_INTERVAL_MS
+  );
+  authCleanupTimer.unref?.();
   const headers = buildHeaders(authToken, projectId);
   console.log("");
   console.log(`${C2.bold}${C2.cyan}validate.qa Local Runner${C2.reset}`);
@@ -347042,7 +348215,7 @@ async function startRunner(opts) {
     capture: envInt("MAX_CAPTURE", DEFAULT_TYPE_LIMITS.capture),
     run: envInt("MAX_RUN", DEFAULT_TYPE_LIMITS.run)
   };
-  const RESOURCE_GOVERNOR_OPTIONS = (0, import_runner_core12.createResourceGovernorOptions)({
+  const RESOURCE_GOVERNOR_OPTIONS = (0, import_runner_core13.createResourceGovernorOptions)({
     isCloud: IS_CLOUD,
     maxConcurrent: MAX_CONCURRENT,
     typeLimits: TYPE_LIMITS
@@ -347210,8 +348383,8 @@ async function startRunner(opts) {
         android: devices.some((d) => d.platform === "ANDROID" && d.isAvailable && d.state === "BOOTED")
       } : { web: true, ios: false, android: false };
       const bridge = enableMobile ? getBridgeState() : void 0;
-      const resourceStatus = (0, import_runner_core12.getResourceGovernorStatus)(RESOURCE_GOVERNOR_OPTIONS, Object.fromEntries(activeByType));
-      const processInventory = await (0, import_runner_core12.getBrowserProcessInventory)();
+      const resourceStatus = (0, import_runner_core13.getResourceGovernorStatus)(RESOURCE_GOVERNOR_OPTIONS, Object.fromEntries(activeByType));
+      const processInventory = await (0, import_runner_core13.getBrowserProcessInventory)();
       lastInventoryPids = new Set(processInventory.processes.map((p) => p.pid));
       lastInventoryKinds.clear();
       for (const p of processInventory.processes) lastInventoryKinds.set(p.pid, p.kind);
@@ -347241,7 +348414,7 @@ async function startRunner(opts) {
           resourceSnapshot: resourceStatus.snapshot,
           resourceGovernor: resourceStatus.governor,
           processInventory,
-          aiQueue: (0, import_runner_core12.getRunnerAIQueueStats)(),
+          aiQueue: (0, import_runner_core13.getRunnerAIQueueStats)(),
           liveBrowsers: import_runner_core11.liveBrowserRegistry.snapshotForHeartbeat(),
           // Pre-flight checks (ANDROID_HOME, Xcode, Appium drivers, adb, etc).
           // Cached & cheap — see getCachedDoctor above.
@@ -347352,7 +348525,7 @@ async function startRunner(opts) {
   let pidsWatchdogWarned = false;
   const pidsWatchdog = setInterval(() => {
     if (shuttingDown) return;
-    const snapshot = (0, import_runner_core12.getResourceSnapshot)();
+    const snapshot = (0, import_runner_core13.getResourceSnapshot)();
     const pct = snapshot.pidsPct;
     if (pct == null || !Number.isFinite(pct)) return;
     if (pct >= PIDS_RECYCLE_PCT) {
@@ -347392,7 +348565,7 @@ async function startRunner(opts) {
               log.dim(`  Deferred ${run2.runId} (project ${runProject} at capacity ${getActiveForProject(runProject)}/${projectLimit})`);
               continue;
             }
-            const admission = (0, import_runner_core12.evaluateRunAdmission)(RESOURCE_GOVERNOR_OPTIONS, {
+            const admission = (0, import_runner_core13.evaluateRunAdmission)(RESOURCE_GOVERNOR_OPTIONS, {
               mode: runMode,
               activeRuns,
               activeByType: Object.fromEntries(activeByType),
@@ -347470,9 +348643,9 @@ async function startRunner(opts) {
               leasedDeviceId = freeDeviceId;
               leasedDeviceIds.set(freeDeviceId, run2.runId);
             }
-            let claimed = false;
+            let claimEpoch = false;
             try {
-              claimed = await claimRun(serverUrl, headers, run2.runId);
+              claimEpoch = await claimRun(serverUrl, headers, run2.runId);
             } catch (err) {
               if (leasedDeviceId) {
                 leasedDeviceIds.delete(leasedDeviceId);
@@ -347480,7 +348653,7 @@ async function startRunner(opts) {
               }
               throw err;
             }
-            if (!claimed) {
+            if (claimEpoch === false) {
               log.dim(`  Skipped ${run2.runId} (already claimed)`);
               if (leasedDeviceId) {
                 leasedDeviceIds.delete(leasedDeviceId);
@@ -347488,6 +348661,7 @@ async function startRunner(opts) {
               }
               continue;
             }
+            run2.claimEpoch = claimEpoch;
             activeRuns++;
             incrementType(runMode);
             incrementProject(runProject);