@validate.qa/runner 1.0.43 → 1.0.44

package/dist/cli.mjs

@@ -4784,6 +4784,204 @@ var init_origin_domain = __esm({
   }
 });
 
+// ../shared/dist/auth-plan.js
+function hasInlineLoginSteps(playwrightCode) {
+  if (!playwrightCode)
+    return false;
+  return /process\.env\.TEST_USER_EMAIL!?/.test(playwrightCode) && /process\.env\.TEST_USER_PASSWORD!?/.test(playwrightCode);
+}
+function hasGeneratedAuthGuard(playwrightCode) {
+  if (!playwrightCode)
+    return false;
+  return /\/\/ >>> VALIDATE_QA_AUTH v\d+\b[\s\S]*?process\.env\.AUTH_FILE[\s\S]*?\/\/ <<< VALIDATE_QA_AUTH v\d+\b/.test(playwrightCode);
+}
+function legacyNeedsCookieState(tags, code, sharedAuthInjectEnabled2) {
+  if (tags.includes("@auth"))
+    return false;
+  if (tags.includes("@api"))
+    return true;
+  if (!tags.includes("@needs-auth"))
+    return false;
+  if (sharedAuthInjectEnabled2 && tags.includes("@auth-guarded") && hasGeneratedAuthGuard(code))
+    return true;
+  const isGeneratedVariant = tags.includes("@edge") || tags.includes("@bug");
+  const hasLegacyInlineLogin = tags.includes("@discovered") && !isGeneratedVariant && hasInlineLoginSteps(code);
+  return !tags.includes("@inline-login") && !hasLegacyInlineLogin;
+}
+function explicitAuthTypeTags(t) {
+  const found = /* @__PURE__ */ new Set();
+  for (const tag of t) {
+    if (AUTH_TYPE_TAGS.includes(tag))
+      found.add(tag);
+    else if (AUTH_TAG_ALIASES[tag])
+      found.add(AUTH_TAG_ALIASES[tag]);
+  }
+  return [...found];
+}
+function invalidPlan(configurationError) {
+  return {
+    version: 1,
+    source: "invalid",
+    acquisition: "unsupported",
+    presentation: "none",
+    needsCookieState: false,
+    needsStandingHeaders: false,
+    standingHeadersMode: "none",
+    needsLoginCreds: false,
+    requiredEnvKeys: [],
+    configurationError
+  };
+}
+function explicitPlan(authTypeTag2, acquisition, presentation, opts) {
+  return {
+    version: 1,
+    source: "explicit",
+    authTypeTag: authTypeTag2,
+    acquisition,
+    presentation,
+    needsCookieState: opts.cookie,
+    needsStandingHeaders: opts.standingMode === "required",
+    standingHeadersMode: opts.standingMode,
+    needsLoginCreds: TEST_USER_ENV_KEYS.every((k) => opts.requiredEnvKeys.includes(k)),
+    requiredEnvKeys: opts.requiredEnvKeys
+  };
+}
+function deriveAuthPlan(tags, code, opts) {
+  const t = Array.isArray(tags) ? tags : [];
+  const sharedFlag = opts?.sharedAuthInjectEnabled ?? false;
+  const isApi = t.includes("@api");
+  const explicit = isApi ? explicitAuthTypeTags(t) : [];
+  if (explicit.length > 0) {
+    if (t.includes("@auth")) {
+      return invalidPlan("@auth (self-login UI) cannot be combined with an explicit @api auth-type tag");
+    }
+    if (explicit.length > 1) {
+      return invalidPlan(`conflicting auth-type tags: ${explicit.join(", ")}`);
+    }
+    switch (explicit[0]) {
+      case AUTH_TAG_UNSUPPORTED:
+        return {
+          ...invalidPlan("auth scheme not yet drivable (e.g. HMAC / mTLS / provider-replay) \u2014 needs manual configuration")
+        };
+      case AUTH_TAG_NONE:
+        return explicitPlan(AUTH_TAG_NONE, "none", "none", { cookie: false, standingMode: "none", requiredEnvKeys: [] });
+      case AUTH_TAG_STANDING:
+        return explicitPlan(AUTH_TAG_STANDING, "standing-secret", "standing-header", { cookie: false, standingMode: "required", requiredEnvKeys: [API_AUTH_HEADERS_ENV_KEY] });
+      case AUTH_TAG_LOGIN_BEARER:
+        return explicitPlan(AUTH_TAG_LOGIN_BEARER, "request-login", "bearer", { cookie: false, standingMode: "none", requiredEnvKeys: [...TEST_USER_ENV_KEYS] });
+      case AUTH_TAG_LOGIN_COOKIE:
+        return explicitPlan(AUTH_TAG_LOGIN_COOKIE, "request-login", "cookie", { cookie: false, standingMode: "legacy-if-configured", requiredEnvKeys: [...TEST_USER_ENV_KEYS] });
+      case AUTH_TAG_COOKIE_STATE:
+        return explicitPlan(AUTH_TAG_COOKIE_STATE, "browser-bootstrap", "cookie", { cookie: true, standingMode: "legacy-if-configured", requiredEnvKeys: [...TEST_USER_ENV_KEYS] });
+    }
+  }
+  const cookie = legacyNeedsCookieState(t, code, sharedFlag);
+  const authedLegacy = t.includes("@auth") || t.includes("@needs-auth") || isApi;
+  return {
+    version: 1,
+    source: "legacy",
+    acquisition: cookie ? "browser-bootstrap" : authedLegacy ? "request-login" : "none",
+    presentation: authedLegacy ? "cookie" : "none",
+    needsCookieState: cookie,
+    needsStandingHeaders: false,
+    // A legacy bare-@api test keeps injecting standing headers IF the project configured them
+    // (preserving today's behavior) — but does not require them. Non-@api legacy tests never inject.
+    standingHeadersMode: isApi ? "legacy-if-configured" : "none",
+    needsLoginCreds: authedLegacy,
+    requiredEnvKeys: authedLegacy ? [...TEST_USER_ENV_KEYS] : []
+  };
+}
+function authTypeTag(tags) {
+  const t = Array.isArray(tags) ? tags : [];
+  const explicit = explicitAuthTypeTags(t);
+  return explicit.length === 1 ? explicit[0] : void 0;
+}
+var AUTH_TAG_COOKIE_STATE, AUTH_TAG_LOGIN_COOKIE, AUTH_TAG_LOGIN_BEARER, AUTH_TAG_STANDING, AUTH_TAG_NONE, AUTH_TAG_UNSUPPORTED, AUTH_TYPE_TAGS, AUTH_TAG_ALIASES, TEST_USER_ENV_KEYS, API_AUTH_HEADERS_ENV_KEY;
+var init_auth_plan = __esm({
+  "../shared/dist/auth-plan.js"() {
+    "use strict";
+    AUTH_TAG_COOKIE_STATE = "@auth-cookie-state";
+    AUTH_TAG_LOGIN_COOKIE = "@auth-login-cookie";
+    AUTH_TAG_LOGIN_BEARER = "@auth-login-bearer";
+    AUTH_TAG_STANDING = "@auth-standing";
+    AUTH_TAG_NONE = "@auth-none";
+    AUTH_TAG_UNSUPPORTED = "@auth-unsupported";
+    AUTH_TYPE_TAGS = [
+      AUTH_TAG_COOKIE_STATE,
+      AUTH_TAG_LOGIN_COOKIE,
+      AUTH_TAG_LOGIN_BEARER,
+      AUTH_TAG_STANDING,
+      AUTH_TAG_NONE,
+      AUTH_TAG_UNSUPPORTED
+    ];
+    AUTH_TAG_ALIASES = {
+      "@auth-cookie": AUTH_TAG_COOKIE_STATE,
+      "@auth-bearer": AUTH_TAG_LOGIN_BEARER,
+      "@auth-token": AUTH_TAG_LOGIN_BEARER,
+      "@auth-api-key": AUTH_TAG_STANDING,
+      "@auth-standing-header": AUTH_TAG_STANDING
+    };
+    TEST_USER_ENV_KEYS = ["TEST_USER_EMAIL", "TEST_USER_PASSWORD"];
+    API_AUTH_HEADERS_ENV_KEY = "API_AUTH_HEADERS";
+  }
+});
+
+// ../shared/dist/redact-needles.js
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function buildNeedleMatcher(needles) {
+  const usable = Array.from(new Set(needles.filter((n) => typeof n === "string" && n.length >= MIN_NEEDLE_LENGTH))).sort((a, b) => b.length - a.length);
+  if (usable.length === 0)
+    return null;
+  return new RegExp(usable.map(escapeRegExp).join("|"), "g");
+}
+function redactNeedlesText(text, matcher) {
+  if (!matcher || !text)
+    return text;
+  matcher.lastIndex = 0;
+  const out = text.replace(matcher, REDACTED);
+  return out === text ? text : out;
+}
+function redactNeedlesDeep(value, matcher) {
+  if (!matcher)
+    return value;
+  if (typeof value === "string") {
+    const scrubbed = redactNeedlesText(value, matcher);
+    return scrubbed === value ? value : scrubbed;
+  }
+  if (Array.isArray(value)) {
+    let changed = false;
+    const next = value.map((item) => {
+      const scrubbed = redactNeedlesDeep(item, matcher);
+      if (scrubbed !== item)
+        changed = true;
+      return scrubbed;
+    });
+    return changed ? next : value;
+  }
+  if (value !== null && typeof value === "object") {
+    let changed = false;
+    const next = {};
+    for (const [k, v] of Object.entries(value)) {
+      const scrubbed = redactNeedlesDeep(v, matcher);
+      if (scrubbed !== v)
+        changed = true;
+      next[k] = scrubbed;
+    }
+    return changed ? next : value;
+  }
+  return value;
+}
+var REDACTED, MIN_NEEDLE_LENGTH;
+var init_redact_needles = __esm({
+  "../shared/dist/redact-needles.js"() {
+    "use strict";
+    REDACTED = "[REDACTED]";
+    MIN_NEEDLE_LENGTH = 8;
+  }
+});
+
 // ../shared/dist/voice-config.js
 function normalizeTtsVoiceId(voiceId) {
   if (!voiceId)
@@ -5058,8 +5256,16 @@ __export(dist_exports, {
   ADDON_DEFINITIONS: () => ADDON_DEFINITIONS,
   ADMIN_EMAIL_LIMITS: () => ADMIN_EMAIL_LIMITS,
   AI_CREDIT_MARGIN: () => AI_CREDIT_MARGIN,
+  API_AUTH_HEADERS_ENV_KEY: () => API_AUTH_HEADERS_ENV_KEY,
   API_PREFIX: () => API_PREFIX,
   AUDIO_CHUNK_DURATION_MS: () => AUDIO_CHUNK_DURATION_MS,
+  AUTH_TAG_COOKIE_STATE: () => AUTH_TAG_COOKIE_STATE,
+  AUTH_TAG_LOGIN_BEARER: () => AUTH_TAG_LOGIN_BEARER,
+  AUTH_TAG_LOGIN_COOKIE: () => AUTH_TAG_LOGIN_COOKIE,
+  AUTH_TAG_NONE: () => AUTH_TAG_NONE,
+  AUTH_TAG_STANDING: () => AUTH_TAG_STANDING,
+  AUTH_TAG_UNSUPPORTED: () => AUTH_TAG_UNSUPPORTED,
+  AUTH_TYPE_TAGS: () => AUTH_TYPE_TAGS,
   COST_PER_M: () => COST_PER_M,
   CREDIT_PACKS_CENTS: () => CREDIT_PACKS_CENTS,
   CREDIT_PRICES_CENTS: () => CREDIT_PRICES_CENTS,
@@ -5102,6 +5308,7 @@ __export(dist_exports, {
   STT_MODEL_OPTIONS: () => STT_MODEL_OPTIONS,
   STT_PROVIDER_OPTIONS: () => STT_PROVIDER_OPTIONS,
   SUPPORT_EMAIL: () => SUPPORT_EMAIL,
+  TEST_USER_ENV_KEYS: () => TEST_USER_ENV_KEYS,
   TRANSIENT_CONTROL_ROLES: () => TRANSIENT_CONTROL_ROLES,
   TRIAL_DURATION_DAYS: () => TRIAL_DURATION_DAYS,
   TTS_MODEL_OPTIONS: () => TTS_MODEL_OPTIONS,
@@ -5111,10 +5318,12 @@ __export(dist_exports, {
   accumulateStatements: () => accumulateStatements,
   aiCostToCreditCents: () => aiCostToCreditCents,
   analyzeMobileSelectorQuality: () => analyzeMobileSelectorQuality,
+  authTypeTag: () => authTypeTag,
   bugFoundQuarantineWhere: () => bugFoundQuarantineWhere,
   buildAppiumCode: () => buildAppiumCode,
   buildLaunchStep: () => buildLaunchStep,
   buildMobileStep: () => buildMobileStep,
+  buildNeedleMatcher: () => buildNeedleMatcher,
   buildSandboxedEnv: () => buildSandboxedEnv,
   buildSanitizedAgentEnv: () => buildSanitizedAgentEnv,
   buildStepTarget: () => buildStepTarget,
@@ -5130,6 +5339,7 @@ __export(dist_exports, {
   controlSignature: () => controlSignature,
   countInnerTests: () => countInnerTests,
   decideHarPosted: () => decideHarPosted,
+  deriveAuthPlan: () => deriveAuthPlan,
   deriveProjectKey: () => deriveProjectKey,
   detectCrossOriginHtmlAsJson: () => detectCrossOriginHtmlAsJson,
   detectsErrorBannerAssertion: () => detectsErrorBannerAssertion,
@@ -5197,6 +5407,8 @@ __export(dist_exports, {
   planHasBillingPortal: () => planHasBillingPortal,
   planRequiresCheckout: () => planRequiresCheckout,
   platformTag: () => platformTag,
+  redactNeedlesDeep: () => redactNeedlesDeep,
+  redactNeedlesText: () => redactNeedlesText,
   registrableDomain: () => registrableDomain,
   resolveCrossOriginConfigOverride: () => resolveCrossOriginConfigOverride,
   resolveMobileStepValuePlaceholders: () => resolveMobileStepValuePlaceholders,
@@ -5239,6 +5451,8 @@ var init_dist = __esm({
     init_agent_env();
     init_test_counting();
     init_origin_domain();
+    init_auth_plan();
+    init_redact_needles();
     init_voice_config();
     init_feature_flags();
   }
@@ -52406,11 +52620,11 @@ var require_leac = __commonJS({
         if (r.str.length === 0) {
           throw new Error(`Rule #${i} ("${r.name}") has empty "str" property, which is not allowed.`);
         }
-        return new RegExp(escapeRegExp(r.str), "y");
+        return new RegExp(escapeRegExp2(r.str), "y");
       }
-      return new RegExp(escapeRegExp(r.name), "y");
+      return new RegExp(escapeRegExp2(r.name), "y");
     }
-    function escapeRegExp(str) {
+    function escapeRegExp2(str) {
       return str.replace(/[-[\]{}()*+!<=:?./\\^$|#\s,]/g, "\\$&");
     }
     function toSticky(re) {
@@ -68383,7 +68597,7 @@ var require_discover_ai_planner = __commonJS({
   "../runner-core/dist/services/discover-ai-planner.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.SCENARIO_SYSTEM_PROMPT = void 0;
+    exports.PLANNER_STRENGTHEN_GATE_PROMPT = exports.SCENARIO_SYSTEM_PROMPT = void 0;
     exports.getAIPlannerMaxTokens = getAIPlannerMaxTokens;
     exports.getSnapshotConfidence = getSnapshotConfidence;
     exports.compressSiteMap = compressSiteMap;
@@ -68966,7 +69180,7 @@ Return ONLY one valid JSON object matching the schema below. Do NOT include <thi
 4. **Multi-page journeys** - only when transitions were actually observed
 5. **Bug reports** - for observed 500 errors, crashes, or broken features
 6. **Steps are human-readable** - "Fill the email field", not "page.getByLabel('Email').fill()"
-7. **Expected outcomes are plain-English success criteria** - describe the user-visible product result, not the controls touched along the way. Steps already cover buttons, inputs, links, fields, headings, tabs, dialogs, and menus. Expected outcomes should say what the user can now do or rely on (record saved, message sent, search results filtered, validation explained, dashboard accessible). Include durable routes or exact copy only when they are the real product outcome; do NOT list "heading visible", "button visible", "search input visible", or similar element inventory unless that exact control is the behavior under test.  **Outcome-strength self-check (applies to EVERY scenario type):** before emitting a scenario, ask \u2014 would every expectedOutcome still pass if the primary action did nothing and only the page and its existing chrome rendered? If yes, it is too weak. Add at least one evidence-backed post-condition that would FAIL in that no-op case: specific result content or value, a created or removed entity, a changed count or status, persisted state after reload, handled validation copy, or a concrete session signal. A route alone suffices only when navigation or redirect is itself the behavior under test; a newly revealed control suffices only when revealing that control is the behavior under test. Never invent copy to satisfy this check \u2014 Rule 1 still governs what you may assert.
+7. **Expected outcomes are plain-English success criteria** - describe the user-visible product result, not the controls touched along the way. Steps already cover buttons, inputs, links, fields, headings, tabs, dialogs, and menus. Expected outcomes should say what the user can now do or rely on (record saved, message sent, search results filtered, validation explained, dashboard accessible). Include durable routes or exact copy only when they are the real product outcome; do NOT list "heading visible", "button visible", "search input visible", or similar element inventory unless that exact control is the behavior under test.  **Outcome-strength check (per outcome, applies to EVERY scenario type):** evaluate each expectedOutcome separately. Delete it if it would already be true immediately before the scenario's primary action \u2014 UNLESS navigation, redirect, or revealing that state is itself the behavior under test. Keep at least one evidence-backed discriminator that proves the primary behavior actually occurred: specific result content or value, a created or removed entity, a changed count or status, persisted state after reload, or handled validation copy. Every value, count-change, persistence, creation, or removal assertion MUST trace to an earlier evidence-backed step that establishes the baseline or exact target. If the evidence does not support such a step, drop the assertion; do not invent setup. **Silent-failure BUG_REPORT exception:** apply ONLY when evidence explicitly records an action as broken because its intended state change did not occur. It does NOT apply to expected validation, permission denial, unmet prerequisites, loading or rate-limit states, or any non-BUG scenario. Prove the unchanged state with an evidence-backed before/after discriminator tied to the attempted run-scoped target \u2014 not merely "no toast", "no redirect", or "the form is still visible". Never invent copy to satisfy this check \u2014 Rule 1 still governs what you may assert.
 8. **Auth-aware** - mark scenarios that need login. Use process.env.TEST_USER_EMAIL / PASSWORD
 9. **No duplicates** - check existing test names before adding
 10. **All tests start from the landing page** - every generated test navigates to \`/\` first and uses the app's own navigation (clicking links/buttons) to reach the target page. Steps must reflect this: say "Navigate to landing page and click Sign In" not "Navigate to /auth/login". Deep-linking to internal routes causes hydration failures in SPAs. \`targetPages\` lists the pages involved in the flow.
@@ -68979,7 +69193,7 @@ Return ONLY one valid JSON object matching the schema below. Do NOT include <thi
     Example - BAD happy path: \`["Navigate to /feature", "Click Create", "Verify dialog opens"]\` \u2192 only tests the trigger.
     Example - GOOD happy path (generic, async): \`["Navigate to landing and log in", "Navigate to the feature page", "Note the current count of items on the list", "Click the primary action button", "Fill required inputs and submit", "Wait for completion signal (up to 60s)", "Verify the item count increased by 1", "Open the newly created item", "Verify its content is non-empty and contains the input I provided"]\`
     Example - GOOD happy path (sync CRUD): \`["Navigate to landing and log in", "Navigate to the list page", "Click New", "Fill required fields", "Click Save", "Verify the new record appears in the list", "Click the record and verify its detail view shows the values I entered"]\`
-12. **Auth happy paths require concrete session proof.** A login/auth HAPPY_PATH is incomplete if it only proves "user reaches dashboard" or "authenticated page is visible." It MUST verify at least one durable signed-in signal that was observed in the evidence: user/account menu opens, Logout/Sign out is available, the observed display name/email/avatar/account item is present, authenticated navigation remains available after a reload, or another app-specific session control is usable. Prefer concrete observed labels from the evidence (for example "Logout", "Sign out", "Account", "Profile", or the user's own displayed name/email from evidence) over generic phrases like "personalized content." If the explorer only observed a redirect and no signed-in signal, keep the route outcome but mark the session-proof outcome reliability "low" and state what concrete signal was missing.
+12. **Auth happy paths require concrete session proof.** A login/auth HAPPY_PATH is incomplete if it only proves "user reaches dashboard" or "authenticated page is visible." It MUST verify at least one durable signed-in signal that was observed in the evidence: user/account menu opens, Logout/Sign out is available, the observed display name/email/avatar/account item is present, authenticated navigation remains available after a reload, or another app-specific session control is usable. Prefer concrete observed labels from the evidence (for example "Logout", "Sign out", "Account", "Profile", or the user's own displayed name/email from evidence) over generic phrases like "personalized content." If the explorer only observed a redirect and no concrete signed-in control, do NOT invent one or instruct the executor to "open the account/user menu" \u2014 assert only the exact observed redirect (plus any directly supported transition, e.g. the login form is no longer shown), treat the redirect and any observed transition as transition outcomes \u2014 not concrete session proof \u2014 assign each its evidence-supported reliability, and name the missing concrete signal as a coverage gap in reasoning. Never substitute a menu of generic alternatives ("such as Logout, Profile, or \u2026") for one evidenced signal in a step or expected outcome.
 13. **Independent execution contract.** Every scenario MUST pass when run alone, first, last, in random order, and in parallel against an environment with no relevant feature data except explicitly guaranteed immutable fixtures. A scenario that depends on a sibling scenario's side effects (e.g. "delete the conversation that another test created") is invalid. If two flows are inherently coupled, bundle them as a single USER_JOURNEY scenario.
 14. **Scenario-owned state.** If a scenario reads, searches, opens, updates, messages, cancels, or deletes an entity, that scenario MUST create or seed the entity in its own setup steps. "Use an existing record" / "the conversation in the demo account" / "the existing user named X" are forbidden phrasings \u2014 they assume mutable pre-existing app data. Carve-out: baseline observations (current count, list length, "the dashboard heading is visible") are allowed as prerequisite reads ONLY when the durable assertion targets a self-created entity. Phrase setup as: "Click New, fill required fields with run-scoped values, submit and verify the new record appears, THEN proceed to <feature under test>."
 15. **Run-scoped test data.** Generated entities MUST use unique, run-scoped identifiers \u2014 phrase as "test message <Date.now()>" or "QA-<unique id>" in steps. Subsequent assertions MUST target that unique identifier, not "the first item", "the latest message", "the last row", or any visible display name observed during exploration. Hardcoding any specific display name, username, email, conversation title, or other identifier observed in the explorer's snapshot is forbidden \u2014 that data is incidental, not a stable contract. The same identifiers will not exist (or will look different) when the test runs in a fresh environment or against a different account.
@@ -69042,6 +69256,9 @@ Return ONLY one valid JSON object matching the schema below. Do NOT include <thi
     Citing observed labels in \`expectedOutcomes\` is fine \u2014 that's asserting on stable product signals, not implementation specifics.
 
 ## Coverage Strategy
+**Coverage allocation \u2014 order matters.** The test budget is a ceiling, never a target. Before writing JSON, privately inventory each distinct behavior the evidence explicitly RECORDS: a SUCCESS, EMPTY_STATE, VALIDATION_ERROR, ERROR, BUG, an Explorer-Recorded Journey outcome, or an observed page/state transition. Assign each recorded behavior to exactly one scenario as its primary coverage owner \u2014 this does not prohibit repeating evidence-backed prerequisite setup and verification required by Rules 13\u201317. Bundle input variants that exercise the same purpose (e.g. two malformed-parameter cases that both return the same validation) into that one scenario. Use Page Intelligence only to make sure every described surface is reached \u2014 a merely listed control, route, provider, tab, or input does NOT by itself prove a behavior or earn its own scenario. Do NOT add an inferred scenario just to fill the budget. If a recorded behavior cannot be tested independently without unsupported mutable state, name it as a coverage gap (rule 17) rather than pretending it is self-contained. Treat a page/state transition as a distinct behavior only when navigation or revealing that state is itself the recorded product outcome; otherwise keep it as a step within the owning scenario \u2014 Page Intelligence creates no additional coverage obligation.
+
+Apply the per-surface minimums below only where the evidence actually supports them (evidence support includes Rule 1's trigger-only structural exception):
 - For every form: at least 1 HAPPY_PATH (submit valid data AND verify durable result per rule 11) + 1 EDGE_CASE (empty/invalid submission)
 - For auth flows: login happy path (verify the post-login route AND a concrete signed-in/session signal per rule 12) + validation (wrong password, empty fields)
 - For CRUD: each scenario MUST own the entity it operates on. Read/search/update/delete/cancel-on-existing/view-existing scenarios MUST include a create step earlier in the same scenario (or declare an immutable seed fixture by name). Never assume a record from prior runs or sibling tests exists. Splitting into atomic create/read/update/delete tests is fine ONLY when each test creates its own entity. When create/delete are tightly coupled (e.g. delete-only with no create flow elsewhere), bundle into a single USER_JOURNEY: create \u2192 verify \u2192 delete \u2192 verify removal.
@@ -69071,11 +69288,11 @@ Return ONLY one valid JSON object matching the schema below. Do NOT include <thi
         { "action": "Fill the email field with test credentials" },
         { "action": "Fill the password field with test credentials" },
         { "action": "Click the Sign In button" },
-        { "action": "Open the observed authenticated account or user menu" }
+        { "action": "After reaching the observed post-login page, reload it" }
       ],
       "expectedOutcomes": [
-        { "type": "url", "description": "User reaches /dashboard after signing in", "reliability": "high" },
-        { "type": "element-visible", "description": "The signed-in session is proven by an observed user/account signal such as Logout, Profile, or the user's displayed identity", "reliability": "high" }
+        { "type": "url", "description": "User reaches /dashboard after signing in and remains there after reload", "reliability": "high" },
+        { "type": "element-hidden", "description": "The login form does not return after reload", "reliability": "medium" }
       ],
       "targetPages": ["/auth/login", "/dashboard"],
       "prerequisites": []
@@ -69105,6 +69322,46 @@ Each entry is exactly one of:
 3 = medium (navigation, secondary features)
 4 = low (edge cases, cosmetic)
 5 = nice-to-have`;
+    exports.PLANNER_STRENGTHEN_GATE_PROMPT = `You are a senior QA lead performing ONE design-audit pass over a test PLAN another model wrote for a single web feature. The plan will be handed to a LIVE generator that opens the real app, follows each scenario's steps, observes the DOM, and writes the concrete assertions itself. Division of labor you MUST respect:
+- The PLAN owns the ORACLE: WHAT must be true for the behavior to be correct, stated in plain English.
+- The GENERATOR owns BINDING: locators and the exact runtime values it reads off the live page.
+Never write an expectation whose truth is decided by looking at the current app ("whatever the page shows"): that lets a live bug become the expected result. State the intended truth; the generator will bind it and report a mismatch if reality disagrees.
+
+You are given (1) the EXACT evidence the plan was based on \u2014 the ONLY ground truth; you may use it to know WHAT behaviors exist, but you must NEVER introduce a behavior, route, element, or effect not present in or directly implied by it \u2014 and (2) the PLAN as JSON. Return the complete corrected plan.
+
+## Rule 0 \u2014 REPAIR OR DROP, never merely describe (highest priority)
+Do NOT write a reasoning note about a fix you did not actually apply. Every change you claim must be present in the scenarios you output: if you say you strengthened an outcome, the new outcome text must be there; if you say you merged or removed a duplicate, NO surviving scenario may share the same primary action + outcome. If a defect cannot be repaired from the evidence, DROP the scenario or FLAG it \u2014 do not keep a known-weak scenario with an excuse. Flag-and-keep is forbidden.
+
+Your only legal moves per scenario are: KEEP unchanged \xB7 REWRITE using a grounded fact \xB7 DROP as unsupported/duplicate \xB7 FLAG as needs-more-evidence (low reliability, honest note). You may never FORCE-REWRITE by inventing an effect the evidence does not show (a visible Delete control does not tell you whether delete removes, archives, hides, or disables \u2014 do not assume).
+
+## Rule 1 \u2014 Classify each scenario, then require the matching oracle
+Identify the scenario's archetype and hold its expectedOutcomes to the right shape. An outcome is only valid if it would be FALSE under a plausible FAULT for that archetype:
+
+- CREATE/EDIT/DELETE (mutation): the scenario must control its own target \u2014 create the entity it acts on with a self-chosen unique identifier (create \u2192 act \u2192 verify), or declare a prerequisite that resolves it (a fixture or a stable immutable reference). Never depend on unspecified pre-existing/ambient rows ("delete the first row", "open an existing order"). Oracle = the owned entity's before\u2192after: it appears after create / reflects the edit / is absent after delete (verify by the unique identifier, ideally after reload), while an unrelated sentinel is unaffected. Plausible faults to defeat: no-op, wrong-target, duplicate, non-persistence-after-reload, over-broad delete.
+- LIST/READ/DETAIL: oracle = the returned content corresponds to what was requested (the opened item's identifier matches the one selected). No before\u2192after is required.
+- FILTER/SEARCH/SORT: oracle = a delta \u2014 a known in-scope item remains AND a known out-of-scope item disappears (or order changes as specified). "Matching items are shown" alone is a no-op (a broken filter that shows everything passes).
+- VALIDATION/NEGATIVE: oracle must distinguish "the action was correctly rejected by validation" from "nothing happened / a dead control". Prefer the grounded error signal the evidence recorded (exact message or the specific field marked invalid) plus the absence of the forbidden effect (no entity created). If no error signal was observed, keep it structural at low reliability and FLAG.
+- NAVIGATION/REDIRECT/AUTH-GUARD: the destination is a legitimate primary effect \u2014 assert the route AND one observed landing signal (heading/content) so a redirect to a broken page fails. Route-presence as an outcome on a NON-navigation scenario is padding \u2014 drop it.
+- TOGGLE/IDEMPOTENT: assert the changed attribute/state (e.g. pressed/checked/disabled), or for idempotent actions that no duplicate is created \u2014 not mere visibility.
+- EXTERNAL INTEGRATION: assert the outbound URL/payload contains the expected parameters (drawn from evidence), not a frozen full string.
+- STATIC CONTENT: presence/label oracle is acceptable; do not inflate it. Verify shared chrome (nav/footer) ONCE, not per page.
+- APP BUG: exactly one BUG_REPORT per distinct root cause; assert the observed defective effect. Console errors, thrown exceptions, and network status codes are NOT page text \u2014 assert the observable page effect (no toast / no redirect / form unchanged), or set the outcome type to the right probe.
+
+## Rule 2 \u2014 Exact values: judge by ORIGIN, not specificity
+- DROP as brittle: mutable ambient snapshots the test does not control \u2014 current counts ("8 cards"), seeded record names, other users' data, opaque IDs/slugs, phone numbers. Phrase these relationally ("the account's active business name", "the created item", "\u22651 result").
+- KEEP exact: values the SCENARIO itself introduced (a unique title it typed \u2014 assert it propagates), app-authored static strings (validation messages, headings, template copy, fixed error codes), and stable contract/derived facts (a contractual price, total = qty \xD7 unit price). These are real oracles, not brittleness.
+
+## Rule 3 \u2014 Do not build on flows the evidence shows are broken or unrepeatable
+If evidence flags a route/flow as broken, a precondition as unobtainable (e.g. a single-use token already consumed, an account locked out), or a mutation as irreversible/one-shot on a shared account, you MUST NOT emit happy-path scenarios that depend on that flow succeeding or repeating. Reconcile: drop the dependent happy path, or route it through an alternate path the evidence actually shows.
+
+## Rule 4 \u2014 Suite economy and completeness
+Budget is a ceiling, not a target. Merge scenarios that collide on (route + primary action + outcome-class). Do not enumerate one scenario per item across a long list when 1\u20133 representatives suffice. Reclaim freed budget to cover a DISTINCT behavior the evidence recorded that the plan left untested (swap, do not inflate). An action inferred only from a merely-listed control the evidence never showed exercised should be dropped and FLAGGED as a survey gap, not asserted.
+
+## Rule 5 \u2014 reliability is honest
+high = the effect and its trigger are both directly observed in evidence; medium = observed but partial/indirect; low = structural or inferred (must be FLAGGED). Never launder an unsupported claim by labelling it low \u2014 if it is invented, drop it.
+
+## Output
+Keep the exact JSON schema { "featureGroups":[...], "scenarios":[...], "reasoning":"..." }; each scenario keeps name, type, priority, variant, featureGroup, goal, steps[], expectedOutcomes[{type,description,reliability}], targetPages, prerequisites. In "reasoning", state ONLY changes you actually made (kept/rewritten/dropped/merged/flagged counts). Return ONLY the complete corrected JSON object \u2014 no markdown, no prose outside JSON.`;
     function coerceRawPrerequisites(raw) {
       if (!Array.isArray(raw))
         return [];
@@ -69888,6 +70145,95 @@ Each entry is exactly one of:
           }
         }
       }
+      const gateFlag = (process.env.PLANNER_STRENGTHEN_GATE || "").trim().toLowerCase();
+      const gateEnabled = gateFlag !== "false" && gateFlag !== "0";
+      if (gateEnabled && context.mode !== "survey" && !options.systemPromptOverride && !options.userPromptOverride && !extraPlannerCallUsed && scenarios.length > 0) {
+        const gateModel = options.gateModelOverride ? (0, ai_provider_js_1.resolveModelForTask)(options.gateModelOverride, "agent") : agentModel;
+        const gateClient = options.gateModelOverride ? (0, ai_provider_js_1.getRunnerClientForModel)(options.gateModelOverride) : aiClient;
+        const gateMaxTokens = getAIPlannerMaxTokens(gateModel);
+        const gatePlan = { featureGroups, scenarios, reasoning: aiOutput.reasoning ?? "" };
+        const gateUser = `EVIDENCE (ground truth):
+${userPrompt}
+
+=====
+
+PLAN TO AUDIT AND REPAIR (JSON):
+${JSON.stringify(gatePlan)}`;
+        const gateStart = Date.now();
+        let gateResponse = null;
+        try {
+          extraPlannerCallUsed = true;
+          gateResponse = await (0, ai_retry_js_1.resilientAICall)((signal, arm) => (0, ai_queue_js_1.queuedAICall)(() => {
+            arm();
+            return gateClient.chat.completions.create({
+              model: gateModel,
+              messages: [
+                { role: "system", content: exports.PLANNER_STRENGTHEN_GATE_PROMPT },
+                { role: "user", content: gateUser }
+              ],
+              max_tokens: gateMaxTokens,
+              temperature: 0.2,
+              ...(0, ai_provider_js_1.getJsonObjectResponseFormat)(gateModel),
+              ...(0, ai_provider_js_1.getNoThinkingRequestOptions)(gateModel)
+            }, { signal });
+          }), {
+            label: "ai-planner-strengthen-gate",
+            deferTimeoutUntilArmed: true,
+            onRetry: (attempt, reason, delay) => logs2.push(`AI planner strengthen-gate call failed (${reason}) \u2014 retry ${attempt} in ${Math.round(delay / 1e3)}s`)
+          });
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          logs2.push(`AI planner strengthen-gate failed (${message}) \u2014 keeping pre-gate result`);
+        }
+        if (gateResponse) {
+          try {
+            options.onAICall?.({
+              iteration: 1,
+              groupId: `ai-planner-${context.projectId.slice(0, 8)}`,
+              callType: "discoveryAIPlannerStrengthenGate",
+              model: gateModel,
+              provider: (0, ai_provider_js_1.getProviderForModel)(gateModel),
+              durationMs: Date.now() - gateStart,
+              promptTokens: gateResponse.usage?.prompt_tokens,
+              completionTokens: gateResponse.usage?.completion_tokens,
+              totalTokens: gateResponse.usage?.total_tokens,
+              assistantMessage: gateResponse.choices[0]?.message?.content,
+              requestMessageCount: 2
+            });
+          } catch {
+          }
+          const gateRaw = gateResponse.choices[0]?.message?.content?.trim();
+          if (gateRaw) {
+            let gateOut = null;
+            try {
+              gateOut = JSON.parse((0, strip_json_fences_js_1.stripJsonFences)(gateRaw));
+            } catch (err) {
+              const message = err instanceof Error ? err.message : String(err);
+              logs2.push(`AI planner strengthen-gate returned invalid JSON (${message}) \u2014 keeping pre-gate result`);
+            }
+            if (gateOut) {
+              try {
+                const vg = validateAIPlannerOutput(gateOut, siteMap, context.existingTestNames, context.testBudget, evidence.recordedJourneys, context.mode, context.focusAreas);
+                const preGateCount = scenarios.length;
+                const keepsCoverage = vg.scenarios.length >= Math.ceil(preGateCount * 0.5);
+                const noWorseGaps = vg.coverageGaps.length <= coverageGaps.length;
+                if (vg.scenarios.length > 0 && keepsCoverage && noWorseGaps) {
+                  logs2.push(`AI planner strengthen-gate [${gateModel}]: ${preGateCount}\u2192${vg.scenarios.length} scenarios, gaps ${coverageGaps.length}\u2192${vg.coverageGaps.length}; taking gated result`);
+                  scenarios = vg.scenarios;
+                  featureGroups = vg.featureGroups;
+                  warnings = [...warnings, ...vg.warnings];
+                  coverageGaps = vg.coverageGaps;
+                } else {
+                  logs2.push(`AI planner strengthen-gate rejected (scen ${preGateCount}\u2192${vg.scenarios.length}, gaps ${coverageGaps.length}\u2192${vg.coverageGaps.length}); keeping pre-gate result`);
+                }
+              } catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                logs2.push(`AI planner strengthen-gate validation threw (${message}) \u2014 keeping pre-gate result`);
+              }
+            }
+          }
+        }
+      }
       const totalFinal = scenarios.length + coverageGaps.length;
       const rejectionRateFinal = totalFinal > 0 ? coverageGaps.length / totalFinal : 0;
       if (rejectionRateFinal > 0.5 && totalFinal >= 3) {
@@ -73667,7 +74013,7 @@ var require_mobile_heal_postprocess = __commonJS({
       // OpenAI-style secret key
     ];
     var EMAIL_RE = /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g;
-    function escapeRegExp(value) {
+    function escapeRegExp2(value) {
       return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     }
     function collectSecretVars(testVariables, minLen, keyRe) {
@@ -73686,7 +74032,7 @@ var require_mobile_heal_postprocess = __commonJS({
         return text;
       let out = text;
       for (const { key, value } of collectSecretVars(testVariables, MIN_REDACT_LEN, REDACT_KEY_RE)) {
-        out = out.replace(new RegExp(escapeRegExp(value), "g"), `{{${key}}}`);
+        out = out.replace(new RegExp(escapeRegExp2(value), "g"), `{{${key}}}`);
       }
       for (const source of TOKEN_SOURCES) {
         out = out.replace(new RegExp(source, "g"), "[REDACTED]");
@@ -76086,7 +76432,7 @@ var require_api_auth_headers = __commonJS({
   "../runner-core/dist/services/api-auth-headers.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.parseApiAuthHeaders = parseApiAuthHeaders;
+    exports.parseApiAuthHeaders = parseApiAuthHeaders2;
     exports.resolveApiAuthHeaders = resolveApiAuthHeaders;
     exports.isAppOriginRequest = isAppOriginRequest;
     exports.buildOriginScopedApiFixtures = buildOriginScopedApiFixtures;
@@ -76099,7 +76445,7 @@ var require_api_auth_headers = __commonJS({
       }
       return false;
     }
-    function parseApiAuthHeaders(raw) {
+    function parseApiAuthHeaders2(raw) {
       if (!raw || typeof raw !== "string")
         return void 0;
       const trimmed = raw.trim();
@@ -76123,9 +76469,9 @@ var require_api_auth_headers = __commonJS({
     function resolveApiAuthHeaders(input) {
       if (input.explicit)
         return input.explicit;
-      if (!input.isApiTest)
+      if (input.standingHeadersMode === "none")
         return void 0;
-      return parseApiAuthHeaders(input.apiAuthHeadersVar);
+      return parseApiAuthHeaders2(input.apiAuthHeadersVar);
     }
     function isAppOriginRequest(url, baseUrl) {
       if (typeof url !== "string" || !baseUrl)
@@ -76392,7 +76738,7 @@ var require_playwright_native = __commonJS({
     var RUNS_DIR = process.env.RUNS_DIR || (0, path_1.join)(PACKAGE_DIR, ".qa-runs");
     var PW_CLI = __require.resolve("@playwright/test/cli");
     async function executeTestViaNativePlaywright2(options) {
-      const { playwrightCode, baseUrl, testName, testVariables, authStateCapturePath, storageStatePath, extraHttpHeaders, validateContext, liveBrowserHandle, onLiveBrowserSnapshot } = options;
+      const { playwrightCode, baseUrl, testName, testVariables, authStateCapturePath, storageStatePath, extraHttpHeaders, authStandingMode, validateContext, liveBrowserHandle, onLiveBrowserSnapshot } = options;
       const logs2 = [];
       const screenshots = [];
       logs2.push(`\u{1F3AD} Native Playwright starting`);
@@ -76402,16 +76748,19 @@ var require_playwright_native = __commonJS({
         logs2.push("\u26A0\uFE0F WARNING: baseUrl is empty - test will likely fail with navigation errors");
       }
       let runDir = null;
+      let standingNeedleMatcher = null;
       let callbackProxy;
       try {
         runDir = (0, path_1.join)(RUNS_DIR, (0, crypto_1.randomUUID)());
         await (0, promises_1.mkdir)(runDir, { recursive: true });
         const isApiTest2 = playwrightCode.includes("@api") || playwrightCode.includes("{ request }") && !playwrightCode.includes("{ page");
+        const effectiveStandingMode = isApiTest2 ? authStandingMode ?? "legacy-if-configured" : "none";
         const resolvedExtraHeaders = (0, api_auth_headers_js_1.resolveApiAuthHeaders)({
           explicit: extraHttpHeaders,
-          isApiTest: isApiTest2,
+          standingHeadersMode: effectiveStandingMode,
           apiAuthHeadersVar: testVariables?.API_AUTH_HEADERS
         });
+        standingNeedleMatcher = (0, shared_1.buildNeedleMatcher)(resolvedExtraHeaders ? Object.values(resolvedExtraHeaders) : []);
         const cssDisableSetup = `
 const __qaLiveBrowserStateFile = process.env.VALIDATE_LIVE_BROWSER_STATE_PATH;
 let __qaLiveBrowserInterval: ReturnType<typeof setInterval> | null = null;
@@ -76606,6 +76955,18 @@ test.afterEach(async ({ page }, testInfo) => {
           logs2.push("\u26A0 Could not find @playwright/test import - animation disabling NOT injected");
         }
         const useScopedApiHeaders = isApiTest2 && !!resolvedExtraHeaders && !!importMatch && !!baseUrl;
+        const authDelivery = { standingHeadersConfigured: !!resolvedExtraHeaders, standingHeadersInjected: useScopedApiHeaders };
+        if (resolvedExtraHeaders && !useScopedApiHeaders) {
+          logs2.push("\u26A0 Standing API auth headers were configured but could not be installed origin-scoped \u2014 failing closed (no global fallback).");
+          return {
+            passed: false,
+            stepResults: [],
+            screenshots: [],
+            logs: logs2.join("\n"),
+            error: 'CONFIG_ISSUE: Standing API auth headers were configured but could not be installed origin-scoped (needs a rewritable `import { test } from "@playwright/test"` and BASE_URL); refusing to attach them globally to avoid an off-origin credential leak.',
+            authDelivery
+          };
+        }
         let instrumentedCode;
         if (isApiTest2) {
           instrumentedCode = useScopedApiHeaders ? playwrightCode.replace(importMatch[0], importMatch[0].replace(/from\s+['"]@playwright\/test['"]/, "from './qa-api-fixtures'")) : playwrightCode;
@@ -76629,7 +76990,7 @@ test.afterEach(async ({ page }, testInfo) => {
         const absHarPath = wantHar ? (0, path_1.join)(runDir, "session.har").replace(/\\/g, "/") : null;
         const recordHarLine = absHarPath ? `recordHar: { path: ${JSON.stringify(absHarPath)}, mode: 'full' },` : "";
         const storageStateLine = storageStatePath ? `storageState: ${JSON.stringify(storageStatePath.replace(/\\/g, "/"))},` : "";
-        const extraHeadersLine = resolvedExtraHeaders && !useScopedApiHeaders && Object.keys(resolvedExtraHeaders).length > 0 ? `extraHTTPHeaders: ${JSON.stringify(resolvedExtraHeaders)},` : "";
+        const extraHeadersLine = "";
         const launchArgs = IS_CLOUD2 ? "args: ['--no-sandbox', '--disable-setuid-sandbox', '--disable-blink-features=AutomationControlled', '--disable-dev-shm-usage', '--disable-gpu', '--disable-software-rasterizer', '--no-zygote', '--disable-accelerated-2d-canvas', '--js-flags=--max-old-space-size=512']," : "args: ['--disable-blink-features=AutomationControlled'],";
         const config = `
 // Plain object export - no require('@playwright/test') needed.
@@ -76767,7 +77128,7 @@ ${passed ? "\u2705" : "\u274C"} Test ${passed ? "PASSED" : "FAILED"}${error2 ? `
             logs2.push(`\u26A0 HAR parse skipped: ${msg.slice(0, 200)}`);
           }
         }
-        return {
+        const nativeResult = {
           passed,
           stepResults,
           screenshots,
@@ -76776,19 +77137,24 @@ ${passed ? "\u2705" : "\u274C"} Test ${passed ? "PASSED" : "FAILED"}${error2 ? `
           harApiCalls,
           logs: logs2.join("\n"),
           error: passed ? void 0 : error2,
-          suspiciousPass
+          suspiciousPass,
+          authDelivery
         };
+        if (!standingNeedleMatcher)
+          return nativeResult;
+        return (0, shared_1.redactNeedlesDeep)(nativeResult, standingNeedleMatcher);
       } catch (fatalErr) {
         const msg = fatalErr instanceof Error ? fatalErr.message : String(fatalErr);
         logs2.push(`
 \u{1F4A5} Fatal error: ${msg}`);
-        return {
+        const fatalResult = {
           passed: false,
           stepResults: [],
           screenshots,
           logs: logs2.join("\n"),
           error: msg
         };
+        return standingNeedleMatcher ? (0, shared_1.redactNeedlesDeep)(fatalResult, standingNeedleMatcher) : fatalResult;
       } finally {
         await callbackProxy?.close().catch(() => {
         });
@@ -85892,7 +86258,7 @@ ${elementContext}${formContext}${observationContext}${interactionContext}${lowCo
       }
       return result;
     }
-    function escapeRegExp(value) {
+    function escapeRegExp2(value) {
       return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     }
     function buildSensitiveEnvReplacements(testVariables) {
@@ -85914,7 +86280,7 @@ ${elementContext}${formContext}${observationContext}${interactionContext}${lowCo
       for (const replacement of buildSensitiveEnvReplacements(testVariables)) {
         if (replacement.value.includes("\n") || replacement.value.includes("\r"))
           continue;
-        const literalPattern = new RegExp(`(['"\`])${escapeRegExp(replacement.value)}\\1`, "g");
+        const literalPattern = new RegExp(`(['"\`])${escapeRegExp2(replacement.value)}\\1`, "g");
         result = result.replace(literalPattern, replacement.envRef);
       }
       return result;
@@ -255170,7 +255536,7 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
             }
           }
           return result;
-          function escapeRegExp(str) {
+          function escapeRegExp2(str) {
             return str.replace(/[-[\]/{}()*+?.\\^$|]/g, "\\$&");
           }
           function getTodoCommentsRegExp() {
@@ -255178,7 +255544,7 @@ ${newComment.split("\n").map((c) => ` * ${c}`).join("\n")}
             const multiLineCommentStart = /(?:\/\*+\s*)/.source;
             const anyNumberOfSpacesAndAsterisksAtStartOfLine = /(?:^(?:\s|\*)*)/.source;
             const preamble = "(" + anyNumberOfSpacesAndAsterisksAtStartOfLine + "|" + singleLineCommentStart + "|" + multiLineCommentStart + ")";
-            const literals = "(?:" + map2(descriptors, (d) => "(" + escapeRegExp(d.text) + ")").join("|") + ")";
+            const literals = "(?:" + map2(descriptors, (d) => "(" + escapeRegExp2(d.text) + ")").join("|") + ")";
             const endOfLineOrEndOfComment = /(?:$|\*\/)/.source;
             const messageRemainder = /(?:.*?)/.source;
             const messagePortion = "(" + literals + messageRemainder + ")";
@@ -303438,7 +303804,7 @@ ${(verifyResult.logs ?? "").slice(0, 2e3)}`;
         confidence: "low"
       };
     }
-    function escapeRegExp(s) {
+    function escapeRegExp2(s) {
       return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     }
     function tryDeterministicStrictModeFix(code, error2) {
@@ -303461,10 +303827,10 @@ ${(verifyResult.logs ?? "").slice(0, 2e3)}`;
       const [, , role, , name, restOfOptions] = violated;
       if (/exact\s*:\s*true/.test(restOfOptions))
         return null;
-      const akaPattern = new RegExp(`aka\\s+getByRole\\(\\s*(['"\`])${escapeRegExp(role)}\\1\\s*,\\s*\\{[^}]*?name:\\s*(['"\`])${escapeRegExp(name)}\\2[^}]*?exact:\\s*true[^}]*\\}\\s*\\)`);
+      const akaPattern = new RegExp(`aka\\s+getByRole\\(\\s*(['"\`])${escapeRegExp2(role)}\\1\\s*,\\s*\\{[^}]*?name:\\s*(['"\`])${escapeRegExp2(name)}\\2[^}]*?exact:\\s*true[^}]*\\}\\s*\\)`);
       if (!akaPattern.test(error2))
         return null;
-      const codePattern = new RegExp(`(getByRole\\(\\s*(['"\`])${escapeRegExp(role)}\\2\\s*,\\s*\\{[^}]*?name:\\s*(['"\`])${escapeRegExp(name)}\\3)([^}]*\\})`, "g");
+      const codePattern = new RegExp(`(getByRole\\(\\s*(['"\`])${escapeRegExp2(role)}\\2\\s*,\\s*\\{[^}]*?name:\\s*(['"\`])${escapeRegExp2(name)}\\3)([^}]*\\})`, "g");
       let modified = false;
       const patched = code.replace(codePattern, (full, prefix, _q1, _q2, suffix) => {
         if (/exact\s*:\s*true/.test(suffix))
@@ -303481,11 +303847,11 @@ ${(verifyResult.logs ?? "").slice(0, 2e3)}`;
       const [, , text, optionsBlock] = violated;
       if (optionsBlock && /exact\s*:\s*true/.test(optionsBlock))
         return null;
-      const akaPattern = new RegExp(`aka\\s+getByText\\(\\s*(['"\`])${escapeRegExp(text)}\\1\\s*,\\s*\\{[^}]*?exact:\\s*true[^}]*\\}\\s*\\)`);
+      const akaPattern = new RegExp(`aka\\s+getByText\\(\\s*(['"\`])${escapeRegExp2(text)}\\1\\s*,\\s*\\{[^}]*?exact:\\s*true[^}]*\\}\\s*\\)`);
       if (!akaPattern.test(error2))
         return null;
-      const noOptsPattern = new RegExp(`getByText\\(\\s*(['"\`])${escapeRegExp(text)}\\1\\s*\\)`, "g");
-      const withOptsPattern = new RegExp(`(getByText\\(\\s*(['"\`])${escapeRegExp(text)}\\2\\s*,\\s*\\{)([^}]*\\})`, "g");
+      const noOptsPattern = new RegExp(`getByText\\(\\s*(['"\`])${escapeRegExp2(text)}\\1\\s*\\)`, "g");
+      const withOptsPattern = new RegExp(`(getByText\\(\\s*(['"\`])${escapeRegExp2(text)}\\2\\s*,\\s*\\{)([^}]*\\})`, "g");
       let modified = false;
       let patched = code.replace(noOptsPattern, (_full, q) => {
         modified = true;
@@ -321442,9 +321808,9 @@ var require_tool_ledger = __commonJS({
       const ledgerPath = (0, node_path_1.join)(runDir, "discovery-events.jsonl");
       let checkpointIndex = 0;
       let headerWritten = false;
-      const escapeRegExp = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      const escapeRegExp2 = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
       const credentialScrubbers = Array.from(credentialEnvMap.entries()).filter(([, value]) => typeof value === "string" && value.length > 0).sort((a, b) => b[1].length - a[1].length).map(([envName, value]) => ({
-        re: new RegExp(escapeRegExp(value), "g"),
+        re: new RegExp(escapeRegExp2(value), "g"),
         replacement: `[REDACTED_${envName}]`
       }));
       const scrubCredentials = (text) => {
@@ -323604,6 +323970,7 @@ Explore complete: ${exploreResult.pagesDiscovered} pages, ${exploreResult.elemen
           testBudget
         }, {
           modelOverride: ctx.planModel ?? ctx.generateModel,
+          gateModelOverride: ctx.planGateModel,
           onAICall
         });
         logs2.push(...planResult.logs);
@@ -324182,6 +324549,7 @@ Plan (reused): ${resumeSavedScenarios.length} scenarios from the paused run.`);
             testBudget: featureTestBudget
           }, {
             modelOverride: ctx.planModel ?? ctx.generateModel,
+            gateModelOverride: ctx.planGateModel,
             onAICall
           });
           logs2.push(...planResult.logs);
@@ -337993,7 +338361,7 @@ var require_package4 = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.43",
+      version: "1.0.44",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"
@@ -338111,32 +338479,24 @@ var import_runner_core12 = __toESM(require_dist2());
 
 // src/services/auth-state.ts
 init_dist();
-var INLINE_LOGIN_TAG = "@inline-login";
 var GUARDED_LOGIN_TAG = "@auth-guarded";
 function sharedAuthInjectEnabled() {
   return isSharedAuthInjectEnabled();
 }
-function hasGeneratedAuthGuard(playwrightCode) {
+function hasGeneratedAuthGuard2(playwrightCode) {
   if (!playwrightCode) return false;
   return /\/\/ >>> VALIDATE_QA_AUTH v\d+\b[\s\S]*?process\.env\.AUTH_FILE[\s\S]*?\/\/ <<< VALIDATE_QA_AUTH v\d+\b/.test(playwrightCode);
 }
 function shouldCaptureAuthState(tags, playwrightCode) {
-  return sharedAuthInjectEnabled() && Array.isArray(tags) && tags.includes("@needs-auth") && tags.includes(GUARDED_LOGIN_TAG) && !tags.includes("@auth") && hasGeneratedAuthGuard(playwrightCode);
-}
-function hasInlineLoginSteps(playwrightCode) {
-  if (!playwrightCode) return false;
-  return /process\.env\.TEST_USER_EMAIL!?/.test(playwrightCode) && /process\.env\.TEST_USER_PASSWORD!?/.test(playwrightCode);
+  return sharedAuthInjectEnabled() && Array.isArray(tags) && tags.includes("@needs-auth") && tags.includes(GUARDED_LOGIN_TAG) && !tags.includes("@auth") && hasGeneratedAuthGuard2(playwrightCode);
 }
 function shouldUseAuthState(tags, playwrightCode) {
   if (!sharedAuthInjectEnabled()) return false;
   if (!Array.isArray(tags)) return false;
-  if (tags.includes("@auth")) return false;
-  if (tags.includes("@api")) return true;
-  if (!tags.includes("@needs-auth")) return false;
-  if (tags.includes(GUARDED_LOGIN_TAG) && hasGeneratedAuthGuard(playwrightCode)) return true;
-  const isGeneratedVariant = tags.includes("@edge") || tags.includes("@bug");
-  const hasLegacyInlineLogin = tags.includes("@discovered") && !isGeneratedVariant && hasInlineLoginSteps(playwrightCode);
-  return !tags.includes(INLINE_LOGIN_TAG) && !hasLegacyInlineLogin;
+  return authPlanFor(tags, playwrightCode).needsCookieState;
+}
+function authPlanFor(tags, playwrightCode) {
+  return deriveAuthPlan(tags, playwrightCode, { sharedAuthInjectEnabled: sharedAuthInjectEnabled() });
 }
 
 // src/version-check.ts
@@ -345535,7 +345895,18 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
     requestLiveBrowserHeartbeat();
   }, 5e3);
   liveBrowserHeartbeatInterval.unref?.();
+  const authPlan = authPlanFor(run2.tags, run2.playwrightCode);
+  const runAuthCachePath = (0, import_runner_core12.localAuthStatePaths)(getRunsDir(), {
+    projectId: run2.projectId || opts.projectId || "default",
+    serverUrl: opts.serverUrl,
+    baseUrl: run2.baseUrl,
+    testVariables: run2.testVariables,
+    authToken: opts.authToken
+  }, run2.runId).cachePath;
+  const wrapperStorageStatePath = authPlan.needsCookieState && runMode !== "auth-setup" ? (0, import_runner_core12.getValidLocalAuthState)(runAuthCachePath) : void 0;
   const runNativeWithLiveBrowser = (nativeOptions) => (0, import_runner_core.executeTestViaNativePlaywright)({
+    authStandingMode: authPlan.standingHeadersMode,
+    storageStatePath: wrapperStorageStatePath,
     ...nativeOptions,
     liveBrowserHandle,
     onLiveBrowserSnapshot: requestLiveBrowserHeartbeat
@@ -345563,11 +345934,24 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
       if (!run2.baseUrl) {
         preflightError = "Pre-flight failed: Missing BASE_URL. Configure it in Test Data \u2192 Test Variables.";
       } else {
-        const needsAuth = Array.isArray(run2.tags) && run2.tags.some((t) => t === "@auth" || t === "@needs-auth" || t === "@api");
-        if (needsAuth && !run2.testVariables?.["TEST_USER_EMAIL"]) {
-          preflightError = "Pre-flight failed: Missing TEST_USER_EMAIL. Tests tagged @auth, @needs-auth, or @api require login credentials.";
-        } else if (needsAuth && !run2.testVariables?.["TEST_USER_PASSWORD"]) {
-          preflightError = "Pre-flight failed: Missing TEST_USER_PASSWORD. Tests tagged @auth, @needs-auth, or @api require login credentials.";
+        const validStanding = (0, import_runner_core13.parseApiAuthHeaders)(run2.testVariables?.["API_AUTH_HEADERS"]) !== void 0;
+        if (authPlan.configurationError) {
+          preflightError = `Pre-flight failed: ${authPlan.configurationError}. Fix the test's auth-type tag before running.`;
+        } else if (authPlan.needsStandingHeaders && !validStanding) {
+          preflightError = "Pre-flight failed: This @auth-standing @api test requires a valid API_AUTH_HEADERS JSON object (header name \u2192 value).";
+        } else {
+          const legacyHeaderBypass = authPlan.source === "legacy" && authPlan.standingHeadersMode === "legacy-if-configured" && validStanding;
+          const code = run2.playwrightCode ?? "";
+          const codeProvided = code.trim().length > 0;
+          const codeUsesCreds = codeProvided && /TEST_USER_EMAIL|TEST_USER_PASSWORD|__vqaLogin/.test(code);
+          const tags = Array.isArray(run2.tags) ? run2.tags : [];
+          const isHallucinationShape = codeProvided && !codeUsesCreds && tags.includes("@inline-login") && !tags.includes("@api");
+          const requireCreds = authPlan.needsLoginCreds && !legacyHeaderBypass && !isHallucinationShape;
+          if (requireCreds && !run2.testVariables?.["TEST_USER_EMAIL"]?.trim()) {
+            preflightError = "Pre-flight failed: Missing TEST_USER_EMAIL. Tests that log in (tagged @auth, @needs-auth, @api, @auth-cookie-state, @auth-login-cookie, or @auth-login-bearer) require login credentials.";
+          } else if (requireCreds && !run2.testVariables?.["TEST_USER_PASSWORD"]?.trim()) {
+            preflightError = "Pre-flight failed: Missing TEST_USER_PASSWORD. Tests that log in (tagged @auth, @needs-auth, @api, @auth-cookie-state, @auth-login-cookie, or @auth-login-bearer) require login credentials.";
+          }
         }
       }
       if (preflightError) {
@@ -346176,10 +346560,13 @@ ${finalVerifyResult.logs ?? ""}`;
             });
             if (healRes.ok) {
               const { healedCode } = await healRes.json();
+              const failedTestPlan = authPlanFor(failedTest.tags, healedCode);
               const verifyResult = await runNativeWithLiveBrowser({
                 playwrightCode: healedCode,
                 baseUrl: run2.baseUrl,
                 testVariables: run2.testVariables,
+                storageStatePath: failedTestPlan.needsCookieState ? (0, import_runner_core12.getValidLocalAuthState)(runAuthCachePath) : void 0,
+                authStandingMode: failedTestPlan.standingHeadersMode,
                 validateContext: callbackContext
               });
               results.push({
@@ -347663,6 +348050,10 @@ ${result2.logs}`);
         log.warn(`\u26A0 Rate-limit block detected - posting ERROR (not FAILED) to skip heal/quarantine`);
       }
     }
+    if (runStatus === "FAILED" && classifyErrorMessage(runError ?? null) === "config_issue") {
+      runStatus = "ERROR";
+      log.warn(`\u26A0 CONFIG_ISSUE from native execution - posting ERROR (not FAILED) to skip heal/quarantine`);
+    }
     await postResult(opts.serverUrl, headers, run2.runId, {
       status: runStatus,
       stepResults: result.stepResults,
@@ -347678,7 +348069,7 @@ ${result2.logs}`);
     if (result.passed) {
       log.ok(`PASSED  (${duration}ms)${result.suspiciousPass ? ` \u26A0 suspicious-pass (viewport ${Math.round(result.suspiciousPass.emptyRatio * 100)}% blank)` : ""}`);
     } else if (runStatus === "ERROR") {
-      log.warn(`BLOCKED (${duration}ms) - rate-limit detected, not counted as failure`);
+      log.warn(`BLOCKED (${duration}ms) - environmental block (rate-limit / config-issue), not counted as failure`);
     } else {
       log.fail(`FAILED  (${duration}ms)${result.error ? ` - ${result.error}` : ""}`);
       if (result.logs) {