@validate.qa/runner 1.0.44 → 1.0.46

package/dist/cli.js

@@ -5243,6 +5243,28 @@ var init_feature_flags = __esm({
   }
 });
 
+// ../shared/dist/env-flags.js
+function parseBoolFlag(value, defaultValue = false) {
+  if (value == null)
+    return defaultValue;
+  const v = value.trim().toLowerCase();
+  if (v === "")
+    return defaultValue;
+  if (TRUTHY.has(v))
+    return true;
+  if (FALSY.has(v))
+    return false;
+  return defaultValue;
+}
+var TRUTHY, FALSY;
+var init_env_flags = __esm({
+  "../shared/dist/env-flags.js"() {
+    "use strict";
+    TRUTHY = /* @__PURE__ */ new Set(["true", "1", "yes", "on"]);
+    FALSY = /* @__PURE__ */ new Set(["false", "0", "no", "off"]);
+  }
+});
+
 // ../shared/dist/index.js
 var dist_exports = {};
 __export(dist_exports, {
@@ -5395,6 +5417,7 @@ __export(dist_exports, {
   normalizeTtsVoiceId: () => normalizeTtsVoiceId,
   otherMobilePlatform: () => otherMobilePlatform,
   parenDepthDelta: () => parenDepthDelta,
+  parseBoolFlag: () => parseBoolFlag,
   pickDisplayRun: () => pickDisplayRun,
   pickLatestHealthRun: () => pickLatestHealthRun,
   placeholderizeRecordedMobileAction: () => placeholderizeRecordedMobileAction,
@@ -5450,6 +5473,7 @@ var init_dist = __esm({
     init_redact_needles();
     init_voice_config();
     init_feature_flags();
+    init_env_flags();
   }
 });
 
@@ -6093,12 +6117,13 @@ var require_global_ai_slot_client = __commonJS({
     exports2.acquireGlobalAiSlot = acquireGlobalAiSlot;
     exports2.releaseGlobalAiSlot = releaseGlobalAiSlot;
     var crypto_1 = require("crypto");
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var SERVER_URL = (process.env.SERVER_URL ?? "").replace(/\/$/, "");
     var AUTH_TOKEN = process.env.AUTH_TOKEN || process.env.RUNNER_TOKEN || "";
     var HOLDER = process.env.RUN_ID || `task-${(0, crypto_1.randomUUID)().slice(0, 8)}`;
     var ACQUIRE_HTTP_TIMEOUT_MS = 8e3;
     function isEnabled() {
-      return (process.env.GLOBAL_AI_LIMITER_ENABLED ?? "").trim().toLowerCase() === "true" && SERVER_URL.length > 0 && AUTH_TOKEN.length > 0;
+      return (0, shared_1.parseBoolFlag)(process.env.GLOBAL_AI_LIMITER_ENABLED) && SERVER_URL.length > 0 && AUTH_TOKEN.length > 0;
     }
     function maxWaitMs() {
       const raw = process.env.GLOBAL_AI_ACQUIRE_MAX_WAIT_MS;
@@ -67508,6 +67533,7 @@ var require_snapshot_parser = __commonJS({
     exports2.detectSessionState = detectSessionState;
     exports2.detectReadinessSignals = detectReadinessSignals;
     exports2.detectViewportHints = detectViewportHints;
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var INTERACTIVE_ROLES = /* @__PURE__ */ new Set([
       "textbox",
       "searchbox",
@@ -67688,7 +67714,7 @@ var require_snapshot_parser = __commonJS({
       return e.name;
     }
     function parseSnapshot(snapshotText, options = {}) {
-      const richParse = options.richParse ?? process.env.DISCOVERY_SNAPSHOT_RICH_PARSE === "true";
+      const richParse = options.richParse ?? (0, shared_1.parseBoolFlag)(process.env.DISCOVERY_SNAPSHOT_RICH_PARSE);
       const lines = snapshotText.split("\n");
       const elements = [];
       const liveMessages = [];
@@ -68600,6 +68626,7 @@ var require_discover_ai_planner = __commonJS({
     exports2.validateAIPlannerOutput = validateAIPlannerOutput;
     exports2.buildFallbackPlan = buildFallbackPlan;
     exports2.runAIPlanner = runAIPlanner;
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var ai_provider_js_1 = require_ai_provider();
     var ai_queue_js_1 = require_ai_queue();
     var ai_retry_js_1 = require_ai_retry();
@@ -69878,7 +69905,7 @@ Keep the exact JSON schema { "featureGroups":[...], "scenarios":[...], "reasonin
     async function runAIPlanner(siteMap, evidence, context, options) {
       const logs2 = [];
       const failurePlan = (kind, reason, legacyFallback2) => {
-        const noFallback = context.mode === "survey" && process.env.DISCOVERY_PLANNER_NO_FALLBACK === "true";
+        const noFallback = context.mode === "survey" && (0, shared_1.parseBoolFlag)(process.env.DISCOVERY_PLANNER_NO_FALLBACK);
         if (noFallback) {
           logs2.push(`Planner ${kind} \u2014 NO-FALLBACK: failing survey cleanly instead of fabricating slug features (${reason})`);
           return {
@@ -70265,7 +70292,7 @@ ${JSON.stringify(gatePlan)}`;
       }
       if (context.mode === "survey" && featureGroups.length === 0 && siteMap.pages.length > 0) {
         const hasGroupWorthyEvidence = siteMap.pages.some((p) => (p.forms?.length ?? 0) > 0 || (p.elements?.length ?? 0) > 0);
-        const noFallback = process.env.DISCOVERY_PLANNER_NO_FALLBACK === "true";
+        const noFallback = (0, shared_1.parseBoolFlag)(process.env.DISCOVERY_PLANNER_NO_FALLBACK);
         if (noFallback && !hasGroupWorthyEvidence) {
           return {
             scenarios,
@@ -75514,7 +75541,8 @@ var require_browser_config = __commonJS({
     var promises_1 = require("fs/promises");
     var path_1 = require("path");
     var os_1 = require("os");
-    exports2.IS_CLOUD = process.env.RUNNER_CLOUD === "true";
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
+    exports2.IS_CLOUD = (0, shared_1.parseBoolFlag)(process.env.RUNNER_CLOUD);
     exports2.CLOUD_ARGS = [
       "--no-sandbox",
       "--disable-setuid-sandbox",
@@ -75656,7 +75684,7 @@ var require_browser_config = __commonJS({
       }
     }
     function isHeadless2() {
-      return exports2.IS_CLOUD || process.env.PLAYWRIGHT_HEADLESS === "true" || process.env.NODE_ENV === "production";
+      return exports2.IS_CLOUD || (0, shared_1.parseBoolFlag)(process.env.PLAYWRIGHT_HEADLESS) || process.env.NODE_ENV === "production";
     }
     function getSlowMoMs() {
       const raw = process.env.PLAYWRIGHT_SLOWMO;
@@ -76728,7 +76756,7 @@ var require_playwright_native = __commonJS({
     Object.defineProperty(exports2, "scrubHarRequestBody", { enumerable: true, get: function() {
       return api_call_redaction_js_2.scrubHarRequestBody;
     } });
-    var IS_CLOUD2 = process.env.RUNNER_CLOUD === "true";
+    var IS_CLOUD2 = (0, shared_1.parseBoolFlag)(process.env.RUNNER_CLOUD);
     var PACKAGE_DIR = (0, path_1.resolve)(__dirname, "..", "..");
     var RUNS_DIR = process.env.RUNS_DIR || (0, path_1.join)(PACKAGE_DIR, ".qa-runs");
     var PW_CLI = require.resolve("@playwright/test/cli");
@@ -76972,7 +77000,7 @@ test.afterEach(async ({ page }, testInfo) => {
         if (useScopedApiHeaders && resolvedExtraHeaders) {
           await (0, promises_1.writeFile)((0, path_1.join)(runDir, "qa-api-fixtures.ts"), (0, api_auth_headers_js_1.buildOriginScopedApiFixtures)(resolvedExtraHeaders, baseUrl));
         }
-        const headless = process.env.PLAYWRIGHT_HEADLESS === "true" || process.env.NODE_ENV === "production" || IS_CLOUD2;
+        const headless = (0, shared_1.parseBoolFlag)(process.env.PLAYWRIGHT_HEADLESS) || process.env.NODE_ENV === "production" || IS_CLOUD2;
         logs2.push(`\u2699\uFE0F  Config: baseURL=${JSON.stringify(baseUrl)}, headless=${headless}${isApiTest2 ? ", API mode (no screenshot/video)" : ""}`);
         const absTestDir = runDir.replace(/\\/g, "/");
         const absResultsFile = (0, path_1.join)(runDir, "results.json").replace(/\\/g, "/");
@@ -78678,6 +78706,7 @@ var require_instrumented_context = __commonJS({
     var mcp_1 = require("@playwright/mcp");
     var index_js_1 = require("@modelcontextprotocol/sdk/client/index.js");
     var inMemory_js_1 = require("@modelcontextprotocol/sdk/inMemory.js");
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var browser_config_js_1 = require_browser_config();
     var health_observer_js_1 = require_health_observer();
     var live_network_collector_js_1 = require_live_network_collector();
@@ -78695,7 +78724,7 @@ var require_instrumented_context = __commonJS({
     var OWNED_BROWSER_CLOSE_TIMEOUT_MS = intEnv("INSTRUMENTED_OWNED_BROWSER_CLOSE_TIMEOUT_MS", 1e4);
     var CLEANUP_TIMEOUT_MS = intEnv("INSTRUMENTED_CLEANUP_TIMEOUT_MS", 1e4);
     function liveCaptureAllowed(mode) {
-      if ((process.env.LIVE_NETWORK_COLLECTOR_ENABLED ?? "").toLowerCase() !== "true")
+      if (!(0, shared_1.parseBoolFlag)(process.env.LIVE_NETWORK_COLLECTOR_ENABLED))
         return false;
       if (!mode)
         return false;
@@ -79158,6 +79187,7 @@ var require_snapshot_observation = __commonJS({
     exports2.qualifyElementLabel = qualifyElementLabel;
     exports2.isConsentOverlayElement = isConsentOverlayElement;
     var snapshot_parser_js_1 = require_snapshot_parser();
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var GENERIC_LABEL_RE = /^(input field|textbox|button|link|item|field|value|tab)$/i;
     var NOISE_LABEL_RE = /^(skip\s+to|skip\s+nav|back\s+to\s+top|cookie|accept\s+(all\s+)?cookies)$/i;
     var CONSENT_OVERLAY_LABEL_RE = /\bcookies?\b|\bgdpr\b|\bconsent\b|privacy (?:policy|preferences|settings)/i;
@@ -79490,8 +79520,8 @@ var require_snapshot_observation = __commonJS({
       const metrics = page.snapshotMetrics ?? page.snapshotArtifact?.metrics;
       const sourceKind = page.snapshotMeta?.sourceKind ?? page.snapshotArtifact?.sourceKind ?? "missing";
       const artifact = page.snapshotArtifact;
-      const richRender = options.richRender ?? process.env.DISCOVERY_SNAPSHOT_RICH_RENDER === "true";
-      const rowActionCensus = richRender && options.mode !== "survey" && (options.rowActionCensus ?? process.env.DISCOVERY_SNAPSHOT_ROW_CENSUS === "true");
+      const richRender = options.richRender ?? (0, shared_1.parseBoolFlag)(process.env.DISCOVERY_SNAPSHOT_RICH_RENDER);
+      const rowActionCensus = richRender && options.mode !== "survey" && (options.rowActionCensus ?? (0, shared_1.parseBoolFlag)(process.env.DISCOVERY_SNAPSHOT_ROW_CENSUS));
       const activeScope = inferActiveSnapshotScope(page);
       const ranked = rankSnapshotElements(getScopedSnapshotElements(page, activeScope), withScopeContext({ ...context, richRank: richRender }, activeScope));
       const allInteractive = ranked.filter(({ element }) => isInteractiveCandidate(element)).filter(({ element }) => {
@@ -80373,6 +80403,7 @@ var require_snapshot_context_compactor = __commonJS({
     exports2.compactSnapshotMessages = compactSnapshotMessages;
     exports2.formatSnapshotCompactionLog = formatSnapshotCompactionLog;
     var crypto_1 = require("crypto");
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var DEFAULT_MAX_TOOL_RESULT_CHARS = 15e3;
     var DEFAULT_MAX_DUPLICATE_SNAPSHOT_CHARS = 1400;
     var DEFAULT_MAX_TOTAL_SNAPSHOT_CHARS = 45e3;
@@ -80382,7 +80413,7 @@ var require_snapshot_context_compactor = __commonJS({
         maxSnapshotChars: options.maxSnapshotChars ?? DEFAULT_MAX_TOOL_RESULT_CHARS,
         maxDuplicateSnapshotChars: options.maxDuplicateSnapshotChars ?? DEFAULT_MAX_DUPLICATE_SNAPSHOT_CHARS,
         maxTotalSnapshotChars: options.maxTotalSnapshotChars ?? DEFAULT_MAX_TOTAL_SNAPSHOT_CHARS,
-        compactStructuredJson: options.compactStructuredJson ?? process.env.DISCOVERY_SNAPSHOT_STRUCTURED_COMPACT !== "false"
+        compactStructuredJson: options.compactStructuredJson ?? (0, shared_1.parseBoolFlag)(process.env.DISCOVERY_SNAPSHOT_STRUCTURED_COMPACT, true)
       };
     }
     function extractSnapshotBlock(content) {
@@ -88423,14 +88454,14 @@ Do NOT add steps you did not execute. Do NOT skip steps from the recording.${led
                     revealedControls,
                     // Opt-in additive-contradiction gate (see assertion-strength.ts). On Fargate this
                     // env must be dispatcher-forwarded to take effect here; off → byte-identical.
-                    flagContradictedAdditions: process.env.STRENGTH_ADDITIVE_CONTRADICTION_GATE === "true"
+                    flagContradictedAdditions: (0, shared_1.parseBoolFlag)(process.env.STRENGTH_ADDITIVE_CONTRADICTION_GATE)
                   });
                 } catch (err) {
                   logs2.push(`    Strength gate errored \u2014 skipping (fail-open): ${String(err)}`);
                 }
                 const verifyCallsSinceLastFinish = verifyCallCount - verifyCallsAtLastFinishGenerate;
                 verifyCallsAtLastFinishGenerate = verifyCallCount;
-                const bugWitnessEnabled = process.env.DISCOVERY_BUG_WITNESS_ENABLED === "true";
+                const bugWitnessEnabled = (0, shared_1.parseBoolFlag)(process.env.DISCOVERY_BUG_WITNESS_ENABLED);
                 const bugWitnessVerdict = bugWitnessEnabled ? resolveSuspectedBugVerdict(suspectedBugDeclared, bugDescription, verifyCallsSinceLastFinish, strengthVerdict?.signals) : null;
                 if (bugWitnessVerdict) {
                   strengthVerdict = bugWitnessVerdict;
@@ -305687,11 +305718,12 @@ var require_bootstrap_grok_auth = __commonJS({
     exports2.seedGrokMcpConfigIfNeeded = seedGrokMcpConfigIfNeeded;
     var node_fs_1 = __importDefault(require("fs"));
     var node_path_1 = __importDefault(require("path"));
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     function seedGrokAuthIfNeeded() {
       const home = process.env.HOME ?? "/home/appuser";
       const authPath = node_path_1.default.join(home, ".grok", "auth.json");
       const b64 = process.env.GROK_AUTH_JSON_B64;
-      const force = process.env.GROK_AUTH_FORCE_RESEED === "true" || process.env.GROK_AUTH_FORCE_RESEED === "1";
+      const force = (0, shared_1.parseBoolFlag)(process.env.GROK_AUTH_FORCE_RESEED) || process.env.GROK_AUTH_FORCE_RESEED === "1";
       if (!force && node_fs_1.default.existsSync(authPath)) {
         return;
       }
@@ -307081,7 +307113,7 @@ Output the JSON envelope exactly ONCE as your final message, then exit.`;
       return (0, shared_1.buildSanitizedAgentEnv)({ extra });
     }
     async function runGrokHealSession(opts) {
-      const subagentsEnabled = (process.env.GROK_HEAL_SUBAGENTS ?? "").toLowerCase() === "true";
+      const subagentsEnabled = (0, shared_1.parseBoolFlag)(process.env.GROK_HEAL_SUBAGENTS);
       const args = [
         "-p",
         'Read BRIEF.md in this directory. Heal TEST_UNDER_HEAL.spec.ts as instructed. Your FINAL assistant message MUST be ONLY a JSON object \u2014 no prose around it \u2014 with this shape: {"verdict":"fix|app_bug|config_issue|prereq_unmet|state_stale|test_invalid","playwrightCode":"<full file if verdict=fix>","changeDescription":"<one sentence>","reason":"<terse, when not fix>","confidence":"high|medium|low"}',
@@ -312860,6 +312892,7 @@ var require_discover_explorer = __commonJS({
     var ai_provider_js_1 = require_ai_provider();
     var snapshot_parser_js_1 = require_snapshot_parser();
     var scrub_credentials_js_1 = require_scrub_credentials();
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var credential_tools_js_1 = require_credential_tools();
     var inbox_tools_js_1 = require_inbox_tools();
     var verification_inbox_js_1 = require_verification_inbox();
@@ -313635,7 +313668,7 @@ ${credentialBlock}${redactedBlock}${inboxBlock}`;
       const collectedPages = [];
       const collectedTransitions = [];
       const observedOriginCounts = /* @__PURE__ */ new Map();
-      const captureOriginSignals = (process.env.APP_ORIGIN_RESOLUTION ?? "").toLowerCase() === "true";
+      const captureOriginSignals = (0, shared_1.parseBoolFlag)(process.env.APP_ORIGIN_RESOLUTION);
       const buildObservedOrigins = () => [...observedOriginCounts.entries()].sort((a, b) => b[1] - a[1]).map(([o]) => o);
       logs2.push(`Explorer starting - provider: ${provider}, model: ${agentModel}`);
       logs2.push(`Base URL: ${baseUrl}`);
@@ -313657,7 +313690,7 @@ ${credentialBlock}${redactedBlock}${inboxBlock}`;
       const v3Env = process.env.DISCOVERY_PROMPT_V3;
       const useV3 = v3Env !== "false";
       const useV2 = true;
-      const perceptionEnricherEnabled = (process.env.DISCOVERY_PERCEPTION_ENRICHER === "true" || process.env.DISCOVERY_PERCEPTION_ENRICHER === "1") && typeof options?.getPerceptionPage === "function";
+      const perceptionEnricherEnabled = ((0, shared_1.parseBoolFlag)(process.env.DISCOVERY_PERCEPTION_ENRICHER) || process.env.DISCOVERY_PERCEPTION_ENRICHER === "1") && typeof options?.getPerceptionPage === "function";
       const linkFrontierEnabled = (0, survey_link_frontier_js_1.isSurveyLinkFrontierEnabled)() && options?.mode === "survey";
       const linkScope = (0, survey_link_frontier_js_1.deriveLinkScope)(baseUrl);
       let finishRedirects = 0;
@@ -313812,7 +313845,7 @@ ${inboxPromptBlock}`;
         let lastBriefRoute = "";
         let lastBriefIteration = 0;
         const BRIEF_INTERVAL = 5;
-        const stuckDetectorEnabled = process.env.DISCOVERY_STUCK_DETECTOR === "1" || process.env.DISCOVERY_STUCK_DETECTOR === "true";
+        const stuckDetectorEnabled = process.env.DISCOVERY_STUCK_DETECTOR === "1" || (0, shared_1.parseBoolFlag)(process.env.DISCOVERY_STUCK_DETECTOR);
         const stuckDetector = stuckDetectorEnabled ? new stuck_detector_js_1.StuckDetector({ repetitionReachesRecovery: !isDeepMode }) : null;
         while (iteration < maxIterations && !explorationComplete) {
           iteration++;
@@ -316319,6 +316352,8 @@ var require_auth_capture_run = __commonJS({
   "../runner-core/dist/services/auth-capture-run.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.filterLoginCaptureCredentials = filterLoginCaptureCredentials;
+    exports2.buildLoginCaptureCredentials = buildLoginCaptureCredentials;
     exports2.getLoginCaptureMaxIterations = getLoginCaptureMaxIterations;
     exports2.harvestAuthProofLive = harvestAuthProofLive;
     exports2.findCredentialLiteralLeaks = findCredentialLiteralLeaks;
@@ -316334,6 +316369,26 @@ var require_auth_capture_run = __commonJS({
     var playwright_native_js_1 = require_playwright_native();
     var scrub_credentials_js_1 = require_scrub_credentials();
     var credential_tools_js_1 = require_credential_tools();
+    var LOGIN_CAPTURE_CONTROL_VARIABLES = /* @__PURE__ */ new Set([
+      "BASE_URL",
+      "DISCOVERY_SHOULD_REGISTER",
+      "DISCOVERY_AUTH_MODE"
+    ]);
+    function filterLoginCaptureCredentials(variables) {
+      const credentials = {};
+      for (const [key, value] of Object.entries(variables)) {
+        if ((0, auth_recipe_js_1.isReservedRunnerEnvVar)(key) || LOGIN_CAPTURE_CONTROL_VARIABLES.has(key))
+          continue;
+        credentials[key] = value;
+      }
+      return credentials;
+    }
+    function buildLoginCaptureCredentials(variableContext) {
+      return filterLoginCaptureCredentials({
+        ...variableContext.publicTestVariables,
+        ...variableContext.allTestVariables
+      });
+    }
     var DEFAULT_MAX_LOGIN_CAPTURE_ITERATIONS = 12;
     function readPositiveIntEnv2(env, name, fallback) {
       const raw = env[name]?.trim();
@@ -316541,7 +316596,8 @@ ${keyLines || "- (none provided)"}
       return false;
     }
     async function runLoginCaptureRun(args) {
-      const { loginBrowser, baseUrl, credentials, projectId, model, onAudit, logs: logs2 } = args;
+      const { loginBrowser, baseUrl, projectId, model, onAudit, logs: logs2 } = args;
+      const credentials = filterLoginCaptureCredentials(args.credentials);
       if ((0, agentic_cli_constants_js_1.getAgenticEngine)(model) !== "native") {
         logs2(`  auth-capture skipped: engine for ${model} is not native (V1 is native-engine-only)`);
         return null;
@@ -317999,6 +318055,7 @@ var require_discovery_verify_pool = __commonJS({
     var node_path_1 = require("path");
     var playwright_native_js_1 = require_playwright_native();
     var scrub_credentials_js_1 = require_scrub_credentials();
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var discover_generator_js_1 = require_discover_generator();
     var canvas_detector_js_1 = require_canvas_detector();
     var agentic_discovery_prompts_js_1 = require_agentic_discovery_prompts();
@@ -318658,7 +318715,7 @@ var require_discovery_verify_pool = __commonJS({
       log2(`ledger: persisted ${scenarioLedgers.size} ledger file(s) to ${ledgerDir}`);
     }
     function startAuthoredWatcher(args) {
-      if (process.env.DISCOVERY_AUTHORED_STREAMING !== "true") {
+      if (!(0, shared_1.parseBoolFlag)(process.env.DISCOVERY_AUTHORED_STREAMING)) {
         return { stop: () => {
         }, count: () => 0 };
       }
@@ -319062,6 +319119,7 @@ var require_grok_discovery_runner = __commonJS({
     var node_fs_1 = require("fs");
     var node_os_1 = require("os");
     var node_path_1 = require("path");
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var instrumented_context_js_1 = require_instrumented_context();
     var exploration_parser_js_1 = require_exploration_parser();
     var bootstrap_grok_auth_js_1 = require_bootstrap_grok_auth();
@@ -319092,7 +319150,7 @@ var require_grok_discovery_runner = __commonJS({
     var DEFAULT_TARGET = { min: 6, max: 15 };
     var WATCHER_DEBOUNCE_MS = 500;
     var MAX_PLAN_REVISIONS = 3;
-    var LEGACY_PLAN_MODE = process.env.USE_LEGACY_GROK_DISCOVERY === "true";
+    var LEGACY_PLAN_MODE = (0, shared_1.parseBoolFlag)(process.env.USE_LEGACY_GROK_DISCOVERY);
     var SNAPSHOT_EXCERPT_CHARS = 150;
     function isObject(v) {
       return typeof v === "object" && v !== null && !Array.isArray(v);
@@ -319243,7 +319301,7 @@ var require_grok_discovery_runner = __commonJS({
       return out;
     }
     async function runGrokDiscoveryOnRunner(ctx, callbackOptions, options = {}) {
-      if (process.env.USE_GROK_DISCOVERY_V2 === "true") {
+      if ((0, shared_1.parseBoolFlag)(process.env.USE_GROK_DISCOVERY_V2)) {
         return runGrokDiscoveryV2OnRunner(ctx, callbackOptions, options);
       }
       const featureName = ctx.featureName ?? "Untitled Feature";
@@ -321715,6 +321773,7 @@ var require_tool_ledger = __commonJS({
     var promises_1 = require("fs/promises");
     var node_crypto_1 = require("crypto");
     var node_path_1 = require("path");
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var OTHER_OUTPUT_PREVIEW_CAP = 1024;
     var DEFAULT_SNAPSHOT_BYTES_CAP = 16 * 1024;
     var KNOWN_CREDENTIAL_BEARING_TOOLS = /* @__PURE__ */ new Set([
@@ -321796,7 +321855,7 @@ var require_tool_ledger = __commonJS({
       let seq = 0;
       let turn = 0;
       let lastNavigateUrl = null;
-      const redact = opts.redact ?? process.env.DISCOVERY_LEDGER_REDACT === "true";
+      const redact = opts.redact ?? (0, shared_1.parseBoolFlag)(process.env.DISCOVERY_LEDGER_REDACT);
       const credentialEnvMap = opts.credentialEnvMap ?? /* @__PURE__ */ new Map();
       const maxSnapshotBytes = opts.maxSnapshotBytes ?? DEFAULT_SNAPSHOT_BYTES_CAP;
       const sessionId = (0, node_crypto_1.randomUUID)();
@@ -323417,6 +323476,7 @@ var require_discover_agent = __commonJS({
     var ai_queue_js_1 = require_ai_queue();
     var ai_retry_js_1 = require_ai_retry();
     var strip_json_fences_js_1 = require_strip_json_fences();
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var discover_explorer_js_1 = require_discover_explorer();
     var discover_feature_explorer_js_1 = require_discover_feature_explorer();
     var discover_planner_js_1 = require_discover_planner();
@@ -323510,7 +323570,7 @@ var require_discover_agent = __commonJS({
     }
     function describeRunnerRuntime(launchOpts) {
       const browserMode = launchOpts?.headless === true ? "headless" : launchOpts?.headless === false ? "headed" : "default";
-      const runtime = process.env.RUNNER_CLOUD === "true" ? "cloud runner" : "local runner";
+      const runtime = (0, shared_1.parseBoolFlag)(process.env.RUNNER_CLOUD) ? "cloud runner" : "local runner";
       return `Runtime: ${runtime}, browser mode: ${browserMode}`;
     }
     function formatElapsed(ms) {
@@ -323657,7 +323717,7 @@ Respond with ONLY valid JSON:
     }
     var AUTH_CAPTURE_TIMEOUT_MS = 4 * 60 * 1e3;
     function maybeStartLoginCaptureRun(ctx, callbackOptions, onAICall, pushLog, onObservedOrigins) {
-      if (process.env.AUTH_RECIPE_STAMP !== "true")
+      if (!(0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP))
         return null;
       if (ctx.authRecipe) {
         pushLog(`auth-prologue: reusing persisted login recipe ${ctx.authRecipe.recipeHash} \u2014 skipping capture`);
@@ -323680,7 +323740,7 @@ Respond with ONLY valid JSON:
         pushLog("auth-prologue: AUTH_RECIPE_STAMP on + native engine, but no login-browser factory supplied (runner stage 2b) \u2014 skipping producer");
         return null;
       }
-      const credentials = ctx.variableContext.allTestVariables ?? ctx.variableContext.publicTestVariables;
+      const credentials = (0, auth_capture_run_js_1.buildLoginCaptureCredentials)(ctx.variableContext);
       const run2 = (async () => {
         let lease = null;
         try {
@@ -323743,7 +323803,7 @@ Respond with ONLY valid JSON:
       if (canvasPreflight.probeRan) {
         ctx.appRenderType = canvasPreflight.renderType;
       }
-      const useNativeOverride = process.env.USE_NATIVE_SURVEY === "true";
+      const useNativeOverride = (0, shared_1.parseBoolFlag)(process.env.USE_NATIVE_SURVEY);
       const surveyEngine = (0, agentic_cli_constants_js_1.getAgenticEngine)(ctx.exploreModel);
       if (isSurvey && surveyEngine !== "native" && !useNativeOverride) {
         logs2.push(`exploreModel=${ctx.exploreModel} \u2192 routing to ${surveyEngine} survey runner`);
@@ -323960,8 +324020,8 @@ Explore complete: ${exploreResult.pagesDiscovered} pages, ${exploreResult.elemen
           // Recipe-aware planning: when a verified login recipe is on file, the planner
           // plans @needs-auth (non-auth-flow) scenarios from the authenticated state
           // instead of authoring landing→login steps (which generate would override).
-          authRecipeAvailable: process.env.AUTH_RECIPE_STAMP === "true" && !!ctx.authRecipe,
-          authRedirectRoute: process.env.AUTH_RECIPE_STAMP === "true" ? ctx.authRecipe?.redirectRoute ?? void 0 : void 0,
+          authRecipeAvailable: (0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP) && !!ctx.authRecipe,
+          authRedirectRoute: (0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP) ? ctx.authRecipe?.redirectRoute ?? void 0 : void 0,
           testBudget
         }, {
           modelOverride: ctx.planModel ?? ctx.generateModel,
@@ -324268,7 +324328,7 @@ Fatal error: ${msg}`);
       if (canvasPreflight.probeRan) {
         ctx.appRenderType = canvasPreflight.renderType;
       }
-      const useNativeDeepOverride = process.env.USE_NATIVE_DEEP === "true";
+      const useNativeDeepOverride = (0, shared_1.parseBoolFlag)(process.env.USE_NATIVE_DEEP);
       const deepEngine = (0, agentic_cli_constants_js_1.getAgenticEngine)(ctx.exploreModel);
       if (deepEngine !== "native" && !useNativeDeepOverride) {
         logs2.push(`exploreModel=${ctx.exploreModel} \u2192 routing to ${deepEngine} deep discovery runner`);
@@ -324539,8 +324599,8 @@ Plan (reused): ${resumeSavedScenarios.length} scenarios from the paused run.`);
             },
             // Recipe-aware planning (feature/deep): plan @needs-auth scenarios from the
             // authenticated state when a verified login recipe is on file for this project.
-            authRecipeAvailable: process.env.AUTH_RECIPE_STAMP === "true" && !!ctx.authRecipe,
-            authRedirectRoute: process.env.AUTH_RECIPE_STAMP === "true" ? ctx.authRecipe?.redirectRoute ?? void 0 : void 0,
+            authRecipeAvailable: (0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP) && !!ctx.authRecipe,
+            authRedirectRoute: (0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP) ? ctx.authRecipe?.redirectRoute ?? void 0 : void 0,
             testBudget: featureTestBudget
           }, {
             modelOverride: ctx.planModel ?? ctx.generateModel,
@@ -325056,6 +325116,7 @@ var require_resource_governor = __commonJS({
     exports2.getResourceGovernorStatus = getResourceGovernorStatus2;
     var fs_1 = require("fs");
     var os_1 = __importDefault(require("os"));
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var DEFAULT_WEIGHTS = {
       run: 1,
       heal: 2.5,
@@ -325202,9 +325263,7 @@ var require_resource_governor = __commonJS({
     }
     function envBool(name, fallback) {
       const raw = process.env[name];
-      if (raw == null || raw === "")
-        return fallback;
-      return raw === "true" || raw === "1" || raw.toLowerCase() === "yes";
+      return (0, shared_1.parseBoolFlag)(raw, fallback);
     }
     function envFloat(name, fallback) {
       const raw = process.env[name];
@@ -337979,9 +338038,9 @@ var require_dist2 = __commonJS({
       for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding(exports3, m, p);
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.MAX_ARCHIVE_BYTES = exports2.isUnsafeEntryName = exports2.extractZipSafely = exports2.downloadArchiveCapped = exports2.detectArchiveKind = exports2.acquireRepoForImport = exports2.runFrameworkImportOnRunner = exports2.getAgenticEngine = exports2.resolveRefFromSnapshot = exports2.replayAuthRecipeIntoBrowser = exports2.runRegisterCaptureRun = exports2.runLoginCaptureRun = exports2.isReservedRunnerEnvVar = exports2.RESERVED_RUNNER_ENV_VARS = exports2.AUTH_MARKER_VERSION = exports2.buildHealAuthStamp = exports2.extractAuthRegion = exports2.upsertAuthBlock = exports2.buildAuthRecipe = exports2.commandToReplayStep = exports2.buildReplayPlan = exports2.absoluteRoute = exports2.renderReplaySettleArrow = exports2.renderReplayClickArrow = exports2.renderAuthFn = exports2.canonicalizeRoute = exports2.executeGrokPerBatchHeal = exports2.executeGrokPerTestHeal = exports2.headerVal = exports2.classifyAuthType = exports2.isTextExcerptable = exports2.isStaticAssetByExt = exports2.isApiCall = exports2.buildApiCallSummary = exports2.computeMobileHealOutcome = exports2.detectMobileStepSecretLeak = exports2.redactMobileSecretsFromText = exports2.MOBILE_LIVE_HEAL_SYSTEM_PROMPT = exports2.MOBILE_SCRIPT_HEAL_SYSTEM_PROMPT = exports2.executeMobileLiveHeal = exports2.executeMobileTestWithHealing = exports2.executeMobileScriptDrivenHeal = exports2.prepareMobileScenarioAppState = exports2.runMobileGeneratePhase = exports2.runMobileAIPlanner = exports2.buildMobileSiteMap = exports2.formatMobileEvidenceForPlanner = exports2.MOBILE_SCENARIO_SYSTEM_PROMPT = exports2.MOBILE_SURVEY_SYSTEM_PROMPT = exports2.runMobileExplorePhase = void 0;
-    exports2.modelSupportsVision = exports2.decideCanvasStrategy = exports2.decideAppRenderType = exports2.detectCanvasApp = exports2.detectRateLimitBlock = exports2.isSafeCanonicalRedirect = exports2.resolveBaseUrlPreflight = exports2.checkBaseUrlRedirect = exports2.stripJsonFences = exports2.scrubCredentials = exports2.withAIRetry = exports2.snapshotMatchingChildren = exports2.findNewChromiumChildPid = exports2.killProcessTree = exports2.gracefulCloseWithTreeKill = exports2.liveBrowserRegistry = exports2.REPO_SWITCH_REMOVED_FRACTION = exports2.MAX_MANIFEST_FILES = exports2.toDiffSummary = exports2.isLikelyTestFile = exports2.sanitizeRepoRelPath = exports2.sha256Hex = exports2.hashFiles = exports2.enumerateTestFiles = exports2.buildNextManifest = exports2.detectRepoSwitch = exports2.classifyImportDiff = exports2.parseImportManifest = exports2.REPO_ANALYSIS_SCHEMA_VERSION = exports2.validateSourceEndpoints = exports2.validateAuthoredTest = exports2.validateRepoMapFile = exports2.validateRepoMemoryFile = exports2.buildTestingStandardsSection = exports2.buildRepoAuthorSystemRules = exports2.buildRepoAuthorKickoff = exports2.buildRepoAuthorContractMd = exports2.buildRepoMapSystemRules = exports2.buildRepoMapKickoff = exports2.buildRepoMapContractMd = exports2.buildRepoMemorySystemRules = exports2.buildRepoMemoryKickoff = exports2.buildRepoMemoryContractMd = exports2.runRepoAnalysisOnRunner = exports2.IMPORT_SCHEMA_VERSION = exports2.validateImportResultFile = exports2.validateImportedTest = exports2.buildImportSystemRules = exports2.buildImportKickoff = exports2.buildImportContractMd = void 0;
-    exports2.UNSUPPORTED_RENDERER_PREFIX = exports2.UnsupportedRendererError = exports2.buildCanvasModeAuthoringAddendum = exports2.buildUnsupportedRendererMessage = void 0;
+    exports2.extractZipSafely = exports2.downloadArchiveCapped = exports2.detectArchiveKind = exports2.acquireRepoForImport = exports2.runFrameworkImportOnRunner = exports2.getAgenticEngine = exports2.resolveRefFromSnapshot = exports2.replayAuthRecipeIntoBrowser = exports2.runRegisterCaptureRun = exports2.runLoginCaptureRun = exports2.filterLoginCaptureCredentials = exports2.buildLoginCaptureCredentials = exports2.isReservedRunnerEnvVar = exports2.RESERVED_RUNNER_ENV_VARS = exports2.AUTH_MARKER_VERSION = exports2.buildHealAuthStamp = exports2.extractAuthRegion = exports2.upsertAuthBlock = exports2.buildAuthRecipe = exports2.commandToReplayStep = exports2.buildReplayPlan = exports2.absoluteRoute = exports2.renderReplaySettleArrow = exports2.renderReplayClickArrow = exports2.renderAuthFn = exports2.canonicalizeRoute = exports2.executeGrokPerBatchHeal = exports2.executeGrokPerTestHeal = exports2.headerVal = exports2.classifyAuthType = exports2.isTextExcerptable = exports2.isStaticAssetByExt = exports2.isApiCall = exports2.buildApiCallSummary = exports2.computeMobileHealOutcome = exports2.detectMobileStepSecretLeak = exports2.redactMobileSecretsFromText = exports2.MOBILE_LIVE_HEAL_SYSTEM_PROMPT = exports2.MOBILE_SCRIPT_HEAL_SYSTEM_PROMPT = exports2.executeMobileLiveHeal = exports2.executeMobileTestWithHealing = exports2.executeMobileScriptDrivenHeal = exports2.prepareMobileScenarioAppState = exports2.runMobileGeneratePhase = exports2.runMobileAIPlanner = exports2.buildMobileSiteMap = exports2.formatMobileEvidenceForPlanner = exports2.MOBILE_SCENARIO_SYSTEM_PROMPT = exports2.MOBILE_SURVEY_SYSTEM_PROMPT = exports2.runMobileExplorePhase = void 0;
+    exports2.decideAppRenderType = exports2.detectCanvasApp = exports2.detectRateLimitBlock = exports2.isSafeCanonicalRedirect = exports2.resolveBaseUrlPreflight = exports2.checkBaseUrlRedirect = exports2.stripJsonFences = exports2.scrubCredentials = exports2.withAIRetry = exports2.snapshotMatchingChildren = exports2.findNewChromiumChildPid = exports2.killProcessTree = exports2.gracefulCloseWithTreeKill = exports2.liveBrowserRegistry = exports2.REPO_SWITCH_REMOVED_FRACTION = exports2.MAX_MANIFEST_FILES = exports2.toDiffSummary = exports2.isLikelyTestFile = exports2.sanitizeRepoRelPath = exports2.sha256Hex = exports2.hashFiles = exports2.enumerateTestFiles = exports2.buildNextManifest = exports2.detectRepoSwitch = exports2.classifyImportDiff = exports2.parseImportManifest = exports2.REPO_ANALYSIS_SCHEMA_VERSION = exports2.validateSourceEndpoints = exports2.validateAuthoredTest = exports2.validateRepoMapFile = exports2.validateRepoMemoryFile = exports2.buildTestingStandardsSection = exports2.buildRepoAuthorSystemRules = exports2.buildRepoAuthorKickoff = exports2.buildRepoAuthorContractMd = exports2.buildRepoMapSystemRules = exports2.buildRepoMapKickoff = exports2.buildRepoMapContractMd = exports2.buildRepoMemorySystemRules = exports2.buildRepoMemoryKickoff = exports2.buildRepoMemoryContractMd = exports2.runRepoAnalysisOnRunner = exports2.IMPORT_SCHEMA_VERSION = exports2.validateImportResultFile = exports2.validateImportedTest = exports2.buildImportSystemRules = exports2.buildImportKickoff = exports2.buildImportContractMd = exports2.MAX_ARCHIVE_BYTES = exports2.isUnsafeEntryName = void 0;
+    exports2.UNSUPPORTED_RENDERER_PREFIX = exports2.UnsupportedRendererError = exports2.buildCanvasModeAuthoringAddendum = exports2.buildUnsupportedRendererMessage = exports2.modelSupportsVision = exports2.decideCanvasStrategy = void 0;
     __exportStar(require_ai_provider(), exports2);
     __exportStar(require_mobile_types(), exports2);
     __exportStar(require_mobile_source_parser(), exports2);
@@ -338130,6 +338189,12 @@ var require_dist2 = __commonJS({
       return auth_recipe_js_1.isReservedRunnerEnvVar;
     } });
     var auth_capture_run_js_1 = require_auth_capture_run();
+    Object.defineProperty(exports2, "buildLoginCaptureCredentials", { enumerable: true, get: function() {
+      return auth_capture_run_js_1.buildLoginCaptureCredentials;
+    } });
+    Object.defineProperty(exports2, "filterLoginCaptureCredentials", { enumerable: true, get: function() {
+      return auth_capture_run_js_1.filterLoginCaptureCredentials;
+    } });
     Object.defineProperty(exports2, "runLoginCaptureRun", { enumerable: true, get: function() {
       return auth_capture_run_js_1.runLoginCaptureRun;
     } });
@@ -338356,7 +338421,7 @@ var require_package4 = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.44",
+      version: "1.0.46",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"
@@ -338495,6 +338560,7 @@ function authPlanFor(tags, playwrightCode) {
 }
 
 // src/version-check.ts
+init_dist();
 var RUNNER_NPM_PACKAGE = "@validate.qa/runner";
 var NPM_LATEST_URL = `https://registry.npmjs.org/${encodeURIComponent(RUNNER_NPM_PACKAGE)}/latest`;
 var DEFAULT_TIMEOUT_MS = 8e3;
@@ -338526,10 +338592,10 @@ function isVersionOutdated(current, latest) {
   return cmp === -1;
 }
 function shouldSkipVersionCheck() {
-  if (process.env.RUNNER_CLOUD === "true") {
+  if (parseBoolFlag(process.env.RUNNER_CLOUD)) {
     return "cloud runner (RUNNER_CLOUD=true)";
   }
-  if (process.env.VALIDATE_RUNNER_ALLOW_OUTDATED === "1" || process.env.VALIDATE_RUNNER_ALLOW_OUTDATED === "true") {
+  if (parseBoolFlag(process.env.VALIDATE_RUNNER_ALLOW_OUTDATED)) {
     return "VALIDATE_RUNNER_ALLOW_OUTDATED is set";
   }
   return null;
@@ -345218,7 +345284,7 @@ function attachMobileDiscoveryNetworkContext(calls, result, appId) {
 }
 var runnerPackage = require_package4();
 var SECRET_VAR_PATTERN = /password|secret|token|api[_]?key|pass\b|credential|bearer|pat\b/i;
-var IS_CLOUD = process.env.RUNNER_CLOUD === "true";
+var IS_CLOUD = parseBoolFlag(process.env.RUNNER_CLOUD);
 var RUNNER_NAME = runnerPackage.name ?? "@validate.qa/runner";
 var RUNNER_VERSION = runnerPackage.version ?? "0.0.0";
 var RUNNER_BUILD_ID = process.env.VALIDATE_RUNNER_BUILD_ID ?? process.env.RAILWAY_GIT_COMMIT_SHA ?? process.env.GIT_COMMIT_SHA ?? process.env.SOURCE_VERSION;
@@ -348107,9 +348173,9 @@ async function startRunner(opts) {
   log.info(`Project:  ${projectId}`);
   log.info(`Mode:     \u{1F3AD} Playwright Native${enableMobile ? " + \u{1F4F1} Mobile" : ""}${enableMobile && enableMobileTunnel ? " \u{1F310} Tunnel" : ""}`);
   log.info(`Interval: ${pollIntervalMs}ms`);
-  if (process.env.DISCOVERY_PROMPT_V3 === "true") {
+  if (parseBoolFlag(process.env.DISCOVERY_PROMPT_V3)) {
     log.ok("Discovery prompt: V3 (per-turn rebuild) \u2014 DISCOVERY_PROMPT_V3=true");
-  } else if (process.env.DISCOVERY_PROMPT_V3 === "false") {
+  } else if (!parseBoolFlag(process.env.DISCOVERY_PROMPT_V3, true)) {
     log.ok("Discovery prompt: V2.5 (full transcript + control brief) \u2014 DISCOVERY_PROMPT_V3=false");
   } else {
     log.ok("Discovery prompt: V3 (per-turn rebuild, default) \u2014 set DISCOVERY_PROMPT_V3=false for V2.5");
@@ -348135,7 +348201,7 @@ async function startRunner(opts) {
           // WebView. Enable at mobile-runner startup even when the emulator is
           // booted later; the feature is driver-scoped and remains dormant on
           // iOS. Operators may explicitly opt out.
-          enableChromedriverAutodownload: process.env.VALIDATEQA_CHROMEDRIVER_AUTODOWNLOAD !== "false"
+          enableChromedriverAutodownload: parseBoolFlag(process.env.VALIDATEQA_CHROMEDRIVER_AUTODOWNLOAD, true)
         });
         log.ok("\u{1F4F1} Appium server started");
       } catch (err) {

package/dist/cli.mjs

@@ -5248,6 +5248,28 @@ var init_feature_flags = __esm({
   }
 });
 
+// ../shared/dist/env-flags.js
+function parseBoolFlag(value, defaultValue = false) {
+  if (value == null)
+    return defaultValue;
+  const v = value.trim().toLowerCase();
+  if (v === "")
+    return defaultValue;
+  if (TRUTHY.has(v))
+    return true;
+  if (FALSY.has(v))
+    return false;
+  return defaultValue;
+}
+var TRUTHY, FALSY;
+var init_env_flags = __esm({
+  "../shared/dist/env-flags.js"() {
+    "use strict";
+    TRUTHY = /* @__PURE__ */ new Set(["true", "1", "yes", "on"]);
+    FALSY = /* @__PURE__ */ new Set(["false", "0", "no", "off"]);
+  }
+});
+
 // ../shared/dist/index.js
 var dist_exports = {};
 __export(dist_exports, {
@@ -5400,6 +5422,7 @@ __export(dist_exports, {
   normalizeTtsVoiceId: () => normalizeTtsVoiceId,
   otherMobilePlatform: () => otherMobilePlatform,
   parenDepthDelta: () => parenDepthDelta,
+  parseBoolFlag: () => parseBoolFlag,
   pickDisplayRun: () => pickDisplayRun,
   pickLatestHealthRun: () => pickLatestHealthRun,
   placeholderizeRecordedMobileAction: () => placeholderizeRecordedMobileAction,
@@ -5455,6 +5478,7 @@ var init_dist = __esm({
     init_redact_needles();
     init_voice_config();
     init_feature_flags();
+    init_env_flags();
   }
 });
 
@@ -6098,12 +6122,13 @@ var require_global_ai_slot_client = __commonJS({
     exports.acquireGlobalAiSlot = acquireGlobalAiSlot;
     exports.releaseGlobalAiSlot = releaseGlobalAiSlot;
     var crypto_1 = __require("crypto");
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var SERVER_URL = (process.env.SERVER_URL ?? "").replace(/\/$/, "");
     var AUTH_TOKEN = process.env.AUTH_TOKEN || process.env.RUNNER_TOKEN || "";
     var HOLDER = process.env.RUN_ID || `task-${(0, crypto_1.randomUUID)().slice(0, 8)}`;
     var ACQUIRE_HTTP_TIMEOUT_MS = 8e3;
     function isEnabled() {
-      return (process.env.GLOBAL_AI_LIMITER_ENABLED ?? "").trim().toLowerCase() === "true" && SERVER_URL.length > 0 && AUTH_TOKEN.length > 0;
+      return (0, shared_1.parseBoolFlag)(process.env.GLOBAL_AI_LIMITER_ENABLED) && SERVER_URL.length > 0 && AUTH_TOKEN.length > 0;
     }
     function maxWaitMs() {
       const raw = process.env.GLOBAL_AI_ACQUIRE_MAX_WAIT_MS;
@@ -67513,6 +67538,7 @@ var require_snapshot_parser = __commonJS({
     exports.detectSessionState = detectSessionState;
     exports.detectReadinessSignals = detectReadinessSignals;
     exports.detectViewportHints = detectViewportHints;
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var INTERACTIVE_ROLES = /* @__PURE__ */ new Set([
       "textbox",
       "searchbox",
@@ -67693,7 +67719,7 @@ var require_snapshot_parser = __commonJS({
       return e.name;
     }
     function parseSnapshot(snapshotText, options = {}) {
-      const richParse = options.richParse ?? process.env.DISCOVERY_SNAPSHOT_RICH_PARSE === "true";
+      const richParse = options.richParse ?? (0, shared_1.parseBoolFlag)(process.env.DISCOVERY_SNAPSHOT_RICH_PARSE);
       const lines = snapshotText.split("\n");
       const elements = [];
       const liveMessages = [];
@@ -68605,6 +68631,7 @@ var require_discover_ai_planner = __commonJS({
     exports.validateAIPlannerOutput = validateAIPlannerOutput;
     exports.buildFallbackPlan = buildFallbackPlan;
     exports.runAIPlanner = runAIPlanner;
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var ai_provider_js_1 = require_ai_provider();
     var ai_queue_js_1 = require_ai_queue();
     var ai_retry_js_1 = require_ai_retry();
@@ -69883,7 +69910,7 @@ Keep the exact JSON schema { "featureGroups":[...], "scenarios":[...], "reasonin
     async function runAIPlanner(siteMap, evidence, context, options) {
       const logs2 = [];
       const failurePlan = (kind, reason, legacyFallback2) => {
-        const noFallback = context.mode === "survey" && process.env.DISCOVERY_PLANNER_NO_FALLBACK === "true";
+        const noFallback = context.mode === "survey" && (0, shared_1.parseBoolFlag)(process.env.DISCOVERY_PLANNER_NO_FALLBACK);
         if (noFallback) {
           logs2.push(`Planner ${kind} \u2014 NO-FALLBACK: failing survey cleanly instead of fabricating slug features (${reason})`);
           return {
@@ -70270,7 +70297,7 @@ ${JSON.stringify(gatePlan)}`;
       }
       if (context.mode === "survey" && featureGroups.length === 0 && siteMap.pages.length > 0) {
         const hasGroupWorthyEvidence = siteMap.pages.some((p) => (p.forms?.length ?? 0) > 0 || (p.elements?.length ?? 0) > 0);
-        const noFallback = process.env.DISCOVERY_PLANNER_NO_FALLBACK === "true";
+        const noFallback = (0, shared_1.parseBoolFlag)(process.env.DISCOVERY_PLANNER_NO_FALLBACK);
         if (noFallback && !hasGroupWorthyEvidence) {
           return {
             scenarios,
@@ -75519,7 +75546,8 @@ var require_browser_config = __commonJS({
     var promises_1 = __require("fs/promises");
     var path_1 = __require("path");
     var os_1 = __require("os");
-    exports.IS_CLOUD = process.env.RUNNER_CLOUD === "true";
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
+    exports.IS_CLOUD = (0, shared_1.parseBoolFlag)(process.env.RUNNER_CLOUD);
     exports.CLOUD_ARGS = [
       "--no-sandbox",
       "--disable-setuid-sandbox",
@@ -75661,7 +75689,7 @@ var require_browser_config = __commonJS({
       }
     }
     function isHeadless2() {
-      return exports.IS_CLOUD || process.env.PLAYWRIGHT_HEADLESS === "true" || process.env.NODE_ENV === "production";
+      return exports.IS_CLOUD || (0, shared_1.parseBoolFlag)(process.env.PLAYWRIGHT_HEADLESS) || process.env.NODE_ENV === "production";
     }
     function getSlowMoMs() {
       const raw = process.env.PLAYWRIGHT_SLOWMO;
@@ -76733,7 +76761,7 @@ var require_playwright_native = __commonJS({
     Object.defineProperty(exports, "scrubHarRequestBody", { enumerable: true, get: function() {
       return api_call_redaction_js_2.scrubHarRequestBody;
     } });
-    var IS_CLOUD2 = process.env.RUNNER_CLOUD === "true";
+    var IS_CLOUD2 = (0, shared_1.parseBoolFlag)(process.env.RUNNER_CLOUD);
     var PACKAGE_DIR = (0, path_1.resolve)(__dirname, "..", "..");
     var RUNS_DIR = process.env.RUNS_DIR || (0, path_1.join)(PACKAGE_DIR, ".qa-runs");
     var PW_CLI = __require.resolve("@playwright/test/cli");
@@ -76977,7 +77005,7 @@ test.afterEach(async ({ page }, testInfo) => {
         if (useScopedApiHeaders && resolvedExtraHeaders) {
           await (0, promises_1.writeFile)((0, path_1.join)(runDir, "qa-api-fixtures.ts"), (0, api_auth_headers_js_1.buildOriginScopedApiFixtures)(resolvedExtraHeaders, baseUrl));
         }
-        const headless = process.env.PLAYWRIGHT_HEADLESS === "true" || process.env.NODE_ENV === "production" || IS_CLOUD2;
+        const headless = (0, shared_1.parseBoolFlag)(process.env.PLAYWRIGHT_HEADLESS) || process.env.NODE_ENV === "production" || IS_CLOUD2;
         logs2.push(`\u2699\uFE0F  Config: baseURL=${JSON.stringify(baseUrl)}, headless=${headless}${isApiTest2 ? ", API mode (no screenshot/video)" : ""}`);
         const absTestDir = runDir.replace(/\\/g, "/");
         const absResultsFile = (0, path_1.join)(runDir, "results.json").replace(/\\/g, "/");
@@ -78683,6 +78711,7 @@ var require_instrumented_context = __commonJS({
     var mcp_1 = __require("@playwright/mcp");
     var index_js_1 = __require("@modelcontextprotocol/sdk/client/index.js");
     var inMemory_js_1 = __require("@modelcontextprotocol/sdk/inMemory.js");
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var browser_config_js_1 = require_browser_config();
     var health_observer_js_1 = require_health_observer();
     var live_network_collector_js_1 = require_live_network_collector();
@@ -78700,7 +78729,7 @@ var require_instrumented_context = __commonJS({
     var OWNED_BROWSER_CLOSE_TIMEOUT_MS = intEnv("INSTRUMENTED_OWNED_BROWSER_CLOSE_TIMEOUT_MS", 1e4);
     var CLEANUP_TIMEOUT_MS = intEnv("INSTRUMENTED_CLEANUP_TIMEOUT_MS", 1e4);
     function liveCaptureAllowed(mode) {
-      if ((process.env.LIVE_NETWORK_COLLECTOR_ENABLED ?? "").toLowerCase() !== "true")
+      if (!(0, shared_1.parseBoolFlag)(process.env.LIVE_NETWORK_COLLECTOR_ENABLED))
         return false;
       if (!mode)
         return false;
@@ -79163,6 +79192,7 @@ var require_snapshot_observation = __commonJS({
     exports.qualifyElementLabel = qualifyElementLabel;
     exports.isConsentOverlayElement = isConsentOverlayElement;
     var snapshot_parser_js_1 = require_snapshot_parser();
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var GENERIC_LABEL_RE = /^(input field|textbox|button|link|item|field|value|tab)$/i;
     var NOISE_LABEL_RE = /^(skip\s+to|skip\s+nav|back\s+to\s+top|cookie|accept\s+(all\s+)?cookies)$/i;
     var CONSENT_OVERLAY_LABEL_RE = /\bcookies?\b|\bgdpr\b|\bconsent\b|privacy (?:policy|preferences|settings)/i;
@@ -79495,8 +79525,8 @@ var require_snapshot_observation = __commonJS({
       const metrics = page.snapshotMetrics ?? page.snapshotArtifact?.metrics;
       const sourceKind = page.snapshotMeta?.sourceKind ?? page.snapshotArtifact?.sourceKind ?? "missing";
       const artifact = page.snapshotArtifact;
-      const richRender = options.richRender ?? process.env.DISCOVERY_SNAPSHOT_RICH_RENDER === "true";
-      const rowActionCensus = richRender && options.mode !== "survey" && (options.rowActionCensus ?? process.env.DISCOVERY_SNAPSHOT_ROW_CENSUS === "true");
+      const richRender = options.richRender ?? (0, shared_1.parseBoolFlag)(process.env.DISCOVERY_SNAPSHOT_RICH_RENDER);
+      const rowActionCensus = richRender && options.mode !== "survey" && (options.rowActionCensus ?? (0, shared_1.parseBoolFlag)(process.env.DISCOVERY_SNAPSHOT_ROW_CENSUS));
       const activeScope = inferActiveSnapshotScope(page);
       const ranked = rankSnapshotElements(getScopedSnapshotElements(page, activeScope), withScopeContext({ ...context, richRank: richRender }, activeScope));
       const allInteractive = ranked.filter(({ element }) => isInteractiveCandidate(element)).filter(({ element }) => {
@@ -80378,6 +80408,7 @@ var require_snapshot_context_compactor = __commonJS({
     exports.compactSnapshotMessages = compactSnapshotMessages;
     exports.formatSnapshotCompactionLog = formatSnapshotCompactionLog;
     var crypto_1 = __require("crypto");
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var DEFAULT_MAX_TOOL_RESULT_CHARS = 15e3;
     var DEFAULT_MAX_DUPLICATE_SNAPSHOT_CHARS = 1400;
     var DEFAULT_MAX_TOTAL_SNAPSHOT_CHARS = 45e3;
@@ -80387,7 +80418,7 @@ var require_snapshot_context_compactor = __commonJS({
         maxSnapshotChars: options.maxSnapshotChars ?? DEFAULT_MAX_TOOL_RESULT_CHARS,
         maxDuplicateSnapshotChars: options.maxDuplicateSnapshotChars ?? DEFAULT_MAX_DUPLICATE_SNAPSHOT_CHARS,
         maxTotalSnapshotChars: options.maxTotalSnapshotChars ?? DEFAULT_MAX_TOTAL_SNAPSHOT_CHARS,
-        compactStructuredJson: options.compactStructuredJson ?? process.env.DISCOVERY_SNAPSHOT_STRUCTURED_COMPACT !== "false"
+        compactStructuredJson: options.compactStructuredJson ?? (0, shared_1.parseBoolFlag)(process.env.DISCOVERY_SNAPSHOT_STRUCTURED_COMPACT, true)
       };
     }
     function extractSnapshotBlock(content) {
@@ -88428,14 +88459,14 @@ Do NOT add steps you did not execute. Do NOT skip steps from the recording.${led
                     revealedControls,
                     // Opt-in additive-contradiction gate (see assertion-strength.ts). On Fargate this
                     // env must be dispatcher-forwarded to take effect here; off → byte-identical.
-                    flagContradictedAdditions: process.env.STRENGTH_ADDITIVE_CONTRADICTION_GATE === "true"
+                    flagContradictedAdditions: (0, shared_1.parseBoolFlag)(process.env.STRENGTH_ADDITIVE_CONTRADICTION_GATE)
                   });
                 } catch (err) {
                   logs2.push(`    Strength gate errored \u2014 skipping (fail-open): ${String(err)}`);
                 }
                 const verifyCallsSinceLastFinish = verifyCallCount - verifyCallsAtLastFinishGenerate;
                 verifyCallsAtLastFinishGenerate = verifyCallCount;
-                const bugWitnessEnabled = process.env.DISCOVERY_BUG_WITNESS_ENABLED === "true";
+                const bugWitnessEnabled = (0, shared_1.parseBoolFlag)(process.env.DISCOVERY_BUG_WITNESS_ENABLED);
                 const bugWitnessVerdict = bugWitnessEnabled ? resolveSuspectedBugVerdict(suspectedBugDeclared, bugDescription, verifyCallsSinceLastFinish, strengthVerdict?.signals) : null;
                 if (bugWitnessVerdict) {
                   strengthVerdict = bugWitnessVerdict;
@@ -305692,11 +305723,12 @@ var require_bootstrap_grok_auth = __commonJS({
     exports.seedGrokMcpConfigIfNeeded = seedGrokMcpConfigIfNeeded;
     var node_fs_1 = __importDefault(__require("fs"));
     var node_path_1 = __importDefault(__require("path"));
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     function seedGrokAuthIfNeeded() {
       const home = process.env.HOME ?? "/home/appuser";
       const authPath = node_path_1.default.join(home, ".grok", "auth.json");
       const b64 = process.env.GROK_AUTH_JSON_B64;
-      const force = process.env.GROK_AUTH_FORCE_RESEED === "true" || process.env.GROK_AUTH_FORCE_RESEED === "1";
+      const force = (0, shared_1.parseBoolFlag)(process.env.GROK_AUTH_FORCE_RESEED) || process.env.GROK_AUTH_FORCE_RESEED === "1";
       if (!force && node_fs_1.default.existsSync(authPath)) {
         return;
       }
@@ -307086,7 +307118,7 @@ Output the JSON envelope exactly ONCE as your final message, then exit.`;
       return (0, shared_1.buildSanitizedAgentEnv)({ extra });
     }
     async function runGrokHealSession(opts) {
-      const subagentsEnabled = (process.env.GROK_HEAL_SUBAGENTS ?? "").toLowerCase() === "true";
+      const subagentsEnabled = (0, shared_1.parseBoolFlag)(process.env.GROK_HEAL_SUBAGENTS);
       const args = [
         "-p",
         'Read BRIEF.md in this directory. Heal TEST_UNDER_HEAL.spec.ts as instructed. Your FINAL assistant message MUST be ONLY a JSON object \u2014 no prose around it \u2014 with this shape: {"verdict":"fix|app_bug|config_issue|prereq_unmet|state_stale|test_invalid","playwrightCode":"<full file if verdict=fix>","changeDescription":"<one sentence>","reason":"<terse, when not fix>","confidence":"high|medium|low"}',
@@ -312865,6 +312897,7 @@ var require_discover_explorer = __commonJS({
     var ai_provider_js_1 = require_ai_provider();
     var snapshot_parser_js_1 = require_snapshot_parser();
     var scrub_credentials_js_1 = require_scrub_credentials();
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var credential_tools_js_1 = require_credential_tools();
     var inbox_tools_js_1 = require_inbox_tools();
     var verification_inbox_js_1 = require_verification_inbox();
@@ -313640,7 +313673,7 @@ ${credentialBlock}${redactedBlock}${inboxBlock}`;
       const collectedPages = [];
       const collectedTransitions = [];
       const observedOriginCounts = /* @__PURE__ */ new Map();
-      const captureOriginSignals = (process.env.APP_ORIGIN_RESOLUTION ?? "").toLowerCase() === "true";
+      const captureOriginSignals = (0, shared_1.parseBoolFlag)(process.env.APP_ORIGIN_RESOLUTION);
       const buildObservedOrigins = () => [...observedOriginCounts.entries()].sort((a, b) => b[1] - a[1]).map(([o]) => o);
       logs2.push(`Explorer starting - provider: ${provider}, model: ${agentModel}`);
       logs2.push(`Base URL: ${baseUrl}`);
@@ -313662,7 +313695,7 @@ ${credentialBlock}${redactedBlock}${inboxBlock}`;
       const v3Env = process.env.DISCOVERY_PROMPT_V3;
       const useV3 = v3Env !== "false";
       const useV2 = true;
-      const perceptionEnricherEnabled = (process.env.DISCOVERY_PERCEPTION_ENRICHER === "true" || process.env.DISCOVERY_PERCEPTION_ENRICHER === "1") && typeof options?.getPerceptionPage === "function";
+      const perceptionEnricherEnabled = ((0, shared_1.parseBoolFlag)(process.env.DISCOVERY_PERCEPTION_ENRICHER) || process.env.DISCOVERY_PERCEPTION_ENRICHER === "1") && typeof options?.getPerceptionPage === "function";
       const linkFrontierEnabled = (0, survey_link_frontier_js_1.isSurveyLinkFrontierEnabled)() && options?.mode === "survey";
       const linkScope = (0, survey_link_frontier_js_1.deriveLinkScope)(baseUrl);
       let finishRedirects = 0;
@@ -313817,7 +313850,7 @@ ${inboxPromptBlock}`;
         let lastBriefRoute = "";
         let lastBriefIteration = 0;
         const BRIEF_INTERVAL = 5;
-        const stuckDetectorEnabled = process.env.DISCOVERY_STUCK_DETECTOR === "1" || process.env.DISCOVERY_STUCK_DETECTOR === "true";
+        const stuckDetectorEnabled = process.env.DISCOVERY_STUCK_DETECTOR === "1" || (0, shared_1.parseBoolFlag)(process.env.DISCOVERY_STUCK_DETECTOR);
         const stuckDetector = stuckDetectorEnabled ? new stuck_detector_js_1.StuckDetector({ repetitionReachesRecovery: !isDeepMode }) : null;
         while (iteration < maxIterations && !explorationComplete) {
           iteration++;
@@ -316324,6 +316357,8 @@ var require_auth_capture_run = __commonJS({
   "../runner-core/dist/services/auth-capture-run.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
+    exports.filterLoginCaptureCredentials = filterLoginCaptureCredentials;
+    exports.buildLoginCaptureCredentials = buildLoginCaptureCredentials;
     exports.getLoginCaptureMaxIterations = getLoginCaptureMaxIterations;
     exports.harvestAuthProofLive = harvestAuthProofLive;
     exports.findCredentialLiteralLeaks = findCredentialLiteralLeaks;
@@ -316339,6 +316374,26 @@ var require_auth_capture_run = __commonJS({
     var playwright_native_js_1 = require_playwright_native();
     var scrub_credentials_js_1 = require_scrub_credentials();
     var credential_tools_js_1 = require_credential_tools();
+    var LOGIN_CAPTURE_CONTROL_VARIABLES = /* @__PURE__ */ new Set([
+      "BASE_URL",
+      "DISCOVERY_SHOULD_REGISTER",
+      "DISCOVERY_AUTH_MODE"
+    ]);
+    function filterLoginCaptureCredentials(variables) {
+      const credentials = {};
+      for (const [key, value] of Object.entries(variables)) {
+        if ((0, auth_recipe_js_1.isReservedRunnerEnvVar)(key) || LOGIN_CAPTURE_CONTROL_VARIABLES.has(key))
+          continue;
+        credentials[key] = value;
+      }
+      return credentials;
+    }
+    function buildLoginCaptureCredentials(variableContext) {
+      return filterLoginCaptureCredentials({
+        ...variableContext.publicTestVariables,
+        ...variableContext.allTestVariables
+      });
+    }
     var DEFAULT_MAX_LOGIN_CAPTURE_ITERATIONS = 12;
     function readPositiveIntEnv2(env, name, fallback) {
       const raw = env[name]?.trim();
@@ -316546,7 +316601,8 @@ ${keyLines || "- (none provided)"}
       return false;
     }
     async function runLoginCaptureRun(args) {
-      const { loginBrowser, baseUrl, credentials, projectId, model, onAudit, logs: logs2 } = args;
+      const { loginBrowser, baseUrl, projectId, model, onAudit, logs: logs2 } = args;
+      const credentials = filterLoginCaptureCredentials(args.credentials);
       if ((0, agentic_cli_constants_js_1.getAgenticEngine)(model) !== "native") {
         logs2(`  auth-capture skipped: engine for ${model} is not native (V1 is native-engine-only)`);
         return null;
@@ -318004,6 +318060,7 @@ var require_discovery_verify_pool = __commonJS({
     var node_path_1 = __require("path");
     var playwright_native_js_1 = require_playwright_native();
     var scrub_credentials_js_1 = require_scrub_credentials();
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var discover_generator_js_1 = require_discover_generator();
     var canvas_detector_js_1 = require_canvas_detector();
     var agentic_discovery_prompts_js_1 = require_agentic_discovery_prompts();
@@ -318663,7 +318720,7 @@ var require_discovery_verify_pool = __commonJS({
       log2(`ledger: persisted ${scenarioLedgers.size} ledger file(s) to ${ledgerDir}`);
     }
     function startAuthoredWatcher(args) {
-      if (process.env.DISCOVERY_AUTHORED_STREAMING !== "true") {
+      if (!(0, shared_1.parseBoolFlag)(process.env.DISCOVERY_AUTHORED_STREAMING)) {
         return { stop: () => {
         }, count: () => 0 };
       }
@@ -319067,6 +319124,7 @@ var require_grok_discovery_runner = __commonJS({
     var node_fs_1 = __require("fs");
     var node_os_1 = __require("os");
     var node_path_1 = __require("path");
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var instrumented_context_js_1 = require_instrumented_context();
     var exploration_parser_js_1 = require_exploration_parser();
     var bootstrap_grok_auth_js_1 = require_bootstrap_grok_auth();
@@ -319097,7 +319155,7 @@ var require_grok_discovery_runner = __commonJS({
     var DEFAULT_TARGET = { min: 6, max: 15 };
     var WATCHER_DEBOUNCE_MS = 500;
     var MAX_PLAN_REVISIONS = 3;
-    var LEGACY_PLAN_MODE = process.env.USE_LEGACY_GROK_DISCOVERY === "true";
+    var LEGACY_PLAN_MODE = (0, shared_1.parseBoolFlag)(process.env.USE_LEGACY_GROK_DISCOVERY);
     var SNAPSHOT_EXCERPT_CHARS = 150;
     function isObject(v) {
       return typeof v === "object" && v !== null && !Array.isArray(v);
@@ -319248,7 +319306,7 @@ var require_grok_discovery_runner = __commonJS({
       return out;
     }
     async function runGrokDiscoveryOnRunner(ctx, callbackOptions, options = {}) {
-      if (process.env.USE_GROK_DISCOVERY_V2 === "true") {
+      if ((0, shared_1.parseBoolFlag)(process.env.USE_GROK_DISCOVERY_V2)) {
         return runGrokDiscoveryV2OnRunner(ctx, callbackOptions, options);
       }
       const featureName = ctx.featureName ?? "Untitled Feature";
@@ -321720,6 +321778,7 @@ var require_tool_ledger = __commonJS({
     var promises_1 = __require("fs/promises");
     var node_crypto_1 = __require("crypto");
     var node_path_1 = __require("path");
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var OTHER_OUTPUT_PREVIEW_CAP = 1024;
     var DEFAULT_SNAPSHOT_BYTES_CAP = 16 * 1024;
     var KNOWN_CREDENTIAL_BEARING_TOOLS = /* @__PURE__ */ new Set([
@@ -321801,7 +321860,7 @@ var require_tool_ledger = __commonJS({
       let seq = 0;
       let turn = 0;
       let lastNavigateUrl = null;
-      const redact = opts.redact ?? process.env.DISCOVERY_LEDGER_REDACT === "true";
+      const redact = opts.redact ?? (0, shared_1.parseBoolFlag)(process.env.DISCOVERY_LEDGER_REDACT);
       const credentialEnvMap = opts.credentialEnvMap ?? /* @__PURE__ */ new Map();
       const maxSnapshotBytes = opts.maxSnapshotBytes ?? DEFAULT_SNAPSHOT_BYTES_CAP;
       const sessionId = (0, node_crypto_1.randomUUID)();
@@ -323422,6 +323481,7 @@ var require_discover_agent = __commonJS({
     var ai_queue_js_1 = require_ai_queue();
     var ai_retry_js_1 = require_ai_retry();
     var strip_json_fences_js_1 = require_strip_json_fences();
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var discover_explorer_js_1 = require_discover_explorer();
     var discover_feature_explorer_js_1 = require_discover_feature_explorer();
     var discover_planner_js_1 = require_discover_planner();
@@ -323515,7 +323575,7 @@ var require_discover_agent = __commonJS({
     }
     function describeRunnerRuntime(launchOpts) {
       const browserMode = launchOpts?.headless === true ? "headless" : launchOpts?.headless === false ? "headed" : "default";
-      const runtime = process.env.RUNNER_CLOUD === "true" ? "cloud runner" : "local runner";
+      const runtime = (0, shared_1.parseBoolFlag)(process.env.RUNNER_CLOUD) ? "cloud runner" : "local runner";
       return `Runtime: ${runtime}, browser mode: ${browserMode}`;
     }
     function formatElapsed(ms) {
@@ -323662,7 +323722,7 @@ Respond with ONLY valid JSON:
     }
     var AUTH_CAPTURE_TIMEOUT_MS = 4 * 60 * 1e3;
     function maybeStartLoginCaptureRun(ctx, callbackOptions, onAICall, pushLog, onObservedOrigins) {
-      if (process.env.AUTH_RECIPE_STAMP !== "true")
+      if (!(0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP))
         return null;
       if (ctx.authRecipe) {
         pushLog(`auth-prologue: reusing persisted login recipe ${ctx.authRecipe.recipeHash} \u2014 skipping capture`);
@@ -323685,7 +323745,7 @@ Respond with ONLY valid JSON:
         pushLog("auth-prologue: AUTH_RECIPE_STAMP on + native engine, but no login-browser factory supplied (runner stage 2b) \u2014 skipping producer");
         return null;
       }
-      const credentials = ctx.variableContext.allTestVariables ?? ctx.variableContext.publicTestVariables;
+      const credentials = (0, auth_capture_run_js_1.buildLoginCaptureCredentials)(ctx.variableContext);
       const run2 = (async () => {
         let lease = null;
         try {
@@ -323748,7 +323808,7 @@ Respond with ONLY valid JSON:
       if (canvasPreflight.probeRan) {
         ctx.appRenderType = canvasPreflight.renderType;
       }
-      const useNativeOverride = process.env.USE_NATIVE_SURVEY === "true";
+      const useNativeOverride = (0, shared_1.parseBoolFlag)(process.env.USE_NATIVE_SURVEY);
       const surveyEngine = (0, agentic_cli_constants_js_1.getAgenticEngine)(ctx.exploreModel);
       if (isSurvey && surveyEngine !== "native" && !useNativeOverride) {
         logs2.push(`exploreModel=${ctx.exploreModel} \u2192 routing to ${surveyEngine} survey runner`);
@@ -323965,8 +324025,8 @@ Explore complete: ${exploreResult.pagesDiscovered} pages, ${exploreResult.elemen
           // Recipe-aware planning: when a verified login recipe is on file, the planner
           // plans @needs-auth (non-auth-flow) scenarios from the authenticated state
           // instead of authoring landing→login steps (which generate would override).
-          authRecipeAvailable: process.env.AUTH_RECIPE_STAMP === "true" && !!ctx.authRecipe,
-          authRedirectRoute: process.env.AUTH_RECIPE_STAMP === "true" ? ctx.authRecipe?.redirectRoute ?? void 0 : void 0,
+          authRecipeAvailable: (0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP) && !!ctx.authRecipe,
+          authRedirectRoute: (0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP) ? ctx.authRecipe?.redirectRoute ?? void 0 : void 0,
           testBudget
         }, {
           modelOverride: ctx.planModel ?? ctx.generateModel,
@@ -324273,7 +324333,7 @@ Fatal error: ${msg}`);
       if (canvasPreflight.probeRan) {
         ctx.appRenderType = canvasPreflight.renderType;
       }
-      const useNativeDeepOverride = process.env.USE_NATIVE_DEEP === "true";
+      const useNativeDeepOverride = (0, shared_1.parseBoolFlag)(process.env.USE_NATIVE_DEEP);
       const deepEngine = (0, agentic_cli_constants_js_1.getAgenticEngine)(ctx.exploreModel);
       if (deepEngine !== "native" && !useNativeDeepOverride) {
         logs2.push(`exploreModel=${ctx.exploreModel} \u2192 routing to ${deepEngine} deep discovery runner`);
@@ -324544,8 +324604,8 @@ Plan (reused): ${resumeSavedScenarios.length} scenarios from the paused run.`);
             },
             // Recipe-aware planning (feature/deep): plan @needs-auth scenarios from the
             // authenticated state when a verified login recipe is on file for this project.
-            authRecipeAvailable: process.env.AUTH_RECIPE_STAMP === "true" && !!ctx.authRecipe,
-            authRedirectRoute: process.env.AUTH_RECIPE_STAMP === "true" ? ctx.authRecipe?.redirectRoute ?? void 0 : void 0,
+            authRecipeAvailable: (0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP) && !!ctx.authRecipe,
+            authRedirectRoute: (0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP) ? ctx.authRecipe?.redirectRoute ?? void 0 : void 0,
             testBudget: featureTestBudget
           }, {
             modelOverride: ctx.planModel ?? ctx.generateModel,
@@ -325061,6 +325121,7 @@ var require_resource_governor = __commonJS({
     exports.getResourceGovernorStatus = getResourceGovernorStatus2;
     var fs_1 = __require("fs");
     var os_1 = __importDefault(__require("os"));
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var DEFAULT_WEIGHTS = {
       run: 1,
       heal: 2.5,
@@ -325207,9 +325268,7 @@ var require_resource_governor = __commonJS({
     }
     function envBool(name, fallback) {
       const raw = process.env[name];
-      if (raw == null || raw === "")
-        return fallback;
-      return raw === "true" || raw === "1" || raw.toLowerCase() === "yes";
+      return (0, shared_1.parseBoolFlag)(raw, fallback);
     }
     function envFloat(name, fallback) {
       const raw = process.env[name];
@@ -337984,9 +338043,9 @@ var require_dist2 = __commonJS({
       for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports2, p)) __createBinding(exports2, m, p);
     };
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.MAX_ARCHIVE_BYTES = exports.isUnsafeEntryName = exports.extractZipSafely = exports.downloadArchiveCapped = exports.detectArchiveKind = exports.acquireRepoForImport = exports.runFrameworkImportOnRunner = exports.getAgenticEngine = exports.resolveRefFromSnapshot = exports.replayAuthRecipeIntoBrowser = exports.runRegisterCaptureRun = exports.runLoginCaptureRun = exports.isReservedRunnerEnvVar = exports.RESERVED_RUNNER_ENV_VARS = exports.AUTH_MARKER_VERSION = exports.buildHealAuthStamp = exports.extractAuthRegion = exports.upsertAuthBlock = exports.buildAuthRecipe = exports.commandToReplayStep = exports.buildReplayPlan = exports.absoluteRoute = exports.renderReplaySettleArrow = exports.renderReplayClickArrow = exports.renderAuthFn = exports.canonicalizeRoute = exports.executeGrokPerBatchHeal = exports.executeGrokPerTestHeal = exports.headerVal = exports.classifyAuthType = exports.isTextExcerptable = exports.isStaticAssetByExt = exports.isApiCall = exports.buildApiCallSummary = exports.computeMobileHealOutcome = exports.detectMobileStepSecretLeak = exports.redactMobileSecretsFromText = exports.MOBILE_LIVE_HEAL_SYSTEM_PROMPT = exports.MOBILE_SCRIPT_HEAL_SYSTEM_PROMPT = exports.executeMobileLiveHeal = exports.executeMobileTestWithHealing = exports.executeMobileScriptDrivenHeal = exports.prepareMobileScenarioAppState = exports.runMobileGeneratePhase = exports.runMobileAIPlanner = exports.buildMobileSiteMap = exports.formatMobileEvidenceForPlanner = exports.MOBILE_SCENARIO_SYSTEM_PROMPT = exports.MOBILE_SURVEY_SYSTEM_PROMPT = exports.runMobileExplorePhase = void 0;
-    exports.modelSupportsVision = exports.decideCanvasStrategy = exports.decideAppRenderType = exports.detectCanvasApp = exports.detectRateLimitBlock = exports.isSafeCanonicalRedirect = exports.resolveBaseUrlPreflight = exports.checkBaseUrlRedirect = exports.stripJsonFences = exports.scrubCredentials = exports.withAIRetry = exports.snapshotMatchingChildren = exports.findNewChromiumChildPid = exports.killProcessTree = exports.gracefulCloseWithTreeKill = exports.liveBrowserRegistry = exports.REPO_SWITCH_REMOVED_FRACTION = exports.MAX_MANIFEST_FILES = exports.toDiffSummary = exports.isLikelyTestFile = exports.sanitizeRepoRelPath = exports.sha256Hex = exports.hashFiles = exports.enumerateTestFiles = exports.buildNextManifest = exports.detectRepoSwitch = exports.classifyImportDiff = exports.parseImportManifest = exports.REPO_ANALYSIS_SCHEMA_VERSION = exports.validateSourceEndpoints = exports.validateAuthoredTest = exports.validateRepoMapFile = exports.validateRepoMemoryFile = exports.buildTestingStandardsSection = exports.buildRepoAuthorSystemRules = exports.buildRepoAuthorKickoff = exports.buildRepoAuthorContractMd = exports.buildRepoMapSystemRules = exports.buildRepoMapKickoff = exports.buildRepoMapContractMd = exports.buildRepoMemorySystemRules = exports.buildRepoMemoryKickoff = exports.buildRepoMemoryContractMd = exports.runRepoAnalysisOnRunner = exports.IMPORT_SCHEMA_VERSION = exports.validateImportResultFile = exports.validateImportedTest = exports.buildImportSystemRules = exports.buildImportKickoff = exports.buildImportContractMd = void 0;
-    exports.UNSUPPORTED_RENDERER_PREFIX = exports.UnsupportedRendererError = exports.buildCanvasModeAuthoringAddendum = exports.buildUnsupportedRendererMessage = void 0;
+    exports.extractZipSafely = exports.downloadArchiveCapped = exports.detectArchiveKind = exports.acquireRepoForImport = exports.runFrameworkImportOnRunner = exports.getAgenticEngine = exports.resolveRefFromSnapshot = exports.replayAuthRecipeIntoBrowser = exports.runRegisterCaptureRun = exports.runLoginCaptureRun = exports.filterLoginCaptureCredentials = exports.buildLoginCaptureCredentials = exports.isReservedRunnerEnvVar = exports.RESERVED_RUNNER_ENV_VARS = exports.AUTH_MARKER_VERSION = exports.buildHealAuthStamp = exports.extractAuthRegion = exports.upsertAuthBlock = exports.buildAuthRecipe = exports.commandToReplayStep = exports.buildReplayPlan = exports.absoluteRoute = exports.renderReplaySettleArrow = exports.renderReplayClickArrow = exports.renderAuthFn = exports.canonicalizeRoute = exports.executeGrokPerBatchHeal = exports.executeGrokPerTestHeal = exports.headerVal = exports.classifyAuthType = exports.isTextExcerptable = exports.isStaticAssetByExt = exports.isApiCall = exports.buildApiCallSummary = exports.computeMobileHealOutcome = exports.detectMobileStepSecretLeak = exports.redactMobileSecretsFromText = exports.MOBILE_LIVE_HEAL_SYSTEM_PROMPT = exports.MOBILE_SCRIPT_HEAL_SYSTEM_PROMPT = exports.executeMobileLiveHeal = exports.executeMobileTestWithHealing = exports.executeMobileScriptDrivenHeal = exports.prepareMobileScenarioAppState = exports.runMobileGeneratePhase = exports.runMobileAIPlanner = exports.buildMobileSiteMap = exports.formatMobileEvidenceForPlanner = exports.MOBILE_SCENARIO_SYSTEM_PROMPT = exports.MOBILE_SURVEY_SYSTEM_PROMPT = exports.runMobileExplorePhase = void 0;
+    exports.decideAppRenderType = exports.detectCanvasApp = exports.detectRateLimitBlock = exports.isSafeCanonicalRedirect = exports.resolveBaseUrlPreflight = exports.checkBaseUrlRedirect = exports.stripJsonFences = exports.scrubCredentials = exports.withAIRetry = exports.snapshotMatchingChildren = exports.findNewChromiumChildPid = exports.killProcessTree = exports.gracefulCloseWithTreeKill = exports.liveBrowserRegistry = exports.REPO_SWITCH_REMOVED_FRACTION = exports.MAX_MANIFEST_FILES = exports.toDiffSummary = exports.isLikelyTestFile = exports.sanitizeRepoRelPath = exports.sha256Hex = exports.hashFiles = exports.enumerateTestFiles = exports.buildNextManifest = exports.detectRepoSwitch = exports.classifyImportDiff = exports.parseImportManifest = exports.REPO_ANALYSIS_SCHEMA_VERSION = exports.validateSourceEndpoints = exports.validateAuthoredTest = exports.validateRepoMapFile = exports.validateRepoMemoryFile = exports.buildTestingStandardsSection = exports.buildRepoAuthorSystemRules = exports.buildRepoAuthorKickoff = exports.buildRepoAuthorContractMd = exports.buildRepoMapSystemRules = exports.buildRepoMapKickoff = exports.buildRepoMapContractMd = exports.buildRepoMemorySystemRules = exports.buildRepoMemoryKickoff = exports.buildRepoMemoryContractMd = exports.runRepoAnalysisOnRunner = exports.IMPORT_SCHEMA_VERSION = exports.validateImportResultFile = exports.validateImportedTest = exports.buildImportSystemRules = exports.buildImportKickoff = exports.buildImportContractMd = exports.MAX_ARCHIVE_BYTES = exports.isUnsafeEntryName = void 0;
+    exports.UNSUPPORTED_RENDERER_PREFIX = exports.UnsupportedRendererError = exports.buildCanvasModeAuthoringAddendum = exports.buildUnsupportedRendererMessage = exports.modelSupportsVision = exports.decideCanvasStrategy = void 0;
     __exportStar(require_ai_provider(), exports);
     __exportStar(require_mobile_types(), exports);
     __exportStar(require_mobile_source_parser(), exports);
@@ -338135,6 +338194,12 @@ var require_dist2 = __commonJS({
       return auth_recipe_js_1.isReservedRunnerEnvVar;
     } });
     var auth_capture_run_js_1 = require_auth_capture_run();
+    Object.defineProperty(exports, "buildLoginCaptureCredentials", { enumerable: true, get: function() {
+      return auth_capture_run_js_1.buildLoginCaptureCredentials;
+    } });
+    Object.defineProperty(exports, "filterLoginCaptureCredentials", { enumerable: true, get: function() {
+      return auth_capture_run_js_1.filterLoginCaptureCredentials;
+    } });
     Object.defineProperty(exports, "runLoginCaptureRun", { enumerable: true, get: function() {
       return auth_capture_run_js_1.runLoginCaptureRun;
     } });
@@ -338361,7 +338426,7 @@ var require_package4 = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.44",
+      version: "1.0.46",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"
@@ -338500,6 +338565,7 @@ function authPlanFor(tags, playwrightCode) {
 }
 
 // src/version-check.ts
+init_dist();
 var RUNNER_NPM_PACKAGE = "@validate.qa/runner";
 var NPM_LATEST_URL = `https://registry.npmjs.org/${encodeURIComponent(RUNNER_NPM_PACKAGE)}/latest`;
 var DEFAULT_TIMEOUT_MS = 8e3;
@@ -338531,10 +338597,10 @@ function isVersionOutdated(current, latest) {
   return cmp === -1;
 }
 function shouldSkipVersionCheck() {
-  if (process.env.RUNNER_CLOUD === "true") {
+  if (parseBoolFlag(process.env.RUNNER_CLOUD)) {
     return "cloud runner (RUNNER_CLOUD=true)";
   }
-  if (process.env.VALIDATE_RUNNER_ALLOW_OUTDATED === "1" || process.env.VALIDATE_RUNNER_ALLOW_OUTDATED === "true") {
+  if (parseBoolFlag(process.env.VALIDATE_RUNNER_ALLOW_OUTDATED)) {
     return "VALIDATE_RUNNER_ALLOW_OUTDATED is set";
   }
   return null;
@@ -345226,7 +345292,7 @@ function attachMobileDiscoveryNetworkContext(calls, result, appId) {
 }
 var runnerPackage = require_package4();
 var SECRET_VAR_PATTERN = /password|secret|token|api[_]?key|pass\b|credential|bearer|pat\b/i;
-var IS_CLOUD = process.env.RUNNER_CLOUD === "true";
+var IS_CLOUD = parseBoolFlag(process.env.RUNNER_CLOUD);
 var RUNNER_NAME = runnerPackage.name ?? "@validate.qa/runner";
 var RUNNER_VERSION = runnerPackage.version ?? "0.0.0";
 var RUNNER_BUILD_ID = process.env.VALIDATE_RUNNER_BUILD_ID ?? process.env.RAILWAY_GIT_COMMIT_SHA ?? process.env.GIT_COMMIT_SHA ?? process.env.SOURCE_VERSION;
@@ -348115,9 +348181,9 @@ async function startRunner(opts) {
   log.info(`Project:  ${projectId}`);
   log.info(`Mode:     \u{1F3AD} Playwright Native${enableMobile ? " + \u{1F4F1} Mobile" : ""}${enableMobile && enableMobileTunnel ? " \u{1F310} Tunnel" : ""}`);
   log.info(`Interval: ${pollIntervalMs}ms`);
-  if (process.env.DISCOVERY_PROMPT_V3 === "true") {
+  if (parseBoolFlag(process.env.DISCOVERY_PROMPT_V3)) {
     log.ok("Discovery prompt: V3 (per-turn rebuild) \u2014 DISCOVERY_PROMPT_V3=true");
-  } else if (process.env.DISCOVERY_PROMPT_V3 === "false") {
+  } else if (!parseBoolFlag(process.env.DISCOVERY_PROMPT_V3, true)) {
     log.ok("Discovery prompt: V2.5 (full transcript + control brief) \u2014 DISCOVERY_PROMPT_V3=false");
   } else {
     log.ok("Discovery prompt: V3 (per-turn rebuild, default) \u2014 set DISCOVERY_PROMPT_V3=false for V2.5");
@@ -348143,7 +348209,7 @@ async function startRunner(opts) {
           // WebView. Enable at mobile-runner startup even when the emulator is
           // booted later; the feature is driver-scoped and remains dormant on
           // iOS. Operators may explicitly opt out.
-          enableChromedriverAutodownload: process.env.VALIDATEQA_CHROMEDRIVER_AUTODOWNLOAD !== "false"
+          enableChromedriverAutodownload: parseBoolFlag(process.env.VALIDATEQA_CHROMEDRIVER_AUTODOWNLOAD, true)
         });
         log.ok("\u{1F4F1} Appium server started");
       } catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@validate.qa/runner",
-  "version": "1.0.44",
+  "version": "1.0.46",
   "description": "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
   "bin": {
     "validate-runner": "dist/cli.js"