@validate.qa/runner 1.0.47 → 1.0.49

package/dist/cli.js

@@ -5041,6 +5041,191 @@ var init_auth_block_detector = __esm({
   }
 });
 
+// ../shared/dist/auth-state-freshness.js
+function isCsrfTokenName(name) {
+  return /csrf|xsrf|forgery|authenticity|requestverification/.test(name.toLowerCase());
+}
+function isAuthTokenName(name) {
+  const n = name.toLowerCase();
+  if (isCsrfTokenName(n))
+    return false;
+  if (/session|auth|jwt|credential|identity|login|token/.test(n))
+    return true;
+  if (/(?:^|[^a-z0-9])(?:sid|sess|account|remember)(?:[^a-z0-9]|$)/.test(n))
+    return true;
+  return [
+    "connect.sid",
+    "jsessionid",
+    "phpsessid",
+    "aspnet",
+    "asp.net",
+    "aspxauth",
+    "sb-",
+    "supabase",
+    "amplify",
+    "cognito",
+    "auth0",
+    "okta",
+    "kc-",
+    "li_at",
+    "ltpatoken",
+    "wordpress_logged_in"
+  ].some((frag) => n.includes(frag));
+}
+function isSessionClassName(name) {
+  const n = name.toLowerCase();
+  if (isCsrfTokenName(n))
+    return false;
+  if (/session|sess/.test(n))
+    return true;
+  if (/(?:^|[^a-z0-9])sid(?:[^a-z0-9]|$)/.test(n))
+    return true;
+  return [
+    "connect.sid",
+    "jsessionid",
+    "phpsessid",
+    "aspxauth",
+    "li_at",
+    "ltpatoken",
+    "wordpress_logged_in"
+  ].some((frag) => n.includes(frag));
+}
+function decodeBase64UrlToUtf8(segment) {
+  if (typeof atob !== "function")
+    return void 0;
+  const base64 = segment.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = base64.length % 4 === 0 ? base64 : base64 + "=".repeat(4 - base64.length % 4);
+  try {
+    const binary = atob(padded);
+    let percentEncoded = "";
+    for (let i = 0; i < binary.length; i += 1) {
+      percentEncoded += `%${binary.charCodeAt(i).toString(16).padStart(2, "0")}`;
+    }
+    return decodeURIComponent(percentEncoded);
+  } catch {
+    return void 0;
+  }
+}
+function jwtExpiryMs(value) {
+  const parts = value.split(".");
+  if (parts.length !== 3 || !parts[0] || !parts[1] || !parts[2])
+    return void 0;
+  const json = decodeBase64UrlToUtf8(parts[1]);
+  if (json === void 0)
+    return void 0;
+  try {
+    const payload = JSON.parse(json);
+    const exp = payload?.exp;
+    return typeof exp === "number" && Number.isFinite(exp) && exp > 0 ? exp * 1e3 : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function localStorageAuthExpiryMs(value) {
+  const direct = jwtExpiryMs(value);
+  if (direct !== void 0)
+    return direct;
+  let obj;
+  try {
+    obj = JSON.parse(value);
+  } catch {
+    return void 0;
+  }
+  if (!obj || typeof obj !== "object")
+    return void 0;
+  const record = obj;
+  const nested = record.currentSession ?? record.session;
+  const jwtCandidates = [
+    record.access_token,
+    record.accessToken,
+    record.token,
+    record.id_token,
+    record.idToken,
+    nested?.access_token,
+    nested?.accessToken
+  ];
+  for (const candidate of jwtCandidates) {
+    if (typeof candidate === "string") {
+      const exp = jwtExpiryMs(candidate);
+      if (exp !== void 0)
+        return exp;
+    }
+  }
+  const expiresAt = record.expires_at ?? record.expiresAt ?? nested?.expires_at;
+  if (typeof expiresAt === "number" && Number.isFinite(expiresAt) && expiresAt > 0) {
+    return expiresAt < 1e12 ? expiresAt * 1e3 : expiresAt;
+  }
+  return void 0;
+}
+function collectAuthTokens(parsed) {
+  const tokens = [];
+  if (!parsed || typeof parsed !== "object")
+    return tokens;
+  const cookies = parsed.cookies;
+  if (Array.isArray(cookies)) {
+    for (const raw of cookies) {
+      if (!raw || typeof raw !== "object")
+        continue;
+      const name = typeof raw.name === "string" ? raw.name : "";
+      const value = typeof raw.value === "string" ? raw.value : "";
+      if (isCsrfTokenName(name))
+        continue;
+      const jwtExp = value ? jwtExpiryMs(value) : void 0;
+      if (jwtExp !== void 0) {
+        tokens.push({ expiryMs: jwtExp, sessionClass: true });
+        continue;
+      }
+      if (isAuthTokenName(name) && typeof raw.expires === "number" && Number.isFinite(raw.expires) && raw.expires > 0) {
+        tokens.push({ expiryMs: raw.expires * 1e3, sessionClass: isSessionClassName(name) });
+      }
+    }
+  }
+  const origins = parsed.origins;
+  if (Array.isArray(origins)) {
+    for (const origin of origins) {
+      if (!origin || typeof origin !== "object" || !Array.isArray(origin.localStorage))
+        continue;
+      for (const entry of origin.localStorage) {
+        if (!entry || typeof entry !== "object")
+          continue;
+        const key = typeof entry.name === "string" ? entry.name : "";
+        const value = typeof entry.value === "string" ? entry.value : "";
+        if (!key || !value || isCsrfTokenName(key) || !isAuthTokenName(key))
+          continue;
+        const exp = localStorageAuthExpiryMs(value);
+        if (exp !== void 0)
+          tokens.push({ expiryMs: exp, sessionClass: true });
+      }
+    }
+  }
+  return tokens;
+}
+function storageStateExpiredBySkew(stateJson, nowMs, skewMs = AUTH_STATE_EXPIRY_SKEW_MS) {
+  let parsed;
+  try {
+    parsed = JSON.parse(stateJson);
+  } catch {
+    return false;
+  }
+  const tokens = collectAuthTokens(parsed);
+  if (tokens.length === 0)
+    return false;
+  const margin = Number.isFinite(skewMs) ? Math.max(0, skewMs) : AUTH_STATE_EXPIRY_SKEW_MS;
+  const deadline = nowMs + margin;
+  const anyExpired = tokens.some((t) => t.expiryMs <= deadline);
+  if (!anyExpired)
+    return false;
+  const liveSession = tokens.some((t) => t.expiryMs > deadline && t.sessionClass);
+  return !liveSession;
+}
+var AUTH_STATE_EXPIRY_SKEW_MS;
+var init_auth_state_freshness = __esm({
+  "../shared/dist/auth-state-freshness.js"() {
+    "use strict";
+    AUTH_STATE_EXPIRY_SKEW_MS = 3e4;
+  }
+});
+
 // ../shared/dist/skip-coverage-detector.js
 function detectSkippedApiCoverage(steps) {
   const allSkipped = steps.length > 0 && steps.every((s) => s.status === "skipped");
@@ -5430,6 +5615,7 @@ __export(dist_exports, {
   API_AUTH_HEADERS_ENV_KEY: () => API_AUTH_HEADERS_ENV_KEY,
   API_PREFIX: () => API_PREFIX,
   AUDIO_CHUNK_DURATION_MS: () => AUDIO_CHUNK_DURATION_MS,
+  AUTH_STATE_EXPIRY_SKEW_MS: () => AUTH_STATE_EXPIRY_SKEW_MS,
   AUTH_TAG_COOKIE_STATE: () => AUTH_TAG_COOKIE_STATE,
   AUTH_TAG_LOGIN_BEARER: () => AUTH_TAG_LOGIN_BEARER,
   AUTH_TAG_LOGIN_COOKIE: () => AUTH_TAG_LOGIN_COOKIE,
@@ -5547,6 +5733,7 @@ __export(dist_exports, {
   isApiTest: () => isApiTest,
   isAppOriginResolutionEnabled: () => isAppOriginResolutionEnabled,
   isAuthReadinessGuardEnabled: () => isAuthReadinessGuardEnabled,
+  isAuthTokenName: () => isAuthTokenName,
   isBlockedEnvVar: () => isBlockedEnvVar,
   isCountedFailure: () => isCountedFailure,
   isCreditPackAmountCents: () => isCreditPackAmountCents,
@@ -5569,6 +5756,7 @@ __export(dist_exports, {
   isValidSttProvider: () => isValidSttProvider,
   isValidTtsModel: () => isValidTtsModel,
   isValidTtsVoiceId: () => isValidTtsVoiceId,
+  jwtExpiryMs: () => jwtExpiryMs,
   mediumForMobilePlatform: () => mediumForMobilePlatform,
   mobileCredentialPlaceholder: () => mobileCredentialPlaceholder,
   mobilePlatformFromMedium: () => mobilePlatformFromMedium,
@@ -5600,6 +5788,7 @@ __export(dist_exports, {
   stepIsDivergentForPlatform: () => stepIsDivergentForPlatform,
   stepsMissingPlatformLocators: () => stepsMissingPlatformLocators,
   stepsNeedingReviewForPlatform: () => stepsNeedingReviewForPlatform,
+  storageStateExpiredBySkew: () => storageStateExpiredBySkew,
   stripEnvironmentalPrefix: () => stripEnvironmentalPrefix,
   stripLoginScaffolding: () => stripLoginScaffolding,
   sttModelsForProvider: () => sttModelsForProvider,
@@ -5630,6 +5819,7 @@ var init_dist = __esm({
     init_origin_domain();
     init_auth_plan();
     init_auth_block_detector();
+    init_auth_state_freshness();
     init_skip_coverage_detector();
     init_redact_needles();
     init_voice_config();
@@ -77098,7 +77288,7 @@ var require_discover_ai_planner = __commonJS({
   "../runner-core/dist/services/discover-ai-planner.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.PLANNER_STRENGTHEN_GATE_PROMPT = exports2.SCENARIO_SYSTEM_PROMPT = void 0;
+    exports2.PLANNER_STRENGTHEN_GATE_PROMPT = exports2.SCENARIO_SYSTEM_PROMPT = exports2.SURVEY_SYSTEM_PROMPT = void 0;
     exports2.getAIPlannerMaxTokens = getAIPlannerMaxTokens;
     exports2.getSnapshotConfidence = getSnapshotConfidence;
     exports2.compressSiteMap = compressSiteMap;
@@ -77634,7 +77824,7 @@ Plan these LOGGED-OUT instead (keep their own establishment steps; do NOT assume
       }
       return sections.join("\n\n");
     }
-    var SURVEY_SYSTEM_PROMPT = `You are a feature analyst for a web application. You receive evidence from an AI explorer that mapped the entire site. Your job is to organize pages into meaningful feature groups.
+    exports2.SURVEY_SYSTEM_PROMPT = `You are a feature analyst for a web application. You receive evidence from an AI explorer that mapped the entire site. Your job is to organize pages into meaningful feature groups.
 
 ## Output Discipline
 Return ONLY one valid JSON object matching the schema below. Do NOT include <think> blocks, markdown fences, analysis, prose, or any text outside the JSON object. Put any brief explanation only in the JSON "reasoning" field.
@@ -77654,6 +77844,7 @@ Return ONLY one valid JSON object matching the schema below. Do NOT include <thi
 6. Do NOT merge pages into one feature just because they serve a similar broader goal. Treat areas as separate features when the evidence shows separate primary navigation destinations (e.g. separate sidebar links), separate route families below the app shell (e.g. /dashboard/documents/* vs /dashboard/reports/* are separate even though both are under /dashboard), or different CRUD entities/forms. Keep pages together when they share one navigational area and operate on the same entity (e.g. /applications, /applications/stats, /applications?filter= all belong together).
 7. Feature descriptions MUST reference actual element labels from the evidence
 8. Do NOT create standalone features for generic error pages (404, 500, access denied). If a business route is broken or crashes, keep it in its intended feature and note the failure in the description. Error pages do not need their own deep exploration run.
+9. The Base URL's PATH is the survey's entry scope. When it is non-root (e.g. \`/shop/checkout\`), the operator is auditing that one flow in isolation: do NOT create featureGroups for parent paths, sibling paths, or guessed/nonexistent routes on the same host \u2014 even if the explorer's evidence wandered there. Auth pages the flow itself traverses (its login page, an \`/api/auth/*\` callback) belong INSIDE that flow's group, not in separate groups. When the Base URL path is \`/\`, group the whole app as usual.
 
 ## Output JSON Schema
 {
@@ -78406,7 +78597,7 @@ Keep the exact JSON schema { "featureGroups":[...], "scenarios":[...], "reasonin
       const agentModel = options.modelOverride ? (0, ai_provider_js_1.resolveModelForTask)(options.modelOverride, "agent") : (0, ai_provider_js_1.getModel)("agent");
       const plannerMaxTokens = getAIPlannerMaxTokens(agentModel);
       logs2.push(`AI planner [${context.mode}]: ${siteMap.pages.length} pages, ${evidence.recordedJourneys.length} journeys, budget ${context.testBudget}`);
-      const systemPrompt = options.systemPromptOverride ?? (context.mode === "survey" ? SURVEY_SYSTEM_PROMPT : exports2.SCENARIO_SYSTEM_PROMPT);
+      const systemPrompt = options.systemPromptOverride ?? (context.mode === "survey" ? exports2.SURVEY_SYSTEM_PROMPT : exports2.SCENARIO_SYSTEM_PROMPT);
       const userPrompt = options.userPromptOverride ?? formatEvidenceForPlanner(compressed, evidence, context);
       logs2.push(`AI planner: ~${Math.ceil(userPrompt.length / 3.5)} input tokens`);
       const aiClient = options.aiClient ?? (options.modelOverride ? (0, ai_provider_js_1.getRunnerClientForModel)(options.modelOverride) : (0, ai_provider_js_1.getRunnerAIClient)());
@@ -321377,6 +321568,168 @@ var require_evidence_harvester = __commonJS({
   }
 });
 
+// ../runner-core/dist/services/survey-scope.js
+var require_survey_scope = __commonJS({
+  "../runner-core/dist/services/survey-scope.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.deriveSurveyPathScope = deriveSurveyPathScope;
+    exports2.isAuthFlowRoute = isAuthFlowRoute;
+    exports2.buildSurveyScopeBoundary = buildSurveyScopeBoundary;
+    exports2.filterFeatureGroupsToPathScope = filterFeatureGroupsToPathScope;
+    var exploration_parser_js_1 = require_exploration_parser();
+    function deriveSurveyPathScope(baseUrl) {
+      const trimmed = (baseUrl ?? "").trim();
+      if (!trimmed)
+        return null;
+      let parsed;
+      try {
+        parsed = new URL(trimmed);
+      } catch {
+        return null;
+      }
+      if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+        return null;
+      const hashRoute = parsed.hash.startsWith("#/") ? parsed.hash : "";
+      const basePath = (0, exploration_parser_js_1.normalizeRouteForFocusScope)(`${parsed.pathname}${hashRoute}`);
+      if (basePath === "/" || basePath === "/#")
+        return null;
+      return { origin: parsed.origin, basePath };
+    }
+    var AUTH_FLOW_SEGMENTS = /* @__PURE__ */ new Set([
+      "auth",
+      "oauth",
+      "oauth2",
+      "callback",
+      "login",
+      "log-in",
+      "signin",
+      "sign-in",
+      "signup",
+      "sign-up",
+      "register",
+      "logout",
+      "log-out",
+      "signout",
+      "sign-out",
+      "sso",
+      "saml",
+      "oidc"
+    ]);
+    function isAuthFlowRoute(route2) {
+      const normalized = (0, exploration_parser_js_1.normalizeRouteForFocusScope)(route2).toLowerCase();
+      return normalized.split(/[/#]/).some((segment) => AUTH_FLOW_SEGMENTS.has(segment));
+    }
+    function routePathForScope(route2, origin) {
+      const trimmed = (route2 ?? "").trim();
+      if (trimmed.startsWith("//")) {
+        try {
+          const parsed = new URL(`https:${trimmed}`);
+          if (parsed.host !== new URL(origin).host)
+            return null;
+          return `${parsed.pathname}${parsed.search}${parsed.hash}`;
+        } catch {
+          return null;
+        }
+      }
+      if (/^https?:\/\//i.test(trimmed)) {
+        try {
+          const parsed = new URL(trimmed);
+          if (parsed.origin !== origin)
+            return null;
+          return `${parsed.pathname}${parsed.search}${parsed.hash}`;
+        } catch {
+          return trimmed;
+        }
+      }
+      if (trimmed.startsWith("/") && trimmed.includes("..")) {
+        try {
+          const resolved = new URL(trimmed, "https://scope.invalid");
+          return `${resolved.pathname}${resolved.search}${resolved.hash}`;
+        } catch {
+          return trimmed;
+        }
+      }
+      return trimmed;
+    }
+    function buildSurveyScopeBoundary(baseUrl) {
+      const scope = deriveSurveyPathScope(baseUrl);
+      const lines = [
+        '- **Never invent a URL.** Navigate only to pages the app presented (links/buttons you can click, per the rule above) or redirects it performs. Do not guess "common" routes and do not probe made-up routes to see what the error page does'
+      ];
+      if (scope) {
+        lines.push(`- **The base URL PATH is the entry scope** (\`${scope.basePath}\`) \u2014 this survey audits that flow in ISOLATION. Do not truncate the path to visit a parent, and do not visit or catalog sibling paths on this host that in-scope pages never linked to. Pages the flow itself pushes you through (its login page, an auth/OAuth callback, a post-submit redirect) are in scope`);
+      }
+      return lines.join("\n");
+    }
+    function filterFeatureGroupsToPathScope(featureGroups, baseUrl) {
+      const scope = deriveSurveyPathScope(baseUrl);
+      if (!scope) {
+        return { kept: featureGroups, droppedGroups: [], trimmedRoutes: [], trimmedPages: [], basePath: null };
+      }
+      const withinBase = (route2) => {
+        const path = routePathForScope(route2, scope.origin);
+        if (path === null)
+          return false;
+        if ((0, exploration_parser_js_1.routeIsWithinFocusAreas)(path, [scope.basePath]))
+          return true;
+        const norm = (0, exploration_parser_js_1.normalizeRouteForFocusScope)(path);
+        return norm === `${scope.basePath}#` || norm.startsWith(`${scope.basePath}#/`);
+      };
+      const allowedAuthFlow = (route2) => {
+        const path = routePathForScope(route2, scope.origin);
+        return path !== null && isAuthFlowRoute(path);
+      };
+      const kept = [];
+      const droppedGroups = [];
+      const trimmedRoutes = [];
+      const trimmedPages = [];
+      for (const group of featureGroups) {
+        const routes = Array.isArray(group.routes) ? group.routes : [];
+        const keptRoutes = [];
+        const removedRoutes = [];
+        let anchored = false;
+        for (const route2 of routes) {
+          if (withinBase(route2)) {
+            anchored = true;
+            keptRoutes.push(route2);
+          } else if (allowedAuthFlow(route2)) {
+            keptRoutes.push(route2);
+          } else {
+            removedRoutes.push(route2);
+          }
+        }
+        if (!anchored) {
+          droppedGroups.push({ name: group.name, routes: [...routes] });
+          continue;
+        }
+        let pages = group.pages;
+        const removedPages = [];
+        if (Array.isArray(group.pages)) {
+          const keptPages = [];
+          for (const page of group.pages) {
+            if (withinBase(page.route) || allowedAuthFlow(page.route))
+              keptPages.push(page);
+            else
+              removedPages.push(page.route);
+          }
+          pages = keptPages;
+        }
+        if (removedRoutes.length === 0 && removedPages.length === 0) {
+          kept.push(group);
+        } else {
+          kept.push({ ...group, routes: keptRoutes, ...group.pages !== void 0 ? { pages } : {} });
+          if (removedRoutes.length > 0)
+            trimmedRoutes.push({ name: group.name, routes: removedRoutes });
+          if (removedPages.length > 0)
+            trimmedPages.push({ name: group.name, routes: removedPages });
+        }
+      }
+      return { kept, droppedGroups, trimmedRoutes, trimmedPages, basePath: scope.basePath };
+    }
+  }
+});
+
 // ../runner-core/dist/services/discover-explorer.js
 var require_discover_explorer = __commonJS({
   "../runner-core/dist/services/discover-explorer.js"(exports2) {
@@ -321418,6 +321771,7 @@ var require_discover_explorer = __commonJS({
     var evidence_harvester_js_1 = require_evidence_harvester();
     var exploration_parser_js_1 = require_exploration_parser();
     var survey_link_frontier_js_1 = require_survey_link_frontier();
+    var survey_scope_js_1 = require_survey_scope();
     var snapshot_context_compactor_js_2 = require_snapshot_context_compactor();
     Object.defineProperty(exports2, "formatMCPToolResult", { enumerable: true, get: function() {
       return snapshot_context_compactor_js_2.formatMCPToolResult;
@@ -321845,6 +322199,7 @@ If a snapshot's readiness section exposes \`loading_indicators\`, \`skeleton_con
 - **Map, do not mutate.** You MAY click buttons that open modals, popups, or dropdowns for the purpose of CATALOGING their contents (capture_page). Do NOT fill forms, submit data, or click destructive buttons (save, delete, submit) - just catalog the elements and close the modal
 - **Modals/popups/banners**: If a cookie consent banner, onboarding tour, or overlay appears, dismiss it (click close/X/dismiss/accept) and continue. If it reappears on the next page, dismiss it again - some sites show consent banners on every navigation until accepted
 - **Stay on the same origin** as the base URL. Note external links in elements but do not follow them
+${(0, survey_scope_js_1.buildSurveyScopeBoundary)(baseUrl)}
 - **OAuth/SSO**: If login redirects to an external provider (Google, GitHub), do not follow it. Note that the app uses OAuth and explore unauthenticated pages only
 - **Auth failure**: If login${isRegisterMode ? " or account registration" : ""} fails after 2 attempts, capture the auth page and explore unauthenticated pages. Note the failure in your \`finish_exploration\` summary
 - **Parameterized routes**: /users/1 and /users/2 are the same page template. Visit ONE instance, not all of them
@@ -325343,6 +325698,8 @@ var require_agentic_survey_prompts = __commonJS({
     exports2.validateSurveyorOutput = validateSurveyorOutput;
     exports2.buildSurveyAgentsMd = buildSurveyAgentsMd;
     exports2.buildSurveyBriefMd = buildSurveyBriefMd;
+    exports2.buildClaudeSurveyKickoffPrompt = buildClaudeSurveyKickoffPrompt;
+    var survey_scope_js_1 = require_survey_scope();
     var CRITICALITY_VALUES = ["critical", "high", "medium", "low"];
     function isString(v) {
       return typeof v === "string";
@@ -325522,9 +325879,40 @@ var require_agentic_survey_prompts = __commonJS({
         '- Click "delete" or destructive admin actions.',
         "- Leave the baseUrl domain except briefly for OAuth providers.",
         "",
+        "## Navigation scope",
+        "",
+        "The Base URL in BRIEF.md is the ENTRY SCOPE \u2014 its full path, not just",
+        "its domain. Open the exact Base URL first. From there, navigate ONLY to:",
+        "",
+        "- URLs the app actually presented to you: a link, button, or form",
+        "  visible in a snapshot of an in-scope page. (`browser_navigate` to a",
+        "  URL you saw as a link href is fine \u2014 composing one yourself is not.)",
+        "- Redirects the app itself performs during those interactions,",
+        "  including login/OAuth/SSO callback routes needed to complete a flow.",
+        "- The Base URL itself, to return to the start of the flow.",
+        "",
+        "NEVER invent a URL. Do NOT:",
+        "- Parent-walk: truncating the Base URL path (base `/shop/checkout` \u2192",
+        "  visiting `/shop` or `/`) is out of scope even though it is same-origin.",
+        "- Sibling-walk: do not visit or catalog neighbours of the Base URL path",
+        "  that in-scope pages never linked to.",
+        '- Guess "common" routes (`/admin`, `/about`) or probe made-up routes',
+        "  (`/nonexistent`) to see what the error handling does. Do not create",
+        "  featureGroups for generic error/404 pages unless the app itself",
+        "  routes users there as part of a real flow.",
+        "- Any other URL surgery: if the UI did not present it and the app did",
+        "  not redirect you to it, it does not exist for this survey.",
+        "",
+        "When the Base URL path is non-root (e.g. `/shop/checkout`, `/portal/billing`),",
+        "the operator is auditing THAT flow in isolation: every featureGroup must",
+        "describe that flow. Auth pages the flow pushes you through belong inside",
+        "that flow's featureGroup \u2014 do not mint separate featureGroups for them.",
+        "When the Base URL is the origin root, survey the whole app \u2014 the",
+        "no-guessing rule still applies: reach pages through the UI.",
+        "",
         "## Exploration philosophy",
         "",
-        "- Breadth before depth \u2014 map the whole surface before drilling in.",
+        "- Breadth before depth \u2014 map the whole in-scope surface before drilling in.",
         "- Authenticated and unauthenticated surfaces are different products;",
         "  explore both when credentials are available.",
         "- Prefer observing over interacting: open a page, snapshot, note the",
@@ -325619,6 +326007,17 @@ var require_agentic_survey_prompts = __commonJS({
       lines.push("");
       lines.push(`**Base URL:** ${input.baseUrl}`);
       lines.push("");
+      const pathScope = (0, survey_scope_js_1.deriveSurveyPathScope)(input.baseUrl);
+      if (pathScope) {
+        lines.push(`**Entry scope:** \`${pathScope.basePath}\` \u2014 this is a SCOPED survey of one flow.`);
+        lines.push("");
+        lines.push(`Everything you catalog must live under \`${pathScope.basePath}\`, or be a page`);
+        lines.push("this flow itself pushes you through (its own login page, an auth/OAuth");
+        lines.push("callback, a post-submit redirect). Parent and sibling paths on this host");
+        lines.push("are OTHER fixtures/apps and are out of scope \u2014 do not visit them, do not");
+        lines.push("catalog them, do not mint featureGroups for them.");
+        lines.push("");
+      }
       if (input.appBrief && input.appBrief.trim().length > 0) {
         lines.push("## App brief from the operator");
         lines.push("");
@@ -325688,6 +326087,37 @@ var require_agentic_survey_prompts = __commonJS({
       lines.push("");
       return lines.join("\n");
     }
+    function buildClaudeSurveyKickoffPrompt(resultFilePath) {
+      return [
+        "Read AGENTS.md, then read BRIEF.md.",
+        "",
+        `Your deliverable is a SurveyorOutput JSON file at ${resultFilePath}.`,
+        "Follow this procedure exactly:",
+        "",
+        "STEP 1 \u2014 Orient: navigate to the EXACT Base URL from BRIEF.md and",
+        "  snapshot it, then open 2-3 pages its UI visibly links to (e.g. a login",
+        "  link it presents). Navigate only to URLs the page actually presented \u2014",
+        '  never guessed parent, sibling, or "common" routes (see "Navigation',
+        '  scope" in AGENTS.md).',
+        `STEP 2 \u2014 IMMEDIATELY use the Write tool to save a first COMPLETE draft of`,
+        `  the SurveyorOutput JSON to ${resultFilePath}, based on what you have seen`,
+        "  so far. featureGroups must be a non-empty array. Do NOT skip this step",
+        "  and do NOT explore further until this file exists.",
+        "STEP 3 \u2014 Continue exploring breadth-first. Visit each remaining page AT",
+        "  MOST ONCE \u2014 never re-navigate to or re-snapshot a page already seen.",
+        `  After every 3-4 new pages, OVERWRITE ${resultFilePath} with an updated,`,
+        "  complete JSON object.",
+        "STEP 4 \u2014 Stop once you have covered the main in-scope pages (around 20",
+        `  page visits is plenty) or stop finding new features. Do a final OVERWRITE`,
+        `  of ${resultFilePath} with the complete SurveyorOutput, then exit.`,
+        "",
+        "Budget: about 40 tool calls total. If you ever sense you are running low,",
+        `immediately overwrite ${resultFilePath} with your best current JSON and`,
+        "exit \u2014 a complete-but-shallow file always beats no file. Never write an",
+        "empty featureGroups array and never omit the key. No markdown fences, no",
+        "prose in the file \u2014 a single JSON object only."
+      ].join("\n");
+    }
   }
 });
 
@@ -326238,6 +326668,9 @@ ${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwo
       const kickoffPrompt = [
         "Read AGENTS.md, then read BRIEF.md.",
         "Use the playwright MCP tools to explore the site.",
+        'Follow the "Navigation scope" rules in AGENTS.md: start at the exact Base',
+        'URL and never navigate to guessed parent, sibling, or "common" routes \u2014',
+        "only URLs the pages actually present (or redirects the app performs).",
         `When done, write your JSON output to ${resultFilePath} as a single JSON object matching the SurveyorOutput schema in AGENTS.md.`,
         "Then exit."
       ].join("\n");
@@ -329954,32 +330387,7 @@ ${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwo
       await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "AGENTS.md"), surveyAgentsMd, "utf8");
       await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "BRIEF.md"), (0, agentic_survey_prompts_js_1.buildSurveyBriefMd)(briefInput), "utf8");
       log2("Wrote AGENTS.md + BRIEF.md");
-      const kickoffPrompt = [
-        "Read AGENTS.md, then read BRIEF.md.",
-        "",
-        `Your deliverable is a SurveyorOutput JSON file at ${resultFilePath}.`,
-        "Follow this procedure exactly:",
-        "",
-        "STEP 1 \u2014 Orient: navigate to the base URL and 2-3 obvious pages (e.g. the",
-        "  login page and the main dashboard).",
-        `STEP 2 \u2014 IMMEDIATELY use the Write tool to save a first COMPLETE draft of`,
-        `  the SurveyorOutput JSON to ${resultFilePath}, based on what you have seen`,
-        "  so far. featureGroups must be a non-empty array. Do NOT skip this step",
-        "  and do NOT explore further until this file exists.",
-        "STEP 3 \u2014 Continue exploring breadth-first. Visit each remaining page AT",
-        "  MOST ONCE \u2014 never re-navigate to or re-snapshot a page already seen.",
-        `  After every 3-4 new pages, OVERWRITE ${resultFilePath} with an updated,`,
-        "  complete JSON object.",
-        "STEP 4 \u2014 Stop once you have covered the main pages (around 20 page visits",
-        `  is plenty) or stop finding new features. Do a final OVERWRITE of`,
-        `  ${resultFilePath} with the complete SurveyorOutput, then exit.`,
-        "",
-        "Budget: about 40 tool calls total. If you ever sense you are running low,",
-        `immediately overwrite ${resultFilePath} with your best current JSON and`,
-        "exit \u2014 a complete-but-shallow file always beats no file. Never write an",
-        "empty featureGroups array and never omit the key. No markdown fences, no",
-        "prose in the file \u2014 a single JSON object only."
-      ].join("\n");
+      const kickoffPrompt = (0, agentic_survey_prompts_js_1.buildClaudeSurveyKickoffPrompt)(resultFilePath);
       const credentialScrubMap = {};
       for (const c of credentials) {
         credentialScrubMap[c.email] = "<email>";
@@ -333991,7 +334399,7 @@ var require_local_auth_state = __commonJS({
     exports2.ensurePrivateDirectory = ensurePrivateDirectory2;
     exports2.isValidStorageState = isValidStorageState;
     exports2.isValidStorageStateJson = isValidStorageStateJson;
-    exports2.isValidLocalAuthStateFile = isValidLocalAuthStateFile;
+    exports2.isValidLocalAuthStateFile = isValidLocalAuthStateFile2;
     exports2.cleanupLocalAuthStateFiles = cleanupLocalAuthStateFiles;
     exports2.cleanupExpiredLocalAuthStateFiles = cleanupExpiredLocalAuthStateFiles2;
     exports2.localAuthStatePaths = localAuthStatePaths2;
@@ -334005,6 +334413,7 @@ var require_local_auth_state = __commonJS({
     var node_fs_1 = require("fs");
     var node_crypto_1 = require("crypto");
     var node_path_1 = require("path");
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var auth_recipe_js_1 = require_auth_recipe();
     exports2.LOCAL_AUTH_STATE_MAX_AGE_MS = 60 * 60 * 1e3;
     exports2.LOCAL_AUTH_STATE_WAIT_MS = 3 * 60 * 1e3;
@@ -334134,7 +334543,7 @@ var require_local_auth_state = __commonJS({
         return false;
       return isValidStorageState(value);
     }
-    function isValidLocalAuthStateFile(path) {
+    function isValidLocalAuthStateFile2(path) {
       try {
         return isStorageStateShape(JSON.parse((0, node_fs_1.readFileSync)(path, "utf8")));
       } catch {
@@ -334192,11 +334601,22 @@ var require_local_auth_state = __commonJS({
         lockPath: `${cachePath}.lock`
       };
     }
+    function localAuthStateExpiredByAuthMaterial(path, now) {
+      try {
+        return (0, shared_1.storageStateExpiredBySkew)((0, node_fs_1.readFileSync)(path, "utf8"), now);
+      } catch {
+        return false;
+      }
+    }
     function getValidLocalAuthState2(path, now = Date.now(), maxAgeMs = exports2.LOCAL_AUTH_STATE_MAX_AGE_MS) {
       if (!(0, node_fs_1.existsSync)(path))
         return void 0;
       try {
-        if (now - (0, node_fs_1.statSync)(path).mtimeMs >= maxAgeMs || !isValidLocalAuthStateFile(path)) {
+        if (now - (0, node_fs_1.statSync)(path).mtimeMs >= maxAgeMs || !isValidLocalAuthStateFile2(path)) {
+          removeFile(path);
+          return void 0;
+        }
+        if (localAuthStateExpiredByAuthMaterial(path, now)) {
           removeFile(path);
           return void 0;
         }
@@ -334243,7 +334663,7 @@ var require_local_auth_state = __commonJS({
         removeFile(capturePath);
         return false;
       }
-      if (!(0, node_fs_1.existsSync)(capturePath) || !isValidLocalAuthStateFile(capturePath)) {
+      if (!(0, node_fs_1.existsSync)(capturePath) || !isValidLocalAuthStateFile2(capturePath)) {
         removeFile(capturePath);
         return false;
       }
@@ -334257,7 +334677,7 @@ var require_local_auth_state = __commonJS({
           return false;
         }
         if ((0, node_fs_1.existsSync)(cachePath)) {
-          if (!replaceExisting && isValidLocalAuthStateFile(cachePath)) {
+          if (!replaceExisting && isValidLocalAuthStateFile2(cachePath)) {
             removeFile(capturePath);
             return true;
           }
@@ -334274,7 +334694,7 @@ var require_local_auth_state = __commonJS({
         }
         return true;
       } catch {
-        const winnerIsValid = (0, node_fs_1.existsSync)(cachePath) && isValidLocalAuthStateFile(cachePath);
+        const winnerIsValid = (0, node_fs_1.existsSync)(cachePath) && isValidLocalAuthStateFile2(cachePath);
         removeFile(capturePath);
         return winnerIsValid;
       }
@@ -346584,9 +347004,9 @@ var require_dist2 = __commonJS({
       for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding(exports3, m, p);
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.extractZipSafely = exports2.downloadArchiveCapped = exports2.detectArchiveKind = exports2.acquireRepoForImport = exports2.runFrameworkImportOnRunner = exports2.getAgenticEngine = exports2.resolveRefFromSnapshot = exports2.replayAuthRecipeIntoBrowser = exports2.runRegisterCaptureRun = exports2.runLoginCaptureRun = exports2.filterLoginCaptureCredentials = exports2.buildLoginCaptureCredentials = exports2.isReservedRunnerEnvVar = exports2.RESERVED_RUNNER_ENV_VARS = exports2.AUTH_MARKER_VERSION = exports2.buildHealAuthStamp = exports2.extractAuthRegion = exports2.upsertAuthBlock = exports2.buildAuthRecipe = exports2.commandToReplayStep = exports2.buildReplayPlan = exports2.absoluteRoute = exports2.renderReplaySettleArrow = exports2.renderReplayClickArrow = exports2.renderAuthFn = exports2.canonicalizeRoute = exports2.executeGrokPerBatchHeal = exports2.executeGrokPerTestHeal = exports2.headerVal = exports2.classifyAuthType = exports2.isTextExcerptable = exports2.isStaticAssetByExt = exports2.isApiCall = exports2.buildApiCallSummary = exports2.computeMobileHealOutcome = exports2.detectMobileStepSecretLeak = exports2.redactMobileSecretsFromText = exports2.MOBILE_LIVE_HEAL_SYSTEM_PROMPT = exports2.MOBILE_SCRIPT_HEAL_SYSTEM_PROMPT = exports2.executeMobileLiveHeal = exports2.executeMobileTestWithHealing = exports2.executeMobileScriptDrivenHeal = exports2.prepareMobileScenarioAppState = exports2.runMobileGeneratePhase = exports2.runMobileAIPlanner = exports2.buildMobileSiteMap = exports2.formatMobileEvidenceForPlanner = exports2.MOBILE_SCENARIO_SYSTEM_PROMPT = exports2.MOBILE_SURVEY_SYSTEM_PROMPT = exports2.runMobileExplorePhase = void 0;
-    exports2.decideAppRenderType = exports2.detectCanvasApp = exports2.detectRateLimitBlock = exports2.isSafeCanonicalRedirect = exports2.resolveBaseUrlPreflight = exports2.checkBaseUrlRedirect = exports2.stripJsonFences = exports2.scrubCredentials = exports2.withAIRetry = exports2.snapshotMatchingChildren = exports2.findNewChromiumChildPid = exports2.killProcessTree = exports2.gracefulCloseWithTreeKill = exports2.liveBrowserRegistry = exports2.REPO_SWITCH_REMOVED_FRACTION = exports2.MAX_MANIFEST_FILES = exports2.toDiffSummary = exports2.isLikelyTestFile = exports2.sanitizeRepoRelPath = exports2.sha256Hex = exports2.hashFiles = exports2.enumerateTestFiles = exports2.buildNextManifest = exports2.detectRepoSwitch = exports2.classifyImportDiff = exports2.parseImportManifest = exports2.REPO_ANALYSIS_SCHEMA_VERSION = exports2.validateSourceEndpoints = exports2.validateAuthoredTest = exports2.validateRepoMapFile = exports2.validateRepoMemoryFile = exports2.buildTestingStandardsSection = exports2.buildRepoAuthorSystemRules = exports2.buildRepoAuthorKickoff = exports2.buildRepoAuthorContractMd = exports2.buildRepoMapSystemRules = exports2.buildRepoMapKickoff = exports2.buildRepoMapContractMd = exports2.buildRepoMemorySystemRules = exports2.buildRepoMemoryKickoff = exports2.buildRepoMemoryContractMd = exports2.runRepoAnalysisOnRunner = exports2.IMPORT_SCHEMA_VERSION = exports2.validateImportResultFile = exports2.validateImportedTest = exports2.buildImportSystemRules = exports2.buildImportKickoff = exports2.buildImportContractMd = exports2.MAX_ARCHIVE_BYTES = exports2.isUnsafeEntryName = void 0;
-    exports2.UNSUPPORTED_RENDERER_PREFIX = exports2.UnsupportedRendererError = exports2.buildCanvasModeAuthoringAddendum = exports2.buildUnsupportedRendererMessage = exports2.modelSupportsVision = exports2.decideCanvasStrategy = void 0;
+    exports2.acquireRepoForImport = exports2.runFrameworkImportOnRunner = exports2.getAgenticEngine = exports2.resolveRefFromSnapshot = exports2.replayAuthRecipeIntoBrowser = exports2.runRegisterCaptureRun = exports2.runLoginCaptureRun = exports2.filterLoginCaptureCredentials = exports2.buildLoginCaptureCredentials = exports2.isReservedRunnerEnvVar = exports2.RESERVED_RUNNER_ENV_VARS = exports2.AUTH_MARKER_VERSION = exports2.buildHealAuthStamp = exports2.extractAuthRegion = exports2.upsertAuthBlock = exports2.buildAuthRecipe = exports2.commandToReplayStep = exports2.buildReplayPlan = exports2.absoluteRoute = exports2.renderReplaySettleArrow = exports2.renderReplayClickArrow = exports2.renderAuthFn = exports2.filterFeatureGroupsToPathScope = exports2.isAuthFlowRoute = exports2.deriveSurveyPathScope = exports2.canonicalizeRoute = exports2.executeGrokPerBatchHeal = exports2.executeGrokPerTestHeal = exports2.headerVal = exports2.classifyAuthType = exports2.isTextExcerptable = exports2.isStaticAssetByExt = exports2.isApiCall = exports2.buildApiCallSummary = exports2.computeMobileHealOutcome = exports2.detectMobileStepSecretLeak = exports2.redactMobileSecretsFromText = exports2.MOBILE_LIVE_HEAL_SYSTEM_PROMPT = exports2.MOBILE_SCRIPT_HEAL_SYSTEM_PROMPT = exports2.executeMobileLiveHeal = exports2.executeMobileTestWithHealing = exports2.executeMobileScriptDrivenHeal = exports2.prepareMobileScenarioAppState = exports2.runMobileGeneratePhase = exports2.runMobileAIPlanner = exports2.buildMobileSiteMap = exports2.formatMobileEvidenceForPlanner = exports2.MOBILE_SCENARIO_SYSTEM_PROMPT = exports2.MOBILE_SURVEY_SYSTEM_PROMPT = exports2.runMobileExplorePhase = void 0;
+    exports2.isSafeCanonicalRedirect = exports2.resolveBaseUrlPreflight = exports2.checkBaseUrlRedirect = exports2.stripJsonFences = exports2.scrubCredentials = exports2.withAIRetry = exports2.snapshotMatchingChildren = exports2.findNewChromiumChildPid = exports2.killProcessTree = exports2.gracefulCloseWithTreeKill = exports2.liveBrowserRegistry = exports2.REPO_SWITCH_REMOVED_FRACTION = exports2.MAX_MANIFEST_FILES = exports2.toDiffSummary = exports2.isLikelyTestFile = exports2.sanitizeRepoRelPath = exports2.sha256Hex = exports2.hashFiles = exports2.enumerateTestFiles = exports2.buildNextManifest = exports2.detectRepoSwitch = exports2.classifyImportDiff = exports2.parseImportManifest = exports2.REPO_ANALYSIS_SCHEMA_VERSION = exports2.validateSourceEndpoints = exports2.validateAuthoredTest = exports2.validateRepoMapFile = exports2.validateRepoMemoryFile = exports2.buildTestingStandardsSection = exports2.buildRepoAuthorSystemRules = exports2.buildRepoAuthorKickoff = exports2.buildRepoAuthorContractMd = exports2.buildRepoMapSystemRules = exports2.buildRepoMapKickoff = exports2.buildRepoMapContractMd = exports2.buildRepoMemorySystemRules = exports2.buildRepoMemoryKickoff = exports2.buildRepoMemoryContractMd = exports2.runRepoAnalysisOnRunner = exports2.IMPORT_SCHEMA_VERSION = exports2.validateImportResultFile = exports2.validateImportedTest = exports2.buildImportSystemRules = exports2.buildImportKickoff = exports2.buildImportContractMd = exports2.MAX_ARCHIVE_BYTES = exports2.isUnsafeEntryName = exports2.extractZipSafely = exports2.downloadArchiveCapped = exports2.detectArchiveKind = void 0;
+    exports2.UNSUPPORTED_RENDERER_PREFIX = exports2.UnsupportedRendererError = exports2.buildCanvasModeAuthoringAddendum = exports2.buildUnsupportedRendererMessage = exports2.modelSupportsVision = exports2.decideCanvasStrategy = exports2.decideAppRenderType = exports2.detectCanvasApp = exports2.detectRateLimitBlock = void 0;
     __exportStar(require_ai_provider(), exports2);
     __exportStar(require_mobile_types(), exports2);
     __exportStar(require_mobile_source_parser(), exports2);
@@ -346694,6 +347114,16 @@ var require_dist2 = __commonJS({
     Object.defineProperty(exports2, "canonicalizeRoute", { enumerable: true, get: function() {
       return exploration_parser_js_1.canonicalizeRoute;
     } });
+    var survey_scope_js_1 = require_survey_scope();
+    Object.defineProperty(exports2, "deriveSurveyPathScope", { enumerable: true, get: function() {
+      return survey_scope_js_1.deriveSurveyPathScope;
+    } });
+    Object.defineProperty(exports2, "isAuthFlowRoute", { enumerable: true, get: function() {
+      return survey_scope_js_1.isAuthFlowRoute;
+    } });
+    Object.defineProperty(exports2, "filterFeatureGroupsToPathScope", { enumerable: true, get: function() {
+      return survey_scope_js_1.filterFeatureGroupsToPathScope;
+    } });
     var auth_recipe_js_1 = require_auth_recipe();
     Object.defineProperty(exports2, "renderAuthFn", { enumerable: true, get: function() {
       return auth_recipe_js_1.renderAuthFn;
@@ -346967,7 +347397,7 @@ var require_package4 = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.47",
+      version: "1.0.49",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"
@@ -356629,7 +357059,7 @@ ${result2.logs}`);
         });
       } finally {
         if (runAuthPath && authPaths) {
-          if ((0, import_runner_core12.getValidLocalAuthState)(runAuthPath)) {
+          if ((0, import_runner_core12.isValidLocalAuthStateFile)(runAuthPath)) {
             const releasePromotionLock = releaseAuthLock ? void 0 : await (0, import_runner_core12.acquireLocalAuthStateLock)(authPaths.lockKey, authPaths.lockPath);
             try {
               const captured = (0, import_runner_core12.promoteLocalAuthStateCapture)(