@validate.qa/runner 1.0.48 → 1.0.49

package/dist/cli.js

@@ -77288,7 +77288,7 @@ var require_discover_ai_planner = __commonJS({
   "../runner-core/dist/services/discover-ai-planner.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.PLANNER_STRENGTHEN_GATE_PROMPT = exports2.SCENARIO_SYSTEM_PROMPT = void 0;
+    exports2.PLANNER_STRENGTHEN_GATE_PROMPT = exports2.SCENARIO_SYSTEM_PROMPT = exports2.SURVEY_SYSTEM_PROMPT = void 0;
     exports2.getAIPlannerMaxTokens = getAIPlannerMaxTokens;
     exports2.getSnapshotConfidence = getSnapshotConfidence;
     exports2.compressSiteMap = compressSiteMap;
@@ -77824,7 +77824,7 @@ Plan these LOGGED-OUT instead (keep their own establishment steps; do NOT assume
       }
       return sections.join("\n\n");
     }
-    var SURVEY_SYSTEM_PROMPT = `You are a feature analyst for a web application. You receive evidence from an AI explorer that mapped the entire site. Your job is to organize pages into meaningful feature groups.
+    exports2.SURVEY_SYSTEM_PROMPT = `You are a feature analyst for a web application. You receive evidence from an AI explorer that mapped the entire site. Your job is to organize pages into meaningful feature groups.
 
 ## Output Discipline
 Return ONLY one valid JSON object matching the schema below. Do NOT include <think> blocks, markdown fences, analysis, prose, or any text outside the JSON object. Put any brief explanation only in the JSON "reasoning" field.
@@ -77844,6 +77844,7 @@ Return ONLY one valid JSON object matching the schema below. Do NOT include <thi
 6. Do NOT merge pages into one feature just because they serve a similar broader goal. Treat areas as separate features when the evidence shows separate primary navigation destinations (e.g. separate sidebar links), separate route families below the app shell (e.g. /dashboard/documents/* vs /dashboard/reports/* are separate even though both are under /dashboard), or different CRUD entities/forms. Keep pages together when they share one navigational area and operate on the same entity (e.g. /applications, /applications/stats, /applications?filter= all belong together).
 7. Feature descriptions MUST reference actual element labels from the evidence
 8. Do NOT create standalone features for generic error pages (404, 500, access denied). If a business route is broken or crashes, keep it in its intended feature and note the failure in the description. Error pages do not need their own deep exploration run.
+9. The Base URL's PATH is the survey's entry scope. When it is non-root (e.g. \`/shop/checkout\`), the operator is auditing that one flow in isolation: do NOT create featureGroups for parent paths, sibling paths, or guessed/nonexistent routes on the same host \u2014 even if the explorer's evidence wandered there. Auth pages the flow itself traverses (its login page, an \`/api/auth/*\` callback) belong INSIDE that flow's group, not in separate groups. When the Base URL path is \`/\`, group the whole app as usual.
 
 ## Output JSON Schema
 {
@@ -78596,7 +78597,7 @@ Keep the exact JSON schema { "featureGroups":[...], "scenarios":[...], "reasonin
       const agentModel = options.modelOverride ? (0, ai_provider_js_1.resolveModelForTask)(options.modelOverride, "agent") : (0, ai_provider_js_1.getModel)("agent");
       const plannerMaxTokens = getAIPlannerMaxTokens(agentModel);
       logs2.push(`AI planner [${context.mode}]: ${siteMap.pages.length} pages, ${evidence.recordedJourneys.length} journeys, budget ${context.testBudget}`);
-      const systemPrompt = options.systemPromptOverride ?? (context.mode === "survey" ? SURVEY_SYSTEM_PROMPT : exports2.SCENARIO_SYSTEM_PROMPT);
+      const systemPrompt = options.systemPromptOverride ?? (context.mode === "survey" ? exports2.SURVEY_SYSTEM_PROMPT : exports2.SCENARIO_SYSTEM_PROMPT);
       const userPrompt = options.userPromptOverride ?? formatEvidenceForPlanner(compressed, evidence, context);
       logs2.push(`AI planner: ~${Math.ceil(userPrompt.length / 3.5)} input tokens`);
       const aiClient = options.aiClient ?? (options.modelOverride ? (0, ai_provider_js_1.getRunnerClientForModel)(options.modelOverride) : (0, ai_provider_js_1.getRunnerAIClient)());
@@ -321567,6 +321568,168 @@ var require_evidence_harvester = __commonJS({
   }
 });
 
+// ../runner-core/dist/services/survey-scope.js
+var require_survey_scope = __commonJS({
+  "../runner-core/dist/services/survey-scope.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.deriveSurveyPathScope = deriveSurveyPathScope;
+    exports2.isAuthFlowRoute = isAuthFlowRoute;
+    exports2.buildSurveyScopeBoundary = buildSurveyScopeBoundary;
+    exports2.filterFeatureGroupsToPathScope = filterFeatureGroupsToPathScope;
+    var exploration_parser_js_1 = require_exploration_parser();
+    function deriveSurveyPathScope(baseUrl) {
+      const trimmed = (baseUrl ?? "").trim();
+      if (!trimmed)
+        return null;
+      let parsed;
+      try {
+        parsed = new URL(trimmed);
+      } catch {
+        return null;
+      }
+      if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+        return null;
+      const hashRoute = parsed.hash.startsWith("#/") ? parsed.hash : "";
+      const basePath = (0, exploration_parser_js_1.normalizeRouteForFocusScope)(`${parsed.pathname}${hashRoute}`);
+      if (basePath === "/" || basePath === "/#")
+        return null;
+      return { origin: parsed.origin, basePath };
+    }
+    var AUTH_FLOW_SEGMENTS = /* @__PURE__ */ new Set([
+      "auth",
+      "oauth",
+      "oauth2",
+      "callback",
+      "login",
+      "log-in",
+      "signin",
+      "sign-in",
+      "signup",
+      "sign-up",
+      "register",
+      "logout",
+      "log-out",
+      "signout",
+      "sign-out",
+      "sso",
+      "saml",
+      "oidc"
+    ]);
+    function isAuthFlowRoute(route2) {
+      const normalized = (0, exploration_parser_js_1.normalizeRouteForFocusScope)(route2).toLowerCase();
+      return normalized.split(/[/#]/).some((segment) => AUTH_FLOW_SEGMENTS.has(segment));
+    }
+    function routePathForScope(route2, origin) {
+      const trimmed = (route2 ?? "").trim();
+      if (trimmed.startsWith("//")) {
+        try {
+          const parsed = new URL(`https:${trimmed}`);
+          if (parsed.host !== new URL(origin).host)
+            return null;
+          return `${parsed.pathname}${parsed.search}${parsed.hash}`;
+        } catch {
+          return null;
+        }
+      }
+      if (/^https?:\/\//i.test(trimmed)) {
+        try {
+          const parsed = new URL(trimmed);
+          if (parsed.origin !== origin)
+            return null;
+          return `${parsed.pathname}${parsed.search}${parsed.hash}`;
+        } catch {
+          return trimmed;
+        }
+      }
+      if (trimmed.startsWith("/") && trimmed.includes("..")) {
+        try {
+          const resolved = new URL(trimmed, "https://scope.invalid");
+          return `${resolved.pathname}${resolved.search}${resolved.hash}`;
+        } catch {
+          return trimmed;
+        }
+      }
+      return trimmed;
+    }
+    function buildSurveyScopeBoundary(baseUrl) {
+      const scope = deriveSurveyPathScope(baseUrl);
+      const lines = [
+        '- **Never invent a URL.** Navigate only to pages the app presented (links/buttons you can click, per the rule above) or redirects it performs. Do not guess "common" routes and do not probe made-up routes to see what the error page does'
+      ];
+      if (scope) {
+        lines.push(`- **The base URL PATH is the entry scope** (\`${scope.basePath}\`) \u2014 this survey audits that flow in ISOLATION. Do not truncate the path to visit a parent, and do not visit or catalog sibling paths on this host that in-scope pages never linked to. Pages the flow itself pushes you through (its login page, an auth/OAuth callback, a post-submit redirect) are in scope`);
+      }
+      return lines.join("\n");
+    }
+    function filterFeatureGroupsToPathScope(featureGroups, baseUrl) {
+      const scope = deriveSurveyPathScope(baseUrl);
+      if (!scope) {
+        return { kept: featureGroups, droppedGroups: [], trimmedRoutes: [], trimmedPages: [], basePath: null };
+      }
+      const withinBase = (route2) => {
+        const path = routePathForScope(route2, scope.origin);
+        if (path === null)
+          return false;
+        if ((0, exploration_parser_js_1.routeIsWithinFocusAreas)(path, [scope.basePath]))
+          return true;
+        const norm = (0, exploration_parser_js_1.normalizeRouteForFocusScope)(path);
+        return norm === `${scope.basePath}#` || norm.startsWith(`${scope.basePath}#/`);
+      };
+      const allowedAuthFlow = (route2) => {
+        const path = routePathForScope(route2, scope.origin);
+        return path !== null && isAuthFlowRoute(path);
+      };
+      const kept = [];
+      const droppedGroups = [];
+      const trimmedRoutes = [];
+      const trimmedPages = [];
+      for (const group of featureGroups) {
+        const routes = Array.isArray(group.routes) ? group.routes : [];
+        const keptRoutes = [];
+        const removedRoutes = [];
+        let anchored = false;
+        for (const route2 of routes) {
+          if (withinBase(route2)) {
+            anchored = true;
+            keptRoutes.push(route2);
+          } else if (allowedAuthFlow(route2)) {
+            keptRoutes.push(route2);
+          } else {
+            removedRoutes.push(route2);
+          }
+        }
+        if (!anchored) {
+          droppedGroups.push({ name: group.name, routes: [...routes] });
+          continue;
+        }
+        let pages = group.pages;
+        const removedPages = [];
+        if (Array.isArray(group.pages)) {
+          const keptPages = [];
+          for (const page of group.pages) {
+            if (withinBase(page.route) || allowedAuthFlow(page.route))
+              keptPages.push(page);
+            else
+              removedPages.push(page.route);
+          }
+          pages = keptPages;
+        }
+        if (removedRoutes.length === 0 && removedPages.length === 0) {
+          kept.push(group);
+        } else {
+          kept.push({ ...group, routes: keptRoutes, ...group.pages !== void 0 ? { pages } : {} });
+          if (removedRoutes.length > 0)
+            trimmedRoutes.push({ name: group.name, routes: removedRoutes });
+          if (removedPages.length > 0)
+            trimmedPages.push({ name: group.name, routes: removedPages });
+        }
+      }
+      return { kept, droppedGroups, trimmedRoutes, trimmedPages, basePath: scope.basePath };
+    }
+  }
+});
+
 // ../runner-core/dist/services/discover-explorer.js
 var require_discover_explorer = __commonJS({
   "../runner-core/dist/services/discover-explorer.js"(exports2) {
@@ -321608,6 +321771,7 @@ var require_discover_explorer = __commonJS({
     var evidence_harvester_js_1 = require_evidence_harvester();
     var exploration_parser_js_1 = require_exploration_parser();
     var survey_link_frontier_js_1 = require_survey_link_frontier();
+    var survey_scope_js_1 = require_survey_scope();
     var snapshot_context_compactor_js_2 = require_snapshot_context_compactor();
     Object.defineProperty(exports2, "formatMCPToolResult", { enumerable: true, get: function() {
       return snapshot_context_compactor_js_2.formatMCPToolResult;
@@ -322035,6 +322199,7 @@ If a snapshot's readiness section exposes \`loading_indicators\`, \`skeleton_con
 - **Map, do not mutate.** You MAY click buttons that open modals, popups, or dropdowns for the purpose of CATALOGING their contents (capture_page). Do NOT fill forms, submit data, or click destructive buttons (save, delete, submit) - just catalog the elements and close the modal
 - **Modals/popups/banners**: If a cookie consent banner, onboarding tour, or overlay appears, dismiss it (click close/X/dismiss/accept) and continue. If it reappears on the next page, dismiss it again - some sites show consent banners on every navigation until accepted
 - **Stay on the same origin** as the base URL. Note external links in elements but do not follow them
+${(0, survey_scope_js_1.buildSurveyScopeBoundary)(baseUrl)}
 - **OAuth/SSO**: If login redirects to an external provider (Google, GitHub), do not follow it. Note that the app uses OAuth and explore unauthenticated pages only
 - **Auth failure**: If login${isRegisterMode ? " or account registration" : ""} fails after 2 attempts, capture the auth page and explore unauthenticated pages. Note the failure in your \`finish_exploration\` summary
 - **Parameterized routes**: /users/1 and /users/2 are the same page template. Visit ONE instance, not all of them
@@ -325533,6 +325698,8 @@ var require_agentic_survey_prompts = __commonJS({
     exports2.validateSurveyorOutput = validateSurveyorOutput;
     exports2.buildSurveyAgentsMd = buildSurveyAgentsMd;
     exports2.buildSurveyBriefMd = buildSurveyBriefMd;
+    exports2.buildClaudeSurveyKickoffPrompt = buildClaudeSurveyKickoffPrompt;
+    var survey_scope_js_1 = require_survey_scope();
     var CRITICALITY_VALUES = ["critical", "high", "medium", "low"];
     function isString(v) {
       return typeof v === "string";
@@ -325712,9 +325879,40 @@ var require_agentic_survey_prompts = __commonJS({
         '- Click "delete" or destructive admin actions.',
         "- Leave the baseUrl domain except briefly for OAuth providers.",
         "",
+        "## Navigation scope",
+        "",
+        "The Base URL in BRIEF.md is the ENTRY SCOPE \u2014 its full path, not just",
+        "its domain. Open the exact Base URL first. From there, navigate ONLY to:",
+        "",
+        "- URLs the app actually presented to you: a link, button, or form",
+        "  visible in a snapshot of an in-scope page. (`browser_navigate` to a",
+        "  URL you saw as a link href is fine \u2014 composing one yourself is not.)",
+        "- Redirects the app itself performs during those interactions,",
+        "  including login/OAuth/SSO callback routes needed to complete a flow.",
+        "- The Base URL itself, to return to the start of the flow.",
+        "",
+        "NEVER invent a URL. Do NOT:",
+        "- Parent-walk: truncating the Base URL path (base `/shop/checkout` \u2192",
+        "  visiting `/shop` or `/`) is out of scope even though it is same-origin.",
+        "- Sibling-walk: do not visit or catalog neighbours of the Base URL path",
+        "  that in-scope pages never linked to.",
+        '- Guess "common" routes (`/admin`, `/about`) or probe made-up routes',
+        "  (`/nonexistent`) to see what the error handling does. Do not create",
+        "  featureGroups for generic error/404 pages unless the app itself",
+        "  routes users there as part of a real flow.",
+        "- Any other URL surgery: if the UI did not present it and the app did",
+        "  not redirect you to it, it does not exist for this survey.",
+        "",
+        "When the Base URL path is non-root (e.g. `/shop/checkout`, `/portal/billing`),",
+        "the operator is auditing THAT flow in isolation: every featureGroup must",
+        "describe that flow. Auth pages the flow pushes you through belong inside",
+        "that flow's featureGroup \u2014 do not mint separate featureGroups for them.",
+        "When the Base URL is the origin root, survey the whole app \u2014 the",
+        "no-guessing rule still applies: reach pages through the UI.",
+        "",
         "## Exploration philosophy",
         "",
-        "- Breadth before depth \u2014 map the whole surface before drilling in.",
+        "- Breadth before depth \u2014 map the whole in-scope surface before drilling in.",
         "- Authenticated and unauthenticated surfaces are different products;",
         "  explore both when credentials are available.",
         "- Prefer observing over interacting: open a page, snapshot, note the",
@@ -325809,6 +326007,17 @@ var require_agentic_survey_prompts = __commonJS({
       lines.push("");
       lines.push(`**Base URL:** ${input.baseUrl}`);
       lines.push("");
+      const pathScope = (0, survey_scope_js_1.deriveSurveyPathScope)(input.baseUrl);
+      if (pathScope) {
+        lines.push(`**Entry scope:** \`${pathScope.basePath}\` \u2014 this is a SCOPED survey of one flow.`);
+        lines.push("");
+        lines.push(`Everything you catalog must live under \`${pathScope.basePath}\`, or be a page`);
+        lines.push("this flow itself pushes you through (its own login page, an auth/OAuth");
+        lines.push("callback, a post-submit redirect). Parent and sibling paths on this host");
+        lines.push("are OTHER fixtures/apps and are out of scope \u2014 do not visit them, do not");
+        lines.push("catalog them, do not mint featureGroups for them.");
+        lines.push("");
+      }
       if (input.appBrief && input.appBrief.trim().length > 0) {
         lines.push("## App brief from the operator");
         lines.push("");
@@ -325878,6 +326087,37 @@ var require_agentic_survey_prompts = __commonJS({
       lines.push("");
       return lines.join("\n");
     }
+    function buildClaudeSurveyKickoffPrompt(resultFilePath) {
+      return [
+        "Read AGENTS.md, then read BRIEF.md.",
+        "",
+        `Your deliverable is a SurveyorOutput JSON file at ${resultFilePath}.`,
+        "Follow this procedure exactly:",
+        "",
+        "STEP 1 \u2014 Orient: navigate to the EXACT Base URL from BRIEF.md and",
+        "  snapshot it, then open 2-3 pages its UI visibly links to (e.g. a login",
+        "  link it presents). Navigate only to URLs the page actually presented \u2014",
+        '  never guessed parent, sibling, or "common" routes (see "Navigation',
+        '  scope" in AGENTS.md).',
+        `STEP 2 \u2014 IMMEDIATELY use the Write tool to save a first COMPLETE draft of`,
+        `  the SurveyorOutput JSON to ${resultFilePath}, based on what you have seen`,
+        "  so far. featureGroups must be a non-empty array. Do NOT skip this step",
+        "  and do NOT explore further until this file exists.",
+        "STEP 3 \u2014 Continue exploring breadth-first. Visit each remaining page AT",
+        "  MOST ONCE \u2014 never re-navigate to or re-snapshot a page already seen.",
+        `  After every 3-4 new pages, OVERWRITE ${resultFilePath} with an updated,`,
+        "  complete JSON object.",
+        "STEP 4 \u2014 Stop once you have covered the main in-scope pages (around 20",
+        `  page visits is plenty) or stop finding new features. Do a final OVERWRITE`,
+        `  of ${resultFilePath} with the complete SurveyorOutput, then exit.`,
+        "",
+        "Budget: about 40 tool calls total. If you ever sense you are running low,",
+        `immediately overwrite ${resultFilePath} with your best current JSON and`,
+        "exit \u2014 a complete-but-shallow file always beats no file. Never write an",
+        "empty featureGroups array and never omit the key. No markdown fences, no",
+        "prose in the file \u2014 a single JSON object only."
+      ].join("\n");
+    }
   }
 });
 
@@ -326428,6 +326668,9 @@ ${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwo
       const kickoffPrompt = [
         "Read AGENTS.md, then read BRIEF.md.",
         "Use the playwright MCP tools to explore the site.",
+        'Follow the "Navigation scope" rules in AGENTS.md: start at the exact Base',
+        'URL and never navigate to guessed parent, sibling, or "common" routes \u2014',
+        "only URLs the pages actually present (or redirects the app performs).",
         `When done, write your JSON output to ${resultFilePath} as a single JSON object matching the SurveyorOutput schema in AGENTS.md.`,
         "Then exit."
       ].join("\n");
@@ -330144,32 +330387,7 @@ ${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwo
       await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "AGENTS.md"), surveyAgentsMd, "utf8");
       await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "BRIEF.md"), (0, agentic_survey_prompts_js_1.buildSurveyBriefMd)(briefInput), "utf8");
       log2("Wrote AGENTS.md + BRIEF.md");
-      const kickoffPrompt = [
-        "Read AGENTS.md, then read BRIEF.md.",
-        "",
-        `Your deliverable is a SurveyorOutput JSON file at ${resultFilePath}.`,
-        "Follow this procedure exactly:",
-        "",
-        "STEP 1 \u2014 Orient: navigate to the base URL and 2-3 obvious pages (e.g. the",
-        "  login page and the main dashboard).",
-        `STEP 2 \u2014 IMMEDIATELY use the Write tool to save a first COMPLETE draft of`,
-        `  the SurveyorOutput JSON to ${resultFilePath}, based on what you have seen`,
-        "  so far. featureGroups must be a non-empty array. Do NOT skip this step",
-        "  and do NOT explore further until this file exists.",
-        "STEP 3 \u2014 Continue exploring breadth-first. Visit each remaining page AT",
-        "  MOST ONCE \u2014 never re-navigate to or re-snapshot a page already seen.",
-        `  After every 3-4 new pages, OVERWRITE ${resultFilePath} with an updated,`,
-        "  complete JSON object.",
-        "STEP 4 \u2014 Stop once you have covered the main pages (around 20 page visits",
-        `  is plenty) or stop finding new features. Do a final OVERWRITE of`,
-        `  ${resultFilePath} with the complete SurveyorOutput, then exit.`,
-        "",
-        "Budget: about 40 tool calls total. If you ever sense you are running low,",
-        `immediately overwrite ${resultFilePath} with your best current JSON and`,
-        "exit \u2014 a complete-but-shallow file always beats no file. Never write an",
-        "empty featureGroups array and never omit the key. No markdown fences, no",
-        "prose in the file \u2014 a single JSON object only."
-      ].join("\n");
+      const kickoffPrompt = (0, agentic_survey_prompts_js_1.buildClaudeSurveyKickoffPrompt)(resultFilePath);
       const credentialScrubMap = {};
       for (const c of credentials) {
         credentialScrubMap[c.email] = "<email>";
@@ -346786,9 +347004,9 @@ var require_dist2 = __commonJS({
       for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding(exports3, m, p);
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.extractZipSafely = exports2.downloadArchiveCapped = exports2.detectArchiveKind = exports2.acquireRepoForImport = exports2.runFrameworkImportOnRunner = exports2.getAgenticEngine = exports2.resolveRefFromSnapshot = exports2.replayAuthRecipeIntoBrowser = exports2.runRegisterCaptureRun = exports2.runLoginCaptureRun = exports2.filterLoginCaptureCredentials = exports2.buildLoginCaptureCredentials = exports2.isReservedRunnerEnvVar = exports2.RESERVED_RUNNER_ENV_VARS = exports2.AUTH_MARKER_VERSION = exports2.buildHealAuthStamp = exports2.extractAuthRegion = exports2.upsertAuthBlock = exports2.buildAuthRecipe = exports2.commandToReplayStep = exports2.buildReplayPlan = exports2.absoluteRoute = exports2.renderReplaySettleArrow = exports2.renderReplayClickArrow = exports2.renderAuthFn = exports2.canonicalizeRoute = exports2.executeGrokPerBatchHeal = exports2.executeGrokPerTestHeal = exports2.headerVal = exports2.classifyAuthType = exports2.isTextExcerptable = exports2.isStaticAssetByExt = exports2.isApiCall = exports2.buildApiCallSummary = exports2.computeMobileHealOutcome = exports2.detectMobileStepSecretLeak = exports2.redactMobileSecretsFromText = exports2.MOBILE_LIVE_HEAL_SYSTEM_PROMPT = exports2.MOBILE_SCRIPT_HEAL_SYSTEM_PROMPT = exports2.executeMobileLiveHeal = exports2.executeMobileTestWithHealing = exports2.executeMobileScriptDrivenHeal = exports2.prepareMobileScenarioAppState = exports2.runMobileGeneratePhase = exports2.runMobileAIPlanner = exports2.buildMobileSiteMap = exports2.formatMobileEvidenceForPlanner = exports2.MOBILE_SCENARIO_SYSTEM_PROMPT = exports2.MOBILE_SURVEY_SYSTEM_PROMPT = exports2.runMobileExplorePhase = void 0;
-    exports2.decideAppRenderType = exports2.detectCanvasApp = exports2.detectRateLimitBlock = exports2.isSafeCanonicalRedirect = exports2.resolveBaseUrlPreflight = exports2.checkBaseUrlRedirect = exports2.stripJsonFences = exports2.scrubCredentials = exports2.withAIRetry = exports2.snapshotMatchingChildren = exports2.findNewChromiumChildPid = exports2.killProcessTree = exports2.gracefulCloseWithTreeKill = exports2.liveBrowserRegistry = exports2.REPO_SWITCH_REMOVED_FRACTION = exports2.MAX_MANIFEST_FILES = exports2.toDiffSummary = exports2.isLikelyTestFile = exports2.sanitizeRepoRelPath = exports2.sha256Hex = exports2.hashFiles = exports2.enumerateTestFiles = exports2.buildNextManifest = exports2.detectRepoSwitch = exports2.classifyImportDiff = exports2.parseImportManifest = exports2.REPO_ANALYSIS_SCHEMA_VERSION = exports2.validateSourceEndpoints = exports2.validateAuthoredTest = exports2.validateRepoMapFile = exports2.validateRepoMemoryFile = exports2.buildTestingStandardsSection = exports2.buildRepoAuthorSystemRules = exports2.buildRepoAuthorKickoff = exports2.buildRepoAuthorContractMd = exports2.buildRepoMapSystemRules = exports2.buildRepoMapKickoff = exports2.buildRepoMapContractMd = exports2.buildRepoMemorySystemRules = exports2.buildRepoMemoryKickoff = exports2.buildRepoMemoryContractMd = exports2.runRepoAnalysisOnRunner = exports2.IMPORT_SCHEMA_VERSION = exports2.validateImportResultFile = exports2.validateImportedTest = exports2.buildImportSystemRules = exports2.buildImportKickoff = exports2.buildImportContractMd = exports2.MAX_ARCHIVE_BYTES = exports2.isUnsafeEntryName = void 0;
-    exports2.UNSUPPORTED_RENDERER_PREFIX = exports2.UnsupportedRendererError = exports2.buildCanvasModeAuthoringAddendum = exports2.buildUnsupportedRendererMessage = exports2.modelSupportsVision = exports2.decideCanvasStrategy = void 0;
+    exports2.acquireRepoForImport = exports2.runFrameworkImportOnRunner = exports2.getAgenticEngine = exports2.resolveRefFromSnapshot = exports2.replayAuthRecipeIntoBrowser = exports2.runRegisterCaptureRun = exports2.runLoginCaptureRun = exports2.filterLoginCaptureCredentials = exports2.buildLoginCaptureCredentials = exports2.isReservedRunnerEnvVar = exports2.RESERVED_RUNNER_ENV_VARS = exports2.AUTH_MARKER_VERSION = exports2.buildHealAuthStamp = exports2.extractAuthRegion = exports2.upsertAuthBlock = exports2.buildAuthRecipe = exports2.commandToReplayStep = exports2.buildReplayPlan = exports2.absoluteRoute = exports2.renderReplaySettleArrow = exports2.renderReplayClickArrow = exports2.renderAuthFn = exports2.filterFeatureGroupsToPathScope = exports2.isAuthFlowRoute = exports2.deriveSurveyPathScope = exports2.canonicalizeRoute = exports2.executeGrokPerBatchHeal = exports2.executeGrokPerTestHeal = exports2.headerVal = exports2.classifyAuthType = exports2.isTextExcerptable = exports2.isStaticAssetByExt = exports2.isApiCall = exports2.buildApiCallSummary = exports2.computeMobileHealOutcome = exports2.detectMobileStepSecretLeak = exports2.redactMobileSecretsFromText = exports2.MOBILE_LIVE_HEAL_SYSTEM_PROMPT = exports2.MOBILE_SCRIPT_HEAL_SYSTEM_PROMPT = exports2.executeMobileLiveHeal = exports2.executeMobileTestWithHealing = exports2.executeMobileScriptDrivenHeal = exports2.prepareMobileScenarioAppState = exports2.runMobileGeneratePhase = exports2.runMobileAIPlanner = exports2.buildMobileSiteMap = exports2.formatMobileEvidenceForPlanner = exports2.MOBILE_SCENARIO_SYSTEM_PROMPT = exports2.MOBILE_SURVEY_SYSTEM_PROMPT = exports2.runMobileExplorePhase = void 0;
+    exports2.isSafeCanonicalRedirect = exports2.resolveBaseUrlPreflight = exports2.checkBaseUrlRedirect = exports2.stripJsonFences = exports2.scrubCredentials = exports2.withAIRetry = exports2.snapshotMatchingChildren = exports2.findNewChromiumChildPid = exports2.killProcessTree = exports2.gracefulCloseWithTreeKill = exports2.liveBrowserRegistry = exports2.REPO_SWITCH_REMOVED_FRACTION = exports2.MAX_MANIFEST_FILES = exports2.toDiffSummary = exports2.isLikelyTestFile = exports2.sanitizeRepoRelPath = exports2.sha256Hex = exports2.hashFiles = exports2.enumerateTestFiles = exports2.buildNextManifest = exports2.detectRepoSwitch = exports2.classifyImportDiff = exports2.parseImportManifest = exports2.REPO_ANALYSIS_SCHEMA_VERSION = exports2.validateSourceEndpoints = exports2.validateAuthoredTest = exports2.validateRepoMapFile = exports2.validateRepoMemoryFile = exports2.buildTestingStandardsSection = exports2.buildRepoAuthorSystemRules = exports2.buildRepoAuthorKickoff = exports2.buildRepoAuthorContractMd = exports2.buildRepoMapSystemRules = exports2.buildRepoMapKickoff = exports2.buildRepoMapContractMd = exports2.buildRepoMemorySystemRules = exports2.buildRepoMemoryKickoff = exports2.buildRepoMemoryContractMd = exports2.runRepoAnalysisOnRunner = exports2.IMPORT_SCHEMA_VERSION = exports2.validateImportResultFile = exports2.validateImportedTest = exports2.buildImportSystemRules = exports2.buildImportKickoff = exports2.buildImportContractMd = exports2.MAX_ARCHIVE_BYTES = exports2.isUnsafeEntryName = exports2.extractZipSafely = exports2.downloadArchiveCapped = exports2.detectArchiveKind = void 0;
+    exports2.UNSUPPORTED_RENDERER_PREFIX = exports2.UnsupportedRendererError = exports2.buildCanvasModeAuthoringAddendum = exports2.buildUnsupportedRendererMessage = exports2.modelSupportsVision = exports2.decideCanvasStrategy = exports2.decideAppRenderType = exports2.detectCanvasApp = exports2.detectRateLimitBlock = void 0;
     __exportStar(require_ai_provider(), exports2);
     __exportStar(require_mobile_types(), exports2);
     __exportStar(require_mobile_source_parser(), exports2);
@@ -346896,6 +347114,16 @@ var require_dist2 = __commonJS({
     Object.defineProperty(exports2, "canonicalizeRoute", { enumerable: true, get: function() {
       return exploration_parser_js_1.canonicalizeRoute;
     } });
+    var survey_scope_js_1 = require_survey_scope();
+    Object.defineProperty(exports2, "deriveSurveyPathScope", { enumerable: true, get: function() {
+      return survey_scope_js_1.deriveSurveyPathScope;
+    } });
+    Object.defineProperty(exports2, "isAuthFlowRoute", { enumerable: true, get: function() {
+      return survey_scope_js_1.isAuthFlowRoute;
+    } });
+    Object.defineProperty(exports2, "filterFeatureGroupsToPathScope", { enumerable: true, get: function() {
+      return survey_scope_js_1.filterFeatureGroupsToPathScope;
+    } });
     var auth_recipe_js_1 = require_auth_recipe();
     Object.defineProperty(exports2, "renderAuthFn", { enumerable: true, get: function() {
       return auth_recipe_js_1.renderAuthFn;
@@ -347169,7 +347397,7 @@ var require_package4 = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.48",
+      version: "1.0.49",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"

package/dist/cli.mjs

@@ -77293,7 +77293,7 @@ var require_discover_ai_planner = __commonJS({
   "../runner-core/dist/services/discover-ai-planner.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.PLANNER_STRENGTHEN_GATE_PROMPT = exports.SCENARIO_SYSTEM_PROMPT = void 0;
+    exports.PLANNER_STRENGTHEN_GATE_PROMPT = exports.SCENARIO_SYSTEM_PROMPT = exports.SURVEY_SYSTEM_PROMPT = void 0;
     exports.getAIPlannerMaxTokens = getAIPlannerMaxTokens;
     exports.getSnapshotConfidence = getSnapshotConfidence;
     exports.compressSiteMap = compressSiteMap;
@@ -77829,7 +77829,7 @@ Plan these LOGGED-OUT instead (keep their own establishment steps; do NOT assume
       }
       return sections.join("\n\n");
     }
-    var SURVEY_SYSTEM_PROMPT = `You are a feature analyst for a web application. You receive evidence from an AI explorer that mapped the entire site. Your job is to organize pages into meaningful feature groups.
+    exports.SURVEY_SYSTEM_PROMPT = `You are a feature analyst for a web application. You receive evidence from an AI explorer that mapped the entire site. Your job is to organize pages into meaningful feature groups.
 
 ## Output Discipline
 Return ONLY one valid JSON object matching the schema below. Do NOT include <think> blocks, markdown fences, analysis, prose, or any text outside the JSON object. Put any brief explanation only in the JSON "reasoning" field.
@@ -77849,6 +77849,7 @@ Return ONLY one valid JSON object matching the schema below. Do NOT include <thi
 6. Do NOT merge pages into one feature just because they serve a similar broader goal. Treat areas as separate features when the evidence shows separate primary navigation destinations (e.g. separate sidebar links), separate route families below the app shell (e.g. /dashboard/documents/* vs /dashboard/reports/* are separate even though both are under /dashboard), or different CRUD entities/forms. Keep pages together when they share one navigational area and operate on the same entity (e.g. /applications, /applications/stats, /applications?filter= all belong together).
 7. Feature descriptions MUST reference actual element labels from the evidence
 8. Do NOT create standalone features for generic error pages (404, 500, access denied). If a business route is broken or crashes, keep it in its intended feature and note the failure in the description. Error pages do not need their own deep exploration run.
+9. The Base URL's PATH is the survey's entry scope. When it is non-root (e.g. \`/shop/checkout\`), the operator is auditing that one flow in isolation: do NOT create featureGroups for parent paths, sibling paths, or guessed/nonexistent routes on the same host \u2014 even if the explorer's evidence wandered there. Auth pages the flow itself traverses (its login page, an \`/api/auth/*\` callback) belong INSIDE that flow's group, not in separate groups. When the Base URL path is \`/\`, group the whole app as usual.
 
 ## Output JSON Schema
 {
@@ -78601,7 +78602,7 @@ Keep the exact JSON schema { "featureGroups":[...], "scenarios":[...], "reasonin
       const agentModel = options.modelOverride ? (0, ai_provider_js_1.resolveModelForTask)(options.modelOverride, "agent") : (0, ai_provider_js_1.getModel)("agent");
       const plannerMaxTokens = getAIPlannerMaxTokens(agentModel);
       logs2.push(`AI planner [${context.mode}]: ${siteMap.pages.length} pages, ${evidence.recordedJourneys.length} journeys, budget ${context.testBudget}`);
-      const systemPrompt = options.systemPromptOverride ?? (context.mode === "survey" ? SURVEY_SYSTEM_PROMPT : exports.SCENARIO_SYSTEM_PROMPT);
+      const systemPrompt = options.systemPromptOverride ?? (context.mode === "survey" ? exports.SURVEY_SYSTEM_PROMPT : exports.SCENARIO_SYSTEM_PROMPT);
       const userPrompt = options.userPromptOverride ?? formatEvidenceForPlanner(compressed, evidence, context);
       logs2.push(`AI planner: ~${Math.ceil(userPrompt.length / 3.5)} input tokens`);
       const aiClient = options.aiClient ?? (options.modelOverride ? (0, ai_provider_js_1.getRunnerClientForModel)(options.modelOverride) : (0, ai_provider_js_1.getRunnerAIClient)());
@@ -321572,6 +321573,168 @@ var require_evidence_harvester = __commonJS({
   }
 });
 
+// ../runner-core/dist/services/survey-scope.js
+var require_survey_scope = __commonJS({
+  "../runner-core/dist/services/survey-scope.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.deriveSurveyPathScope = deriveSurveyPathScope;
+    exports.isAuthFlowRoute = isAuthFlowRoute;
+    exports.buildSurveyScopeBoundary = buildSurveyScopeBoundary;
+    exports.filterFeatureGroupsToPathScope = filterFeatureGroupsToPathScope;
+    var exploration_parser_js_1 = require_exploration_parser();
+    function deriveSurveyPathScope(baseUrl) {
+      const trimmed = (baseUrl ?? "").trim();
+      if (!trimmed)
+        return null;
+      let parsed;
+      try {
+        parsed = new URL(trimmed);
+      } catch {
+        return null;
+      }
+      if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+        return null;
+      const hashRoute = parsed.hash.startsWith("#/") ? parsed.hash : "";
+      const basePath = (0, exploration_parser_js_1.normalizeRouteForFocusScope)(`${parsed.pathname}${hashRoute}`);
+      if (basePath === "/" || basePath === "/#")
+        return null;
+      return { origin: parsed.origin, basePath };
+    }
+    var AUTH_FLOW_SEGMENTS = /* @__PURE__ */ new Set([
+      "auth",
+      "oauth",
+      "oauth2",
+      "callback",
+      "login",
+      "log-in",
+      "signin",
+      "sign-in",
+      "signup",
+      "sign-up",
+      "register",
+      "logout",
+      "log-out",
+      "signout",
+      "sign-out",
+      "sso",
+      "saml",
+      "oidc"
+    ]);
+    function isAuthFlowRoute(route2) {
+      const normalized = (0, exploration_parser_js_1.normalizeRouteForFocusScope)(route2).toLowerCase();
+      return normalized.split(/[/#]/).some((segment) => AUTH_FLOW_SEGMENTS.has(segment));
+    }
+    function routePathForScope(route2, origin) {
+      const trimmed = (route2 ?? "").trim();
+      if (trimmed.startsWith("//")) {
+        try {
+          const parsed = new URL(`https:${trimmed}`);
+          if (parsed.host !== new URL(origin).host)
+            return null;
+          return `${parsed.pathname}${parsed.search}${parsed.hash}`;
+        } catch {
+          return null;
+        }
+      }
+      if (/^https?:\/\//i.test(trimmed)) {
+        try {
+          const parsed = new URL(trimmed);
+          if (parsed.origin !== origin)
+            return null;
+          return `${parsed.pathname}${parsed.search}${parsed.hash}`;
+        } catch {
+          return trimmed;
+        }
+      }
+      if (trimmed.startsWith("/") && trimmed.includes("..")) {
+        try {
+          const resolved = new URL(trimmed, "https://scope.invalid");
+          return `${resolved.pathname}${resolved.search}${resolved.hash}`;
+        } catch {
+          return trimmed;
+        }
+      }
+      return trimmed;
+    }
+    function buildSurveyScopeBoundary(baseUrl) {
+      const scope = deriveSurveyPathScope(baseUrl);
+      const lines = [
+        '- **Never invent a URL.** Navigate only to pages the app presented (links/buttons you can click, per the rule above) or redirects it performs. Do not guess "common" routes and do not probe made-up routes to see what the error page does'
+      ];
+      if (scope) {
+        lines.push(`- **The base URL PATH is the entry scope** (\`${scope.basePath}\`) \u2014 this survey audits that flow in ISOLATION. Do not truncate the path to visit a parent, and do not visit or catalog sibling paths on this host that in-scope pages never linked to. Pages the flow itself pushes you through (its login page, an auth/OAuth callback, a post-submit redirect) are in scope`);
+      }
+      return lines.join("\n");
+    }
+    function filterFeatureGroupsToPathScope(featureGroups, baseUrl) {
+      const scope = deriveSurveyPathScope(baseUrl);
+      if (!scope) {
+        return { kept: featureGroups, droppedGroups: [], trimmedRoutes: [], trimmedPages: [], basePath: null };
+      }
+      const withinBase = (route2) => {
+        const path = routePathForScope(route2, scope.origin);
+        if (path === null)
+          return false;
+        if ((0, exploration_parser_js_1.routeIsWithinFocusAreas)(path, [scope.basePath]))
+          return true;
+        const norm = (0, exploration_parser_js_1.normalizeRouteForFocusScope)(path);
+        return norm === `${scope.basePath}#` || norm.startsWith(`${scope.basePath}#/`);
+      };
+      const allowedAuthFlow = (route2) => {
+        const path = routePathForScope(route2, scope.origin);
+        return path !== null && isAuthFlowRoute(path);
+      };
+      const kept = [];
+      const droppedGroups = [];
+      const trimmedRoutes = [];
+      const trimmedPages = [];
+      for (const group of featureGroups) {
+        const routes = Array.isArray(group.routes) ? group.routes : [];
+        const keptRoutes = [];
+        const removedRoutes = [];
+        let anchored = false;
+        for (const route2 of routes) {
+          if (withinBase(route2)) {
+            anchored = true;
+            keptRoutes.push(route2);
+          } else if (allowedAuthFlow(route2)) {
+            keptRoutes.push(route2);
+          } else {
+            removedRoutes.push(route2);
+          }
+        }
+        if (!anchored) {
+          droppedGroups.push({ name: group.name, routes: [...routes] });
+          continue;
+        }
+        let pages = group.pages;
+        const removedPages = [];
+        if (Array.isArray(group.pages)) {
+          const keptPages = [];
+          for (const page of group.pages) {
+            if (withinBase(page.route) || allowedAuthFlow(page.route))
+              keptPages.push(page);
+            else
+              removedPages.push(page.route);
+          }
+          pages = keptPages;
+        }
+        if (removedRoutes.length === 0 && removedPages.length === 0) {
+          kept.push(group);
+        } else {
+          kept.push({ ...group, routes: keptRoutes, ...group.pages !== void 0 ? { pages } : {} });
+          if (removedRoutes.length > 0)
+            trimmedRoutes.push({ name: group.name, routes: removedRoutes });
+          if (removedPages.length > 0)
+            trimmedPages.push({ name: group.name, routes: removedPages });
+        }
+      }
+      return { kept, droppedGroups, trimmedRoutes, trimmedPages, basePath: scope.basePath };
+    }
+  }
+});
+
 // ../runner-core/dist/services/discover-explorer.js
 var require_discover_explorer = __commonJS({
   "../runner-core/dist/services/discover-explorer.js"(exports) {
@@ -321613,6 +321776,7 @@ var require_discover_explorer = __commonJS({
     var evidence_harvester_js_1 = require_evidence_harvester();
     var exploration_parser_js_1 = require_exploration_parser();
     var survey_link_frontier_js_1 = require_survey_link_frontier();
+    var survey_scope_js_1 = require_survey_scope();
     var snapshot_context_compactor_js_2 = require_snapshot_context_compactor();
     Object.defineProperty(exports, "formatMCPToolResult", { enumerable: true, get: function() {
       return snapshot_context_compactor_js_2.formatMCPToolResult;
@@ -322040,6 +322204,7 @@ If a snapshot's readiness section exposes \`loading_indicators\`, \`skeleton_con
 - **Map, do not mutate.** You MAY click buttons that open modals, popups, or dropdowns for the purpose of CATALOGING their contents (capture_page). Do NOT fill forms, submit data, or click destructive buttons (save, delete, submit) - just catalog the elements and close the modal
 - **Modals/popups/banners**: If a cookie consent banner, onboarding tour, or overlay appears, dismiss it (click close/X/dismiss/accept) and continue. If it reappears on the next page, dismiss it again - some sites show consent banners on every navigation until accepted
 - **Stay on the same origin** as the base URL. Note external links in elements but do not follow them
+${(0, survey_scope_js_1.buildSurveyScopeBoundary)(baseUrl)}
 - **OAuth/SSO**: If login redirects to an external provider (Google, GitHub), do not follow it. Note that the app uses OAuth and explore unauthenticated pages only
 - **Auth failure**: If login${isRegisterMode ? " or account registration" : ""} fails after 2 attempts, capture the auth page and explore unauthenticated pages. Note the failure in your \`finish_exploration\` summary
 - **Parameterized routes**: /users/1 and /users/2 are the same page template. Visit ONE instance, not all of them
@@ -325538,6 +325703,8 @@ var require_agentic_survey_prompts = __commonJS({
     exports.validateSurveyorOutput = validateSurveyorOutput;
     exports.buildSurveyAgentsMd = buildSurveyAgentsMd;
     exports.buildSurveyBriefMd = buildSurveyBriefMd;
+    exports.buildClaudeSurveyKickoffPrompt = buildClaudeSurveyKickoffPrompt;
+    var survey_scope_js_1 = require_survey_scope();
     var CRITICALITY_VALUES = ["critical", "high", "medium", "low"];
     function isString(v) {
       return typeof v === "string";
@@ -325717,9 +325884,40 @@ var require_agentic_survey_prompts = __commonJS({
         '- Click "delete" or destructive admin actions.',
         "- Leave the baseUrl domain except briefly for OAuth providers.",
         "",
+        "## Navigation scope",
+        "",
+        "The Base URL in BRIEF.md is the ENTRY SCOPE \u2014 its full path, not just",
+        "its domain. Open the exact Base URL first. From there, navigate ONLY to:",
+        "",
+        "- URLs the app actually presented to you: a link, button, or form",
+        "  visible in a snapshot of an in-scope page. (`browser_navigate` to a",
+        "  URL you saw as a link href is fine \u2014 composing one yourself is not.)",
+        "- Redirects the app itself performs during those interactions,",
+        "  including login/OAuth/SSO callback routes needed to complete a flow.",
+        "- The Base URL itself, to return to the start of the flow.",
+        "",
+        "NEVER invent a URL. Do NOT:",
+        "- Parent-walk: truncating the Base URL path (base `/shop/checkout` \u2192",
+        "  visiting `/shop` or `/`) is out of scope even though it is same-origin.",
+        "- Sibling-walk: do not visit or catalog neighbours of the Base URL path",
+        "  that in-scope pages never linked to.",
+        '- Guess "common" routes (`/admin`, `/about`) or probe made-up routes',
+        "  (`/nonexistent`) to see what the error handling does. Do not create",
+        "  featureGroups for generic error/404 pages unless the app itself",
+        "  routes users there as part of a real flow.",
+        "- Any other URL surgery: if the UI did not present it and the app did",
+        "  not redirect you to it, it does not exist for this survey.",
+        "",
+        "When the Base URL path is non-root (e.g. `/shop/checkout`, `/portal/billing`),",
+        "the operator is auditing THAT flow in isolation: every featureGroup must",
+        "describe that flow. Auth pages the flow pushes you through belong inside",
+        "that flow's featureGroup \u2014 do not mint separate featureGroups for them.",
+        "When the Base URL is the origin root, survey the whole app \u2014 the",
+        "no-guessing rule still applies: reach pages through the UI.",
+        "",
         "## Exploration philosophy",
         "",
-        "- Breadth before depth \u2014 map the whole surface before drilling in.",
+        "- Breadth before depth \u2014 map the whole in-scope surface before drilling in.",
         "- Authenticated and unauthenticated surfaces are different products;",
         "  explore both when credentials are available.",
         "- Prefer observing over interacting: open a page, snapshot, note the",
@@ -325814,6 +326012,17 @@ var require_agentic_survey_prompts = __commonJS({
       lines.push("");
       lines.push(`**Base URL:** ${input.baseUrl}`);
       lines.push("");
+      const pathScope = (0, survey_scope_js_1.deriveSurveyPathScope)(input.baseUrl);
+      if (pathScope) {
+        lines.push(`**Entry scope:** \`${pathScope.basePath}\` \u2014 this is a SCOPED survey of one flow.`);
+        lines.push("");
+        lines.push(`Everything you catalog must live under \`${pathScope.basePath}\`, or be a page`);
+        lines.push("this flow itself pushes you through (its own login page, an auth/OAuth");
+        lines.push("callback, a post-submit redirect). Parent and sibling paths on this host");
+        lines.push("are OTHER fixtures/apps and are out of scope \u2014 do not visit them, do not");
+        lines.push("catalog them, do not mint featureGroups for them.");
+        lines.push("");
+      }
       if (input.appBrief && input.appBrief.trim().length > 0) {
         lines.push("## App brief from the operator");
         lines.push("");
@@ -325883,6 +326092,37 @@ var require_agentic_survey_prompts = __commonJS({
       lines.push("");
       return lines.join("\n");
     }
+    function buildClaudeSurveyKickoffPrompt(resultFilePath) {
+      return [
+        "Read AGENTS.md, then read BRIEF.md.",
+        "",
+        `Your deliverable is a SurveyorOutput JSON file at ${resultFilePath}.`,
+        "Follow this procedure exactly:",
+        "",
+        "STEP 1 \u2014 Orient: navigate to the EXACT Base URL from BRIEF.md and",
+        "  snapshot it, then open 2-3 pages its UI visibly links to (e.g. a login",
+        "  link it presents). Navigate only to URLs the page actually presented \u2014",
+        '  never guessed parent, sibling, or "common" routes (see "Navigation',
+        '  scope" in AGENTS.md).',
+        `STEP 2 \u2014 IMMEDIATELY use the Write tool to save a first COMPLETE draft of`,
+        `  the SurveyorOutput JSON to ${resultFilePath}, based on what you have seen`,
+        "  so far. featureGroups must be a non-empty array. Do NOT skip this step",
+        "  and do NOT explore further until this file exists.",
+        "STEP 3 \u2014 Continue exploring breadth-first. Visit each remaining page AT",
+        "  MOST ONCE \u2014 never re-navigate to or re-snapshot a page already seen.",
+        `  After every 3-4 new pages, OVERWRITE ${resultFilePath} with an updated,`,
+        "  complete JSON object.",
+        "STEP 4 \u2014 Stop once you have covered the main in-scope pages (around 20",
+        `  page visits is plenty) or stop finding new features. Do a final OVERWRITE`,
+        `  of ${resultFilePath} with the complete SurveyorOutput, then exit.`,
+        "",
+        "Budget: about 40 tool calls total. If you ever sense you are running low,",
+        `immediately overwrite ${resultFilePath} with your best current JSON and`,
+        "exit \u2014 a complete-but-shallow file always beats no file. Never write an",
+        "empty featureGroups array and never omit the key. No markdown fences, no",
+        "prose in the file \u2014 a single JSON object only."
+      ].join("\n");
+    }
   }
 });
 
@@ -326433,6 +326673,9 @@ ${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwo
       const kickoffPrompt = [
         "Read AGENTS.md, then read BRIEF.md.",
         "Use the playwright MCP tools to explore the site.",
+        'Follow the "Navigation scope" rules in AGENTS.md: start at the exact Base',
+        'URL and never navigate to guessed parent, sibling, or "common" routes \u2014',
+        "only URLs the pages actually present (or redirects the app performs).",
         `When done, write your JSON output to ${resultFilePath} as a single JSON object matching the SurveyorOutput schema in AGENTS.md.`,
         "Then exit."
       ].join("\n");
@@ -330149,32 +330392,7 @@ ${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwo
       await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "AGENTS.md"), surveyAgentsMd, "utf8");
       await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "BRIEF.md"), (0, agentic_survey_prompts_js_1.buildSurveyBriefMd)(briefInput), "utf8");
       log2("Wrote AGENTS.md + BRIEF.md");
-      const kickoffPrompt = [
-        "Read AGENTS.md, then read BRIEF.md.",
-        "",
-        `Your deliverable is a SurveyorOutput JSON file at ${resultFilePath}.`,
-        "Follow this procedure exactly:",
-        "",
-        "STEP 1 \u2014 Orient: navigate to the base URL and 2-3 obvious pages (e.g. the",
-        "  login page and the main dashboard).",
-        `STEP 2 \u2014 IMMEDIATELY use the Write tool to save a first COMPLETE draft of`,
-        `  the SurveyorOutput JSON to ${resultFilePath}, based on what you have seen`,
-        "  so far. featureGroups must be a non-empty array. Do NOT skip this step",
-        "  and do NOT explore further until this file exists.",
-        "STEP 3 \u2014 Continue exploring breadth-first. Visit each remaining page AT",
-        "  MOST ONCE \u2014 never re-navigate to or re-snapshot a page already seen.",
-        `  After every 3-4 new pages, OVERWRITE ${resultFilePath} with an updated,`,
-        "  complete JSON object.",
-        "STEP 4 \u2014 Stop once you have covered the main pages (around 20 page visits",
-        `  is plenty) or stop finding new features. Do a final OVERWRITE of`,
-        `  ${resultFilePath} with the complete SurveyorOutput, then exit.`,
-        "",
-        "Budget: about 40 tool calls total. If you ever sense you are running low,",
-        `immediately overwrite ${resultFilePath} with your best current JSON and`,
-        "exit \u2014 a complete-but-shallow file always beats no file. Never write an",
-        "empty featureGroups array and never omit the key. No markdown fences, no",
-        "prose in the file \u2014 a single JSON object only."
-      ].join("\n");
+      const kickoffPrompt = (0, agentic_survey_prompts_js_1.buildClaudeSurveyKickoffPrompt)(resultFilePath);
       const credentialScrubMap = {};
       for (const c of credentials) {
         credentialScrubMap[c.email] = "<email>";
@@ -346791,9 +347009,9 @@ var require_dist2 = __commonJS({
       for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports2, p)) __createBinding(exports2, m, p);
     };
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.extractZipSafely = exports.downloadArchiveCapped = exports.detectArchiveKind = exports.acquireRepoForImport = exports.runFrameworkImportOnRunner = exports.getAgenticEngine = exports.resolveRefFromSnapshot = exports.replayAuthRecipeIntoBrowser = exports.runRegisterCaptureRun = exports.runLoginCaptureRun = exports.filterLoginCaptureCredentials = exports.buildLoginCaptureCredentials = exports.isReservedRunnerEnvVar = exports.RESERVED_RUNNER_ENV_VARS = exports.AUTH_MARKER_VERSION = exports.buildHealAuthStamp = exports.extractAuthRegion = exports.upsertAuthBlock = exports.buildAuthRecipe = exports.commandToReplayStep = exports.buildReplayPlan = exports.absoluteRoute = exports.renderReplaySettleArrow = exports.renderReplayClickArrow = exports.renderAuthFn = exports.canonicalizeRoute = exports.executeGrokPerBatchHeal = exports.executeGrokPerTestHeal = exports.headerVal = exports.classifyAuthType = exports.isTextExcerptable = exports.isStaticAssetByExt = exports.isApiCall = exports.buildApiCallSummary = exports.computeMobileHealOutcome = exports.detectMobileStepSecretLeak = exports.redactMobileSecretsFromText = exports.MOBILE_LIVE_HEAL_SYSTEM_PROMPT = exports.MOBILE_SCRIPT_HEAL_SYSTEM_PROMPT = exports.executeMobileLiveHeal = exports.executeMobileTestWithHealing = exports.executeMobileScriptDrivenHeal = exports.prepareMobileScenarioAppState = exports.runMobileGeneratePhase = exports.runMobileAIPlanner = exports.buildMobileSiteMap = exports.formatMobileEvidenceForPlanner = exports.MOBILE_SCENARIO_SYSTEM_PROMPT = exports.MOBILE_SURVEY_SYSTEM_PROMPT = exports.runMobileExplorePhase = void 0;
-    exports.decideAppRenderType = exports.detectCanvasApp = exports.detectRateLimitBlock = exports.isSafeCanonicalRedirect = exports.resolveBaseUrlPreflight = exports.checkBaseUrlRedirect = exports.stripJsonFences = exports.scrubCredentials = exports.withAIRetry = exports.snapshotMatchingChildren = exports.findNewChromiumChildPid = exports.killProcessTree = exports.gracefulCloseWithTreeKill = exports.liveBrowserRegistry = exports.REPO_SWITCH_REMOVED_FRACTION = exports.MAX_MANIFEST_FILES = exports.toDiffSummary = exports.isLikelyTestFile = exports.sanitizeRepoRelPath = exports.sha256Hex = exports.hashFiles = exports.enumerateTestFiles = exports.buildNextManifest = exports.detectRepoSwitch = exports.classifyImportDiff = exports.parseImportManifest = exports.REPO_ANALYSIS_SCHEMA_VERSION = exports.validateSourceEndpoints = exports.validateAuthoredTest = exports.validateRepoMapFile = exports.validateRepoMemoryFile = exports.buildTestingStandardsSection = exports.buildRepoAuthorSystemRules = exports.buildRepoAuthorKickoff = exports.buildRepoAuthorContractMd = exports.buildRepoMapSystemRules = exports.buildRepoMapKickoff = exports.buildRepoMapContractMd = exports.buildRepoMemorySystemRules = exports.buildRepoMemoryKickoff = exports.buildRepoMemoryContractMd = exports.runRepoAnalysisOnRunner = exports.IMPORT_SCHEMA_VERSION = exports.validateImportResultFile = exports.validateImportedTest = exports.buildImportSystemRules = exports.buildImportKickoff = exports.buildImportContractMd = exports.MAX_ARCHIVE_BYTES = exports.isUnsafeEntryName = void 0;
-    exports.UNSUPPORTED_RENDERER_PREFIX = exports.UnsupportedRendererError = exports.buildCanvasModeAuthoringAddendum = exports.buildUnsupportedRendererMessage = exports.modelSupportsVision = exports.decideCanvasStrategy = void 0;
+    exports.acquireRepoForImport = exports.runFrameworkImportOnRunner = exports.getAgenticEngine = exports.resolveRefFromSnapshot = exports.replayAuthRecipeIntoBrowser = exports.runRegisterCaptureRun = exports.runLoginCaptureRun = exports.filterLoginCaptureCredentials = exports.buildLoginCaptureCredentials = exports.isReservedRunnerEnvVar = exports.RESERVED_RUNNER_ENV_VARS = exports.AUTH_MARKER_VERSION = exports.buildHealAuthStamp = exports.extractAuthRegion = exports.upsertAuthBlock = exports.buildAuthRecipe = exports.commandToReplayStep = exports.buildReplayPlan = exports.absoluteRoute = exports.renderReplaySettleArrow = exports.renderReplayClickArrow = exports.renderAuthFn = exports.filterFeatureGroupsToPathScope = exports.isAuthFlowRoute = exports.deriveSurveyPathScope = exports.canonicalizeRoute = exports.executeGrokPerBatchHeal = exports.executeGrokPerTestHeal = exports.headerVal = exports.classifyAuthType = exports.isTextExcerptable = exports.isStaticAssetByExt = exports.isApiCall = exports.buildApiCallSummary = exports.computeMobileHealOutcome = exports.detectMobileStepSecretLeak = exports.redactMobileSecretsFromText = exports.MOBILE_LIVE_HEAL_SYSTEM_PROMPT = exports.MOBILE_SCRIPT_HEAL_SYSTEM_PROMPT = exports.executeMobileLiveHeal = exports.executeMobileTestWithHealing = exports.executeMobileScriptDrivenHeal = exports.prepareMobileScenarioAppState = exports.runMobileGeneratePhase = exports.runMobileAIPlanner = exports.buildMobileSiteMap = exports.formatMobileEvidenceForPlanner = exports.MOBILE_SCENARIO_SYSTEM_PROMPT = exports.MOBILE_SURVEY_SYSTEM_PROMPT = exports.runMobileExplorePhase = void 0;
+    exports.isSafeCanonicalRedirect = exports.resolveBaseUrlPreflight = exports.checkBaseUrlRedirect = exports.stripJsonFences = exports.scrubCredentials = exports.withAIRetry = exports.snapshotMatchingChildren = exports.findNewChromiumChildPid = exports.killProcessTree = exports.gracefulCloseWithTreeKill = exports.liveBrowserRegistry = exports.REPO_SWITCH_REMOVED_FRACTION = exports.MAX_MANIFEST_FILES = exports.toDiffSummary = exports.isLikelyTestFile = exports.sanitizeRepoRelPath = exports.sha256Hex = exports.hashFiles = exports.enumerateTestFiles = exports.buildNextManifest = exports.detectRepoSwitch = exports.classifyImportDiff = exports.parseImportManifest = exports.REPO_ANALYSIS_SCHEMA_VERSION = exports.validateSourceEndpoints = exports.validateAuthoredTest = exports.validateRepoMapFile = exports.validateRepoMemoryFile = exports.buildTestingStandardsSection = exports.buildRepoAuthorSystemRules = exports.buildRepoAuthorKickoff = exports.buildRepoAuthorContractMd = exports.buildRepoMapSystemRules = exports.buildRepoMapKickoff = exports.buildRepoMapContractMd = exports.buildRepoMemorySystemRules = exports.buildRepoMemoryKickoff = exports.buildRepoMemoryContractMd = exports.runRepoAnalysisOnRunner = exports.IMPORT_SCHEMA_VERSION = exports.validateImportResultFile = exports.validateImportedTest = exports.buildImportSystemRules = exports.buildImportKickoff = exports.buildImportContractMd = exports.MAX_ARCHIVE_BYTES = exports.isUnsafeEntryName = exports.extractZipSafely = exports.downloadArchiveCapped = exports.detectArchiveKind = void 0;
+    exports.UNSUPPORTED_RENDERER_PREFIX = exports.UnsupportedRendererError = exports.buildCanvasModeAuthoringAddendum = exports.buildUnsupportedRendererMessage = exports.modelSupportsVision = exports.decideCanvasStrategy = exports.decideAppRenderType = exports.detectCanvasApp = exports.detectRateLimitBlock = void 0;
     __exportStar(require_ai_provider(), exports);
     __exportStar(require_mobile_types(), exports);
     __exportStar(require_mobile_source_parser(), exports);
@@ -346901,6 +347119,16 @@ var require_dist2 = __commonJS({
     Object.defineProperty(exports, "canonicalizeRoute", { enumerable: true, get: function() {
       return exploration_parser_js_1.canonicalizeRoute;
     } });
+    var survey_scope_js_1 = require_survey_scope();
+    Object.defineProperty(exports, "deriveSurveyPathScope", { enumerable: true, get: function() {
+      return survey_scope_js_1.deriveSurveyPathScope;
+    } });
+    Object.defineProperty(exports, "isAuthFlowRoute", { enumerable: true, get: function() {
+      return survey_scope_js_1.isAuthFlowRoute;
+    } });
+    Object.defineProperty(exports, "filterFeatureGroupsToPathScope", { enumerable: true, get: function() {
+      return survey_scope_js_1.filterFeatureGroupsToPathScope;
+    } });
     var auth_recipe_js_1 = require_auth_recipe();
     Object.defineProperty(exports, "renderAuthFn", { enumerable: true, get: function() {
       return auth_recipe_js_1.renderAuthFn;
@@ -347174,7 +347402,7 @@ var require_package4 = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.48",
+      version: "1.0.49",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@validate.qa/runner",
-  "version": "1.0.48",
+  "version": "1.0.49",
   "description": "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
   "bin": {
     "validate-runner": "dist/cli.js"