@validate.qa/runner 1.0.58 → 1.0.59

package/dist/cli.js

@@ -72841,18 +72841,15 @@ var require_verification_inbox = __commonJS({
             return { code: cleaned, confidence: "keyword" };
         }
       }
-      const distinct = /* @__PURE__ */ new Set();
       for (const body of bodies) {
         if (!body)
           continue;
         for (const n of body.match(/\b[0-9]{4,8}\b/g) ?? []) {
-          if (!looksLikeYearOrDate(n))
-            distinct.add(n);
+          if (looksLikeYearOrDate(n))
+            continue;
+          return { code: n, confidence: "fallback" };
         }
       }
-      if (distinct.size === 1) {
-        return { code: distinct.values().next().value ?? null, confidence: "fallback" };
-      }
       return { code: null, confidence: null };
     }
     function matchBestCode(line) {
@@ -73150,9 +73147,10 @@ var require_verification_inbox = __commonJS({
         const satisfies = (m) => {
           if (opts.require === "code")
             return m.code !== null && m.codeConfidence !== "fallback";
+          const linkOk = (l) => l !== null && (!opts.linkAcceptable || opts.linkAcceptable(l));
           if (opts.require === "link")
-            return m.link !== null;
-          return m.hasVerificationSignal;
+            return linkOk(m.link);
+          return m.code !== null && m.codeConfidence !== "fallback" || linkOk(m.link);
         };
         let weakest = null;
         const check2 = async () => {
@@ -73199,7 +73197,7 @@ var require_verification_inbox = __commonJS({
         const since = new Date(Math.max(0, opts.sinceMs));
         const lock = await client.getMailboxLock(mailbox);
         const results = [];
-        const taggedRecipient = isPlusTagged(opts.toAddress);
+        const demoteMismatch = isPlusTagged(opts.toAddress) && Boolean(opts.demoteFilterMismatch);
         try {
           try {
             await client.noop();
@@ -73245,7 +73243,7 @@ var require_verification_inbox = __commonJS({
               continue;
             const filterActive = Boolean(opts.fromMatch || opts.subjectMatch);
             const filterMatched = (!opts.fromMatch || matchField(parsed.from?.text, opts.fromMatch)) && (!opts.subjectMatch || matchField(parsed.subject, opts.subjectMatch));
-            if (filterActive && !filterMatched && !taggedRecipient) {
+            if (filterActive && !filterMatched && !demoteMismatch) {
               if (opts.stats)
                 opts.stats.filteredOut += 1;
               continue;
@@ -73383,7 +73381,8 @@ var require_inbox_tools = __commonJS({
         // Captured at provision (needs a live reader); 0 = use the sinceMs floor.
         sinceUid: 0,
         sinceUidValidity: 0,
-        knownLinks: /* @__PURE__ */ new Set()
+        knownLinks: /* @__PURE__ */ new Set(),
+        demoteFilterMismatch: opts.demoteFilterMismatch ?? false
       };
     }
     exports2.PROVISION_IDENTITY_TOOL = {
@@ -73571,6 +73570,7 @@ var require_inbox_tools = __commonJS({
         sinceUidValidity: ctx.state.sinceUidValidity,
         fromMatch: asStr(args.senderMatch),
         subjectMatch: asStr(args.subjectMatch),
+        demoteFilterMismatch: ctx.state.demoteFilterMismatch,
         limit: 10
       });
       return ok({
@@ -73595,6 +73595,7 @@ var require_inbox_tools = __commonJS({
         sinceUidValidity: ctx.state.sinceUidValidity,
         fromMatch: asStr(args.senderMatch),
         subjectMatch: asStr(args.subjectMatch),
+        demoteFilterMismatch: ctx.state.demoteFilterMismatch,
         maxWaitMs: maxWaitSeconds * 1e3,
         stats
       });
@@ -73741,7 +73742,7 @@ var require_inbox_tools = __commonJS({
         const u = new URL(raw);
         if (u.protocol !== "http:" && u.protocol !== "https:")
           return false;
-        host = u.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+        host = u.hostname.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.+$/, "");
       } catch {
         return false;
       }
@@ -73757,7 +73758,7 @@ var require_inbox_tools = __commonJS({
         const dotted = host.match(/(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
         if (dotted && !ipv4IsPublic(dotted[1]))
           return false;
-        const mapped = host.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+        const mapped = host.match(/^::(?:ffff:)?([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
         if (mapped) {
           const hi = parseInt(mapped[1], 16);
           const lo = parseInt(mapped[2], 16);
@@ -86418,6 +86419,8 @@ var require_inbox_stamp = __commonJS({
     exports2.INBOX_HELPER_TOKEN_RE = exports2.INBOX_HELPER_NAME = exports2.INBOX_REGION_RE = exports2.INBOX_MARKER_VERSION = void 0;
     exports2.codeUsesInboxHelper = codeUsesInboxHelper;
     exports2.stripInboxRegions = stripInboxRegions;
+    exports2.codeUsesTestInboxIdentity = codeUsesTestInboxIdentity;
+    exports2.codeSelfProvisionsRegistration = codeSelfProvisionsRegistration2;
     exports2.renderInboxFn = renderInboxFn;
     exports2.upsertInboxBlock = upsertInboxBlock;
     var auth_recipe_js_1 = require_auth_recipe();
@@ -86432,12 +86435,54 @@ var require_inbox_stamp = __commonJS({
         return false;
       return exports2.INBOX_HELPER_TOKEN_RE.test(code) || /VALIDATE_QA_INBOX/.test(code);
     }
+    var INBOX_REGION_START = "// >>> VALIDATE_QA_INBOX";
+    var INBOX_REGION_END = "// <<< VALIDATE_QA_INBOX";
     function stripInboxRegions(code) {
-      return code.replace(exports2.INBOX_REGION_RE, "");
+      if (!code || code.indexOf(INBOX_REGION_START) === -1)
+        return code;
+      let out = "";
+      let i = 0;
+      while (i < code.length) {
+        const start = code.indexOf(INBOX_REGION_START, i);
+        if (start === -1) {
+          out += code.slice(i);
+          break;
+        }
+        const end = code.indexOf(INBOX_REGION_END, start + INBOX_REGION_START.length);
+        if (end === -1) {
+          out += code.slice(i);
+          break;
+        }
+        let lineEnd = code.indexOf("\n", end);
+        lineEnd = lineEnd === -1 ? code.length : lineEnd + 1;
+        out += code.slice(i, start);
+        i = lineEnd;
+      }
+      return out;
+    }
+    var TEST_INBOX_IDENTITY_RE = /VQA_TEST_INBOX_EMAIL|VQA_TEST_ACCOUNT_PASSWORD/;
+    function codeUsesTestInboxIdentity(code) {
+      if (!code)
+        return false;
+      return TEST_INBOX_IDENTITY_RE.test(stripInboxRegions(code));
+    }
+    function codeSelfProvisionsRegistration2(code) {
+      return codeUsesTestInboxIdentity(code);
     }
     function countInboxRegions(code) {
-      const m = code.match(exports2.INBOX_REGION_RE);
-      return m ? m.length : 0;
+      let count = 0;
+      let i = 0;
+      while (i < code.length) {
+        const start = code.indexOf(INBOX_REGION_START, i);
+        if (start === -1)
+          break;
+        const end = code.indexOf(INBOX_REGION_END, start + INBOX_REGION_START.length);
+        if (end === -1)
+          break;
+        count++;
+        i = end + INBOX_REGION_END.length;
+      }
+      return count;
     }
     function renderInboxFn() {
       const lines = [
@@ -86531,7 +86576,12 @@ var require_test_inbox_broker = __commonJS({
       return { found: true, code, link, subject: msg.subject, from: msg.from };
     }
     async function startTestInboxBroker(opts) {
-      const identity = mintTestRunInboxIdentity(opts.config, opts);
+      const executionNonce = (0, node_crypto_1.randomBytes)(4).toString("hex");
+      const identity = mintTestRunInboxIdentity(opts.config, {
+        baseUrl: opts.baseUrl,
+        projectId: opts.projectId,
+        runId: `${opts.runId}#${executionNonce}`
+      });
       const reader = new verification_inbox_js_1.VerificationInboxReader(opts.config);
       const sinceMs = Date.now();
       let sinceUid = 0;
@@ -86571,6 +86621,12 @@ var require_test_inbox_broker = __commonJS({
             sinceUidValidity,
             maxWaitMs: timeoutMs,
             require: require2,
+            // The plus-tag recipient is unique to this run, so an unexpected ESP
+            // sender is still this run's mail — demote, don't drop.
+            demoteFilterMismatch: true,
+            // Don't let a private/internal link end a `require:'link'` wait early —
+            // keep polling for a public one (SSRF parity with the post-wait check).
+            linkAcceptable: inbox_tools_js_1.isPublicHttpUrl,
             stats
           });
           const publicLink = msg && msg.link && (0, inbox_tools_js_1.isPublicHttpUrl)(msg.link) ? msg.link : null;
@@ -86705,7 +86761,8 @@ var require_playwright_native = __commonJS({
         runDir = (0, path_1.join)(RUNS_DIR, (0, crypto_1.randomUUID)());
         await (0, promises_1.mkdir)(runDir, { recursive: true });
         const isApiTest2 = playwrightCode.includes("@api") || playwrightCode.includes("{ request }") && !playwrightCode.includes("{ page");
-        const usesInboxHelper = !isApiTest2 && (0, inbox_stamp_js_1.codeUsesInboxHelper)(playwrightCode);
+        const usesRealInboxWait = !isApiTest2 && (0, inbox_stamp_js_1.codeUsesInboxHelper)(playwrightCode);
+        const selfProvisionsRegistration = !isApiTest2 && (0, inbox_stamp_js_1.codeSelfProvisionsRegistration)(playwrightCode);
         const effectiveStandingMode = isApiTest2 ? authStandingMode ?? "legacy-if-configured" : "none";
         const resolvedExtraHeaders = (0, api_auth_headers_js_1.resolveApiAuthHeaders)({
           explicit: extraHttpHeaders,
@@ -86952,7 +87009,7 @@ test.afterEach(async ({ page }, testInfo) => {
 module.exports = {
   testDir: ${JSON.stringify(absTestDir)},
   outputDir: ${JSON.stringify(absOutputDir)},
-  timeout: ${usesInboxHelper ? 24e4 : 6e4},
+  timeout: ${usesRealInboxWait ? 24e4 : 6e4},
   retries: 0,
   use: {
     baseURL: ${JSON.stringify(baseUrl)},
@@ -86978,7 +87035,7 @@ module.exports = {
         const isolation = await (0, chromium_isolation_js_1.createChromiumIsolation)(runDir);
         const processClaimEpoch = Number(process.env.CLAIM_EPOCH);
         const callbackClaimEpoch = Number.isSafeInteger(validateContext?.claimEpoch) ? validateContext?.claimEpoch : Number.isSafeInteger(processClaimEpoch) && processClaimEpoch >= 0 ? processClaimEpoch : void 0;
-        if (usesInboxHelper && validateContext?.runId) {
+        if (selfProvisionsRegistration && validateContext?.runId) {
           const inboxConfig = (0, verification_inbox_js_1.loadVerificationInboxConfig)();
           if (!inboxConfig) {
             logs2.push("\u{1F4EA} Test uses __vqaWaitForEmail but this runner has no verification inbox configured \u2014 the helper will fail as CONFIG_ISSUE");
@@ -86996,8 +87053,8 @@ module.exports = {
               logs2.push(`\u26A0 Inbox broker failed to start: ${error3 instanceof Error ? error3.message : String(error3)}`);
             }
           }
-        } else if (usesInboxHelper) {
-          logs2.push("\u{1F4EA} Test uses __vqaWaitForEmail but no run callback context is available \u2014 the helper will fail as CONFIG_ISSUE");
+        } else if (selfProvisionsRegistration) {
+          logs2.push("\u{1F4EA} Test self-provisions a registration identity (VQA_TEST_* / __vqaWaitForEmail) but no run callback context is available \u2014 the broker cannot start, so those values will be undefined at runtime");
         }
         if (validateContext?.runId && validateContext.serverUrl && validateContext.authHeader) {
           try {
@@ -87038,16 +87095,20 @@ module.exports = {
           ...process.env.SHARED_AUTH_INJECT ? { SHARED_AUTH_INJECT: process.env.SHARED_AUTH_INJECT } : {},
           // Register-and-verify tests: the run's minted registration identity. An
           // address + a DERIVED throwaway-app password — never the IMAP secret,
-          // which stays in this parent (test-inbox-broker.ts). Useless without the
-          // loopback proxy the helper reads mail through, hence the guard.
-          ...inboxBroker && callbackProxy ? inboxBroker.childEnv() : {}
+          // which stays in this parent (test-inbox-broker.ts). Injected whenever the
+          // broker started, NOT gated on the callback proxy: a signup that registers
+          // with this identity but needs no email verification uses the env yet never
+          // touches the proxy — gating on the proxy left it with undefined creds. A
+          // helper test still needs the proxy, and simply fails as CONFIG_ISSUE
+          // without it; leaking the throwaway address/password to that child is inert.
+          ...inboxBroker ? inboxBroker.childEnv() : {}
         };
         delete childTestVariables.API_AUTH_HEADERS;
         logs2.push("\u{1F680} Spawning playwright test...");
         const stopLiveBrowserPolling = liveBrowserStatePath && liveBrowserHandle ? startLiveBrowserStatePolling(liveBrowserStatePath, liveBrowserHandle, onLiveBrowserSnapshot) : null;
         let playResult;
         try {
-          playResult = await runPlaywright(configPath, childTestVariables, trustedRuntimeEnv, usesInboxHelper ? 3e5 : void 0);
+          playResult = await runPlaywright(configPath, childTestVariables, trustedRuntimeEnv, usesRealInboxWait ? 3e5 : void 0);
         } finally {
           await stopLiveBrowserPolling?.();
         }
@@ -94799,7 +94860,7 @@ var require_discover_generator = __commonJS({
     var test_inbox_broker_js_1 = require_test_inbox_broker();
     var REGISTER_SCENARIO_RE = /\b(register|registration|sign[\s-]?up|create[\s-]?(a[n]?[\s-]?)?(new[\s-]?)?account|verify[\s-]?(your[\s-]?)?email|email[\s-]?verification|confirm[\s-]?(your[\s-]?)?(email|account)|activate[\s-]?(your[\s-]?)?account|new[\s-]?account)\b/i;
     function scenarioLooksLikeRegistration(scenario) {
-      const hay = `${scenario.name ?? ""} ${scenario.description ?? ""} ${scenario.entryRoute ?? ""} ${(scenario.targetPages ?? []).join(" ")}`;
+      const hay = `${scenario.name ?? ""} ${scenario.goal ?? ""} ${scenario.description ?? ""} ${scenario.entryRoute ?? ""} ${(scenario.targetPages ?? []).join(" ")}`;
       return REGISTER_SCENARIO_RE.test(hay);
     }
     function buildEmailVerifyGenBlock(genEmail, genPassword) {
@@ -97752,7 +97813,7 @@ ${tailBlock}`;
           const genEmail = (0, verification_inbox_js_1.applyPlusTag)(inboxGenConfig.address, genTag);
           const genPassword = (0, verification_inbox_js_1.deriveRegistrationPassword)(genEmail);
           genInboxReader = new verification_inbox_js_1.VerificationInboxReader(inboxGenConfig);
-          genInboxState = (0, inbox_tools_js_1.createInboxRunState)(inboxGenConfig, { tag: genTag, passwordKey: test_inbox_broker_js_1.TEST_INBOX_PASSWORD_ENV });
+          genInboxState = (0, inbox_tools_js_1.createInboxRunState)(inboxGenConfig, { tag: genTag, passwordKey: test_inbox_broker_js_1.TEST_INBOX_PASSWORD_ENV, demoteFilterMismatch: true });
           genInboxCredentials = { ...credentials, [test_inbox_broker_js_1.TEST_INBOX_EMAIL_ENV]: genEmail, [test_inbox_broker_js_1.TEST_INBOX_PASSWORD_ENV]: genPassword };
           genInboxSecret = genPassword;
           openaiTools.push(...inbox_tools_js_1.INBOX_TOOLS);
@@ -98314,6 +98375,13 @@ Do NOT assert that the button/tab/heading you interacted with is merely visible
                     logs2.push(`    Strength gate: block persists after revision \u2014 tagged @needs-review (proves no outcome)`);
                   }
                 }
+                const finalSelfProvisions = (0, inbox_stamp_js_1.codeSelfProvisionsRegistration)(result.playwrightCode);
+                if (finalSelfProvisions) {
+                  if (!result.tags.includes("@email-verify"))
+                    result.tags.push("@email-verify");
+                } else if (inboxGenConfig) {
+                  logs2.push(`    \u26A0 Email-verify generation was armed but the emitted test neither calls __vqaWaitForEmail nor uses the VQA_TEST_* runtime identity \u2014 it may have hardcoded values (stale on re-run).`);
+                }
                 const elapsed = Date.now() - startTime;
                 logs2.push(`    Scenario test generated in ${iteration} iterations (${elapsed}ms, ${verifyCallCount} verify calls)`);
               } else {
@@ -349882,9 +349950,9 @@ var require_dist2 = __commonJS({
       for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding(exports3, m, p);
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.acquireRepoForImport = exports2.runFrameworkImportOnRunner = exports2.getAgenticEngine = exports2.resolveRefFromSnapshot = exports2.replayAuthRecipeIntoBrowser = exports2.runRegisterCaptureRun = exports2.runLoginCaptureRun = exports2.filterLoginCaptureCredentials = exports2.buildLoginCaptureCredentials = exports2.isReservedRunnerEnvVar = exports2.RESERVED_RUNNER_ENV_VARS = exports2.AUTH_MARKER_VERSION = exports2.buildHealAuthStamp = exports2.extractAuthRegion = exports2.upsertAuthBlock = exports2.buildAuthRecipe = exports2.commandToReplayStep = exports2.buildReplayPlan = exports2.absoluteRoute = exports2.renderReplaySettleArrow = exports2.renderReplayClickArrow = exports2.renderAuthFn = exports2.filterFeatureGroupsToPathScope = exports2.isAuthFlowRoute = exports2.deriveSurveyPathScope = exports2.canonicalizeRoute = exports2.executeGrokPerBatchHeal = exports2.executeGrokPerTestHeal = exports2.headerVal = exports2.classifyAuthType = exports2.isTextExcerptable = exports2.isStaticAssetByExt = exports2.isApiCall = exports2.buildApiCallSummary = exports2.computeMobileHealOutcome = exports2.detectMobileStepSecretLeak = exports2.redactMobileSecretsFromText = exports2.MOBILE_LIVE_HEAL_SYSTEM_PROMPT = exports2.MOBILE_SCRIPT_HEAL_SYSTEM_PROMPT = exports2.executeMobileLiveHeal = exports2.executeMobileTestWithHealing = exports2.executeMobileScriptDrivenHeal = exports2.prepareMobileScenarioAppState = exports2.runMobileGeneratePhase = exports2.runMobileAIPlanner = exports2.buildMobileSiteMap = exports2.formatMobileEvidenceForPlanner = exports2.MOBILE_SCENARIO_SYSTEM_PROMPT = exports2.MOBILE_SURVEY_SYSTEM_PROMPT = exports2.runMobileExplorePhase = void 0;
-    exports2.gracefulCloseWithTreeKill = exports2.liveBrowserRegistry = exports2.REPO_SWITCH_REMOVED_FRACTION = exports2.MAX_MANIFEST_FILES = exports2.toDiffSummary = exports2.isLikelyTestFile = exports2.sanitizeRepoRelPath = exports2.sha256Hex = exports2.hashFiles = exports2.enumerateTestFiles = exports2.buildNextManifest = exports2.detectRepoSwitch = exports2.classifyImportDiff = exports2.parseImportManifest = exports2.validateAuthoredMobileTest = exports2.buildMobileRepoAuthorSystemRules = exports2.buildMobileRepoAuthorKickoff = exports2.buildMobileRepoAuthorContractMd = exports2.REPO_ANALYSIS_SCHEMA_VERSION = exports2.validateSourceEndpoints = exports2.validateAuthoredTest = exports2.validateRepoMapFile = exports2.validateRepoMemoryFile = exports2.buildTestingStandardsSection = exports2.buildRepoAuthorSystemRules = exports2.buildRepoAuthorKickoff = exports2.buildRepoAuthorContractMd = exports2.buildRepoMapSystemRules = exports2.buildRepoMapKickoff = exports2.buildRepoMapContractMd = exports2.buildRepoMemorySystemRules = exports2.buildRepoMemoryKickoff = exports2.buildRepoMemoryContractMd = exports2.runRepoAnalysisOnRunner = exports2.MOBILE_IMPORT_SCHEMA_VERSION = exports2.validateImportedMobileTest = exports2.buildMobileImportSystemRules = exports2.buildMobileImportKickoff = exports2.buildMobileImportContractMd = exports2.IMPORT_SCHEMA_VERSION = exports2.validateImportResultFile = exports2.validateImportedTest = exports2.buildImportSystemRules = exports2.buildImportKickoff = exports2.buildImportContractMd = exports2.MAX_ARCHIVE_BYTES = exports2.isUnsafeEntryName = exports2.extractZipSafely = exports2.downloadArchiveCapped = exports2.detectArchiveKind = void 0;
-    exports2.UNSUPPORTED_RENDERER_PREFIX = exports2.UnsupportedRendererError = exports2.buildCanvasModeAuthoringAddendum = exports2.buildUnsupportedRendererMessage = exports2.modelSupportsVision = exports2.decideCanvasStrategy = exports2.decideAppRenderType = exports2.detectCanvasApp = exports2.detectRateLimitBlock = exports2.isSafeCanonicalRedirect = exports2.resolveBaseUrlPreflight = exports2.checkBaseUrlRedirect = exports2.stripJsonFences = exports2.scrubCredentials = exports2.withAIRetry = exports2.snapshotMatchingChildren = exports2.findNewChromiumChildPid = exports2.killProcessTree = void 0;
+    exports2.resolveRefFromSnapshot = exports2.replayAuthRecipeIntoBrowser = exports2.runRegisterCaptureRun = exports2.runLoginCaptureRun = exports2.filterLoginCaptureCredentials = exports2.buildLoginCaptureCredentials = exports2.isReservedRunnerEnvVar = exports2.RESERVED_RUNNER_ENV_VARS = exports2.AUTH_MARKER_VERSION = exports2.buildHealAuthStamp = exports2.extractAuthRegion = exports2.upsertAuthBlock = exports2.buildAuthRecipe = exports2.commandToReplayStep = exports2.buildReplayPlan = exports2.absoluteRoute = exports2.renderReplaySettleArrow = exports2.renderReplayClickArrow = exports2.renderAuthFn = exports2.filterFeatureGroupsToPathScope = exports2.isAuthFlowRoute = exports2.deriveSurveyPathScope = exports2.canonicalizeRoute = exports2.codeUsesInboxHelper = exports2.codeUsesTestInboxIdentity = exports2.codeSelfProvisionsRegistration = exports2.executeGrokPerBatchHeal = exports2.executeGrokPerTestHeal = exports2.headerVal = exports2.classifyAuthType = exports2.isTextExcerptable = exports2.isStaticAssetByExt = exports2.isApiCall = exports2.buildApiCallSummary = exports2.computeMobileHealOutcome = exports2.detectMobileStepSecretLeak = exports2.redactMobileSecretsFromText = exports2.MOBILE_LIVE_HEAL_SYSTEM_PROMPT = exports2.MOBILE_SCRIPT_HEAL_SYSTEM_PROMPT = exports2.executeMobileLiveHeal = exports2.executeMobileTestWithHealing = exports2.executeMobileScriptDrivenHeal = exports2.prepareMobileScenarioAppState = exports2.runMobileGeneratePhase = exports2.runMobileAIPlanner = exports2.buildMobileSiteMap = exports2.formatMobileEvidenceForPlanner = exports2.MOBILE_SCENARIO_SYSTEM_PROMPT = exports2.MOBILE_SURVEY_SYSTEM_PROMPT = exports2.runMobileExplorePhase = void 0;
+    exports2.MAX_MANIFEST_FILES = exports2.toDiffSummary = exports2.isLikelyTestFile = exports2.sanitizeRepoRelPath = exports2.sha256Hex = exports2.hashFiles = exports2.enumerateTestFiles = exports2.buildNextManifest = exports2.detectRepoSwitch = exports2.classifyImportDiff = exports2.parseImportManifest = exports2.validateAuthoredMobileTest = exports2.buildMobileRepoAuthorSystemRules = exports2.buildMobileRepoAuthorKickoff = exports2.buildMobileRepoAuthorContractMd = exports2.REPO_ANALYSIS_SCHEMA_VERSION = exports2.validateSourceEndpoints = exports2.validateAuthoredTest = exports2.validateRepoMapFile = exports2.validateRepoMemoryFile = exports2.buildTestingStandardsSection = exports2.buildRepoAuthorSystemRules = exports2.buildRepoAuthorKickoff = exports2.buildRepoAuthorContractMd = exports2.buildRepoMapSystemRules = exports2.buildRepoMapKickoff = exports2.buildRepoMapContractMd = exports2.buildRepoMemorySystemRules = exports2.buildRepoMemoryKickoff = exports2.buildRepoMemoryContractMd = exports2.runRepoAnalysisOnRunner = exports2.MOBILE_IMPORT_SCHEMA_VERSION = exports2.validateImportedMobileTest = exports2.buildMobileImportSystemRules = exports2.buildMobileImportKickoff = exports2.buildMobileImportContractMd = exports2.IMPORT_SCHEMA_VERSION = exports2.validateImportResultFile = exports2.validateImportedTest = exports2.buildImportSystemRules = exports2.buildImportKickoff = exports2.buildImportContractMd = exports2.MAX_ARCHIVE_BYTES = exports2.isUnsafeEntryName = exports2.extractZipSafely = exports2.downloadArchiveCapped = exports2.detectArchiveKind = exports2.acquireRepoForImport = exports2.runFrameworkImportOnRunner = exports2.getAgenticEngine = void 0;
+    exports2.UNSUPPORTED_RENDERER_PREFIX = exports2.UnsupportedRendererError = exports2.buildCanvasModeAuthoringAddendum = exports2.buildUnsupportedRendererMessage = exports2.modelSupportsVision = exports2.decideCanvasStrategy = exports2.decideAppRenderType = exports2.detectCanvasApp = exports2.detectRateLimitBlock = exports2.isSafeCanonicalRedirect = exports2.resolveBaseUrlPreflight = exports2.checkBaseUrlRedirect = exports2.stripJsonFences = exports2.scrubCredentials = exports2.withAIRetry = exports2.snapshotMatchingChildren = exports2.findNewChromiumChildPid = exports2.killProcessTree = exports2.gracefulCloseWithTreeKill = exports2.liveBrowserRegistry = exports2.REPO_SWITCH_REMOVED_FRACTION = void 0;
     __exportStar(require_ai_provider(), exports2);
     __exportStar(require_mobile_types(), exports2);
     __exportStar(require_mobile_source_parser(), exports2);
@@ -349975,6 +350043,16 @@ var require_dist2 = __commonJS({
       return grok_batch_healer_js_1.executeGrokPerBatchHeal;
     } });
     __exportStar(require_playwright_code(), exports2);
+    var inbox_stamp_js_1 = require_inbox_stamp();
+    Object.defineProperty(exports2, "codeSelfProvisionsRegistration", { enumerable: true, get: function() {
+      return inbox_stamp_js_1.codeSelfProvisionsRegistration;
+    } });
+    Object.defineProperty(exports2, "codeUsesTestInboxIdentity", { enumerable: true, get: function() {
+      return inbox_stamp_js_1.codeUsesTestInboxIdentity;
+    } });
+    Object.defineProperty(exports2, "codeUsesInboxHelper", { enumerable: true, get: function() {
+      return inbox_stamp_js_1.codeUsesInboxHelper;
+    } });
     __exportStar(require_playwright_native(), exports2);
     __exportStar(require_regression_runner(), exports2);
     __exportStar(require_snapshot_parser(), exports2);
@@ -350304,7 +350382,7 @@ var require_package4 = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.58",
+      version: "1.0.59",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"
@@ -357933,7 +358011,8 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
           const codeUsesCreds = codeProvided && /TEST_USER_EMAIL|TEST_USER_PASSWORD|__vqaLogin/.test(code);
           const tags = Array.isArray(run2.tags) ? run2.tags : [];
           const isHallucinationShape = codeProvided && !codeUsesCreds && tags.includes("@inline-login") && !tags.includes("@api");
-          const requireCreds = authPlan.needsLoginCreds && !legacyHeaderBypass && !isHallucinationShape;
+          const selfProvisioningRegisterTest = codeProvided && !codeUsesCreds && tags.includes("@email-verify") && (0, import_runner_core13.codeSelfProvisionsRegistration)(code);
+          const requireCreds = authPlan.needsLoginCreds && !legacyHeaderBypass && !isHallucinationShape && !selfProvisioningRegisterTest;
           if (requireCreds && !run2.testVariables?.["TEST_USER_EMAIL"]?.trim()) {
             preflightError = "Pre-flight failed: Missing TEST_USER_EMAIL. Tests that log in (tagged @auth, @needs-auth, @api, @auth-cookie-state, @auth-login-cookie, or @auth-login-bearer) require login credentials.";
           } else if (requireCreds && !run2.testVariables?.["TEST_USER_PASSWORD"]?.trim()) {

package/dist/cli.mjs

@@ -72846,18 +72846,15 @@ var require_verification_inbox = __commonJS({
             return { code: cleaned, confidence: "keyword" };
         }
       }
-      const distinct = /* @__PURE__ */ new Set();
       for (const body of bodies) {
         if (!body)
           continue;
         for (const n of body.match(/\b[0-9]{4,8}\b/g) ?? []) {
-          if (!looksLikeYearOrDate(n))
-            distinct.add(n);
+          if (looksLikeYearOrDate(n))
+            continue;
+          return { code: n, confidence: "fallback" };
         }
       }
-      if (distinct.size === 1) {
-        return { code: distinct.values().next().value ?? null, confidence: "fallback" };
-      }
       return { code: null, confidence: null };
     }
     function matchBestCode(line) {
@@ -73155,9 +73152,10 @@ var require_verification_inbox = __commonJS({
         const satisfies = (m) => {
           if (opts.require === "code")
             return m.code !== null && m.codeConfidence !== "fallback";
+          const linkOk = (l) => l !== null && (!opts.linkAcceptable || opts.linkAcceptable(l));
           if (opts.require === "link")
-            return m.link !== null;
-          return m.hasVerificationSignal;
+            return linkOk(m.link);
+          return m.code !== null && m.codeConfidence !== "fallback" || linkOk(m.link);
         };
         let weakest = null;
         const check2 = async () => {
@@ -73204,7 +73202,7 @@ var require_verification_inbox = __commonJS({
         const since = new Date(Math.max(0, opts.sinceMs));
         const lock = await client.getMailboxLock(mailbox);
         const results = [];
-        const taggedRecipient = isPlusTagged(opts.toAddress);
+        const demoteMismatch = isPlusTagged(opts.toAddress) && Boolean(opts.demoteFilterMismatch);
         try {
           try {
             await client.noop();
@@ -73250,7 +73248,7 @@ var require_verification_inbox = __commonJS({
               continue;
             const filterActive = Boolean(opts.fromMatch || opts.subjectMatch);
             const filterMatched = (!opts.fromMatch || matchField(parsed.from?.text, opts.fromMatch)) && (!opts.subjectMatch || matchField(parsed.subject, opts.subjectMatch));
-            if (filterActive && !filterMatched && !taggedRecipient) {
+            if (filterActive && !filterMatched && !demoteMismatch) {
               if (opts.stats)
                 opts.stats.filteredOut += 1;
               continue;
@@ -73388,7 +73386,8 @@ var require_inbox_tools = __commonJS({
         // Captured at provision (needs a live reader); 0 = use the sinceMs floor.
         sinceUid: 0,
         sinceUidValidity: 0,
-        knownLinks: /* @__PURE__ */ new Set()
+        knownLinks: /* @__PURE__ */ new Set(),
+        demoteFilterMismatch: opts.demoteFilterMismatch ?? false
       };
     }
     exports.PROVISION_IDENTITY_TOOL = {
@@ -73576,6 +73575,7 @@ var require_inbox_tools = __commonJS({
         sinceUidValidity: ctx.state.sinceUidValidity,
         fromMatch: asStr(args.senderMatch),
         subjectMatch: asStr(args.subjectMatch),
+        demoteFilterMismatch: ctx.state.demoteFilterMismatch,
         limit: 10
       });
       return ok({
@@ -73600,6 +73600,7 @@ var require_inbox_tools = __commonJS({
         sinceUidValidity: ctx.state.sinceUidValidity,
         fromMatch: asStr(args.senderMatch),
         subjectMatch: asStr(args.subjectMatch),
+        demoteFilterMismatch: ctx.state.demoteFilterMismatch,
         maxWaitMs: maxWaitSeconds * 1e3,
         stats
       });
@@ -73746,7 +73747,7 @@ var require_inbox_tools = __commonJS({
         const u = new URL(raw);
         if (u.protocol !== "http:" && u.protocol !== "https:")
           return false;
-        host = u.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+        host = u.hostname.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.+$/, "");
       } catch {
         return false;
       }
@@ -73762,7 +73763,7 @@ var require_inbox_tools = __commonJS({
         const dotted = host.match(/(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
         if (dotted && !ipv4IsPublic(dotted[1]))
           return false;
-        const mapped = host.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+        const mapped = host.match(/^::(?:ffff:)?([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
         if (mapped) {
           const hi = parseInt(mapped[1], 16);
           const lo = parseInt(mapped[2], 16);
@@ -86423,6 +86424,8 @@ var require_inbox_stamp = __commonJS({
     exports.INBOX_HELPER_TOKEN_RE = exports.INBOX_HELPER_NAME = exports.INBOX_REGION_RE = exports.INBOX_MARKER_VERSION = void 0;
     exports.codeUsesInboxHelper = codeUsesInboxHelper;
     exports.stripInboxRegions = stripInboxRegions;
+    exports.codeUsesTestInboxIdentity = codeUsesTestInboxIdentity;
+    exports.codeSelfProvisionsRegistration = codeSelfProvisionsRegistration2;
     exports.renderInboxFn = renderInboxFn;
     exports.upsertInboxBlock = upsertInboxBlock;
     var auth_recipe_js_1 = require_auth_recipe();
@@ -86437,12 +86440,54 @@ var require_inbox_stamp = __commonJS({
         return false;
       return exports.INBOX_HELPER_TOKEN_RE.test(code) || /VALIDATE_QA_INBOX/.test(code);
     }
+    var INBOX_REGION_START = "// >>> VALIDATE_QA_INBOX";
+    var INBOX_REGION_END = "// <<< VALIDATE_QA_INBOX";
     function stripInboxRegions(code) {
-      return code.replace(exports.INBOX_REGION_RE, "");
+      if (!code || code.indexOf(INBOX_REGION_START) === -1)
+        return code;
+      let out = "";
+      let i = 0;
+      while (i < code.length) {
+        const start = code.indexOf(INBOX_REGION_START, i);
+        if (start === -1) {
+          out += code.slice(i);
+          break;
+        }
+        const end = code.indexOf(INBOX_REGION_END, start + INBOX_REGION_START.length);
+        if (end === -1) {
+          out += code.slice(i);
+          break;
+        }
+        let lineEnd = code.indexOf("\n", end);
+        lineEnd = lineEnd === -1 ? code.length : lineEnd + 1;
+        out += code.slice(i, start);
+        i = lineEnd;
+      }
+      return out;
+    }
+    var TEST_INBOX_IDENTITY_RE = /VQA_TEST_INBOX_EMAIL|VQA_TEST_ACCOUNT_PASSWORD/;
+    function codeUsesTestInboxIdentity(code) {
+      if (!code)
+        return false;
+      return TEST_INBOX_IDENTITY_RE.test(stripInboxRegions(code));
+    }
+    function codeSelfProvisionsRegistration2(code) {
+      return codeUsesTestInboxIdentity(code);
     }
     function countInboxRegions(code) {
-      const m = code.match(exports.INBOX_REGION_RE);
-      return m ? m.length : 0;
+      let count = 0;
+      let i = 0;
+      while (i < code.length) {
+        const start = code.indexOf(INBOX_REGION_START, i);
+        if (start === -1)
+          break;
+        const end = code.indexOf(INBOX_REGION_END, start + INBOX_REGION_START.length);
+        if (end === -1)
+          break;
+        count++;
+        i = end + INBOX_REGION_END.length;
+      }
+      return count;
     }
     function renderInboxFn() {
       const lines = [
@@ -86536,7 +86581,12 @@ var require_test_inbox_broker = __commonJS({
       return { found: true, code, link, subject: msg.subject, from: msg.from };
     }
     async function startTestInboxBroker(opts) {
-      const identity = mintTestRunInboxIdentity(opts.config, opts);
+      const executionNonce = (0, node_crypto_1.randomBytes)(4).toString("hex");
+      const identity = mintTestRunInboxIdentity(opts.config, {
+        baseUrl: opts.baseUrl,
+        projectId: opts.projectId,
+        runId: `${opts.runId}#${executionNonce}`
+      });
       const reader = new verification_inbox_js_1.VerificationInboxReader(opts.config);
       const sinceMs = Date.now();
       let sinceUid = 0;
@@ -86576,6 +86626,12 @@ var require_test_inbox_broker = __commonJS({
             sinceUidValidity,
             maxWaitMs: timeoutMs,
             require: require2,
+            // The plus-tag recipient is unique to this run, so an unexpected ESP
+            // sender is still this run's mail — demote, don't drop.
+            demoteFilterMismatch: true,
+            // Don't let a private/internal link end a `require:'link'` wait early —
+            // keep polling for a public one (SSRF parity with the post-wait check).
+            linkAcceptable: inbox_tools_js_1.isPublicHttpUrl,
             stats
           });
           const publicLink = msg && msg.link && (0, inbox_tools_js_1.isPublicHttpUrl)(msg.link) ? msg.link : null;
@@ -86710,7 +86766,8 @@ var require_playwright_native = __commonJS({
         runDir = (0, path_1.join)(RUNS_DIR, (0, crypto_1.randomUUID)());
         await (0, promises_1.mkdir)(runDir, { recursive: true });
         const isApiTest2 = playwrightCode.includes("@api") || playwrightCode.includes("{ request }") && !playwrightCode.includes("{ page");
-        const usesInboxHelper = !isApiTest2 && (0, inbox_stamp_js_1.codeUsesInboxHelper)(playwrightCode);
+        const usesRealInboxWait = !isApiTest2 && (0, inbox_stamp_js_1.codeUsesInboxHelper)(playwrightCode);
+        const selfProvisionsRegistration = !isApiTest2 && (0, inbox_stamp_js_1.codeSelfProvisionsRegistration)(playwrightCode);
         const effectiveStandingMode = isApiTest2 ? authStandingMode ?? "legacy-if-configured" : "none";
         const resolvedExtraHeaders = (0, api_auth_headers_js_1.resolveApiAuthHeaders)({
           explicit: extraHttpHeaders,
@@ -86957,7 +87014,7 @@ test.afterEach(async ({ page }, testInfo) => {
 module.exports = {
   testDir: ${JSON.stringify(absTestDir)},
   outputDir: ${JSON.stringify(absOutputDir)},
-  timeout: ${usesInboxHelper ? 24e4 : 6e4},
+  timeout: ${usesRealInboxWait ? 24e4 : 6e4},
   retries: 0,
   use: {
     baseURL: ${JSON.stringify(baseUrl)},
@@ -86983,7 +87040,7 @@ module.exports = {
         const isolation = await (0, chromium_isolation_js_1.createChromiumIsolation)(runDir);
         const processClaimEpoch = Number(process.env.CLAIM_EPOCH);
         const callbackClaimEpoch = Number.isSafeInteger(validateContext?.claimEpoch) ? validateContext?.claimEpoch : Number.isSafeInteger(processClaimEpoch) && processClaimEpoch >= 0 ? processClaimEpoch : void 0;
-        if (usesInboxHelper && validateContext?.runId) {
+        if (selfProvisionsRegistration && validateContext?.runId) {
           const inboxConfig = (0, verification_inbox_js_1.loadVerificationInboxConfig)();
           if (!inboxConfig) {
             logs2.push("\u{1F4EA} Test uses __vqaWaitForEmail but this runner has no verification inbox configured \u2014 the helper will fail as CONFIG_ISSUE");
@@ -87001,8 +87058,8 @@ module.exports = {
               logs2.push(`\u26A0 Inbox broker failed to start: ${error3 instanceof Error ? error3.message : String(error3)}`);
             }
           }
-        } else if (usesInboxHelper) {
-          logs2.push("\u{1F4EA} Test uses __vqaWaitForEmail but no run callback context is available \u2014 the helper will fail as CONFIG_ISSUE");
+        } else if (selfProvisionsRegistration) {
+          logs2.push("\u{1F4EA} Test self-provisions a registration identity (VQA_TEST_* / __vqaWaitForEmail) but no run callback context is available \u2014 the broker cannot start, so those values will be undefined at runtime");
         }
         if (validateContext?.runId && validateContext.serverUrl && validateContext.authHeader) {
           try {
@@ -87043,16 +87100,20 @@ module.exports = {
           ...process.env.SHARED_AUTH_INJECT ? { SHARED_AUTH_INJECT: process.env.SHARED_AUTH_INJECT } : {},
           // Register-and-verify tests: the run's minted registration identity. An
           // address + a DERIVED throwaway-app password — never the IMAP secret,
-          // which stays in this parent (test-inbox-broker.ts). Useless without the
-          // loopback proxy the helper reads mail through, hence the guard.
-          ...inboxBroker && callbackProxy ? inboxBroker.childEnv() : {}
+          // which stays in this parent (test-inbox-broker.ts). Injected whenever the
+          // broker started, NOT gated on the callback proxy: a signup that registers
+          // with this identity but needs no email verification uses the env yet never
+          // touches the proxy — gating on the proxy left it with undefined creds. A
+          // helper test still needs the proxy, and simply fails as CONFIG_ISSUE
+          // without it; leaking the throwaway address/password to that child is inert.
+          ...inboxBroker ? inboxBroker.childEnv() : {}
         };
         delete childTestVariables.API_AUTH_HEADERS;
         logs2.push("\u{1F680} Spawning playwright test...");
         const stopLiveBrowserPolling = liveBrowserStatePath && liveBrowserHandle ? startLiveBrowserStatePolling(liveBrowserStatePath, liveBrowserHandle, onLiveBrowserSnapshot) : null;
         let playResult;
         try {
-          playResult = await runPlaywright(configPath, childTestVariables, trustedRuntimeEnv, usesInboxHelper ? 3e5 : void 0);
+          playResult = await runPlaywright(configPath, childTestVariables, trustedRuntimeEnv, usesRealInboxWait ? 3e5 : void 0);
         } finally {
           await stopLiveBrowserPolling?.();
         }
@@ -94804,7 +94865,7 @@ var require_discover_generator = __commonJS({
     var test_inbox_broker_js_1 = require_test_inbox_broker();
     var REGISTER_SCENARIO_RE = /\b(register|registration|sign[\s-]?up|create[\s-]?(a[n]?[\s-]?)?(new[\s-]?)?account|verify[\s-]?(your[\s-]?)?email|email[\s-]?verification|confirm[\s-]?(your[\s-]?)?(email|account)|activate[\s-]?(your[\s-]?)?account|new[\s-]?account)\b/i;
     function scenarioLooksLikeRegistration(scenario) {
-      const hay = `${scenario.name ?? ""} ${scenario.description ?? ""} ${scenario.entryRoute ?? ""} ${(scenario.targetPages ?? []).join(" ")}`;
+      const hay = `${scenario.name ?? ""} ${scenario.goal ?? ""} ${scenario.description ?? ""} ${scenario.entryRoute ?? ""} ${(scenario.targetPages ?? []).join(" ")}`;
       return REGISTER_SCENARIO_RE.test(hay);
     }
     function buildEmailVerifyGenBlock(genEmail, genPassword) {
@@ -97757,7 +97818,7 @@ ${tailBlock}`;
           const genEmail = (0, verification_inbox_js_1.applyPlusTag)(inboxGenConfig.address, genTag);
           const genPassword = (0, verification_inbox_js_1.deriveRegistrationPassword)(genEmail);
           genInboxReader = new verification_inbox_js_1.VerificationInboxReader(inboxGenConfig);
-          genInboxState = (0, inbox_tools_js_1.createInboxRunState)(inboxGenConfig, { tag: genTag, passwordKey: test_inbox_broker_js_1.TEST_INBOX_PASSWORD_ENV });
+          genInboxState = (0, inbox_tools_js_1.createInboxRunState)(inboxGenConfig, { tag: genTag, passwordKey: test_inbox_broker_js_1.TEST_INBOX_PASSWORD_ENV, demoteFilterMismatch: true });
           genInboxCredentials = { ...credentials, [test_inbox_broker_js_1.TEST_INBOX_EMAIL_ENV]: genEmail, [test_inbox_broker_js_1.TEST_INBOX_PASSWORD_ENV]: genPassword };
           genInboxSecret = genPassword;
           openaiTools.push(...inbox_tools_js_1.INBOX_TOOLS);
@@ -98319,6 +98380,13 @@ Do NOT assert that the button/tab/heading you interacted with is merely visible
                     logs2.push(`    Strength gate: block persists after revision \u2014 tagged @needs-review (proves no outcome)`);
                   }
                 }
+                const finalSelfProvisions = (0, inbox_stamp_js_1.codeSelfProvisionsRegistration)(result.playwrightCode);
+                if (finalSelfProvisions) {
+                  if (!result.tags.includes("@email-verify"))
+                    result.tags.push("@email-verify");
+                } else if (inboxGenConfig) {
+                  logs2.push(`    \u26A0 Email-verify generation was armed but the emitted test neither calls __vqaWaitForEmail nor uses the VQA_TEST_* runtime identity \u2014 it may have hardcoded values (stale on re-run).`);
+                }
                 const elapsed = Date.now() - startTime;
                 logs2.push(`    Scenario test generated in ${iteration} iterations (${elapsed}ms, ${verifyCallCount} verify calls)`);
               } else {
@@ -349887,9 +349955,9 @@ var require_dist2 = __commonJS({
       for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports2, p)) __createBinding(exports2, m, p);
     };
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.acquireRepoForImport = exports.runFrameworkImportOnRunner = exports.getAgenticEngine = exports.resolveRefFromSnapshot = exports.replayAuthRecipeIntoBrowser = exports.runRegisterCaptureRun = exports.runLoginCaptureRun = exports.filterLoginCaptureCredentials = exports.buildLoginCaptureCredentials = exports.isReservedRunnerEnvVar = exports.RESERVED_RUNNER_ENV_VARS = exports.AUTH_MARKER_VERSION = exports.buildHealAuthStamp = exports.extractAuthRegion = exports.upsertAuthBlock = exports.buildAuthRecipe = exports.commandToReplayStep = exports.buildReplayPlan = exports.absoluteRoute = exports.renderReplaySettleArrow = exports.renderReplayClickArrow = exports.renderAuthFn = exports.filterFeatureGroupsToPathScope = exports.isAuthFlowRoute = exports.deriveSurveyPathScope = exports.canonicalizeRoute = exports.executeGrokPerBatchHeal = exports.executeGrokPerTestHeal = exports.headerVal = exports.classifyAuthType = exports.isTextExcerptable = exports.isStaticAssetByExt = exports.isApiCall = exports.buildApiCallSummary = exports.computeMobileHealOutcome = exports.detectMobileStepSecretLeak = exports.redactMobileSecretsFromText = exports.MOBILE_LIVE_HEAL_SYSTEM_PROMPT = exports.MOBILE_SCRIPT_HEAL_SYSTEM_PROMPT = exports.executeMobileLiveHeal = exports.executeMobileTestWithHealing = exports.executeMobileScriptDrivenHeal = exports.prepareMobileScenarioAppState = exports.runMobileGeneratePhase = exports.runMobileAIPlanner = exports.buildMobileSiteMap = exports.formatMobileEvidenceForPlanner = exports.MOBILE_SCENARIO_SYSTEM_PROMPT = exports.MOBILE_SURVEY_SYSTEM_PROMPT = exports.runMobileExplorePhase = void 0;
-    exports.gracefulCloseWithTreeKill = exports.liveBrowserRegistry = exports.REPO_SWITCH_REMOVED_FRACTION = exports.MAX_MANIFEST_FILES = exports.toDiffSummary = exports.isLikelyTestFile = exports.sanitizeRepoRelPath = exports.sha256Hex = exports.hashFiles = exports.enumerateTestFiles = exports.buildNextManifest = exports.detectRepoSwitch = exports.classifyImportDiff = exports.parseImportManifest = exports.validateAuthoredMobileTest = exports.buildMobileRepoAuthorSystemRules = exports.buildMobileRepoAuthorKickoff = exports.buildMobileRepoAuthorContractMd = exports.REPO_ANALYSIS_SCHEMA_VERSION = exports.validateSourceEndpoints = exports.validateAuthoredTest = exports.validateRepoMapFile = exports.validateRepoMemoryFile = exports.buildTestingStandardsSection = exports.buildRepoAuthorSystemRules = exports.buildRepoAuthorKickoff = exports.buildRepoAuthorContractMd = exports.buildRepoMapSystemRules = exports.buildRepoMapKickoff = exports.buildRepoMapContractMd = exports.buildRepoMemorySystemRules = exports.buildRepoMemoryKickoff = exports.buildRepoMemoryContractMd = exports.runRepoAnalysisOnRunner = exports.MOBILE_IMPORT_SCHEMA_VERSION = exports.validateImportedMobileTest = exports.buildMobileImportSystemRules = exports.buildMobileImportKickoff = exports.buildMobileImportContractMd = exports.IMPORT_SCHEMA_VERSION = exports.validateImportResultFile = exports.validateImportedTest = exports.buildImportSystemRules = exports.buildImportKickoff = exports.buildImportContractMd = exports.MAX_ARCHIVE_BYTES = exports.isUnsafeEntryName = exports.extractZipSafely = exports.downloadArchiveCapped = exports.detectArchiveKind = void 0;
-    exports.UNSUPPORTED_RENDERER_PREFIX = exports.UnsupportedRendererError = exports.buildCanvasModeAuthoringAddendum = exports.buildUnsupportedRendererMessage = exports.modelSupportsVision = exports.decideCanvasStrategy = exports.decideAppRenderType = exports.detectCanvasApp = exports.detectRateLimitBlock = exports.isSafeCanonicalRedirect = exports.resolveBaseUrlPreflight = exports.checkBaseUrlRedirect = exports.stripJsonFences = exports.scrubCredentials = exports.withAIRetry = exports.snapshotMatchingChildren = exports.findNewChromiumChildPid = exports.killProcessTree = void 0;
+    exports.resolveRefFromSnapshot = exports.replayAuthRecipeIntoBrowser = exports.runRegisterCaptureRun = exports.runLoginCaptureRun = exports.filterLoginCaptureCredentials = exports.buildLoginCaptureCredentials = exports.isReservedRunnerEnvVar = exports.RESERVED_RUNNER_ENV_VARS = exports.AUTH_MARKER_VERSION = exports.buildHealAuthStamp = exports.extractAuthRegion = exports.upsertAuthBlock = exports.buildAuthRecipe = exports.commandToReplayStep = exports.buildReplayPlan = exports.absoluteRoute = exports.renderReplaySettleArrow = exports.renderReplayClickArrow = exports.renderAuthFn = exports.filterFeatureGroupsToPathScope = exports.isAuthFlowRoute = exports.deriveSurveyPathScope = exports.canonicalizeRoute = exports.codeUsesInboxHelper = exports.codeUsesTestInboxIdentity = exports.codeSelfProvisionsRegistration = exports.executeGrokPerBatchHeal = exports.executeGrokPerTestHeal = exports.headerVal = exports.classifyAuthType = exports.isTextExcerptable = exports.isStaticAssetByExt = exports.isApiCall = exports.buildApiCallSummary = exports.computeMobileHealOutcome = exports.detectMobileStepSecretLeak = exports.redactMobileSecretsFromText = exports.MOBILE_LIVE_HEAL_SYSTEM_PROMPT = exports.MOBILE_SCRIPT_HEAL_SYSTEM_PROMPT = exports.executeMobileLiveHeal = exports.executeMobileTestWithHealing = exports.executeMobileScriptDrivenHeal = exports.prepareMobileScenarioAppState = exports.runMobileGeneratePhase = exports.runMobileAIPlanner = exports.buildMobileSiteMap = exports.formatMobileEvidenceForPlanner = exports.MOBILE_SCENARIO_SYSTEM_PROMPT = exports.MOBILE_SURVEY_SYSTEM_PROMPT = exports.runMobileExplorePhase = void 0;
+    exports.MAX_MANIFEST_FILES = exports.toDiffSummary = exports.isLikelyTestFile = exports.sanitizeRepoRelPath = exports.sha256Hex = exports.hashFiles = exports.enumerateTestFiles = exports.buildNextManifest = exports.detectRepoSwitch = exports.classifyImportDiff = exports.parseImportManifest = exports.validateAuthoredMobileTest = exports.buildMobileRepoAuthorSystemRules = exports.buildMobileRepoAuthorKickoff = exports.buildMobileRepoAuthorContractMd = exports.REPO_ANALYSIS_SCHEMA_VERSION = exports.validateSourceEndpoints = exports.validateAuthoredTest = exports.validateRepoMapFile = exports.validateRepoMemoryFile = exports.buildTestingStandardsSection = exports.buildRepoAuthorSystemRules = exports.buildRepoAuthorKickoff = exports.buildRepoAuthorContractMd = exports.buildRepoMapSystemRules = exports.buildRepoMapKickoff = exports.buildRepoMapContractMd = exports.buildRepoMemorySystemRules = exports.buildRepoMemoryKickoff = exports.buildRepoMemoryContractMd = exports.runRepoAnalysisOnRunner = exports.MOBILE_IMPORT_SCHEMA_VERSION = exports.validateImportedMobileTest = exports.buildMobileImportSystemRules = exports.buildMobileImportKickoff = exports.buildMobileImportContractMd = exports.IMPORT_SCHEMA_VERSION = exports.validateImportResultFile = exports.validateImportedTest = exports.buildImportSystemRules = exports.buildImportKickoff = exports.buildImportContractMd = exports.MAX_ARCHIVE_BYTES = exports.isUnsafeEntryName = exports.extractZipSafely = exports.downloadArchiveCapped = exports.detectArchiveKind = exports.acquireRepoForImport = exports.runFrameworkImportOnRunner = exports.getAgenticEngine = void 0;
+    exports.UNSUPPORTED_RENDERER_PREFIX = exports.UnsupportedRendererError = exports.buildCanvasModeAuthoringAddendum = exports.buildUnsupportedRendererMessage = exports.modelSupportsVision = exports.decideCanvasStrategy = exports.decideAppRenderType = exports.detectCanvasApp = exports.detectRateLimitBlock = exports.isSafeCanonicalRedirect = exports.resolveBaseUrlPreflight = exports.checkBaseUrlRedirect = exports.stripJsonFences = exports.scrubCredentials = exports.withAIRetry = exports.snapshotMatchingChildren = exports.findNewChromiumChildPid = exports.killProcessTree = exports.gracefulCloseWithTreeKill = exports.liveBrowserRegistry = exports.REPO_SWITCH_REMOVED_FRACTION = void 0;
     __exportStar(require_ai_provider(), exports);
     __exportStar(require_mobile_types(), exports);
     __exportStar(require_mobile_source_parser(), exports);
@@ -349980,6 +350048,16 @@ var require_dist2 = __commonJS({
       return grok_batch_healer_js_1.executeGrokPerBatchHeal;
     } });
     __exportStar(require_playwright_code(), exports);
+    var inbox_stamp_js_1 = require_inbox_stamp();
+    Object.defineProperty(exports, "codeSelfProvisionsRegistration", { enumerable: true, get: function() {
+      return inbox_stamp_js_1.codeSelfProvisionsRegistration;
+    } });
+    Object.defineProperty(exports, "codeUsesTestInboxIdentity", { enumerable: true, get: function() {
+      return inbox_stamp_js_1.codeUsesTestInboxIdentity;
+    } });
+    Object.defineProperty(exports, "codeUsesInboxHelper", { enumerable: true, get: function() {
+      return inbox_stamp_js_1.codeUsesInboxHelper;
+    } });
     __exportStar(require_playwright_native(), exports);
     __exportStar(require_regression_runner(), exports);
     __exportStar(require_snapshot_parser(), exports);
@@ -350309,7 +350387,7 @@ var require_package4 = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.58",
+      version: "1.0.59",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"
@@ -357941,7 +358019,8 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
           const codeUsesCreds = codeProvided && /TEST_USER_EMAIL|TEST_USER_PASSWORD|__vqaLogin/.test(code);
           const tags = Array.isArray(run2.tags) ? run2.tags : [];
           const isHallucinationShape = codeProvided && !codeUsesCreds && tags.includes("@inline-login") && !tags.includes("@api");
-          const requireCreds = authPlan.needsLoginCreds && !legacyHeaderBypass && !isHallucinationShape;
+          const selfProvisioningRegisterTest = codeProvided && !codeUsesCreds && tags.includes("@email-verify") && (0, import_runner_core13.codeSelfProvisionsRegistration)(code);
+          const requireCreds = authPlan.needsLoginCreds && !legacyHeaderBypass && !isHallucinationShape && !selfProvisioningRegisterTest;
           if (requireCreds && !run2.testVariables?.["TEST_USER_EMAIL"]?.trim()) {
             preflightError = "Pre-flight failed: Missing TEST_USER_EMAIL. Tests that log in (tagged @auth, @needs-auth, @api, @auth-cookie-state, @auth-login-cookie, or @auth-login-bearer) require login credentials.";
           } else if (requireCreds && !run2.testVariables?.["TEST_USER_PASSWORD"]?.trim()) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@validate.qa/runner",
-  "version": "1.0.58",
+  "version": "1.0.59",
   "description": "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
   "bin": {
     "validate-runner": "dist/cli.js"