@validate.qa/runner 1.0.60 → 1.0.61

package/dist/cli.js

@@ -2236,6 +2236,16 @@ function selectorForValue(value) {
 function isIdentityMobileXpath(value) {
   return /@[A-Za-z_:][-A-Za-z0-9_:.]*\s*=/.test(value) && !/(?:contains|starts-with)\s*\(/i.test(value);
 }
+function mobileLocatorBundleHasIdentity(bundle) {
+  if (!bundle)
+    return false;
+  if (nonEmpty(bundle.accessibilityId) || nonEmpty(bundle.resourceId))
+    return true;
+  if (nonEmpty(bundle.text) || nonEmpty(bundle.contentDesc))
+    return true;
+  const xpath = nonEmpty(bundle.xpath);
+  return !!xpath && isIdentityMobileXpath(xpath);
+}
 function selectorCandidatesForStep(step) {
   const target = step.target;
   if (!target)
@@ -2571,7 +2581,7 @@ function generateMobileTestFromSession(input) {
   const warnings = [];
   const unrunnable = interactionSteps.length - runnableInteractions.length;
   if (unrunnable > 0) {
-    warnings.push(`${unrunnable} recorded step(s) could not be turned into a runnable action (missing locator/coordinate) and were kept best-effort.`);
+    warnings.push(`${unrunnable} recorded step(s) could not be turned into a runnable action (missing a replayable identity locator or coordinate) and were kept best-effort.`);
   }
   const locatorCoverage = interactionSteps.filter((step) => step.target?.primary).length;
   const assertionCoverage = steps.filter((step) => step.action === "assertVisible" || step.action === "assertText").length;
@@ -2600,10 +2610,29 @@ function generateMobileTestFromSession(input) {
     warnings
   };
 }
+function isGateStepResolvable(step) {
+  const metadata = step.metadata;
+  if (metadata?.appContext === "WEBVIEW") {
+    return selectorCandidatesForStep(step).length > 0;
+  }
+  const target = step.target;
+  if (!target)
+    return false;
+  if (mobileLocatorBundleHasIdentity(target.locatorBundle))
+    return true;
+  return [target.primary, ...target.fallbacks ?? []].some((value) => {
+    const trimmed = nonEmpty(value);
+    if (!trimmed || trimmed.startsWith("css="))
+      return false;
+    if (trimmed.startsWith("/") || trimmed.startsWith("(//"))
+      return isIdentityMobileXpath(trimmed);
+    return true;
+  });
+}
 function isRunnableStep(step) {
   const bounds = step.metadata?.bounds;
   const hasCoord = !!bounds && [bounds.x, bounds.y].every((n) => typeof n === "number" && Number.isFinite(n));
-  const hasLocator = !!nonEmpty(step.target?.primary);
+  const hasExecutableLocator = selectorCandidatesForStep(step).length > 0;
   switch (step.action) {
     case "launchApp":
     case "back":
@@ -2613,18 +2642,18 @@ function isRunnableStep(step) {
       return true;
     case "tap":
     case "clear":
-      return hasLocator || hasCoord;
+      return hasExecutableLocator || hasCoord;
     case "type": {
       const keyboardSubmitOnly = typeof step.value === "string" && /^[\r\n]+$/.test(step.value);
       if (keyboardSubmitOnly)
         return true;
-      return (hasLocator || hasCoord) && !!nonEmpty(step.value ?? void 0);
+      return (hasExecutableLocator || hasCoord) && !!nonEmpty(step.value ?? void 0);
     }
     case "waitForElement":
     case "assertVisible":
-      return hasLocator;
+      return isGateStepResolvable(step);
     case "assertText":
-      return hasLocator && !!nonEmpty(step.assertion ?? void 0);
+      return isGateStepResolvable(step) && !!nonEmpty(step.assertion ?? void 0);
     default:
       return false;
   }
@@ -5897,6 +5926,7 @@ __export(dist_exports, {
   jwtExpiryMs: () => jwtExpiryMs,
   mediumForMobilePlatform: () => mediumForMobilePlatform,
   mobileCredentialPlaceholder: () => mobileCredentialPlaceholder,
+  mobileLocatorBundleHasIdentity: () => mobileLocatorBundleHasIdentity,
   mobilePlatformFromMedium: () => mobilePlatformFromMedium,
   normalizeControlName: () => normalizeControlName,
   normalizeTtsVoiceId: () => normalizeTtsVoiceId,
@@ -78263,6 +78293,12 @@ ${creds.join(", ")}`);
 A verified login recipe EXISTS for this app \u2014 the harness automatically signs in (and asserts the signed-in state) before every authenticated test. This SUPERSEDES the "all tests start from the landing page and sign in" rule for the non-auth-flow scenarios described here.
 For a scenario that REQUIRES an authenticated session but is NOT itself exercising the authentication / session lifecycle, you MAY assume the test begins ALREADY SIGNED IN at ${startRoute}. Do NOT author sign-in navigation, sign-in clicks, or credential-entry steps for it \u2014 begin at the first real feature action. BUT if the feature is not already on ${startRoute}, DO still include the in-app navigation from the signed-in landing to the feature page.
 Plan these LOGGED-OUT instead (keep their own establishment steps; do NOT assume a session): any scenario that exercises the auth / session / account-access lifecycle itself \u2014 signing in, signing up / registration, password reset, email / OTP / MFA / 2FA verification, SSO or magic-link sign-in, re-authentication, and SIGNING OUT (which starts signed-in and ends signed-out). Also plan logged-out any journey whose first steps must run without a session (e.g. "register a new account, then use it" \u2014 keep the registration steps).`);
+      }
+      if (context.emailVerifyArmed) {
+        sections.push(`## Verification Inbox Available (runtime email capability)
+This runner CAN read THIS test's verification email at runtime \u2014 a one-time code AND a verification link \u2014 for a fresh throwaway account the harness registers per run. That lets a SIGN-UP email-verification flow RUN TO COMPLETION instead of stopping at the "enter the code" / "check your email" screen (a survey has no inbox, so exploration could only reach that screen). Plan it as a HAPPY_PATH:
+- Sign-up + email verification: register a brand-new account, RETRIEVE the emailed code or link, and submit/open it to complete verification.
+Write "retrieve the emailed code / open the emailed link" as an ordinary plain-language step; the generator supplies the runtime mechanism. This is an exception to Rule 1 ONLY for the ACTION of completing the email step \u2014 it does NOT license inventing an outcome. For the durable assertion, Rule 12 still governs: assert only the post-verification result the evidence supports \u2014 a specific observed control, a confirmation message the explorer actually saw, or a STRUCTURAL signal (the verification screen is replaced, the URL leaves the verify route, the login form is no longer shown). If no concrete signed-in signal was observed, assert the observed transition and NAME the missing signal as a coverage gap in reasoning \u2014 do NOT fabricate a Logout/account control exploration never saw (this app may land on a login page or a confirmation page after verifying, not a signed-in dashboard). Keep it LOGGED-OUT with its own registration steps, and still plan the sign-up / verification negative cases the EVIDENCE supports (e.g. an already-registered email, or an invalid / mismatched verification code) as separate scenarios.`);
       }
       sections.push(`## Constraints
 - Test budget: ${context.testBudget} scenarios maximum`);
@@ -94874,6 +94910,7 @@ var require_discover_generator = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.MIN_BUG_DESCRIPTION_LENGTH = exports2.VALID_PLAYWRIGHT_GETBY_METHODS = exports2.BLOCKED_MCP_TOOLS_SCENARIO_GEN = void 0;
+    exports2.scenarioLooksLikeRegistration = scenarioLooksLikeRegistration;
     exports2.filterMcpToolsForScenarioGen = filterMcpToolsForScenarioGen;
     exports2.detectScenarioSignals = detectScenarioSignals;
     exports2.scenarioStepsCoverAuth = scenarioStepsCoverAuth;
@@ -94886,6 +94923,7 @@ var require_discover_generator = __commonJS({
     exports2.stripImportDeclarations = stripImportDeclarations;
     exports2.stripStringsAndComments = stripStringsAndComments;
     exports2.gotoBasePathFromBaseUrl = gotoBasePathFromBaseUrl;
+    exports2.repairInboxHelperScalarDestructure = repairInboxHelperScalarDestructure;
     exports2.sanitizeCode = sanitizeCode;
     exports2.validateTests = validateTests;
     exports2.formatEvidenceForLiveGenerate = formatEvidenceForLiveGenerate;
@@ -94932,7 +94970,8 @@ var require_discover_generator = __commonJS({
     var test_inbox_broker_js_1 = require_test_inbox_broker();
     var REGISTER_SCENARIO_RE = /\b(register|registration|sign[\s-]?up|create[\s-]?(a[n]?[\s-]?)?(new[\s-]?)?account|verify[\s-]?(your[\s-]?)?email|email[\s-]?verification|confirm[\s-]?(your[\s-]?)?(email|account)|activate[\s-]?(your[\s-]?)?account|new[\s-]?account)\b/i;
     function scenarioLooksLikeRegistration(scenario) {
-      const hay = `${scenario.name ?? ""} ${scenario.goal ?? ""} ${scenario.description ?? ""} ${scenario.entryRoute ?? ""} ${(scenario.targetPages ?? []).join(" ")}`;
+      const stepText = (scenario.steps ?? []).map((s) => `${s?.action ?? ""} ${s?.target ?? ""}`).join(" ");
+      const hay = `${scenario.name ?? ""} ${scenario.goal ?? ""} ${scenario.description ?? ""} ${scenario.entryRoute ?? ""} ${(scenario.targetPages ?? []).join(" ")} ${stepText}`;
       return REGISTER_SCENARIO_RE.test(hay);
     }
     function buildEmailVerifyGenBlock(genEmail, genPassword) {
@@ -94955,6 +94994,7 @@ EMIT (the code you put in finish_generate) \u2014 do NOT hardcode the throwaway
   - code flow:  \`const code = await __vqaWaitForEmail('code');\`  then type \`code\` into the verification field.
   - link flow:  \`const link = await __vqaWaitForEmail('link');\`  then \`await page.goto(link);\`.
   - if unsure: \`const email = await __vqaWaitForEmail();\` returns \`{ code, link, subject, from }\`.
+  - IMPORTANT: \`__vqaWaitForEmail('code')\` returns the code STRING (and \`('link')\` the link string) \u2014 assign it directly with \`const code = \u2026\`. Do NOT destructure the scalar form (\`const { code } = await __vqaWaitForEmail('code')\` binds \`undefined\`, so \`code.split(...)\` then crashes). ONLY the no-arg \`__vqaWaitForEmail()\` returns an object you can destructure.
 - Tag the test \`@email-verify\`. Emit EXACTLY ONE test() in this file (one registration per run).
 - End with a DURABLE assertion of the post-verification signed-in state (e.g. a Logout control, an account/dashboard landmark) in your OWN test body \u2014 the helper call is not itself a proof.`;
     }
@@ -96054,6 +96094,200 @@ ${elementContext}${formContext}${observationContext}${interactionContext}${lowCo
         return void 0;
       }
     }
+    function literalPositionMask(code) {
+      const n = code.length;
+      const mask = new Array(n).fill(false);
+      const REGEX_PRECEDING = /[(,=;{}\[!&|?:+\-*%~^<>]$/;
+      const REGEX_PRECEDING_KEYWORD = /\b(?:return|typeof|void|delete|in|of|new|instanceof|throw|await|yield|case)\s*$/;
+      let i = 0;
+      let codeSoFar = "";
+      const isRegexContext = () => {
+        const trimmed = codeSoFar.replace(/\s+$/, "");
+        if (trimmed.length === 0)
+          return true;
+        if (REGEX_PRECEDING.test(trimmed))
+          return true;
+        if (REGEX_PRECEDING_KEYWORD.test(trimmed))
+          return true;
+        if (trimmed.endsWith("=>"))
+          return true;
+        return false;
+      };
+      const scanRegex = () => {
+        i += 1;
+        let inClass = false;
+        while (i < n) {
+          if (code[i] === "\\") {
+            mask[i] = true;
+            if (i + 1 < n)
+              mask[i + 1] = true;
+            i += 2;
+            continue;
+          }
+          if (code[i] === "[") {
+            inClass = true;
+            mask[i] = true;
+            i += 1;
+            continue;
+          }
+          if (code[i] === "]") {
+            inClass = false;
+            mask[i] = true;
+            i += 1;
+            continue;
+          }
+          if (code[i] === "/" && !inClass) {
+            i += 1;
+            break;
+          }
+          if (code[i] === "\n")
+            break;
+          mask[i] = true;
+          i += 1;
+        }
+        while (i < n && /[gimsuydv]/.test(code[i]))
+          i += 1;
+      };
+      const scanQuoted = (quote) => {
+        i += 1;
+        while (i < n) {
+          if (code[i] === "\\") {
+            if (code[i + 1] === "\r" && code[i + 2] === "\n") {
+              mask[i] = true;
+              mask[i + 1] = true;
+              mask[i + 2] = true;
+              i += 3;
+              continue;
+            }
+            mask[i] = true;
+            if (i + 1 < n)
+              mask[i + 1] = true;
+            i += 2;
+            continue;
+          }
+          if (code[i] === quote) {
+            i += 1;
+            break;
+          }
+          if (code[i] === "\n")
+            break;
+          mask[i] = true;
+          i += 1;
+        }
+      };
+      const scanTemplate = () => {
+        while (i < n) {
+          if (code[i] === "\\") {
+            mask[i] = true;
+            if (i + 1 < n)
+              mask[i + 1] = true;
+            i += 2;
+            continue;
+          }
+          if (code[i] === "`") {
+            i += 1;
+            break;
+          }
+          if (code[i] === "$" && code[i + 1] === "{") {
+            i += 2;
+            const savedCodeSoFar = codeSoFar;
+            codeSoFar = "";
+            scanCode(true);
+            codeSoFar = savedCodeSoFar;
+            continue;
+          }
+          mask[i] = true;
+          i += 1;
+        }
+      };
+      function scanCode(stopAtCloseBrace) {
+        let depth = 0;
+        while (i < n) {
+          const c = code[i];
+          const next = i + 1 < n ? code[i + 1] : "";
+          if (stopAtCloseBrace) {
+            if (c === "}" && depth === 0) {
+              i += 1;
+              return;
+            }
+            if (c === "{") {
+              depth += 1;
+              codeSoFar += c;
+              i += 1;
+              continue;
+            }
+            if (c === "}") {
+              depth -= 1;
+              codeSoFar += c;
+              i += 1;
+              continue;
+            }
+          }
+          if (c === "/" && next === "*") {
+            const end = code.indexOf("*/", i + 2);
+            const stop = end < 0 ? n : end + 2;
+            for (let j = i; j < stop; j++)
+              mask[j] = true;
+            i = stop;
+            continue;
+          }
+          if (c === "/" && next === "/") {
+            const end = code.indexOf("\n", i + 2);
+            const stop = end < 0 ? n : end;
+            for (let j = i; j < stop; j++)
+              mask[j] = true;
+            i = stop;
+            continue;
+          }
+          if (c === "/" && isRegexContext()) {
+            scanRegex();
+            codeSoFar += "x";
+            continue;
+          }
+          if (c === "`") {
+            i += 1;
+            scanTemplate();
+            codeSoFar += "x";
+            continue;
+          }
+          if (c === '"' || c === "'") {
+            scanQuoted(c);
+            codeSoFar += "x";
+            continue;
+          }
+          codeSoFar += c;
+          i += 1;
+        }
+      }
+      scanCode(false);
+      return mask;
+    }
+    function atLineStart(code, start) {
+      let j = start - 1;
+      while (j >= 0 && (code[j] === " " || code[j] === "	"))
+        j--;
+      return j < 0 || code[j] === "\n" || code[j] === "\r";
+    }
+    function repairInboxHelperScalarDestructure(code) {
+      if (!code || code.indexOf("__vqaWaitForEmail") === -1)
+        return code;
+      const inLiteral = literalPositionMask(code);
+      const re = /\b(const|let|var)\s*\{\s*([A-Za-z_$][\w$]*)\s*(?::\s*([A-Za-z_$][\w$]*)\s*)?\}\s*=\s*await\s+__vqaWaitForEmail\s*\(\s*(['"`])(code|link)\4\s*\)/g;
+      let out = "";
+      let last = 0;
+      let m;
+      while ((m = re.exec(code)) !== null) {
+        const [full, decl, prop, alias, quote, kind] = m;
+        const start = m.index;
+        if (inLiteral[start] || !atLineStart(code, start) || prop !== kind)
+          continue;
+        out += code.slice(last, start);
+        out += `${decl} ${alias || prop} = await __vqaWaitForEmail(${quote}${kind}${quote})`;
+        last = start + full.length;
+      }
+      out += code.slice(last);
+      return out;
+    }
     function sanitizeCode(code, options) {
       let result = code;
       const isNetworkIdleWaitLine = (line) => /^\s*await page\.waitForLoadState\((['"])networkidle\1\);\s*$/.test(line);
@@ -96144,6 +96378,7 @@ ${testOpen}`;
       if (options?.authStamp) {
         result = (0, auth_recipe_js_1.upsertAuthBlock)(result, options.authStamp);
       }
+      result = repairInboxHelperScalarDestructure(result);
       try {
         result = (0, inbox_stamp_js_1.upsertInboxBlock)(result);
       } catch {
@@ -334605,6 +334840,8 @@ var require_discover_agent = __commonJS({
     var discover_planner_js_1 = require_discover_planner();
     var discover_generator_js_1 = require_discover_generator();
     var discover_ai_planner_js_1 = require_discover_ai_planner();
+    var discovery_lint_flags_js_1 = require_discovery_lint_flags();
+    var verification_inbox_js_1 = require_verification_inbox();
     var sitemap_builder_js_1 = require_sitemap_builder();
     Object.defineProperty(exports2, "buildInMemorySiteMap", { enumerable: true, get: function() {
       return sitemap_builder_js_1.buildInMemorySiteMap;
@@ -334617,6 +334854,13 @@ var require_discover_agent = __commonJS({
     var agentic_cli_constants_js_1 = require_agentic_cli_constants();
     var canvas_detector_js_1 = require_canvas_detector();
     var auth_recipe_js_1 = require_auth_recipe();
+    function plannerEmailVerifyArmed(ctx) {
+      if (!(0, discovery_lint_flags_js_1.isTestgenEmailVerifyEnabled)())
+        return false;
+      if (ctx.variableContext?.allTestVariables?.DISCOVERY_SHOULD_REGISTER !== "true")
+        return false;
+      return (0, verification_inbox_js_1.isVerificationInboxConfigured)();
+    }
     async function runCanvasPreflight(ctx, sharedBrowser, log2) {
       const cached = ctx.appRenderType ?? null;
       const engine = (0, agentic_cli_constants_js_1.getAgenticEngine)(ctx.exploreModel);
@@ -335265,6 +335509,9 @@ Explore complete: ${exploreResult.pagesDiscovered} pages, ${exploreResult.elemen
           // instead of authoring landing→login steps (which generate would override).
           authRecipeAvailable: (0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP) && !!ctx.authRecipe,
           authRedirectRoute: (0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP) ? ctx.authRecipe?.redirectRoute ?? void 0 : void 0,
+          // Email-verify capability — only for scenario-producing modes; a survey emits
+          // featureGroups (no scenarios), so keep its prompt free of the round-trip block.
+          emailVerifyArmed: mode !== "survey" && plannerEmailVerifyArmed(ctx),
           testBudget
         }, {
           modelOverride: ctx.planModel ?? ctx.generateModel,
@@ -335849,6 +336096,12 @@ Plan (reused): ${resumeSavedScenarios.length} scenarios from the paused run.`);
             // authenticated state when a verified login recipe is on file for this project.
             authRecipeAvailable: (0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP) && !!ctx.authRecipe,
             authRedirectRoute: (0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP) ? ctx.authRecipe?.redirectRoute ?? void 0 : void 0,
+            // Email-verify capability: when armed, let the planner plan the full
+            // register→verify and forgot-password→reset round trips to completion
+            // (see the planner's "## Verification Inbox Available" block). Armed on the
+            // SAME project-level predicate the generator uses (flag + register intent +
+            // configured inbox), so the planner never promises what generation can't do.
+            emailVerifyArmed: plannerEmailVerifyArmed(ctx),
             testBudget: featureTestBudget
           }, {
             modelOverride: ctx.planModel ?? ctx.generateModel,
@@ -350474,7 +350727,7 @@ var require_package4 = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.60",
+      version: "1.0.61",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"
@@ -355554,7 +355807,13 @@ async function handleHealth(_req, res) {
     },
     devices,
     capabilities,
-    activeSession: state.appiumSessionId
+    activeSession: state.appiumSessionId,
+    // THIS runner's Appium is executing mobile (APPIUM) test run(s) right now.
+    // The web pre-flight reads this to warn before /bridge/session/start would
+    // 409 — it must never be inferred from server-side global run counts, which
+    // include unrelated projects and runners.
+    executorBusy: executorBusyCount > 0,
+    recordingActive: !!state.appiumSessionId && mirrorSessionOwner === "recording"
   });
 }
 function realDeviceCapabilities2(platform3) {
@@ -355629,7 +355888,11 @@ function validateSessionStartBody(body) {
 }
 async function handleDevices(_req, res) {
   const devices = discoverAllDevices({ includeApps: true });
-  sendJSON(res, 200, { devices });
+  sendJSON(res, 200, {
+    devices,
+    executorBusy: executorBusyCount > 0,
+    recordingActive: !!state.appiumSessionId && mirrorSessionOwner === "recording"
+  });
 }
 async function handleSessionStart(req, res) {
   const body = await parseBody(req);

package/dist/cli.mjs

@@ -2241,6 +2241,16 @@ function selectorForValue(value) {
 function isIdentityMobileXpath(value) {
   return /@[A-Za-z_:][-A-Za-z0-9_:.]*\s*=/.test(value) && !/(?:contains|starts-with)\s*\(/i.test(value);
 }
+function mobileLocatorBundleHasIdentity(bundle) {
+  if (!bundle)
+    return false;
+  if (nonEmpty(bundle.accessibilityId) || nonEmpty(bundle.resourceId))
+    return true;
+  if (nonEmpty(bundle.text) || nonEmpty(bundle.contentDesc))
+    return true;
+  const xpath = nonEmpty(bundle.xpath);
+  return !!xpath && isIdentityMobileXpath(xpath);
+}
 function selectorCandidatesForStep(step) {
   const target = step.target;
   if (!target)
@@ -2576,7 +2586,7 @@ function generateMobileTestFromSession(input) {
   const warnings = [];
   const unrunnable = interactionSteps.length - runnableInteractions.length;
   if (unrunnable > 0) {
-    warnings.push(`${unrunnable} recorded step(s) could not be turned into a runnable action (missing locator/coordinate) and were kept best-effort.`);
+    warnings.push(`${unrunnable} recorded step(s) could not be turned into a runnable action (missing a replayable identity locator or coordinate) and were kept best-effort.`);
   }
   const locatorCoverage = interactionSteps.filter((step) => step.target?.primary).length;
   const assertionCoverage = steps.filter((step) => step.action === "assertVisible" || step.action === "assertText").length;
@@ -2605,10 +2615,29 @@ function generateMobileTestFromSession(input) {
     warnings
   };
 }
+function isGateStepResolvable(step) {
+  const metadata = step.metadata;
+  if (metadata?.appContext === "WEBVIEW") {
+    return selectorCandidatesForStep(step).length > 0;
+  }
+  const target = step.target;
+  if (!target)
+    return false;
+  if (mobileLocatorBundleHasIdentity(target.locatorBundle))
+    return true;
+  return [target.primary, ...target.fallbacks ?? []].some((value) => {
+    const trimmed = nonEmpty(value);
+    if (!trimmed || trimmed.startsWith("css="))
+      return false;
+    if (trimmed.startsWith("/") || trimmed.startsWith("(//"))
+      return isIdentityMobileXpath(trimmed);
+    return true;
+  });
+}
 function isRunnableStep(step) {
   const bounds = step.metadata?.bounds;
   const hasCoord = !!bounds && [bounds.x, bounds.y].every((n) => typeof n === "number" && Number.isFinite(n));
-  const hasLocator = !!nonEmpty(step.target?.primary);
+  const hasExecutableLocator = selectorCandidatesForStep(step).length > 0;
   switch (step.action) {
     case "launchApp":
     case "back":
@@ -2618,18 +2647,18 @@ function isRunnableStep(step) {
       return true;
     case "tap":
     case "clear":
-      return hasLocator || hasCoord;
+      return hasExecutableLocator || hasCoord;
     case "type": {
       const keyboardSubmitOnly = typeof step.value === "string" && /^[\r\n]+$/.test(step.value);
       if (keyboardSubmitOnly)
         return true;
-      return (hasLocator || hasCoord) && !!nonEmpty(step.value ?? void 0);
+      return (hasExecutableLocator || hasCoord) && !!nonEmpty(step.value ?? void 0);
     }
     case "waitForElement":
     case "assertVisible":
-      return hasLocator;
+      return isGateStepResolvable(step);
     case "assertText":
-      return hasLocator && !!nonEmpty(step.assertion ?? void 0);
+      return isGateStepResolvable(step) && !!nonEmpty(step.assertion ?? void 0);
     default:
       return false;
   }
@@ -5902,6 +5931,7 @@ __export(dist_exports, {
   jwtExpiryMs: () => jwtExpiryMs,
   mediumForMobilePlatform: () => mediumForMobilePlatform,
   mobileCredentialPlaceholder: () => mobileCredentialPlaceholder,
+  mobileLocatorBundleHasIdentity: () => mobileLocatorBundleHasIdentity,
   mobilePlatformFromMedium: () => mobilePlatformFromMedium,
   normalizeControlName: () => normalizeControlName,
   normalizeTtsVoiceId: () => normalizeTtsVoiceId,
@@ -78268,6 +78298,12 @@ ${creds.join(", ")}`);
 A verified login recipe EXISTS for this app \u2014 the harness automatically signs in (and asserts the signed-in state) before every authenticated test. This SUPERSEDES the "all tests start from the landing page and sign in" rule for the non-auth-flow scenarios described here.
 For a scenario that REQUIRES an authenticated session but is NOT itself exercising the authentication / session lifecycle, you MAY assume the test begins ALREADY SIGNED IN at ${startRoute}. Do NOT author sign-in navigation, sign-in clicks, or credential-entry steps for it \u2014 begin at the first real feature action. BUT if the feature is not already on ${startRoute}, DO still include the in-app navigation from the signed-in landing to the feature page.
 Plan these LOGGED-OUT instead (keep their own establishment steps; do NOT assume a session): any scenario that exercises the auth / session / account-access lifecycle itself \u2014 signing in, signing up / registration, password reset, email / OTP / MFA / 2FA verification, SSO or magic-link sign-in, re-authentication, and SIGNING OUT (which starts signed-in and ends signed-out). Also plan logged-out any journey whose first steps must run without a session (e.g. "register a new account, then use it" \u2014 keep the registration steps).`);
+      }
+      if (context.emailVerifyArmed) {
+        sections.push(`## Verification Inbox Available (runtime email capability)
+This runner CAN read THIS test's verification email at runtime \u2014 a one-time code AND a verification link \u2014 for a fresh throwaway account the harness registers per run. That lets a SIGN-UP email-verification flow RUN TO COMPLETION instead of stopping at the "enter the code" / "check your email" screen (a survey has no inbox, so exploration could only reach that screen). Plan it as a HAPPY_PATH:
+- Sign-up + email verification: register a brand-new account, RETRIEVE the emailed code or link, and submit/open it to complete verification.
+Write "retrieve the emailed code / open the emailed link" as an ordinary plain-language step; the generator supplies the runtime mechanism. This is an exception to Rule 1 ONLY for the ACTION of completing the email step \u2014 it does NOT license inventing an outcome. For the durable assertion, Rule 12 still governs: assert only the post-verification result the evidence supports \u2014 a specific observed control, a confirmation message the explorer actually saw, or a STRUCTURAL signal (the verification screen is replaced, the URL leaves the verify route, the login form is no longer shown). If no concrete signed-in signal was observed, assert the observed transition and NAME the missing signal as a coverage gap in reasoning \u2014 do NOT fabricate a Logout/account control exploration never saw (this app may land on a login page or a confirmation page after verifying, not a signed-in dashboard). Keep it LOGGED-OUT with its own registration steps, and still plan the sign-up / verification negative cases the EVIDENCE supports (e.g. an already-registered email, or an invalid / mismatched verification code) as separate scenarios.`);
       }
       sections.push(`## Constraints
 - Test budget: ${context.testBudget} scenarios maximum`);
@@ -94879,6 +94915,7 @@ var require_discover_generator = __commonJS({
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.MIN_BUG_DESCRIPTION_LENGTH = exports.VALID_PLAYWRIGHT_GETBY_METHODS = exports.BLOCKED_MCP_TOOLS_SCENARIO_GEN = void 0;
+    exports.scenarioLooksLikeRegistration = scenarioLooksLikeRegistration;
     exports.filterMcpToolsForScenarioGen = filterMcpToolsForScenarioGen;
     exports.detectScenarioSignals = detectScenarioSignals;
     exports.scenarioStepsCoverAuth = scenarioStepsCoverAuth;
@@ -94891,6 +94928,7 @@ var require_discover_generator = __commonJS({
     exports.stripImportDeclarations = stripImportDeclarations;
     exports.stripStringsAndComments = stripStringsAndComments;
     exports.gotoBasePathFromBaseUrl = gotoBasePathFromBaseUrl;
+    exports.repairInboxHelperScalarDestructure = repairInboxHelperScalarDestructure;
     exports.sanitizeCode = sanitizeCode;
     exports.validateTests = validateTests;
     exports.formatEvidenceForLiveGenerate = formatEvidenceForLiveGenerate;
@@ -94937,7 +94975,8 @@ var require_discover_generator = __commonJS({
     var test_inbox_broker_js_1 = require_test_inbox_broker();
     var REGISTER_SCENARIO_RE = /\b(register|registration|sign[\s-]?up|create[\s-]?(a[n]?[\s-]?)?(new[\s-]?)?account|verify[\s-]?(your[\s-]?)?email|email[\s-]?verification|confirm[\s-]?(your[\s-]?)?(email|account)|activate[\s-]?(your[\s-]?)?account|new[\s-]?account)\b/i;
     function scenarioLooksLikeRegistration(scenario) {
-      const hay = `${scenario.name ?? ""} ${scenario.goal ?? ""} ${scenario.description ?? ""} ${scenario.entryRoute ?? ""} ${(scenario.targetPages ?? []).join(" ")}`;
+      const stepText = (scenario.steps ?? []).map((s) => `${s?.action ?? ""} ${s?.target ?? ""}`).join(" ");
+      const hay = `${scenario.name ?? ""} ${scenario.goal ?? ""} ${scenario.description ?? ""} ${scenario.entryRoute ?? ""} ${(scenario.targetPages ?? []).join(" ")} ${stepText}`;
       return REGISTER_SCENARIO_RE.test(hay);
     }
     function buildEmailVerifyGenBlock(genEmail, genPassword) {
@@ -94960,6 +94999,7 @@ EMIT (the code you put in finish_generate) \u2014 do NOT hardcode the throwaway
   - code flow:  \`const code = await __vqaWaitForEmail('code');\`  then type \`code\` into the verification field.
   - link flow:  \`const link = await __vqaWaitForEmail('link');\`  then \`await page.goto(link);\`.
   - if unsure: \`const email = await __vqaWaitForEmail();\` returns \`{ code, link, subject, from }\`.
+  - IMPORTANT: \`__vqaWaitForEmail('code')\` returns the code STRING (and \`('link')\` the link string) \u2014 assign it directly with \`const code = \u2026\`. Do NOT destructure the scalar form (\`const { code } = await __vqaWaitForEmail('code')\` binds \`undefined\`, so \`code.split(...)\` then crashes). ONLY the no-arg \`__vqaWaitForEmail()\` returns an object you can destructure.
 - Tag the test \`@email-verify\`. Emit EXACTLY ONE test() in this file (one registration per run).
 - End with a DURABLE assertion of the post-verification signed-in state (e.g. a Logout control, an account/dashboard landmark) in your OWN test body \u2014 the helper call is not itself a proof.`;
     }
@@ -96059,6 +96099,200 @@ ${elementContext}${formContext}${observationContext}${interactionContext}${lowCo
         return void 0;
       }
     }
+    function literalPositionMask(code) {
+      const n = code.length;
+      const mask = new Array(n).fill(false);
+      const REGEX_PRECEDING = /[(,=;{}\[!&|?:+\-*%~^<>]$/;
+      const REGEX_PRECEDING_KEYWORD = /\b(?:return|typeof|void|delete|in|of|new|instanceof|throw|await|yield|case)\s*$/;
+      let i = 0;
+      let codeSoFar = "";
+      const isRegexContext = () => {
+        const trimmed = codeSoFar.replace(/\s+$/, "");
+        if (trimmed.length === 0)
+          return true;
+        if (REGEX_PRECEDING.test(trimmed))
+          return true;
+        if (REGEX_PRECEDING_KEYWORD.test(trimmed))
+          return true;
+        if (trimmed.endsWith("=>"))
+          return true;
+        return false;
+      };
+      const scanRegex = () => {
+        i += 1;
+        let inClass = false;
+        while (i < n) {
+          if (code[i] === "\\") {
+            mask[i] = true;
+            if (i + 1 < n)
+              mask[i + 1] = true;
+            i += 2;
+            continue;
+          }
+          if (code[i] === "[") {
+            inClass = true;
+            mask[i] = true;
+            i += 1;
+            continue;
+          }
+          if (code[i] === "]") {
+            inClass = false;
+            mask[i] = true;
+            i += 1;
+            continue;
+          }
+          if (code[i] === "/" && !inClass) {
+            i += 1;
+            break;
+          }
+          if (code[i] === "\n")
+            break;
+          mask[i] = true;
+          i += 1;
+        }
+        while (i < n && /[gimsuydv]/.test(code[i]))
+          i += 1;
+      };
+      const scanQuoted = (quote) => {
+        i += 1;
+        while (i < n) {
+          if (code[i] === "\\") {
+            if (code[i + 1] === "\r" && code[i + 2] === "\n") {
+              mask[i] = true;
+              mask[i + 1] = true;
+              mask[i + 2] = true;
+              i += 3;
+              continue;
+            }
+            mask[i] = true;
+            if (i + 1 < n)
+              mask[i + 1] = true;
+            i += 2;
+            continue;
+          }
+          if (code[i] === quote) {
+            i += 1;
+            break;
+          }
+          if (code[i] === "\n")
+            break;
+          mask[i] = true;
+          i += 1;
+        }
+      };
+      const scanTemplate = () => {
+        while (i < n) {
+          if (code[i] === "\\") {
+            mask[i] = true;
+            if (i + 1 < n)
+              mask[i + 1] = true;
+            i += 2;
+            continue;
+          }
+          if (code[i] === "`") {
+            i += 1;
+            break;
+          }
+          if (code[i] === "$" && code[i + 1] === "{") {
+            i += 2;
+            const savedCodeSoFar = codeSoFar;
+            codeSoFar = "";
+            scanCode(true);
+            codeSoFar = savedCodeSoFar;
+            continue;
+          }
+          mask[i] = true;
+          i += 1;
+        }
+      };
+      function scanCode(stopAtCloseBrace) {
+        let depth = 0;
+        while (i < n) {
+          const c = code[i];
+          const next = i + 1 < n ? code[i + 1] : "";
+          if (stopAtCloseBrace) {
+            if (c === "}" && depth === 0) {
+              i += 1;
+              return;
+            }
+            if (c === "{") {
+              depth += 1;
+              codeSoFar += c;
+              i += 1;
+              continue;
+            }
+            if (c === "}") {
+              depth -= 1;
+              codeSoFar += c;
+              i += 1;
+              continue;
+            }
+          }
+          if (c === "/" && next === "*") {
+            const end = code.indexOf("*/", i + 2);
+            const stop = end < 0 ? n : end + 2;
+            for (let j = i; j < stop; j++)
+              mask[j] = true;
+            i = stop;
+            continue;
+          }
+          if (c === "/" && next === "/") {
+            const end = code.indexOf("\n", i + 2);
+            const stop = end < 0 ? n : end;
+            for (let j = i; j < stop; j++)
+              mask[j] = true;
+            i = stop;
+            continue;
+          }
+          if (c === "/" && isRegexContext()) {
+            scanRegex();
+            codeSoFar += "x";
+            continue;
+          }
+          if (c === "`") {
+            i += 1;
+            scanTemplate();
+            codeSoFar += "x";
+            continue;
+          }
+          if (c === '"' || c === "'") {
+            scanQuoted(c);
+            codeSoFar += "x";
+            continue;
+          }
+          codeSoFar += c;
+          i += 1;
+        }
+      }
+      scanCode(false);
+      return mask;
+    }
+    function atLineStart(code, start) {
+      let j = start - 1;
+      while (j >= 0 && (code[j] === " " || code[j] === "	"))
+        j--;
+      return j < 0 || code[j] === "\n" || code[j] === "\r";
+    }
+    function repairInboxHelperScalarDestructure(code) {
+      if (!code || code.indexOf("__vqaWaitForEmail") === -1)
+        return code;
+      const inLiteral = literalPositionMask(code);
+      const re = /\b(const|let|var)\s*\{\s*([A-Za-z_$][\w$]*)\s*(?::\s*([A-Za-z_$][\w$]*)\s*)?\}\s*=\s*await\s+__vqaWaitForEmail\s*\(\s*(['"`])(code|link)\4\s*\)/g;
+      let out = "";
+      let last = 0;
+      let m;
+      while ((m = re.exec(code)) !== null) {
+        const [full, decl, prop, alias, quote, kind] = m;
+        const start = m.index;
+        if (inLiteral[start] || !atLineStart(code, start) || prop !== kind)
+          continue;
+        out += code.slice(last, start);
+        out += `${decl} ${alias || prop} = await __vqaWaitForEmail(${quote}${kind}${quote})`;
+        last = start + full.length;
+      }
+      out += code.slice(last);
+      return out;
+    }
     function sanitizeCode(code, options) {
       let result = code;
       const isNetworkIdleWaitLine = (line) => /^\s*await page\.waitForLoadState\((['"])networkidle\1\);\s*$/.test(line);
@@ -96149,6 +96383,7 @@ ${testOpen}`;
       if (options?.authStamp) {
         result = (0, auth_recipe_js_1.upsertAuthBlock)(result, options.authStamp);
       }
+      result = repairInboxHelperScalarDestructure(result);
       try {
         result = (0, inbox_stamp_js_1.upsertInboxBlock)(result);
       } catch {
@@ -334610,6 +334845,8 @@ var require_discover_agent = __commonJS({
     var discover_planner_js_1 = require_discover_planner();
     var discover_generator_js_1 = require_discover_generator();
     var discover_ai_planner_js_1 = require_discover_ai_planner();
+    var discovery_lint_flags_js_1 = require_discovery_lint_flags();
+    var verification_inbox_js_1 = require_verification_inbox();
     var sitemap_builder_js_1 = require_sitemap_builder();
     Object.defineProperty(exports, "buildInMemorySiteMap", { enumerable: true, get: function() {
       return sitemap_builder_js_1.buildInMemorySiteMap;
@@ -334622,6 +334859,13 @@ var require_discover_agent = __commonJS({
     var agentic_cli_constants_js_1 = require_agentic_cli_constants();
     var canvas_detector_js_1 = require_canvas_detector();
     var auth_recipe_js_1 = require_auth_recipe();
+    function plannerEmailVerifyArmed(ctx) {
+      if (!(0, discovery_lint_flags_js_1.isTestgenEmailVerifyEnabled)())
+        return false;
+      if (ctx.variableContext?.allTestVariables?.DISCOVERY_SHOULD_REGISTER !== "true")
+        return false;
+      return (0, verification_inbox_js_1.isVerificationInboxConfigured)();
+    }
     async function runCanvasPreflight(ctx, sharedBrowser, log2) {
       const cached = ctx.appRenderType ?? null;
       const engine = (0, agentic_cli_constants_js_1.getAgenticEngine)(ctx.exploreModel);
@@ -335270,6 +335514,9 @@ Explore complete: ${exploreResult.pagesDiscovered} pages, ${exploreResult.elemen
           // instead of authoring landing→login steps (which generate would override).
           authRecipeAvailable: (0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP) && !!ctx.authRecipe,
           authRedirectRoute: (0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP) ? ctx.authRecipe?.redirectRoute ?? void 0 : void 0,
+          // Email-verify capability — only for scenario-producing modes; a survey emits
+          // featureGroups (no scenarios), so keep its prompt free of the round-trip block.
+          emailVerifyArmed: mode !== "survey" && plannerEmailVerifyArmed(ctx),
           testBudget
         }, {
           modelOverride: ctx.planModel ?? ctx.generateModel,
@@ -335854,6 +336101,12 @@ Plan (reused): ${resumeSavedScenarios.length} scenarios from the paused run.`);
             // authenticated state when a verified login recipe is on file for this project.
             authRecipeAvailable: (0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP) && !!ctx.authRecipe,
             authRedirectRoute: (0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP) ? ctx.authRecipe?.redirectRoute ?? void 0 : void 0,
+            // Email-verify capability: when armed, let the planner plan the full
+            // register→verify and forgot-password→reset round trips to completion
+            // (see the planner's "## Verification Inbox Available" block). Armed on the
+            // SAME project-level predicate the generator uses (flag + register intent +
+            // configured inbox), so the planner never promises what generation can't do.
+            emailVerifyArmed: plannerEmailVerifyArmed(ctx),
             testBudget: featureTestBudget
           }, {
             modelOverride: ctx.planModel ?? ctx.generateModel,
@@ -350479,7 +350732,7 @@ var require_package4 = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.60",
+      version: "1.0.61",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"
@@ -355562,7 +355815,13 @@ async function handleHealth(_req, res) {
     },
     devices,
     capabilities,
-    activeSession: state.appiumSessionId
+    activeSession: state.appiumSessionId,
+    // THIS runner's Appium is executing mobile (APPIUM) test run(s) right now.
+    // The web pre-flight reads this to warn before /bridge/session/start would
+    // 409 — it must never be inferred from server-side global run counts, which
+    // include unrelated projects and runners.
+    executorBusy: executorBusyCount > 0,
+    recordingActive: !!state.appiumSessionId && mirrorSessionOwner === "recording"
   });
 }
 function realDeviceCapabilities2(platform3) {
@@ -355637,7 +355896,11 @@ function validateSessionStartBody(body) {
 }
 async function handleDevices(_req, res) {
   const devices = discoverAllDevices({ includeApps: true });
-  sendJSON(res, 200, { devices });
+  sendJSON(res, 200, {
+    devices,
+    executorBusy: executorBusyCount > 0,
+    recordingActive: !!state.appiumSessionId && mirrorSessionOwner === "recording"
+  });
 }
 async function handleSessionStart(req, res) {
   const body = await parseBody(req);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@validate.qa/runner",
-  "version": "1.0.60",
+  "version": "1.0.61",
   "description": "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
   "bin": {
     "validate-runner": "dist/cli.js"