@validate.qa/runner 1.0.61 → 1.0.63

package/dist/cli.js

@@ -73455,6 +73455,7 @@ var require_inbox_tools = __commonJS({
         legacyEmail,
         tag,
         usePlusTag: email !== baseEmail,
+        allowPlainFallback: opts.allowPlainFallback ?? true,
         passwordKey: opts.passwordKey ?? "TEST_USER_PASSWORD",
         provisioned: false,
         // Floor reads at run start so a verification email from a PRIOR run (the
@@ -73617,6 +73618,9 @@ var require_inbox_tools = __commonJS({
       const { state: state2 } = ctx;
       const plain = args.plain === true || args.plain === "true";
       const restore = args.plain === false || args.plain === "false";
+      if (plain && !state2.allowPlainFallback) {
+        return err("The bare inbox address is unavailable for this brokered run because it is shared across projects. Keep using the project-scoped +tag address; if the app rejects plus-addressing, report email verification as blocked.");
+      }
       if (plain && state2.usePlusTag) {
         state2.email = state2.baseEmail;
         state2.usePlusTag = false;
@@ -75458,7 +75462,10 @@ ${existingScreens.slice(0, 100).map((s) => `- ${s.screenId}${s.name ? ` "${s.nam
       } else if (registerRequested && ctx.inboxBroker?.address && ctx.inboxBrokerRead) {
         inboxState = (0, inbox_tools_js_1.createInboxRunState)({ address: ctx.inboxBroker.address }, {
           tagSeed: targetAppId ?? ctx.projectId,
-          projectScope: ctx.projectId
+          projectScope: ctx.projectId,
+          // A user-controlled local runner must never read the shared bare inbox:
+          // only the project-scoped +tag is an authorization boundary.
+          allowPlainFallback: false
         });
         inboxReader = new brokered_inbox_reader_js_1.BrokeredInboxReader(ctx.inboxBrokerRead);
         await (0, inbox_tools_js_1.applyAndPersistInboxIdentity)({
@@ -320223,6 +320230,9 @@ var require_survey_link_frontier = __commonJS({
     exports2.markLinkNavigationAttempt = markLinkNavigationAttempt;
     exports2.getFinishBlockingFrontier = getFinishBlockingFrontier;
     exports2.describeBlockingRoutes = describeBlockingRoutes;
+    exports2.isTransientLanding = isTransientLanding;
+    exports2.getAdaptiveDebtRoutes = getAdaptiveDebtRoutes;
+    exports2.listTransientDebtSuppressions = listTransientDebtSuppressions;
     var exploration_state_js_1 = require_exploration_state();
     var exploration_parser_js_1 = require_exploration_parser();
     exports2.MAX_FINISH_REDIRECTS = 2;
@@ -320582,6 +320592,132 @@ var require_survey_link_frontier = __commonJS({
     function describeBlockingRoutes(items, max = 3) {
       return items.slice(0, max).map((i) => i.label ? `${i.label} (${i.route})` : i.route).join(", ");
     }
+    function isOpaqueToken(v) {
+      if (!v)
+        return false;
+      if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v))
+        return true;
+      if (v.length >= 20 && /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(v))
+        return true;
+      if (v.length >= 20 && !/[\s_-]/.test(v) && /[A-Za-z]/.test(v) && /\d/.test(v))
+        return true;
+      if (v.length >= 24 && /^[A-Za-z0-9+/=]+$/.test(v) && /\d/.test(v))
+        return true;
+      return false;
+    }
+    var FLASH_QUERY_KEYS = /* @__PURE__ */ new Set(["toast", "flash", "snackbar"]);
+    var SESSION_TOKEN_QUERY_KEYS = /* @__PURE__ */ new Set([
+      "sid",
+      "sess",
+      "sessid",
+      "session",
+      "sessionid",
+      "jsessionid",
+      "phpsessid"
+    ]);
+    var ONE_TIME_TOKEN_QUERY_KEYS = /* @__PURE__ */ new Set([
+      "token",
+      "oobcode",
+      "confirmation_token",
+      "reset_token",
+      "reset_password_token",
+      "verification_token",
+      "activation_token",
+      "invitation_token",
+      "unsubscribe_token"
+    ]);
+    var ERROR_PATH_RE = /^\/(?:404|500|503|403|401|error|not[-_]?found|maintenance|oops|unauthorized|forbidden)(?:\/|$)/i;
+    var OAUTH_CALLBACK_PATH_RE = /(?:^|\/)(?:oauth2?\/callback|auth\/callback|sso\/callback|oidc\/callback|signin[-_]oidc|auth\/response)(?:\/|$)/i;
+    var ONE_TIME_PATH_PREFIX_RE = /^\/(?:verify|verify[-_]email|confirm|confirmation|activate|activation|reset[-_]password|password[-_]reset|magic[-_]?link|invitation|invite|unsubscribe|email[-_]confirm)\/([^/?#]+)/i;
+    var INFRA_PATH_RE = /^\/(?:cdn-cgi|__\/auth|\.well-known|_next\/(?:static|data|image)|_nuxt|_vercel)(?:\/|$)/i;
+    var DOWNLOAD_PATH_RE = /(?:^|\/)(?:download|export)\/([^/?#]+)$/i;
+    function isTransientLanding(route2, depth = 0) {
+      if (!route2 || route2 === "/" || depth > 4)
+        return false;
+      let url;
+      try {
+        url = new URL(route2, "http://transient.invalid");
+      } catch {
+        return false;
+      }
+      const path = url.pathname;
+      const params = url.searchParams;
+      if (url.hash.startsWith("#/") && isTransientLanding(url.hash.slice(1), depth + 1))
+        return true;
+      if (ERROR_PATH_RE.test(path))
+        return true;
+      if (INFRA_PATH_RE.test(path))
+        return true;
+      if (OAUTH_CALLBACK_PATH_RE.test(path))
+        return true;
+      if (isOpaqueToken(params.get("code")) && isOpaqueToken(params.get("state")))
+        return true;
+      if (params.has("error") && isOpaqueToken(params.get("state")))
+        return true;
+      if (/[#&?](?:access_token|id_token)=/.test(url.hash) || params.has("access_token") || params.has("id_token")) {
+        return true;
+      }
+      for (const key of params.keys()) {
+        if (FLASH_QUERY_KEYS.has(key.toLowerCase()))
+          return true;
+      }
+      const otPath = ONE_TIME_PATH_PREFIX_RE.exec(path);
+      if (otPath) {
+        let seg = otPath[1];
+        try {
+          seg = decodeURIComponent(seg);
+        } catch {
+        }
+        if (isOpaqueToken(seg))
+          return true;
+      }
+      for (const [key, value] of params) {
+        if (ONE_TIME_TOKEN_QUERY_KEYS.has(key.toLowerCase()) && isOpaqueToken(value))
+          return true;
+      }
+      const dl = DOWNLOAD_PATH_RE.exec(path);
+      if (dl && (/\.[a-z0-9]{2,5}$/i.test(dl[1]) || /\d/.test(dl[1])))
+        return true;
+      for (const [key, value] of params) {
+        if (SESSION_TOKEN_QUERY_KEYS.has(key.toLowerCase()) && isOpaqueToken(value))
+          return true;
+      }
+      return false;
+    }
+    function getAdaptiveDebtRoutes(state2) {
+      const excluded = (r) => {
+        if (r === "/")
+          return true;
+        const item = state2.frontier.get(r);
+        if (item?.source === "link-seen" && item.attempted === true)
+          return true;
+        if (visitedSatisfies(state2, r))
+          return true;
+        if (item?.source !== "link-seen" && isTransientLanding(r))
+          return true;
+        return false;
+      };
+      const ranked = (0, exploration_state_js_1.getRankedFrontier)(state2, { preferShallow: true }).filter((r) => !excluded(r));
+      const rankedSet = new Set(ranked);
+      const navigatedUncaptured = [];
+      for (const r of state2.frontier.keys()) {
+        if (!rankedSet.has(r) && !excluded(r))
+          navigatedUncaptured.push(r);
+      }
+      return ranked.concat(navigatedUncaptured);
+    }
+    function listTransientDebtSuppressions(state2) {
+      const out = [];
+      for (const [r, item] of state2.frontier) {
+        if (r === "/" || item.source === "link-seen")
+          continue;
+        if (visitedSatisfies(state2, r))
+          continue;
+        if (isTransientLanding(r))
+          out.push(r);
+      }
+      return out;
+    }
   }
 });
 
@@ -324659,21 +324795,16 @@ ${inboxPromptBlock}`;
         let discoveryCreditedThrough = 0;
         let adaptiveLastDiscoveryIteration = Number.NEGATIVE_INFINITY;
         let adaptiveDiscoveryLeaseUsed = false;
+        let loggedTransientDebtSuppression = false;
         const adaptiveDebtRoutes = () => {
-          const isAttemptedLinkEntry = (r) => {
-            const item = state2.frontier.get(r);
-            return item?.source === "link-seen" && item.attempted === true;
-          };
-          const isSatisfied = (r) => (0, survey_link_frontier_js_1.visitedSatisfies)(state2, r);
-          const ranked = (0, exploration_state_js_1.getRankedFrontier)(state2, { preferShallow: true }).filter((r) => r !== "/" && !isAttemptedLinkEntry(r) && !isSatisfied(r));
-          const rankedSet = new Set(ranked);
-          const navigatedUncaptured = [];
-          for (const r of state2.frontier.keys()) {
-            if (r !== "/" && !rankedSet.has(r) && !isAttemptedLinkEntry(r) && !isSatisfied(r)) {
-              navigatedUncaptured.push(r);
+          if (!loggedTransientDebtSuppression) {
+            const suppressed = (0, survey_link_frontier_js_1.listTransientDebtSuppressions)(state2);
+            if (suppressed.length > 0) {
+              loggedTransientDebtSuppression = true;
+              logs2.push(`  [debt-hygiene] excluded ${suppressed.length} transient landing(s) from adaptive debt: ${suppressed.slice(0, 6).join(", ")}${suppressed.length > 6 ? ` \u2026+${suppressed.length - 6}` : ""}`);
             }
           }
-          return ranked.concat(navigatedUncaptured);
+          return (0, survey_link_frontier_js_1.getAdaptiveDebtRoutes)(state2);
         };
         const describeRankedRoutes = (routes, max) => routes.slice(0, max).map((r) => {
           const label = state2.frontier.get(r)?.label;
@@ -350727,7 +350858,7 @@ var require_package4 = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.61",
+      version: "1.0.63",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"

package/dist/cli.mjs

@@ -73460,6 +73460,7 @@ var require_inbox_tools = __commonJS({
         legacyEmail,
         tag,
         usePlusTag: email !== baseEmail,
+        allowPlainFallback: opts.allowPlainFallback ?? true,
         passwordKey: opts.passwordKey ?? "TEST_USER_PASSWORD",
         provisioned: false,
         // Floor reads at run start so a verification email from a PRIOR run (the
@@ -73622,6 +73623,9 @@ var require_inbox_tools = __commonJS({
       const { state: state2 } = ctx;
       const plain = args.plain === true || args.plain === "true";
       const restore = args.plain === false || args.plain === "false";
+      if (plain && !state2.allowPlainFallback) {
+        return err("The bare inbox address is unavailable for this brokered run because it is shared across projects. Keep using the project-scoped +tag address; if the app rejects plus-addressing, report email verification as blocked.");
+      }
       if (plain && state2.usePlusTag) {
         state2.email = state2.baseEmail;
         state2.usePlusTag = false;
@@ -75463,7 +75467,10 @@ ${existingScreens.slice(0, 100).map((s) => `- ${s.screenId}${s.name ? ` "${s.nam
       } else if (registerRequested && ctx.inboxBroker?.address && ctx.inboxBrokerRead) {
         inboxState = (0, inbox_tools_js_1.createInboxRunState)({ address: ctx.inboxBroker.address }, {
           tagSeed: targetAppId ?? ctx.projectId,
-          projectScope: ctx.projectId
+          projectScope: ctx.projectId,
+          // A user-controlled local runner must never read the shared bare inbox:
+          // only the project-scoped +tag is an authorization boundary.
+          allowPlainFallback: false
         });
         inboxReader = new brokered_inbox_reader_js_1.BrokeredInboxReader(ctx.inboxBrokerRead);
         await (0, inbox_tools_js_1.applyAndPersistInboxIdentity)({
@@ -320228,6 +320235,9 @@ var require_survey_link_frontier = __commonJS({
     exports.markLinkNavigationAttempt = markLinkNavigationAttempt;
     exports.getFinishBlockingFrontier = getFinishBlockingFrontier;
     exports.describeBlockingRoutes = describeBlockingRoutes;
+    exports.isTransientLanding = isTransientLanding;
+    exports.getAdaptiveDebtRoutes = getAdaptiveDebtRoutes;
+    exports.listTransientDebtSuppressions = listTransientDebtSuppressions;
     var exploration_state_js_1 = require_exploration_state();
     var exploration_parser_js_1 = require_exploration_parser();
     exports.MAX_FINISH_REDIRECTS = 2;
@@ -320587,6 +320597,132 @@ var require_survey_link_frontier = __commonJS({
     function describeBlockingRoutes(items, max = 3) {
       return items.slice(0, max).map((i) => i.label ? `${i.label} (${i.route})` : i.route).join(", ");
     }
+    function isOpaqueToken(v) {
+      if (!v)
+        return false;
+      if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v))
+        return true;
+      if (v.length >= 20 && /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(v))
+        return true;
+      if (v.length >= 20 && !/[\s_-]/.test(v) && /[A-Za-z]/.test(v) && /\d/.test(v))
+        return true;
+      if (v.length >= 24 && /^[A-Za-z0-9+/=]+$/.test(v) && /\d/.test(v))
+        return true;
+      return false;
+    }
+    var FLASH_QUERY_KEYS = /* @__PURE__ */ new Set(["toast", "flash", "snackbar"]);
+    var SESSION_TOKEN_QUERY_KEYS = /* @__PURE__ */ new Set([
+      "sid",
+      "sess",
+      "sessid",
+      "session",
+      "sessionid",
+      "jsessionid",
+      "phpsessid"
+    ]);
+    var ONE_TIME_TOKEN_QUERY_KEYS = /* @__PURE__ */ new Set([
+      "token",
+      "oobcode",
+      "confirmation_token",
+      "reset_token",
+      "reset_password_token",
+      "verification_token",
+      "activation_token",
+      "invitation_token",
+      "unsubscribe_token"
+    ]);
+    var ERROR_PATH_RE = /^\/(?:404|500|503|403|401|error|not[-_]?found|maintenance|oops|unauthorized|forbidden)(?:\/|$)/i;
+    var OAUTH_CALLBACK_PATH_RE = /(?:^|\/)(?:oauth2?\/callback|auth\/callback|sso\/callback|oidc\/callback|signin[-_]oidc|auth\/response)(?:\/|$)/i;
+    var ONE_TIME_PATH_PREFIX_RE = /^\/(?:verify|verify[-_]email|confirm|confirmation|activate|activation|reset[-_]password|password[-_]reset|magic[-_]?link|invitation|invite|unsubscribe|email[-_]confirm)\/([^/?#]+)/i;
+    var INFRA_PATH_RE = /^\/(?:cdn-cgi|__\/auth|\.well-known|_next\/(?:static|data|image)|_nuxt|_vercel)(?:\/|$)/i;
+    var DOWNLOAD_PATH_RE = /(?:^|\/)(?:download|export)\/([^/?#]+)$/i;
+    function isTransientLanding(route2, depth = 0) {
+      if (!route2 || route2 === "/" || depth > 4)
+        return false;
+      let url;
+      try {
+        url = new URL(route2, "http://transient.invalid");
+      } catch {
+        return false;
+      }
+      const path = url.pathname;
+      const params = url.searchParams;
+      if (url.hash.startsWith("#/") && isTransientLanding(url.hash.slice(1), depth + 1))
+        return true;
+      if (ERROR_PATH_RE.test(path))
+        return true;
+      if (INFRA_PATH_RE.test(path))
+        return true;
+      if (OAUTH_CALLBACK_PATH_RE.test(path))
+        return true;
+      if (isOpaqueToken(params.get("code")) && isOpaqueToken(params.get("state")))
+        return true;
+      if (params.has("error") && isOpaqueToken(params.get("state")))
+        return true;
+      if (/[#&?](?:access_token|id_token)=/.test(url.hash) || params.has("access_token") || params.has("id_token")) {
+        return true;
+      }
+      for (const key of params.keys()) {
+        if (FLASH_QUERY_KEYS.has(key.toLowerCase()))
+          return true;
+      }
+      const otPath = ONE_TIME_PATH_PREFIX_RE.exec(path);
+      if (otPath) {
+        let seg = otPath[1];
+        try {
+          seg = decodeURIComponent(seg);
+        } catch {
+        }
+        if (isOpaqueToken(seg))
+          return true;
+      }
+      for (const [key, value] of params) {
+        if (ONE_TIME_TOKEN_QUERY_KEYS.has(key.toLowerCase()) && isOpaqueToken(value))
+          return true;
+      }
+      const dl = DOWNLOAD_PATH_RE.exec(path);
+      if (dl && (/\.[a-z0-9]{2,5}$/i.test(dl[1]) || /\d/.test(dl[1])))
+        return true;
+      for (const [key, value] of params) {
+        if (SESSION_TOKEN_QUERY_KEYS.has(key.toLowerCase()) && isOpaqueToken(value))
+          return true;
+      }
+      return false;
+    }
+    function getAdaptiveDebtRoutes(state2) {
+      const excluded = (r) => {
+        if (r === "/")
+          return true;
+        const item = state2.frontier.get(r);
+        if (item?.source === "link-seen" && item.attempted === true)
+          return true;
+        if (visitedSatisfies(state2, r))
+          return true;
+        if (item?.source !== "link-seen" && isTransientLanding(r))
+          return true;
+        return false;
+      };
+      const ranked = (0, exploration_state_js_1.getRankedFrontier)(state2, { preferShallow: true }).filter((r) => !excluded(r));
+      const rankedSet = new Set(ranked);
+      const navigatedUncaptured = [];
+      for (const r of state2.frontier.keys()) {
+        if (!rankedSet.has(r) && !excluded(r))
+          navigatedUncaptured.push(r);
+      }
+      return ranked.concat(navigatedUncaptured);
+    }
+    function listTransientDebtSuppressions(state2) {
+      const out = [];
+      for (const [r, item] of state2.frontier) {
+        if (r === "/" || item.source === "link-seen")
+          continue;
+        if (visitedSatisfies(state2, r))
+          continue;
+        if (isTransientLanding(r))
+          out.push(r);
+      }
+      return out;
+    }
   }
 });
 
@@ -324664,21 +324800,16 @@ ${inboxPromptBlock}`;
         let discoveryCreditedThrough = 0;
         let adaptiveLastDiscoveryIteration = Number.NEGATIVE_INFINITY;
         let adaptiveDiscoveryLeaseUsed = false;
+        let loggedTransientDebtSuppression = false;
         const adaptiveDebtRoutes = () => {
-          const isAttemptedLinkEntry = (r) => {
-            const item = state2.frontier.get(r);
-            return item?.source === "link-seen" && item.attempted === true;
-          };
-          const isSatisfied = (r) => (0, survey_link_frontier_js_1.visitedSatisfies)(state2, r);
-          const ranked = (0, exploration_state_js_1.getRankedFrontier)(state2, { preferShallow: true }).filter((r) => r !== "/" && !isAttemptedLinkEntry(r) && !isSatisfied(r));
-          const rankedSet = new Set(ranked);
-          const navigatedUncaptured = [];
-          for (const r of state2.frontier.keys()) {
-            if (r !== "/" && !rankedSet.has(r) && !isAttemptedLinkEntry(r) && !isSatisfied(r)) {
-              navigatedUncaptured.push(r);
+          if (!loggedTransientDebtSuppression) {
+            const suppressed = (0, survey_link_frontier_js_1.listTransientDebtSuppressions)(state2);
+            if (suppressed.length > 0) {
+              loggedTransientDebtSuppression = true;
+              logs2.push(`  [debt-hygiene] excluded ${suppressed.length} transient landing(s) from adaptive debt: ${suppressed.slice(0, 6).join(", ")}${suppressed.length > 6 ? ` \u2026+${suppressed.length - 6}` : ""}`);
             }
           }
-          return ranked.concat(navigatedUncaptured);
+          return (0, survey_link_frontier_js_1.getAdaptiveDebtRoutes)(state2);
         };
         const describeRankedRoutes = (routes, max) => routes.slice(0, max).map((r) => {
           const label = state2.frontier.get(r)?.label;
@@ -350732,7 +350863,7 @@ var require_package4 = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.61",
+      version: "1.0.63",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@validate.qa/runner",
-  "version": "1.0.61",
+  "version": "1.0.63",
   "description": "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
   "bin": {
     "validate-runner": "dist/cli.js"