@validate.qa/runner 1.0.64 → 1.0.66

package/dist/cli.js

@@ -3485,6 +3485,135 @@ var init_audit_pricing = __esm({
   }
 });
 
+// ../shared/dist/audit-grouping.js
+var GROUPABLE_CALL_TYPES, GROUP_LABELS, FLOW_PHASE_TYPES, FLOW_SERVER_TYPES, FLOW_PHASE_LABELS;
+var init_audit_grouping = __esm({
+  "../shared/dist/audit-grouping.js"() {
+    "use strict";
+    GROUPABLE_CALL_TYPES = /* @__PURE__ */ new Set([
+      "healIteration",
+      "healOrchestrator",
+      "generateRegressionSuite",
+      "discoveryExplore",
+      "surveyExplore",
+      "featureExplore",
+      "discoveryGenerate",
+      "discoveryPlan",
+      "discoveryGenerateSkeleton",
+      "discoveryGenerateElementContext",
+      "liveGenerate",
+      "scenarioGenerate",
+      "liveSuiteHeal",
+      "captureIteration",
+      "healAPITest",
+      "generateAPITests",
+      // Auth-prologue login-capture run (runLoginCaptureRun) — per-turn rows share a
+      // groupId so they collapse into one "Login Capture" phase card on /audit.
+      "authCapture",
+      // Assistant chat — rounds of one conversation collapse into one card.
+      "assistantChat"
+    ]);
+    GROUP_LABELS = {
+      healIteration: "healSession",
+      healOrchestrator: "healSession",
+      healAPITest: "apiHealSession",
+      generateRegressionSuite: "regressionSession",
+      generateAPITests: "apiTestGenSession",
+      discoveryExplore: "discoveryExploreSession",
+      surveyExplore: "surveyExploreSession",
+      featureExplore: "featureExploreSession",
+      discoveryGenerate: "discoveryGenerateSession",
+      discoveryGenerateSkeleton: "discoveryGenerateSession",
+      discoveryGenerateElementContext: "discoveryGenerateSession",
+      liveGenerate: "liveGenerateSession",
+      scenarioGenerate: "scenarioGenerateSession",
+      discoveryPlan: "discoveryPlanSession",
+      liveSuiteHeal: "liveSuiteHealSession",
+      captureIteration: "captureIterationSession",
+      authCapture: "authCaptureSession",
+      assistantChat: "assistantChatSession"
+    };
+    FLOW_PHASE_TYPES = /* @__PURE__ */ new Set([
+      "surveyExploreSession",
+      "featureExploreSession",
+      "discoveryAIPlanner",
+      "discoveryPlanSession",
+      "scenarioGenerateSession",
+      "liveGenerateSession",
+      "discoveryGenerateSession",
+      // Raw callTypes (for ungrouped single-turn entries like planner)
+      "surveyExplore",
+      "featureExplore",
+      "discoveryPlan",
+      "scenarioGenerate",
+      "liveGenerate",
+      "discoveryGenerate",
+      // Planner repair / retry / strengthen-gate — the one-shot extra planner call
+      // shares the base planner's discoveryFlowId, so it nests as its own phase
+      // instead of dangling as a raw camelCase row.
+      "discoveryAIPlannerRepair",
+      "discoveryAIPlannerRetry",
+      "discoveryAIPlannerStrengthenGate",
+      // Deep-run feature analyst insight (one call per feature discovery).
+      "featureInsight",
+      // Discovery v2 Call-1-authoring pivot — per-test Call 2 spawns. Each session
+      // has its OWN sessionId but shares the parent discoveryFlowId, so grouping by
+      // flowId pulls them under the same Discovery Flow card. `Cleanup` is the
+      // teardown sibling of Fix/Author and nests the same way.
+      "discoveryCall2Fix",
+      "discoveryCall2Author",
+      "discoveryCall2Cleanup",
+      // Auth-prologue login-capture run — grouped label + raw callType.
+      "authCaptureSession",
+      "authCapture"
+    ]);
+    FLOW_SERVER_TYPES = /* @__PURE__ */ new Set([
+      "healthAnalysis",
+      "apiSecurityAudit",
+      "apiSecurityAuditVerify",
+      "generateAPITests",
+      "apiTestGenSession",
+      "healAPITest",
+      "apiHealSession",
+      "healSession",
+      "healIteration"
+    ]);
+    FLOW_PHASE_LABELS = {
+      surveyExploreSession: "Survey Explore",
+      featureExploreSession: "Feature Explore",
+      discoveryAIPlanner: "Feature Analyst",
+      discoveryAIPlannerRepair: "Planner Repair",
+      discoveryAIPlannerRetry: "Planner Retry",
+      discoveryAIPlannerStrengthenGate: "Planner Strengthen Gate",
+      discoveryPlanSession: "Survey Planner",
+      scenarioGenerateSession: "Scenario Gen",
+      liveGenerateSession: "Live Browser Gen",
+      discoveryGenerateSession: "Test Generation",
+      surveyExplore: "Survey Explore",
+      featureExplore: "Feature Explore",
+      discoveryPlan: "Planner",
+      scenarioGenerate: "Scenario Gen",
+      liveGenerate: "Live Browser Gen",
+      discoveryGenerate: "Test Generation",
+      discoveryCall2Fix: "Call 2 Fix",
+      discoveryCall2Author: "Call 2 Author",
+      discoveryCall2Cleanup: "Call 2 Cleanup",
+      featureInsight: "Feature Insight",
+      healthAnalysis: "Health Analysis",
+      apiSecurityAudit: "Security Audit",
+      apiSecurityAuditVerify: "Security Verify",
+      generateAPITests: "API Test Gen",
+      apiTestGenSession: "API Test Gen",
+      healAPITest: "API Test Heal",
+      apiHealSession: "API Test Heal",
+      healSession: "Heal Session",
+      healIteration: "Heal",
+      authCapture: "Login Capture",
+      authCaptureSession: "Login Capture"
+    };
+  }
+});
+
 // ../shared/dist/discovery-har-decision.js
 function decideHarPosted(response) {
   if (!response)
@@ -5850,6 +5979,11 @@ __export(dist_exports, {
   DEFAULT_UI_VARIANT: () => DEFAULT_UI_VARIANT,
   EMAIL_FROM_IDENTITIES: () => EMAIL_FROM_IDENTITIES,
   ENVIRONMENTAL_ERROR_PREFIXES: () => ENVIRONMENTAL_ERROR_PREFIXES,
+  FLOW_PHASE_LABELS: () => FLOW_PHASE_LABELS,
+  FLOW_PHASE_TYPES: () => FLOW_PHASE_TYPES,
+  FLOW_SERVER_TYPES: () => FLOW_SERVER_TYPES,
+  GROUPABLE_CALL_TYPES: () => GROUPABLE_CALL_TYPES,
+  GROUP_LABELS: () => GROUP_LABELS,
   LEGACY_TTS_VOICE_ID_MAP: () => LEGACY_TTS_VOICE_ID_MAP,
   MAX_CREDIT_TOPUP_CENTS: () => MAX_CREDIT_TOPUP_CENTS,
   MAX_DEEPLINK_LENGTH: () => MAX_DEEPLINK_LENGTH,
@@ -6033,6 +6167,7 @@ var init_dist = __esm({
     init_mobile_deeplink();
     init_plans();
     init_audit_pricing();
+    init_audit_grouping();
     init_discovery_har_decision();
     init_assertion_classifier();
     init_assertion_strength();
@@ -73489,6 +73624,7 @@ var require_inbox_tools = __commonJS({
     exports2.buildInboxPromptBlock = buildInboxPromptBlock;
     exports2.guardVerificationCodeFabrication = guardVerificationCodeFabrication;
     exports2.hasRegisterIntent = hasRegisterIntent;
+    exports2.hasSignupTestIntent = hasSignupTestIntent;
     exports2.resolveInboxRegistration = resolveInboxRegistration;
     exports2.applyInboxRegistrationIdentity = applyInboxRegistrationIdentity;
     exports2.isThrowawayRegisterSeedEmail = isThrowawayRegisterSeedEmail;
@@ -74032,6 +74168,9 @@ This project asked to REGISTER a new account, but this runner CANNOT receive ema
       const v = variableContext.allTestVariables?.DISCOVERY_SHOULD_REGISTER ?? variableContext.publicTestVariables?.DISCOVERY_SHOULD_REGISTER ?? "";
       return String(v).trim().toLowerCase() === "true";
     }
+    function hasSignupTestIntent(variableContext) {
+      return variableContext?.allTestVariables?.DISCOVERY_ALLOW_SIGNUP_TESTS !== "false";
+    }
     function resolveInboxRegistration(opts) {
       const config = (0, verification_inbox_js_1.loadVerificationInboxConfig)(opts.env ?? process.env);
       if (!config)
@@ -94980,6 +95119,8 @@ var require_discover_generator = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.MIN_BUG_DESCRIPTION_LENGTH = exports2.VALID_PLAYWRIGHT_GETBY_METHODS = exports2.BLOCKED_MCP_TOOLS_SCENARIO_GEN = void 0;
     exports2.scenarioLooksLikeRegistration = scenarioLooksLikeRegistration;
+    exports2.signupFeatureTestingAllowed = signupFeatureTestingAllowed;
+    exports2.scenarioTouchesSignupAuthSurface = scenarioTouchesSignupAuthSurface;
     exports2.filterMcpToolsForScenarioGen = filterMcpToolsForScenarioGen;
     exports2.detectScenarioSignals = detectScenarioSignals;
     exports2.scenarioStepsCoverAuth = scenarioStepsCoverAuth;
@@ -95067,6 +95208,19 @@ EMIT (the code you put in finish_generate) \u2014 do NOT hardcode the throwaway
 - Tag the test \`@email-verify\`. Emit EXACTLY ONE test() in this file (one registration per run).
 - End with a DURABLE assertion of the post-verification signed-in state (e.g. a Logout control, an account/dashboard landmark) in your OWN test body \u2014 the helper call is not itself a proof.`;
     }
+    function signupFeatureTestingAllowed(credentials) {
+      if (!(0, discovery_lint_flags_js_1.isTestgenEmailVerifyEnabled)() || !(0, verification_inbox_js_1.loadVerificationInboxConfig)())
+        return false;
+      return credentials?.DISCOVERY_ALLOW_SIGNUP_TESTS !== "false";
+    }
+    var SIGNUP_AUTH_ROUTE_RE = /\/(sign-?up|verify-?email|email-?verification|create-?account|confirm-?email)\b/i;
+    function scenarioTouchesSignupAuthSurface(scenario, pages) {
+      const routes = [scenario.entryRoute, ...scenario.targetPages ?? []].filter((r) => !!r);
+      if (routes.some((r) => SIGNUP_AUTH_ROUTE_RE.test(r)))
+        return true;
+      const authRoutes = new Set(pages.filter((p) => (p.pageType ?? "").toUpperCase() === "AUTH").map((p) => p.route));
+      return routes.some((r) => authRoutes.has(r));
+    }
     exports2.BLOCKED_MCP_TOOLS_SCENARIO_GEN = /* @__PURE__ */ new Set([
       "browser_install",
       "browser_close",
@@ -98178,9 +98332,16 @@ ${tailBlock}`;
           extraAuthEvidence: !!opts?.recipe || hasConfiguredLoginCredentials(credentials)
         });
         const baseSkeletonHadRegression = tags.includes("@regression");
+        const selfProvisioningSignupScenario = signupFeatureTestingAllowed(credentials) && scenarioLooksLikeRegistration(scenario) && scenarioTouchesSignupAuthSurface(scenario, siteMap.pages);
+        if (selfProvisioningSignupScenario) {
+          for (const prereqTag of ["@needs-auth", "@inline-login", "@auth-guarded"]) {
+            const idx = tags.indexOf(prereqTag);
+            if (idx !== -1)
+              tags.splice(idx, 1);
+          }
+        }
         const hasVerifiedRecipe = !!opts?.recipe && tags.includes("@needs-auth");
-        const projectHasRegisterIntent = credentials?.DISCOVERY_SHOULD_REGISTER === "true";
-        const inboxGenConfig = (0, discovery_lint_flags_js_1.isTestgenEmailVerifyEnabled)() && projectHasRegisterIntent && !hasVerifiedRecipe && scenarioLooksLikeRegistration(scenario) ? (0, verification_inbox_js_1.loadVerificationInboxConfig)() : null;
+        const inboxGenConfig = selfProvisioningSignupScenario ? (0, verification_inbox_js_1.loadVerificationInboxConfig)() : null;
         let genInboxState = null;
         let genInboxCredentials = credentials;
         let genInboxSecret = null;
@@ -99127,7 +99288,8 @@ Scenario: "${scenario.name}" (${scenario.type})`);
             } catch {
             }
             const recipe = authRecipe;
-            const replayLogin = shouldReplayAuthRecipe(scenario.targetPages, siteMap.pages, recipe);
+            const selfProvisioningSignupScenario = signupFeatureTestingAllowed(credentials) && scenarioLooksLikeRegistration(scenario) && scenarioTouchesSignupAuthSurface(scenario, siteMap.pages);
+            const replayLogin = !selfProvisioningSignupScenario && shouldReplayAuthRecipe(scenario.targetPages, siteMap.pages, recipe);
             let effectiveRecipe = null;
             if (replayLogin && recipe) {
               const planLeaks = findSensitiveLiteralLeaks(JSON.stringify(recipe.replayPlan ?? []), credentials);
@@ -99234,7 +99396,8 @@ Scenario: "${scenario.name}" (${scenario.type})`);
             return;
           }
           let effectiveRecipe = null;
-          if (shouldReplayAuthRecipe(scenario.targetPages, siteMap.pages, authRecipe) && authRecipe) {
+          const selfProvisioningSignupScenario = signupFeatureTestingAllowed(credentials) && scenarioLooksLikeRegistration(scenario) && scenarioTouchesSignupAuthSurface(scenario, siteMap.pages);
+          if (!selfProvisioningSignupScenario && shouldReplayAuthRecipe(scenario.targetPages, siteMap.pages, authRecipe) && authRecipe) {
             const planLeaks = findSensitiveLiteralLeaks(JSON.stringify(authRecipe.replayPlan ?? []), credentials);
             if (planLeaks.length > 0) {
               scenarioLogs.push(`  Warning: login replay plan contains literal credential value(s) for ${planLeaks.join(", ")} \u2014 falling back to model-authored login for "${scenario.name}"`);
@@ -335035,6 +335198,7 @@ var require_discover_agent = __commonJS({
     var discover_ai_planner_js_1 = require_discover_ai_planner();
     var discovery_lint_flags_js_1 = require_discovery_lint_flags();
     var verification_inbox_js_1 = require_verification_inbox();
+    var inbox_tools_js_1 = require_inbox_tools();
     var sitemap_builder_js_1 = require_sitemap_builder();
     Object.defineProperty(exports2, "buildInMemorySiteMap", { enumerable: true, get: function() {
       return sitemap_builder_js_1.buildInMemorySiteMap;
@@ -335048,11 +335212,16 @@ var require_discover_agent = __commonJS({
     var canvas_detector_js_1 = require_canvas_detector();
     var auth_recipe_js_1 = require_auth_recipe();
     function plannerEmailVerifyArmed(ctx) {
-      if (!(0, discovery_lint_flags_js_1.isTestgenEmailVerifyEnabled)())
-        return false;
-      if (ctx.variableContext?.allTestVariables?.DISCOVERY_SHOULD_REGISTER !== "true")
+      if (!(0, discovery_lint_flags_js_1.isTestgenEmailVerifyEnabled)() || !(0, verification_inbox_js_1.loadVerificationInboxConfig)())
         return false;
-      return (0, verification_inbox_js_1.isVerificationInboxConfigured)();
+      return (0, inbox_tools_js_1.hasSignupTestIntent)(ctx.variableContext);
+    }
+    var PLANNER_AUTH_NAME_RE = /\b(auth|authentication|log[\s-]?in|sign[\s-]?in|sign[\s-]?up|signup|account|password|verify[\s-]?email)\b/i;
+    var PLANNER_AUTH_ROUTE_RE = /\/(auth|login|sign-?in|sign-?up|signup|verify-?email|create-?account)\b/i;
+    function featureLooksLikeAuth(featureName, focusRoutes) {
+      if (featureName && PLANNER_AUTH_NAME_RE.test(featureName))
+        return true;
+      return (focusRoutes ?? []).some((r) => PLANNER_AUTH_ROUTE_RE.test(r));
     }
     async function runCanvasPreflight(ctx, sharedBrowser, log2) {
       const cached = ctx.appRenderType ?? null;
@@ -335704,6 +335873,11 @@ Explore complete: ${exploreResult.pagesDiscovered} pages, ${exploreResult.elemen
           authRedirectRoute: (0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP) ? ctx.authRecipe?.redirectRoute ?? void 0 : void 0,
           // Email-verify capability — only for scenario-producing modes; a survey emits
           // featureGroups (no scenarios), so keep its prompt free of the round-trip block.
+          // This site serves survey + FULL mode. Full mode is app-wide (no single feature
+          // identity here), so we deliberately do NOT apply the auth-feature scope: the
+          // per-scenario generator gates (scenarioLooksLikeRegistration +
+          // scenarioTouchesSignupAuthSurface) still isolate non-auth scenarios. The
+          // auth-feature scope IS applied at the DEEP call site where ctx.featureName is known.
           emailVerifyArmed: mode !== "survey" && plannerEmailVerifyArmed(ctx),
           testBudget
         }, {
@@ -336292,9 +336466,10 @@ Plan (reused): ${resumeSavedScenarios.length} scenarios from the paused run.`);
             // Email-verify capability: when armed, let the planner plan the full
             // register→verify and forgot-password→reset round trips to completion
             // (see the planner's "## Verification Inbox Available" block). Armed on the
-            // SAME project-level predicate the generator uses (flag + register intent +
+            // SAME project-level predicate the generator uses (flag + consent +
             // configured inbox), so the planner never promises what generation can't do.
-            emailVerifyArmed: plannerEmailVerifyArmed(ctx),
+            // Scoped to AUTH features: a non-auth feature has no signup surface to test.
+            emailVerifyArmed: plannerEmailVerifyArmed(ctx) && featureLooksLikeAuth(ctx.featureName, augmentedFeatureFocusAreas),
             testBudget: featureTestBudget
           }, {
             modelOverride: ctx.planModel ?? ctx.generateModel,
@@ -350920,7 +351095,7 @@ var require_package4 = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.64",
+      version: "1.0.66",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"
@@ -359516,13 +359691,14 @@ ${finalVerifyResult.logs ?? ""}`;
             }
           }
         }
+        const auditStatus = info.exitReason === "abort" || info.exitReason === "timeout" ? "ERROR" : "SUCCESS";
         pushAudit({
           projectId: ctx.projectId,
           sessionId: ctx.sessionId,
           callType: info.callType,
           model: info.model,
           provider: info.provider,
-          status: "SUCCESS",
+          status: auditStatus,
           durationMs: info.durationMs,
           promptTokens: info.promptTokens,
           completionTokens: info.completionTokens,
@@ -359539,6 +359715,11 @@ ${finalVerifyResult.logs ?? ""}`;
             discoveryFlowId: run2.runId,
             ...info.callType === "authCapture" ? { featureName: "Login" } : ctx.featureName ? { featureName: ctx.featureName } : {},
             ...ctx.mode ? { discoveryMode: ctx.mode } : {},
+            // Per-session identity for Call-2 rows (parity with execute-run.ts) so
+            // Fix/Author/Cleanup phases are distinguishable in the flow card.
+            ...info.scenarioName ? { scenarioName: info.scenarioName } : {},
+            ...info.sessionKind ? { sessionKind: info.sessionKind } : {},
+            ...info.exitReason ? { exitReason: info.exitReason } : {},
             ...cliCostUsd !== void 0 ? { cliCostUsd } : {},
             ...ledgerAudit ? {
               ledger: ledgerAudit.entries,

package/dist/cli.mjs

@@ -3490,6 +3490,135 @@ var init_audit_pricing = __esm({
   }
 });
 
+// ../shared/dist/audit-grouping.js
+var GROUPABLE_CALL_TYPES, GROUP_LABELS, FLOW_PHASE_TYPES, FLOW_SERVER_TYPES, FLOW_PHASE_LABELS;
+var init_audit_grouping = __esm({
+  "../shared/dist/audit-grouping.js"() {
+    "use strict";
+    GROUPABLE_CALL_TYPES = /* @__PURE__ */ new Set([
+      "healIteration",
+      "healOrchestrator",
+      "generateRegressionSuite",
+      "discoveryExplore",
+      "surveyExplore",
+      "featureExplore",
+      "discoveryGenerate",
+      "discoveryPlan",
+      "discoveryGenerateSkeleton",
+      "discoveryGenerateElementContext",
+      "liveGenerate",
+      "scenarioGenerate",
+      "liveSuiteHeal",
+      "captureIteration",
+      "healAPITest",
+      "generateAPITests",
+      // Auth-prologue login-capture run (runLoginCaptureRun) — per-turn rows share a
+      // groupId so they collapse into one "Login Capture" phase card on /audit.
+      "authCapture",
+      // Assistant chat — rounds of one conversation collapse into one card.
+      "assistantChat"
+    ]);
+    GROUP_LABELS = {
+      healIteration: "healSession",
+      healOrchestrator: "healSession",
+      healAPITest: "apiHealSession",
+      generateRegressionSuite: "regressionSession",
+      generateAPITests: "apiTestGenSession",
+      discoveryExplore: "discoveryExploreSession",
+      surveyExplore: "surveyExploreSession",
+      featureExplore: "featureExploreSession",
+      discoveryGenerate: "discoveryGenerateSession",
+      discoveryGenerateSkeleton: "discoveryGenerateSession",
+      discoveryGenerateElementContext: "discoveryGenerateSession",
+      liveGenerate: "liveGenerateSession",
+      scenarioGenerate: "scenarioGenerateSession",
+      discoveryPlan: "discoveryPlanSession",
+      liveSuiteHeal: "liveSuiteHealSession",
+      captureIteration: "captureIterationSession",
+      authCapture: "authCaptureSession",
+      assistantChat: "assistantChatSession"
+    };
+    FLOW_PHASE_TYPES = /* @__PURE__ */ new Set([
+      "surveyExploreSession",
+      "featureExploreSession",
+      "discoveryAIPlanner",
+      "discoveryPlanSession",
+      "scenarioGenerateSession",
+      "liveGenerateSession",
+      "discoveryGenerateSession",
+      // Raw callTypes (for ungrouped single-turn entries like planner)
+      "surveyExplore",
+      "featureExplore",
+      "discoveryPlan",
+      "scenarioGenerate",
+      "liveGenerate",
+      "discoveryGenerate",
+      // Planner repair / retry / strengthen-gate — the one-shot extra planner call
+      // shares the base planner's discoveryFlowId, so it nests as its own phase
+      // instead of dangling as a raw camelCase row.
+      "discoveryAIPlannerRepair",
+      "discoveryAIPlannerRetry",
+      "discoveryAIPlannerStrengthenGate",
+      // Deep-run feature analyst insight (one call per feature discovery).
+      "featureInsight",
+      // Discovery v2 Call-1-authoring pivot — per-test Call 2 spawns. Each session
+      // has its OWN sessionId but shares the parent discoveryFlowId, so grouping by
+      // flowId pulls them under the same Discovery Flow card. `Cleanup` is the
+      // teardown sibling of Fix/Author and nests the same way.
+      "discoveryCall2Fix",
+      "discoveryCall2Author",
+      "discoveryCall2Cleanup",
+      // Auth-prologue login-capture run — grouped label + raw callType.
+      "authCaptureSession",
+      "authCapture"
+    ]);
+    FLOW_SERVER_TYPES = /* @__PURE__ */ new Set([
+      "healthAnalysis",
+      "apiSecurityAudit",
+      "apiSecurityAuditVerify",
+      "generateAPITests",
+      "apiTestGenSession",
+      "healAPITest",
+      "apiHealSession",
+      "healSession",
+      "healIteration"
+    ]);
+    FLOW_PHASE_LABELS = {
+      surveyExploreSession: "Survey Explore",
+      featureExploreSession: "Feature Explore",
+      discoveryAIPlanner: "Feature Analyst",
+      discoveryAIPlannerRepair: "Planner Repair",
+      discoveryAIPlannerRetry: "Planner Retry",
+      discoveryAIPlannerStrengthenGate: "Planner Strengthen Gate",
+      discoveryPlanSession: "Survey Planner",
+      scenarioGenerateSession: "Scenario Gen",
+      liveGenerateSession: "Live Browser Gen",
+      discoveryGenerateSession: "Test Generation",
+      surveyExplore: "Survey Explore",
+      featureExplore: "Feature Explore",
+      discoveryPlan: "Planner",
+      scenarioGenerate: "Scenario Gen",
+      liveGenerate: "Live Browser Gen",
+      discoveryGenerate: "Test Generation",
+      discoveryCall2Fix: "Call 2 Fix",
+      discoveryCall2Author: "Call 2 Author",
+      discoveryCall2Cleanup: "Call 2 Cleanup",
+      featureInsight: "Feature Insight",
+      healthAnalysis: "Health Analysis",
+      apiSecurityAudit: "Security Audit",
+      apiSecurityAuditVerify: "Security Verify",
+      generateAPITests: "API Test Gen",
+      apiTestGenSession: "API Test Gen",
+      healAPITest: "API Test Heal",
+      apiHealSession: "API Test Heal",
+      healSession: "Heal Session",
+      healIteration: "Heal",
+      authCapture: "Login Capture",
+      authCaptureSession: "Login Capture"
+    };
+  }
+});
+
 // ../shared/dist/discovery-har-decision.js
 function decideHarPosted(response) {
   if (!response)
@@ -5855,6 +5984,11 @@ __export(dist_exports, {
   DEFAULT_UI_VARIANT: () => DEFAULT_UI_VARIANT,
   EMAIL_FROM_IDENTITIES: () => EMAIL_FROM_IDENTITIES,
   ENVIRONMENTAL_ERROR_PREFIXES: () => ENVIRONMENTAL_ERROR_PREFIXES,
+  FLOW_PHASE_LABELS: () => FLOW_PHASE_LABELS,
+  FLOW_PHASE_TYPES: () => FLOW_PHASE_TYPES,
+  FLOW_SERVER_TYPES: () => FLOW_SERVER_TYPES,
+  GROUPABLE_CALL_TYPES: () => GROUPABLE_CALL_TYPES,
+  GROUP_LABELS: () => GROUP_LABELS,
   LEGACY_TTS_VOICE_ID_MAP: () => LEGACY_TTS_VOICE_ID_MAP,
   MAX_CREDIT_TOPUP_CENTS: () => MAX_CREDIT_TOPUP_CENTS,
   MAX_DEEPLINK_LENGTH: () => MAX_DEEPLINK_LENGTH,
@@ -6038,6 +6172,7 @@ var init_dist = __esm({
     init_mobile_deeplink();
     init_plans();
     init_audit_pricing();
+    init_audit_grouping();
     init_discovery_har_decision();
     init_assertion_classifier();
     init_assertion_strength();
@@ -73494,6 +73629,7 @@ var require_inbox_tools = __commonJS({
     exports.buildInboxPromptBlock = buildInboxPromptBlock;
     exports.guardVerificationCodeFabrication = guardVerificationCodeFabrication;
     exports.hasRegisterIntent = hasRegisterIntent;
+    exports.hasSignupTestIntent = hasSignupTestIntent;
     exports.resolveInboxRegistration = resolveInboxRegistration;
     exports.applyInboxRegistrationIdentity = applyInboxRegistrationIdentity;
     exports.isThrowawayRegisterSeedEmail = isThrowawayRegisterSeedEmail;
@@ -74037,6 +74173,9 @@ This project asked to REGISTER a new account, but this runner CANNOT receive ema
       const v = variableContext.allTestVariables?.DISCOVERY_SHOULD_REGISTER ?? variableContext.publicTestVariables?.DISCOVERY_SHOULD_REGISTER ?? "";
       return String(v).trim().toLowerCase() === "true";
     }
+    function hasSignupTestIntent(variableContext) {
+      return variableContext?.allTestVariables?.DISCOVERY_ALLOW_SIGNUP_TESTS !== "false";
+    }
     function resolveInboxRegistration(opts) {
       const config = (0, verification_inbox_js_1.loadVerificationInboxConfig)(opts.env ?? process.env);
       if (!config)
@@ -94985,6 +95124,8 @@ var require_discover_generator = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.MIN_BUG_DESCRIPTION_LENGTH = exports.VALID_PLAYWRIGHT_GETBY_METHODS = exports.BLOCKED_MCP_TOOLS_SCENARIO_GEN = void 0;
     exports.scenarioLooksLikeRegistration = scenarioLooksLikeRegistration;
+    exports.signupFeatureTestingAllowed = signupFeatureTestingAllowed;
+    exports.scenarioTouchesSignupAuthSurface = scenarioTouchesSignupAuthSurface;
     exports.filterMcpToolsForScenarioGen = filterMcpToolsForScenarioGen;
     exports.detectScenarioSignals = detectScenarioSignals;
     exports.scenarioStepsCoverAuth = scenarioStepsCoverAuth;
@@ -95072,6 +95213,19 @@ EMIT (the code you put in finish_generate) \u2014 do NOT hardcode the throwaway
 - Tag the test \`@email-verify\`. Emit EXACTLY ONE test() in this file (one registration per run).
 - End with a DURABLE assertion of the post-verification signed-in state (e.g. a Logout control, an account/dashboard landmark) in your OWN test body \u2014 the helper call is not itself a proof.`;
     }
+    function signupFeatureTestingAllowed(credentials) {
+      if (!(0, discovery_lint_flags_js_1.isTestgenEmailVerifyEnabled)() || !(0, verification_inbox_js_1.loadVerificationInboxConfig)())
+        return false;
+      return credentials?.DISCOVERY_ALLOW_SIGNUP_TESTS !== "false";
+    }
+    var SIGNUP_AUTH_ROUTE_RE = /\/(sign-?up|verify-?email|email-?verification|create-?account|confirm-?email)\b/i;
+    function scenarioTouchesSignupAuthSurface(scenario, pages) {
+      const routes = [scenario.entryRoute, ...scenario.targetPages ?? []].filter((r) => !!r);
+      if (routes.some((r) => SIGNUP_AUTH_ROUTE_RE.test(r)))
+        return true;
+      const authRoutes = new Set(pages.filter((p) => (p.pageType ?? "").toUpperCase() === "AUTH").map((p) => p.route));
+      return routes.some((r) => authRoutes.has(r));
+    }
     exports.BLOCKED_MCP_TOOLS_SCENARIO_GEN = /* @__PURE__ */ new Set([
       "browser_install",
       "browser_close",
@@ -98183,9 +98337,16 @@ ${tailBlock}`;
           extraAuthEvidence: !!opts?.recipe || hasConfiguredLoginCredentials(credentials)
         });
         const baseSkeletonHadRegression = tags.includes("@regression");
+        const selfProvisioningSignupScenario = signupFeatureTestingAllowed(credentials) && scenarioLooksLikeRegistration(scenario) && scenarioTouchesSignupAuthSurface(scenario, siteMap.pages);
+        if (selfProvisioningSignupScenario) {
+          for (const prereqTag of ["@needs-auth", "@inline-login", "@auth-guarded"]) {
+            const idx = tags.indexOf(prereqTag);
+            if (idx !== -1)
+              tags.splice(idx, 1);
+          }
+        }
         const hasVerifiedRecipe = !!opts?.recipe && tags.includes("@needs-auth");
-        const projectHasRegisterIntent = credentials?.DISCOVERY_SHOULD_REGISTER === "true";
-        const inboxGenConfig = (0, discovery_lint_flags_js_1.isTestgenEmailVerifyEnabled)() && projectHasRegisterIntent && !hasVerifiedRecipe && scenarioLooksLikeRegistration(scenario) ? (0, verification_inbox_js_1.loadVerificationInboxConfig)() : null;
+        const inboxGenConfig = selfProvisioningSignupScenario ? (0, verification_inbox_js_1.loadVerificationInboxConfig)() : null;
         let genInboxState = null;
         let genInboxCredentials = credentials;
         let genInboxSecret = null;
@@ -99132,7 +99293,8 @@ Scenario: "${scenario.name}" (${scenario.type})`);
             } catch {
             }
             const recipe = authRecipe;
-            const replayLogin = shouldReplayAuthRecipe(scenario.targetPages, siteMap.pages, recipe);
+            const selfProvisioningSignupScenario = signupFeatureTestingAllowed(credentials) && scenarioLooksLikeRegistration(scenario) && scenarioTouchesSignupAuthSurface(scenario, siteMap.pages);
+            const replayLogin = !selfProvisioningSignupScenario && shouldReplayAuthRecipe(scenario.targetPages, siteMap.pages, recipe);
             let effectiveRecipe = null;
             if (replayLogin && recipe) {
               const planLeaks = findSensitiveLiteralLeaks(JSON.stringify(recipe.replayPlan ?? []), credentials);
@@ -99239,7 +99401,8 @@ Scenario: "${scenario.name}" (${scenario.type})`);
             return;
           }
           let effectiveRecipe = null;
-          if (shouldReplayAuthRecipe(scenario.targetPages, siteMap.pages, authRecipe) && authRecipe) {
+          const selfProvisioningSignupScenario = signupFeatureTestingAllowed(credentials) && scenarioLooksLikeRegistration(scenario) && scenarioTouchesSignupAuthSurface(scenario, siteMap.pages);
+          if (!selfProvisioningSignupScenario && shouldReplayAuthRecipe(scenario.targetPages, siteMap.pages, authRecipe) && authRecipe) {
             const planLeaks = findSensitiveLiteralLeaks(JSON.stringify(authRecipe.replayPlan ?? []), credentials);
             if (planLeaks.length > 0) {
               scenarioLogs.push(`  Warning: login replay plan contains literal credential value(s) for ${planLeaks.join(", ")} \u2014 falling back to model-authored login for "${scenario.name}"`);
@@ -335040,6 +335203,7 @@ var require_discover_agent = __commonJS({
     var discover_ai_planner_js_1 = require_discover_ai_planner();
     var discovery_lint_flags_js_1 = require_discovery_lint_flags();
     var verification_inbox_js_1 = require_verification_inbox();
+    var inbox_tools_js_1 = require_inbox_tools();
     var sitemap_builder_js_1 = require_sitemap_builder();
     Object.defineProperty(exports, "buildInMemorySiteMap", { enumerable: true, get: function() {
       return sitemap_builder_js_1.buildInMemorySiteMap;
@@ -335053,11 +335217,16 @@ var require_discover_agent = __commonJS({
     var canvas_detector_js_1 = require_canvas_detector();
     var auth_recipe_js_1 = require_auth_recipe();
     function plannerEmailVerifyArmed(ctx) {
-      if (!(0, discovery_lint_flags_js_1.isTestgenEmailVerifyEnabled)())
-        return false;
-      if (ctx.variableContext?.allTestVariables?.DISCOVERY_SHOULD_REGISTER !== "true")
+      if (!(0, discovery_lint_flags_js_1.isTestgenEmailVerifyEnabled)() || !(0, verification_inbox_js_1.loadVerificationInboxConfig)())
         return false;
-      return (0, verification_inbox_js_1.isVerificationInboxConfigured)();
+      return (0, inbox_tools_js_1.hasSignupTestIntent)(ctx.variableContext);
+    }
+    var PLANNER_AUTH_NAME_RE = /\b(auth|authentication|log[\s-]?in|sign[\s-]?in|sign[\s-]?up|signup|account|password|verify[\s-]?email)\b/i;
+    var PLANNER_AUTH_ROUTE_RE = /\/(auth|login|sign-?in|sign-?up|signup|verify-?email|create-?account)\b/i;
+    function featureLooksLikeAuth(featureName, focusRoutes) {
+      if (featureName && PLANNER_AUTH_NAME_RE.test(featureName))
+        return true;
+      return (focusRoutes ?? []).some((r) => PLANNER_AUTH_ROUTE_RE.test(r));
     }
     async function runCanvasPreflight(ctx, sharedBrowser, log2) {
       const cached = ctx.appRenderType ?? null;
@@ -335709,6 +335878,11 @@ Explore complete: ${exploreResult.pagesDiscovered} pages, ${exploreResult.elemen
           authRedirectRoute: (0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP) ? ctx.authRecipe?.redirectRoute ?? void 0 : void 0,
           // Email-verify capability — only for scenario-producing modes; a survey emits
           // featureGroups (no scenarios), so keep its prompt free of the round-trip block.
+          // This site serves survey + FULL mode. Full mode is app-wide (no single feature
+          // identity here), so we deliberately do NOT apply the auth-feature scope: the
+          // per-scenario generator gates (scenarioLooksLikeRegistration +
+          // scenarioTouchesSignupAuthSurface) still isolate non-auth scenarios. The
+          // auth-feature scope IS applied at the DEEP call site where ctx.featureName is known.
           emailVerifyArmed: mode !== "survey" && plannerEmailVerifyArmed(ctx),
           testBudget
         }, {
@@ -336297,9 +336471,10 @@ Plan (reused): ${resumeSavedScenarios.length} scenarios from the paused run.`);
             // Email-verify capability: when armed, let the planner plan the full
             // register→verify and forgot-password→reset round trips to completion
             // (see the planner's "## Verification Inbox Available" block). Armed on the
-            // SAME project-level predicate the generator uses (flag + register intent +
+            // SAME project-level predicate the generator uses (flag + consent +
             // configured inbox), so the planner never promises what generation can't do.
-            emailVerifyArmed: plannerEmailVerifyArmed(ctx),
+            // Scoped to AUTH features: a non-auth feature has no signup surface to test.
+            emailVerifyArmed: plannerEmailVerifyArmed(ctx) && featureLooksLikeAuth(ctx.featureName, augmentedFeatureFocusAreas),
             testBudget: featureTestBudget
           }, {
             modelOverride: ctx.planModel ?? ctx.generateModel,
@@ -350925,7 +351100,7 @@ var require_package4 = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.64",
+      version: "1.0.66",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"
@@ -359524,13 +359699,14 @@ ${finalVerifyResult.logs ?? ""}`;
             }
           }
         }
+        const auditStatus = info.exitReason === "abort" || info.exitReason === "timeout" ? "ERROR" : "SUCCESS";
         pushAudit({
           projectId: ctx.projectId,
           sessionId: ctx.sessionId,
           callType: info.callType,
           model: info.model,
           provider: info.provider,
-          status: "SUCCESS",
+          status: auditStatus,
           durationMs: info.durationMs,
           promptTokens: info.promptTokens,
           completionTokens: info.completionTokens,
@@ -359547,6 +359723,11 @@ ${finalVerifyResult.logs ?? ""}`;
             discoveryFlowId: run2.runId,
             ...info.callType === "authCapture" ? { featureName: "Login" } : ctx.featureName ? { featureName: ctx.featureName } : {},
             ...ctx.mode ? { discoveryMode: ctx.mode } : {},
+            // Per-session identity for Call-2 rows (parity with execute-run.ts) so
+            // Fix/Author/Cleanup phases are distinguishable in the flow card.
+            ...info.scenarioName ? { scenarioName: info.scenarioName } : {},
+            ...info.sessionKind ? { sessionKind: info.sessionKind } : {},
+            ...info.exitReason ? { exitReason: info.exitReason } : {},
             ...cliCostUsd !== void 0 ? { cliCostUsd } : {},
             ...ledgerAudit ? {
               ledger: ledgerAudit.entries,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@validate.qa/runner",
-  "version": "1.0.64",
+  "version": "1.0.66",
   "description": "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
   "bin": {
     "validate-runner": "dist/cli.js"