@validate.qa/runner 1.0.86 → 1.0.88

package/dist/cli.js

@@ -83734,6 +83734,9 @@ ${statePacket}`, redactionCredentials) },
       if (isContentActionScenario(scenario)) {
         return false;
       }
+      if (isFormValidationScenario(scenario)) {
+        return false;
+      }
       const text = scenarioText(scenario);
       const visibilityOnlyGoal = (/\b(entry\s+points?|providers?|provider\s+buttons?|sign[- ]?in\s+options|auth(?:entication)?\s+options|available\s+options)\b/.test(text) || /\b(show|display)\s+(all\s+)?(the\s+)?(providers?|options|buttons?|links?|entry\s+points?)\b/.test(text) || /\b(all\s+(three\s+)?providers?)\b/.test(text)) && !/\b(change|update|create|save|send|register|edit|with\s+valid|successful\s+(sign|log)|complete\s+(the\s+)?(login|sign[- ]?in)|submit\s+(the\s+)?(form|credentials)|enter\s+(an?\s+)?(email|password))\b/.test(text);
       if (visibilityOnlyGoal) {
@@ -83899,8 +83902,8 @@ ${statePacket}`, redactionCredentials) },
         if (isNavChromeThrashTrace(actions)) {
           return "content-action scenario only recorded tab thrash / swipes \u2014 no product action";
         }
-        const asserts = actions.filter((a) => a.type === "ASSERT_VISIBLE" || a.type === "ASSERT_TEXT");
-        if (asserts.length > 0 && asserts.every((a) => VOLATILE_BADGE_ASSERT_RE.test(actionText(a)) || NAV_CHROME_TAP_RE.test(actionText(a)) && !CONTENT_ACTION_VERB_RE.test(actionText(a)))) {
+        const asserts2 = actions.filter((a) => a.type === "ASSERT_VISIBLE" || a.type === "ASSERT_TEXT");
+        if (asserts2.length > 0 && asserts2.every((a) => VOLATILE_BADGE_ASSERT_RE.test(actionText(a)) || NAV_CHROME_TAP_RE.test(actionText(a)) && !CONTENT_ACTION_VERB_RE.test(actionText(a)))) {
           return "content-action scenario only asserted tab chrome or a volatile badge count \u2014 assert the action outcome instead";
         }
         return null;
@@ -83937,12 +83940,15 @@ ${statePacket}`, redactionCredentials) },
         const hasValidationAssert = actions.some((a) => {
           if (a.type !== "ASSERT_VISIBLE" && a.type !== "ASSERT_TEXT")
             return false;
-          return /\b(error|required|invalid|empty|missing|incorrect|wrong|try again|mismatch|does not match|must match)\b/.test(actionText(a));
+          return /\b(error|required|invalid|empty|missing|incorrect|wrong|try again|mismatch|does not match|must match|cannot be empty|please enter|fill out|is required)\b/.test(actionText(a));
         });
         const emptyFieldIntent = /\b(empty|required|missing|blank)\b/.test(text);
         const invalidValueIntent = /\b(wrong|incorrect|invalid|mismatch|reject)\b/.test(text);
+        if (!hasValidationAssert) {
+          return "validation scenario did not assert a validation/error outcome (commit alone is not proof)";
+        }
         if (emptyFieldIntent && !invalidValueIntent) {
-          if (!hasCommit && !hasValidationAssert) {
+          if (!hasCommit) {
             return "validation scenario did not record a form commit or validation outcome";
           }
           return null;
@@ -83950,7 +83956,7 @@ ${statePacket}`, redactionCredentials) },
         if (typedFields && !hasCommit) {
           return "validation scenario filled fields but never committed the form";
         }
-        if (!hasCommit && !hasValidationAssert) {
+        if (!hasCommit) {
           return "validation scenario did not record a form commit or validation outcome";
         }
         return null;
@@ -83964,6 +83970,10 @@ ${statePacket}`, redactionCredentials) },
         if (!hasCommit) {
           return "form-mutation happy path did not record a form commit";
         }
+        const asserts2 = actions.filter((a) => a.type === "ASSERT_VISIBLE" || a.type === "ASSERT_TEXT");
+        if (asserts2.length > 0 && asserts2.every((a) => NAV_CHROME_TAP_RE.test(actionText(a)) || VOLATILE_BADGE_ASSERT_RE.test(actionText(a)) || isStructuralOnlyAssert(a) || isEphemeralContentAssertText(assertIdentityText(a)))) {
+          return "form-mutation happy path only asserted tab chrome or ephemeral content \u2014 assert the saved/updated product outcome";
+        }
       }
       const isCredentialSignIn = /\b(sign\s*in|log\s*in|login|authenticate|auth)\b/.test(text) && /\b(email|e-mail|password|credential|valid credentials?)\b/.test(text) && !/\b(reset|forgot|recover|logout|log\s*out|sign\s*out|change\s+password|update\s+password)\b/.test(text);
       const typedEmailIndexes = [];
@@ -84056,13 +84066,70 @@ ${statePacket}`, redactionCredentials) },
         if (!actions.some((a) => isProductiveScenarioAction(a, text))) {
           return "happy-path / user-journey scenario did not record a productive product action (only chrome, gestures, or empty work)";
         }
-        const asserts = actions.filter((a) => a.type === "ASSERT_VISIBLE" || a.type === "ASSERT_TEXT");
-        if (asserts.length > 0 && asserts.every((a) => VOLATILE_BADGE_ASSERT_RE.test(actionText(a)) || isStructuralOnlyAssert(a))) {
+        const asserts2 = actions.filter((a) => a.type === "ASSERT_VISIBLE" || a.type === "ASSERT_TEXT");
+        if (asserts2.length > 0 && asserts2.every((a) => VOLATILE_BADGE_ASSERT_RE.test(actionText(a)) || isStructuralOnlyAssert(a))) {
           return "happy-path / user-journey scenario only asserted volatile badges or structural roots \u2014 assert a durable feature outcome";
         }
       }
+      const goalFidelity = scenarioGoalActionFidelityReason(text, actions);
+      if (goalFidelity)
+        return goalFidelity;
+      if (actions.some((a) => isBareHierarchyFieldAction(a))) {
+        return "typed or tapped a bare hierarchy/container target with no accessible label \u2014 use a labeled field/control";
+      }
+      const asserts = actions.filter((a) => a.type === "ASSERT_VISIBLE" || a.type === "ASSERT_TEXT");
+      if (asserts.length > 0 && asserts.every((a) => isEphemeralContentAssertText(assertIdentityText(a)))) {
+        return "only asserted ephemeral feed/catalog content (session-specific titles/ids) \u2014 assert durable product chrome or stable outcome";
+      }
       return null;
     }
+    function scenarioGoalActionFidelityReason(scenarioTextLower, actions) {
+      const actionBlob = actions.map((a) => actionText(a)).join(" ").toLowerCase();
+      if (/\b(pick|choose|select)\b.*\b(library|gallery|photos?|camera\s*roll|device)\b|\bfrom\s+(the\s+)?(library|gallery|photos?)\b/.test(scenarioTextLower)) {
+        if (!/\b(library|gallery|photos?|camera\s*roll|pick\s+a\s+video|choose\s+(a\s+)?(video|photo|file)|from\s+library|document\s*picker|media\s*picker)\b/i.test(actionBlob)) {
+          return "scenario claims pick-from-library but recording never tapped a library/gallery/picker control";
+        }
+      }
+      if (/\b(style|styles)\b/.test(scenarioTextLower) && /\b(format|aspect|ratio|quality|reels?|9:16|16:9)\b/.test(scenarioTextLower)) {
+        const pickedStyle = /\b(style|cinematic|anime|realistic|no\s*style|cartoon|oil\s*paint)\b/i.test(actionBlob);
+        const pickedFormat = /\b(9:16|16:9|1:1|reels?|aspect|quality|format|720|1080)\b/i.test(actionBlob);
+        if (!pickedStyle || !pickedFormat) {
+          return "scenario claims style+format selection but recording did not select both a style and a format/aspect control";
+        }
+      }
+      if (/\b(open|launch|start)\b.*\b(camera|recording)\b|\brecord\s+a\s+video\b/.test(scenarioTextLower)) {
+        if (!/\b(camera|record|recording|flash|flip\s+camera|capture|shutter)\b/i.test(actionBlob)) {
+          return "scenario claims open/record camera but recording never reached camera controls";
+        }
+      }
+      return null;
+    }
+    function isBareHierarchyFieldAction(action) {
+      if (action.type !== "TYPE" && action.type !== "CLEAR")
+        return false;
+      const sel = (action.selector ?? "").trim();
+      if (!/^\/hierarchy/i.test(sel))
+        return false;
+      const bundle = action.metadata.locatorBundle;
+      const label = (action.metadata.targetLabel ?? "").trim();
+      if (label && !/^element$/i.test(label))
+        return false;
+      const inner = nonEmpty3(action.innerText);
+      if (inner && !/^element$/i.test(inner))
+        return false;
+      if (nonEmpty3(bundle?.text) || nonEmpty3(bundle?.contentDesc) || nonEmpty3(bundle?.accessibilityId)) {
+        return false;
+      }
+      if (nonEmpty3(bundle?.resourceId) && !isStructuralAssertionIdentity(bundle?.resourceId)) {
+        return false;
+      }
+      if (action.type === "TYPE") {
+        const v = (action.value ?? "").replace(/\s+/g, "");
+        if (v.length > 0)
+          return false;
+      }
+      return true;
+    }
     function actionCycleKey(action) {
       return `${action.type}|${action.selector}|${action.value ?? ""}`;
     }
@@ -84332,6 +84399,15 @@ ${statePacket}`, redactionCredentials) },
       if (t.length >= 40 && /\b(error\s+\d{3,}|generation failed|rate limit|quota exceeded)\b/i.test(t)) {
         return true;
       }
+      if (/\b(harness|seed|fixture|demo\s*data|test\s*artist|qa\s*published)\b/i.test(t) && /\d{6,}/.test(t)) {
+        return true;
+      }
+      if (/\bplay\b.+\bby\b.+/i.test(t) && (t.length >= 40 || /\d{6,}/.test(t))) {
+        return true;
+      }
+      if (/^play\s+/i.test(t) && t.length >= 35 && !/\b(home|search|settings|profile|library|playlist|sign\s*in|log\s*in)\b/i.test(t)) {
+        return true;
+      }
       return false;
     }
     function assertIdentityText(action) {
@@ -87668,6 +87744,7 @@ var require_auth_recipe = __commonJS({
     var START_MARKER = `// >>> VALIDATE_QA_AUTH ${exports2.AUTH_MARKER_VERSION} \u2014 generated, do not edit >>>`;
     var END_MARKER = `// <<< VALIDATE_QA_AUTH ${exports2.AUTH_MARKER_VERSION} <<<`;
     var SHARED_AUTH_RUNTIME_ENABLED = `!/^false$/i.test((process.env.SHARED_AUTH_INJECT ?? '').trim())`;
+    var WARM_PROOF_SETTLE_MS = 8e3;
     var AUTH_REGION_RE = /\/\/ >>> VALIDATE_QA_AUTH[^\n]*\r?\n[\s\S]*?\/\/ <<< VALIDATE_QA_AUTH[^\n]*\r?\n?/g;
     function computeRecipeHash(input) {
       const canonical = JSON.stringify({
@@ -87803,12 +87880,20 @@ ${tabs}`);
           const pred = urlProofPredicateExpr(recipe.authProof.route, recipe.authProof.exact);
           lines.push(`    await page.waitForURL((u) => !(${pred})(u), { timeout: 2000 }).catch(() => {});`);
           lines.push(`    if ((${pred})(new URL(page.url())) && !(await page.locator('input[type="password"]').first().isVisible().catch(() => false))) return;`);
-        } else if (loginRoute) {
-          lines.push(`    if (await ${authProofLocator(recipe.authProof)}.isVisible().catch(() => false) && new URL(page.url()).pathname !== new URL(${JSON.stringify(loginRoute)}, page.url()).pathname) return;`);
         } else {
-          lines.push(`    if (await ${authProofLocator(recipe.authProof)}.isVisible().catch(() => false)) return;`);
+          const proofSettle = `await ${authProofLocator(recipe.authProof)}.waitFor({ state: 'visible', timeout: ${WARM_PROOF_SETTLE_MS} }).then(() => true).catch(() => false)`;
+          if (loginRoute) {
+            lines.push(`    if (new URL(page.url()).pathname !== new URL(${JSON.stringify(loginRoute)}, page.url()).pathname && ${proofSettle}) return;`);
+          } else {
+            lines.push(`    if (${proofSettle}) return;`);
+          }
         }
         lines.push(`  }`);
+        lines.push(`  if (${SHARED_AUTH_RUNTIME_ENABLED}) {`);
+        lines.push(`    await page.context().clearCookies().catch(() => {});`);
+        lines.push(`    await page.goto(${JSON.stringify(recipe.preNavRoute)}, { waitUntil: 'domcontentloaded' }).catch(() => {});`);
+        lines.push(`    await page.evaluate(() => { try { localStorage.clear(); sessionStorage.clear(); } catch {} }).catch(() => {});`);
+        lines.push(`  }`);
       }
       lines.push(`  await page.goto(${JSON.stringify(recipe.preNavRoute)}, { waitUntil: 'domcontentloaded' });`);
       for (const cmd of recipe.preNavCmds)
@@ -95761,6 +95846,32 @@ var require_agentic_discovery_prompts = __commonJS({
       lines.push("For a pure navigation or page-load scenario (no in-page mutation), URL + one");
       lines.push("structural heading is sufficient.");
       lines.push("");
+      lines.push("**Stop at the gate for expensive or irreversible actions.** Some controls");
+      lines.push("start work that costs the account real money (an AI generation, a paid");
+      lines.push("third-party call, a checkout), takes minutes to finish, or cannot be undone");
+      lines.push("(delete, publish, cancel a subscription). Do NOT press them. The regression");
+      lines.push("risk lives in the wiring, and the wiring is fully provable for free:");
+      lines.push("- Assert the control is present and correctly ENABLED/DISABLED by its inputs.");
+      lines.push("- If it opens a dialog, assert the dialog, its fields and its confirm button,");
+      lines.push("  then press Cancel and assert nothing changed.");
+      lines.push("- Assert the auth / quota wall fires for a caller who should be refused.");
+      lines.push("A test that waits minutes for generated output cannot finish inside the run");
+      lines.push("budget, bills the account on every run, and leaves permanent rows behind. If");
+      lines.push("the ONLY way to prove a scenario is to trigger such an action, drop it as a");
+      lines.push("gap rather than emitting a test that does.");
+      lines.push("");
+      lines.push("**Never sign up a new account.** Use the injected credentials. Registering a");
+      lines.push("`testuser-<timestamp>` account to get past a login wall leaves a permanent,");
+      lines.push("unowned user in the target database on every single run. Registration is in");
+      lines.push("scope ONLY when the scenario under test IS registration, in which case use");
+      lines.push("the provided inbox helper so the account is tracked and reaped.");
+      lines.push("");
+      lines.push("**Write the assertion so the BUG fails it.** When a scenario documents broken");
+      lines.push("behaviour, still assert the CORRECT outcome. A test that passes because the");
+      lines.push("error message / console error / not-found page is present inverts the suite:");
+      lines.push("fixing the bug turns the test red and the fix is reported as a regression.");
+      lines.push("State the intended behaviour, let it fail, and flag it as a bug.");
+      lines.push("");
       lines.push("## Tools");
       lines.push("");
       lines.push("Browser MCP: `browser_navigate`, `browser_snapshot`, `browser_click`,");
@@ -96570,7 +96681,7 @@ var require_discover_generator = __commonJS({
   "../runner-core/dist/services/discover-generator.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.MIN_BUG_DESCRIPTION_LENGTH = exports2.VALID_PLAYWRIGHT_GETBY_METHODS = exports2.BLOCKED_MCP_TOOLS_SCENARIO_GEN = void 0;
+    exports2.MIN_BUG_DESCRIPTION_LENGTH = exports2.NAME_PROHIBITED_ROLES = exports2.VALID_PLAYWRIGHT_GETBY_METHODS = exports2.BLOCKED_MCP_TOOLS_SCENARIO_GEN = void 0;
     exports2.scenarioLooksLikeRegistration = scenarioLooksLikeRegistration;
     exports2.signupFeatureTestingAllowed = signupFeatureTestingAllowed;
     exports2.scenarioTouchesSignupAuthSurface = scenarioTouchesSignupAuthSurface;
@@ -96600,6 +96711,7 @@ var require_discover_generator = __commonJS({
     exports2.scanFragileStructuralLocators = scanFragileStructuralLocators;
     exports2.bannedRoleTokensInSelector = bannedRoleTokensInSelector;
     exports2.scanInvalidRoleTagLocators = scanInvalidRoleTagLocators;
+    exports2.scanNameProhibitedRoleLocators = scanNameProhibitedRoleLocators;
     exports2.scanHealedRoleTagLocators = scanHealedRoleTagLocators;
     exports2.validateFinalActionFidelity = validateFinalActionFidelity;
     exports2.resolveSuspectedBugVerdict = resolveSuspectedBugVerdict;
@@ -99667,10 +99779,55 @@ ${testOpen}`;
       }
       return findings;
     }
+    exports2.NAME_PROHIBITED_ROLES = /* @__PURE__ */ new Set([
+      "caption",
+      "code",
+      "deletion",
+      "emphasis",
+      "generic",
+      "insertion",
+      "mark",
+      "none",
+      "paragraph",
+      "presentation",
+      "strong",
+      "subscript",
+      "superscript",
+      "term",
+      "time"
+    ]);
+    function scanNameProhibitedRoleLocators(code) {
+      const findings = [];
+      const seen = /* @__PURE__ */ new Set();
+      const scanCode = code.replace(/\/\*[\s\S]*?\*\//g, (m) => m.replace(/[^\n]/g, " "));
+      const RE = /getByRole\(\s*(['"`])([a-zA-Z]+)\1\s*,\s*\{[^}]*\bname\s*:/g;
+      for (const rawLine of scanCode.split("\n")) {
+        const line = rawLine.replace(/\/\/.*$/, "");
+        if (line.indexOf("getByRole(") === -1)
+          continue;
+        RE.lastIndex = 0;
+        let m;
+        while ((m = RE.exec(line)) !== null) {
+          const role = m[2].toLowerCase();
+          if (!exports2.NAME_PROHIBITED_ROLES.has(role))
+            continue;
+          const key = `${rawLine.trim()} ${role}`;
+          if (seen.has(key))
+            continue;
+          seen.add(key);
+          findings.push({
+            line: rawLine.trim().slice(0, 200),
+            role,
+            reason: `ARIA prohibits an accessible name on role "${role}", so no element ever exposes one \u2014 getByRole('${role}', { name: \u2026 }) matches ZERO nodes and the assertion hangs to its timeout. Match the text instead: page.getByText('\u2026', { exact: true }), optionally scoped (e.g. page.getByRole('main').getByText('\u2026')). If you need the element itself, select a nameable ancestor (region/listitem/link/button) and assert its text.`
+          });
+        }
+      }
+      return findings;
+    }
     function scanHealedRoleTagLocators(code, opts) {
       const inboxStripped = (0, inbox_stamp_js_1.stripInboxRegions)(code);
       const scanned = opts?.stripAuth === false ? inboxStripped : (0, auth_recipe_js_1.stripAuthRegions)(inboxStripped);
-      return scanInvalidRoleTagLocators(scanned);
+      return [...scanInvalidRoleTagLocators(scanned), ...scanNameProhibitedRoleLocators(scanned)];
     }
     function validateFinalActionFidelity(playwrightCode, actionLedger, credentials, opts) {
       const ledgerSigs = [];
@@ -100391,7 +100548,7 @@ Do NOT add steps you did not execute. Do NOT skip steps from the recording.${led
                   continue;
                 }
                 const roleTagMode = (0, discovery_lint_flags_js_1.roleTagLocatorLintMode)();
-                const roleTagFindings = roleTagMode !== "off" ? scanInvalidRoleTagLocators((0, auth_recipe_js_1.stripAuthRegions)((0, inbox_stamp_js_1.stripInboxRegions)(validated[0].playwrightCode))) : [];
+                const roleTagFindings = roleTagMode !== "off" ? scanHealedRoleTagLocators(validated[0].playwrightCode) : [];
                 if (roleTagMode === "warn" && roleTagFindings.length > 0) {
                   logs2.push(`    Role-tag locator gate [warn]: ${roleTagFindings.length} role-as-CSS-tag locator(s) \u2014 ${roleTagFindings.map((f) => sanitizeLedgerText(f.line)).join(" | ").slice(0, 300)}`);
                 }
@@ -100404,12 +100561,10 @@ Do NOT add steps you did not execute. Do NOT skip steps from the recording.${led
                     valid: false,
                     revisionRequired: true,
                     reason: "invalid_role_tag_locator",
-                    instruction: targeted ? `One or more locators below use an ARIA ROLE as a CSS tag selector, e.g. page.locator('textbox[name^="code"]'). There is no <textbox>/<checkbox>/<heading> HTML element, so page.locator() matches ZERO nodes and the action hangs until the test times out.
-For EACH flagged locator, rewrite it as a real Playwright locator:
-1. Prefer page.getByRole('<role>', { name: '<accessible name>' }) \u2014 the role is the token you wrongly put in the CSS.
-2. Or page.getByLabel('<label>'), or a type-scoped CSS like page.locator('input[type="text"]') / input[type="email"].
-3. For a verification-code field, prefer the injected helper: await __vqaEnterVerificationCode(page, code).
-Keep every other line exactly as-is. Submit the COMPLETE corrected test and call finish_generate again.` : `Your resubmission STILL contains a locator that uses an ARIA role as a CSS tag selector (page.locator('<role>[\u2026]')). This can only ever match nothing. Replace EVERY such locator with page.getByRole('<role>', { name: '\u2026' }) / getByLabel / input[type="\u2026"], or use await __vqaEnterVerificationCode(page, code) for the code field, and resubmit the COMPLETE test.`,
+                    instruction: targeted ? `Every locator listed below matches ZERO nodes, so the step hangs until the test times out. Read the \`reason\` on each one \u2014 there are two distinct mistakes:
+(a) An ARIA ROLE used as a CSS tag selector, e.g. page.locator('textbox[name^="code"]'). There is no <textbox>/<checkbox>/<heading> element. Rewrite as page.getByRole('<role>', { name: '<accessible name>' }), or page.getByLabel('<label>'), or a type-scoped CSS like page.locator('input[type="email"]'). For a verification-code field prefer the injected helper: await __vqaEnterVerificationCode(page, code).
+(b) A { name: \u2026 } filter on a role whose accessible name ARIA PROHIBITS (paragraph, generic, code, emphasis, strong, term, time, mark, caption, presentation/none, insertion, deletion, sub/superscript). No element with those roles ever exposes a name. Match the text instead: page.getByText('\u2026', { exact: true }), scoped if needed (page.getByRole('main').getByText('\u2026')), or target a nameable ancestor such as region/listitem/link/button.
+Fix EVERY flagged locator, keep every other line exactly as-is, then submit the COMPLETE corrected test and call finish_generate again.` : `Your resubmission STILL contains a locator that can only ever match nothing \u2014 either an ARIA role used as a CSS tag selector (page.locator('<role>[\u2026]')) or a { name: \u2026 } filter on a name-prohibited role (paragraph/generic/code/emphasis/strong/term/time/\u2026). Replace EVERY one: use getByRole('<role>', { name: '\u2026' }) / getByLabel / input[type="\u2026"] for the first, and getByText('\u2026', { exact: true }) for the second. Resubmit the COMPLETE test.`,
                     offendingLocators: roleTagFindings.map((f) => ({
                       line: sanitizeLedgerText(f.line),
                       reason: f.reason
@@ -353821,7 +353976,7 @@ var require_package4 = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.86",
+      version: "1.0.88",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"
@@ -362164,8 +362319,13 @@ var RunnerUpgradeRequiredError = class extends Error {
     this.latestVersion = latestVersion;
   }
 };
+var PENDING_POLL_TIMEOUT_MS = Math.max(15e3, envInt("VALIDATE_RUNNER_PENDING_TIMEOUT_MS", 9e4));
+var POLL_STUCK_RECYCLE_MS = Math.max(6e4, envInt("VALIDATE_RUNNER_POLL_STUCK_MS", 5 * 6e4));
 async function fetchPendingRuns(serverUrl, headers) {
-  const res = await fetch(`${serverUrl}/api/runner/pending`, { headers, signal: AbortSignal.timeout(3e4) });
+  const res = await fetch(`${serverUrl}/api/runner/pending`, {
+    headers,
+    signal: AbortSignal.timeout(PENDING_POLL_TIMEOUT_MS)
+  });
   if (!res.ok) {
     if (res.status === 401) throw new Error("Runner token is invalid or expired. Run: validate.qa-runner login");
     if (res.status === 426) {
@@ -365578,10 +365738,12 @@ async function startRunner(opts) {
     log.dim(line);
   };
   let lastPendingSummary = "";
+  let lastSuccessfulPollAt = Date.now();
   while (!shuttingDown) {
     try {
       if (activeRuns < MAX_CONCURRENT) {
         const pending = await fetchPendingRuns(serverUrl, headers);
+        lastSuccessfulPollAt = Date.now();
         {
           const pendingIds = new Set(pending.map((r) => r.runId));
           for (const id of [...deferralLogged.keys()]) {
@@ -365786,6 +365948,8 @@ async function startRunner(opts) {
           }
         }
         consecutivePollErrors = 0;
+      } else {
+        lastSuccessfulPollAt = Date.now();
       }
     } catch (err) {
       if (err instanceof RunnerUpgradeRequiredError) {
@@ -365794,6 +365958,13 @@ async function startRunner(opts) {
       }
       const message = err instanceof Error ? err.message : String(err);
       consecutivePollErrors++;
+      const stuckForMs = Date.now() - lastSuccessfulPollAt;
+      if (stuckForMs >= POLL_STUCK_RECYCLE_MS) {
+        log.warn(
+          `Poll stuck for ${Math.round(stuckForMs / 1e3)}s (>= ${Math.round(POLL_STUCK_RECYCLE_MS / 1e3)}s) after error: ${message}. Recycling runner process so the supervisor can restart with a clean loop; orphaned work is re-queued server-side.`
+        );
+        process.exit(78);
+      }
       const backoffMs = Math.min(pollIntervalMs * Math.pow(2, consecutivePollErrors - 1), MAX_BACKOFF_MS);
       if (consecutivePollErrors > 1) {
         log.warn(`Poll error #${consecutivePollErrors} (${message}) - backing off for ${(backoffMs / 1e3).toFixed(1)}s`);
@@ -365846,7 +366017,76 @@ program.command("login").description("Save runner credentials for future use").r
   console.log("");
   console.log("Run: validate-runner start");
 });
-program.command("start").description("Start the local test runner").option("--token <token>", "Runner token (overrides saved credentials)").option("--server <url>", "Server URL (overrides saved credentials)").option("--project <id>", "Project ID (overrides saved credentials)").option("--mode <mode>", "Runner mode: playwright-native (default)", "playwright-native").option("--poll-interval <ms>", "Poll interval in milliseconds", "2000").option("--mobile", "Enable mobile testing (Appium + mobile bridge server)").option("--tunnel", "Enable ngrok tunnel for mobile bridge (allows HTTPS dashboard to connect)").action(async (opts) => {
+async function superviseRunnerStart(argv) {
+  const { spawn: spawn2 } = await import("child_process");
+  const minBackoffMs = 2e3;
+  const maxBackoffMs = 6e4;
+  let backoffMs = minBackoffMs;
+  let restarts = 0;
+  const windowStart = Date.now();
+  const maxRestartsPerHour = Math.max(1, Number(process.env.VALIDATE_RUNNER_MAX_RESTARTS_PER_HOUR || 30));
+  const childEnv = { ...process.env, VALIDATE_RUNNER_SUPERVISED_CHILD: "1" };
+  const runOnce = () => new Promise((resolve2) => {
+    const child = spawn2(process.execPath, argv, {
+      stdio: "inherit",
+      env: childEnv
+    });
+    const onSignal = (sig) => {
+      try {
+        child.kill(sig);
+      } catch {
+      }
+    };
+    process.once("SIGINT", onSignal);
+    process.once("SIGTERM", onSignal);
+    child.on("exit", (code, signal) => {
+      process.removeListener("SIGINT", onSignal);
+      process.removeListener("SIGTERM", onSignal);
+      if (signal === "SIGINT" || signal === "SIGTERM") {
+        resolve2(0);
+        return;
+      }
+      resolve2(code ?? 1);
+    });
+  });
+  const childArgv = argv.filter((a) => a !== "--supervise" && a !== "--no-supervise");
+  console.log("\u{1F6E1}  Runner supervisor enabled \u2014 will auto-restart on crash/stuck exit");
+  console.log("   (disable with --no-supervise or VALIDATE_RUNNER_SUPERVISE=0)");
+  for (; ; ) {
+    const code = await runOnce();
+    if (code === 0) {
+      process.exit(0);
+    }
+    restarts += 1;
+    const elapsedH = (Date.now() - windowStart) / 36e5;
+    if (elapsedH < 1 && restarts > maxRestartsPerHour) {
+      console.error(
+        `\u2717  Supervisor: ${restarts} restarts in under 1h (cap ${maxRestartsPerHour}). Stopping to avoid a crash loop. Fix the underlying issue and re-run start.`
+      );
+      process.exit(1);
+    }
+    console.warn(
+      `\u26A0  Runner exited with code ${code} \u2014 restarting in ${(backoffMs / 1e3).toFixed(1)}s (restart #${restarts}). Server will re-queue orphaned work; pending jobs resume automatically.`
+    );
+    await new Promise((r) => setTimeout(r, backoffMs));
+    backoffMs = Math.min(maxBackoffMs, Math.round(backoffMs * 1.5));
+  }
+}
+function shouldSupervise(opts) {
+  if (opts.supervise === false) return false;
+  if (opts.supervise === true) return true;
+  if (process.env.VALIDATE_RUNNER_SUPERVISED_CHILD === "1") return false;
+  if (process.env.RUNNER_CLOUD === "true") return false;
+  const env = (process.env.VALIDATE_RUNNER_SUPERVISE ?? "1").trim().toLowerCase();
+  return env !== "0" && env !== "false" && env !== "off" && env !== "no";
+}
+program.command("start").description("Start the local test runner").option("--token <token>", "Runner token (overrides saved credentials)").option("--server <url>", "Server URL (overrides saved credentials)").option("--project <id>", "Project ID (overrides saved credentials)").option("--mode <mode>", "Runner mode: playwright-native (default)", "playwright-native").option("--poll-interval <ms>", "Poll interval in milliseconds", "2000").option("--mobile", "Enable mobile testing (Appium + mobile bridge server)").option("--tunnel", "Enable ngrok tunnel for mobile bridge (allows HTTPS dashboard to connect)").option("--supervise", "Auto-restart the runner if it crashes or self-recycles (default for local)").option("--no-supervise", "Disable auto-restart supervisor").action(async (opts) => {
+  if (shouldSupervise(opts)) {
+    const argv = [...process.argv.slice(1)];
+    if (!argv.includes("--no-supervise")) argv.push("--no-supervise");
+    await superviseRunnerStart(argv);
+    return;
+  }
   await requireLatestRunner();
   const saved = loadCredentials();
   const authToken = opts.token || process.env.AUTH_TOKEN || saved?.token;

package/dist/cli.mjs

@@ -83739,6 +83739,9 @@ ${statePacket}`, redactionCredentials) },
       if (isContentActionScenario(scenario)) {
         return false;
       }
+      if (isFormValidationScenario(scenario)) {
+        return false;
+      }
       const text = scenarioText(scenario);
       const visibilityOnlyGoal = (/\b(entry\s+points?|providers?|provider\s+buttons?|sign[- ]?in\s+options|auth(?:entication)?\s+options|available\s+options)\b/.test(text) || /\b(show|display)\s+(all\s+)?(the\s+)?(providers?|options|buttons?|links?|entry\s+points?)\b/.test(text) || /\b(all\s+(three\s+)?providers?)\b/.test(text)) && !/\b(change|update|create|save|send|register|edit|with\s+valid|successful\s+(sign|log)|complete\s+(the\s+)?(login|sign[- ]?in)|submit\s+(the\s+)?(form|credentials)|enter\s+(an?\s+)?(email|password))\b/.test(text);
       if (visibilityOnlyGoal) {
@@ -83904,8 +83907,8 @@ ${statePacket}`, redactionCredentials) },
         if (isNavChromeThrashTrace(actions)) {
           return "content-action scenario only recorded tab thrash / swipes \u2014 no product action";
         }
-        const asserts = actions.filter((a) => a.type === "ASSERT_VISIBLE" || a.type === "ASSERT_TEXT");
-        if (asserts.length > 0 && asserts.every((a) => VOLATILE_BADGE_ASSERT_RE.test(actionText(a)) || NAV_CHROME_TAP_RE.test(actionText(a)) && !CONTENT_ACTION_VERB_RE.test(actionText(a)))) {
+        const asserts2 = actions.filter((a) => a.type === "ASSERT_VISIBLE" || a.type === "ASSERT_TEXT");
+        if (asserts2.length > 0 && asserts2.every((a) => VOLATILE_BADGE_ASSERT_RE.test(actionText(a)) || NAV_CHROME_TAP_RE.test(actionText(a)) && !CONTENT_ACTION_VERB_RE.test(actionText(a)))) {
           return "content-action scenario only asserted tab chrome or a volatile badge count \u2014 assert the action outcome instead";
         }
         return null;
@@ -83942,12 +83945,15 @@ ${statePacket}`, redactionCredentials) },
         const hasValidationAssert = actions.some((a) => {
           if (a.type !== "ASSERT_VISIBLE" && a.type !== "ASSERT_TEXT")
             return false;
-          return /\b(error|required|invalid|empty|missing|incorrect|wrong|try again|mismatch|does not match|must match)\b/.test(actionText(a));
+          return /\b(error|required|invalid|empty|missing|incorrect|wrong|try again|mismatch|does not match|must match|cannot be empty|please enter|fill out|is required)\b/.test(actionText(a));
         });
         const emptyFieldIntent = /\b(empty|required|missing|blank)\b/.test(text);
         const invalidValueIntent = /\b(wrong|incorrect|invalid|mismatch|reject)\b/.test(text);
+        if (!hasValidationAssert) {
+          return "validation scenario did not assert a validation/error outcome (commit alone is not proof)";
+        }
         if (emptyFieldIntent && !invalidValueIntent) {
-          if (!hasCommit && !hasValidationAssert) {
+          if (!hasCommit) {
             return "validation scenario did not record a form commit or validation outcome";
           }
           return null;
@@ -83955,7 +83961,7 @@ ${statePacket}`, redactionCredentials) },
         if (typedFields && !hasCommit) {
           return "validation scenario filled fields but never committed the form";
         }
-        if (!hasCommit && !hasValidationAssert) {
+        if (!hasCommit) {
           return "validation scenario did not record a form commit or validation outcome";
         }
         return null;
@@ -83969,6 +83975,10 @@ ${statePacket}`, redactionCredentials) },
         if (!hasCommit) {
           return "form-mutation happy path did not record a form commit";
         }
+        const asserts2 = actions.filter((a) => a.type === "ASSERT_VISIBLE" || a.type === "ASSERT_TEXT");
+        if (asserts2.length > 0 && asserts2.every((a) => NAV_CHROME_TAP_RE.test(actionText(a)) || VOLATILE_BADGE_ASSERT_RE.test(actionText(a)) || isStructuralOnlyAssert(a) || isEphemeralContentAssertText(assertIdentityText(a)))) {
+          return "form-mutation happy path only asserted tab chrome or ephemeral content \u2014 assert the saved/updated product outcome";
+        }
       }
       const isCredentialSignIn = /\b(sign\s*in|log\s*in|login|authenticate|auth)\b/.test(text) && /\b(email|e-mail|password|credential|valid credentials?)\b/.test(text) && !/\b(reset|forgot|recover|logout|log\s*out|sign\s*out|change\s+password|update\s+password)\b/.test(text);
       const typedEmailIndexes = [];
@@ -84061,13 +84071,70 @@ ${statePacket}`, redactionCredentials) },
         if (!actions.some((a) => isProductiveScenarioAction(a, text))) {
           return "happy-path / user-journey scenario did not record a productive product action (only chrome, gestures, or empty work)";
         }
-        const asserts = actions.filter((a) => a.type === "ASSERT_VISIBLE" || a.type === "ASSERT_TEXT");
-        if (asserts.length > 0 && asserts.every((a) => VOLATILE_BADGE_ASSERT_RE.test(actionText(a)) || isStructuralOnlyAssert(a))) {
+        const asserts2 = actions.filter((a) => a.type === "ASSERT_VISIBLE" || a.type === "ASSERT_TEXT");
+        if (asserts2.length > 0 && asserts2.every((a) => VOLATILE_BADGE_ASSERT_RE.test(actionText(a)) || isStructuralOnlyAssert(a))) {
           return "happy-path / user-journey scenario only asserted volatile badges or structural roots \u2014 assert a durable feature outcome";
         }
       }
+      const goalFidelity = scenarioGoalActionFidelityReason(text, actions);
+      if (goalFidelity)
+        return goalFidelity;
+      if (actions.some((a) => isBareHierarchyFieldAction(a))) {
+        return "typed or tapped a bare hierarchy/container target with no accessible label \u2014 use a labeled field/control";
+      }
+      const asserts = actions.filter((a) => a.type === "ASSERT_VISIBLE" || a.type === "ASSERT_TEXT");
+      if (asserts.length > 0 && asserts.every((a) => isEphemeralContentAssertText(assertIdentityText(a)))) {
+        return "only asserted ephemeral feed/catalog content (session-specific titles/ids) \u2014 assert durable product chrome or stable outcome";
+      }
       return null;
     }
+    function scenarioGoalActionFidelityReason(scenarioTextLower, actions) {
+      const actionBlob = actions.map((a) => actionText(a)).join(" ").toLowerCase();
+      if (/\b(pick|choose|select)\b.*\b(library|gallery|photos?|camera\s*roll|device)\b|\bfrom\s+(the\s+)?(library|gallery|photos?)\b/.test(scenarioTextLower)) {
+        if (!/\b(library|gallery|photos?|camera\s*roll|pick\s+a\s+video|choose\s+(a\s+)?(video|photo|file)|from\s+library|document\s*picker|media\s*picker)\b/i.test(actionBlob)) {
+          return "scenario claims pick-from-library but recording never tapped a library/gallery/picker control";
+        }
+      }
+      if (/\b(style|styles)\b/.test(scenarioTextLower) && /\b(format|aspect|ratio|quality|reels?|9:16|16:9)\b/.test(scenarioTextLower)) {
+        const pickedStyle = /\b(style|cinematic|anime|realistic|no\s*style|cartoon|oil\s*paint)\b/i.test(actionBlob);
+        const pickedFormat = /\b(9:16|16:9|1:1|reels?|aspect|quality|format|720|1080)\b/i.test(actionBlob);
+        if (!pickedStyle || !pickedFormat) {
+          return "scenario claims style+format selection but recording did not select both a style and a format/aspect control";
+        }
+      }
+      if (/\b(open|launch|start)\b.*\b(camera|recording)\b|\brecord\s+a\s+video\b/.test(scenarioTextLower)) {
+        if (!/\b(camera|record|recording|flash|flip\s+camera|capture|shutter)\b/i.test(actionBlob)) {
+          return "scenario claims open/record camera but recording never reached camera controls";
+        }
+      }
+      return null;
+    }
+    function isBareHierarchyFieldAction(action) {
+      if (action.type !== "TYPE" && action.type !== "CLEAR")
+        return false;
+      const sel = (action.selector ?? "").trim();
+      if (!/^\/hierarchy/i.test(sel))
+        return false;
+      const bundle = action.metadata.locatorBundle;
+      const label = (action.metadata.targetLabel ?? "").trim();
+      if (label && !/^element$/i.test(label))
+        return false;
+      const inner = nonEmpty3(action.innerText);
+      if (inner && !/^element$/i.test(inner))
+        return false;
+      if (nonEmpty3(bundle?.text) || nonEmpty3(bundle?.contentDesc) || nonEmpty3(bundle?.accessibilityId)) {
+        return false;
+      }
+      if (nonEmpty3(bundle?.resourceId) && !isStructuralAssertionIdentity(bundle?.resourceId)) {
+        return false;
+      }
+      if (action.type === "TYPE") {
+        const v = (action.value ?? "").replace(/\s+/g, "");
+        if (v.length > 0)
+          return false;
+      }
+      return true;
+    }
     function actionCycleKey(action) {
       return `${action.type}|${action.selector}|${action.value ?? ""}`;
     }
@@ -84337,6 +84404,15 @@ ${statePacket}`, redactionCredentials) },
       if (t.length >= 40 && /\b(error\s+\d{3,}|generation failed|rate limit|quota exceeded)\b/i.test(t)) {
         return true;
       }
+      if (/\b(harness|seed|fixture|demo\s*data|test\s*artist|qa\s*published)\b/i.test(t) && /\d{6,}/.test(t)) {
+        return true;
+      }
+      if (/\bplay\b.+\bby\b.+/i.test(t) && (t.length >= 40 || /\d{6,}/.test(t))) {
+        return true;
+      }
+      if (/^play\s+/i.test(t) && t.length >= 35 && !/\b(home|search|settings|profile|library|playlist|sign\s*in|log\s*in)\b/i.test(t)) {
+        return true;
+      }
       return false;
     }
     function assertIdentityText(action) {
@@ -87673,6 +87749,7 @@ var require_auth_recipe = __commonJS({
     var START_MARKER = `// >>> VALIDATE_QA_AUTH ${exports.AUTH_MARKER_VERSION} \u2014 generated, do not edit >>>`;
     var END_MARKER = `// <<< VALIDATE_QA_AUTH ${exports.AUTH_MARKER_VERSION} <<<`;
     var SHARED_AUTH_RUNTIME_ENABLED = `!/^false$/i.test((process.env.SHARED_AUTH_INJECT ?? '').trim())`;
+    var WARM_PROOF_SETTLE_MS = 8e3;
     var AUTH_REGION_RE = /\/\/ >>> VALIDATE_QA_AUTH[^\n]*\r?\n[\s\S]*?\/\/ <<< VALIDATE_QA_AUTH[^\n]*\r?\n?/g;
     function computeRecipeHash(input) {
       const canonical = JSON.stringify({
@@ -87808,12 +87885,20 @@ ${tabs}`);
           const pred = urlProofPredicateExpr(recipe.authProof.route, recipe.authProof.exact);
           lines.push(`    await page.waitForURL((u) => !(${pred})(u), { timeout: 2000 }).catch(() => {});`);
           lines.push(`    if ((${pred})(new URL(page.url())) && !(await page.locator('input[type="password"]').first().isVisible().catch(() => false))) return;`);
-        } else if (loginRoute) {
-          lines.push(`    if (await ${authProofLocator(recipe.authProof)}.isVisible().catch(() => false) && new URL(page.url()).pathname !== new URL(${JSON.stringify(loginRoute)}, page.url()).pathname) return;`);
         } else {
-          lines.push(`    if (await ${authProofLocator(recipe.authProof)}.isVisible().catch(() => false)) return;`);
+          const proofSettle = `await ${authProofLocator(recipe.authProof)}.waitFor({ state: 'visible', timeout: ${WARM_PROOF_SETTLE_MS} }).then(() => true).catch(() => false)`;
+          if (loginRoute) {
+            lines.push(`    if (new URL(page.url()).pathname !== new URL(${JSON.stringify(loginRoute)}, page.url()).pathname && ${proofSettle}) return;`);
+          } else {
+            lines.push(`    if (${proofSettle}) return;`);
+          }
         }
         lines.push(`  }`);
+        lines.push(`  if (${SHARED_AUTH_RUNTIME_ENABLED}) {`);
+        lines.push(`    await page.context().clearCookies().catch(() => {});`);
+        lines.push(`    await page.goto(${JSON.stringify(recipe.preNavRoute)}, { waitUntil: 'domcontentloaded' }).catch(() => {});`);
+        lines.push(`    await page.evaluate(() => { try { localStorage.clear(); sessionStorage.clear(); } catch {} }).catch(() => {});`);
+        lines.push(`  }`);
       }
       lines.push(`  await page.goto(${JSON.stringify(recipe.preNavRoute)}, { waitUntil: 'domcontentloaded' });`);
       for (const cmd of recipe.preNavCmds)
@@ -95766,6 +95851,32 @@ var require_agentic_discovery_prompts = __commonJS({
       lines.push("For a pure navigation or page-load scenario (no in-page mutation), URL + one");
       lines.push("structural heading is sufficient.");
       lines.push("");
+      lines.push("**Stop at the gate for expensive or irreversible actions.** Some controls");
+      lines.push("start work that costs the account real money (an AI generation, a paid");
+      lines.push("third-party call, a checkout), takes minutes to finish, or cannot be undone");
+      lines.push("(delete, publish, cancel a subscription). Do NOT press them. The regression");
+      lines.push("risk lives in the wiring, and the wiring is fully provable for free:");
+      lines.push("- Assert the control is present and correctly ENABLED/DISABLED by its inputs.");
+      lines.push("- If it opens a dialog, assert the dialog, its fields and its confirm button,");
+      lines.push("  then press Cancel and assert nothing changed.");
+      lines.push("- Assert the auth / quota wall fires for a caller who should be refused.");
+      lines.push("A test that waits minutes for generated output cannot finish inside the run");
+      lines.push("budget, bills the account on every run, and leaves permanent rows behind. If");
+      lines.push("the ONLY way to prove a scenario is to trigger such an action, drop it as a");
+      lines.push("gap rather than emitting a test that does.");
+      lines.push("");
+      lines.push("**Never sign up a new account.** Use the injected credentials. Registering a");
+      lines.push("`testuser-<timestamp>` account to get past a login wall leaves a permanent,");
+      lines.push("unowned user in the target database on every single run. Registration is in");
+      lines.push("scope ONLY when the scenario under test IS registration, in which case use");
+      lines.push("the provided inbox helper so the account is tracked and reaped.");
+      lines.push("");
+      lines.push("**Write the assertion so the BUG fails it.** When a scenario documents broken");
+      lines.push("behaviour, still assert the CORRECT outcome. A test that passes because the");
+      lines.push("error message / console error / not-found page is present inverts the suite:");
+      lines.push("fixing the bug turns the test red and the fix is reported as a regression.");
+      lines.push("State the intended behaviour, let it fail, and flag it as a bug.");
+      lines.push("");
       lines.push("## Tools");
       lines.push("");
       lines.push("Browser MCP: `browser_navigate`, `browser_snapshot`, `browser_click`,");
@@ -96575,7 +96686,7 @@ var require_discover_generator = __commonJS({
   "../runner-core/dist/services/discover-generator.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.MIN_BUG_DESCRIPTION_LENGTH = exports.VALID_PLAYWRIGHT_GETBY_METHODS = exports.BLOCKED_MCP_TOOLS_SCENARIO_GEN = void 0;
+    exports.MIN_BUG_DESCRIPTION_LENGTH = exports.NAME_PROHIBITED_ROLES = exports.VALID_PLAYWRIGHT_GETBY_METHODS = exports.BLOCKED_MCP_TOOLS_SCENARIO_GEN = void 0;
     exports.scenarioLooksLikeRegistration = scenarioLooksLikeRegistration;
     exports.signupFeatureTestingAllowed = signupFeatureTestingAllowed;
     exports.scenarioTouchesSignupAuthSurface = scenarioTouchesSignupAuthSurface;
@@ -96605,6 +96716,7 @@ var require_discover_generator = __commonJS({
     exports.scanFragileStructuralLocators = scanFragileStructuralLocators;
     exports.bannedRoleTokensInSelector = bannedRoleTokensInSelector;
     exports.scanInvalidRoleTagLocators = scanInvalidRoleTagLocators;
+    exports.scanNameProhibitedRoleLocators = scanNameProhibitedRoleLocators;
     exports.scanHealedRoleTagLocators = scanHealedRoleTagLocators;
     exports.validateFinalActionFidelity = validateFinalActionFidelity;
     exports.resolveSuspectedBugVerdict = resolveSuspectedBugVerdict;
@@ -99672,10 +99784,55 @@ ${testOpen}`;
       }
       return findings;
     }
+    exports.NAME_PROHIBITED_ROLES = /* @__PURE__ */ new Set([
+      "caption",
+      "code",
+      "deletion",
+      "emphasis",
+      "generic",
+      "insertion",
+      "mark",
+      "none",
+      "paragraph",
+      "presentation",
+      "strong",
+      "subscript",
+      "superscript",
+      "term",
+      "time"
+    ]);
+    function scanNameProhibitedRoleLocators(code) {
+      const findings = [];
+      const seen = /* @__PURE__ */ new Set();
+      const scanCode = code.replace(/\/\*[\s\S]*?\*\//g, (m) => m.replace(/[^\n]/g, " "));
+      const RE = /getByRole\(\s*(['"`])([a-zA-Z]+)\1\s*,\s*\{[^}]*\bname\s*:/g;
+      for (const rawLine of scanCode.split("\n")) {
+        const line = rawLine.replace(/\/\/.*$/, "");
+        if (line.indexOf("getByRole(") === -1)
+          continue;
+        RE.lastIndex = 0;
+        let m;
+        while ((m = RE.exec(line)) !== null) {
+          const role = m[2].toLowerCase();
+          if (!exports.NAME_PROHIBITED_ROLES.has(role))
+            continue;
+          const key = `${rawLine.trim()} ${role}`;
+          if (seen.has(key))
+            continue;
+          seen.add(key);
+          findings.push({
+            line: rawLine.trim().slice(0, 200),
+            role,
+            reason: `ARIA prohibits an accessible name on role "${role}", so no element ever exposes one \u2014 getByRole('${role}', { name: \u2026 }) matches ZERO nodes and the assertion hangs to its timeout. Match the text instead: page.getByText('\u2026', { exact: true }), optionally scoped (e.g. page.getByRole('main').getByText('\u2026')). If you need the element itself, select a nameable ancestor (region/listitem/link/button) and assert its text.`
+          });
+        }
+      }
+      return findings;
+    }
     function scanHealedRoleTagLocators(code, opts) {
       const inboxStripped = (0, inbox_stamp_js_1.stripInboxRegions)(code);
       const scanned = opts?.stripAuth === false ? inboxStripped : (0, auth_recipe_js_1.stripAuthRegions)(inboxStripped);
-      return scanInvalidRoleTagLocators(scanned);
+      return [...scanInvalidRoleTagLocators(scanned), ...scanNameProhibitedRoleLocators(scanned)];
     }
     function validateFinalActionFidelity(playwrightCode, actionLedger, credentials, opts) {
       const ledgerSigs = [];
@@ -100396,7 +100553,7 @@ Do NOT add steps you did not execute. Do NOT skip steps from the recording.${led
                   continue;
                 }
                 const roleTagMode = (0, discovery_lint_flags_js_1.roleTagLocatorLintMode)();
-                const roleTagFindings = roleTagMode !== "off" ? scanInvalidRoleTagLocators((0, auth_recipe_js_1.stripAuthRegions)((0, inbox_stamp_js_1.stripInboxRegions)(validated[0].playwrightCode))) : [];
+                const roleTagFindings = roleTagMode !== "off" ? scanHealedRoleTagLocators(validated[0].playwrightCode) : [];
                 if (roleTagMode === "warn" && roleTagFindings.length > 0) {
                   logs2.push(`    Role-tag locator gate [warn]: ${roleTagFindings.length} role-as-CSS-tag locator(s) \u2014 ${roleTagFindings.map((f) => sanitizeLedgerText(f.line)).join(" | ").slice(0, 300)}`);
                 }
@@ -100409,12 +100566,10 @@ Do NOT add steps you did not execute. Do NOT skip steps from the recording.${led
                     valid: false,
                     revisionRequired: true,
                     reason: "invalid_role_tag_locator",
-                    instruction: targeted ? `One or more locators below use an ARIA ROLE as a CSS tag selector, e.g. page.locator('textbox[name^="code"]'). There is no <textbox>/<checkbox>/<heading> HTML element, so page.locator() matches ZERO nodes and the action hangs until the test times out.
-For EACH flagged locator, rewrite it as a real Playwright locator:
-1. Prefer page.getByRole('<role>', { name: '<accessible name>' }) \u2014 the role is the token you wrongly put in the CSS.
-2. Or page.getByLabel('<label>'), or a type-scoped CSS like page.locator('input[type="text"]') / input[type="email"].
-3. For a verification-code field, prefer the injected helper: await __vqaEnterVerificationCode(page, code).
-Keep every other line exactly as-is. Submit the COMPLETE corrected test and call finish_generate again.` : `Your resubmission STILL contains a locator that uses an ARIA role as a CSS tag selector (page.locator('<role>[\u2026]')). This can only ever match nothing. Replace EVERY such locator with page.getByRole('<role>', { name: '\u2026' }) / getByLabel / input[type="\u2026"], or use await __vqaEnterVerificationCode(page, code) for the code field, and resubmit the COMPLETE test.`,
+                    instruction: targeted ? `Every locator listed below matches ZERO nodes, so the step hangs until the test times out. Read the \`reason\` on each one \u2014 there are two distinct mistakes:
+(a) An ARIA ROLE used as a CSS tag selector, e.g. page.locator('textbox[name^="code"]'). There is no <textbox>/<checkbox>/<heading> element. Rewrite as page.getByRole('<role>', { name: '<accessible name>' }), or page.getByLabel('<label>'), or a type-scoped CSS like page.locator('input[type="email"]'). For a verification-code field prefer the injected helper: await __vqaEnterVerificationCode(page, code).
+(b) A { name: \u2026 } filter on a role whose accessible name ARIA PROHIBITS (paragraph, generic, code, emphasis, strong, term, time, mark, caption, presentation/none, insertion, deletion, sub/superscript). No element with those roles ever exposes a name. Match the text instead: page.getByText('\u2026', { exact: true }), scoped if needed (page.getByRole('main').getByText('\u2026')), or target a nameable ancestor such as region/listitem/link/button.
+Fix EVERY flagged locator, keep every other line exactly as-is, then submit the COMPLETE corrected test and call finish_generate again.` : `Your resubmission STILL contains a locator that can only ever match nothing \u2014 either an ARIA role used as a CSS tag selector (page.locator('<role>[\u2026]')) or a { name: \u2026 } filter on a name-prohibited role (paragraph/generic/code/emphasis/strong/term/time/\u2026). Replace EVERY one: use getByRole('<role>', { name: '\u2026' }) / getByLabel / input[type="\u2026"] for the first, and getByText('\u2026', { exact: true }) for the second. Resubmit the COMPLETE test.`,
                     offendingLocators: roleTagFindings.map((f) => ({
                       line: sanitizeLedgerText(f.line),
                       reason: f.reason
@@ -353826,7 +353981,7 @@ var require_package4 = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.86",
+      version: "1.0.88",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"
@@ -362172,8 +362327,13 @@ var RunnerUpgradeRequiredError = class extends Error {
     this.latestVersion = latestVersion;
   }
 };
+var PENDING_POLL_TIMEOUT_MS = Math.max(15e3, envInt("VALIDATE_RUNNER_PENDING_TIMEOUT_MS", 9e4));
+var POLL_STUCK_RECYCLE_MS = Math.max(6e4, envInt("VALIDATE_RUNNER_POLL_STUCK_MS", 5 * 6e4));
 async function fetchPendingRuns(serverUrl, headers) {
-  const res = await fetch(`${serverUrl}/api/runner/pending`, { headers, signal: AbortSignal.timeout(3e4) });
+  const res = await fetch(`${serverUrl}/api/runner/pending`, {
+    headers,
+    signal: AbortSignal.timeout(PENDING_POLL_TIMEOUT_MS)
+  });
   if (!res.ok) {
     if (res.status === 401) throw new Error("Runner token is invalid or expired. Run: validate.qa-runner login");
     if (res.status === 426) {
@@ -365586,10 +365746,12 @@ async function startRunner(opts) {
     log.dim(line);
   };
   let lastPendingSummary = "";
+  let lastSuccessfulPollAt = Date.now();
   while (!shuttingDown) {
     try {
       if (activeRuns < MAX_CONCURRENT) {
         const pending = await fetchPendingRuns(serverUrl, headers);
+        lastSuccessfulPollAt = Date.now();
         {
           const pendingIds = new Set(pending.map((r) => r.runId));
           for (const id of [...deferralLogged.keys()]) {
@@ -365794,6 +365956,8 @@ async function startRunner(opts) {
           }
         }
         consecutivePollErrors = 0;
+      } else {
+        lastSuccessfulPollAt = Date.now();
       }
     } catch (err) {
       if (err instanceof RunnerUpgradeRequiredError) {
@@ -365802,6 +365966,13 @@ async function startRunner(opts) {
       }
       const message = err instanceof Error ? err.message : String(err);
       consecutivePollErrors++;
+      const stuckForMs = Date.now() - lastSuccessfulPollAt;
+      if (stuckForMs >= POLL_STUCK_RECYCLE_MS) {
+        log.warn(
+          `Poll stuck for ${Math.round(stuckForMs / 1e3)}s (>= ${Math.round(POLL_STUCK_RECYCLE_MS / 1e3)}s) after error: ${message}. Recycling runner process so the supervisor can restart with a clean loop; orphaned work is re-queued server-side.`
+        );
+        process.exit(78);
+      }
       const backoffMs = Math.min(pollIntervalMs * Math.pow(2, consecutivePollErrors - 1), MAX_BACKOFF_MS);
       if (consecutivePollErrors > 1) {
         log.warn(`Poll error #${consecutivePollErrors} (${message}) - backing off for ${(backoffMs / 1e3).toFixed(1)}s`);
@@ -365854,7 +366025,76 @@ program.command("login").description("Save runner credentials for future use").r
   console.log("");
   console.log("Run: validate-runner start");
 });
-program.command("start").description("Start the local test runner").option("--token <token>", "Runner token (overrides saved credentials)").option("--server <url>", "Server URL (overrides saved credentials)").option("--project <id>", "Project ID (overrides saved credentials)").option("--mode <mode>", "Runner mode: playwright-native (default)", "playwright-native").option("--poll-interval <ms>", "Poll interval in milliseconds", "2000").option("--mobile", "Enable mobile testing (Appium + mobile bridge server)").option("--tunnel", "Enable ngrok tunnel for mobile bridge (allows HTTPS dashboard to connect)").action(async (opts) => {
+async function superviseRunnerStart(argv) {
+  const { spawn: spawn2 } = await import("child_process");
+  const minBackoffMs = 2e3;
+  const maxBackoffMs = 6e4;
+  let backoffMs = minBackoffMs;
+  let restarts = 0;
+  const windowStart = Date.now();
+  const maxRestartsPerHour = Math.max(1, Number(process.env.VALIDATE_RUNNER_MAX_RESTARTS_PER_HOUR || 30));
+  const childEnv = { ...process.env, VALIDATE_RUNNER_SUPERVISED_CHILD: "1" };
+  const runOnce = () => new Promise((resolve2) => {
+    const child = spawn2(process.execPath, argv, {
+      stdio: "inherit",
+      env: childEnv
+    });
+    const onSignal = (sig) => {
+      try {
+        child.kill(sig);
+      } catch {
+      }
+    };
+    process.once("SIGINT", onSignal);
+    process.once("SIGTERM", onSignal);
+    child.on("exit", (code, signal) => {
+      process.removeListener("SIGINT", onSignal);
+      process.removeListener("SIGTERM", onSignal);
+      if (signal === "SIGINT" || signal === "SIGTERM") {
+        resolve2(0);
+        return;
+      }
+      resolve2(code ?? 1);
+    });
+  });
+  const childArgv = argv.filter((a) => a !== "--supervise" && a !== "--no-supervise");
+  console.log("\u{1F6E1}  Runner supervisor enabled \u2014 will auto-restart on crash/stuck exit");
+  console.log("   (disable with --no-supervise or VALIDATE_RUNNER_SUPERVISE=0)");
+  for (; ; ) {
+    const code = await runOnce();
+    if (code === 0) {
+      process.exit(0);
+    }
+    restarts += 1;
+    const elapsedH = (Date.now() - windowStart) / 36e5;
+    if (elapsedH < 1 && restarts > maxRestartsPerHour) {
+      console.error(
+        `\u2717  Supervisor: ${restarts} restarts in under 1h (cap ${maxRestartsPerHour}). Stopping to avoid a crash loop. Fix the underlying issue and re-run start.`
+      );
+      process.exit(1);
+    }
+    console.warn(
+      `\u26A0  Runner exited with code ${code} \u2014 restarting in ${(backoffMs / 1e3).toFixed(1)}s (restart #${restarts}). Server will re-queue orphaned work; pending jobs resume automatically.`
+    );
+    await new Promise((r) => setTimeout(r, backoffMs));
+    backoffMs = Math.min(maxBackoffMs, Math.round(backoffMs * 1.5));
+  }
+}
+function shouldSupervise(opts) {
+  if (opts.supervise === false) return false;
+  if (opts.supervise === true) return true;
+  if (process.env.VALIDATE_RUNNER_SUPERVISED_CHILD === "1") return false;
+  if (process.env.RUNNER_CLOUD === "true") return false;
+  const env = (process.env.VALIDATE_RUNNER_SUPERVISE ?? "1").trim().toLowerCase();
+  return env !== "0" && env !== "false" && env !== "off" && env !== "no";
+}
+program.command("start").description("Start the local test runner").option("--token <token>", "Runner token (overrides saved credentials)").option("--server <url>", "Server URL (overrides saved credentials)").option("--project <id>", "Project ID (overrides saved credentials)").option("--mode <mode>", "Runner mode: playwright-native (default)", "playwright-native").option("--poll-interval <ms>", "Poll interval in milliseconds", "2000").option("--mobile", "Enable mobile testing (Appium + mobile bridge server)").option("--tunnel", "Enable ngrok tunnel for mobile bridge (allows HTTPS dashboard to connect)").option("--supervise", "Auto-restart the runner if it crashes or self-recycles (default for local)").option("--no-supervise", "Disable auto-restart supervisor").action(async (opts) => {
+  if (shouldSupervise(opts)) {
+    const argv = [...process.argv.slice(1)];
+    if (!argv.includes("--no-supervise")) argv.push("--no-supervise");
+    await superviseRunnerStart(argv);
+    return;
+  }
   await requireLatestRunner();
   const saved = loadCredentials();
   const authToken = opts.token || process.env.AUTH_TOKEN || saved?.token;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@validate.qa/runner",
-  "version": "1.0.86",
+  "version": "1.0.88",
   "description": "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
   "bin": {
     "validate-runner": "dist/cli.js"