@validate.qa/runner 1.0.93 → 1.0.94

package/dist/cli.js

@@ -8566,10 +8566,13 @@ var require_google_signin = __commonJS({
     exports2.googleSignInGuidanceOpts = googleSignInGuidanceOpts;
     exports2.googleSignInAllowedEmails = googleSignInAllowedEmails;
     exports2.collectGoogleSignInEnv = collectGoogleSignInEnv;
+    exports2.isGoogleAccountsUrl = isGoogleAccountsUrl;
+    exports2.googleSignInCredentialMismatch = googleSignInCredentialMismatch;
     exports2.generateTotp = generateTotp;
     exports2.buildGoogleSignInPromptSection = buildGoogleSignInPromptSection;
     var node_crypto_1 = require("crypto");
     exports2.GOOGLE_SIGNIN_PASSWORD_KEY = "GOOGLE_SIGNIN_PASSWORD";
+    var APP_REGISTER_CREDENTIAL_KEYS = /^(TEST_|E2E_|QA_)?(USER_?EMAIL|USER_?PASSWORD|USER_?NAME|USERNAME)$/i;
     exports2.GOOGLE_SIGNIN_ENV_KEYS = [
       "GOOGLE_SIGNIN_PASSWORD",
       "GOOGLE_SIGNIN_EMAIL",
@@ -8626,6 +8629,34 @@ var require_google_signin = __commonJS({
       }
       return out;
     }
+    function isGoogleAccountsUrl(url) {
+      if (!url)
+        return false;
+      try {
+        const host = new URL(url).hostname.toLowerCase();
+        return host === "accounts.google.com" || host.endsWith(".google.com") && host.includes("accounts");
+      } catch {
+        return /accounts\.google\.com/i.test(url);
+      }
+    }
+    function googleSignInCredentialMismatch(pageUrl, credentialKey, opts) {
+      const configured = opts?.configured ?? !!loadGoogleSignInConfig(opts?.env);
+      if (!configured)
+        return null;
+      const onGoogle = isGoogleAccountsUrl(pageUrl);
+      if (onGoogle) {
+        if (credentialKey === exports2.GOOGLE_SIGNIN_PASSWORD_KEY)
+          return null;
+        if (APP_REGISTER_CREDENTIAL_KEYS.test(credentialKey)) {
+          return `fill_credential: this is Google account login (accounts.google.com), not app email signup. Do not use ${credentialKey}. Type the BARE Google email with browser_type, then fill_credential with credentialKey ${exports2.GOOGLE_SIGNIN_PASSWORD_KEY}. Do not click Continue with phone / SMS OTP when Continue with Google is available.`;
+        }
+        return null;
+      }
+      if (credentialKey === exports2.GOOGLE_SIGNIN_PASSWORD_KEY) {
+        return `fill_credential: ${exports2.GOOGLE_SIGNIN_PASSWORD_KEY} is only for accounts.google.com. Click Continue with Google first (not Continue with phone). Phone / "Mobile or email" is not app email signup.`;
+      }
+      return null;
+    }
     function generateTotp(secret, atMs = Date.now(), stepSeconds = 30, digits = 6) {
       const key = decodeBase32(secret);
       const counter = Math.floor(atMs / 1e3 / stepSeconds);
@@ -8664,10 +8695,14 @@ var require_google_signin = __commonJS({
       const fill = variant === "cli" ? `fill_credential with credentialKey \`${opts.googlePasswordKey}\`` : `\`fill_credential\` (credentialKey \`${opts.googlePasswordKey}\`)`;
       const plainProvision = variant === "cli" ? "`inbox_provision_identity` with `plain: true`" : "`provision_identity` with `plain: true`";
       return `
-Google / Gmail SSO fallback (SECOND choice \u2014 email+password signup is FIRST):
-- FIRST follow the email-field playbook above whenever a signup form has an email / username / password field (including after clicking "Sign up with email"). Do NOT click Google if that form exists.
-- ONLY if there is no email+password signup field and the only path is "Continue with Google" / "Sign up with Gmail" / "Sign in with Google": click that button. If a Google popup opens, switch to it (browser tabs).
-- On accounts.google.com, type the BARE Google account email \`${opts.googleEmail}\` (no plus-tag \u2014 Google account login rejects plus-addresses) with browser_type, click Next, then fill the Google password with ${fill}. NEVER type the Google password as text and NEVER use the IMAP app password here.
+Google / Gmail SSO (use this when the APP has no Create-account email form):
+- App email+password SIGNUP means a form ON THIS APP to create an account (Sign up / Create account / Register, including after "Sign up with email"). That is FIRST. Do not use Google if that form exists.
+- These are NOT app email signup \u2014 do not treat them as the email playbook, and do not fill TEST_USER_EMAIL / TEST_USER_PASSWORD into them when Continue with Google is available:
+  - "Continue with phone" / SMS / OTP
+  - "Mobile or email" / phone-number identity on a Sign in page
+  - Google's own email and password fields on accounts.google.com
+- If Sign in offers Continue with Google (and there is no app Create-account email form): click Continue with Google. Do NOT click Continue with phone for this registration.
+- If a Google popup or tab opens, switch to it. On accounts.google.com, type the BARE Google account email \`${opts.googleEmail}\` (no plus-tag) with browser_type, click Next, then fill the Google password with ${fill}. NEVER type the Google password as text, NEVER use TEST_USER_PASSWORD here, NEVER use the IMAP app password.
 - Click Next.${totp}
 - Click Continue / Allow on any consent screen, then return to the app tab.
 - If the app then emails a verification code/link, first call ${plainProvision} (Google SSO uses the bare inbox address, not the +tag), then complete it with the inbox tools as usual.
@@ -8699,7 +8734,7 @@ var require_credential_tools = __commonJS({
       type: "function",
       function: {
         name: "fill_credential",
-        description: 'Fill a stored credential VALUE into a form field. ALWAYS use this instead of `browser_type` for ANY email/password/token/auth field. You pass the variable KEY (e.g. "TEST_USER_EMAIL") and the runner injects the real value server-side \u2014 you never see the secret. The list of available credential keys is in the system prompt.',
+        description: 'Fill a stored credential VALUE into a form field. ALWAYS use this instead of `browser_type` for ANY email/password/token/auth field. You pass the variable KEY (e.g. "TEST_USER_EMAIL") and the runner injects the real value server-side \u2014 you never see the secret. On accounts.google.com use GOOGLE_SIGNIN_PASSWORD (never TEST_USER_PASSWORD). The list of available credential keys is in the system prompt.',
         parameters: {
           type: "object",
           properties: {
@@ -8861,6 +8896,22 @@ CREDENTIAL ROTATION (required when the STORED user's secret changes \u2014 read
       return entries.map(([k, v]) => `- **${k}**: \`${v}\``).join("\n");
     }
     var DEFAULT_MAX_RESULT_CHARS = 15e3;
+    var PAGE_URL_RE = /Page URL:\s*(\S+)/i;
+    async function peekPageUrl(mcpClient) {
+      try {
+        const mcpResult = await mcpClient.callTool({ name: "browser_snapshot", arguments: {} });
+        const { text } = parseMcpContent(mcpResult);
+        const match = text.match(PAGE_URL_RE);
+        return match?.[1]?.replace(/[),.;]+$/, "");
+      } catch {
+        return void 0;
+      }
+    }
+    function googleFillBlocked(pageUrl, credentialKey, credentials) {
+      return (0, google_signin_js_1.googleSignInCredentialMismatch)(pageUrl, credentialKey, {
+        configured: !!credentials[google_signin_js_1.GOOGLE_SIGNIN_PASSWORD_KEY]
+      });
+    }
     async function handleFillCredential(toolArgs, ctx) {
       const key = typeof toolArgs.credentialKey === "string" ? toolArgs.credentialKey : "";
       const element = typeof toolArgs.element === "string" ? toolArgs.element : "";
@@ -8882,6 +8933,13 @@ CREDENTIAL ROTATION (required when the STORED user's secret changes \u2014 read
           didMutate: false
         };
       }
+      if (ctx.credentials[google_signin_js_1.GOOGLE_SIGNIN_PASSWORD_KEY]) {
+        const pageUrl = await peekPageUrl(ctx.mcpClient);
+        const blocked = googleFillBlocked(pageUrl, key, ctx.credentials);
+        if (blocked) {
+          return { content: JSON.stringify({ error: blocked }), didMutate: false };
+        }
+      }
       const underlyingArgs = { element, ref, text: value, submit };
       const mcpResult = await ctx.mcpClient.callTool({ name: "browser_type", arguments: underlyingArgs });
       const mcpFailed = mcpResultIsError(mcpResult);
@@ -8920,6 +8978,16 @@ CREDENTIAL ROTATION (required when the STORED user's secret changes \u2014 read
         }
         resolved.push({ field, value });
       }
+      if (ctx.credentials[google_signin_js_1.GOOGLE_SIGNIN_PASSWORD_KEY]) {
+        const pageUrl = await peekPageUrl(ctx.mcpClient);
+        for (const f of fields) {
+          const key = typeof f.credentialKey === "string" ? f.credentialKey : typeof f.key === "string" ? f.key : "";
+          const blocked = googleFillBlocked(pageUrl, key, ctx.credentials);
+          if (blocked) {
+            return { content: JSON.stringify({ error: blocked }), didMutate: false };
+          }
+        }
+      }
       if (missing.length > 0) {
         const available = Object.keys(ctx.credentials).filter((k) => ctx.credentials[k]).join(", ") || "(none configured)";
         return {
@@ -74749,7 +74817,7 @@ var require_inbox_tools = __commonJS({
 ${where} You register using ONE real, monitored email (\`${opts.email}\`) and can complete email-verification (OTP code or confirmation link) end-to-end. This OVERRIDES the general "do not submit forms" rule for the signup/registration form ONLY.
 
 Steps:
-1. Navigate to the Sign Up / Register page (click the link in the UI). FIRST look for an email+password signup form (including after "Sign up with email"). Use Google / Gmail SSO ONLY if that form does not exist.
+1. Navigate to the Sign Up / Register / Sign in page (click the link in the UI). FIRST look for an app Create-account email+password form (including after "Sign up with email").${opts.googleEmail && opts.googlePasswordKey ? ' "Continue with phone", SMS OTP, and "Mobile or email" on a Sign in page are NOT that form \u2014 if Continue with Google is offered and there is no app Create-account email form, use the Google / Gmail SSO playbook below (do not click Continue with phone).' : ""}
 2. Call \`provision_identity\` \u2192 it returns the email to register with (\`${opts.email}\`). The \`+\` part is a normal sub-address that still lands in our inbox.
 3. Fill the signup form: type that email into the email field with \`browser_type\` (this generated inbox email is intentionally visible and is allowed for registration); fill the password field with single-field \`fill_credential\` (credentialKey \`${opts.passwordKey}\`); fill any name/other required fields with simple test values. Do NOT use \`fill_credential_form\` for registration.
    - If the form REJECTS the email (says "invalid email" / will not accept the "+"), call \`provision_identity\` again with \`plain: true\` and use the bare address it returns instead.
@@ -74931,7 +74999,7 @@ This project asked to REGISTER a new account, but this runner CANNOT receive ema
       return `## Account registration & email verification (ENABLED)
 This run registers a new account using our ONE real, monitored inbox (the address \`${email}\` \u2014 the "+" part is a normal sub-address that still lands in our inbox) and can complete email verification end-to-end. This overrides any "do not submit forms" guidance for the signup form only.
 
-1. Go to the Sign Up / Register page. FIRST look for an email+password signup form (including after "Sign up with email"). Use Google / Gmail SSO ONLY if that form does not exist.
+1. Go to the Sign Up / Register / Sign in page. FIRST look for an app Create-account email+password form (including after "Sign up with email").${google ? ' "Continue with phone", SMS OTP, and "Mobile or email" on a Sign in page are NOT that form \u2014 if Continue with Google is offered and there is no app Create-account email form, use the Google / Gmail SSO playbook below (do not click Continue with phone).' : ""}
 2. Call \`inbox_provision_identity\` \u2192 it returns the email to register with (\`${email}\`). Type that email into the email field.
    - If the form REJECTS the email (says "invalid email" / will not accept the "+"), call \`inbox_provision_identity\` with \`plain: true\` and use the bare address it returns instead.
 3. Fill the password with the \`${passwordKey}\` credential (use fill_credential). Submit the signup form.
@@ -333344,7 +333412,7 @@ ${keyLines || "- (none provided)"}
 ## EXACTLY what to do
 1. Navigate to ${baseUrl} and take a \`browser_snapshot\`.
 2. Find the Sign Up / Register / Create account affordance (match by PURPOSE, in the app's own language) and open the signup form. If a reveal button hides the fields ("Sign up with Email"), click it first.
-3. Follow the "Account Registration (verification inbox is ENABLED)" steps below EXACTLY: call \`provision_identity\` for the email, type that email, fill the password with \`fill_credential\`, fill any other required fields with simple test values, and submit. If there is NO email+password signup field and only "Continue with Google" / "Sign up with Gmail", follow the Google / Gmail SSO fallback in that section (bare Google account email, \`fill_credential\` with \`GOOGLE_SIGNIN_PASSWORD\`, never the IMAP app password).
+3. Follow the "Account Registration (verification inbox is ENABLED)" steps below EXACTLY: call \`provision_identity\` for the email, type that email, fill the password with \`fill_credential\`, fill any other required fields with simple test values, and submit. If there is no app Create-account email form (phone / "Mobile or email" / SMS do not count) and Sign in offers "Continue with Google", follow the Google / Gmail SSO playbook (bare Google account email, \`fill_credential\` with \`GOOGLE_SIGNIN_PASSWORD\` on accounts.google.com, never TEST_USER_PASSWORD, never Continue with phone).
 4. Complete email verification using the inbox tools (\`wait_for_verification\` \u2192 enter the code or \`open_verification_link\`). Re-poll if the email is slow; resend AT MOST once; NEVER register a second account.
 5. Confirm you are signed in \u2014 a redirect to an authenticated route, or an in-place change to authenticated content. Take a \`browser_snapshot\`.
 6. \`capture_page\` the authenticated landing page in its DEFAULT state, then call \`finish_exploration\`. Do this the MOMENT the account is verified and you are signed in.
@@ -356286,7 +356354,7 @@ var require_package4 = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.93",
+      version: "1.0.94",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"

package/dist/cli.mjs

@@ -8571,10 +8571,13 @@ var require_google_signin = __commonJS({
     exports.googleSignInGuidanceOpts = googleSignInGuidanceOpts;
     exports.googleSignInAllowedEmails = googleSignInAllowedEmails;
     exports.collectGoogleSignInEnv = collectGoogleSignInEnv;
+    exports.isGoogleAccountsUrl = isGoogleAccountsUrl;
+    exports.googleSignInCredentialMismatch = googleSignInCredentialMismatch;
     exports.generateTotp = generateTotp;
     exports.buildGoogleSignInPromptSection = buildGoogleSignInPromptSection;
     var node_crypto_1 = __require("crypto");
     exports.GOOGLE_SIGNIN_PASSWORD_KEY = "GOOGLE_SIGNIN_PASSWORD";
+    var APP_REGISTER_CREDENTIAL_KEYS = /^(TEST_|E2E_|QA_)?(USER_?EMAIL|USER_?PASSWORD|USER_?NAME|USERNAME)$/i;
     exports.GOOGLE_SIGNIN_ENV_KEYS = [
       "GOOGLE_SIGNIN_PASSWORD",
       "GOOGLE_SIGNIN_EMAIL",
@@ -8631,6 +8634,34 @@ var require_google_signin = __commonJS({
       }
       return out;
     }
+    function isGoogleAccountsUrl(url) {
+      if (!url)
+        return false;
+      try {
+        const host = new URL(url).hostname.toLowerCase();
+        return host === "accounts.google.com" || host.endsWith(".google.com") && host.includes("accounts");
+      } catch {
+        return /accounts\.google\.com/i.test(url);
+      }
+    }
+    function googleSignInCredentialMismatch(pageUrl, credentialKey, opts) {
+      const configured = opts?.configured ?? !!loadGoogleSignInConfig(opts?.env);
+      if (!configured)
+        return null;
+      const onGoogle = isGoogleAccountsUrl(pageUrl);
+      if (onGoogle) {
+        if (credentialKey === exports.GOOGLE_SIGNIN_PASSWORD_KEY)
+          return null;
+        if (APP_REGISTER_CREDENTIAL_KEYS.test(credentialKey)) {
+          return `fill_credential: this is Google account login (accounts.google.com), not app email signup. Do not use ${credentialKey}. Type the BARE Google email with browser_type, then fill_credential with credentialKey ${exports.GOOGLE_SIGNIN_PASSWORD_KEY}. Do not click Continue with phone / SMS OTP when Continue with Google is available.`;
+        }
+        return null;
+      }
+      if (credentialKey === exports.GOOGLE_SIGNIN_PASSWORD_KEY) {
+        return `fill_credential: ${exports.GOOGLE_SIGNIN_PASSWORD_KEY} is only for accounts.google.com. Click Continue with Google first (not Continue with phone). Phone / "Mobile or email" is not app email signup.`;
+      }
+      return null;
+    }
     function generateTotp(secret, atMs = Date.now(), stepSeconds = 30, digits = 6) {
       const key = decodeBase32(secret);
       const counter = Math.floor(atMs / 1e3 / stepSeconds);
@@ -8669,10 +8700,14 @@ var require_google_signin = __commonJS({
       const fill = variant === "cli" ? `fill_credential with credentialKey \`${opts.googlePasswordKey}\`` : `\`fill_credential\` (credentialKey \`${opts.googlePasswordKey}\`)`;
       const plainProvision = variant === "cli" ? "`inbox_provision_identity` with `plain: true`" : "`provision_identity` with `plain: true`";
       return `
-Google / Gmail SSO fallback (SECOND choice \u2014 email+password signup is FIRST):
-- FIRST follow the email-field playbook above whenever a signup form has an email / username / password field (including after clicking "Sign up with email"). Do NOT click Google if that form exists.
-- ONLY if there is no email+password signup field and the only path is "Continue with Google" / "Sign up with Gmail" / "Sign in with Google": click that button. If a Google popup opens, switch to it (browser tabs).
-- On accounts.google.com, type the BARE Google account email \`${opts.googleEmail}\` (no plus-tag \u2014 Google account login rejects plus-addresses) with browser_type, click Next, then fill the Google password with ${fill}. NEVER type the Google password as text and NEVER use the IMAP app password here.
+Google / Gmail SSO (use this when the APP has no Create-account email form):
+- App email+password SIGNUP means a form ON THIS APP to create an account (Sign up / Create account / Register, including after "Sign up with email"). That is FIRST. Do not use Google if that form exists.
+- These are NOT app email signup \u2014 do not treat them as the email playbook, and do not fill TEST_USER_EMAIL / TEST_USER_PASSWORD into them when Continue with Google is available:
+  - "Continue with phone" / SMS / OTP
+  - "Mobile or email" / phone-number identity on a Sign in page
+  - Google's own email and password fields on accounts.google.com
+- If Sign in offers Continue with Google (and there is no app Create-account email form): click Continue with Google. Do NOT click Continue with phone for this registration.
+- If a Google popup or tab opens, switch to it. On accounts.google.com, type the BARE Google account email \`${opts.googleEmail}\` (no plus-tag) with browser_type, click Next, then fill the Google password with ${fill}. NEVER type the Google password as text, NEVER use TEST_USER_PASSWORD here, NEVER use the IMAP app password.
 - Click Next.${totp}
 - Click Continue / Allow on any consent screen, then return to the app tab.
 - If the app then emails a verification code/link, first call ${plainProvision} (Google SSO uses the bare inbox address, not the +tag), then complete it with the inbox tools as usual.
@@ -8704,7 +8739,7 @@ var require_credential_tools = __commonJS({
       type: "function",
       function: {
         name: "fill_credential",
-        description: 'Fill a stored credential VALUE into a form field. ALWAYS use this instead of `browser_type` for ANY email/password/token/auth field. You pass the variable KEY (e.g. "TEST_USER_EMAIL") and the runner injects the real value server-side \u2014 you never see the secret. The list of available credential keys is in the system prompt.',
+        description: 'Fill a stored credential VALUE into a form field. ALWAYS use this instead of `browser_type` for ANY email/password/token/auth field. You pass the variable KEY (e.g. "TEST_USER_EMAIL") and the runner injects the real value server-side \u2014 you never see the secret. On accounts.google.com use GOOGLE_SIGNIN_PASSWORD (never TEST_USER_PASSWORD). The list of available credential keys is in the system prompt.',
         parameters: {
           type: "object",
           properties: {
@@ -8866,6 +8901,22 @@ CREDENTIAL ROTATION (required when the STORED user's secret changes \u2014 read
       return entries.map(([k, v]) => `- **${k}**: \`${v}\``).join("\n");
     }
     var DEFAULT_MAX_RESULT_CHARS = 15e3;
+    var PAGE_URL_RE = /Page URL:\s*(\S+)/i;
+    async function peekPageUrl(mcpClient) {
+      try {
+        const mcpResult = await mcpClient.callTool({ name: "browser_snapshot", arguments: {} });
+        const { text } = parseMcpContent(mcpResult);
+        const match = text.match(PAGE_URL_RE);
+        return match?.[1]?.replace(/[),.;]+$/, "");
+      } catch {
+        return void 0;
+      }
+    }
+    function googleFillBlocked(pageUrl, credentialKey, credentials) {
+      return (0, google_signin_js_1.googleSignInCredentialMismatch)(pageUrl, credentialKey, {
+        configured: !!credentials[google_signin_js_1.GOOGLE_SIGNIN_PASSWORD_KEY]
+      });
+    }
     async function handleFillCredential(toolArgs, ctx) {
       const key = typeof toolArgs.credentialKey === "string" ? toolArgs.credentialKey : "";
       const element = typeof toolArgs.element === "string" ? toolArgs.element : "";
@@ -8887,6 +8938,13 @@ CREDENTIAL ROTATION (required when the STORED user's secret changes \u2014 read
           didMutate: false
         };
       }
+      if (ctx.credentials[google_signin_js_1.GOOGLE_SIGNIN_PASSWORD_KEY]) {
+        const pageUrl = await peekPageUrl(ctx.mcpClient);
+        const blocked = googleFillBlocked(pageUrl, key, ctx.credentials);
+        if (blocked) {
+          return { content: JSON.stringify({ error: blocked }), didMutate: false };
+        }
+      }
       const underlyingArgs = { element, ref, text: value, submit };
       const mcpResult = await ctx.mcpClient.callTool({ name: "browser_type", arguments: underlyingArgs });
       const mcpFailed = mcpResultIsError(mcpResult);
@@ -8925,6 +8983,16 @@ CREDENTIAL ROTATION (required when the STORED user's secret changes \u2014 read
         }
         resolved.push({ field, value });
       }
+      if (ctx.credentials[google_signin_js_1.GOOGLE_SIGNIN_PASSWORD_KEY]) {
+        const pageUrl = await peekPageUrl(ctx.mcpClient);
+        for (const f of fields) {
+          const key = typeof f.credentialKey === "string" ? f.credentialKey : typeof f.key === "string" ? f.key : "";
+          const blocked = googleFillBlocked(pageUrl, key, ctx.credentials);
+          if (blocked) {
+            return { content: JSON.stringify({ error: blocked }), didMutate: false };
+          }
+        }
+      }
       if (missing.length > 0) {
         const available = Object.keys(ctx.credentials).filter((k) => ctx.credentials[k]).join(", ") || "(none configured)";
         return {
@@ -74754,7 +74822,7 @@ var require_inbox_tools = __commonJS({
 ${where} You register using ONE real, monitored email (\`${opts.email}\`) and can complete email-verification (OTP code or confirmation link) end-to-end. This OVERRIDES the general "do not submit forms" rule for the signup/registration form ONLY.
 
 Steps:
-1. Navigate to the Sign Up / Register page (click the link in the UI). FIRST look for an email+password signup form (including after "Sign up with email"). Use Google / Gmail SSO ONLY if that form does not exist.
+1. Navigate to the Sign Up / Register / Sign in page (click the link in the UI). FIRST look for an app Create-account email+password form (including after "Sign up with email").${opts.googleEmail && opts.googlePasswordKey ? ' "Continue with phone", SMS OTP, and "Mobile or email" on a Sign in page are NOT that form \u2014 if Continue with Google is offered and there is no app Create-account email form, use the Google / Gmail SSO playbook below (do not click Continue with phone).' : ""}
 2. Call \`provision_identity\` \u2192 it returns the email to register with (\`${opts.email}\`). The \`+\` part is a normal sub-address that still lands in our inbox.
 3. Fill the signup form: type that email into the email field with \`browser_type\` (this generated inbox email is intentionally visible and is allowed for registration); fill the password field with single-field \`fill_credential\` (credentialKey \`${opts.passwordKey}\`); fill any name/other required fields with simple test values. Do NOT use \`fill_credential_form\` for registration.
    - If the form REJECTS the email (says "invalid email" / will not accept the "+"), call \`provision_identity\` again with \`plain: true\` and use the bare address it returns instead.
@@ -74936,7 +75004,7 @@ This project asked to REGISTER a new account, but this runner CANNOT receive ema
       return `## Account registration & email verification (ENABLED)
 This run registers a new account using our ONE real, monitored inbox (the address \`${email}\` \u2014 the "+" part is a normal sub-address that still lands in our inbox) and can complete email verification end-to-end. This overrides any "do not submit forms" guidance for the signup form only.
 
-1. Go to the Sign Up / Register page. FIRST look for an email+password signup form (including after "Sign up with email"). Use Google / Gmail SSO ONLY if that form does not exist.
+1. Go to the Sign Up / Register / Sign in page. FIRST look for an app Create-account email+password form (including after "Sign up with email").${google ? ' "Continue with phone", SMS OTP, and "Mobile or email" on a Sign in page are NOT that form \u2014 if Continue with Google is offered and there is no app Create-account email form, use the Google / Gmail SSO playbook below (do not click Continue with phone).' : ""}
 2. Call \`inbox_provision_identity\` \u2192 it returns the email to register with (\`${email}\`). Type that email into the email field.
    - If the form REJECTS the email (says "invalid email" / will not accept the "+"), call \`inbox_provision_identity\` with \`plain: true\` and use the bare address it returns instead.
 3. Fill the password with the \`${passwordKey}\` credential (use fill_credential). Submit the signup form.
@@ -333349,7 +333417,7 @@ ${keyLines || "- (none provided)"}
 ## EXACTLY what to do
 1. Navigate to ${baseUrl} and take a \`browser_snapshot\`.
 2. Find the Sign Up / Register / Create account affordance (match by PURPOSE, in the app's own language) and open the signup form. If a reveal button hides the fields ("Sign up with Email"), click it first.
-3. Follow the "Account Registration (verification inbox is ENABLED)" steps below EXACTLY: call \`provision_identity\` for the email, type that email, fill the password with \`fill_credential\`, fill any other required fields with simple test values, and submit. If there is NO email+password signup field and only "Continue with Google" / "Sign up with Gmail", follow the Google / Gmail SSO fallback in that section (bare Google account email, \`fill_credential\` with \`GOOGLE_SIGNIN_PASSWORD\`, never the IMAP app password).
+3. Follow the "Account Registration (verification inbox is ENABLED)" steps below EXACTLY: call \`provision_identity\` for the email, type that email, fill the password with \`fill_credential\`, fill any other required fields with simple test values, and submit. If there is no app Create-account email form (phone / "Mobile or email" / SMS do not count) and Sign in offers "Continue with Google", follow the Google / Gmail SSO playbook (bare Google account email, \`fill_credential\` with \`GOOGLE_SIGNIN_PASSWORD\` on accounts.google.com, never TEST_USER_PASSWORD, never Continue with phone).
 4. Complete email verification using the inbox tools (\`wait_for_verification\` \u2192 enter the code or \`open_verification_link\`). Re-poll if the email is slow; resend AT MOST once; NEVER register a second account.
 5. Confirm you are signed in \u2014 a redirect to an authenticated route, or an in-place change to authenticated content. Take a \`browser_snapshot\`.
 6. \`capture_page\` the authenticated landing page in its DEFAULT state, then call \`finish_exploration\`. Do this the MOMENT the account is verified and you are signed in.
@@ -356291,7 +356359,7 @@ var require_package4 = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.93",
+      version: "1.0.94",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@validate.qa/runner",
-  "version": "1.0.93",
+  "version": "1.0.94",
   "description": "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
   "bin": {
     "validate-runner": "dist/cli.js"