@vostride/agent-qa-core 0.1.13 → 0.1.15

package/dist/index.js

@@ -23,50 +23,50 @@ var init_config = __esm({
 });
 
 // src/memory/schema.ts
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 import { isCanonicalObservationId, isObservationId } from "@vostride/agent-qa-ids";
 var ObservationIdSchema, CanonicalObservationIdSchema, ObservationSuiteSnapshotEntrySchema, BaseObservationSchema, SuiteObservationSchema, BaseObservationWriteSchema, SuiteObservationWriteSchema;
 var init_schema = __esm({
   "src/memory/schema.ts"() {
     "use strict";
-    ObservationIdSchema = z18.string().refine((value) => isObservationId(value), {
+    ObservationIdSchema = z19.string().refine((value) => isObservationId(value), {
       message: "Observation ID must be obs_ followed by either 10 canonical words or a legacy 6-word body"
     });
-    CanonicalObservationIdSchema = z18.string().refine((value) => isCanonicalObservationId(value), {
+    CanonicalObservationIdSchema = z19.string().refine((value) => isCanonicalObservationId(value), {
       message: "Observation ID must be obs_ followed by 10 id-agent words"
     });
-    ObservationSuiteSnapshotEntrySchema = z18.object({
-      test: z18.string(),
-      id: z18.string()
+    ObservationSuiteSnapshotEntrySchema = z19.object({
+      test: z19.string(),
+      id: z19.string()
     }).strict();
-    BaseObservationSchema = z18.object({
+    BaseObservationSchema = z19.object({
       id: ObservationIdSchema,
-      title: z18.string().min(1),
-      content: z18.string().min(1),
-      trust: z18.number().min(0).max(1),
-      created: z18.string().datetime(),
-      last_confirmed: z18.string().datetime(),
-      confirmed_count: z18.number().int().min(0),
-      contradicted_count: z18.number().int().min(0),
-      source_test: z18.string().min(1)
+      title: z19.string().min(1),
+      content: z19.string().min(1),
+      trust: z19.number().min(0).max(1),
+      created: z19.string().datetime(),
+      last_confirmed: z19.string().datetime(),
+      confirmed_count: z19.number().int().min(0),
+      contradicted_count: z19.number().int().min(0),
+      source_test: z19.string().min(1)
     }).strip();
     SuiteObservationSchema = BaseObservationSchema.extend({
-      position: z18.number().int().min(0),
-      suite_snapshot: z18.array(ObservationSuiteSnapshotEntrySchema).min(1)
+      position: z19.number().int().min(0),
+      suite_snapshot: z19.array(ObservationSuiteSnapshotEntrySchema).min(1)
     }).strip();
     BaseObservationWriteSchema = BaseObservationSchema.extend({
       id: CanonicalObservationIdSchema
     }).strip();
     SuiteObservationWriteSchema = BaseObservationWriteSchema.extend({
-      position: z18.number().int().min(0),
-      suite_snapshot: z18.array(ObservationSuiteSnapshotEntrySchema).min(1)
+      position: z19.number().int().min(0),
+      suite_snapshot: z19.array(ObservationSuiteSnapshotEntrySchema).min(1)
     }).strip();
   }
 });
 
 // src/memory/observation-io.ts
 import { parse as parseYaml2, stringify as stringifyYaml } from "yaml";
-import { mkdir as mkdir5, writeFile as writeFile5, readdir as readdir2 } from "fs/promises";
+import { mkdir as mkdir6, writeFile as writeFile6, readdir as readdir3 } from "fs/promises";
 import { join as join5, resolve as resolve4, sep } from "path";
 function toObservationFrontmatter(data) {
   const { content, ...frontmatter } = data;
@@ -74,7 +74,7 @@ function toObservationFrontmatter(data) {
 }
 async function ensureMemoryDirs(root) {
   await Promise.all(
-    MEMORY_TIERS.map((tier) => mkdir5(join5(root, tier), { recursive: true }))
+    MEMORY_TIERS.map((tier) => mkdir6(join5(root, tier), { recursive: true }))
   );
 }
 async function writeObservation(root, tier, scope, data) {
@@ -87,13 +87,13 @@ async function writeObservation(root, tier, scope, data) {
   const schema = "position" in data ? SuiteObservationWriteSchema : BaseObservationWriteSchema;
   const validated = schema.parse(data);
   const frontmatter = toObservationFrontmatter(validated);
-  await mkdir5(dir, { recursive: true });
+  await mkdir6(dir, { recursive: true });
   const content = `---
 ${stringifyYaml({ ...frontmatter }, { lineWidth: 0 })}---
 ${validated.content}
 `;
   const filePath = join5(dir, `${data.id}.md`);
-  await writeFile5(filePath, content, "utf-8");
+  await writeFile6(filePath, content, "utf-8");
   return filePath;
 }
 function parseObservation(content, filename) {
@@ -130,7 +130,7 @@ function parseObservation(content, filename) {
 async function listObservations(dir) {
   let entries;
   try {
-    entries = await readdir2(dir);
+    entries = await readdir3(dir);
   } catch (e) {
     if (e instanceof Error && "code" in e && e.code === "ENOENT") {
       return [];
@@ -359,19 +359,19 @@ function loadBetterSqlite3() {
   sqliteConstructor = require2("better-sqlite3");
   return sqliteConstructor;
 }
-function openBetterSqlite3Database(path5) {
+function openBetterSqlite3Database(path7) {
   const Database = loadBetterSqlite3();
-  return new Database(path5);
+  return new Database(path7);
 }
-function createBetterSqlite3Database(path5) {
+function createBetterSqlite3Database(path7) {
   try {
-    return openBetterSqlite3Database(path5);
+    return openBetterSqlite3Database(path7);
   } catch (error) {
     if (!isBetterSqlite3NativeModuleError(error)) {
       throw error;
     }
     rebuildBetterSqlite3ForCurrentRuntime(error);
-    return openBetterSqlite3Database(path5);
+    return openBetterSqlite3Database(path7);
   }
 }
 var require2, sqliteConstructor, rebuildAttempted, rebuildFailureMessage;
@@ -386,7 +386,7 @@ var init_sqlite = __esm({
 });
 
 // src/memory/memory-index.ts
-import { readFile as readFile12 } from "fs/promises";
+import { readFile as readFile14 } from "fs/promises";
 import { join as join8 } from "path";
 function validatePathComponent(value) {
   return !/\.\./.test(value) && !/[/\\]/.test(value) && !/\0/.test(value);
@@ -437,7 +437,7 @@ async function buildMemoryIndex(params) {
         const filePath = join8(dirPath, filename);
         let raw;
         try {
-          raw = await readFile12(filePath, "utf-8");
+          raw = await readFile14(filePath, "utf-8");
         } catch {
           continue;
         }
@@ -484,7 +484,7 @@ var init_xml_escape = __esm({
 });
 
 // src/memory/lock-manager.ts
-import { writeFile as writeFile7, readFile as readFile13, unlink as unlink3, mkdir as mkdir7 } from "fs/promises";
+import { writeFile as writeFile8, readFile as readFile15, unlink as unlink3, mkdir as mkdir8 } from "fs/promises";
 import { dirname as dirname12 } from "path";
 var LockManager;
 var init_lock_manager = __esm({
@@ -498,17 +498,17 @@ var init_lock_manager = __esm({
         this.timeout = timeout;
       }
       async acquire() {
-        await mkdir7(dirname12(this.lockPath), { recursive: true });
+        await mkdir8(dirname12(this.lockPath), { recursive: true });
         const deadline = Date.now() + this.timeout;
         while (Date.now() < deadline) {
           try {
-            await writeFile7(
+            await writeFile8(
               this.lockPath,
               JSON.stringify({ pid: process.pid, timestamp: (/* @__PURE__ */ new Date()).toISOString() }),
               { flag: "wx" }
             );
             try {
-              const raw = await readFile13(this.lockPath, "utf-8");
+              const raw = await readFile15(this.lockPath, "utf-8");
               const { pid } = JSON.parse(raw);
               if (pid === process.pid) return;
             } catch {
@@ -532,7 +532,7 @@ var init_lock_manager = __esm({
       async release() {
         let raw;
         try {
-          raw = await readFile13(this.lockPath, "utf-8");
+          raw = await readFile15(this.lockPath, "utf-8");
         } catch (err) {
           if (err instanceof Error && "code" in err && err.code === "ENOENT") {
             return;
@@ -555,7 +555,7 @@ var init_lock_manager = __esm({
       async isStale() {
         let raw;
         try {
-          raw = await readFile13(this.lockPath, "utf-8");
+          raw = await readFile15(this.lockPath, "utf-8");
         } catch (err) {
           if (err instanceof Error && "code" in err && err.code === "ENOENT") {
             return true;
@@ -867,7 +867,7 @@ ${lines.join("\n")}
 });
 
 // src/schema/config-schema.ts
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 
 // src/schema/workspace-schema.ts
 import { z } from "zod";
@@ -1037,6 +1037,9 @@ var CacheConfigSchema = z3.object({
   dir: z3.string(),
   ttl: DurationString
 }).strict();
+var AuthStateConfigSchema = z3.object({
+  dir: z3.string().trim().min(1)
+}).strict();
 var LoggingConfigSchema = z3.object({
   level: z3.enum(["silent", "error", "warn", "info", "debug"])
 }).strict();
@@ -1071,6 +1074,7 @@ var ServicesSchema = z3.object({
   dashboard: DashboardConfigSchema.optional(),
   mcp: McpConfigSchema.optional(),
   cache: CacheConfigSchema.optional(),
+  authState: AuthStateConfigSchema.optional(),
   logging: LoggingConfigSchema.optional(),
   recording: RecordingConfigSchema.optional(),
   accessibility: AccessibilityConfigSchema.optional(),
@@ -1078,34 +1082,56 @@ var ServicesSchema = z3.object({
 }).strict();
 
 // src/schema/registry-schema.ts
+import { z as z5 } from "zod";
+
+// src/auth-state/schema.ts
 import { z as z4 } from "zod";
+var AUTH_STATE_SCHEMA_VERSION = 1;
+var AUTH_STATE_SLUG_PATTERN = /^[a-z][a-z0-9-]*[a-z0-9]$/;
+var AuthStateNameSchema = z4.string().regex(
+  AUTH_STATE_SLUG_PATTERN,
+  "Auth state name must match ^[a-z][a-z0-9-]*[a-z0-9]$"
+);
+var TargetNameSchema = z4.string().regex(
+  AUTH_STATE_SLUG_PATTERN,
+  "Target name must match ^[a-z][a-z0-9-]*[a-z0-9]$"
+);
+var AuthStateMetadataSchema = z4.object({
+  version: z4.literal(AUTH_STATE_SCHEMA_VERSION),
+  kind: z4.literal("web"),
+  target: TargetNameSchema,
+  name: AuthStateNameSchema,
+  capturedAt: z4.string().datetime()
+}).strict();
+
+// src/schema/registry-schema.ts
 function isAbsoluteAppPath(value) {
   return value.startsWith("/") || /^[A-Za-z]:[\\/]/.test(value) || value.startsWith("\\\\");
 }
-var AppInstallSchema = z4.object({
-  path: z4.string().refine((v) => !isAbsoluteAppPath(v), { message: "app.path must be relative" }).optional(),
-  browserstack: z4.string().optional()
+var AppInstallSchema = z5.object({
+  path: z5.string().refine((v) => !isAbsoluteAppPath(v), { message: "app.path must be relative" }).optional(),
+  browserstack: z5.string().optional()
 }).strict();
-var TargetSchema = z4.object({
-  product: z4.string().refine(
+var TargetSchema = z5.object({
+  product: z5.string().refine(
     (v) => !/\.\./.test(v) && !/[/\\]/.test(v) && !/\0/.test(v),
     { message: 'product must not contain "..", "/", "\\", or null bytes' }
   ).optional(),
-  platform: z4.enum(["web", "android", "ios"]),
-  bundleId: z4.string().optional(),
-  appPackage: z4.string().optional(),
-  appActivity: z4.string().optional(),
+  platform: z5.enum(["web", "android", "ios"]),
+  bundleId: z5.string().optional(),
+  appPackage: z5.string().optional(),
+  appActivity: z5.string().optional(),
   app: AppInstallSchema.optional(),
-  url: z4.string().optional()
+  url: z5.string().optional()
 }).strict().superRefine((val, ctx) => {
   if (val.platform === "web" && !val.url) {
-    ctx.addIssue({ code: z4.ZodIssueCode.custom, message: "Web targets must have a url" });
+    ctx.addIssue({ code: z5.ZodIssueCode.custom, message: "Web targets must have a url" });
   }
 });
-var DeviceProfileSchema = z4.object({
-  platform: z4.enum(["android", "ios"]),
+var DeviceProfileSchema = z5.object({
+  platform: z5.enum(["android", "ios"]),
   transport: TransportSchema,
-  match: z4.record(z4.string(), z4.unknown()).optional().default({})
+  match: z5.record(z5.string(), z5.unknown()).optional().default({})
 }).strict().superRefine((val, ctx) => {
   if (val.transport === "local") {
     const androidOnly = ["avd", "serial", "appPackage", "appActivity", "automationName", "browserName", "platformVersion"];
@@ -1114,7 +1140,7 @@ var DeviceProfileSchema = z4.object({
     for (const key of Object.keys(val.match)) {
       if (!allowed.includes(key)) {
         ctx.addIssue({
-          code: z4.ZodIssueCode.custom,
+          code: z5.ZodIssueCode.custom,
           path: ["match", key],
           message: `Match field "${key}" is not valid for ${val.platform} local transport. Allowed: ${allowed.join(", ")}`
         });
@@ -1122,94 +1148,119 @@ var DeviceProfileSchema = z4.object({
     }
   }
 });
-var ProviderConfigSchema = z4.record(z4.string(), z4.unknown());
-var RegistrySchema = z4.object({
-  llms: z4.array(NamedLLMConfigSchema).optional().default([]),
-  targets: z4.record(z4.string(), TargetSchema).optional(),
-  devices: z4.record(z4.string(), DeviceProfileSchema).optional(),
-  providers: z4.record(z4.string(), ProviderConfigSchema).optional()
+var ProviderConfigSchema = z5.record(z5.string(), z5.unknown());
+var RegistrySchema = z5.object({
+  llms: z5.array(NamedLLMConfigSchema).optional().default([]),
+  targets: z5.record(TargetNameSchema, TargetSchema).optional(),
+  devices: z5.record(z5.string(), DeviceProfileSchema).optional(),
+  providers: z5.record(z5.string(), ProviderConfigSchema).optional()
 }).strict();
 
 // src/schema/use-schema.ts
-import { z as z5 } from "zod";
-var MobileAppStateSchema = z5.enum(["preserve", "reset"]);
-var MobileUseSchema = z5.object({
+import { z as z6 } from "zod";
+var MobileAppStateSchema = z6.enum(["preserve", "reset"]);
+var MobileUseSchema = z6.object({
   appState: MobileAppStateSchema
 }).strict();
-var MobileUseOverrideSchema = z5.object({
+var MobileUseOverrideSchema = z6.object({
   appState: MobileAppStateSchema.optional()
 }).strict();
-var UseSchema = z5.object({
+var AuthStateUseSchema = z6.union([
+  AuthStateNameSchema,
+  z6.object({
+    name: AuthStateNameSchema,
+    load: z6.boolean().optional(),
+    capture: z6.boolean().optional()
+  }).strict()
+]);
+function normalizeAuthStateUse(use) {
+  const parsed = AuthStateUseSchema.safeParse(use?.authState);
+  if (!parsed.success) return void 0;
+  if (typeof parsed.data === "string") {
+    return {
+      name: parsed.data,
+      load: true,
+      capture: false
+    };
+  }
+  return {
+    name: parsed.data.name,
+    load: parsed.data.load ?? true,
+    capture: parsed.data.capture ?? false
+  };
+}
+var UseSchema = z6.object({
   browser: BrowserConfigSchema.optional(),
   mobile: MobileUseSchema.optional(),
   timeout: TimeoutConfigSchema.optional(),
   healing: HealingConfigSchema.optional(),
   planner: PlannerConfigSchema.optional(),
   logCapture: LogCaptureConfigSchema.optional(),
-  cache: z5.boolean().optional(),
-  llm: z5.string().optional(),
-  parallel: z5.boolean().optional()
+  cache: z6.boolean().optional(),
+  llm: z6.string().optional(),
+  parallel: z6.boolean().optional()
 }).strict();
-var UseOverrideSchema = z5.object({
-  browser: z5.object({
-    name: z5.enum(["chromium", "firefox", "webkit"]).optional(),
-    headless: z5.boolean().optional(),
-    viewport: z5.object({
-      width: z5.number().optional(),
-      height: z5.number().optional()
+var UseOverrideSchema = z6.object({
+  browser: z6.object({
+    name: z6.enum(["chromium", "firefox", "webkit"]).optional(),
+    headless: z6.boolean().optional(),
+    viewport: z6.object({
+      width: z6.number().optional(),
+      height: z6.number().optional()
     }).strict().optional()
   }).strict().optional(),
-  timeout: z5.object({
+  timeout: z6.object({
     step: DurationString.optional(),
     test: DurationString.optional(),
     navigation: DurationString.optional()
   }).strict().optional(),
-  healing: z5.object({
-    maxAttempts: z5.number().optional()
+  healing: z6.object({
+    maxAttempts: z6.number().optional()
   }).strict().optional(),
-  planner: z5.object({
-    maxSubActions: z5.number().optional(),
-    previousStepCount: z5.number().optional()
+  planner: z6.object({
+    maxSubActions: z6.number().optional(),
+    previousStepCount: z6.number().optional()
   }).strict().optional(),
-  logCapture: z5.object({
-    console: z5.boolean().optional(),
-    network: z5.boolean().optional()
+  logCapture: z6.object({
+    console: z6.boolean().optional(),
+    network: z6.boolean().optional()
   }).strict().optional(),
-  cache: z5.boolean().optional(),
+  cache: z6.boolean().optional(),
+  authState: AuthStateUseSchema.optional(),
   mobile: MobileUseOverrideSchema.optional(),
-  llm: z5.string().optional(),
-  parallel: z5.boolean().optional(),
-  device: z5.string().optional()
+  llm: z6.string().optional(),
+  parallel: z6.boolean().optional(),
+  device: z6.string().optional()
 }).strict();
 
 // src/schema/analytics-schema.ts
-import { z as z6 } from "zod";
-var AttributePredicateSchema = z6.union([
-  z6.string(),
-  z6.object({
-    regex: z6.string().min(1)
+import { z as z7 } from "zod";
+var AttributePredicateSchema = z7.union([
+  z7.string(),
+  z7.object({
+    regex: z7.string().min(1)
   }).strict()
 ]);
-var AnalyticsSchema = z6.object({
-  privacy: z6.literal(true).optional(),
-  passRateScope: z6.object({
-    attributes: z6.record(z6.string(), AttributePredicateSchema).optional()
+var AnalyticsSchema = z7.object({
+  privacy: z7.literal(true).optional(),
+  passRateScope: z7.object({
+    attributes: z7.record(z7.string(), AttributePredicateSchema).optional()
   }).strict().optional()
 }).strict();
 
 // src/schema/config-schema.ts
-var AuthPluginDeclarationSchema = z7.union([
-  z7.object({
-    package: z7.string().trim().min(1)
+var AuthPluginDeclarationSchema = z8.union([
+  z8.object({
+    package: z8.string().trim().min(1)
   }).strict(),
-  z7.object({
-    path: z7.string().trim().min(1)
+  z8.object({
+    path: z8.string().trim().min(1)
   }).strict()
 ]);
-var PluginsSchema = z7.object({
-  auth: z7.array(AuthPluginDeclarationSchema).optional().default([])
+var PluginsSchema = z8.object({
+  auth: z8.array(AuthPluginDeclarationSchema).optional().default([])
 }).strict();
-var AgentQaConfigSchema = z7.object({
+var AgentQaConfigSchema = z8.object({
   workspace: WorkspaceSchema,
   services: ServicesSchema.optional(),
   registry: RegistrySchema.optional(),
@@ -1222,28 +1273,28 @@ var AgentQaConfigSchema = z7.object({
   const dupes = names.filter((n, i) => names.indexOf(n) !== i);
   for (const dupe of new Set(dupes)) {
     ctx.addIssue({
-      code: z7.ZodIssueCode.custom,
+      code: z8.ZodIssueCode.custom,
       path: ["registry", "llms"],
       message: `Duplicate LLM config name: "${dupe}"`
     });
   }
   if (val.use?.platform) {
     ctx.addIssue({
-      code: z7.ZodIssueCode.custom,
+      code: z8.ZodIssueCode.custom,
       path: ["use", "platform"],
       message: "use.platform cannot be set at global config level. Set platform in test or suite YAML instead."
     });
   }
   if (val.use?.llm && !names.includes(val.use.llm)) {
     ctx.addIssue({
-      code: z7.ZodIssueCode.custom,
+      code: z8.ZodIssueCode.custom,
       path: ["use", "llm"],
       message: `use.llm "${val.use.llm}" does not match any name in registry.llms`
     });
   }
   if (!MobileAppStateSchema.safeParse(val.use?.mobile?.appState).success) {
     ctx.addIssue({
-      code: z7.ZodIssueCode.custom,
+      code: z8.ZodIssueCode.custom,
       path: ["use", "mobile", "appState"],
       message: "use.mobile.appState is required and must be one of: preserve | reset"
     });
@@ -1251,123 +1302,123 @@ var AgentQaConfigSchema = z7.object({
 });
 
 // src/schema/test-schema.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 import ms2 from "ms";
 import { isCanonicalHookId, isCanonicalTestId } from "@vostride/agent-qa-ids";
-var OptionalDuration = z8.string().refine((v) => ms2(v) !== void 0, {
+var OptionalDuration = z9.string().refine((v) => ms2(v) !== void 0, {
   message: 'Invalid duration format (e.g., "30s", "5m", "1h")'
 }).transform((v) => ms2(v)).optional();
-var CaptureConfigSchema = z8.object({
-  variable: z8.string(),
-  method: z8.enum(["regex", "selector", "ai"]),
-  pattern: z8.string().optional(),
-  selector: z8.string().optional(),
-  description: z8.string().optional()
+var CaptureConfigSchema = z9.object({
+  variable: z9.string(),
+  method: z9.enum(["regex", "selector", "ai"]),
+  pattern: z9.string().optional(),
+  selector: z9.string().optional(),
+  description: z9.string().optional()
 }).strict();
-var TestStepSchema = z8.union([
-  z8.string(),
-  z8.object({
-    step: z8.string(),
+var TestStepSchema = z9.union([
+  z9.string(),
+  z9.object({
+    step: z9.string(),
     timeout: OptionalDuration,
-    retries: z8.number().optional(),
-    screenshot: z8.boolean().optional(),
+    retries: z9.number().optional(),
+    screenshot: z9.boolean().optional(),
     capture: CaptureConfigSchema.optional(),
-    maxAttempts: z8.number().optional()
+    maxAttempts: z9.number().optional()
   }).strict()
 ]);
-var TestMetaSchema = z8.object({
+var TestMetaSchema = z9.object({
   timeout: OptionalDuration,
-  retries: z8.number().optional(),
-  record: z8.boolean().optional()
+  retries: z9.number().optional(),
+  record: z9.boolean().optional()
 }).strict();
-var HookIdSchema = z8.string().refine((value) => isCanonicalHookId(value), {
+var HookIdSchema = z9.string().refine((value) => isCanonicalHookId(value), {
   message: "Hook ID must be h_ followed by 10 id-agent words"
 });
-var TestDefinitionSchema = z8.object({
-  "test-id": z8.string().refine((value) => isCanonicalTestId(value), {
+var TestDefinitionSchema = z9.object({
+  "test-id": z9.string().refine((value) => isCanonicalTestId(value), {
     message: "Test ID must be t_ followed by 10 id-agent words"
   }),
-  name: z8.string(),
-  target: z8.string(),
-  context: z8.string().optional(),
+  name: z9.string(),
+  target: z9.string(),
+  context: z9.string().optional(),
   use: UseOverrideSchema.optional(),
   meta: TestMetaSchema.optional(),
-  setup: z8.array(HookIdSchema).optional(),
-  teardown: z8.array(HookIdSchema).optional(),
-  steps: z8.array(TestStepSchema).min(1)
+  setup: z9.array(HookIdSchema).optional(),
+  teardown: z9.array(HookIdSchema).optional(),
+  steps: z9.array(TestStepSchema).min(1)
 }).strict();
 
 // src/schema/action-schema.ts
-import { z as z9 } from "zod";
-var ActionPlanSchema = z9.object({
-  reasoning: z9.string().describe("Brief explanation of why this action was chosen"),
-  action: z9.object({ type: z9.string() }).passthrough(),
-  confidence: z9.number().describe("Confidence level from 0 to 1"),
-  stepComplete: z9.boolean().default(false).describe("Whether this action completes the step goal. Set true when the step objective is fully accomplished, false when more actions are needed."),
-  stepFailed: z9.boolean().optional().default(false).describe("Set true when the step goal cannot be achieved from the current screen state. When true, no action is executed and the step fails with the reasoning as the error message.")
+import { z as z10 } from "zod";
+var ActionPlanSchema = z10.object({
+  reasoning: z10.string().describe("Brief explanation of why this action was chosen"),
+  action: z10.object({ type: z10.string() }).passthrough(),
+  confidence: z10.number().describe("Confidence level from 0 to 1"),
+  stepComplete: z10.boolean().default(false).describe("Whether this action completes the step goal. Set true when the step objective is fully accomplished, false when more actions are needed."),
+  stepFailed: z10.boolean().optional().default(false).describe("Set true when the step goal cannot be achieved from the current screen state. When true, no action is executed and the step fails with the reasoning as the error message.")
 });
 
 // src/schema/suite-schema.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 import { isCanonicalHookId as isCanonicalHookId2, isCanonicalSuiteId, isCanonicalTestId as isCanonicalTestId2 } from "@vostride/agent-qa-ids";
-var SuiteTestEntrySchema = z10.object({
-  test: z10.string(),
-  id: z10.string().refine((value) => isCanonicalTestId2(value), {
+var SuiteTestEntrySchema = z11.object({
+  test: z11.string(),
+  id: z11.string().refine((value) => isCanonicalTestId2(value), {
     message: "Test ID must be t_ followed by 10 id-agent words"
   })
 }).strict();
-var HookIdSchema2 = z10.string().refine((value) => isCanonicalHookId2(value), {
+var HookIdSchema2 = z11.string().refine((value) => isCanonicalHookId2(value), {
   message: "Hook ID must be h_ followed by 10 id-agent words"
 });
-var SuiteDefinitionSchema = z10.object({
-  "suite-id": z10.string().refine((value) => isCanonicalSuiteId(value), {
+var SuiteDefinitionSchema = z11.object({
+  "suite-id": z11.string().refine((value) => isCanonicalSuiteId(value), {
     message: "Suite ID must be s_ followed by 10 id-agent words"
   }).optional(),
-  name: z10.string(),
-  target: z10.string(),
-  context: z10.string().optional(),
-  setup: z10.array(HookIdSchema2).optional(),
-  teardown: z10.array(HookIdSchema2).optional(),
-  tests: z10.array(SuiteTestEntrySchema).min(1),
+  name: z11.string(),
+  target: z11.string(),
+  context: z11.string().optional(),
+  setup: z11.array(HookIdSchema2).optional(),
+  teardown: z11.array(HookIdSchema2).optional(),
+  tests: z11.array(SuiteTestEntrySchema).min(1),
   use: UseOverrideSchema.optional()
 }).strict();
 
 // src/hooks/schema.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 import ms3 from "ms";
 import { isCanonicalHookId as isCanonicalHookId3 } from "@vostride/agent-qa-ids";
-var HookDurationString = z11.string().refine((v) => ms3(v) !== void 0, {
+var HookDurationString = z12.string().refine((v) => ms3(v) !== void 0, {
   message: 'Invalid duration format (e.g., "30s", "2m", "1h")'
 }).transform((v) => ms3(v));
 var HOOK_ID_MESSAGE = "Hook ID must be h_ followed by 10 id-agent words";
-var HookDefinitionSchema = z11.object({
-  id: z11.string().refine((value) => isCanonicalHookId3(value), {
+var HookDefinitionSchema = z12.object({
+  id: z12.string().refine((value) => isCanonicalHookId3(value), {
     message: HOOK_ID_MESSAGE
   }),
-  name: z11.string().min(1),
-  runtime: z11.enum(["node", "bun", "python", "bash"]),
-  file: z11.string().min(1),
-  deps: z11.array(z11.string()).optional().default([]),
-  packageFile: z11.string().optional(),
+  name: z12.string().min(1),
+  runtime: z12.enum(["node", "bun", "python", "bash"]),
+  file: z12.string().min(1),
+  deps: z12.array(z12.string()).optional().default([]),
+  packageFile: z12.string().optional(),
   timeout: HookDurationString,
-  network: z11.boolean().optional().default(true)
+  network: z12.boolean().optional().default(true)
 });
-var HooksFileSchema = z11.object({
-  hooks: z11.array(HookDefinitionSchema)
+var HooksFileSchema = z12.object({
+  hooks: z12.array(HookDefinitionSchema)
 }).superRefine((val, ctx) => {
   const ids = /* @__PURE__ */ new Set();
   const names = /* @__PURE__ */ new Set();
   for (let i = 0; i < val.hooks.length; i++) {
     if (ids.has(val.hooks[i].id)) {
       ctx.addIssue({
-        code: z11.ZodIssueCode.custom,
+        code: z12.ZodIssueCode.custom,
         path: ["hooks", i, "id"],
         message: `Duplicate hook id: "${val.hooks[i].id}"`
       });
     }
     if (names.has(val.hooks[i].name)) {
       ctx.addIssue({
-        code: z11.ZodIssueCode.custom,
+        code: z12.ZodIssueCode.custom,
         path: ["hooks", i, "name"],
         message: `Duplicate hook name: "${val.hooks[i].name}"`
       });
@@ -1433,8 +1484,8 @@ function formatYamlError(err, linePos, content, filePath) {
     suggestion: void 0
   };
 }
-function zodPathToSuggestion(code, path5, message) {
-  const field = path5[path5.length - 1];
+function zodPathToSuggestion(code, path7, message) {
+  const field = path7[path7.length - 1];
   if (code === "invalid_type") {
     if (typeof field === "string") {
       return `check that '${field}' has the correct type`;
@@ -1458,10 +1509,10 @@ function zodPathToSuggestion(code, path5, message) {
   }
   return void 0;
 }
-function resolveNodeAtPath(doc, path5) {
+function resolveNodeAtPath(doc, path7) {
   let current = doc.contents;
   if (!current) return null;
-  for (const segment of path5) {
+  for (const segment of path7) {
     if (!current) return null;
     if (typeof segment === "number") {
       const items = current.items;
@@ -1524,7 +1575,7 @@ function formatZodErrors(zodError, doc, lineCounter, content, filePath) {
 
 // src/agent/variables.ts
 import { generateText, Output } from "ai";
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 
 // src/agent/observation.ts
 import { createHash } from "crypto";
@@ -1661,12 +1712,12 @@ function getPlatformFilter(name) {
 
 // src/tools/builder.ts
 import { tool } from "ai";
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 var PLAN_FIELDS = {
-  reasoning: z12.string().describe("Brief explanation of why this action was chosen"),
-  confidence: z12.number().describe("Confidence level from 0 to 1"),
-  stepComplete: z12.boolean().describe("Whether this action completes the step goal"),
-  stepFailed: z12.boolean().optional().describe("Set true when the step goal cannot be achieved")
+  reasoning: z13.string().describe("Brief explanation of why this action was chosen"),
+  confidence: z13.number().describe("Confidence level from 0 to 1"),
+  stepComplete: z13.boolean().describe("Whether this action completes the step goal"),
+  stepFailed: z13.boolean().optional().describe("Set true when the step goal cannot be achieved")
 };
 var ToolValidationError = class extends Error {
   toolName;
@@ -1684,7 +1735,7 @@ function buildTools(registry, options) {
     const actionShape = def.schema.shape;
     tools[def.name] = tool({
       description: def.description,
-      inputSchema: z12.object({ ...PLAN_FIELDS, ...actionShape })
+      inputSchema: z13.object({ ...PLAN_FIELDS, ...actionShape })
     });
   }
   return tools;
@@ -1706,7 +1757,7 @@ function toolCallToActionPlan(toolName, args, registry) {
 }
 
 // src/tools/actions/index.ts
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 function action(name, description, schema) {
   return {
     name,
@@ -1717,204 +1768,204 @@ function action(name, description, schema) {
   };
 }
 var ACTION_DEFINITIONS = [
-  action("click", "Click an element", z13.object({
-    ref: z13.string().describe("Element reference from the screen state"),
-    clickDelay: z13.number().optional().describe("Omit when there is no requested delay. Only provide a positive value when the user explicitly asks for a delay.")
+  action("click", "Click an element", z14.object({
+    ref: z14.string().describe("Element reference from the screen state"),
+    clickDelay: z14.number().optional().describe("Omit when there is no requested delay. Only provide a positive value when the user explicitly asks for a delay.")
   })),
-  action("fill", "Fill text into an input field", z13.object({
-    ref: z13.string().describe("Element reference for the input field"),
-    value: z13.string().describe("Text value to fill into the input")
+  action("fill", "Fill text into an input field", z14.object({
+    ref: z14.string().describe("Element reference for the input field"),
+    value: z14.string().describe("Text value to fill into the input")
   })),
-  action("select", "Select an option from a dropdown", z13.object({
-    ref: z13.string().describe("Element reference for the select/dropdown"),
-    value: z13.string().describe("Option value to select")
+  action("select", "Select an option from a dropdown", z14.object({
+    ref: z14.string().describe("Element reference for the select/dropdown"),
+    value: z14.string().describe("Option value to select")
   })),
-  action("nativeSelect", "Select a value from a native mobile picker, picker wheel, spinner, or dropdown/list control", z13.object({
-    ref: z13.string().describe("Element reference for the native picker/dropdown control"),
-    value: z13.string().describe("Visible text/value to select")
+  action("nativeSelect", "Select a value from a native mobile picker, picker wheel, spinner, or dropdown/list control", z14.object({
+    ref: z14.string().describe("Element reference for the native picker/dropdown control"),
+    value: z14.string().describe("Visible text/value to select")
   })),
-  action("navigate", "Navigate to a URL", z13.object({
-    url: z13.string().describe("URL to navigate to")
+  action("navigate", "Navigate to a URL", z14.object({
+    url: z14.string().describe("URL to navigate to")
   })),
-  action("scroll", "Scroll the page or a specific element", z13.object({
-    scrollType: z13.enum(["vertical", "horizontal"]).describe("Scroll axis: vertical (up/down) or horizontal (left/right)"),
-    value: z13.number().describe("Scroll distance in pixels. Positive = down/right, negative = up/left"),
-    ref: z13.string().optional().describe("Optional element to scroll within"),
-    duration: z13.number().optional().describe("Scroll duration in ms (mobile only \u2014 web ignores this)")
+  action("scroll", "Scroll the page or a specific element", z14.object({
+    scrollType: z14.enum(["vertical", "horizontal"]).describe("Scroll axis: vertical (up/down) or horizontal (left/right)"),
+    value: z14.number().describe("Scroll distance in pixels. Positive = down/right, negative = up/left"),
+    ref: z14.string().optional().describe("Optional element to scroll within"),
+    duration: z14.number().optional().describe("Scroll duration in ms (mobile only \u2014 web ignores this)")
   })),
-  action("delay", 'Pause execution for a fixed duration \u2014 use when a specific duration is requested (e.g. "wait 3 seconds"). Do NOT use for waiting on conditions (use waitFor for that).', z13.object({
-    ms: z13.number().describe("Duration in milliseconds")
+  action("delay", 'Pause execution for a fixed duration \u2014 use when a specific duration is requested (e.g. "wait 3 seconds"). Do NOT use for waiting on conditions (use waitFor for that).', z14.object({
+    ms: z14.number().describe("Duration in milliseconds")
   })),
-  action("waitFor", "Wait for a condition to be met (text content match or selector)", z13.object({
-    condition: z13.string().describe("Condition to wait for \u2014 either visible text content or a CSS selector"),
-    timeout: z13.number().optional().describe("Maximum wait time in ms (default: 5000)")
+  action("waitFor", "Wait for a condition to be met (text content match or selector)", z14.object({
+    condition: z14.string().describe("Condition to wait for \u2014 either visible text content or a CSS selector"),
+    timeout: z14.number().optional().describe("Maximum wait time in ms (default: 5000)")
   })),
-  action("assert", "Assert a condition on the current page state", z13.object({
-    condition: z13.string().describe("Assertion condition to check"),
-    expected: z13.string().optional().describe("Expected value for comparison"),
-    visual: z13.boolean().optional().default(true).describe("Whether this assertion requires screen evidence. Set false for non-visual checks (tautologies, hook/env results, runJS outputs, computed values). Default true for screen-visible assertions.")
+  action("assert", "Assert a condition on the current page state", z14.object({
+    condition: z14.string().describe("Assertion condition to check"),
+    expected: z14.string().optional().describe("Expected value for comparison"),
+    visual: z14.boolean().optional().default(true).describe("Whether this assertion requires screen evidence. Set false for non-visual checks (tautologies, hook/env results, runJS outputs, computed values). Default true for screen-visible assertions.")
   })),
-  action("keypress", "Press one or more keyboard keys/combos in sequence", z13.object({
-    keys: z13.array(z13.string()).min(1).describe('Array of keys/combos to press in sequence. Each entry may be a single key (e.g. "Enter", "Tab", "Escape") or a combo with "+" separators (e.g. "Meta+k", "Control+Shift+T"). Use "Meta" for the Cmd/Win/Super key \u2014 on non-Mac platforms it is automatically converted to "Control" when convertPlatformKeys is true. On mobile, only single special keys from the KEY_MAP work meaningfully; combos are a no-op.'),
-    convertPlatformKeys: z13.boolean().optional().default(true).describe('When true (default), replaces "Meta" with "Control" in each key string on non-Mac platforms so that "Meta+k" works as Cmd+K on Mac and Ctrl+K on Windows/Linux. Set to false to pass keys through unchanged. No-op on mobile.')
+  action("keypress", "Press one or more keyboard keys/combos in sequence", z14.object({
+    keys: z14.array(z14.string()).min(1).describe('Array of keys/combos to press in sequence. Each entry may be a single key (e.g. "Enter", "Tab", "Escape") or a combo with "+" separators (e.g. "Meta+k", "Control+Shift+T"). Use "Meta" for the Cmd/Win/Super key \u2014 on non-Mac platforms it is automatically converted to "Control" when convertPlatformKeys is true. On mobile, only single special keys from the KEY_MAP work meaningfully; combos are a no-op.'),
+    convertPlatformKeys: z14.boolean().optional().default(true).describe('When true (default), replaces "Meta" with "Control" in each key string on non-Mac platforms so that "Meta+k" works as Cmd+K on Mac and Ctrl+K on Windows/Linux. Set to false to pass keys through unchanged. No-op on mobile.')
   })),
-  action("hover", "Hover over an element", z13.object({
-    ref: z13.string().describe("Element reference to hover over")
+  action("hover", "Hover over an element", z14.object({
+    ref: z14.string().describe("Element reference to hover over")
   })),
-  action("paste", "Paste text into an element via clipboard paste event", z13.object({
-    ref: z13.string().describe("Element reference for the target element"),
-    value: z13.string().describe("Text value to paste")
+  action("paste", "Paste text into an element via clipboard paste event", z14.object({
+    ref: z14.string().describe("Element reference for the target element"),
+    value: z14.string().describe("Text value to paste")
   })),
-  action("keyDown", "Hold down a key (for modifier combos like Shift+Click)", z13.object({
-    key: z13.string().describe("Key to hold down (e.g., Shift, Control, Alt, Meta)")
+  action("keyDown", "Hold down a key (for modifier combos like Shift+Click)", z14.object({
+    key: z14.string().describe("Key to hold down (e.g., Shift, Control, Alt, Meta)")
   })),
-  action("keyUp", "Release a held key", z13.object({
-    key: z13.string().describe("Key to release (e.g., Shift, Control, Alt, Meta)")
+  action("keyUp", "Release a held key", z14.object({
+    key: z14.string().describe("Key to release (e.g., Shift, Control, Alt, Meta)")
   })),
-  action("refresh", "Refresh the current page", z13.object({})),
-  action("navigateHistory", "Navigate browser history (back or forward)", z13.object({
-    direction: z13.enum(["back", "forward"]).describe("Navigation direction in browser history")
+  action("refresh", "Refresh the current page", z14.object({})),
+  action("navigateHistory", "Navigate browser history (back or forward)", z14.object({
+    direction: z14.enum(["back", "forward"]).describe("Navigation direction in browser history")
   })),
-  action("readConsoleLogs", "Read console log entries from the browser", z13.object({
-    level: z13.enum(["log", "info", "warn", "error"]).optional().describe("Filter by log level. Omit to get all levels."),
-    tab: z13.object({
-      index: z13.number().optional().describe("0-based tab index"),
-      title: z13.string().optional().describe("Substring match on page title"),
-      url: z13.string().optional().describe("Substring match on page URL")
+  action("readConsoleLogs", "Read console log entries from the browser", z14.object({
+    level: z14.enum(["log", "info", "warn", "error"]).optional().describe("Filter by log level. Omit to get all levels."),
+    tab: z14.object({
+      index: z14.number().optional().describe("0-based tab index"),
+      title: z14.string().optional().describe("Substring match on page title"),
+      url: z14.string().optional().describe("Substring match on page URL")
     }).optional().describe("Target a specific tab. Omit to read logs from all tabs.")
   })),
-  action("readNetworkLogs", "Read network request/response log entries", z13.object({
-    urlPattern: z13.string().optional().describe("Filter by URL substring match. Omit to get all requests."),
-    tab: z13.object({
-      index: z13.number().optional().describe("0-based tab index"),
-      title: z13.string().optional().describe("Substring match on page title"),
-      url: z13.string().optional().describe("Substring match on page URL")
+  action("readNetworkLogs", "Read network request/response log entries", z14.object({
+    urlPattern: z14.string().optional().describe("Filter by URL substring match. Omit to get all requests."),
+    tab: z14.object({
+      index: z14.number().optional().describe("0-based tab index"),
+      title: z14.string().optional().describe("Substring match on page title"),
+      url: z14.string().optional().describe("Substring match on page URL")
     }).optional().describe("Target a specific tab. Omit to read logs from all tabs.")
   })),
-  action("readCookies", "Read browser cookies", z13.object({
-    name: z13.string().optional().describe("Cookie name to read. Omit to get all cookies.")
+  action("readCookies", "Read browser cookies", z14.object({
+    name: z14.string().optional().describe("Cookie name to read. Omit to get all cookies.")
   })),
-  action("setCookies", "Set browser cookies", z13.object({
-    cookies: z13.array(z13.object({
-      name: z13.string().describe("Cookie name"),
-      value: z13.string().describe("Cookie value"),
-      domain: z13.string().optional().describe("Cookie domain"),
-      path: z13.string().optional().describe("Cookie path"),
-      httpOnly: z13.boolean().optional().describe("HTTP only flag"),
-      secure: z13.boolean().optional().describe("Secure flag"),
-      sameSite: z13.enum(["Strict", "Lax", "None"]).optional().describe("SameSite attribute"),
-      expires: z13.number().optional().describe("Expiry as Unix timestamp in seconds")
+  action("setCookies", "Set browser cookies", z14.object({
+    cookies: z14.array(z14.object({
+      name: z14.string().describe("Cookie name"),
+      value: z14.string().describe("Cookie value"),
+      domain: z14.string().optional().describe("Cookie domain"),
+      path: z14.string().optional().describe("Cookie path"),
+      httpOnly: z14.boolean().optional().describe("HTTP only flag"),
+      secure: z14.boolean().optional().describe("Secure flag"),
+      sameSite: z14.enum(["Strict", "Lax", "None"]).optional().describe("SameSite attribute"),
+      expires: z14.number().optional().describe("Expiry as Unix timestamp in seconds")
     })).describe("Array of cookies to set")
   })),
-  action("readLocalStorage", "Read local storage entries", z13.object({
-    key: z13.string().optional().describe("Storage key to read. Omit to get all entries.")
+  action("readLocalStorage", "Read local storage entries", z14.object({
+    key: z14.string().optional().describe("Storage key to read. Omit to get all entries.")
   })),
-  action("setLocalStorage", "Set local storage entries", z13.object({
-    entries: z13.array(z13.object({
-      key: z13.string().describe("Storage key"),
-      value: z13.string().describe("Storage value")
+  action("setLocalStorage", "Set local storage entries", z14.object({
+    entries: z14.array(z14.object({
+      key: z14.string().describe("Storage key"),
+      value: z14.string().describe("Storage value")
     })).describe("Array of key-value pairs to set")
   })),
-  action("tap", "Tap an element on a mobile device", z13.object({
-    ref: z13.string().describe("Element reference to tap")
+  action("tap", "Tap an element on a mobile device", z14.object({
+    ref: z14.string().describe("Element reference to tap")
   })),
-  action("swipe", "Swipe gesture on a mobile device", z13.object({
-    direction: z13.enum(["up", "down", "left", "right"]).describe("Swipe direction"),
-    ref: z13.string().optional().describe("Optional element to swipe within"),
-    startX: z13.number().optional().describe("Start X coordinate (overrides direction-based calculation)"),
-    startY: z13.number().optional().describe("Start Y coordinate (overrides direction-based calculation)"),
-    endX: z13.number().optional().describe("End X coordinate (overrides direction-based calculation)"),
-    endY: z13.number().optional().describe("End Y coordinate (overrides direction-based calculation)"),
-    duration: z13.number().optional().describe("Swipe duration in ms (default: 300)")
+  action("swipe", "Swipe gesture on a mobile device", z14.object({
+    direction: z14.enum(["up", "down", "left", "right"]).describe("Swipe direction"),
+    ref: z14.string().optional().describe("Optional element to swipe within"),
+    startX: z14.number().optional().describe("Start X coordinate (overrides direction-based calculation)"),
+    startY: z14.number().optional().describe("Start Y coordinate (overrides direction-based calculation)"),
+    endX: z14.number().optional().describe("End X coordinate (overrides direction-based calculation)"),
+    endY: z14.number().optional().describe("End Y coordinate (overrides direction-based calculation)"),
+    duration: z14.number().optional().describe("Swipe duration in ms (default: 300)")
   })),
-  action("longpress", "Long-press an element on a mobile device", z13.object({
-    ref: z13.string().describe("Element reference to long-press"),
-    duration: z13.number().optional().describe("Long-press duration in ms")
+  action("longpress", "Long-press an element on a mobile device", z14.object({
+    ref: z14.string().describe("Element reference to long-press"),
+    duration: z14.number().optional().describe("Long-press duration in ms")
   })),
-  action("hideKeyboard", "Dismiss the on-screen keyboard (mobile only, no-op on web)", z13.object({})),
-  action("clearText", "Clear all text from an input field without typing new text", z13.object({
-    ref: z13.string().describe("Element reference for the input field to clear")
+  action("hideKeyboard", "Dismiss the on-screen keyboard (mobile only, no-op on web)", z14.object({})),
+  action("clearText", "Clear all text from an input field without typing new text", z14.object({
+    ref: z14.string().describe("Element reference for the input field to clear")
   })),
-  action("openLink", "Open a deep link in a mobile app \u2014 use navigate for web URLs", z13.object({
-    url: z13.string().describe("Deep link URL to open (e.g. myapp://screen, intent://...)"),
-    appId: z13.string().optional().describe("Generic mobile app identifier. Android uses package name; iOS uses bundle ID."),
-    bundleId: z13.string().optional().describe("iOS bundle ID to open the link in"),
-    appPackage: z13.string().optional().describe("Android package name to open the link in"),
-    waitForLaunch: z13.boolean().optional().describe("Whether to wait for the app to launch after opening the link")
+  action("openLink", "Open a deep link in a mobile app \u2014 use navigate for web URLs", z14.object({
+    url: z14.string().describe("Deep link URL to open (e.g. myapp://screen, intent://...)"),
+    appId: z14.string().optional().describe("Generic mobile app identifier. Android uses package name; iOS uses bundle ID."),
+    bundleId: z14.string().optional().describe("iOS bundle ID to open the link in"),
+    appPackage: z14.string().optional().describe("Android package name to open the link in"),
+    waitForLaunch: z14.boolean().optional().describe("Whether to wait for the app to launch after opening the link")
   })),
-  action("drag", "Drag an element to another element (reorder lists, sliders)", z13.object({
-    fromRef: z13.string().describe("Element reference to drag from"),
-    toRef: z13.string().describe("Element reference to drag to")
+  action("drag", "Drag an element to another element (reorder lists, sliders)", z14.object({
+    fromRef: z14.string().describe("Element reference to drag from"),
+    toRef: z14.string().describe("Element reference to drag to")
   })),
-  action("doubleTap", "Double-tap an element (text selection, zoom)", z13.object({
-    ref: z13.string().describe("Element reference to double-tap")
+  action("doubleTap", "Double-tap an element (text selection, zoom)", z14.object({
+    ref: z14.string().describe("Element reference to double-tap")
   })),
-  action("launchApp", "Launch or bring an app to the foreground", z13.object({
-    bundleId: z13.string().describe("App bundle ID (iOS) or package name (Android)")
+  action("launchApp", "Launch or bring an app to the foreground", z14.object({
+    bundleId: z14.string().describe("App bundle ID (iOS) or package name (Android)")
   })),
-  action("stopApp", "Terminate a running app", z13.object({
-    bundleId: z13.string().describe("App bundle ID (iOS) or package name (Android)")
+  action("stopApp", "Terminate a running app", z14.object({
+    bundleId: z14.string().describe("App bundle ID (iOS) or package name (Android)")
   })),
-  action("setOrientation", "Set the device orientation (mobile only)", z13.object({
-    orientation: z13.enum(["portrait", "landscape"]).describe("Device orientation")
+  action("setOrientation", "Set the device orientation (mobile only)", z14.object({
+    orientation: z14.enum(["portrait", "landscape"]).describe("Device orientation")
   })),
-  action("pinch", "Pinch zoom gesture on a mobile device (mobile only)", z13.object({
-    scale: z13.number().describe("Scale factor: >1 to zoom in (spread fingers), <1 to zoom out (pinch fingers)"),
-    x: z13.number().optional().describe("Center X coordinate for pinch gesture"),
-    y: z13.number().optional().describe("Center Y coordinate for pinch gesture"),
-    ref: z13.string().optional().describe("Optional element to center the pinch on")
+  action("pinch", "Pinch zoom gesture on a mobile device (mobile only)", z14.object({
+    scale: z14.number().describe("Scale factor: >1 to zoom in (spread fingers), <1 to zoom out (pinch fingers)"),
+    x: z14.number().optional().describe("Center X coordinate for pinch gesture"),
+    y: z14.number().optional().describe("Center Y coordinate for pinch gesture"),
+    ref: z14.string().optional().describe("Optional element to center the pinch on")
   })),
-  action("multiTap", "Multi-finger tap gesture on a mobile device (mobile only)", z13.object({
-    fingers: z13.number().describe("Number of fingers (2 or 3)"),
-    x: z13.number().optional().describe("Center X coordinate for multi-finger tap"),
-    y: z13.number().optional().describe("Center Y coordinate for multi-finger tap"),
-    ref: z13.string().optional().describe("Optional element to center the tap on")
+  action("multiTap", "Multi-finger tap gesture on a mobile device (mobile only)", z14.object({
+    fingers: z14.number().describe("Number of fingers (2 or 3)"),
+    x: z14.number().optional().describe("Center X coordinate for multi-finger tap"),
+    y: z14.number().optional().describe("Center Y coordinate for multi-finger tap"),
+    ref: z14.string().optional().describe("Optional element to center the tap on")
   })),
-  action("tapCoordinate", "Tap at specific pixel coordinates \u2014 use when target element has no ref in accessibility tree", z13.object({
-    x: z13.number().describe("X coordinate in pixels"),
-    y: z13.number().describe("Y coordinate in pixels")
+  action("tapCoordinate", "Tap at specific pixel coordinates \u2014 use when target element has no ref in accessibility tree", z14.object({
+    x: z14.number().describe("X coordinate in pixels"),
+    y: z14.number().describe("Y coordinate in pixels")
   })),
-  action("executeScript", "Execute an Appium script command (mobile only)", z13.object({
-    command: z13.string().describe('Appium command name (e.g., "mobile: enrollBiometric", "mobile: terminateApp")'),
-    args: z13.any().optional().describe("Command arguments \u2014 object with key-value pairs, or array for some commands")
+  action("executeScript", "Execute an Appium script command (mobile only)", z14.object({
+    command: z14.string().describe('Appium command name (e.g., "mobile: enrollBiometric", "mobile: terminateApp")'),
+    args: z14.any().optional().describe("Command arguments \u2014 object with key-value pairs, or array for some commands")
   })),
-  action("setVariable", "Set a runtime environment variable for use in subsequent steps", z13.object({
-    name: z13.string().describe("Variable name (will be accessible via {{env:varName}})"),
-    value: z13.string().describe("Variable value to store")
+  action("setVariable", "Set a runtime environment variable for use in subsequent steps", z14.object({
+    name: z14.string().describe("Variable name (will be accessible via {{env:varName}})"),
+    value: z14.string().describe("Variable value to store")
   })),
-  action("newTab", "Open a URL in a new browser tab and switch to it", z13.object({
-    url: z13.string().describe("URL to open in the new tab")
+  action("newTab", "Open a URL in a new browser tab and switch to it", z14.object({
+    url: z14.string().describe("URL to open in the new tab")
   })),
-  action("switchTab", "Switch to an open browser tab", z13.object({
-    index: z13.number().optional().describe("0-based tab index to switch to"),
-    title: z13.string().optional().describe("Substring match on page title"),
-    url: z13.string().optional().describe("Substring match on page URL")
+  action("switchTab", "Switch to an open browser tab", z14.object({
+    index: z14.number().optional().describe("0-based tab index to switch to"),
+    title: z14.string().optional().describe("Substring match on page title"),
+    url: z14.string().optional().describe("Substring match on page URL")
   })),
-  action("doubleClick", "Double-click an element (text selection, expand, web-only)", z13.object({
-    ref: z13.string().describe("Element reference from the screen state"),
-    relativePosition: z13.object({
-      x: z13.number().describe("X offset in pixels from element top-left"),
-      y: z13.number().describe("Y offset in pixels from element top-left")
+  action("doubleClick", "Double-click an element (text selection, expand, web-only)", z14.object({
+    ref: z14.string().describe("Element reference from the screen state"),
+    relativePosition: z14.object({
+      x: z14.number().describe("X offset in pixels from element top-left"),
+      y: z14.number().describe("Y offset in pixels from element top-left")
     }).optional().describe("Omit for normal element-center interaction. Only provide when the user explicitly asks for an offset. Do not use { x: 0, y: 0 } for a normal button double-click/right-click; top-left is often intercepted."),
-    clickDelay: z13.number().optional().describe("Omit when there is no requested delay. Only provide a positive value when the user explicitly asks for a delay.")
+    clickDelay: z14.number().optional().describe("Omit when there is no requested delay. Only provide a positive value when the user explicitly asks for a delay.")
   })),
-  action("rightClick", "Right-click an element to open context menu (web-only)", z13.object({
-    ref: z13.string().describe("Element reference from the screen state"),
-    relativePosition: z13.object({
-      x: z13.number().describe("X offset in pixels from element top-left"),
-      y: z13.number().describe("Y offset in pixels from element top-left")
+  action("rightClick", "Right-click an element to open context menu (web-only)", z14.object({
+    ref: z14.string().describe("Element reference from the screen state"),
+    relativePosition: z14.object({
+      x: z14.number().describe("X offset in pixels from element top-left"),
+      y: z14.number().describe("Y offset in pixels from element top-left")
     }).optional().describe("Omit for normal element-center interaction. Only provide when the user explicitly asks for an offset. Do not use { x: 0, y: 0 } for a normal button double-click/right-click; top-left is often intercepted."),
-    clickDelay: z13.number().optional().describe("Omit when there is no requested delay. Only provide a positive value when the user explicitly asks for a delay.")
+    clickDelay: z14.number().optional().describe("Omit when there is no requested delay. Only provide a positive value when the user explicitly asks for a delay.")
   })),
-  action("waitForUrl", "Wait for the page URL to match a glob pattern (web only)", z13.object({
-    pattern: z13.string().describe('URL glob pattern. Use "**" for substring matching (e.g., "**/dashboard**"). Plain strings WITHOUT wildcards require EXACT URL match, not substring.')
+  action("waitForUrl", "Wait for the page URL to match a glob pattern (web only)", z14.object({
+    pattern: z14.string().describe('URL glob pattern. Use "**" for substring matching (e.g., "**/dashboard**"). Plain strings WITHOUT wildcards require EXACT URL match, not substring.')
   })),
-  action("fileUpload", "Upload one or more files to a file input element (web only)", z13.object({
-    ref: z13.string().describe("Element reference for the file input"),
-    files: z13.array(z13.string()).min(1).describe("Paths to files \u2014 relative to the test YAML file, or absolute paths. Missing files fail the action.")
+  action("fileUpload", "Upload one or more files to a file input element (web only)", z14.object({
+    ref: z14.string().describe("Element reference for the file input"),
+    files: z14.array(z14.string()).min(1).describe("Paths to files \u2014 relative to the test YAML file, or absolute paths. Missing files fail the action.")
   })),
-  action("copy", "Copy the text content of an element to the system clipboard (web only, chromium only)", z13.object({
-    ref: z13.string().describe("Element reference whose text content to copy")
+  action("copy", "Copy the text content of an element to the system clipboard (web only, chromium only)", z14.object({
+    ref: z14.string().describe("Element reference whose text content to copy")
   }))
 ];
 function registerAllActions(registry) {
@@ -2328,9 +2379,9 @@ function buildExtractionPrompt(input, screenState) {
 }
 
 // src/agent/variables.ts
-var ExtractionResultSchema = z14.object({
-  value: z14.string(),
-  reasoning: z14.string()
+var ExtractionResultSchema = z15.object({
+  value: z15.string(),
+  reasoning: z15.string()
 });
 var VariableStore = class {
   storage = /* @__PURE__ */ new Map();
@@ -2830,11 +2881,11 @@ var LLMPlanner = class {
 
 // src/agent/verifier.ts
 import { generateText as generateText3, Output as Output2 } from "ai";
-import { z as z15 } from "zod";
-var VerificationResultSchema = z15.object({
-  success: z15.boolean().describe("Whether the step goal was accomplished"),
-  reasoning: z15.string().describe("Explanation of why the step succeeded or failed"),
-  isAppError: z15.boolean().describe(
+import { z as z16 } from "zod";
+var VerificationResultSchema = z16.object({
+  success: z16.boolean().describe("Whether the step goal was accomplished"),
+  reasoning: z16.string().describe("Explanation of why the step succeeded or failed"),
+  isAppError: z16.boolean().describe(
     "Whether the page shows an application error (HTTP error, error toast, crash) vs the agent simply not accomplishing the goal"
   )
 });
@@ -3026,11 +3077,11 @@ async function createOpenAICompatibleModel(config) {
 
 // src/agent/asserter.ts
 import { generateText as generateText4, Output as Output3 } from "ai";
-import { z as z16 } from "zod";
-var AssertionResultSchema = z16.object({
-  passed: z16.boolean(),
-  reasoning: z16.string(),
-  evidence: z16.string()
+import { z as z17 } from "zod";
+var AssertionResultSchema = z17.object({
+  passed: z17.boolean(),
+  reasoning: z17.string(),
+  evidence: z17.string()
 });
 var AssertionEvaluator = class {
   async evaluate(assertion, screenState) {
@@ -4659,6 +4710,192 @@ var RUNTIME_IMAGE_MAP = {
   bash: "vostride/agent-qa-hook-runner-bash"
 };
 
+// src/auth-state/hook-env.ts
+var AUTH_STATE_HOOK_JSON_ENV = "AGENT_QA_AUTH_STATE_JSON";
+var AUTH_STATE_HOOK_STORAGE_STATE_PATH_ENV = "AGENT_QA_AUTH_STATE_STORAGE_STATE_PATH";
+var AUTH_STATE_HOOK_WORKSPACE_DIR = ".agent-qa-auth-state";
+var AUTH_STATE_HOOK_STORAGE_STATE_FILENAME = "storage-state.json";
+var AUTH_STATE_HOOK_CONTAINER_STORAGE_STATE_PATH = `/workspace/${AUTH_STATE_HOOK_WORKSPACE_DIR}/${AUTH_STATE_HOOK_STORAGE_STATE_FILENAME}`;
+var RESERVED_AUTH_STATE_HOOK_ENV_KEYS = /* @__PURE__ */ new Set([
+  AUTH_STATE_HOOK_JSON_ENV,
+  AUTH_STATE_HOOK_STORAGE_STATE_PATH_ENV
+]);
+function isReservedAuthStateHookEnvKey(key) {
+  return RESERVED_AUTH_STATE_HOOK_ENV_KEYS.has(key);
+}
+function stripReservedAuthStateHookEnv(variables) {
+  return Object.fromEntries(
+    Object.entries(variables).filter(([key]) => !isReservedAuthStateHookEnvKey(key))
+  );
+}
+function buildAuthStateHookEnv(authState, storageStatePath = AUTH_STATE_HOOK_CONTAINER_STORAGE_STATE_PATH) {
+  if (!authState) return {};
+  const metadata = {
+    version: authState.version,
+    kind: authState.kind,
+    target: authState.targetName,
+    name: authState.stateName,
+    capturedAt: authState.capturedAt,
+    storageStatePath
+  };
+  return {
+    [AUTH_STATE_HOOK_JSON_ENV]: JSON.stringify(metadata),
+    [AUTH_STATE_HOOK_STORAGE_STATE_PATH_ENV]: storageStatePath
+  };
+}
+
+// src/auth-state/redaction.ts
+var AUTH_STATE_REDACTION_MARKER = "[auth state redacted]";
+var AUTH_STATE_JSON_KEY = normalizeKey(AUTH_STATE_HOOK_JSON_ENV);
+var AUTH_STATE_PATH_KEY = normalizeKey(AUTH_STATE_HOOK_STORAGE_STATE_PATH_ENV);
+var STRUCTURED_AUTH_STATE_KEYS = /* @__PURE__ */ new Set(["authstate", "auth_state"]);
+var STRUCTURED_PATH_KEYS = /* @__PURE__ */ new Set(["storagestatepath", AUTH_STATE_JSON_KEY, AUTH_STATE_PATH_KEY]);
+var AUTH_LIKE_KEY_RE = /(^|[_-])(token|cookie|authorization|csrf|session|bearer)([_-]|$)|^(token|cookie|authorization|csrf|session|bearer)$/i;
+function normalizeKey(key) {
+  return key.replace(/[\s-]/g, "").toLowerCase();
+}
+function isBufferLike2(value) {
+  return typeof Buffer !== "undefined" && Buffer.isBuffer(value);
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) && !isBufferLike2(value);
+}
+function isStorageStateShape(value) {
+  return isRecord(value) && Array.isArray(value.cookies) && Array.isArray(value.origins);
+}
+function isRuntimeAuthStateShape(value) {
+  if (!isRecord(value)) return false;
+  return typeof value.storageStatePath === "string" && typeof value.stateName === "string" && typeof value.targetName === "string";
+}
+function isAuthStateManagementMetadata(value) {
+  if (!isRecord(value)) return false;
+  if ("storageStatePath" in value || "payloadPath" in value || "metadataPath" in value) return false;
+  return value.kind === "web" && typeof value.target === "string" && typeof value.name === "string" && typeof value.capturedAt === "string";
+}
+function isAuthStateManagementConfig(value) {
+  if (!isRecord(value)) return false;
+  const keys = Object.keys(value);
+  return keys.length > 0 && keys.every((key) => key === "dir");
+}
+function isAuthLikeCredentialKey(key) {
+  return AUTH_LIKE_KEY_RE.test(key);
+}
+function knownSensitiveStrings(context) {
+  const values = /* @__PURE__ */ new Set();
+  const hookStorageStatePath = context.hookStorageStatePath ?? AUTH_STATE_HOOK_CONTAINER_STORAGE_STATE_PATH;
+  for (const value of [
+    AUTH_STATE_HOOK_CONTAINER_STORAGE_STATE_PATH,
+    hookStorageStatePath,
+    context.storageStatePath,
+    context.authState?.storageStatePath,
+    context.hookJsonEnv
+  ]) {
+    if (typeof value === "string" && value.length > 0) values.add(value);
+  }
+  if (context.authState) {
+    const env = buildAuthStateHookEnv(context.authState, hookStorageStatePath);
+    const hookJson = env[AUTH_STATE_HOOK_JSON_ENV];
+    if (hookJson) values.add(hookJson);
+  }
+  return [...values].sort((left, right) => right.length - left.length);
+}
+function tryParseJsonObject(value) {
+  try {
+    return JSON.parse(value);
+  } catch {
+    return void 0;
+  }
+}
+function looksLikeStorageStateJson(value) {
+  if (!value.includes('"cookies"') || !value.includes('"origins"')) return false;
+  return isStorageStateShape(tryParseJsonObject(value));
+}
+function looksLikeAuthStateHookJson(value) {
+  if (!value.includes('"storageStatePath"')) return false;
+  const parsed = tryParseJsonObject(value);
+  return isRecord(parsed) && typeof parsed.storageStatePath === "string" && (typeof parsed.name === "string" || typeof parsed.target === "string" || parsed.kind === "web");
+}
+function redactStructuredAuthStateText(value) {
+  return value.replace(
+    /(\bauthState\s*:\s*\n(?:[ \t]+[^\n]*\n)*?[ \t]+name\s*:\s*)[^\n#]+/gi,
+    (_match, prefix) => `${prefix}${AUTH_STATE_REDACTION_MARKER}`
+  ).replace(
+    /(["']?(?:authState|auth_state|storageStatePath|AGENT_QA_AUTH_STATE_JSON|AGENT_QA_AUTH_STATE_STORAGE_STATE_PATH)["']?\s*[:=]\s*)(["'])[^"']*\2/gi,
+    (_match, prefix, quote) => `${prefix}${quote}${AUTH_STATE_REDACTION_MARKER}${quote}`
+  ).replace(
+    /((?:authState|auth_state|storageStatePath|AGENT_QA_AUTH_STATE_JSON|AGENT_QA_AUTH_STATE_STORAGE_STATE_PATH)\s*[:=]\s*)[^\s,}\]]+/gi,
+    (_match, prefix) => `${prefix}${AUTH_STATE_REDACTION_MARKER}`
+  );
+}
+function redactStorageStateJsonLines(value) {
+  return value.split(/\r?\n/).map((line) => {
+    const trimmed = line.trim();
+    return looksLikeStorageStateJson(trimmed) || looksLikeAuthStateHookJson(trimmed) ? AUTH_STATE_REDACTION_MARKER : line;
+  }).join("\n");
+}
+function redactAuthStateString(value, context = {}) {
+  if (value.includes(AUTH_STATE_HOOK_JSON_ENV) || value.includes(AUTH_STATE_HOOK_STORAGE_STATE_PATH_ENV) || looksLikeStorageStateJson(value.trim()) || looksLikeAuthStateHookJson(value.trim())) {
+    return AUTH_STATE_REDACTION_MARKER;
+  }
+  if (value.includes("authState") || value.includes("auth_state")) {
+    const parsed = tryParseJsonObject(value.trim());
+    if (parsed !== void 0) {
+      return JSON.stringify(redactAuthStateOnly(parsed, context));
+    }
+  }
+  let redacted = redactStorageStateJsonLines(value);
+  for (const sensitive of knownSensitiveStrings(context)) {
+    redacted = redacted.split(sensitive).join(AUTH_STATE_REDACTION_MARKER);
+  }
+  return redactStructuredAuthStateText(redacted);
+}
+function shouldRedactKeyValue(key, value, context) {
+  const normalized = normalizeKey(key);
+  if (STRUCTURED_PATH_KEYS.has(normalized)) return true;
+  if (STRUCTURED_AUTH_STATE_KEYS.has(normalized)) {
+    if (typeof value === "string") return true;
+    if (isAuthStateManagementConfig(value) || isAuthStateManagementMetadata(value)) return false;
+    return true;
+  }
+  if (typeof value === "string" && value.startsWith("[secret")) return false;
+  return context.redactAuthLikeKeys !== false && isAuthLikeCredentialKey(key);
+}
+function redactAuthStateOnly(value, context) {
+  if (typeof value === "string") {
+    return redactAuthStateString(value, context);
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => redactAuthStateOnly(item, context));
+  }
+  if (isBufferLike2(value)) {
+    return value;
+  }
+  if (value instanceof Error) {
+    const redacted = new Error(redactAuthStateString(value.message, context));
+    redacted.name = value.name;
+    redacted.stack = value.stack ? redactAuthStateString(value.stack, context) : void 0;
+    return redacted;
+  }
+  if (!isRecord(value)) {
+    return value;
+  }
+  if (isStorageStateShape(value) || isRuntimeAuthStateShape(value)) {
+    return AUTH_STATE_REDACTION_MARKER;
+  }
+  const result = {};
+  for (const [key, item] of Object.entries(value)) {
+    if (shouldRedactKeyValue(key, item, context)) {
+      result[key] = AUTH_STATE_REDACTION_MARKER;
+    } else {
+      result[key] = redactAuthStateOnly(item, context);
+    }
+  }
+  return result;
+}
+function redactAuthStateValue(value, context = {}) {
+  return redactAuthStateOnly(redactSecretValue(value, context.secretRedactor), context);
+}
+
 // src/hooks/sandbox-runner.ts
 var DEFAULT_DOCKER_BIN = "docker";
 function getHookCommand(runtime, entryFile) {
@@ -4702,12 +4939,18 @@ async function runHookInSandbox(hook, options = {}) {
     if (hook.packageFile) {
       await cp(hook.packageFile, join(workDir, basename(hook.packageFile)));
     }
+    if (options.authState) {
+      const authStateDir = join(workDir, AUTH_STATE_HOOK_WORKSPACE_DIR);
+      await mkdir(authStateDir, { recursive: true });
+      await cp(options.authState.storageStatePath, join(authStateDir, AUTH_STATE_HOOK_STORAGE_STATE_FILENAME));
+    }
     const args = buildDockerArgs({
       image,
       workDir,
       hook,
       envVars: options.envVars,
-      secretStore: options.secretStore
+      secretStore: options.secretStore,
+      authState: options.authState
     });
     const cmd = getHookCommand(hook.runtime, basename(hook.file));
     args.push(...cmd);
@@ -4718,9 +4961,15 @@ async function runHookInSandbox(hook, options = {}) {
       variables = parseEnvFile(envContent);
     } catch {
     }
-    variables = filterSecretVariables(variables, options.secretStore);
-    const redactedStdout = redactSecretValue(stdout, options.secretRedactor);
-    const redactedStderr = redactSecretValue(stderr, options.secretRedactor);
+    variables = stripReservedAuthStateHookEnv(filterSecretVariables(variables, options.secretStore));
+    const redactedStdout = redactAuthStateValue(stdout, {
+      secretRedactor: options.secretRedactor,
+      authState: options.authState
+    });
+    const redactedStderr = redactAuthStateValue(stderr, {
+      secretRedactor: options.secretRedactor,
+      authState: options.authState
+    });
     const output = redactedStdout.trim();
     return {
       success: exitCode === 0,
@@ -4729,7 +4978,10 @@ async function runHookInSandbox(hook, options = {}) {
       stdout: redactedStdout,
       stderr: redactedStderr,
       duration: Date.now() - start,
-      error: exitCode !== 0 ? redactSecretValue(`Hook exited with code ${exitCode}: ${stderr}`, options.secretRedactor) : void 0
+      error: exitCode !== 0 ? redactAuthStateValue(`Hook exited with code ${exitCode}: ${stderr}`, {
+        secretRedactor: options.secretRedactor,
+        authState: options.authState
+      }) : void 0
     };
   } catch (err) {
     return {
@@ -4739,7 +4991,10 @@ async function runHookInSandbox(hook, options = {}) {
       stdout: "",
       stderr: "",
       duration: Date.now() - start,
-      error: redactSecretValue(err.message, options.secretRedactor)
+      error: redactAuthStateValue(err.message, {
+        secretRedactor: options.secretRedactor,
+        authState: options.authState
+      })
     };
   } finally {
     if (workDir) {
@@ -4774,6 +5029,10 @@ function buildDockerArgs(input) {
   input.secretStore?.forEachSecret((name, value) => {
     envVars[name] = value;
   });
+  Object.assign(envVars, buildAuthStateHookEnv(
+    input.authState,
+    AUTH_STATE_HOOK_CONTAINER_STORAGE_STATE_PATH
+  ));
   for (const [k, v] of Object.entries(envVars)) {
     args.push("-e", `${k}=${v}`);
   }
@@ -5439,7 +5698,9 @@ ${errorLines.join("\n")}`;
     videoPath,
     failureSummary: failureSummary || void 0
   };
-  await reporter?.onTestEnd(testResult);
+  if (config.skipReporterOnTestEnd !== true) {
+    await reporter?.onTestEnd(testResult);
+  }
   return testResult;
 }
 function createTimeoutStepResult(name, scopeLabel, timeoutMs) {
@@ -6925,8 +7186,223 @@ function formatAppiumInstallGuidance() {
   return "Install Appium locally with `npm install -D appium` (or `pnpm add -D appium` / `yarn add -D appium`). If you prefer a machine-wide setup, use `npm install -g appium`.";
 }
 
+// src/auth-state/resolver.ts
+import path2 from "path";
+
+// src/runtime-paths.ts
+var DEFAULT_AGENT_QA_RUNTIME_DIR = ".agent-qa";
+var DEFAULT_AGENT_QA_ARTIFACTS_DIR = ".agent-qa/artifacts";
+var DEFAULT_AGENT_QA_CACHE_DIR = ".agent-qa/cache";
+var DEFAULT_AGENT_QA_AUTH_STATES_DIR = ".agent-qa/auth-states";
+var DEFAULT_AGENT_QA_SCREENSHOTS_DIR = ".agent-qa/artifacts/screenshots";
+var DEFAULT_AGENT_QA_VIDEOS_DIR = ".agent-qa/artifacts/videos";
+var DEFAULT_AGENT_QA_RUNS_DB_PATH = ".agent-qa/runs.db";
+var LEGACY_AGENT_QA_DASHBOARD_DB_PATH = ".agent-qa/dashboard.db";
+
+// src/auth-state/resolver.ts
+var MOBILE_AUTH_STATE_ERROR = [
+  "auth state is only supported for web targets.",
+  "For native mobile, use use.mobile.appState: preserve when keeping app data between sessions.",
+  "App-state preservation is broader than auth and does not export generic secure-storage/keychain tokens."
+].join(" ");
+function assertInsideRoot(rootDir, filePath) {
+  const relativePath = path2.relative(rootDir, filePath);
+  if (!relativePath || relativePath.startsWith("..") || path2.isAbsolute(relativePath)) {
+    throw new Error(`Resolved auth-state path escapes auth-state directory: ${filePath}`);
+  }
+}
+function resolveAuthStateRoot(input) {
+  const { configDir, authStateDir } = input;
+  const configuredDir = authStateDir ?? DEFAULT_AGENT_QA_AUTH_STATES_DIR;
+  if (configuredDir.trim().length === 0) {
+    throw new Error("authState.dir must be a non-empty path");
+  }
+  return path2.isAbsolute(configuredDir) ? path2.resolve(configuredDir) : path2.resolve(configDir, configuredDir);
+}
+function resolveAuthStatePaths(input) {
+  const targetName = TargetNameSchema.parse(input.targetName);
+  const stateName = AuthStateNameSchema.parse(input.stateName);
+  const platform = input.target?.platform ?? input.platform;
+  if (platform !== "web") {
+    throw new Error(MOBILE_AUTH_STATE_ERROR);
+  }
+  const rootDir = resolveAuthStateRoot({
+    configDir: input.configDir,
+    authStateDir: input.authStateDir
+  });
+  const targetDir = path2.join(rootDir, targetName);
+  const payloadPath = path2.join(targetDir, `${stateName}.json`);
+  const metadataPath = path2.join(targetDir, `${stateName}.meta.json`);
+  assertInsideRoot(rootDir, payloadPath);
+  assertInsideRoot(rootDir, metadataPath);
+  return {
+    targetName,
+    stateName,
+    rootDir,
+    targetDir,
+    payloadPath,
+    metadataPath
+  };
+}
+
+// src/auth-state/store.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import { mkdir as mkdir4, readdir as readdir2, readFile as readFile6, rename, rm as rm2, writeFile as writeFile4 } from "fs/promises";
+import path3 from "path";
+function assertMetadataMatches(paths, metadata) {
+  if (metadata.target !== paths.targetName) {
+    throw new Error(`Auth-state metadata target "${metadata.target}" does not match resolved target "${paths.targetName}"`);
+  }
+  if (metadata.name !== paths.stateName) {
+    throw new Error(`Auth-state metadata name "${metadata.name}" does not match resolved state "${paths.stateName}"`);
+  }
+}
+async function writeJsonAtomic(filePath, value) {
+  const serialized = `${JSON.stringify(value, null, 2)}
+`;
+  const directory = path3.dirname(filePath);
+  const tempPath = path3.join(directory, `.${path3.basename(filePath)}.${process.pid}.${randomUUID2()}.tmp`);
+  await mkdir4(directory, { recursive: true });
+  try {
+    await writeFile4(tempPath, serialized, { mode: 384 });
+    await rename(tempPath, filePath);
+  } catch (error) {
+    await rm2(tempPath, { force: true }).catch(() => void 0);
+    throw error;
+  }
+}
+async function readAuthStateMetadata(paths) {
+  let raw;
+  try {
+    raw = await readFile6(paths.metadataPath, "utf-8");
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      throw new Error(`Auth-state metadata not found: ${paths.metadataPath}`);
+    }
+    throw error;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error(`Invalid auth-state metadata JSON: ${paths.metadataPath}`);
+  }
+  const result = AuthStateMetadataSchema.safeParse(parsed);
+  if (!result.success) {
+    throw new Error(`Invalid auth-state metadata: ${result.error.issues.map((issue) => issue.message).join("; ")}`);
+  }
+  assertMetadataMatches(paths, result.data);
+  return result.data;
+}
+async function writeAuthStateFiles(paths, input) {
+  const metadata = AuthStateMetadataSchema.parse(input.metadata);
+  assertMetadataMatches(paths, metadata);
+  await writeJsonAtomic(paths.payloadPath, input.payload);
+  await writeJsonAtomic(paths.metadataPath, metadata);
+}
+async function listAuthStateMetadata(input) {
+  const rootDir = resolveAuthStateRoot({
+    configDir: input.configDir,
+    authStateDir: input.authStateDir
+  });
+  const targetFilter = input.targetName ? TargetNameSchema.parse(input.targetName) : void 0;
+  let targetEntries;
+  try {
+    targetEntries = await readdir2(rootDir, { withFileTypes: true });
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return [];
+    }
+    throw error;
+  }
+  const metadata = [];
+  for (const targetEntry of targetEntries) {
+    if (!targetEntry.isDirectory()) continue;
+    const targetNameResult = TargetNameSchema.safeParse(targetEntry.name);
+    if (!targetNameResult.success) continue;
+    const targetName = targetNameResult.data;
+    if (targetFilter && targetName !== targetFilter) continue;
+    let stateEntries;
+    const targetDir = path3.join(rootDir, targetName);
+    try {
+      stateEntries = await readdir2(targetDir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const stateEntry of stateEntries) {
+      if (!stateEntry.isFile() || !stateEntry.name.endsWith(".meta.json")) continue;
+      const stateName = stateEntry.name.slice(0, -".meta.json".length);
+      const paths = (() => {
+        try {
+          return resolveAuthStatePaths({
+            configDir: input.configDir,
+            authStateDir: input.authStateDir,
+            targetName,
+            stateName,
+            platform: "web"
+          });
+        } catch {
+          return null;
+        }
+      })();
+      if (!paths) continue;
+      try {
+        const entry = await readAuthStateMetadata(paths);
+        metadata.push(entry);
+      } catch {
+        continue;
+      }
+    }
+  }
+  return metadata.sort((a, b) => {
+    const targetOrder = a.target.localeCompare(b.target);
+    return targetOrder === 0 ? a.name.localeCompare(b.name) : targetOrder;
+  });
+}
+async function removeAuthStateFiles(input) {
+  const paths = resolveAuthStatePaths(input);
+  await rm2(paths.payloadPath, { force: true });
+  await rm2(paths.metadataPath, { force: true });
+}
+async function removeAuthStateTarget(input) {
+  const paths = resolveAuthStatePaths({
+    ...input,
+    stateName: "placeholder"
+  });
+  await rm2(paths.targetDir, { recursive: true, force: true });
+}
+
+// src/auth-state/runtime.ts
+import { readFile as readFile7 } from "fs/promises";
+function createAuthStateReadError(targetName, stateName) {
+  return new Error(
+    `Auth state "${stateName}" for target "${targetName}" was not found or could not be read. Run agent-qa auth-state capture --target ${targetName} --name ${stateName}.`
+  );
+}
+async function assertPayloadReadable(paths) {
+  const raw = await readFile7(paths.payloadPath, "utf-8");
+  JSON.parse(raw);
+}
+async function resolveAuthStateForRun(input) {
+  const paths = resolveAuthStatePaths(input);
+  try {
+    const metadata = await readAuthStateMetadata(paths);
+    await assertPayloadReadable(paths);
+    return {
+      version: metadata.version,
+      kind: metadata.kind,
+      targetName: metadata.target,
+      stateName: metadata.name,
+      capturedAt: metadata.capturedAt,
+      storageStatePath: paths.payloadPath
+    };
+  } catch {
+    throw createAuthStateReadError(paths.targetName, paths.stateName);
+  }
+}
+
 // src/auth/store.ts
-import { readFile as readFile6, writeFile as writeFile4, mkdir as mkdir4, unlink as unlink2 } from "fs/promises";
+import { readFile as readFile8, writeFile as writeFile5, mkdir as mkdir5, unlink as unlink2 } from "fs/promises";
 import { dirname as dirname7, join as join4 } from "path";
 import { homedir } from "os";
 function getAuthPath() {
@@ -6934,24 +7410,24 @@ function getAuthPath() {
   if (xdg) return join4(xdg, "agent-qa", "auth.json");
   return join4(homedir(), ".agent-qa", "auth.json");
 }
-async function readAuth(path5) {
-  const authPath = path5 ?? getAuthPath();
+async function readAuth(path7) {
+  const authPath = path7 ?? getAuthPath();
   try {
-    const data = await readFile6(authPath, "utf-8");
+    const data = await readFile8(authPath, "utf-8");
     return JSON.parse(data);
   } catch {
     return {};
   }
 }
-async function writeAuth(provider, credential, path5) {
-  const authPath = path5 ?? getAuthPath();
+async function writeAuth(provider, credential, path7) {
+  const authPath = path7 ?? getAuthPath();
   const store = await readAuth(authPath);
   store[provider] = credential;
-  await mkdir4(dirname7(authPath), { recursive: true });
-  await writeFile4(authPath, JSON.stringify(store, null, 2), { mode: 384 });
+  await mkdir5(dirname7(authPath), { recursive: true });
+  await writeFile5(authPath, JSON.stringify(store, null, 2), { mode: 384 });
 }
-async function removeAuth(provider, path5) {
-  const authPath = path5 ?? getAuthPath();
+async function removeAuth(provider, path7) {
+  const authPath = path7 ?? getAuthPath();
   const store = await readAuth(authPath);
   delete store[provider];
   if (Object.keys(store).length === 0) {
@@ -6961,10 +7437,10 @@ async function removeAuth(provider, path5) {
     }
     return;
   }
-  await writeFile4(authPath, JSON.stringify(store, null, 2), { mode: 384 });
+  await writeFile5(authPath, JSON.stringify(store, null, 2), { mode: 384 });
 }
-async function getCredential(provider, path5) {
-  const store = await readAuth(path5);
+async function getCredential(provider, path7) {
+  const store = await readAuth(path7);
   return store[provider] ?? null;
 }
 
@@ -7322,7 +7798,7 @@ function createAuthFetch(options) {
 }
 
 // src/logging/types.ts
-import { z as z17 } from "zod";
+import { z as z18 } from "zod";
 var LOG_LEVEL_PRIORITY = {
   silent: 0,
   error: 1,
@@ -7330,53 +7806,53 @@ var LOG_LEVEL_PRIORITY = {
   info: 3,
   debug: 4
 };
-var AgentLogDataSchema = z17.object({
-  extractDom: z17.boolean().optional(),
-  hasScreenshot: z17.boolean().optional(),
-  duration: z17.number().optional(),
-  elementCount: z17.number().optional()
+var AgentLogDataSchema = z18.object({
+  extractDom: z18.boolean().optional(),
+  hasScreenshot: z18.boolean().optional(),
+  duration: z18.number().optional(),
+  elementCount: z18.number().optional()
 });
-var AdapterLogDataSchema = z17.object({
-  actionType: z17.string().optional(),
-  selector: z17.string().optional(),
-  coordinates: z17.object({ x: z17.number(), y: z17.number() }).optional(),
-  elementProperties: z17.record(z17.string(), z17.unknown()).optional(),
-  duration: z17.number().optional()
+var AdapterLogDataSchema = z18.object({
+  actionType: z18.string().optional(),
+  selector: z18.string().optional(),
+  coordinates: z18.object({ x: z18.number(), y: z18.number() }).optional(),
+  elementProperties: z18.record(z18.string(), z18.unknown()).optional(),
+  duration: z18.number().optional()
 });
-var CacheLogDataSchema = z17.object({
-  operation: z17.enum(["get", "set", "invalidate", "bypass", "batch-purge"]),
-  stepHash: z17.string().optional(),
-  screenHash: z17.string().optional(),
-  hit: z17.boolean().optional(),
-  age: z17.number().optional(),
-  entriesDeleted: z17.number().optional()
+var CacheLogDataSchema = z18.object({
+  operation: z18.enum(["get", "set", "invalidate", "bypass", "batch-purge"]),
+  stepHash: z18.string().optional(),
+  screenHash: z18.string().optional(),
+  hit: z18.boolean().optional(),
+  age: z18.number().optional(),
+  entriesDeleted: z18.number().optional()
 });
-var PlannerLogDataSchema = z17.object({
-  model: z17.string().optional(),
-  promptTokens: z17.number().optional(),
-  completionTokens: z17.number().optional(),
-  latencyMs: z17.number().optional(),
-  confidence: z17.number().optional(),
-  actionType: z17.string().optional()
+var PlannerLogDataSchema = z18.object({
+  model: z18.string().optional(),
+  promptTokens: z18.number().optional(),
+  completionTokens: z18.number().optional(),
+  latencyMs: z18.number().optional(),
+  confidence: z18.number().optional(),
+  actionType: z18.string().optional()
 });
-var HealerLogDataSchema = z17.object({
-  strategy: z17.string().optional(),
-  attempt: z17.number().optional(),
-  maxAttempts: z17.number().optional(),
-  stateDiffDetected: z17.boolean().optional(),
-  success: z17.boolean().optional()
+var HealerLogDataSchema = z18.object({
+  strategy: z18.string().optional(),
+  attempt: z18.number().optional(),
+  maxAttempts: z18.number().optional(),
+  stateDiffDetected: z18.boolean().optional(),
+  success: z18.boolean().optional()
 });
-var HookLogDataSchema = z17.object({
-  hookName: z17.string().optional(),
-  phase: z17.enum(["setup", "teardown"]).optional(),
-  duration: z17.number().optional(),
-  success: z17.boolean().optional()
+var HookLogDataSchema = z18.object({
+  hookName: z18.string().optional(),
+  phase: z18.enum(["setup", "teardown"]).optional(),
+  duration: z18.number().optional(),
+  success: z18.boolean().optional()
 });
-var RunnerLogDataSchema = z17.object({
-  stepIndex: z17.number().optional(),
-  totalSteps: z17.number().optional(),
-  testName: z17.string().optional(),
-  variablesCaptured: z17.number().optional()
+var RunnerLogDataSchema = z18.object({
+  stepIndex: z18.number().optional(),
+  totalSteps: z18.number().optional(),
+  testName: z18.string().optional(),
+  variablesCaptured: z18.number().optional()
 });
 var LogSourceDataSchemas = {
   agent: AgentLogDataSchema,
@@ -7389,7 +7865,7 @@ var LogSourceDataSchemas = {
 };
 
 // src/logging/log-manager.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 
 // src/logging/cli-formatter.ts
 import pc3 from "picocolors";
@@ -7431,13 +7907,13 @@ var LogManager = class {
   }
   log(level, source, message, data) {
     const entry = {
-      id: randomUUID2(),
+      id: randomUUID3(),
       stepId: this.currentStepId,
       runId: this.runId,
       level,
       source,
-      message: redactSecretValue(message, this.redactor),
-      data: redactSecretValue(data ?? {}, this.redactor),
+      message: redactAuthStateValue(message, { secretRedactor: this.redactor }),
+      data: redactAuthStateValue(data ?? {}, { secretRedactor: this.redactor }),
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     };
     this.buffer.push(entry);
@@ -7752,8 +8228,8 @@ function registerAllProviders() {
 }
 
 // src/suite/runner.ts
-import { randomUUID as randomUUID3 } from "crypto";
-import { readFile as readFile8 } from "fs/promises";
+import { randomUUID as randomUUID4 } from "crypto";
+import { readFile as readFile10 } from "fs/promises";
 
 // src/hooks/orchestrator.ts
 async function runHooks(hooks, options = {}) {
@@ -7765,7 +8241,7 @@ async function runHooks(hooks, options = {}) {
     const result = await runHookInSandbox(hook, { ...options, envVars });
     results.set(hook.name, result);
     if (result.success) {
-      Object.assign(mergedVars, result.variables);
+      Object.assign(mergedVars, stripReservedAuthStateHookEnv(result.variables));
     } else {
       for (const remaining of hooks.slice(hooks.indexOf(hook) + 1)) {
         results.set(remaining.name, {
@@ -7792,40 +8268,40 @@ async function runHooks(hooks, options = {}) {
 // src/memory/curator.ts
 init_observation_io();
 import { generateText as generateText5, Output as Output4 } from "ai";
-import { z as z19 } from "zod";
+import { z as z20 } from "zod";
 import { join as join6 } from "path";
-import { access as access2, readFile as readFile7, readdir as readdir3 } from "fs/promises";
+import { access as access2, readFile as readFile9, readdir as readdir4 } from "fs/promises";
 
 // src/memory/observation-id.ts
 import { generateObservationId } from "@vostride/agent-qa-ids";
 
 // src/memory/curator.ts
 init_security_scanner();
-var CuratorActionSchema = z19.discriminatedUnion("action", [
-  z19.object({
-    action: z19.literal("add"),
-    title: z19.string().min(1),
-    content: z19.string().min(1),
-    scope: z19.enum(["product", "suite", "test"]).describe('Use "suite" only if a suite context was provided'),
-    reasoning: z19.string()
+var CuratorActionSchema = z20.discriminatedUnion("action", [
+  z20.object({
+    action: z20.literal("add"),
+    title: z20.string().min(1),
+    content: z20.string().min(1),
+    scope: z20.enum(["product", "suite", "test"]).describe('Use "suite" only if a suite context was provided'),
+    reasoning: z20.string()
   }),
-  z19.object({
-    action: z19.literal("update"),
-    observationId: z19.string(),
-    reasoning: z19.string()
+  z20.object({
+    action: z20.literal("update"),
+    observationId: z20.string(),
+    reasoning: z20.string()
   }),
-  z19.object({
-    action: z19.literal("deprecate"),
-    observationId: z19.string(),
-    reasoning: z19.string()
+  z20.object({
+    action: z20.literal("deprecate"),
+    observationId: z20.string(),
+    reasoning: z20.string()
   }),
-  z19.object({
-    action: z19.literal("noop"),
-    reasoning: z19.string()
+  z20.object({
+    action: z20.literal("noop"),
+    reasoning: z20.string()
   })
 ]);
-var CuratorResponseSchema = z19.object({
-  decisions: z19.array(CuratorActionSchema)
+var CuratorResponseSchema = z20.object({
+  decisions: z20.array(CuratorActionSchema)
 });
 function emptyLog() {
   return { added: 0, confirmed: 0, deprecated: 0, deleted: 0, deltas: [], errors: [], curatorDuration: 0 };
@@ -7944,7 +8420,7 @@ async function findObservationFile(memoryRoot, id) {
     const tierDir = join6(memoryRoot, tier);
     let scopes;
     try {
-      scopes = await readdir3(tierDir);
+      scopes = await readdir4(tierDir);
     } catch {
       continue;
     }
@@ -7962,7 +8438,7 @@ async function findObservationFile(memoryRoot, id) {
 }
 async function readAndParseObservation(filePath, id) {
   try {
-    const raw = await readFile7(filePath, "utf-8");
+    const raw = await readFile9(filePath, "utf-8");
     const { data, error } = parseObservation(raw, `${id}.md`);
     if (!data || error) return null;
     return { data, raw };
@@ -8183,7 +8659,7 @@ ${userMessage}`;
           for (const file of files) {
             try {
               const filePath = join6(suiteDir, file);
-              const raw = await readFile7(filePath, "utf-8");
+              const raw = await readFile9(filePath, "utf-8");
               const { data } = parseObservation(raw, file);
               if (!data || !("suite_snapshot" in data)) continue;
               const suiteObs = data;
@@ -8385,6 +8861,7 @@ async function runSuite(suite, testEntries, config) {
   const results = [];
   const reporter = config.reporters?.length ? new MultiReporter(config.reporters) : void 0;
   const suiteRunId = config.runId ?? process.env.AGENT_QA_SUITE_QUEUE_ID ?? generateRunId();
+  let suiteSandboxOptions = config.sandboxOptions && config.platformConfig.authState ? { ...config.sandboxOptions, authState: config.platformConfig.authState } : config.sandboxOptions;
   const suiteArtifact = config.artifactContext?.artifact ?? config.artifactContext;
   await reporter?.onSuiteStart(suite, {
     runId: suiteRunId,
@@ -8420,7 +8897,7 @@ async function runSuite(suite, testEntries, config) {
     return { runId: suiteRunId, name: suite.name, status: "failed", tests: earlyResults, duration: duration2, failedAt: 0 };
   };
   let suiteHookVars = {};
-  if (suite.setup?.length && config.resolvedHooks && config.sandboxOptions) {
+  if (suite.setup?.length && config.resolvedHooks && suiteSandboxOptions) {
     const hookDefs = [];
     let hookMissing = false;
     for (const hookId of suite.setup) {
@@ -8439,14 +8916,14 @@ async function runSuite(suite, testEntries, config) {
     if (config.inlineVars) Object.assign(envVars, config.inlineVars);
     if (config.cliVars) Object.assign(envVars, config.cliVars);
     const result = await runHooks(hookDefs, {
-      ...config.sandboxOptions,
+      ...suiteSandboxOptions,
       secretStore: config.secretStore,
       secretRedactor: config.secretRedactor,
-      envVars: { ...config.sandboxOptions.envVars, ...envVars }
+      envVars: { ...suiteSandboxOptions.envVars, ...envVars }
     });
     for (const [name, hr] of result.results) {
       const hookDef = hookDefs.find((hook) => hook.name === name);
-      const hookExecId = randomUUID3();
+      const hookExecId = randomUUID4();
       await reporter?.onHookStart?.({ hookId: hookDef?.id, hookName: name, phase: "setup", hookExecutionId: hookExecId, runId: suiteRunId });
       await reporter?.onHookEnd?.({
         hookId: hookDef?.id,
@@ -8542,7 +9019,7 @@ async function runSuite(suite, testEntries, config) {
         });
         let perTestHookVars = {};
         let perTestSetupFailed = false;
-        if (patched.setup?.length && config.resolvedHooks && config.sandboxOptions) {
+        if (patched.setup?.length && config.resolvedHooks && suiteSandboxOptions) {
           const hookDefs = [];
           let hookMissing = false;
           for (const hookId of patched.setup) {
@@ -8560,13 +9037,13 @@ async function runSuite(suite, testEntries, config) {
             if (config.cliVars) Object.assign(allVars, config.cliVars);
             Object.assign(allVars, suiteHookVars);
             for (const hookDef of hookDefs) {
-              const hookExecId = randomUUID3();
+              const hookExecId = randomUUID4();
               await reporter?.onHookStart?.({ hookId: hookDef.id, hookName: hookDef.name, phase: "setup", hookExecutionId: hookExecId, runId: childRunId });
               const hookResult = await runHooks([hookDef], {
-                ...config.sandboxOptions,
+                ...suiteSandboxOptions,
                 secretStore: config.secretStore,
                 secretRedactor: config.secretRedactor,
-                envVars: { ...config.sandboxOptions.envVars, ...allVars, ...perTestHookVars }
+                envVars: { ...suiteSandboxOptions.envVars, ...allVars, ...perTestHookVars }
               });
               const hr = hookResult.results.get(hookDef.name);
               await reporter?.onHookEnd?.({
@@ -8608,7 +9085,7 @@ async function runSuite(suite, testEntries, config) {
         }
         let testFileContent = "";
         try {
-          testFileContent = await readFile8(filePath, "utf-8");
+          testFileContent = await readFile10(filePath, "utf-8");
         } catch {
         }
         const memoryInitParams = memoryEnabled ? {
@@ -8643,7 +9120,7 @@ async function runSuite(suite, testEntries, config) {
           cliVars: config.cliVars,
           hookSetupVars: perTestHookVars,
           inlineHookDefs: config.resolvedHooks,
-          inlineHookSandboxOptions: config.sandboxOptions,
+          inlineHookSandboxOptions: suiteSandboxOptions,
           secretStore: config.secretStore,
           secretRedactor: config.secretRedactor,
           accessibility: config.accessibility,
@@ -8659,11 +9136,11 @@ async function runSuite(suite, testEntries, config) {
           parentRunId: suiteRunId
         }, filePath);
         if (!result.runId) result.runId = childRunId;
-        if (patched.teardown?.length && config.resolvedHooks && config.sandboxOptions) {
+        if (patched.teardown?.length && config.resolvedHooks && suiteSandboxOptions) {
           for (const hookId of patched.teardown) {
             const hook = config.resolvedHooks.get(hookId);
             if (!hook) continue;
-            const hookExecId = randomUUID3();
+            const hookExecId = randomUUID4();
             try {
               await reporter?.onHookStart?.({ hookId: hook.id, hookName: hook.name, phase: "teardown", hookExecutionId: hookExecId, runId: childRunId });
               const teardownVars = {};
@@ -8671,10 +9148,10 @@ async function runSuite(suite, testEntries, config) {
               if (config.cliVars) Object.assign(teardownVars, config.cliVars);
               Object.assign(teardownVars, suiteHookVars, perTestHookVars);
               const hookResult = await runHooks([hook], {
-                ...config.sandboxOptions,
+                ...suiteSandboxOptions,
                 secretStore: config.secretStore,
                 secretRedactor: config.secretRedactor,
-                envVars: { ...config.sandboxOptions.envVars, ...teardownVars }
+                envVars: { ...suiteSandboxOptions.envVars, ...teardownVars }
               });
               const hr = hookResult.results.get(hook.name);
               await reporter?.onHookEnd?.({
@@ -8811,8 +9288,27 @@ async function runSuite(suite, testEntries, config) {
         }
       }
     }
+    if (config.authStateCapture && results.length > 0 && results.every((result) => result.status === "passed")) {
+      try {
+        const capturedAuthState = await config.authStateCapture.capture();
+        suiteSandboxOptions = config.sandboxOptions ? { ...config.sandboxOptions, authState: capturedAuthState } : config.sandboxOptions;
+      } catch {
+        const captureFailureResult = {
+          runId: suiteRunId,
+          name: "Auth state capture",
+          filePath: "",
+          status: "failed",
+          steps: [],
+          duration: 0,
+          failureSummary: config.authStateCapture.failureSummary,
+          metadata: { phase: "auth-state-capture" }
+        };
+        results.push(captureFailureResult);
+        await reporter?.onTestEnd(captureFailureResult);
+      }
+    }
   } finally {
-    if (suite.teardown?.length && config.resolvedHooks && config.sandboxOptions) {
+    if (suite.teardown?.length && config.resolvedHooks && suiteSandboxOptions) {
       const teardownVars = {};
       if (config.envFileVars) Object.assign(teardownVars, config.envFileVars);
       if (config.inlineVars) Object.assign(teardownVars, config.inlineVars);
@@ -8821,14 +9317,14 @@ async function runSuite(suite, testEntries, config) {
       for (const hookId of suite.teardown) {
         const hook = config.resolvedHooks.get(hookId);
         if (!hook) continue;
-        const hookExecId = randomUUID3();
+        const hookExecId = randomUUID4();
         try {
           await reporter?.onHookStart?.({ hookId: hook.id, hookName: hook.name, phase: "teardown", hookExecutionId: hookExecId, runId: suiteRunId });
           const hookResult = await runHooks([hook], {
-            ...config.sandboxOptions,
+            ...suiteSandboxOptions,
             secretStore: config.secretStore,
             secretRedactor: config.secretRedactor,
-            envVars: { ...config.sandboxOptions.envVars, ...teardownVars }
+            envVars: { ...suiteSandboxOptions.envVars, ...teardownVars }
           });
           const hr = hookResult.results.get(hook.name);
           await reporter?.onHookEnd?.({
@@ -8887,20 +9383,20 @@ async function runSuite(suite, testEntries, config) {
 }
 
 // src/validation/validate.ts
-import { readFile as readFile10 } from "fs/promises";
+import { readFile as readFile12 } from "fs/promises";
 import { existsSync as existsSync6 } from "fs";
-import path4 from "path";
+import path6 from "path";
 import { parse as parseYaml4, LineCounter as LineCounter2, parseDocument } from "yaml";
 import { glob as glob2 } from "glob";
 
 // src/hooks/parser.ts
-import { readFile as readFile9 } from "fs/promises";
+import { readFile as readFile11 } from "fs/promises";
 import { dirname as dirname9, resolve as resolve5 } from "path";
 import { parse as parseYaml3 } from "yaml";
 async function parseHooksFile(filePath) {
   let raw;
   try {
-    raw = await readFile9(filePath, "utf-8");
+    raw = await readFile11(filePath, "utf-8");
   } catch (err) {
     return { hooks: [], errors: [`Failed to read hooks file: ${err.message}`] };
   }
@@ -8928,20 +9424,20 @@ async function parseHooksFile(filePath) {
 }
 
 // src/utils/path-validation.ts
-import path2 from "path";
+import path4 from "path";
 function isPathInsideDir(childPath, parentDir) {
   if (!childPath) return false;
-  const resolved = path2.resolve(parentDir, childPath);
-  const relative2 = path2.relative(parentDir, resolved);
-  return !!relative2 && !relative2.startsWith("..") && !path2.isAbsolute(relative2);
+  const resolved = path4.resolve(parentDir, childPath);
+  const relative2 = path4.relative(parentDir, resolved);
+  return !!relative2 && !relative2.startsWith("..") && !path4.isAbsolute(relative2);
 }
 
 // src/workspace/workspace-paths.ts
 import { existsSync as existsSync5 } from "fs";
-import path3 from "path";
+import path5 from "path";
 import { glob } from "glob";
 function toForwardSlash(value) {
-  return value.split(path3.sep).join("/");
+  return value.split(path5.sep).join("/");
 }
 function trimLeadingCurrentDir(value) {
   return toForwardSlash(value).replace(/^\.\//, "");
@@ -8960,16 +9456,16 @@ function assertNonEmptyString(value, key) {
 }
 function resolveWorkspaceScalar(configDir, key, configuredPath) {
   const value = assertNonEmptyString(configuredPath, key);
-  const absolutePath = path3.isAbsolute(value) ? path3.resolve(value) : path3.resolve(configDir, value);
+  const absolutePath = path5.isAbsolute(value) ? path5.resolve(value) : path5.resolve(configDir, value);
   return {
     configuredPath: value,
     absolutePath,
-    workspaceRelativePath: trimLeadingCurrentDir(path3.relative(configDir, absolutePath))
+    workspaceRelativePath: trimLeadingCurrentDir(path5.relative(configDir, absolutePath))
   };
 }
 function assertInsideWorkspace(configDir, absolutePath, filePath) {
-  const relativePath = path3.relative(configDir, absolutePath);
-  if (!relativePath || relativePath.startsWith("..") || path3.isAbsolute(relativePath)) {
+  const relativePath = path5.relative(configDir, absolutePath);
+  if (!relativePath || relativePath.startsWith("..") || path5.isAbsolute(relativePath)) {
     throw new Error(`Workspace file path escapes config directory: ${filePath}`);
   }
   return trimLeadingCurrentDir(relativePath);
@@ -9026,8 +9522,8 @@ function isIgnored(workspace, workspaceRelativePath) {
   return workspace.testPathIgnore.length > 0 && matchesAnyPattern(workspaceRelativePath, workspace.testPathIgnore);
 }
 function resolveWorkspacePaths(input) {
-  const configPath = path3.resolve(input.configPath);
-  const configDir = path3.dirname(configPath);
+  const configPath = path5.resolve(input.configPath);
+  const configDir = path5.dirname(configPath);
   const workspace = input.config.workspace;
   if (!workspace) {
     throw new Error("Missing required workspace config key: workspace");
@@ -9065,14 +9561,14 @@ async function discoverWorkspaceFiles(input) {
     absolute: true,
     nodir: true
   });
-  return matches.map((match) => path3.resolve(match)).map((absolutePath) => ({
+  return matches.map((match) => path5.resolve(match)).map((absolutePath) => ({
     kind: input.kind,
     absolutePath,
-    workspaceRelativePath: trimLeadingCurrentDir(path3.relative(input.workspace.configDir, absolutePath))
+    workspaceRelativePath: trimLeadingCurrentDir(path5.relative(input.workspace.configDir, absolutePath))
   })).sort((a, b) => a.workspaceRelativePath.localeCompare(b.workspaceRelativePath));
 }
 async function resolveWorkspaceFileTarget(input) {
-  const absolutePath = path3.isAbsolute(input.filePath) ? path3.resolve(input.filePath) : path3.resolve(input.workspace.configDir, input.filePath);
+  const absolutePath = path5.isAbsolute(input.filePath) ? path5.resolve(input.filePath) : path5.resolve(input.workspace.configDir, input.filePath);
   const workspaceRelativePath = assertInsideWorkspace(input.workspace.configDir, absolutePath, input.filePath);
   if (!isWorkspacePathMatch({
     workspace: input.workspace,
@@ -9100,7 +9596,7 @@ async function validateConfig(configPath) {
   const diagnostics = [];
   let content;
   try {
-    content = await readFile10(configPath, "utf-8");
+    content = await readFile12(configPath, "utf-8");
   } catch (err) {
     diagnostics.push({
       file: configPath,
@@ -9202,7 +9698,7 @@ function validateSuiteFile(filePath, content, basedir) {
       });
       continue;
     }
-    const resolved = path4.resolve(basedir, testPath);
+    const resolved = path6.resolve(basedir, testPath);
     if (!existsSync6(resolved)) {
       let line = 1;
       let column = 1;
@@ -9224,7 +9720,7 @@ function validateSuiteFile(filePath, content, basedir) {
   return diagnostics;
 }
 function validateFilename(filePath) {
-  const basename3 = path4.basename(filePath);
+  const basename3 = path6.basename(filePath);
   if (!VALID_FILENAME_RE.test(basename3)) {
     return [{
       file: filePath,
@@ -9331,7 +9827,7 @@ async function validateFiles(filePaths, configPath, options = {}) {
     diagnostics.push(...validateFilename(filePath));
     let content;
     try {
-      content = await readFile10(filePath, "utf-8");
+      content = await readFile12(filePath, "utf-8");
     } catch (err) {
       diagnostics.push({
         file: filePath,
@@ -9411,7 +9907,7 @@ async function validateProject(options = {}) {
     }
     filePaths = resolvedFiles;
   } else if (options.files && options.files.length > 0) {
-    filePaths = options.files.map((f) => path4.resolve(f));
+    filePaths = options.files.map((f) => path6.resolve(f));
   } else if (options.workspace) {
     const [testFiles, suiteFiles] = await Promise.all([
       discoverWorkspaceFiles({ workspace: options.workspace, kind: "test" }),
@@ -9458,11 +9954,11 @@ async function validateProject(options = {}) {
     const { hooks } = await parseHooksFile(hooksFilePath);
     const hookIds = new Set(hooks.map((h) => h.id));
     for (const filePath of filePaths) {
-      const workspaceRelativePath = options.workspace ? path4.relative(options.workspace.configDir, filePath).split(path4.sep).join("/") : filePath;
+      const workspaceRelativePath = options.workspace ? path6.relative(options.workspace.configDir, filePath).split(path6.sep).join("/") : filePath;
       const isWorkspaceFile = options.workspace ? isWorkspacePathMatch({ workspace: options.workspace, kind: isSuiteFile(filePath) ? "suite" : "test", workspaceRelativePath }) : true;
       if (!isWorkspaceFile) continue;
       try {
-        const content = await readFile10(filePath, "utf-8");
+        const content = await readFile12(filePath, "utf-8");
         const parsed = parseYaml4(content);
         if (parsed && typeof parsed === "object") {
           const setup = parsed.setup;
@@ -9559,27 +10055,27 @@ function warnIfOutOfBounds(coords, viewport, actionType) {
 }
 
 // src/hooks/migrate-hook-refs.ts
-import { mkdir as mkdir6, readFile as readFile11, rm as rm2, writeFile as writeFile6 } from "fs/promises";
+import { mkdir as mkdir7, readFile as readFile13, rm as rm3, writeFile as writeFile7 } from "fs/promises";
 import { dirname as dirname10, relative, resolve as resolve6 } from "path";
 import { parse as parseYaml5, stringify as stringifyYaml2 } from "yaml";
-import { z as z20 } from "zod";
+import { z as z21 } from "zod";
 import { generateHookId, isCanonicalHookId as isCanonicalHookId5 } from "@vostride/agent-qa-ids";
 var DEFAULT_CLEANUP_TARGETS = [
   ".agent-qa"
 ];
 var HOOK_INLINE_RE = /\{\{runHook:"([^"]+)"\}\}/g;
-var MigratableHookDefinitionSchema = z20.object({
-  id: z20.string().optional(),
-  name: z20.string().min(1),
-  runtime: z20.enum(["node", "bun", "python", "bash"]),
-  file: z20.string().min(1),
-  deps: z20.array(z20.string()).optional(),
-  packageFile: z20.string().optional(),
-  timeout: z20.string().min(1),
-  network: z20.boolean().optional()
+var MigratableHookDefinitionSchema = z21.object({
+  id: z21.string().optional(),
+  name: z21.string().min(1),
+  runtime: z21.enum(["node", "bun", "python", "bash"]),
+  file: z21.string().min(1),
+  deps: z21.array(z21.string()).optional(),
+  packageFile: z21.string().optional(),
+  timeout: z21.string().min(1),
+  network: z21.boolean().optional()
 }).strict();
-var MigratableHooksFileSchema = z20.object({
-  hooks: z20.array(MigratableHookDefinitionSchema).min(1)
+var MigratableHooksFileSchema = z21.object({
+  hooks: z21.array(MigratableHookDefinitionSchema).min(1)
 }).strict();
 var HookReferenceMigrationError = class extends Error {
   errors;
@@ -9667,7 +10163,7 @@ function rewriteSteps(owner, filePath, hookNameToId, hookIds, errors) {
 }
 async function resolveWorkspaceMigrationContext(workspaceDir, configPath) {
   const resolvedConfigPath = configPath ? resolve6(configPath) : resolve6(workspaceDir, "agent-qa.config.yaml");
-  const rawConfig = await readFile11(resolvedConfigPath, "utf-8");
+  const rawConfig = await readFile13(resolvedConfigPath, "utf-8");
   const parsedConfig = parseYaml5(rawConfig);
   const configResult = AgentQaConfigSchema.safeParse(parsedConfig);
   if (!configResult.success) {
@@ -9711,7 +10207,7 @@ async function auditWorkspaceHookReferenceMigration(options) {
   }
   let parsedHooksFile;
   try {
-    parsedHooksFile = parseYaml5(await readFile11(context.hooksFilePath, "utf-8"));
+    parsedHooksFile = parseYaml5(await readFile13(context.hooksFilePath, "utf-8"));
   } catch (error) {
     return {
       ok: false,
@@ -9764,7 +10260,7 @@ async function auditWorkspaceHookReferenceMigration(options) {
     const absolutePath = resolve6(context.configDir, relativePath);
     let parsedFile;
     try {
-      parsedFile = parseYaml5(await readFile11(absolutePath, "utf-8"));
+      parsedFile = parseYaml5(await readFile13(absolutePath, "utf-8"));
     } catch (error) {
       errors.push(`${relativePath}: ${error.message}`);
       continue;
@@ -9805,11 +10301,11 @@ async function applyWorkspaceHookReferenceMigration(options) {
   const workspaceDir = options.configPath ? dirname10(resolve6(options.configPath)) : resolve6(options.workspaceDir);
   for (const rewrite of audit.rewriteFiles) {
     const outputPath = resolve6(workspaceDir, rewrite.path);
-    await mkdir6(dirname10(outputPath), { recursive: true });
-    await writeFile6(outputPath, rewrite.content, "utf-8");
+    await mkdir7(dirname10(outputPath), { recursive: true });
+    await writeFile7(outputPath, rewrite.content, "utf-8");
   }
   for (const cleanupTarget of audit.cleanupTargets) {
-    await rm2(resolve6(workspaceDir, cleanupTarget), { recursive: true, force: true });
+    await rm3(resolve6(workspaceDir, cleanupTarget), { recursive: true, force: true });
   }
   return audit;
 }
@@ -9878,7 +10374,7 @@ var CircuitBreaker = class {
 var RUN_ARTIFACT_SCHEMA_VERSION = 1;
 
 // src/analytics/identity.ts
-import { chmod, mkdir as mkdir8, readFile as readFile15, writeFile as writeFile8 } from "fs/promises";
+import { chmod, mkdir as mkdir9, readFile as readFile17, writeFile as writeFile9 } from "fs/promises";
 import { homedir as homedir2 } from "os";
 import { dirname as dirname13, join as join10 } from "path";
 import { idAgent } from "id-agent";
@@ -9901,24 +10397,24 @@ function parseAnalyticsIdentityStore(value) {
     needsMigration: typeof rawIsInternal !== "boolean"
   };
 }
-async function readAnalyticsIdentityStore(path5) {
-  const identityPath = path5 ?? getAnalyticsIdentityPath();
+async function readAnalyticsIdentityStore(path7) {
+  const identityPath = path7 ?? getAnalyticsIdentityPath();
   try {
-    const data = await readFile15(identityPath, "utf-8");
+    const data = await readFile17(identityPath, "utf-8");
     const parsed = JSON.parse(data);
     return parseAnalyticsIdentityStore(parsed);
   } catch {
     return null;
   }
 }
-async function readAnalyticsIdentity(path5) {
-  const parsed = await readAnalyticsIdentityStore(path5);
+async function readAnalyticsIdentity(path7) {
+  const parsed = await readAnalyticsIdentityStore(path7);
   return parsed ? { distinctId: parsed.distinctId, is_internal: parsed.is_internal } : null;
 }
-async function writeAnalyticsIdentity(distinctId, path5, isInternal = false) {
-  const identityPath = path5 ?? getAnalyticsIdentityPath();
-  await mkdir8(dirname13(identityPath), { recursive: true });
-  await writeFile8(identityPath, JSON.stringify({
+async function writeAnalyticsIdentity(distinctId, path7, isInternal = false) {
+  const identityPath = path7 ?? getAnalyticsIdentityPath();
+  await mkdir9(dirname13(identityPath), { recursive: true });
+  await writeFile9(identityPath, JSON.stringify({
     distinctId,
     is_internal: isInternal
   }, null, 2), { mode: 384 });
@@ -10130,7 +10626,7 @@ async function flushAnalytics(options) {
 }
 
 // src/analytics/events.ts
-import { z as z21 } from "zod";
+import { z as z22 } from "zod";
 var ANALYTICS_EVENT_NAMES = [
   "agent-qa.analytics.initialized",
   "agent-qa.analytics.test_event",
@@ -10207,34 +10703,34 @@ var ANALYTICS_FAILURE_CATEGORIES = [
   "unknown"
 ];
 var ANALYTICS_SUITE_EXECUTION_MODES = ["sequential", "parallel", "unknown"];
-var AnalyticsEventNameSchema = z21.enum(ANALYTICS_EVENT_NAMES);
-var NonNegativeIntegerSchema = z21.number().int().min(0);
-var NonNegativeNumberSchema = z21.number().min(0);
-var AnalyticsBasePropertiesSchema = z21.object({
-  agent_qa_version: z21.string().min(1).optional(),
-  surface: z21.enum(ANALYTICS_SURFACES).optional(),
-  runtime_context: z21.enum(ANALYTICS_RUNTIME_CONTEXTS).optional(),
-  agent_product: z21.enum(ANALYTICS_AGENT_PRODUCTS).optional(),
-  transport: z21.enum(ANALYTICS_TRANSPORT_KINDS).optional(),
-  privacy_enabled: z21.boolean().optional(),
-  posthog_key_present: z21.boolean().optional(),
-  $process_person_profile: z21.literal(false).optional()
+var AnalyticsEventNameSchema = z22.enum(ANALYTICS_EVENT_NAMES);
+var NonNegativeIntegerSchema = z22.number().int().min(0);
+var NonNegativeNumberSchema = z22.number().min(0);
+var AnalyticsBasePropertiesSchema = z22.object({
+  agent_qa_version: z22.string().min(1).optional(),
+  surface: z22.enum(ANALYTICS_SURFACES).optional(),
+  runtime_context: z22.enum(ANALYTICS_RUNTIME_CONTEXTS).optional(),
+  agent_product: z22.enum(ANALYTICS_AGENT_PRODUCTS).optional(),
+  transport: z22.enum(ANALYTICS_TRANSPORT_KINDS).optional(),
+  privacy_enabled: z22.boolean().optional(),
+  posthog_key_present: z22.boolean().optional(),
+  $process_person_profile: z22.literal(false).optional()
 }).strip();
 var AnalyticsRunPropertiesSchema = AnalyticsBasePropertiesSchema.extend({
-  trigger_source: z21.enum(ANALYTICS_TRIGGER_SOURCES).optional(),
-  runner: z21.enum(ANALYTICS_RUNNERS).optional(),
-  platform: z21.enum(ANALYTICS_PLATFORMS).optional(),
-  status: z21.enum(ANALYTICS_RUN_STATUSES).optional(),
+  trigger_source: z22.enum(ANALYTICS_TRIGGER_SOURCES).optional(),
+  runner: z22.enum(ANALYTICS_RUNNERS).optional(),
+  platform: z22.enum(ANALYTICS_PLATFORMS).optional(),
+  status: z22.enum(ANALYTICS_RUN_STATUSES).optional(),
   duration_ms: NonNegativeNumberSchema.optional(),
-  run_id: z21.string().min(1).optional(),
-  parent_run_id: z21.string().min(1).optional(),
-  test_id: z21.string().min(1).optional(),
-  suite_id: z21.string().min(1).optional(),
-  model_name: z21.string().min(1).optional(),
-  provider: z21.string().min(1).optional(),
-  provider_mode: z21.string().min(1).optional(),
-  planner_model: z21.string().min(1).optional(),
-  verifier_model: z21.string().min(1).optional(),
+  run_id: z22.string().min(1).optional(),
+  parent_run_id: z22.string().min(1).optional(),
+  test_id: z22.string().min(1).optional(),
+  suite_id: z22.string().min(1).optional(),
+  model_name: z22.string().min(1).optional(),
+  provider: z22.string().min(1).optional(),
+  provider_mode: z22.string().min(1).optional(),
+  planner_model: z22.string().min(1).optional(),
+  verifier_model: z22.string().min(1).optional(),
   input_tokens: NonNegativeIntegerSchema.optional(),
   output_tokens: NonNegativeIntegerSchema.optional(),
   total_tokens: NonNegativeIntegerSchema.optional(),
@@ -10251,16 +10747,16 @@ var AnalyticsRunPropertiesSchema = AnalyticsBasePropertiesSchema.extend({
   hook_count: NonNegativeIntegerSchema.optional(),
   failed_hook_count: NonNegativeIntegerSchema.optional(),
   retry_count: NonNegativeIntegerSchema.optional(),
-  is_flaky: z21.boolean().optional(),
-  cancelled: z21.boolean().optional(),
-  timed_out: z21.boolean().optional(),
-  failure_category: z21.enum(ANALYTICS_FAILURE_CATEGORIES).optional(),
-  browser_name: z21.string().min(1).optional(),
-  mobile_transport: z21.string().min(1).optional(),
-  mobile_provider: z21.string().min(1).optional(),
-  app_state: z21.string().min(1).optional(),
-  execution_destination: z21.string().min(1).optional(),
-  memory_enabled: z21.boolean().optional(),
+  is_flaky: z22.boolean().optional(),
+  cancelled: z22.boolean().optional(),
+  timed_out: z22.boolean().optional(),
+  failure_category: z22.enum(ANALYTICS_FAILURE_CATEGORIES).optional(),
+  browser_name: z22.string().min(1).optional(),
+  mobile_transport: z22.string().min(1).optional(),
+  mobile_provider: z22.string().min(1).optional(),
+  app_state: z22.string().min(1).optional(),
+  execution_destination: z22.string().min(1).optional(),
+  memory_enabled: z22.boolean().optional(),
   memory_injected_observation_count: NonNegativeIntegerSchema.optional(),
   memory_curator_input_tokens: NonNegativeIntegerSchema.optional(),
   memory_curator_output_tokens: NonNegativeIntegerSchema.optional(),
@@ -10274,33 +10770,33 @@ var AnalyticsRunPropertiesSchema = AnalyticsBasePropertiesSchema.extend({
   suite_passed_count: NonNegativeIntegerSchema.optional(),
   suite_failed_count: NonNegativeIntegerSchema.optional(),
   suite_skipped_count: NonNegativeIntegerSchema.optional(),
-  suite_execution_mode: z21.enum(ANALYTICS_SUITE_EXECUTION_MODES).optional(),
+  suite_execution_mode: z22.enum(ANALYTICS_SUITE_EXECUTION_MODES).optional(),
   mcp_tool_count: NonNegativeIntegerSchema.optional()
 }).strip();
 var AnalyticsDashboardOpenedPropertiesSchema = AnalyticsBasePropertiesSchema;
 var AnalyticsDashboardLiveModeStartedPropertiesSchema = AnalyticsBasePropertiesSchema.extend({
-  platform: z21.enum(ANALYTICS_PLATFORMS).optional(),
-  entity_type: z21.enum(["test", "suite", "unknown"]).optional()
+  platform: z22.enum(ANALYTICS_PLATFORMS).optional(),
+  entity_type: z22.enum(["test", "suite", "unknown"]).optional()
 }).strip();
 var AnalyticsDashboardEntityCreatedPropertiesSchema = AnalyticsBasePropertiesSchema.extend({
-  entity_type: z21.enum(["test", "suite", "hook"]).optional(),
-  outcome: z21.enum(ANALYTICS_DASHBOARD_OUTCOMES).optional()
+  entity_type: z22.enum(["test", "suite", "hook"]).optional(),
+  outcome: z22.enum(ANALYTICS_DASHBOARD_OUTCOMES).optional()
 }).strip();
 var AnalyticsMcpServerLifecyclePropertiesSchema = AnalyticsBasePropertiesSchema.extend({
-  mcp_server_state: z21.enum(ANALYTICS_MCP_SERVER_STATES).optional(),
-  mcp_transport: z21.enum(ANALYTICS_MCP_TRANSPORTS).optional(),
-  mcp_host_kind: z21.enum(ANALYTICS_MCP_HOST_KINDS).optional(),
-  mcp_port_kind: z21.enum(ANALYTICS_MCP_PORT_KINDS).optional(),
-  mcp_path_kind: z21.enum(ANALYTICS_MCP_PATH_KINDS).optional()
+  mcp_server_state: z22.enum(ANALYTICS_MCP_SERVER_STATES).optional(),
+  mcp_transport: z22.enum(ANALYTICS_MCP_TRANSPORTS).optional(),
+  mcp_host_kind: z22.enum(ANALYTICS_MCP_HOST_KINDS).optional(),
+  mcp_port_kind: z22.enum(ANALYTICS_MCP_PORT_KINDS).optional(),
+  mcp_path_kind: z22.enum(ANALYTICS_MCP_PATH_KINDS).optional()
 }).strip();
 var AnalyticsMcpToolInvokedPropertiesSchema = AnalyticsBasePropertiesSchema.extend({
-  tool_name: z21.string().min(1).optional(),
-  mcp_tool_category: z21.enum(ANALYTICS_MCP_TOOL_CATEGORIES).optional(),
-  mcp_tool_status: z21.enum(ANALYTICS_MCP_TOOL_STATUSES).optional(),
+  tool_name: z22.string().min(1).optional(),
+  mcp_tool_category: z22.enum(ANALYTICS_MCP_TOOL_CATEGORIES).optional(),
+  mcp_tool_status: z22.enum(ANALYTICS_MCP_TOOL_STATUSES).optional(),
   duration_ms: NonNegativeNumberSchema.optional(),
-  mcp_error_category: z21.enum(ANALYTICS_MCP_ERROR_CATEGORIES).optional(),
-  mcp_transport: z21.enum(ANALYTICS_MCP_TRANSPORTS).optional(),
-  run_id: z21.string().min(1).optional()
+  mcp_error_category: z22.enum(ANALYTICS_MCP_ERROR_CATEGORIES).optional(),
+  mcp_transport: z22.enum(ANALYTICS_MCP_TRANSPORTS).optional(),
+  run_id: z22.string().min(1).optional()
 }).strip();
 var AnalyticsEventPropertiesSchemaByName = {
   "agent-qa.analytics.initialized": AnalyticsRunPropertiesSchema,
@@ -10468,7 +10964,7 @@ function formatRunAttributesBlock(attributes) {
 }
 
 // src/analytics/run-reporter.ts
-function isRecord(value) {
+function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function readString(value) {
@@ -10481,9 +10977,9 @@ function readBoolean(value) {
   return typeof value === "boolean" ? value : void 0;
 }
 function readNestedRecord(source, key) {
-  if (!isRecord(source)) return void 0;
+  if (!isRecord2(source)) return void 0;
   const value = source[key];
-  return isRecord(value) ? value : void 0;
+  return isRecord2(value) ? value : void 0;
 }
 function readAttributes(value) {
   try {
@@ -10527,13 +11023,13 @@ function normalizeSuiteExecutionMode(value) {
   return void 0;
 }
 function readArtifactSource(context) {
-  return isRecord(context?.artifact?.source) ? context?.artifact?.source : void 0;
+  return isRecord2(context?.artifact?.source) ? context?.artifact?.source : void 0;
 }
 function readArtifactConfig(context) {
-  return isRecord(context?.artifact?.config) ? context?.artifact?.config : void 0;
+  return isRecord2(context?.artifact?.config) ? context?.artifact?.config : void 0;
 }
 function readArtifactRuntime(context) {
-  const artifactRuntime = isRecord(context?.artifact?.runtime) ? context?.artifact?.runtime : void 0;
+  const artifactRuntime = isRecord2(context?.artifact?.runtime) ? context?.artifact?.runtime : void 0;
   const configRuntime = readNestedRecord(readArtifactConfig(context), "runtime");
   return {
     ...configRuntime ?? {},
@@ -10641,14 +11137,14 @@ function collectMemoryMetrics(result, state) {
   if (state?.memoryInjectedObservationCount !== void 0) {
     properties.memory_injected_observation_count = state.memoryInjectedObservationCount;
   }
-  if (!isRecord(log)) return properties;
+  if (!isRecord2(log)) return properties;
   properties.memory_enabled = properties.memory_enabled ?? true;
   properties.memory_added_count = readNumber(log.added);
   properties.memory_confirmed_count = readNumber(log.confirmed);
   properties.memory_deprecated_count = readNumber(log.deprecated);
   properties.memory_deleted_count = readNumber(log.deleted);
   properties.memory_error_count = Array.isArray(log.errors) ? log.errors.length : void 0;
-  const tokenUsage = isRecord(log.tokenUsage) ? log.tokenUsage : void 0;
+  const tokenUsage = isRecord2(log.tokenUsage) ? log.tokenUsage : void 0;
   properties.memory_curator_input_tokens = readNumber(tokenUsage?.promptTokens);
   properties.memory_curator_output_tokens = readNumber(tokenUsage?.completionTokens);
   properties.memory_curator_total_tokens = readNumber(tokenUsage?.totalTokens);
@@ -10705,7 +11201,7 @@ var AnalyticsRunReporter = class {
     if (this.disabled) return;
     const runId = context?.runId ?? readString(context?.artifact?.runtime?.runId);
     if (!runId) return;
-    const runtime = isRecord(context?.artifact?.runtime) ? context?.artifact?.runtime : {};
+    const runtime = isRecord2(context?.artifact?.runtime) ? context?.artifact?.runtime : {};
     this.suiteStates.set(runId, {
       runId,
       suiteId: readSuiteId(suite, context),
@@ -10751,7 +11247,7 @@ var AnalyticsRunReporter = class {
   }
   async captureTestResult(result) {
     const state = this.findStateForResult(result);
-    const resultMetadata = isRecord(result.metadata) ? result.metadata : void 0;
+    const resultMetadata = isRecord2(result.metadata) ? result.metadata : void 0;
     const resultRuntime = readNestedRecord(resultMetadata, "runtime");
     const resultAttributes = readAttributes(resultMetadata?.attributes);
     const retryCount = typeof result.retryCount === "number" && result.retryCount >= 0 ? result.retryCount : void 0;
@@ -10831,15 +11327,6 @@ function createAnalyticsRunReporter(options = {}) {
 // src/index.ts
 init_sqlite();
 
-// src/runtime-paths.ts
-var DEFAULT_AGENT_QA_RUNTIME_DIR = ".agent-qa";
-var DEFAULT_AGENT_QA_ARTIFACTS_DIR = ".agent-qa/artifacts";
-var DEFAULT_AGENT_QA_CACHE_DIR = ".agent-qa/cache";
-var DEFAULT_AGENT_QA_SCREENSHOTS_DIR = ".agent-qa/artifacts/screenshots";
-var DEFAULT_AGENT_QA_VIDEOS_DIR = ".agent-qa/artifacts/videos";
-var DEFAULT_AGENT_QA_RUNS_DB_PATH = ".agent-qa/runs.db";
-var LEGACY_AGENT_QA_DASHBOARD_DB_PATH = ".agent-qa/dashboard.db";
-
 // src/screenshot/align.ts
 import sharp3 from "sharp";
 async function alignToWindow(buffer, opts) {
@@ -10892,6 +11379,14 @@ export {
   ANDROID_ROLE_MAP,
   ATTR_RUNNER,
   ATTR_TRIGGER,
+  AUTH_STATE_HOOK_CONTAINER_STORAGE_STATE_PATH,
+  AUTH_STATE_HOOK_JSON_ENV,
+  AUTH_STATE_HOOK_STORAGE_STATE_FILENAME,
+  AUTH_STATE_HOOK_STORAGE_STATE_PATH_ENV,
+  AUTH_STATE_HOOK_WORKSPACE_DIR,
+  AUTH_STATE_REDACTION_MARKER,
+  AUTH_STATE_SCHEMA_VERSION,
+  AUTH_STATE_SLUG_PATTERN,
   AccessibilityConfigSchema,
   ActionPlanSchema,
   AdapterLogDataSchema,
@@ -10902,6 +11397,10 @@ export {
   AssertionEvaluator,
   AssertionResultSchema,
   AuthPluginDeclarationSchema,
+  AuthStateConfigSchema,
+  AuthStateMetadataSchema,
+  AuthStateNameSchema,
+  AuthStateUseSchema,
   BaseObservationSchema,
   BrowserConfigSchema,
   CACHE_SCHEMA_VERSION,
@@ -10912,6 +11411,7 @@ export {
   ConsoleReporter,
   CuratorResponseSchema,
   DEFAULT_AGENT_QA_ARTIFACTS_DIR,
+  DEFAULT_AGENT_QA_AUTH_STATES_DIR,
   DEFAULT_AGENT_QA_CACHE_DIR,
   DEFAULT_AGENT_QA_RUNS_DB_PATH,
   DEFAULT_AGENT_QA_RUNTIME_DIR,
@@ -10982,6 +11482,7 @@ export {
   SuiteDefinitionSchema,
   SuiteObservationSchema,
   SuiteTestEntrySchema,
+  TargetNameSchema,
   TargetSchema,
   TestDefinitionSchema,
   TestMetaSchema,
@@ -11000,6 +11501,7 @@ export {
   browserstackProvider,
   buildAnalyticsEvent,
   buildAssertionPrompt,
+  buildAuthStateHookEnv,
   buildExtractionPrompt,
   buildInternalRunAttributes,
   buildMemoryIndex,
@@ -11070,7 +11572,9 @@ export {
   isBetterSqlite3NodeGypSymlinkConflict,
   isMacPlatform,
   isPathInsideDir,
+  isReservedAuthStateHookEnvKey,
   isWorkspacePathMatch,
+  listAuthStateMetadata,
   listLLMAuthProviderPlugins,
   listObservations,
   listProviders,
@@ -11079,6 +11583,7 @@ export {
   mapMobileCapabilities,
   mapWebCapabilities,
   mergeRunAttributes,
+  normalizeAuthStateUse,
   normalizeRole,
   parseAllTests,
   parseEnvFile,
@@ -11092,17 +11597,25 @@ export {
   parseTestFile,
   readAnalyticsIdentity,
   readAuth,
+  readAuthStateMetadata,
+  redactAuthStateString,
+  redactAuthStateValue,
   redactSecretValue,
   registerAllProviders,
   registerLLMAuthProviderPlugin,
   registerLLMAuthProviderPlugins,
   registerProvider,
   removeAuth,
+  removeAuthStateFiles,
+  removeAuthStateTarget,
   resetAnalyticsServiceForTests,
   resolveAnalyticsAgentProduct,
   resolveAnalyticsIdentity,
   resolveAnalyticsStandardProperties,
   resolveAppiumExecutable,
+  resolveAuthStateForRun,
+  resolveAuthStatePaths,
+  resolveAuthStateRoot,
   resolveBetterSqliteRebuildCommand,
   resolveFarmCredentials,
   resolveFileReferences,
@@ -11123,6 +11636,7 @@ export {
   shouldAblate,
   sortRunAttributesForDisplay,
   stripHookInline,
+  stripReservedAuthStateHookEnv,
   toolCallToActionPlan,
   toolSchemaMiddleware,
   truncateScreenState,
@@ -11137,6 +11651,7 @@ export {
   warnIfOutOfBounds,
   writeAnalyticsIdentity,
   writeAuth,
+  writeAuthStateFiles,
   writeObservation
 };
 //# sourceMappingURL=index.js.map